crypto/libressl/ssl/ssl_ciphers.c

   1 /*      $OpenBSD: ssl_ciphers.c,v 1.15 2022/07/02 16:31:04 tb Exp $ */
   2 /*
   3  * Copyright (c) 2015-2017 Doug Hogan <doug@openbsd.org>
   4  * Copyright (c) 2015-2018, 2020 Joel Sing <jsing@openbsd.org>
   5  * Copyright (c) 2019 Theo Buehler <tb@openbsd.org>
   6  *
   7  * Permission to use, copy, modify, and distribute this software for any
   8  * purpose with or without fee is hereby granted, provided that the above
   9  * copyright notice and this permission notice appear in all copies.
  10  *
  11  * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
  12  * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
  13  * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
  14  * ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
  15  * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
  16  * ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
  17  * OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
  18  */
  19
  20 #include <openssl/safestack.h>
  21
  22 #include "bytestring.h"
  23 #include "ssl_locl.h"
  24
  25 int
  26 ssl_cipher_in_list(STACK_OF(SSL_CIPHER) *ciphers, const SSL_CIPHER *cipher)
  27 {
  28         int i;
  29
  30         for (i = 0; i < sk_SSL_CIPHER_num(ciphers); i++) {
  31                 if (sk_SSL_CIPHER_value(ciphers, i)->id == cipher->id)
  32                         return 1;
  33         }
  34
  35         return 0;
  36 }
  37
  38 int
  39 ssl_cipher_allowed_in_tls_version_range(const SSL_CIPHER *cipher, uint16_t min_ver,
  40     uint16_t max_ver)
  41 {
  42         switch(cipher->algorithm_ssl) {
  43         case SSL_SSLV3:
  44                 return (min_ver <= TLS1_2_VERSION);
  45         case SSL_TLSV1_2:
  46                 return (min_ver <= TLS1_2_VERSION && TLS1_2_VERSION <= max_ver);
  47         case SSL_TLSV1_3:
  48                 return (min_ver <= TLS1_3_VERSION && TLS1_3_VERSION <= max_ver);
  49         }
  50         return 0;
  51 }
  52
  53 int
  54 ssl_cipher_list_to_bytes(SSL *s, STACK_OF(SSL_CIPHER) *ciphers, CBB *cbb)
  55 {
  56         SSL_CIPHER *cipher;
  57         int num_ciphers = 0;
  58         uint16_t min_vers, max_vers;
  59         int i;
  60
  61         if (ciphers == NULL)
  62                 return 0;
  63
  64         if (!ssl_supported_tls_version_range(s, &min_vers, &max_vers))
  65                 return 0;
  66
  67         for (i = 0; i < sk_SSL_CIPHER_num(ciphers); i++) {
  68                 if ((cipher = sk_SSL_CIPHER_value(ciphers, i)) == NULL)
  69                         return 0;
  70                 if (!ssl_cipher_allowed_in_tls_version_range(cipher, min_vers,
  71                     max_vers))
  72                         continue;
  73                 if (!ssl_security_cipher_check(s, cipher))
  74                         continue;
  75                 if (!CBB_add_u16(cbb, ssl3_cipher_get_value(cipher)))
  76                         return 0;
  77
  78                 num_ciphers++;
  79         }
  80
  81         /* Add SCSV if there are other ciphers and we're not renegotiating. */
  82         if (num_ciphers > 0 && !s->internal->renegotiate) {
  83                 if (!CBB_add_u16(cbb, SSL3_CK_SCSV & SSL3_CK_VALUE_MASK))
  84                         return 0;
  85         }
  86
  87         if (!CBB_flush(cbb))
  88                 return 0;
  89
  90         return 1;
  91 }
  92
  93 STACK_OF(SSL_CIPHER) *
  94 ssl_bytes_to_cipher_list(SSL *s, CBS *cbs)
  95 {
  96         STACK_OF(SSL_CIPHER) *ciphers = NULL;
  97         const SSL_CIPHER *cipher;
  98         uint16_t cipher_value;
  99         unsigned long cipher_id;
 100
 101         s->s3->send_connection_binding = 0;
 102
 103         if ((ciphers = sk_SSL_CIPHER_new_null()) == NULL) {
 104                 SSLerror(s, ERR_R_MALLOC_FAILURE);
 105                 goto err;
 106         }
 107
 108         while (CBS_len(cbs) > 0) {
 109                 if (!CBS_get_u16(cbs, &cipher_value)) {
 110                         SSLerror(s, SSL_R_ERROR_IN_RECEIVED_CIPHER_LIST);
 111                         goto err;
 112                 }
 113
 114                 cipher_id = SSL3_CK_ID | cipher_value;
 115
 116                 if (cipher_id == SSL3_CK_SCSV) {
 117                         /*
 118                          * TLS_EMPTY_RENEGOTIATION_INFO_SCSV is fatal if
 119                          * renegotiating.
 120                          */
 121                         if (s->internal->renegotiate) {
 122                                 SSLerror(s, SSL_R_SCSV_RECEIVED_WHEN_RENEGOTIATING);
 123                                 ssl3_send_alert(s, SSL3_AL_FATAL,
 124                                     SSL_AD_HANDSHAKE_FAILURE);
 125
 126                                 goto err;
 127                         }
 128                         s->s3->send_connection_binding = 1;
 129                         continue;
 130                 }
 131
 132                 if (cipher_id == SSL3_CK_FALLBACK_SCSV) {
 133                         /*
 134                          * TLS_FALLBACK_SCSV indicates that the client
 135                          * previously tried a higher protocol version.
 136                          * Fail if the current version is an unexpected
 137                          * downgrade.
 138                          */
 139                         if (s->s3->hs.negotiated_tls_version <
 140                             s->s3->hs.our_max_tls_version) {
 141                                 SSLerror(s, SSL_R_INAPPROPRIATE_FALLBACK);
 142                                 ssl3_send_alert(s, SSL3_AL_FATAL,
 143                                         SSL_AD_INAPPROPRIATE_FALLBACK);
 144                                 goto err;
 145                         }
 146                         continue;
 147                 }
 148
 149                 if ((cipher = ssl3_get_cipher_by_value(cipher_value)) != NULL) {
 150                         if (!sk_SSL_CIPHER_push(ciphers, cipher)) {
 151                                 SSLerror(s, ERR_R_MALLOC_FAILURE);
 152                                 goto err;
 153                         }
 154                 }
 155         }
 156
 157         return (ciphers);
 158
 159  err:
 160         sk_SSL_CIPHER_free(ciphers);
 161
 162         return (NULL);
 163 }
 164
 165 struct ssl_tls13_ciphersuite {
 166         const char *name;
 167         const char *alias;
 168         unsigned long cid;
 169 };
 170
 171 static const struct ssl_tls13_ciphersuite ssl_tls13_ciphersuites[] = {
 172         {
 173                 .name = TLS1_3_RFC_AES_128_GCM_SHA256,
 174                 .alias = TLS1_3_TXT_AES_128_GCM_SHA256,
 175                 .cid = TLS1_3_CK_AES_128_GCM_SHA256,
 176         },
 177         {
 178                 .name = TLS1_3_RFC_AES_256_GCM_SHA384,
 179                 .alias = TLS1_3_TXT_AES_256_GCM_SHA384,
 180                 .cid = TLS1_3_CK_AES_256_GCM_SHA384,
 181         },
 182         {
 183                 .name = TLS1_3_RFC_CHACHA20_POLY1305_SHA256,
 184                 .alias = TLS1_3_TXT_CHACHA20_POLY1305_SHA256,
 185                 .cid = TLS1_3_CK_CHACHA20_POLY1305_SHA256,
 186         },
 187         {
 188                 .name = TLS1_3_RFC_AES_128_CCM_SHA256,
 189                 .alias = TLS1_3_TXT_AES_128_CCM_SHA256,
 190                 .cid = TLS1_3_CK_AES_128_CCM_SHA256,
 191         },
 192         {
 193                 .name = TLS1_3_RFC_AES_128_CCM_8_SHA256,
 194                 .alias = TLS1_3_TXT_AES_128_CCM_8_SHA256,
 195                 .cid = TLS1_3_CK_AES_128_CCM_8_SHA256,
 196         },
 197         {
 198                 .name = NULL,
 199         },
 200 };
 201
 202 int
 203 ssl_parse_ciphersuites(STACK_OF(SSL_CIPHER) **out_ciphers, const char *str)
 204 {
 205         const struct ssl_tls13_ciphersuite *ciphersuite;
 206         STACK_OF(SSL_CIPHER) *ciphers;
 207         const SSL_CIPHER *cipher;
 208         char *s = NULL;
 209         char *p, *q;
 210         int i;
 211         int ret = 0;
 212
 213         if ((ciphers = sk_SSL_CIPHER_new_null()) == NULL)
 214                 goto err;
 215
 216         /* An empty string is valid and means no ciphers. */
 217         if (strcmp(str, "") == 0)
 218                 goto done;
 219
 220         if ((s = strdup(str)) == NULL)
 221                 goto err;
 222
 223         q = s;
 224         while ((p = strsep(&q, ":")) != NULL) {
 225                 ciphersuite = &ssl_tls13_ciphersuites[0];
 226                 for (i = 0; ciphersuite->name != NULL; i++) {
 227                         if (strcmp(p, ciphersuite->name) == 0)
 228                                 break;
 229                         if (strcmp(p, ciphersuite->alias) == 0)
 230                                 break;
 231                         ciphersuite = &ssl_tls13_ciphersuites[i];
 232                 }
 233                 if (ciphersuite->name == NULL)
 234                         goto err;
 235
 236                 /* We know about the cipher suite, but it is not supported. */
 237                 if ((cipher = ssl3_get_cipher_by_id(ciphersuite->cid)) == NULL)
 238                         continue;
 239
 240                 if (!sk_SSL_CIPHER_push(ciphers, cipher))
 241                         goto err;
 242         }
 243
 244  done:
 245         sk_SSL_CIPHER_free(*out_ciphers);
 246         *out_ciphers = ciphers;
 247         ciphers = NULL;
 248         ret = 1;
 249
 250  err:
 251         sk_SSL_CIPHER_free(ciphers);
 252         free(s);
 253
 254         return ret;
 255 }
 256
 257 int
 258 ssl_merge_cipherlists(STACK_OF(SSL_CIPHER) *cipherlist,
 259     STACK_OF(SSL_CIPHER) *cipherlist_tls13,
 260     STACK_OF(SSL_CIPHER) **out_cipherlist)
 261 {
 262         STACK_OF(SSL_CIPHER) *ciphers = NULL;
 263         const SSL_CIPHER *cipher;
 264         int i, ret = 0;
 265
 266         if ((ciphers = sk_SSL_CIPHER_dup(cipherlist_tls13)) == NULL)
 267                 goto err;
 268         for (i = 0; i < sk_SSL_CIPHER_num(cipherlist); i++) {
 269                 cipher = sk_SSL_CIPHER_value(cipherlist, i);
 270                 if (cipher->algorithm_ssl == SSL_TLSV1_3)
 271                         continue;
 272                 if (!sk_SSL_CIPHER_push(ciphers, cipher))
 273                         goto err;
 274         }
 275
 276         sk_SSL_CIPHER_free(*out_cipherlist);
 277         *out_cipherlist = ciphers;
 278         ciphers = NULL;
 279
 280         ret = 1;
 281
 282  err:
 283         sk_SSL_CIPHER_free(ciphers);
 284
 285         return ret;
 286 }