1/* Copyright (c) 2018, Google Inc.
2 *
3 * Permission to use, copy, modify, and/or distribute this software for any
4 * purpose with or without fee is hereby granted, provided that the above
5 * copyright notice and this permission notice appear in all copies.
6 *
7 * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
8 * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
9 * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY
10 * SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
11 * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION
12 * OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN
13 * CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE. */
14
15#include <openssl/ssl.h>
16
17#include <openssl/bytestring.h>
18
19#include "internal.h"
20
21
22namespace bssl {
23
24constexpr int kHandoffVersion = 0;
25constexpr int kHandbackVersion = 0;
26
27bool SSL_serialize_handoff(const SSL *ssl, CBB *out) {
28  const SSL3_STATE *const s3 = ssl->s3;
29  if (!ssl->server ||
30      s3->hs == nullptr ||
31      s3->rwstate != SSL_HANDOFF) {
32    return false;
33  }
34
35  CBB seq;
36  Span<const uint8_t> transcript = s3->hs->transcript.buffer();
37  if (!CBB_add_asn1(out, &seq, CBS_ASN1_SEQUENCE) ||
38      !CBB_add_asn1_uint64(&seq, kHandoffVersion) ||
39      !CBB_add_asn1_octet_string(&seq, transcript.data(), transcript.size()) ||
40      !CBB_add_asn1_octet_string(&seq,
41                                 reinterpret_cast<uint8_t *>(s3->hs_buf->data),
42                                 s3->hs_buf->length) ||
43      !CBB_flush(out)) {
44    return false;
45  }
46
47  return true;
48}
49
50bool SSL_decline_handoff(SSL *ssl) {
51  const SSL3_STATE *const s3 = ssl->s3;
52  if (!ssl->server ||
53      s3->hs == nullptr ||
54      s3->rwstate != SSL_HANDOFF) {
55    return false;
56  }
57
58  ssl->handoff = false;
59  return true;
60}
61
62bool SSL_apply_handoff(SSL *ssl, Span<const uint8_t> handoff) {
63  if (ssl->method->is_dtls) {
64    return false;
65  }
66
67  CBS seq, handoff_cbs(handoff);
68  uint64_t handoff_version;
69  if (!CBS_get_asn1(&handoff_cbs, &seq, CBS_ASN1_SEQUENCE) ||
70      !CBS_get_asn1_uint64(&seq, &handoff_version) ||
71      handoff_version != kHandoffVersion) {
72    return false;
73  }
74
75  CBS transcript, hs_buf;
76  if (!CBS_get_asn1(&seq, &transcript, CBS_ASN1_OCTETSTRING) ||
77      !CBS_get_asn1(&seq, &hs_buf, CBS_ASN1_OCTETSTRING)) {
78    return false;
79  }
80
81  SSL_set_accept_state(ssl);
82
83  SSL3_STATE *const s3 = ssl->s3;
84  s3->v2_hello_done = true;
85  s3->has_message = true;
86
87  s3->hs_buf.reset(BUF_MEM_new());
88  if (!s3->hs_buf ||
89      !BUF_MEM_append(s3->hs_buf.get(), CBS_data(&hs_buf), CBS_len(&hs_buf))) {
90    return false;
91  }
92
93  if (CBS_len(&transcript) != 0) {
94    s3->hs->transcript.Update(transcript);
95    s3->is_v2_hello = true;
96    ssl_do_msg_callback(ssl, 0 /* read */, 0 /* V2ClientHello */, transcript);
97  }
98
99  return true;
100}
101
102bool SSL_serialize_handback(const SSL *ssl, CBB *out) {
103  if (!ssl->server ||
104      !ssl->s3->initial_handshake_complete ||
105      ssl->method->is_dtls ||
106      ssl->version < TLS1_VERSION) {
107    return false;
108  }
109
110  const SSL3_STATE *const s3 = ssl->s3;
111  size_t hostname_len = 0;
112  if (s3->hostname) {
113    hostname_len = strlen(s3->hostname.get());
114  }
115
116  size_t iv_len = 0;
117  const uint8_t *read_iv = nullptr, *write_iv = nullptr;
118  if (ssl->version == TLS1_VERSION &&
119      SSL_CIPHER_is_block_cipher(s3->aead_read_ctx->cipher()) &&
120      (!s3->aead_read_ctx->GetIV(&read_iv, &iv_len) ||
121       !s3->aead_write_ctx->GetIV(&write_iv, &iv_len))) {
122    return false;
123  }
124
125  CBB seq;
126  if (!CBB_add_asn1(out, &seq, CBS_ASN1_SEQUENCE) ||
127      !CBB_add_asn1_uint64(&seq, kHandbackVersion) ||
128      !CBB_add_asn1_uint64(&seq, ssl->version) ||
129      !CBB_add_asn1_uint64(&seq, ssl->conf_max_version) ||
130      !CBB_add_asn1_uint64(&seq, ssl->conf_min_version) ||
131      !CBB_add_asn1_uint64(&seq, ssl->max_send_fragment) ||
132      !CBB_add_asn1_octet_string(&seq, s3->read_sequence,
133                                 sizeof(s3->read_sequence)) ||
134      !CBB_add_asn1_octet_string(&seq, s3->write_sequence,
135                                 sizeof(s3->write_sequence)) ||
136      !CBB_add_asn1_octet_string(&seq, s3->server_random,
137                                 sizeof(s3->server_random)) ||
138      !CBB_add_asn1_octet_string(&seq, s3->client_random,
139                                 sizeof(s3->client_random)) ||
140      !CBB_add_asn1_octet_string(&seq, read_iv, iv_len) ||
141      !CBB_add_asn1_octet_string(&seq, write_iv, iv_len) ||
142      !CBB_add_asn1_bool(&seq, s3->session_reused) ||
143      !CBB_add_asn1_bool(&seq, s3->send_connection_binding) ||
144      !CBB_add_asn1_bool(&seq, s3->tlsext_channel_id_valid) ||
145      !ssl_session_serialize(s3->established_session.get(), &seq) ||
146      !CBB_add_asn1_octet_string(&seq, s3->next_proto_negotiated.data(),
147                                 s3->next_proto_negotiated.size()) ||
148      !CBB_add_asn1_octet_string(&seq, s3->alpn_selected.data(),
149                                 s3->alpn_selected.size()) ||
150      !CBB_add_asn1_octet_string(
151          &seq, reinterpret_cast<uint8_t *>(s3->hostname.get()),
152          hostname_len) ||
153      !CBB_add_asn1_octet_string(&seq, s3->tlsext_channel_id,
154                                 sizeof(s3->tlsext_channel_id)) ||
155      !CBB_add_asn1_uint64(&seq, ssl->options) ||
156      !CBB_add_asn1_uint64(&seq, ssl->mode) ||
157      !CBB_add_asn1_uint64(&seq, ssl->max_cert_list) ||
158      !CBB_add_asn1_bool(&seq, ssl->quiet_shutdown) ||
159      !CBB_add_asn1_bool(&seq, ssl->tlsext_channel_id_enabled) ||
160      !CBB_add_asn1_bool(&seq, ssl->retain_only_sha256_of_client_certs) ||
161      !CBB_flush(out)) {
162    return false;
163  }
164
165  return true;
166}
167
168bool SSL_apply_handback(SSL *ssl, Span<const uint8_t> handback) {
169  if (ssl->do_handshake != nullptr ||
170      ssl->method->is_dtls) {
171    return false;
172  }
173
174  SSL3_STATE *const s3 = ssl->s3;
175  uint64_t handback_version, version, conf_max_version, conf_min_version,
176      max_send_fragment, options, mode, max_cert_list;
177  CBS seq, read_seq, write_seq, server_rand, client_rand, read_iv, write_iv,
178      next_proto, alpn, hostname, channel_id;
179  int session_reused, send_connection_binding, channel_id_valid,
180      quiet_shutdown, channel_id_enabled, retain_only_sha256;
181
182  CBS handback_cbs(handback);
183  if (!CBS_get_asn1(&handback_cbs, &seq, CBS_ASN1_SEQUENCE) ||
184      !CBS_get_asn1_uint64(&seq, &handback_version) ||
185      handback_version != kHandbackVersion) {
186    return false;
187  }
188
189  if (!CBS_get_asn1_uint64(&seq, &version) ||
190      !CBS_get_asn1_uint64(&seq, &conf_max_version) ||
191      !CBS_get_asn1_uint64(&seq, &conf_min_version) ||
192      !CBS_get_asn1_uint64(&seq, &max_send_fragment) ||
193      !CBS_get_asn1(&seq, &read_seq, CBS_ASN1_OCTETSTRING) ||
194      CBS_len(&read_seq) != sizeof(s3->read_sequence) ||
195      !CBS_get_asn1(&seq, &write_seq, CBS_ASN1_OCTETSTRING) ||
196      CBS_len(&write_seq) != sizeof(s3->write_sequence) ||
197      !CBS_get_asn1(&seq, &server_rand, CBS_ASN1_OCTETSTRING) ||
198      CBS_len(&server_rand) != sizeof(s3->server_random) ||
199      !CBS_copy_bytes(&server_rand, s3->server_random,
200                      sizeof(s3->server_random)) ||
201      !CBS_get_asn1(&seq, &client_rand, CBS_ASN1_OCTETSTRING) ||
202      CBS_len(&client_rand) != sizeof(s3->client_random) ||
203      !CBS_copy_bytes(&client_rand, s3->client_random,
204                      sizeof(s3->client_random)) ||
205      !CBS_get_asn1(&seq, &read_iv, CBS_ASN1_OCTETSTRING) ||
206      !CBS_get_asn1(&seq, &write_iv, CBS_ASN1_OCTETSTRING) ||
207      !CBS_get_asn1_bool(&seq, &session_reused) ||
208      !CBS_get_asn1_bool(&seq, &send_connection_binding) ||
209      !CBS_get_asn1_bool(&seq, &channel_id_valid)) {
210    return false;
211  }
212
213  s3->established_session =
214      SSL_SESSION_parse(&seq, ssl->ctx->x509_method, ssl->ctx->pool);
215
216  if (!s3->established_session ||
217      !CBS_get_asn1(&seq, &next_proto, CBS_ASN1_OCTETSTRING) ||
218      !CBS_get_asn1(&seq, &alpn, CBS_ASN1_OCTETSTRING) ||
219      !CBS_get_asn1(&seq, &hostname, CBS_ASN1_OCTETSTRING) ||
220      !CBS_get_asn1(&seq, &channel_id, CBS_ASN1_OCTETSTRING) ||
221      CBS_len(&channel_id) != sizeof(s3->tlsext_channel_id) ||
222      !CBS_copy_bytes(&channel_id, s3->tlsext_channel_id,
223                      sizeof(s3->tlsext_channel_id)) ||
224      !CBS_get_asn1_uint64(&seq, &options) ||
225      !CBS_get_asn1_uint64(&seq, &mode) ||
226      !CBS_get_asn1_uint64(&seq, &max_cert_list) ||
227      !CBS_get_asn1_bool(&seq, &quiet_shutdown) ||
228      !CBS_get_asn1_bool(&seq, &channel_id_enabled) ||
229      !CBS_get_asn1_bool(&seq, &retain_only_sha256)) {
230    return false;
231  }
232
233  ssl->version = version;
234  ssl->conf_max_version = conf_max_version;
235  ssl->conf_min_version = conf_min_version;
236  ssl->max_send_fragment = max_send_fragment;
237  ssl->do_handshake = ssl_server_handshake;
238  ssl->server = true;
239  ssl->options = options;
240  ssl->mode = mode;
241  ssl->max_cert_list = max_cert_list;
242
243  s3->hs.reset();
244  s3->have_version = true;
245  s3->initial_handshake_complete = true;
246  s3->session_reused = session_reused;
247  s3->send_connection_binding = send_connection_binding;
248  s3->tlsext_channel_id_valid = channel_id_valid;
249  s3->next_proto_negotiated.CopyFrom(next_proto);
250  s3->alpn_selected.CopyFrom(alpn);
251
252  const size_t hostname_len = CBS_len(&hostname);
253  if (hostname_len == 0) {
254    s3->hostname.reset();
255  } else {
256    char *hostname_str = nullptr;
257    if (!CBS_strdup(&hostname, &hostname_str)) {
258      return false;
259    }
260    s3->hostname.reset(hostname_str);
261  }
262
263  ssl->quiet_shutdown = quiet_shutdown;
264  ssl->tlsext_channel_id_enabled = channel_id_enabled;
265  ssl->retain_only_sha256_of_client_certs = retain_only_sha256;
266
267  Array<uint8_t> key_block;
268  if (!tls1_configure_aead(ssl, evp_aead_open, &key_block,
269                           s3->established_session->cipher, read_iv) ||
270      !tls1_configure_aead(ssl, evp_aead_seal, &key_block,
271                           s3->established_session->cipher, write_iv)) {
272    return false;
273  }
274
275  if (!CBS_copy_bytes(&read_seq, s3->read_sequence,
276                      sizeof(s3->read_sequence)) ||
277      !CBS_copy_bytes(&write_seq, s3->write_sequence,
278                      sizeof(s3->write_sequence))) {
279    return false;
280  }
281
282  return true;
283}
284
285}  // namespace bssl
286