Line data Source code
1 : /* ssl/t1_enc.c */
2 : /* Copyright (C) 1995-1998 Eric Young (eay@cryptsoft.com)
3 : * All rights reserved.
4 : *
5 : * This package is an SSL implementation written
6 : * by Eric Young (eay@cryptsoft.com).
7 : * The implementation was written so as to conform with Netscapes SSL.
8 : *
9 : * This library is free for commercial and non-commercial use as long as
10 : * the following conditions are aheared to. The following conditions
11 : * apply to all code found in this distribution, be it the RC4, RSA,
12 : * lhash, DES, etc., code; not just the SSL code. The SSL documentation
13 : * included with this distribution is covered by the same copyright terms
14 : * except that the holder is Tim Hudson (tjh@cryptsoft.com).
15 : *
16 : * Copyright remains Eric Young's, and as such any Copyright notices in
17 : * the code are not to be removed.
18 : * If this package is used in a product, Eric Young should be given attribution
19 : * as the author of the parts of the library used.
20 : * This can be in the form of a textual message at program startup or
21 : * in documentation (online or textual) provided with the package.
22 : *
23 : * Redistribution and use in source and binary forms, with or without
24 : * modification, are permitted provided that the following conditions
25 : * are met:
26 : * 1. Redistributions of source code must retain the copyright
27 : * notice, this list of conditions and the following disclaimer.
28 : * 2. Redistributions in binary form must reproduce the above copyright
29 : * notice, this list of conditions and the following disclaimer in the
30 : * documentation and/or other materials provided with the distribution.
31 : * 3. All advertising materials mentioning features or use of this software
32 : * must display the following acknowledgement:
33 : * "This product includes cryptographic software written by
34 : * Eric Young (eay@cryptsoft.com)"
35 : * The word 'cryptographic' can be left out if the rouines from the library
36 : * being used are not cryptographic related :-).
37 : * 4. If you include any Windows specific code (or a derivative thereof) from
38 : * the apps directory (application code) you must include an acknowledgement:
39 : * "This product includes software written by Tim Hudson (tjh@cryptsoft.com)"
40 : *
41 : * THIS SOFTWARE IS PROVIDED BY ERIC YOUNG ``AS IS'' AND
42 : * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
43 : * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
44 : * ARE DISCLAIMED. IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE
45 : * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
46 : * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
47 : * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
48 : * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
49 : * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
50 : * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
51 : * SUCH DAMAGE.
52 : *
53 : * The licence and distribution terms for any publically available version or
54 : * derivative of this code cannot be changed. i.e. this code cannot simply be
55 : * copied and put under another distribution licence
56 : * [including the GNU Public Licence.]
57 : */
58 : /* ====================================================================
59 : * Copyright (c) 1998-2007 The OpenSSL Project. All rights reserved.
60 : *
61 : * Redistribution and use in source and binary forms, with or without
62 : * modification, are permitted provided that the following conditions
63 : * are met:
64 : *
65 : * 1. Redistributions of source code must retain the above copyright
66 : * notice, this list of conditions and the following disclaimer.
67 : *
68 : * 2. Redistributions in binary form must reproduce the above copyright
69 : * notice, this list of conditions and the following disclaimer in
70 : * the documentation and/or other materials provided with the
71 : * distribution.
72 : *
73 : * 3. All advertising materials mentioning features or use of this
74 : * software must display the following acknowledgment:
75 : * "This product includes software developed by the OpenSSL Project
76 : * for use in the OpenSSL Toolkit. (http://www.openssl.org/)"
77 : *
78 : * 4. The names "OpenSSL Toolkit" and "OpenSSL Project" must not be used to
79 : * endorse or promote products derived from this software without
80 : * prior written permission. For written permission, please contact
81 : * openssl-core@openssl.org.
82 : *
83 : * 5. Products derived from this software may not be called "OpenSSL"
84 : * nor may "OpenSSL" appear in their names without prior written
85 : * permission of the OpenSSL Project.
86 : *
87 : * 6. Redistributions of any form whatsoever must retain the following
88 : * acknowledgment:
89 : * "This product includes software developed by the OpenSSL Project
90 : * for use in the OpenSSL Toolkit (http://www.openssl.org/)"
91 : *
92 : * THIS SOFTWARE IS PROVIDED BY THE OpenSSL PROJECT ``AS IS'' AND ANY
93 : * EXPRESSED OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
94 : * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
95 : * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE OpenSSL PROJECT OR
96 : * ITS CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
97 : * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
98 : * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
99 : * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
100 : * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT,
101 : * STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
102 : * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED
103 : * OF THE POSSIBILITY OF SUCH DAMAGE.
104 : * ====================================================================
105 : *
106 : * This product includes cryptographic software written by Eric Young
107 : * (eay@cryptsoft.com). This product includes software written by Tim
108 : * Hudson (tjh@cryptsoft.com).
109 : *
110 : */
111 : /* ====================================================================
112 : * Copyright 2005 Nokia. All rights reserved.
113 : *
114 : * The portions of the attached software ("Contribution") is developed by
115 : * Nokia Corporation and is licensed pursuant to the OpenSSL open source
116 : * license.
117 : *
118 : * The Contribution, originally written by Mika Kousa and Pasi Eronen of
119 : * Nokia Corporation, consists of the "PSK" (Pre-Shared Key) ciphersuites
120 : * support (see RFC 4279) to OpenSSL.
121 : *
122 : * No patent licenses or other rights except those expressly stated in
123 : * the OpenSSL open source license shall be deemed granted or received
124 : * expressly, by implication, estoppel, or otherwise.
125 : *
126 : * No assurances are provided by Nokia that the Contribution does not
127 : * infringe the patent or other intellectual property rights of any third
128 : * party or that the license provides you with all the necessary rights
129 : * to make use of the Contribution.
130 : *
131 : * THE SOFTWARE IS PROVIDED "AS IS" WITHOUT WARRANTY OF ANY KIND. IN
132 : * ADDITION TO THE DISCLAIMERS INCLUDED IN THE LICENSE, NOKIA
133 : * SPECIFICALLY DISCLAIMS ANY LIABILITY FOR CLAIMS BROUGHT BY YOU OR ANY
134 : * OTHER ENTITY BASED ON INFRINGEMENT OF INTELLECTUAL PROPERTY RIGHTS OR
135 : * OTHERWISE.
136 : */
137 :
138 : #include <stdio.h>
139 : #include "ssl_locl.h"
140 : #ifndef OPENSSL_NO_COMP
141 : # include <openssl/comp.h>
142 : #endif
143 : #include <openssl/evp.h>
144 : #include <openssl/hmac.h>
145 : #include <openssl/md5.h>
146 : #include <openssl/rand.h>
147 : #ifdef KSSL_DEBUG
148 : # include <openssl/des.h>
149 : #endif
150 :
151 : /* seed1 through seed5 are virtually concatenated */
152 3675 : static int tls1_P_hash(const EVP_MD *md, const unsigned char *sec,
153 : int sec_len,
154 : const void *seed1, int seed1_len,
155 : const void *seed2, int seed2_len,
156 : const void *seed3, int seed3_len,
157 : const void *seed4, int seed4_len,
158 : const void *seed5, int seed5_len,
159 : unsigned char *out, int olen)
160 : {
161 : int chunk;
162 : size_t j;
163 : EVP_MD_CTX ctx, ctx_tmp, ctx_init;
164 : EVP_PKEY *mac_key;
165 : unsigned char A1[EVP_MAX_MD_SIZE];
166 : size_t A1_len;
167 : int ret = 0;
168 :
169 3675 : chunk = EVP_MD_size(md);
170 3675 : OPENSSL_assert(chunk >= 0);
171 :
172 3675 : EVP_MD_CTX_init(&ctx);
173 3675 : EVP_MD_CTX_init(&ctx_tmp);
174 3675 : EVP_MD_CTX_init(&ctx_init);
175 3675 : EVP_MD_CTX_set_flags(&ctx_init, EVP_MD_CTX_FLAG_NON_FIPS_ALLOW);
176 3675 : mac_key = EVP_PKEY_new_mac_key(EVP_PKEY_HMAC, NULL, sec, sec_len);
177 3675 : if (!mac_key)
178 : goto err;
179 3675 : if (!EVP_DigestSignInit(&ctx_init, NULL, md, NULL, mac_key))
180 : goto err;
181 3675 : if (!EVP_MD_CTX_copy_ex(&ctx, &ctx_init))
182 : goto err;
183 3675 : if (seed1 && !EVP_DigestSignUpdate(&ctx, seed1, seed1_len))
184 : goto err;
185 3675 : if (seed2 && !EVP_DigestSignUpdate(&ctx, seed2, seed2_len))
186 : goto err;
187 3675 : if (seed3 && !EVP_DigestSignUpdate(&ctx, seed3, seed3_len))
188 : goto err;
189 3675 : if (seed4 && !EVP_DigestSignUpdate(&ctx, seed4, seed4_len))
190 : goto err;
191 3675 : if (seed5 && !EVP_DigestSignUpdate(&ctx, seed5, seed5_len))
192 : goto err;
193 3675 : if (!EVP_DigestSignFinal(&ctx, A1, &A1_len))
194 : goto err;
195 :
196 : for (;;) {
197 : /* Reinit mac contexts */
198 5149 : if (!EVP_MD_CTX_copy_ex(&ctx, &ctx_init))
199 : goto err;
200 5149 : if (!EVP_DigestSignUpdate(&ctx, A1, A1_len))
201 : goto err;
202 5149 : if (olen > chunk && !EVP_MD_CTX_copy_ex(&ctx_tmp, &ctx))
203 : goto err;
204 5149 : if (seed1 && !EVP_DigestSignUpdate(&ctx, seed1, seed1_len))
205 : goto err;
206 5149 : if (seed2 && !EVP_DigestSignUpdate(&ctx, seed2, seed2_len))
207 : goto err;
208 5149 : if (seed3 && !EVP_DigestSignUpdate(&ctx, seed3, seed3_len))
209 : goto err;
210 5149 : if (seed4 && !EVP_DigestSignUpdate(&ctx, seed4, seed4_len))
211 : goto err;
212 5149 : if (seed5 && !EVP_DigestSignUpdate(&ctx, seed5, seed5_len))
213 : goto err;
214 :
215 5149 : if (olen > chunk) {
216 1474 : if (!EVP_DigestSignFinal(&ctx, out, &j))
217 : goto err;
218 1474 : out += j;
219 1474 : olen -= j;
220 : /* calc the next A1 value */
221 1474 : if (!EVP_DigestSignFinal(&ctx_tmp, A1, &A1_len))
222 : goto err;
223 : } else { /* last one */
224 :
225 3675 : if (!EVP_DigestSignFinal(&ctx, A1, &A1_len))
226 : goto err;
227 3675 : memcpy(out, A1, olen);
228 : break;
229 : }
230 : }
231 : ret = 1;
232 : err:
233 3675 : EVP_PKEY_free(mac_key);
234 3675 : EVP_MD_CTX_cleanup(&ctx);
235 3675 : EVP_MD_CTX_cleanup(&ctx_tmp);
236 3675 : EVP_MD_CTX_cleanup(&ctx_init);
237 3675 : OPENSSL_cleanse(A1, sizeof(A1));
238 3675 : return ret;
239 : }
240 :
241 : /* seed1 through seed5 are virtually concatenated */
242 3675 : static int tls1_PRF(long digest_mask,
243 : const void *seed1, int seed1_len,
244 : const void *seed2, int seed2_len,
245 : const void *seed3, int seed3_len,
246 : const void *seed4, int seed4_len,
247 : const void *seed5, int seed5_len,
248 : const unsigned char *sec, int slen,
249 : unsigned char *out1, unsigned char *out2, int olen)
250 : {
251 : int len, i, idx, count;
252 : const unsigned char *S1;
253 : long m;
254 : const EVP_MD *md;
255 : int ret = 0;
256 :
257 : /* Count number of digests and partition sec evenly */
258 : count = 0;
259 25725 : for (idx = 0; ssl_get_handshake_digest(idx, &m, &md); idx++) {
260 22050 : if ((m << TLS1_PRF_DGST_SHIFT) & digest_mask)
261 3675 : count++;
262 : }
263 3675 : if (!count) {
264 : /* Should never happen */
265 0 : SSLerr(SSL_F_TLS1_PRF, ERR_R_INTERNAL_ERROR);
266 0 : goto err;
267 : }
268 3675 : len = slen / count;
269 3675 : if (count == 1)
270 : slen = 0;
271 : S1 = sec;
272 3675 : memset(out1, 0, olen);
273 25725 : for (idx = 0; ssl_get_handshake_digest(idx, &m, &md); idx++) {
274 22050 : if ((m << TLS1_PRF_DGST_SHIFT) & digest_mask) {
275 3675 : if (!md) {
276 0 : SSLerr(SSL_F_TLS1_PRF, SSL_R_UNSUPPORTED_DIGEST_TYPE);
277 0 : goto err;
278 : }
279 3675 : if (!tls1_P_hash(md, S1, len + (slen & 1),
280 : seed1, seed1_len, seed2, seed2_len, seed3,
281 : seed3_len, seed4, seed4_len, seed5, seed5_len,
282 : out2, olen))
283 : goto err;
284 3675 : S1 += len;
285 106735 : for (i = 0; i < olen; i++) {
286 103060 : out1[i] ^= out2[i];
287 : }
288 : }
289 : }
290 : ret = 1;
291 : err:
292 3675 : return ret;
293 : }
294 :
295 737 : static int tls1_generate_key_block(SSL *s, unsigned char *km,
296 : unsigned char *tmp, int num)
297 : {
298 : int ret;
299 1474 : ret = tls1_PRF(ssl_get_algorithm2(s),
300 : TLS_MD_KEY_EXPANSION_CONST,
301 737 : TLS_MD_KEY_EXPANSION_CONST_SIZE, s->s3->server_random,
302 737 : SSL3_RANDOM_SIZE, s->s3->client_random, SSL3_RANDOM_SIZE,
303 737 : NULL, 0, NULL, 0, s->session->master_key,
304 737 : s->session->master_key_length, km, tmp, num);
305 : #ifdef KSSL_DEBUG
306 : fprintf(stderr, "tls1_generate_key_block() ==> %d byte master_key =\n\t",
307 : s->session->master_key_length);
308 : {
309 : int i;
310 : for (i = 0; i < s->session->master_key_length; i++) {
311 : fprintf(stderr, "%02X", s->session->master_key[i]);
312 : }
313 : fprintf(stderr, "\n");
314 : }
315 : #endif /* KSSL_DEBUG */
316 737 : return ret;
317 : }
318 :
319 1469 : int tls1_change_cipher_state(SSL *s, int which)
320 : {
321 : static const unsigned char empty[] = "";
322 : unsigned char *p, *mac_secret;
323 : unsigned char *exp_label;
324 : unsigned char tmp1[EVP_MAX_KEY_LENGTH];
325 : unsigned char tmp2[EVP_MAX_KEY_LENGTH];
326 : unsigned char iv1[EVP_MAX_IV_LENGTH * 2];
327 : unsigned char iv2[EVP_MAX_IV_LENGTH * 2];
328 : unsigned char *ms, *key, *iv;
329 : int client_write;
330 : EVP_CIPHER_CTX *dd;
331 : const EVP_CIPHER *c;
332 : #ifndef OPENSSL_NO_COMP
333 : const SSL_COMP *comp;
334 : #endif
335 : const EVP_MD *m;
336 : int mac_type;
337 : int *mac_secret_size;
338 : EVP_MD_CTX *mac_ctx;
339 : EVP_PKEY *mac_key;
340 : int is_export, n, i, j, k, exp_label_len, cl;
341 : int reuse_dd = 0;
342 :
343 1469 : is_export = SSL_C_IS_EXPORT(s->s3->tmp.new_cipher);
344 1469 : c = s->s3->tmp.new_sym_enc;
345 1469 : m = s->s3->tmp.new_hash;
346 1469 : mac_type = s->s3->tmp.new_mac_pkey_type;
347 : #ifndef OPENSSL_NO_COMP
348 1469 : comp = s->s3->tmp.new_compression;
349 : #endif
350 :
351 : #ifdef KSSL_DEBUG
352 : fprintf(stderr, "tls1_change_cipher_state(which= %d) w/\n", which);
353 : fprintf(stderr, "\talg= %ld/%ld, comp= %p\n",
354 : s->s3->tmp.new_cipher->algorithm_mkey,
355 : s->s3->tmp.new_cipher->algorithm_auth, comp);
356 : fprintf(stderr, "\tevp_cipher == %p ==? &d_cbc_ede_cipher3\n", c);
357 : fprintf(stderr, "\tevp_cipher: nid, blksz= %d, %d, keylen=%d, ivlen=%d\n",
358 : c->nid, c->block_size, c->key_len, c->iv_len);
359 : fprintf(stderr, "\tkey_block: len= %d, data= ",
360 : s->s3->tmp.key_block_length);
361 : {
362 : int i;
363 : for (i = 0; i < s->s3->tmp.key_block_length; i++)
364 : fprintf(stderr, "%02x", s->s3->tmp.key_block[i]);
365 : fprintf(stderr, "\n");
366 : }
367 : #endif /* KSSL_DEBUG */
368 :
369 1469 : if (which & SSL3_CC_READ) {
370 732 : if (s->s3->tmp.new_cipher->algorithm2 & TLS1_STREAM_MAC)
371 0 : s->mac_flags |= SSL_MAC_FLAG_READ_MAC_STREAM;
372 : else
373 732 : s->mac_flags &= ~SSL_MAC_FLAG_READ_MAC_STREAM;
374 :
375 732 : if (s->enc_read_ctx != NULL)
376 : reuse_dd = 1;
377 732 : else if ((s->enc_read_ctx =
378 732 : OPENSSL_malloc(sizeof(EVP_CIPHER_CTX))) == NULL)
379 : goto err;
380 : else
381 : /*
382 : * make sure it's intialized in case we exit later with an error
383 : */
384 732 : EVP_CIPHER_CTX_init(s->enc_read_ctx);
385 732 : dd = s->enc_read_ctx;
386 732 : mac_ctx = ssl_replace_hash(&s->read_hash, NULL);
387 : #ifndef OPENSSL_NO_COMP
388 732 : if (s->expand != NULL) {
389 0 : COMP_CTX_free(s->expand);
390 0 : s->expand = NULL;
391 : }
392 732 : if (comp != NULL) {
393 0 : s->expand = COMP_CTX_new(comp->method);
394 0 : if (s->expand == NULL) {
395 0 : SSLerr(SSL_F_TLS1_CHANGE_CIPHER_STATE,
396 : SSL_R_COMPRESSION_LIBRARY_ERROR);
397 0 : goto err2;
398 : }
399 0 : if (s->s3->rrec.comp == NULL)
400 0 : s->s3->rrec.comp = (unsigned char *)
401 0 : OPENSSL_malloc(SSL3_RT_MAX_ENCRYPTED_LENGTH);
402 0 : if (s->s3->rrec.comp == NULL)
403 : goto err;
404 : }
405 : #endif
406 : /*
407 : * this is done by dtls1_reset_seq_numbers for DTLS
408 : */
409 732 : if (!SSL_IS_DTLS(s))
410 732 : memset(&(s->s3->read_sequence[0]), 0, 8);
411 732 : mac_secret = &(s->s3->read_mac_secret[0]);
412 732 : mac_secret_size = &(s->s3->read_mac_secret_size);
413 : } else {
414 737 : if (s->s3->tmp.new_cipher->algorithm2 & TLS1_STREAM_MAC)
415 0 : s->mac_flags |= SSL_MAC_FLAG_WRITE_MAC_STREAM;
416 : else
417 737 : s->mac_flags &= ~SSL_MAC_FLAG_WRITE_MAC_STREAM;
418 737 : if (s->enc_write_ctx != NULL && !SSL_IS_DTLS(s))
419 : reuse_dd = 1;
420 737 : else if ((s->enc_write_ctx = EVP_CIPHER_CTX_new()) == NULL)
421 : goto err;
422 737 : dd = s->enc_write_ctx;
423 737 : if (SSL_IS_DTLS(s)) {
424 0 : mac_ctx = EVP_MD_CTX_create();
425 0 : if (!mac_ctx)
426 : goto err;
427 0 : s->write_hash = mac_ctx;
428 : } else
429 737 : mac_ctx = ssl_replace_hash(&s->write_hash, NULL);
430 : #ifndef OPENSSL_NO_COMP
431 737 : if (s->compress != NULL) {
432 0 : COMP_CTX_free(s->compress);
433 0 : s->compress = NULL;
434 : }
435 737 : if (comp != NULL) {
436 0 : s->compress = COMP_CTX_new(comp->method);
437 0 : if (s->compress == NULL) {
438 0 : SSLerr(SSL_F_TLS1_CHANGE_CIPHER_STATE,
439 : SSL_R_COMPRESSION_LIBRARY_ERROR);
440 0 : goto err2;
441 : }
442 : }
443 : #endif
444 : /*
445 : * this is done by dtls1_reset_seq_numbers for DTLS
446 : */
447 737 : if (!SSL_IS_DTLS(s))
448 737 : memset(&(s->s3->write_sequence[0]), 0, 8);
449 737 : mac_secret = &(s->s3->write_mac_secret[0]);
450 737 : mac_secret_size = &(s->s3->write_mac_secret_size);
451 : }
452 :
453 1469 : if (reuse_dd)
454 0 : EVP_CIPHER_CTX_cleanup(dd);
455 :
456 1469 : p = s->s3->tmp.key_block;
457 1469 : i = *mac_secret_size = s->s3->tmp.new_mac_secret_size;
458 :
459 1469 : cl = EVP_CIPHER_key_length(c);
460 : j = is_export ? (cl < SSL_C_EXPORT_KEYLENGTH(s->s3->tmp.new_cipher) ?
461 1469 : cl : SSL_C_EXPORT_KEYLENGTH(s->s3->tmp.new_cipher)) : cl;
462 : /* Was j=(exp)?5:EVP_CIPHER_key_length(c); */
463 : /* If GCM mode only part of IV comes from PRF */
464 1469 : if (EVP_CIPHER_mode(c) == EVP_CIPH_GCM_MODE)
465 : k = EVP_GCM_TLS_FIXED_IV_LEN;
466 : else
467 0 : k = EVP_CIPHER_iv_length(c);
468 2938 : if ((which == SSL3_CHANGE_CIPHER_CLIENT_WRITE) ||
469 1469 : (which == SSL3_CHANGE_CIPHER_SERVER_READ)) {
470 : ms = &(p[0]);
471 737 : n = i + i;
472 737 : key = &(p[n]);
473 737 : n += j + j;
474 737 : iv = &(p[n]);
475 737 : n += k + k;
476 : exp_label = (unsigned char *)TLS_MD_CLIENT_WRITE_KEY_CONST;
477 : exp_label_len = TLS_MD_CLIENT_WRITE_KEY_CONST_SIZE;
478 : client_write = 1;
479 : } else {
480 : n = i;
481 732 : ms = &(p[n]);
482 732 : n += i + j;
483 732 : key = &(p[n]);
484 732 : n += j + k;
485 732 : iv = &(p[n]);
486 732 : n += k;
487 : exp_label = (unsigned char *)TLS_MD_SERVER_WRITE_KEY_CONST;
488 : exp_label_len = TLS_MD_SERVER_WRITE_KEY_CONST_SIZE;
489 : client_write = 0;
490 : }
491 :
492 1469 : if (n > s->s3->tmp.key_block_length) {
493 0 : SSLerr(SSL_F_TLS1_CHANGE_CIPHER_STATE, ERR_R_INTERNAL_ERROR);
494 0 : goto err2;
495 : }
496 :
497 1469 : memcpy(mac_secret, ms, i);
498 :
499 1469 : if (!(EVP_CIPHER_flags(c) & EVP_CIPH_FLAG_AEAD_CIPHER)) {
500 0 : mac_key = EVP_PKEY_new_mac_key(mac_type, NULL,
501 : mac_secret, *mac_secret_size);
502 0 : EVP_DigestSignInit(mac_ctx, NULL, m, NULL, mac_key);
503 0 : EVP_PKEY_free(mac_key);
504 : }
505 : #ifdef TLS_DEBUG
506 : printf("which = %04X\nmac key=", which);
507 : {
508 : int z;
509 : for (z = 0; z < i; z++)
510 : printf("%02X%c", ms[z], ((z + 1) % 16) ? ' ' : '\n');
511 : }
512 : #endif
513 1469 : if (is_export) {
514 : /*
515 : * In here I set both the read and write key/iv to the same value
516 : * since only the correct one will be used :-).
517 : */
518 0 : if (!tls1_PRF(ssl_get_algorithm2(s),
519 : exp_label, exp_label_len,
520 0 : s->s3->client_random, SSL3_RANDOM_SIZE,
521 0 : s->s3->server_random, SSL3_RANDOM_SIZE,
522 : NULL, 0, NULL, 0,
523 : key, j, tmp1, tmp2, EVP_CIPHER_key_length(c)))
524 : goto err2;
525 : key = tmp1;
526 :
527 0 : if (k > 0) {
528 0 : if (!tls1_PRF(ssl_get_algorithm2(s),
529 : TLS_MD_IV_BLOCK_CONST, TLS_MD_IV_BLOCK_CONST_SIZE,
530 0 : s->s3->client_random, SSL3_RANDOM_SIZE,
531 0 : s->s3->server_random, SSL3_RANDOM_SIZE,
532 : NULL, 0, NULL, 0, empty, 0, iv1, iv2, k * 2))
533 : goto err2;
534 0 : if (client_write)
535 : iv = iv1;
536 : else
537 0 : iv = &(iv1[k]);
538 : }
539 : }
540 :
541 1469 : s->session->key_arg_length = 0;
542 : #ifdef KSSL_DEBUG
543 : {
544 : int i;
545 : fprintf(stderr, "EVP_CipherInit_ex(dd,c,key=,iv=,which)\n");
546 : fprintf(stderr, "\tkey= ");
547 : for (i = 0; i < c->key_len; i++)
548 : fprintf(stderr, "%02x", key[i]);
549 : fprintf(stderr, "\n");
550 : fprintf(stderr, "\t iv= ");
551 : for (i = 0; i < c->iv_len; i++)
552 : fprintf(stderr, "%02x", iv[i]);
553 : fprintf(stderr, "\n");
554 : }
555 : #endif /* KSSL_DEBUG */
556 :
557 1469 : if (EVP_CIPHER_mode(c) == EVP_CIPH_GCM_MODE) {
558 1469 : if (!EVP_CipherInit_ex(dd, c, NULL, key, NULL, (which & SSL3_CC_WRITE))
559 1469 : || !EVP_CIPHER_CTX_ctrl(dd, EVP_CTRL_GCM_SET_IV_FIXED, k, iv)) {
560 0 : SSLerr(SSL_F_TLS1_CHANGE_CIPHER_STATE, ERR_R_INTERNAL_ERROR);
561 0 : goto err2;
562 : }
563 : } else {
564 0 : if (!EVP_CipherInit_ex(dd, c, NULL, key, iv, (which & SSL3_CC_WRITE))) {
565 0 : SSLerr(SSL_F_TLS1_CHANGE_CIPHER_STATE, ERR_R_INTERNAL_ERROR);
566 0 : goto err2;
567 : }
568 : }
569 : /* Needed for "composite" AEADs, such as RC4-HMAC-MD5 */
570 1469 : if ((EVP_CIPHER_flags(c) & EVP_CIPH_FLAG_AEAD_CIPHER) && *mac_secret_size
571 0 : && !EVP_CIPHER_CTX_ctrl(dd, EVP_CTRL_AEAD_SET_MAC_KEY,
572 : *mac_secret_size, mac_secret)) {
573 0 : SSLerr(SSL_F_TLS1_CHANGE_CIPHER_STATE, ERR_R_INTERNAL_ERROR);
574 0 : goto err2;
575 : }
576 : #ifdef OPENSSL_SSL_TRACE_CRYPTO
577 : if (s->msg_callback) {
578 : int wh = which & SSL3_CC_WRITE ? TLS1_RT_CRYPTO_WRITE : 0;
579 : if (*mac_secret_size)
580 : s->msg_callback(2, s->version, wh | TLS1_RT_CRYPTO_MAC,
581 : mac_secret, *mac_secret_size,
582 : s, s->msg_callback_arg);
583 : if (c->key_len)
584 : s->msg_callback(2, s->version, wh | TLS1_RT_CRYPTO_KEY,
585 : key, c->key_len, s, s->msg_callback_arg);
586 : if (k) {
587 : if (EVP_CIPHER_mode(c) == EVP_CIPH_GCM_MODE)
588 : wh |= TLS1_RT_CRYPTO_FIXED_IV;
589 : else
590 : wh |= TLS1_RT_CRYPTO_IV;
591 : s->msg_callback(2, s->version, wh, iv, k, s, s->msg_callback_arg);
592 : }
593 : }
594 : #endif
595 :
596 : #ifdef TLS_DEBUG
597 : printf("which = %04X\nkey=", which);
598 : {
599 : int z;
600 : for (z = 0; z < EVP_CIPHER_key_length(c); z++)
601 : printf("%02X%c", key[z], ((z + 1) % 16) ? ' ' : '\n');
602 : }
603 : printf("\niv=");
604 : {
605 : int z;
606 : for (z = 0; z < k; z++)
607 : printf("%02X%c", iv[z], ((z + 1) % 16) ? ' ' : '\n');
608 : }
609 : printf("\n");
610 : #endif
611 :
612 1469 : OPENSSL_cleanse(tmp1, sizeof(tmp1));
613 1469 : OPENSSL_cleanse(tmp2, sizeof(tmp1));
614 1469 : OPENSSL_cleanse(iv1, sizeof(iv1));
615 1469 : OPENSSL_cleanse(iv2, sizeof(iv2));
616 1469 : return (1);
617 : err:
618 0 : SSLerr(SSL_F_TLS1_CHANGE_CIPHER_STATE, ERR_R_MALLOC_FAILURE);
619 : err2:
620 : return (0);
621 : }
622 :
623 1104 : int tls1_setup_key_block(SSL *s)
624 : {
625 : unsigned char *p1, *p2 = NULL;
626 : const EVP_CIPHER *c;
627 : const EVP_MD *hash;
628 : int num;
629 : SSL_COMP *comp;
630 1104 : int mac_type = NID_undef, mac_secret_size = 0;
631 : int ret = 0;
632 :
633 : #ifdef KSSL_DEBUG
634 : fprintf(stderr, "tls1_setup_key_block()\n");
635 : #endif /* KSSL_DEBUG */
636 :
637 1104 : if (s->s3->tmp.key_block_length != 0)
638 : return (1);
639 :
640 737 : if (!ssl_cipher_get_evp
641 737 : (s->session, &c, &hash, &mac_type, &mac_secret_size, &comp)) {
642 0 : SSLerr(SSL_F_TLS1_SETUP_KEY_BLOCK, SSL_R_CIPHER_OR_HASH_UNAVAILABLE);
643 0 : return (0);
644 : }
645 :
646 737 : s->s3->tmp.new_sym_enc = c;
647 737 : s->s3->tmp.new_hash = hash;
648 737 : s->s3->tmp.new_mac_pkey_type = mac_type;
649 737 : s->s3->tmp.new_mac_secret_size = mac_secret_size;
650 737 : num =
651 737 : EVP_CIPHER_key_length(c) + mac_secret_size + EVP_CIPHER_iv_length(c);
652 737 : num *= 2;
653 :
654 737 : ssl3_cleanup_key_block(s);
655 :
656 737 : if ((p1 = (unsigned char *)OPENSSL_malloc(num)) == NULL) {
657 0 : SSLerr(SSL_F_TLS1_SETUP_KEY_BLOCK, ERR_R_MALLOC_FAILURE);
658 0 : goto err;
659 : }
660 :
661 737 : s->s3->tmp.key_block_length = num;
662 737 : s->s3->tmp.key_block = p1;
663 :
664 737 : if ((p2 = (unsigned char *)OPENSSL_malloc(num)) == NULL) {
665 0 : SSLerr(SSL_F_TLS1_SETUP_KEY_BLOCK, ERR_R_MALLOC_FAILURE);
666 0 : OPENSSL_free(p1);
667 0 : goto err;
668 : }
669 : #ifdef TLS_DEBUG
670 : printf("client random\n");
671 : {
672 : int z;
673 : for (z = 0; z < SSL3_RANDOM_SIZE; z++)
674 : printf("%02X%c", s->s3->client_random[z],
675 : ((z + 1) % 16) ? ' ' : '\n');
676 : }
677 : printf("server random\n");
678 : {
679 : int z;
680 : for (z = 0; z < SSL3_RANDOM_SIZE; z++)
681 : printf("%02X%c", s->s3->server_random[z],
682 : ((z + 1) % 16) ? ' ' : '\n');
683 : }
684 : printf("pre-master\n");
685 : {
686 : int z;
687 : for (z = 0; z < s->session->master_key_length; z++)
688 : printf("%02X%c", s->session->master_key[z],
689 : ((z + 1) % 16) ? ' ' : '\n');
690 : }
691 : #endif
692 737 : if (!tls1_generate_key_block(s, p1, p2, num))
693 : goto err;
694 : #ifdef TLS_DEBUG
695 : printf("\nkey block\n");
696 : {
697 : int z;
698 : for (z = 0; z < num; z++)
699 : printf("%02X%c", p1[z], ((z + 1) % 16) ? ' ' : '\n');
700 : }
701 : #endif
702 :
703 737 : if (!(s->options & SSL_OP_DONT_INSERT_EMPTY_FRAGMENTS)
704 737 : && s->method->version <= TLS1_VERSION) {
705 : /*
706 : * enable vulnerability countermeasure for CBC ciphers with known-IV
707 : * problem (http://www.openssl.org/~bodo/tls-cbc.txt)
708 : */
709 0 : s->s3->need_empty_fragments = 1;
710 :
711 0 : if (s->session->cipher != NULL) {
712 0 : if (s->session->cipher->algorithm_enc == SSL_eNULL)
713 0 : s->s3->need_empty_fragments = 0;
714 :
715 : #ifndef OPENSSL_NO_RC4
716 0 : if (s->session->cipher->algorithm_enc == SSL_RC4)
717 0 : s->s3->need_empty_fragments = 0;
718 : #endif
719 : }
720 : }
721 :
722 : ret = 1;
723 : err:
724 737 : if (p2) {
725 737 : OPENSSL_cleanse(p2, num);
726 737 : OPENSSL_free(p2);
727 : }
728 737 : return (ret);
729 : }
730 :
731 : /*-
732 : * tls1_enc encrypts/decrypts the record in |s->wrec| / |s->rrec|, respectively.
733 : *
734 : * Returns:
735 : * 0: (in non-constant time) if the record is publically invalid (i.e. too
736 : * short etc).
737 : * 1: if the record's padding is valid / the encryption was successful.
738 : * -1: if the record's padding/AEAD-authenticator is invalid or, if sending,
739 : * an internal error occured.
740 : */
741 19000 : int tls1_enc(SSL *s, int send)
742 : {
743 : SSL3_RECORD *rec;
744 : EVP_CIPHER_CTX *ds;
745 : unsigned long l;
746 : int bs, i, j, k, pad = 0, ret, mac_size = 0;
747 : const EVP_CIPHER *enc;
748 :
749 19000 : if (send) {
750 9702 : if (EVP_MD_CTX_md(s->write_hash)) {
751 0 : int n = EVP_MD_CTX_size(s->write_hash);
752 0 : OPENSSL_assert(n >= 0);
753 : }
754 9698 : ds = s->enc_write_ctx;
755 9698 : rec = &(s->s3->wrec);
756 9698 : if (s->enc_write_ctx == NULL)
757 : enc = NULL;
758 : else {
759 : int ivlen;
760 6363 : enc = EVP_CIPHER_CTX_cipher(s->enc_write_ctx);
761 : /* For TLSv1.1 and later explicit IV */
762 6363 : if (SSL_USE_EXPLICIT_IV(s)
763 6363 : && EVP_CIPHER_mode(enc) == EVP_CIPH_CBC_MODE)
764 0 : ivlen = EVP_CIPHER_iv_length(enc);
765 : else
766 : ivlen = 0;
767 6363 : if (ivlen > 1) {
768 0 : if (rec->data != rec->input)
769 : /*
770 : * we can't write into the input stream: Can this ever
771 : * happen?? (steve)
772 : */
773 0 : fprintf(stderr,
774 : "%s:%d: rec->data != rec->input\n",
775 : __FILE__, __LINE__);
776 0 : else if (RAND_bytes(rec->input, ivlen) <= 0)
777 : return -1;
778 : }
779 : }
780 : } else {
781 9298 : if (EVP_MD_CTX_md(s->read_hash)) {
782 0 : int n = EVP_MD_CTX_size(s->read_hash);
783 0 : OPENSSL_assert(n >= 0);
784 : }
785 9298 : ds = s->enc_read_ctx;
786 9298 : rec = &(s->s3->rrec);
787 9298 : if (s->enc_read_ctx == NULL)
788 : enc = NULL;
789 : else
790 5981 : enc = EVP_CIPHER_CTX_cipher(s->enc_read_ctx);
791 : }
792 :
793 : #ifdef KSSL_DEBUG
794 : fprintf(stderr, "tls1_enc(%d)\n", send);
795 : #endif /* KSSL_DEBUG */
796 :
797 18996 : if ((s->session == NULL) || (ds == NULL) || (enc == NULL)) {
798 6656 : memmove(rec->data, rec->input, rec->length);
799 6656 : rec->input = rec->data;
800 6656 : ret = 1;
801 : } else {
802 12340 : l = rec->length;
803 12340 : bs = EVP_CIPHER_block_size(ds->cipher);
804 :
805 12340 : if (EVP_CIPHER_flags(ds->cipher) & EVP_CIPH_FLAG_AEAD_CIPHER) {
806 : unsigned char buf[EVP_AEAD_TLS1_AAD_LEN], *seq;
807 :
808 12338 : seq = send ? s->s3->write_sequence : s->s3->read_sequence;
809 :
810 12338 : if (SSL_IS_DTLS(s)) {
811 : unsigned char dtlsseq[9], *p = dtlsseq;
812 :
813 0 : s2n(send ? s->d1->w_epoch : s->d1->r_epoch, p);
814 0 : memcpy(p, &seq[2], 6);
815 : memcpy(buf, dtlsseq, 8);
816 : } else {
817 : memcpy(buf, seq, 8);
818 12338 : for (i = 7; i >= 0; i--) { /* increment */
819 12338 : ++seq[i];
820 12338 : if (seq[i] != 0)
821 : break;
822 : }
823 : }
824 :
825 12338 : buf[8] = rec->type;
826 12338 : buf[9] = (unsigned char)(s->version >> 8);
827 12338 : buf[10] = (unsigned char)(s->version);
828 12338 : buf[11] = rec->length >> 8;
829 12338 : buf[12] = rec->length & 0xff;
830 12338 : pad = EVP_CIPHER_CTX_ctrl(ds, EVP_CTRL_AEAD_TLS1_AAD,
831 : EVP_AEAD_TLS1_AAD_LEN, buf);
832 12342 : if (pad <= 0)
833 0 : return -1;
834 12342 : if (send) {
835 6363 : l += pad;
836 6363 : rec->length += pad;
837 : }
838 0 : } else if ((bs != 1) && send) {
839 0 : i = bs - ((int)l % bs);
840 :
841 : /* Add weird padding of upto 256 bytes */
842 :
843 : /* we need to add 'i' padding bytes of value j */
844 0 : j = i - 1;
845 0 : if (s->options & SSL_OP_TLS_BLOCK_PADDING_BUG) {
846 0 : if (s->s3->flags & TLS1_FLAGS_TLS_PADDING_BUG)
847 : j++;
848 : }
849 0 : for (k = (int)l; k < (int)(l + i); k++)
850 0 : rec->input[k] = j;
851 0 : l += i;
852 0 : rec->length += i;
853 : }
854 : #ifdef KSSL_DEBUG
855 : {
856 : unsigned long ui;
857 : fprintf(stderr,
858 : "EVP_Cipher(ds=%p,rec->data=%p,rec->input=%p,l=%ld) ==>\n",
859 : ds, rec->data, rec->input, l);
860 : fprintf(stderr,
861 : "\tEVP_CIPHER_CTX: %d buf_len, %d key_len [%lu %lu], %d iv_len\n",
862 : ds->buf_len, ds->cipher->key_len, DES_KEY_SZ,
863 : DES_SCHEDULE_SZ, ds->cipher->iv_len);
864 : fprintf(stderr, "\t\tIV: ");
865 : for (i = 0; i < ds->cipher->iv_len; i++)
866 : fprintf(stderr, "%02X", ds->iv[i]);
867 : fprintf(stderr, "\n");
868 : fprintf(stderr, "\trec->input=");
869 : for (ui = 0; ui < l; ui++)
870 : fprintf(stderr, " %02x", rec->input[ui]);
871 : fprintf(stderr, "\n");
872 : }
873 : #endif /* KSSL_DEBUG */
874 :
875 12342 : if (!send) {
876 5982 : if (l == 0 || l % bs != 0)
877 : return 0;
878 : }
879 :
880 12342 : i = EVP_Cipher(ds, rec->data, rec->input, l);
881 12342 : if ((EVP_CIPHER_flags(ds->cipher) & EVP_CIPH_FLAG_CUSTOM_CIPHER)
882 : ? (i < 0)
883 : : (i == 0))
884 : return -1; /* AEAD can fail to verify MAC */
885 12342 : if (EVP_CIPHER_mode(enc) == EVP_CIPH_GCM_MODE && !send) {
886 5981 : rec->data += EVP_GCM_TLS_EXPLICIT_IV_LEN;
887 5981 : rec->input += EVP_GCM_TLS_EXPLICIT_IV_LEN;
888 5981 : rec->length -= EVP_GCM_TLS_EXPLICIT_IV_LEN;
889 : }
890 : #ifdef KSSL_DEBUG
891 : {
892 : unsigned long i;
893 : fprintf(stderr, "\trec->data=");
894 : for (i = 0; i < l; i++)
895 : fprintf(stderr, " %02x", rec->data[i]);
896 : fprintf(stderr, "\n");
897 : }
898 : #endif /* KSSL_DEBUG */
899 :
900 : ret = 1;
901 12342 : if (EVP_MD_CTX_md(s->read_hash) != NULL)
902 0 : mac_size = EVP_MD_CTX_size(s->read_hash);
903 12343 : if ((bs != 1) && !send)
904 0 : ret = tls1_cbc_remove_padding(s, rec, bs, mac_size);
905 12343 : if (pad && !send)
906 5982 : rec->length -= pad;
907 : }
908 18999 : return ret;
909 : }
910 :
911 0 : int tls1_cert_verify_mac(SSL *s, int md_nid, unsigned char *out)
912 : {
913 : unsigned int ret;
914 : EVP_MD_CTX ctx, *d = NULL;
915 : int i;
916 :
917 0 : if (s->s3->handshake_buffer)
918 0 : if (!ssl3_digest_cached_records(s))
919 : return 0;
920 :
921 0 : for (i = 0; i < SSL_MAX_DIGEST; i++) {
922 0 : if (s->s3->handshake_dgst[i]
923 0 : && EVP_MD_CTX_type(s->s3->handshake_dgst[i]) == md_nid) {
924 0 : d = s->s3->handshake_dgst[i];
925 0 : break;
926 : }
927 : }
928 0 : if (!d) {
929 0 : SSLerr(SSL_F_TLS1_CERT_VERIFY_MAC, SSL_R_NO_REQUIRED_DIGEST);
930 0 : return 0;
931 : }
932 :
933 0 : EVP_MD_CTX_init(&ctx);
934 0 : EVP_MD_CTX_copy_ex(&ctx, d);
935 0 : EVP_DigestFinal_ex(&ctx, out, &ret);
936 0 : EVP_MD_CTX_cleanup(&ctx);
937 0 : return ((int)ret);
938 : }
939 :
940 2201 : int tls1_final_finish_mac(SSL *s,
941 : const char *str, int slen, unsigned char *out)
942 : {
943 : unsigned int i;
944 : EVP_MD_CTX ctx;
945 : unsigned char buf[2 * EVP_MAX_MD_SIZE];
946 : unsigned char *q, buf2[12];
947 : int idx;
948 : long mask;
949 : int err = 0;
950 : const EVP_MD *md;
951 :
952 : q = buf;
953 :
954 2201 : if (s->s3->handshake_buffer)
955 0 : if (!ssl3_digest_cached_records(s))
956 : return 0;
957 :
958 2201 : EVP_MD_CTX_init(&ctx);
959 :
960 15407 : for (idx = 0; ssl_get_handshake_digest(idx, &mask, &md); idx++) {
961 13206 : if (mask & ssl_get_algorithm2(s)) {
962 2201 : int hashsize = EVP_MD_size(md);
963 2201 : EVP_MD_CTX *hdgst = s->s3->handshake_dgst[idx];
964 2201 : if (!hdgst || hashsize < 0
965 2201 : || hashsize > (int)(sizeof buf - (size_t)(q - buf))) {
966 : /*
967 : * internal error: 'buf' is too small for this cipersuite!
968 : */
969 : err = 1;
970 : } else {
971 4402 : if (!EVP_MD_CTX_copy_ex(&ctx, hdgst) ||
972 4402 : !EVP_DigestFinal_ex(&ctx, q, &i) ||
973 2201 : (i != (unsigned int)hashsize))
974 : err = 1;
975 2201 : q += hashsize;
976 : }
977 : }
978 : }
979 :
980 4402 : if (!tls1_PRF(ssl_get_algorithm2(s),
981 2201 : str, slen, buf, (int)(q - buf), NULL, 0, NULL, 0, NULL, 0,
982 4402 : s->session->master_key, s->session->master_key_length,
983 : out, buf2, sizeof buf2))
984 : err = 1;
985 2201 : EVP_MD_CTX_cleanup(&ctx);
986 :
987 2201 : OPENSSL_cleanse(buf, (int)(q - buf));
988 2201 : OPENSSL_cleanse(buf2, sizeof(buf2));
989 2201 : if (err)
990 : return 0;
991 : else
992 2201 : return sizeof buf2;
993 : }
994 :
995 0 : int tls1_mac(SSL *ssl, unsigned char *md, int send)
996 : {
997 : SSL3_RECORD *rec;
998 : unsigned char *seq;
999 : EVP_MD_CTX *hash;
1000 : size_t md_size, orig_len;
1001 : int i;
1002 : EVP_MD_CTX hmac, *mac_ctx;
1003 : unsigned char header[13];
1004 0 : int stream_mac = (send ? (ssl->mac_flags & SSL_MAC_FLAG_WRITE_MAC_STREAM)
1005 0 : : (ssl->mac_flags & SSL_MAC_FLAG_READ_MAC_STREAM));
1006 : int t;
1007 :
1008 0 : if (send) {
1009 0 : rec = &(ssl->s3->wrec);
1010 0 : seq = &(ssl->s3->write_sequence[0]);
1011 0 : hash = ssl->write_hash;
1012 : } else {
1013 0 : rec = &(ssl->s3->rrec);
1014 0 : seq = &(ssl->s3->read_sequence[0]);
1015 0 : hash = ssl->read_hash;
1016 : }
1017 :
1018 0 : t = EVP_MD_CTX_size(hash);
1019 0 : OPENSSL_assert(t >= 0);
1020 0 : md_size = t;
1021 :
1022 : /* I should fix this up TLS TLS TLS TLS TLS XXXXXXXX */
1023 0 : if (stream_mac) {
1024 : mac_ctx = hash;
1025 : } else {
1026 0 : if (!EVP_MD_CTX_copy(&hmac, hash))
1027 : return -1;
1028 : mac_ctx = &hmac;
1029 : }
1030 :
1031 0 : if (SSL_IS_DTLS(ssl)) {
1032 : unsigned char dtlsseq[8], *p = dtlsseq;
1033 :
1034 0 : s2n(send ? ssl->d1->w_epoch : ssl->d1->r_epoch, p);
1035 0 : memcpy(p, &seq[2], 6);
1036 :
1037 : memcpy(header, dtlsseq, 8);
1038 : } else
1039 : memcpy(header, seq, 8);
1040 :
1041 : /*
1042 : * kludge: tls1_cbc_remove_padding passes padding length in rec->type
1043 : */
1044 0 : orig_len = rec->length + md_size + ((unsigned int)rec->type >> 8);
1045 0 : rec->type &= 0xff;
1046 :
1047 0 : header[8] = rec->type;
1048 0 : header[9] = (unsigned char)(ssl->version >> 8);
1049 0 : header[10] = (unsigned char)(ssl->version);
1050 0 : header[11] = (rec->length) >> 8;
1051 0 : header[12] = (rec->length) & 0xff;
1052 :
1053 0 : if (!send &&
1054 0 : EVP_CIPHER_CTX_mode(ssl->enc_read_ctx) == EVP_CIPH_CBC_MODE &&
1055 0 : ssl3_cbc_record_digest_supported(mac_ctx)) {
1056 : /*
1057 : * This is a CBC-encrypted record. We must avoid leaking any
1058 : * timing-side channel information about how many blocks of data we
1059 : * are hashing because that gives an attacker a timing-oracle.
1060 : */
1061 : /* Final param == not SSLv3 */
1062 0 : ssl3_cbc_digest_record(mac_ctx,
1063 : md, &md_size,
1064 0 : header, rec->input,
1065 0 : rec->length + md_size, orig_len,
1066 0 : ssl->s3->read_mac_secret,
1067 0 : ssl->s3->read_mac_secret_size, 0);
1068 : } else {
1069 0 : EVP_DigestSignUpdate(mac_ctx, header, sizeof(header));
1070 0 : EVP_DigestSignUpdate(mac_ctx, rec->input, rec->length);
1071 0 : t = EVP_DigestSignFinal(mac_ctx, md, &md_size);
1072 0 : OPENSSL_assert(t > 0);
1073 : #ifdef OPENSSL_FIPS
1074 : if (!send && FIPS_mode())
1075 : tls_fips_digest_extra(ssl->enc_read_ctx,
1076 : mac_ctx, rec->input, rec->length, orig_len);
1077 : #endif
1078 : }
1079 :
1080 0 : if (!stream_mac)
1081 0 : EVP_MD_CTX_cleanup(&hmac);
1082 : #ifdef TLS_DEBUG
1083 : fprintf(stderr, "seq=");
1084 : {
1085 : int z;
1086 : for (z = 0; z < 8; z++)
1087 : fprintf(stderr, "%02X ", seq[z]);
1088 : fprintf(stderr, "\n");
1089 : }
1090 : fprintf(stderr, "rec=");
1091 : {
1092 : unsigned int z;
1093 : for (z = 0; z < rec->length; z++)
1094 : fprintf(stderr, "%02X ", rec->data[z]);
1095 : fprintf(stderr, "\n");
1096 : }
1097 : #endif
1098 :
1099 0 : if (!SSL_IS_DTLS(ssl)) {
1100 0 : for (i = 7; i >= 0; i--) {
1101 0 : ++seq[i];
1102 0 : if (seq[i] != 0)
1103 : break;
1104 : }
1105 : }
1106 : #ifdef TLS_DEBUG
1107 : {
1108 : unsigned int z;
1109 : for (z = 0; z < md_size; z++)
1110 : fprintf(stderr, "%02X ", md[z]);
1111 : fprintf(stderr, "\n");
1112 : }
1113 : #endif
1114 0 : return (md_size);
1115 : }
1116 :
1117 737 : int tls1_generate_master_secret(SSL *s, unsigned char *out, unsigned char *p,
1118 : int len)
1119 : {
1120 : unsigned char buff[SSL_MAX_MASTER_KEY_LENGTH];
1121 : const void *co = NULL, *so = NULL;
1122 : int col = 0, sol = 0;
1123 :
1124 : #ifdef KSSL_DEBUG
1125 : fprintf(stderr, "tls1_generate_master_secret(%p,%p, %p, %d)\n", s, out, p,
1126 : len);
1127 : #endif /* KSSL_DEBUG */
1128 :
1129 : #ifdef TLSEXT_TYPE_opaque_prf_input
1130 : if (s->s3->client_opaque_prf_input != NULL
1131 : && s->s3->server_opaque_prf_input != NULL
1132 : && s->s3->client_opaque_prf_input_len > 0
1133 : && s->s3->client_opaque_prf_input_len ==
1134 : s->s3->server_opaque_prf_input_len) {
1135 : co = s->s3->client_opaque_prf_input;
1136 : col = s->s3->server_opaque_prf_input_len;
1137 : so = s->s3->server_opaque_prf_input;
1138 : /*
1139 : * must be same as col (see
1140 : * draft-resc-00.txts-opaque-prf-input-00.txt, section 3.1)
1141 : */
1142 : sol = s->s3->client_opaque_prf_input_len;
1143 : }
1144 : #endif
1145 :
1146 737 : tls1_PRF(ssl_get_algorithm2(s),
1147 : TLS_MD_MASTER_SECRET_CONST, TLS_MD_MASTER_SECRET_CONST_SIZE,
1148 737 : s->s3->client_random, SSL3_RANDOM_SIZE,
1149 : co, col,
1150 737 : s->s3->server_random, SSL3_RANDOM_SIZE,
1151 737 : so, sol, p, len, s->session->master_key, buff, sizeof buff);
1152 737 : OPENSSL_cleanse(buff, sizeof buff);
1153 : #ifdef SSL_DEBUG
1154 : fprintf(stderr, "Premaster Secret:\n");
1155 : BIO_dump_fp(stderr, (char *)p, len);
1156 : fprintf(stderr, "Client Random:\n");
1157 : BIO_dump_fp(stderr, (char *)s->s3->client_random, SSL3_RANDOM_SIZE);
1158 : fprintf(stderr, "Server Random:\n");
1159 : BIO_dump_fp(stderr, (char *)s->s3->server_random, SSL3_RANDOM_SIZE);
1160 : fprintf(stderr, "Master Secret:\n");
1161 : BIO_dump_fp(stderr, (char *)s->session->master_key,
1162 : SSL3_MASTER_SECRET_SIZE);
1163 : #endif
1164 :
1165 : #ifdef OPENSSL_SSL_TRACE_CRYPTO
1166 : if (s->msg_callback) {
1167 : s->msg_callback(2, s->version, TLS1_RT_CRYPTO_PREMASTER,
1168 : p, len, s, s->msg_callback_arg);
1169 : s->msg_callback(2, s->version, TLS1_RT_CRYPTO_CLIENT_RANDOM,
1170 : s->s3->client_random, SSL3_RANDOM_SIZE,
1171 : s, s->msg_callback_arg);
1172 : s->msg_callback(2, s->version, TLS1_RT_CRYPTO_SERVER_RANDOM,
1173 : s->s3->server_random, SSL3_RANDOM_SIZE,
1174 : s, s->msg_callback_arg);
1175 : s->msg_callback(2, s->version, TLS1_RT_CRYPTO_MASTER,
1176 : s->session->master_key,
1177 : SSL3_MASTER_SECRET_SIZE, s, s->msg_callback_arg);
1178 : }
1179 : #endif
1180 :
1181 : #ifdef KSSL_DEBUG
1182 : fprintf(stderr, "tls1_generate_master_secret() complete\n");
1183 : #endif /* KSSL_DEBUG */
1184 737 : return (SSL3_MASTER_SECRET_SIZE);
1185 : }
1186 :
1187 0 : int tls1_export_keying_material(SSL *s, unsigned char *out, size_t olen,
1188 : const char *label, size_t llen,
1189 : const unsigned char *context,
1190 : size_t contextlen, int use_context)
1191 : {
1192 : unsigned char *buff;
1193 : unsigned char *val = NULL;
1194 : size_t vallen, currentvalpos;
1195 : int rv;
1196 :
1197 : #ifdef KSSL_DEBUG
1198 : fprintf(stderr, "tls1_export_keying_material(%p,%p,%lu,%s,%lu,%p,%lu)\n",
1199 : s, out, olen, label, llen, context, contextlen);
1200 : #endif /* KSSL_DEBUG */
1201 :
1202 0 : buff = OPENSSL_malloc(olen);
1203 0 : if (buff == NULL)
1204 : goto err2;
1205 :
1206 : /*
1207 : * construct PRF arguments we construct the PRF argument ourself rather
1208 : * than passing separate values into the TLS PRF to ensure that the
1209 : * concatenation of values does not create a prohibited label.
1210 : */
1211 0 : vallen = llen + SSL3_RANDOM_SIZE * 2;
1212 0 : if (use_context) {
1213 0 : vallen += 2 + contextlen;
1214 : }
1215 :
1216 0 : val = OPENSSL_malloc(vallen);
1217 0 : if (val == NULL)
1218 : goto err2;
1219 : currentvalpos = 0;
1220 : memcpy(val + currentvalpos, (unsigned char *)label, llen);
1221 : currentvalpos += llen;
1222 0 : memcpy(val + currentvalpos, s->s3->client_random, SSL3_RANDOM_SIZE);
1223 0 : currentvalpos += SSL3_RANDOM_SIZE;
1224 0 : memcpy(val + currentvalpos, s->s3->server_random, SSL3_RANDOM_SIZE);
1225 : currentvalpos += SSL3_RANDOM_SIZE;
1226 :
1227 0 : if (use_context) {
1228 0 : val[currentvalpos] = (contextlen >> 8) & 0xff;
1229 0 : currentvalpos++;
1230 0 : val[currentvalpos] = contextlen & 0xff;
1231 0 : currentvalpos++;
1232 0 : if ((contextlen > 0) || (context != NULL)) {
1233 0 : memcpy(val + currentvalpos, context, contextlen);
1234 : }
1235 : }
1236 :
1237 : /*
1238 : * disallow prohibited labels note that SSL3_RANDOM_SIZE > max(prohibited
1239 : * label len) = 15, so size of val > max(prohibited label len) = 15 and
1240 : * the comparisons won't have buffer overflow
1241 : */
1242 0 : if (memcmp(val, TLS_MD_CLIENT_FINISH_CONST,
1243 : TLS_MD_CLIENT_FINISH_CONST_SIZE) == 0)
1244 : goto err1;
1245 0 : if (memcmp(val, TLS_MD_SERVER_FINISH_CONST,
1246 : TLS_MD_SERVER_FINISH_CONST_SIZE) == 0)
1247 : goto err1;
1248 0 : if (memcmp(val, TLS_MD_MASTER_SECRET_CONST,
1249 : TLS_MD_MASTER_SECRET_CONST_SIZE) == 0)
1250 : goto err1;
1251 0 : if (memcmp(val, TLS_MD_KEY_EXPANSION_CONST,
1252 : TLS_MD_KEY_EXPANSION_CONST_SIZE) == 0)
1253 : goto err1;
1254 :
1255 0 : rv = tls1_PRF(ssl_get_algorithm2(s),
1256 : val, vallen,
1257 : NULL, 0,
1258 : NULL, 0,
1259 : NULL, 0,
1260 : NULL, 0,
1261 0 : s->session->master_key, s->session->master_key_length,
1262 : out, buff, olen);
1263 0 : OPENSSL_cleanse(val, vallen);
1264 0 : OPENSSL_cleanse(buff, olen);
1265 :
1266 : #ifdef KSSL_DEBUG
1267 : fprintf(stderr, "tls1_export_keying_material() complete\n");
1268 : #endif /* KSSL_DEBUG */
1269 0 : goto ret;
1270 : err1:
1271 0 : SSLerr(SSL_F_TLS1_EXPORT_KEYING_MATERIAL,
1272 : SSL_R_TLS_ILLEGAL_EXPORTER_LABEL);
1273 : rv = 0;
1274 0 : goto ret;
1275 : err2:
1276 0 : SSLerr(SSL_F_TLS1_EXPORT_KEYING_MATERIAL, ERR_R_MALLOC_FAILURE);
1277 : rv = 0;
1278 : ret:
1279 0 : if (buff != NULL)
1280 0 : OPENSSL_free(buff);
1281 0 : if (val != NULL)
1282 0 : OPENSSL_free(val);
1283 0 : return (rv);
1284 : }
1285 :
1286 0 : int tls1_alert_code(int code)
1287 : {
1288 : switch (code) {
1289 : case SSL_AD_CLOSE_NOTIFY:
1290 : return (SSL3_AD_CLOSE_NOTIFY);
1291 : case SSL_AD_UNEXPECTED_MESSAGE:
1292 : return (SSL3_AD_UNEXPECTED_MESSAGE);
1293 : case SSL_AD_BAD_RECORD_MAC:
1294 : return (SSL3_AD_BAD_RECORD_MAC);
1295 : case SSL_AD_DECRYPTION_FAILED:
1296 : return (TLS1_AD_DECRYPTION_FAILED);
1297 : case SSL_AD_RECORD_OVERFLOW:
1298 : return (TLS1_AD_RECORD_OVERFLOW);
1299 : case SSL_AD_DECOMPRESSION_FAILURE:
1300 : return (SSL3_AD_DECOMPRESSION_FAILURE);
1301 : case SSL_AD_HANDSHAKE_FAILURE:
1302 : return (SSL3_AD_HANDSHAKE_FAILURE);
1303 : case SSL_AD_NO_CERTIFICATE:
1304 : return (-1);
1305 : case SSL_AD_BAD_CERTIFICATE:
1306 : return (SSL3_AD_BAD_CERTIFICATE);
1307 : case SSL_AD_UNSUPPORTED_CERTIFICATE:
1308 : return (SSL3_AD_UNSUPPORTED_CERTIFICATE);
1309 : case SSL_AD_CERTIFICATE_REVOKED:
1310 : return (SSL3_AD_CERTIFICATE_REVOKED);
1311 : case SSL_AD_CERTIFICATE_EXPIRED:
1312 : return (SSL3_AD_CERTIFICATE_EXPIRED);
1313 : case SSL_AD_CERTIFICATE_UNKNOWN:
1314 : return (SSL3_AD_CERTIFICATE_UNKNOWN);
1315 : case SSL_AD_ILLEGAL_PARAMETER:
1316 : return (SSL3_AD_ILLEGAL_PARAMETER);
1317 : case SSL_AD_UNKNOWN_CA:
1318 : return (TLS1_AD_UNKNOWN_CA);
1319 : case SSL_AD_ACCESS_DENIED:
1320 : return (TLS1_AD_ACCESS_DENIED);
1321 : case SSL_AD_DECODE_ERROR:
1322 : return (TLS1_AD_DECODE_ERROR);
1323 : case SSL_AD_DECRYPT_ERROR:
1324 : return (TLS1_AD_DECRYPT_ERROR);
1325 : case SSL_AD_EXPORT_RESTRICTION:
1326 : return (TLS1_AD_EXPORT_RESTRICTION);
1327 : case SSL_AD_PROTOCOL_VERSION:
1328 : return (TLS1_AD_PROTOCOL_VERSION);
1329 : case SSL_AD_INSUFFICIENT_SECURITY:
1330 : return (TLS1_AD_INSUFFICIENT_SECURITY);
1331 : case SSL_AD_INTERNAL_ERROR:
1332 : return (TLS1_AD_INTERNAL_ERROR);
1333 : case SSL_AD_USER_CANCELLED:
1334 : return (TLS1_AD_USER_CANCELLED);
1335 : case SSL_AD_NO_RENEGOTIATION:
1336 : return (TLS1_AD_NO_RENEGOTIATION);
1337 : case SSL_AD_UNSUPPORTED_EXTENSION:
1338 : return (TLS1_AD_UNSUPPORTED_EXTENSION);
1339 : case SSL_AD_CERTIFICATE_UNOBTAINABLE:
1340 : return (TLS1_AD_CERTIFICATE_UNOBTAINABLE);
1341 : case SSL_AD_UNRECOGNIZED_NAME:
1342 : return (TLS1_AD_UNRECOGNIZED_NAME);
1343 : case SSL_AD_BAD_CERTIFICATE_STATUS_RESPONSE:
1344 : return (TLS1_AD_BAD_CERTIFICATE_STATUS_RESPONSE);
1345 : case SSL_AD_BAD_CERTIFICATE_HASH_VALUE:
1346 : return (TLS1_AD_BAD_CERTIFICATE_HASH_VALUE);
1347 : case SSL_AD_UNKNOWN_PSK_IDENTITY:
1348 : return (TLS1_AD_UNKNOWN_PSK_IDENTITY);
1349 : case SSL_AD_INAPPROPRIATE_FALLBACK:
1350 : return (TLS1_AD_INAPPROPRIATE_FALLBACK);
1351 : #if 0
1352 : /* not appropriate for TLS, not used for DTLS */
1353 : case DTLS1_AD_MISSING_HANDSHAKE_MESSAGE:
1354 : return (DTLS1_AD_MISSING_HANDSHAKE_MESSAGE);
1355 : #endif
1356 : default:
1357 : return (-1);
1358 : }
1359 : }
|
