2 /* Copyright (C) 1995-1998 Eric Young (eay@cryptsoft.com)
5 * This package is an SSL implementation written
6 * by Eric Young (eay@cryptsoft.com).
7 * The implementation was written so as to conform with Netscapes SSL.
9 * This library is free for commercial and non-commercial use as long as
10 * the following conditions are aheared to. The following conditions
11 * apply to all code found in this distribution, be it the RC4, RSA,
12 * lhash, DES, etc., code; not just the SSL code. The SSL documentation
13 * included with this distribution is covered by the same copyright terms
14 * except that the holder is Tim Hudson (tjh@cryptsoft.com).
16 * Copyright remains Eric Young's, and as such any Copyright notices in
17 * the code are not to be removed.
18 * If this package is used in a product, Eric Young should be given attribution
19 * as the author of the parts of the library used.
20 * This can be in the form of a textual message at program startup or
21 * in documentation (online or textual) provided with the package.
23 * Redistribution and use in source and binary forms, with or without
24 * modification, are permitted provided that the following conditions
26 * 1. Redistributions of source code must retain the copyright
27 * notice, this list of conditions and the following disclaimer.
28 * 2. Redistributions in binary form must reproduce the above copyright
29 * notice, this list of conditions and the following disclaimer in the
30 * documentation and/or other materials provided with the distribution.
31 * 3. All advertising materials mentioning features or use of this software
32 * must display the following acknowledgement:
33 * "This product includes cryptographic software written by
34 * Eric Young (eay@cryptsoft.com)"
35 * The word 'cryptographic' can be left out if the rouines from the library
36 * being used are not cryptographic related :-).
37 * 4. If you include any Windows specific code (or a derivative thereof) from
38 * the apps directory (application code) you must include an acknowledgement:
39 * "This product includes software written by Tim Hudson (tjh@cryptsoft.com)"
41 * THIS SOFTWARE IS PROVIDED BY ERIC YOUNG ``AS IS'' AND
42 * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
43 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
44 * ARE DISCLAIMED. IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE
45 * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
46 * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
47 * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
48 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
49 * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
50 * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
53 * The licence and distribution terms for any publically available version or
54 * derivative of this code cannot be changed. i.e. this code cannot simply be
55 * copied and put under another distribution licence
56 * [including the GNU Public Licence.]
60 #include <openssl/objects.h>
61 #include <openssl/evp.h>
62 #include <openssl/hmac.h>
63 #include <openssl/ocsp.h>
66 const char tls1_version_str
[]="TLSv1" OPENSSL_VERSION_PTEXT
;
68 #ifndef OPENSSL_NO_TLSEXT
69 static int tls_decrypt_ticket(SSL
*s
, const unsigned char *tick
, int ticklen
,
70 const unsigned char *sess_id
, int sesslen
,
74 SSL3_ENC_METHOD TLSv1_enc_data
={
78 tls1_generate_master_secret
,
79 tls1_change_cipher_state
,
80 tls1_final_finish_mac
,
81 TLS1_FINISH_MAC_LENGTH
,
83 TLS_MD_CLIENT_FINISH_CONST
,TLS_MD_CLIENT_FINISH_CONST_SIZE
,
84 TLS_MD_SERVER_FINISH_CONST
,TLS_MD_SERVER_FINISH_CONST_SIZE
,
88 long tls1_default_timeout(void)
90 /* 2 hours, the 24 hours mentioned in the TLSv1 spec
91 * is way too long for http, the cache would over fill */
95 IMPLEMENT_tls1_meth_func(tlsv1_base_method
,
96 ssl_undefined_function
,
97 ssl_undefined_function
,
102 if (!ssl3_new(s
)) return(0);
103 s
->method
->ssl_clear(s
);
107 void tls1_free(SSL
*s
)
112 void tls1_clear(SSL
*s
)
115 s
->version
=TLS1_VERSION
;
119 long tls1_ctrl(SSL
*s
, int cmd
, long larg
, char *parg
)
124 long tls1_callback_ctrl(SSL
*s
, int cmd
, void *(*fp
)())
130 #ifndef OPENSSL_NO_TLSEXT
131 unsigned char *ssl_add_clienthello_tlsext(SSL
*s
, unsigned char *p
, unsigned char *limit
)
134 unsigned char *ret
= p
;
138 if (ret
>=limit
) return NULL
; /* this really never occurs, but ... */
140 if (s
->tlsext_hostname
!= NULL
)
142 /* Add TLS extension servername to the Client Hello message */
143 unsigned long size_str
;
146 /* check for enough space.
147 4 for the servername type and entension length
148 2 for servernamelist length
149 1 for the hostname type
150 2 for hostname length
154 if ((lenmax
= limit
- ret
- 9) < 0
155 || (size_str
= strlen(s
->tlsext_hostname
)) > (unsigned long)lenmax
)
158 /* extension type and length */
159 s2n(TLSEXT_TYPE_server_name
,ret
);
162 /* length of servername list */
165 /* hostname type, length and hostname */
166 *(ret
++) = (unsigned char) TLSEXT_NAMETYPE_host_name
;
168 memcpy(ret
, s
->tlsext_hostname
, size_str
);
173 if (!(SSL_get_options(s
) & SSL_OP_NO_TICKET
))
176 if (s
->session
&& s
->session
->tlsext_tick
)
177 ticklen
= s
->session
->tlsext_ticklen
;
180 /* Check for enough room 2 for extension type, 2 for len
183 if (limit
- ret
- 4 - ticklen
< 0)
185 s2n(TLSEXT_TYPE_session_ticket
,ret
);
189 memcpy(ret
, s
->session
->tlsext_tick
, ticklen
);
194 if (s
->tlsext_status_type
== TLSEXT_STATUSTYPE_ocsp
)
197 long extlen
, idlen
, itmp
;
201 for (i
= 0; i
< sk_OCSP_RESPID_num(s
->tlsext_ocsp_ids
); i
++)
203 id
= sk_OCSP_RESPID_value(s
->tlsext_ocsp_ids
, i
);
204 itmp
= i2d_OCSP_RESPID(id
, NULL
);
210 if (s
->tlsext_ocsp_exts
)
212 extlen
= i2d_X509_EXTENSIONS(s
->tlsext_ocsp_exts
, NULL
);
219 if ((long)(limit
- ret
- 7 - extlen
- idlen
) < 0) return NULL
;
220 s2n(TLSEXT_TYPE_status_request
, ret
);
221 if (extlen
+ idlen
> 0xFFF0)
223 s2n(extlen
+ idlen
+ 5, ret
);
224 *(ret
++) = TLSEXT_STATUSTYPE_ocsp
;
226 for (i
= 0; i
< sk_OCSP_RESPID_num(s
->tlsext_ocsp_ids
); i
++)
228 /* save position of id len */
229 unsigned char *q
= ret
;
230 id
= sk_OCSP_RESPID_value(s
->tlsext_ocsp_ids
, i
);
231 /* skip over id len */
233 itmp
= i2d_OCSP_RESPID(id
, &ret
);
239 i2d_X509_EXTENSIONS(s
->tlsext_ocsp_exts
, &ret
);
242 if ((extdatalen
= ret
-p
-2)== 0)
249 unsigned char *ssl_add_serverhello_tlsext(SSL
*s
, unsigned char *p
, unsigned char *limit
)
252 unsigned char *ret
= p
;
255 if (ret
>=limit
) return NULL
; /* this really never occurs, but ... */
257 if (!s
->hit
&& s
->servername_done
== 1 && s
->session
->tlsext_hostname
!= NULL
)
259 if (limit
- ret
- 4 < 0) return NULL
;
261 s2n(TLSEXT_TYPE_server_name
,ret
);
265 if (s
->tlsext_ticket_expected
266 && !(SSL_get_options(s
) & SSL_OP_NO_TICKET
))
268 if (limit
- ret
- 4 < 0) return NULL
;
269 s2n(TLSEXT_TYPE_session_ticket
,ret
);
273 if (s
->tlsext_status_expected
)
275 if ((long)(limit
- ret
- 4) < 0) return NULL
;
276 s2n(TLSEXT_TYPE_status_request
,ret
);
280 if ((extdatalen
= ret
-p
-2)== 0)
287 int ssl_parse_clienthello_tlsext(SSL
*s
, unsigned char **p
, unsigned char *d
, int n
, int *al
)
292 unsigned char *data
= *p
;
293 s
->servername_done
= 0;
294 s
->tlsext_status_type
= -1;
300 if (data
> (d
+n
-len
))
303 while (data
<= (d
+n
-4))
308 if (data
+size
> (d
+n
))
311 if (s
->tlsext_debug_cb
)
312 s
->tlsext_debug_cb(s
, 0, type
, data
, size
,
313 s
->tlsext_debug_arg
);
314 /* The servername extension is treated as follows:
316 - Only the hostname type is supported with a maximum length of 255.
317 - The servername is rejected if too long or if it contains zeros,
318 in which case an fatal alert is generated.
319 - The servername field is maintained together with the session cache.
320 - When a session is resumed, the servername call back invoked in order
321 to allow the application to position itself to the right context.
322 - The servername is acknowledged if it is new for a session or when
323 it is identical to a previously used for the same session.
324 Applications can control the behaviour. They can at any time
325 set a 'desirable' servername for a new SSL object. This can be the
326 case for example with HTTPS when a Host: header field is received and
327 a renegotiation is requested. In this case, a possible servername
328 presented in the new client hello is only acknowledged if it matches
329 the value of the Host: field.
330 - Applications must use SSL_OP_NO_SESSION_RESUMPTION_ON_RENEGOTIATION
331 if they provide for changing an explicit servername context for the session,
332 i.e. when the session has been established with a servername extension.
333 - On session reconnect, the servername extension may be absent.
337 if (type
== TLSEXT_TYPE_server_name
)
339 unsigned char *sdata
;
345 *al
= SSL_AD_DECODE_ERROR
;
352 *al
= SSL_AD_DECODE_ERROR
;
359 servname_type
= *(sdata
++);
365 *al
= SSL_AD_DECODE_ERROR
;
368 if (s
->servername_done
== 0)
369 switch (servname_type
)
371 case TLSEXT_NAMETYPE_host_name
:
372 if (s
->session
->tlsext_hostname
== NULL
)
374 if (len
> TLSEXT_MAXLEN_host_name
||
375 ((s
->session
->tlsext_hostname
= OPENSSL_malloc(len
+1)) == NULL
))
377 *al
= TLS1_AD_UNRECOGNIZED_NAME
;
380 memcpy(s
->session
->tlsext_hostname
, sdata
, len
);
381 s
->session
->tlsext_hostname
[len
]='\0';
382 if (strlen(s
->session
->tlsext_hostname
) != len
) {
383 OPENSSL_free(s
->session
->tlsext_hostname
);
384 s
->session
->tlsext_hostname
= NULL
;
385 *al
= TLS1_AD_UNRECOGNIZED_NAME
;
388 s
->servername_done
= 1;
392 s
->servername_done
= strlen(s
->session
->tlsext_hostname
) == len
393 && strncmp(s
->session
->tlsext_hostname
, (char *)sdata
, len
) == 0;
405 *al
= SSL_AD_DECODE_ERROR
;
410 else if (type
== TLSEXT_TYPE_status_request
411 && s
->ctx
->tlsext_status_cb
)
416 *al
= SSL_AD_DECODE_ERROR
;
420 s
->tlsext_status_type
= *data
++;
422 if (s
->tlsext_status_type
== TLSEXT_STATUSTYPE_ocsp
)
424 const unsigned char *sdata
;
426 /* Read in responder_id_list */
431 *al
= SSL_AD_DECODE_ERROR
;
440 *al
= SSL_AD_DECODE_ERROR
;
447 *al
= SSL_AD_DECODE_ERROR
;
452 id
= d2i_OCSP_RESPID(NULL
,
456 *al
= SSL_AD_DECODE_ERROR
;
461 OCSP_RESPID_free(id
);
462 *al
= SSL_AD_DECODE_ERROR
;
465 if (!s
->tlsext_ocsp_ids
466 && !(s
->tlsext_ocsp_ids
=
467 sk_OCSP_RESPID_new_null()))
469 OCSP_RESPID_free(id
);
470 *al
= SSL_AD_INTERNAL_ERROR
;
473 if (!sk_OCSP_RESPID_push(
474 s
->tlsext_ocsp_ids
, id
))
476 OCSP_RESPID_free(id
);
477 *al
= SSL_AD_INTERNAL_ERROR
;
482 /* Read in request_extensions */
487 *al
= SSL_AD_DECODE_ERROR
;
493 s
->tlsext_ocsp_exts
=
494 d2i_X509_EXTENSIONS(NULL
,
496 if (!s
->tlsext_ocsp_exts
497 || (data
+ dsize
!= sdata
))
499 *al
= SSL_AD_DECODE_ERROR
;
504 /* We don't know what to do with any other type
508 s
->tlsext_status_type
= -1;
510 /* session ticket processed earlier */
519 int ssl_parse_serverhello_tlsext(SSL
*s
, unsigned char **p
, unsigned char *d
, int n
, int *al
)
524 unsigned char *data
= *p
;
526 int tlsext_servername
= 0;
533 while(data
<= (d
+n
-4))
538 if (data
+size
> (d
+n
))
541 if (s
->tlsext_debug_cb
)
542 s
->tlsext_debug_cb(s
, 1, type
, data
, size
,
543 s
->tlsext_debug_arg
);
545 if (type
== TLSEXT_TYPE_server_name
)
547 if (s
->tlsext_hostname
== NULL
|| size
> 0)
549 *al
= TLS1_AD_UNRECOGNIZED_NAME
;
552 tlsext_servername
= 1;
554 else if (type
== TLSEXT_TYPE_session_ticket
)
556 if ((SSL_get_options(s
) & SSL_OP_NO_TICKET
)
559 *al
= TLS1_AD_UNSUPPORTED_EXTENSION
;
562 s
->tlsext_ticket_expected
= 1;
564 else if (type
== TLSEXT_TYPE_status_request
)
566 /* MUST be empty and only sent if we've requested
567 * a status request message.
569 if ((s
->tlsext_status_type
== -1) || (size
> 0))
571 *al
= TLS1_AD_UNSUPPORTED_EXTENSION
;
574 /* Set flag to expect CertificateStatus message */
575 s
->tlsext_status_expected
= 1;
583 *al
= SSL_AD_DECODE_ERROR
;
587 if (!s
->hit
&& tlsext_servername
== 1)
589 if (s
->tlsext_hostname
)
591 if (s
->session
->tlsext_hostname
== NULL
)
593 s
->session
->tlsext_hostname
= BUF_strdup(s
->tlsext_hostname
);
594 if (!s
->session
->tlsext_hostname
)
596 *al
= SSL_AD_UNRECOGNIZED_NAME
;
602 *al
= SSL_AD_DECODE_ERROR
;
612 int ssl_check_clienthello_tlsext(SSL
*s
)
614 int ret
=SSL_TLSEXT_ERR_NOACK
;
615 int al
= SSL_AD_UNRECOGNIZED_NAME
;
617 if (s
->ctx
!= NULL
&& s
->ctx
->tlsext_servername_callback
!= 0)
618 ret
= s
->ctx
->tlsext_servername_callback(s
, &al
, s
->ctx
->tlsext_servername_arg
);
619 else if (s
->initial_ctx
!= NULL
&& s
->initial_ctx
->tlsext_servername_callback
!= 0)
620 ret
= s
->initial_ctx
->tlsext_servername_callback(s
, &al
, s
->initial_ctx
->tlsext_servername_arg
);
622 /* If status request then ask callback what to do.
623 * Note: this must be called after servername callbacks in case
624 * the certificate has changed.
626 if ((s
->tlsext_status_type
!= -1) && s
->ctx
->tlsext_status_cb
)
629 r
= s
->ctx
->tlsext_status_cb(s
, s
->ctx
->tlsext_status_arg
);
632 /* We don't want to send a status request response */
633 case SSL_TLSEXT_ERR_NOACK
:
634 s
->tlsext_status_expected
= 0;
636 /* status request response should be sent */
637 case SSL_TLSEXT_ERR_OK
:
638 if (s
->tlsext_ocsp_resp
)
639 s
->tlsext_status_expected
= 1;
641 s
->tlsext_status_expected
= 0;
643 /* something bad happened */
644 case SSL_TLSEXT_ERR_ALERT_FATAL
:
645 ret
= SSL_TLSEXT_ERR_ALERT_FATAL
;
646 al
= SSL_AD_INTERNAL_ERROR
;
651 s
->tlsext_status_expected
= 0;
655 case SSL_TLSEXT_ERR_ALERT_FATAL
:
656 ssl3_send_alert(s
,SSL3_AL_FATAL
,al
);
659 case SSL_TLSEXT_ERR_ALERT_WARNING
:
660 ssl3_send_alert(s
,SSL3_AL_WARNING
,al
);
663 case SSL_TLSEXT_ERR_NOACK
:
664 s
->servername_done
=0;
670 int ssl_check_serverhello_tlsext(SSL
*s
)
672 int ret
=SSL_TLSEXT_ERR_NOACK
;
673 int al
= SSL_AD_UNRECOGNIZED_NAME
;
675 if (s
->ctx
!= NULL
&& s
->ctx
->tlsext_servername_callback
!= 0)
676 ret
= s
->ctx
->tlsext_servername_callback(s
, &al
, s
->ctx
->tlsext_servername_arg
);
677 else if (s
->initial_ctx
!= NULL
&& s
->initial_ctx
->tlsext_servername_callback
!= 0)
678 ret
= s
->initial_ctx
->tlsext_servername_callback(s
, &al
, s
->initial_ctx
->tlsext_servername_arg
);
680 /* If we've requested certificate status and we wont get one
683 if ((s
->tlsext_status_type
!= -1) && !(s
->tlsext_status_expected
)
684 && s
->ctx
->tlsext_status_cb
)
687 /* Set resp to NULL, resplen to -1 so callback knows
688 * there is no response.
690 if (s
->tlsext_ocsp_resp
)
692 OPENSSL_free(s
->tlsext_ocsp_resp
);
693 s
->tlsext_ocsp_resp
= NULL
;
695 s
->tlsext_ocsp_resplen
= -1;
696 r
= s
->ctx
->tlsext_status_cb(s
, s
->ctx
->tlsext_status_arg
);
699 al
= SSL_AD_BAD_CERTIFICATE_STATUS_RESPONSE
;
700 ret
= SSL_TLSEXT_ERR_ALERT_FATAL
;
704 al
= SSL_AD_INTERNAL_ERROR
;
705 ret
= SSL_TLSEXT_ERR_ALERT_FATAL
;
711 case SSL_TLSEXT_ERR_ALERT_FATAL
:
712 ssl3_send_alert(s
,SSL3_AL_FATAL
,al
);
715 case SSL_TLSEXT_ERR_ALERT_WARNING
:
716 ssl3_send_alert(s
,SSL3_AL_WARNING
,al
);
719 case SSL_TLSEXT_ERR_NOACK
:
720 s
->servername_done
=0;
726 /* Since the server cache lookup is done early on in the processing of client
727 * hello and other operations depend on the result we need to handle any TLS
728 * session ticket extension at the same time.
731 int tls1_process_ticket(SSL
*s
, unsigned char *session_id
, int len
,
732 const unsigned char *limit
, SSL_SESSION
**ret
)
734 /* Point after session ID in client hello */
735 const unsigned char *p
= session_id
+ len
;
737 if ((s
->version
<= SSL3_VERSION
) || !limit
)
741 /* Skip past cipher list */
746 /* Skip past compression algorithm list */
751 /* Now at start of extensions */
752 if ((p
+ 2) >= limit
)
755 while ((p
+ 4) <= limit
)
757 unsigned short type
, size
;
760 if (p
+ size
> limit
)
762 if (type
== TLSEXT_TYPE_session_ticket
)
764 /* If tickets disabled indicate cache miss which will
765 * trigger a full handshake
767 if (SSL_get_options(s
) & SSL_OP_NO_TICKET
)
769 /* If zero length not client will accept a ticket
770 * and indicate cache miss to trigger full handshake
774 s
->tlsext_ticket_expected
= 1;
775 return 0; /* Cache miss */
777 return tls_decrypt_ticket(s
, p
, size
, session_id
, len
,
785 static int tls_decrypt_ticket(SSL
*s
, const unsigned char *etick
, int eticklen
,
786 const unsigned char *sess_id
, int sesslen
,
791 const unsigned char *p
;
792 int slen
, mlen
, renew_ticket
= 0;
793 unsigned char tick_hmac
[EVP_MAX_MD_SIZE
];
796 /* Need at least keyname + iv + some encrypted data */
799 /* Initialize session ticket encryption and HMAC contexts */
800 HMAC_CTX_init(&hctx
);
801 EVP_CIPHER_CTX_init(&ctx
);
802 if (s
->ctx
->tlsext_ticket_key_cb
)
804 unsigned char *nctick
= (unsigned char *)etick
;
805 int rv
= s
->ctx
->tlsext_ticket_key_cb(s
, nctick
, nctick
+ 16,
816 /* Check key name matches */
817 if (memcmp(etick
, s
->ctx
->tlsext_tick_key_name
, 16))
819 HMAC_Init_ex(&hctx
, s
->ctx
->tlsext_tick_hmac_key
, 16,
820 tlsext_tick_md(), NULL
);
821 EVP_DecryptInit_ex(&ctx
, EVP_aes_128_cbc(), NULL
,
822 s
->ctx
->tlsext_tick_aes_key
, etick
+ 16);
824 /* Attempt to process session ticket, first conduct sanity and
825 * integrity checks on ticket.
827 mlen
= HMAC_size(&hctx
);
829 /* Check HMAC of encrypted ticket */
830 HMAC_Update(&hctx
, etick
, eticklen
);
831 HMAC_Final(&hctx
, tick_hmac
, NULL
);
832 HMAC_CTX_cleanup(&hctx
);
833 if (memcmp(tick_hmac
, etick
+ eticklen
, mlen
))
835 /* Attempt to decrypt session data */
836 /* Move p after IV to start of encrypted ticket, update length */
837 p
= etick
+ 16 + EVP_CIPHER_CTX_iv_length(&ctx
);
838 eticklen
-= 16 + EVP_CIPHER_CTX_iv_length(&ctx
);
839 sdec
= OPENSSL_malloc(eticklen
);
842 EVP_CIPHER_CTX_cleanup(&ctx
);
845 EVP_DecryptUpdate(&ctx
, sdec
, &slen
, p
, eticklen
);
846 if (EVP_DecryptFinal(&ctx
, sdec
+ slen
, &mlen
) <= 0)
849 EVP_CIPHER_CTX_cleanup(&ctx
);
852 sess
= d2i_SSL_SESSION(NULL
, &p
, slen
);
856 /* The session ID if non-empty is used by some clients to
857 * detect that the ticket has been accepted. So we copy it to
858 * the session structure. If it is empty set length to zero
859 * as required by standard.
862 memcpy(sess
->session_id
, sess_id
, sesslen
);
863 sess
->session_id_length
= sesslen
;
865 s
->tlsext_ticket_expected
= renew_ticket
;
868 /* If session decrypt failure indicate a cache miss and set state to
872 s
->tlsext_ticket_expected
= 1;