mirror of
https://github.com/classilla/tenfourfox.git
synced 2024-09-05 23:54:38 +00:00
2685 lines
94 KiB
C
2685 lines
94 KiB
C
/* -*- Mode: C; tab-width: 8; indent-tabs-mode: nil; c-basic-offset: 4 -*- */
|
|
/*
|
|
* SSL3 Protocol
|
|
*
|
|
* This Source Code Form is subject to the terms of the Mozilla Public
|
|
* License, v. 2.0. If a copy of the MPL was not distributed with this
|
|
* file, You can obtain one at http://mozilla.org/MPL/2.0/. */
|
|
|
|
/* TLS extension code moved here from ssl3ecc.c */
|
|
|
|
#include "nssrenam.h"
|
|
#include "nss.h"
|
|
#include "ssl.h"
|
|
#include "sslproto.h"
|
|
#include "sslimpl.h"
|
|
#include "pk11pub.h"
|
|
#ifdef NO_PKCS11_BYPASS
|
|
#include "blapit.h"
|
|
#else
|
|
#include "blapi.h"
|
|
#endif
|
|
#include "prinit.h"
|
|
|
|
static unsigned char key_name[SESS_TICKET_KEY_NAME_LEN];
|
|
static PK11SymKey *session_ticket_enc_key_pkcs11 = NULL;
|
|
static PK11SymKey *session_ticket_mac_key_pkcs11 = NULL;
|
|
|
|
#ifndef NO_PKCS11_BYPASS
|
|
static unsigned char session_ticket_enc_key[AES_256_KEY_LENGTH];
|
|
static unsigned char session_ticket_mac_key[SHA256_LENGTH];
|
|
|
|
static PRBool session_ticket_keys_initialized = PR_FALSE;
|
|
#endif
|
|
static PRCallOnceType generate_session_keys_once;
|
|
|
|
/* forward static function declarations */
|
|
static SECStatus ssl3_ParseEncryptedSessionTicket(sslSocket *ss,
|
|
SECItem *data, EncryptedSessionTicket *enc_session_ticket);
|
|
static SECStatus ssl3_AppendToItem(SECItem *item, const unsigned char *buf,
|
|
PRUint32 bytes);
|
|
static SECStatus ssl3_AppendNumberToItem(SECItem *item, PRUint32 num,
|
|
PRInt32 lenSize);
|
|
static SECStatus ssl3_GetSessionTicketKeysPKCS11(sslSocket *ss,
|
|
PK11SymKey **aes_key, PK11SymKey **mac_key);
|
|
#ifndef NO_PKCS11_BYPASS
|
|
static SECStatus ssl3_GetSessionTicketKeys(const unsigned char **aes_key,
|
|
PRUint32 *aes_key_length, const unsigned char **mac_key,
|
|
PRUint32 *mac_key_length);
|
|
#endif
|
|
static PRInt32 ssl3_SendRenegotiationInfoXtn(sslSocket * ss,
|
|
PRBool append, PRUint32 maxBytes);
|
|
static SECStatus ssl3_HandleRenegotiationInfoXtn(sslSocket *ss,
|
|
PRUint16 ex_type, SECItem *data);
|
|
static SECStatus ssl3_ClientHandleNextProtoNegoXtn(sslSocket *ss,
|
|
PRUint16 ex_type, SECItem *data);
|
|
static SECStatus ssl3_ClientHandleAppProtoXtn(sslSocket *ss,
|
|
PRUint16 ex_type, SECItem *data);
|
|
static SECStatus ssl3_ServerHandleNextProtoNegoXtn(sslSocket *ss,
|
|
PRUint16 ex_type, SECItem *data);
|
|
static SECStatus ssl3_ServerHandleAppProtoXtn(sslSocket *ss, PRUint16 ex_type,
|
|
SECItem *data);
|
|
static PRInt32 ssl3_ClientSendNextProtoNegoXtn(sslSocket *ss, PRBool append,
|
|
PRUint32 maxBytes);
|
|
static PRInt32 ssl3_ClientSendAppProtoXtn(sslSocket *ss, PRBool append,
|
|
PRUint32 maxBytes);
|
|
static PRInt32 ssl3_ServerSendAppProtoXtn(sslSocket *ss, PRBool append,
|
|
PRUint32 maxBytes);
|
|
static PRInt32 ssl3_ClientSendUseSRTPXtn(sslSocket *ss, PRBool append,
|
|
PRUint32 maxBytes);
|
|
static PRInt32 ssl3_ServerSendUseSRTPXtn(sslSocket *ss, PRBool append,
|
|
PRUint32 maxBytes);
|
|
static SECStatus ssl3_ClientHandleUseSRTPXtn(sslSocket * ss, PRUint16 ex_type,
|
|
SECItem *data);
|
|
static SECStatus ssl3_ServerHandleUseSRTPXtn(sslSocket * ss, PRUint16 ex_type,
|
|
SECItem *data);
|
|
static PRInt32 ssl3_ServerSendStatusRequestXtn(sslSocket * ss,
|
|
PRBool append, PRUint32 maxBytes);
|
|
static SECStatus ssl3_ServerHandleStatusRequestXtn(sslSocket *ss,
|
|
PRUint16 ex_type, SECItem *data);
|
|
static SECStatus ssl3_ClientHandleStatusRequestXtn(sslSocket *ss,
|
|
PRUint16 ex_type,
|
|
SECItem *data);
|
|
static PRInt32 ssl3_ClientSendStatusRequestXtn(sslSocket * ss, PRBool append,
|
|
PRUint32 maxBytes);
|
|
static PRInt32 ssl3_ClientSendSigAlgsXtn(sslSocket *ss, PRBool append,
|
|
PRUint32 maxBytes);
|
|
static SECStatus ssl3_ServerHandleSigAlgsXtn(sslSocket *ss, PRUint16 ex_type,
|
|
SECItem *data);
|
|
|
|
static PRInt32 ssl3_ClientSendDraftVersionXtn(sslSocket *ss, PRBool append,
|
|
PRUint32 maxBytes);
|
|
static SECStatus ssl3_ServerHandleDraftVersionXtn(sslSocket *ss, PRUint16 ex_type,
|
|
SECItem *data);
|
|
static PRInt32 ssl3_SendExtendedMasterSecretXtn(sslSocket *ss, PRBool append,
|
|
PRUint32 maxBytes);
|
|
static SECStatus ssl3_HandleExtendedMasterSecretXtn(sslSocket *ss,
|
|
PRUint16 ex_type,
|
|
SECItem *data);
|
|
|
|
|
|
/*
|
|
* Write bytes. Using this function means the SECItem structure
|
|
* cannot be freed. The caller is expected to call this function
|
|
* on a shallow copy of the structure.
|
|
*/
|
|
static SECStatus
|
|
ssl3_AppendToItem(SECItem *item, const unsigned char *buf, PRUint32 bytes)
|
|
{
|
|
if (bytes > item->len)
|
|
return SECFailure;
|
|
|
|
PORT_Memcpy(item->data, buf, bytes);
|
|
item->data += bytes;
|
|
item->len -= bytes;
|
|
return SECSuccess;
|
|
}
|
|
|
|
/*
|
|
* Write a number in network byte order. Using this function means the
|
|
* SECItem structure cannot be freed. The caller is expected to call
|
|
* this function on a shallow copy of the structure.
|
|
*/
|
|
static SECStatus
|
|
ssl3_AppendNumberToItem(SECItem *item, PRUint32 num, PRInt32 lenSize)
|
|
{
|
|
SECStatus rv;
|
|
PRUint8 b[4];
|
|
PRUint8 * p = b;
|
|
|
|
switch (lenSize) {
|
|
case 4:
|
|
*p++ = (PRUint8) (num >> 24);
|
|
case 3:
|
|
*p++ = (PRUint8) (num >> 16);
|
|
case 2:
|
|
*p++ = (PRUint8) (num >> 8);
|
|
case 1:
|
|
*p = (PRUint8) num;
|
|
}
|
|
rv = ssl3_AppendToItem(item, &b[0], lenSize);
|
|
return rv;
|
|
}
|
|
|
|
static SECStatus ssl3_SessionTicketShutdown(void* appData, void* nssData)
|
|
{
|
|
if (session_ticket_enc_key_pkcs11) {
|
|
PK11_FreeSymKey(session_ticket_enc_key_pkcs11);
|
|
session_ticket_enc_key_pkcs11 = NULL;
|
|
}
|
|
if (session_ticket_mac_key_pkcs11) {
|
|
PK11_FreeSymKey(session_ticket_mac_key_pkcs11);
|
|
session_ticket_mac_key_pkcs11 = NULL;
|
|
}
|
|
PORT_Memset(&generate_session_keys_once, 0,
|
|
sizeof(generate_session_keys_once));
|
|
return SECSuccess;
|
|
}
|
|
|
|
|
|
static PRStatus
|
|
ssl3_GenerateSessionTicketKeysPKCS11(void *data)
|
|
{
|
|
SECStatus rv;
|
|
sslSocket *ss = (sslSocket *)data;
|
|
SECKEYPrivateKey *svrPrivKey = ss->serverCerts[kt_rsa].SERVERKEY;
|
|
SECKEYPublicKey *svrPubKey = ss->serverCerts[kt_rsa].serverKeyPair->pubKey;
|
|
|
|
if (svrPrivKey == NULL || svrPubKey == NULL) {
|
|
SSL_DBG(("%d: SSL[%d]: Pub or priv key(s) is NULL.",
|
|
SSL_GETPID(), ss->fd));
|
|
goto loser;
|
|
}
|
|
|
|
/* Get a copy of the session keys from shared memory. */
|
|
PORT_Memcpy(key_name, SESS_TICKET_KEY_NAME_PREFIX,
|
|
sizeof(SESS_TICKET_KEY_NAME_PREFIX));
|
|
if (!ssl_GetSessionTicketKeysPKCS11(svrPrivKey, svrPubKey,
|
|
ss->pkcs11PinArg, &key_name[SESS_TICKET_KEY_NAME_PREFIX_LEN],
|
|
&session_ticket_enc_key_pkcs11, &session_ticket_mac_key_pkcs11))
|
|
return PR_FAILURE;
|
|
|
|
rv = NSS_RegisterShutdown(ssl3_SessionTicketShutdown, NULL);
|
|
if (rv != SECSuccess)
|
|
goto loser;
|
|
|
|
return PR_SUCCESS;
|
|
|
|
loser:
|
|
ssl3_SessionTicketShutdown(NULL, NULL);
|
|
return PR_FAILURE;
|
|
}
|
|
|
|
static SECStatus
|
|
ssl3_GetSessionTicketKeysPKCS11(sslSocket *ss, PK11SymKey **aes_key,
|
|
PK11SymKey **mac_key)
|
|
{
|
|
if (PR_CallOnceWithArg(&generate_session_keys_once,
|
|
ssl3_GenerateSessionTicketKeysPKCS11, ss) != PR_SUCCESS)
|
|
return SECFailure;
|
|
|
|
if (session_ticket_enc_key_pkcs11 == NULL ||
|
|
session_ticket_mac_key_pkcs11 == NULL)
|
|
return SECFailure;
|
|
|
|
*aes_key = session_ticket_enc_key_pkcs11;
|
|
*mac_key = session_ticket_mac_key_pkcs11;
|
|
return SECSuccess;
|
|
}
|
|
|
|
#ifndef NO_PKCS11_BYPASS
|
|
static PRStatus
|
|
ssl3_GenerateSessionTicketKeys(void)
|
|
{
|
|
PORT_Memcpy(key_name, SESS_TICKET_KEY_NAME_PREFIX,
|
|
sizeof(SESS_TICKET_KEY_NAME_PREFIX));
|
|
|
|
if (!ssl_GetSessionTicketKeys(&key_name[SESS_TICKET_KEY_NAME_PREFIX_LEN],
|
|
session_ticket_enc_key, session_ticket_mac_key))
|
|
return PR_FAILURE;
|
|
|
|
session_ticket_keys_initialized = PR_TRUE;
|
|
return PR_SUCCESS;
|
|
}
|
|
|
|
static SECStatus
|
|
ssl3_GetSessionTicketKeys(const unsigned char **aes_key,
|
|
PRUint32 *aes_key_length, const unsigned char **mac_key,
|
|
PRUint32 *mac_key_length)
|
|
{
|
|
if (PR_CallOnce(&generate_session_keys_once,
|
|
ssl3_GenerateSessionTicketKeys) != PR_SUCCESS)
|
|
return SECFailure;
|
|
|
|
if (!session_ticket_keys_initialized)
|
|
return SECFailure;
|
|
|
|
*aes_key = session_ticket_enc_key;
|
|
*aes_key_length = sizeof(session_ticket_enc_key);
|
|
*mac_key = session_ticket_mac_key;
|
|
*mac_key_length = sizeof(session_ticket_mac_key);
|
|
|
|
return SECSuccess;
|
|
}
|
|
#endif
|
|
|
|
/* Table of handlers for received TLS hello extensions, one per extension.
|
|
* In the second generation, this table will be dynamic, and functions
|
|
* will be registered here.
|
|
*/
|
|
/* This table is used by the server, to handle client hello extensions. */
|
|
static const ssl3HelloExtensionHandler clientHelloHandlers[] = {
|
|
{ ssl_server_name_xtn, &ssl3_HandleServerNameXtn },
|
|
#ifndef NSS_DISABLE_ECC
|
|
{ ssl_elliptic_curves_xtn, &ssl3_HandleSupportedCurvesXtn },
|
|
{ ssl_ec_point_formats_xtn, &ssl3_HandleSupportedPointFormatsXtn },
|
|
#endif
|
|
{ ssl_session_ticket_xtn, &ssl3_ServerHandleSessionTicketXtn },
|
|
{ ssl_renegotiation_info_xtn, &ssl3_HandleRenegotiationInfoXtn },
|
|
{ ssl_next_proto_nego_xtn, &ssl3_ServerHandleNextProtoNegoXtn },
|
|
{ ssl_app_layer_protocol_xtn, &ssl3_ServerHandleAppProtoXtn },
|
|
{ ssl_use_srtp_xtn, &ssl3_ServerHandleUseSRTPXtn },
|
|
{ ssl_cert_status_xtn, &ssl3_ServerHandleStatusRequestXtn },
|
|
{ ssl_signature_algorithms_xtn, &ssl3_ServerHandleSigAlgsXtn },
|
|
{ ssl_tls13_draft_version_xtn, &ssl3_ServerHandleDraftVersionXtn },
|
|
{ ssl_extended_master_secret_xtn, &ssl3_HandleExtendedMasterSecretXtn },
|
|
{ -1, NULL }
|
|
};
|
|
|
|
/* These two tables are used by the client, to handle server hello
|
|
* extensions. */
|
|
static const ssl3HelloExtensionHandler serverHelloHandlersTLS[] = {
|
|
{ ssl_server_name_xtn, &ssl3_HandleServerNameXtn },
|
|
/* TODO: add a handler for ssl_ec_point_formats_xtn */
|
|
{ ssl_session_ticket_xtn, &ssl3_ClientHandleSessionTicketXtn },
|
|
{ ssl_renegotiation_info_xtn, &ssl3_HandleRenegotiationInfoXtn },
|
|
{ ssl_next_proto_nego_xtn, &ssl3_ClientHandleNextProtoNegoXtn },
|
|
{ ssl_app_layer_protocol_xtn, &ssl3_ClientHandleAppProtoXtn },
|
|
{ ssl_use_srtp_xtn, &ssl3_ClientHandleUseSRTPXtn },
|
|
{ ssl_cert_status_xtn, &ssl3_ClientHandleStatusRequestXtn },
|
|
{ ssl_extended_master_secret_xtn, &ssl3_HandleExtendedMasterSecretXtn },
|
|
{ -1, NULL }
|
|
};
|
|
|
|
static const ssl3HelloExtensionHandler serverHelloHandlersSSL3[] = {
|
|
{ ssl_renegotiation_info_xtn, &ssl3_HandleRenegotiationInfoXtn },
|
|
{ -1, NULL }
|
|
};
|
|
|
|
/* Tables of functions to format TLS hello extensions, one function per
|
|
* extension.
|
|
* These static tables are for the formatting of client hello extensions.
|
|
* The server's table of hello senders is dynamic, in the socket struct,
|
|
* and sender functions are registered there.
|
|
*/
|
|
static const
|
|
ssl3HelloExtensionSender clientHelloSendersTLS[SSL_MAX_EXTENSIONS] = {
|
|
{ ssl_server_name_xtn, &ssl3_SendServerNameXtn },
|
|
{ ssl_renegotiation_info_xtn, &ssl3_SendRenegotiationInfoXtn },
|
|
#ifndef NSS_DISABLE_ECC
|
|
{ ssl_elliptic_curves_xtn, &ssl3_SendSupportedCurvesXtn },
|
|
{ ssl_ec_point_formats_xtn, &ssl3_SendSupportedPointFormatsXtn },
|
|
#endif
|
|
{ ssl_session_ticket_xtn, &ssl3_SendSessionTicketXtn },
|
|
{ ssl_next_proto_nego_xtn, &ssl3_ClientSendNextProtoNegoXtn },
|
|
{ ssl_app_layer_protocol_xtn, &ssl3_ClientSendAppProtoXtn },
|
|
{ ssl_use_srtp_xtn, &ssl3_ClientSendUseSRTPXtn },
|
|
{ ssl_cert_status_xtn, &ssl3_ClientSendStatusRequestXtn },
|
|
{ ssl_signature_algorithms_xtn, &ssl3_ClientSendSigAlgsXtn },
|
|
{ ssl_tls13_draft_version_xtn, &ssl3_ClientSendDraftVersionXtn },
|
|
{ ssl_extended_master_secret_xtn, &ssl3_SendExtendedMasterSecretXtn},
|
|
/* any extra entries will appear as { 0, NULL } */
|
|
};
|
|
|
|
static const
|
|
ssl3HelloExtensionSender clientHelloSendersSSL3[SSL_MAX_EXTENSIONS] = {
|
|
{ ssl_renegotiation_info_xtn, &ssl3_SendRenegotiationInfoXtn }
|
|
/* any extra entries will appear as { 0, NULL } */
|
|
};
|
|
|
|
static PRBool
|
|
arrayContainsExtension(const PRUint16 *array, PRUint32 len, PRUint16 ex_type)
|
|
{
|
|
unsigned int i;
|
|
for (i = 0; i < len; i++) {
|
|
if (ex_type == array[i])
|
|
return PR_TRUE;
|
|
}
|
|
return PR_FALSE;
|
|
}
|
|
|
|
PRBool
|
|
ssl3_ExtensionNegotiated(sslSocket *ss, PRUint16 ex_type) {
|
|
TLSExtensionData *xtnData = &ss->xtnData;
|
|
return arrayContainsExtension(xtnData->negotiated,
|
|
xtnData->numNegotiated, ex_type);
|
|
}
|
|
|
|
static PRBool
|
|
ssl3_ClientExtensionAdvertised(sslSocket *ss, PRUint16 ex_type) {
|
|
TLSExtensionData *xtnData = &ss->xtnData;
|
|
return arrayContainsExtension(xtnData->advertised,
|
|
xtnData->numAdvertised, ex_type);
|
|
}
|
|
|
|
/* Format an SNI extension, using the name from the socket's URL,
|
|
* unless that name is a dotted decimal string.
|
|
* Used by client and server.
|
|
*/
|
|
PRInt32
|
|
ssl3_SendServerNameXtn(sslSocket * ss, PRBool append,
|
|
PRUint32 maxBytes)
|
|
{
|
|
SECStatus rv;
|
|
if (!ss)
|
|
return 0;
|
|
if (!ss->sec.isServer) {
|
|
PRUint32 len;
|
|
PRNetAddr netAddr;
|
|
|
|
/* must have a hostname */
|
|
if (!ss->url || !ss->url[0])
|
|
return 0;
|
|
/* must not be an IPv4 or IPv6 address */
|
|
if (PR_SUCCESS == PR_StringToNetAddr(ss->url, &netAddr)) {
|
|
/* is an IP address (v4 or v6) */
|
|
return 0;
|
|
}
|
|
len = PORT_Strlen(ss->url);
|
|
if (append && maxBytes >= len + 9) {
|
|
/* extension_type */
|
|
rv = ssl3_AppendHandshakeNumber(ss, ssl_server_name_xtn, 2);
|
|
if (rv != SECSuccess) return -1;
|
|
/* length of extension_data */
|
|
rv = ssl3_AppendHandshakeNumber(ss, len + 5, 2);
|
|
if (rv != SECSuccess) return -1;
|
|
/* length of server_name_list */
|
|
rv = ssl3_AppendHandshakeNumber(ss, len + 3, 2);
|
|
if (rv != SECSuccess) return -1;
|
|
/* Name Type (sni_host_name) */
|
|
rv = ssl3_AppendHandshake(ss, "\0", 1);
|
|
if (rv != SECSuccess) return -1;
|
|
/* HostName (length and value) */
|
|
rv = ssl3_AppendHandshakeVariable(ss, (PRUint8 *)ss->url, len, 2);
|
|
if (rv != SECSuccess) return -1;
|
|
if (!ss->sec.isServer) {
|
|
TLSExtensionData *xtnData = &ss->xtnData;
|
|
xtnData->advertised[xtnData->numAdvertised++] =
|
|
ssl_server_name_xtn;
|
|
}
|
|
}
|
|
return len + 9;
|
|
}
|
|
/* Server side */
|
|
if (append && maxBytes >= 4) {
|
|
rv = ssl3_AppendHandshakeNumber(ss, ssl_server_name_xtn, 2);
|
|
if (rv != SECSuccess) return -1;
|
|
/* length of extension_data */
|
|
rv = ssl3_AppendHandshakeNumber(ss, 0, 2);
|
|
if (rv != SECSuccess) return -1;
|
|
}
|
|
return 4;
|
|
}
|
|
|
|
/* handle an incoming SNI extension, by ignoring it. */
|
|
SECStatus
|
|
ssl3_HandleServerNameXtn(sslSocket * ss, PRUint16 ex_type, SECItem *data)
|
|
{
|
|
SECItem *names = NULL;
|
|
PRUint32 listCount = 0, namesPos = 0, i;
|
|
TLSExtensionData *xtnData = &ss->xtnData;
|
|
SECItem ldata;
|
|
PRInt32 listLenBytes = 0;
|
|
|
|
if (!ss->sec.isServer) {
|
|
return SECSuccess; /* ignore extension */
|
|
}
|
|
|
|
/* Server side - consume client data and register server sender. */
|
|
/* do not parse the data if don't have user extension handling function. */
|
|
if (!ss->sniSocketConfig) {
|
|
return SECSuccess;
|
|
}
|
|
/* length of server_name_list */
|
|
listLenBytes = ssl3_ConsumeHandshakeNumber(ss, 2, &data->data, &data->len);
|
|
if (listLenBytes < 0) {
|
|
return SECFailure;
|
|
}
|
|
if (listLenBytes == 0 || listLenBytes != data->len) {
|
|
(void)ssl3_DecodeError(ss);
|
|
return SECFailure;
|
|
}
|
|
ldata = *data;
|
|
/* Calculate the size of the array.*/
|
|
while (listLenBytes > 0) {
|
|
SECItem litem;
|
|
SECStatus rv;
|
|
PRInt32 type;
|
|
/* Skip Name Type (sni_host_name); checks are on the second pass */
|
|
type = ssl3_ConsumeHandshakeNumber(ss, 1, &ldata.data, &ldata.len);
|
|
if (type < 0) { /* i.e., SECFailure cast to PRint32 */
|
|
return SECFailure;
|
|
}
|
|
rv = ssl3_ConsumeHandshakeVariable(ss, &litem, 2, &ldata.data, &ldata.len);
|
|
if (rv != SECSuccess) {
|
|
return rv;
|
|
}
|
|
/* Adjust total length for consumed item, item len and type.*/
|
|
listLenBytes -= litem.len + 3;
|
|
if (listLenBytes > 0 && !ldata.len) {
|
|
(void)ssl3_DecodeError(ss);
|
|
return SECFailure;
|
|
}
|
|
listCount += 1;
|
|
}
|
|
names = PORT_ZNewArray(SECItem, listCount);
|
|
if (!names) {
|
|
return SECFailure;
|
|
}
|
|
for (i = 0;i < listCount;i++) {
|
|
unsigned int j;
|
|
PRInt32 type;
|
|
SECStatus rv;
|
|
PRBool nametypePresent = PR_FALSE;
|
|
/* Name Type (sni_host_name) */
|
|
type = ssl3_ConsumeHandshakeNumber(ss, 1, &data->data, &data->len);
|
|
/* Check if we have such type in the list */
|
|
for (j = 0;j < listCount && names[j].data;j++) {
|
|
/* TODO bug 998524: .type is not assigned a value */
|
|
if (names[j].type == type) {
|
|
nametypePresent = PR_TRUE;
|
|
break;
|
|
}
|
|
}
|
|
/* HostName (length and value) */
|
|
rv = ssl3_ConsumeHandshakeVariable(ss, &names[namesPos], 2,
|
|
&data->data, &data->len);
|
|
if (rv != SECSuccess) {
|
|
PORT_Assert(0);
|
|
PORT_Free(names);
|
|
PORT_SetError(SEC_ERROR_LIBRARY_FAILURE);
|
|
return rv;
|
|
}
|
|
if (nametypePresent == PR_FALSE) {
|
|
namesPos += 1;
|
|
}
|
|
}
|
|
/* Free old and set the new data. */
|
|
if (xtnData->sniNameArr) {
|
|
PORT_Free(ss->xtnData.sniNameArr);
|
|
}
|
|
xtnData->sniNameArr = names;
|
|
xtnData->sniNameArrSize = namesPos;
|
|
xtnData->negotiated[xtnData->numNegotiated++] = ssl_server_name_xtn;
|
|
|
|
return SECSuccess;
|
|
}
|
|
|
|
/* Called by both clients and servers.
|
|
* Clients sends a filled in session ticket if one is available, and otherwise
|
|
* sends an empty ticket. Servers always send empty tickets.
|
|
*/
|
|
PRInt32
|
|
ssl3_SendSessionTicketXtn(
|
|
sslSocket * ss,
|
|
PRBool append,
|
|
PRUint32 maxBytes)
|
|
{
|
|
PRInt32 extension_length;
|
|
NewSessionTicket *session_ticket = NULL;
|
|
sslSessionID *sid = ss->sec.ci.sid;
|
|
|
|
/* Ignore the SessionTicket extension if processing is disabled. */
|
|
if (!ss->opt.enableSessionTickets)
|
|
return 0;
|
|
|
|
/* Empty extension length = extension_type (2-bytes) +
|
|
* length(extension_data) (2-bytes)
|
|
*/
|
|
extension_length = 4;
|
|
|
|
/* If we are a client then send a session ticket if one is availble.
|
|
* Servers that support the extension and are willing to negotiate the
|
|
* the extension always respond with an empty extension.
|
|
*/
|
|
if (!ss->sec.isServer) {
|
|
/* The caller must be holding sid->u.ssl3.lock for reading. We cannot
|
|
* just acquire and release the lock within this function because the
|
|
* caller will call this function twice, and we need the inputs to be
|
|
* consistent between the two calls. Note that currently the caller
|
|
* will only be holding the lock when we are the client and when we're
|
|
* attempting to resume an existing session.
|
|
*/
|
|
|
|
session_ticket = &sid->u.ssl3.locked.sessionTicket;
|
|
if (session_ticket->ticket.data) {
|
|
if (ss->xtnData.ticketTimestampVerified) {
|
|
extension_length += session_ticket->ticket.len;
|
|
} else if (!append &&
|
|
(session_ticket->ticket_lifetime_hint == 0 ||
|
|
(session_ticket->ticket_lifetime_hint +
|
|
session_ticket->received_timestamp > ssl_Time()))) {
|
|
extension_length += session_ticket->ticket.len;
|
|
ss->xtnData.ticketTimestampVerified = PR_TRUE;
|
|
}
|
|
}
|
|
}
|
|
|
|
if (maxBytes < (PRUint32)extension_length) {
|
|
PORT_Assert(0);
|
|
return 0;
|
|
}
|
|
if (append) {
|
|
SECStatus rv;
|
|
/* extension_type */
|
|
rv = ssl3_AppendHandshakeNumber(ss, ssl_session_ticket_xtn, 2);
|
|
if (rv != SECSuccess)
|
|
goto loser;
|
|
if (session_ticket && session_ticket->ticket.data &&
|
|
ss->xtnData.ticketTimestampVerified) {
|
|
rv = ssl3_AppendHandshakeVariable(ss, session_ticket->ticket.data,
|
|
session_ticket->ticket.len, 2);
|
|
ss->xtnData.ticketTimestampVerified = PR_FALSE;
|
|
ss->xtnData.sentSessionTicketInClientHello = PR_TRUE;
|
|
} else {
|
|
rv = ssl3_AppendHandshakeNumber(ss, 0, 2);
|
|
}
|
|
if (rv != SECSuccess)
|
|
goto loser;
|
|
|
|
if (!ss->sec.isServer) {
|
|
TLSExtensionData *xtnData = &ss->xtnData;
|
|
xtnData->advertised[xtnData->numAdvertised++] =
|
|
ssl_session_ticket_xtn;
|
|
}
|
|
}
|
|
return extension_length;
|
|
|
|
loser:
|
|
ss->xtnData.ticketTimestampVerified = PR_FALSE;
|
|
return -1;
|
|
}
|
|
|
|
/* handle an incoming Next Protocol Negotiation extension. */
|
|
static SECStatus
|
|
ssl3_ServerHandleNextProtoNegoXtn(sslSocket * ss, PRUint16 ex_type,
|
|
SECItem *data)
|
|
{
|
|
if (ss->firstHsDone || data->len != 0) {
|
|
/* Clients MUST send an empty NPN extension, if any. */
|
|
PORT_SetError(SSL_ERROR_NEXT_PROTOCOL_DATA_INVALID);
|
|
return SECFailure;
|
|
}
|
|
|
|
ss->xtnData.negotiated[ss->xtnData.numNegotiated++] = ex_type;
|
|
|
|
/* TODO: server side NPN support would require calling
|
|
* ssl3_RegisterServerHelloExtensionSender here in order to echo the
|
|
* extension back to the client. */
|
|
|
|
return SECSuccess;
|
|
}
|
|
|
|
/* ssl3_ValidateNextProtoNego checks that the given block of data is valid: none
|
|
* of the lengths may be 0 and the sum of the lengths must equal the length of
|
|
* the block. */
|
|
SECStatus
|
|
ssl3_ValidateNextProtoNego(const unsigned char* data, unsigned int length)
|
|
{
|
|
unsigned int offset = 0;
|
|
|
|
while (offset < length) {
|
|
unsigned int newOffset = offset + 1 + (unsigned int) data[offset];
|
|
/* Reject embedded nulls to protect against buggy applications that
|
|
* store protocol identifiers in null-terminated strings.
|
|
*/
|
|
if (newOffset > length || data[offset] == 0) {
|
|
return SECFailure;
|
|
}
|
|
offset = newOffset;
|
|
}
|
|
|
|
return SECSuccess;
|
|
}
|
|
|
|
/* protocol selection handler for ALPN (server side) and NPN (client side) */
|
|
static SECStatus
|
|
ssl3_SelectAppProtocol(sslSocket *ss, PRUint16 ex_type, SECItem *data)
|
|
{
|
|
SECStatus rv;
|
|
unsigned char resultBuffer[255];
|
|
SECItem result = { siBuffer, resultBuffer, 0 };
|
|
|
|
rv = ssl3_ValidateNextProtoNego(data->data, data->len);
|
|
if (rv != SECSuccess) {
|
|
(void)SSL3_SendAlert(ss, alert_fatal, decode_error);
|
|
PORT_SetError(SSL_ERROR_NEXT_PROTOCOL_DATA_INVALID);
|
|
return rv;
|
|
}
|
|
|
|
PORT_Assert(ss->nextProtoCallback);
|
|
/* For ALPN, the cipher suite isn't selected yet. Note that extensions
|
|
* sometimes affect what cipher suite is selected, e.g., for ECC. */
|
|
PORT_Assert((ss->ssl3.hs.preliminaryInfo &
|
|
ssl_preinfo_all & ~ssl_preinfo_cipher_suite) ==
|
|
(ssl_preinfo_all & ~ssl_preinfo_cipher_suite));
|
|
rv = ss->nextProtoCallback(ss->nextProtoArg, ss->fd, data->data, data->len,
|
|
result.data, &result.len, sizeof(resultBuffer));
|
|
if (rv != SECSuccess) {
|
|
/* Expect callback to call PORT_SetError() */
|
|
(void)SSL3_SendAlert(ss, alert_fatal, internal_error);
|
|
return SECFailure;
|
|
}
|
|
|
|
/* If the callback wrote more than allowed to |result| it has corrupted our
|
|
* stack. */
|
|
if (result.len > sizeof(resultBuffer)) {
|
|
PORT_SetError(SEC_ERROR_OUTPUT_LEN);
|
|
/* TODO: crash */
|
|
return SECFailure;
|
|
}
|
|
|
|
SECITEM_FreeItem(&ss->ssl3.nextProto, PR_FALSE);
|
|
|
|
if (ex_type == ssl_app_layer_protocol_xtn &&
|
|
ss->ssl3.nextProtoState != SSL_NEXT_PROTO_NEGOTIATED) {
|
|
/* The callback might say OK, but then it picks a default value - one
|
|
* that was not listed. That's OK for NPN, but not ALPN. */
|
|
(void)SSL3_SendAlert(ss, alert_fatal, no_application_protocol);
|
|
PORT_SetError(SSL_ERROR_NEXT_PROTOCOL_NO_PROTOCOL);
|
|
return SECFailure;
|
|
}
|
|
|
|
ss->xtnData.negotiated[ss->xtnData.numNegotiated++] = ex_type;
|
|
return SECITEM_CopyItem(NULL, &ss->ssl3.nextProto, &result);
|
|
}
|
|
|
|
/* handle an incoming ALPN extension at the server */
|
|
static SECStatus
|
|
ssl3_ServerHandleAppProtoXtn(sslSocket *ss, PRUint16 ex_type, SECItem *data)
|
|
{
|
|
int count;
|
|
SECStatus rv;
|
|
|
|
/* We expressly don't want to allow ALPN on renegotiation,
|
|
* despite it being permitted by the spec. */
|
|
if (ss->firstHsDone || data->len == 0) {
|
|
/* Clients MUST send a non-empty ALPN extension. */
|
|
(void)SSL3_SendAlert(ss, alert_fatal, illegal_parameter);
|
|
PORT_SetError(SSL_ERROR_NEXT_PROTOCOL_DATA_INVALID);
|
|
return SECFailure;
|
|
}
|
|
|
|
/* Unlike NPN, ALPN has extra redundant length information so that
|
|
* the extension is the same in both ClientHello and ServerHello. */
|
|
count = ssl3_ConsumeHandshakeNumber(ss, 2, &data->data, &data->len);
|
|
if (count != data->len) {
|
|
(void)ssl3_DecodeError(ss);
|
|
return SECFailure;
|
|
}
|
|
|
|
if (!ss->nextProtoCallback) {
|
|
/* we're not configured for it */
|
|
return SECSuccess;
|
|
}
|
|
|
|
rv = ssl3_SelectAppProtocol(ss, ex_type, data);
|
|
if (rv != SECSuccess) {
|
|
return rv;
|
|
}
|
|
|
|
/* prepare to send back a response, if we negotiated */
|
|
if (ss->ssl3.nextProtoState == SSL_NEXT_PROTO_NEGOTIATED) {
|
|
rv = ssl3_RegisterServerHelloExtensionSender(
|
|
ss, ex_type, ssl3_ServerSendAppProtoXtn);
|
|
if (rv != SECSuccess) {
|
|
(void)SSL3_SendAlert(ss, alert_fatal, internal_error);
|
|
PORT_SetError(SEC_ERROR_LIBRARY_FAILURE);
|
|
return rv;
|
|
}
|
|
}
|
|
return SECSuccess;
|
|
}
|
|
|
|
static SECStatus
|
|
ssl3_ClientHandleNextProtoNegoXtn(sslSocket *ss, PRUint16 ex_type,
|
|
SECItem *data)
|
|
{
|
|
PORT_Assert(!ss->firstHsDone);
|
|
|
|
if (ssl3_ExtensionNegotiated(ss, ssl_app_layer_protocol_xtn)) {
|
|
/* If the server negotiated ALPN then it has already told us what
|
|
* protocol to use, so it doesn't make sense for us to try to negotiate
|
|
* a different one by sending the NPN handshake message. However, if
|
|
* we've negotiated NPN then we're required to send the NPN handshake
|
|
* message. Thus, these two extensions cannot both be negotiated on the
|
|
* same connection. */
|
|
(void)SSL3_SendAlert(ss, alert_fatal, illegal_parameter);
|
|
PORT_SetError(SSL_ERROR_BAD_SERVER);
|
|
return SECFailure;
|
|
}
|
|
|
|
/* We should only get this call if we sent the extension, so
|
|
* ss->nextProtoCallback needs to be non-NULL. However, it is possible
|
|
* that an application erroneously cleared the callback between the time
|
|
* we sent the ClientHello and now. */
|
|
if (!ss->nextProtoCallback) {
|
|
PORT_Assert(0);
|
|
(void)SSL3_SendAlert(ss, alert_fatal, internal_error);
|
|
PORT_SetError(SSL_ERROR_NEXT_PROTOCOL_NO_CALLBACK);
|
|
return SECFailure;
|
|
}
|
|
|
|
return ssl3_SelectAppProtocol(ss, ex_type, data);
|
|
}
|
|
|
|
static SECStatus
|
|
ssl3_ClientHandleAppProtoXtn(sslSocket *ss, PRUint16 ex_type, SECItem *data)
|
|
{
|
|
SECStatus rv;
|
|
PRInt32 list_len;
|
|
SECItem protocol_name;
|
|
|
|
if (ssl3_ExtensionNegotiated(ss, ssl_next_proto_nego_xtn)) {
|
|
PORT_SetError(SEC_ERROR_LIBRARY_FAILURE);
|
|
return SECFailure;
|
|
}
|
|
|
|
/* The extension data from the server has the following format:
|
|
* uint16 name_list_len;
|
|
* uint8 len; // where len >= 1
|
|
* uint8 protocol_name[len]; */
|
|
if (data->len < 4 || data->len > 2 + 1 + 255) {
|
|
(void)SSL3_SendAlert(ss, alert_fatal, decode_error);
|
|
PORT_SetError(SSL_ERROR_NEXT_PROTOCOL_DATA_INVALID);
|
|
return SECFailure;
|
|
}
|
|
|
|
list_len = ssl3_ConsumeHandshakeNumber(ss, 2, &data->data, &data->len);
|
|
/* The list has to be the entire extension. */
|
|
if (list_len != data->len) {
|
|
(void)SSL3_SendAlert(ss, alert_fatal, decode_error);
|
|
PORT_SetError(SSL_ERROR_NEXT_PROTOCOL_DATA_INVALID);
|
|
return SECFailure;
|
|
}
|
|
|
|
rv = ssl3_ConsumeHandshakeVariable(ss, &protocol_name, 1,
|
|
&data->data, &data->len);
|
|
/* The list must have exactly one value. */
|
|
if (rv != SECSuccess || data->len != 0) {
|
|
(void)SSL3_SendAlert(ss, alert_fatal, decode_error);
|
|
PORT_SetError(SSL_ERROR_NEXT_PROTOCOL_DATA_INVALID);
|
|
return SECFailure;
|
|
}
|
|
|
|
SECITEM_FreeItem(&ss->ssl3.nextProto, PR_FALSE);
|
|
ss->ssl3.nextProtoState = SSL_NEXT_PROTO_SELECTED;
|
|
ss->xtnData.negotiated[ss->xtnData.numNegotiated++] = ex_type;
|
|
return SECITEM_CopyItem(NULL, &ss->ssl3.nextProto, &protocol_name);
|
|
}
|
|
|
|
static PRInt32
|
|
ssl3_ClientSendNextProtoNegoXtn(sslSocket * ss, PRBool append,
|
|
PRUint32 maxBytes)
|
|
{
|
|
PRInt32 extension_length;
|
|
|
|
/* Renegotiations do not send this extension. */
|
|
if (!ss->opt.enableNPN || !ss->nextProtoCallback || ss->firstHsDone) {
|
|
return 0;
|
|
}
|
|
|
|
extension_length = 4;
|
|
|
|
if (maxBytes < (PRUint32)extension_length) {
|
|
return 0;
|
|
}
|
|
if (append) {
|
|
SECStatus rv;
|
|
rv = ssl3_AppendHandshakeNumber(ss, ssl_next_proto_nego_xtn, 2);
|
|
if (rv != SECSuccess)
|
|
goto loser;
|
|
rv = ssl3_AppendHandshakeNumber(ss, 0, 2);
|
|
if (rv != SECSuccess)
|
|
goto loser;
|
|
ss->xtnData.advertised[ss->xtnData.numAdvertised++] =
|
|
ssl_next_proto_nego_xtn;
|
|
}
|
|
|
|
return extension_length;
|
|
|
|
loser:
|
|
return -1;
|
|
}
|
|
|
|
static PRInt32
|
|
ssl3_ClientSendAppProtoXtn(sslSocket * ss, PRBool append, PRUint32 maxBytes)
|
|
{
|
|
PRInt32 extension_length;
|
|
unsigned char *alpn_protos = NULL;
|
|
|
|
/* Renegotiations do not send this extension. */
|
|
if (!ss->opt.enableALPN || !ss->opt.nextProtoNego.data || ss->firstHsDone) {
|
|
return 0;
|
|
}
|
|
|
|
extension_length = 2 /* extension type */ + 2 /* extension length */ +
|
|
2 /* protocol name list length */ +
|
|
ss->opt.nextProtoNego.len;
|
|
|
|
if (maxBytes < (PRUint32)extension_length) {
|
|
return 0;
|
|
}
|
|
if (append) {
|
|
/* NPN requires that the client's fallback protocol is first in the
|
|
* list. However, ALPN sends protocols in preference order. So we
|
|
* allocate a buffer and move the first protocol to the end of the
|
|
* list. */
|
|
SECStatus rv;
|
|
const unsigned int len = ss->opt.nextProtoNego.len;
|
|
|
|
alpn_protos = PORT_Alloc(len);
|
|
if (alpn_protos == NULL) {
|
|
return SECFailure;
|
|
}
|
|
if (len > 0) {
|
|
/* Each protocol string is prefixed with a single byte length. */
|
|
unsigned int i = ss->opt.nextProtoNego.data[0] + 1;
|
|
if (i <= len) {
|
|
memcpy(alpn_protos, &ss->opt.nextProtoNego.data[i], len - i);
|
|
memcpy(alpn_protos + len - i, ss->opt.nextProtoNego.data, i);
|
|
} else {
|
|
/* This seems to be invalid data so we'll send as-is. */
|
|
memcpy(alpn_protos, ss->opt.nextProtoNego.data, len);
|
|
}
|
|
}
|
|
|
|
rv = ssl3_AppendHandshakeNumber(ss, ssl_app_layer_protocol_xtn, 2);
|
|
if (rv != SECSuccess) {
|
|
goto loser;
|
|
}
|
|
rv = ssl3_AppendHandshakeNumber(ss, extension_length - 4, 2);
|
|
if (rv != SECSuccess) {
|
|
goto loser;
|
|
}
|
|
rv = ssl3_AppendHandshakeVariable(ss, alpn_protos, len, 2);
|
|
PORT_Free(alpn_protos);
|
|
alpn_protos = NULL;
|
|
if (rv != SECSuccess) {
|
|
goto loser;
|
|
}
|
|
ss->xtnData.advertised[ss->xtnData.numAdvertised++] =
|
|
ssl_app_layer_protocol_xtn;
|
|
}
|
|
|
|
return extension_length;
|
|
|
|
loser:
|
|
if (alpn_protos) {
|
|
PORT_Free(alpn_protos);
|
|
}
|
|
return -1;
|
|
}
|
|
|
|
static PRInt32
|
|
ssl3_ServerSendAppProtoXtn(sslSocket * ss, PRBool append, PRUint32 maxBytes)
|
|
{
|
|
PRInt32 extension_length;
|
|
|
|
/* we're in over our heads if any of these fail */
|
|
PORT_Assert(ss->opt.enableALPN);
|
|
PORT_Assert(ss->ssl3.nextProto.data);
|
|
PORT_Assert(ss->ssl3.nextProto.len > 0);
|
|
PORT_Assert(ss->ssl3.nextProtoState == SSL_NEXT_PROTO_NEGOTIATED);
|
|
PORT_Assert(!ss->firstHsDone);
|
|
|
|
extension_length = 2 /* extension type */ + 2 /* extension length */ +
|
|
2 /* protocol name list */ + 1 /* name length */ +
|
|
ss->ssl3.nextProto.len;
|
|
|
|
if (maxBytes < (PRUint32)extension_length) {
|
|
return 0;
|
|
}
|
|
if (append) {
|
|
SECStatus rv;
|
|
rv = ssl3_AppendHandshakeNumber(ss, ssl_app_layer_protocol_xtn, 2);
|
|
if (rv != SECSuccess) {
|
|
return -1;
|
|
}
|
|
rv = ssl3_AppendHandshakeNumber(ss, extension_length - 4, 2);
|
|
if (rv != SECSuccess) {
|
|
return -1;
|
|
}
|
|
rv = ssl3_AppendHandshakeNumber(ss, ss->ssl3.nextProto.len + 1, 2);
|
|
if (rv != SECSuccess) {
|
|
return -1;
|
|
}
|
|
rv = ssl3_AppendHandshakeVariable(ss, ss->ssl3.nextProto.data,
|
|
ss->ssl3.nextProto.len, 1);
|
|
if (rv != SECSuccess) {
|
|
return -1;
|
|
}
|
|
}
|
|
|
|
return extension_length;
|
|
}
|
|
|
|
static SECStatus
|
|
ssl3_ClientHandleStatusRequestXtn(sslSocket *ss, PRUint16 ex_type,
|
|
SECItem *data)
|
|
{
|
|
/* The echoed extension must be empty. */
|
|
if (data->len != 0) {
|
|
return SECSuccess; /* Ignore the extension. */
|
|
}
|
|
|
|
/* Keep track of negotiated extensions. */
|
|
ss->xtnData.negotiated[ss->xtnData.numNegotiated++] = ex_type;
|
|
|
|
return SECSuccess;
|
|
}
|
|
|
|
static PRInt32
|
|
ssl3_ServerSendStatusRequestXtn(
|
|
sslSocket * ss,
|
|
PRBool append,
|
|
PRUint32 maxBytes)
|
|
{
|
|
PRInt32 extension_length;
|
|
SECStatus rv;
|
|
int i;
|
|
PRBool haveStatus = PR_FALSE;
|
|
|
|
for (i = kt_null; i < kt_kea_size; i++) {
|
|
/* TODO: This is a temporary workaround.
|
|
* The correct code needs to see if we have an OCSP response for
|
|
* the server certificate being used, rather than if we have any
|
|
* OCSP response. See also ssl3_SendCertificateStatus.
|
|
*/
|
|
if (ss->certStatusArray[i] && ss->certStatusArray[i]->len) {
|
|
haveStatus = PR_TRUE;
|
|
break;
|
|
}
|
|
}
|
|
if (!haveStatus)
|
|
return 0;
|
|
|
|
extension_length = 2 + 2;
|
|
if (maxBytes < (PRUint32)extension_length) {
|
|
return 0;
|
|
}
|
|
if (append) {
|
|
/* extension_type */
|
|
rv = ssl3_AppendHandshakeNumber(ss, ssl_cert_status_xtn, 2);
|
|
if (rv != SECSuccess)
|
|
return -1;
|
|
/* length of extension_data */
|
|
rv = ssl3_AppendHandshakeNumber(ss, 0, 2);
|
|
if (rv != SECSuccess)
|
|
return -1;
|
|
}
|
|
|
|
return extension_length;
|
|
}
|
|
|
|
/* ssl3_ClientSendStatusRequestXtn builds the status_request extension on the
|
|
* client side. See RFC 4366 section 3.6. */
|
|
static PRInt32
|
|
ssl3_ClientSendStatusRequestXtn(sslSocket * ss, PRBool append,
|
|
PRUint32 maxBytes)
|
|
{
|
|
PRInt32 extension_length;
|
|
|
|
if (!ss->opt.enableOCSPStapling)
|
|
return 0;
|
|
|
|
/* extension_type (2-bytes) +
|
|
* length(extension_data) (2-bytes) +
|
|
* status_type (1) +
|
|
* responder_id_list length (2) +
|
|
* request_extensions length (2)
|
|
*/
|
|
extension_length = 9;
|
|
|
|
if (maxBytes < (PRUint32)extension_length) {
|
|
PORT_Assert(0);
|
|
return 0;
|
|
}
|
|
if (append) {
|
|
SECStatus rv;
|
|
TLSExtensionData *xtnData;
|
|
|
|
/* extension_type */
|
|
rv = ssl3_AppendHandshakeNumber(ss, ssl_cert_status_xtn, 2);
|
|
if (rv != SECSuccess)
|
|
return -1;
|
|
rv = ssl3_AppendHandshakeNumber(ss, extension_length - 4, 2);
|
|
if (rv != SECSuccess)
|
|
return -1;
|
|
rv = ssl3_AppendHandshakeNumber(ss, 1 /* status_type ocsp */, 1);
|
|
if (rv != SECSuccess)
|
|
return -1;
|
|
/* A zero length responder_id_list means that the responders are
|
|
* implicitly known to the server. */
|
|
rv = ssl3_AppendHandshakeNumber(ss, 0, 2);
|
|
if (rv != SECSuccess)
|
|
return -1;
|
|
/* A zero length request_extensions means that there are no extensions.
|
|
* Specifically, we don't set the id-pkix-ocsp-nonce extension. This
|
|
* means that the server can replay a cached OCSP response to us. */
|
|
rv = ssl3_AppendHandshakeNumber(ss, 0, 2);
|
|
if (rv != SECSuccess)
|
|
return -1;
|
|
|
|
xtnData = &ss->xtnData;
|
|
xtnData->advertised[xtnData->numAdvertised++] = ssl_cert_status_xtn;
|
|
}
|
|
return extension_length;
|
|
}
|
|
|
|
/*
|
|
* NewSessionTicket
|
|
* Called from ssl3_HandleFinished
|
|
*/
|
|
SECStatus
|
|
ssl3_SendNewSessionTicket(sslSocket *ss)
|
|
{
|
|
PRUint32 i;
|
|
SECStatus rv;
|
|
NewSessionTicket ticket;
|
|
SECItem plaintext;
|
|
SECItem plaintext_item = {0, NULL, 0};
|
|
SECItem ciphertext = {0, NULL, 0};
|
|
PRUint32 ciphertext_length;
|
|
PRBool ms_is_wrapped;
|
|
unsigned char wrapped_ms[SSL3_MASTER_SECRET_LENGTH];
|
|
SECItem ms_item = {0, NULL, 0};
|
|
SSL3KEAType effectiveExchKeyType = ssl_kea_null;
|
|
PRUint32 padding_length;
|
|
PRUint32 message_length;
|
|
PRUint32 cert_length;
|
|
PRUint8 length_buf[4];
|
|
PRUint32 now;
|
|
PK11SymKey *aes_key_pkcs11;
|
|
PK11SymKey *mac_key_pkcs11;
|
|
#ifndef NO_PKCS11_BYPASS
|
|
const unsigned char *aes_key;
|
|
const unsigned char *mac_key;
|
|
PRUint32 aes_key_length;
|
|
PRUint32 mac_key_length;
|
|
PRUint64 aes_ctx_buf[MAX_CIPHER_CONTEXT_LLONGS];
|
|
AESContext *aes_ctx;
|
|
const SECHashObject *hashObj = NULL;
|
|
PRUint64 hmac_ctx_buf[MAX_MAC_CONTEXT_LLONGS];
|
|
HMACContext *hmac_ctx;
|
|
#endif
|
|
CK_MECHANISM_TYPE cipherMech = CKM_AES_CBC;
|
|
PK11Context *aes_ctx_pkcs11;
|
|
CK_MECHANISM_TYPE macMech = CKM_SHA256_HMAC;
|
|
PK11Context *hmac_ctx_pkcs11 = NULL;
|
|
unsigned char computed_mac[TLS_EX_SESS_TICKET_MAC_LENGTH];
|
|
unsigned int computed_mac_length;
|
|
unsigned char iv[AES_BLOCK_SIZE];
|
|
SECItem ivItem;
|
|
SECItem *srvName = NULL;
|
|
PRUint32 srvNameLen = 0;
|
|
CK_MECHANISM_TYPE msWrapMech = 0; /* dummy default value,
|
|
* must be >= 0 */
|
|
|
|
SSL_TRC(3, ("%d: SSL3[%d]: send session_ticket handshake",
|
|
SSL_GETPID(), ss->fd));
|
|
|
|
PORT_Assert( ss->opt.noLocks || ssl_HaveXmitBufLock(ss));
|
|
PORT_Assert( ss->opt.noLocks || ssl_HaveSSL3HandshakeLock(ss));
|
|
|
|
ticket.ticket_lifetime_hint = TLS_EX_SESS_TICKET_LIFETIME_HINT;
|
|
cert_length = (ss->opt.requestCertificate && ss->sec.ci.sid->peerCert) ?
|
|
3 + ss->sec.ci.sid->peerCert->derCert.len : 0;
|
|
|
|
/* Get IV and encryption keys */
|
|
ivItem.data = iv;
|
|
ivItem.len = sizeof(iv);
|
|
rv = PK11_GenerateRandom(iv, sizeof(iv));
|
|
if (rv != SECSuccess) goto loser;
|
|
|
|
#ifndef NO_PKCS11_BYPASS
|
|
if (ss->opt.bypassPKCS11) {
|
|
rv = ssl3_GetSessionTicketKeys(&aes_key, &aes_key_length,
|
|
&mac_key, &mac_key_length);
|
|
} else
|
|
#endif
|
|
{
|
|
rv = ssl3_GetSessionTicketKeysPKCS11(ss, &aes_key_pkcs11,
|
|
&mac_key_pkcs11);
|
|
}
|
|
if (rv != SECSuccess) goto loser;
|
|
|
|
if (ss->ssl3.pwSpec->msItem.len && ss->ssl3.pwSpec->msItem.data) {
|
|
/* The master secret is available unwrapped. */
|
|
ms_item.data = ss->ssl3.pwSpec->msItem.data;
|
|
ms_item.len = ss->ssl3.pwSpec->msItem.len;
|
|
ms_is_wrapped = PR_FALSE;
|
|
} else {
|
|
/* Extract the master secret wrapped. */
|
|
sslSessionID sid;
|
|
PORT_Memset(&sid, 0, sizeof(sslSessionID));
|
|
|
|
if (ss->ssl3.hs.kea_def->kea == kea_ecdhe_rsa ||
|
|
ss->ssl3.hs.kea_def->kea == kea_dhe_rsa) {
|
|
effectiveExchKeyType = kt_rsa;
|
|
} else {
|
|
effectiveExchKeyType = ss->ssl3.hs.kea_def->exchKeyType;
|
|
}
|
|
|
|
rv = ssl3_CacheWrappedMasterSecret(ss, &sid, ss->ssl3.pwSpec,
|
|
effectiveExchKeyType);
|
|
if (rv == SECSuccess) {
|
|
if (sid.u.ssl3.keys.wrapped_master_secret_len > sizeof(wrapped_ms))
|
|
goto loser;
|
|
memcpy(wrapped_ms, sid.u.ssl3.keys.wrapped_master_secret,
|
|
sid.u.ssl3.keys.wrapped_master_secret_len);
|
|
ms_item.data = wrapped_ms;
|
|
ms_item.len = sid.u.ssl3.keys.wrapped_master_secret_len;
|
|
msWrapMech = sid.u.ssl3.masterWrapMech;
|
|
} else {
|
|
/* TODO: else send an empty ticket. */
|
|
goto loser;
|
|
}
|
|
ms_is_wrapped = PR_TRUE;
|
|
}
|
|
/* Prep to send negotiated name */
|
|
srvName = &ss->ssl3.pwSpec->srvVirtName;
|
|
if (srvName->data && srvName->len) {
|
|
srvNameLen = 2 + srvName->len; /* len bytes + name len */
|
|
}
|
|
|
|
ciphertext_length =
|
|
sizeof(PRUint16) /* ticket_version */
|
|
+ sizeof(SSL3ProtocolVersion) /* ssl_version */
|
|
+ sizeof(ssl3CipherSuite) /* ciphersuite */
|
|
+ 1 /* compression */
|
|
+ 10 /* cipher spec parameters */
|
|
+ 1 /* SessionTicket.ms_is_wrapped */
|
|
+ 1 /* effectiveExchKeyType */
|
|
+ 4 /* msWrapMech */
|
|
+ 2 /* master_secret.length */
|
|
+ ms_item.len /* master_secret */
|
|
+ 1 /* client_auth_type */
|
|
+ cert_length /* cert */
|
|
+ 1 /* server name type */
|
|
+ srvNameLen /* name len + length field */
|
|
+ 1 /* extendedMasterSecretUsed */
|
|
+ sizeof(ticket.ticket_lifetime_hint);
|
|
padding_length = AES_BLOCK_SIZE -
|
|
(ciphertext_length % AES_BLOCK_SIZE);
|
|
ciphertext_length += padding_length;
|
|
|
|
message_length =
|
|
sizeof(ticket.ticket_lifetime_hint) /* ticket_lifetime_hint */
|
|
+ 2 /* length field for NewSessionTicket.ticket */
|
|
+ SESS_TICKET_KEY_NAME_LEN /* key_name */
|
|
+ AES_BLOCK_SIZE /* iv */
|
|
+ 2 /* length field for NewSessionTicket.ticket.encrypted_state */
|
|
+ ciphertext_length /* encrypted_state */
|
|
+ TLS_EX_SESS_TICKET_MAC_LENGTH; /* mac */
|
|
|
|
if (SECITEM_AllocItem(NULL, &plaintext_item, ciphertext_length) == NULL)
|
|
goto loser;
|
|
|
|
plaintext = plaintext_item;
|
|
|
|
/* ticket_version */
|
|
rv = ssl3_AppendNumberToItem(&plaintext, TLS_EX_SESS_TICKET_VERSION,
|
|
sizeof(PRUint16));
|
|
if (rv != SECSuccess) goto loser;
|
|
|
|
/* ssl_version */
|
|
rv = ssl3_AppendNumberToItem(&plaintext, ss->version,
|
|
sizeof(SSL3ProtocolVersion));
|
|
if (rv != SECSuccess) goto loser;
|
|
|
|
/* ciphersuite */
|
|
rv = ssl3_AppendNumberToItem(&plaintext, ss->ssl3.hs.cipher_suite,
|
|
sizeof(ssl3CipherSuite));
|
|
if (rv != SECSuccess) goto loser;
|
|
|
|
/* compression */
|
|
rv = ssl3_AppendNumberToItem(&plaintext, ss->ssl3.hs.compression, 1);
|
|
if (rv != SECSuccess) goto loser;
|
|
|
|
/* cipher spec parameters */
|
|
rv = ssl3_AppendNumberToItem(&plaintext, ss->sec.authAlgorithm, 1);
|
|
if (rv != SECSuccess) goto loser;
|
|
rv = ssl3_AppendNumberToItem(&plaintext, ss->sec.authKeyBits, 4);
|
|
if (rv != SECSuccess) goto loser;
|
|
rv = ssl3_AppendNumberToItem(&plaintext, ss->sec.keaType, 1);
|
|
if (rv != SECSuccess) goto loser;
|
|
rv = ssl3_AppendNumberToItem(&plaintext, ss->sec.keaKeyBits, 4);
|
|
if (rv != SECSuccess) goto loser;
|
|
|
|
/* master_secret */
|
|
rv = ssl3_AppendNumberToItem(&plaintext, ms_is_wrapped, 1);
|
|
if (rv != SECSuccess) goto loser;
|
|
rv = ssl3_AppendNumberToItem(&plaintext, effectiveExchKeyType, 1);
|
|
if (rv != SECSuccess) goto loser;
|
|
rv = ssl3_AppendNumberToItem(&plaintext, msWrapMech, 4);
|
|
if (rv != SECSuccess) goto loser;
|
|
rv = ssl3_AppendNumberToItem(&plaintext, ms_item.len, 2);
|
|
if (rv != SECSuccess) goto loser;
|
|
rv = ssl3_AppendToItem(&plaintext, ms_item.data, ms_item.len);
|
|
if (rv != SECSuccess) goto loser;
|
|
|
|
/* client_identity */
|
|
if (ss->opt.requestCertificate && ss->sec.ci.sid->peerCert) {
|
|
rv = ssl3_AppendNumberToItem(&plaintext, CLIENT_AUTH_CERTIFICATE, 1);
|
|
if (rv != SECSuccess) goto loser;
|
|
rv = ssl3_AppendNumberToItem(&plaintext,
|
|
ss->sec.ci.sid->peerCert->derCert.len, 3);
|
|
if (rv != SECSuccess) goto loser;
|
|
rv = ssl3_AppendToItem(&plaintext,
|
|
ss->sec.ci.sid->peerCert->derCert.data,
|
|
ss->sec.ci.sid->peerCert->derCert.len);
|
|
if (rv != SECSuccess) goto loser;
|
|
} else {
|
|
rv = ssl3_AppendNumberToItem(&plaintext, 0, 1);
|
|
if (rv != SECSuccess) goto loser;
|
|
}
|
|
|
|
/* timestamp */
|
|
now = ssl_Time();
|
|
rv = ssl3_AppendNumberToItem(&plaintext, now,
|
|
sizeof(ticket.ticket_lifetime_hint));
|
|
if (rv != SECSuccess) goto loser;
|
|
|
|
if (srvNameLen) {
|
|
/* Name Type (sni_host_name) */
|
|
rv = ssl3_AppendNumberToItem(&plaintext, srvName->type, 1);
|
|
if (rv != SECSuccess) goto loser;
|
|
/* HostName (length and value) */
|
|
rv = ssl3_AppendNumberToItem(&plaintext, srvName->len, 2);
|
|
if (rv != SECSuccess) goto loser;
|
|
rv = ssl3_AppendToItem(&plaintext, srvName->data, srvName->len);
|
|
if (rv != SECSuccess) goto loser;
|
|
} else {
|
|
/* No Name */
|
|
rv = ssl3_AppendNumberToItem(&plaintext, (char)TLS_STE_NO_SERVER_NAME,
|
|
1);
|
|
if (rv != SECSuccess) goto loser;
|
|
}
|
|
|
|
/* extendedMasterSecretUsed */
|
|
rv = ssl3_AppendNumberToItem(
|
|
&plaintext, ss->sec.ci.sid->u.ssl3.keys.extendedMasterSecretUsed, 1);
|
|
if (rv != SECSuccess) goto loser;
|
|
|
|
PORT_Assert(plaintext.len == padding_length);
|
|
for (i = 0; i < padding_length; i++)
|
|
plaintext.data[i] = (unsigned char)padding_length;
|
|
|
|
if (SECITEM_AllocItem(NULL, &ciphertext, ciphertext_length) == NULL) {
|
|
rv = SECFailure;
|
|
goto loser;
|
|
}
|
|
|
|
/* Generate encrypted portion of ticket. */
|
|
#ifndef NO_PKCS11_BYPASS
|
|
if (ss->opt.bypassPKCS11) {
|
|
aes_ctx = (AESContext *)aes_ctx_buf;
|
|
rv = AES_InitContext(aes_ctx, aes_key, aes_key_length, iv,
|
|
NSS_AES_CBC, 1, AES_BLOCK_SIZE);
|
|
if (rv != SECSuccess) goto loser;
|
|
|
|
rv = AES_Encrypt(aes_ctx, ciphertext.data, &ciphertext.len,
|
|
ciphertext.len, plaintext_item.data,
|
|
plaintext_item.len);
|
|
if (rv != SECSuccess) goto loser;
|
|
} else
|
|
#endif
|
|
{
|
|
aes_ctx_pkcs11 = PK11_CreateContextBySymKey(cipherMech,
|
|
CKA_ENCRYPT, aes_key_pkcs11, &ivItem);
|
|
if (!aes_ctx_pkcs11)
|
|
goto loser;
|
|
|
|
rv = PK11_CipherOp(aes_ctx_pkcs11, ciphertext.data,
|
|
(int *)&ciphertext.len, ciphertext.len,
|
|
plaintext_item.data, plaintext_item.len);
|
|
PK11_Finalize(aes_ctx_pkcs11);
|
|
PK11_DestroyContext(aes_ctx_pkcs11, PR_TRUE);
|
|
if (rv != SECSuccess) goto loser;
|
|
}
|
|
|
|
/* Convert ciphertext length to network order. */
|
|
length_buf[0] = (ciphertext.len >> 8) & 0xff;
|
|
length_buf[1] = (ciphertext.len ) & 0xff;
|
|
|
|
/* Compute MAC. */
|
|
#ifndef NO_PKCS11_BYPASS
|
|
if (ss->opt.bypassPKCS11) {
|
|
hmac_ctx = (HMACContext *)hmac_ctx_buf;
|
|
hashObj = HASH_GetRawHashObject(HASH_AlgSHA256);
|
|
if (HMAC_Init(hmac_ctx, hashObj, mac_key,
|
|
mac_key_length, PR_FALSE) != SECSuccess)
|
|
goto loser;
|
|
|
|
HMAC_Begin(hmac_ctx);
|
|
HMAC_Update(hmac_ctx, key_name, SESS_TICKET_KEY_NAME_LEN);
|
|
HMAC_Update(hmac_ctx, iv, sizeof(iv));
|
|
HMAC_Update(hmac_ctx, (unsigned char *)length_buf, 2);
|
|
HMAC_Update(hmac_ctx, ciphertext.data, ciphertext.len);
|
|
HMAC_Finish(hmac_ctx, computed_mac, &computed_mac_length,
|
|
sizeof(computed_mac));
|
|
} else
|
|
#endif
|
|
{
|
|
SECItem macParam;
|
|
macParam.data = NULL;
|
|
macParam.len = 0;
|
|
hmac_ctx_pkcs11 = PK11_CreateContextBySymKey(macMech,
|
|
CKA_SIGN, mac_key_pkcs11, &macParam);
|
|
if (!hmac_ctx_pkcs11)
|
|
goto loser;
|
|
|
|
rv = PK11_DigestBegin(hmac_ctx_pkcs11);
|
|
if (rv != SECSuccess) goto loser;
|
|
rv = PK11_DigestOp(hmac_ctx_pkcs11, key_name,
|
|
SESS_TICKET_KEY_NAME_LEN);
|
|
if (rv != SECSuccess) goto loser;
|
|
rv = PK11_DigestOp(hmac_ctx_pkcs11, iv, sizeof(iv));
|
|
if (rv != SECSuccess) goto loser;
|
|
rv = PK11_DigestOp(hmac_ctx_pkcs11, (unsigned char *)length_buf, 2);
|
|
if (rv != SECSuccess) goto loser;
|
|
rv = PK11_DigestOp(hmac_ctx_pkcs11, ciphertext.data, ciphertext.len);
|
|
if (rv != SECSuccess) goto loser;
|
|
rv = PK11_DigestFinal(hmac_ctx_pkcs11, computed_mac,
|
|
&computed_mac_length, sizeof(computed_mac));
|
|
if (rv != SECSuccess) goto loser;
|
|
}
|
|
|
|
/* Serialize the handshake message. */
|
|
rv = ssl3_AppendHandshakeHeader(ss, new_session_ticket, message_length);
|
|
if (rv != SECSuccess) goto loser;
|
|
|
|
rv = ssl3_AppendHandshakeNumber(ss, ticket.ticket_lifetime_hint,
|
|
sizeof(ticket.ticket_lifetime_hint));
|
|
if (rv != SECSuccess) goto loser;
|
|
|
|
rv = ssl3_AppendHandshakeNumber(ss,
|
|
message_length - sizeof(ticket.ticket_lifetime_hint) - 2, 2);
|
|
if (rv != SECSuccess) goto loser;
|
|
|
|
rv = ssl3_AppendHandshake(ss, key_name, SESS_TICKET_KEY_NAME_LEN);
|
|
if (rv != SECSuccess) goto loser;
|
|
|
|
rv = ssl3_AppendHandshake(ss, iv, sizeof(iv));
|
|
if (rv != SECSuccess) goto loser;
|
|
|
|
rv = ssl3_AppendHandshakeVariable(ss, ciphertext.data, ciphertext.len, 2);
|
|
if (rv != SECSuccess) goto loser;
|
|
|
|
rv = ssl3_AppendHandshake(ss, computed_mac, computed_mac_length);
|
|
if (rv != SECSuccess) goto loser;
|
|
|
|
loser:
|
|
if (hmac_ctx_pkcs11)
|
|
PK11_DestroyContext(hmac_ctx_pkcs11, PR_TRUE);
|
|
if (plaintext_item.data)
|
|
SECITEM_FreeItem(&plaintext_item, PR_FALSE);
|
|
if (ciphertext.data)
|
|
SECITEM_FreeItem(&ciphertext, PR_FALSE);
|
|
|
|
return rv;
|
|
}
|
|
|
|
/* When a client receives a SessionTicket extension a NewSessionTicket
|
|
* message is expected during the handshake.
|
|
*/
|
|
SECStatus
|
|
ssl3_ClientHandleSessionTicketXtn(sslSocket *ss, PRUint16 ex_type,
|
|
SECItem *data)
|
|
{
|
|
if (data->len != 0) {
|
|
return SECSuccess; /* Ignore the extension. */
|
|
}
|
|
|
|
/* Keep track of negotiated extensions. */
|
|
ss->xtnData.negotiated[ss->xtnData.numNegotiated++] = ex_type;
|
|
return SECSuccess;
|
|
}
|
|
|
|
SECStatus
|
|
ssl3_ServerHandleSessionTicketXtn(sslSocket *ss, PRUint16 ex_type,
|
|
SECItem *data)
|
|
{
|
|
SECStatus rv;
|
|
SECItem *decrypted_state = NULL;
|
|
SessionTicket *parsed_session_ticket = NULL;
|
|
sslSessionID *sid = NULL;
|
|
SSL3Statistics *ssl3stats;
|
|
|
|
/* Ignore the SessionTicket extension if processing is disabled. */
|
|
if (!ss->opt.enableSessionTickets) {
|
|
return SECSuccess;
|
|
}
|
|
|
|
/* Keep track of negotiated extensions. */
|
|
ss->xtnData.negotiated[ss->xtnData.numNegotiated++] = ex_type;
|
|
|
|
/* Parse the received ticket sent in by the client. We are
|
|
* lenient about some parse errors, falling back to a fullshake
|
|
* instead of terminating the current connection.
|
|
*/
|
|
if (data->len == 0) {
|
|
ss->xtnData.emptySessionTicket = PR_TRUE;
|
|
} else {
|
|
PRUint32 i;
|
|
SECItem extension_data;
|
|
EncryptedSessionTicket enc_session_ticket;
|
|
unsigned char computed_mac[TLS_EX_SESS_TICKET_MAC_LENGTH];
|
|
unsigned int computed_mac_length;
|
|
#ifndef NO_PKCS11_BYPASS
|
|
const SECHashObject *hashObj;
|
|
const unsigned char *aes_key;
|
|
const unsigned char *mac_key;
|
|
PRUint32 aes_key_length;
|
|
PRUint32 mac_key_length;
|
|
PRUint64 hmac_ctx_buf[MAX_MAC_CONTEXT_LLONGS];
|
|
HMACContext *hmac_ctx;
|
|
PRUint64 aes_ctx_buf[MAX_CIPHER_CONTEXT_LLONGS];
|
|
AESContext *aes_ctx;
|
|
#endif
|
|
PK11SymKey *aes_key_pkcs11;
|
|
PK11SymKey *mac_key_pkcs11;
|
|
PK11Context *hmac_ctx_pkcs11;
|
|
CK_MECHANISM_TYPE macMech = CKM_SHA256_HMAC;
|
|
PK11Context *aes_ctx_pkcs11;
|
|
CK_MECHANISM_TYPE cipherMech = CKM_AES_CBC;
|
|
unsigned char * padding;
|
|
PRUint32 padding_length;
|
|
unsigned char *buffer;
|
|
unsigned int buffer_len;
|
|
PRInt32 temp;
|
|
SECItem cert_item;
|
|
PRInt8 nameType = TLS_STE_NO_SERVER_NAME;
|
|
|
|
/* Turn off stateless session resumption if the client sends a
|
|
* SessionTicket extension, even if the extension turns out to be
|
|
* malformed (ss->sec.ci.sid is non-NULL when doing session
|
|
* renegotiation.)
|
|
*/
|
|
if (ss->sec.ci.sid != NULL) {
|
|
if (ss->sec.uncache)
|
|
ss->sec.uncache(ss->sec.ci.sid);
|
|
ssl_FreeSID(ss->sec.ci.sid);
|
|
ss->sec.ci.sid = NULL;
|
|
}
|
|
|
|
extension_data.data = data->data; /* Keep a copy for future use. */
|
|
extension_data.len = data->len;
|
|
|
|
if (ssl3_ParseEncryptedSessionTicket(ss, data, &enc_session_ticket)
|
|
!= SECSuccess) {
|
|
return SECSuccess; /* Pretend it isn't there */
|
|
}
|
|
|
|
/* Get session ticket keys. */
|
|
#ifndef NO_PKCS11_BYPASS
|
|
if (ss->opt.bypassPKCS11) {
|
|
rv = ssl3_GetSessionTicketKeys(&aes_key, &aes_key_length,
|
|
&mac_key, &mac_key_length);
|
|
} else
|
|
#endif
|
|
{
|
|
rv = ssl3_GetSessionTicketKeysPKCS11(ss, &aes_key_pkcs11,
|
|
&mac_key_pkcs11);
|
|
}
|
|
if (rv != SECSuccess) {
|
|
SSL_DBG(("%d: SSL[%d]: Unable to get/generate session ticket keys.",
|
|
SSL_GETPID(), ss->fd));
|
|
goto loser;
|
|
}
|
|
|
|
/* If the ticket sent by the client was generated under a key different
|
|
* from the one we have, bypass ticket processing.
|
|
*/
|
|
if (PORT_Memcmp(enc_session_ticket.key_name, key_name,
|
|
SESS_TICKET_KEY_NAME_LEN) != 0) {
|
|
SSL_DBG(("%d: SSL[%d]: Session ticket key_name sent mismatch.",
|
|
SSL_GETPID(), ss->fd));
|
|
goto no_ticket;
|
|
}
|
|
|
|
/* Verify the MAC on the ticket. MAC verification may also
|
|
* fail if the MAC key has been recently refreshed.
|
|
*/
|
|
#ifndef NO_PKCS11_BYPASS
|
|
if (ss->opt.bypassPKCS11) {
|
|
hmac_ctx = (HMACContext *)hmac_ctx_buf;
|
|
hashObj = HASH_GetRawHashObject(HASH_AlgSHA256);
|
|
if (HMAC_Init(hmac_ctx, hashObj, mac_key,
|
|
sizeof(session_ticket_mac_key), PR_FALSE) != SECSuccess)
|
|
goto no_ticket;
|
|
HMAC_Begin(hmac_ctx);
|
|
HMAC_Update(hmac_ctx, extension_data.data,
|
|
extension_data.len - TLS_EX_SESS_TICKET_MAC_LENGTH);
|
|
if (HMAC_Finish(hmac_ctx, computed_mac, &computed_mac_length,
|
|
sizeof(computed_mac)) != SECSuccess)
|
|
goto no_ticket;
|
|
} else
|
|
#endif
|
|
{
|
|
SECItem macParam;
|
|
macParam.data = NULL;
|
|
macParam.len = 0;
|
|
hmac_ctx_pkcs11 = PK11_CreateContextBySymKey(macMech,
|
|
CKA_SIGN, mac_key_pkcs11, &macParam);
|
|
if (!hmac_ctx_pkcs11) {
|
|
SSL_DBG(("%d: SSL[%d]: Unable to create HMAC context: %d.",
|
|
SSL_GETPID(), ss->fd, PORT_GetError()));
|
|
goto no_ticket;
|
|
} else {
|
|
SSL_DBG(("%d: SSL[%d]: Successfully created HMAC context.",
|
|
SSL_GETPID(), ss->fd));
|
|
}
|
|
rv = PK11_DigestBegin(hmac_ctx_pkcs11);
|
|
rv = PK11_DigestOp(hmac_ctx_pkcs11, extension_data.data,
|
|
extension_data.len - TLS_EX_SESS_TICKET_MAC_LENGTH);
|
|
if (rv != SECSuccess) {
|
|
PK11_DestroyContext(hmac_ctx_pkcs11, PR_TRUE);
|
|
goto no_ticket;
|
|
}
|
|
rv = PK11_DigestFinal(hmac_ctx_pkcs11, computed_mac,
|
|
&computed_mac_length, sizeof(computed_mac));
|
|
PK11_DestroyContext(hmac_ctx_pkcs11, PR_TRUE);
|
|
if (rv != SECSuccess)
|
|
goto no_ticket;
|
|
}
|
|
if (NSS_SecureMemcmp(computed_mac, enc_session_ticket.mac,
|
|
computed_mac_length) != 0) {
|
|
SSL_DBG(("%d: SSL[%d]: Session ticket MAC mismatch.",
|
|
SSL_GETPID(), ss->fd));
|
|
goto no_ticket;
|
|
}
|
|
|
|
/* We ignore key_name for now.
|
|
* This is ok as MAC verification succeeded.
|
|
*/
|
|
|
|
/* Decrypt the ticket. */
|
|
|
|
/* Plaintext is shorter than the ciphertext due to padding. */
|
|
decrypted_state = SECITEM_AllocItem(NULL, NULL,
|
|
enc_session_ticket.encrypted_state.len);
|
|
|
|
#ifndef NO_PKCS11_BYPASS
|
|
if (ss->opt.bypassPKCS11) {
|
|
aes_ctx = (AESContext *)aes_ctx_buf;
|
|
rv = AES_InitContext(aes_ctx, aes_key,
|
|
sizeof(session_ticket_enc_key), enc_session_ticket.iv,
|
|
NSS_AES_CBC, 0,AES_BLOCK_SIZE);
|
|
if (rv != SECSuccess) {
|
|
SSL_DBG(("%d: SSL[%d]: Unable to create AES context.",
|
|
SSL_GETPID(), ss->fd));
|
|
goto no_ticket;
|
|
}
|
|
|
|
rv = AES_Decrypt(aes_ctx, decrypted_state->data,
|
|
&decrypted_state->len, decrypted_state->len,
|
|
enc_session_ticket.encrypted_state.data,
|
|
enc_session_ticket.encrypted_state.len);
|
|
if (rv != SECSuccess)
|
|
goto no_ticket;
|
|
} else
|
|
#endif
|
|
{
|
|
SECItem ivItem;
|
|
ivItem.data = enc_session_ticket.iv;
|
|
ivItem.len = AES_BLOCK_SIZE;
|
|
aes_ctx_pkcs11 = PK11_CreateContextBySymKey(cipherMech,
|
|
CKA_DECRYPT, aes_key_pkcs11, &ivItem);
|
|
if (!aes_ctx_pkcs11) {
|
|
SSL_DBG(("%d: SSL[%d]: Unable to create AES context.",
|
|
SSL_GETPID(), ss->fd));
|
|
goto no_ticket;
|
|
}
|
|
|
|
rv = PK11_CipherOp(aes_ctx_pkcs11, decrypted_state->data,
|
|
(int *)&decrypted_state->len, decrypted_state->len,
|
|
enc_session_ticket.encrypted_state.data,
|
|
enc_session_ticket.encrypted_state.len);
|
|
PK11_Finalize(aes_ctx_pkcs11);
|
|
PK11_DestroyContext(aes_ctx_pkcs11, PR_TRUE);
|
|
if (rv != SECSuccess)
|
|
goto no_ticket;
|
|
}
|
|
|
|
/* Check padding. */
|
|
padding_length =
|
|
(PRUint32)decrypted_state->data[decrypted_state->len - 1];
|
|
if (padding_length == 0 || padding_length > AES_BLOCK_SIZE)
|
|
goto no_ticket;
|
|
|
|
padding = &decrypted_state->data[decrypted_state->len - padding_length];
|
|
for (i = 0; i < padding_length; i++, padding++) {
|
|
if (padding_length != (PRUint32)*padding)
|
|
goto no_ticket;
|
|
}
|
|
|
|
/* Deserialize session state. */
|
|
buffer = decrypted_state->data;
|
|
buffer_len = decrypted_state->len;
|
|
|
|
parsed_session_ticket = PORT_ZAlloc(sizeof(SessionTicket));
|
|
if (parsed_session_ticket == NULL) {
|
|
rv = SECFailure;
|
|
goto loser;
|
|
}
|
|
|
|
/* Read ticket_version and reject if the version is wrong */
|
|
temp = ssl3_ConsumeHandshakeNumber(ss, 2, &buffer, &buffer_len);
|
|
if (temp != TLS_EX_SESS_TICKET_VERSION) goto no_ticket;
|
|
|
|
parsed_session_ticket->ticket_version = (SSL3ProtocolVersion)temp;
|
|
|
|
/* Read SSLVersion. */
|
|
temp = ssl3_ConsumeHandshakeNumber(ss, 2, &buffer, &buffer_len);
|
|
if (temp < 0) goto no_ticket;
|
|
parsed_session_ticket->ssl_version = (SSL3ProtocolVersion)temp;
|
|
|
|
/* Read cipher_suite. */
|
|
temp = ssl3_ConsumeHandshakeNumber(ss, 2, &buffer, &buffer_len);
|
|
if (temp < 0) goto no_ticket;
|
|
parsed_session_ticket->cipher_suite = (ssl3CipherSuite)temp;
|
|
|
|
/* Read compression_method. */
|
|
temp = ssl3_ConsumeHandshakeNumber(ss, 1, &buffer, &buffer_len);
|
|
if (temp < 0) goto no_ticket;
|
|
parsed_session_ticket->compression_method = (SSLCompressionMethod)temp;
|
|
|
|
/* Read cipher spec parameters. */
|
|
temp = ssl3_ConsumeHandshakeNumber(ss, 1, &buffer, &buffer_len);
|
|
if (temp < 0) goto no_ticket;
|
|
parsed_session_ticket->authAlgorithm = (SSLSignType)temp;
|
|
temp = ssl3_ConsumeHandshakeNumber(ss, 4, &buffer, &buffer_len);
|
|
if (temp < 0) goto no_ticket;
|
|
parsed_session_ticket->authKeyBits = (PRUint32)temp;
|
|
temp = ssl3_ConsumeHandshakeNumber(ss, 1, &buffer, &buffer_len);
|
|
if (temp < 0) goto no_ticket;
|
|
parsed_session_ticket->keaType = (SSLKEAType)temp;
|
|
temp = ssl3_ConsumeHandshakeNumber(ss, 4, &buffer, &buffer_len);
|
|
if (temp < 0) goto no_ticket;
|
|
parsed_session_ticket->keaKeyBits = (PRUint32)temp;
|
|
|
|
/* Read wrapped master_secret. */
|
|
temp = ssl3_ConsumeHandshakeNumber(ss, 1, &buffer, &buffer_len);
|
|
if (temp < 0) goto no_ticket;
|
|
parsed_session_ticket->ms_is_wrapped = (PRBool)temp;
|
|
|
|
temp = ssl3_ConsumeHandshakeNumber(ss, 1, &buffer, &buffer_len);
|
|
if (temp < 0) goto no_ticket;
|
|
parsed_session_ticket->exchKeyType = (SSL3KEAType)temp;
|
|
|
|
temp = ssl3_ConsumeHandshakeNumber(ss, 4, &buffer, &buffer_len);
|
|
if (temp < 0) goto no_ticket;
|
|
parsed_session_ticket->msWrapMech = (CK_MECHANISM_TYPE)temp;
|
|
|
|
temp = ssl3_ConsumeHandshakeNumber(ss, 2, &buffer, &buffer_len);
|
|
if (temp < 0) goto no_ticket;
|
|
parsed_session_ticket->ms_length = (PRUint16)temp;
|
|
if (parsed_session_ticket->ms_length == 0 || /* sanity check MS. */
|
|
parsed_session_ticket->ms_length >
|
|
sizeof(parsed_session_ticket->master_secret))
|
|
goto no_ticket;
|
|
|
|
/* Allow for the wrapped master secret to be longer. */
|
|
if (buffer_len < parsed_session_ticket->ms_length)
|
|
goto no_ticket;
|
|
PORT_Memcpy(parsed_session_ticket->master_secret, buffer,
|
|
parsed_session_ticket->ms_length);
|
|
buffer += parsed_session_ticket->ms_length;
|
|
buffer_len -= parsed_session_ticket->ms_length;
|
|
|
|
/* Read client_identity */
|
|
temp = ssl3_ConsumeHandshakeNumber(ss, 1, &buffer, &buffer_len);
|
|
if (temp < 0)
|
|
goto no_ticket;
|
|
parsed_session_ticket->client_identity.client_auth_type =
|
|
(ClientAuthenticationType)temp;
|
|
switch(parsed_session_ticket->client_identity.client_auth_type) {
|
|
case CLIENT_AUTH_ANONYMOUS:
|
|
break;
|
|
case CLIENT_AUTH_CERTIFICATE:
|
|
rv = ssl3_ConsumeHandshakeVariable(ss, &cert_item, 3,
|
|
&buffer, &buffer_len);
|
|
if (rv != SECSuccess) goto no_ticket;
|
|
rv = SECITEM_CopyItem(NULL, &parsed_session_ticket->peer_cert,
|
|
&cert_item);
|
|
if (rv != SECSuccess) goto no_ticket;
|
|
break;
|
|
default:
|
|
goto no_ticket;
|
|
}
|
|
/* Read timestamp. */
|
|
temp = ssl3_ConsumeHandshakeNumber(ss, 4, &buffer, &buffer_len);
|
|
if (temp < 0)
|
|
goto no_ticket;
|
|
parsed_session_ticket->timestamp = (PRUint32)temp;
|
|
|
|
/* Read server name */
|
|
nameType =
|
|
ssl3_ConsumeHandshakeNumber(ss, 1, &buffer, &buffer_len);
|
|
if (nameType != TLS_STE_NO_SERVER_NAME) {
|
|
SECItem name_item;
|
|
rv = ssl3_ConsumeHandshakeVariable(ss, &name_item, 2, &buffer,
|
|
&buffer_len);
|
|
if (rv != SECSuccess) goto no_ticket;
|
|
rv = SECITEM_CopyItem(NULL, &parsed_session_ticket->srvName,
|
|
&name_item);
|
|
if (rv != SECSuccess) goto no_ticket;
|
|
parsed_session_ticket->srvName.type = nameType;
|
|
}
|
|
|
|
/* Read extendedMasterSecretUsed */
|
|
temp = ssl3_ConsumeHandshakeNumber(ss, 1, &buffer, &buffer_len);
|
|
if (temp < 0)
|
|
goto no_ticket;
|
|
PORT_Assert(temp == PR_TRUE || temp == PR_FALSE);
|
|
parsed_session_ticket->extendedMasterSecretUsed = (PRBool)temp;
|
|
|
|
/* Done parsing. Check that all bytes have been consumed. */
|
|
if (buffer_len != padding_length)
|
|
goto no_ticket;
|
|
|
|
/* Use the ticket if it has not expired, otherwise free the allocated
|
|
* memory since the ticket is of no use.
|
|
*/
|
|
if (parsed_session_ticket->timestamp != 0 &&
|
|
parsed_session_ticket->timestamp +
|
|
TLS_EX_SESS_TICKET_LIFETIME_HINT > ssl_Time()) {
|
|
|
|
sid = ssl3_NewSessionID(ss, PR_TRUE);
|
|
if (sid == NULL) {
|
|
rv = SECFailure;
|
|
goto loser;
|
|
}
|
|
|
|
/* Copy over parameters. */
|
|
sid->version = parsed_session_ticket->ssl_version;
|
|
sid->u.ssl3.cipherSuite = parsed_session_ticket->cipher_suite;
|
|
sid->u.ssl3.compression = parsed_session_ticket->compression_method;
|
|
sid->authAlgorithm = parsed_session_ticket->authAlgorithm;
|
|
sid->authKeyBits = parsed_session_ticket->authKeyBits;
|
|
sid->keaType = parsed_session_ticket->keaType;
|
|
sid->keaKeyBits = parsed_session_ticket->keaKeyBits;
|
|
|
|
/* Copy master secret. */
|
|
#ifndef NO_PKCS11_BYPASS
|
|
if (ss->opt.bypassPKCS11 &&
|
|
parsed_session_ticket->ms_is_wrapped)
|
|
goto no_ticket;
|
|
#endif
|
|
if (parsed_session_ticket->ms_length >
|
|
sizeof(sid->u.ssl3.keys.wrapped_master_secret))
|
|
goto no_ticket;
|
|
PORT_Memcpy(sid->u.ssl3.keys.wrapped_master_secret,
|
|
parsed_session_ticket->master_secret,
|
|
parsed_session_ticket->ms_length);
|
|
sid->u.ssl3.keys.wrapped_master_secret_len =
|
|
parsed_session_ticket->ms_length;
|
|
sid->u.ssl3.exchKeyType = parsed_session_ticket->exchKeyType;
|
|
sid->u.ssl3.masterWrapMech = parsed_session_ticket->msWrapMech;
|
|
sid->u.ssl3.keys.msIsWrapped =
|
|
parsed_session_ticket->ms_is_wrapped;
|
|
sid->u.ssl3.masterValid = PR_TRUE;
|
|
sid->u.ssl3.keys.resumable = PR_TRUE;
|
|
sid->u.ssl3.keys.extendedMasterSecretUsed = parsed_session_ticket->
|
|
extendedMasterSecretUsed;
|
|
|
|
/* Copy over client cert from session ticket if there is one. */
|
|
if (parsed_session_ticket->peer_cert.data != NULL) {
|
|
if (sid->peerCert != NULL)
|
|
CERT_DestroyCertificate(sid->peerCert);
|
|
sid->peerCert = CERT_NewTempCertificate(ss->dbHandle,
|
|
&parsed_session_ticket->peer_cert, NULL, PR_FALSE, PR_TRUE);
|
|
if (sid->peerCert == NULL) {
|
|
rv = SECFailure;
|
|
goto loser;
|
|
}
|
|
}
|
|
if (parsed_session_ticket->srvName.data != NULL) {
|
|
sid->u.ssl3.srvName = parsed_session_ticket->srvName;
|
|
}
|
|
ss->statelessResume = PR_TRUE;
|
|
ss->sec.ci.sid = sid;
|
|
}
|
|
}
|
|
|
|
if (0) {
|
|
no_ticket:
|
|
SSL_DBG(("%d: SSL[%d]: Session ticket parsing failed.",
|
|
SSL_GETPID(), ss->fd));
|
|
ssl3stats = SSL_GetStatistics();
|
|
SSL_AtomicIncrementLong(& ssl3stats->hch_sid_ticket_parse_failures );
|
|
}
|
|
rv = SECSuccess;
|
|
|
|
loser:
|
|
/* ss->sec.ci.sid == sid if it did NOT come here via goto statement
|
|
* in that case do not free sid
|
|
*/
|
|
if (sid && (ss->sec.ci.sid != sid)) {
|
|
ssl_FreeSID(sid);
|
|
sid = NULL;
|
|
}
|
|
if (decrypted_state != NULL) {
|
|
SECITEM_FreeItem(decrypted_state, PR_TRUE);
|
|
decrypted_state = NULL;
|
|
}
|
|
|
|
if (parsed_session_ticket != NULL) {
|
|
if (parsed_session_ticket->peer_cert.data) {
|
|
SECITEM_FreeItem(&parsed_session_ticket->peer_cert, PR_FALSE);
|
|
}
|
|
PORT_ZFree(parsed_session_ticket, sizeof(SessionTicket));
|
|
}
|
|
|
|
return rv;
|
|
}
|
|
|
|
/*
|
|
* Read bytes. Using this function means the SECItem structure
|
|
* cannot be freed. The caller is expected to call this function
|
|
* on a shallow copy of the structure.
|
|
*/
|
|
static SECStatus
|
|
ssl3_ConsumeFromItem(SECItem *item, unsigned char **buf, PRUint32 bytes)
|
|
{
|
|
if (bytes > item->len)
|
|
return SECFailure;
|
|
|
|
*buf = item->data;
|
|
item->data += bytes;
|
|
item->len -= bytes;
|
|
return SECSuccess;
|
|
}
|
|
|
|
static SECStatus
|
|
ssl3_ParseEncryptedSessionTicket(sslSocket *ss, SECItem *data,
|
|
EncryptedSessionTicket *enc_session_ticket)
|
|
{
|
|
if (ssl3_ConsumeFromItem(data, &enc_session_ticket->key_name,
|
|
SESS_TICKET_KEY_NAME_LEN) != SECSuccess)
|
|
return SECFailure;
|
|
if (ssl3_ConsumeFromItem(data, &enc_session_ticket->iv,
|
|
AES_BLOCK_SIZE) != SECSuccess)
|
|
return SECFailure;
|
|
if (ssl3_ConsumeHandshakeVariable(ss, &enc_session_ticket->encrypted_state,
|
|
2, &data->data, &data->len) != SECSuccess)
|
|
return SECFailure;
|
|
if (ssl3_ConsumeFromItem(data, &enc_session_ticket->mac,
|
|
TLS_EX_SESS_TICKET_MAC_LENGTH) != SECSuccess)
|
|
return SECFailure;
|
|
if (data->len != 0) /* Make sure that we have consumed all bytes. */
|
|
return SECFailure;
|
|
|
|
return SECSuccess;
|
|
}
|
|
|
|
/* go through hello extensions in buffer "b".
|
|
* For each one, find the extension handler in the table, and
|
|
* if present, invoke that handler.
|
|
* Servers ignore any extensions with unknown extension types.
|
|
* Clients reject any extensions with unadvertised extension types.
|
|
*/
|
|
SECStatus
|
|
ssl3_HandleHelloExtensions(sslSocket *ss, SSL3Opaque **b, PRUint32 *length)
|
|
{
|
|
const ssl3HelloExtensionHandler * handlers;
|
|
|
|
if (ss->sec.isServer) {
|
|
handlers = clientHelloHandlers;
|
|
} else if (ss->version > SSL_LIBRARY_VERSION_3_0) {
|
|
handlers = serverHelloHandlersTLS;
|
|
} else {
|
|
handlers = serverHelloHandlersSSL3;
|
|
}
|
|
|
|
while (*length) {
|
|
const ssl3HelloExtensionHandler * handler;
|
|
SECStatus rv;
|
|
PRInt32 extension_type;
|
|
SECItem extension_data;
|
|
|
|
/* Get the extension's type field */
|
|
extension_type = ssl3_ConsumeHandshakeNumber(ss, 2, b, length);
|
|
if (extension_type < 0) /* failure to decode extension_type */
|
|
return SECFailure; /* alert already sent */
|
|
|
|
/* get the data for this extension, so we can pass it or skip it. */
|
|
rv = ssl3_ConsumeHandshakeVariable(ss, &extension_data, 2, b, length);
|
|
if (rv != SECSuccess)
|
|
return rv; /* alert already sent */
|
|
|
|
/* Check whether the server sent an extension which was not advertised
|
|
* in the ClientHello.
|
|
*/
|
|
if (!ss->sec.isServer &&
|
|
!ssl3_ClientExtensionAdvertised(ss, extension_type)) {
|
|
(void)SSL3_SendAlert(ss, alert_fatal, unsupported_extension);
|
|
return SECFailure;
|
|
}
|
|
|
|
/* Check whether an extension has been sent multiple times. */
|
|
if (ssl3_ExtensionNegotiated(ss, extension_type)) {
|
|
(void)SSL3_SendAlert(ss, alert_fatal, illegal_parameter);
|
|
return SECFailure;
|
|
}
|
|
|
|
/* find extension_type in table of Hello Extension Handlers */
|
|
for (handler = handlers; handler->ex_type >= 0; handler++) {
|
|
/* if found, call this handler */
|
|
if (handler->ex_type == extension_type) {
|
|
rv = (*handler->ex_handler)(ss, (PRUint16)extension_type,
|
|
&extension_data);
|
|
if (rv != SECSuccess) {
|
|
if (!ss->ssl3.fatalAlertSent) {
|
|
/* send a generic alert if the handler didn't already */
|
|
(void)SSL3_SendAlert(ss, alert_fatal, handshake_failure);
|
|
}
|
|
return SECFailure;
|
|
}
|
|
}
|
|
}
|
|
}
|
|
return SECSuccess;
|
|
}
|
|
|
|
/* Add a callback function to the table of senders of server hello extensions.
|
|
*/
|
|
SECStatus
|
|
ssl3_RegisterServerHelloExtensionSender(sslSocket *ss, PRUint16 ex_type,
|
|
ssl3HelloExtensionSenderFunc cb)
|
|
{
|
|
int i;
|
|
ssl3HelloExtensionSender *sender = &ss->xtnData.serverSenders[0];
|
|
|
|
for (i = 0; i < SSL_MAX_EXTENSIONS; ++i, ++sender) {
|
|
if (!sender->ex_sender) {
|
|
sender->ex_type = ex_type;
|
|
sender->ex_sender = cb;
|
|
return SECSuccess;
|
|
}
|
|
/* detect duplicate senders */
|
|
PORT_Assert(sender->ex_type != ex_type);
|
|
if (sender->ex_type == ex_type) {
|
|
/* duplicate */
|
|
break;
|
|
}
|
|
}
|
|
PORT_Assert(i < SSL_MAX_EXTENSIONS); /* table needs to grow */
|
|
PORT_SetError(SEC_ERROR_LIBRARY_FAILURE);
|
|
return SECFailure;
|
|
}
|
|
|
|
/* call each of the extension senders and return the accumulated length */
|
|
PRInt32
|
|
ssl3_CallHelloExtensionSenders(sslSocket *ss, PRBool append, PRUint32 maxBytes,
|
|
const ssl3HelloExtensionSender *sender)
|
|
{
|
|
PRInt32 total_exten_len = 0;
|
|
int i;
|
|
|
|
if (!sender) {
|
|
sender = ss->version > SSL_LIBRARY_VERSION_3_0 ?
|
|
&clientHelloSendersTLS[0] : &clientHelloSendersSSL3[0];
|
|
}
|
|
|
|
for (i = 0; i < SSL_MAX_EXTENSIONS; ++i, ++sender) {
|
|
if (sender->ex_sender) {
|
|
PRInt32 extLen = (*sender->ex_sender)(ss, append, maxBytes);
|
|
if (extLen < 0)
|
|
return -1;
|
|
maxBytes -= extLen;
|
|
total_exten_len += extLen;
|
|
}
|
|
}
|
|
return total_exten_len;
|
|
}
|
|
|
|
|
|
/* Extension format:
|
|
* Extension number: 2 bytes
|
|
* Extension length: 2 bytes
|
|
* Verify Data Length: 1 byte
|
|
* Verify Data (TLS): 12 bytes (client) or 24 bytes (server)
|
|
* Verify Data (SSL): 36 bytes (client) or 72 bytes (server)
|
|
*/
|
|
static PRInt32
|
|
ssl3_SendRenegotiationInfoXtn(
|
|
sslSocket * ss,
|
|
PRBool append,
|
|
PRUint32 maxBytes)
|
|
{
|
|
PRInt32 len, needed;
|
|
|
|
/* In draft-ietf-tls-renegotiation-03, it is NOT RECOMMENDED to send
|
|
* both the SCSV and the empty RI, so when we send SCSV in
|
|
* the initial handshake, we don't also send RI.
|
|
*/
|
|
if (!ss || ss->ssl3.hs.sendingSCSV)
|
|
return 0;
|
|
len = !ss->firstHsDone ? 0 :
|
|
(ss->sec.isServer ? ss->ssl3.hs.finishedBytes * 2
|
|
: ss->ssl3.hs.finishedBytes);
|
|
needed = 5 + len;
|
|
if (maxBytes < (PRUint32)needed) {
|
|
return 0;
|
|
}
|
|
if (append) {
|
|
SECStatus rv;
|
|
/* extension_type */
|
|
rv = ssl3_AppendHandshakeNumber(ss, ssl_renegotiation_info_xtn, 2);
|
|
if (rv != SECSuccess) return -1;
|
|
/* length of extension_data */
|
|
rv = ssl3_AppendHandshakeNumber(ss, len + 1, 2);
|
|
if (rv != SECSuccess) return -1;
|
|
/* verify_Data from previous Finished message(s) */
|
|
rv = ssl3_AppendHandshakeVariable(ss,
|
|
ss->ssl3.hs.finishedMsgs.data, len, 1);
|
|
if (rv != SECSuccess) return -1;
|
|
if (!ss->sec.isServer) {
|
|
TLSExtensionData *xtnData = &ss->xtnData;
|
|
xtnData->advertised[xtnData->numAdvertised++] =
|
|
ssl_renegotiation_info_xtn;
|
|
}
|
|
}
|
|
return needed;
|
|
}
|
|
|
|
static SECStatus
|
|
ssl3_ServerHandleStatusRequestXtn(sslSocket *ss, PRUint16 ex_type,
|
|
SECItem *data)
|
|
{
|
|
SECStatus rv = SECSuccess;
|
|
|
|
/* remember that we got this extension. */
|
|
ss->xtnData.negotiated[ss->xtnData.numNegotiated++] = ex_type;
|
|
PORT_Assert(ss->sec.isServer);
|
|
/* prepare to send back the appropriate response */
|
|
rv = ssl3_RegisterServerHelloExtensionSender(ss, ex_type,
|
|
ssl3_ServerSendStatusRequestXtn);
|
|
return rv;
|
|
}
|
|
|
|
/* This function runs in both the client and server. */
|
|
static SECStatus
|
|
ssl3_HandleRenegotiationInfoXtn(sslSocket *ss, PRUint16 ex_type, SECItem *data)
|
|
{
|
|
SECStatus rv = SECSuccess;
|
|
PRUint32 len = 0;
|
|
|
|
if (ss->firstHsDone) {
|
|
len = ss->sec.isServer ? ss->ssl3.hs.finishedBytes
|
|
: ss->ssl3.hs.finishedBytes * 2;
|
|
}
|
|
if (data->len != 1 + len || data->data[0] != len ) {
|
|
(void)ssl3_DecodeError(ss);
|
|
return SECFailure;
|
|
}
|
|
if (len && NSS_SecureMemcmp(ss->ssl3.hs.finishedMsgs.data,
|
|
data->data + 1, len)) {
|
|
(void)SSL3_SendAlert(ss, alert_fatal, handshake_failure);
|
|
PORT_SetError(SSL_ERROR_BAD_HANDSHAKE_HASH_VALUE);
|
|
return SECFailure;
|
|
}
|
|
/* remember that we got this extension and it was correct. */
|
|
ss->peerRequestedProtection = 1;
|
|
ss->xtnData.negotiated[ss->xtnData.numNegotiated++] = ex_type;
|
|
if (ss->sec.isServer) {
|
|
/* prepare to send back the appropriate response */
|
|
rv = ssl3_RegisterServerHelloExtensionSender(ss, ex_type,
|
|
ssl3_SendRenegotiationInfoXtn);
|
|
}
|
|
return rv;
|
|
}
|
|
|
|
static PRInt32
|
|
ssl3_ClientSendUseSRTPXtn(sslSocket *ss, PRBool append, PRUint32 maxBytes)
|
|
{
|
|
PRUint32 ext_data_len;
|
|
PRInt16 i;
|
|
SECStatus rv;
|
|
|
|
if (!ss)
|
|
return 0;
|
|
|
|
if (!IS_DTLS(ss) || !ss->ssl3.dtlsSRTPCipherCount)
|
|
return 0; /* Not relevant */
|
|
|
|
ext_data_len = 2 + 2 * ss->ssl3.dtlsSRTPCipherCount + 1;
|
|
|
|
if (append && maxBytes >= 4 + ext_data_len) {
|
|
/* Extension type */
|
|
rv = ssl3_AppendHandshakeNumber(ss, ssl_use_srtp_xtn, 2);
|
|
if (rv != SECSuccess) return -1;
|
|
/* Length of extension data */
|
|
rv = ssl3_AppendHandshakeNumber(ss, ext_data_len, 2);
|
|
if (rv != SECSuccess) return -1;
|
|
/* Length of the SRTP cipher list */
|
|
rv = ssl3_AppendHandshakeNumber(ss,
|
|
2 * ss->ssl3.dtlsSRTPCipherCount,
|
|
2);
|
|
if (rv != SECSuccess) return -1;
|
|
/* The SRTP ciphers */
|
|
for (i = 0; i < ss->ssl3.dtlsSRTPCipherCount; i++) {
|
|
rv = ssl3_AppendHandshakeNumber(ss,
|
|
ss->ssl3.dtlsSRTPCiphers[i],
|
|
2);
|
|
}
|
|
/* Empty MKI value */
|
|
ssl3_AppendHandshakeVariable(ss, NULL, 0, 1);
|
|
|
|
ss->xtnData.advertised[ss->xtnData.numAdvertised++] =
|
|
ssl_use_srtp_xtn;
|
|
}
|
|
|
|
return 4 + ext_data_len;
|
|
}
|
|
|
|
static PRInt32
|
|
ssl3_ServerSendUseSRTPXtn(sslSocket *ss, PRBool append, PRUint32 maxBytes)
|
|
{
|
|
SECStatus rv;
|
|
|
|
/* Server side */
|
|
if (!append || maxBytes < 9) {
|
|
return 9;
|
|
}
|
|
|
|
/* Extension type */
|
|
rv = ssl3_AppendHandshakeNumber(ss, ssl_use_srtp_xtn, 2);
|
|
if (rv != SECSuccess) return -1;
|
|
/* Length of extension data */
|
|
rv = ssl3_AppendHandshakeNumber(ss, 5, 2);
|
|
if (rv != SECSuccess) return -1;
|
|
/* Length of the SRTP cipher list */
|
|
rv = ssl3_AppendHandshakeNumber(ss, 2, 2);
|
|
if (rv != SECSuccess) return -1;
|
|
/* The selected cipher */
|
|
rv = ssl3_AppendHandshakeNumber(ss, ss->ssl3.dtlsSRTPCipherSuite, 2);
|
|
if (rv != SECSuccess) return -1;
|
|
/* Empty MKI value */
|
|
ssl3_AppendHandshakeVariable(ss, NULL, 0, 1);
|
|
|
|
return 9;
|
|
}
|
|
|
|
static SECStatus
|
|
ssl3_ClientHandleUseSRTPXtn(sslSocket * ss, PRUint16 ex_type, SECItem *data)
|
|
{
|
|
SECStatus rv;
|
|
SECItem ciphers = {siBuffer, NULL, 0};
|
|
PRUint16 i;
|
|
PRUint16 cipher = 0;
|
|
PRBool found = PR_FALSE;
|
|
SECItem litem;
|
|
|
|
if (!data->data || !data->len) {
|
|
(void)ssl3_DecodeError(ss);
|
|
return SECFailure;
|
|
}
|
|
|
|
/* Get the cipher list */
|
|
rv = ssl3_ConsumeHandshakeVariable(ss, &ciphers, 2,
|
|
&data->data, &data->len);
|
|
if (rv != SECSuccess) {
|
|
return SECFailure; /* fatal alert already sent */
|
|
}
|
|
/* Now check that the server has picked just 1 (i.e., len = 2) */
|
|
if (ciphers.len != 2) {
|
|
(void)ssl3_DecodeError(ss);
|
|
return SECFailure;
|
|
}
|
|
|
|
/* Get the selected cipher */
|
|
cipher = (ciphers.data[0] << 8) | ciphers.data[1];
|
|
|
|
/* Now check that this is one of the ciphers we offered */
|
|
for (i = 0; i < ss->ssl3.dtlsSRTPCipherCount; i++) {
|
|
if (cipher == ss->ssl3.dtlsSRTPCiphers[i]) {
|
|
found = PR_TRUE;
|
|
break;
|
|
}
|
|
}
|
|
|
|
if (!found) {
|
|
(void)SSL3_SendAlert(ss, alert_fatal, illegal_parameter);
|
|
PORT_SetError(SSL_ERROR_RX_MALFORMED_SERVER_HELLO);
|
|
return SECFailure;
|
|
}
|
|
|
|
/* Get the srtp_mki value */
|
|
rv = ssl3_ConsumeHandshakeVariable(ss, &litem, 1,
|
|
&data->data, &data->len);
|
|
if (rv != SECSuccess) {
|
|
return SECFailure; /* alert already sent */
|
|
}
|
|
|
|
/* We didn't offer an MKI, so this must be 0 length */
|
|
if (litem.len != 0) {
|
|
(void)SSL3_SendAlert(ss, alert_fatal, illegal_parameter);
|
|
PORT_SetError(SSL_ERROR_RX_MALFORMED_SERVER_HELLO);
|
|
return SECFailure;
|
|
}
|
|
|
|
/* extra trailing bytes */
|
|
if (data->len != 0) {
|
|
(void)ssl3_DecodeError(ss);
|
|
return SECFailure;
|
|
}
|
|
|
|
/* OK, this looks fine. */
|
|
ss->xtnData.negotiated[ss->xtnData.numNegotiated++] = ssl_use_srtp_xtn;
|
|
ss->ssl3.dtlsSRTPCipherSuite = cipher;
|
|
return SECSuccess;
|
|
}
|
|
|
|
static SECStatus
|
|
ssl3_ServerHandleUseSRTPXtn(sslSocket * ss, PRUint16 ex_type, SECItem *data)
|
|
{
|
|
SECStatus rv;
|
|
SECItem ciphers = {siBuffer, NULL, 0};
|
|
PRUint16 i;
|
|
unsigned int j;
|
|
PRUint16 cipher = 0;
|
|
PRBool found = PR_FALSE;
|
|
SECItem litem;
|
|
|
|
if (!IS_DTLS(ss) || !ss->ssl3.dtlsSRTPCipherCount) {
|
|
/* Ignore the extension if we aren't doing DTLS or no DTLS-SRTP
|
|
* preferences have been set. */
|
|
return SECSuccess;
|
|
}
|
|
|
|
if (!data->data || data->len < 5) {
|
|
(void)ssl3_DecodeError(ss);
|
|
return SECFailure;
|
|
}
|
|
|
|
/* Get the cipher list */
|
|
rv = ssl3_ConsumeHandshakeVariable(ss, &ciphers, 2,
|
|
&data->data, &data->len);
|
|
if (rv != SECSuccess) {
|
|
return SECFailure; /* alert already sent */
|
|
}
|
|
/* Check that the list is even length */
|
|
if (ciphers.len % 2) {
|
|
(void)ssl3_DecodeError(ss);
|
|
return SECFailure;
|
|
}
|
|
|
|
/* Walk through the offered list and pick the most preferred of our
|
|
* ciphers, if any */
|
|
for (i = 0; !found && i < ss->ssl3.dtlsSRTPCipherCount; i++) {
|
|
for (j = 0; j + 1 < ciphers.len; j += 2) {
|
|
cipher = (ciphers.data[j] << 8) | ciphers.data[j + 1];
|
|
if (cipher == ss->ssl3.dtlsSRTPCiphers[i]) {
|
|
found = PR_TRUE;
|
|
break;
|
|
}
|
|
}
|
|
}
|
|
|
|
/* Get the srtp_mki value */
|
|
rv = ssl3_ConsumeHandshakeVariable(ss, &litem, 1, &data->data, &data->len);
|
|
if (rv != SECSuccess) {
|
|
return SECFailure;
|
|
}
|
|
|
|
if (data->len != 0) {
|
|
(void)ssl3_DecodeError(ss); /* trailing bytes */
|
|
return SECFailure;
|
|
}
|
|
|
|
/* Now figure out what to do */
|
|
if (!found) {
|
|
/* No matching ciphers, pretend we don't support use_srtp */
|
|
return SECSuccess;
|
|
}
|
|
|
|
/* OK, we have a valid cipher and we've selected it */
|
|
ss->ssl3.dtlsSRTPCipherSuite = cipher;
|
|
ss->xtnData.negotiated[ss->xtnData.numNegotiated++] = ssl_use_srtp_xtn;
|
|
|
|
return ssl3_RegisterServerHelloExtensionSender(ss, ssl_use_srtp_xtn,
|
|
ssl3_ServerSendUseSRTPXtn);
|
|
}
|
|
|
|
/* ssl3_ServerHandleSigAlgsXtn handles the signature_algorithms extension
|
|
* from a client.
|
|
* See https://tools.ietf.org/html/rfc5246#section-7.4.1.4.1 */
|
|
static SECStatus
|
|
ssl3_ServerHandleSigAlgsXtn(sslSocket * ss, PRUint16 ex_type, SECItem *data)
|
|
{
|
|
SECStatus rv;
|
|
SECItem algorithms;
|
|
const unsigned char *b;
|
|
unsigned int numAlgorithms, i;
|
|
|
|
/* Ignore this extension if we aren't doing TLS 1.2 or greater. */
|
|
if (ss->version < SSL_LIBRARY_VERSION_TLS_1_2) {
|
|
return SECSuccess;
|
|
}
|
|
|
|
rv = ssl3_ConsumeHandshakeVariable(ss, &algorithms, 2, &data->data,
|
|
&data->len);
|
|
if (rv != SECSuccess) {
|
|
return SECFailure;
|
|
}
|
|
/* Trailing data, empty value, or odd-length value is invalid. */
|
|
if (data->len != 0 || algorithms.len == 0 || (algorithms.len & 1) != 0) {
|
|
(void)SSL3_SendAlert(ss, alert_fatal, decode_error);
|
|
PORT_SetError(SSL_ERROR_RX_MALFORMED_CLIENT_HELLO);
|
|
return SECFailure;
|
|
}
|
|
|
|
numAlgorithms = algorithms.len/2;
|
|
|
|
/* We don't care to process excessive numbers of algorithms. */
|
|
if (numAlgorithms > 512) {
|
|
numAlgorithms = 512;
|
|
}
|
|
|
|
ss->ssl3.hs.clientSigAndHash =
|
|
PORT_NewArray(SSLSignatureAndHashAlg, numAlgorithms);
|
|
if (!ss->ssl3.hs.clientSigAndHash) {
|
|
(void)SSL3_SendAlert(ss, alert_fatal, internal_error);
|
|
PORT_SetError(SSL_ERROR_RX_MALFORMED_CLIENT_HELLO);
|
|
return SECFailure;
|
|
}
|
|
ss->ssl3.hs.numClientSigAndHash = 0;
|
|
|
|
b = algorithms.data;
|
|
ss->ssl3.hs.numClientSigAndHash = 0;
|
|
for (i = 0; i < numAlgorithms; i++) {
|
|
SSLSignatureAndHashAlg *sigAndHash =
|
|
&ss->ssl3.hs.clientSigAndHash[ss->ssl3.hs.numClientSigAndHash];
|
|
sigAndHash->hashAlg = (SSLHashType)*(b++);
|
|
sigAndHash->sigAlg = (SSLSignType)*(b++);
|
|
if (ssl3_IsSupportedSignatureAlgorithm(sigAndHash)) {
|
|
++ss->ssl3.hs.numClientSigAndHash;
|
|
}
|
|
}
|
|
|
|
if (!ss->ssl3.hs.numClientSigAndHash) {
|
|
/* We didn't understand any of the client's requested signature
|
|
* formats. We'll use the defaults. */
|
|
PORT_Free(ss->ssl3.hs.clientSigAndHash);
|
|
ss->ssl3.hs.clientSigAndHash = NULL;
|
|
}
|
|
|
|
/* Keep track of negotiated extensions. */
|
|
ss->xtnData.negotiated[ss->xtnData.numNegotiated++] = ex_type;
|
|
return SECSuccess;
|
|
}
|
|
|
|
/* ssl3_ClientSendSigAlgsXtn sends the signature_algorithm extension for TLS
|
|
* 1.2 ClientHellos. */
|
|
static PRInt32
|
|
ssl3_ClientSendSigAlgsXtn(sslSocket *ss, PRBool append, PRUint32 maxBytes)
|
|
{
|
|
PRInt32 extension_length;
|
|
unsigned int i;
|
|
PRInt32 pos=0;
|
|
PRUint32 policy;
|
|
PRUint8 buf[MAX_SIGNATURE_ALGORITHMS * 2];
|
|
|
|
if (ss->version < SSL_LIBRARY_VERSION_TLS_1_2) {
|
|
return 0;
|
|
}
|
|
|
|
for (i=0; i < ss->ssl3.signatureAlgorithmCount; i++) {
|
|
SECOidTag hashOID = ssl3_TLSHashAlgorithmToOID(
|
|
ss->ssl3.signatureAlgorithms[i].hashAlg);
|
|
if ((NSS_GetAlgorithmPolicy(hashOID, & policy) != SECSuccess) ||
|
|
(policy & NSS_USE_ALG_IN_SSL_KX)) {
|
|
buf[pos++] = ss->ssl3.signatureAlgorithms[i].hashAlg;
|
|
buf[pos++] = ss->ssl3.signatureAlgorithms[i].sigAlg;
|
|
}
|
|
}
|
|
|
|
extension_length =
|
|
2 /* extension type */ +
|
|
2 /* extension length */ +
|
|
2 /* supported_signature_algorithms length */ +
|
|
pos;
|
|
|
|
if (maxBytes < extension_length) {
|
|
PORT_Assert(0);
|
|
return 0;
|
|
}
|
|
|
|
if (append) {
|
|
SECStatus rv;
|
|
rv = ssl3_AppendHandshakeNumber(ss, ssl_signature_algorithms_xtn, 2);
|
|
if (rv != SECSuccess) {
|
|
return -1;
|
|
}
|
|
rv = ssl3_AppendHandshakeNumber(ss, extension_length - 4, 2);
|
|
if (rv != SECSuccess) {
|
|
return -1;
|
|
}
|
|
|
|
rv = ssl3_AppendHandshakeVariable(ss, buf, extension_length - 6, 2);
|
|
if (rv != SECSuccess) {
|
|
return -1;
|
|
}
|
|
|
|
ss->xtnData.advertised[ss->xtnData.numAdvertised++] =
|
|
ssl_signature_algorithms_xtn;
|
|
}
|
|
|
|
return extension_length;
|
|
}
|
|
|
|
unsigned int
|
|
ssl3_CalculatePaddingExtensionLength(unsigned int clientHelloLength)
|
|
{
|
|
unsigned int recordLength = 1 /* handshake message type */ +
|
|
3 /* handshake message length */ +
|
|
clientHelloLength;
|
|
unsigned int extensionLength;
|
|
|
|
if (recordLength < 256 || recordLength >= 512) {
|
|
return 0;
|
|
}
|
|
|
|
extensionLength = 512 - recordLength;
|
|
/* Extensions take at least four bytes to encode. */
|
|
if (extensionLength < 4) {
|
|
extensionLength = 4;
|
|
}
|
|
|
|
return extensionLength;
|
|
}
|
|
|
|
/* ssl3_AppendPaddingExtension possibly adds an extension which ensures that a
|
|
* ClientHello record is either < 256 bytes or is >= 512 bytes. This ensures
|
|
* that we don't trigger bugs in F5 products. */
|
|
PRInt32
|
|
ssl3_AppendPaddingExtension(sslSocket *ss, unsigned int extensionLen,
|
|
PRUint32 maxBytes)
|
|
{
|
|
unsigned int paddingLen = extensionLen - 4;
|
|
static unsigned char padding[256];
|
|
|
|
if (extensionLen == 0) {
|
|
return 0;
|
|
}
|
|
|
|
if (extensionLen < 4 ||
|
|
extensionLen > maxBytes ||
|
|
paddingLen > sizeof(padding)) {
|
|
PORT_Assert(0);
|
|
return -1;
|
|
}
|
|
|
|
if (SECSuccess != ssl3_AppendHandshakeNumber(ss, ssl_padding_xtn, 2))
|
|
return -1;
|
|
if (SECSuccess != ssl3_AppendHandshakeNumber(ss, paddingLen, 2))
|
|
return -1;
|
|
if (SECSuccess != ssl3_AppendHandshake(ss, padding, paddingLen))
|
|
return -1;
|
|
|
|
return extensionLen;
|
|
}
|
|
|
|
/* ssl3_ClientSendDraftVersionXtn sends the TLS 1.3 temporary draft
|
|
* version extension.
|
|
* TODO(ekr@rtfm.com): Remove when TLS 1.3 is published. */
|
|
static PRInt32
|
|
ssl3_ClientSendDraftVersionXtn(sslSocket * ss, PRBool append, PRUint32 maxBytes)
|
|
{
|
|
PRInt32 extension_length;
|
|
|
|
if (ss->version != SSL_LIBRARY_VERSION_TLS_1_3) {
|
|
return 0;
|
|
}
|
|
|
|
extension_length = 6; /* Type + length + number */
|
|
if (maxBytes < (PRUint32)extension_length) {
|
|
PORT_Assert(0);
|
|
return 0;
|
|
}
|
|
if (append) {
|
|
SECStatus rv;
|
|
rv = ssl3_AppendHandshakeNumber(ss, ssl_tls13_draft_version_xtn, 2);
|
|
if (rv != SECSuccess)
|
|
goto loser;
|
|
rv = ssl3_AppendHandshakeNumber(ss, extension_length - 4, 2);
|
|
if (rv != SECSuccess)
|
|
goto loser;
|
|
rv = ssl3_AppendHandshakeNumber(ss, TLS_1_3_DRAFT_VERSION, 2);
|
|
if (rv != SECSuccess)
|
|
goto loser;
|
|
ss->xtnData.advertised[ss->xtnData.numAdvertised++] =
|
|
ssl_tls13_draft_version_xtn;
|
|
}
|
|
|
|
return extension_length;
|
|
|
|
loser:
|
|
return -1;
|
|
}
|
|
|
|
/* ssl3_ServerHandleDraftVersionXtn handles the TLS 1.3 temporary draft
|
|
* version extension.
|
|
* TODO(ekr@rtfm.com): Remove when TLS 1.3 is published. */
|
|
static SECStatus
|
|
ssl3_ServerHandleDraftVersionXtn(sslSocket * ss, PRUint16 ex_type,
|
|
SECItem *data)
|
|
{
|
|
PRInt32 draft_version;
|
|
|
|
/* Ignore this extension if we aren't doing TLS 1.3 */
|
|
if (ss->version != SSL_LIBRARY_VERSION_TLS_1_3) {
|
|
return SECSuccess;
|
|
}
|
|
|
|
if (data->len != 2) {
|
|
(void)ssl3_DecodeError(ss);
|
|
return SECFailure;
|
|
}
|
|
|
|
/* Get the draft version out of the handshake */
|
|
draft_version = ssl3_ConsumeHandshakeNumber(ss, 2,
|
|
&data->data, &data->len);
|
|
if (draft_version < 0) {
|
|
return SECFailure;
|
|
}
|
|
|
|
/* Keep track of negotiated extensions. */
|
|
ss->xtnData.negotiated[ss->xtnData.numNegotiated++] = ex_type;
|
|
|
|
if (draft_version != TLS_1_3_DRAFT_VERSION) {
|
|
/*
|
|
* Incompatible/broken TLS 1.3 implementation. Fall back to TLS 1.2.
|
|
* TODO(ekr@rtfm.com): It's not entirely clear it's safe to roll back
|
|
* here. Need to double-check.
|
|
*/
|
|
SSL_TRC(30, ("%d: SSL3[%d]: Incompatible version of TLS 1.3 (%d), "
|
|
"expected %d",
|
|
SSL_GETPID(), ss->fd, draft_version, TLS_1_3_DRAFT_VERSION));
|
|
ss->version = SSL_LIBRARY_VERSION_TLS_1_2;
|
|
}
|
|
|
|
return SECSuccess;
|
|
}
|
|
|
|
static PRInt32
|
|
ssl3_SendExtendedMasterSecretXtn(sslSocket * ss, PRBool append,
|
|
PRUint32 maxBytes)
|
|
{
|
|
PRInt32 extension_length;
|
|
|
|
if (!ss->opt.enableExtendedMS) {
|
|
return 0;
|
|
}
|
|
|
|
#ifndef NO_PKCS11_BYPASS
|
|
/* Extended MS can only be used w/o bypass mode */
|
|
if (ss->opt.bypassPKCS11) {
|
|
PORT_Assert(0);
|
|
PORT_SetError(PR_NOT_IMPLEMENTED_ERROR);
|
|
return -1;
|
|
}
|
|
#endif
|
|
|
|
/* Always send the extension in this function, since the
|
|
* client always sends it and this function is only called on
|
|
* the server if we negotiated the extension. */
|
|
extension_length = 4; /* Type + length (0) */
|
|
if (maxBytes < extension_length) {
|
|
PORT_Assert(0);
|
|
return 0;
|
|
}
|
|
|
|
if (append) {
|
|
SECStatus rv;
|
|
rv = ssl3_AppendHandshakeNumber(ss, ssl_extended_master_secret_xtn, 2);
|
|
if (rv != SECSuccess)
|
|
goto loser;
|
|
rv = ssl3_AppendHandshakeNumber(ss, 0, 2);
|
|
if (rv != SECSuccess)
|
|
goto loser;
|
|
ss->xtnData.advertised[ss->xtnData.numAdvertised++] =
|
|
ssl_extended_master_secret_xtn;
|
|
}
|
|
|
|
return extension_length;
|
|
|
|
loser:
|
|
return -1;
|
|
}
|
|
|
|
|
|
static SECStatus
|
|
ssl3_HandleExtendedMasterSecretXtn(sslSocket * ss, PRUint16 ex_type,
|
|
SECItem *data)
|
|
{
|
|
if (ss->version < SSL_LIBRARY_VERSION_TLS_1_0) {
|
|
return SECSuccess;
|
|
}
|
|
|
|
if (!ss->opt.enableExtendedMS) {
|
|
return SECSuccess;
|
|
}
|
|
|
|
#ifndef NO_PKCS11_BYPASS
|
|
/* Extended MS can only be used w/o bypass mode */
|
|
if (ss->opt.bypassPKCS11) {
|
|
PORT_Assert(0);
|
|
PORT_SetError(PR_NOT_IMPLEMENTED_ERROR);
|
|
return SECFailure;
|
|
}
|
|
#endif
|
|
|
|
if (data->len != 0) {
|
|
SSL_TRC(30, ("%d: SSL3[%d]: Bogus extended master secret extension",
|
|
SSL_GETPID(), ss->fd));
|
|
return SECFailure;
|
|
}
|
|
|
|
SSL_DBG(("%d: SSL[%d]: Negotiated extended master secret extension.",
|
|
SSL_GETPID(), ss->fd));
|
|
|
|
/* Keep track of negotiated extensions. */
|
|
ss->xtnData.negotiated[ss->xtnData.numNegotiated++] = ex_type;
|
|
|
|
if (ss->sec.isServer) {
|
|
return ssl3_RegisterServerHelloExtensionSender(
|
|
ss, ex_type, ssl3_SendExtendedMasterSecretXtn);
|
|
}
|
|
return SECSuccess;
|
|
}
|