Import OpenSSL-0.9.8g.
[dragonfly.git] / crypto / openssl-0.9 / ssl / t1_lib.c
CommitLineData
56276539
SS
1/* ssl/t1_lib.c */
2/* Copyright (C) 1995-1998 Eric Young (eay@cryptsoft.com)
3 * All rights reserved.
4 *
5 * This package is an SSL implementation written
6 * by Eric Young (eay@cryptsoft.com).
7 * The implementation was written so as to conform with Netscapes SSL.
8 *
9 * This library is free for commercial and non-commercial use as long as
10 * the following conditions are aheared to. The following conditions
11 * apply to all code found in this distribution, be it the RC4, RSA,
12 * lhash, DES, etc., code; not just the SSL code. The SSL documentation
13 * included with this distribution is covered by the same copyright terms
14 * except that the holder is Tim Hudson (tjh@cryptsoft.com).
15 *
16 * Copyright remains Eric Young's, and as such any Copyright notices in
17 * the code are not to be removed.
18 * If this package is used in a product, Eric Young should be given attribution
19 * as the author of the parts of the library used.
20 * This can be in the form of a textual message at program startup or
21 * in documentation (online or textual) provided with the package.
22 *
23 * Redistribution and use in source and binary forms, with or without
24 * modification, are permitted provided that the following conditions
25 * are met:
26 * 1. Redistributions of source code must retain the copyright
27 * notice, this list of conditions and the following disclaimer.
28 * 2. Redistributions in binary form must reproduce the above copyright
29 * notice, this list of conditions and the following disclaimer in the
30 * documentation and/or other materials provided with the distribution.
31 * 3. All advertising materials mentioning features or use of this software
32 * must display the following acknowledgement:
33 * "This product includes cryptographic software written by
34 * Eric Young (eay@cryptsoft.com)"
35 * The word 'cryptographic' can be left out if the rouines from the library
36 * being used are not cryptographic related :-).
37 * 4. If you include any Windows specific code (or a derivative thereof) from
38 * the apps directory (application code) you must include an acknowledgement:
39 * "This product includes software written by Tim Hudson (tjh@cryptsoft.com)"
40 *
41 * THIS SOFTWARE IS PROVIDED BY ERIC YOUNG ``AS IS'' AND
42 * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
43 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
44 * ARE DISCLAIMED. IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE
45 * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
46 * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
47 * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
48 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
49 * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
50 * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
51 * SUCH DAMAGE.
52 *
53 * The licence and distribution terms for any publically available version or
54 * derivative of this code cannot be changed. i.e. this code cannot simply be
55 * copied and put under another distribution licence
56 * [including the GNU Public Licence.]
57 */
58
59#include <stdio.h>
60#include <openssl/objects.h>
e6bc27f5
PA
61#include <openssl/evp.h>
62#include <openssl/hmac.h>
56276539
SS
63#include "ssl_locl.h"
64
e40c9513 65const char tls1_version_str[]="TLSv1" OPENSSL_VERSION_PTEXT;
56276539 66
e6bc27f5
PA
67#ifndef OPENSSL_NO_TLSEXT
68static int tls_decrypt_ticket(SSL *s, const unsigned char *tick, int ticklen,
69 const unsigned char *sess_id, int sesslen,
70 SSL_SESSION **psess);
71#endif
72
5bd86ce5 73SSL3_ENC_METHOD TLSv1_enc_data={
56276539
SS
74 tls1_enc,
75 tls1_mac,
76 tls1_setup_key_block,
77 tls1_generate_master_secret,
78 tls1_change_cipher_state,
79 tls1_final_finish_mac,
80 TLS1_FINISH_MAC_LENGTH,
81 tls1_cert_verify_mac,
82 TLS_MD_CLIENT_FINISH_CONST,TLS_MD_CLIENT_FINISH_CONST_SIZE,
83 TLS_MD_SERVER_FINISH_CONST,TLS_MD_SERVER_FINISH_CONST_SIZE,
84 tls1_alert_code,
85 };
86
5bd86ce5 87long tls1_default_timeout(void)
56276539
SS
88 {
89 /* 2 hours, the 24 hours mentioned in the TLSv1 spec
90 * is way too long for http, the cache would over fill */
91 return(60*60*2);
92 }
93
5bd86ce5
SS
94IMPLEMENT_tls1_meth_func(tlsv1_base_method,
95 ssl_undefined_function,
96 ssl_undefined_function,
97 ssl_bad_method)
56276539
SS
98
99int tls1_new(SSL *s)
100 {
101 if (!ssl3_new(s)) return(0);
102 s->method->ssl_clear(s);
103 return(1);
104 }
105
106void tls1_free(SSL *s)
107 {
108 ssl3_free(s);
109 }
110
111void tls1_clear(SSL *s)
112 {
113 ssl3_clear(s);
114 s->version=TLS1_VERSION;
115 }
116
117#if 0
118long tls1_ctrl(SSL *s, int cmd, long larg, char *parg)
119 {
120 return(0);
121 }
122
123long tls1_callback_ctrl(SSL *s, int cmd, void *(*fp)())
124 {
125 return(0);
126 }
127#endif
e6bc27f5
PA
128
129#ifndef OPENSSL_NO_TLSEXT
130unsigned char *ssl_add_clienthello_tlsext(SSL *s, unsigned char *p, unsigned char *limit)
131 {
132 int extdatalen=0;
133 unsigned char *ret = p;
134
135 ret+=2;
136
137 if (ret>=limit) return NULL; /* this really never occurs, but ... */
138
139 if (s->tlsext_hostname != NULL)
140 {
141 /* Add TLS extension servername to the Client Hello message */
142 unsigned long size_str;
143 long lenmax;
144
145 /* check for enough space.
146 4 for the servername type and entension length
147 2 for servernamelist length
148 1 for the hostname type
149 2 for hostname length
150 + hostname length
151 */
152
153 if ((lenmax = limit - ret - 9) < 0
154 || (size_str = strlen(s->tlsext_hostname)) > (unsigned long)lenmax)
155 return NULL;
156
157 /* extension type and length */
158 s2n(TLSEXT_TYPE_server_name,ret);
159 s2n(size_str+5,ret);
160
161 /* length of servername list */
162 s2n(size_str+3,ret);
163
164 /* hostname type, length and hostname */
165 *(ret++) = (unsigned char) TLSEXT_NAMETYPE_host_name;
166 s2n(size_str,ret);
167 memcpy(ret, s->tlsext_hostname, size_str);
168 ret+=size_str;
169
170 }
171
172 if (!(SSL_get_options(s) & SSL_OP_NO_TICKET))
173 {
174 int ticklen;
175 if (s->session && s->session->tlsext_tick)
176 ticklen = s->session->tlsext_ticklen;
177 else
178 ticklen = 0;
179 /* Check for enough room 2 for extension type, 2 for len
180 * rest for ticket
181 */
182 if (limit - ret - 4 - ticklen < 0)
183 return NULL;
184 s2n(TLSEXT_TYPE_session_ticket,ret);
185 s2n(ticklen,ret);
186 if (ticklen)
187 {
188 memcpy(ret, s->session->tlsext_tick, ticklen);
189 ret += ticklen;
190 }
191 }
192
193 if ((extdatalen = ret-p-2)== 0)
194 return p;
195
196 s2n(extdatalen,p);
197 return ret;
198 }
199
200unsigned char *ssl_add_serverhello_tlsext(SSL *s, unsigned char *p, unsigned char *limit)
201 {
202 int extdatalen=0;
203 unsigned char *ret = p;
204
205 ret+=2;
206 if (ret>=limit) return NULL; /* this really never occurs, but ... */
207
208 if (!s->hit && s->servername_done == 1 && s->session->tlsext_hostname != NULL)
209 {
210 if (limit - ret - 4 < 0) return NULL;
211
212 s2n(TLSEXT_TYPE_server_name,ret);
213 s2n(0,ret);
214 }
215
216 if (s->tlsext_ticket_expected
217 && !(SSL_get_options(s) & SSL_OP_NO_TICKET))
218 {
219 if (limit - ret - 4 < 0) return NULL;
220 s2n(TLSEXT_TYPE_session_ticket,ret);
221 s2n(0,ret);
222 }
223
224 if ((extdatalen = ret-p-2)== 0)
225 return p;
226
227 s2n(extdatalen,p);
228 return ret;
229 }
230
231int ssl_parse_clienthello_tlsext(SSL *s, unsigned char **p, unsigned char *d, int n, int *al)
232 {
233 unsigned short type;
234 unsigned short size;
235 unsigned short len;
236 unsigned char *data = *p;
237 s->servername_done = 0;
238
239 if (data >= (d+n-2))
240 return 1;
241 n2s(data,len);
242
243 if (data > (d+n-len))
244 return 1;
245
246 while (data <= (d+n-4))
247 {
248 n2s(data,type);
249 n2s(data,size);
250
251 if (data+size > (d+n))
252 return 1;
253
254 if (s->tlsext_debug_cb)
255 s->tlsext_debug_cb(s, 0, type, data, size,
256 s->tlsext_debug_arg);
257/* The servername extension is treated as follows:
258
259 - Only the hostname type is supported with a maximum length of 255.
260 - The servername is rejected if too long or if it contains zeros,
261 in which case an fatal alert is generated.
262 - The servername field is maintained together with the session cache.
263 - When a session is resumed, the servername call back invoked in order
264 to allow the application to position itself to the right context.
265 - The servername is acknowledged if it is new for a session or when
266 it is identical to a previously used for the same session.
267 Applications can control the behaviour. They can at any time
268 set a 'desirable' servername for a new SSL object. This can be the
269 case for example with HTTPS when a Host: header field is received and
270 a renegotiation is requested. In this case, a possible servername
271 presented in the new client hello is only acknowledged if it matches
272 the value of the Host: field.
273 - Applications must use SSL_OP_NO_SESSION_RESUMPTION_ON_RENEGOTIATION
274 if they provide for changing an explicit servername context for the session,
275 i.e. when the session has been established with a servername extension.
276 - On session reconnect, the servername extension may be absent.
277
278*/
279
280 if (type == TLSEXT_TYPE_server_name)
281 {
282 unsigned char *sdata;
283 int servname_type;
284 int dsize;
285
286 if (size < 2)
287 {
288 *al = SSL_AD_DECODE_ERROR;
289 return 0;
290 }
291 n2s(data,dsize);
292 size -= 2;
293 if (dsize > size )
294 {
295 *al = SSL_AD_DECODE_ERROR;
296 return 0;
297 }
298
299 sdata = data;
300 while (dsize > 3)
301 {
302 servname_type = *(sdata++);
303 n2s(sdata,len);
304 dsize -= 3;
305
306 if (len > dsize)
307 {
308 *al = SSL_AD_DECODE_ERROR;
309 return 0;
310 }
311 if (s->servername_done == 0)
312 switch (servname_type)
313 {
314 case TLSEXT_NAMETYPE_host_name:
315 if (s->session->tlsext_hostname == NULL)
316 {
317 if (len > TLSEXT_MAXLEN_host_name ||
318 ((s->session->tlsext_hostname = OPENSSL_malloc(len+1)) == NULL))
319 {
320 *al = TLS1_AD_UNRECOGNIZED_NAME;
321 return 0;
322 }
323 memcpy(s->session->tlsext_hostname, sdata, len);
324 s->session->tlsext_hostname[len]='\0';
325 if (strlen(s->session->tlsext_hostname) != len) {
326 OPENSSL_free(s->session->tlsext_hostname);
327 *al = TLS1_AD_UNRECOGNIZED_NAME;
328 return 0;
329 }
330 s->servername_done = 1;
331
332 }
333 else
334 s->servername_done = strlen(s->session->tlsext_hostname) == len
335 && strncmp(s->session->tlsext_hostname, (char *)sdata, len) == 0;
336
337 break;
338
339 default:
340 break;
341 }
342
343 dsize -= len;
344 }
345 if (dsize != 0)
346 {
347 *al = SSL_AD_DECODE_ERROR;
348 return 0;
349 }
350
351 }
352 /* session ticket processed earlier */
353
354 data+=size;
355 }
356
357 *p = data;
358 return 1;
359 }
360
361int ssl_parse_serverhello_tlsext(SSL *s, unsigned char **p, unsigned char *d, int n, int *al)
362 {
363 unsigned short type;
364 unsigned short size;
365 unsigned short len;
366 unsigned char *data = *p;
367
368 int tlsext_servername = 0;
369
370 if (data >= (d+n-2))
371 return 1;
372
373 n2s(data,len);
374
375 while(data <= (d+n-4))
376 {
377 n2s(data,type);
378 n2s(data,size);
379
380 if (data+size > (d+n))
381 return 1;
382
383 if (s->tlsext_debug_cb)
384 s->tlsext_debug_cb(s, 1, type, data, size,
385 s->tlsext_debug_arg);
386
387 if (type == TLSEXT_TYPE_server_name)
388 {
389 if (s->tlsext_hostname == NULL || size > 0)
390 {
391 *al = TLS1_AD_UNRECOGNIZED_NAME;
392 return 0;
393 }
394 tlsext_servername = 1;
395 }
396 else if (type == TLSEXT_TYPE_session_ticket)
397 {
398 if ((SSL_get_options(s) & SSL_OP_NO_TICKET)
399 || (size > 0))
400 {
401 *al = TLS1_AD_UNSUPPORTED_EXTENSION;
402 return 0;
403 }
404 s->tlsext_ticket_expected = 1;
405 }
406
407 data+=size;
408 }
409
410 if (data != d+n)
411 {
412 *al = SSL_AD_DECODE_ERROR;
413 return 0;
414 }
415
416 if (!s->hit && tlsext_servername == 1)
417 {
418 if (s->tlsext_hostname)
419 {
420 if (s->session->tlsext_hostname == NULL)
421 {
422 s->session->tlsext_hostname = BUF_strdup(s->tlsext_hostname);
423 if (!s->session->tlsext_hostname)
424 {
425 *al = SSL_AD_UNRECOGNIZED_NAME;
426 return 0;
427 }
428 }
429 else
430 {
431 *al = SSL_AD_DECODE_ERROR;
432 return 0;
433 }
434 }
435 }
436
437 *p = data;
438 return 1;
439 }
440
441int ssl_check_clienthello_tlsext(SSL *s)
442 {
443 int ret=SSL_TLSEXT_ERR_NOACK;
444 int al = SSL_AD_UNRECOGNIZED_NAME;
445
446 if (s->ctx != NULL && s->ctx->tlsext_servername_callback != 0)
447 ret = s->ctx->tlsext_servername_callback(s, &al, s->ctx->tlsext_servername_arg);
448 else if (s->initial_ctx != NULL && s->initial_ctx->tlsext_servername_callback != 0)
449 ret = s->initial_ctx->tlsext_servername_callback(s, &al, s->initial_ctx->tlsext_servername_arg);
450
451 switch (ret)
452 {
453 case SSL_TLSEXT_ERR_ALERT_FATAL:
454 ssl3_send_alert(s,SSL3_AL_FATAL,al);
455 return -1;
456
457 case SSL_TLSEXT_ERR_ALERT_WARNING:
458 ssl3_send_alert(s,SSL3_AL_WARNING,al);
459 return 1;
460
461 case SSL_TLSEXT_ERR_NOACK:
462 s->servername_done=0;
463 default:
464 return 1;
465 }
466 }
467
468int ssl_check_serverhello_tlsext(SSL *s)
469 {
470 int ret=SSL_TLSEXT_ERR_NOACK;
471 int al = SSL_AD_UNRECOGNIZED_NAME;
472
473 if (s->ctx != NULL && s->ctx->tlsext_servername_callback != 0)
474 ret = s->ctx->tlsext_servername_callback(s, &al, s->ctx->tlsext_servername_arg);
475 else if (s->initial_ctx != NULL && s->initial_ctx->tlsext_servername_callback != 0)
476 ret = s->initial_ctx->tlsext_servername_callback(s, &al, s->initial_ctx->tlsext_servername_arg);
477
478 switch (ret)
479 {
480 case SSL_TLSEXT_ERR_ALERT_FATAL:
481 ssl3_send_alert(s,SSL3_AL_FATAL,al);
482 return -1;
483
484 case SSL_TLSEXT_ERR_ALERT_WARNING:
485 ssl3_send_alert(s,SSL3_AL_WARNING,al);
486 return 1;
487
488 case SSL_TLSEXT_ERR_NOACK:
489 s->servername_done=0;
490 default:
491 return 1;
492 }
493 }
494
495/* Since the server cache lookup is done early on in the processing of client
496 * hello and other operations depend on the result we need to handle any TLS
497 * session ticket extension at the same time.
498 */
499
500int tls1_process_ticket(SSL *s, unsigned char *session_id, int len,
501 const unsigned char *limit, SSL_SESSION **ret)
502 {
503 /* Point after session ID in client hello */
504 const unsigned char *p = session_id + len;
505 unsigned short i;
506 if ((s->version <= SSL3_VERSION) || !limit)
507 return 1;
508 if (p >= limit)
509 return -1;
510 /* Skip past cipher list */
511 n2s(p, i);
512 p+= i;
513 if (p >= limit)
514 return -1;
515 /* Skip past compression algorithm list */
516 i = *(p++);
517 p += i;
518 if (p > limit)
519 return -1;
520 /* Now at start of extensions */
521 if ((p + 2) >= limit)
522 return 1;
523 n2s(p, i);
524 while ((p + 4) <= limit)
525 {
526 unsigned short type, size;
527 n2s(p, type);
528 n2s(p, size);
529 if (p + size > limit)
530 return 1;
531 if (type == TLSEXT_TYPE_session_ticket)
532 {
533 /* If tickets disabled indicate cache miss which will
534 * trigger a full handshake
535 */
536 if (SSL_get_options(s) & SSL_OP_NO_TICKET)
537 return 0;
538 /* If zero length not client will accept a ticket
539 * and indicate cache miss to trigger full handshake
540 */
541 if (size == 0)
542 {
543 s->tlsext_ticket_expected = 1;
544 return 0; /* Cache miss */
545 }
546 return tls_decrypt_ticket(s, p, size, session_id, len,
547 ret);
548 }
549 p += size;
550 }
551 return 1;
552 }
553
554static int tls_decrypt_ticket(SSL *s, const unsigned char *etick, int eticklen,
555 const unsigned char *sess_id, int sesslen,
556 SSL_SESSION **psess)
557 {
558 SSL_SESSION *sess;
559 unsigned char *sdec;
560 const unsigned char *p;
561 int slen, mlen;
562 unsigned char tick_hmac[EVP_MAX_MD_SIZE];
563 HMAC_CTX hctx;
564 EVP_CIPHER_CTX ctx;
565 /* Attempt to process session ticket, first conduct sanity and
566 * integrity checks on ticket.
567 */
568 mlen = EVP_MD_size(tlsext_tick_md());
569 eticklen -= mlen;
570 /* Need at least keyname + iv + some encrypted data */
571 if (eticklen < 48)
572 goto tickerr;
573 /* Check key name matches */
574 if (memcmp(etick, s->ctx->tlsext_tick_key_name, 16))
575 goto tickerr;
576 /* Check HMAC of encrypted ticket */
577 HMAC_CTX_init(&hctx);
578 HMAC_Init_ex(&hctx, s->ctx->tlsext_tick_hmac_key, 16,
579 tlsext_tick_md(), NULL);
580 HMAC_Update(&hctx, etick, eticklen);
581 HMAC_Final(&hctx, tick_hmac, NULL);
582 HMAC_CTX_cleanup(&hctx);
583 if (memcmp(tick_hmac, etick + eticklen, mlen))
584 goto tickerr;
585 /* Set p to start of IV */
586 p = etick + 16;
587 EVP_CIPHER_CTX_init(&ctx);
588 /* Attempt to decrypt session data */
589 EVP_DecryptInit_ex(&ctx, EVP_aes_128_cbc(), NULL,
590 s->ctx->tlsext_tick_aes_key, p);
591 /* Move p after IV to start of encrypted ticket, update length */
592 p += 16;
593 eticklen -= 32;
594 sdec = OPENSSL_malloc(eticklen);
595 if (!sdec)
596 {
597 EVP_CIPHER_CTX_cleanup(&ctx);
598 return -1;
599 }
600 EVP_DecryptUpdate(&ctx, sdec, &slen, p, eticklen);
601 if (EVP_DecryptFinal(&ctx, sdec + slen, &mlen) <= 0)
602 goto tickerr;
603 slen += mlen;
604 EVP_CIPHER_CTX_cleanup(&ctx);
605 p = sdec;
606
607 sess = d2i_SSL_SESSION(NULL, &p, slen);
608 OPENSSL_free(sdec);
609 if (sess)
610 {
611 /* The session ID if non-empty is used by some clients to
612 * detect that the ticket has been accepted. So we copy it to
613 * the session structure. If it is empty set length to zero
614 * as required by standard.
615 */
616 if (sesslen)
617 memcpy(sess->session_id, sess_id, sesslen);
618 sess->session_id_length = sesslen;
619 *psess = sess;
96768186 620 s->tlsext_ticket_expected = 0;
e6bc27f5
PA
621 return 1;
622 }
623 /* If session decrypt failure indicate a cache miss and set state to
624 * send a new ticket
625 */
626 tickerr:
627 s->tlsext_ticket_expected = 1;
628 return 0;
629 }
630
631#endif