1 /* Copyright (C) 1995-1998 Eric Young (eay (at) cryptsoft.com) 2 * All rights reserved. 3 * 4 * This package is an SSL implementation written 5 * by Eric Young (eay (at) cryptsoft.com). 6 * The implementation was written so as to conform with Netscapes SSL. 7 * 8 * This library is free for commercial and non-commercial use as long as 9 * the following conditions are aheared to. The following conditions 10 * apply to all code found in this distribution, be it the RC4, RSA, 11 * lhash, DES, etc., code; not just the SSL code. The SSL documentation 12 * included with this distribution is covered by the same copyright terms 13 * except that the holder is Tim Hudson (tjh (at) cryptsoft.com). 14 * 15 * Copyright remains Eric Young's, and as such any Copyright notices in 16 * the code are not to be removed. 17 * If this package is used in a product, Eric Young should be given attribution 18 * as the author of the parts of the library used. 19 * This can be in the form of a textual message at program startup or 20 * in documentation (online or textual) provided with the package. 21 * 22 * Redistribution and use in source and binary forms, with or without 23 * modification, are permitted provided that the following conditions 24 * are met: 25 * 1. Redistributions of source code must retain the copyright 26 * notice, this list of conditions and the following disclaimer. 27 * 2. Redistributions in binary form must reproduce the above copyright 28 * notice, this list of conditions and the following disclaimer in the 29 * documentation and/or other materials provided with the distribution. 30 * 3. All advertising materials mentioning features or use of this software 31 * must display the following acknowledgement: 32 * "This product includes cryptographic software written by 33 * Eric Young (eay (at) cryptsoft.com)" 34 * The word 'cryptographic' can be left out if the rouines from the library 35 * being used are not cryptographic related :-). 36 * 4. If you include any Windows specific code (or a derivative thereof) from 37 * the apps directory (application code) you must include an acknowledgement: 38 * "This product includes software written by Tim Hudson (tjh (at) cryptsoft.com)" 39 * 40 * THIS SOFTWARE IS PROVIDED BY ERIC YOUNG ``AS IS'' AND 41 * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE 42 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE 43 * ARE DISCLAIMED. IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE 44 * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL 45 * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS 46 * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) 47 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT 48 * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY 49 * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF 50 * SUCH DAMAGE. 51 * 52 * The licence and distribution terms for any publically available version or 53 * derivative of this code cannot be changed. i.e. this code cannot simply be 54 * copied and put under another distribution licence 55 * [including the GNU Public Licence.] 56 */ 57 /* ==================================================================== 58 * Copyright (c) 1998-2006 The OpenSSL Project. All rights reserved. 59 * 60 * Redistribution and use in source and binary forms, with or without 61 * modification, are permitted provided that the following conditions 62 * are met: 63 * 64 * 1. Redistributions of source code must retain the above copyright 65 * notice, this list of conditions and the following disclaimer. 66 * 67 * 2. Redistributions in binary form must reproduce the above copyright 68 * notice, this list of conditions and the following disclaimer in 69 * the documentation and/or other materials provided with the 70 * distribution. 71 * 72 * 3. All advertising materials mentioning features or use of this 73 * software must display the following acknowledgment: 74 * "This product includes software developed by the OpenSSL Project 75 * for use in the OpenSSL Toolkit. (http://www.openssl.org/)" 76 * 77 * 4. The names "OpenSSL Toolkit" and "OpenSSL Project" must not be used to 78 * endorse or promote products derived from this software without 79 * prior written permission. For written permission, please contact 80 * openssl-core (at) openssl.org. 81 * 82 * 5. Products derived from this software may not be called "OpenSSL" 83 * nor may "OpenSSL" appear in their names without prior written 84 * permission of the OpenSSL Project. 85 * 86 * 6. Redistributions of any form whatsoever must retain the following 87 * acknowledgment: 88 * "This product includes software developed by the OpenSSL Project 89 * for use in the OpenSSL Toolkit (http://www.openssl.org/)" 90 * 91 * THIS SOFTWARE IS PROVIDED BY THE OpenSSL PROJECT ``AS IS'' AND ANY 92 * EXPRESSED OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE 93 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR 94 * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE OpenSSL PROJECT OR 95 * ITS CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, 96 * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT 97 * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; 98 * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) 99 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, 100 * STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) 101 * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED 102 * OF THE POSSIBILITY OF SUCH DAMAGE. 103 * ==================================================================== 104 * 105 * This product includes cryptographic software written by Eric Young 106 * (eay (at) cryptsoft.com). This product includes software written by Tim 107 * Hudson (tjh (at) cryptsoft.com). 108 * 109 */ 110 /* ==================================================================== 111 * Copyright 2005 Nokia. All rights reserved. 112 * 113 * The portions of the attached software ("Contribution") is developed by 114 * Nokia Corporation and is licensed pursuant to the OpenSSL open source 115 * license. 116 * 117 * The Contribution, originally written by Mika Kousa and Pasi Eronen of 118 * Nokia Corporation, consists of the "PSK" (Pre-Shared Key) ciphersuites 119 * support (see RFC 4279) to OpenSSL. 120 * 121 * No patent licenses or other rights except those expressly stated in 122 * the OpenSSL open source license shall be deemed granted or received 123 * expressly, by implication, estoppel, or otherwise. 124 * 125 * No assurances are provided by Nokia that the Contribution does not 126 * infringe the patent or other intellectual property rights of any third 127 * party or that the license provides you with all the necessary rights 128 * to make use of the Contribution. 129 * 130 * THE SOFTWARE IS PROVIDED "AS IS" WITHOUT WARRANTY OF ANY KIND. IN 131 * ADDITION TO THE DISCLAIMERS INCLUDED IN THE LICENSE, NOKIA 132 * SPECIFICALLY DISCLAIMS ANY LIABILITY FOR CLAIMS BROUGHT BY YOU OR ANY 133 * OTHER ENTITY BASED ON INFRINGEMENT OF INTELLECTUAL PROPERTY RIGHTS OR 134 * OTHERWISE. */ 135 136 #include <openssl/ssl.h> 137 138 #include <assert.h> 139 #include <stdlib.h> 140 #include <string.h> 141 142 #include <openssl/err.h> 143 #include <openssl/lhash.h> 144 #include <openssl/mem.h> 145 #include <openssl/rand.h> 146 147 #include "internal.h" 148 #include "../crypto/internal.h" 149 150 151 /* The address of this is a magic value, a pointer to which is returned by 152 * SSL_magic_pending_session_ptr(). It allows a session callback to indicate 153 * that it needs to asynchronously fetch session information. */ 154 static const char g_pending_session_magic = 0; 155 156 static CRYPTO_EX_DATA_CLASS g_ex_data_class = 157 CRYPTO_EX_DATA_CLASS_INIT_WITH_APP_DATA; 158 159 static void SSL_SESSION_list_remove(SSL_CTX *ctx, SSL_SESSION *session); 160 static void SSL_SESSION_list_add(SSL_CTX *ctx, SSL_SESSION *session); 161 static int remove_session_lock(SSL_CTX *ctx, SSL_SESSION *session, int lock); 162 163 SSL_SESSION *ssl_session_new(const SSL_X509_METHOD *x509_method) { 164 SSL_SESSION *session = (SSL_SESSION *)OPENSSL_malloc(sizeof(SSL_SESSION)); 165 if (session == NULL) { 166 OPENSSL_PUT_ERROR(SSL, ERR_R_MALLOC_FAILURE); 167 return 0; 168 } 169 OPENSSL_memset(session, 0, sizeof(SSL_SESSION)); 170 171 session->x509_method = x509_method; 172 session->verify_result = X509_V_ERR_INVALID_CALL; 173 session->references = 1; 174 session->timeout = SSL_DEFAULT_SESSION_TIMEOUT; 175 session->auth_timeout = SSL_DEFAULT_SESSION_TIMEOUT; 176 session->time = time(NULL); 177 CRYPTO_new_ex_data(&session->ex_data); 178 return session; 179 } 180 181 SSL_SESSION *SSL_SESSION_new(const SSL_CTX *ctx) { 182 return ssl_session_new(ctx->x509_method); 183 } 184 185 SSL_SESSION *SSL_SESSION_dup(SSL_SESSION *session, int dup_flags) { 186 SSL_SESSION *new_session = ssl_session_new(session->x509_method); 187 if (new_session == NULL) { 188 goto err; 189 } 190 191 new_session->is_server = session->is_server; 192 new_session->ssl_version = session->ssl_version; 193 new_session->sid_ctx_length = session->sid_ctx_length; 194 OPENSSL_memcpy(new_session->sid_ctx, session->sid_ctx, session->sid_ctx_length); 195 196 /* Copy the key material. */ 197 new_session->master_key_length = session->master_key_length; 198 OPENSSL_memcpy(new_session->master_key, session->master_key, 199 session->master_key_length); 200 new_session->cipher = session->cipher; 201 202 /* Copy authentication state. */ 203 if (session->psk_identity != NULL) { 204 new_session->psk_identity = BUF_strdup(session->psk_identity); 205 if (new_session->psk_identity == NULL) { 206 goto err; 207 } 208 } 209 if (session->certs != NULL) { 210 new_session->certs = sk_CRYPTO_BUFFER_new_null(); 211 if (new_session->certs == NULL) { 212 goto err; 213 } 214 for (size_t i = 0; i < sk_CRYPTO_BUFFER_num(session->certs); i++) { 215 CRYPTO_BUFFER *buffer = sk_CRYPTO_BUFFER_value(session->certs, i); 216 if (!sk_CRYPTO_BUFFER_push(new_session->certs, buffer)) { 217 goto err; 218 } 219 CRYPTO_BUFFER_up_ref(buffer); 220 } 221 } 222 223 if (!session->x509_method->session_dup(new_session, session)) { 224 goto err; 225 } 226 227 new_session->verify_result = session->verify_result; 228 229 new_session->ocsp_response_length = session->ocsp_response_length; 230 if (session->ocsp_response != NULL) { 231 new_session->ocsp_response = (uint8_t *)BUF_memdup( 232 session->ocsp_response, session->ocsp_response_length); 233 if (new_session->ocsp_response == NULL) { 234 goto err; 235 } 236 } 237 238 new_session->tlsext_signed_cert_timestamp_list_length = 239 session->tlsext_signed_cert_timestamp_list_length; 240 if (session->tlsext_signed_cert_timestamp_list != NULL) { 241 new_session->tlsext_signed_cert_timestamp_list = (uint8_t *)BUF_memdup( 242 session->tlsext_signed_cert_timestamp_list, 243 session->tlsext_signed_cert_timestamp_list_length); 244 if (new_session->tlsext_signed_cert_timestamp_list == NULL) { 245 goto err; 246 } 247 } 248 249 OPENSSL_memcpy(new_session->peer_sha256, session->peer_sha256, 250 SHA256_DIGEST_LENGTH); 251 new_session->peer_sha256_valid = session->peer_sha256_valid; 252 253 if (session->tlsext_hostname != NULL) { 254 new_session->tlsext_hostname = BUF_strdup(session->tlsext_hostname); 255 if (new_session->tlsext_hostname == NULL) { 256 goto err; 257 } 258 } 259 260 new_session->peer_signature_algorithm = session->peer_signature_algorithm; 261 262 new_session->timeout = session->timeout; 263 new_session->auth_timeout = session->auth_timeout; 264 new_session->time = session->time; 265 266 /* Copy non-authentication connection properties. */ 267 if (dup_flags & SSL_SESSION_INCLUDE_NONAUTH) { 268 new_session->session_id_length = session->session_id_length; 269 OPENSSL_memcpy(new_session->session_id, session->session_id, 270 session->session_id_length); 271 272 new_session->group_id = session->group_id; 273 274 OPENSSL_memcpy(new_session->original_handshake_hash, 275 session->original_handshake_hash, 276 session->original_handshake_hash_len); 277 new_session->original_handshake_hash_len = 278 session->original_handshake_hash_len; 279 new_session->tlsext_tick_lifetime_hint = session->tlsext_tick_lifetime_hint; 280 new_session->ticket_age_add = session->ticket_age_add; 281 new_session->ticket_max_early_data = session->ticket_max_early_data; 282 new_session->extended_master_secret = session->extended_master_secret; 283 284 if (session->early_alpn != NULL) { 285 new_session->early_alpn = 286 (uint8_t *)BUF_memdup(session->early_alpn, session->early_alpn_len); 287 if (new_session->early_alpn == NULL) { 288 goto err; 289 } 290 } 291 new_session->early_alpn_len = session->early_alpn_len; 292 } 293 294 /* Copy the ticket. */ 295 if (dup_flags & SSL_SESSION_INCLUDE_TICKET) { 296 if (session->tlsext_tick != NULL) { 297 new_session->tlsext_tick = 298 (uint8_t *)BUF_memdup(session->tlsext_tick, session->tlsext_ticklen); 299 if (new_session->tlsext_tick == NULL) { 300 goto err; 301 } 302 } 303 new_session->tlsext_ticklen = session->tlsext_ticklen; 304 } 305 306 /* The new_session does not get a copy of the ex_data. */ 307 308 new_session->not_resumable = 1; 309 return new_session; 310 311 err: 312 SSL_SESSION_free(new_session); 313 OPENSSL_PUT_ERROR(SSL, ERR_R_MALLOC_FAILURE); 314 return 0; 315 } 316 317 void ssl_session_rebase_time(SSL *ssl, SSL_SESSION *session) { 318 struct OPENSSL_timeval now; 319 ssl_get_current_time(ssl, &now); 320 321 /* To avoid overflows and underflows, if we've gone back in time, update the 322 * time, but mark the session expired. */ 323 if (session->time > now.tv_sec) { 324 session->time = now.tv_sec; 325 session->timeout = 0; 326 session->auth_timeout = 0; 327 return; 328 } 329 330 /* Adjust the session time and timeouts. If the session has already expired, 331 * clamp the timeouts at zero. */ 332 uint64_t delta = now.tv_sec - session->time; 333 session->time = now.tv_sec; 334 if (session->timeout < delta) { 335 session->timeout = 0; 336 } else { 337 session->timeout -= delta; 338 } 339 if (session->auth_timeout < delta) { 340 session->auth_timeout = 0; 341 } else { 342 session->auth_timeout -= delta; 343 } 344 } 345 346 void ssl_session_renew_timeout(SSL *ssl, SSL_SESSION *session, 347 uint32_t timeout) { 348 /* Rebase the timestamp relative to the current time so |timeout| is measured 349 * correctly. */ 350 ssl_session_rebase_time(ssl, session); 351 352 if (session->timeout > timeout) { 353 return; 354 } 355 356 session->timeout = timeout; 357 if (session->timeout > session->auth_timeout) { 358 session->timeout = session->auth_timeout; 359 } 360 } 361 362 int SSL_SESSION_up_ref(SSL_SESSION *session) { 363 CRYPTO_refcount_inc(&session->references); 364 return 1; 365 } 366 367 void SSL_SESSION_free(SSL_SESSION *session) { 368 if (session == NULL || 369 !CRYPTO_refcount_dec_and_test_zero(&session->references)) { 370 return; 371 } 372 373 CRYPTO_free_ex_data(&g_ex_data_class, session, &session->ex_data); 374 375 OPENSSL_cleanse(session->master_key, sizeof(session->master_key)); 376 OPENSSL_cleanse(session->session_id, sizeof(session->session_id)); 377 sk_CRYPTO_BUFFER_pop_free(session->certs, CRYPTO_BUFFER_free); 378 session->x509_method->session_clear(session); 379 OPENSSL_free(session->tlsext_hostname); 380 OPENSSL_free(session->tlsext_tick); 381 OPENSSL_free(session->tlsext_signed_cert_timestamp_list); 382 OPENSSL_free(session->ocsp_response); 383 OPENSSL_free(session->psk_identity); 384 OPENSSL_free(session->early_alpn); 385 OPENSSL_cleanse(session, sizeof(*session)); 386 OPENSSL_free(session); 387 } 388 389 const uint8_t *SSL_SESSION_get_id(const SSL_SESSION *session, 390 unsigned *out_len) { 391 if (out_len != NULL) { 392 *out_len = session->session_id_length; 393 } 394 return session->session_id; 395 } 396 397 uint32_t SSL_SESSION_get_timeout(const SSL_SESSION *session) { 398 return session->timeout; 399 } 400 401 uint64_t SSL_SESSION_get_time(const SSL_SESSION *session) { 402 if (session == NULL) { 403 /* NULL should crash, but silently accept it here for compatibility. */ 404 return 0; 405 } 406 return session->time; 407 } 408 409 X509 *SSL_SESSION_get0_peer(const SSL_SESSION *session) { 410 return session->x509_peer; 411 } 412 413 size_t SSL_SESSION_get_master_key(const SSL_SESSION *session, uint8_t *out, 414 size_t max_out) { 415 /* TODO(davidben): Fix master_key_length's type and remove these casts. */ 416 if (max_out == 0) { 417 return (size_t)session->master_key_length; 418 } 419 if (max_out > (size_t)session->master_key_length) { 420 max_out = (size_t)session->master_key_length; 421 } 422 OPENSSL_memcpy(out, session->master_key, max_out); 423 return max_out; 424 } 425 426 uint64_t SSL_SESSION_set_time(SSL_SESSION *session, uint64_t time) { 427 if (session == NULL) { 428 return 0; 429 } 430 431 session->time = time; 432 return time; 433 } 434 435 uint32_t SSL_SESSION_set_timeout(SSL_SESSION *session, uint32_t timeout) { 436 if (session == NULL) { 437 return 0; 438 } 439 440 session->timeout = timeout; 441 session->auth_timeout = timeout; 442 return 1; 443 } 444 445 int SSL_SESSION_set1_id_context(SSL_SESSION *session, const uint8_t *sid_ctx, 446 size_t sid_ctx_len) { 447 if (sid_ctx_len > sizeof(session->sid_ctx)) { 448 OPENSSL_PUT_ERROR(SSL, SSL_R_SSL_SESSION_ID_CONTEXT_TOO_LONG); 449 return 0; 450 } 451 452 assert(sizeof(session->sid_ctx) < 256); 453 session->sid_ctx_length = (uint8_t)sid_ctx_len; 454 OPENSSL_memcpy(session->sid_ctx, sid_ctx, sid_ctx_len); 455 456 return 1; 457 } 458 459 SSL_SESSION *SSL_magic_pending_session_ptr(void) { 460 return (SSL_SESSION *)&g_pending_session_magic; 461 } 462 463 SSL_SESSION *SSL_get_session(const SSL *ssl) { 464 /* Once the handshake completes we return the established session. Otherwise 465 * we return the intermediate session, either |session| (for resumption) or 466 * |new_session| if doing a full handshake. */ 467 if (!SSL_in_init(ssl)) { 468 return ssl->s3->established_session; 469 } 470 SSL_HANDSHAKE *hs = ssl->s3->hs; 471 if (hs->early_session != NULL) { 472 return hs->early_session; 473 } 474 if (hs->new_session != NULL) { 475 return hs->new_session; 476 } 477 return ssl->session; 478 } 479 480 SSL_SESSION *SSL_get1_session(SSL *ssl) { 481 SSL_SESSION *ret = SSL_get_session(ssl); 482 if (ret != NULL) { 483 SSL_SESSION_up_ref(ret); 484 } 485 return ret; 486 } 487 488 int SSL_SESSION_get_ex_new_index(long argl, void *argp, 489 CRYPTO_EX_unused *unused, 490 CRYPTO_EX_dup *dup_unused, 491 CRYPTO_EX_free *free_func) { 492 int index; 493 if (!CRYPTO_get_ex_new_index(&g_ex_data_class, &index, argl, argp, 494 free_func)) { 495 return -1; 496 } 497 return index; 498 } 499 500 int SSL_SESSION_set_ex_data(SSL_SESSION *session, int idx, void *arg) { 501 return CRYPTO_set_ex_data(&session->ex_data, idx, arg); 502 } 503 504 void *SSL_SESSION_get_ex_data(const SSL_SESSION *session, int idx) { 505 return CRYPTO_get_ex_data(&session->ex_data, idx); 506 } 507 508 uint16_t SSL_SESSION_protocol_version(const SSL_SESSION *session) { 509 uint16_t ret; 510 if (!ssl_protocol_version_from_wire(&ret, session->ssl_version)) { 511 /* An |SSL_SESSION| will never have an invalid version. This is enforced by 512 * the parser. */ 513 assert(0); 514 return 0; 515 } 516 517 return ret; 518 } 519 520 const EVP_MD *SSL_SESSION_get_digest(const SSL_SESSION *session) { 521 return ssl_get_handshake_digest(session->cipher->algorithm_prf, 522 SSL_SESSION_protocol_version(session)); 523 } 524 525 int ssl_get_new_session(SSL_HANDSHAKE *hs, int is_server) { 526 SSL *const ssl = hs->ssl; 527 if (ssl->mode & SSL_MODE_NO_SESSION_CREATION) { 528 OPENSSL_PUT_ERROR(SSL, SSL_R_SESSION_MAY_NOT_BE_CREATED); 529 return 0; 530 } 531 532 SSL_SESSION *session = ssl_session_new(ssl->ctx->x509_method); 533 if (session == NULL) { 534 return 0; 535 } 536 537 session->is_server = is_server; 538 session->ssl_version = ssl->version; 539 540 /* Fill in the time from the |SSL_CTX|'s clock. */ 541 struct OPENSSL_timeval now; 542 ssl_get_current_time(ssl, &now); 543 session->time = now.tv_sec; 544 545 uint16_t version = ssl3_protocol_version(ssl); 546 if (version >= TLS1_3_VERSION) { 547 /* TLS 1.3 uses tickets as authenticators, so we are willing to use them for 548 * longer. */ 549 session->timeout = ssl->session_ctx->session_psk_dhe_timeout; 550 session->auth_timeout = SSL_DEFAULT_SESSION_AUTH_TIMEOUT; 551 } else { 552 /* TLS 1.2 resumption does not incorporate new key material, so we use a 553 * much shorter timeout. */ 554 session->timeout = ssl->session_ctx->session_timeout; 555 session->auth_timeout = ssl->session_ctx->session_timeout; 556 } 557 558 if (is_server) { 559 if (hs->ticket_expected || version >= TLS1_3_VERSION) { 560 /* Don't set session IDs for sessions resumed with tickets. This will keep 561 * them out of the session cache. */ 562 session->session_id_length = 0; 563 } else { 564 session->session_id_length = SSL3_SSL_SESSION_ID_LENGTH; 565 if (!RAND_bytes(session->session_id, session->session_id_length)) { 566 goto err; 567 } 568 } 569 } else { 570 session->session_id_length = 0; 571 } 572 573 if (ssl->cert->sid_ctx_length > sizeof(session->sid_ctx)) { 574 OPENSSL_PUT_ERROR(SSL, ERR_R_INTERNAL_ERROR); 575 goto err; 576 } 577 OPENSSL_memcpy(session->sid_ctx, ssl->cert->sid_ctx, 578 ssl->cert->sid_ctx_length); 579 session->sid_ctx_length = ssl->cert->sid_ctx_length; 580 581 /* The session is marked not resumable until it is completely filled in. */ 582 session->not_resumable = 1; 583 session->verify_result = X509_V_ERR_INVALID_CALL; 584 585 SSL_SESSION_free(hs->new_session); 586 hs->new_session = session; 587 ssl_set_session(ssl, NULL); 588 return 1; 589 590 err: 591 SSL_SESSION_free(session); 592 return 0; 593 } 594 595 static int ssl_encrypt_ticket_with_cipher_ctx(SSL *ssl, CBB *out, 596 const uint8_t *session_buf, 597 size_t session_len) { 598 bssl::ScopedEVP_CIPHER_CTX ctx; 599 bssl::ScopedHMAC_CTX hctx; 600 601 /* If the session is too long, emit a dummy value rather than abort the 602 * connection. */ 603 static const size_t kMaxTicketOverhead = 604 16 + EVP_MAX_IV_LENGTH + EVP_MAX_BLOCK_LENGTH + EVP_MAX_MD_SIZE; 605 if (session_len > 0xffff - kMaxTicketOverhead) { 606 static const char kTicketPlaceholder[] = "TICKET TOO LARGE"; 607 return CBB_add_bytes(out, (const uint8_t *)kTicketPlaceholder, 608 strlen(kTicketPlaceholder)); 609 } 610 611 /* Initialize HMAC and cipher contexts. If callback present it does all the 612 * work otherwise use generated values from parent ctx. */ 613 SSL_CTX *tctx = ssl->session_ctx; 614 uint8_t iv[EVP_MAX_IV_LENGTH]; 615 uint8_t key_name[16]; 616 if (tctx->tlsext_ticket_key_cb != NULL) { 617 if (tctx->tlsext_ticket_key_cb(ssl, key_name, iv, ctx.get(), hctx.get(), 618 1 /* encrypt */) < 0) { 619 return 0; 620 } 621 } else { 622 if (!RAND_bytes(iv, 16) || 623 !EVP_EncryptInit_ex(ctx.get(), EVP_aes_128_cbc(), NULL, 624 tctx->tlsext_tick_aes_key, iv) || 625 !HMAC_Init_ex(hctx.get(), tctx->tlsext_tick_hmac_key, 16, 626 tlsext_tick_md(), NULL)) { 627 return 0; 628 } 629 OPENSSL_memcpy(key_name, tctx->tlsext_tick_key_name, 16); 630 } 631 632 uint8_t *ptr; 633 if (!CBB_add_bytes(out, key_name, 16) || 634 !CBB_add_bytes(out, iv, EVP_CIPHER_CTX_iv_length(ctx.get())) || 635 !CBB_reserve(out, &ptr, session_len + EVP_MAX_BLOCK_LENGTH)) { 636 return 0; 637 } 638 639 size_t total = 0; 640 #if defined(BORINGSSL_UNSAFE_FUZZER_MODE) 641 OPENSSL_memcpy(ptr, session_buf, session_len); 642 total = session_len; 643 #else 644 int len; 645 if (!EVP_EncryptUpdate(ctx.get(), ptr + total, &len, session_buf, session_len)) { 646 return 0; 647 } 648 total += len; 649 if (!EVP_EncryptFinal_ex(ctx.get(), ptr + total, &len)) { 650 return 0; 651 } 652 total += len; 653 #endif 654 if (!CBB_did_write(out, total)) { 655 return 0; 656 } 657 658 unsigned hlen; 659 if (!HMAC_Update(hctx.get(), CBB_data(out), CBB_len(out)) || 660 !CBB_reserve(out, &ptr, EVP_MAX_MD_SIZE) || 661 !HMAC_Final(hctx.get(), ptr, &hlen) || 662 !CBB_did_write(out, hlen)) { 663 return 0; 664 } 665 666 return 1; 667 } 668 669 static int ssl_encrypt_ticket_with_method(SSL *ssl, CBB *out, 670 const uint8_t *session_buf, 671 size_t session_len) { 672 const SSL_TICKET_AEAD_METHOD *method = ssl->session_ctx->ticket_aead_method; 673 const size_t max_overhead = method->max_overhead(ssl); 674 const size_t max_out = session_len + max_overhead; 675 if (max_out < max_overhead) { 676 OPENSSL_PUT_ERROR(SSL, ERR_R_OVERFLOW); 677 return 0; 678 } 679 680 uint8_t *ptr; 681 if (!CBB_reserve(out, &ptr, max_out)) { 682 return 0; 683 } 684 685 size_t out_len; 686 if (!method->seal(ssl, ptr, &out_len, max_out, session_buf, session_len)) { 687 OPENSSL_PUT_ERROR(SSL, SSL_R_TICKET_ENCRYPTION_FAILED); 688 return 0; 689 } 690 691 if (!CBB_did_write(out, out_len)) { 692 return 0; 693 } 694 695 return 1; 696 } 697 698 int ssl_encrypt_ticket(SSL *ssl, CBB *out, const SSL_SESSION *session) { 699 /* Serialize the SSL_SESSION to be encoded into the ticket. */ 700 uint8_t *session_buf = NULL; 701 size_t session_len; 702 if (!SSL_SESSION_to_bytes_for_ticket(session, &session_buf, &session_len)) { 703 return -1; 704 } 705 706 int ret = 0; 707 if (ssl->session_ctx->ticket_aead_method) { 708 ret = ssl_encrypt_ticket_with_method(ssl, out, session_buf, session_len); 709 } else { 710 ret = 711 ssl_encrypt_ticket_with_cipher_ctx(ssl, out, session_buf, session_len); 712 } 713 714 OPENSSL_free(session_buf); 715 return ret; 716 } 717 718 int ssl_session_is_context_valid(const SSL *ssl, const SSL_SESSION *session) { 719 if (session == NULL) { 720 return 0; 721 } 722 723 return session->sid_ctx_length == ssl->cert->sid_ctx_length && 724 OPENSSL_memcmp(session->sid_ctx, ssl->cert->sid_ctx, 725 ssl->cert->sid_ctx_length) == 0; 726 } 727 728 int ssl_session_is_time_valid(const SSL *ssl, const SSL_SESSION *session) { 729 if (session == NULL) { 730 return 0; 731 } 732 733 struct OPENSSL_timeval now; 734 ssl_get_current_time(ssl, &now); 735 736 /* Reject tickets from the future to avoid underflow. */ 737 if (now.tv_sec < session->time) { 738 return 0; 739 } 740 741 return session->timeout > now.tv_sec - session->time; 742 } 743 744 int ssl_session_is_resumable(const SSL_HANDSHAKE *hs, 745 const SSL_SESSION *session) { 746 const SSL *const ssl = hs->ssl; 747 return ssl_session_is_context_valid(ssl, session) && 748 /* The session must have been created by the same type of end point as 749 * we're now using it with. */ 750 ssl->server == session->is_server && 751 /* The session must not be expired. */ 752 ssl_session_is_time_valid(ssl, session) && 753 /* Only resume if the session's version matches the negotiated 754 * version. */ 755 ssl->version == session->ssl_version && 756 /* Only resume if the session's cipher matches the negotiated one. */ 757 hs->new_cipher == session->cipher && 758 /* If the session contains a client certificate (either the full 759 * certificate or just the hash) then require that the form of the 760 * certificate matches the current configuration. */ 761 ((sk_CRYPTO_BUFFER_num(session->certs) == 0 && 762 !session->peer_sha256_valid) || 763 session->peer_sha256_valid == 764 ssl->retain_only_sha256_of_client_certs); 765 } 766 767 /* ssl_lookup_session looks up |session_id| in the session cache and sets 768 * |*out_session| to an |SSL_SESSION| object if found. The caller takes 769 * ownership of the result. */ 770 static enum ssl_session_result_t ssl_lookup_session( 771 SSL *ssl, SSL_SESSION **out_session, const uint8_t *session_id, 772 size_t session_id_len) { 773 *out_session = NULL; 774 775 if (session_id_len == 0 || session_id_len > SSL_MAX_SSL_SESSION_ID_LENGTH) { 776 return ssl_session_success; 777 } 778 779 SSL_SESSION *session = NULL; 780 /* Try the internal cache, if it exists. */ 781 if (!(ssl->session_ctx->session_cache_mode & 782 SSL_SESS_CACHE_NO_INTERNAL_LOOKUP)) { 783 SSL_SESSION data; 784 data.ssl_version = ssl->version; 785 data.session_id_length = session_id_len; 786 OPENSSL_memcpy(data.session_id, session_id, session_id_len); 787 788 CRYPTO_MUTEX_lock_read(&ssl->session_ctx->lock); 789 session = lh_SSL_SESSION_retrieve(ssl->session_ctx->sessions, &data); 790 if (session != NULL) { 791 SSL_SESSION_up_ref(session); 792 } 793 /* TODO(davidben): This should probably move it to the front of the list. */ 794 CRYPTO_MUTEX_unlock_read(&ssl->session_ctx->lock); 795 } 796 797 /* Fall back to the external cache, if it exists. */ 798 if (session == NULL && 799 ssl->session_ctx->get_session_cb != NULL) { 800 int copy = 1; 801 session = ssl->session_ctx->get_session_cb(ssl, (uint8_t *)session_id, 802 session_id_len, ©); 803 804 if (session == NULL) { 805 return ssl_session_success; 806 } 807 808 if (session == SSL_magic_pending_session_ptr()) { 809 return ssl_session_retry; 810 } 811 812 /* Increment reference count now if the session callback asks us to do so 813 * (note that if the session structures returned by the callback are shared 814 * between threads, it must handle the reference count itself [i.e. copy == 815 * 0], or things won't be thread-safe). */ 816 if (copy) { 817 SSL_SESSION_up_ref(session); 818 } 819 820 /* Add the externally cached session to the internal cache if necessary. */ 821 if (!(ssl->session_ctx->session_cache_mode & 822 SSL_SESS_CACHE_NO_INTERNAL_STORE)) { 823 SSL_CTX_add_session(ssl->session_ctx, session); 824 } 825 } 826 827 if (session != NULL && 828 !ssl_session_is_time_valid(ssl, session)) { 829 /* The session was from the cache, so remove it. */ 830 SSL_CTX_remove_session(ssl->session_ctx, session); 831 SSL_SESSION_free(session); 832 session = NULL; 833 } 834 835 *out_session = session; 836 return ssl_session_success; 837 } 838 839 enum ssl_session_result_t ssl_get_prev_session( 840 SSL *ssl, SSL_SESSION **out_session, int *out_tickets_supported, 841 int *out_renew_ticket, const SSL_CLIENT_HELLO *client_hello) { 842 /* This is used only by servers. */ 843 assert(ssl->server); 844 SSL_SESSION *session = NULL; 845 int renew_ticket = 0; 846 847 /* If tickets are disabled, always behave as if no tickets are present. */ 848 const uint8_t *ticket = NULL; 849 size_t ticket_len = 0; 850 const int tickets_supported = 851 !(SSL_get_options(ssl) & SSL_OP_NO_TICKET) && 852 ssl->version > SSL3_VERSION && 853 SSL_early_callback_ctx_extension_get( 854 client_hello, TLSEXT_TYPE_session_ticket, &ticket, &ticket_len); 855 if (tickets_supported && ticket_len > 0) { 856 switch (ssl_process_ticket(ssl, &session, &renew_ticket, ticket, ticket_len, 857 client_hello->session_id, 858 client_hello->session_id_len)) { 859 case ssl_ticket_aead_success: 860 break; 861 case ssl_ticket_aead_ignore_ticket: 862 assert(session == NULL); 863 break; 864 case ssl_ticket_aead_error: 865 return ssl_session_error; 866 case ssl_ticket_aead_retry: 867 return ssl_session_ticket_retry; 868 } 869 } else { 870 /* The client didn't send a ticket, so the session ID is a real ID. */ 871 enum ssl_session_result_t lookup_ret = ssl_lookup_session( 872 ssl, &session, client_hello->session_id, client_hello->session_id_len); 873 if (lookup_ret != ssl_session_success) { 874 return lookup_ret; 875 } 876 } 877 878 *out_session = session; 879 *out_tickets_supported = tickets_supported; 880 *out_renew_ticket = renew_ticket; 881 return ssl_session_success; 882 } 883 884 int SSL_CTX_add_session(SSL_CTX *ctx, SSL_SESSION *session) { 885 /* Although |session| is inserted into two structures (a doubly-linked list 886 * and the hash table), |ctx| only takes one reference. */ 887 SSL_SESSION_up_ref(session); 888 889 SSL_SESSION *old_session; 890 CRYPTO_MUTEX_lock_write(&ctx->lock); 891 if (!lh_SSL_SESSION_insert(ctx->sessions, &old_session, session)) { 892 CRYPTO_MUTEX_unlock_write(&ctx->lock); 893 SSL_SESSION_free(session); 894 return 0; 895 } 896 897 if (old_session != NULL) { 898 if (old_session == session) { 899 /* |session| was already in the cache. */ 900 CRYPTO_MUTEX_unlock_write(&ctx->lock); 901 SSL_SESSION_free(old_session); 902 return 0; 903 } 904 905 /* There was a session ID collision. |old_session| must be removed from 906 * the linked list and released. */ 907 SSL_SESSION_list_remove(ctx, old_session); 908 SSL_SESSION_free(old_session); 909 } 910 911 SSL_SESSION_list_add(ctx, session); 912 913 /* Enforce any cache size limits. */ 914 if (SSL_CTX_sess_get_cache_size(ctx) > 0) { 915 while (SSL_CTX_sess_number(ctx) > SSL_CTX_sess_get_cache_size(ctx)) { 916 if (!remove_session_lock(ctx, ctx->session_cache_tail, 0)) { 917 break; 918 } 919 } 920 } 921 922 CRYPTO_MUTEX_unlock_write(&ctx->lock); 923 return 1; 924 } 925 926 int SSL_CTX_remove_session(SSL_CTX *ctx, SSL_SESSION *session) { 927 return remove_session_lock(ctx, session, 1); 928 } 929 930 static int remove_session_lock(SSL_CTX *ctx, SSL_SESSION *session, int lock) { 931 int ret = 0; 932 933 if (session != NULL && session->session_id_length != 0) { 934 if (lock) { 935 CRYPTO_MUTEX_lock_write(&ctx->lock); 936 } 937 SSL_SESSION *found_session = lh_SSL_SESSION_retrieve(ctx->sessions, 938 session); 939 if (found_session == session) { 940 ret = 1; 941 found_session = lh_SSL_SESSION_delete(ctx->sessions, session); 942 SSL_SESSION_list_remove(ctx, session); 943 } 944 945 if (lock) { 946 CRYPTO_MUTEX_unlock_write(&ctx->lock); 947 } 948 949 if (ret) { 950 if (ctx->remove_session_cb != NULL) { 951 ctx->remove_session_cb(ctx, found_session); 952 } 953 SSL_SESSION_free(found_session); 954 } 955 } 956 957 return ret; 958 } 959 960 int SSL_set_session(SSL *ssl, SSL_SESSION *session) { 961 /* SSL_set_session may only be called before the handshake has started. */ 962 if (ssl->s3->initial_handshake_complete || 963 ssl->s3->hs == NULL || 964 ssl->s3->hs->state != SSL_ST_INIT) { 965 abort(); 966 } 967 968 ssl_set_session(ssl, session); 969 return 1; 970 } 971 972 void ssl_set_session(SSL *ssl, SSL_SESSION *session) { 973 if (ssl->session == session) { 974 return; 975 } 976 977 SSL_SESSION_free(ssl->session); 978 ssl->session = session; 979 if (session != NULL) { 980 SSL_SESSION_up_ref(session); 981 } 982 } 983 984 uint32_t SSL_CTX_set_timeout(SSL_CTX *ctx, uint32_t timeout) { 985 if (ctx == NULL) { 986 return 0; 987 } 988 989 /* Historically, zero was treated as |SSL_DEFAULT_SESSION_TIMEOUT|. */ 990 if (timeout == 0) { 991 timeout = SSL_DEFAULT_SESSION_TIMEOUT; 992 } 993 994 uint32_t old_timeout = ctx->session_timeout; 995 ctx->session_timeout = timeout; 996 return old_timeout; 997 } 998 999 uint32_t SSL_CTX_get_timeout(const SSL_CTX *ctx) { 1000 if (ctx == NULL) { 1001 return 0; 1002 } 1003 1004 return ctx->session_timeout; 1005 } 1006 1007 void SSL_CTX_set_session_psk_dhe_timeout(SSL_CTX *ctx, uint32_t timeout) { 1008 ctx->session_psk_dhe_timeout = timeout; 1009 } 1010 1011 typedef struct timeout_param_st { 1012 SSL_CTX *ctx; 1013 uint64_t time; 1014 LHASH_OF(SSL_SESSION) *cache; 1015 } TIMEOUT_PARAM; 1016 1017 static void timeout_doall_arg(SSL_SESSION *session, void *void_param) { 1018 TIMEOUT_PARAM *param = reinterpret_cast<TIMEOUT_PARAM *>(void_param); 1019 1020 if (param->time == 0 || 1021 session->time + session->timeout < session->time || 1022 param->time > (session->time + session->timeout)) { 1023 /* timeout */ 1024 /* The reason we don't call SSL_CTX_remove_session() is to 1025 * save on locking overhead */ 1026 (void) lh_SSL_SESSION_delete(param->cache, session); 1027 SSL_SESSION_list_remove(param->ctx, session); 1028 if (param->ctx->remove_session_cb != NULL) { 1029 param->ctx->remove_session_cb(param->ctx, session); 1030 } 1031 SSL_SESSION_free(session); 1032 } 1033 } 1034 1035 void SSL_CTX_flush_sessions(SSL_CTX *ctx, uint64_t time) { 1036 TIMEOUT_PARAM tp; 1037 1038 tp.ctx = ctx; 1039 tp.cache = ctx->sessions; 1040 if (tp.cache == NULL) { 1041 return; 1042 } 1043 tp.time = time; 1044 CRYPTO_MUTEX_lock_write(&ctx->lock); 1045 lh_SSL_SESSION_doall_arg(tp.cache, timeout_doall_arg, &tp); 1046 CRYPTO_MUTEX_unlock_write(&ctx->lock); 1047 } 1048 1049 /* locked by SSL_CTX in the calling function */ 1050 static void SSL_SESSION_list_remove(SSL_CTX *ctx, SSL_SESSION *session) { 1051 if (session->next == NULL || session->prev == NULL) { 1052 return; 1053 } 1054 1055 if (session->next == (SSL_SESSION *)&ctx->session_cache_tail) { 1056 /* last element in list */ 1057 if (session->prev == (SSL_SESSION *)&ctx->session_cache_head) { 1058 /* only one element in list */ 1059 ctx->session_cache_head = NULL; 1060 ctx->session_cache_tail = NULL; 1061 } else { 1062 ctx->session_cache_tail = session->prev; 1063 session->prev->next = (SSL_SESSION *)&(ctx->session_cache_tail); 1064 } 1065 } else { 1066 if (session->prev == (SSL_SESSION *)&ctx->session_cache_head) { 1067 /* first element in list */ 1068 ctx->session_cache_head = session->next; 1069 session->next->prev = (SSL_SESSION *)&(ctx->session_cache_head); 1070 } else { /* middle of list */ 1071 session->next->prev = session->prev; 1072 session->prev->next = session->next; 1073 } 1074 } 1075 session->prev = session->next = NULL; 1076 } 1077 1078 static void SSL_SESSION_list_add(SSL_CTX *ctx, SSL_SESSION *session) { 1079 if (session->next != NULL && session->prev != NULL) { 1080 SSL_SESSION_list_remove(ctx, session); 1081 } 1082 1083 if (ctx->session_cache_head == NULL) { 1084 ctx->session_cache_head = session; 1085 ctx->session_cache_tail = session; 1086 session->prev = (SSL_SESSION *)&(ctx->session_cache_head); 1087 session->next = (SSL_SESSION *)&(ctx->session_cache_tail); 1088 } else { 1089 session->next = ctx->session_cache_head; 1090 session->next->prev = session; 1091 session->prev = (SSL_SESSION *)&(ctx->session_cache_head); 1092 ctx->session_cache_head = session; 1093 } 1094 } 1095 1096 void SSL_CTX_sess_set_new_cb(SSL_CTX *ctx, 1097 int (*cb)(SSL *ssl, SSL_SESSION *session)) { 1098 ctx->new_session_cb = cb; 1099 } 1100 1101 int (*SSL_CTX_sess_get_new_cb(SSL_CTX *ctx))(SSL *ssl, SSL_SESSION *session) { 1102 return ctx->new_session_cb; 1103 } 1104 1105 void SSL_CTX_sess_set_remove_cb( 1106 SSL_CTX *ctx, void (*cb)(SSL_CTX *ctx, SSL_SESSION *session)) { 1107 ctx->remove_session_cb = cb; 1108 } 1109 1110 void (*SSL_CTX_sess_get_remove_cb(SSL_CTX *ctx))(SSL_CTX *ctx, 1111 SSL_SESSION *session) { 1112 return ctx->remove_session_cb; 1113 } 1114 1115 void SSL_CTX_sess_set_get_cb(SSL_CTX *ctx, 1116 SSL_SESSION *(*cb)(SSL *ssl, 1117 uint8_t *id, int id_len, 1118 int *out_copy)) { 1119 ctx->get_session_cb = cb; 1120 } 1121 1122 SSL_SESSION *(*SSL_CTX_sess_get_get_cb(SSL_CTX *ctx))( 1123 SSL *ssl, uint8_t *id, int id_len, int *out_copy) { 1124 return ctx->get_session_cb; 1125 } 1126 1127 void SSL_CTX_set_info_callback( 1128 SSL_CTX *ctx, void (*cb)(const SSL *ssl, int type, int value)) { 1129 ctx->info_callback = cb; 1130 } 1131 1132 void (*SSL_CTX_get_info_callback(SSL_CTX *ctx))(const SSL *ssl, int type, 1133 int value) { 1134 return ctx->info_callback; 1135 } 1136 1137 void SSL_CTX_set_channel_id_cb(SSL_CTX *ctx, 1138 void (*cb)(SSL *ssl, EVP_PKEY **pkey)) { 1139 ctx->channel_id_cb = cb; 1140 } 1141 1142 void (*SSL_CTX_get_channel_id_cb(SSL_CTX *ctx))(SSL *ssl, EVP_PKEY **pkey) { 1143 return ctx->channel_id_cb; 1144 } 1145