Merge from vendor branch OPENSSL:
[dragonfly.git] / crypto / openssl-0.9 / ssl / t1_lib.c
1 /* ssl/t1_lib.c */
2 /* Copyright (C) 1995-1998 Eric Young (eay@cryptsoft.com)
3  * All rights reserved.
4  *
5  * This package is an SSL implementation written
6  * by Eric Young (eay@cryptsoft.com).
7  * The implementation was written so as to conform with Netscapes SSL.
8  * 
9  * This library is free for commercial and non-commercial use as long as
10  * the following conditions are aheared to.  The following conditions
11  * apply to all code found in this distribution, be it the RC4, RSA,
12  * lhash, DES, etc., code; not just the SSL code.  The SSL documentation
13  * included with this distribution is covered by the same copyright terms
14  * except that the holder is Tim Hudson (tjh@cryptsoft.com).
15  * 
16  * Copyright remains Eric Young's, and as such any Copyright notices in
17  * the code are not to be removed.
18  * If this package is used in a product, Eric Young should be given attribution
19  * as the author of the parts of the library used.
20  * This can be in the form of a textual message at program startup or
21  * in documentation (online or textual) provided with the package.
22  * 
23  * Redistribution and use in source and binary forms, with or without
24  * modification, are permitted provided that the following conditions
25  * are met:
26  * 1. Redistributions of source code must retain the copyright
27  *    notice, this list of conditions and the following disclaimer.
28  * 2. Redistributions in binary form must reproduce the above copyright
29  *    notice, this list of conditions and the following disclaimer in the
30  *    documentation and/or other materials provided with the distribution.
31  * 3. All advertising materials mentioning features or use of this software
32  *    must display the following acknowledgement:
33  *    "This product includes cryptographic software written by
34  *     Eric Young (eay@cryptsoft.com)"
35  *    The word 'cryptographic' can be left out if the rouines from the library
36  *    being used are not cryptographic related :-).
37  * 4. If you include any Windows specific code (or a derivative thereof) from 
38  *    the apps directory (application code) you must include an acknowledgement:
39  *    "This product includes software written by Tim Hudson (tjh@cryptsoft.com)"
40  * 
41  * THIS SOFTWARE IS PROVIDED BY ERIC YOUNG ``AS IS'' AND
42  * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
43  * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
44  * ARE DISCLAIMED.  IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE
45  * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
46  * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
47  * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
48  * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
49  * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
50  * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
51  * SUCH DAMAGE.
52  * 
53  * The licence and distribution terms for any publically available version or
54  * derivative of this code cannot be changed.  i.e. this code cannot simply be
55  * copied and put under another distribution licence
56  * [including the GNU Public Licence.]
57  */
58
59 #include <stdio.h>
60 #include <openssl/objects.h>
61 #include <openssl/evp.h>
62 #include <openssl/hmac.h>
63 #include "ssl_locl.h"
64
65 const char tls1_version_str[]="TLSv1" OPENSSL_VERSION_PTEXT;
66
67 #ifndef OPENSSL_NO_TLSEXT
68 static int tls_decrypt_ticket(SSL *s, const unsigned char *tick, int ticklen,
69                                 const unsigned char *sess_id, int sesslen,
70                                 SSL_SESSION **psess);
71 #endif
72
73 SSL3_ENC_METHOD TLSv1_enc_data={
74         tls1_enc,
75         tls1_mac,
76         tls1_setup_key_block,
77         tls1_generate_master_secret,
78         tls1_change_cipher_state,
79         tls1_final_finish_mac,
80         TLS1_FINISH_MAC_LENGTH,
81         tls1_cert_verify_mac,
82         TLS_MD_CLIENT_FINISH_CONST,TLS_MD_CLIENT_FINISH_CONST_SIZE,
83         TLS_MD_SERVER_FINISH_CONST,TLS_MD_SERVER_FINISH_CONST_SIZE,
84         tls1_alert_code,
85         };
86
87 long tls1_default_timeout(void)
88         {
89         /* 2 hours, the 24 hours mentioned in the TLSv1 spec
90          * is way too long for http, the cache would over fill */
91         return(60*60*2);
92         }
93
94 IMPLEMENT_tls1_meth_func(tlsv1_base_method,
95                         ssl_undefined_function,
96                         ssl_undefined_function,
97                         ssl_bad_method)
98
99 int tls1_new(SSL *s)
100         {
101         if (!ssl3_new(s)) return(0);
102         s->method->ssl_clear(s);
103         return(1);
104         }
105
106 void tls1_free(SSL *s)
107         {
108         ssl3_free(s);
109         }
110
111 void tls1_clear(SSL *s)
112         {
113         ssl3_clear(s);
114         s->version=TLS1_VERSION;
115         }
116
117 #if 0
118 long tls1_ctrl(SSL *s, int cmd, long larg, char *parg)
119         {
120         return(0);
121         }
122
123 long tls1_callback_ctrl(SSL *s, int cmd, void *(*fp)())
124         {
125         return(0);
126         }
127 #endif
128
129 #ifndef OPENSSL_NO_TLSEXT
130 unsigned char *ssl_add_clienthello_tlsext(SSL *s, unsigned char *p, unsigned char *limit)
131         {
132         int extdatalen=0;
133         unsigned char *ret = p;
134
135         ret+=2;
136
137         if (ret>=limit) return NULL; /* this really never occurs, but ... */
138
139         if (s->tlsext_hostname != NULL)
140                 { 
141                 /* Add TLS extension servername to the Client Hello message */
142                 unsigned long size_str;
143                 long lenmax; 
144
145                 /* check for enough space.
146                    4 for the servername type and entension length
147                    2 for servernamelist length
148                    1 for the hostname type
149                    2 for hostname length
150                    + hostname length 
151                 */
152                    
153                 if ((lenmax = limit - ret - 9) < 0 
154                 || (size_str = strlen(s->tlsext_hostname)) > (unsigned long)lenmax) 
155                         return NULL;
156                         
157                 /* extension type and length */
158                 s2n(TLSEXT_TYPE_server_name,ret); 
159                 s2n(size_str+5,ret);
160                 
161                 /* length of servername list */
162                 s2n(size_str+3,ret);
163         
164                 /* hostname type, length and hostname */
165                 *(ret++) = (unsigned char) TLSEXT_NAMETYPE_host_name;
166                 s2n(size_str,ret);
167                 memcpy(ret, s->tlsext_hostname, size_str);
168                 ret+=size_str;
169
170                 }
171
172         if (!(SSL_get_options(s) & SSL_OP_NO_TICKET))
173                 {
174                 int ticklen;
175                 if (s->session && s->session->tlsext_tick)
176                         ticklen = s->session->tlsext_ticklen;
177                 else
178                         ticklen = 0;
179                 /* Check for enough room 2 for extension type, 2 for len
180                  * rest for ticket
181                  */
182                 if (limit - ret - 4 - ticklen < 0)
183                         return NULL;
184                 s2n(TLSEXT_TYPE_session_ticket,ret); 
185                 s2n(ticklen,ret);
186                 if (ticklen)
187                         {
188                         memcpy(ret, s->session->tlsext_tick, ticklen);
189                         ret += ticklen;
190                         }
191                 }
192
193         if ((extdatalen = ret-p-2)== 0) 
194                 return p;
195
196         s2n(extdatalen,p);
197         return ret;
198         }
199
200 unsigned char *ssl_add_serverhello_tlsext(SSL *s, unsigned char *p, unsigned char *limit)
201         {
202         int extdatalen=0;
203         unsigned char *ret = p;
204
205         ret+=2;
206         if (ret>=limit) return NULL; /* this really never occurs, but ... */
207
208         if (!s->hit && s->servername_done == 1 && s->session->tlsext_hostname != NULL)
209                 { 
210                 if (limit - ret - 4 < 0) return NULL; 
211
212                 s2n(TLSEXT_TYPE_server_name,ret);
213                 s2n(0,ret);
214                 }
215         
216         if (s->tlsext_ticket_expected
217                 && !(SSL_get_options(s) & SSL_OP_NO_TICKET)) 
218                 { 
219                 if (limit - ret - 4 < 0) return NULL; 
220                 s2n(TLSEXT_TYPE_session_ticket,ret);
221                 s2n(0,ret);
222                 }
223                 
224         if ((extdatalen = ret-p-2)== 0) 
225                 return p;
226
227         s2n(extdatalen,p);
228         return ret;
229         }
230
231 int ssl_parse_clienthello_tlsext(SSL *s, unsigned char **p, unsigned char *d, int n, int *al)
232         {
233         unsigned short type;
234         unsigned short size;
235         unsigned short len;
236         unsigned char *data = *p;
237         s->servername_done = 0;
238
239         if (data >= (d+n-2))
240                 return 1;
241         n2s(data,len);
242
243         if (data > (d+n-len)) 
244                 return 1;
245
246         while (data <= (d+n-4))
247                 {
248                 n2s(data,type);
249                 n2s(data,size);
250
251                 if (data+size > (d+n))
252                         return 1;
253
254                 if (s->tlsext_debug_cb)
255                         s->tlsext_debug_cb(s, 0, type, data, size,
256                                                 s->tlsext_debug_arg);
257 /* The servername extension is treated as follows:
258
259    - Only the hostname type is supported with a maximum length of 255.
260    - The servername is rejected if too long or if it contains zeros,
261      in which case an fatal alert is generated.
262    - The servername field is maintained together with the session cache.
263    - When a session is resumed, the servername call back invoked in order
264      to allow the application to position itself to the right context. 
265    - The servername is acknowledged if it is new for a session or when 
266      it is identical to a previously used for the same session. 
267      Applications can control the behaviour.  They can at any time
268      set a 'desirable' servername for a new SSL object. This can be the
269      case for example with HTTPS when a Host: header field is received and
270      a renegotiation is requested. In this case, a possible servername
271      presented in the new client hello is only acknowledged if it matches
272      the value of the Host: field. 
273    - Applications must  use SSL_OP_NO_SESSION_RESUMPTION_ON_RENEGOTIATION
274      if they provide for changing an explicit servername context for the session,
275      i.e. when the session has been established with a servername extension. 
276    - On session reconnect, the servername extension may be absent. 
277
278 */      
279
280                 if (type == TLSEXT_TYPE_server_name)
281                         {
282                         unsigned char *sdata;
283                         int servname_type;
284                         int dsize; 
285                 
286                         if (size < 2) 
287                                 {
288                                 *al = SSL_AD_DECODE_ERROR;
289                                 return 0;
290                                 }
291                         n2s(data,dsize);  
292                         size -= 2;
293                         if (dsize > size  ) 
294                                 {
295                                 *al = SSL_AD_DECODE_ERROR;
296                                 return 0;
297                                 } 
298
299                         sdata = data;
300                         while (dsize > 3) 
301                                 {
302                                 servname_type = *(sdata++); 
303                                 n2s(sdata,len);
304                                 dsize -= 3;
305
306                                 if (len > dsize) 
307                                         {
308                                         *al = SSL_AD_DECODE_ERROR;
309                                         return 0;
310                                         }
311                                 if (s->servername_done == 0)
312                                 switch (servname_type)
313                                         {
314                                 case TLSEXT_NAMETYPE_host_name:
315                                         if (s->session->tlsext_hostname == NULL)
316                                                 {
317                                                 if (len > TLSEXT_MAXLEN_host_name || 
318                                                         ((s->session->tlsext_hostname = OPENSSL_malloc(len+1)) == NULL))
319                                                         {
320                                                         *al = TLS1_AD_UNRECOGNIZED_NAME;
321                                                         return 0;
322                                                         }
323                                                 memcpy(s->session->tlsext_hostname, sdata, len);
324                                                 s->session->tlsext_hostname[len]='\0';
325                                                 if (strlen(s->session->tlsext_hostname) != len) {
326                                                         OPENSSL_free(s->session->tlsext_hostname);
327                                                         *al = TLS1_AD_UNRECOGNIZED_NAME;
328                                                         return 0;
329                                                 }
330                                                 s->servername_done = 1; 
331
332                                                 }
333                                         else 
334                                                 s->servername_done = strlen(s->session->tlsext_hostname) == len 
335                                                         && strncmp(s->session->tlsext_hostname, (char *)sdata, len) == 0;
336                                         
337                                         break;
338
339                                 default:
340                                         break;
341                                         }
342                                  
343                                 dsize -= len;
344                                 }
345                         if (dsize != 0) 
346                                 {
347                                 *al = SSL_AD_DECODE_ERROR;
348                                 return 0;
349                                 }
350
351                         }
352                 /* session ticket processed earlier */
353
354                 data+=size;             
355                 }
356
357         *p = data;
358         return 1;
359         }
360
361 int ssl_parse_serverhello_tlsext(SSL *s, unsigned char **p, unsigned char *d, int n, int *al)
362         {
363         unsigned short type;
364         unsigned short size;
365         unsigned short len;  
366         unsigned char *data = *p;
367
368         int tlsext_servername = 0;
369
370         if (data >= (d+n-2))
371                 return 1;
372
373         n2s(data,len);
374
375         while(data <= (d+n-4))
376                 {
377                 n2s(data,type);
378                 n2s(data,size);
379
380                 if (data+size > (d+n))
381                         return 1;
382
383                 if (s->tlsext_debug_cb)
384                         s->tlsext_debug_cb(s, 1, type, data, size,
385                                                 s->tlsext_debug_arg);
386
387                 if (type == TLSEXT_TYPE_server_name)
388                         {
389                         if (s->tlsext_hostname == NULL || size > 0)
390                                 {
391                                 *al = TLS1_AD_UNRECOGNIZED_NAME;
392                                 return 0;
393                                 }
394                         tlsext_servername = 1;   
395                         }
396                 else if (type == TLSEXT_TYPE_session_ticket)
397                         {
398                         if ((SSL_get_options(s) & SSL_OP_NO_TICKET)
399                                 || (size > 0))
400                                 {
401                                 *al = TLS1_AD_UNSUPPORTED_EXTENSION;
402                                 return 0;
403                                 }
404                         s->tlsext_ticket_expected = 1;
405                         }
406
407                 data+=size;             
408                 }
409
410         if (data != d+n)
411                 {
412                 *al = SSL_AD_DECODE_ERROR;
413                 return 0;
414                 }
415
416         if (!s->hit && tlsext_servername == 1)
417                 {
418                 if (s->tlsext_hostname)
419                         {
420                         if (s->session->tlsext_hostname == NULL)
421                                 {
422                                 s->session->tlsext_hostname = BUF_strdup(s->tlsext_hostname);   
423                                 if (!s->session->tlsext_hostname)
424                                         {
425                                         *al = SSL_AD_UNRECOGNIZED_NAME;
426                                         return 0;
427                                         }
428                                 }
429                         else 
430                                 {
431                                 *al = SSL_AD_DECODE_ERROR;
432                                 return 0;
433                                 }
434                         }
435                 }
436
437         *p = data;
438         return 1;
439         }
440
441 int ssl_check_clienthello_tlsext(SSL *s)
442         {
443         int ret=SSL_TLSEXT_ERR_NOACK;
444         int al = SSL_AD_UNRECOGNIZED_NAME;
445
446         if (s->ctx != NULL && s->ctx->tlsext_servername_callback != 0) 
447                 ret = s->ctx->tlsext_servername_callback(s, &al, s->ctx->tlsext_servername_arg);
448         else if (s->initial_ctx != NULL && s->initial_ctx->tlsext_servername_callback != 0)             
449                 ret = s->initial_ctx->tlsext_servername_callback(s, &al, s->initial_ctx->tlsext_servername_arg);
450
451         switch (ret)
452                 {
453                 case SSL_TLSEXT_ERR_ALERT_FATAL:
454                         ssl3_send_alert(s,SSL3_AL_FATAL,al); 
455                         return -1;
456
457                 case SSL_TLSEXT_ERR_ALERT_WARNING:
458                         ssl3_send_alert(s,SSL3_AL_WARNING,al);
459                         return 1; 
460                                         
461                 case SSL_TLSEXT_ERR_NOACK:
462                         s->servername_done=0;
463                         default:
464                 return 1;
465                 }
466         }
467
468 int ssl_check_serverhello_tlsext(SSL *s)
469         {
470         int ret=SSL_TLSEXT_ERR_NOACK;
471         int al = SSL_AD_UNRECOGNIZED_NAME;
472
473         if (s->ctx != NULL && s->ctx->tlsext_servername_callback != 0) 
474                 ret = s->ctx->tlsext_servername_callback(s, &al, s->ctx->tlsext_servername_arg);
475         else if (s->initial_ctx != NULL && s->initial_ctx->tlsext_servername_callback != 0)             
476                 ret = s->initial_ctx->tlsext_servername_callback(s, &al, s->initial_ctx->tlsext_servername_arg);
477
478         switch (ret)
479                 {
480                 case SSL_TLSEXT_ERR_ALERT_FATAL:
481                         ssl3_send_alert(s,SSL3_AL_FATAL,al); 
482                         return -1;
483
484                 case SSL_TLSEXT_ERR_ALERT_WARNING:
485                         ssl3_send_alert(s,SSL3_AL_WARNING,al);
486                         return 1; 
487                                         
488                 case SSL_TLSEXT_ERR_NOACK:
489                         s->servername_done=0;
490                         default:
491                 return 1;
492                 }
493         }
494
495 /* Since the server cache lookup is done early on in the processing of client
496  * hello and other operations depend on the result we need to handle any TLS
497  * session ticket extension at the same time.
498  */
499
500 int tls1_process_ticket(SSL *s, unsigned char *session_id, int len,
501                                 const unsigned char *limit, SSL_SESSION **ret)
502         {
503         /* Point after session ID in client hello */
504         const unsigned char *p = session_id + len;
505         unsigned short i;
506         if ((s->version <= SSL3_VERSION) || !limit)
507                 return 1;
508         if (p >= limit)
509                 return -1;
510         /* Skip past cipher list */
511         n2s(p, i);
512         p+= i;
513         if (p >= limit)
514                 return -1;
515         /* Skip past compression algorithm list */
516         i = *(p++);
517         p += i;
518         if (p > limit)
519                 return -1;
520         /* Now at start of extensions */
521         if ((p + 2) >= limit)
522                 return 1;
523         n2s(p, i);
524         while ((p + 4) <= limit)
525                 {
526                 unsigned short type, size;
527                 n2s(p, type);
528                 n2s(p, size);
529                 if (p + size > limit)
530                         return 1;
531                 if (type == TLSEXT_TYPE_session_ticket)
532                         {
533                         /* If tickets disabled indicate cache miss which will
534                          * trigger a full handshake
535                          */
536                         if (SSL_get_options(s) & SSL_OP_NO_TICKET)
537                                 return 0;
538                         /* If zero length not client will accept a ticket
539                          * and indicate cache miss to trigger full handshake
540                          */
541                         if (size == 0)
542                                 {
543                                 s->tlsext_ticket_expected = 1;
544                                 return 0;       /* Cache miss */
545                                 }
546                         return tls_decrypt_ticket(s, p, size, session_id, len,
547                                                                         ret);
548                         }
549                 p += size;
550                 }
551         return 1;
552         }
553
554 static int tls_decrypt_ticket(SSL *s, const unsigned char *etick, int eticklen,
555                                 const unsigned char *sess_id, int sesslen,
556                                 SSL_SESSION **psess)
557         {
558         SSL_SESSION *sess;
559         unsigned char *sdec;
560         const unsigned char *p;
561         int slen, mlen;
562         unsigned char tick_hmac[EVP_MAX_MD_SIZE];
563         HMAC_CTX hctx;
564         EVP_CIPHER_CTX ctx;
565         /* Attempt to process session ticket, first conduct sanity and
566          * integrity checks on ticket.
567          */
568         mlen = EVP_MD_size(tlsext_tick_md());
569         eticklen -= mlen;
570         /* Need at least keyname + iv + some encrypted data */
571         if (eticklen < 48)
572                 goto tickerr;
573         /* Check key name matches */
574         if (memcmp(etick, s->ctx->tlsext_tick_key_name, 16))
575                 goto tickerr;
576         /* Check HMAC of encrypted ticket */
577         HMAC_CTX_init(&hctx);
578         HMAC_Init_ex(&hctx, s->ctx->tlsext_tick_hmac_key, 16,
579                                 tlsext_tick_md(), NULL);
580         HMAC_Update(&hctx, etick, eticklen);
581         HMAC_Final(&hctx, tick_hmac, NULL);
582         HMAC_CTX_cleanup(&hctx);
583         if (memcmp(tick_hmac, etick + eticklen, mlen))
584                 goto tickerr;
585         /* Set p to start of IV */
586         p = etick + 16;
587         EVP_CIPHER_CTX_init(&ctx);
588         /* Attempt to decrypt session data */
589         EVP_DecryptInit_ex(&ctx, EVP_aes_128_cbc(), NULL,
590                                         s->ctx->tlsext_tick_aes_key, p);
591         /* Move p after IV to start of encrypted ticket, update length */
592         p += 16;
593         eticklen -= 32;
594         sdec = OPENSSL_malloc(eticklen);
595         if (!sdec)
596                 {
597                 EVP_CIPHER_CTX_cleanup(&ctx);
598                 return -1;
599                 }
600         EVP_DecryptUpdate(&ctx, sdec, &slen, p, eticklen);
601         if (EVP_DecryptFinal(&ctx, sdec + slen, &mlen) <= 0)
602                 goto tickerr;
603         slen += mlen;
604         EVP_CIPHER_CTX_cleanup(&ctx);
605         p = sdec;
606                 
607         sess = d2i_SSL_SESSION(NULL, &p, slen);
608         OPENSSL_free(sdec);
609         if (sess)
610                 {
611                 /* The session ID if non-empty is used by some clients to
612                  * detect that the ticket has been accepted. So we copy it to
613                  * the session structure. If it is empty set length to zero
614                  * as required by standard.
615                  */
616                 if (sesslen)
617                         memcpy(sess->session_id, sess_id, sesslen);
618                 sess->session_id_length = sesslen;
619                 *psess = sess;
620                 s->tlsext_ticket_expected = 0;
621                 return 1;
622                 }
623         /* If session decrypt failure indicate a cache miss and set state to
624          * send a new ticket
625          */
626         tickerr:        
627         s->tlsext_ticket_expected = 1;
628         return 0;
629         }
630
631 #endif