t1_enc.c@ 106165

最後變更在這個檔案從106165是 104078,由 vboxsync 提交於 8 月前
openssl-3.1.5: Applied and adjusted our OpenSSL changes to 3.1.4. bugref:10638
檔案大小: 28.5 KB

行
1	/*
2	* Copyright 1995-2022 The OpenSSL Project Authors. All Rights Reserved.
3	* Copyright 2005 Nokia. All rights reserved.
4	*
5	* Licensed under the Apache License 2.0 (the "License"). You may not use
6	* this file except in compliance with the License. You can obtain a copy
7	* in the file LICENSE in the source distribution or at
8	* https://www.openssl.org/source/license.html
9	*/
10
11	#include <stdio.h>
12	#include "ssl_local.h"
13	#include "record/record_local.h"
14	#include "internal/ktls.h"
15	#include "internal/cryptlib.h"
16	#include <openssl/comp.h>
17	#include <openssl/evp.h>
18	#include <openssl/kdf.h>
19	#include <openssl/rand.h>
20	#include <openssl/obj_mac.h>
21	#include <openssl/core_names.h>
22	#include <openssl/trace.h>
23
24	/* seed1 through seed5 are concatenated */
25	static int tls1_PRF(SSL *s,
26	const void *seed1, size_t seed1_len,
27	const void *seed2, size_t seed2_len,
28	const void *seed3, size_t seed3_len,
29	const void *seed4, size_t seed4_len,
30	const void *seed5, size_t seed5_len,
31	const unsigned char *sec, size_t slen,
32	unsigned char *out, size_t olen, int fatal)
33	{
34	const EVP_MD *md = ssl_prf_md(s);
35	EVP_KDF *kdf;
36	EVP_KDF_CTX *kctx = NULL;
37	OSSL_PARAM params[8], *p = params;
38	const char *mdname;
39
40	if (md == NULL) {
41	/* Should never happen */
42	if (fatal)
43	SSLfatal(s, SSL_AD_INTERNAL_ERROR, ERR_R_INTERNAL_ERROR);
44	else
45	ERR_raise(ERR_LIB_SSL, ERR_R_INTERNAL_ERROR);
46	return 0;
47	}
48	kdf = EVP_KDF_fetch(s->ctx->libctx, OSSL_KDF_NAME_TLS1_PRF, s->ctx->propq);
49	if (kdf == NULL)
50	goto err;
51	kctx = EVP_KDF_CTX_new(kdf);
52	EVP_KDF_free(kdf);
53	if (kctx == NULL)
54	goto err;
55	mdname = EVP_MD_get0_name(md);
56	*p++ = OSSL_PARAM_construct_utf8_string(OSSL_KDF_PARAM_DIGEST,
57	(char *)mdname, 0);
58	*p++ = OSSL_PARAM_construct_octet_string(OSSL_KDF_PARAM_SECRET,
59	(unsigned char *)sec,
60	(size_t)slen);
61	*p++ = OSSL_PARAM_construct_octet_string(OSSL_KDF_PARAM_SEED,
62	(void *)seed1, (size_t)seed1_len);
63	*p++ = OSSL_PARAM_construct_octet_string(OSSL_KDF_PARAM_SEED,
64	(void *)seed2, (size_t)seed2_len);
65	*p++ = OSSL_PARAM_construct_octet_string(OSSL_KDF_PARAM_SEED,
66	(void *)seed3, (size_t)seed3_len);
67	*p++ = OSSL_PARAM_construct_octet_string(OSSL_KDF_PARAM_SEED,
68	(void *)seed4, (size_t)seed4_len);
69	*p++ = OSSL_PARAM_construct_octet_string(OSSL_KDF_PARAM_SEED,
70	(void *)seed5, (size_t)seed5_len);
71	*p = OSSL_PARAM_construct_end();
72	if (EVP_KDF_derive(kctx, out, olen, params)) {
73	EVP_KDF_CTX_free(kctx);
74	return 1;
75	}
76
77	err:
78	if (fatal)
79	SSLfatal(s, SSL_AD_INTERNAL_ERROR, ERR_R_INTERNAL_ERROR);
80	else
81	ERR_raise(ERR_LIB_SSL, ERR_R_INTERNAL_ERROR);
82	EVP_KDF_CTX_free(kctx);
83	return 0;
84	}
85
86	static int tls1_generate_key_block(SSL s, unsigned char km, size_t num)
87	{
88	int ret;
89
90	/* Calls SSLfatal() as required */
91	ret = tls1_PRF(s,
92	TLS_MD_KEY_EXPANSION_CONST,
93	TLS_MD_KEY_EXPANSION_CONST_SIZE, s->s3.server_random,
94	SSL3_RANDOM_SIZE, s->s3.client_random, SSL3_RANDOM_SIZE,
95	NULL, 0, NULL, 0, s->session->master_key,
96	s->session->master_key_length, km, num, 1);
97
98	return ret;
99	}
100
101	#ifndef OPENSSL_NO_KTLS
102	/*
103	* Count the number of records that were not processed yet from record boundary.
104	*
105	* This function assumes that there are only fully formed records read in the
106	* record layer. If read_ahead is enabled, then this might be false and this
107	* function will fail.
108	*/
109	# ifndef OPENSSL_NO_KTLS_RX
110	static int count_unprocessed_records(SSL *s)
111	{
112	SSL3_BUFFER *rbuf = RECORD_LAYER_get_rbuf(&s->rlayer);
113	PACKET pkt, subpkt;
114	int count = 0;
115
116	if (!PACKET_buf_init(&pkt, rbuf->buf + rbuf->offset, rbuf->left))
117	return -1;
118
119	while (PACKET_remaining(&pkt) > 0) {
120	/* Skip record type and version */
121	if (!PACKET_forward(&pkt, 3))
122	return -1;
123
124	/* Read until next record */
125	if (!PACKET_get_length_prefixed_2(&pkt, &subpkt))
126	return -1;
127
128	count += 1;
129	}
130
131	return count;
132	}
133	# endif
134	#endif
135
136
137	int tls_provider_set_tls_params(SSL s, EVP_CIPHER_CTX ctx,
138	const EVP_CIPHER *ciph,
139	const EVP_MD *md)
140	{
141	/*
142	* Provided cipher, the TLS padding/MAC removal is performed provider
143	* side so we need to tell the ctx about our TLS version and mac size
144	*/
145	OSSL_PARAM params[3], *pprm = params;
146	size_t macsize = 0;
147	int imacsize = -1;
148
149	if ((EVP_CIPHER_get_flags(ciph) & EVP_CIPH_FLAG_AEAD_CIPHER) == 0
150	/*
151	* We look at s->ext.use_etm instead of SSL_READ_ETM() or
152	* SSL_WRITE_ETM() because this test applies to both reading
153	* and writing.
154	*/
155	&& !s->ext.use_etm)
156	imacsize = EVP_MD_get_size(md);
157	if (imacsize >= 0)
158	macsize = (size_t)imacsize;
159
160	*pprm++ = OSSL_PARAM_construct_int(OSSL_CIPHER_PARAM_TLS_VERSION,
161	&s->version);
162	*pprm++ = OSSL_PARAM_construct_size_t(OSSL_CIPHER_PARAM_TLS_MAC_SIZE,
163	&macsize);
164	*pprm = OSSL_PARAM_construct_end();
165
166	if (!EVP_CIPHER_CTX_set_params(ctx, params)) {
167	SSLfatal(s, SSL_AD_INTERNAL_ERROR, ERR_R_INTERNAL_ERROR);
168	return 0;
169	}
170
171	return 1;
172	}
173
174
175	static int tls_iv_length_within_key_block(const EVP_CIPHER *c)
176	{
177	/* If GCM/CCM mode only part of IV comes from PRF */
178	if (EVP_CIPHER_get_mode(c) == EVP_CIPH_GCM_MODE)
179	return EVP_GCM_TLS_FIXED_IV_LEN;
180	else if (EVP_CIPHER_get_mode(c) == EVP_CIPH_CCM_MODE)
181	return EVP_CCM_TLS_FIXED_IV_LEN;
182	else
183	return EVP_CIPHER_get_iv_length(c);
184	}
185
186	int tls1_change_cipher_state(SSL *s, int which)
187	{
188	unsigned char p, mac_secret;
189	unsigned char ms, key, *iv;
190	EVP_CIPHER_CTX *dd;
191	const EVP_CIPHER *c;
192	#ifndef OPENSSL_NO_COMP
193	const SSL_COMP *comp;
194	#endif
195	const EVP_MD *m;
196	int mac_type;
197	size_t *mac_secret_size;
198	EVP_MD_CTX *mac_ctx;
199	EVP_PKEY *mac_key;
200	size_t n, i, j, k, cl;
201	int reuse_dd = 0;
202	#ifndef OPENSSL_NO_KTLS
203	ktls_crypto_info_t crypto_info;
204	unsigned char *rec_seq;
205	void *rl_sequence;
206	# ifndef OPENSSL_NO_KTLS_RX
207	int count_unprocessed;
208	int bit;
209	# endif
210	BIO *bio;
211	#endif
212
213	c = s->s3.tmp.new_sym_enc;
214	m = s->s3.tmp.new_hash;
215	mac_type = s->s3.tmp.new_mac_pkey_type;
216	#ifndef OPENSSL_NO_COMP
217	comp = s->s3.tmp.new_compression;
218	#endif
219
220	if (which & SSL3_CC_READ) {
221	if (s->ext.use_etm)
222	s->s3.flags \|= TLS1_FLAGS_ENCRYPT_THEN_MAC_READ;
223	else
224	s->s3.flags &= ~TLS1_FLAGS_ENCRYPT_THEN_MAC_READ;
225
226	if (s->s3.tmp.new_cipher->algorithm2 & TLS1_STREAM_MAC)
227	s->mac_flags \|= SSL_MAC_FLAG_READ_MAC_STREAM;
228	else
229	s->mac_flags &= ~SSL_MAC_FLAG_READ_MAC_STREAM;
230
231	if (s->s3.tmp.new_cipher->algorithm2 & TLS1_TLSTREE)
232	s->mac_flags \|= SSL_MAC_FLAG_READ_MAC_TLSTREE;
233	else
234	s->mac_flags &= ~SSL_MAC_FLAG_READ_MAC_TLSTREE;
235
236	if (s->enc_read_ctx != NULL) {
237	reuse_dd = 1;
238	} else if ((s->enc_read_ctx = EVP_CIPHER_CTX_new()) == NULL) {
239	SSLfatal(s, SSL_AD_INTERNAL_ERROR, ERR_R_MALLOC_FAILURE);
240	goto err;
241	} else {
242	/*
243	* make sure it's initialised in case we exit later with an error
244	*/
245	EVP_CIPHER_CTX_reset(s->enc_read_ctx);
246	}
247	dd = s->enc_read_ctx;
248	mac_ctx = ssl_replace_hash(&s->read_hash, NULL);
249	if (mac_ctx == NULL) {
250	SSLfatal(s, SSL_AD_INTERNAL_ERROR, ERR_R_INTERNAL_ERROR);
251	goto err;
252	}
253	#ifndef OPENSSL_NO_COMP
254	COMP_CTX_free(s->expand);
255	s->expand = NULL;
256	if (comp != NULL) {
257	s->expand = COMP_CTX_new(comp->method);
258	if (s->expand == NULL) {
259	SSLfatal(s, SSL_AD_INTERNAL_ERROR,
260	SSL_R_COMPRESSION_LIBRARY_ERROR);
261	goto err;
262	}
263	}
264	#endif
265	/*
266	* this is done by dtls1_reset_seq_numbers for DTLS
267	*/
268	if (!SSL_IS_DTLS(s))
269	RECORD_LAYER_reset_read_sequence(&s->rlayer);
270	mac_secret = &(s->s3.read_mac_secret[0]);
271	mac_secret_size = &(s->s3.read_mac_secret_size);
272	} else {
273	s->statem.enc_write_state = ENC_WRITE_STATE_INVALID;
274	if (s->ext.use_etm)
275	s->s3.flags \|= TLS1_FLAGS_ENCRYPT_THEN_MAC_WRITE;
276	else
277	s->s3.flags &= ~TLS1_FLAGS_ENCRYPT_THEN_MAC_WRITE;
278
279	if (s->s3.tmp.new_cipher->algorithm2 & TLS1_STREAM_MAC)
280	s->mac_flags \|= SSL_MAC_FLAG_WRITE_MAC_STREAM;
281	else
282	s->mac_flags &= ~SSL_MAC_FLAG_WRITE_MAC_STREAM;
283
284	if (s->s3.tmp.new_cipher->algorithm2 & TLS1_TLSTREE)
285	s->mac_flags \|= SSL_MAC_FLAG_WRITE_MAC_TLSTREE;
286	else
287	s->mac_flags &= ~SSL_MAC_FLAG_WRITE_MAC_TLSTREE;
288	if (s->enc_write_ctx != NULL && !SSL_IS_DTLS(s)) {
289	reuse_dd = 1;
290	} else if ((s->enc_write_ctx = EVP_CIPHER_CTX_new()) == NULL) {
291	SSLfatal(s, SSL_AD_INTERNAL_ERROR, ERR_R_MALLOC_FAILURE);
292	goto err;
293	}
294	dd = s->enc_write_ctx;
295	if (SSL_IS_DTLS(s)) {
296	mac_ctx = EVP_MD_CTX_new();
297	if (mac_ctx == NULL) {
298	SSLfatal(s, SSL_AD_INTERNAL_ERROR, ERR_R_MALLOC_FAILURE);
299	goto err;
300	}
301	s->write_hash = mac_ctx;
302	} else {
303	mac_ctx = ssl_replace_hash(&s->write_hash, NULL);
304	if (mac_ctx == NULL) {
305	SSLfatal(s, SSL_AD_INTERNAL_ERROR, ERR_R_MALLOC_FAILURE);
306	goto err;
307	}
308	}
309	#ifndef OPENSSL_NO_COMP
310	COMP_CTX_free(s->compress);
311	s->compress = NULL;
312	if (comp != NULL) {
313	s->compress = COMP_CTX_new(comp->method);
314	if (s->compress == NULL) {
315	SSLfatal(s, SSL_AD_INTERNAL_ERROR,
316	SSL_R_COMPRESSION_LIBRARY_ERROR);
317	goto err;
318	}
319	}
320	#endif
321	/*
322	* this is done by dtls1_reset_seq_numbers for DTLS
323	*/
324	if (!SSL_IS_DTLS(s))
325	RECORD_LAYER_reset_write_sequence(&s->rlayer);
326	mac_secret = &(s->s3.write_mac_secret[0]);
327	mac_secret_size = &(s->s3.write_mac_secret_size);
328	}
329
330	if (reuse_dd)
331	EVP_CIPHER_CTX_reset(dd);
332
333	p = s->s3.tmp.key_block;
334	i = *mac_secret_size = s->s3.tmp.new_mac_secret_size;
335
336	cl = EVP_CIPHER_get_key_length(c);
337	j = cl;
338	k = tls_iv_length_within_key_block(c);
339	if ((which == SSL3_CHANGE_CIPHER_CLIENT_WRITE) \|\|
340	(which == SSL3_CHANGE_CIPHER_SERVER_READ)) {
341	ms = &(p[0]);
342	n = i + i;
343	key = &(p[n]);
344	n += j + j;
345	iv = &(p[n]);
346	n += k + k;
347	} else {
348	n = i;
349	ms = &(p[n]);
350	n += i + j;
351	key = &(p[n]);
352	n += j + k;
353	iv = &(p[n]);
354	n += k;
355	}
356
357	if (n > s->s3.tmp.key_block_length) {
358	SSLfatal(s, SSL_AD_INTERNAL_ERROR, ERR_R_INTERNAL_ERROR);
359	goto err;
360	}
361
362	memcpy(mac_secret, ms, i);
363
364	if (!(EVP_CIPHER_get_flags(c) & EVP_CIPH_FLAG_AEAD_CIPHER)) {
365	if (mac_type == EVP_PKEY_HMAC) {
366	mac_key = EVP_PKEY_new_raw_private_key_ex(s->ctx->libctx, "HMAC",
367	s->ctx->propq, mac_secret,
368	*mac_secret_size);
369	} else {
370	/*
371	* If its not HMAC then the only other types of MAC we support are
372	* the GOST MACs, so we need to use the old style way of creating
373	* a MAC key.
374	*/
375	mac_key = EVP_PKEY_new_mac_key(mac_type, NULL, mac_secret,
376	(int)*mac_secret_size);
377	}
378	if (mac_key == NULL
379	\|\| EVP_DigestSignInit_ex(mac_ctx, NULL, EVP_MD_get0_name(m),
380	s->ctx->libctx, s->ctx->propq, mac_key,
381	NULL) <= 0) {
382	EVP_PKEY_free(mac_key);
383	SSLfatal(s, SSL_AD_INTERNAL_ERROR, ERR_R_INTERNAL_ERROR);
384	goto err;
385	}
386	EVP_PKEY_free(mac_key);
387	}
388
389	OSSL_TRACE_BEGIN(TLS) {
390	BIO_printf(trc_out, "which = %04X, mac key:\n", which);
391	BIO_dump_indent(trc_out, ms, i, 4);
392	} OSSL_TRACE_END(TLS);
393
394	if (EVP_CIPHER_get_mode(c) == EVP_CIPH_GCM_MODE) {
395	if (!EVP_CipherInit_ex(dd, c, NULL, key, NULL, (which & SSL3_CC_WRITE))
396	\|\| EVP_CIPHER_CTX_ctrl(dd, EVP_CTRL_GCM_SET_IV_FIXED, (int)k,
397	iv) <= 0) {
398	SSLfatal(s, SSL_AD_INTERNAL_ERROR, ERR_R_INTERNAL_ERROR);
399	goto err;
400	}
401	} else if (EVP_CIPHER_get_mode(c) == EVP_CIPH_CCM_MODE) {
402	int taglen;
403	if (s->s3.tmp.
404	new_cipher->algorithm_enc & (SSL_AES128CCM8 \| SSL_AES256CCM8))
405	taglen = EVP_CCM8_TLS_TAG_LEN;
406	else
407	taglen = EVP_CCM_TLS_TAG_LEN;
408	if (!EVP_CipherInit_ex(dd, c, NULL, NULL, NULL, (which & SSL3_CC_WRITE))
409	\|\| (EVP_CIPHER_CTX_ctrl(dd, EVP_CTRL_AEAD_SET_IVLEN, 12, NULL) <= 0)
410	\|\| (EVP_CIPHER_CTX_ctrl(dd, EVP_CTRL_AEAD_SET_TAG, taglen, NULL) <= 0)
411	\|\| (EVP_CIPHER_CTX_ctrl(dd, EVP_CTRL_CCM_SET_IV_FIXED, (int)k, iv) <= 0)
412	\|\| !EVP_CipherInit_ex(dd, NULL, NULL, key, NULL, -1)) {
413	SSLfatal(s, SSL_AD_INTERNAL_ERROR, ERR_R_INTERNAL_ERROR);
414	goto err;
415	}
416	} else {
417	if (!EVP_CipherInit_ex(dd, c, NULL, key, iv, (which & SSL3_CC_WRITE))) {
418	SSLfatal(s, SSL_AD_INTERNAL_ERROR, ERR_R_INTERNAL_ERROR);
419	goto err;
420	}
421	}
422	/* Needed for "composite" AEADs, such as RC4-HMAC-MD5 */
423	if ((EVP_CIPHER_get_flags(c) & EVP_CIPH_FLAG_AEAD_CIPHER)
424	&& *mac_secret_size
425	&& EVP_CIPHER_CTX_ctrl(dd, EVP_CTRL_AEAD_SET_MAC_KEY,
426	(int)*mac_secret_size, mac_secret) <= 0) {
427	SSLfatal(s, SSL_AD_INTERNAL_ERROR, ERR_R_INTERNAL_ERROR);
428	goto err;
429	}
430
431	/*
432	* The cipher we actually ended up using in the EVP_CIPHER_CTX may be
433	* different to that in c if we have an ENGINE in use
434	*/
435	if (EVP_CIPHER_get0_provider(EVP_CIPHER_CTX_get0_cipher(dd)) != NULL
436	&& !tls_provider_set_tls_params(s, dd, c, m)) {
437	/* SSLfatal already called */
438	goto err;
439	}
440
441	#ifndef OPENSSL_NO_KTLS
442	if (s->compress \|\| (s->options & SSL_OP_ENABLE_KTLS) == 0)
443	goto skip_ktls;
444
445	/* ktls supports only the maximum fragment size */
446	if (ssl_get_max_send_fragment(s) != SSL3_RT_MAX_PLAIN_LENGTH)
447	goto skip_ktls;
448
449	/* check that cipher is supported */
450	if (!ktls_check_supported_cipher(s, c, dd))
451	goto skip_ktls;
452
453	if (which & SSL3_CC_WRITE)
454	bio = s->wbio;
455	else
456	bio = s->rbio;
457
458	if (!ossl_assert(bio != NULL)) {
459	SSLfatal(s, SSL_AD_INTERNAL_ERROR, ERR_R_INTERNAL_ERROR);
460	goto err;
461	}
462
463	/* All future data will get encrypted by ktls. Flush the BIO or skip ktls */
464	if (which & SSL3_CC_WRITE) {
465	if (BIO_flush(bio) <= 0)
466	goto skip_ktls;
467	}
468
469	/* ktls doesn't support renegotiation */
470	if ((BIO_get_ktls_send(s->wbio) && (which & SSL3_CC_WRITE)) \|\|
471	(BIO_get_ktls_recv(s->rbio) && (which & SSL3_CC_READ))) {
472	SSLfatal(s, SSL_AD_NO_RENEGOTIATION, ERR_R_INTERNAL_ERROR);
473	goto err;
474	}
475
476	if (which & SSL3_CC_WRITE)
477	rl_sequence = RECORD_LAYER_get_write_sequence(&s->rlayer);
478	else
479	rl_sequence = RECORD_LAYER_get_read_sequence(&s->rlayer);
480
481	if (!ktls_configure_crypto(s, c, dd, rl_sequence, &crypto_info, &rec_seq,
482	iv, key, ms, *mac_secret_size))
483	goto skip_ktls;
484
485	if (which & SSL3_CC_READ) {
486	# ifndef OPENSSL_NO_KTLS_RX
487	count_unprocessed = count_unprocessed_records(s);
488	if (count_unprocessed < 0)
489	goto skip_ktls;
490
491	/* increment the crypto_info record sequence */
492	while (count_unprocessed) {
493	for (bit = 7; bit >= 0; bit--) { /* increment */
494	++rec_seq[bit];
495	if (rec_seq[bit] != 0)
496	break;
497	}
498	count_unprocessed--;
499	}
500	# else
501	goto skip_ktls;
502	# endif
503	}
504
505	/* ktls works with user provided buffers directly */
506	if (BIO_set_ktls(bio, &crypto_info, which & SSL3_CC_WRITE)) {
507	if (which & SSL3_CC_WRITE)
508	ssl3_release_write_buffer(s);
509	SSL_set_options(s, SSL_OP_NO_RENEGOTIATION);
510	}
511
512	skip_ktls:
513	#endif /* OPENSSL_NO_KTLS */
514	s->statem.enc_write_state = ENC_WRITE_STATE_VALID;
515
516	OSSL_TRACE_BEGIN(TLS) {
517	BIO_printf(trc_out, "which = %04X, key:\n", which);
518	BIO_dump_indent(trc_out, key, EVP_CIPHER_get_key_length(c), 4);
519	BIO_printf(trc_out, "iv:\n");
520	BIO_dump_indent(trc_out, iv, k, 4);
521	} OSSL_TRACE_END(TLS);
522
523	return 1;
524	err:
525	return 0;
526	}
527
528	int tls1_setup_key_block(SSL *s)
529	{
530	unsigned char *p;
531	const EVP_CIPHER *c;
532	const EVP_MD *hash;
533	SSL_COMP *comp;
534	int mac_type = NID_undef;
535	size_t num, mac_secret_size = 0;
536	int ret = 0;
537
538	if (s->s3.tmp.key_block_length != 0)
539	return 1;
540
541	if (!ssl_cipher_get_evp(s->ctx, s->session, &c, &hash, &mac_type,
542	&mac_secret_size, &comp, s->ext.use_etm)) {
543	/* Error is already recorded */
544	SSLfatal_alert(s, SSL_AD_INTERNAL_ERROR);
545	return 0;
546	}
547
548	ssl_evp_cipher_free(s->s3.tmp.new_sym_enc);
549	s->s3.tmp.new_sym_enc = c;
550	ssl_evp_md_free(s->s3.tmp.new_hash);
551	s->s3.tmp.new_hash = hash;
552	s->s3.tmp.new_mac_pkey_type = mac_type;
553	s->s3.tmp.new_mac_secret_size = mac_secret_size;
554	num = mac_secret_size + EVP_CIPHER_get_key_length(c)
555	+ tls_iv_length_within_key_block(c);
556	num *= 2;
557
558	ssl3_cleanup_key_block(s);
559
560	if ((p = OPENSSL_malloc(num)) == NULL) {
561	SSLfatal(s, SSL_AD_INTERNAL_ERROR, ERR_R_MALLOC_FAILURE);
562	goto err;
563	}
564
565	s->s3.tmp.key_block_length = num;
566	s->s3.tmp.key_block = p;
567
568	OSSL_TRACE_BEGIN(TLS) {
569	BIO_printf(trc_out, "key block length: %zu\n", num);
570	BIO_printf(trc_out, "client random\n");
571	BIO_dump_indent(trc_out, s->s3.client_random, SSL3_RANDOM_SIZE, 4);
572	BIO_printf(trc_out, "server random\n");
573	BIO_dump_indent(trc_out, s->s3.server_random, SSL3_RANDOM_SIZE, 4);
574	BIO_printf(trc_out, "master key\n");
575	BIO_dump_indent(trc_out,
576	s->session->master_key,
577	s->session->master_key_length, 4);
578	} OSSL_TRACE_END(TLS);
579
580	if (!tls1_generate_key_block(s, p, num)) {
581	/* SSLfatal() already called */
582	goto err;
583	}
584
585	OSSL_TRACE_BEGIN(TLS) {
586	BIO_printf(trc_out, "key block\n");
587	BIO_dump_indent(trc_out, p, num, 4);
588	} OSSL_TRACE_END(TLS);
589
590	if (!(s->options & SSL_OP_DONT_INSERT_EMPTY_FRAGMENTS)
591	&& s->method->version <= TLS1_VERSION) {
592	/*
593	* enable vulnerability countermeasure for CBC ciphers with known-IV
594	* problem (http://www.openssl.org/~bodo/tls-cbc.txt)
595	*/
596	s->s3.need_empty_fragments = 1;
597
598	if (s->session->cipher != NULL) {
599	if (s->session->cipher->algorithm_enc == SSL_eNULL)
600	s->s3.need_empty_fragments = 0;
601
602	if (s->session->cipher->algorithm_enc == SSL_RC4)
603	s->s3.need_empty_fragments = 0;
604	}
605	}
606
607	ret = 1;
608	err:
609	return ret;
610	}
611
612	size_t tls1_final_finish_mac(SSL s, const char str, size_t slen,
613	unsigned char *out)
614	{
615	size_t hashlen;
616	unsigned char hash[EVP_MAX_MD_SIZE];
617	size_t finished_size = TLS1_FINISH_MAC_LENGTH;
618
619	if (s->s3.tmp.new_cipher->algorithm_mkey & SSL_kGOST18)
620	finished_size = 32;
621
622	if (!ssl3_digest_cached_records(s, 0)) {
623	/* SSLfatal() already called */
624	return 0;
625	}
626
627	if (!ssl_handshake_hash(s, hash, sizeof(hash), &hashlen)) {
628	/* SSLfatal() already called */
629	return 0;
630	}
631
632	if (!tls1_PRF(s, str, slen, hash, hashlen, NULL, 0, NULL, 0, NULL, 0,
633	s->session->master_key, s->session->master_key_length,
634	out, finished_size, 1)) {
635	/* SSLfatal() already called */
636	return 0;
637	}
638	OPENSSL_cleanse(hash, hashlen);
639	return finished_size;
640	}
641
642	int tls1_generate_master_secret(SSL s, unsigned char out, unsigned char *p,
643	size_t len, size_t *secret_size)
644	{
645	if (s->session->flags & SSL_SESS_FLAG_EXTMS) {
646	unsigned char hash[EVP_MAX_MD_SIZE * 2];
647	size_t hashlen;
648	/*
649	* Digest cached records keeping record buffer (if present): this won't
650	* affect client auth because we're freezing the buffer at the same
651	* point (after client key exchange and before certificate verify)
652	*/
653	if (!ssl3_digest_cached_records(s, 1)
654	\|\| !ssl_handshake_hash(s, hash, sizeof(hash), &hashlen)) {
655	/* SSLfatal() already called */
656	return 0;
657	}
658	OSSL_TRACE_BEGIN(TLS) {
659	BIO_printf(trc_out, "Handshake hashes:\n");
660	BIO_dump(trc_out, (char *)hash, hashlen);
661	} OSSL_TRACE_END(TLS);
662	if (!tls1_PRF(s,
663	TLS_MD_EXTENDED_MASTER_SECRET_CONST,
664	TLS_MD_EXTENDED_MASTER_SECRET_CONST_SIZE,
665	hash, hashlen,
666	NULL, 0,
667	NULL, 0,
668	NULL, 0, p, len, out,
669	SSL3_MASTER_SECRET_SIZE, 1)) {
670	/* SSLfatal() already called */
671	return 0;
672	}
673	OPENSSL_cleanse(hash, hashlen);
674	} else {
675	if (!tls1_PRF(s,
676	TLS_MD_MASTER_SECRET_CONST,
677	TLS_MD_MASTER_SECRET_CONST_SIZE,
678	s->s3.client_random, SSL3_RANDOM_SIZE,
679	NULL, 0,
680	s->s3.server_random, SSL3_RANDOM_SIZE,
681	NULL, 0, p, len, out,
682	SSL3_MASTER_SECRET_SIZE, 1)) {
683	/* SSLfatal() already called */
684	return 0;
685	}
686	}
687
688	OSSL_TRACE_BEGIN(TLS) {
689	BIO_printf(trc_out, "Premaster Secret:\n");
690	BIO_dump_indent(trc_out, p, len, 4);
691	BIO_printf(trc_out, "Client Random:\n");
692	BIO_dump_indent(trc_out, s->s3.client_random, SSL3_RANDOM_SIZE, 4);
693	BIO_printf(trc_out, "Server Random:\n");
694	BIO_dump_indent(trc_out, s->s3.server_random, SSL3_RANDOM_SIZE, 4);
695	BIO_printf(trc_out, "Master Secret:\n");
696	BIO_dump_indent(trc_out,
697	s->session->master_key,
698	SSL3_MASTER_SECRET_SIZE, 4);
699	} OSSL_TRACE_END(TLS);
700
701	*secret_size = SSL3_MASTER_SECRET_SIZE;
702	return 1;
703	}
704
705	int tls1_export_keying_material(SSL s, unsigned char out, size_t olen,
706	const char *label, size_t llen,
707	const unsigned char *context,
708	size_t contextlen, int use_context)
709	{
710	unsigned char *val = NULL;
711	size_t vallen = 0, currentvalpos;
712	int rv;
713
714	/*
715	* construct PRF arguments we construct the PRF argument ourself rather
716	* than passing separate values into the TLS PRF to ensure that the
717	* concatenation of values does not create a prohibited label.
718	*/
719	vallen = llen + SSL3_RANDOM_SIZE * 2;
720	if (use_context) {
721	vallen += 2 + contextlen;
722	}
723
724	val = OPENSSL_malloc(vallen);
725	if (val == NULL)
726	goto err2;
727	currentvalpos = 0;
728	memcpy(val + currentvalpos, (unsigned char *)label, llen);
729	currentvalpos += llen;
730	memcpy(val + currentvalpos, s->s3.client_random, SSL3_RANDOM_SIZE);
731	currentvalpos += SSL3_RANDOM_SIZE;
732	memcpy(val + currentvalpos, s->s3.server_random, SSL3_RANDOM_SIZE);
733	currentvalpos += SSL3_RANDOM_SIZE;
734
735	if (use_context) {
736	val[currentvalpos] = (contextlen >> 8) & 0xff;
737	currentvalpos++;
738	val[currentvalpos] = contextlen & 0xff;
739	currentvalpos++;
740	if ((contextlen > 0) \|\| (context != NULL)) {
741	memcpy(val + currentvalpos, context, contextlen);
742	}
743	}
744
745	/*
746	* disallow prohibited labels note that SSL3_RANDOM_SIZE > max(prohibited
747	* label len) = 15, so size of val > max(prohibited label len) = 15 and
748	* the comparisons won't have buffer overflow
749	*/
750	if (memcmp(val, TLS_MD_CLIENT_FINISH_CONST,
751	TLS_MD_CLIENT_FINISH_CONST_SIZE) == 0)
752	goto err1;
753	if (memcmp(val, TLS_MD_SERVER_FINISH_CONST,
754	TLS_MD_SERVER_FINISH_CONST_SIZE) == 0)
755	goto err1;
756	if (memcmp(val, TLS_MD_MASTER_SECRET_CONST,
757	TLS_MD_MASTER_SECRET_CONST_SIZE) == 0)
758	goto err1;
759	if (memcmp(val, TLS_MD_EXTENDED_MASTER_SECRET_CONST,
760	TLS_MD_EXTENDED_MASTER_SECRET_CONST_SIZE) == 0)
761	goto err1;
762	if (memcmp(val, TLS_MD_KEY_EXPANSION_CONST,
763	TLS_MD_KEY_EXPANSION_CONST_SIZE) == 0)
764	goto err1;
765
766	rv = tls1_PRF(s,
767	val, vallen,
768	NULL, 0,
769	NULL, 0,
770	NULL, 0,
771	NULL, 0,
772	s->session->master_key, s->session->master_key_length,
773	out, olen, 0);
774
775	goto ret;
776	err1:
777	ERR_raise(ERR_LIB_SSL, SSL_R_TLS_ILLEGAL_EXPORTER_LABEL);
778	rv = 0;
779	goto ret;
780	err2:
781	ERR_raise(ERR_LIB_SSL, ERR_R_MALLOC_FAILURE);
782	rv = 0;
783	ret:
784	OPENSSL_clear_free(val, vallen);
785	return rv;
786	}
787
788	int tls1_alert_code(int code)
789	{
790	switch (code) {
791	case SSL_AD_CLOSE_NOTIFY:
792	return SSL3_AD_CLOSE_NOTIFY;
793	case SSL_AD_UNEXPECTED_MESSAGE:
794	return SSL3_AD_UNEXPECTED_MESSAGE;
795	case SSL_AD_BAD_RECORD_MAC:
796	return SSL3_AD_BAD_RECORD_MAC;
797	case SSL_AD_DECRYPTION_FAILED:
798	return TLS1_AD_DECRYPTION_FAILED;
799	case SSL_AD_RECORD_OVERFLOW:
800	return TLS1_AD_RECORD_OVERFLOW;
801	case SSL_AD_DECOMPRESSION_FAILURE:
802	return SSL3_AD_DECOMPRESSION_FAILURE;
803	case SSL_AD_HANDSHAKE_FAILURE:
804	return SSL3_AD_HANDSHAKE_FAILURE;
805	case SSL_AD_NO_CERTIFICATE:
806	return -1;
807	case SSL_AD_BAD_CERTIFICATE:
808	return SSL3_AD_BAD_CERTIFICATE;
809	case SSL_AD_UNSUPPORTED_CERTIFICATE:
810	return SSL3_AD_UNSUPPORTED_CERTIFICATE;
811	case SSL_AD_CERTIFICATE_REVOKED:
812	return SSL3_AD_CERTIFICATE_REVOKED;
813	case SSL_AD_CERTIFICATE_EXPIRED:
814	return SSL3_AD_CERTIFICATE_EXPIRED;
815	case SSL_AD_CERTIFICATE_UNKNOWN:
816	return SSL3_AD_CERTIFICATE_UNKNOWN;
817	case SSL_AD_ILLEGAL_PARAMETER:
818	return SSL3_AD_ILLEGAL_PARAMETER;
819	case SSL_AD_UNKNOWN_CA:
820	return TLS1_AD_UNKNOWN_CA;
821	case SSL_AD_ACCESS_DENIED:
822	return TLS1_AD_ACCESS_DENIED;
823	case SSL_AD_DECODE_ERROR:
824	return TLS1_AD_DECODE_ERROR;
825	case SSL_AD_DECRYPT_ERROR:
826	return TLS1_AD_DECRYPT_ERROR;
827	case SSL_AD_EXPORT_RESTRICTION:
828	return TLS1_AD_EXPORT_RESTRICTION;
829	case SSL_AD_PROTOCOL_VERSION:
830	return TLS1_AD_PROTOCOL_VERSION;
831	case SSL_AD_INSUFFICIENT_SECURITY:
832	return TLS1_AD_INSUFFICIENT_SECURITY;
833	case SSL_AD_INTERNAL_ERROR:
834	return TLS1_AD_INTERNAL_ERROR;
835	case SSL_AD_USER_CANCELLED:
836	return TLS1_AD_USER_CANCELLED;
837	case SSL_AD_NO_RENEGOTIATION:
838	return TLS1_AD_NO_RENEGOTIATION;
839	case SSL_AD_UNSUPPORTED_EXTENSION:
840	return TLS1_AD_UNSUPPORTED_EXTENSION;
841	case SSL_AD_CERTIFICATE_UNOBTAINABLE:
842	return TLS1_AD_CERTIFICATE_UNOBTAINABLE;
843	case SSL_AD_UNRECOGNIZED_NAME:
844	return TLS1_AD_UNRECOGNIZED_NAME;
845	case SSL_AD_BAD_CERTIFICATE_STATUS_RESPONSE:
846	return TLS1_AD_BAD_CERTIFICATE_STATUS_RESPONSE;
847	case SSL_AD_BAD_CERTIFICATE_HASH_VALUE:
848	return TLS1_AD_BAD_CERTIFICATE_HASH_VALUE;
849	case SSL_AD_UNKNOWN_PSK_IDENTITY:
850	return TLS1_AD_UNKNOWN_PSK_IDENTITY;
851	case SSL_AD_INAPPROPRIATE_FALLBACK:
852	return TLS1_AD_INAPPROPRIATE_FALLBACK;
853	case SSL_AD_NO_APPLICATION_PROTOCOL:
854	return TLS1_AD_NO_APPLICATION_PROTOCOL;
855	case SSL_AD_CERTIFICATE_REQUIRED:
856	return SSL_AD_HANDSHAKE_FAILURE;
857	case TLS13_AD_MISSING_EXTENSION:
858	return SSL_AD_HANDSHAKE_FAILURE;
859	default:
860	return -1;
861	}
862	}

注意: 瀏覽 TracBrowser 來幫助您使用儲存庫瀏覽器

source: vbox/trunk/src/libs/openssl-3.1.7/ssl/t1_enc.c@ 106165

以其他格式下載: