crypto/libressl/ssl/tls13_legacy.c

   1 /*      $OpenBSD: tls13_legacy.c,v 1.38 2022/07/17 15:49:20 jsing Exp $ */
   2 /*
   3  * Copyright (c) 2018, 2019 Joel Sing <jsing@openbsd.org>
   4  *
   5  * Permission to use, copy, modify, and distribute this software for any
   6  * purpose with or without fee is hereby granted, provided that the above
   7  * copyright notice and this permission notice appear in all copies.
   8  *
   9  * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
  10  * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
  11  * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
  12  * ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
  13  * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
  14  * ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
  15  * OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
  16  */
  17
  18 #include <limits.h>
  19
  20 #include "ssl_locl.h"
  21 #include "tls13_internal.h"
  22
  23 static ssize_t
  24 tls13_legacy_wire_read(SSL *ssl, uint8_t *buf, size_t len)
  25 {
  26         int n;
  27
  28         if (ssl->rbio == NULL) {
  29                 SSLerror(ssl, SSL_R_BIO_NOT_SET);
  30                 return TLS13_IO_FAILURE;
  31         }
  32
  33         ssl->internal->rwstate = SSL_READING;
  34         errno = 0;
  35
  36         if ((n = BIO_read(ssl->rbio, buf, len)) <= 0) {
  37                 if (BIO_should_read(ssl->rbio))
  38                         return TLS13_IO_WANT_POLLIN;
  39                 if (n == 0)
  40                         return TLS13_IO_EOF;
  41
  42                 if (ERR_peek_error() == 0 && errno != 0)
  43                         SYSerror(errno);
  44
  45                 return TLS13_IO_FAILURE;
  46         }
  47
  48         if (n == len)
  49                 ssl->internal->rwstate = SSL_NOTHING;
  50
  51         return n;
  52 }
  53
  54 ssize_t
  55 tls13_legacy_wire_read_cb(void *buf, size_t n, void *arg)
  56 {
  57         struct tls13_ctx *ctx = arg;
  58
  59         return tls13_legacy_wire_read(ctx->ssl, buf, n);
  60 }
  61
  62 static ssize_t
  63 tls13_legacy_wire_write(SSL *ssl, const uint8_t *buf, size_t len)
  64 {
  65         int n;
  66
  67         if (ssl->wbio == NULL) {
  68                 SSLerror(ssl, SSL_R_BIO_NOT_SET);
  69                 return TLS13_IO_FAILURE;
  70         }
  71
  72         ssl->internal->rwstate = SSL_WRITING;
  73         errno = 0;
  74
  75         if ((n = BIO_write(ssl->wbio, buf, len)) <= 0) {
  76                 if (BIO_should_write(ssl->wbio))
  77                         return TLS13_IO_WANT_POLLOUT;
  78
  79                 if (ERR_peek_error() == 0 && errno != 0)
  80                         SYSerror(errno);
  81
  82                 return TLS13_IO_FAILURE;
  83         }
  84
  85         if (n == len)
  86                 ssl->internal->rwstate = SSL_NOTHING;
  87
  88         return n;
  89 }
  90
  91 ssize_t
  92 tls13_legacy_wire_write_cb(const void *buf, size_t n, void *arg)
  93 {
  94         struct tls13_ctx *ctx = arg;
  95
  96         return tls13_legacy_wire_write(ctx->ssl, buf, n);
  97 }
  98
  99 static ssize_t
 100 tls13_legacy_wire_flush(SSL *ssl)
 101 {
 102         if (BIO_flush(ssl->wbio) <= 0) {
 103                 if (BIO_should_write(ssl->wbio))
 104                         return TLS13_IO_WANT_POLLOUT;
 105
 106                 if (ERR_peek_error() == 0 && errno != 0)
 107                         SYSerror(errno);
 108
 109                 return TLS13_IO_FAILURE;
 110         }
 111
 112         return TLS13_IO_SUCCESS;
 113 }
 114
 115 ssize_t
 116 tls13_legacy_wire_flush_cb(void *arg)
 117 {
 118         struct tls13_ctx *ctx = arg;
 119
 120         return tls13_legacy_wire_flush(ctx->ssl);
 121 }
 122
 123 static void
 124 tls13_legacy_error(SSL *ssl)
 125 {
 126         struct tls13_ctx *ctx = ssl->internal->tls13;
 127         int reason = SSL_R_UNKNOWN;
 128
 129         /* If we received a fatal alert we already put an error on the stack. */
 130         if (ssl->s3->fatal_alert != 0)
 131                 return;
 132
 133         switch (ctx->error.code) {
 134         case TLS13_ERR_VERIFY_FAILED:
 135                 reason = SSL_R_CERTIFICATE_VERIFY_FAILED;
 136                 break;
 137         case TLS13_ERR_HRR_FAILED:
 138                 reason = SSL_R_NO_CIPHERS_AVAILABLE;
 139                 break;
 140         case TLS13_ERR_TRAILING_DATA:
 141                 reason = SSL_R_EXTRA_DATA_IN_MESSAGE;
 142                 break;
 143         case TLS13_ERR_NO_SHARED_CIPHER:
 144                 reason = SSL_R_NO_SHARED_CIPHER;
 145                 break;
 146         case TLS13_ERR_NO_CERTIFICATE:
 147                 reason = SSL_R_MISSING_RSA_CERTIFICATE; /* XXX */
 148                 break;
 149         case TLS13_ERR_NO_PEER_CERTIFICATE:
 150                 reason = SSL_R_PEER_DID_NOT_RETURN_A_CERTIFICATE;
 151                 break;
 152         }
 153
 154         /* Something (probably libcrypto) already pushed an error on the stack. */
 155         if (reason == SSL_R_UNKNOWN && ERR_peek_error() != 0)
 156                 return;
 157
 158         ERR_put_error(ERR_LIB_SSL, (0xfff), reason, ctx->error.file,
 159             ctx->error.line);
 160 }
 161
 162 int
 163 tls13_legacy_return_code(SSL *ssl, ssize_t ret)
 164 {
 165         if (ret > INT_MAX) {
 166                 SSLerror(ssl, ERR_R_INTERNAL_ERROR);
 167                 return -1;
 168         }
 169
 170         /* A successful read, write or other operation. */
 171         if (ret > 0)
 172                 return ret;
 173
 174         ssl->internal->rwstate = SSL_NOTHING;
 175
 176         switch (ret) {
 177         case TLS13_IO_EOF:
 178                 return 0;
 179
 180         case TLS13_IO_FAILURE:
 181                 tls13_legacy_error(ssl);
 182                 return -1;
 183
 184         case TLS13_IO_ALERT:
 185                 tls13_legacy_error(ssl);
 186                 return -1;
 187
 188         case TLS13_IO_WANT_POLLIN:
 189                 BIO_set_retry_read(ssl->rbio);
 190                 ssl->internal->rwstate = SSL_READING;
 191                 return -1;
 192
 193         case TLS13_IO_WANT_POLLOUT:
 194                 BIO_set_retry_write(ssl->wbio);
 195                 ssl->internal->rwstate = SSL_WRITING;
 196                 return -1;
 197
 198         case TLS13_IO_WANT_RETRY:
 199                 SSLerror(ssl, ERR_R_INTERNAL_ERROR);
 200                 return -1;
 201         }
 202
 203         SSLerror(ssl, ERR_R_INTERNAL_ERROR);
 204         return -1;
 205 }
 206
 207 int
 208 tls13_legacy_pending(const SSL *ssl)
 209 {
 210         struct tls13_ctx *ctx = ssl->internal->tls13;
 211         ssize_t ret;
 212
 213         if (ctx == NULL)
 214                 return 0;
 215
 216         ret = tls13_pending_application_data(ctx->rl);
 217         if (ret < 0 || ret > INT_MAX)
 218                 return 0;
 219
 220         return ret;
 221 }
 222
 223 int
 224 tls13_legacy_read_bytes(SSL *ssl, int type, unsigned char *buf, int len, int peek)
 225 {
 226         struct tls13_ctx *ctx = ssl->internal->tls13;
 227         ssize_t ret;
 228
 229         if (ctx == NULL || !ctx->handshake_completed) {
 230                 if ((ret = ssl->internal->handshake_func(ssl)) <= 0)
 231                         return ret;
 232                 if (len == 0)
 233                         return 0;
 234                 return tls13_legacy_return_code(ssl, TLS13_IO_WANT_POLLIN);
 235         }
 236
 237         tls13_record_layer_set_retry_after_phh(ctx->rl,
 238             (ctx->ssl->internal->mode & SSL_MODE_AUTO_RETRY) != 0);
 239
 240         if (type != SSL3_RT_APPLICATION_DATA) {
 241                 SSLerror(ssl, ERR_R_SHOULD_NOT_HAVE_BEEN_CALLED);
 242                 return -1;
 243         }
 244         if (len < 0) {
 245                 SSLerror(ssl, SSL_R_BAD_LENGTH);
 246                 return -1;
 247         }
 248
 249         if (peek)
 250                 ret = tls13_peek_application_data(ctx->rl, buf, len);
 251         else
 252                 ret = tls13_read_application_data(ctx->rl, buf, len);
 253
 254         return tls13_legacy_return_code(ssl, ret);
 255 }
 256
 257 int
 258 tls13_legacy_write_bytes(SSL *ssl, int type, const void *vbuf, int len)
 259 {
 260         struct tls13_ctx *ctx = ssl->internal->tls13;
 261         const uint8_t *buf = vbuf;
 262         size_t n, sent;
 263         ssize_t ret;
 264
 265         if (ctx == NULL || !ctx->handshake_completed) {
 266                 if ((ret = ssl->internal->handshake_func(ssl)) <= 0)
 267                         return ret;
 268                 if (len == 0)
 269                         return 0;
 270                 return tls13_legacy_return_code(ssl, TLS13_IO_WANT_POLLOUT);
 271         }
 272
 273         if (type != SSL3_RT_APPLICATION_DATA) {
 274                 SSLerror(ssl, ERR_R_SHOULD_NOT_HAVE_BEEN_CALLED);
 275                 return -1;
 276         }
 277         if (len < 0) {
 278                 SSLerror(ssl, SSL_R_BAD_LENGTH);
 279                 return -1;
 280         }
 281
 282         /*
 283          * The TLSv1.3 record layer write behaviour is the same as
 284          * SSL_MODE_ENABLE_PARTIAL_WRITE.
 285          */
 286         if (ssl->internal->mode & SSL_MODE_ENABLE_PARTIAL_WRITE) {
 287                 ret = tls13_write_application_data(ctx->rl, buf, len);
 288                 return tls13_legacy_return_code(ssl, ret);
 289         }
 290
 291         /*
 292          * In the non-SSL_MODE_ENABLE_PARTIAL_WRITE case we have to loop until
 293          * we have written out all of the requested data.
 294          */
 295         sent = ssl->s3->wnum;
 296         if (len < sent) {
 297                 SSLerror(ssl, SSL_R_BAD_LENGTH);
 298                 return -1;
 299         }
 300         n = len - sent;
 301         for (;;) {
 302                 if (n == 0) {
 303                         ssl->s3->wnum = 0;
 304                         return sent;
 305                 }
 306                 if ((ret = tls13_write_application_data(ctx->rl,
 307                     &buf[sent], n)) <= 0) {
 308                         ssl->s3->wnum = sent;
 309                         return tls13_legacy_return_code(ssl, ret);
 310                 }
 311                 sent += ret;
 312                 n -= ret;
 313         }
 314 }
 315
 316 static int
 317 tls13_use_legacy_stack(struct tls13_ctx *ctx)
 318 {
 319         SSL *s = ctx->ssl;
 320         CBB cbb, fragment;
 321         CBS cbs;
 322
 323         memset(&cbb, 0, sizeof(cbb));
 324
 325         s->method = tls_legacy_method();
 326
 327         if (!ssl3_setup_init_buffer(s))
 328                 goto err;
 329         if (!ssl3_setup_buffers(s))
 330                 goto err;
 331         if (!ssl_init_wbio_buffer(s, 1))
 332                 goto err;
 333
 334         /* Stash any unprocessed data from the last record. */
 335         tls13_record_layer_rcontent(ctx->rl, &cbs);
 336         if (CBS_len(&cbs) > 0) {
 337                 if (!CBB_init_fixed(&cbb, s->s3->rbuf.buf,
 338                     s->s3->rbuf.len))
 339                         goto err;
 340                 if (!CBB_add_u8(&cbb, SSL3_RT_HANDSHAKE))
 341                         goto err;
 342                 if (!CBB_add_u16(&cbb, TLS1_2_VERSION))
 343                         goto err;
 344                 if (!CBB_add_u16_length_prefixed(&cbb, &fragment))
 345                         goto err;
 346                 if (!CBB_add_bytes(&fragment, CBS_data(&cbs), CBS_len(&cbs)))
 347                         goto err;
 348                 if (!CBB_finish(&cbb, NULL, NULL))
 349                         goto err;
 350
 351                 s->s3->rbuf.offset = SSL3_RT_HEADER_LENGTH;
 352                 s->s3->rbuf.left = CBS_len(&cbs);
 353                 s->s3->rrec.type = SSL3_RT_HANDSHAKE;
 354                 s->s3->rrec.length = CBS_len(&cbs);
 355                 s->internal->rstate = SSL_ST_READ_BODY;
 356                 s->internal->packet = s->s3->rbuf.buf;
 357                 s->internal->packet_length = SSL3_RT_HEADER_LENGTH;
 358                 s->internal->mac_packet = 1;
 359         }
 360
 361         /* Stash the current handshake message. */
 362         tls13_handshake_msg_data(ctx->hs_msg, &cbs);
 363         if (!BUF_MEM_grow_clean(s->internal->init_buf, CBS_len(&cbs)))
 364                 goto err;
 365         if (!CBS_write_bytes(&cbs, s->internal->init_buf->data,
 366             s->internal->init_buf->length, NULL))
 367                 goto err;
 368
 369         s->s3->hs.tls12.reuse_message = 1;
 370         s->s3->hs.tls12.message_type = tls13_handshake_msg_type(ctx->hs_msg);
 371         s->s3->hs.tls12.message_size = CBS_len(&cbs) - SSL3_HM_HEADER_LENGTH;
 372
 373         return 1;
 374
 375  err:
 376         CBB_cleanup(&cbb);
 377
 378         return 0;
 379 }
 380
 381 int
 382 tls13_use_legacy_client(struct tls13_ctx *ctx)
 383 {
 384         SSL *s = ctx->ssl;
 385
 386         if (!tls13_use_legacy_stack(ctx))
 387                 return 0;
 388
 389         s->internal->handshake_func = s->method->ssl_connect;
 390         s->version = s->method->max_tls_version;
 391
 392         return 1;
 393 }
 394
 395 int
 396 tls13_use_legacy_server(struct tls13_ctx *ctx)
 397 {
 398         SSL *s = ctx->ssl;
 399
 400         if (!tls13_use_legacy_stack(ctx))
 401                 return 0;
 402
 403         s->internal->handshake_func = s->method->ssl_accept;
 404         s->version = s->method->max_tls_version;
 405         s->server = 1;
 406
 407         return 1;
 408 }
 409
 410 int
 411 tls13_legacy_accept(SSL *ssl)
 412 {
 413         struct tls13_ctx *ctx = ssl->internal->tls13;
 414         int ret;
 415
 416         if (ctx == NULL) {
 417                 if ((ctx = tls13_ctx_new(TLS13_HS_SERVER, ssl)) == NULL) {
 418                         SSLerror(ssl, ERR_R_INTERNAL_ERROR); /* XXX */
 419                         return -1;
 420                 }
 421                 if (!tls13_server_init(ctx)) {
 422                         if (ERR_peek_error() == 0)
 423                                 SSLerror(ssl, ERR_R_INTERNAL_ERROR); /* XXX */
 424                         return -1;
 425                 }
 426         }
 427
 428         ERR_clear_error();
 429
 430         ret = tls13_server_accept(ctx);
 431         if (ret == TLS13_IO_USE_LEGACY)
 432                 return ssl->method->ssl_accept(ssl);
 433
 434         ret = tls13_legacy_return_code(ssl, ret);
 435
 436         if (ctx->info_cb != NULL)
 437                 ctx->info_cb(ctx, TLS13_INFO_ACCEPT_EXIT, ret);
 438
 439         return ret;
 440 }
 441
 442 int
 443 tls13_legacy_connect(SSL *ssl)
 444 {
 445         struct tls13_ctx *ctx = ssl->internal->tls13;
 446         int ret;
 447
 448         if (ctx == NULL) {
 449                 if ((ctx = tls13_ctx_new(TLS13_HS_CLIENT, ssl)) == NULL) {
 450                         SSLerror(ssl, ERR_R_INTERNAL_ERROR); /* XXX */
 451                         return -1;
 452                 }
 453                 if (!tls13_client_init(ctx)) {
 454                         if (ERR_peek_error() == 0)
 455                                 SSLerror(ssl, ERR_R_INTERNAL_ERROR); /* XXX */
 456                         return -1;
 457                 }
 458         }
 459
 460         ERR_clear_error();
 461
 462         ret = tls13_client_connect(ctx);
 463         if (ret == TLS13_IO_USE_LEGACY)
 464                 return ssl->method->ssl_connect(ssl);
 465
 466         ret = tls13_legacy_return_code(ssl, ret);
 467
 468         if (ctx->info_cb != NULL)
 469                 ctx->info_cb(ctx, TLS13_INFO_CONNECT_EXIT, ret);
 470
 471         return ret;
 472 }
 473
 474 int
 475 tls13_legacy_shutdown(SSL *ssl)
 476 {
 477         struct tls13_ctx *ctx = ssl->internal->tls13;
 478         uint8_t buf[512]; /* XXX */
 479         ssize_t ret;
 480
 481         /*
 482          * We need to return 0 at the point that we have completed sending a
 483          * close-notify. We return 1 when we have sent and received close-notify
 484          * alerts. All other cases, including EOF, return -1 and set internal
 485          * state appropriately.
 486          */
 487         if (ctx == NULL || ssl->internal->quiet_shutdown) {
 488                 ssl->internal->shutdown = SSL_SENT_SHUTDOWN | SSL_RECEIVED_SHUTDOWN;
 489                 return 1;
 490         }
 491
 492         if (!ctx->close_notify_sent) {
 493                 /* Enqueue and send close notify. */
 494                 if (!(ssl->internal->shutdown & SSL_SENT_SHUTDOWN)) {
 495                         ssl->internal->shutdown |= SSL_SENT_SHUTDOWN;
 496                         if ((ret = tls13_send_alert(ctx->rl,
 497                             TLS13_ALERT_CLOSE_NOTIFY)) < 0)
 498                                 return tls13_legacy_return_code(ssl, ret);
 499                 }
 500                 ret = tls13_record_layer_send_pending(ctx->rl);
 501                 if (ret == TLS13_IO_EOF)
 502                         return -1;
 503                 if (ret != TLS13_IO_SUCCESS)
 504                         return tls13_legacy_return_code(ssl, ret);
 505         } else if (!ctx->close_notify_recv) {
 506                 /*
 507                  * If there is no application data pending, attempt to read more
 508                  * data in order to receive a close-notify. This should trigger
 509                  * a record to be read from the wire, which may be application
 510                  * handshake or alert data. Only one attempt is made to match
 511                  * previous semantics.
 512                  */
 513                 if (tls13_pending_application_data(ctx->rl) == 0) {
 514                         if ((ret = tls13_read_application_data(ctx->rl, buf,
 515                             sizeof(buf))) < 0)
 516                                 return tls13_legacy_return_code(ssl, ret);
 517                         if (!ctx->close_notify_recv)
 518                                 return -1;
 519                 }
 520         }
 521
 522         if (ctx->close_notify_recv)
 523                 return 1;
 524
 525         return 0;
 526 }
 527
 528 int
 529 tls13_legacy_servername_process(struct tls13_ctx *ctx, uint8_t *alert)
 530 {
 531         int legacy_alert = SSL_AD_UNRECOGNIZED_NAME;
 532         int ret = SSL_TLSEXT_ERR_NOACK;
 533         SSL_CTX *ssl_ctx = ctx->ssl->ctx;
 534         SSL *s = ctx->ssl;
 535
 536         if (ssl_ctx->internal->tlsext_servername_callback == NULL)
 537                 ssl_ctx = s->initial_ctx;
 538         if (ssl_ctx->internal->tlsext_servername_callback == NULL)
 539                 return 1;
 540
 541         ret = ssl_ctx->internal->tlsext_servername_callback(s, &legacy_alert,
 542             ssl_ctx->internal->tlsext_servername_arg);
 543
 544         /*
 545          * Ignore SSL_TLSEXT_ERR_ALERT_WARNING returns to match OpenSSL's
 546          * behavior: the only warning alerts in TLSv1.3 are close_notify and
 547          * user_canceled, neither of which should be returned by the callback.
 548          */
 549         if (ret == SSL_TLSEXT_ERR_ALERT_FATAL) {
 550                 if (legacy_alert >= 0 && legacy_alert <= 255)
 551                         *alert = legacy_alert;
 552                 return 0;
 553         }
 554
 555         return 1;
 556 }