1/* Copyright (C) 1995-1998 Eric Young (eay@cryptsoft.com)
2 * All rights reserved.
3 *
4 * This package is an SSL implementation written
5 * by Eric Young (eay@cryptsoft.com).
6 * The implementation was written so as to conform with Netscapes SSL.
7 *
8 * This library is free for commercial and non-commercial use as long as
9 * the following conditions are aheared to. The following conditions
10 * apply to all code found in this distribution, be it the RC4, RSA,
11 * lhash, DES, etc., code; not just the SSL code. The SSL documentation
12 * included with this distribution is covered by the same copyright terms
13 * except that the holder is Tim Hudson (tjh@cryptsoft.com).
14 *
15 * Copyright remains Eric Young's, and as such any Copyright notices in
16 * the code are not to be removed.
17 * If this package is used in a product, Eric Young should be given attribution
18 * as the author of the parts of the library used.
19 * This can be in the form of a textual message at program startup or
20 * in documentation (online or textual) provided with the package.
21 *
22 * Redistribution and use in source and binary forms, with or without
23 * modification, are permitted provided that the following conditions
24 * are met:
25 * 1. Redistributions of source code must retain the copyright
26 * notice, this list of conditions and the following disclaimer.
27 * 2. Redistributions in binary form must reproduce the above copyright
28 * notice, this list of conditions and the following disclaimer in the
29 * documentation and/or other materials provided with the distribution.
30 * 3. All advertising materials mentioning features or use of this software
31 * must display the following acknowledgement:
32 * "This product includes cryptographic software written by
33 * Eric Young (eay@cryptsoft.com)"
34 * The word 'cryptographic' can be left out if the rouines from the library
35 * being used are not cryptographic related :-).
36 * 4. If you include any Windows specific code (or a derivative thereof) from
37 * the apps directory (application code) you must include an acknowledgement:
38 * "This product includes software written by Tim Hudson (tjh@cryptsoft.com)"
39 *
40 * THIS SOFTWARE IS PROVIDED BY ERIC YOUNG ``AS IS'' AND
41 * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
42 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
43 * ARE DISCLAIMED. IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE
44 * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
45 * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
46 * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
47 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
48 * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
49 * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
50 * SUCH DAMAGE.
51 *
52 * The licence and distribution terms for any publically available version or
53 * derivative of this code cannot be changed. i.e. this code cannot simply be
54 * copied and put under another distribution licence
55 * [including the GNU Public Licence.]
56 */
57/* ====================================================================
58 * Copyright (c) 1998-2002 The OpenSSL Project. All rights reserved.
59 *
60 * Redistribution and use in source and binary forms, with or without
61 * modification, are permitted provided that the following conditions
62 * are met:
63 *
64 * 1. Redistributions of source code must retain the above copyright
65 * notice, this list of conditions and the following disclaimer.
66 *
67 * 2. Redistributions in binary form must reproduce the above copyright
68 * notice, this list of conditions and the following disclaimer in
69 * the documentation and/or other materials provided with the
70 * distribution.
71 *
72 * 3. All advertising materials mentioning features or use of this
73 * software must display the following acknowledgment:
74 * "This product includes software developed by the OpenSSL Project
75 * for use in the OpenSSL Toolkit. (http://www.openssl.org/)"
76 *
77 * 4. The names "OpenSSL Toolkit" and "OpenSSL Project" must not be used to
78 * endorse or promote products derived from this software without
79 * prior written permission. For written permission, please contact
80 * openssl-core@openssl.org.
81 *
82 * 5. Products derived from this software may not be called "OpenSSL"
83 * nor may "OpenSSL" appear in their names without prior written
84 * permission of the OpenSSL Project.
85 *
86 * 6. Redistributions of any form whatsoever must retain the following
87 * acknowledgment:
88 * "This product includes software developed by the OpenSSL Project
89 * for use in the OpenSSL Toolkit (http://www.openssl.org/)"
90 *
91 * THIS SOFTWARE IS PROVIDED BY THE OpenSSL PROJECT ``AS IS'' AND ANY
92 * EXPRESSED OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
93 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
94 * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE OpenSSL PROJECT OR
95 * ITS CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
96 * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
97 * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
98 * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
99 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT,
100 * STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
101 * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED
102 * OF THE POSSIBILITY OF SUCH DAMAGE.
103 * ====================================================================
104 *
105 * This product includes cryptographic software written by Eric Young
106 * (eay@cryptsoft.com). This product includes software written by Tim
107 * Hudson (tjh@cryptsoft.com). */
108/* ====================================================================
109 * Copyright 2002 Sun Microsystems, Inc. ALL RIGHTS RESERVED.
110 * ECC cipher suite support in OpenSSL originally developed by
111 * SUN MICROSYSTEMS, INC., and contributed to the OpenSSL project. */
112
113#include <openssl/ssl.h>
114
115#include <assert.h>
116
117#include <utility>
118
119#include <openssl/rand.h>
120
121#include "../crypto/internal.h"
122#include "internal.h"
123
124
125BSSL_NAMESPACE_BEGIN
126
127SSL_HANDSHAKE::SSL_HANDSHAKE(SSL *ssl_arg)
128 : ssl(ssl_arg),
129 ech_is_inner(false),
130 ech_authenticated_reject(false),
131 scts_requested(false),
132 handshake_finalized(false),
133 accept_psk_mode(false),
134 cert_request(false),
135 certificate_status_expected(false),
136 ocsp_stapling_requested(false),
137 delegated_credential_requested(false),
138 should_ack_sni(false),
139 in_false_start(false),
140 in_early_data(false),
141 early_data_offered(false),
142 can_early_read(false),
143 can_early_write(false),
144 next_proto_neg_seen(false),
145 ticket_expected(false),
146 extended_master_secret(false),
147 pending_private_key_op(false),
148 handback(false),
149 hints_requested(false),
150 cert_compression_negotiated(false),
151 apply_jdk11_workaround(false),
152 can_release_private_key(false),
153 channel_id_negotiated(false) {
154 assert(ssl);
155
156 // Draw entropy for all GREASE values at once. This avoids calling
157 // |RAND_bytes| repeatedly and makes the values consistent within a
158 // connection. The latter is so the second ClientHello matches after
159 // HelloRetryRequest and so supported_groups and key_shares are consistent.
160 RAND_bytes(buf: grease_seed, len: sizeof(grease_seed));
161}
162
163SSL_HANDSHAKE::~SSL_HANDSHAKE() {
164 ssl->ctx->x509_method->hs_flush_cached_ca_names(this);
165}
166
167void SSL_HANDSHAKE::ResizeSecrets(size_t hash_len) {
168 if (hash_len > SSL_MAX_MD_SIZE) {
169 abort();
170 }
171 hash_len_ = hash_len;
172}
173
174bool SSL_HANDSHAKE::GetClientHello(SSLMessage *out_msg,
175 SSL_CLIENT_HELLO *out_client_hello) {
176 if (!ech_client_hello_buf.empty()) {
177 // If the backing buffer is non-empty, the ClientHelloInner has been set.
178 out_msg->is_v2_hello = false;
179 out_msg->type = SSL3_MT_CLIENT_HELLO;
180 out_msg->raw = CBS(ech_client_hello_buf);
181 out_msg->body = MakeConstSpan(c: ech_client_hello_buf).subspan(pos: 4);
182 } else if (!ssl->method->get_message(ssl, out_msg)) {
183 // The message has already been read, so this cannot fail.
184 OPENSSL_PUT_ERROR(SSL, ERR_R_INTERNAL_ERROR);
185 return false;
186 }
187
188 if (!ssl_client_hello_init(ssl, out: out_client_hello, body: out_msg->body)) {
189 OPENSSL_PUT_ERROR(SSL, SSL_R_CLIENTHELLO_PARSE_FAILED);
190 ssl_send_alert(ssl, SSL3_AL_FATAL, SSL_AD_DECODE_ERROR);
191 return false;
192 }
193 return true;
194}
195
196UniquePtr<SSL_HANDSHAKE> ssl_handshake_new(SSL *ssl) {
197 UniquePtr<SSL_HANDSHAKE> hs = MakeUnique<SSL_HANDSHAKE>(args&: ssl);
198 if (!hs || !hs->transcript.Init()) {
199 return nullptr;
200 }
201 hs->config = ssl->config.get();
202 if (!hs->config) {
203 assert(hs->config);
204 return nullptr;
205 }
206 return hs;
207}
208
209bool ssl_check_message_type(SSL *ssl, const SSLMessage &msg, int type) {
210 if (msg.type != type) {
211 ssl_send_alert(ssl, SSL3_AL_FATAL, SSL_AD_UNEXPECTED_MESSAGE);
212 OPENSSL_PUT_ERROR(SSL, SSL_R_UNEXPECTED_MESSAGE);
213 ERR_add_error_dataf(format: "got type %d, wanted type %d", msg.type, type);
214 return false;
215 }
216
217 return true;
218}
219
220bool ssl_add_message_cbb(SSL *ssl, CBB *cbb) {
221 Array<uint8_t> msg;
222 if (!ssl->method->finish_message(ssl, cbb, &msg) ||
223 !ssl->method->add_message(ssl, std::move(msg))) {
224 return false;
225 }
226
227 return true;
228}
229
230size_t ssl_max_handshake_message_len(const SSL *ssl) {
231 // kMaxMessageLen is the default maximum message size for handshakes which do
232 // not accept peer certificate chains.
233 static const size_t kMaxMessageLen = 16384;
234
235 if (SSL_in_init(ssl)) {
236 SSL_CONFIG *config = ssl->config.get(); // SSL_in_init() implies not NULL.
237 if ((!ssl->server || (config->verify_mode & SSL_VERIFY_PEER)) &&
238 kMaxMessageLen < ssl->max_cert_list) {
239 return ssl->max_cert_list;
240 }
241 return kMaxMessageLen;
242 }
243
244 if (ssl_protocol_version(ssl) < TLS1_3_VERSION) {
245 // In TLS 1.2 and below, the largest acceptable post-handshake message is
246 // a HelloRequest.
247 return 0;
248 }
249
250 if (ssl->server) {
251 // The largest acceptable post-handshake message for a server is a
252 // KeyUpdate. We will never initiate post-handshake auth.
253 return 1;
254 }
255
256 // Clients must accept NewSessionTicket, so allow the default size.
257 return kMaxMessageLen;
258}
259
260bool ssl_hash_message(SSL_HANDSHAKE *hs, const SSLMessage &msg) {
261 // V2ClientHello messages are pre-hashed.
262 if (msg.is_v2_hello) {
263 return true;
264 }
265
266 return hs->transcript.Update(in: msg.raw);
267}
268
269bool ssl_parse_extensions(const CBS *cbs, uint8_t *out_alert,
270 std::initializer_list<SSLExtension *> extensions,
271 bool ignore_unknown) {
272 // Reset everything.
273 for (SSLExtension *ext : extensions) {
274 ext->present = false;
275 CBS_init(cbs: &ext->data, data: nullptr, len: 0);
276 if (!ext->allowed) {
277 assert(!ignore_unknown);
278 }
279 }
280
281 CBS copy = *cbs;
282 while (CBS_len(cbs: &copy) != 0) {
283 uint16_t type;
284 CBS data;
285 if (!CBS_get_u16(cbs: &copy, out: &type) ||
286 !CBS_get_u16_length_prefixed(cbs: &copy, out: &data)) {
287 OPENSSL_PUT_ERROR(SSL, SSL_R_PARSE_TLSEXT);
288 *out_alert = SSL_AD_DECODE_ERROR;
289 return false;
290 }
291
292 SSLExtension *found = nullptr;
293 for (SSLExtension *ext : extensions) {
294 if (type == ext->type && ext->allowed) {
295 found = ext;
296 break;
297 }
298 }
299
300 if (found == nullptr) {
301 if (ignore_unknown) {
302 continue;
303 }
304 OPENSSL_PUT_ERROR(SSL, SSL_R_UNEXPECTED_EXTENSION);
305 *out_alert = SSL_AD_UNSUPPORTED_EXTENSION;
306 return false;
307 }
308
309 // Duplicate ext_types are forbidden.
310 if (found->present) {
311 OPENSSL_PUT_ERROR(SSL, SSL_R_DUPLICATE_EXTENSION);
312 *out_alert = SSL_AD_ILLEGAL_PARAMETER;
313 return false;
314 }
315
316 found->present = true;
317 found->data = data;
318 }
319
320 return true;
321}
322
323enum ssl_verify_result_t ssl_verify_peer_cert(SSL_HANDSHAKE *hs) {
324 SSL *const ssl = hs->ssl;
325 const SSL_SESSION *prev_session = ssl->s3->established_session.get();
326 if (prev_session != NULL) {
327 // If renegotiating, the server must not change the server certificate. See
328 // https://mitls.org/pages/attacks/3SHAKE. We never resume on renegotiation,
329 // so this check is sufficient to ensure the reported peer certificate never
330 // changes on renegotiation.
331 assert(!ssl->server);
332 if (sk_CRYPTO_BUFFER_num(sk: prev_session->certs.get()) !=
333 sk_CRYPTO_BUFFER_num(sk: hs->new_session->certs.get())) {
334 OPENSSL_PUT_ERROR(SSL, SSL_R_SERVER_CERT_CHANGED);
335 ssl_send_alert(ssl, SSL3_AL_FATAL, SSL_AD_ILLEGAL_PARAMETER);
336 return ssl_verify_invalid;
337 }
338
339 for (size_t i = 0; i < sk_CRYPTO_BUFFER_num(sk: hs->new_session->certs.get());
340 i++) {
341 const CRYPTO_BUFFER *old_cert =
342 sk_CRYPTO_BUFFER_value(sk: prev_session->certs.get(), i);
343 const CRYPTO_BUFFER *new_cert =
344 sk_CRYPTO_BUFFER_value(sk: hs->new_session->certs.get(), i);
345 if (CRYPTO_BUFFER_len(buf: old_cert) != CRYPTO_BUFFER_len(buf: new_cert) ||
346 OPENSSL_memcmp(s1: CRYPTO_BUFFER_data(buf: old_cert),
347 s2: CRYPTO_BUFFER_data(buf: new_cert),
348 n: CRYPTO_BUFFER_len(buf: old_cert)) != 0) {
349 OPENSSL_PUT_ERROR(SSL, SSL_R_SERVER_CERT_CHANGED);
350 ssl_send_alert(ssl, SSL3_AL_FATAL, SSL_AD_ILLEGAL_PARAMETER);
351 return ssl_verify_invalid;
352 }
353 }
354
355 // The certificate is identical, so we may skip re-verifying the
356 // certificate. Since we only authenticated the previous one, copy other
357 // authentication from the established session and ignore what was newly
358 // received.
359 hs->new_session->ocsp_response = UpRef(ptr: prev_session->ocsp_response);
360 hs->new_session->signed_cert_timestamp_list =
361 UpRef(ptr: prev_session->signed_cert_timestamp_list);
362 hs->new_session->verify_result = prev_session->verify_result;
363 return ssl_verify_ok;
364 }
365
366 uint8_t alert = SSL_AD_CERTIFICATE_UNKNOWN;
367 enum ssl_verify_result_t ret;
368 if (hs->config->custom_verify_callback != nullptr) {
369 ret = hs->config->custom_verify_callback(ssl, &alert);
370 switch (ret) {
371 case ssl_verify_ok:
372 hs->new_session->verify_result = X509_V_OK;
373 break;
374 case ssl_verify_invalid:
375 // If |SSL_VERIFY_NONE|, the error is non-fatal, but we keep the result.
376 if (hs->config->verify_mode == SSL_VERIFY_NONE) {
377 ERR_clear_error();
378 ret = ssl_verify_ok;
379 }
380 hs->new_session->verify_result = X509_V_ERR_APPLICATION_VERIFICATION;
381 break;
382 case ssl_verify_retry:
383 break;
384 }
385 } else {
386 ret = ssl->ctx->x509_method->session_verify_cert_chain(
387 hs->new_session.get(), hs, &alert)
388 ? ssl_verify_ok
389 : ssl_verify_invalid;
390 }
391
392 if (ret == ssl_verify_invalid) {
393 OPENSSL_PUT_ERROR(SSL, SSL_R_CERTIFICATE_VERIFY_FAILED);
394 ssl_send_alert(ssl, SSL3_AL_FATAL, desc: alert);
395 }
396
397 // Emulate OpenSSL's client OCSP callback. OpenSSL verifies certificates
398 // before it receives the OCSP, so it needs a second callback for OCSP.
399 if (ret == ssl_verify_ok && !ssl->server &&
400 hs->config->ocsp_stapling_enabled &&
401 ssl->ctx->legacy_ocsp_callback != nullptr) {
402 int cb_ret =
403 ssl->ctx->legacy_ocsp_callback(ssl, ssl->ctx->legacy_ocsp_callback_arg);
404 if (cb_ret <= 0) {
405 OPENSSL_PUT_ERROR(SSL, SSL_R_OCSP_CB_ERROR);
406 ssl_send_alert(ssl, SSL3_AL_FATAL,
407 desc: cb_ret == 0 ? SSL_AD_BAD_CERTIFICATE_STATUS_RESPONSE
408 : SSL_AD_INTERNAL_ERROR);
409 ret = ssl_verify_invalid;
410 }
411 }
412
413 return ret;
414}
415
416// Verifies a stored certificate when resuming a session. A few things are
417// different from verify_peer_cert:
418// 1. We can't be renegotiating if we're resuming a session.
419// 2. The session is immutable, so we don't support verify_mode ==
420// SSL_VERIFY_NONE
421// 3. We don't call the OCSP callback.
422// 4. We only support custom verify callbacks.
423enum ssl_verify_result_t ssl_reverify_peer_cert(SSL_HANDSHAKE *hs,
424 bool send_alert) {
425 SSL *const ssl = hs->ssl;
426 assert(ssl->s3->established_session == nullptr);
427 assert(hs->config->verify_mode != SSL_VERIFY_NONE);
428
429 uint8_t alert = SSL_AD_CERTIFICATE_UNKNOWN;
430 enum ssl_verify_result_t ret = ssl_verify_invalid;
431 if (hs->config->custom_verify_callback != nullptr) {
432 ret = hs->config->custom_verify_callback(ssl, &alert);
433 }
434
435 if (ret == ssl_verify_invalid) {
436 OPENSSL_PUT_ERROR(SSL, SSL_R_CERTIFICATE_VERIFY_FAILED);
437 if (send_alert) {
438 ssl_send_alert(ssl, SSL3_AL_FATAL, desc: alert);
439 }
440 }
441
442 return ret;
443}
444
445static uint16_t grease_index_to_value(const SSL_HANDSHAKE *hs,
446 enum ssl_grease_index_t index) {
447 // This generates a random value of the form 0xωaωa, for all 0 ≤ ω < 16.
448 uint16_t ret = hs->grease_seed[index];
449 ret = (ret & 0xf0) | 0x0a;
450 ret |= ret << 8;
451 return ret;
452}
453
454uint16_t ssl_get_grease_value(const SSL_HANDSHAKE *hs,
455 enum ssl_grease_index_t index) {
456 uint16_t ret = grease_index_to_value(hs, index);
457 if (index == ssl_grease_extension2 &&
458 ret == grease_index_to_value(hs, index: ssl_grease_extension1)) {
459 // The two fake extensions must not have the same value. GREASE values are
460 // of the form 0x1a1a, 0x2a2a, 0x3a3a, etc., so XOR to generate a different
461 // one.
462 ret ^= 0x1010;
463 }
464 return ret;
465}
466
467enum ssl_hs_wait_t ssl_get_finished(SSL_HANDSHAKE *hs) {
468 SSL *const ssl = hs->ssl;
469 SSLMessage msg;
470 if (!ssl->method->get_message(ssl, &msg)) {
471 return ssl_hs_read_message;
472 }
473
474 if (!ssl_check_message_type(ssl, msg, SSL3_MT_FINISHED)) {
475 return ssl_hs_error;
476 }
477
478 // Snapshot the finished hash before incorporating the new message.
479 uint8_t finished[EVP_MAX_MD_SIZE];
480 size_t finished_len;
481 if (!hs->transcript.GetFinishedMAC(out: finished, out_len: &finished_len,
482 session: ssl_handshake_session(hs), from_server: !ssl->server) ||
483 !ssl_hash_message(hs, msg)) {
484 return ssl_hs_error;
485 }
486
487 int finished_ok = CBS_mem_equal(cbs: &msg.body, data: finished, len: finished_len);
488#if defined(BORINGSSL_UNSAFE_FUZZER_MODE)
489 finished_ok = 1;
490#endif
491 if (!finished_ok) {
492 ssl_send_alert(ssl, SSL3_AL_FATAL, SSL_AD_DECRYPT_ERROR);
493 OPENSSL_PUT_ERROR(SSL, SSL_R_DIGEST_CHECK_FAILED);
494 return ssl_hs_error;
495 }
496
497 // Copy the Finished so we can use it for renegotiation checks.
498 if (finished_len > sizeof(ssl->s3->previous_client_finished) ||
499 finished_len > sizeof(ssl->s3->previous_server_finished)) {
500 OPENSSL_PUT_ERROR(SSL, ERR_R_INTERNAL_ERROR);
501 return ssl_hs_error;
502 }
503
504 if (ssl->server) {
505 OPENSSL_memcpy(dst: ssl->s3->previous_client_finished, src: finished, n: finished_len);
506 ssl->s3->previous_client_finished_len = finished_len;
507 } else {
508 OPENSSL_memcpy(dst: ssl->s3->previous_server_finished, src: finished, n: finished_len);
509 ssl->s3->previous_server_finished_len = finished_len;
510 }
511
512 // The Finished message should be the end of a flight.
513 if (ssl->method->has_unprocessed_handshake_data(ssl)) {
514 ssl_send_alert(ssl, SSL3_AL_FATAL, SSL_AD_UNEXPECTED_MESSAGE);
515 OPENSSL_PUT_ERROR(SSL, SSL_R_EXCESS_HANDSHAKE_DATA);
516 return ssl_hs_error;
517 }
518
519 ssl->method->next_message(ssl);
520 return ssl_hs_ok;
521}
522
523bool ssl_send_finished(SSL_HANDSHAKE *hs) {
524 SSL *const ssl = hs->ssl;
525 const SSL_SESSION *session = ssl_handshake_session(hs);
526
527 uint8_t finished[EVP_MAX_MD_SIZE];
528 size_t finished_len;
529 if (!hs->transcript.GetFinishedMAC(out: finished, out_len: &finished_len, session,
530 from_server: ssl->server)) {
531 return false;
532 }
533
534 // Log the master secret, if logging is enabled.
535 if (!ssl_log_secret(ssl, label: "CLIENT_RANDOM",
536 secret: MakeConstSpan(ptr: session->secret, size: session->secret_length))) {
537 return false;
538 }
539
540 // Copy the Finished so we can use it for renegotiation checks.
541 if (finished_len > sizeof(ssl->s3->previous_client_finished) ||
542 finished_len > sizeof(ssl->s3->previous_server_finished)) {
543 OPENSSL_PUT_ERROR(SSL, ERR_R_INTERNAL_ERROR);
544 return false;
545 }
546
547 if (ssl->server) {
548 OPENSSL_memcpy(dst: ssl->s3->previous_server_finished, src: finished, n: finished_len);
549 ssl->s3->previous_server_finished_len = finished_len;
550 } else {
551 OPENSSL_memcpy(dst: ssl->s3->previous_client_finished, src: finished, n: finished_len);
552 ssl->s3->previous_client_finished_len = finished_len;
553 }
554
555 ScopedCBB cbb;
556 CBB body;
557 if (!ssl->method->init_message(ssl, cbb.get(), &body, SSL3_MT_FINISHED) ||
558 !CBB_add_bytes(cbb: &body, data: finished, len: finished_len) ||
559 !ssl_add_message_cbb(ssl, cbb: cbb.get())) {
560 OPENSSL_PUT_ERROR(SSL, ERR_R_INTERNAL_ERROR);
561 return false;
562 }
563
564 return true;
565}
566
567bool ssl_output_cert_chain(SSL_HANDSHAKE *hs) {
568 ScopedCBB cbb;
569 CBB body;
570 if (!hs->ssl->method->init_message(hs->ssl, cbb.get(), &body,
571 SSL3_MT_CERTIFICATE) ||
572 !ssl_add_cert_chain(hs, cbb: &body) ||
573 !ssl_add_message_cbb(ssl: hs->ssl, cbb: cbb.get())) {
574 OPENSSL_PUT_ERROR(SSL, ERR_R_INTERNAL_ERROR);
575 return false;
576 }
577
578 return true;
579}
580
581const SSL_SESSION *ssl_handshake_session(const SSL_HANDSHAKE *hs) {
582 if (hs->new_session) {
583 return hs->new_session.get();
584 }
585 return hs->ssl->session.get();
586}
587
588int ssl_run_handshake(SSL_HANDSHAKE *hs, bool *out_early_return) {
589 SSL *const ssl = hs->ssl;
590 for (;;) {
591 // Resolve the operation the handshake was waiting on. Each condition may
592 // halt the handshake by returning, or continue executing if the handshake
593 // may immediately proceed. Cases which halt the handshake can clear
594 // |hs->wait| to re-enter the state machine on the next iteration, or leave
595 // it set to keep the condition sticky.
596 switch (hs->wait) {
597 case ssl_hs_error:
598 ERR_restore_state(state: hs->error.get());
599 return -1;
600
601 case ssl_hs_flush: {
602 int ret = ssl->method->flush_flight(ssl);
603 if (ret <= 0) {
604 return ret;
605 }
606 break;
607 }
608
609 case ssl_hs_read_server_hello:
610 case ssl_hs_read_message:
611 case ssl_hs_read_change_cipher_spec: {
612 if (ssl->quic_method) {
613 // QUIC has no ChangeCipherSpec messages.
614 assert(hs->wait != ssl_hs_read_change_cipher_spec);
615 // The caller should call |SSL_provide_quic_data|. Clear |hs->wait| so
616 // the handshake can check if there is sufficient data next iteration.
617 ssl->s3->rwstate = SSL_ERROR_WANT_READ;
618 hs->wait = ssl_hs_ok;
619 return -1;
620 }
621
622 uint8_t alert = SSL_AD_DECODE_ERROR;
623 size_t consumed = 0;
624 ssl_open_record_t ret;
625 if (hs->wait == ssl_hs_read_change_cipher_spec) {
626 ret = ssl_open_change_cipher_spec(ssl, out_consumed: &consumed, out_alert: &alert,
627 in: ssl->s3->read_buffer.span());
628 } else {
629 ret = ssl_open_handshake(ssl, out_consumed: &consumed, out_alert: &alert,
630 in: ssl->s3->read_buffer.span());
631 }
632 if (ret == ssl_open_record_error &&
633 hs->wait == ssl_hs_read_server_hello) {
634 uint32_t err = ERR_peek_error();
635 if (ERR_GET_LIB(packed_error: err) == ERR_LIB_SSL &&
636 ERR_GET_REASON(packed_error: err) == SSL_R_SSLV3_ALERT_HANDSHAKE_FAILURE) {
637 // Add a dedicated error code to the queue for a handshake_failure
638 // alert in response to ClientHello. This matches NSS's client
639 // behavior and gives a better error on a (probable) failure to
640 // negotiate initial parameters. Note: this error code comes after
641 // the original one.
642 //
643 // See https://crbug.com/446505.
644 OPENSSL_PUT_ERROR(SSL, SSL_R_HANDSHAKE_FAILURE_ON_CLIENT_HELLO);
645 }
646 }
647 bool retry;
648 int bio_ret = ssl_handle_open_record(ssl, out_retry: &retry, ret, consumed, alert);
649 if (bio_ret <= 0) {
650 return bio_ret;
651 }
652 if (retry) {
653 continue;
654 }
655 ssl->s3->read_buffer.DiscardConsumed();
656 break;
657 }
658
659 case ssl_hs_read_end_of_early_data: {
660 if (ssl->s3->hs->can_early_read) {
661 // While we are processing early data, the handshake returns early.
662 *out_early_return = true;
663 return 1;
664 }
665 hs->wait = ssl_hs_ok;
666 break;
667 }
668
669 case ssl_hs_certificate_selection_pending:
670 ssl->s3->rwstate = SSL_ERROR_PENDING_CERTIFICATE;
671 hs->wait = ssl_hs_ok;
672 return -1;
673
674 case ssl_hs_handoff:
675 ssl->s3->rwstate = SSL_ERROR_HANDOFF;
676 hs->wait = ssl_hs_ok;
677 return -1;
678
679 case ssl_hs_handback: {
680 int ret = ssl->method->flush_flight(ssl);
681 if (ret <= 0) {
682 return ret;
683 }
684 ssl->s3->rwstate = SSL_ERROR_HANDBACK;
685 hs->wait = ssl_hs_handback;
686 return -1;
687 }
688
689 // The following cases are associated with callback APIs which expect to
690 // be called each time the state machine runs. Thus they set |hs->wait|
691 // to |ssl_hs_ok| so that, next time, we re-enter the state machine and
692 // call the callback again.
693 case ssl_hs_x509_lookup:
694 ssl->s3->rwstate = SSL_ERROR_WANT_X509_LOOKUP;
695 hs->wait = ssl_hs_ok;
696 return -1;
697 case ssl_hs_private_key_operation:
698 ssl->s3->rwstate = SSL_ERROR_WANT_PRIVATE_KEY_OPERATION;
699 hs->wait = ssl_hs_ok;
700 return -1;
701 case ssl_hs_pending_session:
702 ssl->s3->rwstate = SSL_ERROR_PENDING_SESSION;
703 hs->wait = ssl_hs_ok;
704 return -1;
705 case ssl_hs_pending_ticket:
706 ssl->s3->rwstate = SSL_ERROR_PENDING_TICKET;
707 hs->wait = ssl_hs_ok;
708 return -1;
709 case ssl_hs_certificate_verify:
710 ssl->s3->rwstate = SSL_ERROR_WANT_CERTIFICATE_VERIFY;
711 hs->wait = ssl_hs_ok;
712 return -1;
713
714 case ssl_hs_early_data_rejected:
715 assert(ssl->s3->early_data_reason != ssl_early_data_unknown);
716 assert(!hs->can_early_write);
717 ssl->s3->rwstate = SSL_ERROR_EARLY_DATA_REJECTED;
718 return -1;
719
720 case ssl_hs_early_return:
721 if (!ssl->server) {
722 // On ECH reject, the handshake should never complete.
723 assert(ssl->s3->ech_status != ssl_ech_rejected);
724 }
725 *out_early_return = true;
726 hs->wait = ssl_hs_ok;
727 return 1;
728
729 case ssl_hs_hints_ready:
730 ssl->s3->rwstate = SSL_ERROR_HANDSHAKE_HINTS_READY;
731 return -1;
732
733 case ssl_hs_ok:
734 break;
735 }
736
737 // Run the state machine again.
738 hs->wait = ssl->do_handshake(hs);
739 if (hs->wait == ssl_hs_error) {
740 hs->error.reset(p: ERR_save_state());
741 return -1;
742 }
743 if (hs->wait == ssl_hs_ok) {
744 if (!ssl->server) {
745 // On ECH reject, the handshake should never complete.
746 assert(ssl->s3->ech_status != ssl_ech_rejected);
747 }
748 // The handshake has completed.
749 *out_early_return = false;
750 return 1;
751 }
752
753 // Otherwise, loop to the beginning and resolve what was blocking the
754 // handshake.
755 }
756}
757
758BSSL_NAMESPACE_END
759

Provided by KDAB

Privacy Policy
Learn more about Flutter for embedded and desktop on industrialflutter.com

source code of flutter_engine/third_party/boringssl/src/ssl/handshake.cc