2 /* Copyright (C) 1995-1998 Eric Young (eay@cryptsoft.com)
5 * This package is an SSL implementation written
6 * by Eric Young (eay@cryptsoft.com).
7 * The implementation was written so as to conform with Netscapes SSL.
9 * This library is free for commercial and non-commercial use as long as
10 * the following conditions are aheared to. The following conditions
11 * apply to all code found in this distribution, be it the RC4, RSA,
12 * lhash, DES, etc., code; not just the SSL code. The SSL documentation
13 * included with this distribution is covered by the same copyright terms
14 * except that the holder is Tim Hudson (tjh@cryptsoft.com).
16 * Copyright remains Eric Young's, and as such any Copyright notices in
17 * the code are not to be removed.
18 * If this package is used in a product, Eric Young should be given attribution
19 * as the author of the parts of the library used.
20 * This can be in the form of a textual message at program startup or
21 * in documentation (online or textual) provided with the package.
23 * Redistribution and use in source and binary forms, with or without
24 * modification, are permitted provided that the following conditions
26 * 1. Redistributions of source code must retain the copyright
27 * notice, this list of conditions and the following disclaimer.
28 * 2. Redistributions in binary form must reproduce the above copyright
29 * notice, this list of conditions and the following disclaimer in the
30 * documentation and/or other materials provided with the distribution.
31 * 3. All advertising materials mentioning features or use of this software
32 * must display the following acknowledgement:
33 * "This product includes cryptographic software written by
34 * Eric Young (eay@cryptsoft.com)"
35 * The word 'cryptographic' can be left out if the rouines from the library
36 * being used are not cryptographic related :-).
37 * 4. If you include any Windows specific code (or a derivative thereof) from
38 * the apps directory (application code) you must include an acknowledgement:
39 * "This product includes software written by Tim Hudson (tjh@cryptsoft.com)"
41 * THIS SOFTWARE IS PROVIDED BY ERIC YOUNG ``AS IS'' AND
42 * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
43 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
44 * ARE DISCLAIMED. IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE
45 * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
46 * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
47 * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
48 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
49 * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
50 * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
53 * The licence and distribution terms for any publically available version or
54 * derivative of this code cannot be changed. i.e. this code cannot simply be
55 * copied and put under another distribution licence
56 * [including the GNU Public Licence.]
60 #include <openssl/objects.h>
61 #include <openssl/evp.h>
62 #include <openssl/hmac.h>
65 const char tls1_version_str
[]="TLSv1" OPENSSL_VERSION_PTEXT
;
67 #ifndef OPENSSL_NO_TLSEXT
68 static int tls_decrypt_ticket(SSL
*s
, const unsigned char *tick
, int ticklen
,
69 const unsigned char *sess_id
, int sesslen
,
73 SSL3_ENC_METHOD TLSv1_enc_data
={
77 tls1_generate_master_secret
,
78 tls1_change_cipher_state
,
79 tls1_final_finish_mac
,
80 TLS1_FINISH_MAC_LENGTH
,
82 TLS_MD_CLIENT_FINISH_CONST
,TLS_MD_CLIENT_FINISH_CONST_SIZE
,
83 TLS_MD_SERVER_FINISH_CONST
,TLS_MD_SERVER_FINISH_CONST_SIZE
,
87 long tls1_default_timeout(void)
89 /* 2 hours, the 24 hours mentioned in the TLSv1 spec
90 * is way too long for http, the cache would over fill */
94 IMPLEMENT_tls1_meth_func(tlsv1_base_method
,
95 ssl_undefined_function
,
96 ssl_undefined_function
,
101 if (!ssl3_new(s
)) return(0);
102 s
->method
->ssl_clear(s
);
106 void tls1_free(SSL
*s
)
111 void tls1_clear(SSL
*s
)
114 s
->version
=TLS1_VERSION
;
118 long tls1_ctrl(SSL
*s
, int cmd
, long larg
, char *parg
)
123 long tls1_callback_ctrl(SSL
*s
, int cmd
, void *(*fp
)())
129 #ifndef OPENSSL_NO_TLSEXT
130 unsigned char *ssl_add_clienthello_tlsext(SSL
*s
, unsigned char *p
, unsigned char *limit
)
133 unsigned char *ret
= p
;
137 if (ret
>=limit
) return NULL
; /* this really never occurs, but ... */
139 if (s
->tlsext_hostname
!= NULL
)
141 /* Add TLS extension servername to the Client Hello message */
142 unsigned long size_str
;
145 /* check for enough space.
146 4 for the servername type and entension length
147 2 for servernamelist length
148 1 for the hostname type
149 2 for hostname length
153 if ((lenmax
= limit
- ret
- 9) < 0
154 || (size_str
= strlen(s
->tlsext_hostname
)) > (unsigned long)lenmax
)
157 /* extension type and length */
158 s2n(TLSEXT_TYPE_server_name
,ret
);
161 /* length of servername list */
164 /* hostname type, length and hostname */
165 *(ret
++) = (unsigned char) TLSEXT_NAMETYPE_host_name
;
167 memcpy(ret
, s
->tlsext_hostname
, size_str
);
172 if (!(SSL_get_options(s
) & SSL_OP_NO_TICKET
))
175 if (s
->session
&& s
->session
->tlsext_tick
)
176 ticklen
= s
->session
->tlsext_ticklen
;
179 /* Check for enough room 2 for extension type, 2 for len
182 if (limit
- ret
- 4 - ticklen
< 0)
184 s2n(TLSEXT_TYPE_session_ticket
,ret
);
188 memcpy(ret
, s
->session
->tlsext_tick
, ticklen
);
193 if ((extdatalen
= ret
-p
-2)== 0)
200 unsigned char *ssl_add_serverhello_tlsext(SSL
*s
, unsigned char *p
, unsigned char *limit
)
203 unsigned char *ret
= p
;
206 if (ret
>=limit
) return NULL
; /* this really never occurs, but ... */
208 if (!s
->hit
&& s
->servername_done
== 1 && s
->session
->tlsext_hostname
!= NULL
)
210 if (limit
- ret
- 4 < 0) return NULL
;
212 s2n(TLSEXT_TYPE_server_name
,ret
);
216 if (s
->tlsext_ticket_expected
217 && !(SSL_get_options(s
) & SSL_OP_NO_TICKET
))
219 if (limit
- ret
- 4 < 0) return NULL
;
220 s2n(TLSEXT_TYPE_session_ticket
,ret
);
224 if ((extdatalen
= ret
-p
-2)== 0)
231 int ssl_parse_clienthello_tlsext(SSL
*s
, unsigned char **p
, unsigned char *d
, int n
, int *al
)
236 unsigned char *data
= *p
;
237 s
->servername_done
= 0;
243 if (data
> (d
+n
-len
))
246 while (data
<= (d
+n
-4))
251 if (data
+size
> (d
+n
))
254 if (s
->tlsext_debug_cb
)
255 s
->tlsext_debug_cb(s
, 0, type
, data
, size
,
256 s
->tlsext_debug_arg
);
257 /* The servername extension is treated as follows:
259 - Only the hostname type is supported with a maximum length of 255.
260 - The servername is rejected if too long or if it contains zeros,
261 in which case an fatal alert is generated.
262 - The servername field is maintained together with the session cache.
263 - When a session is resumed, the servername call back invoked in order
264 to allow the application to position itself to the right context.
265 - The servername is acknowledged if it is new for a session or when
266 it is identical to a previously used for the same session.
267 Applications can control the behaviour. They can at any time
268 set a 'desirable' servername for a new SSL object. This can be the
269 case for example with HTTPS when a Host: header field is received and
270 a renegotiation is requested. In this case, a possible servername
271 presented in the new client hello is only acknowledged if it matches
272 the value of the Host: field.
273 - Applications must use SSL_OP_NO_SESSION_RESUMPTION_ON_RENEGOTIATION
274 if they provide for changing an explicit servername context for the session,
275 i.e. when the session has been established with a servername extension.
276 - On session reconnect, the servername extension may be absent.
280 if (type
== TLSEXT_TYPE_server_name
)
282 unsigned char *sdata
;
288 *al
= SSL_AD_DECODE_ERROR
;
295 *al
= SSL_AD_DECODE_ERROR
;
302 servname_type
= *(sdata
++);
308 *al
= SSL_AD_DECODE_ERROR
;
311 if (s
->servername_done
== 0)
312 switch (servname_type
)
314 case TLSEXT_NAMETYPE_host_name
:
315 if (s
->session
->tlsext_hostname
== NULL
)
317 if (len
> TLSEXT_MAXLEN_host_name
||
318 ((s
->session
->tlsext_hostname
= OPENSSL_malloc(len
+1)) == NULL
))
320 *al
= TLS1_AD_UNRECOGNIZED_NAME
;
323 memcpy(s
->session
->tlsext_hostname
, sdata
, len
);
324 s
->session
->tlsext_hostname
[len
]='\0';
325 if (strlen(s
->session
->tlsext_hostname
) != len
) {
326 OPENSSL_free(s
->session
->tlsext_hostname
);
327 *al
= TLS1_AD_UNRECOGNIZED_NAME
;
330 s
->servername_done
= 1;
334 s
->servername_done
= strlen(s
->session
->tlsext_hostname
) == len
335 && strncmp(s
->session
->tlsext_hostname
, (char *)sdata
, len
) == 0;
347 *al
= SSL_AD_DECODE_ERROR
;
352 /* session ticket processed earlier */
361 int ssl_parse_serverhello_tlsext(SSL
*s
, unsigned char **p
, unsigned char *d
, int n
, int *al
)
366 unsigned char *data
= *p
;
368 int tlsext_servername
= 0;
375 while(data
<= (d
+n
-4))
380 if (data
+size
> (d
+n
))
383 if (s
->tlsext_debug_cb
)
384 s
->tlsext_debug_cb(s
, 1, type
, data
, size
,
385 s
->tlsext_debug_arg
);
387 if (type
== TLSEXT_TYPE_server_name
)
389 if (s
->tlsext_hostname
== NULL
|| size
> 0)
391 *al
= TLS1_AD_UNRECOGNIZED_NAME
;
394 tlsext_servername
= 1;
396 else if (type
== TLSEXT_TYPE_session_ticket
)
398 if ((SSL_get_options(s
) & SSL_OP_NO_TICKET
)
401 *al
= TLS1_AD_UNSUPPORTED_EXTENSION
;
404 s
->tlsext_ticket_expected
= 1;
412 *al
= SSL_AD_DECODE_ERROR
;
416 if (!s
->hit
&& tlsext_servername
== 1)
418 if (s
->tlsext_hostname
)
420 if (s
->session
->tlsext_hostname
== NULL
)
422 s
->session
->tlsext_hostname
= BUF_strdup(s
->tlsext_hostname
);
423 if (!s
->session
->tlsext_hostname
)
425 *al
= SSL_AD_UNRECOGNIZED_NAME
;
431 *al
= SSL_AD_DECODE_ERROR
;
441 int ssl_check_clienthello_tlsext(SSL
*s
)
443 int ret
=SSL_TLSEXT_ERR_NOACK
;
444 int al
= SSL_AD_UNRECOGNIZED_NAME
;
446 if (s
->ctx
!= NULL
&& s
->ctx
->tlsext_servername_callback
!= 0)
447 ret
= s
->ctx
->tlsext_servername_callback(s
, &al
, s
->ctx
->tlsext_servername_arg
);
448 else if (s
->initial_ctx
!= NULL
&& s
->initial_ctx
->tlsext_servername_callback
!= 0)
449 ret
= s
->initial_ctx
->tlsext_servername_callback(s
, &al
, s
->initial_ctx
->tlsext_servername_arg
);
453 case SSL_TLSEXT_ERR_ALERT_FATAL
:
454 ssl3_send_alert(s
,SSL3_AL_FATAL
,al
);
457 case SSL_TLSEXT_ERR_ALERT_WARNING
:
458 ssl3_send_alert(s
,SSL3_AL_WARNING
,al
);
461 case SSL_TLSEXT_ERR_NOACK
:
462 s
->servername_done
=0;
468 int ssl_check_serverhello_tlsext(SSL
*s
)
470 int ret
=SSL_TLSEXT_ERR_NOACK
;
471 int al
= SSL_AD_UNRECOGNIZED_NAME
;
473 if (s
->ctx
!= NULL
&& s
->ctx
->tlsext_servername_callback
!= 0)
474 ret
= s
->ctx
->tlsext_servername_callback(s
, &al
, s
->ctx
->tlsext_servername_arg
);
475 else if (s
->initial_ctx
!= NULL
&& s
->initial_ctx
->tlsext_servername_callback
!= 0)
476 ret
= s
->initial_ctx
->tlsext_servername_callback(s
, &al
, s
->initial_ctx
->tlsext_servername_arg
);
480 case SSL_TLSEXT_ERR_ALERT_FATAL
:
481 ssl3_send_alert(s
,SSL3_AL_FATAL
,al
);
484 case SSL_TLSEXT_ERR_ALERT_WARNING
:
485 ssl3_send_alert(s
,SSL3_AL_WARNING
,al
);
488 case SSL_TLSEXT_ERR_NOACK
:
489 s
->servername_done
=0;
495 /* Since the server cache lookup is done early on in the processing of client
496 * hello and other operations depend on the result we need to handle any TLS
497 * session ticket extension at the same time.
500 int tls1_process_ticket(SSL
*s
, unsigned char *session_id
, int len
,
501 const unsigned char *limit
, SSL_SESSION
**ret
)
503 /* Point after session ID in client hello */
504 const unsigned char *p
= session_id
+ len
;
506 if ((s
->version
<= SSL3_VERSION
) || !limit
)
510 /* Skip past cipher list */
515 /* Skip past compression algorithm list */
520 /* Now at start of extensions */
521 if ((p
+ 2) >= limit
)
524 while ((p
+ 4) <= limit
)
526 unsigned short type
, size
;
529 if (p
+ size
> limit
)
531 if (type
== TLSEXT_TYPE_session_ticket
)
533 /* If tickets disabled indicate cache miss which will
534 * trigger a full handshake
536 if (SSL_get_options(s
) & SSL_OP_NO_TICKET
)
538 /* If zero length not client will accept a ticket
539 * and indicate cache miss to trigger full handshake
543 s
->tlsext_ticket_expected
= 1;
544 return 0; /* Cache miss */
546 return tls_decrypt_ticket(s
, p
, size
, session_id
, len
,
554 static int tls_decrypt_ticket(SSL
*s
, const unsigned char *etick
, int eticklen
,
555 const unsigned char *sess_id
, int sesslen
,
560 const unsigned char *p
;
562 unsigned char tick_hmac
[EVP_MAX_MD_SIZE
];
565 /* Attempt to process session ticket, first conduct sanity and
566 * integrity checks on ticket.
568 mlen
= EVP_MD_size(tlsext_tick_md());
570 /* Need at least keyname + iv + some encrypted data */
573 /* Check key name matches */
574 if (memcmp(etick
, s
->ctx
->tlsext_tick_key_name
, 16))
576 /* Check HMAC of encrypted ticket */
577 HMAC_CTX_init(&hctx
);
578 HMAC_Init_ex(&hctx
, s
->ctx
->tlsext_tick_hmac_key
, 16,
579 tlsext_tick_md(), NULL
);
580 HMAC_Update(&hctx
, etick
, eticklen
);
581 HMAC_Final(&hctx
, tick_hmac
, NULL
);
582 HMAC_CTX_cleanup(&hctx
);
583 if (memcmp(tick_hmac
, etick
+ eticklen
, mlen
))
585 /* Set p to start of IV */
587 EVP_CIPHER_CTX_init(&ctx
);
588 /* Attempt to decrypt session data */
589 EVP_DecryptInit_ex(&ctx
, EVP_aes_128_cbc(), NULL
,
590 s
->ctx
->tlsext_tick_aes_key
, p
);
591 /* Move p after IV to start of encrypted ticket, update length */
594 sdec
= OPENSSL_malloc(eticklen
);
597 EVP_CIPHER_CTX_cleanup(&ctx
);
600 EVP_DecryptUpdate(&ctx
, sdec
, &slen
, p
, eticklen
);
601 if (EVP_DecryptFinal(&ctx
, sdec
+ slen
, &mlen
) <= 0)
604 EVP_CIPHER_CTX_cleanup(&ctx
);
607 sess
= d2i_SSL_SESSION(NULL
, &p
, slen
);
611 /* The session ID if non-empty is used by some clients to
612 * detect that the ticket has been accepted. So we copy it to
613 * the session structure. If it is empty set length to zero
614 * as required by standard.
617 memcpy(sess
->session_id
, sess_id
, sesslen
);
618 sess
->session_id_length
= sesslen
;
620 s
->tlsext_ticket_expected
= 0;
623 /* If session decrypt failure indicate a cache miss and set state to
627 s
->tlsext_ticket_expected
= 1;