statem_lib.c@ 104031

Last change on this file since 104031 was 102863, checked in by vboxsync, 11 months ago
openssl-3.1.4: Applied and adjusted our OpenSSL changes to 3.1.3. bugref:10577
File size: 78.1 KB

Line
1	/*
2	* Copyright 1995-2023 The OpenSSL Project Authors. All Rights Reserved.
3	* Copyright (c) 2002, Oracle and/or its affiliates. All rights reserved
4	*
5	* Licensed under the Apache License 2.0 (the "License"). You may not use
6	* this file except in compliance with the License. You can obtain a copy
7	* in the file LICENSE in the source distribution or at
8	* https://www.openssl.org/source/license.html
9	*/
10
11	#include <limits.h>
12	#include <string.h>
13	#include <stdio.h>
14	#include "../ssl_local.h"
15	#include "statem_local.h"
16	#include "internal/cryptlib.h"
17	#include <openssl/buffer.h>
18	#include <openssl/objects.h>
19	#include <openssl/evp.h>
20	#include <openssl/rsa.h>
21	#include <openssl/x509.h>
22	#include <openssl/trace.h>
23
24	/*
25	* Map error codes to TLS/SSL alart types.
26	*/
27	typedef struct x509err2alert_st {
28	int x509err;
29	int alert;
30	} X509ERR2ALERT;
31
32	/* Fixed value used in the ServerHello random field to identify an HRR */
33	const unsigned char hrrrandom[] = {
34	0xcf, 0x21, 0xad, 0x74, 0xe5, 0x9a, 0x61, 0x11, 0xbe, 0x1d, 0x8c, 0x02,
35	0x1e, 0x65, 0xb8, 0x91, 0xc2, 0xa2, 0x11, 0x16, 0x7a, 0xbb, 0x8c, 0x5e,
36	0x07, 0x9e, 0x09, 0xe2, 0xc8, 0xa8, 0x33, 0x9c
37	};
38
39	/*
40	* send s->init_buf in records of type 'type' (SSL3_RT_HANDSHAKE or
41	* SSL3_RT_CHANGE_CIPHER_SPEC)
42	*/
43	int ssl3_do_write(SSL *s, int type)
44	{
45	int ret;
46	size_t written = 0;
47
48	ret = ssl3_write_bytes(s, type, &s->init_buf->data[s->init_off],
49	s->init_num, &written);
50	if (ret <= 0)
51	return -1;
52	if (type == SSL3_RT_HANDSHAKE)
53	/*
54	* should not be done for 'Hello Request's, but in that case we'll
55	* ignore the result anyway
56	* TLS1.3 KeyUpdate and NewSessionTicket do not need to be added
57	*/
58	if (!SSL_IS_TLS13(s) \|\| (s->statem.hand_state != TLS_ST_SW_SESSION_TICKET
59	&& s->statem.hand_state != TLS_ST_CW_KEY_UPDATE
60	&& s->statem.hand_state != TLS_ST_SW_KEY_UPDATE))
61	if (!ssl3_finish_mac(s,
62	(unsigned char *)&s->init_buf->data[s->init_off],
63	written))
64	return -1;
65	if (written == s->init_num) {
66	if (s->msg_callback)
67	s->msg_callback(1, s->version, type, s->init_buf->data,
68	(size_t)(s->init_off + s->init_num), s,
69	s->msg_callback_arg);
70	return 1;
71	}
72	s->init_off += written;
73	s->init_num -= written;
74	return 0;
75	}
76
77	int tls_close_construct_packet(SSL s, WPACKET pkt, int htype)
78	{
79	size_t msglen;
80
81	if ((htype != SSL3_MT_CHANGE_CIPHER_SPEC && !WPACKET_close(pkt))
82	\|\| !WPACKET_get_length(pkt, &msglen)
83	\|\| msglen > INT_MAX)
84	return 0;
85	s->init_num = (int)msglen;
86	s->init_off = 0;
87
88	return 1;
89	}
90
91	int tls_setup_handshake(SSL *s)
92	{
93	int ver_min, ver_max, ok;
94
95	if (!ssl3_init_finished_mac(s)) {
96	/* SSLfatal() already called */
97	return 0;
98	}
99
100	/* Reset any extension flags */
101	memset(s->ext.extflags, 0, sizeof(s->ext.extflags));
102
103	if (ssl_get_min_max_version(s, &ver_min, &ver_max, NULL) != 0) {
104	SSLfatal(s, SSL_AD_PROTOCOL_VERSION, SSL_R_NO_PROTOCOLS_AVAILABLE);
105	return 0;
106	}
107
108	/* Sanity check that we have MD5-SHA1 if we need it */
109	if (s->ctx->ssl_digest_methods[SSL_MD_MD5_SHA1_IDX] == NULL) {
110	int md5sha1_needed = 0;
111
112	/* We don't have MD5-SHA1 - do we need it? */
113	if (SSL_IS_DTLS(s)) {
114	if (DTLS_VERSION_LE(ver_max, DTLS1_VERSION))
115	md5sha1_needed = 1;
116	} else {
117	if (ver_max <= TLS1_1_VERSION)
118	md5sha1_needed = 1;
119	}
120	if (md5sha1_needed) {
121	SSLfatal_data(s, SSL_AD_HANDSHAKE_FAILURE,
122	SSL_R_NO_SUITABLE_DIGEST_ALGORITHM,
123	"The max supported SSL/TLS version needs the"
124	" MD5-SHA1 digest but it is not available"
125	" in the loaded providers. Use (D)TLSv1.2 or"
126	" above, or load different providers");
127	return 0;
128	}
129
130	ok = 1;
131	/* Don't allow TLSv1.1 or below to be negotiated */
132	if (SSL_IS_DTLS(s)) {
133	if (DTLS_VERSION_LT(ver_min, DTLS1_2_VERSION))
134	ok = SSL_set_min_proto_version(s, DTLS1_2_VERSION);
135	} else {
136	if (ver_min < TLS1_2_VERSION)
137	ok = SSL_set_min_proto_version(s, TLS1_2_VERSION);
138	}
139	if (!ok) {
140	/* Shouldn't happen */
141	SSLfatal(s, SSL_AD_HANDSHAKE_FAILURE, ERR_R_INTERNAL_ERROR);
142	return 0;
143	}
144	}
145
146	ok = 0;
147	if (s->server) {
148	STACK_OF(SSL_CIPHER) *ciphers = SSL_get_ciphers(s);
149	int i;
150
151	/*
152	* Sanity check that the maximum version we accept has ciphers
153	* enabled. For clients we do this check during construction of the
154	* ClientHello.
155	*/
156	for (i = 0; i < sk_SSL_CIPHER_num(ciphers); i++) {
157	const SSL_CIPHER *c = sk_SSL_CIPHER_value(ciphers, i);
158
159	if (SSL_IS_DTLS(s)) {
160	if (DTLS_VERSION_GE(ver_max, c->min_dtls) &&
161	DTLS_VERSION_LE(ver_max, c->max_dtls))
162	ok = 1;
163	} else if (ver_max >= c->min_tls && ver_max <= c->max_tls) {
164	ok = 1;
165	}
166	if (ok)
167	break;
168	}
169	if (!ok) {
170	SSLfatal_data(s, SSL_AD_HANDSHAKE_FAILURE,
171	SSL_R_NO_CIPHERS_AVAILABLE,
172	"No ciphers enabled for max supported "
173	"SSL/TLS version");
174	return 0;
175	}
176	if (SSL_IS_FIRST_HANDSHAKE(s)) {
177	/* N.B. s->session_ctx == s->ctx here */
178	ssl_tsan_counter(s->session_ctx, &s->session_ctx->stats.sess_accept);
179	} else {
180	/* N.B. s->ctx may not equal s->session_ctx */
181	ssl_tsan_counter(s->ctx, &s->ctx->stats.sess_accept_renegotiate);
182
183	s->s3.tmp.cert_request = 0;
184	}
185	} else {
186	if (SSL_IS_FIRST_HANDSHAKE(s))
187	ssl_tsan_counter(s->session_ctx, &s->session_ctx->stats.sess_connect);
188	else
189	ssl_tsan_counter(s->session_ctx,
190	&s->session_ctx->stats.sess_connect_renegotiate);
191
192	/* mark client_random uninitialized */
193	memset(s->s3.client_random, 0, sizeof(s->s3.client_random));
194	s->hit = 0;
195
196	s->s3.tmp.cert_req = 0;
197
198	if (SSL_IS_DTLS(s))
199	s->statem.use_timer = 1;
200	}
201
202	return 1;
203	}
204
205	/*
206	* Size of the to-be-signed TLS13 data, without the hash size itself:
207	* 64 bytes of value 32, 33 context bytes, 1 byte separator
208	*/
209	#define TLS13_TBS_START_SIZE 64
210	#define TLS13_TBS_PREAMBLE_SIZE (TLS13_TBS_START_SIZE + 33 + 1)
211
212	static int get_cert_verify_tbs_data(SSL s, unsigned char tls13tbs,
213	void *hdata, size_t hdatalen)
214	{
215	/* ASCII: "TLS 1.3, server CertificateVerify", in hex for EBCDIC compatibility */
216	static const char servercontext[] = "\x54\x4c\x53\x20\x31\x2e\x33\x2c\x20\x73\x65\x72"
217	"\x76\x65\x72\x20\x43\x65\x72\x74\x69\x66\x69\x63\x61\x74\x65\x56\x65\x72\x69\x66\x79";
218	/* ASCII: "TLS 1.3, client CertificateVerify", in hex for EBCDIC compatibility */
219	static const char clientcontext[] = "\x54\x4c\x53\x20\x31\x2e\x33\x2c\x20\x63\x6c\x69"
220	"\x65\x6e\x74\x20\x43\x65\x72\x74\x69\x66\x69\x63\x61\x74\x65\x56\x65\x72\x69\x66\x79";
221
222	if (SSL_IS_TLS13(s)) {
223	size_t hashlen;
224
225	/* Set the first 64 bytes of to-be-signed data to octet 32 */
226	memset(tls13tbs, 32, TLS13_TBS_START_SIZE);
227	/* This copies the 33 bytes of context plus the 0 separator byte */
228	if (s->statem.hand_state == TLS_ST_CR_CERT_VRFY
229	\|\| s->statem.hand_state == TLS_ST_SW_CERT_VRFY)
230	strcpy((char *)tls13tbs + TLS13_TBS_START_SIZE, servercontext);
231	else
232	strcpy((char *)tls13tbs + TLS13_TBS_START_SIZE, clientcontext);
233
234	/*
235	* If we're currently reading then we need to use the saved handshake
236	* hash value. We can't use the current handshake hash state because
237	* that includes the CertVerify itself.
238	*/
239	if (s->statem.hand_state == TLS_ST_CR_CERT_VRFY
240	\|\| s->statem.hand_state == TLS_ST_SR_CERT_VRFY) {
241	memcpy(tls13tbs + TLS13_TBS_PREAMBLE_SIZE, s->cert_verify_hash,
242	s->cert_verify_hash_len);
243	hashlen = s->cert_verify_hash_len;
244	} else if (!ssl_handshake_hash(s, tls13tbs + TLS13_TBS_PREAMBLE_SIZE,
245	EVP_MAX_MD_SIZE, &hashlen)) {
246	/* SSLfatal() already called */
247	return 0;
248	}
249
250	*hdata = tls13tbs;
251	*hdatalen = TLS13_TBS_PREAMBLE_SIZE + hashlen;
252	} else {
253	size_t retlen;
254	long retlen_l;
255
256	retlen = retlen_l = BIO_get_mem_data(s->s3.handshake_buffer, hdata);
257	if (retlen_l <= 0) {
258	SSLfatal(s, SSL_AD_INTERNAL_ERROR, ERR_R_INTERNAL_ERROR);
259	return 0;
260	}
261	*hdatalen = retlen;
262	}
263
264	return 1;
265	}
266
267	int tls_construct_cert_verify(SSL s, WPACKET pkt)
268	{
269	EVP_PKEY *pkey = NULL;
270	const EVP_MD *md = NULL;
271	EVP_MD_CTX *mctx = NULL;
272	EVP_PKEY_CTX *pctx = NULL;
273	size_t hdatalen = 0, siglen = 0;
274	void *hdata;
275	unsigned char *sig = NULL;
276	unsigned char tls13tbs[TLS13_TBS_PREAMBLE_SIZE + EVP_MAX_MD_SIZE];
277	const SIGALG_LOOKUP *lu = s->s3.tmp.sigalg;
278
279	if (lu == NULL \|\| s->s3.tmp.cert == NULL) {
280	SSLfatal(s, SSL_AD_INTERNAL_ERROR, ERR_R_INTERNAL_ERROR);
281	goto err;
282	}
283	pkey = s->s3.tmp.cert->privatekey;
284
285	if (pkey == NULL \|\| !tls1_lookup_md(s->ctx, lu, &md)) {
286	SSLfatal(s, SSL_AD_INTERNAL_ERROR, ERR_R_INTERNAL_ERROR);
287	goto err;
288	}
289
290	mctx = EVP_MD_CTX_new();
291	if (mctx == NULL) {
292	SSLfatal(s, SSL_AD_INTERNAL_ERROR, ERR_R_MALLOC_FAILURE);
293	goto err;
294	}
295
296	/* Get the data to be signed */
297	if (!get_cert_verify_tbs_data(s, tls13tbs, &hdata, &hdatalen)) {
298	/* SSLfatal() already called */
299	goto err;
300	}
301
302	if (SSL_USE_SIGALGS(s) && !WPACKET_put_bytes_u16(pkt, lu->sigalg)) {
303	SSLfatal(s, SSL_AD_INTERNAL_ERROR, ERR_R_INTERNAL_ERROR);
304	goto err;
305	}
306
307	if (EVP_DigestSignInit_ex(mctx, &pctx,
308	md == NULL ? NULL : EVP_MD_get0_name(md),
309	s->ctx->libctx, s->ctx->propq, pkey,
310	NULL) <= 0) {
311	SSLfatal(s, SSL_AD_INTERNAL_ERROR, ERR_R_EVP_LIB);
312	goto err;
313	}
314
315	if (lu->sig == EVP_PKEY_RSA_PSS) {
316	if (EVP_PKEY_CTX_set_rsa_padding(pctx, RSA_PKCS1_PSS_PADDING) <= 0
317	\|\| EVP_PKEY_CTX_set_rsa_pss_saltlen(pctx,
318	RSA_PSS_SALTLEN_DIGEST) <= 0) {
319	SSLfatal(s, SSL_AD_INTERNAL_ERROR, ERR_R_EVP_LIB);
320	goto err;
321	}
322	}
323	if (s->version == SSL3_VERSION) {
324	/*
325	* Here we use EVP_DigestSignUpdate followed by EVP_DigestSignFinal
326	* in order to add the EVP_CTRL_SSL3_MASTER_SECRET call between them.
327	*/
328	if (EVP_DigestSignUpdate(mctx, hdata, hdatalen) <= 0
329	\|\| EVP_MD_CTX_ctrl(mctx, EVP_CTRL_SSL3_MASTER_SECRET,
330	(int)s->session->master_key_length,
331	s->session->master_key) <= 0
332	\|\| EVP_DigestSignFinal(mctx, NULL, &siglen) <= 0) {
333
334	SSLfatal(s, SSL_AD_INTERNAL_ERROR, ERR_R_EVP_LIB);
335	goto err;
336	}
337	sig = OPENSSL_malloc(siglen);
338	if (sig == NULL
339	\|\| EVP_DigestSignFinal(mctx, sig, &siglen) <= 0) {
340	SSLfatal(s, SSL_AD_INTERNAL_ERROR, ERR_R_EVP_LIB);
341	goto err;
342	}
343	} else {
344	/*
345	* Here we must use EVP_DigestSign() because Ed25519/Ed448 does not
346	* support streaming via EVP_DigestSignUpdate/EVP_DigestSignFinal
347	*/
348	if (EVP_DigestSign(mctx, NULL, &siglen, hdata, hdatalen) <= 0) {
349	SSLfatal(s, SSL_AD_INTERNAL_ERROR, ERR_R_EVP_LIB);
350	goto err;
351	}
352	sig = OPENSSL_malloc(siglen);
353	if (sig == NULL
354	\|\| EVP_DigestSign(mctx, sig, &siglen, hdata, hdatalen) <= 0) {
355	SSLfatal(s, SSL_AD_INTERNAL_ERROR, ERR_R_EVP_LIB);
356	goto err;
357	}
358	}
359
360	#ifndef OPENSSL_NO_GOST
361	{
362	int pktype = lu->sig;
363
364	if (pktype == NID_id_GostR3410_2001
365	\|\| pktype == NID_id_GostR3410_2012_256
366	\|\| pktype == NID_id_GostR3410_2012_512)
367	BUF_reverse(sig, NULL, siglen);
368	}
369	#endif
370
371	if (!WPACKET_sub_memcpy_u16(pkt, sig, siglen)) {
372	SSLfatal(s, SSL_AD_INTERNAL_ERROR, ERR_R_INTERNAL_ERROR);
373	goto err;
374	}
375
376	/* Digest cached records and discard handshake buffer */
377	if (!ssl3_digest_cached_records(s, 0)) {
378	/* SSLfatal() already called */
379	goto err;
380	}
381
382	OPENSSL_free(sig);
383	EVP_MD_CTX_free(mctx);
384	return 1;
385	err:
386	OPENSSL_free(sig);
387	EVP_MD_CTX_free(mctx);
388	return 0;
389	}
390
391	MSG_PROCESS_RETURN tls_process_cert_verify(SSL s, PACKET pkt)
392	{
393	EVP_PKEY *pkey = NULL;
394	const unsigned char *data;
395	#ifndef OPENSSL_NO_GOST
396	unsigned char *gost_data = NULL;
397	#endif
398	MSG_PROCESS_RETURN ret = MSG_PROCESS_ERROR;
399	int j;
400	unsigned int len;
401	X509 *peer;
402	const EVP_MD *md = NULL;
403	size_t hdatalen = 0;
404	void *hdata;
405	unsigned char tls13tbs[TLS13_TBS_PREAMBLE_SIZE + EVP_MAX_MD_SIZE];
406	EVP_MD_CTX *mctx = EVP_MD_CTX_new();
407	EVP_PKEY_CTX *pctx = NULL;
408
409	if (mctx == NULL) {
410	SSLfatal(s, SSL_AD_INTERNAL_ERROR, ERR_R_MALLOC_FAILURE);
411	goto err;
412	}
413
414	peer = s->session->peer;
415	pkey = X509_get0_pubkey(peer);
416	if (pkey == NULL) {
417	SSLfatal(s, SSL_AD_INTERNAL_ERROR, ERR_R_INTERNAL_ERROR);
418	goto err;
419	}
420
421	if (ssl_cert_lookup_by_pkey(pkey, NULL) == NULL) {
422	SSLfatal(s, SSL_AD_ILLEGAL_PARAMETER,
423	SSL_R_SIGNATURE_FOR_NON_SIGNING_CERTIFICATE);
424	goto err;
425	}
426
427	if (SSL_USE_SIGALGS(s)) {
428	unsigned int sigalg;
429
430	if (!PACKET_get_net_2(pkt, &sigalg)) {
431	SSLfatal(s, SSL_AD_DECODE_ERROR, SSL_R_BAD_PACKET);
432	goto err;
433	}
434	if (tls12_check_peer_sigalg(s, sigalg, pkey) <= 0) {
435	/* SSLfatal() already called */
436	goto err;
437	}
438	} else if (!tls1_set_peer_legacy_sigalg(s, pkey)) {
439	SSLfatal(s, SSL_AD_INTERNAL_ERROR,
440	SSL_R_LEGACY_SIGALG_DISALLOWED_OR_UNSUPPORTED);
441	goto err;
442	}
443
444	if (!tls1_lookup_md(s->ctx, s->s3.tmp.peer_sigalg, &md)) {
445	SSLfatal(s, SSL_AD_INTERNAL_ERROR, ERR_R_INTERNAL_ERROR);
446	goto err;
447	}
448
449	if (SSL_USE_SIGALGS(s))
450	OSSL_TRACE1(TLS, "USING TLSv1.2 HASH %s\n",
451	md == NULL ? "n/a" : EVP_MD_get0_name(md));
452
453	/* Check for broken implementations of GOST ciphersuites */
454	/*
455	* If key is GOST and len is exactly 64 or 128, it is signature without
456	* length field (CryptoPro implementations at least till TLS 1.2)
457	*/
458	#ifndef OPENSSL_NO_GOST
459	if (!SSL_USE_SIGALGS(s)
460	&& ((PACKET_remaining(pkt) == 64
461	&& (EVP_PKEY_get_id(pkey) == NID_id_GostR3410_2001
462	\|\| EVP_PKEY_get_id(pkey) == NID_id_GostR3410_2012_256))
463	\|\| (PACKET_remaining(pkt) == 128
464	&& EVP_PKEY_get_id(pkey) == NID_id_GostR3410_2012_512))) {
465	len = PACKET_remaining(pkt);
466	} else
467	#endif
468	if (!PACKET_get_net_2(pkt, &len)) {
469	SSLfatal(s, SSL_AD_DECODE_ERROR, SSL_R_LENGTH_MISMATCH);
470	goto err;
471	}
472
473	if (!PACKET_get_bytes(pkt, &data, len)) {
474	SSLfatal(s, SSL_AD_DECODE_ERROR, SSL_R_LENGTH_MISMATCH);
475	goto err;
476	}
477
478	if (!get_cert_verify_tbs_data(s, tls13tbs, &hdata, &hdatalen)) {
479	/* SSLfatal() already called */
480	goto err;
481	}
482
483	OSSL_TRACE1(TLS, "Using client verify alg %s\n",
484	md == NULL ? "n/a" : EVP_MD_get0_name(md));
485
486	if (EVP_DigestVerifyInit_ex(mctx, &pctx,
487	md == NULL ? NULL : EVP_MD_get0_name(md),
488	s->ctx->libctx, s->ctx->propq, pkey,
489	NULL) <= 0) {
490	SSLfatal(s, SSL_AD_INTERNAL_ERROR, ERR_R_EVP_LIB);
491	goto err;
492	}
493	#ifndef OPENSSL_NO_GOST
494	{
495	int pktype = EVP_PKEY_get_id(pkey);
496	if (pktype == NID_id_GostR3410_2001
497	\|\| pktype == NID_id_GostR3410_2012_256
498	\|\| pktype == NID_id_GostR3410_2012_512) {
499	if ((gost_data = OPENSSL_malloc(len)) == NULL) {
500	SSLfatal(s, SSL_AD_INTERNAL_ERROR, ERR_R_MALLOC_FAILURE);
501	goto err;
502	}
503	BUF_reverse(gost_data, data, len);
504	data = gost_data;
505	}
506	}
507	#endif
508
509	if (SSL_USE_PSS(s)) {
510	if (EVP_PKEY_CTX_set_rsa_padding(pctx, RSA_PKCS1_PSS_PADDING) <= 0
511	\|\| EVP_PKEY_CTX_set_rsa_pss_saltlen(pctx,
512	RSA_PSS_SALTLEN_DIGEST) <= 0) {
513	SSLfatal(s, SSL_AD_INTERNAL_ERROR, ERR_R_EVP_LIB);
514	goto err;
515	}
516	}
517	if (s->version == SSL3_VERSION) {
518	if (EVP_DigestVerifyUpdate(mctx, hdata, hdatalen) <= 0
519	\|\| EVP_MD_CTX_ctrl(mctx, EVP_CTRL_SSL3_MASTER_SECRET,
520	(int)s->session->master_key_length,
521	s->session->master_key) <= 0) {
522	SSLfatal(s, SSL_AD_INTERNAL_ERROR, ERR_R_EVP_LIB);
523	goto err;
524	}
525	if (EVP_DigestVerifyFinal(mctx, data, len) <= 0) {
526	SSLfatal(s, SSL_AD_DECRYPT_ERROR, SSL_R_BAD_SIGNATURE);
527	goto err;
528	}
529	} else {
530	j = EVP_DigestVerify(mctx, data, len, hdata, hdatalen);
531	if (j <= 0) {
532	SSLfatal(s, SSL_AD_DECRYPT_ERROR, SSL_R_BAD_SIGNATURE);
533	goto err;
534	}
535	}
536
537	/*
538	* In TLSv1.3 on the client side we make sure we prepare the client
539	* certificate after the CertVerify instead of when we get the
540	* CertificateRequest. This is because in TLSv1.3 the CertificateRequest
541	* comes before the Certificate message. In TLSv1.2 it comes after. We
542	* want to make sure that SSL_get1_peer_certificate() will return the actual
543	* server certificate from the client_cert_cb callback.
544	*/
545	if (!s->server && SSL_IS_TLS13(s) && s->s3.tmp.cert_req == 1)
546	ret = MSG_PROCESS_CONTINUE_PROCESSING;
547	else
548	ret = MSG_PROCESS_CONTINUE_READING;
549	err:
550	BIO_free(s->s3.handshake_buffer);
551	s->s3.handshake_buffer = NULL;
552	EVP_MD_CTX_free(mctx);
553	#ifndef OPENSSL_NO_GOST
554	OPENSSL_free(gost_data);
555	#endif
556	return ret;
557	}
558
559	int tls_construct_finished(SSL s, WPACKET pkt)
560	{
561	size_t finish_md_len;
562	const char *sender;
563	size_t slen;
564
565	/* This is a real handshake so make sure we clean it up at the end */
566	if (!s->server && s->post_handshake_auth != SSL_PHA_REQUESTED)
567	s->statem.cleanuphand = 1;
568
569	/*
570	* We only change the keys if we didn't already do this when we sent the
571	* client certificate
572	*/
573	if (SSL_IS_TLS13(s)
574	&& !s->server
575	&& s->s3.tmp.cert_req == 0
576	&& (!s->method->ssl3_enc->change_cipher_state(s,
577	SSL3_CC_HANDSHAKE \| SSL3_CHANGE_CIPHER_CLIENT_WRITE))) {;
578	/* SSLfatal() already called */
579	return 0;
580	}
581
582	if (s->server) {
583	sender = s->method->ssl3_enc->server_finished_label;
584	slen = s->method->ssl3_enc->server_finished_label_len;
585	} else {
586	sender = s->method->ssl3_enc->client_finished_label;
587	slen = s->method->ssl3_enc->client_finished_label_len;
588	}
589
590	finish_md_len = s->method->ssl3_enc->final_finish_mac(s,
591	sender, slen,
592	s->s3.tmp.finish_md);
593	if (finish_md_len == 0) {
594	/* SSLfatal() already called */
595	return 0;
596	}
597
598	s->s3.tmp.finish_md_len = finish_md_len;
599
600	if (!WPACKET_memcpy(pkt, s->s3.tmp.finish_md, finish_md_len)) {
601	SSLfatal(s, SSL_AD_INTERNAL_ERROR, ERR_R_INTERNAL_ERROR);
602	return 0;
603	}
604
605	/*
606	* Log the master secret, if logging is enabled. We don't log it for
607	* TLSv1.3: there's a different key schedule for that.
608	*/
609	if (!SSL_IS_TLS13(s) && !ssl_log_secret(s, MASTER_SECRET_LABEL,
610	s->session->master_key,
611	s->session->master_key_length)) {
612	/* SSLfatal() already called */
613	return 0;
614	}
615
616	/*
617	* Copy the finished so we can use it for renegotiation checks
618	*/
619	if (!ossl_assert(finish_md_len <= EVP_MAX_MD_SIZE)) {
620	SSLfatal(s, SSL_AD_INTERNAL_ERROR, ERR_R_INTERNAL_ERROR);
621	return 0;
622	}
623	if (!s->server) {
624	memcpy(s->s3.previous_client_finished, s->s3.tmp.finish_md,
625	finish_md_len);
626	s->s3.previous_client_finished_len = finish_md_len;
627	} else {
628	memcpy(s->s3.previous_server_finished, s->s3.tmp.finish_md,
629	finish_md_len);
630	s->s3.previous_server_finished_len = finish_md_len;
631	}
632
633	return 1;
634	}
635
636	int tls_construct_key_update(SSL s, WPACKET pkt)
637	{
638	if (!WPACKET_put_bytes_u8(pkt, s->key_update)) {
639	SSLfatal(s, SSL_AD_INTERNAL_ERROR, ERR_R_INTERNAL_ERROR);
640	return 0;
641	}
642
643	s->key_update = SSL_KEY_UPDATE_NONE;
644	return 1;
645	}
646
647	MSG_PROCESS_RETURN tls_process_key_update(SSL s, PACKET pkt)
648	{
649	unsigned int updatetype;
650
651	/*
652	* A KeyUpdate message signals a key change so the end of the message must
653	* be on a record boundary.
654	*/
655	if (RECORD_LAYER_processed_read_pending(&s->rlayer)) {
656	SSLfatal(s, SSL_AD_UNEXPECTED_MESSAGE, SSL_R_NOT_ON_RECORD_BOUNDARY);
657	return MSG_PROCESS_ERROR;
658	}
659
660	if (!PACKET_get_1(pkt, &updatetype)
661	\|\| PACKET_remaining(pkt) != 0) {
662	SSLfatal(s, SSL_AD_DECODE_ERROR, SSL_R_BAD_KEY_UPDATE);
663	return MSG_PROCESS_ERROR;
664	}
665
666	/*
667	* There are only two defined key update types. Fail if we get a value we
668	* didn't recognise.
669	*/
670	if (updatetype != SSL_KEY_UPDATE_NOT_REQUESTED
671	&& updatetype != SSL_KEY_UPDATE_REQUESTED) {
672	SSLfatal(s, SSL_AD_ILLEGAL_PARAMETER, SSL_R_BAD_KEY_UPDATE);
673	return MSG_PROCESS_ERROR;
674	}
675
676	/*
677	* If we get a request for us to update our sending keys too then, we need
678	* to additionally send a KeyUpdate message. However that message should
679	* not also request an update (otherwise we get into an infinite loop).
680	*/
681	if (updatetype == SSL_KEY_UPDATE_REQUESTED)
682	s->key_update = SSL_KEY_UPDATE_NOT_REQUESTED;
683
684	if (!tls13_update_key(s, 0)) {
685	/* SSLfatal() already called */
686	return MSG_PROCESS_ERROR;
687	}
688
689	return MSG_PROCESS_FINISHED_READING;
690	}
691
692	/*
693	* ssl3_take_mac calculates the Finished MAC for the handshakes messages seen
694	* to far.
695	*/
696	int ssl3_take_mac(SSL *s)
697	{
698	const char *sender;
699	size_t slen;
700
701	if (!s->server) {
702	sender = s->method->ssl3_enc->server_finished_label;
703	slen = s->method->ssl3_enc->server_finished_label_len;
704	} else {
705	sender = s->method->ssl3_enc->client_finished_label;
706	slen = s->method->ssl3_enc->client_finished_label_len;
707	}
708
709	s->s3.tmp.peer_finish_md_len =
710	s->method->ssl3_enc->final_finish_mac(s, sender, slen,
711	s->s3.tmp.peer_finish_md);
712
713	if (s->s3.tmp.peer_finish_md_len == 0) {
714	/* SSLfatal() already called */
715	return 0;
716	}
717
718	return 1;
719	}
720
721	MSG_PROCESS_RETURN tls_process_change_cipher_spec(SSL s, PACKET pkt)
722	{
723	size_t remain;
724
725	remain = PACKET_remaining(pkt);
726	/*
727	* 'Change Cipher Spec' is just a single byte, which should already have
728	* been consumed by ssl_get_message() so there should be no bytes left,
729	* unless we're using DTLS1_BAD_VER, which has an extra 2 bytes
730	*/
731	if (SSL_IS_DTLS(s)) {
732	if ((s->version == DTLS1_BAD_VER
733	&& remain != DTLS1_CCS_HEADER_LENGTH + 1)
734	\|\| (s->version != DTLS1_BAD_VER
735	&& remain != DTLS1_CCS_HEADER_LENGTH - 1)) {
736	SSLfatal(s, SSL_AD_DECODE_ERROR, SSL_R_BAD_CHANGE_CIPHER_SPEC);
737	return MSG_PROCESS_ERROR;
738	}
739	} else {
740	if (remain != 0) {
741	SSLfatal(s, SSL_AD_DECODE_ERROR, SSL_R_BAD_CHANGE_CIPHER_SPEC);
742	return MSG_PROCESS_ERROR;
743	}
744	}
745
746	/* Check we have a cipher to change to */
747	if (s->s3.tmp.new_cipher == NULL) {
748	SSLfatal(s, SSL_AD_UNEXPECTED_MESSAGE, SSL_R_CCS_RECEIVED_EARLY);
749	return MSG_PROCESS_ERROR;
750	}
751
752	s->s3.change_cipher_spec = 1;
753	if (!ssl3_do_change_cipher_spec(s)) {
754	SSLfatal(s, SSL_AD_INTERNAL_ERROR, ERR_R_INTERNAL_ERROR);
755	return MSG_PROCESS_ERROR;
756	}
757
758	if (SSL_IS_DTLS(s)) {
759	dtls1_reset_seq_numbers(s, SSL3_CC_READ);
760
761	if (s->version == DTLS1_BAD_VER)
762	s->d1->handshake_read_seq++;
763
764	#ifndef OPENSSL_NO_SCTP
765	/*
766	* Remember that a CCS has been received, so that an old key of
767	* SCTP-Auth can be deleted when a CCS is sent. Will be ignored if no
768	* SCTP is used
769	*/
770	BIO_ctrl(SSL_get_wbio(s), BIO_CTRL_DGRAM_SCTP_AUTH_CCS_RCVD, 1, NULL);
771	#endif
772	}
773
774	return MSG_PROCESS_CONTINUE_READING;
775	}
776
777	MSG_PROCESS_RETURN tls_process_finished(SSL s, PACKET pkt)
778	{
779	size_t md_len;
780
781
782	/* This is a real handshake so make sure we clean it up at the end */
783	if (s->server) {
784	/*
785	* To get this far we must have read encrypted data from the client. We
786	* no longer tolerate unencrypted alerts. This value is ignored if less
787	* than TLSv1.3
788	*/
789	s->statem.enc_read_state = ENC_READ_STATE_VALID;
790	if (s->post_handshake_auth != SSL_PHA_REQUESTED)
791	s->statem.cleanuphand = 1;
792	if (SSL_IS_TLS13(s) && !tls13_save_handshake_digest_for_pha(s)) {
793	/* SSLfatal() already called */
794	return MSG_PROCESS_ERROR;
795	}
796	}
797
798	/*
799	* In TLSv1.3 a Finished message signals a key change so the end of the
800	* message must be on a record boundary.
801	*/
802	if (SSL_IS_TLS13(s) && RECORD_LAYER_processed_read_pending(&s->rlayer)) {
803	SSLfatal(s, SSL_AD_UNEXPECTED_MESSAGE, SSL_R_NOT_ON_RECORD_BOUNDARY);
804	return MSG_PROCESS_ERROR;
805	}
806
807	/* If this occurs, we have missed a message */
808	if (!SSL_IS_TLS13(s) && !s->s3.change_cipher_spec) {
809	SSLfatal(s, SSL_AD_UNEXPECTED_MESSAGE, SSL_R_GOT_A_FIN_BEFORE_A_CCS);
810	return MSG_PROCESS_ERROR;
811	}
812	s->s3.change_cipher_spec = 0;
813
814	md_len = s->s3.tmp.peer_finish_md_len;
815
816	if (md_len != PACKET_remaining(pkt)) {
817	SSLfatal(s, SSL_AD_DECODE_ERROR, SSL_R_BAD_DIGEST_LENGTH);
818	return MSG_PROCESS_ERROR;
819	}
820
821	if (CRYPTO_memcmp(PACKET_data(pkt), s->s3.tmp.peer_finish_md,
822	md_len) != 0) {
823	SSLfatal(s, SSL_AD_DECRYPT_ERROR, SSL_R_DIGEST_CHECK_FAILED);
824	return MSG_PROCESS_ERROR;
825	}
826
827	/*
828	* Copy the finished so we can use it for renegotiation checks
829	*/
830	if (!ossl_assert(md_len <= EVP_MAX_MD_SIZE)) {
831	SSLfatal(s, SSL_AD_INTERNAL_ERROR, ERR_R_INTERNAL_ERROR);
832	return MSG_PROCESS_ERROR;
833	}
834	if (s->server) {
835	memcpy(s->s3.previous_client_finished, s->s3.tmp.peer_finish_md,
836	md_len);
837	s->s3.previous_client_finished_len = md_len;
838	} else {
839	memcpy(s->s3.previous_server_finished, s->s3.tmp.peer_finish_md,
840	md_len);
841	s->s3.previous_server_finished_len = md_len;
842	}
843
844	/*
845	* In TLS1.3 we also have to change cipher state and do any final processing
846	* of the initial server flight (if we are a client)
847	*/
848	if (SSL_IS_TLS13(s)) {
849	if (s->server) {
850	if (s->post_handshake_auth != SSL_PHA_REQUESTED &&
851	!s->method->ssl3_enc->change_cipher_state(s,
852	SSL3_CC_APPLICATION \| SSL3_CHANGE_CIPHER_SERVER_READ)) {
853	/* SSLfatal() already called */
854	return MSG_PROCESS_ERROR;
855	}
856	} else {
857	/* TLS 1.3 gets the secret size from the handshake md */
858	size_t dummy;
859	if (!s->method->ssl3_enc->generate_master_secret(s,
860	s->master_secret, s->handshake_secret, 0,
861	&dummy)) {
862	/* SSLfatal() already called */
863	return MSG_PROCESS_ERROR;
864	}
865	if (!s->method->ssl3_enc->change_cipher_state(s,
866	SSL3_CC_APPLICATION \| SSL3_CHANGE_CIPHER_CLIENT_READ)) {
867	/* SSLfatal() already called */
868	return MSG_PROCESS_ERROR;
869	}
870	if (!tls_process_initial_server_flight(s)) {
871	/* SSLfatal() already called */
872	return MSG_PROCESS_ERROR;
873	}
874	}
875	}
876
877	return MSG_PROCESS_FINISHED_READING;
878	}
879
880	int tls_construct_change_cipher_spec(SSL s, WPACKET pkt)
881	{
882	if (!WPACKET_put_bytes_u8(pkt, SSL3_MT_CCS)) {
883	SSLfatal(s, SSL_AD_INTERNAL_ERROR, ERR_R_INTERNAL_ERROR);
884	return 0;
885	}
886
887	return 1;
888	}
889
890	/* Add a certificate to the WPACKET */
891	static int ssl_add_cert_to_wpacket(SSL s, WPACKET pkt, X509 *x, int chain)
892	{
893	int len;
894	unsigned char *outbytes;
895
896	len = i2d_X509(x, NULL);
897	if (len < 0) {
898	SSLfatal(s, SSL_AD_INTERNAL_ERROR, ERR_R_BUF_LIB);
899	return 0;
900	}
901	if (!WPACKET_sub_allocate_bytes_u24(pkt, len, &outbytes)
902	\|\| i2d_X509(x, &outbytes) != len) {
903	SSLfatal(s, SSL_AD_INTERNAL_ERROR, ERR_R_INTERNAL_ERROR);
904	return 0;
905	}
906
907	if (SSL_IS_TLS13(s)
908	&& !tls_construct_extensions(s, pkt, SSL_EXT_TLS1_3_CERTIFICATE, x,
909	chain)) {
910	/* SSLfatal() already called */
911	return 0;
912	}
913
914	return 1;
915	}
916
917	/* Add certificate chain to provided WPACKET */
918	static int ssl_add_cert_chain(SSL s, WPACKET pkt, CERT_PKEY *cpk)
919	{
920	int i, chain_count;
921	X509 *x;
922	STACK_OF(X509) *extra_certs;
923	STACK_OF(X509) *chain = NULL;
924	X509_STORE *chain_store;
925
926	if (cpk == NULL \|\| cpk->x509 == NULL)
927	return 1;
928
929	x = cpk->x509;
930
931	/*
932	* If we have a certificate specific chain use it, else use parent ctx.
933	*/
934	if (cpk->chain != NULL)
935	extra_certs = cpk->chain;
936	else
937	extra_certs = s->ctx->extra_certs;
938
939	if ((s->mode & SSL_MODE_NO_AUTO_CHAIN) \|\| extra_certs)
940	chain_store = NULL;
941	else if (s->cert->chain_store)
942	chain_store = s->cert->chain_store;
943	else
944	chain_store = s->ctx->cert_store;
945
946	if (chain_store != NULL) {
947	X509_STORE_CTX *xs_ctx = X509_STORE_CTX_new_ex(s->ctx->libctx,
948	s->ctx->propq);
949
950	if (xs_ctx == NULL) {
951	SSLfatal(s, SSL_AD_INTERNAL_ERROR, ERR_R_MALLOC_FAILURE);
952	return 0;
953	}
954	if (!X509_STORE_CTX_init(xs_ctx, chain_store, x, NULL)) {
955	X509_STORE_CTX_free(xs_ctx);
956	SSLfatal(s, SSL_AD_INTERNAL_ERROR, ERR_R_X509_LIB);
957	return 0;
958	}
959	/*
960	* It is valid for the chain not to be complete (because normally we
961	* don't include the root cert in the chain). Therefore we deliberately
962	* ignore the error return from this call. We're not actually verifying
963	* the cert - we're just building as much of the chain as we can
964	*/
965	(void)X509_verify_cert(xs_ctx);
966	/* Don't leave errors in the queue */
967	ERR_clear_error();
968	chain = X509_STORE_CTX_get0_chain(xs_ctx);
969	i = ssl_security_cert_chain(s, chain, NULL, 0);
970	if (i != 1) {
971	#if 0
972	/* Dummy error calls so mkerr generates them */
973	ERR_raise(ERR_LIB_SSL, SSL_R_EE_KEY_TOO_SMALL);
974	ERR_raise(ERR_LIB_SSL, SSL_R_CA_KEY_TOO_SMALL);
975	ERR_raise(ERR_LIB_SSL, SSL_R_CA_MD_TOO_WEAK);
976	#endif
977	X509_STORE_CTX_free(xs_ctx);
978	SSLfatal(s, SSL_AD_INTERNAL_ERROR, i);
979	return 0;
980	}
981	chain_count = sk_X509_num(chain);
982	for (i = 0; i < chain_count; i++) {
983	x = sk_X509_value(chain, i);
984
985	if (!ssl_add_cert_to_wpacket(s, pkt, x, i)) {
986	/* SSLfatal() already called */
987	X509_STORE_CTX_free(xs_ctx);
988	return 0;
989	}
990	}
991	X509_STORE_CTX_free(xs_ctx);
992	} else {
993	i = ssl_security_cert_chain(s, extra_certs, x, 0);
994	if (i != 1) {
995	SSLfatal(s, SSL_AD_INTERNAL_ERROR, i);
996	return 0;
997	}
998	if (!ssl_add_cert_to_wpacket(s, pkt, x, 0)) {
999	/* SSLfatal() already called */
1000	return 0;
1001	}
1002	for (i = 0; i < sk_X509_num(extra_certs); i++) {
1003	x = sk_X509_value(extra_certs, i);
1004	if (!ssl_add_cert_to_wpacket(s, pkt, x, i + 1)) {
1005	/* SSLfatal() already called */
1006	return 0;
1007	}
1008	}
1009	}
1010	return 1;
1011	}
1012
1013	unsigned long ssl3_output_cert_chain(SSL s, WPACKET pkt, CERT_PKEY *cpk)
1014	{
1015	if (!WPACKET_start_sub_packet_u24(pkt)) {
1016	SSLfatal(s, SSL_AD_INTERNAL_ERROR, ERR_R_INTERNAL_ERROR);
1017	return 0;
1018	}
1019
1020	if (!ssl_add_cert_chain(s, pkt, cpk))
1021	return 0;
1022
1023	if (!WPACKET_close(pkt)) {
1024	SSLfatal(s, SSL_AD_INTERNAL_ERROR, ERR_R_INTERNAL_ERROR);
1025	return 0;
1026	}
1027
1028	return 1;
1029	}
1030
1031	/*
1032	* Tidy up after the end of a handshake. In the case of SCTP this may result
1033	* in NBIO events. If \|clearbufs\| is set then init_buf and the wbio buffer is
1034	* freed up as well.
1035	*/
1036	WORK_STATE tls_finish_handshake(SSL *s, ossl_unused WORK_STATE wst,
1037	int clearbufs, int stop)
1038	{
1039	void (cb) (const SSL ssl, int type, int val) = NULL;
1040	int cleanuphand = s->statem.cleanuphand;
1041
1042	if (clearbufs) {
1043	if (!SSL_IS_DTLS(s)
1044	#ifndef OPENSSL_NO_SCTP
1045	/*
1046	* RFC6083: SCTP provides a reliable and in-sequence transport service for DTLS
1047	* messages that require it. Therefore, DTLS procedures for retransmissions
1048	* MUST NOT be used.
1049	* Hence the init_buf can be cleared when DTLS over SCTP as transport is used.
1050	*/
1051	\|\| BIO_dgram_is_sctp(SSL_get_wbio(s))
1052	#endif
1053	) {
1054	/*
1055	* We don't do this in DTLS over UDP because we may still need the init_buf
1056	* in case there are any unexpected retransmits
1057	*/
1058	BUF_MEM_free(s->init_buf);
1059	s->init_buf = NULL;
1060	}
1061
1062	if (!ssl_free_wbio_buffer(s)) {
1063	SSLfatal(s, SSL_AD_INTERNAL_ERROR, ERR_R_INTERNAL_ERROR);
1064	return WORK_ERROR;
1065	}
1066	s->init_num = 0;
1067	}
1068
1069	if (SSL_IS_TLS13(s) && !s->server
1070	&& s->post_handshake_auth == SSL_PHA_REQUESTED)
1071	s->post_handshake_auth = SSL_PHA_EXT_SENT;
1072
1073	/*
1074	* Only set if there was a Finished message and this isn't after a TLSv1.3
1075	* post handshake exchange
1076	*/
1077	if (cleanuphand) {
1078	/* skipped if we just sent a HelloRequest */
1079	s->renegotiate = 0;
1080	s->new_session = 0;
1081	s->statem.cleanuphand = 0;
1082	s->ext.ticket_expected = 0;
1083
1084	ssl3_cleanup_key_block(s);
1085
1086	if (s->server) {
1087	/*
1088	* In TLSv1.3 we update the cache as part of constructing the
1089	* NewSessionTicket
1090	*/
1091	if (!SSL_IS_TLS13(s))
1092	ssl_update_cache(s, SSL_SESS_CACHE_SERVER);
1093
1094	/* N.B. s->ctx may not equal s->session_ctx */
1095	ssl_tsan_counter(s->ctx, &s->ctx->stats.sess_accept_good);
1096	s->handshake_func = ossl_statem_accept;
1097	} else {
1098	if (SSL_IS_TLS13(s)) {
1099	/*
1100	* We encourage applications to only use TLSv1.3 tickets once,
1101	* so we remove this one from the cache.
1102	*/
1103	if ((s->session_ctx->session_cache_mode
1104	& SSL_SESS_CACHE_CLIENT) != 0)
1105	SSL_CTX_remove_session(s->session_ctx, s->session);
1106	} else {
1107	/*
1108	* In TLSv1.3 we update the cache as part of processing the
1109	* NewSessionTicket
1110	*/
1111	ssl_update_cache(s, SSL_SESS_CACHE_CLIENT);
1112	}
1113	if (s->hit)
1114	ssl_tsan_counter(s->session_ctx,
1115	&s->session_ctx->stats.sess_hit);
1116
1117	s->handshake_func = ossl_statem_connect;
1118	ssl_tsan_counter(s->session_ctx,
1119	&s->session_ctx->stats.sess_connect_good);
1120	}
1121
1122	if (SSL_IS_DTLS(s)) {
1123	/* done with handshaking */
1124	s->d1->handshake_read_seq = 0;
1125	s->d1->handshake_write_seq = 0;
1126	s->d1->next_handshake_write_seq = 0;
1127	dtls1_clear_received_buffer(s);
1128	}
1129	}
1130
1131	if (s->info_callback != NULL)
1132	cb = s->info_callback;
1133	else if (s->ctx->info_callback != NULL)
1134	cb = s->ctx->info_callback;
1135
1136	/* The callback may expect us to not be in init at handshake done */
1137	ossl_statem_set_in_init(s, 0);
1138
1139	if (cb != NULL) {
1140	if (cleanuphand
1141	\|\| !SSL_IS_TLS13(s)
1142	\|\| SSL_IS_FIRST_HANDSHAKE(s))
1143	cb(s, SSL_CB_HANDSHAKE_DONE, 1);
1144	}
1145
1146	if (!stop) {
1147	/* If we've got more work to do we go back into init */
1148	ossl_statem_set_in_init(s, 1);
1149	return WORK_FINISHED_CONTINUE;
1150	}
1151
1152	return WORK_FINISHED_STOP;
1153	}
1154
1155	int tls_get_message_header(SSL s, int mt)
1156	{
1157	/* s->init_num < SSL3_HM_HEADER_LENGTH */
1158	int skip_message, i, recvd_type;
1159	unsigned char *p;
1160	size_t l, readbytes;
1161
1162	p = (unsigned char *)s->init_buf->data;
1163
1164	do {
1165	while (s->init_num < SSL3_HM_HEADER_LENGTH) {
1166	i = s->method->ssl_read_bytes(s, SSL3_RT_HANDSHAKE, &recvd_type,
1167	&p[s->init_num],
1168	SSL3_HM_HEADER_LENGTH - s->init_num,
1169	0, &readbytes);
1170	if (i <= 0) {
1171	s->rwstate = SSL_READING;
1172	return 0;
1173	}
1174	if (recvd_type == SSL3_RT_CHANGE_CIPHER_SPEC) {
1175	/*
1176	* A ChangeCipherSpec must be a single byte and may not occur
1177	* in the middle of a handshake message.
1178	*/
1179	if (s->init_num != 0 \|\| readbytes != 1 \|\| p[0] != SSL3_MT_CCS) {
1180	SSLfatal(s, SSL_AD_UNEXPECTED_MESSAGE,
1181	SSL_R_BAD_CHANGE_CIPHER_SPEC);
1182	return 0;
1183	}
1184	if (s->statem.hand_state == TLS_ST_BEFORE
1185	&& (s->s3.flags & TLS1_FLAGS_STATELESS) != 0) {
1186	/*
1187	* We are stateless and we received a CCS. Probably this is
1188	* from a client between the first and second ClientHellos.
1189	* We should ignore this, but return an error because we do
1190	* not return success until we see the second ClientHello
1191	* with a valid cookie.
1192	*/
1193	return 0;
1194	}
1195	s->s3.tmp.message_type = *mt = SSL3_MT_CHANGE_CIPHER_SPEC;
1196	s->init_num = readbytes - 1;
1197	s->init_msg = s->init_buf->data;
1198	s->s3.tmp.message_size = readbytes;
1199	return 1;
1200	} else if (recvd_type != SSL3_RT_HANDSHAKE) {
1201	SSLfatal(s, SSL_AD_UNEXPECTED_MESSAGE,
1202	SSL_R_CCS_RECEIVED_EARLY);
1203	return 0;
1204	}
1205	s->init_num += readbytes;
1206	}
1207
1208	skip_message = 0;
1209	if (!s->server)
1210	if (s->statem.hand_state != TLS_ST_OK
1211	&& p[0] == SSL3_MT_HELLO_REQUEST)
1212	/*
1213	* The server may always send 'Hello Request' messages --
1214	* we are doing a handshake anyway now, so ignore them if
1215	* their format is correct. Does not count for 'Finished'
1216	* MAC.
1217	*/
1218	if (p[1] == 0 && p[2] == 0 && p[3] == 0) {
1219	s->init_num = 0;
1220	skip_message = 1;
1221
1222	if (s->msg_callback)
1223	s->msg_callback(0, s->version, SSL3_RT_HANDSHAKE,
1224	p, SSL3_HM_HEADER_LENGTH, s,
1225	s->msg_callback_arg);
1226	}
1227	} while (skip_message);
1228	/* s->init_num == SSL3_HM_HEADER_LENGTH */
1229
1230	mt = p;
1231	s->s3.tmp.message_type = *(p++);
1232
1233	if (RECORD_LAYER_is_sslv2_record(&s->rlayer)) {
1234	/*
1235	* Only happens with SSLv3+ in an SSLv2 backward compatible
1236	* ClientHello
1237	*
1238	* Total message size is the remaining record bytes to read
1239	* plus the SSL3_HM_HEADER_LENGTH bytes that we already read
1240	*/
1241	l = RECORD_LAYER_get_rrec_length(&s->rlayer)
1242	+ SSL3_HM_HEADER_LENGTH;
1243	s->s3.tmp.message_size = l;
1244
1245	s->init_msg = s->init_buf->data;
1246	s->init_num = SSL3_HM_HEADER_LENGTH;
1247	} else {
1248	n2l3(p, l);
1249	/* BUF_MEM_grow takes an 'int' parameter */
1250	if (l > (INT_MAX - SSL3_HM_HEADER_LENGTH)) {
1251	SSLfatal(s, SSL_AD_ILLEGAL_PARAMETER,
1252	SSL_R_EXCESSIVE_MESSAGE_SIZE);
1253	return 0;
1254	}
1255	s->s3.tmp.message_size = l;
1256
1257	s->init_msg = s->init_buf->data + SSL3_HM_HEADER_LENGTH;
1258	s->init_num = 0;
1259	}
1260
1261	return 1;
1262	}
1263
1264	int tls_get_message_body(SSL s, size_t len)
1265	{
1266	size_t n, readbytes;
1267	unsigned char *p;
1268	int i;
1269
1270	if (s->s3.tmp.message_type == SSL3_MT_CHANGE_CIPHER_SPEC) {
1271	/* We've already read everything in */
1272	*len = (unsigned long)s->init_num;
1273	return 1;
1274	}
1275
1276	p = s->init_msg;
1277	n = s->s3.tmp.message_size - s->init_num;
1278	while (n > 0) {
1279	i = s->method->ssl_read_bytes(s, SSL3_RT_HANDSHAKE, NULL,
1280	&p[s->init_num], n, 0, &readbytes);
1281	if (i <= 0) {
1282	s->rwstate = SSL_READING;
1283	*len = 0;
1284	return 0;
1285	}
1286	s->init_num += readbytes;
1287	n -= readbytes;
1288	}
1289
1290	/*
1291	* If receiving Finished, record MAC of prior handshake messages for
1292	* Finished verification.
1293	*/
1294	if (*(s->init_buf->data) == SSL3_MT_FINISHED && !ssl3_take_mac(s)) {
1295	/* SSLfatal() already called */
1296	*len = 0;
1297	return 0;
1298	}
1299
1300	/* Feed this message into MAC computation. */
1301	if (RECORD_LAYER_is_sslv2_record(&s->rlayer)) {
1302	if (!ssl3_finish_mac(s, (unsigned char *)s->init_buf->data,
1303	s->init_num)) {
1304	/* SSLfatal() already called */
1305	*len = 0;
1306	return 0;
1307	}
1308	if (s->msg_callback)
1309	s->msg_callback(0, SSL2_VERSION, 0, s->init_buf->data,
1310	(size_t)s->init_num, s, s->msg_callback_arg);
1311	} else {
1312	/*
1313	* We defer feeding in the HRR until later. We'll do it as part of
1314	* processing the message
1315	* The TLsv1.3 handshake transcript stops at the ClientFinished
1316	* message.
1317	*/
1318	#define SERVER_HELLO_RANDOM_OFFSET (SSL3_HM_HEADER_LENGTH + 2)
1319	/* KeyUpdate and NewSessionTicket do not need to be added */
1320	if (!SSL_IS_TLS13(s) \|\| (s->s3.tmp.message_type != SSL3_MT_NEWSESSION_TICKET
1321	&& s->s3.tmp.message_type != SSL3_MT_KEY_UPDATE)) {
1322	if (s->s3.tmp.message_type != SSL3_MT_SERVER_HELLO
1323	\|\| s->init_num < SERVER_HELLO_RANDOM_OFFSET + SSL3_RANDOM_SIZE
1324	\|\| memcmp(hrrrandom,
1325	s->init_buf->data + SERVER_HELLO_RANDOM_OFFSET,
1326	SSL3_RANDOM_SIZE) != 0) {
1327	if (!ssl3_finish_mac(s, (unsigned char *)s->init_buf->data,
1328	s->init_num + SSL3_HM_HEADER_LENGTH)) {
1329	/* SSLfatal() already called */
1330	*len = 0;
1331	return 0;
1332	}
1333	}
1334	}
1335	if (s->msg_callback)
1336	s->msg_callback(0, s->version, SSL3_RT_HANDSHAKE, s->init_buf->data,
1337	(size_t)s->init_num + SSL3_HM_HEADER_LENGTH, s,
1338	s->msg_callback_arg);
1339	}
1340
1341	*len = s->init_num;
1342	return 1;
1343	}
1344
1345	static const X509ERR2ALERT x509table[] = {
1346	{X509_V_ERR_APPLICATION_VERIFICATION, SSL_AD_HANDSHAKE_FAILURE},
1347	{X509_V_ERR_CA_KEY_TOO_SMALL, SSL_AD_BAD_CERTIFICATE},
1348	{X509_V_ERR_EC_KEY_EXPLICIT_PARAMS, SSL_AD_BAD_CERTIFICATE},
1349	{X509_V_ERR_CA_MD_TOO_WEAK, SSL_AD_BAD_CERTIFICATE},
1350	{X509_V_ERR_CERT_CHAIN_TOO_LONG, SSL_AD_UNKNOWN_CA},
1351	{X509_V_ERR_CERT_HAS_EXPIRED, SSL_AD_CERTIFICATE_EXPIRED},
1352	{X509_V_ERR_CERT_NOT_YET_VALID, SSL_AD_BAD_CERTIFICATE},
1353	{X509_V_ERR_CERT_REJECTED, SSL_AD_BAD_CERTIFICATE},
1354	{X509_V_ERR_CERT_REVOKED, SSL_AD_CERTIFICATE_REVOKED},
1355	{X509_V_ERR_CERT_SIGNATURE_FAILURE, SSL_AD_DECRYPT_ERROR},
1356	{X509_V_ERR_CERT_UNTRUSTED, SSL_AD_BAD_CERTIFICATE},
1357	{X509_V_ERR_CRL_HAS_EXPIRED, SSL_AD_CERTIFICATE_EXPIRED},
1358	{X509_V_ERR_CRL_NOT_YET_VALID, SSL_AD_BAD_CERTIFICATE},
1359	{X509_V_ERR_CRL_SIGNATURE_FAILURE, SSL_AD_DECRYPT_ERROR},
1360	{X509_V_ERR_DANE_NO_MATCH, SSL_AD_BAD_CERTIFICATE},
1361	{X509_V_ERR_DEPTH_ZERO_SELF_SIGNED_CERT, SSL_AD_UNKNOWN_CA},
1362	{X509_V_ERR_EE_KEY_TOO_SMALL, SSL_AD_BAD_CERTIFICATE},
1363	{X509_V_ERR_EMAIL_MISMATCH, SSL_AD_BAD_CERTIFICATE},
1364	{X509_V_ERR_ERROR_IN_CERT_NOT_AFTER_FIELD, SSL_AD_BAD_CERTIFICATE},
1365	{X509_V_ERR_ERROR_IN_CERT_NOT_BEFORE_FIELD, SSL_AD_BAD_CERTIFICATE},
1366	{X509_V_ERR_ERROR_IN_CRL_LAST_UPDATE_FIELD, SSL_AD_BAD_CERTIFICATE},
1367	{X509_V_ERR_ERROR_IN_CRL_NEXT_UPDATE_FIELD, SSL_AD_BAD_CERTIFICATE},
1368	{X509_V_ERR_HOSTNAME_MISMATCH, SSL_AD_BAD_CERTIFICATE},
1369	{X509_V_ERR_INVALID_CA, SSL_AD_UNKNOWN_CA},
1370	{X509_V_ERR_INVALID_CALL, SSL_AD_INTERNAL_ERROR},
1371	{X509_V_ERR_INVALID_PURPOSE, SSL_AD_UNSUPPORTED_CERTIFICATE},
1372	{X509_V_ERR_IP_ADDRESS_MISMATCH, SSL_AD_BAD_CERTIFICATE},
1373	{X509_V_ERR_OUT_OF_MEM, SSL_AD_INTERNAL_ERROR},
1374	{X509_V_ERR_PATH_LENGTH_EXCEEDED, SSL_AD_UNKNOWN_CA},
1375	{X509_V_ERR_SELF_SIGNED_CERT_IN_CHAIN, SSL_AD_UNKNOWN_CA},
1376	{X509_V_ERR_STORE_LOOKUP, SSL_AD_INTERNAL_ERROR},
1377	{X509_V_ERR_UNABLE_TO_DECODE_ISSUER_PUBLIC_KEY, SSL_AD_BAD_CERTIFICATE},
1378	{X509_V_ERR_UNABLE_TO_DECRYPT_CERT_SIGNATURE, SSL_AD_BAD_CERTIFICATE},
1379	{X509_V_ERR_UNABLE_TO_DECRYPT_CRL_SIGNATURE, SSL_AD_BAD_CERTIFICATE},
1380	{X509_V_ERR_UNABLE_TO_GET_CRL, SSL_AD_UNKNOWN_CA},
1381	{X509_V_ERR_UNABLE_TO_GET_CRL_ISSUER, SSL_AD_UNKNOWN_CA},
1382	{X509_V_ERR_UNABLE_TO_GET_ISSUER_CERT, SSL_AD_UNKNOWN_CA},
1383	{X509_V_ERR_UNABLE_TO_GET_ISSUER_CERT_LOCALLY, SSL_AD_UNKNOWN_CA},
1384	{X509_V_ERR_UNABLE_TO_VERIFY_LEAF_SIGNATURE, SSL_AD_UNKNOWN_CA},
1385	{X509_V_ERR_UNSPECIFIED, SSL_AD_INTERNAL_ERROR},
1386
1387	/* Last entry; return this if we don't find the value above. */
1388	{X509_V_OK, SSL_AD_CERTIFICATE_UNKNOWN}
1389	};
1390
1391	int ssl_x509err2alert(int x509err)
1392	{
1393	const X509ERR2ALERT *tp;
1394
1395	for (tp = x509table; tp->x509err != X509_V_OK; ++tp)
1396	if (tp->x509err == x509err)
1397	break;
1398	return tp->alert;
1399	}
1400
1401	int ssl_allow_compression(SSL *s)
1402	{
1403	if (s->options & SSL_OP_NO_COMPRESSION)
1404	return 0;
1405	return ssl_security(s, SSL_SECOP_COMPRESSION, 0, 0, NULL);
1406	}
1407
1408	static int version_cmp(const SSL *s, int a, int b)
1409	{
1410	int dtls = SSL_IS_DTLS(s);
1411
1412	if (a == b)
1413	return 0;
1414	if (!dtls)
1415	return a < b ? -1 : 1;
1416	return DTLS_VERSION_LT(a, b) ? -1 : 1;
1417	}
1418
1419	typedef struct {
1420	int version;
1421	const SSL_METHOD (cmeth) (void);
1422	const SSL_METHOD (smeth) (void);
1423	} version_info;
1424
1425	#if TLS_MAX_VERSION_INTERNAL != TLS1_3_VERSION
1426	# error Code needs update for TLS_method() support beyond TLS1_3_VERSION.
1427	#endif
1428
1429	/* Must be in order high to low */
1430	static const version_info tls_version_table[] = {
1431	#ifndef OPENSSL_NO_TLS1_3
1432	{TLS1_3_VERSION, tlsv1_3_client_method, tlsv1_3_server_method},
1433	#else
1434	{TLS1_3_VERSION, NULL, NULL},
1435	#endif
1436	#ifndef OPENSSL_NO_TLS1_2
1437	{TLS1_2_VERSION, tlsv1_2_client_method, tlsv1_2_server_method},
1438	#else
1439	{TLS1_2_VERSION, NULL, NULL},
1440	#endif
1441	#ifndef OPENSSL_NO_TLS1_1
1442	{TLS1_1_VERSION, tlsv1_1_client_method, tlsv1_1_server_method},
1443	#else
1444	{TLS1_1_VERSION, NULL, NULL},
1445	#endif
1446	#ifndef OPENSSL_NO_TLS1
1447	{TLS1_VERSION, tlsv1_client_method, tlsv1_server_method},
1448	#else
1449	{TLS1_VERSION, NULL, NULL},
1450	#endif
1451	#ifndef OPENSSL_NO_SSL3
1452	{SSL3_VERSION, sslv3_client_method, sslv3_server_method},
1453	#else
1454	{SSL3_VERSION, NULL, NULL},
1455	#endif
1456	{0, NULL, NULL},
1457	};
1458
1459	#if DTLS_MAX_VERSION_INTERNAL != DTLS1_2_VERSION
1460	# error Code needs update for DTLS_method() support beyond DTLS1_2_VERSION.
1461	#endif
1462
1463	/* Must be in order high to low */
1464	static const version_info dtls_version_table[] = {
1465	#ifndef OPENSSL_NO_DTLS1_2
1466	{DTLS1_2_VERSION, dtlsv1_2_client_method, dtlsv1_2_server_method},
1467	#else
1468	{DTLS1_2_VERSION, NULL, NULL},
1469	#endif
1470	#ifndef OPENSSL_NO_DTLS1
1471	{DTLS1_VERSION, dtlsv1_client_method, dtlsv1_server_method},
1472	{DTLS1_BAD_VER, dtls_bad_ver_client_method, NULL},
1473	#else
1474	{DTLS1_VERSION, NULL, NULL},
1475	{DTLS1_BAD_VER, NULL, NULL},
1476	#endif
1477	{0, NULL, NULL},
1478	};
1479
1480	/*
1481	* ssl_method_error - Check whether an SSL_METHOD is enabled.
1482	*
1483	* @s: The SSL handle for the candidate method
1484	* @method: the intended method.
1485	*
1486	* Returns 0 on success, or an SSL error reason on failure.
1487	*/
1488	static int ssl_method_error(const SSL s, const SSL_METHOD method)
1489	{
1490	int version = method->version;
1491
1492	if ((s->min_proto_version != 0 &&
1493	version_cmp(s, version, s->min_proto_version) < 0) \|\|
1494	ssl_security(s, SSL_SECOP_VERSION, 0, version, NULL) == 0)
1495	return SSL_R_VERSION_TOO_LOW;
1496
1497	if (s->max_proto_version != 0 &&
1498	version_cmp(s, version, s->max_proto_version) > 0)
1499	return SSL_R_VERSION_TOO_HIGH;
1500
1501	if ((s->options & method->mask) != 0)
1502	return SSL_R_UNSUPPORTED_PROTOCOL;
1503	if ((method->flags & SSL_METHOD_NO_SUITEB) != 0 && tls1_suiteb(s))
1504	return SSL_R_AT_LEAST_TLS_1_2_NEEDED_IN_SUITEB_MODE;
1505
1506	return 0;
1507	}
1508
1509	/*
1510	* Only called by servers. Returns 1 if the server has a TLSv1.3 capable
1511	* certificate type, or has PSK or a certificate callback configured, or has
1512	* a servername callback configure. Otherwise returns 0.
1513	*/
1514	static int is_tls13_capable(const SSL *s)
1515	{
1516	int i;
1517	int curve;
1518
1519	if (!ossl_assert(s->ctx != NULL) \|\| !ossl_assert(s->session_ctx != NULL))
1520	return 0;
1521
1522	/*
1523	* A servername callback can change the available certs, so if a servername
1524	* cb is set then we just assume TLSv1.3 will be ok
1525	*/
1526	if (s->ctx->ext.servername_cb != NULL
1527	\|\| s->session_ctx->ext.servername_cb != NULL)
1528	return 1;
1529
1530	#ifndef OPENSSL_NO_PSK
1531	if (s->psk_server_callback != NULL)
1532	return 1;
1533	#endif
1534
1535	if (s->psk_find_session_cb != NULL \|\| s->cert->cert_cb != NULL)
1536	return 1;
1537
1538	for (i = 0; i < SSL_PKEY_NUM; i++) {
1539	/* Skip over certs disallowed for TLSv1.3 */
1540	switch (i) {
1541	case SSL_PKEY_DSA_SIGN:
1542	case SSL_PKEY_GOST01:
1543	case SSL_PKEY_GOST12_256:
1544	case SSL_PKEY_GOST12_512:
1545	continue;
1546	default:
1547	break;
1548	}
1549	if (!ssl_has_cert(s, i))
1550	continue;
1551	if (i != SSL_PKEY_ECC)
1552	return 1;
1553	/*
1554	* Prior to TLSv1.3 sig algs allowed any curve to be used. TLSv1.3 is
1555	* more restrictive so check that our sig algs are consistent with this
1556	* EC cert. See section 4.2.3 of RFC8446.
1557	*/
1558	curve = ssl_get_EC_curve_nid(s->cert->pkeys[SSL_PKEY_ECC].privatekey);
1559	if (tls_check_sigalg_curve(s, curve))
1560	return 1;
1561	}
1562
1563	return 0;
1564	}
1565
1566	/*
1567	* ssl_version_supported - Check that the specified `version` is supported by
1568	* `SSL *` instance
1569	*
1570	* @s: The SSL handle for the candidate method
1571	* @version: Protocol version to test against
1572	*
1573	* Returns 1 when supported, otherwise 0
1574	*/
1575	int ssl_version_supported(const SSL s, int version, const SSL_METHOD *meth)
1576	{
1577	const version_info *vent;
1578	const version_info *table;
1579
1580	switch (s->method->version) {
1581	default:
1582	/* Version should match method version for non-ANY method */
1583	return version_cmp(s, version, s->version) == 0;
1584	case TLS_ANY_VERSION:
1585	table = tls_version_table;
1586	break;
1587	case DTLS_ANY_VERSION:
1588	table = dtls_version_table;
1589	break;
1590	}
1591
1592	for (vent = table;
1593	vent->version != 0 && version_cmp(s, version, vent->version) <= 0;
1594	++vent) {
1595	if (vent->cmeth != NULL
1596	&& version_cmp(s, version, vent->version) == 0
1597	&& ssl_method_error(s, vent->cmeth()) == 0
1598	&& (!s->server
1599	\|\| version != TLS1_3_VERSION
1600	\|\| is_tls13_capable(s))) {
1601	if (meth != NULL)
1602	*meth = vent->cmeth();
1603	return 1;
1604	}
1605	}
1606	return 0;
1607	}
1608
1609	/*
1610	* ssl_check_version_downgrade - In response to RFC7507 SCSV version
1611	* fallback indication from a client check whether we're using the highest
1612	* supported protocol version.
1613	*
1614	* @s server SSL handle.
1615	*
1616	* Returns 1 when using the highest enabled version, 0 otherwise.
1617	*/
1618	int ssl_check_version_downgrade(SSL *s)
1619	{
1620	const version_info *vent;
1621	const version_info *table;
1622
1623	/*
1624	* Check that the current protocol is the highest enabled version
1625	* (according to s->ctx->method, as version negotiation may have changed
1626	* s->method).
1627	*/
1628	if (s->version == s->ctx->method->version)
1629	return 1;
1630
1631	/*
1632	* Apparently we're using a version-flexible SSL_METHOD (not at its
1633	* highest protocol version).
1634	*/
1635	if (s->ctx->method->version == TLS_method()->version)
1636	table = tls_version_table;
1637	else if (s->ctx->method->version == DTLS_method()->version)
1638	table = dtls_version_table;
1639	else {
1640	/* Unexpected state; fail closed. */
1641	return 0;
1642	}
1643
1644	for (vent = table; vent->version != 0; ++vent) {
1645	if (vent->smeth != NULL && ssl_method_error(s, vent->smeth()) == 0)
1646	return s->version == vent->version;
1647	}
1648	return 0;
1649	}
1650
1651	/*
1652	* ssl_set_version_bound - set an upper or lower bound on the supported (D)TLS
1653	* protocols, provided the initial (D)TLS method is version-flexible. This
1654	* function sanity-checks the proposed value and makes sure the method is
1655	* version-flexible, then sets the limit if all is well.
1656	*
1657	* @method_version: The version of the current SSL_METHOD.
1658	* @version: the intended limit.
1659	* @bound: pointer to limit to be updated.
1660	*
1661	* Returns 1 on success, 0 on failure.
1662	*/
1663	int ssl_set_version_bound(int method_version, int version, int *bound)
1664	{
1665	int valid_tls;
1666	int valid_dtls;
1667
1668	if (version == 0) {
1669	*bound = version;
1670	return 1;
1671	}
1672
1673	valid_tls = version >= SSL3_VERSION && version <= TLS_MAX_VERSION_INTERNAL;
1674	valid_dtls =
1675	DTLS_VERSION_LE(version, DTLS_MAX_VERSION_INTERNAL) &&
1676	DTLS_VERSION_GE(version, DTLS1_BAD_VER);
1677
1678	if (!valid_tls && !valid_dtls)
1679	return 0;
1680
1681	/*-
1682	* Restrict TLS methods to TLS protocol versions.
1683	* Restrict DTLS methods to DTLS protocol versions.
1684	* Note, DTLS version numbers are decreasing, use comparison macros.
1685	*
1686	* Note that for both lower-bounds we use explicit versions, not
1687	* (D)TLS_MIN_VERSION. This is because we don't want to break user
1688	* configurations. If the MIN (supported) version ever rises, the user's
1689	* "floor" remains valid even if no longer available. We don't expect the
1690	* MAX ceiling to ever get lower, so making that variable makes sense.
1691	*
1692	* We ignore attempts to set bounds on version-inflexible methods,
1693	* returning success.
1694	*/
1695	switch (method_version) {
1696	default:
1697	break;
1698
1699	case TLS_ANY_VERSION:
1700	if (valid_tls)
1701	*bound = version;
1702	break;
1703
1704	case DTLS_ANY_VERSION:
1705	if (valid_dtls)
1706	*bound = version;
1707	break;
1708	}
1709	return 1;
1710	}
1711
1712	static void check_for_downgrade(SSL s, int vers, DOWNGRADE dgrd)
1713	{
1714	if (vers == TLS1_2_VERSION
1715	&& ssl_version_supported(s, TLS1_3_VERSION, NULL)) {
1716	*dgrd = DOWNGRADE_TO_1_2;
1717	} else if (!SSL_IS_DTLS(s)
1718	&& vers < TLS1_2_VERSION
1719	/*
1720	* We need to ensure that a server that disables TLSv1.2
1721	* (creating a hole between TLSv1.3 and TLSv1.1) can still
1722	* complete handshakes with clients that support TLSv1.2 and
1723	* below. Therefore we do not enable the sentinel if TLSv1.3 is
1724	* enabled and TLSv1.2 is not.
1725	*/
1726	&& ssl_version_supported(s, TLS1_2_VERSION, NULL)) {
1727	*dgrd = DOWNGRADE_TO_1_1;
1728	} else {
1729	*dgrd = DOWNGRADE_NONE;
1730	}
1731	}
1732
1733	/*
1734	* ssl_choose_server_version - Choose server (D)TLS version. Called when the
1735	* client HELLO is received to select the final server protocol version and
1736	* the version specific method.
1737	*
1738	* @s: server SSL handle.
1739	*
1740	* Returns 0 on success or an SSL error reason number on failure.
1741	*/
1742	int ssl_choose_server_version(SSL s, CLIENTHELLO_MSG hello, DOWNGRADE *dgrd)
1743	{
1744	/*-
1745	* With version-flexible methods we have an initial state with:
1746	*
1747	* s->method->version == (D)TLS_ANY_VERSION,
1748	* s->version == (D)TLS_MAX_VERSION_INTERNAL.
1749	*
1750	* So we detect version-flexible methods via the method version, not the
1751	* handle version.
1752	*/
1753	int server_version = s->method->version;
1754	int client_version = hello->legacy_version;
1755	const version_info *vent;
1756	const version_info *table;
1757	int disabled = 0;
1758	RAW_EXTENSION *suppversions;
1759
1760	s->client_version = client_version;
1761
1762	switch (server_version) {
1763	default:
1764	if (!SSL_IS_TLS13(s)) {
1765	if (version_cmp(s, client_version, s->version) < 0)
1766	return SSL_R_WRONG_SSL_VERSION;
1767	*dgrd = DOWNGRADE_NONE;
1768	/*
1769	* If this SSL handle is not from a version flexible method we don't
1770	* (and never did) check min/max FIPS or Suite B constraints. Hope
1771	* that's OK. It is up to the caller to not choose fixed protocol
1772	* versions they don't want. If not, then easy to fix, just return
1773	* ssl_method_error(s, s->method)
1774	*/
1775	return 0;
1776	}
1777	/*
1778	* Fall through if we are TLSv1.3 already (this means we must be after
1779	* a HelloRetryRequest
1780	*/
1781	/* fall thru */
1782	case TLS_ANY_VERSION:
1783	table = tls_version_table;
1784	break;
1785	case DTLS_ANY_VERSION:
1786	table = dtls_version_table;
1787	break;
1788	}
1789
1790	suppversions = &hello->pre_proc_exts[TLSEXT_IDX_supported_versions];
1791
1792	/* If we did an HRR then supported versions is mandatory */
1793	if (!suppversions->present && s->hello_retry_request != SSL_HRR_NONE)
1794	return SSL_R_UNSUPPORTED_PROTOCOL;
1795
1796	if (suppversions->present && !SSL_IS_DTLS(s)) {
1797	unsigned int candidate_vers = 0;
1798	unsigned int best_vers = 0;
1799	const SSL_METHOD *best_method = NULL;
1800	PACKET versionslist;
1801
1802	suppversions->parsed = 1;
1803
1804	if (!PACKET_as_length_prefixed_1(&suppversions->data, &versionslist)) {
1805	/* Trailing or invalid data? */
1806	return SSL_R_LENGTH_MISMATCH;
1807	}
1808
1809	/*
1810	* The TLSv1.3 spec says the client MUST set this to TLS1_2_VERSION.
1811	* The spec only requires servers to check that it isn't SSLv3:
1812	* "Any endpoint receiving a Hello message with
1813	* ClientHello.legacy_version or ServerHello.legacy_version set to
1814	* 0x0300 MUST abort the handshake with a "protocol_version" alert."
1815	* We are slightly stricter and require that it isn't SSLv3 or lower.
1816	* We tolerate TLSv1 and TLSv1.1.
1817	*/
1818	if (client_version <= SSL3_VERSION)
1819	return SSL_R_BAD_LEGACY_VERSION;
1820
1821	while (PACKET_get_net_2(&versionslist, &candidate_vers)) {
1822	if (version_cmp(s, candidate_vers, best_vers) <= 0)
1823	continue;
1824	if (ssl_version_supported(s, candidate_vers, &best_method))
1825	best_vers = candidate_vers;
1826	}
1827	if (PACKET_remaining(&versionslist) != 0) {
1828	/* Trailing data? */
1829	return SSL_R_LENGTH_MISMATCH;
1830	}
1831
1832	if (best_vers > 0) {
1833	if (s->hello_retry_request != SSL_HRR_NONE) {
1834	/*
1835	* This is after a HelloRetryRequest so we better check that we
1836	* negotiated TLSv1.3
1837	*/
1838	if (best_vers != TLS1_3_VERSION)
1839	return SSL_R_UNSUPPORTED_PROTOCOL;
1840	return 0;
1841	}
1842	check_for_downgrade(s, best_vers, dgrd);
1843	s->version = best_vers;
1844	s->method = best_method;
1845	return 0;
1846	}
1847	return SSL_R_UNSUPPORTED_PROTOCOL;
1848	}
1849
1850	/*
1851	* If the supported versions extension isn't present, then the highest
1852	* version we can negotiate is TLSv1.2
1853	*/
1854	if (version_cmp(s, client_version, TLS1_3_VERSION) >= 0)
1855	client_version = TLS1_2_VERSION;
1856
1857	/*
1858	* No supported versions extension, so we just use the version supplied in
1859	* the ClientHello.
1860	*/
1861	for (vent = table; vent->version != 0; ++vent) {
1862	const SSL_METHOD *method;
1863
1864	if (vent->smeth == NULL \|\|
1865	version_cmp(s, client_version, vent->version) < 0)
1866	continue;
1867	method = vent->smeth();
1868	if (ssl_method_error(s, method) == 0) {
1869	check_for_downgrade(s, vent->version, dgrd);
1870	s->version = vent->version;
1871	s->method = method;
1872	return 0;
1873	}
1874	disabled = 1;
1875	}
1876	return disabled ? SSL_R_UNSUPPORTED_PROTOCOL : SSL_R_VERSION_TOO_LOW;
1877	}
1878
1879	/*
1880	* ssl_choose_client_version - Choose client (D)TLS version. Called when the
1881	* server HELLO is received to select the final client protocol version and
1882	* the version specific method.
1883	*
1884	* @s: client SSL handle.
1885	* @version: The proposed version from the server's HELLO.
1886	* @extensions: The extensions received
1887	*
1888	* Returns 1 on success or 0 on error.
1889	*/
1890	int ssl_choose_client_version(SSL s, int version, RAW_EXTENSION extensions)
1891	{
1892	const version_info *vent;
1893	const version_info *table;
1894	int ret, ver_min, ver_max, real_max, origv;
1895
1896	origv = s->version;
1897	s->version = version;
1898
1899	/* This will overwrite s->version if the extension is present */
1900	if (!tls_parse_extension(s, TLSEXT_IDX_supported_versions,
1901	SSL_EXT_TLS1_2_SERVER_HELLO
1902	\| SSL_EXT_TLS1_3_SERVER_HELLO, extensions,
1903	NULL, 0)) {
1904	s->version = origv;
1905	return 0;
1906	}
1907
1908	if (s->hello_retry_request != SSL_HRR_NONE
1909	&& s->version != TLS1_3_VERSION) {
1910	s->version = origv;
1911	SSLfatal(s, SSL_AD_PROTOCOL_VERSION, SSL_R_WRONG_SSL_VERSION);
1912	return 0;
1913	}
1914
1915	switch (s->method->version) {
1916	default:
1917	if (s->version != s->method->version) {
1918	s->version = origv;
1919	SSLfatal(s, SSL_AD_PROTOCOL_VERSION, SSL_R_WRONG_SSL_VERSION);
1920	return 0;
1921	}
1922	/*
1923	* If this SSL handle is not from a version flexible method we don't
1924	* (and never did) check min/max, FIPS or Suite B constraints. Hope
1925	* that's OK. It is up to the caller to not choose fixed protocol
1926	* versions they don't want. If not, then easy to fix, just return
1927	* ssl_method_error(s, s->method)
1928	*/
1929	return 1;
1930	case TLS_ANY_VERSION:
1931	table = tls_version_table;
1932	break;
1933	case DTLS_ANY_VERSION:
1934	table = dtls_version_table;
1935	break;
1936	}
1937
1938	ret = ssl_get_min_max_version(s, &ver_min, &ver_max, &real_max);
1939	if (ret != 0) {
1940	s->version = origv;
1941	SSLfatal(s, SSL_AD_PROTOCOL_VERSION, ret);
1942	return 0;
1943	}
1944	if (SSL_IS_DTLS(s) ? DTLS_VERSION_LT(s->version, ver_min)
1945	: s->version < ver_min) {
1946	s->version = origv;
1947	SSLfatal(s, SSL_AD_PROTOCOL_VERSION, SSL_R_UNSUPPORTED_PROTOCOL);
1948	return 0;
1949	} else if (SSL_IS_DTLS(s) ? DTLS_VERSION_GT(s->version, ver_max)
1950	: s->version > ver_max) {
1951	s->version = origv;
1952	SSLfatal(s, SSL_AD_PROTOCOL_VERSION, SSL_R_UNSUPPORTED_PROTOCOL);
1953	return 0;
1954	}
1955
1956	if ((s->mode & SSL_MODE_SEND_FALLBACK_SCSV) == 0)
1957	real_max = ver_max;
1958
1959	/* Check for downgrades */
1960	if (s->version == TLS1_2_VERSION && real_max > s->version) {
1961	if (memcmp(tls12downgrade,
1962	s->s3.server_random + SSL3_RANDOM_SIZE
1963	- sizeof(tls12downgrade),
1964	sizeof(tls12downgrade)) == 0) {
1965	s->version = origv;
1966	SSLfatal(s, SSL_AD_ILLEGAL_PARAMETER,
1967	SSL_R_INAPPROPRIATE_FALLBACK);
1968	return 0;
1969	}
1970	} else if (!SSL_IS_DTLS(s)
1971	&& s->version < TLS1_2_VERSION
1972	&& real_max > s->version) {
1973	if (memcmp(tls11downgrade,
1974	s->s3.server_random + SSL3_RANDOM_SIZE
1975	- sizeof(tls11downgrade),
1976	sizeof(tls11downgrade)) == 0) {
1977	s->version = origv;
1978	SSLfatal(s, SSL_AD_ILLEGAL_PARAMETER,
1979	SSL_R_INAPPROPRIATE_FALLBACK);
1980	return 0;
1981	}
1982	}
1983
1984	for (vent = table; vent->version != 0; ++vent) {
1985	if (vent->cmeth == NULL \|\| s->version != vent->version)
1986	continue;
1987
1988	s->method = vent->cmeth();
1989	return 1;
1990	}
1991
1992	s->version = origv;
1993	SSLfatal(s, SSL_AD_PROTOCOL_VERSION, SSL_R_UNSUPPORTED_PROTOCOL);
1994	return 0;
1995	}
1996
1997	/*
1998	* ssl_get_min_max_version - get minimum and maximum protocol version
1999	* @s: The SSL connection
2000	* @min_version: The minimum supported version
2001	* @max_version: The maximum supported version
2002	* @real_max: The highest version below the lowest compile time version hole
2003	* where that hole lies above at least one run-time enabled
2004	* protocol.
2005	*
2006	* Work out what version we should be using for the initial ClientHello if the
2007	* version is initially (D)TLS_ANY_VERSION. We apply any explicit SSL_OP_NO_xxx
2008	* options, the MinProtocol and MaxProtocol configuration commands, any Suite B
2009	* constraints and any floor imposed by the security level here,
2010	* so we don't advertise the wrong protocol version to only reject the outcome later.
2011	*
2012	* Computing the right floor matters. If, e.g., TLS 1.0 and 1.2 are enabled,
2013	* TLS 1.1 is disabled, but the security level, Suite-B and/or MinProtocol
2014	* only allow TLS 1.2, we want to advertise TLS1.2, not TLS1.
2015	*
2016	* Returns 0 on success or an SSL error reason number on failure. On failure
2017	* min_version and max_version will also be set to 0.
2018	*/
2019	int ssl_get_min_max_version(const SSL s, int min_version, int *max_version,
2020	int *real_max)
2021	{
2022	int version, tmp_real_max;
2023	int hole;
2024	const SSL_METHOD *single = NULL;
2025	const SSL_METHOD *method;
2026	const version_info *table;
2027	const version_info *vent;
2028
2029	switch (s->method->version) {
2030	default:
2031	/*
2032	* If this SSL handle is not from a version flexible method we don't
2033	* (and never did) check min/max FIPS or Suite B constraints. Hope
2034	* that's OK. It is up to the caller to not choose fixed protocol
2035	* versions they don't want. If not, then easy to fix, just return
2036	* ssl_method_error(s, s->method)
2037	*/
2038	min_version = max_version = s->version;
2039	/*
2040	* Providing a real_max only makes sense where we're using a version
2041	* flexible method.
2042	*/
2043	if (!ossl_assert(real_max == NULL))
2044	return ERR_R_INTERNAL_ERROR;
2045	return 0;
2046	case TLS_ANY_VERSION:
2047	table = tls_version_table;
2048	break;
2049	case DTLS_ANY_VERSION:
2050	table = dtls_version_table;
2051	break;
2052	}
2053
2054	/*
2055	* SSL_OP_NO_X disables all protocols above X if there are some protocols
2056	* below X enabled. This is required in order to maintain the "version
2057	* capability" vector contiguous. Any versions with a NULL client method
2058	* (protocol version client is disabled at compile-time) is also a "hole".
2059	*
2060	* Our initial state is hole == 1, version == 0. That is, versions above
2061	* the first version in the method table are disabled (a "hole" above
2062	* the valid protocol entries) and we don't have a selected version yet.
2063	*
2064	* Whenever "hole == 1", and we hit an enabled method, its version becomes
2065	* the selected version, and the method becomes a candidate "single"
2066	* method. We're no longer in a hole, so "hole" becomes 0.
2067	*
2068	* If "hole == 0" and we hit an enabled method, then "single" is cleared,
2069	* as we support a contiguous range of at least two methods. If we hit
2070	* a disabled method, then hole becomes true again, but nothing else
2071	* changes yet, because all the remaining methods may be disabled too.
2072	* If we again hit an enabled method after the new hole, it becomes
2073	* selected, as we start from scratch.
2074	*/
2075	*min_version = version = 0;
2076	hole = 1;
2077	if (real_max != NULL)
2078	*real_max = 0;
2079	tmp_real_max = 0;
2080	for (vent = table; vent->version != 0; ++vent) {
2081	/*
2082	* A table entry with a NULL client method is still a hole in the
2083	* "version capability" vector.
2084	*/
2085	if (vent->cmeth == NULL) {
2086	hole = 1;
2087	tmp_real_max = 0;
2088	continue;
2089	}
2090	method = vent->cmeth();
2091
2092	if (hole == 1 && tmp_real_max == 0)
2093	tmp_real_max = vent->version;
2094
2095	if (ssl_method_error(s, method) != 0) {
2096	hole = 1;
2097	} else if (!hole) {
2098	single = NULL;
2099	*min_version = method->version;
2100	} else {
2101	if (real_max != NULL && tmp_real_max != 0)
2102	*real_max = tmp_real_max;
2103	version = (single = method)->version;
2104	*min_version = version;
2105	hole = 0;
2106	}
2107	}
2108
2109	*max_version = version;
2110
2111	/* Fail if everything is disabled */
2112	if (version == 0)
2113	return SSL_R_NO_PROTOCOLS_AVAILABLE;
2114
2115	return 0;
2116	}
2117
2118	/*
2119	* ssl_set_client_hello_version - Work out what version we should be using for
2120	* the initial ClientHello.legacy_version field.
2121	*
2122	* @s: client SSL handle.
2123	*
2124	* Returns 0 on success or an SSL error reason number on failure.
2125	*/
2126	int ssl_set_client_hello_version(SSL *s)
2127	{
2128	int ver_min, ver_max, ret;
2129
2130	/*
2131	* In a renegotiation we always send the same client_version that we sent
2132	* last time, regardless of which version we eventually negotiated.
2133	*/
2134	if (!SSL_IS_FIRST_HANDSHAKE(s))
2135	return 0;
2136
2137	ret = ssl_get_min_max_version(s, &ver_min, &ver_max, NULL);
2138
2139	if (ret != 0)
2140	return ret;
2141
2142	s->version = ver_max;
2143
2144	/* TLS1.3 always uses TLS1.2 in the legacy_version field */
2145	if (!SSL_IS_DTLS(s) && ver_max > TLS1_2_VERSION)
2146	ver_max = TLS1_2_VERSION;
2147
2148	s->client_version = ver_max;
2149	return 0;
2150	}
2151
2152	/*
2153	* Checks a list of \|groups\| to determine if the \|group_id\| is in it. If it is
2154	* and \|checkallow\| is 1 then additionally check if the group is allowed to be
2155	* used. Returns 1 if the group is in the list (and allowed if \|checkallow\| is
2156	* 1) or 0 otherwise.
2157	*/
2158	int check_in_list(SSL s, uint16_t group_id, const uint16_t groups,
2159	size_t num_groups, int checkallow)
2160	{
2161	size_t i;
2162
2163	if (groups == NULL \|\| num_groups == 0)
2164	return 0;
2165
2166	for (i = 0; i < num_groups; i++) {
2167	uint16_t group = groups[i];
2168
2169	if (group_id == group
2170	&& (!checkallow
2171	\|\| tls_group_allowed(s, group, SSL_SECOP_CURVE_CHECK))) {
2172	return 1;
2173	}
2174	}
2175
2176	return 0;
2177	}
2178
2179	/* Replace ClientHello1 in the transcript hash with a synthetic message */
2180	int create_synthetic_message_hash(SSL s, const unsigned char hashval,
2181	size_t hashlen, const unsigned char *hrr,
2182	size_t hrrlen)
2183	{
2184	unsigned char hashvaltmp[EVP_MAX_MD_SIZE];
2185	unsigned char msghdr[SSL3_HM_HEADER_LENGTH];
2186
2187	memset(msghdr, 0, sizeof(msghdr));
2188
2189	if (hashval == NULL) {
2190	hashval = hashvaltmp;
2191	hashlen = 0;
2192	/* Get the hash of the initial ClientHello */
2193	if (!ssl3_digest_cached_records(s, 0)
2194	\|\| !ssl_handshake_hash(s, hashvaltmp, sizeof(hashvaltmp),
2195	&hashlen)) {
2196	/* SSLfatal() already called */
2197	return 0;
2198	}
2199	}
2200
2201	/* Reinitialise the transcript hash */
2202	if (!ssl3_init_finished_mac(s)) {
2203	/* SSLfatal() already called */
2204	return 0;
2205	}
2206
2207	/* Inject the synthetic message_hash message */
2208	msghdr[0] = SSL3_MT_MESSAGE_HASH;
2209	msghdr[SSL3_HM_HEADER_LENGTH - 1] = (unsigned char)hashlen;
2210	if (!ssl3_finish_mac(s, msghdr, SSL3_HM_HEADER_LENGTH)
2211	\|\| !ssl3_finish_mac(s, hashval, hashlen)) {
2212	/* SSLfatal() already called */
2213	return 0;
2214	}
2215
2216	/*
2217	* Now re-inject the HRR and current message if appropriate (we just deleted
2218	* it when we reinitialised the transcript hash above). Only necessary after
2219	* receiving a ClientHello2 with a cookie.
2220	*/
2221	if (hrr != NULL
2222	&& (!ssl3_finish_mac(s, hrr, hrrlen)
2223	\|\| !ssl3_finish_mac(s, (unsigned char *)s->init_buf->data,
2224	s->s3.tmp.message_size
2225	+ SSL3_HM_HEADER_LENGTH))) {
2226	/* SSLfatal() already called */
2227	return 0;
2228	}
2229
2230	return 1;
2231	}
2232
2233	static int ca_dn_cmp(const X509_NAME const a, const X509_NAME const b)
2234	{
2235	return X509_NAME_cmp(a, b);
2236	}
2237
2238	int parse_ca_names(SSL s, PACKET pkt)
2239	{
2240	STACK_OF(X509_NAME) *ca_sk = sk_X509_NAME_new(ca_dn_cmp);
2241	X509_NAME *xn = NULL;
2242	PACKET cadns;
2243
2244	if (ca_sk == NULL) {
2245	SSLfatal(s, SSL_AD_INTERNAL_ERROR, ERR_R_MALLOC_FAILURE);
2246	goto err;
2247	}
2248	/* get the CA RDNs */
2249	if (!PACKET_get_length_prefixed_2(pkt, &cadns)) {
2250	SSLfatal(s, SSL_AD_DECODE_ERROR, SSL_R_LENGTH_MISMATCH);
2251	goto err;
2252	}
2253
2254	while (PACKET_remaining(&cadns)) {
2255	const unsigned char namestart, namebytes;
2256	unsigned int name_len;
2257
2258	if (!PACKET_get_net_2(&cadns, &name_len)
2259	\|\| !PACKET_get_bytes(&cadns, &namebytes, name_len)) {
2260	SSLfatal(s, SSL_AD_DECODE_ERROR, SSL_R_LENGTH_MISMATCH);
2261	goto err;
2262	}
2263
2264	namestart = namebytes;
2265	if ((xn = d2i_X509_NAME(NULL, &namebytes, name_len)) == NULL) {
2266	SSLfatal(s, SSL_AD_DECODE_ERROR, ERR_R_ASN1_LIB);
2267	goto err;
2268	}
2269	if (namebytes != (namestart + name_len)) {
2270	SSLfatal(s, SSL_AD_DECODE_ERROR, SSL_R_CA_DN_LENGTH_MISMATCH);
2271	goto err;
2272	}
2273
2274	if (!sk_X509_NAME_push(ca_sk, xn)) {
2275	SSLfatal(s, SSL_AD_INTERNAL_ERROR, ERR_R_MALLOC_FAILURE);
2276	goto err;
2277	}
2278	xn = NULL;
2279	}
2280
2281	sk_X509_NAME_pop_free(s->s3.tmp.peer_ca_names, X509_NAME_free);
2282	s->s3.tmp.peer_ca_names = ca_sk;
2283
2284	return 1;
2285
2286	err:
2287	sk_X509_NAME_pop_free(ca_sk, X509_NAME_free);
2288	X509_NAME_free(xn);
2289	return 0;
2290	}
2291
2292	const STACK_OF(X509_NAME) get_ca_names(SSL s)
2293	{
2294	const STACK_OF(X509_NAME) *ca_sk = NULL;;
2295
2296	if (s->server) {
2297	ca_sk = SSL_get_client_CA_list(s);
2298	if (ca_sk != NULL && sk_X509_NAME_num(ca_sk) == 0)
2299	ca_sk = NULL;
2300	}
2301
2302	if (ca_sk == NULL)
2303	ca_sk = SSL_get0_CA_list(s);
2304
2305	return ca_sk;
2306	}
2307
2308	int construct_ca_names(SSL s, const STACK_OF(X509_NAME) ca_sk, WPACKET *pkt)
2309	{
2310	/* Start sub-packet for client CA list */
2311	if (!WPACKET_start_sub_packet_u16(pkt)) {
2312	SSLfatal(s, SSL_AD_INTERNAL_ERROR, ERR_R_INTERNAL_ERROR);
2313	return 0;
2314	}
2315
2316	if ((ca_sk != NULL) && !(s->options & SSL_OP_DISABLE_TLSEXT_CA_NAMES)) {
2317	int i;
2318
2319	for (i = 0; i < sk_X509_NAME_num(ca_sk); i++) {
2320	unsigned char *namebytes;
2321	X509_NAME *name = sk_X509_NAME_value(ca_sk, i);
2322	int namelen;
2323
2324	if (name == NULL
2325	\|\| (namelen = i2d_X509_NAME(name, NULL)) < 0
2326	\|\| !WPACKET_sub_allocate_bytes_u16(pkt, namelen,
2327	&namebytes)
2328	\|\| i2d_X509_NAME(name, &namebytes) != namelen) {
2329	SSLfatal(s, SSL_AD_INTERNAL_ERROR, ERR_R_INTERNAL_ERROR);
2330	return 0;
2331	}
2332	}
2333	}
2334
2335	if (!WPACKET_close(pkt)) {
2336	SSLfatal(s, SSL_AD_INTERNAL_ERROR, ERR_R_INTERNAL_ERROR);
2337	return 0;
2338	}
2339
2340	return 1;
2341	}
2342
2343	/* Create a buffer containing data to be signed for server key exchange */
2344	size_t construct_key_exchange_tbs(SSL s, unsigned char *ptbs,
2345	const void *param, size_t paramlen)
2346	{
2347	size_t tbslen = 2 * SSL3_RANDOM_SIZE + paramlen;
2348	unsigned char *tbs = OPENSSL_malloc(tbslen);
2349
2350	if (tbs == NULL) {
2351	SSLfatal(s, SSL_AD_INTERNAL_ERROR, ERR_R_MALLOC_FAILURE);
2352	return 0;
2353	}
2354	memcpy(tbs, s->s3.client_random, SSL3_RANDOM_SIZE);
2355	memcpy(tbs + SSL3_RANDOM_SIZE, s->s3.server_random, SSL3_RANDOM_SIZE);
2356
2357	memcpy(tbs + SSL3_RANDOM_SIZE * 2, param, paramlen);
2358
2359	*ptbs = tbs;
2360	return tbslen;
2361	}
2362
2363	/*
2364	* Saves the current handshake digest for Post-Handshake Auth,
2365	* Done after ClientFinished is processed, done exactly once
2366	*/
2367	int tls13_save_handshake_digest_for_pha(SSL *s)
2368	{
2369	if (s->pha_dgst == NULL) {
2370	if (!ssl3_digest_cached_records(s, 1))
2371	/* SSLfatal() already called */
2372	return 0;
2373
2374	s->pha_dgst = EVP_MD_CTX_new();
2375	if (s->pha_dgst == NULL) {
2376	SSLfatal(s, SSL_AD_INTERNAL_ERROR, ERR_R_INTERNAL_ERROR);
2377	return 0;
2378	}
2379	if (!EVP_MD_CTX_copy_ex(s->pha_dgst,
2380	s->s3.handshake_dgst)) {
2381	SSLfatal(s, SSL_AD_INTERNAL_ERROR, ERR_R_INTERNAL_ERROR);
2382	EVP_MD_CTX_free(s->pha_dgst);
2383	s->pha_dgst = NULL;
2384	return 0;
2385	}
2386	}
2387	return 1;
2388	}
2389
2390	/*
2391	* Restores the Post-Handshake Auth handshake digest
2392	* Done just before sending/processing the Cert Request
2393	*/
2394	int tls13_restore_handshake_digest_for_pha(SSL *s)
2395	{
2396	if (s->pha_dgst == NULL) {
2397	SSLfatal(s, SSL_AD_INTERNAL_ERROR, ERR_R_INTERNAL_ERROR);
2398	return 0;
2399	}
2400	if (!EVP_MD_CTX_copy_ex(s->s3.handshake_dgst,
2401	s->pha_dgst)) {
2402	SSLfatal(s, SSL_AD_INTERNAL_ERROR, ERR_R_INTERNAL_ERROR);
2403	return 0;
2404	}
2405	return 1;
2406	}

Note: See TracBrowser for help on using the repository browser.

source: vbox/trunk/src/libs/openssl-3.1.4/ssl/statem/statem_lib.c@ 104031

Download in other formats: