Home | History | Annotate | Download | only in ssl 
      1 /* Copyright (c) 2018, Google Inc.
      2  *
      3  * Permission to use, copy, modify, and/or distribute this software for any
      4  * purpose with or without fee is hereby granted, provided that the above
      5  * copyright notice and this permission notice appear in all copies.
      6  *
      7  * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
      8  * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
      9  * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY
     10  * SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
     11  * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION
     12  * OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN
     13  * CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE. */
     14 
     15 #include <openssl/ssl.h>
     16 
     17 #include <openssl/bytestring.h>
     18 
     19 #include "internal.h"
     20 
     21 
     22 namespace bssl {
     23 
     24 constexpr int kHandoffVersion = 0;
     25 constexpr int kHandbackVersion = 0;
     26 
     27 bool SSL_serialize_handoff(const SSL *ssl, CBB *out) {
     28   const SSL3_STATE *const s3 = ssl->s3;
     29   if (!ssl->server ||
     30       s3->hs == nullptr ||
     31       s3->rwstate != SSL_HANDOFF) {
     32     return false;
     33   }
     34 
     35   CBB seq;
     36   Span<const uint8_t> transcript = s3->hs->transcript.buffer();
     37   if (!CBB_add_asn1(out, &seq, CBS_ASN1_SEQUENCE) ||
     38       !CBB_add_asn1_uint64(&seq, kHandoffVersion) ||
     39       !CBB_add_asn1_octet_string(&seq, transcript.data(), transcript.size()) ||
     40       !CBB_add_asn1_octet_string(&seq,
     41                                  reinterpret_cast<uint8_t *>(s3->hs_buf->data),
     42                                  s3->hs_buf->length) ||
     43       !CBB_flush(out)) {
     44     return false;
     45   }
     46 
     47   return true;
     48 }
     49 
     50 bool SSL_decline_handoff(SSL *ssl) {
     51   const SSL3_STATE *const s3 = ssl->s3;
     52   if (!ssl->server ||
     53       s3->hs == nullptr ||
     54       s3->rwstate != SSL_HANDOFF) {
     55     return false;
     56   }
     57 
     58   ssl->handoff = false;
     59   return true;
     60 }
     61 
     62 bool SSL_apply_handoff(SSL *ssl, Span<const uint8_t> handoff) {
     63   if (ssl->method->is_dtls) {
     64     return false;
     65   }
     66 
     67   CBS seq, handoff_cbs(handoff);
     68   uint64_t handoff_version;
     69   if (!CBS_get_asn1(&handoff_cbs, &seq, CBS_ASN1_SEQUENCE) ||
     70       !CBS_get_asn1_uint64(&seq, &handoff_version) ||
     71       handoff_version != kHandoffVersion) {
     72     return false;
     73   }
     74 
     75   CBS transcript, hs_buf;
     76   if (!CBS_get_asn1(&seq, &transcript, CBS_ASN1_OCTETSTRING) ||
     77       !CBS_get_asn1(&seq, &hs_buf, CBS_ASN1_OCTETSTRING)) {
     78     return false;
     79   }
     80 
     81   SSL_set_accept_state(ssl);
     82 
     83   SSL3_STATE *const s3 = ssl->s3;
     84   s3->v2_hello_done = true;
     85   s3->has_message = true;
     86 
     87   s3->hs_buf.reset(BUF_MEM_new());
     88   if (!s3->hs_buf ||
     89       !BUF_MEM_append(s3->hs_buf.get(), CBS_data(&hs_buf), CBS_len(&hs_buf))) {
     90     return false;
     91   }
     92 
     93   if (CBS_len(&transcript) != 0) {
     94     s3->hs->transcript.Update(transcript);
     95     s3->is_v2_hello = true;
     96     ssl_do_msg_callback(ssl, 0 /* read */, 0 /* V2ClientHello */, transcript);
     97   }
     98 
     99   return true;
    100 }
    101 
    102 bool SSL_serialize_handback(const SSL *ssl, CBB *out) {
    103   if (!ssl->server ||
    104       !ssl->s3->initial_handshake_complete ||
    105       ssl->method->is_dtls ||
    106       ssl->version < TLS1_VERSION) {
    107     return false;
    108   }
    109 
    110   const SSL3_STATE *const s3 = ssl->s3;
    111   size_t hostname_len = 0;
    112   if (s3->hostname) {
    113     hostname_len = strlen(s3->hostname.get());
    114   }
    115 
    116   size_t iv_len = 0;
    117   const uint8_t *read_iv = nullptr, *write_iv = nullptr;
    118   if (ssl->version == TLS1_VERSION &&
    119       SSL_CIPHER_is_block_cipher(s3->aead_read_ctx->cipher()) &&
    120       (!s3->aead_read_ctx->GetIV(&read_iv, &iv_len) ||
    121        !s3->aead_write_ctx->GetIV(&write_iv, &iv_len))) {
    122     return false;
    123   }
    124 
    125   CBB seq;
    126   if (!CBB_add_asn1(out, &seq, CBS_ASN1_SEQUENCE) ||
    127       !CBB_add_asn1_uint64(&seq, kHandbackVersion) ||
    128       !CBB_add_asn1_uint64(&seq, ssl->version) ||
    129       !CBB_add_asn1_uint64(&seq, ssl->conf_max_version) ||
    130       !CBB_add_asn1_uint64(&seq, ssl->conf_min_version) ||
    131       !CBB_add_asn1_uint64(&seq, ssl->max_send_fragment) ||
    132       !CBB_add_asn1_octet_string(&seq, s3->read_sequence,
    133                                  sizeof(s3->read_sequence)) ||
    134       !CBB_add_asn1_octet_string(&seq, s3->write_sequence,
    135                                  sizeof(s3->write_sequence)) ||
    136       !CBB_add_asn1_octet_string(&seq, s3->server_random,
    137                                  sizeof(s3->server_random)) ||
    138       !CBB_add_asn1_octet_string(&seq, s3->client_random,
    139                                  sizeof(s3->client_random)) ||
    140       !CBB_add_asn1_octet_string(&seq, read_iv, iv_len) ||
    141       !CBB_add_asn1_octet_string(&seq, write_iv, iv_len) ||
    142       !CBB_add_asn1_bool(&seq, s3->session_reused) ||
    143       !CBB_add_asn1_bool(&seq, s3->send_connection_binding) ||
    144       !CBB_add_asn1_bool(&seq, s3->tlsext_channel_id_valid) ||
    145       !ssl_session_serialize(s3->established_session.get(), &seq) ||
    146       !CBB_add_asn1_octet_string(&seq, s3->next_proto_negotiated.data(),
    147                                  s3->next_proto_negotiated.size()) ||
    148       !CBB_add_asn1_octet_string(&seq, s3->alpn_selected.data(),
    149                                  s3->alpn_selected.size()) ||
    150       !CBB_add_asn1_octet_string(
    151           &seq, reinterpret_cast<uint8_t *>(s3->hostname.get()),
    152           hostname_len) ||
    153       !CBB_add_asn1_octet_string(&seq, s3->tlsext_channel_id,
    154                                  sizeof(s3->tlsext_channel_id)) ||
    155       !CBB_add_asn1_uint64(&seq, ssl->options) ||
    156       !CBB_add_asn1_uint64(&seq, ssl->mode) ||
    157       !CBB_add_asn1_uint64(&seq, ssl->max_cert_list) ||
    158       !CBB_add_asn1_bool(&seq, ssl->quiet_shutdown) ||
    159       !CBB_add_asn1_bool(&seq, ssl->tlsext_channel_id_enabled) ||
    160       !CBB_add_asn1_bool(&seq, ssl->retain_only_sha256_of_client_certs) ||
    161       !CBB_flush(out)) {
    162     return false;
    163   }
    164 
    165   return true;
    166 }
    167 
    168 bool SSL_apply_handback(SSL *ssl, Span<const uint8_t> handback) {
    169   if (ssl->do_handshake != nullptr ||
    170       ssl->method->is_dtls) {
    171     return false;
    172   }
    173 
    174   SSL3_STATE *const s3 = ssl->s3;
    175   uint64_t handback_version, version, conf_max_version, conf_min_version,
    176       max_send_fragment, options, mode, max_cert_list;
    177   CBS seq, read_seq, write_seq, server_rand, client_rand, read_iv, write_iv,
    178       next_proto, alpn, hostname, channel_id;
    179   int session_reused, send_connection_binding, channel_id_valid,
    180       quiet_shutdown, channel_id_enabled, retain_only_sha256;
    181 
    182   CBS handback_cbs(handback);
    183   if (!CBS_get_asn1(&handback_cbs, &seq, CBS_ASN1_SEQUENCE) ||
    184       !CBS_get_asn1_uint64(&seq, &handback_version) ||
    185       handback_version != kHandbackVersion) {
    186     return false;
    187   }
    188 
    189   if (!CBS_get_asn1_uint64(&seq, &version) ||
    190       !CBS_get_asn1_uint64(&seq, &conf_max_version) ||
    191       !CBS_get_asn1_uint64(&seq, &conf_min_version) ||
    192       !CBS_get_asn1_uint64(&seq, &max_send_fragment) ||
    193       !CBS_get_asn1(&seq, &read_seq, CBS_ASN1_OCTETSTRING) ||
    194       CBS_len(&read_seq) != sizeof(s3->read_sequence) ||
    195       !CBS_get_asn1(&seq, &write_seq, CBS_ASN1_OCTETSTRING) ||
    196       CBS_len(&write_seq) != sizeof(s3->write_sequence) ||
    197       !CBS_get_asn1(&seq, &server_rand, CBS_ASN1_OCTETSTRING) ||
    198       CBS_len(&server_rand) != sizeof(s3->server_random) ||
    199       !CBS_copy_bytes(&server_rand, s3->server_random,
    200                       sizeof(s3->server_random)) ||
    201       !CBS_get_asn1(&seq, &client_rand, CBS_ASN1_OCTETSTRING) ||
    202       CBS_len(&client_rand) != sizeof(s3->client_random) ||
    203       !CBS_copy_bytes(&client_rand, s3->client_random,
    204                       sizeof(s3->client_random)) ||
    205       !CBS_get_asn1(&seq, &read_iv, CBS_ASN1_OCTETSTRING) ||
    206       !CBS_get_asn1(&seq, &write_iv, CBS_ASN1_OCTETSTRING) ||
    207       !CBS_get_asn1_bool(&seq, &session_reused) ||
    208       !CBS_get_asn1_bool(&seq, &send_connection_binding) ||
    209       !CBS_get_asn1_bool(&seq, &channel_id_valid)) {
    210     return false;
    211   }
    212 
    213   s3->established_session =
    214       SSL_SESSION_parse(&seq, ssl->ctx->x509_method, ssl->ctx->pool);
    215 
    216   if (!s3->established_session ||
    217       !CBS_get_asn1(&seq, &next_proto, CBS_ASN1_OCTETSTRING) ||
    218       !CBS_get_asn1(&seq, &alpn, CBS_ASN1_OCTETSTRING) ||
    219       !CBS_get_asn1(&seq, &hostname, CBS_ASN1_OCTETSTRING) ||
    220       !CBS_get_asn1(&seq, &channel_id, CBS_ASN1_OCTETSTRING) ||
    221       CBS_len(&channel_id) != sizeof(s3->tlsext_channel_id) ||
    222       !CBS_copy_bytes(&channel_id, s3->tlsext_channel_id,
    223                       sizeof(s3->tlsext_channel_id)) ||
    224       !CBS_get_asn1_uint64(&seq, &options) ||
    225       !CBS_get_asn1_uint64(&seq, &mode) ||
    226       !CBS_get_asn1_uint64(&seq, &max_cert_list) ||
    227       !CBS_get_asn1_bool(&seq, &quiet_shutdown) ||
    228       !CBS_get_asn1_bool(&seq, &channel_id_enabled) ||
    229       !CBS_get_asn1_bool(&seq, &retain_only_sha256)) {
    230     return false;
    231   }
    232 
    233   ssl->version = version;
    234   ssl->conf_max_version = conf_max_version;
    235   ssl->conf_min_version = conf_min_version;
    236   ssl->max_send_fragment = max_send_fragment;
    237   ssl->do_handshake = ssl_server_handshake;
    238   ssl->server = true;
    239   ssl->options = options;
    240   ssl->mode = mode;
    241   ssl->max_cert_list = max_cert_list;
    242 
    243   s3->hs.reset();
    244   s3->have_version = true;
    245   s3->initial_handshake_complete = true;
    246   s3->session_reused = session_reused;
    247   s3->send_connection_binding = send_connection_binding;
    248   s3->tlsext_channel_id_valid = channel_id_valid;
    249   s3->next_proto_negotiated.CopyFrom(next_proto);
    250   s3->alpn_selected.CopyFrom(alpn);
    251 
    252   const size_t hostname_len = CBS_len(&hostname);
    253   if (hostname_len == 0) {
    254     s3->hostname.reset();
    255   } else {
    256     char *hostname_str = nullptr;
    257     if (!CBS_strdup(&hostname, &hostname_str)) {
    258       return false;
    259     }
    260     s3->hostname.reset(hostname_str);
    261   }
    262 
    263   ssl->quiet_shutdown = quiet_shutdown;
    264   ssl->tlsext_channel_id_enabled = channel_id_enabled;
    265   ssl->retain_only_sha256_of_client_certs = retain_only_sha256;
    266 
    267   Array<uint8_t> key_block;
    268   if (!tls1_configure_aead(ssl, evp_aead_open, &key_block,
    269                            s3->established_session->cipher, read_iv) ||
    270       !tls1_configure_aead(ssl, evp_aead_seal, &key_block,
    271                            s3->established_session->cipher, write_iv)) {
    272     return false;
    273   }
    274 
    275   if (!CBS_copy_bytes(&read_seq, s3->read_sequence,
    276                       sizeof(s3->read_sequence)) ||
    277       !CBS_copy_bytes(&write_seq, s3->write_sequence,
    278                       sizeof(s3->write_sequence))) {
    279     return false;
    280   }
    281 
    282   return true;
    283 }
    284 
    285 }  // namespace bssl
    286