statem_clnt.c 99.5 KB
Newer Older
R
Rich Salz 已提交
1 2
/*
 * Copyright 1995-2016 The OpenSSL Project Authors. All Rights Reserved.
3
 *
R
Rich Salz 已提交
4 5 6 7
 * Licensed under the OpenSSL license (the "License").  You may not use
 * this file except in compliance with the License.  You can obtain a copy
 * in the file LICENSE in the source distribution or at
 * https://www.openssl.org/source/license.html
8
 */
R
Rich Salz 已提交
9

B
Bodo Möller 已提交
10 11 12
/* ====================================================================
 * Copyright 2002 Sun Microsystems, Inc. ALL RIGHTS RESERVED.
 *
13
 * Portions of the attached software ("Contribution") are developed by
B
Bodo Möller 已提交
14 15 16 17 18 19 20 21 22
 * SUN MICROSYSTEMS, INC., and are contributed to the OpenSSL project.
 *
 * The Contribution is licensed pursuant to the OpenSSL open source
 * license provided above.
 *
 * ECC cipher suite support in OpenSSL originally written by
 * Vipul Gupta and Sumit Gupta of Sun Microsystems Laboratories.
 *
 */
23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48
/* ====================================================================
 * Copyright 2005 Nokia. All rights reserved.
 *
 * The portions of the attached software ("Contribution") is developed by
 * Nokia Corporation and is licensed pursuant to the OpenSSL open source
 * license.
 *
 * The Contribution, originally written by Mika Kousa and Pasi Eronen of
 * Nokia Corporation, consists of the "PSK" (Pre-Shared Key) ciphersuites
 * support (see RFC 4279) to OpenSSL.
 *
 * No patent licenses or other rights except those expressly stated in
 * the OpenSSL open source license shall be deemed granted or received
 * expressly, by implication, estoppel, or otherwise.
 *
 * No assurances are provided by Nokia that the Contribution does not
 * infringe the patent or other intellectual property rights of any third
 * party or that the license provides you with all the necessary rights
 * to make use of the Contribution.
 *
 * THE SOFTWARE IS PROVIDED "AS IS" WITHOUT WARRANTY OF ANY KIND. IN
 * ADDITION TO THE DISCLAIMERS INCLUDED IN THE LICENSE, NOKIA
 * SPECIFICALLY DISCLAIMS ANY LIABILITY FOR CLAIMS BROUGHT BY YOU OR ANY
 * OTHER ENTITY BASED ON INFRINGEMENT OF INTELLECTUAL PROPERTY RIGHTS OR
 * OTHERWISE.
 */
49 50

#include <stdio.h>
M
Matt Caswell 已提交
51
#include "../ssl_locl.h"
M
Matt Caswell 已提交
52
#include "statem_locl.h"
53 54 55 56
#include <openssl/buffer.h>
#include <openssl/rand.h>
#include <openssl/objects.h>
#include <openssl/evp.h>
57
#include <openssl/md5.h>
R
Rich Salz 已提交
58
#include <openssl/dh.h>
59
#include <openssl/bn.h>
R
Rich Salz 已提交
60
#include <openssl/engine.h>
61

M
Matt Caswell 已提交
62 63
static MSG_PROCESS_RETURN tls_process_encrypted_extensions(SSL *s, PACKET *pkt);

M
Matt Caswell 已提交
64
static ossl_inline int cert_req_allowed(SSL *s);
65
static int key_exchange_expected(SSL *s);
66
static int ca_dn_cmp(const X509_NAME *const *a, const X509_NAME *const *b);
M
Matt Caswell 已提交
67
static int ssl_cipher_list_to_bytes(SSL *s, STACK_OF(SSL_CIPHER) *sk,
M
Matt Caswell 已提交
68
                                    WPACKET *pkt);
B
Bodo Möller 已提交
69

M
Matt Caswell 已提交
70 71 72 73 74 75 76
/*
 * Is a CertificateRequest message allowed at the moment or not?
 *
 *  Return values are:
 *  1: Yes
 *  0: No
 */
M
Matt Caswell 已提交
77
static ossl_inline int cert_req_allowed(SSL *s)
M
Matt Caswell 已提交
78 79
{
    /* TLS does not like anon-DH with client cert */
80
    if ((s->version > SSL3_VERSION
E
Emilia Kasper 已提交
81 82
         && (s->s3->tmp.new_cipher->algorithm_auth & SSL_aNULL))
        || (s->s3->tmp.new_cipher->algorithm_auth & (SSL_aSRP | SSL_aPSK)))
M
Matt Caswell 已提交
83 84 85 86 87 88
        return 0;

    return 1;
}

/*
89
 * Should we expect the ServerKeyExchange message or not?
M
Matt Caswell 已提交
90 91 92 93 94
 *
 *  Return values are:
 *  1: Yes
 *  0: No
 */
95
static int key_exchange_expected(SSL *s)
M
Matt Caswell 已提交
96 97 98 99 100
{
    long alg_k = s->s3->tmp.new_cipher->algorithm_mkey;

    /*
     * Can't skip server key exchange if this is an ephemeral
101
     * ciphersuite or for SRP
M
Matt Caswell 已提交
102
     */
103 104 105
    if (alg_k & (SSL_kDHE | SSL_kECDHE | SSL_kDHEPSK | SSL_kECDHEPSK
                 | SSL_kSRP)) {
        return 1;
M
Matt Caswell 已提交
106 107
    }

108
    return 0;
M
Matt Caswell 已提交
109 110
}

111 112 113 114 115 116
/*
 * ossl_statem_client_read_transition() encapsulates the logic for the allowed
 * handshake state transitions when a TLS1.3 client is reading messages from the
 * server. The message type that the server has sent is provided in |mt|. The
 * current state is in |s->statem.hand_state|.
 *
117 118
 * Return values are 1 for success (transition allowed) and  0 on error
 * (transition not allowed)
119 120 121 122 123
 */
static int ossl_statem_client13_read_transition(SSL *s, int mt)
{
    OSSL_STATEM *st = &s->statem;

124 125 126 127 128
    /*
     * TODO(TLS1.3): This is still based on the TLSv1.2 state machine. Over time
     * we will update this to look more like real TLSv1.3
     */

129 130 131 132 133 134 135 136 137 138 139
    /*
     * Note: There is no case for TLS_ST_CW_CLNT_HELLO, because we haven't
     * yet negotiated TLSv1.3 at that point so that is handled by
     * ossl_statem_client_read_transition()
     */

    switch (st->hand_state) {
    default:
        break;

    case TLS_ST_CR_SRVR_HELLO:
M
Matt Caswell 已提交
140 141 142 143 144 145 146
        if (mt == SSL3_MT_ENCRYPTED_EXTENSIONS) {
            st->hand_state = TLS_ST_CR_ENCRYPTED_EXTENSIONS;
            return 1;
        }
        break;

    case TLS_ST_CR_ENCRYPTED_EXTENSIONS:
147
        if (s->hit) {
148 149
            if (mt == SSL3_MT_FINISHED) {
                st->hand_state = TLS_ST_CR_FINISHED;
150 151 152
                return 1;
            }
        } else {
153 154 155
            if (mt == SSL3_MT_CERTIFICATE_REQUEST) {
                st->hand_state = TLS_ST_CR_CERT_REQ;
                return 1;
156 157
            }
            if (mt == SSL3_MT_CERTIFICATE) {
158 159 160 161 162 163
                st->hand_state = TLS_ST_CR_CERT;
                return 1;
            }
        }
        break;

164 165 166 167 168 169 170
    case TLS_ST_CR_CERT_REQ:
        if (mt == SSL3_MT_CERTIFICATE) {
            st->hand_state = TLS_ST_CR_CERT;
            return 1;
        }
        break;

171 172 173 174 175 176 177 178 179 180 181 182 183 184 185 186 187
    case TLS_ST_CR_CERT:
        /*
         * The CertificateStatus message is optional even if
         * |tlsext_status_expected| is set
         */
        if (s->tlsext_status_expected && mt == SSL3_MT_CERTIFICATE_STATUS) {
            st->hand_state = TLS_ST_CR_CERT_STATUS;
            return 1;
        }
        /* Fall through */

    case TLS_ST_CR_CERT_STATUS:
        if (mt == SSL3_MT_FINISHED) {
            st->hand_state = TLS_ST_CR_FINISHED;
            return 1;
        }
        break;
188

189 190 191 192 193 194
    }

    /* No valid transition found */
    return 0;
}

M
Matt Caswell 已提交
195
/*
196 197 198 199
 * ossl_statem_client_read_transition() encapsulates the logic for the allowed
 * handshake state transitions when the client is reading messages from the
 * server. The message type that the server has sent is provided in |mt|. The
 * current state is in |s->statem.hand_state|.
M
Matt Caswell 已提交
200
 *
201 202
 * Return values are 1 for success (transition allowed) and  0 on error
 * (transition not allowed)
M
Matt Caswell 已提交
203
 */
204
int ossl_statem_client_read_transition(SSL *s, int mt)
M
Matt Caswell 已提交
205
{
M
Matt Caswell 已提交
206
    OSSL_STATEM *st = &s->statem;
207
    int ske_expected;
M
Matt Caswell 已提交
208

209 210 211 212
    /*
     * Note that after a ClientHello we don't know what version we are going
     * to negotiate yet, so we don't take this branch until later
     */
213
    if (SSL_IS_TLS13(s)) {
214 215 216 217
        if (!ossl_statem_client13_read_transition(s, mt))
            goto err;
        return 1;
    }
218

E
Emilia Kasper 已提交
219
    switch (st->hand_state) {
R
Rich Salz 已提交
220 221 222
    default:
        break;

M
Matt Caswell 已提交
223 224 225 226 227 228 229 230 231 232 233 234 235 236 237 238 239 240 241 242 243 244 245 246 247 248 249 250 251
    case TLS_ST_CW_CLNT_HELLO:
        if (mt == SSL3_MT_SERVER_HELLO) {
            st->hand_state = TLS_ST_CR_SRVR_HELLO;
            return 1;
        }

        if (SSL_IS_DTLS(s)) {
            if (mt == DTLS1_MT_HELLO_VERIFY_REQUEST) {
                st->hand_state = DTLS_ST_CR_HELLO_VERIFY_REQUEST;
                return 1;
            }
        }
        break;

    case TLS_ST_CR_SRVR_HELLO:
        if (s->hit) {
            if (s->tlsext_ticket_expected) {
                if (mt == SSL3_MT_NEWSESSION_TICKET) {
                    st->hand_state = TLS_ST_CR_SESSION_TICKET;
                    return 1;
                }
            } else if (mt == SSL3_MT_CHANGE_CIPHER_SPEC) {
                st->hand_state = TLS_ST_CR_CHANGE;
                return 1;
            }
        } else {
            if (SSL_IS_DTLS(s) && mt == DTLS1_MT_HELLO_VERIFY_REQUEST) {
                st->hand_state = DTLS_ST_CR_HELLO_VERIFY_REQUEST;
                return 1;
252
            } else if (s->version >= TLS1_VERSION
E
Emilia Kasper 已提交
253 254 255
                       && s->tls_session_secret_cb != NULL
                       && s->session->tlsext_tick != NULL
                       && mt == SSL3_MT_CHANGE_CIPHER_SPEC) {
256 257 258 259 260 261 262 263 264
                /*
                 * Normally, we can tell if the server is resuming the session
                 * from the session ID. EAP-FAST (RFC 4851), however, relies on
                 * the next server message after the ServerHello to determine if
                 * the server is resuming.
                 */
                s->hit = 1;
                st->hand_state = TLS_ST_CR_CHANGE;
                return 1;
M
Matt Caswell 已提交
265
            } else if (!(s->s3->tmp.new_cipher->algorithm_auth
E
Emilia Kasper 已提交
266
                         & (SSL_aNULL | SSL_aSRP | SSL_aPSK))) {
M
Matt Caswell 已提交
267 268 269 270 271
                if (mt == SSL3_MT_CERTIFICATE) {
                    st->hand_state = TLS_ST_CR_CERT;
                    return 1;
                }
            } else {
272 273 274
                ske_expected = key_exchange_expected(s);
                /* SKE is optional for some PSK ciphersuites */
                if (ske_expected
E
Emilia Kasper 已提交
275 276
                    || ((s->s3->tmp.new_cipher->algorithm_mkey & SSL_PSK)
                        && mt == SSL3_MT_SERVER_KEY_EXCHANGE)) {
277 278 279 280 281
                    if (mt == SSL3_MT_SERVER_KEY_EXCHANGE) {
                        st->hand_state = TLS_ST_CR_KEY_EXCH;
                        return 1;
                    }
                } else if (mt == SSL3_MT_CERTIFICATE_REQUEST
E
Emilia Kasper 已提交
282 283 284
                           && cert_req_allowed(s)) {
                    st->hand_state = TLS_ST_CR_CERT_REQ;
                    return 1;
285
                } else if (mt == SSL3_MT_SERVER_DONE) {
E
Emilia Kasper 已提交
286 287
                    st->hand_state = TLS_ST_CR_SRVR_DONE;
                    return 1;
M
Matt Caswell 已提交
288 289 290 291 292 293
                }
            }
        }
        break;

    case TLS_ST_CR_CERT:
294 295 296 297 298 299 300
        /*
         * The CertificateStatus message is optional even if
         * |tlsext_status_expected| is set
         */
        if (s->tlsext_status_expected && mt == SSL3_MT_CERTIFICATE_STATUS) {
            st->hand_state = TLS_ST_CR_CERT_STATUS;
            return 1;
301 302 303 304 305 306
        }
        /* Fall through */

    case TLS_ST_CR_CERT_STATUS:
        ske_expected = key_exchange_expected(s);
        /* SKE is optional for some PSK ciphersuites */
E
Emilia Kasper 已提交
307 308
        if (ske_expected || ((s->s3->tmp.new_cipher->algorithm_mkey & SSL_PSK)
                             && mt == SSL3_MT_SERVER_KEY_EXCHANGE)) {
M
Matt Caswell 已提交
309 310 311 312
            if (mt == SSL3_MT_SERVER_KEY_EXCHANGE) {
                st->hand_state = TLS_ST_CR_KEY_EXCH;
                return 1;
            }
313
            goto err;
M
Matt Caswell 已提交
314
        }
315
        /* Fall through */
M
Matt Caswell 已提交
316

317 318 319
    case TLS_ST_CR_KEY_EXCH:
        if (mt == SSL3_MT_CERTIFICATE_REQUEST) {
            if (cert_req_allowed(s)) {
M
Matt Caswell 已提交
320 321 322
                st->hand_state = TLS_ST_CR_CERT_REQ;
                return 1;
            }
323
            goto err;
M
Matt Caswell 已提交
324
        }
325
        /* Fall through */
M
Matt Caswell 已提交
326 327 328 329 330 331 332 333 334

    case TLS_ST_CR_CERT_REQ:
        if (mt == SSL3_MT_SERVER_DONE) {
            st->hand_state = TLS_ST_CR_SRVR_DONE;
            return 1;
        }
        break;

    case TLS_ST_CW_FINISHED:
335 336 337 338 339
        if (s->tlsext_ticket_expected) {
            if (mt == SSL3_MT_NEWSESSION_TICKET) {
                st->hand_state = TLS_ST_CR_SESSION_TICKET;
                return 1;
            }
M
Matt Caswell 已提交
340 341 342 343 344 345 346 347 348 349 350 351 352 353 354 355 356 357 358 359 360
        } else if (mt == SSL3_MT_CHANGE_CIPHER_SPEC) {
            st->hand_state = TLS_ST_CR_CHANGE;
            return 1;
        }
        break;

    case TLS_ST_CR_SESSION_TICKET:
        if (mt == SSL3_MT_CHANGE_CIPHER_SPEC) {
            st->hand_state = TLS_ST_CR_CHANGE;
            return 1;
        }
        break;

    case TLS_ST_CR_CHANGE:
        if (mt == SSL3_MT_FINISHED) {
            st->hand_state = TLS_ST_CR_FINISHED;
            return 1;
        }
        break;
    }

361
 err:
M
Matt Caswell 已提交
362
    /* No valid transition found */
363
    ssl3_send_alert(s, SSL3_AL_FATAL, SSL3_AD_UNEXPECTED_MESSAGE);
364
    SSLerr(SSL_F_OSSL_STATEM_CLIENT_READ_TRANSITION, SSL_R_UNEXPECTED_MESSAGE);
M
Matt Caswell 已提交
365 366 367 368
    return 0;
}

/*
369 370 371 372 373 374 375 376
 * ossl_statem_client13_write_transition() works out what handshake state to
 * move to next when the TLSv1.3 client is writing messages to be sent to the
 * server.
 */
static WRITE_TRAN ossl_statem_client13_write_transition(SSL *s)
{
    OSSL_STATEM *st = &s->statem;

377 378 379 380 381
    /*
     * TODO(TLS1.3): This is still based on the TLSv1.2 state machine. Over time
     * we will update this to look more like real TLSv1.3
     */

382 383 384 385 386 387 388 389 390 391
    /*
     * Note: There are no cases for TLS_ST_BEFORE or TLS_ST_CW_CLNT_HELLO,
     * because we haven't negotiated TLSv1.3 yet at that point. They are
     * handled by ossl_statem_client_write_transition().
     */
    switch (st->hand_state) {
    default:
        /* Shouldn't happen */
        return WRITE_TRAN_ERROR;

392
    case TLS_ST_CR_FINISHED:
393
        st->hand_state = (s->s3->tmp.cert_req != 0) ? TLS_ST_CW_CERT
394
                                                    : TLS_ST_CW_FINISHED;
395 396 397 398
        return WRITE_TRAN_CONTINUE;

    case TLS_ST_CW_CERT:
        /* If a non-empty Certificate we also send CertificateVerify */
399
        st->hand_state = (s->s3->tmp.cert_req == 1) ? TLS_ST_CW_CERT_VRFY
400
                                                    : TLS_ST_CW_FINISHED;
401 402 403 404 405 406 407
        return WRITE_TRAN_CONTINUE;

    case TLS_ST_CW_CERT_VRFY:
        st->hand_state = TLS_ST_CW_FINISHED;
        return WRITE_TRAN_CONTINUE;

    case TLS_ST_CW_FINISHED:
408 409 410
        st->hand_state = TLS_ST_OK;
        ossl_statem_set_in_init(s, 0);
        return WRITE_TRAN_CONTINUE;
411 412 413 414 415 416
    }
}

/*
 * ossl_statem_client_write_transition() works out what handshake state to
 * move to next when the client is writing messages to be sent to the server.
M
Matt Caswell 已提交
417
 */
418
WRITE_TRAN ossl_statem_client_write_transition(SSL *s)
M
Matt Caswell 已提交
419
{
M
Matt Caswell 已提交
420
    OSSL_STATEM *st = &s->statem;
M
Matt Caswell 已提交
421

422 423 424 425 426
    /*
     * Note that immediately before/after a ClientHello we don't know what
     * version we are going to negotiate yet, so we don't take this branch until
     * later
     */
427
    if (SSL_IS_TLS13(s))
428 429
        return ossl_statem_client13_write_transition(s);

E
Emilia Kasper 已提交
430
    switch (st->hand_state) {
R
Rich Salz 已提交
431 432 433 434
    default:
        /* Shouldn't happen */
        return WRITE_TRAN_ERROR;

E
Emilia Kasper 已提交
435 436 437 438 439
    case TLS_ST_OK:
        /* Renegotiation - fall through */
    case TLS_ST_BEFORE:
        st->hand_state = TLS_ST_CW_CLNT_HELLO;
        return WRITE_TRAN_CONTINUE;
M
Matt Caswell 已提交
440

E
Emilia Kasper 已提交
441 442 443 444 445 446
    case TLS_ST_CW_CLNT_HELLO:
        /*
         * No transition at the end of writing because we don't know what
         * we will be sent
         */
        return WRITE_TRAN_FINISHED;
M
Matt Caswell 已提交
447

E
Emilia Kasper 已提交
448 449 450
    case DTLS_ST_CR_HELLO_VERIFY_REQUEST:
        st->hand_state = TLS_ST_CW_CLNT_HELLO;
        return WRITE_TRAN_CONTINUE;
M
Matt Caswell 已提交
451

E
Emilia Kasper 已提交
452 453 454 455
    case TLS_ST_CR_SRVR_DONE:
        if (s->s3->tmp.cert_req)
            st->hand_state = TLS_ST_CW_CERT;
        else
M
Matt Caswell 已提交
456
            st->hand_state = TLS_ST_CW_KEY_EXCH;
E
Emilia Kasper 已提交
457
        return WRITE_TRAN_CONTINUE;
M
Matt Caswell 已提交
458

E
Emilia Kasper 已提交
459 460 461
    case TLS_ST_CW_CERT:
        st->hand_state = TLS_ST_CW_KEY_EXCH;
        return WRITE_TRAN_CONTINUE;
M
Matt Caswell 已提交
462

E
Emilia Kasper 已提交
463 464 465 466 467 468 469 470 471 472 473 474 475 476
    case TLS_ST_CW_KEY_EXCH:
        /*
         * For TLS, cert_req is set to 2, so a cert chain of nothing is
         * sent, but no verify packet is sent
         */
        /*
         * XXX: For now, we do not support client authentication in ECDH
         * cipher suites with ECDH (rather than ECDSA) certificates. We
         * need to skip the certificate verify message when client's
         * ECDH public key is sent inside the client certificate.
         */
        if (s->s3->tmp.cert_req == 1) {
            st->hand_state = TLS_ST_CW_CERT_VRFY;
        } else {
M
Matt Caswell 已提交
477
            st->hand_state = TLS_ST_CW_CHANGE;
E
Emilia Kasper 已提交
478 479 480 481 482
        }
        if (s->s3->flags & TLS1_FLAGS_SKIP_CERT_VERIFY) {
            st->hand_state = TLS_ST_CW_CHANGE;
        }
        return WRITE_TRAN_CONTINUE;
M
Matt Caswell 已提交
483

E
Emilia Kasper 已提交
484 485 486 487 488
    case TLS_ST_CW_CERT_VRFY:
        st->hand_state = TLS_ST_CW_CHANGE;
        return WRITE_TRAN_CONTINUE;

    case TLS_ST_CW_CHANGE:
M
Matt Caswell 已提交
489
#if defined(OPENSSL_NO_NEXTPROTONEG)
E
Emilia Kasper 已提交
490
        st->hand_state = TLS_ST_CW_FINISHED;
M
Matt Caswell 已提交
491
#else
E
Emilia Kasper 已提交
492 493 494 495
        if (!SSL_IS_DTLS(s) && s->s3->next_proto_neg_seen)
            st->hand_state = TLS_ST_CW_NEXT_PROTO;
        else
            st->hand_state = TLS_ST_CW_FINISHED;
M
Matt Caswell 已提交
496
#endif
E
Emilia Kasper 已提交
497
        return WRITE_TRAN_CONTINUE;
M
Matt Caswell 已提交
498 499

#if !defined(OPENSSL_NO_NEXTPROTONEG)
E
Emilia Kasper 已提交
500 501 502
    case TLS_ST_CW_NEXT_PROTO:
        st->hand_state = TLS_ST_CW_FINISHED;
        return WRITE_TRAN_CONTINUE;
M
Matt Caswell 已提交
503 504
#endif

E
Emilia Kasper 已提交
505 506 507 508 509 510 511 512
    case TLS_ST_CW_FINISHED:
        if (s->hit) {
            st->hand_state = TLS_ST_OK;
            ossl_statem_set_in_init(s, 0);
            return WRITE_TRAN_CONTINUE;
        } else {
            return WRITE_TRAN_FINISHED;
        }
M
Matt Caswell 已提交
513

E
Emilia Kasper 已提交
514 515 516 517 518 519 520 521 522
    case TLS_ST_CR_FINISHED:
        if (s->hit) {
            st->hand_state = TLS_ST_CW_CHANGE;
            return WRITE_TRAN_CONTINUE;
        } else {
            st->hand_state = TLS_ST_OK;
            ossl_statem_set_in_init(s, 0);
            return WRITE_TRAN_CONTINUE;
        }
M
Matt Caswell 已提交
523 524 525 526 527 528 529
    }
}

/*
 * Perform any pre work that needs to be done prior to sending a message from
 * the client to the server.
 */
530
WORK_STATE ossl_statem_client_pre_work(SSL *s, WORK_STATE wst)
M
Matt Caswell 已提交
531
{
M
Matt Caswell 已提交
532
    OSSL_STATEM *st = &s->statem;
M
Matt Caswell 已提交
533

E
Emilia Kasper 已提交
534
    switch (st->hand_state) {
R
Rich Salz 已提交
535 536 537 538
    default:
        /* No pre work to be done */
        break;

M
Matt Caswell 已提交
539 540 541 542
    case TLS_ST_CW_CLNT_HELLO:
        s->shutdown = 0;
        if (SSL_IS_DTLS(s)) {
            /* every DTLS ClientHello resets Finished MAC */
543 544 545 546
            if (!ssl3_init_finished_mac(s)) {
                ossl_statem_set_error(s);
                return WORK_ERROR;
            }
M
Matt Caswell 已提交
547 548 549 550 551 552 553 554 555 556 557 558 559 560 561 562 563
        }
        break;

    case TLS_ST_CW_CHANGE:
        if (SSL_IS_DTLS(s)) {
            if (s->hit) {
                /*
                 * We're into the last flight so we don't retransmit these
                 * messages unless we need to.
                 */
                st->use_timer = 0;
            }
#ifndef OPENSSL_NO_SCTP
            if (BIO_dgram_is_sctp(SSL_get_wbio(s)))
                return dtls_wait_for_dry(s);
#endif
        }
R
Rich Salz 已提交
564
        break;
M
Matt Caswell 已提交
565 566 567 568 569 570 571 572 573 574 575 576

    case TLS_ST_OK:
        return tls_finish_handshake(s, wst);
    }

    return WORK_FINISHED_CONTINUE;
}

/*
 * Perform any work that needs to be done after sending a message from the
 * client to the server.
 */
577
WORK_STATE ossl_statem_client_post_work(SSL *s, WORK_STATE wst)
M
Matt Caswell 已提交
578
{
M
Matt Caswell 已提交
579
    OSSL_STATEM *st = &s->statem;
M
Matt Caswell 已提交
580 581 582

    s->init_num = 0;

E
Emilia Kasper 已提交
583
    switch (st->hand_state) {
R
Rich Salz 已提交
584 585 586 587
    default:
        /* No post work to be done */
        break;

M
Matt Caswell 已提交
588
    case TLS_ST_CW_CLNT_HELLO:
M
Matt Caswell 已提交
589
        if (wst == WORK_MORE_A && statem_flush(s) != 1)
M
Matt Caswell 已提交
590
            return WORK_MORE_A;
M
Matt Caswell 已提交
591

M
Matt Caswell 已提交
592 593 594 595 596 597 598 599 600 601 602 603 604 605 606 607 608 609 610 611 612 613 614 615 616 617 618 619 620 621 622 623 624 625 626 627 628 629 630 631 632 633 634 635 636 637 638 639 640 641 642 643 644 645 646 647 648
        if (SSL_IS_DTLS(s)) {
            /* Treat the next message as the first packet */
            s->first_packet = 1;
        }
        break;

    case TLS_ST_CW_KEY_EXCH:
        if (tls_client_key_exchange_post_work(s) == 0)
            return WORK_ERROR;
        break;

    case TLS_ST_CW_CHANGE:
        s->session->cipher = s->s3->tmp.new_cipher;
#ifdef OPENSSL_NO_COMP
        s->session->compress_meth = 0;
#else
        if (s->s3->tmp.new_compression == NULL)
            s->session->compress_meth = 0;
        else
            s->session->compress_meth = s->s3->tmp.new_compression->id;
#endif
        if (!s->method->ssl3_enc->setup_key_block(s))
            return WORK_ERROR;

        if (!s->method->ssl3_enc->change_cipher_state(s,
                                                      SSL3_CHANGE_CIPHER_CLIENT_WRITE))
            return WORK_ERROR;

        if (SSL_IS_DTLS(s)) {
#ifndef OPENSSL_NO_SCTP
            if (s->hit) {
                /*
                 * Change to new shared key of SCTP-Auth, will be ignored if
                 * no SCTP used.
                 */
                BIO_ctrl(SSL_get_wbio(s), BIO_CTRL_DGRAM_SCTP_NEXT_AUTH_KEY,
                         0, NULL);
            }
#endif

            dtls1_reset_seq_numbers(s, SSL3_CC_WRITE);
        }
        break;

    case TLS_ST_CW_FINISHED:
#ifndef OPENSSL_NO_SCTP
        if (wst == WORK_MORE_A && SSL_IS_DTLS(s) && s->hit == 0) {
            /*
             * Change to new shared key of SCTP-Auth, will be ignored if
             * no SCTP used.
             */
            BIO_ctrl(SSL_get_wbio(s), BIO_CTRL_DGRAM_SCTP_NEXT_AUTH_KEY,
                     0, NULL);
        }
#endif
        if (statem_flush(s) != 1)
            return WORK_MORE_B;
649 650 651 652 653 654

        if (SSL_IS_TLS13(s)) {
            if (!s->method->ssl3_enc->change_cipher_state(s,
                        SSL3_CC_APPLICATION | SSL3_CHANGE_CIPHER_CLIENT_WRITE))
            return WORK_ERROR;
        }
M
Matt Caswell 已提交
655 656 657 658 659 660 661
        break;
    }

    return WORK_FINISHED_CONTINUE;
}

/*
662 663
 * Get the message construction function and message type for sending from the
 * client
M
Matt Caswell 已提交
664 665 666 667 668
 *
 * Valid return values are:
 *   1: Success
 *   0: Error
 */
669
int ossl_statem_client_construct_message(SSL *s, WPACKET *pkt,
670
                                         confunc_f *confunc, int *mt)
M
Matt Caswell 已提交
671
{
M
Matt Caswell 已提交
672
    OSSL_STATEM *st = &s->statem;
M
Matt Caswell 已提交
673

674 675 676 677 678 679
    switch (st->hand_state) {
    default:
        /* Shouldn't happen */
        return 0;

    case TLS_ST_CW_CHANGE:
680
        if (SSL_IS_DTLS(s))
681
            *confunc = dtls_construct_change_cipher_spec;
682
        else
683 684
            *confunc = tls_construct_change_cipher_spec;
        *mt = SSL3_MT_CHANGE_CIPHER_SPEC;
685 686 687
        break;

    case TLS_ST_CW_CLNT_HELLO:
688 689
        *confunc = tls_construct_client_hello;
        *mt = SSL3_MT_CLIENT_HELLO;
690 691 692
        break;

    case TLS_ST_CW_CERT:
693 694
        *confunc = tls_construct_client_certificate;
        *mt = SSL3_MT_CERTIFICATE;
695 696 697
        break;

    case TLS_ST_CW_KEY_EXCH:
698 699
        *confunc = tls_construct_client_key_exchange;
        *mt = SSL3_MT_CLIENT_KEY_EXCHANGE;
700 701 702
        break;

    case TLS_ST_CW_CERT_VRFY:
703 704
        *confunc = tls_construct_client_verify;
        *mt = SSL3_MT_CERTIFICATE_VERIFY;
705
        break;
M
Matt Caswell 已提交
706 707

#if !defined(OPENSSL_NO_NEXTPROTONEG)
708
    case TLS_ST_CW_NEXT_PROTO:
709 710
        *confunc = tls_construct_next_proto;
        *mt = SSL3_MT_NEXT_PROTO;
711
        break;
M
Matt Caswell 已提交
712
#endif
713
    case TLS_ST_CW_FINISHED:
714 715
        *confunc = tls_construct_finished;
        *mt = SSL3_MT_FINISHED;
716 717
        break;
    }
718 719

    return 1;
M
Matt Caswell 已提交
720 721 722 723 724 725
}

/*
 * Returns the maximum allowed length for the current message that we are
 * reading. Excludes the message header.
 */
726
size_t ossl_statem_client_max_message_size(SSL *s)
M
Matt Caswell 已提交
727
{
M
Matt Caswell 已提交
728
    OSSL_STATEM *st = &s->statem;
M
Matt Caswell 已提交
729

E
Emilia Kasper 已提交
730
    switch (st->hand_state) {
R
Rich Salz 已提交
731 732 733 734
    default:
        /* Shouldn't happen */
        return 0;

E
Emilia Kasper 已提交
735 736
    case TLS_ST_CR_SRVR_HELLO:
        return SERVER_HELLO_MAX_LENGTH;
M
Matt Caswell 已提交
737

E
Emilia Kasper 已提交
738 739
    case DTLS_ST_CR_HELLO_VERIFY_REQUEST:
        return HELLO_VERIFY_REQUEST_MAX_LENGTH;
M
Matt Caswell 已提交
740

E
Emilia Kasper 已提交
741 742
    case TLS_ST_CR_CERT:
        return s->max_cert_list;
M
Matt Caswell 已提交
743

E
Emilia Kasper 已提交
744 745
    case TLS_ST_CR_CERT_STATUS:
        return SSL3_RT_MAX_PLAIN_LENGTH;
M
Matt Caswell 已提交
746

E
Emilia Kasper 已提交
747 748
    case TLS_ST_CR_KEY_EXCH:
        return SERVER_KEY_EXCH_MAX_LENGTH;
M
Matt Caswell 已提交
749

E
Emilia Kasper 已提交
750 751 752 753 754 755 756
    case TLS_ST_CR_CERT_REQ:
        /*
         * Set to s->max_cert_list for compatibility with previous releases. In
         * practice these messages can get quite long if servers are configured
         * to provide a long list of acceptable CAs
         */
        return s->max_cert_list;
M
Matt Caswell 已提交
757

E
Emilia Kasper 已提交
758 759
    case TLS_ST_CR_SRVR_DONE:
        return SERVER_HELLO_DONE_MAX_LENGTH;
M
Matt Caswell 已提交
760

E
Emilia Kasper 已提交
761 762 763 764
    case TLS_ST_CR_CHANGE:
        if (s->version == DTLS1_BAD_VER)
            return 3;
        return CCS_MAX_LENGTH;
M
Matt Caswell 已提交
765

E
Emilia Kasper 已提交
766 767
    case TLS_ST_CR_SESSION_TICKET:
        return SSL3_RT_MAX_PLAIN_LENGTH;
M
Matt Caswell 已提交
768

E
Emilia Kasper 已提交
769 770
    case TLS_ST_CR_FINISHED:
        return FINISHED_MAX_LENGTH;
M
Matt Caswell 已提交
771 772 773

    case TLS_ST_CR_ENCRYPTED_EXTENSIONS:
        return ENCRYPTED_EXTENSIONS_MAX_LENGTH;
M
Matt Caswell 已提交
774 775 776 777 778 779
    }
}

/*
 * Process a message that the client has been received from the server.
 */
780
MSG_PROCESS_RETURN ossl_statem_client_process_message(SSL *s, PACKET *pkt)
M
Matt Caswell 已提交
781
{
M
Matt Caswell 已提交
782
    OSSL_STATEM *st = &s->statem;
M
Matt Caswell 已提交
783

E
Emilia Kasper 已提交
784
    switch (st->hand_state) {
R
Rich Salz 已提交
785 786 787 788
    default:
        /* Shouldn't happen */
        return MSG_PROCESS_ERROR;

E
Emilia Kasper 已提交
789 790
    case TLS_ST_CR_SRVR_HELLO:
        return tls_process_server_hello(s, pkt);
M
Matt Caswell 已提交
791

E
Emilia Kasper 已提交
792 793
    case DTLS_ST_CR_HELLO_VERIFY_REQUEST:
        return dtls_process_hello_verify(s, pkt);
M
Matt Caswell 已提交
794

E
Emilia Kasper 已提交
795 796
    case TLS_ST_CR_CERT:
        return tls_process_server_certificate(s, pkt);
M
Matt Caswell 已提交
797

E
Emilia Kasper 已提交
798 799
    case TLS_ST_CR_CERT_STATUS:
        return tls_process_cert_status(s, pkt);
M
Matt Caswell 已提交
800

E
Emilia Kasper 已提交
801 802
    case TLS_ST_CR_KEY_EXCH:
        return tls_process_key_exchange(s, pkt);
M
Matt Caswell 已提交
803

E
Emilia Kasper 已提交
804 805
    case TLS_ST_CR_CERT_REQ:
        return tls_process_certificate_request(s, pkt);
M
Matt Caswell 已提交
806

E
Emilia Kasper 已提交
807 808
    case TLS_ST_CR_SRVR_DONE:
        return tls_process_server_done(s, pkt);
M
Matt Caswell 已提交
809

E
Emilia Kasper 已提交
810 811
    case TLS_ST_CR_CHANGE:
        return tls_process_change_cipher_spec(s, pkt);
M
Matt Caswell 已提交
812

E
Emilia Kasper 已提交
813 814
    case TLS_ST_CR_SESSION_TICKET:
        return tls_process_new_session_ticket(s, pkt);
M
Matt Caswell 已提交
815

E
Emilia Kasper 已提交
816 817
    case TLS_ST_CR_FINISHED:
        return tls_process_finished(s, pkt);
M
Matt Caswell 已提交
818 819 820

    case TLS_ST_CR_ENCRYPTED_EXTENSIONS:
        return tls_process_encrypted_extensions(s, pkt);
M
Matt Caswell 已提交
821 822 823 824 825 826 827
    }
}

/*
 * Perform any further processing required following the receipt of a message
 * from the server
 */
828
WORK_STATE ossl_statem_client_post_process_message(SSL *s, WORK_STATE wst)
M
Matt Caswell 已提交
829
{
M
Matt Caswell 已提交
830
    OSSL_STATEM *st = &s->statem;
M
Matt Caswell 已提交
831

E
Emilia Kasper 已提交
832
    switch (st->hand_state) {
R
Rich Salz 已提交
833 834 835 836
    default:
        /* Shouldn't happen */
        return WORK_ERROR;

837 838 839
    case TLS_ST_CR_CERT_REQ:
        return tls_prepare_client_certificate(s, wst);

M
Matt Caswell 已提交
840 841 842 843 844 845 846 847
#ifndef OPENSSL_NO_SCTP
    case TLS_ST_CR_SRVR_DONE:
        /* We only get here if we are using SCTP and we are renegotiating */
        if (BIO_dgram_sctp_msg_waiting(SSL_get_rbio(s))) {
            s->s3->in_read_app_data = 2;
            s->rwstate = SSL_READING;
            BIO_clear_retry_flags(SSL_get_rbio(s));
            BIO_set_retry_read(SSL_get_rbio(s));
M
Matt Caswell 已提交
848
            ossl_statem_set_sctp_read_sock(s, 1);
M
Matt Caswell 已提交
849 850
            return WORK_MORE_A;
        }
M
Matt Caswell 已提交
851
        ossl_statem_set_sctp_read_sock(s, 0);
M
Matt Caswell 已提交
852 853 854 855 856
        return WORK_FINISHED_STOP;
#endif
    }
}

857
int tls_construct_client_hello(SSL *s, WPACKET *pkt)
858
{
859
    unsigned char *p;
860 861
    size_t sess_id_len;
    int i, protverr;
862
    int al = SSL_AD_HANDSHAKE_FAILURE;
863
#ifndef OPENSSL_NO_COMP
864 865
    SSL_COMP *comp;
#endif
866
    SSL_SESSION *sess = s->session;
867

868
    if (!WPACKET_set_max_size(pkt, SSL3_RT_MAX_PLAIN_LENGTH)) {
869 870
        /* Should not happen */
        SSLerr(SSL_F_TLS_CONSTRUCT_CLIENT_HELLO, ERR_R_INTERNAL_ERROR);
871
        return 0;
872
    }
873

874
    /* Work out what SSL/TLS/DTLS version to use */
875 876 877
    protverr = ssl_set_client_hello_version(s);
    if (protverr != 0) {
        SSLerr(SSL_F_TLS_CONSTRUCT_CLIENT_HELLO, protverr);
878
        return 0;
879
    }
880

E
Emilia Kasper 已提交
881
    if ((sess == NULL) || !ssl_version_supported(s, sess->ssl_version) ||
882
        /*
883 884
         * In the case of EAP-FAST, we can have a pre-shared
         * "ticket" without a session ID.
885
         */
886 887 888
        (!sess->session_id_length && !sess->tlsext_tick) ||
        (sess->not_resumable)) {
        if (!ssl_get_new_session(s, 0))
889
            return 0;
890 891
    }
    /* else use the pre-loaded session */
892

893
    p = s->s3->client_random;
894

895 896 897 898 899 900 901 902 903 904 905
    /*
     * for DTLS if client_random is initialized, reuse it, we are
     * required to use same upon reply to HelloVerify
     */
    if (SSL_IS_DTLS(s)) {
        size_t idx;
        i = 1;
        for (idx = 0; idx < sizeof(s->s3->client_random); idx++) {
            if (p[idx]) {
                i = 0;
                break;
906 907
            }
        }
908 909
    } else
        i = 1;
910

E
Emilia Kasper 已提交
911
    if (i && ssl_fill_hello_random(s, 0, p, sizeof(s->s3->client_random)) <= 0)
912
        return 0;
913 914 915 916 917 918 919 920 921 922 923 924 925 926 927 928

    /*-
     * version indicates the negotiated version: for example from
     * an SSLv2/v3 compatible client hello). The client_version
     * field is the maximum version we permit and it is also
     * used in RSA encrypted premaster secrets. Some servers can
     * choke if we initially report a higher version then
     * renegotiate to a lower one in the premaster secret. This
     * didn't happen with TLS 1.0 as most servers supported it
     * but it can with TLS 1.1 or later if the server only supports
     * 1.0.
     *
     * Possible scenario with previous logic:
     *      1. Client hello indicates TLS 1.2
     *      2. Server hello says TLS 1.0
     *      3. RSA encrypted premaster secret uses 1.2.
F
FdaSilvaYY 已提交
929
     *      4. Handshake proceeds using TLS 1.0.
930 931 932 933 934 935 936 937 938 939 940 941 942
     *      5. Server sends hello request to renegotiate.
     *      6. Client hello indicates TLS v1.0 as we now
     *         know that is maximum server supports.
     *      7. Server chokes on RSA encrypted premaster secret
     *         containing version 1.0.
     *
     * For interoperability it should be OK to always use the
     * maximum version we support in client hello and then rely
     * on the checking of version to ensure the servers isn't
     * being inconsistent: for example initially negotiating with
     * TLS 1.0 and renegotiating with TLS 1.2. We do this by using
     * client_version in client hello and not resetting it to
     * the negotiated version.
943 944
     *
     * For TLS 1.3 we always set the ClientHello version to 1.2 and rely on the
945
     * supported_versions extension for the real supported versions.
946
     */
947
    if (!WPACKET_put_bytes_u16(pkt, s->client_version)
948
            || !WPACKET_memcpy(pkt, s->s3->client_random, SSL3_RANDOM_SIZE)) {
949
        SSLerr(SSL_F_TLS_CONSTRUCT_CLIENT_HELLO, ERR_R_INTERNAL_ERROR);
950
        return 0;
951
    }
952 953 954

    /* Session ID */
    if (s->new_session)
955
        sess_id_len = 0;
956
    else
957 958
        sess_id_len = s->session->session_id_length;
    if (sess_id_len > sizeof(s->session->session_id)
959
            || !WPACKET_start_sub_packet_u8(pkt)
960 961
            || (sess_id_len != 0 && !WPACKET_memcpy(pkt, s->session->session_id,
                                                    sess_id_len))
962
            || !WPACKET_close(pkt)) {
963
        SSLerr(SSL_F_TLS_CONSTRUCT_CLIENT_HELLO, ERR_R_INTERNAL_ERROR);
964
        return 0;
965
    }
966

967 968
    /* cookie stuff for DTLS */
    if (SSL_IS_DTLS(s)) {
969
        if (s->d1->cookie_len > sizeof(s->d1->cookie)
970
                || !WPACKET_sub_memcpy_u8(pkt, s->d1->cookie,
971
                                          s->d1->cookie_len)) {
972
            SSLerr(SSL_F_TLS_CONSTRUCT_CLIENT_HELLO, ERR_R_INTERNAL_ERROR);
973
            return 0;
974
        }
975 976 977
    }

    /* Ciphers supported */
978
    if (!WPACKET_start_sub_packet_u16(pkt)) {
979
        SSLerr(SSL_F_TLS_CONSTRUCT_CLIENT_HELLO, ERR_R_INTERNAL_ERROR);
980
        return 0;
981 982
    }
    /* ssl_cipher_list_to_bytes() raises SSLerr if appropriate */
983 984 985
    if (!ssl_cipher_list_to_bytes(s, SSL_get_ciphers(s), pkt))
        return 0;
    if (!WPACKET_close(pkt)) {
986
        SSLerr(SSL_F_TLS_CONSTRUCT_CLIENT_HELLO, ERR_R_INTERNAL_ERROR);
987
        return 0;
988
    }
989

990
    /* COMPRESSION */
991
    if (!WPACKET_start_sub_packet_u8(pkt)) {
992
        SSLerr(SSL_F_TLS_CONSTRUCT_CLIENT_HELLO, ERR_R_INTERNAL_ERROR);
993
        return 0;
994 995 996 997 998 999
    }
#ifndef OPENSSL_NO_COMP
    if (ssl_allow_compression(s) && s->ctx->comp_methods) {
        int compnum = sk_SSL_COMP_num(s->ctx->comp_methods);
        for (i = 0; i < compnum; i++) {
            comp = sk_SSL_COMP_value(s->ctx->comp_methods, i);
1000
            if (!WPACKET_put_bytes_u8(pkt, comp->id)) {
1001
                SSLerr(SSL_F_TLS_CONSTRUCT_CLIENT_HELLO, ERR_R_INTERNAL_ERROR);
1002
                return 0;
1003 1004
            }
        }
1005
    }
1006
#endif
1007
    /* Add the NULL method */
1008
    if (!WPACKET_put_bytes_u8(pkt, 0) || !WPACKET_close(pkt)) {
1009
        SSLerr(SSL_F_TLS_CONSTRUCT_CLIENT_HELLO, ERR_R_INTERNAL_ERROR);
1010
        return 0;
1011
    }
1012

1013
    /* TLS extensions */
1014
    if (!tls_construct_extensions(s, pkt, EXT_CLIENT_HELLO, &al)) {
1015 1016
        ssl3_send_alert(s, SSL3_AL_FATAL, al);
        SSLerr(SSL_F_TLS_CONSTRUCT_CLIENT_HELLO, ERR_R_INTERNAL_ERROR);
1017
        return 0;
1018
    }
1019

1020
    return 1;
1021
}
1022

M
Matt Caswell 已提交
1023
MSG_PROCESS_RETURN dtls_process_hello_verify(SSL *s, PACKET *pkt)
M
Matt Caswell 已提交
1024 1025
{
    int al;
M
Matt Caswell 已提交
1026
    size_t cookie_len;
M
Matt Caswell 已提交
1027 1028 1029
    PACKET cookiepkt;

    if (!PACKET_forward(pkt, 2)
E
Emilia Kasper 已提交
1030
        || !PACKET_get_length_prefixed_1(pkt, &cookiepkt)) {
M
Matt Caswell 已提交
1031 1032 1033 1034 1035 1036 1037 1038 1039 1040 1041 1042 1043 1044 1045 1046 1047 1048 1049 1050 1051 1052
        al = SSL_AD_DECODE_ERROR;
        SSLerr(SSL_F_DTLS_PROCESS_HELLO_VERIFY, SSL_R_LENGTH_MISMATCH);
        goto f_err;
    }

    cookie_len = PACKET_remaining(&cookiepkt);
    if (cookie_len > sizeof(s->d1->cookie)) {
        al = SSL_AD_ILLEGAL_PARAMETER;
        SSLerr(SSL_F_DTLS_PROCESS_HELLO_VERIFY, SSL_R_LENGTH_TOO_LONG);
        goto f_err;
    }

    if (!PACKET_copy_bytes(&cookiepkt, s->d1->cookie, cookie_len)) {
        al = SSL_AD_DECODE_ERROR;
        SSLerr(SSL_F_DTLS_PROCESS_HELLO_VERIFY, SSL_R_LENGTH_MISMATCH);
        goto f_err;
    }
    s->d1->cookie_len = cookie_len;

    return MSG_PROCESS_FINISHED_READING;
 f_err:
    ssl3_send_alert(s, SSL3_AL_FATAL, al);
M
Matt Caswell 已提交
1053
    ossl_statem_set_error(s);
M
Matt Caswell 已提交
1054 1055 1056
    return MSG_PROCESS_ERROR;
}

M
Matt Caswell 已提交
1057
MSG_PROCESS_RETURN tls_process_server_hello(SSL *s, PACKET *pkt)
1058 1059 1060
{
    STACK_OF(SSL_CIPHER) *sk;
    const SSL_CIPHER *c;
1061
    PACKET session_id, extpkt;
1062
    size_t session_id_len;
E
Emilia Kasper 已提交
1063
    const unsigned char *cipherchars;
1064 1065
    int i, al = SSL_AD_INTERNAL_ERROR;
    unsigned int compression;
1066
    unsigned int sversion;
M
Matt Caswell 已提交
1067
    unsigned int context;
1068
    int protverr;
1069
    RAW_EXTENSION *extensions = NULL;
1070 1071 1072 1073
#ifndef OPENSSL_NO_COMP
    SSL_COMP *comp;
#endif

1074 1075 1076 1077 1078
    if (!PACKET_get_net_2(pkt, &sversion)) {
        al = SSL_AD_DECODE_ERROR;
        SSLerr(SSL_F_TLS_PROCESS_SERVER_HELLO, SSL_R_LENGTH_MISMATCH);
        goto f_err;
    }
M
Matt Caswell 已提交
1079

1080 1081 1082 1083 1084
    protverr = ssl_choose_client_version(s, sversion);
    if (protverr != 0) {
        al = SSL_AD_PROTOCOL_VERSION;
        SSLerr(SSL_F_TLS_PROCESS_SERVER_HELLO, protverr);
        goto f_err;
1085 1086 1087 1088
    }

    /* load the server hello data */
    /* load the server random */
1089
    if (!PACKET_copy_bytes(pkt, s->s3->server_random, SSL3_RANDOM_SIZE)) {
M
Matt Caswell 已提交
1090
        al = SSL_AD_DECODE_ERROR;
1091
        SSLerr(SSL_F_TLS_PROCESS_SERVER_HELLO, SSL_R_LENGTH_MISMATCH);
M
Matt Caswell 已提交
1092 1093
        goto f_err;
    }
1094 1095 1096

    s->hit = 0;

1097
    /* Get the session-id. */
1098 1099 1100 1101 1102 1103 1104 1105 1106 1107 1108 1109 1110 1111 1112 1113
    if (!SSL_IS_TLS13(s)) {
        if (!PACKET_get_length_prefixed_1(pkt, &session_id)) {
            al = SSL_AD_DECODE_ERROR;
            SSLerr(SSL_F_TLS_PROCESS_SERVER_HELLO, SSL_R_LENGTH_MISMATCH);
            goto f_err;
        }
        session_id_len = PACKET_remaining(&session_id);
        if (session_id_len > sizeof s->session->session_id
            || session_id_len > SSL3_SESSION_ID_SIZE) {
            al = SSL_AD_ILLEGAL_PARAMETER;
            SSLerr(SSL_F_TLS_PROCESS_SERVER_HELLO,
                   SSL_R_SSL3_SESSION_ID_TOO_LONG);
            goto f_err;
        }
    } else {
        session_id_len = 0;
1114
    }
1115

1116
    if (!PACKET_get_bytes(pkt, &cipherchars, TLS_CIPHER_LEN)) {
M
Matt Caswell 已提交
1117
        SSLerr(SSL_F_TLS_PROCESS_SERVER_HELLO, SSL_R_LENGTH_MISMATCH);
1118 1119 1120 1121
        al = SSL_AD_DECODE_ERROR;
        goto f_err;
    }

1122
    /*
1123 1124 1125 1126 1127 1128 1129 1130 1131 1132
     * Check if we can resume the session based on external pre-shared secret.
     * EAP-FAST (RFC 4851) supports two types of session resumption.
     * Resumption based on server-side state works with session IDs.
     * Resumption based on pre-shared Protected Access Credentials (PACs)
     * works by overriding the SessionTicket extension at the application
     * layer, and does not send a session ID. (We do not know whether EAP-FAST
     * servers would honour the session ID.) Therefore, the session ID alone
     * is not a reliable indicator of session resumption, so we first check if
     * we can resume, and later peek at the next handshake message to see if the
     * server wants to resume.
1133
     */
1134
    if (s->version >= TLS1_VERSION && !SSL_IS_TLS13(s)
1135
            && s->tls_session_secret_cb != NULL && s->session->tlsext_tick) {
1136
        const SSL_CIPHER *pref_cipher = NULL;
1137 1138 1139 1140 1141 1142
        /*
         * s->session->master_key_length is a size_t, but this is an int for
         * backwards compat reasons
         */
        int master_key_length;
        master_key_length = sizeof(s->session->master_key);
1143
        if (s->tls_session_secret_cb(s, s->session->master_key,
1144
                                     &master_key_length,
1145
                                     NULL, &pref_cipher,
1146 1147 1148
                                     s->tls_session_secret_cb_arg)
                 && master_key_length > 0) {
            s->session->master_key_length = master_key_length;
1149
            s->session->cipher = pref_cipher ?
M
Matt Caswell 已提交
1150
                pref_cipher : ssl_get_cipher_by_char(s, cipherchars);
1151
        } else {
1152
            SSLerr(SSL_F_TLS_PROCESS_SERVER_HELLO, ERR_R_INTERNAL_ERROR);
1153 1154
            al = SSL_AD_INTERNAL_ERROR;
            goto f_err;
1155
        }
M
Matt Caswell 已提交
1156 1157
    }

1158 1159 1160
    if (session_id_len != 0 && session_id_len == s->session->session_id_length
        && memcmp(PACKET_data(&session_id), s->session->session_id,
                  session_id_len) == 0) {
1161 1162 1163 1164
        if (s->sid_ctx_length != s->session->sid_ctx_length
            || memcmp(s->session->sid_ctx, s->sid_ctx, s->sid_ctx_length)) {
            /* actually a client application bug */
            al = SSL_AD_ILLEGAL_PARAMETER;
1165
            SSLerr(SSL_F_TLS_PROCESS_SERVER_HELLO,
1166 1167 1168 1169
                   SSL_R_ATTEMPT_TO_REUSE_SESSION_IN_DIFFERENT_CONTEXT);
            goto f_err;
        }
        s->hit = 1;
1170
    } else {
1171
        /*
1172 1173 1174 1175 1176
         * If we were trying for session-id reuse but the server
         * didn't echo the ID, make a new SSL_SESSION.
         * In the case of EAP-FAST and PAC, we do not send a session ID,
         * so the PAC-based session secret is always preserved. It'll be
         * overwritten if the server refuses resumption.
1177 1178
         */
        if (s->session->session_id_length > 0) {
1179
            s->ctx->stats.sess_miss++;
1180 1181 1182 1183
            if (!ssl_get_new_session(s, 0)) {
                goto f_err;
            }
        }
M
Matt Caswell 已提交
1184

1185
        s->session->ssl_version = s->version;
1186 1187 1188 1189
        s->session->session_id_length = session_id_len;
        /* session_id_len could be 0 */
        memcpy(s->session->session_id, PACKET_data(&session_id),
               session_id_len);
1190
    }
1191

1192 1193 1194 1195 1196 1197 1198 1199 1200
    /* Session version and negotiated protocol version should match */
    if (s->version != s->session->ssl_version) {
        al = SSL_AD_PROTOCOL_VERSION;

        SSLerr(SSL_F_TLS_PROCESS_SERVER_HELLO,
               SSL_R_SSL_SESSION_VERSION_MISMATCH);
        goto f_err;
    }

M
Matt Caswell 已提交
1201
    c = ssl_get_cipher_by_char(s, cipherchars);
1202 1203 1204
    if (c == NULL) {
        /* unknown cipher */
        al = SSL_AD_ILLEGAL_PARAMETER;
1205
        SSLerr(SSL_F_TLS_PROCESS_SERVER_HELLO, SSL_R_UNKNOWN_CIPHER_RETURNED);
1206 1207 1208
        goto f_err;
    }
    /*
1209 1210 1211 1212 1213 1214 1215 1216
     * Now that we know the version, update the check to see if it's an allowed
     * version.
     */
    s->s3->tmp.min_ver = s->version;
    s->s3->tmp.max_ver = s->version;
    /*
     * If it is a disabled cipher we either didn't send it in client hello,
     * or it's not allowed for the selected protocol. So we return an error.
1217 1218 1219
     */
    if (ssl_cipher_disabled(s, c, SSL_SECOP_CIPHER_CHECK)) {
        al = SSL_AD_ILLEGAL_PARAMETER;
1220
        SSLerr(SSL_F_TLS_PROCESS_SERVER_HELLO, SSL_R_WRONG_CIPHER_RETURNED);
1221 1222 1223 1224 1225 1226 1227 1228
        goto f_err;
    }

    sk = ssl_get_ciphers_by_id(s);
    i = sk_SSL_CIPHER_find(sk, c);
    if (i < 0) {
        /* we did not say we would use this cipher */
        al = SSL_AD_ILLEGAL_PARAMETER;
1229
        SSLerr(SSL_F_TLS_PROCESS_SERVER_HELLO, SSL_R_WRONG_CIPHER_RETURNED);
1230 1231 1232 1233 1234 1235 1236 1237 1238 1239 1240
        goto f_err;
    }

    /*
     * Depending on the session caching (internal/external), the cipher
     * and/or cipher_id values may not be set. Make sure that cipher_id is
     * set and use it for comparison.
     */
    if (s->session->cipher)
        s->session->cipher_id = s->session->cipher->id;
    if (s->hit && (s->session->cipher_id != c->id)) {
R
Rich Salz 已提交
1241
        al = SSL_AD_ILLEGAL_PARAMETER;
1242
        SSLerr(SSL_F_TLS_PROCESS_SERVER_HELLO,
R
Rich Salz 已提交
1243 1244
               SSL_R_OLD_SESSION_CIPHER_NOT_RETURNED);
        goto f_err;
1245 1246 1247 1248
    }
    s->s3->tmp.new_cipher = c;
    /* lets get the compression algorithm */
    /* COMPRESSION */
1249 1250 1251 1252 1253 1254 1255 1256
    if (!SSL_IS_TLS13(s)) {
        if (!PACKET_get_1(pkt, &compression)) {
            SSLerr(SSL_F_TLS_PROCESS_SERVER_HELLO, SSL_R_LENGTH_MISMATCH);
            al = SSL_AD_DECODE_ERROR;
            goto f_err;
        }
    } else {
        compression = 0;
M
Matt Caswell 已提交
1257
    }
1258

1259
#ifdef OPENSSL_NO_COMP
1260
    if (compression != 0) {
1261
        al = SSL_AD_ILLEGAL_PARAMETER;
1262
        SSLerr(SSL_F_TLS_PROCESS_SERVER_HELLO,
1263 1264 1265 1266 1267 1268 1269 1270
               SSL_R_UNSUPPORTED_COMPRESSION_ALGORITHM);
        goto f_err;
    }
    /*
     * If compression is disabled we'd better not try to resume a session
     * using compression.
     */
    if (s->session->compress_meth != 0) {
1271
        SSLerr(SSL_F_TLS_PROCESS_SERVER_HELLO, SSL_R_INCONSISTENT_COMPRESSION);
1272 1273
        goto f_err;
    }
1274
#else
1275
    if (s->hit && compression != s->session->compress_meth) {
1276
        al = SSL_AD_ILLEGAL_PARAMETER;
1277
        SSLerr(SSL_F_TLS_PROCESS_SERVER_HELLO,
1278 1279 1280
               SSL_R_OLD_SESSION_COMPRESSION_ALGORITHM_NOT_RETURNED);
        goto f_err;
    }
1281
    if (compression == 0)
1282 1283 1284
        comp = NULL;
    else if (!ssl_allow_compression(s)) {
        al = SSL_AD_ILLEGAL_PARAMETER;
1285
        SSLerr(SSL_F_TLS_PROCESS_SERVER_HELLO, SSL_R_COMPRESSION_DISABLED);
1286
        goto f_err;
1287 1288 1289
    } else {
        comp = ssl3_comp_find(s->ctx->comp_methods, compression);
    }
1290

1291
    if (compression != 0 && comp == NULL) {
1292
        al = SSL_AD_ILLEGAL_PARAMETER;
1293
        SSLerr(SSL_F_TLS_PROCESS_SERVER_HELLO,
1294 1295 1296 1297 1298
               SSL_R_UNSUPPORTED_COMPRESSION_ALGORITHM);
        goto f_err;
    } else {
        s->s3->tmp.new_compression = comp;
    }
1299
#endif
1300

1301
    /* TLS extensions */
1302 1303 1304
    if (PACKET_remaining(pkt) == 0) {
        PACKET_null_init(&extpkt);
    } else if (!PACKET_as_length_prefixed_2(pkt, &extpkt)) {
1305
        al = SSL_AD_DECODE_ERROR;
1306
        SSLerr(SSL_F_TLS_PROCESS_SERVER_HELLO, SSL_R_BAD_LENGTH);
1307 1308
        goto f_err;
    }
1309

M
Matt Caswell 已提交
1310 1311 1312 1313
    context = SSL_IS_TLS13(s) ? EXT_TLS1_3_SERVER_HELLO
                              : EXT_TLS1_2_SERVER_HELLO;
    if (!tls_collect_extensions(s, &extpkt, context, &extensions, &al)
            || !tls_parse_all_extensions(s, context, extensions, &al))
1314 1315
        goto f_err;

M
Matt Caswell 已提交
1316 1317 1318 1319 1320 1321 1322 1323 1324
#ifndef OPENSSL_NO_SCTP
    if (SSL_IS_DTLS(s) && s->hit) {
        unsigned char sctpauthkey[64];
        char labelbuffer[sizeof(DTLS1_SCTP_AUTH_LABEL)];

        /*
         * Add new shared key for SCTP-Auth, will be ignored if
         * no SCTP used.
         */
M
Matt Caswell 已提交
1325 1326
        memcpy(labelbuffer, DTLS1_SCTP_AUTH_LABEL,
               sizeof(DTLS1_SCTP_AUTH_LABEL));
M
Matt Caswell 已提交
1327 1328

        if (SSL_export_keying_material(s, sctpauthkey,
E
Emilia Kasper 已提交
1329 1330 1331
                                       sizeof(sctpauthkey),
                                       labelbuffer,
                                       sizeof(labelbuffer), NULL, 0, 0) <= 0)
M
Matt Caswell 已提交
1332 1333 1334 1335 1336 1337 1338 1339
            goto err;

        BIO_ctrl(SSL_get_wbio(s),
                 BIO_CTRL_DGRAM_SCTP_ADD_AUTH_KEY,
                 sizeof(sctpauthkey), sctpauthkey);
    }
#endif

1340 1341 1342 1343 1344 1345 1346 1347 1348 1349 1350 1351 1352 1353 1354
    /*
     * In TLSv1.3 we have some post-processing to change cipher state, otherwise
     * we're done with this message
     */
    if (SSL_IS_TLS13(s)
            && (!s->method->ssl3_enc->setup_key_block(s)
                || !s->method->ssl3_enc->change_cipher_state(s,
                    SSL3_CC_HANDSHAKE | SSL3_CHANGE_CIPHER_CLIENT_WRITE)
                || !s->method->ssl3_enc->change_cipher_state(s,
                    SSL3_CC_HANDSHAKE | SSL3_CHANGE_CIPHER_CLIENT_READ))) {
        al = SSL_AD_INTERNAL_ERROR;
        SSLerr(SSL_F_TLS_PROCESS_SERVER_HELLO, SSL_R_CANNOT_CHANGE_CIPHER);
        goto f_err;
    }

M
Matt Caswell 已提交
1355
    OPENSSL_free(extensions);
1356
    return MSG_PROCESS_CONTINUE_READING;
1357 1358
 f_err:
    ssl3_send_alert(s, SSL3_AL_FATAL, al);
M
Matt Caswell 已提交
1359
    ossl_statem_set_error(s);
M
Matt Caswell 已提交
1360
    OPENSSL_free(extensions);
1361
    return MSG_PROCESS_ERROR;
1362
}
1363

M
Matt Caswell 已提交
1364
MSG_PROCESS_RETURN tls_process_server_certificate(SSL *s, PACKET *pkt)
1365 1366 1367 1368
{
    int al, i, ret = MSG_PROCESS_ERROR, exp_idx;
    unsigned long cert_list_len, cert_len;
    X509 *x = NULL;
E
Emilia Kasper 已提交
1369
    const unsigned char *certstart, *certbytes;
1370 1371
    STACK_OF(X509) *sk = NULL;
    EVP_PKEY *pkey = NULL;
1372 1373

    if ((sk = sk_X509_new_null()) == NULL) {
1374
        SSLerr(SSL_F_TLS_PROCESS_SERVER_CERTIFICATE, ERR_R_MALLOC_FAILURE);
1375
        goto err;
1376 1377
    }

1378
    if (!PACKET_get_net_3(pkt, &cert_list_len)
E
Emilia Kasper 已提交
1379
        || PACKET_remaining(pkt) != cert_list_len) {
1380
        al = SSL_AD_DECODE_ERROR;
1381
        SSLerr(SSL_F_TLS_PROCESS_SERVER_CERTIFICATE, SSL_R_LENGTH_MISMATCH);
1382 1383
        goto f_err;
    }
1384 1385
    while (PACKET_remaining(pkt)) {
        if (!PACKET_get_net_3(pkt, &cert_len)
E
Emilia Kasper 已提交
1386
            || !PACKET_get_bytes(pkt, &certbytes, cert_len)) {
1387
            al = SSL_AD_DECODE_ERROR;
1388
            SSLerr(SSL_F_TLS_PROCESS_SERVER_CERTIFICATE,
1389 1390 1391 1392
                   SSL_R_CERT_LENGTH_MISMATCH);
            goto f_err;
        }

1393 1394
        certstart = certbytes;
        x = d2i_X509(NULL, (const unsigned char **)&certbytes, cert_len);
1395 1396
        if (x == NULL) {
            al = SSL_AD_BAD_CERTIFICATE;
1397
            SSLerr(SSL_F_TLS_PROCESS_SERVER_CERTIFICATE, ERR_R_ASN1_LIB);
1398 1399
            goto f_err;
        }
1400
        if (certbytes != (certstart + cert_len)) {
1401
            al = SSL_AD_DECODE_ERROR;
1402
            SSLerr(SSL_F_TLS_PROCESS_SERVER_CERTIFICATE,
1403 1404 1405 1406
                   SSL_R_CERT_LENGTH_MISMATCH);
            goto f_err;
        }
        if (!sk_X509_push(sk, x)) {
1407
            SSLerr(SSL_F_TLS_PROCESS_SERVER_CERTIFICATE, ERR_R_MALLOC_FAILURE);
1408
            goto err;
1409 1410 1411 1412 1413
        }
        x = NULL;
    }

    i = ssl_verify_cert_chain(s, sk);
1414 1415 1416 1417 1418 1419 1420 1421 1422 1423 1424 1425 1426 1427 1428
    /*
     * The documented interface is that SSL_VERIFY_PEER should be set in order
     * for client side verification of the server certificate to take place.
     * However, historically the code has only checked that *any* flag is set
     * to cause server verification to take place. Use of the other flags makes
     * no sense in client mode. An attempt to clean up the semantics was
     * reverted because at least one application *only* set
     * SSL_VERIFY_FAIL_IF_NO_PEER_CERT. Prior to the clean up this still caused
     * server verification to take place, after the clean up it silently did
     * nothing. SSL_CTX_set_verify()/SSL_set_verify() cannot validate the flags
     * sent to them because they are void functions. Therefore, we now use the
     * (less clean) historic behaviour of performing validation if any flag is
     * set. The *documented* interface remains the same.
     */
    if (s->verify_mode != SSL_VERIFY_NONE && i <= 0) {
1429
        al = ssl_verify_alarm_type(s->verify_result);
1430
        SSLerr(SSL_F_TLS_PROCESS_SERVER_CERTIFICATE,
1431 1432 1433 1434 1435
               SSL_R_CERTIFICATE_VERIFY_FAILED);
        goto f_err;
    }
    ERR_clear_error();          /* but we keep s->verify_result */
    if (i > 1) {
1436
        SSLerr(SSL_F_TLS_PROCESS_SERVER_CERTIFICATE, i);
1437 1438 1439 1440
        al = SSL_AD_HANDSHAKE_FAILURE;
        goto f_err;
    }

1441
    s->session->peer_chain = sk;
1442 1443
    /*
     * Inconsistency alert: cert_chain does include the peer's certificate,
M
Matt Caswell 已提交
1444
     * which we don't include in statem_srvr.c
1445 1446 1447 1448 1449 1450 1451
     */
    x = sk_X509_value(sk, 0);
    sk = NULL;
    /*
     * VRS 19990621: possible memory leak; sk=null ==> !sk_pop_free() @end
     */

1452
    pkey = X509_get0_pubkey(x);
1453

1454
    if (pkey == NULL || EVP_PKEY_missing_parameters(pkey)) {
1455 1456
        x = NULL;
        al = SSL3_AL_FATAL;
1457
        SSLerr(SSL_F_TLS_PROCESS_SERVER_CERTIFICATE,
1458 1459 1460 1461 1462
               SSL_R_UNABLE_TO_FIND_PUBLIC_KEY_PARAMETERS);
        goto f_err;
    }

    i = ssl_cert_type(x, pkey);
1463
    if (i < 0) {
1464 1465
        x = NULL;
        al = SSL3_AL_FATAL;
1466
        SSLerr(SSL_F_TLS_PROCESS_SERVER_CERTIFICATE,
1467 1468 1469 1470
               SSL_R_UNKNOWN_CERTIFICATE_TYPE);
        goto f_err;
    }

1471
    exp_idx = ssl_cipher_get_cert_index(s->s3->tmp.new_cipher);
1472
    if (exp_idx >= 0 && i != exp_idx
E
Emilia Kasper 已提交
1473 1474 1475
        && (exp_idx != SSL_PKEY_GOST_EC ||
            (i != SSL_PKEY_GOST12_512 && i != SSL_PKEY_GOST12_256
             && i != SSL_PKEY_GOST01))) {
1476 1477
        x = NULL;
        al = SSL_AD_ILLEGAL_PARAMETER;
1478
        SSLerr(SSL_F_TLS_PROCESS_SERVER_CERTIFICATE,
1479 1480
               SSL_R_WRONG_CERTIFICATE_TYPE);
        goto f_err;
1481
    }
1482
    s->session->peer_type = i;
1483 1484

    X509_free(s->session->peer);
D
Dr. Stephen Henson 已提交
1485
    X509_up_ref(x);
1486
    s->session->peer = x;
1487 1488 1489
    s->session->verify_result = s->verify_result;

    x = NULL;
1490
    ret = MSG_PROCESS_CONTINUE_READING;
R
Rich Salz 已提交
1491 1492
    goto done;

1493
 f_err:
R
Rich Salz 已提交
1494
    ssl3_send_alert(s, SSL3_AL_FATAL, al);
1495
 err:
M
Matt Caswell 已提交
1496
    ossl_statem_set_error(s);
R
Rich Salz 已提交
1497
 done:
1498 1499
    X509_free(x);
    sk_X509_pop_free(sk, X509_free);
1500
    return ret;
1501
}
1502

1503
static int tls_process_ske_psk_preamble(SSL *s, PACKET *pkt, int *al)
1504 1505
{
#ifndef OPENSSL_NO_PSK
1506
    PACKET psk_identity_hint;
1507

1508 1509 1510 1511
    /* PSK ciphersuites are preceded by an identity hint */

    if (!PACKET_get_length_prefixed_2(pkt, &psk_identity_hint)) {
        *al = SSL_AD_DECODE_ERROR;
1512
        SSLerr(SSL_F_TLS_PROCESS_SKE_PSK_PREAMBLE, SSL_R_LENGTH_MISMATCH);
1513 1514 1515 1516 1517 1518 1519 1520 1521 1522 1523
        return 0;
    }

    /*
     * Store PSK identity hint for later use, hint is used in
     * tls_construct_client_key_exchange.  Assume that the maximum length of
     * a PSK identity hint can be as long as the maximum length of a PSK
     * identity.
     */
    if (PACKET_remaining(&psk_identity_hint) > PSK_MAX_IDENTITY_LEN) {
        *al = SSL_AD_HANDSHAKE_FAILURE;
1524
        SSLerr(SSL_F_TLS_PROCESS_SKE_PSK_PREAMBLE, SSL_R_DATA_LENGTH_TOO_LONG);
1525 1526
        return 0;
    }
1527

1528 1529 1530 1531
    if (PACKET_remaining(&psk_identity_hint) == 0) {
        OPENSSL_free(s->session->psk_identity_hint);
        s->session->psk_identity_hint = NULL;
    } else if (!PACKET_strndup(&psk_identity_hint,
E
Emilia Kasper 已提交
1532
                               &s->session->psk_identity_hint)) {
1533 1534 1535 1536 1537 1538
        *al = SSL_AD_INTERNAL_ERROR;
        return 0;
    }

    return 1;
#else
1539
    SSLerr(SSL_F_TLS_PROCESS_SKE_PSK_PREAMBLE, ERR_R_INTERNAL_ERROR);
1540 1541
    *al = SSL_AD_INTERNAL_ERROR;
    return 0;
1542 1543 1544
#endif
}

1545 1546 1547 1548 1549 1550 1551 1552 1553 1554
static int tls_process_ske_srp(SSL *s, PACKET *pkt, EVP_PKEY **pkey, int *al)
{
#ifndef OPENSSL_NO_SRP
    PACKET prime, generator, salt, server_pub;

    if (!PACKET_get_length_prefixed_2(pkt, &prime)
        || !PACKET_get_length_prefixed_2(pkt, &generator)
        || !PACKET_get_length_prefixed_1(pkt, &salt)
        || !PACKET_get_length_prefixed_2(pkt, &server_pub)) {
        *al = SSL_AD_DECODE_ERROR;
1555
        SSLerr(SSL_F_TLS_PROCESS_SKE_SRP, SSL_R_LENGTH_MISMATCH);
1556 1557 1558
        return 0;
    }

1559
    /* TODO(size_t): Convert BN_bin2bn() calls */
1560 1561
    if ((s->srp_ctx.N =
         BN_bin2bn(PACKET_data(&prime),
1562
                   (int)PACKET_remaining(&prime), NULL)) == NULL
1563 1564
        || (s->srp_ctx.g =
            BN_bin2bn(PACKET_data(&generator),
1565
                      (int)PACKET_remaining(&generator), NULL)) == NULL
1566 1567
        || (s->srp_ctx.s =
            BN_bin2bn(PACKET_data(&salt),
1568
                      (int)PACKET_remaining(&salt), NULL)) == NULL
1569 1570
        || (s->srp_ctx.B =
            BN_bin2bn(PACKET_data(&server_pub),
1571
                      (int)PACKET_remaining(&server_pub), NULL)) == NULL) {
1572
        *al = SSL_AD_INTERNAL_ERROR;
1573
        SSLerr(SSL_F_TLS_PROCESS_SKE_SRP, ERR_R_BN_LIB);
1574 1575 1576 1577 1578
        return 0;
    }

    if (!srp_verify_server_param(s, al)) {
        *al = SSL_AD_DECODE_ERROR;
1579
        SSLerr(SSL_F_TLS_PROCESS_SKE_SRP, SSL_R_BAD_SRP_PARAMETERS);
1580 1581 1582 1583
        return 0;
    }

    /* We must check if there is a certificate */
E
Emilia Kasper 已提交
1584
    if (s->s3->tmp.new_cipher->algorithm_auth & (SSL_aRSA | SSL_aDSS))
1585 1586 1587 1588
        *pkey = X509_get0_pubkey(s->session->peer);

    return 1;
#else
1589
    SSLerr(SSL_F_TLS_PROCESS_SKE_SRP, ERR_R_INTERNAL_ERROR);
1590 1591 1592 1593 1594
    *al = SSL_AD_INTERNAL_ERROR;
    return 0;
#endif
}

1595 1596 1597 1598 1599 1600 1601 1602 1603 1604 1605 1606 1607
static int tls_process_ske_dhe(SSL *s, PACKET *pkt, EVP_PKEY **pkey, int *al)
{
#ifndef OPENSSL_NO_DH
    PACKET prime, generator, pub_key;
    EVP_PKEY *peer_tmp = NULL;

    DH *dh = NULL;
    BIGNUM *p = NULL, *g = NULL, *bnpub_key = NULL;

    if (!PACKET_get_length_prefixed_2(pkt, &prime)
        || !PACKET_get_length_prefixed_2(pkt, &generator)
        || !PACKET_get_length_prefixed_2(pkt, &pub_key)) {
        *al = SSL_AD_DECODE_ERROR;
1608
        SSLerr(SSL_F_TLS_PROCESS_SKE_DHE, SSL_R_LENGTH_MISMATCH);
1609 1610 1611 1612 1613 1614 1615 1616
        return 0;
    }

    peer_tmp = EVP_PKEY_new();
    dh = DH_new();

    if (peer_tmp == NULL || dh == NULL) {
        *al = SSL_AD_INTERNAL_ERROR;
1617
        SSLerr(SSL_F_TLS_PROCESS_SKE_DHE, ERR_R_MALLOC_FAILURE);
1618 1619 1620
        goto err;
    }

1621 1622 1623 1624 1625 1626
    /* TODO(size_t): Convert these calls */
    p = BN_bin2bn(PACKET_data(&prime), (int)PACKET_remaining(&prime), NULL);
    g = BN_bin2bn(PACKET_data(&generator), (int)PACKET_remaining(&generator),
                  NULL);
    bnpub_key = BN_bin2bn(PACKET_data(&pub_key),
                          (int)PACKET_remaining(&pub_key), NULL);
1627 1628
    if (p == NULL || g == NULL || bnpub_key == NULL) {
        *al = SSL_AD_INTERNAL_ERROR;
1629
        SSLerr(SSL_F_TLS_PROCESS_SKE_DHE, ERR_R_BN_LIB);
1630 1631 1632 1633 1634
        goto err;
    }

    if (BN_is_zero(p) || BN_is_zero(g) || BN_is_zero(bnpub_key)) {
        *al = SSL_AD_DECODE_ERROR;
1635
        SSLerr(SSL_F_TLS_PROCESS_SKE_DHE, SSL_R_BAD_DH_VALUE);
1636 1637 1638 1639 1640
        goto err;
    }

    if (!DH_set0_pqg(dh, p, NULL, g)) {
        *al = SSL_AD_INTERNAL_ERROR;
1641
        SSLerr(SSL_F_TLS_PROCESS_SKE_DHE, ERR_R_BN_LIB);
1642 1643 1644 1645 1646 1647
        goto err;
    }
    p = g = NULL;

    if (!DH_set0_key(dh, bnpub_key, NULL)) {
        *al = SSL_AD_INTERNAL_ERROR;
1648
        SSLerr(SSL_F_TLS_PROCESS_SKE_DHE, ERR_R_BN_LIB);
1649 1650 1651 1652 1653 1654
        goto err;
    }
    bnpub_key = NULL;

    if (!ssl_security(s, SSL_SECOP_TMP_DH, DH_security_bits(dh), 0, dh)) {
        *al = SSL_AD_HANDSHAKE_FAILURE;
1655
        SSLerr(SSL_F_TLS_PROCESS_SKE_DHE, SSL_R_DH_KEY_TOO_SMALL);
1656 1657 1658 1659 1660
        goto err;
    }

    if (EVP_PKEY_assign_DH(peer_tmp, dh) == 0) {
        *al = SSL_AD_INTERNAL_ERROR;
1661
        SSLerr(SSL_F_TLS_PROCESS_SKE_DHE, ERR_R_EVP_LIB);
1662 1663 1664 1665 1666 1667 1668 1669 1670
        goto err;
    }

    s->s3->peer_tmp = peer_tmp;

    /*
     * FIXME: This makes assumptions about which ciphersuites come with
     * public keys. We should have a less ad-hoc way of doing this
     */
E
Emilia Kasper 已提交
1671
    if (s->s3->tmp.new_cipher->algorithm_auth & (SSL_aRSA | SSL_aDSS))
1672 1673 1674 1675 1676 1677 1678 1679 1680 1681 1682 1683 1684 1685
        *pkey = X509_get0_pubkey(s->session->peer);
    /* else anonymous DH, so no certificate or pkey. */

    return 1;

 err:
    BN_free(p);
    BN_free(g);
    BN_free(bnpub_key);
    DH_free(dh);
    EVP_PKEY_free(peer_tmp);

    return 0;
#else
1686
    SSLerr(SSL_F_TLS_PROCESS_SKE_DHE, ERR_R_INTERNAL_ERROR);
1687 1688 1689 1690 1691
    *al = SSL_AD_INTERNAL_ERROR;
    return 0;
#endif
}

1692 1693 1694 1695 1696 1697
static int tls_process_ske_ecdhe(SSL *s, PACKET *pkt, EVP_PKEY **pkey, int *al)
{
#ifndef OPENSSL_NO_EC
    PACKET encoded_pt;
    const unsigned char *ecparams;
    int curve_nid;
1698
    unsigned int curve_flags;
1699 1700 1701 1702 1703 1704 1705 1706 1707
    EVP_PKEY_CTX *pctx = NULL;

    /*
     * Extract elliptic curve parameters and the server's ephemeral ECDH
     * public key. For now we only support named (not generic) curves and
     * ECParameters in this case is just three bytes.
     */
    if (!PACKET_get_bytes(pkt, &ecparams, 3)) {
        *al = SSL_AD_DECODE_ERROR;
1708
        SSLerr(SSL_F_TLS_PROCESS_SKE_ECDHE, SSL_R_LENGTH_TOO_SHORT);
1709 1710 1711 1712 1713 1714 1715 1716
        return 0;
    }
    /*
     * Check curve is one of our preferences, if not server has sent an
     * invalid curve. ECParameters is 3 bytes.
     */
    if (!tls1_check_curve(s, ecparams, 3)) {
        *al = SSL_AD_DECODE_ERROR;
1717
        SSLerr(SSL_F_TLS_PROCESS_SKE_ECDHE, SSL_R_WRONG_CURVE);
1718 1719 1720
        return 0;
    }

1721 1722
    curve_nid = tls1_ec_curve_id2nid(*(ecparams + 2), &curve_flags);

E
Emilia Kasper 已提交
1723
    if (curve_nid == 0) {
1724
        *al = SSL_AD_INTERNAL_ERROR;
1725
        SSLerr(SSL_F_TLS_PROCESS_SKE_ECDHE,
1726 1727 1728 1729
               SSL_R_UNABLE_TO_FIND_ECDH_PARAMETERS);
        return 0;
    }

1730 1731 1732 1733 1734 1735 1736 1737 1738 1739 1740 1741 1742 1743 1744 1745 1746 1747 1748 1749 1750 1751
    if ((curve_flags & TLS_CURVE_TYPE) == TLS_CURVE_CUSTOM) {
        EVP_PKEY *key = EVP_PKEY_new();

        if (key == NULL || !EVP_PKEY_set_type(key, curve_nid)) {
            *al = SSL_AD_INTERNAL_ERROR;
            SSLerr(SSL_F_TLS_PROCESS_SKE_ECDHE, ERR_R_EVP_LIB);
            EVP_PKEY_free(key);
            return 0;
        }
        s->s3->peer_tmp = key;
    } else {
        /* Set up EVP_PKEY with named curve as parameters */
        pctx = EVP_PKEY_CTX_new_id(EVP_PKEY_EC, NULL);
        if (pctx == NULL
            || EVP_PKEY_paramgen_init(pctx) <= 0
            || EVP_PKEY_CTX_set_ec_paramgen_curve_nid(pctx, curve_nid) <= 0
            || EVP_PKEY_paramgen(pctx, &s->s3->peer_tmp) <= 0) {
            *al = SSL_AD_INTERNAL_ERROR;
            SSLerr(SSL_F_TLS_PROCESS_SKE_ECDHE, ERR_R_EVP_LIB);
            EVP_PKEY_CTX_free(pctx);
            return 0;
        }
1752
        EVP_PKEY_CTX_free(pctx);
1753
        pctx = NULL;
1754 1755 1756 1757
    }

    if (!PACKET_get_length_prefixed_1(pkt, &encoded_pt)) {
        *al = SSL_AD_DECODE_ERROR;
1758
        SSLerr(SSL_F_TLS_PROCESS_SKE_ECDHE, SSL_R_LENGTH_MISMATCH);
1759 1760 1761
        return 0;
    }

1762 1763 1764
    if (!EVP_PKEY_set1_tls_encodedpoint(s->s3->peer_tmp,
                                        PACKET_data(&encoded_pt),
                                        PACKET_remaining(&encoded_pt))) {
1765
        *al = SSL_AD_DECODE_ERROR;
1766
        SSLerr(SSL_F_TLS_PROCESS_SKE_ECDHE, SSL_R_BAD_ECPOINT);
1767 1768 1769 1770 1771 1772 1773 1774 1775 1776 1777 1778 1779 1780 1781 1782
        return 0;
    }

    /*
     * The ECC/TLS specification does not mention the use of DSA to sign
     * ECParameters in the server key exchange message. We do support RSA
     * and ECDSA.
     */
    if (s->s3->tmp.new_cipher->algorithm_auth & SSL_aECDSA)
        *pkey = X509_get0_pubkey(s->session->peer);
    else if (s->s3->tmp.new_cipher->algorithm_auth & SSL_aRSA)
        *pkey = X509_get0_pubkey(s->session->peer);
    /* else anonymous ECDH, so no certificate or pkey. */

    return 1;
#else
1783
    SSLerr(SSL_F_TLS_PROCESS_SKE_ECDHE, ERR_R_INTERNAL_ERROR);
1784 1785 1786 1787 1788
    *al = SSL_AD_INTERNAL_ERROR;
    return 0;
#endif
}

M
Matt Caswell 已提交
1789
MSG_PROCESS_RETURN tls_process_key_exchange(SSL *s, PACKET *pkt)
1790
{
1791
    int al = -1;
1792
    long alg_k;
1793
    EVP_PKEY *pkey = NULL;
1794
    PACKET save_param_start, signature;
1795 1796 1797

    alg_k = s->s3->tmp.new_cipher->algorithm_mkey;

1798
    save_param_start = *pkt;
1799

1800
#if !defined(OPENSSL_NO_EC) || !defined(OPENSSL_NO_DH)
1801 1802
    EVP_PKEY_free(s->s3->peer_tmp);
    s->s3->peer_tmp = NULL;
1803
#endif
1804

1805
    if (alg_k & SSL_PSK) {
1806 1807
        if (!tls_process_ske_psk_preamble(s, pkt, &al))
            goto err;
1808 1809 1810 1811
    }

    /* Nothing else to do for plain PSK or RSAPSK */
    if (alg_k & (SSL_kPSK | SSL_kRSAPSK)) {
1812 1813
    } else if (alg_k & SSL_kSRP) {
        if (!tls_process_ske_srp(s, pkt, &pkey, &al))
1814
            goto err;
1815 1816 1817
    } else if (alg_k & (SSL_kDHE | SSL_kDHEPSK)) {
        if (!tls_process_ske_dhe(s, pkt, &pkey, &al))
            goto err;
1818 1819 1820
    } else if (alg_k & (SSL_kECDHE | SSL_kECDHEPSK)) {
        if (!tls_process_ske_ecdhe(s, pkt, &pkey, &al))
            goto err;
1821 1822
    } else if (alg_k) {
        al = SSL_AD_UNEXPECTED_MESSAGE;
1823
        SSLerr(SSL_F_TLS_PROCESS_KEY_EXCHANGE, SSL_R_UNEXPECTED_MESSAGE);
1824
        goto err;
1825 1826 1827 1828
    }

    /* if it was signed, check the signature */
    if (pkey != NULL) {
1829
        PACKET params;
1830 1831
        int maxsig;
        const EVP_MD *md = NULL;
1832 1833
        EVP_MD_CTX *md_ctx;

1834 1835 1836 1837 1838 1839
        /*
         * |pkt| now points to the beginning of the signature, so the difference
         * equals the length of the parameters.
         */
        if (!PACKET_get_sub_packet(&save_param_start, &params,
                                   PACKET_remaining(&save_param_start) -
1840
                                   PACKET_remaining(pkt))) {
1841
            al = SSL_AD_INTERNAL_ERROR;
M
Matt Caswell 已提交
1842
            SSLerr(SSL_F_TLS_PROCESS_KEY_EXCHANGE, ERR_R_INTERNAL_ERROR);
1843
            goto err;
1844 1845
        }

1846
        if (SSL_USE_SIGALGS(s)) {
E
Emilia Kasper 已提交
1847
            const unsigned char *sigalgs;
1848
            int rv;
1849
            if (!PACKET_get_bytes(pkt, &sigalgs, 2)) {
1850
                al = SSL_AD_DECODE_ERROR;
M
Matt Caswell 已提交
1851
                SSLerr(SSL_F_TLS_PROCESS_KEY_EXCHANGE, SSL_R_LENGTH_TOO_SHORT);
1852
                goto err;
1853
            }
1854
            rv = tls12_check_peer_sigalg(&md, s, sigalgs, pkey);
1855 1856 1857 1858 1859
            if (rv == -1) {
                al = SSL_AD_INTERNAL_ERROR;
                goto err;
            } else if (rv == 0) {
                al = SSL_AD_DECODE_ERROR;
1860 1861
                goto err;
            }
1862
#ifdef SSL_DEBUG
1863 1864
            fprintf(stderr, "USING TLSv1.2 HASH %s\n", EVP_MD_name(md));
#endif
D
Dr. Stephen Henson 已提交
1865
        } else if (EVP_PKEY_id(pkey) == EVP_PKEY_RSA) {
1866
            md = EVP_md5_sha1();
1867
        } else {
1868
            md = EVP_sha1();
1869
        }
1870

1871 1872
        if (!PACKET_get_length_prefixed_2(pkt, &signature)
            || PACKET_remaining(pkt) != 0) {
1873
            al = SSL_AD_DECODE_ERROR;
M
Matt Caswell 已提交
1874
            SSLerr(SSL_F_TLS_PROCESS_KEY_EXCHANGE, SSL_R_LENGTH_MISMATCH);
1875
            goto err;
1876
        }
1877 1878
        maxsig = EVP_PKEY_size(pkey);
        if (maxsig < 0) {
1879
            al = SSL_AD_INTERNAL_ERROR;
1880
            SSLerr(SSL_F_TLS_PROCESS_KEY_EXCHANGE, ERR_R_INTERNAL_ERROR);
1881
            goto err;
M
Matt Caswell 已提交
1882
        }
1883 1884

        /*
M
Matt Caswell 已提交
1885
         * Check signature length
1886
         */
1887
        if (PACKET_remaining(&signature) > (size_t)maxsig) {
1888
            /* wrong packet length */
1889
            al = SSL_AD_DECODE_ERROR;
E
Emilia Kasper 已提交
1890 1891
            SSLerr(SSL_F_TLS_PROCESS_KEY_EXCHANGE,
                   SSL_R_WRONG_SIGNATURE_LENGTH);
1892 1893 1894 1895 1896 1897 1898 1899
            goto err;
        }

        md_ctx = EVP_MD_CTX_new();
        if (md_ctx == NULL) {
            al = SSL_AD_INTERNAL_ERROR;
            SSLerr(SSL_F_TLS_PROCESS_KEY_EXCHANGE, ERR_R_MALLOC_FAILURE);
            goto err;
1900
        }
1901

1902
        if (EVP_VerifyInit_ex(md_ctx, md, NULL) <= 0
E
Emilia Kasper 已提交
1903 1904 1905 1906 1907 1908
            || EVP_VerifyUpdate(md_ctx, &(s->s3->client_random[0]),
                                SSL3_RANDOM_SIZE) <= 0
            || EVP_VerifyUpdate(md_ctx, &(s->s3->server_random[0]),
                                SSL3_RANDOM_SIZE) <= 0
            || EVP_VerifyUpdate(md_ctx, PACKET_data(&params),
                                PACKET_remaining(&params)) <= 0) {
1909
            EVP_MD_CTX_free(md_ctx);
1910 1911
            al = SSL_AD_INTERNAL_ERROR;
            SSLerr(SSL_F_TLS_PROCESS_KEY_EXCHANGE, ERR_R_EVP_LIB);
1912
            goto err;
1913
        }
1914
        /* TODO(size_t): Convert this call */
1915
        if (EVP_VerifyFinal(md_ctx, PACKET_data(&signature),
1916 1917
                            (unsigned int)PACKET_remaining(&signature),
                            pkey) <= 0) {
1918
            /* bad signature */
1919
            EVP_MD_CTX_free(md_ctx);
1920 1921
            al = SSL_AD_DECRYPT_ERROR;
            SSLerr(SSL_F_TLS_PROCESS_KEY_EXCHANGE, SSL_R_BAD_SIGNATURE);
1922
            goto err;
1923
        }
1924
        EVP_MD_CTX_free(md_ctx);
1925
    } else {
1926
        /* aNULL, aSRP or PSK do not need public keys */
1927
        if (!(s->s3->tmp.new_cipher->algorithm_auth & (SSL_aNULL | SSL_aSRP))
E
Emilia Kasper 已提交
1928
            && !(alg_k & SSL_PSK)) {
1929
            /* Might be wrong key type, check it */
1930
            if (ssl3_check_cert_and_algorithm(s)) {
1931
                /* Otherwise this shouldn't happen */
1932
                al = SSL_AD_INTERNAL_ERROR;
1933
                SSLerr(SSL_F_TLS_PROCESS_KEY_EXCHANGE, ERR_R_INTERNAL_ERROR);
1934 1935 1936
            } else {
                al = SSL_AD_DECODE_ERROR;
            }
1937 1938 1939
            goto err;
        }
        /* still data left over */
1940
        if (PACKET_remaining(pkt) != 0) {
1941
            al = SSL_AD_DECODE_ERROR;
1942
            SSLerr(SSL_F_TLS_PROCESS_KEY_EXCHANGE, SSL_R_EXTRA_DATA_IN_MESSAGE);
1943
            goto err;
1944 1945
        }
    }
1946

1947
    return MSG_PROCESS_CONTINUE_READING;
1948
 err:
1949 1950
    if (al != -1)
        ssl3_send_alert(s, SSL3_AL_FATAL, al);
M
Matt Caswell 已提交
1951
    ossl_statem_set_error(s);
1952
    return MSG_PROCESS_ERROR;
1953
}
1954

M
Matt Caswell 已提交
1955
MSG_PROCESS_RETURN tls_process_certificate_request(SSL *s, PACKET *pkt)
1956 1957 1958 1959
{
    int ret = MSG_PROCESS_ERROR;
    unsigned int list_len, ctype_num, i, name_len;
    X509_NAME *xn = NULL;
E
Emilia Kasper 已提交
1960 1961
    const unsigned char *data;
    const unsigned char *namestart, *namebytes;
1962
    STACK_OF(X509_NAME) *ca_sk = NULL;
1963 1964

    if ((ca_sk = sk_X509_NAME_new(ca_dn_cmp)) == NULL) {
1965
        SSLerr(SSL_F_TLS_PROCESS_CERTIFICATE_REQUEST, ERR_R_MALLOC_FAILURE);
1966 1967 1968 1969
        goto err;
    }

    /* get the certificate types */
1970
    if (!PACKET_get_1(pkt, &ctype_num)
E
Emilia Kasper 已提交
1971
        || !PACKET_get_bytes(pkt, &data, ctype_num)) {
M
Matt Caswell 已提交
1972
        ssl3_send_alert(s, SSL3_AL_FATAL, SSL_AD_DECODE_ERROR);
1973
        SSLerr(SSL_F_TLS_PROCESS_CERTIFICATE_REQUEST, SSL_R_LENGTH_MISMATCH);
M
Matt Caswell 已提交
1974 1975
        goto err;
    }
R
Rich Salz 已提交
1976 1977
    OPENSSL_free(s->cert->ctypes);
    s->cert->ctypes = NULL;
1978 1979 1980 1981
    if (ctype_num > SSL3_CT_NUMBER) {
        /* If we exceed static buffer copy all to cert structure */
        s->cert->ctypes = OPENSSL_malloc(ctype_num);
        if (s->cert->ctypes == NULL) {
1982
            SSLerr(SSL_F_TLS_PROCESS_CERTIFICATE_REQUEST, ERR_R_MALLOC_FAILURE);
1983 1984
            goto err;
        }
M
Matt Caswell 已提交
1985
        memcpy(s->cert->ctypes, data, ctype_num);
1986
        s->cert->ctype_num = ctype_num;
1987 1988 1989
        ctype_num = SSL3_CT_NUMBER;
    }
    for (i = 0; i < ctype_num; i++)
M
Matt Caswell 已提交
1990 1991
        s->s3->tmp.ctype[i] = data[i];

1992
    if (SSL_USE_SIGALGS(s)) {
1993
        if (!PACKET_get_net_2(pkt, &list_len)
E
Emilia Kasper 已提交
1994
            || !PACKET_get_bytes(pkt, &data, list_len)) {
1995
            ssl3_send_alert(s, SSL3_AL_FATAL, SSL_AD_DECODE_ERROR);
1996 1997
            SSLerr(SSL_F_TLS_PROCESS_CERTIFICATE_REQUEST,
                   SSL_R_LENGTH_MISMATCH);
1998 1999
            goto err;
        }
M
Matt Caswell 已提交
2000

2001 2002
        /* Clear certificate digests and validity flags */
        for (i = 0; i < SSL_PKEY_NUM; i++) {
2003
            s->s3->tmp.md[i] = NULL;
2004
            s->s3->tmp.valid_flags[i] = 0;
2005
        }
M
Matt Caswell 已提交
2006
        if ((list_len & 1) || !tls1_save_sigalgs(s, data, list_len)) {
2007
            ssl3_send_alert(s, SSL3_AL_FATAL, SSL_AD_DECODE_ERROR);
2008
            SSLerr(SSL_F_TLS_PROCESS_CERTIFICATE_REQUEST,
2009 2010 2011 2012 2013
                   SSL_R_SIGNATURE_ALGORITHMS_ERROR);
            goto err;
        }
        if (!tls1_process_sigalgs(s)) {
            ssl3_send_alert(s, SSL3_AL_FATAL, SSL_AD_INTERNAL_ERROR);
2014
            SSLerr(SSL_F_TLS_PROCESS_CERTIFICATE_REQUEST, ERR_R_MALLOC_FAILURE);
2015 2016
            goto err;
        }
2017 2018
    } else {
        ssl_set_default_md(s);
2019 2020 2021
    }

    /* get the CA RDNs */
2022
    if (!PACKET_get_net_2(pkt, &list_len)
E
Emilia Kasper 已提交
2023
        || PACKET_remaining(pkt) != list_len) {
2024
        ssl3_send_alert(s, SSL3_AL_FATAL, SSL_AD_DECODE_ERROR);
2025
        SSLerr(SSL_F_TLS_PROCESS_CERTIFICATE_REQUEST, SSL_R_LENGTH_MISMATCH);
2026 2027 2028
        goto err;
    }

2029 2030
    while (PACKET_remaining(pkt)) {
        if (!PACKET_get_net_2(pkt, &name_len)
E
Emilia Kasper 已提交
2031
            || !PACKET_get_bytes(pkt, &namebytes, name_len)) {
2032
            ssl3_send_alert(s, SSL3_AL_FATAL, SSL_AD_DECODE_ERROR);
2033 2034
            SSLerr(SSL_F_TLS_PROCESS_CERTIFICATE_REQUEST,
                   SSL_R_LENGTH_MISMATCH);
2035 2036 2037
            goto err;
        }

M
Matt Caswell 已提交
2038
        namestart = namebytes;
2039

M
Matt Caswell 已提交
2040 2041
        if ((xn = d2i_X509_NAME(NULL, (const unsigned char **)&namebytes,
                                name_len)) == NULL) {
2042
            ssl3_send_alert(s, SSL3_AL_FATAL, SSL_AD_DECODE_ERROR);
2043
            SSLerr(SSL_F_TLS_PROCESS_CERTIFICATE_REQUEST, ERR_R_ASN1_LIB);
2044
            goto err;
2045 2046
        }

M
Matt Caswell 已提交
2047
        if (namebytes != (namestart + name_len)) {
2048
            ssl3_send_alert(s, SSL3_AL_FATAL, SSL_AD_DECODE_ERROR);
2049
            SSLerr(SSL_F_TLS_PROCESS_CERTIFICATE_REQUEST,
2050 2051 2052 2053
                   SSL_R_CA_DN_LENGTH_MISMATCH);
            goto err;
        }
        if (!sk_X509_NAME_push(ca_sk, xn)) {
2054
            SSLerr(SSL_F_TLS_PROCESS_CERTIFICATE_REQUEST, ERR_R_MALLOC_FAILURE);
2055 2056
            goto err;
        }
2057
        xn = NULL;
2058 2059 2060 2061 2062
    }

    /* we should setup a certificate to return.... */
    s->s3->tmp.cert_req = 1;
    s->s3->tmp.ctype_num = ctype_num;
R
Rich Salz 已提交
2063
    sk_X509_NAME_pop_free(s->s3->tmp.ca_names, X509_NAME_free);
2064 2065 2066
    s->s3->tmp.ca_names = ca_sk;
    ca_sk = NULL;

2067
    ret = MSG_PROCESS_CONTINUE_PROCESSING;
2068
    goto done;
2069
 err:
M
Matt Caswell 已提交
2070
    ossl_statem_set_error(s);
2071
 done:
2072
    X509_NAME_free(xn);
R
Rich Salz 已提交
2073
    sk_X509_NAME_pop_free(ca_sk, X509_NAME_free);
2074
    return ret;
2075 2076 2077
}

static int ca_dn_cmp(const X509_NAME *const *a, const X509_NAME *const *b)
2078
{
2079
    return (X509_NAME_cmp(*a, *b));
2080 2081
}

M
Matt Caswell 已提交
2082
MSG_PROCESS_RETURN tls_process_new_session_ticket(SSL *s, PACKET *pkt)
2083 2084 2085 2086
{
    int al;
    unsigned int ticklen;
    unsigned long ticket_lifetime_hint;
2087
    unsigned int sess_len;
2088

2089
    if (!PACKET_get_net_4(pkt, &ticket_lifetime_hint)
E
Emilia Kasper 已提交
2090 2091
        || !PACKET_get_net_2(pkt, &ticklen)
        || PACKET_remaining(pkt) != ticklen) {
2092
        al = SSL_AD_DECODE_ERROR;
M
Matt Caswell 已提交
2093
        SSLerr(SSL_F_TLS_PROCESS_NEW_SESSION_TICKET, SSL_R_LENGTH_MISMATCH);
2094 2095 2096 2097 2098
        goto f_err;
    }

    /* Server is allowed to change its mind and send an empty ticket. */
    if (ticklen == 0)
2099
        return MSG_PROCESS_CONTINUE_READING;
2100

2101 2102 2103 2104 2105 2106 2107 2108 2109
    if (s->session->session_id_length > 0) {
        int i = s->session_ctx->session_cache_mode;
        SSL_SESSION *new_sess;
        /*
         * We reused an existing session, so we need to replace it with a new
         * one
         */
        if (i & SSL_SESS_CACHE_CLIENT) {
            /*
2110
             * Remove the old session from the cache. We carry on if this fails
2111
             */
2112
            SSL_CTX_remove_session(s->session_ctx, s->session);
2113 2114 2115 2116
        }

        if ((new_sess = ssl_session_dup(s->session, 0)) == 0) {
            al = SSL_AD_INTERNAL_ERROR;
2117
            SSLerr(SSL_F_TLS_PROCESS_NEW_SESSION_TICKET, ERR_R_MALLOC_FAILURE);
2118 2119 2120 2121 2122 2123 2124
            goto f_err;
        }

        SSL_SESSION_free(s->session);
        s->session = new_sess;
    }

R
Rich Salz 已提交
2125 2126
    OPENSSL_free(s->session->tlsext_tick);
    s->session->tlsext_ticklen = 0;
2127

2128
    s->session->tlsext_tick = OPENSSL_malloc(ticklen);
2129
    if (s->session->tlsext_tick == NULL) {
2130
        SSLerr(SSL_F_TLS_PROCESS_NEW_SESSION_TICKET, ERR_R_MALLOC_FAILURE);
2131 2132
        goto err;
    }
2133
    if (!PACKET_copy_bytes(pkt, s->session->tlsext_tick, ticklen)) {
M
Matt Caswell 已提交
2134
        al = SSL_AD_DECODE_ERROR;
2135
        SSLerr(SSL_F_TLS_PROCESS_NEW_SESSION_TICKET, SSL_R_LENGTH_MISMATCH);
M
Matt Caswell 已提交
2136 2137
        goto f_err;
    }
2138 2139

    s->session->tlsext_tick_lifetime_hint = ticket_lifetime_hint;
2140 2141 2142 2143 2144 2145 2146 2147 2148 2149 2150 2151
    s->session->tlsext_ticklen = ticklen;
    /*
     * There are two ways to detect a resumed ticket session. One is to set
     * an appropriate session ID and then the server must return a match in
     * ServerHello. This allows the normal client session ID matching to work
     * and we know much earlier that the ticket has been accepted. The
     * other way is to set zero length session ID when the ticket is
     * presented and rely on the handshake to determine session resumption.
     * We choose the former approach because this fits in with assumptions
     * elsewhere in OpenSSL. The session ID is set to the SHA256 (or SHA1 is
     * SHA256 is disabled) hash of the ticket.
     */
2152 2153 2154 2155
    /*
     * TODO(size_t): we use sess_len here because EVP_Digest expects an int
     * but s->session->session_id_length is a size_t
     */
2156
    if (!EVP_Digest(s->session->tlsext_tick, ticklen,
2157
                    s->session->session_id, &sess_len,
2158 2159 2160 2161
                    EVP_sha256(), NULL)) {
        SSLerr(SSL_F_TLS_PROCESS_NEW_SESSION_TICKET, ERR_R_EVP_LIB);
        goto err;
    }
2162
    s->session->session_id_length = sess_len;
2163
    return MSG_PROCESS_CONTINUE_READING;
2164 2165 2166
 f_err:
    ssl3_send_alert(s, SSL3_AL_FATAL, al);
 err:
M
Matt Caswell 已提交
2167
    ossl_statem_set_error(s);
2168
    return MSG_PROCESS_ERROR;
2169
}
2170

M
Matt Caswell 已提交
2171
MSG_PROCESS_RETURN tls_process_cert_status(SSL *s, PACKET *pkt)
2172 2173
{
    int al;
M
Matt Caswell 已提交
2174
    size_t resplen;
2175 2176
    unsigned int type;

2177
    if (!PACKET_get_1(pkt, &type)
E
Emilia Kasper 已提交
2178
        || type != TLSEXT_STATUSTYPE_ocsp) {
2179
        al = SSL_AD_DECODE_ERROR;
2180
        SSLerr(SSL_F_TLS_PROCESS_CERT_STATUS, SSL_R_UNSUPPORTED_STATUS_TYPE);
2181 2182
        goto f_err;
    }
2183 2184
    if (!PACKET_get_net_3_len(pkt, &resplen)
        || PACKET_remaining(pkt) != resplen) {
2185
        al = SSL_AD_DECODE_ERROR;
2186
        SSLerr(SSL_F_TLS_PROCESS_CERT_STATUS, SSL_R_LENGTH_MISMATCH);
2187 2188
        goto f_err;
    }
2189
    s->tlsext_ocsp_resp = OPENSSL_malloc(resplen);
2190
    if (s->tlsext_ocsp_resp == NULL) {
2191
        al = SSL_AD_INTERNAL_ERROR;
2192
        SSLerr(SSL_F_TLS_PROCESS_CERT_STATUS, ERR_R_MALLOC_FAILURE);
2193 2194
        goto f_err;
    }
2195
    if (!PACKET_copy_bytes(pkt, s->tlsext_ocsp_resp, resplen)) {
2196
        al = SSL_AD_DECODE_ERROR;
2197
        SSLerr(SSL_F_TLS_PROCESS_CERT_STATUS, SSL_R_LENGTH_MISMATCH);
2198 2199
        goto f_err;
    }
2200
    s->tlsext_ocsp_resplen = resplen;
2201
    return MSG_PROCESS_CONTINUE_READING;
2202 2203
 f_err:
    ssl3_send_alert(s, SSL3_AL_FATAL, al);
M
Matt Caswell 已提交
2204
    ossl_statem_set_error(s);
2205
    return MSG_PROCESS_ERROR;
2206
}
2207

2208 2209 2210
/*
 * Perform miscellaneous checks and processing after we have received the
 * server's initial flight. In TLS1.3 this is after the Server Finished message.
2211 2212
 * In <=TLS1.2 this is after the ServerDone message. Returns 1 on success or 0
 * on failure.
2213 2214
 */
int tls_process_initial_server_flight(SSL *s, int *al)
2215
{
2216 2217 2218 2219 2220
    /*
     * at this point we check that we have the required stuff from
     * the server
     */
    if (!ssl3_check_cert_and_algorithm(s)) {
2221 2222
        *al = SSL_AD_HANDSHAKE_FAILURE;
        return 0;
2223 2224
    }

2225 2226 2227 2228 2229
    /*
     * Call the ocsp status callback if needed. The |tlsext_ocsp_resp| and
     * |tlsext_ocsp_resplen| values will be set if we actually received a status
     * message, or NULL and -1 otherwise
     */
2230 2231
    if (s->tlsext_status_type != TLSEXT_STATUSTYPE_nothing
            && s->ctx->tlsext_status_cb != NULL) {
2232 2233 2234
        int ret;
        ret = s->ctx->tlsext_status_cb(s, s->ctx->tlsext_status_arg);
        if (ret == 0) {
2235 2236
            *al = SSL_AD_BAD_CERTIFICATE_STATUS_RESPONSE;
            SSLerr(SSL_F_TLS_PROCESS_INITIAL_SERVER_FLIGHT,
2237
                   SSL_R_INVALID_STATUS_RESPONSE);
2238
            return 0;
2239 2240
        }
        if (ret < 0) {
2241 2242 2243 2244
            *al = SSL_AD_INTERNAL_ERROR;
            SSLerr(SSL_F_TLS_PROCESS_INITIAL_SERVER_FLIGHT,
                   ERR_R_MALLOC_FAILURE);
            return 0;
2245 2246
        }
    }
2247 2248
#ifndef OPENSSL_NO_CT
    if (s->ct_validation_callback != NULL) {
2249 2250
        /* Note we validate the SCTs whether or not we abort on error */
        if (!ssl_validate_ct(s) && (s->verify_mode & SSL_VERIFY_PEER)) {
2251 2252
            *al = SSL_AD_HANDSHAKE_FAILURE;
            return 0;
2253 2254 2255 2256
        }
    }
#endif

2257 2258 2259 2260 2261 2262 2263 2264 2265 2266 2267 2268 2269 2270 2271 2272 2273 2274 2275 2276 2277 2278 2279 2280 2281 2282 2283 2284
    return 1;
}

MSG_PROCESS_RETURN tls_process_server_done(SSL *s, PACKET *pkt)
{
    int al = SSL_AD_INTERNAL_ERROR;

    if (PACKET_remaining(pkt) > 0) {
        /* should contain no data */
        al = SSL_AD_DECODE_ERROR;
        SSLerr(SSL_F_TLS_PROCESS_SERVER_DONE, SSL_R_LENGTH_MISMATCH);
        goto err;
    }
#ifndef OPENSSL_NO_SRP
    if (s->s3->tmp.new_cipher->algorithm_mkey & SSL_kSRP) {
        if (SRP_Calc_A_param(s) <= 0) {
            SSLerr(SSL_F_TLS_PROCESS_SERVER_DONE, SSL_R_SRP_A_CALC);
            goto err;
        }
    }
#endif

    /*
     * Error queue messages are generated directly by this function
     */
    if (!tls_process_initial_server_flight(s, &al))
        goto err;

2285 2286 2287
#ifndef OPENSSL_NO_SCTP
    /* Only applies to renegotiation */
    if (SSL_IS_DTLS(s) && BIO_dgram_is_sctp(SSL_get_wbio(s))
E
Emilia Kasper 已提交
2288
        && s->renegotiate != 0)
2289 2290 2291 2292
        return MSG_PROCESS_CONTINUE_PROCESSING;
    else
#endif
        return MSG_PROCESS_FINISHED_READING;
2293 2294 2295 2296 2297

 err:
    ssl3_send_alert(s, SSL3_AL_FATAL, al);
    ossl_statem_set_error(s);
    return MSG_PROCESS_ERROR;
2298
}
2299

2300
static int tls_construct_cke_psk_preamble(SSL *s, WPACKET *pkt, int *al)
2301
{
2302
#ifndef OPENSSL_NO_PSK
2303 2304 2305 2306 2307 2308 2309 2310 2311 2312 2313 2314 2315 2316
    int ret = 0;
    /*
     * The callback needs PSK_MAX_IDENTITY_LEN + 1 bytes to return a
     * \0-terminated identity. The last byte is for us for simulating
     * strnlen.
     */
    char identity[PSK_MAX_IDENTITY_LEN + 1];
    size_t identitylen = 0;
    unsigned char psk[PSK_MAX_PSK_LEN];
    unsigned char *tmppsk = NULL;
    char *tmpidentity = NULL;
    size_t psklen = 0;

    if (s->psk_client_callback == NULL) {
2317
        SSLerr(SSL_F_TLS_CONSTRUCT_CKE_PSK_PREAMBLE, SSL_R_PSK_NO_CLIENT_CB);
2318 2319 2320
        *al = SSL_AD_INTERNAL_ERROR;
        goto err;
    }
2321

2322
    memset(identity, 0, sizeof(identity));
2323

2324 2325 2326
    psklen = s->psk_client_callback(s, s->session->psk_identity_hint,
                                    identity, sizeof(identity) - 1,
                                    psk, sizeof(psk));
2327

2328
    if (psklen > PSK_MAX_PSK_LEN) {
2329
        SSLerr(SSL_F_TLS_CONSTRUCT_CKE_PSK_PREAMBLE, ERR_R_INTERNAL_ERROR);
2330 2331 2332
        *al = SSL_AD_HANDSHAKE_FAILURE;
        goto err;
    } else if (psklen == 0) {
2333
        SSLerr(SSL_F_TLS_CONSTRUCT_CKE_PSK_PREAMBLE,
2334 2335 2336 2337
               SSL_R_PSK_IDENTITY_NOT_FOUND);
        *al = SSL_AD_HANDSHAKE_FAILURE;
        goto err;
    }
2338

2339 2340
    identitylen = strlen(identity);
    if (identitylen > PSK_MAX_IDENTITY_LEN) {
2341
        SSLerr(SSL_F_TLS_CONSTRUCT_CKE_PSK_PREAMBLE, ERR_R_INTERNAL_ERROR);
2342 2343 2344
        *al = SSL_AD_HANDSHAKE_FAILURE;
        goto err;
    }
2345

2346 2347 2348
    tmppsk = OPENSSL_memdup(psk, psklen);
    tmpidentity = OPENSSL_strdup(identity);
    if (tmppsk == NULL || tmpidentity == NULL) {
2349
        SSLerr(SSL_F_TLS_CONSTRUCT_CKE_PSK_PREAMBLE, ERR_R_MALLOC_FAILURE);
2350 2351 2352
        *al = SSL_AD_INTERNAL_ERROR;
        goto err;
    }
2353

2354 2355 2356 2357 2358 2359 2360
    OPENSSL_free(s->s3->tmp.psk);
    s->s3->tmp.psk = tmppsk;
    s->s3->tmp.psklen = psklen;
    tmppsk = NULL;
    OPENSSL_free(s->session->psk_identity);
    s->session->psk_identity = tmpidentity;
    tmpidentity = NULL;
2361

2362
    if (!WPACKET_sub_memcpy_u16(pkt, identity, identitylen))  {
2363 2364 2365 2366
        SSLerr(SSL_F_TLS_CONSTRUCT_CKE_PSK_PREAMBLE, ERR_R_INTERNAL_ERROR);
        *al = SSL_AD_INTERNAL_ERROR;
        goto err;
    }
2367

2368
    ret = 1;
2369

2370 2371 2372 2373 2374
 err:
    OPENSSL_cleanse(psk, psklen);
    OPENSSL_cleanse(identity, sizeof(identity));
    OPENSSL_clear_free(tmppsk, psklen);
    OPENSSL_clear_free(tmpidentity, identitylen);
2375

2376 2377
    return ret;
#else
2378
    SSLerr(SSL_F_TLS_CONSTRUCT_CKE_PSK_PREAMBLE, ERR_R_INTERNAL_ERROR);
2379 2380
    *al = SSL_AD_INTERNAL_ERROR;
    return 0;
2381
#endif
2382
}
2383

2384
static int tls_construct_cke_rsa(SSL *s, WPACKET *pkt, int *al)
2385
{
2386
#ifndef OPENSSL_NO_RSA
2387
    unsigned char *encdata = NULL;
2388 2389 2390 2391 2392
    EVP_PKEY *pkey = NULL;
    EVP_PKEY_CTX *pctx = NULL;
    size_t enclen;
    unsigned char *pms = NULL;
    size_t pmslen = 0;
2393

2394 2395 2396 2397
    if (s->session->peer == NULL) {
        /*
         * We should always have a server certificate with SSL_kRSA.
         */
2398
        SSLerr(SSL_F_TLS_CONSTRUCT_CKE_RSA, ERR_R_INTERNAL_ERROR);
2399 2400
        return 0;
    }
2401

2402 2403
    pkey = X509_get0_pubkey(s->session->peer);
    if (EVP_PKEY_get0_RSA(pkey) == NULL) {
2404
        SSLerr(SSL_F_TLS_CONSTRUCT_CKE_RSA, ERR_R_INTERNAL_ERROR);
2405 2406
        return 0;
    }
2407

2408 2409 2410
    pmslen = SSL_MAX_MASTER_KEY_LENGTH;
    pms = OPENSSL_malloc(pmslen);
    if (pms == NULL) {
2411
        SSLerr(SSL_F_TLS_CONSTRUCT_CKE_RSA, ERR_R_MALLOC_FAILURE);
2412 2413 2414
        *al = SSL_AD_INTERNAL_ERROR;
        return 0;
    }
2415

2416 2417
    pms[0] = s->client_version >> 8;
    pms[1] = s->client_version & 0xff;
2418 2419
    /* TODO(size_t): Convert this function */
    if (RAND_bytes(pms + 2, (int)(pmslen - 2)) <= 0) {
2420 2421
        goto err;
    }
2422

2423
    /* Fix buf for TLS and beyond */
2424 2425 2426 2427
    if (s->version > SSL3_VERSION && !WPACKET_start_sub_packet_u16(pkt)) {
        SSLerr(SSL_F_TLS_CONSTRUCT_CKE_RSA, ERR_R_INTERNAL_ERROR);
        goto err;
    }
2428 2429 2430
    pctx = EVP_PKEY_CTX_new(pkey, NULL);
    if (pctx == NULL || EVP_PKEY_encrypt_init(pctx) <= 0
        || EVP_PKEY_encrypt(pctx, NULL, &enclen, pms, pmslen) <= 0) {
2431
        SSLerr(SSL_F_TLS_CONSTRUCT_CKE_RSA, ERR_R_EVP_LIB);
2432 2433
        goto err;
    }
2434 2435
    if (!WPACKET_allocate_bytes(pkt, enclen, &encdata)
            || EVP_PKEY_encrypt(pctx, encdata, &enclen, pms, pmslen) <= 0) {
2436
        SSLerr(SSL_F_TLS_CONSTRUCT_CKE_RSA, SSL_R_BAD_RSA_ENCRYPT);
2437 2438 2439 2440
        goto err;
    }
    EVP_PKEY_CTX_free(pctx);
    pctx = NULL;
2441
# ifdef PKCS1_CHECK
2442 2443 2444 2445
    if (s->options & SSL_OP_PKCS1_CHECK_1)
        (*p)[1]++;
    if (s->options & SSL_OP_PKCS1_CHECK_2)
        tmp_buf[0] = 0x70;
2446 2447
# endif

2448
    /* Fix buf for TLS and beyond */
2449 2450 2451
    if (s->version > SSL3_VERSION && !WPACKET_close(pkt)) {
        SSLerr(SSL_F_TLS_CONSTRUCT_CKE_RSA, ERR_R_INTERNAL_ERROR);
        goto err;
2452
    }
2453 2454 2455 2456 2457 2458 2459 2460 2461 2462 2463

    s->s3->tmp.pms = pms;
    s->s3->tmp.pmslen = pmslen;

    return 1;
 err:
    OPENSSL_clear_free(pms, pmslen);
    EVP_PKEY_CTX_free(pctx);

    return 0;
#else
2464
    SSLerr(SSL_F_TLS_CONSTRUCT_CKE_RSA, ERR_R_INTERNAL_ERROR);
2465 2466
    *al = SSL_AD_INTERNAL_ERROR;
    return 0;
2467
#endif
2468 2469
}

2470
static int tls_construct_cke_dhe(SSL *s, WPACKET *pkt, int *al)
2471 2472 2473 2474 2475
{
#ifndef OPENSSL_NO_DH
    DH *dh_clnt = NULL;
    const BIGNUM *pub_key;
    EVP_PKEY *ckey = NULL, *skey = NULL;
2476
    unsigned char *keybytes = NULL;
2477 2478

    skey = s->s3->peer_tmp;
2479 2480 2481
    if (skey == NULL)
        goto err;

D
Dr. Stephen Henson 已提交
2482
    ckey = ssl_generate_pkey(skey);
2483 2484 2485
    if (ckey == NULL)
        goto err;

2486 2487
    dh_clnt = EVP_PKEY_get0_DH(ckey);

2488
    if (dh_clnt == NULL || ssl_derive(s, ckey, skey, 0) == 0)
2489
        goto err;
2490 2491 2492

    /* send off the data */
    DH_get0_key(dh_clnt, &pub_key, NULL);
2493
    if (!WPACKET_sub_allocate_bytes_u16(pkt, BN_num_bytes(pub_key), &keybytes))
2494 2495 2496
        goto err;

    BN_bn2bin(pub_key, keybytes);
2497 2498 2499
    EVP_PKEY_free(ckey);

    return 1;
2500 2501 2502
 err:
    EVP_PKEY_free(ckey);
#endif
2503
    SSLerr(SSL_F_TLS_CONSTRUCT_CKE_DHE, ERR_R_INTERNAL_ERROR);
2504 2505 2506 2507
    *al = SSL_AD_INTERNAL_ERROR;
    return 0;
}

2508
static int tls_construct_cke_ecdhe(SSL *s, WPACKET *pkt, int *al)
2509 2510 2511
{
#ifndef OPENSSL_NO_EC
    unsigned char *encodedPoint = NULL;
2512
    size_t encoded_pt_len = 0;
2513
    EVP_PKEY *ckey = NULL, *skey = NULL;
2514
    int ret = 0;
2515 2516

    skey = s->s3->peer_tmp;
2517
    if (skey == NULL) {
2518
        SSLerr(SSL_F_TLS_CONSTRUCT_CKE_ECDHE, ERR_R_INTERNAL_ERROR);
2519 2520 2521
        return 0;
    }

D
Dr. Stephen Henson 已提交
2522
    ckey = ssl_generate_pkey(skey);
2523 2524 2525 2526
    if (ckey == NULL) {
        SSLerr(SSL_F_TLS_CONSTRUCT_CKE_ECDHE, ERR_R_MALLOC_FAILURE);
        goto err;
    }
2527

2528
    if (ssl_derive(s, ckey, skey, 0) == 0) {
2529
        SSLerr(SSL_F_TLS_CONSTRUCT_CKE_ECDHE, ERR_R_EVP_LIB);
2530 2531 2532 2533
        goto err;
    }

    /* Generate encoding of client key */
2534
    encoded_pt_len = EVP_PKEY_get1_tls_encodedpoint(ckey, &encodedPoint);
2535 2536

    if (encoded_pt_len == 0) {
2537
        SSLerr(SSL_F_TLS_CONSTRUCT_CKE_ECDHE, ERR_R_EC_LIB);
2538 2539 2540
        goto err;
    }

2541
    if (!WPACKET_sub_memcpy_u8(pkt, encodedPoint, encoded_pt_len)) {
2542 2543 2544
        SSLerr(SSL_F_TLS_CONSTRUCT_CKE_ECDHE, ERR_R_INTERNAL_ERROR);
        goto err;
    }
2545

2546
    ret = 1;
2547
 err:
2548
    OPENSSL_free(encodedPoint);
2549
    EVP_PKEY_free(ckey);
2550
    return ret;
2551
#else
2552
    SSLerr(SSL_F_TLS_CONSTRUCT_CKE_ECDHE, ERR_R_INTERNAL_ERROR);
2553 2554 2555 2556 2557
    *al = SSL_AD_INTERNAL_ERROR;
    return 0;
#endif
}

2558
static int tls_construct_cke_gost(SSL *s, WPACKET *pkt, int *al)
2559 2560 2561 2562 2563 2564 2565 2566 2567 2568 2569 2570 2571 2572 2573 2574 2575 2576 2577 2578 2579 2580
{
#ifndef OPENSSL_NO_GOST
    /* GOST key exchange message creation */
    EVP_PKEY_CTX *pkey_ctx = NULL;
    X509 *peer_cert;
    size_t msglen;
    unsigned int md_len;
    unsigned char shared_ukm[32], tmp[256];
    EVP_MD_CTX *ukm_hash = NULL;
    int dgst_nid = NID_id_GostR3411_94;
    unsigned char *pms = NULL;
    size_t pmslen = 0;

    if ((s->s3->tmp.new_cipher->algorithm_auth & SSL_aGOST12) != 0)
        dgst_nid = NID_id_GostR3411_2012_256;

    /*
     * Get server sertificate PKEY and create ctx from it
     */
    peer_cert = s->session->peer;
    if (!peer_cert) {
        *al = SSL_AD_HANDSHAKE_FAILURE;
2581
        SSLerr(SSL_F_TLS_CONSTRUCT_CKE_GOST,
2582 2583 2584 2585 2586 2587 2588
               SSL_R_NO_GOST_CERTIFICATE_SENT_BY_PEER);
        return 0;
    }

    pkey_ctx = EVP_PKEY_CTX_new(X509_get0_pubkey(peer_cert), NULL);
    if (pkey_ctx == NULL) {
        *al = SSL_AD_INTERNAL_ERROR;
2589
        SSLerr(SSL_F_TLS_CONSTRUCT_CKE_GOST, ERR_R_MALLOC_FAILURE);
2590 2591 2592 2593 2594 2595 2596 2597 2598 2599 2600 2601 2602
        return 0;
    }
    /*
     * If we have send a certificate, and certificate key
     * parameters match those of server certificate, use
     * certificate key for key exchange
     */

    /* Otherwise, generate ephemeral key pair */
    pmslen = 32;
    pms = OPENSSL_malloc(pmslen);
    if (pms == NULL) {
        *al = SSL_AD_INTERNAL_ERROR;
2603
        SSLerr(SSL_F_TLS_CONSTRUCT_CKE_GOST, ERR_R_MALLOC_FAILURE);
2604
        goto err;
2605 2606 2607
    }

    if (EVP_PKEY_encrypt_init(pkey_ctx) <= 0
2608 2609 2610 2611
        /* Generate session key
         * TODO(size_t): Convert this function
         */
        || RAND_bytes(pms, (int)pmslen) <= 0) {
2612
        *al = SSL_AD_INTERNAL_ERROR;
2613
        SSLerr(SSL_F_TLS_CONSTRUCT_CKE_GOST, ERR_R_INTERNAL_ERROR);
2614 2615 2616 2617 2618 2619 2620 2621
        goto err;
    };
    /*
     * Compute shared IV and store it in algorithm-specific context
     * data
     */
    ukm_hash = EVP_MD_CTX_new();
    if (ukm_hash == NULL
E
Emilia Kasper 已提交
2622 2623 2624 2625 2626 2627
        || EVP_DigestInit(ukm_hash, EVP_get_digestbynid(dgst_nid)) <= 0
        || EVP_DigestUpdate(ukm_hash, s->s3->client_random,
                            SSL3_RANDOM_SIZE) <= 0
        || EVP_DigestUpdate(ukm_hash, s->s3->server_random,
                            SSL3_RANDOM_SIZE) <= 0
        || EVP_DigestFinal_ex(ukm_hash, shared_ukm, &md_len) <= 0) {
2628
        *al = SSL_AD_INTERNAL_ERROR;
2629
        SSLerr(SSL_F_TLS_CONSTRUCT_CKE_GOST, ERR_R_INTERNAL_ERROR);
2630 2631 2632 2633 2634 2635 2636
        goto err;
    }
    EVP_MD_CTX_free(ukm_hash);
    ukm_hash = NULL;
    if (EVP_PKEY_CTX_ctrl(pkey_ctx, -1, EVP_PKEY_OP_ENCRYPT,
                          EVP_PKEY_CTRL_SET_IV, 8, shared_ukm) < 0) {
        *al = SSL_AD_INTERNAL_ERROR;
2637
        SSLerr(SSL_F_TLS_CONSTRUCT_CKE_GOST, SSL_R_LIBRARY_BUG);
2638 2639 2640 2641 2642 2643 2644 2645 2646
        goto err;
    }
    /* Make GOST keytransport blob message */
    /*
     * Encapsulate it into sequence
     */
    msglen = 255;
    if (EVP_PKEY_encrypt(pkey_ctx, tmp, &msglen, pms, pmslen) <= 0) {
        *al = SSL_AD_INTERNAL_ERROR;
2647
        SSLerr(SSL_F_TLS_CONSTRUCT_CKE_GOST, SSL_R_LIBRARY_BUG);
2648 2649
        goto err;
    }
2650

2651 2652
    if (!WPACKET_put_bytes_u8(pkt, V_ASN1_SEQUENCE | V_ASN1_CONSTRUCTED)
            || (msglen >= 0x80 && !WPACKET_put_bytes_u8(pkt, 0x81))
2653
            || !WPACKET_sub_memcpy_u8(pkt, tmp, msglen)) {
2654 2655 2656
        *al = SSL_AD_INTERNAL_ERROR;
        SSLerr(SSL_F_TLS_CONSTRUCT_CKE_GOST, ERR_R_INTERNAL_ERROR);
        goto err;
2657
    }
2658

2659 2660 2661 2662 2663 2664 2665 2666 2667 2668 2669
    EVP_PKEY_CTX_free(pkey_ctx);
    s->s3->tmp.pms = pms;
    s->s3->tmp.pmslen = pmslen;

    return 1;
 err:
    EVP_PKEY_CTX_free(pkey_ctx);
    OPENSSL_clear_free(pms, pmslen);
    EVP_MD_CTX_free(ukm_hash);
    return 0;
#else
2670
    SSLerr(SSL_F_TLS_CONSTRUCT_CKE_GOST, ERR_R_INTERNAL_ERROR);
2671 2672 2673 2674 2675
    *al = SSL_AD_INTERNAL_ERROR;
    return 0;
#endif
}

2676
static int tls_construct_cke_srp(SSL *s, WPACKET *pkt, int *al)
2677
{
2678
#ifndef OPENSSL_NO_SRP
2679 2680 2681
    unsigned char *abytes = NULL;

    if (s->srp_ctx.A == NULL
2682 2683
            || !WPACKET_sub_allocate_bytes_u16(pkt, BN_num_bytes(s->srp_ctx.A),
                                               &abytes)) {
2684
        SSLerr(SSL_F_TLS_CONSTRUCT_CKE_SRP, ERR_R_INTERNAL_ERROR);
2685 2686
        return 0;
    }
2687 2688
    BN_bn2bin(s->srp_ctx.A, abytes);

2689 2690 2691
    OPENSSL_free(s->session->srp_username);
    s->session->srp_username = OPENSSL_strdup(s->srp_ctx.login);
    if (s->session->srp_username == NULL) {
2692
        SSLerr(SSL_F_TLS_CONSTRUCT_CKE_SRP, ERR_R_MALLOC_FAILURE);
2693 2694 2695 2696 2697
        return 0;
    }

    return 1;
#else
2698
    SSLerr(SSL_F_TLS_CONSTRUCT_CKE_SRP, ERR_R_INTERNAL_ERROR);
2699 2700 2701 2702 2703
    *al = SSL_AD_INTERNAL_ERROR;
    return 0;
#endif
}

2704
int tls_construct_client_key_exchange(SSL *s, WPACKET *pkt)
2705 2706 2707 2708
{
    unsigned long alg_k;
    int al = -1;

2709
    alg_k = s->s3->tmp.new_cipher->algorithm_mkey;
2710 2711

    if ((alg_k & SSL_PSK)
2712
        && !tls_construct_cke_psk_preamble(s, pkt, &al))
2713 2714
        goto err;

2715
    if (alg_k & (SSL_kRSA | SSL_kRSAPSK)) {
2716
        if (!tls_construct_cke_rsa(s, pkt, &al))
2717
            goto err;
2718
    } else if (alg_k & (SSL_kDHE | SSL_kDHEPSK)) {
2719
        if (!tls_construct_cke_dhe(s, pkt, &al))
2720
            goto err;
2721
    } else if (alg_k & (SSL_kECDHE | SSL_kECDHEPSK)) {
2722
        if (!tls_construct_cke_ecdhe(s, pkt, &al))
D
Dr. Stephen Henson 已提交
2723
            goto err;
2724
    } else if (alg_k & SSL_kGOST) {
2725
        if (!tls_construct_cke_gost(s, pkt, &al))
2726
            goto err;
2727
    } else if (alg_k & SSL_kSRP) {
2728
        if (!tls_construct_cke_srp(s, pkt, &al))
M
Matt Caswell 已提交
2729
            goto err;
2730
    } else if (!(alg_k & SSL_kPSK)) {
2731 2732 2733 2734 2735 2736
        ssl3_send_alert(s, SSL3_AL_FATAL, SSL_AD_HANDSHAKE_FAILURE);
        SSLerr(SSL_F_TLS_CONSTRUCT_CLIENT_KEY_EXCHANGE, ERR_R_INTERNAL_ERROR);
        goto err;
    }

    return 1;
2737
 err:
2738 2739
    if (al != -1)
        ssl3_send_alert(s, SSL3_AL_FATAL, al);
2740
    OPENSSL_clear_free(s->s3->tmp.pms, s->s3->tmp.pmslen);
D
Dr. Stephen Henson 已提交
2741
    s->s3->tmp.pms = NULL;
2742 2743 2744
#ifndef OPENSSL_NO_PSK
    OPENSSL_clear_free(s->s3->tmp.psk, s->s3->tmp.psklen);
    s->s3->tmp.psk = NULL;
2745
#endif
2746 2747 2748 2749 2750 2751 2752 2753
    return 0;
}

int tls_client_key_exchange_post_work(SSL *s)
{
    unsigned char *pms = NULL;
    size_t pmslen = 0;

2754 2755 2756
    pms = s->s3->tmp.pms;
    pmslen = s->s3->tmp.pmslen;

2757 2758 2759 2760 2761 2762 2763 2764 2765 2766 2767 2768 2769 2770 2771 2772 2773 2774 2775 2776
#ifndef OPENSSL_NO_SRP
    /* Check for SRP */
    if (s->s3->tmp.new_cipher->algorithm_mkey & SSL_kSRP) {
        if (!srp_generate_client_master_secret(s)) {
            SSLerr(SSL_F_TLS_CLIENT_KEY_EXCHANGE_POST_WORK,
                   ERR_R_INTERNAL_ERROR);
            goto err;
        }
        return 1;
    }
#endif

    if (pms == NULL && !(s->s3->tmp.new_cipher->algorithm_mkey & SSL_kPSK)) {
        ssl3_send_alert(s, SSL3_AL_FATAL, SSL_AD_INTERNAL_ERROR);
        SSLerr(SSL_F_TLS_CLIENT_KEY_EXCHANGE_POST_WORK, ERR_R_MALLOC_FAILURE);
        goto err;
    }
    if (!ssl_generate_master_secret(s, pms, pmslen, 1)) {
        ssl3_send_alert(s, SSL3_AL_FATAL, SSL_AD_INTERNAL_ERROR);
        SSLerr(SSL_F_TLS_CLIENT_KEY_EXCHANGE_POST_WORK, ERR_R_INTERNAL_ERROR);
2777 2778 2779
        /* ssl_generate_master_secret frees the pms even on error */
        pms = NULL;
        pmslen = 0;
2780 2781
        goto err;
    }
2782 2783
    pms = NULL;
    pmslen = 0;
2784 2785 2786 2787 2788 2789 2790 2791 2792 2793

#ifndef OPENSSL_NO_SCTP
    if (SSL_IS_DTLS(s)) {
        unsigned char sctpauthkey[64];
        char labelbuffer[sizeof(DTLS1_SCTP_AUTH_LABEL)];

        /*
         * Add new shared key for SCTP-Auth, will be ignored if no SCTP
         * used.
         */
M
Matt Caswell 已提交
2794 2795
        memcpy(labelbuffer, DTLS1_SCTP_AUTH_LABEL,
               sizeof(DTLS1_SCTP_AUTH_LABEL));
2796 2797

        if (SSL_export_keying_material(s, sctpauthkey,
E
Emilia Kasper 已提交
2798 2799
                                       sizeof(sctpauthkey), labelbuffer,
                                       sizeof(labelbuffer), NULL, 0, 0) <= 0)
2800 2801 2802 2803 2804 2805 2806
            goto err;

        BIO_ctrl(SSL_get_wbio(s), BIO_CTRL_DGRAM_SCTP_ADD_AUTH_KEY,
                 sizeof(sctpauthkey), sctpauthkey);
    }
#endif

2807 2808 2809 2810 2811
    return 1;
 err:
    OPENSSL_clear_free(pms, pmslen);
    s->s3->tmp.pms = NULL;
    return 0;
2812
}
2813

2814
int tls_construct_client_verify(SSL *s, WPACKET *pkt)
2815 2816
{
    EVP_PKEY *pkey;
2817
    const EVP_MD *md = s->s3->tmp.md[s->cert->key - s->cert->pkeys];
2818
    EVP_MD_CTX *mctx = NULL;
2819
    unsigned u = 0;
2820 2821
    long hdatalen = 0;
    void *hdata;
2822 2823
    unsigned char *sig = NULL;

2824
    mctx = EVP_MD_CTX_new();
2825 2826 2827 2828
    if (mctx == NULL) {
        SSLerr(SSL_F_TLS_CONSTRUCT_CLIENT_VERIFY, ERR_R_MALLOC_FAILURE);
        goto err;
    }
2829
    pkey = s->cert->key->privatekey;
2830 2831 2832

    hdatalen = BIO_get_mem_data(s->s3->handshake_buffer, &hdata);
    if (hdatalen <= 0) {
2833 2834 2835
        SSLerr(SSL_F_TLS_CONSTRUCT_CLIENT_VERIFY, ERR_R_INTERNAL_ERROR);
        goto err;
    }
2836

2837
    if (SSL_USE_SIGALGS(s)&& !tls12_get_sigandhash(pkt, pkey, md)) {
2838 2839
        SSLerr(SSL_F_TLS_CONSTRUCT_CLIENT_VERIFY, ERR_R_INTERNAL_ERROR);
        goto err;
2840
    }
2841
#ifdef SSL_DEBUG
2842
    fprintf(stderr, "Using client alg %s\n", EVP_MD_name(md));
2843
#endif
2844 2845 2846 2847 2848
    sig = OPENSSL_malloc(EVP_PKEY_size(pkey));
    if (sig == NULL) {
        SSLerr(SSL_F_TLS_CONSTRUCT_CLIENT_VERIFY, ERR_R_MALLOC_FAILURE);
        goto err;
    }
2849 2850
    if (!EVP_SignInit_ex(mctx, md, NULL)
        || !EVP_SignUpdate(mctx, hdata, hdatalen)
2851
        || (s->version == SSL3_VERSION
2852
            && !EVP_MD_CTX_ctrl(mctx, EVP_CTRL_SSL3_MASTER_SECRET,
2853
                                (int)s->session->master_key_length,
2854
                                s->session->master_key))
2855
        || !EVP_SignFinal(mctx, sig, &u, pkey)) {
2856 2857 2858
        SSLerr(SSL_F_TLS_CONSTRUCT_CLIENT_VERIFY, ERR_R_EVP_LIB);
        goto err;
    }
M
Matt Caswell 已提交
2859
#ifndef OPENSSL_NO_GOST
D
Dr. Stephen Henson 已提交
2860 2861 2862 2863 2864
    {
        int pktype = EVP_PKEY_id(pkey);
        if (pktype == NID_id_GostR3410_2001
            || pktype == NID_id_GostR3410_2012_256
            || pktype == NID_id_GostR3410_2012_512)
2865
            BUF_reverse(sig, NULL, u);
2866
    }
M
Matt Caswell 已提交
2867
#endif
2868

2869
    if (!WPACKET_sub_memcpy_u16(pkt, sig, u)) {
2870 2871 2872 2873
        SSLerr(SSL_F_TLS_CONSTRUCT_CLIENT_VERIFY, ERR_R_INTERNAL_ERROR);
        goto err;
    }

2874 2875 2876
    /* Digest cached records and discard handshake buffer */
    if (!ssl3_digest_cached_records(s, 0))
        goto err;
2877 2878

    OPENSSL_free(sig);
2879
    EVP_MD_CTX_free(mctx);
2880
    return 1;
2881
 err:
2882
    OPENSSL_free(sig);
2883
    EVP_MD_CTX_free(mctx);
2884
    ssl3_send_alert(s, SSL3_AL_FATAL, SSL_AD_INTERNAL_ERROR);
2885
    return 0;
2886 2887 2888 2889 2890 2891
}

/*
 * Check a certificate can be used for client authentication. Currently check
 * cert exists, if we have a suitable digest for TLS 1.2 if static DH client
 * certificates can be used and optionally checks suitability for Suite B.
2892 2893
 */
static int ssl3_check_client_certificate(SSL *s)
2894 2895 2896 2897
{
    if (!s->cert || !s->cert->key->x509 || !s->cert->key->privatekey)
        return 0;
    /* If no suitable signature algorithm can't use certificate */
2898
    if (SSL_USE_SIGALGS(s) && !s->s3->tmp.md[s->cert->key - s->cert->pkeys])
2899 2900 2901 2902 2903 2904 2905 2906 2907 2908
        return 0;
    /*
     * If strict mode check suitability of chain before using it. This also
     * adjusts suite B digest if necessary.
     */
    if (s->cert->cert_flags & SSL_CERT_FLAGS_CHECK_TLS_STRICT &&
        !tls1_check_chain(s, NULL, NULL, NULL, -2))
        return 0;
    return 1;
}
2909

M
Matt Caswell 已提交
2910
WORK_STATE tls_prepare_client_certificate(SSL *s, WORK_STATE wst)
2911 2912 2913 2914 2915
{
    X509 *x509 = NULL;
    EVP_PKEY *pkey = NULL;
    int i;

2916
    if (wst == WORK_MORE_A) {
2917 2918 2919 2920 2921
        /* Let cert callback update client certificates if required */
        if (s->cert->cert_cb) {
            i = s->cert->cert_cb(s, s->cert->cert_cb_arg);
            if (i < 0) {
                s->rwstate = SSL_X509_LOOKUP;
2922
                return WORK_MORE_A;
2923 2924 2925
            }
            if (i == 0) {
                ssl3_send_alert(s, SSL3_AL_FATAL, SSL_AD_INTERNAL_ERROR);
M
Matt Caswell 已提交
2926
                ossl_statem_set_error(s);
2927 2928 2929 2930 2931
                return 0;
            }
            s->rwstate = SSL_NOTHING;
        }
        if (ssl3_check_client_certificate(s))
2932 2933 2934 2935
            return WORK_FINISHED_CONTINUE;

        /* Fall through to WORK_MORE_B */
        wst = WORK_MORE_B;
2936 2937 2938
    }

    /* We need to get a client cert */
2939
    if (wst == WORK_MORE_B) {
2940 2941 2942 2943 2944 2945 2946
        /*
         * If we get an error, we need to ssl->rwstate=SSL_X509_LOOKUP;
         * return(-1); We then get retied later
         */
        i = ssl_do_client_cert_cb(s, &x509, &pkey);
        if (i < 0) {
            s->rwstate = SSL_X509_LOOKUP;
2947
            return WORK_MORE_B;
2948 2949 2950 2951 2952 2953 2954
        }
        s->rwstate = SSL_NOTHING;
        if ((i == 1) && (pkey != NULL) && (x509 != NULL)) {
            if (!SSL_use_certificate(s, x509) || !SSL_use_PrivateKey(s, pkey))
                i = 0;
        } else if (i == 1) {
            i = 0;
2955
            SSLerr(SSL_F_TLS_PREPARE_CLIENT_CERTIFICATE,
2956 2957 2958
                   SSL_R_BAD_DATA_RETURNED_BY_CALLBACK);
        }

R
Rich Salz 已提交
2959
        X509_free(x509);
R
Rich Salz 已提交
2960
        EVP_PKEY_free(pkey);
2961 2962 2963 2964 2965 2966
        if (i && !ssl3_check_client_certificate(s))
            i = 0;
        if (i == 0) {
            if (s->version == SSL3_VERSION) {
                s->s3->tmp.cert_req = 0;
                ssl3_send_alert(s, SSL3_AL_WARNING, SSL_AD_NO_CERTIFICATE);
2967
                return WORK_FINISHED_CONTINUE;
2968 2969
            } else {
                s->s3->tmp.cert_req = 2;
2970
                if (!ssl3_digest_cached_records(s, 0)) {
2971
                    ssl3_send_alert(s, SSL3_AL_FATAL, SSL_AD_INTERNAL_ERROR);
M
Matt Caswell 已提交
2972
                    ossl_statem_set_error(s);
2973 2974
                    return 0;
                }
2975 2976 2977
            }
        }

2978
        return WORK_FINISHED_CONTINUE;
2979 2980
    }

2981 2982 2983 2984
    /* Shouldn't ever get here */
    return WORK_ERROR;
}

2985
int tls_construct_client_certificate(SSL *s, WPACKET *pkt)
2986
{
2987
    if (!ssl3_output_cert_chain(s, pkt,
2988 2989
                               (s->s3->tmp.cert_req == 2) ? NULL
                                                          : s->cert->key)) {
2990 2991 2992
        SSLerr(SSL_F_TLS_CONSTRUCT_CLIENT_CERTIFICATE, ERR_R_INTERNAL_ERROR);
        ssl3_send_alert(s, SSL3_AL_FATAL, SSL_AD_INTERNAL_ERROR);
        return 0;
2993
    }
2994 2995

    return 1;
2996 2997 2998
}

#define has_bits(i,m)   (((i)&(m)) == (m))
2999

B
Ben Laurie 已提交
3000
int ssl3_check_cert_and_algorithm(SSL *s)
3001
{
3002 3003 3004 3005
    int i;
#ifndef OPENSSL_NO_EC
    int idx;
#endif
3006 3007
    long alg_k, alg_a;
    EVP_PKEY *pkey = NULL;
3008
    int al = SSL_AD_HANDSHAKE_FAILURE;
3009

3010 3011
    alg_k = s->s3->tmp.new_cipher->algorithm_mkey;
    alg_a = s->s3->tmp.new_cipher->algorithm_auth;
3012

3013
    /* we don't have a certificate */
3014
    if ((alg_a & SSL_aNULL) || (alg_k & SSL_kPSK))
3015
        return (1);
3016

3017
    /* This is the passed certificate */
3018

3019
#ifndef OPENSSL_NO_EC
3020
    idx = s->session->peer_type;
3021
    if (idx == SSL_PKEY_ECC) {
3022
        if (ssl_check_srvr_ecc_cert_and_alg(s->session->peer, s) == 0) {
3023 3024 3025 3026 3027 3028 3029 3030 3031 3032 3033 3034
            /* check failed */
            SSLerr(SSL_F_SSL3_CHECK_CERT_AND_ALGORITHM, SSL_R_BAD_ECC_CERT);
            goto f_err;
        } else {
            return 1;
        }
    } else if (alg_a & SSL_aECDSA) {
        SSLerr(SSL_F_SSL3_CHECK_CERT_AND_ALGORITHM,
               SSL_R_MISSING_ECDSA_SIGNING_CERT);
        goto f_err;
    }
#endif
3035
    pkey = X509_get0_pubkey(s->session->peer);
3036
    i = X509_certificate_type(s->session->peer, pkey);
3037 3038 3039 3040 3041 3042 3043

    /* Check that we have a certificate if we require one */
    if ((alg_a & SSL_aRSA) && !has_bits(i, EVP_PK_RSA | EVP_PKT_SIGN)) {
        SSLerr(SSL_F_SSL3_CHECK_CERT_AND_ALGORITHM,
               SSL_R_MISSING_RSA_SIGNING_CERT);
        goto f_err;
    }
3044
#ifndef OPENSSL_NO_DSA
3045 3046 3047 3048 3049
    else if ((alg_a & SSL_aDSS) && !has_bits(i, EVP_PK_DSA | EVP_PKT_SIGN)) {
        SSLerr(SSL_F_SSL3_CHECK_CERT_AND_ALGORITHM,
               SSL_R_MISSING_DSA_SIGNING_CERT);
        goto f_err;
    }
3050
#endif
3051
#ifndef OPENSSL_NO_RSA
3052 3053 3054 3055 3056
    if (alg_k & (SSL_kRSA | SSL_kRSAPSK) &&
        !has_bits(i, EVP_PK_RSA | EVP_PKT_ENC)) {
        SSLerr(SSL_F_SSL3_CHECK_CERT_AND_ALGORITHM,
               SSL_R_MISSING_RSA_ENCRYPTING_CERT);
        goto f_err;
3057
    }
3058
#endif
3059
#ifndef OPENSSL_NO_DH
D
Dr. Stephen Henson 已提交
3060
    if ((alg_k & SSL_kDHE) && (s->s3->peer_tmp == NULL)) {
3061 3062
        al = SSL_AD_INTERNAL_ERROR;
        SSLerr(SSL_F_SSL3_CHECK_CERT_AND_ALGORITHM, ERR_R_INTERNAL_ERROR);
3063 3064
        goto f_err;
    }
3065 3066
#endif

3067 3068
    return (1);
 f_err:
3069
    ssl3_send_alert(s, SSL3_AL_FATAL, al);
3070 3071 3072
    return (0);
}

3073
#ifndef OPENSSL_NO_NEXTPROTONEG
3074
int tls_construct_next_proto(SSL *s, WPACKET *pkt)
3075
{
3076 3077 3078
    size_t len, padding_len;
    unsigned char *padding = NULL;

3079 3080
    len = s->next_proto_negotiated_len;
    padding_len = 32 - ((len + 2) % 32);
3081

3082 3083
    if (!WPACKET_sub_memcpy_u8(pkt, s->next_proto_negotiated, len)
            || !WPACKET_sub_allocate_bytes_u8(pkt, padding_len, &padding)) {
3084 3085 3086 3087 3088 3089
        SSLerr(SSL_F_TLS_CONSTRUCT_NEXT_PROTO, ERR_R_INTERNAL_ERROR);
        goto err;
    }

    memset(padding, 0, padding_len);

3090
    return 1;
3091 3092 3093
 err:
    ssl3_send_alert(s, SSL3_AL_FATAL, SSL_AD_INTERNAL_ERROR);
    return 0;
3094
}
3095
#endif
3096

M
Matt Caswell 已提交
3097 3098 3099 3100
static MSG_PROCESS_RETURN tls_process_encrypted_extensions(SSL *s, PACKET *pkt)
{
    int al = SSL_AD_INTERNAL_ERROR;
    PACKET extensions;
M
Matt Caswell 已提交
3101
    RAW_EXTENSION *rawexts = NULL;
M
Matt Caswell 已提交
3102 3103 3104 3105 3106 3107 3108

    if (!PACKET_as_length_prefixed_2(pkt, &extensions)) {
        al = SSL_AD_DECODE_ERROR;
        SSLerr(SSL_F_TLS_PROCESS_ENCRYPTED_EXTENSIONS, SSL_R_LENGTH_MISMATCH);
        goto err;
    }

M
Matt Caswell 已提交
3109 3110 3111 3112 3113 3114 3115
    /*
     * TODO(TLS1.3): For now we are processing Encrypted Extensions and
     * Certificate extensions as part of this one message. Later we need to
     * split out the Certificate extensions into the Certificate message
     */
    if (!tls_collect_extensions(s, &extensions,
                                EXT_TLS1_3_ENCRYPTED_EXTENSIONS
3116 3117
                                    | EXT_TLS1_3_CERTIFICATE,
                                &rawexts, &al)
M
Matt Caswell 已提交
3118 3119
            || !tls_parse_all_extensions(s,
                                         EXT_TLS1_3_ENCRYPTED_EXTENSIONS
3120
                                            | EXT_TLS1_3_CERTIFICATE,
M
Matt Caswell 已提交
3121 3122 3123
                                         rawexts, &al))
        goto err;

M
Matt Caswell 已提交
3124
    OPENSSL_free(rawexts);
M
Matt Caswell 已提交
3125 3126 3127 3128 3129
    return MSG_PROCESS_CONTINUE_READING;

 err:
    ssl3_send_alert(s, SSL3_AL_FATAL, al);
    ossl_statem_set_error(s);
M
Matt Caswell 已提交
3130
    OPENSSL_free(rawexts);
M
Matt Caswell 已提交
3131 3132 3133
    return MSG_PROCESS_ERROR;
}

3134
int ssl_do_client_cert_cb(SSL *s, X509 **px509, EVP_PKEY **ppkey)
3135 3136
{
    int i = 0;
3137
#ifndef OPENSSL_NO_ENGINE
3138 3139 3140 3141 3142 3143 3144 3145 3146 3147 3148 3149
    if (s->ctx->client_cert_engine) {
        i = ENGINE_load_ssl_client_cert(s->ctx->client_cert_engine, s,
                                        SSL_get_client_CA_list(s),
                                        px509, ppkey, NULL, NULL, NULL);
        if (i != 0)
            return i;
    }
#endif
    if (s->ctx->client_cert_cb)
        i = s->ctx->client_cert_cb(s, px509, ppkey);
    return i;
}
M
Matt Caswell 已提交
3150

M
Matt Caswell 已提交
3151
int ssl_cipher_list_to_bytes(SSL *s, STACK_OF(SSL_CIPHER) *sk, WPACKET *pkt)
M
Matt Caswell 已提交
3152
{
3153 3154
    int i;
    size_t totlen = 0, len, maxlen;
M
Matt Caswell 已提交
3155 3156 3157 3158 3159 3160 3161
    int empty_reneg_info_scsv = !s->renegotiate;
    /* Set disabled masks for this session */
    ssl_set_client_disabled(s);

    if (sk == NULL)
        return (0);

3162 3163 3164 3165 3166 3167 3168 3169 3170 3171 3172 3173 3174 3175 3176 3177 3178 3179 3180 3181 3182 3183 3184 3185
#ifdef OPENSSL_MAX_TLS1_2_CIPHER_LENGTH
# if OPENSSL_MAX_TLS1_2_CIPHER_LENGTH < 6
#  error Max cipher length too short
# endif
    /*
     * Some servers hang if client hello > 256 bytes as hack workaround
     * chop number of supported ciphers to keep it well below this if we
     * use TLS v1.2
     */
    if (TLS1_get_version(s) >= TLS1_2_VERSION)
        maxlen = OPENSSL_MAX_TLS1_2_CIPHER_LENGTH & ~1;
    else
#endif
        /* Maximum length that can be stored in 2 bytes. Length must be even */
        maxlen = 0xfffe;

    if (empty_reneg_info_scsv)
        maxlen -= 2;
    if (s->mode & SSL_MODE_SEND_FALLBACK_SCSV)
        maxlen -= 2;

    for (i = 0; i < sk_SSL_CIPHER_num(sk) && totlen < maxlen; i++) {
        const SSL_CIPHER *c;

M
Matt Caswell 已提交
3186 3187 3188 3189
        c = sk_SSL_CIPHER_value(sk, i);
        /* Skip disabled ciphers */
        if (ssl_cipher_disabled(s, c, SSL_SECOP_CIPHER_SUPPORTED))
            continue;
3190 3191 3192 3193 3194 3195 3196

        if (!s->method->put_cipher_by_char(c, pkt, &len)) {
            SSLerr(SSL_F_SSL_CIPHER_LIST_TO_BYTES, ERR_R_INTERNAL_ERROR);
            return 0;
        }

        totlen += len;
M
Matt Caswell 已提交
3197
    }
3198 3199 3200 3201 3202 3203 3204

    if (totlen == 0) {
        SSLerr(SSL_F_SSL_CIPHER_LIST_TO_BYTES, SSL_R_NO_CIPHERS_AVAILABLE);
        return 0;
    }

    if (totlen != 0) {
M
Matt Caswell 已提交
3205 3206 3207 3208
        if (empty_reneg_info_scsv) {
            static SSL_CIPHER scsv = {
                0, NULL, SSL3_CK_SCSV, 0, 0, 0, 0, 0, 0, 0, 0, 0
            };
3209 3210 3211 3212
            if (!s->method->put_cipher_by_char(&scsv, pkt, &len)) {
                SSLerr(SSL_F_SSL_CIPHER_LIST_TO_BYTES, ERR_R_INTERNAL_ERROR);
                return 0;
            }
M
Matt Caswell 已提交
3213 3214 3215 3216 3217
        }
        if (s->mode & SSL_MODE_SEND_FALLBACK_SCSV) {
            static SSL_CIPHER scsv = {
                0, NULL, SSL3_CK_FALLBACK_SCSV, 0, 0, 0, 0, 0, 0, 0, 0, 0
            };
3218 3219 3220 3221
            if (!s->method->put_cipher_by_char(&scsv, pkt, &len)) {
                SSLerr(SSL_F_SSL_CIPHER_LIST_TO_BYTES, ERR_R_INTERNAL_ERROR);
                return 0;
            }
M
Matt Caswell 已提交
3222 3223 3224
        }
    }

3225
    return 1;
M
Matt Caswell 已提交
3226
}