diff options
Diffstat (limited to 'security/nss/lib/ssl')
60 files changed, 45280 insertions, 0 deletions
diff --git a/security/nss/lib/ssl/Makefile b/security/nss/lib/ssl/Makefile new file mode 100644 index 000000000..24fccc590 --- /dev/null +++ b/security/nss/lib/ssl/Makefile @@ -0,0 +1,65 @@ +#! gmake +# +# This Source Code Form is subject to the terms of the Mozilla Public +# License, v. 2.0. If a copy of the MPL was not distributed with this +# file, You can obtain one at http://mozilla.org/MPL/2.0/. + +####################################################################### +# (1) Include initial platform-independent assignments (MANDATORY). # +####################################################################### + +include manifest.mn + +####################################################################### +# (2) Include "global" configuration information. (OPTIONAL) # +####################################################################### + +include $(CORE_DEPTH)/coreconf/config.mk + +####################################################################### +# (3) Include "component" configuration information. (OPTIONAL) # +###################################################################### +# + + +####################################################################### +# (4) Include "local" platform-dependent assignments (OPTIONAL). # +####################################################################### + +include config.mk + +ifeq (,$(filter-out WIN%,$(OS_TARGET))) +CSRCS += win32err.c +DEFINES += -DIN_LIBSSL +else +ifeq ($(OS_TARGET),OS2) +CSRCS += os2_err.c +else +CSRCS += unix_err.c +endif +endif + +# Enable key logging by default in debug builds, but not opt builds. +# Logging still needs to be enabled at runtime through env vars. +NSS_ALLOW_SSLKEYLOGFILE ?= $(if $(BUILD_OPT),0,1) +ifeq (1,$(NSS_ALLOW_SSLKEYLOGFILE)) +DEFINES += -DNSS_ALLOW_SSLKEYLOGFILE=1 +endif + +####################################################################### +# (5) Execute "global" rules. (OPTIONAL) # +####################################################################### + +include $(CORE_DEPTH)/coreconf/rules.mk + +####################################################################### +# (6) Execute "component" rules. (OPTIONAL) # +####################################################################### + + + +####################################################################### +# (7) Execute "local" rules. (OPTIONAL). # +####################################################################### + +export:: private_export diff --git a/security/nss/lib/ssl/SSLerrs.h b/security/nss/lib/ssl/SSLerrs.h new file mode 100644 index 000000000..b0319b86c --- /dev/null +++ b/security/nss/lib/ssl/SSLerrs.h @@ -0,0 +1,507 @@ +/* This Source Code Form is subject to the terms of the Mozilla Public + * License, v. 2.0. If a copy of the MPL was not distributed with this + * file, You can obtain one at http://mozilla.org/MPL/2.0/. */ + +#define UNUSED_ERROR(x) ER3(SSL_ERROR_UNUSED_##x, (SSL_ERROR_BASE + x), \ + "Unrecognized SSL error_code.") + +/* SSL-specific security error codes */ +/* caller must include "sslerr.h" */ + +ER3(SSL_ERROR_EXPORT_ONLY_SERVER, SSL_ERROR_BASE + 0, + "Unable to communicate securely. Peer does not support high-grade encryption.") + +ER3(SSL_ERROR_US_ONLY_SERVER, SSL_ERROR_BASE + 1, + "Unable to communicate securely. Peer requires high-grade encryption which is not supported.") + +ER3(SSL_ERROR_NO_CYPHER_OVERLAP, SSL_ERROR_BASE + 2, + "Cannot communicate securely with peer: no common encryption algorithm(s).") + +ER3(SSL_ERROR_NO_CERTIFICATE, SSL_ERROR_BASE + 3, + "Unable to find the certificate or key necessary for authentication.") + +ER3(SSL_ERROR_BAD_CERTIFICATE, SSL_ERROR_BASE + 4, + "Unable to communicate securely with peer: peers's certificate was rejected.") + +UNUSED_ERROR(5) + +ER3(SSL_ERROR_BAD_CLIENT, SSL_ERROR_BASE + 6, + "The server has encountered bad data from the client.") + +ER3(SSL_ERROR_BAD_SERVER, SSL_ERROR_BASE + 7, + "The client has encountered bad data from the server.") + +ER3(SSL_ERROR_UNSUPPORTED_CERTIFICATE_TYPE, SSL_ERROR_BASE + 8, + "Unsupported certificate type.") + +ER3(SSL_ERROR_UNSUPPORTED_VERSION, SSL_ERROR_BASE + 9, + "Peer using unsupported version of security protocol.") + +UNUSED_ERROR(10) + +ER3(SSL_ERROR_WRONG_CERTIFICATE, SSL_ERROR_BASE + 11, + "Client authentication failed: private key in key database does not match public key in certificate database.") + +ER3(SSL_ERROR_BAD_CERT_DOMAIN, SSL_ERROR_BASE + 12, + "Unable to communicate securely with peer: requested domain name does not match the server's certificate.") + +ER3(SSL_ERROR_POST_WARNING, SSL_ERROR_BASE + 13, + "Unrecognized SSL error code.") + +ER3(SSL_ERROR_SSL2_DISABLED, (SSL_ERROR_BASE + 14), + "Peer only supports SSL version 2, which is locally disabled.") + +ER3(SSL_ERROR_BAD_MAC_READ, (SSL_ERROR_BASE + 15), + "SSL received a record with an incorrect Message Authentication Code.") + +ER3(SSL_ERROR_BAD_MAC_ALERT, (SSL_ERROR_BASE + 16), + "SSL peer reports incorrect Message Authentication Code.") + +ER3(SSL_ERROR_BAD_CERT_ALERT, (SSL_ERROR_BASE + 17), + "SSL peer cannot verify your certificate.") + +ER3(SSL_ERROR_REVOKED_CERT_ALERT, (SSL_ERROR_BASE + 18), + "SSL peer rejected your certificate as revoked.") + +ER3(SSL_ERROR_EXPIRED_CERT_ALERT, (SSL_ERROR_BASE + 19), + "SSL peer rejected your certificate as expired.") + +ER3(SSL_ERROR_SSL_DISABLED, (SSL_ERROR_BASE + 20), + "Cannot connect: SSL is disabled.") + +ER3(SSL_ERROR_FORTEZZA_PQG, (SSL_ERROR_BASE + 21), + "Cannot connect: SSL peer is in another FORTEZZA domain.") + +ER3(SSL_ERROR_UNKNOWN_CIPHER_SUITE, (SSL_ERROR_BASE + 22), + "An unknown SSL cipher suite has been requested.") + +ER3(SSL_ERROR_NO_CIPHERS_SUPPORTED, (SSL_ERROR_BASE + 23), + "No cipher suites are present and enabled in this program.") + +ER3(SSL_ERROR_BAD_BLOCK_PADDING, (SSL_ERROR_BASE + 24), + "SSL received a record with bad block padding.") + +ER3(SSL_ERROR_RX_RECORD_TOO_LONG, (SSL_ERROR_BASE + 25), + "SSL received a record that exceeded the maximum permissible length.") + +ER3(SSL_ERROR_TX_RECORD_TOO_LONG, (SSL_ERROR_BASE + 26), + "SSL attempted to send a record that exceeded the maximum permissible length.") + +/* + * Received a malformed (too long or short or invalid content) SSL handshake. + */ +ER3(SSL_ERROR_RX_MALFORMED_HELLO_REQUEST, (SSL_ERROR_BASE + 27), + "SSL received a malformed Hello Request handshake message.") + +ER3(SSL_ERROR_RX_MALFORMED_CLIENT_HELLO, (SSL_ERROR_BASE + 28), + "SSL received a malformed Client Hello handshake message.") + +ER3(SSL_ERROR_RX_MALFORMED_SERVER_HELLO, (SSL_ERROR_BASE + 29), + "SSL received a malformed Server Hello handshake message.") + +ER3(SSL_ERROR_RX_MALFORMED_CERTIFICATE, (SSL_ERROR_BASE + 30), + "SSL received a malformed Certificate handshake message.") + +ER3(SSL_ERROR_RX_MALFORMED_SERVER_KEY_EXCH, (SSL_ERROR_BASE + 31), + "SSL received a malformed Server Key Exchange handshake message.") + +ER3(SSL_ERROR_RX_MALFORMED_CERT_REQUEST, (SSL_ERROR_BASE + 32), + "SSL received a malformed Certificate Request handshake message.") + +ER3(SSL_ERROR_RX_MALFORMED_HELLO_DONE, (SSL_ERROR_BASE + 33), + "SSL received a malformed Server Hello Done handshake message.") + +ER3(SSL_ERROR_RX_MALFORMED_CERT_VERIFY, (SSL_ERROR_BASE + 34), + "SSL received a malformed Certificate Verify handshake message.") + +ER3(SSL_ERROR_RX_MALFORMED_CLIENT_KEY_EXCH, (SSL_ERROR_BASE + 35), + "SSL received a malformed Client Key Exchange handshake message.") + +ER3(SSL_ERROR_RX_MALFORMED_FINISHED, (SSL_ERROR_BASE + 36), + "SSL received a malformed Finished handshake message.") + +/* + * Received a malformed (too long or short) SSL record. + */ +ER3(SSL_ERROR_RX_MALFORMED_CHANGE_CIPHER, (SSL_ERROR_BASE + 37), + "SSL received a malformed Change Cipher Spec record.") + +ER3(SSL_ERROR_RX_MALFORMED_ALERT, (SSL_ERROR_BASE + 38), + "SSL received a malformed Alert record.") + +ER3(SSL_ERROR_RX_MALFORMED_HANDSHAKE, (SSL_ERROR_BASE + 39), + "SSL received a malformed Handshake record.") + +ER3(SSL_ERROR_RX_MALFORMED_APPLICATION_DATA, (SSL_ERROR_BASE + 40), + "SSL received a malformed Application Data record.") + +/* + * Received an SSL handshake that was inappropriate for the state we're in. + * E.g. Server received message from server, or wrong state in state machine. + */ +ER3(SSL_ERROR_RX_UNEXPECTED_HELLO_REQUEST, (SSL_ERROR_BASE + 41), + "SSL received an unexpected Hello Request handshake message.") + +ER3(SSL_ERROR_RX_UNEXPECTED_CLIENT_HELLO, (SSL_ERROR_BASE + 42), + "SSL received an unexpected Client Hello handshake message.") + +ER3(SSL_ERROR_RX_UNEXPECTED_SERVER_HELLO, (SSL_ERROR_BASE + 43), + "SSL received an unexpected Server Hello handshake message.") + +ER3(SSL_ERROR_RX_UNEXPECTED_CERTIFICATE, (SSL_ERROR_BASE + 44), + "SSL received an unexpected Certificate handshake message.") + +ER3(SSL_ERROR_RX_UNEXPECTED_SERVER_KEY_EXCH, (SSL_ERROR_BASE + 45), + "SSL received an unexpected Server Key Exchange handshake message.") + +ER3(SSL_ERROR_RX_UNEXPECTED_CERT_REQUEST, (SSL_ERROR_BASE + 46), + "SSL received an unexpected Certificate Request handshake message.") + +ER3(SSL_ERROR_RX_UNEXPECTED_HELLO_DONE, (SSL_ERROR_BASE + 47), + "SSL received an unexpected Server Hello Done handshake message.") + +ER3(SSL_ERROR_RX_UNEXPECTED_CERT_VERIFY, (SSL_ERROR_BASE + 48), + "SSL received an unexpected Certificate Verify handshake message.") + +ER3(SSL_ERROR_RX_UNEXPECTED_CLIENT_KEY_EXCH, (SSL_ERROR_BASE + 49), + "SSL received an unexpected Client Key Exchange handshake message.") + +ER3(SSL_ERROR_RX_UNEXPECTED_FINISHED, (SSL_ERROR_BASE + 50), + "SSL received an unexpected Finished handshake message.") + +/* + * Received an SSL record that was inappropriate for the state we're in. + */ +ER3(SSL_ERROR_RX_UNEXPECTED_CHANGE_CIPHER, (SSL_ERROR_BASE + 51), + "SSL received an unexpected Change Cipher Spec record.") + +ER3(SSL_ERROR_RX_UNEXPECTED_ALERT, (SSL_ERROR_BASE + 52), + "SSL received an unexpected Alert record.") + +ER3(SSL_ERROR_RX_UNEXPECTED_HANDSHAKE, (SSL_ERROR_BASE + 53), + "SSL received an unexpected Handshake record.") + +ER3(SSL_ERROR_RX_UNEXPECTED_APPLICATION_DATA, (SSL_ERROR_BASE + 54), + "SSL received an unexpected Application Data record.") + +/* + * Received record/message with unknown discriminant. + */ +ER3(SSL_ERROR_RX_UNKNOWN_RECORD_TYPE, (SSL_ERROR_BASE + 55), + "SSL received a record with an unknown content type.") + +ER3(SSL_ERROR_RX_UNKNOWN_HANDSHAKE, (SSL_ERROR_BASE + 56), + "SSL received a handshake message with an unknown message type.") + +ER3(SSL_ERROR_RX_UNKNOWN_ALERT, (SSL_ERROR_BASE + 57), + "SSL received an alert record with an unknown alert description.") + +/* + * Received an alert reporting what we did wrong. (more alerts above) + */ +ER3(SSL_ERROR_CLOSE_NOTIFY_ALERT, (SSL_ERROR_BASE + 58), + "SSL peer has closed this connection.") + +ER3(SSL_ERROR_HANDSHAKE_UNEXPECTED_ALERT, (SSL_ERROR_BASE + 59), + "SSL peer was not expecting a handshake message it received.") + +ER3(SSL_ERROR_DECOMPRESSION_FAILURE_ALERT, (SSL_ERROR_BASE + 60), + "SSL peer was unable to successfully decompress an SSL record it received.") + +ER3(SSL_ERROR_HANDSHAKE_FAILURE_ALERT, (SSL_ERROR_BASE + 61), + "SSL peer was unable to negotiate an acceptable set of security parameters.") + +ER3(SSL_ERROR_ILLEGAL_PARAMETER_ALERT, (SSL_ERROR_BASE + 62), + "SSL peer rejected a handshake message for unacceptable content.") + +ER3(SSL_ERROR_UNSUPPORTED_CERT_ALERT, (SSL_ERROR_BASE + 63), + "SSL peer does not support certificates of the type it received.") + +ER3(SSL_ERROR_CERTIFICATE_UNKNOWN_ALERT, (SSL_ERROR_BASE + 64), + "SSL peer had some unspecified issue with the certificate it received.") + +ER3(SSL_ERROR_GENERATE_RANDOM_FAILURE, (SSL_ERROR_BASE + 65), + "SSL experienced a failure of its random number generator.") + +ER3(SSL_ERROR_SIGN_HASHES_FAILURE, (SSL_ERROR_BASE + 66), + "Unable to digitally sign data required to verify your certificate.") + +ER3(SSL_ERROR_EXTRACT_PUBLIC_KEY_FAILURE, (SSL_ERROR_BASE + 67), + "SSL was unable to extract the public key from the peer's certificate.") + +ER3(SSL_ERROR_SERVER_KEY_EXCHANGE_FAILURE, (SSL_ERROR_BASE + 68), + "Unspecified failure while processing SSL Server Key Exchange handshake.") + +ER3(SSL_ERROR_CLIENT_KEY_EXCHANGE_FAILURE, (SSL_ERROR_BASE + 69), + "Unspecified failure while processing SSL Client Key Exchange handshake.") + +ER3(SSL_ERROR_ENCRYPTION_FAILURE, (SSL_ERROR_BASE + 70), + "Bulk data encryption algorithm failed in selected cipher suite.") + +ER3(SSL_ERROR_DECRYPTION_FAILURE, (SSL_ERROR_BASE + 71), + "Bulk data decryption algorithm failed in selected cipher suite.") + +ER3(SSL_ERROR_SOCKET_WRITE_FAILURE, (SSL_ERROR_BASE + 72), + "Attempt to write encrypted data to underlying socket failed.") + +ER3(SSL_ERROR_MD5_DIGEST_FAILURE, (SSL_ERROR_BASE + 73), + "MD5 digest function failed.") + +ER3(SSL_ERROR_SHA_DIGEST_FAILURE, (SSL_ERROR_BASE + 74), + "SHA-1 digest function failed.") + +ER3(SSL_ERROR_MAC_COMPUTATION_FAILURE, (SSL_ERROR_BASE + 75), + "MAC computation failed.") + +ER3(SSL_ERROR_SYM_KEY_CONTEXT_FAILURE, (SSL_ERROR_BASE + 76), + "Failure to create Symmetric Key context.") + +ER3(SSL_ERROR_SYM_KEY_UNWRAP_FAILURE, (SSL_ERROR_BASE + 77), + "Failure to unwrap the Symmetric key in Client Key Exchange message.") + +ER3(SSL_ERROR_PUB_KEY_SIZE_LIMIT_EXCEEDED, (SSL_ERROR_BASE + 78), + "SSL Server attempted to use domestic-grade public key with export cipher suite.") + +ER3(SSL_ERROR_IV_PARAM_FAILURE, (SSL_ERROR_BASE + 79), + "PKCS11 code failed to translate an IV into a param.") + +ER3(SSL_ERROR_INIT_CIPHER_SUITE_FAILURE, (SSL_ERROR_BASE + 80), + "Failed to initialize the selected cipher suite.") + +ER3(SSL_ERROR_SESSION_KEY_GEN_FAILURE, (SSL_ERROR_BASE + 81), + "Client failed to generate session keys for SSL session.") + +ER3(SSL_ERROR_NO_SERVER_KEY_FOR_ALG, (SSL_ERROR_BASE + 82), + "Server has no key for the attempted key exchange algorithm.") + +ER3(SSL_ERROR_TOKEN_INSERTION_REMOVAL, (SSL_ERROR_BASE + 83), + "PKCS#11 token was inserted or removed while operation was in progress.") + +ER3(SSL_ERROR_TOKEN_SLOT_NOT_FOUND, (SSL_ERROR_BASE + 84), + "No PKCS#11 token could be found to do a required operation.") + +ER3(SSL_ERROR_NO_COMPRESSION_OVERLAP, (SSL_ERROR_BASE + 85), + "Cannot communicate securely with peer: no common compression algorithm(s).") + +ER3(SSL_ERROR_HANDSHAKE_NOT_COMPLETED, (SSL_ERROR_BASE + 86), + "Cannot perform the operation until the handshake is complete.") + +ER3(SSL_ERROR_BAD_HANDSHAKE_HASH_VALUE, (SSL_ERROR_BASE + 87), + "Received incorrect handshakes hash values from peer.") + +ER3(SSL_ERROR_CERT_KEA_MISMATCH, (SSL_ERROR_BASE + 88), + "The certificate provided cannot be used with the selected authentication type.") + +ER3(SSL_ERROR_NO_TRUSTED_SSL_CLIENT_CA, (SSL_ERROR_BASE + 89), + "No certificate authority is trusted for SSL client authentication.") + +ER3(SSL_ERROR_SESSION_NOT_FOUND, (SSL_ERROR_BASE + 90), + "Client's SSL session ID not found in server's session cache.") + +ER3(SSL_ERROR_DECRYPTION_FAILED_ALERT, (SSL_ERROR_BASE + 91), + "Peer was unable to decrypt an SSL record it received.") + +ER3(SSL_ERROR_RECORD_OVERFLOW_ALERT, (SSL_ERROR_BASE + 92), + "Peer received an SSL record that was longer than is permitted.") + +ER3(SSL_ERROR_UNKNOWN_CA_ALERT, (SSL_ERROR_BASE + 93), + "Peer does not recognize and trust the CA that issued your certificate.") + +ER3(SSL_ERROR_ACCESS_DENIED_ALERT, (SSL_ERROR_BASE + 94), + "Peer received a valid certificate, but access was denied.") + +ER3(SSL_ERROR_DECODE_ERROR_ALERT, (SSL_ERROR_BASE + 95), + "Peer could not decode an SSL handshake message.") + +ER3(SSL_ERROR_DECRYPT_ERROR_ALERT, (SSL_ERROR_BASE + 96), + "Peer reports failure of signature verification or key exchange.") + +ER3(SSL_ERROR_EXPORT_RESTRICTION_ALERT, (SSL_ERROR_BASE + 97), + "Peer reports negotiation not in compliance with export regulations.") + +ER3(SSL_ERROR_PROTOCOL_VERSION_ALERT, (SSL_ERROR_BASE + 98), + "Peer reports incompatible or unsupported protocol version.") + +ER3(SSL_ERROR_INSUFFICIENT_SECURITY_ALERT, (SSL_ERROR_BASE + 99), + "Server requires ciphers more secure than those supported by client.") + +ER3(SSL_ERROR_INTERNAL_ERROR_ALERT, (SSL_ERROR_BASE + 100), + "Peer reports it experienced an internal error.") + +ER3(SSL_ERROR_USER_CANCELED_ALERT, (SSL_ERROR_BASE + 101), + "Peer user canceled handshake.") + +ER3(SSL_ERROR_NO_RENEGOTIATION_ALERT, (SSL_ERROR_BASE + 102), + "Peer does not permit renegotiation of SSL security parameters.") + +ER3(SSL_ERROR_SERVER_CACHE_NOT_CONFIGURED, (SSL_ERROR_BASE + 103), + "SSL server cache not configured and not disabled for this socket.") + +ER3(SSL_ERROR_UNSUPPORTED_EXTENSION_ALERT, (SSL_ERROR_BASE + 104), + "SSL peer does not support requested TLS hello extension.") + +ER3(SSL_ERROR_CERTIFICATE_UNOBTAINABLE_ALERT, (SSL_ERROR_BASE + 105), + "SSL peer could not obtain your certificate from the supplied URL.") + +ER3(SSL_ERROR_UNRECOGNIZED_NAME_ALERT, (SSL_ERROR_BASE + 106), + "SSL peer has no certificate for the requested DNS name.") + +ER3(SSL_ERROR_BAD_CERT_STATUS_RESPONSE_ALERT, (SSL_ERROR_BASE + 107), + "SSL peer was unable to get an OCSP response for its certificate.") + +ER3(SSL_ERROR_BAD_CERT_HASH_VALUE_ALERT, (SSL_ERROR_BASE + 108), + "SSL peer reported bad certificate hash value.") + +ER3(SSL_ERROR_RX_UNEXPECTED_NEW_SESSION_TICKET, (SSL_ERROR_BASE + 109), + "SSL received an unexpected New Session Ticket handshake message.") + +ER3(SSL_ERROR_RX_MALFORMED_NEW_SESSION_TICKET, (SSL_ERROR_BASE + 110), + "SSL received a malformed New Session Ticket handshake message.") + +ER3(SSL_ERROR_DECOMPRESSION_FAILURE, (SSL_ERROR_BASE + 111), + "SSL received a compressed record that could not be decompressed.") + +ER3(SSL_ERROR_RENEGOTIATION_NOT_ALLOWED, (SSL_ERROR_BASE + 112), + "Renegotiation is not allowed on this SSL socket.") + +ER3(SSL_ERROR_UNSAFE_NEGOTIATION, (SSL_ERROR_BASE + 113), + "Peer attempted old style (potentially vulnerable) handshake.") + +ER3(SSL_ERROR_RX_UNEXPECTED_UNCOMPRESSED_RECORD, (SSL_ERROR_BASE + 114), + "SSL received an unexpected uncompressed record.") + +ER3(SSL_ERROR_WEAK_SERVER_EPHEMERAL_DH_KEY, (SSL_ERROR_BASE + 115), + "SSL received a weak ephemeral Diffie-Hellman key in Server Key Exchange handshake message.") + +ER3(SSL_ERROR_NEXT_PROTOCOL_DATA_INVALID, (SSL_ERROR_BASE + 116), + "SSL received invalid NPN extension data.") + +ER3(SSL_ERROR_FEATURE_NOT_SUPPORTED_FOR_SSL2, (SSL_ERROR_BASE + 117), + "SSL feature not supported for SSL 2.0 connections.") + +ER3(SSL_ERROR_FEATURE_NOT_SUPPORTED_FOR_SERVERS, (SSL_ERROR_BASE + 118), + "SSL feature not supported for servers.") + +ER3(SSL_ERROR_FEATURE_NOT_SUPPORTED_FOR_CLIENTS, (SSL_ERROR_BASE + 119), + "SSL feature not supported for clients.") + +ER3(SSL_ERROR_INVALID_VERSION_RANGE, (SSL_ERROR_BASE + 120), + "SSL version range is not valid.") + +ER3(SSL_ERROR_CIPHER_DISALLOWED_FOR_VERSION, (SSL_ERROR_BASE + 121), + "SSL peer selected a cipher suite disallowed for the selected protocol version.") + +ER3(SSL_ERROR_RX_MALFORMED_HELLO_VERIFY_REQUEST, (SSL_ERROR_BASE + 122), + "SSL received a malformed Hello Verify Request handshake message.") + +ER3(SSL_ERROR_RX_UNEXPECTED_HELLO_VERIFY_REQUEST, (SSL_ERROR_BASE + 123), + "SSL received an unexpected Hello Verify Request handshake message.") + +ER3(SSL_ERROR_FEATURE_NOT_SUPPORTED_FOR_VERSION, (SSL_ERROR_BASE + 124), + "SSL feature not supported for the protocol version.") + +ER3(SSL_ERROR_RX_UNEXPECTED_CERT_STATUS, (SSL_ERROR_BASE + 125), + "SSL received an unexpected Certificate Status handshake message.") + +ER3(SSL_ERROR_UNSUPPORTED_HASH_ALGORITHM, (SSL_ERROR_BASE + 126), + "Unsupported hash algorithm used by TLS peer.") + +ER3(SSL_ERROR_DIGEST_FAILURE, (SSL_ERROR_BASE + 127), + "Digest function failed.") + +ER3(SSL_ERROR_INCORRECT_SIGNATURE_ALGORITHM, (SSL_ERROR_BASE + 128), + "Incorrect signature algorithm specified in a digitally-signed element.") + +ER3(SSL_ERROR_NEXT_PROTOCOL_NO_CALLBACK, (SSL_ERROR_BASE + 129), + "The next protocol negotiation extension was enabled, but the callback was cleared prior to being needed.") + +ER3(SSL_ERROR_NEXT_PROTOCOL_NO_PROTOCOL, (SSL_ERROR_BASE + 130), + "The server supports no protocols that the client advertises in the ALPN extension.") + +ER3(SSL_ERROR_INAPPROPRIATE_FALLBACK_ALERT, (SSL_ERROR_BASE + 131), + "The server rejected the handshake because the client downgraded to a lower " + "TLS version than the server supports.") + +ER3(SSL_ERROR_WEAK_SERVER_CERT_KEY, (SSL_ERROR_BASE + 132), + "The server certificate included a public key that was too weak.") + +ER3(SSL_ERROR_RX_SHORT_DTLS_READ, (SSL_ERROR_BASE + 133), + "Not enough room in buffer for DTLS record.") + +ER3(SSL_ERROR_NO_SUPPORTED_SIGNATURE_ALGORITHM, (SSL_ERROR_BASE + 134), + "No supported TLS signature algorithm was configured.") + +ER3(SSL_ERROR_UNSUPPORTED_SIGNATURE_ALGORITHM, (SSL_ERROR_BASE + 135), + "The peer used an unsupported combination of signature and hash algorithm.") + +ER3(SSL_ERROR_MISSING_EXTENDED_MASTER_SECRET, (SSL_ERROR_BASE + 136), + "The peer tried to resume without a correct extended_master_secret extension") + +ER3(SSL_ERROR_UNEXPECTED_EXTENDED_MASTER_SECRET, (SSL_ERROR_BASE + 137), + "The peer tried to resume with an unexpected extended_master_secret extension") + +ER3(SSL_ERROR_RX_MALFORMED_KEY_SHARE, (SSL_ERROR_BASE + 138), + "SSL received a malformed Key Share extension.") + +ER3(SSL_ERROR_MISSING_KEY_SHARE, (SSL_ERROR_BASE + 139), + "SSL expected a Key Share extension.") + +ER3(SSL_ERROR_RX_MALFORMED_ECDHE_KEY_SHARE, (SSL_ERROR_BASE + 140), + "SSL received a malformed ECDHE key share handshake extension.") + +ER3(SSL_ERROR_RX_MALFORMED_DHE_KEY_SHARE, (SSL_ERROR_BASE + 141), + "SSL received a malformed DHE key share handshake extension.") + +ER3(SSL_ERROR_RX_UNEXPECTED_ENCRYPTED_EXTENSIONS, (SSL_ERROR_BASE + 142), + "SSL received an unexpected Encrypted Extensions handshake message.") + +ER3(SSL_ERROR_MISSING_EXTENSION_ALERT, (SSL_ERROR_BASE + 143), + "SSL received a missing_extension alert.") + +ER3(SSL_ERROR_KEY_EXCHANGE_FAILURE, (SSL_ERROR_BASE + 144), + "SSL had an error performing key exchange.") + +ER3(SSL_ERROR_EXTENSION_DISALLOWED_FOR_VERSION, (SSL_ERROR_BASE + 145), + "SSL received an extension that is not permitted for this version.") + +ER3(SSL_ERROR_RX_MALFORMED_ENCRYPTED_EXTENSIONS, (SSL_ERROR_BASE + 146), + "SSL received a malformed Encrypted Extensions handshake message.") + +ER3(SSL_ERROR_RX_MALFORMED_PRE_SHARED_KEY, (SSL_ERROR_BASE + 147), + "SSL received an invalid PreSharedKey extension.") + +ER3(SSL_ERROR_RX_MALFORMED_EARLY_DATA, (SSL_ERROR_BASE + 148), + "SSL received an invalid EarlyData extension.") + +ER3(SSL_ERROR_END_OF_EARLY_DATA_ALERT, (SSL_ERROR_BASE + 149), + "SSL received an unexpected end of early data alert.") + +ER3(SSL_ERROR_MISSING_ALPN_EXTENSION, (SSL_ERROR_BASE + 150), + "SSL didn't receive an expected ALPN extension.") + +ER3(SSL_ERROR_RX_UNEXPECTED_EXTENSION, (SSL_ERROR_BASE + 151), + "SSL received an unexpected extension.") + +ER3(SSL_ERROR_MISSING_SUPPORTED_GROUPS, (SSL_ERROR_BASE + 152), + "SSL expected a supported groups extension.") + +ER3(SSL_ERROR_TOO_MANY_RECORDS, (SSL_ERROR_BASE + 153), + "SSL sent or received too many records with the same symmetric key.") + +ER3(SSL_ERROR_RX_UNEXPECTED_HELLO_RETRY_REQUEST, (SSL_ERROR_BASE + 154), + "SSL received an unexpected Hello Retry Request handshake message.") + +ER3(SSL_ERROR_RX_MALFORMED_HELLO_RETRY_REQUEST, (SSL_ERROR_BASE + 155), + "SSL received a malformed Hello Retry Request handshake message.") + +ER3(SSL_ERROR_BAD_2ND_CLIENT_HELLO, (SSL_ERROR_BASE + 156), + "SSL received a second Client Hello message without a usable key share.") + +ER3(SSL_ERROR_MISSING_SIGNATURE_ALGORITHMS_EXTENSION, (SSL_ERROR_BASE + 157), + "SSL expected a signature algorithms extension.") + +ER3(SSL_ERROR_MALFORMED_PSK_KEY_EXCHANGE_MODES, (SSL_ERROR_BASE + 158), + "SSL received a malformed PSK key exchange modes extension.") + +ER3(SSL_ERROR_MISSING_PSK_KEY_EXCHANGE_MODES, (SSL_ERROR_BASE + 159), + "SSL expected a missing PSK key exchange modes extension.") diff --git a/security/nss/lib/ssl/authcert.c b/security/nss/lib/ssl/authcert.c new file mode 100644 index 000000000..88c7c084a --- /dev/null +++ b/security/nss/lib/ssl/authcert.c @@ -0,0 +1,89 @@ +/* + * NSS utility functions + * + * This Source Code Form is subject to the terms of the Mozilla Public + * License, v. 2.0. If a copy of the MPL was not distributed with this + * file, You can obtain one at http://mozilla.org/MPL/2.0/. */ + +#include <stdio.h> +#include <string.h> +#include "prerror.h" +#include "secitem.h" +#include "prnetdb.h" +#include "cert.h" +#include "nspr.h" +#include "secder.h" +#include "key.h" +#include "nss.h" +#include "ssl.h" +#include "pk11func.h" /* for PK11_ function calls */ + +/* + * This callback used by SSL to pull client sertificate upon + * server request + */ +SECStatus +NSS_GetClientAuthData(void *arg, + PRFileDesc *socket, + struct CERTDistNamesStr *caNames, + struct CERTCertificateStr **pRetCert, + struct SECKEYPrivateKeyStr **pRetKey) +{ + CERTCertificate *cert = NULL; + SECKEYPrivateKey *privkey = NULL; + char *chosenNickName = (char *)arg; /* CONST */ + void *proto_win = NULL; + SECStatus rv = SECFailure; + + proto_win = SSL_RevealPinArg(socket); + + if (chosenNickName) { + cert = CERT_FindUserCertByUsage(CERT_GetDefaultCertDB(), + chosenNickName, certUsageSSLClient, + PR_FALSE, proto_win); + if (cert) { + privkey = PK11_FindKeyByAnyCert(cert, proto_win); + if (privkey) { + rv = SECSuccess; + } else { + CERT_DestroyCertificate(cert); + } + } + } else { /* no name given, automatically find the right cert. */ + CERTCertNicknames *names; + int i; + + names = CERT_GetCertNicknames(CERT_GetDefaultCertDB(), + SEC_CERT_NICKNAMES_USER, proto_win); + if (names != NULL) { + for (i = 0; i < names->numnicknames; i++) { + cert = CERT_FindUserCertByUsage(CERT_GetDefaultCertDB(), + names->nicknames[i], certUsageSSLClient, + PR_FALSE, proto_win); + if (!cert) + continue; + /* Only check unexpired certs */ + if (CERT_CheckCertValidTimes(cert, PR_Now(), PR_TRUE) != + secCertTimeValid) { + CERT_DestroyCertificate(cert); + continue; + } + rv = NSS_CmpCertChainWCANames(cert, caNames); + if (rv == SECSuccess) { + privkey = + PK11_FindKeyByAnyCert(cert, proto_win); + if (privkey) + break; + } + rv = SECFailure; + CERT_DestroyCertificate(cert); + } + CERT_FreeNicknames(names); + } + } + if (rv == SECSuccess) { + *pRetCert = cert; + *pRetKey = privkey; + } + return rv; +} diff --git a/security/nss/lib/ssl/cmpcert.c b/security/nss/lib/ssl/cmpcert.c new file mode 100644 index 000000000..e6edbee83 --- /dev/null +++ b/security/nss/lib/ssl/cmpcert.c @@ -0,0 +1,89 @@ +/* + * NSS utility functions + * + * This Source Code Form is subject to the terms of the Mozilla Public + * License, v. 2.0. If a copy of the MPL was not distributed with this + * file, You can obtain one at http://mozilla.org/MPL/2.0/. */ + +#include <stdio.h> +#include <string.h> +#include "prerror.h" +#include "secitem.h" +#include "prnetdb.h" +#include "cert.h" +#include "nspr.h" +#include "secder.h" +#include "key.h" +#include "nss.h" + +/* + * Look to see if any of the signers in the cert chain for "cert" are found + * in the list of caNames. + * Returns SECSuccess if so, SECFailure if not. + */ +SECStatus +NSS_CmpCertChainWCANames(CERTCertificate *cert, CERTDistNames *caNames) +{ + SECItem *caname; + CERTCertificate *curcert; + CERTCertificate *oldcert; + PRInt32 contentlen; + int j; + int headerlen; + int depth; + SECStatus rv; + SECItem issuerName; + SECItem compatIssuerName; + + if (!cert || !caNames || !caNames->nnames || !caNames->names || + !caNames->names->data) + return SECFailure; + depth = 0; + curcert = CERT_DupCertificate(cert); + + while (curcert) { + issuerName = curcert->derIssuer; + + /* compute an alternate issuer name for compatibility with 2.0 + * enterprise server, which send the CA names without + * the outer layer of DER header + */ + rv = DER_Lengths(&issuerName, &headerlen, (PRUint32 *)&contentlen); + if (rv == SECSuccess) { + compatIssuerName.data = &issuerName.data[headerlen]; + compatIssuerName.len = issuerName.len - headerlen; + } else { + compatIssuerName.data = NULL; + compatIssuerName.len = 0; + } + + for (j = 0; j < caNames->nnames; j++) { + caname = &caNames->names[j]; + if (SECITEM_CompareItem(&issuerName, caname) == SECEqual) { + rv = SECSuccess; + CERT_DestroyCertificate(curcert); + goto done; + } else if (SECITEM_CompareItem(&compatIssuerName, caname) == SECEqual) { + rv = SECSuccess; + CERT_DestroyCertificate(curcert); + goto done; + } + } + if ((depth <= 20) && + (SECITEM_CompareItem(&curcert->derIssuer, &curcert->derSubject) != + SECEqual)) { + oldcert = curcert; + curcert = CERT_FindCertByName(curcert->dbhandle, + &curcert->derIssuer); + CERT_DestroyCertificate(oldcert); + depth++; + } else { + CERT_DestroyCertificate(curcert); + curcert = NULL; + } + } + rv = SECFailure; + +done: + return rv; +} diff --git a/security/nss/lib/ssl/config.mk b/security/nss/lib/ssl/config.mk new file mode 100644 index 000000000..339cc80df --- /dev/null +++ b/security/nss/lib/ssl/config.mk @@ -0,0 +1,71 @@ +# +# This Source Code Form is subject to the terms of the Mozilla Public +# License, v. 2.0. If a copy of the MPL was not distributed with this +# file, You can obtain one at http://mozilla.org/MPL/2.0/. + +ifdef NISCC_TEST +DEFINES += -DNISCC_TEST +endif + +ifeq (,$(filter-out WIN%,$(OS_TARGET))) + +# don't want the 32 in the shared library name +SHARED_LIBRARY = $(OBJDIR)/$(DLL_PREFIX)$(LIBRARY_NAME)$(LIBRARY_VERSION).$(DLL_SUFFIX) +IMPORT_LIBRARY = $(OBJDIR)/$(IMPORT_LIB_PREFIX)$(LIBRARY_NAME)$(LIBRARY_VERSION)$(IMPORT_LIB_SUFFIX) + +RES = $(OBJDIR)/ssl.res +RESNAME = ssl.rc + +ifdef NS_USE_GCC +EXTRA_SHARED_LIBS += \ + -L$(DIST)/lib \ + -lnss3 \ + -L$(NSSUTIL_LIB_DIR) \ + -lnssutil3 \ + -L$(NSPR_LIB_DIR) \ + -lplc4 \ + -lplds4 \ + -lnspr4 \ + $(NULL) +else # ! NS_USE_GCC +EXTRA_SHARED_LIBS += \ + $(DIST)/lib/nss3.lib \ + $(DIST)/lib/nssutil3.lib \ + $(NSPR_LIB_DIR)/$(NSPR31_LIB_PREFIX)plc4.lib \ + $(NSPR_LIB_DIR)/$(NSPR31_LIB_PREFIX)plds4.lib \ + $(NSPR_LIB_DIR)/$(NSPR31_LIB_PREFIX)nspr4.lib \ + $(NULL) +endif # NS_USE_GCC + +else + +# $(EXTRA_SHARED_LIBS) come before $(OS_LIBS), except on AIX. +EXTRA_SHARED_LIBS += \ + -L$(DIST)/lib \ + -lnss3 \ + -L$(NSSUTIL_LIB_DIR) \ + -lnssutil3 \ + -L$(NSPR_LIB_DIR) \ + -lplc4 \ + -lplds4 \ + -lnspr4 \ + $(NULL) + +ifeq ($(OS_ARCH), BeOS) +EXTRA_SHARED_LIBS += -lbe +endif + +endif + +ifdef NSS_SSL_ENABLE_ZLIB +DEFINES += -DNSS_SSL_ENABLE_ZLIB +include $(CORE_DEPTH)/coreconf/zlib.mk +endif + +ifndef NSS_ENABLE_TLS_1_3 +NSS_DISABLE_TLS_1_3=1 +endif + +ifdef NSS_DISABLE_TLS_1_3 +DEFINES += -DNSS_DISABLE_TLS_1_3 +endif diff --git a/security/nss/lib/ssl/dhe-param.c b/security/nss/lib/ssl/dhe-param.c new file mode 100644 index 000000000..ad87cc4f6 --- /dev/null +++ b/security/nss/lib/ssl/dhe-param.c @@ -0,0 +1,418 @@ +/* This Source Code Form is subject to the terms of the Mozilla Public + * License, v. 2.0. If a copy of the MPL was not distributed with this + * file, You can obtain one at http://mozilla.org/MPL/2.0/. */ + +static const unsigned char ff_dhe_g2[] = { 2 }; + +static const unsigned char ff_dhe_2048_p[] = { + 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, + 0xAD, 0xF8, 0x54, 0x58, 0xA2, 0xBB, 0x4A, 0x9A, + 0xAF, 0xDC, 0x56, 0x20, 0x27, 0x3D, 0x3C, 0xF1, + 0xD8, 0xB9, 0xC5, 0x83, 0xCE, 0x2D, 0x36, 0x95, + 0xA9, 0xE1, 0x36, 0x41, 0x14, 0x64, 0x33, 0xFB, + 0xCC, 0x93, 0x9D, 0xCE, 0x24, 0x9B, 0x3E, 0xF9, + 0x7D, 0x2F, 0xE3, 0x63, 0x63, 0x0C, 0x75, 0xD8, + 0xF6, 0x81, 0xB2, 0x02, 0xAE, 0xC4, 0x61, 0x7A, + 0xD3, 0xDF, 0x1E, 0xD5, 0xD5, 0xFD, 0x65, 0x61, + 0x24, 0x33, 0xF5, 0x1F, 0x5F, 0x06, 0x6E, 0xD0, + 0x85, 0x63, 0x65, 0x55, 0x3D, 0xED, 0x1A, 0xF3, + 0xB5, 0x57, 0x13, 0x5E, 0x7F, 0x57, 0xC9, 0x35, + 0x98, 0x4F, 0x0C, 0x70, 0xE0, 0xE6, 0x8B, 0x77, + 0xE2, 0xA6, 0x89, 0xDA, 0xF3, 0xEF, 0xE8, 0x72, + 0x1D, 0xF1, 0x58, 0xA1, 0x36, 0xAD, 0xE7, 0x35, + 0x30, 0xAC, 0xCA, 0x4F, 0x48, 0x3A, 0x79, 0x7A, + 0xBC, 0x0A, 0xB1, 0x82, 0xB3, 0x24, 0xFB, 0x61, + 0xD1, 0x08, 0xA9, 0x4B, 0xB2, 0xC8, 0xE3, 0xFB, + 0xB9, 0x6A, 0xDA, 0xB7, 0x60, 0xD7, 0xF4, 0x68, + 0x1D, 0x4F, 0x42, 0xA3, 0xDE, 0x39, 0x4D, 0xF4, + 0xAE, 0x56, 0xED, 0xE7, 0x63, 0x72, 0xBB, 0x19, + 0x0B, 0x07, 0xA7, 0xC8, 0xEE, 0x0A, 0x6D, 0x70, + 0x9E, 0x02, 0xFC, 0xE1, 0xCD, 0xF7, 0xE2, 0xEC, + 0xC0, 0x34, 0x04, 0xCD, 0x28, 0x34, 0x2F, 0x61, + 0x91, 0x72, 0xFE, 0x9C, 0xE9, 0x85, 0x83, 0xFF, + 0x8E, 0x4F, 0x12, 0x32, 0xEE, 0xF2, 0x81, 0x83, + 0xC3, 0xFE, 0x3B, 0x1B, 0x4C, 0x6F, 0xAD, 0x73, + 0x3B, 0xB5, 0xFC, 0xBC, 0x2E, 0xC2, 0x20, 0x05, + 0xC5, 0x8E, 0xF1, 0x83, 0x7D, 0x16, 0x83, 0xB2, + 0xC6, 0xF3, 0x4A, 0x26, 0xC1, 0xB2, 0xEF, 0xFA, + 0x88, 0x6B, 0x42, 0x38, 0x61, 0x28, 0x5C, 0x97, + 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, +}; + +static const ssl3DHParams ff_dhe_2048_params = { + ssl_grp_ffdhe_2048, + { siBuffer, (unsigned char *)ff_dhe_2048_p, sizeof(ff_dhe_2048_p) }, + { siBuffer, (unsigned char *)ff_dhe_g2, sizeof(ff_dhe_g2) }, +}; + +static const unsigned char ff_dhe_3072_p[] = { + 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, + 0xAD, 0xF8, 0x54, 0x58, 0xA2, 0xBB, 0x4A, 0x9A, + 0xAF, 0xDC, 0x56, 0x20, 0x27, 0x3D, 0x3C, 0xF1, + 0xD8, 0xB9, 0xC5, 0x83, 0xCE, 0x2D, 0x36, 0x95, + 0xA9, 0xE1, 0x36, 0x41, 0x14, 0x64, 0x33, 0xFB, + 0xCC, 0x93, 0x9D, 0xCE, 0x24, 0x9B, 0x3E, 0xF9, + 0x7D, 0x2F, 0xE3, 0x63, 0x63, 0x0C, 0x75, 0xD8, + 0xF6, 0x81, 0xB2, 0x02, 0xAE, 0xC4, 0x61, 0x7A, + 0xD3, 0xDF, 0x1E, 0xD5, 0xD5, 0xFD, 0x65, 0x61, + 0x24, 0x33, 0xF5, 0x1F, 0x5F, 0x06, 0x6E, 0xD0, + 0x85, 0x63, 0x65, 0x55, 0x3D, 0xED, 0x1A, 0xF3, + 0xB5, 0x57, 0x13, 0x5E, 0x7F, 0x57, 0xC9, 0x35, + 0x98, 0x4F, 0x0C, 0x70, 0xE0, 0xE6, 0x8B, 0x77, + 0xE2, 0xA6, 0x89, 0xDA, 0xF3, 0xEF, 0xE8, 0x72, + 0x1D, 0xF1, 0x58, 0xA1, 0x36, 0xAD, 0xE7, 0x35, + 0x30, 0xAC, 0xCA, 0x4F, 0x48, 0x3A, 0x79, 0x7A, + 0xBC, 0x0A, 0xB1, 0x82, 0xB3, 0x24, 0xFB, 0x61, + 0xD1, 0x08, 0xA9, 0x4B, 0xB2, 0xC8, 0xE3, 0xFB, + 0xB9, 0x6A, 0xDA, 0xB7, 0x60, 0xD7, 0xF4, 0x68, + 0x1D, 0x4F, 0x42, 0xA3, 0xDE, 0x39, 0x4D, 0xF4, + 0xAE, 0x56, 0xED, 0xE7, 0x63, 0x72, 0xBB, 0x19, + 0x0B, 0x07, 0xA7, 0xC8, 0xEE, 0x0A, 0x6D, 0x70, + 0x9E, 0x02, 0xFC, 0xE1, 0xCD, 0xF7, 0xE2, 0xEC, + 0xC0, 0x34, 0x04, 0xCD, 0x28, 0x34, 0x2F, 0x61, + 0x91, 0x72, 0xFE, 0x9C, 0xE9, 0x85, 0x83, 0xFF, + 0x8E, 0x4F, 0x12, 0x32, 0xEE, 0xF2, 0x81, 0x83, + 0xC3, 0xFE, 0x3B, 0x1B, 0x4C, 0x6F, 0xAD, 0x73, + 0x3B, 0xB5, 0xFC, 0xBC, 0x2E, 0xC2, 0x20, 0x05, + 0xC5, 0x8E, 0xF1, 0x83, 0x7D, 0x16, 0x83, 0xB2, + 0xC6, 0xF3, 0x4A, 0x26, 0xC1, 0xB2, 0xEF, 0xFA, + 0x88, 0x6B, 0x42, 0x38, 0x61, 0x1F, 0xCF, 0xDC, + 0xDE, 0x35, 0x5B, 0x3B, 0x65, 0x19, 0x03, 0x5B, + 0xBC, 0x34, 0xF4, 0xDE, 0xF9, 0x9C, 0x02, 0x38, + 0x61, 0xB4, 0x6F, 0xC9, 0xD6, 0xE6, 0xC9, 0x07, + 0x7A, 0xD9, 0x1D, 0x26, 0x91, 0xF7, 0xF7, 0xEE, + 0x59, 0x8C, 0xB0, 0xFA, 0xC1, 0x86, 0xD9, 0x1C, + 0xAE, 0xFE, 0x13, 0x09, 0x85, 0x13, 0x92, 0x70, + 0xB4, 0x13, 0x0C, 0x93, 0xBC, 0x43, 0x79, 0x44, + 0xF4, 0xFD, 0x44, 0x52, 0xE2, 0xD7, 0x4D, 0xD3, + 0x64, 0xF2, 0xE2, 0x1E, 0x71, 0xF5, 0x4B, 0xFF, + 0x5C, 0xAE, 0x82, 0xAB, 0x9C, 0x9D, 0xF6, 0x9E, + 0xE8, 0x6D, 0x2B, 0xC5, 0x22, 0x36, 0x3A, 0x0D, + 0xAB, 0xC5, 0x21, 0x97, 0x9B, 0x0D, 0xEA, 0xDA, + 0x1D, 0xBF, 0x9A, 0x42, 0xD5, 0xC4, 0x48, 0x4E, + 0x0A, 0xBC, 0xD0, 0x6B, 0xFA, 0x53, 0xDD, 0xEF, + 0x3C, 0x1B, 0x20, 0xEE, 0x3F, 0xD5, 0x9D, 0x7C, + 0x25, 0xE4, 0x1D, 0x2B, 0x66, 0xC6, 0x2E, 0x37, + 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, +}; + +static const ssl3DHParams ff_dhe_3072_params = { + ssl_grp_ffdhe_3072, + { siBuffer, (unsigned char *)ff_dhe_3072_p, sizeof(ff_dhe_3072_p) }, + { siBuffer, (unsigned char *)ff_dhe_g2, sizeof(ff_dhe_g2) }, +}; + +static const unsigned char ff_dhe_4096_p[] = { + 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, + 0xAD, 0xF8, 0x54, 0x58, 0xA2, 0xBB, 0x4A, 0x9A, + 0xAF, 0xDC, 0x56, 0x20, 0x27, 0x3D, 0x3C, 0xF1, + 0xD8, 0xB9, 0xC5, 0x83, 0xCE, 0x2D, 0x36, 0x95, + 0xA9, 0xE1, 0x36, 0x41, 0x14, 0x64, 0x33, 0xFB, + 0xCC, 0x93, 0x9D, 0xCE, 0x24, 0x9B, 0x3E, 0xF9, + 0x7D, 0x2F, 0xE3, 0x63, 0x63, 0x0C, 0x75, 0xD8, + 0xF6, 0x81, 0xB2, 0x02, 0xAE, 0xC4, 0x61, 0x7A, + 0xD3, 0xDF, 0x1E, 0xD5, 0xD5, 0xFD, 0x65, 0x61, + 0x24, 0x33, 0xF5, 0x1F, 0x5F, 0x06, 0x6E, 0xD0, + 0x85, 0x63, 0x65, 0x55, 0x3D, 0xED, 0x1A, 0xF3, + 0xB5, 0x57, 0x13, 0x5E, 0x7F, 0x57, 0xC9, 0x35, + 0x98, 0x4F, 0x0C, 0x70, 0xE0, 0xE6, 0x8B, 0x77, + 0xE2, 0xA6, 0x89, 0xDA, 0xF3, 0xEF, 0xE8, 0x72, + 0x1D, 0xF1, 0x58, 0xA1, 0x36, 0xAD, 0xE7, 0x35, + 0x30, 0xAC, 0xCA, 0x4F, 0x48, 0x3A, 0x79, 0x7A, + 0xBC, 0x0A, 0xB1, 0x82, 0xB3, 0x24, 0xFB, 0x61, + 0xD1, 0x08, 0xA9, 0x4B, 0xB2, 0xC8, 0xE3, 0xFB, + 0xB9, 0x6A, 0xDA, 0xB7, 0x60, 0xD7, 0xF4, 0x68, + 0x1D, 0x4F, 0x42, 0xA3, 0xDE, 0x39, 0x4D, 0xF4, + 0xAE, 0x56, 0xED, 0xE7, 0x63, 0x72, 0xBB, 0x19, + 0x0B, 0x07, 0xA7, 0xC8, 0xEE, 0x0A, 0x6D, 0x70, + 0x9E, 0x02, 0xFC, 0xE1, 0xCD, 0xF7, 0xE2, 0xEC, + 0xC0, 0x34, 0x04, 0xCD, 0x28, 0x34, 0x2F, 0x61, + 0x91, 0x72, 0xFE, 0x9C, 0xE9, 0x85, 0x83, 0xFF, + 0x8E, 0x4F, 0x12, 0x32, 0xEE, 0xF2, 0x81, 0x83, + 0xC3, 0xFE, 0x3B, 0x1B, 0x4C, 0x6F, 0xAD, 0x73, + 0x3B, 0xB5, 0xFC, 0xBC, 0x2E, 0xC2, 0x20, 0x05, + 0xC5, 0x8E, 0xF1, 0x83, 0x7D, 0x16, 0x83, 0xB2, + 0xC6, 0xF3, 0x4A, 0x26, 0xC1, 0xB2, 0xEF, 0xFA, + 0x88, 0x6B, 0x42, 0x38, 0x61, 0x1F, 0xCF, 0xDC, + 0xDE, 0x35, 0x5B, 0x3B, 0x65, 0x19, 0x03, 0x5B, + 0xBC, 0x34, 0xF4, 0xDE, 0xF9, 0x9C, 0x02, 0x38, + 0x61, 0xB4, 0x6F, 0xC9, 0xD6, 0xE6, 0xC9, 0x07, + 0x7A, 0xD9, 0x1D, 0x26, 0x91, 0xF7, 0xF7, 0xEE, + 0x59, 0x8C, 0xB0, 0xFA, 0xC1, 0x86, 0xD9, 0x1C, + 0xAE, 0xFE, 0x13, 0x09, 0x85, 0x13, 0x92, 0x70, + 0xB4, 0x13, 0x0C, 0x93, 0xBC, 0x43, 0x79, 0x44, + 0xF4, 0xFD, 0x44, 0x52, 0xE2, 0xD7, 0x4D, 0xD3, + 0x64, 0xF2, 0xE2, 0x1E, 0x71, 0xF5, 0x4B, 0xFF, + 0x5C, 0xAE, 0x82, 0xAB, 0x9C, 0x9D, 0xF6, 0x9E, + 0xE8, 0x6D, 0x2B, 0xC5, 0x22, 0x36, 0x3A, 0x0D, + 0xAB, 0xC5, 0x21, 0x97, 0x9B, 0x0D, 0xEA, 0xDA, + 0x1D, 0xBF, 0x9A, 0x42, 0xD5, 0xC4, 0x48, 0x4E, + 0x0A, 0xBC, 0xD0, 0x6B, 0xFA, 0x53, 0xDD, 0xEF, + 0x3C, 0x1B, 0x20, 0xEE, 0x3F, 0xD5, 0x9D, 0x7C, + 0x25, 0xE4, 0x1D, 0x2B, 0x66, 0x9E, 0x1E, 0xF1, + 0x6E, 0x6F, 0x52, 0xC3, 0x16, 0x4D, 0xF4, 0xFB, + 0x79, 0x30, 0xE9, 0xE4, 0xE5, 0x88, 0x57, 0xB6, + 0xAC, 0x7D, 0x5F, 0x42, 0xD6, 0x9F, 0x6D, 0x18, + 0x77, 0x63, 0xCF, 0x1D, 0x55, 0x03, 0x40, 0x04, + 0x87, 0xF5, 0x5B, 0xA5, 0x7E, 0x31, 0xCC, 0x7A, + 0x71, 0x35, 0xC8, 0x86, 0xEF, 0xB4, 0x31, 0x8A, + 0xED, 0x6A, 0x1E, 0x01, 0x2D, 0x9E, 0x68, 0x32, + 0xA9, 0x07, 0x60, 0x0A, 0x91, 0x81, 0x30, 0xC4, + 0x6D, 0xC7, 0x78, 0xF9, 0x71, 0xAD, 0x00, 0x38, + 0x09, 0x29, 0x99, 0xA3, 0x33, 0xCB, 0x8B, 0x7A, + 0x1A, 0x1D, 0xB9, 0x3D, 0x71, 0x40, 0x00, 0x3C, + 0x2A, 0x4E, 0xCE, 0xA9, 0xF9, 0x8D, 0x0A, 0xCC, + 0x0A, 0x82, 0x91, 0xCD, 0xCE, 0xC9, 0x7D, 0xCF, + 0x8E, 0xC9, 0xB5, 0x5A, 0x7F, 0x88, 0xA4, 0x6B, + 0x4D, 0xB5, 0xA8, 0x51, 0xF4, 0x41, 0x82, 0xE1, + 0xC6, 0x8A, 0x00, 0x7E, 0x5E, 0x65, 0x5F, 0x6A, + 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, +}; + +static const ssl3DHParams ff_dhe_4096_params = { + ssl_grp_ffdhe_4096, + { siBuffer, (unsigned char *)ff_dhe_4096_p, sizeof(ff_dhe_4096_p) }, + { siBuffer, (unsigned char *)ff_dhe_g2, sizeof(ff_dhe_g2) }, +}; + +static const unsigned char ff_dhe_6144_p[] = { + 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, + 0xAD, 0xF8, 0x54, 0x58, 0xA2, 0xBB, 0x4A, 0x9A, + 0xAF, 0xDC, 0x56, 0x20, 0x27, 0x3D, 0x3C, 0xF1, + 0xD8, 0xB9, 0xC5, 0x83, 0xCE, 0x2D, 0x36, 0x95, + 0xA9, 0xE1, 0x36, 0x41, 0x14, 0x64, 0x33, 0xFB, + 0xCC, 0x93, 0x9D, 0xCE, 0x24, 0x9B, 0x3E, 0xF9, + 0x7D, 0x2F, 0xE3, 0x63, 0x63, 0x0C, 0x75, 0xD8, + 0xF6, 0x81, 0xB2, 0x02, 0xAE, 0xC4, 0x61, 0x7A, + 0xD3, 0xDF, 0x1E, 0xD5, 0xD5, 0xFD, 0x65, 0x61, + 0x24, 0x33, 0xF5, 0x1F, 0x5F, 0x06, 0x6E, 0xD0, + 0x85, 0x63, 0x65, 0x55, 0x3D, 0xED, 0x1A, 0xF3, + 0xB5, 0x57, 0x13, 0x5E, 0x7F, 0x57, 0xC9, 0x35, + 0x98, 0x4F, 0x0C, 0x70, 0xE0, 0xE6, 0x8B, 0x77, + 0xE2, 0xA6, 0x89, 0xDA, 0xF3, 0xEF, 0xE8, 0x72, + 0x1D, 0xF1, 0x58, 0xA1, 0x36, 0xAD, 0xE7, 0x35, + 0x30, 0xAC, 0xCA, 0x4F, 0x48, 0x3A, 0x79, 0x7A, + 0xBC, 0x0A, 0xB1, 0x82, 0xB3, 0x24, 0xFB, 0x61, + 0xD1, 0x08, 0xA9, 0x4B, 0xB2, 0xC8, 0xE3, 0xFB, + 0xB9, 0x6A, 0xDA, 0xB7, 0x60, 0xD7, 0xF4, 0x68, + 0x1D, 0x4F, 0x42, 0xA3, 0xDE, 0x39, 0x4D, 0xF4, + 0xAE, 0x56, 0xED, 0xE7, 0x63, 0x72, 0xBB, 0x19, + 0x0B, 0x07, 0xA7, 0xC8, 0xEE, 0x0A, 0x6D, 0x70, + 0x9E, 0x02, 0xFC, 0xE1, 0xCD, 0xF7, 0xE2, 0xEC, + 0xC0, 0x34, 0x04, 0xCD, 0x28, 0x34, 0x2F, 0x61, + 0x91, 0x72, 0xFE, 0x9C, 0xE9, 0x85, 0x83, 0xFF, + 0x8E, 0x4F, 0x12, 0x32, 0xEE, 0xF2, 0x81, 0x83, + 0xC3, 0xFE, 0x3B, 0x1B, 0x4C, 0x6F, 0xAD, 0x73, + 0x3B, 0xB5, 0xFC, 0xBC, 0x2E, 0xC2, 0x20, 0x05, + 0xC5, 0x8E, 0xF1, 0x83, 0x7D, 0x16, 0x83, 0xB2, + 0xC6, 0xF3, 0x4A, 0x26, 0xC1, 0xB2, 0xEF, 0xFA, + 0x88, 0x6B, 0x42, 0x38, 0x61, 0x1F, 0xCF, 0xDC, + 0xDE, 0x35, 0x5B, 0x3B, 0x65, 0x19, 0x03, 0x5B, + 0xBC, 0x34, 0xF4, 0xDE, 0xF9, 0x9C, 0x02, 0x38, + 0x61, 0xB4, 0x6F, 0xC9, 0xD6, 0xE6, 0xC9, 0x07, + 0x7A, 0xD9, 0x1D, 0x26, 0x91, 0xF7, 0xF7, 0xEE, + 0x59, 0x8C, 0xB0, 0xFA, 0xC1, 0x86, 0xD9, 0x1C, + 0xAE, 0xFE, 0x13, 0x09, 0x85, 0x13, 0x92, 0x70, + 0xB4, 0x13, 0x0C, 0x93, 0xBC, 0x43, 0x79, 0x44, + 0xF4, 0xFD, 0x44, 0x52, 0xE2, 0xD7, 0x4D, 0xD3, + 0x64, 0xF2, 0xE2, 0x1E, 0x71, 0xF5, 0x4B, 0xFF, + 0x5C, 0xAE, 0x82, 0xAB, 0x9C, 0x9D, 0xF6, 0x9E, + 0xE8, 0x6D, 0x2B, 0xC5, 0x22, 0x36, 0x3A, 0x0D, + 0xAB, 0xC5, 0x21, 0x97, 0x9B, 0x0D, 0xEA, 0xDA, + 0x1D, 0xBF, 0x9A, 0x42, 0xD5, 0xC4, 0x48, 0x4E, + 0x0A, 0xBC, 0xD0, 0x6B, 0xFA, 0x53, 0xDD, 0xEF, + 0x3C, 0x1B, 0x20, 0xEE, 0x3F, 0xD5, 0x9D, 0x7C, + 0x25, 0xE4, 0x1D, 0x2B, 0x66, 0x9E, 0x1E, 0xF1, + 0x6E, 0x6F, 0x52, 0xC3, 0x16, 0x4D, 0xF4, 0xFB, + 0x79, 0x30, 0xE9, 0xE4, 0xE5, 0x88, 0x57, 0xB6, + 0xAC, 0x7D, 0x5F, 0x42, 0xD6, 0x9F, 0x6D, 0x18, + 0x77, 0x63, 0xCF, 0x1D, 0x55, 0x03, 0x40, 0x04, + 0x87, 0xF5, 0x5B, 0xA5, 0x7E, 0x31, 0xCC, 0x7A, + 0x71, 0x35, 0xC8, 0x86, 0xEF, 0xB4, 0x31, 0x8A, + 0xED, 0x6A, 0x1E, 0x01, 0x2D, 0x9E, 0x68, 0x32, + 0xA9, 0x07, 0x60, 0x0A, 0x91, 0x81, 0x30, 0xC4, + 0x6D, 0xC7, 0x78, 0xF9, 0x71, 0xAD, 0x00, 0x38, + 0x09, 0x29, 0x99, 0xA3, 0x33, 0xCB, 0x8B, 0x7A, + 0x1A, 0x1D, 0xB9, 0x3D, 0x71, 0x40, 0x00, 0x3C, + 0x2A, 0x4E, 0xCE, 0xA9, 0xF9, 0x8D, 0x0A, 0xCC, + 0x0A, 0x82, 0x91, 0xCD, 0xCE, 0xC9, 0x7D, 0xCF, + 0x8E, 0xC9, 0xB5, 0x5A, 0x7F, 0x88, 0xA4, 0x6B, + 0x4D, 0xB5, 0xA8, 0x51, 0xF4, 0x41, 0x82, 0xE1, + 0xC6, 0x8A, 0x00, 0x7E, 0x5E, 0x0D, 0xD9, 0x02, + 0x0B, 0xFD, 0x64, 0xB6, 0x45, 0x03, 0x6C, 0x7A, + 0x4E, 0x67, 0x7D, 0x2C, 0x38, 0x53, 0x2A, 0x3A, + 0x23, 0xBA, 0x44, 0x42, 0xCA, 0xF5, 0x3E, 0xA6, + 0x3B, 0xB4, 0x54, 0x32, 0x9B, 0x76, 0x24, 0xC8, + 0x91, 0x7B, 0xDD, 0x64, 0xB1, 0xC0, 0xFD, 0x4C, + 0xB3, 0x8E, 0x8C, 0x33, 0x4C, 0x70, 0x1C, 0x3A, + 0xCD, 0xAD, 0x06, 0x57, 0xFC, 0xCF, 0xEC, 0x71, + 0x9B, 0x1F, 0x5C, 0x3E, 0x4E, 0x46, 0x04, 0x1F, + 0x38, 0x81, 0x47, 0xFB, 0x4C, 0xFD, 0xB4, 0x77, + 0xA5, 0x24, 0x71, 0xF7, 0xA9, 0xA9, 0x69, 0x10, + 0xB8, 0x55, 0x32, 0x2E, 0xDB, 0x63, 0x40, 0xD8, + 0xA0, 0x0E, 0xF0, 0x92, 0x35, 0x05, 0x11, 0xE3, + 0x0A, 0xBE, 0xC1, 0xFF, 0xF9, 0xE3, 0xA2, 0x6E, + 0x7F, 0xB2, 0x9F, 0x8C, 0x18, 0x30, 0x23, 0xC3, + 0x58, 0x7E, 0x38, 0xDA, 0x00, 0x77, 0xD9, 0xB4, + 0x76, 0x3E, 0x4E, 0x4B, 0x94, 0xB2, 0xBB, 0xC1, + 0x94, 0xC6, 0x65, 0x1E, 0x77, 0xCA, 0xF9, 0x92, + 0xEE, 0xAA, 0xC0, 0x23, 0x2A, 0x28, 0x1B, 0xF6, + 0xB3, 0xA7, 0x39, 0xC1, 0x22, 0x61, 0x16, 0x82, + 0x0A, 0xE8, 0xDB, 0x58, 0x47, 0xA6, 0x7C, 0xBE, + 0xF9, 0xC9, 0x09, 0x1B, 0x46, 0x2D, 0x53, 0x8C, + 0xD7, 0x2B, 0x03, 0x74, 0x6A, 0xE7, 0x7F, 0x5E, + 0x62, 0x29, 0x2C, 0x31, 0x15, 0x62, 0xA8, 0x46, + 0x50, 0x5D, 0xC8, 0x2D, 0xB8, 0x54, 0x33, 0x8A, + 0xE4, 0x9F, 0x52, 0x35, 0xC9, 0x5B, 0x91, 0x17, + 0x8C, 0xCF, 0x2D, 0xD5, 0xCA, 0xCE, 0xF4, 0x03, + 0xEC, 0x9D, 0x18, 0x10, 0xC6, 0x27, 0x2B, 0x04, + 0x5B, 0x3B, 0x71, 0xF9, 0xDC, 0x6B, 0x80, 0xD6, + 0x3F, 0xDD, 0x4A, 0x8E, 0x9A, 0xDB, 0x1E, 0x69, + 0x62, 0xA6, 0x95, 0x26, 0xD4, 0x31, 0x61, 0xC1, + 0xA4, 0x1D, 0x57, 0x0D, 0x79, 0x38, 0xDA, 0xD4, + 0xA4, 0x0E, 0x32, 0x9C, 0xD0, 0xE4, 0x0E, 0x65, + 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, +}; + +static const ssl3DHParams ff_dhe_6144_params = { + ssl_grp_ffdhe_6144, + { siBuffer, (unsigned char *)ff_dhe_6144_p, sizeof(ff_dhe_6144_p) }, + { siBuffer, (unsigned char *)ff_dhe_g2, sizeof(ff_dhe_g2) }, +}; + +static const unsigned char ff_dhe_8192_p[] = { + 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, + 0xAD, 0xF8, 0x54, 0x58, 0xA2, 0xBB, 0x4A, 0x9A, + 0xAF, 0xDC, 0x56, 0x20, 0x27, 0x3D, 0x3C, 0xF1, + 0xD8, 0xB9, 0xC5, 0x83, 0xCE, 0x2D, 0x36, 0x95, + 0xA9, 0xE1, 0x36, 0x41, 0x14, 0x64, 0x33, 0xFB, + 0xCC, 0x93, 0x9D, 0xCE, 0x24, 0x9B, 0x3E, 0xF9, + 0x7D, 0x2F, 0xE3, 0x63, 0x63, 0x0C, 0x75, 0xD8, + 0xF6, 0x81, 0xB2, 0x02, 0xAE, 0xC4, 0x61, 0x7A, + 0xD3, 0xDF, 0x1E, 0xD5, 0xD5, 0xFD, 0x65, 0x61, + 0x24, 0x33, 0xF5, 0x1F, 0x5F, 0x06, 0x6E, 0xD0, + 0x85, 0x63, 0x65, 0x55, 0x3D, 0xED, 0x1A, 0xF3, + 0xB5, 0x57, 0x13, 0x5E, 0x7F, 0x57, 0xC9, 0x35, + 0x98, 0x4F, 0x0C, 0x70, 0xE0, 0xE6, 0x8B, 0x77, + 0xE2, 0xA6, 0x89, 0xDA, 0xF3, 0xEF, 0xE8, 0x72, + 0x1D, 0xF1, 0x58, 0xA1, 0x36, 0xAD, 0xE7, 0x35, + 0x30, 0xAC, 0xCA, 0x4F, 0x48, 0x3A, 0x79, 0x7A, + 0xBC, 0x0A, 0xB1, 0x82, 0xB3, 0x24, 0xFB, 0x61, + 0xD1, 0x08, 0xA9, 0x4B, 0xB2, 0xC8, 0xE3, 0xFB, + 0xB9, 0x6A, 0xDA, 0xB7, 0x60, 0xD7, 0xF4, 0x68, + 0x1D, 0x4F, 0x42, 0xA3, 0xDE, 0x39, 0x4D, 0xF4, + 0xAE, 0x56, 0xED, 0xE7, 0x63, 0x72, 0xBB, 0x19, + 0x0B, 0x07, 0xA7, 0xC8, 0xEE, 0x0A, 0x6D, 0x70, + 0x9E, 0x02, 0xFC, 0xE1, 0xCD, 0xF7, 0xE2, 0xEC, + 0xC0, 0x34, 0x04, 0xCD, 0x28, 0x34, 0x2F, 0x61, + 0x91, 0x72, 0xFE, 0x9C, 0xE9, 0x85, 0x83, 0xFF, + 0x8E, 0x4F, 0x12, 0x32, 0xEE, 0xF2, 0x81, 0x83, + 0xC3, 0xFE, 0x3B, 0x1B, 0x4C, 0x6F, 0xAD, 0x73, + 0x3B, 0xB5, 0xFC, 0xBC, 0x2E, 0xC2, 0x20, 0x05, + 0xC5, 0x8E, 0xF1, 0x83, 0x7D, 0x16, 0x83, 0xB2, + 0xC6, 0xF3, 0x4A, 0x26, 0xC1, 0xB2, 0xEF, 0xFA, + 0x88, 0x6B, 0x42, 0x38, 0x61, 0x1F, 0xCF, 0xDC, + 0xDE, 0x35, 0x5B, 0x3B, 0x65, 0x19, 0x03, 0x5B, + 0xBC, 0x34, 0xF4, 0xDE, 0xF9, 0x9C, 0x02, 0x38, + 0x61, 0xB4, 0x6F, 0xC9, 0xD6, 0xE6, 0xC9, 0x07, + 0x7A, 0xD9, 0x1D, 0x26, 0x91, 0xF7, 0xF7, 0xEE, + 0x59, 0x8C, 0xB0, 0xFA, 0xC1, 0x86, 0xD9, 0x1C, + 0xAE, 0xFE, 0x13, 0x09, 0x85, 0x13, 0x92, 0x70, + 0xB4, 0x13, 0x0C, 0x93, 0xBC, 0x43, 0x79, 0x44, + 0xF4, 0xFD, 0x44, 0x52, 0xE2, 0xD7, 0x4D, 0xD3, + 0x64, 0xF2, 0xE2, 0x1E, 0x71, 0xF5, 0x4B, 0xFF, + 0x5C, 0xAE, 0x82, 0xAB, 0x9C, 0x9D, 0xF6, 0x9E, + 0xE8, 0x6D, 0x2B, 0xC5, 0x22, 0x36, 0x3A, 0x0D, + 0xAB, 0xC5, 0x21, 0x97, 0x9B, 0x0D, 0xEA, 0xDA, + 0x1D, 0xBF, 0x9A, 0x42, 0xD5, 0xC4, 0x48, 0x4E, + 0x0A, 0xBC, 0xD0, 0x6B, 0xFA, 0x53, 0xDD, 0xEF, + 0x3C, 0x1B, 0x20, 0xEE, 0x3F, 0xD5, 0x9D, 0x7C, + 0x25, 0xE4, 0x1D, 0x2B, 0x66, 0x9E, 0x1E, 0xF1, + 0x6E, 0x6F, 0x52, 0xC3, 0x16, 0x4D, 0xF4, 0xFB, + 0x79, 0x30, 0xE9, 0xE4, 0xE5, 0x88, 0x57, 0xB6, + 0xAC, 0x7D, 0x5F, 0x42, 0xD6, 0x9F, 0x6D, 0x18, + 0x77, 0x63, 0xCF, 0x1D, 0x55, 0x03, 0x40, 0x04, + 0x87, 0xF5, 0x5B, 0xA5, 0x7E, 0x31, 0xCC, 0x7A, + 0x71, 0x35, 0xC8, 0x86, 0xEF, 0xB4, 0x31, 0x8A, + 0xED, 0x6A, 0x1E, 0x01, 0x2D, 0x9E, 0x68, 0x32, + 0xA9, 0x07, 0x60, 0x0A, 0x91, 0x81, 0x30, 0xC4, + 0x6D, 0xC7, 0x78, 0xF9, 0x71, 0xAD, 0x00, 0x38, + 0x09, 0x29, 0x99, 0xA3, 0x33, 0xCB, 0x8B, 0x7A, + 0x1A, 0x1D, 0xB9, 0x3D, 0x71, 0x40, 0x00, 0x3C, + 0x2A, 0x4E, 0xCE, 0xA9, 0xF9, 0x8D, 0x0A, 0xCC, + 0x0A, 0x82, 0x91, 0xCD, 0xCE, 0xC9, 0x7D, 0xCF, + 0x8E, 0xC9, 0xB5, 0x5A, 0x7F, 0x88, 0xA4, 0x6B, + 0x4D, 0xB5, 0xA8, 0x51, 0xF4, 0x41, 0x82, 0xE1, + 0xC6, 0x8A, 0x00, 0x7E, 0x5E, 0x0D, 0xD9, 0x02, + 0x0B, 0xFD, 0x64, 0xB6, 0x45, 0x03, 0x6C, 0x7A, + 0x4E, 0x67, 0x7D, 0x2C, 0x38, 0x53, 0x2A, 0x3A, + 0x23, 0xBA, 0x44, 0x42, 0xCA, 0xF5, 0x3E, 0xA6, + 0x3B, 0xB4, 0x54, 0x32, 0x9B, 0x76, 0x24, 0xC8, + 0x91, 0x7B, 0xDD, 0x64, 0xB1, 0xC0, 0xFD, 0x4C, + 0xB3, 0x8E, 0x8C, 0x33, 0x4C, 0x70, 0x1C, 0x3A, + 0xCD, 0xAD, 0x06, 0x57, 0xFC, 0xCF, 0xEC, 0x71, + 0x9B, 0x1F, 0x5C, 0x3E, 0x4E, 0x46, 0x04, 0x1F, + 0x38, 0x81, 0x47, 0xFB, 0x4C, 0xFD, 0xB4, 0x77, + 0xA5, 0x24, 0x71, 0xF7, 0xA9, 0xA9, 0x69, 0x10, + 0xB8, 0x55, 0x32, 0x2E, 0xDB, 0x63, 0x40, 0xD8, + 0xA0, 0x0E, 0xF0, 0x92, 0x35, 0x05, 0x11, 0xE3, + 0x0A, 0xBE, 0xC1, 0xFF, 0xF9, 0xE3, 0xA2, 0x6E, + 0x7F, 0xB2, 0x9F, 0x8C, 0x18, 0x30, 0x23, 0xC3, + 0x58, 0x7E, 0x38, 0xDA, 0x00, 0x77, 0xD9, 0xB4, + 0x76, 0x3E, 0x4E, 0x4B, 0x94, 0xB2, 0xBB, 0xC1, + 0x94, 0xC6, 0x65, 0x1E, 0x77, 0xCA, 0xF9, 0x92, + 0xEE, 0xAA, 0xC0, 0x23, 0x2A, 0x28, 0x1B, 0xF6, + 0xB3, 0xA7, 0x39, 0xC1, 0x22, 0x61, 0x16, 0x82, + 0x0A, 0xE8, 0xDB, 0x58, 0x47, 0xA6, 0x7C, 0xBE, + 0xF9, 0xC9, 0x09, 0x1B, 0x46, 0x2D, 0x53, 0x8C, + 0xD7, 0x2B, 0x03, 0x74, 0x6A, 0xE7, 0x7F, 0x5E, + 0x62, 0x29, 0x2C, 0x31, 0x15, 0x62, 0xA8, 0x46, + 0x50, 0x5D, 0xC8, 0x2D, 0xB8, 0x54, 0x33, 0x8A, + 0xE4, 0x9F, 0x52, 0x35, 0xC9, 0x5B, 0x91, 0x17, + 0x8C, 0xCF, 0x2D, 0xD5, 0xCA, 0xCE, 0xF4, 0x03, + 0xEC, 0x9D, 0x18, 0x10, 0xC6, 0x27, 0x2B, 0x04, + 0x5B, 0x3B, 0x71, 0xF9, 0xDC, 0x6B, 0x80, 0xD6, + 0x3F, 0xDD, 0x4A, 0x8E, 0x9A, 0xDB, 0x1E, 0x69, + 0x62, 0xA6, 0x95, 0x26, 0xD4, 0x31, 0x61, 0xC1, + 0xA4, 0x1D, 0x57, 0x0D, 0x79, 0x38, 0xDA, 0xD4, + 0xA4, 0x0E, 0x32, 0x9C, 0xCF, 0xF4, 0x6A, 0xAA, + 0x36, 0xAD, 0x00, 0x4C, 0xF6, 0x00, 0xC8, 0x38, + 0x1E, 0x42, 0x5A, 0x31, 0xD9, 0x51, 0xAE, 0x64, + 0xFD, 0xB2, 0x3F, 0xCE, 0xC9, 0x50, 0x9D, 0x43, + 0x68, 0x7F, 0xEB, 0x69, 0xED, 0xD1, 0xCC, 0x5E, + 0x0B, 0x8C, 0xC3, 0xBD, 0xF6, 0x4B, 0x10, 0xEF, + 0x86, 0xB6, 0x31, 0x42, 0xA3, 0xAB, 0x88, 0x29, + 0x55, 0x5B, 0x2F, 0x74, 0x7C, 0x93, 0x26, 0x65, + 0xCB, 0x2C, 0x0F, 0x1C, 0xC0, 0x1B, 0xD7, 0x02, + 0x29, 0x38, 0x88, 0x39, 0xD2, 0xAF, 0x05, 0xE4, + 0x54, 0x50, 0x4A, 0xC7, 0x8B, 0x75, 0x82, 0x82, + 0x28, 0x46, 0xC0, 0xBA, 0x35, 0xC3, 0x5F, 0x5C, + 0x59, 0x16, 0x0C, 0xC0, 0x46, 0xFD, 0x82, 0x51, + 0x54, 0x1F, 0xC6, 0x8C, 0x9C, 0x86, 0xB0, 0x22, + 0xBB, 0x70, 0x99, 0x87, 0x6A, 0x46, 0x0E, 0x74, + 0x51, 0xA8, 0xA9, 0x31, 0x09, 0x70, 0x3F, 0xEE, + 0x1C, 0x21, 0x7E, 0x6C, 0x38, 0x26, 0xE5, 0x2C, + 0x51, 0xAA, 0x69, 0x1E, 0x0E, 0x42, 0x3C, 0xFC, + 0x99, 0xE9, 0xE3, 0x16, 0x50, 0xC1, 0x21, 0x7B, + 0x62, 0x48, 0x16, 0xCD, 0xAD, 0x9A, 0x95, 0xF9, + 0xD5, 0xB8, 0x01, 0x94, 0x88, 0xD9, 0xC0, 0xA0, + 0xA1, 0xFE, 0x30, 0x75, 0xA5, 0x77, 0xE2, 0x31, + 0x83, 0xF8, 0x1D, 0x4A, 0x3F, 0x2F, 0xA4, 0x57, + 0x1E, 0xFC, 0x8C, 0xE0, 0xBA, 0x8A, 0x4F, 0xE8, + 0xB6, 0x85, 0x5D, 0xFE, 0x72, 0xB0, 0xA6, 0x6E, + 0xDE, 0xD2, 0xFB, 0xAB, 0xFB, 0xE5, 0x8A, 0x30, + 0xFA, 0xFA, 0xBE, 0x1C, 0x5D, 0x71, 0xA8, 0x7E, + 0x2F, 0x74, 0x1E, 0xF8, 0xC1, 0xFE, 0x86, 0xFE, + 0xA6, 0xBB, 0xFD, 0xE5, 0x30, 0x67, 0x7F, 0x0D, + 0x97, 0xD1, 0x1D, 0x49, 0xF7, 0xA8, 0x44, 0x3D, + 0x08, 0x22, 0xE5, 0x06, 0xA9, 0xF4, 0x61, 0x4E, + 0x01, 0x1E, 0x2A, 0x94, 0x83, 0x8F, 0xF8, 0x8C, + 0xD6, 0x8C, 0x8B, 0xB7, 0xC5, 0xC6, 0x42, 0x4C, + 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, +}; + +static const ssl3DHParams ff_dhe_8192_params = { + ssl_grp_ffdhe_8192, + { siBuffer, (unsigned char *)ff_dhe_8192_p, sizeof(ff_dhe_8192_p) }, + { siBuffer, (unsigned char *)ff_dhe_g2, sizeof(ff_dhe_g2) }, +}; diff --git a/security/nss/lib/ssl/dtlscon.c b/security/nss/lib/ssl/dtlscon.c new file mode 100644 index 000000000..09ceeac23 --- /dev/null +++ b/security/nss/lib/ssl/dtlscon.c @@ -0,0 +1,1214 @@ +/* -*- Mode: C++; tab-width: 8; indent-tabs-mode: nil; c-basic-offset: 4 -*- */ +/* This Source Code Form is subject to the terms of the Mozilla Public + * License, v. 2.0. If a copy of the MPL was not distributed with this + * file, You can obtain one at http://mozilla.org/MPL/2.0/. */ + +/* + * DTLS Protocol + */ + +#include "ssl.h" +#include "sslimpl.h" +#include "sslproto.h" + +#ifndef PR_ARRAY_SIZE +#define PR_ARRAY_SIZE(a) (sizeof(a) / sizeof((a)[0])) +#endif + +static SECStatus dtls_TransmitMessageFlight(sslSocket *ss); +static SECStatus dtls_StartRetransmitTimer(sslSocket *ss); +static void dtls_RetransmitTimerExpiredCb(sslSocket *ss); +static SECStatus dtls_SendSavedWriteData(sslSocket *ss); +static void dtls_FinishedTimerCb(sslSocket *ss); + +/* -28 adjusts for the IP/UDP header */ +static const PRUint16 COMMON_MTU_VALUES[] = { + 1500 - 28, /* Ethernet MTU */ + 1280 - 28, /* IPv6 minimum MTU */ + 576 - 28, /* Common assumption */ + 256 - 28 /* We're in serious trouble now */ +}; + +#define DTLS_COOKIE_BYTES 32 + +/* List copied from ssl3con.c:cipherSuites */ +static const ssl3CipherSuite nonDTLSSuites[] = { + TLS_ECDHE_ECDSA_WITH_RC4_128_SHA, + TLS_ECDHE_RSA_WITH_RC4_128_SHA, + TLS_DHE_DSS_WITH_RC4_128_SHA, + TLS_ECDH_RSA_WITH_RC4_128_SHA, + TLS_ECDH_ECDSA_WITH_RC4_128_SHA, + TLS_RSA_WITH_RC4_128_MD5, + TLS_RSA_WITH_RC4_128_SHA, + 0 /* End of list marker */ +}; + +/* Map back and forth between TLS and DTLS versions in wire format. + * Mapping table is: + * + * TLS DTLS + * 1.1 (0302) 1.0 (feff) + * 1.2 (0303) 1.2 (fefd) + * 1.3 (0304) 1.3 (fefc) + */ +SSL3ProtocolVersion +dtls_TLSVersionToDTLSVersion(SSL3ProtocolVersion tlsv) +{ + if (tlsv == SSL_LIBRARY_VERSION_TLS_1_1) { + return SSL_LIBRARY_VERSION_DTLS_1_0_WIRE; + } + if (tlsv == SSL_LIBRARY_VERSION_TLS_1_2) { + return SSL_LIBRARY_VERSION_DTLS_1_2_WIRE; + } + if (tlsv == SSL_LIBRARY_VERSION_TLS_1_3) { + return SSL_LIBRARY_VERSION_DTLS_1_3_WIRE; + } + + /* Anything other than TLS 1.1 or 1.2 is an error, so return + * the invalid version 0xffff. */ + return 0xffff; +} + +/* Map known DTLS versions to known TLS versions. + * - Invalid versions (< 1.0) return a version of 0 + * - Versions > known return a version one higher than we know of + * to accomodate a theoretically newer version */ +SSL3ProtocolVersion +dtls_DTLSVersionToTLSVersion(SSL3ProtocolVersion dtlsv) +{ + if (MSB(dtlsv) == 0xff) { + return 0; + } + + if (dtlsv == SSL_LIBRARY_VERSION_DTLS_1_0_WIRE) { + return SSL_LIBRARY_VERSION_TLS_1_1; + } + /* Handle the skipped version of DTLS 1.1 by returning + * an error. */ + if (dtlsv == ((~0x0101) & 0xffff)) { + return 0; + } + if (dtlsv == SSL_LIBRARY_VERSION_DTLS_1_2_WIRE) { + return SSL_LIBRARY_VERSION_TLS_1_2; + } + if (dtlsv == SSL_LIBRARY_VERSION_DTLS_1_3_WIRE) { + return SSL_LIBRARY_VERSION_TLS_1_3; + } + + /* Return a fictional higher version than we know of */ + return SSL_LIBRARY_VERSION_MAX_SUPPORTED + 1; +} + +/* On this socket, Disable non-DTLS cipher suites in the argument's list */ +SECStatus +ssl3_DisableNonDTLSSuites(sslSocket *ss) +{ + const ssl3CipherSuite *suite; + + for (suite = nonDTLSSuites; *suite; ++suite) { + PORT_CheckSuccess(ssl3_CipherPrefSet(ss, *suite, PR_FALSE)); + } + return SECSuccess; +} + +/* Allocate a DTLSQueuedMessage. + * + * Called from dtls_QueueMessage() + */ +static DTLSQueuedMessage * +dtls_AllocQueuedMessage(ssl3CipherSpec *cwSpec, SSL3ContentType type, + const unsigned char *data, PRUint32 len) +{ + DTLSQueuedMessage *msg = NULL; + + msg = PORT_ZAlloc(sizeof(DTLSQueuedMessage)); + if (!msg) + return NULL; + + msg->data = PORT_Alloc(len); + if (!msg->data) { + PORT_Free(msg); + return NULL; + } + PORT_Memcpy(msg->data, data, len); + + msg->len = len; + msg->cwSpec = cwSpec; + msg->type = type; + /* Safe if we are < 1.3, since the refct is + * already very high. */ + tls13_CipherSpecAddRef(cwSpec); + + return msg; +} + +/* + * Free a handshake message + * + * Called from dtls_FreeHandshakeMessages() + */ +void +dtls_FreeHandshakeMessage(DTLSQueuedMessage *msg) +{ + if (!msg) + return; + + /* Safe if we are < 1.3, since the refct is + * already very high. */ + tls13_CipherSpecRelease(msg->cwSpec); + PORT_ZFree(msg->data, msg->len); + PORT_Free(msg); +} + +/* + * Free a list of handshake messages + * + * Called from: + * dtls_HandleHandshake() + * ssl3_DestroySSL3Info() + */ +void +dtls_FreeHandshakeMessages(PRCList *list) +{ + PRCList *cur_p; + + while (!PR_CLIST_IS_EMPTY(list)) { + cur_p = PR_LIST_TAIL(list); + PR_REMOVE_LINK(cur_p); + dtls_FreeHandshakeMessage((DTLSQueuedMessage *)cur_p); + } +} + +/* Called by dtls_HandleHandshake() and dtls_MaybeRetransmitHandshake() if a + * handshake message retransmission is detected. */ +static SECStatus +dtls_RetransmitDetected(sslSocket *ss) +{ + SECStatus rv = SECSuccess; + + PORT_Assert(ss->opt.noLocks || ssl_HaveRecvBufLock(ss)); + PORT_Assert(ss->opt.noLocks || ssl_HaveSSL3HandshakeLock(ss)); + + if (ss->ssl3.hs.rtTimerCb == dtls_RetransmitTimerExpiredCb) { + /* Check to see if we retransmitted recently. If so, + * suppress the triggered retransmit. This avoids + * retransmit wars after packet loss. + * This is not in RFC 5346 but it should be. + */ + if ((PR_IntervalNow() - ss->ssl3.hs.rtTimerStarted) > + (ss->ssl3.hs.rtTimeoutMs / 4)) { + SSL_TRC(30, + ("%d: SSL3[%d]: Shortcutting retransmit timer", + SSL_GETPID(), ss->fd)); + + /* Cancel the timer and call the CB, + * which re-arms the timer */ + dtls_CancelTimer(ss); + dtls_RetransmitTimerExpiredCb(ss); + } else { + SSL_TRC(30, + ("%d: SSL3[%d]: Ignoring retransmission: " + "last retransmission %dms ago, suppressed for %dms", + SSL_GETPID(), ss->fd, + PR_IntervalNow() - ss->ssl3.hs.rtTimerStarted, + ss->ssl3.hs.rtTimeoutMs / 4)); + } + + } else if (ss->ssl3.hs.rtTimerCb == dtls_FinishedTimerCb) { + SSL_TRC(30, ("%d: SSL3[%d]: Retransmit detected in holddown", + SSL_GETPID(), ss->fd)); + /* Retransmit the messages and re-arm the timer + * Note that we are not backing off the timer here. + * The spec isn't clear and my reasoning is that this + * may be a re-ordered packet rather than slowness, + * so let's be aggressive. */ + dtls_CancelTimer(ss); + rv = dtls_TransmitMessageFlight(ss); + if (rv == SECSuccess) { + rv = dtls_StartHolddownTimer(ss); + } + + } else { + PORT_Assert(ss->ssl3.hs.rtTimerCb == NULL); + /* ... and ignore it. */ + } + return rv; +} + +/* Called only from ssl3_HandleRecord, for each (deciphered) DTLS record. + * origBuf is the decrypted ssl record content and is expected to contain + * complete handshake records + * Caller must hold the handshake and RecvBuf locks. + * + * Note that this code uses msg_len for two purposes: + * + * (1) To pass the length to ssl3_HandleHandshakeMessage() + * (2) To carry the length of a message currently being reassembled + * + * However, unlike ssl3_HandleHandshake(), it is not used to carry + * the state of reassembly (i.e., whether one is in progress). That + * is carried in recvdHighWater and recvdFragments. + */ +#define OFFSET_BYTE(o) (o / 8) +#define OFFSET_MASK(o) (1 << (o % 8)) + +SECStatus +dtls_HandleHandshake(sslSocket *ss, sslBuffer *origBuf) +{ + /* XXX OK for now. + * This doesn't work properly with asynchronous certificate validation. + * because that returns a WOULDBLOCK error. The current DTLS + * applications do not need asynchronous validation, but in the + * future we will need to add this. + */ + sslBuffer buf = *origBuf; + SECStatus rv = SECSuccess; + + PORT_Assert(ss->opt.noLocks || ssl_HaveRecvBufLock(ss)); + PORT_Assert(ss->opt.noLocks || ssl_HaveSSL3HandshakeLock(ss)); + + while (buf.len > 0) { + PRUint8 type; + PRUint32 message_length; + PRUint16 message_seq; + PRUint32 fragment_offset; + PRUint32 fragment_length; + PRUint32 offset; + + if (buf.len < 12) { + PORT_SetError(SSL_ERROR_RX_MALFORMED_HANDSHAKE); + rv = SECFailure; + break; + } + + /* Parse the header */ + type = buf.buf[0]; + message_length = (buf.buf[1] << 16) | (buf.buf[2] << 8) | buf.buf[3]; + message_seq = (buf.buf[4] << 8) | buf.buf[5]; + fragment_offset = (buf.buf[6] << 16) | (buf.buf[7] << 8) | buf.buf[8]; + fragment_length = (buf.buf[9] << 16) | (buf.buf[10] << 8) | buf.buf[11]; + +#define MAX_HANDSHAKE_MSG_LEN 0x1ffff /* 128k - 1 */ + if (message_length > MAX_HANDSHAKE_MSG_LEN) { + (void)ssl3_DecodeError(ss); + PORT_SetError(SSL_ERROR_RX_MALFORMED_HANDSHAKE); + return SECFailure; + } +#undef MAX_HANDSHAKE_MSG_LEN + + buf.buf += 12; + buf.len -= 12; + + /* This fragment must be complete */ + if (buf.len < fragment_length) { + PORT_SetError(SSL_ERROR_RX_MALFORMED_HANDSHAKE); + rv = SECFailure; + break; + } + + /* Sanity check the packet contents */ + if ((fragment_length + fragment_offset) > message_length) { + PORT_SetError(SSL_ERROR_RX_MALFORMED_HANDSHAKE); + rv = SECFailure; + break; + } + + /* There are three ways we could not be ready for this packet. + * + * 1. It's a partial next message. + * 2. It's a partial or complete message beyond the next + * 3. It's a message we've already seen + * + * If it's the complete next message we accept it right away. + * This is the common case for short messages + */ + if ((message_seq == ss->ssl3.hs.recvMessageSeq) && + (fragment_offset == 0) && + (fragment_length == message_length)) { + /* Complete next message. Process immediately */ + ss->ssl3.hs.msg_type = (SSL3HandshakeType)type; + ss->ssl3.hs.msg_len = message_length; + + /* At this point we are advancing our state machine, so + * we can free our last flight of messages */ + dtls_FreeHandshakeMessages(&ss->ssl3.hs.lastMessageFlight); + ss->ssl3.hs.recvdHighWater = -1; + dtls_CancelTimer(ss); + + /* Reset the timer to the initial value if the retry counter + * is 0, per Sec. 4.2.4.1 */ + if (ss->ssl3.hs.rtRetries == 0) { + ss->ssl3.hs.rtTimeoutMs = DTLS_RETRANSMIT_INITIAL_MS; + } + + rv = ssl3_HandleHandshakeMessage(ss, buf.buf, ss->ssl3.hs.msg_len, + buf.len == fragment_length); + if (rv == SECFailure) { + /* Do not attempt to process rest of messages in this record */ + break; + } + } else { + if (message_seq < ss->ssl3.hs.recvMessageSeq) { + /* Case 3: we do an immediate retransmit if we're + * in a waiting state. */ + rv = dtls_RetransmitDetected(ss); + break; + } else if (message_seq > ss->ssl3.hs.recvMessageSeq) { + /* Case 2 + * + * Ignore this message. This means we don't handle out of + * order complete messages that well, but we're still + * compliant and this probably does not happen often + * + * XXX OK for now. Maybe do something smarter at some point? + */ + } else { + /* Case 1 + * + * Buffer the fragment for reassembly + */ + /* Make room for the message */ + if (ss->ssl3.hs.recvdHighWater == -1) { + PRUint32 map_length = OFFSET_BYTE(message_length) + 1; + + rv = sslBuffer_Grow(&ss->ssl3.hs.msg_body, message_length); + if (rv != SECSuccess) + break; + /* Make room for the fragment map */ + rv = sslBuffer_Grow(&ss->ssl3.hs.recvdFragments, + map_length); + if (rv != SECSuccess) + break; + + /* Reset the reassembly map */ + ss->ssl3.hs.recvdHighWater = 0; + PORT_Memset(ss->ssl3.hs.recvdFragments.buf, 0, + ss->ssl3.hs.recvdFragments.space); + ss->ssl3.hs.msg_type = (SSL3HandshakeType)type; + ss->ssl3.hs.msg_len = message_length; + } + + /* If we have a message length mismatch, abandon the reassembly + * in progress and hope that the next retransmit will give us + * something sane + */ + if (message_length != ss->ssl3.hs.msg_len) { + ss->ssl3.hs.recvdHighWater = -1; + PORT_SetError(SSL_ERROR_RX_MALFORMED_HANDSHAKE); + rv = SECFailure; + break; + } + + /* Now copy this fragment into the buffer */ + PORT_Assert((fragment_offset + fragment_length) <= + ss->ssl3.hs.msg_body.space); + PORT_Memcpy(ss->ssl3.hs.msg_body.buf + fragment_offset, + buf.buf, fragment_length); + + /* This logic is a bit tricky. We have two values for + * reassembly state: + * + * - recvdHighWater contains the highest contiguous number of + * bytes received + * - recvdFragments contains a bitmask of packets received + * above recvdHighWater + * + * This avoids having to fill in the bitmask in the common + * case of adjacent fragments received in sequence + */ + if (fragment_offset <= (unsigned int)ss->ssl3.hs.recvdHighWater) { + /* Either this is the adjacent fragment or an overlapping + * fragment */ + ss->ssl3.hs.recvdHighWater = fragment_offset + + fragment_length; + } else { + for (offset = fragment_offset; + offset < fragment_offset + fragment_length; + offset++) { + ss->ssl3.hs.recvdFragments.buf[OFFSET_BYTE(offset)] |= + OFFSET_MASK(offset); + } + } + + /* Now figure out the new high water mark if appropriate */ + for (offset = ss->ssl3.hs.recvdHighWater; + offset < ss->ssl3.hs.msg_len; offset++) { + /* Note that this loop is not efficient, since it counts + * bit by bit. If we have a lot of out-of-order packets, + * we should optimize this */ + if (ss->ssl3.hs.recvdFragments.buf[OFFSET_BYTE(offset)] & + OFFSET_MASK(offset)) { + ss->ssl3.hs.recvdHighWater++; + } else { + break; + } + } + + /* If we have all the bytes, then we are good to go */ + if (ss->ssl3.hs.recvdHighWater == ss->ssl3.hs.msg_len) { + ss->ssl3.hs.recvdHighWater = -1; + + rv = ssl3_HandleHandshakeMessage( + ss, + ss->ssl3.hs.msg_body.buf, ss->ssl3.hs.msg_len, + buf.len == fragment_length); + if (rv == SECFailure) + break; /* Skip rest of record */ + + /* At this point we are advancing our state machine, so + * we can free our last flight of messages */ + dtls_FreeHandshakeMessages(&ss->ssl3.hs.lastMessageFlight); + dtls_CancelTimer(ss); + + /* If there have been no retries this time, reset the + * timer value to the default per Section 4.2.4.1 */ + if (ss->ssl3.hs.rtRetries == 0) { + ss->ssl3.hs.rtTimeoutMs = DTLS_RETRANSMIT_INITIAL_MS; + } + } + } + } + + buf.buf += fragment_length; + buf.len -= fragment_length; + } + + origBuf->len = 0; /* So ssl3_GatherAppDataRecord will keep looping. */ + + /* XXX OK for now. In future handle rv == SECWouldBlock safely in order + * to deal with asynchronous certificate verification */ + return rv; +} + +/* Enqueue a message (either handshake or CCS) + * + * Called from: + * dtls_StageHandshakeMessage() + * ssl3_SendChangeCipherSpecs() + */ +SECStatus +dtls_QueueMessage(sslSocket *ss, SSL3ContentType type, + const SSL3Opaque *pIn, PRInt32 nIn) +{ + SECStatus rv = SECSuccess; + DTLSQueuedMessage *msg = NULL; + ssl3CipherSpec *spec; + + PORT_Assert(ss->opt.noLocks || ssl_HaveSSL3HandshakeLock(ss)); + PORT_Assert(ss->opt.noLocks || ssl_HaveXmitBufLock(ss)); + + spec = ss->ssl3.cwSpec; + msg = dtls_AllocQueuedMessage(spec, type, pIn, nIn); + + if (!msg) { + PORT_SetError(SEC_ERROR_NO_MEMORY); + rv = SECFailure; + } else { + PR_APPEND_LINK(&msg->link, &ss->ssl3.hs.lastMessageFlight); + } + + return rv; +} + +/* Add DTLS handshake message to the pending queue + * Empty the sendBuf buffer. + * This function returns SECSuccess or SECFailure, never SECWouldBlock. + * Always set sendBuf.len to 0, even when returning SECFailure. + * + * Called from: + * ssl3_AppendHandshakeHeader() + * dtls_FlushHandshake() + */ +SECStatus +dtls_StageHandshakeMessage(sslSocket *ss) +{ + SECStatus rv = SECSuccess; + + PORT_Assert(ss->opt.noLocks || ssl_HaveSSL3HandshakeLock(ss)); + PORT_Assert(ss->opt.noLocks || ssl_HaveXmitBufLock(ss)); + + /* This function is sometimes called when no data is actually to + * be staged, so just return SECSuccess. */ + if (!ss->sec.ci.sendBuf.buf || !ss->sec.ci.sendBuf.len) + return rv; + + rv = dtls_QueueMessage(ss, content_handshake, + ss->sec.ci.sendBuf.buf, ss->sec.ci.sendBuf.len); + + /* Whether we succeeded or failed, toss the old handshake data. */ + ss->sec.ci.sendBuf.len = 0; + return rv; +} + +/* Enqueue the handshake message in sendBuf (if any) and then + * transmit the resulting flight of handshake messages. + * + * Called from: + * ssl3_FlushHandshake() + */ +SECStatus +dtls_FlushHandshakeMessages(sslSocket *ss, PRInt32 flags) +{ + SECStatus rv = SECSuccess; + + PORT_Assert(ss->opt.noLocks || ssl_HaveSSL3HandshakeLock(ss)); + PORT_Assert(ss->opt.noLocks || ssl_HaveXmitBufLock(ss)); + + rv = dtls_StageHandshakeMessage(ss); + if (rv != SECSuccess) + return rv; + + if (!(flags & ssl_SEND_FLAG_FORCE_INTO_BUFFER)) { + rv = dtls_TransmitMessageFlight(ss); + if (rv != SECSuccess) { + return rv; + } + + if (!(flags & ssl_SEND_FLAG_NO_RETRANSMIT)) { + rv = dtls_StartRetransmitTimer(ss); + } + } + + return rv; +} + +/* The callback for when the retransmit timer expires + * + * Called from: + * dtls_CheckTimer() + * dtls_HandleHandshake() + */ +static void +dtls_RetransmitTimerExpiredCb(sslSocket *ss) +{ + SECStatus rv; + + ss->ssl3.hs.rtRetries++; + + if (!(ss->ssl3.hs.rtRetries % 3)) { + /* If one of the messages was potentially greater than > MTU, + * then downgrade. Do this every time we have retransmitted a + * message twice, per RFC 6347 Sec. 4.1.1 */ + dtls_SetMTU(ss, ss->ssl3.hs.maxMessageSent - 1); + } + + rv = dtls_TransmitMessageFlight(ss); + if (rv == SECSuccess) { + /* Re-arm the timer */ + ss->ssl3.hs.rtTimeoutMs *= 2; + if (ss->ssl3.hs.rtTimeoutMs > DTLS_RETRANSMIT_MAX_MS) { + ss->ssl3.hs.rtTimeoutMs = DTLS_RETRANSMIT_MAX_MS; + } + + ss->ssl3.hs.rtTimerStarted = PR_IntervalNow(); + ss->ssl3.hs.rtTimerCb = dtls_RetransmitTimerExpiredCb; + + SSL_TRC(30, + ("%d: SSL3[%d]: Retransmit #%d, next in %d", + SSL_GETPID(), ss->fd, + ss->ssl3.hs.rtRetries, ss->ssl3.hs.rtTimeoutMs)); + } + /* else: OK for now. In future maybe signal the stack that we couldn't + * transmit. For now, let the read handle any real network errors */ +} + +/* Transmit a flight of handshake messages, stuffing them + * into as few records as seems reasonable + * + * Called from: + * dtls_FlushHandshake() + * dtls_RetransmitTimerExpiredCb() + */ +static SECStatus +dtls_TransmitMessageFlight(sslSocket *ss) +{ + SECStatus rv = SECSuccess; + PRCList *msg_p; + PRUint16 room_left = ss->ssl3.mtu; + PRInt32 sent; + + ssl_GetXmitBufLock(ss); + ssl_GetSpecReadLock(ss); + + /* DTLS does not buffer its handshake messages in + * ss->pendingBuf, but rather in the lastMessageFlight + * structure. This is just a sanity check that + * some programming error hasn't inadvertantly + * stuffed something in ss->pendingBuf + */ + PORT_Assert(!ss->pendingBuf.len); + for (msg_p = PR_LIST_HEAD(&ss->ssl3.hs.lastMessageFlight); + msg_p != &ss->ssl3.hs.lastMessageFlight; + msg_p = PR_NEXT_LINK(msg_p)) { + DTLSQueuedMessage *msg = (DTLSQueuedMessage *)msg_p; + + /* The logic here is: + * + * 1. If this is a message that will not fit into the remaining + * space, then flush. + * 2. If the message will now fit into the remaining space, + * encrypt, buffer, and loop. + * 3. If the message will not fit, then fragment. + * + * At the end of the function, flush. + */ + if ((msg->len + SSL3_BUFFER_FUDGE) > room_left) { + /* The message will not fit into the remaining space, so flush */ + rv = dtls_SendSavedWriteData(ss); + if (rv != SECSuccess) + break; + + room_left = ss->ssl3.mtu; + } + + if ((msg->len + SSL3_BUFFER_FUDGE) <= room_left) { + /* The message will fit, so encrypt and then continue with the + * next packet */ + sent = ssl3_SendRecord(ss, msg->cwSpec, msg->type, + msg->data, msg->len, + ssl_SEND_FLAG_FORCE_INTO_BUFFER); + if (sent != msg->len) { + rv = SECFailure; + if (sent != -1) { + PORT_SetError(SEC_ERROR_LIBRARY_FAILURE); + } + break; + } + + room_left = ss->ssl3.mtu - ss->pendingBuf.len; + } else { + /* The message will not fit, so fragment. + * + * XXX OK for now. Arrange to coalesce the last fragment + * of this message with the next message if possible. + * That would be more efficient. + */ + PRUint32 fragment_offset = 0; + unsigned char fragment[DTLS_MAX_MTU]; /* >= than largest + * plausible MTU */ + + /* Assert that we have already flushed */ + PORT_Assert(room_left == ss->ssl3.mtu); + + /* Case 3: We now need to fragment this message + * DTLS only supports fragmenting handshaking messages */ + PORT_Assert(msg->type == content_handshake); + + /* The headers consume 12 bytes so the smalles possible + * message (i.e., an empty one) is 12 bytes + */ + PORT_Assert(msg->len >= 12); + + while ((fragment_offset + 12) < msg->len) { + PRUint32 fragment_len; + const unsigned char *content = msg->data + 12; + PRUint32 content_len = msg->len - 12; + + /* The reason we use 8 here is that that's the length of + * the new DTLS data that we add to the header */ + fragment_len = PR_MIN((PRUint32)room_left - (SSL3_BUFFER_FUDGE + 8), + content_len - fragment_offset); + PORT_Assert(fragment_len < DTLS_MAX_MTU - 12); + /* Make totally sure that we are within the buffer. + * Note that the only way that fragment len could get + * adjusted here is if + * + * (a) we are in release mode so the PORT_Assert is compiled out + * (b) either the MTU table is inconsistent with DTLS_MAX_MTU + * or ss->ssl3.mtu has become corrupt. + */ + fragment_len = PR_MIN(fragment_len, DTLS_MAX_MTU - 12); + + /* Construct an appropriate-sized fragment */ + /* Type, length, sequence */ + PORT_Memcpy(fragment, msg->data, 6); + + /* Offset */ + fragment[6] = (fragment_offset >> 16) & 0xff; + fragment[7] = (fragment_offset >> 8) & 0xff; + fragment[8] = (fragment_offset)&0xff; + + /* Fragment length */ + fragment[9] = (fragment_len >> 16) & 0xff; + fragment[10] = (fragment_len >> 8) & 0xff; + fragment[11] = (fragment_len)&0xff; + + PORT_Memcpy(fragment + 12, content + fragment_offset, + fragment_len); + + /* + * Send the record. We do this in two stages + * 1. Encrypt + */ + sent = ssl3_SendRecord(ss, msg->cwSpec, msg->type, + fragment, fragment_len + 12, + ssl_SEND_FLAG_FORCE_INTO_BUFFER); + if (sent != (fragment_len + 12)) { + rv = SECFailure; + if (sent != -1) { + PORT_SetError(SEC_ERROR_LIBRARY_FAILURE); + } + break; + } + + /* 2. Flush */ + rv = dtls_SendSavedWriteData(ss); + if (rv != SECSuccess) + break; + + fragment_offset += fragment_len; + } + } + } + + /* Finally, we need to flush */ + if (rv == SECSuccess) + rv = dtls_SendSavedWriteData(ss); + + /* Give up the locks */ + ssl_ReleaseSpecReadLock(ss); + ssl_ReleaseXmitBufLock(ss); + + return rv; +} + +/* Flush the data in the pendingBuf and update the max message sent + * so we can adjust the MTU estimate if we need to. + * Wrapper for ssl_SendSavedWriteData. + * + * Called from dtls_TransmitMessageFlight() + */ +static SECStatus +dtls_SendSavedWriteData(sslSocket *ss) +{ + PRInt32 sent; + + sent = ssl_SendSavedWriteData(ss); + if (sent < 0) + return SECFailure; + + /* We should always have complete writes b/c datagram sockets + * don't really block */ + if (ss->pendingBuf.len > 0) { + ssl_MapLowLevelError(SSL_ERROR_SOCKET_WRITE_FAILURE); + return SECFailure; + } + + /* Update the largest message sent so we can adjust the MTU + * estimate if necessary */ + if (sent > ss->ssl3.hs.maxMessageSent) + ss->ssl3.hs.maxMessageSent = sent; + + return SECSuccess; +} + +static SECStatus +dtls_StartTimer(sslSocket *ss, PRUint32 time, DTLSTimerCb cb) +{ + PORT_Assert(ss->ssl3.hs.rtTimerCb == NULL); + + ss->ssl3.hs.rtRetries = 0; + ss->ssl3.hs.rtTimerStarted = PR_IntervalNow(); + ss->ssl3.hs.rtTimeoutMs = time; + ss->ssl3.hs.rtTimerCb = cb; + return SECSuccess; +} + +/* Start a timer for retransmission. */ +static SECStatus +dtls_StartRetransmitTimer(sslSocket *ss) +{ + return dtls_StartTimer(ss, DTLS_RETRANSMIT_INITIAL_MS, + dtls_RetransmitTimerExpiredCb); +} + +/* Start a timer for holding an old cipher spec. */ +SECStatus +dtls_StartHolddownTimer(sslSocket *ss) +{ + return dtls_StartTimer(ss, DTLS_RETRANSMIT_FINISHED_MS, + dtls_FinishedTimerCb); +} + +/* Cancel a pending timer + * + * Called from: + * dtls_HandleHandshake() + * dtls_CheckTimer() + */ +void +dtls_CancelTimer(sslSocket *ss) +{ + PORT_Assert(ss->opt.noLocks || ssl_HaveRecvBufLock(ss)); + + ss->ssl3.hs.rtTimerCb = NULL; +} + +/* Check the pending timer and fire the callback if it expired + * + * Called from ssl3_GatherCompleteHandshake() + */ +void +dtls_CheckTimer(sslSocket *ss) +{ + ssl_GetSSL3HandshakeLock(ss); + if (!ss->ssl3.hs.rtTimerCb) { + ssl_ReleaseSSL3HandshakeLock(ss); + return; + } + + if ((PR_IntervalNow() - ss->ssl3.hs.rtTimerStarted) > + PR_MillisecondsToInterval(ss->ssl3.hs.rtTimeoutMs)) { + /* Timer has expired */ + DTLSTimerCb cb = ss->ssl3.hs.rtTimerCb; + + /* Cancel the timer so that we can call the CB safely */ + dtls_CancelTimer(ss); + + /* Now call the CB */ + cb(ss); + } + ssl_ReleaseSSL3HandshakeLock(ss); +} + +/* The callback to fire when the holddown timer for the Finished + * message expires and we can delete it + * + * Called from dtls_CheckTimer() + */ +static void +dtls_FinishedTimerCb(sslSocket *ss) +{ + dtls_FreeHandshakeMessages(&ss->ssl3.hs.lastMessageFlight); + if (ss->version < SSL_LIBRARY_VERSION_TLS_1_3) { + ssl3_DestroyCipherSpec(ss->ssl3.pwSpec, PR_FALSE); + } +} + +/* Cancel the Finished hold-down timer and destroy the + * pending cipher spec. Note that this means that + * successive rehandshakes will fail if the Finished is + * lost. + * + * XXX OK for now. Figure out how to handle the combination + * of Finished lost and rehandshake + */ +void +dtls_RehandshakeCleanup(sslSocket *ss) +{ + /* Skip this if we are handling a second ClientHello. */ + if (ss->ssl3.hs.helloRetry) { + return; + } + PORT_Assert((ss->version < SSL_LIBRARY_VERSION_TLS_1_3)); + dtls_CancelTimer(ss); + ssl3_DestroyCipherSpec(ss->ssl3.pwSpec, PR_FALSE); + ss->ssl3.hs.sendMessageSeq = 0; + ss->ssl3.hs.recvMessageSeq = 0; +} + +/* Set the MTU to the next step less than or equal to the + * advertised value. Also used to downgrade the MTU by + * doing dtls_SetMTU(ss, biggest packet set). + * + * Passing 0 means set this to the largest MTU known + * (effectively resetting the PMTU backoff value). + * + * Called by: + * ssl3_InitState() + * dtls_RetransmitTimerExpiredCb() + */ +void +dtls_SetMTU(sslSocket *ss, PRUint16 advertised) +{ + int i; + + if (advertised == 0) { + ss->ssl3.mtu = COMMON_MTU_VALUES[0]; + SSL_TRC(30, ("Resetting MTU to %d", ss->ssl3.mtu)); + return; + } + + for (i = 0; i < PR_ARRAY_SIZE(COMMON_MTU_VALUES); i++) { + if (COMMON_MTU_VALUES[i] <= advertised) { + ss->ssl3.mtu = COMMON_MTU_VALUES[i]; + SSL_TRC(30, ("Resetting MTU to %d", ss->ssl3.mtu)); + return; + } + } + + /* Fallback */ + ss->ssl3.mtu = COMMON_MTU_VALUES[PR_ARRAY_SIZE(COMMON_MTU_VALUES) - 1]; + SSL_TRC(30, ("Resetting MTU to %d", ss->ssl3.mtu)); +} + +/* Called from ssl3_HandleHandshakeMessage() when it has deciphered a + * DTLS hello_verify_request + * Caller must hold Handshake and RecvBuf locks. + */ +SECStatus +dtls_HandleHelloVerifyRequest(sslSocket *ss, SSL3Opaque *b, PRUint32 length) +{ + int errCode = SSL_ERROR_RX_MALFORMED_HELLO_VERIFY_REQUEST; + SECStatus rv; + SSL3ProtocolVersion temp; + SSL3AlertDescription desc = illegal_parameter; + + SSL_TRC(3, ("%d: SSL3[%d]: handle hello_verify_request handshake", + SSL_GETPID(), ss->fd)); + PORT_Assert(ss->opt.noLocks || ssl_HaveRecvBufLock(ss)); + PORT_Assert(ss->opt.noLocks || ssl_HaveSSL3HandshakeLock(ss)); + + if (ss->ssl3.hs.ws != wait_server_hello) { + errCode = SSL_ERROR_RX_UNEXPECTED_HELLO_VERIFY_REQUEST; + desc = unexpected_message; + goto alert_loser; + } + + /* The version. + * + * RFC 4347 required that you verify that the server versions + * match (Section 4.2.1) in the HelloVerifyRequest and the + * ServerHello. + * + * RFC 6347 suggests (SHOULD) that servers always use 1.0 in + * HelloVerifyRequest and allows the versions not to match, + * especially when 1.2 is being negotiated. + * + * Therefore we do not do anything to enforce a match, just + * read and check that this value is sane. + */ + rv = ssl_ClientReadVersion(ss, &b, &length, &temp); + if (rv != SECSuccess) { + goto loser; /* alert has been sent */ + } + + /* Read the cookie. + * IMPORTANT: The value of ss->ssl3.hs.cookie is only valid while the + * HelloVerifyRequest message remains valid. */ + rv = ssl3_ConsumeHandshakeVariable(ss, &ss->ssl3.hs.cookie, 1, &b, &length); + if (rv != SECSuccess) { + goto loser; /* alert has been sent */ + } + if (ss->ssl3.hs.cookie.len > DTLS_COOKIE_BYTES) { + desc = decode_error; + goto alert_loser; /* malformed. */ + } + + ssl_GetXmitBufLock(ss); /*******************************/ + + /* Now re-send the client hello */ + rv = ssl3_SendClientHello(ss, client_hello_retransmit); + + ssl_ReleaseXmitBufLock(ss); /*******************************/ + + if (rv == SECSuccess) + return rv; + +alert_loser: + (void)SSL3_SendAlert(ss, alert_fatal, desc); + +loser: + ssl_MapLowLevelError(errCode); + return SECFailure; +} + +/* Initialize the DTLS anti-replay window + * + * Called from: + * ssl3_SetupPendingCipherSpec() + * ssl3_InitCipherSpec() + */ +void +dtls_InitRecvdRecords(DTLSRecvdRecords *records) +{ + PORT_Memset(records->data, 0, sizeof(records->data)); + records->left = 0; + records->right = DTLS_RECVD_RECORDS_WINDOW - 1; +} + +/* + * Has this DTLS record been received? Return values are: + * -1 -- out of range to the left + * 0 -- not received yet + * 1 -- replay + * + * Called from: ssl3_HandleRecord() + */ +int +dtls_RecordGetRecvd(const DTLSRecvdRecords *records, sslSequenceNumber seq) +{ + PRUint64 offset; + + /* Out of range to the left */ + if (seq < records->left) { + return -1; + } + + /* Out of range to the right; since we advance the window on + * receipt, that means that this packet has not been received + * yet */ + if (seq > records->right) + return 0; + + offset = seq % DTLS_RECVD_RECORDS_WINDOW; + + return !!(records->data[offset / 8] & (1 << (offset % 8))); +} + +/* Update the DTLS anti-replay window + * + * Called from ssl3_HandleRecord() + */ +void +dtls_RecordSetRecvd(DTLSRecvdRecords *records, sslSequenceNumber seq) +{ + PRUint64 offset; + + if (seq < records->left) + return; + + if (seq > records->right) { + sslSequenceNumber new_left; + sslSequenceNumber new_right; + sslSequenceNumber right; + + /* Slide to the right; this is the tricky part + * + * 1. new_top is set to have room for seq, on the + * next byte boundary by setting the right 8 + * bits of seq + * 2. new_left is set to compensate. + * 3. Zero all bits between top and new_top. Since + * this is a ring, this zeroes everything as-yet + * unseen. Because we always operate on byte + * boundaries, we can zero one byte at a time + */ + new_right = seq | 0x07; + new_left = (new_right - DTLS_RECVD_RECORDS_WINDOW) + 1; + + if (new_right > records->right + DTLS_RECVD_RECORDS_WINDOW) { + PORT_Memset(records->data, 0, sizeof(records->data)); + } else { + for (right = records->right + 8; right <= new_right; right += 8) { + offset = right % DTLS_RECVD_RECORDS_WINDOW; + records->data[offset / 8] = 0; + } + } + + records->right = new_right; + records->left = new_left; + } + + offset = seq % DTLS_RECVD_RECORDS_WINDOW; + + records->data[offset / 8] |= (1 << (offset % 8)); +} + +SECStatus +DTLS_GetHandshakeTimeout(PRFileDesc *socket, PRIntervalTime *timeout) +{ + sslSocket *ss = NULL; + PRIntervalTime elapsed; + PRIntervalTime desired; + + ss = ssl_FindSocket(socket); + + if (!ss) + return SECFailure; + + if (!IS_DTLS(ss)) + return SECFailure; + + if (!ss->ssl3.hs.rtTimerCb) + return SECFailure; + + elapsed = PR_IntervalNow() - ss->ssl3.hs.rtTimerStarted; + desired = PR_MillisecondsToInterval(ss->ssl3.hs.rtTimeoutMs); + if (elapsed > desired) { + /* Timer expired */ + *timeout = PR_INTERVAL_NO_WAIT; + } else { + *timeout = desired - elapsed; + } + + return SECSuccess; +} + +/* + * DTLS relevance checks: + * Note that this code currently ignores all out-of-epoch packets, + * which means we lose some in the case of rehandshake + + * loss/reordering. Since DTLS is explicitly unreliable, this + * seems like a good tradeoff for implementation effort and is + * consistent with the guidance of RFC 6347 Sections 4.1 and 4.2.4.1. + * + * If the packet is not relevant, this function returns PR_FALSE. + * If the packet is relevant, this function returns PR_TRUE + * and sets |*seqNum| to the packet sequence number. + */ +PRBool +dtls_IsRelevant(sslSocket *ss, const SSL3Ciphertext *cText, + PRBool *sameEpoch, PRUint64 *seqNum) +{ + const ssl3CipherSpec *crSpec = ss->ssl3.crSpec; + DTLSEpoch epoch; + sslSequenceNumber dtls_seq_num; + + epoch = cText->seq_num >> 48; + *sameEpoch = crSpec->epoch == epoch; + if (!*sameEpoch) { + SSL_DBG(("%d: SSL3[%d]: dtls_IsRelevant, received packet " + "from irrelevant epoch %d", + SSL_GETPID(), ss->fd, epoch)); + return PR_FALSE; + } + + dtls_seq_num = cText->seq_num & RECORD_SEQ_MAX; + if (dtls_RecordGetRecvd(&crSpec->recvdRecords, dtls_seq_num) != 0) { + SSL_DBG(("%d: SSL3[%d]: dtls_IsRelevant, rejecting " + "potentially replayed packet", + SSL_GETPID(), ss->fd)); + return PR_FALSE; + } + + *seqNum = dtls_seq_num; + return PR_TRUE; +} + +/* In TLS 1.3, a client that receives a retransmission of the server's first + * flight will reject that message and discard it (see dtls_IsRelevant() above). + * However, we need to trigger retransmission to prevent loss of the client's + * last flight from causing the connection to fail. + * + * This only triggers for a retransmitted ServerHello. Other (encrypted) + * handshake messages do not trigger retransmission, so we are a little more + * exposed to loss than is ideal. + * + * Note: This isn't an issue in earlier versions because the second-to-last + * flight (sent by the server) includes the Finished message, which is not + * dropped because it has the same epoch that the client currently expects. + */ +SECStatus +dtls_MaybeRetransmitHandshake(sslSocket *ss, const SSL3Ciphertext *cText, + PRBool sameEpoch) +{ + SECStatus rv = SECSuccess; + DTLSEpoch messageEpoch = cText->seq_num >> 48; + + /* Drop messages from other epochs if we are ignoring things. */ + if (!sameEpoch && ss->ssl3.hs.zeroRttIgnore != ssl_0rtt_ignore_none) { + return SECSuccess; + } + + if (!ss->sec.isServer && ss->version >= SSL_LIBRARY_VERSION_TLS_1_3 && + messageEpoch == 0 && cText->type == content_handshake) { + ssl_GetSSL3HandshakeLock(ss); + if (ss->ssl3.hs.rtTimerCb == dtls_FinishedTimerCb && + ss->ssl3.hs.ws == idle_handshake) { + rv = dtls_RetransmitDetected(ss); + } + ssl_ReleaseSSL3HandshakeLock(ss); + } + return rv; +} diff --git a/security/nss/lib/ssl/exports.gyp b/security/nss/lib/ssl/exports.gyp new file mode 100644 index 000000000..e2123af84 --- /dev/null +++ b/security/nss/lib/ssl/exports.gyp @@ -0,0 +1,29 @@ +# This Source Code Form is subject to the terms of the Mozilla Public +# License, v. 2.0. If a copy of the MPL was not distributed with this +# file, You can obtain one at http://mozilla.org/MPL/2.0/. +{ + 'includes': [ + '../../coreconf/config.gypi' + ], + 'targets': [ + { + 'target_name': 'lib_ssl_exports', + 'type': 'none', + 'copies': [ + { + 'files': [ + 'preenc.h', + 'ssl.h', + 'sslerr.h', + 'sslproto.h', + 'sslt.h' + ], + 'destination': '<(nss_public_dist_dir)/<(module)' + } + ] + } + ], + 'variables': { + 'module': 'nss' + } +} diff --git a/security/nss/lib/ssl/manifest.mn b/security/nss/lib/ssl/manifest.mn new file mode 100644 index 000000000..e7564edb2 --- /dev/null +++ b/security/nss/lib/ssl/manifest.mn @@ -0,0 +1,57 @@ +# +# This Source Code Form is subject to the terms of the Mozilla Public +# License, v. 2.0. If a copy of the MPL was not distributed with this +# file, You can obtain one at http://mozilla.org/MPL/2.0/. +CORE_DEPTH = ../.. + +# DEFINES = -DTRACE + +EXPORTS = \ + ssl.h \ + sslt.h \ + sslerr.h \ + sslproto.h \ + preenc.h \ + $(NULL) + +MODULE = nss +MAPFILE = $(OBJDIR)/ssl.def + +CSRCS = \ + dtlscon.c \ + prelib.c \ + ssl3con.c \ + ssl3gthr.c \ + sslauth.c \ + sslcon.c \ + ssldef.c \ + sslenum.c \ + sslerr.c \ + sslerrstrs.c \ + sslinit.c \ + ssl3ext.c \ + ssl3exthandle.c \ + sslmutex.c \ + sslnonce.c \ + sslreveal.c \ + sslsecur.c \ + sslsnce.c \ + sslsock.c \ + ssltrace.c \ + sslver.c \ + authcert.c \ + cmpcert.c \ + sslinfo.c \ + ssl3ecc.c \ + tls13con.c \ + tls13exthandle.c \ + tls13hkdf.c \ + sslcert.c \ + sslgrp.c \ + $(NULL) + +LIBRARY_NAME = ssl +LIBRARY_VERSION = 3 + +# This part of the code, including all sub-dirs, can be optimized for size +export ALLOW_OPT_CODE_SIZE = 1 diff --git a/security/nss/lib/ssl/notes.txt b/security/nss/lib/ssl/notes.txt new file mode 100644 index 000000000..7a8998a85 --- /dev/null +++ b/security/nss/lib/ssl/notes.txt @@ -0,0 +1,104 @@ +# This Source Code Form is subject to the terms of the Mozilla Public +# License, v. 2.0. If a copy of the MPL was not distributed with this +# file, You can obtain one at http://mozilla.org/MPL/2.0/. + +SSL's Buffers: enumerated and explained. + +--------------------------------------------------------------------------- +incoming: + +gs = ss->gather +hs = ss->ssl3->hs + +gs->inbuf incoming (encrypted) ssl records are placed here, + and then decrypted (or copied) to gs->buf. + +gs->buf ssl3_HandleHandshake puts decrypted ssl records here. + +hs.msg_body When an incoming handshake message spans more + than one ssl record, the first part(s) of it are accumulated + here until it all arrives. + +hs.msgState an alternative set of pointers/lengths for gs->buf. + Used only when a handleHandshake function returns SECWouldBlock. + ssl3_HandleHandshake remembers how far it previously got by + using these pointers instead of gs->buf when it is called + after a previous SECWouldBlock return. + +--------------------------------------------------------------------------- +outgoing: + +sec = ss->sec +ci = ss->sec->ci /* connect info */ + +ci->sendBuf Outgoing handshake messages are appended to this buffer. + This buffer will then be sent as a single SSL record. + +sec->writeBuf outgoing ssl records are constructed here and encrypted in + place before being written or copied to pendingBuf. + +ss->pendingBuf contains outgoing ciphertext that was saved after a write + attempt to the socket failed, e.g. EWouldBlock. + Generally empty with blocking sockets (should be no incomplete + writes). + +ss->saveBuf Used only by socks code. Intended to be used to buffer + outgoing data until a socks handshake completes. However, + this buffer is always empty. There is no code to put + anything into it. + +--------------------------------------------------------------------------- + +SECWouldBlock means that the function cannot make progress because it is +waiting for some event OTHER THAN socket I/O completion (e.g. waiting for +user dialog to finish). It is not the same as EWOULDBLOCK. + +--------------------------------------------------------------------------- + +Rank (order) of locks + +recvLock ->\ firstHandshake -> recvbuf -> ssl3Handshake -> xmitbuf -> "spec" +sendLock ->/ + +crypto and hash Data that must be protected while turning plaintext into +ciphertext: + +SSl3: (in ssl3_SendPlainText) + ss->ssl3 (the pointer) + ss->ssl3->current_write* (the pointer and the data in the spec + and any data referenced by the spec. + + ss->sec->isServer + ss->sec->writebuf* (ptr & content) locked by xmitBufLock + "buf" locked by xmitBufLock + +crypto and hash data that must be protected while turning ciphertext into +plaintext: + +SSL3: (in ssl3_HandleRecord ) + ssl3->current_read* (the pointer and all data refernced) + ss->sec->isServer + + +Data that must be protected while being used by a "writer": + +ss->pendingBuf.* +ss->saveBuf.* (which is dead) + +in ssl3_sendPlainText + +ss->ssl3->current_write-> (spec) +ss->sec->writeBuf.* +ss->sec->isServer + +in SendBlock + +ss->sec->writeBuf.* +ss->pendingBuf + +-------------------------------------------------------------------------- + +Data variables (not const) protected by the "sslGlobalDataLock". +Note, this really should be a reader/writer lock. + +cipherSuites[] ssl3con.c diff --git a/security/nss/lib/ssl/os2_err.c b/security/nss/lib/ssl/os2_err.c new file mode 100644 index 000000000..6e3d423f4 --- /dev/null +++ b/security/nss/lib/ssl/os2_err.c @@ -0,0 +1,330 @@ +/* -*- Mode: C++; tab-width: 4; indent-tabs-mode: nil; c-basic-offset: 2 -*- */ +/* + * This file essentially replicates NSPR's source for the functions that + * map system-specific error codes to NSPR error codes. We would use + * NSPR's functions, instead of duplicating them, but they're private. + * As long as SSL's server session cache code must do platform native I/O + * to accomplish its job, and NSPR's error mapping functions remain private, + * this code will continue to need to be replicated. + * + * This Source Code Form is subject to the terms of the Mozilla Public + * License, v. 2.0. If a copy of the MPL was not distributed with this + * file, You can obtain one at http://mozilla.org/MPL/2.0/. */ + +#include "prerror.h" +#include "prlog.h" +#include <errno.h> + +/* + * Based on win32err.c + * OS2TODO Stub everything for now to build. HCT + */ + +/* forward declaration. */ +void nss_MD_os2_map_default_error(PRInt32 err); + +void +nss_MD_os2_map_opendir_error(PRInt32 err) +{ + nss_MD_os2_map_default_error(err); +} + +void +nss_MD_os2_map_closedir_error(PRInt32 err) +{ + nss_MD_os2_map_default_error(err); +} + +void +nss_MD_os2_map_readdir_error(PRInt32 err) +{ + nss_MD_os2_map_default_error(err); +} + +void +nss_MD_os2_map_delete_error(PRInt32 err) +{ + nss_MD_os2_map_default_error(err); +} + +/* The error code for stat() is in errno. */ +void +nss_MD_os2_map_stat_error(PRInt32 err) +{ + nss_MD_os2_map_default_error(err); +} + +void +nss_MD_os2_map_fstat_error(PRInt32 err) +{ + nss_MD_os2_map_default_error(err); +} + +void +nss_MD_os2_map_rename_error(PRInt32 err) +{ + nss_MD_os2_map_default_error(err); +} + +/* The error code for access() is in errno. */ +void +nss_MD_os2_map_access_error(PRInt32 err) +{ + nss_MD_os2_map_default_error(err); +} + +void +nss_MD_os2_map_mkdir_error(PRInt32 err) +{ + nss_MD_os2_map_default_error(err); +} + +void +nss_MD_os2_map_rmdir_error(PRInt32 err) +{ + nss_MD_os2_map_default_error(err); +} + +void +nss_MD_os2_map_read_error(PRInt32 err) +{ + nss_MD_os2_map_default_error(err); +} + +void +nss_MD_os2_map_transmitfile_error(PRInt32 err) +{ + nss_MD_os2_map_default_error(err); +} + +void +nss_MD_os2_map_write_error(PRInt32 err) +{ + nss_MD_os2_map_default_error(err); +} + +void +nss_MD_os2_map_lseek_error(PRInt32 err) +{ + nss_MD_os2_map_default_error(err); +} + +void +nss_MD_os2_map_fsync_error(PRInt32 err) +{ + nss_MD_os2_map_default_error(err); +} + +/* + * For both CloseHandle() and closesocket(). + */ +void +nss_MD_os2_map_close_error(PRInt32 err) +{ + nss_MD_os2_map_default_error(err); +} + +void +nss_MD_os2_map_socket_error(PRInt32 err) +{ + // PR_ASSERT(err != WSANOTINITIALISED); + nss_MD_os2_map_default_error(err); +} + +void +nss_MD_os2_map_recv_error(PRInt32 err) +{ + nss_MD_os2_map_default_error(err); +} + +void +nss_MD_os2_map_recvfrom_error(PRInt32 err) +{ + nss_MD_os2_map_default_error(err); +} + +void +nss_MD_os2_map_send_error(PRInt32 err) +{ + PRErrorCode prError; + switch (err) { + // case WSAEMSGSIZE: prError = PR_INVALID_ARGUMENT_ERROR; break; + default: + nss_MD_os2_map_default_error(err); + return; + } + PR_SetError(prError, err); +} + +void +nss_MD_os2_map_sendto_error(PRInt32 err) +{ + PRErrorCode prError; + switch (err) { + // case WSAEMSGSIZE: prError = PR_INVALID_ARGUMENT_ERROR; break; + default: + nss_MD_os2_map_default_error(err); + return; + } + PR_SetError(prError, err); +} + +void +nss_MD_os2_map_accept_error(PRInt32 err) +{ + PRErrorCode prError; + switch (err) { + // case WSAEOPNOTSUPP: prError = PR_NOT_TCP_SOCKET_ERROR; break; + // case WSAEINVAL: prError = PR_INVALID_STATE_ERROR; break; + default: + nss_MD_os2_map_default_error(err); + return; + } + PR_SetError(prError, err); +} + +void +nss_MD_os2_map_acceptex_error(PRInt32 err) +{ + nss_MD_os2_map_default_error(err); +} + +void +nss_MD_os2_map_connect_error(PRInt32 err) +{ + PRErrorCode prError; + switch (err) { + // case WSAEWOULDBLOCK: prError = PR_IN_PROGRESS_ERROR; break; + // case WSAEINVAL: prError = PR_ALREADY_INITIATED_ERROR; break; + // case WSAETIMEDOUT: prError = PR_IO_TIMEOUT_ERROR; break; + default: + nss_MD_os2_map_default_error(err); + return; + } + PR_SetError(prError, err); +} + +void +nss_MD_os2_map_bind_error(PRInt32 err) +{ + PRErrorCode prError; + switch (err) { + // case WSAEINVAL: prError = PR_SOCKET_ADDRESS_IS_BOUND_ERROR; break; + default: + nss_MD_os2_map_default_error(err); + return; + } + PR_SetError(prError, err); +} + +void +nss_MD_os2_map_listen_error(PRInt32 err) +{ + PRErrorCode prError; + switch (err) { + // case WSAEOPNOTSUPP: prError = PR_NOT_TCP_SOCKET_ERROR; break; + // case WSAEINVAL: prError = PR_INVALID_STATE_ERROR; break; + default: + nss_MD_os2_map_default_error(err); + return; + } + PR_SetError(prError, err); +} + +void +nss_MD_os2_map_shutdown_error(PRInt32 err) +{ + nss_MD_os2_map_default_error(err); +} + +void +nss_MD_os2_map_getsockname_error(PRInt32 err) +{ + PRErrorCode prError; + switch (err) { + // case WSAEINVAL: prError = PR_INVALID_STATE_ERROR; break; + default: + nss_MD_os2_map_default_error(err); + return; + } + PR_SetError(prError, err); +} + +void +nss_MD_os2_map_getpeername_error(PRInt32 err) +{ + nss_MD_os2_map_default_error(err); +} + +void +nss_MD_os2_map_getsockopt_error(PRInt32 err) +{ + nss_MD_os2_map_default_error(err); +} + +void +nss_MD_os2_map_setsockopt_error(PRInt32 err) +{ + nss_MD_os2_map_default_error(err); +} + +void +nss_MD_os2_map_open_error(PRInt32 err) +{ + nss_MD_os2_map_default_error(err); +} + +void +nss_MD_os2_map_gethostname_error(PRInt32 err) +{ + nss_MD_os2_map_default_error(err); +} + +/* Win32 select() only works on sockets. So in this +** context, WSAENOTSOCK is equivalent to EBADF on Unix. +*/ +void +nss_MD_os2_map_select_error(PRInt32 err) +{ + PRErrorCode prError; + switch (err) { + // case WSAENOTSOCK: prError = PR_BAD_DESCRIPTOR_ERROR; break; + default: + nss_MD_os2_map_default_error(err); + return; + } + PR_SetError(prError, err); +} + +void +nss_MD_os2_map_lockf_error(PRInt32 err) +{ + nss_MD_os2_map_default_error(err); +} + +void +nss_MD_os2_map_default_error(PRInt32 err) +{ + PRErrorCode prError; + + switch (err) { +// case ENOENT: prError = PR_FILE_NOT_FOUND_ERROR; break; +// case ERROR_ACCESS_DENIED: prError = PR_NO_ACCESS_RIGHTS_ERROR; break; +// case ERROR_ALREADY_EXISTS: prError = PR_FILE_EXISTS_ERROR; break; +// case ERROR_DISK_CORRUPT: prError = PR_IO_ERROR; break; +// case ERROR_DISK_FULL: prError = PR_NO_DEVICE_SPACE_ERROR; break; +// case ERROR_DISK_OPERATION_FAILED: prError = PR_IO_ERROR; break; +// case ERROR_DRIVE_LOCKED: prError = PR_FILE_IS_LOCKED_ERROR; break; +// case ERROR_FILENAME_EXCED_RANGE: prError = PR_NAME_TOO_LONG_ERROR; break; +// case ERROR_FILE_CORRUPT: prError = PR_IO_ERROR; break; +// case ERROR_FILE_EXISTS: prError = PR_FILE_EXISTS_ERROR; break; +// case ERROR_FILE_INVALID: prError = PR_BAD_DESCRIPTOR_ERROR; break; +#if ERROR_FILE_NOT_FOUND != ENOENT +// case ERROR_FILE_NOT_FOUND: prError = PR_FILE_NOT_FOUND_ERROR; break; +#endif + default: + prError = PR_UNKNOWN_ERROR; + break; + } + PR_SetError(prError, err); +} diff --git a/security/nss/lib/ssl/os2_err.h b/security/nss/lib/ssl/os2_err.h new file mode 100644 index 000000000..15e47411a --- /dev/null +++ b/security/nss/lib/ssl/os2_err.h @@ -0,0 +1,53 @@ +/* + * This file essentially replicates NSPR's source for the functions that + * map system-specific error codes to NSPR error codes. We would use + * NSPR's functions, instead of duplicating them, but they're private. + * As long as SSL's server session cache code must do platform native I/O + * to accomplish its job, and NSPR's error mapping functions remain private, + * This code will continue to need to be replicated. + * + * This Source Code Form is subject to the terms of the Mozilla Public + * License, v. 2.0. If a copy of the MPL was not distributed with this + * file, You can obtain one at http://mozilla.org/MPL/2.0/. */ + +/* NSPR doesn't make these functions public, so we have to duplicate +** them in NSS. +*/ + +//HCT Based on Win32err.h +extern void nss_MD_os2_map_accept_error(PRInt32 err); +extern void nss_MD_os2_map_acceptex_error(PRInt32 err); +extern void nss_MD_os2_map_access_error(PRInt32 err); +extern void nss_MD_os2_map_bind_error(PRInt32 err); +extern void nss_MD_os2_map_close_error(PRInt32 err); +extern void nss_MD_os2_map_closedir_error(PRInt32 err); +extern void nss_MD_os2_map_connect_error(PRInt32 err); +extern void nss_MD_os2_map_default_error(PRInt32 err); +extern void nss_MD_os2_map_delete_error(PRInt32 err); +extern void nss_MD_os2_map_fstat_error(PRInt32 err); +extern void nss_MD_os2_map_fsync_error(PRInt32 err); +extern void nss_MD_os2_map_gethostname_error(PRInt32 err); +extern void nss_MD_os2_map_getpeername_error(PRInt32 err); +extern void nss_MD_os2_map_getsockname_error(PRInt32 err); +extern void nss_MD_os2_map_getsockopt_error(PRInt32 err); +extern void nss_MD_os2_map_listen_error(PRInt32 err); +extern void nss_MD_os2_map_lockf_error(PRInt32 err); +extern void nss_MD_os2_map_lseek_error(PRInt32 err); +extern void nss_MD_os2_map_mkdir_error(PRInt32 err); +extern void nss_MD_os2_map_open_error(PRInt32 err); +extern void nss_MD_os2_map_opendir_error(PRInt32 err); +extern void nss_MD_os2_map_read_error(PRInt32 err); +extern void nss_MD_os2_map_readdir_error(PRInt32 err); +extern void nss_MD_os2_map_recv_error(PRInt32 err); +extern void nss_MD_os2_map_recvfrom_error(PRInt32 err); +extern void nss_MD_os2_map_rename_error(PRInt32 err); +extern void nss_MD_os2_map_rmdir_error(PRInt32 err); +extern void nss_MD_os2_map_select_error(PRInt32 err); +extern void nss_MD_os2_map_send_error(PRInt32 err); +extern void nss_MD_os2_map_sendto_error(PRInt32 err); +extern void nss_MD_os2_map_setsockopt_error(PRInt32 err); +extern void nss_MD_os2_map_shutdown_error(PRInt32 err); +extern void nss_MD_os2_map_socket_error(PRInt32 err); +extern void nss_MD_os2_map_stat_error(PRInt32 err); +extern void nss_MD_os2_map_transmitfile_error(PRInt32 err); +extern void nss_MD_os2_map_write_error(PRInt32 err); diff --git a/security/nss/lib/ssl/preenc.h b/security/nss/lib/ssl/preenc.h new file mode 100644 index 000000000..bebff89e2 --- /dev/null +++ b/security/nss/lib/ssl/preenc.h @@ -0,0 +1,113 @@ +/* -*- Mode: C; tab-width: 4; indent-tabs-mode: nil -*- */ + +/* + * Fortezza support is removed. + * + * This Source Code Form is subject to the terms of the Mozilla Public + * License, v. 2.0. If a copy of the MPL was not distributed with this + * file, You can obtain one at http://mozilla.org/MPL/2.0/. */ + +/* Fortezza support is removed. + * This file remains so that old programs will continue to compile, + * But this functionality is no longer supported or implemented. + */ + +#include "seccomon.h" +#include "prio.h" + +typedef struct PEHeaderStr PEHeader; + +#define PE_MIME_TYPE "application/pre-encrypted" + +typedef struct PEFortezzaHeaderStr PEFortezzaHeader; +typedef struct PEFortezzaGeneratedHeaderStr PEFortezzaGeneratedHeader; +typedef struct PEFixedKeyHeaderStr PEFixedKeyHeader; +typedef struct PERSAKeyHeaderStr PERSAKeyHeader; + +struct PEFortezzaHeaderStr { + unsigned char key[12]; + unsigned char iv[24]; + unsigned char hash[20]; + unsigned char serial[8]; +}; + +struct PEFortezzaGeneratedHeaderStr { + unsigned char key[12]; + unsigned char iv[24]; + unsigned char hash[20]; + unsigned char Ra[128]; + unsigned char Y[128]; +}; + +struct PEFixedKeyHeaderStr { + unsigned char pkcs11Mech[4]; + unsigned char labelLen[2]; + unsigned char keyIDLen[2]; + unsigned char ivLen[2]; + unsigned char keyLen[2]; + unsigned char data[1]; +}; + +struct PERSAKeyHeaderStr { + unsigned char pkcs11Mech[4]; + unsigned char issuerLen[2]; + unsigned char serialLen[2]; + unsigned char ivLen[2]; + unsigned char keyLen[2]; + unsigned char data[1]; +}; + +#define PEFIXED_Label(header) (header->data) +#define PEFIXED_KeyID(header) (&header->data[GetInt2(header->labelLen)]) +#define PEFIXED_IV(header) (&header->data[GetInt2(header->labelLen) + \ + GetInt2(header->keyIDLen)]) +#define PEFIXED_Key(header) (&header->data[GetInt2(header->labelLen) + \ + GetInt2(header->keyIDLen) + \ + GetInt2(header->keyLen)]) +#define PERSA_Issuer(header) (header->data) +#define PERSA_Serial(header) (&header->data[GetInt2(header->issuerLen)]) +#define PERSA_IV(header) (&header->data[GetInt2(header->issuerLen) + \ + GetInt2(header->serialLen)]) +#define PERSA_Key(header) (&header->data[GetInt2(header->issuerLen) + \ + GetInt2(header->serialLen) + \ + GetInt2(header->keyLen)]) +struct PEHeaderStr { + unsigned char magic[2]; + unsigned char len[2]; + unsigned char type[2]; + unsigned char version[2]; + union { + PEFortezzaHeader fortezza; + PEFortezzaGeneratedHeader g_fortezza; + PEFixedKeyHeader fixed; + PERSAKeyHeader rsa; + } u; +}; + +#define PE_CRYPT_INTRO_LEN 8 +#define PE_INTRO_LEN 4 +#define PE_BASE_HEADER_LEN 8 + +#define PRE_BLOCK_SIZE 8 + +#define GetInt2(c) ((c[0] << 8) | c[1]) +#define GetInt4(c) (((unsigned long)c[0] << 24) | ((unsigned long)c[1] << 16) | \ + ((unsigned long)c[2] << 8) | ((unsigned long)c[3])) +#define PutInt2(c, i) ((c[1] = (i)&0xff), (c[0] = ((i) >> 8) & 0xff)) +#define PutInt4(c, i) ((c[0] = ((i) >> 24) & 0xff), (c[1] = ((i) >> 16) & 0xff), \ + (c[2] = ((i) >> 8) & 0xff), (c[3] = (i)&0xff)) + +#define PRE_MAGIC 0xc0de +#define PRE_VERSION 0x1010 +#define PRE_FORTEZZA_FILE 0x00ff +#define PRE_FORTEZZA_STREAM 0x00f5 +#define PRE_FORTEZZA_GEN_STREAM 0x00f6 +#define PRE_FIXED_FILE 0x000f +#define PRE_RSA_FILE 0x001f +#define PRE_FIXED_STREAM 0x0005 + +PEHeader *SSL_PreencryptedStreamToFile(PRFileDesc *fd, PEHeader *, + int *headerSize); + +PEHeader *SSL_PreencryptedFileToStream(PRFileDesc *fd, PEHeader *, + int *headerSize); diff --git a/security/nss/lib/ssl/prelib.c b/security/nss/lib/ssl/prelib.c new file mode 100644 index 000000000..4db9ffe69 --- /dev/null +++ b/security/nss/lib/ssl/prelib.c @@ -0,0 +1,34 @@ +/* -*- Mode: C; tab-width: 4; indent-tabs-mode: nil -*- */ + +/* + * Functions used by https servers to send (download) pre-encrypted files + * over SSL connections that use Fortezza ciphersuites. + * + * This Source Code Form is subject to the terms of the Mozilla Public + * License, v. 2.0. If a copy of the MPL was not distributed with this + * file, You can obtain one at http://mozilla.org/MPL/2.0/. */ + +#include "cert.h" +#include "ssl.h" +#include "keyhi.h" +#include "secitem.h" +#include "sslimpl.h" +#include "pkcs11t.h" +#include "preenc.h" +#include "pk11func.h" + +PEHeader * +SSL_PreencryptedStreamToFile(PRFileDesc *fd, PEHeader *inHeader, + int *headerSize) +{ + PORT_SetError(PR_NOT_IMPLEMENTED_ERROR); + return NULL; +} + +PEHeader * +SSL_PreencryptedFileToStream(PRFileDesc *fd, PEHeader *header, + int *headerSize) +{ + PORT_SetError(PR_NOT_IMPLEMENTED_ERROR); + return NULL; +} diff --git a/security/nss/lib/ssl/ssl.def b/security/nss/lib/ssl/ssl.def new file mode 100644 index 000000000..6aa8b6437 --- /dev/null +++ b/security/nss/lib/ssl/ssl.def @@ -0,0 +1,223 @@ +;+# +;+# This Source Code Form is subject to the terms of the Mozilla Public +;+# License, v. 2.0. If a copy of the MPL was not distributed with this +;+# file, You can obtain one at http://mozilla.org/MPL/2.0/. +;+# +;+# OK, this file is meant to support SUN, LINUX, AIX and WINDOWS +;+# 1. For all unix platforms, the string ";-" means "remove this line" +;+# 2. For all unix platforms, the string " DATA " will be removed from any +;+# line on which it occurs. +;+# 3. Lines containing ";+" will have ";+" removed on SUN and LINUX. +;+# On AIX, lines containing ";+" will be removed. +;+# 4. For all unix platforms, the string ";;" will thave the ";;" removed. +;+# 5. For all unix platforms, after the above processing has taken place, +;+# all characters after the first ";" on the line will be removed. +;+# And for AIX, the first ";" will also be removed. +;+# This file is passed directly to windows. Since ';' is a comment, all UNIX +;+# directives are hidden behind ";", ";+", and ";-" +;+ +;+NSS_3.2 { # NSS 3.2 release +;+ global: +LIBRARY ssl3 ;- +EXPORTS ;- +SSL_ImplementedCiphers DATA ; +SSL_NumImplementedCiphers DATA ; +NSS_CmpCertChainWCANames; +NSS_FindCertKEAType; +NSS_GetClientAuthData; +NSS_SetDomesticPolicy; +NSS_SetExportPolicy; +NSS_SetFrancePolicy; +SSL_AuthCertificate; +SSL_AuthCertificateHook; +SSL_BadCertHook; +SSL_CertDBHandleSet; +SSL_CipherPolicyGet; +SSL_CipherPolicySet; +SSL_CipherPrefGet; +SSL_CipherPrefGetDefault; +SSL_CipherPrefSet; +SSL_CipherPrefSetDefault; +SSL_ClearSessionCache; +SSL_ConfigMPServerSIDCache; +SSL_ConfigSecureServer; +SSL_ConfigServerSessionIDCache; +SSL_DataPending; +SSL_ForceHandshake; +SSL_GetClientAuthDataHook; +SSL_GetSessionID; +SSL_GetStatistics; +SSL_HandshakeCallback; +SSL_ImportFD; +SSL_InheritMPServerSIDCache; +SSL_InvalidateSession; +SSL_OptionGet; +SSL_OptionGetDefault; +SSL_OptionSet; +SSL_OptionSetDefault; +SSL_PeerCertificate; +SSL_PreencryptedFileToStream; +SSL_PreencryptedStreamToFile; +SSL_ReHandshake; +SSL_ResetHandshake; +SSL_RestartHandshakeAfterCertReq; +SSL_RestartHandshakeAfterServerCert; +SSL_RevealCert; +SSL_RevealPinArg; +SSL_RevealURL; +SSL_SecurityStatus; +SSL_SetPKCS11PinArg; +SSL_SetSockPeerID; +SSL_SetURL; +;+ local: +;+*; +;+}; +;+NSS_3.2.1 { # NSS 3.2.1 release +;+ global: +NSSSSL_VersionCheck; +;+ local: +;+*; +;+}; +;+NSS_3.4 { # NSS 3.4 release +;+ global: +SSL_GetChannelInfo; +SSL_GetCipherSuiteInfo; +SSL_GetMaxServerCacheLocks; +SSL_LocalCertificate; +SSL_SetMaxServerCacheLocks; +;+ local: +;+*; +;+}; +;+NSS_3.7.4 { # NSS 3.7.4 release +;+ global: +SSL_ShutdownServerSessionIDCache; +;+ local: +;+*; +;+}; +;+NSS_3.11.4 { # NSS 3.11.4 release +;+ global: +SSL_ForceHandshakeWithTimeout; +SSL_ReHandshakeWithTimeout; +;+ local: +;+*; +;+}; +;+NSS_3.11.8 { # NSS 3.11.8 release +;+ global: +SSL_CanBypass; +;+ local: +;+*; +;+}; +;+NSS_3.12.6 { # NSS 3.12.6 release +;+ global: +SSL_ConfigServerSessionIDCacheWithOpt; +SSL_GetImplementedCiphers; +SSL_GetNegotiatedHostInfo; +SSL_GetNumImplementedCiphers; +SSL_HandshakeNegotiatedExtension; +SSL_ReconfigFD; +SSL_SetTrustAnchors; +SSL_SNISocketConfigHook; +;+ local: +;+*; +;+}; +;+NSS_3.12.10 { # NSS 3.12.10 release +;+ global: +SSL_ConfigSecureServerWithCertChain; +;+ local: +;+*; +;+}; +;+NSS_3.13 { # NSS 3.13 release +;+ global: +NSSSSL_GetVersion; +;+ local: +;+ *; +;+}; +;+NSS_3.13.2 { # NSS 3.13.2 release +;+ global: +SSL_SetNextProtoCallback; +SSL_SetNextProtoNego; +SSL_GetNextProto; +SSL_AuthCertificateComplete; +;+ local: +;+ *; +;+}; +;+NSS_3.14 { # NSS 3.14 release +;+ global: +DTLS_GetHandshakeTimeout; +DTLS_ImportFD; +SSL_ExportKeyingMaterial; +SSL_VersionRangeGet; +SSL_VersionRangeGetDefault; +SSL_VersionRangeGetSupported; +SSL_VersionRangeSet; +SSL_VersionRangeSetDefault; +SSL_GetSRTPCipher; +SSL_SetSRTPCiphers; +;+ local: +;+*; +;+}; +;+NSS_3.15 { # NSS 3.15 release +;+ global: +SSL_PeerStapledOCSPResponses; +SSL_SetStapledOCSPResponses; +;+ local: +;+*; +;+}; +;+NSS_3.15.4 { # NSS 3.15.4 release +;+ global: +SSL_PeerCertificateChain; +SSL_RecommendedCanFalseStart; +SSL_SetCanFalseStartCallback; +;+ local: +;+*; +;+}; +;+NSS_3.20 { # NSS 3.20 release +;+ global: +SSL_DHEGroupPrefSet; +SSL_EnableWeakDHEPrimeGroup; +;+ local: +;+*; +;+}; +;+NSS_3.21 { # NSS 3.21 release +;+ global: +SSL_GetPreliminaryChannelInfo; +SSL_SignaturePrefSet; +SSL_SignaturePrefGet; +SSL_SignatureMaxCount; +;+ local: +;+*; +;+}; +;+NSS_3.22 { # NSS 3.22 release +;+ global: +SSL_PeerSignedCertTimestamps; +SSL_SetSignedCertTimestamps; +;+ local: +;+*; +;+}; +;+NSS_3.23 { # NSS 3.23 release +;+ global: +SSL_SetDowngradeCheckVersion; +;+ local: +;+*; +;+}; +;+NSS_3.24 { # NSS 3.24 release +;+ global: +SSL_ConfigServerCert; +;+ local: +;+*; +;+}; +;+NSS_3.27 { # NSS 3.27 release +;+ global: +SSL_NamedGroupConfig; +;+ local: +;+*; +;+}; +;+NSS_3.28 { # NSS 3.28 release +;+ global: +SSL_ExportEarlyKeyingMaterial; +SSL_SendAdditionalKeyShares; +SSL_SignatureSchemePrefSet; +SSL_SignatureSchemePrefGet; +;+ local: +;+*; +;+}; diff --git a/security/nss/lib/ssl/ssl.gyp b/security/nss/lib/ssl/ssl.gyp new file mode 100644 index 000000000..0306ab667 --- /dev/null +++ b/security/nss/lib/ssl/ssl.gyp @@ -0,0 +1,98 @@ +# This Source Code Form is subject to the terms of the Mozilla Public +# License, v. 2.0. If a copy of the MPL was not distributed with this +# file, You can obtain one at http://mozilla.org/MPL/2.0/. +{ + 'includes': [ + '../../coreconf/config.gypi' + ], + 'targets': [ + { + 'target_name': 'ssl', + 'type': 'static_library', + 'sources': [ + 'authcert.c', + 'cmpcert.c', + 'dtlscon.c', + 'prelib.c', + 'ssl3con.c', + 'ssl3ecc.c', + 'ssl3ext.c', + 'ssl3exthandle.c', + 'ssl3gthr.c', + 'sslauth.c', + 'sslcert.c', + 'sslcon.c', + 'ssldef.c', + 'sslenum.c', + 'sslerr.c', + 'sslerrstrs.c', + 'sslgrp.c', + 'sslinfo.c', + 'sslinit.c', + 'sslmutex.c', + 'sslnonce.c', + 'sslreveal.c', + 'sslsecur.c', + 'sslsnce.c', + 'sslsock.c', + 'ssltrace.c', + 'sslver.c', + 'tls13con.c', + 'tls13exthandle.c', + 'tls13hkdf.c', + ], + 'conditions': [ + [ 'OS=="win"', { + 'sources': [ + 'win32err.c', + ], + 'defines': [ + 'IN_LIBSSL', + ], + }, { + # Not Windows. + 'sources': [ + 'unix_err.c' + ], + }], + [ 'ssl_enable_zlib==1', { + 'dependencies': [ + '<(DEPTH)/lib/zlib/zlib.gyp:nss_zlib' + ], + 'defines': [ + 'NSS_SSL_ENABLE_ZLIB', + ], + }], + [ 'fuzz==1', { + 'defines': [ + 'UNSAFE_FUZZER_MODE', + ], + }], + ], + 'dependencies': [ + '<(DEPTH)/exports.gyp:nss_exports', + '<(DEPTH)/lib/freebl/freebl.gyp:freebl', + ], + }, + { + 'target_name': 'ssl3', + 'type': 'shared_library', + 'dependencies': [ + 'ssl', + '<(DEPTH)/lib/nss/nss.gyp:nss3', + '<(DEPTH)/lib/util/util.gyp:nssutil3', + ], + 'variables': { + 'mapfile': 'ssl.def' + } + } + ], + 'target_defaults': { + 'defines': [ + 'NSS_ALLOW_SSLKEYLOGFILE=1' + ] + }, + 'variables': { + 'module': 'nss' + } +} diff --git a/security/nss/lib/ssl/ssl.h b/security/nss/lib/ssl/ssl.h new file mode 100644 index 000000000..9394adcca --- /dev/null +++ b/security/nss/lib/ssl/ssl.h @@ -0,0 +1,1344 @@ +/* + * This file contains prototypes for the public SSL functions. + * + * This Source Code Form is subject to the terms of the Mozilla Public + * License, v. 2.0. If a copy of the MPL was not distributed with this + * file, You can obtain one at http://mozilla.org/MPL/2.0/. */ + +#ifndef __ssl_h_ +#define __ssl_h_ + +#include "prtypes.h" +#include "prerror.h" +#include "prio.h" +#include "seccomon.h" +#include "cert.h" +#include "keyt.h" + +#include "sslt.h" /* public ssl data types */ + +#if defined(_WIN32) && !defined(IN_LIBSSL) && !defined(NSS_USE_STATIC_LIBS) +#define SSL_IMPORT extern __declspec(dllimport) +#else +#define SSL_IMPORT extern +#endif + +SEC_BEGIN_PROTOS + +/* constant table enumerating all implemented cipher suites. */ +SSL_IMPORT const PRUint16 SSL_ImplementedCiphers[]; + +/* the same as the above, but is a function */ +SSL_IMPORT const PRUint16 *SSL_GetImplementedCiphers(void); + +/* number of entries in the above table. */ +SSL_IMPORT const PRUint16 SSL_NumImplementedCiphers; + +/* the same as the above, but is a function */ +SSL_IMPORT PRUint16 SSL_GetNumImplementedCiphers(void); + +/* Macro to tell which ciphers in table are SSL2 vs SSL3/TLS. */ +#define SSL_IS_SSL2_CIPHER(which) (((which)&0xfff0) == 0xff00) + +/* +** Imports fd into SSL, returning a new socket. Copies SSL configuration +** from model. +*/ +SSL_IMPORT PRFileDesc *SSL_ImportFD(PRFileDesc *model, PRFileDesc *fd); + +/* +** Imports fd into DTLS, returning a new socket. Copies DTLS configuration +** from model. +*/ +SSL_IMPORT PRFileDesc *DTLS_ImportFD(PRFileDesc *model, PRFileDesc *fd); + +/* +** Enable/disable an ssl mode +** +** SSL_SECURITY: +** enable/disable use of SSL security protocol before connect +** +** SSL_SOCKS: +** enable/disable use of socks before connect +** (No longer supported). +** +** SSL_REQUEST_CERTIFICATE: +** require a certificate during secure connect +*/ +/* options */ +#define SSL_SECURITY 1 /* (on by default) */ +#define SSL_SOCKS 2 /* (off by default) */ +#define SSL_REQUEST_CERTIFICATE 3 /* (off by default) */ +#define SSL_HANDSHAKE_AS_CLIENT 5 /* force accept to hs as client */ + /* (off by default) */ +#define SSL_HANDSHAKE_AS_SERVER 6 /* force connect to hs as server */ + /* (off by default) */ + +/* OBSOLETE: SSL v2 is obsolete and may be removed soon. */ +#define SSL_ENABLE_SSL2 7 /* enable ssl v2 (off by default) */ + +/* OBSOLETE: See "SSL Version Range API" below for the replacement and a +** description of the non-obvious semantics of using SSL_ENABLE_SSL3. +*/ +#define SSL_ENABLE_SSL3 8 /* enable ssl v3 (on by default) */ + +#define SSL_NO_CACHE 9 /* don't use the session cache */ + /* (off by default) */ +#define SSL_REQUIRE_CERTIFICATE 10 /* (SSL_REQUIRE_FIRST_HANDSHAKE */ + /* by default) */ +#define SSL_ENABLE_FDX 11 /* permit simultaneous read/write */ + /* (off by default) */ + +/* OBSOLETE: SSL v2 compatible hellos are not accepted by some TLS servers +** and cannot negotiate extensions. SSL v2 is obsolete. This option may be +** removed soon. +*/ +#define SSL_V2_COMPATIBLE_HELLO 12 /* send v3 client hello in v2 fmt */ + /* (off by default) */ + +/* OBSOLETE: See "SSL Version Range API" below for the replacement and a +** description of the non-obvious semantics of using SSL_ENABLE_TLS. +*/ +#define SSL_ENABLE_TLS 13 /* enable TLS (on by default) */ + +#define SSL_ROLLBACK_DETECTION 14 /* for compatibility, default: on */ +#define SSL_NO_STEP_DOWN 15 /* (unsupported, deprecated, off) */ +#define SSL_BYPASS_PKCS11 16 /* (unsupported, deprecated, off) */ +#define SSL_NO_LOCKS 17 /* Don't use locks for protection */ +#define SSL_ENABLE_SESSION_TICKETS 18 /* Enable TLS SessionTicket */ + /* extension (off by default) */ +#define SSL_ENABLE_DEFLATE 19 /* Enable TLS compression with */ + /* DEFLATE (off by default) */ +#define SSL_ENABLE_RENEGOTIATION 20 /* Values below (default: never) */ +#define SSL_REQUIRE_SAFE_NEGOTIATION 21 /* Peer must send Signaling */ + /* Cipher Suite Value (SCSV) or */ + /* Renegotiation Info (RI) */ + /* extension in ALL handshakes. */ + /* default: off */ +#define SSL_ENABLE_FALSE_START 22 /* Enable SSL false start (off by */ + /* default, applies only to */ + /* clients). False start is a */ +/* mode where an SSL client will start sending application data before + * verifying the server's Finished message. This means that we could end up + * sending data to an imposter. However, the data will be encrypted and + * only the true server can derive the session key. Thus, so long as the + * cipher isn't broken this is safe. The advantage of false start is that + * it saves a round trip for client-speaks-first protocols when performing a + * full handshake. + * + * In addition to enabling this option, the application must register a + * callback using the SSL_SetCanFalseStartCallback function. + */ + +/* For SSL 3.0 and TLS 1.0, by default we prevent chosen plaintext attacks + * on SSL CBC mode cipher suites (see RFC 4346 Section F.3) by splitting + * non-empty application_data records into two records; the first record has + * only the first byte of plaintext, and the second has the rest. + * + * This only prevents the attack in the sending direction; the connection may + * still be vulnerable to such attacks if the peer does not implement a similar + * countermeasure. + * + * This protection mechanism is on by default; the default can be overridden by + * setting NSS_SSL_CBC_RANDOM_IV=0 in the environment prior to execution, + * and/or by the application setting the option SSL_CBC_RANDOM_IV to PR_FALSE. + * + * The per-record IV in TLS 1.1 and later adds one block of overhead per + * record, whereas this hack will add at least two blocks of overhead per + * record, so TLS 1.1+ will always be more efficient. + * + * Other implementations (e.g. some versions of OpenSSL, in some + * configurations) prevent the same attack by prepending an empty + * application_data record to every application_data record they send; we do + * not do that because some implementations cannot handle empty + * application_data records. Also, we only split application_data records and + * not other types of records, because some implementations will not accept + * fragmented records of some other types (e.g. some versions of NSS do not + * accept fragmented alerts). + */ +#define SSL_CBC_RANDOM_IV 23 +#define SSL_ENABLE_OCSP_STAPLING 24 /* Request OCSP stapling (client) */ + +/* SSL_ENABLE_NPN controls whether the NPN extension is enabled for the initial + * handshake when application layer protocol negotiation is used. + * SSL_SetNextProtoCallback or SSL_SetNextProtoNego must be used to control the + * application layer protocol negotiation; otherwise, the NPN extension will + * not be negotiated. SSL_ENABLE_NPN is currently enabled by default but this + * may change in future versions. + */ +#define SSL_ENABLE_NPN 25 + +/* SSL_ENABLE_ALPN controls whether the ALPN extension is enabled for the + * initial handshake when application layer protocol negotiation is used. + * SSL_SetNextProtoNego (not SSL_SetNextProtoCallback) must be used to control + * the application layer protocol negotiation; otherwise, the ALPN extension + * will not be negotiated. ALPN is not negotiated for renegotiation handshakes, + * even though the ALPN specification defines a way to use ALPN during + * renegotiations. SSL_ENABLE_ALPN is currently disabled by default, but this + * may change in future versions. + */ +#define SSL_ENABLE_ALPN 26 + +/* SSL_REUSE_SERVER_ECDHE_KEY controls whether the ECDHE server key is + * reused for multiple handshakes or generated each time. + * SSL_REUSE_SERVER_ECDHE_KEY is currently enabled by default. + * This socket option is for ECDHE, only. It is unrelated to DHE. + */ +#define SSL_REUSE_SERVER_ECDHE_KEY 27 + +#define SSL_ENABLE_FALLBACK_SCSV 28 /* Send fallback SCSV in \ + * handshakes. */ + +/* SSL_ENABLE_SERVER_DHE controls whether DHE is enabled for the server socket. + */ +#define SSL_ENABLE_SERVER_DHE 29 + +/* Use draft-ietf-tls-session-hash. Controls whether we offer the + * extended_master_secret extension which, when accepted, hashes + * the handshake transcript into the master secret. This option is + * disabled by default. + */ +#define SSL_ENABLE_EXTENDED_MASTER_SECRET 30 + +/* Request Signed Certificate Timestamps via TLS extension (client) */ +#define SSL_ENABLE_SIGNED_CERT_TIMESTAMPS 31 + +/* Ordinarily, when negotiating a TLS_DHE_* cipher suite the server picks the + * group. draft-ietf-tls-negotiated-ff-dhe changes this to use supported_groups + * (formerly supported_curves) to signal which pre-defined groups are OK. + * + * This option causes an NSS client to use this extension and demand that those + * groups be used. A client will signal any enabled DHE groups in the + * supported_groups extension and reject groups that don't match what it has + * enabled. A server will only negotiate TLS_DHE_* cipher suites if the + * client includes the extension. + * + * See SSL_NamedGroupConfig() for how to control which groups are enabled. + * + * This option cannot be enabled if NSS is not compiled with ECC support. + */ +#define SSL_REQUIRE_DH_NAMED_GROUPS 32 + +/* Allow 0-RTT data (for TLS 1.3). + * + * When this option is set, the server's session tickets will contain + * a flag indicating that it accepts 0-RTT. When resuming such a + * session, PR_Write() on the client will be allowed immediately after + * starting the handshake and PR_Read() on the server will be allowed + * on the server to read that data. Calls to + * SSL_GetPreliminaryChannelInfo() and SSL_GetNextProto() + * can be made used during this period to learn about the channel + * parameters [TODO(ekr@rtfm.com): This hasn't landed yet]. + * + * The transition between the 0-RTT and 1-RTT modes is marked by the + * handshake callback. + * + * WARNING: 0-RTT data has different anti-replay and PFS properties than + * the rest of the TLS data. See [draft-ietf-tls-tls13; Section 6.2.3] + * for more details. + */ +#define SSL_ENABLE_0RTT_DATA 33 + +#ifdef SSL_DEPRECATED_FUNCTION +/* Old deprecated function names */ +SSL_IMPORT SECStatus SSL_Enable(PRFileDesc *fd, int option, PRBool on); +SSL_IMPORT SECStatus SSL_EnableDefault(int option, PRBool on); +#endif + +/* New function names */ +SSL_IMPORT SECStatus SSL_OptionSet(PRFileDesc *fd, PRInt32 option, PRBool on); +SSL_IMPORT SECStatus SSL_OptionGet(PRFileDesc *fd, PRInt32 option, PRBool *on); +SSL_IMPORT SECStatus SSL_OptionSetDefault(PRInt32 option, PRBool on); +SSL_IMPORT SECStatus SSL_OptionGetDefault(PRInt32 option, PRBool *on); +SSL_IMPORT SECStatus SSL_CertDBHandleSet(PRFileDesc *fd, CERTCertDBHandle *dbHandle); + +/* SSLNextProtoCallback is called during the handshake for the client, when a + * Next Protocol Negotiation (NPN) extension has been received from the server. + * |protos| and |protosLen| define a buffer which contains the server's + * advertisement. This data is guaranteed to be well formed per the NPN spec. + * |protoOut| is a buffer provided by the caller, of length 255 (the maximum + * allowed by the protocol). On successful return, the protocol to be announced + * to the server will be in |protoOut| and its length in |*protoOutLen|. + * + * The callback must return SECFailure or SECSuccess (not SECWouldBlock). + */ +typedef SECStatus(PR_CALLBACK *SSLNextProtoCallback)( + void *arg, + PRFileDesc *fd, + const unsigned char *protos, + unsigned int protosLen, + unsigned char *protoOut, + unsigned int *protoOutLen, + unsigned int protoMaxOut); + +/* SSL_SetNextProtoCallback sets a callback function to handle Next Protocol + * Negotiation. It causes a client to advertise NPN. */ +SSL_IMPORT SECStatus SSL_SetNextProtoCallback(PRFileDesc *fd, + SSLNextProtoCallback callback, + void *arg); + +/* SSL_SetNextProtoNego can be used as an alternative to + * SSL_SetNextProtoCallback. It also causes a client to advertise NPN and + * installs a default callback function which selects the first supported + * protocol in server-preference order. If no matching protocol is found it + * selects the first supported protocol. + * + * Using this function also allows the client to transparently support ALPN. + * The same set of protocols will be advertised via ALPN and, if the server + * uses ALPN to select a protocol, SSL_GetNextProto will return + * SSL_NEXT_PROTO_SELECTED as the state. + * + * Since NPN uses the first protocol as the fallback protocol, when sending an + * ALPN extension, the first protocol is moved to the end of the list. This + * indicates that the fallback protocol is the least preferred. The other + * protocols should be in preference order. + * + * The supported protocols are specified in |data| in wire-format (8-bit + * length-prefixed). For example: "\010http/1.1\006spdy/2". */ +SSL_IMPORT SECStatus SSL_SetNextProtoNego(PRFileDesc *fd, + const unsigned char *data, + unsigned int length); + +typedef enum SSLNextProtoState { + SSL_NEXT_PROTO_NO_SUPPORT = 0, /* No peer support */ + SSL_NEXT_PROTO_NEGOTIATED = 1, /* Mutual agreement */ + SSL_NEXT_PROTO_NO_OVERLAP = 2, /* No protocol overlap found */ + SSL_NEXT_PROTO_SELECTED = 3, /* Server selected proto (ALPN) */ + SSL_NEXT_PROTO_EARLY_VALUE = 4 /* We are in 0-RTT using this value. */ +} SSLNextProtoState; + +/* SSL_GetNextProto can be used in the HandshakeCallback or any time after + * a handshake to retrieve the result of the Next Protocol negotiation. + * + * The length of the negotiated protocol, if any, is written into *bufLen. + * If the negotiated protocol is longer than bufLenMax, then SECFailure is + * returned. Otherwise, the negotiated protocol, if any, is written into buf, + * and SECSuccess is returned. */ +SSL_IMPORT SECStatus SSL_GetNextProto(PRFileDesc *fd, + SSLNextProtoState *state, + unsigned char *buf, + unsigned int *bufLen, + unsigned int bufLenMax); + +/* +** Control ciphers that SSL uses. If on is non-zero then the named cipher +** is enabled, otherwise it is disabled. +** The "cipher" values are defined in sslproto.h (the SSL_EN_* values). +** EnableCipher records user preferences. +** SetPolicy sets the policy according to the policy module. +*/ +#ifdef SSL_DEPRECATED_FUNCTION +/* Old deprecated function names */ +SSL_IMPORT SECStatus SSL_EnableCipher(long which, PRBool enabled); +SSL_IMPORT SECStatus SSL_SetPolicy(long which, int policy); +#endif + +/* New function names */ +SSL_IMPORT SECStatus SSL_CipherPrefSet(PRFileDesc *fd, PRInt32 cipher, PRBool enabled); +SSL_IMPORT SECStatus SSL_CipherPrefGet(PRFileDesc *fd, PRInt32 cipher, PRBool *enabled); +SSL_IMPORT SECStatus SSL_CipherPrefSetDefault(PRInt32 cipher, PRBool enabled); +SSL_IMPORT SECStatus SSL_CipherPrefGetDefault(PRInt32 cipher, PRBool *enabled); +SSL_IMPORT SECStatus SSL_CipherPolicySet(PRInt32 cipher, PRInt32 policy); +SSL_IMPORT SECStatus SSL_CipherPolicyGet(PRInt32 cipher, PRInt32 *policy); + +/* +** Control for TLS signature schemes for TLS 1.2 and 1.3. +** +** This governs what signature schemes (or algorithms) are sent by a client in +** the signature_algorithms extension. A client will not accept a signature +** from a server unless it uses an enabled algorithm. +** +** This also governs what the server sends in the supported_signature_algorithms +** field of a CertificateRequest. +** +** This changes what the server uses to sign ServerKeyExchange and +** CertificateVerify messages. An endpoint uses the first entry from this list +** that is compatible with both its certificate and its peer's supported +** values. +** +** This configuration affects TLS 1.2, but the combination of EC group and hash +** algorithm is interpreted loosely to be compatible with other implementations. +** For TLS 1.2, NSS will ignore the curve group when generating or verifying +** ECDSA signatures. For example, a P-384 ECDSA certificate is used with +** SHA-256 if ssl_sig_ecdsa_secp256r1_sha256 is enabled. +** +** Omitting SHA-256 schemes from this list might be foolish. Support is +** mandatory in TLS 1.2 and 1.3 and there might be interoperability issues. +*/ +SSL_IMPORT SECStatus SSL_SignatureSchemePrefSet( + PRFileDesc *fd, const SSLSignatureScheme *schemes, unsigned int count); + +/* Deprecated, use SSL_SignatureSchemePrefSet() instead. */ +SSL_IMPORT SECStatus SSL_SignaturePrefSet( + PRFileDesc *fd, const SSLSignatureAndHashAlg *algorithms, + unsigned int count); + +/* +** Get the currently configured signature schemes. +** +** The schemes are written to |schemes| but not if there are more than +** |maxCount| values configured. The number of schemes that are in use are +** written to |count|. This fails if |maxCount| is insufficiently large. +*/ +SSL_IMPORT SECStatus SSL_SignatureSchemePrefGet( + PRFileDesc *fd, SSLSignatureScheme *algorithms, unsigned int *count, + unsigned int maxCount); + +/* Deprecated, use SSL_SignatureSchemePrefGet() instead. */ +SSL_IMPORT SECStatus SSL_SignaturePrefGet( + PRFileDesc *fd, SSLSignatureAndHashAlg *algorithms, unsigned int *count, + unsigned int maxCount); + +/* +** Returns the maximum number of signature algorithms that are supported and +** can be set or retrieved using SSL_SignatureSchemePrefSet or +** SSL_SignatureSchemePrefGet. +*/ +SSL_IMPORT unsigned int SSL_SignatureMaxCount(); + +/* +** Define custom priorities for EC and FF groups used in DH key exchange and EC +** groups for ECDSA. This only changes the order of enabled lists (and thus +** their priorities) and enables all groups in |groups| while disabling all other +** groups. +*/ +SSL_IMPORT SECStatus SSL_NamedGroupConfig(PRFileDesc *fd, + const SSLNamedGroup *groups, + unsigned int num_groups); + +/* +** Configure the socket to configure additional key shares. Normally when a TLS +** 1.3 ClientHello is sent, just one key share is included using the first +** preference group (as set by SSL_NamedGroupConfig). If the server decides to +** pick a different group for key exchange, it is forced to send a +** HelloRetryRequest, which adds an entire round trip of latency. +** +** This function can be used to configure libssl to generate additional key +** shares when sending a TLS 1.3 ClientHello. If |count| is set to a non-zero +** value, then additional key shares are generated. Shares are added in the +** preference order set in SSL_NamedGroupConfig. |count| can be set to any +** value; NSS limits the number of shares to the number of supported groups. +*/ +SSL_IMPORT SECStatus SSL_SendAdditionalKeyShares(PRFileDesc *fd, + unsigned int count); + +/* Deprecated: use SSL_NamedGroupConfig() instead. +** SSL_DHEGroupPrefSet is used to configure the set of allowed/enabled DHE group +** parameters that can be used by NSS for the given server socket. +** The first item in the array is used as the default group, if no other +** selection criteria can be used by NSS. +** The set is provided as an array of identifiers as defined by SSLDHEGroupType. +** If more than one group identifier is provided, NSS will select the one to use. +** For example, a TLS extension sent by the client might indicate a preference. +*/ +SSL_IMPORT SECStatus SSL_DHEGroupPrefSet(PRFileDesc *fd, + const SSLDHEGroupType *groups, + PRUint16 num_groups); + +/* Enable the use of a DHE group that's smaller than the library default, +** for backwards compatibility reasons. The DH parameters will be created +** at the time this function is called, which might take a very long time. +** The function will block until generation is completed. +** The intention is to enforce that fresh and safe parameters are generated +** each time a process is started. +** At the time this API was initially implemented, the API will enable the +** use of 1024 bit DHE parameters. This value might get increased in future +** versions of NSS. +** +** It is allowed to call this API will a NULL value for parameter fd, +** which will prepare the global parameters that NSS will reuse for the remainder +** of the process lifetime. This can be used early after startup of a process, +** to avoid a delay when handling incoming client connections. +** This preparation with a NULL for parameter fd will NOT enable the weak group +** on sockets. The function needs to be called again for every socket that +** should use the weak group. +** +** It is allowed to use this API in combination with the SSL_NamedGroupConfig API. +** If both APIs have been called, the weakest group will be used, unless it is +** certain that the client supports larger group parameters. The weak group will +** be used as the default group for TLS <= 1.2, overriding the preference for +** the first group potentially set with a call to SSL_NamedGroupConfig. +*/ +SSL_IMPORT SECStatus SSL_EnableWeakDHEPrimeGroup(PRFileDesc *fd, PRBool enabled); + +/* SSL Version Range API +** +** This API should be used to control SSL 3.0 & TLS support instead of the +** older SSL_Option* API; however, the SSL_Option* API MUST still be used to +** control SSL 2.0 support. In this version of libssl, SSL 3.0 and TLS 1.0 are +** enabled by default. Future versions of libssl may change which versions of +** the protocol are enabled by default. +** +** The SSLProtocolVariant enum indicates whether the protocol is of type +** stream or datagram. This must be provided to the functions that do not +** take an fd. Functions which take an fd will get the variant from the fd, +** which is typed. +** +** Using the new version range API in conjunction with the older +** SSL_OptionSet-based API for controlling the enabled protocol versions may +** cause unexpected results. Going forward, we guarantee only the following: +** +** SSL_OptionGet(SSL_ENABLE_TLS) will return PR_TRUE if *ANY* versions of TLS +** are enabled. +** +** SSL_OptionSet(SSL_ENABLE_TLS, PR_FALSE) will disable *ALL* versions of TLS, +** including TLS 1.0 and later. +** +** The above two properties provide compatibility for applications that use +** SSL_OptionSet to implement the insecure fallback from TLS 1.x to SSL 3.0. +** +** SSL_OptionSet(SSL_ENABLE_TLS, PR_TRUE) will enable TLS 1.0, and may also +** enable some later versions of TLS, if it is necessary to do so in order to +** keep the set of enabled versions contiguous. For example, if TLS 1.2 is +** enabled, then after SSL_OptionSet(SSL_ENABLE_TLS, PR_TRUE), TLS 1.0, +** TLS 1.1, and TLS 1.2 will be enabled, and the call will have no effect on +** whether SSL 3.0 is enabled. If no later versions of TLS are enabled at the +** time SSL_OptionSet(SSL_ENABLE_TLS, PR_TRUE) is called, then no later +** versions of TLS will be enabled by the call. +** +** SSL_OptionSet(SSL_ENABLE_SSL3, PR_FALSE) will disable SSL 3.0, and will not +** change the set of TLS versions that are enabled. +** +** SSL_OptionSet(SSL_ENABLE_SSL3, PR_TRUE) will enable SSL 3.0, and may also +** enable some versions of TLS if TLS 1.1 or later is enabled at the time of +** the call, the same way SSL_OptionSet(SSL_ENABLE_TLS, PR_TRUE) works, in +** order to keep the set of enabled versions contiguous. +*/ + +/* Returns, in |*vrange|, the range of SSL3/TLS versions supported for the +** given protocol variant by the version of libssl linked-to at runtime. +*/ +SSL_IMPORT SECStatus SSL_VersionRangeGetSupported( + SSLProtocolVariant protocolVariant, SSLVersionRange *vrange); + +/* Returns, in |*vrange|, the range of SSL3/TLS versions enabled by default +** for the given protocol variant. +*/ +SSL_IMPORT SECStatus SSL_VersionRangeGetDefault( + SSLProtocolVariant protocolVariant, SSLVersionRange *vrange); + +/* Sets the range of enabled-by-default SSL3/TLS versions for the given +** protocol variant to |*vrange|. +*/ +SSL_IMPORT SECStatus SSL_VersionRangeSetDefault( + SSLProtocolVariant protocolVariant, const SSLVersionRange *vrange); + +/* Returns, in |*vrange|, the range of enabled SSL3/TLS versions for |fd|. */ +SSL_IMPORT SECStatus SSL_VersionRangeGet(PRFileDesc *fd, + SSLVersionRange *vrange); + +/* Sets the range of enabled SSL3/TLS versions for |fd| to |*vrange|. */ +SSL_IMPORT SECStatus SSL_VersionRangeSet(PRFileDesc *fd, + const SSLVersionRange *vrange); + +/* Sets the version to check the server random against for the + * fallback check defined in [draft-ietf-tls-tls13-11 Section 6.3.1.1]. + * This function is provided to allow for detection of forced downgrade + * attacks against client-side reconnect-and-fallback outside of TLS + * by setting |version| to be that of the original connection, rather + * than that of the new connection. + * + * The default, which can also be enabled by setting |version| to + * zero, is just to check against the max version in the + * version range (see SSL_VersionRangeSet). */ +SSL_IMPORT SECStatus SSL_SetDowngradeCheckVersion(PRFileDesc *fd, + PRUint16 version); + +/* Values for "policy" argument to SSL_CipherPolicySet */ +/* Values returned by SSL_CipherPolicyGet. */ +#define SSL_NOT_ALLOWED 0 /* or invalid or unimplemented */ +#define SSL_ALLOWED 1 +#define SSL_RESTRICTED 2 /* only with "Step-Up" certs. */ + +/* Values for "on" with SSL_REQUIRE_CERTIFICATE. */ +#define SSL_REQUIRE_NEVER ((PRBool)0) +#define SSL_REQUIRE_ALWAYS ((PRBool)1) +#define SSL_REQUIRE_FIRST_HANDSHAKE ((PRBool)2) +#define SSL_REQUIRE_NO_ERROR ((PRBool)3) + +/* Values for "on" with SSL_ENABLE_RENEGOTIATION */ +/* Never renegotiate at all. */ +#define SSL_RENEGOTIATE_NEVER ((PRBool)0) +/* Renegotiate without restriction, whether or not the peer's client hello */ +/* bears the renegotiation info extension. Vulnerable, as in the past. */ +#define SSL_RENEGOTIATE_UNRESTRICTED ((PRBool)1) +/* Only renegotiate if the peer's hello bears the TLS renegotiation_info */ +/* extension. This is safe renegotiation. */ +#define SSL_RENEGOTIATE_REQUIRES_XTN ((PRBool)2) +/* Disallow unsafe renegotiation in server sockets only, but allow clients */ +/* to continue to renegotiate with vulnerable servers. */ +/* This value should only be used during the transition period when few */ +/* servers have been upgraded. */ +#define SSL_RENEGOTIATE_TRANSITIONAL ((PRBool)3) + +/* +** Reset the handshake state for fd. This will make the complete SSL +** handshake protocol execute from the ground up on the next i/o +** operation. +*/ +SSL_IMPORT SECStatus SSL_ResetHandshake(PRFileDesc *fd, PRBool asServer); + +/* +** Force the handshake for fd to complete immediately. This blocks until +** the complete SSL handshake protocol is finished. +*/ +SSL_IMPORT SECStatus SSL_ForceHandshake(PRFileDesc *fd); + +/* +** Same as above, but with an I/O timeout. + */ +SSL_IMPORT SECStatus SSL_ForceHandshakeWithTimeout(PRFileDesc *fd, + PRIntervalTime timeout); + +/* +** Query security status of socket. *on is set to one if security is +** enabled. *keySize will contain the stream key size used. *issuer will +** contain the RFC1485 verison of the name of the issuer of the +** certificate at the other end of the connection. For a client, this is +** the issuer of the server's certificate; for a server, this is the +** issuer of the client's certificate (if any). Subject is the subject of +** the other end's certificate. The pointers can be zero if the desired +** data is not needed. All strings returned by this function are owned +** by the caller, and need to be freed with PORT_Free. +*/ +SSL_IMPORT SECStatus SSL_SecurityStatus(PRFileDesc *fd, int *on, char **cipher, + int *keySize, int *secretKeySize, + char **issuer, char **subject); + +/* Values for "on" */ +#define SSL_SECURITY_STATUS_NOOPT -1 +#define SSL_SECURITY_STATUS_OFF 0 +#define SSL_SECURITY_STATUS_ON_HIGH 1 +#define SSL_SECURITY_STATUS_ON_LOW 2 +#define SSL_SECURITY_STATUS_FORTEZZA 3 /* NO LONGER SUPPORTED */ + +/* +** Return the certificate for our SSL peer. If the client calls this +** it will always return the server's certificate. If the server calls +** this, it may return NULL if client authentication is not enabled or +** if the client had no certificate when asked. +** "fd" the socket "file" descriptor +*/ +SSL_IMPORT CERTCertificate *SSL_PeerCertificate(PRFileDesc *fd); + +/* +** Return the certificates presented by the SSL peer. If the SSL peer +** did not present certificates, return NULL with the +** SSL_ERROR_NO_CERTIFICATE error. On failure, return NULL with an error +** code other than SSL_ERROR_NO_CERTIFICATE. +** "fd" the socket "file" descriptor +*/ +SSL_IMPORT CERTCertList *SSL_PeerCertificateChain(PRFileDesc *fd); + +/* SSL_PeerStapledOCSPResponses returns the OCSP responses that were provided + * by the TLS server. The return value is a pointer to an internal SECItemArray + * that contains the returned OCSP responses; it is only valid until the + * callback function that calls SSL_PeerStapledOCSPResponses returns. + * + * If no OCSP responses were given by the server then the result will be empty. + * If there was an error, then the result will be NULL. + * + * You must set the SSL_ENABLE_OCSP_STAPLING option to enable OCSP stapling. + * to be provided by a server. + * + * libssl does not do any validation of the OCSP response itself; the + * authenticate certificate hook is responsible for doing so. The default + * authenticate certificate hook, SSL_AuthCertificate, does not implement + * any OCSP stapling funtionality, but this may change in future versions. + */ +SSL_IMPORT const SECItemArray *SSL_PeerStapledOCSPResponses(PRFileDesc *fd); + +/* SSL_PeerSignedCertTimestamps returns the signed_certificate_timestamp + * extension data provided by the TLS server. The return value is a pointer + * to an internal SECItem that contains the returned response (as a serialized + * SignedCertificateTimestampList, see RFC 6962). The returned pointer is only + * valid until the callback function that calls SSL_PeerSignedCertTimestamps + * (e.g. the authenticate certificate hook, or the handshake callback) returns. + * + * If no Signed Certificate Timestamps were given by the server then the result + * will be empty. If there was an error, then the result will be NULL. + * + * You must set the SSL_ENABLE_SIGNED_CERT_TIMESTAMPS option to indicate support + * for Signed Certificate Timestamps to a server. + * + * libssl does not do any parsing or validation of the response itself. + */ +SSL_IMPORT const SECItem *SSL_PeerSignedCertTimestamps(PRFileDesc *fd); + +/* SSL_SetStapledOCSPResponses stores an array of one or multiple OCSP responses + * in the fd's data, which may be sent as part of a server side cert_status + * handshake message. Parameter |responses| is for the server certificate of + * the key exchange type |kea|. + * The function will duplicate the responses array. + * + * Deprecated: see SSL_ConfigSecureServer for details. + */ +SSL_IMPORT SECStatus +SSL_SetStapledOCSPResponses(PRFileDesc *fd, const SECItemArray *responses, + SSLKEAType kea); + +/* + * SSL_SetSignedCertTimestamps stores serialized signed_certificate_timestamp + * extension data in the fd. The signed_certificate_timestamp data is sent + * during the handshake (if requested by the client). Parameter |scts| + * is for the server certificate of the key exchange type |kea|. + * The function will duplicate the provided data item. To clear previously + * set data for a given key exchange type |kea|, pass NULL to |scts|. + * + * Deprecated: see SSL_ConfigSecureServer for details. + */ +SSL_IMPORT SECStatus +SSL_SetSignedCertTimestamps(PRFileDesc *fd, const SECItem *scts, + SSLKEAType kea); + +/* +** Authenticate certificate hook. Called when a certificate comes in +** (because of SSL_REQUIRE_CERTIFICATE in SSL_Enable) to authenticate the +** certificate. +** +** The authenticate certificate hook must return SECSuccess to indicate the +** certificate is valid, SECFailure to indicate the certificate is invalid, +** or SECWouldBlock if the application will authenticate the certificate +** asynchronously. SECWouldBlock is only supported for non-blocking sockets. +** +** If the authenticate certificate hook returns SECFailure, then the bad cert +** hook will be called. The bad cert handler is NEVER called if the +** authenticate certificate hook returns SECWouldBlock. If the application +** needs to handle and/or override a bad cert, it should do so before it +** calls SSL_AuthCertificateComplete (modifying the error it passes to +** SSL_AuthCertificateComplete as needed). +** +** See the documentation for SSL_AuthCertificateComplete for more information +** about the asynchronous behavior that occurs when the authenticate +** certificate hook returns SECWouldBlock. +** +** RFC 6066 says that clients should send the bad_certificate_status_response +** alert when they encounter an error processing the stapled OCSP response. +** libssl does not provide a way for the authenticate certificate hook to +** indicate that an OCSP error (SEC_ERROR_OCSP_*) that it returns is an error +** in the stapled OCSP response or an error in some other OCSP response. +** Further, NSS does not provide a convenient way to control or determine +** which OCSP response(s) were used to validate a certificate chain. +** Consequently, the current version of libssl does not ever send the +** bad_certificate_status_response alert. This may change in future releases. +*/ +typedef SECStatus(PR_CALLBACK *SSLAuthCertificate)(void *arg, PRFileDesc *fd, + PRBool checkSig, + PRBool isServer); + +SSL_IMPORT SECStatus SSL_AuthCertificateHook(PRFileDesc *fd, + SSLAuthCertificate f, + void *arg); + +/* An implementation of the certificate authentication hook */ +SSL_IMPORT SECStatus SSL_AuthCertificate(void *arg, PRFileDesc *fd, + PRBool checkSig, PRBool isServer); + +/* + * Prototype for SSL callback to get client auth data from the application. + * arg - application passed argument + * caNames - pointer to distinguished names of CAs that the server likes + * pRetCert - pointer to pointer to cert, for return of cert + * pRetKey - pointer to key pointer, for return of key + */ +typedef SECStatus(PR_CALLBACK *SSLGetClientAuthData)(void *arg, + PRFileDesc *fd, + CERTDistNames *caNames, + CERTCertificate **pRetCert, /*return */ + SECKEYPrivateKey **pRetKey); /* return */ + +/* + * Set the client side callback for SSL to retrieve user's private key + * and certificate. + * fd - the file descriptor for the connection in question + * f - the application's callback that delivers the key and cert + * a - application specific data + */ +SSL_IMPORT SECStatus SSL_GetClientAuthDataHook(PRFileDesc *fd, + SSLGetClientAuthData f, void *a); + +/* +** SNI extension processing callback function. +** It is called when SSL socket receives SNI extension in ClientHello message. +** Upon this callback invocation, application is responsible to reconfigure the +** socket with the data for a particular server name. +** There are three potential outcomes of this function invocation: +** * application does not recognize the name or the type and wants the +** "unrecognized_name" alert be sent to the client. In this case the callback +** function must return SSL_SNI_SEND_ALERT status. +** * application does not recognize the name, but wants to continue with +** the handshake using the current socket configuration. In this case, +** no socket reconfiguration is needed and the function should return +** SSL_SNI_CURRENT_CONFIG_IS_USED. +** * application recognizes the name and reconfigures the socket with +** appropriate certs, key, etc. There are many ways to reconfigure. NSS +** provides SSL_ReconfigFD function that can be used to update the socket +** data from model socket. To continue with the rest of the handshake, the +** implementation function should return an index of a name it has chosen. +** LibSSL will ignore any SNI extension received in a ClientHello message +** if application does not register a SSLSNISocketConfig callback. +** Each type field of SECItem indicates the name type. +** NOTE: currently RFC3546 defines only one name type: sni_host_name. +** Client is allowed to send only one name per known type. LibSSL will +** send an "unrecognized_name" alert if SNI extension name list contains more +** then one name of a type. +*/ +typedef PRInt32(PR_CALLBACK *SSLSNISocketConfig)(PRFileDesc *fd, + const SECItem *srvNameArr, + PRUint32 srvNameArrSize, + void *arg); + +/* +** SSLSNISocketConfig should return an index within 0 and srvNameArrSize-1 +** when it has reconfigured the socket fd to use certs and keys, etc +** for a specific name. There are two other allowed return values. One +** tells libSSL to use the default cert and key. The other tells libSSL +** to send the "unrecognized_name" alert. These values are: +**/ +#define SSL_SNI_CURRENT_CONFIG_IS_USED -1 +#define SSL_SNI_SEND_ALERT -2 + +/* +** Set application implemented SNISocketConfig callback. +*/ +SSL_IMPORT SECStatus SSL_SNISocketConfigHook(PRFileDesc *fd, + SSLSNISocketConfig f, + void *arg); + +/* +** Reconfigure fd SSL socket with model socket parameters. Sets +** server certs and keys, list of trust anchor, socket options +** and all SSL socket call backs and parameters. +*/ +SSL_IMPORT PRFileDesc *SSL_ReconfigFD(PRFileDesc *model, PRFileDesc *fd); + +/* + * Set the client side argument for SSL to retrieve PKCS #11 pin. + * fd - the file descriptor for the connection in question + * a - pkcs11 application specific data + */ +SSL_IMPORT SECStatus SSL_SetPKCS11PinArg(PRFileDesc *fd, void *a); + +/* +** This is a callback for dealing with server certs that are not authenticated +** by the client. The client app can decide that it actually likes the +** cert by some external means and restart the connection. +** +** The bad cert hook must return SECSuccess to override the result of the +** authenticate certificate hook, SECFailure if the certificate should still be +** considered invalid, or SECWouldBlock if the application will authenticate +** the certificate asynchronously. SECWouldBlock is only supported for +** non-blocking sockets. +** +** See the documentation for SSL_AuthCertificateComplete for more information +** about the asynchronous behavior that occurs when the bad cert hook returns +** SECWouldBlock. +*/ +typedef SECStatus(PR_CALLBACK *SSLBadCertHandler)(void *arg, PRFileDesc *fd); +SSL_IMPORT SECStatus SSL_BadCertHook(PRFileDesc *fd, SSLBadCertHandler f, + void *arg); + +/* +** Configure SSL socket for running a secure server. Needs the +** certificate for the server and the servers private key. The arguments +** are copied. +** +** This method should be used in preference to SSL_ConfigSecureServer, +** SSL_ConfigSecureServerWithCertChain, SSL_SetStapledOCSPResponses, and +** SSL_SetSignedCertTimestamps. +** +** The authentication method is determined from the certificate and private key +** based on how libssl authenticates peers. Primarily, this uses the value of +** the SSLAuthType enum and is derived from the type of public key in the +** certificate. For example, different RSA certificates might be saved for +** signing (ssl_auth_rsa_sign) and key encipherment +** (ssl_auth_rsa_decrypt). Unique to RSA, the same certificate can be used for +** both usages. Additional information about the authentication method is also +** used: EC keys with different curves are separately stored. +** +** Only one certificate is stored for each authentication method. +** +** The optional |data| argument contains additional information about the +** certificate: +** +** - |authType| (with a value other than ssl_auth_null) limits the +** authentication method; this is primarily useful in limiting the use of an +** RSA certificate to one particular key usage (either signing or key +** encipherment) when its key usages indicate support for both. +** +** - |certChain| provides an explicit certificate chain, rather than relying on +** NSS functions for finding a certificate chain. +** +** - |stapledOCSPResponses| provides a response for OCSP stapling. +** +** - |signedCertTimestamps| provides a value for the +** signed_certificate_timestamp extension used in certificate transparency. +** +** The |data_len| argument provides the length of the data. This should be set +** to |sizeof(data)|. +** +** This function allows an application to provide certificates with narrow key +** usages attached to them. For instance, RSA keys can be provided that are +** limited to signing or decryption only. Multiple EC certificates with keys on +** different named curves can be provided. +** +** Unlike SSL_ConfigSecureServer(WithCertChain), this function does not accept +** NULL for the |cert| and |key| arguments. It will replace certificates that +** have the same type, but it cannot be used to remove certificates that have +** already been configured. +*/ +SSL_IMPORT SECStatus SSL_ConfigServerCert( + PRFileDesc *fd, CERTCertificate *cert, SECKEYPrivateKey *key, + const SSLExtraServerCertData *data, unsigned int data_len); + +/* +** Deprecated variant of SSL_ConfigServerCert. +** +** This uses values from the SSLKEAType to identify the type of |key| that the +** |cert| contains. This is incorrect, since key exchange and authentication +** are separated in some cipher suites (in particular, ECDHE_RSA_* suites). +** +** Providing a |kea| parameter of ssl_kea_ecdh (or kt_ecdh) is interpreted as +** providing both ECDH and ECDSA certificates. +*/ +SSL_IMPORT SECStatus SSL_ConfigSecureServer( + PRFileDesc *fd, CERTCertificate *cert, + SECKEYPrivateKey *key, SSLKEAType kea); + +/* +** Deprecated variant of SSL_ConfigSecureServerCert. The |data| argument to +** SSL_ConfigSecureServerCert can be used to pass a certificate chain. +*/ +SSL_IMPORT SECStatus +SSL_ConfigSecureServerWithCertChain(PRFileDesc *fd, CERTCertificate *cert, + const CERTCertificateList *certChainOpt, + SECKEYPrivateKey *key, SSLKEAType kea); + +/* +** Configure a secure server's session-id cache. Define the maximum number +** of entries in the cache, the longevity of the entires, and the directory +** where the cache files will be placed. These values can be zero, and +** if so, the implementation will choose defaults. +** This version of the function is for use in applications that have only one +** process that uses the cache (even if that process has multiple threads). +*/ +SSL_IMPORT SECStatus SSL_ConfigServerSessionIDCache(int maxCacheEntries, + PRUint32 timeout, + PRUint32 ssl3_timeout, + const char *directory); + +/* Configure a secure server's session-id cache. Depends on value of + * enableMPCache, configures malti-proc or single proc cache. */ +SSL_IMPORT SECStatus SSL_ConfigServerSessionIDCacheWithOpt( + PRUint32 timeout, + PRUint32 ssl3_timeout, + const char *directory, + int maxCacheEntries, + int maxCertCacheEntries, + int maxSrvNameCacheEntries, + PRBool enableMPCache); + +/* +** Like SSL_ConfigServerSessionIDCache, with one important difference. +** If the application will run multiple processes (as opposed to, or in +** addition to multiple threads), then it must call this function, instead +** of calling SSL_ConfigServerSessionIDCache(). +** This has nothing to do with the number of processORs, only processEs. +** This function sets up a Server Session ID (SID) cache that is safe for +** access by multiple processes on the same system. +*/ +SSL_IMPORT SECStatus SSL_ConfigMPServerSIDCache(int maxCacheEntries, + PRUint32 timeout, + PRUint32 ssl3_timeout, + const char *directory); + +/* Get and set the configured maximum number of mutexes used for the +** server's store of SSL sessions. This value is used by the server +** session ID cache initialization functions shown above. Note that on +** some platforms, these mutexes are actually implemented with POSIX +** semaphores, or with unnamed pipes. The default value varies by platform. +** An attempt to set a too-low maximum will return an error and the +** configured value will not be changed. +*/ +SSL_IMPORT PRUint32 SSL_GetMaxServerCacheLocks(void); +SSL_IMPORT SECStatus SSL_SetMaxServerCacheLocks(PRUint32 maxLocks); + +/* environment variable set by SSL_ConfigMPServerSIDCache, and queried by + * SSL_InheritMPServerSIDCache when envString is NULL. + */ +#define SSL_ENV_VAR_NAME "SSL_INHERITANCE" + +/* called in child to inherit SID Cache variables. + * If envString is NULL, this function will use the value of the environment + * variable "SSL_INHERITANCE", otherwise the string value passed in will be + * used. + */ +SSL_IMPORT SECStatus SSL_InheritMPServerSIDCache(const char *envString); + +/* +** Set the callback that gets called when a TLS handshake is complete. The +** handshake callback is called after verifying the peer's Finished message and +** before processing incoming application data. +** +** For the initial handshake: If the handshake false started (see +** SSL_ENABLE_FALSE_START), then application data may already have been sent +** before the handshake callback is called. If we did not false start then the +** callback will get called before any application data is sent. +*/ +typedef void(PR_CALLBACK *SSLHandshakeCallback)(PRFileDesc *fd, + void *client_data); +SSL_IMPORT SECStatus SSL_HandshakeCallback(PRFileDesc *fd, + SSLHandshakeCallback cb, void *client_data); + +/* Applications that wish to enable TLS false start must set this callback +** function. NSS will invoke the functon to determine if a particular +** connection should use false start or not. SECSuccess indicates that the +** callback completed successfully, and if so *canFalseStart indicates if false +** start can be used. If the callback does not return SECSuccess then the +** handshake will be canceled. NSS's recommended criteria can be evaluated by +** calling SSL_RecommendedCanFalseStart. +** +** If no false start callback is registered then false start will never be +** done, even if the SSL_ENABLE_FALSE_START option is enabled. +**/ +typedef SECStatus(PR_CALLBACK *SSLCanFalseStartCallback)( + PRFileDesc *fd, void *arg, PRBool *canFalseStart); + +SSL_IMPORT SECStatus SSL_SetCanFalseStartCallback( + PRFileDesc *fd, SSLCanFalseStartCallback callback, void *arg); + +/* This function sets *canFalseStart according to the recommended criteria for +** false start. These criteria may change from release to release and may depend +** on which handshake features have been negotiated and/or properties of the +** certifciates/keys used on the connection. +*/ +SSL_IMPORT SECStatus SSL_RecommendedCanFalseStart(PRFileDesc *fd, + PRBool *canFalseStart); + +/* +** For the server, request a new handshake. For the client, begin a new +** handshake. If flushCache is non-zero, the SSL3 cache entry will be +** flushed first, ensuring that a full SSL handshake will be done. +** If flushCache is zero, and an SSL connection is established, it will +** do the much faster session restart handshake. This will change the +** session keys without doing another private key operation. +*/ +SSL_IMPORT SECStatus SSL_ReHandshake(PRFileDesc *fd, PRBool flushCache); + +/* +** Same as above, but with an I/O timeout. + */ +SSL_IMPORT SECStatus SSL_ReHandshakeWithTimeout(PRFileDesc *fd, + PRBool flushCache, + PRIntervalTime timeout); + +#ifdef SSL_DEPRECATED_FUNCTION +/* deprecated! +** For the server, request a new handshake. For the client, begin a new +** handshake. Flushes SSL3 session cache entry first, ensuring that a +** full handshake will be done. +** This call is equivalent to SSL_ReHandshake(fd, PR_TRUE) +*/ +SSL_IMPORT SECStatus SSL_RedoHandshake(PRFileDesc *fd); +#endif + +/* + * Allow the application to pass a URL or hostname into the SSL library. + */ +SSL_IMPORT SECStatus SSL_SetURL(PRFileDesc *fd, const char *url); + +/* + * Allow an application to define a set of trust anchors for peer + * cert validation. + */ +SSL_IMPORT SECStatus SSL_SetTrustAnchors(PRFileDesc *fd, CERTCertList *list); + +/* +** Return the number of bytes that SSL has waiting in internal buffers. +** Return 0 if security is not enabled. +*/ +SSL_IMPORT int SSL_DataPending(PRFileDesc *fd); + +/* +** Invalidate the SSL session associated with fd. +*/ +SSL_IMPORT SECStatus SSL_InvalidateSession(PRFileDesc *fd); + +/* +** Return a SECItem containing the SSL session ID associated with the fd. +*/ +SSL_IMPORT SECItem *SSL_GetSessionID(PRFileDesc *fd); + +/* +** Clear out the client's SSL session cache, not the server's session cache. +*/ +SSL_IMPORT void SSL_ClearSessionCache(void); + +/* +** Close the server's SSL session cache. +*/ +SSL_IMPORT SECStatus SSL_ShutdownServerSessionIDCache(void); + +/* +** Set peer information so we can correctly look up SSL session later. +** You only have to do this if you're tunneling through a proxy. +*/ +SSL_IMPORT SECStatus SSL_SetSockPeerID(PRFileDesc *fd, const char *peerID); + +/* +** Reveal the security information for the peer. +*/ +SSL_IMPORT CERTCertificate *SSL_RevealCert(PRFileDesc *socket); +SSL_IMPORT void *SSL_RevealPinArg(PRFileDesc *socket); +SSL_IMPORT char *SSL_RevealURL(PRFileDesc *socket); + +/* This callback may be passed to the SSL library via a call to + * SSL_GetClientAuthDataHook() for each SSL client socket. + * It will be invoked when SSL needs to know what certificate and private key + * (if any) to use to respond to a request for client authentication. + * If arg is non-NULL, it is a pointer to a NULL-terminated string containing + * the nickname of the cert/key pair to use. + * If arg is NULL, this function will search the cert and key databases for + * a suitable match and send it if one is found. + */ +SSL_IMPORT SECStatus +NSS_GetClientAuthData(void *arg, + PRFileDesc *socket, + struct CERTDistNamesStr *caNames, + struct CERTCertificateStr **pRetCert, + struct SECKEYPrivateKeyStr **pRetKey); + +/* +** Configure DTLS-SRTP (RFC 5764) cipher suite preferences. +** Input is a list of ciphers in descending preference order and a length +** of the list. As a side effect, this causes the use_srtp extension to be +** negotiated. +** +** Invalid or unimplemented cipher suites in |ciphers| are ignored. If at +** least one cipher suite in |ciphers| is implemented, returns SECSuccess. +** Otherwise returns SECFailure. +*/ +SSL_IMPORT SECStatus SSL_SetSRTPCiphers(PRFileDesc *fd, + const PRUint16 *ciphers, + unsigned int numCiphers); + +/* +** Get the selected DTLS-SRTP cipher suite (if any). +** To be called after the handshake completes. +** Returns SECFailure if not negotiated. +*/ +SSL_IMPORT SECStatus SSL_GetSRTPCipher(PRFileDesc *fd, + PRUint16 *cipher); + +/* + * Look to see if any of the signers in the cert chain for "cert" are found + * in the list of caNames. + * Returns SECSuccess if so, SECFailure if not. + * Used by NSS_GetClientAuthData. May be used by other callback functions. + */ +SSL_IMPORT SECStatus NSS_CmpCertChainWCANames(CERTCertificate *cert, + CERTDistNames *caNames); + +/* Deprecated. This reports a misleading value for certificates that might + * be used for signing rather than key exchange. + * Returns key exchange type of the keys in an SSL server certificate. + */ +SSL_IMPORT SSLKEAType NSS_FindCertKEAType(CERTCertificate *cert); + +/* Set cipher policies to a predefined Domestic (U.S.A.) policy. + * This essentially allows all supported ciphers. + */ +SSL_IMPORT SECStatus NSS_SetDomesticPolicy(void); + +/* Set cipher policies to a predefined Policy that is exportable from the USA + * according to present U.S. policies as we understand them. + * It is the same as NSS_SetDomesticPolicy now. + */ +SSL_IMPORT SECStatus NSS_SetExportPolicy(void); + +/* Set cipher policies to a predefined Policy that is exportable from the USA + * according to present U.S. policies as we understand them, and that the + * nation of France will permit to be imported into their country. + * It is the same as NSS_SetDomesticPolicy now. + */ +SSL_IMPORT SECStatus NSS_SetFrancePolicy(void); + +SSL_IMPORT SSL3Statistics *SSL_GetStatistics(void); + +/* Report more information than SSL_SecurityStatus. + * Caller supplies the info struct. This function fills it in. Caller should + * pass sizeof(SSLChannelInfo) as the |len| argument. + * + * The information here will be zeroed prior to details being confirmed. The + * details are confirmed either when a Finished message is received, or - for a + * client - when the second flight of messages have been sent. This function + * therefore produces unreliable results prior to receiving the + * SSLHandshakeCallback or the SSLCanFalseStartCallback. + */ +SSL_IMPORT SECStatus SSL_GetChannelInfo(PRFileDesc *fd, SSLChannelInfo *info, + PRUintn len); +/* Get preliminary information about a channel. + * Caller supplies the info struct. This function fills it in. Caller should + * pass sizeof(SSLPreliminaryChannelInfo) as the |len| argument. + * + * This function can be called prior to handshake details being confirmed (see + * SSL_GetChannelInfo above for what that means). Thus, information provided by + * this function is available to SSLAuthCertificate, SSLGetClientAuthData, + * SSLSNISocketConfig, and other callbacks that might be called during the + * processing of the first flight of client of server handshake messages. + * Values are marked as being unavailable when renegotiation is initiated. + */ +SSL_IMPORT SECStatus +SSL_GetPreliminaryChannelInfo(PRFileDesc *fd, + SSLPreliminaryChannelInfo *info, + PRUintn len); +/* Get information about cipher suite with id of |cipherSuite|. + * Caller supplies the info struct. This function fills it in. Caller should + * pass sizeof(SSLCipherSuiteInfo) as the |len| argument. + */ +SSL_IMPORT SECStatus SSL_GetCipherSuiteInfo(PRUint16 cipherSuite, + SSLCipherSuiteInfo *info, PRUintn len); + +/* Returnes negotiated through SNI host info. */ +SSL_IMPORT SECItem *SSL_GetNegotiatedHostInfo(PRFileDesc *fd); + +/* Export keying material according to RFC 5705. +** fd must correspond to a TLS 1.0 or higher socket and out must +** already be allocated. If hasContext is false, it uses the no-context +** construction from the RFC and ignores the context and contextLen +** arguments. +*/ +SSL_IMPORT SECStatus SSL_ExportKeyingMaterial(PRFileDesc *fd, + const char *label, + unsigned int labelLen, + PRBool hasContext, + const unsigned char *context, + unsigned int contextLen, + unsigned char *out, + unsigned int outLen); + +/* Early exporters are used if 0-RTT is enabled. This is TLS 1.3 only. Note + * that in TLS 1.3, an empty context is equivalent to an absent context. */ +SSL_IMPORT SECStatus SSL_ExportEarlyKeyingMaterial(PRFileDesc *fd, + const char *label, + unsigned int labelLen, + const unsigned char *context, + unsigned int contextLen, + unsigned char *out, + unsigned int outLen); + +/* +** Return a new reference to the certificate that was most recently sent +** to the peer on this SSL/TLS connection, or NULL if none has been sent. +*/ +SSL_IMPORT CERTCertificate *SSL_LocalCertificate(PRFileDesc *fd); + +#define SSL_CBP_SSL3 0x0001 /* (deprecated) */ +#define SSL_CBP_TLS1_0 0x0002 /* (deprecated) */ + +/* DEPRECATED: The PKCS#11 bypass has been removed. +** This function will now always return false. */ +SSL_IMPORT SECStatus SSL_CanBypass(CERTCertificate *cert, + SECKEYPrivateKey *privKey, + PRUint32 protocolmask, + PRUint16 *ciphers, int nciphers, + PRBool *pcanbypass, void *pwArg); + +/* +** Did the handshake with the peer negotiate the given extension? +** Output parameter valid only if function returns SECSuccess +*/ +SSL_IMPORT SECStatus SSL_HandshakeNegotiatedExtension(PRFileDesc *socket, + SSLExtensionType extId, + PRBool *yes); + +/* +** How long should we wait before retransmitting the next flight of +** the DTLS handshake? Returns SECFailure if not DTLS or not in a +** handshake. +*/ +SSL_IMPORT SECStatus DTLS_GetHandshakeTimeout(PRFileDesc *socket, + PRIntervalTime *timeout); + +/* + * Return a boolean that indicates whether the underlying library + * will perform as the caller expects. + * + * The only argument is a string, which should be the version + * identifier of the NSS library. That string will be compared + * against a string that represents the actual build version of + * the SSL library. + */ +extern PRBool NSSSSL_VersionCheck(const char *importedVersion); + +/* + * Returns a const string of the SSL library version. + */ +extern const char *NSSSSL_GetVersion(void); + +/* Restart an SSL connection that was paused to do asynchronous certificate + * chain validation (when the auth certificate hook or bad cert handler + * returned SECWouldBlock). + * + * This function only works for non-blocking sockets; Do not use it for + * blocking sockets. Currently, this function works only for the client role of + * a connection; it does not work for the server role. + * + * The application must call SSL_AuthCertificateComplete with 0 as the value of + * the error parameter after it has successfully validated the peer's + * certificate, in order to continue the SSL handshake. + * + * The application may call SSL_AuthCertificateComplete with a non-zero value + * for error (e.g. SEC_ERROR_REVOKED_CERTIFICATE) when certificate validation + * fails, before it closes the connection. If the application does so, an + * alert corresponding to the error (e.g. certificate_revoked) will be sent to + * the peer. See the source code of the internal function + * ssl3_SendAlertForCertError for the current mapping of error to alert. This + * mapping may change in future versions of libssl. + * + * This function will not complete the entire handshake. The application must + * call SSL_ForceHandshake, PR_Recv, PR_Send, etc. after calling this function + * to force the handshake to complete. + * + * On the first handshake of a connection, libssl will wait for the peer's + * certificate to be authenticated before calling the handshake callback, + * sending a client certificate, sending any application data, or returning + * any application data to the application. On subsequent (renegotiation) + * handshakes, libssl will block the handshake unconditionally while the + * certificate is being validated. + * + * libssl may send and receive handshake messages while waiting for the + * application to call SSL_AuthCertificateComplete, and it may call other + * callbacks (e.g, the client auth data hook) before + * SSL_AuthCertificateComplete has been called. + * + * An application that uses this asynchronous mechanism will usually have lower + * handshake latency if it has to do public key operations on the certificate + * chain and/or CRL/OCSP/cert fetching during the authentication, especially if + * it does so in parallel on another thread. However, if the application can + * authenticate the peer's certificate quickly then it may be more efficient + * to use the synchronous mechanism (i.e. returning SECFailure/SECSuccess + * instead of SECWouldBlock from the authenticate certificate hook). + * + * Be careful about converting an application from synchronous cert validation + * to asynchronous certificate validation. A naive conversion is likely to + * result in deadlocks; e.g. the application will wait in PR_Poll for network + * I/O on the connection while all network I/O on the connection is blocked + * waiting for this function to be called. + * + * Returns SECFailure on failure, SECSuccess on success. Never returns + * SECWouldBlock. Note that SSL_AuthCertificateComplete will (usually) return + * SECSuccess; do not interpret the return value of SSL_AuthCertificateComplete + * as an indicator of whether it is OK to continue using the connection. For + * example, SSL_AuthCertificateComplete(fd, SEC_ERROR_REVOKED_CERTIFICATE) will + * return SECSuccess (normally), but that does not mean that the application + * should continue using the connection. If the application passes a non-zero + * value for second argument (error), or if SSL_AuthCertificateComplete returns + * anything other than SECSuccess, then the application should close the + * connection. + */ +SSL_IMPORT SECStatus SSL_AuthCertificateComplete(PRFileDesc *fd, + PRErrorCode error); +SEC_END_PROTOS + +#endif /* __ssl_h_ */ diff --git a/security/nss/lib/ssl/ssl.rc b/security/nss/lib/ssl/ssl.rc new file mode 100644 index 000000000..809a07e5f --- /dev/null +++ b/security/nss/lib/ssl/ssl.rc @@ -0,0 +1,68 @@ +/* This Source Code Form is subject to the terms of the Mozilla Public + * License, v. 2.0. If a copy of the MPL was not distributed with this + * file, You can obtain one at http://mozilla.org/MPL/2.0/. */ + +#include "nss.h" +#include <winver.h> + +#define MY_LIBNAME "ssl" +#define MY_FILEDESCRIPTION "NSS SSL Library" + +#define STRINGIZE(x) #x +#define STRINGIZE2(x) STRINGIZE(x) +#define NSS_VMAJOR_STR STRINGIZE2(NSS_VMAJOR) + +#ifdef _DEBUG +#define MY_DEBUG_STR " (debug)" +#define MY_FILEFLAGS_1 VS_FF_DEBUG +#else +#define MY_DEBUG_STR "" +#define MY_FILEFLAGS_1 0x0L +#endif +#if NSS_BETA +#define MY_FILEFLAGS_2 MY_FILEFLAGS_1|VS_FF_PRERELEASE +#else +#define MY_FILEFLAGS_2 MY_FILEFLAGS_1 +#endif + +#ifdef WINNT +#define MY_FILEOS VOS_NT_WINDOWS32 +#else +#define MY_FILEOS VOS__WINDOWS32 +#endif + +#define MY_INTERNAL_NAME MY_LIBNAME NSS_VMAJOR_STR + +///////////////////////////////////////////////////////////////////////////// +// +// Version-information resource +// + +VS_VERSION_INFO VERSIONINFO + FILEVERSION NSS_VMAJOR,NSS_VMINOR,NSS_VPATCH,NSS_VBUILD + PRODUCTVERSION NSS_VMAJOR,NSS_VMINOR,NSS_VPATCH,NSS_VBUILD + FILEFLAGSMASK VS_FFI_FILEFLAGSMASK + FILEFLAGS MY_FILEFLAGS_2 + FILEOS MY_FILEOS + FILETYPE VFT_DLL + FILESUBTYPE 0x0L // not used + +BEGIN + BLOCK "StringFileInfo" + BEGIN + BLOCK "040904B0" // Lang=US English, CharSet=Unicode + BEGIN + VALUE "CompanyName", "Mozilla Foundation\0" + VALUE "FileDescription", MY_FILEDESCRIPTION MY_DEBUG_STR "\0" + VALUE "FileVersion", NSS_VERSION "\0" + VALUE "InternalName", MY_INTERNAL_NAME "\0" + VALUE "OriginalFilename", MY_INTERNAL_NAME ".dll\0" + VALUE "ProductName", "Network Security Services\0" + VALUE "ProductVersion", NSS_VERSION "\0" + END + END + BLOCK "VarFileInfo" + BEGIN + VALUE "Translation", 0x409, 1200 + END +END diff --git a/security/nss/lib/ssl/ssl3con.c b/security/nss/lib/ssl/ssl3con.c new file mode 100644 index 000000000..186ce23f3 --- /dev/null +++ b/security/nss/lib/ssl/ssl3con.c @@ -0,0 +1,13350 @@ +/* -*- Mode: C; tab-width: 8; indent-tabs-mode: nil; c-basic-offset: 4 -*- */ +/* + * SSL3 Protocol + * + * This Source Code Form is subject to the terms of the Mozilla Public + * License, v. 2.0. If a copy of the MPL was not distributed with this + * file, You can obtain one at http://mozilla.org/MPL/2.0/. */ + +/* TODO(ekr): Implement HelloVerifyRequest on server side. OK for now. */ + +#include "cert.h" +#include "ssl.h" +#include "cryptohi.h" /* for DSAU_ stuff */ +#include "keyhi.h" +#include "secder.h" +#include "secitem.h" +#include "sechash.h" + +#include "sslimpl.h" +#include "sslproto.h" +#include "sslerr.h" +#include "ssl3ext.h" +#include "ssl3exthandle.h" +#include "prtime.h" +#include "prinrval.h" +#include "prerror.h" +#include "pratom.h" +#include "prthread.h" +#include "nss.h" +#include "nssoptions.h" + +#include "pk11func.h" +#include "secmod.h" +#include "blapi.h" + +#include <stdio.h> +#ifdef NSS_SSL_ENABLE_ZLIB +#include "zlib.h" +#endif + +#ifndef PK11_SETATTRS +#define PK11_SETATTRS(x, id, v, l) \ + (x)->type = (id); \ + (x)->pValue = (v); \ + (x)->ulValueLen = (l); +#endif + +static PK11SymKey *ssl3_GenerateRSAPMS(sslSocket *ss, ssl3CipherSpec *spec, + PK11SlotInfo *serverKeySlot); +static SECStatus ssl3_DeriveMasterSecret(sslSocket *ss, PK11SymKey *pms); +static SECStatus ssl3_DeriveConnectionKeys(sslSocket *ss); +static SECStatus ssl3_HandshakeFailure(sslSocket *ss); +static SECStatus ssl3_SendCertificate(sslSocket *ss); +static SECStatus ssl3_SendCertificateRequest(sslSocket *ss); +static SECStatus ssl3_SendNextProto(sslSocket *ss); +static SECStatus ssl3_SendFinished(sslSocket *ss, PRInt32 flags); +static SECStatus ssl3_SendServerHelloDone(sslSocket *ss); +static SECStatus ssl3_SendServerKeyExchange(sslSocket *ss); +static SECStatus ssl3_HandleClientHelloPart2(sslSocket *ss, + SECItem *suites, + SECItem *comps, + sslSessionID *sid); +static SECStatus ssl3_HandleServerHelloPart2(sslSocket *ss, + const SECItem *sidBytes, + int *retErrCode); +static SECStatus ssl3_HandlePostHelloHandshakeMessage(sslSocket *ss, + SSL3Opaque *b, + PRUint32 length, + SSL3Hashes *hashesPtr); +static SECStatus ssl3_FlushHandshakeMessages(sslSocket *ss, PRInt32 flags); + +static SECStatus Null_Cipher(void *ctx, unsigned char *output, int *outputLen, + int maxOutputLen, const unsigned char *input, + int inputLen); + +static CK_MECHANISM_TYPE ssl3_GetHashMechanismByHashType(SSLHashType hashType); +static CK_MECHANISM_TYPE ssl3_GetMgfMechanismByHashType(SSLHashType hash); +PRBool ssl_IsRsaPssSignatureScheme(SSLSignatureScheme scheme); + +#define MAX_SEND_BUF_LENGTH 32000 /* watch for 16-bit integer overflow */ +#define MIN_SEND_BUF_LENGTH 4000 + +/* This list of SSL3 cipher suites is sorted in descending order of + * precedence (desirability). It only includes cipher suites we implement. + * This table is modified by SSL3_SetPolicy(). The ordering of cipher suites + * in this table must match the ordering in SSL_ImplementedCiphers (sslenum.c) + * + * Important: See bug 946147 before enabling, reordering, or adding any cipher + * suites to this list. + */ +/* clang-format off */ +static ssl3CipherSuiteCfg cipherSuites[ssl_V3_SUITES_IMPLEMENTED] = { + /* cipher_suite policy enabled isPresent */ + /* Special TLS 1.3 suites. */ + { TLS_AES_128_GCM_SHA256, SSL_ALLOWED, PR_TRUE, PR_FALSE }, + { TLS_CHACHA20_POLY1305_SHA256, SSL_ALLOWED, PR_TRUE, PR_FALSE }, + { TLS_AES_256_GCM_SHA384, SSL_ALLOWED, PR_TRUE, PR_FALSE }, + + { TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256, SSL_ALLOWED, PR_TRUE, PR_FALSE}, + { TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256, SSL_ALLOWED, PR_TRUE, PR_FALSE}, + { TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256, SSL_ALLOWED, PR_TRUE, PR_FALSE}, + { TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256, SSL_ALLOWED, PR_TRUE, PR_FALSE}, + { TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384, SSL_ALLOWED, PR_FALSE, PR_FALSE}, + { TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384, SSL_ALLOWED, PR_FALSE, PR_FALSE}, + /* TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA is out of order to work around + * bug 946147. + */ + { TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA, SSL_ALLOWED, PR_TRUE, PR_FALSE}, + { TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA, SSL_ALLOWED, PR_TRUE, PR_FALSE}, + { TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA, SSL_ALLOWED, PR_TRUE, PR_FALSE}, + { TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256, SSL_ALLOWED, PR_TRUE, PR_FALSE}, + { TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256, SSL_ALLOWED, PR_TRUE, PR_FALSE}, + { TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA, SSL_ALLOWED, PR_TRUE, PR_FALSE}, + { TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA384, SSL_ALLOWED, PR_FALSE, PR_FALSE}, + { TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384, SSL_ALLOWED, PR_FALSE, PR_FALSE}, + { TLS_ECDHE_ECDSA_WITH_3DES_EDE_CBC_SHA, SSL_ALLOWED, PR_FALSE, PR_FALSE}, + { TLS_ECDHE_RSA_WITH_3DES_EDE_CBC_SHA, SSL_ALLOWED, PR_FALSE, PR_FALSE}, + { TLS_ECDHE_ECDSA_WITH_RC4_128_SHA, SSL_ALLOWED, PR_FALSE, PR_FALSE}, + { TLS_ECDHE_RSA_WITH_RC4_128_SHA, SSL_ALLOWED, PR_FALSE, PR_FALSE}, + + { TLS_DHE_RSA_WITH_AES_128_GCM_SHA256, SSL_ALLOWED, PR_TRUE, PR_FALSE}, + { TLS_DHE_RSA_WITH_CHACHA20_POLY1305_SHA256,SSL_ALLOWED,PR_TRUE, PR_FALSE}, + { TLS_DHE_DSS_WITH_AES_128_GCM_SHA256, SSL_ALLOWED, PR_FALSE, PR_FALSE}, + { TLS_DHE_RSA_WITH_AES_256_GCM_SHA384, SSL_ALLOWED, PR_FALSE, PR_FALSE}, + { TLS_DHE_DSS_WITH_AES_256_GCM_SHA384, SSL_ALLOWED, PR_FALSE, PR_FALSE}, + { TLS_DHE_RSA_WITH_AES_128_CBC_SHA, SSL_ALLOWED, PR_TRUE, PR_FALSE}, + { TLS_DHE_DSS_WITH_AES_128_CBC_SHA, SSL_ALLOWED, PR_TRUE, PR_FALSE}, + { TLS_DHE_RSA_WITH_AES_128_CBC_SHA256, SSL_ALLOWED, PR_TRUE, PR_FALSE}, + { TLS_DHE_DSS_WITH_AES_128_CBC_SHA256, SSL_ALLOWED, PR_FALSE, PR_FALSE}, + { TLS_DHE_RSA_WITH_CAMELLIA_128_CBC_SHA, SSL_ALLOWED, PR_FALSE, PR_FALSE}, + { TLS_DHE_DSS_WITH_CAMELLIA_128_CBC_SHA, SSL_ALLOWED, PR_FALSE, PR_FALSE}, + { TLS_DHE_RSA_WITH_AES_256_CBC_SHA, SSL_ALLOWED, PR_TRUE, PR_FALSE}, + { TLS_DHE_DSS_WITH_AES_256_CBC_SHA, SSL_ALLOWED, PR_TRUE, PR_FALSE}, + { TLS_DHE_RSA_WITH_AES_256_CBC_SHA256, SSL_ALLOWED, PR_TRUE, PR_FALSE}, + { TLS_DHE_DSS_WITH_AES_256_CBC_SHA256, SSL_ALLOWED, PR_FALSE, PR_FALSE}, + { TLS_DHE_RSA_WITH_CAMELLIA_256_CBC_SHA, SSL_ALLOWED, PR_FALSE, PR_FALSE}, + { TLS_DHE_DSS_WITH_CAMELLIA_256_CBC_SHA, SSL_ALLOWED, PR_FALSE, PR_FALSE}, + { TLS_DHE_RSA_WITH_3DES_EDE_CBC_SHA, SSL_ALLOWED, PR_TRUE, PR_FALSE}, + { TLS_DHE_DSS_WITH_3DES_EDE_CBC_SHA, SSL_ALLOWED, PR_TRUE, PR_FALSE}, + { TLS_DHE_DSS_WITH_RC4_128_SHA, SSL_ALLOWED, PR_FALSE, PR_FALSE}, + + { TLS_ECDH_ECDSA_WITH_AES_128_CBC_SHA, SSL_ALLOWED, PR_FALSE, PR_FALSE}, + { TLS_ECDH_RSA_WITH_AES_128_CBC_SHA, SSL_ALLOWED, PR_FALSE, PR_FALSE}, + { TLS_ECDH_ECDSA_WITH_AES_256_CBC_SHA, SSL_ALLOWED, PR_FALSE, PR_FALSE}, + { TLS_ECDH_RSA_WITH_AES_256_CBC_SHA, SSL_ALLOWED, PR_FALSE, PR_FALSE}, + { TLS_ECDH_ECDSA_WITH_3DES_EDE_CBC_SHA, SSL_ALLOWED, PR_FALSE, PR_FALSE}, + { TLS_ECDH_RSA_WITH_3DES_EDE_CBC_SHA, SSL_ALLOWED, PR_FALSE, PR_FALSE}, + { TLS_ECDH_ECDSA_WITH_RC4_128_SHA, SSL_ALLOWED, PR_FALSE, PR_FALSE}, + { TLS_ECDH_RSA_WITH_RC4_128_SHA, SSL_ALLOWED, PR_FALSE, PR_FALSE}, + + /* RSA */ + { TLS_RSA_WITH_AES_128_GCM_SHA256, SSL_ALLOWED, PR_TRUE, PR_FALSE}, + { TLS_RSA_WITH_AES_256_GCM_SHA384, SSL_ALLOWED, PR_FALSE, PR_FALSE}, + { TLS_RSA_WITH_AES_128_CBC_SHA, SSL_ALLOWED, PR_TRUE, PR_FALSE}, + { TLS_RSA_WITH_AES_128_CBC_SHA256, SSL_ALLOWED, PR_TRUE, PR_FALSE}, + { TLS_RSA_WITH_CAMELLIA_128_CBC_SHA, SSL_ALLOWED, PR_FALSE, PR_FALSE}, + { TLS_RSA_WITH_AES_256_CBC_SHA, SSL_ALLOWED, PR_TRUE, PR_FALSE}, + { TLS_RSA_WITH_AES_256_CBC_SHA256, SSL_ALLOWED, PR_TRUE, PR_FALSE}, + { TLS_RSA_WITH_CAMELLIA_256_CBC_SHA, SSL_ALLOWED, PR_FALSE, PR_FALSE}, + { TLS_RSA_WITH_SEED_CBC_SHA, SSL_ALLOWED, PR_FALSE, PR_FALSE}, + { TLS_RSA_WITH_3DES_EDE_CBC_SHA, SSL_ALLOWED, PR_TRUE, PR_FALSE}, + { TLS_RSA_WITH_RC4_128_SHA, SSL_ALLOWED, PR_TRUE, PR_FALSE}, + { TLS_RSA_WITH_RC4_128_MD5, SSL_ALLOWED, PR_TRUE, PR_FALSE}, + + /* 56-bit DES "domestic" cipher suites */ + { TLS_DHE_RSA_WITH_DES_CBC_SHA, SSL_ALLOWED, PR_FALSE, PR_FALSE}, + { TLS_DHE_DSS_WITH_DES_CBC_SHA, SSL_ALLOWED, PR_FALSE, PR_FALSE}, + { TLS_RSA_WITH_DES_CBC_SHA, SSL_ALLOWED, PR_FALSE, PR_FALSE}, + + /* ciphersuites with no encryption */ + { TLS_ECDHE_ECDSA_WITH_NULL_SHA, SSL_ALLOWED, PR_FALSE, PR_FALSE}, + { TLS_ECDHE_RSA_WITH_NULL_SHA, SSL_ALLOWED, PR_FALSE, PR_FALSE}, + { TLS_ECDH_RSA_WITH_NULL_SHA, SSL_ALLOWED, PR_FALSE, PR_FALSE}, + { TLS_ECDH_ECDSA_WITH_NULL_SHA, SSL_ALLOWED, PR_FALSE, PR_FALSE}, + { TLS_RSA_WITH_NULL_SHA, SSL_ALLOWED, PR_FALSE, PR_FALSE}, + { TLS_RSA_WITH_NULL_SHA256, SSL_ALLOWED, PR_FALSE, PR_FALSE}, + { TLS_RSA_WITH_NULL_MD5, SSL_ALLOWED, PR_FALSE, PR_FALSE}, +}; +/* clang-format on */ + +/* This is the default supported set of signature schemes. The order of the + * hashes here is all that is important, since that will (sometimes) determine + * which hash we use. The key pair (i.e., cert) is the primary thing that + * determines what we use and this doesn't affect how we select key pairs. The + * order of signature types is based on the same rules for ordering we use for + * cipher suites just for consistency. + */ +static const SSLSignatureScheme defaultSignatureSchemes[] = { + ssl_sig_ecdsa_secp256r1_sha256, + ssl_sig_ecdsa_secp384r1_sha384, + ssl_sig_ecdsa_secp521r1_sha512, + ssl_sig_ecdsa_sha1, + ssl_sig_rsa_pss_sha256, + ssl_sig_rsa_pss_sha384, + ssl_sig_rsa_pss_sha512, + ssl_sig_rsa_pkcs1_sha256, + ssl_sig_rsa_pkcs1_sha384, + ssl_sig_rsa_pkcs1_sha512, + ssl_sig_rsa_pkcs1_sha1, + ssl_sig_dsa_sha256, + ssl_sig_dsa_sha384, + ssl_sig_dsa_sha512, + ssl_sig_dsa_sha1 +}; +PR_STATIC_ASSERT(PR_ARRAY_SIZE(defaultSignatureSchemes) <= + MAX_SIGNATURE_SCHEMES); + +/* Verify that SSL_ImplementedCiphers and cipherSuites are in consistent order. + */ +#ifdef DEBUG +void +ssl3_CheckCipherSuiteOrderConsistency() +{ + unsigned int i; + + PORT_Assert(SSL_NumImplementedCiphers == PR_ARRAY_SIZE(cipherSuites)); + + for (i = 0; i < PR_ARRAY_SIZE(cipherSuites); ++i) { + PORT_Assert(SSL_ImplementedCiphers[i] == cipherSuites[i].cipher_suite); + } +} +#endif + +/* This list of SSL3 compression methods is sorted in descending order of + * precedence (desirability). It only includes compression methods we + * implement. + */ +static const SSLCompressionMethod ssl_compression_methods[] = { +#ifdef NSS_SSL_ENABLE_ZLIB + ssl_compression_deflate, +#endif + ssl_compression_null +}; + +static const unsigned int ssl_compression_method_count = + PR_ARRAY_SIZE(ssl_compression_methods); + +/* compressionEnabled returns true iff the compression algorithm is enabled + * for the given SSL socket. */ +static PRBool +ssl_CompressionEnabled(sslSocket *ss, SSLCompressionMethod compression) +{ + SSL3ProtocolVersion version; + + if (compression == ssl_compression_null) { + return PR_TRUE; /* Always enabled */ + } + if (ss->sec.isServer) { + /* We can't easily check that the client didn't attempt TLS 1.3, + * so this will have to do. */ + PORT_Assert(ss->version < SSL_LIBRARY_VERSION_TLS_1_3); + version = ss->version; + } else { + version = ss->vrange.max; + } + if (version >= SSL_LIBRARY_VERSION_TLS_1_3) { + return PR_FALSE; + } +#ifdef NSS_SSL_ENABLE_ZLIB + if (compression == ssl_compression_deflate) { + if (IS_DTLS(ss)) { + return PR_FALSE; + } + return ss->opt.enableDeflate; + } +#endif + return PR_FALSE; +} + +static const /*SSL3ClientCertificateType */ PRUint8 certificate_types[] = { + ct_RSA_sign, + ct_ECDSA_sign, + ct_DSS_sign, +}; + +/* This global item is used only in servers. It is is initialized by +** SSL_ConfigSecureServer(), and is used in ssl3_SendCertificateRequest(). +*/ +CERTDistNames *ssl3_server_ca_list = NULL; +static SSL3Statistics ssl3stats; + +/* Record protection algorithms, indexed by SSL3BulkCipher. + * + * The |max_records| field (|mr| below) is set to a number that is higher than + * recommended in some literature (esp. TLS 1.3) because we currently abort the + * connection when this limit is reached and we want to ensure that we only + * rarely hit this limit. See bug 1268745 for details. + */ +#define MR_MAX RECORD_SEQ_MAX /* 2^48-1 */ +#define MR_128 (0x5aULL << 28) /* For AES and similar. */ +#define MR_LOW (1ULL << 20) /* For weak ciphers. */ +/* clang-format off */ +static const ssl3BulkCipherDef bulk_cipher_defs[] = { + /* |--------- Lengths ---------| */ + /* cipher calg : s : */ + /* : e b n */ + /* oid short_name mr : l o */ + /* k r o t n */ + /* e e i c a c */ + /* y t type v k g e */ + {cipher_null, calg_null, 0, 0, type_stream, 0, 0, 0, 0, + SEC_OID_NULL_CIPHER, "NULL", MR_MAX}, + {cipher_rc4, calg_rc4, 16,16, type_stream, 0, 0, 0, 0, + SEC_OID_RC4, "RC4", MR_LOW}, + {cipher_des, calg_des, 8, 8, type_block, 8, 8, 0, 0, + SEC_OID_DES_CBC, "DES-CBC", MR_LOW}, + {cipher_3des, calg_3des, 24,24, type_block, 8, 8, 0, 0, + SEC_OID_DES_EDE3_CBC, "3DES-EDE-CBC", MR_LOW}, + {cipher_aes_128, calg_aes, 16,16, type_block, 16,16, 0, 0, + SEC_OID_AES_128_CBC, "AES-128", MR_128}, + {cipher_aes_256, calg_aes, 32,32, type_block, 16,16, 0, 0, + SEC_OID_AES_256_CBC, "AES-256", MR_128}, + {cipher_camellia_128, calg_camellia, 16,16, type_block, 16,16, 0, 0, + SEC_OID_CAMELLIA_128_CBC, "Camellia-128", MR_128}, + {cipher_camellia_256, calg_camellia, 32,32, type_block, 16,16, 0, 0, + SEC_OID_CAMELLIA_256_CBC, "Camellia-256", MR_128}, + {cipher_seed, calg_seed, 16,16, type_block, 16,16, 0, 0, + SEC_OID_SEED_CBC, "SEED-CBC", MR_128}, + {cipher_aes_128_gcm, calg_aes_gcm, 16,16, type_aead, 4, 0,16, 8, + SEC_OID_AES_128_GCM, "AES-128-GCM", MR_128}, + {cipher_aes_256_gcm, calg_aes_gcm, 32,32, type_aead, 4, 0,16, 8, + SEC_OID_AES_256_GCM, "AES-256-GCM", MR_128}, + {cipher_chacha20, calg_chacha20, 32,32, type_aead, 12, 0,16, 0, + SEC_OID_CHACHA20_POLY1305, "ChaCha20-Poly1305", MR_MAX}, + {cipher_missing, calg_null, 0, 0, type_stream, 0, 0, 0, 0, + SEC_OID_UNKNOWN, "missing", 0U}, +}; + +static const ssl3KEADef kea_defs[] = +{ /* indexed by SSL3KeyExchangeAlgorithm */ + /* kea exchKeyType signKeyType authKeyType ephemeral oid */ + {kea_null, ssl_kea_null, nullKey, ssl_auth_null, PR_FALSE, 0}, + {kea_rsa, ssl_kea_rsa, nullKey, ssl_auth_rsa_decrypt, PR_FALSE, SEC_OID_TLS_RSA}, + {kea_dh_dss, ssl_kea_dh, dsaKey, ssl_auth_dsa, PR_FALSE, SEC_OID_TLS_DH_DSS}, + {kea_dh_rsa, ssl_kea_dh, rsaKey, ssl_auth_rsa_sign, PR_FALSE, SEC_OID_TLS_DH_RSA}, + {kea_dhe_dss, ssl_kea_dh, dsaKey, ssl_auth_dsa, PR_TRUE, SEC_OID_TLS_DHE_DSS}, + {kea_dhe_rsa, ssl_kea_dh, rsaKey, ssl_auth_rsa_sign, PR_TRUE, SEC_OID_TLS_DHE_RSA}, + {kea_dh_anon, ssl_kea_dh, nullKey, ssl_auth_null, PR_TRUE, SEC_OID_TLS_DH_ANON}, + {kea_ecdh_ecdsa, ssl_kea_ecdh, nullKey, ssl_auth_ecdh_ecdsa, PR_FALSE, SEC_OID_TLS_ECDH_ECDSA}, + {kea_ecdhe_ecdsa, ssl_kea_ecdh, ecKey, ssl_auth_ecdsa, PR_TRUE, SEC_OID_TLS_ECDHE_ECDSA}, + {kea_ecdh_rsa, ssl_kea_ecdh, nullKey, ssl_auth_ecdh_rsa, PR_FALSE, SEC_OID_TLS_ECDH_RSA}, + {kea_ecdhe_rsa, ssl_kea_ecdh, rsaKey, ssl_auth_rsa_sign, PR_TRUE, SEC_OID_TLS_ECDHE_RSA}, + {kea_ecdh_anon, ssl_kea_ecdh, nullKey, ssl_auth_null, PR_TRUE, SEC_OID_TLS_ECDH_ANON}, + {kea_ecdhe_psk, ssl_kea_ecdh_psk, nullKey, ssl_auth_psk, PR_TRUE, SEC_OID_TLS_ECDHE_PSK}, + {kea_dhe_psk, ssl_kea_dh_psk, nullKey, ssl_auth_psk, PR_TRUE, SEC_OID_TLS_DHE_PSK}, + {kea_tls13_any, ssl_kea_tls13_any, nullKey, ssl_auth_tls13_any, PR_TRUE, SEC_OID_TLS13_KEA_ANY}, +}; + +/* must use ssl_LookupCipherSuiteDef to access */ +static const ssl3CipherSuiteDef cipher_suite_defs[] = +{ +/* cipher_suite bulk_cipher_alg mac_alg key_exchange_alg prf_hash */ +/* Note that the prf_hash_alg is the hash function used by the PRF, see sslimpl.h. */ + + {TLS_NULL_WITH_NULL_NULL, cipher_null, mac_null, kea_null, ssl_hash_none}, + {TLS_RSA_WITH_NULL_MD5, cipher_null, mac_md5, kea_rsa, ssl_hash_none}, + {TLS_RSA_WITH_NULL_SHA, cipher_null, mac_sha, kea_rsa, ssl_hash_none}, + {TLS_RSA_WITH_NULL_SHA256, cipher_null, hmac_sha256, kea_rsa, ssl_hash_sha256}, + {TLS_RSA_WITH_RC4_128_MD5, cipher_rc4, mac_md5, kea_rsa, ssl_hash_none}, + {TLS_RSA_WITH_RC4_128_SHA, cipher_rc4, mac_sha, kea_rsa, ssl_hash_none}, + {TLS_RSA_WITH_DES_CBC_SHA, cipher_des, mac_sha, kea_rsa, ssl_hash_none}, + {TLS_RSA_WITH_3DES_EDE_CBC_SHA, cipher_3des, mac_sha, kea_rsa, ssl_hash_none}, + {TLS_DHE_DSS_WITH_DES_CBC_SHA, cipher_des, mac_sha, kea_dhe_dss, ssl_hash_none}, + {TLS_DHE_DSS_WITH_3DES_EDE_CBC_SHA, + cipher_3des, mac_sha, kea_dhe_dss, ssl_hash_none}, + {TLS_DHE_DSS_WITH_RC4_128_SHA, cipher_rc4, mac_sha, kea_dhe_dss, ssl_hash_none}, + {TLS_DHE_RSA_WITH_DES_CBC_SHA, cipher_des, mac_sha, kea_dhe_rsa, ssl_hash_none}, + {TLS_DHE_RSA_WITH_3DES_EDE_CBC_SHA, + cipher_3des, mac_sha, kea_dhe_rsa, ssl_hash_none}, + + +/* New TLS cipher suites */ + {TLS_RSA_WITH_AES_128_CBC_SHA, cipher_aes_128, mac_sha, kea_rsa, ssl_hash_none}, + {TLS_RSA_WITH_AES_128_CBC_SHA256, cipher_aes_128, hmac_sha256, kea_rsa, ssl_hash_sha256}, + {TLS_DHE_DSS_WITH_AES_128_CBC_SHA, cipher_aes_128, mac_sha, kea_dhe_dss, ssl_hash_none}, + {TLS_DHE_RSA_WITH_AES_128_CBC_SHA, cipher_aes_128, mac_sha, kea_dhe_rsa, ssl_hash_none}, + {TLS_DHE_RSA_WITH_AES_128_CBC_SHA256, cipher_aes_128, hmac_sha256, kea_dhe_rsa, ssl_hash_sha256}, + {TLS_RSA_WITH_AES_256_CBC_SHA, cipher_aes_256, mac_sha, kea_rsa, ssl_hash_none}, + {TLS_RSA_WITH_AES_256_CBC_SHA256, cipher_aes_256, hmac_sha256, kea_rsa, ssl_hash_sha256}, + {TLS_DHE_DSS_WITH_AES_256_CBC_SHA, cipher_aes_256, mac_sha, kea_dhe_dss, ssl_hash_none}, + {TLS_DHE_RSA_WITH_AES_256_CBC_SHA, cipher_aes_256, mac_sha, kea_dhe_rsa, ssl_hash_none}, + {TLS_DHE_RSA_WITH_AES_256_CBC_SHA256, cipher_aes_256, hmac_sha256, kea_dhe_rsa, ssl_hash_sha256}, + {TLS_DHE_RSA_WITH_AES_256_GCM_SHA384, cipher_aes_256_gcm, mac_aead, kea_dhe_rsa, ssl_hash_sha384}, + + {TLS_RSA_WITH_SEED_CBC_SHA, cipher_seed, mac_sha, kea_rsa, ssl_hash_none}, + + {TLS_RSA_WITH_CAMELLIA_128_CBC_SHA, cipher_camellia_128, mac_sha, kea_rsa, ssl_hash_none}, + {TLS_DHE_DSS_WITH_CAMELLIA_128_CBC_SHA, + cipher_camellia_128, mac_sha, kea_dhe_dss, ssl_hash_none}, + {TLS_DHE_RSA_WITH_CAMELLIA_128_CBC_SHA, + cipher_camellia_128, mac_sha, kea_dhe_rsa, ssl_hash_none}, + {TLS_RSA_WITH_CAMELLIA_256_CBC_SHA, cipher_camellia_256, mac_sha, kea_rsa, ssl_hash_none}, + {TLS_DHE_DSS_WITH_CAMELLIA_256_CBC_SHA, + cipher_camellia_256, mac_sha, kea_dhe_dss, ssl_hash_none}, + {TLS_DHE_RSA_WITH_CAMELLIA_256_CBC_SHA, + cipher_camellia_256, mac_sha, kea_dhe_rsa, ssl_hash_none}, + + {TLS_DHE_RSA_WITH_AES_128_GCM_SHA256, cipher_aes_128_gcm, mac_aead, kea_dhe_rsa, ssl_hash_sha256}, + {TLS_RSA_WITH_AES_128_GCM_SHA256, cipher_aes_128_gcm, mac_aead, kea_rsa, ssl_hash_sha256}, + + {TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256, cipher_aes_128_gcm, mac_aead, kea_ecdhe_rsa, ssl_hash_sha256}, + {TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256, cipher_aes_128_gcm, mac_aead, kea_ecdhe_ecdsa, ssl_hash_sha256}, + {TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384, cipher_aes_256_gcm, mac_aead, kea_ecdhe_ecdsa, ssl_hash_sha384}, + {TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384, cipher_aes_256_gcm, mac_aead, kea_ecdhe_rsa, ssl_hash_sha384}, + {TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA384, cipher_aes_256, hmac_sha384, kea_ecdhe_ecdsa, ssl_hash_sha384}, + {TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384, cipher_aes_256, hmac_sha384, kea_ecdhe_rsa, ssl_hash_sha384}, + {TLS_DHE_DSS_WITH_AES_128_GCM_SHA256, cipher_aes_128_gcm, mac_aead, kea_dhe_dss, ssl_hash_sha256}, + {TLS_DHE_DSS_WITH_AES_128_CBC_SHA256, cipher_aes_128, hmac_sha256, kea_dhe_dss, ssl_hash_sha256}, + {TLS_DHE_DSS_WITH_AES_256_CBC_SHA256, cipher_aes_256, hmac_sha256, kea_dhe_dss, ssl_hash_sha256}, + {TLS_DHE_DSS_WITH_AES_256_GCM_SHA384, cipher_aes_256_gcm, mac_aead, kea_dhe_dss, ssl_hash_sha384}, + {TLS_RSA_WITH_AES_256_GCM_SHA384, cipher_aes_256_gcm, mac_aead, kea_rsa, ssl_hash_sha384}, + + {TLS_DHE_RSA_WITH_CHACHA20_POLY1305_SHA256, cipher_chacha20, mac_aead, kea_dhe_rsa, ssl_hash_sha256}, + + {TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256, cipher_chacha20, mac_aead, kea_ecdhe_rsa, ssl_hash_sha256}, + {TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256, cipher_chacha20, mac_aead, kea_ecdhe_ecdsa, ssl_hash_sha256}, + + {TLS_ECDH_ECDSA_WITH_NULL_SHA, cipher_null, mac_sha, kea_ecdh_ecdsa, ssl_hash_none}, + {TLS_ECDH_ECDSA_WITH_RC4_128_SHA, cipher_rc4, mac_sha, kea_ecdh_ecdsa, ssl_hash_none}, + {TLS_ECDH_ECDSA_WITH_3DES_EDE_CBC_SHA, cipher_3des, mac_sha, kea_ecdh_ecdsa, ssl_hash_none}, + {TLS_ECDH_ECDSA_WITH_AES_128_CBC_SHA, cipher_aes_128, mac_sha, kea_ecdh_ecdsa, ssl_hash_none}, + {TLS_ECDH_ECDSA_WITH_AES_256_CBC_SHA, cipher_aes_256, mac_sha, kea_ecdh_ecdsa, ssl_hash_none}, + + {TLS_ECDHE_ECDSA_WITH_NULL_SHA, cipher_null, mac_sha, kea_ecdhe_ecdsa, ssl_hash_none}, + {TLS_ECDHE_ECDSA_WITH_RC4_128_SHA, cipher_rc4, mac_sha, kea_ecdhe_ecdsa, ssl_hash_none}, + {TLS_ECDHE_ECDSA_WITH_3DES_EDE_CBC_SHA, cipher_3des, mac_sha, kea_ecdhe_ecdsa, ssl_hash_none}, + {TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA, cipher_aes_128, mac_sha, kea_ecdhe_ecdsa, ssl_hash_none}, + {TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256, cipher_aes_128, hmac_sha256, kea_ecdhe_ecdsa, ssl_hash_sha256}, + {TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA, cipher_aes_256, mac_sha, kea_ecdhe_ecdsa, ssl_hash_none}, + + {TLS_ECDH_RSA_WITH_NULL_SHA, cipher_null, mac_sha, kea_ecdh_rsa, ssl_hash_none}, + {TLS_ECDH_RSA_WITH_RC4_128_SHA, cipher_rc4, mac_sha, kea_ecdh_rsa, ssl_hash_none}, + {TLS_ECDH_RSA_WITH_3DES_EDE_CBC_SHA, cipher_3des, mac_sha, kea_ecdh_rsa, ssl_hash_none}, + {TLS_ECDH_RSA_WITH_AES_128_CBC_SHA, cipher_aes_128, mac_sha, kea_ecdh_rsa, ssl_hash_none}, + {TLS_ECDH_RSA_WITH_AES_256_CBC_SHA, cipher_aes_256, mac_sha, kea_ecdh_rsa, ssl_hash_none}, + + {TLS_ECDHE_RSA_WITH_NULL_SHA, cipher_null, mac_sha, kea_ecdhe_rsa, ssl_hash_none}, + {TLS_ECDHE_RSA_WITH_RC4_128_SHA, cipher_rc4, mac_sha, kea_ecdhe_rsa, ssl_hash_none}, + {TLS_ECDHE_RSA_WITH_3DES_EDE_CBC_SHA, cipher_3des, mac_sha, kea_ecdhe_rsa, ssl_hash_none}, + {TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA, cipher_aes_128, mac_sha, kea_ecdhe_rsa, ssl_hash_none}, + {TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256, cipher_aes_128, hmac_sha256, kea_ecdhe_rsa, ssl_hash_sha256}, + {TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA, cipher_aes_256, mac_sha, kea_ecdhe_rsa, ssl_hash_none}, + + {TLS_AES_128_GCM_SHA256, cipher_aes_128_gcm, mac_aead, kea_tls13_any, ssl_hash_sha256}, + {TLS_CHACHA20_POLY1305_SHA256, cipher_chacha20, mac_aead, kea_tls13_any, ssl_hash_sha256}, + {TLS_AES_256_GCM_SHA384, cipher_aes_256_gcm, mac_aead, kea_tls13_any, ssl_hash_sha384}, +}; +/* clang-format on */ + +static const CK_MECHANISM_TYPE auth_alg_defs[] = { + CKM_INVALID_MECHANISM, /* ssl_auth_null */ + CKM_RSA_PKCS, /* ssl_auth_rsa_decrypt */ + CKM_DSA, /* ? _SHA1 */ /* ssl_auth_dsa */ + CKM_INVALID_MECHANISM, /* ssl_auth_kea (unused) */ + CKM_ECDSA, /* ssl_auth_ecdsa */ + CKM_ECDH1_DERIVE, /* ssl_auth_ecdh_rsa */ + CKM_ECDH1_DERIVE, /* ssl_auth_ecdh_ecdsa */ + CKM_RSA_PKCS, /* ssl_auth_rsa_sign */ + CKM_RSA_PKCS_PSS, /* ssl_auth_rsa_pss */ + CKM_NSS_HKDF_SHA256, /* ssl_auth_psk (just check for HKDF) */ + CKM_INVALID_MECHANISM /* ssl_auth_tls13_any */ +}; +PR_STATIC_ASSERT(PR_ARRAY_SIZE(auth_alg_defs) == ssl_auth_size); + +static const CK_MECHANISM_TYPE kea_alg_defs[] = { + CKM_INVALID_MECHANISM, /* ssl_kea_null */ + CKM_RSA_PKCS, /* ssl_kea_rsa */ + CKM_DH_PKCS_DERIVE, /* ssl_kea_dh */ + CKM_INVALID_MECHANISM, /* ssl_kea_fortezza (unused) */ + CKM_ECDH1_DERIVE, /* ssl_kea_ecdh */ + CKM_ECDH1_DERIVE, /* ssl_kea_ecdh_psk */ + CKM_DH_PKCS_DERIVE, /* ssl_kea_dh_psk */ + CKM_INVALID_MECHANISM, /* ssl_kea_tls13_any */ +}; +PR_STATIC_ASSERT(PR_ARRAY_SIZE(kea_alg_defs) == ssl_kea_size); + +typedef struct SSLCipher2MechStr { + SSLCipherAlgorithm calg; + CK_MECHANISM_TYPE cmech; +} SSLCipher2Mech; + +/* indexed by type SSLCipherAlgorithm */ +static const SSLCipher2Mech alg2Mech[] = { + /* calg, cmech */ + { calg_null, (CK_MECHANISM_TYPE)0x80000000L }, + { calg_rc4, CKM_RC4 }, + { calg_rc2, CKM_RC2_CBC }, + { calg_des, CKM_DES_CBC }, + { calg_3des, CKM_DES3_CBC }, + { calg_idea, CKM_IDEA_CBC }, + { calg_fortezza, CKM_SKIPJACK_CBC64 }, + { calg_aes, CKM_AES_CBC }, + { calg_camellia, CKM_CAMELLIA_CBC }, + { calg_seed, CKM_SEED_CBC }, + { calg_aes_gcm, CKM_AES_GCM }, + { calg_chacha20, CKM_NSS_CHACHA20_POLY1305 }, + /* { calg_init , (CK_MECHANISM_TYPE)0x7fffffffL } */ +}; + +#define mmech_invalid (CK_MECHANISM_TYPE)0x80000000L +#define mmech_md5 CKM_SSL3_MD5_MAC +#define mmech_sha CKM_SSL3_SHA1_MAC +#define mmech_md5_hmac CKM_MD5_HMAC +#define mmech_sha_hmac CKM_SHA_1_HMAC +#define mmech_sha256_hmac CKM_SHA256_HMAC +#define mmech_sha384_hmac CKM_SHA384_HMAC + +/* clang-format off */ +static const ssl3MACDef mac_defs[] = { /* indexed by SSL3MACAlgorithm */ + /* pad_size is only used for SSL 3.0 MAC. See RFC 6101 Sec. 5.2.3.1. */ + /* mac mmech pad_size mac_size */ + { mac_null, mmech_invalid, 0, 0 , 0}, + { mac_md5, mmech_md5, 48, MD5_LENGTH, SEC_OID_HMAC_MD5 }, + { mac_sha, mmech_sha, 40, SHA1_LENGTH, SEC_OID_HMAC_SHA1}, + {hmac_md5, mmech_md5_hmac, 0, MD5_LENGTH, SEC_OID_HMAC_MD5}, + {hmac_sha, mmech_sha_hmac, 0, SHA1_LENGTH, SEC_OID_HMAC_SHA1}, + {hmac_sha256, mmech_sha256_hmac, 0, SHA256_LENGTH, SEC_OID_HMAC_SHA256}, + { mac_aead, mmech_invalid, 0, 0, 0 }, + {hmac_sha384, mmech_sha384_hmac, 0, SHA384_LENGTH, SEC_OID_HMAC_SHA384} +}; +/* clang-format on */ + +const PRUint8 tls13_downgrade_random[] = { 0x44, 0x4F, 0x57, 0x4E, + 0x47, 0x52, 0x44, 0x01 }; +const PRUint8 tls12_downgrade_random[] = { 0x44, 0x4F, 0x57, 0x4E, + 0x47, 0x52, 0x44, 0x00 }; +PR_STATIC_ASSERT(sizeof(tls13_downgrade_random) == + sizeof(tls13_downgrade_random)); + +/* The ECCWrappedKeyInfo structure defines how various pieces of + * information are laid out within wrappedSymmetricWrappingkey + * for ECDH key exchange. Since wrappedSymmetricWrappingkey is + * a 512-byte buffer (see sslimpl.h), the variable length field + * in ECCWrappedKeyInfo can be at most (512 - 8) = 504 bytes. + * + * XXX For now, NSS only supports named elliptic curves of size 571 bits + * or smaller. The public value will fit within 145 bytes and EC params + * will fit within 12 bytes. We'll need to revisit this when NSS + * supports arbitrary curves. + */ +#define MAX_EC_WRAPPED_KEY_BUFLEN 504 + +typedef struct ECCWrappedKeyInfoStr { + PRUint16 size; /* EC public key size in bits */ + PRUint16 encodedParamLen; /* length (in bytes) of DER encoded EC params */ + PRUint16 pubValueLen; /* length (in bytes) of EC public value */ + PRUint16 wrappedKeyLen; /* length (in bytes) of the wrapped key */ + PRUint8 var[MAX_EC_WRAPPED_KEY_BUFLEN]; /* this buffer contains the */ + /* EC public-key params, the EC public value and the wrapped key */ +} ECCWrappedKeyInfo; + +CK_MECHANISM_TYPE +ssl3_Alg2Mech(SSLCipherAlgorithm calg) +{ + PORT_Assert(alg2Mech[calg].calg == calg); + return alg2Mech[calg].cmech; +} + +#if defined(TRACE) + +static char * +ssl3_DecodeHandshakeType(int msgType) +{ + char *rv; + static char line[40]; + + switch (msgType) { + case hello_request: + rv = "hello_request (0)"; + break; + case client_hello: + rv = "client_hello (1)"; + break; + case server_hello: + rv = "server_hello (2)"; + break; + case hello_verify_request: + rv = "hello_verify_request (3)"; + break; + case new_session_ticket: + rv = "session_ticket (4)"; + break; + case hello_retry_request: + rv = "hello_retry_request (6)"; + break; + case encrypted_extensions: + rv = "encrypted_extensions (8)"; + break; + case certificate: + rv = "certificate (11)"; + break; + case server_key_exchange: + rv = "server_key_exchange (12)"; + break; + case certificate_request: + rv = "certificate_request (13)"; + break; + case server_hello_done: + rv = "server_hello_done (14)"; + break; + case certificate_verify: + rv = "certificate_verify (15)"; + break; + case client_key_exchange: + rv = "client_key_exchange (16)"; + break; + case finished: + rv = "finished (20)"; + break; + default: + sprintf(line, "*UNKNOWN* handshake type! (%d)", msgType); + rv = line; + } + return rv; +} + +static char * +ssl3_DecodeContentType(int msgType) +{ + char *rv; + static char line[40]; + + switch (msgType) { + case content_change_cipher_spec: + rv = "change_cipher_spec (20)"; + break; + case content_alert: + rv = "alert (21)"; + break; + case content_handshake: + rv = "handshake (22)"; + break; + case content_application_data: + rv = "application_data (23)"; + break; + default: + sprintf(line, "*UNKNOWN* record type! (%d)", msgType); + rv = line; + } + return rv; +} + +#endif + +SSL3Statistics * +SSL_GetStatistics(void) +{ + return &ssl3stats; +} + +typedef struct tooLongStr { +#if defined(IS_LITTLE_ENDIAN) + PRInt32 low; + PRInt32 high; +#else + PRInt32 high; + PRInt32 low; +#endif +} tooLong; + +void +SSL_AtomicIncrementLong(long *x) +{ + if ((sizeof *x) == sizeof(PRInt32)) { + PR_ATOMIC_INCREMENT((PRInt32 *)x); + } else { + tooLong *tl = (tooLong *)x; + if (PR_ATOMIC_INCREMENT(&tl->low) == 0) + PR_ATOMIC_INCREMENT(&tl->high); + } +} + +static PRBool +ssl3_CipherSuiteAllowedForVersionRange( + ssl3CipherSuite cipherSuite, + const SSLVersionRange *vrange) +{ + switch (cipherSuite) { + case TLS_DHE_RSA_WITH_AES_256_CBC_SHA256: + case TLS_RSA_WITH_AES_256_CBC_SHA256: + case TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256: + case TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA384: + case TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256: + case TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384: + case TLS_DHE_RSA_WITH_AES_128_CBC_SHA256: + case TLS_RSA_WITH_AES_128_CBC_SHA256: + case TLS_RSA_WITH_AES_128_GCM_SHA256: + case TLS_RSA_WITH_AES_256_GCM_SHA384: + case TLS_DHE_DSS_WITH_AES_128_CBC_SHA256: + case TLS_DHE_DSS_WITH_AES_256_CBC_SHA256: + case TLS_RSA_WITH_NULL_SHA256: + case TLS_DHE_DSS_WITH_AES_128_GCM_SHA256: + case TLS_DHE_DSS_WITH_AES_256_GCM_SHA384: + case TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256: + case TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384: + case TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256: + case TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384: + case TLS_DHE_RSA_WITH_AES_128_GCM_SHA256: + case TLS_DHE_RSA_WITH_AES_256_GCM_SHA384: + case TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256: + case TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256: + case TLS_DHE_RSA_WITH_CHACHA20_POLY1305_SHA256: + return vrange->max >= SSL_LIBRARY_VERSION_TLS_1_2 && + vrange->min < SSL_LIBRARY_VERSION_TLS_1_3; + + /* RFC 4492: ECC cipher suites need TLS extensions to negotiate curves and + * point formats.*/ + case TLS_ECDH_ECDSA_WITH_NULL_SHA: + case TLS_ECDH_ECDSA_WITH_RC4_128_SHA: + case TLS_ECDH_ECDSA_WITH_3DES_EDE_CBC_SHA: + case TLS_ECDH_ECDSA_WITH_AES_128_CBC_SHA: + case TLS_ECDH_ECDSA_WITH_AES_256_CBC_SHA: + case TLS_ECDHE_ECDSA_WITH_NULL_SHA: + case TLS_ECDHE_ECDSA_WITH_RC4_128_SHA: + case TLS_ECDHE_ECDSA_WITH_3DES_EDE_CBC_SHA: + case TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA: + case TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA: + case TLS_ECDH_RSA_WITH_NULL_SHA: + case TLS_ECDH_RSA_WITH_RC4_128_SHA: + case TLS_ECDH_RSA_WITH_3DES_EDE_CBC_SHA: + case TLS_ECDH_RSA_WITH_AES_128_CBC_SHA: + case TLS_ECDH_RSA_WITH_AES_256_CBC_SHA: + case TLS_ECDHE_RSA_WITH_NULL_SHA: + case TLS_ECDHE_RSA_WITH_RC4_128_SHA: + case TLS_ECDHE_RSA_WITH_3DES_EDE_CBC_SHA: + case TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA: + case TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA: + return vrange->max >= SSL_LIBRARY_VERSION_TLS_1_0 && + vrange->min < SSL_LIBRARY_VERSION_TLS_1_3; + + case TLS_AES_128_GCM_SHA256: + case TLS_AES_256_GCM_SHA384: + case TLS_CHACHA20_POLY1305_SHA256: + return vrange->max >= SSL_LIBRARY_VERSION_TLS_1_3; + + default: + return vrange->min < SSL_LIBRARY_VERSION_TLS_1_3; + } +} + +/* return pointer to ssl3CipherSuiteDef for suite, or NULL */ +/* XXX This does a linear search. A binary search would be better. */ +const ssl3CipherSuiteDef * +ssl_LookupCipherSuiteDef(ssl3CipherSuite suite) +{ + int cipher_suite_def_len = + sizeof(cipher_suite_defs) / sizeof(cipher_suite_defs[0]); + int i; + + for (i = 0; i < cipher_suite_def_len; i++) { + if (cipher_suite_defs[i].cipher_suite == suite) + return &cipher_suite_defs[i]; + } + PORT_Assert(PR_FALSE); /* We should never get here. */ + PORT_SetError(SSL_ERROR_UNKNOWN_CIPHER_SUITE); + return NULL; +} + +/* Find the cipher configuration struct associate with suite */ +/* XXX This does a linear search. A binary search would be better. */ +static ssl3CipherSuiteCfg * +ssl_LookupCipherSuiteCfgMutable(ssl3CipherSuite suite, + ssl3CipherSuiteCfg *suites) +{ + int i; + + for (i = 0; i < ssl_V3_SUITES_IMPLEMENTED; i++) { + if (suites[i].cipher_suite == suite) + return &suites[i]; + } + /* return NULL and let the caller handle it. */ + PORT_SetError(SSL_ERROR_UNKNOWN_CIPHER_SUITE); + return NULL; +} + +const static ssl3CipherSuiteCfg * +ssl_LookupCipherSuiteCfg(ssl3CipherSuite suite, const ssl3CipherSuiteCfg *suites) +{ + return ssl_LookupCipherSuiteCfgMutable(suite, + CONST_CAST(ssl3CipherSuiteCfg, suites)); +} + +static PRBool +ssl_NamedGroupTypeEnabled(const sslSocket *ss, SSLKEAType keaType) +{ + unsigned int i; + for (i = 0; i < SSL_NAMED_GROUP_COUNT; ++i) { + if (ss->namedGroupPreferences[i] && + ss->namedGroupPreferences[i]->keaType == keaType) { + return PR_TRUE; + } + } + return PR_FALSE; +} + +static PRBool +ssl_KEAEnabled(const sslSocket *ss, SSLKEAType keaType) +{ + switch (keaType) { + case ssl_kea_rsa: + return PR_TRUE; + + case ssl_kea_dh: + case ssl_kea_dh_psk: { + if (ss->sec.isServer && !ss->opt.enableServerDhe) { + return PR_FALSE; + } + + if (ss->sec.isServer) { + /* If the server requires named FFDHE groups, then the client + * must have included an FFDHE group. peerSupportsFfdheGroups + * is set to true in ssl_HandleSupportedGroupsXtn(). */ + if (ss->opt.requireDHENamedGroups && + !ss->xtnData.peerSupportsFfdheGroups) { + return PR_FALSE; + } + + /* We can use the weak DH group if all of these are true: + * 1. We don't require named groups. + * 2. The peer doesn't support named groups. + * 3. This isn't TLS 1.3. + * 4. The weak group is enabled. */ + if (!ss->opt.requireDHENamedGroups && + !ss->xtnData.peerSupportsFfdheGroups && + ss->version < SSL_LIBRARY_VERSION_TLS_1_3 && + ss->ssl3.dheWeakGroupEnabled) { + return PR_TRUE; + } + } else { + if (ss->version < SSL_LIBRARY_VERSION_TLS_1_3 && + !ss->opt.requireDHENamedGroups) { + /* The client enables DHE cipher suites even if no DHE groups + * are enabled. Only if this isn't TLS 1.3 and named groups + * are not required. */ + return PR_TRUE; + } + } + return ssl_NamedGroupTypeEnabled(ss, ssl_kea_dh); + } + + case ssl_kea_ecdh: + case ssl_kea_ecdh_psk: + return ssl_NamedGroupTypeEnabled(ss, ssl_kea_ecdh); + + case ssl_kea_tls13_any: + return PR_TRUE; + + case ssl_kea_fortezza: + default: + PORT_Assert(0); + } + return PR_FALSE; +} + +static PRBool +ssl_HasCert(const sslSocket *ss, SSLAuthType authType) +{ + PRCList *cursor; + if (authType == ssl_auth_null || authType == ssl_auth_psk || authType == ssl_auth_tls13_any) { + return PR_TRUE; + } + for (cursor = PR_NEXT_LINK(&ss->serverCerts); + cursor != &ss->serverCerts; + cursor = PR_NEXT_LINK(cursor)) { + sslServerCert *cert = (sslServerCert *)cursor; + if (cert->certType.authType != authType) { + continue; + } + if (!cert->serverKeyPair || + !cert->serverKeyPair->privKey || + !cert->serverCertChain) { + continue; + } + /* When called from ssl3_config_match_init(), all the EC curves will be + * enabled, so this will essentially do nothing (unless we implement + * curve configuration). However, once we have seen the + * supported_groups extension and this is called from config_match(), + * this will filter out certificates with an unsupported curve. */ + if ((authType == ssl_auth_ecdsa || + authType == ssl_auth_ecdh_ecdsa || + authType == ssl_auth_ecdh_rsa) && + !ssl_NamedGroupEnabled(ss, cert->certType.namedCurve)) { + continue; + } + return PR_TRUE; + } + return PR_FALSE; +} + +const ssl3BulkCipherDef * +ssl_GetBulkCipherDef(const ssl3CipherSuiteDef *cipher_def) +{ + PORT_Assert(cipher_def->bulk_cipher_alg < PR_ARRAY_SIZE(bulk_cipher_defs)); + PORT_Assert(bulk_cipher_defs[cipher_def->bulk_cipher_alg].cipher == cipher_def->bulk_cipher_alg); + return &bulk_cipher_defs[cipher_def->bulk_cipher_alg]; +} + +/* Initialize the suite->isPresent value for config_match + * Returns count of enabled ciphers supported by extant tokens, + * regardless of policy or user preference. + * If this returns zero, the user cannot do SSL v3. + */ +int +ssl3_config_match_init(sslSocket *ss) +{ + ssl3CipherSuiteCfg *suite; + const ssl3CipherSuiteDef *cipher_def; + SSLCipherAlgorithm cipher_alg; + CK_MECHANISM_TYPE cipher_mech; + SSLAuthType authType; + SSLKEAType keaType; + int i; + int numPresent = 0; + int numEnabled = 0; + + PORT_Assert(ss); + if (!ss) { + PORT_SetError(SEC_ERROR_INVALID_ARGS); + return 0; + } + if (SSL_ALL_VERSIONS_DISABLED(&ss->vrange)) { + return 0; + } + + for (i = 0; i < ssl_V3_SUITES_IMPLEMENTED; i++) { + suite = &ss->cipherSuites[i]; + if (suite->enabled) { + ++numEnabled; + /* We need the cipher defs to see if we have a token that can handle + * this cipher. It isn't part of the static definition. + */ + cipher_def = ssl_LookupCipherSuiteDef(suite->cipher_suite); + if (!cipher_def) { + suite->isPresent = PR_FALSE; + continue; + } + cipher_alg = ssl_GetBulkCipherDef(cipher_def)->calg; + cipher_mech = ssl3_Alg2Mech(cipher_alg); + + /* Mark the suites that are backed by real tokens, certs and keys */ + suite->isPresent = PR_TRUE; + + authType = kea_defs[cipher_def->key_exchange_alg].authKeyType; + if (authType != ssl_auth_null && authType != ssl_auth_tls13_any) { + if (ss->sec.isServer && !ssl_HasCert(ss, authType)) { + suite->isPresent = PR_FALSE; + } + if (!PK11_TokenExists(auth_alg_defs[authType])) { + suite->isPresent = PR_FALSE; + } + } + + keaType = kea_defs[cipher_def->key_exchange_alg].exchKeyType; + if (keaType != ssl_kea_null && + keaType != ssl_kea_tls13_any && + !PK11_TokenExists(kea_alg_defs[keaType])) { + suite->isPresent = PR_FALSE; + } + + if (cipher_alg != calg_null && + !PK11_TokenExists(cipher_mech)) { + suite->isPresent = PR_FALSE; + } + + if (suite->isPresent) { + ++numPresent; + } + } + } + PORT_Assert(numPresent > 0 || numEnabled == 0); + if (numPresent <= 0) { + PORT_SetError(SSL_ERROR_NO_CIPHERS_SUPPORTED); + } + return numPresent; +} + +/* Return PR_TRUE if suite is usable. This if the suite is permitted by policy, + * enabled, has a certificate (as needed), has a viable key agreement method, is + * usable with the negotiated TLS version, and is otherwise usable. */ +static PRBool +config_match(const ssl3CipherSuiteCfg *suite, int policy, + const SSLVersionRange *vrange, const sslSocket *ss) +{ + const ssl3CipherSuiteDef *cipher_def; + const ssl3KEADef *kea_def; + + PORT_Assert(policy != SSL_NOT_ALLOWED); + if (policy == SSL_NOT_ALLOWED) + return PR_FALSE; + + if (!suite->enabled || !suite->isPresent) + return PR_FALSE; + + if ((suite->policy == SSL_NOT_ALLOWED) || + (suite->policy > policy)) + return PR_FALSE; + + PORT_Assert(ss != NULL); + cipher_def = ssl_LookupCipherSuiteDef(suite->cipher_suite); + PORT_Assert(cipher_def != NULL); + kea_def = &kea_defs[cipher_def->key_exchange_alg]; + PORT_Assert(kea_def != NULL); + if (!ssl_KEAEnabled(ss, kea_def->exchKeyType)) { + return PR_FALSE; + } + + if (ss->sec.isServer && !ssl_HasCert(ss, kea_def->authKeyType)) { + return PR_FALSE; + } + + return ssl3_CipherSuiteAllowedForVersionRange(suite->cipher_suite, vrange); +} + +/* Return the number of cipher suites that are usable. */ +/* called from ssl3_SendClientHello */ +static int +count_cipher_suites(sslSocket *ss, int policy) +{ + int i, count = 0; + + if (SSL_ALL_VERSIONS_DISABLED(&ss->vrange)) { + return 0; + } + for (i = 0; i < ssl_V3_SUITES_IMPLEMENTED; i++) { + if (config_match(&ss->cipherSuites[i], policy, &ss->vrange, ss)) + count++; + } + if (count <= 0) { + PORT_SetError(SSL_ERROR_SSL_DISABLED); + } + return count; +} + +/* + * Null compression, mac and encryption functions + */ +static SECStatus +Null_Cipher(void *ctx, unsigned char *output, int *outputLen, int maxOutputLen, + const unsigned char *input, int inputLen) +{ + if (inputLen > maxOutputLen) { + *outputLen = 0; /* Match PK11_CipherOp in setting outputLen */ + PORT_SetError(SEC_ERROR_OUTPUT_LEN); + return SECFailure; + } + *outputLen = inputLen; + if (input != output) + PORT_Memcpy(output, input, inputLen); + return SECSuccess; +} + +/* + * SSL3 Utility functions + */ + +/* allowLargerPeerVersion controls whether the function will select the + * highest enabled SSL version or fail when peerVersion is greater than the + * highest enabled version. + * + * If allowLargerPeerVersion is true, peerVersion is the peer's highest + * enabled version rather than the peer's selected version. + */ +SECStatus +ssl3_NegotiateVersion(sslSocket *ss, SSL3ProtocolVersion peerVersion, + PRBool allowLargerPeerVersion) +{ + if (SSL_ALL_VERSIONS_DISABLED(&ss->vrange)) { + PORT_SetError(SSL_ERROR_SSL_DISABLED); + return SECFailure; + } + + if (peerVersion < ss->vrange.min || + (peerVersion > ss->vrange.max && !allowLargerPeerVersion)) { + PORT_SetError(SSL_ERROR_UNSUPPORTED_VERSION); + return SECFailure; + } + + ss->version = PR_MIN(peerVersion, ss->vrange.max); + PORT_Assert(ssl3_VersionIsSupported(ss->protocolVariant, ss->version)); + + return SECSuccess; +} + +/* Used by the client when the server produces a version number. + * This reads, validates, and normalizes the value. */ +SECStatus +ssl_ClientReadVersion(sslSocket *ss, SSL3Opaque **b, unsigned int *len, + SSL3ProtocolVersion *version) +{ + SSL3ProtocolVersion v; + PRInt32 temp; + + temp = ssl3_ConsumeHandshakeNumber(ss, 2, b, len); + if (temp < 0) { + return SECFailure; /* alert has been sent */ + } + +#ifdef TLS_1_3_DRAFT_VERSION + if (temp == SSL_LIBRARY_VERSION_TLS_1_3) { + (void)SSL3_SendAlert(ss, alert_fatal, protocol_version); + PORT_SetError(SSL_ERROR_UNSUPPORTED_VERSION); + return SECFailure; + } + if (temp == tls13_EncodeDraftVersion(SSL_LIBRARY_VERSION_TLS_1_3)) { + v = SSL_LIBRARY_VERSION_TLS_1_3; + } else { + v = (SSL3ProtocolVersion)temp; + } +#else + v = (SSL3ProtocolVersion)temp; +#endif + + if (IS_DTLS(ss)) { + /* If this fails, we get 0 back and the next check to fails. */ + v = dtls_DTLSVersionToTLSVersion(v); + } + + PORT_Assert(!SSL_ALL_VERSIONS_DISABLED(&ss->vrange)); + if (ss->vrange.min > v || ss->vrange.max < v) { + (void)SSL3_SendAlert(ss, alert_fatal, + (v > SSL_LIBRARY_VERSION_3_0) ? protocol_version + : handshake_failure); + PORT_SetError(SSL_ERROR_UNSUPPORTED_VERSION); + return SECFailure; + } + *version = v; + return SECSuccess; +} + +static SECStatus +ssl3_GetNewRandom(SSL3Random *random) +{ + SECStatus rv; + + rv = PK11_GenerateRandom(random->rand, SSL3_RANDOM_LENGTH); + if (rv != SECSuccess) { + ssl_MapLowLevelError(SSL_ERROR_GENERATE_RANDOM_FAILURE); + } + return rv; +} + +/* Called by ssl3_SendServerKeyExchange and ssl3_SendCertificateVerify */ +SECStatus +ssl3_SignHashes(sslSocket *ss, SSL3Hashes *hash, SECKEYPrivateKey *key, + SECItem *buf) +{ + SECStatus rv = SECFailure; + PRBool doDerEncode = PR_FALSE; + PRBool isTLS = (PRBool)(ss->ssl3.pwSpec->version > SSL_LIBRARY_VERSION_3_0); + PRBool useRsaPss = ssl_IsRsaPssSignatureScheme(ss->ssl3.hs.signatureScheme); + SECItem hashItem; + + buf->data = NULL; + + switch (SECKEY_GetPrivateKeyType(key)) { + case rsaKey: + hashItem.data = hash->u.raw; + hashItem.len = hash->len; + break; + case dsaKey: + doDerEncode = isTLS; + /* ssl_hash_none is used to specify the MD5/SHA1 concatenated hash. + * In that case, we use just the SHA1 part. */ + if (hash->hashAlg == ssl_hash_none) { + hashItem.data = hash->u.s.sha; + hashItem.len = sizeof(hash->u.s.sha); + } else { + hashItem.data = hash->u.raw; + hashItem.len = hash->len; + } + break; + case ecKey: + doDerEncode = PR_TRUE; + /* ssl_hash_none is used to specify the MD5/SHA1 concatenated hash. + * In that case, we use just the SHA1 part. */ + if (hash->hashAlg == ssl_hash_none) { + hashItem.data = hash->u.s.sha; + hashItem.len = sizeof(hash->u.s.sha); + } else { + hashItem.data = hash->u.raw; + hashItem.len = hash->len; + } + break; + default: + PORT_SetError(SEC_ERROR_INVALID_KEY); + goto done; + } + PRINT_BUF(60, (NULL, "hash(es) to be signed", hashItem.data, hashItem.len)); + + if (useRsaPss || hash->hashAlg == ssl_hash_none) { + CK_MECHANISM_TYPE mech = PK11_MapSignKeyType(key->keyType); + int signatureLen = PK11_SignatureLen(key); + + SECItem *params = NULL; + CK_RSA_PKCS_PSS_PARAMS pssParams; + SECItem pssParamsItem = { siBuffer, + (unsigned char *)&pssParams, + sizeof(pssParams) }; + + if (signatureLen <= 0) { + PORT_SetError(SEC_ERROR_INVALID_KEY); + goto done; + } + + buf->len = (unsigned)signatureLen; + buf->data = (unsigned char *)PORT_Alloc(signatureLen); + if (!buf->data) + goto done; /* error code was set. */ + + if (useRsaPss) { + pssParams.hashAlg = ssl3_GetHashMechanismByHashType(hash->hashAlg); + pssParams.mgf = ssl3_GetMgfMechanismByHashType(hash->hashAlg); + pssParams.sLen = hashItem.len; + params = &pssParamsItem; + mech = CKM_RSA_PKCS_PSS; + } + + rv = PK11_SignWithMechanism(key, mech, params, buf, &hashItem); + } else { + SECOidTag hashOID = ssl3_HashTypeToOID(hash->hashAlg); + rv = SGN_Digest(key, hashOID, buf, &hashItem); + } + if (rv != SECSuccess) { + ssl_MapLowLevelError(SSL_ERROR_SIGN_HASHES_FAILURE); + } else if (doDerEncode) { + SECItem derSig = { siBuffer, NULL, 0 }; + + /* This also works for an ECDSA signature */ + rv = DSAU_EncodeDerSigWithLen(&derSig, buf, buf->len); + if (rv == SECSuccess) { + PORT_Free(buf->data); /* discard unencoded signature. */ + *buf = derSig; /* give caller encoded signature. */ + } else if (derSig.data) { + PORT_Free(derSig.data); + } + } + + if (ss->sec.isServer) { + ss->sec.signatureScheme = ss->ssl3.hs.signatureScheme; + } + PRINT_BUF(60, (NULL, "signed hashes", (unsigned char *)buf->data, buf->len)); +done: + if (rv != SECSuccess && buf->data) { + PORT_Free(buf->data); + buf->data = NULL; + } + return rv; +} + +/* Called from ssl3_HandleServerKeyExchange, ssl3_HandleCertificateVerify */ +SECStatus +ssl3_VerifySignedHashes(sslSocket *ss, SSLSignatureScheme scheme, SSL3Hashes *hash, + SECItem *buf) +{ + SECKEYPublicKey *key; + SECItem *signature = NULL; + SECStatus rv = SECFailure; + SECItem hashItem; + SECOidTag encAlg; + SECOidTag hashAlg; + void *pwArg = ss->pkcs11PinArg; + PRBool isRsaPssScheme = ssl_IsRsaPssSignatureScheme(scheme); + + PRINT_BUF(60, (NULL, "check signed hashes", + buf->data, buf->len)); + + key = CERT_ExtractPublicKey(ss->sec.peerCert); + if (key == NULL) { + ssl_MapLowLevelError(SSL_ERROR_EXTRACT_PUBLIC_KEY_FAILURE); + return SECFailure; + } + + hashAlg = ssl3_HashTypeToOID(hash->hashAlg); + switch (SECKEY_GetPublicKeyType(key)) { + case rsaKey: + encAlg = SEC_OID_PKCS1_RSA_ENCRYPTION; + hashItem.data = hash->u.raw; + hashItem.len = hash->len; + if (scheme == ssl_sig_none) { + scheme = ssl_sig_rsa_pkcs1_sha1md5; + } + break; + case dsaKey: + encAlg = SEC_OID_ANSIX9_DSA_SIGNATURE; + /* ssl_hash_none is used to specify the MD5/SHA1 concatenated hash. + * In that case, we use just the SHA1 part. */ + if (hash->hashAlg == ssl_hash_none) { + hashItem.data = hash->u.s.sha; + hashItem.len = sizeof(hash->u.s.sha); + } else { + hashItem.data = hash->u.raw; + hashItem.len = hash->len; + } + /* Allow DER encoded DSA signatures in SSL 3.0 */ + if (ss->ssl3.prSpec->version > SSL_LIBRARY_VERSION_3_0 || + buf->len != SECKEY_SignatureLen(key)) { + signature = DSAU_DecodeDerSigToLen(buf, SECKEY_SignatureLen(key)); + if (!signature) { + PORT_SetError(SSL_ERROR_BAD_HANDSHAKE_HASH_VALUE); + goto loser; + } + buf = signature; + } + if (scheme == ssl_sig_none) { + scheme = ssl_sig_dsa_sha1; + } + break; + + case ecKey: + encAlg = SEC_OID_ANSIX962_EC_PUBLIC_KEY; + /* ssl_hash_none is used to specify the MD5/SHA1 concatenated hash. + * In that case, we use just the SHA1 part. + * ECDSA signatures always encode the integers r and s using ASN.1 + * (unlike DSA where ASN.1 encoding is used with TLS but not with + * SSL3). So we can use VFY_VerifyDigestDirect for ECDSA. + */ + if (hash->hashAlg == ssl_hash_none) { + hashAlg = SEC_OID_SHA1; + hashItem.data = hash->u.s.sha; + hashItem.len = sizeof(hash->u.s.sha); + } else { + hashItem.data = hash->u.raw; + hashItem.len = hash->len; + } + if (scheme == ssl_sig_none) { + scheme = ssl_sig_ecdsa_sha1; + } + break; + + default: + PORT_SetError(SEC_ERROR_UNSUPPORTED_KEYALG); + goto loser; + } + + PRINT_BUF(60, (NULL, "hash(es) to be verified", + hashItem.data, hashItem.len)); + + if (isRsaPssScheme || + hashAlg == SEC_OID_UNKNOWN || + SECKEY_GetPublicKeyType(key) == dsaKey) { + /* VFY_VerifyDigestDirect requires DSA signatures to be DER-encoded. + * DSA signatures are DER-encoded in TLS but not in SSL3 and the code + * above always removes the DER encoding of DSA signatures when + * present. Thus DSA signatures are always verified with PK11_Verify. + */ + CK_MECHANISM_TYPE mech = PK11_MapSignKeyType(key->keyType); + + SECItem *params = NULL; + CK_RSA_PKCS_PSS_PARAMS pssParams; + SECItem pssParamsItem = { siBuffer, + (unsigned char *)&pssParams, + sizeof(pssParams) }; + + if (isRsaPssScheme) { + pssParams.hashAlg = ssl3_GetHashMechanismByHashType(hash->hashAlg); + pssParams.mgf = ssl3_GetMgfMechanismByHashType(hash->hashAlg); + pssParams.sLen = hashItem.len; + params = &pssParamsItem; + mech = CKM_RSA_PKCS_PSS; + } + + rv = PK11_VerifyWithMechanism(key, mech, params, buf, &hashItem, pwArg); + } else { + rv = VFY_VerifyDigestDirect(&hashItem, key, buf, encAlg, hashAlg, + pwArg); + } + if (signature) { + SECITEM_FreeItem(signature, PR_TRUE); + } + if (rv != SECSuccess) { + ssl_MapLowLevelError(SSL_ERROR_BAD_HANDSHAKE_HASH_VALUE); + } + if (!ss->sec.isServer) { + ss->sec.signatureScheme = scheme; + } + +loser: + SECKEY_DestroyPublicKey(key); +#ifdef UNSAFE_FUZZER_MODE + rv = SECSuccess; + PORT_SetError(0); +#endif + return rv; +} + +/* Caller must set hiLevel error code. */ +/* Called from ssl3_ComputeDHKeyHash + * which are called from ssl3_HandleServerKeyExchange. + * + * hashAlg: ssl_hash_none indicates the pre-1.2, MD5/SHA1 combination hash. + */ +SECStatus +ssl3_ComputeCommonKeyHash(SSLHashType hashAlg, + PRUint8 *hashBuf, unsigned int bufLen, + SSL3Hashes *hashes) +{ + SECStatus rv; + SECOidTag hashOID; + + if (hashAlg == ssl_hash_none) { + rv = PK11_HashBuf(SEC_OID_MD5, hashes->u.s.md5, hashBuf, bufLen); + if (rv != SECSuccess) { + ssl_MapLowLevelError(SSL_ERROR_MD5_DIGEST_FAILURE); + return rv; + } + rv = PK11_HashBuf(SEC_OID_SHA1, hashes->u.s.sha, hashBuf, bufLen); + if (rv != SECSuccess) { + ssl_MapLowLevelError(SSL_ERROR_SHA_DIGEST_FAILURE); + return rv; + } + hashes->len = MD5_LENGTH + SHA1_LENGTH; + } else { + hashOID = ssl3_HashTypeToOID(hashAlg); + hashes->len = HASH_ResultLenByOidTag(hashOID); + if (hashes->len == 0 || hashes->len > sizeof(hashes->u.raw)) { + ssl_MapLowLevelError(SSL_ERROR_UNSUPPORTED_HASH_ALGORITHM); + return SECFailure; + } + rv = PK11_HashBuf(hashOID, hashes->u.raw, hashBuf, bufLen); + if (rv != SECSuccess) { + ssl_MapLowLevelError(SSL_ERROR_DIGEST_FAILURE); + return rv; + } + } + hashes->hashAlg = hashAlg; + return SECSuccess; +} + +/* Caller must set hiLevel error code. */ +/* Called from ssl3_HandleServerKeyExchange. */ +static SECStatus +ssl3_ComputeDHKeyHash(sslSocket *ss, SSLHashType hashAlg, SSL3Hashes *hashes, + SECItem dh_p, SECItem dh_g, SECItem dh_Ys, PRBool padY) +{ + PRUint8 *hashBuf; + PRUint8 *pBuf; + SECStatus rv = SECSuccess; + unsigned int bufLen, yLen; + PRUint8 buf[2 * SSL3_RANDOM_LENGTH + 2 + 4096 / 8 + 2 + 4096 / 8]; + + PORT_Assert(dh_p.data); + PORT_Assert(dh_g.data); + PORT_Assert(dh_Ys.data); + + yLen = padY ? dh_p.len : dh_Ys.len; + bufLen = 2 * SSL3_RANDOM_LENGTH + + 2 + dh_p.len + + 2 + dh_g.len + + 2 + yLen; + if (bufLen <= sizeof buf) { + hashBuf = buf; + } else { + hashBuf = PORT_Alloc(bufLen); + if (!hashBuf) { + return SECFailure; + } + } + + memcpy(hashBuf, &ss->ssl3.hs.client_random, SSL3_RANDOM_LENGTH); + pBuf = hashBuf + SSL3_RANDOM_LENGTH; + memcpy(pBuf, &ss->ssl3.hs.server_random, SSL3_RANDOM_LENGTH); + pBuf += SSL3_RANDOM_LENGTH; + pBuf = ssl_EncodeUintX(dh_p.len, 2, pBuf); + memcpy(pBuf, dh_p.data, dh_p.len); + pBuf += dh_p.len; + pBuf = ssl_EncodeUintX(dh_g.len, 2, pBuf); + memcpy(pBuf, dh_g.data, dh_g.len); + pBuf += dh_g.len; + pBuf = ssl_EncodeUintX(yLen, 2, pBuf); + if (padY && dh_p.len > dh_Ys.len) { + memset(pBuf, 0, dh_p.len - dh_Ys.len); + pBuf += dh_p.len - dh_Ys.len; + } + /* If we're padding Y, dh_Ys can't be longer than dh_p. */ + PORT_Assert(!padY || dh_p.len >= dh_Ys.len); + memcpy(pBuf, dh_Ys.data, dh_Ys.len); + pBuf += dh_Ys.len; + PORT_Assert((unsigned int)(pBuf - hashBuf) == bufLen); + + rv = ssl3_ComputeCommonKeyHash(hashAlg, hashBuf, bufLen, hashes); + + PRINT_BUF(95, (NULL, "DHkey hash: ", hashBuf, bufLen)); + if (rv == SECSuccess) { + if (hashAlg == ssl_hash_none) { + PRINT_BUF(95, (NULL, "DHkey hash: MD5 result", + hashes->u.s.md5, MD5_LENGTH)); + PRINT_BUF(95, (NULL, "DHkey hash: SHA1 result", + hashes->u.s.sha, SHA1_LENGTH)); + } else { + PRINT_BUF(95, (NULL, "DHkey hash: result", + hashes->u.raw, hashes->len)); + } + } + + if (hashBuf != buf && hashBuf != NULL) + PORT_Free(hashBuf); + return rv; +} + +/* Called twice, only from ssl3_DestroyCipherSpec (immediately below). */ +static void +ssl3_CleanupKeyMaterial(ssl3KeyMaterial *mat) +{ + if (mat->write_key != NULL) { + PK11_FreeSymKey(mat->write_key); + mat->write_key = NULL; + } + if (mat->write_mac_key != NULL) { + PK11_FreeSymKey(mat->write_mac_key); + mat->write_mac_key = NULL; + } + if (mat->write_mac_context != NULL) { + PK11_DestroyContext(mat->write_mac_context, PR_TRUE); + mat->write_mac_context = NULL; + } +} + +/* Called from ssl3_SendChangeCipherSpecs() and +** ssl3_HandleChangeCipherSpecs() +** ssl3_DestroySSL3Info +** Caller must hold SpecWriteLock. +*/ +void +ssl3_DestroyCipherSpec(ssl3CipherSpec *spec, PRBool freeSrvName) +{ + /* PORT_Assert( ss->opt.noLocks || ssl_HaveSpecWriteLock(ss)); Don't have ss! */ + if (spec->encodeContext) { + PK11_DestroyContext(spec->encodeContext, PR_TRUE); + spec->encodeContext = NULL; + } + if (spec->decodeContext) { + PK11_DestroyContext(spec->decodeContext, PR_TRUE); + spec->decodeContext = NULL; + } + if (spec->destroyCompressContext && spec->compressContext) { + spec->destroyCompressContext(spec->compressContext, 1); + spec->compressContext = NULL; + } + if (spec->destroyDecompressContext && spec->decompressContext) { + spec->destroyDecompressContext(spec->decompressContext, 1); + spec->decompressContext = NULL; + } + if (spec->master_secret != NULL) { + PK11_FreeSymKey(spec->master_secret); + spec->master_secret = NULL; + } + spec->msItem.data = NULL; + spec->msItem.len = 0; + ssl3_CleanupKeyMaterial(&spec->client); + ssl3_CleanupKeyMaterial(&spec->server); + spec->destroyCompressContext = NULL; + spec->destroyDecompressContext = NULL; +} + +/* Fill in the pending cipher spec with info from the selected ciphersuite. +** This is as much initialization as we can do without having key material. +** Called from ssl3_HandleServerHello(), ssl3_SendServerHello() +** Caller must hold the ssl3 handshake lock. +** Acquires & releases SpecWriteLock. +*/ +SECStatus +ssl3_SetupPendingCipherSpec(sslSocket *ss) +{ + ssl3CipherSpec *pwSpec; + ssl3CipherSpec *cwSpec; + ssl3CipherSuite suite = ss->ssl3.hs.cipher_suite; + SSL3MACAlgorithm mac; + SSL3KeyExchangeAlgorithm kea; + const ssl3CipherSuiteDef *suite_def; + PRBool isTLS; + + PORT_Assert(ss->opt.noLocks || ssl_HaveSSL3HandshakeLock(ss)); + PORT_Assert(ss->version < SSL_LIBRARY_VERSION_TLS_1_3); + + ssl_GetSpecWriteLock(ss); /*******************************/ + + pwSpec = ss->ssl3.pwSpec; + PORT_Assert(pwSpec == ss->ssl3.prSpec); + + /* This hack provides maximal interoperability with SSL 3 servers. */ + cwSpec = ss->ssl3.cwSpec; + if (cwSpec->mac_def->mac == mac_null) { + /* SSL records are not being MACed. */ + cwSpec->version = ss->version; + } + + pwSpec->version = ss->version; + isTLS = (PRBool)(pwSpec->version > SSL_LIBRARY_VERSION_3_0); + + SSL_TRC(3, ("%d: SSL3[%d]: Set XXX Pending Cipher Suite to 0x%04x", + SSL_GETPID(), ss->fd, suite)); + + suite_def = ssl_LookupCipherSuiteDef(suite); + if (suite_def == NULL) { + ssl_ReleaseSpecWriteLock(ss); + return SECFailure; /* error code set by ssl_LookupCipherSuiteDef */ + } + + if (IS_DTLS(ss)) { + /* Double-check that we did not pick an RC4 suite */ + PORT_Assert(suite_def->bulk_cipher_alg != cipher_rc4); + } + + kea = suite_def->key_exchange_alg; + mac = suite_def->mac_alg; + if (mac <= ssl_mac_sha && mac != ssl_mac_null && isTLS) + mac += 2; + + ss->ssl3.hs.suite_def = suite_def; + ss->ssl3.hs.kea_def = &kea_defs[kea]; + PORT_Assert(ss->ssl3.hs.kea_def->kea == kea); + + pwSpec->cipher_def = ssl_GetBulkCipherDef(suite_def); + + pwSpec->mac_def = &mac_defs[mac]; + PORT_Assert(pwSpec->mac_def->mac == mac); + + pwSpec->encodeContext = NULL; + pwSpec->decodeContext = NULL; + + pwSpec->mac_size = pwSpec->mac_def->mac_size; + + pwSpec->compression_method = ss->ssl3.hs.compression; + pwSpec->compressContext = NULL; + pwSpec->decompressContext = NULL; + + if (ss->version >= SSL_LIBRARY_VERSION_TLS_1_3) { + PORT_Assert(ss->ssl3.hs.kea_def->ephemeral); + PORT_Assert(pwSpec->cipher_def->type == type_aead); + } + ssl_ReleaseSpecWriteLock(ss); /*******************************/ + return SECSuccess; +} + +#ifdef NSS_SSL_ENABLE_ZLIB +#define SSL3_DEFLATE_CONTEXT_SIZE sizeof(z_stream) + +static SECStatus +ssl3_MapZlibError(int zlib_error) +{ + switch (zlib_error) { + case Z_OK: + return SECSuccess; + default: + return SECFailure; + } +} + +static SECStatus +ssl3_DeflateInit(void *void_context) +{ + z_stream *context = void_context; + context->zalloc = NULL; + context->zfree = NULL; + context->opaque = NULL; + + return ssl3_MapZlibError(deflateInit(context, Z_DEFAULT_COMPRESSION)); +} + +static SECStatus +ssl3_InflateInit(void *void_context) +{ + z_stream *context = void_context; + context->zalloc = NULL; + context->zfree = NULL; + context->opaque = NULL; + context->next_in = NULL; + context->avail_in = 0; + + return ssl3_MapZlibError(inflateInit(context)); +} + +static SECStatus +ssl3_DeflateCompress(void *void_context, unsigned char *out, int *out_len, + int maxout, const unsigned char *in, int inlen) +{ + z_stream *context = void_context; + + if (!inlen) { + *out_len = 0; + return SECSuccess; + } + + context->next_in = (unsigned char *)in; + context->avail_in = inlen; + context->next_out = out; + context->avail_out = maxout; + if (deflate(context, Z_SYNC_FLUSH) != Z_OK) { + return SECFailure; + } + if (context->avail_out == 0) { + /* We ran out of space! */ + SSL_TRC(3, ("%d: SSL3[%d] Ran out of buffer while compressing", + SSL_GETPID())); + return SECFailure; + } + + *out_len = maxout - context->avail_out; + return SECSuccess; +} + +static SECStatus +ssl3_DeflateDecompress(void *void_context, unsigned char *out, int *out_len, + int maxout, const unsigned char *in, int inlen) +{ + z_stream *context = void_context; + + if (!inlen) { + *out_len = 0; + return SECSuccess; + } + + context->next_in = (unsigned char *)in; + context->avail_in = inlen; + context->next_out = out; + context->avail_out = maxout; + if (inflate(context, Z_SYNC_FLUSH) != Z_OK) { + PORT_SetError(SSL_ERROR_DECOMPRESSION_FAILURE); + return SECFailure; + } + + *out_len = maxout - context->avail_out; + return SECSuccess; +} + +static SECStatus +ssl3_DestroyCompressContext(void *void_context, PRBool unused) +{ + deflateEnd(void_context); + PORT_Free(void_context); + return SECSuccess; +} + +static SECStatus +ssl3_DestroyDecompressContext(void *void_context, PRBool unused) +{ + inflateEnd(void_context); + PORT_Free(void_context); + return SECSuccess; +} + +#endif /* NSS_SSL_ENABLE_ZLIB */ + +/* Initialize the compression functions and contexts for the given + * CipherSpec. */ +static SECStatus +ssl3_InitCompressionContext(ssl3CipherSpec *pwSpec) +{ + /* Setup the compression functions */ + switch (pwSpec->compression_method) { + case ssl_compression_null: + pwSpec->compressor = NULL; + pwSpec->decompressor = NULL; + pwSpec->compressContext = NULL; + pwSpec->decompressContext = NULL; + pwSpec->destroyCompressContext = NULL; + pwSpec->destroyDecompressContext = NULL; + break; +#ifdef NSS_SSL_ENABLE_ZLIB + case ssl_compression_deflate: + pwSpec->compressor = ssl3_DeflateCompress; + pwSpec->decompressor = ssl3_DeflateDecompress; + pwSpec->compressContext = PORT_Alloc(SSL3_DEFLATE_CONTEXT_SIZE); + pwSpec->decompressContext = PORT_Alloc(SSL3_DEFLATE_CONTEXT_SIZE); + pwSpec->destroyCompressContext = ssl3_DestroyCompressContext; + pwSpec->destroyDecompressContext = ssl3_DestroyDecompressContext; + ssl3_DeflateInit(pwSpec->compressContext); + ssl3_InflateInit(pwSpec->decompressContext); + break; +#endif /* NSS_SSL_ENABLE_ZLIB */ + default: + PORT_Assert(0); + PORT_SetError(SEC_ERROR_LIBRARY_FAILURE); + return SECFailure; + } + + return SECSuccess; +} + +/* This function should probably be moved to pk11wrap and be named + * PK11_ParamFromIVAndEffectiveKeyBits + */ +static SECItem * +ssl3_ParamFromIV(CK_MECHANISM_TYPE mtype, SECItem *iv, CK_ULONG ulEffectiveBits) +{ + SECItem *param = PK11_ParamFromIV(mtype, iv); + if (param && param->data && param->len >= sizeof(CK_RC2_PARAMS)) { + switch (mtype) { + case CKM_RC2_KEY_GEN: + case CKM_RC2_ECB: + case CKM_RC2_CBC: + case CKM_RC2_MAC: + case CKM_RC2_MAC_GENERAL: + case CKM_RC2_CBC_PAD: + *(CK_RC2_PARAMS *)param->data = ulEffectiveBits; + default: + break; + } + } + return param; +} + +/* ssl3_BuildRecordPseudoHeader writes the SSL/TLS pseudo-header (the data + * which is included in the MAC or AEAD additional data) to |out| and returns + * its length. See https://tools.ietf.org/html/rfc5246#section-6.2.3.3 for the + * definition of the AEAD additional data. + * + * TLS pseudo-header includes the record's version field, SSL's doesn't. Which + * pseudo-header defintiion to use should be decided based on the version of + * the protocol that was negotiated when the cipher spec became current, NOT + * based on the version value in the record itself, and the decision is passed + * to this function as the |includesVersion| argument. But, the |version| + * argument should be the record's version value. + */ +static unsigned int +ssl3_BuildRecordPseudoHeader(unsigned char *out, + sslSequenceNumber seq_num, + SSL3ContentType type, + PRBool includesVersion, + SSL3ProtocolVersion version, + PRBool isDTLS, + int length) +{ + out[0] = (unsigned char)(seq_num >> 56); + out[1] = (unsigned char)(seq_num >> 48); + out[2] = (unsigned char)(seq_num >> 40); + out[3] = (unsigned char)(seq_num >> 32); + out[4] = (unsigned char)(seq_num >> 24); + out[5] = (unsigned char)(seq_num >> 16); + out[6] = (unsigned char)(seq_num >> 8); + out[7] = (unsigned char)(seq_num >> 0); + out[8] = type; + + /* SSL3 MAC doesn't include the record's version field. */ + if (!includesVersion) { + out[9] = MSB(length); + out[10] = LSB(length); + return 11; + } + + /* TLS MAC and AEAD additional data include version. */ + if (isDTLS) { + SSL3ProtocolVersion dtls_version; + + dtls_version = dtls_TLSVersionToDTLSVersion(version); + out[9] = MSB(dtls_version); + out[10] = LSB(dtls_version); + } else { + out[9] = MSB(version); + out[10] = LSB(version); + } + out[11] = MSB(length); + out[12] = LSB(length); + return 13; +} + +static SECStatus +ssl3_AESGCM(ssl3KeyMaterial *keys, + PRBool doDecrypt, + unsigned char *out, + int *outlen, + int maxout, + const unsigned char *in, + int inlen, + const unsigned char *additionalData, + int additionalDataLen) +{ + SECItem param; + SECStatus rv = SECFailure; + unsigned char nonce[12]; + unsigned int uOutLen; + CK_GCM_PARAMS gcmParams; + + const int tagSize = bulk_cipher_defs[cipher_aes_128_gcm].tag_size; + const int explicitNonceLen = + bulk_cipher_defs[cipher_aes_128_gcm].explicit_nonce_size; + + /* See https://tools.ietf.org/html/rfc5288#section-3 for details of how the + * nonce is formed. */ + memcpy(nonce, keys->write_iv, 4); + if (doDecrypt) { + memcpy(nonce + 4, in, explicitNonceLen); + in += explicitNonceLen; + inlen -= explicitNonceLen; + *outlen = 0; + } else { + if (maxout < explicitNonceLen) { + PORT_SetError(SEC_ERROR_INPUT_LEN); + return SECFailure; + } + /* Use the 64-bit sequence number as the explicit nonce. */ + memcpy(nonce + 4, additionalData, explicitNonceLen); + memcpy(out, additionalData, explicitNonceLen); + out += explicitNonceLen; + maxout -= explicitNonceLen; + *outlen = explicitNonceLen; + } + + param.type = siBuffer; + param.data = (unsigned char *)&gcmParams; + param.len = sizeof(gcmParams); + gcmParams.pIv = nonce; + gcmParams.ulIvLen = sizeof(nonce); + gcmParams.pAAD = (unsigned char *)additionalData; /* const cast */ + gcmParams.ulAADLen = additionalDataLen; + gcmParams.ulTagBits = tagSize * 8; + + if (doDecrypt) { + rv = PK11_Decrypt(keys->write_key, CKM_AES_GCM, ¶m, out, &uOutLen, + maxout, in, inlen); + } else { + rv = PK11_Encrypt(keys->write_key, CKM_AES_GCM, ¶m, out, &uOutLen, + maxout, in, inlen); + } + *outlen += (int)uOutLen; + + return rv; +} + +static SECStatus +ssl3_ChaCha20Poly1305(ssl3KeyMaterial *keys, PRBool doDecrypt, + unsigned char *out, int *outlen, int maxout, + const unsigned char *in, int inlen, + const unsigned char *additionalData, + int additionalDataLen) +{ + size_t i; + SECItem param; + SECStatus rv = SECFailure; + unsigned int uOutLen; + unsigned char nonce[12]; + CK_NSS_AEAD_PARAMS aeadParams; + + const int tagSize = bulk_cipher_defs[cipher_chacha20].tag_size; + + /* See + * https://tools.ietf.org/html/draft-ietf-tls-chacha20-poly1305-04#section-2 + * for details of how the nonce is formed. */ + PORT_Memcpy(nonce, keys->write_iv, 12); + + /* XOR the last 8 bytes of the IV with the sequence number. */ + PORT_Assert(additionalDataLen >= 8); + for (i = 0; i < 8; ++i) { + nonce[4 + i] ^= additionalData[i]; + } + + param.type = siBuffer; + param.len = sizeof(aeadParams); + param.data = (unsigned char *)&aeadParams; + memset(&aeadParams, 0, sizeof(aeadParams)); + aeadParams.pNonce = nonce; + aeadParams.ulNonceLen = sizeof(nonce); + aeadParams.pAAD = (unsigned char *)additionalData; + aeadParams.ulAADLen = additionalDataLen; + aeadParams.ulTagLen = tagSize; + + if (doDecrypt) { + rv = PK11_Decrypt(keys->write_key, CKM_NSS_CHACHA20_POLY1305, ¶m, + out, &uOutLen, maxout, in, inlen); + } else { + rv = PK11_Encrypt(keys->write_key, CKM_NSS_CHACHA20_POLY1305, ¶m, + out, &uOutLen, maxout, in, inlen); + } + *outlen = (int)uOutLen; + + return rv; +} + +/* Initialize encryption and MAC contexts for pending spec. + * Master Secret already is derived. + * Caller holds Spec write lock. + */ +static SECStatus +ssl3_InitPendingContexts(sslSocket *ss) +{ + ssl3CipherSpec *pwSpec; + const ssl3BulkCipherDef *cipher_def; + PK11Context *serverContext = NULL; + PK11Context *clientContext = NULL; + SECItem *param; + CK_MECHANISM_TYPE mechanism; + CK_MECHANISM_TYPE mac_mech; + CK_ULONG macLength; + CK_ULONG effKeyBits; + SECItem iv; + SECItem mac_param; + SSLCipherAlgorithm calg; + + PORT_Assert(ss->opt.noLocks || ssl_HaveSSL3HandshakeLock(ss)); + PORT_Assert(ss->opt.noLocks || ssl_HaveSpecWriteLock(ss)); + PORT_Assert(ss->ssl3.prSpec == ss->ssl3.pwSpec); + + pwSpec = ss->ssl3.pwSpec; + cipher_def = pwSpec->cipher_def; + macLength = pwSpec->mac_size; + calg = cipher_def->calg; + PORT_Assert(alg2Mech[calg].calg == calg); + + pwSpec->client.write_mac_context = NULL; + pwSpec->server.write_mac_context = NULL; + + if (cipher_def->type == type_aead) { + pwSpec->encode = NULL; + pwSpec->decode = NULL; + pwSpec->encodeContext = NULL; + pwSpec->decodeContext = NULL; + switch (calg) { + case calg_aes_gcm: + pwSpec->aead = ssl3_AESGCM; + break; + case calg_chacha20: + pwSpec->aead = ssl3_ChaCha20Poly1305; + break; + default: + PORT_SetError(SEC_ERROR_LIBRARY_FAILURE); + return SECFailure; + } + return SECSuccess; + } + + /* + ** Now setup the MAC contexts, + ** crypto contexts are setup below. + */ + + mac_mech = pwSpec->mac_def->mmech; + mac_param.data = (unsigned char *)&macLength; + mac_param.len = sizeof(macLength); + mac_param.type = 0; + + pwSpec->client.write_mac_context = PK11_CreateContextBySymKey( + mac_mech, CKA_SIGN, pwSpec->client.write_mac_key, &mac_param); + if (pwSpec->client.write_mac_context == NULL) { + ssl_MapLowLevelError(SSL_ERROR_SYM_KEY_CONTEXT_FAILURE); + goto fail; + } + pwSpec->server.write_mac_context = PK11_CreateContextBySymKey( + mac_mech, CKA_SIGN, pwSpec->server.write_mac_key, &mac_param); + if (pwSpec->server.write_mac_context == NULL) { + ssl_MapLowLevelError(SSL_ERROR_SYM_KEY_CONTEXT_FAILURE); + goto fail; + } + + /* + ** Now setup the crypto contexts. + */ + + if (calg == calg_null) { + pwSpec->encode = Null_Cipher; + pwSpec->decode = Null_Cipher; + return SECSuccess; + } + mechanism = ssl3_Alg2Mech(calg); + effKeyBits = cipher_def->key_size * BPB; + + /* + * build the server context + */ + iv.data = pwSpec->server.write_iv; + iv.len = cipher_def->iv_size; + param = ssl3_ParamFromIV(mechanism, &iv, effKeyBits); + if (param == NULL) { + ssl_MapLowLevelError(SSL_ERROR_IV_PARAM_FAILURE); + goto fail; + } + serverContext = PK11_CreateContextBySymKey(mechanism, + (ss->sec.isServer ? CKA_ENCRYPT + : CKA_DECRYPT), + pwSpec->server.write_key, param); + iv.data = PK11_IVFromParam(mechanism, param, (int *)&iv.len); + if (iv.data) + PORT_Memcpy(pwSpec->server.write_iv, iv.data, iv.len); + SECITEM_FreeItem(param, PR_TRUE); + if (serverContext == NULL) { + ssl_MapLowLevelError(SSL_ERROR_SYM_KEY_CONTEXT_FAILURE); + goto fail; + } + + /* + * build the client context + */ + iv.data = pwSpec->client.write_iv; + iv.len = cipher_def->iv_size; + + param = ssl3_ParamFromIV(mechanism, &iv, effKeyBits); + if (param == NULL) { + ssl_MapLowLevelError(SSL_ERROR_IV_PARAM_FAILURE); + goto fail; + } + clientContext = PK11_CreateContextBySymKey(mechanism, + (ss->sec.isServer ? CKA_DECRYPT + : CKA_ENCRYPT), + pwSpec->client.write_key, param); + iv.data = PK11_IVFromParam(mechanism, param, (int *)&iv.len); + if (iv.data) + PORT_Memcpy(pwSpec->client.write_iv, iv.data, iv.len); + SECITEM_FreeItem(param, PR_TRUE); + if (clientContext == NULL) { + ssl_MapLowLevelError(SSL_ERROR_SYM_KEY_CONTEXT_FAILURE); + goto fail; + } + pwSpec->encode = (SSLCipher)PK11_CipherOp; + pwSpec->decode = (SSLCipher)PK11_CipherOp; + + pwSpec->encodeContext = (ss->sec.isServer) ? serverContext : clientContext; + pwSpec->decodeContext = (ss->sec.isServer) ? clientContext : serverContext; + + serverContext = NULL; + clientContext = NULL; + + ssl3_InitCompressionContext(pwSpec); + + return SECSuccess; + +fail: + if (serverContext != NULL) + PK11_DestroyContext(serverContext, PR_TRUE); + if (pwSpec->client.write_mac_context != NULL) { + PK11_DestroyContext(pwSpec->client.write_mac_context, PR_TRUE); + pwSpec->client.write_mac_context = NULL; + } + if (pwSpec->server.write_mac_context != NULL) { + PK11_DestroyContext(pwSpec->server.write_mac_context, PR_TRUE); + pwSpec->server.write_mac_context = NULL; + } + + return SECFailure; +} + +HASH_HashType +ssl3_GetTls12HashType(sslSocket *ss) +{ + if (ss->ssl3.pwSpec->version < SSL_LIBRARY_VERSION_TLS_1_2) { + return HASH_AlgNULL; + } + + switch (ss->ssl3.hs.suite_def->prf_hash) { + case ssl_hash_sha384: + return HASH_AlgSHA384; + case ssl_hash_sha256: + case ssl_hash_none: + /* ssl_hash_none is for pre-1.2 suites, which use SHA-256. */ + return HASH_AlgSHA256; + default: + PORT_Assert(0); + } + return HASH_AlgSHA256; +} + +/* Complete the initialization of all keys, ciphers, MACs and their contexts + * for the pending Cipher Spec. + * Called from: ssl3_SendClientKeyExchange (for Full handshake) + * ssl3_HandleRSAClientKeyExchange (for Full handshake) + * ssl3_HandleServerHello (for session restart) + * ssl3_HandleClientHello (for session restart) + * Sets error code, but caller probably should override to disambiguate. + * NULL pms means re-use old master_secret. + * + * If the old master secret is reused, pms is NULL and the master secret is + * already in pwSpec->master_secret. + */ +SECStatus +ssl3_InitPendingCipherSpec(sslSocket *ss, PK11SymKey *pms) +{ + ssl3CipherSpec *pwSpec; + ssl3CipherSpec *cwSpec; + SECStatus rv; + + PORT_Assert(ss->opt.noLocks || ssl_HaveSSL3HandshakeLock(ss)); + + ssl_GetSpecWriteLock(ss); /**************************************/ + + PORT_Assert(ss->ssl3.prSpec == ss->ssl3.pwSpec); + + pwSpec = ss->ssl3.pwSpec; + cwSpec = ss->ssl3.cwSpec; + + if (pms || (!pwSpec->msItem.len && !pwSpec->master_secret)) { + rv = ssl3_DeriveMasterSecret(ss, pms); + if (rv != SECSuccess) { + goto done; /* err code set by ssl3_DeriveMasterSecret */ + } + } + if (pwSpec->master_secret) { + rv = ssl3_DeriveConnectionKeys(ss); + if (rv == SECSuccess) { + rv = ssl3_InitPendingContexts(ss); + } + } else { + PORT_Assert(pwSpec->master_secret); + PORT_SetError(SEC_ERROR_LIBRARY_FAILURE); + rv = SECFailure; + } + if (rv != SECSuccess) { + goto done; + } + + /* Generic behaviors -- common to all crypto methods */ + if (!IS_DTLS(ss)) { + pwSpec->read_seq_num = pwSpec->write_seq_num = 0; + } else { + if (cwSpec->epoch == PR_UINT16_MAX) { + /* The problem here is that we have rehandshaked too many + * times (you are not allowed to wrap the epoch). The + * spec says you should be discarding the connection + * and start over, so not much we can do here. */ + PORT_SetError(SEC_ERROR_LIBRARY_FAILURE); + rv = SECFailure; + goto done; + } + /* The sequence number has the high 16 bits as the epoch. */ + pwSpec->epoch = cwSpec->epoch + 1; + pwSpec->read_seq_num = pwSpec->write_seq_num = + (sslSequenceNumber)pwSpec->epoch << 48; + + dtls_InitRecvdRecords(&pwSpec->recvdRecords); + } + +done: + ssl_ReleaseSpecWriteLock(ss); /******************************/ + if (rv != SECSuccess) + ssl_MapLowLevelError(SSL_ERROR_SESSION_KEY_GEN_FAILURE); + return rv; +} + +/* + * 60 bytes is 3 times the maximum length MAC size that is supported. + */ +static const unsigned char mac_pad_1[60] = { + 0x36, 0x36, 0x36, 0x36, 0x36, 0x36, 0x36, 0x36, + 0x36, 0x36, 0x36, 0x36, 0x36, 0x36, 0x36, 0x36, + 0x36, 0x36, 0x36, 0x36, 0x36, 0x36, 0x36, 0x36, + 0x36, 0x36, 0x36, 0x36, 0x36, 0x36, 0x36, 0x36, + 0x36, 0x36, 0x36, 0x36, 0x36, 0x36, 0x36, 0x36, + 0x36, 0x36, 0x36, 0x36, 0x36, 0x36, 0x36, 0x36, + 0x36, 0x36, 0x36, 0x36, 0x36, 0x36, 0x36, 0x36, + 0x36, 0x36, 0x36, 0x36 +}; +static const unsigned char mac_pad_2[60] = { + 0x5c, 0x5c, 0x5c, 0x5c, 0x5c, 0x5c, 0x5c, 0x5c, + 0x5c, 0x5c, 0x5c, 0x5c, 0x5c, 0x5c, 0x5c, 0x5c, + 0x5c, 0x5c, 0x5c, 0x5c, 0x5c, 0x5c, 0x5c, 0x5c, + 0x5c, 0x5c, 0x5c, 0x5c, 0x5c, 0x5c, 0x5c, 0x5c, + 0x5c, 0x5c, 0x5c, 0x5c, 0x5c, 0x5c, 0x5c, 0x5c, + 0x5c, 0x5c, 0x5c, 0x5c, 0x5c, 0x5c, 0x5c, 0x5c, + 0x5c, 0x5c, 0x5c, 0x5c, 0x5c, 0x5c, 0x5c, 0x5c, + 0x5c, 0x5c, 0x5c, 0x5c +}; + +/* Called from: ssl3_SendRecord() +** Caller must already hold the SpecReadLock. (wish we could assert that!) +*/ +static SECStatus +ssl3_ComputeRecordMAC( + ssl3CipherSpec *spec, + PRBool useServerMacKey, + const unsigned char *header, + unsigned int headerLen, + const SSL3Opaque *input, + int inputLength, + unsigned char *outbuf, + unsigned int *outLength) +{ + const ssl3MACDef *mac_def; + SECStatus rv; + + PRINT_BUF(95, (NULL, "frag hash1: header", header, headerLen)); + PRINT_BUF(95, (NULL, "frag hash1: input", input, inputLength)); + + mac_def = spec->mac_def; + if (mac_def->mac == mac_null) { + *outLength = 0; + return SECSuccess; + } + + PK11Context *mac_context = + (useServerMacKey ? spec->server.write_mac_context + : spec->client.write_mac_context); + rv = PK11_DigestBegin(mac_context); + rv |= PK11_DigestOp(mac_context, header, headerLen); + rv |= PK11_DigestOp(mac_context, input, inputLength); + rv |= PK11_DigestFinal(mac_context, outbuf, outLength, spec->mac_size); + PORT_Assert(rv != SECSuccess || *outLength == (unsigned)spec->mac_size); + + PRINT_BUF(95, (NULL, "frag hash2: result", outbuf, *outLength)); + + if (rv != SECSuccess) { + rv = SECFailure; + ssl_MapLowLevelError(SSL_ERROR_MAC_COMPUTATION_FAILURE); + } + return rv; +} + +/* Called from: ssl3_HandleRecord() + * Caller must already hold the SpecReadLock. (wish we could assert that!) + * + * On entry: + * originalLen >= inputLen >= MAC size +*/ +static SECStatus +ssl3_ComputeRecordMACConstantTime( + ssl3CipherSpec *spec, + PRBool useServerMacKey, + const unsigned char *header, + unsigned int headerLen, + const SSL3Opaque *input, + int inputLen, + int originalLen, + unsigned char *outbuf, + unsigned int *outLen) +{ + CK_MECHANISM_TYPE macType; + CK_NSS_MAC_CONSTANT_TIME_PARAMS params; + SECItem param, inputItem, outputItem; + SECStatus rv; + PK11SymKey *key; + + PORT_Assert(inputLen >= spec->mac_size); + PORT_Assert(originalLen >= inputLen); + + if (spec->mac_def->mac == mac_null) { + *outLen = 0; + return SECSuccess; + } + + macType = CKM_NSS_HMAC_CONSTANT_TIME; + if (spec->version == SSL_LIBRARY_VERSION_3_0) { + macType = CKM_NSS_SSL3_MAC_CONSTANT_TIME; + } + + params.macAlg = spec->mac_def->mmech; + params.ulBodyTotalLen = originalLen; + params.pHeader = (unsigned char *)header; /* const cast */ + params.ulHeaderLen = headerLen; + + param.data = (unsigned char *)¶ms; + param.len = sizeof(params); + param.type = 0; + + inputItem.data = (unsigned char *)input; + inputItem.len = inputLen; + inputItem.type = 0; + + outputItem.data = outbuf; + outputItem.len = *outLen; + outputItem.type = 0; + + key = spec->server.write_mac_key; + if (!useServerMacKey) { + key = spec->client.write_mac_key; + } + + rv = PK11_SignWithSymKey(key, macType, ¶m, &outputItem, &inputItem); + if (rv != SECSuccess) { + if (PORT_GetError() == SEC_ERROR_INVALID_ALGORITHM) { + /* ssl3_ComputeRecordMAC() expects the MAC to have been removed + * from the input length already. */ + return ssl3_ComputeRecordMAC(spec, useServerMacKey, + header, headerLen, + input, inputLen - spec->mac_size, + outbuf, outLen); + } + + *outLen = 0; + rv = SECFailure; + ssl_MapLowLevelError(SSL_ERROR_MAC_COMPUTATION_FAILURE); + return rv; + } + + PORT_Assert(outputItem.len == (unsigned)spec->mac_size); + *outLen = outputItem.len; + + return rv; +} + +static PRBool +ssl3_ClientAuthTokenPresent(sslSessionID *sid) +{ + PK11SlotInfo *slot = NULL; + PRBool isPresent = PR_TRUE; + + /* we only care if we are doing client auth */ + if (!sid || !sid->u.ssl3.clAuthValid) { + return PR_TRUE; + } + + /* get the slot */ + slot = SECMOD_LookupSlot(sid->u.ssl3.clAuthModuleID, + sid->u.ssl3.clAuthSlotID); + if (slot == NULL || + !PK11_IsPresent(slot) || + sid->u.ssl3.clAuthSeries != PK11_GetSlotSeries(slot) || + sid->u.ssl3.clAuthSlotID != PK11_GetSlotID(slot) || + sid->u.ssl3.clAuthModuleID != PK11_GetModuleID(slot) || + (PK11_NeedLogin(slot) && !PK11_IsLoggedIn(slot, NULL))) { + isPresent = PR_FALSE; + } + if (slot) { + PK11_FreeSlot(slot); + } + return isPresent; +} + +/* Caller must hold the spec read lock. */ +SECStatus +ssl3_CompressMACEncryptRecord(ssl3CipherSpec *cwSpec, + PRBool isServer, + PRBool isDTLS, + PRBool capRecordVersion, + SSL3ContentType type, + const SSL3Opaque *pIn, + PRUint32 contentLen, + sslBuffer *wrBuf) +{ + const ssl3BulkCipherDef *cipher_def; + SECStatus rv; + PRUint32 macLen = 0; + PRUint32 fragLen; + PRUint32 p1Len, p2Len, oddLen = 0; + unsigned int ivLen = 0; + unsigned char pseudoHeader[13]; + unsigned int pseudoHeaderLen; + + cipher_def = cwSpec->cipher_def; + + if (cipher_def->type == type_block && + cwSpec->version >= SSL_LIBRARY_VERSION_TLS_1_1) { + /* Prepend the per-record explicit IV using technique 2b from + * RFC 4346 section 6.2.3.2: The IV is a cryptographically + * strong random number XORed with the CBC residue from the previous + * record. + */ + ivLen = cipher_def->iv_size; + if (ivLen > wrBuf->space) { + PORT_SetError(SEC_ERROR_LIBRARY_FAILURE); + return SECFailure; + } + rv = PK11_GenerateRandom(wrBuf->buf, ivLen); + if (rv != SECSuccess) { + ssl_MapLowLevelError(SSL_ERROR_GENERATE_RANDOM_FAILURE); + return rv; + } + rv = cwSpec->encode(cwSpec->encodeContext, + wrBuf->buf, /* output */ + (int *)&wrBuf->len, /* outlen */ + ivLen, /* max outlen */ + wrBuf->buf, /* input */ + ivLen); /* input len */ + if (rv != SECSuccess || wrBuf->len != ivLen) { + PORT_SetError(SSL_ERROR_ENCRYPTION_FAILURE); + return SECFailure; + } + } + + if (cwSpec->compressor) { + int outlen; + rv = cwSpec->compressor(cwSpec->compressContext, wrBuf->buf + ivLen, + &outlen, wrBuf->space - ivLen, pIn, contentLen); + if (rv != SECSuccess) + return rv; + pIn = wrBuf->buf + ivLen; + contentLen = outlen; + } + + pseudoHeaderLen = ssl3_BuildRecordPseudoHeader( + pseudoHeader, cwSpec->write_seq_num, type, + cwSpec->version >= SSL_LIBRARY_VERSION_TLS_1_0, cwSpec->version, + isDTLS, contentLen); + PORT_Assert(pseudoHeaderLen <= sizeof(pseudoHeader)); + if (cipher_def->type == type_aead) { + const int nonceLen = cipher_def->explicit_nonce_size; + const int tagLen = cipher_def->tag_size; + + if (nonceLen + contentLen + tagLen > wrBuf->space) { + PORT_SetError(SEC_ERROR_LIBRARY_FAILURE); + return SECFailure; + } + + rv = cwSpec->aead( + isServer ? &cwSpec->server : &cwSpec->client, + PR_FALSE, /* do encrypt */ + wrBuf->buf, /* output */ + (int *)&wrBuf->len, /* out len */ + wrBuf->space, /* max out */ + pIn, contentLen, /* input */ + pseudoHeader, pseudoHeaderLen); + if (rv != SECSuccess) { + PORT_SetError(SSL_ERROR_ENCRYPTION_FAILURE); + return SECFailure; + } + } else { + /* + * Add the MAC + */ + rv = ssl3_ComputeRecordMAC(cwSpec, isServer, pseudoHeader, + pseudoHeaderLen, pIn, contentLen, + wrBuf->buf + ivLen + contentLen, &macLen); + if (rv != SECSuccess) { + ssl_MapLowLevelError(SSL_ERROR_MAC_COMPUTATION_FAILURE); + return SECFailure; + } + p1Len = contentLen; + p2Len = macLen; + fragLen = contentLen + macLen; /* needs to be encrypted */ + PORT_Assert(fragLen <= MAX_FRAGMENT_LENGTH + 1024); + + /* + * Pad the text (if we're doing a block cipher) + * then Encrypt it + */ + if (cipher_def->type == type_block) { + unsigned char *pBuf; + int padding_length; + int i; + + oddLen = contentLen % cipher_def->block_size; + /* Assume blockSize is a power of two */ + padding_length = cipher_def->block_size - 1 - ((fragLen) & (cipher_def->block_size - 1)); + fragLen += padding_length + 1; + PORT_Assert((fragLen % cipher_def->block_size) == 0); + + /* Pad according to TLS rules (also acceptable to SSL3). */ + pBuf = &wrBuf->buf[ivLen + fragLen - 1]; + for (i = padding_length + 1; i > 0; --i) { + *pBuf-- = padding_length; + } + /* now, if contentLen is not a multiple of block size, fix it */ + p2Len = fragLen - p1Len; + } + if (p1Len < 256) { + oddLen = p1Len; + p1Len = 0; + } else { + p1Len -= oddLen; + } + if (oddLen) { + p2Len += oddLen; + PORT_Assert((cipher_def->block_size < 2) || + (p2Len % cipher_def->block_size) == 0); + memmove(wrBuf->buf + ivLen + p1Len, pIn + p1Len, oddLen); + } + if (p1Len > 0) { + int cipherBytesPart1 = -1; + rv = cwSpec->encode(cwSpec->encodeContext, + wrBuf->buf + ivLen, /* output */ + &cipherBytesPart1, /* actual outlen */ + p1Len, /* max outlen */ + pIn, + p1Len); /* input, and inputlen */ + PORT_Assert(rv == SECSuccess && cipherBytesPart1 == (int)p1Len); + if (rv != SECSuccess || cipherBytesPart1 != (int)p1Len) { + PORT_SetError(SSL_ERROR_ENCRYPTION_FAILURE); + return SECFailure; + } + wrBuf->len += cipherBytesPart1; + } + if (p2Len > 0) { + int cipherBytesPart2 = -1; + rv = cwSpec->encode(cwSpec->encodeContext, + wrBuf->buf + ivLen + p1Len, + &cipherBytesPart2, /* output and actual outLen */ + p2Len, /* max outlen */ + wrBuf->buf + ivLen + p1Len, + p2Len); /* input and inputLen*/ + PORT_Assert(rv == SECSuccess && cipherBytesPart2 == (int)p2Len); + if (rv != SECSuccess || cipherBytesPart2 != (int)p2Len) { + PORT_SetError(SSL_ERROR_ENCRYPTION_FAILURE); + return SECFailure; + } + wrBuf->len += cipherBytesPart2; + } + } + + return SECSuccess; +} + +SECStatus +ssl_ProtectRecord(sslSocket *ss, ssl3CipherSpec *cwSpec, + PRBool capRecordVersion, SSL3ContentType type, + const SSL3Opaque *pIn, PRUint32 contentLen, sslBuffer *wrBuf) +{ + const ssl3BulkCipherDef *cipher_def = cwSpec->cipher_def; + PRUint16 headerLen; + sslBuffer protBuf; + SSL3ProtocolVersion version = cwSpec->version; + PRBool isTLS13; + PRUint8 *ptr = wrBuf->buf; + SECStatus rv; + + if (ss->ssl3.hs.shortHeaders) { + PORT_Assert(!IS_DTLS(ss)); + PORT_Assert(ss->version >= SSL_LIBRARY_VERSION_TLS_1_3); + headerLen = TLS13_RECORD_HEADER_LENGTH_SHORT; + } else { + headerLen = IS_DTLS(ss) ? DTLS_RECORD_HEADER_LENGTH : SSL3_RECORD_HEADER_LENGTH; + } + protBuf.buf = wrBuf->buf + headerLen; + protBuf.len = 0; + protBuf.space = wrBuf->space - headerLen; + + PORT_Assert(cipher_def->max_records <= RECORD_SEQ_MAX); + if ((cwSpec->write_seq_num & RECORD_SEQ_MAX) >= cipher_def->max_records) { + SSL_TRC(3, ("%d: SSL[-]: write sequence number at limit 0x%0llx", + SSL_GETPID(), cwSpec->write_seq_num)); + PORT_SetError(SSL_ERROR_TOO_MANY_RECORDS); + return SECFailure; + } + + isTLS13 = (PRBool)(cwSpec->version >= SSL_LIBRARY_VERSION_TLS_1_3); + +#ifdef UNSAFE_FUZZER_MODE + rv = Null_Cipher(NULL, protBuf.buf, (int *)&protBuf.len, protBuf.space, + pIn, contentLen); +#else + if (isTLS13) { + rv = tls13_ProtectRecord(ss, cwSpec, type, pIn, contentLen, &protBuf); + } else { + rv = ssl3_CompressMACEncryptRecord(cwSpec, ss->sec.isServer, + IS_DTLS(ss), capRecordVersion, type, + pIn, contentLen, &protBuf); + } +#endif + if (rv != SECSuccess) { + return SECFailure; /* error was set */ + } + + PORT_Assert(protBuf.len <= MAX_FRAGMENT_LENGTH + (isTLS13 ? 256 : 1024)); + wrBuf->len = protBuf.len + headerLen; + + if (ss->ssl3.hs.shortHeaders) { + PORT_Assert(!IS_DTLS(ss)); /* Decoder not yet implemented. */ + (void)ssl_EncodeUintX(0x8000 | protBuf.len, 2, ptr); + } else { +#ifndef UNSAFE_FUZZER_MODE + if (isTLS13 && cipher_def->calg != ssl_calg_null) { + *ptr++ = content_application_data; + } else +#endif + { + *ptr++ = type; + } + + if (IS_DTLS(ss)) { + version = isTLS13 ? SSL_LIBRARY_VERSION_TLS_1_1 : version; + version = dtls_TLSVersionToDTLSVersion(version); + + ptr = ssl_EncodeUintX(version, 2, ptr); + ptr = ssl_EncodeUintX(cwSpec->write_seq_num, 8, ptr); + } else { + if (capRecordVersion || isTLS13) { + version = PR_MIN(SSL_LIBRARY_VERSION_TLS_1_0, version); + } + ptr = ssl_EncodeUintX(version, 2, ptr); + } + (void)ssl_EncodeUintX(protBuf.len, 2, ptr); + } + ++cwSpec->write_seq_num; + + return SECSuccess; +} + +/* Process the plain text before sending it. + * Returns the number of bytes of plaintext that were successfully sent + * plus the number of bytes of plaintext that were copied into the + * output (write) buffer. + * Returns SECFailure on a hard IO error, memory error, or crypto error. + * Does NOT return SECWouldBlock. + * + * Notes on the use of the private ssl flags: + * (no private SSL flags) + * Attempt to make and send SSL records for all plaintext + * If non-blocking and a send gets WOULD_BLOCK, + * or if the pending (ciphertext) buffer is not empty, + * then buffer remaining bytes of ciphertext into pending buf, + * and continue to do that for all succssive records until all + * bytes are used. + * ssl_SEND_FLAG_FORCE_INTO_BUFFER + * As above, except this suppresses all write attempts, and forces + * all ciphertext into the pending ciphertext buffer. + * ssl_SEND_FLAG_USE_EPOCH (for DTLS) + * Forces the use of the provided epoch + * ssl_SEND_FLAG_CAP_RECORD_VERSION + * Caps the record layer version number of TLS ClientHello to { 3, 1 } + * (TLS 1.0). Some TLS 1.0 servers (which seem to use F5 BIG-IP) ignore + * ClientHello.client_version and use the record layer version number + * (TLSPlaintext.version) instead when negotiating protocol versions. In + * addition, if the record layer version number of ClientHello is { 3, 2 } + * (TLS 1.1) or higher, these servers reset the TCP connections. Lastly, + * some F5 BIG-IP servers hang if a record containing a ClientHello has a + * version greater than { 3, 1 } and a length greater than 255. Set this + * flag to work around such servers. + */ +PRInt32 +ssl3_SendRecord(sslSocket *ss, + ssl3CipherSpec *cwSpec, /* non-NULL for DTLS retransmits */ + SSL3ContentType type, + const SSL3Opaque *pIn, /* input buffer */ + PRInt32 nIn, /* bytes of input */ + PRInt32 flags) +{ + sslBuffer *wrBuf = &ss->sec.writeBuf; + SECStatus rv; + PRInt32 totalSent = 0; + PRBool capRecordVersion; + + SSL_TRC(3, ("%d: SSL3[%d] SendRecord type: %s nIn=%d", + SSL_GETPID(), ss->fd, ssl3_DecodeContentType(type), + nIn)); + PRINT_BUF(50, (ss, "Send record (plain text)", pIn, nIn)); + + PORT_Assert(ss->opt.noLocks || ssl_HaveXmitBufLock(ss)); + + if (ss->ssl3.fatalAlertSent) { + SSL_TRC(3, ("%d: SSL3[%d] Suppress write, fatal alert already sent", + SSL_GETPID(), ss->fd)); + return SECFailure; + } + + capRecordVersion = ((flags & ssl_SEND_FLAG_CAP_RECORD_VERSION) != 0); + + if (capRecordVersion) { + /* ssl_SEND_FLAG_CAP_RECORD_VERSION can only be used with the + * TLS initial ClientHello. */ + PORT_Assert(!IS_DTLS(ss)); + PORT_Assert(!ss->firstHsDone); + PORT_Assert(type == content_handshake); + PORT_Assert(ss->ssl3.hs.ws == wait_server_hello); + } + + if (ss->ssl3.initialized == PR_FALSE) { + /* This can happen on a server if the very first incoming record + ** looks like a defective ssl3 record (e.g. too long), and we're + ** trying to send an alert. + */ + PR_ASSERT(type == content_alert); + rv = ssl3_InitState(ss); + if (rv != SECSuccess) { + return SECFailure; /* ssl3_InitState has set the error code. */ + } + } + + /* check for Token Presence */ + if (!ssl3_ClientAuthTokenPresent(ss->sec.ci.sid)) { + PORT_SetError(SSL_ERROR_TOKEN_INSERTION_REMOVAL); + return SECFailure; + } + + while (nIn > 0) { + PRUint32 contentLen = PR_MIN(nIn, MAX_FRAGMENT_LENGTH); + unsigned int spaceNeeded; + unsigned int numRecords; + + ssl_GetSpecReadLock(ss); /********************************/ + + if (nIn > 1 && ss->opt.cbcRandomIV && + ss->ssl3.cwSpec->version < SSL_LIBRARY_VERSION_TLS_1_1 && + type == content_application_data && + ss->ssl3.cwSpec->cipher_def->type == type_block /* CBC mode */) { + /* We will split the first byte of the record into its own record, + * as explained in the documentation for SSL_CBC_RANDOM_IV in ssl.h + */ + numRecords = 2; + } else { + numRecords = 1; + } + + spaceNeeded = contentLen + (numRecords * SSL3_BUFFER_FUDGE); + if (ss->ssl3.cwSpec->version >= SSL_LIBRARY_VERSION_TLS_1_1 && + ss->ssl3.cwSpec->cipher_def->type == type_block) { + spaceNeeded += ss->ssl3.cwSpec->cipher_def->iv_size; + } + if (spaceNeeded > wrBuf->space) { + rv = sslBuffer_Grow(wrBuf, spaceNeeded); + if (rv != SECSuccess) { + SSL_DBG(("%d: SSL3[%d]: SendRecord, tried to get %d bytes", + SSL_GETPID(), ss->fd, spaceNeeded)); + goto spec_locked_loser; /* sslBuffer_Grow set error code. */ + } + } + + if (numRecords == 2) { + sslBuffer secondRecord; + rv = ssl_ProtectRecord(ss, ss->ssl3.cwSpec, capRecordVersion, type, + pIn, 1, wrBuf); + if (rv != SECSuccess) + goto spec_locked_loser; + + PRINT_BUF(50, (ss, "send (encrypted) record data [1/2]:", + wrBuf->buf, wrBuf->len)); + + secondRecord.buf = wrBuf->buf + wrBuf->len; + secondRecord.len = 0; + secondRecord.space = wrBuf->space - wrBuf->len; + + rv = ssl_ProtectRecord(ss, ss->ssl3.cwSpec, capRecordVersion, type, + pIn + 1, contentLen - 1, &secondRecord); + if (rv == SECSuccess) { + PRINT_BUF(50, (ss, "send (encrypted) record data [2/2]:", + secondRecord.buf, secondRecord.len)); + wrBuf->len += secondRecord.len; + } + } else { + if (cwSpec) { + /* cwSpec can only be set for retransmissions of DTLS handshake + * messages. */ + PORT_Assert(IS_DTLS(ss) && + (type == content_handshake || + type == content_change_cipher_spec)); + } else { + cwSpec = ss->ssl3.cwSpec; + } + + rv = ssl_ProtectRecord(ss, cwSpec, !IS_DTLS(ss) && capRecordVersion, + type, pIn, contentLen, wrBuf); + if (rv == SECSuccess) { + PRINT_BUF(50, (ss, "send (encrypted) record data:", + wrBuf->buf, wrBuf->len)); + } + } + + spec_locked_loser: + ssl_ReleaseSpecReadLock(ss); /************************************/ + + if (rv != SECSuccess) + return SECFailure; + + pIn += contentLen; + nIn -= contentLen; + PORT_Assert(nIn >= 0); + + /* If there's still some previously saved ciphertext, + * or the caller doesn't want us to send the data yet, + * then add all our new ciphertext to the amount previously saved. + */ + if ((ss->pendingBuf.len > 0) || + (flags & ssl_SEND_FLAG_FORCE_INTO_BUFFER)) { + + rv = ssl_SaveWriteData(ss, wrBuf->buf, wrBuf->len); + if (rv != SECSuccess) { + /* presumably a memory error, SEC_ERROR_NO_MEMORY */ + return SECFailure; + } + wrBuf->len = 0; /* All cipher text is saved away. */ + + if (!(flags & ssl_SEND_FLAG_FORCE_INTO_BUFFER)) { + PRInt32 sent; + ss->handshakeBegun = 1; + sent = ssl_SendSavedWriteData(ss); + if (sent < 0 && PR_GetError() != PR_WOULD_BLOCK_ERROR) { + ssl_MapLowLevelError(SSL_ERROR_SOCKET_WRITE_FAILURE); + return SECFailure; + } + if (ss->pendingBuf.len) { + flags |= ssl_SEND_FLAG_FORCE_INTO_BUFFER; + } + } + } else if (wrBuf->len > 0) { + PRInt32 sent; + ss->handshakeBegun = 1; + sent = ssl_DefSend(ss, wrBuf->buf, wrBuf->len, + flags & ~ssl_SEND_FLAG_MASK); + if (sent < 0) { + if (PR_GetError() != PR_WOULD_BLOCK_ERROR) { + ssl_MapLowLevelError(SSL_ERROR_SOCKET_WRITE_FAILURE); + return SECFailure; + } + /* we got PR_WOULD_BLOCK_ERROR, which means none was sent. */ + sent = 0; + } + wrBuf->len -= sent; + if (wrBuf->len) { + if (IS_DTLS(ss)) { + /* DTLS just says no in this case. No buffering */ + PR_SetError(PR_WOULD_BLOCK_ERROR, 0); + return SECFailure; + } + /* now take all the remaining unsent new ciphertext and + * append it to the buffer of previously unsent ciphertext. + */ + rv = ssl_SaveWriteData(ss, wrBuf->buf + sent, wrBuf->len); + if (rv != SECSuccess) { + /* presumably a memory error, SEC_ERROR_NO_MEMORY */ + return SECFailure; + } + } + } + totalSent += contentLen; + } + return totalSent; +} + +#define SSL3_PENDING_HIGH_WATER 1024 + +/* Attempt to send the content of "in" in an SSL application_data record. + * Returns "len" or SECFailure, never SECWouldBlock, nor SECSuccess. + */ +int +ssl3_SendApplicationData(sslSocket *ss, const unsigned char *in, + PRInt32 len, PRInt32 flags) +{ + PRInt32 totalSent = 0; + PRInt32 discarded = 0; + + PORT_Assert(ss->opt.noLocks || ssl_HaveXmitBufLock(ss)); + /* These flags for internal use only */ + PORT_Assert(!(flags & ssl_SEND_FLAG_NO_RETRANSMIT)); + if (len < 0 || !in) { + PORT_SetError(PR_INVALID_ARGUMENT_ERROR); + return SECFailure; + } + + if (ss->pendingBuf.len > SSL3_PENDING_HIGH_WATER && + !ssl_SocketIsBlocking(ss)) { + PORT_Assert(!ssl_SocketIsBlocking(ss)); + PORT_SetError(PR_WOULD_BLOCK_ERROR); + return SECFailure; + } + + if (ss->appDataBuffered && len) { + PORT_Assert(in[0] == (unsigned char)(ss->appDataBuffered)); + if (in[0] != (unsigned char)(ss->appDataBuffered)) { + PORT_SetError(PR_INVALID_ARGUMENT_ERROR); + return SECFailure; + } + in++; + len--; + discarded = 1; + } + while (len > totalSent) { + PRInt32 sent, toSend; + + if (totalSent > 0) { + /* + * The thread yield is intended to give the reader thread a + * chance to get some cycles while the writer thread is in + * the middle of a large application data write. (See + * Bugzilla bug 127740, comment #1.) + */ + ssl_ReleaseXmitBufLock(ss); + PR_Sleep(PR_INTERVAL_NO_WAIT); /* PR_Yield(); */ + ssl_GetXmitBufLock(ss); + } + toSend = PR_MIN(len - totalSent, MAX_FRAGMENT_LENGTH); + /* + * Note that the 0 epoch is OK because flags will never require + * its use, as guaranteed by the PORT_Assert above. + */ + sent = ssl3_SendRecord(ss, NULL, content_application_data, + in + totalSent, toSend, flags); + if (sent < 0) { + if (totalSent > 0 && PR_GetError() == PR_WOULD_BLOCK_ERROR) { + PORT_Assert(ss->lastWriteBlocked); + break; + } + return SECFailure; /* error code set by ssl3_SendRecord */ + } + totalSent += sent; + if (ss->pendingBuf.len) { + /* must be a non-blocking socket */ + PORT_Assert(!ssl_SocketIsBlocking(ss)); + PORT_Assert(ss->lastWriteBlocked); + break; + } + } + if (ss->pendingBuf.len) { + /* Must be non-blocking. */ + PORT_Assert(!ssl_SocketIsBlocking(ss)); + if (totalSent > 0) { + ss->appDataBuffered = 0x100 | in[totalSent - 1]; + } + + totalSent = totalSent + discarded - 1; + if (totalSent <= 0) { + PORT_SetError(PR_WOULD_BLOCK_ERROR); + totalSent = SECFailure; + } + return totalSent; + } + ss->appDataBuffered = 0; + return totalSent + discarded; +} + +/* Attempt to send buffered handshake messages. + * This function returns SECSuccess or SECFailure, never SECWouldBlock. + * Always set sendBuf.len to 0, even when returning SECFailure. + * + * Depending on whether we are doing DTLS or not, this either calls + * + * - ssl3_FlushHandshakeMessages if non-DTLS + * - dtls_FlushHandshakeMessages if DTLS + * + * Called from SSL3_SendAlert(), ssl3_SendChangeCipherSpecs(), + * ssl3_AppendHandshake(), ssl3_SendClientHello(), + * ssl3_SendHelloRequest(), ssl3_SendServerHelloDone(), + * ssl3_SendFinished(), + */ +SECStatus +ssl3_FlushHandshake(sslSocket *ss, PRInt32 flags) +{ + if (IS_DTLS(ss)) { + return dtls_FlushHandshakeMessages(ss, flags); + } else { + return ssl3_FlushHandshakeMessages(ss, flags); + } +} + +/* Attempt to send the content of sendBuf buffer in an SSL handshake record. + * This function returns SECSuccess or SECFailure, never SECWouldBlock. + * Always set sendBuf.len to 0, even when returning SECFailure. + * + * Called from ssl3_FlushHandshake + */ +static SECStatus +ssl3_FlushHandshakeMessages(sslSocket *ss, PRInt32 flags) +{ + static const PRInt32 allowedFlags = ssl_SEND_FLAG_FORCE_INTO_BUFFER | + ssl_SEND_FLAG_CAP_RECORD_VERSION; + PRInt32 count = -1; + SECStatus rv; + + PORT_Assert(ss->opt.noLocks || ssl_HaveSSL3HandshakeLock(ss)); + PORT_Assert(ss->opt.noLocks || ssl_HaveXmitBufLock(ss)); + + if (!ss->sec.ci.sendBuf.buf || !ss->sec.ci.sendBuf.len) + return SECSuccess; + + /* only these flags are allowed */ + PORT_Assert(!(flags & ~allowedFlags)); + if ((flags & ~allowedFlags) != 0) { + PORT_SetError(SEC_ERROR_INVALID_ARGS); + return SECFailure; + } + count = ssl3_SendRecord(ss, NULL, content_handshake, + ss->sec.ci.sendBuf.buf, + ss->sec.ci.sendBuf.len, flags); + if (count < 0) { + int err = PORT_GetError(); + PORT_Assert(err != PR_WOULD_BLOCK_ERROR); + if (err == PR_WOULD_BLOCK_ERROR) { + PORT_SetError(SEC_ERROR_LIBRARY_FAILURE); + } + rv = SECFailure; + } else if ((unsigned int)count < ss->sec.ci.sendBuf.len) { + /* short write should never happen */ + PORT_Assert((unsigned int)count >= ss->sec.ci.sendBuf.len); + PORT_SetError(SEC_ERROR_LIBRARY_FAILURE); + rv = SECFailure; + } else { + rv = SECSuccess; + } + + /* Whether we succeeded or failed, toss the old handshake data. */ + ss->sec.ci.sendBuf.len = 0; + return rv; +} + +/* + * Called from ssl3_HandleAlert and from ssl3_HandleCertificate when + * the remote client sends a negative response to our certificate request. + * Returns SECFailure if the application has required client auth. + * SECSuccess otherwise. + */ +SECStatus +ssl3_HandleNoCertificate(sslSocket *ss) +{ + ssl3_CleanupPeerCerts(ss); + + /* If the server has required client-auth blindly but doesn't + * actually look at the certificate it won't know that no + * certificate was presented so we shutdown the socket to ensure + * an error. We only do this if we haven't already completed the + * first handshake because if we're redoing the handshake we + * know the server is paying attention to the certificate. + */ + if ((ss->opt.requireCertificate == SSL_REQUIRE_ALWAYS) || + (!ss->firstHsDone && + (ss->opt.requireCertificate == SSL_REQUIRE_FIRST_HANDSHAKE))) { + PRFileDesc *lower; + + ss->sec.uncache(ss->sec.ci.sid); + SSL3_SendAlert(ss, alert_fatal, bad_certificate); + + lower = ss->fd->lower; +#ifdef _WIN32 + lower->methods->shutdown(lower, PR_SHUTDOWN_SEND); +#else + lower->methods->shutdown(lower, PR_SHUTDOWN_BOTH); +#endif + PORT_SetError(SSL_ERROR_NO_CERTIFICATE); + return SECFailure; + } + return SECSuccess; +} + +/************************************************************************ + * Alerts + */ + +/* +** Acquires both handshake and XmitBuf locks. +** Called from: ssl3_IllegalParameter <- +** ssl3_HandshakeFailure <- +** ssl3_HandleAlert <- ssl3_HandleRecord. +** ssl3_HandleChangeCipherSpecs <- ssl3_HandleRecord +** ssl3_ConsumeHandshakeVariable <- +** ssl3_HandleHelloRequest <- +** ssl3_HandleServerHello <- +** ssl3_HandleServerKeyExchange <- +** ssl3_HandleCertificateRequest <- +** ssl3_HandleServerHelloDone <- +** ssl3_HandleClientHello <- +** ssl3_HandleV2ClientHello <- +** ssl3_HandleCertificateVerify <- +** ssl3_HandleClientKeyExchange <- +** ssl3_HandleCertificate <- +** ssl3_HandleFinished <- +** ssl3_HandleHandshakeMessage <- +** ssl3_HandlePostHelloHandshakeMessage <- +** ssl3_HandleRecord <- +** +*/ +SECStatus +SSL3_SendAlert(sslSocket *ss, SSL3AlertLevel level, SSL3AlertDescription desc) +{ + PRUint8 bytes[2]; + SECStatus rv; + + SSL_TRC(3, ("%d: SSL3[%d]: send alert record, level=%d desc=%d", + SSL_GETPID(), ss->fd, level, desc)); + + bytes[0] = level; + bytes[1] = desc; + + ssl_GetSSL3HandshakeLock(ss); + if (level == alert_fatal) { + if (!ss->opt.noCache && ss->sec.ci.sid) { + ss->sec.uncache(ss->sec.ci.sid); + } + } + ssl_GetXmitBufLock(ss); + rv = ssl3_FlushHandshake(ss, ssl_SEND_FLAG_FORCE_INTO_BUFFER); + if (rv == SECSuccess) { + PRInt32 sent; + sent = ssl3_SendRecord(ss, NULL, content_alert, bytes, 2, + (desc == no_certificate) ? ssl_SEND_FLAG_FORCE_INTO_BUFFER : 0); + rv = (sent >= 0) ? SECSuccess : (SECStatus)sent; + } + if (level == alert_fatal) { + ss->ssl3.fatalAlertSent = PR_TRUE; + } + ssl_ReleaseXmitBufLock(ss); + ssl_ReleaseSSL3HandshakeLock(ss); + return rv; /* error set by ssl3_FlushHandshake or ssl3_SendRecord */ +} + +/* + * Send illegal_parameter alert. Set generic error number. + */ +static SECStatus +ssl3_IllegalParameter(sslSocket *ss) +{ + (void)SSL3_SendAlert(ss, alert_fatal, illegal_parameter); + PORT_SetError(ss->sec.isServer ? SSL_ERROR_BAD_CLIENT + : SSL_ERROR_BAD_SERVER); + return SECFailure; +} + +/* + * Send handshake_Failure alert. Set generic error number. + */ +static SECStatus +ssl3_HandshakeFailure(sslSocket *ss) +{ + (void)SSL3_SendAlert(ss, alert_fatal, handshake_failure); + PORT_SetError(ss->sec.isServer ? SSL_ERROR_BAD_CLIENT + : SSL_ERROR_BAD_SERVER); + return SECFailure; +} + +void +ssl3_SendAlertForCertError(sslSocket *ss, PRErrorCode errCode) +{ + SSL3AlertDescription desc = bad_certificate; + PRBool isTLS = ss->version >= SSL_LIBRARY_VERSION_3_1_TLS; + + switch (errCode) { + case SEC_ERROR_LIBRARY_FAILURE: + desc = unsupported_certificate; + break; + case SEC_ERROR_EXPIRED_CERTIFICATE: + desc = certificate_expired; + break; + case SEC_ERROR_REVOKED_CERTIFICATE: + desc = certificate_revoked; + break; + case SEC_ERROR_INADEQUATE_KEY_USAGE: + case SEC_ERROR_INADEQUATE_CERT_TYPE: + desc = certificate_unknown; + break; + case SEC_ERROR_UNTRUSTED_CERT: + desc = isTLS ? access_denied : certificate_unknown; + break; + case SEC_ERROR_UNKNOWN_ISSUER: + case SEC_ERROR_UNTRUSTED_ISSUER: + desc = isTLS ? unknown_ca : certificate_unknown; + break; + case SEC_ERROR_EXPIRED_ISSUER_CERTIFICATE: + desc = isTLS ? unknown_ca : certificate_expired; + break; + + case SEC_ERROR_CERT_NOT_IN_NAME_SPACE: + case SEC_ERROR_PATH_LEN_CONSTRAINT_INVALID: + case SEC_ERROR_CA_CERT_INVALID: + case SEC_ERROR_BAD_SIGNATURE: + default: + desc = bad_certificate; + break; + } + SSL_DBG(("%d: SSL3[%d]: peer certificate is no good: error=%d", + SSL_GETPID(), ss->fd, errCode)); + + (void)SSL3_SendAlert(ss, alert_fatal, desc); +} + +/* + * Send decode_error alert. Set generic error number. + */ +SECStatus +ssl3_DecodeError(sslSocket *ss) +{ + (void)SSL3_SendAlert(ss, alert_fatal, + ss->version > SSL_LIBRARY_VERSION_3_0 ? decode_error + : illegal_parameter); + PORT_SetError(ss->sec.isServer ? SSL_ERROR_BAD_CLIENT + : SSL_ERROR_BAD_SERVER); + return SECFailure; +} + +/* Called from ssl3_HandleRecord. +** Caller must hold both RecvBuf and Handshake locks. +*/ +static SECStatus +ssl3_HandleAlert(sslSocket *ss, sslBuffer *buf) +{ + SSL3AlertLevel level; + SSL3AlertDescription desc; + int error; + + PORT_Assert(ss->opt.noLocks || ssl_HaveRecvBufLock(ss)); + PORT_Assert(ss->opt.noLocks || ssl_HaveSSL3HandshakeLock(ss)); + + SSL_TRC(3, ("%d: SSL3[%d]: handle alert record", SSL_GETPID(), ss->fd)); + + if (buf->len != 2) { + (void)ssl3_DecodeError(ss); + PORT_SetError(SSL_ERROR_RX_MALFORMED_ALERT); + return SECFailure; + } + level = (SSL3AlertLevel)buf->buf[0]; + desc = (SSL3AlertDescription)buf->buf[1]; + buf->len = 0; + SSL_TRC(5, ("%d: SSL3[%d] received alert, level = %d, description = %d", + SSL_GETPID(), ss->fd, level, desc)); + + switch (desc) { + case close_notify: + ss->recvdCloseNotify = 1; + error = SSL_ERROR_CLOSE_NOTIFY_ALERT; + break; + case unexpected_message: + error = SSL_ERROR_HANDSHAKE_UNEXPECTED_ALERT; + break; + case bad_record_mac: + error = SSL_ERROR_BAD_MAC_ALERT; + break; + case decryption_failed_RESERVED: + error = SSL_ERROR_DECRYPTION_FAILED_ALERT; + break; + case record_overflow: + error = SSL_ERROR_RECORD_OVERFLOW_ALERT; + break; + case decompression_failure: + error = SSL_ERROR_DECOMPRESSION_FAILURE_ALERT; + break; + case handshake_failure: + error = SSL_ERROR_HANDSHAKE_FAILURE_ALERT; + break; + case no_certificate: + error = SSL_ERROR_NO_CERTIFICATE; + break; + case bad_certificate: + error = SSL_ERROR_BAD_CERT_ALERT; + break; + case unsupported_certificate: + error = SSL_ERROR_UNSUPPORTED_CERT_ALERT; + break; + case certificate_revoked: + error = SSL_ERROR_REVOKED_CERT_ALERT; + break; + case certificate_expired: + error = SSL_ERROR_EXPIRED_CERT_ALERT; + break; + case certificate_unknown: + error = SSL_ERROR_CERTIFICATE_UNKNOWN_ALERT; + break; + case illegal_parameter: + error = SSL_ERROR_ILLEGAL_PARAMETER_ALERT; + break; + case inappropriate_fallback: + error = SSL_ERROR_INAPPROPRIATE_FALLBACK_ALERT; + break; + + /* All alerts below are TLS only. */ + case unknown_ca: + error = SSL_ERROR_UNKNOWN_CA_ALERT; + break; + case access_denied: + error = SSL_ERROR_ACCESS_DENIED_ALERT; + break; + case decode_error: + error = SSL_ERROR_DECODE_ERROR_ALERT; + break; + case decrypt_error: + error = SSL_ERROR_DECRYPT_ERROR_ALERT; + break; + case export_restriction: + error = SSL_ERROR_EXPORT_RESTRICTION_ALERT; + break; + case protocol_version: + error = SSL_ERROR_PROTOCOL_VERSION_ALERT; + break; + case insufficient_security: + error = SSL_ERROR_INSUFFICIENT_SECURITY_ALERT; + break; + case internal_error: + error = SSL_ERROR_INTERNAL_ERROR_ALERT; + break; + case user_canceled: + error = SSL_ERROR_USER_CANCELED_ALERT; + break; + case no_renegotiation: + error = SSL_ERROR_NO_RENEGOTIATION_ALERT; + break; + + /* Alerts for TLS client hello extensions */ + case missing_extension: + error = SSL_ERROR_MISSING_EXTENSION_ALERT; + break; + case unsupported_extension: + error = SSL_ERROR_UNSUPPORTED_EXTENSION_ALERT; + break; + case certificate_unobtainable: + error = SSL_ERROR_CERTIFICATE_UNOBTAINABLE_ALERT; + break; + case unrecognized_name: + error = SSL_ERROR_UNRECOGNIZED_NAME_ALERT; + break; + case bad_certificate_status_response: + error = SSL_ERROR_BAD_CERT_STATUS_RESPONSE_ALERT; + break; + case bad_certificate_hash_value: + error = SSL_ERROR_BAD_CERT_HASH_VALUE_ALERT; + break; + case end_of_early_data: + error = SSL_ERROR_END_OF_EARLY_DATA_ALERT; + break; + default: + error = SSL_ERROR_RX_UNKNOWN_ALERT; + break; + } + if ((ss->version >= SSL_LIBRARY_VERSION_TLS_1_3) && + (ss->ssl3.hs.ws != wait_server_hello)) { + /* TLS 1.3 requires all but "end of data" alerts to be + * treated as fatal. */ + switch (desc) { + case close_notify: + case user_canceled: + case end_of_early_data: + break; + default: + level = alert_fatal; + } + } + if (level == alert_fatal) { + if (!ss->opt.noCache) { + ss->sec.uncache(ss->sec.ci.sid); + } + if ((ss->ssl3.hs.ws == wait_server_hello) && + (desc == handshake_failure)) { + /* XXX This is a hack. We're assuming that any handshake failure + * XXX on the client hello is a failure to match ciphers. + */ + error = SSL_ERROR_NO_CYPHER_OVERLAP; + } + PORT_SetError(error); + return SECFailure; + } + if (desc == end_of_early_data) { + return tls13_HandleEndOfEarlyData(ss); + } + if ((desc == no_certificate) && (ss->ssl3.hs.ws == wait_client_cert)) { + /* I'm a server. I've requested a client cert. He hasn't got one. */ + SECStatus rv; + + PORT_Assert(ss->sec.isServer); + ss->ssl3.hs.ws = wait_client_key; + rv = ssl3_HandleNoCertificate(ss); + return rv; + } + return SECSuccess; +} + +/* + * Change Cipher Specs + * Called from ssl3_HandleServerHelloDone, + * ssl3_HandleClientHello, + * and ssl3_HandleFinished + * + * Acquires and releases spec write lock, to protect switching the current + * and pending write spec pointers. + */ + +static SECStatus +ssl3_SendChangeCipherSpecs(sslSocket *ss) +{ + PRUint8 change = change_cipher_spec_choice; + ssl3CipherSpec *pwSpec; + SECStatus rv; + PRInt32 sent; + + SSL_TRC(3, ("%d: SSL3[%d]: send change_cipher_spec record", + SSL_GETPID(), ss->fd)); + + PORT_Assert(ss->opt.noLocks || ssl_HaveXmitBufLock(ss)); + PORT_Assert(ss->opt.noLocks || ssl_HaveSSL3HandshakeLock(ss)); + + rv = ssl3_FlushHandshake(ss, ssl_SEND_FLAG_FORCE_INTO_BUFFER); + if (rv != SECSuccess) { + return rv; /* error code set by ssl3_FlushHandshake */ + } + if (!IS_DTLS(ss)) { + sent = ssl3_SendRecord(ss, NULL, content_change_cipher_spec, &change, 1, + ssl_SEND_FLAG_FORCE_INTO_BUFFER); + if (sent < 0) { + return (SECStatus)sent; /* error code set by ssl3_SendRecord */ + } + } else { + rv = dtls_QueueMessage(ss, content_change_cipher_spec, &change, 1); + if (rv != SECSuccess) { + return rv; + } + } + + /* swap the pending and current write specs. */ + ssl_GetSpecWriteLock(ss); /**************************************/ + pwSpec = ss->ssl3.pwSpec; + + ss->ssl3.pwSpec = ss->ssl3.cwSpec; + ss->ssl3.cwSpec = pwSpec; + + SSL_TRC(3, ("%d: SSL3[%d] Set Current Write Cipher Suite to Pending", + SSL_GETPID(), ss->fd)); + + /* We need to free up the contexts, keys and certs ! */ + /* If we are really through with the old cipher spec + * (Both the read and write sides have changed) destroy it. + */ + if (ss->ssl3.prSpec == ss->ssl3.pwSpec) { + if (!IS_DTLS(ss)) { + ssl3_DestroyCipherSpec(ss->ssl3.pwSpec, PR_FALSE /*freeSrvName*/); + } else { + /* With DTLS, we need to set a holddown timer in case the final + * message got lost */ + rv = dtls_StartHolddownTimer(ss); + } + } + ssl_ReleaseSpecWriteLock(ss); /**************************************/ + + return rv; +} + +/* Called from ssl3_HandleRecord. +** Caller must hold both RecvBuf and Handshake locks. + * + * Acquires and releases spec write lock, to protect switching the current + * and pending write spec pointers. +*/ +static SECStatus +ssl3_HandleChangeCipherSpecs(sslSocket *ss, sslBuffer *buf) +{ + ssl3CipherSpec *prSpec; + SSL3WaitState ws = ss->ssl3.hs.ws; + SSL3ChangeCipherSpecChoice change; + + PORT_Assert(ss->opt.noLocks || ssl_HaveRecvBufLock(ss)); + PORT_Assert(ss->opt.noLocks || ssl_HaveSSL3HandshakeLock(ss)); + + SSL_TRC(3, ("%d: SSL3[%d]: handle change_cipher_spec record", + SSL_GETPID(), ss->fd)); + + if (ws != wait_change_cipher) { + if (IS_DTLS(ss)) { + /* Ignore this because it's out of order. */ + SSL_TRC(3, ("%d: SSL3[%d]: discard out of order " + "DTLS change_cipher_spec", + SSL_GETPID(), ss->fd)); + buf->len = 0; + return SECSuccess; + } + (void)SSL3_SendAlert(ss, alert_fatal, unexpected_message); + PORT_SetError(SSL_ERROR_RX_UNEXPECTED_CHANGE_CIPHER); + return SECFailure; + } + /* Handshake messages should not span ChangeCipherSpec. */ + if (ss->ssl3.hs.header_bytes) { + (void)SSL3_SendAlert(ss, alert_fatal, unexpected_message); + PORT_SetError(SSL_ERROR_RX_UNEXPECTED_CHANGE_CIPHER); + return SECFailure; + } + if (buf->len != 1) { + (void)ssl3_DecodeError(ss); + PORT_SetError(SSL_ERROR_RX_MALFORMED_CHANGE_CIPHER); + return SECFailure; + } + change = (SSL3ChangeCipherSpecChoice)buf->buf[0]; + if (change != change_cipher_spec_choice) { + /* illegal_parameter is correct here for both SSL3 and TLS. */ + (void)ssl3_IllegalParameter(ss); + PORT_SetError(SSL_ERROR_RX_MALFORMED_CHANGE_CIPHER); + return SECFailure; + } + buf->len = 0; + + /* Swap the pending and current read specs. */ + ssl_GetSpecWriteLock(ss); /*************************************/ + prSpec = ss->ssl3.prSpec; + + ss->ssl3.prSpec = ss->ssl3.crSpec; + ss->ssl3.crSpec = prSpec; + ss->ssl3.hs.ws = wait_finished; + + SSL_TRC(3, ("%d: SSL3[%d] Set Current Read Cipher Suite to Pending", + SSL_GETPID(), ss->fd)); + + /* If we are really through with the old cipher prSpec + * (Both the read and write sides have changed) destroy it. + */ + if (ss->ssl3.prSpec == ss->ssl3.pwSpec) { + ssl3_DestroyCipherSpec(ss->ssl3.prSpec, PR_FALSE /*freeSrvName*/); + } + ssl_ReleaseSpecWriteLock(ss); /*************************************/ + return SECSuccess; +} + +static CK_MECHANISM_TYPE +ssl3_GetMgfMechanismByHashType(SSLHashType hash) +{ + switch (hash) { + case ssl_hash_sha256: + return CKG_MGF1_SHA256; + case ssl_hash_sha384: + return CKG_MGF1_SHA384; + case ssl_hash_sha512: + return CKG_MGF1_SHA512; + default: + PORT_Assert(0); + } + return CKG_MGF1_SHA256; +} + +/* Function valid for >= TLS 1.2, only. */ +static CK_MECHANISM_TYPE +ssl3_GetHashMechanismByHashType(SSLHashType hashType) +{ + switch (hashType) { + case ssl_hash_sha512: + return CKM_SHA512; + case ssl_hash_sha384: + return CKM_SHA384; + case ssl_hash_sha256: + case ssl_hash_none: + /* ssl_hash_none is for pre-1.2 suites, which use SHA-256. */ + return CKM_SHA256; + case ssl_hash_sha1: + return CKM_SHA_1; + default: + PORT_Assert(0); + } + return CKM_SHA256; +} + +/* Function valid for >= TLS 1.2, only. */ +static CK_MECHANISM_TYPE +ssl3_GetPrfHashMechanism(sslSocket *ss) +{ + return ssl3_GetHashMechanismByHashType(ss->ssl3.hs.suite_def->prf_hash); +} + +static SSLHashType +ssl3_GetSuitePrfHash(sslSocket *ss) +{ + /* ssl_hash_none is for pre-1.2 suites, which use SHA-256. */ + if (ss->ssl3.hs.suite_def->prf_hash == ssl_hash_none) { + return ssl_hash_sha256; + } + return ss->ssl3.hs.suite_def->prf_hash; +} + +/* This method completes the derivation of the MS from the PMS. +** +** 1. Derive the MS, if possible, else return an error. +** +** 2. Check the version if |pms_version| is non-zero and if wrong, +** return an error. +** +** 3. If |msp| is nonzero, return MS in |*msp|. + +** Called from: +** ssl3_ComputeMasterSecretInt +** tls_ComputeExtendedMasterSecretInt +*/ +static SECStatus +ssl3_ComputeMasterSecretFinish(sslSocket *ss, + CK_MECHANISM_TYPE master_derive, + CK_MECHANISM_TYPE key_derive, + CK_VERSION *pms_version, + SECItem *params, CK_FLAGS keyFlags, + PK11SymKey *pms, PK11SymKey **msp) +{ + PK11SymKey *ms = NULL; + + ms = PK11_DeriveWithFlags(pms, master_derive, + params, key_derive, + CKA_DERIVE, 0, keyFlags); + if (!ms) { + ssl_MapLowLevelError(SSL_ERROR_SESSION_KEY_GEN_FAILURE); + return SECFailure; + } + + if (pms_version && ss->opt.detectRollBack) { + SSL3ProtocolVersion client_version; + client_version = pms_version->major << 8 | pms_version->minor; + + if (IS_DTLS(ss)) { + client_version = dtls_DTLSVersionToTLSVersion(client_version); + } + + if (client_version != ss->clientHelloVersion) { + /* Destroy MS. Version roll-back detected. */ + PK11_FreeSymKey(ms); + ssl_MapLowLevelError(SSL_ERROR_SESSION_KEY_GEN_FAILURE); + return SECFailure; + } + } + + if (msp) { + *msp = ms; + } else { + PK11_FreeSymKey(ms); + } + + return SECSuccess; +} + +/* Compute the ordinary (pre draft-ietf-tls-session-hash) master + ** secret and return it in |*msp|. + ** + ** Called from: ssl3_ComputeMasterSecret + */ +static SECStatus +ssl3_ComputeMasterSecretInt(sslSocket *ss, PK11SymKey *pms, + PK11SymKey **msp) +{ + ssl3CipherSpec *pwSpec = ss->ssl3.pwSpec; + unsigned char *cr = (unsigned char *)&ss->ssl3.hs.client_random; + unsigned char *sr = (unsigned char *)&ss->ssl3.hs.server_random; + PRBool isTLS = (PRBool)(pwSpec->version > SSL_LIBRARY_VERSION_3_0); + PRBool isTLS12 = + (PRBool)(isTLS && pwSpec->version >= SSL_LIBRARY_VERSION_TLS_1_2); + /* + * Whenever isDH is true, we need to use CKM_TLS_MASTER_KEY_DERIVE_DH + * which, unlike CKM_TLS_MASTER_KEY_DERIVE, converts arbitrary size + * data into a 48-byte value, and does not expect to return the version. + */ + PRBool isDH = (PRBool)((ss->ssl3.hs.kea_def->exchKeyType == ssl_kea_dh) || + (ss->ssl3.hs.kea_def->exchKeyType == ssl_kea_ecdh)); + CK_MECHANISM_TYPE master_derive; + CK_MECHANISM_TYPE key_derive; + SECItem params; + CK_FLAGS keyFlags; + CK_VERSION pms_version; + CK_VERSION *pms_version_ptr = NULL; + /* master_params may be used as a CK_SSL3_MASTER_KEY_DERIVE_PARAMS */ + CK_TLS12_MASTER_KEY_DERIVE_PARAMS master_params; + unsigned int master_params_len; + + if (isTLS12) { + if (isDH) + master_derive = CKM_TLS12_MASTER_KEY_DERIVE_DH; + else + master_derive = CKM_TLS12_MASTER_KEY_DERIVE; + key_derive = CKM_TLS12_KEY_AND_MAC_DERIVE; + keyFlags = CKF_SIGN | CKF_VERIFY; + } else if (isTLS) { + if (isDH) + master_derive = CKM_TLS_MASTER_KEY_DERIVE_DH; + else + master_derive = CKM_TLS_MASTER_KEY_DERIVE; + key_derive = CKM_TLS_KEY_AND_MAC_DERIVE; + keyFlags = CKF_SIGN | CKF_VERIFY; + } else { + if (isDH) + master_derive = CKM_SSL3_MASTER_KEY_DERIVE_DH; + else + master_derive = CKM_SSL3_MASTER_KEY_DERIVE; + key_derive = CKM_SSL3_KEY_AND_MAC_DERIVE; + keyFlags = 0; + } + + if (!isDH) { + pms_version_ptr = &pms_version; + } + + master_params.pVersion = pms_version_ptr; + master_params.RandomInfo.pClientRandom = cr; + master_params.RandomInfo.ulClientRandomLen = SSL3_RANDOM_LENGTH; + master_params.RandomInfo.pServerRandom = sr; + master_params.RandomInfo.ulServerRandomLen = SSL3_RANDOM_LENGTH; + if (isTLS12) { + master_params.prfHashMechanism = ssl3_GetPrfHashMechanism(ss); + master_params_len = sizeof(CK_TLS12_MASTER_KEY_DERIVE_PARAMS); + } else { + /* prfHashMechanism is not relevant with this PRF */ + master_params_len = sizeof(CK_SSL3_MASTER_KEY_DERIVE_PARAMS); + } + + params.data = (unsigned char *)&master_params; + params.len = master_params_len; + + return ssl3_ComputeMasterSecretFinish(ss, master_derive, key_derive, + pms_version_ptr, ¶ms, + keyFlags, pms, msp); +} + +/* Compute the draft-ietf-tls-session-hash master +** secret and return it in |*msp|. +** +** Called from: ssl3_ComputeMasterSecret +*/ +static SECStatus +tls_ComputeExtendedMasterSecretInt(sslSocket *ss, PK11SymKey *pms, + PK11SymKey **msp) +{ + ssl3CipherSpec *pwSpec = ss->ssl3.pwSpec; + CK_NSS_TLS_EXTENDED_MASTER_KEY_DERIVE_PARAMS extended_master_params; + SSL3Hashes hashes; + /* + * Determine whether to use the DH/ECDH or RSA derivation modes. + */ + /* + * TODO(ekr@rtfm.com): Verify that the slot can handle this key expansion + * mode. Bug 1198298 */ + PRBool isDH = (PRBool)((ss->ssl3.hs.kea_def->exchKeyType == ssl_kea_dh) || + (ss->ssl3.hs.kea_def->exchKeyType == ssl_kea_ecdh)); + CK_MECHANISM_TYPE master_derive; + CK_MECHANISM_TYPE key_derive; + SECItem params; + const CK_FLAGS keyFlags = CKF_SIGN | CKF_VERIFY; + CK_VERSION pms_version; + CK_VERSION *pms_version_ptr = NULL; + SECStatus rv; + + rv = ssl3_ComputeHandshakeHashes(ss, pwSpec, &hashes, 0); + if (rv != SECSuccess) { + PORT_Assert(0); /* Should never fail */ + ssl_MapLowLevelError(SSL_ERROR_SESSION_KEY_GEN_FAILURE); + return SECFailure; + } + + if (isDH) { + master_derive = CKM_NSS_TLS_EXTENDED_MASTER_KEY_DERIVE_DH; + } else { + master_derive = CKM_NSS_TLS_EXTENDED_MASTER_KEY_DERIVE; + pms_version_ptr = &pms_version; + } + + if (pwSpec->version >= SSL_LIBRARY_VERSION_TLS_1_2) { + /* TLS 1.2+ */ + extended_master_params.prfHashMechanism = ssl3_GetPrfHashMechanism(ss); + key_derive = CKM_TLS12_KEY_AND_MAC_DERIVE; + } else { + /* TLS < 1.2 */ + extended_master_params.prfHashMechanism = CKM_TLS_PRF; + key_derive = CKM_TLS_KEY_AND_MAC_DERIVE; + } + + extended_master_params.pVersion = pms_version_ptr; + extended_master_params.pSessionHash = hashes.u.raw; + extended_master_params.ulSessionHashLen = hashes.len; + + params.data = (unsigned char *)&extended_master_params; + params.len = sizeof extended_master_params; + + return ssl3_ComputeMasterSecretFinish(ss, master_derive, key_derive, + pms_version_ptr, ¶ms, + keyFlags, pms, msp); +} + +/* Wrapper method to compute the master secret and return it in |*msp|. +** +** Called from ssl3_ComputeMasterSecret +*/ +static SECStatus +ssl3_ComputeMasterSecret(sslSocket *ss, PK11SymKey *pms, + PK11SymKey **msp) +{ + PORT_Assert(pms != NULL); + PORT_Assert(ss->opt.noLocks || ssl_HaveSSL3HandshakeLock(ss)); + PORT_Assert(ss->ssl3.prSpec == ss->ssl3.pwSpec); + + if (ssl3_ExtensionNegotiated(ss, ssl_extended_master_secret_xtn)) { + return tls_ComputeExtendedMasterSecretInt(ss, pms, msp); + } else { + return ssl3_ComputeMasterSecretInt(ss, pms, msp); + } +} + +/* This method uses PKCS11 to derive the MS from the PMS, where PMS +** is a PKCS11 symkey. We call ssl3_ComputeMasterSecret to do the +** computations and then modify the pwSpec->state as a side effect. +** +** This is used in all cases except the "triple bypass" with RSA key +** exchange. +** +** Called from ssl3_InitPendingCipherSpec. prSpec is pwSpec. +*/ +static SECStatus +ssl3_DeriveMasterSecret(sslSocket *ss, PK11SymKey *pms) +{ + SECStatus rv; + PK11SymKey *ms = NULL; + ssl3CipherSpec *pwSpec = ss->ssl3.pwSpec; + + PORT_Assert(ss->opt.noLocks || ssl_HaveSSL3HandshakeLock(ss)); + PORT_Assert(ss->opt.noLocks || ssl_HaveSpecWriteLock(ss)); + PORT_Assert(ss->ssl3.prSpec == ss->ssl3.pwSpec); + + if (pms) { + rv = ssl3_ComputeMasterSecret(ss, pms, &ms); + pwSpec->master_secret = ms; + if (rv != SECSuccess) + return rv; + } + + return SECSuccess; +} + +/* + * Derive encryption and MAC Keys (and IVs) from master secret + * Sets a useful error code when returning SECFailure. + * + * Called only from ssl3_InitPendingCipherSpec(), + * which in turn is called from + * ssl3_SendRSAClientKeyExchange (for Full handshake) + * ssl3_SendDHClientKeyExchange (for Full handshake) + * ssl3_HandleClientKeyExchange (for Full handshake) + * ssl3_HandleServerHello (for session restart) + * ssl3_HandleClientHello (for session restart) + * Caller MUST hold the specWriteLock, and SSL3HandshakeLock. + * ssl3_InitPendingCipherSpec does that. + * + */ +static SECStatus +ssl3_DeriveConnectionKeys(sslSocket *ss) +{ + ssl3CipherSpec *pwSpec = ss->ssl3.pwSpec; + unsigned char *cr = (unsigned char *)&ss->ssl3.hs.client_random; + unsigned char *sr = (unsigned char *)&ss->ssl3.hs.server_random; + PRBool isTLS = (PRBool)(pwSpec->version > SSL_LIBRARY_VERSION_3_0); + PRBool isTLS12 = + (PRBool)(isTLS && pwSpec->version >= SSL_LIBRARY_VERSION_TLS_1_2); + const ssl3BulkCipherDef *cipher_def = pwSpec->cipher_def; + PK11SlotInfo *slot = NULL; + PK11SymKey *symKey = NULL; + void *pwArg = ss->pkcs11PinArg; + int keySize; + CK_TLS12_KEY_MAT_PARAMS key_material_params; /* may be used as a + * CK_SSL3_KEY_MAT_PARAMS */ + unsigned int key_material_params_len; + CK_SSL3_KEY_MAT_OUT returnedKeys; + CK_MECHANISM_TYPE key_derive; + CK_MECHANISM_TYPE bulk_mechanism; + SSLCipherAlgorithm calg; + SECItem params; + PRBool skipKeysAndIVs = (PRBool)(cipher_def->calg == calg_null); + + PORT_Assert(ss->opt.noLocks || ssl_HaveSSL3HandshakeLock(ss)); + PORT_Assert(ss->opt.noLocks || ssl_HaveSpecWriteLock(ss)); + PORT_Assert(ss->ssl3.prSpec == ss->ssl3.pwSpec); + + if (!pwSpec->master_secret) { + PORT_SetError(SSL_ERROR_SESSION_KEY_GEN_FAILURE); + return SECFailure; + } + /* + * generate the key material + */ + key_material_params.ulMacSizeInBits = pwSpec->mac_size * BPB; + key_material_params.ulKeySizeInBits = cipher_def->secret_key_size * BPB; + key_material_params.ulIVSizeInBits = cipher_def->iv_size * BPB; + if (cipher_def->type == type_block && + pwSpec->version >= SSL_LIBRARY_VERSION_TLS_1_1) { + /* Block ciphers in >= TLS 1.1 use a per-record, explicit IV. */ + key_material_params.ulIVSizeInBits = 0; + memset(pwSpec->client.write_iv, 0, cipher_def->iv_size); + memset(pwSpec->server.write_iv, 0, cipher_def->iv_size); + } + + key_material_params.bIsExport = PR_FALSE; + key_material_params.RandomInfo.pClientRandom = cr; + key_material_params.RandomInfo.ulClientRandomLen = SSL3_RANDOM_LENGTH; + key_material_params.RandomInfo.pServerRandom = sr; + key_material_params.RandomInfo.ulServerRandomLen = SSL3_RANDOM_LENGTH; + key_material_params.pReturnedKeyMaterial = &returnedKeys; + + returnedKeys.pIVClient = pwSpec->client.write_iv; + returnedKeys.pIVServer = pwSpec->server.write_iv; + keySize = cipher_def->key_size; + + if (skipKeysAndIVs) { + keySize = 0; + key_material_params.ulKeySizeInBits = 0; + key_material_params.ulIVSizeInBits = 0; + returnedKeys.pIVClient = NULL; + returnedKeys.pIVServer = NULL; + } + + calg = cipher_def->calg; + bulk_mechanism = ssl3_Alg2Mech(calg); + + if (isTLS12) { + key_derive = CKM_TLS12_KEY_AND_MAC_DERIVE; + key_material_params.prfHashMechanism = ssl3_GetPrfHashMechanism(ss); + key_material_params_len = sizeof(CK_TLS12_KEY_MAT_PARAMS); + } else if (isTLS) { + key_derive = CKM_TLS_KEY_AND_MAC_DERIVE; + key_material_params_len = sizeof(CK_SSL3_KEY_MAT_PARAMS); + } else { + key_derive = CKM_SSL3_KEY_AND_MAC_DERIVE; + key_material_params_len = sizeof(CK_SSL3_KEY_MAT_PARAMS); + } + + params.data = (unsigned char *)&key_material_params; + params.len = key_material_params_len; + + /* CKM_SSL3_KEY_AND_MAC_DERIVE is defined to set ENCRYPT, DECRYPT, and + * DERIVE by DEFAULT */ + symKey = PK11_Derive(pwSpec->master_secret, key_derive, ¶ms, + bulk_mechanism, CKA_ENCRYPT, keySize); + if (!symKey) { + ssl_MapLowLevelError(SSL_ERROR_SESSION_KEY_GEN_FAILURE); + return SECFailure; + } + /* we really should use the actual mac'ing mechanism here, but we + * don't because these types are used to map keytype anyway and both + * mac's map to the same keytype. + */ + slot = PK11_GetSlotFromKey(symKey); + + PK11_FreeSlot(slot); /* slot is held until the key is freed */ + pwSpec->client.write_mac_key = + PK11_SymKeyFromHandle(slot, symKey, PK11_OriginDerive, + CKM_SSL3_SHA1_MAC, returnedKeys.hClientMacSecret, PR_TRUE, pwArg); + if (pwSpec->client.write_mac_key == NULL) { + goto loser; /* loser sets err */ + } + pwSpec->server.write_mac_key = + PK11_SymKeyFromHandle(slot, symKey, PK11_OriginDerive, + CKM_SSL3_SHA1_MAC, returnedKeys.hServerMacSecret, PR_TRUE, pwArg); + if (pwSpec->server.write_mac_key == NULL) { + goto loser; /* loser sets err */ + } + if (!skipKeysAndIVs) { + pwSpec->client.write_key = + PK11_SymKeyFromHandle(slot, symKey, PK11_OriginDerive, + bulk_mechanism, returnedKeys.hClientKey, PR_TRUE, pwArg); + if (pwSpec->client.write_key == NULL) { + goto loser; /* loser sets err */ + } + pwSpec->server.write_key = + PK11_SymKeyFromHandle(slot, symKey, PK11_OriginDerive, + bulk_mechanism, returnedKeys.hServerKey, PR_TRUE, pwArg); + if (pwSpec->server.write_key == NULL) { + goto loser; /* loser sets err */ + } + } + PK11_FreeSymKey(symKey); + return SECSuccess; + +loser: + if (symKey) + PK11_FreeSymKey(symKey); + ssl_MapLowLevelError(SSL_ERROR_SESSION_KEY_GEN_FAILURE); + return SECFailure; +} + +/* ssl3_InitHandshakeHashes creates handshake hash contexts and hashes in + * buffered messages in ss->ssl3.hs.messages. Called from + * ssl3_NegotiateCipherSuite(), tls13_HandleClientHelloPart2(), + * and ssl3_HandleServerHello. */ +SECStatus +ssl3_InitHandshakeHashes(sslSocket *ss) +{ + SSL_TRC(30, ("%d: SSL3[%d]: start handshake hashes", SSL_GETPID(), ss->fd)); + + PORT_Assert(ss->ssl3.hs.hashType == handshake_hash_unknown); + if (ss->version == SSL_LIBRARY_VERSION_TLS_1_2) { + ss->ssl3.hs.hashType = handshake_hash_record; + } else { + PORT_Assert(!ss->ssl3.hs.md5 && !ss->ssl3.hs.sha); + /* + * note: We should probably lookup an SSL3 slot for these + * handshake hashes in hopes that we wind up with the same slots + * that the master secret will wind up in ... + */ + if (ss->version >= SSL_LIBRARY_VERSION_TLS_1_3) { + /* determine the hash from the prf */ + const SECOidData *hash_oid = + SECOID_FindOIDByMechanism(ssl3_GetPrfHashMechanism(ss)); + + /* Get the PKCS #11 mechanism for the Hash from the cipher suite (prf_hash) + * Convert that to the OidTag. We can then use that OidTag to create our + * PK11Context */ + PORT_Assert(hash_oid != NULL); + if (hash_oid == NULL) { + ssl_MapLowLevelError(SSL_ERROR_DIGEST_FAILURE); + return SECFailure; + } + + ss->ssl3.hs.sha = PK11_CreateDigestContext(hash_oid->offset); + if (ss->ssl3.hs.sha == NULL) { + ssl_MapLowLevelError(SSL_ERROR_SHA_DIGEST_FAILURE); + return SECFailure; + } + ss->ssl3.hs.hashType = handshake_hash_single; + + if (PK11_DigestBegin(ss->ssl3.hs.sha) != SECSuccess) { + ssl_MapLowLevelError(SSL_ERROR_DIGEST_FAILURE); + return SECFailure; + } + } else { + /* Both ss->ssl3.hs.md5 and ss->ssl3.hs.sha should be NULL or + * created successfully. */ + ss->ssl3.hs.md5 = PK11_CreateDigestContext(SEC_OID_MD5); + if (ss->ssl3.hs.md5 == NULL) { + ssl_MapLowLevelError(SSL_ERROR_MD5_DIGEST_FAILURE); + return SECFailure; + } + ss->ssl3.hs.sha = PK11_CreateDigestContext(SEC_OID_SHA1); + if (ss->ssl3.hs.sha == NULL) { + PK11_DestroyContext(ss->ssl3.hs.md5, PR_TRUE); + ss->ssl3.hs.md5 = NULL; + ssl_MapLowLevelError(SSL_ERROR_SHA_DIGEST_FAILURE); + return SECFailure; + } + ss->ssl3.hs.hashType = handshake_hash_combo; + + if (PK11_DigestBegin(ss->ssl3.hs.md5) != SECSuccess) { + ssl_MapLowLevelError(SSL_ERROR_MD5_DIGEST_FAILURE); + return SECFailure; + } + if (PK11_DigestBegin(ss->ssl3.hs.sha) != SECSuccess) { + ssl_MapLowLevelError(SSL_ERROR_SHA_DIGEST_FAILURE); + return SECFailure; + } + } + } + + if (ss->ssl3.hs.hashType != handshake_hash_record && + ss->ssl3.hs.messages.len > 0) { + if (ssl3_UpdateHandshakeHashes(ss, ss->ssl3.hs.messages.buf, + ss->ssl3.hs.messages.len) != SECSuccess) { + return SECFailure; + } + sslBuffer_Clear(&ss->ssl3.hs.messages); + } + + return SECSuccess; +} + +SECStatus +ssl3_RestartHandshakeHashes(sslSocket *ss) +{ + SECStatus rv = SECSuccess; + + SSL_TRC(30, ("%d: SSL3[%d]: reset handshake hashes", + SSL_GETPID(), ss->fd)); + ss->ssl3.hs.hashType = handshake_hash_unknown; + ss->ssl3.hs.messages.len = 0; + if (ss->ssl3.hs.md5) { + PK11_DestroyContext(ss->ssl3.hs.md5, PR_TRUE); + ss->ssl3.hs.md5 = NULL; + } + if (ss->ssl3.hs.sha) { + PK11_DestroyContext(ss->ssl3.hs.sha, PR_TRUE); + ss->ssl3.hs.sha = NULL; + } + return rv; +} + +/* + * Handshake messages + */ +/* Called from ssl3_InitHandshakeHashes() +** ssl3_AppendHandshake() +** ssl3_HandleV2ClientHello() +** ssl3_HandleHandshakeMessage() +** Caller must hold the ssl3Handshake lock. +*/ +SECStatus +ssl3_UpdateHandshakeHashes(sslSocket *ss, const unsigned char *b, unsigned int l) +{ + SECStatus rv = SECSuccess; + + PORT_Assert(ss->opt.noLocks || ssl_HaveSSL3HandshakeLock(ss)); + + /* With TLS 1.3, and versions TLS.1.1 and older, we keep the hash(es) + * always up to date. However, we must initially buffer the handshake + * messages, until we know what to do. + * If ss->ssl3.hs.hashType != handshake_hash_unknown, + * it means we know what to do. We calculate (hash our input), + * and we stop appending to the buffer. + * + * With TLS 1.2, we always append all handshake messages, + * and never update the hash, because the hash function we must use for + * certificate_verify might be different from the hash function we use + * when signing other handshake hashes. */ + + if (ss->ssl3.hs.hashType == handshake_hash_unknown || + ss->ssl3.hs.hashType == handshake_hash_record) { + return sslBuffer_Append(&ss->ssl3.hs.messages, b, l); + } + + PRINT_BUF(90, (NULL, "handshake hash input:", b, l)); + + if (ss->ssl3.hs.hashType == handshake_hash_single) { + PORT_Assert(ss->version >= SSL_LIBRARY_VERSION_TLS_1_3); + rv = PK11_DigestOp(ss->ssl3.hs.sha, b, l); + if (rv != SECSuccess) { + ssl_MapLowLevelError(SSL_ERROR_DIGEST_FAILURE); + return rv; + } + } else if (ss->ssl3.hs.hashType == handshake_hash_combo) { + rv = PK11_DigestOp(ss->ssl3.hs.md5, b, l); + if (rv != SECSuccess) { + ssl_MapLowLevelError(SSL_ERROR_MD5_DIGEST_FAILURE); + return rv; + } + rv = PK11_DigestOp(ss->ssl3.hs.sha, b, l); + if (rv != SECSuccess) { + ssl_MapLowLevelError(SSL_ERROR_SHA_DIGEST_FAILURE); + return rv; + } + } + return rv; +} + +/************************************************************************** + * Append Handshake functions. + * All these functions set appropriate error codes. + * Most rely on ssl3_AppendHandshake to set the error code. + **************************************************************************/ +SECStatus +ssl3_AppendHandshake(sslSocket *ss, const void *void_src, PRInt32 bytes) +{ + unsigned char *src = (unsigned char *)void_src; + int room = ss->sec.ci.sendBuf.space - ss->sec.ci.sendBuf.len; + SECStatus rv; + + PORT_Assert(ss->opt.noLocks || ssl_HaveSSL3HandshakeLock(ss)); /* protects sendBuf. */ + + if (!bytes) + return SECSuccess; + if (ss->sec.ci.sendBuf.space < MAX_SEND_BUF_LENGTH && room < bytes) { + rv = sslBuffer_Grow(&ss->sec.ci.sendBuf, PR_MAX(MIN_SEND_BUF_LENGTH, + PR_MIN(MAX_SEND_BUF_LENGTH, ss->sec.ci.sendBuf.len + bytes))); + if (rv != SECSuccess) + return rv; /* sslBuffer_Grow has set a memory error code. */ + room = ss->sec.ci.sendBuf.space - ss->sec.ci.sendBuf.len; + } + + PRINT_BUF(60, (ss, "Append to Handshake", (unsigned char *)void_src, bytes)); + rv = ssl3_UpdateHandshakeHashes(ss, src, bytes); + if (rv != SECSuccess) + return rv; /* error code set by ssl3_UpdateHandshakeHashes */ + + while (bytes > room) { + if (room > 0) + PORT_Memcpy(ss->sec.ci.sendBuf.buf + ss->sec.ci.sendBuf.len, src, + room); + ss->sec.ci.sendBuf.len += room; + rv = ssl3_FlushHandshake(ss, ssl_SEND_FLAG_FORCE_INTO_BUFFER); + if (rv != SECSuccess) { + return rv; /* error code set by ssl3_FlushHandshake */ + } + bytes -= room; + src += room; + room = ss->sec.ci.sendBuf.space; + PORT_Assert(ss->sec.ci.sendBuf.len == 0); + } + PORT_Memcpy(ss->sec.ci.sendBuf.buf + ss->sec.ci.sendBuf.len, src, bytes); + ss->sec.ci.sendBuf.len += bytes; + return SECSuccess; +} + +SECStatus +ssl3_AppendHandshakeNumber(sslSocket *ss, PRInt32 num, PRInt32 lenSize) +{ + SECStatus rv; + PRUint8 b[4]; + PRUint8 *p = b; + + PORT_Assert(lenSize <= 4 && lenSize > 0); + if (lenSize < 4 && num >= (1L << (lenSize * 8))) { + PORT_SetError(SSL_ERROR_TX_RECORD_TOO_LONG); + return SECFailure; + } + + switch (lenSize) { + case 4: + *p++ = (num >> 24) & 0xff; + case 3: + *p++ = (num >> 16) & 0xff; + case 2: + *p++ = (num >> 8) & 0xff; + case 1: + *p = num & 0xff; + } + SSL_TRC(60, ("%d: number:", SSL_GETPID())); + rv = ssl3_AppendHandshake(ss, &b[0], lenSize); + return rv; /* error code set by AppendHandshake, if applicable. */ +} + +SECStatus +ssl3_AppendHandshakeVariable( + sslSocket *ss, const SSL3Opaque *src, PRInt32 bytes, PRInt32 lenSize) +{ + SECStatus rv; + + PORT_Assert((bytes < (1 << 8) && lenSize == 1) || + (bytes < (1L << 16) && lenSize == 2) || + (bytes < (1L << 24) && lenSize == 3)); + + SSL_TRC(60, ("%d: append variable:", SSL_GETPID())); + rv = ssl3_AppendHandshakeNumber(ss, bytes, lenSize); + if (rv != SECSuccess) { + return rv; /* error code set by AppendHandshake, if applicable. */ + } + SSL_TRC(60, ("data:")); + rv = ssl3_AppendHandshake(ss, src, bytes); + return rv; /* error code set by AppendHandshake, if applicable. */ +} + +SECStatus +ssl3_AppendHandshakeHeader(sslSocket *ss, SSL3HandshakeType t, PRUint32 length) +{ + SECStatus rv; + + /* If we already have a message in place, we need to enqueue it. + * This empties the buffer. This is a convenient place to call + * dtls_StageHandshakeMessage to mark the message boundary. + */ + if (IS_DTLS(ss)) { + rv = dtls_StageHandshakeMessage(ss); + if (rv != SECSuccess) { + return rv; + } + } + + SSL_TRC(30, ("%d: SSL3[%d]: append handshake header: type %s", + SSL_GETPID(), ss->fd, ssl3_DecodeHandshakeType(t))); + + rv = ssl3_AppendHandshakeNumber(ss, t, 1); + if (rv != SECSuccess) { + return rv; /* error code set by AppendHandshake, if applicable. */ + } + rv = ssl3_AppendHandshakeNumber(ss, length, 3); + if (rv != SECSuccess) { + return rv; /* error code set by AppendHandshake, if applicable. */ + } + + if (IS_DTLS(ss)) { + /* Note that we make an unfragmented message here. We fragment in the + * transmission code, if necessary */ + rv = ssl3_AppendHandshakeNumber(ss, ss->ssl3.hs.sendMessageSeq, 2); + if (rv != SECSuccess) { + return rv; /* error code set by AppendHandshake, if applicable. */ + } + ss->ssl3.hs.sendMessageSeq++; + + /* 0 is the fragment offset, because it's not fragmented yet */ + rv = ssl3_AppendHandshakeNumber(ss, 0, 3); + if (rv != SECSuccess) { + return rv; /* error code set by AppendHandshake, if applicable. */ + } + + /* Fragment length -- set to the packet length because not fragmented */ + rv = ssl3_AppendHandshakeNumber(ss, length, 3); + if (rv != SECSuccess) { + return rv; /* error code set by AppendHandshake, if applicable. */ + } + } + + return rv; /* error code set by AppendHandshake, if applicable. */ +} + +/************************************************************************** + * Consume Handshake functions. + * + * All data used in these functions is protected by two locks, + * the RecvBufLock and the SSL3HandshakeLock + **************************************************************************/ + +/* Read up the next "bytes" number of bytes from the (decrypted) input + * stream "b" (which is *length bytes long). Copy them into buffer "v". + * Reduces *length by bytes. Advances *b by bytes. + * + * If this function returns SECFailure, it has already sent an alert, + * and has set a generic error code. The caller should probably + * override the generic error code by setting another. + */ +SECStatus +ssl3_ConsumeHandshake(sslSocket *ss, void *v, PRInt32 bytes, SSL3Opaque **b, + PRUint32 *length) +{ + PORT_Assert(ss->opt.noLocks || ssl_HaveRecvBufLock(ss)); + PORT_Assert(ss->opt.noLocks || ssl_HaveSSL3HandshakeLock(ss)); + + if ((PRUint32)bytes > *length) { + return ssl3_DecodeError(ss); + } + PORT_Memcpy(v, *b, bytes); + PRINT_BUF(60, (ss, "consume bytes:", *b, bytes)); + *b += bytes; + *length -= bytes; + return SECSuccess; +} + +/* Read up the next "bytes" number of bytes from the (decrypted) input + * stream "b" (which is *length bytes long), and interpret them as an + * integer in network byte order. Returns the received value. + * Reduces *length by bytes. Advances *b by bytes. + * + * Returns SECFailure (-1) on failure. + * This value is indistinguishable from the equivalent received value. + * Only positive numbers are to be received this way. + * Thus, the largest value that may be sent this way is 0x7fffffff. + * On error, an alert has been sent, and a generic error code has been set. + */ +PRInt32 +ssl3_ConsumeHandshakeNumber(sslSocket *ss, PRInt32 bytes, SSL3Opaque **b, + PRUint32 *length) +{ + PRUint8 *buf = *b; + int i; + PRInt32 num = 0; + + PORT_Assert(ss->opt.noLocks || ssl_HaveRecvBufLock(ss)); + PORT_Assert(ss->opt.noLocks || ssl_HaveSSL3HandshakeLock(ss)); + PORT_Assert(bytes <= sizeof num); + + if ((PRUint32)bytes > *length) { + return ssl3_DecodeError(ss); + } + PRINT_BUF(60, (ss, "consume bytes:", *b, bytes)); + + for (i = 0; i < bytes; i++) + num = (num << 8) + buf[i]; + *b += bytes; + *length -= bytes; + return num; +} + +/* Read in two values from the incoming decrypted byte stream "b", which is + * *length bytes long. The first value is a number whose size is "bytes" + * bytes long. The second value is a byte-string whose size is the value + * of the first number received. The latter byte-string, and its length, + * is returned in the SECItem i. + * + * Returns SECFailure (-1) on failure. + * On error, an alert has been sent, and a generic error code has been set. + * + * RADICAL CHANGE for NSS 3.11. All callers of this function make copies + * of the data returned in the SECItem *i, so making a copy of it here + * is simply wasteful. So, This function now just sets SECItem *i to + * point to the values in the buffer **b. + */ +SECStatus +ssl3_ConsumeHandshakeVariable(sslSocket *ss, SECItem *i, PRInt32 bytes, + SSL3Opaque **b, PRUint32 *length) +{ + PRInt32 count; + + PORT_Assert(bytes <= 3); + i->len = 0; + i->data = NULL; + i->type = siBuffer; + count = ssl3_ConsumeHandshakeNumber(ss, bytes, b, length); + if (count < 0) { /* Can't test for SECSuccess here. */ + return SECFailure; + } + if (count > 0) { + if ((PRUint32)count > *length) { + return ssl3_DecodeError(ss); + } + i->data = *b; + i->len = count; + *b += count; + *length -= count; + } + return SECSuccess; +} + +/* Helper function to encode an unsigned integer into a buffer. */ +PRUint8 * +ssl_EncodeUintX(PRUint64 value, unsigned int bytes, PRUint8 *to) +{ + PRUint64 encoded; + + PORT_Assert(bytes > 0 && bytes <= sizeof(encoded)); + + encoded = PR_htonll(value); + memcpy(to, ((unsigned char *)(&encoded)) + (sizeof(encoded) - bytes), bytes); + return to + bytes; +} + +/* ssl3_TLSHashAlgorithmToOID converts a TLS hash identifier into an OID value. + * If the hash is not recognised, SEC_OID_UNKNOWN is returned. + * + * See https://tools.ietf.org/html/rfc5246#section-7.4.1.4.1 */ +SECOidTag +ssl3_HashTypeToOID(SSLHashType hashType) +{ + switch (hashType) { + case ssl_hash_sha1: + return SEC_OID_SHA1; + case ssl_hash_sha256: + return SEC_OID_SHA256; + case ssl_hash_sha384: + return SEC_OID_SHA384; + case ssl_hash_sha512: + return SEC_OID_SHA512; + default: + break; + } + return SEC_OID_UNKNOWN; +} + +SSLHashType +ssl_SignatureSchemeToHashType(SSLSignatureScheme scheme) +{ + switch (scheme) { + case ssl_sig_rsa_pkcs1_sha1: + case ssl_sig_dsa_sha1: + case ssl_sig_ecdsa_sha1: + return ssl_hash_sha1; + case ssl_sig_rsa_pkcs1_sha256: + case ssl_sig_ecdsa_secp256r1_sha256: + case ssl_sig_rsa_pss_sha256: + case ssl_sig_dsa_sha256: + return ssl_hash_sha256; + case ssl_sig_rsa_pkcs1_sha384: + case ssl_sig_ecdsa_secp384r1_sha384: + case ssl_sig_rsa_pss_sha384: + case ssl_sig_dsa_sha384: + return ssl_hash_sha384; + case ssl_sig_rsa_pkcs1_sha512: + case ssl_sig_ecdsa_secp521r1_sha512: + case ssl_sig_rsa_pss_sha512: + case ssl_sig_dsa_sha512: + return ssl_hash_sha512; + case ssl_sig_rsa_pkcs1_sha1md5: + return ssl_hash_none; /* Special for TLS 1.0/1.1. */ + case ssl_sig_none: + case ssl_sig_ed25519: + case ssl_sig_ed448: + break; + } + PORT_Assert(0); + return ssl_hash_none; +} + +KeyType +ssl_SignatureSchemeToKeyType(SSLSignatureScheme scheme) +{ + switch (scheme) { + case ssl_sig_rsa_pkcs1_sha256: + case ssl_sig_rsa_pkcs1_sha384: + case ssl_sig_rsa_pkcs1_sha512: + case ssl_sig_rsa_pkcs1_sha1: + case ssl_sig_rsa_pss_sha256: + case ssl_sig_rsa_pss_sha384: + case ssl_sig_rsa_pss_sha512: + case ssl_sig_rsa_pkcs1_sha1md5: + return rsaKey; + case ssl_sig_ecdsa_secp256r1_sha256: + case ssl_sig_ecdsa_secp384r1_sha384: + case ssl_sig_ecdsa_secp521r1_sha512: + case ssl_sig_ecdsa_sha1: + return ecKey; + case ssl_sig_dsa_sha256: + case ssl_sig_dsa_sha384: + case ssl_sig_dsa_sha512: + case ssl_sig_dsa_sha1: + return dsaKey; + case ssl_sig_none: + case ssl_sig_ed25519: + case ssl_sig_ed448: + break; + } + PORT_Assert(0); + return nullKey; +} + +static SSLNamedGroup +ssl_NamedGroupForSignatureScheme(SSLSignatureScheme scheme) +{ + switch (scheme) { + case ssl_sig_ecdsa_secp256r1_sha256: + return ssl_grp_ec_secp256r1; + case ssl_sig_ecdsa_secp384r1_sha384: + return ssl_grp_ec_secp384r1; + case ssl_sig_ecdsa_secp521r1_sha512: + return ssl_grp_ec_secp521r1; + default: + break; + } + PORT_Assert(0); + return 0; +} + +/* Validate that the signature scheme works for the given key. + * If |allowSha1| is set, we allow the use of SHA-1. + * If |matchGroup| is set, we also check that the group and hash match. */ +static PRBool +ssl_SignatureSchemeValidForKey(PRBool allowSha1, PRBool matchGroup, + KeyType keyType, + const sslNamedGroupDef *ecGroup, + SSLSignatureScheme scheme) +{ + if (!ssl_IsSupportedSignatureScheme(scheme)) { + return PR_FALSE; + } + if (keyType != ssl_SignatureSchemeToKeyType(scheme)) { + return PR_FALSE; + } + if (!allowSha1 && ssl_SignatureSchemeToHashType(scheme) == ssl_hash_sha1) { + return PR_FALSE; + } + if (keyType != ecKey) { + return PR_TRUE; + } + if (!ecGroup) { + return PR_FALSE; + } + /* If |allowSha1| is present and the scheme is ssl_sig_ecdsa_sha1, it's OK. + * This scheme isn't bound to a specific group. */ + if (allowSha1 && (scheme == ssl_sig_ecdsa_sha1)) { + return PR_TRUE; + } + if (!matchGroup) { + return PR_TRUE; + } + return ecGroup->name == ssl_NamedGroupForSignatureScheme(scheme); +} + +/* ssl3_CheckSignatureSchemeConsistency checks that the signature + * algorithm identifier in |sigAndHash| is consistent with the public key in + * |cert|. It also checks the hash algorithm against the configured signature + * algorithms. If all the tests pass, SECSuccess is returned. Otherwise, + * PORT_SetError is called and SECFailure is returned. */ +SECStatus +ssl_CheckSignatureSchemeConsistency( + sslSocket *ss, SSLSignatureScheme scheme, CERTCertificate *cert) +{ + unsigned int i; + const sslNamedGroupDef *group = NULL; + SECKEYPublicKey *key; + KeyType keyType; + PRBool isTLS13 = ss->version == SSL_LIBRARY_VERSION_TLS_1_3; + + key = CERT_ExtractPublicKey(cert); + if (key == NULL) { + ssl_MapLowLevelError(SSL_ERROR_EXTRACT_PUBLIC_KEY_FAILURE); + return SECFailure; + } + + keyType = SECKEY_GetPublicKeyType(key); + if (keyType == ecKey) { + group = ssl_ECPubKey2NamedGroup(key); + } + SECKEY_DestroyPublicKey(key); + + /* If we're a client, check that the signature algorithm matches the signing + * key type of the cipher suite. */ + if (!isTLS13 && + !ss->sec.isServer && + ss->ssl3.hs.kea_def->signKeyType != keyType) { + PORT_SetError(SSL_ERROR_INCORRECT_SIGNATURE_ALGORITHM); + return SECFailure; + } + + /* Verify that the signature scheme matches the signing key. */ + if (!ssl_SignatureSchemeValidForKey(!isTLS13 /* allowSha1 */, + isTLS13 /* matchGroup */, + keyType, group, scheme)) { + PORT_SetError(SSL_ERROR_INCORRECT_SIGNATURE_ALGORITHM); + return SECFailure; + } + + for (i = 0; i < ss->ssl3.signatureSchemeCount; ++i) { + if (scheme == ss->ssl3.signatureSchemes[i]) { + return SECSuccess; + } + } + PORT_SetError(SSL_ERROR_UNSUPPORTED_SIGNATURE_ALGORITHM); + return SECFailure; +} + +PRBool +ssl_IsSupportedSignatureScheme(SSLSignatureScheme scheme) +{ + switch (scheme) { + case ssl_sig_rsa_pkcs1_sha1: + case ssl_sig_rsa_pkcs1_sha256: + case ssl_sig_rsa_pkcs1_sha384: + case ssl_sig_rsa_pkcs1_sha512: + case ssl_sig_rsa_pss_sha256: + case ssl_sig_rsa_pss_sha384: + case ssl_sig_rsa_pss_sha512: + case ssl_sig_ecdsa_secp256r1_sha256: + case ssl_sig_ecdsa_secp384r1_sha384: + case ssl_sig_ecdsa_secp521r1_sha512: + case ssl_sig_dsa_sha1: + case ssl_sig_dsa_sha256: + case ssl_sig_dsa_sha384: + case ssl_sig_dsa_sha512: + case ssl_sig_ecdsa_sha1: + return PR_TRUE; + + case ssl_sig_rsa_pkcs1_sha1md5: + case ssl_sig_none: + case ssl_sig_ed25519: + case ssl_sig_ed448: + return PR_FALSE; + } + return PR_FALSE; +} + +PRBool +ssl_IsRsaPssSignatureScheme(SSLSignatureScheme scheme) +{ + switch (scheme) { + case ssl_sig_rsa_pss_sha256: + case ssl_sig_rsa_pss_sha384: + case ssl_sig_rsa_pss_sha512: + return PR_TRUE; + + default: + return PR_FALSE; + } + return PR_FALSE; +} + +/* ssl_ConsumeSignatureScheme reads a SSLSignatureScheme (formerly + * SignatureAndHashAlgorithm) structure from |b| and puts the resulting value + * into |out|. |b| and |length| are updated accordingly. + * + * See https://tools.ietf.org/html/rfc5246#section-7.4.1.4.1 */ +SECStatus +ssl_ConsumeSignatureScheme(sslSocket *ss, SSL3Opaque **b, + PRUint32 *length, SSLSignatureScheme *out) +{ + PRInt32 tmp; + + tmp = ssl3_ConsumeHandshakeNumber(ss, 2, b, length); + if (tmp < 0) { + return SECFailure; /* Error code set already. */ + } + if (!ssl_IsSupportedSignatureScheme((SSLSignatureScheme)tmp)) { + PORT_SetError(SSL_ERROR_UNSUPPORTED_SIGNATURE_ALGORITHM); + return SECFailure; + } + *out = (SSLSignatureScheme)tmp; + return SECSuccess; +} + +/************************************************************************** + * end of Consume Handshake functions. + **************************************************************************/ + +static SECStatus +ssl3_ComputeHandshakeHash(unsigned char *buf, unsigned int len, + SSLHashType hashAlg, SSL3Hashes *hashes) +{ + SECStatus rv = SECFailure; + PK11Context *hashContext = PK11_CreateDigestContext( + ssl3_HashTypeToOID(hashAlg)); + + if (!hashContext) { + return rv; + } + rv = PK11_DigestBegin(hashContext); + if (rv == SECSuccess) { + rv = PK11_DigestOp(hashContext, buf, len); + } + if (rv == SECSuccess) { + rv = PK11_DigestFinal(hashContext, hashes->u.raw, &hashes->len, + sizeof(hashes->u.raw)); + } + if (rv == SECSuccess) { + hashes->hashAlg = hashAlg; + } + PK11_DestroyContext(hashContext, PR_TRUE); + return rv; +} + +/* Extract the hashes of handshake messages to this point. + * Called from ssl3_SendCertificateVerify + * ssl3_SendFinished + * ssl3_HandleHandshakeMessage + * + * Caller must hold the SSL3HandshakeLock. + * Caller must hold a read or write lock on the Spec R/W lock. + * (There is presently no way to assert on a Read lock.) + */ +SECStatus +ssl3_ComputeHandshakeHashes(sslSocket *ss, + ssl3CipherSpec *spec, /* uses ->master_secret */ + SSL3Hashes *hashes, /* output goes here. */ + PRUint32 sender) +{ + SECStatus rv = SECSuccess; + PRBool isTLS = (PRBool)(spec->version > SSL_LIBRARY_VERSION_3_0); + unsigned int outLength; + SSL3Opaque md5_inner[MAX_MAC_LENGTH]; + SSL3Opaque sha_inner[MAX_MAC_LENGTH]; + + PORT_Assert(ss->opt.noLocks || ssl_HaveSSL3HandshakeLock(ss)); + if (ss->ssl3.hs.hashType == handshake_hash_unknown) { + PORT_SetError(SEC_ERROR_LIBRARY_FAILURE); + return SECFailure; + } + + hashes->hashAlg = ssl_hash_none; + + if (ss->ssl3.hs.hashType == handshake_hash_single) { + PK11Context *h; + unsigned int stateLen; + unsigned char stackBuf[1024]; + unsigned char *stateBuf = NULL; + + h = ss->ssl3.hs.sha; + stateBuf = PK11_SaveContextAlloc(h, stackBuf, + sizeof(stackBuf), &stateLen); + if (stateBuf == NULL) { + ssl_MapLowLevelError(SSL_ERROR_DIGEST_FAILURE); + goto tls12_loser; + } + rv |= PK11_DigestFinal(h, hashes->u.raw, &hashes->len, + sizeof(hashes->u.raw)); + if (rv != SECSuccess) { + ssl_MapLowLevelError(SSL_ERROR_DIGEST_FAILURE); + rv = SECFailure; + goto tls12_loser; + } + + hashes->hashAlg = ssl3_GetSuitePrfHash(ss); + rv = SECSuccess; + + tls12_loser: + if (stateBuf) { + if (PK11_RestoreContext(h, stateBuf, stateLen) != SECSuccess) { + ssl_MapLowLevelError(SSL_ERROR_DIGEST_FAILURE); + rv = SECFailure; + } + if (stateBuf != stackBuf) { + PORT_ZFree(stateBuf, stateLen); + } + } + } else if (ss->ssl3.hs.hashType == handshake_hash_record) { + rv = ssl3_ComputeHandshakeHash(ss->ssl3.hs.messages.buf, + ss->ssl3.hs.messages.len, + ssl3_GetSuitePrfHash(ss), + hashes); + } else { + PK11Context *md5; + PK11Context *sha = NULL; + unsigned char *md5StateBuf = NULL; + unsigned char *shaStateBuf = NULL; + unsigned int md5StateLen, shaStateLen; + unsigned char md5StackBuf[256]; + unsigned char shaStackBuf[512]; + + md5StateBuf = PK11_SaveContextAlloc(ss->ssl3.hs.md5, md5StackBuf, + sizeof md5StackBuf, &md5StateLen); + if (md5StateBuf == NULL) { + ssl_MapLowLevelError(SSL_ERROR_MD5_DIGEST_FAILURE); + goto loser; + } + md5 = ss->ssl3.hs.md5; + + shaStateBuf = PK11_SaveContextAlloc(ss->ssl3.hs.sha, shaStackBuf, + sizeof shaStackBuf, &shaStateLen); + if (shaStateBuf == NULL) { + ssl_MapLowLevelError(SSL_ERROR_SHA_DIGEST_FAILURE); + goto loser; + } + sha = ss->ssl3.hs.sha; + + if (!isTLS) { + /* compute hashes for SSL3. */ + unsigned char s[4]; + + if (!spec->master_secret) { + PORT_SetError(SSL_ERROR_RX_UNEXPECTED_HANDSHAKE); + rv = SECFailure; + goto loser; + } + + s[0] = (unsigned char)(sender >> 24); + s[1] = (unsigned char)(sender >> 16); + s[2] = (unsigned char)(sender >> 8); + s[3] = (unsigned char)sender; + + if (sender != 0) { + rv |= PK11_DigestOp(md5, s, 4); + PRINT_BUF(95, (NULL, "MD5 inner: sender", s, 4)); + } + + PRINT_BUF(95, (NULL, "MD5 inner: MAC Pad 1", mac_pad_1, + mac_defs[mac_md5].pad_size)); + + rv |= PK11_DigestKey(md5, spec->master_secret); + rv |= PK11_DigestOp(md5, mac_pad_1, mac_defs[mac_md5].pad_size); + rv |= PK11_DigestFinal(md5, md5_inner, &outLength, MD5_LENGTH); + PORT_Assert(rv != SECSuccess || outLength == MD5_LENGTH); + if (rv != SECSuccess) { + ssl_MapLowLevelError(SSL_ERROR_MD5_DIGEST_FAILURE); + rv = SECFailure; + goto loser; + } + + PRINT_BUF(95, (NULL, "MD5 inner: result", md5_inner, outLength)); + + if (sender != 0) { + rv |= PK11_DigestOp(sha, s, 4); + PRINT_BUF(95, (NULL, "SHA inner: sender", s, 4)); + } + + PRINT_BUF(95, (NULL, "SHA inner: MAC Pad 1", mac_pad_1, + mac_defs[mac_sha].pad_size)); + + rv |= PK11_DigestKey(sha, spec->master_secret); + rv |= PK11_DigestOp(sha, mac_pad_1, mac_defs[mac_sha].pad_size); + rv |= PK11_DigestFinal(sha, sha_inner, &outLength, SHA1_LENGTH); + PORT_Assert(rv != SECSuccess || outLength == SHA1_LENGTH); + if (rv != SECSuccess) { + ssl_MapLowLevelError(SSL_ERROR_SHA_DIGEST_FAILURE); + rv = SECFailure; + goto loser; + } + + PRINT_BUF(95, (NULL, "SHA inner: result", sha_inner, outLength)); + + PRINT_BUF(95, (NULL, "MD5 outer: MAC Pad 2", mac_pad_2, + mac_defs[mac_md5].pad_size)); + PRINT_BUF(95, (NULL, "MD5 outer: MD5 inner", md5_inner, MD5_LENGTH)); + + rv |= PK11_DigestBegin(md5); + rv |= PK11_DigestKey(md5, spec->master_secret); + rv |= PK11_DigestOp(md5, mac_pad_2, mac_defs[mac_md5].pad_size); + rv |= PK11_DigestOp(md5, md5_inner, MD5_LENGTH); + } + rv |= PK11_DigestFinal(md5, hashes->u.s.md5, &outLength, MD5_LENGTH); + PORT_Assert(rv != SECSuccess || outLength == MD5_LENGTH); + if (rv != SECSuccess) { + ssl_MapLowLevelError(SSL_ERROR_MD5_DIGEST_FAILURE); + rv = SECFailure; + goto loser; + } + + PRINT_BUF(60, (NULL, "MD5 outer: result", hashes->u.s.md5, MD5_LENGTH)); + + if (!isTLS) { + PRINT_BUF(95, (NULL, "SHA outer: MAC Pad 2", mac_pad_2, + mac_defs[mac_sha].pad_size)); + PRINT_BUF(95, (NULL, "SHA outer: SHA inner", sha_inner, SHA1_LENGTH)); + + rv |= PK11_DigestBegin(sha); + rv |= PK11_DigestKey(sha, spec->master_secret); + rv |= PK11_DigestOp(sha, mac_pad_2, mac_defs[mac_sha].pad_size); + rv |= PK11_DigestOp(sha, sha_inner, SHA1_LENGTH); + } + rv |= PK11_DigestFinal(sha, hashes->u.s.sha, &outLength, SHA1_LENGTH); + PORT_Assert(rv != SECSuccess || outLength == SHA1_LENGTH); + if (rv != SECSuccess) { + ssl_MapLowLevelError(SSL_ERROR_SHA_DIGEST_FAILURE); + rv = SECFailure; + goto loser; + } + + PRINT_BUF(60, (NULL, "SHA outer: result", hashes->u.s.sha, SHA1_LENGTH)); + + hashes->len = MD5_LENGTH + SHA1_LENGTH; + rv = SECSuccess; + + loser: + if (md5StateBuf) { + if (PK11_RestoreContext(ss->ssl3.hs.md5, md5StateBuf, md5StateLen) != + SECSuccess) { + ssl_MapLowLevelError(SSL_ERROR_MD5_DIGEST_FAILURE); + rv = SECFailure; + } + if (md5StateBuf != md5StackBuf) { + PORT_ZFree(md5StateBuf, md5StateLen); + } + } + if (shaStateBuf) { + if (PK11_RestoreContext(ss->ssl3.hs.sha, shaStateBuf, shaStateLen) != + SECSuccess) { + ssl_MapLowLevelError(SSL_ERROR_SHA_DIGEST_FAILURE); + rv = SECFailure; + } + if (shaStateBuf != shaStackBuf) { + PORT_ZFree(shaStateBuf, shaStateLen); + } + } + } + return rv; +} + +/************************************************************************** + * end of Handshake Hash functions. + * Begin Send and Handle functions for handshakes. + **************************************************************************/ + +#ifdef TRACE +#define CHTYPE(t) \ + case client_hello_##t: \ + return #t; + +static const char * +ssl_ClientHelloTypeName(sslClientHelloType type) +{ + switch (type) { + CHTYPE(initial); + CHTYPE(retry); + CHTYPE(retransmit); /* DTLS only */ + CHTYPE(renegotiation); /* TLS <= 1.2 only */ + } + PORT_Assert(0); + return NULL; +} +#undef CHTYPE +#endif + +/* Called from ssl3_HandleHelloRequest(), + * ssl3_RedoHandshake() + * ssl_BeginClientHandshake (when resuming ssl3 session) + * dtls_HandleHelloVerifyRequest(with resending=PR_TRUE) + * + * The |type| argument indicates what is going on here: + * - client_hello_initial is set for the very first ClientHello + * - client_hello_retry indicates that this is a second attempt after receiving + * a HelloRetryRequest (in TLS 1.3) + * - client_hello_retransmit is used in DTLS when resending + * - client_hello_renegotiation is used to renegotiate (in TLS <1.3) + */ +SECStatus +ssl3_SendClientHello(sslSocket *ss, sslClientHelloType type) +{ + sslSessionID *sid; + ssl3CipherSpec *cwSpec; + SECStatus rv; + int i; + int length; + int num_suites; + int actual_count = 0; + PRBool isTLS = PR_FALSE; + PRBool requestingResume = PR_FALSE, fallbackSCSV = PR_FALSE; + PRInt32 total_exten_len = 0; + unsigned paddingExtensionLen; + unsigned numCompressionMethods; + PRUint16 version; + PRInt32 flags; + + SSL_TRC(3, ("%d: SSL3[%d]: send %s ClientHello handshake", SSL_GETPID(), + ss->fd, ssl_ClientHelloTypeName(type))); + + PORT_Assert(ss->opt.noLocks || ssl_HaveSSL3HandshakeLock(ss)); + PORT_Assert(ss->opt.noLocks || ssl_HaveXmitBufLock(ss)); + + /* shouldn't get here if SSL3 is disabled, but ... */ + if (SSL_ALL_VERSIONS_DISABLED(&ss->vrange)) { + PR_NOT_REACHED("No versions of SSL 3.0 or later are enabled"); + PORT_SetError(SSL_ERROR_SSL_DISABLED); + return SECFailure; + } + + /* If we are responding to a HelloRetryRequest, don't reinitialize. We need + * to maintain the handshake hashes. */ + if (ss->ssl3.hs.helloRetry) { + PORT_Assert(type == client_hello_retry); + } else { + rv = ssl3_InitState(ss); + if (rv != SECSuccess) { + return rv; /* ssl3_InitState has set the error code. */ + } + + rv = ssl3_RestartHandshakeHashes(ss); + if (rv != SECSuccess) { + return rv; + } + } + + /* These must be reset every handshake. */ + ss->ssl3.hs.sendingSCSV = PR_FALSE; + ss->ssl3.hs.preliminaryInfo = 0; + PORT_Assert(IS_DTLS(ss) || type != client_hello_retransmit); + SECITEM_FreeItem(&ss->ssl3.hs.newSessionTicket.ticket, PR_FALSE); + ss->ssl3.hs.receivedNewSessionTicket = PR_FALSE; + ssl3_ResetExtensionData(&ss->xtnData); + + /* How many suites does our PKCS11 support (regardless of policy)? */ + num_suites = ssl3_config_match_init(ss); + if (!num_suites) { + return SECFailure; /* ssl3_config_match_init has set error code. */ + } + + /* + * During a renegotiation, ss->clientHelloVersion will be used again to + * work around a Windows SChannel bug. Ensure that it is still enabled. + */ + if (ss->firstHsDone) { + PORT_Assert(type != client_hello_initial); + if (SSL_ALL_VERSIONS_DISABLED(&ss->vrange)) { + PORT_SetError(SSL_ERROR_SSL_DISABLED); + return SECFailure; + } + + if (ss->clientHelloVersion < ss->vrange.min || + ss->clientHelloVersion > ss->vrange.max) { + PORT_SetError(SSL_ERROR_NO_CYPHER_OVERLAP); + return SECFailure; + } + } + + /* We ignore ss->sec.ci.sid here, and use ssl_Lookup because Lookup + * handles expired entries and other details. + * XXX If we've been called from ssl_BeginClientHandshake, then + * this lookup is duplicative and wasteful. + */ + sid = (ss->opt.noCache) ? NULL + : ssl_LookupSID(&ss->sec.ci.peer, ss->sec.ci.port, ss->peerID, ss->url); + + /* We can't resume based on a different token. If the sid exists, + * make sure the token that holds the master secret still exists ... + * If we previously did client-auth, make sure that the token that holds + * the private key still exists, is logged in, hasn't been removed, etc. + */ + if (sid) { + PRBool sidOK = PR_TRUE; + const ssl3CipherSuiteCfg *suite; + + /* Check that the cipher suite we need is enabled. */ + suite = ssl_LookupCipherSuiteCfg(sid->u.ssl3.cipherSuite, + ss->cipherSuites); + PORT_Assert(suite); + if (!suite || !config_match(suite, ss->ssl3.policy, &ss->vrange, ss)) { + sidOK = PR_FALSE; + } + + /* Check that we can recover the master secret. */ + if (sidOK && sid->u.ssl3.keys.msIsWrapped) { + PK11SlotInfo *slot = NULL; + if (sid->u.ssl3.masterValid) { + slot = SECMOD_LookupSlot(sid->u.ssl3.masterModuleID, + sid->u.ssl3.masterSlotID); + } + if (slot == NULL) { + sidOK = PR_FALSE; + } else { + PK11SymKey *wrapKey = NULL; + if (!PK11_IsPresent(slot) || + ((wrapKey = PK11_GetWrapKey(slot, + sid->u.ssl3.masterWrapIndex, + sid->u.ssl3.masterWrapMech, + sid->u.ssl3.masterWrapSeries, + ss->pkcs11PinArg)) == NULL)) { + sidOK = PR_FALSE; + } + if (wrapKey) + PK11_FreeSymKey(wrapKey); + PK11_FreeSlot(slot); + slot = NULL; + } + } + /* If we previously did client-auth, make sure that the token that + ** holds the private key still exists, is logged in, hasn't been + ** removed, etc. + */ + if (sidOK && !ssl3_ClientAuthTokenPresent(sid)) { + sidOK = PR_FALSE; + } + + if (sidOK) { + /* Set version based on the sid. */ + if (ss->firstHsDone) { + /* + * Windows SChannel compares the client_version inside the RSA + * EncryptedPreMasterSecret of a renegotiation with the + * client_version of the initial ClientHello rather than the + * ClientHello in the renegotiation. To work around this bug, we + * continue to use the client_version used in the initial + * ClientHello when renegotiating. + * + * The client_version of the initial ClientHello is still + * available in ss->clientHelloVersion. Ensure that + * sid->version is bounded within + * [ss->vrange.min, ss->clientHelloVersion], otherwise we + * can't use sid. + */ + if (sid->version >= ss->vrange.min && + sid->version <= ss->clientHelloVersion) { + version = ss->clientHelloVersion; + } else { + sidOK = PR_FALSE; + } + } else { + /* + * Check sid->version is OK first. + * Previously, we would cap the version based on sid->version, + * but that prevents negotiation of a higher version if the + * previous session was reduced (e.g., with version fallback) + */ + if (sid->version < ss->vrange.min || + sid->version > ss->vrange.max) { + sidOK = PR_FALSE; + } else { + version = ss->vrange.max; + } + } + } + + if (!sidOK) { + SSL_AtomicIncrementLong(&ssl3stats.sch_sid_cache_not_ok); + ss->sec.uncache(sid); + ssl_FreeSID(sid); + sid = NULL; + } + } + + if (sid) { + requestingResume = PR_TRUE; + SSL_AtomicIncrementLong(&ssl3stats.sch_sid_cache_hits); + + PRINT_BUF(4, (ss, "client, found session-id:", sid->u.ssl3.sessionID, + sid->u.ssl3.sessionIDLength)); + + ss->ssl3.policy = sid->u.ssl3.policy; + } else { + SSL_AtomicIncrementLong(&ssl3stats.sch_sid_cache_misses); + + /* + * Windows SChannel compares the client_version inside the RSA + * EncryptedPreMasterSecret of a renegotiation with the + * client_version of the initial ClientHello rather than the + * ClientHello in the renegotiation. To work around this bug, we + * continue to use the client_version used in the initial + * ClientHello when renegotiating. + */ + if (ss->firstHsDone) { + version = ss->clientHelloVersion; + } else { + version = ss->vrange.max; + } + + sid = ssl3_NewSessionID(ss, PR_FALSE); + if (!sid) { + return SECFailure; /* memory error is set */ + } + /* ss->version isn't set yet, but the sid needs a sane value. */ + sid->version = version; + } + + isTLS = (version > SSL_LIBRARY_VERSION_3_0); + ssl_GetSpecWriteLock(ss); + cwSpec = ss->ssl3.cwSpec; + if (cwSpec->mac_def->mac == mac_null) { + /* SSL records are not being MACed. */ + cwSpec->version = version; + } + ssl_ReleaseSpecWriteLock(ss); + + if (ss->sec.ci.sid != NULL) { + ssl_FreeSID(ss->sec.ci.sid); /* decrement ref count, free if zero */ + } + ss->sec.ci.sid = sid; + + /* HACK for SCSV in SSL 3.0. On initial handshake, prepend SCSV, + * only if TLS is disabled. + */ + if (!ss->firstHsDone && !isTLS) { + /* Must set this before calling Hello Extension Senders, + * to suppress sending of empty RI extension. + */ + ss->ssl3.hs.sendingSCSV = PR_TRUE; + } + + /* When we attempt session resumption (only), we must lock the sid to + * prevent races with other resumption connections that receive a + * NewSessionTicket that will cause the ticket in the sid to be replaced. + * Once we've copied the session ticket into our ClientHello message, it + * is OK for the ticket to change, so we just need to make sure we hold + * the lock across the calls to ssl3_CallHelloExtensionSenders. + */ + if (sid->u.ssl3.lock) { + PR_RWLock_Rlock(sid->u.ssl3.lock); + } + + if (ss->vrange.max >= SSL_LIBRARY_VERSION_TLS_1_3 && + type == client_hello_initial) { + rv = tls13_SetupClientHello(ss); + if (rv != SECSuccess) { + return SECFailure; + } + } + if (isTLS || (ss->firstHsDone && ss->peerRequestedProtection)) { + PRUint32 maxBytes = 65535; /* 2^16 - 1 */ + PRInt32 extLen; + + extLen = ssl3_CallHelloExtensionSenders(ss, PR_FALSE, maxBytes, NULL); + if (extLen < 0) { + if (sid->u.ssl3.lock) { + PR_RWLock_Unlock(sid->u.ssl3.lock); + } + return SECFailure; + } + total_exten_len += extLen; + + if (total_exten_len > 0) + total_exten_len += 2; + } + + if (IS_DTLS(ss)) { + ssl3_DisableNonDTLSSuites(ss); + } + + /* how many suites are permitted by policy and user preference? */ + num_suites = count_cipher_suites(ss, ss->ssl3.policy); + if (!num_suites) { + if (sid->u.ssl3.lock) { + PR_RWLock_Unlock(sid->u.ssl3.lock); + } + return SECFailure; /* count_cipher_suites has set error code. */ + } + + fallbackSCSV = ss->opt.enableFallbackSCSV && (!requestingResume || + version < sid->version); + /* make room for SCSV */ + if (ss->ssl3.hs.sendingSCSV) { + ++num_suites; + } + if (fallbackSCSV) { + ++num_suites; + } + + /* count compression methods */ + numCompressionMethods = 0; + for (i = 0; i < ssl_compression_method_count; i++) { + if (ssl_CompressionEnabled(ss, ssl_compression_methods[i])) + numCompressionMethods++; + } + + length = sizeof(SSL3ProtocolVersion) + SSL3_RANDOM_LENGTH + + 1 + (sid->version >= SSL_LIBRARY_VERSION_TLS_1_3 + ? 0 + : sid->u.ssl3.sessionIDLength) + + 2 + num_suites * sizeof(ssl3CipherSuite) + + 1 + numCompressionMethods + total_exten_len; + if (IS_DTLS(ss)) { + length += 1 + ss->ssl3.hs.cookie.len; + } + + /* A padding extension may be included to ensure that the record containing + * the ClientHello doesn't have a length between 256 and 511 bytes + * (inclusive). Initial, ClientHello records with such lengths trigger bugs + * in F5 devices. + * + * This is not done for DTLS, for renegotiation, or when there are no + * extensions. */ + if (!IS_DTLS(ss) && isTLS && !ss->firstHsDone && total_exten_len) { + paddingExtensionLen = ssl3_CalculatePaddingExtensionLength(length); + total_exten_len += paddingExtensionLen; + length += paddingExtensionLen; + } else { + paddingExtensionLen = 0; + } + + rv = ssl3_AppendHandshakeHeader(ss, client_hello, length); + if (rv != SECSuccess) { + if (sid->u.ssl3.lock) { + PR_RWLock_Unlock(sid->u.ssl3.lock); + } + return rv; /* err set by ssl3_AppendHandshake* */ + } + + if (ss->firstHsDone) { + /* The client hello version must stay unchanged to work around + * the Windows SChannel bug described above. */ + PORT_Assert(version == ss->clientHelloVersion); + } + ss->clientHelloVersion = PR_MIN(version, SSL_LIBRARY_VERSION_TLS_1_2); + if (IS_DTLS(ss)) { + PRUint16 dtlsVersion; + + dtlsVersion = dtls_TLSVersionToDTLSVersion(ss->clientHelloVersion); + rv = ssl3_AppendHandshakeNumber(ss, dtlsVersion, 2); + } else { + rv = ssl3_AppendHandshakeNumber(ss, ss->clientHelloVersion, 2); + } + if (rv != SECSuccess) { + if (sid->u.ssl3.lock) { + PR_RWLock_Unlock(sid->u.ssl3.lock); + } + return rv; /* err set by ssl3_AppendHandshake* */ + } + + /* Generate a new random if this is the first attempt. */ + if (type == client_hello_initial) { + rv = ssl3_GetNewRandom(&ss->ssl3.hs.client_random); + if (rv != SECSuccess) { + if (sid->u.ssl3.lock) { + PR_RWLock_Unlock(sid->u.ssl3.lock); + } + return rv; /* err set by GetNewRandom. */ + } + } + rv = ssl3_AppendHandshake(ss, &ss->ssl3.hs.client_random, + SSL3_RANDOM_LENGTH); + if (rv != SECSuccess) { + if (sid->u.ssl3.lock) { + PR_RWLock_Unlock(sid->u.ssl3.lock); + } + return rv; /* err set by ssl3_AppendHandshake* */ + } + + if (sid->version < SSL_LIBRARY_VERSION_TLS_1_3) + rv = ssl3_AppendHandshakeVariable( + ss, sid->u.ssl3.sessionID, sid->u.ssl3.sessionIDLength, 1); + else + rv = ssl3_AppendHandshakeNumber(ss, 0, 1); + if (rv != SECSuccess) { + if (sid->u.ssl3.lock) { + PR_RWLock_Unlock(sid->u.ssl3.lock); + } + return rv; /* err set by ssl3_AppendHandshake* */ + } + + if (IS_DTLS(ss)) { + rv = ssl3_AppendHandshakeVariable( + ss, ss->ssl3.hs.cookie.data, ss->ssl3.hs.cookie.len, 1); + if (rv != SECSuccess) { + if (sid->u.ssl3.lock) { + PR_RWLock_Unlock(sid->u.ssl3.lock); + } + return rv; /* err set by ssl3_AppendHandshake* */ + } + } + + rv = ssl3_AppendHandshakeNumber(ss, num_suites * sizeof(ssl3CipherSuite), 2); + if (rv != SECSuccess) { + if (sid->u.ssl3.lock) { + PR_RWLock_Unlock(sid->u.ssl3.lock); + } + return rv; /* err set by ssl3_AppendHandshake* */ + } + + if (ss->ssl3.hs.sendingSCSV) { + /* Add the actual SCSV */ + rv = ssl3_AppendHandshakeNumber(ss, TLS_EMPTY_RENEGOTIATION_INFO_SCSV, + sizeof(ssl3CipherSuite)); + if (rv != SECSuccess) { + if (sid->u.ssl3.lock) { + PR_RWLock_Unlock(sid->u.ssl3.lock); + } + return rv; /* err set by ssl3_AppendHandshake* */ + } + actual_count++; + } + if (fallbackSCSV) { + rv = ssl3_AppendHandshakeNumber(ss, TLS_FALLBACK_SCSV, + sizeof(ssl3CipherSuite)); + if (rv != SECSuccess) { + if (sid->u.ssl3.lock) { + PR_RWLock_Unlock(sid->u.ssl3.lock); + } + return rv; /* err set by ssl3_AppendHandshake* */ + } + actual_count++; + } + for (i = 0; i < ssl_V3_SUITES_IMPLEMENTED; i++) { + ssl3CipherSuiteCfg *suite = &ss->cipherSuites[i]; + if (config_match(suite, ss->ssl3.policy, &ss->vrange, ss)) { + actual_count++; + if (actual_count > num_suites) { + if (sid->u.ssl3.lock) { + PR_RWLock_Unlock(sid->u.ssl3.lock); + } + /* set error card removal/insertion error */ + PORT_SetError(SSL_ERROR_TOKEN_INSERTION_REMOVAL); + return SECFailure; + } + rv = ssl3_AppendHandshakeNumber(ss, suite->cipher_suite, + sizeof(ssl3CipherSuite)); + if (rv != SECSuccess) { + if (sid->u.ssl3.lock) { + PR_RWLock_Unlock(sid->u.ssl3.lock); + } + return rv; /* err set by ssl3_AppendHandshake* */ + } + } + } + + /* if cards were removed or inserted between count_cipher_suites and + * generating our list, detect the error here rather than send it off to + * the server.. */ + if (actual_count != num_suites) { + /* Card removal/insertion error */ + if (sid->u.ssl3.lock) { + PR_RWLock_Unlock(sid->u.ssl3.lock); + } + PORT_SetError(SSL_ERROR_TOKEN_INSERTION_REMOVAL); + return SECFailure; + } + + rv = ssl3_AppendHandshakeNumber(ss, numCompressionMethods, 1); + if (rv != SECSuccess) { + if (sid->u.ssl3.lock) { + PR_RWLock_Unlock(sid->u.ssl3.lock); + } + return rv; /* err set by ssl3_AppendHandshake* */ + } + for (i = 0; i < ssl_compression_method_count; i++) { + if (!ssl_CompressionEnabled(ss, ssl_compression_methods[i])) + continue; + rv = ssl3_AppendHandshakeNumber(ss, ssl_compression_methods[i], 1); + if (rv != SECSuccess) { + if (sid->u.ssl3.lock) { + PR_RWLock_Unlock(sid->u.ssl3.lock); + } + return rv; /* err set by ssl3_AppendHandshake* */ + } + } + + if (total_exten_len) { + PRUint32 maxBytes = total_exten_len - 2; + PRInt32 extLen; + + rv = ssl3_AppendHandshakeNumber(ss, maxBytes, 2); + if (rv != SECSuccess) { + if (sid->u.ssl3.lock) { + PR_RWLock_Unlock(sid->u.ssl3.lock); + } + return rv; /* err set by AppendHandshake. */ + } + + extLen = ssl3_AppendPaddingExtension(ss, paddingExtensionLen, maxBytes); + if (extLen < 0) { + if (sid->u.ssl3.lock) { + PR_RWLock_Unlock(sid->u.ssl3.lock); + } + return SECFailure; + } + maxBytes -= extLen; + + extLen = ssl3_CallHelloExtensionSenders(ss, PR_TRUE, maxBytes, NULL); + if (extLen < 0) { + if (sid->u.ssl3.lock) { + PR_RWLock_Unlock(sid->u.ssl3.lock); + } + return SECFailure; + } + maxBytes -= extLen; + + PORT_Assert(!maxBytes); + } + + if (sid->u.ssl3.lock) { + PR_RWLock_Unlock(sid->u.ssl3.lock); + } + + if (ss->xtnData.sentSessionTicketInClientHello) { + SSL_AtomicIncrementLong(&ssl3stats.sch_sid_stateless_resumes); + } + + if (ss->ssl3.hs.sendingSCSV) { + /* Since we sent the SCSV, pretend we sent empty RI extension. */ + TLSExtensionData *xtnData = &ss->xtnData; + xtnData->advertised[xtnData->numAdvertised++] = + ssl_renegotiation_info_xtn; + } + + flags = 0; + if (!ss->firstHsDone && !IS_DTLS(ss)) { + flags |= ssl_SEND_FLAG_CAP_RECORD_VERSION; + } + rv = ssl3_FlushHandshake(ss, flags); + if (rv != SECSuccess) { + return rv; /* error code set by ssl3_FlushHandshake */ + } + + if (version >= SSL_LIBRARY_VERSION_TLS_1_3) { + rv = tls13_MaybeDo0RTTHandshake(ss); + if (rv != SECSuccess) { + return SECFailure; /* error code set already. */ + } + } + + ss->ssl3.hs.ws = wait_server_hello; + return SECSuccess; +} + +/* Called from ssl3_HandlePostHelloHandshakeMessage() when it has deciphered a + * complete ssl3 Hello Request. + * Caller must hold Handshake and RecvBuf locks. + */ +static SECStatus +ssl3_HandleHelloRequest(sslSocket *ss) +{ + sslSessionID *sid = ss->sec.ci.sid; + SECStatus rv; + + SSL_TRC(3, ("%d: SSL3[%d]: handle hello_request handshake", + SSL_GETPID(), ss->fd)); + + PORT_Assert(ss->opt.noLocks || ssl_HaveRecvBufLock(ss)); + PORT_Assert(ss->opt.noLocks || ssl_HaveSSL3HandshakeLock(ss)); + PORT_Assert(ss->version < SSL_LIBRARY_VERSION_TLS_1_3); + + if (ss->ssl3.hs.ws == wait_server_hello) + return SECSuccess; + if (ss->ssl3.hs.ws != idle_handshake || ss->sec.isServer) { + (void)SSL3_SendAlert(ss, alert_fatal, unexpected_message); + PORT_SetError(SSL_ERROR_RX_UNEXPECTED_HELLO_REQUEST); + return SECFailure; + } + if (ss->opt.enableRenegotiation == SSL_RENEGOTIATE_NEVER) { + (void)SSL3_SendAlert(ss, alert_warning, no_renegotiation); + PORT_SetError(SSL_ERROR_RENEGOTIATION_NOT_ALLOWED); + return SECFailure; + } + + if (sid) { + ss->sec.uncache(sid); + ssl_FreeSID(sid); + ss->sec.ci.sid = NULL; + } + + if (IS_DTLS(ss)) { + dtls_RehandshakeCleanup(ss); + } + + ssl_GetXmitBufLock(ss); + rv = ssl3_SendClientHello(ss, client_hello_renegotiation); + ssl_ReleaseXmitBufLock(ss); + + return rv; +} + +#define UNKNOWN_WRAP_MECHANISM 0x7fffffff + +static const CK_MECHANISM_TYPE wrapMechanismList[SSL_NUM_WRAP_MECHS] = { + CKM_DES3_ECB, + CKM_CAST5_ECB, + CKM_DES_ECB, + CKM_KEY_WRAP_LYNKS, + CKM_IDEA_ECB, + CKM_CAST3_ECB, + CKM_CAST_ECB, + CKM_RC5_ECB, + CKM_RC2_ECB, + CKM_CDMF_ECB, + CKM_SKIPJACK_WRAP, + CKM_SKIPJACK_CBC64, + CKM_AES_ECB, + CKM_CAMELLIA_ECB, + CKM_SEED_ECB, + UNKNOWN_WRAP_MECHANISM +}; + +static int +ssl_FindIndexByWrapMechanism(CK_MECHANISM_TYPE mech) +{ + const CK_MECHANISM_TYPE *pMech = wrapMechanismList; + + while (mech != *pMech && *pMech != UNKNOWN_WRAP_MECHANISM) { + ++pMech; + } + return (*pMech == UNKNOWN_WRAP_MECHANISM) ? -1 + : (pMech - wrapMechanismList); +} + +static PK11SymKey * +ssl_UnwrapSymWrappingKey( + SSLWrappedSymWrappingKey *pWswk, + SECKEYPrivateKey *svrPrivKey, + SSLAuthType authType, + CK_MECHANISM_TYPE masterWrapMech, + void *pwArg) +{ + PK11SymKey *unwrappedWrappingKey = NULL; + SECItem wrappedKey; + PK11SymKey *Ks; + SECKEYPublicKey pubWrapKey; + ECCWrappedKeyInfo *ecWrapped; + + /* found the wrapping key on disk. */ + PORT_Assert(pWswk->symWrapMechanism == masterWrapMech); + PORT_Assert(pWswk->authType == authType); + if (pWswk->symWrapMechanism != masterWrapMech || + pWswk->authType != authType) { + goto loser; + } + wrappedKey.type = siBuffer; + wrappedKey.data = pWswk->wrappedSymmetricWrappingkey; + wrappedKey.len = pWswk->wrappedSymKeyLen; + PORT_Assert(wrappedKey.len <= sizeof pWswk->wrappedSymmetricWrappingkey); + + switch (authType) { + + case ssl_auth_rsa_decrypt: + case ssl_auth_rsa_sign: /* bad: see Bug 1248320 */ + unwrappedWrappingKey = + PK11_PubUnwrapSymKey(svrPrivKey, &wrappedKey, + masterWrapMech, CKA_UNWRAP, 0); + break; + + case ssl_auth_ecdsa: + case ssl_auth_ecdh_rsa: + case ssl_auth_ecdh_ecdsa: + /* + * For ssl_auth_ecd*, we first create an EC public key based on + * data stored with the wrappedSymmetricWrappingkey. Next, + * we do an ECDH computation involving this public key and + * the SSL server's (long-term) EC private key. The resulting + * shared secret is treated the same way as Fortezza's Ks, i.e., + * it is used to recover the symmetric wrapping key. + * + * The data in wrappedSymmetricWrappingkey is laid out as defined + * in the ECCWrappedKeyInfo structure. + */ + ecWrapped = (ECCWrappedKeyInfo *)pWswk->wrappedSymmetricWrappingkey; + + PORT_Assert(ecWrapped->encodedParamLen + ecWrapped->pubValueLen + + ecWrapped->wrappedKeyLen <= + MAX_EC_WRAPPED_KEY_BUFLEN); + + if (ecWrapped->encodedParamLen + ecWrapped->pubValueLen + + ecWrapped->wrappedKeyLen > + MAX_EC_WRAPPED_KEY_BUFLEN) { + PORT_SetError(SEC_ERROR_LIBRARY_FAILURE); + goto loser; + } + + pubWrapKey.keyType = ecKey; + pubWrapKey.u.ec.size = ecWrapped->size; + pubWrapKey.u.ec.DEREncodedParams.len = ecWrapped->encodedParamLen; + pubWrapKey.u.ec.DEREncodedParams.data = ecWrapped->var; + pubWrapKey.u.ec.publicValue.len = ecWrapped->pubValueLen; + pubWrapKey.u.ec.publicValue.data = ecWrapped->var + + ecWrapped->encodedParamLen; + + wrappedKey.len = ecWrapped->wrappedKeyLen; + wrappedKey.data = ecWrapped->var + ecWrapped->encodedParamLen + + ecWrapped->pubValueLen; + + /* Derive Ks using ECDH */ + Ks = PK11_PubDeriveWithKDF(svrPrivKey, &pubWrapKey, PR_FALSE, NULL, + NULL, CKM_ECDH1_DERIVE, masterWrapMech, + CKA_DERIVE, 0, CKD_NULL, NULL, NULL); + if (Ks == NULL) { + goto loser; + } + + /* Use Ks to unwrap the wrapping key */ + unwrappedWrappingKey = PK11_UnwrapSymKey(Ks, masterWrapMech, NULL, + &wrappedKey, masterWrapMech, + CKA_UNWRAP, 0); + PK11_FreeSymKey(Ks); + + break; + + default: + PORT_Assert(0); + PORT_SetError(SEC_ERROR_LIBRARY_FAILURE); + goto loser; + } +loser: + return unwrappedWrappingKey; +} + +/* Each process sharing the server session ID cache has its own array of SymKey + * pointers for the symmetric wrapping keys that are used to wrap the master + * secrets. There is one key for each authentication type. These Symkeys + * correspond to the wrapped SymKeys kept in the server session cache. + */ + +typedef struct { + PK11SymKey *symWrapKey[ssl_auth_size]; +} ssl3SymWrapKey; + +static PZLock *symWrapKeysLock = NULL; +static ssl3SymWrapKey symWrapKeys[SSL_NUM_WRAP_MECHS]; + +SECStatus +ssl_FreeSymWrapKeysLock(void) +{ + if (symWrapKeysLock) { + PZ_DestroyLock(symWrapKeysLock); + symWrapKeysLock = NULL; + return SECSuccess; + } + PORT_SetError(SEC_ERROR_NOT_INITIALIZED); + return SECFailure; +} + +SECStatus +SSL3_ShutdownServerCache(void) +{ + int i, j; + + if (!symWrapKeysLock) + return SECSuccess; /* lock was never initialized */ + PZ_Lock(symWrapKeysLock); + /* get rid of all symWrapKeys */ + for (i = 0; i < SSL_NUM_WRAP_MECHS; ++i) { + for (j = 0; j < ssl_auth_size; ++j) { + PK11SymKey **pSymWrapKey; + pSymWrapKey = &symWrapKeys[i].symWrapKey[j]; + if (*pSymWrapKey) { + PK11_FreeSymKey(*pSymWrapKey); + *pSymWrapKey = NULL; + } + } + } + + PZ_Unlock(symWrapKeysLock); + ssl_FreeSessionCacheLocks(); + return SECSuccess; +} + +SECStatus +ssl_InitSymWrapKeysLock(void) +{ + symWrapKeysLock = PZ_NewLock(nssILockOther); + return symWrapKeysLock ? SECSuccess : SECFailure; +} + +/* Try to get wrapping key for mechanism from in-memory array. + * If that fails, look for one on disk. + * If that fails, generate a new one, put the new one on disk, + * Put the new key in the in-memory array. + * + * Note that this function performs some fairly inadvisable functions with + * certificate private keys. ECDSA keys are used with ECDH; similarly, RSA + * signing keys are used to encrypt. Bug 1248320. + */ +PK11SymKey * +ssl3_GetWrappingKey(sslSocket *ss, + PK11SlotInfo *masterSecretSlot, + const sslServerCert *serverCert, + CK_MECHANISM_TYPE masterWrapMech, + void *pwArg) +{ + SSLAuthType authType; + SECKEYPrivateKey *svrPrivKey; + SECKEYPublicKey *svrPubKey = NULL; + PK11SymKey *unwrappedWrappingKey = NULL; + PK11SymKey **pSymWrapKey; + CK_MECHANISM_TYPE asymWrapMechanism = CKM_INVALID_MECHANISM; + int length; + int symWrapMechIndex; + SECStatus rv; + SECItem wrappedKey; + SSLWrappedSymWrappingKey wswk; + PK11SymKey *Ks = NULL; + SECKEYPublicKey *pubWrapKey = NULL; + SECKEYPrivateKey *privWrapKey = NULL; + ECCWrappedKeyInfo *ecWrapped; + + PORT_Assert(serverCert); + PORT_Assert(serverCert->serverKeyPair); + PORT_Assert(serverCert->serverKeyPair->privKey); + PORT_Assert(serverCert->serverKeyPair->pubKey); + if (!serverCert || !serverCert->serverKeyPair || + !serverCert->serverKeyPair->privKey || + !serverCert->serverKeyPair->pubKey) { + PORT_SetError(SEC_ERROR_LIBRARY_FAILURE); + return NULL; /* hmm */ + } + authType = serverCert->certType.authType; + svrPrivKey = serverCert->serverKeyPair->privKey; + + symWrapMechIndex = ssl_FindIndexByWrapMechanism(masterWrapMech); + PORT_Assert(symWrapMechIndex >= 0); + if (symWrapMechIndex < 0) + return NULL; /* invalid masterWrapMech. */ + + pSymWrapKey = &symWrapKeys[symWrapMechIndex].symWrapKey[authType]; + + ssl_InitSessionCacheLocks(PR_TRUE); + + PZ_Lock(symWrapKeysLock); + + unwrappedWrappingKey = *pSymWrapKey; + if (unwrappedWrappingKey != NULL) { + if (PK11_VerifyKeyOK(unwrappedWrappingKey)) { + unwrappedWrappingKey = PK11_ReferenceSymKey(unwrappedWrappingKey); + goto done; + } + /* slot series has changed, so this key is no good any more. */ + PK11_FreeSymKey(unwrappedWrappingKey); + *pSymWrapKey = unwrappedWrappingKey = NULL; + } + + /* Try to get wrapped SymWrapping key out of the (disk) cache. */ + /* Following call fills in wswk on success. */ + if (ssl_GetWrappingKey(symWrapMechIndex, authType, &wswk)) { + /* found the wrapped sym wrapping key on disk. */ + unwrappedWrappingKey = + ssl_UnwrapSymWrappingKey(&wswk, svrPrivKey, authType, + masterWrapMech, pwArg); + if (unwrappedWrappingKey) { + goto install; + } + } + + if (!masterSecretSlot) /* caller doesn't want to create a new one. */ + goto loser; + + length = PK11_GetBestKeyLength(masterSecretSlot, masterWrapMech); + /* Zero length means fixed key length algorithm, or error. + * It's ambiguous. + */ + unwrappedWrappingKey = PK11_KeyGen(masterSecretSlot, masterWrapMech, NULL, + length, pwArg); + if (!unwrappedWrappingKey) { + goto loser; + } + + /* Prepare the buffer to receive the wrappedWrappingKey, + * the symmetric wrapping key wrapped using the server's pub key. + */ + PORT_Memset(&wswk, 0, sizeof wswk); /* eliminate UMRs. */ + + svrPubKey = serverCert->serverKeyPair->pubKey; + wrappedKey.type = siBuffer; + wrappedKey.len = SECKEY_PublicKeyStrength(svrPubKey); + wrappedKey.data = wswk.wrappedSymmetricWrappingkey; + + PORT_Assert(wrappedKey.len <= sizeof wswk.wrappedSymmetricWrappingkey); + if (wrappedKey.len > sizeof wswk.wrappedSymmetricWrappingkey) + goto loser; + + /* wrap symmetric wrapping key in server's public key. */ + switch (authType) { + case ssl_auth_rsa_decrypt: + case ssl_auth_rsa_sign: /* bad: see Bug 1248320 */ + asymWrapMechanism = CKM_RSA_PKCS; + rv = PK11_PubWrapSymKey(asymWrapMechanism, svrPubKey, + unwrappedWrappingKey, &wrappedKey); + break; + + case ssl_auth_ecdsa: + case ssl_auth_ecdh_rsa: + case ssl_auth_ecdh_ecdsa: + /* + * We generate an ephemeral EC key pair. Perform an ECDH + * computation involving this ephemeral EC public key and + * the SSL server's (long-term) EC private key. The resulting + * shared secret is treated in the same way as Fortezza's Ks, + * i.e., it is used to wrap the wrapping key. To facilitate + * unwrapping in ssl_UnwrapWrappingKey, we also store all + * relevant info about the ephemeral EC public key in + * wswk.wrappedSymmetricWrappingkey and lay it out as + * described in the ECCWrappedKeyInfo structure. + */ + PORT_Assert(SECKEY_GetPublicKeyType(svrPubKey) == ecKey); + if (SECKEY_GetPublicKeyType(svrPubKey) != ecKey) { + /* something is wrong in sslsecur.c if this isn't an ecKey */ + PORT_SetError(SEC_ERROR_LIBRARY_FAILURE); + rv = SECFailure; + goto ec_cleanup; + } + + privWrapKey = SECKEY_CreateECPrivateKey( + &svrPubKey->u.ec.DEREncodedParams, &pubWrapKey, NULL); + if ((privWrapKey == NULL) || (pubWrapKey == NULL)) { + rv = SECFailure; + goto ec_cleanup; + } + + /* Set the key size in bits */ + if (pubWrapKey->u.ec.size == 0) { + pubWrapKey->u.ec.size = SECKEY_PublicKeyStrengthInBits(svrPubKey); + } + + PORT_Assert(pubWrapKey->u.ec.DEREncodedParams.len + + pubWrapKey->u.ec.publicValue.len < + MAX_EC_WRAPPED_KEY_BUFLEN); + if (pubWrapKey->u.ec.DEREncodedParams.len + + pubWrapKey->u.ec.publicValue.len >= + MAX_EC_WRAPPED_KEY_BUFLEN) { + PORT_SetError(SEC_ERROR_INVALID_KEY); + rv = SECFailure; + goto ec_cleanup; + } + + /* Derive Ks using ECDH */ + Ks = PK11_PubDeriveWithKDF(svrPrivKey, pubWrapKey, PR_FALSE, NULL, + NULL, CKM_ECDH1_DERIVE, masterWrapMech, + CKA_DERIVE, 0, CKD_NULL, NULL, NULL); + if (Ks == NULL) { + rv = SECFailure; + goto ec_cleanup; + } + + ecWrapped = (ECCWrappedKeyInfo *)(wswk.wrappedSymmetricWrappingkey); + ecWrapped->size = pubWrapKey->u.ec.size; + ecWrapped->encodedParamLen = pubWrapKey->u.ec.DEREncodedParams.len; + PORT_Memcpy(ecWrapped->var, pubWrapKey->u.ec.DEREncodedParams.data, + pubWrapKey->u.ec.DEREncodedParams.len); + + ecWrapped->pubValueLen = pubWrapKey->u.ec.publicValue.len; + PORT_Memcpy(ecWrapped->var + ecWrapped->encodedParamLen, + pubWrapKey->u.ec.publicValue.data, + pubWrapKey->u.ec.publicValue.len); + + wrappedKey.len = MAX_EC_WRAPPED_KEY_BUFLEN - + (ecWrapped->encodedParamLen + ecWrapped->pubValueLen); + wrappedKey.data = ecWrapped->var + ecWrapped->encodedParamLen + + ecWrapped->pubValueLen; + + /* wrap symmetricWrapping key with the local Ks */ + rv = PK11_WrapSymKey(masterWrapMech, NULL, Ks, + unwrappedWrappingKey, &wrappedKey); + + if (rv != SECSuccess) { + goto ec_cleanup; + } + + /* Write down the length of wrapped key in the buffer + * wswk.wrappedSymmetricWrappingkey at the appropriate offset + */ + ecWrapped->wrappedKeyLen = wrappedKey.len; + + ec_cleanup: + if (privWrapKey) + SECKEY_DestroyPrivateKey(privWrapKey); + if (pubWrapKey) + SECKEY_DestroyPublicKey(pubWrapKey); + if (Ks) + PK11_FreeSymKey(Ks); + asymWrapMechanism = masterWrapMech; + break; + + default: + rv = SECFailure; + break; + } + + if (rv != SECSuccess) { + ssl_MapLowLevelError(SSL_ERROR_CLIENT_KEY_EXCHANGE_FAILURE); + goto loser; + } + + PORT_Assert(asymWrapMechanism != CKM_INVALID_MECHANISM); + + wswk.symWrapMechanism = masterWrapMech; + wswk.symWrapMechIndex = symWrapMechIndex; + wswk.asymWrapMechanism = asymWrapMechanism; + wswk.authType = authType; + wswk.wrappedSymKeyLen = wrappedKey.len; + + /* put it on disk. */ + /* If the wrapping key for this KEA type has already been set, + * then abandon the value we just computed and + * use the one we got from the disk. + */ + if (ssl_SetWrappingKey(&wswk)) { + /* somebody beat us to it. The original contents of our wswk + * has been replaced with the content on disk. Now, discard + * the key we just created and unwrap this new one. + */ + PK11_FreeSymKey(unwrappedWrappingKey); + + unwrappedWrappingKey = + ssl_UnwrapSymWrappingKey(&wswk, svrPrivKey, authType, + masterWrapMech, pwArg); + } + +install: + if (unwrappedWrappingKey) { + *pSymWrapKey = PK11_ReferenceSymKey(unwrappedWrappingKey); + } + +loser: +done: + PZ_Unlock(symWrapKeysLock); + return unwrappedWrappingKey; +} + +#ifdef NSS_ALLOW_SSLKEYLOGFILE +/* hexEncode hex encodes |length| bytes from |in| and writes it as |length*2| + * bytes to |out|. */ +static void +hexEncode(char *out, const unsigned char *in, unsigned int length) +{ + static const char hextable[] = "0123456789abcdef"; + unsigned int i; + + for (i = 0; i < length; i++) { + *(out++) = hextable[in[i] >> 4]; + *(out++) = hextable[in[i] & 15]; + } +} +#endif + +/* Called from ssl3_SendClientKeyExchange(). */ +static SECStatus +ssl3_SendRSAClientKeyExchange(sslSocket *ss, SECKEYPublicKey *svrPubKey) +{ + PK11SymKey *pms = NULL; + SECStatus rv = SECFailure; + SECItem enc_pms = { siBuffer, NULL, 0 }; + PRBool isTLS; + + PORT_Assert(ss->opt.noLocks || ssl_HaveSSL3HandshakeLock(ss)); + PORT_Assert(ss->opt.noLocks || ssl_HaveXmitBufLock(ss)); + + /* Generate the pre-master secret ... */ + ssl_GetSpecWriteLock(ss); + isTLS = (PRBool)(ss->ssl3.pwSpec->version > SSL_LIBRARY_VERSION_3_0); + + pms = ssl3_GenerateRSAPMS(ss, ss->ssl3.pwSpec, NULL); + ssl_ReleaseSpecWriteLock(ss); + if (pms == NULL) { + ssl_MapLowLevelError(SSL_ERROR_CLIENT_KEY_EXCHANGE_FAILURE); + goto loser; + } + + /* Get the wrapped (encrypted) pre-master secret, enc_pms */ + enc_pms.len = SECKEY_PublicKeyStrength(svrPubKey); + enc_pms.data = (unsigned char *)PORT_Alloc(enc_pms.len); + if (enc_pms.data == NULL) { + goto loser; /* err set by PORT_Alloc */ + } + + /* wrap pre-master secret in server's public key. */ + rv = PK11_PubWrapSymKey(CKM_RSA_PKCS, svrPubKey, pms, &enc_pms); + if (rv != SECSuccess) { + ssl_MapLowLevelError(SSL_ERROR_CLIENT_KEY_EXCHANGE_FAILURE); + goto loser; + } + +#ifdef NSS_ALLOW_SSLKEYLOGFILE + if (ssl_keylog_iob) { + SECStatus extractRV = PK11_ExtractKeyValue(pms); + if (extractRV == SECSuccess) { + SECItem *keyData = PK11_GetKeyData(pms); + if (keyData && keyData->data && keyData->len) { +#ifdef TRACE + if (ssl_trace >= 100) { + ssl_PrintBuf(ss, "Pre-Master Secret", + keyData->data, keyData->len); + } +#endif + if (ssl_keylog_iob && enc_pms.len >= 8 && keyData->len == 48) { + /* https://developer.mozilla.org/en/NSS_Key_Log_Format */ + + /* There could be multiple, concurrent writers to the + * keylog, so we have to do everything in a single call to + * fwrite. */ + char buf[4 + 8 * 2 + 1 + 48 * 2 + 1]; + + strcpy(buf, "RSA "); + hexEncode(buf + 4, enc_pms.data, 8); + buf[20] = ' '; + hexEncode(buf + 21, keyData->data, 48); + buf[sizeof(buf) - 1] = '\n'; + + fwrite(buf, sizeof(buf), 1, ssl_keylog_iob); + fflush(ssl_keylog_iob); + } + } + } + } +#endif + + rv = ssl3_AppendHandshakeHeader(ss, client_key_exchange, + isTLS ? enc_pms.len + 2 + : enc_pms.len); + if (rv != SECSuccess) { + goto loser; /* err set by ssl3_AppendHandshake* */ + } + if (isTLS) { + rv = ssl3_AppendHandshakeVariable(ss, enc_pms.data, enc_pms.len, 2); + } else { + rv = ssl3_AppendHandshake(ss, enc_pms.data, enc_pms.len); + } + if (rv != SECSuccess) { + goto loser; /* err set by ssl3_AppendHandshake* */ + } + + rv = ssl3_InitPendingCipherSpec(ss, pms); + PK11_FreeSymKey(pms); + pms = NULL; + + if (rv != SECSuccess) { + ssl_MapLowLevelError(SSL_ERROR_CLIENT_KEY_EXCHANGE_FAILURE); + goto loser; + } + + rv = SECSuccess; + +loser: + if (enc_pms.data != NULL) { + PORT_Free(enc_pms.data); + } + if (pms != NULL) { + PK11_FreeSymKey(pms); + } + return rv; +} + +/* DH shares need to be padded to the size of their prime. Some implementations + * require this. TLS 1.3 also requires this. */ +SECStatus +ssl_AppendPaddedDHKeyShare(const sslSocket *ss, const SECKEYPublicKey *pubKey, + PRBool appendLength) +{ + SECStatus rv; + unsigned int pad = pubKey->u.dh.prime.len - pubKey->u.dh.publicValue.len; + + if (appendLength) { + rv = ssl3_ExtAppendHandshakeNumber(ss, pubKey->u.dh.prime.len, 2); + if (rv != SECSuccess) { + return rv; + } + } + while (pad) { + rv = ssl3_ExtAppendHandshakeNumber(ss, 0, 1); + if (rv != SECSuccess) { + return rv; + } + --pad; + } + rv = ssl3_ExtAppendHandshake(ss, pubKey->u.dh.publicValue.data, + pubKey->u.dh.publicValue.len); + if (rv != SECSuccess) { + return rv; + } + return SECSuccess; +} + +/* Called from ssl3_SendClientKeyExchange(). */ +static SECStatus +ssl3_SendDHClientKeyExchange(sslSocket *ss, SECKEYPublicKey *svrPubKey) +{ + PK11SymKey *pms = NULL; + SECStatus rv; + PRBool isTLS; + CK_MECHANISM_TYPE target; + + const ssl3DHParams *params; + ssl3DHParams customParams; + const sslNamedGroupDef *groupDef; + static const sslNamedGroupDef customGroupDef = { + ssl_grp_ffdhe_custom, 0, ssl_kea_dh, SEC_OID_TLS_DHE_CUSTOM, PR_FALSE + }; + sslEphemeralKeyPair *keyPair = NULL; + SECKEYPublicKey *pubKey; + + PORT_Assert(ss->opt.noLocks || ssl_HaveSSL3HandshakeLock(ss)); + PORT_Assert(ss->opt.noLocks || ssl_HaveXmitBufLock(ss)); + + isTLS = (PRBool)(ss->ssl3.pwSpec->version > SSL_LIBRARY_VERSION_3_0); + + /* Copy DH parameters from server key */ + + if (SECKEY_GetPublicKeyType(svrPubKey) != dhKey) { + PORT_SetError(SEC_ERROR_BAD_KEY); + return SECFailure; + } + + /* Work out the parameters. */ + rv = ssl_ValidateDHENamedGroup(ss, &svrPubKey->u.dh.prime, + &svrPubKey->u.dh.base, + &groupDef, ¶ms); + if (rv != SECSuccess) { + /* If we require named groups, we will have already validated the group + * in ssl_HandleDHServerKeyExchange() */ + PORT_Assert(!ss->opt.requireDHENamedGroups && + !ss->xtnData.peerSupportsFfdheGroups); + + customParams.name = ssl_grp_ffdhe_custom; + customParams.prime.data = svrPubKey->u.dh.prime.data; + customParams.prime.len = svrPubKey->u.dh.prime.len; + customParams.base.data = svrPubKey->u.dh.base.data; + customParams.base.len = svrPubKey->u.dh.base.len; + params = &customParams; + groupDef = &customGroupDef; + } + ss->sec.keaGroup = groupDef; + + rv = ssl_CreateDHEKeyPair(groupDef, params, &keyPair); + if (rv != SECSuccess) { + ssl_MapLowLevelError(SEC_ERROR_KEYGEN_FAIL); + goto loser; + } + pubKey = keyPair->keys->pubKey; + PRINT_BUF(50, (ss, "DH public value:", + pubKey->u.dh.publicValue.data, + pubKey->u.dh.publicValue.len)); + + if (isTLS) + target = CKM_TLS_MASTER_KEY_DERIVE_DH; + else + target = CKM_SSL3_MASTER_KEY_DERIVE_DH; + + /* Determine the PMS */ + pms = PK11_PubDerive(keyPair->keys->privKey, svrPubKey, + PR_FALSE, NULL, NULL, CKM_DH_PKCS_DERIVE, + target, CKA_DERIVE, 0, NULL); + + if (pms == NULL) { + ssl_MapLowLevelError(SSL_ERROR_CLIENT_KEY_EXCHANGE_FAILURE); + goto loser; + } + + /* Note: send the DH share padded to avoid triggering bugs. */ + rv = ssl3_AppendHandshakeHeader(ss, client_key_exchange, + params->prime.len + 2); + if (rv != SECSuccess) { + goto loser; /* err set by ssl3_AppendHandshake* */ + } + rv = ssl_AppendPaddedDHKeyShare(ss, pubKey, PR_TRUE); + if (rv != SECSuccess) { + goto loser; /* err set by ssl_AppendPaddedDHKeyShare */ + } + + rv = ssl3_InitPendingCipherSpec(ss, pms); + if (rv != SECSuccess) { + ssl_MapLowLevelError(SSL_ERROR_CLIENT_KEY_EXCHANGE_FAILURE); + goto loser; + } + + PK11_FreeSymKey(pms); + ssl_FreeEphemeralKeyPair(keyPair); + return SECSuccess; + +loser: + if (pms) + PK11_FreeSymKey(pms); + if (keyPair) + ssl_FreeEphemeralKeyPair(keyPair); + return SECFailure; +} + +/* Called from ssl3_HandleServerHelloDone(). */ +static SECStatus +ssl3_SendClientKeyExchange(sslSocket *ss) +{ + SECKEYPublicKey *serverKey = NULL; + SECStatus rv = SECFailure; + + SSL_TRC(3, ("%d: SSL3[%d]: send client_key_exchange handshake", + SSL_GETPID(), ss->fd)); + + PORT_Assert(ss->opt.noLocks || ssl_HaveXmitBufLock(ss)); + PORT_Assert(ss->opt.noLocks || ssl_HaveSSL3HandshakeLock(ss)); + + if (ss->sec.peerKey == NULL) { + serverKey = CERT_ExtractPublicKey(ss->sec.peerCert); + if (serverKey == NULL) { + ssl_MapLowLevelError(SSL_ERROR_EXTRACT_PUBLIC_KEY_FAILURE); + return SECFailure; + } + } else { + serverKey = ss->sec.peerKey; + ss->sec.peerKey = NULL; /* we're done with it now */ + } + + ss->sec.keaType = ss->ssl3.hs.kea_def->exchKeyType; + ss->sec.keaKeyBits = SECKEY_PublicKeyStrengthInBits(serverKey); + + switch (ss->ssl3.hs.kea_def->exchKeyType) { + case ssl_kea_rsa: + rv = ssl3_SendRSAClientKeyExchange(ss, serverKey); + break; + + case ssl_kea_dh: + rv = ssl3_SendDHClientKeyExchange(ss, serverKey); + break; + + case ssl_kea_ecdh: + rv = ssl3_SendECDHClientKeyExchange(ss, serverKey); + break; + + default: + PORT_Assert(0); + PORT_SetError(SEC_ERROR_LIBRARY_FAILURE); + break; + } + + SSL_TRC(3, ("%d: SSL3[%d]: DONE sending client_key_exchange", + SSL_GETPID(), ss->fd)); + + SECKEY_DestroyPublicKey(serverKey); + return rv; /* err code already set. */ +} + +SECStatus +ssl_PickSignatureScheme(sslSocket *ss, + SECKEYPublicKey *pubKey, + SECKEYPrivateKey *privKey, + const SSLSignatureScheme *peerSchemes, + unsigned int peerSchemeCount, + PRBool requireSha1) +{ + unsigned int i, j; + const sslNamedGroupDef *group = NULL; + KeyType keyType; + PK11SlotInfo *slot; + PRBool slotDoesPss; + PRBool isTLS13 = ss->version >= SSL_LIBRARY_VERSION_TLS_1_3; + + /* We can't require SHA-1 in TLS 1.3. */ + PORT_Assert(!(requireSha1 && isTLS13)); + if (!pubKey || !privKey) { + PORT_Assert(0); + PORT_SetError(SEC_ERROR_LIBRARY_FAILURE); + return SECFailure; + } + + slot = PK11_GetSlotFromPrivateKey(privKey); + if (!slot) { + PORT_SetError(SEC_ERROR_LIBRARY_FAILURE); + return SECFailure; + } + slotDoesPss = PK11_DoesMechanism(slot, auth_alg_defs[ssl_auth_rsa_pss]); + PK11_FreeSlot(slot); + + keyType = SECKEY_GetPublicKeyType(pubKey); + if (keyType == ecKey) { + group = ssl_ECPubKey2NamedGroup(pubKey); + } + + /* Here we look for the first local preference that the client has + * indicated support for in their signature_algorithms extension. */ + for (i = 0; i < ss->ssl3.signatureSchemeCount; ++i) { + SSLHashType hashType; + SECOidTag hashOID; + SSLSignatureScheme preferred = ss->ssl3.signatureSchemes[i]; + PRUint32 policy; + + if (!ssl_SignatureSchemeValidForKey(!isTLS13 /* allowSha1 */, + isTLS13 /* matchGroup */, + keyType, group, preferred)) { + continue; + } + + /* Skip RSA-PSS schemes when the certificate's private key slot does + * not support this signature mechanism. */ + if (ssl_IsRsaPssSignatureScheme(preferred) && !slotDoesPss) { + continue; + } + + hashType = ssl_SignatureSchemeToHashType(preferred); + if (requireSha1 && (hashType != ssl_hash_sha1)) { + continue; + } + hashOID = ssl3_HashTypeToOID(hashType); + if ((NSS_GetAlgorithmPolicy(hashOID, &policy) == SECSuccess) && + !(policy & NSS_USE_ALG_IN_SSL_KX)) { + /* we ignore hashes we don't support */ + continue; + } + + for (j = 0; j < peerSchemeCount; j++) { + if (peerSchemes[j] == preferred) { + ss->ssl3.hs.signatureScheme = preferred; + return SECSuccess; + } + } + } + + PORT_SetError(SSL_ERROR_UNSUPPORTED_SIGNATURE_ALGORITHM); + return SECFailure; +} + +/* ssl3_PickServerSignatureScheme selects a signature scheme for signing the + * handshake. Most of this is determined by the key pair we are using. + * Prior to TLS 1.2, the MD5/SHA1 combination is always used. With TLS 1.2, a + * client may advertise its support for signature and hash combinations. */ +static SECStatus +ssl3_PickServerSignatureScheme(sslSocket *ss) +{ + sslKeyPair *keyPair = ss->sec.serverCert->serverKeyPair; + PRBool isTLS12 = ss->version >= SSL_LIBRARY_VERSION_TLS_1_2; + + if (!isTLS12 || !ssl3_ExtensionNegotiated(ss, ssl_signature_algorithms_xtn)) { + /* If the client didn't provide any signature_algorithms extension then + * we can assume that they support SHA-1: RFC5246, Section 7.4.1.4.1. */ + switch (SECKEY_GetPublicKeyType(keyPair->pubKey)) { + case rsaKey: + if (isTLS12) { + ss->ssl3.hs.signatureScheme = ssl_sig_rsa_pkcs1_sha1; + } else { + ss->ssl3.hs.signatureScheme = ssl_sig_rsa_pkcs1_sha1md5; + } + break; + case ecKey: + ss->ssl3.hs.signatureScheme = ssl_sig_ecdsa_sha1; + break; + case dsaKey: + ss->ssl3.hs.signatureScheme = ssl_sig_dsa_sha1; + break; + default: + PORT_Assert(0); + PORT_SetError(SEC_ERROR_INVALID_KEY); + return SECFailure; + } + return SECSuccess; + } + + /* Sets error code, if needed. */ + return ssl_PickSignatureScheme(ss, keyPair->pubKey, keyPair->privKey, + ss->xtnData.clientSigSchemes, + ss->xtnData.numClientSigScheme, + PR_FALSE /* requireSha1 */); +} + +static SECStatus +ssl_PickClientSignatureScheme(sslSocket *ss, const SSLSignatureScheme *schemes, + unsigned int numSchemes) +{ + SECKEYPrivateKey *privKey = ss->ssl3.clientPrivateKey; + SECKEYPublicKey *pubKey; + SECStatus rv; + + pubKey = CERT_ExtractPublicKey(ss->ssl3.clientCertificate); + PORT_Assert(pubKey); + if (ss->version < SSL_LIBRARY_VERSION_TLS_1_3 && + (SECKEY_GetPublicKeyType(pubKey) == rsaKey || + SECKEY_GetPublicKeyType(pubKey) == dsaKey) && + SECKEY_PublicKeyStrengthInBits(pubKey) <= 1024) { + /* If the key is a 1024-bit RSA or DSA key, assume conservatively that + * it may be unable to sign SHA-256 hashes. This is the case for older + * Estonian ID cards that have 1024-bit RSA keys. In FIPS 186-2 and + * older, DSA key size is at most 1024 bits and the hash function must + * be SHA-1. + */ + rv = ssl_PickSignatureScheme(ss, pubKey, privKey, schemes, numSchemes, + PR_TRUE /* requireSha1 */); + if (rv == SECSuccess) { + SECKEY_DestroyPublicKey(pubKey); + return SECSuccess; + } + /* If this fails, that's because the peer doesn't advertise SHA-1, + * so fall back to the full negotiation. */ + } + rv = ssl_PickSignatureScheme(ss, pubKey, privKey, schemes, numSchemes, + PR_FALSE /* requireSha1 */); + SECKEY_DestroyPublicKey(pubKey); + return rv; +} + +/* Called from ssl3_HandleServerHelloDone(). */ +static SECStatus +ssl3_SendCertificateVerify(sslSocket *ss, SECKEYPrivateKey *privKey) +{ + SECStatus rv = SECFailure; + PRBool isTLS12; + SECItem buf = { siBuffer, NULL, 0 }; + SSL3Hashes hashes; + unsigned int len; + SSLHashType hashAlg; + + PORT_Assert(ss->opt.noLocks || ssl_HaveXmitBufLock(ss)); + PORT_Assert(ss->opt.noLocks || ssl_HaveSSL3HandshakeLock(ss)); + + SSL_TRC(3, ("%d: SSL3[%d]: send certificate_verify handshake", + SSL_GETPID(), ss->fd)); + + ssl_GetSpecReadLock(ss); + + if (ss->ssl3.hs.hashType == handshake_hash_record) { + hashAlg = ssl_SignatureSchemeToHashType(ss->ssl3.hs.signatureScheme); + } else { + /* Use ssl_hash_none to represent the MD5+SHA1 combo. */ + hashAlg = ssl_hash_none; + } + if (ss->ssl3.hs.hashType == handshake_hash_record && + hashAlg != ssl3_GetSuitePrfHash(ss)) { + rv = ssl3_ComputeHandshakeHash(ss->ssl3.hs.messages.buf, + ss->ssl3.hs.messages.len, + hashAlg, &hashes); + if (rv != SECSuccess) { + ssl_MapLowLevelError(SSL_ERROR_DIGEST_FAILURE); + } + } else { + rv = ssl3_ComputeHandshakeHashes(ss, ss->ssl3.pwSpec, &hashes, 0); + } + ssl_ReleaseSpecReadLock(ss); + if (rv != SECSuccess) { + goto done; /* err code was set by ssl3_ComputeHandshakeHash(es) */ + } + + isTLS12 = (PRBool)(ss->version == SSL_LIBRARY_VERSION_TLS_1_2); + PORT_Assert(ss->version <= SSL_LIBRARY_VERSION_TLS_1_2); + + rv = ssl3_SignHashes(ss, &hashes, privKey, &buf); + if (rv == SECSuccess && !ss->sec.isServer) { + /* Remember the info about the slot that did the signing. + ** Later, when doing an SSL restart handshake, verify this. + ** These calls are mere accessors, and can't fail. + */ + PK11SlotInfo *slot; + sslSessionID *sid = ss->sec.ci.sid; + + slot = PK11_GetSlotFromPrivateKey(privKey); + sid->u.ssl3.clAuthSeries = PK11_GetSlotSeries(slot); + sid->u.ssl3.clAuthSlotID = PK11_GetSlotID(slot); + sid->u.ssl3.clAuthModuleID = PK11_GetModuleID(slot); + sid->u.ssl3.clAuthValid = PR_TRUE; + PK11_FreeSlot(slot); + } + if (rv != SECSuccess) { + goto done; /* err code was set by ssl3_SignHashes */ + } + + len = buf.len + 2 + (isTLS12 ? 2 : 0); + + rv = ssl3_AppendHandshakeHeader(ss, certificate_verify, len); + if (rv != SECSuccess) { + goto done; /* error code set by AppendHandshake */ + } + if (isTLS12) { + rv = ssl3_AppendHandshakeNumber(ss, ss->ssl3.hs.signatureScheme, 2); + if (rv != SECSuccess) { + goto done; /* err set by AppendHandshake. */ + } + } + rv = ssl3_AppendHandshakeVariable(ss, buf.data, buf.len, 2); + if (rv != SECSuccess) { + goto done; /* error code set by AppendHandshake */ + } + +done: + if (buf.data) + PORT_Free(buf.data); + return rv; +} + +/* Once a cipher suite has been selected, make sure that the necessary secondary + * information is properly set. */ +SECStatus +ssl3_SetCipherSuite(sslSocket *ss, ssl3CipherSuite chosenSuite, + PRBool initHashes) +{ + ss->ssl3.hs.cipher_suite = chosenSuite; + ss->ssl3.hs.suite_def = ssl_LookupCipherSuiteDef(chosenSuite); + if (!ss->ssl3.hs.suite_def) { + PORT_Assert(0); + PORT_SetError(SEC_ERROR_LIBRARY_FAILURE); + return SECFailure; + } + + ss->ssl3.hs.kea_def = &kea_defs[ss->ssl3.hs.suite_def->key_exchange_alg]; + ss->ssl3.hs.preliminaryInfo |= ssl_preinfo_cipher_suite; + + if (!initHashes) { + return SECSuccess; + } + /* Now we've have a cipher suite, initialize the handshake hashes. */ + return ssl3_InitHandshakeHashes(ss); +} + +/* Called from ssl3_HandleHandshakeMessage() when it has deciphered a complete + * ssl3 ServerHello message. + * Caller must hold Handshake and RecvBuf locks. + */ +static SECStatus +ssl3_HandleServerHello(sslSocket *ss, SSL3Opaque *b, PRUint32 length) +{ + PRInt32 temp; /* allow for consume number failure */ + PRBool suite_found = PR_FALSE; + int i; + int errCode = SSL_ERROR_RX_MALFORMED_SERVER_HELLO; + SECStatus rv; + SECItem sidBytes = { siBuffer, NULL, 0 }; + PRBool isTLS = PR_FALSE; + SSL3AlertDescription desc = illegal_parameter; +#ifndef TLS_1_3_DRAFT_VERSION + SSL3ProtocolVersion downgradeCheckVersion; +#endif + + SSL_TRC(3, ("%d: SSL3[%d]: handle server_hello handshake", + SSL_GETPID(), ss->fd)); + PORT_Assert(ss->opt.noLocks || ssl_HaveRecvBufLock(ss)); + PORT_Assert(ss->opt.noLocks || ssl_HaveSSL3HandshakeLock(ss)); + PORT_Assert(ss->ssl3.initialized); + + if (ss->ssl3.hs.ws != wait_server_hello) { + errCode = SSL_ERROR_RX_UNEXPECTED_SERVER_HELLO; + desc = unexpected_message; + goto alert_loser; + } + + /* clean up anything left from previous handshake. */ + if (ss->ssl3.clientCertChain != NULL) { + CERT_DestroyCertificateList(ss->ssl3.clientCertChain); + ss->ssl3.clientCertChain = NULL; + } + if (ss->ssl3.clientCertificate != NULL) { + CERT_DestroyCertificate(ss->ssl3.clientCertificate); + ss->ssl3.clientCertificate = NULL; + } + if (ss->ssl3.clientPrivateKey != NULL) { + SECKEY_DestroyPrivateKey(ss->ssl3.clientPrivateKey); + ss->ssl3.clientPrivateKey = NULL; + } + + rv = ssl_ClientReadVersion(ss, &b, &length, &ss->version); + if (rv != SECSuccess) { + goto loser; /* alert has been sent */ + } + + /* We got a HelloRetryRequest, but the server didn't pick 1.3. Scream. */ + if (ss->ssl3.hs.helloRetry && ss->version < SSL_LIBRARY_VERSION_TLS_1_3) { + desc = illegal_parameter; + errCode = SSL_ERROR_RX_MALFORMED_SERVER_HELLO; + goto alert_loser; + } + + /* Check that the server negotiated the same version as it did + * in the first handshake. This isn't really the best place for + * us to be getting this version number, but it's what we have. + * (1294697). */ + if (ss->firstHsDone && (ss->version != ss->ssl3.crSpec->version)) { + desc = illegal_parameter; + errCode = SSL_ERROR_UNSUPPORTED_VERSION; + goto alert_loser; + } + ss->ssl3.hs.preliminaryInfo |= ssl_preinfo_version; + isTLS = (ss->version > SSL_LIBRARY_VERSION_3_0); + + rv = ssl3_ConsumeHandshake( + ss, &ss->ssl3.hs.server_random, SSL3_RANDOM_LENGTH, &b, &length); + if (rv != SECSuccess) { + goto loser; /* alert has been sent */ + } + +#ifndef TLS_1_3_DRAFT_VERSION + /* Check the ServerHello.random per + * [draft-ietf-tls-tls13-11 Section 6.3.1.1]. + * + * TLS 1.3 clients receiving a TLS 1.2 or below ServerHello MUST check + * that the top eight octets are not equal to either of these values. + * TLS 1.2 clients SHOULD also perform this check if the ServerHello + * indicates TLS 1.1 or below. If a match is found the client MUST + * abort the handshake with a fatal "illegal_parameter" alert. + * + * Disable this test during the TLS 1.3 draft version period. + */ + downgradeCheckVersion = ss->ssl3.downgradeCheckVersion ? ss->ssl3.downgradeCheckVersion + : ss->vrange.max; + + if (downgradeCheckVersion >= SSL_LIBRARY_VERSION_TLS_1_2 && + downgradeCheckVersion > ss->version) { + /* Both sections use the same sentinel region. */ + unsigned char *downgrade_sentinel = + ss->ssl3.hs.server_random.rand + + SSL3_RANDOM_LENGTH - sizeof(tls13_downgrade_random); + if (!PORT_Memcmp(downgrade_sentinel, + tls13_downgrade_random, + sizeof(tls13_downgrade_random)) || + !PORT_Memcmp(downgrade_sentinel, + tls12_downgrade_random, + sizeof(tls12_downgrade_random))) { + desc = illegal_parameter; + errCode = SSL_ERROR_RX_MALFORMED_SERVER_HELLO; + goto alert_loser; + } + } +#endif + + if (ss->version < SSL_LIBRARY_VERSION_TLS_1_3) { + rv = ssl3_ConsumeHandshakeVariable(ss, &sidBytes, 1, &b, &length); + if (rv != SECSuccess) { + goto loser; /* alert has been sent */ + } + if (sidBytes.len > SSL3_SESSIONID_BYTES) { + if (isTLS) + desc = decode_error; + goto alert_loser; /* malformed. */ + } + } + + /* find selected cipher suite in our list. */ + temp = ssl3_ConsumeHandshakeNumber(ss, 2, &b, &length); + if (temp < 0) { + goto loser; /* alert has been sent */ + } + i = ssl3_config_match_init(ss); + PORT_Assert(i > 0); + if (i <= 0) { + errCode = PORT_GetError(); + goto loser; + } + for (i = 0; i < ssl_V3_SUITES_IMPLEMENTED; i++) { + ssl3CipherSuiteCfg *suite = &ss->cipherSuites[i]; + if (temp == suite->cipher_suite) { + SSLVersionRange vrange = { ss->version, ss->version }; + if (!config_match(suite, ss->ssl3.policy, &vrange, ss)) { + /* config_match already checks whether the cipher suite is + * acceptable for the version, but the check is repeated here + * in order to give a more precise error code. */ + if (!ssl3_CipherSuiteAllowedForVersionRange(temp, &vrange)) { + desc = handshake_failure; + errCode = SSL_ERROR_CIPHER_DISALLOWED_FOR_VERSION; + goto alert_loser; + } + + break; /* failure */ + } + + suite_found = PR_TRUE; + break; /* success */ + } + } + if (!suite_found) { + desc = handshake_failure; + errCode = SSL_ERROR_NO_CYPHER_OVERLAP; + goto alert_loser; + } + + rv = ssl3_SetCipherSuite(ss, (ssl3CipherSuite)temp, PR_TRUE); + if (rv != SECSuccess) { + desc = internal_error; + errCode = PORT_GetError(); + goto alert_loser; + } + + if (ss->version < SSL_LIBRARY_VERSION_TLS_1_3) { + /* find selected compression method in our list. */ + temp = ssl3_ConsumeHandshakeNumber(ss, 1, &b, &length); + if (temp < 0) { + goto loser; /* alert has been sent */ + } + suite_found = PR_FALSE; + for (i = 0; i < ssl_compression_method_count; i++) { + if (temp == ssl_compression_methods[i]) { + if (!ssl_CompressionEnabled(ss, ssl_compression_methods[i])) { + break; /* failure */ + } + suite_found = PR_TRUE; + break; /* success */ + } + } + if (!suite_found) { + desc = handshake_failure; + errCode = SSL_ERROR_NO_COMPRESSION_OVERLAP; + goto alert_loser; + } + ss->ssl3.hs.compression = (SSLCompressionMethod)temp; + } else { + ss->ssl3.hs.compression = ssl_compression_null; + } + + /* Note that if !isTLS and the extra stuff is not extensions, we + * do NOT goto alert_loser. + * There are some old SSL 3.0 implementations that do send stuff + * after the end of the server hello, and we deliberately ignore + * such stuff in the interest of maximal interoperability (being + * "generous in what you accept"). + * Update: Starting in NSS 3.12.6, we handle the renegotiation_info + * extension in SSL 3.0. + */ + if (length != 0) { + SECItem extensions; + rv = ssl3_ConsumeHandshakeVariable(ss, &extensions, 2, &b, &length); + if (rv != SECSuccess || length != 0) { + if (isTLS) + goto alert_loser; + } else { + rv = ssl3_HandleExtensions(ss, &extensions.data, + &extensions.len, server_hello); + if (rv != SECSuccess) + goto alert_loser; + } + } + + if (ss->version >= SSL_LIBRARY_VERSION_TLS_1_3) { + rv = tls13_HandleServerHelloPart2(ss); + if (rv != SECSuccess) { + errCode = PORT_GetError(); + goto loser; + } + } else { + rv = ssl3_HandleServerHelloPart2(ss, &sidBytes, &errCode); + if (rv != SECSuccess) + goto loser; + } + + return SECSuccess; + +alert_loser: + (void)SSL3_SendAlert(ss, alert_fatal, desc); + +loser: + /* Clean up the temporary pointer to the handshake buffer. */ + ss->xtnData.signedCertTimestamps.len = 0; + ssl_MapLowLevelError(errCode); + return SECFailure; +} + +static SECStatus +ssl3_HandleServerHelloPart2(sslSocket *ss, const SECItem *sidBytes, + int *retErrCode) +{ + SSL3AlertDescription desc = handshake_failure; + int errCode = SSL_ERROR_RX_MALFORMED_SERVER_HELLO; + SECStatus rv; + PRBool sid_match; + sslSessionID *sid = ss->sec.ci.sid; + + if ((ss->opt.requireSafeNegotiation || + (ss->firstHsDone && (ss->peerRequestedProtection || + ss->opt.enableRenegotiation == + SSL_RENEGOTIATE_REQUIRES_XTN))) && + !ssl3_ExtensionNegotiated(ss, ssl_renegotiation_info_xtn)) { + desc = handshake_failure; + errCode = ss->firstHsDone ? SSL_ERROR_RENEGOTIATION_NOT_ALLOWED + : SSL_ERROR_UNSAFE_NEGOTIATION; + goto alert_loser; + } + + /* Any errors after this point are not "malformed" errors. */ + desc = handshake_failure; + + /* we need to call ssl3_SetupPendingCipherSpec here so we can check the + * key exchange algorithm. */ + rv = ssl3_SetupPendingCipherSpec(ss); + if (rv != SECSuccess) { + goto alert_loser; /* error code is set. */ + } + + /* We may or may not have sent a session id, we may get one back or + * not and if so it may match the one we sent. + * Attempt to restore the master secret to see if this is so... + * Don't consider failure to find a matching SID an error. + */ + sid_match = (PRBool)(sidBytes->len > 0 && + sidBytes->len == + sid->u.ssl3.sessionIDLength && + !PORT_Memcmp(sid->u.ssl3.sessionID, + sidBytes->data, sidBytes->len)); + + if (sid_match) { + if (sid->version != ss->version || + sid->u.ssl3.cipherSuite != ss->ssl3.hs.cipher_suite) { + errCode = SSL_ERROR_RX_MALFORMED_SERVER_HELLO; + goto alert_loser; + } + do { + ssl3CipherSpec *pwSpec = ss->ssl3.pwSpec; + + SECItem wrappedMS; /* wrapped master secret. */ + + /* [draft-ietf-tls-session-hash-06; Section 5.3] + * + * o If the original session did not use the "extended_master_secret" + * extension but the new ServerHello contains the extension, the + * client MUST abort the handshake. + */ + if (!sid->u.ssl3.keys.extendedMasterSecretUsed && + ssl3_ExtensionNegotiated(ss, ssl_extended_master_secret_xtn)) { + errCode = SSL_ERROR_UNEXPECTED_EXTENDED_MASTER_SECRET; + goto alert_loser; + } + + /* + * o If the original session used an extended master secret but the new + * ServerHello does not contain the "extended_master_secret" + * extension, the client SHOULD abort the handshake. + * + * TODO(ekr@rtfm.com): Add option to refuse to resume when EMS is not + * used at all (bug 1176526). + */ + if (sid->u.ssl3.keys.extendedMasterSecretUsed && + !ssl3_ExtensionNegotiated(ss, ssl_extended_master_secret_xtn)) { + errCode = SSL_ERROR_MISSING_EXTENDED_MASTER_SECRET; + goto alert_loser; + } + + ss->sec.authType = sid->authType; + ss->sec.authKeyBits = sid->authKeyBits; + ss->sec.keaType = sid->keaType; + ss->sec.keaKeyBits = sid->keaKeyBits; + + if (sid->u.ssl3.keys.msIsWrapped) { + PK11SlotInfo *slot; + PK11SymKey *wrapKey; /* wrapping key */ + CK_FLAGS keyFlags = 0; + + /* unwrap master secret */ + slot = SECMOD_LookupSlot(sid->u.ssl3.masterModuleID, + sid->u.ssl3.masterSlotID); + if (slot == NULL) { + break; /* not considered an error. */ + } + if (!PK11_IsPresent(slot)) { + PK11_FreeSlot(slot); + break; /* not considered an error. */ + } + wrapKey = PK11_GetWrapKey(slot, sid->u.ssl3.masterWrapIndex, + sid->u.ssl3.masterWrapMech, + sid->u.ssl3.masterWrapSeries, + ss->pkcs11PinArg); + PK11_FreeSlot(slot); + if (wrapKey == NULL) { + break; /* not considered an error. */ + } + + if (ss->version > SSL_LIBRARY_VERSION_3_0) { /* isTLS */ + keyFlags = + CKF_SIGN | CKF_VERIFY; + } + + wrappedMS.data = sid->u.ssl3.keys.wrapped_master_secret; + wrappedMS.len = sid->u.ssl3.keys.wrapped_master_secret_len; + pwSpec->master_secret = + PK11_UnwrapSymKeyWithFlags(wrapKey, sid->u.ssl3.masterWrapMech, + NULL, &wrappedMS, CKM_SSL3_MASTER_KEY_DERIVE, + CKA_DERIVE, sizeof(SSL3MasterSecret), keyFlags); + errCode = PORT_GetError(); + PK11_FreeSymKey(wrapKey); + if (pwSpec->master_secret == NULL) { + break; /* errorCode set just after call to UnwrapSymKey. */ + } + } else { + /* need to import the raw master secret to session object */ + PK11SlotInfo *slot = PK11_GetInternalSlot(); + wrappedMS.data = sid->u.ssl3.keys.wrapped_master_secret; + wrappedMS.len = sid->u.ssl3.keys.wrapped_master_secret_len; + pwSpec->master_secret = + PK11_ImportSymKey(slot, CKM_SSL3_MASTER_KEY_DERIVE, + PK11_OriginUnwrap, CKA_ENCRYPT, + &wrappedMS, NULL); + PK11_FreeSlot(slot); + if (pwSpec->master_secret == NULL) { + break; + } + } + + /* Got a Match */ + SSL_AtomicIncrementLong(&ssl3stats.hsh_sid_cache_hits); + + /* If we sent a session ticket, then this is a stateless resume. */ + if (ss->xtnData.sentSessionTicketInClientHello) + SSL_AtomicIncrementLong(&ssl3stats.hsh_sid_stateless_resumes); + + if (ssl3_ExtensionNegotiated(ss, ssl_session_ticket_xtn)) + ss->ssl3.hs.ws = wait_new_session_ticket; + else + ss->ssl3.hs.ws = wait_change_cipher; + + ss->ssl3.hs.isResuming = PR_TRUE; + + /* copy the peer cert from the SID */ + if (sid->peerCert != NULL) { + ss->sec.peerCert = CERT_DupCertificate(sid->peerCert); + } + + /* NULL value for PMS because we are reusing the old MS */ + rv = ssl3_InitPendingCipherSpec(ss, NULL); + if (rv != SECSuccess) { + goto alert_loser; /* err code was set */ + } + return SECSuccess; + } while (0); + } + + if (sid_match) + SSL_AtomicIncrementLong(&ssl3stats.hsh_sid_cache_not_ok); + else + SSL_AtomicIncrementLong(&ssl3stats.hsh_sid_cache_misses); + + /* throw the old one away */ + sid->u.ssl3.keys.resumable = PR_FALSE; + ss->sec.uncache(sid); + ssl_FreeSID(sid); + + /* get a new sid */ + ss->sec.ci.sid = sid = ssl3_NewSessionID(ss, PR_FALSE); + if (sid == NULL) { + goto alert_loser; /* memory error is set. */ + } + + sid->version = ss->version; + sid->u.ssl3.sessionIDLength = sidBytes->len; + if (sidBytes->len > 0) { + PORT_Memcpy(sid->u.ssl3.sessionID, sidBytes->data, sidBytes->len); + } + + sid->u.ssl3.keys.extendedMasterSecretUsed = + ssl3_ExtensionNegotiated(ss, ssl_extended_master_secret_xtn); + + /* Copy Signed Certificate Timestamps, if any. */ + if (ss->xtnData.signedCertTimestamps.len) { + rv = SECITEM_CopyItem(NULL, &sid->u.ssl3.signedCertTimestamps, + &ss->xtnData.signedCertTimestamps); + ss->xtnData.signedCertTimestamps.len = 0; + if (rv != SECSuccess) + goto loser; + } + + ss->ssl3.hs.isResuming = PR_FALSE; + if (ss->ssl3.hs.kea_def->authKeyType != ssl_auth_null) { + /* All current cipher suites other than those with ssl_auth_null (i.e., + * (EC)DH_anon_* suites) require a certificate, so use that signal. */ + ss->ssl3.hs.ws = wait_server_cert; + } else { + /* All the remaining cipher suites must be (EC)DH_anon_* and so + * must be ephemeral. Note, if we ever add PSK this might + * change. */ + PORT_Assert(ss->ssl3.hs.kea_def->ephemeral); + ss->ssl3.hs.ws = wait_server_key; + } + return SECSuccess; + +alert_loser: + (void)SSL3_SendAlert(ss, alert_fatal, desc); + +loser: + *retErrCode = errCode; + return SECFailure; +} + +static SECStatus +ssl_HandleDHServerKeyExchange(sslSocket *ss, SSL3Opaque *b, PRUint32 length) +{ + SECStatus rv; + int errCode = SSL_ERROR_RX_MALFORMED_SERVER_KEY_EXCH; + SSL3AlertDescription desc = illegal_parameter; + SSLHashType hashAlg; + PRBool isTLS = ss->ssl3.prSpec->version > SSL_LIBRARY_VERSION_3_0; + SSLSignatureScheme sigScheme; + + SECItem dh_p = { siBuffer, NULL, 0 }; + SECItem dh_g = { siBuffer, NULL, 0 }; + SECItem dh_Ys = { siBuffer, NULL, 0 }; + unsigned dh_p_bits; + unsigned dh_g_bits; + PRInt32 minDH; + + SSL3Hashes hashes; + SECItem signature = { siBuffer, NULL, 0 }; + PLArenaPool *arena = NULL; + SECKEYPublicKey *peerKey = NULL; + + rv = ssl3_ConsumeHandshakeVariable(ss, &dh_p, 2, &b, &length); + if (rv != SECSuccess) { + goto loser; /* malformed. */ + } + + rv = NSS_OptionGet(NSS_DH_MIN_KEY_SIZE, &minDH); + if (rv != SECSuccess) { + minDH = SSL_DH_MIN_P_BITS; + } + dh_p_bits = SECKEY_BigIntegerBitLength(&dh_p); + if (dh_p_bits < minDH) { + errCode = SSL_ERROR_WEAK_SERVER_EPHEMERAL_DH_KEY; + goto alert_loser; + } + rv = ssl3_ConsumeHandshakeVariable(ss, &dh_g, 2, &b, &length); + if (rv != SECSuccess) { + goto loser; /* malformed. */ + } + /* Abort if dh_g is 0, 1, or obviously too big. */ + dh_g_bits = SECKEY_BigIntegerBitLength(&dh_g); + if (dh_g_bits > dh_p_bits || dh_g_bits <= 1) { + goto alert_loser; + } + if (ss->opt.requireDHENamedGroups) { + /* If we're doing named groups, make sure it's good. */ + rv = ssl_ValidateDHENamedGroup(ss, &dh_p, &dh_g, NULL, NULL); + if (rv != SECSuccess) { + errCode = SSL_ERROR_WEAK_SERVER_EPHEMERAL_DH_KEY; + goto alert_loser; + } + } + + rv = ssl3_ConsumeHandshakeVariable(ss, &dh_Ys, 2, &b, &length); + if (rv != SECSuccess) { + goto loser; /* malformed. */ + } + if (!ssl_IsValidDHEShare(&dh_p, &dh_Ys)) { + errCode = SSL_ERROR_RX_MALFORMED_DHE_KEY_SHARE; + goto alert_loser; + } + + if (ss->version >= SSL_LIBRARY_VERSION_TLS_1_2) { + rv = ssl_ConsumeSignatureScheme(ss, &b, &length, &sigScheme); + if (rv != SECSuccess) { + goto loser; /* malformed or unsupported. */ + } + rv = ssl_CheckSignatureSchemeConsistency(ss, sigScheme, + ss->sec.peerCert); + if (rv != SECSuccess) { + goto loser; + } + hashAlg = ssl_SignatureSchemeToHashType(sigScheme); + } else { + /* Use ssl_hash_none to represent the MD5+SHA1 combo. */ + hashAlg = ssl_hash_none; + sigScheme = ssl_sig_none; + } + rv = ssl3_ConsumeHandshakeVariable(ss, &signature, 2, &b, &length); + if (rv != SECSuccess) { + goto loser; /* malformed. */ + } + if (length != 0) { + if (isTLS) { + desc = decode_error; + } + goto alert_loser; /* malformed. */ + } + + PRINT_BUF(60, (NULL, "Server DH p", dh_p.data, dh_p.len)); + PRINT_BUF(60, (NULL, "Server DH g", dh_g.data, dh_g.len)); + PRINT_BUF(60, (NULL, "Server DH Ys", dh_Ys.data, dh_Ys.len)); + + /* failures after this point are not malformed handshakes. */ + /* TLS: send decrypt_error if signature failed. */ + desc = isTLS ? decrypt_error : handshake_failure; + + /* + * Check to make sure the hash is signed by right guy. + */ + rv = ssl3_ComputeDHKeyHash(ss, hashAlg, &hashes, + dh_p, dh_g, dh_Ys, PR_FALSE /* padY */); + if (rv != SECSuccess) { + errCode = + ssl_MapLowLevelError(SSL_ERROR_SERVER_KEY_EXCHANGE_FAILURE); + goto alert_loser; + } + rv = ssl3_VerifySignedHashes(ss, sigScheme, &hashes, &signature); + if (rv != SECSuccess) { + errCode = + ssl_MapLowLevelError(SSL_ERROR_SERVER_KEY_EXCHANGE_FAILURE); + goto alert_loser; + } + + /* + * we really need to build a new key here because we can no longer + * ignore calling SECKEY_DestroyPublicKey. Using the key may allocate + * pkcs11 slots and ID's. + */ + arena = PORT_NewArena(DER_DEFAULT_CHUNKSIZE); + if (arena == NULL) { + errCode = SEC_ERROR_NO_MEMORY; + goto loser; + } + + peerKey = PORT_ArenaZNew(arena, SECKEYPublicKey); + if (peerKey == NULL) { + errCode = SEC_ERROR_NO_MEMORY; + goto loser; + } + + peerKey->arena = arena; + peerKey->keyType = dhKey; + peerKey->pkcs11Slot = NULL; + peerKey->pkcs11ID = CK_INVALID_HANDLE; + + if (SECITEM_CopyItem(arena, &peerKey->u.dh.prime, &dh_p) || + SECITEM_CopyItem(arena, &peerKey->u.dh.base, &dh_g) || + SECITEM_CopyItem(arena, &peerKey->u.dh.publicValue, &dh_Ys)) { + errCode = SEC_ERROR_NO_MEMORY; + goto loser; + } + ss->sec.peerKey = peerKey; + return SECSuccess; + +alert_loser: + (void)SSL3_SendAlert(ss, alert_fatal, desc); +loser: + if (arena) { + PORT_FreeArena(arena, PR_FALSE); + } + PORT_SetError(ssl_MapLowLevelError(errCode)); + return SECFailure; +} + +/* Called from ssl3_HandlePostHelloHandshakeMessage() when it has deciphered a + * complete ssl3 ServerKeyExchange message. + * Caller must hold Handshake and RecvBuf locks. + */ +static SECStatus +ssl3_HandleServerKeyExchange(sslSocket *ss, SSL3Opaque *b, PRUint32 length) +{ + SECStatus rv; + + SSL_TRC(3, ("%d: SSL3[%d]: handle server_key_exchange handshake", + SSL_GETPID(), ss->fd)); + PORT_Assert(ss->opt.noLocks || ssl_HaveRecvBufLock(ss)); + PORT_Assert(ss->opt.noLocks || ssl_HaveSSL3HandshakeLock(ss)); + + if (ss->ssl3.hs.ws != wait_server_key) { + SSL3_SendAlert(ss, alert_fatal, unexpected_message); + PORT_SetError(SSL_ERROR_RX_UNEXPECTED_SERVER_KEY_EXCH); + return SECFailure; + } + + switch (ss->ssl3.hs.kea_def->exchKeyType) { + case ssl_kea_dh: + rv = ssl_HandleDHServerKeyExchange(ss, b, length); + break; + + case ssl_kea_ecdh: + rv = ssl3_HandleECDHServerKeyExchange(ss, b, length); + break; + + default: + SSL3_SendAlert(ss, alert_fatal, handshake_failure); + PORT_SetError(SEC_ERROR_UNSUPPORTED_KEYALG); + rv = SECFailure; + break; + } + + if (rv == SECSuccess) { + ss->ssl3.hs.ws = wait_cert_request; + } + /* All Handle*ServerKeyExchange functions set the error code. */ + return rv; +} + +typedef struct dnameNode { + struct dnameNode *next; + SECItem name; +} dnameNode; + +/* + * Parse the ca_list structure in a CertificateRequest. + * + * Called from: + * ssl3_HandleCertificateRequest + * tls13_HandleCertificateRequest + */ +SECStatus +ssl3_ParseCertificateRequestCAs(sslSocket *ss, SSL3Opaque **b, PRUint32 *length, + PLArenaPool *arena, CERTDistNames *ca_list) +{ + PRInt32 remaining; + int nnames = 0; + dnameNode *node; + int i; + + remaining = ssl3_ConsumeHandshakeNumber(ss, 2, b, length); + if (remaining < 0) + return SECFailure; /* malformed, alert has been sent */ + + if ((PRUint32)remaining > *length) + goto alert_loser; + + ca_list->head = node = PORT_ArenaZNew(arena, dnameNode); + if (node == NULL) + goto no_mem; + + while (remaining > 0) { + PRInt32 len; + + if (remaining < 2) + goto alert_loser; /* malformed */ + + node->name.len = len = ssl3_ConsumeHandshakeNumber(ss, 2, b, length); + if (len <= 0) + return SECFailure; /* malformed, alert has been sent */ + + remaining -= 2; + if (remaining < len) + goto alert_loser; /* malformed */ + + node->name.data = *b; + *b += len; + *length -= len; + remaining -= len; + nnames++; + if (remaining <= 0) + break; /* success */ + + node->next = PORT_ArenaZNew(arena, dnameNode); + node = node->next; + if (node == NULL) + goto no_mem; + } + + ca_list->nnames = nnames; + ca_list->names = PORT_ArenaNewArray(arena, SECItem, nnames); + if (nnames > 0 && ca_list->names == NULL) + goto no_mem; + + for (i = 0, node = (dnameNode *)ca_list->head; + i < nnames; + i++, node = node->next) { + ca_list->names[i] = node->name; + } + + return SECSuccess; + +no_mem: + PORT_SetError(SEC_ERROR_NO_MEMORY); + return SECFailure; + +alert_loser: + (void)SSL3_SendAlert(ss, alert_fatal, + ss->version < SSL_LIBRARY_VERSION_TLS_1_0 ? illegal_parameter + : decode_error); + PORT_SetError(SSL_ERROR_RX_MALFORMED_CERT_REQUEST); + return SECFailure; +} + +SECStatus +ssl_ParseSignatureSchemes(const sslSocket *ss, PLArenaPool *arena, + SSLSignatureScheme **schemesOut, + unsigned int *numSchemesOut, + unsigned char **b, unsigned int *len) +{ + SECStatus rv; + SECItem buf; + SSLSignatureScheme *schemes; + unsigned int numSchemes = 0; + unsigned int max; + + rv = ssl3_ExtConsumeHandshakeVariable(ss, &buf, 2, b, len); + if (rv != SECSuccess) { + return SECFailure; + } + /* An empty or odd-length value is invalid. */ + if (buf.len == 0 || (buf.len & 1) != 0) { + ssl3_ExtSendAlert(ss, alert_fatal, decode_error); + return SECFailure; + } + + /* Limit the number of schemes we read. */ + max = PR_MIN(buf.len / 2, MAX_SIGNATURE_SCHEMES); + + if (arena) { + schemes = PORT_ArenaZNewArray(arena, SSLSignatureScheme, max); + } else { + schemes = PORT_ZNewArray(SSLSignatureScheme, max); + } + if (!schemes) { + ssl3_ExtSendAlert(ss, alert_fatal, internal_error); + return SECFailure; + } + + for (; max; --max) { + PRInt32 tmp; + tmp = ssl3_ExtConsumeHandshakeNumber(ss, 2, &buf.data, &buf.len); + if (tmp < 0) { + PORT_Assert(0); + PORT_SetError(SEC_ERROR_LIBRARY_FAILURE); + return SECFailure; + } + if (ssl_IsSupportedSignatureScheme((SSLSignatureScheme)tmp)) { + schemes[numSchemes++] = (SSLSignatureScheme)tmp; + } + } + + if (!numSchemes) { + if (!arena) { + PORT_Free(schemes); + } + schemes = NULL; + } + + *schemesOut = schemes; + *numSchemesOut = numSchemes; + return SECSuccess; +} + +/* Called from ssl3_HandlePostHelloHandshakeMessage() when it has deciphered + * a complete ssl3 Certificate Request message. + * Caller must hold Handshake and RecvBuf locks. + */ +static SECStatus +ssl3_HandleCertificateRequest(sslSocket *ss, SSL3Opaque *b, PRUint32 length) +{ + PLArenaPool *arena = NULL; + PRBool isTLS = PR_FALSE; + PRBool isTLS12 = PR_FALSE; + int errCode = SSL_ERROR_RX_MALFORMED_CERT_REQUEST; + SECStatus rv; + SSL3AlertDescription desc = illegal_parameter; + SECItem cert_types = { siBuffer, NULL, 0 }; + SSLSignatureScheme *signatureSchemes = NULL; + unsigned int signatureSchemeCount = 0; + CERTDistNames ca_list; + + SSL_TRC(3, ("%d: SSL3[%d]: handle certificate_request handshake", + SSL_GETPID(), ss->fd)); + PORT_Assert(ss->opt.noLocks || ssl_HaveRecvBufLock(ss)); + PORT_Assert(ss->opt.noLocks || ssl_HaveSSL3HandshakeLock(ss)); + + if (ss->ssl3.hs.ws != wait_cert_request) { + desc = unexpected_message; + errCode = SSL_ERROR_RX_UNEXPECTED_CERT_REQUEST; + goto alert_loser; + } + + PORT_Assert(ss->ssl3.clientCertChain == NULL); + PORT_Assert(ss->ssl3.clientCertificate == NULL); + PORT_Assert(ss->ssl3.clientPrivateKey == NULL); + + isTLS = (PRBool)(ss->ssl3.prSpec->version > SSL_LIBRARY_VERSION_3_0); + isTLS12 = (PRBool)(ss->ssl3.prSpec->version >= SSL_LIBRARY_VERSION_TLS_1_2); + rv = ssl3_ConsumeHandshakeVariable(ss, &cert_types, 1, &b, &length); + if (rv != SECSuccess) + goto loser; /* malformed, alert has been sent */ + + arena = ca_list.arena = PORT_NewArena(DER_DEFAULT_CHUNKSIZE); + if (arena == NULL) + goto no_mem; + + if (isTLS12) { + rv = ssl_ParseSignatureSchemes(ss, arena, + &signatureSchemes, + &signatureSchemeCount, + &b, &length); + if (rv != SECSuccess) { + PORT_SetError(SSL_ERROR_RX_MALFORMED_CERT_REQUEST); + goto loser; /* malformed, alert has been sent */ + } + } + + rv = ssl3_ParseCertificateRequestCAs(ss, &b, &length, arena, &ca_list); + if (rv != SECSuccess) + goto done; /* alert sent in ssl3_ParseCertificateRequestCAs */ + + if (length != 0) + goto alert_loser; /* malformed */ + + ss->ssl3.hs.ws = wait_hello_done; + + rv = ssl3_CompleteHandleCertificateRequest(ss, signatureSchemes, + signatureSchemeCount, &ca_list); + if (rv == SECFailure) { + PORT_Assert(0); + errCode = SEC_ERROR_LIBRARY_FAILURE; + desc = internal_error; + goto alert_loser; + } + goto done; + +no_mem: + rv = SECFailure; + PORT_SetError(SEC_ERROR_NO_MEMORY); + goto done; + +alert_loser: + if (isTLS && desc == illegal_parameter) + desc = decode_error; + (void)SSL3_SendAlert(ss, alert_fatal, desc); +loser: + PORT_SetError(errCode); + rv = SECFailure; +done: + if (arena != NULL) + PORT_FreeArena(arena, PR_FALSE); + return rv; +} + +SECStatus +ssl3_CompleteHandleCertificateRequest(sslSocket *ss, + const SSLSignatureScheme *signatureSchemes, + unsigned int signatureSchemeCount, + CERTDistNames *ca_list) +{ + SECStatus rv; + + if (ss->getClientAuthData != NULL) { + PORT_Assert((ss->ssl3.hs.preliminaryInfo & ssl_preinfo_all) == + ssl_preinfo_all); + /* XXX Should pass cert_types and algorithms in this call!! */ + rv = (SECStatus)(*ss->getClientAuthData)(ss->getClientAuthDataArg, + ss->fd, ca_list, + &ss->ssl3.clientCertificate, + &ss->ssl3.clientPrivateKey); + } else { + rv = SECFailure; /* force it to send a no_certificate alert */ + } + switch (rv) { + case SECWouldBlock: /* getClientAuthData has put up a dialog box. */ + ssl3_SetAlwaysBlock(ss); + break; /* not an error */ + + case SECSuccess: + /* check what the callback function returned */ + if ((!ss->ssl3.clientCertificate) || (!ss->ssl3.clientPrivateKey)) { + /* we are missing either the key or cert */ + if (ss->ssl3.clientCertificate) { + /* got a cert, but no key - free it */ + CERT_DestroyCertificate(ss->ssl3.clientCertificate); + ss->ssl3.clientCertificate = NULL; + } + if (ss->ssl3.clientPrivateKey) { + /* got a key, but no cert - free it */ + SECKEY_DestroyPrivateKey(ss->ssl3.clientPrivateKey); + ss->ssl3.clientPrivateKey = NULL; + } + goto send_no_certificate; + } + /* Setting ssl3.clientCertChain non-NULL will cause + * ssl3_HandleServerHelloDone to call SendCertificate. + */ + ss->ssl3.clientCertChain = CERT_CertChainFromCert( + ss->ssl3.clientCertificate, + certUsageSSLClient, PR_FALSE); + if (ss->ssl3.clientCertChain == NULL) { + CERT_DestroyCertificate(ss->ssl3.clientCertificate); + ss->ssl3.clientCertificate = NULL; + SECKEY_DestroyPrivateKey(ss->ssl3.clientPrivateKey); + ss->ssl3.clientPrivateKey = NULL; + goto send_no_certificate; + } + if (ss->ssl3.hs.hashType == handshake_hash_record || + ss->ssl3.hs.hashType == handshake_hash_single) { + rv = ssl_PickClientSignatureScheme(ss, signatureSchemes, + signatureSchemeCount); + } + break; /* not an error */ + + case SECFailure: + default: + send_no_certificate: + if (ss->ssl3.prSpec->version > SSL_LIBRARY_VERSION_3_0) { + ss->ssl3.sendEmptyCert = PR_TRUE; + } else { + (void)SSL3_SendAlert(ss, alert_warning, no_certificate); + } + rv = SECSuccess; + break; + } + + return rv; +} + +static SECStatus +ssl3_CheckFalseStart(sslSocket *ss) +{ + PORT_Assert(ss->opt.noLocks || ssl_HaveSSL3HandshakeLock(ss)); + PORT_Assert(!ss->ssl3.hs.authCertificatePending); + PORT_Assert(!ss->ssl3.hs.canFalseStart); + + if (!ss->canFalseStartCallback) { + SSL_TRC(3, ("%d: SSL[%d]: no false start callback so no false start", + SSL_GETPID(), ss->fd)); + } else { + PRBool maybeFalseStart; + SECStatus rv; + + /* An attacker can control the selected ciphersuite so we only wish to + * do False Start in the case that the selected ciphersuite is + * sufficiently strong that the attack can gain no advantage. + * Therefore we always require an 80-bit cipher. */ + ssl_GetSpecReadLock(ss); + maybeFalseStart = ss->ssl3.cwSpec->cipher_def->secret_key_size >= 10; + ssl_ReleaseSpecReadLock(ss); + + if (!maybeFalseStart) { + SSL_TRC(3, ("%d: SSL[%d]: no false start due to weak cipher", + SSL_GETPID(), ss->fd)); + } else { + PORT_Assert((ss->ssl3.hs.preliminaryInfo & ssl_preinfo_all) == + ssl_preinfo_all); + rv = (ss->canFalseStartCallback)(ss->fd, + ss->canFalseStartCallbackData, + &ss->ssl3.hs.canFalseStart); + if (rv == SECSuccess) { + SSL_TRC(3, ("%d: SSL[%d]: false start callback returned %s", + SSL_GETPID(), ss->fd, + ss->ssl3.hs.canFalseStart ? "TRUE" + : "FALSE")); + } else { + SSL_TRC(3, ("%d: SSL[%d]: false start callback failed (%s)", + SSL_GETPID(), ss->fd, + PR_ErrorToName(PR_GetError()))); + } + return rv; + } + } + + ss->ssl3.hs.canFalseStart = PR_FALSE; + return SECSuccess; +} + +PRBool +ssl3_WaitingForServerSecondRound(sslSocket *ss) +{ + PRBool result; + + PORT_Assert(ss->opt.noLocks || ssl_HaveSSL3HandshakeLock(ss)); + + switch (ss->ssl3.hs.ws) { + case wait_new_session_ticket: + case wait_change_cipher: + case wait_finished: + result = PR_TRUE; + break; + default: + result = PR_FALSE; + break; + } + + return result; +} + +static SECStatus ssl3_SendClientSecondRound(sslSocket *ss); + +/* Called from ssl3_HandlePostHelloHandshakeMessage() when it has deciphered + * a complete ssl3 Server Hello Done message. + * Caller must hold Handshake and RecvBuf locks. + */ +static SECStatus +ssl3_HandleServerHelloDone(sslSocket *ss) +{ + SECStatus rv; + SSL3WaitState ws = ss->ssl3.hs.ws; + + SSL_TRC(3, ("%d: SSL3[%d]: handle server_hello_done handshake", + SSL_GETPID(), ss->fd)); + PORT_Assert(ss->opt.noLocks || ssl_HaveRecvBufLock(ss)); + PORT_Assert(ss->opt.noLocks || ssl_HaveSSL3HandshakeLock(ss)); + + /* Skipping CertificateRequest is always permitted. */ + if (ws != wait_hello_done && + ws != wait_cert_request) { + SSL3_SendAlert(ss, alert_fatal, unexpected_message); + PORT_SetError(SSL_ERROR_RX_UNEXPECTED_HELLO_DONE); + return SECFailure; + } + + rv = ssl3_SendClientSecondRound(ss); + + return rv; +} + +/* Called from ssl3_HandleServerHelloDone and ssl3_AuthCertificateComplete. + * + * Caller must hold Handshake and RecvBuf locks. + */ +static SECStatus +ssl3_SendClientSecondRound(sslSocket *ss) +{ + SECStatus rv; + PRBool sendClientCert; + + PORT_Assert(ss->opt.noLocks || ssl_HaveRecvBufLock(ss)); + PORT_Assert(ss->opt.noLocks || ssl_HaveSSL3HandshakeLock(ss)); + + sendClientCert = !ss->ssl3.sendEmptyCert && + ss->ssl3.clientCertChain != NULL && + ss->ssl3.clientPrivateKey != NULL; + + /* We must wait for the server's certificate to be authenticated before + * sending the client certificate in order to disclosing the client + * certificate to an attacker that does not have a valid cert for the + * domain we are connecting to. + * + * XXX: We should do the same for the NPN extension, but for that we + * need an option to give the application the ability to leak the NPN + * information to get better performance. + * + * During the initial handshake on a connection, we never send/receive + * application data until we have authenticated the server's certificate; + * i.e. we have fully authenticated the handshake before using the cipher + * specs agreed upon for that handshake. During a renegotiation, we may + * continue sending and receiving application data during the handshake + * interleaved with the handshake records. If we were to send the client's + * second round for a renegotiation before the server's certificate was + * authenticated, then the application data sent/received after this point + * would be using cipher spec that hadn't been authenticated. By waiting + * until the server's certificate has been authenticated during + * renegotiations, we ensure that renegotiations have the same property + * as initial handshakes; i.e. we have fully authenticated the handshake + * before using the cipher specs agreed upon for that handshake for + * application data. + */ + if (ss->ssl3.hs.restartTarget) { + PR_NOT_REACHED("unexpected ss->ssl3.hs.restartTarget"); + PORT_SetError(SEC_ERROR_LIBRARY_FAILURE); + return SECFailure; + } + if (ss->ssl3.hs.authCertificatePending && + (sendClientCert || ss->ssl3.sendEmptyCert || ss->firstHsDone)) { + SSL_TRC(3, ("%d: SSL3[%p]: deferring ssl3_SendClientSecondRound because" + " certificate authentication is still pending.", + SSL_GETPID(), ss->fd)); + ss->ssl3.hs.restartTarget = ssl3_SendClientSecondRound; + return SECWouldBlock; + } + + ssl_GetXmitBufLock(ss); /*******************************/ + + if (ss->ssl3.sendEmptyCert) { + ss->ssl3.sendEmptyCert = PR_FALSE; + rv = ssl3_SendEmptyCertificate(ss); + /* Don't send verify */ + if (rv != SECSuccess) { + goto loser; /* error code is set. */ + } + } else if (sendClientCert) { + rv = ssl3_SendCertificate(ss); + if (rv != SECSuccess) { + goto loser; /* error code is set. */ + } + } + + rv = ssl3_SendClientKeyExchange(ss); + if (rv != SECSuccess) { + goto loser; /* err is set. */ + } + + if (sendClientCert) { + rv = ssl3_SendCertificateVerify(ss, ss->ssl3.clientPrivateKey); + SECKEY_DestroyPrivateKey(ss->ssl3.clientPrivateKey); + ss->ssl3.clientPrivateKey = NULL; + if (rv != SECSuccess) { + goto loser; /* err is set. */ + } + } + + rv = ssl3_SendChangeCipherSpecs(ss); + if (rv != SECSuccess) { + goto loser; /* err code was set. */ + } + + /* This must be done after we've set ss->ssl3.cwSpec in + * ssl3_SendChangeCipherSpecs because SSL_GetChannelInfo uses information + * from cwSpec. This must be done before we call ssl3_CheckFalseStart + * because the false start callback (if any) may need the information from + * the functions that depend on this being set. + */ + ss->enoughFirstHsDone = PR_TRUE; + + if (!ss->firstHsDone) { + /* XXX: If the server's certificate hasn't been authenticated by this + * point, then we may be leaking this NPN message to an attacker. + */ + rv = ssl3_SendNextProto(ss); + if (rv != SECSuccess) { + goto loser; /* err code was set. */ + } + + if (ss->opt.enableFalseStart) { + if (!ss->ssl3.hs.authCertificatePending) { + /* When we fix bug 589047, we will need to know whether we are + * false starting before we try to flush the client second + * round to the network. With that in mind, we purposefully + * call ssl3_CheckFalseStart before calling ssl3_SendFinished, + * which includes a call to ssl3_FlushHandshake, so that + * no application develops a reliance on such flushing being + * done before its false start callback is called. + */ + ssl_ReleaseXmitBufLock(ss); + rv = ssl3_CheckFalseStart(ss); + ssl_GetXmitBufLock(ss); + if (rv != SECSuccess) { + goto loser; + } + } else { + /* The certificate authentication and the server's Finished + * message are racing each other. If the certificate + * authentication wins, then we will try to false start in + * ssl3_AuthCertificateComplete. + */ + SSL_TRC(3, ("%d: SSL3[%p]: deferring false start check because" + " certificate authentication is still pending.", + SSL_GETPID(), ss->fd)); + } + } + } + + rv = ssl3_SendFinished(ss, 0); + if (rv != SECSuccess) { + goto loser; /* err code was set. */ + } + + ssl_ReleaseXmitBufLock(ss); /*******************************/ + + if (ssl3_ExtensionNegotiated(ss, ssl_session_ticket_xtn)) + ss->ssl3.hs.ws = wait_new_session_ticket; + else + ss->ssl3.hs.ws = wait_change_cipher; + + PORT_Assert(ssl3_WaitingForServerSecondRound(ss)); + + return SECSuccess; + +loser: + ssl_ReleaseXmitBufLock(ss); + return rv; +} + +/* + * Routines used by servers + */ +static SECStatus +ssl3_SendHelloRequest(sslSocket *ss) +{ + SECStatus rv; + + SSL_TRC(3, ("%d: SSL3[%d]: send hello_request handshake", SSL_GETPID(), + ss->fd)); + + PORT_Assert(ss->opt.noLocks || ssl_HaveSSL3HandshakeLock(ss)); + PORT_Assert(ss->opt.noLocks || ssl_HaveXmitBufLock(ss)); + + rv = ssl3_AppendHandshakeHeader(ss, hello_request, 0); + if (rv != SECSuccess) { + return rv; /* err set by AppendHandshake */ + } + rv = ssl3_FlushHandshake(ss, 0); + if (rv != SECSuccess) { + return rv; /* error code set by ssl3_FlushHandshake */ + } + ss->ssl3.hs.ws = wait_client_hello; + return SECSuccess; +} + +/* + * Called from: + * ssl3_HandleClientHello() + */ +static SECComparison +ssl3_ServerNameCompare(const SECItem *name1, const SECItem *name2) +{ + if (!name1 != !name2) { + return SECLessThan; + } + if (!name1) { + return SECEqual; + } + if (name1->type != name2->type) { + return SECLessThan; + } + return SECITEM_CompareItem(name1, name2); +} + +/* Sets memory error when returning NULL. + * Called from: + * ssl3_SendClientHello() + * ssl3_HandleServerHello() + * ssl3_HandleClientHello() + * ssl3_HandleV2ClientHello() + */ +sslSessionID * +ssl3_NewSessionID(sslSocket *ss, PRBool is_server) +{ + sslSessionID *sid; + + sid = PORT_ZNew(sslSessionID); + if (sid == NULL) + return sid; + + if (is_server) { + const SECItem *srvName; + SECStatus rv = SECSuccess; + + ssl_GetSpecReadLock(ss); /********************************/ + srvName = &ss->ssl3.hs.srvVirtName; + if (srvName->len && srvName->data) { + rv = SECITEM_CopyItem(NULL, &sid->u.ssl3.srvName, srvName); + } + ssl_ReleaseSpecReadLock(ss); /************************************/ + if (rv != SECSuccess) { + PORT_Free(sid); + return NULL; + } + } + sid->peerID = (ss->peerID == NULL) ? NULL : PORT_Strdup(ss->peerID); + sid->urlSvrName = (ss->url == NULL) ? NULL : PORT_Strdup(ss->url); + sid->addr = ss->sec.ci.peer; + sid->port = ss->sec.ci.port; + sid->references = 1; + sid->cached = never_cached; + sid->version = ss->version; + + sid->u.ssl3.keys.resumable = PR_TRUE; + sid->u.ssl3.policy = SSL_ALLOWED; + sid->u.ssl3.clientWriteKey = NULL; + sid->u.ssl3.serverWriteKey = NULL; + sid->u.ssl3.keys.extendedMasterSecretUsed = PR_FALSE; + + if (is_server) { + SECStatus rv; + int pid = SSL_GETPID(); + + sid->u.ssl3.sessionIDLength = SSL3_SESSIONID_BYTES; + sid->u.ssl3.sessionID[0] = (pid >> 8) & 0xff; + sid->u.ssl3.sessionID[1] = pid & 0xff; + rv = PK11_GenerateRandom(sid->u.ssl3.sessionID + 2, + SSL3_SESSIONID_BYTES - 2); + if (rv != SECSuccess) { + ssl_FreeSID(sid); + ssl_MapLowLevelError(SSL_ERROR_GENERATE_RANDOM_FAILURE); + return NULL; + } + } + return sid; +} + +/* Called from: ssl3_HandleClientHello, ssl3_HandleV2ClientHello */ +static SECStatus +ssl3_SendServerHelloSequence(sslSocket *ss) +{ + const ssl3KEADef *kea_def; + SECStatus rv; + + SSL_TRC(3, ("%d: SSL3[%d]: begin send server_hello sequence", + SSL_GETPID(), ss->fd)); + + PORT_Assert(ss->opt.noLocks || ssl_HaveSSL3HandshakeLock(ss)); + PORT_Assert(ss->opt.noLocks || ssl_HaveXmitBufLock(ss)); + + rv = ssl3_SendServerHello(ss); + if (rv != SECSuccess) { + return rv; /* err code is set. */ + } + rv = ssl3_SendCertificate(ss); + if (rv != SECSuccess) { + return rv; /* error code is set. */ + } + rv = ssl3_SendCertificateStatus(ss); + if (rv != SECSuccess) { + return rv; /* error code is set. */ + } + /* We have to do this after the call to ssl3_SendServerHello, + * because kea_def is set up by ssl3_SendServerHello(). + */ + kea_def = ss->ssl3.hs.kea_def; + + if (kea_def->ephemeral) { + rv = ssl3_SendServerKeyExchange(ss); + if (rv != SECSuccess) { + return rv; /* err code was set. */ + } + } + + if (ss->opt.requestCertificate) { + rv = ssl3_SendCertificateRequest(ss); + if (rv != SECSuccess) { + return rv; /* err code is set. */ + } + } + rv = ssl3_SendServerHelloDone(ss); + if (rv != SECSuccess) { + return rv; /* err code is set. */ + } + + ss->ssl3.hs.ws = (ss->opt.requestCertificate) ? wait_client_cert + : wait_client_key; + return SECSuccess; +} + +/* An empty TLS Renegotiation Info (RI) extension */ +static const PRUint8 emptyRIext[5] = { 0xff, 0x01, 0x00, 0x01, 0x00 }; + +static PRBool +ssl3_KEASupportsTickets(const ssl3KEADef *kea_def) +{ + if (kea_def->signKeyType == dsaKey) { + /* TODO: Fix session tickets for DSS. The server code rejects the + * session ticket received from the client. Bug 1174677 */ + return PR_FALSE; + } + return PR_TRUE; +} + +/* Select a cipher suite. +** +** NOTE: This suite selection algorithm should be the same as the one in +** ssl3_HandleV2ClientHello(). +** +** If TLS 1.0 is enabled, we could handle the case where the client +** offered TLS 1.1 but offered only export cipher suites by choosing TLS +** 1.0 and selecting one of those export cipher suites. However, a secure +** TLS 1.1 client should not have export cipher suites enabled at all, +** and a TLS 1.1 client should definitely not be offering *only* export +** cipher suites. Therefore, we refuse to negotiate export cipher suites +** with any client that indicates support for TLS 1.1 or higher when we +** (the server) have TLS 1.1 support enabled. +*/ +SECStatus +ssl3_NegotiateCipherSuite(sslSocket *ss, const SECItem *suites, + PRBool initHashes) +{ + int j; + int i; + + for (j = 0; j < ssl_V3_SUITES_IMPLEMENTED; j++) { + ssl3CipherSuiteCfg *suite = &ss->cipherSuites[j]; + SSLVersionRange vrange = { ss->version, ss->version }; + if (!config_match(suite, ss->ssl3.policy, &vrange, ss)) { + continue; + } + for (i = 0; i + 1 < suites->len; i += 2) { + PRUint16 suite_i = (suites->data[i] << 8) | suites->data[i + 1]; + if (suite_i == suite->cipher_suite) { + return ssl3_SetCipherSuite(ss, suite_i, initHashes); + } + } + } + return SECFailure; +} + +/* + * Call the SNI config hook. + * + * Called from: + * ssl3_HandleClientHello + * tls13_HandleClientHelloPart2 + */ +SECStatus +ssl3_ServerCallSNICallback(sslSocket *ss) +{ + int errCode = SSL_ERROR_RX_MALFORMED_CLIENT_HELLO; + SSL3AlertDescription desc = illegal_parameter; + int ret = 0; + +#ifdef SSL_SNI_ALLOW_NAME_CHANGE_2HS +#error("No longer allowed to set SSL_SNI_ALLOW_NAME_CHANGE_2HS") +#endif + if (!ssl3_ExtensionNegotiated(ss, ssl_server_name_xtn)) { + if (ss->firstHsDone) { + /* Check that we don't have the name is current spec + * if this extension was not negotiated on the 2d hs. */ + PRBool passed = PR_TRUE; + ssl_GetSpecReadLock(ss); /*******************************/ + if (ss->ssl3.hs.srvVirtName.data) { + passed = PR_FALSE; + } + ssl_ReleaseSpecReadLock(ss); /***************************/ + if (!passed) { + errCode = SSL_ERROR_UNRECOGNIZED_NAME_ALERT; + desc = handshake_failure; + goto alert_loser; + } + } + return SECSuccess; + } + + if (ss->sniSocketConfig) + do { /* not a loop */ + PORT_Assert((ss->ssl3.hs.preliminaryInfo & ssl_preinfo_all) == + ssl_preinfo_all); + + ret = SSL_SNI_SEND_ALERT; + /* If extension is negotiated, the len of names should > 0. */ + if (ss->xtnData.sniNameArrSize) { + /* Calling client callback to reconfigure the socket. */ + ret = (SECStatus)(*ss->sniSocketConfig)(ss->fd, + ss->xtnData.sniNameArr, + ss->xtnData.sniNameArrSize, + ss->sniSocketConfigArg); + } + if (ret <= SSL_SNI_SEND_ALERT) { + /* Application does not know the name or was not able to + * properly reconfigure the socket. */ + errCode = SSL_ERROR_UNRECOGNIZED_NAME_ALERT; + desc = unrecognized_name; + break; + } else if (ret == SSL_SNI_CURRENT_CONFIG_IS_USED) { + SECStatus rv = SECSuccess; + SECItem pwsNameBuf = { 0, NULL, 0 }; + SECItem *pwsName = &pwsNameBuf; + SECItem *cwsName; + + ssl_GetSpecWriteLock(ss); /*******************************/ + cwsName = &ss->ssl3.hs.srvVirtName; + /* not allow name change on the 2d HS */ + if (ss->firstHsDone) { + if (ssl3_ServerNameCompare(pwsName, cwsName)) { + ssl_ReleaseSpecWriteLock(ss); /******************/ + errCode = SSL_ERROR_UNRECOGNIZED_NAME_ALERT; + desc = handshake_failure; + ret = SSL_SNI_SEND_ALERT; + break; + } + } + if (pwsName->data) { + SECITEM_FreeItem(pwsName, PR_FALSE); + } + if (cwsName->data) { + rv = SECITEM_CopyItem(NULL, pwsName, cwsName); + } + ssl_ReleaseSpecWriteLock(ss); /**************************/ + if (rv != SECSuccess) { + errCode = SSL_ERROR_INTERNAL_ERROR_ALERT; + desc = internal_error; + ret = SSL_SNI_SEND_ALERT; + break; + } + } else if ((unsigned int)ret < ss->xtnData.sniNameArrSize) { + /* Application has configured new socket info. Lets check it + * and save the name. */ + SECStatus rv; + SECItem *name = &ss->xtnData.sniNameArr[ret]; + int configedCiphers; + SECItem *pwsName; + + /* get rid of the old name and save the newly picked. */ + /* This code is protected by ssl3HandshakeLock. */ + ssl_GetSpecWriteLock(ss); /*******************************/ + /* not allow name change on the 2d HS */ + if (ss->firstHsDone) { + SECItem *cwsName = &ss->ssl3.hs.srvVirtName; + if (ssl3_ServerNameCompare(name, cwsName)) { + ssl_ReleaseSpecWriteLock(ss); /******************/ + errCode = SSL_ERROR_UNRECOGNIZED_NAME_ALERT; + desc = handshake_failure; + ret = SSL_SNI_SEND_ALERT; + break; + } + } + pwsName = &ss->ssl3.hs.srvVirtName; + if (pwsName->data) { + SECITEM_FreeItem(pwsName, PR_FALSE); + } + rv = SECITEM_CopyItem(NULL, pwsName, name); + ssl_ReleaseSpecWriteLock(ss); /***************************/ + if (rv != SECSuccess) { + errCode = SSL_ERROR_INTERNAL_ERROR_ALERT; + desc = internal_error; + ret = SSL_SNI_SEND_ALERT; + break; + } + configedCiphers = ssl3_config_match_init(ss); + if (configedCiphers <= 0) { + /* no ciphers are working/supported */ + errCode = PORT_GetError(); + desc = handshake_failure; + ret = SSL_SNI_SEND_ALERT; + break; + } + /* Need to tell the client that application has picked + * the name from the offered list and reconfigured the socket. + */ + ssl3_RegisterExtensionSender(ss, &ss->xtnData, ssl_server_name_xtn, + ssl3_SendServerNameXtn); + } else { + /* Callback returned index outside of the boundary. */ + PORT_Assert((unsigned int)ret < ss->xtnData.sniNameArrSize); + errCode = SSL_ERROR_INTERNAL_ERROR_ALERT; + desc = internal_error; + ret = SSL_SNI_SEND_ALERT; + break; + } + } while (0); + ssl3_FreeSniNameArray(&ss->xtnData); + if (ret <= SSL_SNI_SEND_ALERT) { + /* desc and errCode should be set. */ + goto alert_loser; + } + + return SECSuccess; + +alert_loser: + (void)SSL3_SendAlert(ss, alert_fatal, desc); + PORT_SetError(errCode); + return SECFailure; +} + +SECStatus +ssl3_SelectServerCert(sslSocket *ss) +{ + const ssl3KEADef *kea_def = ss->ssl3.hs.kea_def; + PRCList *cursor; + + /* If the client didn't include the supported groups extension, assume just + * P-256 support and disable all the other ECDHE groups. This also affects + * ECDHE group selection, but this function is called first. */ + if (!ssl3_ExtensionNegotiated(ss, ssl_supported_groups_xtn)) { + unsigned int i; + for (i = 0; i < SSL_NAMED_GROUP_COUNT; ++i) { + if (ss->namedGroupPreferences[i] && + ss->namedGroupPreferences[i]->keaType == ssl_kea_ecdh && + ss->namedGroupPreferences[i]->name != ssl_grp_ec_secp256r1) { + ss->namedGroupPreferences[i] = NULL; + } + } + } + + /* This picks the first certificate that has: + * a) the right authentication method, and + * b) the right named curve (EC only) + * + * We might want to do some sort of ranking here later. For now, it's all + * based on what order they are configured in. */ + for (cursor = PR_NEXT_LINK(&ss->serverCerts); + cursor != &ss->serverCerts; + cursor = PR_NEXT_LINK(cursor)) { + sslServerCert *cert = (sslServerCert *)cursor; + if (cert->certType.authType != kea_def->authKeyType) { + continue; + } + if ((cert->certType.authType == ssl_auth_ecdsa || + cert->certType.authType == ssl_auth_ecdh_rsa || + cert->certType.authType == ssl_auth_ecdh_ecdsa) && + !ssl_NamedGroupEnabled(ss, cert->certType.namedCurve)) { + continue; + } + + /* Found one. */ + ss->sec.serverCert = cert; + ss->sec.authType = cert->certType.authType; + ss->sec.authKeyBits = cert->serverKeyBits; + + /* Don't pick a signature scheme if we aren't going to use it. */ + if (kea_def->signKeyType == nullKey) { + return SECSuccess; + } + return ssl3_PickServerSignatureScheme(ss); + } + + PORT_SetError(SSL_ERROR_NO_CYPHER_OVERLAP); + return SECFailure; +} + +/* Called from ssl3_HandleHandshakeMessage() when it has deciphered a complete + * ssl3 Client Hello message. + * Caller must hold Handshake and RecvBuf locks. + */ +static SECStatus +ssl3_HandleClientHello(sslSocket *ss, SSL3Opaque *b, PRUint32 length) +{ + sslSessionID *sid = NULL; + PRInt32 tmp; + unsigned int i; + SECStatus rv; + int errCode = SSL_ERROR_RX_MALFORMED_CLIENT_HELLO; + SSL3AlertDescription desc = illegal_parameter; + SSL3AlertLevel level = alert_fatal; + SSL3ProtocolVersion version; + TLSExtension *versionExtension; + SECItem sidBytes = { siBuffer, NULL, 0 }; + SECItem cookieBytes = { siBuffer, NULL, 0 }; + SECItem suites = { siBuffer, NULL, 0 }; + SECItem comps = { siBuffer, NULL, 0 }; + PRBool isTLS13; + + SSL_TRC(3, ("%d: SSL3[%d]: handle client_hello handshake", + SSL_GETPID(), ss->fd)); + + PORT_Assert(ss->opt.noLocks || ssl_HaveRecvBufLock(ss)); + PORT_Assert(ss->opt.noLocks || ssl_HaveSSL3HandshakeLock(ss)); + PORT_Assert(ss->ssl3.initialized); + ss->ssl3.hs.preliminaryInfo = 0; + + if (!ss->sec.isServer || + (ss->ssl3.hs.ws != wait_client_hello && + ss->ssl3.hs.ws != idle_handshake)) { + desc = unexpected_message; + errCode = SSL_ERROR_RX_UNEXPECTED_CLIENT_HELLO; + goto alert_loser; + } + if (ss->ssl3.hs.ws == idle_handshake) { + /* Refuse re-handshake when we have already negotiated TLS 1.3. */ + if (ss->version >= SSL_LIBRARY_VERSION_TLS_1_3) { + desc = unexpected_message; + errCode = SSL_ERROR_RENEGOTIATION_NOT_ALLOWED; + goto alert_loser; + } + if (ss->opt.enableRenegotiation == SSL_RENEGOTIATE_NEVER) { + desc = no_renegotiation; + level = alert_warning; + errCode = SSL_ERROR_RENEGOTIATION_NOT_ALLOWED; + goto alert_loser; + } + } + + /* Get peer name of client */ + rv = ssl_GetPeerInfo(ss); + if (rv != SECSuccess) { + return rv; /* error code is set. */ + } + + /* We might be starting session renegotiation in which case we should + * clear previous state. + */ + ssl3_ResetExtensionData(&ss->xtnData); + ss->statelessResume = PR_FALSE; + + if (IS_DTLS(ss)) { + dtls_RehandshakeCleanup(ss); + } + + tmp = ssl3_ConsumeHandshakeNumber(ss, 2, &b, &length); + if (tmp < 0) + goto loser; /* malformed, alert already sent */ + + /* Translate the version. */ + if (IS_DTLS(ss)) { + ss->clientHelloVersion = version = + dtls_DTLSVersionToTLSVersion((SSL3ProtocolVersion)tmp); + } else { + ss->clientHelloVersion = version = (SSL3ProtocolVersion)tmp; + } + + /* Grab the client random data. */ + rv = ssl3_ConsumeHandshake( + ss, &ss->ssl3.hs.client_random, SSL3_RANDOM_LENGTH, &b, &length); + if (rv != SECSuccess) { + goto loser; /* malformed */ + } + + /* Grab the client's SID, if present. */ + rv = ssl3_ConsumeHandshakeVariable(ss, &sidBytes, 1, &b, &length); + if (rv != SECSuccess) { + goto loser; /* malformed */ + } + + /* Grab the client's cookie, if present. */ + if (IS_DTLS(ss)) { + rv = ssl3_ConsumeHandshakeVariable(ss, &cookieBytes, 1, &b, &length); + if (rv != SECSuccess) { + goto loser; /* malformed */ + } + } + + /* Grab the list of cipher suites. */ + rv = ssl3_ConsumeHandshakeVariable(ss, &suites, 2, &b, &length); + if (rv != SECSuccess) { + goto loser; /* malformed */ + } + + /* Grab the list of compression methods. */ + rv = ssl3_ConsumeHandshakeVariable(ss, &comps, 1, &b, &length); + if (rv != SECSuccess) { + goto loser; /* malformed */ + } + + /* Handle TLS hello extensions for SSL3 & TLS. We do not know if + * we are restarting a previous session until extensions have been + * parsed, since we might have received a SessionTicket extension. + * Note: we allow extensions even when negotiating SSL3 for the sake + * of interoperability (and backwards compatibility). + */ + + if (length) { + /* Get length of hello extensions */ + PRInt32 extension_length; + extension_length = ssl3_ConsumeHandshakeNumber(ss, 2, &b, &length); + if (extension_length < 0) { + goto loser; /* alert already sent */ + } + if (extension_length != length) { + ssl3_DecodeError(ss); /* send alert */ + goto loser; + } + + rv = ssl3_ParseExtensions(ss, &b, &length); + if (rv != SECSuccess) { + goto loser; /* malformed */ + } + } + + versionExtension = ssl3_FindExtension(ss, ssl_tls13_supported_versions_xtn); + if (versionExtension) { + rv = tls13_NegotiateVersion(ss, versionExtension); + if (rv != SECSuccess) { + errCode = PORT_GetError(); + desc = (errCode == SSL_ERROR_UNSUPPORTED_VERSION) ? protocol_version : illegal_parameter; + goto alert_loser; + } + } else { + /* The PR_MIN here ensures that we never negotiate 1.3 if the + * peer didn't offer "supported_versions". */ + rv = ssl3_NegotiateVersion(ss, + PR_MIN(version, + SSL_LIBRARY_VERSION_TLS_1_2), + PR_TRUE); + if (rv != SECSuccess) { + desc = (version > SSL_LIBRARY_VERSION_3_0) ? protocol_version + : handshake_failure; + errCode = SSL_ERROR_UNSUPPORTED_VERSION; + goto alert_loser; + } + } + isTLS13 = ss->version >= SSL_LIBRARY_VERSION_TLS_1_3; + ss->ssl3.hs.preliminaryInfo |= ssl_preinfo_version; + + /* You can't resume TLS 1.3 like this. */ + if (isTLS13 && sidBytes.len) { + goto alert_loser; + } + + /* Generate the Server Random now so it is available + * when we process the ClientKeyShare in TLS 1.3 */ + rv = ssl3_GetNewRandom(&ss->ssl3.hs.server_random); + if (rv != SECSuccess) { + errCode = SSL_ERROR_GENERATE_RANDOM_FAILURE; + goto loser; + } + +#ifndef TLS_1_3_DRAFT_VERSION + /* + * [draft-ietf-tls-tls13-11 Section 6.3.1.1]. + * TLS 1.3 server implementations which respond to a ClientHello with a + * client_version indicating TLS 1.2 or below MUST set the last eight + * bytes of their Random value to the bytes: + * + * 44 4F 57 4E 47 52 44 01 + * + * TLS 1.2 server implementations which respond to a ClientHello with a + * client_version indicating TLS 1.1 or below SHOULD set the last eight + * bytes of their Random value to the bytes: + * + * 44 4F 57 4E 47 52 44 00 + * + * TODO(ekr@rtfm.com): Note this change was not added in the SSLv2 + * compat processing code since that will most likely be removed before + * we ship the final version of TLS 1.3. Bug 1306672. + */ + if (ss->vrange.max > ss->version) { + unsigned char *downgrade_sentinel = + ss->ssl3.hs.server_random.rand + + SSL3_RANDOM_LENGTH - sizeof(tls13_downgrade_random); + + switch (ss->vrange.max) { + case SSL_LIBRARY_VERSION_TLS_1_3: + PORT_Memcpy(downgrade_sentinel, + tls13_downgrade_random, + sizeof(tls13_downgrade_random)); + break; + case SSL_LIBRARY_VERSION_TLS_1_2: + PORT_Memcpy(downgrade_sentinel, + tls12_downgrade_random, + sizeof(tls12_downgrade_random)); + break; + default: + /* Do not change random. */ + break; + } + } +#endif + + /* Now parse the rest of the extensions. */ + rv = ssl3_HandleParsedExtensions(ss, client_hello); + if (rv != SECSuccess) { + goto loser; /* malformed */ + } + + /* If the ClientHello version is less than our maximum version, check for a + * TLS_FALLBACK_SCSV and reject the connection if found. */ + if (ss->vrange.max > ss->clientHelloVersion) { + for (i = 0; i + 1 < suites.len; i += 2) { + PRUint16 suite_i = (suites.data[i] << 8) | suites.data[i + 1]; + if (suite_i != TLS_FALLBACK_SCSV) + continue; + desc = inappropriate_fallback; + errCode = SSL_ERROR_INAPPROPRIATE_FALLBACK_ALERT; + goto alert_loser; + } + } + + /* TLS 1.3 requires that compression only include null. */ + if (isTLS13) { + if (comps.len != 1 || comps.data[0] != ssl_compression_null) { + goto alert_loser; + } + } + + if (!ssl3_ExtensionNegotiated(ss, ssl_renegotiation_info_xtn)) { + /* If we didn't receive an RI extension, look for the SCSV, + * and if found, treat it just like an empty RI extension + * by processing a local copy of an empty RI extension. + */ + for (i = 0; i + 1 < suites.len; i += 2) { + PRUint16 suite_i = (suites.data[i] << 8) | suites.data[i + 1]; + if (suite_i == TLS_EMPTY_RENEGOTIATION_INFO_SCSV) { + SSL3Opaque *b2 = (SSL3Opaque *)emptyRIext; + PRUint32 L2 = sizeof emptyRIext; + (void)ssl3_HandleExtensions(ss, &b2, &L2, client_hello); + break; + } + } + } + /* This is a second check for TLS 1.3 and re-handshake to stop us + * from re-handshake up to TLS 1.3, so it happens after version + * negotiation. */ + if (ss->firstHsDone && ss->version >= SSL_LIBRARY_VERSION_TLS_1_3) { + desc = unexpected_message; + errCode = SSL_ERROR_RENEGOTIATION_NOT_ALLOWED; + goto alert_loser; + } + if (ss->firstHsDone && + (ss->opt.enableRenegotiation == SSL_RENEGOTIATE_REQUIRES_XTN || + ss->opt.enableRenegotiation == SSL_RENEGOTIATE_TRANSITIONAL) && + !ssl3_ExtensionNegotiated(ss, ssl_renegotiation_info_xtn)) { + desc = no_renegotiation; + level = alert_warning; + errCode = SSL_ERROR_RENEGOTIATION_NOT_ALLOWED; + goto alert_loser; + } + if ((ss->opt.requireSafeNegotiation || + (ss->firstHsDone && ss->peerRequestedProtection)) && + !ssl3_ExtensionNegotiated(ss, ssl_renegotiation_info_xtn)) { + desc = handshake_failure; + errCode = SSL_ERROR_UNSAFE_NEGOTIATION; + goto alert_loser; + } + + /* We do stateful resumes only if we are in TLS < 1.3 and + * either of the following conditions are satisfied: + * (1) the client does not support the session ticket extension, or + * (2) the client support the session ticket extension, but sent an + * empty ticket. + */ + if ((ss->version < SSL_LIBRARY_VERSION_TLS_1_3) && + (!ssl3_ExtensionNegotiated(ss, ssl_session_ticket_xtn) || + ss->xtnData.emptySessionTicket)) { + if (sidBytes.len > 0 && !ss->opt.noCache) { + SSL_TRC(7, ("%d: SSL3[%d]: server, lookup client session-id for 0x%08x%08x%08x%08x", + SSL_GETPID(), ss->fd, ss->sec.ci.peer.pr_s6_addr32[0], + ss->sec.ci.peer.pr_s6_addr32[1], + ss->sec.ci.peer.pr_s6_addr32[2], + ss->sec.ci.peer.pr_s6_addr32[3])); + if (ssl_sid_lookup) { + sid = (*ssl_sid_lookup)(&ss->sec.ci.peer, sidBytes.data, + sidBytes.len, ss->dbHandle); + } else { + errCode = SSL_ERROR_SERVER_CACHE_NOT_CONFIGURED; + goto loser; + } + } + } else if (ss->statelessResume) { + /* Fill in the client's session ID if doing a stateless resume. + * (When doing stateless resumes, server echos client's SessionID.) + * This branch also handles TLS 1.3 resumption-PSK. + */ + sid = ss->sec.ci.sid; + PORT_Assert(sid != NULL); /* Should have already been filled in.*/ + + if (sidBytes.len > 0 && sidBytes.len <= SSL3_SESSIONID_BYTES) { + sid->u.ssl3.sessionIDLength = sidBytes.len; + PORT_Memcpy(sid->u.ssl3.sessionID, sidBytes.data, + sidBytes.len); + sid->u.ssl3.sessionIDLength = sidBytes.len; + } else { + sid->u.ssl3.sessionIDLength = 0; + } + ss->sec.ci.sid = NULL; + } + + /* Free a potentially leftover session ID from a previous handshake. */ + if (ss->sec.ci.sid) { + ssl_FreeSID(ss->sec.ci.sid); + ss->sec.ci.sid = NULL; + } + + if (sid != NULL) { + /* We've found a session cache entry for this client. + * Now, if we're going to require a client-auth cert, + * and we don't already have this client's cert in the session cache, + * and this is the first handshake on this connection (not a redo), + * then drop this old cache entry and start a new session. + */ + if ((sid->peerCert == NULL) && ss->opt.requestCertificate && + ((ss->opt.requireCertificate == SSL_REQUIRE_ALWAYS) || + (ss->opt.requireCertificate == SSL_REQUIRE_NO_ERROR) || + ((ss->opt.requireCertificate == SSL_REQUIRE_FIRST_HANDSHAKE) && + !ss->firstHsDone))) { + + SSL_AtomicIncrementLong(&ssl3stats.hch_sid_cache_not_ok); + ss->sec.uncache(sid); + ssl_FreeSID(sid); + sid = NULL; + } + } + + if (IS_DTLS(ss)) { + ssl3_DisableNonDTLSSuites(ss); + } + +#ifdef PARANOID + /* Look for a matching cipher suite. */ + j = ssl3_config_match_init(ss); + if (j <= 0) { /* no ciphers are working/supported by PK11 */ + errCode = PORT_GetError(); /* error code is already set. */ + goto alert_loser; + } +#endif + + if (ss->version >= SSL_LIBRARY_VERSION_TLS_1_3) { + rv = tls13_HandleClientHelloPart2(ss, &suites, sid); + } else { + rv = ssl3_HandleClientHelloPart2(ss, &suites, &comps, sid); + } + if (rv != SECSuccess) { + errCode = PORT_GetError(); + goto loser; + } + return SECSuccess; + +alert_loser: + (void)SSL3_SendAlert(ss, level, desc); +/* FALLTHRU */ +loser: + PORT_SetError(errCode); + return SECFailure; +} + +static SECStatus +ssl3_HandleClientHelloPart2(sslSocket *ss, + SECItem *suites, + SECItem *comps, + sslSessionID *sid) +{ + PRBool haveSpecWriteLock = PR_FALSE; + PRBool haveXmitBufLock = PR_FALSE; + int errCode = SSL_ERROR_RX_MALFORMED_CLIENT_HELLO; + SSL3AlertDescription desc = illegal_parameter; + SECStatus rv; + unsigned int i; + int j; + + /* If we already have a session for this client, be sure to pick the + ** same cipher suite and compression method we picked before. + ** This is not a loop, despite appearances. + */ + if (sid) + do { + ssl3CipherSuiteCfg *suite; +#ifdef PARANOID + SSLVersionRange vrange = { ss->version, ss->version }; +#endif + + /* Check that the cached compression method is still enabled. */ + if (!ssl_CompressionEnabled(ss, sid->u.ssl3.compression)) + break; + + /* Check that the cached compression method is in the client's list */ + for (i = 0; i < comps->len; i++) { + if (comps->data[i] == sid->u.ssl3.compression) + break; + } + if (i == comps->len) + break; + + suite = ss->cipherSuites; + /* Find the entry for the cipher suite used in the cached session. */ + for (j = ssl_V3_SUITES_IMPLEMENTED; j > 0; --j, ++suite) { + if (suite->cipher_suite == sid->u.ssl3.cipherSuite) + break; + } + PORT_Assert(j > 0); + if (j <= 0) + break; +#ifdef PARANOID + /* Double check that the cached cipher suite is still enabled, + * implemented, and allowed by policy. Might have been disabled. + * The product policy won't change during the process lifetime. + * Implemented ("isPresent") shouldn't change for servers. + */ + if (!config_match(suite, ss->ssl3.policy, &vrange, ss)) + break; +#else + if (!suite->enabled) + break; +#endif + /* Double check that the cached cipher suite is in the client's + * list. If it isn't, fall through and start a new session. */ + for (i = 0; i + 1 < suites->len; i += 2) { + PRUint16 suite_i = (suites->data[i] << 8) | suites->data[i + 1]; + if (suite_i == suite->cipher_suite) { + rv = ssl3_SetCipherSuite(ss, suite_i, PR_TRUE); + if (rv != SECSuccess) { + desc = internal_error; + errCode = PORT_GetError(); + goto alert_loser; + } + + /* Use the cached compression method. */ + ss->ssl3.hs.compression = + sid->u.ssl3.compression; + goto compression_found; + } + } + } while (0); +/* START A NEW SESSION */ + +#ifndef PARANOID + /* Look for a matching cipher suite. */ + j = ssl3_config_match_init(ss); + if (j <= 0) { /* no ciphers are working/supported by PK11 */ + desc = internal_error; + errCode = PORT_GetError(); /* error code is already set. */ + goto alert_loser; + } +#endif + + rv = ssl3_NegotiateCipherSuite(ss, suites, PR_TRUE); + if (rv != SECSuccess) { + desc = handshake_failure; + errCode = SSL_ERROR_NO_CYPHER_OVERLAP; + goto alert_loser; + } + + /* Select a compression algorithm. */ + for (i = 0; i < comps->len; i++) { + SSLCompressionMethod method = (SSLCompressionMethod)comps->data[i]; + if (!ssl_CompressionEnabled(ss, method)) + continue; + for (j = 0; j < ssl_compression_method_count; j++) { + if (method == ssl_compression_methods[j]) { + ss->ssl3.hs.compression = ssl_compression_methods[j]; + goto compression_found; + } + } + } + errCode = SSL_ERROR_NO_COMPRESSION_OVERLAP; + /* null compression must be supported */ + goto alert_loser; + +compression_found: + suites->data = NULL; + comps->data = NULL; + + /* If there are any failures while processing the old sid, + * we don't consider them to be errors. Instead, We just behave + * as if the client had sent us no sid to begin with, and make a new one. + * The exception here is attempts to resume extended_master_secret + * sessions without the extension, which causes an alert. + */ + if (sid != NULL) + do { + ssl3CipherSpec *pwSpec; + SECItem wrappedMS; /* wrapped key */ + const sslServerCert *serverCert; + + if (sid->version != ss->version || + sid->u.ssl3.cipherSuite != ss->ssl3.hs.cipher_suite || + sid->u.ssl3.compression != ss->ssl3.hs.compression) { + break; /* not an error */ + } + + serverCert = ssl_FindServerCert(ss, &sid->certType); + if (!serverCert || !serverCert->serverCert) { + /* A compatible certificate must not have been configured. It + * might not be the same certificate, but we only find that out + * when the ticket fails to decrypt. */ + break; + } + + /* [draft-ietf-tls-session-hash-06; Section 5.3] + * o If the original session did not use the "extended_master_secret" + * extension but the new ClientHello contains the extension, then the + * server MUST NOT perform the abbreviated handshake. Instead, it + * SHOULD continue with a full handshake (as described in + * Section 5.2) to negotiate a new session. + * + * o If the original session used the "extended_master_secret" + * extension but the new ClientHello does not contain the extension, + * the server MUST abort the abbreviated handshake. + */ + if (ssl3_ExtensionNegotiated(ss, ssl_extended_master_secret_xtn)) { + if (!sid->u.ssl3.keys.extendedMasterSecretUsed) { + break; /* not an error */ + } + } else { + if (sid->u.ssl3.keys.extendedMasterSecretUsed) { + /* Note: we do not destroy the session */ + desc = handshake_failure; + errCode = SSL_ERROR_MISSING_EXTENDED_MASTER_SECRET; + goto alert_loser; + } + } + + if (ss->sec.ci.sid) { + ss->sec.uncache(ss->sec.ci.sid); + PORT_Assert(ss->sec.ci.sid != sid); /* should be impossible, but ... */ + if (ss->sec.ci.sid != sid) { + ssl_FreeSID(ss->sec.ci.sid); + } + ss->sec.ci.sid = NULL; + } + /* we need to resurrect the master secret.... */ + + ssl_GetSpecWriteLock(ss); + haveSpecWriteLock = PR_TRUE; + pwSpec = ss->ssl3.pwSpec; + if (sid->u.ssl3.keys.msIsWrapped) { + PK11SymKey *wrapKey; /* wrapping key */ + CK_FLAGS keyFlags = 0; + + wrapKey = ssl3_GetWrappingKey(ss, NULL, serverCert, + sid->u.ssl3.masterWrapMech, + ss->pkcs11PinArg); + if (!wrapKey) { + /* we have a SID cache entry, but no wrapping key for it??? */ + break; + } + + if (ss->version > SSL_LIBRARY_VERSION_3_0) { /* isTLS */ + keyFlags = CKF_SIGN | CKF_VERIFY; + } + + wrappedMS.data = sid->u.ssl3.keys.wrapped_master_secret; + wrappedMS.len = sid->u.ssl3.keys.wrapped_master_secret_len; + + /* unwrap the master secret. */ + pwSpec->master_secret = + PK11_UnwrapSymKeyWithFlags(wrapKey, sid->u.ssl3.masterWrapMech, + NULL, &wrappedMS, CKM_SSL3_MASTER_KEY_DERIVE, + CKA_DERIVE, sizeof(SSL3MasterSecret), keyFlags); + PK11_FreeSymKey(wrapKey); + if (pwSpec->master_secret == NULL) { + break; /* not an error */ + } + } else { + /* need to import the raw master secret to session object */ + PK11SlotInfo *slot; + wrappedMS.data = sid->u.ssl3.keys.wrapped_master_secret; + wrappedMS.len = sid->u.ssl3.keys.wrapped_master_secret_len; + slot = PK11_GetInternalSlot(); + pwSpec->master_secret = + PK11_ImportSymKey(slot, CKM_SSL3_MASTER_KEY_DERIVE, + PK11_OriginUnwrap, CKA_ENCRYPT, &wrappedMS, + NULL); + PK11_FreeSlot(slot); + if (pwSpec->master_secret == NULL) { + break; /* not an error */ + } + } + ss->sec.ci.sid = sid; + if (sid->peerCert != NULL) { + ss->sec.peerCert = CERT_DupCertificate(sid->peerCert); + } + + /* + * Old SID passed all tests, so resume this old session. + * + * XXX make sure compression still matches + */ + SSL_AtomicIncrementLong(&ssl3stats.hch_sid_cache_hits); + if (ss->statelessResume) + SSL_AtomicIncrementLong(&ssl3stats.hch_sid_stateless_resumes); + ss->ssl3.hs.isResuming = PR_TRUE; + + ss->sec.authType = sid->authType; + ss->sec.authKeyBits = sid->authKeyBits; + ss->sec.keaType = sid->keaType; + ss->sec.keaKeyBits = sid->keaKeyBits; + + /* server sids don't remember the server cert we previously sent, + ** but they do remember the slot we originally used, so we + ** can locate it again, provided that the current ssl socket + ** has had its server certs configured the same as the previous one. + */ + ss->sec.serverCert = serverCert; + ss->sec.localCert = CERT_DupCertificate(serverCert->serverCert); + + /* Copy cached name in to pending spec */ + if (sid != NULL && + sid->version > SSL_LIBRARY_VERSION_3_0 && + sid->u.ssl3.srvName.len && sid->u.ssl3.srvName.data) { + /* Set server name from sid */ + SECItem *sidName = &sid->u.ssl3.srvName; + SECItem *pwsName = &ss->ssl3.hs.srvVirtName; + if (pwsName->data) { + SECITEM_FreeItem(pwsName, PR_FALSE); + } + rv = SECITEM_CopyItem(NULL, pwsName, sidName); + if (rv != SECSuccess) { + errCode = PORT_GetError(); + desc = internal_error; + goto alert_loser; + } + } + + /* Clean up sni name array */ + ssl3_FreeSniNameArray(&ss->xtnData); + + ssl_GetXmitBufLock(ss); + haveXmitBufLock = PR_TRUE; + + rv = ssl3_SendServerHello(ss); + if (rv != SECSuccess) { + errCode = PORT_GetError(); + goto loser; + } + + if (haveSpecWriteLock) { + ssl_ReleaseSpecWriteLock(ss); + haveSpecWriteLock = PR_FALSE; + } + + /* NULL value for PMS because we are re-using the old MS */ + rv = ssl3_InitPendingCipherSpec(ss, NULL); + if (rv != SECSuccess) { + errCode = PORT_GetError(); + goto loser; + } + + rv = ssl3_SendChangeCipherSpecs(ss); + if (rv != SECSuccess) { + errCode = PORT_GetError(); + goto loser; + } + rv = ssl3_SendFinished(ss, 0); + ss->ssl3.hs.ws = wait_change_cipher; + if (rv != SECSuccess) { + errCode = PORT_GetError(); + goto loser; + } + + if (haveXmitBufLock) { + ssl_ReleaseXmitBufLock(ss); + } + + return SECSuccess; + } while (0); + + if (haveSpecWriteLock) { + ssl_ReleaseSpecWriteLock(ss); + haveSpecWriteLock = PR_FALSE; + } + + if (sid) { /* we had a sid, but it's no longer valid, free it */ + SSL_AtomicIncrementLong(&ssl3stats.hch_sid_cache_not_ok); + ss->sec.uncache(sid); + ssl_FreeSID(sid); + sid = NULL; + } + SSL_AtomicIncrementLong(&ssl3stats.hch_sid_cache_misses); + + /* We only send a session ticket extension if the client supports + * the extension and we are unable to resume. + * + * TODO: send a session ticket if performing a stateful + * resumption. (As per RFC4507, a server may issue a session + * ticket while doing a (stateless or stateful) session resume, + * but OpenSSL-0.9.8g does not accept session tickets while + * resuming.) + */ + if (ssl3_ExtensionNegotiated(ss, ssl_session_ticket_xtn) && + ssl3_KEASupportsTickets(ss->ssl3.hs.kea_def)) { + ssl3_RegisterExtensionSender(ss, &ss->xtnData, + ssl_session_ticket_xtn, + ssl3_SendSessionTicketXtn); + } + + rv = ssl3_ServerCallSNICallback(ss); + if (rv != SECSuccess) { + /* The alert has already been sent. */ + errCode = PORT_GetError(); + goto loser; + } + + rv = ssl3_SelectServerCert(ss); + if (rv != SECSuccess) { + errCode = PORT_GetError(); + desc = handshake_failure; + goto alert_loser; + } + + sid = ssl3_NewSessionID(ss, PR_TRUE); + if (sid == NULL) { + errCode = PORT_GetError(); + goto loser; /* memory error is set. */ + } + ss->sec.ci.sid = sid; + + sid->u.ssl3.keys.extendedMasterSecretUsed = + ssl3_ExtensionNegotiated(ss, ssl_extended_master_secret_xtn); + ss->ssl3.hs.isResuming = PR_FALSE; + + ssl_GetXmitBufLock(ss); + rv = ssl3_SendServerHelloSequence(ss); + ssl_ReleaseXmitBufLock(ss); + if (rv != SECSuccess) { + errCode = PORT_GetError(); + desc = handshake_failure; + goto alert_loser; + } + + if (haveXmitBufLock) { + ssl_ReleaseXmitBufLock(ss); + } + + return SECSuccess; + +alert_loser: + if (haveSpecWriteLock) { + ssl_ReleaseSpecWriteLock(ss); + haveSpecWriteLock = PR_FALSE; + } + (void)SSL3_SendAlert(ss, alert_fatal, desc); +/* FALLTHRU */ +loser: + if (sid && sid != ss->sec.ci.sid) { + ss->sec.uncache(sid); + ssl_FreeSID(sid); + } + + if (haveSpecWriteLock) { + ssl_ReleaseSpecWriteLock(ss); + } + + if (haveXmitBufLock) { + ssl_ReleaseXmitBufLock(ss); + } + + PORT_SetError(errCode); + return SECFailure; +} + +/* + * ssl3_HandleV2ClientHello is used when a V2 formatted hello comes + * in asking to use the V3 handshake. + */ +SECStatus +ssl3_HandleV2ClientHello(sslSocket *ss, unsigned char *buffer, int length, + PRUint8 padding) +{ + sslSessionID *sid = NULL; + unsigned char *suites; + unsigned char *random; + SSL3ProtocolVersion version; + SECStatus rv; + int i; + int j; + int sid_length; + int suite_length; + int rand_length; + int errCode = SSL_ERROR_RX_MALFORMED_CLIENT_HELLO; + SSL3AlertDescription desc = handshake_failure; + unsigned int total = SSL_HL_CLIENT_HELLO_HBYTES; + + SSL_TRC(3, ("%d: SSL3[%d]: handle v2 client_hello", SSL_GETPID(), ss->fd)); + + PORT_Assert(ss->opt.noLocks || ssl_HaveRecvBufLock(ss)); + + ssl_GetSSL3HandshakeLock(ss); + + ssl3_ResetExtensionData(&ss->xtnData); + + version = (buffer[1] << 8) | buffer[2]; + if (version < SSL_LIBRARY_VERSION_3_0) { + goto loser; + } + + rv = ssl3_InitState(ss); + if (rv != SECSuccess) { + ssl_ReleaseSSL3HandshakeLock(ss); + return rv; /* ssl3_InitState has set the error code. */ + } + rv = ssl3_RestartHandshakeHashes(ss); + if (rv != SECSuccess) { + ssl_ReleaseSSL3HandshakeLock(ss); + return rv; + } + + if (ss->ssl3.hs.ws != wait_client_hello) { + desc = unexpected_message; + errCode = SSL_ERROR_RX_UNEXPECTED_CLIENT_HELLO; + goto alert_loser; + } + + total += suite_length = (buffer[3] << 8) | buffer[4]; + total += sid_length = (buffer[5] << 8) | buffer[6]; + total += rand_length = (buffer[7] << 8) | buffer[8]; + total += padding; + ss->clientHelloVersion = version; + + if (version >= SSL_LIBRARY_VERSION_TLS_1_3) { + /* [draft-ietf-tls-tls-11; C.3] forbids sending a TLS 1.3 + * ClientHello using the backwards-compatible format. */ + desc = illegal_parameter; + errCode = SSL_ERROR_RX_MALFORMED_CLIENT_HELLO; + goto alert_loser; + } + + rv = ssl3_NegotiateVersion(ss, version, PR_TRUE); + if (rv != SECSuccess) { + /* send back which ever alert client will understand. */ + desc = (version > SSL_LIBRARY_VERSION_3_0) ? protocol_version + : handshake_failure; + errCode = SSL_ERROR_UNSUPPORTED_VERSION; + goto alert_loser; + } + ss->ssl3.hs.preliminaryInfo |= ssl_preinfo_version; + + /* if we get a non-zero SID, just ignore it. */ + if (length != total) { + SSL_DBG(("%d: SSL3[%d]: bad v2 client hello message, len=%d should=%d", + SSL_GETPID(), ss->fd, length, total)); + desc = illegal_parameter; + errCode = SSL_ERROR_RX_MALFORMED_CLIENT_HELLO; + goto alert_loser; + } + + suites = buffer + SSL_HL_CLIENT_HELLO_HBYTES; + random = suites + suite_length + sid_length; + + if (rand_length < SSL_MIN_CHALLENGE_BYTES || + rand_length > SSL_MAX_CHALLENGE_BYTES) { + desc = illegal_parameter; + errCode = SSL_ERROR_RX_MALFORMED_CLIENT_HELLO; + goto alert_loser; + } + + PORT_Assert(SSL_MAX_CHALLENGE_BYTES == SSL3_RANDOM_LENGTH); + + PORT_Memset(&ss->ssl3.hs.client_random, 0, SSL3_RANDOM_LENGTH); + PORT_Memcpy( + &ss->ssl3.hs.client_random.rand[SSL3_RANDOM_LENGTH - rand_length], + random, rand_length); + + PRINT_BUF(60, (ss, "client random:", &ss->ssl3.hs.client_random.rand[0], + SSL3_RANDOM_LENGTH)); + i = ssl3_config_match_init(ss); + if (i <= 0) { + errCode = PORT_GetError(); /* error code is already set. */ + goto alert_loser; + } + + /* Select a cipher suite. + ** + ** NOTE: This suite selection algorithm should be the same as the one in + ** ssl3_HandleClientHello(). + ** + ** See the comments about export cipher suites in ssl3_HandleClientHello(). + */ + for (j = 0; j < ssl_V3_SUITES_IMPLEMENTED; j++) { + ssl3CipherSuiteCfg *suite = &ss->cipherSuites[j]; + SSLVersionRange vrange = { ss->version, ss->version }; + if (!config_match(suite, ss->ssl3.policy, &vrange, ss)) { + continue; + } + for (i = 0; i + 2 < suite_length; i += 3) { + PRUint32 suite_i = (suites[i] << 16) | (suites[i + 1] << 8) | suites[i + 2]; + if (suite_i == suite->cipher_suite) { + rv = ssl3_SetCipherSuite(ss, suite_i, PR_TRUE); + if (rv != SECSuccess) { + desc = internal_error; + errCode = PORT_GetError(); + goto alert_loser; + } + goto suite_found; + } + } + } + errCode = SSL_ERROR_NO_CYPHER_OVERLAP; + goto alert_loser; + +suite_found: + + /* If the ClientHello version is less than our maximum version, check for a + * TLS_FALLBACK_SCSV and reject the connection if found. */ + if (ss->vrange.max > ss->clientHelloVersion) { + for (i = 0; i + 2 < suite_length; i += 3) { + PRUint16 suite_i = (suites[i] << 16) | (suites[i + 1] << 8) | suites[i + 2]; + if (suite_i == TLS_FALLBACK_SCSV) { + desc = inappropriate_fallback; + errCode = SSL_ERROR_INAPPROPRIATE_FALLBACK_ALERT; + goto alert_loser; + } + } + } + + /* Look for the SCSV, and if found, treat it just like an empty RI + * extension by processing a local copy of an empty RI extension. + */ + for (i = 0; i + 2 < suite_length; i += 3) { + PRUint32 suite_i = (suites[i] << 16) | (suites[i + 1] << 8) | suites[i + 2]; + if (suite_i == TLS_EMPTY_RENEGOTIATION_INFO_SCSV) { + SSL3Opaque *b2 = (SSL3Opaque *)emptyRIext; + PRUint32 L2 = sizeof emptyRIext; + (void)ssl3_HandleExtensions(ss, &b2, &L2, client_hello); + break; + } + } + + if (ss->opt.requireSafeNegotiation && + !ssl3_ExtensionNegotiated(ss, ssl_renegotiation_info_xtn)) { + desc = handshake_failure; + errCode = SSL_ERROR_UNSAFE_NEGOTIATION; + goto alert_loser; + } + + ss->ssl3.hs.compression = ssl_compression_null; + + rv = ssl3_SelectServerCert(ss); + if (rv != SECSuccess) { + errCode = PORT_GetError(); + desc = handshake_failure; + goto alert_loser; + } + + /* we don't even search for a cache hit here. It's just a miss. */ + SSL_AtomicIncrementLong(&ssl3stats.hch_sid_cache_misses); + sid = ssl3_NewSessionID(ss, PR_TRUE); + if (sid == NULL) { + errCode = PORT_GetError(); + goto loser; /* memory error is set. */ + } + ss->sec.ci.sid = sid; + /* do not worry about memory leak of sid since it now belongs to ci */ + + /* We have to update the handshake hashes before we can send stuff */ + rv = ssl3_UpdateHandshakeHashes(ss, buffer, length); + if (rv != SECSuccess) { + errCode = PORT_GetError(); + goto loser; + } + + ssl_GetXmitBufLock(ss); + rv = ssl3_SendServerHelloSequence(ss); + ssl_ReleaseXmitBufLock(ss); + if (rv != SECSuccess) { + errCode = PORT_GetError(); + goto loser; + } + + ssl_ReleaseSSL3HandshakeLock(ss); + return SECSuccess; + +alert_loser: + SSL3_SendAlert(ss, alert_fatal, desc); +loser: + ssl_ReleaseSSL3HandshakeLock(ss); + PORT_SetError(errCode); + return SECFailure; +} + +/* The negotiated version number has been already placed in ss->version. +** +** Called from: ssl3_HandleClientHello (resuming session), +** ssl3_SendServerHelloSequence <- ssl3_HandleClientHello (new session), +** ssl3_SendServerHelloSequence <- ssl3_HandleV2ClientHello (new session) +*/ +SECStatus +ssl3_SendServerHello(sslSocket *ss) +{ + sslSessionID *sid; + SECStatus rv; + PRUint32 maxBytes = 65535; + PRUint32 length; + PRInt32 extensions_len = 0; + SSL3ProtocolVersion version; + + SSL_TRC(3, ("%d: SSL3[%d]: send server_hello handshake", SSL_GETPID(), + ss->fd)); + + PORT_Assert(ss->opt.noLocks || ssl_HaveXmitBufLock(ss)); + PORT_Assert(ss->opt.noLocks || ssl_HaveSSL3HandshakeLock(ss)); + + PORT_Assert(MSB(ss->version) == MSB(SSL_LIBRARY_VERSION_3_0)); + if (MSB(ss->version) != MSB(SSL_LIBRARY_VERSION_3_0)) { + PORT_SetError(SSL_ERROR_NO_CYPHER_OVERLAP); + return SECFailure; + } + + sid = ss->sec.ci.sid; + + extensions_len = ssl3_CallHelloExtensionSenders( + ss, PR_FALSE, maxBytes, &ss->xtnData.serverHelloSenders[0]); + if (extensions_len > 0) + extensions_len += 2; /* Add sizeof total extension length */ + + /* TLS 1.3 doesn't use the session_id or compression_method + * fields in the ServerHello. */ + length = sizeof(SSL3ProtocolVersion) + SSL3_RANDOM_LENGTH; + if (ss->version < SSL_LIBRARY_VERSION_TLS_1_3) { + length += 1 + ((sid == NULL) ? 0 : sid->u.ssl3.sessionIDLength); + } + length += sizeof(ssl3CipherSuite); + if (ss->version < SSL_LIBRARY_VERSION_TLS_1_3) { + length += 1; /* Compression */ + } + length += extensions_len; + + rv = ssl3_AppendHandshakeHeader(ss, server_hello, length); + if (rv != SECSuccess) { + return rv; /* err set by AppendHandshake. */ + } + + if (IS_DTLS(ss) && ss->version < SSL_LIBRARY_VERSION_TLS_1_3) { + version = dtls_TLSVersionToDTLSVersion(ss->version); + } else { + version = tls13_EncodeDraftVersion(ss->version); + } + + rv = ssl3_AppendHandshakeNumber(ss, version, 2); + if (rv != SECSuccess) { + return rv; /* err set by AppendHandshake. */ + } + /* Random already generated in ssl3_HandleClientHello */ + rv = ssl3_AppendHandshake( + ss, &ss->ssl3.hs.server_random, SSL3_RANDOM_LENGTH); + if (rv != SECSuccess) { + return rv; /* err set by AppendHandshake. */ + } + + if (ss->version < SSL_LIBRARY_VERSION_TLS_1_3) { + if (sid) { + rv = ssl3_AppendHandshakeVariable( + ss, sid->u.ssl3.sessionID, sid->u.ssl3.sessionIDLength, 1); + } else { + rv = ssl3_AppendHandshakeNumber(ss, 0, 1); + } + if (rv != SECSuccess) { + return rv; /* err set by AppendHandshake. */ + } + } + + rv = ssl3_AppendHandshakeNumber(ss, ss->ssl3.hs.cipher_suite, 2); + if (rv != SECSuccess) { + return rv; /* err set by AppendHandshake. */ + } + if (ss->version < SSL_LIBRARY_VERSION_TLS_1_3) { + rv = ssl3_AppendHandshakeNumber(ss, ss->ssl3.hs.compression, 1); + if (rv != SECSuccess) { + return rv; /* err set by AppendHandshake. */ + } + } + if (extensions_len) { + PRInt32 sent_len; + + extensions_len -= 2; + rv = ssl3_AppendHandshakeNumber(ss, extensions_len, 2); + if (rv != SECSuccess) + return rv; /* err set by ssl3_AppendHandshakeNumber */ + sent_len = ssl3_CallHelloExtensionSenders(ss, PR_TRUE, extensions_len, + &ss->xtnData.serverHelloSenders[0]); + PORT_Assert(sent_len == extensions_len); + if (sent_len != extensions_len) { + if (sent_len >= 0) + PORT_SetError(SEC_ERROR_LIBRARY_FAILURE); + return SECFailure; + } + } + + if (ss->version < SSL_LIBRARY_VERSION_TLS_1_3) { + rv = ssl3_SetupPendingCipherSpec(ss); + if (rv != SECSuccess) { + return rv; /* err set by ssl3_SetupPendingCipherSpec */ + } + } + + return SECSuccess; +} + +SECStatus +ssl_CreateDHEKeyPair(const sslNamedGroupDef *groupDef, + const ssl3DHParams *params, + sslEphemeralKeyPair **keyPair) +{ + SECKEYDHParams dhParam; + SECKEYPublicKey *pubKey = NULL; /* Ephemeral DH key */ + SECKEYPrivateKey *privKey = NULL; /* Ephemeral DH key */ + sslEphemeralKeyPair *pair; + + dhParam.prime.data = params->prime.data; + dhParam.prime.len = params->prime.len; + dhParam.base.data = params->base.data; + dhParam.base.len = params->base.len; + + PRINT_BUF(60, (NULL, "Server DH p", dhParam.prime.data, + dhParam.prime.len)); + PRINT_BUF(60, (NULL, "Server DH g", dhParam.base.data, + dhParam.base.len)); + + /* Generate ephemeral DH keypair */ + privKey = SECKEY_CreateDHPrivateKey(&dhParam, &pubKey, NULL); + if (!privKey || !pubKey) { + ssl_MapLowLevelError(SEC_ERROR_KEYGEN_FAIL); + return SECFailure; + } + + pair = ssl_NewEphemeralKeyPair(groupDef, privKey, pubKey); + if (!pair) { + SECKEY_DestroyPrivateKey(privKey); + SECKEY_DestroyPublicKey(pubKey); + + return SECFailure; + } + + *keyPair = pair; + return SECSuccess; +} + +static SECStatus +ssl3_SendDHServerKeyExchange(sslSocket *ss) +{ + const ssl3KEADef *kea_def = ss->ssl3.hs.kea_def; + SECStatus rv = SECFailure; + int length; + SECItem signed_hash = { siBuffer, NULL, 0 }; + SSL3Hashes hashes; + SSLHashType hashAlg; + + const ssl3DHParams *params; + sslEphemeralKeyPair *keyPair; + SECKEYPublicKey *pubKey; + SECKEYPrivateKey *certPrivateKey; + const sslNamedGroupDef *groupDef; + + if (kea_def->kea != kea_dhe_dss && kea_def->kea != kea_dhe_rsa) { + /* TODO: Support DH_anon. It might be sufficient to drop the signature. + See bug 1170510. */ + PORT_SetError(SSL_ERROR_SERVER_KEY_EXCHANGE_FAILURE); + return SECFailure; + } + + rv = ssl_SelectDHEGroup(ss, &groupDef); + if (rv == SECFailure) { + PORT_SetError(SSL_ERROR_NO_CYPHER_OVERLAP); + return SECFailure; + } + ss->sec.keaGroup = groupDef; + + params = ssl_GetDHEParams(groupDef); + rv = ssl_CreateDHEKeyPair(groupDef, params, &keyPair); + if (rv == SECFailure) { + ssl_MapLowLevelError(SEC_ERROR_KEYGEN_FAIL); + return SECFailure; + } + PR_APPEND_LINK(&keyPair->link, &ss->ephemeralKeyPairs); + + if (ss->ssl3.pwSpec->version == SSL_LIBRARY_VERSION_TLS_1_2) { + hashAlg = ssl_SignatureSchemeToHashType(ss->ssl3.hs.signatureScheme); + } else { + /* Use ssl_hash_none to represent the MD5+SHA1 combo. */ + hashAlg = ssl_hash_none; + } + + pubKey = keyPair->keys->pubKey; + PRINT_BUF(50, (ss, "DH public value:", + pubKey->u.dh.publicValue.data, + pubKey->u.dh.publicValue.len)); + rv = ssl3_ComputeDHKeyHash(ss, hashAlg, &hashes, + pubKey->u.dh.prime, + pubKey->u.dh.base, + pubKey->u.dh.publicValue, + PR_TRUE /* padY */); + if (rv != SECSuccess) { + ssl_MapLowLevelError(SSL_ERROR_SERVER_KEY_EXCHANGE_FAILURE); + goto loser; + } + + certPrivateKey = ss->sec.serverCert->serverKeyPair->privKey; + rv = ssl3_SignHashes(ss, &hashes, certPrivateKey, &signed_hash); + if (rv != SECSuccess) { + goto loser; /* ssl3_SignHashes has set err. */ + } + + length = 2 + pubKey->u.dh.prime.len + + 2 + pubKey->u.dh.base.len + + 2 + pubKey->u.dh.prime.len + + 2 + signed_hash.len; + + if (ss->ssl3.pwSpec->version >= SSL_LIBRARY_VERSION_TLS_1_2) { + length += 2; + } + + rv = ssl3_AppendHandshakeHeader(ss, server_key_exchange, length); + if (rv != SECSuccess) { + goto loser; /* err set by AppendHandshake. */ + } + + rv = ssl3_AppendHandshakeVariable(ss, pubKey->u.dh.prime.data, + pubKey->u.dh.prime.len, 2); + if (rv != SECSuccess) { + goto loser; /* err set by AppendHandshake. */ + } + + rv = ssl3_AppendHandshakeVariable(ss, pubKey->u.dh.base.data, + pubKey->u.dh.base.len, 2); + if (rv != SECSuccess) { + goto loser; /* err set by AppendHandshake. */ + } + + rv = ssl_AppendPaddedDHKeyShare(ss, pubKey, PR_TRUE); + if (rv != SECSuccess) { + goto loser; /* err set by AppendHandshake. */ + } + + if (ss->ssl3.pwSpec->version >= SSL_LIBRARY_VERSION_TLS_1_2) { + rv = ssl3_AppendHandshakeNumber(ss, ss->ssl3.hs.signatureScheme, 2); + if (rv != SECSuccess) { + goto loser; /* err set by AppendHandshake. */ + } + } + + rv = ssl3_AppendHandshakeVariable(ss, signed_hash.data, + signed_hash.len, 2); + if (rv != SECSuccess) { + goto loser; /* err set by AppendHandshake. */ + } + PORT_Free(signed_hash.data); + return SECSuccess; + +loser: + if (signed_hash.data) + PORT_Free(signed_hash.data); + return SECFailure; +} + +static SECStatus +ssl3_SendServerKeyExchange(sslSocket *ss) +{ + const ssl3KEADef *kea_def = ss->ssl3.hs.kea_def; + + SSL_TRC(3, ("%d: SSL3[%d]: send server_key_exchange handshake", + SSL_GETPID(), ss->fd)); + + PORT_Assert(ss->opt.noLocks || ssl_HaveXmitBufLock(ss)); + PORT_Assert(ss->opt.noLocks || ssl_HaveSSL3HandshakeLock(ss)); + + switch (kea_def->exchKeyType) { + case ssl_kea_dh: { + return ssl3_SendDHServerKeyExchange(ss); + } + + case ssl_kea_ecdh: { + return ssl3_SendECDHServerKeyExchange(ss); + } + + case ssl_kea_rsa: + case ssl_kea_null: + default: + PORT_SetError(SEC_ERROR_LIBRARY_FAILURE); + break; + } + + return SECFailure; +} + +SECStatus +ssl3_EncodeSigAlgs(const sslSocket *ss, PRUint8 *buf, unsigned maxLen, PRUint32 *len) +{ + unsigned int i; + PRUint8 *p = buf; + + PORT_Assert(maxLen >= ss->ssl3.signatureSchemeCount * 2); + if (maxLen < ss->ssl3.signatureSchemeCount * 2) { + PORT_SetError(SEC_ERROR_LIBRARY_FAILURE); + return SECFailure; + } + + for (i = 0; i < ss->ssl3.signatureSchemeCount; ++i) { + PRUint32 policy = 0; + SSLHashType hashType = ssl_SignatureSchemeToHashType( + ss->ssl3.signatureSchemes[i]); + SECOidTag hashOID = ssl3_HashTypeToOID(hashType); + + /* Skip RSA-PSS schemes if there are no tokens to verify them. */ + if (ssl_IsRsaPssSignatureScheme(ss->ssl3.signatureSchemes[i]) && + !PK11_TokenExists(auth_alg_defs[ssl_auth_rsa_pss])) { + continue; + } + + if ((NSS_GetAlgorithmPolicy(hashOID, &policy) != SECSuccess) || + (policy & NSS_USE_ALG_IN_SSL_KX)) { + p = ssl_EncodeUintX((PRUint32)ss->ssl3.signatureSchemes[i], 2, p); + } + } + + if (p == buf) { + PORT_SetError(SSL_ERROR_NO_SUPPORTED_SIGNATURE_ALGORITHM); + return SECFailure; + } + *len = p - buf; + return SECSuccess; +} + +void +ssl3_GetCertificateRequestCAs(sslSocket *ss, int *calen, SECItem **names, + int *nnames) +{ + SECItem *name; + CERTDistNames *ca_list; + int i; + + *calen = 0; + *names = NULL; + *nnames = 0; + + /* ssl3.ca_list is initialized to NULL, and never changed. */ + ca_list = ss->ssl3.ca_list; + if (!ca_list) { + ca_list = ssl3_server_ca_list; + } + + if (ca_list != NULL) { + *names = ca_list->names; + *nnames = ca_list->nnames; + } + + for (i = 0, name = *names; i < *nnames; i++, name++) { + *calen += 2 + name->len; + } +} + +static SECStatus +ssl3_SendCertificateRequest(sslSocket *ss) +{ + PRBool isTLS12; + const PRUint8 *certTypes; + SECStatus rv; + int length; + SECItem *names; + int calen; + int nnames; + SECItem *name; + int i; + int certTypesLength; + PRUint8 sigAlgs[MAX_SIGNATURE_SCHEMES * 2]; + unsigned int sigAlgsLength = 0; + + SSL_TRC(3, ("%d: SSL3[%d]: send certificate_request handshake", + SSL_GETPID(), ss->fd)); + + PORT_Assert(ss->opt.noLocks || ssl_HaveXmitBufLock(ss)); + PORT_Assert(ss->opt.noLocks || ssl_HaveSSL3HandshakeLock(ss)); + + isTLS12 = (PRBool)(ss->ssl3.pwSpec->version >= SSL_LIBRARY_VERSION_TLS_1_2); + + ssl3_GetCertificateRequestCAs(ss, &calen, &names, &nnames); + certTypes = certificate_types; + certTypesLength = sizeof certificate_types; + + length = 1 + certTypesLength + 2 + calen; + if (isTLS12) { + rv = ssl3_EncodeSigAlgs(ss, sigAlgs, sizeof(sigAlgs), &sigAlgsLength); + if (rv != SECSuccess) { + return rv; + } + length += 2 + sigAlgsLength; + } + + rv = ssl3_AppendHandshakeHeader(ss, certificate_request, length); + if (rv != SECSuccess) { + return rv; /* err set by AppendHandshake. */ + } + rv = ssl3_AppendHandshakeVariable(ss, certTypes, certTypesLength, 1); + if (rv != SECSuccess) { + return rv; /* err set by AppendHandshake. */ + } + if (isTLS12) { + rv = ssl3_AppendHandshakeVariable(ss, sigAlgs, sigAlgsLength, 2); + if (rv != SECSuccess) { + return rv; /* err set by AppendHandshake. */ + } + } + rv = ssl3_AppendHandshakeNumber(ss, calen, 2); + if (rv != SECSuccess) { + return rv; /* err set by AppendHandshake. */ + } + for (i = 0, name = names; i < nnames; i++, name++) { + rv = ssl3_AppendHandshakeVariable(ss, name->data, name->len, 2); + if (rv != SECSuccess) { + return rv; /* err set by AppendHandshake. */ + } + } + + return SECSuccess; +} + +static SECStatus +ssl3_SendServerHelloDone(sslSocket *ss) +{ + SECStatus rv; + + SSL_TRC(3, ("%d: SSL3[%d]: send server_hello_done handshake", + SSL_GETPID(), ss->fd)); + + PORT_Assert(ss->opt.noLocks || ssl_HaveXmitBufLock(ss)); + PORT_Assert(ss->opt.noLocks || ssl_HaveSSL3HandshakeLock(ss)); + + rv = ssl3_AppendHandshakeHeader(ss, server_hello_done, 0); + if (rv != SECSuccess) { + return rv; /* err set by AppendHandshake. */ + } + rv = ssl3_FlushHandshake(ss, 0); + if (rv != SECSuccess) { + return rv; /* error code set by ssl3_FlushHandshake */ + } + return SECSuccess; +} + +/* Called from ssl3_HandlePostHelloHandshakeMessage() when it has deciphered + * a complete ssl3 Certificate Verify message + * Caller must hold Handshake and RecvBuf locks. + */ +static SECStatus +ssl3_HandleCertificateVerify(sslSocket *ss, SSL3Opaque *b, PRUint32 length, + SSL3Hashes *hashes) +{ + SECItem signed_hash = { siBuffer, NULL, 0 }; + SECStatus rv; + int errCode = SSL_ERROR_RX_MALFORMED_CERT_VERIFY; + SSL3AlertDescription desc = handshake_failure; + PRBool isTLS; + SSLSignatureScheme sigScheme; + SSLHashType hashAlg; + SSL3Hashes localHashes; + SSL3Hashes *hashesForVerify = NULL; + + SSL_TRC(3, ("%d: SSL3[%d]: handle certificate_verify handshake", + SSL_GETPID(), ss->fd)); + PORT_Assert(ss->opt.noLocks || ssl_HaveRecvBufLock(ss)); + PORT_Assert(ss->opt.noLocks || ssl_HaveSSL3HandshakeLock(ss)); + + /* TLS 1.3 is handled by tls13_HandleCertificateVerify */ + PORT_Assert(ss->ssl3.prSpec->version <= SSL_LIBRARY_VERSION_TLS_1_2); + + isTLS = (PRBool)(ss->ssl3.prSpec->version > SSL_LIBRARY_VERSION_3_0); + + if (ss->ssl3.hs.ws != wait_cert_verify) { + desc = unexpected_message; + errCode = SSL_ERROR_RX_UNEXPECTED_CERT_VERIFY; + goto alert_loser; + } + + if (!hashes) { + PORT_Assert(0); + desc = internal_error; + errCode = SEC_ERROR_LIBRARY_FAILURE; + goto alert_loser; + } + + if (ss->ssl3.hs.hashType == handshake_hash_record) { + rv = ssl_ConsumeSignatureScheme(ss, &b, &length, &sigScheme); + if (rv != SECSuccess) { + goto loser; /* malformed or unsupported. */ + } + rv = ssl_CheckSignatureSchemeConsistency(ss, sigScheme, + ss->sec.peerCert); + if (rv != SECSuccess) { + errCode = PORT_GetError(); + desc = decrypt_error; + goto alert_loser; + } + + hashAlg = ssl_SignatureSchemeToHashType(sigScheme); + + /* Read from the message buffer, but we need to use only up to the end + * of the previous handshake message. The length of the transcript up to + * that point is saved in |hashes->u.transcriptLen|. */ + rv = ssl3_ComputeHandshakeHash(ss->ssl3.hs.messages.buf, + hashes->u.transcriptLen, + hashAlg, &localHashes); + + if (rv == SECSuccess) { + hashesForVerify = &localHashes; + } else { + errCode = SSL_ERROR_DIGEST_FAILURE; + desc = decrypt_error; + goto alert_loser; + } + } else { + hashesForVerify = hashes; + sigScheme = ssl_sig_none; + } + + rv = ssl3_ConsumeHandshakeVariable(ss, &signed_hash, 2, &b, &length); + if (rv != SECSuccess) { + goto loser; /* malformed. */ + } + + /* XXX verify that the key & kea match */ + rv = ssl3_VerifySignedHashes(ss, sigScheme, hashesForVerify, &signed_hash); + if (rv != SECSuccess) { + errCode = PORT_GetError(); + desc = isTLS ? decrypt_error : handshake_failure; + goto alert_loser; + } + + signed_hash.data = NULL; + + if (length != 0) { + desc = isTLS ? decode_error : illegal_parameter; + goto alert_loser; /* malformed */ + } + ss->ssl3.hs.ws = wait_change_cipher; + return SECSuccess; + +alert_loser: + SSL3_SendAlert(ss, alert_fatal, desc); +loser: + PORT_SetError(errCode); + return SECFailure; +} + +/* find a slot that is able to generate a PMS and wrap it with RSA. + * Then generate and return the PMS. + * If the serverKeySlot parameter is non-null, this function will use + * that slot to do the job, otherwise it will find a slot. + * + * Called from ssl3_DeriveConnectionKeys() (above) + * ssl3_SendRSAClientKeyExchange() (above) + * ssl3_HandleRSAClientKeyExchange() (below) + * Caller must hold the SpecWriteLock, the SSL3HandshakeLock + */ +static PK11SymKey * +ssl3_GenerateRSAPMS(sslSocket *ss, ssl3CipherSpec *spec, + PK11SlotInfo *serverKeySlot) +{ + PK11SymKey *pms = NULL; + PK11SlotInfo *slot = serverKeySlot; + void *pwArg = ss->pkcs11PinArg; + SECItem param; + CK_VERSION version; + CK_MECHANISM_TYPE mechanism_array[3]; + + PORT_Assert(ss->opt.noLocks || ssl_HaveSSL3HandshakeLock(ss)); + + if (slot == NULL) { + SSLCipherAlgorithm calg; + /* The specReadLock would suffice here, but we cannot assert on + ** read locks. Also, all the callers who call with a non-null + ** slot already hold the SpecWriteLock. + */ + PORT_Assert(ss->opt.noLocks || ssl_HaveSpecWriteLock(ss)); + PORT_Assert(ss->ssl3.prSpec == ss->ssl3.pwSpec); + + calg = spec->cipher_def->calg; + + /* First get an appropriate slot. */ + mechanism_array[0] = CKM_SSL3_PRE_MASTER_KEY_GEN; + mechanism_array[1] = CKM_RSA_PKCS; + mechanism_array[2] = ssl3_Alg2Mech(calg); + + slot = PK11_GetBestSlotMultiple(mechanism_array, 3, pwArg); + if (slot == NULL) { + /* can't find a slot with all three, find a slot with the minimum */ + slot = PK11_GetBestSlotMultiple(mechanism_array, 2, pwArg); + if (slot == NULL) { + PORT_SetError(SSL_ERROR_TOKEN_SLOT_NOT_FOUND); + return pms; /* which is NULL */ + } + } + } + + /* Generate the pre-master secret ... */ + if (IS_DTLS(ss)) { + SSL3ProtocolVersion temp; + + temp = dtls_TLSVersionToDTLSVersion(ss->clientHelloVersion); + version.major = MSB(temp); + version.minor = LSB(temp); + } else { + version.major = MSB(ss->clientHelloVersion); + version.minor = LSB(ss->clientHelloVersion); + } + + param.data = (unsigned char *)&version; + param.len = sizeof version; + + pms = PK11_KeyGen(slot, CKM_SSL3_PRE_MASTER_KEY_GEN, ¶m, 0, pwArg); + if (!serverKeySlot) + PK11_FreeSlot(slot); + if (pms == NULL) { + ssl_MapLowLevelError(SSL_ERROR_CLIENT_KEY_EXCHANGE_FAILURE); + } + return pms; +} + +/* Note: The Bleichenbacher attack on PKCS#1 necessitates that we NEVER + * return any indication of failure of the Client Key Exchange message, + * where that failure is caused by the content of the client's message. + * This function must not return SECFailure for any reason that is directly + * or indirectly caused by the content of the client's encrypted PMS. + * We must not send an alert and also not drop the connection. + * Instead, we generate a random PMS. This will cause a failure + * in the processing the finished message, which is exactly where + * the failure must occur. + * + * Called from ssl3_HandleClientKeyExchange + */ +static SECStatus +ssl3_HandleRSAClientKeyExchange(sslSocket *ss, + SSL3Opaque *b, + PRUint32 length, + sslKeyPair *serverKeyPair) +{ + SECStatus rv; + SECItem enc_pms; + PK11SymKey *tmpPms[2] = { NULL, NULL }; + PK11SlotInfo *slot; + int useFauxPms = 0; + + PORT_Assert(ss->opt.noLocks || ssl_HaveRecvBufLock(ss)); + PORT_Assert(ss->opt.noLocks || ssl_HaveSSL3HandshakeLock(ss)); + PORT_Assert(ss->ssl3.prSpec == ss->ssl3.pwSpec); + + enc_pms.data = b; + enc_pms.len = length; + + if (ss->ssl3.prSpec->version > SSL_LIBRARY_VERSION_3_0) { /* isTLS */ + PRInt32 kLen; + kLen = ssl3_ConsumeHandshakeNumber(ss, 2, &enc_pms.data, &enc_pms.len); + if (kLen < 0) { + PORT_SetError(SSL_ERROR_CLIENT_KEY_EXCHANGE_FAILURE); + return SECFailure; + } + if ((unsigned)kLen < enc_pms.len) { + enc_pms.len = kLen; + } + } + +#define currentPms tmpPms[!useFauxPms] +#define unusedPms tmpPms[useFauxPms] +#define realPms tmpPms[1] +#define fauxPms tmpPms[0] + + /* + * Get as close to algorithm 2 from RFC 5246; Section 7.4.7.1 + * as we can within the constraints of the PKCS#11 interface. + * + * 1. Unconditionally generate a bogus PMS (what RFC 5246 + * calls R). + * 2. Attempt the RSA decryption to recover the PMS (what + * RFC 5246 calls M). + * 3. Set PMS = (M == NULL) ? R : M + * 4. Use ssl3_ComputeMasterSecret(PMS) to attempt to derive + * the MS from PMS. This includes performing the version + * check and length check. + * 5. If either the initial RSA decryption failed or + * ssl3_ComputeMasterSecret(PMS) failed, then discard + * M and set PMS = R. Else, discard R and set PMS = M. + * + * We do two derivations here because we can't rely on having + * a function that only performs the PMS version and length + * check. The only redundant cost is that this runs the PRF, + * which isn't necessary here. + */ + + /* Generate the bogus PMS (R) */ + slot = PK11_GetSlotFromPrivateKey(serverKeyPair->privKey); + if (!slot) { + PORT_SetError(SEC_ERROR_LIBRARY_FAILURE); + return SECFailure; + } + + if (!PK11_DoesMechanism(slot, CKM_SSL3_MASTER_KEY_DERIVE)) { + PK11_FreeSlot(slot); + slot = PK11_GetBestSlot(CKM_SSL3_MASTER_KEY_DERIVE, NULL); + if (!slot) { + PORT_SetError(SEC_ERROR_LIBRARY_FAILURE); + return SECFailure; + } + } + + ssl_GetSpecWriteLock(ss); + fauxPms = ssl3_GenerateRSAPMS(ss, ss->ssl3.prSpec, slot); + ssl_ReleaseSpecWriteLock(ss); + PK11_FreeSlot(slot); + + if (fauxPms == NULL) { + ssl_MapLowLevelError(SSL_ERROR_CLIENT_KEY_EXCHANGE_FAILURE); + return SECFailure; + } + + /* + * unwrap pms out of the incoming buffer + * Note: CKM_SSL3_MASTER_KEY_DERIVE is NOT the mechanism used to do + * the unwrap. Rather, it is the mechanism with which the + * unwrapped pms will be used. + */ + realPms = PK11_PubUnwrapSymKey(serverKeyPair->privKey, &enc_pms, + CKM_SSL3_MASTER_KEY_DERIVE, CKA_DERIVE, 0); + /* Temporarily use the PMS if unwrapping the real PMS fails. */ + useFauxPms |= (realPms == NULL); + + /* Attempt to derive the MS from the PMS. This is the only way to + * check the version field in the RSA PMS. If this fails, we + * then use the faux PMS in place of the PMS. Note that this + * operation should never fail if we are using the faux PMS + * since it is correctly formatted. */ + rv = ssl3_ComputeMasterSecret(ss, currentPms, NULL); + + /* If we succeeded, then select the true PMS and discard the + * FPMS. Else, select the FPMS and select the true PMS */ + useFauxPms |= (rv != SECSuccess); + + if (unusedPms) { + PK11_FreeSymKey(unusedPms); + } + + /* This step will derive the MS from the PMS, among other things. */ + rv = ssl3_InitPendingCipherSpec(ss, currentPms); + PK11_FreeSymKey(currentPms); + + if (rv != SECSuccess) { + (void)SSL3_SendAlert(ss, alert_fatal, handshake_failure); + return SECFailure; /* error code set by ssl3_InitPendingCipherSpec */ + } + +#undef currentPms +#undef unusedPms +#undef realPms +#undef fauxPms + + return SECSuccess; +} + +static SECStatus +ssl3_HandleDHClientKeyExchange(sslSocket *ss, + SSL3Opaque *b, + PRUint32 length, + sslKeyPair *serverKeyPair) +{ + PK11SymKey *pms; + SECStatus rv; + SECKEYPublicKey clntPubKey; + CK_MECHANISM_TYPE target; + PRBool isTLS; + + PORT_Assert(ss->opt.noLocks || ssl_HaveRecvBufLock(ss)); + PORT_Assert(ss->opt.noLocks || ssl_HaveSSL3HandshakeLock(ss)); + + clntPubKey.keyType = dhKey; + clntPubKey.u.dh.prime.len = serverKeyPair->pubKey->u.dh.prime.len; + clntPubKey.u.dh.prime.data = serverKeyPair->pubKey->u.dh.prime.data; + clntPubKey.u.dh.base.len = serverKeyPair->pubKey->u.dh.base.len; + clntPubKey.u.dh.base.data = serverKeyPair->pubKey->u.dh.base.data; + + rv = ssl3_ConsumeHandshakeVariable(ss, &clntPubKey.u.dh.publicValue, + 2, &b, &length); + if (rv != SECSuccess) { + return SECFailure; + } + + if (!ssl_IsValidDHEShare(&serverKeyPair->pubKey->u.dh.prime, + &clntPubKey.u.dh.publicValue)) { + PORT_SetError(SSL_ERROR_RX_MALFORMED_DHE_KEY_SHARE); + return SECFailure; + } + + isTLS = (PRBool)(ss->ssl3.prSpec->version > SSL_LIBRARY_VERSION_3_0); + + if (isTLS) + target = CKM_TLS_MASTER_KEY_DERIVE_DH; + else + target = CKM_SSL3_MASTER_KEY_DERIVE_DH; + + /* Determine the PMS */ + pms = PK11_PubDerive(serverKeyPair->privKey, &clntPubKey, PR_FALSE, NULL, NULL, + CKM_DH_PKCS_DERIVE, target, CKA_DERIVE, 0, NULL); + if (pms == NULL) { + ssl_FreeEphemeralKeyPairs(ss); + ssl_MapLowLevelError(SSL_ERROR_CLIENT_KEY_EXCHANGE_FAILURE); + return SECFailure; + } + + rv = ssl3_InitPendingCipherSpec(ss, pms); + PK11_FreeSymKey(pms); + ssl_FreeEphemeralKeyPairs(ss); + return rv; +} + +/* Called from ssl3_HandlePostHelloHandshakeMessage() when it has deciphered + * a complete ssl3 ClientKeyExchange message from the remote client + * Caller must hold Handshake and RecvBuf locks. + */ +static SECStatus +ssl3_HandleClientKeyExchange(sslSocket *ss, SSL3Opaque *b, PRUint32 length) +{ + sslKeyPair *serverKeyPair = NULL; + SECStatus rv; + const ssl3KEADef *kea_def; + + SSL_TRC(3, ("%d: SSL3[%d]: handle client_key_exchange handshake", + SSL_GETPID(), ss->fd)); + + PORT_Assert(ss->opt.noLocks || ssl_HaveRecvBufLock(ss)); + PORT_Assert(ss->opt.noLocks || ssl_HaveSSL3HandshakeLock(ss)); + + if (ss->ssl3.hs.ws != wait_client_key) { + SSL3_SendAlert(ss, alert_fatal, unexpected_message); + PORT_SetError(SSL_ERROR_RX_UNEXPECTED_CLIENT_KEY_EXCH); + return SECFailure; + } + + kea_def = ss->ssl3.hs.kea_def; + + if (kea_def->ephemeral) { + sslEphemeralKeyPair *keyPair; + /* There should be exactly one pair. */ + PORT_Assert(!PR_CLIST_IS_EMPTY(&ss->ephemeralKeyPairs)); + PORT_Assert(PR_PREV_LINK(&ss->ephemeralKeyPairs) == + PR_NEXT_LINK(&ss->ephemeralKeyPairs)); + keyPair = (sslEphemeralKeyPair *)PR_NEXT_LINK(&ss->ephemeralKeyPairs); + serverKeyPair = keyPair->keys; + ss->sec.keaKeyBits = + SECKEY_PublicKeyStrengthInBits(serverKeyPair->pubKey); + } else { + serverKeyPair = ss->sec.serverCert->serverKeyPair; + ss->sec.keaKeyBits = ss->sec.serverCert->serverKeyBits; + } + + if (!serverKeyPair) { + SSL3_SendAlert(ss, alert_fatal, handshake_failure); + PORT_SetError(SSL_ERROR_NO_SERVER_KEY_FOR_ALG); + return SECFailure; + } + PORT_Assert(serverKeyPair->pubKey); + PORT_Assert(serverKeyPair->privKey); + + ss->sec.keaType = kea_def->exchKeyType; + + switch (kea_def->exchKeyType) { + case ssl_kea_rsa: + rv = ssl3_HandleRSAClientKeyExchange(ss, b, length, serverKeyPair); + break; + + case ssl_kea_dh: + rv = ssl3_HandleDHClientKeyExchange(ss, b, length, serverKeyPair); + break; + + case ssl_kea_ecdh: + rv = ssl3_HandleECDHClientKeyExchange(ss, b, length, serverKeyPair); + break; + + default: + (void)ssl3_HandshakeFailure(ss); + PORT_SetError(SEC_ERROR_UNSUPPORTED_KEYALG); + return SECFailure; + } + ssl_FreeEphemeralKeyPairs(ss); + if (rv == SECSuccess) { + ss->ssl3.hs.ws = ss->sec.peerCert ? wait_cert_verify : wait_change_cipher; + } else { + /* PORT_SetError has been called by all the Handle*ClientKeyExchange + * functions above. However, not all error paths result in an alert, so + * this ensures that the server knows about the error. Note that if an + * alert was already sent, SSL3_SendAlert() is a noop. */ + PRErrorCode errCode = PORT_GetError(); + (void)SSL3_SendAlert(ss, alert_fatal, handshake_failure); + PORT_SetError(errCode); + } + return rv; +} + +/* This is TLS's equivalent of sending a no_certificate alert. */ +SECStatus +ssl3_SendEmptyCertificate(sslSocket *ss) +{ + SECStatus rv; + unsigned int len = 0; + PRBool isTLS13 = PR_FALSE; + const SECItem *context; + + if (ss->version >= SSL_LIBRARY_VERSION_TLS_1_3) { + PORT_Assert(ss->ssl3.hs.certificateRequest); + context = &ss->ssl3.hs.certificateRequest->context; + len = context->len + 1; + isTLS13 = PR_TRUE; + } + + rv = ssl3_AppendHandshakeHeader(ss, certificate, len + 3); + if (rv != SECSuccess) { + return rv; + } + + if (isTLS13) { + rv = ssl3_AppendHandshakeVariable(ss, context->data, context->len, 1); + if (rv != SECSuccess) { + return rv; + } + } + + return ssl3_AppendHandshakeNumber(ss, 0, 3); +} + +/* + * NewSessionTicket + * Called from ssl3_HandleFinished + */ +static SECStatus +ssl3_SendNewSessionTicket(sslSocket *ss) +{ + SECItem ticket = { 0, NULL, 0 }; + SECStatus rv; + NewSessionTicket nticket = { 0 }; + + rv = ssl3_EncodeSessionTicket(ss, &nticket, &ticket); + if (rv != SECSuccess) + goto loser; + + /* Serialize the handshake message. Length = + * lifetime (4) + ticket length (2) + ticket. */ + rv = ssl3_AppendHandshakeHeader(ss, new_session_ticket, + 4 + 2 + ticket.len); + if (rv != SECSuccess) + goto loser; + + /* This is a fixed value. */ + rv = ssl3_AppendHandshakeNumber(ss, TLS_EX_SESS_TICKET_LIFETIME_HINT, 4); + if (rv != SECSuccess) + goto loser; + + /* Encode the ticket. */ + rv = ssl3_AppendHandshakeVariable(ss, ticket.data, ticket.len, 2); + if (rv != SECSuccess) + goto loser; + + rv = SECSuccess; + +loser: + if (ticket.data) { + SECITEM_FreeItem(&ticket, PR_FALSE); + } + return rv; +} + +static SECStatus +ssl3_HandleNewSessionTicket(sslSocket *ss, SSL3Opaque *b, PRUint32 length) +{ + SECStatus rv; + SECItem ticketData; + + SSL_TRC(3, ("%d: SSL3[%d]: handle session_ticket handshake", + SSL_GETPID(), ss->fd)); + + PORT_Assert(ss->opt.noLocks || ssl_HaveRecvBufLock(ss)); + PORT_Assert(ss->opt.noLocks || ssl_HaveSSL3HandshakeLock(ss)); + + PORT_Assert(!ss->ssl3.hs.newSessionTicket.ticket.data); + PORT_Assert(!ss->ssl3.hs.receivedNewSessionTicket); + + if (ss->ssl3.hs.ws != wait_new_session_ticket) { + SSL3_SendAlert(ss, alert_fatal, unexpected_message); + PORT_SetError(SSL_ERROR_RX_UNEXPECTED_NEW_SESSION_TICKET); + return SECFailure; + } + + /* RFC5077 Section 3.3: "The client MUST NOT treat the ticket as valid + * until it has verified the server's Finished message." See the comment in + * ssl3_FinishHandshake for more details. + */ + ss->ssl3.hs.newSessionTicket.received_timestamp = ssl_Time(); + if (length < 4) { + (void)SSL3_SendAlert(ss, alert_fatal, decode_error); + PORT_SetError(SSL_ERROR_RX_MALFORMED_NEW_SESSION_TICKET); + return SECFailure; + } + ss->ssl3.hs.newSessionTicket.ticket_lifetime_hint = + (PRUint32)ssl3_ConsumeHandshakeNumber(ss, 4, &b, &length); + + rv = ssl3_ConsumeHandshakeVariable(ss, &ticketData, 2, &b, &length); + if (rv != SECSuccess || length != 0) { + (void)SSL3_SendAlert(ss, alert_fatal, decode_error); + PORT_SetError(SSL_ERROR_RX_MALFORMED_NEW_SESSION_TICKET); + return SECFailure; /* malformed */ + } + /* If the server sent a zero-length ticket, ignore it and keep the + * existing ticket. */ + if (ticketData.len != 0) { + rv = SECITEM_CopyItem(NULL, &ss->ssl3.hs.newSessionTicket.ticket, + &ticketData); + if (rv != SECSuccess) { + return rv; + } + ss->ssl3.hs.receivedNewSessionTicket = PR_TRUE; + } + + ss->ssl3.hs.ws = wait_change_cipher; + return SECSuccess; +} + +#ifdef NISCC_TEST +static PRInt32 connNum = 0; + +static SECStatus +get_fake_cert(SECItem *pCertItem, int *pIndex) +{ + PRFileDesc *cf; + char *testdir; + char *startat; + char *stopat; + const char *extension; + int fileNum; + PRInt32 numBytes = 0; + PRStatus prStatus; + PRFileInfo info; + char cfn[100]; + + pCertItem->data = 0; + if ((testdir = PR_GetEnvSecure("NISCC_TEST")) == NULL) { + return SECSuccess; + } + *pIndex = (NULL != strstr(testdir, "root")); + extension = (strstr(testdir, "simple") ? "" : ".der"); + fileNum = PR_ATOMIC_INCREMENT(&connNum) - 1; + if ((startat = PR_GetEnvSecure("START_AT")) != NULL) { + fileNum += atoi(startat); + } + if ((stopat = PR_GetEnvSecure("STOP_AT")) != NULL && + fileNum >= atoi(stopat)) { + *pIndex = -1; + return SECSuccess; + } + sprintf(cfn, "%s/%08d%s", testdir, fileNum, extension); + cf = PR_Open(cfn, PR_RDONLY, 0); + if (!cf) { + goto loser; + } + prStatus = PR_GetOpenFileInfo(cf, &info); + if (prStatus != PR_SUCCESS) { + PR_Close(cf); + goto loser; + } + pCertItem = SECITEM_AllocItem(NULL, pCertItem, info.size); + if (pCertItem) { + numBytes = PR_Read(cf, pCertItem->data, info.size); + } + PR_Close(cf); + if (numBytes != info.size) { + SECITEM_FreeItem(pCertItem, PR_FALSE); + PORT_SetError(SEC_ERROR_IO); + goto loser; + } + fprintf(stderr, "using %s\n", cfn); + return SECSuccess; + +loser: + fprintf(stderr, "failed to use %s\n", cfn); + *pIndex = -1; + return SECFailure; +} +#endif + +/* + * Used by both client and server. + * Called from HandleServerHelloDone and from SendServerHelloSequence. + */ +static SECStatus +ssl3_SendCertificate(sslSocket *ss) +{ + SECStatus rv; + CERTCertificateList *certChain; + int certChainLen = 0; + int i; +#ifdef NISCC_TEST + SECItem fakeCert; + int ndex = -1; +#endif + PRBool isTLS13 = ss->version >= SSL_LIBRARY_VERSION_TLS_1_3; + SECItem context = { siBuffer, NULL, 0 }; + unsigned int contextLen = 0; + + SSL_TRC(3, ("%d: SSL3[%d]: send certificate handshake", + SSL_GETPID(), ss->fd)); + + PORT_Assert(ss->opt.noLocks || ssl_HaveXmitBufLock(ss)); + PORT_Assert(ss->opt.noLocks || ssl_HaveSSL3HandshakeLock(ss)); + + if (ss->sec.localCert) + CERT_DestroyCertificate(ss->sec.localCert); + if (ss->sec.isServer) { + /* A server certificate is selected in ssl3_HandleClientHello. */ + PORT_Assert(ss->sec.serverCert); + + certChain = ss->sec.serverCert->serverCertChain; + ss->sec.localCert = CERT_DupCertificate(ss->sec.serverCert->serverCert); + } else { + certChain = ss->ssl3.clientCertChain; + ss->sec.localCert = CERT_DupCertificate(ss->ssl3.clientCertificate); + } + +#ifdef NISCC_TEST + rv = get_fake_cert(&fakeCert, &ndex); +#endif + + if (isTLS13) { + contextLen = 1; /* Size of the context length */ + if (!ss->sec.isServer) { + PORT_Assert(ss->ssl3.hs.certificateRequest); + context = ss->ssl3.hs.certificateRequest->context; + contextLen += context.len; + } + } + if (certChain) { + for (i = 0; i < certChain->len; i++) { +#ifdef NISCC_TEST + if (fakeCert.len > 0 && i == ndex) { + certChainLen += fakeCert.len + 3; + } else { + certChainLen += certChain->certs[i].len + 3; + } +#else + certChainLen += certChain->certs[i].len + 3; +#endif + } + } + + rv = ssl3_AppendHandshakeHeader(ss, certificate, + contextLen + certChainLen + 3); + if (rv != SECSuccess) { + return rv; /* err set by AppendHandshake. */ + } + + if (isTLS13) { + rv = ssl3_AppendHandshakeVariable(ss, context.data, + context.len, 1); + if (rv != SECSuccess) { + return rv; /* err set by AppendHandshake. */ + } + } + + rv = ssl3_AppendHandshakeNumber(ss, certChainLen, 3); + if (rv != SECSuccess) { + return rv; /* err set by AppendHandshake. */ + } + if (certChain) { + for (i = 0; i < certChain->len; i++) { +#ifdef NISCC_TEST + if (fakeCert.len > 0 && i == ndex) { + rv = ssl3_AppendHandshakeVariable(ss, fakeCert.data, + fakeCert.len, 3); + SECITEM_FreeItem(&fakeCert, PR_FALSE); + } else { + rv = ssl3_AppendHandshakeVariable(ss, certChain->certs[i].data, + certChain->certs[i].len, 3); + } +#else + rv = ssl3_AppendHandshakeVariable(ss, certChain->certs[i].data, + certChain->certs[i].len, 3); +#endif + if (rv != SECSuccess) { + return rv; /* err set by AppendHandshake. */ + } + } + } + + return SECSuccess; +} + +/* + * Used by server only. + * single-stapling, send only a single cert status + */ +SECStatus +ssl3_SendCertificateStatus(sslSocket *ss) +{ + SECStatus rv; + int len = 0; + SECItemArray *statusToSend = NULL; + const sslServerCert *serverCert; + + SSL_TRC(3, ("%d: SSL3[%d]: send certificate status handshake", + SSL_GETPID(), ss->fd)); + + PORT_Assert(ss->opt.noLocks || ssl_HaveXmitBufLock(ss)); + PORT_Assert(ss->opt.noLocks || ssl_HaveSSL3HandshakeLock(ss)); + PORT_Assert(ss->sec.isServer); + + if (!ssl3_ExtensionNegotiated(ss, ssl_cert_status_xtn)) + return SECSuccess; + + /* Use certStatus based on the cert being used. */ + serverCert = ss->sec.serverCert; + if (serverCert->certStatusArray && serverCert->certStatusArray->len) { + statusToSend = serverCert->certStatusArray; + } + if (!statusToSend) + return SECSuccess; + + /* Use the array's first item only (single stapling) */ + len = 1 + statusToSend->items[0].len + 3; + + rv = ssl3_AppendHandshakeHeader(ss, certificate_status, len); + if (rv != SECSuccess) { + return rv; /* err set by AppendHandshake. */ + } + rv = ssl3_AppendHandshakeNumber(ss, 1 /*ocsp*/, 1); + if (rv != SECSuccess) + return rv; /* err set by AppendHandshake. */ + + rv = ssl3_AppendHandshakeVariable(ss, + statusToSend->items[0].data, + statusToSend->items[0].len, + 3); + if (rv != SECSuccess) + return rv; /* err set by AppendHandshake. */ + + return SECSuccess; +} + +/* This is used to delete the CA certificates in the peer certificate chain + * from the cert database after they've been validated. + */ +void +ssl3_CleanupPeerCerts(sslSocket *ss) +{ + PLArenaPool *arena = ss->ssl3.peerCertArena; + ssl3CertNode *certs = (ssl3CertNode *)ss->ssl3.peerCertChain; + + for (; certs; certs = certs->next) { + CERT_DestroyCertificate(certs->cert); + } + if (arena) + PORT_FreeArena(arena, PR_FALSE); + ss->ssl3.peerCertArena = NULL; + ss->ssl3.peerCertChain = NULL; + + if (ss->sec.peerCert != NULL) { + if (ss->sec.peerKey) { + SECKEY_DestroyPublicKey(ss->sec.peerKey); + ss->sec.peerKey = NULL; + } + CERT_DestroyCertificate(ss->sec.peerCert); + ss->sec.peerCert = NULL; + } +} + +/* Called from ssl3_HandlePostHelloHandshakeMessage() when it has deciphered + * a complete ssl3 CertificateStatus message. + * Caller must hold Handshake and RecvBuf locks. + */ +static SECStatus +ssl3_HandleCertificateStatus(sslSocket *ss, SSL3Opaque *b, PRUint32 length) +{ + SECStatus rv; + + if (ss->ssl3.hs.ws != wait_certificate_status) { + (void)SSL3_SendAlert(ss, alert_fatal, unexpected_message); + PORT_SetError(SSL_ERROR_RX_UNEXPECTED_CERT_STATUS); + return SECFailure; + } + + rv = ssl_ReadCertificateStatus(ss, b, length); + if (rv != SECSuccess) { + return SECFailure; /* code already set */ + } + + return ssl3_AuthCertificate(ss); +} + +SECStatus +ssl_ReadCertificateStatus(sslSocket *ss, SSL3Opaque *b, PRUint32 length) +{ + PRInt32 status, len; + + PORT_Assert(!ss->sec.isServer); + + /* Consume the CertificateStatusType enum */ + status = ssl3_ConsumeHandshakeNumber(ss, 1, &b, &length); + if (status != 1 /* ocsp */) { + ssl3_DecodeError(ss); /* sets error code */ + return SECFailure; + } + + len = ssl3_ConsumeHandshakeNumber(ss, 3, &b, &length); + if (len != length) { + ssl3_DecodeError(ss); /* sets error code */ + return SECFailure; + } + +#define MAX_CERTSTATUS_LEN 0x1ffff /* 128k - 1 */ + if (length > MAX_CERTSTATUS_LEN) { + ssl3_DecodeError(ss); /* sets error code */ + return SECFailure; + } +#undef MAX_CERTSTATUS_LEN + + /* Array size 1, because we currently implement single-stapling only */ + SECITEM_AllocArray(NULL, &ss->sec.ci.sid->peerCertStatus, 1); + if (!ss->sec.ci.sid->peerCertStatus.items) + return SECFailure; /* code already set */ + + ss->sec.ci.sid->peerCertStatus.items[0].data = PORT_Alloc(length); + + if (!ss->sec.ci.sid->peerCertStatus.items[0].data) { + SECITEM_FreeArray(&ss->sec.ci.sid->peerCertStatus, PR_FALSE); + return SECFailure; /* code already set */ + } + + PORT_Memcpy(ss->sec.ci.sid->peerCertStatus.items[0].data, b, length); + ss->sec.ci.sid->peerCertStatus.items[0].len = length; + ss->sec.ci.sid->peerCertStatus.items[0].type = siBuffer; + return SECSuccess; +} + +/* Called from ssl3_HandlePostHelloHandshakeMessage() when it has deciphered + * a complete ssl3 Certificate message. + * Caller must hold Handshake and RecvBuf locks. + */ +static SECStatus +ssl3_HandleCertificate(sslSocket *ss, SSL3Opaque *b, PRUint32 length) +{ + SSL_TRC(3, ("%d: SSL3[%d]: handle certificate handshake", + SSL_GETPID(), ss->fd)); + PORT_Assert(ss->opt.noLocks || ssl_HaveRecvBufLock(ss)); + PORT_Assert(ss->opt.noLocks || ssl_HaveSSL3HandshakeLock(ss)); + + if ((ss->sec.isServer && ss->ssl3.hs.ws != wait_client_cert) || + (!ss->sec.isServer && ss->ssl3.hs.ws != wait_server_cert)) { + (void)SSL3_SendAlert(ss, alert_fatal, unexpected_message); + PORT_SetError(SSL_ERROR_RX_UNEXPECTED_CERTIFICATE); + return SECFailure; + } + + return ssl3_CompleteHandleCertificate(ss, b, length); +} + +/* Called from ssl3_HandleCertificate + */ +SECStatus +ssl3_CompleteHandleCertificate(sslSocket *ss, SSL3Opaque *b, PRUint32 length) +{ + ssl3CertNode *c; + ssl3CertNode *lastCert = NULL; + PRInt32 remaining = 0; + PRInt32 size; + SECStatus rv; + PRBool isServer = ss->sec.isServer; + PRBool isTLS; + SSL3AlertDescription desc; + int errCode = SSL_ERROR_RX_MALFORMED_CERTIFICATE; + SECItem certItem; + + ssl3_CleanupPeerCerts(ss); + isTLS = (PRBool)(ss->ssl3.prSpec->version > SSL_LIBRARY_VERSION_3_0); + + /* It is reported that some TLS client sends a Certificate message + ** with a zero-length message body. We'll treat that case like a + ** normal no_certificates message to maximize interoperability. + */ + if (length) { + remaining = ssl3_ConsumeHandshakeNumber(ss, 3, &b, &length); + if (remaining < 0) + goto loser; /* fatal alert already sent by ConsumeHandshake. */ + if ((PRUint32)remaining > length) + goto decode_loser; + } + + if (!remaining) { + if (!(isTLS && isServer)) { + desc = bad_certificate; + goto alert_loser; + } + /* This is TLS's version of a no_certificate alert. */ + /* I'm a server. I've requested a client cert. He hasn't got one. */ + rv = ssl3_HandleNoCertificate(ss); + if (rv != SECSuccess) { + errCode = PORT_GetError(); + goto loser; + } + + if (ss->version < SSL_LIBRARY_VERSION_TLS_1_3) { + ss->ssl3.hs.ws = wait_client_key; + } else { + TLS13_SET_HS_STATE(ss, wait_finished); + } + return SECSuccess; + } + + ss->ssl3.peerCertArena = PORT_NewArena(DER_DEFAULT_CHUNKSIZE); + if (ss->ssl3.peerCertArena == NULL) { + goto loser; /* don't send alerts on memory errors */ + } + + /* First get the peer cert. */ + remaining -= 3; + if (remaining < 0) + goto decode_loser; + + size = ssl3_ConsumeHandshakeNumber(ss, 3, &b, &length); + if (size <= 0) + goto loser; /* fatal alert already sent by ConsumeHandshake. */ + + if (remaining < size) + goto decode_loser; + + certItem.data = b; + certItem.len = size; + b += size; + length -= size; + remaining -= size; + + ss->sec.peerCert = CERT_NewTempCertificate(ss->dbHandle, &certItem, NULL, + PR_FALSE, PR_TRUE); + if (ss->sec.peerCert == NULL) { + /* We should report an alert if the cert was bad, but not if the + * problem was just some local problem, like memory error. + */ + goto ambiguous_err; + } + + /* Now get all of the CA certs. */ + while (remaining > 0) { + remaining -= 3; + if (remaining < 0) + goto decode_loser; + + size = ssl3_ConsumeHandshakeNumber(ss, 3, &b, &length); + if (size <= 0) + goto loser; /* fatal alert already sent by ConsumeHandshake. */ + + if (remaining < size) + goto decode_loser; + + certItem.data = b; + certItem.len = size; + b += size; + length -= size; + remaining -= size; + + c = PORT_ArenaNew(ss->ssl3.peerCertArena, ssl3CertNode); + if (c == NULL) { + goto loser; /* don't send alerts on memory errors */ + } + + c->cert = CERT_NewTempCertificate(ss->dbHandle, &certItem, NULL, + PR_FALSE, PR_TRUE); + if (c->cert == NULL) { + goto ambiguous_err; + } + + c->next = NULL; + if (lastCert) { + lastCert->next = c; + } else { + ss->ssl3.peerCertChain = c; + } + lastCert = c; + } + + if (remaining != 0) + goto decode_loser; + + SECKEY_UpdateCertPQG(ss->sec.peerCert); + + if (!isServer && + ss->version < SSL_LIBRARY_VERSION_TLS_1_3 && + ssl3_ExtensionNegotiated(ss, ssl_cert_status_xtn)) { + ss->ssl3.hs.ws = wait_certificate_status; + rv = SECSuccess; + } else { + rv = ssl3_AuthCertificate(ss); /* sets ss->ssl3.hs.ws */ + } + + return rv; + +ambiguous_err: + errCode = PORT_GetError(); + switch (errCode) { + case PR_OUT_OF_MEMORY_ERROR: + case SEC_ERROR_BAD_DATABASE: + case SEC_ERROR_NO_MEMORY: + if (isTLS) { + desc = internal_error; + goto alert_loser; + } + goto loser; + } + ssl3_SendAlertForCertError(ss, errCode); + goto loser; + +decode_loser: + desc = isTLS ? decode_error : bad_certificate; + +alert_loser: + (void)SSL3_SendAlert(ss, alert_fatal, desc); + +loser: + (void)ssl_MapLowLevelError(errCode); + return SECFailure; +} + +SECStatus +ssl3_AuthCertificate(sslSocket *ss) +{ + SECStatus rv; + PRBool isServer = ss->sec.isServer; + int errCode; + + ss->ssl3.hs.authCertificatePending = PR_FALSE; + + PORT_Assert((ss->ssl3.hs.preliminaryInfo & ssl_preinfo_all) == + ssl_preinfo_all); + /* + * Ask caller-supplied callback function to validate cert chain. + */ + rv = (SECStatus)(*ss->authCertificate)(ss->authCertificateArg, ss->fd, + PR_TRUE, isServer); + if (rv != SECSuccess) { + errCode = PORT_GetError(); + if (rv != SECWouldBlock) { + if (ss->handleBadCert) { + rv = (*ss->handleBadCert)(ss->badCertArg, ss->fd); + } + } + + if (rv == SECWouldBlock) { + if (ss->sec.isServer) { + errCode = SSL_ERROR_FEATURE_NOT_SUPPORTED_FOR_SERVERS; + goto loser; + } + + ss->ssl3.hs.authCertificatePending = PR_TRUE; + rv = SECSuccess; + } + + if (rv != SECSuccess) { + ssl3_SendAlertForCertError(ss, errCode); + goto loser; + } + } + + ss->sec.ci.sid->peerCert = CERT_DupCertificate(ss->sec.peerCert); + + if (!ss->sec.isServer) { + CERTCertificate *cert = ss->sec.peerCert; + + /* set the server authentication type and size from the value + ** in the cert. */ + SECKEYPublicKey *pubKey = CERT_ExtractPublicKey(cert); + if (ss->version < SSL_LIBRARY_VERSION_TLS_1_3) { + /* These are filled in in tls13_HandleCertificateVerify and + * tls13_HandleServerKeyShare. */ + ss->sec.authType = ss->ssl3.hs.kea_def->authKeyType; + ss->sec.keaType = ss->ssl3.hs.kea_def->exchKeyType; + } + if (pubKey) { + KeyType pubKeyType; + PRInt32 minKey; + /* This partly fixes Bug 124230 and may cause problems for + * callers which depend on the old (wrong) behavior. */ + ss->sec.authKeyBits = SECKEY_PublicKeyStrengthInBits(pubKey); + pubKeyType = SECKEY_GetPublicKeyType(pubKey); + minKey = ss->sec.authKeyBits; + switch (pubKeyType) { + case rsaKey: + case rsaPssKey: + case rsaOaepKey: + rv = + NSS_OptionGet(NSS_RSA_MIN_KEY_SIZE, &minKey); + if (rv != + SECSuccess) { + minKey = + SSL_RSA_MIN_MODULUS_BITS; + } + break; + case dsaKey: + rv = + NSS_OptionGet(NSS_DSA_MIN_KEY_SIZE, &minKey); + if (rv != + SECSuccess) { + minKey = + SSL_DSA_MIN_P_BITS; + } + break; + case dhKey: + rv = + NSS_OptionGet(NSS_DH_MIN_KEY_SIZE, &minKey); + if (rv != + SECSuccess) { + minKey = + SSL_DH_MIN_P_BITS; + } + break; + default: + break; + } + + /* Too small: not good enough. Send a fatal alert. */ + /* We aren't checking EC here on the understanding that we only + * support curves we like, a decision that might need revisiting. */ + if (ss->sec.authKeyBits < minKey) { + PORT_SetError(SSL_ERROR_WEAK_SERVER_CERT_KEY); + (void)SSL3_SendAlert(ss, alert_fatal, + ss->version >= SSL_LIBRARY_VERSION_TLS_1_0 + ? insufficient_security + : illegal_parameter); + SECKEY_DestroyPublicKey(pubKey); + return SECFailure; + } + SECKEY_DestroyPublicKey(pubKey); + pubKey = NULL; + } + + if (ss->version >= SSL_LIBRARY_VERSION_TLS_1_3) { + TLS13_SET_HS_STATE(ss, wait_cert_verify); + } else { + /* Ephemeral suites require ServerKeyExchange. */ + if (ss->ssl3.hs.kea_def->ephemeral) { + /* require server_key_exchange */ + ss->ssl3.hs.ws = wait_server_key; + } else { + /* disallow server_key_exchange */ + ss->ssl3.hs.ws = wait_cert_request; + /* This is static RSA key exchange so set the key exchange + * details to compensate for that. */ + ss->sec.keaKeyBits = ss->sec.authKeyBits; + ss->sec.signatureScheme = ssl_sig_none; + ss->sec.keaGroup = NULL; + } + } + } else { + /* Server */ + if (ss->version < SSL_LIBRARY_VERSION_TLS_1_3) { + ss->ssl3.hs.ws = wait_client_key; + } else { + TLS13_SET_HS_STATE(ss, wait_cert_verify); + } + } + + PORT_Assert(rv == SECSuccess); + if (rv != SECSuccess) { + errCode = SEC_ERROR_LIBRARY_FAILURE; + goto loser; + } + + return SECSuccess; + +loser: + (void)ssl_MapLowLevelError(errCode); + return SECFailure; +} + +static SECStatus ssl3_FinishHandshake(sslSocket *ss); + +static SECStatus +ssl3_AlwaysFail(sslSocket *ss) +{ + PORT_SetError(PR_INVALID_STATE_ERROR); + return SECFailure; +} + +/* Caller must hold 1stHandshakeLock. +*/ +SECStatus +ssl3_AuthCertificateComplete(sslSocket *ss, PRErrorCode error) +{ + SECStatus rv; + + PORT_Assert(ss->opt.noLocks || ssl_Have1stHandshakeLock(ss)); + + if (ss->sec.isServer) { + PORT_SetError(SSL_ERROR_FEATURE_NOT_SUPPORTED_FOR_SERVERS); + return SECFailure; + } + + ssl_GetRecvBufLock(ss); + ssl_GetSSL3HandshakeLock(ss); + + if (!ss->ssl3.hs.authCertificatePending) { + PORT_SetError(PR_INVALID_STATE_ERROR); + rv = SECFailure; + goto done; + } + + ss->ssl3.hs.authCertificatePending = PR_FALSE; + + if (error != 0) { + ss->ssl3.hs.restartTarget = ssl3_AlwaysFail; + ssl3_SendAlertForCertError(ss, error); + rv = SECSuccess; + } else if (ss->ssl3.hs.restartTarget != NULL) { + sslRestartTarget target = ss->ssl3.hs.restartTarget; + ss->ssl3.hs.restartTarget = NULL; + + if (target == ssl3_FinishHandshake) { + SSL_TRC(3, ("%d: SSL3[%p]: certificate authentication lost the race" + " with peer's finished message", + SSL_GETPID(), ss->fd)); + } + + rv = target(ss); + /* Even if we blocked here, we have accomplished enough to claim + * success. Any remaining work will be taken care of by subsequent + * calls to SSL_ForceHandshake/PR_Send/PR_Read/etc. + */ + if (rv == SECWouldBlock) { + rv = SECSuccess; + } + } else { + SSL_TRC(3, ("%d: SSL3[%p]: certificate authentication won the race with" + " peer's finished message", + SSL_GETPID(), ss->fd)); + + PORT_Assert(!ss->ssl3.hs.isResuming); + PORT_Assert(ss->ssl3.hs.ws != idle_handshake); + + if (ss->opt.enableFalseStart && + !ss->firstHsDone && + !ss->ssl3.hs.isResuming && + ssl3_WaitingForServerSecondRound(ss)) { + /* ssl3_SendClientSecondRound deferred the false start check because + * certificate authentication was pending, so we do it now if we still + * haven't received all of the server's second round yet. + */ + rv = ssl3_CheckFalseStart(ss); + } else { + rv = SECSuccess; + } + } + +done: + ssl_ReleaseSSL3HandshakeLock(ss); + ssl_ReleaseRecvBufLock(ss); + + return rv; +} + +static SECStatus +ssl3_ComputeTLSFinished(sslSocket *ss, ssl3CipherSpec *spec, + PRBool isServer, + const SSL3Hashes *hashes, + TLSFinished *tlsFinished) +{ + SECStatus rv; + CK_TLS_MAC_PARAMS tls_mac_params; + SECItem param = { siBuffer, NULL, 0 }; + PK11Context *prf_context; + unsigned int retLen; + + if (!spec->master_secret) { + const char *label = isServer ? "server finished" : "client finished"; + unsigned int len = 15; + HASH_HashType hashType = ssl3_GetTls12HashType(ss); + return ssl3_TLSPRFWithMasterSecret(spec, label, len, hashes->u.raw, + hashes->len, tlsFinished->verify_data, + sizeof tlsFinished->verify_data, hashType); + } + + if (spec->version < SSL_LIBRARY_VERSION_TLS_1_2) { + tls_mac_params.prfMechanism = CKM_TLS_PRF; + } else { + tls_mac_params.prfMechanism = ssl3_GetPrfHashMechanism(ss); + } + tls_mac_params.ulMacLength = 12; + tls_mac_params.ulServerOrClient = isServer ? 1 : 2; + param.data = (unsigned char *)&tls_mac_params; + param.len = sizeof(tls_mac_params); + prf_context = PK11_CreateContextBySymKey(CKM_TLS_MAC, CKA_SIGN, + spec->master_secret, ¶m); + if (!prf_context) + return SECFailure; + + rv = PK11_DigestBegin(prf_context); + rv |= PK11_DigestOp(prf_context, hashes->u.raw, hashes->len); + rv |= PK11_DigestFinal(prf_context, tlsFinished->verify_data, &retLen, + sizeof tlsFinished->verify_data); + PORT_Assert(rv != SECSuccess || retLen == sizeof tlsFinished->verify_data); + + PK11_DestroyContext(prf_context, PR_TRUE); + + return rv; +} + +/* The calling function must acquire and release the appropriate + * lock (e.g., ssl_GetSpecReadLock / ssl_ReleaseSpecReadLock for + * ss->ssl3.crSpec). + */ +SECStatus +ssl3_TLSPRFWithMasterSecret(ssl3CipherSpec *spec, const char *label, + unsigned int labelLen, const unsigned char *val, unsigned int valLen, + unsigned char *out, unsigned int outLen, HASH_HashType tls12HashType) +{ + SECStatus rv = SECSuccess; + + if (spec->master_secret) { + SECItem param = { siBuffer, NULL, 0 }; + CK_MECHANISM_TYPE mech = CKM_TLS_PRF_GENERAL; + PK11Context *prf_context; + unsigned int retLen; + + if (spec->version >= SSL_LIBRARY_VERSION_TLS_1_2) { + mech = CKM_NSS_TLS_PRF_GENERAL_SHA256; + } + prf_context = PK11_CreateContextBySymKey(mech, CKA_SIGN, + spec->master_secret, ¶m); + if (!prf_context) + return SECFailure; + + rv = PK11_DigestBegin(prf_context); + rv |= PK11_DigestOp(prf_context, (unsigned char *)label, labelLen); + rv |= PK11_DigestOp(prf_context, val, valLen); + rv |= PK11_DigestFinal(prf_context, out, &retLen, outLen); + PORT_Assert(rv != SECSuccess || retLen == outLen); + + PK11_DestroyContext(prf_context, PR_TRUE); + } else { + PORT_Assert(spec->master_secret); + PORT_SetError(SEC_ERROR_LIBRARY_FAILURE); + rv = SECFailure; + } + return rv; +} + +/* called from ssl3_SendClientSecondRound + * ssl3_HandleFinished + */ +static SECStatus +ssl3_SendNextProto(sslSocket *ss) +{ + SECStatus rv; + int padding_len; + static const unsigned char padding[32] = { 0 }; + + if (ss->xtnData.nextProto.len == 0 || + ss->xtnData.nextProtoState == SSL_NEXT_PROTO_SELECTED) { + return SECSuccess; + } + + PORT_Assert(ss->opt.noLocks || ssl_HaveXmitBufLock(ss)); + PORT_Assert(ss->opt.noLocks || ssl_HaveSSL3HandshakeLock(ss)); + + padding_len = 32 - ((ss->xtnData.nextProto.len + 2) % 32); + + rv = ssl3_AppendHandshakeHeader(ss, next_proto, ss->xtnData.nextProto.len + + 2 + + padding_len); + if (rv != SECSuccess) { + return rv; /* error code set by AppendHandshakeHeader */ + } + rv = ssl3_AppendHandshakeVariable(ss, ss->xtnData.nextProto.data, + ss->xtnData.nextProto.len, 1); + if (rv != SECSuccess) { + return rv; /* error code set by AppendHandshake */ + } + rv = ssl3_AppendHandshakeVariable(ss, padding, padding_len, 1); + if (rv != SECSuccess) { + return rv; /* error code set by AppendHandshake */ + } + return rv; +} + +/* called from ssl3_SendFinished + * + * This function is simply a debugging aid and therefore does not return a + * SECStatus. */ +static void +ssl3_RecordKeyLog(sslSocket *ss) +{ +#ifdef NSS_ALLOW_SSLKEYLOGFILE + SECStatus rv; + SECItem *keyData; + char buf[14 /* "CLIENT_RANDOM " */ + + SSL3_RANDOM_LENGTH * 2 /* client_random */ + + 1 /* " " */ + + 48 * 2 /* master secret */ + + 1 /* new line */]; + unsigned int j; + + PORT_Assert(ss->opt.noLocks || ssl_HaveSSL3HandshakeLock(ss)); + + if (!ssl_keylog_iob) + return; + + rv = PK11_ExtractKeyValue(ss->ssl3.cwSpec->master_secret); + if (rv != SECSuccess) + return; + + ssl_GetSpecReadLock(ss); + + /* keyData does not need to be freed. */ + keyData = PK11_GetKeyData(ss->ssl3.cwSpec->master_secret); + if (!keyData || !keyData->data || keyData->len != 48) { + ssl_ReleaseSpecReadLock(ss); + return; + } + + /* https://developer.mozilla.org/en/NSS_Key_Log_Format */ + + /* There could be multiple, concurrent writers to the + * keylog, so we have to do everything in a single call to + * fwrite. */ + + memcpy(buf, "CLIENT_RANDOM ", 14); + j = 14; + hexEncode(buf + j, ss->ssl3.hs.client_random.rand, SSL3_RANDOM_LENGTH); + j += SSL3_RANDOM_LENGTH * 2; + buf[j++] = ' '; + hexEncode(buf + j, keyData->data, 48); + j += 48 * 2; + buf[j++] = '\n'; + + PORT_Assert(j == sizeof(buf)); + + ssl_ReleaseSpecReadLock(ss); + + if (fwrite(buf, sizeof(buf), 1, ssl_keylog_iob) != 1) + return; + fflush(ssl_keylog_iob); + return; +#endif +} + +/* called from ssl3_SendClientSecondRound + * ssl3_HandleClientHello + * ssl3_HandleFinished + */ +static SECStatus +ssl3_SendFinished(sslSocket *ss, PRInt32 flags) +{ + ssl3CipherSpec *cwSpec; + PRBool isTLS; + PRBool isServer = ss->sec.isServer; + SECStatus rv; + SSL3Sender sender = isServer ? sender_server : sender_client; + SSL3Hashes hashes; + TLSFinished tlsFinished; + + SSL_TRC(3, ("%d: SSL3[%d]: send finished handshake", SSL_GETPID(), ss->fd)); + + PORT_Assert(ss->opt.noLocks || ssl_HaveXmitBufLock(ss)); + PORT_Assert(ss->opt.noLocks || ssl_HaveSSL3HandshakeLock(ss)); + + ssl_GetSpecReadLock(ss); + cwSpec = ss->ssl3.cwSpec; + isTLS = (PRBool)(cwSpec->version > SSL_LIBRARY_VERSION_3_0); + rv = ssl3_ComputeHandshakeHashes(ss, cwSpec, &hashes, sender); + if (isTLS && rv == SECSuccess) { + rv = ssl3_ComputeTLSFinished(ss, cwSpec, isServer, &hashes, &tlsFinished); + } + ssl_ReleaseSpecReadLock(ss); + if (rv != SECSuccess) { + goto fail; /* err code was set by ssl3_ComputeHandshakeHashes */ + } + + if (isTLS) { + if (isServer) + ss->ssl3.hs.finishedMsgs.tFinished[1] = tlsFinished; + else + ss->ssl3.hs.finishedMsgs.tFinished[0] = tlsFinished; + ss->ssl3.hs.finishedBytes = sizeof tlsFinished; + rv = ssl3_AppendHandshakeHeader(ss, finished, sizeof tlsFinished); + if (rv != SECSuccess) + goto fail; /* err set by AppendHandshake. */ + rv = ssl3_AppendHandshake(ss, &tlsFinished, sizeof tlsFinished); + if (rv != SECSuccess) + goto fail; /* err set by AppendHandshake. */ + } else { + if (isServer) + ss->ssl3.hs.finishedMsgs.sFinished[1] = hashes.u.s; + else + ss->ssl3.hs.finishedMsgs.sFinished[0] = hashes.u.s; + PORT_Assert(hashes.len == sizeof hashes.u.s); + ss->ssl3.hs.finishedBytes = sizeof hashes.u.s; + rv = ssl3_AppendHandshakeHeader(ss, finished, sizeof hashes.u.s); + if (rv != SECSuccess) + goto fail; /* err set by AppendHandshake. */ + rv = ssl3_AppendHandshake(ss, &hashes.u.s, sizeof hashes.u.s); + if (rv != SECSuccess) + goto fail; /* err set by AppendHandshake. */ + } + rv = ssl3_FlushHandshake(ss, flags); + if (rv != SECSuccess) { + goto fail; /* error code set by ssl3_FlushHandshake */ + } + + ssl3_RecordKeyLog(ss); + + return SECSuccess; + +fail: + return rv; +} + +/* wrap the master secret, and put it into the SID. + * Caller holds the Spec read lock. + */ +SECStatus +ssl3_CacheWrappedMasterSecret(sslSocket *ss, sslSessionID *sid, + ssl3CipherSpec *spec, SSLAuthType authType) +{ + PK11SymKey *wrappingKey = NULL; + PK11SlotInfo *symKeySlot; + void *pwArg = ss->pkcs11PinArg; + SECStatus rv = SECFailure; + PRBool isServer = ss->sec.isServer; + CK_MECHANISM_TYPE mechanism = CKM_INVALID_MECHANISM; + + symKeySlot = PK11_GetSlotFromKey(spec->master_secret); + if (!isServer) { + int wrapKeyIndex; + int incarnation; + + /* these next few functions are mere accessors and don't fail. */ + sid->u.ssl3.masterWrapIndex = wrapKeyIndex = + PK11_GetCurrentWrapIndex(symKeySlot); + PORT_Assert(wrapKeyIndex == 0); /* array has only one entry! */ + + sid->u.ssl3.masterWrapSeries = incarnation = + PK11_GetSlotSeries(symKeySlot); + sid->u.ssl3.masterSlotID = PK11_GetSlotID(symKeySlot); + sid->u.ssl3.masterModuleID = PK11_GetModuleID(symKeySlot); + sid->u.ssl3.masterValid = PR_TRUE; + /* Get the default wrapping key, for wrapping the master secret before + * placing it in the SID cache entry. */ + wrappingKey = PK11_GetWrapKey(symKeySlot, wrapKeyIndex, + CKM_INVALID_MECHANISM, incarnation, + pwArg); + if (wrappingKey) { + mechanism = PK11_GetMechanism(wrappingKey); /* can't fail. */ + } else { + int keyLength; + /* if the wrappingKey doesn't exist, attempt to create it. + * Note: we intentionally ignore errors here. If we cannot + * generate a wrapping key, it is not fatal to this SSL connection, + * but we will not be able to restart this session. + */ + mechanism = PK11_GetBestWrapMechanism(symKeySlot); + keyLength = PK11_GetBestKeyLength(symKeySlot, mechanism); + /* Zero length means fixed key length algorithm, or error. + * It's ambiguous. + */ + wrappingKey = PK11_KeyGen(symKeySlot, mechanism, NULL, + keyLength, pwArg); + if (wrappingKey) { + PK11_SetWrapKey(symKeySlot, wrapKeyIndex, wrappingKey); + } + } + } else { + /* server socket using session cache. */ + mechanism = PK11_GetBestWrapMechanism(symKeySlot); + if (mechanism != CKM_INVALID_MECHANISM) { + wrappingKey = + ssl3_GetWrappingKey(ss, symKeySlot, ss->sec.serverCert, + mechanism, pwArg); + if (wrappingKey) { + mechanism = PK11_GetMechanism(wrappingKey); /* can't fail. */ + } + } + } + + sid->u.ssl3.masterWrapMech = mechanism; + PK11_FreeSlot(symKeySlot); + + if (wrappingKey) { + SECItem wmsItem; + + wmsItem.data = sid->u.ssl3.keys.wrapped_master_secret; + wmsItem.len = sizeof sid->u.ssl3.keys.wrapped_master_secret; + rv = PK11_WrapSymKey(mechanism, NULL, wrappingKey, + spec->master_secret, &wmsItem); + /* rv is examined below. */ + sid->u.ssl3.keys.wrapped_master_secret_len = wmsItem.len; + PK11_FreeSymKey(wrappingKey); + } + return rv; +} + +/* Called from ssl3_HandlePostHelloHandshakeMessage() when it has deciphered + * a complete ssl3 Finished message from the peer. + * Caller must hold Handshake and RecvBuf locks. + */ +static SECStatus +ssl3_HandleFinished(sslSocket *ss, SSL3Opaque *b, PRUint32 length, + const SSL3Hashes *hashes) +{ + sslSessionID *sid = ss->sec.ci.sid; + SECStatus rv = SECSuccess; + PRBool isServer = ss->sec.isServer; + PRBool isTLS; + + PORT_Assert(ss->opt.noLocks || ssl_HaveRecvBufLock(ss)); + PORT_Assert(ss->opt.noLocks || ssl_HaveSSL3HandshakeLock(ss)); + + SSL_TRC(3, ("%d: SSL3[%d]: handle finished handshake", + SSL_GETPID(), ss->fd)); + + if (ss->ssl3.hs.ws != wait_finished) { + SSL3_SendAlert(ss, alert_fatal, unexpected_message); + PORT_SetError(SSL_ERROR_RX_UNEXPECTED_FINISHED); + return SECFailure; + } + + if (!hashes) { + PORT_Assert(0); + SSL3_SendAlert(ss, alert_fatal, internal_error); + PORT_SetError(SEC_ERROR_LIBRARY_FAILURE); + return SECFailure; + } + + isTLS = (PRBool)(ss->ssl3.crSpec->version > SSL_LIBRARY_VERSION_3_0); + if (isTLS) { + TLSFinished tlsFinished; + + if (length != sizeof(tlsFinished)) { +#ifndef UNSAFE_FUZZER_MODE + (void)SSL3_SendAlert(ss, alert_fatal, decode_error); + PORT_SetError(SSL_ERROR_RX_MALFORMED_FINISHED); + return SECFailure; +#endif + } + rv = ssl3_ComputeTLSFinished(ss, ss->ssl3.crSpec, !isServer, + hashes, &tlsFinished); + if (!isServer) + ss->ssl3.hs.finishedMsgs.tFinished[1] = tlsFinished; + else + ss->ssl3.hs.finishedMsgs.tFinished[0] = tlsFinished; + ss->ssl3.hs.finishedBytes = sizeof(tlsFinished); + if (rv != SECSuccess || + 0 != NSS_SecureMemcmp(&tlsFinished, b, + PR_MIN(length, ss->ssl3.hs.finishedBytes))) { +#ifndef UNSAFE_FUZZER_MODE + (void)SSL3_SendAlert(ss, alert_fatal, decrypt_error); + PORT_SetError(SSL_ERROR_BAD_HANDSHAKE_HASH_VALUE); + return SECFailure; +#endif + } + } else { + if (length != sizeof(SSL3Finished)) { + (void)ssl3_IllegalParameter(ss); + PORT_SetError(SSL_ERROR_RX_MALFORMED_FINISHED); + return SECFailure; + } + + if (!isServer) + ss->ssl3.hs.finishedMsgs.sFinished[1] = hashes->u.s; + else + ss->ssl3.hs.finishedMsgs.sFinished[0] = hashes->u.s; + PORT_Assert(hashes->len == sizeof hashes->u.s); + ss->ssl3.hs.finishedBytes = sizeof hashes->u.s; + if (0 != NSS_SecureMemcmp(&hashes->u.s, b, length)) { + (void)ssl3_HandshakeFailure(ss); + PORT_SetError(SSL_ERROR_BAD_HANDSHAKE_HASH_VALUE); + return SECFailure; + } + } + + ssl_GetXmitBufLock(ss); /*************************************/ + + if ((isServer && !ss->ssl3.hs.isResuming) || + (!isServer && ss->ssl3.hs.isResuming)) { + PRInt32 flags = 0; + + /* Send a NewSessionTicket message if the client sent us + * either an empty session ticket, or one that did not verify. + * (Note that if either of these conditions was met, then the + * server has sent a SessionTicket extension in the + * ServerHello message.) + */ + if (isServer && !ss->ssl3.hs.isResuming && + ssl3_ExtensionNegotiated(ss, ssl_session_ticket_xtn) && + ssl3_KEASupportsTickets(ss->ssl3.hs.kea_def)) { + /* RFC 5077 Section 3.3: "In the case of a full handshake, the + * server MUST verify the client's Finished message before sending + * the ticket." Presumably, this also means that the client's + * certificate, if any, must be verified beforehand too. + */ + rv = ssl3_SendNewSessionTicket(ss); + if (rv != SECSuccess) { + goto xmit_loser; + } + } + + rv = ssl3_SendChangeCipherSpecs(ss); + if (rv != SECSuccess) { + goto xmit_loser; /* err is set. */ + } + /* If this thread is in SSL_SecureSend (trying to write some data) + ** then set the ssl_SEND_FLAG_FORCE_INTO_BUFFER flag, so that the + ** last two handshake messages (change cipher spec and finished) + ** will be sent in the same send/write call as the application data. + */ + if (ss->writerThread == PR_GetCurrentThread()) { + flags = ssl_SEND_FLAG_FORCE_INTO_BUFFER; + } + + if (!isServer && !ss->firstHsDone) { + rv = ssl3_SendNextProto(ss); + if (rv != SECSuccess) { + goto xmit_loser; /* err code was set. */ + } + } + + if (IS_DTLS(ss)) { + flags |= ssl_SEND_FLAG_NO_RETRANSMIT; + } + + rv = ssl3_SendFinished(ss, flags); + if (rv != SECSuccess) { + goto xmit_loser; /* err is set. */ + } + } + +xmit_loser: + ssl_ReleaseXmitBufLock(ss); /*************************************/ + if (rv != SECSuccess) { + return rv; + } + + if (sid->cached == never_cached && !ss->opt.noCache) { + rv = ssl3_FillInCachedSID(ss, sid); + + /* If the wrap failed, we don't cache the sid. + * The connection continues normally however. + */ + ss->ssl3.hs.cacheSID = rv == SECSuccess; + } + + if (ss->ssl3.hs.authCertificatePending) { + if (ss->ssl3.hs.restartTarget) { + PR_NOT_REACHED("ssl3_HandleFinished: unexpected restartTarget"); + PORT_SetError(SEC_ERROR_LIBRARY_FAILURE); + return SECFailure; + } + + ss->ssl3.hs.restartTarget = ssl3_FinishHandshake; + return SECWouldBlock; + } + + rv = ssl3_FinishHandshake(ss); + return rv; +} + +SECStatus +ssl3_FillInCachedSID(sslSocket *ss, sslSessionID *sid) +{ + SECStatus rv; + + /* fill in the sid */ + sid->u.ssl3.cipherSuite = ss->ssl3.hs.cipher_suite; + sid->u.ssl3.compression = ss->ssl3.hs.compression; + sid->u.ssl3.policy = ss->ssl3.policy; + sid->version = ss->version; + sid->authType = ss->sec.authType; + sid->authKeyBits = ss->sec.authKeyBits; + sid->keaType = ss->sec.keaType; + sid->keaKeyBits = ss->sec.keaKeyBits; + sid->lastAccessTime = sid->creationTime = ssl_Time(); + sid->expirationTime = sid->creationTime + ssl3_sid_timeout; + sid->localCert = CERT_DupCertificate(ss->sec.localCert); + if (ss->sec.isServer) { + memcpy(&sid->certType, &ss->sec.serverCert->certType, sizeof(sid->certType)); + } else { + sid->certType.authType = ssl_auth_null; + } + + if (ss->xtnData.nextProtoState != SSL_NEXT_PROTO_NO_SUPPORT && + ss->xtnData.nextProto.data) { + if (SECITEM_CopyItem( + NULL, &sid->u.ssl3.alpnSelection, &ss->xtnData.nextProto) != SECSuccess) { + return SECFailure; /* error already set. */ + } + } + + ssl_GetSpecReadLock(ss); /*************************************/ + + /* Copy the master secret (wrapped or unwrapped) into the sid */ + if (ss->ssl3.crSpec->msItem.len && ss->ssl3.crSpec->msItem.data) { + sid->u.ssl3.keys.wrapped_master_secret_len = + ss->ssl3.crSpec->msItem.len; + memcpy(sid->u.ssl3.keys.wrapped_master_secret, + ss->ssl3.crSpec->msItem.data, ss->ssl3.crSpec->msItem.len); + sid->u.ssl3.masterValid = PR_TRUE; + sid->u.ssl3.keys.msIsWrapped = PR_FALSE; + rv = SECSuccess; + } else { + rv = ssl3_CacheWrappedMasterSecret(ss, ss->sec.ci.sid, + ss->ssl3.crSpec, + ss->ssl3.hs.kea_def->authKeyType); + sid->u.ssl3.keys.msIsWrapped = PR_TRUE; + } + ssl_ReleaseSpecReadLock(ss); /*************************************/ + + return rv; +} + +/* The return type is SECStatus instead of void because this function needs + * to have type sslRestartTarget. + */ +SECStatus +ssl3_FinishHandshake(sslSocket *ss) +{ + PORT_Assert(ss->opt.noLocks || ssl_HaveRecvBufLock(ss)); + PORT_Assert(ss->opt.noLocks || ssl_HaveSSL3HandshakeLock(ss)); + PORT_Assert(ss->ssl3.hs.restartTarget == NULL); + + /* The first handshake is now completed. */ + ss->handshake = NULL; + + /* RFC 5077 Section 3.3: "The client MUST NOT treat the ticket as valid + * until it has verified the server's Finished message." When the server + * sends a NewSessionTicket in a resumption handshake, we must wait until + * the handshake is finished (we have verified the server's Finished + * AND the server's certificate) before we update the ticket in the sid. + * + * This must be done before we call ss->sec.cache(ss->sec.ci.sid) + * because CacheSID requires the session ticket to already be set, and also + * because of the lazy lock creation scheme used by CacheSID and + * ssl3_SetSIDSessionTicket. + */ + if (ss->ssl3.hs.receivedNewSessionTicket) { + PORT_Assert(!ss->sec.isServer); + ssl3_SetSIDSessionTicket(ss->sec.ci.sid, &ss->ssl3.hs.newSessionTicket); + /* The sid took over the ticket data */ + PORT_Assert(!ss->ssl3.hs.newSessionTicket.ticket.data); + ss->ssl3.hs.receivedNewSessionTicket = PR_FALSE; + } + + if (ss->ssl3.hs.cacheSID) { + PORT_Assert(ss->sec.ci.sid->cached == never_cached); + ss->sec.cache(ss->sec.ci.sid); + ss->ssl3.hs.cacheSID = PR_FALSE; + } + + ss->ssl3.hs.canFalseStart = PR_FALSE; /* False Start phase is complete */ + ss->ssl3.hs.ws = idle_handshake; + + ssl_FinishHandshake(ss); + + return SECSuccess; +} + +/* Called from ssl3_HandleHandshake() when it has gathered a complete ssl3 + * hanshake message. + * Caller must hold Handshake and RecvBuf locks. + */ +SECStatus +ssl3_HandleHandshakeMessage(sslSocket *ss, SSL3Opaque *b, PRUint32 length, + PRBool endOfRecord) +{ + SECStatus rv = SECSuccess; + SSL3HandshakeType type = ss->ssl3.hs.msg_type; + SSL3Hashes hashes; /* computed hashes are put here. */ + SSL3Hashes *hashesPtr = NULL; /* Set when hashes are computed */ + PRUint8 hdr[4]; + PRUint8 dtlsData[8]; + PRBool computeHashes = PR_FALSE; + PRUint16 epoch; + + PORT_Assert(ss->opt.noLocks || ssl_HaveRecvBufLock(ss)); + PORT_Assert(ss->opt.noLocks || ssl_HaveSSL3HandshakeLock(ss)); + /* + * We have to compute the hashes before we update them with the + * current message. + */ + if (ss->version < SSL_LIBRARY_VERSION_TLS_1_3) { + if ((type == finished) && (ss->ssl3.hs.ws == wait_finished)) { + computeHashes = PR_TRUE; + } else if ((type == certificate_verify) && (ss->ssl3.hs.ws == wait_cert_verify)) { + if (ss->ssl3.hs.hashType == handshake_hash_record) { + /* We cannot compute the hash yet. We must wait until we have + * decoded the certificate_verify message in + * ssl3_HandleCertificateVerify, which will tell us which + * hash function we must use. + * + * (ssl3_HandleCertificateVerify cannot simply look at the + * buffer length itself, because at the time we reach it, + * additional handshake messages will have been added to the + * buffer, e.g. the certificate_verify message itself.) + * + * Therefore, we use SSL3Hashes.u.transcriptLen to save how much + * data there is and read directly from ss->ssl3.hs.messages + * when calculating the hashes. + * + * ssl3_HandleCertificateVerify will detect + * hashType == handshake_hash_record + * and use that information to calculate the hash. + */ + hashes.u.transcriptLen = ss->ssl3.hs.messages.len; + hashesPtr = &hashes; + } else { + computeHashes = PR_TRUE; + } + } + } else { + if (type == certificate_verify) { + computeHashes = TLS13_IN_HS_STATE(ss, wait_cert_verify); + } else if (type == finished) { + computeHashes = + TLS13_IN_HS_STATE(ss, wait_cert_request, wait_finished); + } + } + + ssl_GetSpecReadLock(ss); /************************************/ + if (computeHashes) { + SSL3Sender sender = (SSL3Sender)0; + ssl3CipherSpec *rSpec = ss->version >= SSL_LIBRARY_VERSION_TLS_1_3 ? ss->ssl3.crSpec + : ss->ssl3.prSpec; + + if (type == finished) { + sender = ss->sec.isServer ? sender_client : sender_server; + rSpec = ss->ssl3.crSpec; + } + rv = ssl3_ComputeHandshakeHashes(ss, rSpec, &hashes, sender); + if (rv == SECSuccess) { + hashesPtr = &hashes; + } + } + ssl_ReleaseSpecReadLock(ss); /************************************/ + if (rv != SECSuccess) { + return rv; /* error code was set by ssl3_ComputeHandshakeHashes*/ + } + SSL_TRC(30, ("%d: SSL3[%d]: handle handshake message: %s", SSL_GETPID(), + ss->fd, ssl3_DecodeHandshakeType(ss->ssl3.hs.msg_type))); + + hdr[0] = (PRUint8)ss->ssl3.hs.msg_type; + hdr[1] = (PRUint8)(length >> 16); + hdr[2] = (PRUint8)(length >> 8); + hdr[3] = (PRUint8)(length); + + /* Start new handshake hashes when we start a new handshake. Unless this is + * TLS 1.3 and we sent a HelloRetryRequest. */ + if (ss->ssl3.hs.msg_type == client_hello && !ss->ssl3.hs.helloRetry) { + rv = ssl3_RestartHandshakeHashes(ss); + if (rv != SECSuccess) { + return rv; + } + } + /* We should not include hello_request and hello_verify_request messages + * in the handshake hashes */ + if ((ss->ssl3.hs.msg_type != hello_request) && + (ss->ssl3.hs.msg_type != hello_verify_request)) { + rv = ssl3_UpdateHandshakeHashes(ss, (unsigned char *)hdr, 4); + if (rv != SECSuccess) + return rv; /* err code already set. */ + + /* Extra data to simulate a complete DTLS handshake fragment */ + if (IS_DTLS(ss)) { + /* Sequence number */ + dtlsData[0] = MSB(ss->ssl3.hs.recvMessageSeq); + dtlsData[1] = LSB(ss->ssl3.hs.recvMessageSeq); + + /* Fragment offset */ + dtlsData[2] = 0; + dtlsData[3] = 0; + dtlsData[4] = 0; + + /* Fragment length */ + dtlsData[5] = (PRUint8)(length >> 16); + dtlsData[6] = (PRUint8)(length >> 8); + dtlsData[7] = (PRUint8)(length); + + rv = ssl3_UpdateHandshakeHashes(ss, (unsigned char *)dtlsData, + sizeof(dtlsData)); + if (rv != SECSuccess) + return rv; /* err code already set. */ + } + + /* The message body */ + rv = ssl3_UpdateHandshakeHashes(ss, b, length); + if (rv != SECSuccess) + return rv; /* err code already set. */ + } + + PORT_SetError(0); /* each message starts with no error. */ + + if (ss->ssl3.hs.ws == wait_certificate_status && + ss->ssl3.hs.msg_type != certificate_status) { + /* If we negotiated the certificate_status extension then we deferred + * certificate validation until we get the CertificateStatus messsage. + * But the CertificateStatus message is optional. If the server did + * not send it then we need to validate the certificate now. If the + * server does send the CertificateStatus message then we will + * authenticate the certificate in ssl3_HandleCertificateStatus. + */ + rv = ssl3_AuthCertificate(ss); /* sets ss->ssl3.hs.ws */ + PORT_Assert(rv != SECWouldBlock); + if (rv != SECSuccess) { + return rv; + } + } + + epoch = ss->ssl3.crSpec->epoch; + switch (ss->ssl3.hs.msg_type) { + case client_hello: + if (!ss->sec.isServer) { + (void)SSL3_SendAlert(ss, alert_fatal, unexpected_message); + PORT_SetError(SSL_ERROR_RX_UNEXPECTED_CLIENT_HELLO); + return SECFailure; + } + rv = ssl3_HandleClientHello(ss, b, length); + break; + case server_hello: + if (ss->sec.isServer) { + (void)SSL3_SendAlert(ss, alert_fatal, unexpected_message); + PORT_SetError(SSL_ERROR_RX_UNEXPECTED_SERVER_HELLO); + return SECFailure; + } + rv = ssl3_HandleServerHello(ss, b, length); + break; + default: + if (ss->version < SSL_LIBRARY_VERSION_TLS_1_3) { + rv = ssl3_HandlePostHelloHandshakeMessage(ss, b, length, hashesPtr); + } else { + rv = tls13_HandlePostHelloHandshakeMessage(ss, b, length, + hashesPtr); + } + break; + } + if (ss->version >= SSL_LIBRARY_VERSION_TLS_1_3 && + (epoch != ss->ssl3.crSpec->epoch) && !endOfRecord) { + /* If we changed read cipher states, there must not be any + * data in the input queue. */ + (void)SSL3_SendAlert(ss, alert_fatal, unexpected_message); + PORT_SetError(SSL_ERROR_RX_UNEXPECTED_HANDSHAKE); + return SECFailure; + } + + if (IS_DTLS(ss) && (rv != SECFailure)) { + /* Increment the expected sequence number */ + ss->ssl3.hs.recvMessageSeq++; + } + return rv; +} + +static SECStatus +ssl3_HandlePostHelloHandshakeMessage(sslSocket *ss, SSL3Opaque *b, + PRUint32 length, SSL3Hashes *hashesPtr) +{ + SECStatus rv; + PORT_Assert(ss->version < SSL_LIBRARY_VERSION_TLS_1_3); + + switch (ss->ssl3.hs.msg_type) { + case hello_request: + if (length != 0) { + (void)ssl3_DecodeError(ss); + PORT_SetError(SSL_ERROR_RX_MALFORMED_HELLO_REQUEST); + return SECFailure; + } + if (ss->sec.isServer) { + (void)SSL3_SendAlert(ss, alert_fatal, unexpected_message); + PORT_SetError(SSL_ERROR_RX_UNEXPECTED_HELLO_REQUEST); + return SECFailure; + } + rv = ssl3_HandleHelloRequest(ss); + break; + + case hello_retry_request: + /* This arrives here because - as a client - we haven't received a + * final decision on the version from the server. */ + rv = tls13_HandleHelloRetryRequest(ss, b, length); + break; + + case hello_verify_request: + if (!IS_DTLS(ss) || ss->sec.isServer) { + (void)SSL3_SendAlert(ss, alert_fatal, unexpected_message); + PORT_SetError(SSL_ERROR_RX_UNEXPECTED_HELLO_VERIFY_REQUEST); + return SECFailure; + } + rv = dtls_HandleHelloVerifyRequest(ss, b, length); + break; + case certificate: + rv = ssl3_HandleCertificate(ss, b, length); + break; + case certificate_status: + rv = ssl3_HandleCertificateStatus(ss, b, length); + break; + case server_key_exchange: + if (ss->sec.isServer) { + (void)SSL3_SendAlert(ss, alert_fatal, unexpected_message); + PORT_SetError(SSL_ERROR_RX_UNEXPECTED_SERVER_KEY_EXCH); + return SECFailure; + } + rv = ssl3_HandleServerKeyExchange(ss, b, length); + break; + case certificate_request: + if (ss->sec.isServer) { + (void)SSL3_SendAlert(ss, alert_fatal, unexpected_message); + PORT_SetError(SSL_ERROR_RX_UNEXPECTED_CERT_REQUEST); + return SECFailure; + } + rv = ssl3_HandleCertificateRequest(ss, b, length); + break; + case server_hello_done: + if (length != 0) { + (void)ssl3_DecodeError(ss); + PORT_SetError(SSL_ERROR_RX_MALFORMED_HELLO_DONE); + return SECFailure; + } + if (ss->sec.isServer) { + (void)SSL3_SendAlert(ss, alert_fatal, unexpected_message); + PORT_SetError(SSL_ERROR_RX_UNEXPECTED_HELLO_DONE); + return SECFailure; + } + rv = ssl3_HandleServerHelloDone(ss); + break; + case certificate_verify: + if (!ss->sec.isServer) { + (void)SSL3_SendAlert(ss, alert_fatal, unexpected_message); + PORT_SetError(SSL_ERROR_RX_UNEXPECTED_CERT_VERIFY); + return SECFailure; + } + rv = ssl3_HandleCertificateVerify(ss, b, length, hashesPtr); + break; + case client_key_exchange: + if (!ss->sec.isServer) { + (void)SSL3_SendAlert(ss, alert_fatal, unexpected_message); + PORT_SetError(SSL_ERROR_RX_UNEXPECTED_CLIENT_KEY_EXCH); + return SECFailure; + } + rv = ssl3_HandleClientKeyExchange(ss, b, length); + break; + case new_session_ticket: + if (ss->sec.isServer) { + (void)SSL3_SendAlert(ss, alert_fatal, unexpected_message); + PORT_SetError(SSL_ERROR_RX_UNEXPECTED_NEW_SESSION_TICKET); + return SECFailure; + } + rv = ssl3_HandleNewSessionTicket(ss, b, length); + break; + case finished: + rv = ssl3_HandleFinished(ss, b, length, hashesPtr); + break; + default: + (void)SSL3_SendAlert(ss, alert_fatal, unexpected_message); + PORT_SetError(SSL_ERROR_RX_UNKNOWN_HANDSHAKE); + rv = SECFailure; + } + + return rv; +} + +/* Called only from ssl3_HandleRecord, for each (deciphered) ssl3 record. + * origBuf is the decrypted ssl record content. + * Caller must hold the handshake and RecvBuf locks. + */ +static SECStatus +ssl3_HandleHandshake(sslSocket *ss, sslBuffer *origBuf) +{ + /* + * There may be a partial handshake message already in the handshake + * state. The incoming buffer may contain another portion, or a + * complete message or several messages followed by another portion. + * + * Each message is made contiguous before being passed to the actual + * message parser. + */ + sslBuffer *buf = &ss->ssl3.hs.msgState; /* do not lose the original buffer pointer */ + SECStatus rv; + + PORT_Assert(ss->opt.noLocks || ssl_HaveRecvBufLock(ss)); + PORT_Assert(ss->opt.noLocks || ssl_HaveSSL3HandshakeLock(ss)); + + if (buf->buf == NULL) { + *buf = *origBuf; + } + while (buf->len > 0) { + if (ss->ssl3.hs.header_bytes < 4) { + PRUint8 t; + t = *(buf->buf++); + buf->len--; + if (ss->ssl3.hs.header_bytes++ == 0) + ss->ssl3.hs.msg_type = (SSL3HandshakeType)t; + else + ss->ssl3.hs.msg_len = (ss->ssl3.hs.msg_len << 8) + t; + if (ss->ssl3.hs.header_bytes < 4) + continue; + +#define MAX_HANDSHAKE_MSG_LEN 0x1ffff /* 128k - 1 */ + if (ss->ssl3.hs.msg_len > MAX_HANDSHAKE_MSG_LEN) { + (void)ssl3_DecodeError(ss); + PORT_SetError(SSL_ERROR_RX_MALFORMED_HANDSHAKE); + return SECFailure; + } +#undef MAX_HANDSHAKE_MSG_LEN + + /* If msg_len is zero, be sure we fall through, + ** even if buf->len is zero. + */ + if (ss->ssl3.hs.msg_len > 0) + continue; + } + + /* + * Header has been gathered and there is at least one byte of new + * data available for this message. If it can be done right out + * of the original buffer, then use it from there. + */ + if (ss->ssl3.hs.msg_body.len == 0 && buf->len >= ss->ssl3.hs.msg_len) { + /* handle it from input buffer */ + rv = ssl3_HandleHandshakeMessage(ss, buf->buf, ss->ssl3.hs.msg_len, + buf->len == ss->ssl3.hs.msg_len); + if (rv == SECFailure) { + /* This test wants to fall through on either + * SECSuccess or SECWouldBlock. + * ssl3_HandleHandshakeMessage MUST set the error code. + */ + return rv; + } + buf->buf += ss->ssl3.hs.msg_len; + buf->len -= ss->ssl3.hs.msg_len; + ss->ssl3.hs.msg_len = 0; + ss->ssl3.hs.header_bytes = 0; + if (rv != SECSuccess) { /* return if SECWouldBlock. */ + return rv; + } + } else { + /* must be copied to msg_body and dealt with from there */ + unsigned int bytes; + + PORT_Assert(ss->ssl3.hs.msg_body.len < ss->ssl3.hs.msg_len); + bytes = PR_MIN(buf->len, ss->ssl3.hs.msg_len - ss->ssl3.hs.msg_body.len); + + /* Grow the buffer if needed */ + rv = sslBuffer_Grow(&ss->ssl3.hs.msg_body, ss->ssl3.hs.msg_len); + if (rv != SECSuccess) { + /* sslBuffer_Grow has set a memory error code. */ + return SECFailure; + } + + PORT_Memcpy(ss->ssl3.hs.msg_body.buf + ss->ssl3.hs.msg_body.len, + buf->buf, bytes); + ss->ssl3.hs.msg_body.len += bytes; + buf->buf += bytes; + buf->len -= bytes; + + PORT_Assert(ss->ssl3.hs.msg_body.len <= ss->ssl3.hs.msg_len); + + /* if we have a whole message, do it */ + if (ss->ssl3.hs.msg_body.len == ss->ssl3.hs.msg_len) { + rv = ssl3_HandleHandshakeMessage( + ss, ss->ssl3.hs.msg_body.buf, ss->ssl3.hs.msg_len, + buf->len == 0); + if (rv == SECFailure) { + /* This test wants to fall through on either + * SECSuccess or SECWouldBlock. + * ssl3_HandleHandshakeMessage MUST set error code. + */ + return rv; + } + ss->ssl3.hs.msg_body.len = 0; + ss->ssl3.hs.msg_len = 0; + ss->ssl3.hs.header_bytes = 0; + if (rv != SECSuccess) { /* return if SECWouldBlock. */ + return rv; + } + } else { + PORT_Assert(buf->len == 0); + break; + } + } + } /* end loop */ + + origBuf->len = 0; /* So ssl3_GatherAppDataRecord will keep looping. */ + buf->buf = NULL; /* not a leak. */ + return SECSuccess; +} + +/* These macros return the given value with the MSB copied to all the other + * bits. They use the fact that arithmetic shift shifts-in the sign bit. + * However, this is not ensured by the C standard so you may need to replace + * them with something else for odd compilers. */ +#define DUPLICATE_MSB_TO_ALL(x) ((unsigned)((int)(x) >> (sizeof(int) * 8 - 1))) +#define DUPLICATE_MSB_TO_ALL_8(x) ((unsigned char)(DUPLICATE_MSB_TO_ALL(x))) + +/* SECStatusToMask returns, in constant time, a mask value of all ones if + * rv == SECSuccess. Otherwise it returns zero. */ +static unsigned int +SECStatusToMask(SECStatus rv) +{ + unsigned int good; + /* rv ^ SECSuccess is zero iff rv == SECSuccess. Subtracting one results + * in the MSB being set to one iff it was zero before. */ + good = rv ^ SECSuccess; + good--; + return DUPLICATE_MSB_TO_ALL(good); +} + +/* ssl_ConstantTimeGE returns 0xff if a>=b and 0x00 otherwise. */ +static unsigned char +ssl_ConstantTimeGE(unsigned int a, unsigned int b) +{ + a -= b; + return DUPLICATE_MSB_TO_ALL(~a); +} + +/* ssl_ConstantTimeEQ8 returns 0xff if a==b and 0x00 otherwise. */ +static unsigned char +ssl_ConstantTimeEQ8(unsigned char a, unsigned char b) +{ + unsigned int c = a ^ b; + c--; + return DUPLICATE_MSB_TO_ALL_8(c); +} + +/* ssl_constantTimeSelect return a if mask is 0xFF and b if mask is 0x00 */ +static unsigned char +ssl_constantTimeSelect(unsigned char mask, unsigned char a, unsigned char b) +{ + return (mask & a) | (~mask & b); +} + +static SECStatus +ssl_RemoveSSLv3CBCPadding(sslBuffer *plaintext, + unsigned int blockSize, + unsigned int macSize) +{ + unsigned int paddingLength, good, t; + const unsigned int overhead = 1 /* padding length byte */ + macSize; + + /* These lengths are all public so we can test them in non-constant + * time. */ + if (overhead > plaintext->len) { + return SECFailure; + } + + paddingLength = plaintext->buf[plaintext->len - 1]; + /* SSLv3 padding bytes are random and cannot be checked. */ + t = plaintext->len; + t -= paddingLength + overhead; + /* If len >= paddingLength+overhead then the MSB of t is zero. */ + good = DUPLICATE_MSB_TO_ALL(~t); + /* SSLv3 requires that the padding is minimal. */ + t = blockSize - (paddingLength + 1); + good &= DUPLICATE_MSB_TO_ALL(~t); + plaintext->len -= good & (paddingLength + 1); + return (good & SECSuccess) | (~good & SECFailure); +} + +SECStatus +ssl_RemoveTLSCBCPadding(sslBuffer *plaintext, unsigned int macSize) +{ + unsigned int paddingLength, good, t, toCheck, i; + const unsigned int overhead = 1 /* padding length byte */ + macSize; + + /* These lengths are all public so we can test them in non-constant + * time. */ + if (overhead > plaintext->len) { + return SECFailure; + } + + paddingLength = plaintext->buf[plaintext->len - 1]; + t = plaintext->len; + t -= paddingLength + overhead; + /* If len >= paddingLength+overhead then the MSB of t is zero. */ + good = DUPLICATE_MSB_TO_ALL(~t); + + /* The padding consists of a length byte at the end of the record and then + * that many bytes of padding, all with the same value as the length byte. + * Thus, with the length byte included, there are paddingLength+1 bytes of + * padding. + * + * We can't check just |paddingLength+1| bytes because that leaks + * decrypted information. Therefore we always have to check the maximum + * amount of padding possible. (Again, the length of the record is + * public information so we can use it.) */ + toCheck = 256; /* maximum amount of padding + 1. */ + if (toCheck > plaintext->len) { + toCheck = plaintext->len; + } + + for (i = 0; i < toCheck; i++) { + unsigned int t = paddingLength - i; + /* If i <= paddingLength then the MSB of t is zero and mask is + * 0xff. Otherwise, mask is 0. */ + unsigned char mask = DUPLICATE_MSB_TO_ALL(~t); + unsigned char b = plaintext->buf[plaintext->len - 1 - i]; + /* The final |paddingLength+1| bytes should all have the value + * |paddingLength|. Therefore the XOR should be zero. */ + good &= ~(mask & (paddingLength ^ b)); + } + + /* If any of the final |paddingLength+1| bytes had the wrong value, + * one or more of the lower eight bits of |good| will be cleared. We + * AND the bottom 8 bits together and duplicate the result to all the + * bits. */ + good &= good >> 4; + good &= good >> 2; + good &= good >> 1; + good <<= sizeof(good) * 8 - 1; + good = DUPLICATE_MSB_TO_ALL(good); + + plaintext->len -= good & (paddingLength + 1); + return (good & SECSuccess) | (~good & SECFailure); +} + +/* On entry: + * originalLength >= macSize + * macSize <= MAX_MAC_LENGTH + * plaintext->len >= macSize + */ +static void +ssl_CBCExtractMAC(sslBuffer *plaintext, + unsigned int originalLength, + SSL3Opaque *out, + unsigned int macSize) +{ + unsigned char rotatedMac[MAX_MAC_LENGTH]; + /* macEnd is the index of |plaintext->buf| just after the end of the + * MAC. */ + unsigned macEnd = plaintext->len; + unsigned macStart = macEnd - macSize; + /* scanStart contains the number of bytes that we can ignore because + * the MAC's position can only vary by 255 bytes. */ + unsigned scanStart = 0; + unsigned i, j; + unsigned char rotateOffset; + + if (originalLength > macSize + 255 + 1) { + scanStart = originalLength - (macSize + 255 + 1); + } + + /* We want to compute + * rotateOffset = (macStart - scanStart) % macSize + * But the time to compute this varies based on the amount of padding. Thus + * we explicitely handle all mac sizes with (hopefully) constant time modulo + * using Barrett reduction: + * q := (rotateOffset * m) >> k + * rotateOffset -= q * n + * if (n <= rotateOffset) rotateOffset -= n + */ + rotateOffset = macStart - scanStart; + /* rotateOffset < 255 + 1 + 48 = 304 */ + if (macSize == 16) { + rotateOffset &= 15; + } else if (macSize == 20) { + /* + * Correctness: rotateOffset * ( 1/20 - 25/2^9 ) < 1 + * with rotateOffset <= 853 + */ + unsigned q = (rotateOffset * 25) >> 9; + rotateOffset -= q * 20; + rotateOffset -= ssl_constantTimeSelect(ssl_ConstantTimeGE(rotateOffset, 20), + 20, 0); + } else if (macSize == 32) { + rotateOffset &= 31; + } else if (macSize == 48) { + /* + * Correctness: rotateOffset * ( 1/48 - 10/2^9 ) < 1 + * with rotateOffset < 768 + */ + unsigned q = (rotateOffset * 10) >> 9; + rotateOffset -= q * 48; + rotateOffset -= ssl_constantTimeSelect(ssl_ConstantTimeGE(rotateOffset, 48), + 48, 0); + } else { + /* + * SHA384 (macSize == 48) is the largest we support. We should never + * get here. + */ + PORT_Assert(0); + rotateOffset = rotateOffset % macSize; + } + + memset(rotatedMac, 0, macSize); + for (i = scanStart; i < originalLength;) { + for (j = 0; j < macSize && i < originalLength; i++, j++) { + unsigned char macStarted = ssl_ConstantTimeGE(i, macStart); + unsigned char macEnded = ssl_ConstantTimeGE(i, macEnd); + unsigned char b = 0; + b = plaintext->buf[i]; + rotatedMac[j] |= b & macStarted & ~macEnded; + } + } + + /* Now rotate the MAC. If we knew that the MAC fit into a CPU cache line + * we could line-align |rotatedMac| and rotate in place. */ + memset(out, 0, macSize); + rotateOffset = macSize - rotateOffset; + rotateOffset = ssl_constantTimeSelect(ssl_ConstantTimeGE(rotateOffset, macSize), + 0, rotateOffset); + for (i = 0; i < macSize; i++) { + for (j = 0; j < macSize; j++) { + out[j] |= rotatedMac[i] & ssl_ConstantTimeEQ8(j, rotateOffset); + } + rotateOffset++; + rotateOffset = ssl_constantTimeSelect(ssl_ConstantTimeGE(rotateOffset, macSize), + 0, rotateOffset); + } +} + +/* Unprotect an SSL3 record and leave the result in plaintext. + * + * If SECFailure is returned, we: + * 1. Set |*alert| to the alert to be sent. + * 2. Call PORT_SetError() with an appropriate code. + * + * Called by ssl3_HandleRecord. Caller must hold the spec read lock. + * Therefore, we MUST not call SSL3_SendAlert(). + * + */ +static SECStatus +ssl3_UnprotectRecord(sslSocket *ss, SSL3Ciphertext *cText, sslBuffer *plaintext, + SSL3AlertDescription *alert) +{ + ssl3CipherSpec *crSpec = ss->ssl3.crSpec; + const ssl3BulkCipherDef *cipher_def = crSpec->cipher_def; + PRBool isTLS; + unsigned int good; + unsigned int ivLen = 0; + SSL3ContentType rType; + unsigned int minLength; + unsigned int originalLen = 0; + unsigned char header[13]; + unsigned int headerLen; + SSL3Opaque hash[MAX_MAC_LENGTH]; + SSL3Opaque givenHashBuf[MAX_MAC_LENGTH]; + SSL3Opaque *givenHash; + unsigned int hashBytes = MAX_MAC_LENGTH + 1; + SECStatus rv; + + good = ~0U; + minLength = crSpec->mac_size; + if (cipher_def->type == type_block) { + /* CBC records have a padding length byte at the end. */ + minLength++; + if (crSpec->version >= SSL_LIBRARY_VERSION_TLS_1_1) { + /* With >= TLS 1.1, CBC records have an explicit IV. */ + minLength += cipher_def->iv_size; + } + } else if (cipher_def->type == type_aead) { + minLength = cipher_def->explicit_nonce_size + cipher_def->tag_size; + } + + /* We can perform this test in variable time because the record's total + * length and the ciphersuite are both public knowledge. */ + if (cText->buf->len < minLength) { + goto decrypt_loser; + } + + if (cipher_def->type == type_block && + crSpec->version >= SSL_LIBRARY_VERSION_TLS_1_1) { + /* Consume the per-record explicit IV. RFC 4346 Section 6.2.3.2 states + * "The receiver decrypts the entire GenericBlockCipher structure and + * then discards the first cipher block corresponding to the IV + * component." Instead, we decrypt the first cipher block and then + * discard it before decrypting the rest. + */ + SSL3Opaque iv[MAX_IV_LENGTH]; + int decoded; + + ivLen = cipher_def->iv_size; + if (ivLen < 8 || ivLen > sizeof(iv)) { + *alert = internal_error; + PORT_SetError(SEC_ERROR_LIBRARY_FAILURE); + return SECFailure; + } + + PRINT_BUF(80, (ss, "IV (ciphertext):", cText->buf->buf, ivLen)); + + /* The decryption result is garbage, but since we just throw away + * the block it doesn't matter. The decryption of the next block + * depends only on the ciphertext of the IV block. + */ + rv = crSpec->decode(crSpec->decodeContext, iv, &decoded, + sizeof(iv), cText->buf->buf, ivLen); + + good &= SECStatusToMask(rv); + } + + PRINT_BUF(80, (ss, "ciphertext:", cText->buf->buf + ivLen, + cText->buf->len - ivLen)); + + isTLS = (PRBool)(crSpec->version > SSL_LIBRARY_VERSION_3_0); + + if (isTLS && cText->buf->len - ivLen > (MAX_FRAGMENT_LENGTH + 2048)) { + *alert = record_overflow; + PORT_SetError(SSL_ERROR_RX_RECORD_TOO_LONG); + return SECFailure; + } + + rType = cText->type; + if (cipher_def->type == type_aead) { + /* XXX For many AEAD ciphers, the plaintext is shorter than the + * ciphertext by a fixed byte count, but it is not true in general. + * Each AEAD cipher should provide a function that returns the + * plaintext length for a given ciphertext. */ + unsigned int decryptedLen = + cText->buf->len - cipher_def->explicit_nonce_size - + cipher_def->tag_size; + headerLen = ssl3_BuildRecordPseudoHeader( + header, IS_DTLS(ss) ? cText->seq_num : crSpec->read_seq_num, + rType, isTLS, cText->version, IS_DTLS(ss), decryptedLen); + PORT_Assert(headerLen <= sizeof(header)); + rv = crSpec->aead( + ss->sec.isServer ? &crSpec->client : &crSpec->server, + PR_TRUE, /* do decrypt */ + plaintext->buf, /* out */ + (int *)&plaintext->len, /* outlen */ + plaintext->space, /* maxout */ + cText->buf->buf, /* in */ + cText->buf->len, /* inlen */ + header, headerLen); + if (rv != SECSuccess) { + good = 0; + } + } else { + if (cipher_def->type == type_block && + ((cText->buf->len - ivLen) % cipher_def->block_size) != 0) { + goto decrypt_loser; + } + + /* decrypt from cText buf to plaintext. */ + rv = crSpec->decode( + crSpec->decodeContext, plaintext->buf, (int *)&plaintext->len, + plaintext->space, cText->buf->buf + ivLen, cText->buf->len - ivLen); + if (rv != SECSuccess) { + goto decrypt_loser; + } + + PRINT_BUF(80, (ss, "cleartext:", plaintext->buf, plaintext->len)); + + originalLen = plaintext->len; + + /* If it's a block cipher, check and strip the padding. */ + if (cipher_def->type == type_block) { + const unsigned int blockSize = cipher_def->block_size; + const unsigned int macSize = crSpec->mac_size; + + if (!isTLS) { + good &= SECStatusToMask(ssl_RemoveSSLv3CBCPadding( + plaintext, blockSize, macSize)); + } else { + good &= SECStatusToMask(ssl_RemoveTLSCBCPadding( + plaintext, macSize)); + } + } + + /* compute the MAC */ + headerLen = ssl3_BuildRecordPseudoHeader( + header, IS_DTLS(ss) ? cText->seq_num : crSpec->read_seq_num, + rType, isTLS, cText->version, IS_DTLS(ss), + plaintext->len - crSpec->mac_size); + PORT_Assert(headerLen <= sizeof(header)); + if (cipher_def->type == type_block) { + rv = ssl3_ComputeRecordMACConstantTime( + crSpec, (PRBool)(!ss->sec.isServer), header, headerLen, + plaintext->buf, plaintext->len, originalLen, + hash, &hashBytes); + + ssl_CBCExtractMAC(plaintext, originalLen, givenHashBuf, + crSpec->mac_size); + givenHash = givenHashBuf; + + /* plaintext->len will always have enough space to remove the MAC + * because in ssl_Remove{SSLv3|TLS}CBCPadding we only adjust + * plaintext->len if the result has enough space for the MAC and we + * tested the unadjusted size against minLength, above. */ + plaintext->len -= crSpec->mac_size; + } else { + /* This is safe because we checked the minLength above. */ + plaintext->len -= crSpec->mac_size; + + rv = ssl3_ComputeRecordMAC( + crSpec, (PRBool)(!ss->sec.isServer), header, headerLen, + plaintext->buf, plaintext->len, hash, &hashBytes); + + /* We can read the MAC directly from the record because its location + * is public when a stream cipher is used. */ + givenHash = plaintext->buf + plaintext->len; + } + + good &= SECStatusToMask(rv); + + if (hashBytes != (unsigned)crSpec->mac_size || + NSS_SecureMemcmp(givenHash, hash, crSpec->mac_size) != 0) { + /* We're allowed to leak whether or not the MAC check was correct */ + good = 0; + } + } + + if (good == 0) { + decrypt_loser: + /* always log mac error, in case attacker can read server logs. */ + PORT_SetError(SSL_ERROR_BAD_MAC_READ); + *alert = bad_record_mac; + return SECFailure; + } + return SECSuccess; +} + +/* if cText is non-null, then decipher, check MAC, and decompress the + * SSL record from cText->buf (typically gs->inbuf) + * into databuf (typically gs->buf), and any previous contents of databuf + * is lost. Then handle databuf according to its SSL record type, + * unless it's an application record. + * + * If cText is NULL, then the ciphertext has previously been deciphered and + * checked, and is already sitting in databuf. It is processed as an SSL + * Handshake message. + * + * DOES NOT process the decrypted/decompressed application data. + * On return, databuf contains the decrypted/decompressed record. + * + * Called from ssl3_GatherCompleteHandshake + * ssl3_RestartHandshakeAfterCertReq + * + * Caller must hold the RecvBufLock. + * + * This function aquires and releases the SSL3Handshake Lock, holding the + * lock around any calls to functions that handle records other than + * Application Data records. + */ +SECStatus +ssl3_HandleRecord(sslSocket *ss, SSL3Ciphertext *cText, sslBuffer *databuf) +{ + SECStatus rv; + PRBool isTLS; + sslSequenceNumber seq_num = 0; + ssl3CipherSpec *crSpec; + SSL3ContentType rType; + sslBuffer *plaintext; + sslBuffer temp_buf; + SSL3AlertDescription alert = internal_error; + PORT_Assert(ss->opt.noLocks || ssl_HaveRecvBufLock(ss)); + + if (!ss->ssl3.initialized) { + ssl_GetSSL3HandshakeLock(ss); + rv = ssl3_InitState(ss); + ssl_ReleaseSSL3HandshakeLock(ss); + if (rv != SECSuccess) { + return rv; /* ssl3_InitState has set the error code. */ + } + } + + /* check for Token Presence */ + if (!ssl3_ClientAuthTokenPresent(ss->sec.ci.sid)) { + PORT_SetError(SSL_ERROR_TOKEN_INSERTION_REMOVAL); + return SECFailure; + } + + /* cText is NULL when we're called from ssl3_RestartHandshakeAfterXXX(). + * This implies that databuf holds a previously deciphered SSL Handshake + * message. + */ + if (cText == NULL) { + SSL_DBG(("%d: SSL3[%d]: HandleRecord, resuming handshake", + SSL_GETPID(), ss->fd)); + rType = content_handshake; + goto process_it; + } + + ssl_GetSpecReadLock(ss); /******************************************/ + crSpec = ss->ssl3.crSpec; + isTLS = (PRBool)(crSpec->version > SSL_LIBRARY_VERSION_3_0); + + if (IS_DTLS(ss)) { + PRBool sameEpoch; + if (!dtls_IsRelevant(ss, cText, &sameEpoch, &seq_num)) { + ssl_ReleaseSpecReadLock(ss); /*****************************/ + databuf->len = 0; /* Needed to ensure data not left around */ + + /* Maybe retransmit if needed. */ + return dtls_MaybeRetransmitHandshake(ss, cText, sameEpoch); + } + } else { + seq_num = crSpec->read_seq_num + 1; + } + if (seq_num >= crSpec->cipher_def->max_records) { + ssl_ReleaseSpecReadLock(ss); /*****************************/ + SSL_TRC(3, ("%d: SSL[%d]: read sequence number at limit 0x%0llx", + SSL_GETPID(), ss->fd, seq_num)); + PORT_SetError(SSL_ERROR_TOO_MANY_RECORDS); + return SECFailure; + } + + /* If we will be decompressing the buffer we need to decrypt somewhere + * other than into databuf */ + if (crSpec->decompressor) { + temp_buf.buf = NULL; + temp_buf.space = 0; + plaintext = &temp_buf; + } else { + plaintext = databuf; + } + + plaintext->len = 0; /* filled in by Unprotect call below. */ + if (plaintext->space < MAX_FRAGMENT_LENGTH) { + rv = sslBuffer_Grow(plaintext, MAX_FRAGMENT_LENGTH + 2048); + if (rv != SECSuccess) { + ssl_ReleaseSpecReadLock(ss); /*************************/ + SSL_DBG(("%d: SSL3[%d]: HandleRecord, tried to get %d bytes", + SSL_GETPID(), ss->fd, MAX_FRAGMENT_LENGTH + 2048)); + /* sslBuffer_Grow has set a memory error code. */ + /* Perhaps we should send an alert. (but we have no memory!) */ + return SECFailure; + } + } + + /* We're waiting for another ClientHello, which will appear unencrypted. + * Use the content type to tell whether this is should be discarded. + * + * XXX If we decide to remove the content type from encrypted records, this + * will become much more difficult to manage. */ + if (ss->ssl3.hs.zeroRttIgnore == ssl_0rtt_ignore_hrr && + cText->type == content_application_data) { + ssl_ReleaseSpecReadLock(ss); /*****************************/ + PORT_Assert(ss->ssl3.hs.ws == wait_client_hello); + databuf->len = 0; + return SECSuccess; + } + +#ifdef UNSAFE_FUZZER_MODE + rv = Null_Cipher(NULL, plaintext->buf, (int *)&plaintext->len, + plaintext->space, cText->buf->buf, cText->buf->len); +#else + /* IMPORTANT: Unprotect functions MUST NOT send alerts + * because we still hold the spec read lock. Instead, if they + * return SECFailure, they set *alert to the alert to be sent. */ + if (crSpec->version < SSL_LIBRARY_VERSION_TLS_1_3 || + crSpec->cipher_def->calg == ssl_calg_null) { + /* Unencrypted TLS 1.3 records use the pre-TLS 1.3 format. */ + rv = ssl3_UnprotectRecord(ss, cText, plaintext, &alert); + } else { + rv = tls13_UnprotectRecord(ss, cText, plaintext, &alert); + } +#endif + + if (rv != SECSuccess) { + ssl_ReleaseSpecReadLock(ss); /***************************/ + + SSL_DBG(("%d: SSL3[%d]: decryption failed", SSL_GETPID(), ss->fd)); + + if (IS_DTLS(ss) || + (ss->sec.isServer && + ss->ssl3.hs.zeroRttIgnore == ssl_0rtt_ignore_trial)) { + /* Silently drop the packet */ + databuf->len = 0; /* Needed to ensure data not left around */ + return SECSuccess; + } else { + int errCode = PORT_GetError(); + SSL3_SendAlert(ss, alert_fatal, alert); + /* Reset the error code in case SSL3_SendAlert called + * PORT_SetError(). */ + PORT_SetError(errCode); + return SECFailure; + } + } + + /* SECSuccess */ + crSpec->read_seq_num = seq_num; + if (IS_DTLS(ss)) { + dtls_RecordSetRecvd(&crSpec->recvdRecords, seq_num); + } + + ssl_ReleaseSpecReadLock(ss); /*****************************************/ + + /* + * The decrypted data is now in plaintext. + */ + rType = cText->type; /* This must go after decryption because TLS 1.3 + * has encrypted content types. */ + + /* possibly decompress the record. If we aren't using compression then + * plaintext == databuf and so the uncompressed data is already in + * databuf. */ + if (crSpec->decompressor) { + if (databuf->space < plaintext->len + SSL3_COMPRESSION_MAX_EXPANSION) { + rv = sslBuffer_Grow( + databuf, plaintext->len + SSL3_COMPRESSION_MAX_EXPANSION); + if (rv != SECSuccess) { + SSL_DBG(("%d: SSL3[%d]: HandleRecord, tried to get %d bytes", + SSL_GETPID(), ss->fd, + plaintext->len + + SSL3_COMPRESSION_MAX_EXPANSION)); + /* sslBuffer_Grow has set a memory error code. */ + /* Perhaps we should send an alert. (but we have no memory!) */ + PORT_Free(plaintext->buf); + return SECFailure; + } + } + + rv = crSpec->decompressor(crSpec->decompressContext, + databuf->buf, + (int *)&databuf->len, + databuf->space, + plaintext->buf, + plaintext->len); + + if (rv != SECSuccess) { + int err = ssl_MapLowLevelError(SSL_ERROR_DECOMPRESSION_FAILURE); + SSL3_SendAlert(ss, alert_fatal, + isTLS ? decompression_failure + : bad_record_mac); + + /* There appears to be a bug with (at least) Apache + OpenSSL where + * resumed SSLv3 connections don't actually use compression. See + * comments 93-95 of + * https://bugzilla.mozilla.org/show_bug.cgi?id=275744 + * + * So, if we get a decompression error, and the record appears to + * be already uncompressed, then we return a more specific error + * code to hopefully save somebody some debugging time in the + * future. + */ + if (plaintext->len >= 4) { + unsigned int len = ((unsigned int)plaintext->buf[1] << 16) | + ((unsigned int)plaintext->buf[2] << 8) | + (unsigned int)plaintext->buf[3]; + if (len == plaintext->len - 4) { + /* This appears to be uncompressed already */ + err = SSL_ERROR_RX_UNEXPECTED_UNCOMPRESSED_RECORD; + } + } + + PORT_Free(plaintext->buf); + PORT_SetError(err); + return SECFailure; + } + + PORT_Free(plaintext->buf); + } + + /* + ** Having completed the decompression, check the length again. + */ + if (isTLS && databuf->len > (MAX_FRAGMENT_LENGTH + 1024)) { + SSL3_SendAlert(ss, alert_fatal, record_overflow); + PORT_SetError(SSL_ERROR_RX_RECORD_TOO_LONG); + return SECFailure; + } + + /* Application data records are processed by the caller of this + ** function, not by this function. + */ + if (rType == content_application_data) { + if (ss->firstHsDone) + return SECSuccess; + if (ss->version >= SSL_LIBRARY_VERSION_TLS_1_3 && + ss->sec.isServer && + ss->ssl3.hs.zeroRttState == ssl_0rtt_accepted) { + return tls13_HandleEarlyApplicationData(ss, databuf); + } + (void)SSL3_SendAlert(ss, alert_fatal, unexpected_message); + PORT_SetError(SSL_ERROR_RX_UNEXPECTED_APPLICATION_DATA); + return SECFailure; + } + +/* It's a record that must be handled by ssl itself, not the application. + */ +process_it: + /* XXX Get the xmit lock here. Odds are very high that we'll be xmiting + * data ang getting the xmit lock here prevents deadlocks. + */ + ssl_GetSSL3HandshakeLock(ss); + + /* All the functions called in this switch MUST set error code if + ** they return SECFailure or SECWouldBlock. + */ + switch (rType) { + case content_change_cipher_spec: + rv = ssl3_HandleChangeCipherSpecs(ss, databuf); + break; + case content_alert: + rv = ssl3_HandleAlert(ss, databuf); + break; + case content_handshake: + if (!IS_DTLS(ss)) { + rv = ssl3_HandleHandshake(ss, databuf); + } else { + rv = dtls_HandleHandshake(ss, databuf); + } + break; + /* + case content_application_data is handled before this switch + */ + default: + SSL_DBG(("%d: SSL3[%d]: bogus content type=%d", + SSL_GETPID(), ss->fd, cText->type)); + PORT_SetError(SSL_ERROR_RX_UNKNOWN_RECORD_TYPE); + ssl3_DecodeError(ss); + rv = SECFailure; + break; + } + + ssl_ReleaseSSL3HandshakeLock(ss); + return rv; +} + +/* + * Initialization functions + */ + +void +ssl_InitSecState(sslSecurityInfo *sec) +{ + sec->authType = ssl_auth_null; + sec->authKeyBits = 0; + sec->signatureScheme = ssl_sig_none; + sec->keaType = ssl_kea_null; + sec->keaKeyBits = 0; + sec->keaGroup = NULL; +} + +/* Called from ssl3_InitState, immediately below. */ +/* Caller must hold the SpecWriteLock. */ +void +ssl3_InitCipherSpec(ssl3CipherSpec *spec) +{ + spec->cipher_def = &bulk_cipher_defs[cipher_null]; + PORT_Assert(spec->cipher_def->cipher == cipher_null); + spec->mac_def = &mac_defs[mac_null]; + PORT_Assert(spec->mac_def->mac == mac_null); + spec->encode = Null_Cipher; + spec->decode = Null_Cipher; + spec->compressor = NULL; + spec->decompressor = NULL; + spec->destroyCompressContext = NULL; + spec->destroyDecompressContext = NULL; + spec->mac_size = 0; + spec->master_secret = NULL; + + spec->msItem.data = NULL; + spec->msItem.len = 0; + + spec->client.write_key = NULL; + spec->client.write_mac_key = NULL; + spec->client.write_mac_context = NULL; + + spec->server.write_key = NULL; + spec->server.write_mac_key = NULL; + spec->server.write_mac_context = NULL; + + spec->write_seq_num = 0; + spec->read_seq_num = 0; + spec->epoch = 0; + + spec->refCt = 128; /* Arbitrarily high number to prevent + * non-TLS 1.3 cipherSpecs from being + * GCed. This will be overwritten with + * a valid refCt for TLS 1.3. */ + dtls_InitRecvdRecords(&spec->recvdRecords); +} + +/* Called from: ssl3_SendRecord +** ssl3_SendClientHello() +** ssl3_HandleV2ClientHello() +** ssl3_HandleRecord() +** +** This function should perhaps acquire and release the SpecWriteLock. +** +** +*/ +SECStatus +ssl3_InitState(sslSocket *ss) +{ + PORT_Assert(ss->opt.noLocks || ssl_HaveSSL3HandshakeLock(ss)); + + if (ss->ssl3.initialized) + return SECSuccess; /* Function should be idempotent */ + + ss->ssl3.policy = SSL_ALLOWED; + + ssl_InitSecState(&ss->sec); + + ssl_GetSpecWriteLock(ss); + ss->ssl3.crSpec = ss->ssl3.cwSpec = &ss->ssl3.specs[0]; + ss->ssl3.prSpec = ss->ssl3.pwSpec = &ss->ssl3.specs[1]; + ssl3_InitCipherSpec(ss->ssl3.crSpec); + ssl3_InitCipherSpec(ss->ssl3.prSpec); + ss->ssl3.crSpec->version = ss->ssl3.prSpec->version = ss->vrange.max; + ssl_ReleaseSpecWriteLock(ss); + + ss->ssl3.hs.sendingSCSV = PR_FALSE; + ss->ssl3.hs.preliminaryInfo = 0; + ss->ssl3.hs.ws = (ss->sec.isServer) ? wait_client_hello : wait_server_hello; + + ssl3_ResetExtensionData(&ss->xtnData); + PR_INIT_CLIST(&ss->ssl3.hs.remoteExtensions); + if (IS_DTLS(ss)) { + ss->ssl3.hs.sendMessageSeq = 0; + ss->ssl3.hs.recvMessageSeq = 0; + ss->ssl3.hs.rtTimeoutMs = DTLS_RETRANSMIT_INITIAL_MS; + ss->ssl3.hs.rtRetries = 0; + ss->ssl3.hs.recvdHighWater = -1; + PR_INIT_CLIST(&ss->ssl3.hs.lastMessageFlight); + dtls_SetMTU(ss, 0); /* Set the MTU to the highest plateau */ + } + + ss->ssl3.hs.currentSecret = NULL; + ss->ssl3.hs.resumptionMasterSecret = NULL; + ss->ssl3.hs.dheSecret = NULL; + ss->ssl3.hs.pskBinderKey = NULL; + ss->ssl3.hs.clientEarlyTrafficSecret = NULL; + ss->ssl3.hs.clientHsTrafficSecret = NULL; + ss->ssl3.hs.serverHsTrafficSecret = NULL; + ss->ssl3.hs.clientTrafficSecret = NULL; + ss->ssl3.hs.serverTrafficSecret = NULL; + ss->ssl3.hs.certificateRequest = NULL; + PR_INIT_CLIST(&ss->ssl3.hs.cipherSpecs); + + PORT_Assert(!ss->ssl3.hs.messages.buf && !ss->ssl3.hs.messages.space); + ss->ssl3.hs.messages.buf = NULL; + ss->ssl3.hs.messages.space = 0; + + ss->ssl3.hs.receivedNewSessionTicket = PR_FALSE; + PORT_Memset(&ss->ssl3.hs.newSessionTicket, 0, + sizeof(ss->ssl3.hs.newSessionTicket)); + + ss->ssl3.hs.zeroRttState = ssl_0rtt_none; + + ssl_FilterSupportedGroups(ss); + + ss->ssl3.initialized = PR_TRUE; + return SECSuccess; +} + +/* record the export policy for this cipher suite */ +SECStatus +ssl3_SetPolicy(ssl3CipherSuite which, int policy) +{ + ssl3CipherSuiteCfg *suite; + + suite = ssl_LookupCipherSuiteCfgMutable(which, cipherSuites); + if (suite == NULL) { + return SECFailure; /* err code was set by ssl_LookupCipherSuiteCfg */ + } + suite->policy = policy; + + return SECSuccess; +} + +SECStatus +ssl3_GetPolicy(ssl3CipherSuite which, PRInt32 *oPolicy) +{ + const ssl3CipherSuiteCfg *suite; + PRInt32 policy; + SECStatus rv; + + suite = ssl_LookupCipherSuiteCfg(which, cipherSuites); + if (suite) { + policy = suite->policy; + rv = SECSuccess; + } else { + policy = SSL_NOT_ALLOWED; + rv = SECFailure; /* err code was set by Lookup. */ + } + *oPolicy = policy; + return rv; +} + +/* record the user preference for this suite */ +SECStatus +ssl3_CipherPrefSetDefault(ssl3CipherSuite which, PRBool enabled) +{ + ssl3CipherSuiteCfg *suite; + + suite = ssl_LookupCipherSuiteCfgMutable(which, cipherSuites); + if (suite == NULL) { + return SECFailure; /* err code was set by ssl_LookupCipherSuiteCfg */ + } + suite->enabled = enabled; + return SECSuccess; +} + +/* return the user preference for this suite */ +SECStatus +ssl3_CipherPrefGetDefault(ssl3CipherSuite which, PRBool *enabled) +{ + const ssl3CipherSuiteCfg *suite; + PRBool pref; + SECStatus rv; + + suite = ssl_LookupCipherSuiteCfg(which, cipherSuites); + if (suite) { + pref = suite->enabled; + rv = SECSuccess; + } else { + pref = SSL_NOT_ALLOWED; + rv = SECFailure; /* err code was set by Lookup. */ + } + *enabled = pref; + return rv; +} + +SECStatus +ssl3_CipherPrefSet(sslSocket *ss, ssl3CipherSuite which, PRBool enabled) +{ + ssl3CipherSuiteCfg *suite; + + suite = ssl_LookupCipherSuiteCfgMutable(which, ss->cipherSuites); + if (suite == NULL) { + return SECFailure; /* err code was set by ssl_LookupCipherSuiteCfg */ + } + suite->enabled = enabled; + return SECSuccess; +} + +SECStatus +ssl3_CipherPrefGet(const sslSocket *ss, ssl3CipherSuite which, PRBool *enabled) +{ + const ssl3CipherSuiteCfg *suite; + PRBool pref; + SECStatus rv; + + suite = ssl_LookupCipherSuiteCfg(which, ss->cipherSuites); + if (suite) { + pref = suite->enabled; + rv = SECSuccess; + } else { + pref = SSL_NOT_ALLOWED; + rv = SECFailure; /* err code was set by Lookup. */ + } + *enabled = pref; + return rv; +} + +SECStatus +SSL_SignatureSchemePrefSet(PRFileDesc *fd, const SSLSignatureScheme *schemes, + unsigned int count) +{ + sslSocket *ss; + unsigned int i; + unsigned int supported = 0; + + ss = ssl_FindSocket(fd); + if (!ss) { + SSL_DBG(("%d: SSL[%d]: bad socket in SSL_SignatureSchemePrefSet", + SSL_GETPID(), fd)); + PORT_SetError(SEC_ERROR_INVALID_ARGS); + return SECFailure; + } + + if (!count) { + PORT_SetError(SEC_ERROR_INVALID_ARGS); + return SECFailure; + } + + for (i = 0; i < count; ++i) { + if (ssl_IsSupportedSignatureScheme(schemes[i])) { + ++supported; + } + } + /* We don't check for duplicates, so it's possible to get too many. */ + if (supported > MAX_SIGNATURE_SCHEMES) { + PORT_SetError(SEC_ERROR_INVALID_ARGS); + return SECFailure; + } + + ss->ssl3.signatureSchemeCount = 0; + for (i = 0; i < count; ++i) { + if (!ssl_IsSupportedSignatureScheme(schemes[i])) { + SSL_DBG(("%d: SSL[%d]: invalid signature scheme %d ignored", + SSL_GETPID(), fd, schemes[i])); + continue; + } + + ss->ssl3.signatureSchemes[ss->ssl3.signatureSchemeCount++] = schemes[i]; + } + + if (ss->ssl3.signatureSchemeCount == 0) { + PORT_SetError(SSL_ERROR_NO_SUPPORTED_SIGNATURE_ALGORITHM); + return SECFailure; + } + return SECSuccess; +} + +SECStatus +SSL_SignaturePrefSet(PRFileDesc *fd, const SSLSignatureAndHashAlg *algorithms, + unsigned int count) +{ + SSLSignatureScheme schemes[MAX_SIGNATURE_SCHEMES]; + unsigned int i; + + count = PR_MIN(PR_ARRAY_SIZE(schemes), count); + for (i = 0; i < count; ++i) { + schemes[i] = (algorithms[i].hashAlg << 8) | algorithms[i].sigAlg; + } + return SSL_SignatureSchemePrefSet(fd, schemes, count); +} + +SECStatus +SSL_SignatureSchemePrefGet(PRFileDesc *fd, SSLSignatureScheme *schemes, + unsigned int *count, unsigned int maxCount) +{ + sslSocket *ss; + + ss = ssl_FindSocket(fd); + if (!ss) { + SSL_DBG(("%d: SSL[%d]: bad socket in SSL_SignatureSchemePrefGet", + SSL_GETPID(), fd)); + PORT_SetError(SEC_ERROR_INVALID_ARGS); + return SECFailure; + } + + if (!schemes || !count || + maxCount < ss->ssl3.signatureSchemeCount) { + PORT_SetError(SEC_ERROR_INVALID_ARGS); + return SECFailure; + } + + PORT_Memcpy(schemes, ss->ssl3.signatureSchemes, + ss->ssl3.signatureSchemeCount * sizeof(SSLSignatureScheme)); + *count = ss->ssl3.signatureSchemeCount; + return SECSuccess; +} + +SECStatus +SSL_SignaturePrefGet(PRFileDesc *fd, SSLSignatureAndHashAlg *algorithms, + unsigned int *count, unsigned int maxCount) +{ + sslSocket *ss; + unsigned int i; + + ss = ssl_FindSocket(fd); + if (!ss) { + SSL_DBG(("%d: SSL[%d]: bad socket in SSL_SignaturePrefGet", + SSL_GETPID(), fd)); + PORT_SetError(SEC_ERROR_INVALID_ARGS); + return SECFailure; + } + + if (!algorithms || !count || + maxCount < ss->ssl3.signatureSchemeCount) { + PORT_SetError(SEC_ERROR_INVALID_ARGS); + return SECFailure; + } + + for (i = 0; i < ss->ssl3.signatureSchemeCount; ++i) { + algorithms[i].hashAlg = (ss->ssl3.signatureSchemes[i] >> 8) & 0xff; + algorithms[i].sigAlg = ss->ssl3.signatureSchemes[i] & 0xff; + } + *count = ss->ssl3.signatureSchemeCount; + return SECSuccess; +} + +unsigned int +SSL_SignatureMaxCount() +{ + return MAX_SIGNATURE_SCHEMES; +} + +/* copy global default policy into socket. */ +void +ssl3_InitSocketPolicy(sslSocket *ss) +{ + PORT_Memcpy(ss->cipherSuites, cipherSuites, sizeof(cipherSuites)); + PORT_Memcpy(ss->ssl3.signatureSchemes, defaultSignatureSchemes, + sizeof(defaultSignatureSchemes)); + ss->ssl3.signatureSchemeCount = PR_ARRAY_SIZE(defaultSignatureSchemes); +} + +/* +** If ssl3 socket has completed the first handshake, and is in idle state, +** then start a new handshake. +** If flushCache is true, the SID cache will be flushed first, forcing a +** "Full" handshake (not a session restart handshake), to be done. +** +** called from SSL_RedoHandshake(), which already holds the handshake locks. +*/ +SECStatus +ssl3_RedoHandshake(sslSocket *ss, PRBool flushCache) +{ + sslSessionID *sid = ss->sec.ci.sid; + SECStatus rv; + + PORT_Assert(ss->opt.noLocks || ssl_HaveSSL3HandshakeLock(ss)); + + if (!ss->firstHsDone || + (ss->ssl3.initialized && (ss->ssl3.hs.ws != idle_handshake))) { + PORT_SetError(SSL_ERROR_HANDSHAKE_NOT_COMPLETED); + return SECFailure; + } + + if (IS_DTLS(ss)) { + dtls_RehandshakeCleanup(ss); + } + + if (ss->opt.enableRenegotiation == SSL_RENEGOTIATE_NEVER || + ss->version >= SSL_LIBRARY_VERSION_TLS_1_3) { + PORT_SetError(SSL_ERROR_RENEGOTIATION_NOT_ALLOWED); + return SECFailure; + } + if (sid && flushCache) { + ss->sec.uncache(sid); /* remove it from whichever cache it's in. */ + ssl_FreeSID(sid); /* dec ref count and free if zero. */ + ss->sec.ci.sid = NULL; + } + + ssl_GetXmitBufLock(ss); /**************************************/ + + /* start off a new handshake. */ + if (ss->sec.isServer) { + rv = ssl3_SendHelloRequest(ss); + } else { + rv = ssl3_SendClientHello(ss, client_hello_renegotiation); + } + + ssl_ReleaseXmitBufLock(ss); /**************************************/ + return rv; +} + +/* Called from ssl_DestroySocketContents() in sslsock.c */ +void +ssl3_DestroySSL3Info(sslSocket *ss) +{ + + if (ss->ssl3.clientCertificate != NULL) + CERT_DestroyCertificate(ss->ssl3.clientCertificate); + + if (ss->ssl3.clientPrivateKey != NULL) + SECKEY_DestroyPrivateKey(ss->ssl3.clientPrivateKey); + + if (ss->ssl3.peerCertArena != NULL) + ssl3_CleanupPeerCerts(ss); + + if (ss->ssl3.clientCertChain != NULL) { + CERT_DestroyCertificateList(ss->ssl3.clientCertChain); + ss->ssl3.clientCertChain = NULL; + } + if (ss->ssl3.ca_list) { + CERT_FreeDistNames(ss->ssl3.ca_list); + } + + /* clean up handshake */ + if (ss->ssl3.hs.md5) { + PK11_DestroyContext(ss->ssl3.hs.md5, PR_TRUE); + } + if (ss->ssl3.hs.sha) { + PK11_DestroyContext(ss->ssl3.hs.sha, PR_TRUE); + } + if (ss->ssl3.hs.messages.buf) { + sslBuffer_Clear(&ss->ssl3.hs.messages); + } + + /* free the SSL3Buffer (msg_body) */ + PORT_Free(ss->ssl3.hs.msg_body.buf); + + SECITEM_FreeItem(&ss->ssl3.hs.newSessionTicket.ticket, PR_FALSE); + SECITEM_FreeItem(&ss->ssl3.hs.srvVirtName, PR_FALSE); + + if (ss->ssl3.hs.certificateRequest) { + PORT_FreeArena(ss->ssl3.hs.certificateRequest->arena, PR_FALSE); + ss->ssl3.hs.certificateRequest = NULL; + } + + /* free up the CipherSpecs */ + ssl3_DestroyCipherSpec(&ss->ssl3.specs[0], PR_TRUE /*freeSrvName*/); + ssl3_DestroyCipherSpec(&ss->ssl3.specs[1], PR_TRUE /*freeSrvName*/); + + /* Destroy the DTLS data */ + if (IS_DTLS(ss)) { + dtls_FreeHandshakeMessages(&ss->ssl3.hs.lastMessageFlight); + if (ss->ssl3.hs.recvdFragments.buf) { + PORT_Free(ss->ssl3.hs.recvdFragments.buf); + } + } + + /* Destroy remote extensions */ + ssl3_DestroyRemoteExtensions(&ss->ssl3.hs.remoteExtensions); + ssl3_ResetExtensionData(&ss->xtnData); + + /* Destroy TLS 1.3 cipher specs */ + tls13_DestroyCipherSpecs(&ss->ssl3.hs.cipherSpecs); + + /* Destroy TLS 1.3 keys */ + if (ss->ssl3.hs.currentSecret) + PK11_FreeSymKey(ss->ssl3.hs.currentSecret); + if (ss->ssl3.hs.resumptionMasterSecret) + PK11_FreeSymKey(ss->ssl3.hs.resumptionMasterSecret); + if (ss->ssl3.hs.dheSecret) + PK11_FreeSymKey(ss->ssl3.hs.dheSecret); + if (ss->ssl3.hs.pskBinderKey) + PK11_FreeSymKey(ss->ssl3.hs.pskBinderKey); + if (ss->ssl3.hs.clientEarlyTrafficSecret) + PK11_FreeSymKey(ss->ssl3.hs.clientEarlyTrafficSecret); + if (ss->ssl3.hs.clientHsTrafficSecret) + PK11_FreeSymKey(ss->ssl3.hs.clientHsTrafficSecret); + if (ss->ssl3.hs.serverHsTrafficSecret) + PK11_FreeSymKey(ss->ssl3.hs.serverHsTrafficSecret); + if (ss->ssl3.hs.clientTrafficSecret) + PK11_FreeSymKey(ss->ssl3.hs.clientTrafficSecret); + if (ss->ssl3.hs.serverTrafficSecret) + PK11_FreeSymKey(ss->ssl3.hs.serverTrafficSecret); + if (ss->ssl3.hs.earlyExporterSecret) + PK11_FreeSymKey(ss->ssl3.hs.earlyExporterSecret); + if (ss->ssl3.hs.exporterSecret) + PK11_FreeSymKey(ss->ssl3.hs.exporterSecret); + + ss->ssl3.hs.zeroRttState = ssl_0rtt_none; + /* Destroy TLS 1.3 buffered early data. */ + tls13_DestroyEarlyData(&ss->ssl3.hs.bufferedEarlyData); + + ss->ssl3.initialized = PR_FALSE; +} + +#define MAP_NULL(x) (((x) != 0) ? (x) : SEC_OID_NULL_CIPHER) + +SECStatus +ssl3_ApplyNSSPolicy(void) +{ + unsigned i; + SECStatus rv; + PRUint32 policy = 0; + + rv = NSS_GetAlgorithmPolicy(SEC_OID_APPLY_SSL_POLICY, &policy); + if (rv != SECSuccess || !(policy & NSS_USE_POLICY_IN_SSL)) { + return SECSuccess; /* do nothing */ + } + + /* disable every ciphersuite */ + for (i = 1; i < PR_ARRAY_SIZE(cipher_suite_defs); ++i) { + const ssl3CipherSuiteDef *suite = &cipher_suite_defs[i]; + SECOidTag policyOid; + + policyOid = MAP_NULL(kea_defs[suite->key_exchange_alg].oid); + rv = NSS_GetAlgorithmPolicy(policyOid, &policy); + if (rv == SECSuccess && !(policy & NSS_USE_ALG_IN_SSL_KX)) { + ssl_CipherPrefSetDefault(suite->cipher_suite, PR_FALSE); + ssl_CipherPolicySet(suite->cipher_suite, SSL_NOT_ALLOWED); + continue; + } + + policyOid = MAP_NULL(ssl_GetBulkCipherDef(suite)->oid); + rv = NSS_GetAlgorithmPolicy(policyOid, &policy); + if (rv == SECSuccess && !(policy & NSS_USE_ALG_IN_SSL)) { + ssl_CipherPrefSetDefault(suite->cipher_suite, PR_FALSE); + ssl_CipherPolicySet(suite->cipher_suite, SSL_NOT_ALLOWED); + continue; + } + + if (ssl_GetBulkCipherDef(suite)->type != type_aead) { + policyOid = MAP_NULL(mac_defs[suite->mac_alg].oid); + rv = NSS_GetAlgorithmPolicy(policyOid, &policy); + if (rv == SECSuccess && !(policy & NSS_USE_ALG_IN_SSL)) { + ssl_CipherPrefSetDefault(suite->cipher_suite, PR_FALSE); + ssl_CipherPolicySet(suite->cipher_suite, + SSL_NOT_ALLOWED); + continue; + } + } + } + + rv = ssl3_ConstrainRangeByPolicy(); + + return rv; +} + +/* End of ssl3con.c */ diff --git a/security/nss/lib/ssl/ssl3ecc.c b/security/nss/lib/ssl/ssl3ecc.c new file mode 100644 index 000000000..9f2f4d621 --- /dev/null +++ b/security/nss/lib/ssl/ssl3ecc.c @@ -0,0 +1,1009 @@ +/* -*- Mode: C; tab-width: 8; indent-tabs-mode: nil; c-basic-offset: 4 -*- */ +/* + * SSL3 Protocol + * + * This Source Code Form is subject to the terms of the Mozilla Public + * License, v. 2.0. If a copy of the MPL was not distributed with this + * file, You can obtain one at http://mozilla.org/MPL/2.0/. */ + +/* ECC code moved here from ssl3con.c */ + +#include "cert.h" +#include "ssl.h" +#include "cryptohi.h" /* for DSAU_ stuff */ +#include "keyhi.h" +#include "secder.h" +#include "secitem.h" + +#include "sslimpl.h" +#include "sslproto.h" +#include "sslerr.h" +#include "ssl3ext.h" +#include "prtime.h" +#include "prinrval.h" +#include "prerror.h" +#include "pratom.h" +#include "prthread.h" +#include "prinit.h" + +#include "pk11func.h" +#include "secmod.h" + +#include <stdio.h> + +#ifndef PK11_SETATTRS +#define PK11_SETATTRS(x, id, v, l) \ + (x)->type = (id); \ + (x)->pValue = (v); \ + (x)->ulValueLen = (l); +#endif + +SECStatus +ssl_NamedGroup2ECParams(PLArenaPool *arena, const sslNamedGroupDef *ecGroup, + SECKEYECParams *params) +{ + SECOidData *oidData = NULL; + + if (!params) { + PORT_Assert(0); + PORT_SetError(SEC_ERROR_INVALID_ARGS); + return SECFailure; + } + + if (!ecGroup || ecGroup->keaType != ssl_kea_ecdh || + (oidData = SECOID_FindOIDByTag(ecGroup->oidTag)) == NULL) { + PORT_SetError(SEC_ERROR_UNSUPPORTED_ELLIPTIC_CURVE); + return SECFailure; + } + + if (SECITEM_AllocItem(arena, params, (2 + oidData->oid.len)) == NULL) { + PORT_SetError(SEC_ERROR_NO_MEMORY); + return SECFailure; + } + + /* + * params->data needs to contain the ASN encoding of an object ID (OID) + * representing the named curve. The actual OID is in + * oidData->oid.data so we simply prepend 0x06 and OID length + */ + params->data[0] = SEC_ASN1_OBJECT_ID; + params->data[1] = oidData->oid.len; + memcpy(params->data + 2, oidData->oid.data, oidData->oid.len); + + return SECSuccess; +} + +const sslNamedGroupDef * +ssl_ECPubKey2NamedGroup(const SECKEYPublicKey *pubKey) +{ + SECItem oid = { siBuffer, NULL, 0 }; + SECOidData *oidData = NULL; + PRUint32 policyFlags = 0; + unsigned int i; + const SECKEYECParams *params; + + if (pubKey->keyType != ecKey) { + PORT_Assert(0); + return NULL; + } + + params = &pubKey->u.ec.DEREncodedParams; + + /* + * params->data needs to contain the ASN encoding of an object ID (OID) + * representing a named curve. Here, we strip away everything + * before the actual OID and use the OID to look up a named curve. + */ + if (params->data[0] != SEC_ASN1_OBJECT_ID) + return NULL; + oid.len = params->len - 2; + oid.data = params->data + 2; + if ((oidData = SECOID_FindOID(&oid)) == NULL) + return NULL; + if ((NSS_GetAlgorithmPolicy(oidData->offset, &policyFlags) == + SECSuccess) && + !(policyFlags & NSS_USE_ALG_IN_SSL_KX)) { + return NULL; + } + for (i = 0; i < SSL_NAMED_GROUP_COUNT; ++i) { + if (ssl_named_groups[i].oidTag == oidData->offset) { + return &ssl_named_groups[i]; + } + } + + return NULL; +} + +/* Caller must set hiLevel error code. */ +static SECStatus +ssl3_ComputeECDHKeyHash(SSLHashType hashAlg, + SECItem ec_params, SECItem server_ecpoint, + SSL3Random *client_rand, SSL3Random *server_rand, + SSL3Hashes *hashes) +{ + PRUint8 *hashBuf; + PRUint8 *pBuf; + SECStatus rv = SECSuccess; + unsigned int bufLen; + /* + * We only support named curves (the appropriate checks are made before this + * method is called) so ec_params takes up only two bytes. ECPoint needs to + * fit in 256 bytes because the spec says the length must fit in one byte. + */ + PRUint8 buf[2 * SSL3_RANDOM_LENGTH + 2 + 1 + 256]; + + bufLen = 2 * SSL3_RANDOM_LENGTH + ec_params.len + 1 + server_ecpoint.len; + if (bufLen <= sizeof buf) { + hashBuf = buf; + } else { + hashBuf = PORT_Alloc(bufLen); + if (!hashBuf) { + return SECFailure; + } + } + + memcpy(hashBuf, client_rand, SSL3_RANDOM_LENGTH); + pBuf = hashBuf + SSL3_RANDOM_LENGTH; + memcpy(pBuf, server_rand, SSL3_RANDOM_LENGTH); + pBuf += SSL3_RANDOM_LENGTH; + memcpy(pBuf, ec_params.data, ec_params.len); + pBuf += ec_params.len; + pBuf[0] = (PRUint8)(server_ecpoint.len); + pBuf += 1; + memcpy(pBuf, server_ecpoint.data, server_ecpoint.len); + pBuf += server_ecpoint.len; + PORT_Assert((unsigned int)(pBuf - hashBuf) == bufLen); + + rv = ssl3_ComputeCommonKeyHash(hashAlg, hashBuf, bufLen, hashes); + + PRINT_BUF(95, (NULL, "ECDHkey hash: ", hashBuf, bufLen)); + PRINT_BUF(95, (NULL, "ECDHkey hash: MD5 result", + hashes->u.s.md5, MD5_LENGTH)); + PRINT_BUF(95, (NULL, "ECDHkey hash: SHA1 result", + hashes->u.s.sha, SHA1_LENGTH)); + + if (hashBuf != buf) + PORT_Free(hashBuf); + return rv; +} + +/* Called from ssl3_SendClientKeyExchange(). */ +SECStatus +ssl3_SendECDHClientKeyExchange(sslSocket *ss, SECKEYPublicKey *svrPubKey) +{ + PK11SymKey *pms = NULL; + SECStatus rv = SECFailure; + PRBool isTLS, isTLS12; + CK_MECHANISM_TYPE target; + const sslNamedGroupDef *groupDef; + sslEphemeralKeyPair *keyPair = NULL; + SECKEYPublicKey *pubKey; + + PORT_Assert(ss->opt.noLocks || ssl_HaveSSL3HandshakeLock(ss)); + PORT_Assert(ss->opt.noLocks || ssl_HaveXmitBufLock(ss)); + + isTLS = (PRBool)(ss->ssl3.pwSpec->version > SSL_LIBRARY_VERSION_3_0); + isTLS12 = (PRBool)(ss->ssl3.pwSpec->version >= SSL_LIBRARY_VERSION_TLS_1_2); + + /* Generate ephemeral EC keypair */ + if (svrPubKey->keyType != ecKey) { + PORT_SetError(SEC_ERROR_BAD_KEY); + goto loser; + } + groupDef = ssl_ECPubKey2NamedGroup(svrPubKey); + if (!groupDef) { + PORT_SetError(SEC_ERROR_BAD_KEY); + goto loser; + } + ss->sec.keaGroup = groupDef; + rv = ssl_CreateECDHEphemeralKeyPair(ss, groupDef, &keyPair); + if (rv != SECSuccess) { + ssl_MapLowLevelError(SEC_ERROR_KEYGEN_FAIL); + goto loser; + } + + pubKey = keyPair->keys->pubKey; + PRINT_BUF(50, (ss, "ECDH public value:", + pubKey->u.ec.publicValue.data, + pubKey->u.ec.publicValue.len)); + + if (isTLS12) { + target = CKM_TLS12_MASTER_KEY_DERIVE_DH; + } else if (isTLS) { + target = CKM_TLS_MASTER_KEY_DERIVE_DH; + } else { + target = CKM_SSL3_MASTER_KEY_DERIVE_DH; + } + + /* Determine the PMS */ + pms = PK11_PubDeriveWithKDF(keyPair->keys->privKey, svrPubKey, + PR_FALSE, NULL, NULL, CKM_ECDH1_DERIVE, target, + CKA_DERIVE, 0, CKD_NULL, NULL, NULL); + + if (pms == NULL) { + (void)SSL3_SendAlert(ss, alert_fatal, illegal_parameter); + ssl_MapLowLevelError(SSL_ERROR_CLIENT_KEY_EXCHANGE_FAILURE); + goto loser; + } + + rv = ssl3_AppendHandshakeHeader(ss, client_key_exchange, + pubKey->u.ec.publicValue.len + 1); + if (rv != SECSuccess) { + goto loser; /* err set by ssl3_AppendHandshake* */ + } + + rv = ssl3_AppendHandshakeVariable(ss, pubKey->u.ec.publicValue.data, + pubKey->u.ec.publicValue.len, 1); + + if (rv != SECSuccess) { + goto loser; /* err set by ssl3_AppendHandshake* */ + } + + rv = ssl3_InitPendingCipherSpec(ss, pms); + if (rv != SECSuccess) { + ssl_MapLowLevelError(SSL_ERROR_CLIENT_KEY_EXCHANGE_FAILURE); + goto loser; + } + + PK11_FreeSymKey(pms); + ssl_FreeEphemeralKeyPair(keyPair); + return SECSuccess; + +loser: + if (pms) + PK11_FreeSymKey(pms); + if (keyPair) + ssl_FreeEphemeralKeyPair(keyPair); + return SECFailure; +} + +/* This function returns the size of the key_exchange field in + * the KeyShareEntry structure, i.e.: + * opaque point <1..2^8-1>; */ +unsigned int +tls13_SizeOfECDHEKeyShareKEX(const SECKEYPublicKey *pubKey) +{ + PORT_Assert(pubKey->keyType == ecKey); + return pubKey->u.ec.publicValue.len; +} + +/* This function encodes the key_exchange field in + * the KeyShareEntry structure. */ +SECStatus +tls13_EncodeECDHEKeyShareKEX(const sslSocket *ss, const SECKEYPublicKey *pubKey) +{ + PORT_Assert(ss->opt.noLocks || ssl_HaveSSL3HandshakeLock(ss)); + PORT_Assert(ss->opt.noLocks || ssl_HaveXmitBufLock(ss)); + PORT_Assert(pubKey->keyType == ecKey); + + return ssl3_ExtAppendHandshake(ss, pubKey->u.ec.publicValue.data, + pubKey->u.ec.publicValue.len); +} + +/* +** Called from ssl3_HandleClientKeyExchange() +*/ +SECStatus +ssl3_HandleECDHClientKeyExchange(sslSocket *ss, SSL3Opaque *b, + PRUint32 length, + sslKeyPair *serverKeyPair) +{ + PK11SymKey *pms; + SECStatus rv; + SECKEYPublicKey clntPubKey; + CK_MECHANISM_TYPE target; + PRBool isTLS, isTLS12; + int errCode = SSL_ERROR_RX_MALFORMED_CLIENT_KEY_EXCH; + + PORT_Assert(ss->opt.noLocks || ssl_HaveRecvBufLock(ss)); + PORT_Assert(ss->opt.noLocks || ssl_HaveSSL3HandshakeLock(ss)); + + clntPubKey.keyType = ecKey; + clntPubKey.u.ec.DEREncodedParams.len = + serverKeyPair->pubKey->u.ec.DEREncodedParams.len; + clntPubKey.u.ec.DEREncodedParams.data = + serverKeyPair->pubKey->u.ec.DEREncodedParams.data; + clntPubKey.u.ec.encoding = ECPoint_Undefined; + + rv = ssl3_ConsumeHandshakeVariable(ss, &clntPubKey.u.ec.publicValue, + 1, &b, &length); + if (rv != SECSuccess) { + PORT_SetError(errCode); + return SECFailure; + } + + /* we have to catch the case when the client's public key has length 0. */ + if (!clntPubKey.u.ec.publicValue.len) { + (void)SSL3_SendAlert(ss, alert_fatal, illegal_parameter); + PORT_SetError(errCode); + return SECFailure; + } + + isTLS = (PRBool)(ss->ssl3.prSpec->version > SSL_LIBRARY_VERSION_3_0); + isTLS12 = (PRBool)(ss->ssl3.prSpec->version >= SSL_LIBRARY_VERSION_TLS_1_2); + + if (isTLS12) { + target = CKM_TLS12_MASTER_KEY_DERIVE_DH; + } else if (isTLS) { + target = CKM_TLS_MASTER_KEY_DERIVE_DH; + } else { + target = CKM_SSL3_MASTER_KEY_DERIVE_DH; + } + + /* Determine the PMS */ + pms = PK11_PubDeriveWithKDF(serverKeyPair->privKey, &clntPubKey, + PR_FALSE, NULL, NULL, + CKM_ECDH1_DERIVE, target, CKA_DERIVE, 0, + CKD_NULL, NULL, NULL); + + if (pms == NULL) { + /* last gasp. */ + errCode = ssl_MapLowLevelError(SSL_ERROR_CLIENT_KEY_EXCHANGE_FAILURE); + PORT_SetError(errCode); + return SECFailure; + } + + rv = ssl3_InitPendingCipherSpec(ss, pms); + PK11_FreeSymKey(pms); + if (rv != SECSuccess) { + /* error code set by ssl3_InitPendingCipherSpec */ + return SECFailure; + } + ss->sec.keaGroup = ssl_ECPubKey2NamedGroup(&clntPubKey); + return SECSuccess; +} + +/* +** Take an encoded key share and make a public key out of it. +*/ +SECStatus +ssl_ImportECDHKeyShare(sslSocket *ss, SECKEYPublicKey *peerKey, + SSL3Opaque *b, PRUint32 length, + const sslNamedGroupDef *ecGroup) +{ + SECStatus rv; + SECItem ecPoint = { siBuffer, NULL, 0 }; + + PORT_Assert(ss->opt.noLocks || ssl_HaveRecvBufLock(ss)); + PORT_Assert(ss->opt.noLocks || ssl_HaveSSL3HandshakeLock(ss)); + + if (!length) { + PORT_SetError(SSL_ERROR_RX_MALFORMED_ECDHE_KEY_SHARE); + return SECFailure; + } + + /* Fail if the ec point uses compressed representation */ + if (b[0] != EC_POINT_FORM_UNCOMPRESSED && + ecGroup->name != ssl_grp_ec_curve25519) { + PORT_SetError(SEC_ERROR_UNSUPPORTED_EC_POINT_FORM); + return SECFailure; + } + + peerKey->keyType = ecKey; + /* Set up the encoded params */ + rv = ssl_NamedGroup2ECParams(peerKey->arena, ecGroup, + &peerKey->u.ec.DEREncodedParams); + if (rv != SECSuccess) { + ssl_MapLowLevelError(SSL_ERROR_RX_MALFORMED_ECDHE_KEY_SHARE); + return SECFailure; + } + peerKey->u.ec.encoding = ECPoint_Undefined; + + /* copy publicValue in peerKey */ + ecPoint.data = b; + ecPoint.len = length; + + rv = SECITEM_CopyItem(peerKey->arena, &peerKey->u.ec.publicValue, &ecPoint); + if (rv != SECSuccess) { + return SECFailure; + } + + return SECSuccess; +} + +const sslNamedGroupDef * +ssl_GetECGroupWithStrength(sslSocket *ss, unsigned int requiredECCbits) +{ + int i; + + PORT_Assert(ss); + + for (i = 0; i < SSL_NAMED_GROUP_COUNT; ++i) { + const sslNamedGroupDef *group = ss->namedGroupPreferences[i]; + if (group && group->keaType == ssl_kea_ecdh && + group->bits >= requiredECCbits) { + return group; + } + } + + PORT_SetError(SSL_ERROR_NO_CYPHER_OVERLAP); + return NULL; +} + +/* Find the "weakest link". Get the strength of the signature and symmetric + * keys and choose a curve based on the weakest of those two. */ +const sslNamedGroupDef * +ssl_GetECGroupForServerSocket(sslSocket *ss) +{ + const sslServerCert *cert = ss->sec.serverCert; + unsigned int certKeySize; + const ssl3BulkCipherDef *bulkCipher; + unsigned int requiredECCbits; + + PORT_Assert(cert); + if (!cert || !cert->serverKeyPair || !cert->serverKeyPair->pubKey) { + PORT_SetError(SSL_ERROR_NO_CYPHER_OVERLAP); + return NULL; + } + + if (cert->certType.authType == ssl_auth_rsa_sign) { + certKeySize = SECKEY_PublicKeyStrengthInBits(cert->serverKeyPair->pubKey); + certKeySize = + SSL_RSASTRENGTH_TO_ECSTRENGTH(certKeySize); + } else if (cert->certType.authType == ssl_auth_ecdsa || + cert->certType.authType == ssl_auth_ecdh_rsa || + cert->certType.authType == ssl_auth_ecdh_ecdsa) { + const sslNamedGroupDef *groupDef = cert->certType.namedCurve; + + /* We won't select a certificate unless the named curve has been + * negotiated (or supported_curves was absent), double check that. */ + PORT_Assert(groupDef->keaType == ssl_kea_ecdh); + PORT_Assert(ssl_NamedGroupEnabled(ss, groupDef)); + if (!ssl_NamedGroupEnabled(ss, groupDef)) { + return NULL; + } + certKeySize = groupDef->bits; + } else { + PORT_Assert(0); + return NULL; + } + bulkCipher = ssl_GetBulkCipherDef(ss->ssl3.hs.suite_def); + requiredECCbits = bulkCipher->key_size * BPB * 2; + PORT_Assert(requiredECCbits || + ss->ssl3.hs.suite_def->bulk_cipher_alg == cipher_null); + if (requiredECCbits > certKeySize) { + requiredECCbits = certKeySize; + } + + return ssl_GetECGroupWithStrength(ss, requiredECCbits); +} + +/* Create an ECDHE key pair for a given curve */ +SECStatus +ssl_CreateECDHEphemeralKeyPair(const sslSocket *ss, + const sslNamedGroupDef *ecGroup, + sslEphemeralKeyPair **keyPair) +{ + SECKEYPrivateKey *privKey = NULL; + SECKEYPublicKey *pubKey = NULL; + SECKEYECParams ecParams = { siBuffer, NULL, 0 }; + sslEphemeralKeyPair *pair; + + if (ssl_NamedGroup2ECParams(NULL, ecGroup, &ecParams) != SECSuccess) { + return SECFailure; + } + privKey = SECKEY_CreateECPrivateKey(&ecParams, &pubKey, ss->pkcs11PinArg); + SECITEM_FreeItem(&ecParams, PR_FALSE); + + if (!privKey || !pubKey || + !(pair = ssl_NewEphemeralKeyPair(ecGroup, privKey, pubKey))) { + if (privKey) { + SECKEY_DestroyPrivateKey(privKey); + } + if (pubKey) { + SECKEY_DestroyPublicKey(pubKey); + } + ssl_MapLowLevelError(SEC_ERROR_KEYGEN_FAIL); + return SECFailure; + } + + *keyPair = pair; + SSL_TRC(50, ("%d: SSL[%d]: Create ECDH ephemeral key %d", + SSL_GETPID(), ss ? ss->fd : NULL, ecGroup->name)); + PRINT_BUF(50, (ss, "Public Key", pubKey->u.ec.publicValue.data, + pubKey->u.ec.publicValue.len)); +#ifdef TRACE + if (ssl_trace >= 50) { + SECItem d = { siBuffer, NULL, 0 }; + SECStatus rv = PK11_ReadRawAttribute(PK11_TypePrivKey, privKey, + CKA_VALUE, &d); + if (rv == SECSuccess) { + PRINT_BUF(50, (ss, "Private Key", d.data, d.len)); + SECITEM_FreeItem(&d, PR_FALSE); + } else { + SSL_TRC(50, ("Error extracting private key")); + } + } +#endif + return SECSuccess; +} + +SECStatus +ssl3_HandleECDHServerKeyExchange(sslSocket *ss, SSL3Opaque *b, PRUint32 length) +{ + PLArenaPool *arena = NULL; + SECKEYPublicKey *peerKey = NULL; + PRBool isTLS; + SECStatus rv; + int errCode = SSL_ERROR_RX_MALFORMED_SERVER_KEY_EXCH; + SSL3AlertDescription desc = illegal_parameter; + SSL3Hashes hashes; + SECItem signature = { siBuffer, NULL, 0 }; + SSLHashType hashAlg; + SSLSignatureScheme sigScheme; + + SECItem ec_params = { siBuffer, NULL, 0 }; + SECItem ec_point = { siBuffer, NULL, 0 }; + unsigned char paramBuf[3]; + const sslNamedGroupDef *ecGroup; + + isTLS = (PRBool)(ss->ssl3.prSpec->version > SSL_LIBRARY_VERSION_3_0); + + ec_params.len = sizeof paramBuf; + ec_params.data = paramBuf; + rv = ssl3_ConsumeHandshake(ss, ec_params.data, ec_params.len, &b, &length); + if (rv != SECSuccess) { + goto loser; /* malformed. */ + } + + /* Fail if the curve is not a named curve */ + if (ec_params.data[0] != ec_type_named) { + errCode = SEC_ERROR_UNSUPPORTED_ELLIPTIC_CURVE; + desc = handshake_failure; + goto alert_loser; + } + ecGroup = ssl_LookupNamedGroup(ec_params.data[1] << 8 | ec_params.data[2]); + if (!ecGroup || ecGroup->keaType != ssl_kea_ecdh) { + errCode = SEC_ERROR_UNSUPPORTED_ELLIPTIC_CURVE; + desc = handshake_failure; + goto alert_loser; + } + + rv = ssl3_ConsumeHandshakeVariable(ss, &ec_point, 1, &b, &length); + if (rv != SECSuccess) { + goto loser; /* malformed. */ + } + + /* Fail if the provided point has length 0. */ + if (!ec_point.len) { + /* desc and errCode are initialized already */ + goto alert_loser; + } + + /* Fail if the ec point is not uncompressed for any curve that's not 25519. */ + if (ecGroup->name != ssl_grp_ec_curve25519 && + ec_point.data[0] != EC_POINT_FORM_UNCOMPRESSED) { + errCode = SEC_ERROR_UNSUPPORTED_EC_POINT_FORM; + desc = handshake_failure; + goto alert_loser; + } + + PORT_Assert(ss->ssl3.prSpec->version <= SSL_LIBRARY_VERSION_TLS_1_2); + if (ss->ssl3.prSpec->version == SSL_LIBRARY_VERSION_TLS_1_2) { + rv = ssl_ConsumeSignatureScheme(ss, &b, &length, &sigScheme); + if (rv != SECSuccess) { + goto loser; /* malformed or unsupported. */ + } + rv = ssl_CheckSignatureSchemeConsistency(ss, sigScheme, + ss->sec.peerCert); + if (rv != SECSuccess) { + goto loser; + } + hashAlg = ssl_SignatureSchemeToHashType(sigScheme); + } else { + /* Use ssl_hash_none to represent the MD5+SHA1 combo. */ + hashAlg = ssl_hash_none; + sigScheme = ssl_sig_none; + } + + rv = ssl3_ConsumeHandshakeVariable(ss, &signature, 2, &b, &length); + if (rv != SECSuccess) { + goto loser; /* malformed. */ + } + + if (length != 0) { + if (isTLS) + desc = decode_error; + goto alert_loser; /* malformed. */ + } + + PRINT_BUF(60, (NULL, "Server EC params", ec_params.data, ec_params.len)); + PRINT_BUF(60, (NULL, "Server EC point", ec_point.data, ec_point.len)); + + /* failures after this point are not malformed handshakes. */ + /* TLS: send decrypt_error if signature failed. */ + desc = isTLS ? decrypt_error : handshake_failure; + + /* + * check to make sure the hash is signed by right guy + */ + rv = ssl3_ComputeECDHKeyHash(hashAlg, ec_params, ec_point, + &ss->ssl3.hs.client_random, + &ss->ssl3.hs.server_random, + &hashes); + + if (rv != SECSuccess) { + errCode = + ssl_MapLowLevelError(SSL_ERROR_SERVER_KEY_EXCHANGE_FAILURE); + goto alert_loser; + } + rv = ssl3_VerifySignedHashes(ss, sigScheme, &hashes, &signature); + if (rv != SECSuccess) { + errCode = + ssl_MapLowLevelError(SSL_ERROR_SERVER_KEY_EXCHANGE_FAILURE); + goto alert_loser; + } + + arena = PORT_NewArena(DER_DEFAULT_CHUNKSIZE); + if (arena == NULL) { + errCode = SEC_ERROR_NO_MEMORY; + goto loser; + } + + peerKey = PORT_ArenaZNew(arena, SECKEYPublicKey); + if (peerKey == NULL) { + errCode = SEC_ERROR_NO_MEMORY; + goto loser; + } + peerKey->arena = arena; + + /* create public key from point data */ + rv = ssl_ImportECDHKeyShare(ss, peerKey, ec_point.data, ec_point.len, + ecGroup); + if (rv != SECSuccess) { + /* error code is set */ + desc = handshake_failure; + errCode = PORT_GetError(); + goto alert_loser; + } + peerKey->pkcs11Slot = NULL; + peerKey->pkcs11ID = CK_INVALID_HANDLE; + + ss->sec.peerKey = peerKey; + return SECSuccess; + +alert_loser: + (void)SSL3_SendAlert(ss, alert_fatal, desc); +loser: + if (arena) { + PORT_FreeArena(arena, PR_FALSE); + } + PORT_SetError(errCode); + return SECFailure; +} + +SECStatus +ssl3_SendECDHServerKeyExchange(sslSocket *ss) +{ + SECStatus rv = SECFailure; + int length; + PRBool isTLS12; + SECItem signed_hash = { siBuffer, NULL, 0 }; + SSLHashType hashAlg; + SSL3Hashes hashes; + + SECItem ec_params = { siBuffer, NULL, 0 }; + unsigned char paramBuf[3]; + const sslNamedGroupDef *ecGroup; + sslEphemeralKeyPair *keyPair; + SECKEYPublicKey *pubKey; + + /* Generate ephemeral ECDH key pair and send the public key */ + ecGroup = ssl_GetECGroupForServerSocket(ss); + if (!ecGroup) { + goto loser; + } + + PORT_Assert(PR_CLIST_IS_EMPTY(&ss->ephemeralKeyPairs)); + if (ss->opt.reuseServerECDHEKey) { + rv = ssl_CreateStaticECDHEKey(ss, ecGroup); + if (rv != SECSuccess) { + goto loser; + } + keyPair = (sslEphemeralKeyPair *)PR_NEXT_LINK(&ss->ephemeralKeyPairs); + } else { + rv = ssl_CreateECDHEphemeralKeyPair(ss, ecGroup, &keyPair); + if (rv != SECSuccess) { + goto loser; + } + PR_APPEND_LINK(&keyPair->link, &ss->ephemeralKeyPairs); + } + + PORT_Assert(keyPair); + if (!keyPair) { + PORT_SetError(SSL_ERROR_SERVER_KEY_EXCHANGE_FAILURE); + return SECFailure; + } + + ec_params.len = sizeof(paramBuf); + ec_params.data = paramBuf; + PORT_Assert(keyPair->group); + PORT_Assert(keyPair->group->keaType == ssl_kea_ecdh); + ec_params.data[0] = ec_type_named; + ec_params.data[1] = keyPair->group->name >> 8; + ec_params.data[2] = keyPair->group->name & 0xff; + + pubKey = keyPair->keys->pubKey; + if (ss->ssl3.pwSpec->version == SSL_LIBRARY_VERSION_TLS_1_2) { + hashAlg = ssl_SignatureSchemeToHashType(ss->ssl3.hs.signatureScheme); + } else { + /* Use ssl_hash_none to represent the MD5+SHA1 combo. */ + hashAlg = ssl_hash_none; + } + rv = ssl3_ComputeECDHKeyHash(hashAlg, ec_params, + pubKey->u.ec.publicValue, + &ss->ssl3.hs.client_random, + &ss->ssl3.hs.server_random, + &hashes); + if (rv != SECSuccess) { + ssl_MapLowLevelError(SSL_ERROR_SERVER_KEY_EXCHANGE_FAILURE); + goto loser; + } + + isTLS12 = (PRBool)(ss->ssl3.pwSpec->version >= SSL_LIBRARY_VERSION_TLS_1_2); + + rv = ssl3_SignHashes(ss, &hashes, + ss->sec.serverCert->serverKeyPair->privKey, &signed_hash); + if (rv != SECSuccess) { + goto loser; /* ssl3_SignHashes has set err. */ + } + + length = ec_params.len + + 1 + pubKey->u.ec.publicValue.len + + (isTLS12 ? 2 : 0) + 2 + signed_hash.len; + + rv = ssl3_AppendHandshakeHeader(ss, server_key_exchange, length); + if (rv != SECSuccess) { + goto loser; /* err set by AppendHandshake. */ + } + + rv = ssl3_AppendHandshake(ss, ec_params.data, ec_params.len); + if (rv != SECSuccess) { + goto loser; /* err set by AppendHandshake. */ + } + + rv = ssl3_AppendHandshakeVariable(ss, pubKey->u.ec.publicValue.data, + pubKey->u.ec.publicValue.len, 1); + if (rv != SECSuccess) { + goto loser; /* err set by AppendHandshake. */ + } + + if (isTLS12) { + rv = ssl3_AppendHandshakeNumber(ss, ss->ssl3.hs.signatureScheme, 2); + if (rv != SECSuccess) { + goto loser; /* err set by AppendHandshake. */ + } + } + + rv = ssl3_AppendHandshakeVariable(ss, signed_hash.data, + signed_hash.len, 2); + if (rv != SECSuccess) { + goto loser; /* err set by AppendHandshake. */ + } + + PORT_Free(signed_hash.data); + return SECSuccess; + +loser: + if (signed_hash.data != NULL) + PORT_Free(signed_hash.data); + return SECFailure; +} + +/* List of all ECC cipher suites */ +static const ssl3CipherSuite ssl_all_ec_suites[] = { + TLS_ECDHE_ECDSA_WITH_3DES_EDE_CBC_SHA, + TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA, + TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256, + TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256, + TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA, + TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256, + TLS_ECDHE_ECDSA_WITH_NULL_SHA, + TLS_ECDHE_ECDSA_WITH_RC4_128_SHA, + TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA384, + TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384, + TLS_ECDHE_RSA_WITH_3DES_EDE_CBC_SHA, + TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA, + TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256, + TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256, + TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384, + TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA, + TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384, + TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256, + TLS_ECDHE_RSA_WITH_NULL_SHA, + TLS_ECDHE_RSA_WITH_RC4_128_SHA, + TLS_ECDH_ECDSA_WITH_3DES_EDE_CBC_SHA, + TLS_ECDH_ECDSA_WITH_AES_128_CBC_SHA, + TLS_ECDH_ECDSA_WITH_AES_256_CBC_SHA, + TLS_ECDH_ECDSA_WITH_NULL_SHA, + TLS_ECDH_ECDSA_WITH_RC4_128_SHA, + TLS_ECDH_RSA_WITH_3DES_EDE_CBC_SHA, + TLS_ECDH_RSA_WITH_AES_128_CBC_SHA, + TLS_ECDH_RSA_WITH_AES_256_CBC_SHA, + TLS_ECDH_RSA_WITH_NULL_SHA, + TLS_ECDH_RSA_WITH_RC4_128_SHA, + 0 /* end of list marker */ +}; + +static const ssl3CipherSuite ssl_dhe_suites[] = { + TLS_DHE_RSA_WITH_AES_128_GCM_SHA256, + TLS_DHE_RSA_WITH_AES_256_GCM_SHA384, + TLS_DHE_RSA_WITH_CHACHA20_POLY1305_SHA256, + TLS_DHE_DSS_WITH_AES_128_GCM_SHA256, + TLS_DHE_RSA_WITH_AES_128_CBC_SHA, + TLS_DHE_DSS_WITH_AES_128_CBC_SHA, + TLS_DHE_RSA_WITH_AES_128_CBC_SHA256, + TLS_DHE_DSS_WITH_AES_128_CBC_SHA256, + TLS_DHE_RSA_WITH_CAMELLIA_128_CBC_SHA, + TLS_DHE_DSS_WITH_CAMELLIA_128_CBC_SHA, + TLS_DHE_RSA_WITH_AES_256_CBC_SHA, + TLS_DHE_DSS_WITH_AES_256_CBC_SHA, + TLS_DHE_RSA_WITH_AES_256_CBC_SHA256, + TLS_DHE_DSS_WITH_AES_256_CBC_SHA256, + TLS_DHE_RSA_WITH_CAMELLIA_256_CBC_SHA, + TLS_DHE_DSS_WITH_CAMELLIA_256_CBC_SHA, + TLS_DHE_RSA_WITH_3DES_EDE_CBC_SHA, + TLS_DHE_DSS_WITH_3DES_EDE_CBC_SHA, + TLS_DHE_DSS_WITH_RC4_128_SHA, + TLS_DHE_RSA_WITH_DES_CBC_SHA, + TLS_DHE_DSS_WITH_DES_CBC_SHA, + 0 +}; + +/* Order(N^2). Yuk. */ +static PRBool +ssl_IsSuiteEnabled(const sslSocket *ss, const ssl3CipherSuite *list) +{ + const ssl3CipherSuite *suite; + + for (suite = list; *suite; ++suite) { + PRBool enabled = PR_FALSE; + SECStatus rv = ssl3_CipherPrefGet(ss, *suite, &enabled); + + PORT_Assert(rv == SECSuccess); /* else is coding error */ + if (rv == SECSuccess && enabled) + return PR_TRUE; + } + return PR_FALSE; +} + +/* Ask: is ANY ECC cipher suite enabled on this socket? */ +PRBool +ssl_IsECCEnabled(const sslSocket *ss) +{ + PK11SlotInfo *slot; + + /* make sure we can do ECC */ + slot = PK11_GetBestSlot(CKM_ECDH1_DERIVE, ss->pkcs11PinArg); + if (!slot) { + return PR_FALSE; + } + PK11_FreeSlot(slot); + + /* make sure an ECC cipher is enabled */ + return ssl_IsSuiteEnabled(ss, ssl_all_ec_suites); +} + +PRBool +ssl_IsDHEEnabled(const sslSocket *ss) +{ + return ssl_IsSuiteEnabled(ss, ssl_dhe_suites); +} + +/* Send our Supported Groups extension. */ +PRInt32 +ssl_SendSupportedGroupsXtn(const sslSocket *ss, + TLSExtensionData *xtnData, + PRBool append, PRUint32 maxBytes) +{ + PRInt32 extension_length; + unsigned char enabledGroups[64]; + unsigned int enabledGroupsLen = 0; + unsigned int i; + PRBool ec; + PRBool ff = PR_FALSE; + + if (!ss) + return 0; + + /* We only send FF supported groups if we require DH named groups + * or if TLS 1.3 is a possibility. */ + if (ss->vrange.max < SSL_LIBRARY_VERSION_TLS_1_3) { + ec = ssl_IsECCEnabled(ss); + if (ss->opt.requireDHENamedGroups) { + ff = ssl_IsDHEEnabled(ss); + } + if (!ec && !ff) + return 0; + } else { + ec = ff = PR_TRUE; + } + + PORT_Assert(sizeof(enabledGroups) > SSL_NAMED_GROUP_COUNT * 2); + for (i = 0; i < SSL_NAMED_GROUP_COUNT; ++i) { + const sslNamedGroupDef *group = ss->namedGroupPreferences[i]; + if (!group) { + continue; + } + if (group->keaType == ssl_kea_ecdh && !ec) { + continue; + } + if (group->keaType == ssl_kea_dh && !ff) { + continue; + } + + if (append) { + (void)ssl_EncodeUintX(group->name, 2, &enabledGroups[enabledGroupsLen]); + } + enabledGroupsLen += 2; + } + + if (enabledGroupsLen == 0) { + return 0; + } + + extension_length = + 2 /* extension type */ + + 2 /* extension length */ + + 2 /* enabled groups length */ + + enabledGroupsLen; + + if (maxBytes < (PRUint32)extension_length) { + return 0; + } + + if (append) { + SECStatus rv; + rv = ssl3_ExtAppendHandshakeNumber(ss, ssl_supported_groups_xtn, 2); + if (rv != SECSuccess) + return -1; + rv = ssl3_ExtAppendHandshakeNumber(ss, extension_length - 4, 2); + if (rv != SECSuccess) + return -1; + rv = ssl3_ExtAppendHandshakeVariable(ss, enabledGroups, + enabledGroupsLen, 2); + if (rv != SECSuccess) + return -1; + if (!ss->sec.isServer) { + xtnData->advertised[xtnData->numAdvertised++] = + ssl_supported_groups_xtn; + } + } + return extension_length; +} + +/* Send our "canned" (precompiled) Supported Point Formats extension, + * which says that we only support uncompressed points. + */ +PRInt32 +ssl3_SendSupportedPointFormatsXtn( + const sslSocket *ss, + TLSExtensionData *xtnData, + PRBool append, + PRUint32 maxBytes) +{ + static const PRUint8 ecPtFmt[6] = { + 0, 11, /* Extension type */ + 0, 2, /* octets that follow */ + 1, /* octets that follow */ + 0 /* uncompressed type only */ + }; + + /* No point in doing this unless we have a socket that supports ECC. + * Similarly, no point if we are going to do TLS 1.3 only or we have already + * picked TLS 1.3 (server) given that it doesn't use point formats. */ + if (!ss || !ssl_IsECCEnabled(ss) || + ss->vrange.min >= SSL_LIBRARY_VERSION_TLS_1_3 || + (ss->sec.isServer && ss->version >= SSL_LIBRARY_VERSION_TLS_1_3)) + return 0; + if (append && maxBytes >= (sizeof ecPtFmt)) { + SECStatus rv = ssl3_ExtAppendHandshake(ss, ecPtFmt, (sizeof ecPtFmt)); + if (rv != SECSuccess) + return -1; + if (!ss->sec.isServer) { + xtnData->advertised[xtnData->numAdvertised++] = + ssl_ec_point_formats_xtn; + } + } + return sizeof(ecPtFmt); +} diff --git a/security/nss/lib/ssl/ssl3ext.c b/security/nss/lib/ssl/ssl3ext.c new file mode 100644 index 000000000..0da41be12 --- /dev/null +++ b/security/nss/lib/ssl/ssl3ext.c @@ -0,0 +1,530 @@ +/* -*- Mode: C; tab-width: 8; indent-tabs-mode: nil; c-basic-offset: 4 -*- */ +/* + * SSL3 Protocol + * + * This Source Code Form is subject to the terms of the Mozilla Public + * License, v. 2.0. If a copy of the MPL was not distributed with this + * file, You can obtain one at http://mozilla.org/MPL/2.0/. */ + +/* TLS extension code moved here from ssl3ecc.c */ + +#include "nssrenam.h" +#include "nss.h" +#include "ssl.h" +#include "sslimpl.h" +#include "sslproto.h" +#include "ssl3exthandle.h" +#include "tls13exthandle.h" + +/* Table of handlers for received TLS hello extensions, one per extension. + * In the second generation, this table will be dynamic, and functions + * will be registered here. + */ +/* This table is used by the server, to handle client hello extensions. */ +static const ssl3ExtensionHandler clientHelloHandlers[] = { + { ssl_server_name_xtn, &ssl3_HandleServerNameXtn }, + { ssl_supported_groups_xtn, &ssl_HandleSupportedGroupsXtn }, + { ssl_ec_point_formats_xtn, &ssl3_HandleSupportedPointFormatsXtn }, + { ssl_session_ticket_xtn, &ssl3_ServerHandleSessionTicketXtn }, + { ssl_renegotiation_info_xtn, &ssl3_HandleRenegotiationInfoXtn }, + { ssl_next_proto_nego_xtn, &ssl3_ServerHandleNextProtoNegoXtn }, + { ssl_app_layer_protocol_xtn, &ssl3_ServerHandleAppProtoXtn }, + { ssl_use_srtp_xtn, &ssl3_ServerHandleUseSRTPXtn }, + { ssl_cert_status_xtn, &ssl3_ServerHandleStatusRequestXtn }, + { ssl_signature_algorithms_xtn, &ssl3_ServerHandleSigAlgsXtn }, + { ssl_extended_master_secret_xtn, &ssl3_HandleExtendedMasterSecretXtn }, + { ssl_signed_cert_timestamp_xtn, &ssl3_ServerHandleSignedCertTimestampXtn }, + { ssl_tls13_key_share_xtn, &tls13_ServerHandleKeyShareXtn }, + { ssl_tls13_pre_shared_key_xtn, &tls13_ServerHandlePreSharedKeyXtn }, + { ssl_tls13_early_data_xtn, &tls13_ServerHandleEarlyDataXtn }, + { ssl_tls13_psk_key_exchange_modes_xtn, + &tls13_ServerHandlePskKeyExchangeModesXtn }, + { ssl_tls13_short_header_xtn, &tls13_HandleShortHeaderXtn }, + { -1, NULL } +}; + +/* These two tables are used by the client, to handle server hello + * extensions. */ +static const ssl3ExtensionHandler serverHelloHandlersTLS[] = { + { ssl_server_name_xtn, &ssl3_HandleServerNameXtn }, + /* TODO: add a handler for ssl_ec_point_formats_xtn */ + { ssl_session_ticket_xtn, &ssl3_ClientHandleSessionTicketXtn }, + { ssl_renegotiation_info_xtn, &ssl3_HandleRenegotiationInfoXtn }, + { ssl_next_proto_nego_xtn, &ssl3_ClientHandleNextProtoNegoXtn }, + { ssl_app_layer_protocol_xtn, &ssl3_ClientHandleAppProtoXtn }, + { ssl_use_srtp_xtn, &ssl3_ClientHandleUseSRTPXtn }, + { ssl_cert_status_xtn, &ssl3_ClientHandleStatusRequestXtn }, + { ssl_extended_master_secret_xtn, &ssl3_HandleExtendedMasterSecretXtn }, + { ssl_signed_cert_timestamp_xtn, &ssl3_ClientHandleSignedCertTimestampXtn }, + { ssl_tls13_key_share_xtn, &tls13_ClientHandleKeyShareXtn }, + { ssl_tls13_pre_shared_key_xtn, &tls13_ClientHandlePreSharedKeyXtn }, + { ssl_tls13_early_data_xtn, &tls13_ClientHandleEarlyDataXtn }, + { ssl_tls13_short_header_xtn, &tls13_HandleShortHeaderXtn }, + { -1, NULL } +}; + +static const ssl3ExtensionHandler helloRetryRequestHandlers[] = { + { ssl_tls13_key_share_xtn, tls13_ClientHandleKeyShareXtnHrr }, + { ssl_tls13_cookie_xtn, tls13_ClientHandleHrrCookie }, + { -1, NULL } +}; + +static const ssl3ExtensionHandler serverHelloHandlersSSL3[] = { + { ssl_renegotiation_info_xtn, &ssl3_HandleRenegotiationInfoXtn }, + { -1, NULL } +}; + +static const ssl3ExtensionHandler newSessionTicketHandlers[] = { + { ssl_tls13_ticket_early_data_info_xtn, + &tls13_ClientHandleTicketEarlyDataInfoXtn }, + { -1, NULL } +}; + +/* This table is used by the client to handle server certificates in TLS 1.3 */ +static const ssl3ExtensionHandler serverCertificateHandlers[] = { + { ssl_signed_cert_timestamp_xtn, &ssl3_ClientHandleSignedCertTimestampXtn }, + { ssl_cert_status_xtn, &ssl3_ClientHandleStatusRequestXtn }, + { -1, NULL } +}; + +/* Tables of functions to format TLS hello extensions, one function per + * extension. + * These static tables are for the formatting of client hello extensions. + * The server's table of hello senders is dynamic, in the socket struct, + * and sender functions are registered there. + * NB: the order of these extensions can have an impact on compatibility. Some + * servers (e.g. Tomcat) will terminate the connection if the last extension in + * the client hello is empty (for example, the extended master secret + * extension, if it were listed last). See bug 1243641. + */ +static const ssl3HelloExtensionSender clientHelloSendersTLS[SSL_MAX_EXTENSIONS] = + { + { ssl_server_name_xtn, &ssl3_SendServerNameXtn }, + { ssl_extended_master_secret_xtn, &ssl3_SendExtendedMasterSecretXtn }, + { ssl_renegotiation_info_xtn, &ssl3_SendRenegotiationInfoXtn }, + { ssl_supported_groups_xtn, &ssl_SendSupportedGroupsXtn }, + { ssl_ec_point_formats_xtn, &ssl3_SendSupportedPointFormatsXtn }, + { ssl_session_ticket_xtn, &ssl3_SendSessionTicketXtn }, + { ssl_next_proto_nego_xtn, &ssl3_ClientSendNextProtoNegoXtn }, + { ssl_app_layer_protocol_xtn, &ssl3_ClientSendAppProtoXtn }, + { ssl_use_srtp_xtn, &ssl3_ClientSendUseSRTPXtn }, + { ssl_cert_status_xtn, &ssl3_ClientSendStatusRequestXtn }, + { ssl_signed_cert_timestamp_xtn, &ssl3_ClientSendSignedCertTimestampXtn }, + { ssl_tls13_key_share_xtn, &tls13_ClientSendKeyShareXtn }, + { ssl_tls13_early_data_xtn, &tls13_ClientSendEarlyDataXtn }, + /* Some servers (e.g. WebSphere Application Server 7.0 and Tomcat) will + * time out or terminate the connection if the last extension in the + * client hello is empty. They are not intolerant of TLS 1.2, so list + * signature_algorithms at the end. See bug 1243641. */ + { ssl_tls13_supported_versions_xtn, &tls13_ClientSendSupportedVersionsXtn }, + { ssl_tls13_short_header_xtn, &tls13_SendShortHeaderXtn }, + { ssl_signature_algorithms_xtn, &ssl3_ClientSendSigAlgsXtn }, + { ssl_tls13_cookie_xtn, &tls13_ClientSendHrrCookieXtn }, + { ssl_tls13_psk_key_exchange_modes_xtn, + &tls13_ClientSendPskKeyExchangeModesXtn }, + /* The pre_shared_key extension MUST be last. */ + { ssl_tls13_pre_shared_key_xtn, &tls13_ClientSendPreSharedKeyXtn }, + /* any extra entries will appear as { 0, NULL } */ + }; + +static const ssl3HelloExtensionSender clientHelloSendersSSL3[SSL_MAX_EXTENSIONS] = { + { ssl_renegotiation_info_xtn, &ssl3_SendRenegotiationInfoXtn } + /* any extra entries will appear as { 0, NULL } */ +}; + +static PRBool +arrayContainsExtension(const PRUint16 *array, PRUint32 len, PRUint16 ex_type) +{ + unsigned int i; + for (i = 0; i < len; i++) { + if (ex_type == array[i]) + return PR_TRUE; + } + return PR_FALSE; +} + +PRBool +ssl3_ExtensionNegotiated(const sslSocket *ss, PRUint16 ex_type) +{ + const TLSExtensionData *xtnData = &ss->xtnData; + return arrayContainsExtension(xtnData->negotiated, + xtnData->numNegotiated, ex_type); +} + +PRBool +ssl3_ClientExtensionAdvertised(const sslSocket *ss, PRUint16 ex_type) +{ + const TLSExtensionData *xtnData = &ss->xtnData; + return arrayContainsExtension(xtnData->advertised, + xtnData->numAdvertised, ex_type); +} + +/* Go through hello extensions in |b| and deserialize + * them into the list in |ss->ssl3.hs.remoteExtensions|. + * The only checking we do in this point is for duplicates. + * + * IMPORTANT: This list just contains pointers to the incoming + * buffer so they can only be used during ClientHello processing. + */ +SECStatus +ssl3_ParseExtensions(sslSocket *ss, SSL3Opaque **b, PRUint32 *length) +{ + /* Clean out the extensions list. */ + ssl3_DestroyRemoteExtensions(&ss->ssl3.hs.remoteExtensions); + + while (*length) { + SECStatus rv; + PRInt32 extension_type; + SECItem extension_data = { siBuffer, NULL, 0 }; + TLSExtension *extension; + PRCList *cursor; + + /* Get the extension's type field */ + extension_type = ssl3_ConsumeHandshakeNumber(ss, 2, b, length); + if (extension_type < 0) { /* failure to decode extension_type */ + return SECFailure; /* alert already sent */ + } + + SSL_TRC(10, ("%d: SSL3[%d]: parsing extension %d", + SSL_GETPID(), ss->fd, extension_type)); + /* Check whether an extension has been sent multiple times. */ + for (cursor = PR_NEXT_LINK(&ss->ssl3.hs.remoteExtensions); + cursor != &ss->ssl3.hs.remoteExtensions; + cursor = PR_NEXT_LINK(cursor)) { + if (((TLSExtension *)cursor)->type == extension_type) { + (void)SSL3_SendAlert(ss, alert_fatal, illegal_parameter); + PORT_SetError(SSL_ERROR_RX_UNEXPECTED_EXTENSION); + return SECFailure; + } + } + + /* Get the data for this extension, so we can pass it or skip it. */ + rv = ssl3_ConsumeHandshakeVariable(ss, &extension_data, 2, b, length); + if (rv != SECSuccess) { + return rv; /* alert already sent */ + } + + extension = PORT_ZNew(TLSExtension); + if (!extension) { + return SECFailure; + } + + extension->type = (PRUint16)extension_type; + extension->data = extension_data; + PR_APPEND_LINK(&extension->link, &ss->ssl3.hs.remoteExtensions); + } + + return SECSuccess; +} + +TLSExtension * +ssl3_FindExtension(sslSocket *ss, SSLExtensionType extension_type) +{ + PRCList *cursor; + + for (cursor = PR_NEXT_LINK(&ss->ssl3.hs.remoteExtensions); + cursor != &ss->ssl3.hs.remoteExtensions; + cursor = PR_NEXT_LINK(cursor)) { + TLSExtension *extension = (TLSExtension *)cursor; + + if (extension->type == extension_type) { + return extension; + } + } + + return NULL; +} + +/* Go through the hello extensions in |ss->ssl3.hs.remoteExtensions|. + * For each one, find the extension handler in the table, and + * if present, invoke that handler. + * Servers ignore any extensions with unknown extension types. + * Clients reject any extensions with unadvertised extension types + * + * In TLS >= 1.3, the client checks that extensions appear in the + * right phase. + */ +SECStatus +ssl3_HandleParsedExtensions(sslSocket *ss, + SSL3HandshakeType handshakeMessage) +{ + const ssl3ExtensionHandler *handlers; + PRBool isTLS13 = ss->version >= SSL_LIBRARY_VERSION_TLS_1_3; + PRCList *cursor; + + switch (handshakeMessage) { + case client_hello: + handlers = clientHelloHandlers; + break; + case new_session_ticket: + PORT_Assert(ss->version >= SSL_LIBRARY_VERSION_TLS_1_3); + handlers = newSessionTicketHandlers; + break; + case hello_retry_request: + handlers = helloRetryRequestHandlers; + break; + case encrypted_extensions: + PORT_Assert(ss->version >= SSL_LIBRARY_VERSION_TLS_1_3); + /* fall through */ + case server_hello: + if (ss->version > SSL_LIBRARY_VERSION_3_0) { + handlers = serverHelloHandlersTLS; + } else { + handlers = serverHelloHandlersSSL3; + } + break; + case certificate: + PORT_Assert(!ss->sec.isServer); + handlers = serverCertificateHandlers; + break; + default: + PORT_SetError(SEC_ERROR_LIBRARY_FAILURE); + PORT_Assert(0); + return SECFailure; + } + + for (cursor = PR_NEXT_LINK(&ss->ssl3.hs.remoteExtensions); + cursor != &ss->ssl3.hs.remoteExtensions; + cursor = PR_NEXT_LINK(cursor)) { + TLSExtension *extension = (TLSExtension *)cursor; + const ssl3ExtensionHandler *handler; + + /* Check whether the server sent an extension which was not advertised + * in the ClientHello */ + if (!ss->sec.isServer && + !ssl3_ClientExtensionAdvertised(ss, extension->type) && + (handshakeMessage != new_session_ticket) && + (extension->type != ssl_tls13_cookie_xtn)) { + (void)SSL3_SendAlert(ss, alert_fatal, unsupported_extension); + PORT_SetError(SSL_ERROR_RX_UNEXPECTED_EXTENSION); + return SECFailure; + } + + /* Check that this is a legal extension in TLS 1.3 */ + if (isTLS13 && !tls13_ExtensionAllowed(extension->type, handshakeMessage)) { + if (handshakeMessage == client_hello) { + /* Skip extensions not used in TLS 1.3 */ + continue; + } + tls13_FatalError(ss, SSL_ERROR_EXTENSION_DISALLOWED_FOR_VERSION, + unsupported_extension); + return SECFailure; + } + + /* Special check for this being the last extension if it's + * PreSharedKey */ + if (ss->sec.isServer && isTLS13 && + (extension->type == ssl_tls13_pre_shared_key_xtn) && + (PR_NEXT_LINK(cursor) != &ss->ssl3.hs.remoteExtensions)) { + tls13_FatalError(ss, + SSL_ERROR_RX_MALFORMED_CLIENT_HELLO, + illegal_parameter); + return SECFailure; + } + + /* find extension_type in table of Hello Extension Handlers */ + for (handler = handlers; handler->ex_type >= 0; handler++) { + /* if found, call this handler */ + if (handler->ex_type == extension->type) { + SECStatus rv; + + rv = (*handler->ex_handler)(ss, &ss->xtnData, + (PRUint16)extension->type, + &extension->data); + if (rv != SECSuccess) { + if (!ss->ssl3.fatalAlertSent) { + /* send a generic alert if the handler didn't already */ + (void)SSL3_SendAlert(ss, alert_fatal, handshake_failure); + } + return SECFailure; + } + } + } + } + return SECSuccess; +} + +/* Syntactic sugar around ssl3_ParseExtensions and + * ssl3_HandleParsedExtensions. */ +SECStatus +ssl3_HandleExtensions(sslSocket *ss, + SSL3Opaque **b, PRUint32 *length, + SSL3HandshakeType handshakeMessage) +{ + SECStatus rv; + + rv = ssl3_ParseExtensions(ss, b, length); + if (rv != SECSuccess) + return rv; + + rv = ssl3_HandleParsedExtensions(ss, handshakeMessage); + if (rv != SECSuccess) + return rv; + + ssl3_DestroyRemoteExtensions(&ss->ssl3.hs.remoteExtensions); + return SECSuccess; +} + +/* Add a callback function to the table of senders of server hello extensions. + */ +SECStatus +ssl3_RegisterExtensionSender(const sslSocket *ss, + TLSExtensionData *xtnData, + PRUint16 ex_type, + ssl3HelloExtensionSenderFunc cb) +{ + int i; + ssl3HelloExtensionSender *sender; + if (ss->version < SSL_LIBRARY_VERSION_TLS_1_3) { + sender = &xtnData->serverHelloSenders[0]; + } else { + if (tls13_ExtensionAllowed(ex_type, server_hello)) { + PORT_Assert(!tls13_ExtensionAllowed(ex_type, encrypted_extensions)); + sender = &xtnData->serverHelloSenders[0]; + } else if (tls13_ExtensionAllowed(ex_type, certificate)) { + sender = &xtnData->certificateSenders[0]; + } else { + PORT_Assert(tls13_ExtensionAllowed(ex_type, encrypted_extensions)); + sender = &xtnData->encryptedExtensionsSenders[0]; + } + } + for (i = 0; i < SSL_MAX_EXTENSIONS; ++i, ++sender) { + if (!sender->ex_sender) { + sender->ex_type = ex_type; + sender->ex_sender = cb; + return SECSuccess; + } + /* detect duplicate senders */ + PORT_Assert(sender->ex_type != ex_type); + if (sender->ex_type == ex_type) { + /* duplicate */ + break; + } + } + PORT_Assert(i < SSL_MAX_EXTENSIONS); /* table needs to grow */ + PORT_SetError(SEC_ERROR_LIBRARY_FAILURE); + return SECFailure; +} + +/* call each of the extension senders and return the accumulated length */ +PRInt32 +ssl3_CallHelloExtensionSenders(sslSocket *ss, PRBool append, PRUint32 maxBytes, + const ssl3HelloExtensionSender *sender) +{ + PRInt32 total_exten_len = 0; + int i; + + if (!sender) { + if (ss->vrange.max > SSL_LIBRARY_VERSION_3_0) { + sender = &clientHelloSendersTLS[0]; + } else { + sender = &clientHelloSendersSSL3[0]; + } + } + + for (i = 0; i < SSL_MAX_EXTENSIONS; ++i, ++sender) { + if (sender->ex_sender) { + PRInt32 extLen = (*sender->ex_sender)(ss, &ss->xtnData, append, maxBytes); + if (extLen < 0) + return -1; + maxBytes -= extLen; + total_exten_len += extLen; + } + } + return total_exten_len; +} + +void +ssl3_DestroyRemoteExtensions(PRCList *list) +{ + PRCList *cur_p; + + while (!PR_CLIST_IS_EMPTY(list)) { + cur_p = PR_LIST_TAIL(list); + PR_REMOVE_LINK(cur_p); + PORT_Free(cur_p); + } +} + +/* Initialize the extension data block. */ +void +ssl3_InitExtensionData(TLSExtensionData *xtnData) +{ + /* Set things up to the right starting state. */ + PORT_Memset(xtnData, 0, sizeof(*xtnData)); + xtnData->peerSupportsFfdheGroups = PR_FALSE; + PR_INIT_CLIST(&xtnData->remoteKeyShares); +} + +/* Free everything that has been allocated and then reset back to + * the starting state. */ +void +ssl3_ResetExtensionData(TLSExtensionData *xtnData) +{ + /* Clean up. */ + ssl3_FreeSniNameArray(xtnData); + PORT_Free(xtnData->clientSigSchemes); + SECITEM_FreeItem(&xtnData->nextProto, PR_FALSE); + tls13_DestroyKeyShares(&xtnData->remoteKeyShares); + + /* Now reinit. */ + ssl3_InitExtensionData(xtnData); +} + +/* Thunks to let extension handlers operate on const sslSocket* objects. */ +SECStatus +ssl3_ExtAppendHandshake(const sslSocket *ss, const void *void_src, + PRInt32 bytes) +{ + return ssl3_AppendHandshake((sslSocket *)ss, void_src, bytes); +} + +SECStatus +ssl3_ExtAppendHandshakeNumber(const sslSocket *ss, PRInt32 num, + PRInt32 lenSize) +{ + return ssl3_AppendHandshakeNumber((sslSocket *)ss, num, lenSize); +} + +SECStatus +ssl3_ExtAppendHandshakeVariable(const sslSocket *ss, + const SSL3Opaque *src, PRInt32 bytes, + PRInt32 lenSize) +{ + return ssl3_AppendHandshakeVariable((sslSocket *)ss, src, bytes, lenSize); +} + +void +ssl3_ExtSendAlert(const sslSocket *ss, SSL3AlertLevel level, + SSL3AlertDescription desc) +{ + (void)SSL3_SendAlert((sslSocket *)ss, level, desc); +} + +void +ssl3_ExtDecodeError(const sslSocket *ss) +{ + (void)ssl3_DecodeError((sslSocket *)ss); +} + +SECStatus +ssl3_ExtConsumeHandshake(const sslSocket *ss, void *v, PRInt32 bytes, + SSL3Opaque **b, PRUint32 *length) +{ + return ssl3_ConsumeHandshake((sslSocket *)ss, v, bytes, b, length); +} + +PRInt32 +ssl3_ExtConsumeHandshakeNumber(const sslSocket *ss, PRInt32 bytes, + SSL3Opaque **b, PRUint32 *length) +{ + return ssl3_ConsumeHandshakeNumber((sslSocket *)ss, bytes, b, length); +} + +SECStatus +ssl3_ExtConsumeHandshakeVariable(const sslSocket *ss, SECItem *i, + PRInt32 bytes, SSL3Opaque **b, + PRUint32 *length) +{ + return ssl3_ConsumeHandshakeVariable((sslSocket *)ss, i, bytes, b, length); +} diff --git a/security/nss/lib/ssl/ssl3ext.h b/security/nss/lib/ssl/ssl3ext.h new file mode 100644 index 000000000..f93ad65bd --- /dev/null +++ b/security/nss/lib/ssl/ssl3ext.h @@ -0,0 +1,156 @@ +/* -*- Mode: C; tab-width: 8; indent-tabs-mode: nil; c-basic-offset: 4 -*- */ +/* + * This file is PRIVATE to SSL. + * + * This Source Code Form is subject to the terms of the Mozilla Public + * License, v. 2.0. If a copy of the MPL was not distributed with this + * file, You can obtain one at http://mozilla.org/MPL/2.0/. */ + +#ifndef __ssl3ext_h_ +#define __ssl3ext_h_ + +typedef enum { + sni_nametype_hostname +} SNINameType; +typedef struct TLSExtensionDataStr TLSExtensionData; + +/* registerable callback function that either appends extension to buffer + * or returns length of data that it would have appended. + */ +typedef PRInt32 (*ssl3HelloExtensionSenderFunc)(const sslSocket *ss, + TLSExtensionData *xtnData, + PRBool append, + PRUint32 maxBytes); + +/* registerable callback function that handles a received extension, + * of the given type. + */ +typedef SECStatus (*ssl3ExtensionHandlerFunc)(const sslSocket *ss, + TLSExtensionData *xtnData, + PRUint16 ex_type, + SECItem *data); + +/* row in a table of hello extension senders */ +typedef struct { + PRInt32 ex_type; + ssl3HelloExtensionSenderFunc ex_sender; +} ssl3HelloExtensionSender; + +/* row in a table of hello extension handlers */ +typedef struct { + PRInt32 ex_type; + ssl3ExtensionHandlerFunc ex_handler; +} ssl3ExtensionHandler; + +struct TLSExtensionDataStr { + /* registered callbacks that send server hello extensions */ + ssl3HelloExtensionSender serverHelloSenders[SSL_MAX_EXTENSIONS]; + ssl3HelloExtensionSender encryptedExtensionsSenders[SSL_MAX_EXTENSIONS]; + ssl3HelloExtensionSender certificateSenders[SSL_MAX_EXTENSIONS]; + + /* Keep track of the extensions that are negotiated. */ + PRUint16 numAdvertised; + PRUint16 numNegotiated; + PRUint16 advertised[SSL_MAX_EXTENSIONS]; + PRUint16 negotiated[SSL_MAX_EXTENSIONS]; + + /* SessionTicket Extension related data. */ + PRBool ticketTimestampVerified; + PRBool emptySessionTicket; + PRBool sentSessionTicketInClientHello; + SECItem psk_ke_modes; + PRUint32 max_early_data_size; + + /* SNI Extension related data + * Names data is not coppied from the input buffer. It can not be + * used outside the scope where input buffer is defined and that + * is beyond ssl3_HandleClientHello function. */ + SECItem *sniNameArr; + PRUint32 sniNameArrSize; + + /* Signed Certificate Timestamps extracted from the TLS extension. + * (client only). + * This container holds a temporary pointer to the extension data, + * until a session structure (the sec.ci.sid of an sslSocket) is setup + * that can hold a permanent copy of the data + * (in sec.ci.sid.u.ssl3.signedCertTimestamps). + * The data pointed to by this structure is neither explicitly allocated + * nor copied: the pointer points to the handshake message buffer and is + * only valid in the scope of ssl3_HandleServerHello. + */ + SECItem signedCertTimestamps; + + PRBool peerSupportsFfdheGroups; /* if the peer supports named ffdhe groups */ + + /* clientSigAndHash contains the contents of the signature_algorithms + * extension (if any) from the client. This is only valid for TLS 1.2 + * or later. */ + SSLSignatureScheme *clientSigSchemes; + unsigned int numClientSigScheme; + + /* In a client: if the server supports Next Protocol Negotiation, then + * this is the protocol that was negotiated. + */ + SECItem nextProto; + SSLNextProtoState nextProtoState; + + PRUint16 dtlsSRTPCipherSuite; /* 0 if not selected */ + + SECItem pskBinder; /* The PSK binder for the first PSK (TLS 1.3) */ + unsigned long pskBinderPrefixLen; /* The length of the binder input. */ + PRCList remoteKeyShares; /* The other side's public keys (TLS 1.3) */ +}; + +typedef struct TLSExtensionStr { + PRCList link; /* The linked list link */ + PRUint16 type; /* Extension type */ + SECItem data; /* Pointers into the handshake data. */ +} TLSExtension; + +SECStatus ssl3_HandleExtensions(sslSocket *ss, + SSL3Opaque **b, PRUint32 *length, + SSL3HandshakeType handshakeMessage); +SECStatus ssl3_ParseExtensions(sslSocket *ss, + SSL3Opaque **b, PRUint32 *length); +SECStatus ssl3_HandleParsedExtensions(sslSocket *ss, + SSL3HandshakeType handshakeMessage); +TLSExtension *ssl3_FindExtension(sslSocket *ss, + SSLExtensionType extension_type); +void ssl3_DestroyRemoteExtensions(PRCList *list); +void ssl3_InitExtensionData(TLSExtensionData *xtnData); +void ssl3_ResetExtensionData(TLSExtensionData *xtnData); + +PRBool ssl3_ExtensionNegotiated(const sslSocket *ss, PRUint16 ex_type); +PRBool ssl3_ClientExtensionAdvertised(const sslSocket *ss, PRUint16 ex_type); + +SECStatus ssl3_RegisterExtensionSender(const sslSocket *ss, + TLSExtensionData *xtnData, + PRUint16 ex_type, + ssl3HelloExtensionSenderFunc cb); +PRInt32 ssl3_CallHelloExtensionSenders(sslSocket *ss, PRBool append, PRUint32 maxBytes, + const ssl3HelloExtensionSender *sender); + +unsigned int ssl3_CalculatePaddingExtensionLength(unsigned int clientHelloLength); +PRInt32 ssl3_AppendPaddingExtension(sslSocket *ss, unsigned int extensionLen, + PRUint32 maxBytes); + +/* Thunks to let us operate on const sslSocket* objects. */ +SECStatus ssl3_ExtAppendHandshake(const sslSocket *ss, const void *void_src, + PRInt32 bytes); +SECStatus ssl3_ExtAppendHandshakeNumber(const sslSocket *ss, PRInt32 num, + PRInt32 lenSize); +SECStatus ssl3_ExtAppendHandshakeVariable(const sslSocket *ss, + const SSL3Opaque *src, PRInt32 bytes, + PRInt32 lenSize); +void ssl3_ExtSendAlert(const sslSocket *ss, SSL3AlertLevel level, + SSL3AlertDescription desc); +void ssl3_ExtDecodeError(const sslSocket *ss); +SECStatus ssl3_ExtConsumeHandshake(const sslSocket *ss, void *v, PRInt32 bytes, + SSL3Opaque **b, PRUint32 *length); +PRInt32 ssl3_ExtConsumeHandshakeNumber(const sslSocket *ss, PRInt32 bytes, + SSL3Opaque **b, PRUint32 *length); +SECStatus ssl3_ExtConsumeHandshakeVariable(const sslSocket *ss, SECItem *i, + PRInt32 bytes, SSL3Opaque **b, + PRUint32 *length); + +#endif diff --git a/security/nss/lib/ssl/ssl3exthandle.c b/security/nss/lib/ssl/ssl3exthandle.c new file mode 100644 index 000000000..2a80e2690 --- /dev/null +++ b/security/nss/lib/ssl/ssl3exthandle.c @@ -0,0 +1,2579 @@ +/* -*- Mode: C; tab-width: 8; indent-tabs-mode: nil; c-basic-offset: 4 -*- */ +/* + * This Source Code Form is subject to the terms of the Mozilla Public + * License, v. 2.0. If a copy of the MPL was not distributed with this + * file, You can obtain one at http://mozilla.org/MPL/2.0/. */ + +#include "nssrenam.h" +#include "nss.h" +#include "ssl.h" +#include "sslproto.h" +#include "sslimpl.h" +#include "pk11pub.h" +#include "blapit.h" +#include "prinit.h" +#include "ssl3ext.h" +#include "ssl3exthandle.h" +#include "tls13exthandle.h" /* For tls13_ServerSendStatusRequestXtn. */ + +static unsigned char key_name[SESS_TICKET_KEY_NAME_LEN]; +static PK11SymKey *session_ticket_enc_key = NULL; +static PK11SymKey *session_ticket_mac_key = NULL; + +static PRCallOnceType generate_session_keys_once; + +static SECStatus ssl3_ParseEncryptedSessionTicket(sslSocket *ss, + SECItem *data, EncryptedSessionTicket *enc_session_ticket); +static SECStatus ssl3_AppendToItem(SECItem *item, const unsigned char *buf, + PRUint32 bytes); +static SECStatus ssl3_ConsumeFromItem(SECItem *item, unsigned char **buf, PRUint32 bytes); +static SECStatus ssl3_AppendNumberToItem(SECItem *item, PRUint32 num, + PRInt32 lenSize); +static SECStatus ssl3_GetSessionTicketKeys(sslSocket *ss, + PK11SymKey **aes_key, PK11SymKey **mac_key); +static SECStatus ssl3_ConsumeFromItem(SECItem *item, unsigned char **buf, PRUint32 bytes); + +/* + * Write bytes. Using this function means the SECItem structure + * cannot be freed. The caller is expected to call this function + * on a shallow copy of the structure. + */ +static SECStatus +ssl3_AppendToItem(SECItem *item, const unsigned char *buf, PRUint32 bytes) +{ + if (bytes > item->len) + return SECFailure; + + PORT_Memcpy(item->data, buf, bytes); + item->data += bytes; + item->len -= bytes; + return SECSuccess; +} + +/* + * Write a number in network byte order. Using this function means the + * SECItem structure cannot be freed. The caller is expected to call + * this function on a shallow copy of the structure. + */ +static SECStatus +ssl3_AppendNumberToItem(SECItem *item, PRUint32 num, PRInt32 lenSize) +{ + SECStatus rv; + PRUint8 b[4]; + PRUint8 *p = b; + + switch (lenSize) { + case 4: + *p++ = (PRUint8)(num >> 24); + case 3: + *p++ = (PRUint8)(num >> 16); + case 2: + *p++ = (PRUint8)(num >> 8); + case 1: + *p = (PRUint8)num; + } + rv = ssl3_AppendToItem(item, &b[0], lenSize); + return rv; +} + +SECStatus +ssl3_SessionTicketShutdown(void *appData, void *nssData) +{ + if (session_ticket_enc_key) { + PK11_FreeSymKey(session_ticket_enc_key); + session_ticket_enc_key = NULL; + } + if (session_ticket_mac_key) { + PK11_FreeSymKey(session_ticket_mac_key); + session_ticket_mac_key = NULL; + } + PORT_Memset(&generate_session_keys_once, 0, + sizeof(generate_session_keys_once)); + return SECSuccess; +} + +static PRStatus +ssl3_GenerateSessionTicketKeys(void *data) +{ + SECStatus rv; + sslSocket *ss = (sslSocket *)data; + sslServerCertType certType = { ssl_auth_rsa_decrypt, NULL }; + const sslServerCert *sc; + SECKEYPrivateKey *svrPrivKey; + SECKEYPublicKey *svrPubKey; + + sc = ssl_FindServerCert(ss, &certType); + if (!sc || !sc->serverKeyPair) { + SSL_DBG(("%d: SSL[%d]: No ssl_auth_rsa_decrypt cert and key pair", + SSL_GETPID(), ss->fd)); + goto loser; + } + svrPrivKey = sc->serverKeyPair->privKey; + svrPubKey = sc->serverKeyPair->pubKey; + if (svrPrivKey == NULL || svrPubKey == NULL) { + SSL_DBG(("%d: SSL[%d]: Pub or priv key(s) is NULL.", + SSL_GETPID(), ss->fd)); + goto loser; + } + + /* Get a copy of the session keys from shared memory. */ + PORT_Memcpy(key_name, SESS_TICKET_KEY_NAME_PREFIX, + sizeof(SESS_TICKET_KEY_NAME_PREFIX)); + if (!ssl_GetSessionTicketKeys(svrPrivKey, svrPubKey, ss->pkcs11PinArg, + &key_name[SESS_TICKET_KEY_NAME_PREFIX_LEN], + &session_ticket_enc_key, &session_ticket_mac_key)) + return PR_FAILURE; + + rv = NSS_RegisterShutdown(ssl3_SessionTicketShutdown, NULL); + if (rv != SECSuccess) + goto loser; + + return PR_SUCCESS; + +loser: + ssl3_SessionTicketShutdown(NULL, NULL); + return PR_FAILURE; +} + +static SECStatus +ssl3_GetSessionTicketKeys(sslSocket *ss, PK11SymKey **aes_key, + PK11SymKey **mac_key) +{ + if (PR_CallOnceWithArg(&generate_session_keys_once, + ssl3_GenerateSessionTicketKeys, ss) != + PR_SUCCESS) + return SECFailure; + + if (session_ticket_enc_key == NULL || + session_ticket_mac_key == NULL) + return SECFailure; + + *aes_key = session_ticket_enc_key; + *mac_key = session_ticket_mac_key; + return SECSuccess; +} + +/* Format an SNI extension, using the name from the socket's URL, + * unless that name is a dotted decimal string. + * Used by client and server. + */ +PRInt32 +ssl3_SendServerNameXtn(const sslSocket *ss, TLSExtensionData *xtnData, PRBool append, + PRUint32 maxBytes) +{ + SECStatus rv; + if (!ss) + return 0; + if (!ss->sec.isServer) { + PRUint32 len; + PRNetAddr netAddr; + + /* must have a hostname */ + if (!ss->url || !ss->url[0]) + return 0; + /* must not be an IPv4 or IPv6 address */ + if (PR_SUCCESS == PR_StringToNetAddr(ss->url, &netAddr)) { + /* is an IP address (v4 or v6) */ + return 0; + } + len = PORT_Strlen(ss->url); + if (append && maxBytes >= len + 9) { + /* extension_type */ + rv = ssl3_ExtAppendHandshakeNumber(ss, ssl_server_name_xtn, 2); + if (rv != SECSuccess) + return -1; + /* length of extension_data */ + rv = ssl3_ExtAppendHandshakeNumber(ss, len + 5, 2); + if (rv != SECSuccess) + return -1; + /* length of server_name_list */ + rv = ssl3_ExtAppendHandshakeNumber(ss, len + 3, 2); + if (rv != SECSuccess) + return -1; + /* Name Type (sni_host_name) */ + rv = ssl3_ExtAppendHandshake(ss, "\0", 1); + if (rv != SECSuccess) + return -1; + /* HostName (length and value) */ + rv = ssl3_ExtAppendHandshakeVariable(ss, (PRUint8 *)ss->url, len, 2); + if (rv != SECSuccess) + return -1; + if (!ss->sec.isServer) { + xtnData->advertised[xtnData->numAdvertised++] = + ssl_server_name_xtn; + } + } + return len + 9; + } + /* Server side */ + if (append && maxBytes >= 4) { + rv = ssl3_ExtAppendHandshakeNumber(ss, ssl_server_name_xtn, 2); + if (rv != SECSuccess) + return -1; + /* length of extension_data */ + rv = ssl3_ExtAppendHandshakeNumber(ss, 0, 2); + if (rv != SECSuccess) + return -1; + } + return 4; +} + +/* Handle an incoming SNI extension. */ +SECStatus +ssl3_HandleServerNameXtn(const sslSocket *ss, TLSExtensionData *xtnData, PRUint16 ex_type, SECItem *data) +{ + SECItem *names = NULL; + PRInt32 listLenBytes = 0; + + if (!ss->sec.isServer) { + return SECSuccess; /* ignore extension */ + } + + /* Server side - consume client data and register server sender. */ + /* do not parse the data if don't have user extension handling function. */ + if (!ss->sniSocketConfig) { + return SECSuccess; + } + + /* length of server_name_list */ + listLenBytes = ssl3_ExtConsumeHandshakeNumber(ss, 2, &data->data, &data->len); + if (listLenBytes < 0) { + goto loser; /* alert already sent */ + } + if (listLenBytes == 0 || listLenBytes != data->len) { + goto alert_loser; + } + + /* Read ServerNameList. */ + while (data->len > 0) { + SECItem tmp; + SECStatus rv; + PRInt32 type; + + /* Read Name Type. */ + type = ssl3_ExtConsumeHandshakeNumber(ss, 1, &data->data, &data->len); + if (type < 0) { /* i.e., SECFailure cast to PRint32 */ + /* alert sent in ConsumeHandshakeNumber */ + goto loser; + } + + /* Read ServerName (length and value). */ + rv = ssl3_ExtConsumeHandshakeVariable(ss, &tmp, 2, &data->data, &data->len); + if (rv != SECSuccess) { + goto loser; + } + + /* Record the value for host_name(0). */ + if (type == sni_nametype_hostname) { + /* Fail if we encounter a second host_name entry. */ + if (names) { + goto alert_loser; + } + + /* Create an array for the only supported NameType. */ + names = PORT_ZNewArray(SECItem, 1); + if (!names) { + goto loser; + } + + /* Copy ServerName into the array. */ + if (SECITEM_CopyItem(NULL, &names[0], &tmp) != SECSuccess) { + goto loser; + } + } + + /* Even if we don't support NameTypes other than host_name at the + * moment, we continue parsing the whole list to check its validity. + * We do not check for duplicate entries with NameType != host_name(0). + */ + } + if (names) { + /* Free old and set the new data. */ + ssl3_FreeSniNameArray(xtnData); + xtnData->sniNameArr = names; + xtnData->sniNameArrSize = 1; + xtnData->negotiated[xtnData->numNegotiated++] = ssl_server_name_xtn; + } + return SECSuccess; + +alert_loser: + ssl3_ExtDecodeError(ss); +loser: + if (names) { + PORT_Free(names); + } + return SECFailure; +} + +/* Frees a given xtnData->sniNameArr and its elements. */ +void +ssl3_FreeSniNameArray(TLSExtensionData *xtnData) +{ + PRUint32 i; + + if (!xtnData->sniNameArr) { + return; + } + + for (i = 0; i < xtnData->sniNameArrSize; i++) { + SECITEM_FreeItem(&xtnData->sniNameArr[i], PR_FALSE); + } + + PORT_Free(xtnData->sniNameArr); + xtnData->sniNameArr = NULL; + xtnData->sniNameArrSize = 0; +} + +/* Called by both clients and servers. + * Clients sends a filled in session ticket if one is available, and otherwise + * sends an empty ticket. Servers always send empty tickets. + */ +PRInt32 +ssl3_SendSessionTicketXtn( + const sslSocket *ss, + TLSExtensionData *xtnData, + PRBool append, + PRUint32 maxBytes) +{ + PRInt32 extension_length; + NewSessionTicket *session_ticket = NULL; + sslSessionID *sid = ss->sec.ci.sid; + + /* Never send an extension with a ticket for TLS 1.3, but + * OK to send the empty one in case the server does 1.2. */ + if (sid->cached == in_client_cache && + sid->version >= SSL_LIBRARY_VERSION_TLS_1_3) { + return 0; + } + + /* Ignore the SessionTicket extension if processing is disabled. */ + if (!ss->opt.enableSessionTickets) + return 0; + + /* Empty extension length = extension_type (2-bytes) + + * length(extension_data) (2-bytes) + */ + extension_length = 4; + + /* If we are a client then send a session ticket if one is availble. + * Servers that support the extension and are willing to negotiate the + * the extension always respond with an empty extension. + */ + if (!ss->sec.isServer) { + /* The caller must be holding sid->u.ssl3.lock for reading. We cannot + * just acquire and release the lock within this function because the + * caller will call this function twice, and we need the inputs to be + * consistent between the two calls. Note that currently the caller + * will only be holding the lock when we are the client and when we're + * attempting to resume an existing session. + */ + + session_ticket = &sid->u.ssl3.locked.sessionTicket; + if (session_ticket->ticket.data) { + if (xtnData->ticketTimestampVerified) { + extension_length += session_ticket->ticket.len; + } else if (!append && + (session_ticket->ticket_lifetime_hint == 0 || + (session_ticket->ticket_lifetime_hint + + session_ticket->received_timestamp > + ssl_Time()))) { + extension_length += session_ticket->ticket.len; + xtnData->ticketTimestampVerified = PR_TRUE; + } + } + } + + if (maxBytes < (PRUint32)extension_length) { + PORT_Assert(0); + return 0; + } + if (append) { + SECStatus rv; + /* extension_type */ + rv = ssl3_ExtAppendHandshakeNumber(ss, ssl_session_ticket_xtn, 2); + if (rv != SECSuccess) + goto loser; + if (session_ticket && session_ticket->ticket.data && + xtnData->ticketTimestampVerified) { + rv = ssl3_ExtAppendHandshakeVariable(ss, session_ticket->ticket.data, + session_ticket->ticket.len, 2); + xtnData->ticketTimestampVerified = PR_FALSE; + xtnData->sentSessionTicketInClientHello = PR_TRUE; + } else { + rv = ssl3_ExtAppendHandshakeNumber(ss, 0, 2); + } + if (rv != SECSuccess) + goto loser; + + if (!ss->sec.isServer) { + xtnData->advertised[xtnData->numAdvertised++] = + ssl_session_ticket_xtn; + } + } + return extension_length; + +loser: + xtnData->ticketTimestampVerified = PR_FALSE; + return -1; +} + +static SECStatus +ssl3_ParseEncryptedSessionTicket(sslSocket *ss, SECItem *data, + EncryptedSessionTicket *enc_session_ticket) +{ + if (ssl3_ConsumeFromItem(data, &enc_session_ticket->key_name, + SESS_TICKET_KEY_NAME_LEN) != + SECSuccess) + return SECFailure; + if (ssl3_ConsumeFromItem(data, &enc_session_ticket->iv, + AES_BLOCK_SIZE) != + SECSuccess) + return SECFailure; + if (ssl3_ConsumeHandshakeVariable(ss, &enc_session_ticket->encrypted_state, + 2, &data->data, &data->len) != + SECSuccess) + return SECFailure; + if (ssl3_ConsumeFromItem(data, &enc_session_ticket->mac, + TLS_EX_SESS_TICKET_MAC_LENGTH) != + SECSuccess) + return SECFailure; + if (data->len != 0) /* Make sure that we have consumed all bytes. */ + return SECFailure; + + return SECSuccess; +} + +/* handle an incoming Next Protocol Negotiation extension. */ +SECStatus +ssl3_ServerHandleNextProtoNegoXtn(const sslSocket *ss, TLSExtensionData *xtnData, PRUint16 ex_type, + SECItem *data) +{ + if (ss->firstHsDone || data->len != 0) { + /* Clients MUST send an empty NPN extension, if any. */ + PORT_SetError(SSL_ERROR_NEXT_PROTOCOL_DATA_INVALID); + return SECFailure; + } + + xtnData->negotiated[xtnData->numNegotiated++] = ex_type; + + /* TODO: server side NPN support would require calling + * ssl3_RegisterServerHelloExtensionSender here in order to echo the + * extension back to the client. */ + + return SECSuccess; +} + +/* ssl3_ValidateNextProtoNego checks that the given block of data is valid: none + * of the lengths may be 0 and the sum of the lengths must equal the length of + * the block. */ +SECStatus +ssl3_ValidateNextProtoNego(const unsigned char *data, unsigned int length) +{ + unsigned int offset = 0; + + while (offset < length) { + unsigned int newOffset = offset + 1 + (unsigned int)data[offset]; + /* Reject embedded nulls to protect against buggy applications that + * store protocol identifiers in null-terminated strings. + */ + if (newOffset > length || data[offset] == 0) { + return SECFailure; + } + offset = newOffset; + } + + return SECSuccess; +} + +/* protocol selection handler for ALPN (server side) and NPN (client side) */ +static SECStatus +ssl3_SelectAppProtocol(const sslSocket *ss, TLSExtensionData *xtnData, + PRUint16 ex_type, SECItem *data) +{ + SECStatus rv; + unsigned char resultBuffer[255]; + SECItem result = { siBuffer, resultBuffer, 0 }; + + rv = ssl3_ValidateNextProtoNego(data->data, data->len); + if (rv != SECSuccess) { + ssl3_ExtSendAlert(ss, alert_fatal, decode_error); + PORT_SetError(SSL_ERROR_NEXT_PROTOCOL_DATA_INVALID); + return rv; + } + + PORT_Assert(ss->nextProtoCallback); + /* For ALPN, the cipher suite isn't selected yet. Note that extensions + * sometimes affect what cipher suite is selected, e.g., for ECC. */ + PORT_Assert((ss->ssl3.hs.preliminaryInfo & + ssl_preinfo_all & ~ssl_preinfo_cipher_suite) == + (ssl_preinfo_all & ~ssl_preinfo_cipher_suite)); + rv = ss->nextProtoCallback(ss->nextProtoArg, ss->fd, data->data, data->len, + result.data, &result.len, sizeof(resultBuffer)); + if (rv != SECSuccess) { + /* Expect callback to call PORT_SetError() */ + ssl3_ExtSendAlert(ss, alert_fatal, internal_error); + return SECFailure; + } + + /* If the callback wrote more than allowed to |result| it has corrupted our + * stack. */ + if (result.len > sizeof(resultBuffer)) { + PORT_SetError(SEC_ERROR_OUTPUT_LEN); + /* TODO: crash */ + return SECFailure; + } + + SECITEM_FreeItem(&xtnData->nextProto, PR_FALSE); + + if (ex_type == ssl_app_layer_protocol_xtn && + xtnData->nextProtoState != SSL_NEXT_PROTO_NEGOTIATED) { + /* The callback might say OK, but then it picks a default value - one + * that was not listed. That's OK for NPN, but not ALPN. */ + ssl3_ExtSendAlert(ss, alert_fatal, no_application_protocol); + PORT_SetError(SSL_ERROR_NEXT_PROTOCOL_NO_PROTOCOL); + return SECFailure; + } + + xtnData->negotiated[xtnData->numNegotiated++] = ex_type; + return SECITEM_CopyItem(NULL, &xtnData->nextProto, &result); +} + +/* handle an incoming ALPN extension at the server */ +SECStatus +ssl3_ServerHandleAppProtoXtn(const sslSocket *ss, TLSExtensionData *xtnData, PRUint16 ex_type, SECItem *data) +{ + int count; + SECStatus rv; + + /* We expressly don't want to allow ALPN on renegotiation, + * despite it being permitted by the spec. */ + if (ss->firstHsDone || data->len == 0) { + /* Clients MUST send a non-empty ALPN extension. */ + ssl3_ExtSendAlert(ss, alert_fatal, illegal_parameter); + PORT_SetError(SSL_ERROR_NEXT_PROTOCOL_DATA_INVALID); + return SECFailure; + } + + /* Unlike NPN, ALPN has extra redundant length information so that + * the extension is the same in both ClientHello and ServerHello. */ + count = ssl3_ExtConsumeHandshakeNumber(ss, 2, &data->data, &data->len); + if (count != data->len) { + ssl3_ExtDecodeError(ss); + return SECFailure; + } + + if (!ss->nextProtoCallback) { + /* we're not configured for it */ + return SECSuccess; + } + + rv = ssl3_SelectAppProtocol(ss, xtnData, ex_type, data); + if (rv != SECSuccess) { + return rv; + } + + /* prepare to send back a response, if we negotiated */ + if (xtnData->nextProtoState == SSL_NEXT_PROTO_NEGOTIATED) { + rv = ssl3_RegisterExtensionSender( + ss, xtnData, ex_type, ssl3_ServerSendAppProtoXtn); + if (rv != SECSuccess) { + ssl3_ExtSendAlert(ss, alert_fatal, internal_error); + PORT_SetError(SEC_ERROR_LIBRARY_FAILURE); + return rv; + } + } + return SECSuccess; +} + +SECStatus +ssl3_ClientHandleNextProtoNegoXtn(const sslSocket *ss, TLSExtensionData *xtnData, PRUint16 ex_type, + SECItem *data) +{ + PORT_Assert(!ss->firstHsDone); + + if (ssl3_ExtensionNegotiated(ss, ssl_app_layer_protocol_xtn)) { + /* If the server negotiated ALPN then it has already told us what + * protocol to use, so it doesn't make sense for us to try to negotiate + * a different one by sending the NPN handshake message. However, if + * we've negotiated NPN then we're required to send the NPN handshake + * message. Thus, these two extensions cannot both be negotiated on the + * same connection. */ + ssl3_ExtSendAlert(ss, alert_fatal, illegal_parameter); + PORT_SetError(SSL_ERROR_BAD_SERVER); + return SECFailure; + } + + /* We should only get this call if we sent the extension, so + * ss->nextProtoCallback needs to be non-NULL. However, it is possible + * that an application erroneously cleared the callback between the time + * we sent the ClientHello and now. */ + if (!ss->nextProtoCallback) { + PORT_Assert(0); + ssl3_ExtSendAlert(ss, alert_fatal, internal_error); + PORT_SetError(SSL_ERROR_NEXT_PROTOCOL_NO_CALLBACK); + return SECFailure; + } + + return ssl3_SelectAppProtocol(ss, xtnData, ex_type, data); +} + +SECStatus +ssl3_ClientHandleAppProtoXtn(const sslSocket *ss, TLSExtensionData *xtnData, PRUint16 ex_type, SECItem *data) +{ + SECStatus rv; + PRInt32 list_len; + SECItem protocol_name; + + if (ssl3_ExtensionNegotiated(ss, ssl_next_proto_nego_xtn)) { + PORT_SetError(SEC_ERROR_LIBRARY_FAILURE); + return SECFailure; + } + + /* The extension data from the server has the following format: + * uint16 name_list_len; + * uint8 len; // where len >= 1 + * uint8 protocol_name[len]; */ + if (data->len < 4 || data->len > 2 + 1 + 255) { + ssl3_ExtSendAlert(ss, alert_fatal, decode_error); + PORT_SetError(SSL_ERROR_NEXT_PROTOCOL_DATA_INVALID); + return SECFailure; + } + + list_len = ssl3_ExtConsumeHandshakeNumber(ss, 2, &data->data, &data->len); + /* The list has to be the entire extension. */ + if (list_len != data->len) { + ssl3_ExtSendAlert(ss, alert_fatal, decode_error); + PORT_SetError(SSL_ERROR_NEXT_PROTOCOL_DATA_INVALID); + return SECFailure; + } + + rv = ssl3_ExtConsumeHandshakeVariable(ss, &protocol_name, 1, + &data->data, &data->len); + /* The list must have exactly one value. */ + if (rv != SECSuccess || data->len != 0) { + ssl3_ExtSendAlert(ss, alert_fatal, decode_error); + PORT_SetError(SSL_ERROR_NEXT_PROTOCOL_DATA_INVALID); + return SECFailure; + } + + SECITEM_FreeItem(&xtnData->nextProto, PR_FALSE); + xtnData->nextProtoState = SSL_NEXT_PROTO_SELECTED; + xtnData->negotiated[xtnData->numNegotiated++] = ex_type; + return SECITEM_CopyItem(NULL, &xtnData->nextProto, &protocol_name); +} + +PRInt32 +ssl3_ClientSendNextProtoNegoXtn(const sslSocket *ss, TLSExtensionData *xtnData, PRBool append, + PRUint32 maxBytes) +{ + PRInt32 extension_length; + + /* Renegotiations do not send this extension. */ + if (!ss->opt.enableNPN || !ss->nextProtoCallback || ss->firstHsDone) { + return 0; + } + + extension_length = 4; + + if (maxBytes < (PRUint32)extension_length) { + return 0; + } + if (append) { + SECStatus rv; + rv = ssl3_ExtAppendHandshakeNumber(ss, ssl_next_proto_nego_xtn, 2); + if (rv != SECSuccess) + goto loser; + rv = ssl3_ExtAppendHandshakeNumber(ss, 0, 2); + if (rv != SECSuccess) + goto loser; + xtnData->advertised[xtnData->numAdvertised++] = + ssl_next_proto_nego_xtn; + } + + return extension_length; + +loser: + return -1; +} + +PRInt32 +ssl3_ClientSendAppProtoXtn(const sslSocket *ss, TLSExtensionData *xtnData, PRBool append, PRUint32 maxBytes) +{ + PRInt32 extension_length; + unsigned char *alpn_protos = NULL; + + /* Renegotiations do not send this extension. */ + if (!ss->opt.enableALPN || !ss->opt.nextProtoNego.data || ss->firstHsDone) { + return 0; + } + + extension_length = 2 /* extension type */ + 2 /* extension length */ + + 2 /* protocol name list length */ + + ss->opt.nextProtoNego.len; + + if (maxBytes < (PRUint32)extension_length) { + return 0; + } + if (append) { + /* NPN requires that the client's fallback protocol is first in the + * list. However, ALPN sends protocols in preference order. So we + * allocate a buffer and move the first protocol to the end of the + * list. */ + SECStatus rv; + const unsigned int len = ss->opt.nextProtoNego.len; + + alpn_protos = PORT_Alloc(len); + if (alpn_protos == NULL) { + return SECFailure; + } + if (len > 0) { + /* Each protocol string is prefixed with a single byte length. */ + unsigned int i = ss->opt.nextProtoNego.data[0] + 1; + if (i <= len) { + memcpy(alpn_protos, &ss->opt.nextProtoNego.data[i], len - i); + memcpy(alpn_protos + len - i, ss->opt.nextProtoNego.data, i); + } else { + /* This seems to be invalid data so we'll send as-is. */ + memcpy(alpn_protos, ss->opt.nextProtoNego.data, len); + } + } + + rv = ssl3_ExtAppendHandshakeNumber(ss, ssl_app_layer_protocol_xtn, 2); + if (rv != SECSuccess) { + goto loser; + } + rv = ssl3_ExtAppendHandshakeNumber(ss, extension_length - 4, 2); + if (rv != SECSuccess) { + goto loser; + } + rv = ssl3_ExtAppendHandshakeVariable(ss, alpn_protos, len, 2); + PORT_Free(alpn_protos); + alpn_protos = NULL; + if (rv != SECSuccess) { + goto loser; + } + xtnData->advertised[xtnData->numAdvertised++] = + ssl_app_layer_protocol_xtn; + } + + return extension_length; + +loser: + if (alpn_protos) { + PORT_Free(alpn_protos); + } + return -1; +} + +PRInt32 +ssl3_ServerSendAppProtoXtn(const sslSocket *ss, TLSExtensionData *xtnData, PRBool append, PRUint32 maxBytes) +{ + PRInt32 extension_length; + + /* we're in over our heads if any of these fail */ + PORT_Assert(ss->opt.enableALPN); + PORT_Assert(xtnData->nextProto.data); + PORT_Assert(xtnData->nextProto.len > 0); + PORT_Assert(xtnData->nextProtoState == SSL_NEXT_PROTO_NEGOTIATED); + PORT_Assert(!ss->firstHsDone); + + extension_length = 2 /* extension type */ + 2 /* extension length */ + + 2 /* protocol name list */ + 1 /* name length */ + + xtnData->nextProto.len; + + if (maxBytes < (PRUint32)extension_length) { + return 0; + } + if (append) { + SECStatus rv; + rv = ssl3_ExtAppendHandshakeNumber(ss, ssl_app_layer_protocol_xtn, 2); + if (rv != SECSuccess) { + return -1; + } + rv = ssl3_ExtAppendHandshakeNumber(ss, extension_length - 4, 2); + if (rv != SECSuccess) { + return -1; + } + rv = ssl3_ExtAppendHandshakeNumber(ss, xtnData->nextProto.len + 1, 2); + if (rv != SECSuccess) { + return -1; + } + rv = ssl3_ExtAppendHandshakeVariable(ss, xtnData->nextProto.data, + xtnData->nextProto.len, 1); + if (rv != SECSuccess) { + return -1; + } + } + + return extension_length; +} + +SECStatus +ssl3_ServerHandleStatusRequestXtn(const sslSocket *ss, TLSExtensionData *xtnData, PRUint16 ex_type, + SECItem *data) +{ + ssl3HelloExtensionSenderFunc sender; + + PORT_Assert(ss->sec.isServer); + + /* remember that we got this extension. */ + xtnData->negotiated[xtnData->numNegotiated++] = ex_type; + + if (ss->version >= SSL_LIBRARY_VERSION_TLS_1_3) { + sender = tls13_ServerSendStatusRequestXtn; + } else { + sender = ssl3_ServerSendStatusRequestXtn; + } + return ssl3_RegisterExtensionSender(ss, xtnData, ex_type, sender); +} + +PRInt32 +ssl3_ServerSendStatusRequestXtn( + const sslSocket *ss, + TLSExtensionData *xtnData, + PRBool append, + PRUint32 maxBytes) +{ + PRInt32 extension_length; + const sslServerCert *serverCert = ss->sec.serverCert; + SECStatus rv; + + if (!serverCert->certStatusArray || + !serverCert->certStatusArray->len) { + return 0; + } + + extension_length = 2 + 2; + if (maxBytes < (PRUint32)extension_length) { + return 0; + } + if (append) { + /* extension_type */ + rv = ssl3_ExtAppendHandshakeNumber(ss, ssl_cert_status_xtn, 2); + if (rv != SECSuccess) + return -1; + /* length of extension_data */ + rv = ssl3_ExtAppendHandshakeNumber(ss, 0, 2); + if (rv != SECSuccess) + return -1; + /* The certificate status data is sent in ssl3_SendCertificateStatus. */ + } + + return extension_length; +} + +/* ssl3_ClientSendStatusRequestXtn builds the status_request extension on the + * client side. See RFC 6066 section 8. */ +PRInt32 +ssl3_ClientSendStatusRequestXtn(const sslSocket *ss, TLSExtensionData *xtnData, PRBool append, + PRUint32 maxBytes) +{ + PRInt32 extension_length; + + if (!ss->opt.enableOCSPStapling) + return 0; + + /* extension_type (2-bytes) + + * length(extension_data) (2-bytes) + + * status_type (1) + + * responder_id_list length (2) + + * request_extensions length (2) + */ + extension_length = 9; + + if (maxBytes < (PRUint32)extension_length) { + PORT_Assert(0); + return 0; + } + if (append) { + SECStatus rv; + + /* extension_type */ + rv = ssl3_ExtAppendHandshakeNumber(ss, ssl_cert_status_xtn, 2); + if (rv != SECSuccess) + return -1; + rv = ssl3_ExtAppendHandshakeNumber(ss, extension_length - 4, 2); + if (rv != SECSuccess) + return -1; + rv = ssl3_ExtAppendHandshakeNumber(ss, 1 /* status_type ocsp */, 1); + if (rv != SECSuccess) + return -1; + /* A zero length responder_id_list means that the responders are + * implicitly known to the server. */ + rv = ssl3_ExtAppendHandshakeNumber(ss, 0, 2); + if (rv != SECSuccess) + return -1; + /* A zero length request_extensions means that there are no extensions. + * Specifically, we don't set the id-pkix-ocsp-nonce extension. This + * means that the server can replay a cached OCSP response to us. */ + rv = ssl3_ExtAppendHandshakeNumber(ss, 0, 2); + if (rv != SECSuccess) + return -1; + + xtnData->advertised[xtnData->numAdvertised++] = ssl_cert_status_xtn; + } + return extension_length; +} + +SECStatus +ssl3_ClientHandleStatusRequestXtn(const sslSocket *ss, TLSExtensionData *xtnData, PRUint16 ex_type, + SECItem *data) +{ + /* In TLS 1.3, the extension carries the OCSP response. */ + if (ss->version >= SSL_LIBRARY_VERSION_TLS_1_3) { + SECStatus rv; + rv = ssl_ReadCertificateStatus(CONST_CAST(sslSocket, ss), + data->data, data->len); + if (rv != SECSuccess) { + return SECFailure; /* code already set */ + } + } else if (data->len != 0) { + ssl3_ExtSendAlert(ss, alert_fatal, illegal_parameter); + PORT_SetError(SSL_ERROR_RX_MALFORMED_SERVER_HELLO); + return SECFailure; + } + + /* Keep track of negotiated extensions. */ + xtnData->negotiated[xtnData->numNegotiated++] = ex_type; + return SECSuccess; +} + +/* + * Called from ssl3_SendNewSessionTicket, tls13_SendNewSessionTicket + */ +SECStatus +ssl3_EncodeSessionTicket(sslSocket *ss, + const NewSessionTicket *ticket, + SECItem *ticket_data) +{ + PRUint32 i; + SECStatus rv; + SECItem plaintext; + SECItem plaintext_item = { 0, NULL, 0 }; + SECItem ciphertext = { 0, NULL, 0 }; + PRUint32 ciphertext_length; + SECItem ticket_buf = { 0, NULL, 0 }; + SECItem ticket_tmp = { 0, NULL, 0 }; + SECItem macParam = { 0, NULL, 0 }; + PRBool ms_is_wrapped; + unsigned char wrapped_ms[SSL3_MASTER_SECRET_LENGTH]; + SECItem ms_item = { 0, NULL, 0 }; + PRUint32 padding_length; + PRUint32 ticket_length; + PRUint32 cert_length = 0; + PRUint8 length_buf[4]; + PRUint32 now; + PK11SymKey *aes_key = NULL; + PK11SymKey *mac_key = NULL; + CK_MECHANISM_TYPE cipherMech = CKM_AES_CBC; + PK11Context *aes_ctx; + CK_MECHANISM_TYPE macMech = CKM_SHA256_HMAC; + PK11Context *hmac_ctx = NULL; + unsigned char computed_mac[TLS_EX_SESS_TICKET_MAC_LENGTH]; + unsigned int computed_mac_length; + unsigned char iv[AES_BLOCK_SIZE]; + SECItem ivItem; + SECItem *srvName = NULL; + PRUint32 srvNameLen = 0; + CK_MECHANISM_TYPE msWrapMech = 0; /* dummy default value, + * must be >= 0 */ + ssl3CipherSpec *spec; + const sslServerCertType *certType; + SECItem alpnSelection = { siBuffer, NULL, 0 }; + + SSL_TRC(3, ("%d: SSL3[%d]: send session_ticket handshake", + SSL_GETPID(), ss->fd)); + + PORT_Assert(ss->opt.noLocks || ssl_HaveXmitBufLock(ss)); + PORT_Assert(ss->opt.noLocks || ssl_HaveSSL3HandshakeLock(ss)); + + if (ss->opt.requestCertificate && ss->sec.ci.sid->peerCert) { + cert_length = 3 + ss->sec.ci.sid->peerCert->derCert.len; + } + + /* Get IV and encryption keys */ + ivItem.data = iv; + ivItem.len = sizeof(iv); + rv = PK11_GenerateRandom(iv, sizeof(iv)); + if (rv != SECSuccess) + goto loser; + + rv = ssl3_GetSessionTicketKeys(ss, &aes_key, &mac_key); + if (rv != SECSuccess) + goto loser; + + if (ss->version >= SSL_LIBRARY_VERSION_TLS_1_3) { + spec = ss->ssl3.cwSpec; + } else { + spec = ss->ssl3.pwSpec; + } + if (spec->msItem.len && spec->msItem.data) { + /* The master secret is available unwrapped. */ + ms_item.data = spec->msItem.data; + ms_item.len = spec->msItem.len; + ms_is_wrapped = PR_FALSE; + } else { + /* Extract the master secret wrapped. */ + sslSessionID sid; + PORT_Memset(&sid, 0, sizeof(sslSessionID)); + + rv = ssl3_CacheWrappedMasterSecret(ss, &sid, spec, + ss->ssl3.hs.kea_def->authKeyType); + if (rv == SECSuccess) { + if (sid.u.ssl3.keys.wrapped_master_secret_len > sizeof(wrapped_ms)) + goto loser; + memcpy(wrapped_ms, sid.u.ssl3.keys.wrapped_master_secret, + sid.u.ssl3.keys.wrapped_master_secret_len); + ms_item.data = wrapped_ms; + ms_item.len = sid.u.ssl3.keys.wrapped_master_secret_len; + msWrapMech = sid.u.ssl3.masterWrapMech; + } else { + /* TODO: else send an empty ticket. */ + goto loser; + } + ms_is_wrapped = PR_TRUE; + } + /* Prep to send negotiated name */ + srvName = &ss->sec.ci.sid->u.ssl3.srvName; + if (srvName->data && srvName->len) { + srvNameLen = 2 + srvName->len; /* len bytes + name len */ + } + + if (ss->xtnData.nextProtoState != SSL_NEXT_PROTO_NO_SUPPORT && + ss->xtnData.nextProto.data) { + alpnSelection = ss->xtnData.nextProto; + } + + ciphertext_length = + sizeof(PRUint16) /* ticket_version */ + + sizeof(SSL3ProtocolVersion) /* ssl_version */ + + sizeof(ssl3CipherSuite) /* ciphersuite */ + + 1 /* compression */ + + 10 /* cipher spec parameters */ + + 1 /* certType arguments */ + + 1 /* SessionTicket.ms_is_wrapped */ + + 4 /* msWrapMech */ + + 2 /* master_secret.length */ + + ms_item.len /* master_secret */ + + 1 /* client_auth_type */ + + cert_length /* cert */ + + 1 /* server name type */ + + srvNameLen /* name len + length field */ + + 1 /* extendedMasterSecretUsed */ + + sizeof(ticket->ticket_lifetime_hint) /* ticket lifetime hint */ + + sizeof(ticket->flags) /* ticket flags */ + + 1 + alpnSelection.len; /* npn value + length field. */ + padding_length = AES_BLOCK_SIZE - + (ciphertext_length % + AES_BLOCK_SIZE); + ciphertext_length += padding_length; + + if (SECITEM_AllocItem(NULL, &plaintext_item, ciphertext_length) == NULL) + goto loser; + + plaintext = plaintext_item; + + /* ticket_version */ + rv = ssl3_AppendNumberToItem(&plaintext, TLS_EX_SESS_TICKET_VERSION, + sizeof(PRUint16)); + if (rv != SECSuccess) + goto loser; + + /* ssl_version */ + rv = ssl3_AppendNumberToItem(&plaintext, ss->version, + sizeof(SSL3ProtocolVersion)); + if (rv != SECSuccess) + goto loser; + + /* ciphersuite */ + rv = ssl3_AppendNumberToItem(&plaintext, ss->ssl3.hs.cipher_suite, + sizeof(ssl3CipherSuite)); + if (rv != SECSuccess) + goto loser; + + /* compression */ + rv = ssl3_AppendNumberToItem(&plaintext, ss->ssl3.hs.compression, 1); + if (rv != SECSuccess) + goto loser; + + /* cipher spec parameters */ + rv = ssl3_AppendNumberToItem(&plaintext, ss->sec.authType, 1); + if (rv != SECSuccess) + goto loser; + rv = ssl3_AppendNumberToItem(&plaintext, ss->sec.authKeyBits, 4); + if (rv != SECSuccess) + goto loser; + rv = ssl3_AppendNumberToItem(&plaintext, ss->sec.keaType, 1); + if (rv != SECSuccess) + goto loser; + rv = ssl3_AppendNumberToItem(&plaintext, ss->sec.keaKeyBits, 4); + if (rv != SECSuccess) + goto loser; + + /* certificate type */ + certType = &ss->sec.serverCert->certType; + PORT_Assert(certType->authType == ss->sec.authType); + switch (ss->sec.authType) { + case ssl_auth_ecdsa: + case ssl_auth_ecdh_rsa: + case ssl_auth_ecdh_ecdsa: + PORT_Assert(certType->namedCurve); + PORT_Assert(certType->namedCurve->keaType == ssl_kea_ecdh); + /* EC curves only use the second of the two bytes. */ + PORT_Assert(certType->namedCurve->name < 256); + rv = ssl3_AppendNumberToItem(&plaintext, + certType->namedCurve->name, 1); + break; + default: + rv = ssl3_AppendNumberToItem(&plaintext, 0, 1); + break; + } + if (rv != SECSuccess) + goto loser; + + /* master_secret */ + rv = ssl3_AppendNumberToItem(&plaintext, ms_is_wrapped, 1); + if (rv != SECSuccess) + goto loser; + rv = ssl3_AppendNumberToItem(&plaintext, msWrapMech, 4); + if (rv != SECSuccess) + goto loser; + rv = ssl3_AppendNumberToItem(&plaintext, ms_item.len, 2); + if (rv != SECSuccess) + goto loser; + rv = ssl3_AppendToItem(&plaintext, ms_item.data, ms_item.len); + if (rv != SECSuccess) + goto loser; + + /* client_identity */ + if (ss->opt.requestCertificate && ss->sec.ci.sid->peerCert) { + rv = ssl3_AppendNumberToItem(&plaintext, CLIENT_AUTH_CERTIFICATE, 1); + if (rv != SECSuccess) + goto loser; + rv = ssl3_AppendNumberToItem(&plaintext, + ss->sec.ci.sid->peerCert->derCert.len, 3); + if (rv != SECSuccess) + goto loser; + rv = ssl3_AppendToItem(&plaintext, + ss->sec.ci.sid->peerCert->derCert.data, + ss->sec.ci.sid->peerCert->derCert.len); + if (rv != SECSuccess) + goto loser; + } else { + rv = ssl3_AppendNumberToItem(&plaintext, 0, 1); + if (rv != SECSuccess) + goto loser; + } + + /* timestamp */ + now = ssl_Time(); + rv = ssl3_AppendNumberToItem(&plaintext, now, + sizeof(ticket->ticket_lifetime_hint)); + if (rv != SECSuccess) + goto loser; + + if (srvNameLen) { + /* Name Type (sni_host_name) */ + rv = ssl3_AppendNumberToItem(&plaintext, srvName->type, 1); + if (rv != SECSuccess) + goto loser; + /* HostName (length and value) */ + rv = ssl3_AppendNumberToItem(&plaintext, srvName->len, 2); + if (rv != SECSuccess) + goto loser; + rv = ssl3_AppendToItem(&plaintext, srvName->data, srvName->len); + if (rv != SECSuccess) + goto loser; + } else { + /* No Name */ + rv = ssl3_AppendNumberToItem(&plaintext, (char)TLS_STE_NO_SERVER_NAME, 1); + if (rv != SECSuccess) + goto loser; + } + + /* extendedMasterSecretUsed */ + rv = ssl3_AppendNumberToItem( + &plaintext, ss->sec.ci.sid->u.ssl3.keys.extendedMasterSecretUsed, 1); + if (rv != SECSuccess) + goto loser; + + /* Flags */ + rv = ssl3_AppendNumberToItem(&plaintext, ticket->flags, + sizeof(ticket->flags)); + if (rv != SECSuccess) + goto loser; + + /* NPN value. */ + PORT_Assert(alpnSelection.len < 256); + rv = ssl3_AppendNumberToItem(&plaintext, alpnSelection.len, 1); + if (rv != SECSuccess) + goto loser; + if (alpnSelection.len) { + rv = ssl3_AppendToItem(&plaintext, alpnSelection.data, alpnSelection.len); + if (rv != SECSuccess) + goto loser; + } + + PORT_Assert(plaintext.len == padding_length); + for (i = 0; i < padding_length; i++) + plaintext.data[i] = (unsigned char)padding_length; + + if (SECITEM_AllocItem(NULL, &ciphertext, ciphertext_length) == NULL) { + rv = SECFailure; + goto loser; + } + + /* Generate encrypted portion of ticket. */ + PORT_Assert(aes_key); + aes_ctx = PK11_CreateContextBySymKey(cipherMech, CKA_ENCRYPT, aes_key, &ivItem); + if (!aes_ctx) + goto loser; + + rv = PK11_CipherOp(aes_ctx, ciphertext.data, + (int *)&ciphertext.len, ciphertext.len, + plaintext_item.data, plaintext_item.len); + PK11_Finalize(aes_ctx); + PK11_DestroyContext(aes_ctx, PR_TRUE); + if (rv != SECSuccess) + goto loser; + + /* Convert ciphertext length to network order. */ + length_buf[0] = (ciphertext.len >> 8) & 0xff; + length_buf[1] = (ciphertext.len) & 0xff; + + /* Compute MAC. */ + PORT_Assert(mac_key); + hmac_ctx = PK11_CreateContextBySymKey(macMech, CKA_SIGN, mac_key, &macParam); + if (!hmac_ctx) + goto loser; + + rv = PK11_DigestBegin(hmac_ctx); + if (rv != SECSuccess) + goto loser; + rv = PK11_DigestOp(hmac_ctx, key_name, SESS_TICKET_KEY_NAME_LEN); + if (rv != SECSuccess) + goto loser; + rv = PK11_DigestOp(hmac_ctx, iv, sizeof(iv)); + if (rv != SECSuccess) + goto loser; + rv = PK11_DigestOp(hmac_ctx, (unsigned char *)length_buf, 2); + if (rv != SECSuccess) + goto loser; + rv = PK11_DigestOp(hmac_ctx, ciphertext.data, ciphertext.len); + if (rv != SECSuccess) + goto loser; + rv = PK11_DigestFinal(hmac_ctx, computed_mac, + &computed_mac_length, sizeof(computed_mac)); + if (rv != SECSuccess) + goto loser; + + ticket_length = + +SESS_TICKET_KEY_NAME_LEN /* key_name */ + + AES_BLOCK_SIZE /* iv */ + + 2 /* length field for NewSessionTicket.ticket.encrypted_state */ + + ciphertext_length /* encrypted_state */ + + TLS_EX_SESS_TICKET_MAC_LENGTH; /* mac */ + + if (SECITEM_AllocItem(NULL, &ticket_buf, ticket_length) == NULL) { + rv = SECFailure; + goto loser; + } + ticket_tmp = ticket_buf; /* Shallow copy because AppendToItem is + * destructive. */ + + rv = ssl3_AppendToItem(&ticket_tmp, key_name, SESS_TICKET_KEY_NAME_LEN); + if (rv != SECSuccess) + goto loser; + + rv = ssl3_AppendToItem(&ticket_tmp, iv, sizeof(iv)); + if (rv != SECSuccess) + goto loser; + + rv = ssl3_AppendNumberToItem(&ticket_tmp, ciphertext.len, 2); + if (rv != SECSuccess) + goto loser; + + rv = ssl3_AppendToItem(&ticket_tmp, ciphertext.data, ciphertext.len); + if (rv != SECSuccess) + goto loser; + + rv = ssl3_AppendToItem(&ticket_tmp, computed_mac, computed_mac_length); + if (rv != SECSuccess) + goto loser; + + /* Give ownership of memory to caller. */ + *ticket_data = ticket_buf; + ticket_buf.data = NULL; + +loser: + if (hmac_ctx) { + PK11_DestroyContext(hmac_ctx, PR_TRUE); + } + if (plaintext_item.data) { + SECITEM_FreeItem(&plaintext_item, PR_FALSE); + } + if (ciphertext.data) { + SECITEM_FreeItem(&ciphertext, PR_FALSE); + } + if (ticket_buf.data) { + SECITEM_FreeItem(&ticket_buf, PR_FALSE); + } + + return rv; +} + +/* When a client receives a SessionTicket extension a NewSessionTicket + * message is expected during the handshake. + */ +SECStatus +ssl3_ClientHandleSessionTicketXtn(const sslSocket *ss, TLSExtensionData *xtnData, PRUint16 ex_type, + SECItem *data) +{ + if (data->len != 0) { + return SECSuccess; /* Ignore the extension. */ + } + + /* Keep track of negotiated extensions. */ + xtnData->negotiated[xtnData->numNegotiated++] = ex_type; + return SECSuccess; +} + +/* Generic ticket processing code, common to TLS 1.0-1.2 and + * TLS 1.3. */ +SECStatus +ssl3_ProcessSessionTicketCommon(sslSocket *ss, SECItem *data) +{ + SECStatus rv; + SECItem *decrypted_state = NULL; + SessionTicket *parsed_session_ticket = NULL; + sslSessionID *sid = NULL; + SSL3Statistics *ssl3stats; + PRUint32 i; + SECItem extension_data; + EncryptedSessionTicket enc_session_ticket; + unsigned char computed_mac[TLS_EX_SESS_TICKET_MAC_LENGTH]; + unsigned int computed_mac_length; + PK11SymKey *aes_key = NULL; + PK11SymKey *mac_key = NULL; + PK11Context *hmac_ctx; + CK_MECHANISM_TYPE macMech = CKM_SHA256_HMAC; + PK11Context *aes_ctx; + CK_MECHANISM_TYPE cipherMech = CKM_AES_CBC; + unsigned char *padding; + PRUint32 padding_length; + unsigned char *buffer; + unsigned int buffer_len; + PRInt32 temp; + SECItem cert_item; + PRInt8 nameType = TLS_STE_NO_SERVER_NAME; + SECItem macParam = { siBuffer, NULL, 0 }; + SECItem alpn_item; + SECItem ivItem; + + /* Turn off stateless session resumption if the client sends a + * SessionTicket extension, even if the extension turns out to be + * malformed (ss->sec.ci.sid is non-NULL when doing session + * renegotiation.) + */ + if (ss->sec.ci.sid != NULL) { + ss->sec.uncache(ss->sec.ci.sid); + ssl_FreeSID(ss->sec.ci.sid); + ss->sec.ci.sid = NULL; + } + + extension_data.data = data->data; /* Keep a copy for future use. */ + extension_data.len = data->len; + + if (ssl3_ParseEncryptedSessionTicket(ss, data, &enc_session_ticket) != + SECSuccess) { + return SECSuccess; /* Pretend it isn't there */ + } + + /* Get session ticket keys. */ + rv = ssl3_GetSessionTicketKeys(ss, &aes_key, &mac_key); + if (rv != SECSuccess) { + SSL_DBG(("%d: SSL[%d]: Unable to get/generate session ticket keys.", + SSL_GETPID(), ss->fd)); + goto loser; + } + + /* If the ticket sent by the client was generated under a key different + * from the one we have, bypass ticket processing. + */ + if (PORT_Memcmp(enc_session_ticket.key_name, key_name, + SESS_TICKET_KEY_NAME_LEN) != 0) { + SSL_DBG(("%d: SSL[%d]: Session ticket key_name sent mismatch.", + SSL_GETPID(), ss->fd)); + goto no_ticket; + } + + /* Verify the MAC on the ticket. MAC verification may also + * fail if the MAC key has been recently refreshed. + */ + PORT_Assert(mac_key); + hmac_ctx = PK11_CreateContextBySymKey(macMech, CKA_SIGN, mac_key, &macParam); + if (!hmac_ctx) { + SSL_DBG(("%d: SSL[%d]: Unable to create HMAC context: %d.", + SSL_GETPID(), ss->fd, PORT_GetError())); + goto no_ticket; + } else { + SSL_DBG(("%d: SSL[%d]: Successfully created HMAC context.", + SSL_GETPID(), ss->fd)); + } + rv = PK11_DigestBegin(hmac_ctx); + if (rv != SECSuccess) { + PK11_DestroyContext(hmac_ctx, PR_TRUE); + goto no_ticket; + } + rv = PK11_DigestOp(hmac_ctx, extension_data.data, + extension_data.len - + TLS_EX_SESS_TICKET_MAC_LENGTH); + if (rv != SECSuccess) { + PK11_DestroyContext(hmac_ctx, PR_TRUE); + goto no_ticket; + } + rv = PK11_DigestFinal(hmac_ctx, computed_mac, + &computed_mac_length, sizeof(computed_mac)); + PK11_DestroyContext(hmac_ctx, PR_TRUE); + if (rv != SECSuccess) + goto no_ticket; + + if (NSS_SecureMemcmp(computed_mac, enc_session_ticket.mac, + computed_mac_length) != + 0) { + SSL_DBG(("%d: SSL[%d]: Session ticket MAC mismatch.", + SSL_GETPID(), ss->fd)); + goto no_ticket; + } + + /* We ignore key_name for now. + * This is ok as MAC verification succeeded. + */ + + /* Decrypt the ticket. */ + + /* Plaintext is shorter than the ciphertext due to padding. */ + decrypted_state = SECITEM_AllocItem(NULL, NULL, + enc_session_ticket.encrypted_state.len); + + PORT_Assert(aes_key); + ivItem.data = enc_session_ticket.iv; + ivItem.len = AES_BLOCK_SIZE; + aes_ctx = PK11_CreateContextBySymKey(cipherMech, CKA_DECRYPT, + aes_key, &ivItem); + if (!aes_ctx) { + SSL_DBG(("%d: SSL[%d]: Unable to create AES context.", + SSL_GETPID(), ss->fd)); + goto no_ticket; + } + + rv = PK11_CipherOp(aes_ctx, decrypted_state->data, + (int *)&decrypted_state->len, decrypted_state->len, + enc_session_ticket.encrypted_state.data, + enc_session_ticket.encrypted_state.len); + PK11_Finalize(aes_ctx); + PK11_DestroyContext(aes_ctx, PR_TRUE); + if (rv != SECSuccess) + goto no_ticket; + + /* Check padding. */ + padding_length = + (PRUint32)decrypted_state->data[decrypted_state->len - 1]; + if (padding_length == 0 || padding_length > AES_BLOCK_SIZE) + goto no_ticket; + + padding = &decrypted_state->data[decrypted_state->len - padding_length]; + for (i = 0; i < padding_length; i++, padding++) { + if (padding_length != (PRUint32)*padding) + goto no_ticket; + } + + /* Deserialize session state. */ + buffer = decrypted_state->data; + buffer_len = decrypted_state->len; + + parsed_session_ticket = PORT_ZAlloc(sizeof(SessionTicket)); + if (parsed_session_ticket == NULL) { + rv = SECFailure; + goto loser; + } + + /* Read ticket_version and reject if the version is wrong */ + temp = ssl3_ExtConsumeHandshakeNumber(ss, 2, &buffer, &buffer_len); + if (temp != TLS_EX_SESS_TICKET_VERSION) + goto no_ticket; + + parsed_session_ticket->ticket_version = (SSL3ProtocolVersion)temp; + + /* Read SSLVersion. */ + temp = ssl3_ExtConsumeHandshakeNumber(ss, 2, &buffer, &buffer_len); + if (temp < 0) + goto no_ticket; + parsed_session_ticket->ssl_version = (SSL3ProtocolVersion)temp; + + /* Read cipher_suite. */ + temp = ssl3_ExtConsumeHandshakeNumber(ss, 2, &buffer, &buffer_len); + if (temp < 0) + goto no_ticket; + parsed_session_ticket->cipher_suite = (ssl3CipherSuite)temp; + + /* Read compression_method. */ + temp = ssl3_ExtConsumeHandshakeNumber(ss, 1, &buffer, &buffer_len); + if (temp < 0) + goto no_ticket; + parsed_session_ticket->compression_method = (SSLCompressionMethod)temp; + + /* Read cipher spec parameters. */ + temp = ssl3_ExtConsumeHandshakeNumber(ss, 1, &buffer, &buffer_len); + if (temp < 0) + goto no_ticket; + parsed_session_ticket->authType = (SSLAuthType)temp; + temp = ssl3_ExtConsumeHandshakeNumber(ss, 4, &buffer, &buffer_len); + if (temp < 0) + goto no_ticket; + parsed_session_ticket->authKeyBits = (PRUint32)temp; + temp = ssl3_ExtConsumeHandshakeNumber(ss, 1, &buffer, &buffer_len); + if (temp < 0) + goto no_ticket; + parsed_session_ticket->keaType = (SSLKEAType)temp; + temp = ssl3_ExtConsumeHandshakeNumber(ss, 4, &buffer, &buffer_len); + if (temp < 0) + goto no_ticket; + parsed_session_ticket->keaKeyBits = (PRUint32)temp; + + /* Read certificate slot */ + parsed_session_ticket->certType.authType = parsed_session_ticket->authType; + temp = ssl3_ExtConsumeHandshakeNumber(ss, 1, &buffer, &buffer_len); + if (temp < 0) + goto no_ticket; + switch (parsed_session_ticket->authType) { + case ssl_auth_ecdsa: + case ssl_auth_ecdh_rsa: + case ssl_auth_ecdh_ecdsa: { + const sslNamedGroupDef *group = + ssl_LookupNamedGroup((SSLNamedGroup)temp); + if (!group || group->keaType != ssl_kea_ecdh) { + goto no_ticket; + } + parsed_session_ticket->certType.namedCurve = group; + } break; + default: + break; + } + + /* Read wrapped master_secret. */ + temp = ssl3_ExtConsumeHandshakeNumber(ss, 1, &buffer, &buffer_len); + if (temp < 0) + goto no_ticket; + parsed_session_ticket->ms_is_wrapped = (PRBool)temp; + + temp = ssl3_ExtConsumeHandshakeNumber(ss, 4, &buffer, &buffer_len); + if (temp < 0) + goto no_ticket; + parsed_session_ticket->msWrapMech = (CK_MECHANISM_TYPE)temp; + + temp = ssl3_ExtConsumeHandshakeNumber(ss, 2, &buffer, &buffer_len); + if (temp < 0) + goto no_ticket; + parsed_session_ticket->ms_length = (PRUint16)temp; + if (parsed_session_ticket->ms_length == 0 || /* sanity check MS. */ + parsed_session_ticket->ms_length > + sizeof(parsed_session_ticket->master_secret)) + goto no_ticket; + + /* Allow for the wrapped master secret to be longer. */ + if (buffer_len < parsed_session_ticket->ms_length) + goto no_ticket; + PORT_Memcpy(parsed_session_ticket->master_secret, buffer, + parsed_session_ticket->ms_length); + buffer += parsed_session_ticket->ms_length; + buffer_len -= parsed_session_ticket->ms_length; + + /* Read client_identity */ + temp = ssl3_ExtConsumeHandshakeNumber(ss, 1, &buffer, &buffer_len); + if (temp < 0) + goto no_ticket; + parsed_session_ticket->client_identity.client_auth_type = + (ClientAuthenticationType)temp; + switch (parsed_session_ticket->client_identity.client_auth_type) { + case CLIENT_AUTH_ANONYMOUS: + break; + case CLIENT_AUTH_CERTIFICATE: + rv = ssl3_ExtConsumeHandshakeVariable(ss, &cert_item, 3, + &buffer, &buffer_len); + if (rv != SECSuccess) + goto no_ticket; + rv = SECITEM_CopyItem(NULL, &parsed_session_ticket->peer_cert, + &cert_item); + if (rv != SECSuccess) + goto no_ticket; + break; + default: + goto no_ticket; + } + /* Read timestamp. */ + temp = ssl3_ExtConsumeHandshakeNumber(ss, 4, &buffer, &buffer_len); + if (temp < 0) + goto no_ticket; + parsed_session_ticket->timestamp = (PRUint32)temp; + + /* Read server name */ + nameType = + ssl3_ExtConsumeHandshakeNumber(ss, 1, &buffer, &buffer_len); + if (nameType != TLS_STE_NO_SERVER_NAME) { + SECItem name_item; + rv = ssl3_ExtConsumeHandshakeVariable(ss, &name_item, 2, &buffer, + &buffer_len); + if (rv != SECSuccess) + goto no_ticket; + rv = SECITEM_CopyItem(NULL, &parsed_session_ticket->srvName, + &name_item); + if (rv != SECSuccess) + goto no_ticket; + parsed_session_ticket->srvName.type = nameType; + } + + /* Read extendedMasterSecretUsed */ + temp = ssl3_ExtConsumeHandshakeNumber(ss, 1, &buffer, &buffer_len); + if (temp < 0) + goto no_ticket; + PORT_Assert(temp == PR_TRUE || temp == PR_FALSE); + parsed_session_ticket->extendedMasterSecretUsed = (PRBool)temp; + + rv = ssl3_ExtConsumeHandshake(ss, &parsed_session_ticket->flags, 4, + &buffer, &buffer_len); + if (rv != SECSuccess) + goto no_ticket; + parsed_session_ticket->flags = PR_ntohl(parsed_session_ticket->flags); + + rv = ssl3_ExtConsumeHandshakeVariable(ss, &alpn_item, 1, &buffer, &buffer_len); + if (rv != SECSuccess) + goto no_ticket; + if (alpn_item.len != 0) { + rv = SECITEM_CopyItem(NULL, &parsed_session_ticket->alpnSelection, + &alpn_item); + if (rv != SECSuccess) + goto no_ticket; + if (alpn_item.len >= 256) + goto no_ticket; + } + + /* Done parsing. Check that all bytes have been consumed. */ + if (buffer_len != padding_length) + goto no_ticket; + + /* Use the ticket if it has not expired, otherwise free the allocated + * memory since the ticket is of no use. + */ + if (parsed_session_ticket->timestamp != 0 && + parsed_session_ticket->timestamp + + TLS_EX_SESS_TICKET_LIFETIME_HINT > + ssl_Time()) { + + sid = ssl3_NewSessionID(ss, PR_TRUE); + if (sid == NULL) { + rv = SECFailure; + goto loser; + } + + /* Copy over parameters. */ + sid->version = parsed_session_ticket->ssl_version; + sid->u.ssl3.cipherSuite = parsed_session_ticket->cipher_suite; + sid->u.ssl3.compression = parsed_session_ticket->compression_method; + sid->authType = parsed_session_ticket->authType; + sid->authKeyBits = parsed_session_ticket->authKeyBits; + sid->keaType = parsed_session_ticket->keaType; + sid->keaKeyBits = parsed_session_ticket->keaKeyBits; + memcpy(&sid->certType, &parsed_session_ticket->certType, + sizeof(sslServerCertType)); + + if (SECITEM_CopyItem(NULL, &sid->u.ssl3.locked.sessionTicket.ticket, + &extension_data) != SECSuccess) + goto no_ticket; + sid->u.ssl3.locked.sessionTicket.flags = parsed_session_ticket->flags; + + if (parsed_session_ticket->ms_length > + sizeof(sid->u.ssl3.keys.wrapped_master_secret)) + goto no_ticket; + PORT_Memcpy(sid->u.ssl3.keys.wrapped_master_secret, + parsed_session_ticket->master_secret, + parsed_session_ticket->ms_length); + sid->u.ssl3.keys.wrapped_master_secret_len = + parsed_session_ticket->ms_length; + sid->u.ssl3.masterWrapMech = parsed_session_ticket->msWrapMech; + sid->u.ssl3.keys.msIsWrapped = + parsed_session_ticket->ms_is_wrapped; + sid->u.ssl3.masterValid = PR_TRUE; + sid->u.ssl3.keys.resumable = PR_TRUE; + sid->u.ssl3.keys.extendedMasterSecretUsed = parsed_session_ticket->extendedMasterSecretUsed; + + /* Copy over client cert from session ticket if there is one. */ + if (parsed_session_ticket->peer_cert.data != NULL) { + if (sid->peerCert != NULL) + CERT_DestroyCertificate(sid->peerCert); + sid->peerCert = CERT_NewTempCertificate(ss->dbHandle, + &parsed_session_ticket->peer_cert, NULL, PR_FALSE, PR_TRUE); + if (sid->peerCert == NULL) { + rv = SECFailure; + goto loser; + } + } + if (parsed_session_ticket->srvName.data != NULL) { + if (sid->u.ssl3.srvName.data) { + SECITEM_FreeItem(&sid->u.ssl3.srvName, PR_FALSE); + } + sid->u.ssl3.srvName = parsed_session_ticket->srvName; + } + if (parsed_session_ticket->alpnSelection.data != NULL) { + sid->u.ssl3.alpnSelection = parsed_session_ticket->alpnSelection; + /* So we don't free below. */ + parsed_session_ticket->alpnSelection.data = NULL; + } + ss->statelessResume = PR_TRUE; + ss->sec.ci.sid = sid; + } + + if (0) { + no_ticket: + SSL_DBG(("%d: SSL[%d]: Session ticket parsing failed.", + SSL_GETPID(), ss->fd)); + ssl3stats = SSL_GetStatistics(); + SSL_AtomicIncrementLong(&ssl3stats->hch_sid_ticket_parse_failures); + } + rv = SECSuccess; + +loser: + /* ss->sec.ci.sid == sid if it did NOT come here via goto statement + * in that case do not free sid + */ + if (sid && (ss->sec.ci.sid != sid)) { + ssl_FreeSID(sid); + sid = NULL; + } + if (decrypted_state != NULL) { + SECITEM_FreeItem(decrypted_state, PR_TRUE); + decrypted_state = NULL; + } + + if (parsed_session_ticket != NULL) { + if (parsed_session_ticket->peer_cert.data) { + SECITEM_FreeItem(&parsed_session_ticket->peer_cert, PR_FALSE); + } + if (parsed_session_ticket->alpnSelection.data) { + SECITEM_FreeItem(&parsed_session_ticket->alpnSelection, PR_FALSE); + } + PORT_ZFree(parsed_session_ticket, sizeof(SessionTicket)); + } + + return rv; +} + +SECStatus +ssl3_ServerHandleSessionTicketXtn(const sslSocket *ss, TLSExtensionData *xtnData, PRUint16 ex_type, + SECItem *data) +{ + + /* Ignore the SessionTicket extension if processing is disabled. */ + if (!ss->opt.enableSessionTickets) { + return SECSuccess; + } + + /* If we are doing TLS 1.3, then ignore this. */ + if (ss->version >= SSL_LIBRARY_VERSION_TLS_1_3) { + return SECSuccess; + } + + /* Keep track of negotiated extensions. */ + xtnData->negotiated[xtnData->numNegotiated++] = ex_type; + + /* Parse the received ticket sent in by the client. We are + * lenient about some parse errors, falling back to a fullshake + * instead of terminating the current connection. + */ + if (data->len == 0) { + xtnData->emptySessionTicket = PR_TRUE; + return SECSuccess; + } + + return ssl3_ProcessSessionTicketCommon(CONST_CAST(sslSocket, ss), data); +} + +/* + * Read bytes. Using this function means the SECItem structure + * cannot be freed. The caller is expected to call this function + * on a shallow copy of the structure. + */ +static SECStatus +ssl3_ConsumeFromItem(SECItem *item, unsigned char **buf, PRUint32 bytes) +{ + if (bytes > item->len) + return SECFailure; + + *buf = item->data; + item->data += bytes; + item->len -= bytes; + return SECSuccess; +} + +/* Extension format: + * Extension number: 2 bytes + * Extension length: 2 bytes + * Verify Data Length: 1 byte + * Verify Data (TLS): 12 bytes (client) or 24 bytes (server) + * Verify Data (SSL): 36 bytes (client) or 72 bytes (server) + */ +PRInt32 +ssl3_SendRenegotiationInfoXtn( + const sslSocket *ss, + TLSExtensionData *xtnData, + PRBool append, + PRUint32 maxBytes) +{ + PRInt32 len = 0; + PRInt32 needed; + + /* In draft-ietf-tls-renegotiation-03, it is NOT RECOMMENDED to send + * both the SCSV and the empty RI, so when we send SCSV in + * the initial handshake, we don't also send RI. + */ + if (!ss || ss->ssl3.hs.sendingSCSV) + return 0; + if (ss->firstHsDone) { + len = ss->sec.isServer ? ss->ssl3.hs.finishedBytes * 2 + : ss->ssl3.hs.finishedBytes; + } + needed = 5 + len; + if (maxBytes < (PRUint32)needed) { + return 0; + } + if (append) { + SECStatus rv; + /* extension_type */ + rv = ssl3_ExtAppendHandshakeNumber(ss, ssl_renegotiation_info_xtn, 2); + if (rv != SECSuccess) + return -1; + /* length of extension_data */ + rv = ssl3_ExtAppendHandshakeNumber(ss, len + 1, 2); + if (rv != SECSuccess) + return -1; + /* verify_Data from previous Finished message(s) */ + rv = ssl3_ExtAppendHandshakeVariable(ss, + ss->ssl3.hs.finishedMsgs.data, len, 1); + if (rv != SECSuccess) + return -1; + if (!ss->sec.isServer) { + xtnData->advertised[xtnData->numAdvertised++] = + ssl_renegotiation_info_xtn; + } + } + return needed; +} + +/* This function runs in both the client and server. */ +SECStatus +ssl3_HandleRenegotiationInfoXtn(const sslSocket *ss, TLSExtensionData *xtnData, PRUint16 ex_type, SECItem *data) +{ + SECStatus rv = SECSuccess; + PRUint32 len = 0; + + if (ss->firstHsDone) { + len = ss->sec.isServer ? ss->ssl3.hs.finishedBytes + : ss->ssl3.hs.finishedBytes * 2; + } + if (data->len != 1 + len || data->data[0] != len) { + ssl3_ExtDecodeError(ss); + return SECFailure; + } + if (len && NSS_SecureMemcmp(ss->ssl3.hs.finishedMsgs.data, + data->data + 1, len)) { + ssl3_ExtSendAlert(ss, alert_fatal, handshake_failure); + PORT_SetError(SSL_ERROR_BAD_HANDSHAKE_HASH_VALUE); + return SECFailure; + } + /* remember that we got this extension and it was correct. */ + CONST_CAST(sslSocket, ss) + ->peerRequestedProtection = 1; + xtnData->negotiated[xtnData->numNegotiated++] = ex_type; + if (ss->sec.isServer) { + /* prepare to send back the appropriate response */ + rv = ssl3_RegisterExtensionSender(ss, xtnData, ex_type, + ssl3_SendRenegotiationInfoXtn); + } + return rv; +} + +PRInt32 +ssl3_ClientSendUseSRTPXtn(const sslSocket *ss, TLSExtensionData *xtnData, PRBool append, PRUint32 maxBytes) +{ + PRUint32 ext_data_len; + PRInt16 i; + SECStatus rv; + + if (!ss) + return 0; + + if (!IS_DTLS(ss) || !ss->ssl3.dtlsSRTPCipherCount) + return 0; /* Not relevant */ + + ext_data_len = 2 + 2 * ss->ssl3.dtlsSRTPCipherCount + 1; + + if (append && maxBytes >= 4 + ext_data_len) { + /* Extension type */ + rv = ssl3_ExtAppendHandshakeNumber(ss, ssl_use_srtp_xtn, 2); + if (rv != SECSuccess) + return -1; + /* Length of extension data */ + rv = ssl3_ExtAppendHandshakeNumber(ss, ext_data_len, 2); + if (rv != SECSuccess) + return -1; + /* Length of the SRTP cipher list */ + rv = ssl3_ExtAppendHandshakeNumber(ss, + 2 * ss->ssl3.dtlsSRTPCipherCount, + 2); + if (rv != SECSuccess) + return -1; + /* The SRTP ciphers */ + for (i = 0; i < ss->ssl3.dtlsSRTPCipherCount; i++) { + rv = ssl3_ExtAppendHandshakeNumber(ss, + ss->ssl3.dtlsSRTPCiphers[i], + 2); + if (rv != SECSuccess) + return -1; + } + /* Empty MKI value */ + ssl3_ExtAppendHandshakeVariable(ss, NULL, 0, 1); + + xtnData->advertised[xtnData->numAdvertised++] = + ssl_use_srtp_xtn; + } + + return 4 + ext_data_len; +} + +PRInt32 +ssl3_ServerSendUseSRTPXtn(const sslSocket *ss, TLSExtensionData *xtnData, PRBool append, PRUint32 maxBytes) +{ + SECStatus rv; + + /* Server side */ + if (!append || maxBytes < 9) { + return 9; + } + + /* Extension type */ + rv = ssl3_ExtAppendHandshakeNumber(ss, ssl_use_srtp_xtn, 2); + if (rv != SECSuccess) + return -1; + /* Length of extension data */ + rv = ssl3_ExtAppendHandshakeNumber(ss, 5, 2); + if (rv != SECSuccess) + return -1; + /* Length of the SRTP cipher list */ + rv = ssl3_ExtAppendHandshakeNumber(ss, 2, 2); + if (rv != SECSuccess) + return -1; + /* The selected cipher */ + rv = ssl3_ExtAppendHandshakeNumber(ss, xtnData->dtlsSRTPCipherSuite, 2); + if (rv != SECSuccess) + return -1; + /* Empty MKI value */ + ssl3_ExtAppendHandshakeVariable(ss, NULL, 0, 1); + + return 9; +} + +SECStatus +ssl3_ClientHandleUseSRTPXtn(const sslSocket *ss, TLSExtensionData *xtnData, PRUint16 ex_type, SECItem *data) +{ + SECStatus rv; + SECItem ciphers = { siBuffer, NULL, 0 }; + PRUint16 i; + PRUint16 cipher = 0; + PRBool found = PR_FALSE; + SECItem litem; + + if (!data->data || !data->len) { + ssl3_ExtDecodeError(ss); + return SECFailure; + } + + /* Get the cipher list */ + rv = ssl3_ExtConsumeHandshakeVariable(ss, &ciphers, 2, + &data->data, &data->len); + if (rv != SECSuccess) { + return SECFailure; /* fatal alert already sent */ + } + /* Now check that the server has picked just 1 (i.e., len = 2) */ + if (ciphers.len != 2) { + ssl3_ExtDecodeError(ss); + return SECFailure; + } + + /* Get the selected cipher */ + cipher = (ciphers.data[0] << 8) | ciphers.data[1]; + + /* Now check that this is one of the ciphers we offered */ + for (i = 0; i < ss->ssl3.dtlsSRTPCipherCount; i++) { + if (cipher == ss->ssl3.dtlsSRTPCiphers[i]) { + found = PR_TRUE; + break; + } + } + + if (!found) { + ssl3_ExtSendAlert(ss, alert_fatal, illegal_parameter); + PORT_SetError(SSL_ERROR_RX_MALFORMED_SERVER_HELLO); + return SECFailure; + } + + /* Get the srtp_mki value */ + rv = ssl3_ExtConsumeHandshakeVariable(ss, &litem, 1, + &data->data, &data->len); + if (rv != SECSuccess) { + return SECFailure; /* alert already sent */ + } + + /* We didn't offer an MKI, so this must be 0 length */ + if (litem.len != 0) { + ssl3_ExtSendAlert(ss, alert_fatal, illegal_parameter); + PORT_SetError(SSL_ERROR_RX_MALFORMED_SERVER_HELLO); + return SECFailure; + } + + /* extra trailing bytes */ + if (data->len != 0) { + ssl3_ExtDecodeError(ss); + return SECFailure; + } + + /* OK, this looks fine. */ + xtnData->negotiated[xtnData->numNegotiated++] = ssl_use_srtp_xtn; + xtnData->dtlsSRTPCipherSuite = cipher; + return SECSuccess; +} + +SECStatus +ssl3_ServerHandleUseSRTPXtn(const sslSocket *ss, TLSExtensionData *xtnData, PRUint16 ex_type, SECItem *data) +{ + SECStatus rv; + SECItem ciphers = { siBuffer, NULL, 0 }; + PRUint16 i; + unsigned int j; + PRUint16 cipher = 0; + PRBool found = PR_FALSE; + SECItem litem; + + if (!IS_DTLS(ss) || !ss->ssl3.dtlsSRTPCipherCount) { + /* Ignore the extension if we aren't doing DTLS or no DTLS-SRTP + * preferences have been set. */ + return SECSuccess; + } + + if (!data->data || data->len < 5) { + ssl3_ExtDecodeError(ss); + return SECFailure; + } + + /* Get the cipher list */ + rv = ssl3_ExtConsumeHandshakeVariable(ss, &ciphers, 2, + &data->data, &data->len); + if (rv != SECSuccess) { + return SECFailure; /* alert already sent */ + } + /* Check that the list is even length */ + if (ciphers.len % 2) { + ssl3_ExtDecodeError(ss); + return SECFailure; + } + + /* Walk through the offered list and pick the most preferred of our + * ciphers, if any */ + for (i = 0; !found && i < ss->ssl3.dtlsSRTPCipherCount; i++) { + for (j = 0; j + 1 < ciphers.len; j += 2) { + cipher = (ciphers.data[j] << 8) | ciphers.data[j + 1]; + if (cipher == ss->ssl3.dtlsSRTPCiphers[i]) { + found = PR_TRUE; + break; + } + } + } + + /* Get the srtp_mki value */ + rv = ssl3_ExtConsumeHandshakeVariable(ss, &litem, 1, &data->data, &data->len); + if (rv != SECSuccess) { + return SECFailure; + } + + if (data->len != 0) { + ssl3_ExtDecodeError(ss); /* trailing bytes */ + return SECFailure; + } + + /* Now figure out what to do */ + if (!found) { + /* No matching ciphers, pretend we don't support use_srtp */ + return SECSuccess; + } + + /* OK, we have a valid cipher and we've selected it */ + xtnData->dtlsSRTPCipherSuite = cipher; + xtnData->negotiated[xtnData->numNegotiated++] = ssl_use_srtp_xtn; + + return ssl3_RegisterExtensionSender(ss, xtnData, + ssl_use_srtp_xtn, + ssl3_ServerSendUseSRTPXtn); +} + +/* ssl3_ServerHandleSigAlgsXtn handles the signature_algorithms extension + * from a client. + * See https://tools.ietf.org/html/rfc5246#section-7.4.1.4.1 */ +SECStatus +ssl3_ServerHandleSigAlgsXtn(const sslSocket *ss, TLSExtensionData *xtnData, PRUint16 ex_type, SECItem *data) +{ + SECStatus rv; + + /* Ignore this extension if we aren't doing TLS 1.2 or greater. */ + if (ss->version < SSL_LIBRARY_VERSION_TLS_1_2) { + return SECSuccess; + } + + if (xtnData->clientSigSchemes) { + PORT_Free(xtnData->clientSigSchemes); + xtnData->clientSigSchemes = NULL; + } + rv = ssl_ParseSignatureSchemes(ss, NULL, + &xtnData->clientSigSchemes, + &xtnData->numClientSigScheme, + &data->data, &data->len); + if (rv != SECSuccess) { + PORT_SetError(SSL_ERROR_RX_MALFORMED_CLIENT_HELLO); + return SECFailure; + } + /* Check for trailing data. */ + if (data->len != 0) { + ssl3_ExtSendAlert(ss, alert_fatal, decode_error); + PORT_SetError(SSL_ERROR_RX_MALFORMED_CLIENT_HELLO); + return SECFailure; + } + + /* Keep track of negotiated extensions. */ + xtnData->negotiated[xtnData->numNegotiated++] = ex_type; + return SECSuccess; +} + +/* ssl3_ClientSendSigAlgsXtn sends the signature_algorithm extension for TLS + * 1.2 ClientHellos. */ +PRInt32 +ssl3_ClientSendSigAlgsXtn(const sslSocket *ss, TLSExtensionData *xtnData, PRBool append, PRUint32 maxBytes) +{ + PRInt32 extension_length; + PRUint8 buf[MAX_SIGNATURE_SCHEMES * 2]; + PRUint32 len; + SECStatus rv; + + if (ss->vrange.max < SSL_LIBRARY_VERSION_TLS_1_2) { + return 0; + } + + rv = ssl3_EncodeSigAlgs(ss, buf, sizeof(buf), &len); + if (rv != SECSuccess) { + return -1; + } + + extension_length = + 2 /* extension type */ + + 2 /* extension length */ + + 2 /* supported_signature_algorithms length */ + + len; + + if (maxBytes < extension_length) { + PORT_Assert(0); + return 0; + } + + if (append) { + SECStatus rv; + rv = ssl3_ExtAppendHandshakeNumber(ss, ssl_signature_algorithms_xtn, 2); + if (rv != SECSuccess) { + return -1; + } + rv = ssl3_ExtAppendHandshakeNumber(ss, len + 2, 2); + if (rv != SECSuccess) { + return -1; + } + + rv = ssl3_ExtAppendHandshakeVariable(ss, buf, len, 2); + if (rv != SECSuccess) { + return -1; + } + + xtnData->advertised[xtnData->numAdvertised++] = + ssl_signature_algorithms_xtn; + } + + return extension_length; +} + +/* Takes the size of the ClientHello, less the record header, and determines how + * much padding is required. */ +unsigned int +ssl3_CalculatePaddingExtensionLength(unsigned int clientHelloLength) +{ + unsigned int recordLength = 1 /* handshake message type */ + + 3 /* handshake message length */ + + clientHelloLength; + unsigned int extensionLength; + + if (recordLength < 256 || recordLength >= 512) { + return 0; + } + + extensionLength = 512 - recordLength; + /* Extensions take at least four bytes to encode. Always include at least + * one byte of data if including the extension. Some servers (e.g. + * WebSphere Application Server 7.0 and Tomcat) will time out or terminate + * the connection if the last extension in the client hello is empty. */ + if (extensionLength < 4 + 1) { + extensionLength = 4 + 1; + } + + return extensionLength; +} + +/* ssl3_AppendPaddingExtension possibly adds an extension which ensures that a + * ClientHello record is either < 256 bytes or is >= 512 bytes. This ensures + * that we don't trigger bugs in F5 products. */ +PRInt32 +ssl3_AppendPaddingExtension(sslSocket *ss, unsigned int extensionLen, + PRUint32 maxBytes) +{ + unsigned int paddingLen = extensionLen - 4; + static unsigned char padding[252]; + + if (extensionLen == 0) { + return 0; + } + + if (extensionLen > maxBytes || + !paddingLen || + paddingLen > sizeof(padding)) { + PORT_Assert(0); + return -1; + } + + if (SECSuccess != ssl3_ExtAppendHandshakeNumber(ss, ssl_padding_xtn, 2)) + return -1; + if (SECSuccess != ssl3_ExtAppendHandshakeVariable(ss, padding, paddingLen, 2)) + return -1; + + return extensionLen; +} + +PRInt32 +ssl3_SendExtendedMasterSecretXtn(const sslSocket *ss, TLSExtensionData *xtnData, PRBool append, + PRUint32 maxBytes) +{ + PRInt32 extension_length; + + if (!ss->opt.enableExtendedMS) { + return 0; + } + + /* Always send the extension in this function, since the + * client always sends it and this function is only called on + * the server if we negotiated the extension. */ + extension_length = 4; /* Type + length (0) */ + if (maxBytes < extension_length) { + PORT_Assert(0); + return 0; + } + + if (append) { + SECStatus rv; + rv = ssl3_ExtAppendHandshakeNumber(ss, ssl_extended_master_secret_xtn, 2); + if (rv != SECSuccess) + goto loser; + rv = ssl3_ExtAppendHandshakeNumber(ss, 0, 2); + if (rv != SECSuccess) + goto loser; + xtnData->advertised[xtnData->numAdvertised++] = + ssl_extended_master_secret_xtn; + } + + return extension_length; + +loser: + return -1; +} + +SECStatus +ssl3_HandleExtendedMasterSecretXtn(const sslSocket *ss, TLSExtensionData *xtnData, PRUint16 ex_type, + SECItem *data) +{ + if (ss->version < SSL_LIBRARY_VERSION_TLS_1_0) { + return SECSuccess; + } + + if (!ss->opt.enableExtendedMS) { + return SECSuccess; + } + + if (data->len != 0) { + SSL_TRC(30, ("%d: SSL3[%d]: Bogus extended master secret extension", + SSL_GETPID(), ss->fd)); + return SECFailure; + } + + SSL_DBG(("%d: SSL[%d]: Negotiated extended master secret extension.", + SSL_GETPID(), ss->fd)); + + /* Keep track of negotiated extensions. */ + xtnData->negotiated[xtnData->numNegotiated++] = ex_type; + + if (ss->sec.isServer) { + return ssl3_RegisterExtensionSender( + ss, xtnData, ex_type, ssl3_SendExtendedMasterSecretXtn); + } + return SECSuccess; +} + +/* ssl3_ClientSendSignedCertTimestampXtn sends the signed_certificate_timestamp + * extension for TLS ClientHellos. */ +PRInt32 +ssl3_ClientSendSignedCertTimestampXtn(const sslSocket *ss, TLSExtensionData *xtnData, PRBool append, + PRUint32 maxBytes) +{ + PRInt32 extension_length = 2 /* extension_type */ + + 2 /* length(extension_data) */; + + /* Only send the extension if processing is enabled. */ + if (!ss->opt.enableSignedCertTimestamps) + return 0; + + if (append && maxBytes >= extension_length) { + SECStatus rv; + /* extension_type */ + rv = ssl3_ExtAppendHandshakeNumber(ss, + ssl_signed_cert_timestamp_xtn, + 2); + if (rv != SECSuccess) + goto loser; + /* zero length */ + rv = ssl3_ExtAppendHandshakeNumber(ss, 0, 2); + if (rv != SECSuccess) + goto loser; + xtnData->advertised[xtnData->numAdvertised++] = + ssl_signed_cert_timestamp_xtn; + } else if (maxBytes < extension_length) { + PORT_Assert(0); + return 0; + } + + return extension_length; +loser: + return -1; +} + +SECStatus +ssl3_ClientHandleSignedCertTimestampXtn(const sslSocket *ss, TLSExtensionData *xtnData, PRUint16 ex_type, + SECItem *data) +{ + /* We do not yet know whether we'll be resuming a session or creating + * a new one, so we keep a pointer to the data in the TLSExtensionData + * structure. This pointer is only valid in the scope of + * ssl3_HandleServerHello, and, if not resuming a session, the data is + * copied once a new session structure has been set up. + * All parsing is currently left to the application and we accept + * everything, including empty data. + */ + SECItem *scts = &xtnData->signedCertTimestamps; + PORT_Assert(!scts->data && !scts->len); + + if (!data->len) { + /* Empty extension data: RFC 6962 mandates non-empty contents. */ + return SECFailure; + } + *scts = *data; + /* Keep track of negotiated extensions. */ + xtnData->negotiated[xtnData->numNegotiated++] = ex_type; + return SECSuccess; +} + +PRInt32 +ssl3_ServerSendSignedCertTimestampXtn(const sslSocket *ss, TLSExtensionData *xtnData, + PRBool append, + PRUint32 maxBytes) +{ + PRInt32 extension_length; + const SECItem *scts = &ss->sec.serverCert->signedCertTimestamps; + + if (!scts->len) { + /* No timestamps to send */ + return 0; + } + + extension_length = 2 /* extension_type */ + + 2 /* length(extension_data) */ + + scts->len; + + if (maxBytes < extension_length) { + PORT_Assert(0); + return 0; + } + if (append) { + SECStatus rv; + /* extension_type */ + rv = ssl3_ExtAppendHandshakeNumber(ss, + ssl_signed_cert_timestamp_xtn, + 2); + if (rv != SECSuccess) { + return -1; + } + /* extension_data */ + rv = ssl3_ExtAppendHandshakeVariable(ss, scts->data, scts->len, 2); + if (rv != SECSuccess) { + return -1; + } + } + + return extension_length; +} + +SECStatus +ssl3_ServerHandleSignedCertTimestampXtn(const sslSocket *ss, + TLSExtensionData *xtnData, + PRUint16 ex_type, + SECItem *data) +{ + xtnData->negotiated[xtnData->numNegotiated++] = ex_type; + PORT_Assert(ss->sec.isServer); + return ssl3_RegisterExtensionSender( + ss, xtnData, ex_type, ssl3_ServerSendSignedCertTimestampXtn); +} + +/* Just make sure that the remote client supports uncompressed points, + * Since that is all we support. Disable ECC cipher suites if it doesn't. + */ +SECStatus +ssl3_HandleSupportedPointFormatsXtn(const sslSocket *ss, TLSExtensionData *xtnData, + PRUint16 ex_type, + SECItem *data) +{ + int i; + + if (data->len < 2 || data->len > 255 || !data->data || + data->len != (unsigned int)data->data[0] + 1) { + ssl3_ExtDecodeError(ss); + return SECFailure; + } + for (i = data->len; --i > 0;) { + if (data->data[i] == 0) { + /* indicate that we should send a reply */ + SECStatus rv; + rv = ssl3_RegisterExtensionSender(ss, xtnData, ex_type, + &ssl3_SendSupportedPointFormatsXtn); + return rv; + } + } + + /* Poor client doesn't support uncompressed points. */ + PORT_SetError(SSL_ERROR_RX_MALFORMED_HANDSHAKE); + return SECFailure; +} + +static SECStatus +ssl_UpdateSupportedGroups(sslSocket *ss, SECItem *data) +{ + PRInt32 list_len; + unsigned int i; + const sslNamedGroupDef *enabled[SSL_NAMED_GROUP_COUNT] = { 0 }; + PORT_Assert(SSL_NAMED_GROUP_COUNT == PR_ARRAY_SIZE(enabled)); + + if (!data->data || data->len < 4) { + (void)ssl3_DecodeError(ss); + return SECFailure; + } + + /* get the length of elliptic_curve_list */ + list_len = ssl3_ConsumeHandshakeNumber(ss, 2, &data->data, &data->len); + if (list_len < 0 || data->len != list_len || (data->len % 2) != 0) { + (void)ssl3_DecodeError(ss); + return SECFailure; + } + + /* disable all groups and remember the enabled groups */ + for (i = 0; i < SSL_NAMED_GROUP_COUNT; ++i) { + enabled[i] = ss->namedGroupPreferences[i]; + ss->namedGroupPreferences[i] = NULL; + } + + /* Read groups from data and enable if in |enabled| */ + while (data->len) { + const sslNamedGroupDef *group; + PRInt32 curve_name = + ssl3_ConsumeHandshakeNumber(ss, 2, &data->data, &data->len); + if (curve_name < 0) { + return SECFailure; /* fatal alert already sent */ + } + group = ssl_LookupNamedGroup(curve_name); + if (group) { + for (i = 0; i < SSL_NAMED_GROUP_COUNT; ++i) { + if (enabled[i] && group == enabled[i]) { + ss->namedGroupPreferences[i] = enabled[i]; + break; + } + } + } + + /* "Codepoints in the NamedCurve registry with a high byte of 0x01 (that + * is, between 256 and 511 inclusive) are set aside for FFDHE groups," + * -- https://tools.ietf.org/html/draft-ietf-tls-negotiated-ff-dhe-10 + */ + if ((curve_name & 0xff00) == 0x0100) { + ss->xtnData.peerSupportsFfdheGroups = PR_TRUE; + } + } + + /* Note: if ss->opt.requireDHENamedGroups is set, we disable DHE cipher + * suites, but we do that in ssl3_config_match(). */ + if (ss->version < SSL_LIBRARY_VERSION_TLS_1_3 && + !ss->opt.requireDHENamedGroups && !ss->xtnData.peerSupportsFfdheGroups) { + /* If we don't require that DHE use named groups, and no FFDHE was + * included, we pretend that they support all the FFDHE groups we do. */ + for (i = 0; i < SSL_NAMED_GROUP_COUNT; ++i) { + if (enabled[i] && enabled[i]->keaType == ssl_kea_dh) { + ss->namedGroupPreferences[i] = enabled[i]; + } + } + } + + return SECSuccess; +} + +/* Ensure that the curve in our server cert is one of the ones supported + * by the remote client, and disable all ECC cipher suites if not. + */ +SECStatus +ssl_HandleSupportedGroupsXtn(const sslSocket *ss, TLSExtensionData *xtnData, + PRUint16 ex_type, SECItem *data) +{ + SECStatus rv; + + rv = ssl_UpdateSupportedGroups(CONST_CAST(sslSocket, ss), data); + if (rv != SECSuccess) + return SECFailure; + + /* TLS 1.3 permits the server to send this extension so make it so. */ + if (ss->sec.isServer && ss->version >= SSL_LIBRARY_VERSION_TLS_1_3) { + rv = ssl3_RegisterExtensionSender(ss, xtnData, ex_type, + &ssl_SendSupportedGroupsXtn); + if (rv != SECSuccess) { + return SECFailure; /* error already set. */ + } + } + + /* Remember that we negotiated this extension. */ + xtnData->negotiated[xtnData->numNegotiated++] = ex_type; + + return SECSuccess; +} diff --git a/security/nss/lib/ssl/ssl3exthandle.h b/security/nss/lib/ssl/ssl3exthandle.h new file mode 100644 index 000000000..65223d6fd --- /dev/null +++ b/security/nss/lib/ssl/ssl3exthandle.h @@ -0,0 +1,95 @@ +/* -*- Mode: C; tab-width: 8; indent-tabs-mode: nil; c-basic-offset: 4 -*- */ +/* + * This file is PRIVATE to SSL. + * + * This Source Code Form is subject to the terms of the Mozilla Public + * License, v. 2.0. If a copy of the MPL was not distributed with this + * file, You can obtain one at http://mozilla.org/MPL/2.0/. */ + +#ifndef __ssl3exthandle_h_ +#define __ssl3exthandle_h_ + +PRInt32 ssl3_SendRenegotiationInfoXtn(const sslSocket *ss, TLSExtensionData *xtnData, + PRBool append, PRUint32 maxBytes); +SECStatus ssl3_HandleRenegotiationInfoXtn(const sslSocket *ss, TLSExtensionData *xtnData, + PRUint16 ex_type, SECItem *data); +SECStatus ssl3_ClientHandleNextProtoNegoXtn(const sslSocket *ss, TLSExtensionData *xtnData, + PRUint16 ex_type, SECItem *data); +SECStatus ssl3_ClientHandleAppProtoXtn(const sslSocket *ss, TLSExtensionData *xtnData, + PRUint16 ex_type, SECItem *data); +SECStatus ssl3_ServerHandleNextProtoNegoXtn(const sslSocket *ss, TLSExtensionData *xtnData, + PRUint16 ex_type, SECItem *data); +SECStatus ssl3_ServerHandleAppProtoXtn(const sslSocket *ss, TLSExtensionData *xtnData, PRUint16 ex_type, + SECItem *data); +PRInt32 ssl3_ClientSendNextProtoNegoXtn(const sslSocket *ss, TLSExtensionData *xtnData, PRBool append, + PRUint32 maxBytes); +PRInt32 ssl3_ClientSendAppProtoXtn(const sslSocket *ss, TLSExtensionData *xtnData, PRBool append, + PRUint32 maxBytes); +PRInt32 ssl3_ServerSendAppProtoXtn(const sslSocket *ss, TLSExtensionData *xtnData, PRBool append, + PRUint32 maxBytes); +PRInt32 ssl3_ClientSendUseSRTPXtn(const sslSocket *ss, TLSExtensionData *xtnData, PRBool append, + PRUint32 maxBytes); +PRInt32 ssl3_ServerSendUseSRTPXtn(const sslSocket *ss, TLSExtensionData *xtnData, PRBool append, + PRUint32 maxBytes); +SECStatus ssl3_ClientHandleUseSRTPXtn(const sslSocket *ss, TLSExtensionData *xtnData, PRUint16 ex_type, + SECItem *data); +SECStatus ssl3_ServerHandleUseSRTPXtn(const sslSocket *ss, TLSExtensionData *xtnData, PRUint16 ex_type, + SECItem *data); +PRInt32 ssl3_ServerSendStatusRequestXtn(const sslSocket *ss, TLSExtensionData *xtnData, + PRBool append, PRUint32 maxBytes); +SECStatus ssl3_ServerHandleStatusRequestXtn(const sslSocket *ss, TLSExtensionData *xtnData, + PRUint16 ex_type, SECItem *data); +SECStatus ssl3_ClientHandleStatusRequestXtn(const sslSocket *ss, TLSExtensionData *xtnData, + PRUint16 ex_type, + SECItem *data); +PRInt32 ssl3_ClientSendStatusRequestXtn(const sslSocket *ss, TLSExtensionData *xtnData, PRBool append, + PRUint32 maxBytes); +PRInt32 ssl3_ClientSendSigAlgsXtn(const sslSocket *ss, TLSExtensionData *xtnData, PRBool append, + PRUint32 maxBytes); +SECStatus ssl3_ServerHandleSigAlgsXtn(const sslSocket *ss, TLSExtensionData *xtnData, PRUint16 ex_type, + SECItem *data); + +PRInt32 ssl3_ClientSendSignedCertTimestampXtn(const sslSocket *ss, TLSExtensionData *xtnData, + PRBool append, + PRUint32 maxBytes); +SECStatus ssl3_ClientHandleSignedCertTimestampXtn(const sslSocket *ss, TLSExtensionData *xtnData, + PRUint16 ex_type, + SECItem *data); +PRInt32 ssl3_ServerSendSignedCertTimestampXtn(const sslSocket *ss, TLSExtensionData *xtnData, + PRBool append, + PRUint32 maxBytes); +SECStatus ssl3_ServerHandleSignedCertTimestampXtn(const sslSocket *ss, TLSExtensionData *xtnData, + PRUint16 ex_type, + SECItem *data); +PRInt32 ssl3_SendExtendedMasterSecretXtn(const sslSocket *ss, TLSExtensionData *xtnData, PRBool append, + PRUint32 maxBytes); +SECStatus ssl3_HandleExtendedMasterSecretXtn(const sslSocket *ss, TLSExtensionData *xtnData, + PRUint16 ex_type, + SECItem *data); +SECStatus ssl3_ProcessSessionTicketCommon(sslSocket *ss, SECItem *data); +PRInt32 ssl3_SendServerNameXtn(const sslSocket *ss, + TLSExtensionData *xtnData, + PRBool append, + PRUint32 maxBytes); +SECStatus ssl3_HandleServerNameXtn(const sslSocket *ss, TLSExtensionData *xtnData, + PRUint16 ex_type, SECItem *data); +SECStatus ssl_HandleSupportedGroupsXtn(const sslSocket *ss, TLSExtensionData *xtnData, + PRUint16 ex_type, SECItem *data); +SECStatus ssl3_HandleSupportedPointFormatsXtn(const sslSocket *ss, TLSExtensionData *xtnData, + PRUint16 ex_type, SECItem *data); +SECStatus ssl3_ClientHandleSessionTicketXtn(const sslSocket *ss, TLSExtensionData *xtnData, + PRUint16 ex_type, SECItem *data); +SECStatus ssl3_ServerHandleSessionTicketXtn(const sslSocket *ss, TLSExtensionData *xtnData, + PRUint16 ex_type, SECItem *data); +PRInt32 ssl3_SendSessionTicketXtn(const sslSocket *ss, + TLSExtensionData *xtnData, + PRBool append, + PRUint32 maxBytes); + +PRInt32 ssl_SendSupportedGroupsXtn(const sslSocket *ss, + TLSExtensionData *xtnData, + PRBool append, PRUint32 maxBytes); +PRInt32 ssl3_SendSupportedPointFormatsXtn(const sslSocket *ss, + TLSExtensionData *xtnData, + PRBool append, PRUint32 maxBytes); +#endif diff --git a/security/nss/lib/ssl/ssl3gthr.c b/security/nss/lib/ssl/ssl3gthr.c new file mode 100644 index 000000000..2bcc1d0aa --- /dev/null +++ b/security/nss/lib/ssl/ssl3gthr.c @@ -0,0 +1,573 @@ +/* + * Gather (Read) entire SSL3 records from socket into buffer. + * + * This Source Code Form is subject to the terms of the Mozilla Public + * License, v. 2.0. If a copy of the MPL was not distributed with this + * file, You can obtain one at http://mozilla.org/MPL/2.0/. */ + +#include "cert.h" +#include "ssl.h" +#include "sslimpl.h" +#include "sslproto.h" +#include "ssl3prot.h" + +struct ssl2GatherStr { + /* true when ssl3_GatherData encounters an SSLv2 handshake */ + PRBool isV2; + + /* number of bytes of padding appended to the message content */ + PRUint8 padding; +}; + +typedef struct ssl2GatherStr ssl2Gather; + +/* Caller should hold RecvBufLock. */ +SECStatus +ssl3_InitGather(sslGather *gs) +{ + SECStatus status; + + gs->state = GS_INIT; + gs->writeOffset = 0; + gs->readOffset = 0; + gs->dtlsPacketOffset = 0; + gs->dtlsPacket.len = 0; + status = sslBuffer_Grow(&gs->buf, 4096); + return status; +} + +/* Caller must hold RecvBufLock. */ +void +ssl3_DestroyGather(sslGather *gs) +{ + if (gs) { /* the PORT_*Free functions check for NULL pointers. */ + PORT_ZFree(gs->buf.buf, gs->buf.space); + PORT_Free(gs->inbuf.buf); + PORT_Free(gs->dtlsPacket.buf); + } +} + +/* Checks whether a given buffer is likely an SSLv3 record header. */ +PRBool +ssl3_isLikelyV3Hello(const unsigned char *buf) +{ + /* Even if this was a V2 record header we couldn't possibly parse it + * correctly as the second bit denotes a vaguely-defined security escape. */ + if (buf[0] & 0x40) { + return PR_TRUE; + } + + /* Check for a typical V3 record header. */ + return (PRBool)(buf[0] >= content_change_cipher_spec && + buf[0] <= content_application_data && + buf[1] == MSB(SSL_LIBRARY_VERSION_3_0)); +} + +/* + * Attempt to read in an entire SSL3 record. + * Blocks here for blocking sockets, otherwise returns -1 with + * PR_WOULD_BLOCK_ERROR when socket would block. + * + * returns 1 if received a complete SSL3 record. + * returns 0 if recv returns EOF + * returns -1 if recv returns < 0 + * (The error value may have already been set to PR_WOULD_BLOCK_ERROR) + * + * Caller must hold the recv buf lock. + * + * The Gather state machine has 3 states: GS_INIT, GS_HEADER, GS_DATA. + * GS_HEADER: waiting for the 5-byte SSL3 record header to come in. + * GS_DATA: waiting for the body of the SSL3 record to come in. + * + * This loop returns when either + * (a) an error or EOF occurs, + * (b) PR_WOULD_BLOCK_ERROR, + * (c) data (entire SSL3 record) has been received. + */ +static int +ssl3_GatherData(sslSocket *ss, sslGather *gs, int flags, ssl2Gather *ssl2gs) +{ + unsigned char *bp; + unsigned char *lbp; + int nb; + int err; + int rv = 1; + PRUint8 v2HdrLength = 0; + + PORT_Assert(ss->opt.noLocks || ssl_HaveRecvBufLock(ss)); + if (gs->state == GS_INIT) { + gs->state = GS_HEADER; + gs->remainder = ss->ssl3.hs.shortHeaders ? 2 : 5; + gs->offset = 0; + gs->writeOffset = 0; + gs->readOffset = 0; + gs->inbuf.len = 0; + } + + lbp = gs->inbuf.buf; + for (;;) { + SSL_TRC(30, ("%d: SSL3[%d]: gather state %d (need %d more)", + SSL_GETPID(), ss->fd, gs->state, gs->remainder)); + bp = ((gs->state != GS_HEADER) ? lbp : gs->hdr) + gs->offset; + nb = ssl_DefRecv(ss, bp, gs->remainder, flags); + + if (nb > 0) { + PRINT_BUF(60, (ss, "raw gather data:", bp, nb)); + } else if (nb == 0) { + /* EOF */ + SSL_TRC(30, ("%d: SSL3[%d]: EOF", SSL_GETPID(), ss->fd)); + rv = 0; + break; + } else /* if (nb < 0) */ { + SSL_DBG(("%d: SSL3[%d]: recv error %d", SSL_GETPID(), ss->fd, + PR_GetError())); + rv = SECFailure; + break; + } + + PORT_Assert((unsigned int)nb <= gs->remainder); + if ((unsigned int)nb > gs->remainder) { + /* ssl_DefRecv is misbehaving! this error is fatal to SSL. */ + gs->state = GS_INIT; /* so we don't crash next time */ + rv = SECFailure; + break; + } + + gs->offset += nb; + gs->remainder -= nb; + if (gs->state == GS_DATA) + gs->inbuf.len += nb; + + /* if there's more to go, read some more. */ + if (gs->remainder > 0) { + continue; + } + + /* have received entire record header, or entire record. */ + switch (gs->state) { + case GS_HEADER: + /* Check for SSLv2 handshakes. Always assume SSLv3 on clients, + * support SSLv2 handshakes only when ssl2gs != NULL. */ + if (!ssl2gs || ssl3_isLikelyV3Hello(gs->hdr)) { + /* Should have a non-SSLv2 record header in gs->hdr. Extract + * the length of the following encrypted data, and then + * read in the rest of the record into gs->inbuf. */ + if (ss->ssl3.hs.shortHeaders) { + PRUint16 len = (gs->hdr[0] << 8) | gs->hdr[1]; + if (!(len & 0x8000)) { + SSL_DBG(("%d: SSL3[%d]: incorrectly formatted header")); + SSL3_SendAlert(ss, alert_fatal, illegal_parameter); + gs->state = GS_INIT; + PORT_SetError(SSL_ERROR_BAD_MAC_READ); + return SECFailure; + } + gs->remainder = len & ~0x8000; + } else { + gs->remainder = (gs->hdr[3] << 8) | gs->hdr[4]; + } + } else { + /* Probably an SSLv2 record header. No need to handle any + * security escapes (gs->hdr[0] & 0x40) as we wouldn't get + * here if one was set. See ssl3_isLikelyV3Hello(). */ + gs->remainder = ((gs->hdr[0] & 0x7f) << 8) | gs->hdr[1]; + ssl2gs->isV2 = PR_TRUE; + v2HdrLength = 2; + + /* Is it a 3-byte header with padding? */ + if (!(gs->hdr[0] & 0x80)) { + ssl2gs->padding = gs->hdr[2]; + v2HdrLength++; + } + } + + /* This is the max length for an encrypted SSLv3+ fragment. */ + if (!v2HdrLength && + gs->remainder > (MAX_FRAGMENT_LENGTH + 2048)) { + SSL3_SendAlert(ss, alert_fatal, unexpected_message); + gs->state = GS_INIT; + PORT_SetError(SSL_ERROR_RX_RECORD_TOO_LONG); + return SECFailure; + } + + gs->state = GS_DATA; + gs->offset = 0; + gs->inbuf.len = 0; + + if (gs->remainder > gs->inbuf.space) { + err = sslBuffer_Grow(&gs->inbuf, gs->remainder); + if (err) { /* realloc has set error code to no mem. */ + return err; + } + lbp = gs->inbuf.buf; + } + + /* When we encounter an SSLv2 hello we've read 2 or 3 bytes too + * many into the gs->hdr[] buffer. Copy them over into inbuf so + * that we can properly process the hello record later. */ + if (v2HdrLength) { + gs->inbuf.len = 5 - v2HdrLength; + PORT_Memcpy(lbp, gs->hdr + v2HdrLength, gs->inbuf.len); + gs->remainder -= gs->inbuf.len; + lbp += gs->inbuf.len; + } + + break; /* End this case. Continue around the loop. */ + + case GS_DATA: + /* + ** SSL3 record has been completely received. + */ + SSL_TRC(10, ("%d: SSL[%d]: got record of %d bytes", + SSL_GETPID(), ss->fd, gs->inbuf.len)); + gs->state = GS_INIT; + return 1; + } + } + + return rv; +} + +/* + * Read in an entire DTLS record. + * + * Blocks here for blocking sockets, otherwise returns -1 with + * PR_WOULD_BLOCK_ERROR when socket would block. + * + * This is simpler than SSL because we are reading on a datagram socket + * and datagrams must contain >=1 complete records. + * + * returns 1 if received a complete DTLS record. + * returns 0 if recv returns EOF + * returns -1 if recv returns < 0 + * (The error value may have already been set to PR_WOULD_BLOCK_ERROR) + * + * Caller must hold the recv buf lock. + * + * This loop returns when either + * (a) an error or EOF occurs, + * (b) PR_WOULD_BLOCK_ERROR, + * (c) data (entire DTLS record) has been received. + */ +static int +dtls_GatherData(sslSocket *ss, sslGather *gs, int flags) +{ + int nb; + int err; + int rv = 1; + + SSL_TRC(30, ("dtls_GatherData")); + + PORT_Assert(ss->opt.noLocks || ssl_HaveRecvBufLock(ss)); + + gs->state = GS_HEADER; + gs->offset = 0; + + if (gs->dtlsPacketOffset == gs->dtlsPacket.len) { /* No data left */ + gs->dtlsPacketOffset = 0; + gs->dtlsPacket.len = 0; + + /* Resize to the maximum possible size so we can fit a full datagram */ + /* This is the max fragment length for an encrypted fragment + ** plus the size of the record header. + ** This magic constant is copied from ssl3_GatherData, with 5 changed + ** to 13 (the size of the record header). + */ + if (gs->dtlsPacket.space < MAX_FRAGMENT_LENGTH + 2048 + 13) { + err = sslBuffer_Grow(&gs->dtlsPacket, + MAX_FRAGMENT_LENGTH + 2048 + 13); + if (err) { /* realloc has set error code to no mem. */ + return err; + } + } + + /* recv() needs to read a full datagram at a time */ + nb = ssl_DefRecv(ss, gs->dtlsPacket.buf, gs->dtlsPacket.space, flags); + + if (nb > 0) { + PRINT_BUF(60, (ss, "raw gather data:", gs->dtlsPacket.buf, nb)); + } else if (nb == 0) { + /* EOF */ + SSL_TRC(30, ("%d: SSL3[%d]: EOF", SSL_GETPID(), ss->fd)); + rv = 0; + return rv; + } else /* if (nb < 0) */ { + SSL_DBG(("%d: SSL3[%d]: recv error %d", SSL_GETPID(), ss->fd, + PR_GetError())); + rv = SECFailure; + return rv; + } + + gs->dtlsPacket.len = nb; + } + + /* At this point we should have >=1 complete records lined up in + * dtlsPacket. Read off the header. + */ + if ((gs->dtlsPacket.len - gs->dtlsPacketOffset) < 13) { + SSL_DBG(("%d: SSL3[%d]: rest of DTLS packet " + "too short to contain header", + SSL_GETPID(), ss->fd)); + PR_SetError(PR_WOULD_BLOCK_ERROR, 0); + gs->dtlsPacketOffset = 0; + gs->dtlsPacket.len = 0; + rv = SECFailure; + return rv; + } + memcpy(gs->hdr, gs->dtlsPacket.buf + gs->dtlsPacketOffset, 13); + gs->dtlsPacketOffset += 13; + + /* Have received SSL3 record header in gs->hdr. */ + gs->remainder = (gs->hdr[11] << 8) | gs->hdr[12]; + + if ((gs->dtlsPacket.len - gs->dtlsPacketOffset) < gs->remainder) { + SSL_DBG(("%d: SSL3[%d]: rest of DTLS packet too short " + "to contain rest of body", + SSL_GETPID(), ss->fd)); + PR_SetError(PR_WOULD_BLOCK_ERROR, 0); + gs->dtlsPacketOffset = 0; + gs->dtlsPacket.len = 0; + rv = SECFailure; + return rv; + } + + /* OK, we have at least one complete packet, copy into inbuf */ + if (gs->remainder > gs->inbuf.space) { + err = sslBuffer_Grow(&gs->inbuf, gs->remainder); + if (err) { /* realloc has set error code to no mem. */ + return err; + } + } + + memcpy(gs->inbuf.buf, gs->dtlsPacket.buf + gs->dtlsPacketOffset, + gs->remainder); + gs->inbuf.len = gs->remainder; + gs->offset = gs->remainder; + gs->dtlsPacketOffset += gs->remainder; + gs->state = GS_INIT; + + return 1; +} + +/* Gather in a record and when complete, Handle that record. + * Repeat this until the handshake is complete, + * or until application data is available. + * + * Returns 1 when the handshake is completed without error, or + * application data is available. + * Returns 0 if ssl3_GatherData hits EOF. + * Returns -1 on read error, or PR_WOULD_BLOCK_ERROR, or handleRecord error. + * Returns -2 on SECWouldBlock return from ssl3_HandleRecord. + * + * Called from ssl_GatherRecord1stHandshake in sslcon.c, + * and from SSL_ForceHandshake in sslsecur.c + * and from ssl3_GatherAppDataRecord below (<- DoRecv in sslsecur.c). + * + * Caller must hold the recv buf lock. + */ +int +ssl3_GatherCompleteHandshake(sslSocket *ss, int flags) +{ + int rv; + SSL3Ciphertext cText; + PRBool keepGoing = PR_TRUE; + + SSL_TRC(30, ("ssl3_GatherCompleteHandshake")); + + /* ssl3_HandleRecord may end up eventually calling ssl_FinishHandshake, + * which requires the 1stHandshakeLock, which must be acquired before the + * RecvBufLock. + */ + PORT_Assert(ss->opt.noLocks || ssl_Have1stHandshakeLock(ss)); + PORT_Assert(ss->opt.noLocks || ssl_HaveRecvBufLock(ss)); + + do { + PRBool handleRecordNow = PR_FALSE; + + ssl_GetSSL3HandshakeLock(ss); + + /* Without this, we may end up wrongly reporting + * SSL_ERROR_RX_UNEXPECTED_* errors if we receive any records from the + * peer while we are waiting to be restarted. + */ + if (ss->ssl3.hs.restartTarget) { + ssl_ReleaseSSL3HandshakeLock(ss); + PORT_SetError(PR_WOULD_BLOCK_ERROR); + return (int)SECFailure; + } + + /* Treat an empty msgState like a NULL msgState. (Most of the time + * when ssl3_HandleHandshake returns SECWouldBlock, it leaves + * behind a non-NULL but zero-length msgState). + * Test: async_cert_restart_server_sends_hello_request_first_in_separate_record + */ + if (ss->ssl3.hs.msgState.buf) { + if (ss->ssl3.hs.msgState.len == 0) { + ss->ssl3.hs.msgState.buf = NULL; + } else { + handleRecordNow = PR_TRUE; + } + } + + ssl_ReleaseSSL3HandshakeLock(ss); + + if (handleRecordNow) { + /* ssl3_HandleHandshake previously returned SECWouldBlock and the + * as-yet-unprocessed plaintext of that previous handshake record. + * We need to process it now before we overwrite it with the next + * handshake record. + */ + rv = ssl3_HandleRecord(ss, NULL, &ss->gs.buf); + } else { + /* State for SSLv2 client hello support. */ + ssl2Gather ssl2gs = { PR_FALSE, 0 }; + ssl2Gather *ssl2gs_ptr = NULL; + + /* If we're a server and waiting for a client hello, accept v2. */ + if (ss->sec.isServer && ss->ssl3.hs.ws == wait_client_hello) { + ssl2gs_ptr = &ssl2gs; + } + + /* bring in the next sslv3 record. */ + if (ss->recvdCloseNotify) { + /* RFC 5246 Section 7.2.1: + * Any data received after a closure alert is ignored. + */ + return 0; + } + + if (!IS_DTLS(ss)) { + /* If we're a server waiting for a ClientHello then pass + * ssl2gs to support SSLv2 ClientHello messages. */ + rv = ssl3_GatherData(ss, &ss->gs, flags, ssl2gs_ptr); + } else { + rv = dtls_GatherData(ss, &ss->gs, flags); + + /* If we got a would block error, that means that no data was + * available, so we check the timer to see if it's time to + * retransmit */ + if (rv == SECFailure && + (PORT_GetError() == PR_WOULD_BLOCK_ERROR)) { + dtls_CheckTimer(ss); + /* Restore the error in case something succeeded */ + PORT_SetError(PR_WOULD_BLOCK_ERROR); + } + } + + if (rv <= 0) { + return rv; + } + + if (ssl2gs.isV2) { + rv = ssl3_HandleV2ClientHello(ss, ss->gs.inbuf.buf, + ss->gs.inbuf.len, + ssl2gs.padding); + if (rv < 0) { + return rv; + } + } else { + /* decipher it, and handle it if it's a handshake. + * If it's application data, ss->gs.buf will not be empty upon return. + * If it's a change cipher spec, alert, or handshake message, + * ss->gs.buf.len will be 0 when ssl3_HandleRecord returns SECSuccess. + */ + if (ss->ssl3.hs.shortHeaders) { + cText.type = content_application_data; + cText.version = SSL_LIBRARY_VERSION_TLS_1_0; + } else { + cText.type = (SSL3ContentType)ss->gs.hdr[0]; + cText.version = (ss->gs.hdr[1] << 8) | ss->gs.hdr[2]; + } + + if (IS_DTLS(ss)) { + sslSequenceNumber seq_num; + + cText.version = dtls_DTLSVersionToTLSVersion(cText.version); + /* DTLS sequence number */ + PORT_Memcpy(&seq_num, &ss->gs.hdr[3], sizeof(seq_num)); + cText.seq_num = PR_ntohll(seq_num); + } + + cText.buf = &ss->gs.inbuf; + rv = ssl3_HandleRecord(ss, &cText, &ss->gs.buf); + } + } + if (rv < 0) { + return ss->recvdCloseNotify ? 0 : rv; + } + if (ss->gs.buf.len > 0) { + /* We have application data to return to the application. This + * prioritizes returning application data to the application over + * completing any renegotiation handshake we may be doing. + */ + PORT_Assert(ss->firstHsDone); + PORT_Assert(cText.type == content_application_data); + break; + } + + PORT_Assert(keepGoing); + ssl_GetSSL3HandshakeLock(ss); + if (ss->ssl3.hs.ws == idle_handshake) { + /* We are done with the current handshake so stop trying to + * handshake. Note that it would be safe to test ss->firstHsDone + * instead of ss->ssl3.hs.ws. By testing ss->ssl3.hs.ws instead, + * we prioritize completing a renegotiation handshake over sending + * application data. + */ + PORT_Assert(ss->firstHsDone); + PORT_Assert(!ss->ssl3.hs.canFalseStart); + keepGoing = PR_FALSE; + } else if (ss->ssl3.hs.canFalseStart) { + /* Prioritize sending application data over trying to complete + * the handshake if we're false starting. + * + * If we were to do this check at the beginning of the loop instead + * of here, then this function would become be a no-op after + * receiving the ServerHelloDone in the false start case, and we + * would never complete the handshake. + */ + PORT_Assert(!ss->firstHsDone); + + if (ssl3_WaitingForServerSecondRound(ss)) { + keepGoing = PR_FALSE; + } else { + ss->ssl3.hs.canFalseStart = PR_FALSE; + } + } + ssl_ReleaseSSL3HandshakeLock(ss); + } while (keepGoing); + + /* Service the DTLS timer so that the holddown timer eventually fires. */ + if (IS_DTLS(ss)) { + dtls_CheckTimer(ss); + } + ss->gs.readOffset = 0; + ss->gs.writeOffset = ss->gs.buf.len; + return 1; +} + +/* Repeatedly gather in a record and when complete, Handle that record. + * Repeat this until some application data is received. + * + * Returns 1 when application data is available. + * Returns 0 if ssl3_GatherData hits EOF. + * Returns -1 on read error, or PR_WOULD_BLOCK_ERROR, or handleRecord error. + * Returns -2 on SECWouldBlock return from ssl3_HandleRecord. + * + * Called from DoRecv in sslsecur.c + * Caller must hold the recv buf lock. + */ +int +ssl3_GatherAppDataRecord(sslSocket *ss, int flags) +{ + int rv; + + /* ssl3_GatherCompleteHandshake requires both of these locks. */ + PORT_Assert(ss->opt.noLocks || ssl_Have1stHandshakeLock(ss)); + PORT_Assert(ss->opt.noLocks || ssl_HaveRecvBufLock(ss)); + + do { + rv = ssl3_GatherCompleteHandshake(ss, flags); + } while (rv > 0 && ss->gs.buf.len == 0); + + return rv; +} diff --git a/security/nss/lib/ssl/ssl3prot.h b/security/nss/lib/ssl/ssl3prot.h new file mode 100644 index 000000000..35c7e547d --- /dev/null +++ b/security/nss/lib/ssl/ssl3prot.h @@ -0,0 +1,331 @@ +/* -*- Mode: C; tab-width: 8; indent-tabs-mode: nil; c-basic-offset: 4 -*- */ +/* Private header file of libSSL. + * Various and sundry protocol constants. DON'T CHANGE THESE. These + * values are defined by the SSL 3.0 protocol specification. + * + * This Source Code Form is subject to the terms of the Mozilla Public + * License, v. 2.0. If a copy of the MPL was not distributed with this + * file, You can obtain one at http://mozilla.org/MPL/2.0/. */ + +#ifndef __ssl3proto_h_ +#define __ssl3proto_h_ + +typedef PRUint8 SSL3Opaque; + +typedef PRUint16 SSL3ProtocolVersion; +/* version numbers are defined in sslproto.h */ + +/* The TLS 1.3 draft version. Used to avoid negotiating + * between incompatible pre-standard TLS 1.3 drafts. + * TODO(ekr@rtfm.com): Remove when TLS 1.3 is published. */ +#define TLS_1_3_DRAFT_VERSION 18 + +typedef PRUint16 ssl3CipherSuite; +/* The cipher suites are defined in sslproto.h */ + +#define MAX_CERT_TYPES 10 +#define MAX_COMPRESSION_METHODS 10 +#define MAX_MAC_LENGTH 64 +#define MAX_PADDING_LENGTH 64 +#define MAX_KEY_LENGTH 64 +#define EXPORT_KEY_LENGTH 5 +#define SSL3_RANDOM_LENGTH 32 + +#define SSL3_RECORD_HEADER_LENGTH 5 +#define TLS13_RECORD_HEADER_LENGTH_SHORT 2 + +/* SSL3_RECORD_HEADER_LENGTH + epoch/sequence_number */ +#define DTLS_RECORD_HEADER_LENGTH 13 + +#define MAX_FRAGMENT_LENGTH 16384 + +typedef enum { + content_change_cipher_spec = 20, + content_alert = 21, + content_handshake = 22, + content_application_data = 23 +} SSL3ContentType; + +typedef struct { + SSL3ContentType type; + SSL3ProtocolVersion version; + PRUint16 length; + SECItem fragment; +} SSL3Plaintext; + +typedef struct { + SSL3ContentType type; + SSL3ProtocolVersion version; + PRUint16 length; + SECItem fragment; +} SSL3Compressed; + +typedef struct { + SECItem content; + SSL3Opaque MAC[MAX_MAC_LENGTH]; +} SSL3GenericStreamCipher; + +typedef struct { + SECItem content; + SSL3Opaque MAC[MAX_MAC_LENGTH]; + PRUint8 padding[MAX_PADDING_LENGTH]; + PRUint8 padding_length; +} SSL3GenericBlockCipher; + +typedef enum { change_cipher_spec_choice = 1 } SSL3ChangeCipherSpecChoice; + +typedef struct { + SSL3ChangeCipherSpecChoice choice; +} SSL3ChangeCipherSpec; + +typedef enum { alert_warning = 1, + alert_fatal = 2 } SSL3AlertLevel; + +typedef enum { + close_notify = 0, + end_of_early_data = 1, /* TLS 1.3 */ + unexpected_message = 10, + bad_record_mac = 20, + decryption_failed_RESERVED = 21, /* do not send; see RFC 5246 */ + record_overflow = 22, /* TLS only */ + decompression_failure = 30, + handshake_failure = 40, + no_certificate = 41, /* SSL3 only, NOT TLS */ + bad_certificate = 42, + unsupported_certificate = 43, + certificate_revoked = 44, + certificate_expired = 45, + certificate_unknown = 46, + illegal_parameter = 47, + + /* All alerts below are TLS only. */ + unknown_ca = 48, + access_denied = 49, + decode_error = 50, + decrypt_error = 51, + export_restriction = 60, + protocol_version = 70, + insufficient_security = 71, + internal_error = 80, + inappropriate_fallback = 86, /* could also be sent for SSLv3 */ + user_canceled = 90, + no_renegotiation = 100, + + /* Alerts for client hello extensions */ + missing_extension = 109, + unsupported_extension = 110, + certificate_unobtainable = 111, + unrecognized_name = 112, + bad_certificate_status_response = 113, + bad_certificate_hash_value = 114, + no_application_protocol = 120, + + /* invalid alert */ + no_alert = 256 +} SSL3AlertDescription; + +typedef struct { + SSL3AlertLevel level; + SSL3AlertDescription description; +} SSL3Alert; + +typedef enum { + hello_request = 0, + client_hello = 1, + server_hello = 2, + hello_verify_request = 3, + new_session_ticket = 4, + hello_retry_request = 6, + encrypted_extensions = 8, + certificate = 11, + server_key_exchange = 12, + certificate_request = 13, + server_hello_done = 14, + certificate_verify = 15, + client_key_exchange = 16, + finished = 20, + certificate_status = 22, + next_proto = 67 +} SSL3HandshakeType; + +typedef struct { + PRUint8 empty; +} SSL3HelloRequest; + +typedef struct { + SSL3Opaque rand[SSL3_RANDOM_LENGTH]; +} SSL3Random; + +typedef struct { + SSL3Opaque id[32]; + PRUint8 length; +} SSL3SessionID; + +typedef struct { + SSL3ProtocolVersion client_version; + SSL3Random random; + SSL3SessionID session_id; + SECItem cipher_suites; + PRUint8 cm_count; + SSLCompressionMethod compression_methods[MAX_COMPRESSION_METHODS]; +} SSL3ClientHello; + +typedef struct { + SSL3ProtocolVersion server_version; + SSL3Random random; + SSL3SessionID session_id; + ssl3CipherSuite cipher_suite; + SSLCompressionMethod compression_method; +} SSL3ServerHello; + +typedef struct { + SECItem list; +} SSL3Certificate; + +/* SSL3SignType moved to ssl.h */ + +/* The SSL key exchange method used */ +typedef enum { + kea_null, + kea_rsa, + kea_dh_dss, + kea_dh_rsa, + kea_dhe_dss, + kea_dhe_rsa, + kea_dh_anon, + kea_ecdh_ecdsa, + kea_ecdhe_ecdsa, + kea_ecdh_rsa, + kea_ecdhe_rsa, + kea_ecdh_anon, + kea_ecdhe_psk, + kea_dhe_psk, + kea_tls13_any, +} SSL3KeyExchangeAlgorithm; + +typedef struct { + SECItem modulus; + SECItem exponent; +} SSL3ServerRSAParams; + +typedef struct { + SECItem p; + SECItem g; + SECItem Ys; +} SSL3ServerDHParams; + +typedef struct { + union { + SSL3ServerDHParams dh; + SSL3ServerRSAParams rsa; + } u; +} SSL3ServerParams; + +/* SSL3HashesIndividually contains a combination MD5/SHA1 hash, as used in TLS + * prior to 1.2. */ +typedef struct { + PRUint8 md5[16]; + PRUint8 sha[20]; +} SSL3HashesIndividually; + +/* SSL3Hashes contains an SSL hash value. The digest is contained in |u.raw| + * which, if |hashAlg==ssl_hash_none| is also a SSL3HashesIndividually + * struct. */ +typedef struct { + unsigned int len; + SSLHashType hashAlg; + union { + PRUint8 raw[64]; + SSL3HashesIndividually s; + unsigned int transcriptLen; + } u; +} SSL3Hashes; + +typedef struct { + union { + SSL3Opaque anonymous; + SSL3Hashes certified; + } u; +} SSL3ServerKeyExchange; + +typedef enum { + ct_RSA_sign = 1, + ct_DSS_sign = 2, + ct_RSA_fixed_DH = 3, + ct_DSS_fixed_DH = 4, + ct_RSA_ephemeral_DH = 5, + ct_DSS_ephemeral_DH = 6, + ct_ECDSA_sign = 64, + ct_RSA_fixed_ECDH = 65, + ct_ECDSA_fixed_ECDH = 66 + +} SSL3ClientCertificateType; + +typedef struct { + SSL3Opaque client_version[2]; + SSL3Opaque random[46]; +} SSL3RSAPreMasterSecret; + +typedef SSL3Opaque SSL3MasterSecret[48]; + +typedef enum { + sender_client = 0x434c4e54, + sender_server = 0x53525652 +} SSL3Sender; + +typedef SSL3HashesIndividually SSL3Finished; + +typedef struct { + SSL3Opaque verify_data[12]; +} TLSFinished; + +/* + * TLS extension related data structures and constants. + */ + +/* SessionTicket extension related data structures. */ + +/* NewSessionTicket handshake message. */ +typedef struct { + PRUint32 received_timestamp; + PRUint32 ticket_lifetime_hint; + PRUint32 flags; + PRUint32 ticket_age_add; + PRUint32 max_early_data_size; + SECItem ticket; +} NewSessionTicket; + +typedef enum { + tls13_psk_ke = 0, + tls13_psk_dh_ke = 1 +} TLS13PskKEModes; + +typedef enum { + CLIENT_AUTH_ANONYMOUS = 0, + CLIENT_AUTH_CERTIFICATE = 1 +} ClientAuthenticationType; + +typedef struct { + ClientAuthenticationType client_auth_type; + union { + SSL3Opaque *certificate_list; + } identity; +} ClientIdentity; + +#define SESS_TICKET_KEY_NAME_LEN 16 +#define SESS_TICKET_KEY_NAME_PREFIX "NSS!" +#define SESS_TICKET_KEY_NAME_PREFIX_LEN 4 +#define SESS_TICKET_KEY_VAR_NAME_LEN 12 + +typedef struct { + unsigned char *key_name; + unsigned char *iv; + SECItem encrypted_state; + unsigned char *mac; +} EncryptedSessionTicket; + +#define TLS_EX_SESS_TICKET_MAC_LENGTH 32 + +#define TLS_STE_NO_SERVER_NAME -1 + +#endif /* __ssl3proto_h_ */ diff --git a/security/nss/lib/ssl/sslauth.c b/security/nss/lib/ssl/sslauth.c new file mode 100644 index 000000000..5b5f672f0 --- /dev/null +++ b/security/nss/lib/ssl/sslauth.c @@ -0,0 +1,292 @@ +/* -*- Mode: C; tab-width: 8; indent-tabs-mode: nil; c-basic-offset: 4 -*- */ +/* This Source Code Form is subject to the terms of the Mozilla Public + * License, v. 2.0. If a copy of the MPL was not distributed with this + * file, You can obtain one at http://mozilla.org/MPL/2.0/. */ +#include "cert.h" +#include "secitem.h" +#include "ssl.h" +#include "sslimpl.h" +#include "sslproto.h" +#include "pk11func.h" +#include "ocsp.h" + +/* NEED LOCKS IN HERE. */ +CERTCertificate * +SSL_PeerCertificate(PRFileDesc *fd) +{ + sslSocket *ss; + + ss = ssl_FindSocket(fd); + if (!ss) { + SSL_DBG(("%d: SSL[%d]: bad socket in PeerCertificate", + SSL_GETPID(), fd)); + return 0; + } + if (ss->opt.useSecurity && ss->sec.peerCert) { + return CERT_DupCertificate(ss->sec.peerCert); + } + return 0; +} + +/* NEED LOCKS IN HERE. */ +CERTCertList * +SSL_PeerCertificateChain(PRFileDesc *fd) +{ + sslSocket *ss; + CERTCertList *chain = NULL; + CERTCertificate *cert; + ssl3CertNode *cur; + + ss = ssl_FindSocket(fd); + if (!ss) { + SSL_DBG(("%d: SSL[%d]: bad socket in PeerCertificateChain", + SSL_GETPID(), fd)); + return NULL; + } + if (!ss->opt.useSecurity || !ss->sec.peerCert) { + PORT_SetError(SSL_ERROR_NO_CERTIFICATE); + return NULL; + } + chain = CERT_NewCertList(); + if (!chain) { + return NULL; + } + cert = CERT_DupCertificate(ss->sec.peerCert); + if (CERT_AddCertToListTail(chain, cert) != SECSuccess) { + goto loser; + } + for (cur = ss->ssl3.peerCertChain; cur; cur = cur->next) { + cert = CERT_DupCertificate(cur->cert); + if (CERT_AddCertToListTail(chain, cert) != SECSuccess) { + goto loser; + } + } + return chain; + +loser: + CERT_DestroyCertList(chain); + return NULL; +} + +/* NEED LOCKS IN HERE. */ +CERTCertificate * +SSL_LocalCertificate(PRFileDesc *fd) +{ + sslSocket *ss; + + ss = ssl_FindSocket(fd); + if (!ss) { + SSL_DBG(("%d: SSL[%d]: bad socket in PeerCertificate", + SSL_GETPID(), fd)); + return NULL; + } + if (ss->opt.useSecurity) { + if (ss->sec.localCert) { + return CERT_DupCertificate(ss->sec.localCert); + } + if (ss->sec.ci.sid && ss->sec.ci.sid->localCert) { + return CERT_DupCertificate(ss->sec.ci.sid->localCert); + } + } + return NULL; +} + +/* NEED LOCKS IN HERE. */ +SECStatus +SSL_SecurityStatus(PRFileDesc *fd, int *op, char **cp, int *kp0, int *kp1, + char **ip, char **sp) +{ + sslSocket *ss; + + ss = ssl_FindSocket(fd); + if (!ss) { + SSL_DBG(("%d: SSL[%d]: bad socket in SecurityStatus", + SSL_GETPID(), fd)); + return SECFailure; + } + + if (cp) + *cp = 0; + if (kp0) + *kp0 = 0; + if (kp1) + *kp1 = 0; + if (ip) + *ip = 0; + if (sp) + *sp = 0; + if (op) { + *op = SSL_SECURITY_STATUS_OFF; + } + + if (ss->opt.useSecurity && ss->enoughFirstHsDone) { + const ssl3BulkCipherDef *bulkCipherDef; + PRBool isDes = PR_FALSE; + + bulkCipherDef = ssl_GetBulkCipherDef(ss->ssl3.hs.suite_def); + if (cp) { + *cp = PORT_Strdup(bulkCipherDef->short_name); + } + if (PORT_Strstr(bulkCipherDef->short_name, "DES")) { + isDes = PR_TRUE; + } + + if (kp0) { + *kp0 = bulkCipherDef->key_size * 8; + if (isDes) + *kp0 = (*kp0 * 7) / 8; + } + if (kp1) { + *kp1 = bulkCipherDef->secret_key_size * 8; + if (isDes) + *kp1 = (*kp1 * 7) / 8; + } + if (op) { + if (bulkCipherDef->key_size == 0) { + *op = SSL_SECURITY_STATUS_OFF; + } else if (bulkCipherDef->secret_key_size * 8 < 90) { + *op = SSL_SECURITY_STATUS_ON_LOW; + } else { + *op = SSL_SECURITY_STATUS_ON_HIGH; + } + } + + if (ip || sp) { + CERTCertificate *cert; + + cert = ss->sec.peerCert; + if (cert) { + if (ip) { + *ip = CERT_NameToAscii(&cert->issuer); + } + if (sp) { + *sp = CERT_NameToAscii(&cert->subject); + } + } else { + if (ip) { + *ip = PORT_Strdup("no certificate"); + } + if (sp) { + *sp = PORT_Strdup("no certificate"); + } + } + } + } + + return SECSuccess; +} + +/************************************************************************/ + +/* NEED LOCKS IN HERE. */ +SECStatus +SSL_AuthCertificateHook(PRFileDesc *s, SSLAuthCertificate func, void *arg) +{ + sslSocket *ss; + + ss = ssl_FindSocket(s); + if (!ss) { + SSL_DBG(("%d: SSL[%d]: bad socket in AuthCertificateHook", + SSL_GETPID(), s)); + return SECFailure; + } + + ss->authCertificate = func; + ss->authCertificateArg = arg; + + return SECSuccess; +} + +/* NEED LOCKS IN HERE. */ +SECStatus +SSL_GetClientAuthDataHook(PRFileDesc *s, SSLGetClientAuthData func, + void *arg) +{ + sslSocket *ss; + + ss = ssl_FindSocket(s); + if (!ss) { + SSL_DBG(("%d: SSL[%d]: bad socket in GetClientAuthDataHook", + SSL_GETPID(), s)); + return SECFailure; + } + + ss->getClientAuthData = func; + ss->getClientAuthDataArg = arg; + return SECSuccess; +} + +/* NEED LOCKS IN HERE. */ +SECStatus +SSL_SetPKCS11PinArg(PRFileDesc *s, void *arg) +{ + sslSocket *ss; + + ss = ssl_FindSocket(s); + if (!ss) { + SSL_DBG(("%d: SSL[%d]: bad socket in GetClientAuthDataHook", + SSL_GETPID(), s)); + return SECFailure; + } + + ss->pkcs11PinArg = arg; + return SECSuccess; +} + +/* This is the "default" authCert callback function. It is called when a + * certificate message is received from the peer and the local application + * has not registered an authCert callback function. + */ +SECStatus +SSL_AuthCertificate(void *arg, PRFileDesc *fd, PRBool checkSig, PRBool isServer) +{ + SECStatus rv; + CERTCertDBHandle *handle; + sslSocket *ss; + SECCertUsage certUsage; + const char *hostname = NULL; + PRTime now = PR_Now(); + SECItemArray *certStatusArray; + + ss = ssl_FindSocket(fd); + PORT_Assert(ss != NULL); + if (!ss) { + return SECFailure; + } + + handle = (CERTCertDBHandle *)arg; + certStatusArray = &ss->sec.ci.sid->peerCertStatus; + + if (certStatusArray->len) { + PORT_SetError(0); + if (CERT_CacheOCSPResponseFromSideChannel(handle, ss->sec.peerCert, now, + &certStatusArray->items[0], + ss->pkcs11PinArg) != + SECSuccess) { + PORT_Assert(PR_GetError() != 0); + } + } + + /* this may seem backwards, but isn't. */ + certUsage = isServer ? certUsageSSLClient : certUsageSSLServer; + + rv = CERT_VerifyCert(handle, ss->sec.peerCert, checkSig, certUsage, + now, ss->pkcs11PinArg, NULL); + + if (rv != SECSuccess || isServer) + return rv; + + /* cert is OK. This is the client side of an SSL connection. + * Now check the name field in the cert against the desired hostname. + * NB: This is our only defense against Man-In-The-Middle (MITM) attacks! + */ + hostname = ss->url; + if (hostname && hostname[0]) + rv = CERT_VerifyCertName(ss->sec.peerCert, hostname); + else + rv = SECFailure; + if (rv != SECSuccess) + PORT_SetError(SSL_ERROR_BAD_CERT_DOMAIN); + + return rv; +} diff --git a/security/nss/lib/ssl/sslcert.c b/security/nss/lib/ssl/sslcert.c new file mode 100644 index 000000000..ea524552d --- /dev/null +++ b/security/nss/lib/ssl/sslcert.c @@ -0,0 +1,992 @@ +/* -*- Mode: C; tab-width: 8; indent-tabs-mode: nil; c-basic-offset: 4 -*- */ +/* + * SSL server certificate configuration functions. + * + * This Source Code Form is subject to the terms of the Mozilla Public + * License, v. 2.0. If a copy of the MPL was not distributed with this + * file, You can obtain one at http://mozilla.org/MPL/2.0/. */ + +#include "ssl.h" +#include "sslimpl.h" +#include "secoid.h" /* for SECOID_GetAlgorithmTag */ +#include "pk11func.h" /* for PK11_ReferenceSlot */ +#include "nss.h" /* for NSS_RegisterShutdown */ +#include "prinit.h" /* for PR_CallOnceWithArg */ + +static const PRCallOnceType pristineCallOnce; +static PRCallOnceType setupServerCAListOnce; + +static SECStatus +serverCAListShutdown(void *appData, void *nssData) +{ + PORT_Assert(ssl3_server_ca_list); + if (ssl3_server_ca_list) { + CERT_FreeDistNames(ssl3_server_ca_list); + ssl3_server_ca_list = NULL; + } + setupServerCAListOnce = pristineCallOnce; + return SECSuccess; +} + +static PRStatus +serverCAListSetup(void *arg) +{ + CERTCertDBHandle *dbHandle = (CERTCertDBHandle *)arg; + SECStatus rv = NSS_RegisterShutdown(serverCAListShutdown, NULL); + PORT_Assert(SECSuccess == rv); + if (SECSuccess == rv) { + ssl3_server_ca_list = CERT_GetSSLCACerts(dbHandle); + return PR_SUCCESS; + } + return PR_FAILURE; +} + +sslServerCert * +ssl_NewServerCert(const sslServerCertType *certType) +{ + sslServerCert *sc = PORT_ZNew(sslServerCert); + if (!sc) { + return NULL; + } + memcpy(&sc->certType, certType, sizeof(sc->certType)); + sc->serverCert = NULL; + sc->serverCertChain = NULL; + sc->certStatusArray = NULL; + sc->signedCertTimestamps.len = 0; + return sc; +} + +sslServerCert * +ssl_CopyServerCert(const sslServerCert *oc) +{ + sslServerCert *sc; + + sc = ssl_NewServerCert(&oc->certType); + if (!sc) { + return NULL; + } + + if (oc->serverCert && oc->serverCertChain) { + sc->serverCert = CERT_DupCertificate(oc->serverCert); + if (!sc->serverCert) + goto loser; + sc->serverCertChain = CERT_DupCertList(oc->serverCertChain); + if (!sc->serverCertChain) + goto loser; + } else { + sc->serverCert = NULL; + sc->serverCertChain = NULL; + } + + if (oc->serverKeyPair) { + sc->serverKeyPair = ssl_GetKeyPairRef(oc->serverKeyPair); + if (!sc->serverKeyPair) + goto loser; + } else { + sc->serverKeyPair = NULL; + } + sc->serverKeyBits = oc->serverKeyBits; + + if (oc->certStatusArray) { + sc->certStatusArray = SECITEM_DupArray(NULL, oc->certStatusArray); + if (!sc->certStatusArray) + goto loser; + } else { + sc->certStatusArray = NULL; + } + + if (SECITEM_CopyItem(NULL, &sc->signedCertTimestamps, + &oc->signedCertTimestamps) != SECSuccess) + goto loser; + return sc; +loser: + ssl_FreeServerCert(sc); + return NULL; +} + +void +ssl_FreeServerCert(sslServerCert *sc) +{ + if (!sc) { + return; + } + + if (sc->serverCert) { + CERT_DestroyCertificate(sc->serverCert); + } + if (sc->serverCertChain) { + CERT_DestroyCertificateList(sc->serverCertChain); + } + if (sc->serverKeyPair) { + ssl_FreeKeyPair(sc->serverKeyPair); + } + if (sc->certStatusArray) { + SECITEM_FreeArray(sc->certStatusArray, PR_TRUE); + } + if (sc->signedCertTimestamps.len) { + SECITEM_FreeItem(&sc->signedCertTimestamps, PR_FALSE); + } + PORT_ZFree(sc, sizeof(*sc)); +} + +sslServerCert * +ssl_FindServerCert(const sslSocket *ss, + const sslServerCertType *certType) +{ + PRCList *cursor; + + for (cursor = PR_NEXT_LINK(&ss->serverCerts); + cursor != &ss->serverCerts; + cursor = PR_NEXT_LINK(cursor)) { + sslServerCert *cert = (sslServerCert *)cursor; + if (cert->certType.authType != certType->authType) { + continue; + } + switch (cert->certType.authType) { + case ssl_auth_ecdsa: + case ssl_auth_ecdh_rsa: + case ssl_auth_ecdh_ecdsa: + /* Note: For deprecated APIs, we need to be able to find and + match a slot with any named curve. */ + if (certType->namedCurve && + cert->certType.namedCurve != certType->namedCurve) { + continue; + } + break; + default: + break; + } + return cert; + } + return NULL; +} + +sslServerCert * +ssl_FindServerCertByAuthType(const sslSocket *ss, SSLAuthType authType) +{ + sslServerCertType certType; + certType.authType = authType; + /* Setting the named curve to NULL ensures that all EC certificates + * are matched when searching for this slot. */ + certType.namedCurve = NULL; + return ssl_FindServerCert(ss, &certType); +} + +SECStatus +ssl_OneTimeCertSetup(sslSocket *ss, const sslServerCert *sc) +{ + if (PR_SUCCESS != PR_CallOnceWithArg(&setupServerCAListOnce, + &serverCAListSetup, + (void *)(ss->dbHandle))) { + return SECFailure; + } + return SECSuccess; +} + +/* Determine which slot a certificate fits into. SSLAuthType is known, but + * extra information needs to be worked out from the cert and key. */ +static void +ssl_PopulateCertType(sslServerCertType *certType, SSLAuthType authType, + CERTCertificate *cert, sslKeyPair *keyPair) +{ + certType->authType = authType; + switch (authType) { + case ssl_auth_ecdsa: + case ssl_auth_ecdh_rsa: + case ssl_auth_ecdh_ecdsa: + certType->namedCurve = ssl_ECPubKey2NamedGroup(keyPair->pubKey); + break; + default: + break; + } +} + +static SECStatus +ssl_PopulateServerCert(sslServerCert *sc, CERTCertificate *cert, + const CERTCertificateList *certChain) +{ + if (sc->serverCert) { + CERT_DestroyCertificate(sc->serverCert); + } + if (sc->serverCertChain) { + CERT_DestroyCertificateList(sc->serverCertChain); + } + + if (!cert) { + sc->serverCert = NULL; + sc->serverCertChain = NULL; + return SECSuccess; + } + + sc->serverCert = CERT_DupCertificate(cert); + if (certChain) { + sc->serverCertChain = CERT_DupCertList(certChain); + } else { + sc->serverCertChain = + CERT_CertChainFromCert(sc->serverCert, certUsageSSLServer, + PR_TRUE); + } + return sc->serverCertChain ? SECSuccess : SECFailure; +} + +static SECStatus +ssl_PopulateKeyPair(sslServerCert *sc, sslKeyPair *keyPair) +{ + /* Copy over the key pair. */ + if (sc->serverKeyPair) { + ssl_FreeKeyPair(sc->serverKeyPair); + } + if (keyPair) { + /* Get the size of the cert's public key, and remember it. */ + sc->serverKeyBits = SECKEY_PublicKeyStrengthInBits(keyPair->pubKey); + if (sc->serverKeyBits == 0) { + return SECFailure; + } + + SECKEY_CacheStaticFlags(keyPair->privKey); + sc->serverKeyPair = ssl_GetKeyPairRef(keyPair); + } else { + sc->serverKeyPair = NULL; + } + return SECSuccess; +} + +static SECStatus +ssl_PopulateOCSPResponses(sslServerCert *sc, + const SECItemArray *stapledOCSPResponses) +{ + if (sc->certStatusArray) { + SECITEM_FreeArray(sc->certStatusArray, PR_TRUE); + } + if (stapledOCSPResponses) { + sc->certStatusArray = SECITEM_DupArray(NULL, stapledOCSPResponses); + return sc->certStatusArray ? SECSuccess : SECFailure; + } else { + sc->certStatusArray = NULL; + } + return SECSuccess; +} + +static SECStatus +ssl_PopulateSignedCertTimestamps(sslServerCert *sc, + const SECItem *signedCertTimestamps) +{ + if (sc->signedCertTimestamps.len) { + SECITEM_FreeItem(&sc->signedCertTimestamps, PR_FALSE); + } + if (signedCertTimestamps && signedCertTimestamps->len) { + return SECITEM_CopyItem(NULL, &sc->signedCertTimestamps, + signedCertTimestamps); + } + return SECSuccess; +} + +static SECStatus +ssl_ConfigCert(sslSocket *ss, CERTCertificate *cert, + sslKeyPair *keyPair, const SSLExtraServerCertData *data) +{ + sslServerCert *oldsc; + sslServerCertType certType; + SECStatus rv; + sslServerCert *sc = NULL; + int error_code = SEC_ERROR_NO_MEMORY; + + PORT_Assert(cert); + PORT_Assert(keyPair); + PORT_Assert(data); + PORT_Assert(data->authType != ssl_auth_null); + + if (!cert || !keyPair || !data || data->authType == ssl_auth_null) { + error_code = SEC_ERROR_INVALID_ARGS; + goto loser; + } + + ssl_PopulateCertType(&certType, data->authType, cert, keyPair); + + /* Delete any existing certificate that matches this one, since we can only + * use one certificate of a given type. */ + oldsc = ssl_FindServerCert(ss, &certType); + if (oldsc) { + PR_REMOVE_LINK(&oldsc->link); + ssl_FreeServerCert(oldsc); + } + sc = ssl_NewServerCert(&certType); + if (!sc) { + goto loser; + } + + rv = ssl_PopulateServerCert(sc, cert, data->certChain); + if (rv != SECSuccess) { + goto loser; + } + rv = ssl_PopulateKeyPair(sc, keyPair); + if (rv != SECSuccess) { + error_code = SEC_ERROR_INVALID_ARGS; + goto loser; + } + rv = ssl_PopulateOCSPResponses(sc, data->stapledOCSPResponses); + if (rv != SECSuccess) { + goto loser; + } + rv = ssl_PopulateSignedCertTimestamps(sc, data->signedCertTimestamps); + if (rv != SECSuccess) { + goto loser; + } + PR_APPEND_LINK(&sc->link, &ss->serverCerts); + + /* This one-time setup depends on having the certificate in place. */ + rv = ssl_OneTimeCertSetup(ss, sc); + if (rv != SECSuccess) { + PR_REMOVE_LINK(&sc->link); + error_code = PORT_GetError(); + goto loser; + } + return SECSuccess; + +loser: + if (sc) { + ssl_FreeServerCert(sc); + } + /* This is the only way any of the calls above can fail, except the one time + * setup, which doesn't land here. */ + PORT_SetError(error_code); + return SECFailure; +} + +static SSLAuthType +ssl_GetEcdhAuthType(CERTCertificate *cert) +{ + SECOidTag sigTag = SECOID_GetAlgorithmTag(&cert->signature); + switch (sigTag) { + case SEC_OID_PKCS1_RSA_ENCRYPTION: + case SEC_OID_PKCS1_RSA_PSS_SIGNATURE: + case SEC_OID_PKCS1_MD2_WITH_RSA_ENCRYPTION: + case SEC_OID_PKCS1_MD4_WITH_RSA_ENCRYPTION: + case SEC_OID_PKCS1_MD5_WITH_RSA_ENCRYPTION: + case SEC_OID_PKCS1_SHA1_WITH_RSA_ENCRYPTION: + case SEC_OID_PKCS1_SHA224_WITH_RSA_ENCRYPTION: + case SEC_OID_PKCS1_SHA256_WITH_RSA_ENCRYPTION: + case SEC_OID_PKCS1_SHA384_WITH_RSA_ENCRYPTION: + case SEC_OID_PKCS1_SHA512_WITH_RSA_ENCRYPTION: + return ssl_auth_ecdh_rsa; + case SEC_OID_ANSIX962_ECDSA_SHA1_SIGNATURE: + case SEC_OID_ANSIX962_ECDSA_SHA224_SIGNATURE: + case SEC_OID_ANSIX962_ECDSA_SHA256_SIGNATURE: + case SEC_OID_ANSIX962_ECDSA_SHA384_SIGNATURE: + case SEC_OID_ANSIX962_ECDSA_SHA512_SIGNATURE: + case SEC_OID_ANSIX962_ECDSA_SIGNATURE_RECOMMENDED_DIGEST: + case SEC_OID_ANSIX962_ECDSA_SIGNATURE_SPECIFIED_DIGEST: + return ssl_auth_ecdh_ecdsa; + default: + return ssl_auth_null; + } +} + +/* This function examines the key usages of the given RSA-PKCS1 certificate + * and configures one or multiple server certificates based on that data. + * + * If the data argument contains an authType value other than ssl_auth_null, + * then only that slot will be used. If that choice is invalid, + * then this will fail. */ +static SECStatus +ssl_ConfigRsaPkcs1CertByUsage(sslSocket *ss, CERTCertificate *cert, + sslKeyPair *keyPair, + SSLExtraServerCertData *data) +{ + SECStatus rv = SECFailure; + + PRBool ku_sig = (PRBool)(cert->keyUsage & KU_DIGITAL_SIGNATURE); + PRBool ku_enc = (PRBool)(cert->keyUsage & KU_KEY_ENCIPHERMENT); + + if ((data->authType == ssl_auth_rsa_sign && ku_sig) || + (data->authType == ssl_auth_rsa_pss && ku_sig) || + (data->authType == ssl_auth_rsa_decrypt && ku_enc)) { + return ssl_ConfigCert(ss, cert, keyPair, data); + } + + if (data->authType != ssl_auth_null || !(ku_sig || ku_enc)) { + PORT_SetError(SEC_ERROR_INVALID_ARGS); + return SECFailure; + } + + if (ku_sig) { + data->authType = ssl_auth_rsa_sign; + rv = ssl_ConfigCert(ss, cert, keyPair, data); + if (rv != SECSuccess) { + return rv; + } + + /* This certificate is RSA, assume that it's also PSS. */ + data->authType = ssl_auth_rsa_pss; + rv = ssl_ConfigCert(ss, cert, keyPair, data); + if (rv != SECSuccess) { + return rv; + } + } + + if (ku_enc) { + /* If ku_sig=true we configure signature and encryption slots with the + * same cert. This is bad form, but there are enough dual-usage RSA + * certs that we can't really break by limiting this to one type. */ + data->authType = ssl_auth_rsa_decrypt; + rv = ssl_ConfigCert(ss, cert, keyPair, data); + if (rv != SECSuccess) { + return rv; + } + } + + return rv; +} + +/* This function examines the type of certificate and its key usage and + * configures a certificate based on that information. For some certificates + * this can mean that multiple server certificates are configured. + * + * If the data argument contains an authType value other than ssl_auth_null, + * then only that slot will be used. If that choice is invalid, + * then this will fail. */ +static SECStatus +ssl_ConfigCertByUsage(sslSocket *ss, CERTCertificate *cert, + sslKeyPair *keyPair, const SSLExtraServerCertData *data) +{ + SECStatus rv = SECFailure; + SSLExtraServerCertData arg; + SECOidTag tag; + + PORT_Assert(data); + /* Take a (shallow) copy so that we can play with it */ + memcpy(&arg, data, sizeof(arg)); + + tag = SECOID_GetAlgorithmTag(&cert->subjectPublicKeyInfo.algorithm); + switch (tag) { + case SEC_OID_X500_RSA_ENCRYPTION: + case SEC_OID_PKCS1_RSA_ENCRYPTION: + return ssl_ConfigRsaPkcs1CertByUsage(ss, cert, keyPair, &arg); + + case SEC_OID_PKCS1_RSA_PSS_SIGNATURE: + if (cert->keyUsage & KU_DIGITAL_SIGNATURE) { + arg.authType = ssl_auth_rsa_pss; + } + break; + + case SEC_OID_ANSIX9_DSA_SIGNATURE: + if (cert->keyUsage & KU_DIGITAL_SIGNATURE) { + arg.authType = ssl_auth_dsa; + } + break; + + case SEC_OID_ANSIX962_EC_PUBLIC_KEY: + if (cert->keyUsage & KU_KEY_ENCIPHERMENT) { + if ((cert->keyUsage & KU_DIGITAL_SIGNATURE) && + arg.authType == ssl_auth_null) { + /* See above regarding bad practice. */ + arg.authType = ssl_auth_ecdsa; + rv = ssl_ConfigCert(ss, cert, keyPair, &arg); + if (rv != SECSuccess) { + return rv; + } + } + + arg.authType = ssl_GetEcdhAuthType(cert); + } else if (cert->keyUsage & KU_DIGITAL_SIGNATURE) { + arg.authType = ssl_auth_ecdsa; + } + break; + + default: + break; + } + + /* Check that we successfully picked an authType */ + if (arg.authType == ssl_auth_null) { + PORT_SetError(SEC_ERROR_INVALID_ARGS); + return SECFailure; + } + /* |data->authType| has to either agree or be ssl_auth_null. */ + if (data && data->authType != ssl_auth_null && + data->authType != arg.authType) { + PORT_SetError(SEC_ERROR_INVALID_ARGS); + return SECFailure; + } + return ssl_ConfigCert(ss, cert, keyPair, &arg); +} + +/* This function adopts pubKey and destroys it if things go wrong. */ +static sslKeyPair * +ssl_MakeKeyPairForCert(SECKEYPrivateKey *key, SECKEYPublicKey *pubKey) +{ + sslKeyPair *keyPair = NULL; + SECKEYPrivateKey *privKeyCopy = NULL; + PK11SlotInfo *bestSlot; + + if (key->pkcs11Slot) { + bestSlot = PK11_ReferenceSlot(key->pkcs11Slot); + if (bestSlot) { + privKeyCopy = PK11_CopyTokenPrivKeyToSessionPrivKey(bestSlot, key); + PK11_FreeSlot(bestSlot); + } + } + if (!privKeyCopy) { + CK_MECHANISM_TYPE keyMech = PK11_MapSignKeyType(key->keyType); + /* XXX Maybe should be bestSlotMultiple? */ + bestSlot = PK11_GetBestSlot(keyMech, NULL /* wincx */); + if (bestSlot) { + privKeyCopy = PK11_CopyTokenPrivKeyToSessionPrivKey(bestSlot, key); + PK11_FreeSlot(bestSlot); + } + } + if (!privKeyCopy) { + privKeyCopy = SECKEY_CopyPrivateKey(key); + } + if (privKeyCopy) { + keyPair = ssl_NewKeyPair(privKeyCopy, pubKey); + } + if (!keyPair) { + if (privKeyCopy) { + SECKEY_DestroyPrivateKey(privKeyCopy); + } + /* We adopted the public key, so we're responsible. */ + if (pubKey) { + SECKEY_DestroyPublicKey(pubKey); + } + } + return keyPair; +} + +/* Configure a certificate and private key. + * + * This function examines the certificate and key to determine which slot (or + * slots) to place the information in. As long as certificates are different + * (based on having different values of sslServerCertType), then this function + * can be called multiple times and the certificates will all be remembered. + */ +SECStatus +SSL_ConfigServerCert(PRFileDesc *fd, CERTCertificate *cert, + SECKEYPrivateKey *key, + const SSLExtraServerCertData *data, unsigned int data_len) +{ + sslSocket *ss; + SECKEYPublicKey *pubKey; + sslKeyPair *keyPair; + SECStatus rv; + SSLExtraServerCertData dataCopy = { + ssl_auth_null, NULL, NULL, NULL + }; + + ss = ssl_FindSocket(fd); + if (!ss) { + return SECFailure; + } + + if (!cert || !key) { + PORT_SetError(SEC_ERROR_INVALID_ARGS); + return SECFailure; + } + + if (data) { + if (data_len > sizeof(dataCopy)) { + PORT_SetError(SEC_ERROR_INVALID_ARGS); + return SECFailure; + } + PORT_Memcpy(&dataCopy, data, data_len); + } + + pubKey = CERT_ExtractPublicKey(cert); + if (!pubKey) { + return SECFailure; + } + + keyPair = ssl_MakeKeyPairForCert(key, pubKey); + if (!keyPair) { + /* pubKey is adopted by ssl_MakeKeyPairForCert() */ + PORT_SetError(SEC_ERROR_NO_MEMORY); + return SECFailure; + } + + rv = ssl_ConfigCertByUsage(ss, cert, keyPair, &dataCopy); + ssl_FreeKeyPair(keyPair); + return rv; +} + +/*******************************************************************/ +/* Deprecated functions. + * + * The remainder of this file contains deprecated functions for server + * certificate configuration. These configure certificates incorrectly, but in + * a way that allows old code to continue working without change. All these + * functions create certificate slots based on SSLKEAType values. Some values + * of SSLKEAType cause multiple certificates to be configured. + */ + +SECStatus +SSL_ConfigSecureServer(PRFileDesc *fd, CERTCertificate *cert, + SECKEYPrivateKey *key, SSLKEAType kea) +{ + return SSL_ConfigSecureServerWithCertChain(fd, cert, NULL, key, kea); +} + +/* This implements a limited check that is consistent with the checks performed + * by older versions of NSS. This is less rigorous than the checks in + * ssl_ConfigCertByUsage(), only checking against the type of key and ignoring + * things like usage. */ +static PRBool +ssl_CertSuitableForAuthType(CERTCertificate *cert, SSLAuthType authType) +{ + SECOidTag tag = SECOID_GetAlgorithmTag(&cert->subjectPublicKeyInfo.algorithm); + switch (authType) { + case ssl_auth_rsa_decrypt: + case ssl_auth_rsa_sign: + return tag == SEC_OID_X500_RSA_ENCRYPTION || + tag == SEC_OID_PKCS1_RSA_ENCRYPTION; + case ssl_auth_dsa: + return tag == SEC_OID_ANSIX9_DSA_SIGNATURE; + case ssl_auth_ecdsa: + case ssl_auth_ecdh_rsa: + case ssl_auth_ecdh_ecdsa: + return tag == SEC_OID_ANSIX962_EC_PUBLIC_KEY; + case ssl_auth_null: + case ssl_auth_kea: + case ssl_auth_rsa_pss: /* not supported with deprecated APIs */ + return PR_FALSE; + default: + PORT_Assert(0); + return PR_FALSE; + } +} + +/* This finds an existing server cert slot and unlinks it, or it makes a new + * server cert slot of the right type. */ +static sslServerCert * +ssl_FindOrMakeCertType(sslSocket *ss, SSLAuthType authType) +{ + sslServerCert *sc; + sslServerCertType certType; + + certType.authType = authType; + /* Setting the named curve to NULL ensures that all EC certificates + * are matched when searching for this slot. */ + certType.namedCurve = NULL; + sc = ssl_FindServerCert(ss, &certType); + if (sc) { + PR_REMOVE_LINK(&sc->link); + return sc; + } + + return ssl_NewServerCert(&certType); +} + +static void +ssl_RemoveCertAndKeyByAuthType(sslSocket *ss, SSLAuthType authType) +{ + sslServerCert *sc; + + sc = ssl_FindServerCertByAuthType(ss, authType); + if (sc) { + (void)ssl_PopulateServerCert(sc, NULL, NULL); + (void)ssl_PopulateKeyPair(sc, NULL); + /* Leave the entry linked here because the old API expects that. There + * might be OCSP stapling values or signed certificate timestamps still + * present that will subsequently be used. */ + /* For ECC certificates, also leave the namedCurve parameter on the slot + * unchanged; the value will be updated when a key is added. */ + } +} + +static SECStatus +ssl_AddCertAndKeyByAuthType(sslSocket *ss, SSLAuthType authType, + CERTCertificate *cert, + const CERTCertificateList *certChainOpt, + sslKeyPair *keyPair) +{ + sslServerCert *sc; + SECStatus rv; + + if (!ssl_CertSuitableForAuthType(cert, authType)) { + PORT_SetError(SEC_ERROR_INVALID_ARGS); + return SECFailure; + } + + sc = ssl_FindOrMakeCertType(ss, authType); + if (!sc) { + PORT_SetError(SEC_ERROR_NO_MEMORY); + return SECFailure; + } + rv = ssl_PopulateKeyPair(sc, keyPair); + if (rv != SECSuccess) { + PORT_SetError(SEC_ERROR_INVALID_ARGS); + goto loser; + } + /* Now that we have a key pair, update the details of the slot. Many of the + * legacy functions create a slot with a namedCurve of NULL, which + * makes the slot unusable; this corrects that. */ + ssl_PopulateCertType(&sc->certType, authType, cert, keyPair); + rv = ssl_PopulateServerCert(sc, cert, certChainOpt); + if (rv != SECSuccess) { + PORT_SetError(SEC_ERROR_NO_MEMORY); + goto loser; + } + PR_APPEND_LINK(&sc->link, &ss->serverCerts); + return ssl_OneTimeCertSetup(ss, sc); +loser: + ssl_FreeServerCert(sc); + return SECFailure; +} + +static SECStatus +ssl_AddCertsByKEA(sslSocket *ss, CERTCertificate *cert, + const CERTCertificateList *certChainOpt, + SECKEYPrivateKey *key, SSLKEAType certType) +{ + SECKEYPublicKey *pubKey; + sslKeyPair *keyPair; + SECStatus rv; + + pubKey = CERT_ExtractPublicKey(cert); + if (!pubKey) { + return SECFailure; + } + + keyPair = ssl_MakeKeyPairForCert(key, pubKey); + if (!keyPair) { + /* Note: pubKey is adopted or freed by ssl_MakeKeyPairForCert() + * depending on whether it succeeds or not. */ + PORT_SetError(SEC_ERROR_NO_MEMORY); + return SECFailure; + } + + switch (certType) { + case ssl_kea_rsa: + rv = ssl_AddCertAndKeyByAuthType(ss, ssl_auth_rsa_decrypt, + cert, certChainOpt, keyPair); + if (rv != SECSuccess) { + return SECFailure; + } + rv = ssl_AddCertAndKeyByAuthType(ss, ssl_auth_rsa_sign, + cert, certChainOpt, keyPair); + break; + + case ssl_kea_dh: + rv = ssl_AddCertAndKeyByAuthType(ss, ssl_auth_dsa, + cert, certChainOpt, keyPair); + break; + + case ssl_kea_ecdh: + rv = ssl_AddCertAndKeyByAuthType(ss, ssl_auth_ecdsa, + cert, certChainOpt, keyPair); + if (rv != SECSuccess) { + return SECFailure; + } + rv = ssl_AddCertAndKeyByAuthType(ss, ssl_GetEcdhAuthType(cert), + cert, certChainOpt, keyPair); + break; + + default: + PORT_SetError(SEC_ERROR_INVALID_ARGS); + rv = SECFailure; + break; + } + + ssl_FreeKeyPair(keyPair); + return rv; +} + +/* Public deprecated function */ +SECStatus +SSL_ConfigSecureServerWithCertChain(PRFileDesc *fd, CERTCertificate *cert, + const CERTCertificateList *certChainOpt, + SECKEYPrivateKey *key, SSLKEAType certType) +{ + sslSocket *ss; + + ss = ssl_FindSocket(fd); + if (!ss) { + return SECFailure; + } + + if (!cert != !key) { /* Configure both, or neither */ + PORT_SetError(SEC_ERROR_INVALID_ARGS); + return SECFailure; + } + + if (!cert) { + switch (certType) { + case ssl_kea_rsa: + ssl_RemoveCertAndKeyByAuthType(ss, ssl_auth_rsa_decrypt); + ssl_RemoveCertAndKeyByAuthType(ss, ssl_auth_rsa_sign); + break; + + case ssl_kea_dh: + ssl_RemoveCertAndKeyByAuthType(ss, ssl_auth_dsa); + break; + + case ssl_kea_ecdh: + ssl_RemoveCertAndKeyByAuthType(ss, ssl_auth_ecdsa); + ssl_RemoveCertAndKeyByAuthType(ss, ssl_auth_ecdh_rsa); + ssl_RemoveCertAndKeyByAuthType(ss, ssl_auth_ecdh_ecdsa); + break; + + default: + PORT_SetError(SEC_ERROR_INVALID_ARGS); + return SECFailure; + } + return SECSuccess; + } + + return ssl_AddCertsByKEA(ss, cert, certChainOpt, key, certType); +} + +static SECStatus +ssl_SetOCSPResponsesInSlot(sslSocket *ss, SSLAuthType authType, + const SECItemArray *responses) +{ + sslServerCert *sc; + SECStatus rv; + + sc = ssl_FindOrMakeCertType(ss, authType); + if (!sc) { + PORT_SetError(SEC_ERROR_NO_MEMORY); + return SECFailure; + } + rv = ssl_PopulateOCSPResponses(sc, responses); + if (rv == SECSuccess) { + PR_APPEND_LINK(&sc->link, &ss->serverCerts); + } else { + ssl_FreeServerCert(sc); + } + return rv; +} + +/* Public deprecated function */ +SECStatus +SSL_SetStapledOCSPResponses(PRFileDesc *fd, const SECItemArray *responses, + SSLKEAType certType) +{ + sslSocket *ss; + SECStatus rv; + + ss = ssl_FindSocket(fd); + if (!ss) { + SSL_DBG(("%d: SSL[%d]: bad socket in SSL_SetStapledOCSPResponses", + SSL_GETPID(), fd)); + return SECFailure; + } + + switch (certType) { + case ssl_kea_rsa: + rv = ssl_SetOCSPResponsesInSlot(ss, ssl_auth_rsa_decrypt, responses); + if (rv != SECSuccess) { + return SECFailure; + } + return ssl_SetOCSPResponsesInSlot(ss, ssl_auth_rsa_sign, responses); + + case ssl_kea_dh: + return ssl_SetOCSPResponsesInSlot(ss, ssl_auth_dsa, responses); + + case ssl_kea_ecdh: + rv = ssl_SetOCSPResponsesInSlot(ss, ssl_auth_ecdsa, responses); + if (rv != SECSuccess) { + return SECFailure; + } + rv = ssl_SetOCSPResponsesInSlot(ss, ssl_auth_ecdh_rsa, responses); + if (rv != SECSuccess) { + return SECFailure; + } + return ssl_SetOCSPResponsesInSlot(ss, ssl_auth_ecdh_ecdsa, responses); + + default: + SSL_DBG(("%d: SSL[%d]: invalid cert type in SSL_SetStapledOCSPResponses", + SSL_GETPID(), fd)); + PORT_SetError(SEC_ERROR_INVALID_ARGS); + return SECFailure; + } +} + +static SECStatus +ssl_SetSignedTimestampsInSlot(sslSocket *ss, SSLAuthType authType, + const SECItem *scts) +{ + sslServerCert *sc; + SECStatus rv; + + sc = ssl_FindOrMakeCertType(ss, authType); + if (!sc) { + PORT_SetError(SEC_ERROR_NO_MEMORY); + return SECFailure; + } + rv = ssl_PopulateSignedCertTimestamps(sc, scts); + if (rv == SECSuccess) { + PR_APPEND_LINK(&sc->link, &ss->serverCerts); + } else { + ssl_FreeServerCert(sc); + } + return rv; +} + +/* Public deprecated function */ +SECStatus +SSL_SetSignedCertTimestamps(PRFileDesc *fd, const SECItem *scts, + SSLKEAType certType) +{ + sslSocket *ss; + SECStatus rv; + + ss = ssl_FindSocket(fd); + if (!ss) { + SSL_DBG(("%d: SSL[%d]: bad socket in SSL_SetSignedCertTimestamps", + SSL_GETPID(), fd)); + return SECFailure; + } + + switch (certType) { + case ssl_kea_rsa: + rv = ssl_SetSignedTimestampsInSlot(ss, ssl_auth_rsa_decrypt, scts); + if (rv != SECSuccess) { + return SECFailure; + } + return ssl_SetSignedTimestampsInSlot(ss, ssl_auth_rsa_sign, scts); + + case ssl_kea_dh: + return ssl_SetSignedTimestampsInSlot(ss, ssl_auth_dsa, scts); + + case ssl_kea_ecdh: + rv = ssl_SetSignedTimestampsInSlot(ss, ssl_auth_ecdsa, scts); + if (rv != SECSuccess) { + return SECFailure; + } + rv = ssl_SetSignedTimestampsInSlot(ss, ssl_auth_ecdh_rsa, scts); + if (rv != SECSuccess) { + return SECFailure; + } + return ssl_SetSignedTimestampsInSlot(ss, ssl_auth_ecdh_ecdsa, scts); + + default: + SSL_DBG(("%d: SSL[%d]: invalid cert type in SSL_SetSignedCertTimestamps", + SSL_GETPID(), fd)); + PORT_SetError(SEC_ERROR_INVALID_ARGS); + return SECFailure; + } +} + +/* Public deprecated function. */ +SSLKEAType +NSS_FindCertKEAType(CERTCertificate *cert) +{ + int tag; + + if (!cert) + return ssl_kea_null; + + tag = SECOID_GetAlgorithmTag(&(cert->subjectPublicKeyInfo.algorithm)); + switch (tag) { + case SEC_OID_X500_RSA_ENCRYPTION: + case SEC_OID_PKCS1_RSA_ENCRYPTION: + return ssl_kea_rsa; + case SEC_OID_ANSIX9_DSA_SIGNATURE: /* hah, signature, not a key? */ + case SEC_OID_X942_DIFFIE_HELMAN_KEY: + return ssl_kea_dh; + case SEC_OID_ANSIX962_EC_PUBLIC_KEY: + return ssl_kea_ecdh; + default: + return ssl_kea_null; + } +} diff --git a/security/nss/lib/ssl/sslcert.h b/security/nss/lib/ssl/sslcert.h new file mode 100644 index 000000000..052c7d6db --- /dev/null +++ b/security/nss/lib/ssl/sslcert.h @@ -0,0 +1,59 @@ +/* -*- Mode: C; tab-width: 8; indent-tabs-mode: nil; c-basic-offset: 4 -*- */ +/* + * This file is PRIVATE to SSL. + * + * This Source Code Form is subject to the terms of the Mozilla Public + * License, v. 2.0. If a copy of the MPL was not distributed with this + * file, You can obtain one at http://mozilla.org/MPL/2.0/. */ + +#ifndef __sslcert_h_ +#define __sslcert_h_ + +#include "cert.h" +#include "secitem.h" +#include "keyhi.h" + +/* The following struct identifies a single slot into which a certificate can be +** loaded. The authType field determines the basic slot, then additional +** parameters further narrow the slot. +** +** An EC key (ssl_auth_ecdsa or ssl_auth_ecdh_*) is assigned to a slot based on +** the named curve of the key. +*/ +typedef struct sslServerCertTypeStr { + SSLAuthType authType; + /* For ssl_auth_ecdsa and ssl_auth_ecdh_*. This is only the named curve + * of the end-entity certificate key. The keys in other certificates in + * the chain aren't directly relevant to the operation of TLS (though it + * might make certificate validation difficult, libssl doesn't care). */ + const sslNamedGroupDef *namedCurve; +} sslServerCertType; + +typedef struct sslServerCertStr { + PRCList link; /* The linked list link */ + + sslServerCertType certType; /* The certificate slot this occupies */ + + /* Configuration state for server sockets */ + CERTCertificate *serverCert; + CERTCertificateList *serverCertChain; + sslKeyPair *serverKeyPair; + unsigned int serverKeyBits; + /* Each certificate needs its own status. */ + SECItemArray *certStatusArray; + /* Serialized signed certificate timestamps to be sent to the client + ** in a TLS extension (server only). Each certificate needs its own + ** timestamps item. + */ + SECItem signedCertTimestamps; +} sslServerCert; + +extern sslServerCert *ssl_NewServerCert(const sslServerCertType *slot); +extern sslServerCert *ssl_CopyServerCert(const sslServerCert *oc); +extern sslServerCert *ssl_FindServerCert(const sslSocket *ss, + const sslServerCertType *slot); +extern sslServerCert *ssl_FindServerCertByAuthType(const sslSocket *ss, + SSLAuthType authType); +extern void ssl_FreeServerCert(sslServerCert *sc); + +#endif /* __sslcert_h_ */ diff --git a/security/nss/lib/ssl/sslcon.c b/security/nss/lib/ssl/sslcon.c new file mode 100644 index 000000000..448170640 --- /dev/null +++ b/security/nss/lib/ssl/sslcon.c @@ -0,0 +1,264 @@ +/* + * Basic SSL handshake functions. + * + * This Source Code Form is subject to the terms of the Mozilla Public + * License, v. 2.0. If a copy of the MPL was not distributed with this + * file, You can obtain one at http://mozilla.org/MPL/2.0/. */ + +#include "nssrenam.h" +#include "cert.h" +#include "secitem.h" +#include "sechash.h" +#include "cryptohi.h" /* for SGN_ funcs */ +#include "keyhi.h" /* for SECKEY_ high level functions. */ +#include "ssl.h" +#include "sslimpl.h" +#include "sslproto.h" +#include "ssl3prot.h" +#include "sslerr.h" +#include "pk11func.h" +#include "prinit.h" +#include "prtime.h" /* for PR_Now() */ + +/* +** Put a string tag in the library so that we can examine an executable +** and see what kind of security it supports. +*/ +const char *ssl_version = "SECURITY_VERSION:" + " +us" + " +export" +#ifdef TRACE + " +trace" +#endif +#ifdef DEBUG + " +debug" +#endif + ; + +/*********************************************************************** + * Gathers in and handles records/messages until either the handshake is + * complete or application data is available. + * + * Called from ssl_Do1stHandshake() via function pointer ss->handshake. + * Caller must hold handshake lock. + * This function acquires and releases the RecvBufLock. + * + * returns SECSuccess for success. + * returns SECWouldBlock when that value is returned by + * ssl3_GatherCompleteHandshake(). + * returns SECFailure on all other errors. + * + * The gather functions called by ssl_GatherRecord1stHandshake are expected + * to return values interpreted as follows: + * 1 : the function completed without error. + * 0 : the function read EOF. + * -1 : read error, or PR_WOULD_BLOCK_ERROR, or handleRecord error. + * -2 : the function wants ssl_GatherRecord1stHandshake to be called again + * immediately, by ssl_Do1stHandshake. + * + * This code is similar to, and easily confused with, DoRecv() in sslsecur.c + * + * This function is called from ssl_Do1stHandshake(). + * The following functions put ssl_GatherRecord1stHandshake into ss->handshake: + * ssl_BeginClientHandshake + * ssl3_RestartHandshakeAfterCertReq + * ssl3_RestartHandshakeAfterServerCert + * ssl_BeginServerHandshake + */ +SECStatus +ssl_GatherRecord1stHandshake(sslSocket *ss) +{ + int rv; + + PORT_Assert(ss->opt.noLocks || ssl_Have1stHandshakeLock(ss)); + + ssl_GetRecvBufLock(ss); + + /* Wait for handshake to complete, or application data to arrive. */ + rv = ssl3_GatherCompleteHandshake(ss, 0); + SSL_TRC(10, ("%d: SSL[%d]: handshake gathering, rv=%d", + SSL_GETPID(), ss->fd, rv)); + + ssl_ReleaseRecvBufLock(ss); + + if (rv <= 0) { + if (rv == SECWouldBlock) { + /* Progress is blocked waiting for callback completion. */ + SSL_TRC(10, ("%d: SSL[%d]: handshake blocked (need %d)", + SSL_GETPID(), ss->fd, ss->gs.remainder)); + return SECWouldBlock; + } + if (rv == 0) { + /* EOF. Loser */ + PORT_SetError(PR_END_OF_FILE_ERROR); + } + return SECFailure; /* rv is < 0 here. */ + } + + ss->handshake = NULL; + return SECSuccess; +} + +/* This function is called at the beginning of a handshake to ensure that at + * least one SSL/TLS version is enabled. */ +static SECStatus +ssl_CheckConfigSanity(sslSocket *ss) +{ + if (SSL_ALL_VERSIONS_DISABLED(&ss->vrange)) { + SSL_DBG(("%d: SSL[%d]: Can't handshake! all versions disabled.", + SSL_GETPID(), ss->fd)); + PORT_SetError(SSL_ERROR_SSL_DISABLED); + return SECFailure; + } + return SECSuccess; +} + +/* Sends out the initial client Hello message on the connection. + * Acquires and releases the socket's xmitBufLock. + */ +SECStatus +ssl_BeginClientHandshake(sslSocket *ss) +{ + sslSessionID *sid; + SECStatus rv; + + PORT_Assert(ss->opt.noLocks || ssl_Have1stHandshakeLock(ss)); + + ss->sec.isServer = PR_FALSE; + ssl_ChooseSessionIDProcs(&ss->sec); + + rv = ssl_CheckConfigSanity(ss); + if (rv != SECSuccess) + goto loser; + + /* Get peer name of server */ + rv = ssl_GetPeerInfo(ss); + if (rv < 0) { +#ifdef HPUX11 + /* + * On some HP-UX B.11.00 systems, getpeername() occasionally + * fails with ENOTCONN after a successful completion of + * non-blocking connect. I found that if we do a write() + * and then retry getpeername(), it will work. + */ + if (PR_GetError() == PR_NOT_CONNECTED_ERROR) { + char dummy; + (void)PR_Write(ss->fd->lower, &dummy, 0); + rv = ssl_GetPeerInfo(ss); + if (rv < 0) { + goto loser; + } + } +#else + goto loser; +#endif + } + + SSL_TRC(3, ("%d: SSL[%d]: sending client-hello", SSL_GETPID(), ss->fd)); + + /* Try to find server in our session-id cache */ + if (ss->opt.noCache) { + sid = NULL; + } else { + sid = ssl_LookupSID(&ss->sec.ci.peer, ss->sec.ci.port, ss->peerID, + ss->url); + } + if (sid) { + if (sid->version >= ss->vrange.min && sid->version <= ss->vrange.max) { + PORT_Assert(!ss->sec.localCert); + ss->sec.localCert = CERT_DupCertificate(sid->localCert); + } else { + ss->sec.uncache(sid); + ssl_FreeSID(sid); + sid = NULL; + } + } + if (!sid) { + sid = PORT_ZNew(sslSessionID); + if (!sid) { + goto loser; + } + sid->references = 1; + sid->cached = never_cached; + sid->addr = ss->sec.ci.peer; + sid->port = ss->sec.ci.port; + if (ss->peerID != NULL) { + sid->peerID = PORT_Strdup(ss->peerID); + } + if (ss->url != NULL) { + sid->urlSvrName = PORT_Strdup(ss->url); + } + } + ss->sec.ci.sid = sid; + + PORT_Assert(sid != NULL); + + ss->gs.state = GS_INIT; + ss->handshake = ssl_GatherRecord1stHandshake; + + /* ssl3_SendClientHello will override this if it succeeds. */ + ss->version = SSL_LIBRARY_VERSION_3_0; + + ssl_GetSSL3HandshakeLock(ss); + ssl_GetXmitBufLock(ss); + rv = ssl3_SendClientHello(ss, client_hello_initial); + ssl_ReleaseXmitBufLock(ss); + ssl_ReleaseSSL3HandshakeLock(ss); + + return rv; + +loser: + return SECFailure; +} + +SECStatus +ssl_BeginServerHandshake(sslSocket *ss) +{ + SECStatus rv; + + ss->sec.isServer = PR_TRUE; + ss->ssl3.hs.ws = wait_client_hello; + ssl_ChooseSessionIDProcs(&ss->sec); + + rv = ssl_CheckConfigSanity(ss); + if (rv != SECSuccess) + goto loser; + + ss->handshake = ssl_GatherRecord1stHandshake; + return SECSuccess; + +loser: + return SECFailure; +} + +/* This function doesn't really belong in this file. +** It's here to keep AIX compilers from optimizing it away, +** and not including it in the DSO. +*/ + +#include "nss.h" +extern const char __nss_ssl_version[]; + +PRBool +NSSSSL_VersionCheck(const char *importedVersion) +{ +#define NSS_VERSION_VARIABLE __nss_ssl_version +#include "verref.h" + + /* + * This is the secret handshake algorithm. + * + * This release has a simple version compatibility + * check algorithm. This release is not backward + * compatible with previous major releases. It is + * not compatible with future major, minor, or + * patch releases. + */ + return NSS_VersionCheck(importedVersion); +} + +const char * +NSSSSL_GetVersion(void) +{ + return NSS_VERSION; +} diff --git a/security/nss/lib/ssl/ssldef.c b/security/nss/lib/ssl/ssldef.c new file mode 100644 index 000000000..77a744cc7 --- /dev/null +++ b/security/nss/lib/ssl/ssldef.c @@ -0,0 +1,224 @@ +/* + * "Default" SSLSocket methods, used by sockets that do neither SSL nor socks. + * + * This Source Code Form is subject to the terms of the Mozilla Public + * License, v. 2.0. If a copy of the MPL was not distributed with this + * file, You can obtain one at http://mozilla.org/MPL/2.0/. */ + +#include "cert.h" +#include "ssl.h" +#include "sslimpl.h" + +#if defined(WIN32) +#define MAP_ERROR(from, to) \ + if (err == from) { \ + PORT_SetError(to); \ + } +#define DEFINE_ERROR PRErrorCode err = PR_GetError(); +#else +#define MAP_ERROR(from, to) +#define DEFINE_ERROR +#endif + +int +ssl_DefConnect(sslSocket *ss, const PRNetAddr *sa) +{ + PRFileDesc *lower = ss->fd->lower; + int rv; + + rv = lower->methods->connect(lower, sa, ss->cTimeout); + return rv; +} + +int +ssl_DefBind(sslSocket *ss, const PRNetAddr *addr) +{ + PRFileDesc *lower = ss->fd->lower; + int rv; + + rv = lower->methods->bind(lower, addr); + return rv; +} + +int +ssl_DefListen(sslSocket *ss, int backlog) +{ + PRFileDesc *lower = ss->fd->lower; + int rv; + + rv = lower->methods->listen(lower, backlog); + return rv; +} + +int +ssl_DefShutdown(sslSocket *ss, int how) +{ + PRFileDesc *lower = ss->fd->lower; + int rv; + + rv = lower->methods->shutdown(lower, how); + return rv; +} + +int +ssl_DefRecv(sslSocket *ss, unsigned char *buf, int len, int flags) +{ + PRFileDesc *lower = ss->fd->lower; + int rv; + + rv = lower->methods->recv(lower, (void *)buf, len, flags, ss->rTimeout); + if (rv < 0) { + DEFINE_ERROR + MAP_ERROR(PR_SOCKET_SHUTDOWN_ERROR, PR_CONNECT_RESET_ERROR) + } else if (rv > len) { + PORT_Assert(rv <= len); + PORT_SetError(PR_BUFFER_OVERFLOW_ERROR); + rv = SECFailure; + } + return rv; +} + +/* Default (unencrypted) send. + * For blocking sockets, always returns len or SECFailure, no short writes. + * For non-blocking sockets: + * Returns positive count if any data was written, else returns SECFailure. + * Short writes may occur. Does not return SECWouldBlock. + */ +int +ssl_DefSend(sslSocket *ss, const unsigned char *buf, int len, int flags) +{ + PRFileDesc *lower = ss->fd->lower; + int sent = 0; + +#if NSS_DISABLE_NAGLE_DELAYS + /* Although this is overkill, we disable Nagle delays completely for + ** SSL sockets. + */ + if (ss->opt.useSecurity && !ss->delayDisabled) { + ssl_EnableNagleDelay(ss, PR_FALSE); /* ignore error */ + ss->delayDisabled = 1; + } +#endif + do { + int rv = lower->methods->send(lower, (const void *)(buf + sent), + len - sent, flags, ss->wTimeout); + if (rv < 0) { + PRErrorCode err = PR_GetError(); + if (err == PR_WOULD_BLOCK_ERROR) { + ss->lastWriteBlocked = 1; + return sent ? sent : SECFailure; + } + ss->lastWriteBlocked = 0; + MAP_ERROR(PR_CONNECT_ABORTED_ERROR, PR_CONNECT_RESET_ERROR) + /* Loser */ + return rv; + } + sent += rv; + + if (IS_DTLS(ss) && (len > sent)) { + /* We got a partial write so just return it */ + return sent; + } + } while (len > sent); + ss->lastWriteBlocked = 0; + return sent; +} + +int +ssl_DefRead(sslSocket *ss, unsigned char *buf, int len) +{ + PRFileDesc *lower = ss->fd->lower; + int rv; + + rv = lower->methods->read(lower, (void *)buf, len); + if (rv < 0) { + DEFINE_ERROR + MAP_ERROR(PR_SOCKET_SHUTDOWN_ERROR, PR_CONNECT_RESET_ERROR) + } + return rv; +} + +int +ssl_DefWrite(sslSocket *ss, const unsigned char *buf, int len) +{ + PRFileDesc *lower = ss->fd->lower; + int sent = 0; + + do { + int rv = lower->methods->write(lower, (const void *)(buf + sent), + len - sent); + if (rv < 0) { + PRErrorCode err = PR_GetError(); + if (err == PR_WOULD_BLOCK_ERROR) { + ss->lastWriteBlocked = 1; + return sent ? sent : SECFailure; + } + ss->lastWriteBlocked = 0; + MAP_ERROR(PR_CONNECT_ABORTED_ERROR, PR_CONNECT_RESET_ERROR) + /* Loser */ + return rv; + } + sent += rv; + } while (len > sent); + ss->lastWriteBlocked = 0; + return sent; +} + +int +ssl_DefGetpeername(sslSocket *ss, PRNetAddr *name) +{ + PRFileDesc *lower = ss->fd->lower; + int rv; + + rv = lower->methods->getpeername(lower, name); + return rv; +} + +int +ssl_DefGetsockname(sslSocket *ss, PRNetAddr *name) +{ + PRFileDesc *lower = ss->fd->lower; + int rv; + + rv = lower->methods->getsockname(lower, name); + return rv; +} + +int +ssl_DefClose(sslSocket *ss) +{ + PRFileDesc *fd; + PRFileDesc *popped; + int rv; + + fd = ss->fd; + + /* First, remove the SSL layer PRFileDesc from the socket's stack, + ** then invoke the SSL layer's PRFileDesc destructor. + ** This must happen before the next layer down is closed. + */ + PORT_Assert(fd->higher == NULL); + if (fd->higher) { + PORT_SetError(PR_BAD_DESCRIPTOR_ERROR); + return SECFailure; + } + ss->fd = NULL; + + /* PR_PopIOLayer will swap the contents of the top two PRFileDescs on + ** the stack, and then remove the second one. This way, the address + ** of the PRFileDesc on the top of the stack doesn't change. + */ + popped = PR_PopIOLayer(fd, PR_TOP_IO_LAYER); + popped->dtor(popped); + + /* fd is now the PRFileDesc for the next layer down. + ** Now close the underlying socket. + */ + rv = fd->methods->close(fd); + + ssl_FreeSocket(ss); + + SSL_TRC(5, ("%d: SSL[%d]: closing, rv=%d errno=%d", + SSL_GETPID(), fd, rv, PORT_GetError())); + return rv; +} diff --git a/security/nss/lib/ssl/sslenum.c b/security/nss/lib/ssl/sslenum.c new file mode 100644 index 000000000..b5272d4a8 --- /dev/null +++ b/security/nss/lib/ssl/sslenum.c @@ -0,0 +1,157 @@ +/* + * Table enumerating all implemented cipher suites + * Part of public API. + * + * This Source Code Form is subject to the terms of the Mozilla Public + * License, v. 2.0. If a copy of the MPL was not distributed with this + * file, You can obtain one at http://mozilla.org/MPL/2.0/. */ + +#include "ssl.h" +#include "sslproto.h" + +/* + * The ordering of cipher suites in this table must match the ordering in + * the cipherSuites table in ssl3con.c. + * + * If new ECC cipher suites are added, also update the ssl3CipherSuite arrays + * in ssl3ecc.c. + * + * Finally, update the ssl_V3_SUITES_IMPLEMENTED macro in sslimpl.h. + * + * The ordering is as follows: + * * No-encryption cipher suites last + * * Export/weak/obsolete cipher suites before no-encryption cipher suites + * * Order by key exchange algorithm: ECDHE, then DHE, then ECDH, RSA. + * * Within key agreement sections, prefer AEAD over non-AEAD cipher suites. + * * Within AEAD sections, order by symmetric encryption algorithm which + * integrates message authentication algorithm: AES-128-GCM, then + * ChaCha20-Poly1305, then AES-256-GCM, + * * Within non-AEAD sections, order by symmetric encryption algorithm: + * AES-128, then Camellia-128, then AES-256, then Camellia-256, then SEED, + * then FIPS-3DES, then 3DES, then RC4. AES is commonly accepted as a + * strong cipher internationally, and is often hardware-accelerated. + * Camellia also has wide international support across standards + * organizations. SEED is only recommended by the Korean government. 3DES + * only provides 112 bits of security. RC4 is now deprecated or forbidden + * by many standards organizations. + * * Within non-AEAD symmetric algorithm sections, order by message + * authentication algorithm: HMAC-SHA256, then HMAC-SHA384, then HMAC-SHA1, + * then HMAC-MD5. + * * Within symmetric algorithm sections, order by message authentication + * algorithm: GCM, then HMAC-SHA1, then HMAC-SHA256, then HMAC-MD5. + * * Within message authentication algorithm sections, order by asymmetric + * signature algorithm: ECDSA, then RSA, then DSS. + * * As a special case, the PSK ciphers, which are only enabled when + * TLS 1.3 PSK-resumption is in use, come first. + * + * Exception: Because some servers ignore the high-order byte of the cipher + * suite ID, we must be careful about adding cipher suites with IDs larger + * than 0x00ff; see bug 946147. For these broken servers, the first three + * cipher suites, with the MSB zeroed, look like: + * TLS_RSA_WITH_AES_128_CBC_SHA { 0x00,0x2F } + * TLS_RSA_WITH_3DES_EDE_CBC_SHA { 0x00,0x0A } + * TLS_RSA_WITH_DES_CBC_SHA { 0x00,0x09 } + * The broken server only supports the third and fourth ones and will select + * the third one. + */ +const PRUint16 SSL_ImplementedCiphers[] = { + TLS_AES_128_GCM_SHA256, + TLS_CHACHA20_POLY1305_SHA256, + TLS_AES_256_GCM_SHA384, + + TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256, + TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256, + TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256, + TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256, + TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384, + TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384, + /* TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA must appear before + * TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA to work around bug 946147. + */ + TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA, + TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA, + TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA, + TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256, + TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256, + TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA, + TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA384, + TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384, + TLS_ECDHE_ECDSA_WITH_3DES_EDE_CBC_SHA, + TLS_ECDHE_RSA_WITH_3DES_EDE_CBC_SHA, + TLS_ECDHE_ECDSA_WITH_RC4_128_SHA, + TLS_ECDHE_RSA_WITH_RC4_128_SHA, + + TLS_DHE_RSA_WITH_AES_128_GCM_SHA256, + TLS_DHE_RSA_WITH_CHACHA20_POLY1305_SHA256, + TLS_DHE_DSS_WITH_AES_128_GCM_SHA256, + TLS_DHE_RSA_WITH_AES_256_GCM_SHA384, + TLS_DHE_DSS_WITH_AES_256_GCM_SHA384, + TLS_DHE_RSA_WITH_AES_128_CBC_SHA, + TLS_DHE_DSS_WITH_AES_128_CBC_SHA, + TLS_DHE_RSA_WITH_AES_128_CBC_SHA256, + TLS_DHE_DSS_WITH_AES_128_CBC_SHA256, + TLS_DHE_RSA_WITH_CAMELLIA_128_CBC_SHA, + TLS_DHE_DSS_WITH_CAMELLIA_128_CBC_SHA, + TLS_DHE_RSA_WITH_AES_256_CBC_SHA, + TLS_DHE_DSS_WITH_AES_256_CBC_SHA, + TLS_DHE_RSA_WITH_AES_256_CBC_SHA256, + TLS_DHE_DSS_WITH_AES_256_CBC_SHA256, + TLS_DHE_RSA_WITH_CAMELLIA_256_CBC_SHA, + TLS_DHE_DSS_WITH_CAMELLIA_256_CBC_SHA, + TLS_DHE_RSA_WITH_3DES_EDE_CBC_SHA, + TLS_DHE_DSS_WITH_3DES_EDE_CBC_SHA, + TLS_DHE_DSS_WITH_RC4_128_SHA, + + TLS_ECDH_ECDSA_WITH_AES_128_CBC_SHA, + TLS_ECDH_RSA_WITH_AES_128_CBC_SHA, + TLS_ECDH_ECDSA_WITH_AES_256_CBC_SHA, + TLS_ECDH_RSA_WITH_AES_256_CBC_SHA, + TLS_ECDH_ECDSA_WITH_3DES_EDE_CBC_SHA, + TLS_ECDH_RSA_WITH_3DES_EDE_CBC_SHA, + TLS_ECDH_ECDSA_WITH_RC4_128_SHA, + TLS_ECDH_RSA_WITH_RC4_128_SHA, + + TLS_RSA_WITH_AES_128_GCM_SHA256, + TLS_RSA_WITH_AES_256_GCM_SHA384, + TLS_RSA_WITH_AES_128_CBC_SHA, + TLS_RSA_WITH_AES_128_CBC_SHA256, + TLS_RSA_WITH_CAMELLIA_128_CBC_SHA, + TLS_RSA_WITH_AES_256_CBC_SHA, + TLS_RSA_WITH_AES_256_CBC_SHA256, + TLS_RSA_WITH_CAMELLIA_256_CBC_SHA, + TLS_RSA_WITH_SEED_CBC_SHA, + TLS_RSA_WITH_3DES_EDE_CBC_SHA, + TLS_RSA_WITH_RC4_128_SHA, + TLS_RSA_WITH_RC4_128_MD5, + + /* 56-bit DES "domestic" cipher suites */ + TLS_DHE_RSA_WITH_DES_CBC_SHA, + TLS_DHE_DSS_WITH_DES_CBC_SHA, + TLS_RSA_WITH_DES_CBC_SHA, + + /* ciphersuites with no encryption */ + TLS_ECDHE_ECDSA_WITH_NULL_SHA, + TLS_ECDHE_RSA_WITH_NULL_SHA, + TLS_ECDH_RSA_WITH_NULL_SHA, + TLS_ECDH_ECDSA_WITH_NULL_SHA, + TLS_RSA_WITH_NULL_SHA, + TLS_RSA_WITH_NULL_SHA256, + TLS_RSA_WITH_NULL_MD5, + + 0 +}; + +const PRUint16 SSL_NumImplementedCiphers = + (sizeof SSL_ImplementedCiphers) / (sizeof SSL_ImplementedCiphers[0]) - 1; + +const PRUint16* +SSL_GetImplementedCiphers(void) +{ + return SSL_ImplementedCiphers; +} + +PRUint16 +SSL_GetNumImplementedCiphers(void) +{ + return SSL_NumImplementedCiphers; +} diff --git a/security/nss/lib/ssl/sslerr.c b/security/nss/lib/ssl/sslerr.c new file mode 100644 index 000000000..edb941257 --- /dev/null +++ b/security/nss/lib/ssl/sslerr.c @@ -0,0 +1,41 @@ +/* + * Function to set error code only when meaningful error has not already + * been set. + * + * This Source Code Form is subject to the terms of the Mozilla Public + * License, v. 2.0. If a copy of the MPL was not distributed with this + * file, You can obtain one at http://mozilla.org/MPL/2.0/. */ + +#include "prerror.h" +#include "secerr.h" +#include "sslerr.h" +#include "seccomon.h" + +/* look at the current value of PR_GetError, and evaluate it to see + * if it is meaningful or meaningless (out of context). + * If it is meaningless, replace it with the hiLevelError. + * Returns the chosen error value. + */ +int +ssl_MapLowLevelError(int hiLevelError) +{ + int oldErr = PORT_GetError(); + + switch (oldErr) { + + case 0: + case PR_IO_ERROR: + case SEC_ERROR_IO: + case SEC_ERROR_BAD_DATA: + case SEC_ERROR_LIBRARY_FAILURE: + case SEC_ERROR_EXTENSION_NOT_FOUND: + case SSL_ERROR_BAD_CLIENT: + case SSL_ERROR_BAD_SERVER: + case SSL_ERROR_SESSION_NOT_FOUND: + PORT_SetError(hiLevelError); + return hiLevelError; + + default: /* leave the majority of error codes alone. */ + return oldErr; + } +} diff --git a/security/nss/lib/ssl/sslerr.h b/security/nss/lib/ssl/sslerr.h new file mode 100644 index 000000000..751c33541 --- /dev/null +++ b/security/nss/lib/ssl/sslerr.h @@ -0,0 +1,253 @@ +/* + * Enumeration of all SSL-specific error codes. + * + * This Source Code Form is subject to the terms of the Mozilla Public + * License, v. 2.0. If a copy of the MPL was not distributed with this + * file, You can obtain one at http://mozilla.org/MPL/2.0/. */ +#ifndef __SSL_ERR_H_ +#define __SSL_ERR_H_ + +/* clang-format off */ + +#define SSL_ERROR_BASE (-0x3000) +#define SSL_ERROR_LIMIT (SSL_ERROR_BASE + 1000) + +#define IS_SSL_ERROR(code) \ + (((code) >= SSL_ERROR_BASE) && ((code) < SSL_ERROR_LIMIT)) + +#ifndef NO_SECURITY_ERROR_ENUM +typedef enum { + SSL_ERROR_EXPORT_ONLY_SERVER = (SSL_ERROR_BASE + 0), + /* error 0 is obsolete */ + SSL_ERROR_US_ONLY_SERVER = (SSL_ERROR_BASE + 1), + /* error 1 is obsolete */ + SSL_ERROR_NO_CYPHER_OVERLAP = (SSL_ERROR_BASE + 2), + /* + * Received an alert reporting what we did wrong. (more alerts below) + */ + SSL_ERROR_NO_CERTIFICATE /*_ALERT */ = (SSL_ERROR_BASE + 3), + SSL_ERROR_BAD_CERTIFICATE = (SSL_ERROR_BASE + 4), + /* error 4 is obsolete */ + SSL_ERROR_UNUSED_5 = (SSL_ERROR_BASE + 5), + /* error 5 is obsolete */ + SSL_ERROR_BAD_CLIENT = (SSL_ERROR_BASE + 6), + SSL_ERROR_BAD_SERVER = (SSL_ERROR_BASE + 7), + SSL_ERROR_UNSUPPORTED_CERTIFICATE_TYPE = (SSL_ERROR_BASE + 8), + /* error 8 is obsolete */ + SSL_ERROR_UNSUPPORTED_VERSION = (SSL_ERROR_BASE + 9), + SSL_ERROR_UNUSED_10 = (SSL_ERROR_BASE + 10), + /* error 10 is obsolete */ + SSL_ERROR_WRONG_CERTIFICATE = (SSL_ERROR_BASE + 11), + /* error 11 is obsolete */ + SSL_ERROR_BAD_CERT_DOMAIN = (SSL_ERROR_BASE + 12), + SSL_ERROR_POST_WARNING = (SSL_ERROR_BASE + 13), + /* error 13 is obsolete */ + SSL_ERROR_SSL2_DISABLED = (SSL_ERROR_BASE + 14), + /* error 14 is obsolete */ + SSL_ERROR_BAD_MAC_READ = (SSL_ERROR_BASE + 15), + /* + * Received an alert reporting what we did wrong. + * (two more alerts above, and many more below) + */ + SSL_ERROR_BAD_MAC_ALERT = (SSL_ERROR_BASE + 16), + SSL_ERROR_BAD_CERT_ALERT = (SSL_ERROR_BASE + 17), + SSL_ERROR_REVOKED_CERT_ALERT = (SSL_ERROR_BASE + 18), + SSL_ERROR_EXPIRED_CERT_ALERT = (SSL_ERROR_BASE + 19), + + SSL_ERROR_SSL_DISABLED = (SSL_ERROR_BASE + 20), + SSL_ERROR_FORTEZZA_PQG = (SSL_ERROR_BASE + 21), + /* error 21 is obsolete */ + SSL_ERROR_UNKNOWN_CIPHER_SUITE = (SSL_ERROR_BASE + 22), + SSL_ERROR_NO_CIPHERS_SUPPORTED = (SSL_ERROR_BASE + 23), + SSL_ERROR_BAD_BLOCK_PADDING = (SSL_ERROR_BASE + 24), + SSL_ERROR_RX_RECORD_TOO_LONG = (SSL_ERROR_BASE + 25), + SSL_ERROR_TX_RECORD_TOO_LONG = (SSL_ERROR_BASE + 26), + /* + * Received a malformed (too long or short) SSL handshake. + */ + SSL_ERROR_RX_MALFORMED_HELLO_REQUEST = (SSL_ERROR_BASE + 27), + SSL_ERROR_RX_MALFORMED_CLIENT_HELLO = (SSL_ERROR_BASE + 28), + SSL_ERROR_RX_MALFORMED_SERVER_HELLO = (SSL_ERROR_BASE + 29), + SSL_ERROR_RX_MALFORMED_CERTIFICATE = (SSL_ERROR_BASE + 30), + SSL_ERROR_RX_MALFORMED_SERVER_KEY_EXCH = (SSL_ERROR_BASE + 31), + SSL_ERROR_RX_MALFORMED_CERT_REQUEST = (SSL_ERROR_BASE + 32), + SSL_ERROR_RX_MALFORMED_HELLO_DONE = (SSL_ERROR_BASE + 33), + SSL_ERROR_RX_MALFORMED_CERT_VERIFY = (SSL_ERROR_BASE + 34), + SSL_ERROR_RX_MALFORMED_CLIENT_KEY_EXCH = (SSL_ERROR_BASE + 35), + SSL_ERROR_RX_MALFORMED_FINISHED = (SSL_ERROR_BASE + 36), + /* + * Received a malformed (too long or short) SSL record. + */ + SSL_ERROR_RX_MALFORMED_CHANGE_CIPHER = (SSL_ERROR_BASE + 37), + SSL_ERROR_RX_MALFORMED_ALERT = (SSL_ERROR_BASE + 38), + SSL_ERROR_RX_MALFORMED_HANDSHAKE = (SSL_ERROR_BASE + 39), + SSL_ERROR_RX_MALFORMED_APPLICATION_DATA = (SSL_ERROR_BASE + 40), + /* + * Received an SSL handshake that was inappropriate for the state we're in. + * E.g. Server received message from server, or wrong state in state machine. + */ + SSL_ERROR_RX_UNEXPECTED_HELLO_REQUEST = (SSL_ERROR_BASE + 41), + SSL_ERROR_RX_UNEXPECTED_CLIENT_HELLO = (SSL_ERROR_BASE + 42), + SSL_ERROR_RX_UNEXPECTED_SERVER_HELLO = (SSL_ERROR_BASE + 43), + SSL_ERROR_RX_UNEXPECTED_CERTIFICATE = (SSL_ERROR_BASE + 44), + SSL_ERROR_RX_UNEXPECTED_SERVER_KEY_EXCH = (SSL_ERROR_BASE + 45), + SSL_ERROR_RX_UNEXPECTED_CERT_REQUEST = (SSL_ERROR_BASE + 46), + SSL_ERROR_RX_UNEXPECTED_HELLO_DONE = (SSL_ERROR_BASE + 47), + SSL_ERROR_RX_UNEXPECTED_CERT_VERIFY = (SSL_ERROR_BASE + 48), + SSL_ERROR_RX_UNEXPECTED_CLIENT_KEY_EXCH = (SSL_ERROR_BASE + 49), + SSL_ERROR_RX_UNEXPECTED_FINISHED = (SSL_ERROR_BASE + 50), + /* + * Received an SSL record that was inappropriate for the state we're in. + */ + SSL_ERROR_RX_UNEXPECTED_CHANGE_CIPHER = (SSL_ERROR_BASE + 51), + SSL_ERROR_RX_UNEXPECTED_ALERT = (SSL_ERROR_BASE + 52), + SSL_ERROR_RX_UNEXPECTED_HANDSHAKE = (SSL_ERROR_BASE + 53), + SSL_ERROR_RX_UNEXPECTED_APPLICATION_DATA = (SSL_ERROR_BASE + 54), + /* + * Received record/message with unknown discriminant. + */ + SSL_ERROR_RX_UNKNOWN_RECORD_TYPE = (SSL_ERROR_BASE + 55), + SSL_ERROR_RX_UNKNOWN_HANDSHAKE = (SSL_ERROR_BASE + 56), + SSL_ERROR_RX_UNKNOWN_ALERT = (SSL_ERROR_BASE + 57), + /* + * Received an alert reporting what we did wrong. (more alerts above) + */ + SSL_ERROR_CLOSE_NOTIFY_ALERT = (SSL_ERROR_BASE + 58), + SSL_ERROR_HANDSHAKE_UNEXPECTED_ALERT = (SSL_ERROR_BASE + 59), + SSL_ERROR_DECOMPRESSION_FAILURE_ALERT = (SSL_ERROR_BASE + 60), + SSL_ERROR_HANDSHAKE_FAILURE_ALERT = (SSL_ERROR_BASE + 61), + SSL_ERROR_ILLEGAL_PARAMETER_ALERT = (SSL_ERROR_BASE + 62), + SSL_ERROR_UNSUPPORTED_CERT_ALERT = (SSL_ERROR_BASE + 63), + SSL_ERROR_CERTIFICATE_UNKNOWN_ALERT = (SSL_ERROR_BASE + 64), + + SSL_ERROR_GENERATE_RANDOM_FAILURE = (SSL_ERROR_BASE + 65), + SSL_ERROR_SIGN_HASHES_FAILURE = (SSL_ERROR_BASE + 66), + SSL_ERROR_EXTRACT_PUBLIC_KEY_FAILURE = (SSL_ERROR_BASE + 67), + SSL_ERROR_SERVER_KEY_EXCHANGE_FAILURE = (SSL_ERROR_BASE + 68), + SSL_ERROR_CLIENT_KEY_EXCHANGE_FAILURE = (SSL_ERROR_BASE + 69), + + SSL_ERROR_ENCRYPTION_FAILURE = (SSL_ERROR_BASE + 70), + SSL_ERROR_DECRYPTION_FAILURE = (SSL_ERROR_BASE + 71), + /* error 71 is obsolete */ + SSL_ERROR_SOCKET_WRITE_FAILURE = (SSL_ERROR_BASE + 72), + + SSL_ERROR_MD5_DIGEST_FAILURE = (SSL_ERROR_BASE + 73), + SSL_ERROR_SHA_DIGEST_FAILURE = (SSL_ERROR_BASE + 74), + SSL_ERROR_MAC_COMPUTATION_FAILURE = (SSL_ERROR_BASE + 75), + SSL_ERROR_SYM_KEY_CONTEXT_FAILURE = (SSL_ERROR_BASE + 76), + SSL_ERROR_SYM_KEY_UNWRAP_FAILURE = (SSL_ERROR_BASE + 77), + SSL_ERROR_PUB_KEY_SIZE_LIMIT_EXCEEDED = (SSL_ERROR_BASE + 78), + /* error 78 is obsolete */ + SSL_ERROR_IV_PARAM_FAILURE = (SSL_ERROR_BASE + 79), + SSL_ERROR_INIT_CIPHER_SUITE_FAILURE = (SSL_ERROR_BASE + 80), + SSL_ERROR_SESSION_KEY_GEN_FAILURE = (SSL_ERROR_BASE + 81), + SSL_ERROR_NO_SERVER_KEY_FOR_ALG = (SSL_ERROR_BASE + 82), + SSL_ERROR_TOKEN_INSERTION_REMOVAL = (SSL_ERROR_BASE + 83), + SSL_ERROR_TOKEN_SLOT_NOT_FOUND = (SSL_ERROR_BASE + 84), + SSL_ERROR_NO_COMPRESSION_OVERLAP = (SSL_ERROR_BASE + 85), + SSL_ERROR_HANDSHAKE_NOT_COMPLETED = (SSL_ERROR_BASE + 86), + SSL_ERROR_BAD_HANDSHAKE_HASH_VALUE = (SSL_ERROR_BASE + 87), + SSL_ERROR_CERT_KEA_MISMATCH = (SSL_ERROR_BASE + 88), + SSL_ERROR_NO_TRUSTED_SSL_CLIENT_CA = (SSL_ERROR_BASE + 89), + /* error 89 is obsolete */ + SSL_ERROR_SESSION_NOT_FOUND = (SSL_ERROR_BASE + 90), + + SSL_ERROR_DECRYPTION_FAILED_ALERT = (SSL_ERROR_BASE + 91), + SSL_ERROR_RECORD_OVERFLOW_ALERT = (SSL_ERROR_BASE + 92), + SSL_ERROR_UNKNOWN_CA_ALERT = (SSL_ERROR_BASE + 93), + SSL_ERROR_ACCESS_DENIED_ALERT = (SSL_ERROR_BASE + 94), + SSL_ERROR_DECODE_ERROR_ALERT = (SSL_ERROR_BASE + 95), + SSL_ERROR_DECRYPT_ERROR_ALERT = (SSL_ERROR_BASE + 96), + SSL_ERROR_EXPORT_RESTRICTION_ALERT = (SSL_ERROR_BASE + 97), + SSL_ERROR_PROTOCOL_VERSION_ALERT = (SSL_ERROR_BASE + 98), + SSL_ERROR_INSUFFICIENT_SECURITY_ALERT = (SSL_ERROR_BASE + 99), + SSL_ERROR_INTERNAL_ERROR_ALERT = (SSL_ERROR_BASE + 100), + SSL_ERROR_USER_CANCELED_ALERT = (SSL_ERROR_BASE + 101), + SSL_ERROR_NO_RENEGOTIATION_ALERT = (SSL_ERROR_BASE + 102), + + SSL_ERROR_SERVER_CACHE_NOT_CONFIGURED = (SSL_ERROR_BASE + 103), + + SSL_ERROR_UNSUPPORTED_EXTENSION_ALERT = (SSL_ERROR_BASE + 104), + SSL_ERROR_CERTIFICATE_UNOBTAINABLE_ALERT = (SSL_ERROR_BASE + 105), + SSL_ERROR_UNRECOGNIZED_NAME_ALERT = (SSL_ERROR_BASE + 106), + SSL_ERROR_BAD_CERT_STATUS_RESPONSE_ALERT = (SSL_ERROR_BASE + 107), + SSL_ERROR_BAD_CERT_HASH_VALUE_ALERT = (SSL_ERROR_BASE + 108), + + SSL_ERROR_RX_UNEXPECTED_NEW_SESSION_TICKET = (SSL_ERROR_BASE + 109), + SSL_ERROR_RX_MALFORMED_NEW_SESSION_TICKET = (SSL_ERROR_BASE + 110), + + SSL_ERROR_DECOMPRESSION_FAILURE = (SSL_ERROR_BASE + 111), + SSL_ERROR_RENEGOTIATION_NOT_ALLOWED = (SSL_ERROR_BASE + 112), + SSL_ERROR_UNSAFE_NEGOTIATION = (SSL_ERROR_BASE + 113), + + SSL_ERROR_RX_UNEXPECTED_UNCOMPRESSED_RECORD = (SSL_ERROR_BASE + 114), + + SSL_ERROR_WEAK_SERVER_EPHEMERAL_DH_KEY = (SSL_ERROR_BASE + 115), + + SSL_ERROR_NEXT_PROTOCOL_DATA_INVALID = (SSL_ERROR_BASE + 116), + + SSL_ERROR_FEATURE_NOT_SUPPORTED_FOR_SSL2 = (SSL_ERROR_BASE + 117), + /* error 117 is obsolete */ + SSL_ERROR_FEATURE_NOT_SUPPORTED_FOR_SERVERS = (SSL_ERROR_BASE + 118), + SSL_ERROR_FEATURE_NOT_SUPPORTED_FOR_CLIENTS = (SSL_ERROR_BASE + 119), + + SSL_ERROR_INVALID_VERSION_RANGE = (SSL_ERROR_BASE + 120), + SSL_ERROR_CIPHER_DISALLOWED_FOR_VERSION = (SSL_ERROR_BASE + 121), + + SSL_ERROR_RX_MALFORMED_HELLO_VERIFY_REQUEST = (SSL_ERROR_BASE + 122), + SSL_ERROR_RX_UNEXPECTED_HELLO_VERIFY_REQUEST = (SSL_ERROR_BASE + 123), + + SSL_ERROR_FEATURE_NOT_SUPPORTED_FOR_VERSION = (SSL_ERROR_BASE + 124), + + SSL_ERROR_RX_UNEXPECTED_CERT_STATUS = (SSL_ERROR_BASE + 125), + + SSL_ERROR_UNSUPPORTED_HASH_ALGORITHM = (SSL_ERROR_BASE + 126), + SSL_ERROR_DIGEST_FAILURE = (SSL_ERROR_BASE + 127), + SSL_ERROR_INCORRECT_SIGNATURE_ALGORITHM = (SSL_ERROR_BASE + 128), + + SSL_ERROR_NEXT_PROTOCOL_NO_CALLBACK = (SSL_ERROR_BASE + 129), + SSL_ERROR_NEXT_PROTOCOL_NO_PROTOCOL = (SSL_ERROR_BASE + 130), + + SSL_ERROR_INAPPROPRIATE_FALLBACK_ALERT = (SSL_ERROR_BASE + 131), + + SSL_ERROR_WEAK_SERVER_CERT_KEY = (SSL_ERROR_BASE + 132), + + SSL_ERROR_RX_SHORT_DTLS_READ = (SSL_ERROR_BASE + 133), + + SSL_ERROR_NO_SUPPORTED_SIGNATURE_ALGORITHM = (SSL_ERROR_BASE + 134), + SSL_ERROR_UNSUPPORTED_SIGNATURE_ALGORITHM = (SSL_ERROR_BASE + 135), + + SSL_ERROR_MISSING_EXTENDED_MASTER_SECRET = (SSL_ERROR_BASE + 136), + SSL_ERROR_UNEXPECTED_EXTENDED_MASTER_SECRET = (SSL_ERROR_BASE + 137), + + SSL_ERROR_RX_MALFORMED_KEY_SHARE = (SSL_ERROR_BASE + 138), + SSL_ERROR_MISSING_KEY_SHARE = (SSL_ERROR_BASE + 139), + SSL_ERROR_RX_MALFORMED_ECDHE_KEY_SHARE = (SSL_ERROR_BASE + 140), + SSL_ERROR_RX_MALFORMED_DHE_KEY_SHARE = (SSL_ERROR_BASE + 141), + + SSL_ERROR_RX_UNEXPECTED_ENCRYPTED_EXTENSIONS = (SSL_ERROR_BASE + 142), + SSL_ERROR_MISSING_EXTENSION_ALERT = (SSL_ERROR_BASE + 143), + + SSL_ERROR_KEY_EXCHANGE_FAILURE = (SSL_ERROR_BASE + 144), + SSL_ERROR_EXTENSION_DISALLOWED_FOR_VERSION = (SSL_ERROR_BASE + 145), + SSL_ERROR_RX_MALFORMED_ENCRYPTED_EXTENSIONS = (SSL_ERROR_BASE + 146), + SSL_ERROR_MALFORMED_PRE_SHARED_KEY = (SSL_ERROR_BASE + 147), + SSL_ERROR_MALFORMED_EARLY_DATA = (SSL_ERROR_BASE + 148), + SSL_ERROR_END_OF_EARLY_DATA_ALERT = (SSL_ERROR_BASE + 149), + SSL_ERROR_MISSING_ALPN_EXTENSION = (SSL_ERROR_BASE + 150), + SSL_ERROR_RX_UNEXPECTED_EXTENSION = (SSL_ERROR_BASE + 151), + SSL_ERROR_MISSING_SUPPORTED_GROUPS_EXTENSION = (SSL_ERROR_BASE + 152), + SSL_ERROR_TOO_MANY_RECORDS = (SSL_ERROR_BASE + 153), + SSL_ERROR_RX_UNEXPECTED_HELLO_RETRY_REQUEST = (SSL_ERROR_BASE + 154), + SSL_ERROR_RX_MALFORMED_HELLO_RETRY_REQUEST = (SSL_ERROR_BASE + 155), + SSL_ERROR_BAD_2ND_CLIENT_HELLO = (SSL_ERROR_BASE + 156), + SSL_ERROR_MISSING_SIGNATURE_ALGORITHMS_EXTENSION = (SSL_ERROR_BASE + 157), + SSL_ERROR_MALFORMED_PSK_KEY_EXCHANGE_MODES = (SSL_ERROR_BASE + 158), + SSL_ERROR_MISSING_PSK_KEY_EXCHANGE_MODES = (SSL_ERROR_BASE + 159), + SSL_ERROR_END_OF_LIST /* let the c compiler determine the value of this. */ +} SSLErrorCodes; +#endif /* NO_SECURITY_ERROR_ENUM */ + +/* clang-format on */ + +#endif /* __SSL_ERR_H_ */ diff --git a/security/nss/lib/ssl/sslerrstrs.c b/security/nss/lib/ssl/sslerrstrs.c new file mode 100644 index 000000000..4e3db6d73 --- /dev/null +++ b/security/nss/lib/ssl/sslerrstrs.c @@ -0,0 +1,36 @@ +/* This Source Code Form is subject to the terms of the Mozilla Public + * License, v. 2.0. If a copy of the MPL was not distributed with this + * file, You can obtain one at http://mozilla.org/MPL/2.0/. */ +#include "prerror.h" +#include "sslerr.h" +#include "prinit.h" +#include "nssutil.h" +#include "ssl.h" + +#define ER3(name, value, str) { #name, str }, + +static const struct PRErrorMessage ssltext[] = { +#include "SSLerrs.h" + { 0, 0 } +}; + +static const struct PRErrorTable ssl_et = { + ssltext, "sslerr", SSL_ERROR_BASE, + (sizeof ssltext) / (sizeof ssltext[0]) +}; + +static PRStatus +ssl_InitializePRErrorTableOnce(void) +{ + return PR_ErrorInstallTable(&ssl_et); +} + +static PRCallOnceType once; + +SECStatus +ssl_InitializePRErrorTable(void) +{ + return (PR_SUCCESS == PR_CallOnce(&once, ssl_InitializePRErrorTableOnce)) + ? SECSuccess + : SECFailure; +} diff --git a/security/nss/lib/ssl/sslgrp.c b/security/nss/lib/ssl/sslgrp.c new file mode 100644 index 000000000..eb53ad381 --- /dev/null +++ b/security/nss/lib/ssl/sslgrp.c @@ -0,0 +1,164 @@ +/* -*- Mode: C; tab-width: 8; indent-tabs-mode: nil; c-basic-offset: 4 -*- */ +/* + * This file contains prototypes for the public SSL functions. + * + * This Source Code Form is subject to the terms of the Mozilla Public + * License, v. 2.0. If a copy of the MPL was not distributed with this + * file, You can obtain one at http://mozilla.org/MPL/2.0/. */ + +#include "nss.h" +#include "pk11func.h" +#include "ssl.h" +#include "sslimpl.h" + +struct { + sslEphemeralKeyPair *keyPair; + PRCallOnceType once; +} gECDHEKeyPairs[SSL_NAMED_GROUP_COUNT]; + +typedef struct sslSocketAndGroupArgStr { + const sslNamedGroupDef *group; + const sslSocket *ss; +} sslSocketAndGroupArg; + +/* Function to clear out the ECDHE keys. */ +static SECStatus +ssl_CleanupECDHEKeys(void *appData, void *nssData) +{ + unsigned int i; + + for (i = 0; i < SSL_NAMED_GROUP_COUNT; i++) { + if (gECDHEKeyPairs[i].keyPair) { + ssl_FreeEphemeralKeyPair(gECDHEKeyPairs[i].keyPair); + } + } + memset(gECDHEKeyPairs, 0, sizeof(gECDHEKeyPairs)); + return SECSuccess; +} + +/* Only run the cleanup once. */ +static PRCallOnceType cleanupECDHEKeysOnce; +static PRStatus +ssl_SetupCleanupECDHEKeysOnce(void) +{ + SECStatus rv = NSS_RegisterShutdown(ssl_CleanupECDHEKeys, NULL); + return (rv != SECSuccess) ? PR_FAILURE : PR_SUCCESS; +} + +/* This creates a key pair for each of the supported EC groups. If that works, + * we assume that the token supports that group. Since this is relatively + * expensive, this is only done for the first socket that is used. That means + * that if tokens are added or removed, then this will not pick up any changes. + */ +static PRStatus +ssl_CreateStaticECDHEKeyPair(void *arg) +{ + const sslSocketAndGroupArg *typed_arg = (sslSocketAndGroupArg *)arg; + const sslNamedGroupDef *group = typed_arg->group; + const sslSocket *ss = typed_arg->ss; + unsigned int i = group - ssl_named_groups; + SECStatus rv; + + PORT_Assert(group->keaType == ssl_kea_ecdh); + PORT_Assert(i < SSL_NAMED_GROUP_COUNT); + rv = ssl_CreateECDHEphemeralKeyPair(ss, group, + &gECDHEKeyPairs[i].keyPair); + if (rv != SECSuccess) { + gECDHEKeyPairs[i].keyPair = NULL; + SSL_TRC(5, ("%d: SSL[-]: disabling group %d", + SSL_GETPID(), group->name)); + } + + return PR_SUCCESS; +} + +void +ssl_FilterSupportedGroups(sslSocket *ss) +{ + unsigned int i; + PRStatus prv; + sslSocketAndGroupArg arg = { NULL, ss }; + + prv = PR_CallOnce(&cleanupECDHEKeysOnce, ssl_SetupCleanupECDHEKeysOnce); + PORT_Assert(prv == PR_SUCCESS); + if (prv != PR_SUCCESS) { + return; + } + + for (i = 0; i < SSL_NAMED_GROUP_COUNT; ++i) { + PRUint32 policy; + SECStatus srv; + unsigned int index; + const sslNamedGroupDef *group = ss->namedGroupPreferences[i]; + if (!group) { + continue; + } + + srv = NSS_GetAlgorithmPolicy(group->oidTag, &policy); + if (srv == SECSuccess && !(policy & NSS_USE_ALG_IN_SSL_KX)) { + ss->namedGroupPreferences[i] = NULL; + continue; + } + + if (group->assumeSupported) { + continue; + } + + /* For EC groups, we have to test that a key pair can be created. This + * is gross, and expensive, so only do it once. */ + index = group - ssl_named_groups; + PORT_Assert(index < SSL_NAMED_GROUP_COUNT); + + arg.group = group; + prv = PR_CallOnceWithArg(&gECDHEKeyPairs[index].once, + ssl_CreateStaticECDHEKeyPair, + (void *)&arg); + PORT_Assert(prv == PR_SUCCESS); + if (prv != PR_SUCCESS) { + continue; + } + + if (!gECDHEKeyPairs[index].keyPair) { + ss->namedGroupPreferences[i] = NULL; + } + } +} + +/* + * Creates the static "ephemeral" public and private ECDH keys used by server in + * ECDHE_RSA and ECDHE_ECDSA handshakes when we reuse the same key. + */ +SECStatus +ssl_CreateStaticECDHEKey(sslSocket *ss, const sslNamedGroupDef *ecGroup) +{ + sslEphemeralKeyPair *keyPair; + /* We index gECDHEKeyPairs by the named group. Pointer arithmetic! */ + unsigned int index = ecGroup - ssl_named_groups; + PRStatus prv; + sslSocketAndGroupArg arg = { ecGroup, ss }; + + prv = PR_CallOnceWithArg(&gECDHEKeyPairs[index].once, + ssl_CreateStaticECDHEKeyPair, + (void *)&arg); + PORT_Assert(prv == PR_SUCCESS); + if (prv != PR_SUCCESS) { + PORT_SetError(SEC_ERROR_LIBRARY_FAILURE); + return SECFailure; + } + + keyPair = gECDHEKeyPairs[index].keyPair; + if (!keyPair) { + /* Attempting to use a key pair for an unsupported group. */ + PORT_Assert(keyPair); + PORT_SetError(SEC_ERROR_LIBRARY_FAILURE); + return SECFailure; + } + + keyPair = ssl_CopyEphemeralKeyPair(keyPair); + if (!keyPair) + return SECFailure; + + PORT_Assert(PR_CLIST_IS_EMPTY(&ss->ephemeralKeyPairs)); + PR_APPEND_LINK(&keyPair->link, &ss->ephemeralKeyPairs); + return SECSuccess; +} diff --git a/security/nss/lib/ssl/sslimpl.h b/security/nss/lib/ssl/sslimpl.h new file mode 100644 index 000000000..09c37832a --- /dev/null +++ b/security/nss/lib/ssl/sslimpl.h @@ -0,0 +1,1872 @@ +/* -*- Mode: C; tab-width: 8; indent-tabs-mode: nil; c-basic-offset: 4 -*- */ +/* + * This file is PRIVATE to SSL and should be the first thing included by + * any SSL implementation file. + * + * This Source Code Form is subject to the terms of the Mozilla Public + * License, v. 2.0. If a copy of the MPL was not distributed with this + * file, You can obtain one at http://mozilla.org/MPL/2.0/. */ + +#ifndef __sslimpl_h_ +#define __sslimpl_h_ + +#ifdef DEBUG +#undef NDEBUG +#else +#undef NDEBUG +#define NDEBUG +#endif +#include "secport.h" +#include "secerr.h" +#include "sslerr.h" +#include "ssl3prot.h" +#include "hasht.h" +#include "nssilock.h" +#include "pkcs11t.h" +#if defined(XP_UNIX) || defined(XP_BEOS) +#include "unistd.h" +#endif +#include "nssrwlk.h" +#include "prthread.h" +#include "prclist.h" +#include "private/pprthred.h" + +#include "sslt.h" /* for some formerly private types, now public */ + +typedef struct sslSocketStr sslSocket; + +#include "ssl3ext.h" + +/* to make some of these old enums public without namespace pollution, +** it was necessary to prepend ssl_ to the names. +** These #defines preserve compatibility with the old code here in libssl. +*/ +typedef SSLMACAlgorithm SSL3MACAlgorithm; + +#define calg_null ssl_calg_null +#define calg_rc4 ssl_calg_rc4 +#define calg_rc2 ssl_calg_rc2 +#define calg_des ssl_calg_des +#define calg_3des ssl_calg_3des +#define calg_idea ssl_calg_idea +#define calg_fortezza ssl_calg_fortezza /* deprecated, must preserve */ +#define calg_aes ssl_calg_aes +#define calg_camellia ssl_calg_camellia +#define calg_seed ssl_calg_seed +#define calg_aes_gcm ssl_calg_aes_gcm +#define calg_chacha20 ssl_calg_chacha20 + +#define mac_null ssl_mac_null +#define mac_md5 ssl_mac_md5 +#define mac_sha ssl_mac_sha +#define hmac_md5 ssl_hmac_md5 +#define hmac_sha ssl_hmac_sha +#define hmac_sha256 ssl_hmac_sha256 +#define hmac_sha384 ssl_hmac_sha384 +#define mac_aead ssl_mac_aead + +#if defined(DEBUG) || defined(TRACE) +#ifdef __cplusplus +#define Debug 1 +#else +extern int Debug; +#endif +#else +#undef Debug +#endif + +#if defined(DEBUG) && !defined(TRACE) && !defined(NISCC_TEST) +#define TRACE +#endif + +#ifdef TRACE +#define SSL_TRC(a, b) \ + if (ssl_trace >= (a)) \ + ssl_Trace b +#define PRINT_BUF(a, b) \ + if (ssl_trace >= (a)) \ + ssl_PrintBuf b +#define PRINT_KEY(a, b) \ + if (ssl_trace >= (a)) \ + ssl_PrintKey b +#else +#define SSL_TRC(a, b) +#define PRINT_BUF(a, b) +#define PRINT_KEY(a, b) +#endif + +#ifdef DEBUG +#define SSL_DBG(b) \ + if (ssl_debug) \ + ssl_Trace b +#else +#define SSL_DBG(b) +#endif + +#define LSB(x) ((unsigned char)((x)&0xff)) +#define MSB(x) ((unsigned char)(((unsigned)(x)) >> 8)) + +#define CONST_CAST(T, X) ((T *)(X)) + +/************************************************************************/ + +typedef enum { SSLAppOpRead = 0, + SSLAppOpWrite, + SSLAppOpRDWR, + SSLAppOpPost, + SSLAppOpHeader +} SSLAppOperation; + +#define SSL3_SESSIONID_BYTES 32 + +#define SSL_MIN_CHALLENGE_BYTES 16 +#define SSL_MAX_CHALLENGE_BYTES 32 + +#define SSL3_MASTER_SECRET_LENGTH 48 + +/* number of wrap mechanisms potentially used to wrap master secrets. */ +#define SSL_NUM_WRAP_MECHS 16 + +/* This makes the cert cache entry exactly 4k. */ +#define SSL_MAX_CACHED_CERT_LEN 4060 + +#ifndef BPB +#define BPB 8 /* Bits Per Byte */ +#endif + +/* The default value from RFC 4347 is 1s, which is too slow. */ +#define DTLS_RETRANSMIT_INITIAL_MS 50 +/* The maximum time to wait between retransmissions. */ +#define DTLS_RETRANSMIT_MAX_MS 10000 +/* Time to wait in FINISHED state for retransmissions. */ +#define DTLS_RETRANSMIT_FINISHED_MS 30000 + +/* default number of entries in namedGroupPreferences */ +#define SSL_NAMED_GROUP_COUNT 31 + +/* Types and names of elliptic curves used in TLS */ +typedef enum { + ec_type_explicitPrime = 1, /* not supported */ + ec_type_explicitChar2Curve = 2, /* not supported */ + ec_type_named = 3 +} ECType; + +typedef enum { + ticket_allow_early_data = 1, + ticket_allow_psk_ke = 2, + ticket_allow_psk_dhe_ke = 4, + ticket_allow_psk_auth = 8, + ticket_allow_psk_sign_auth = 16 +} TLS13SessionTicketFlags; + +typedef struct { + /* The name is the value that is encoded on the wire in TLS. */ + SSLNamedGroup name; + /* The number of bits in the group. */ + unsigned int bits; + /* The key exchange algorithm this group provides. */ + SSLKEAType keaType; + /* The OID that identifies the group to PKCS11. This also determines + * whether the group is enabled in policy. */ + SECOidTag oidTag; + /* Assume that the group is always supported. */ + PRBool assumeSupported; +} sslNamedGroupDef; + +typedef struct sslBufferStr sslBuffer; +typedef struct sslConnectInfoStr sslConnectInfo; +typedef struct sslGatherStr sslGather; +typedef struct sslSecurityInfoStr sslSecurityInfo; +typedef struct sslSessionIDStr sslSessionID; +typedef struct sslSocketOpsStr sslSocketOps; + +typedef struct ssl3StateStr ssl3State; +typedef struct ssl3CertNodeStr ssl3CertNode; +typedef struct ssl3BulkCipherDefStr ssl3BulkCipherDef; +typedef struct ssl3MACDefStr ssl3MACDef; +typedef struct sslKeyPairStr sslKeyPair; +typedef struct ssl3DHParamsStr ssl3DHParams; + +struct ssl3CertNodeStr { + struct ssl3CertNodeStr *next; + CERTCertificate *cert; +}; + +typedef SECStatus (*sslHandshakeFunc)(sslSocket *ss); + +typedef void (*sslSessionIDCacheFunc)(sslSessionID *sid); +typedef void (*sslSessionIDUncacheFunc)(sslSessionID *sid); +typedef sslSessionID *(*sslSessionIDLookupFunc)(const PRIPv6Addr *addr, + unsigned char *sid, + unsigned int sidLen, + CERTCertDBHandle *dbHandle); + +/* Socket ops */ +struct sslSocketOpsStr { + int (*connect)(sslSocket *, const PRNetAddr *); + PRFileDesc *(*accept)(sslSocket *, PRNetAddr *); + int (*bind)(sslSocket *, const PRNetAddr *); + int (*listen)(sslSocket *, int); + int (*shutdown)(sslSocket *, int); + int (*close)(sslSocket *); + + int (*recv)(sslSocket *, unsigned char *, int, int); + + /* points to the higher-layer send func, e.g. ssl_SecureSend. */ + int (*send)(sslSocket *, const unsigned char *, int, int); + int (*read)(sslSocket *, unsigned char *, int); + int (*write)(sslSocket *, const unsigned char *, int); + + int (*getpeername)(sslSocket *, PRNetAddr *); + int (*getsockname)(sslSocket *, PRNetAddr *); +}; + +/* Flags interpreted by ssl send functions. */ +#define ssl_SEND_FLAG_FORCE_INTO_BUFFER 0x40000000 +#define ssl_SEND_FLAG_NO_BUFFER 0x20000000 +#define ssl_SEND_FLAG_NO_RETRANSMIT 0x08000000 /* DTLS only */ +#define ssl_SEND_FLAG_CAP_RECORD_VERSION \ + 0x04000000 /* TLS only */ +#define ssl_SEND_FLAG_MASK 0x7f000000 + +/* +** A buffer object. +*/ +struct sslBufferStr { + unsigned char *buf; + unsigned int len; + unsigned int space; +}; + +/* +** SSL3 cipher suite policy and preference struct. +*/ +typedef struct { +#if !defined(_WIN32) + unsigned int cipher_suite : 16; + unsigned int policy : 8; + unsigned int enabled : 1; + unsigned int isPresent : 1; +#else + ssl3CipherSuite cipher_suite; + PRUint8 policy; + unsigned char enabled : 1; + unsigned char isPresent : 1; +#endif +} ssl3CipherSuiteCfg; + +#define ssl_V3_SUITES_IMPLEMENTED 71 + +#define MAX_DTLS_SRTP_CIPHER_SUITES 4 + +/* MAX_SIGNATURE_SCHEMES allows for all the values we support. */ +#define MAX_SIGNATURE_SCHEMES 15 + +typedef struct sslOptionsStr { + /* If SSL_SetNextProtoNego has been called, then this contains the + * list of supported protocols. */ + SECItem nextProtoNego; + + unsigned int useSecurity : 1; + unsigned int useSocks : 1; + unsigned int requestCertificate : 1; + unsigned int requireCertificate : 2; + unsigned int handshakeAsClient : 1; + unsigned int handshakeAsServer : 1; + unsigned int noCache : 1; + unsigned int fdx : 1; + unsigned int detectRollBack : 1; + unsigned int noLocks : 1; + unsigned int enableSessionTickets : 1; + unsigned int enableDeflate : 1; + unsigned int enableRenegotiation : 2; + unsigned int requireSafeNegotiation : 1; + unsigned int enableFalseStart : 1; + unsigned int cbcRandomIV : 1; + unsigned int enableOCSPStapling : 1; + unsigned int enableNPN : 1; + unsigned int enableALPN : 1; + unsigned int reuseServerECDHEKey : 1; + unsigned int enableFallbackSCSV : 1; + unsigned int enableServerDhe : 1; + unsigned int enableExtendedMS : 1; + unsigned int enableSignedCertTimestamps : 1; + unsigned int requireDHENamedGroups : 1; + unsigned int enable0RttData : 1; + unsigned int enableShortHeaders : 1; +} sslOptions; + +typedef enum { sslHandshakingUndetermined = 0, + sslHandshakingAsClient, + sslHandshakingAsServer +} sslHandshakingType; + +#define SSL_LOCK_RANK_SPEC 255 + +/* These are the valid values for shutdownHow. +** These values are each 1 greater than the NSPR values, and the code +** depends on that relation to efficiently convert PR_SHUTDOWN values +** into ssl_SHUTDOWN values. These values use one bit for read, and +** another bit for write, and can be used as bitmasks. +*/ +#define ssl_SHUTDOWN_NONE 0 /* NOT shutdown at all */ +#define ssl_SHUTDOWN_RCV 1 /* PR_SHUTDOWN_RCV +1 */ +#define ssl_SHUTDOWN_SEND 2 /* PR_SHUTDOWN_SEND +1 */ +#define ssl_SHUTDOWN_BOTH 3 /* PR_SHUTDOWN_BOTH +1 */ + +/* +** A gather object. Used to read some data until a count has been +** satisfied. Primarily for support of async sockets. +** Everything in here is protected by the recvBufLock. +*/ +struct sslGatherStr { + int state; /* see GS_ values below. */ + + /* "buf" holds received plaintext SSL records, after decrypt and MAC check. + * recv'd ciphertext records are put in inbuf (see below), then decrypted + * into buf. + */ + sslBuffer buf; /*recvBufLock*/ + + /* number of bytes previously read into hdr or inbuf. + ** (offset - writeOffset) is the number of ciphertext bytes read in but + ** not yet deciphered. + */ + unsigned int offset; + + /* number of bytes to read in next call to ssl_DefRecv (recv) */ + unsigned int remainder; + + /* DoRecv uses the next two values to extract application data. + ** The difference between writeOffset and readOffset is the amount of + ** data available to the application. Note that the actual offset of + ** the data in "buf" is recordOffset (above), not readOffset. + ** In the current implementation, this is made available before the + ** MAC is checked!! + */ + unsigned int readOffset; /* Spot where DATA reader (e.g. application + ** or handshake code) will read next. + ** Always zero for SSl3 application data. + */ + /* offset in buf/inbuf/hdr into which new data will be read from socket. */ + unsigned int writeOffset; + + /* Buffer for ssl3 to read (encrypted) data from the socket */ + sslBuffer inbuf; /*recvBufLock*/ + + /* The ssl[23]_GatherData functions read data into this buffer, rather + ** than into buf or inbuf, while in the GS_HEADER state. + ** The portion of the SSL record header put here always comes off the wire + ** as plaintext, never ciphertext. + ** For SSL3/TLS, the plaintext portion is 5 bytes long. For DTLS it is 13. + */ + unsigned char hdr[13]; + + /* Buffer for DTLS data read off the wire as a single datagram */ + sslBuffer dtlsPacket; + + /* the start of the buffered DTLS record in dtlsPacket */ + unsigned int dtlsPacketOffset; +}; + +/* sslGather.state */ +#define GS_INIT 0 +#define GS_HEADER 1 +#define GS_DATA 2 + +/* +** ssl3State and CipherSpec structs +*/ + +/* The SSL bulk cipher definition */ +typedef enum { + cipher_null, + cipher_rc4, + cipher_des, + cipher_3des, + cipher_aes_128, + cipher_aes_256, + cipher_camellia_128, + cipher_camellia_256, + cipher_seed, + cipher_aes_128_gcm, + cipher_aes_256_gcm, + cipher_chacha20, + cipher_missing /* reserved for no such supported cipher */ + /* This enum must match ssl3_cipherName[] in ssl3con.c. */ +} SSL3BulkCipher; + +typedef enum { type_stream, + type_block, + type_aead } CipherType; + +#define MAX_IV_LENGTH 24 + +typedef PRUint64 sslSequenceNumber; +typedef PRUint16 DTLSEpoch; + +typedef void (*DTLSTimerCb)(sslSocket *); + +typedef struct { + SSL3Opaque wrapped_master_secret[48]; + PRUint16 wrapped_master_secret_len; + PRUint8 msIsWrapped; + PRUint8 resumable; + PRUint8 extendedMasterSecretUsed; +} ssl3SidKeys; /* 52 bytes */ + +typedef struct { + PK11SymKey *write_key; + PK11SymKey *write_mac_key; + PK11Context *write_mac_context; + SECItem write_key_item; + SECItem write_iv_item; + SECItem write_mac_key_item; + SSL3Opaque write_iv[MAX_IV_LENGTH]; +} ssl3KeyMaterial; + +typedef SECStatus (*SSLCipher)(void *context, + unsigned char *out, + int *outlen, + int maxout, + const unsigned char *in, + int inlen); +typedef SECStatus (*SSLAEADCipher)( + ssl3KeyMaterial *keys, + PRBool doDecrypt, + unsigned char *out, + int *outlen, + int maxout, + const unsigned char *in, + int inlen, + const unsigned char *additionalData, + int additionalDataLen); +typedef SECStatus (*SSLCompressor)(void *context, + unsigned char *out, + int *outlen, + int maxout, + const unsigned char *in, + int inlen); +typedef SECStatus (*SSLDestroy)(void *context, PRBool freeit); + +/* The DTLS anti-replay window in number of packets. Defined here because we + * need it in the cipher spec. Note that this is a ring buffer but left and + * right represent the true window, with modular arithmetic used to map them + * onto the buffer. + */ +#define DTLS_RECVD_RECORDS_WINDOW 1024 +#define RECORD_SEQ_MAX ((1ULL << 48) - 1) +PR_STATIC_ASSERT(DTLS_RECVD_RECORDS_WINDOW % 8 == 0); + +typedef struct DTLSRecvdRecordsStr { + unsigned char data[DTLS_RECVD_RECORDS_WINDOW / 8]; + sslSequenceNumber left; + sslSequenceNumber right; +} DTLSRecvdRecords; + +/* +** These are the "specs" in the "ssl3" struct. +** Access to the pointers to these specs, and all the specs' contents +** (direct and indirect) is protected by the reader/writer lock ss->specLock. +*/ +typedef struct { + PRCList link; + const ssl3BulkCipherDef *cipher_def; + const ssl3MACDef *mac_def; + SSLCompressionMethod compression_method; + int mac_size; + SSLCipher encode; + SSLCipher decode; + SSLAEADCipher aead; + void *encodeContext; + void *decodeContext; + SSLCompressor compressor; /* Don't name these fields compress */ + SSLCompressor decompressor; /* and uncompress because zconf.h */ + /* may define them as macros. */ + SSLDestroy destroyCompressContext; + void *compressContext; + SSLDestroy destroyDecompressContext; + void *decompressContext; + PK11SymKey *master_secret; + sslSequenceNumber write_seq_num; + sslSequenceNumber read_seq_num; + SSL3ProtocolVersion version; + ssl3KeyMaterial client; + ssl3KeyMaterial server; + SECItem msItem; + DTLSEpoch epoch; + DTLSRecvdRecords recvdRecords; + + PRUint8 refCt; + const char *phase; +} ssl3CipherSpec; + +typedef enum { never_cached, + in_client_cache, + in_server_cache, + invalid_cache /* no longer in any cache. */ +} Cached; + +#include "sslcert.h" + +struct sslSessionIDStr { + /* The global cache lock must be held when accessing these members when the + * sid is in any cache. + */ + sslSessionID *next; /* chain used for client sockets, only */ + Cached cached; + int references; + PRUint32 lastAccessTime; /* seconds since Jan 1, 1970 */ + + /* The rest of the members, except for the members of u.ssl3.locked, may + * be modified only when the sid is not in any cache. + */ + + CERTCertificate *peerCert; + SECItemArray peerCertStatus; /* client only */ + const char *peerID; /* client only */ + const char *urlSvrName; /* client only */ + sslServerCertType certType; + CERTCertificate *localCert; + + PRIPv6Addr addr; + PRUint16 port; + + SSL3ProtocolVersion version; + + PRUint32 creationTime; /* seconds since Jan 1, 1970 */ + PRUint32 expirationTime; /* seconds since Jan 1, 1970 */ + + SSLAuthType authType; + PRUint32 authKeyBits; + SSLKEAType keaType; + PRUint32 keaKeyBits; + + union { + struct { + /* values that are copied into the server's on-disk SID cache. */ + PRUint8 sessionIDLength; + SSL3Opaque sessionID[SSL3_SESSIONID_BYTES]; + + ssl3CipherSuite cipherSuite; + SSLCompressionMethod compression; + int policy; + ssl3SidKeys keys; + /* mechanism used to wrap master secret */ + CK_MECHANISM_TYPE masterWrapMech; + + /* The following values are NOT restored from the server's on-disk + * session cache, but are restored from the client's cache. + */ + PK11SymKey *clientWriteKey; + PK11SymKey *serverWriteKey; + + /* The following values pertain to the slot that wrapped the + ** master secret. (used only in client) + */ + SECMODModuleID masterModuleID; + /* what module wrapped the master secret */ + CK_SLOT_ID masterSlotID; + PRUint16 masterWrapIndex; + /* what's the key index for the wrapping key */ + PRUint16 masterWrapSeries; + /* keep track of the slot series, so we don't + * accidently try to use new keys after the + * card gets removed and replaced.*/ + + /* The following values pertain to the slot that did the signature + ** for client auth. (used only in client) + */ + SECMODModuleID clAuthModuleID; + CK_SLOT_ID clAuthSlotID; + PRUint16 clAuthSeries; + + char masterValid; + char clAuthValid; + + SECItem srvName; + + /* Signed certificate timestamps received in a TLS extension. + ** (used only in client). + */ + SECItem signedCertTimestamps; + + /* The NPN/ALPN value negotiated in the original connection. + * Used for TLS 1.3. */ + SECItem alpnSelection; + + /* This lock is lazily initialized by CacheSID when a sid is first + * cached. Before then, there is no need to lock anything because + * the sid isn't being shared by anything. + */ + PRRWLock *lock; + + /* The lock must be held while reading or writing these members + * because they change while the sid is cached. + */ + struct { + /* The session ticket, if we have one, is sent as an extension + * in the ClientHello message. This field is used only by + * clients. It is protected by lock when lock is non-null + * (after the sid has been added to the client session cache). + */ + NewSessionTicket sessionTicket; + } locked; + } ssl3; + } u; +}; + +typedef struct ssl3CipherSuiteDefStr { + ssl3CipherSuite cipher_suite; + SSL3BulkCipher bulk_cipher_alg; + SSL3MACAlgorithm mac_alg; + SSL3KeyExchangeAlgorithm key_exchange_alg; + SSLHashType prf_hash; +} ssl3CipherSuiteDef; + +/* +** There are tables of these, all const. +*/ +typedef struct { + /* An identifier for this struct. */ + SSL3KeyExchangeAlgorithm kea; + /* The type of key exchange used by the cipher suite. */ + SSLKEAType exchKeyType; + /* If the cipher suite uses a signature, the type of key used in the + * signature. */ + KeyType signKeyType; + /* In most cases, cipher suites depend on their signature type for + * authentication, ECDH certificates being the exception. */ + SSLAuthType authKeyType; + /* True if the key exchange for the suite is ephemeral. Or to be more + * precise: true if the ServerKeyExchange message is always required. */ + PRBool ephemeral; + /* An OID describing the key exchange */ + SECOidTag oid; +} ssl3KEADef; + +/* +** There are tables of these, all const. +*/ +struct ssl3BulkCipherDefStr { + SSL3BulkCipher cipher; + SSLCipherAlgorithm calg; + unsigned int key_size; + unsigned int secret_key_size; + CipherType type; + unsigned int iv_size; + unsigned int block_size; + unsigned int tag_size; /* for AEAD ciphers. */ + unsigned int explicit_nonce_size; /* for AEAD ciphers. */ + SECOidTag oid; + const char *short_name; + /* The maximum number of records that can be sent/received with the same + * symmetric key before the connection will be terminated. */ + PRUint64 max_records; +}; + +/* +** There are tables of these, all const. +*/ +struct ssl3MACDefStr { + SSL3MACAlgorithm mac; + CK_MECHANISM_TYPE mmech; + int pad_size; + int mac_size; + SECOidTag oid; +}; + +typedef enum { + ssl_0rtt_none, /* 0-RTT not present */ + ssl_0rtt_sent, /* 0-RTT sent (no decision yet) */ + ssl_0rtt_accepted, /* 0-RTT sent and accepted */ + ssl_0rtt_ignored, /* 0-RTT sent but rejected/ignored */ + ssl_0rtt_done /* 0-RTT accepted, but finished */ +} sslZeroRttState; + +typedef enum { + ssl_0rtt_ignore_none, /* not ignoring */ + ssl_0rtt_ignore_trial, /* ignoring with trial decryption */ + ssl_0rtt_ignore_hrr /* ignoring until ClientHello (due to HRR) */ +} sslZeroRttIgnore; + +typedef enum { + idle_handshake, + wait_client_hello, + wait_client_cert, + wait_client_key, + wait_cert_verify, + wait_change_cipher, + wait_finished, + wait_server_hello, + wait_certificate_status, + wait_server_cert, + wait_server_key, + wait_cert_request, + wait_hello_done, + wait_new_session_ticket, + wait_encrypted_extensions, + wait_invalid /* Invalid value. There is no handshake message "invalid". */ +} SSL3WaitState; + +typedef enum { + client_hello_initial, /* The first attempt. */ + client_hello_retry, /* If we receive HelloRetryRequest. */ + client_hello_retransmit, /* In DTLS, if we receive HelloVerifyRequest. */ + client_hello_renegotiation /* A renegotiation attempt. */ +} sslClientHelloType; + +typedef struct SessionTicketDataStr SessionTicketData; + +typedef SECStatus (*sslRestartTarget)(sslSocket *); + +/* +** A DTLS queued message (potentially to be retransmitted) +*/ +typedef struct DTLSQueuedMessageStr { + PRCList link; /* The linked list link */ + ssl3CipherSpec *cwSpec; /* The cipher spec to use, null for none */ + SSL3ContentType type; /* The message type */ + unsigned char *data; /* The data */ + PRUint16 len; /* The data length */ +} DTLSQueuedMessage; + +typedef struct TLS13KeyShareEntryStr { + PRCList link; /* The linked list link */ + const sslNamedGroupDef *group; /* The group for the entry */ + SECItem key_exchange; /* The share itself */ +} TLS13KeyShareEntry; + +typedef struct TLS13EarlyDataStr { + PRCList link; /* The linked list link */ + SECItem data; /* The data */ +} TLS13EarlyData; + +typedef enum { + handshake_hash_unknown = 0, + handshake_hash_combo = 1, /* The MD5/SHA-1 combination */ + handshake_hash_single = 2, /* A single hash */ + handshake_hash_record +} SSL3HandshakeHashType; + +/* This holds state for TLS 1.3 CertificateRequest handling. */ +typedef struct TLS13CertificateRequestStr { + PLArenaPool *arena; + SECItem context; + SSLSignatureScheme *signatureSchemes; + unsigned int signatureSchemeCount; + CERTDistNames ca_list; +} TLS13CertificateRequest; + +/* +** This is the "hs" member of the "ssl3" struct. +** This entire struct is protected by ssl3HandshakeLock +*/ +typedef struct SSL3HandshakeStateStr { + SSL3Random server_random; + SSL3Random client_random; + SSL3WaitState ws; /* May also contain SSL3WaitState | 0x80 for TLS 1.3 */ + + /* This group of members is used for handshake running hashes. */ + SSL3HandshakeHashType hashType; + sslBuffer messages; /* Accumulated handshake messages */ + /* PKCS #11 mode: + * SSL 3.0 - TLS 1.1 use both |md5| and |sha|. |md5| is used for MD5 and + * |sha| for SHA-1. + * TLS 1.2 and later use only |sha|, for SHA-256. */ + PK11Context *md5; + PK11Context *sha; + SSLSignatureScheme signatureScheme; + const ssl3KEADef *kea_def; + ssl3CipherSuite cipher_suite; + const ssl3CipherSuiteDef *suite_def; + SSLCompressionMethod compression; + sslBuffer msg_body; /* protected by recvBufLock */ + /* partial handshake message from record layer */ + unsigned int header_bytes; + /* number of bytes consumed from handshake */ + /* message for message type and header length */ + SSL3HandshakeType msg_type; + unsigned long msg_len; + PRBool isResuming; /* we are resuming (not used in TLS 1.3) */ + PRBool sendingSCSV; /* instead of empty RI */ + sslBuffer msgState; /* current state for handshake messages*/ + /* protected by recvBufLock */ + + /* The session ticket received in a NewSessionTicket message is temporarily + * stored in newSessionTicket until the handshake is finished; then it is + * moved to the sid. + */ + PRBool receivedNewSessionTicket; + NewSessionTicket newSessionTicket; + + PRUint16 finishedBytes; /* size of single finished below */ + union { + TLSFinished tFinished[2]; /* client, then server */ + SSL3Finished sFinished[2]; + SSL3Opaque data[72]; + } finishedMsgs; + + PRBool authCertificatePending; + /* Which function should SSL_RestartHandshake* call if we're blocked? + * One of NULL, ssl3_SendClientSecondRound, ssl3_FinishHandshake, + * or ssl3_AlwaysFail */ + sslRestartTarget restartTarget; + /* Shared state between ssl3_HandleFinished and ssl3_FinishHandshake */ + PRBool cacheSID; + + PRBool canFalseStart; /* Can/did we False Start */ + /* Which preliminaryinfo values have been set. */ + PRUint32 preliminaryInfo; + + /* Parsed extensions */ + PRCList remoteExtensions; /* Parsed incoming extensions */ + + /* This group of values is used for DTLS */ + PRUint16 sendMessageSeq; /* The sending message sequence + * number */ + PRCList lastMessageFlight; /* The last message flight we + * sent */ + PRUint16 maxMessageSent; /* The largest message we sent */ + PRUint16 recvMessageSeq; /* The receiving message sequence + * number */ + sslBuffer recvdFragments; /* The fragments we have received in + * a bitmask */ + PRInt32 recvdHighWater; /* The high water mark for fragments + * received. -1 means no reassembly + * in progress. */ + SECItem cookie; /* The Hello(Retry|Verify)Request cookie. */ + PRIntervalTime rtTimerStarted; /* When the timer was started */ + DTLSTimerCb rtTimerCb; /* The function to call on expiry */ + PRUint32 rtTimeoutMs; /* The length of the current timeout + * used for backoff (in ms) */ + PRUint32 rtRetries; /* The retry counter */ + SECItem srvVirtName; /* for server: name that was negotiated + * with a client. For client - is + * always set to NULL.*/ + + /* This group of values is used for TLS 1.3 and above */ + PK11SymKey *currentSecret; /* The secret down the "left hand side" + * of the TLS 1.3 key schedule. */ + PK11SymKey *resumptionMasterSecret; /* The resumption PSK. */ + PK11SymKey *dheSecret; /* The (EC)DHE shared secret. */ + PK11SymKey *pskBinderKey; /* Used to compute the PSK binder. */ + PK11SymKey *clientEarlyTrafficSecret; /* The secret we use for 0-RTT. */ + PK11SymKey *clientHsTrafficSecret; /* The source keys for handshake */ + PK11SymKey *serverHsTrafficSecret; /* traffic keys. */ + PK11SymKey *clientTrafficSecret; /* The source keys for application */ + PK11SymKey *serverTrafficSecret; /* traffic keys */ + PK11SymKey *earlyExporterSecret; /* for 0-RTT exporters */ + PK11SymKey *exporterSecret; /* for exporters */ + /* The certificate request from the server. */ + TLS13CertificateRequest *certificateRequest; + PRCList cipherSpecs; /* The cipher specs in the sequence they + * will be applied. */ + ssl3CipherSpec *nullSpec; /* In case 0-RTT is rejected. */ + sslZeroRttState zeroRttState; /* Are we doing a 0-RTT handshake? */ + sslZeroRttIgnore zeroRttIgnore; /* Are we ignoring 0-RTT? */ + ssl3CipherSuite zeroRttSuite; /* The cipher suite we used for 0-RTT. */ + PRCList bufferedEarlyData; /* Buffered TLS 1.3 early data + * on server.*/ + PRBool helloRetry; /* True if HelloRetryRequest has been sent + * or received. */ + ssl3KEADef kea_def_mutable; /* Used to hold the writable kea_def + * we use for TLS 1.3 */ + PRBool shortHeaders; /* Assigned if we are doing short headers. */ +} SSL3HandshakeState; + +/* +** This is the "ssl3" struct, as in "ss->ssl3". +** note: +** usually, crSpec == cwSpec and prSpec == pwSpec. +** Sometimes, crSpec == pwSpec and prSpec == cwSpec. +** But there are never more than 2 actual specs. +** No spec must ever be modified if either "current" pointer points to it. +*/ +struct ssl3StateStr { + + /* + ** The following Specs and Spec pointers must be protected using the + ** Spec Lock. + */ + ssl3CipherSpec *crSpec; /* current read spec. */ + ssl3CipherSpec *prSpec; /* pending read spec. */ + ssl3CipherSpec *cwSpec; /* current write spec. */ + ssl3CipherSpec *pwSpec; /* pending write spec. */ + + CERTCertificate *clientCertificate; /* used by client */ + SECKEYPrivateKey *clientPrivateKey; /* used by client */ + CERTCertificateList *clientCertChain; /* used by client */ + PRBool sendEmptyCert; /* used by client */ + + int policy; + /* This says what cipher suites we can do, and should + * be either SSL_ALLOWED or SSL_RESTRICTED + */ + PLArenaPool *peerCertArena; + /* These are used to keep track of the peer CA */ + void *peerCertChain; + /* chain while we are trying to validate it. */ + CERTDistNames *ca_list; + /* used by server. trusted CAs for this socket. */ + PRBool initialized; + SSL3HandshakeState hs; + ssl3CipherSpec specs[2]; /* one is current, one is pending. */ + + PRUint16 mtu; /* Our estimate of the MTU */ + + /* DTLS-SRTP cipher suite preferences (if any) */ + PRUint16 dtlsSRTPCiphers[MAX_DTLS_SRTP_CIPHER_SUITES]; + PRUint16 dtlsSRTPCipherCount; + PRBool fatalAlertSent; + PRBool dheWeakGroupEnabled; /* used by server */ + const sslNamedGroupDef *dhePreferredGroup; + + /* TLS 1.2 introduces separate signature algorithm negotiation. + * TLS 1.3 combined signature and hash into a single enum. + * This is our preference order. */ + SSLSignatureScheme signatureSchemes[MAX_SIGNATURE_SCHEMES]; + unsigned int signatureSchemeCount; + + /* The version to check if we fell back from our highest version + * of TLS. Default is 0 in which case we check against the maximum + * configured version for this socket. Used only on the client. */ + SSL3ProtocolVersion downgradeCheckVersion; +}; + +/* Ethernet MTU but without subtracting the headers, + * so slightly larger than expected */ +#define DTLS_MAX_MTU 1500U +#define IS_DTLS(ss) (ss->protocolVariant == ssl_variant_datagram) + +typedef struct { + SSL3ContentType type; + SSL3ProtocolVersion version; + sslSequenceNumber seq_num; /* DTLS only */ + sslBuffer *buf; +} SSL3Ciphertext; + +struct sslKeyPairStr { + SECKEYPrivateKey *privKey; + SECKEYPublicKey *pubKey; + PRInt32 refCount; /* use PR_Atomic calls for this. */ +}; + +typedef struct { + PRCList link; + const sslNamedGroupDef *group; + sslKeyPair *keys; +} sslEphemeralKeyPair; + +struct ssl3DHParamsStr { + SSLNamedGroup name; + SECItem prime; /* p */ + SECItem base; /* g */ +}; + +typedef struct SSLWrappedSymWrappingKeyStr { + SSL3Opaque wrappedSymmetricWrappingkey[512]; + CK_MECHANISM_TYPE symWrapMechanism; + /* unwrapped symmetric wrapping key uses this mechanism */ + CK_MECHANISM_TYPE asymWrapMechanism; + /* mechanism used to wrap the SymmetricWrappingKey using + * server's public and/or private keys. */ + SSLAuthType authType; /* type of keys used to wrap SymWrapKey*/ + PRInt32 symWrapMechIndex; + PRUint16 wrappedSymKeyLen; +} SSLWrappedSymWrappingKey; + +typedef struct SessionTicketStr { + PRUint16 ticket_version; + SSL3ProtocolVersion ssl_version; + ssl3CipherSuite cipher_suite; + SSLCompressionMethod compression_method; + SSLAuthType authType; + PRUint32 authKeyBits; + SSLKEAType keaType; + PRUint32 keaKeyBits; + sslServerCertType certType; + /* + * msWrapMech contains a meaningful value only if ms_is_wrapped is true. + */ + PRUint8 ms_is_wrapped; + CK_MECHANISM_TYPE msWrapMech; + PRUint16 ms_length; + SSL3Opaque master_secret[48]; + PRBool extendedMasterSecretUsed; + ClientIdentity client_identity; + SECItem peer_cert; + PRUint32 timestamp; + PRUint32 flags; + SECItem srvName; /* negotiated server name */ + SECItem alpnSelection; +} SessionTicket; + +/* + * SSL2 buffers used in SSL3. + * writeBuf in the SecurityInfo maintained by sslsecur.c is used + * to hold the data just about to be passed to the kernel + * sendBuf in the ConnectInfo maintained by sslcon.c is used + * to hold handshake messages as they are accumulated + */ + +/* +** This is "ci", as in "ss->sec.ci". +** +** Protection: All the variables in here are protected by +** firstHandshakeLock AND ssl3HandshakeLock +*/ +struct sslConnectInfoStr { + /* outgoing handshakes appended to this. */ + sslBuffer sendBuf; /*xmitBufLock*/ + + PRIPv6Addr peer; + unsigned short port; + + sslSessionID *sid; +}; + +/* Note: The entire content of this struct and whatever it points to gets + * blown away by SSL_ResetHandshake(). This is "sec" as in "ss->sec". + * + * Unless otherwise specified below, the contents of this struct are + * protected by firstHandshakeLock AND ssl3HandshakeLock. + */ +struct sslSecurityInfoStr { + +#define SSL_ROLE(ss) (ss->sec.isServer ? "server" : "client") + + PRBool isServer; + sslBuffer writeBuf; /*xmitBufLock*/ + + CERTCertificate *localCert; + CERTCertificate *peerCert; + SECKEYPublicKey *peerKey; + + SSLAuthType authType; + PRUint32 authKeyBits; + SSLSignatureScheme signatureScheme; + SSLKEAType keaType; + PRUint32 keaKeyBits; + const sslNamedGroupDef *keaGroup; + /* The selected certificate (for servers only). */ + const sslServerCert *serverCert; + + /* + ** Procs used for SID cache (nonce) management. + ** Different implementations exist for clients/servers + ** The lookup proc is only used for servers. Baloney! + */ + sslSessionIDCacheFunc cache; + sslSessionIDUncacheFunc uncache; + + /* These are used during a connection handshake */ + sslConnectInfo ci; +}; + +/* +** SSL Socket struct +** +** Protection: XXX +*/ +struct sslSocketStr { + PRFileDesc *fd; + + /* Pointer to operations vector for this socket */ + const sslSocketOps *ops; + + /* SSL socket options */ + sslOptions opt; + /* Enabled version range */ + SSLVersionRange vrange; + + /* State flags */ + unsigned long clientAuthRequested; + unsigned long delayDisabled; /* Nagle delay disabled */ + unsigned long firstHsDone; /* first handshake is complete. */ + unsigned long enoughFirstHsDone; /* enough of the first handshake is + * done for callbacks to be able to + * retrieve channel security + * parameters from the SSL socket. */ + unsigned long handshakeBegun; + unsigned long lastWriteBlocked; + unsigned long recvdCloseNotify; /* received SSL EOF. */ + unsigned long TCPconnected; + unsigned long appDataBuffered; + unsigned long peerRequestedProtection; /* from old renegotiation */ + + /* version of the protocol to use */ + SSL3ProtocolVersion version; + SSL3ProtocolVersion clientHelloVersion; /* version sent in client hello. */ + + sslSecurityInfo sec; /* not a pointer any more */ + + /* protected by firstHandshakeLock AND ssl3HandshakeLock. */ + const char *url; + + sslHandshakeFunc handshake; /*firstHandshakeLock*/ + + /* the following variable is only used with socks or other proxies. */ + char *peerID; /* String uniquely identifies target server. */ + + /* ECDHE and DHE keys: In TLS 1.3, we might have to maintain multiple of + * these on the client side. The server inserts a single value into this + * list for all versions. */ + PRCList /*<sslEphemeralKeyPair>*/ ephemeralKeyPairs; + + /* Callbacks */ + SSLAuthCertificate authCertificate; + void *authCertificateArg; + SSLGetClientAuthData getClientAuthData; + void *getClientAuthDataArg; + SSLSNISocketConfig sniSocketConfig; + void *sniSocketConfigArg; + SSLBadCertHandler handleBadCert; + void *badCertArg; + SSLHandshakeCallback handshakeCallback; + void *handshakeCallbackData; + SSLCanFalseStartCallback canFalseStartCallback; + void *canFalseStartCallbackData; + void *pkcs11PinArg; + SSLNextProtoCallback nextProtoCallback; + void *nextProtoArg; + + PRIntervalTime rTimeout; /* timeout for NSPR I/O */ + PRIntervalTime wTimeout; /* timeout for NSPR I/O */ + PRIntervalTime cTimeout; /* timeout for NSPR I/O */ + + PZLock *recvLock; /* lock against multiple reader threads. */ + PZLock *sendLock; /* lock against multiple sender threads. */ + + PZMonitor *recvBufLock; /* locks low level recv buffers. */ + PZMonitor *xmitBufLock; /* locks low level xmit buffers. */ + + /* Only one thread may operate on the socket until the initial handshake + ** is complete. This Monitor ensures that. Since SSL2 handshake is + ** only done once, this is also effectively the SSL2 handshake lock. + */ + PZMonitor *firstHandshakeLock; + + /* This monitor protects the ssl3 handshake state machine data. + ** Only one thread (reader or writer) may be in the ssl3 handshake state + ** machine at any time. */ + PZMonitor *ssl3HandshakeLock; + + /* reader/writer lock, protects the secret data needed to encrypt and MAC + ** outgoing records, and to decrypt and MAC check incoming ciphertext + ** records. */ + NSSRWLock *specLock; + + /* handle to perm cert db (and implicitly to the temp cert db) used + ** with this socket. + */ + CERTCertDBHandle *dbHandle; + + PRThread *writerThread; /* thread holds SSL_LOCK_WRITER lock */ + + PRUint16 shutdownHow; /* See ssl_SHUTDOWN defines below. */ + + sslHandshakingType handshaking; + + /* Gather object used for gathering data */ + sslGather gs; /*recvBufLock*/ + + sslBuffer saveBuf; /*xmitBufLock*/ + sslBuffer pendingBuf; /*xmitBufLock*/ + + /* Configuration state for server sockets */ + /* One server cert and key for each authentication type. */ + PRCList /* <sslServerCert> */ serverCerts; + + ssl3CipherSuiteCfg cipherSuites[ssl_V3_SUITES_IMPLEMENTED]; + + /* A list of groups that are sorted according to user preferences pointing + * to entries of ssl_named_groups. By default this list contains pointers + * to all elements in ssl_named_groups in the default order. + * This list also determines which groups are enabled. This + * starts with all being enabled and can be modified either by negotiation + * (in which case groups not supported by a peer are masked off), or by + * calling SSL_DHEGroupPrefSet(). + * Note that renegotiation will ignore groups that were disabled in the + * first handshake. + */ + const sslNamedGroupDef *namedGroupPreferences[SSL_NAMED_GROUP_COUNT]; + /* The number of additional shares to generate for the TLS 1.3 ClientHello */ + unsigned int additionalShares; + + /* SSL3 state info. Formerly was a pointer */ + ssl3State ssl3; + + /* + * TLS extension related data. + */ + /* True when the current session is a stateless resume. */ + PRBool statelessResume; + TLSExtensionData xtnData; + + /* Whether we are doing stream or datagram mode */ + SSLProtocolVariant protocolVariant; +}; + +/* All the global data items declared here should be protected using the +** ssl_global_data_lock, which is a reader/writer lock. +*/ +extern NSSRWLock *ssl_global_data_lock; +extern char ssl_debug; +extern char ssl_trace; +extern FILE *ssl_trace_iob; +extern FILE *ssl_keylog_iob; +extern CERTDistNames *ssl3_server_ca_list; +extern PRUint32 ssl_sid_timeout; +extern PRUint32 ssl3_sid_timeout; + +extern const char *const ssl3_cipherName[]; + +extern sslSessionIDLookupFunc ssl_sid_lookup; +extern sslSessionIDCacheFunc ssl_sid_cache; +extern sslSessionIDUncacheFunc ssl_sid_uncache; + +extern const sslNamedGroupDef ssl_named_groups[]; + +/************************************************************************/ + +SEC_BEGIN_PROTOS + +/* Internal initialization and installation of the SSL error tables */ +extern SECStatus ssl_Init(void); +extern SECStatus ssl_InitializePRErrorTable(void); + +/* Implementation of ops for default (non socks, non secure) case */ +extern int ssl_DefConnect(sslSocket *ss, const PRNetAddr *addr); +extern PRFileDesc *ssl_DefAccept(sslSocket *ss, PRNetAddr *addr); +extern int ssl_DefBind(sslSocket *ss, const PRNetAddr *addr); +extern int ssl_DefListen(sslSocket *ss, int backlog); +extern int ssl_DefShutdown(sslSocket *ss, int how); +extern int ssl_DefClose(sslSocket *ss); +extern int ssl_DefRecv(sslSocket *ss, unsigned char *buf, int len, int flags); +extern int ssl_DefSend(sslSocket *ss, const unsigned char *buf, + int len, int flags); +extern int ssl_DefRead(sslSocket *ss, unsigned char *buf, int len); +extern int ssl_DefWrite(sslSocket *ss, const unsigned char *buf, int len); +extern int ssl_DefGetpeername(sslSocket *ss, PRNetAddr *name); +extern int ssl_DefGetsockname(sslSocket *ss, PRNetAddr *name); +extern int ssl_DefGetsockopt(sslSocket *ss, PRSockOption optname, + void *optval, PRInt32 *optlen); +extern int ssl_DefSetsockopt(sslSocket *ss, PRSockOption optname, + const void *optval, PRInt32 optlen); + +/* Implementation of ops for socks only case */ +extern int ssl_SocksConnect(sslSocket *ss, const PRNetAddr *addr); +extern PRFileDesc *ssl_SocksAccept(sslSocket *ss, PRNetAddr *addr); +extern int ssl_SocksBind(sslSocket *ss, const PRNetAddr *addr); +extern int ssl_SocksListen(sslSocket *ss, int backlog); +extern int ssl_SocksGetsockname(sslSocket *ss, PRNetAddr *name); +extern int ssl_SocksRecv(sslSocket *ss, unsigned char *buf, int len, int flags); +extern int ssl_SocksSend(sslSocket *ss, const unsigned char *buf, + int len, int flags); +extern int ssl_SocksRead(sslSocket *ss, unsigned char *buf, int len); +extern int ssl_SocksWrite(sslSocket *ss, const unsigned char *buf, int len); + +/* Implementation of ops for secure only case */ +extern int ssl_SecureConnect(sslSocket *ss, const PRNetAddr *addr); +extern PRFileDesc *ssl_SecureAccept(sslSocket *ss, PRNetAddr *addr); +extern int ssl_SecureRecv(sslSocket *ss, unsigned char *buf, + int len, int flags); +extern int ssl_SecureSend(sslSocket *ss, const unsigned char *buf, + int len, int flags); +extern int ssl_SecureRead(sslSocket *ss, unsigned char *buf, int len); +extern int ssl_SecureWrite(sslSocket *ss, const unsigned char *buf, int len); +extern int ssl_SecureShutdown(sslSocket *ss, int how); +extern int ssl_SecureClose(sslSocket *ss); + +/* Implementation of ops for secure socks case */ +extern int ssl_SecureSocksConnect(sslSocket *ss, const PRNetAddr *addr); +extern PRFileDesc *ssl_SecureSocksAccept(sslSocket *ss, PRNetAddr *addr); +extern PRFileDesc *ssl_FindTop(sslSocket *ss); + +/* Gather funcs. */ +extern sslGather *ssl_NewGather(void); +extern SECStatus ssl3_InitGather(sslGather *gs); +extern void ssl3_DestroyGather(sslGather *gs); +extern SECStatus ssl_GatherRecord1stHandshake(sslSocket *ss); + +extern SECStatus ssl_CreateSecurityInfo(sslSocket *ss); +extern SECStatus ssl_CopySecurityInfo(sslSocket *ss, sslSocket *os); +extern void ssl_ResetSecurityInfo(sslSecurityInfo *sec, PRBool doMemset); +extern void ssl_DestroySecurityInfo(sslSecurityInfo *sec); + +extern void ssl_PrintBuf(const sslSocket *ss, const char *msg, const void *cp, + int len); +extern void ssl_PrintKey(const sslSocket *ss, const char *msg, PK11SymKey *key); + +extern int ssl_SendSavedWriteData(sslSocket *ss); +extern SECStatus ssl_SaveWriteData(sslSocket *ss, + const void *p, unsigned int l); +extern SECStatus ssl_BeginClientHandshake(sslSocket *ss); +extern SECStatus ssl_BeginServerHandshake(sslSocket *ss); +extern int ssl_Do1stHandshake(sslSocket *ss); + +extern SECStatus sslBuffer_Grow(sslBuffer *b, unsigned int newLen); +extern SECStatus sslBuffer_Append(sslBuffer *b, const void *data, + unsigned int len); +extern void sslBuffer_Clear(sslBuffer *b); + +extern void ssl_ChooseSessionIDProcs(sslSecurityInfo *sec); + +extern void ssl3_InitCipherSpec(ssl3CipherSpec *spec); +extern sslSessionID *ssl3_NewSessionID(sslSocket *ss, PRBool is_server); +extern sslSessionID *ssl_LookupSID(const PRIPv6Addr *addr, PRUint16 port, + const char *peerID, const char *urlSvrName); +extern void ssl_FreeSID(sslSessionID *sid); + +extern int ssl3_SendApplicationData(sslSocket *ss, const PRUint8 *in, + int len, int flags); + +extern PRBool ssl_FdIsBlocking(PRFileDesc *fd); + +extern PRBool ssl_SocketIsBlocking(sslSocket *ss); + +extern void ssl3_SetAlwaysBlock(sslSocket *ss); + +extern SECStatus ssl_EnableNagleDelay(sslSocket *ss, PRBool enabled); + +extern void ssl_FinishHandshake(sslSocket *ss); + +extern SECStatus ssl_CipherPolicySet(PRInt32 which, PRInt32 policy); + +extern SECStatus ssl_CipherPrefSetDefault(PRInt32 which, PRBool enabled); + +extern SECStatus ssl3_ConstrainRangeByPolicy(void); + +extern SECStatus ssl3_InitState(sslSocket *ss); +extern SECStatus ssl3_RestartHandshakeHashes(sslSocket *ss); +extern SECStatus ssl3_UpdateHandshakeHashes(sslSocket *ss, + const unsigned char *b, + unsigned int l); + +/* Returns PR_TRUE if we are still waiting for the server to complete its + * response to our client second round. Once we've received the Finished from + * the server then there is no need to check false start. + */ +extern PRBool ssl3_WaitingForServerSecondRound(sslSocket *ss); + +extern PRInt32 ssl3_SendRecord(sslSocket *ss, ssl3CipherSpec *cwSpec, + SSL3ContentType type, + const SSL3Opaque *pIn, PRInt32 nIn, + PRInt32 flags); + +#ifdef NSS_SSL_ENABLE_ZLIB +/* + * The DEFLATE algorithm can result in an expansion of 0.1% + 12 bytes. For a + * maximum TLS record payload of 2**14 bytes, that's 29 bytes. + */ +#define SSL3_COMPRESSION_MAX_EXPANSION 29 +#else /* !NSS_SSL_ENABLE_ZLIB */ +#define SSL3_COMPRESSION_MAX_EXPANSION 0 +#endif + +/* + * make sure there is room in the write buffer for padding and + * other compression and cryptographic expansions. + */ +#define SSL3_BUFFER_FUDGE 100 + SSL3_COMPRESSION_MAX_EXPANSION + +#define SSL_LOCK_READER(ss) \ + if (ss->recvLock) \ + PZ_Lock(ss->recvLock) +#define SSL_UNLOCK_READER(ss) \ + if (ss->recvLock) \ + PZ_Unlock(ss->recvLock) +#define SSL_LOCK_WRITER(ss) \ + if (ss->sendLock) \ + PZ_Lock(ss->sendLock) +#define SSL_UNLOCK_WRITER(ss) \ + if (ss->sendLock) \ + PZ_Unlock(ss->sendLock) + +/* firstHandshakeLock -> recvBufLock */ +#define ssl_Get1stHandshakeLock(ss) \ + { \ + if (!ss->opt.noLocks) { \ + PORT_Assert(PZ_InMonitor((ss)->firstHandshakeLock) || \ + !ssl_HaveRecvBufLock(ss)); \ + PZ_EnterMonitor((ss)->firstHandshakeLock); \ + } \ + } +#define ssl_Release1stHandshakeLock(ss) \ + { \ + if (!ss->opt.noLocks) \ + PZ_ExitMonitor((ss)->firstHandshakeLock); \ + } +#define ssl_Have1stHandshakeLock(ss) \ + (PZ_InMonitor((ss)->firstHandshakeLock)) + +/* ssl3HandshakeLock -> xmitBufLock */ +#define ssl_GetSSL3HandshakeLock(ss) \ + { \ + if (!ss->opt.noLocks) { \ + PORT_Assert(!ssl_HaveXmitBufLock(ss)); \ + PZ_EnterMonitor((ss)->ssl3HandshakeLock); \ + } \ + } +#define ssl_ReleaseSSL3HandshakeLock(ss) \ + { \ + if (!ss->opt.noLocks) \ + PZ_ExitMonitor((ss)->ssl3HandshakeLock); \ + } +#define ssl_HaveSSL3HandshakeLock(ss) \ + (PZ_InMonitor((ss)->ssl3HandshakeLock)) + +#define ssl_GetSpecReadLock(ss) \ + { \ + if (!ss->opt.noLocks) \ + NSSRWLock_LockRead((ss)->specLock); \ + } +#define ssl_ReleaseSpecReadLock(ss) \ + { \ + if (!ss->opt.noLocks) \ + NSSRWLock_UnlockRead((ss)->specLock); \ + } +/* NSSRWLock_HaveReadLock is not exported so there's no + * ssl_HaveSpecReadLock macro. */ + +#define ssl_GetSpecWriteLock(ss) \ + { \ + if (!ss->opt.noLocks) \ + NSSRWLock_LockWrite((ss)->specLock); \ + } +#define ssl_ReleaseSpecWriteLock(ss) \ + { \ + if (!ss->opt.noLocks) \ + NSSRWLock_UnlockWrite((ss)->specLock); \ + } +#define ssl_HaveSpecWriteLock(ss) \ + (NSSRWLock_HaveWriteLock((ss)->specLock)) + +/* recvBufLock -> ssl3HandshakeLock -> xmitBufLock */ +#define ssl_GetRecvBufLock(ss) \ + { \ + if (!ss->opt.noLocks) { \ + PORT_Assert(!ssl_HaveSSL3HandshakeLock(ss)); \ + PORT_Assert(!ssl_HaveXmitBufLock(ss)); \ + PZ_EnterMonitor((ss)->recvBufLock); \ + } \ + } +#define ssl_ReleaseRecvBufLock(ss) \ + { \ + if (!ss->opt.noLocks) \ + PZ_ExitMonitor((ss)->recvBufLock); \ + } +#define ssl_HaveRecvBufLock(ss) \ + (PZ_InMonitor((ss)->recvBufLock)) + +/* xmitBufLock -> specLock */ +#define ssl_GetXmitBufLock(ss) \ + { \ + if (!ss->opt.noLocks) \ + PZ_EnterMonitor((ss)->xmitBufLock); \ + } +#define ssl_ReleaseXmitBufLock(ss) \ + { \ + if (!ss->opt.noLocks) \ + PZ_ExitMonitor((ss)->xmitBufLock); \ + } +#define ssl_HaveXmitBufLock(ss) \ + (PZ_InMonitor((ss)->xmitBufLock)) + +/* Placeholder value used in version ranges when SSL 3.0 and all + * versions of TLS are disabled. + */ +#define SSL_LIBRARY_VERSION_NONE 0 + +/* SSL_LIBRARY_VERSION_MAX_SUPPORTED is the maximum version that this version + * of libssl supports. Applications should use SSL_VersionRangeGetSupported at + * runtime to determine which versions are supported by the version of libssl + * in use. + */ +#ifndef NSS_DISABLE_TLS_1_3 +#define SSL_LIBRARY_VERSION_MAX_SUPPORTED SSL_LIBRARY_VERSION_TLS_1_3 +#else +#define SSL_LIBRARY_VERSION_MAX_SUPPORTED SSL_LIBRARY_VERSION_TLS_1_2 +#endif + +#define SSL_ALL_VERSIONS_DISABLED(vrange) \ + ((vrange)->min == SSL_LIBRARY_VERSION_NONE) + +extern PRBool ssl3_VersionIsSupported(SSLProtocolVariant protocolVariant, + SSL3ProtocolVersion version); + +/* These functions are called from secnav, even though they're "private". */ + +extern int SSL_RestartHandshakeAfterCertReq(struct sslSocketStr *ss, + CERTCertificate *cert, + SECKEYPrivateKey *key, + CERTCertificateList *certChain); +extern sslSocket *ssl_FindSocket(PRFileDesc *fd); +extern void ssl_FreeSocket(struct sslSocketStr *ssl); +extern SECStatus SSL3_SendAlert(sslSocket *ss, SSL3AlertLevel level, + SSL3AlertDescription desc); +extern SECStatus ssl3_DecodeError(sslSocket *ss); + +extern SECStatus ssl3_AuthCertificateComplete(sslSocket *ss, PRErrorCode error); + +/* + * for dealing with SSL 3.0 clients sending SSL 2.0 format hellos + */ +extern SECStatus ssl3_HandleV2ClientHello( + sslSocket *ss, unsigned char *buffer, int length, PRUint8 padding); + +SECStatus ssl3_SendClientHello(sslSocket *ss, sslClientHelloType type); + +/* + * input into the SSL3 machinery from the actualy network reading code + */ +SECStatus ssl3_HandleRecord( + sslSocket *ss, SSL3Ciphertext *cipher, sslBuffer *out); +SECStatus ssl_RemoveTLSCBCPadding(sslBuffer *plaintext, unsigned int macSize); + +int ssl3_GatherAppDataRecord(sslSocket *ss, int flags); +int ssl3_GatherCompleteHandshake(sslSocket *ss, int flags); + +/* Create a new ref counted key pair object from two keys. */ +extern sslKeyPair *ssl_NewKeyPair(SECKEYPrivateKey *privKey, + SECKEYPublicKey *pubKey); + +/* get a new reference (bump ref count) to an ssl3KeyPair. */ +extern sslKeyPair *ssl_GetKeyPairRef(sslKeyPair *keyPair); + +/* Decrement keypair's ref count and free if zero. */ +extern void ssl_FreeKeyPair(sslKeyPair *keyPair); + +extern sslEphemeralKeyPair *ssl_NewEphemeralKeyPair( + const sslNamedGroupDef *group, + SECKEYPrivateKey *privKey, SECKEYPublicKey *pubKey); +extern sslEphemeralKeyPair *ssl_CopyEphemeralKeyPair( + sslEphemeralKeyPair *keyPair); +extern void ssl_FreeEphemeralKeyPair(sslEphemeralKeyPair *keyPair); +extern sslEphemeralKeyPair *ssl_LookupEphemeralKeyPair( + sslSocket *ss, const sslNamedGroupDef *groupDef); +extern PRBool ssl_HaveEphemeralKeyPair(const sslSocket *ss, + const sslNamedGroupDef *groupDef); +extern void ssl_FreeEphemeralKeyPairs(sslSocket *ss); + +extern SECStatus ssl_AppendPaddedDHKeyShare(const sslSocket *ss, + const SECKEYPublicKey *pubKey, + PRBool appendLength); +extern const ssl3DHParams *ssl_GetDHEParams(const sslNamedGroupDef *groupDef); +extern SECStatus ssl_SelectDHEGroup(sslSocket *ss, + const sslNamedGroupDef **groupDef); +extern SECStatus ssl_CreateDHEKeyPair(const sslNamedGroupDef *groupDef, + const ssl3DHParams *params, + sslEphemeralKeyPair **keyPair); +extern PRBool ssl_IsValidDHEShare(const SECItem *dh_p, const SECItem *dh_Ys); +extern SECStatus ssl_ValidateDHENamedGroup(sslSocket *ss, + const SECItem *dh_p, + const SECItem *dh_g, + const sslNamedGroupDef **groupDef, + const ssl3DHParams **dhParams); + +extern PRBool ssl_IsECCEnabled(const sslSocket *ss); +extern PRBool ssl_IsDHEEnabled(const sslSocket *ss); + +/* Macro for finding a curve equivalent in strength to RSA key's */ +#define SSL_RSASTRENGTH_TO_ECSTRENGTH(s) \ + ((s <= 1024) ? 160 \ + : ((s <= 2048) ? 224 \ + : ((s <= 3072) ? 256 \ + : ((s <= 7168) ? 384 \ + : 521)))) + +extern const sslNamedGroupDef *ssl_LookupNamedGroup(SSLNamedGroup group); +extern PRBool ssl_NamedGroupEnabled(const sslSocket *ss, const sslNamedGroupDef *group); +extern SECStatus ssl_NamedGroup2ECParams(PLArenaPool *arena, + const sslNamedGroupDef *curve, + SECKEYECParams *params); +extern const sslNamedGroupDef *ssl_ECPubKey2NamedGroup( + const SECKEYPublicKey *pubKey); + +extern const sslNamedGroupDef *ssl_GetECGroupForServerSocket(sslSocket *ss); +extern void ssl_FilterSupportedGroups(sslSocket *ss); + +extern SECStatus ssl3_CipherPrefSetDefault(ssl3CipherSuite which, PRBool on); +extern SECStatus ssl3_CipherPrefGetDefault(ssl3CipherSuite which, PRBool *on); + +extern SECStatus ssl3_CipherPrefSet(sslSocket *ss, ssl3CipherSuite which, PRBool on); +extern SECStatus ssl3_CipherPrefGet(const sslSocket *ss, ssl3CipherSuite which, PRBool *on); + +extern SECStatus ssl3_SetPolicy(ssl3CipherSuite which, PRInt32 policy); +extern SECStatus ssl3_GetPolicy(ssl3CipherSuite which, PRInt32 *policy); + +extern void ssl3_InitSocketPolicy(sslSocket *ss); + +extern SECStatus ssl3_RedoHandshake(sslSocket *ss, PRBool flushCache); +extern SECStatus ssl3_HandleHandshakeMessage(sslSocket *ss, SSL3Opaque *b, + PRUint32 length, + PRBool endOfRecord); + +extern void ssl3_DestroySSL3Info(sslSocket *ss); + +extern SECStatus ssl_ClientReadVersion(sslSocket *ss, SSL3Opaque **b, + PRUint32 *length, + SSL3ProtocolVersion *version); +extern SECStatus ssl3_NegotiateVersion(sslSocket *ss, + SSL3ProtocolVersion peerVersion, + PRBool allowLargerPeerVersion); + +extern SECStatus ssl_GetPeerInfo(sslSocket *ss); + +/* ECDH functions */ +extern SECStatus ssl3_SendECDHClientKeyExchange(sslSocket *ss, + SECKEYPublicKey *svrPubKey); +extern SECStatus ssl3_HandleECDHServerKeyExchange(sslSocket *ss, + SSL3Opaque *b, PRUint32 length); +extern SECStatus ssl3_HandleECDHClientKeyExchange(sslSocket *ss, + SSL3Opaque *b, PRUint32 length, + sslKeyPair *serverKeys); +extern SECStatus ssl3_SendECDHServerKeyExchange(sslSocket *ss); +extern SECStatus ssl_ImportECDHKeyShare( + sslSocket *ss, SECKEYPublicKey *peerKey, + SSL3Opaque *b, PRUint32 length, const sslNamedGroupDef *curve); +unsigned int tls13_SizeOfECDHEKeyShareKEX(const SECKEYPublicKey *pubKey); +SECStatus tls13_EncodeECDHEKeyShareKEX(const sslSocket *ss, + const SECKEYPublicKey *pubKey); + +extern SECStatus ssl3_ComputeCommonKeyHash(SSLHashType hashAlg, + PRUint8 *hashBuf, + unsigned int bufLen, + SSL3Hashes *hashes); +extern void ssl3_DestroyCipherSpec(ssl3CipherSpec *spec, PRBool freeSrvName); +extern SECStatus ssl3_InitPendingCipherSpec(sslSocket *ss, PK11SymKey *pms); +extern SECStatus ssl3_AppendHandshake(sslSocket *ss, const void *void_src, + PRInt32 bytes); +extern SECStatus ssl3_AppendHandshakeHeader(sslSocket *ss, + SSL3HandshakeType t, PRUint32 length); +extern SECStatus ssl3_AppendHandshakeNumber(sslSocket *ss, PRInt32 num, + PRInt32 lenSize); +extern SECStatus ssl3_AppendHandshakeVariable(sslSocket *ss, + const SSL3Opaque *src, PRInt32 bytes, PRInt32 lenSize); +extern SECStatus ssl3_AppendSignatureAndHashAlgorithm( + sslSocket *ss, const SSLSignatureAndHashAlg *sigAndHash); +extern SECStatus ssl3_ConsumeHandshake(sslSocket *ss, void *v, PRInt32 bytes, + SSL3Opaque **b, PRUint32 *length); +extern PRInt32 ssl3_ConsumeHandshakeNumber(sslSocket *ss, PRInt32 bytes, + SSL3Opaque **b, PRUint32 *length); +extern SECStatus ssl3_ConsumeHandshakeVariable(sslSocket *ss, SECItem *i, + PRInt32 bytes, SSL3Opaque **b, + PRUint32 *length); +extern PRUint8 *ssl_EncodeUintX(PRUint64 value, unsigned int bytes, + PRUint8 *to); +extern PRBool ssl_IsSupportedSignatureScheme(SSLSignatureScheme scheme); +extern SECStatus ssl_CheckSignatureSchemeConsistency( + sslSocket *ss, SSLSignatureScheme scheme, CERTCertificate *cert); +extern SECStatus ssl_ParseSignatureSchemes(const sslSocket *ss, PLArenaPool *arena, + SSLSignatureScheme **schemesOut, + unsigned int *numSchemesOut, + unsigned char **b, + unsigned int *len); +extern SECStatus ssl_ConsumeSignatureScheme( + sslSocket *ss, SSL3Opaque **b, PRUint32 *length, SSLSignatureScheme *out); +extern SECStatus ssl3_SignHashes(sslSocket *ss, SSL3Hashes *hash, + SECKEYPrivateKey *key, SECItem *buf); +extern SECStatus ssl3_VerifySignedHashes(sslSocket *ss, SSLSignatureScheme scheme, + SSL3Hashes *hash, SECItem *buf); +extern SECStatus ssl3_CacheWrappedMasterSecret( + sslSocket *ss, sslSessionID *sid, + ssl3CipherSpec *spec, SSLAuthType authType); +extern void ssl3_FreeSniNameArray(TLSExtensionData *xtnData); + +/* Hello Extension related routines. */ +extern void ssl3_SetSIDSessionTicket(sslSessionID *sid, + /*in/out*/ NewSessionTicket *session_ticket); +SECStatus ssl3_EncodeSessionTicket(sslSocket *ss, + const NewSessionTicket *ticket_input, + SECItem *ticket_data); +extern PRBool ssl_GetSessionTicketKeys(SECKEYPrivateKey *svrPrivKey, + SECKEYPublicKey *svrPubKey, void *pwArg, + unsigned char *keyName, PK11SymKey **aesKey, + PK11SymKey **macKey); +extern SECStatus ssl3_SessionTicketShutdown(void *appData, void *nssData); + +/* Tell clients to consider tickets valid for this long. */ +#define TLS_EX_SESS_TICKET_LIFETIME_HINT (2 * 24 * 60 * 60) /* 2 days */ +#define TLS_EX_SESS_TICKET_VERSION (0x0103) + +extern SECStatus ssl3_ValidateNextProtoNego(const unsigned char *data, + unsigned int length); + +/* Construct a new NSPR socket for the app to use */ +extern PRFileDesc *ssl_NewPRSocket(sslSocket *ss, PRFileDesc *fd); +extern void ssl_FreePRSocket(PRFileDesc *fd); + +/* Internal config function so SSL3 can initialize the present state of + * various ciphers */ +extern int ssl3_config_match_init(sslSocket *); + +/* calls for accessing wrapping keys across processes. */ +extern PRBool +ssl_GetWrappingKey(PRInt32 symWrapMechIndex, SSLAuthType authType, + SSLWrappedSymWrappingKey *wswk); + +/* The caller passes in the new value it wants + * to set. This code tests the wrapped sym key entry in the file on disk. + * If it is uninitialized, this function writes the caller's value into + * the disk entry, and returns false. + * Otherwise, it overwrites the caller's wswk with the value obtained from + * the disk, and returns PR_TRUE. + * This is all done while holding the locks/semaphores necessary to make + * the operation atomic. + */ +extern PRBool +ssl_SetWrappingKey(SSLWrappedSymWrappingKey *wswk); + +/* get rid of the symmetric wrapping key references. */ +extern SECStatus SSL3_ShutdownServerCache(void); + +extern SECStatus ssl_InitSymWrapKeysLock(void); + +extern SECStatus ssl_FreeSymWrapKeysLock(void); + +extern SECStatus ssl_InitSessionCacheLocks(PRBool lazyInit); + +extern SECStatus ssl_FreeSessionCacheLocks(void); + +/**************** DTLS-specific functions **************/ +extern void dtls_FreeHandshakeMessage(DTLSQueuedMessage *msg); +extern void dtls_FreeHandshakeMessages(PRCList *lst); + +extern SECStatus dtls_HandleHandshake(sslSocket *ss, sslBuffer *origBuf); +extern SECStatus dtls_HandleHelloVerifyRequest(sslSocket *ss, + SSL3Opaque *b, PRUint32 length); +extern SECStatus dtls_StageHandshakeMessage(sslSocket *ss); +extern SECStatus dtls_QueueMessage(sslSocket *ss, SSL3ContentType type, + const SSL3Opaque *pIn, PRInt32 nIn); +extern SECStatus dtls_FlushHandshakeMessages(sslSocket *ss, PRInt32 flags); +SECStatus ssl3_DisableNonDTLSSuites(sslSocket *ss); +extern SECStatus dtls_StartHolddownTimer(sslSocket *ss); +extern void dtls_CheckTimer(sslSocket *ss); +extern void dtls_CancelTimer(sslSocket *ss); +extern void dtls_SetMTU(sslSocket *ss, PRUint16 advertised); +extern void dtls_InitRecvdRecords(DTLSRecvdRecords *records); +extern int dtls_RecordGetRecvd(const DTLSRecvdRecords *records, + sslSequenceNumber seq); +extern void dtls_RecordSetRecvd(DTLSRecvdRecords *records, + sslSequenceNumber seq); +extern void dtls_RehandshakeCleanup(sslSocket *ss); +extern SSL3ProtocolVersion +dtls_TLSVersionToDTLSVersion(SSL3ProtocolVersion tlsv); +extern SSL3ProtocolVersion +dtls_DTLSVersionToTLSVersion(SSL3ProtocolVersion dtlsv); +extern PRBool dtls_IsRelevant(sslSocket *ss, const SSL3Ciphertext *cText, + PRBool *sameEpoch, PRUint64 *seqNum); +extern SECStatus dtls_MaybeRetransmitHandshake(sslSocket *ss, + const SSL3Ciphertext *cText, + PRBool sameEpoch); + +CK_MECHANISM_TYPE ssl3_Alg2Mech(SSLCipherAlgorithm calg); +SECStatus ssl3_NegotiateCipherSuite(sslSocket *ss, const SECItem *suites, + PRBool initHashes); +SECStatus ssl3_InitHandshakeHashes(sslSocket *ss); +SECStatus ssl3_ServerCallSNICallback(sslSocket *ss); +SECStatus ssl3_SetupPendingCipherSpec(sslSocket *ss); +SECStatus ssl3_FlushHandshake(sslSocket *ss, PRInt32 flags); +SECStatus ssl3_CompleteHandleCertificate(sslSocket *ss, + SSL3Opaque *b, PRUint32 length); +void ssl3_SendAlertForCertError(sslSocket *ss, PRErrorCode errCode); +SECStatus ssl3_HandleNoCertificate(sslSocket *ss); +SECStatus ssl3_SendEmptyCertificate(sslSocket *ss); +void ssl3_CleanupPeerCerts(sslSocket *ss); +SECStatus ssl3_SendCertificateStatus(sslSocket *ss); +SECStatus ssl3_AuthCertificate(sslSocket *ss); +SECStatus ssl_ReadCertificateStatus(sslSocket *ss, SSL3Opaque *b, + PRUint32 length); +SECStatus ssl3_EncodeSigAlgs(const sslSocket *ss, PRUint8 *buf, + unsigned maxLen, PRUint32 *len); +void ssl3_GetCertificateRequestCAs(sslSocket *ss, int *calenp, SECItem **namesp, + int *nnamesp); +SECStatus ssl3_ParseCertificateRequestCAs(sslSocket *ss, SSL3Opaque **b, + PRUint32 *length, PLArenaPool *arena, + CERTDistNames *ca_list); +SECStatus ssl3_CompleteHandleCertificateRequest( + sslSocket *ss, const SSLSignatureScheme *signatureSchemes, + unsigned int signatureSchemeCount, CERTDistNames *ca_list); +SECStatus ssl3_SendServerHello(sslSocket *ss); +SECStatus ssl3_ComputeHandshakeHashes(sslSocket *ss, + ssl3CipherSpec *spec, + SSL3Hashes *hashes, + PRUint32 sender); +SECStatus ssl_CreateECDHEphemeralKeyPair(const sslSocket *ss, + const sslNamedGroupDef *ecGroup, + sslEphemeralKeyPair **keyPair); +SECStatus ssl_CreateStaticECDHEKey(sslSocket *ss, + const sslNamedGroupDef *ecGroup); +SECStatus ssl3_FlushHandshake(sslSocket *ss, PRInt32 flags); +PK11SymKey *ssl3_GetWrappingKey(sslSocket *ss, + PK11SlotInfo *masterSecretSlot, + const sslServerCert *serverCert, + CK_MECHANISM_TYPE masterWrapMech, + void *pwArg); +SECStatus ssl3_FillInCachedSID(sslSocket *ss, sslSessionID *sid); +const ssl3CipherSuiteDef *ssl_LookupCipherSuiteDef(ssl3CipherSuite suite); +const ssl3BulkCipherDef * +ssl_GetBulkCipherDef(const ssl3CipherSuiteDef *cipher_def); +SECStatus ssl3_SelectServerCert(sslSocket *ss); +SECStatus ssl_PickSignatureScheme(sslSocket *ss, + SECKEYPublicKey *pubKey, + SECKEYPrivateKey *privKey, + const SSLSignatureScheme *peerSchemes, + unsigned int peerSchemeCount, + PRBool requireSha1); +SECOidTag ssl3_HashTypeToOID(SSLHashType hashType); +SSLHashType ssl_SignatureSchemeToHashType(SSLSignatureScheme scheme); +KeyType ssl_SignatureSchemeToKeyType(SSLSignatureScheme scheme); + +SECStatus ssl3_SetCipherSuite(sslSocket *ss, ssl3CipherSuite chosenSuite, + PRBool initHashes); + +/* Pull in TLS 1.3 functions */ +#include "tls13con.h" + +/********************** misc calls *********************/ + +#ifdef DEBUG +extern void ssl3_CheckCipherSuiteOrderConsistency(); +#endif + +extern int ssl_MapLowLevelError(int hiLevelError); + +extern PRUint32 ssl_Time(void); + +extern void SSL_AtomicIncrementLong(long *x); + +SECStatus ssl3_ApplyNSSPolicy(void); + +extern HASH_HashType +ssl3_GetTls12HashType(sslSocket *ss); + +extern SECStatus +ssl3_TLSPRFWithMasterSecret(ssl3CipherSpec *spec, + const char *label, unsigned int labelLen, + const unsigned char *val, unsigned int valLen, + unsigned char *out, unsigned int outLen, + HASH_HashType tls12HashType); + +#ifdef TRACE +#define SSL_TRACE(msg) ssl_Trace msg +#else +#define SSL_TRACE(msg) +#endif + +void ssl_Trace(const char *format, ...); + +SEC_END_PROTOS + +#if defined(XP_UNIX) || defined(XP_OS2) || defined(XP_BEOS) +#define SSL_GETPID getpid +#elif defined(WIN32) +extern int __cdecl _getpid(void); +#define SSL_GETPID _getpid +#else +#define SSL_GETPID() 0 +#endif + +#endif /* __sslimpl_h_ */ diff --git a/security/nss/lib/ssl/sslinfo.c b/security/nss/lib/ssl/sslinfo.c new file mode 100644 index 000000000..665109d65 --- /dev/null +++ b/security/nss/lib/ssl/sslinfo.c @@ -0,0 +1,493 @@ +/* -*- Mode: C; tab-width: 8; indent-tabs-mode: nil; c-basic-offset: 4 -*- */ +/* This Source Code Form is subject to the terms of the Mozilla Public + * License, v. 2.0. If a copy of the MPL was not distributed with this + * file, You can obtain one at http://mozilla.org/MPL/2.0/. */ +#include "ssl.h" +#include "sslimpl.h" +#include "sslproto.h" +#include "tls13hkdf.h" + +static const char * +ssl_GetCompressionMethodName(SSLCompressionMethod compression) +{ + switch (compression) { + case ssl_compression_null: + return "NULL"; +#ifdef NSS_ENABLE_ZLIB + case ssl_compression_deflate: + return "DEFLATE"; +#endif + default: + return "???"; + } +} + +SECStatus +SSL_GetChannelInfo(PRFileDesc *fd, SSLChannelInfo *info, PRUintn len) +{ + sslSocket *ss; + SSLChannelInfo inf; + sslSessionID *sid; + + /* Check if we can properly return the length of data written and that + * we're not asked to return more information than we know how to provide. + */ + if (!info || len < sizeof inf.length || len > sizeof inf) { + PORT_SetError(SEC_ERROR_INVALID_ARGS); + return SECFailure; + } + + ss = ssl_FindSocket(fd); + if (!ss) { + SSL_DBG(("%d: SSL[%d]: bad socket in SSL_GetChannelInfo", + SSL_GETPID(), fd)); + return SECFailure; + } + + memset(&inf, 0, sizeof inf); + inf.length = PR_MIN(sizeof inf, len); + + if (ss->opt.useSecurity && ss->enoughFirstHsDone) { + sid = ss->sec.ci.sid; + inf.protocolVersion = ss->version; + inf.authKeyBits = ss->sec.authKeyBits; + inf.keaKeyBits = ss->sec.keaKeyBits; + if (ss->ssl3.initialized) { + SSLCipherSuiteInfo cinfo; + SECStatus rv; + + ssl_GetSpecReadLock(ss); + /* XXX The cipher suite should be in the specs and this + * function should get it from cwSpec rather than from the "hs". + * See bug 275744 comment 69 and bug 766137. + */ + inf.cipherSuite = ss->ssl3.hs.cipher_suite; + inf.compressionMethod = ss->ssl3.cwSpec->compression_method; + ssl_ReleaseSpecReadLock(ss); + inf.compressionMethodName = + ssl_GetCompressionMethodName(inf.compressionMethod); + + /* Fill in the cipher details from the cipher suite. */ + rv = SSL_GetCipherSuiteInfo(inf.cipherSuite, + &cinfo, sizeof(cinfo)); + if (rv != SECSuccess) { + return SECFailure; /* Error code already set. */ + } + inf.symCipher = cinfo.symCipher; + inf.macAlgorithm = cinfo.macAlgorithm; + /* Get these fromm |ss->sec| because that is accurate + * even with TLS 1.3 disaggregated cipher suites. */ + inf.keaType = ss->sec.keaType; + inf.keaGroup = ss->sec.keaGroup ? ss->sec.keaGroup->name : ssl_grp_none; + inf.keaKeyBits = ss->sec.keaKeyBits; + inf.authType = ss->sec.authType; + inf.authKeyBits = ss->sec.authKeyBits; + inf.signatureScheme = ss->sec.signatureScheme; + } + if (sid) { + unsigned int sidLen; + + inf.creationTime = sid->creationTime; + inf.lastAccessTime = sid->lastAccessTime; + inf.expirationTime = sid->expirationTime; + inf.extendedMasterSecretUsed = + (ss->version >= SSL_LIBRARY_VERSION_TLS_1_3 || + sid->u.ssl3.keys.extendedMasterSecretUsed) + ? PR_TRUE + : PR_FALSE; + + inf.earlyDataAccepted = + (ss->ssl3.hs.zeroRttState == ssl_0rtt_accepted || + ss->ssl3.hs.zeroRttState == ssl_0rtt_done); + sidLen = sid->u.ssl3.sessionIDLength; + sidLen = PR_MIN(sidLen, sizeof inf.sessionID); + inf.sessionIDLength = sidLen; + memcpy(inf.sessionID, sid->u.ssl3.sessionID, sidLen); + } + } + + memcpy(info, &inf, inf.length); + + return SECSuccess; +} + +SECStatus +SSL_GetPreliminaryChannelInfo(PRFileDesc *fd, + SSLPreliminaryChannelInfo *info, + PRUintn len) +{ + sslSocket *ss; + SSLPreliminaryChannelInfo inf; + + /* Check if we can properly return the length of data written and that + * we're not asked to return more information than we know how to provide. + */ + if (!info || len < sizeof inf.length || len > sizeof inf) { + PORT_SetError(SEC_ERROR_INVALID_ARGS); + return SECFailure; + } + + ss = ssl_FindSocket(fd); + if (!ss) { + SSL_DBG(("%d: SSL[%d]: bad socket in SSL_GetPreliminaryChannelInfo", + SSL_GETPID(), fd)); + return SECFailure; + } + + memset(&inf, 0, sizeof(inf)); + inf.length = PR_MIN(sizeof(inf), len); + + inf.valuesSet = ss->ssl3.hs.preliminaryInfo; + inf.protocolVersion = ss->version; + inf.cipherSuite = ss->ssl3.hs.cipher_suite; + + memcpy(info, &inf, inf.length); + return SECSuccess; +} + +/* name */ +#define CS_(x) x, #x +#define CS(x) CS_(TLS_##x) + +/* legacy values for authAlgorithm */ +#define S_DSA "DSA", ssl_auth_dsa +/* S_RSA is incorrect for signature-based suites */ +/* ECDH suites incorrectly report S_RSA or S_ECDSA */ +#define S_RSA "RSA", ssl_auth_rsa_decrypt +#define S_ECDSA "ECDSA", ssl_auth_ecdsa +#define S_PSK "PSK", ssl_auth_psk +#define S_ANY "TLS 1.3", ssl_auth_tls13_any + +/* real authentication algorithm */ +#define A_DSA ssl_auth_dsa +#define A_RSAD ssl_auth_rsa_decrypt +#define A_RSAS ssl_auth_rsa_sign +#define A_ECDSA ssl_auth_ecdsa +#define A_ECDH_R ssl_auth_ecdh_rsa +#define A_ECDH_E ssl_auth_ecdh_ecdsa +#define A_PSK ssl_auth_psk +/* Report ssl_auth_null for export suites that can't decide between + * ssl_auth_rsa_sign and ssl_auth_rsa_decrypt. */ +#define A_EXP ssl_auth_null +#define A_ANY ssl_auth_tls13_any + +/* key exchange */ +#define K_DHE "DHE", ssl_kea_dh +#define K_RSA "RSA", ssl_kea_rsa +#define K_KEA "KEA", ssl_kea_kea +#define K_ECDH "ECDH", ssl_kea_ecdh +#define K_ECDHE "ECDHE", ssl_kea_ecdh +#define K_ECDHE_PSK "ECDHE-PSK", ssl_kea_ecdh_psk +#define K_DHE_PSK "DHE-PSK", ssl_kea_dh_psk +#define K_ANY "TLS 1.3", ssl_kea_tls13_any + +/* record protection cipher */ +#define C_SEED "SEED", calg_seed +#define C_CAMELLIA "CAMELLIA", calg_camellia +#define C_AES "AES", calg_aes +#define C_RC4 "RC4", calg_rc4 +#define C_RC2 "RC2", calg_rc2 +#define C_DES "DES", calg_des +#define C_3DES "3DES", calg_3des +#define C_NULL "NULL", calg_null +#define C_SJ "SKIPJACK", calg_sj +#define C_AESGCM "AES-GCM", calg_aes_gcm +#define C_CHACHA20 "CHACHA20POLY1305", calg_chacha20 + +/* "block cipher" sizes */ +#define B_256 256, 256, 256 +#define B_128 128, 128, 128 +#define B_3DES 192, 156, 112 +#define B_SJ 96, 80, 80 +#define B_DES 64, 56, 56 +#define B_56 128, 56, 56 +#define B_40 128, 40, 40 +#define B_0 0, 0, 0 + +/* "mac algorithm" and size */ +#define M_AEAD_128 "AEAD", ssl_mac_aead, 128 +#define M_SHA384 "SHA384", ssl_hmac_sha384, 384 +#define M_SHA256 "SHA256", ssl_hmac_sha256, 256 +#define M_SHA "SHA1", ssl_mac_sha, 160 +#define M_MD5 "MD5", ssl_mac_md5, 128 +#define M_NULL "NULL", ssl_mac_null, 0 + +/* flags: FIPS, exportable, nonstandard, reserved */ +#define F_FIPS_STD 1, 0, 0, 0 +#define F_FIPS_NSTD 1, 0, 1, 0 +#define F_NFIPS_STD 0, 0, 0, 0 +#define F_NFIPS_NSTD 0, 0, 1, 0 /* i.e., trash */ +#define F_EXPORT 0, 1, 0, 0 /* i.e., trash */ + +static const SSLCipherSuiteInfo suiteInfo[] = { + /* <------ Cipher suite --------------------> <auth> <KEA> <bulk cipher> <MAC> <FIPS> */ + { 0, CS_(TLS_AES_128_GCM_SHA256), S_ANY, K_ANY, C_AESGCM, B_128, M_AEAD_128, F_FIPS_STD, A_ANY }, + { 0, CS_(TLS_CHACHA20_POLY1305_SHA256), S_ANY, K_ANY, C_CHACHA20, B_256, M_AEAD_128, F_NFIPS_STD, A_ANY }, + { 0, CS_(TLS_AES_256_GCM_SHA384), S_ANY, K_ANY, C_AESGCM, B_256, M_AEAD_128, F_NFIPS_STD, A_ANY }, + + { 0, CS(RSA_WITH_AES_128_GCM_SHA256), S_RSA, K_RSA, C_AESGCM, B_128, M_AEAD_128, F_FIPS_STD, A_RSAD }, + { 0, CS(DHE_RSA_WITH_CHACHA20_POLY1305_SHA256), S_RSA, K_DHE, C_CHACHA20, B_256, M_AEAD_128, F_NFIPS_STD, A_RSAS }, + + { 0, CS(DHE_RSA_WITH_CAMELLIA_256_CBC_SHA), S_RSA, K_DHE, C_CAMELLIA, B_256, M_SHA, F_NFIPS_STD, A_RSAS }, + { 0, CS(DHE_DSS_WITH_CAMELLIA_256_CBC_SHA), S_DSA, K_DHE, C_CAMELLIA, B_256, M_SHA, F_NFIPS_STD, A_DSA }, + { 0, CS(DHE_RSA_WITH_AES_256_CBC_SHA256), S_RSA, K_DHE, C_AES, B_256, M_SHA256, F_FIPS_STD, A_RSAS }, + { 0, CS(DHE_RSA_WITH_AES_256_CBC_SHA), S_RSA, K_DHE, C_AES, B_256, M_SHA, F_FIPS_STD, A_RSAS }, + { 0, CS(DHE_DSS_WITH_AES_256_CBC_SHA), S_DSA, K_DHE, C_AES, B_256, M_SHA, F_FIPS_STD, A_DSA }, + { 0, CS(DHE_DSS_WITH_AES_256_CBC_SHA256), S_DSA, K_DHE, C_AES, B_256, M_SHA256, F_FIPS_STD, A_DSA }, + { 0, CS(RSA_WITH_CAMELLIA_256_CBC_SHA), S_RSA, K_RSA, C_CAMELLIA, B_256, M_SHA, F_NFIPS_STD, A_RSAD }, + { 0, CS(RSA_WITH_AES_256_CBC_SHA256), S_RSA, K_RSA, C_AES, B_256, M_SHA256, F_FIPS_STD, A_RSAD }, + { 0, CS(RSA_WITH_AES_256_CBC_SHA), S_RSA, K_RSA, C_AES, B_256, M_SHA, F_FIPS_STD, A_RSAD }, + + { 0, CS(DHE_RSA_WITH_CAMELLIA_128_CBC_SHA), S_RSA, K_DHE, C_CAMELLIA, B_128, M_SHA, F_NFIPS_STD, A_RSAS }, + { 0, CS(DHE_DSS_WITH_CAMELLIA_128_CBC_SHA), S_DSA, K_DHE, C_CAMELLIA, B_128, M_SHA, F_NFIPS_STD, A_DSA }, + { 0, CS(DHE_DSS_WITH_RC4_128_SHA), S_DSA, K_DHE, C_RC4, B_128, M_SHA, F_NFIPS_STD, A_DSA }, + { 0, CS(DHE_RSA_WITH_AES_128_CBC_SHA256), S_RSA, K_DHE, C_AES, B_128, M_SHA256, F_FIPS_STD, A_RSAS }, + { 0, CS(DHE_RSA_WITH_AES_128_GCM_SHA256), S_RSA, K_DHE, C_AESGCM, B_128, M_AEAD_128, F_FIPS_STD, A_RSAS }, + { 0, CS(DHE_RSA_WITH_AES_128_CBC_SHA), S_RSA, K_DHE, C_AES, B_128, M_SHA, F_FIPS_STD, A_RSAS }, + { 0, CS(DHE_DSS_WITH_AES_128_GCM_SHA256), S_DSA, K_DHE, C_AESGCM, B_128, M_AEAD_128, F_FIPS_STD, A_DSA }, + { 0, CS(DHE_DSS_WITH_AES_128_CBC_SHA), S_DSA, K_DHE, C_AES, B_128, M_SHA, F_FIPS_STD, A_DSA }, + { 0, CS(DHE_DSS_WITH_AES_128_CBC_SHA256), S_DSA, K_DHE, C_AES, B_128, M_SHA256, F_FIPS_STD, A_DSA }, + { 0, CS(RSA_WITH_SEED_CBC_SHA), S_RSA, K_RSA, C_SEED, B_128, M_SHA, F_FIPS_STD, A_RSAD }, + { 0, CS(RSA_WITH_CAMELLIA_128_CBC_SHA), S_RSA, K_RSA, C_CAMELLIA, B_128, M_SHA, F_NFIPS_STD, A_RSAD }, + { 0, CS(RSA_WITH_RC4_128_SHA), S_RSA, K_RSA, C_RC4, B_128, M_SHA, F_NFIPS_STD, A_RSAD }, + { 0, CS(RSA_WITH_RC4_128_MD5), S_RSA, K_RSA, C_RC4, B_128, M_MD5, F_NFIPS_STD, A_RSAD }, + { 0, CS(RSA_WITH_AES_128_CBC_SHA256), S_RSA, K_RSA, C_AES, B_128, M_SHA256, F_FIPS_STD, A_RSAD }, + { 0, CS(RSA_WITH_AES_128_CBC_SHA), S_RSA, K_RSA, C_AES, B_128, M_SHA, F_FIPS_STD, A_RSAD }, + + { 0, CS(DHE_RSA_WITH_3DES_EDE_CBC_SHA), S_RSA, K_DHE, C_3DES, B_3DES, M_SHA, F_FIPS_STD, A_RSAS }, + { 0, CS(DHE_DSS_WITH_3DES_EDE_CBC_SHA), S_DSA, K_DHE, C_3DES, B_3DES, M_SHA, F_FIPS_STD, A_DSA }, + { 0, CS(RSA_WITH_3DES_EDE_CBC_SHA), S_RSA, K_RSA, C_3DES, B_3DES, M_SHA, F_FIPS_STD, A_RSAD }, + + { 0, CS(DHE_RSA_WITH_DES_CBC_SHA), S_RSA, K_DHE, C_DES, B_DES, M_SHA, F_NFIPS_STD, A_RSAS }, + { 0, CS(DHE_DSS_WITH_DES_CBC_SHA), S_DSA, K_DHE, C_DES, B_DES, M_SHA, F_NFIPS_STD, A_DSA }, + { 0, CS(RSA_WITH_DES_CBC_SHA), S_RSA, K_RSA, C_DES, B_DES, M_SHA, F_NFIPS_STD, A_RSAD }, + + { 0, CS(RSA_WITH_NULL_SHA256), S_RSA, K_RSA, C_NULL, B_0, M_SHA256, F_EXPORT, A_RSAD }, + { 0, CS(RSA_WITH_NULL_SHA), S_RSA, K_RSA, C_NULL, B_0, M_SHA, F_EXPORT, A_RSAD }, + { 0, CS(RSA_WITH_NULL_MD5), S_RSA, K_RSA, C_NULL, B_0, M_MD5, F_EXPORT, A_RSAD }, + + /* ECC cipher suites */ + { 0, CS(ECDHE_RSA_WITH_AES_128_GCM_SHA256), S_RSA, K_ECDHE, C_AESGCM, B_128, M_AEAD_128, F_FIPS_STD, A_RSAS }, + { 0, CS(ECDHE_ECDSA_WITH_AES_128_GCM_SHA256), S_ECDSA, K_ECDHE, C_AESGCM, B_128, M_AEAD_128, F_FIPS_STD, A_ECDSA }, + { 0, CS(ECDH_ECDSA_WITH_NULL_SHA), S_ECDSA, K_ECDH, C_NULL, B_0, M_SHA, F_NFIPS_STD, A_ECDH_E }, + { 0, CS(ECDH_ECDSA_WITH_RC4_128_SHA), S_ECDSA, K_ECDH, C_RC4, B_128, M_SHA, F_NFIPS_STD, A_ECDH_E }, + { 0, CS(ECDH_ECDSA_WITH_3DES_EDE_CBC_SHA), S_ECDSA, K_ECDH, C_3DES, B_3DES, M_SHA, F_FIPS_STD, A_ECDH_E }, + { 0, CS(ECDH_ECDSA_WITH_AES_128_CBC_SHA), S_ECDSA, K_ECDH, C_AES, B_128, M_SHA, F_FIPS_STD, A_ECDH_E }, + { 0, CS(ECDH_ECDSA_WITH_AES_256_CBC_SHA), S_ECDSA, K_ECDH, C_AES, B_256, M_SHA, F_FIPS_STD, A_ECDH_E }, + + { 0, CS(ECDHE_ECDSA_WITH_NULL_SHA), S_ECDSA, K_ECDHE, C_NULL, B_0, M_SHA, F_NFIPS_STD, A_ECDSA }, + { 0, CS(ECDHE_ECDSA_WITH_RC4_128_SHA), S_ECDSA, K_ECDHE, C_RC4, B_128, M_SHA, F_NFIPS_STD, A_ECDSA }, + { 0, CS(ECDHE_ECDSA_WITH_3DES_EDE_CBC_SHA), S_ECDSA, K_ECDHE, C_3DES, B_3DES, M_SHA, F_FIPS_STD, A_ECDSA }, + { 0, CS(ECDHE_ECDSA_WITH_AES_128_CBC_SHA), S_ECDSA, K_ECDHE, C_AES, B_128, M_SHA, F_FIPS_STD, A_ECDSA }, + { 0, CS(ECDHE_ECDSA_WITH_AES_128_CBC_SHA256), S_ECDSA, K_ECDHE, C_AES, B_128, M_SHA256, F_FIPS_STD, A_ECDSA }, + { 0, CS(ECDHE_ECDSA_WITH_AES_256_CBC_SHA), S_ECDSA, K_ECDHE, C_AES, B_256, M_SHA, F_FIPS_STD, A_ECDSA }, + { 0, CS(ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256), S_ECDSA, K_ECDHE, C_CHACHA20, B_256, M_AEAD_128, F_NFIPS_STD, A_ECDSA }, + + { 0, CS(ECDH_RSA_WITH_NULL_SHA), S_RSA, K_ECDH, C_NULL, B_0, M_SHA, F_NFIPS_STD, A_ECDH_R }, + { 0, CS(ECDH_RSA_WITH_RC4_128_SHA), S_RSA, K_ECDH, C_RC4, B_128, M_SHA, F_NFIPS_STD, A_ECDH_R }, + { 0, CS(ECDH_RSA_WITH_3DES_EDE_CBC_SHA), S_RSA, K_ECDH, C_3DES, B_3DES, M_SHA, F_FIPS_STD, A_ECDH_R }, + { 0, CS(ECDH_RSA_WITH_AES_128_CBC_SHA), S_RSA, K_ECDH, C_AES, B_128, M_SHA, F_FIPS_STD, A_ECDH_R }, + { 0, CS(ECDH_RSA_WITH_AES_256_CBC_SHA), S_RSA, K_ECDH, C_AES, B_256, M_SHA, F_FIPS_STD, A_ECDH_R }, + + { 0, CS(ECDHE_RSA_WITH_NULL_SHA), S_RSA, K_ECDHE, C_NULL, B_0, M_SHA, F_NFIPS_STD, A_RSAS }, + { 0, CS(ECDHE_RSA_WITH_RC4_128_SHA), S_RSA, K_ECDHE, C_RC4, B_128, M_SHA, F_NFIPS_STD, A_RSAS }, + { 0, CS(ECDHE_RSA_WITH_3DES_EDE_CBC_SHA), S_RSA, K_ECDHE, C_3DES, B_3DES, M_SHA, F_FIPS_STD, A_RSAS }, + { 0, CS(ECDHE_RSA_WITH_AES_128_CBC_SHA), S_RSA, K_ECDHE, C_AES, B_128, M_SHA, F_FIPS_STD, A_RSAS }, + { 0, CS(ECDHE_RSA_WITH_AES_128_CBC_SHA256), S_RSA, K_ECDHE, C_AES, B_128, M_SHA256, F_FIPS_STD, A_RSAS }, + { 0, CS(ECDHE_RSA_WITH_AES_256_CBC_SHA), S_RSA, K_ECDHE, C_AES, B_256, M_SHA, F_FIPS_STD, A_RSAS }, + { 0, CS(ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256), S_RSA, K_ECDHE, C_CHACHA20, B_256, M_AEAD_128, F_NFIPS_STD, A_RSAS }, + { 0, CS(ECDHE_RSA_WITH_AES_256_CBC_SHA384), S_RSA, K_ECDHE, C_AES, B_256, M_SHA384, F_FIPS_STD, A_RSAS }, + { 0, CS(ECDHE_ECDSA_WITH_AES_256_CBC_SHA384), S_ECDSA, K_ECDHE, C_AES, B_256, M_SHA384, F_FIPS_STD, A_ECDSA }, + { 0, CS(ECDHE_ECDSA_WITH_AES_256_GCM_SHA384), S_ECDSA, K_ECDHE, C_AESGCM, B_256, M_AEAD_128, F_FIPS_STD, A_ECDSA }, + { 0, CS(ECDHE_RSA_WITH_AES_256_GCM_SHA384), S_RSA, K_ECDHE, C_AESGCM, B_256, M_AEAD_128, F_FIPS_STD, A_RSAS }, + + { 0, CS(DHE_DSS_WITH_AES_256_GCM_SHA384), S_DSA, K_DHE, C_AESGCM, B_256, M_AEAD_128, F_FIPS_STD, A_DSA }, + { 0, CS(DHE_RSA_WITH_AES_256_GCM_SHA384), S_RSA, K_DHE, C_AESGCM, B_256, M_AEAD_128, F_FIPS_STD, A_RSAS }, + { 0, CS(RSA_WITH_AES_256_GCM_SHA384), S_RSA, K_RSA, C_AESGCM, B_256, M_AEAD_128, F_FIPS_STD, A_RSAD }, +}; + +#define NUM_SUITEINFOS ((sizeof suiteInfo) / (sizeof suiteInfo[0])) + +SECStatus +SSL_GetCipherSuiteInfo(PRUint16 cipherSuite, + SSLCipherSuiteInfo *info, PRUintn len) +{ + unsigned int i; + + /* Check if we can properly return the length of data written and that + * we're not asked to return more information than we know how to provide. + */ + if (!info || len < sizeof suiteInfo[0].length || + len > sizeof suiteInfo[0]) { + PORT_SetError(SEC_ERROR_INVALID_ARGS); + return SECFailure; + } + len = PR_MIN(len, sizeof suiteInfo[0]); + for (i = 0; i < NUM_SUITEINFOS; i++) { + if (suiteInfo[i].cipherSuite == cipherSuite) { + memcpy(info, &suiteInfo[i], len); + info->length = len; + return SECSuccess; + } + } + + PORT_SetError(SEC_ERROR_INVALID_ARGS); + return SECFailure; +} + +SECItem * +SSL_GetNegotiatedHostInfo(PRFileDesc *fd) +{ + SECItem *sniName = NULL; + sslSocket *ss; + char *name = NULL; + + ss = ssl_FindSocket(fd); + if (!ss) { + SSL_DBG(("%d: SSL[%d]: bad socket in SSL_GetNegotiatedHostInfo", + SSL_GETPID(), fd)); + return NULL; + } + + if (ss->sec.isServer) { + if (ss->version > SSL_LIBRARY_VERSION_3_0 && + ss->ssl3.initialized) { /* TLS */ + SECItem *crsName; + ssl_GetSpecReadLock(ss); /*********************************/ + crsName = &ss->ssl3.hs.srvVirtName; + if (crsName->data) { + sniName = SECITEM_DupItem(crsName); + } + ssl_ReleaseSpecReadLock(ss); /*----------------------------*/ + } + return sniName; + } + name = SSL_RevealURL(fd); + if (name) { + sniName = PORT_ZNew(SECItem); + if (!sniName) { + PORT_Free(name); + return NULL; + } + sniName->data = (void *)name; + sniName->len = PORT_Strlen(name); + } + return sniName; +} + +static SECStatus +tls13_Exporter(sslSocket *ss, PK11SymKey *secret, + const char *label, unsigned int labelLen, + const unsigned char *context, unsigned int contextLen, + unsigned char *out, unsigned int outLen) +{ + if (!secret) { + PORT_SetError(SEC_ERROR_INVALID_ARGS); + return SECFailure; + } + + return tls13_HkdfExpandLabelRaw(secret, + tls13_GetHash(ss), + context, contextLen, + label, labelLen, + out, outLen); +} + +SECStatus +SSL_ExportKeyingMaterial(PRFileDesc *fd, + const char *label, unsigned int labelLen, + PRBool hasContext, + const unsigned char *context, unsigned int contextLen, + unsigned char *out, unsigned int outLen) +{ + sslSocket *ss; + unsigned char *val = NULL; + unsigned int valLen, i; + SECStatus rv = SECFailure; + + ss = ssl_FindSocket(fd); + if (!ss) { + SSL_DBG(("%d: SSL[%d]: bad socket in ExportKeyingMaterial", + SSL_GETPID(), fd)); + return SECFailure; + } + + if (!label || !labelLen || !out || !outLen || + (hasContext && (!context || !contextLen))) { + PORT_SetError(SEC_ERROR_INVALID_ARGS); + return SECFailure; + } + + if (ss->version >= SSL_LIBRARY_VERSION_TLS_1_3) { + return tls13_Exporter(ss, ss->ssl3.hs.exporterSecret, + label, labelLen, + context, hasContext ? contextLen : 0, + out, outLen); + } + + /* construct PRF arguments */ + valLen = SSL3_RANDOM_LENGTH * 2; + if (hasContext) { + valLen += 2 /* PRUint16 length */ + contextLen; + } + val = PORT_Alloc(valLen); + if (!val) { + return SECFailure; + } + i = 0; + PORT_Memcpy(val + i, &ss->ssl3.hs.client_random.rand, SSL3_RANDOM_LENGTH); + i += SSL3_RANDOM_LENGTH; + PORT_Memcpy(val + i, &ss->ssl3.hs.server_random.rand, SSL3_RANDOM_LENGTH); + i += SSL3_RANDOM_LENGTH; + if (hasContext) { + val[i++] = contextLen >> 8; + val[i++] = contextLen; + PORT_Memcpy(val + i, context, contextLen); + i += contextLen; + } + PORT_Assert(i == valLen); + + /* Allow TLS keying material to be exported sooner, when the master + * secret is available and we have sent ChangeCipherSpec. + */ + ssl_GetSpecReadLock(ss); + if (!ss->ssl3.cwSpec->master_secret && !ss->ssl3.cwSpec->msItem.len) { + PORT_SetError(SSL_ERROR_HANDSHAKE_NOT_COMPLETED); + rv = SECFailure; + } else { + HASH_HashType ht = ssl3_GetTls12HashType(ss); + rv = ssl3_TLSPRFWithMasterSecret(ss->ssl3.cwSpec, label, labelLen, val, + valLen, out, outLen, ht); + } + ssl_ReleaseSpecReadLock(ss); + + PORT_ZFree(val, valLen); + return rv; +} + +SECStatus +SSL_ExportEarlyKeyingMaterial(PRFileDesc *fd, + const char *label, unsigned int labelLen, + const unsigned char *context, + unsigned int contextLen, + unsigned char *out, unsigned int outLen) +{ + sslSocket *ss; + + ss = ssl_FindSocket(fd); + if (!ss) { + SSL_DBG(("%d: SSL[%d]: bad socket in SSL_ExportEarlyKeyingMaterial", + SSL_GETPID(), fd)); + return SECFailure; + } + + if (!label || !labelLen || !out || !outLen || + (!context && contextLen)) { + PORT_SetError(SEC_ERROR_INVALID_ARGS); + return SECFailure; + } + + return tls13_Exporter(ss, ss->ssl3.hs.earlyExporterSecret, + label, labelLen, context, contextLen, + out, outLen); +} diff --git a/security/nss/lib/ssl/sslinit.c b/security/nss/lib/ssl/sslinit.c new file mode 100644 index 000000000..0f38c0b57 --- /dev/null +++ b/security/nss/lib/ssl/sslinit.c @@ -0,0 +1,59 @@ +/* + * NSS utility functions + * + * This Source Code Form is subject to the terms of the Mozilla Public + * License, v. 2.0. If a copy of the MPL was not distributed with this + * file, You can obtain one at http://mozilla.org/MPL/2.0/. */ + +#include "prtypes.h" +#include "prinit.h" +#include "seccomon.h" +#include "secerr.h" +#include "ssl.h" +#include "sslimpl.h" +#include "sslproto.h" + +static int ssl_isInited = 0; +static PRCallOnceType ssl_init = { 0 }; + +PRStatus +ssl_InitCallOnce(void *arg) +{ + int *error = (int *)arg; + SECStatus rv; + + rv = ssl_InitializePRErrorTable(); + if (rv != SECSuccess) { + *error = SEC_ERROR_NO_MEMORY; + return PR_FAILURE; + } +#ifdef DEBUG + ssl3_CheckCipherSuiteOrderConsistency(); +#endif + + rv = ssl3_ApplyNSSPolicy(); + if (rv != SECSuccess) { + *error = PORT_GetError(); + return PR_FAILURE; + } + return PR_SUCCESS; +} + +SECStatus +ssl_Init(void) +{ + PRStatus nrv; + + /* short circuit test if we are already inited */ + if (!ssl_isInited) { + int error; + /* only do this once at init time, block all others until we are done */ + nrv = PR_CallOnceWithArg(&ssl_init, ssl_InitCallOnce, &error); + if (nrv != PR_SUCCESS) { + PORT_SetError(error); + return SECFailure; + } + ssl_isInited = 1; + } + return SECSuccess; +} diff --git a/security/nss/lib/ssl/sslmutex.c b/security/nss/lib/ssl/sslmutex.c new file mode 100644 index 000000000..560a9e823 --- /dev/null +++ b/security/nss/lib/ssl/sslmutex.c @@ -0,0 +1,658 @@ +/* This Source Code Form is subject to the terms of the Mozilla Public + * License, v. 2.0. If a copy of the MPL was not distributed with this + * file, You can obtain one at http://mozilla.org/MPL/2.0/. */ + +#include "seccomon.h" +/* This ifdef should match the one in sslsnce.c */ +#if defined(XP_UNIX) || defined(XP_WIN32) || defined(XP_OS2) || defined(XP_BEOS) + +#include "sslmutex.h" +#include "prerr.h" + +static SECStatus +single_process_sslMutex_Init(sslMutex* pMutex) +{ + PR_ASSERT(pMutex != 0 && pMutex->u.sslLock == 0); + + pMutex->u.sslLock = PR_NewLock(); + if (!pMutex->u.sslLock) { + return SECFailure; + } + return SECSuccess; +} + +static SECStatus +single_process_sslMutex_Destroy(sslMutex* pMutex) +{ + PR_ASSERT(pMutex != 0); + PR_ASSERT(pMutex->u.sslLock != 0); + if (!pMutex->u.sslLock) { + PORT_SetError(PR_INVALID_ARGUMENT_ERROR); + return SECFailure; + } + PR_DestroyLock(pMutex->u.sslLock); + return SECSuccess; +} + +static SECStatus +single_process_sslMutex_Unlock(sslMutex* pMutex) +{ + PR_ASSERT(pMutex != 0); + PR_ASSERT(pMutex->u.sslLock != 0); + if (!pMutex->u.sslLock) { + PORT_SetError(PR_INVALID_ARGUMENT_ERROR); + return SECFailure; + } + PR_Unlock(pMutex->u.sslLock); + return SECSuccess; +} + +static SECStatus +single_process_sslMutex_Lock(sslMutex* pMutex) +{ + PR_ASSERT(pMutex != 0); + PR_ASSERT(pMutex->u.sslLock != 0); + if (!pMutex->u.sslLock) { + PORT_SetError(PR_INVALID_ARGUMENT_ERROR); + return SECFailure; + } + PR_Lock(pMutex->u.sslLock); + return SECSuccess; +} + +#if defined(LINUX) || defined(AIX) || defined(BEOS) || defined(BSDI) || (defined(NETBSD) && __NetBSD_Version__ < 500000000) || defined(OPENBSD) + +#include <unistd.h> +#include <fcntl.h> +#include <string.h> +#include <errno.h> +#include "unix_err.h" +#include "pratom.h" + +#define SSL_MUTEX_MAGIC 0xfeedfd +#define NONBLOCKING_POSTS 1 /* maybe this is faster */ + +#if NONBLOCKING_POSTS + +#ifndef FNONBLOCK +#define FNONBLOCK O_NONBLOCK +#endif + +static int +setNonBlocking(int fd, int nonBlocking) +{ + int flags; + int err; + + flags = fcntl(fd, F_GETFL, 0); + if (0 > flags) + return flags; + if (nonBlocking) + flags |= FNONBLOCK; + else + flags &= ~FNONBLOCK; + err = fcntl(fd, F_SETFL, flags); + return err; +} +#endif + +SECStatus +sslMutex_Init(sslMutex* pMutex, int shared) +{ + int err; + PR_ASSERT(pMutex); + pMutex->isMultiProcess = (PRBool)(shared != 0); + if (!shared) { + return single_process_sslMutex_Init(pMutex); + } + pMutex->u.pipeStr.mPipes[0] = -1; + pMutex->u.pipeStr.mPipes[1] = -1; + pMutex->u.pipeStr.mPipes[2] = -1; + pMutex->u.pipeStr.nWaiters = 0; + + err = pipe(pMutex->u.pipeStr.mPipes); + if (err) { + nss_MD_unix_map_default_error(errno); + return err; + } +#if NONBLOCKING_POSTS + err = setNonBlocking(pMutex->u.pipeStr.mPipes[1], 1); + if (err) + goto loser; +#endif + + pMutex->u.pipeStr.mPipes[2] = SSL_MUTEX_MAGIC; + +#if defined(LINUX) && defined(i386) + /* Pipe starts out empty */ + return SECSuccess; +#else + /* Pipe starts with one byte. */ + return sslMutex_Unlock(pMutex); +#endif + +loser: + nss_MD_unix_map_default_error(errno); + close(pMutex->u.pipeStr.mPipes[0]); + close(pMutex->u.pipeStr.mPipes[1]); + return SECFailure; +} + +SECStatus +sslMutex_Destroy(sslMutex* pMutex, PRBool processLocal) +{ + if (PR_FALSE == pMutex->isMultiProcess) { + return single_process_sslMutex_Destroy(pMutex); + } + if (pMutex->u.pipeStr.mPipes[2] != SSL_MUTEX_MAGIC) { + PORT_SetError(PR_INVALID_ARGUMENT_ERROR); + return SECFailure; + } + close(pMutex->u.pipeStr.mPipes[0]); + close(pMutex->u.pipeStr.mPipes[1]); + + if (processLocal) { + return SECSuccess; + } + + pMutex->u.pipeStr.mPipes[0] = -1; + pMutex->u.pipeStr.mPipes[1] = -1; + pMutex->u.pipeStr.mPipes[2] = -1; + pMutex->u.pipeStr.nWaiters = 0; + + return SECSuccess; +} + +#if defined(LINUX) && defined(i386) +/* No memory barrier needed for this platform */ + +/* nWaiters includes the holder of the lock (if any) and the number +** threads waiting for it. After incrementing nWaiters, if the count +** is exactly 1, then you have the lock and may proceed. If the +** count is greater than 1, then you must wait on the pipe. +*/ + +SECStatus +sslMutex_Unlock(sslMutex* pMutex) +{ + PRInt32 newValue; + if (PR_FALSE == pMutex->isMultiProcess) { + return single_process_sslMutex_Unlock(pMutex); + } + + if (pMutex->u.pipeStr.mPipes[2] != SSL_MUTEX_MAGIC) { + PORT_SetError(PR_INVALID_ARGUMENT_ERROR); + return SECFailure; + } + /* Do Memory Barrier here. */ + newValue = PR_ATOMIC_DECREMENT(&pMutex->u.pipeStr.nWaiters); + if (newValue > 0) { + int cc; + char c = 1; + do { + cc = write(pMutex->u.pipeStr.mPipes[1], &c, 1); + } while (cc < 0 && (errno == EINTR || errno == EAGAIN)); + if (cc != 1) { + if (cc < 0) + nss_MD_unix_map_default_error(errno); + else + PORT_SetError(PR_UNKNOWN_ERROR); + return SECFailure; + } + } + return SECSuccess; +} + +SECStatus +sslMutex_Lock(sslMutex* pMutex) +{ + PRInt32 newValue; + if (PR_FALSE == pMutex->isMultiProcess) { + return single_process_sslMutex_Lock(pMutex); + } + + if (pMutex->u.pipeStr.mPipes[2] != SSL_MUTEX_MAGIC) { + PORT_SetError(PR_INVALID_ARGUMENT_ERROR); + return SECFailure; + } + newValue = PR_ATOMIC_INCREMENT(&pMutex->u.pipeStr.nWaiters); + /* Do Memory Barrier here. */ + if (newValue > 1) { + int cc; + char c; + do { + cc = read(pMutex->u.pipeStr.mPipes[0], &c, 1); + } while (cc < 0 && errno == EINTR); + if (cc != 1) { + if (cc < 0) + nss_MD_unix_map_default_error(errno); + else + PORT_SetError(PR_UNKNOWN_ERROR); + return SECFailure; + } + } + return SECSuccess; +} + +#else + +/* Using Atomic operations requires the use of a memory barrier instruction +** on PowerPC, Sparc, and Alpha. NSPR's PR_Atomic functions do not perform +** them, and NSPR does not provide a function that does them (e.g. PR_Barrier). +** So, we don't use them on those platforms. +*/ + +SECStatus +sslMutex_Unlock(sslMutex* pMutex) +{ + int cc; + char c = 1; + + if (PR_FALSE == pMutex->isMultiProcess) { + return single_process_sslMutex_Unlock(pMutex); + } + + if (pMutex->u.pipeStr.mPipes[2] != SSL_MUTEX_MAGIC) { + PORT_SetError(PR_INVALID_ARGUMENT_ERROR); + return SECFailure; + } + do { + cc = write(pMutex->u.pipeStr.mPipes[1], &c, 1); + } while (cc < 0 && (errno == EINTR || errno == EAGAIN)); + if (cc != 1) { + if (cc < 0) + nss_MD_unix_map_default_error(errno); + else + PORT_SetError(PR_UNKNOWN_ERROR); + return SECFailure; + } + + return SECSuccess; +} + +SECStatus +sslMutex_Lock(sslMutex* pMutex) +{ + int cc; + char c; + + if (PR_FALSE == pMutex->isMultiProcess) { + return single_process_sslMutex_Lock(pMutex); + } + + if (pMutex->u.pipeStr.mPipes[2] != SSL_MUTEX_MAGIC) { + PORT_SetError(PR_INVALID_ARGUMENT_ERROR); + return SECFailure; + } + + do { + cc = read(pMutex->u.pipeStr.mPipes[0], &c, 1); + } while (cc < 0 && errno == EINTR); + if (cc != 1) { + if (cc < 0) + nss_MD_unix_map_default_error(errno); + else + PORT_SetError(PR_UNKNOWN_ERROR); + return SECFailure; + } + + return SECSuccess; +} + +#endif + +#elif defined(WIN32) + +#include "win32err.h" + +/* on Windows, we need to find the optimal type of locking mechanism to use + for the sslMutex. + + There are 3 cases : + 1) single-process, use a PRLock, as for all other platforms + 2) Win95 multi-process, use a Win32 mutex + 3) on WINNT multi-process, use a PRLock + a Win32 mutex + +*/ + +#ifdef WINNT + +SECStatus +sslMutex_2LevelInit(sslMutex *sem) +{ + /* the following adds a PRLock to sslMutex . This is done in each + process of a multi-process server and is only needed on WINNT, if + using fibers. We can't tell if native threads or fibers are used, so + we always do it on WINNT + */ + PR_ASSERT(sem); + if (sem) { + /* we need to reset the sslLock in the children or the single_process init + function below will assert */ + sem->u.sslLock = NULL; + } + return single_process_sslMutex_Init(sem); +} + +static SECStatus +sslMutex_2LevelDestroy(sslMutex *sem) +{ + return single_process_sslMutex_Destroy(sem); +} + +#endif + +SECStatus +sslMutex_Init(sslMutex *pMutex, int shared) +{ +#ifdef WINNT + SECStatus retvalue; +#endif + HANDLE hMutex; + SECURITY_ATTRIBUTES attributes = + { sizeof(SECURITY_ATTRIBUTES), NULL, TRUE }; + + PR_ASSERT(pMutex != 0 && (pMutex->u.sslMutx == 0 || + pMutex->u.sslMutx == + INVALID_HANDLE_VALUE)); + + pMutex->isMultiProcess = (PRBool)(shared != 0); + + if (PR_FALSE == pMutex->isMultiProcess) { + return single_process_sslMutex_Init(pMutex); + } + +#ifdef WINNT + /* we need a lock on WINNT for fibers in the parent process */ + retvalue = sslMutex_2LevelInit(pMutex); + if (SECSuccess != retvalue) + return SECFailure; +#endif + + if (!pMutex || ((hMutex = pMutex->u.sslMutx) != 0 && + hMutex != + INVALID_HANDLE_VALUE)) { + PORT_SetError(PR_INVALID_ARGUMENT_ERROR); + return SECFailure; + } + attributes.bInheritHandle = (shared ? TRUE : FALSE); + hMutex = CreateMutex(&attributes, FALSE, NULL); + if (hMutex == NULL) { + hMutex = INVALID_HANDLE_VALUE; + nss_MD_win32_map_default_error(GetLastError()); + return SECFailure; + } + pMutex->u.sslMutx = hMutex; + return SECSuccess; +} + +SECStatus +sslMutex_Destroy(sslMutex *pMutex, PRBool processLocal) +{ + HANDLE hMutex; + int rv; + int retvalue = SECSuccess; + + PR_ASSERT(pMutex != 0); + if (!pMutex) { + PORT_SetError(PR_INVALID_ARGUMENT_ERROR); + return SECFailure; + } + + if (PR_FALSE == pMutex->isMultiProcess) { + return single_process_sslMutex_Destroy(pMutex); + } + +/* multi-process mode */ +#ifdef WINNT + /* on NT, get rid of the PRLock used for fibers within a process */ + retvalue = sslMutex_2LevelDestroy(pMutex); +#endif + + PR_ASSERT(pMutex->u.sslMutx != 0 && + pMutex->u.sslMutx != INVALID_HANDLE_VALUE); + if ((hMutex = pMutex->u.sslMutx) == 0 || hMutex == INVALID_HANDLE_VALUE) { + PORT_SetError(PR_INVALID_ARGUMENT_ERROR); + return SECFailure; + } + + rv = CloseHandle(hMutex); /* ignore error */ + if (!processLocal && rv) { + pMutex->u.sslMutx = hMutex = INVALID_HANDLE_VALUE; + } + if (!rv) { + nss_MD_win32_map_default_error(GetLastError()); + retvalue = SECFailure; + } + return retvalue; +} + +int +sslMutex_Unlock(sslMutex *pMutex) +{ + BOOL success = FALSE; + HANDLE hMutex; + + PR_ASSERT(pMutex != 0); + if (!pMutex) { + PORT_SetError(PR_INVALID_ARGUMENT_ERROR); + return SECFailure; + } + + if (PR_FALSE == pMutex->isMultiProcess) { + return single_process_sslMutex_Unlock(pMutex); + } + + PR_ASSERT(pMutex->u.sslMutx != 0 && + pMutex->u.sslMutx != INVALID_HANDLE_VALUE); + if ((hMutex = pMutex->u.sslMutx) == 0 || hMutex == INVALID_HANDLE_VALUE) { + PORT_SetError(PR_INVALID_ARGUMENT_ERROR); + return SECFailure; + } + success = ReleaseMutex(hMutex); + if (!success) { + nss_MD_win32_map_default_error(GetLastError()); + return SECFailure; + } +#ifdef WINNT + return single_process_sslMutex_Unlock(pMutex); +/* release PRLock for other fibers in the process */ +#else + return SECSuccess; +#endif +} + +int +sslMutex_Lock(sslMutex *pMutex) +{ + HANDLE hMutex; + DWORD event; + DWORD lastError; + SECStatus rv; + SECStatus retvalue = SECSuccess; + + PR_ASSERT(pMutex != 0); + if (!pMutex) { + PORT_SetError(PR_INVALID_ARGUMENT_ERROR); + return SECFailure; + } + + if (PR_FALSE == pMutex->isMultiProcess) { + return single_process_sslMutex_Lock(pMutex); + } +#ifdef WINNT + /* lock first to preserve from other threads/fibers in the same process */ + retvalue = single_process_sslMutex_Lock(pMutex); +#endif + PR_ASSERT(pMutex->u.sslMutx != 0 && + pMutex->u.sslMutx != INVALID_HANDLE_VALUE); + if ((hMutex = pMutex->u.sslMutx) == 0 || hMutex == INVALID_HANDLE_VALUE) { + PORT_SetError(PR_INVALID_ARGUMENT_ERROR); + return SECFailure; /* what else ? */ + } + /* acquire the mutex to be the only owner accross all other processes */ + event = WaitForSingleObject(hMutex, INFINITE); + switch (event) { + case WAIT_OBJECT_0: + case WAIT_ABANDONED: + rv = SECSuccess; + break; + + case WAIT_TIMEOUT: +#if defined(WAIT_IO_COMPLETION) + case WAIT_IO_COMPLETION: +#endif + default: /* should never happen. nothing we can do. */ + PR_ASSERT(!("WaitForSingleObject returned invalid value.")); + PORT_SetError(PR_UNKNOWN_ERROR); + rv = SECFailure; + break; + + case WAIT_FAILED: /* failure returns this */ + rv = SECFailure; + lastError = GetLastError(); /* for debugging */ + nss_MD_win32_map_default_error(lastError); + break; + } + + if (!(SECSuccess == retvalue && SECSuccess == rv)) { + return SECFailure; + } + + return SECSuccess; +} + +#elif defined(XP_UNIX) && !defined(DARWIN) + +#include <errno.h> +#include "unix_err.h" + +SECStatus +sslMutex_Init(sslMutex* pMutex, int shared) +{ + int rv; + PR_ASSERT(pMutex); + pMutex->isMultiProcess = (PRBool)(shared != 0); + if (!shared) { + return single_process_sslMutex_Init(pMutex); + } + do { + rv = sem_init(&pMutex->u.sem, shared, 1); + } while (rv < 0 && errno == EINTR); + if (rv < 0) { + nss_MD_unix_map_default_error(errno); + return SECFailure; + } + return SECSuccess; +} + +SECStatus +sslMutex_Destroy(sslMutex* pMutex, PRBool processLocal) +{ + int rv; + if (PR_FALSE == pMutex->isMultiProcess) { + return single_process_sslMutex_Destroy(pMutex); + } + + /* semaphores are global resources. See SEM_DESTROY(3) man page */ + if (processLocal) { + return SECSuccess; + } + do { + rv = sem_destroy(&pMutex->u.sem); + } while (rv < 0 && errno == EINTR); + if (rv < 0) { + nss_MD_unix_map_default_error(errno); + return SECFailure; + } + return SECSuccess; +} + +SECStatus +sslMutex_Unlock(sslMutex* pMutex) +{ + int rv; + if (PR_FALSE == pMutex->isMultiProcess) { + return single_process_sslMutex_Unlock(pMutex); + } + do { + rv = sem_post(&pMutex->u.sem); + } while (rv < 0 && errno == EINTR); + if (rv < 0) { + nss_MD_unix_map_default_error(errno); + return SECFailure; + } + return SECSuccess; +} + +SECStatus +sslMutex_Lock(sslMutex* pMutex) +{ + int rv; + if (PR_FALSE == pMutex->isMultiProcess) { + return single_process_sslMutex_Lock(pMutex); + } + do { + rv = sem_wait(&pMutex->u.sem); + } while (rv < 0 && errno == EINTR); + if (rv < 0) { + nss_MD_unix_map_default_error(errno); + return SECFailure; + } + return SECSuccess; +} + +#else + +SECStatus +sslMutex_Init(sslMutex* pMutex, int shared) +{ + PR_ASSERT(pMutex); + pMutex->isMultiProcess = (PRBool)(shared != 0); + if (!shared) { + return single_process_sslMutex_Init(pMutex); + } + PORT_Assert(!("sslMutex_Init not implemented for multi-process applications !")); + PORT_SetError(PR_NOT_IMPLEMENTED_ERROR); + return SECFailure; +} + +SECStatus +sslMutex_Destroy(sslMutex* pMutex, PRBool processLocal) +{ + PR_ASSERT(pMutex); + if (PR_FALSE == pMutex->isMultiProcess) { + return single_process_sslMutex_Destroy(pMutex); + } + PORT_Assert(!("sslMutex_Destroy not implemented for multi-process applications !")); + PORT_SetError(PR_NOT_IMPLEMENTED_ERROR); + return SECFailure; +} + +SECStatus +sslMutex_Unlock(sslMutex* pMutex) +{ + PR_ASSERT(pMutex); + if (PR_FALSE == pMutex->isMultiProcess) { + return single_process_sslMutex_Unlock(pMutex); + } + PORT_Assert(!("sslMutex_Unlock not implemented for multi-process applications !")); + PORT_SetError(PR_NOT_IMPLEMENTED_ERROR); + return SECFailure; +} + +SECStatus +sslMutex_Lock(sslMutex* pMutex) +{ + PR_ASSERT(pMutex); + if (PR_FALSE == pMutex->isMultiProcess) { + return single_process_sslMutex_Lock(pMutex); + } + PORT_Assert(!("sslMutex_Lock not implemented for multi-process applications !")); + PORT_SetError(PR_NOT_IMPLEMENTED_ERROR); + return SECFailure; +} + +#endif + +#endif diff --git a/security/nss/lib/ssl/sslmutex.h b/security/nss/lib/ssl/sslmutex.h new file mode 100644 index 000000000..7611148ad --- /dev/null +++ b/security/nss/lib/ssl/sslmutex.h @@ -0,0 +1,128 @@ +/* This Source Code Form is subject to the terms of the Mozilla Public + * License, v. 2.0. If a copy of the MPL was not distributed with this + * file, You can obtain one at http://mozilla.org/MPL/2.0/. */ +#ifndef __SSLMUTEX_H_ +#define __SSLMUTEX_H_ 1 + +/* What SSL really wants is portable process-shared unnamed mutexes in + * shared memory, that have the property that if the process that holds + * them dies, they are released automatically, and that (unlike fcntl + * record locking) lock to the thread, not to the process. + * NSPR doesn't provide that. + * Windows has mutexes that meet that description, but they're not portable. + * POSIX mutexes are not automatically released when the holder dies, + * and other processes/threads cannot release the mutex on behalf of the + * dead holder. + * POSIX semaphores can be used to accomplish this on systems that implement + * process-shared unnamed POSIX semaphores, because a watchdog thread can + * discover and release semaphores that were held by a dead process. + * On systems that do not support process-shared POSIX unnamed semaphores, + * they can be emulated using pipes. + * The performance cost of doing that is not yet measured. + * + * So, this API looks a lot like POSIX pthread mutexes. + */ + +#include "prtypes.h" +#include "prlock.h" + +#if defined(NETBSD) +#include <sys/param.h> /* for __NetBSD_Version__ */ +#endif + +#if defined(WIN32) + +#include <wtypes.h> + +typedef struct { + PRBool isMultiProcess; +#ifdef WINNT + /* on WINNT we need both the PRLock and the Win32 mutex for fibers */ + struct { +#else + union { +#endif + PRLock *sslLock; + HANDLE sslMutx; + } u; +} sslMutex; + +typedef int sslPID; + +#elif defined(LINUX) || defined(AIX) || defined(BEOS) || defined(BSDI) || (defined(NETBSD) && __NetBSD_Version__ < 500000000) || defined(OPENBSD) + +#include <sys/types.h> +#include "prtypes.h" + +typedef struct { + PRBool isMultiProcess; + union { + PRLock *sslLock; + struct { + int mPipes[3]; + PRInt32 nWaiters; + } pipeStr; + } u; +} sslMutex; +typedef pid_t sslPID; + +/* other types of unix, except OS X */ +#elif defined(XP_UNIX) && !defined(DARWIN) + +#include <sys/types.h> /* for pid_t */ +#include <semaphore.h> /* for sem_t, and sem_* functions */ + +typedef struct { + PRBool isMultiProcess; + union { + PRLock *sslLock; + sem_t sem; + } u; +} sslMutex; + +typedef pid_t sslPID; + +#else /* no support for cross-process locking */ + +/* what platform is this ?? */ + +typedef struct { + PRBool isMultiProcess; + union { + PRLock *sslLock; + /* include cross-process locking mechanism here */ + } u; +} sslMutex; + +#ifdef DARWIN +typedef pid_t sslPID; +#else +typedef int sslPID; +#endif + +#endif + +#include "seccomon.h" + +SEC_BEGIN_PROTOS + +extern SECStatus sslMutex_Init(sslMutex *sem, int shared); + +/* If processLocal is set to true, then just free resources which are *only* associated + * with the current process. Leave any shared resources (including the state of + * shared memory) intact. */ +extern SECStatus sslMutex_Destroy(sslMutex *sem, PRBool processLocal); + +extern SECStatus sslMutex_Unlock(sslMutex *sem); + +extern SECStatus sslMutex_Lock(sslMutex *sem); + +#ifdef WINNT + +extern SECStatus sslMutex_2LevelInit(sslMutex *sem); + +#endif + +SEC_END_PROTOS + +#endif diff --git a/security/nss/lib/ssl/sslnonce.c b/security/nss/lib/ssl/sslnonce.c new file mode 100644 index 000000000..91cc87040 --- /dev/null +++ b/security/nss/lib/ssl/sslnonce.c @@ -0,0 +1,495 @@ +/* + * This file implements the CLIENT Session ID cache. + * + * This Source Code Form is subject to the terms of the Mozilla Public + * License, v. 2.0. If a copy of the MPL was not distributed with this + * file, You can obtain one at http://mozilla.org/MPL/2.0/. */ + +#include "cert.h" +#include "pk11pub.h" +#include "secitem.h" +#include "ssl.h" +#include "nss.h" + +#include "sslimpl.h" +#include "sslproto.h" +#include "nssilock.h" +#if defined(XP_UNIX) || defined(XP_WIN) || defined(_WINDOWS) || defined(XP_BEOS) +#include <time.h> +#endif + +PRUint32 ssl_sid_timeout = 100; +PRUint32 ssl3_sid_timeout = 86400L; /* 24 hours */ + +static sslSessionID *cache = NULL; +static PZLock *cacheLock = NULL; + +/* sids can be in one of 4 states: + * + * never_cached, created, but not yet put into cache. + * in_client_cache, in the client cache's linked list. + * in_server_cache, entry came from the server's cache file. + * invalid_cache has been removed from the cache. + */ + +#define LOCK_CACHE lock_cache() +#define UNLOCK_CACHE PZ_Unlock(cacheLock) + +static SECStatus +ssl_InitClientSessionCacheLock(void) +{ + cacheLock = PZ_NewLock(nssILockCache); + return cacheLock ? SECSuccess : SECFailure; +} + +static SECStatus +ssl_FreeClientSessionCacheLock(void) +{ + if (cacheLock) { + PZ_DestroyLock(cacheLock); + cacheLock = NULL; + return SECSuccess; + } + PORT_SetError(SEC_ERROR_NOT_INITIALIZED); + return SECFailure; +} + +static PRBool LocksInitializedEarly = PR_FALSE; + +static SECStatus +FreeSessionCacheLocks() +{ + SECStatus rv1, rv2; + rv1 = ssl_FreeSymWrapKeysLock(); + rv2 = ssl_FreeClientSessionCacheLock(); + if ((SECSuccess == rv1) && (SECSuccess == rv2)) { + return SECSuccess; + } + return SECFailure; +} + +static SECStatus +InitSessionCacheLocks(void) +{ + SECStatus rv1, rv2; + PRErrorCode rc; + rv1 = ssl_InitSymWrapKeysLock(); + rv2 = ssl_InitClientSessionCacheLock(); + if ((SECSuccess == rv1) && (SECSuccess == rv2)) { + return SECSuccess; + } + rc = PORT_GetError(); + FreeSessionCacheLocks(); + PORT_SetError(rc); + return SECFailure; +} + +/* free the session cache locks if they were initialized early */ +SECStatus +ssl_FreeSessionCacheLocks() +{ + PORT_Assert(PR_TRUE == LocksInitializedEarly); + if (!LocksInitializedEarly) { + PORT_SetError(SEC_ERROR_NOT_INITIALIZED); + return SECFailure; + } + FreeSessionCacheLocks(); + LocksInitializedEarly = PR_FALSE; + return SECSuccess; +} + +static PRCallOnceType lockOnce; + +/* free the session cache locks if they were initialized lazily */ +static SECStatus +ssl_ShutdownLocks(void *appData, void *nssData) +{ + PORT_Assert(PR_FALSE == LocksInitializedEarly); + if (LocksInitializedEarly) { + PORT_SetError(SEC_ERROR_LIBRARY_FAILURE); + return SECFailure; + } + FreeSessionCacheLocks(); + memset(&lockOnce, 0, sizeof(lockOnce)); + return SECSuccess; +} + +static PRStatus +initSessionCacheLocksLazily(void) +{ + SECStatus rv = InitSessionCacheLocks(); + if (SECSuccess != rv) { + return PR_FAILURE; + } + rv = NSS_RegisterShutdown(ssl_ShutdownLocks, NULL); + PORT_Assert(SECSuccess == rv); + if (SECSuccess != rv) { + return PR_FAILURE; + } + return PR_SUCCESS; +} + +/* lazyInit means that the call is not happening during a 1-time + * initialization function, but rather during dynamic, lazy initialization + */ +SECStatus +ssl_InitSessionCacheLocks(PRBool lazyInit) +{ + if (LocksInitializedEarly) { + return SECSuccess; + } + + if (lazyInit) { + return (PR_SUCCESS == + PR_CallOnce(&lockOnce, initSessionCacheLocksLazily)) + ? SECSuccess + : SECFailure; + } + + if (SECSuccess == InitSessionCacheLocks()) { + LocksInitializedEarly = PR_TRUE; + return SECSuccess; + } + + return SECFailure; +} + +static void +lock_cache(void) +{ + ssl_InitSessionCacheLocks(PR_TRUE); + PZ_Lock(cacheLock); +} + +/* BEWARE: This function gets called for both client and server SIDs !! + * If the unreferenced sid is not in the cache, Free sid and its contents. + */ +static void +ssl_DestroySID(sslSessionID *sid) +{ + SSL_TRC(8, ("SSL: destroy sid: sid=0x%x cached=%d", sid, sid->cached)); + PORT_Assert(sid->references == 0); + PORT_Assert(sid->cached != in_client_cache); + + if (sid->u.ssl3.locked.sessionTicket.ticket.data) { + SECITEM_FreeItem(&sid->u.ssl3.locked.sessionTicket.ticket, + PR_FALSE); + } + if (sid->u.ssl3.srvName.data) { + SECITEM_FreeItem(&sid->u.ssl3.srvName, PR_FALSE); + } + if (sid->u.ssl3.signedCertTimestamps.data) { + SECITEM_FreeItem(&sid->u.ssl3.signedCertTimestamps, PR_FALSE); + } + + if (sid->u.ssl3.lock) { + PR_DestroyRWLock(sid->u.ssl3.lock); + } + + if (sid->peerID != NULL) + PORT_Free((void *)sid->peerID); /* CONST */ + + if (sid->urlSvrName != NULL) + PORT_Free((void *)sid->urlSvrName); /* CONST */ + + if (sid->peerCert) { + CERT_DestroyCertificate(sid->peerCert); + } + if (sid->peerCertStatus.items) { + SECITEM_FreeArray(&sid->peerCertStatus, PR_FALSE); + } + + if (sid->localCert) { + CERT_DestroyCertificate(sid->localCert); + } + + SECITEM_FreeItem(&sid->u.ssl3.alpnSelection, PR_FALSE); + + PORT_ZFree(sid, sizeof(sslSessionID)); +} + +/* BEWARE: This function gets called for both client and server SIDs !! + * Decrement reference count, and + * free sid if ref count is zero, and sid is not in the cache. + * Does NOT remove from the cache first. + * If the sid is still in the cache, it is left there until next time + * the cache list is traversed. + */ +static void +ssl_FreeLockedSID(sslSessionID *sid) +{ + PORT_Assert(sid->references >= 1); + if (--sid->references == 0) { + ssl_DestroySID(sid); + } +} + +/* BEWARE: This function gets called for both client and server SIDs !! + * Decrement reference count, and + * free sid if ref count is zero, and sid is not in the cache. + * Does NOT remove from the cache first. + * These locks are necessary because the sid _might_ be in the cache list. + */ +void +ssl_FreeSID(sslSessionID *sid) +{ + LOCK_CACHE; + ssl_FreeLockedSID(sid); + UNLOCK_CACHE; +} + +/************************************************************************/ + +/* +** Lookup sid entry in cache by Address, port, and peerID string. +** If found, Increment reference count, and return pointer to caller. +** If it has timed out or ref count is zero, remove from list and free it. +*/ + +sslSessionID * +ssl_LookupSID(const PRIPv6Addr *addr, PRUint16 port, const char *peerID, + const char *urlSvrName) +{ + sslSessionID **sidp; + sslSessionID *sid; + PRUint32 now; + + if (!urlSvrName) + return NULL; + now = ssl_Time(); + LOCK_CACHE; + sidp = &cache; + while ((sid = *sidp) != 0) { + PORT_Assert(sid->cached == in_client_cache); + PORT_Assert(sid->references >= 1); + + SSL_TRC(8, ("SSL: Lookup1: sid=0x%x", sid)); + + if (sid->expirationTime < now) { + /* + ** This session-id timed out. + ** Don't even care who it belongs to, blow it out of our cache. + */ + SSL_TRC(7, ("SSL: lookup1, throwing sid out, age=%d refs=%d", + now - sid->creationTime, sid->references)); + + *sidp = sid->next; /* delink it from the list. */ + sid->cached = invalid_cache; /* mark not on list. */ + ssl_FreeLockedSID(sid); /* drop ref count, free. */ + } else if (!memcmp(&sid->addr, addr, sizeof(PRIPv6Addr)) && /* server IP addr matches */ + (sid->port == port) && /* server port matches */ + /* proxy (peerID) matches */ + (((peerID == NULL) && (sid->peerID == NULL)) || + ((peerID != NULL) && (sid->peerID != NULL) && + PORT_Strcmp(sid->peerID, peerID) == 0)) && + /* is cacheable */ + (sid->u.ssl3.keys.resumable) && + /* server hostname matches. */ + (sid->urlSvrName != NULL) && + (0 == PORT_Strcmp(urlSvrName, sid->urlSvrName))) { + /* Hit */ + sid->lastAccessTime = now; + sid->references++; + break; + } else { + sidp = &sid->next; + } + } + UNLOCK_CACHE; + return sid; +} + +/* +** Add an sid to the cache or return a previously cached entry to the cache. +** Although this is static, it is called via ss->sec.cache(). +*/ +static void +CacheSID(sslSessionID *sid) +{ + PRUint32 expirationPeriod; + + PORT_Assert(sid->cached == never_cached); + + SSL_TRC(8, ("SSL: Cache: sid=0x%x cached=%d addr=0x%08x%08x%08x%08x port=0x%04x " + "time=%x cached=%d", + sid, sid->cached, sid->addr.pr_s6_addr32[0], + sid->addr.pr_s6_addr32[1], sid->addr.pr_s6_addr32[2], + sid->addr.pr_s6_addr32[3], sid->port, sid->creationTime, + sid->cached)); + + if (!sid->urlSvrName) { + /* don't cache this SID because it can never be matched */ + return; + } + + if (sid->u.ssl3.sessionIDLength == 0 && + sid->u.ssl3.locked.sessionTicket.ticket.data == NULL) + return; + + /* Client generates the SessionID if this was a stateless resume. */ + if (sid->u.ssl3.sessionIDLength == 0) { + SECStatus rv; + rv = PK11_GenerateRandom(sid->u.ssl3.sessionID, + SSL3_SESSIONID_BYTES); + if (rv != SECSuccess) + return; + sid->u.ssl3.sessionIDLength = SSL3_SESSIONID_BYTES; + } + expirationPeriod = ssl3_sid_timeout; + PRINT_BUF(8, (0, "sessionID:", + sid->u.ssl3.sessionID, sid->u.ssl3.sessionIDLength)); + + sid->u.ssl3.lock = PR_NewRWLock(PR_RWLOCK_RANK_NONE, NULL); + if (!sid->u.ssl3.lock) { + return; + } + PORT_Assert(sid->creationTime != 0 && sid->expirationTime != 0); + if (!sid->creationTime) + sid->lastAccessTime = sid->creationTime = ssl_Time(); + if (!sid->expirationTime) + sid->expirationTime = sid->creationTime + expirationPeriod; + + /* + * Put sid into the cache. Bump reference count to indicate that + * cache is holding a reference. Uncache will reduce the cache + * reference. + */ + LOCK_CACHE; + sid->references++; + sid->cached = in_client_cache; + sid->next = cache; + cache = sid; + UNLOCK_CACHE; +} + +/* + * If sid "zap" is in the cache, + * removes sid from cache, and decrements reference count. + * Caller must hold cache lock. + */ +static void +UncacheSID(sslSessionID *zap) +{ + sslSessionID **sidp = &cache; + sslSessionID *sid; + + if (zap->cached != in_client_cache) { + return; + } + + SSL_TRC(8, ("SSL: Uncache: zap=0x%x cached=%d addr=0x%08x%08x%08x%08x port=0x%04x " + "time=%x cipherSuite=%d", + zap, zap->cached, zap->addr.pr_s6_addr32[0], + zap->addr.pr_s6_addr32[1], zap->addr.pr_s6_addr32[2], + zap->addr.pr_s6_addr32[3], zap->port, zap->creationTime, + zap->u.ssl3.cipherSuite)); + + /* See if it's in the cache, if so nuke it */ + while ((sid = *sidp) != 0) { + if (sid == zap) { + /* + ** Bingo. Reduce reference count by one so that when + ** everyone is done with the sid we can free it up. + */ + *sidp = zap->next; + zap->cached = invalid_cache; + ssl_FreeLockedSID(zap); + return; + } + sidp = &sid->next; + } +} + +/* If sid "zap" is in the cache, + * removes sid from cache, and decrements reference count. + * Although this function is static, it is called externally via + * ss->sec.uncache(). + */ +static void +LockAndUncacheSID(sslSessionID *zap) +{ + LOCK_CACHE; + UncacheSID(zap); + UNLOCK_CACHE; +} + +/* choose client or server cache functions for this sslsocket. */ +void +ssl_ChooseSessionIDProcs(sslSecurityInfo *sec) +{ + if (sec->isServer) { + sec->cache = ssl_sid_cache; + sec->uncache = ssl_sid_uncache; + } else { + sec->cache = CacheSID; + sec->uncache = LockAndUncacheSID; + } +} + +/* wipe out the entire client session cache. */ +void +SSL_ClearSessionCache(void) +{ + LOCK_CACHE; + while (cache != NULL) + UncacheSID(cache); + UNLOCK_CACHE; +} + +/* returns an unsigned int containing the number of seconds in PR_Now() */ +PRUint32 +ssl_Time(void) +{ +#ifdef UNSAFE_FUZZER_MODE + return 1234; +#endif + + PRUint32 myTime; +#if defined(XP_UNIX) || defined(XP_WIN) || defined(_WINDOWS) || defined(XP_BEOS) + myTime = time(NULL); /* accurate until the year 2038. */ +#else + /* portable, but possibly slower */ + PRTime now; + PRInt64 ll; + + now = PR_Now(); + LL_I2L(ll, 1000000L); + LL_DIV(now, now, ll); + LL_L2UI(myTime, now); +#endif + return myTime; +} + +void +ssl3_SetSIDSessionTicket(sslSessionID *sid, + /*in/out*/ NewSessionTicket *newSessionTicket) +{ + PORT_Assert(sid); + PORT_Assert(newSessionTicket); + PORT_Assert(newSessionTicket->ticket.data); + PORT_Assert(newSessionTicket->ticket.len != 0); + + /* if sid->u.ssl3.lock, we are updating an existing entry that is already + * cached or was once cached, so we need to acquire and release the write + * lock. Otherwise, this is a new session that isn't shared with anything + * yet, so no locking is needed. + */ + if (sid->u.ssl3.lock) { + PR_RWLock_Wlock(sid->u.ssl3.lock); + if (sid->u.ssl3.locked.sessionTicket.ticket.data) { + SECITEM_FreeItem(&sid->u.ssl3.locked.sessionTicket.ticket, + PR_FALSE); + } + } + + PORT_Assert(!sid->u.ssl3.locked.sessionTicket.ticket.data); + + /* Do a shallow copy, moving the ticket data. */ + sid->u.ssl3.locked.sessionTicket = *newSessionTicket; + newSessionTicket->ticket.data = NULL; + newSessionTicket->ticket.len = 0; + + if (sid->u.ssl3.lock) { + PR_RWLock_Unlock(sid->u.ssl3.lock); + } +} diff --git a/security/nss/lib/ssl/sslproto.h b/security/nss/lib/ssl/sslproto.h new file mode 100644 index 000000000..70daea0a1 --- /dev/null +++ b/security/nss/lib/ssl/sslproto.h @@ -0,0 +1,294 @@ +/* + * Various and sundry protocol constants. DON'T CHANGE THESE. These values + * are mostly defined by the SSL3 or TLS protocol specifications. + * Cipher kinds and ciphersuites are part of the public API. + * + * This Source Code Form is subject to the terms of the Mozilla Public + * License, v. 2.0. If a copy of the MPL was not distributed with this + * file, You can obtain one at http://mozilla.org/MPL/2.0/. */ + +#ifndef __sslproto_h_ +#define __sslproto_h_ + +/* clang-format off */ + +/* All versions less than 3_0 are treated as SSL version 2 */ +#define SSL_LIBRARY_VERSION_2 0x0002 +#define SSL_LIBRARY_VERSION_3_0 0x0300 +#define SSL_LIBRARY_VERSION_TLS_1_0 0x0301 +#define SSL_LIBRARY_VERSION_TLS_1_1 0x0302 +#define SSL_LIBRARY_VERSION_TLS_1_2 0x0303 +#define SSL_LIBRARY_VERSION_TLS_1_3 0x0304 + +/* Note: this is the internal format, not the wire format */ +#define SSL_LIBRARY_VERSION_DTLS_1_0 SSL_LIBRARY_VERSION_TLS_1_1 +#define SSL_LIBRARY_VERSION_DTLS_1_2 SSL_LIBRARY_VERSION_TLS_1_2 +#define SSL_LIBRARY_VERSION_DTLS_1_3 SSL_LIBRARY_VERSION_TLS_1_3 + +/* deprecated old name */ +#define SSL_LIBRARY_VERSION_3_1_TLS SSL_LIBRARY_VERSION_TLS_1_0 + +/* The DTLS versions used in the spec */ +#define SSL_LIBRARY_VERSION_DTLS_1_0_WIRE ((~0x0100) & 0xffff) +#define SSL_LIBRARY_VERSION_DTLS_1_2_WIRE ((~0x0102) & 0xffff) +#define SSL_LIBRARY_VERSION_DTLS_1_3_WIRE SSL_LIBRARY_VERSION_DTLS_1_3 + +/* Certificate types */ +#define SSL_CT_X509_CERTIFICATE 0x01 +#if 0 /* XXX Not implemented yet */ +#define SSL_PKCS6_CERTIFICATE 0x02 +#endif +#define SSL_AT_MD5_WITH_RSA_ENCRYPTION 0x01 + +/* Error codes */ +#define SSL_PE_NO_CYPHERS 0x0001 +#define SSL_PE_NO_CERTIFICATE 0x0002 +#define SSL_PE_BAD_CERTIFICATE 0x0004 +#define SSL_PE_UNSUPPORTED_CERTIFICATE_TYPE 0x0006 + +/* Deprecated SSL 3.0 & libssl names replaced by IANA-registered TLS names. */ +#ifndef SSL_DISABLE_DEPRECATED_CIPHER_SUITE_NAMES +#define SSL_NULL_WITH_NULL_NULL TLS_NULL_WITH_NULL_NULL +#define SSL_RSA_WITH_NULL_MD5 TLS_RSA_WITH_NULL_MD5 +#define SSL_RSA_WITH_NULL_SHA TLS_RSA_WITH_NULL_SHA +#define SSL_RSA_WITH_RC4_128_MD5 TLS_RSA_WITH_RC4_128_MD5 +#define SSL_RSA_WITH_RC4_128_SHA TLS_RSA_WITH_RC4_128_SHA +#define SSL_RSA_WITH_IDEA_CBC_SHA TLS_RSA_WITH_IDEA_CBC_SHA +#define SSL_RSA_WITH_DES_CBC_SHA TLS_RSA_WITH_DES_CBC_SHA +#define SSL_RSA_WITH_3DES_EDE_CBC_SHA TLS_RSA_WITH_3DES_EDE_CBC_SHA +#define SSL_DH_DSS_WITH_DES_CBC_SHA TLS_DH_DSS_WITH_DES_CBC_SHA +#define SSL_DH_DSS_WITH_3DES_EDE_CBC_SHA TLS_DH_DSS_WITH_3DES_EDE_CBC_SHA +#define SSL_DH_RSA_WITH_DES_CBC_SHA TLS_DH_RSA_WITH_DES_CBC_SHA +#define SSL_DH_RSA_WITH_3DES_EDE_CBC_SHA TLS_DH_RSA_WITH_3DES_EDE_CBC_SHA +#define SSL_DHE_DSS_WITH_DES_CBC_SHA TLS_DHE_DSS_WITH_DES_CBC_SHA +#define SSL_DHE_DSS_WITH_3DES_EDE_CBC_SHA TLS_DHE_DSS_WITH_3DES_EDE_CBC_SHA +#define SSL_DHE_RSA_WITH_DES_CBC_SHA TLS_DHE_RSA_WITH_DES_CBC_SHA +#define SSL_DHE_RSA_WITH_3DES_EDE_CBC_SHA TLS_DHE_RSA_WITH_3DES_EDE_CBC_SHA +#define SSL_DH_ANON_WITH_RC4_128_MD5 TLS_DH_anon_WITH_RC4_128_MD5 +#define SSL_DH_ANON_WITH_DES_CBC_SHA TLS_DH_anon_WITH_DES_CBC_SHA +#define SSL_DH_ANON_WITH_3DES_EDE_CBC_SHA TLS_DH_anon_WITH_3DES_EDE_CBC_SHA +#define TLS_DH_ANON_WITH_AES_128_CBC_SHA TLS_DH_anon_WITH_AES_128_CBC_SHA +#define TLS_DH_ANON_WITH_AES_256_CBC_SHA TLS_DH_anon_WITH_AES_256_CBC_SHA +#define TLS_DH_ANON_WITH_CAMELLIA_128_CBC_SHA TLS_DH_anon_WITH_CAMELLIA_128_CBC_SHA +#define TLS_DH_ANON_WITH_CAMELLIA_256_CBC_SHA TLS_DH_anon_WITH_CAMELLIA_256_CBC_SHA +#endif + +#define TLS_NULL_WITH_NULL_NULL 0x0000 + +#define TLS_RSA_WITH_NULL_MD5 0x0001 +#define TLS_RSA_WITH_NULL_SHA 0x0002 +#define TLS_RSA_WITH_RC4_128_MD5 0x0004 +#define TLS_RSA_WITH_RC4_128_SHA 0x0005 +#define TLS_RSA_WITH_IDEA_CBC_SHA 0x0007 +#define TLS_RSA_WITH_DES_CBC_SHA 0x0009 +#define TLS_RSA_WITH_3DES_EDE_CBC_SHA 0x000a + +#define TLS_DH_DSS_WITH_DES_CBC_SHA 0x000c +#define TLS_DH_DSS_WITH_3DES_EDE_CBC_SHA 0x000d +#define TLS_DH_RSA_WITH_DES_CBC_SHA 0x000f +#define TLS_DH_RSA_WITH_3DES_EDE_CBC_SHA 0x0010 + +#define TLS_DHE_DSS_WITH_DES_CBC_SHA 0x0012 +#define TLS_DHE_DSS_WITH_3DES_EDE_CBC_SHA 0x0013 +#define TLS_DHE_RSA_WITH_DES_CBC_SHA 0x0015 +#define TLS_DHE_RSA_WITH_3DES_EDE_CBC_SHA 0x0016 + +#define TLS_DH_anon_WITH_RC4_128_MD5 0x0018 +#define TLS_DH_anon_WITH_DES_CBC_SHA 0x001a +#define TLS_DH_anon_WITH_3DES_EDE_CBC_SHA 0x001b + +#define TLS_RSA_WITH_AES_128_CBC_SHA 0x002F +#define TLS_DH_DSS_WITH_AES_128_CBC_SHA 0x0030 +#define TLS_DH_RSA_WITH_AES_128_CBC_SHA 0x0031 +#define TLS_DHE_DSS_WITH_AES_128_CBC_SHA 0x0032 +#define TLS_DHE_RSA_WITH_AES_128_CBC_SHA 0x0033 +#define TLS_DH_anon_WITH_AES_128_CBC_SHA 0x0034 + +#define TLS_RSA_WITH_AES_256_CBC_SHA 0x0035 +#define TLS_DH_DSS_WITH_AES_256_CBC_SHA 0x0036 +#define TLS_DH_RSA_WITH_AES_256_CBC_SHA 0x0037 +#define TLS_DHE_DSS_WITH_AES_256_CBC_SHA 0x0038 +#define TLS_DHE_RSA_WITH_AES_256_CBC_SHA 0x0039 +#define TLS_DH_anon_WITH_AES_256_CBC_SHA 0x003A +#define TLS_RSA_WITH_NULL_SHA256 0x003B +#define TLS_RSA_WITH_AES_128_CBC_SHA256 0x003C +#define TLS_RSA_WITH_AES_256_CBC_SHA256 0x003D + +#define TLS_DHE_DSS_WITH_AES_128_CBC_SHA256 0x0040 +#define TLS_RSA_WITH_CAMELLIA_128_CBC_SHA 0x0041 +#define TLS_DH_DSS_WITH_CAMELLIA_128_CBC_SHA 0x0042 +#define TLS_DH_RSA_WITH_CAMELLIA_128_CBC_SHA 0x0043 +#define TLS_DHE_DSS_WITH_CAMELLIA_128_CBC_SHA 0x0044 +#define TLS_DHE_RSA_WITH_CAMELLIA_128_CBC_SHA 0x0045 +#define TLS_DH_anon_WITH_CAMELLIA_128_CBC_SHA 0x0046 + +#define TLS_DHE_DSS_WITH_RC4_128_SHA 0x0066 +#define TLS_DHE_RSA_WITH_AES_128_CBC_SHA256 0x0067 +#define TLS_DHE_DSS_WITH_AES_256_CBC_SHA256 0x006A +#define TLS_DHE_RSA_WITH_AES_256_CBC_SHA256 0x006B + +#define TLS_RSA_WITH_CAMELLIA_256_CBC_SHA 0x0084 +#define TLS_DH_DSS_WITH_CAMELLIA_256_CBC_SHA 0x0085 +#define TLS_DH_RSA_WITH_CAMELLIA_256_CBC_SHA 0x0086 +#define TLS_DHE_DSS_WITH_CAMELLIA_256_CBC_SHA 0x0087 +#define TLS_DHE_RSA_WITH_CAMELLIA_256_CBC_SHA 0x0088 +#define TLS_DH_anon_WITH_CAMELLIA_256_CBC_SHA 0x0089 + +#define TLS_RSA_WITH_SEED_CBC_SHA 0x0096 + +#define TLS_RSA_WITH_AES_128_GCM_SHA256 0x009C +#define TLS_RSA_WITH_AES_256_GCM_SHA384 0x009D +#define TLS_DHE_RSA_WITH_AES_128_GCM_SHA256 0x009E +#define TLS_DHE_RSA_WITH_AES_256_GCM_SHA384 0x009F +#define TLS_DHE_DSS_WITH_AES_128_GCM_SHA256 0x00A2 +#define TLS_DHE_DSS_WITH_AES_256_GCM_SHA384 0x00A3 + +/* TLS "Signaling Cipher Suite Value" (SCSV). May be requested by client. + * Must NEVER be chosen by server. SSL 3.0 server acknowledges by sending + * back an empty Renegotiation Info (RI) server hello extension. + */ +#define TLS_EMPTY_RENEGOTIATION_INFO_SCSV 0x00FF + +/* TLS_FALLBACK_SCSV is a signaling cipher suite value that indicates that a + * handshake is the result of TLS version fallback. + */ +#define TLS_FALLBACK_SCSV 0x5600 + +/* Cipher Suite Values starting with 0xC000 are defined in informational + * RFCs. + */ +#define TLS_ECDH_ECDSA_WITH_NULL_SHA 0xC001 +#define TLS_ECDH_ECDSA_WITH_RC4_128_SHA 0xC002 +#define TLS_ECDH_ECDSA_WITH_3DES_EDE_CBC_SHA 0xC003 +#define TLS_ECDH_ECDSA_WITH_AES_128_CBC_SHA 0xC004 +#define TLS_ECDH_ECDSA_WITH_AES_256_CBC_SHA 0xC005 + +#define TLS_ECDHE_ECDSA_WITH_NULL_SHA 0xC006 +#define TLS_ECDHE_ECDSA_WITH_RC4_128_SHA 0xC007 +#define TLS_ECDHE_ECDSA_WITH_3DES_EDE_CBC_SHA 0xC008 +#define TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA 0xC009 +#define TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA 0xC00A + +#define TLS_ECDH_RSA_WITH_NULL_SHA 0xC00B +#define TLS_ECDH_RSA_WITH_RC4_128_SHA 0xC00C +#define TLS_ECDH_RSA_WITH_3DES_EDE_CBC_SHA 0xC00D +#define TLS_ECDH_RSA_WITH_AES_128_CBC_SHA 0xC00E +#define TLS_ECDH_RSA_WITH_AES_256_CBC_SHA 0xC00F + +#define TLS_ECDHE_RSA_WITH_NULL_SHA 0xC010 +#define TLS_ECDHE_RSA_WITH_RC4_128_SHA 0xC011 +#define TLS_ECDHE_RSA_WITH_3DES_EDE_CBC_SHA 0xC012 +#define TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA 0xC013 +#define TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA 0xC014 + +#define TLS_ECDH_anon_WITH_NULL_SHA 0xC015 +#define TLS_ECDH_anon_WITH_RC4_128_SHA 0xC016 +#define TLS_ECDH_anon_WITH_3DES_EDE_CBC_SHA 0xC017 +#define TLS_ECDH_anon_WITH_AES_128_CBC_SHA 0xC018 +#define TLS_ECDH_anon_WITH_AES_256_CBC_SHA 0xC019 + +#define TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256 0xC023 +#define TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA384 0xC024 +#define TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256 0xC027 +#define TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384 0xC028 + +#define TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256 0xC02B +#define TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384 0xC02C +#define TLS_ECDH_ECDSA_WITH_AES_128_GCM_SHA256 0xC02D +#define TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256 0xC02F +#define TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384 0xC030 +#define TLS_ECDH_RSA_WITH_AES_128_GCM_SHA256 0xC031 + +/* draft-ietf-tls-chacha20-poly1305-04 */ +#define TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256 0xCCA8 +#define TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256 0xCCA9 +#define TLS_DHE_RSA_WITH_CHACHA20_POLY1305_SHA256 0xCCAA + +/* Special TLS 1.3 cipher suites that really just specify AEAD */ +#define TLS_AES_128_GCM_SHA256 0x1301 +#define TLS_AES_256_GCM_SHA384 0x1302 +#define TLS_CHACHA20_POLY1305_SHA256 0x1303 + +/* PSK cipher suites. NSS doesn't actually support these, but we + * exposed them when TLS 1.3 used them so we need to keep them + * in the API. */ +#define TLS_ECDHE_PSK_WITH_CHACHA20_POLY1305_SHA256 0xCCAC +#define TLS_DHE_PSK_WITH_CHACHA20_POLY1305_SHA256 0xCCAD +#define TLS_ECDHE_PSK_WITH_AES_128_GCM_SHA256 0xD001 +#define TLS_ECDHE_PSK_WITH_AES_256_GCM_SHA384 0xD002 +#define TLS_DHE_PSK_WITH_AES_128_GCM_SHA256 0x00AA /* RFC 5487 */ +#define TLS_DHE_PSK_WITH_AES_256_GCM_SHA384 0x00AB /* RFC 5487 */ + +/* DTLS-SRTP cipher suites from RFC 5764 */ +/* If you modify this, also modify MAX_DTLS_SRTP_CIPHER_SUITES in sslimpl.h */ +#define SRTP_AES128_CM_HMAC_SHA1_80 0x0001 +#define SRTP_AES128_CM_HMAC_SHA1_32 0x0002 +#define SRTP_NULL_HMAC_SHA1_80 0x0005 +#define SRTP_NULL_HMAC_SHA1_32 0x0006 + +/* DO NOT USE. (deprecated, will be removed) */ +#define SSL_HL_ERROR_HBYTES 3 +#define SSL_HL_CLIENT_HELLO_HBYTES 9 +#define SSL_HL_CLIENT_MASTER_KEY_HBYTES 10 +#define SSL_HL_CLIENT_FINISHED_HBYTES 1 +#define SSL_HL_SERVER_HELLO_HBYTES 11 +#define SSL_HL_SERVER_VERIFY_HBYTES 1 +#define SSL_HL_SERVER_FINISHED_HBYTES 1 +#define SSL_HL_REQUEST_CERTIFICATE_HBYTES 2 +#define SSL_HL_CLIENT_CERTIFICATE_HBYTES 6 +#define SSL_MT_ERROR 0 +#define SSL_MT_CLIENT_HELLO 1 +#define SSL_MT_CLIENT_MASTER_KEY 2 +#define SSL_MT_CLIENT_FINISHED 3 +#define SSL_MT_SERVER_HELLO 4 +#define SSL_MT_SERVER_VERIFY 5 +#define SSL_MT_SERVER_FINISHED 6 +#define SSL_MT_REQUEST_CERTIFICATE 7 +#define SSL_MT_CLIENT_CERTIFICATE 8 +#define SSL_CK_RC4_128_WITH_MD5 0x01 +#define SSL_CK_RC4_128_EXPORT40_WITH_MD5 0x02 +#define SSL_CK_RC2_128_CBC_WITH_MD5 0x03 +#define SSL_CK_RC2_128_CBC_EXPORT40_WITH_MD5 0x04 +#define SSL_CK_IDEA_128_CBC_WITH_MD5 0x05 +#define SSL_CK_DES_64_CBC_WITH_MD5 0x06 +#define SSL_CK_DES_192_EDE3_CBC_WITH_MD5 0x07 +#define SSL_EN_RC4_128_WITH_MD5 0xFF01 +#define SSL_EN_RC4_128_EXPORT40_WITH_MD5 0xFF02 +#define SSL_EN_RC2_128_CBC_WITH_MD5 0xFF03 +#define SSL_EN_RC2_128_CBC_EXPORT40_WITH_MD5 0xFF04 +#define SSL_EN_IDEA_128_CBC_WITH_MD5 0xFF05 +#define SSL_EN_DES_64_CBC_WITH_MD5 0xFF06 +#define SSL_EN_DES_192_EDE3_CBC_WITH_MD5 0xFF07 +#define TLS_RSA_EXPORT_WITH_RC4_40_MD5 0x0003 +#define TLS_RSA_EXPORT_WITH_RC2_CBC_40_MD5 0x0006 +#define TLS_RSA_EXPORT_WITH_DES40_CBC_SHA 0x0008 +#define TLS_RSA_EXPORT1024_WITH_DES_CBC_SHA 0x0062 +#define TLS_RSA_EXPORT1024_WITH_RC4_56_SHA 0x0064 +#define TLS_DHE_RSA_EXPORT_WITH_DES40_CBC_SHA 0x0014 +#define TLS_DH_RSA_EXPORT_WITH_DES40_CBC_SHA 0x000e +#define TLS_DHE_DSS_EXPORT1024_WITH_DES_CBC_SHA 0x0063 +#define TLS_DHE_DSS_EXPORT1024_WITH_RC4_56_SHA 0x0065 +#define TLS_DH_DSS_EXPORT_WITH_DES40_CBC_SHA 0x000b +#define TLS_DHE_DSS_EXPORT_WITH_DES40_CBC_SHA 0x0011 +#define TLS_DH_anon_EXPORT_WITH_RC4_40_MD5 0x0017 +#define TLS_DH_anon_EXPORT_WITH_DES40_CBC_SHA 0x0019 +#define SSL_FORTEZZA_DMS_WITH_NULL_SHA 0x001c +#define SSL_FORTEZZA_DMS_WITH_FORTEZZA_CBC_SHA 0x001d +#define SSL_FORTEZZA_DMS_WITH_RC4_128_SHA 0x001e +#define SSL_RSA_OLDFIPS_WITH_3DES_EDE_CBC_SHA 0xffe0 +#define SSL_RSA_OLDFIPS_WITH_DES_CBC_SHA 0xffe1 +#define SSL_RSA_FIPS_WITH_3DES_EDE_CBC_SHA 0xfeff +#define SSL_RSA_FIPS_WITH_DES_CBC_SHA 0xfefe +#define SSL_RSA_EXPORT_WITH_RC4_40_MD5 TLS_RSA_EXPORT_WITH_RC4_40_MD5 +#define SSL_RSA_EXPORT_WITH_RC2_CBC_40_MD5 TLS_RSA_EXPORT_WITH_RC2_CBC_40_MD5 +#define SSL_RSA_EXPORT_WITH_DES40_CBC_SHA TLS_RSA_EXPORT_WITH_DES40_CBC_SHA +#define SSL_DH_RSA_EXPORT_WITH_DES40_CBC_SHA TLS_DH_RSA_EXPORT_WITH_DES40_CBC_SHA +#define SSL_DHE_RSA_EXPORT_WITH_DES40_CBC_SHA TLS_DHE_RSA_EXPORT_WITH_DES40_CBC_SHA +#define SSL_DH_DSS_EXPORT_WITH_DES40_CBC_SHA TLS_DH_DSS_EXPORT_WITH_DES40_CBC_SHA +#define SSL_DHE_DSS_EXPORT_WITH_DES40_CBC_SHA TLS_DHE_DSS_EXPORT_WITH_DES40_CBC_SHA +#define SSL_DH_ANON_EXPORT_WITH_DES40_CBC_SHA TLS_DH_anon_EXPORT_WITH_DES40_CBC_SHA +#define SSL_DH_ANON_EXPORT_WITH_RC4_40_MD5 TLS_DH_anon_EXPORT_WITH_RC4_40_MD5 + +/* clang-format on */ + +#endif /* __sslproto_h_ */ diff --git a/security/nss/lib/ssl/sslreveal.c b/security/nss/lib/ssl/sslreveal.c new file mode 100644 index 000000000..4c124a1dc --- /dev/null +++ b/security/nss/lib/ssl/sslreveal.c @@ -0,0 +1,110 @@ +/* + * Accessor functions for SSLSocket private members. + * + * This Source Code Form is subject to the terms of the Mozilla Public + * License, v. 2.0. If a copy of the MPL was not distributed with this + * file, You can obtain one at http://mozilla.org/MPL/2.0/. */ + +#include "cert.h" +#include "ssl.h" +#include "certt.h" +#include "sslimpl.h" + +/* given PRFileDesc, returns a copy of certificate associated with the socket + * the caller should delete the cert when done with SSL_DestroyCertificate + */ +CERTCertificate * +SSL_RevealCert(PRFileDesc *fd) +{ + CERTCertificate *cert = NULL; + sslSocket *sslsocket = NULL; + + sslsocket = ssl_FindSocket(fd); + + /* CERT_DupCertificate increases reference count and returns pointer to + * the same cert + */ + if (sslsocket && sslsocket->sec.peerCert) + cert = CERT_DupCertificate(sslsocket->sec.peerCert); + + return cert; +} + +/* given PRFileDesc, returns a pointer to PinArg associated with the socket + */ +void * +SSL_RevealPinArg(PRFileDesc *fd) +{ + sslSocket *sslsocket = NULL; + void *PinArg = NULL; + + sslsocket = ssl_FindSocket(fd); + + /* is pkcs11PinArg part of the sslSocket or sslSecurityInfo ? */ + if (sslsocket) + PinArg = sslsocket->pkcs11PinArg; + + return PinArg; +} + +/* given PRFileDesc, returns a pointer to the URL associated with the socket + * the caller should free url when done + */ +char * +SSL_RevealURL(PRFileDesc *fd) +{ + sslSocket *sslsocket = NULL; + char *url = NULL; + + sslsocket = ssl_FindSocket(fd); + + if (sslsocket && sslsocket->url) + url = PL_strdup(sslsocket->url); + + return url; +} + +/* given PRFileDesc, returns status information related to extensions + * negotiated with peer during the handshake. + */ + +SECStatus +SSL_HandshakeNegotiatedExtension(PRFileDesc *socket, + SSLExtensionType extId, + PRBool *pYes) +{ + /* some decisions derived from SSL_GetChannelInfo */ + sslSocket *sslsocket = NULL; + + if (!pYes) { + PORT_SetError(SEC_ERROR_INVALID_ARGS); + return SECFailure; + } + + sslsocket = ssl_FindSocket(socket); + if (!sslsocket) { + SSL_DBG(("%d: SSL[%d]: bad socket in HandshakeNegotiatedExtension", + SSL_GETPID(), socket)); + return SECFailure; + } + + *pYes = PR_FALSE; + + /* according to public API SSL_GetChannelInfo, this doesn't need a lock */ + if (sslsocket->opt.useSecurity) { + if (sslsocket->ssl3.initialized) { /* SSL3 and TLS */ + /* now we know this socket went through ssl3_InitState() and + * ss->xtnData got initialized, which is the only member accessed by + * ssl3_ExtensionNegotiated(); + * Member xtnData appears to get accessed in functions that handle + * the handshake (hello messages and extension sending), + * therefore the handshake lock should be sufficient. + */ + ssl_GetSSL3HandshakeLock(sslsocket); + *pYes = ssl3_ExtensionNegotiated(sslsocket, extId); + ssl_ReleaseSSL3HandshakeLock(sslsocket); + } + } + + return SECSuccess; +} diff --git a/security/nss/lib/ssl/sslsecur.c b/security/nss/lib/ssl/sslsecur.c new file mode 100644 index 000000000..eecf44396 --- /dev/null +++ b/security/nss/lib/ssl/sslsecur.c @@ -0,0 +1,1235 @@ +/* + * Various SSL functions. + * + * This Source Code Form is subject to the terms of the Mozilla Public + * License, v. 2.0. If a copy of the MPL was not distributed with this + * file, You can obtain one at http://mozilla.org/MPL/2.0/. */ +#include "cert.h" +#include "secitem.h" +#include "keyhi.h" +#include "ssl.h" +#include "sslimpl.h" +#include "sslproto.h" +#include "secoid.h" /* for SECOID_GetALgorithmTag */ +#include "pk11func.h" /* for PK11_GenerateRandom */ +#include "nss.h" /* for NSS_RegisterShutdown */ +#include "prinit.h" /* for PR_CallOnceWithArg */ + +/* Returns a SECStatus: SECSuccess or SECFailure, NOT SECWouldBlock. + * + * Currently, the list of functions called through ss->handshake is: + * + * In sslsocks.c: + * SocksGatherRecord + * SocksHandleReply + * SocksStartGather + * + * In sslcon.c: + * ssl_GatherRecord1stHandshake + * ssl_BeginClientHandshake + * ssl_BeginServerHandshake + * + * The ss->handshake function returns SECWouldBlock if it was returned by + * one of the callback functions, via one of these paths: + * + * - ssl_GatherRecord1stHandshake() -> ssl3_GatherCompleteHandshake() -> + * ssl3_HandleRecord() -> ssl3_HandleHandshake() -> + * ssl3_HandleHandshakeMessage() -> ssl3_HandleCertificate() -> + * ss->handleBadCert() + * + * - ssl_GatherRecord1stHandshake() -> ssl3_GatherCompleteHandshake() -> + * ssl3_HandleRecord() -> ssl3_HandleHandshake() -> + * ssl3_HandleHandshakeMessage() -> ssl3_HandleCertificateRequest() -> + * ss->getClientAuthData() + * + * Called from: SSL_ForceHandshake (below), + * ssl_SecureRecv (below) and + * ssl_SecureSend (below) + * from: WaitForResponse in sslsocks.c + * ssl_SocksRecv in sslsocks.c + * ssl_SocksSend in sslsocks.c + * + * Caller must hold the (write) handshakeLock. + */ +int +ssl_Do1stHandshake(sslSocket *ss) +{ + int rv = SECSuccess; + + while (ss->handshake && rv == SECSuccess) { + PORT_Assert(ss->opt.noLocks || ssl_Have1stHandshakeLock(ss)); + PORT_Assert(ss->opt.noLocks || !ssl_HaveRecvBufLock(ss)); + PORT_Assert(ss->opt.noLocks || !ssl_HaveXmitBufLock(ss)); + PORT_Assert(ss->opt.noLocks || !ssl_HaveSSL3HandshakeLock(ss)); + + rv = (*ss->handshake)(ss); + }; + + PORT_Assert(ss->opt.noLocks || !ssl_HaveRecvBufLock(ss)); + PORT_Assert(ss->opt.noLocks || !ssl_HaveXmitBufLock(ss)); + PORT_Assert(ss->opt.noLocks || !ssl_HaveSSL3HandshakeLock(ss)); + + if (rv == SECWouldBlock) { + PORT_SetError(PR_WOULD_BLOCK_ERROR); + rv = SECFailure; + } + return rv; +} + +void +ssl_FinishHandshake(sslSocket *ss) +{ + PORT_Assert(ss->opt.noLocks || ssl_Have1stHandshakeLock(ss)); + PORT_Assert(ss->opt.noLocks || ssl_HaveRecvBufLock(ss)); + + SSL_TRC(3, ("%d: SSL[%d]: handshake is completed", SSL_GETPID(), ss->fd)); + + ss->firstHsDone = PR_TRUE; + ss->enoughFirstHsDone = PR_TRUE; + ss->gs.writeOffset = 0; + ss->gs.readOffset = 0; + + if (ss->handshakeCallback) { + PORT_Assert((ss->ssl3.hs.preliminaryInfo & ssl_preinfo_all) == + ssl_preinfo_all); + (ss->handshakeCallback)(ss->fd, ss->handshakeCallbackData); + } + + ssl_FreeEphemeralKeyPairs(ss); +} + +/* + * Handshake function that blocks. Used to force a + * retry on a connection on the next read/write. + */ +static SECStatus +ssl3_AlwaysBlock(sslSocket *ss) +{ + PORT_SetError(PR_WOULD_BLOCK_ERROR); /* perhaps redundant. */ + return SECWouldBlock; +} + +/* + * set the initial handshake state machine to block + */ +void +ssl3_SetAlwaysBlock(sslSocket *ss) +{ + if (!ss->firstHsDone) { + ss->handshake = ssl3_AlwaysBlock; + } +} + +static SECStatus +ssl_SetTimeout(PRFileDesc *fd, PRIntervalTime timeout) +{ + sslSocket *ss; + + ss = ssl_FindSocket(fd); + if (!ss) { + SSL_DBG(("%d: SSL[%d]: bad socket in SetTimeout", SSL_GETPID(), fd)); + return SECFailure; + } + SSL_LOCK_READER(ss); + ss->rTimeout = timeout; + if (ss->opt.fdx) { + SSL_LOCK_WRITER(ss); + } + ss->wTimeout = timeout; + if (ss->opt.fdx) { + SSL_UNLOCK_WRITER(ss); + } + SSL_UNLOCK_READER(ss); + return SECSuccess; +} + +/* Acquires and releases HandshakeLock. +*/ +SECStatus +SSL_ResetHandshake(PRFileDesc *s, PRBool asServer) +{ + sslSocket *ss; + SECStatus status; + PRNetAddr addr; + + ss = ssl_FindSocket(s); + if (!ss) { + SSL_DBG(("%d: SSL[%d]: bad socket in ResetHandshake", SSL_GETPID(), s)); + return SECFailure; + } + + /* Don't waste my time */ + if (!ss->opt.useSecurity) + return SECSuccess; + + SSL_LOCK_READER(ss); + SSL_LOCK_WRITER(ss); + + /* Reset handshake state */ + ssl_Get1stHandshakeLock(ss); + + ss->firstHsDone = PR_FALSE; + ss->enoughFirstHsDone = PR_FALSE; + if (asServer) { + ss->handshake = ssl_BeginServerHandshake; + ss->handshaking = sslHandshakingAsServer; + } else { + ss->handshake = ssl_BeginClientHandshake; + ss->handshaking = sslHandshakingAsClient; + } + + ssl_GetRecvBufLock(ss); + status = ssl3_InitGather(&ss->gs); + ssl_ReleaseRecvBufLock(ss); + if (status != SECSuccess) + goto loser; + + ssl_GetSSL3HandshakeLock(ss); + ss->ssl3.hs.canFalseStart = PR_FALSE; + ss->ssl3.hs.restartTarget = NULL; + + /* + ** Blow away old security state and get a fresh setup. + */ + ssl_GetXmitBufLock(ss); + ssl_ResetSecurityInfo(&ss->sec, PR_TRUE); + status = ssl_CreateSecurityInfo(ss); + ssl_ReleaseXmitBufLock(ss); + + ssl_ReleaseSSL3HandshakeLock(ss); + ssl_Release1stHandshakeLock(ss); + + ssl3_DestroyRemoteExtensions(&ss->ssl3.hs.remoteExtensions); + ssl3_ResetExtensionData(&ss->xtnData); + + if (!ss->TCPconnected) + ss->TCPconnected = (PR_SUCCESS == ssl_DefGetpeername(ss, &addr)); + +loser: + SSL_UNLOCK_WRITER(ss); + SSL_UNLOCK_READER(ss); + + return status; +} + +/* For SSLv2, does nothing but return an error. +** For SSLv3, flushes SID cache entry (if requested), +** and then starts new client hello or hello request. +** Acquires and releases HandshakeLock. +*/ +SECStatus +SSL_ReHandshake(PRFileDesc *fd, PRBool flushCache) +{ + sslSocket *ss; + SECStatus rv; + + ss = ssl_FindSocket(fd); + if (!ss) { + SSL_DBG(("%d: SSL[%d]: bad socket in RedoHandshake", SSL_GETPID(), fd)); + return SECFailure; + } + + if (!ss->opt.useSecurity) + return SECSuccess; + + ssl_Get1stHandshakeLock(ss); + + ssl_GetSSL3HandshakeLock(ss); + rv = ssl3_RedoHandshake(ss, flushCache); /* force full handshake. */ + ssl_ReleaseSSL3HandshakeLock(ss); + + ssl_Release1stHandshakeLock(ss); + + return rv; +} + +/* +** Same as above, but with an I/O timeout. + */ +SSL_IMPORT SECStatus +SSL_ReHandshakeWithTimeout(PRFileDesc *fd, + PRBool flushCache, + PRIntervalTime timeout) +{ + if (SECSuccess != ssl_SetTimeout(fd, timeout)) { + return SECFailure; + } + return SSL_ReHandshake(fd, flushCache); +} + +SECStatus +SSL_RedoHandshake(PRFileDesc *fd) +{ + return SSL_ReHandshake(fd, PR_TRUE); +} + +/* Register an application callback to be called when SSL handshake completes. +** Acquires and releases HandshakeLock. +*/ +SECStatus +SSL_HandshakeCallback(PRFileDesc *fd, SSLHandshakeCallback cb, + void *client_data) +{ + sslSocket *ss; + + ss = ssl_FindSocket(fd); + if (!ss) { + SSL_DBG(("%d: SSL[%d]: bad socket in HandshakeCallback", + SSL_GETPID(), fd)); + return SECFailure; + } + + if (!ss->opt.useSecurity) { + PORT_SetError(SEC_ERROR_INVALID_ARGS); + return SECFailure; + } + + ssl_Get1stHandshakeLock(ss); + ssl_GetSSL3HandshakeLock(ss); + + ss->handshakeCallback = cb; + ss->handshakeCallbackData = client_data; + + ssl_ReleaseSSL3HandshakeLock(ss); + ssl_Release1stHandshakeLock(ss); + + return SECSuccess; +} + +/* Register an application callback to be called when false start may happen. +** Acquires and releases HandshakeLock. +*/ +SECStatus +SSL_SetCanFalseStartCallback(PRFileDesc *fd, SSLCanFalseStartCallback cb, + void *arg) +{ + sslSocket *ss; + + ss = ssl_FindSocket(fd); + if (!ss) { + SSL_DBG(("%d: SSL[%d]: bad socket in SSL_SetCanFalseStartCallback", + SSL_GETPID(), fd)); + return SECFailure; + } + + if (!ss->opt.useSecurity) { + PORT_SetError(SEC_ERROR_INVALID_ARGS); + return SECFailure; + } + + ssl_Get1stHandshakeLock(ss); + ssl_GetSSL3HandshakeLock(ss); + + ss->canFalseStartCallback = cb; + ss->canFalseStartCallbackData = arg; + + ssl_ReleaseSSL3HandshakeLock(ss); + ssl_Release1stHandshakeLock(ss); + + return SECSuccess; +} + +SECStatus +SSL_RecommendedCanFalseStart(PRFileDesc *fd, PRBool *canFalseStart) +{ + sslSocket *ss; + + *canFalseStart = PR_FALSE; + ss = ssl_FindSocket(fd); + if (!ss) { + SSL_DBG(("%d: SSL[%d]: bad socket in SSL_RecommendedCanFalseStart", + SSL_GETPID(), fd)); + return SECFailure; + } + + if (!ss->ssl3.initialized) { + PORT_SetError(SEC_ERROR_INVALID_ARGS); + return SECFailure; + } + + /* Require a forward-secret key exchange. */ + *canFalseStart = ss->ssl3.hs.kea_def->kea == kea_dhe_dss || + ss->ssl3.hs.kea_def->kea == kea_dhe_rsa || + ss->ssl3.hs.kea_def->kea == kea_ecdhe_ecdsa || + ss->ssl3.hs.kea_def->kea == kea_ecdhe_rsa; + + return SECSuccess; +} + +/* Try to make progress on an SSL handshake by attempting to read the +** next handshake from the peer, and sending any responses. +** For non-blocking sockets, returns PR_ERROR_WOULD_BLOCK if it cannot +** read the next handshake from the underlying socket. +** Returns when handshake is complete, or application data has +** arrived that must be taken by application before handshake can continue, +** or a fatal error occurs. +** Application should use handshake completion callback to tell which. +*/ +SECStatus +SSL_ForceHandshake(PRFileDesc *fd) +{ + sslSocket *ss; + SECStatus rv = SECFailure; + + ss = ssl_FindSocket(fd); + if (!ss) { + SSL_DBG(("%d: SSL[%d]: bad socket in ForceHandshake", + SSL_GETPID(), fd)); + return rv; + } + + /* Don't waste my time */ + if (!ss->opt.useSecurity) + return SECSuccess; + + if (!ssl_SocketIsBlocking(ss)) { + ssl_GetXmitBufLock(ss); + if (ss->pendingBuf.len != 0) { + int sent = ssl_SendSavedWriteData(ss); + if ((sent < 0) && (PORT_GetError() != PR_WOULD_BLOCK_ERROR)) { + ssl_ReleaseXmitBufLock(ss); + return SECFailure; + } + } + ssl_ReleaseXmitBufLock(ss); + } + + ssl_Get1stHandshakeLock(ss); + + if (ss->version >= SSL_LIBRARY_VERSION_3_0) { + int gatherResult; + + ssl_GetRecvBufLock(ss); + gatherResult = ssl3_GatherCompleteHandshake(ss, 0); + ssl_ReleaseRecvBufLock(ss); + if (gatherResult > 0) { + rv = SECSuccess; + } else if (gatherResult == 0) { + PORT_SetError(PR_END_OF_FILE_ERROR); + } else if (gatherResult == SECWouldBlock) { + PORT_SetError(PR_WOULD_BLOCK_ERROR); + } + } else { + PORT_Assert(!ss->firstHsDone); + rv = ssl_Do1stHandshake(ss); + } + + ssl_Release1stHandshakeLock(ss); + + return rv; +} + +/* + ** Same as above, but with an I/O timeout. + */ +SSL_IMPORT SECStatus +SSL_ForceHandshakeWithTimeout(PRFileDesc *fd, + PRIntervalTime timeout) +{ + if (SECSuccess != ssl_SetTimeout(fd, timeout)) { + return SECFailure; + } + return SSL_ForceHandshake(fd); +} + +/************************************************************************/ + +/* +** Grow a buffer to hold newLen bytes of data. +** Called for both recv buffers and xmit buffers. +** Caller must hold xmitBufLock or recvBufLock, as appropriate. +*/ +SECStatus +sslBuffer_Grow(sslBuffer *b, unsigned int newLen) +{ + newLen = PR_MAX(newLen, MAX_FRAGMENT_LENGTH + 2048); + if (newLen > b->space) { + unsigned char *newBuf; + if (b->buf) { + newBuf = (unsigned char *)PORT_Realloc(b->buf, newLen); + } else { + newBuf = (unsigned char *)PORT_Alloc(newLen); + } + if (!newBuf) { + return SECFailure; + } + SSL_TRC(10, ("%d: SSL: grow buffer from %d to %d", + SSL_GETPID(), b->space, newLen)); + b->buf = newBuf; + b->space = newLen; + } + return SECSuccess; +} + +SECStatus +sslBuffer_Append(sslBuffer *b, const void *data, unsigned int len) +{ + unsigned int newLen = b->len + len; + SECStatus rv; + + rv = sslBuffer_Grow(b, newLen); + if (rv != SECSuccess) + return rv; + PORT_Memcpy(b->buf + b->len, data, len); + b->len += len; + return SECSuccess; +} + +void +sslBuffer_Clear(sslBuffer *b) +{ + if (b->len > 0) { + PORT_Free(b->buf); + b->buf = NULL; + b->len = 0; + b->space = 0; + } +} + +/* +** Save away write data that is trying to be written before the security +** handshake has been completed. When the handshake is completed, we will +** flush this data out. +** Caller must hold xmitBufLock +*/ +SECStatus +ssl_SaveWriteData(sslSocket *ss, const void *data, unsigned int len) +{ + SECStatus rv; + + PORT_Assert(ss->opt.noLocks || ssl_HaveXmitBufLock(ss)); + rv = sslBuffer_Append(&ss->pendingBuf, data, len); + SSL_TRC(5, ("%d: SSL[%d]: saving %u bytes of data (%u total saved so far)", + SSL_GETPID(), ss->fd, len, ss->pendingBuf.len)); + return rv; +} + +/* +** Send saved write data. This will flush out data sent prior to a +** complete security handshake. Hopefully there won't be too much of it. +** Returns count of the bytes sent, NOT a SECStatus. +** Caller must hold xmitBufLock +*/ +int +ssl_SendSavedWriteData(sslSocket *ss) +{ + int rv = 0; + + PORT_Assert(ss->opt.noLocks || ssl_HaveXmitBufLock(ss)); + if (ss->pendingBuf.len != 0) { + SSL_TRC(5, ("%d: SSL[%d]: sending %d bytes of saved data", + SSL_GETPID(), ss->fd, ss->pendingBuf.len)); + rv = ssl_DefSend(ss, ss->pendingBuf.buf, ss->pendingBuf.len, 0); + if (rv < 0) { + return rv; + } + ss->pendingBuf.len -= rv; + if (ss->pendingBuf.len > 0 && rv > 0) { + /* UGH !! This shifts the whole buffer down by copying it */ + PORT_Memmove(ss->pendingBuf.buf, ss->pendingBuf.buf + rv, + ss->pendingBuf.len); + } + } + return rv; +} + +/************************************************************************/ + +/* +** Receive some application data on a socket. Reads SSL records from the input +** stream, decrypts them and then copies them to the output buffer. +** Called from ssl_SecureRecv() below. +** +** Caller does NOT hold 1stHandshakeLock because that handshake is over. +** Caller doesn't call this until initial handshake is complete. +** The call to ssl3_GatherAppDataRecord may encounter handshake +** messages from a subsequent handshake. +** +** This code is similar to, and easily confused with, +** ssl_GatherRecord1stHandshake() in sslcon.c +*/ +static int +DoRecv(sslSocket *ss, unsigned char *out, int len, int flags) +{ + int rv; + int amount; + int available; + + /* ssl3_GatherAppDataRecord may call ssl_FinishHandshake, which needs the + * 1stHandshakeLock. */ + ssl_Get1stHandshakeLock(ss); + ssl_GetRecvBufLock(ss); + + available = ss->gs.writeOffset - ss->gs.readOffset; + if (available == 0) { + /* Wait for application data to arrive. */ + rv = ssl3_GatherAppDataRecord(ss, 0); + if (rv <= 0) { + if (rv == 0) { + /* EOF */ + SSL_TRC(10, ("%d: SSL[%d]: ssl_recv EOF", + SSL_GETPID(), ss->fd)); + goto done; + } + if ((rv != SECWouldBlock) && + (PR_GetError() != PR_WOULD_BLOCK_ERROR)) { + /* Some random error */ + goto done; + } + + /* + ** Gather record is blocked waiting for more record data to + ** arrive. Try to process what we have already received + */ + } else { + /* Gather record has finished getting a complete record */ + } + + /* See if any clear data is now available */ + available = ss->gs.writeOffset - ss->gs.readOffset; + if (available == 0) { + /* + ** No partial data is available. Force error code to + ** EWOULDBLOCK so that caller will try again later. Note + ** that the error code is probably EWOULDBLOCK already, + ** but if it isn't (for example, if we received a zero + ** length record) then this will force it to be correct. + */ + PORT_SetError(PR_WOULD_BLOCK_ERROR); + rv = SECFailure; + goto done; + } + SSL_TRC(30, ("%d: SSL[%d]: partial data ready, available=%d", + SSL_GETPID(), ss->fd, available)); + } + + if (IS_DTLS(ss) && (len < available)) { + /* DTLS does not allow you to do partial reads */ + SSL_TRC(30, ("%d: SSL[%d]: DTLS short read. len=%d available=%d", + SSL_GETPID(), ss->fd, len, available)); + ss->gs.readOffset += available; + PORT_SetError(SSL_ERROR_RX_SHORT_DTLS_READ); + rv = SECFailure; + goto done; + } + + /* Dole out clear data to reader */ + amount = PR_MIN(len, available); + PORT_Memcpy(out, ss->gs.buf.buf + ss->gs.readOffset, amount); + if (!(flags & PR_MSG_PEEK)) { + ss->gs.readOffset += amount; + } + PORT_Assert(ss->gs.readOffset <= ss->gs.writeOffset); + rv = amount; + + SSL_TRC(30, ("%d: SSL[%d]: amount=%d available=%d", + SSL_GETPID(), ss->fd, amount, available)); + PRINT_BUF(4, (ss, "DoRecv receiving plaintext:", out, amount)); + +done: + ssl_ReleaseRecvBufLock(ss); + ssl_Release1stHandshakeLock(ss); + return rv; +} + +/************************************************************************/ + +SECStatus +ssl_CreateSecurityInfo(sslSocket *ss) +{ + SECStatus status; + + ssl_GetXmitBufLock(ss); + status = sslBuffer_Grow(&ss->sec.writeBuf, 4096); + ssl_ReleaseXmitBufLock(ss); + + return status; +} + +SECStatus +ssl_CopySecurityInfo(sslSocket *ss, sslSocket *os) +{ + ss->sec.isServer = os->sec.isServer; + + ss->sec.peerCert = CERT_DupCertificate(os->sec.peerCert); + if (os->sec.peerCert && !ss->sec.peerCert) + goto loser; + + ss->sec.cache = os->sec.cache; + ss->sec.uncache = os->sec.uncache; + + return SECSuccess; + +loser: + return SECFailure; +} + +/* Reset sec back to its initial state. +** Caller holds any relevant locks. +*/ +void +ssl_ResetSecurityInfo(sslSecurityInfo *sec, PRBool doMemset) +{ + if (sec->localCert) { + CERT_DestroyCertificate(sec->localCert); + sec->localCert = NULL; + } + if (sec->peerCert) { + CERT_DestroyCertificate(sec->peerCert); + sec->peerCert = NULL; + } + if (sec->peerKey) { + SECKEY_DestroyPublicKey(sec->peerKey); + sec->peerKey = NULL; + } + + /* cleanup the ci */ + if (sec->ci.sid != NULL) { + ssl_FreeSID(sec->ci.sid); + } + PORT_ZFree(sec->ci.sendBuf.buf, sec->ci.sendBuf.space); + if (doMemset) { + memset(&sec->ci, 0, sizeof sec->ci); + } +} + +/* +** Called from SSL_ResetHandshake (above), and +** from ssl_FreeSocket in sslsock.c +** Caller should hold relevant locks (e.g. XmitBufLock) +*/ +void +ssl_DestroySecurityInfo(sslSecurityInfo *sec) +{ + ssl_ResetSecurityInfo(sec, PR_FALSE); + + PORT_ZFree(sec->writeBuf.buf, sec->writeBuf.space); + sec->writeBuf.buf = 0; + + memset(sec, 0, sizeof *sec); +} + +/************************************************************************/ + +int +ssl_SecureConnect(sslSocket *ss, const PRNetAddr *sa) +{ + PRFileDesc *osfd = ss->fd->lower; + int rv; + + if (ss->opt.handshakeAsServer) { + ss->handshake = ssl_BeginServerHandshake; + ss->handshaking = sslHandshakingAsServer; + } else { + ss->handshake = ssl_BeginClientHandshake; + ss->handshaking = sslHandshakingAsClient; + } + + /* connect to server */ + rv = osfd->methods->connect(osfd, sa, ss->cTimeout); + if (rv == PR_SUCCESS) { + ss->TCPconnected = 1; + } else { + int err = PR_GetError(); + SSL_DBG(("%d: SSL[%d]: connect failed, errno=%d", + SSL_GETPID(), ss->fd, err)); + if (err == PR_IS_CONNECTED_ERROR) { + ss->TCPconnected = 1; + } + } + + SSL_TRC(5, ("%d: SSL[%d]: secure connect completed, rv == %d", + SSL_GETPID(), ss->fd, rv)); + return rv; +} + +/* + * The TLS 1.2 RFC 5246, Section 7.2.1 says: + * + * Unless some other fatal alert has been transmitted, each party is + * required to send a close_notify alert before closing the write side + * of the connection. The other party MUST respond with a close_notify + * alert of its own and close down the connection immediately, + * discarding any pending writes. It is not required for the initiator + * of the close to wait for the responding close_notify alert before + * closing the read side of the connection. + * + * The second sentence requires that we send a close_notify alert when we + * have received a close_notify alert. In practice, all SSL implementations + * close the socket immediately after sending a close_notify alert (which is + * allowed by the third sentence), so responding with a close_notify alert + * would result in a write failure with the ECONNRESET error. This is why + * we don't respond with a close_notify alert. + * + * Also, in the unlikely event that the TCP pipe is full and the peer stops + * reading, the SSL3_SendAlert call in ssl_SecureClose and ssl_SecureShutdown + * may block indefinitely in blocking mode, and may fail (without retrying) + * in non-blocking mode. + */ + +int +ssl_SecureClose(sslSocket *ss) +{ + int rv; + + if (!(ss->shutdownHow & ssl_SHUTDOWN_SEND) && + ss->firstHsDone && + !ss->recvdCloseNotify && + ss->ssl3.initialized) { + + /* We don't want the final alert to be Nagle delayed. */ + if (!ss->delayDisabled) { + ssl_EnableNagleDelay(ss, PR_FALSE); + ss->delayDisabled = 1; + } + + (void)SSL3_SendAlert(ss, alert_warning, close_notify); + } + rv = ssl_DefClose(ss); + return rv; +} + +/* Caller handles all locking */ +int +ssl_SecureShutdown(sslSocket *ss, int nsprHow) +{ + PRFileDesc *osfd = ss->fd->lower; + int rv; + PRIntn sslHow = nsprHow + 1; + + if ((unsigned)nsprHow > PR_SHUTDOWN_BOTH) { + PORT_SetError(PR_INVALID_ARGUMENT_ERROR); + return PR_FAILURE; + } + + if ((sslHow & ssl_SHUTDOWN_SEND) != 0 && + !(ss->shutdownHow & ssl_SHUTDOWN_SEND) && + ss->firstHsDone && + !ss->recvdCloseNotify && + ss->ssl3.initialized) { + + (void)SSL3_SendAlert(ss, alert_warning, close_notify); + } + + rv = osfd->methods->shutdown(osfd, nsprHow); + + ss->shutdownHow |= sslHow; + + return rv; +} + +/************************************************************************/ + +int +ssl_SecureRecv(sslSocket *ss, unsigned char *buf, int len, int flags) +{ + int rv = 0; + + if (ss->shutdownHow & ssl_SHUTDOWN_RCV) { + PORT_SetError(PR_SOCKET_SHUTDOWN_ERROR); + return PR_FAILURE; + } + if (flags & ~PR_MSG_PEEK) { + PORT_SetError(PR_INVALID_ARGUMENT_ERROR); + return PR_FAILURE; + } + + if (!ssl_SocketIsBlocking(ss) && !ss->opt.fdx) { + ssl_GetXmitBufLock(ss); + if (ss->pendingBuf.len != 0) { + rv = ssl_SendSavedWriteData(ss); + if ((rv < 0) && (PORT_GetError() != PR_WOULD_BLOCK_ERROR)) { + ssl_ReleaseXmitBufLock(ss); + return SECFailure; + } + } + ssl_ReleaseXmitBufLock(ss); + } + + rv = 0; + if (!PR_CLIST_IS_EMPTY(&ss->ssl3.hs.bufferedEarlyData)) { + PORT_Assert(ss->version >= SSL_LIBRARY_VERSION_TLS_1_3); + return tls13_Read0RttData(ss, buf, len); + } + + /* If any of these is non-zero, the initial handshake is not done. */ + if (!ss->firstHsDone) { + ssl_Get1stHandshakeLock(ss); + if (ss->handshake) { + rv = ssl_Do1stHandshake(ss); + } + ssl_Release1stHandshakeLock(ss); + } + if (rv < 0) { + return rv; + } + + if (len == 0) + return 0; + + rv = DoRecv(ss, (unsigned char *)buf, len, flags); + SSL_TRC(2, ("%d: SSL[%d]: recving %d bytes securely (errno=%d)", + SSL_GETPID(), ss->fd, rv, PORT_GetError())); + return rv; +} + +int +ssl_SecureRead(sslSocket *ss, unsigned char *buf, int len) +{ + return ssl_SecureRecv(ss, buf, len, 0); +} + +/* Caller holds the SSL Socket's write lock. SSL_LOCK_WRITER(ss) */ +int +ssl_SecureSend(sslSocket *ss, const unsigned char *buf, int len, int flags) +{ + int rv = 0; + + SSL_TRC(2, ("%d: SSL[%d]: SecureSend: sending %d bytes", + SSL_GETPID(), ss->fd, len)); + + if (ss->shutdownHow & ssl_SHUTDOWN_SEND) { + PORT_SetError(PR_SOCKET_SHUTDOWN_ERROR); + rv = PR_FAILURE; + goto done; + } + if (flags) { + PORT_SetError(PR_INVALID_ARGUMENT_ERROR); + rv = PR_FAILURE; + goto done; + } + + ssl_GetXmitBufLock(ss); + if (ss->pendingBuf.len != 0) { + PORT_Assert(ss->pendingBuf.len > 0); + rv = ssl_SendSavedWriteData(ss); + if (rv >= 0 && ss->pendingBuf.len != 0) { + PORT_Assert(ss->pendingBuf.len > 0); + PORT_SetError(PR_WOULD_BLOCK_ERROR); + rv = SECFailure; + } + } + ssl_ReleaseXmitBufLock(ss); + if (rv < 0) { + goto done; + } + + if (len > 0) + ss->writerThread = PR_GetCurrentThread(); + + /* Check to see if we can write even though we're not finished. + * + * Case 1: False start + * Case 2: TLS 1.3 0-RTT + */ + if (!ss->firstHsDone) { + PRBool falseStart = PR_FALSE; + ssl_Get1stHandshakeLock(ss); + if (ss->opt.enableFalseStart || + (ss->opt.enable0RttData && !ss->sec.isServer)) { + ssl_GetSSL3HandshakeLock(ss); + /* The client can sometimes send before the handshake is fully + * complete. In TLS 1.2: false start; in TLS 1.3: 0-RTT. */ + falseStart = ss->ssl3.hs.canFalseStart || + ss->ssl3.hs.zeroRttState == ssl_0rtt_sent || + ss->ssl3.hs.zeroRttState == ssl_0rtt_accepted; + ssl_ReleaseSSL3HandshakeLock(ss); + } + if (!falseStart && ss->handshake) { + rv = ssl_Do1stHandshake(ss); + } + ssl_Release1stHandshakeLock(ss); + } + if (rv < 0) { + ss->writerThread = NULL; + goto done; + } + + /* Check for zero length writes after we do housekeeping so we make forward + * progress. + */ + if (len == 0) { + rv = 0; + goto done; + } + PORT_Assert(buf != NULL); + if (!buf) { + PORT_SetError(PR_INVALID_ARGUMENT_ERROR); + rv = PR_FAILURE; + goto done; + } + + if (!ss->firstHsDone) { +#ifdef DEBUG + ssl_GetSSL3HandshakeLock(ss); + PORT_Assert(!ss->sec.isServer && + (ss->ssl3.hs.canFalseStart || + ss->ssl3.hs.zeroRttState == ssl_0rtt_sent || + ss->ssl3.hs.zeroRttState == ssl_0rtt_accepted)); + ssl_ReleaseSSL3HandshakeLock(ss); +#endif + SSL_TRC(3, ("%d: SSL[%d]: SecureSend: sending data due to false start", + SSL_GETPID(), ss->fd)); + } + + ssl_GetXmitBufLock(ss); + rv = ssl3_SendApplicationData(ss, buf, len, flags); + ssl_ReleaseXmitBufLock(ss); + ss->writerThread = NULL; +done: + if (rv < 0) { + SSL_TRC(2, ("%d: SSL[%d]: SecureSend: returning %d count, error %d", + SSL_GETPID(), ss->fd, rv, PORT_GetError())); + } else { + SSL_TRC(2, ("%d: SSL[%d]: SecureSend: returning %d count", + SSL_GETPID(), ss->fd, rv)); + } + return rv; +} + +int +ssl_SecureWrite(sslSocket *ss, const unsigned char *buf, int len) +{ + return ssl_SecureSend(ss, buf, len, 0); +} + +SECStatus +SSL_BadCertHook(PRFileDesc *fd, SSLBadCertHandler f, void *arg) +{ + sslSocket *ss; + + ss = ssl_FindSocket(fd); + if (!ss) { + SSL_DBG(("%d: SSL[%d]: bad socket in SSLBadCertHook", + SSL_GETPID(), fd)); + return SECFailure; + } + + ss->handleBadCert = f; + ss->badCertArg = arg; + + return SECSuccess; +} + +/* + * Allow the application to pass the url or hostname into the SSL library + * so that we can do some checking on it. It will be used for the value in + * SNI extension of client hello message. + */ +SECStatus +SSL_SetURL(PRFileDesc *fd, const char *url) +{ + sslSocket *ss = ssl_FindSocket(fd); + SECStatus rv = SECSuccess; + + if (!ss) { + SSL_DBG(("%d: SSL[%d]: bad socket in SSLSetURL", + SSL_GETPID(), fd)); + return SECFailure; + } + ssl_Get1stHandshakeLock(ss); + ssl_GetSSL3HandshakeLock(ss); + + if (ss->url) { + PORT_Free((void *)ss->url); /* CONST */ + } + + ss->url = (const char *)PORT_Strdup(url); + if (ss->url == NULL) { + rv = SECFailure; + } + + ssl_ReleaseSSL3HandshakeLock(ss); + ssl_Release1stHandshakeLock(ss); + + return rv; +} + +/* + * Allow the application to pass the set of trust anchors + */ +SECStatus +SSL_SetTrustAnchors(PRFileDesc *fd, CERTCertList *certList) +{ + sslSocket *ss = ssl_FindSocket(fd); + CERTDistNames *names = NULL; + + if (!certList) { + PORT_SetError(SEC_ERROR_INVALID_ARGS); + return SECFailure; + } + if (!ss) { + SSL_DBG(("%d: SSL[%d]: bad socket in SSL_SetTrustAnchors", + SSL_GETPID(), fd)); + return SECFailure; + } + + names = CERT_DistNamesFromCertList(certList); + if (names == NULL) { + return SECFailure; + } + ssl_Get1stHandshakeLock(ss); + ssl_GetSSL3HandshakeLock(ss); + if (ss->ssl3.ca_list) { + CERT_FreeDistNames(ss->ssl3.ca_list); + } + ss->ssl3.ca_list = names; + ssl_ReleaseSSL3HandshakeLock(ss); + ssl_Release1stHandshakeLock(ss); + + return SECSuccess; +} + +/* +** Returns Negative number on error, zero or greater on success. +** Returns the amount of data immediately available to be read. +*/ +int +SSL_DataPending(PRFileDesc *fd) +{ + sslSocket *ss; + int rv = 0; + + ss = ssl_FindSocket(fd); + + if (ss && ss->opt.useSecurity) { + ssl_GetRecvBufLock(ss); + rv = ss->gs.writeOffset - ss->gs.readOffset; + ssl_ReleaseRecvBufLock(ss); + } + + return rv; +} + +SECStatus +SSL_InvalidateSession(PRFileDesc *fd) +{ + sslSocket *ss = ssl_FindSocket(fd); + SECStatus rv = SECFailure; + + if (ss) { + ssl_Get1stHandshakeLock(ss); + ssl_GetSSL3HandshakeLock(ss); + + if (ss->sec.ci.sid) { + ss->sec.uncache(ss->sec.ci.sid); + rv = SECSuccess; + } + + ssl_ReleaseSSL3HandshakeLock(ss); + ssl_Release1stHandshakeLock(ss); + } + return rv; +} + +SECItem * +SSL_GetSessionID(PRFileDesc *fd) +{ + sslSocket *ss; + SECItem *item = NULL; + + ss = ssl_FindSocket(fd); + if (ss) { + ssl_Get1stHandshakeLock(ss); + ssl_GetSSL3HandshakeLock(ss); + + if (ss->opt.useSecurity && ss->firstHsDone && ss->sec.ci.sid) { + item = (SECItem *)PORT_Alloc(sizeof(SECItem)); + if (item) { + sslSessionID *sid = ss->sec.ci.sid; + item->len = sid->u.ssl3.sessionIDLength; + item->data = (unsigned char *)PORT_Alloc(item->len); + PORT_Memcpy(item->data, sid->u.ssl3.sessionID, item->len); + } + } + + ssl_ReleaseSSL3HandshakeLock(ss); + ssl_Release1stHandshakeLock(ss); + } + return item; +} + +SECStatus +SSL_CertDBHandleSet(PRFileDesc *fd, CERTCertDBHandle *dbHandle) +{ + sslSocket *ss; + + ss = ssl_FindSocket(fd); + if (!ss) + return SECFailure; + if (!dbHandle) { + PORT_SetError(SEC_ERROR_INVALID_ARGS); + return SECFailure; + } + ss->dbHandle = dbHandle; + return SECSuccess; +} + +/* DO NOT USE. This function was exported in ssl.def with the wrong signature; + * this implementation exists to maintain link-time compatibility. + */ +int +SSL_RestartHandshakeAfterCertReq(sslSocket *ss, + CERTCertificate *cert, + SECKEYPrivateKey *key, + CERTCertificateList *certChain) +{ + PORT_SetError(PR_NOT_IMPLEMENTED_ERROR); + return -1; +} + +/* DO NOT USE. This function was exported in ssl.def with the wrong signature; + * this implementation exists to maintain link-time compatibility. + */ +int +SSL_RestartHandshakeAfterServerCert(sslSocket *ss) +{ + PORT_SetError(PR_NOT_IMPLEMENTED_ERROR); + return -1; +} + +/* See documentation in ssl.h */ +SECStatus +SSL_AuthCertificateComplete(PRFileDesc *fd, PRErrorCode error) +{ + SECStatus rv; + sslSocket *ss = ssl_FindSocket(fd); + + if (!ss) { + SSL_DBG(("%d: SSL[%d]: bad socket in SSL_AuthCertificateComplete", + SSL_GETPID(), fd)); + return SECFailure; + } + + ssl_Get1stHandshakeLock(ss); + + if (!ss->ssl3.initialized) { + PORT_SetError(SEC_ERROR_INVALID_ARGS); + rv = SECFailure; + } else { + rv = ssl3_AuthCertificateComplete(ss, error); + } + + ssl_Release1stHandshakeLock(ss); + + return rv; +} + +/* For more info see ssl.h */ +SECStatus +SSL_SNISocketConfigHook(PRFileDesc *fd, SSLSNISocketConfig func, + void *arg) +{ + sslSocket *ss; + + ss = ssl_FindSocket(fd); + if (!ss) { + SSL_DBG(("%d: SSL[%d]: bad socket in SNISocketConfigHook", + SSL_GETPID(), fd)); + return SECFailure; + } + + ss->sniSocketConfig = func; + ss->sniSocketConfigArg = arg; + return SECSuccess; +} diff --git a/security/nss/lib/ssl/sslsnce.c b/security/nss/lib/ssl/sslsnce.c new file mode 100644 index 000000000..4a4005c2d --- /dev/null +++ b/security/nss/lib/ssl/sslsnce.c @@ -0,0 +1,1990 @@ +/* This file implements the SERVER Session ID cache. + * NOTE: The contents of this file are NOT used by the client. + * + * This Source Code Form is subject to the terms of the Mozilla Public + * License, v. 2.0. If a copy of the MPL was not distributed with this + * file, You can obtain one at http://mozilla.org/MPL/2.0/. */ + +/* Note: ssl_FreeSID() in sslnonce.c gets used for both client and server + * cache sids! + * + * About record locking among different server processes: + * + * All processes that are part of the same conceptual server (serving on + * the same address and port) MUST share a common SSL session cache. + * This code makes the content of the shared cache accessible to all + * processes on the same "server". This code works on Unix and Win32 only. + * + * We use NSPR anonymous shared memory and move data to & from shared memory. + * We must do explicit locking of the records for all reads and writes. + * The set of Cache entries are divided up into "sets" of 128 entries. + * Each set is protected by a lock. There may be one or more sets protected + * by each lock. That is, locks to sets are 1:N. + * There is one lock for the entire cert cache. + * There is one lock for the set of wrapped sym wrap keys. + * + * The anonymous shared memory is laid out as if it were declared like this: + * + * struct { + * cacheDescriptor desc; + * sidCacheLock sidCacheLocks[ numSIDCacheLocks]; + * sidCacheLock keyCacheLock; + * sidCacheLock certCacheLock; + * sidCacheSet sidCacheSets[ numSIDCacheSets ]; + * sidCacheEntry sidCacheData[ numSIDCacheEntries]; + * certCacheEntry certCacheData[numCertCacheEntries]; + * SSLWrappedSymWrappingKey keyCacheData[ssl_auth_size][SSL_NUM_WRAP_MECHS]; + * PRUint8 keyNameSuffix[SESS_TICKET_KEY_VAR_NAME_LEN] + * encKeyCacheEntry ticketEncKey; // Wrapped + * encKeyCacheEntry ticketMacKey; // Wrapped + * PRBool ticketKeysValid; + * sidCacheLock srvNameCacheLock; + * srvNameCacheEntry srvNameData[ numSrvNameCacheEntries ]; + * } cacheMemCacheData; + */ +#include "seccomon.h" + +#if defined(XP_UNIX) || defined(XP_WIN32) || defined(XP_OS2) || defined(XP_BEOS) + +#include "cert.h" +#include "ssl.h" +#include "sslimpl.h" +#include "sslproto.h" +#include "pk11func.h" +#include "base64.h" +#include "keyhi.h" +#include "blapit.h" +#include "sechash.h" + +#include <stdio.h> + +#if defined(XP_UNIX) || defined(XP_BEOS) + +#include <syslog.h> +#include <fcntl.h> +#include <unistd.h> +#include <errno.h> +#include <signal.h> +#include "unix_err.h" + +#else + +#ifdef XP_WIN32 +#include <wtypes.h> +#include "win32err.h" +#endif + +#endif +#include <sys/types.h> + +#include "nspr.h" +#include "sslmutex.h" + +/* +** Format of a cache entry in the shared memory. +*/ +struct sidCacheEntryStr { + /* 16 */ PRIPv6Addr addr; /* client's IP address */ + /* 4 */ PRUint32 creationTime; + /* 4 */ PRUint32 lastAccessTime; + /* 4 */ PRUint32 expirationTime; + /* 2 */ PRUint16 version; + /* 1 */ PRUint8 valid; + /* 1 */ PRUint8 sessionIDLength; + /* 32 */ PRUint8 sessionID[SSL3_SESSIONID_BYTES]; + /* 2 */ PRUint16 authType; + /* 2 */ PRUint16 authKeyBits; + /* 2 */ PRUint16 keaType; + /* 2 */ PRUint16 keaKeyBits; + /* 72 - common header total */ + + union { + struct { + /* 2 */ ssl3CipherSuite cipherSuite; + /* 2 */ PRUint16 compression; /* SSLCompressionMethod */ + + /* 54 */ ssl3SidKeys keys; /* keys, wrapped as needed. */ + + /* 4 */ PRUint32 masterWrapMech; + /* 4 */ PRInt32 certIndex; + /* 4 */ PRInt32 srvNameIndex; + /* 32 */ PRUint8 srvNameHash[SHA256_LENGTH]; /* SHA256 name hash */ + /* 2 */ PRUint16 certTypeArgs; +/*104 */} ssl3; + +/* force sizeof(sidCacheEntry) to be a multiple of cache line size */ +struct { + /*120 */ PRUint8 filler[120]; /* 72+120==192, a multiple of 16 */ +} forceSize; + } u; +}; +typedef struct sidCacheEntryStr sidCacheEntry; + +/* The length of this struct is supposed to be a power of 2, e.g. 4KB */ +struct certCacheEntryStr { + PRUint16 certLength; /* 2 */ + PRUint16 sessionIDLength; /* 2 */ + PRUint8 sessionID[SSL3_SESSIONID_BYTES]; /* 32 */ + PRUint8 cert[SSL_MAX_CACHED_CERT_LEN]; /* 4060 */ +}; /* total 4096 */ +typedef struct certCacheEntryStr certCacheEntry; + +struct sidCacheLockStr { + PRUint32 timeStamp; + sslMutex mutex; + sslPID pid; +}; +typedef struct sidCacheLockStr sidCacheLock; + +struct sidCacheSetStr { + PRIntn next; +}; +typedef struct sidCacheSetStr sidCacheSet; + +struct encKeyCacheEntryStr { + PRUint8 bytes[512]; + PRInt32 length; +}; +typedef struct encKeyCacheEntryStr encKeyCacheEntry; + +#define SSL_MAX_DNS_HOST_NAME 1024 + +struct srvNameCacheEntryStr { + PRUint16 type; /* 2 */ + PRUint16 nameLen; /* 2 */ + PRUint8 name[SSL_MAX_DNS_HOST_NAME + 12]; /* 1034 */ + PRUint8 nameHash[SHA256_LENGTH]; /* 32 */ + /* 1072 */ +}; +typedef struct srvNameCacheEntryStr srvNameCacheEntry; + +struct cacheDescStr { + + PRUint32 cacheMemSize; + + PRUint32 numSIDCacheLocks; + PRUint32 numSIDCacheSets; + PRUint32 numSIDCacheSetsPerLock; + + PRUint32 numSIDCacheEntries; + PRUint32 sidCacheSize; + + PRUint32 numCertCacheEntries; + PRUint32 certCacheSize; + + PRUint32 numKeyCacheEntries; + PRUint32 keyCacheSize; + + PRUint32 numSrvNameCacheEntries; + PRUint32 srvNameCacheSize; + + PRUint32 ssl3Timeout; + + PRUint32 numSIDCacheLocksInitialized; + + /* These values are volatile, and are accessed through sharedCache-> */ + PRUint32 nextCertCacheEntry; /* certCacheLock protects */ + PRBool stopPolling; + PRBool everInherited; + + /* The private copies of these values are pointers into shared mem */ + /* The copies of these values in shared memory are merely offsets */ + sidCacheLock *sidCacheLocks; + sidCacheLock *keyCacheLock; + sidCacheLock *certCacheLock; + sidCacheLock *srvNameCacheLock; + sidCacheSet *sidCacheSets; + sidCacheEntry *sidCacheData; + certCacheEntry *certCacheData; + SSLWrappedSymWrappingKey *keyCacheData; + PRUint8 *ticketKeyNameSuffix; + encKeyCacheEntry *ticketEncKey; + encKeyCacheEntry *ticketMacKey; + PRUint32 *ticketKeysValid; + srvNameCacheEntry *srvNameCacheData; + + /* Only the private copies of these pointers are valid */ + char *cacheMem; + struct cacheDescStr *sharedCache; /* shared copy of this struct */ + PRFileMap *cacheMemMap; + PRThread *poller; + PRUint32 mutexTimeout; + PRBool shared; +}; +typedef struct cacheDescStr cacheDesc; + +static cacheDesc globalCache; + +static const char envVarName[] = { SSL_ENV_VAR_NAME }; + +static PRBool isMultiProcess = PR_FALSE; + +#define DEF_SID_CACHE_ENTRIES 10000 +#define DEF_CERT_CACHE_ENTRIES 250 +#define MIN_CERT_CACHE_ENTRIES 125 /* the effective size in old releases. */ +#define DEF_KEY_CACHE_ENTRIES 250 +#define DEF_NAME_CACHE_ENTRIES 1000 + +#define SID_CACHE_ENTRIES_PER_SET 128 +#define SID_ALIGNMENT 16 + +#define DEF_SSL3_TIMEOUT 86400L /* 24 hours */ +#define MAX_SSL3_TIMEOUT 86400L /* 24 hours */ +#define MIN_SSL3_TIMEOUT 5 /* seconds */ + +#if defined(AIX) || defined(LINUX) || defined(NETBSD) || defined(OPENBSD) +#define MAX_SID_CACHE_LOCKS 8 /* two FDs per lock */ +#elif defined(OSF1) +#define MAX_SID_CACHE_LOCKS 16 /* one FD per lock */ +#else +#define MAX_SID_CACHE_LOCKS 256 +#endif + +#define SID_HOWMANY(val, size) (((val) + ((size)-1)) / (size)) +#define SID_ROUNDUP(val, size) ((size)*SID_HOWMANY((val), (size))) + +static sslPID myPid; +static PRUint32 ssl_max_sid_cache_locks = MAX_SID_CACHE_LOCKS; + +/* forward static function declarations */ +static PRUint32 SIDindex(cacheDesc *cache, const PRIPv6Addr *addr, PRUint8 *s, + unsigned nl); +static SECStatus LaunchLockPoller(cacheDesc *cache); +static SECStatus StopLockPoller(cacheDesc *cache); + +struct inheritanceStr { + PRUint32 cacheMemSize; + PRUint32 fmStrLen; +}; + +typedef struct inheritanceStr inheritance; + +#if defined(_WIN32) || defined(XP_OS2) + +#define DEFAULT_CACHE_DIRECTORY "\\temp" + +#endif /* _win32 */ + +#if defined(XP_UNIX) || defined(XP_BEOS) + +#define DEFAULT_CACHE_DIRECTORY "/tmp" + +#endif /* XP_UNIX || XP_BEOS */ + +/************************************************************************/ + +static PRUint32 +LockSidCacheLock(sidCacheLock *lock, PRUint32 now) +{ + SECStatus rv = sslMutex_Lock(&lock->mutex); + if (rv != SECSuccess) + return 0; + if (!now) + now = ssl_Time(); + lock->timeStamp = now; + lock->pid = myPid; + return now; +} + +static SECStatus +UnlockSidCacheLock(sidCacheLock *lock) +{ + SECStatus rv; + + lock->pid = 0; + rv = sslMutex_Unlock(&lock->mutex); + return rv; +} + +/* returns the value of ssl_Time on success, zero on failure. */ +static PRUint32 +LockSet(cacheDesc *cache, PRUint32 set, PRUint32 now) +{ + PRUint32 lockNum = set % cache->numSIDCacheLocks; + sidCacheLock *lock = cache->sidCacheLocks + lockNum; + + return LockSidCacheLock(lock, now); +} + +static SECStatus +UnlockSet(cacheDesc *cache, PRUint32 set) +{ + PRUint32 lockNum = set % cache->numSIDCacheLocks; + sidCacheLock *lock = cache->sidCacheLocks + lockNum; + + return UnlockSidCacheLock(lock); +} + +/************************************************************************/ + +/* Put a certificate in the cache. Update the cert index in the sce. +*/ +static PRUint32 +CacheCert(cacheDesc *cache, CERTCertificate *cert, sidCacheEntry *sce) +{ + PRUint32 now; + certCacheEntry cce; + + if ((cert->derCert.len > SSL_MAX_CACHED_CERT_LEN) || + (cert->derCert.len <= 0) || + (cert->derCert.data == NULL)) { + PORT_SetError(SEC_ERROR_INVALID_ARGS); + return 0; + } + + cce.sessionIDLength = sce->sessionIDLength; + PORT_Memcpy(cce.sessionID, sce->sessionID, cce.sessionIDLength); + + cce.certLength = cert->derCert.len; + PORT_Memcpy(cce.cert, cert->derCert.data, cce.certLength); + + /* get lock on cert cache */ + now = LockSidCacheLock(cache->certCacheLock, 0); + if (now) { + + /* Find where to place the next cert cache entry. */ + cacheDesc *sharedCache = cache->sharedCache; + PRUint32 ndx = sharedCache->nextCertCacheEntry; + + /* write the entry */ + cache->certCacheData[ndx] = cce; + + /* remember where we put it. */ + sce->u.ssl3.certIndex = ndx; + + /* update the "next" cache entry index */ + sharedCache->nextCertCacheEntry = + (ndx + 1) % cache->numCertCacheEntries; + + UnlockSidCacheLock(cache->certCacheLock); + } + return now; +} + +/* Server configuration hash tables need to account the SECITEM.type + * field as well. These functions accomplish that. */ +static PLHashNumber +Get32BitNameHash(const SECItem *name) +{ + PLHashNumber rv = SECITEM_Hash(name); + + PRUint8 *rvc = (PRUint8 *)&rv; + rvc[name->len % sizeof(rv)] ^= name->type; + + return rv; +} + +/* Put a name in the cache. Update the cert index in the sce. +*/ +static PRUint32 +CacheSrvName(cacheDesc *cache, SECItem *name, sidCacheEntry *sce) +{ + PRUint32 now; + PRUint32 ndx; + srvNameCacheEntry snce; + + if (!name || name->len <= 0 || + name->len > SSL_MAX_DNS_HOST_NAME) { + PORT_SetError(SEC_ERROR_INVALID_ARGS); + return 0; + } + + snce.type = name->type; + snce.nameLen = name->len; + PORT_Memcpy(snce.name, name->data, snce.nameLen); + HASH_HashBuf(HASH_AlgSHA256, snce.nameHash, name->data, name->len); + + /* get index of the next name */ + ndx = Get32BitNameHash(name); + /* get lock on cert cache */ + now = LockSidCacheLock(cache->srvNameCacheLock, 0); + if (now) { + if (cache->numSrvNameCacheEntries > 0) { + /* Fit the index into array */ + ndx %= cache->numSrvNameCacheEntries; + /* write the entry */ + cache->srvNameCacheData[ndx] = snce; + /* remember where we put it. */ + sce->u.ssl3.srvNameIndex = ndx; + /* Copy hash into sid hash */ + PORT_Memcpy(sce->u.ssl3.srvNameHash, snce.nameHash, SHA256_LENGTH); + } + UnlockSidCacheLock(cache->srvNameCacheLock); + } + return now; +} + +/* +** Convert local SID to shared memory one +*/ +static void +ConvertFromSID(sidCacheEntry *to, sslSessionID *from) +{ + to->valid = 1; + to->version = from->version; + to->addr = from->addr; + to->creationTime = from->creationTime; + to->lastAccessTime = from->lastAccessTime; + to->expirationTime = from->expirationTime; + to->authType = from->authType; + to->authKeyBits = from->authKeyBits; + to->keaType = from->keaType; + to->keaKeyBits = from->keaKeyBits; + + to->u.ssl3.cipherSuite = from->u.ssl3.cipherSuite; + to->u.ssl3.compression = (PRUint16)from->u.ssl3.compression; + to->u.ssl3.keys = from->u.ssl3.keys; + to->u.ssl3.masterWrapMech = from->u.ssl3.masterWrapMech; + to->sessionIDLength = from->u.ssl3.sessionIDLength; + to->u.ssl3.certIndex = -1; + to->u.ssl3.srvNameIndex = -1; + PORT_Memcpy(to->sessionID, from->u.ssl3.sessionID, + to->sessionIDLength); + to->u.ssl3.certTypeArgs = 0U; + switch (from->authType) { + case ssl_auth_ecdsa: + case ssl_auth_ecdh_rsa: + case ssl_auth_ecdh_ecdsa: + PORT_Assert(from->certType.namedCurve); + to->u.ssl3.certTypeArgs = + (PRUint16)from->certType.namedCurve->name; + break; + default: + break; + } + + SSL_TRC(8, ("%d: SSL3: ConvertSID: time=%d addr=0x%08x%08x%08x%08x " + "cipherSuite=%d", + myPid, to->creationTime, to->addr.pr_s6_addr32[0], + to->addr.pr_s6_addr32[1], to->addr.pr_s6_addr32[2], + to->addr.pr_s6_addr32[3], to->u.ssl3.cipherSuite)); +} + +/* +** Convert shared memory cache-entry to local memory based one +** This is only called from ServerSessionIDLookup(). +*/ +static sslSessionID * +ConvertToSID(sidCacheEntry *from, + certCacheEntry *pcce, + srvNameCacheEntry *psnce, + CERTCertDBHandle *dbHandle) +{ + sslSessionID *to; + + to = PORT_ZNew(sslSessionID); + if (!to) { + return 0; + } + + to->u.ssl3.sessionIDLength = from->sessionIDLength; + to->u.ssl3.cipherSuite = from->u.ssl3.cipherSuite; + to->u.ssl3.compression = (SSLCompressionMethod)from->u.ssl3.compression; + to->u.ssl3.keys = from->u.ssl3.keys; + to->u.ssl3.masterWrapMech = from->u.ssl3.masterWrapMech; + if (from->u.ssl3.srvNameIndex != -1 && psnce) { + SECItem name; + SECStatus rv; + name.type = psnce->type; + name.len = psnce->nameLen; + name.data = psnce->name; + rv = SECITEM_CopyItem(NULL, &to->u.ssl3.srvName, &name); + if (rv != SECSuccess) { + goto loser; + } + } + + PORT_Memcpy(to->u.ssl3.sessionID, from->sessionID, from->sessionIDLength); + + /* the portions of the SID that are only restored on the client + * are set to invalid values on the server. + */ + to->u.ssl3.clientWriteKey = NULL; + to->u.ssl3.serverWriteKey = NULL; + + to->urlSvrName = NULL; + + to->u.ssl3.masterModuleID = (SECMODModuleID)-1; /* invalid value */ + to->u.ssl3.masterSlotID = (CK_SLOT_ID)-1; /* invalid value */ + to->u.ssl3.masterWrapIndex = 0; + to->u.ssl3.masterWrapSeries = 0; + to->u.ssl3.masterValid = PR_FALSE; + + to->u.ssl3.clAuthModuleID = (SECMODModuleID)-1; /* invalid value */ + to->u.ssl3.clAuthSlotID = (CK_SLOT_ID)-1; /* invalid value */ + to->u.ssl3.clAuthSeries = 0; + to->u.ssl3.clAuthValid = PR_FALSE; + + if (from->u.ssl3.certIndex != -1 && pcce) { + SECItem derCert; + + derCert.len = pcce->certLength; + derCert.data = pcce->cert; + + to->peerCert = CERT_NewTempCertificate(dbHandle, &derCert, NULL, + PR_FALSE, PR_TRUE); + if (to->peerCert == NULL) + goto loser; + } + to->certType.authType = from->authType; + switch (from->authType) { + case ssl_auth_ecdsa: + case ssl_auth_ecdh_rsa: + case ssl_auth_ecdh_ecdsa: + to->certType.namedCurve = + ssl_LookupNamedGroup((SSLNamedGroup)from->u.ssl3.certTypeArgs); + break; + default: + break; + } + + to->version = from->version; + to->creationTime = from->creationTime; + to->lastAccessTime = from->lastAccessTime; + to->expirationTime = from->expirationTime; + to->cached = in_server_cache; + to->addr = from->addr; + to->references = 1; + to->authType = from->authType; + to->authKeyBits = from->authKeyBits; + to->keaType = from->keaType; + to->keaKeyBits = from->keaKeyBits; + + return to; + +loser: + if (to) { + SECITEM_FreeItem(&to->u.ssl3.srvName, PR_FALSE); + PORT_Free(to); + } + return NULL; +} + +/* +** Perform some mumbo jumbo on the ip-address and the session-id value to +** compute a hash value. +*/ +static PRUint32 +SIDindex(cacheDesc *cache, const PRIPv6Addr *addr, PRUint8 *s, unsigned nl) +{ + PRUint32 rv; + PRUint32 x[8]; + + memset(x, 0, sizeof x); + if (nl > sizeof x) + nl = sizeof x; + memcpy(x, s, nl); + + rv = (addr->pr_s6_addr32[0] ^ addr->pr_s6_addr32[1] ^ + addr->pr_s6_addr32[2] ^ addr->pr_s6_addr32[3] ^ + x[0] ^ x[1] ^ x[2] ^ x[3] ^ x[4] ^ x[5] ^ x[6] ^ x[7]) % + cache->numSIDCacheSets; + return rv; +} + +/* +** Look something up in the cache. This will invalidate old entries +** in the process. Caller has locked the cache set! +** Returns PR_TRUE if found a valid match. PR_FALSE otherwise. +*/ +static sidCacheEntry * +FindSID(cacheDesc *cache, PRUint32 setNum, PRUint32 now, + const PRIPv6Addr *addr, unsigned char *sessionID, + unsigned sessionIDLength) +{ + PRUint32 ndx = cache->sidCacheSets[setNum].next; + int i; + + sidCacheEntry *set = cache->sidCacheData + + (setNum * SID_CACHE_ENTRIES_PER_SET); + + for (i = SID_CACHE_ENTRIES_PER_SET; i > 0; --i) { + sidCacheEntry *sce; + + ndx = (ndx - 1) % SID_CACHE_ENTRIES_PER_SET; + sce = set + ndx; + + if (!sce->valid) + continue; + + if (now > sce->expirationTime) { + /* SessionID has timed out. Invalidate the entry. */ + SSL_TRC(7, ("%d: timed out sid entry addr=%08x%08x%08x%08x now=%x " + "time+=%x", + myPid, sce->addr.pr_s6_addr32[0], + sce->addr.pr_s6_addr32[1], sce->addr.pr_s6_addr32[2], + sce->addr.pr_s6_addr32[3], now, + sce->expirationTime)); + sce->valid = 0; + continue; + } + + /* + ** Next, examine specific session-id/addr data to see if the cache + ** entry matches our addr+session-id value + */ + if (sessionIDLength == sce->sessionIDLength && + !memcmp(&sce->addr, addr, sizeof(PRIPv6Addr)) && + !memcmp(sce->sessionID, sessionID, sessionIDLength)) { + /* Found it */ + return sce; + } + } + + PORT_SetError(SSL_ERROR_SESSION_NOT_FOUND); + return NULL; +} + +/************************************************************************/ + +/* This is the primary function for finding entries in the server's sid cache. + * Although it is static, this function is called via the global function + * pointer ssl_sid_lookup. + */ +static sslSessionID * +ServerSessionIDLookup(const PRIPv6Addr *addr, + unsigned char *sessionID, + unsigned int sessionIDLength, + CERTCertDBHandle *dbHandle) +{ + sslSessionID *sid = 0; + sidCacheEntry *psce; + certCacheEntry *pcce = 0; + srvNameCacheEntry *psnce = 0; + cacheDesc *cache = &globalCache; + PRUint32 now; + PRUint32 set; + PRInt32 cndx; + sidCacheEntry sce; + certCacheEntry cce; + srvNameCacheEntry snce; + + set = SIDindex(cache, addr, sessionID, sessionIDLength); + now = LockSet(cache, set, 0); + if (!now) + return NULL; + + psce = FindSID(cache, set, now, addr, sessionID, sessionIDLength); + if (psce) { + if ((cndx = psce->u.ssl3.certIndex) != -1) { + PRUint32 gotLock = LockSidCacheLock(cache->certCacheLock, now); + if (gotLock) { + pcce = &cache->certCacheData[cndx]; + + /* See if the cert's session ID matches the sce cache. */ + if ((pcce->sessionIDLength == psce->sessionIDLength) && + !PORT_Memcmp(pcce->sessionID, psce->sessionID, + pcce->sessionIDLength)) { + cce = *pcce; + } else { + /* The cert doesen't match the SID cache entry, + ** so invalidate the SID cache entry. + */ + psce->valid = 0; + psce = 0; + pcce = 0; + } + UnlockSidCacheLock(cache->certCacheLock); + } else { + /* what the ??. Didn't get the cert cache lock. + ** Don't invalidate the SID cache entry, but don't find it. + */ + PORT_Assert(!("Didn't get cert Cache Lock!")); + psce = 0; + pcce = 0; + } + } + if (psce && ((cndx = psce->u.ssl3.srvNameIndex) != -1)) { + PRUint32 gotLock = LockSidCacheLock(cache->srvNameCacheLock, + now); + if (gotLock) { + psnce = &cache->srvNameCacheData[cndx]; + + if (!PORT_Memcmp(psnce->nameHash, psce->u.ssl3.srvNameHash, + SHA256_LENGTH)) { + snce = *psnce; + } else { + /* The name doesen't match the SID cache entry, + ** so invalidate the SID cache entry. + */ + psce->valid = 0; + psce = 0; + psnce = 0; + } + UnlockSidCacheLock(cache->srvNameCacheLock); + } else { + /* what the ??. Didn't get the cert cache lock. + ** Don't invalidate the SID cache entry, but don't find it. + */ + PORT_Assert(!("Didn't get name Cache Lock!")); + psce = 0; + psnce = 0; + } + } + if (psce) { + psce->lastAccessTime = now; + sce = *psce; /* grab a copy while holding the lock */ + } + } + UnlockSet(cache, set); + if (psce) { + /* sce conains a copy of the cache entry. + ** Convert shared memory format to local format + */ + sid = ConvertToSID(&sce, pcce ? &cce : 0, psnce ? &snce : 0, dbHandle); + } + return sid; +} + +/* +** Place a sid into the cache, if it isn't already there. +*/ +static void +ServerSessionIDCache(sslSessionID *sid) +{ + sidCacheEntry sce; + PRUint32 now = 0; + cacheDesc *cache = &globalCache; + + if (sid->u.ssl3.sessionIDLength == 0) { + return; + } + + if (sid->cached == never_cached || sid->cached == invalid_cache) { + PRUint32 set; + SECItem *name; + + PORT_Assert(sid->creationTime != 0); + if (!sid->creationTime) + sid->lastAccessTime = sid->creationTime = ssl_Time(); + /* override caller's expiration time, which uses client timeout + * duration, not server timeout duration. + */ + sid->expirationTime = sid->creationTime + cache->ssl3Timeout; + SSL_TRC(8, ("%d: SSL: CacheMT: cached=%d addr=0x%08x%08x%08x%08x time=%x " + "cipherSuite=%d", + myPid, sid->cached, + sid->addr.pr_s6_addr32[0], sid->addr.pr_s6_addr32[1], + sid->addr.pr_s6_addr32[2], sid->addr.pr_s6_addr32[3], + sid->creationTime, sid->u.ssl3.cipherSuite)); + PRINT_BUF(8, (0, "sessionID:", sid->u.ssl3.sessionID, + sid->u.ssl3.sessionIDLength)); + + ConvertFromSID(&sce, sid); + + name = &sid->u.ssl3.srvName; + if (name->len && name->data) { + now = CacheSrvName(cache, name, &sce); + } + if (sid->peerCert != NULL) { + now = CacheCert(cache, sid->peerCert, &sce); + } + + set = SIDindex(cache, &sce.addr, sce.sessionID, sce.sessionIDLength); + now = LockSet(cache, set, now); + if (now) { + PRUint32 next = cache->sidCacheSets[set].next; + PRUint32 ndx = set * SID_CACHE_ENTRIES_PER_SET + next; + + /* Write out new cache entry */ + cache->sidCacheData[ndx] = sce; + + cache->sidCacheSets[set].next = + (next + 1) % SID_CACHE_ENTRIES_PER_SET; + + UnlockSet(cache, set); + sid->cached = in_server_cache; + } + } +} + +/* +** Although this is static, it is called from ssl via global function pointer +** ssl_sid_uncache. This invalidates the referenced cache entry. +*/ +static void +ServerSessionIDUncache(sslSessionID *sid) +{ + cacheDesc *cache = &globalCache; + PRUint8 *sessionID; + unsigned int sessionIDLength; + PRErrorCode err; + PRUint32 set; + PRUint32 now; + sidCacheEntry *psce; + + if (sid == NULL) + return; + + /* Uncaching a SID should never change the error code. + ** So save it here and restore it before exiting. + */ + err = PR_GetError(); + + sessionID = sid->u.ssl3.sessionID; + sessionIDLength = sid->u.ssl3.sessionIDLength; + SSL_TRC(8, ("%d: SSL3: UncacheMT: valid=%d addr=0x%08x%08x%08x%08x time=%x " + "cipherSuite=%d", + myPid, sid->cached, + sid->addr.pr_s6_addr32[0], sid->addr.pr_s6_addr32[1], + sid->addr.pr_s6_addr32[2], sid->addr.pr_s6_addr32[3], + sid->creationTime, sid->u.ssl3.cipherSuite)); + PRINT_BUF(8, (0, "sessionID:", sessionID, sessionIDLength)); + set = SIDindex(cache, &sid->addr, sessionID, sessionIDLength); + now = LockSet(cache, set, 0); + if (now) { + psce = FindSID(cache, set, now, &sid->addr, sessionID, sessionIDLength); + if (psce) { + psce->valid = 0; + } + UnlockSet(cache, set); + } + sid->cached = invalid_cache; + PORT_SetError(err); +} + +#ifdef XP_OS2 + +#define INCL_DOSPROCESS +#include <os2.h> + +long +gettid(void) +{ + PTIB ptib; + PPIB ppib; + DosGetInfoBlocks(&ptib, &ppib); + return ((long)ptib->tib_ordinal); /* thread id */ +} +#endif + +static void +CloseCache(cacheDesc *cache) +{ + int locks_initialized = cache->numSIDCacheLocksInitialized; + + if (cache->cacheMem) { + if (cache->sharedCache) { + sidCacheLock *pLock = cache->sidCacheLocks; + for (; locks_initialized > 0; --locks_initialized, ++pLock) { + /* If everInherited is true, this shared cache was (and may + ** still be) in use by multiple processes. We do not wish to + ** destroy the mutexes while they are still in use, but we do + ** want to free mutex resources associated with this process. + */ + sslMutex_Destroy(&pLock->mutex, + cache->sharedCache->everInherited); + } + } + if (cache->shared) { + PR_MemUnmap(cache->cacheMem, cache->cacheMemSize); + } else { + PORT_Free(cache->cacheMem); + } + cache->cacheMem = NULL; + } + if (cache->cacheMemMap) { + PR_CloseFileMap(cache->cacheMemMap); + cache->cacheMemMap = NULL; + } + memset(cache, 0, sizeof *cache); +} + +static SECStatus +InitCache(cacheDesc *cache, int maxCacheEntries, int maxCertCacheEntries, + int maxSrvNameCacheEntries, PRUint32 ssl3_timeout, + const char *directory, PRBool shared) +{ + ptrdiff_t ptr; + sidCacheLock *pLock; + char *cacheMem; + PRFileMap *cacheMemMap; + char *cfn = NULL; /* cache file name */ + int locks_initialized = 0; + int locks_to_initialize = 0; + PRUint32 init_time; + + if ((!cache) || (maxCacheEntries < 0) || (!directory)) { + PORT_SetError(SEC_ERROR_INVALID_ARGS); + return SECFailure; + } + + if (cache->cacheMem) { + /* Already done */ + return SECSuccess; + } + + /* make sure loser can clean up properly */ + cache->shared = shared; + cache->cacheMem = cacheMem = NULL; + cache->cacheMemMap = cacheMemMap = NULL; + cache->sharedCache = (cacheDesc *)0; + + cache->numSIDCacheLocksInitialized = 0; + cache->nextCertCacheEntry = 0; + cache->stopPolling = PR_FALSE; + cache->everInherited = PR_FALSE; + cache->poller = NULL; + cache->mutexTimeout = 0; + + cache->numSIDCacheEntries = maxCacheEntries ? maxCacheEntries + : DEF_SID_CACHE_ENTRIES; + cache->numSIDCacheSets = + SID_HOWMANY(cache->numSIDCacheEntries, SID_CACHE_ENTRIES_PER_SET); + + cache->numSIDCacheEntries = + cache->numSIDCacheSets * SID_CACHE_ENTRIES_PER_SET; + + cache->numSIDCacheLocks = + PR_MIN(cache->numSIDCacheSets, ssl_max_sid_cache_locks); + + cache->numSIDCacheSetsPerLock = + SID_HOWMANY(cache->numSIDCacheSets, cache->numSIDCacheLocks); + + cache->numCertCacheEntries = (maxCertCacheEntries > 0) ? maxCertCacheEntries + : 0; + cache->numSrvNameCacheEntries = (maxSrvNameCacheEntries >= 0) ? maxSrvNameCacheEntries + : DEF_NAME_CACHE_ENTRIES; + + /* compute size of shared memory, and offsets of all pointers */ + ptr = 0; + cache->cacheMem = (char *)ptr; + ptr += SID_ROUNDUP(sizeof(cacheDesc), SID_ALIGNMENT); + + cache->sidCacheLocks = (sidCacheLock *)ptr; + cache->keyCacheLock = cache->sidCacheLocks + cache->numSIDCacheLocks; + cache->certCacheLock = cache->keyCacheLock + 1; + cache->srvNameCacheLock = cache->certCacheLock + 1; + ptr = (ptrdiff_t)(cache->srvNameCacheLock + 1); + ptr = SID_ROUNDUP(ptr, SID_ALIGNMENT); + + cache->sidCacheSets = (sidCacheSet *)ptr; + ptr = (ptrdiff_t)(cache->sidCacheSets + cache->numSIDCacheSets); + ptr = SID_ROUNDUP(ptr, SID_ALIGNMENT); + + cache->sidCacheData = (sidCacheEntry *)ptr; + ptr = (ptrdiff_t)(cache->sidCacheData + cache->numSIDCacheEntries); + ptr = SID_ROUNDUP(ptr, SID_ALIGNMENT); + + cache->certCacheData = (certCacheEntry *)ptr; + cache->sidCacheSize = + (char *)cache->certCacheData - (char *)cache->sidCacheData; + + if (cache->numCertCacheEntries < MIN_CERT_CACHE_ENTRIES) { + /* This is really a poor way to computer this! */ + cache->numCertCacheEntries = cache->sidCacheSize / sizeof(certCacheEntry); + if (cache->numCertCacheEntries < MIN_CERT_CACHE_ENTRIES) + cache->numCertCacheEntries = MIN_CERT_CACHE_ENTRIES; + } + ptr = (ptrdiff_t)(cache->certCacheData + cache->numCertCacheEntries); + ptr = SID_ROUNDUP(ptr, SID_ALIGNMENT); + + cache->keyCacheData = (SSLWrappedSymWrappingKey *)ptr; + cache->certCacheSize = + (char *)cache->keyCacheData - (char *)cache->certCacheData; + + cache->numKeyCacheEntries = ssl_auth_size * SSL_NUM_WRAP_MECHS; + ptr = (ptrdiff_t)(cache->keyCacheData + cache->numKeyCacheEntries); + ptr = SID_ROUNDUP(ptr, SID_ALIGNMENT); + + cache->keyCacheSize = (char *)ptr - (char *)cache->keyCacheData; + + cache->ticketKeyNameSuffix = (PRUint8 *)ptr; + ptr = (ptrdiff_t)(cache->ticketKeyNameSuffix + + SESS_TICKET_KEY_VAR_NAME_LEN); + ptr = SID_ROUNDUP(ptr, SID_ALIGNMENT); + + cache->ticketEncKey = (encKeyCacheEntry *)ptr; + ptr = (ptrdiff_t)(cache->ticketEncKey + 1); + ptr = SID_ROUNDUP(ptr, SID_ALIGNMENT); + + cache->ticketMacKey = (encKeyCacheEntry *)ptr; + ptr = (ptrdiff_t)(cache->ticketMacKey + 1); + ptr = SID_ROUNDUP(ptr, SID_ALIGNMENT); + + cache->ticketKeysValid = (PRUint32 *)ptr; + ptr = (ptrdiff_t)(cache->ticketKeysValid + 1); + ptr = SID_ROUNDUP(ptr, SID_ALIGNMENT); + + cache->srvNameCacheData = (srvNameCacheEntry *)ptr; + cache->srvNameCacheSize = + cache->numSrvNameCacheEntries * sizeof(srvNameCacheEntry); + ptr = (ptrdiff_t)(cache->srvNameCacheData + cache->numSrvNameCacheEntries); + ptr = SID_ROUNDUP(ptr, SID_ALIGNMENT); + + cache->cacheMemSize = ptr; + + if (ssl3_timeout) { + if (ssl3_timeout > MAX_SSL3_TIMEOUT) { + ssl3_timeout = MAX_SSL3_TIMEOUT; + } + if (ssl3_timeout < MIN_SSL3_TIMEOUT) { + ssl3_timeout = MIN_SSL3_TIMEOUT; + } + cache->ssl3Timeout = ssl3_timeout; + } else { + cache->ssl3Timeout = DEF_SSL3_TIMEOUT; + } + + if (shared) { +/* Create file names */ +#if defined(XP_UNIX) || defined(XP_BEOS) + /* there's some confusion here about whether PR_OpenAnonFileMap wants + ** a directory name or a file name for its first argument. + cfn = PR_smprintf("%s/.sslsvrcache.%d", directory, myPid); + */ + cfn = PR_smprintf("%s", directory); +#elif defined(XP_WIN32) + cfn = PR_smprintf("%s/svrcache_%d_%x.ssl", directory, myPid, + GetCurrentThreadId()); +#elif defined(XP_OS2) + cfn = PR_smprintf("%s/svrcache_%d_%x.ssl", directory, myPid, + gettid()); +#else +#error "Don't know how to create file name for this platform!" +#endif + if (!cfn) { + goto loser; + } + + /* Create cache */ + cacheMemMap = PR_OpenAnonFileMap(cfn, cache->cacheMemSize, + PR_PROT_READWRITE); + + PR_smprintf_free(cfn); + if (!cacheMemMap) { + goto loser; + } + + cacheMem = PR_MemMap(cacheMemMap, 0, cache->cacheMemSize); + } else { + cacheMem = PORT_Alloc(cache->cacheMemSize); + } + + if (!cacheMem) { + goto loser; + } + + /* Initialize shared memory. This may not be necessary on all platforms */ + memset(cacheMem, 0, cache->cacheMemSize); + + /* Copy cache descriptor header into shared memory */ + memcpy(cacheMem, cache, sizeof *cache); + + /* save private copies of these values */ + cache->cacheMemMap = cacheMemMap; + cache->cacheMem = cacheMem; + cache->sharedCache = (cacheDesc *)cacheMem; + + /* Fix pointers in our private copy of cache descriptor to point to + ** spaces in shared memory + */ + cache->sidCacheLocks = (sidCacheLock *)(cache->cacheMem + (ptrdiff_t)cache->sidCacheLocks); + cache->keyCacheLock = (sidCacheLock *)(cache->cacheMem + (ptrdiff_t)cache->keyCacheLock); + cache->certCacheLock = (sidCacheLock *)(cache->cacheMem + (ptrdiff_t)cache->certCacheLock); + cache->srvNameCacheLock = (sidCacheLock *)(cache->cacheMem + (ptrdiff_t)cache->srvNameCacheLock); + cache->sidCacheSets = (sidCacheSet *)(cache->cacheMem + (ptrdiff_t)cache->sidCacheSets); + cache->sidCacheData = (sidCacheEntry *)(cache->cacheMem + (ptrdiff_t)cache->sidCacheData); + cache->certCacheData = (certCacheEntry *)(cache->cacheMem + (ptrdiff_t)cache->certCacheData); + cache->keyCacheData = (SSLWrappedSymWrappingKey *)(cache->cacheMem + (ptrdiff_t)cache->keyCacheData); + cache->ticketKeyNameSuffix = (PRUint8 *)(cache->cacheMem + (ptrdiff_t)cache->ticketKeyNameSuffix); + cache->ticketEncKey = (encKeyCacheEntry *)(cache->cacheMem + (ptrdiff_t)cache->ticketEncKey); + cache->ticketMacKey = (encKeyCacheEntry *)(cache->cacheMem + (ptrdiff_t)cache->ticketMacKey); + cache->ticketKeysValid = (PRUint32 *)(cache->cacheMem + (ptrdiff_t)cache->ticketKeysValid); + cache->srvNameCacheData = (srvNameCacheEntry *)(cache->cacheMem + (ptrdiff_t)cache->srvNameCacheData); + + /* initialize the locks */ + init_time = ssl_Time(); + pLock = cache->sidCacheLocks; + for (locks_to_initialize = cache->numSIDCacheLocks + 3; + locks_initialized < locks_to_initialize; + ++locks_initialized, ++pLock) { + + SECStatus err = sslMutex_Init(&pLock->mutex, shared); + if (err) { + cache->numSIDCacheLocksInitialized = locks_initialized; + goto loser; + } + pLock->timeStamp = init_time; + pLock->pid = 0; + } + cache->numSIDCacheLocksInitialized = locks_initialized; + + return SECSuccess; + +loser: + CloseCache(cache); + PORT_SetError(SEC_ERROR_LIBRARY_FAILURE); + return SECFailure; +} + +PRUint32 +SSL_GetMaxServerCacheLocks(void) +{ + return ssl_max_sid_cache_locks + 2; + /* The extra two are the cert cache lock and the key cache lock. */ +} + +SECStatus +SSL_SetMaxServerCacheLocks(PRUint32 maxLocks) +{ + /* Minimum is 1 sid cache lock, 1 cert cache lock and 1 key cache lock. + ** We'd like to test for a maximum value, but not all platforms' header + ** files provide a symbol or function or other means of determining + ** the maximum, other than trial and error. + */ + if (maxLocks < 3) { + PORT_SetError(SEC_ERROR_INVALID_ARGS); + return SECFailure; + } + ssl_max_sid_cache_locks = maxLocks - 2; + /* The extra two are the cert cache lock and the key cache lock. */ + return SECSuccess; +} + +static SECStatus +ssl_ConfigServerSessionIDCacheInstanceWithOpt(cacheDesc *cache, + PRUint32 ssl3_timeout, + const char *directory, + PRBool shared, + int maxCacheEntries, + int maxCertCacheEntries, + int maxSrvNameCacheEntries) +{ + SECStatus rv; + + PORT_Assert(sizeof(sidCacheEntry) == 192); + PORT_Assert(sizeof(certCacheEntry) == 4096); + PORT_Assert(sizeof(srvNameCacheEntry) == 1072); + + rv = ssl_Init(); + if (rv != SECSuccess) { + return rv; + } + + myPid = SSL_GETPID(); + if (!directory) { + directory = DEFAULT_CACHE_DIRECTORY; + } + rv = InitCache(cache, maxCacheEntries, maxCertCacheEntries, + maxSrvNameCacheEntries, ssl3_timeout, directory, shared); + if (rv) { + return SECFailure; + } + + ssl_sid_lookup = ServerSessionIDLookup; + ssl_sid_cache = ServerSessionIDCache; + ssl_sid_uncache = ServerSessionIDUncache; + return SECSuccess; +} + +SECStatus +SSL_ConfigServerSessionIDCacheInstance(cacheDesc *cache, + int maxCacheEntries, + PRUint32 ssl2_timeout, + PRUint32 ssl3_timeout, + const char *directory, PRBool shared) +{ + return ssl_ConfigServerSessionIDCacheInstanceWithOpt(cache, + ssl3_timeout, + directory, + shared, + maxCacheEntries, + -1, -1); +} + +SECStatus +SSL_ConfigServerSessionIDCache(int maxCacheEntries, + PRUint32 ssl2_timeout, + PRUint32 ssl3_timeout, + const char *directory) +{ + ssl_InitSessionCacheLocks(PR_FALSE); + return SSL_ConfigServerSessionIDCacheInstance(&globalCache, + maxCacheEntries, ssl2_timeout, ssl3_timeout, directory, PR_FALSE); +} + +SECStatus +SSL_ShutdownServerSessionIDCacheInstance(cacheDesc *cache) +{ + CloseCache(cache); + return SECSuccess; +} + +SECStatus +SSL_ShutdownServerSessionIDCache(void) +{ +#if defined(XP_UNIX) || defined(XP_BEOS) + /* Stop the thread that polls cache for expired locks on Unix */ + StopLockPoller(&globalCache); +#endif + SSL3_ShutdownServerCache(); + return SSL_ShutdownServerSessionIDCacheInstance(&globalCache); +} + +/* Use this function, instead of SSL_ConfigServerSessionIDCache, + * if the cache will be shared by multiple processes. + */ +static SECStatus +ssl_ConfigMPServerSIDCacheWithOpt(PRUint32 ssl3_timeout, + const char *directory, + int maxCacheEntries, + int maxCertCacheEntries, + int maxSrvNameCacheEntries) +{ + char *envValue; + char *inhValue; + cacheDesc *cache = &globalCache; + PRUint32 fmStrLen; + SECStatus result; + PRStatus prStatus; + SECStatus putEnvFailed; + inheritance inherit; + char fmString[PR_FILEMAP_STRING_BUFSIZE]; + + isMultiProcess = PR_TRUE; + result = ssl_ConfigServerSessionIDCacheInstanceWithOpt(cache, + ssl3_timeout, directory, PR_TRUE, + maxCacheEntries, maxCacheEntries, maxSrvNameCacheEntries); + if (result != SECSuccess) + return result; + + prStatus = PR_ExportFileMapAsString(cache->cacheMemMap, + sizeof fmString, fmString); + if ((prStatus != PR_SUCCESS) || !(fmStrLen = strlen(fmString))) { + PORT_SetError(SEC_ERROR_LIBRARY_FAILURE); + return SECFailure; + } + + inherit.cacheMemSize = cache->cacheMemSize; + inherit.fmStrLen = fmStrLen; + + inhValue = BTOA_DataToAscii((unsigned char *)&inherit, sizeof inherit); + if (!inhValue || !strlen(inhValue)) { + PORT_SetError(SEC_ERROR_LIBRARY_FAILURE); + return SECFailure; + } + envValue = PR_smprintf("%s,%s", inhValue, fmString); + if (!envValue || !strlen(envValue)) { + PORT_SetError(SEC_ERROR_LIBRARY_FAILURE); + return SECFailure; + } + PORT_Free(inhValue); + + putEnvFailed = (SECStatus)NSS_PutEnv(envVarName, envValue); + PR_smprintf_free(envValue); + if (putEnvFailed) { + PORT_SetError(SEC_ERROR_LIBRARY_FAILURE); + result = SECFailure; + } + +#if defined(XP_UNIX) || defined(XP_BEOS) + /* Launch thread to poll cache for expired locks on Unix */ + LaunchLockPoller(cache); +#endif + return result; +} + +/* Use this function, instead of SSL_ConfigServerSessionIDCache, + * if the cache will be shared by multiple processes. + */ +SECStatus +SSL_ConfigMPServerSIDCache(int maxCacheEntries, + PRUint32 ssl2_timeout, + PRUint32 ssl3_timeout, + const char *directory) +{ + return ssl_ConfigMPServerSIDCacheWithOpt(ssl3_timeout, + directory, + maxCacheEntries, + -1, -1); +} + +SECStatus +SSL_ConfigServerSessionIDCacheWithOpt( + PRUint32 ssl2_timeout, + PRUint32 ssl3_timeout, + const char *directory, + int maxCacheEntries, + int maxCertCacheEntries, + int maxSrvNameCacheEntries, + PRBool enableMPCache) +{ + if (!enableMPCache) { + ssl_InitSessionCacheLocks(PR_FALSE); + return ssl_ConfigServerSessionIDCacheInstanceWithOpt(&globalCache, + ssl3_timeout, directory, PR_FALSE, + maxCacheEntries, maxCertCacheEntries, maxSrvNameCacheEntries); + } else { + return ssl_ConfigMPServerSIDCacheWithOpt(ssl3_timeout, directory, + maxCacheEntries, maxCertCacheEntries, maxSrvNameCacheEntries); + } +} + +SECStatus +SSL_InheritMPServerSIDCacheInstance(cacheDesc *cache, const char *envString) +{ + unsigned char *decoString = NULL; + char *fmString = NULL; + char *myEnvString = NULL; + unsigned int decoLen; + inheritance inherit; + cacheDesc my; +#ifdef WINNT + sidCacheLock *newLocks; + int locks_initialized = 0; + int locks_to_initialize = 0; +#endif + SECStatus status = ssl_Init(); + + if (status != SECSuccess) { + return status; + } + + myPid = SSL_GETPID(); + + /* If this child was created by fork(), and not by exec() on unix, + ** then isMultiProcess will already be set. + ** If not, we'll set it below. + */ + if (isMultiProcess) { + if (cache && cache->sharedCache) { + cache->sharedCache->everInherited = PR_TRUE; + } + return SECSuccess; /* already done. */ + } + + ssl_InitSessionCacheLocks(PR_FALSE); + + ssl_sid_lookup = ServerSessionIDLookup; + ssl_sid_cache = ServerSessionIDCache; + ssl_sid_uncache = ServerSessionIDUncache; + + if (!envString) { + envString = PR_GetEnvSecure(envVarName); + if (!envString) { + PORT_SetError(SEC_ERROR_LIBRARY_FAILURE); + return SECFailure; + } + } + myEnvString = PORT_Strdup(envString); + if (!myEnvString) + return SECFailure; + fmString = strchr(myEnvString, ','); + if (!fmString) + goto loser; + *fmString++ = 0; + + decoString = ATOB_AsciiToData(myEnvString, &decoLen); + if (!decoString) { + goto loser; + } + if (decoLen != sizeof inherit) { + goto loser; + } + + PORT_Memcpy(&inherit, decoString, sizeof inherit); + + if (strlen(fmString) != inherit.fmStrLen) { + goto loser; + } + + memset(cache, 0, sizeof *cache); + cache->cacheMemSize = inherit.cacheMemSize; + + /* Create cache */ + cache->cacheMemMap = PR_ImportFileMapFromString(fmString); + if (!cache->cacheMemMap) { + goto loser; + } + cache->cacheMem = PR_MemMap(cache->cacheMemMap, 0, cache->cacheMemSize); + if (!cache->cacheMem) { + goto loser; + } + cache->sharedCache = (cacheDesc *)cache->cacheMem; + + if (cache->sharedCache->cacheMemSize != cache->cacheMemSize) { + goto loser; + } + + /* We're now going to overwrite the local cache instance with the + ** shared copy of the cache struct, then update several values in + ** the local cache using the values for cache->cacheMemMap and + ** cache->cacheMem computed just above. So, we copy cache into + ** the automatic variable "my", to preserve the variables while + ** cache is overwritten. + */ + my = *cache; /* save values computed above. */ + memcpy(cache, cache->sharedCache, sizeof *cache); /* overwrite */ + + /* Fix pointers in our private copy of cache descriptor to point to + ** spaces in shared memory, whose address is now in "my". + */ + cache->sidCacheLocks = (sidCacheLock *)(my.cacheMem + (ptrdiff_t)cache->sidCacheLocks); + cache->keyCacheLock = (sidCacheLock *)(my.cacheMem + (ptrdiff_t)cache->keyCacheLock); + cache->certCacheLock = (sidCacheLock *)(my.cacheMem + (ptrdiff_t)cache->certCacheLock); + cache->srvNameCacheLock = (sidCacheLock *)(my.cacheMem + (ptrdiff_t)cache->srvNameCacheLock); + cache->sidCacheSets = (sidCacheSet *)(my.cacheMem + (ptrdiff_t)cache->sidCacheSets); + cache->sidCacheData = (sidCacheEntry *)(my.cacheMem + (ptrdiff_t)cache->sidCacheData); + cache->certCacheData = (certCacheEntry *)(my.cacheMem + (ptrdiff_t)cache->certCacheData); + cache->keyCacheData = (SSLWrappedSymWrappingKey *)(my.cacheMem + (ptrdiff_t)cache->keyCacheData); + cache->ticketKeyNameSuffix = (PRUint8 *)(my.cacheMem + (ptrdiff_t)cache->ticketKeyNameSuffix); + cache->ticketEncKey = (encKeyCacheEntry *)(my.cacheMem + (ptrdiff_t)cache->ticketEncKey); + cache->ticketMacKey = (encKeyCacheEntry *)(my.cacheMem + (ptrdiff_t)cache->ticketMacKey); + cache->ticketKeysValid = (PRUint32 *)(my.cacheMem + (ptrdiff_t)cache->ticketKeysValid); + cache->srvNameCacheData = (srvNameCacheEntry *)(my.cacheMem + (ptrdiff_t)cache->srvNameCacheData); + + cache->cacheMemMap = my.cacheMemMap; + cache->cacheMem = my.cacheMem; + cache->sharedCache = (cacheDesc *)cache->cacheMem; + +#ifdef WINNT + /* On Windows NT we need to "fix" the sidCacheLocks here to support fibers + ** When NT fibers are used in a multi-process server, a second level of + ** locking is needed to prevent a deadlock, in case a fiber acquires the + ** cross-process mutex, yields, and another fiber is later scheduled on + ** the same native thread and tries to acquire the cross-process mutex. + ** We do this by using a PRLock in the sslMutex. However, it is stored in + ** shared memory as part of sidCacheLocks, and we don't want to overwrite + ** the PRLock of the parent process. So we need to make new, private + ** copies of sidCacheLocks before modifying the sslMutex with our own + ** PRLock + */ + + /* note from jpierre : this should be free'd in child processes when + ** a function is added to delete the SSL session cache in the future. + */ + locks_to_initialize = cache->numSIDCacheLocks + 3; + newLocks = PORT_NewArray(sidCacheLock, locks_to_initialize); + if (!newLocks) + goto loser; + /* copy the old locks */ + memcpy(newLocks, cache->sidCacheLocks, + locks_to_initialize * sizeof(sidCacheLock)); + cache->sidCacheLocks = newLocks; + /* fix the locks */ + for (; locks_initialized < locks_to_initialize; ++locks_initialized) { + /* now, make a local PRLock in this sslMutex for this child process */ + SECStatus err; + err = sslMutex_2LevelInit(&newLocks[locks_initialized].mutex); + if (err != SECSuccess) { + cache->numSIDCacheLocksInitialized = locks_initialized; + goto loser; + } + } + cache->numSIDCacheLocksInitialized = locks_initialized; + + /* also fix the key and cert cache which use the last 2 lock entries */ + cache->keyCacheLock = cache->sidCacheLocks + cache->numSIDCacheLocks; + cache->certCacheLock = cache->keyCacheLock + 1; + cache->srvNameCacheLock = cache->certCacheLock + 1; +#endif + + PORT_Free(myEnvString); + PORT_Free(decoString); + + /* mark that we have inherited this. */ + cache->sharedCache->everInherited = PR_TRUE; + isMultiProcess = PR_TRUE; + + return SECSuccess; + +loser: + PORT_Free(myEnvString); + if (decoString) + PORT_Free(decoString); + CloseCache(cache); + PORT_SetError(SEC_ERROR_LIBRARY_FAILURE); + return SECFailure; +} + +SECStatus +SSL_InheritMPServerSIDCache(const char *envString) +{ + return SSL_InheritMPServerSIDCacheInstance(&globalCache, envString); +} + +#if defined(XP_UNIX) || defined(XP_BEOS) + +#define SID_LOCK_EXPIRATION_TIMEOUT 30 /* seconds */ + +static void +LockPoller(void *arg) +{ + cacheDesc *cache = (cacheDesc *)arg; + cacheDesc *sharedCache = cache->sharedCache; + sidCacheLock *pLock; + PRIntervalTime timeout; + PRUint32 now; + PRUint32 then; + int locks_polled = 0; + int locks_to_poll = cache->numSIDCacheLocks + 2; + PRUint32 expiration = cache->mutexTimeout; + + timeout = PR_SecondsToInterval(expiration); + while (!sharedCache->stopPolling) { + PR_Sleep(timeout); + if (sharedCache->stopPolling) + break; + + now = ssl_Time(); + then = now - expiration; + for (pLock = cache->sidCacheLocks, locks_polled = 0; + locks_to_poll > locks_polled && !sharedCache->stopPolling; + ++locks_polled, ++pLock) { + pid_t pid; + + if (pLock->timeStamp < then && + pLock->timeStamp != 0 && + (pid = pLock->pid) != 0) { + + /* maybe we should try the lock? */ + int result = kill(pid, 0); + if (result < 0 && errno == ESRCH) { + SECStatus rv; + /* No process exists by that pid any more. + ** Treat this mutex as abandoned. + */ + pLock->timeStamp = now; + pLock->pid = 0; + rv = sslMutex_Unlock(&pLock->mutex); + if (rv != SECSuccess) { + /* Now what? */ + } + } + } + } /* end of loop over locks */ + } /* end of entire polling loop */ +} + +/* Launch thread to poll cache for expired locks */ +static SECStatus +LaunchLockPoller(cacheDesc *cache) +{ + const char *timeoutString; + PRThread *pollerThread; + + cache->mutexTimeout = SID_LOCK_EXPIRATION_TIMEOUT; + timeoutString = PR_GetEnvSecure("NSS_SSL_SERVER_CACHE_MUTEX_TIMEOUT"); + if (timeoutString) { + long newTime = strtol(timeoutString, 0, 0); + if (newTime == 0) + return SECSuccess; /* application doesn't want poller thread */ + if (newTime > 0) + cache->mutexTimeout = (PRUint32)newTime; + /* if error (newTime < 0) ignore it and use default */ + } + + pollerThread = + PR_CreateThread(PR_USER_THREAD, LockPoller, cache, PR_PRIORITY_NORMAL, + PR_GLOBAL_THREAD, PR_JOINABLE_THREAD, 0); + if (!pollerThread) { + return SECFailure; + } + cache->poller = pollerThread; + return SECSuccess; +} + +/* Stop the thread that polls cache for expired locks */ +static SECStatus +StopLockPoller(cacheDesc *cache) +{ + if (!cache->poller) { + return SECSuccess; + } + cache->sharedCache->stopPolling = PR_TRUE; + if (PR_Interrupt(cache->poller) != PR_SUCCESS) { + return SECFailure; + } + if (PR_JoinThread(cache->poller) != PR_SUCCESS) { + return SECFailure; + } + cache->poller = NULL; + return SECSuccess; +} +#endif + +/************************************************************************ + * Code dealing with shared wrapped symmetric wrapping keys below * + ************************************************************************/ + +/* If now is zero, it implies that the lock is not held, and must be +** aquired here. +*/ +static PRBool +getSvrWrappingKey(PRInt32 symWrapMechIndex, + SSLAuthType authType, + SSLWrappedSymWrappingKey *wswk, + cacheDesc *cache, + PRUint32 lockTime) +{ + PRUint32 ndx = (authType * SSL_NUM_WRAP_MECHS) + symWrapMechIndex; + SSLWrappedSymWrappingKey *pwswk = cache->keyCacheData + ndx; + PRUint32 now = 0; + PRBool rv = PR_FALSE; + + if (!cache->cacheMem) { /* cache is uninitialized */ + PORT_SetError(SSL_ERROR_SERVER_CACHE_NOT_CONFIGURED); + return rv; + } + if (!lockTime) { + lockTime = now = LockSidCacheLock(cache->keyCacheLock, now); + if (!lockTime) { + return rv; + } + } + if (pwswk->authType == authType && + pwswk->symWrapMechIndex == symWrapMechIndex && + pwswk->wrappedSymKeyLen != 0) { + *wswk = *pwswk; + rv = PR_TRUE; + } + if (now) { + UnlockSidCacheLock(cache->keyCacheLock); + } + return rv; +} + +PRBool +ssl_GetWrappingKey(PRInt32 symWrapMechIndex, + SSLAuthType authType, + SSLWrappedSymWrappingKey *wswk) +{ + PRBool rv; + + PORT_Assert((unsigned)authType < ssl_auth_size); + PORT_Assert((unsigned)symWrapMechIndex < SSL_NUM_WRAP_MECHS); + if ((unsigned)authType < ssl_auth_size && + (unsigned)symWrapMechIndex < SSL_NUM_WRAP_MECHS) { + rv = getSvrWrappingKey(symWrapMechIndex, authType, wswk, + &globalCache, 0); + } else { + rv = PR_FALSE; + } + + return rv; +} + +/* Wrap and cache a session ticket key. */ +static PRBool +WrapTicketKey(SECKEYPublicKey *svrPubKey, PK11SymKey *symKey, + const char *keyName, encKeyCacheEntry *cacheEntry) +{ + SECItem wrappedKey = { siBuffer, NULL, 0 }; + + wrappedKey.len = SECKEY_PublicKeyStrength(svrPubKey); + PORT_Assert(wrappedKey.len <= sizeof(cacheEntry->bytes)); + if (wrappedKey.len > sizeof(cacheEntry->bytes)) + return PR_FALSE; + wrappedKey.data = cacheEntry->bytes; + + if (PK11_PubWrapSymKey(CKM_RSA_PKCS, svrPubKey, symKey, &wrappedKey) != + SECSuccess) { + SSL_DBG(("%d: SSL[%s]: Unable to wrap session ticket %s.", + SSL_GETPID(), "unknown", keyName)); + return PR_FALSE; + } + cacheEntry->length = wrappedKey.len; + return PR_TRUE; +} + +static PRBool +GenerateTicketKeys(void *pwArg, unsigned char *keyName, PK11SymKey **aesKey, + PK11SymKey **macKey) +{ + PK11SlotInfo *slot; + CK_MECHANISM_TYPE mechanismArray[2]; + PK11SymKey *aesKeyTmp = NULL; + PK11SymKey *macKeyTmp = NULL; + cacheDesc *cache = &globalCache; + PRUint8 ticketKeyNameSuffixLocal[SESS_TICKET_KEY_VAR_NAME_LEN]; + PRUint8 *ticketKeyNameSuffix; + + if (!cache->cacheMem) { + /* cache is not initalized. Use stack buffer */ + ticketKeyNameSuffix = ticketKeyNameSuffixLocal; + } else { + ticketKeyNameSuffix = cache->ticketKeyNameSuffix; + } + + if (PK11_GenerateRandom(ticketKeyNameSuffix, + SESS_TICKET_KEY_VAR_NAME_LEN) != + SECSuccess) { + SSL_DBG(("%d: SSL[%s]: Unable to generate random key name bytes.", + SSL_GETPID(), "unknown")); + goto loser; + } + + mechanismArray[0] = CKM_AES_CBC; + mechanismArray[1] = CKM_SHA256_HMAC; + + slot = PK11_GetBestSlotMultiple(mechanismArray, 2, pwArg); + if (slot) { + aesKeyTmp = PK11_KeyGen(slot, mechanismArray[0], NULL, + AES_256_KEY_LENGTH, pwArg); + macKeyTmp = PK11_KeyGen(slot, mechanismArray[1], NULL, + SHA256_LENGTH, pwArg); + PK11_FreeSlot(slot); + } + + if (aesKeyTmp == NULL || macKeyTmp == NULL) { + SSL_DBG(("%d: SSL[%s]: Unable to generate session ticket keys.", + SSL_GETPID(), "unknown")); + goto loser; + } + PORT_Memcpy(keyName, ticketKeyNameSuffix, SESS_TICKET_KEY_VAR_NAME_LEN); + *aesKey = aesKeyTmp; + *macKey = macKeyTmp; + return PR_TRUE; + +loser: + if (aesKeyTmp) + PK11_FreeSymKey(aesKeyTmp); + if (macKeyTmp) + PK11_FreeSymKey(macKeyTmp); + return PR_FALSE; +} + +static PRBool +GenerateAndWrapTicketKeys(SECKEYPublicKey *svrPubKey, void *pwArg, + unsigned char *keyName, PK11SymKey **aesKey, + PK11SymKey **macKey) +{ + PK11SymKey *aesKeyTmp = NULL; + PK11SymKey *macKeyTmp = NULL; + cacheDesc *cache = &globalCache; + + if (!GenerateTicketKeys(pwArg, keyName, &aesKeyTmp, &macKeyTmp)) { + goto loser; + } + + if (cache->cacheMem) { + /* Export the keys to the shared cache in wrapped form. */ + if (!WrapTicketKey(svrPubKey, aesKeyTmp, "enc key", cache->ticketEncKey)) + goto loser; + if (!WrapTicketKey(svrPubKey, macKeyTmp, "mac key", cache->ticketMacKey)) + goto loser; + } + *aesKey = aesKeyTmp; + *macKey = macKeyTmp; + return PR_TRUE; + +loser: + if (aesKeyTmp) + PK11_FreeSymKey(aesKeyTmp); + if (macKeyTmp) + PK11_FreeSymKey(macKeyTmp); + return PR_FALSE; +} + +static PRBool +UnwrapCachedTicketKeys(SECKEYPrivateKey *svrPrivKey, unsigned char *keyName, + PK11SymKey **aesKey, PK11SymKey **macKey) +{ + SECItem wrappedKey = { siBuffer, NULL, 0 }; + PK11SymKey *aesKeyTmp = NULL; + PK11SymKey *macKeyTmp = NULL; + cacheDesc *cache = &globalCache; + + wrappedKey.data = cache->ticketEncKey->bytes; + wrappedKey.len = cache->ticketEncKey->length; + PORT_Assert(wrappedKey.len <= sizeof(cache->ticketEncKey->bytes)); + aesKeyTmp = PK11_PubUnwrapSymKey(svrPrivKey, &wrappedKey, + CKM_AES_CBC, CKA_DECRYPT, 0); + + wrappedKey.data = cache->ticketMacKey->bytes; + wrappedKey.len = cache->ticketMacKey->length; + PORT_Assert(wrappedKey.len <= sizeof(cache->ticketMacKey->bytes)); + macKeyTmp = PK11_PubUnwrapSymKey(svrPrivKey, &wrappedKey, + CKM_SHA256_HMAC, CKA_SIGN, 0); + + if (aesKeyTmp == NULL || macKeyTmp == NULL) { + SSL_DBG(("%d: SSL[%s]: Unable to unwrap session ticket keys.", + SSL_GETPID(), "unknown")); + goto loser; + } + SSL_DBG(("%d: SSL[%s]: Successfully unwrapped session ticket keys.", + SSL_GETPID(), "unknown")); + + PORT_Memcpy(keyName, cache->ticketKeyNameSuffix, + SESS_TICKET_KEY_VAR_NAME_LEN); + *aesKey = aesKeyTmp; + *macKey = macKeyTmp; + return PR_TRUE; + +loser: + if (aesKeyTmp) + PK11_FreeSymKey(aesKeyTmp); + if (macKeyTmp) + PK11_FreeSymKey(macKeyTmp); + return PR_FALSE; +} + +PRBool +ssl_GetSessionTicketKeys(SECKEYPrivateKey *svrPrivKey, + SECKEYPublicKey *svrPubKey, void *pwArg, + unsigned char *keyName, PK11SymKey **aesKey, + PK11SymKey **macKey) +{ + PRUint32 now = 0; + PRBool rv = PR_FALSE; + PRBool keysGenerated = PR_FALSE; + cacheDesc *cache = &globalCache; + + if (!cache->cacheMem) { + /* cache is uninitialized. Generate keys and return them + * without caching. */ + return GenerateTicketKeys(pwArg, keyName, aesKey, macKey); + } + + now = LockSidCacheLock(cache->keyCacheLock, now); + if (!now) + return rv; + + if (!*(cache->ticketKeysValid)) { + /* Keys do not exist, create them. */ + if (!GenerateAndWrapTicketKeys(svrPubKey, pwArg, keyName, + aesKey, macKey)) + goto loser; + keysGenerated = PR_TRUE; + *(cache->ticketKeysValid) = 1; + } + + rv = PR_TRUE; + +loser: + UnlockSidCacheLock(cache->keyCacheLock); + if (rv && !keysGenerated) + rv = UnwrapCachedTicketKeys(svrPrivKey, keyName, aesKey, macKey); + return rv; +} + +/* The caller passes in the new value it wants + * to set. This code tests the wrapped sym key entry in the shared memory. + * If it is uninitialized, this function writes the caller's value into + * the disk entry, and returns false. + * Otherwise, it overwrites the caller's wswk with the value obtained from + * the disk, and returns PR_TRUE. + * This is all done while holding the locks/mutexes necessary to make + * the operation atomic. + */ +PRBool +ssl_SetWrappingKey(SSLWrappedSymWrappingKey *wswk) +{ + cacheDesc *cache = &globalCache; + PRBool rv = PR_FALSE; + SSLAuthType authType = wswk->authType; + /* type of keys used to wrap SymWrapKey*/ + PRInt32 symWrapMechIndex = wswk->symWrapMechIndex; + PRUint32 ndx; + PRUint32 now = 0; + SSLWrappedSymWrappingKey myWswk; + + if (!cache->cacheMem) { /* cache is uninitialized */ + PORT_SetError(SSL_ERROR_SERVER_CACHE_NOT_CONFIGURED); + return 0; + } + + PORT_Assert((unsigned)authType < ssl_auth_size); + if ((unsigned)authType >= ssl_auth_size) + return 0; + + PORT_Assert((unsigned)symWrapMechIndex < SSL_NUM_WRAP_MECHS); + if ((unsigned)symWrapMechIndex >= SSL_NUM_WRAP_MECHS) + return 0; + + ndx = (authType * SSL_NUM_WRAP_MECHS) + symWrapMechIndex; + PORT_Memset(&myWswk, 0, sizeof myWswk); /* eliminate UMRs. */ + + now = LockSidCacheLock(cache->keyCacheLock, now); + if (now) { + rv = getSvrWrappingKey(wswk->symWrapMechIndex, wswk->authType, + &myWswk, cache, now); + if (rv) { + /* we found it on disk, copy it out to the caller. */ + PORT_Memcpy(wswk, &myWswk, sizeof *wswk); + } else { + /* Wasn't on disk, and we're still holding the lock, so write it. */ + cache->keyCacheData[ndx] = *wswk; + } + UnlockSidCacheLock(cache->keyCacheLock); + } + return rv; +} + +#else /* MAC version or other platform */ + +#include "seccomon.h" +#include "cert.h" +#include "ssl.h" +#include "sslimpl.h" + +SECStatus +SSL_ConfigServerSessionIDCache(int maxCacheEntries, + PRUint32 ssl2_timeout, + PRUint32 ssl3_timeout, + const char *directory) +{ + PR_ASSERT(!"SSL servers are not supported on this platform. (SSL_ConfigServerSessionIDCache)"); + return SECFailure; +} + +SECStatus +SSL_ConfigMPServerSIDCache(int maxCacheEntries, + PRUint32 ssl2_timeout, + PRUint32 ssl3_timeout, + const char *directory) +{ + PR_ASSERT(!"SSL servers are not supported on this platform. (SSL_ConfigMPServerSIDCache)"); + return SECFailure; +} + +SECStatus +SSL_InheritMPServerSIDCache(const char *envString) +{ + PR_ASSERT(!"SSL servers are not supported on this platform. (SSL_InheritMPServerSIDCache)"); + return SECFailure; +} + +PRBool +ssl_GetWrappingKey(PRInt32 symWrapMechIndex, + SSLAuthType authType, + SSLWrappedSymWrappingKey *wswk) +{ + PRBool rv = PR_FALSE; + PR_ASSERT(!"SSL servers are not supported on this platform. (ssl_GetWrappingKey)"); + return rv; +} + +/* This is a kind of test-and-set. The caller passes in the new value it wants + * to set. This code tests the wrapped sym key entry in the shared memory. + * If it is uninitialized, this function writes the caller's value into + * the disk entry, and returns false. + * Otherwise, it overwrites the caller's wswk with the value obtained from + * the disk, and returns PR_TRUE. + * This is all done while holding the locks/mutexes necessary to make + * the operation atomic. + */ +PRBool +ssl_SetWrappingKey(SSLWrappedSymWrappingKey *wswk) +{ + PRBool rv = PR_FALSE; + PR_ASSERT(!"SSL servers are not supported on this platform. (ssl_SetWrappingKey)"); + return rv; +} + +PRUint32 +SSL_GetMaxServerCacheLocks(void) +{ + PR_ASSERT(!"SSL servers are not supported on this platform. (SSL_GetMaxServerCacheLocks)"); + return -1; +} + +SECStatus +SSL_SetMaxServerCacheLocks(PRUint32 maxLocks) +{ + PR_ASSERT(!"SSL servers are not supported on this platform. (SSL_SetMaxServerCacheLocks)"); + return SECFailure; +} + +#endif /* XP_UNIX || XP_WIN32 */ diff --git a/security/nss/lib/ssl/sslsock.c b/security/nss/lib/ssl/sslsock.c new file mode 100644 index 000000000..f089c75e0 --- /dev/null +++ b/security/nss/lib/ssl/sslsock.c @@ -0,0 +1,3742 @@ +/* -*- Mode: C; tab-width: 8; indent-tabs-mode: nil; c-basic-offset: 4 -*- */ +/* + * vtables (and methods that call through them) for the 4 types of + * SSLSockets supported. Only one type is still supported. + * Various other functions. + * + * This Source Code Form is subject to the terms of the Mozilla Public + * License, v. 2.0. If a copy of the MPL was not distributed with this + * file, You can obtain one at http://mozilla.org/MPL/2.0/. */ +#include "seccomon.h" +#include "cert.h" +#include "keyhi.h" +#include "ssl.h" +#include "sslimpl.h" +#include "sslproto.h" +#include "nspr.h" +#include "private/pprio.h" +#include "nss.h" +#include "pk11pqg.h" + +static const sslSocketOps ssl_default_ops = { /* No SSL. */ + ssl_DefConnect, + NULL, + ssl_DefBind, + ssl_DefListen, + ssl_DefShutdown, + ssl_DefClose, + ssl_DefRecv, + ssl_DefSend, + ssl_DefRead, + ssl_DefWrite, + ssl_DefGetpeername, + ssl_DefGetsockname +}; + +static const sslSocketOps ssl_secure_ops = { /* SSL. */ + ssl_SecureConnect, + NULL, + ssl_DefBind, + ssl_DefListen, + ssl_SecureShutdown, + ssl_SecureClose, + ssl_SecureRecv, + ssl_SecureSend, + ssl_SecureRead, + ssl_SecureWrite, + ssl_DefGetpeername, + ssl_DefGetsockname +}; + +/* +** default settings for socket enables +*/ +static sslOptions ssl_defaults = { + { siBuffer, NULL, 0 }, /* nextProtoNego */ + PR_TRUE, /* useSecurity */ + PR_FALSE, /* useSocks */ + PR_FALSE, /* requestCertificate */ + 2, /* requireCertificate */ + PR_FALSE, /* handshakeAsClient */ + PR_FALSE, /* handshakeAsServer */ + PR_FALSE, /* noCache */ + PR_FALSE, /* fdx */ + PR_TRUE, /* detectRollBack */ + PR_FALSE, /* noLocks */ + PR_FALSE, /* enableSessionTickets */ + PR_FALSE, /* enableDeflate */ + 2, /* enableRenegotiation (default: requires extension) */ + PR_FALSE, /* requireSafeNegotiation */ + PR_FALSE, /* enableFalseStart */ + PR_TRUE, /* cbcRandomIV */ + PR_FALSE, /* enableOCSPStapling */ + PR_FALSE, /* enableNPN */ + PR_TRUE, /* enableALPN */ + PR_TRUE, /* reuseServerECDHEKey */ + PR_FALSE, /* enableFallbackSCSV */ + PR_TRUE, /* enableServerDhe */ + PR_FALSE, /* enableExtendedMS */ + PR_FALSE, /* enableSignedCertTimestamps */ + PR_FALSE, /* requireDHENamedGroups */ + PR_FALSE, /* enable0RttData */ +#ifdef NSS_ENABLE_TLS13_SHORT_HEADERS + PR_TRUE /* enableShortHeaders */ +#else + PR_FALSE /* enableShortHeaders */ +#endif +}; + +/* + * default range of enabled SSL/TLS protocols + */ +static SSLVersionRange versions_defaults_stream = { + SSL_LIBRARY_VERSION_TLS_1_0, + SSL_LIBRARY_VERSION_TLS_1_2 +}; + +static SSLVersionRange versions_defaults_datagram = { + SSL_LIBRARY_VERSION_TLS_1_1, + SSL_LIBRARY_VERSION_TLS_1_2 +}; + +#define VERSIONS_DEFAULTS(variant) \ + (variant == ssl_variant_stream ? &versions_defaults_stream : &versions_defaults_datagram) +#define VERSIONS_POLICY_MIN(variant) \ + (variant == ssl_variant_stream ? NSS_TLS_VERSION_MIN_POLICY : NSS_DTLS_VERSION_MIN_POLICY) +#define VERSIONS_POLICY_MAX(variant) \ + (variant == ssl_variant_stream ? NSS_TLS_VERSION_MAX_POLICY : NSS_DTLS_VERSION_MAX_POLICY) + +sslSessionIDLookupFunc ssl_sid_lookup; +sslSessionIDCacheFunc ssl_sid_cache; +sslSessionIDUncacheFunc ssl_sid_uncache; + +static PRBool ssl_inited = PR_FALSE; +static PRDescIdentity ssl_layer_id; + +PRBool locksEverDisabled; /* implicitly PR_FALSE */ +PRBool ssl_force_locks; /* implicitly PR_FALSE */ +int ssl_lock_readers = 1; /* default true. */ +char ssl_debug; +char ssl_trace; +FILE *ssl_trace_iob; + +#ifdef NSS_ALLOW_SSLKEYLOGFILE +FILE *ssl_keylog_iob; +#endif + +char lockStatus[] = "Locks are ENABLED. "; +#define LOCKSTATUS_OFFSET 10 /* offset of ENABLED */ + +/* SRTP_NULL_HMAC_SHA1_80 and SRTP_NULL_HMAC_SHA1_32 are not implemented. */ +static const PRUint16 srtpCiphers[] = { + SRTP_AES128_CM_HMAC_SHA1_80, + SRTP_AES128_CM_HMAC_SHA1_32, + 0 +}; + +/* This list is in preference order. Note that while some smaller groups appear + * early in the list, smaller groups are generally ignored when iterating + * through this list. ffdhe_custom must not appear in this list. */ +#define ECGROUP(name, size, oid, assumeSupported) \ + { \ + ssl_grp_ec_##name, size, ssl_kea_ecdh, \ + SEC_OID_SECG_EC_##oid, assumeSupported \ + } +#define FFGROUP(size) \ + { \ + ssl_grp_ffdhe_##size, size, ssl_kea_dh, \ + SEC_OID_TLS_FFDHE_##size, PR_TRUE \ + } + +const sslNamedGroupDef ssl_named_groups[] = { + /* Note that 256 for 25519 is a lie, but we only use it for checking bit + * security and expect 256 bits there (not 255). */ + { ssl_grp_ec_curve25519, 256, ssl_kea_ecdh, SEC_OID_CURVE25519, PR_TRUE }, + ECGROUP(secp256r1, 256, SECP256R1, PR_TRUE), + ECGROUP(secp384r1, 384, SECP384R1, PR_TRUE), + ECGROUP(secp521r1, 521, SECP521R1, PR_TRUE), + FFGROUP(2048), + FFGROUP(3072), + FFGROUP(4096), + FFGROUP(6144), + FFGROUP(8192), + ECGROUP(secp192r1, 192, SECP192R1, PR_FALSE), + ECGROUP(secp160r2, 160, SECP160R2, PR_FALSE), + ECGROUP(secp160k1, 160, SECP160K1, PR_FALSE), + ECGROUP(secp160r1, 160, SECP160R1, PR_FALSE), + ECGROUP(sect163k1, 163, SECT163K1, PR_FALSE), + ECGROUP(sect163r1, 163, SECT163R1, PR_FALSE), + ECGROUP(sect163r2, 163, SECT163R2, PR_FALSE), + ECGROUP(secp192k1, 192, SECP192K1, PR_FALSE), + ECGROUP(sect193r1, 193, SECT193R1, PR_FALSE), + ECGROUP(sect193r2, 193, SECT193R2, PR_FALSE), + ECGROUP(secp224r1, 224, SECP224R1, PR_FALSE), + ECGROUP(secp224k1, 224, SECP224K1, PR_FALSE), + ECGROUP(sect233k1, 233, SECT233K1, PR_FALSE), + ECGROUP(sect233r1, 233, SECT233R1, PR_FALSE), + ECGROUP(sect239k1, 239, SECT239K1, PR_FALSE), + ECGROUP(secp256k1, 256, SECP256K1, PR_FALSE), + ECGROUP(sect283k1, 283, SECT283K1, PR_FALSE), + ECGROUP(sect283r1, 283, SECT283R1, PR_FALSE), + ECGROUP(sect409k1, 409, SECT409K1, PR_FALSE), + ECGROUP(sect409r1, 409, SECT409R1, PR_FALSE), + ECGROUP(sect571k1, 571, SECT571K1, PR_FALSE), + ECGROUP(sect571r1, 571, SECT571R1, PR_FALSE), +}; +PR_STATIC_ASSERT(SSL_NAMED_GROUP_COUNT == PR_ARRAY_SIZE(ssl_named_groups)); + +#undef ECGROUP +#undef FFGROUP + +/* forward declarations. */ +static sslSocket *ssl_NewSocket(PRBool makeLocks, SSLProtocolVariant variant); +static SECStatus ssl_MakeLocks(sslSocket *ss); +static void ssl_SetDefaultsFromEnvironment(void); +static PRStatus ssl_PushIOLayer(sslSocket *ns, PRFileDesc *stack, + PRDescIdentity id); + +/************************************************************************/ + +/* +** Lookup a socket structure from a file descriptor. +** Only functions called through the PRIOMethods table should use this. +** Other app-callable functions should use ssl_FindSocket. +*/ +static sslSocket * +ssl_GetPrivate(PRFileDesc *fd) +{ + sslSocket *ss; + + PORT_Assert(fd != NULL); + PORT_Assert(fd->methods->file_type == PR_DESC_LAYERED); + PORT_Assert(fd->identity == ssl_layer_id); + + if (fd->methods->file_type != PR_DESC_LAYERED || + fd->identity != ssl_layer_id) { + PORT_SetError(PR_BAD_DESCRIPTOR_ERROR); + return NULL; + } + + ss = (sslSocket *)fd->secret; + /* Set ss->fd lazily. We can't rely on the value of ss->fd set by + * ssl_PushIOLayer because another PR_PushIOLayer call will switch the + * contents of the PRFileDesc pointed by ss->fd and the new layer. + * See bug 807250. + */ + ss->fd = fd; + return ss; +} + +/* This function tries to find the SSL layer in the stack. + * It searches for the first SSL layer at or below the argument fd, + * and failing that, it searches for the nearest SSL layer above the + * argument fd. It returns the private sslSocket from the found layer. + */ +sslSocket * +ssl_FindSocket(PRFileDesc *fd) +{ + PRFileDesc *layer; + sslSocket *ss; + + PORT_Assert(fd != NULL); + PORT_Assert(ssl_layer_id != 0); + + layer = PR_GetIdentitiesLayer(fd, ssl_layer_id); + if (layer == NULL) { + PORT_SetError(PR_BAD_DESCRIPTOR_ERROR); + return NULL; + } + + ss = (sslSocket *)layer->secret; + /* Set ss->fd lazily. We can't rely on the value of ss->fd set by + * ssl_PushIOLayer because another PR_PushIOLayer call will switch the + * contents of the PRFileDesc pointed by ss->fd and the new layer. + * See bug 807250. + */ + ss->fd = layer; + return ss; +} + +static sslSocket * +ssl_DupSocket(sslSocket *os) +{ + sslSocket *ss; + SECStatus rv; + + ss = ssl_NewSocket((PRBool)(!os->opt.noLocks), os->protocolVariant); + if (!ss) { + return NULL; + } + + ss->opt = os->opt; + ss->opt.useSocks = PR_FALSE; + rv = SECITEM_CopyItem(NULL, &ss->opt.nextProtoNego, &os->opt.nextProtoNego); + if (rv != SECSuccess) { + goto loser; + } + ss->vrange = os->vrange; + + ss->peerID = !os->peerID ? NULL : PORT_Strdup(os->peerID); + ss->url = !os->url ? NULL : PORT_Strdup(os->url); + + ss->ops = os->ops; + ss->rTimeout = os->rTimeout; + ss->wTimeout = os->wTimeout; + ss->cTimeout = os->cTimeout; + ss->dbHandle = os->dbHandle; + + /* copy ssl2&3 policy & prefs, even if it's not selected (yet) */ + PORT_Memcpy(ss->cipherSuites, os->cipherSuites, sizeof os->cipherSuites); + PORT_Memcpy(ss->ssl3.dtlsSRTPCiphers, os->ssl3.dtlsSRTPCiphers, + sizeof(PRUint16) * os->ssl3.dtlsSRTPCipherCount); + ss->ssl3.dtlsSRTPCipherCount = os->ssl3.dtlsSRTPCipherCount; + PORT_Memcpy(ss->ssl3.signatureSchemes, os->ssl3.signatureSchemes, + sizeof(ss->ssl3.signatureSchemes[0]) * + os->ssl3.signatureSchemeCount); + ss->ssl3.signatureSchemeCount = os->ssl3.signatureSchemeCount; + ss->ssl3.downgradeCheckVersion = os->ssl3.downgradeCheckVersion; + + ss->ssl3.dheWeakGroupEnabled = os->ssl3.dheWeakGroupEnabled; + + if (ss->opt.useSecurity) { + PRCList *cursor; + for (cursor = PR_NEXT_LINK(&os->serverCerts); + cursor != &os->serverCerts; + cursor = PR_NEXT_LINK(cursor)) { + sslServerCert *sc = ssl_CopyServerCert((sslServerCert *)cursor); + if (!sc) + goto loser; + PR_APPEND_LINK(&sc->link, &ss->serverCerts); + } + + PR_INIT_CLIST(&ss->ephemeralKeyPairs); + for (cursor = PR_NEXT_LINK(&os->ephemeralKeyPairs); + cursor != &os->ephemeralKeyPairs; + cursor = PR_NEXT_LINK(cursor)) { + sslEphemeralKeyPair *okp = (sslEphemeralKeyPair *)cursor; + sslEphemeralKeyPair *skp = ssl_CopyEphemeralKeyPair(okp); + if (!skp) + goto loser; + PR_APPEND_LINK(&skp->link, &ss->ephemeralKeyPairs); + } + + /* + * XXX the preceding CERT_ and SECKEY_ functions can fail and return NULL. + * XXX We should detect this, and not just march on with NULL pointers. + */ + ss->authCertificate = os->authCertificate; + ss->authCertificateArg = os->authCertificateArg; + ss->getClientAuthData = os->getClientAuthData; + ss->getClientAuthDataArg = os->getClientAuthDataArg; + ss->sniSocketConfig = os->sniSocketConfig; + ss->sniSocketConfigArg = os->sniSocketConfigArg; + ss->handleBadCert = os->handleBadCert; + ss->badCertArg = os->badCertArg; + ss->handshakeCallback = os->handshakeCallback; + ss->handshakeCallbackData = os->handshakeCallbackData; + ss->canFalseStartCallback = os->canFalseStartCallback; + ss->canFalseStartCallbackData = os->canFalseStartCallbackData; + ss->pkcs11PinArg = os->pkcs11PinArg; + ss->nextProtoCallback = os->nextProtoCallback; + ss->nextProtoArg = os->nextProtoArg; + PORT_Memcpy((void *)ss->namedGroupPreferences, + os->namedGroupPreferences, + sizeof(ss->namedGroupPreferences)); + ss->additionalShares = os->additionalShares; + + /* Create security data */ + rv = ssl_CopySecurityInfo(ss, os); + if (rv != SECSuccess) { + goto loser; + } + } + return ss; + +loser: + ssl_FreeSocket(ss); + return NULL; +} + +static void +ssl_DestroyLocks(sslSocket *ss) +{ + /* Destroy locks. */ + if (ss->firstHandshakeLock) { + PZ_DestroyMonitor(ss->firstHandshakeLock); + ss->firstHandshakeLock = NULL; + } + if (ss->ssl3HandshakeLock) { + PZ_DestroyMonitor(ss->ssl3HandshakeLock); + ss->ssl3HandshakeLock = NULL; + } + if (ss->specLock) { + NSSRWLock_Destroy(ss->specLock); + ss->specLock = NULL; + } + + if (ss->recvLock) { + PZ_DestroyLock(ss->recvLock); + ss->recvLock = NULL; + } + if (ss->sendLock) { + PZ_DestroyLock(ss->sendLock); + ss->sendLock = NULL; + } + if (ss->xmitBufLock) { + PZ_DestroyMonitor(ss->xmitBufLock); + ss->xmitBufLock = NULL; + } + if (ss->recvBufLock) { + PZ_DestroyMonitor(ss->recvBufLock); + ss->recvBufLock = NULL; + } +} + +/* Caller holds any relevant locks */ +static void +ssl_DestroySocketContents(sslSocket *ss) +{ + PRCList *cursor; + + /* Free up socket */ + ssl_DestroySecurityInfo(&ss->sec); + + ssl3_DestroySSL3Info(ss); + + PORT_Free(ss->saveBuf.buf); + PORT_Free(ss->pendingBuf.buf); + ssl3_DestroyGather(&ss->gs); + + if (ss->peerID != NULL) + PORT_Free(ss->peerID); + if (ss->url != NULL) + PORT_Free((void *)ss->url); /* CONST */ + + /* Clean up server certificates and sundries. */ + while (!PR_CLIST_IS_EMPTY(&ss->serverCerts)) { + cursor = PR_LIST_TAIL(&ss->serverCerts); + PR_REMOVE_LINK(cursor); + ssl_FreeServerCert((sslServerCert *)cursor); + } + ssl_FreeEphemeralKeyPairs(ss); + SECITEM_FreeItem(&ss->opt.nextProtoNego, PR_FALSE); + ssl3_FreeSniNameArray(&ss->xtnData); +} + +/* + * free an sslSocket struct, and all the stuff that hangs off of it + */ +void +ssl_FreeSocket(sslSocket *ss) +{ + /* Get every lock you can imagine! + ** Caller already holds these: + ** SSL_LOCK_READER(ss); + ** SSL_LOCK_WRITER(ss); + */ + ssl_Get1stHandshakeLock(ss); + ssl_GetRecvBufLock(ss); + ssl_GetSSL3HandshakeLock(ss); + ssl_GetXmitBufLock(ss); + ssl_GetSpecWriteLock(ss); + + ssl_DestroySocketContents(ss); + + /* Release all the locks acquired above. */ + SSL_UNLOCK_READER(ss); + SSL_UNLOCK_WRITER(ss); + ssl_Release1stHandshakeLock(ss); + ssl_ReleaseRecvBufLock(ss); + ssl_ReleaseSSL3HandshakeLock(ss); + ssl_ReleaseXmitBufLock(ss); + ssl_ReleaseSpecWriteLock(ss); + + ssl_DestroyLocks(ss); + +#ifdef DEBUG + PORT_Memset(ss, 0x1f, sizeof *ss); +#endif + PORT_Free(ss); + return; +} + +/************************************************************************/ +SECStatus +ssl_EnableNagleDelay(sslSocket *ss, PRBool enabled) +{ + PRFileDesc *osfd = ss->fd->lower; + SECStatus rv = SECFailure; + PRSocketOptionData opt; + + opt.option = PR_SockOpt_NoDelay; + opt.value.no_delay = (PRBool)!enabled; + + if (osfd->methods->setsocketoption) { + rv = (SECStatus)osfd->methods->setsocketoption(osfd, &opt); + } else { + PR_SetError(PR_NOT_IMPLEMENTED_ERROR, 0); + } + + return rv; +} + +static void +ssl_ChooseOps(sslSocket *ss) +{ + ss->ops = ss->opt.useSecurity ? &ssl_secure_ops : &ssl_default_ops; +} + +/* Called from SSL_Enable (immediately below) */ +static SECStatus +PrepareSocket(sslSocket *ss) +{ + SECStatus rv = SECSuccess; + + ssl_ChooseOps(ss); + return rv; +} + +SECStatus +SSL_Enable(PRFileDesc *fd, int which, PRBool on) +{ + return SSL_OptionSet(fd, which, on); +} + +static PRBool ssl_VersionIsSupportedByPolicy( + SSLProtocolVariant protocolVariant, SSL3ProtocolVersion version); + +/* Implements the semantics for SSL_OptionSet(SSL_ENABLE_TLS, on) described in + * ssl.h in the section "SSL version range setting API". + */ +static void +ssl_EnableTLS(SSLVersionRange *vrange, PRBool on) +{ + if (on) { + /* don't turn it on if tls1.0 disallowed by by policy */ + if (!ssl_VersionIsSupportedByPolicy(ssl_variant_stream, + SSL_LIBRARY_VERSION_TLS_1_0)) { + return; + } + } + if (SSL_ALL_VERSIONS_DISABLED(vrange)) { + if (on) { + vrange->min = SSL_LIBRARY_VERSION_TLS_1_0; + vrange->max = SSL_LIBRARY_VERSION_TLS_1_0; + } /* else don't change anything */ + return; + } + + if (on) { + /* Expand the range of enabled version to include TLS 1.0 */ + vrange->min = PR_MIN(vrange->min, SSL_LIBRARY_VERSION_TLS_1_0); + vrange->max = PR_MAX(vrange->max, SSL_LIBRARY_VERSION_TLS_1_0); + } else { + /* Disable all TLS versions, leaving only SSL 3.0 if it was enabled */ + if (vrange->min == SSL_LIBRARY_VERSION_3_0) { + vrange->max = SSL_LIBRARY_VERSION_3_0; + } else { + /* Only TLS was enabled, so now no versions are. */ + vrange->min = SSL_LIBRARY_VERSION_NONE; + vrange->max = SSL_LIBRARY_VERSION_NONE; + } + } +} + +/* Implements the semantics for SSL_OptionSet(SSL_ENABLE_SSL3, on) described in + * ssl.h in the section "SSL version range setting API". + */ +static void +ssl_EnableSSL3(SSLVersionRange *vrange, PRBool on) +{ + if (on) { + /* don't turn it on if ssl3 disallowed by by policy */ + if (!ssl_VersionIsSupportedByPolicy(ssl_variant_stream, + SSL_LIBRARY_VERSION_3_0)) { + return; + } + } + if (SSL_ALL_VERSIONS_DISABLED(vrange)) { + if (on) { + vrange->min = SSL_LIBRARY_VERSION_3_0; + vrange->max = SSL_LIBRARY_VERSION_3_0; + } /* else don't change anything */ + return; + } + + if (on) { + /* Expand the range of enabled versions to include SSL 3.0. We know + * SSL 3.0 or some version of TLS is already enabled at this point, so + * we don't need to change vrange->max. + */ + vrange->min = SSL_LIBRARY_VERSION_3_0; + } else { + /* Disable SSL 3.0, leaving TLS unaffected. */ + if (vrange->max > SSL_LIBRARY_VERSION_3_0) { + vrange->min = PR_MAX(vrange->min, SSL_LIBRARY_VERSION_TLS_1_0); + } else { + /* Only SSL 3.0 was enabled, so now no versions are. */ + vrange->min = SSL_LIBRARY_VERSION_NONE; + vrange->max = SSL_LIBRARY_VERSION_NONE; + } + } +} + +SECStatus +SSL_OptionSet(PRFileDesc *fd, PRInt32 which, PRBool on) +{ + sslSocket *ss = ssl_FindSocket(fd); + SECStatus rv = SECSuccess; + PRBool holdingLocks; + + if (!ss) { + SSL_DBG(("%d: SSL[%d]: bad socket in Enable", SSL_GETPID(), fd)); + return SECFailure; + } + + holdingLocks = (!ss->opt.noLocks); + ssl_Get1stHandshakeLock(ss); + ssl_GetSSL3HandshakeLock(ss); + + switch (which) { + case SSL_SOCKS: + ss->opt.useSocks = PR_FALSE; + rv = PrepareSocket(ss); + if (on) { + PORT_SetError(SEC_ERROR_INVALID_ARGS); + rv = SECFailure; + } + break; + + case SSL_SECURITY: + ss->opt.useSecurity = on; + rv = PrepareSocket(ss); + break; + + case SSL_REQUEST_CERTIFICATE: + ss->opt.requestCertificate = on; + break; + + case SSL_REQUIRE_CERTIFICATE: + ss->opt.requireCertificate = on; + break; + + case SSL_HANDSHAKE_AS_CLIENT: + if (ss->opt.handshakeAsServer && on) { + PORT_SetError(SEC_ERROR_INVALID_ARGS); + rv = SECFailure; + break; + } + ss->opt.handshakeAsClient = on; + break; + + case SSL_HANDSHAKE_AS_SERVER: + if (ss->opt.handshakeAsClient && on) { + PORT_SetError(SEC_ERROR_INVALID_ARGS); + rv = SECFailure; + break; + } + ss->opt.handshakeAsServer = on; + break; + + case SSL_ENABLE_TLS: + if (IS_DTLS(ss)) { + if (on) { + PORT_SetError(SEC_ERROR_INVALID_ARGS); + rv = SECFailure; /* not allowed */ + } + break; + } + ssl_EnableTLS(&ss->vrange, on); + break; + + case SSL_ENABLE_SSL3: + if (IS_DTLS(ss)) { + if (on) { + PORT_SetError(SEC_ERROR_INVALID_ARGS); + rv = SECFailure; /* not allowed */ + } + break; + } + ssl_EnableSSL3(&ss->vrange, on); + break; + + case SSL_ENABLE_SSL2: + case SSL_V2_COMPATIBLE_HELLO: + /* We no longer support SSL v2. + * However, if an old application requests to disable SSL v2, + * we shouldn't fail. + */ + if (on) { + PORT_SetError(SEC_ERROR_INVALID_ARGS); + rv = SECFailure; + } + break; + + case SSL_NO_CACHE: + ss->opt.noCache = on; + break; + + case SSL_ENABLE_FDX: + if (on && ss->opt.noLocks) { + PORT_SetError(SEC_ERROR_INVALID_ARGS); + rv = SECFailure; + } + ss->opt.fdx = on; + break; + + case SSL_ROLLBACK_DETECTION: + ss->opt.detectRollBack = on; + break; + + case SSL_NO_STEP_DOWN: + break; + + case SSL_BYPASS_PKCS11: + break; + + case SSL_NO_LOCKS: + if (on && ss->opt.fdx) { + PORT_SetError(SEC_ERROR_INVALID_ARGS); + rv = SECFailure; + } + if (on && ssl_force_locks) + on = PR_FALSE; /* silent override */ + ss->opt.noLocks = on; + if (on) { + locksEverDisabled = PR_TRUE; + strcpy(lockStatus + LOCKSTATUS_OFFSET, "DISABLED."); + } else if (!holdingLocks) { + rv = ssl_MakeLocks(ss); + if (rv != SECSuccess) { + ss->opt.noLocks = PR_TRUE; + } + } + break; + + case SSL_ENABLE_SESSION_TICKETS: + ss->opt.enableSessionTickets = on; + break; + + case SSL_ENABLE_DEFLATE: + ss->opt.enableDeflate = on; + break; + + case SSL_ENABLE_RENEGOTIATION: + if (IS_DTLS(ss) && on != SSL_RENEGOTIATE_NEVER) { + PORT_SetError(SEC_ERROR_INVALID_ARGS); + rv = SECFailure; + break; + } + ss->opt.enableRenegotiation = on; + break; + + case SSL_REQUIRE_SAFE_NEGOTIATION: + ss->opt.requireSafeNegotiation = on; + break; + + case SSL_ENABLE_FALSE_START: + ss->opt.enableFalseStart = on; + break; + + case SSL_CBC_RANDOM_IV: + ss->opt.cbcRandomIV = on; + break; + + case SSL_ENABLE_OCSP_STAPLING: + ss->opt.enableOCSPStapling = on; + break; + + case SSL_ENABLE_NPN: + break; + + case SSL_ENABLE_ALPN: + ss->opt.enableALPN = on; + break; + + case SSL_REUSE_SERVER_ECDHE_KEY: + ss->opt.reuseServerECDHEKey = on; + break; + + case SSL_ENABLE_FALLBACK_SCSV: + ss->opt.enableFallbackSCSV = on; + break; + + case SSL_ENABLE_SERVER_DHE: + ss->opt.enableServerDhe = on; + break; + + case SSL_ENABLE_EXTENDED_MASTER_SECRET: + ss->opt.enableExtendedMS = on; + break; + + case SSL_ENABLE_SIGNED_CERT_TIMESTAMPS: + ss->opt.enableSignedCertTimestamps = on; + break; + + case SSL_REQUIRE_DH_NAMED_GROUPS: + ss->opt.requireDHENamedGroups = on; + break; + + case SSL_ENABLE_0RTT_DATA: + ss->opt.enable0RttData = on; + break; + + default: + PORT_SetError(SEC_ERROR_INVALID_ARGS); + rv = SECFailure; + } + + /* We can't use the macros for releasing the locks here, + * because ss->opt.noLocks might have changed just above. + * We must release these locks (monitors) here, if we aquired them above, + * regardless of the current value of ss->opt.noLocks. + */ + if (holdingLocks) { + PZ_ExitMonitor((ss)->ssl3HandshakeLock); + PZ_ExitMonitor((ss)->firstHandshakeLock); + } + + return rv; +} + +SECStatus +SSL_OptionGet(PRFileDesc *fd, PRInt32 which, PRBool *pOn) +{ + sslSocket *ss = ssl_FindSocket(fd); + SECStatus rv = SECSuccess; + PRBool on = PR_FALSE; + + if (!pOn) { + PORT_SetError(SEC_ERROR_INVALID_ARGS); + return SECFailure; + } + if (!ss) { + SSL_DBG(("%d: SSL[%d]: bad socket in Enable", SSL_GETPID(), fd)); + *pOn = PR_FALSE; + return SECFailure; + } + + ssl_Get1stHandshakeLock(ss); + ssl_GetSSL3HandshakeLock(ss); + + switch (which) { + case SSL_SOCKS: + on = PR_FALSE; + break; + case SSL_SECURITY: + on = ss->opt.useSecurity; + break; + case SSL_REQUEST_CERTIFICATE: + on = ss->opt.requestCertificate; + break; + case SSL_REQUIRE_CERTIFICATE: + on = ss->opt.requireCertificate; + break; + case SSL_HANDSHAKE_AS_CLIENT: + on = ss->opt.handshakeAsClient; + break; + case SSL_HANDSHAKE_AS_SERVER: + on = ss->opt.handshakeAsServer; + break; + case SSL_ENABLE_TLS: + on = ss->vrange.max >= SSL_LIBRARY_VERSION_TLS_1_0; + break; + case SSL_ENABLE_SSL3: + on = ss->vrange.min == SSL_LIBRARY_VERSION_3_0; + break; + case SSL_ENABLE_SSL2: + case SSL_V2_COMPATIBLE_HELLO: + on = PR_FALSE; + break; + case SSL_NO_CACHE: + on = ss->opt.noCache; + break; + case SSL_ENABLE_FDX: + on = ss->opt.fdx; + break; + case SSL_ROLLBACK_DETECTION: + on = ss->opt.detectRollBack; + break; + case SSL_NO_STEP_DOWN: + on = PR_FALSE; + break; + case SSL_BYPASS_PKCS11: + on = PR_FALSE; + break; + case SSL_NO_LOCKS: + on = ss->opt.noLocks; + break; + case SSL_ENABLE_SESSION_TICKETS: + on = ss->opt.enableSessionTickets; + break; + case SSL_ENABLE_DEFLATE: + on = ss->opt.enableDeflate; + break; + case SSL_ENABLE_RENEGOTIATION: + on = ss->opt.enableRenegotiation; + break; + case SSL_REQUIRE_SAFE_NEGOTIATION: + on = ss->opt.requireSafeNegotiation; + break; + case SSL_ENABLE_FALSE_START: + on = ss->opt.enableFalseStart; + break; + case SSL_CBC_RANDOM_IV: + on = ss->opt.cbcRandomIV; + break; + case SSL_ENABLE_OCSP_STAPLING: + on = ss->opt.enableOCSPStapling; + break; + case SSL_ENABLE_NPN: + on = ss->opt.enableNPN; + break; + case SSL_ENABLE_ALPN: + on = ss->opt.enableALPN; + break; + case SSL_REUSE_SERVER_ECDHE_KEY: + on = ss->opt.reuseServerECDHEKey; + break; + case SSL_ENABLE_FALLBACK_SCSV: + on = ss->opt.enableFallbackSCSV; + break; + case SSL_ENABLE_SERVER_DHE: + on = ss->opt.enableServerDhe; + break; + case SSL_ENABLE_EXTENDED_MASTER_SECRET: + on = ss->opt.enableExtendedMS; + break; + case SSL_ENABLE_SIGNED_CERT_TIMESTAMPS: + on = ss->opt.enableSignedCertTimestamps; + break; + case SSL_REQUIRE_DH_NAMED_GROUPS: + on = ss->opt.requireDHENamedGroups; + break; + case SSL_ENABLE_0RTT_DATA: + on = ss->opt.enable0RttData; + break; + default: + PORT_SetError(SEC_ERROR_INVALID_ARGS); + rv = SECFailure; + } + + ssl_ReleaseSSL3HandshakeLock(ss); + ssl_Release1stHandshakeLock(ss); + + *pOn = on; + return rv; +} + +SECStatus +SSL_OptionGetDefault(PRInt32 which, PRBool *pOn) +{ + SECStatus rv = SECSuccess; + PRBool on = PR_FALSE; + + if (!pOn) { + PORT_SetError(SEC_ERROR_INVALID_ARGS); + return SECFailure; + } + + ssl_SetDefaultsFromEnvironment(); + + switch (which) { + case SSL_SOCKS: + on = PR_FALSE; + break; + case SSL_SECURITY: + on = ssl_defaults.useSecurity; + break; + case SSL_REQUEST_CERTIFICATE: + on = ssl_defaults.requestCertificate; + break; + case SSL_REQUIRE_CERTIFICATE: + on = ssl_defaults.requireCertificate; + break; + case SSL_HANDSHAKE_AS_CLIENT: + on = ssl_defaults.handshakeAsClient; + break; + case SSL_HANDSHAKE_AS_SERVER: + on = ssl_defaults.handshakeAsServer; + break; + case SSL_ENABLE_TLS: + on = versions_defaults_stream.max >= SSL_LIBRARY_VERSION_TLS_1_0; + break; + case SSL_ENABLE_SSL3: + on = versions_defaults_stream.min == SSL_LIBRARY_VERSION_3_0; + break; + case SSL_ENABLE_SSL2: + case SSL_V2_COMPATIBLE_HELLO: + on = PR_FALSE; + break; + case SSL_NO_CACHE: + on = ssl_defaults.noCache; + break; + case SSL_ENABLE_FDX: + on = ssl_defaults.fdx; + break; + case SSL_ROLLBACK_DETECTION: + on = ssl_defaults.detectRollBack; + break; + case SSL_NO_STEP_DOWN: + on = PR_FALSE; + break; + case SSL_BYPASS_PKCS11: + on = PR_FALSE; + break; + case SSL_NO_LOCKS: + on = ssl_defaults.noLocks; + break; + case SSL_ENABLE_SESSION_TICKETS: + on = ssl_defaults.enableSessionTickets; + break; + case SSL_ENABLE_DEFLATE: + on = ssl_defaults.enableDeflate; + break; + case SSL_ENABLE_RENEGOTIATION: + on = ssl_defaults.enableRenegotiation; + break; + case SSL_REQUIRE_SAFE_NEGOTIATION: + on = ssl_defaults.requireSafeNegotiation; + break; + case SSL_ENABLE_FALSE_START: + on = ssl_defaults.enableFalseStart; + break; + case SSL_CBC_RANDOM_IV: + on = ssl_defaults.cbcRandomIV; + break; + case SSL_ENABLE_OCSP_STAPLING: + on = ssl_defaults.enableOCSPStapling; + break; + case SSL_ENABLE_NPN: + on = ssl_defaults.enableNPN; + break; + case SSL_ENABLE_ALPN: + on = ssl_defaults.enableALPN; + break; + case SSL_REUSE_SERVER_ECDHE_KEY: + on = ssl_defaults.reuseServerECDHEKey; + break; + case SSL_ENABLE_FALLBACK_SCSV: + on = ssl_defaults.enableFallbackSCSV; + break; + case SSL_ENABLE_SERVER_DHE: + on = ssl_defaults.enableServerDhe; + break; + case SSL_ENABLE_EXTENDED_MASTER_SECRET: + on = ssl_defaults.enableExtendedMS; + break; + case SSL_ENABLE_SIGNED_CERT_TIMESTAMPS: + on = ssl_defaults.enableSignedCertTimestamps; + break; + case SSL_ENABLE_0RTT_DATA: + on = ssl_defaults.enable0RttData; + break; + default: + PORT_SetError(SEC_ERROR_INVALID_ARGS); + rv = SECFailure; + } + + *pOn = on; + return rv; +} + +/* XXX Use Global Lock to protect this stuff. */ +SECStatus +SSL_EnableDefault(int which, PRBool on) +{ + return SSL_OptionSetDefault(which, on); +} + +SECStatus +SSL_OptionSetDefault(PRInt32 which, PRBool on) +{ + SECStatus status = ssl_Init(); + + if (status != SECSuccess) { + return status; + } + + ssl_SetDefaultsFromEnvironment(); + + switch (which) { + case SSL_SOCKS: + ssl_defaults.useSocks = PR_FALSE; + if (on) { + PORT_SetError(SEC_ERROR_INVALID_ARGS); + return SECFailure; + } + break; + + case SSL_SECURITY: + ssl_defaults.useSecurity = on; + break; + + case SSL_REQUEST_CERTIFICATE: + ssl_defaults.requestCertificate = on; + break; + + case SSL_REQUIRE_CERTIFICATE: + ssl_defaults.requireCertificate = on; + break; + + case SSL_HANDSHAKE_AS_CLIENT: + if (ssl_defaults.handshakeAsServer && on) { + PORT_SetError(SEC_ERROR_INVALID_ARGS); + return SECFailure; + } + ssl_defaults.handshakeAsClient = on; + break; + + case SSL_HANDSHAKE_AS_SERVER: + if (ssl_defaults.handshakeAsClient && on) { + PORT_SetError(SEC_ERROR_INVALID_ARGS); + return SECFailure; + } + ssl_defaults.handshakeAsServer = on; + break; + + case SSL_ENABLE_TLS: + ssl_EnableTLS(&versions_defaults_stream, on); + break; + + case SSL_ENABLE_SSL3: + ssl_EnableSSL3(&versions_defaults_stream, on); + break; + + case SSL_ENABLE_SSL2: + case SSL_V2_COMPATIBLE_HELLO: + /* We no longer support SSL v2. + * However, if an old application requests to disable SSL v2, + * we shouldn't fail. + */ + if (on) { + PORT_SetError(SEC_ERROR_INVALID_ARGS); + return SECFailure; + } + break; + + case SSL_NO_CACHE: + ssl_defaults.noCache = on; + break; + + case SSL_ENABLE_FDX: + if (on && ssl_defaults.noLocks) { + PORT_SetError(SEC_ERROR_INVALID_ARGS); + return SECFailure; + } + ssl_defaults.fdx = on; + break; + + case SSL_ROLLBACK_DETECTION: + ssl_defaults.detectRollBack = on; + break; + + case SSL_NO_STEP_DOWN: + break; + + case SSL_BYPASS_PKCS11: + break; + + case SSL_NO_LOCKS: + if (on && ssl_defaults.fdx) { + PORT_SetError(SEC_ERROR_INVALID_ARGS); + return SECFailure; + } + if (on && ssl_force_locks) + on = PR_FALSE; /* silent override */ + ssl_defaults.noLocks = on; + if (on) { + locksEverDisabled = PR_TRUE; + strcpy(lockStatus + LOCKSTATUS_OFFSET, "DISABLED."); + } + break; + + case SSL_ENABLE_SESSION_TICKETS: + ssl_defaults.enableSessionTickets = on; + break; + + case SSL_ENABLE_DEFLATE: + ssl_defaults.enableDeflate = on; + break; + + case SSL_ENABLE_RENEGOTIATION: + ssl_defaults.enableRenegotiation = on; + break; + + case SSL_REQUIRE_SAFE_NEGOTIATION: + ssl_defaults.requireSafeNegotiation = on; + break; + + case SSL_ENABLE_FALSE_START: + ssl_defaults.enableFalseStart = on; + break; + + case SSL_CBC_RANDOM_IV: + ssl_defaults.cbcRandomIV = on; + break; + + case SSL_ENABLE_OCSP_STAPLING: + ssl_defaults.enableOCSPStapling = on; + break; + + case SSL_ENABLE_NPN: + break; + + case SSL_ENABLE_ALPN: + ssl_defaults.enableALPN = on; + break; + + case SSL_REUSE_SERVER_ECDHE_KEY: + ssl_defaults.reuseServerECDHEKey = on; + break; + + case SSL_ENABLE_FALLBACK_SCSV: + ssl_defaults.enableFallbackSCSV = on; + break; + + case SSL_ENABLE_SERVER_DHE: + ssl_defaults.enableServerDhe = on; + break; + + case SSL_ENABLE_EXTENDED_MASTER_SECRET: + ssl_defaults.enableExtendedMS = on; + break; + + case SSL_ENABLE_SIGNED_CERT_TIMESTAMPS: + ssl_defaults.enableSignedCertTimestamps = on; + break; + + case SSL_ENABLE_0RTT_DATA: + ssl_defaults.enable0RttData = on; + break; + + default: + PORT_SetError(SEC_ERROR_INVALID_ARGS); + return SECFailure; + } + return SECSuccess; +} + +/* function tells us if the cipher suite is one that we no longer support. */ +static PRBool +ssl_IsRemovedCipherSuite(PRInt32 suite) +{ + switch (suite) { + case SSL_FORTEZZA_DMS_WITH_NULL_SHA: + case SSL_FORTEZZA_DMS_WITH_FORTEZZA_CBC_SHA: + case SSL_FORTEZZA_DMS_WITH_RC4_128_SHA: + return PR_TRUE; + default: + return PR_FALSE; + } +} + +/* Part of the public NSS API. + * Since this is a global (not per-socket) setting, we cannot use the + * HandshakeLock to protect this. Probably want a global lock. + */ +SECStatus +SSL_SetPolicy(long which, int policy) +{ + if (ssl_IsRemovedCipherSuite(which)) + return SECSuccess; + return SSL_CipherPolicySet(which, policy); +} + +SECStatus +ssl_CipherPolicySet(PRInt32 which, PRInt32 policy) +{ + SECStatus rv = SECSuccess; + + if (ssl_IsRemovedCipherSuite(which)) { + rv = SECSuccess; + } else { + rv = ssl3_SetPolicy((ssl3CipherSuite)which, policy); + } + return rv; +} +SECStatus +SSL_CipherPolicySet(PRInt32 which, PRInt32 policy) +{ + SECStatus rv = ssl_Init(); + + if (rv != SECSuccess) { + return rv; + } + return ssl_CipherPolicySet(which, policy); +} + +SECStatus +SSL_CipherPolicyGet(PRInt32 which, PRInt32 *oPolicy) +{ + SECStatus rv; + + if (!oPolicy) { + PORT_SetError(SEC_ERROR_INVALID_ARGS); + return SECFailure; + } + if (ssl_IsRemovedCipherSuite(which)) { + *oPolicy = SSL_NOT_ALLOWED; + rv = SECSuccess; + } else { + rv = ssl3_GetPolicy((ssl3CipherSuite)which, oPolicy); + } + return rv; +} + +/* Part of the public NSS API. + * Since this is a global (not per-socket) setting, we cannot use the + * HandshakeLock to protect this. Probably want a global lock. + * These changes have no effect on any sslSockets already created. + */ +SECStatus +SSL_EnableCipher(long which, PRBool enabled) +{ + if (ssl_IsRemovedCipherSuite(which)) + return SECSuccess; + return SSL_CipherPrefSetDefault(which, enabled); +} + +SECStatus +ssl_CipherPrefSetDefault(PRInt32 which, PRBool enabled) +{ + if (ssl_IsRemovedCipherSuite(which)) + return SECSuccess; + return ssl3_CipherPrefSetDefault((ssl3CipherSuite)which, enabled); +} + +SECStatus +SSL_CipherPrefSetDefault(PRInt32 which, PRBool enabled) +{ + SECStatus rv = ssl_Init(); + + if (rv != SECSuccess) { + return rv; + } + return ssl_CipherPrefSetDefault(which, enabled); +} + +SECStatus +SSL_CipherPrefGetDefault(PRInt32 which, PRBool *enabled) +{ + SECStatus rv; + + if (!enabled) { + PORT_SetError(SEC_ERROR_INVALID_ARGS); + return SECFailure; + } + if (ssl_IsRemovedCipherSuite(which)) { + *enabled = PR_FALSE; + rv = SECSuccess; + } else { + rv = ssl3_CipherPrefGetDefault((ssl3CipherSuite)which, enabled); + } + return rv; +} + +SECStatus +SSL_CipherPrefSet(PRFileDesc *fd, PRInt32 which, PRBool enabled) +{ + sslSocket *ss = ssl_FindSocket(fd); + + if (!ss) { + SSL_DBG(("%d: SSL[%d]: bad socket in CipherPrefSet", SSL_GETPID(), fd)); + return SECFailure; + } + if (ssl_IsRemovedCipherSuite(which)) + return SECSuccess; + return ssl3_CipherPrefSet(ss, (ssl3CipherSuite)which, enabled); +} + +SECStatus +SSL_CipherPrefGet(PRFileDesc *fd, PRInt32 which, PRBool *enabled) +{ + SECStatus rv; + sslSocket *ss = ssl_FindSocket(fd); + + if (!enabled) { + PORT_SetError(SEC_ERROR_INVALID_ARGS); + return SECFailure; + } + if (!ss) { + SSL_DBG(("%d: SSL[%d]: bad socket in CipherPrefGet", SSL_GETPID(), fd)); + *enabled = PR_FALSE; + return SECFailure; + } + if (ssl_IsRemovedCipherSuite(which)) { + *enabled = PR_FALSE; + rv = SECSuccess; + } else { + rv = ssl3_CipherPrefGet(ss, (ssl3CipherSuite)which, enabled); + } + return rv; +} + +SECStatus +NSS_SetDomesticPolicy(void) +{ + SECStatus status = SECSuccess; + const PRUint16 *cipher; + SECStatus rv; + PRUint32 policy; + + /* If we've already defined some policy oids, skip changing them */ + rv = NSS_GetAlgorithmPolicy(SEC_OID_APPLY_SSL_POLICY, &policy); + if ((rv == SECSuccess) && (policy & NSS_USE_POLICY_IN_SSL)) { + return ssl_Init(); /* make sure the policies have bee loaded */ + } + + for (cipher = SSL_ImplementedCiphers; *cipher != 0; ++cipher) { + status = SSL_SetPolicy(*cipher, SSL_ALLOWED); + if (status != SECSuccess) + break; + } + return status; +} + +SECStatus +NSS_SetExportPolicy(void) +{ + return NSS_SetDomesticPolicy(); +} + +SECStatus +NSS_SetFrancePolicy(void) +{ + return NSS_SetDomesticPolicy(); +} + +SECStatus +SSL_NamedGroupConfig(PRFileDesc *fd, const SSLNamedGroup *groups, + unsigned int numGroups) +{ + unsigned int i; + unsigned int j = 0; + sslSocket *ss = ssl_FindSocket(fd); + + if (!ss) { + PORT_SetError(SEC_ERROR_NOT_INITIALIZED); + return SECFailure; + } + + if (!groups) { + PORT_SetError(SEC_ERROR_INVALID_ARGS); + return SECFailure; + } + if (numGroups > SSL_NAMED_GROUP_COUNT) { + PORT_SetError(SEC_ERROR_INVALID_ARGS); + return SECFailure; + } + + memset((void *)ss->namedGroupPreferences, 0, + sizeof(ss->namedGroupPreferences)); + for (i = 0; i < numGroups; ++i) { + const sslNamedGroupDef *groupDef = ssl_LookupNamedGroup(groups[i]); + if (!ssl_NamedGroupEnabled(ss, groupDef)) { + ss->namedGroupPreferences[j++] = groupDef; + } + } + + return SECSuccess; +} + +SECStatus +SSL_DHEGroupPrefSet(PRFileDesc *fd, const SSLDHEGroupType *groups, + PRUint16 num_groups) +{ + sslSocket *ss; + const SSLDHEGroupType *list; + unsigned int count; + int i, k, j; + const sslNamedGroupDef *enabled[SSL_NAMED_GROUP_COUNT] = { 0 }; + static const SSLDHEGroupType default_dhe_groups[] = { + ssl_ff_dhe_2048_group + }; + + if ((num_groups && !groups) || (!num_groups && groups) || + num_groups > SSL_NAMED_GROUP_COUNT) { + PORT_SetError(SEC_ERROR_INVALID_ARGS); + return SECFailure; + } + + ss = ssl_FindSocket(fd); + if (!ss) { + SSL_DBG(("%d: SSL[%d]: bad socket in SSL_DHEGroupPrefSet", SSL_GETPID(), fd)); + return SECFailure; + } + + if (groups) { + list = groups; + count = num_groups; + } else { + list = default_dhe_groups; + count = PR_ARRAY_SIZE(default_dhe_groups); + } + + /* save enabled ec groups and clear ss->namedGroupPreferences */ + k = 0; + for (i = 0; i < SSL_NAMED_GROUP_COUNT; ++i) { + if (ss->namedGroupPreferences[i] && + ss->namedGroupPreferences[i]->keaType != ssl_kea_dh) { + enabled[k++] = ss->namedGroupPreferences[i]; + } + ss->namedGroupPreferences[i] = NULL; + } + + ss->ssl3.dhePreferredGroup = NULL; + for (i = 0; i < count; ++i) { + PRBool duplicate = PR_FALSE; + SSLNamedGroup name; + const sslNamedGroupDef *groupDef; + switch (list[i]) { + case ssl_ff_dhe_2048_group: + name = ssl_grp_ffdhe_2048; + break; + case ssl_ff_dhe_3072_group: + name = ssl_grp_ffdhe_3072; + break; + case ssl_ff_dhe_4096_group: + name = ssl_grp_ffdhe_4096; + break; + case ssl_ff_dhe_6144_group: + name = ssl_grp_ffdhe_6144; + break; + case ssl_ff_dhe_8192_group: + name = ssl_grp_ffdhe_8192; + break; + default: + PORT_SetError(SEC_ERROR_INVALID_ARGS); + return SECFailure; + } + groupDef = ssl_LookupNamedGroup(name); + PORT_Assert(groupDef); + if (!ss->ssl3.dhePreferredGroup) { + ss->ssl3.dhePreferredGroup = groupDef; + } + PORT_Assert(k < SSL_NAMED_GROUP_COUNT); + for (j = 0; j < k; ++j) { + /* skip duplicates */ + if (enabled[j] == groupDef) { + duplicate = PR_TRUE; + break; + } + } + if (!duplicate) { + enabled[k++] = groupDef; + } + } + for (i = 0; i < k; ++i) { + ss->namedGroupPreferences[i] = enabled[i]; + } + + return SECSuccess; +} + +PRCallOnceType gWeakDHParamsRegisterOnce; +int gWeakDHParamsRegisterError; + +PRCallOnceType gWeakDHParamsOnce; +int gWeakDHParamsError; +/* As our code allocates type PQGParams, we'll keep it around, + * even though we only make use of it's parameters through gWeakDHParam. */ +static PQGParams *gWeakParamsPQG; +static ssl3DHParams *gWeakDHParams; +#define WEAK_DHE_SIZE 1024 + +static PRStatus +ssl3_CreateWeakDHParams(void) +{ + PQGVerify *vfy; + SECStatus rv, passed; + + PORT_Assert(!gWeakDHParams && !gWeakParamsPQG); + + rv = PK11_PQG_ParamGenV2(WEAK_DHE_SIZE, 160, 64 /*maximum seed that will work*/, + &gWeakParamsPQG, &vfy); + if (rv != SECSuccess) { + gWeakDHParamsError = PORT_GetError(); + return PR_FAILURE; + } + + rv = PK11_PQG_VerifyParams(gWeakParamsPQG, vfy, &passed); + if (rv != SECSuccess || passed != SECSuccess) { + SSL_DBG(("%d: PK11_PQG_VerifyParams failed in ssl3_CreateWeakDHParams", + SSL_GETPID())); + gWeakDHParamsError = PORT_GetError(); + return PR_FAILURE; + } + + gWeakDHParams = PORT_ArenaNew(gWeakParamsPQG->arena, ssl3DHParams); + if (!gWeakDHParams) { + gWeakDHParamsError = PORT_GetError(); + return PR_FAILURE; + } + + gWeakDHParams->name = ssl_grp_ffdhe_custom; + gWeakDHParams->prime.data = gWeakParamsPQG->prime.data; + gWeakDHParams->prime.len = gWeakParamsPQG->prime.len; + gWeakDHParams->base.data = gWeakParamsPQG->base.data; + gWeakDHParams->base.len = gWeakParamsPQG->base.len; + + PK11_PQG_DestroyVerify(vfy); + return PR_SUCCESS; +} + +static SECStatus +ssl3_WeakDHParamsShutdown(void *appData, void *nssData) +{ + if (gWeakParamsPQG) { + PK11_PQG_DestroyParams(gWeakParamsPQG); + gWeakParamsPQG = NULL; + gWeakDHParams = NULL; + } + return SECSuccess; +} + +static PRStatus +ssl3_WeakDHParamsRegisterShutdown(void) +{ + SECStatus rv; + rv = NSS_RegisterShutdown(ssl3_WeakDHParamsShutdown, NULL); + if (rv != SECSuccess) { + gWeakDHParamsRegisterError = PORT_GetError(); + } + return (PRStatus)rv; +} + +/* global init strategy inspired by ssl3_CreateECDHEphemeralKeys */ +SECStatus +SSL_EnableWeakDHEPrimeGroup(PRFileDesc *fd, PRBool enabled) +{ + sslSocket *ss; + PRStatus status; + + if (enabled) { + status = PR_CallOnce(&gWeakDHParamsRegisterOnce, + ssl3_WeakDHParamsRegisterShutdown); + if (status != PR_SUCCESS) { + PORT_SetError(gWeakDHParamsRegisterError); + return SECFailure; + } + + status = PR_CallOnce(&gWeakDHParamsOnce, ssl3_CreateWeakDHParams); + if (status != PR_SUCCESS) { + PORT_SetError(gWeakDHParamsError); + return SECFailure; + } + } + + if (!fd) + return SECSuccess; + + ss = ssl_FindSocket(fd); + if (!ss) { + SSL_DBG(("%d: SSL[%d]: bad socket in SSL_DHEGroupPrefSet", SSL_GETPID(), fd)); + return SECFailure; + } + + ss->ssl3.dheWeakGroupEnabled = enabled; + return SECSuccess; +} + +#include "dhe-param.c" + +const ssl3DHParams * +ssl_GetDHEParams(const sslNamedGroupDef *groupDef) +{ + switch (groupDef->name) { + case ssl_grp_ffdhe_2048: + return &ff_dhe_2048_params; + case ssl_grp_ffdhe_3072: + return &ff_dhe_3072_params; + case ssl_grp_ffdhe_4096: + return &ff_dhe_4096_params; + case ssl_grp_ffdhe_6144: + return &ff_dhe_6144_params; + case ssl_grp_ffdhe_8192: + return &ff_dhe_8192_params; + case ssl_grp_ffdhe_custom: + PORT_Assert(gWeakDHParams); + return gWeakDHParams; + default: + PORT_Assert(0); + } + return NULL; +} + +/* This validates dh_Ys against the group prime. */ +PRBool +ssl_IsValidDHEShare(const SECItem *dh_p, const SECItem *dh_Ys) +{ + unsigned int size_p = SECKEY_BigIntegerBitLength(dh_p); + unsigned int size_y = SECKEY_BigIntegerBitLength(dh_Ys); + unsigned int commonPart; + int cmp; + + if (dh_p->len == 0 || dh_Ys->len == 0) { + return PR_FALSE; + } + /* Check that the prime is at least odd. */ + if ((dh_p->data[dh_p->len - 1] & 0x01) == 0) { + return PR_FALSE; + } + /* dh_Ys can't be 1, or bigger than dh_p. */ + if (size_y <= 1 || size_y > size_p) { + return PR_FALSE; + } + /* If dh_Ys is shorter, then it's definitely smaller than p-1. */ + if (size_y < size_p) { + return PR_TRUE; + } + + /* Compare the common part of each, minus the final octet. */ + commonPart = (size_p + 7) / 8; + PORT_Assert(commonPart <= dh_Ys->len); + PORT_Assert(commonPart <= dh_p->len); + cmp = PORT_Memcmp(dh_Ys->data + dh_Ys->len - commonPart, + dh_p->data + dh_p->len - commonPart, commonPart - 1); + if (cmp < 0) { + return PR_TRUE; + } + if (cmp > 0) { + return PR_FALSE; + } + + /* The last octet of the prime is the only thing that is different and that + * has to be two greater than the share, otherwise we have Ys == p - 1, + * and that means small subgroups. */ + if (dh_Ys->data[dh_Ys->len - 1] >= (dh_p->data[dh_p->len - 1] - 1)) { + return PR_FALSE; + } + + return PR_TRUE; +} + +/* Checks that the provided DH parameters match those in one of the named groups + * that we have enabled. The groups are defined in dhe-param.c and are those + * defined in Appendix A of draft-ietf-tls-negotiated-ff-dhe. + * + * |groupDef| and |dhParams| are optional outparams that identify the group and + * its parameters respectively (if this is successful). */ +SECStatus +ssl_ValidateDHENamedGroup(sslSocket *ss, + const SECItem *dh_p, + const SECItem *dh_g, + const sslNamedGroupDef **groupDef, + const ssl3DHParams **dhParams) +{ + unsigned int i; + + for (i = 0; i < SSL_NAMED_GROUP_COUNT; ++i) { + const ssl3DHParams *params; + if (!ss->namedGroupPreferences[i]) { + continue; + } + if (ss->namedGroupPreferences[i]->keaType != ssl_kea_dh) { + continue; + } + + params = ssl_GetDHEParams(ss->namedGroupPreferences[i]); + PORT_Assert(params); + if (SECITEM_ItemsAreEqual(¶ms->prime, dh_p)) { + if (!SECITEM_ItemsAreEqual(¶ms->base, dh_g)) { + return SECFailure; + } + if (groupDef) + *groupDef = ss->namedGroupPreferences[i]; + if (dhParams) + *dhParams = params; + return SECSuccess; + } + } + + return SECFailure; +} + +/* Ensure DH parameters have been selected. This just picks the first enabled + * FFDHE group in ssl_named_groups, or the weak one if it was enabled. */ +SECStatus +ssl_SelectDHEGroup(sslSocket *ss, const sslNamedGroupDef **groupDef) +{ + unsigned int i; + static const sslNamedGroupDef weak_group_def = { + ssl_grp_ffdhe_custom, WEAK_DHE_SIZE, ssl_kea_dh, + SEC_OID_TLS_DHE_CUSTOM, PR_TRUE + }; + + /* Only select weak groups in TLS 1.2 and earlier, but not if the client has + * indicated that it supports an FFDHE named group. */ + if (ss->ssl3.dheWeakGroupEnabled && + ss->version < SSL_LIBRARY_VERSION_TLS_1_3 && + !ss->xtnData.peerSupportsFfdheGroups) { + *groupDef = &weak_group_def; + return SECSuccess; + } + if (ss->ssl3.dhePreferredGroup && + ssl_NamedGroupEnabled(ss, ss->ssl3.dhePreferredGroup)) { + *groupDef = ss->ssl3.dhePreferredGroup; + return SECSuccess; + } + for (i = 0; i < SSL_NAMED_GROUP_COUNT; ++i) { + if (ss->namedGroupPreferences[i] && + ss->namedGroupPreferences[i]->keaType == ssl_kea_dh) { + *groupDef = ss->namedGroupPreferences[i]; + return SECSuccess; + } + } + + *groupDef = NULL; + PORT_SetError(SSL_ERROR_NO_CYPHER_OVERLAP); + return SECFailure; +} + +/* LOCKS ??? XXX */ +static PRFileDesc * +ssl_ImportFD(PRFileDesc *model, PRFileDesc *fd, SSLProtocolVariant variant) +{ + sslSocket *ns = NULL; + PRStatus rv; + PRNetAddr addr; + SECStatus status = ssl_Init(); + + if (status != SECSuccess) { + return NULL; + } + + if (model == NULL) { + /* Just create a default socket if we're given NULL for the model */ + ns = ssl_NewSocket((PRBool)(!ssl_defaults.noLocks), variant); + } else { + sslSocket *ss = ssl_FindSocket(model); + if (ss == NULL || ss->protocolVariant != variant) { + SSL_DBG(("%d: SSL[%d]: bad model socket in ssl_ImportFD", + SSL_GETPID(), model)); + return NULL; + } + ns = ssl_DupSocket(ss); + } + if (ns == NULL) + return NULL; + + rv = ssl_PushIOLayer(ns, fd, PR_TOP_IO_LAYER); + if (rv != PR_SUCCESS) { + ssl_FreeSocket(ns); + PORT_SetError(SEC_ERROR_LIBRARY_FAILURE); + return NULL; + } +#if defined(DEBUG) || defined(FORCE_PR_ASSERT) + { + sslSocket *ss = ssl_FindSocket(fd); + PORT_Assert(ss == ns); + } +#endif + ns->TCPconnected = (PR_SUCCESS == ssl_DefGetpeername(ns, &addr)); + return fd; +} + +PRFileDesc * +SSL_ImportFD(PRFileDesc *model, PRFileDesc *fd) +{ + return ssl_ImportFD(model, fd, ssl_variant_stream); +} + +PRFileDesc * +DTLS_ImportFD(PRFileDesc *model, PRFileDesc *fd) +{ + return ssl_ImportFD(model, fd, ssl_variant_datagram); +} + +/* SSL_SetNextProtoCallback is used to select an application protocol + * for ALPN and NPN. For ALPN, this runs on the server; for NPN it + * runs on the client. */ +/* Note: The ALPN version doesn't allow for the use of a default, setting a + * status of SSL_NEXT_PROTO_NO_OVERLAP is treated as a failure. */ +SECStatus +SSL_SetNextProtoCallback(PRFileDesc *fd, SSLNextProtoCallback callback, + void *arg) +{ + sslSocket *ss = ssl_FindSocket(fd); + + if (!ss) { + SSL_DBG(("%d: SSL[%d]: bad socket in SSL_SetNextProtoCallback", SSL_GETPID(), + fd)); + return SECFailure; + } + + ssl_GetSSL3HandshakeLock(ss); + ss->nextProtoCallback = callback; + ss->nextProtoArg = arg; + ssl_ReleaseSSL3HandshakeLock(ss); + + return SECSuccess; +} + +/* ssl_NextProtoNegoCallback is set as an ALPN/NPN callback when + * SSL_SetNextProtoNego is used. + */ +static SECStatus +ssl_NextProtoNegoCallback(void *arg, PRFileDesc *fd, + const unsigned char *protos, unsigned int protos_len, + unsigned char *protoOut, unsigned int *protoOutLen, + unsigned int protoMaxLen) +{ + unsigned int i, j; + const unsigned char *result; + sslSocket *ss = ssl_FindSocket(fd); + + if (!ss) { + SSL_DBG(("%d: SSL[%d]: bad socket in ssl_NextProtoNegoCallback", + SSL_GETPID(), fd)); + return SECFailure; + } + + /* For each protocol in server preference, see if we support it. */ + for (i = 0; i < protos_len;) { + for (j = 0; j < ss->opt.nextProtoNego.len;) { + if (protos[i] == ss->opt.nextProtoNego.data[j] && + PORT_Memcmp(&protos[i + 1], &ss->opt.nextProtoNego.data[j + 1], + protos[i]) == 0) { + /* We found a match. */ + ss->xtnData.nextProtoState = SSL_NEXT_PROTO_NEGOTIATED; + result = &protos[i]; + goto found; + } + j += 1 + (unsigned int)ss->opt.nextProtoNego.data[j]; + } + i += 1 + (unsigned int)protos[i]; + } + + /* The other side supports the extension, and either doesn't have any + * protocols configured, or none of its options match ours. In this case we + * request our favoured protocol. */ + /* This will be treated as a failure for ALPN. */ + ss->xtnData.nextProtoState = SSL_NEXT_PROTO_NO_OVERLAP; + result = ss->opt.nextProtoNego.data; + +found: + if (protoMaxLen < result[0]) { + PORT_SetError(SEC_ERROR_OUTPUT_LEN); + return SECFailure; + } + memcpy(protoOut, result + 1, result[0]); + *protoOutLen = result[0]; + return SECSuccess; +} + +SECStatus +SSL_SetNextProtoNego(PRFileDesc *fd, const unsigned char *data, + unsigned int length) +{ + sslSocket *ss; + SECStatus rv; + SECItem dataItem = { siBuffer, (unsigned char *)data, length }; + + ss = ssl_FindSocket(fd); + if (!ss) { + SSL_DBG(("%d: SSL[%d]: bad socket in SSL_SetNextProtoNego", + SSL_GETPID(), fd)); + return SECFailure; + } + + if (ssl3_ValidateNextProtoNego(data, length) != SECSuccess) + return SECFailure; + + ssl_GetSSL3HandshakeLock(ss); + SECITEM_FreeItem(&ss->opt.nextProtoNego, PR_FALSE); + rv = SECITEM_CopyItem(NULL, &ss->opt.nextProtoNego, &dataItem); + ssl_ReleaseSSL3HandshakeLock(ss); + + if (rv != SECSuccess) + return rv; + + return SSL_SetNextProtoCallback(fd, ssl_NextProtoNegoCallback, NULL); +} + +SECStatus +SSL_GetNextProto(PRFileDesc *fd, SSLNextProtoState *state, unsigned char *buf, + unsigned int *bufLen, unsigned int bufLenMax) +{ + sslSocket *ss = ssl_FindSocket(fd); + + if (!ss) { + SSL_DBG(("%d: SSL[%d]: bad socket in SSL_GetNextProto", SSL_GETPID(), + fd)); + return SECFailure; + } + + if (!state || !buf || !bufLen) { + PORT_SetError(SEC_ERROR_INVALID_ARGS); + return SECFailure; + } + + *state = ss->xtnData.nextProtoState; + + if (ss->xtnData.nextProtoState != SSL_NEXT_PROTO_NO_SUPPORT && + ss->xtnData.nextProto.data) { + if (ss->xtnData.nextProto.len > bufLenMax) { + PORT_SetError(SEC_ERROR_OUTPUT_LEN); + return SECFailure; + } + PORT_Memcpy(buf, ss->xtnData.nextProto.data, ss->xtnData.nextProto.len); + *bufLen = ss->xtnData.nextProto.len; + } else { + *bufLen = 0; + } + + return SECSuccess; +} + +SECStatus +SSL_SetSRTPCiphers(PRFileDesc *fd, + const PRUint16 *ciphers, + unsigned int numCiphers) +{ + sslSocket *ss; + unsigned int i; + + ss = ssl_FindSocket(fd); + if (!ss || !IS_DTLS(ss)) { + SSL_DBG(("%d: SSL[%d]: bad socket in SSL_SetSRTPCiphers", + SSL_GETPID(), fd)); + PORT_SetError(SEC_ERROR_INVALID_ARGS); + return SECFailure; + } + + if (numCiphers > MAX_DTLS_SRTP_CIPHER_SUITES) { + PORT_SetError(SEC_ERROR_INVALID_ARGS); + return SECFailure; + } + + ss->ssl3.dtlsSRTPCipherCount = 0; + for (i = 0; i < numCiphers; i++) { + const PRUint16 *srtpCipher = srtpCiphers; + + while (*srtpCipher) { + if (ciphers[i] == *srtpCipher) + break; + srtpCipher++; + } + if (*srtpCipher) { + ss->ssl3.dtlsSRTPCiphers[ss->ssl3.dtlsSRTPCipherCount++] = + ciphers[i]; + } else { + SSL_DBG(("%d: SSL[%d]: invalid or unimplemented SRTP cipher " + "suite specified: 0x%04hx", + SSL_GETPID(), fd, + ciphers[i])); + } + } + + if (ss->ssl3.dtlsSRTPCipherCount == 0) { + PORT_SetError(SEC_ERROR_INVALID_ARGS); + return SECFailure; + } + + return SECSuccess; +} + +SECStatus +SSL_GetSRTPCipher(PRFileDesc *fd, PRUint16 *cipher) +{ + sslSocket *ss; + + ss = ssl_FindSocket(fd); + if (!ss) { + SSL_DBG(("%d: SSL[%d]: bad socket in SSL_GetSRTPCipher", + SSL_GETPID(), fd)); + PORT_SetError(SEC_ERROR_INVALID_ARGS); + return SECFailure; + } + + if (!ss->xtnData.dtlsSRTPCipherSuite) { + PORT_SetError(SEC_ERROR_INVALID_ARGS); + return SECFailure; + } + + *cipher = ss->xtnData.dtlsSRTPCipherSuite; + return SECSuccess; +} + +PRFileDesc * +SSL_ReconfigFD(PRFileDesc *model, PRFileDesc *fd) +{ + sslSocket *sm = NULL, *ss = NULL; + PRCList *cursor; + + if (model == NULL) { + PR_SetError(SEC_ERROR_INVALID_ARGS, 0); + return NULL; + } + sm = ssl_FindSocket(model); + if (sm == NULL) { + SSL_DBG(("%d: SSL[%d]: bad model socket in ssl_ReconfigFD", + SSL_GETPID(), model)); + return NULL; + } + ss = ssl_FindSocket(fd); + PORT_Assert(ss); + if (ss == NULL) { + PORT_SetError(SEC_ERROR_INVALID_ARGS); + return NULL; + } + + ss->opt = sm->opt; + ss->vrange = sm->vrange; + PORT_Memcpy(ss->cipherSuites, sm->cipherSuites, sizeof sm->cipherSuites); + PORT_Memcpy(ss->ssl3.dtlsSRTPCiphers, sm->ssl3.dtlsSRTPCiphers, + sizeof(PRUint16) * sm->ssl3.dtlsSRTPCipherCount); + ss->ssl3.dtlsSRTPCipherCount = sm->ssl3.dtlsSRTPCipherCount; + PORT_Memcpy(ss->ssl3.signatureSchemes, sm->ssl3.signatureSchemes, + sizeof(ss->ssl3.signatureSchemes[0]) * + sm->ssl3.signatureSchemeCount); + ss->ssl3.signatureSchemeCount = sm->ssl3.signatureSchemeCount; + ss->ssl3.downgradeCheckVersion = sm->ssl3.downgradeCheckVersion; + + if (!ss->opt.useSecurity) { + PORT_SetError(SEC_ERROR_INVALID_ARGS); + return NULL; + } + while (!PR_CLIST_IS_EMPTY(&ss->serverCerts)) { + cursor = PR_LIST_TAIL(&ss->serverCerts); + PR_REMOVE_LINK(cursor); + ssl_FreeServerCert((sslServerCert *)cursor); + } + for (cursor = PR_NEXT_LINK(&sm->serverCerts); + cursor != &sm->serverCerts; + cursor = PR_NEXT_LINK(cursor)) { + sslServerCert *sc = ssl_CopyServerCert((sslServerCert *)cursor); + if (!sc) + return NULL; + PR_APPEND_LINK(&sc->link, &ss->serverCerts); + } + + ssl_FreeEphemeralKeyPairs(ss); + for (cursor = PR_NEXT_LINK(&sm->ephemeralKeyPairs); + cursor != &sm->ephemeralKeyPairs; + cursor = PR_NEXT_LINK(cursor)) { + sslEphemeralKeyPair *mkp = (sslEphemeralKeyPair *)cursor; + sslEphemeralKeyPair *skp = ssl_CopyEphemeralKeyPair(mkp); + if (!skp) + return NULL; + PR_APPEND_LINK(&skp->link, &ss->ephemeralKeyPairs); + } + PORT_Memcpy((void *)ss->namedGroupPreferences, + sm->namedGroupPreferences, + sizeof(ss->namedGroupPreferences)); + ss->additionalShares = sm->additionalShares; + + /* copy trust anchor names */ + if (sm->ssl3.ca_list) { + if (ss->ssl3.ca_list) { + CERT_FreeDistNames(ss->ssl3.ca_list); + } + ss->ssl3.ca_list = CERT_DupDistNames(sm->ssl3.ca_list); + if (!ss->ssl3.ca_list) { + return NULL; + } + } + + if (sm->authCertificate) + ss->authCertificate = sm->authCertificate; + if (sm->authCertificateArg) + ss->authCertificateArg = sm->authCertificateArg; + if (sm->getClientAuthData) + ss->getClientAuthData = sm->getClientAuthData; + if (sm->getClientAuthDataArg) + ss->getClientAuthDataArg = sm->getClientAuthDataArg; + if (sm->sniSocketConfig) + ss->sniSocketConfig = sm->sniSocketConfig; + if (sm->sniSocketConfigArg) + ss->sniSocketConfigArg = sm->sniSocketConfigArg; + if (sm->handleBadCert) + ss->handleBadCert = sm->handleBadCert; + if (sm->badCertArg) + ss->badCertArg = sm->badCertArg; + if (sm->handshakeCallback) + ss->handshakeCallback = sm->handshakeCallback; + if (sm->handshakeCallbackData) + ss->handshakeCallbackData = sm->handshakeCallbackData; + if (sm->pkcs11PinArg) + ss->pkcs11PinArg = sm->pkcs11PinArg; + return fd; +} + +/* + * Get the user supplied range + */ +static SECStatus +ssl3_GetRangePolicy(SSLProtocolVariant protocolVariant, SSLVersionRange *prange) +{ + SECStatus rv; + PRUint32 policy; + PRInt32 option; + + /* only use policy constraints if we've set the apply ssl policy bit */ + rv = NSS_GetAlgorithmPolicy(SEC_OID_APPLY_SSL_POLICY, &policy); + if ((rv != SECSuccess) || !(policy & NSS_USE_POLICY_IN_SSL)) { + return SECFailure; + } + rv = NSS_OptionGet(VERSIONS_POLICY_MIN(protocolVariant), &option); + if (rv != SECSuccess) { + return rv; + } + prange->min = (PRUint16)option; + rv = NSS_OptionGet(VERSIONS_POLICY_MAX(protocolVariant), &option); + if (rv != SECSuccess) { + return rv; + } + prange->max = (PRUint16)option; + if (prange->max < prange->min) { + return SECFailure; /* don't accept an invalid policy */ + } + return SECSuccess; +} + +/* + * Constrain a single protocol variant's range based on the user policy + */ +static SECStatus +ssl3_ConstrainVariantRangeByPolicy(SSLProtocolVariant protocolVariant) +{ + SSLVersionRange vrange; + SSLVersionRange pvrange; + SECStatus rv; + + vrange = *VERSIONS_DEFAULTS(protocolVariant); + rv = ssl3_GetRangePolicy(protocolVariant, &pvrange); + if (rv != SECSuccess) { + return SECSuccess; /* we don't have any policy */ + } + vrange.min = PR_MAX(vrange.min, pvrange.min); + vrange.max = PR_MIN(vrange.max, pvrange.max); + if (vrange.max >= vrange.min) { + *VERSIONS_DEFAULTS(protocolVariant) = vrange; + } else { + /* there was no overlap, turn off range altogether */ + pvrange.min = pvrange.max = SSL_LIBRARY_VERSION_NONE; + *VERSIONS_DEFAULTS(protocolVariant) = pvrange; + } + return SECSuccess; +} + +static PRBool +ssl_VersionIsSupportedByPolicy(SSLProtocolVariant protocolVariant, + SSL3ProtocolVersion version) +{ + SSLVersionRange pvrange; + SECStatus rv; + + rv = ssl3_GetRangePolicy(protocolVariant, &pvrange); + if (rv == SECSuccess) { + if ((version > pvrange.max) || (version < pvrange.min)) { + return PR_FALSE; /* disallowed by policy */ + } + } + return PR_TRUE; +} + +/* + * This is called at SSL init time to constrain the existing range based + * on user supplied policy. + */ +SECStatus +ssl3_ConstrainRangeByPolicy(void) +{ + SECStatus rv; + rv = ssl3_ConstrainVariantRangeByPolicy(ssl_variant_stream); + if (rv != SECSuccess) { + return rv; + } + rv = ssl3_ConstrainVariantRangeByPolicy(ssl_variant_datagram); + if (rv != SECSuccess) { + return rv; + } + return SECSuccess; +} + +PRBool +ssl3_VersionIsSupported(SSLProtocolVariant protocolVariant, + SSL3ProtocolVersion version) +{ + if (!ssl_VersionIsSupportedByPolicy(protocolVariant, version)) { + return PR_FALSE; + } + switch (protocolVariant) { + case ssl_variant_stream: + return (version >= SSL_LIBRARY_VERSION_3_0 && + version <= SSL_LIBRARY_VERSION_MAX_SUPPORTED); + case ssl_variant_datagram: + return (version >= SSL_LIBRARY_VERSION_TLS_1_1 && + version <= SSL_LIBRARY_VERSION_MAX_SUPPORTED); + default: + /* Can't get here */ + PORT_Assert(PR_FALSE); + return PR_FALSE; + } +} + +/* Returns PR_TRUE if the given version range is valid and +** fully supported; otherwise, returns PR_FALSE. +*/ +static PRBool +ssl3_VersionRangeIsValid(SSLProtocolVariant protocolVariant, + const SSLVersionRange *vrange) +{ + return vrange && + vrange->min <= vrange->max && + ssl3_VersionIsSupported(protocolVariant, vrange->min) && + ssl3_VersionIsSupported(protocolVariant, vrange->max) && + (vrange->min > SSL_LIBRARY_VERSION_3_0 || + vrange->max < SSL_LIBRARY_VERSION_TLS_1_3); +} + +const SECItem * +SSL_PeerSignedCertTimestamps(PRFileDesc *fd) +{ + sslSocket *ss = ssl_FindSocket(fd); + + if (!ss) { + SSL_DBG(("%d: SSL[%d]: bad socket in SSL_PeerSignedCertTimestamps", + SSL_GETPID(), fd)); + return NULL; + } + + if (!ss->sec.ci.sid) { + PORT_SetError(SEC_ERROR_NOT_INITIALIZED); + return NULL; + } + + return &ss->sec.ci.sid->u.ssl3.signedCertTimestamps; +} + +SECStatus +SSL_VersionRangeGetSupported(SSLProtocolVariant protocolVariant, + SSLVersionRange *vrange) +{ + if (!vrange) { + PORT_SetError(SEC_ERROR_INVALID_ARGS); + return SECFailure; + } + + switch (protocolVariant) { + case ssl_variant_stream: + vrange->min = SSL_LIBRARY_VERSION_3_0; + vrange->max = SSL_LIBRARY_VERSION_MAX_SUPPORTED; + // We don't allow SSLv3 and TLSv1.3 together. + if (vrange->max == SSL_LIBRARY_VERSION_TLS_1_3) { + vrange->min = SSL_LIBRARY_VERSION_TLS_1_0; + } + break; + case ssl_variant_datagram: + vrange->min = SSL_LIBRARY_VERSION_TLS_1_1; + vrange->max = SSL_LIBRARY_VERSION_MAX_SUPPORTED; + break; + default: + PORT_SetError(SEC_ERROR_INVALID_ARGS); + return SECFailure; + } + + return SECSuccess; +} + +SECStatus +SSL_VersionRangeGetDefault(SSLProtocolVariant protocolVariant, + SSLVersionRange *vrange) +{ + if ((protocolVariant != ssl_variant_stream && + protocolVariant != ssl_variant_datagram) || + !vrange) { + PORT_SetError(SEC_ERROR_INVALID_ARGS); + return SECFailure; + } + + *vrange = *VERSIONS_DEFAULTS(protocolVariant); + + return SECSuccess; +} + +SECStatus +SSL_VersionRangeSetDefault(SSLProtocolVariant protocolVariant, + const SSLVersionRange *vrange) +{ + if (!ssl3_VersionRangeIsValid(protocolVariant, vrange)) { + PORT_SetError(SSL_ERROR_INVALID_VERSION_RANGE); + return SECFailure; + } + + *VERSIONS_DEFAULTS(protocolVariant) = *vrange; + + return SECSuccess; +} + +SECStatus +SSL_VersionRangeGet(PRFileDesc *fd, SSLVersionRange *vrange) +{ + sslSocket *ss = ssl_FindSocket(fd); + + if (!ss) { + SSL_DBG(("%d: SSL[%d]: bad socket in SSL_VersionRangeGet", + SSL_GETPID(), fd)); + return SECFailure; + } + + if (!vrange) { + PORT_SetError(SEC_ERROR_INVALID_ARGS); + return SECFailure; + } + + ssl_Get1stHandshakeLock(ss); + ssl_GetSSL3HandshakeLock(ss); + + *vrange = ss->vrange; + + ssl_ReleaseSSL3HandshakeLock(ss); + ssl_Release1stHandshakeLock(ss); + + return SECSuccess; +} + +SECStatus +SSL_VersionRangeSet(PRFileDesc *fd, const SSLVersionRange *vrange) +{ + sslSocket *ss = ssl_FindSocket(fd); + + if (!ss) { + SSL_DBG(("%d: SSL[%d]: bad socket in SSL_VersionRangeSet", + SSL_GETPID(), fd)); + return SECFailure; + } + + if (!ssl3_VersionRangeIsValid(ss->protocolVariant, vrange)) { + PORT_SetError(SSL_ERROR_INVALID_VERSION_RANGE); + return SECFailure; + } + + ssl_Get1stHandshakeLock(ss); + ssl_GetSSL3HandshakeLock(ss); + + if (ss->ssl3.downgradeCheckVersion && + ss->vrange.max > ss->ssl3.downgradeCheckVersion) { + PORT_SetError(SSL_ERROR_INVALID_VERSION_RANGE); + ssl_ReleaseSSL3HandshakeLock(ss); + ssl_Release1stHandshakeLock(ss); + return SECFailure; + } + + ss->vrange = *vrange; + + ssl_ReleaseSSL3HandshakeLock(ss); + ssl_Release1stHandshakeLock(ss); + + return SECSuccess; +} + +SECStatus +SSL_SetDowngradeCheckVersion(PRFileDesc *fd, PRUint16 version) +{ + sslSocket *ss = ssl_FindSocket(fd); + SECStatus rv = SECFailure; + + if (!ss) { + SSL_DBG(("%d: SSL[%d]: bad socket in SSL_SetDowngradeCheckVersion", + SSL_GETPID(), fd)); + return SECFailure; + } + + if (version && !ssl3_VersionIsSupported(ss->protocolVariant, version)) { + PORT_SetError(SEC_ERROR_INVALID_ARGS); + return SECFailure; + } + + ssl_Get1stHandshakeLock(ss); + ssl_GetSSL3HandshakeLock(ss); + + if (version && version < ss->vrange.max) { + PORT_SetError(SEC_ERROR_INVALID_ARGS); + goto loser; + } + ss->ssl3.downgradeCheckVersion = version; + rv = SECSuccess; + +loser: + ssl_ReleaseSSL3HandshakeLock(ss); + ssl_Release1stHandshakeLock(ss); + + return rv; +} + +const SECItemArray * +SSL_PeerStapledOCSPResponses(PRFileDesc *fd) +{ + sslSocket *ss = ssl_FindSocket(fd); + + if (!ss) { + SSL_DBG(("%d: SSL[%d]: bad socket in SSL_PeerStapledOCSPResponses", + SSL_GETPID(), fd)); + return NULL; + } + + if (!ss->sec.ci.sid) { + PORT_SetError(SEC_ERROR_NOT_INITIALIZED); + return NULL; + } + + return &ss->sec.ci.sid->peerCertStatus; +} + +/************************************************************************/ +/* The following functions are the TOP LEVEL SSL functions. +** They all get called through the NSPRIOMethods table below. +*/ + +static PRFileDesc *PR_CALLBACK +ssl_Accept(PRFileDesc *fd, PRNetAddr *sockaddr, PRIntervalTime timeout) +{ + sslSocket *ss; + sslSocket *ns = NULL; + PRFileDesc *newfd = NULL; + PRFileDesc *osfd; + PRStatus status; + + ss = ssl_GetPrivate(fd); + if (!ss) { + SSL_DBG(("%d: SSL[%d]: bad socket in accept", SSL_GETPID(), fd)); + return NULL; + } + + /* IF this is a listen socket, there shouldn't be any I/O going on */ + SSL_LOCK_READER(ss); + SSL_LOCK_WRITER(ss); + ssl_Get1stHandshakeLock(ss); + ssl_GetSSL3HandshakeLock(ss); + + ss->cTimeout = timeout; + + osfd = ss->fd->lower; + + /* First accept connection */ + newfd = osfd->methods->accept(osfd, sockaddr, timeout); + if (newfd == NULL) { + SSL_DBG(("%d: SSL[%d]: accept failed, errno=%d", + SSL_GETPID(), ss->fd, PORT_GetError())); + } else { + /* Create ssl module */ + ns = ssl_DupSocket(ss); + } + + ssl_ReleaseSSL3HandshakeLock(ss); + ssl_Release1stHandshakeLock(ss); + SSL_UNLOCK_WRITER(ss); + SSL_UNLOCK_READER(ss); /* ss isn't used below here. */ + + if (ns == NULL) + goto loser; + + /* push ssl module onto the new socket */ + status = ssl_PushIOLayer(ns, newfd, PR_TOP_IO_LAYER); + if (status != PR_SUCCESS) + goto loser; + + /* Now start server connection handshake with client. + ** Don't need locks here because nobody else has a reference to ns yet. + */ + if (ns->opt.useSecurity) { + if (ns->opt.handshakeAsClient) { + ns->handshake = ssl_BeginClientHandshake; + ss->handshaking = sslHandshakingAsClient; + } else { + ns->handshake = ssl_BeginServerHandshake; + ss->handshaking = sslHandshakingAsServer; + } + } + ns->TCPconnected = 1; + return newfd; + +loser: + if (ns != NULL) + ssl_FreeSocket(ns); + if (newfd != NULL) + PR_Close(newfd); + return NULL; +} + +static PRStatus PR_CALLBACK +ssl_Connect(PRFileDesc *fd, const PRNetAddr *sockaddr, PRIntervalTime timeout) +{ + sslSocket *ss; + PRStatus rv; + + ss = ssl_GetPrivate(fd); + if (!ss) { + SSL_DBG(("%d: SSL[%d]: bad socket in connect", SSL_GETPID(), fd)); + return PR_FAILURE; + } + + /* IF this is a listen socket, there shouldn't be any I/O going on */ + SSL_LOCK_READER(ss); + SSL_LOCK_WRITER(ss); + + ss->cTimeout = timeout; + rv = (PRStatus)(*ss->ops->connect)(ss, sockaddr); + + SSL_UNLOCK_WRITER(ss); + SSL_UNLOCK_READER(ss); + + return rv; +} + +static PRStatus PR_CALLBACK +ssl_Bind(PRFileDesc *fd, const PRNetAddr *addr) +{ + sslSocket *ss = ssl_GetPrivate(fd); + PRStatus rv; + + if (!ss) { + SSL_DBG(("%d: SSL[%d]: bad socket in bind", SSL_GETPID(), fd)); + return PR_FAILURE; + } + SSL_LOCK_READER(ss); + SSL_LOCK_WRITER(ss); + + rv = (PRStatus)(*ss->ops->bind)(ss, addr); + + SSL_UNLOCK_WRITER(ss); + SSL_UNLOCK_READER(ss); + return rv; +} + +static PRStatus PR_CALLBACK +ssl_Listen(PRFileDesc *fd, PRIntn backlog) +{ + sslSocket *ss = ssl_GetPrivate(fd); + PRStatus rv; + + if (!ss) { + SSL_DBG(("%d: SSL[%d]: bad socket in listen", SSL_GETPID(), fd)); + return PR_FAILURE; + } + SSL_LOCK_READER(ss); + SSL_LOCK_WRITER(ss); + + rv = (PRStatus)(*ss->ops->listen)(ss, backlog); + + SSL_UNLOCK_WRITER(ss); + SSL_UNLOCK_READER(ss); + return rv; +} + +static PRStatus PR_CALLBACK +ssl_Shutdown(PRFileDesc *fd, PRIntn how) +{ + sslSocket *ss = ssl_GetPrivate(fd); + PRStatus rv; + + if (!ss) { + SSL_DBG(("%d: SSL[%d]: bad socket in shutdown", SSL_GETPID(), fd)); + return PR_FAILURE; + } + if (how == PR_SHUTDOWN_RCV || how == PR_SHUTDOWN_BOTH) { + SSL_LOCK_READER(ss); + } + if (how == PR_SHUTDOWN_SEND || how == PR_SHUTDOWN_BOTH) { + SSL_LOCK_WRITER(ss); + } + + rv = (PRStatus)(*ss->ops->shutdown)(ss, how); + + if (how == PR_SHUTDOWN_SEND || how == PR_SHUTDOWN_BOTH) { + SSL_UNLOCK_WRITER(ss); + } + if (how == PR_SHUTDOWN_RCV || how == PR_SHUTDOWN_BOTH) { + SSL_UNLOCK_READER(ss); + } + return rv; +} + +static PRStatus PR_CALLBACK +ssl_Close(PRFileDesc *fd) +{ + sslSocket *ss; + PRStatus rv; + + ss = ssl_GetPrivate(fd); + if (!ss) { + SSL_DBG(("%d: SSL[%d]: bad socket in close", SSL_GETPID(), fd)); + return PR_FAILURE; + } + + /* There must not be any I/O going on */ + SSL_LOCK_READER(ss); + SSL_LOCK_WRITER(ss); + + /* By the time this function returns, + ** ss is an invalid pointer, and the locks to which it points have + ** been unlocked and freed. So, this is the ONE PLACE in all of SSL + ** where the LOCK calls and the corresponding UNLOCK calls are not in + ** the same function scope. The unlock calls are in ssl_FreeSocket(). + */ + rv = (PRStatus)(*ss->ops->close)(ss); + + return rv; +} + +static int PR_CALLBACK +ssl_Recv(PRFileDesc *fd, void *buf, PRInt32 len, PRIntn flags, + PRIntervalTime timeout) +{ + sslSocket *ss; + int rv; + + ss = ssl_GetPrivate(fd); + if (!ss) { + SSL_DBG(("%d: SSL[%d]: bad socket in recv", SSL_GETPID(), fd)); + return SECFailure; + } + SSL_LOCK_READER(ss); + ss->rTimeout = timeout; + if (!ss->opt.fdx) + ss->wTimeout = timeout; + rv = (*ss->ops->recv)(ss, (unsigned char *)buf, len, flags); + SSL_UNLOCK_READER(ss); + return rv; +} + +static int PR_CALLBACK +ssl_Send(PRFileDesc *fd, const void *buf, PRInt32 len, PRIntn flags, + PRIntervalTime timeout) +{ + sslSocket *ss; + int rv; + + ss = ssl_GetPrivate(fd); + if (!ss) { + SSL_DBG(("%d: SSL[%d]: bad socket in send", SSL_GETPID(), fd)); + return SECFailure; + } + SSL_LOCK_WRITER(ss); + ss->wTimeout = timeout; + if (!ss->opt.fdx) + ss->rTimeout = timeout; + rv = (*ss->ops->send)(ss, (const unsigned char *)buf, len, flags); + SSL_UNLOCK_WRITER(ss); + return rv; +} + +static int PR_CALLBACK +ssl_Read(PRFileDesc *fd, void *buf, PRInt32 len) +{ + sslSocket *ss; + int rv; + + ss = ssl_GetPrivate(fd); + if (!ss) { + SSL_DBG(("%d: SSL[%d]: bad socket in read", SSL_GETPID(), fd)); + return SECFailure; + } + SSL_LOCK_READER(ss); + ss->rTimeout = PR_INTERVAL_NO_TIMEOUT; + if (!ss->opt.fdx) + ss->wTimeout = PR_INTERVAL_NO_TIMEOUT; + rv = (*ss->ops->read)(ss, (unsigned char *)buf, len); + SSL_UNLOCK_READER(ss); + return rv; +} + +static int PR_CALLBACK +ssl_Write(PRFileDesc *fd, const void *buf, PRInt32 len) +{ + sslSocket *ss; + int rv; + + ss = ssl_GetPrivate(fd); + if (!ss) { + SSL_DBG(("%d: SSL[%d]: bad socket in write", SSL_GETPID(), fd)); + return SECFailure; + } + SSL_LOCK_WRITER(ss); + ss->wTimeout = PR_INTERVAL_NO_TIMEOUT; + if (!ss->opt.fdx) + ss->rTimeout = PR_INTERVAL_NO_TIMEOUT; + rv = (*ss->ops->write)(ss, (const unsigned char *)buf, len); + SSL_UNLOCK_WRITER(ss); + return rv; +} + +static PRStatus PR_CALLBACK +ssl_GetPeerName(PRFileDesc *fd, PRNetAddr *addr) +{ + sslSocket *ss; + + ss = ssl_GetPrivate(fd); + if (!ss) { + SSL_DBG(("%d: SSL[%d]: bad socket in getpeername", SSL_GETPID(), fd)); + return PR_FAILURE; + } + return (PRStatus)(*ss->ops->getpeername)(ss, addr); +} + +/* +*/ +SECStatus +ssl_GetPeerInfo(sslSocket *ss) +{ + PRFileDesc *osfd; + int rv; + PRNetAddr sin; + + osfd = ss->fd->lower; + + PORT_Memset(&sin, 0, sizeof(sin)); + rv = osfd->methods->getpeername(osfd, &sin); + if (rv < 0) { + return SECFailure; + } + ss->TCPconnected = 1; + if (sin.inet.family == PR_AF_INET) { + PR_ConvertIPv4AddrToIPv6(sin.inet.ip, &ss->sec.ci.peer); + ss->sec.ci.port = sin.inet.port; + } else if (sin.ipv6.family == PR_AF_INET6) { + ss->sec.ci.peer = sin.ipv6.ip; + ss->sec.ci.port = sin.ipv6.port; + } else { + PORT_SetError(PR_ADDRESS_NOT_SUPPORTED_ERROR); + return SECFailure; + } + return SECSuccess; +} + +static PRStatus PR_CALLBACK +ssl_GetSockName(PRFileDesc *fd, PRNetAddr *name) +{ + sslSocket *ss; + + ss = ssl_GetPrivate(fd); + if (!ss) { + SSL_DBG(("%d: SSL[%d]: bad socket in getsockname", SSL_GETPID(), fd)); + return PR_FAILURE; + } + return (PRStatus)(*ss->ops->getsockname)(ss, name); +} + +SECStatus +SSL_SetSockPeerID(PRFileDesc *fd, const char *peerID) +{ + sslSocket *ss; + + ss = ssl_FindSocket(fd); + if (!ss) { + SSL_DBG(("%d: SSL[%d]: bad socket in SSL_SetSockPeerID", + SSL_GETPID(), fd)); + return SECFailure; + } + + if (ss->peerID) { + PORT_Free(ss->peerID); + ss->peerID = NULL; + } + if (peerID) + ss->peerID = PORT_Strdup(peerID); + return (ss->peerID || !peerID) ? SECSuccess : SECFailure; +} + +#define PR_POLL_RW (PR_POLL_WRITE | PR_POLL_READ) + +static PRInt16 PR_CALLBACK +ssl_Poll(PRFileDesc *fd, PRInt16 how_flags, PRInt16 *p_out_flags) +{ + sslSocket *ss; + PRInt16 new_flags = how_flags; /* should select on these flags. */ + PRNetAddr addr; + + *p_out_flags = 0; + ss = ssl_GetPrivate(fd); + if (!ss) { + SSL_DBG(("%d: SSL[%d]: bad socket in SSL_Poll", + SSL_GETPID(), fd)); + return 0; /* don't poll on this socket */ + } + + if (ss->opt.useSecurity && + ss->handshaking != sslHandshakingUndetermined && + !ss->firstHsDone && + (how_flags & PR_POLL_RW)) { + if (!ss->TCPconnected) { + ss->TCPconnected = (PR_SUCCESS == ssl_DefGetpeername(ss, &addr)); + } + /* If it's not connected, then presumably the application is polling + ** on read or write appropriately, so don't change it. + */ + if (ss->TCPconnected) { + if (!ss->handshakeBegun) { + /* If the handshake has not begun, poll on read or write + ** based on the local application's role in the handshake, + ** not based on what the application requested. + */ + new_flags &= ~PR_POLL_RW; + if (ss->handshaking == sslHandshakingAsClient) { + new_flags |= PR_POLL_WRITE; + } else { /* handshaking as server */ + new_flags |= PR_POLL_READ; + } + } else + /* First handshake is in progress */ + if (ss->lastWriteBlocked) { + if (new_flags & PR_POLL_READ) { + /* The caller is waiting for data to be received, + ** but the initial handshake is blocked on write, or the + ** client's first handshake record has not been written. + ** The code should select on write, not read. + */ + new_flags ^= PR_POLL_READ; /* don't select on read. */ + new_flags |= PR_POLL_WRITE; /* do select on write. */ + } + } else if (new_flags & PR_POLL_WRITE) { + /* The caller is trying to write, but the handshake is + ** blocked waiting for data to read, and the first + ** handshake has been sent. So do NOT to poll on write + ** unless we did false start. + */ + if (!ss->ssl3.hs.canFalseStart) { + new_flags ^= PR_POLL_WRITE; /* don't select on write. */ + } + new_flags |= PR_POLL_READ; /* do select on read. */ + } + } + } else if ((new_flags & PR_POLL_READ) && (SSL_DataPending(fd) > 0)) { + *p_out_flags = PR_POLL_READ; /* it's ready already. */ + return new_flags; + } else if ((ss->lastWriteBlocked) && (how_flags & PR_POLL_READ) && + (ss->pendingBuf.len != 0)) { /* write data waiting to be sent */ + new_flags |= PR_POLL_WRITE; /* also select on write. */ + } + + if (ss->ssl3.hs.restartTarget != NULL) { + /* Read and write will block until the asynchronous callback completes + * (e.g. until SSL_AuthCertificateComplete is called), so don't tell + * the caller to poll the socket unless there is pending write data. + */ + if (ss->lastWriteBlocked && ss->pendingBuf.len != 0) { + /* Ignore any newly-received data on the socket, but do wait for + * the socket to become writable again. Here, it is OK for an error + * to be detected, because our logic for sending pending write data + * will allow us to report the error to the caller without the risk + * of the application spinning. + */ + new_flags &= (PR_POLL_WRITE | PR_POLL_EXCEPT); + } else { + /* Unfortunately, clearing new_flags will make it impossible for + * the application to detect errors that it would otherwise be + * able to detect with PR_POLL_EXCEPT, until the asynchronous + * callback completes. However, we must clear all the flags to + * prevent the application from spinning (alternating between + * calling PR_Poll that would return PR_POLL_EXCEPT, and send/recv + * which won't actually report the I/O error while we are waiting + * for the asynchronous callback to complete). + */ + new_flags = 0; + } + } + + if (new_flags && (fd->lower->methods->poll != NULL)) { + PRInt16 lower_out_flags = 0; + PRInt16 lower_new_flags; + lower_new_flags = fd->lower->methods->poll(fd->lower, new_flags, + &lower_out_flags); + if ((lower_new_flags & lower_out_flags) && (how_flags != new_flags)) { + PRInt16 out_flags = lower_out_flags & ~PR_POLL_RW; + if (lower_out_flags & PR_POLL_READ) + out_flags |= PR_POLL_WRITE; + if (lower_out_flags & PR_POLL_WRITE) + out_flags |= PR_POLL_READ; + *p_out_flags = out_flags; + new_flags = how_flags; + } else { + *p_out_flags = lower_out_flags; + new_flags = lower_new_flags; + } + } + + return new_flags; +} + +static PRInt32 PR_CALLBACK +ssl_TransmitFile(PRFileDesc *sd, PRFileDesc *fd, + const void *headers, PRInt32 hlen, + PRTransmitFileFlags flags, PRIntervalTime timeout) +{ + PRSendFileData sfd; + + sfd.fd = fd; + sfd.file_offset = 0; + sfd.file_nbytes = 0; + sfd.header = headers; + sfd.hlen = hlen; + sfd.trailer = NULL; + sfd.tlen = 0; + + return sd->methods->sendfile(sd, &sfd, flags, timeout); +} + +PRBool +ssl_FdIsBlocking(PRFileDesc *fd) +{ + PRSocketOptionData opt; + PRStatus status; + + opt.option = PR_SockOpt_Nonblocking; + opt.value.non_blocking = PR_FALSE; + status = PR_GetSocketOption(fd, &opt); + if (status != PR_SUCCESS) + return PR_FALSE; + return (PRBool)!opt.value.non_blocking; +} + +PRBool +ssl_SocketIsBlocking(sslSocket *ss) +{ + return ssl_FdIsBlocking(ss->fd); +} + +PRInt32 sslFirstBufSize = 8 * 1024; +PRInt32 sslCopyLimit = 1024; + +static PRInt32 PR_CALLBACK +ssl_WriteV(PRFileDesc *fd, const PRIOVec *iov, PRInt32 vectors, + PRIntervalTime timeout) +{ + PRInt32 i; + PRInt32 bufLen; + PRInt32 left; + PRInt32 rv; + PRInt32 sent = 0; + const PRInt32 first_len = sslFirstBufSize; + const PRInt32 limit = sslCopyLimit; + PRBool blocking; + PRIOVec myIov; + char buf[MAX_FRAGMENT_LENGTH]; + + if (vectors < 0) { + PORT_SetError(PR_INVALID_ARGUMENT_ERROR); + return -1; + } + if (vectors > PR_MAX_IOVECTOR_SIZE) { + PORT_SetError(PR_BUFFER_OVERFLOW_ERROR); + return -1; + } + for (i = 0; i < vectors; i++) { + if (iov[i].iov_len < 0) { + PORT_SetError(PR_INVALID_ARGUMENT_ERROR); + return -1; + } + } + blocking = ssl_FdIsBlocking(fd); + +#define K16 sizeof(buf) +#define KILL_VECTORS \ + while (vectors && !iov->iov_len) { \ + ++iov; \ + --vectors; \ + } +#define GET_VECTOR \ + do { \ + myIov = *iov++; \ + --vectors; \ + KILL_VECTORS \ + } while (0) +#define HANDLE_ERR(rv, len) \ + if (rv != len) { \ + if (rv < 0) { \ + if (!blocking && \ + (PR_GetError() == PR_WOULD_BLOCK_ERROR) && \ + (sent > 0)) { \ + return sent; \ + } else { \ + return -1; \ + } \ + } \ + /* Only a nonblocking socket can have partial sends */ \ + PR_ASSERT(!blocking); \ + return sent + rv; \ + } +#define SEND(bfr, len) \ + do { \ + rv = ssl_Send(fd, bfr, len, 0, timeout); \ + HANDLE_ERR(rv, len) \ + sent += len; \ + } while (0) + + /* Make sure the first write is at least 8 KB, if possible. */ + KILL_VECTORS + if (!vectors) + return ssl_Send(fd, 0, 0, 0, timeout); + GET_VECTOR; + if (!vectors) { + return ssl_Send(fd, myIov.iov_base, myIov.iov_len, 0, timeout); + } + if (myIov.iov_len < first_len) { + PORT_Memcpy(buf, myIov.iov_base, myIov.iov_len); + bufLen = myIov.iov_len; + left = first_len - bufLen; + while (vectors && left) { + int toCopy; + GET_VECTOR; + toCopy = PR_MIN(left, myIov.iov_len); + PORT_Memcpy(buf + bufLen, myIov.iov_base, toCopy); + bufLen += toCopy; + left -= toCopy; + myIov.iov_base += toCopy; + myIov.iov_len -= toCopy; + } + SEND(buf, bufLen); + } + + while (vectors || myIov.iov_len) { + PRInt32 addLen; + if (!myIov.iov_len) { + GET_VECTOR; + } + while (myIov.iov_len >= K16) { + SEND(myIov.iov_base, K16); + myIov.iov_base += K16; + myIov.iov_len -= K16; + } + if (!myIov.iov_len) + continue; + + if (!vectors || myIov.iov_len > limit) { + addLen = 0; + } else if ((addLen = iov->iov_len % K16) + myIov.iov_len <= limit) { + /* Addlen is already computed. */; + } else if (vectors > 1 && + iov[1].iov_len % K16 + addLen + myIov.iov_len <= 2 * limit) { + addLen = limit - myIov.iov_len; + } else + addLen = 0; + + if (!addLen) { + SEND(myIov.iov_base, myIov.iov_len); + myIov.iov_len = 0; + continue; + } + PORT_Memcpy(buf, myIov.iov_base, myIov.iov_len); + bufLen = myIov.iov_len; + do { + GET_VECTOR; + PORT_Memcpy(buf + bufLen, myIov.iov_base, addLen); + myIov.iov_base += addLen; + myIov.iov_len -= addLen; + bufLen += addLen; + + left = PR_MIN(limit, K16 - bufLen); + if (!vectors /* no more left */ + || myIov.iov_len > 0 /* we didn't use that one all up */ + || bufLen >= K16 /* it's full. */) { + addLen = 0; + } else if ((addLen = iov->iov_len % K16) <= left) { + /* Addlen is already computed. */; + } else if (vectors > 1 && + iov[1].iov_len % K16 + addLen <= left + limit) { + addLen = left; + } else + addLen = 0; + + } while (addLen); + SEND(buf, bufLen); + } + return sent; +} + +/* + * These functions aren't implemented. + */ + +static PRInt32 PR_CALLBACK +ssl_Available(PRFileDesc *fd) +{ + PORT_Assert(0); + PR_SetError(PR_NOT_IMPLEMENTED_ERROR, 0); + return SECFailure; +} + +static PRInt64 PR_CALLBACK +ssl_Available64(PRFileDesc *fd) +{ + PRInt64 res; + + PORT_Assert(0); + PR_SetError(PR_NOT_IMPLEMENTED_ERROR, 0); + LL_I2L(res, -1L); + return res; +} + +static PRStatus PR_CALLBACK +ssl_FSync(PRFileDesc *fd) +{ + PORT_Assert(0); + PR_SetError(PR_NOT_IMPLEMENTED_ERROR, 0); + return PR_FAILURE; +} + +static PRInt32 PR_CALLBACK +ssl_Seek(PRFileDesc *fd, PRInt32 offset, PRSeekWhence how) +{ + PORT_Assert(0); + PR_SetError(PR_NOT_IMPLEMENTED_ERROR, 0); + return SECFailure; +} + +static PRInt64 PR_CALLBACK +ssl_Seek64(PRFileDesc *fd, PRInt64 offset, PRSeekWhence how) +{ + PRInt64 res; + + PORT_Assert(0); + PR_SetError(PR_NOT_IMPLEMENTED_ERROR, 0); + LL_I2L(res, -1L); + return res; +} + +static PRStatus PR_CALLBACK +ssl_FileInfo(PRFileDesc *fd, PRFileInfo *info) +{ + PORT_Assert(0); + PR_SetError(PR_NOT_IMPLEMENTED_ERROR, 0); + return PR_FAILURE; +} + +static PRStatus PR_CALLBACK +ssl_FileInfo64(PRFileDesc *fd, PRFileInfo64 *info) +{ + PORT_Assert(0); + PR_SetError(PR_NOT_IMPLEMENTED_ERROR, 0); + return PR_FAILURE; +} + +static PRInt32 PR_CALLBACK +ssl_RecvFrom(PRFileDesc *fd, void *buf, PRInt32 amount, PRIntn flags, + PRNetAddr *addr, PRIntervalTime timeout) +{ + PORT_Assert(0); + PR_SetError(PR_NOT_IMPLEMENTED_ERROR, 0); + return SECFailure; +} + +static PRInt32 PR_CALLBACK +ssl_SendTo(PRFileDesc *fd, const void *buf, PRInt32 amount, PRIntn flags, + const PRNetAddr *addr, PRIntervalTime timeout) +{ + PORT_Assert(0); + PR_SetError(PR_NOT_IMPLEMENTED_ERROR, 0); + return SECFailure; +} + +static const PRIOMethods ssl_methods = { + PR_DESC_LAYERED, + ssl_Close, /* close */ + ssl_Read, /* read */ + ssl_Write, /* write */ + ssl_Available, /* available */ + ssl_Available64, /* available64 */ + ssl_FSync, /* fsync */ + ssl_Seek, /* seek */ + ssl_Seek64, /* seek64 */ + ssl_FileInfo, /* fileInfo */ + ssl_FileInfo64, /* fileInfo64 */ + ssl_WriteV, /* writev */ + ssl_Connect, /* connect */ + ssl_Accept, /* accept */ + ssl_Bind, /* bind */ + ssl_Listen, /* listen */ + ssl_Shutdown, /* shutdown */ + ssl_Recv, /* recv */ + ssl_Send, /* send */ + ssl_RecvFrom, /* recvfrom */ + ssl_SendTo, /* sendto */ + ssl_Poll, /* poll */ + PR_EmulateAcceptRead, /* acceptread */ + ssl_TransmitFile, /* transmitfile */ + ssl_GetSockName, /* getsockname */ + ssl_GetPeerName, /* getpeername */ + NULL, /* getsockopt OBSOLETE */ + NULL, /* setsockopt OBSOLETE */ + NULL, /* getsocketoption */ + NULL, /* setsocketoption */ + PR_EmulateSendFile, /* Send a (partial) file with header/trailer*/ + NULL, /* reserved for future use */ + NULL, /* reserved for future use */ + NULL, /* reserved for future use */ + NULL, /* reserved for future use */ + NULL /* reserved for future use */ +}; + +static PRIOMethods combined_methods; + +static void +ssl_SetupIOMethods(void) +{ + PRIOMethods *new_methods = &combined_methods; + const PRIOMethods *nspr_methods = PR_GetDefaultIOMethods(); + const PRIOMethods *my_methods = &ssl_methods; + + *new_methods = *nspr_methods; + + new_methods->file_type = my_methods->file_type; + new_methods->close = my_methods->close; + new_methods->read = my_methods->read; + new_methods->write = my_methods->write; + new_methods->available = my_methods->available; + new_methods->available64 = my_methods->available64; + new_methods->fsync = my_methods->fsync; + new_methods->seek = my_methods->seek; + new_methods->seek64 = my_methods->seek64; + new_methods->fileInfo = my_methods->fileInfo; + new_methods->fileInfo64 = my_methods->fileInfo64; + new_methods->writev = my_methods->writev; + new_methods->connect = my_methods->connect; + new_methods->accept = my_methods->accept; + new_methods->bind = my_methods->bind; + new_methods->listen = my_methods->listen; + new_methods->shutdown = my_methods->shutdown; + new_methods->recv = my_methods->recv; + new_methods->send = my_methods->send; + new_methods->recvfrom = my_methods->recvfrom; + new_methods->sendto = my_methods->sendto; + new_methods->poll = my_methods->poll; + new_methods->acceptread = my_methods->acceptread; + new_methods->transmitfile = my_methods->transmitfile; + new_methods->getsockname = my_methods->getsockname; + new_methods->getpeername = my_methods->getpeername; + /* new_methods->getsocketoption = my_methods->getsocketoption; */ + /* new_methods->setsocketoption = my_methods->setsocketoption; */ + new_methods->sendfile = my_methods->sendfile; +} + +static PRCallOnceType initIoLayerOnce; + +static PRStatus +ssl_InitIOLayer(void) +{ + ssl_layer_id = PR_GetUniqueIdentity("SSL"); + ssl_SetupIOMethods(); + ssl_inited = PR_TRUE; + return PR_SUCCESS; +} + +static PRStatus +ssl_PushIOLayer(sslSocket *ns, PRFileDesc *stack, PRDescIdentity id) +{ + PRFileDesc *layer = NULL; + PRStatus status; + + if (!ssl_inited) { + status = PR_CallOnce(&initIoLayerOnce, &ssl_InitIOLayer); + if (status != PR_SUCCESS) + goto loser; + } + + if (ns == NULL) + goto loser; + + layer = PR_CreateIOLayerStub(ssl_layer_id, &combined_methods); + if (layer == NULL) + goto loser; + layer->secret = (PRFilePrivate *)ns; + + /* Here, "stack" points to the PRFileDesc on the top of the stack. + ** "layer" points to a new FD that is to be inserted into the stack. + ** If layer is being pushed onto the top of the stack, then + ** PR_PushIOLayer switches the contents of stack and layer, and then + ** puts stack on top of layer, so that after it is done, the top of + ** stack is the same "stack" as it was before, and layer is now the + ** FD for the former top of stack. + ** After this call, stack always points to the top PRFD on the stack. + ** If this function fails, the contents of stack and layer are as + ** they were before the call. + */ + status = PR_PushIOLayer(stack, id, layer); + if (status != PR_SUCCESS) + goto loser; + + ns->fd = (id == PR_TOP_IO_LAYER) ? stack : layer; + return PR_SUCCESS; + +loser: + if (layer) { + layer->dtor(layer); /* free layer */ + } + return PR_FAILURE; +} + +/* if this fails, caller must destroy socket. */ +static SECStatus +ssl_MakeLocks(sslSocket *ss) +{ + ss->firstHandshakeLock = PZ_NewMonitor(nssILockSSL); + if (!ss->firstHandshakeLock) + goto loser; + ss->ssl3HandshakeLock = PZ_NewMonitor(nssILockSSL); + if (!ss->ssl3HandshakeLock) + goto loser; + ss->specLock = NSSRWLock_New(SSL_LOCK_RANK_SPEC, NULL); + if (!ss->specLock) + goto loser; + ss->recvBufLock = PZ_NewMonitor(nssILockSSL); + if (!ss->recvBufLock) + goto loser; + ss->xmitBufLock = PZ_NewMonitor(nssILockSSL); + if (!ss->xmitBufLock) + goto loser; + ss->writerThread = NULL; + if (ssl_lock_readers) { + ss->recvLock = PZ_NewLock(nssILockSSL); + if (!ss->recvLock) + goto loser; + ss->sendLock = PZ_NewLock(nssILockSSL); + if (!ss->sendLock) + goto loser; + } + return SECSuccess; +loser: + ssl_DestroyLocks(ss); + return SECFailure; +} + +#if defined(XP_UNIX) || defined(XP_WIN32) || defined(XP_BEOS) +#define NSS_HAVE_GETENV 1 +#endif + +#define LOWER(x) (x | 0x20) /* cheap ToLower function ignores LOCALE */ + +static void +ssl_SetDefaultsFromEnvironment(void) +{ +#if defined(NSS_HAVE_GETENV) + static int firsttime = 1; + + if (firsttime) { + char *ev; + firsttime = 0; +#ifdef DEBUG + ev = PR_GetEnvSecure("SSLDEBUGFILE"); + if (ev && ev[0]) { + ssl_trace_iob = fopen(ev, "w"); + } + if (!ssl_trace_iob) { + ssl_trace_iob = stderr; + } +#ifdef TRACE + ev = PR_GetEnvSecure("SSLTRACE"); + if (ev && ev[0]) { + ssl_trace = atoi(ev); + SSL_TRACE(("SSL: tracing set to %d", ssl_trace)); + } +#endif /* TRACE */ + ev = PR_GetEnvSecure("SSLDEBUG"); + if (ev && ev[0]) { + ssl_debug = atoi(ev); + SSL_TRACE(("SSL: debugging set to %d", ssl_debug)); + } +#endif /* DEBUG */ +#ifdef NSS_ALLOW_SSLKEYLOGFILE + ev = PR_GetEnvSecure("SSLKEYLOGFILE"); + if (ev && ev[0]) { + ssl_keylog_iob = fopen(ev, "a"); + if (!ssl_keylog_iob) { + SSL_TRACE(("SSL: failed to open key log file")); + } else { + if (ftell(ssl_keylog_iob) == 0) { + fputs("# SSL/TLS secrets log file, generated by NSS\n", + ssl_keylog_iob); + } + SSL_TRACE(("SSL: logging SSL/TLS secrets to %s", ev)); + } + } +#endif + ev = PR_GetEnvSecure("SSLFORCELOCKS"); + if (ev && ev[0] == '1') { + ssl_force_locks = PR_TRUE; + ssl_defaults.noLocks = 0; + strcpy(lockStatus + LOCKSTATUS_OFFSET, "FORCED. "); + SSL_TRACE(("SSL: force_locks set to %d", ssl_force_locks)); + } + ev = PR_GetEnvSecure("NSS_SSL_ENABLE_RENEGOTIATION"); + if (ev) { + if (ev[0] == '1' || LOWER(ev[0]) == 'u') + ssl_defaults.enableRenegotiation = SSL_RENEGOTIATE_UNRESTRICTED; + else if (ev[0] == '0' || LOWER(ev[0]) == 'n') + ssl_defaults.enableRenegotiation = SSL_RENEGOTIATE_NEVER; + else if (ev[0] == '2' || LOWER(ev[0]) == 'r') + ssl_defaults.enableRenegotiation = SSL_RENEGOTIATE_REQUIRES_XTN; + else if (ev[0] == '3' || LOWER(ev[0]) == 't') + ssl_defaults.enableRenegotiation = SSL_RENEGOTIATE_TRANSITIONAL; + SSL_TRACE(("SSL: enableRenegotiation set to %d", + ssl_defaults.enableRenegotiation)); + } + ev = PR_GetEnvSecure("NSS_SSL_REQUIRE_SAFE_NEGOTIATION"); + if (ev && ev[0] == '1') { + ssl_defaults.requireSafeNegotiation = PR_TRUE; + SSL_TRACE(("SSL: requireSafeNegotiation set to %d", + PR_TRUE)); + } + ev = PR_GetEnvSecure("NSS_SSL_CBC_RANDOM_IV"); + if (ev && ev[0] == '0') { + ssl_defaults.cbcRandomIV = PR_FALSE; + SSL_TRACE(("SSL: cbcRandomIV set to 0")); + } + } +#endif /* NSS_HAVE_GETENV */ +} + +const sslNamedGroupDef * +ssl_LookupNamedGroup(SSLNamedGroup group) +{ + unsigned int i; + + for (i = 0; i < SSL_NAMED_GROUP_COUNT; ++i) { + if (ssl_named_groups[i].name == group) { + return &ssl_named_groups[i]; + } + } + return NULL; +} + +PRBool +ssl_NamedGroupEnabled(const sslSocket *ss, const sslNamedGroupDef *groupDef) +{ + unsigned int i; + + if (!groupDef) { + return PR_FALSE; + } + + for (i = 0; i < SSL_NAMED_GROUP_COUNT; ++i) { + if (ss->namedGroupPreferences[i] && + ss->namedGroupPreferences[i] == groupDef) { + return PR_TRUE; + } + } + return PR_FALSE; +} + +/* Returns a reference counted object that contains a key pair. + * Or NULL on failure. Initial ref count is 1. + * Uses the keys in the pair as input. Adopts the keys given. + */ +sslKeyPair * +ssl_NewKeyPair(SECKEYPrivateKey *privKey, SECKEYPublicKey *pubKey) +{ + sslKeyPair *pair; + + if (!privKey || !pubKey) { + PORT_SetError(PR_INVALID_ARGUMENT_ERROR); + return NULL; + } + pair = PORT_ZNew(sslKeyPair); + if (!pair) + return NULL; /* error code is set. */ + pair->privKey = privKey; + pair->pubKey = pubKey; + pair->refCount = 1; + return pair; /* success */ +} + +sslKeyPair * +ssl_GetKeyPairRef(sslKeyPair *keyPair) +{ + PR_ATOMIC_INCREMENT(&keyPair->refCount); + return keyPair; +} + +void +ssl_FreeKeyPair(sslKeyPair *keyPair) +{ + PRInt32 newCount = PR_ATOMIC_DECREMENT(&keyPair->refCount); + if (!newCount) { + SECKEY_DestroyPrivateKey(keyPair->privKey); + SECKEY_DestroyPublicKey(keyPair->pubKey); + PORT_Free(keyPair); + } +} + +/* Ephemeral key handling. */ +sslEphemeralKeyPair * +ssl_NewEphemeralKeyPair(const sslNamedGroupDef *group, + SECKEYPrivateKey *privKey, SECKEYPublicKey *pubKey) +{ + sslKeyPair *keys; + sslEphemeralKeyPair *pair; + + if (!group) { + PORT_SetError(PR_INVALID_ARGUMENT_ERROR); + return NULL; + } + + keys = ssl_NewKeyPair(privKey, pubKey); + if (!keys) { + return NULL; + } + + pair = PORT_ZNew(sslEphemeralKeyPair); + if (!pair) { + ssl_FreeKeyPair(keys); + return NULL; /* error already set */ + } + + PR_INIT_CLIST(&pair->link); + pair->group = group; + pair->keys = keys; + + return pair; +} + +sslEphemeralKeyPair * +ssl_CopyEphemeralKeyPair(sslEphemeralKeyPair *keyPair) +{ + sslEphemeralKeyPair *pair; + + pair = PORT_ZNew(sslEphemeralKeyPair); + if (!pair) { + return NULL; /* error already set */ + } + + PR_INIT_CLIST(&pair->link); + pair->group = keyPair->group; + pair->keys = ssl_GetKeyPairRef(keyPair->keys); + + return pair; +} + +void +ssl_FreeEphemeralKeyPair(sslEphemeralKeyPair *keyPair) +{ + ssl_FreeKeyPair(keyPair->keys); + PR_REMOVE_LINK(&keyPair->link); + PORT_Free(keyPair); +} + +PRBool +ssl_HaveEphemeralKeyPair(const sslSocket *ss, const sslNamedGroupDef *groupDef) +{ + return ssl_LookupEphemeralKeyPair((sslSocket *)ss, groupDef) != NULL; +} + +sslEphemeralKeyPair * +ssl_LookupEphemeralKeyPair(sslSocket *ss, const sslNamedGroupDef *groupDef) +{ + PRCList *cursor; + for (cursor = PR_NEXT_LINK(&ss->ephemeralKeyPairs); + cursor != &ss->ephemeralKeyPairs; + cursor = PR_NEXT_LINK(cursor)) { + sslEphemeralKeyPair *keyPair = (sslEphemeralKeyPair *)cursor; + if (keyPair->group == groupDef) { + return keyPair; + } + } + return NULL; +} + +void +ssl_FreeEphemeralKeyPairs(sslSocket *ss) +{ + while (!PR_CLIST_IS_EMPTY(&ss->ephemeralKeyPairs)) { + PRCList *cursor = PR_LIST_TAIL(&ss->ephemeralKeyPairs); + ssl_FreeEphemeralKeyPair((sslEphemeralKeyPair *)cursor); + } +} + +/* +** Create a newsocket structure for a file descriptor. +*/ +static sslSocket * +ssl_NewSocket(PRBool makeLocks, SSLProtocolVariant protocolVariant) +{ + SECStatus rv; + sslSocket *ss; + int i; + + ssl_SetDefaultsFromEnvironment(); + + if (ssl_force_locks) + makeLocks = PR_TRUE; + + /* Make a new socket and get it ready */ + ss = (sslSocket *)PORT_ZAlloc(sizeof(sslSocket)); + if (!ss) { + return NULL; + } + ss->opt = ssl_defaults; + if (protocolVariant == ssl_variant_datagram) { + ss->opt.enableRenegotiation = SSL_RENEGOTIATE_NEVER; + } + ss->opt.useSocks = PR_FALSE; + ss->opt.noLocks = !makeLocks; + ss->vrange = *VERSIONS_DEFAULTS(protocolVariant); + ss->protocolVariant = protocolVariant; + + ss->peerID = NULL; + ss->rTimeout = PR_INTERVAL_NO_TIMEOUT; + ss->wTimeout = PR_INTERVAL_NO_TIMEOUT; + ss->cTimeout = PR_INTERVAL_NO_TIMEOUT; + ss->url = NULL; + + PR_INIT_CLIST(&ss->serverCerts); + PR_INIT_CLIST(&ss->ephemeralKeyPairs); + + ss->dbHandle = CERT_GetDefaultCertDB(); + + /* Provide default implementation of hooks */ + ss->authCertificate = SSL_AuthCertificate; + ss->authCertificateArg = (void *)ss->dbHandle; + ss->sniSocketConfig = NULL; + ss->sniSocketConfigArg = NULL; + ss->getClientAuthData = NULL; + ss->handleBadCert = NULL; + ss->badCertArg = NULL; + ss->pkcs11PinArg = NULL; + + ssl_ChooseOps(ss); + ssl3_InitSocketPolicy(ss); + for (i = 0; i < SSL_NAMED_GROUP_COUNT; ++i) { + ss->namedGroupPreferences[i] = &ssl_named_groups[i]; + } + ss->additionalShares = 0; + PR_INIT_CLIST(&ss->ssl3.hs.remoteExtensions); + PR_INIT_CLIST(&ss->ssl3.hs.lastMessageFlight); + PR_INIT_CLIST(&ss->ssl3.hs.cipherSpecs); + PR_INIT_CLIST(&ss->ssl3.hs.bufferedEarlyData); + ssl3_InitExtensionData(&ss->xtnData); + if (makeLocks) { + rv = ssl_MakeLocks(ss); + if (rv != SECSuccess) + goto loser; + } + rv = ssl_CreateSecurityInfo(ss); + if (rv != SECSuccess) + goto loser; + rv = ssl3_InitGather(&ss->gs); + if (rv != SECSuccess) + goto loser; + return ss; + +loser: + ssl_DestroySocketContents(ss); + ssl_DestroyLocks(ss); + PORT_Free(ss); + return NULL; +} + +/** + * DEPRECATED: Will always return false. + */ +SECStatus +SSL_CanBypass(CERTCertificate *cert, SECKEYPrivateKey *srvPrivkey, + PRUint32 protocolmask, PRUint16 *ciphersuites, int nsuites, + PRBool *pcanbypass, void *pwArg) +{ + if (!pcanbypass) { + PORT_SetError(SEC_ERROR_INVALID_ARGS); + return SECFailure; + } + *pcanbypass = PR_FALSE; + return SECSuccess; +} diff --git a/security/nss/lib/ssl/sslt.h b/security/nss/lib/ssl/sslt.h new file mode 100644 index 000000000..506b78d64 --- /dev/null +++ b/security/nss/lib/ssl/sslt.h @@ -0,0 +1,415 @@ +/* -*- Mode: C; tab-width: 8; indent-tabs-mode: nil; c-basic-offset: 4 -*- */ +/* + * This file contains prototypes for the public SSL functions. + * + * This Source Code Form is subject to the terms of the Mozilla Public + * License, v. 2.0. If a copy of the MPL was not distributed with this + * file, You can obtain one at http://mozilla.org/MPL/2.0/. */ + +#ifndef __sslt_h_ +#define __sslt_h_ + +#include "prtypes.h" +#include "secitem.h" +#include "certt.h" + +typedef struct SSL3StatisticsStr { + /* statistics from ssl3_SendClientHello (sch) */ + long sch_sid_cache_hits; + long sch_sid_cache_misses; + long sch_sid_cache_not_ok; + + /* statistics from ssl3_HandleServerHello (hsh) */ + long hsh_sid_cache_hits; + long hsh_sid_cache_misses; + long hsh_sid_cache_not_ok; + + /* statistics from ssl3_HandleClientHello (hch) */ + long hch_sid_cache_hits; + long hch_sid_cache_misses; + long hch_sid_cache_not_ok; + + /* statistics related to stateless resume */ + long sch_sid_stateless_resumes; + long hsh_sid_stateless_resumes; + long hch_sid_stateless_resumes; + long hch_sid_ticket_parse_failures; +} SSL3Statistics; + +/* Key Exchange algorithm values */ +typedef enum { + ssl_kea_null = 0, + ssl_kea_rsa = 1, + ssl_kea_dh = 2, + ssl_kea_fortezza = 3, /* deprecated, now unused */ + ssl_kea_ecdh = 4, + ssl_kea_ecdh_psk = 5, + ssl_kea_dh_psk = 6, + ssl_kea_tls13_any = 7, + ssl_kea_size /* number of ssl_kea_ algorithms */ +} SSLKEAType; + +/* The following defines are for backwards compatibility. +** They will be removed in a forthcoming release to reduce namespace pollution. +** programs that use the kt_ symbols should convert to the ssl_kt_ symbols +** soon. +*/ +#define kt_null ssl_kea_null +#define kt_rsa ssl_kea_rsa +#define kt_dh ssl_kea_dh +#define kt_fortezza ssl_kea_fortezza /* deprecated, now unused */ +#define kt_ecdh ssl_kea_ecdh +#define kt_kea_size ssl_kea_size + +/* Values of this enum match the SignatureAlgorithm enum from + * https://tools.ietf.org/html/rfc5246#section-7.4.1.4.1 */ +typedef enum { + ssl_sign_null = 0, /* "anonymous" in TLS */ + ssl_sign_rsa = 1, + ssl_sign_dsa = 2, + ssl_sign_ecdsa = 3 +} SSLSignType; + +/* Values of this enum match the HashAlgorithm enum from + * https://tools.ietf.org/html/rfc5246#section-7.4.1.4.1 */ +typedef enum { + /* ssl_hash_none is used internally to mean the pre-1.2 combination of MD5 + * and SHA1. The other values are only used in TLS 1.2. */ + ssl_hash_none = 0, + ssl_hash_md5 = 1, + ssl_hash_sha1 = 2, + ssl_hash_sha224 = 3, + ssl_hash_sha256 = 4, + ssl_hash_sha384 = 5, + ssl_hash_sha512 = 6 +} SSLHashType; + +/* Deprecated */ +typedef struct SSLSignatureAndHashAlgStr { + SSLHashType hashAlg; + SSLSignType sigAlg; +} SSLSignatureAndHashAlg; + +typedef enum { + ssl_sig_none = 0, + ssl_sig_rsa_pkcs1_sha1 = 0x0201, + ssl_sig_rsa_pkcs1_sha256 = 0x0401, + ssl_sig_rsa_pkcs1_sha384 = 0x0501, + ssl_sig_rsa_pkcs1_sha512 = 0x0601, + /* For ECDSA, the pairing of the hash with a specific curve is only enforced + * in TLS 1.3; in TLS 1.2 any curve can be used with each of these. */ + ssl_sig_ecdsa_secp256r1_sha256 = 0x0403, + ssl_sig_ecdsa_secp384r1_sha384 = 0x0503, + ssl_sig_ecdsa_secp521r1_sha512 = 0x0603, + ssl_sig_rsa_pss_sha256 = 0x0804, + ssl_sig_rsa_pss_sha384 = 0x0805, + ssl_sig_rsa_pss_sha512 = 0x0806, + ssl_sig_ed25519 = 0x0807, + ssl_sig_ed448 = 0x0808, + + ssl_sig_dsa_sha1 = 0x0202, + ssl_sig_dsa_sha256 = 0x0402, + ssl_sig_dsa_sha384 = 0x0502, + ssl_sig_dsa_sha512 = 0x0602, + ssl_sig_ecdsa_sha1 = 0x0203, + + /* The following value (which can't be used in the protocol), represents + * the RSA signature using SHA-1 and MD5 that is used in TLS 1.0 and 1.1. + * This is reported as a signature scheme when TLS 1.0 or 1.1 is used. + * This should not be passed to SSL_SignatureSchemePrefSet(); this + * signature scheme is always used and cannot be disabled. */ + ssl_sig_rsa_pkcs1_sha1md5 = 0x10101, +} SSLSignatureScheme; + +/* +** SSLAuthType describes the type of key that is used to authenticate a +** connection. That is, the type of key in the end-entity certificate. +*/ +typedef enum { + ssl_auth_null = 0, + ssl_auth_rsa_decrypt = 1, /* static RSA */ + ssl_auth_dsa = 2, + ssl_auth_kea = 3, /* unused */ + ssl_auth_ecdsa = 4, + ssl_auth_ecdh_rsa = 5, /* ECDH cert with an RSA signature */ + ssl_auth_ecdh_ecdsa = 6, /* ECDH cert with an ECDSA signature */ + ssl_auth_rsa_sign = 7, /* RSA PKCS#1.5 signing */ + ssl_auth_rsa_pss = 8, + ssl_auth_psk = 9, + ssl_auth_tls13_any = 10, + ssl_auth_size /* number of authentication types */ +} SSLAuthType; + +/* This is defined for backward compatibility reasons */ +#define ssl_auth_rsa ssl_auth_rsa_decrypt + +typedef enum { + ssl_calg_null = 0, + ssl_calg_rc4 = 1, + ssl_calg_rc2 = 2, + ssl_calg_des = 3, + ssl_calg_3des = 4, + ssl_calg_idea = 5, + ssl_calg_fortezza = 6, /* deprecated, now unused */ + ssl_calg_aes = 7, + ssl_calg_camellia = 8, + ssl_calg_seed = 9, + ssl_calg_aes_gcm = 10, + ssl_calg_chacha20 = 11 +} SSLCipherAlgorithm; + +typedef enum { + ssl_mac_null = 0, + ssl_mac_md5 = 1, + ssl_mac_sha = 2, + ssl_hmac_md5 = 3, /* TLS HMAC version of mac_md5 */ + ssl_hmac_sha = 4, /* TLS HMAC version of mac_sha */ + ssl_hmac_sha256 = 5, + ssl_mac_aead = 6, + ssl_hmac_sha384 = 7 +} SSLMACAlgorithm; + +typedef enum { + ssl_compression_null = 0, + ssl_compression_deflate = 1 /* RFC 3749 */ +} SSLCompressionMethod; + +typedef enum { + ssl_grp_ec_sect163k1 = 1, + ssl_grp_ec_sect163r1 = 2, + ssl_grp_ec_sect163r2 = 3, + ssl_grp_ec_sect193r1 = 4, + ssl_grp_ec_sect193r2 = 5, + ssl_grp_ec_sect233k1 = 6, + ssl_grp_ec_sect233r1 = 7, + ssl_grp_ec_sect239k1 = 8, + ssl_grp_ec_sect283k1 = 9, + ssl_grp_ec_sect283r1 = 10, + ssl_grp_ec_sect409k1 = 11, + ssl_grp_ec_sect409r1 = 12, + ssl_grp_ec_sect571k1 = 13, + ssl_grp_ec_sect571r1 = 14, + ssl_grp_ec_secp160k1 = 15, + ssl_grp_ec_secp160r1 = 16, + ssl_grp_ec_secp160r2 = 17, + ssl_grp_ec_secp192k1 = 18, + ssl_grp_ec_secp192r1 = 19, + ssl_grp_ec_secp224k1 = 20, + ssl_grp_ec_secp224r1 = 21, + ssl_grp_ec_secp256k1 = 22, + ssl_grp_ec_secp256r1 = 23, + ssl_grp_ec_secp384r1 = 24, + ssl_grp_ec_secp521r1 = 25, + ssl_grp_ec_curve25519 = 29, /* RFC4492 */ + ssl_grp_ffdhe_2048 = 256, /* RFC7919 */ + ssl_grp_ffdhe_3072 = 257, + ssl_grp_ffdhe_4096 = 258, + ssl_grp_ffdhe_6144 = 259, + ssl_grp_ffdhe_8192 = 260, + ssl_grp_none = 65537, /* special value */ + ssl_grp_ffdhe_custom = 65538 /* special value */ +} SSLNamedGroup; + +typedef struct SSLExtraServerCertDataStr { + /* When this struct is passed to SSL_ConfigServerCert, and authType is set + * to a value other than ssl_auth_null, this limits the use of the key to + * the type defined; otherwise, the certificate is configured for all + * compatible types. */ + SSLAuthType authType; + /* The remainder of the certificate chain. */ + const CERTCertificateList* certChain; + /* A set of one or more stapled OCSP responses for the certificate. This is + * used to generate the OCSP stapling answer provided by the server. */ + const SECItemArray* stapledOCSPResponses; + /* A serialized sign_certificate_timestamp extension, used to answer + * requests from clients for this data. */ + const SECItem* signedCertTimestamps; +} SSLExtraServerCertData; + +typedef struct SSLChannelInfoStr { + /* On return, SSL_GetChannelInfo sets |length| to the smaller of + * the |len| argument and the length of the struct used by NSS. + * Callers must ensure the application uses a version of NSS that + * isn't older than the version used at compile time. */ + PRUint32 length; + PRUint16 protocolVersion; + PRUint16 cipherSuite; + + /* server authentication info */ + PRUint32 authKeyBits; + + /* key exchange algorithm info */ + PRUint32 keaKeyBits; + + /* session info */ + PRUint32 creationTime; /* seconds since Jan 1, 1970 */ + PRUint32 lastAccessTime; /* seconds since Jan 1, 1970 */ + PRUint32 expirationTime; /* seconds since Jan 1, 1970 */ + PRUint32 sessionIDLength; /* up to 32 */ + PRUint8 sessionID[32]; + + /* The following fields are added in NSS 3.12.5. */ + + /* compression method info */ + const char* compressionMethodName; + SSLCompressionMethod compressionMethod; + + /* The following fields are added in NSS 3.21. + * This field only has meaning in TLS < 1.3 and will be set to + * PR_FALSE in TLS 1.3. + */ + PRBool extendedMasterSecretUsed; + + /* The following fields were added in NSS 3.25. + * This field only has meaning in TLS >= 1.3, and indicates on the + * client side that the server accepted early (0-RTT) data. + */ + PRBool earlyDataAccepted; + + /* The following fields were added in NSS 3.28. */ + /* These fields have the same meaning as in SSLCipherSuiteInfo. */ + SSLKEAType keaType; + SSLNamedGroup keaGroup; + SSLCipherAlgorithm symCipher; + SSLMACAlgorithm macAlgorithm; + SSLAuthType authType; + SSLSignatureScheme signatureScheme; + + /* When adding new fields to this structure, please document the + * NSS version in which they were added. */ +} SSLChannelInfo; + +/* Preliminary channel info */ +#define ssl_preinfo_version (1U << 0) +#define ssl_preinfo_cipher_suite (1U << 1) +#define ssl_preinfo_all (ssl_preinfo_version | ssl_preinfo_cipher_suite) + +typedef struct SSLPreliminaryChannelInfoStr { + /* On return, SSL_GetPreliminaryChannelInfo sets |length| to the smaller of + * the |len| argument and the length of the struct used by NSS. + * Callers must ensure the application uses a version of NSS that + * isn't older than the version used at compile time. */ + PRUint32 length; + /* A bitfield over SSLPreliminaryValueSet that describes which + * preliminary values are set (see ssl_preinfo_*). */ + PRUint32 valuesSet; + /* Protocol version: test (valuesSet & ssl_preinfo_version) */ + PRUint16 protocolVersion; + /* Cipher suite: test (valuesSet & ssl_preinfo_cipher_suite) */ + PRUint16 cipherSuite; + + /* When adding new fields to this structure, please document the + * NSS version in which they were added. */ +} SSLPreliminaryChannelInfo; + +typedef struct SSLCipherSuiteInfoStr { + /* On return, SSL_GetCipherSuitelInfo sets |length| to the smaller of + * the |len| argument and the length of the struct used by NSS. + * Callers must ensure the application uses a version of NSS that + * isn't older than the version used at compile time. */ + PRUint16 length; + PRUint16 cipherSuite; + + /* Cipher Suite Name */ + const char* cipherSuiteName; + + /* server authentication info */ + const char* authAlgorithmName; + SSLAuthType authAlgorithm; /* deprecated, use |authType| */ + + /* key exchange algorithm info */ + const char* keaTypeName; + SSLKEAType keaType; + + /* symmetric encryption info */ + const char* symCipherName; + SSLCipherAlgorithm symCipher; + PRUint16 symKeyBits; + PRUint16 symKeySpace; + PRUint16 effectiveKeyBits; + + /* MAC info */ + /* AEAD ciphers don't have a MAC. For an AEAD cipher, macAlgorithmName + * is "AEAD", macAlgorithm is ssl_mac_aead, and macBits is the length in + * bits of the authentication tag. */ + const char* macAlgorithmName; + SSLMACAlgorithm macAlgorithm; + PRUint16 macBits; + + PRUintn isFIPS : 1; + PRUintn isExportable : 1; /* deprecated, don't use */ + PRUintn nonStandard : 1; + PRUintn reservedBits : 29; + + /* The following fields were added in NSS 3.24. */ + /* This reports the correct authentication type for the cipher suite, use + * this instead of |authAlgorithm|. */ + SSLAuthType authType; + + /* When adding new fields to this structure, please document the + * NSS version in which they were added. */ +} SSLCipherSuiteInfo; + +typedef enum { + ssl_variant_stream = 0, + ssl_variant_datagram = 1 +} SSLProtocolVariant; + +typedef struct SSLVersionRangeStr { + PRUint16 min; + PRUint16 max; +} SSLVersionRange; + +typedef enum { + SSL_sni_host_name = 0, + SSL_sni_type_total +} SSLSniNameType; + +/* Supported extensions. */ +/* Update SSL_MAX_EXTENSIONS whenever a new extension type is added. */ +typedef enum { + ssl_server_name_xtn = 0, + ssl_cert_status_xtn = 5, + ssl_supported_groups_xtn = 10, + ssl_ec_point_formats_xtn = 11, + ssl_signature_algorithms_xtn = 13, + ssl_use_srtp_xtn = 14, + ssl_app_layer_protocol_xtn = 16, + /* signed_certificate_timestamp extension, RFC 6962 */ + ssl_signed_cert_timestamp_xtn = 18, + ssl_padding_xtn = 21, + ssl_extended_master_secret_xtn = 23, + ssl_session_ticket_xtn = 35, + ssl_tls13_key_share_xtn = 40, + ssl_tls13_pre_shared_key_xtn = 41, + ssl_tls13_early_data_xtn = 42, + ssl_tls13_supported_versions_xtn = 43, + ssl_tls13_cookie_xtn = 44, + ssl_tls13_psk_key_exchange_modes_xtn = 45, + ssl_tls13_ticket_early_data_info_xtn = 46, + ssl_next_proto_nego_xtn = 13172, + ssl_renegotiation_info_xtn = 0xff01, + ssl_tls13_short_header_xtn = 0xff03 +} SSLExtensionType; + +/* This is the old name for the supported_groups extensions. */ +#define ssl_elliptic_curves_xtn ssl_supported_groups_xtn + +/* SSL_MAX_EXTENSIONS doesn't include ssl_padding_xtn. It includes the maximum + * number of extensions that are supported for any single message type. That + * is, a ClientHello; ServerHello and TLS 1.3 NewSessionTicket and + * HelloRetryRequest extensions are smaller. */ +#define SSL_MAX_EXTENSIONS 19 + +/* Deprecated */ +typedef enum { + ssl_dhe_group_none = 0, + ssl_ff_dhe_2048_group = 1, + ssl_ff_dhe_3072_group = 2, + ssl_ff_dhe_4096_group = 3, + ssl_ff_dhe_6144_group = 4, + ssl_ff_dhe_8192_group = 5, + ssl_dhe_group_max +} SSLDHEGroupType; + +#endif /* __sslt_h_ */ diff --git a/security/nss/lib/ssl/ssltrace.c b/security/nss/lib/ssl/ssltrace.c new file mode 100644 index 000000000..b1fdde790 --- /dev/null +++ b/security/nss/lib/ssl/ssltrace.c @@ -0,0 +1,114 @@ +/* + * Functions to trace SSL protocol behavior in DEBUG builds. + * + * This Source Code Form is subject to the terms of the Mozilla Public + * License, v. 2.0. If a copy of the MPL was not distributed with this + * file, You can obtain one at http://mozilla.org/MPL/2.0/. */ +#include <stdarg.h> +#include "cert.h" +#include "pk11func.h" +#include "ssl.h" +#include "sslimpl.h" +#include "sslproto.h" +#include "prprf.h" + +#if defined(DEBUG) || defined(TRACE) +static const char *hex = "0123456789abcdef"; + +static const char printable[257] = { + "................" /* 0x */ + "................" /* 1x */ + " !\"#$%&'()*+,-./" /* 2x */ + "0123456789:;<=>?" /* 3x */ + "@ABCDEFGHIJKLMNO" /* 4x */ + "PQRSTUVWXYZ[\\]^_" /* 5x */ + "`abcdefghijklmno" /* 6x */ + "pqrstuvwxyz{|}~." /* 7x */ + "................" /* 8x */ + "................" /* 9x */ + "................" /* ax */ + "................" /* bx */ + "................" /* cx */ + "................" /* dx */ + "................" /* ex */ + "................" /* fx */ +}; + +void +ssl_PrintBuf(const sslSocket *ss, const char *msg, const void *vp, int len) +{ + const unsigned char *cp = (const unsigned char *)vp; + char buf[80]; + char *bp; + char *ap; + + if (ss) { + SSL_TRACE(("%d: SSL[%d]: %s [Len: %d]", SSL_GETPID(), ss->fd, + msg, len)); + } else { + SSL_TRACE(("%d: SSL: %s [Len: %d]", SSL_GETPID(), msg, len)); + } + + if (!cp) { + SSL_TRACE((" <NULL>")); + return; + } + + memset(buf, ' ', sizeof buf); + bp = buf; + ap = buf + 50; + while (--len >= 0) { + unsigned char ch = *cp++; + *bp++ = hex[(ch >> 4) & 0xf]; + *bp++ = hex[ch & 0xf]; + *bp++ = ' '; + *ap++ = printable[ch]; + if (ap - buf >= 66) { + *ap = 0; + SSL_TRACE((" %s", buf)); + memset(buf, ' ', sizeof buf); + bp = buf; + ap = buf + 50; + } + } + if (bp > buf) { + *ap = 0; + SSL_TRACE((" %s", buf)); + } +} + +void +ssl_Trace(const char *format, ...) +{ + char buf[2000]; + va_list args; + + if (ssl_trace_iob) { + va_start(args, format); + PR_vsnprintf(buf, sizeof(buf), format, args); + va_end(args); + + fputs(buf, ssl_trace_iob); + fputs("\n", ssl_trace_iob); + } +} + +void +ssl_PrintKey(const sslSocket *ss, const char *msg, PK11SymKey *key) +{ + SECStatus rv; + SECItem *rawkey; + + rv = PK11_ExtractKeyValue(key); + if (rv != SECSuccess) { + ssl_Trace("Could not extract key for %s", msg); + return; + } + rawkey = PK11_GetKeyData(key); + if (!rawkey) { + ssl_Trace("Could not extract key for %s", msg); + return; + } + ssl_PrintBuf(ss, msg, rawkey->data, rawkey->len); +} +#endif diff --git a/security/nss/lib/ssl/sslver.c b/security/nss/lib/ssl/sslver.c new file mode 100644 index 000000000..666e25922 --- /dev/null +++ b/security/nss/lib/ssl/sslver.c @@ -0,0 +1,18 @@ +/* This Source Code Form is subject to the terms of the Mozilla Public + * License, v. 2.0. If a copy of the MPL was not distributed with this + * file, You can obtain one at http://mozilla.org/MPL/2.0/. */ + +/* Library identity and versioning */ + +#include "nss.h" + +#if defined(DEBUG) +#define _DEBUG_STRING " (debug)" +#else +#define _DEBUG_STRING "" +#endif + +/* + * Version information + */ +const char __nss_ssl_version[] = "Version: NSS " NSS_VERSION _DEBUG_STRING; diff --git a/security/nss/lib/ssl/tls13con.c b/security/nss/lib/ssl/tls13con.c new file mode 100644 index 000000000..c6a584748 --- /dev/null +++ b/security/nss/lib/ssl/tls13con.c @@ -0,0 +1,4512 @@ +/* -*- Mode: C; tab-width: 8; indent-tabs-mode: nil; c-basic-offset: 4 -*- */ +/* + * TLS 1.3 Protocol + * + * This Source Code Form is subject to the terms of the Mozilla Public + * License, v. 2.0. If a copy of the MPL was not distributed with this + * file, You can obtain one at http://mozilla.org/MPL/2.0/. */ + +#include "stdarg.h" +#include "cert.h" +#include "ssl.h" +#include "keyhi.h" +#include "pk11func.h" +#include "prerr.h" +#include "secitem.h" +#include "secmod.h" +#include "sslimpl.h" +#include "sslproto.h" +#include "sslerr.h" +#include "tls13hkdf.h" +#include "tls13con.h" +#include "tls13exthandle.h" + +typedef enum { + TrafficKeyEarlyApplicationData, + TrafficKeyHandshake, + TrafficKeyApplicationData +} TrafficKeyType; + +typedef enum { + CipherSpecRead, + CipherSpecWrite, +} CipherSpecDirection; + +static SECStatus tls13_SetCipherSpec(sslSocket *ss, TrafficKeyType type, + CipherSpecDirection install, + PRBool deleteSecret); +static SECStatus tls13_AESGCM( + ssl3KeyMaterial *keys, + PRBool doDecrypt, + unsigned char *out, int *outlen, int maxout, + const unsigned char *in, int inlen, + const unsigned char *additionalData, int additionalDataLen); +static SECStatus tls13_ChaCha20Poly1305( + ssl3KeyMaterial *keys, + PRBool doDecrypt, + unsigned char *out, int *outlen, int maxout, + const unsigned char *in, int inlen, + const unsigned char *additionalData, int additionalDataLen); +static SECStatus tls13_SendServerHelloSequence(sslSocket *ss); +static SECStatus tls13_SendEncryptedExtensions(sslSocket *ss); +static void tls13_SetKeyExchangeType(sslSocket *ss, const sslNamedGroupDef *group); +static SECStatus tls13_HandleClientKeyShare(sslSocket *ss, + TLS13KeyShareEntry *peerShare); +static SECStatus tls13_SendHelloRetryRequest(sslSocket *ss, + const sslNamedGroupDef *selectedGroup); + +static SECStatus tls13_HandleServerKeyShare(sslSocket *ss); +static SECStatus tls13_HandleEncryptedExtensions(sslSocket *ss, SSL3Opaque *b, + PRUint32 length); +static SECStatus tls13_SendCertificate(sslSocket *ss); +static SECStatus tls13_HandleCertificate( + sslSocket *ss, SSL3Opaque *b, PRUint32 length); +static SECStatus tls13_HandleCertificateRequest(sslSocket *ss, SSL3Opaque *b, + PRUint32 length); +static SECStatus +tls13_SendCertificateVerify(sslSocket *ss, SECKEYPrivateKey *privKey); +static SECStatus tls13_HandleCertificateVerify( + sslSocket *ss, SSL3Opaque *b, PRUint32 length, + SSL3Hashes *hashes); +static SECStatus tls13_RecoverWrappedSharedSecret(sslSocket *ss, + sslSessionID *sid); +static SECStatus +tls13_DeriveSecret(sslSocket *ss, PK11SymKey *key, + const char *prefix, + const char *suffix, + const SSL3Hashes *hashes, + PK11SymKey **dest); +static void tls13_SetNullCipherSpec(sslSocket *ss, ssl3CipherSpec **specp); +static SECStatus tls13_SendEndOfEarlyData(sslSocket *ss); +static SECStatus tls13_SendFinished(sslSocket *ss, PK11SymKey *baseKey); +static SECStatus tls13_ComputePskBinderHash(sslSocket *ss, + unsigned long prefixLength, + SSL3Hashes *hashes); +static SECStatus tls13_VerifyFinished(sslSocket *ss, SSL3HandshakeType message, + PK11SymKey *secret, + SSL3Opaque *b, PRUint32 length, + const SSL3Hashes *hashes); +static SECStatus tls13_ClientHandleFinished(sslSocket *ss, + SSL3Opaque *b, PRUint32 length, + const SSL3Hashes *hashes); +static SECStatus tls13_ServerHandleFinished(sslSocket *ss, + SSL3Opaque *b, PRUint32 length, + const SSL3Hashes *hashes); +static SECStatus tls13_HandleNewSessionTicket(sslSocket *ss, SSL3Opaque *b, + PRUint32 length); +static SECStatus tls13_ComputeHandshakeHashes(sslSocket *ss, + SSL3Hashes *hashes); +static SECStatus tls13_ComputeEarlySecrets(sslSocket *ss); +static SECStatus tls13_ComputeHandshakeSecrets(sslSocket *ss); +static SECStatus tls13_ComputeApplicationSecrets(sslSocket *ss); +static SECStatus tls13_ComputeFinalSecrets(sslSocket *ss); +static SECStatus tls13_ComputeFinished( + sslSocket *ss, PK11SymKey *baseKey, const SSL3Hashes *hashes, + PRBool sending, PRUint8 *output, unsigned int *outputLen, + unsigned int maxOutputLen); +static SECStatus tls13_SendClientSecondRound(sslSocket *ss); +static SECStatus tls13_FinishHandshake(sslSocket *ss); + +const char kHkdfLabelClient[] = "client"; +const char kHkdfLabelServer[] = "server"; +const char kHkdfLabelPskBinderKey[] = "resumption psk binder key"; +const char kHkdfLabelEarlyTrafficSecret[] = "early traffic secret"; +const char kHkdfLabelEarlyExporterSecret[] = "early exporter master secret"; +const char kHkdfLabelHandshakeTrafficSecret[] = "handshake traffic secret"; +const char kHkdfLabelApplicationTrafficSecret[] = "application traffic secret"; +const char kHkdfLabelFinishedSecret[] = "finished"; +const char kHkdfLabelResumptionMasterSecret[] = "resumption master secret"; +const char kHkdfLabelExporterMasterSecret[] = "exporter master secret"; +const char kHkdfPurposeKey[] = "key"; +const char kHkdfPurposeIv[] = "iv"; + +#define TRAFFIC_SECRET(ss, dir, name) ((ss->sec.isServer ^ \ + (dir == CipherSpecWrite)) \ + ? ss->ssl3.hs.client##name \ + : ss->ssl3.hs.server##name) + +const SSL3ProtocolVersion kTlsRecordVersion = SSL_LIBRARY_VERSION_TLS_1_0; +const SSL3ProtocolVersion kDtlsRecordVersion = SSL_LIBRARY_VERSION_TLS_1_1; + +/* Belt and suspenders in case we ever add a TLS 1.4. */ +PR_STATIC_ASSERT(SSL_LIBRARY_VERSION_MAX_SUPPORTED <= + SSL_LIBRARY_VERSION_TLS_1_3); + +/* Use this instead of FATAL_ERROR when an alert isn't possible. */ +#define LOG_ERROR(ss, prError) \ + do { \ + SSL_TRC(3, ("%d: TLS13[%d]: fatal error %d in %s (%s:%d)", \ + SSL_GETPID(), ss->fd, prError, __func__, __FILE__, __LINE__)); \ + PORT_SetError(prError); \ + } while (0) + +/* Log an error and generate an alert because something is irreparably wrong. */ +#define FATAL_ERROR(ss, prError, desc) \ + do { \ + LOG_ERROR(ss, prError); \ + tls13_FatalError(ss, prError, desc); \ + } while (0) + +void +tls13_FatalError(sslSocket *ss, PRErrorCode prError, SSL3AlertDescription desc) +{ + PORT_Assert(desc != internal_error); /* These should never happen */ + (void)SSL3_SendAlert(ss, alert_fatal, desc); + PORT_SetError(prError); +} + +#ifdef TRACE +#define STATE_CASE(a) \ + case a: \ + return #a +static char * +tls13_HandshakeState(SSL3WaitState st) +{ + switch (st) { + STATE_CASE(wait_client_hello); + STATE_CASE(wait_client_cert); + STATE_CASE(wait_cert_verify); + STATE_CASE(wait_finished); + STATE_CASE(wait_server_hello); + STATE_CASE(wait_server_cert); + STATE_CASE(wait_cert_request); + STATE_CASE(wait_encrypted_extensions); + STATE_CASE(idle_handshake); + default: + break; + } + PORT_Assert(0); + return "unknown"; +} +#endif + +#define TLS13_WAIT_STATE_MASK 0x80 + +#define TLS13_BASE_WAIT_STATE(ws) (ws & ~TLS13_WAIT_STATE_MASK) +/* We don't mask idle_handshake because other parts of the code use it*/ +#define TLS13_WAIT_STATE(ws) (((ws == idle_handshake) || (ws == wait_server_hello)) ? ws : ws | TLS13_WAIT_STATE_MASK) +#define TLS13_CHECK_HS_STATE(ss, err, ...) \ + tls13_CheckHsState(ss, err, #err, __func__, __FILE__, __LINE__, \ + __VA_ARGS__, \ + wait_invalid) +void +tls13_SetHsState(sslSocket *ss, SSL3WaitState ws, + const char *func, const char *file, int line) +{ +#ifdef TRACE + const char *new_state_name = + tls13_HandshakeState(ws); + + SSL_TRC(3, ("%d: TLS13[%d]: %s state change from %s->%s in %s (%s:%d)", + SSL_GETPID(), ss->fd, SSL_ROLE(ss), + tls13_HandshakeState(TLS13_BASE_WAIT_STATE(ss->ssl3.hs.ws)), + new_state_name, + func, file, line)); +#endif + + ss->ssl3.hs.ws = TLS13_WAIT_STATE(ws); +} + +static PRBool +tls13_InHsStateV(sslSocket *ss, va_list ap) +{ + SSL3WaitState ws; + + while ((ws = va_arg(ap, SSL3WaitState)) != wait_invalid) { + if (TLS13_WAIT_STATE(ws) == ss->ssl3.hs.ws) { + return PR_TRUE; + } + } + return PR_FALSE; +} + +PRBool +tls13_InHsState(sslSocket *ss, ...) +{ + PRBool found; + va_list ap; + + va_start(ap, ss); + found = tls13_InHsStateV(ss, ap); + va_end(ap); + + return found; +} + +static SECStatus +tls13_CheckHsState(sslSocket *ss, int err, const char *error_name, + const char *func, const char *file, int line, + ...) +{ + va_list ap; + va_start(ap, line); + if (tls13_InHsStateV(ss, ap)) { + va_end(ap); + return SECSuccess; + } + va_end(ap); + + SSL_TRC(3, ("%d: TLS13[%d]: error %s state is (%s) at %s (%s:%d)", + SSL_GETPID(), ss->fd, + error_name, + tls13_HandshakeState(TLS13_BASE_WAIT_STATE(ss->ssl3.hs.ws)), + func, file, line)); + tls13_FatalError(ss, err, unexpected_message); + return SECFailure; +} + +SSLHashType +tls13_GetHashForCipherSuite(ssl3CipherSuite suite) +{ + const ssl3CipherSuiteDef *cipherDef = + ssl_LookupCipherSuiteDef(suite); + PORT_Assert(cipherDef); + if (!cipherDef) { + return ssl_hash_none; + } + return cipherDef->prf_hash; +} + +SSLHashType +tls13_GetHash(const sslSocket *ss) +{ + /* All TLS 1.3 cipher suites must have an explict PRF hash. */ + PORT_Assert(ss->ssl3.hs.suite_def->prf_hash != ssl_hash_none); + return ss->ssl3.hs.suite_def->prf_hash; +} + +unsigned int +tls13_GetHashSizeForHash(SSLHashType hash) +{ + switch (hash) { + case ssl_hash_sha256: + return 32; + case ssl_hash_sha384: + return 48; + default: + PORT_Assert(0); + } + return 32; +} + +unsigned int +tls13_GetHashSize(const sslSocket *ss) +{ + return tls13_GetHashSizeForHash(tls13_GetHash(ss)); +} + +static CK_MECHANISM_TYPE +tls13_GetHkdfMechanismForHash(SSLHashType hash) +{ + switch (hash) { + case ssl_hash_sha256: + return CKM_NSS_HKDF_SHA256; + case ssl_hash_sha384: + return CKM_NSS_HKDF_SHA384; + default: + PORT_Assert(0); + } + return CKM_NSS_HKDF_SHA256; +} + +CK_MECHANISM_TYPE +tls13_GetHkdfMechanism(sslSocket *ss) +{ + return tls13_GetHkdfMechanismForHash(tls13_GetHash(ss)); +} + +static CK_MECHANISM_TYPE +tls13_GetHmacMechanism(sslSocket *ss) +{ + switch (tls13_GetHash(ss)) { + case ssl_hash_sha256: + return CKM_SHA256_HMAC; + case ssl_hash_sha384: + return CKM_SHA384_HMAC; + default: + PORT_Assert(0); + } + return CKM_SHA256_HMAC; +} + +SECStatus +tls13_CreateKeyShare(sslSocket *ss, const sslNamedGroupDef *groupDef) +{ + SECStatus rv; + sslEphemeralKeyPair *keyPair = NULL; + const ssl3DHParams *params; + + PORT_Assert(groupDef); + switch (groupDef->keaType) { + case ssl_kea_ecdh: + rv = ssl_CreateECDHEphemeralKeyPair(ss, groupDef, &keyPair); + if (rv != SECSuccess) { + return SECFailure; + } + break; + case ssl_kea_dh: + params = ssl_GetDHEParams(groupDef); + PORT_Assert(params->name != ssl_grp_ffdhe_custom); + rv = ssl_CreateDHEKeyPair(groupDef, params, &keyPair); + if (rv != SECSuccess) { + return SECFailure; + } + break; + default: + PORT_Assert(0); + PORT_SetError(SEC_ERROR_LIBRARY_FAILURE); + return SECFailure; + } + + PR_APPEND_LINK(&keyPair->link, &ss->ephemeralKeyPairs); + return rv; +} + +SECStatus +SSL_SendAdditionalKeyShares(PRFileDesc *fd, unsigned int count) +{ + sslSocket *ss = ssl_FindSocket(fd); + if (!ss) { + PORT_SetError(SEC_ERROR_INVALID_ARGS); + return SECFailure; + } + + ss->additionalShares = count; + return SECSuccess; +} + +/* + * Generate shares for ECDHE and FFDHE. This picks the first enabled group of + * the requisite type and creates a share for that. + * + * Called from ssl3_SendClientHello. + */ +SECStatus +tls13_SetupClientHello(sslSocket *ss) +{ + unsigned int i; + SSL3Statistics *ssl3stats = SSL_GetStatistics(); + NewSessionTicket *session_ticket = NULL; + sslSessionID *sid = ss->sec.ci.sid; + unsigned int numShares = 0; + + PORT_Assert(ss->opt.noLocks || ssl_HaveSSL3HandshakeLock(ss)); + PORT_Assert(ss->opt.noLocks || ssl_HaveXmitBufLock(ss)); + PORT_Assert(PR_CLIST_IS_EMPTY(&ss->ephemeralKeyPairs)); + + /* Select the first enabled group. + * TODO(ekr@rtfm.com): be smarter about offering the group + * that the other side negotiated if we are resuming. */ + for (i = 0; i < SSL_NAMED_GROUP_COUNT; ++i) { + SECStatus rv; + if (!ss->namedGroupPreferences[i]) { + continue; + } + rv = tls13_CreateKeyShare(ss, ss->namedGroupPreferences[i]); + if (rv != SECSuccess) { + return SECFailure; + } + if (++numShares > ss->additionalShares) { + break; + } + } + + if (PR_CLIST_IS_EMPTY(&ss->ephemeralKeyPairs)) { + PORT_SetError(SSL_ERROR_NO_CIPHERS_SUPPORTED); + return SECFailure; + } + + /* Below here checks if we can do stateless resumption. */ + if (sid->cached == never_cached || + sid->version < SSL_LIBRARY_VERSION_TLS_1_3) { + return SECSuccess; + } + + /* The caller must be holding sid->u.ssl3.lock for reading. */ + session_ticket = &sid->u.ssl3.locked.sessionTicket; + PORT_Assert(session_ticket && session_ticket->ticket.data); + + if (session_ticket->ticket_lifetime_hint == 0 || + (session_ticket->ticket_lifetime_hint + + session_ticket->received_timestamp > + ssl_Time())) { + ss->statelessResume = PR_TRUE; + } + + if (ss->statelessResume) { + SECStatus rv; + + PORT_Assert(ss->sec.ci.sid); + rv = tls13_RecoverWrappedSharedSecret(ss, ss->sec.ci.sid); + if (rv != SECSuccess) { + FATAL_ERROR(ss, SEC_ERROR_LIBRARY_FAILURE, internal_error); + SSL_AtomicIncrementLong(&ssl3stats->sch_sid_cache_not_ok); + ss->sec.uncache(ss->sec.ci.sid); + ssl_FreeSID(ss->sec.ci.sid); + ss->sec.ci.sid = NULL; + return SECFailure; + } + + rv = ssl3_SetCipherSuite(ss, ss->sec.ci.sid->u.ssl3.cipherSuite, PR_FALSE); + if (rv != SECSuccess) { + FATAL_ERROR(ss, PORT_GetError(), internal_error); + return SECFailure; + } + + rv = tls13_ComputeEarlySecrets(ss); + if (rv != SECSuccess) { + FATAL_ERROR(ss, SEC_ERROR_LIBRARY_FAILURE, internal_error); + return SECFailure; + } + } + + return SECSuccess; +} + +static SECStatus +tls13_ImportDHEKeyShare(sslSocket *ss, SECKEYPublicKey *peerKey, + SSL3Opaque *b, PRUint32 length, + SECKEYPublicKey *pubKey) +{ + SECStatus rv; + SECItem publicValue = { siBuffer, NULL, 0 }; + + publicValue.data = b; + publicValue.len = length; + if (!ssl_IsValidDHEShare(&pubKey->u.dh.prime, &publicValue)) { + PORT_SetError(SSL_ERROR_RX_MALFORMED_DHE_KEY_SHARE); + return SECFailure; + } + + peerKey->keyType = dhKey; + rv = SECITEM_CopyItem(peerKey->arena, &peerKey->u.dh.prime, + &pubKey->u.dh.prime); + if (rv != SECSuccess) + return SECFailure; + rv = SECITEM_CopyItem(peerKey->arena, &peerKey->u.dh.base, + &pubKey->u.dh.base); + if (rv != SECSuccess) + return SECFailure; + rv = SECITEM_CopyItem(peerKey->arena, &peerKey->u.dh.publicValue, + &publicValue); + if (rv != SECSuccess) + return SECFailure; + + return SECSuccess; +} + +static SECStatus +tls13_HandleKeyShare(sslSocket *ss, + TLS13KeyShareEntry *entry, + sslKeyPair *keyPair) +{ + PORTCheapArenaPool arena; + SECKEYPublicKey *peerKey; + CK_MECHANISM_TYPE mechanism; + PRErrorCode errorCode; + SECStatus rv; + + PORT_InitCheapArena(&arena, DER_DEFAULT_CHUNKSIZE); + peerKey = PORT_ArenaZNew(&arena.arena, SECKEYPublicKey); + if (peerKey == NULL) { + goto loser; + } + peerKey->arena = &arena.arena; + peerKey->pkcs11Slot = NULL; + peerKey->pkcs11ID = CK_INVALID_HANDLE; + + switch (entry->group->keaType) { + case ssl_kea_ecdh: + rv = ssl_ImportECDHKeyShare(ss, peerKey, + entry->key_exchange.data, + entry->key_exchange.len, + entry->group); + mechanism = CKM_ECDH1_DERIVE; + break; + case ssl_kea_dh: + rv = tls13_ImportDHEKeyShare(ss, peerKey, + entry->key_exchange.data, + entry->key_exchange.len, + keyPair->pubKey); + mechanism = CKM_DH_PKCS_DERIVE; + break; + default: + PORT_Assert(0); + goto loser; + } + if (rv != SECSuccess) { + goto loser; + } + + ss->ssl3.hs.dheSecret = PK11_PubDeriveWithKDF( + keyPair->privKey, peerKey, PR_FALSE, NULL, NULL, mechanism, + tls13_GetHkdfMechanism(ss), CKA_DERIVE, 0, CKD_NULL, NULL, NULL); + if (!ss->ssl3.hs.dheSecret) { + ssl_MapLowLevelError(SSL_ERROR_KEY_EXCHANGE_FAILURE); + goto loser; + } + PORT_DestroyCheapArena(&arena); + return SECSuccess; + +loser: + PORT_DestroyCheapArena(&arena); + errorCode = PORT_GetError(); /* don't overwrite the error code */ + tls13_FatalError(ss, errorCode, illegal_parameter); + return SECFailure; +} + +SECStatus +tls13_HandlePostHelloHandshakeMessage(sslSocket *ss, SSL3Opaque *b, + PRUint32 length, SSL3Hashes *hashesPtr) +{ + if (ss->sec.isServer && ss->ssl3.hs.zeroRttIgnore != ssl_0rtt_ignore_none) { + SSL_TRC(3, ("%d: TLS13[%d]: %s successfully decrypted handshake after" + "failed 0-RTT", + SSL_GETPID(), ss->fd)); + ss->ssl3.hs.zeroRttIgnore = ssl_0rtt_ignore_none; + } + + /* TODO(ekr@rtfm.com): Would it be better to check all the states here? */ + switch (ss->ssl3.hs.msg_type) { + case certificate: + return tls13_HandleCertificate(ss, b, length); + + case certificate_request: + return tls13_HandleCertificateRequest(ss, b, length); + + case certificate_verify: + if (!hashesPtr) { + FATAL_ERROR(ss, SSL_ERROR_RX_UNEXPECTED_CERT_VERIFY, unexpected_message); + return SECFailure; + } + return tls13_HandleCertificateVerify(ss, b, length, hashesPtr); + + case encrypted_extensions: + return tls13_HandleEncryptedExtensions(ss, b, length); + + case new_session_ticket: + return tls13_HandleNewSessionTicket(ss, b, length); + + case finished: + if (!hashesPtr) { + FATAL_ERROR(ss, SSL_ERROR_RX_UNEXPECTED_FINISHED, unexpected_message); + return SECFailure; + } + if (ss->sec.isServer) { + return tls13_ServerHandleFinished(ss, b, length, hashesPtr); + } else { + return tls13_ClientHandleFinished(ss, b, length, hashesPtr); + } + + default: + FATAL_ERROR(ss, SSL_ERROR_RX_UNKNOWN_HANDSHAKE, unexpected_message); + return SECFailure; + } + + PORT_Assert(0); /* Unreached */ + return SECFailure; +} + +static SECStatus +tls13_RecoverWrappedSharedSecret(sslSocket *ss, sslSessionID *sid) +{ + PK11SymKey *wrapKey; /* wrapping key */ + SECItem wrappedMS = { siBuffer, NULL, 0 }; + SSLHashType hashType; + + SSL_TRC(3, ("%d: TLS13[%d]: recovering static secret (%s)", + SSL_GETPID(), ss->fd, SSL_ROLE(ss))); + if (!sid->u.ssl3.keys.msIsWrapped) { + PORT_Assert(0); /* I think this can't happen. */ + return SECFailure; + } + + /* Now find the hash used as the PRF for the previous handshake. */ + hashType = tls13_GetHashForCipherSuite(sid->u.ssl3.cipherSuite); + + /* If we are the server, we compute the wrapping key, but if we + * are the client, it's coordinates are stored with the ticket. */ + if (ss->sec.isServer) { + const sslServerCert *serverCert; + + serverCert = ssl_FindServerCert(ss, &sid->certType); + PORT_Assert(serverCert); + wrapKey = ssl3_GetWrappingKey(ss, NULL, serverCert, + sid->u.ssl3.masterWrapMech, + ss->pkcs11PinArg); + } else { + PK11SlotInfo *slot = SECMOD_LookupSlot(sid->u.ssl3.masterModuleID, + sid->u.ssl3.masterSlotID); + if (!slot) + return SECFailure; + + wrapKey = PK11_GetWrapKey(slot, + sid->u.ssl3.masterWrapIndex, + sid->u.ssl3.masterWrapMech, + sid->u.ssl3.masterWrapSeries, + ss->pkcs11PinArg); + PK11_FreeSlot(slot); + } + if (!wrapKey) { + return SECFailure; + } + + wrappedMS.data = sid->u.ssl3.keys.wrapped_master_secret; + wrappedMS.len = sid->u.ssl3.keys.wrapped_master_secret_len; + + /* unwrap the "master secret" which is actually RMS. */ + ss->ssl3.hs.resumptionMasterSecret = PK11_UnwrapSymKeyWithFlags( + wrapKey, sid->u.ssl3.masterWrapMech, + NULL, &wrappedMS, + CKM_SSL3_MASTER_KEY_DERIVE, + CKA_DERIVE, + tls13_GetHashSizeForHash(hashType), + CKF_SIGN | CKF_VERIFY); + PK11_FreeSymKey(wrapKey); + if (!ss->ssl3.hs.resumptionMasterSecret) { + return SECFailure; + } + + PRINT_KEY(50, (ss, "Recovered RMS", ss->ssl3.hs.resumptionMasterSecret)); + + return SECSuccess; +} + +/* Key Derivation Functions. + * + * Below is the key schedule from [draft-ietf-tls-tls13]. + * + * * The relevant functions from this file are indicated by tls13_Foo(). + * 0 + * | + * v + * PSK -> HKDF-Extract + * | + * v + * Early Secret ---> Derive-Secret(., "client early traffic secret", + * | ClientHello) + * | = client_early_traffic_secret + * v + * (EC)DHE -> HKDF-Extract + * | + * v + * Handshake Secret + * | + * +---------> Derive-Secret(., "client handshake traffic secret", + * | ClientHello...ServerHello) + * | = client_handshake_traffic_secret + * | + * +---------> Derive-Secret(., "server handshake traffic secret", + * | ClientHello...ServerHello) + * | = server_handshake_traffic_secret + * | + * v + * 0 -> HKDF-Extract + * | + * v + * Master Secret + * | + * +---------> Derive-Secret(., "client application traffic secret", + * | ClientHello...Server Finished) + * | = client_traffic_secret_0 + * | + * +---------> Derive-Secret(., "server application traffic secret", + * | ClientHello...Server Finished) + * | = server_traffic_secret_0 + * | + * +---------> Derive-Secret(., "exporter master secret", + * | ClientHello...Client Finished) + * | = exporter_secret + * | + * +---------> Derive-Secret(., "resumption master secret", + * ClientHello...Client Finished) + * = resumption_secret + * + */ + +static SECStatus +tls13_ComputeEarlySecrets(sslSocket *ss) +{ + SECStatus rv = SECSuccess; + + SSL_TRC(5, ("%d: TLS13[%d]: compute early secrets (%s)", + SSL_GETPID(), ss->fd, SSL_ROLE(ss))); + + /* Extract off the resumptionMasterSecret (if present), else pass the NULL + * resumptionMasterSecret which will be internally translated to zeroes. */ + PORT_Assert(!ss->ssl3.hs.currentSecret); + rv = tls13_HkdfExtract(NULL, ss->ssl3.hs.resumptionMasterSecret, + tls13_GetHash(ss), &ss->ssl3.hs.currentSecret); + if (rv != SECSuccess) { + return SECFailure; + } + + PORT_Assert(ss->statelessResume == (ss->ssl3.hs.resumptionMasterSecret != NULL)); + if (ss->statelessResume) { + PRUint8 buf[1] = { 0 }; + SSL3Hashes hashes; + + PK11_FreeSymKey(ss->ssl3.hs.resumptionMasterSecret); + ss->ssl3.hs.resumptionMasterSecret = NULL; + + rv = PK11_HashBuf(ssl3_HashTypeToOID(tls13_GetHash(ss)), + hashes.u.raw, buf, 0); + if (rv != SECSuccess) { + FATAL_ERROR(ss, SEC_ERROR_LIBRARY_FAILURE, internal_error); + return SECFailure; + } + hashes.len = tls13_GetHashSize(ss); + + rv = tls13_DeriveSecret(ss, ss->ssl3.hs.currentSecret, + NULL, kHkdfLabelPskBinderKey, &hashes, + &ss->ssl3.hs.pskBinderKey); + if (rv != SECSuccess) { + return SECFailure; + } + + rv = tls13_DeriveSecret(ss, ss->ssl3.hs.currentSecret, + NULL, kHkdfLabelEarlyExporterSecret, + &hashes, &ss->ssl3.hs.earlyExporterSecret); + if (rv != SECSuccess) { + return SECFailure; + } + } else { + PORT_Assert(!ss->ssl3.hs.resumptionMasterSecret); + } + + return SECSuccess; +} + +static SECStatus +tls13_ComputeHandshakeSecrets(sslSocket *ss) +{ + SECStatus rv; + PK11SymKey *newSecret = NULL; + + SSL_TRC(5, ("%d: TLS13[%d]: compute handshake secrets (%s)", + SSL_GETPID(), ss->fd, SSL_ROLE(ss))); + + /* First update |currentSecret| to add |dheSecret|, if any. */ + PORT_Assert(ss->ssl3.hs.currentSecret); + PORT_Assert(ss->ssl3.hs.dheSecret); + rv = tls13_HkdfExtract(ss->ssl3.hs.currentSecret, ss->ssl3.hs.dheSecret, + tls13_GetHash(ss), &newSecret); + if (rv != SECSuccess) { + LOG_ERROR(ss, SEC_ERROR_LIBRARY_FAILURE); + return rv; + } + PK11_FreeSymKey(ss->ssl3.hs.dheSecret); + ss->ssl3.hs.dheSecret = NULL; + PK11_FreeSymKey(ss->ssl3.hs.currentSecret); + ss->ssl3.hs.currentSecret = newSecret; + + /* Now compute |*HsTrafficSecret| */ + rv = tls13_DeriveSecret(ss, ss->ssl3.hs.currentSecret, + kHkdfLabelClient, + kHkdfLabelHandshakeTrafficSecret, NULL, + &ss->ssl3.hs.clientHsTrafficSecret); + if (rv != SECSuccess) { + LOG_ERROR(ss, SEC_ERROR_LIBRARY_FAILURE); + return rv; + } + rv = tls13_DeriveSecret(ss, ss->ssl3.hs.currentSecret, + kHkdfLabelServer, + kHkdfLabelHandshakeTrafficSecret, NULL, + &ss->ssl3.hs.serverHsTrafficSecret); + if (rv != SECSuccess) { + LOG_ERROR(ss, SEC_ERROR_LIBRARY_FAILURE); + return rv; + } + + SSL_TRC(5, ("%d: TLS13[%d]: compute master secret (%s)", + SSL_GETPID(), ss->fd, SSL_ROLE(ss))); + + /* Crank HKDF forward to make master secret, which we + * stuff in current secret. */ + rv = tls13_HkdfExtract(ss->ssl3.hs.currentSecret, + NULL, + tls13_GetHash(ss), + &newSecret); + + if (rv != SECSuccess) { + LOG_ERROR(ss, SEC_ERROR_LIBRARY_FAILURE); + return SECFailure; + } + PK11_FreeSymKey(ss->ssl3.hs.currentSecret); + ss->ssl3.hs.currentSecret = newSecret; + + return SECSuccess; +} + +static SECStatus +tls13_ComputeApplicationSecrets(sslSocket *ss) +{ + SECStatus rv; + + rv = tls13_DeriveSecret(ss, ss->ssl3.hs.currentSecret, + kHkdfLabelClient, + kHkdfLabelApplicationTrafficSecret, + NULL, + &ss->ssl3.hs.clientTrafficSecret); + if (rv != SECSuccess) { + return SECFailure; + } + rv = tls13_DeriveSecret(ss, ss->ssl3.hs.currentSecret, + kHkdfLabelServer, + kHkdfLabelApplicationTrafficSecret, + NULL, + &ss->ssl3.hs.serverTrafficSecret); + if (rv != SECSuccess) { + return SECFailure; + } + + rv = tls13_DeriveSecret(ss, ss->ssl3.hs.currentSecret, + NULL, kHkdfLabelExporterMasterSecret, + NULL, &ss->ssl3.hs.exporterSecret); + if (rv != SECSuccess) { + return SECFailure; + } + + return SECSuccess; +} + +static SECStatus +tls13_ComputeFinalSecrets(sslSocket *ss) +{ + SECStatus rv; + PK11SymKey *resumptionMasterSecret = NULL; + + PORT_Assert(!ss->ssl3.crSpec->master_secret); + PORT_Assert(!ss->ssl3.cwSpec->master_secret); + + rv = tls13_DeriveSecret(ss, ss->ssl3.hs.currentSecret, + NULL, kHkdfLabelResumptionMasterSecret, + NULL, &resumptionMasterSecret); + PK11_FreeSymKey(ss->ssl3.hs.currentSecret); + ss->ssl3.hs.currentSecret = NULL; + if (rv != SECSuccess) { + return SECFailure; + } + + /* This is pretty gross. TLS 1.3 uses a number of master secrets: + * The master secret to generate the keys and then the resumption + * master secret for future connections. To make this work without + * refactoring too much of the SSLv3 code, we store the RMS in + * |crSpec->master_secret| and |cwSpec->master_secret|. + */ + ss->ssl3.crSpec->master_secret = resumptionMasterSecret; + ss->ssl3.cwSpec->master_secret = + PK11_ReferenceSymKey(ss->ssl3.crSpec->master_secret); + + return SECSuccess; +} + +static void +tls13_RestoreCipherInfo(sslSocket *ss, sslSessionID *sid) +{ + /* Set these to match the cached value. + * TODO(ekr@rtfm.com): Make a version with the "true" values. + * Bug 1256137. + */ + ss->sec.authType = sid->authType; + ss->sec.authKeyBits = sid->authKeyBits; +} + +/* Check whether resumption-PSK is allowed. */ +static PRBool +tls13_CanResume(sslSocket *ss, const sslSessionID *sid) +{ + const sslServerCert *sc; + + if (!sid) { + return PR_FALSE; + } + + if (sid->version != ss->version) { + return PR_FALSE; + } + + if (tls13_GetHashForCipherSuite(sid->u.ssl3.cipherSuite) != tls13_GetHashForCipherSuite(ss->ssl3.hs.cipher_suite)) { + return PR_FALSE; + } + + /* Server sids don't remember the server cert we previously sent, but they + * do remember the type of certificate we originally used, so we can locate + * it again, provided that the current ssl socket has had its server certs + * configured the same as the previous one. */ + sc = ssl_FindServerCert(ss, &sid->certType); + if (!sc || !sc->serverCert) { + return PR_FALSE; + } + + return PR_TRUE; +} + +static PRBool +tls13_AlpnTagAllowed(const sslSocket *ss, const SECItem *tag) +{ + const unsigned char *data = ss->opt.nextProtoNego.data; + unsigned int length = ss->opt.nextProtoNego.len; + unsigned int offset = 0; + + if (!tag->len) + return PR_TRUE; + + while (offset < length) { + unsigned int taglen = (unsigned int)data[offset]; + if ((taglen == tag->len) && + !PORT_Memcmp(data + offset + 1, tag->data, tag->len)) + return PR_TRUE; + offset += 1 + taglen; + } + + return PR_FALSE; +} + +static PRBool +tls13_CanNegotiateZeroRtt(sslSocket *ss, const sslSessionID *sid) +{ + PORT_Assert(ss->ssl3.hs.zeroRttState == ssl_0rtt_sent); + + if (!sid) + return PR_FALSE; + PORT_Assert(ss->statelessResume); + if (!ss->statelessResume) + return PR_FALSE; + if (ss->ssl3.hs.cipher_suite != sid->u.ssl3.cipherSuite) + return PR_FALSE; + if (!ss->opt.enable0RttData) + return PR_FALSE; + if (!(sid->u.ssl3.locked.sessionTicket.flags & ticket_allow_early_data)) + return PR_FALSE; + if (SECITEM_CompareItem(&ss->xtnData.nextProto, + &sid->u.ssl3.alpnSelection) != 0) + return PR_FALSE; + + return PR_TRUE; +} + +/* Called from tls13_HandleClientHelloPart2 to update the state of 0-RTT handling. + * + * 0-RTT is only permitted if: + * 1. The early data extension was present. + * 2. We are resuming a session. + * 3. The 0-RTT option is set. + * 4. The ticket allowed 0-RTT. + * 5. We negotiated the same ALPN value as in the ticket. + */ +static void +tls13_NegotiateZeroRtt(sslSocket *ss, const sslSessionID *sid) +{ + SSL_TRC(3, ("%d: TLS13[%d]: negotiate 0-RTT %p", + SSL_GETPID(), ss->fd, sid)); + + /* tls13_ServerHandleEarlyDataXtn sets this to ssl_0rtt_sent, so this will + * be ssl_0rtt_none unless early_data is present. */ + if (ss->ssl3.hs.zeroRttState == ssl_0rtt_none) { + return; + } + + /* If we rejected 0-RTT on the first ClientHello, then we can just say that + * there is no 0-RTT for the second. We shouldn't get any more. Reset the + * ignore state so that we treat decryption failure normally. */ + if (ss->ssl3.hs.zeroRttIgnore == ssl_0rtt_ignore_hrr) { + PORT_Assert(ss->ssl3.hs.helloRetry); + ss->ssl3.hs.zeroRttState = ssl_0rtt_none; + ss->ssl3.hs.zeroRttIgnore = ssl_0rtt_ignore_none; + return; + } + + if (!tls13_CanNegotiateZeroRtt(ss, sid)) { + SSL_TRC(3, ("%d: TLS13[%d]: ignore 0-RTT", + SSL_GETPID(), ss->fd)); + ss->ssl3.hs.zeroRttState = ssl_0rtt_ignored; + ss->ssl3.hs.zeroRttIgnore = ssl_0rtt_ignore_trial; + return; + } + + SSL_TRC(3, ("%d: TLS13[%d]: enable 0-RTT", + SSL_GETPID(), ss->fd)); + PORT_Assert(ss->statelessResume); + ss->ssl3.hs.zeroRttState = ssl_0rtt_accepted; + ss->ssl3.hs.zeroRttIgnore = ssl_0rtt_ignore_none; +} + +/* Check if the offered group is acceptable. */ +static PRBool +tls13_isGroupAcceptable(const sslNamedGroupDef *offered, + const sslNamedGroupDef *preferredGroup) +{ + /* We accept epsilon (e) bits around the offered group size. */ + const unsigned int e = 2; + + PORT_Assert(offered); + PORT_Assert(preferredGroup); + + if (offered->bits >= preferredGroup->bits - e && + offered->bits <= preferredGroup->bits + e) { + return PR_TRUE; + } + + return PR_FALSE; +} + +/* Find remote key share for given group and return it. + * Returns NULL if no key share is found. */ +static TLS13KeyShareEntry * +tls13_FindKeyShareEntry(sslSocket *ss, const sslNamedGroupDef *group) +{ + PRCList *cur_p = PR_NEXT_LINK(&ss->xtnData.remoteKeyShares); + while (cur_p != &ss->xtnData.remoteKeyShares) { + TLS13KeyShareEntry *offer = (TLS13KeyShareEntry *)cur_p; + if (offer->group == group) { + return offer; + } + cur_p = PR_NEXT_LINK(cur_p); + } + return NULL; +} + +static SECStatus +tls13_NegotiateKeyExchange(sslSocket *ss, TLS13KeyShareEntry **clientShare) +{ + unsigned int index; + TLS13KeyShareEntry *entry = NULL; + const sslNamedGroupDef *preferredGroup = NULL; + + /* We insist on DHE. */ + if (ss->statelessResume) { + if (!ssl3_ExtensionNegotiated(ss, ssl_tls13_psk_key_exchange_modes_xtn)) { + FATAL_ERROR(ss, SSL_ERROR_MISSING_PSK_KEY_EXCHANGE_MODES, + missing_extension); + return SECFailure; + } + if (!memchr(ss->xtnData.psk_ke_modes.data, tls13_psk_dh_ke, + ss->xtnData.psk_ke_modes.len)) { + SSL_TRC(3, ("%d: TLS13[%d]: client offered PSK without DH", + SSL_GETPID(), ss->fd)); + ss->statelessResume = PR_FALSE; + } + } + + /* Now figure out which key share we like the best out of the + * mutually supported groups, regardless of what the client offered + * for key shares. + */ + if (!ssl3_ExtensionNegotiated(ss, ssl_supported_groups_xtn)) { + FATAL_ERROR(ss, SSL_ERROR_MISSING_SUPPORTED_GROUPS_EXTENSION, + missing_extension); + return SECFailure; + } + + SSL_TRC(3, ("%d: TLS13[%d]: selected KE = %s", + SSL_GETPID(), ss->fd, ss->statelessResume ? "PSK + (EC)DHE" : "(EC)DHE")); + + /* Find the preferred group and an according client key share available. */ + for (index = 0; index < SSL_NAMED_GROUP_COUNT; ++index) { + /* Continue to the next group if this one is not enabled. */ + if (!ss->namedGroupPreferences[index]) { + /* There's a gap in the preferred groups list. Assume this is a group + * that's not supported by the client but preferred by the server. */ + if (preferredGroup) { + entry = NULL; + break; + } + continue; + } + + /* Check if the client sent a key share for this group. */ + entry = tls13_FindKeyShareEntry(ss, ss->namedGroupPreferences[index]); + + if (preferredGroup) { + /* We already found our preferred group but the group didn't have a share. */ + if (entry) { + /* The client sent a key share with group ss->namedGroupPreferences[index] */ + if (tls13_isGroupAcceptable(ss->namedGroupPreferences[index], + preferredGroup)) { + /* This is not the preferred group, but it's acceptable */ + preferredGroup = ss->namedGroupPreferences[index]; + } else { + /* The proposed group is not acceptable. */ + entry = NULL; + } + } + break; + } else { + /* The first enabled group is the preferred group. */ + preferredGroup = ss->namedGroupPreferences[index]; + if (entry) { + break; + } + } + } + + if (!preferredGroup) { + FATAL_ERROR(ss, SSL_ERROR_NO_CYPHER_OVERLAP, handshake_failure); + return SECFailure; + } + SSL_TRC(3, ("%d: TLS13[%d]: group = %d", SSL_GETPID(), ss->fd, + preferredGroup->name)); + + if (!entry) { + return tls13_SendHelloRetryRequest(ss, preferredGroup); + } + + PORT_Assert(preferredGroup == entry->group); + *clientShare = entry; + + return SECSuccess; +} + +SECStatus +tls13_SelectServerCert(sslSocket *ss) +{ + PRCList *cursor; + SECStatus rv; + + if (!ssl3_ExtensionNegotiated(ss, ssl_signature_algorithms_xtn)) { + FATAL_ERROR(ss, SSL_ERROR_MISSING_SIGNATURE_ALGORITHMS_EXTENSION, + missing_extension); + return SECFailure; + } + + /* This picks the first certificate that has: + * a) the right authentication method, and + * b) the right named curve (EC only) + * + * We might want to do some sort of ranking here later. For now, it's all + * based on what order they are configured in. */ + for (cursor = PR_NEXT_LINK(&ss->serverCerts); + cursor != &ss->serverCerts; + cursor = PR_NEXT_LINK(cursor)) { + sslServerCert *cert = (sslServerCert *)cursor; + + if (cert->certType.authType == ssl_auth_rsa_pss || + cert->certType.authType == ssl_auth_rsa_decrypt) { + continue; + } + + rv = ssl_PickSignatureScheme(ss, + cert->serverKeyPair->pubKey, + cert->serverKeyPair->privKey, + ss->xtnData.clientSigSchemes, + ss->xtnData.numClientSigScheme, + PR_FALSE); + if (rv == SECSuccess) { + /* Found one. */ + ss->sec.serverCert = cert; + ss->sec.authType = cert->certType.authType; + ss->ssl3.hs.kea_def_mutable.authKeyType = cert->certType.authType; + ss->sec.authKeyBits = cert->serverKeyBits; + return SECSuccess; + } + } + + FATAL_ERROR(ss, SSL_ERROR_UNSUPPORTED_SIGNATURE_ALGORITHM, + handshake_failure); + return SECFailure; +} + +static SECStatus +tls13_NegotiateAuthentication(sslSocket *ss) +{ + SECStatus rv; + + if (ss->statelessResume) { + SSL_TRC(3, ("%d: TLS13[%d]: selected PSK authentication", + SSL_GETPID(), ss->fd)); + ss->ssl3.hs.signatureScheme = ssl_sig_none; + ss->ssl3.hs.kea_def_mutable.authKeyType = ssl_auth_psk; + return SECSuccess; + } + + SSL_TRC(3, ("%d: TLS13[%d]: selected certificate authentication", + SSL_GETPID(), ss->fd)); + /* We've now established that we need to sign.... */ + rv = tls13_SelectServerCert(ss); + if (rv != SECSuccess) { + return SECFailure; + } + ss->ssl3.hs.kea_def_mutable.authKeyType = + ss->sec.serverCert->certType.authType; + return SECSuccess; +} + +/* Called from ssl3_HandleClientHello after we have parsed the + * ClientHello and are sure that we are going to do TLS 1.3 + * or fail. */ +SECStatus +tls13_HandleClientHelloPart2(sslSocket *ss, + const SECItem *suites, + sslSessionID *sid) +{ + SECStatus rv; + SSL3Statistics *ssl3stats = SSL_GetStatistics(); + TLS13KeyShareEntry *clientShare = NULL; + int j; + ssl3CipherSuite previousCipherSuite; + + if (ssl3_ExtensionNegotiated(ss, ssl_tls13_early_data_xtn)) { + ss->ssl3.hs.zeroRttState = ssl_0rtt_sent; + + if (IS_DTLS(ss)) { + /* Save the null spec, which we should be currently reading. We will + * use this when 0-RTT sending is over. */ + ssl_GetSpecReadLock(ss); + ss->ssl3.hs.nullSpec = ss->ssl3.crSpec; + tls13_CipherSpecAddRef(ss->ssl3.hs.nullSpec); + PORT_Assert(ss->ssl3.hs.nullSpec->cipher_def->cipher == cipher_null); + ssl_ReleaseSpecReadLock(ss); + } + } + +#ifndef PARANOID + /* Look for a matching cipher suite. */ + j = ssl3_config_match_init(ss); + if (j <= 0) { /* no ciphers are working/supported by PK11 */ + FATAL_ERROR(ss, PORT_GetError(), internal_error); + goto loser; + } +#endif + + previousCipherSuite = ss->ssl3.hs.cipher_suite; + rv = ssl3_NegotiateCipherSuite(ss, suites, PR_FALSE); + if (rv != SECSuccess) { + FATAL_ERROR(ss, SSL_ERROR_NO_CYPHER_OVERLAP, handshake_failure); + goto loser; + } + /* If we are going around again, then we should make sure that the cipher + * suite selection doesn't change. That's a sign of client shennanigans. */ + if (ss->ssl3.hs.helloRetry && + ss->ssl3.hs.cipher_suite != previousCipherSuite) { + FATAL_ERROR(ss, SSL_ERROR_RX_MALFORMED_CLIENT_HELLO, handshake_failure); + goto loser; + } + + /* Now create a synthetic kea_def that we can tweak. */ + ss->ssl3.hs.kea_def_mutable = *ss->ssl3.hs.kea_def; + ss->ssl3.hs.kea_def = &ss->ssl3.hs.kea_def_mutable; + + /* Note: We call this quite a bit earlier than with TLS 1.2 and + * before. */ + rv = ssl3_ServerCallSNICallback(ss); + if (rv != SECSuccess) { + goto loser; /* An alert has already been sent. */ + } + + /* Check if we could in principle resume. */ + if (ss->statelessResume) { + PORT_Assert(sid); + if (!sid) { + FATAL_ERROR(ss, SEC_ERROR_LIBRARY_FAILURE, internal_error); + return SECFailure; + } + if (!tls13_CanResume(ss, sid)) { + ss->statelessResume = PR_FALSE; + } + } + + /* Select key exchange. */ + rv = tls13_NegotiateKeyExchange(ss, &clientShare); + if (rv != SECSuccess) { + goto loser; + } + + /* If we didn't find a client key share, we have to retry. */ + if (!clientShare) { + if (sid) { /* Free the sid. */ + ss->sec.uncache(sid); + ssl_FreeSID(sid); + } + PORT_Assert(ss->ssl3.hs.helloRetry); + return SECSuccess; + } + + /* Select the authentication (this is also handshake shape). */ + rv = tls13_NegotiateAuthentication(ss); + if (rv != SECSuccess) { + goto loser; + } + + if (ss->statelessResume) { + /* We are now committed to trying to resume. */ + PORT_Assert(sid); + + /* Check that the negotiated SNI and the cached SNI match. */ + if (SECITEM_CompareItem(&sid->u.ssl3.srvName, + &ss->ssl3.hs.srvVirtName) != SECEqual) { + FATAL_ERROR(ss, SSL_ERROR_RX_MALFORMED_CLIENT_HELLO, + handshake_failure); + goto loser; + } + + rv = tls13_RecoverWrappedSharedSecret(ss, sid); + if (rv != SECSuccess) { + SSL_AtomicIncrementLong(&ssl3stats->hch_sid_cache_not_ok); + FATAL_ERROR(ss, SEC_ERROR_LIBRARY_FAILURE, internal_error); + goto loser; + } + tls13_RestoreCipherInfo(ss, sid); + + ss->sec.serverCert = ssl_FindServerCert(ss, &sid->certType); + PORT_Assert(ss->sec.serverCert); + ss->sec.localCert = CERT_DupCertificate(ss->sec.serverCert->serverCert); + if (sid->peerCert != NULL) { + ss->sec.peerCert = CERT_DupCertificate(sid->peerCert); + } + ssl3_RegisterExtensionSender( + ss, &ss->xtnData, + ssl_tls13_pre_shared_key_xtn, tls13_ServerSendPreSharedKeyXtn); + + tls13_NegotiateZeroRtt(ss, sid); + } else { + if (sid) { /* we had a sid, but it's no longer valid, free it */ + SSL_AtomicIncrementLong(&ssl3stats->hch_sid_cache_not_ok); + if (ss->sec.uncache) + ss->sec.uncache(sid); + ssl_FreeSID(sid); + sid = NULL; + } + tls13_NegotiateZeroRtt(ss, NULL); + } + + /* Need to compute early secrets. */ + rv = tls13_ComputeEarlySecrets(ss); + if (rv != SECSuccess) { + FATAL_ERROR(ss, SEC_ERROR_LIBRARY_FAILURE, internal_error); + return SECFailure; + } + + /* Now that we have the binder key check the binder. */ + if (ss->statelessResume) { + SSL3Hashes hashes; + + rv = tls13_ComputePskBinderHash(ss, ss->xtnData.pskBinderPrefixLen, + &hashes); + if (rv != SECSuccess) { + FATAL_ERROR(ss, SEC_ERROR_LIBRARY_FAILURE, internal_error); + goto loser; + } + + rv = tls13_VerifyFinished(ss, client_hello, + ss->ssl3.hs.pskBinderKey, + ss->xtnData.pskBinder.data, + ss->xtnData.pskBinder.len, + &hashes); + if (rv != SECSuccess) { + goto loser; + } + } + + /* This needs to go after we verify the psk binder. */ + rv = ssl3_InitHandshakeHashes(ss); + if (rv != SECSuccess) { + goto loser; + } + + /* If this is TLS 1.3 we are expecting a ClientKeyShare + * extension. Missing/absent extension cause failure + * below. */ + rv = tls13_HandleClientKeyShare(ss, clientShare); + if (rv != SECSuccess) { + goto loser; /* An alert was sent already. */ + } + + /* From this point we are either committed to resumption, or not. */ + if (ss->statelessResume) { + SSL_AtomicIncrementLong(&ssl3stats->hch_sid_cache_hits); + SSL_AtomicIncrementLong(&ssl3stats->hch_sid_stateless_resumes); + } else { + if (sid) { + /* We had a sid, but it's no longer valid, free it. */ + SSL_AtomicIncrementLong(&ssl3stats->hch_sid_cache_not_ok); + ss->sec.uncache(sid); + ssl_FreeSID(sid); + } else { + SSL_AtomicIncrementLong(&ssl3stats->hch_sid_cache_misses); + } + + sid = ssl3_NewSessionID(ss, PR_TRUE); + if (!sid) { + FATAL_ERROR(ss, PORT_GetError(), internal_error); + return SECFailure; + } + } + /* Take ownership of the session. */ + ss->sec.ci.sid = sid; + sid = NULL; + + if (ss->ssl3.hs.zeroRttState == ssl_0rtt_accepted) { + rv = tls13_DeriveSecret(ss, ss->ssl3.hs.currentSecret, + kHkdfLabelClient, + kHkdfLabelEarlyTrafficSecret, + NULL, /* Current running hash. */ + &ss->ssl3.hs.clientEarlyTrafficSecret); + if (rv != SECSuccess) { + FATAL_ERROR(ss, SEC_ERROR_LIBRARY_FAILURE, internal_error); + return SECFailure; + } + } + + ssl_GetXmitBufLock(ss); + rv = tls13_SendServerHelloSequence(ss); + ssl_ReleaseXmitBufLock(ss); + if (rv != SECSuccess) { + FATAL_ERROR(ss, PORT_GetError(), handshake_failure); + return SECFailure; + } + + return SECSuccess; + +loser: + if (sid) { + ss->sec.uncache(sid); + ssl_FreeSID(sid); + } + return SECFailure; +} + +static SECStatus +tls13_SendHelloRetryRequest(sslSocket *ss, const sslNamedGroupDef *selectedGroup) +{ + SECStatus rv; + + SSL_TRC(3, ("%d: TLS13[%d]: send hello retry request handshake", + SSL_GETPID(), ss->fd)); + + PORT_Assert(ss->opt.noLocks || ssl_HaveSSL3HandshakeLock(ss)); + + /* We asked already, but made no progress. */ + if (ss->ssl3.hs.helloRetry) { + FATAL_ERROR(ss, SSL_ERROR_BAD_2ND_CLIENT_HELLO, illegal_parameter); + return SECFailure; + } + + ssl_GetXmitBufLock(ss); + rv = ssl3_AppendHandshakeHeader(ss, hello_retry_request, + 2 + /* version */ + 2 + /* extension length */ + 2 + /* group extension id */ + 2 + /* group extension length */ + 2 /* group */); + if (rv != SECSuccess) { + FATAL_ERROR(ss, SEC_ERROR_LIBRARY_FAILURE, internal_error); + goto loser; + } + + rv = ssl3_AppendHandshakeNumber( + ss, tls13_EncodeDraftVersion(ss->version), 2); + if (rv != SECSuccess) { + FATAL_ERROR(ss, SEC_ERROR_LIBRARY_FAILURE, internal_error); + goto loser; + } + + /* Length of extensions. */ + rv = ssl3_AppendHandshakeNumber(ss, 2 + 2 + 2, 2); + if (rv != SECSuccess) { + FATAL_ERROR(ss, SEC_ERROR_LIBRARY_FAILURE, internal_error); + goto loser; + } + + /* Key share extension - currently the only reason we send this. */ + rv = ssl3_AppendHandshakeNumber(ss, ssl_tls13_key_share_xtn, 2); + if (rv != SECSuccess) { + FATAL_ERROR(ss, SEC_ERROR_LIBRARY_FAILURE, internal_error); + goto loser; + } + /* Key share extension length. */ + rv = ssl3_AppendHandshakeNumber(ss, 2, 2); + if (rv != SECSuccess) { + FATAL_ERROR(ss, SEC_ERROR_LIBRARY_FAILURE, internal_error); + goto loser; + } + rv = ssl3_AppendHandshakeNumber(ss, selectedGroup->name, 2); + if (rv != SECSuccess) { + FATAL_ERROR(ss, SEC_ERROR_LIBRARY_FAILURE, internal_error); + goto loser; + } + + rv = ssl3_FlushHandshake(ss, 0); + if (rv != SECSuccess) { + goto loser; /* error code set by ssl3_FlushHandshake */ + } + ssl_ReleaseXmitBufLock(ss); + + ss->ssl3.hs.helloRetry = PR_TRUE; + + /* We received early data but have to ignore it because we sent a retry. */ + if (ss->ssl3.hs.zeroRttState == ssl_0rtt_sent) { + ss->ssl3.hs.zeroRttState = ssl_0rtt_ignored; + ss->ssl3.hs.zeroRttIgnore = ssl_0rtt_ignore_hrr; + } + + return SECSuccess; + +loser: + ssl_ReleaseXmitBufLock(ss); + return SECFailure; +} + +/* Called from tls13_HandleClientHello. + * + * Caller must hold Handshake and RecvBuf locks. + */ + +static SECStatus +tls13_HandleClientKeyShare(sslSocket *ss, TLS13KeyShareEntry *peerShare) +{ + SECStatus rv; + sslEphemeralKeyPair *keyPair; /* ours */ + + SSL_TRC(3, ("%d: TLS13[%d]: handle client_key_share handshake", + SSL_GETPID(), ss->fd)); + + PORT_Assert(ss->opt.noLocks || ssl_HaveRecvBufLock(ss)); + PORT_Assert(ss->opt.noLocks || ssl_HaveSSL3HandshakeLock(ss)); + PORT_Assert(peerShare); + + tls13_SetKeyExchangeType(ss, peerShare->group); + + /* Generate our key */ + rv = tls13_CreateKeyShare(ss, peerShare->group); + if (rv != SECSuccess) { + return rv; + } + + /* We should have exactly one key share. */ + PORT_Assert(!PR_CLIST_IS_EMPTY(&ss->ephemeralKeyPairs)); + PORT_Assert(PR_PREV_LINK(&ss->ephemeralKeyPairs) == + PR_NEXT_LINK(&ss->ephemeralKeyPairs)); + + keyPair = ((sslEphemeralKeyPair *)PR_NEXT_LINK(&ss->ephemeralKeyPairs)); + ss->sec.keaKeyBits = SECKEY_PublicKeyStrengthInBits(keyPair->keys->pubKey); + + /* Register the sender */ + rv = ssl3_RegisterExtensionSender(ss, &ss->xtnData, ssl_tls13_key_share_xtn, + tls13_ServerSendKeyShareXtn); + if (rv != SECSuccess) { + return SECFailure; /* Error code set already. */ + } + + rv = tls13_HandleKeyShare(ss, peerShare, keyPair->keys); + return rv; /* Error code set already. */ +} + +/* + * [draft-ietf-tls-tls13-11] Section 6.3.3.2 + * + * opaque DistinguishedName<1..2^16-1>; + * + * struct { + * opaque certificate_extension_oid<1..2^8-1>; + * opaque certificate_extension_values<0..2^16-1>; + * } CertificateExtension; + * + * struct { + * opaque certificate_request_context<0..2^8-1>; + * SignatureAndHashAlgorithm + * supported_signature_algorithms<2..2^16-2>; + * DistinguishedName certificate_authorities<0..2^16-1>; + * CertificateExtension certificate_extensions<0..2^16-1>; + * } CertificateRequest; + */ +static SECStatus +tls13_SendCertificateRequest(sslSocket *ss) +{ + SECStatus rv; + int calen; + SECItem *names; + int nnames; + SECItem *name; + int i; + PRUint8 sigSchemes[MAX_SIGNATURE_SCHEMES * 2]; + unsigned int sigSchemesLength = 0; + int length; + + SSL_TRC(3, ("%d: TLS13[%d]: begin send certificate_request", + SSL_GETPID(), ss->fd)); + + rv = ssl3_EncodeSigAlgs(ss, sigSchemes, sizeof(sigSchemes), + &sigSchemesLength); + if (rv != SECSuccess) { + return rv; + } + + ssl3_GetCertificateRequestCAs(ss, &calen, &names, &nnames); + length = 1 + 0 /* length byte for empty request context */ + + 2 + sigSchemesLength + 2 + calen + 2; + + rv = ssl3_AppendHandshakeHeader(ss, certificate_request, length); + if (rv != SECSuccess) { + return rv; /* err set by AppendHandshake. */ + } + rv = ssl3_AppendHandshakeNumber(ss, 0, 1); + if (rv != SECSuccess) { + return rv; /* err set by AppendHandshake. */ + } + rv = ssl3_AppendHandshakeVariable(ss, sigSchemes, sigSchemesLength, 2); + if (rv != SECSuccess) { + return rv; /* err set by AppendHandshake. */ + } + rv = ssl3_AppendHandshakeNumber(ss, calen, 2); + if (rv != SECSuccess) { + return rv; /* err set by AppendHandshake. */ + } + for (i = 0, name = names; i < nnames; i++, name++) { + rv = ssl3_AppendHandshakeVariable(ss, name->data, name->len, 2); + if (rv != SECSuccess) { + return rv; /* err set by AppendHandshake. */ + } + } + rv = ssl3_AppendHandshakeNumber(ss, 0, 2); + if (rv != SECSuccess) { + return rv; /* err set by AppendHandshake. */ + } + + return SECSuccess; +} + +SECStatus +tls13_HandleHelloRetryRequest(sslSocket *ss, SSL3Opaque *b, PRUint32 length) +{ + SECStatus rv; + PRInt32 tmp; + SSL3ProtocolVersion version; + + SSL_TRC(3, ("%d: TLS13[%d]: handle hello retry request", + SSL_GETPID(), ss->fd)); + + PORT_Assert(ss->opt.noLocks || ssl_HaveRecvBufLock(ss)); + PORT_Assert(ss->opt.noLocks || ssl_HaveSSL3HandshakeLock(ss)); + + if (ss->vrange.max < SSL_LIBRARY_VERSION_TLS_1_3) { + FATAL_ERROR(ss, SSL_ERROR_RX_UNEXPECTED_HELLO_RETRY_REQUEST, + unexpected_message); + return SECFailure; + } + + /* Client only. */ + rv = TLS13_CHECK_HS_STATE(ss, SSL_ERROR_RX_UNEXPECTED_HELLO_RETRY_REQUEST, + wait_server_hello); + if (rv != SECSuccess) { + return SECFailure; + } + + /* Fool me once, shame on you; fool me twice... */ + if (ss->ssl3.hs.helloRetry) { + FATAL_ERROR(ss, SSL_ERROR_RX_UNEXPECTED_HELLO_RETRY_REQUEST, + unexpected_message); + return SECFailure; + } + + if (ss->ssl3.hs.zeroRttState == ssl_0rtt_sent) { + /* Oh well, back to the start. */ + tls13_SetNullCipherSpec(ss, &ss->ssl3.cwSpec); + ss->ssl3.hs.zeroRttState = ssl_0rtt_ignored; + } else { + PORT_Assert(ss->ssl3.hs.zeroRttState == ssl_0rtt_none); + } + + /* Version. */ + rv = ssl_ClientReadVersion(ss, &b, &length, &version); + if (rv != SECSuccess) { + return SECFailure; /* alert already sent */ + } + if (version > ss->vrange.max || version < SSL_LIBRARY_VERSION_TLS_1_3) { + FATAL_ERROR(ss, SSL_ERROR_RX_MALFORMED_HELLO_RETRY_REQUEST, + protocol_version); + return SECFailure; + } + + /* Extensions. */ + tmp = ssl3_ConsumeHandshakeNumber(ss, 2, &b, &length); + if (tmp < 0) { + return SECFailure; /* error code already set */ + } + /* Extensions must be non-empty and use the remainder of the message. + * This means that a HelloRetryRequest cannot be a no-op: we must have an + * extension, it must be one that we understand and recognize as being valid + * for HelloRetryRequest, and all the extensions we permit cause us to + * modify our ClientHello in some way. */ + if (!tmp || tmp != length) { + FATAL_ERROR(ss, SSL_ERROR_RX_MALFORMED_HELLO_RETRY_REQUEST, + decode_error); + return SECFailure; + } + + rv = ssl3_HandleExtensions(ss, &b, &length, hello_retry_request); + if (rv != SECSuccess) { + return SECFailure; /* Error code set below */ + } + + ss->ssl3.hs.helloRetry = PR_TRUE; + + ssl_GetXmitBufLock(ss); + rv = ssl3_SendClientHello(ss, client_hello_retry); + ssl_ReleaseXmitBufLock(ss); + if (rv != SECSuccess) { + return SECFailure; + } + + return SECSuccess; +} + +static SECStatus +tls13_HandleCertificateRequest(sslSocket *ss, SSL3Opaque *b, PRUint32 length) +{ + SECStatus rv; + TLS13CertificateRequest *certRequest = NULL; + SECItem context = { siBuffer, NULL, 0 }; + PLArenaPool *arena; + PRInt32 extensionsLength; + + SSL_TRC(3, ("%d: TLS13[%d]: handle certificate_request sequence", + SSL_GETPID(), ss->fd)); + + PORT_Assert(ss->opt.noLocks || ssl_HaveRecvBufLock(ss)); + PORT_Assert(ss->opt.noLocks || ssl_HaveSSL3HandshakeLock(ss)); + + /* Client */ + rv = TLS13_CHECK_HS_STATE(ss, SSL_ERROR_RX_UNEXPECTED_CERT_REQUEST, + wait_cert_request); + if (rv != SECSuccess) { + return SECFailure; + } + + PORT_Assert(ss->ssl3.clientCertChain == NULL); + PORT_Assert(ss->ssl3.clientCertificate == NULL); + PORT_Assert(ss->ssl3.clientPrivateKey == NULL); + PORT_Assert(ss->ssl3.hs.certificateRequest == NULL); + + arena = PORT_NewArena(DER_DEFAULT_CHUNKSIZE); + if (!arena) { + FATAL_ERROR(ss, SEC_ERROR_LIBRARY_FAILURE, internal_error); + return SECFailure; + } + + rv = ssl3_ConsumeHandshakeVariable(ss, &context, 1, &b, &length); + if (rv != SECSuccess) + goto loser; + + /* We don't support post-handshake client auth, the certificate request + * context must always be null. */ + if (context.len > 0) { + FATAL_ERROR(ss, SSL_ERROR_RX_MALFORMED_CERT_REQUEST, illegal_parameter); + goto loser; + } + + certRequest = PORT_ArenaZNew(arena, TLS13CertificateRequest); + if (!certRequest) + goto loser; + certRequest->arena = arena; + certRequest->ca_list.arena = arena; + + rv = ssl_ParseSignatureSchemes(ss, arena, + &certRequest->signatureSchemes, + &certRequest->signatureSchemeCount, + &b, &length); + if (rv != SECSuccess) { + FATAL_ERROR(ss, SSL_ERROR_RX_MALFORMED_CERT_REQUEST, + decode_error); + goto loser; + } + + rv = ssl3_ParseCertificateRequestCAs(ss, &b, &length, arena, + &certRequest->ca_list); + if (rv != SECSuccess) + goto loser; /* alert already sent */ + + /* Verify that the extensions length is correct. */ + extensionsLength = ssl3_ConsumeHandshakeNumber(ss, 2, &b, &length); + if (extensionsLength < 0) { + goto loser; /* alert already sent */ + } + if (extensionsLength != length) { + FATAL_ERROR(ss, SSL_ERROR_RX_MALFORMED_CERT_REQUEST, + illegal_parameter); + goto loser; + } + + rv = SECITEM_CopyItem(arena, &certRequest->context, &context); + if (rv != SECSuccess) + goto loser; + + TLS13_SET_HS_STATE(ss, wait_server_cert); + ss->ssl3.hs.certificateRequest = certRequest; + + return SECSuccess; + +loser: + PORT_FreeArena(arena, PR_FALSE); + return SECFailure; +} + +static SECStatus +tls13_SendEncryptedServerSequence(sslSocket *ss) +{ + SECStatus rv; + + rv = tls13_ComputeHandshakeSecrets(ss); + if (rv != SECSuccess) { + return SECFailure; /* error code is set. */ + } + + rv = tls13_SetCipherSpec(ss, TrafficKeyHandshake, + CipherSpecWrite, PR_FALSE); + if (rv != SECSuccess) { + LOG_ERROR(ss, SEC_ERROR_LIBRARY_FAILURE); + return SECFailure; + } + + ss->ssl3.hs.shortHeaders = ssl3_ExtensionNegotiated( + ss, ssl_tls13_short_header_xtn); + + if (ss->ssl3.hs.zeroRttState == ssl_0rtt_accepted) { + rv = ssl3_RegisterExtensionSender(ss, &ss->xtnData, ssl_tls13_early_data_xtn, + tls13_ServerSendEarlyDataXtn); + if (rv != SECSuccess) { + return SECFailure; /* Error code set already. */ + } + } + + rv = tls13_SendEncryptedExtensions(ss); + if (rv != SECSuccess) { + return SECFailure; /* error code is set. */ + } + + if (ss->opt.requestCertificate) { + rv = tls13_SendCertificateRequest(ss); + if (rv != SECSuccess) { + return SECFailure; /* error code is set. */ + } + } + if (ss->ssl3.hs.signatureScheme != ssl_sig_none) { + SECKEYPrivateKey *svrPrivKey; + + rv = tls13_SendCertificate(ss); + if (rv != SECSuccess) { + return SECFailure; /* error code is set. */ + } + + svrPrivKey = ss->sec.serverCert->serverKeyPair->privKey; + rv = tls13_SendCertificateVerify(ss, svrPrivKey); + if (rv != SECSuccess) { + return SECFailure; /* err code is set. */ + } + } + + rv = tls13_SendFinished(ss, ss->ssl3.hs.serverHsTrafficSecret); + if (rv != SECSuccess) { + return SECFailure; /* error code is set. */ + } + + return SECSuccess; +} + +/* Called from: ssl3_HandleClientHello */ +static SECStatus +tls13_SendServerHelloSequence(sslSocket *ss) +{ + SECStatus rv; + PRErrorCode err = 0; + + SSL_TRC(3, ("%d: TLS13[%d]: begin send server_hello sequence", + SSL_GETPID(), ss->fd)); + + PORT_Assert(ss->opt.noLocks || ssl_HaveSSL3HandshakeLock(ss)); + PORT_Assert(ss->opt.noLocks || ssl_HaveXmitBufLock(ss)); + + rv = ssl3_SendServerHello(ss); + if (rv != SECSuccess) { + return rv; /* err code is set. */ + } + + rv = tls13_SendEncryptedServerSequence(ss); + if (rv != SECSuccess) { + err = PORT_GetError(); + } + /* Even if we get an error, since the ServerHello was successfully + * serialized, we should give it a chance to reach the network. This gives + * the client a chance to perform the key exchange and decrypt the alert + * we're about to send. */ + rv |= ssl3_FlushHandshake(ss, 0); + if (rv != SECSuccess) { + if (err) { + PORT_SetError(err); + } + return SECFailure; + } + + /* Compute the rest of the secrets except for the resumption + * and exporter secret. */ + rv = tls13_ComputeApplicationSecrets(ss); + if (rv != SECSuccess) { + LOG_ERROR(ss, PORT_GetError()); + return SECFailure; + } + + rv = tls13_SetCipherSpec(ss, TrafficKeyApplicationData, + CipherSpecWrite, PR_FALSE); + if (rv != SECSuccess) { + LOG_ERROR(ss, SEC_ERROR_LIBRARY_FAILURE); + return SECFailure; + } + + if (ss->ssl3.hs.zeroRttState == ssl_0rtt_accepted) { + rv = tls13_SetCipherSpec(ss, + TrafficKeyEarlyApplicationData, + CipherSpecRead, PR_TRUE); + if (rv != SECSuccess) { + LOG_ERROR(ss, SEC_ERROR_LIBRARY_FAILURE); + return SECFailure; + } + } else { + PORT_Assert(ss->ssl3.hs.zeroRttState == ssl_0rtt_none || + ss->ssl3.hs.zeroRttState == ssl_0rtt_ignored); + + rv = tls13_SetCipherSpec(ss, + TrafficKeyHandshake, + CipherSpecRead, PR_FALSE); + if (rv != SECSuccess) { + LOG_ERROR(ss, SEC_ERROR_LIBRARY_FAILURE); + return SECFailure; + } + } + + TLS13_SET_HS_STATE(ss, + ss->opt.requestCertificate ? wait_client_cert + : wait_finished); + return SECSuccess; +} + +SECStatus +tls13_HandleServerHelloPart2(sslSocket *ss) +{ + SECStatus rv; + sslSessionID *sid = ss->sec.ci.sid; + SSL3Statistics *ssl3stats = SSL_GetStatistics(); + + if (ssl3_ExtensionNegotiated(ss, ssl_tls13_pre_shared_key_xtn)) { + PORT_Assert(ss->statelessResume); + } else { + if (ss->ssl3.hs.currentSecret) { + PORT_Assert(ss->statelessResume); + PK11_FreeSymKey(ss->ssl3.hs.currentSecret); + ss->ssl3.hs.currentSecret = NULL; + } + ss->statelessResume = PR_FALSE; + } + + if (ss->statelessResume) { + if (tls13_GetHash(ss) != + tls13_GetHashForCipherSuite(sid->u.ssl3.cipherSuite)) { + FATAL_ERROR(ss, SSL_ERROR_RX_MALFORMED_SERVER_HELLO, + illegal_parameter); + return SECFailure; + } + } + + /* Now create a synthetic kea_def that we can tweak. */ + ss->ssl3.hs.kea_def_mutable = *ss->ssl3.hs.kea_def; + ss->ssl3.hs.kea_def = &ss->ssl3.hs.kea_def_mutable; + + if (ss->statelessResume) { + /* PSK */ + ss->ssl3.hs.kea_def_mutable.authKeyType = ssl_auth_psk; + tls13_RestoreCipherInfo(ss, sid); + if (sid->peerCert) { + ss->sec.peerCert = CERT_DupCertificate(sid->peerCert); + } + + SSL_AtomicIncrementLong(&ssl3stats->hsh_sid_cache_hits); + SSL_AtomicIncrementLong(&ssl3stats->hsh_sid_stateless_resumes); + } else { + /* !PSK */ + if (ssl3_ClientExtensionAdvertised(ss, ssl_tls13_pre_shared_key_xtn)) { + SSL_AtomicIncrementLong(&ssl3stats->hsh_sid_cache_misses); + } + if (sid->cached == in_client_cache) { + /* If we tried to resume and failed, let's not try again. */ + ss->sec.uncache(sid); + } + } + + if (!ss->ssl3.hs.currentSecret) { + PORT_Assert(!ss->statelessResume); + + /* If we don't already have the Early Secret we need to make it + * now. */ + rv = tls13_ComputeEarlySecrets(ss); + if (rv != SECSuccess) { + FATAL_ERROR(ss, SEC_ERROR_LIBRARY_FAILURE, internal_error); + return SECFailure; + } + } + + /* Discard current SID and make a new one, though it may eventually + * end up looking a lot like the old one. + */ + ssl_FreeSID(sid); + ss->sec.ci.sid = sid = ssl3_NewSessionID(ss, PR_FALSE); + if (sid == NULL) { + FATAL_ERROR(ss, PORT_GetError(), internal_error); + return SECFailure; + } + if (ss->statelessResume) { + PORT_Assert(ss->sec.peerCert); + sid->peerCert = CERT_DupCertificate(ss->sec.peerCert); + } + sid->version = ss->version; + + rv = tls13_HandleServerKeyShare(ss); + if (rv != SECSuccess) { + return SECFailure; + } + rv = tls13_ComputeHandshakeSecrets(ss); + if (rv != SECSuccess) { + return SECFailure; /* error code is set. */ + } + + ss->ssl3.hs.shortHeaders = ssl3_ExtensionNegotiated( + ss, ssl_tls13_short_header_xtn); + + rv = tls13_SetCipherSpec(ss, TrafficKeyHandshake, + CipherSpecRead, PR_FALSE); + if (rv != SECSuccess) { + FATAL_ERROR(ss, SSL_ERROR_INIT_CIPHER_SUITE_FAILURE, internal_error); + return SECFailure; + } + TLS13_SET_HS_STATE(ss, wait_encrypted_extensions); + + return SECSuccess; +} + +static void +tls13_SetKeyExchangeType(sslSocket *ss, const sslNamedGroupDef *group) +{ + ss->sec.keaGroup = group; + switch (group->keaType) { + /* Note: These overwrite on resumption.... so if you start with ECDH + * and resume with DH, we report DH. That's fine, since no answer + * is really right. */ + case ssl_kea_ecdh: + ss->ssl3.hs.kea_def_mutable.exchKeyType = + ss->statelessResume ? ssl_kea_ecdh_psk : ssl_kea_ecdh; + ss->sec.keaType = ssl_kea_ecdh; + break; + case ssl_kea_dh: + ss->ssl3.hs.kea_def_mutable.exchKeyType = + ss->statelessResume ? ssl_kea_dh_psk : ssl_kea_dh; + ss->sec.keaType = ssl_kea_dh; + break; + default: + PORT_Assert(0); + } +} + +/* + * Called from ssl3_HandleServerHello. + * + * Caller must hold Handshake and RecvBuf locks. + */ +static SECStatus +tls13_HandleServerKeyShare(sslSocket *ss) +{ + SECStatus rv; + TLS13KeyShareEntry *entry; + sslEphemeralKeyPair *keyPair; + + SSL_TRC(3, ("%d: TLS13[%d]: handle server_key_share handshake", + SSL_GETPID(), ss->fd)); + PORT_Assert(ss->opt.noLocks || ssl_HaveRecvBufLock(ss)); + PORT_Assert(ss->opt.noLocks || ssl_HaveSSL3HandshakeLock(ss)); + + /* This list should have one entry. */ + if (PR_CLIST_IS_EMPTY(&ss->xtnData.remoteKeyShares)) { + FATAL_ERROR(ss, SSL_ERROR_MISSING_KEY_SHARE, missing_extension); + return SECFailure; + } + + entry = (TLS13KeyShareEntry *)PR_NEXT_LINK(&ss->xtnData.remoteKeyShares); + PORT_Assert(PR_NEXT_LINK(&entry->link) == &ss->xtnData.remoteKeyShares); + + /* Now get our matching key. */ + keyPair = ssl_LookupEphemeralKeyPair(ss, entry->group); + if (!keyPair) { + FATAL_ERROR(ss, SSL_ERROR_RX_MALFORMED_KEY_SHARE, illegal_parameter); + return SECFailure; + } + + PORT_Assert(ssl_NamedGroupEnabled(ss, entry->group)); + + rv = tls13_HandleKeyShare(ss, entry, keyPair->keys); + if (rv != SECSuccess) + return SECFailure; /* Error code set by caller. */ + + tls13_SetKeyExchangeType(ss, entry->group); + ss->sec.keaKeyBits = SECKEY_PublicKeyStrengthInBits(keyPair->keys->pubKey); + + return SECSuccess; +} + +/* + * opaque ASN1Cert<1..2^24-1>; + * + * struct { + * ASN1Cert cert_data; + * Extension extensions<0..2^16-1>; + * } CertificateEntry; + * + * struct { + * opaque certificate_request_context<0..2^8-1>; + * CertificateEntry certificate_list<0..2^24-1>; + * } Certificate; + */ +static SECStatus +tls13_SendCertificate(sslSocket *ss) +{ + SECStatus rv; + CERTCertificateList *certChain; + int certChainLen = 0; + int i; + SECItem context = { siBuffer, NULL, 0 }; + PRInt32 extensionsLen = 0; + PRUint32 maxBytes = 65535; + + SSL_TRC(3, ("%d: TLS1.3[%d]: send certificate handshake", + SSL_GETPID(), ss->fd)); + + PORT_Assert(ss->opt.noLocks || ssl_HaveXmitBufLock(ss)); + PORT_Assert(ss->opt.noLocks || ssl_HaveSSL3HandshakeLock(ss)); + + if (ss->sec.isServer) { + PORT_Assert(!ss->sec.localCert); + /* A server certificate is selected in tls13_SelectServerCert(). */ + PORT_Assert(ss->sec.serverCert); + + certChain = ss->sec.serverCert->serverCertChain; + ss->sec.localCert = CERT_DupCertificate(ss->sec.serverCert->serverCert); + } else { + if (ss->sec.localCert) + CERT_DestroyCertificate(ss->sec.localCert); + + certChain = ss->ssl3.clientCertChain; + ss->sec.localCert = CERT_DupCertificate(ss->ssl3.clientCertificate); + } + + /* Get the extensions length. This only applies to the leaf cert, + * because we don't yet send extensions for non-leaf certs. */ + extensionsLen = ssl3_CallHelloExtensionSenders( + ss, PR_FALSE, maxBytes, &ss->xtnData.certificateSenders[0]); + + if (!ss->sec.isServer) { + PORT_Assert(ss->ssl3.hs.certificateRequest); + context = ss->ssl3.hs.certificateRequest->context; + } + if (certChain) { + for (i = 0; i < certChain->len; i++) { + certChainLen += + 3 + certChain->certs[i].len + /* cert length + cert */ + 2 + (!i ? extensionsLen : 0); /* extensions length + extensions */ + } + } + + rv = ssl3_AppendHandshakeHeader(ss, certificate, + 1 + context.len + + 3 + certChainLen); + if (rv != SECSuccess) { + return SECFailure; /* err set by AppendHandshake. */ + } + + rv = ssl3_AppendHandshakeVariable(ss, context.data, + context.len, 1); + if (rv != SECSuccess) { + return SECFailure; /* err set by AppendHandshake. */ + } + + rv = ssl3_AppendHandshakeNumber(ss, certChainLen, 3); + if (rv != SECSuccess) { + return SECFailure; /* err set by AppendHandshake. */ + } + if (certChain) { + for (i = 0; i < certChain->len; i++) { + PRInt32 sentLen; + + rv = ssl3_AppendHandshakeVariable(ss, certChain->certs[i].data, + certChain->certs[i].len, 3); + if (rv != SECSuccess) { + return SECFailure; /* err set by AppendHandshake. */ + } + + if (i) { + /* Not end-entity. */ + rv = ssl3_AppendHandshakeNumber(ss, 0, 2); + if (rv != SECSuccess) { + return SECFailure; /* err set by AppendHandshake. */ + } + continue; + } + + /* End-entity, send extensions. */ + rv = ssl3_AppendHandshakeNumber(ss, extensionsLen, 2); + if (rv != SECSuccess) { + return SECFailure; /* err set by AppendHandshake. */ + } + + sentLen = ssl3_CallHelloExtensionSenders( + ss, PR_TRUE, extensionsLen, + &ss->xtnData.certificateSenders[0]); + PORT_Assert(sentLen == extensionsLen); + if (sentLen != extensionsLen) { + LOG_ERROR(ss, SEC_ERROR_LIBRARY_FAILURE); + return SECFailure; + } + } + } + + return SECSuccess; +} + +static SECStatus +tls13_HandleCertificateEntry(sslSocket *ss, SECItem *data, PRBool first, + CERTCertificate **certp) +{ + SECStatus rv; + SECItem certData; + SECItem extensionsData; + CERTCertificate *cert = NULL; + + rv = ssl3_ConsumeHandshakeVariable(ss, &certData, + 3, &data->data, &data->len); + if (rv != SECSuccess) { + return SECFailure; + } + + rv = ssl3_ConsumeHandshakeVariable(ss, &extensionsData, + 2, &data->data, &data->len); + if (rv != SECSuccess) { + return SECFailure; + } + + /* Parse all the extensions. */ + if (first && !ss->sec.isServer) { + rv = ssl3_HandleExtensions(ss, &extensionsData.data, + &extensionsData.len, + certificate); + if (rv != SECSuccess) { + return SECFailure; + } + + /* TODO(ekr@rtfm.com): Copy out SCTs. Bug 1315727. */ + } + + cert = CERT_NewTempCertificate(ss->dbHandle, &certData, NULL, + PR_FALSE, PR_TRUE); + + if (!cert) { + PRErrorCode errCode = PORT_GetError(); + switch (errCode) { + case PR_OUT_OF_MEMORY_ERROR: + case SEC_ERROR_BAD_DATABASE: + case SEC_ERROR_NO_MEMORY: + FATAL_ERROR(ss, errCode, internal_error); + return SECFailure; + default: + ssl3_SendAlertForCertError(ss, errCode); + return SECFailure; + } + } + + *certp = cert; + + return SECSuccess; +} + +/* Called from tls13_CompleteHandleHandshakeMessage() when it has deciphered a complete + * tls13 Certificate message. + * Caller must hold Handshake and RecvBuf locks. + */ +static SECStatus +tls13_HandleCertificate(sslSocket *ss, SSL3Opaque *b, PRUint32 length) +{ + SECStatus rv; + SECItem context = { siBuffer, NULL, 0 }; + SECItem certList; + PRBool first = PR_TRUE; + ssl3CertNode *lastCert = NULL; + + SSL_TRC(3, ("%d: TLS13[%d]: handle certificate handshake", + SSL_GETPID(), ss->fd)); + PORT_Assert(ss->opt.noLocks || ssl_HaveRecvBufLock(ss)); + PORT_Assert(ss->opt.noLocks || ssl_HaveSSL3HandshakeLock(ss)); + + if (ss->sec.isServer) { + rv = TLS13_CHECK_HS_STATE(ss, SSL_ERROR_RX_UNEXPECTED_CERTIFICATE, + wait_client_cert); + } else { + rv = TLS13_CHECK_HS_STATE(ss, SSL_ERROR_RX_UNEXPECTED_CERTIFICATE, + wait_cert_request, wait_server_cert); + } + if (rv != SECSuccess) + return SECFailure; + + /* Process the context string */ + rv = ssl3_ConsumeHandshakeVariable(ss, &context, 1, &b, &length); + if (rv != SECSuccess) + return SECFailure; + + if (context.len) { + /* The context string MUST be empty */ + FATAL_ERROR(ss, SSL_ERROR_RX_MALFORMED_CERTIFICATE, illegal_parameter); + return SECFailure; + } + + rv = ssl3_ConsumeHandshakeVariable(ss, &certList, 3, &b, &length); + if (rv != SECSuccess) { + return SECFailure; + } + if (length) { + FATAL_ERROR(ss, SSL_ERROR_RX_MALFORMED_CERTIFICATE, illegal_parameter); + return SECFailure; + } + + if (!certList.len) { + if (!ss->sec.isServer) { + /* Servers always need to send some cert. */ + FATAL_ERROR(ss, SSL_ERROR_RX_MALFORMED_CERTIFICATE, bad_certificate); + return SECFailure; + } else { + /* This is TLS's version of a no_certificate alert. */ + /* I'm a server. I've requested a client cert. He hasn't got one. */ + rv = ssl3_HandleNoCertificate(ss); + if (rv != SECSuccess) { + return SECFailure; + } + + TLS13_SET_HS_STATE(ss, wait_finished); + return SECSuccess; + } + } + + /* Now clean up. */ + ssl3_CleanupPeerCerts(ss); + ss->ssl3.peerCertArena = PORT_NewArena(DER_DEFAULT_CHUNKSIZE); + if (ss->ssl3.peerCertArena == NULL) { + FATAL_ERROR(ss, SEC_ERROR_NO_MEMORY, internal_error); + return SECFailure; + } + + while (certList.len) { + CERTCertificate *cert; + + rv = tls13_HandleCertificateEntry(ss, &certList, first, + &cert); + if (rv != SECSuccess) { + ss->xtnData.signedCertTimestamps.len = 0; + return SECFailure; + } + + if (first) { + ss->sec.peerCert = cert; + + if (ss->xtnData.signedCertTimestamps.len) { + sslSessionID *sid = ss->sec.ci.sid; + rv = SECITEM_CopyItem(NULL, &sid->u.ssl3.signedCertTimestamps, + &ss->xtnData.signedCertTimestamps); + ss->xtnData.signedCertTimestamps.len = 0; + if (rv != SECSuccess) { + FATAL_ERROR(ss, SEC_ERROR_NO_MEMORY, internal_error); + return SECFailure; + } + } + } else { + ssl3CertNode *c = PORT_ArenaNew(ss->ssl3.peerCertArena, + ssl3CertNode); + if (!c) { + FATAL_ERROR(ss, SEC_ERROR_NO_MEMORY, internal_error); + return SECFailure; + } + c->cert = cert; + c->next = NULL; + + if (lastCert) { + lastCert->next = c; + } else { + ss->ssl3.peerCertChain = c; + } + lastCert = c; + } + + first = PR_FALSE; + } + SECKEY_UpdateCertPQG(ss->sec.peerCert); + + return ssl3_AuthCertificate(ss); /* sets ss->ssl3.hs.ws */ +} + +void +tls13_CipherSpecAddRef(ssl3CipherSpec *spec) +{ + ++spec->refCt; + SSL_TRC(10, ("%d: TLS13[-]: Increment ref ct for spec %d. new ct = %d", + SSL_GETPID(), spec, spec->refCt)); +} + +/* This function is never called on a spec which is on the + * cipherSpecs list. */ +void +tls13_CipherSpecRelease(ssl3CipherSpec *spec) +{ + PORT_Assert(spec->refCt > 0); + --spec->refCt; + SSL_TRC(10, ("%d: TLS13[-]: decrement refct for spec %d. phase=%s new ct = %d", + SSL_GETPID(), spec, spec->phase, spec->refCt)); + if (!spec->refCt) { + SSL_TRC(10, ("%d: TLS13[-]: Freeing spec %d. phase=%s", + SSL_GETPID(), spec, spec->phase)); + PR_REMOVE_LINK(&spec->link); + ssl3_DestroyCipherSpec(spec, PR_TRUE); + PORT_Free(spec); + } +} + +/* Add context to the hash functions as described in + [draft-ietf-tls-tls13; Section 4.9.1] */ +SECStatus +tls13_AddContextToHashes(sslSocket *ss, const SSL3Hashes *hashes, + SSLHashType algorithm, PRBool sending, + SSL3Hashes *tbsHash) +{ + SECStatus rv = SECSuccess; + PK11Context *ctx; + const unsigned char context_padding[] = { + 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, + 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, + 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, + 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, + 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, + 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, + 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, + 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, + }; + + const char *client_cert_verify_string = "TLS 1.3, client CertificateVerify"; + const char *server_cert_verify_string = "TLS 1.3, server CertificateVerify"; + const char *context_string = (sending ^ ss->sec.isServer) ? client_cert_verify_string + : server_cert_verify_string; + unsigned int hashlength; + + /* Double check that we are doing the same hash.*/ + PORT_Assert(hashes->len == tls13_GetHashSize(ss)); + + ctx = PK11_CreateDigestContext(ssl3_HashTypeToOID(algorithm)); + if (!ctx) { + PORT_SetError(SEC_ERROR_NO_MEMORY); + goto loser; + } + + PORT_Assert(SECFailure); + PORT_Assert(!SECSuccess); + + PRINT_BUF(50, (ss, "TLS 1.3 hash without context", hashes->u.raw, hashes->len)); + PRINT_BUF(50, (ss, "Context string", context_string, strlen(context_string))); + rv |= PK11_DigestBegin(ctx); + rv |= PK11_DigestOp(ctx, context_padding, sizeof(context_padding)); + rv |= PK11_DigestOp(ctx, (unsigned char *)context_string, + strlen(context_string) + 1); /* +1 includes the terminating 0 */ + rv |= PK11_DigestOp(ctx, hashes->u.raw, hashes->len); + /* Update the hash in-place */ + rv |= PK11_DigestFinal(ctx, tbsHash->u.raw, &hashlength, sizeof(tbsHash->u.raw)); + PK11_DestroyContext(ctx, PR_TRUE); + PRINT_BUF(50, (ss, "TLS 1.3 hash with context", tbsHash->u.raw, hashlength)); + + tbsHash->len = hashlength; + tbsHash->hashAlg = algorithm; + + if (rv) { + ssl_MapLowLevelError(SSL_ERROR_SHA_DIGEST_FAILURE); + goto loser; + } + return SECSuccess; + +loser: + return SECFailure; +} + +/* + * Derive-Secret(Secret, Label, Messages) = + * HKDF-Expand-Label(Secret, Label, + * Hash(Messages) + Hash(resumption_context), L)) + */ +static SECStatus +tls13_DeriveSecret(sslSocket *ss, PK11SymKey *key, + const char *prefix, + const char *suffix, + const SSL3Hashes *hashes, + PK11SymKey **dest) +{ + SECStatus rv; + SSL3Hashes hashesTmp; + char buf[100]; + const char *label; + + if (prefix) { + if ((strlen(prefix) + strlen(suffix) + 2) > sizeof(buf)) { + PORT_Assert(0); + PORT_SetError(SEC_ERROR_LIBRARY_FAILURE); + return SECFailure; + } + (void)PR_snprintf(buf, sizeof(buf), "%s %s", + prefix, suffix); + label = buf; + } else { + label = suffix; + } + + SSL_TRC(3, ("%d: TLS13[%d]: deriving secret '%s'", + SSL_GETPID(), ss->fd, label)); + if (!hashes) { + rv = tls13_ComputeHandshakeHashes(ss, &hashesTmp); + if (rv != SECSuccess) { + PORT_Assert(0); /* Should never fail */ + ssl_MapLowLevelError(SEC_ERROR_LIBRARY_FAILURE); + return SECFailure; + } + hashes = &hashesTmp; + } + + rv = tls13_HkdfExpandLabel(key, tls13_GetHash(ss), + hashes->u.raw, hashes->len, + label, strlen(label), + tls13_GetHkdfMechanism(ss), + tls13_GetHashSize(ss), dest); + if (rv != SECSuccess) { + LOG_ERROR(ss, SEC_ERROR_LIBRARY_FAILURE); + return SECFailure; + } + return SECSuccess; +} + +/* Derive traffic keys for the next cipher spec in the queue. */ +static SECStatus +tls13_DeriveTrafficKeys(sslSocket *ss, ssl3CipherSpec *spec, + TrafficKeyType type, + CipherSpecDirection direction, + PRBool deleteSecret) +{ + size_t keySize = spec->cipher_def->key_size; + size_t ivSize = spec->cipher_def->iv_size + + spec->cipher_def->explicit_nonce_size; /* This isn't always going to + * work, but it does for + * AES-GCM */ + CK_MECHANISM_TYPE bulkAlgorithm = ssl3_Alg2Mech(spec->cipher_def->calg); + PK11SymKey **prkp = NULL; + PK11SymKey *prk = NULL; + PRBool clientKey; + ssl3KeyMaterial *target; + const char *phase; + SECStatus rv; + /* These labels are just used for debugging. */ + static const char kHkdfPhaseEarlyApplicationDataKeys[] = "early application data"; + static const char kHkdfPhaseHandshakeKeys[] = "handshake data"; + static const char kHkdfPhaseApplicationDataKeys[] = "application data"; + + if (ss->sec.isServer ^ (direction == CipherSpecWrite)) { + clientKey = PR_TRUE; + target = &spec->client; + } else { + clientKey = PR_FALSE; + target = &spec->server; + } + + PORT_Assert(ss->opt.noLocks || ssl_HaveSSL3HandshakeLock(ss)); + + switch (type) { + case TrafficKeyEarlyApplicationData: + PORT_Assert(clientKey); + phase = kHkdfPhaseEarlyApplicationDataKeys; + prkp = &ss->ssl3.hs.clientEarlyTrafficSecret; + break; + case TrafficKeyHandshake: + phase = kHkdfPhaseHandshakeKeys; + prkp = clientKey ? &ss->ssl3.hs.clientHsTrafficSecret : &ss->ssl3.hs.serverHsTrafficSecret; + break; + case TrafficKeyApplicationData: + phase = kHkdfPhaseApplicationDataKeys; + prkp = clientKey ? &ss->ssl3.hs.clientTrafficSecret : &ss->ssl3.hs.serverTrafficSecret; + break; + default: + LOG_ERROR(ss, SEC_ERROR_LIBRARY_FAILURE); + PORT_Assert(0); + return SECFailure; + } + PORT_Assert(prkp != NULL); + prk = *prkp; + + SSL_TRC(3, ("%d: TLS13[%d]: deriving %s traffic keys phase='%s'", + SSL_GETPID(), ss->fd, + (direction == CipherSpecWrite) ? "write" : "read", phase)); + PORT_Assert(phase); + spec->phase = phase; + + rv = tls13_HkdfExpandLabel(prk, tls13_GetHash(ss), + NULL, 0, + kHkdfPurposeKey, strlen(kHkdfPurposeKey), + bulkAlgorithm, keySize, + &target->write_key); + if (rv != SECSuccess) { + LOG_ERROR(ss, SEC_ERROR_LIBRARY_FAILURE); + PORT_Assert(0); + goto loser; + } + + rv = tls13_HkdfExpandLabelRaw(prk, tls13_GetHash(ss), + NULL, 0, + kHkdfPurposeIv, strlen(kHkdfPurposeIv), + target->write_iv, ivSize); + if (rv != SECSuccess) { + LOG_ERROR(ss, SEC_ERROR_LIBRARY_FAILURE); + PORT_Assert(0); + goto loser; + } + + if (deleteSecret) { + PK11_FreeSymKey(prk); + *prkp = NULL; + } + return SECSuccess; + +loser: + return SECFailure; +} + +static SECStatus +tls13_SetupPendingCipherSpec(sslSocket *ss) +{ + ssl3CipherSpec *pSpec; + ssl3CipherSuite suite = ss->ssl3.hs.cipher_suite; + const ssl3BulkCipherDef *bulk = ssl_GetBulkCipherDef( + ssl_LookupCipherSuiteDef(suite)); + + PORT_Assert(ss->opt.noLocks || ssl_HaveSSL3HandshakeLock(ss)); + + ssl_GetSpecWriteLock(ss); /*******************************/ + + pSpec = ss->ssl3.pwSpec; + /* Version isn't set when we send 0-RTT data. */ + pSpec->version = PR_MAX(SSL_LIBRARY_VERSION_TLS_1_3, ss->version); + + SSL_TRC(3, ("%d: TLS13[%d]: Set Pending Cipher Suite to 0x%04x", + SSL_GETPID(), ss->fd, suite)); + pSpec->cipher_def = bulk; + + ssl_ReleaseSpecWriteLock(ss); /*******************************/ + return SECSuccess; +} + +/* Install a new cipher spec for this direction. */ +static SECStatus +tls13_SetCipherSpec(sslSocket *ss, TrafficKeyType type, + CipherSpecDirection direction, PRBool deleteSecret) +{ + SECStatus rv; + ssl3CipherSpec *spec = NULL; + ssl3CipherSpec **specp = (direction == CipherSpecRead) ? &ss->ssl3.crSpec : &ss->ssl3.cwSpec; + /* Flush out old handshake data. */ + ssl_GetXmitBufLock(ss); + rv = ssl3_FlushHandshake(ss, ssl_SEND_FLAG_FORCE_INTO_BUFFER); + ssl_ReleaseXmitBufLock(ss); + if (rv != SECSuccess) { + return SECFailure; + } + + /* Create the new spec. */ + spec = PORT_ZNew(ssl3CipherSpec); + if (!spec) { + PORT_SetError(SEC_ERROR_NO_MEMORY); + return SECFailure; + } + spec->refCt = 1; + PR_APPEND_LINK(&spec->link, &ss->ssl3.hs.cipherSpecs); + ss->ssl3.pwSpec = ss->ssl3.prSpec = spec; + + rv = tls13_SetupPendingCipherSpec(ss); + if (rv != SECSuccess) + return SECFailure; + + switch (spec->cipher_def->calg) { + case calg_aes_gcm: + spec->aead = tls13_AESGCM; + break; + case calg_chacha20: + spec->aead = tls13_ChaCha20Poly1305; + break; + default: + PORT_Assert(0); + return SECFailure; + break; + } + + rv = tls13_DeriveTrafficKeys(ss, spec, type, direction, + deleteSecret); + if (rv != SECSuccess) { + return SECFailure; + } + + /* We use the epoch for cipher suite identification, so increment + * it in both TLS and DTLS. */ + if ((*specp)->epoch == PR_UINT16_MAX) { + return SECFailure; + } + spec->epoch = (*specp)->epoch + 1; + + if (!IS_DTLS(ss)) { + spec->read_seq_num = spec->write_seq_num = 0; + } else { + /* The sequence number has the high 16 bits as the epoch. */ + spec->read_seq_num = spec->write_seq_num = + (sslSequenceNumber)spec->epoch << 48; + + dtls_InitRecvdRecords(&spec->recvdRecords); + } + + /* Now that we've set almost everything up, finally cut over. */ + ssl_GetSpecWriteLock(ss); + tls13_CipherSpecRelease(*specp); /* May delete old cipher. */ + *specp = spec; /* Overwrite. */ + ssl_ReleaseSpecWriteLock(ss); + + SSL_TRC(3, ("%d: TLS13[%d]: %s installed key for phase='%s'.%d dir=%s", + SSL_GETPID(), ss->fd, SSL_ROLE(ss), + spec->phase, spec->epoch, + direction == CipherSpecRead ? "read" : "write")); + + return SECSuccess; +} + +static SECStatus +tls13_ComputeHandshakeHashes(sslSocket *ss, + SSL3Hashes *hashes) +{ + SECStatus rv; + PK11Context *ctx = NULL; + + PORT_Assert(ss->opt.noLocks || ssl_HaveSSL3HandshakeLock(ss)); + if (ss->ssl3.hs.hashType == handshake_hash_unknown) { + /* Backup: if we haven't done any hashing, then hash now. + * This happens when we are doing 0-RTT on the client. */ + ctx = PK11_CreateDigestContext(ssl3_HashTypeToOID(tls13_GetHash(ss))); + if (!ctx) { + ssl_MapLowLevelError(SSL_ERROR_SHA_DIGEST_FAILURE); + return SECFailure; + } + + if (PK11_DigestBegin(ctx) != SECSuccess) { + ssl_MapLowLevelError(SSL_ERROR_SHA_DIGEST_FAILURE); + goto loser; + } + + PRINT_BUF(10, (NULL, "Handshake hash computed over saved messages", + ss->ssl3.hs.messages.buf, + ss->ssl3.hs.messages.len)); + + if (PK11_DigestOp(ctx, + ss->ssl3.hs.messages.buf, + ss->ssl3.hs.messages.len) != SECSuccess) { + ssl_MapLowLevelError(SSL_ERROR_SHA_DIGEST_FAILURE); + goto loser; + } + } else { + ctx = PK11_CloneContext(ss->ssl3.hs.sha); + if (!ctx) { + ssl_MapLowLevelError(SSL_ERROR_SHA_DIGEST_FAILURE); + return SECFailure; + } + } + + rv = PK11_DigestFinal(ctx, hashes->u.raw, + &hashes->len, + sizeof(hashes->u.raw)); + if (rv != SECSuccess) { + ssl_MapLowLevelError(SSL_ERROR_DIGEST_FAILURE); + goto loser; + } + PORT_Assert(hashes->len == tls13_GetHashSize(ss)); + PK11_DestroyContext(ctx, PR_TRUE); + + return SECSuccess; + +loser: + PK11_DestroyContext(ctx, PR_TRUE); + return SECFailure; +} + +void +tls13_DestroyKeyShareEntry(TLS13KeyShareEntry *offer) +{ + SECITEM_ZfreeItem(&offer->key_exchange, PR_FALSE); + PORT_ZFree(offer, sizeof(*offer)); +} + +void +tls13_DestroyKeyShares(PRCList *list) +{ + PRCList *cur_p; + + /* The list must be initialized. */ + PORT_Assert(PR_LIST_HEAD(list)); + + while (!PR_CLIST_IS_EMPTY(list)) { + cur_p = PR_LIST_TAIL(list); + PR_REMOVE_LINK(cur_p); + tls13_DestroyKeyShareEntry((TLS13KeyShareEntry *)cur_p); + } +} + +void +tls13_DestroyEarlyData(PRCList *list) +{ + PRCList *cur_p; + + while (!PR_CLIST_IS_EMPTY(list)) { + TLS13EarlyData *msg; + + cur_p = PR_LIST_TAIL(list); + msg = (TLS13EarlyData *)cur_p; + + PR_REMOVE_LINK(cur_p); + SECITEM_ZfreeItem(&msg->data, PR_FALSE); + PORT_ZFree(msg, sizeof(*msg)); + } +} + +void +tls13_DestroyCipherSpecs(PRCList *list) +{ + PRCList *cur_p; + + while (!PR_CLIST_IS_EMPTY(list)) { + cur_p = PR_LIST_TAIL(list); + PR_REMOVE_LINK(cur_p); + ssl3_DestroyCipherSpec((ssl3CipherSpec *)cur_p, PR_FALSE); + PORT_Free(cur_p); + } +} + +/* draft-ietf-tls-tls13 Section 5.2.2 specifies the following + * nonce algorithm: + * + * The length of the per-record nonce (iv_length) is set to max(8 bytes, + * N_MIN) for the AEAD algorithm (see [RFC5116] Section 4). An AEAD + * algorithm where N_MAX is less than 8 bytes MUST NOT be used with TLS. + * The per-record nonce for the AEAD construction is formed as follows: + * + * 1. The 64-bit record sequence number is padded to the left with + * zeroes to iv_length. + * + * 2. The padded sequence number is XORed with the static + * client_write_iv or server_write_iv, depending on the role. + * + * The resulting quantity (of length iv_length) is used as the per- + * record nonce. + * + * Existing suites have the same nonce size: N_MIN = N_MAX = 12 bytes + * + * See RFC 5288 and https://tools.ietf.org/html/draft-ietf-tls-chacha20-poly1305-04#section-2 + */ +static void +tls13_WriteNonce(ssl3KeyMaterial *keys, + const unsigned char *seqNumBuf, unsigned int seqNumLen, + unsigned char *nonce, unsigned int nonceLen) +{ + size_t i; + + PORT_Assert(nonceLen == 12); + memcpy(nonce, keys->write_iv, 12); + + /* XOR the last 8 bytes of the IV with the sequence number. */ + PORT_Assert(seqNumLen == 8); + for (i = 0; i < 8; ++i) { + nonce[4 + i] ^= seqNumBuf[i]; + } +} + +/* Implement the SSLAEADCipher interface defined in sslimpl.h. + * + * That interface takes the additional data (see below) and reinterprets that as + * a sequence number. In TLS 1.3 there is no additional data so this value is + * just the encoded sequence number. + */ +static SECStatus +tls13_AEAD(ssl3KeyMaterial *keys, PRBool doDecrypt, + unsigned char *out, int *outlen, int maxout, + const unsigned char *in, int inlen, + CK_MECHANISM_TYPE mechanism, + unsigned char *aeadParams, unsigned int aeadParamLength) +{ + SECStatus rv; + unsigned int uOutLen = 0; + SECItem param = { + siBuffer, aeadParams, aeadParamLength + }; + + if (doDecrypt) { + rv = PK11_Decrypt(keys->write_key, mechanism, ¶m, + out, &uOutLen, maxout, in, inlen); + } else { + rv = PK11_Encrypt(keys->write_key, mechanism, ¶m, + out, &uOutLen, maxout, in, inlen); + } + *outlen = (int)uOutLen; + + return rv; +} + +static SECStatus +tls13_AESGCM(ssl3KeyMaterial *keys, + PRBool doDecrypt, + unsigned char *out, + int *outlen, + int maxout, + const unsigned char *in, + int inlen, + const unsigned char *additionalData, + int additionalDataLen) +{ + CK_GCM_PARAMS gcmParams; + unsigned char nonce[12]; + + memset(&gcmParams, 0, sizeof(gcmParams)); + gcmParams.pIv = nonce; + gcmParams.ulIvLen = sizeof(nonce); + gcmParams.pAAD = NULL; + gcmParams.ulAADLen = 0; + gcmParams.ulTagBits = 128; /* GCM measures tag length in bits. */ + + tls13_WriteNonce(keys, additionalData, additionalDataLen, + nonce, sizeof(nonce)); + return tls13_AEAD(keys, doDecrypt, out, outlen, maxout, in, inlen, + CKM_AES_GCM, + (unsigned char *)&gcmParams, sizeof(gcmParams)); +} + +static SECStatus +tls13_ChaCha20Poly1305(ssl3KeyMaterial *keys, PRBool doDecrypt, + unsigned char *out, int *outlen, int maxout, + const unsigned char *in, int inlen, + const unsigned char *additionalData, + int additionalDataLen) +{ + CK_NSS_AEAD_PARAMS aeadParams; + unsigned char nonce[12]; + + memset(&aeadParams, 0, sizeof(aeadParams)); + aeadParams.pNonce = nonce; + aeadParams.ulNonceLen = sizeof(nonce); + aeadParams.pAAD = NULL; /* No AAD in TLS 1.3. */ + aeadParams.ulAADLen = 0; + aeadParams.ulTagLen = 16; /* The Poly1305 tag is 16 octets. */ + + tls13_WriteNonce(keys, additionalData, additionalDataLen, + nonce, sizeof(nonce)); + return tls13_AEAD(keys, doDecrypt, out, outlen, maxout, in, inlen, + CKM_NSS_CHACHA20_POLY1305, + (unsigned char *)&aeadParams, sizeof(aeadParams)); +} + +static SECStatus +tls13_HandleEncryptedExtensions(sslSocket *ss, SSL3Opaque *b, PRUint32 length) +{ + SECStatus rv; + PRInt32 innerLength; + SECItem oldNpn = { siBuffer, NULL, 0 }; + + PORT_Assert(ss->opt.noLocks || ssl_HaveRecvBufLock(ss)); + PORT_Assert(ss->opt.noLocks || ssl_HaveSSL3HandshakeLock(ss)); + + SSL_TRC(3, ("%d: TLS13[%d]: handle encrypted extensions", + SSL_GETPID(), ss->fd)); + + rv = TLS13_CHECK_HS_STATE(ss, SSL_ERROR_RX_UNEXPECTED_ENCRYPTED_EXTENSIONS, + wait_encrypted_extensions); + if (rv != SECSuccess) { + return SECFailure; + } + + innerLength = ssl3_ConsumeHandshakeNumber(ss, 2, &b, &length); + if (innerLength < 0) { + return SECFailure; /* Alert already sent. */ + } + if (innerLength != length) { + FATAL_ERROR(ss, SSL_ERROR_RX_MALFORMED_ENCRYPTED_EXTENSIONS, + illegal_parameter); + return SECFailure; + } + + /* If we are doing 0-RTT, then we already have an NPN value. Stash + * it for comparison. */ + if (ss->ssl3.hs.zeroRttState == ssl_0rtt_sent && + ss->xtnData.nextProtoState == SSL_NEXT_PROTO_EARLY_VALUE) { + oldNpn = ss->xtnData.nextProto; + ss->xtnData.nextProto.data = NULL; + ss->xtnData.nextProtoState = SSL_NEXT_PROTO_NO_SUPPORT; + } + rv = ssl3_HandleExtensions(ss, &b, &length, encrypted_extensions); + if (rv != SECSuccess) { + return SECFailure; /* Error code set below */ + } + + /* We can only get here if we offered 0-RTT. */ + if (ssl3_ExtensionNegotiated(ss, ssl_tls13_early_data_xtn)) { + PORT_Assert(ss->ssl3.hs.zeroRttState == ssl_0rtt_sent); + if (!ss->statelessResume) { + /* Illegal to accept 0-RTT without also accepting PSK. */ + FATAL_ERROR(ss, SSL_ERROR_RX_MALFORMED_ENCRYPTED_EXTENSIONS, + illegal_parameter); + } + ss->ssl3.hs.zeroRttState = ssl_0rtt_accepted; + + /* Check that the server negotiated the same ALPN (if any). */ + if (SECITEM_CompareItem(&oldNpn, &ss->xtnData.nextProto)) { + SECITEM_FreeItem(&oldNpn, PR_FALSE); + FATAL_ERROR(ss, SSL_ERROR_NEXT_PROTOCOL_DATA_INVALID, + illegal_parameter); + return SECFailure; + } + /* Check that the server negotiated the same cipher suite. */ + if (ss->ssl3.hs.cipher_suite != ss->ssl3.hs.zeroRttSuite) { + FATAL_ERROR(ss, SSL_ERROR_RX_MALFORMED_ENCRYPTED_EXTENSIONS, + illegal_parameter); + return SECFailure; + } + } else if (ss->ssl3.hs.zeroRttState == ssl_0rtt_sent) { + /* Though we sent 0-RTT, the early_data extension wasn't present so the + * state is unmodified; the server must have rejected 0-RTT. */ + ss->ssl3.hs.zeroRttState = ssl_0rtt_ignored; + ss->ssl3.hs.zeroRttIgnore = ssl_0rtt_ignore_trial; + } else { + PORT_Assert(ss->ssl3.hs.zeroRttState == ssl_0rtt_none || + (ss->ssl3.hs.helloRetry && + ss->ssl3.hs.zeroRttState == ssl_0rtt_ignored)); + } + + SECITEM_FreeItem(&oldNpn, PR_FALSE); + if (ss->ssl3.hs.kea_def->authKeyType == ssl_auth_psk) { + TLS13_SET_HS_STATE(ss, wait_finished); + } else { + TLS13_SET_HS_STATE(ss, wait_cert_request); + } + + return SECSuccess; +} + +static SECStatus +tls13_SendEncryptedExtensions(sslSocket *ss) +{ + SECStatus rv; + PRInt32 extensions_len = 0; + PRInt32 sent_len = 0; + PRUint32 maxBytes = 65535; + + SSL_TRC(3, ("%d: TLS13[%d]: send encrypted extensions handshake", + SSL_GETPID(), ss->fd)); + + PORT_Assert(ss->opt.noLocks || ssl_HaveSSL3HandshakeLock(ss)); + PORT_Assert(ss->opt.noLocks || ssl_HaveXmitBufLock(ss)); + + extensions_len = ssl3_CallHelloExtensionSenders( + ss, PR_FALSE, maxBytes, &ss->xtnData.encryptedExtensionsSenders[0]); + + rv = ssl3_AppendHandshakeHeader(ss, encrypted_extensions, + extensions_len + 2); + if (rv != SECSuccess) { + LOG_ERROR(ss, SEC_ERROR_LIBRARY_FAILURE); + return SECFailure; + } + rv = ssl3_AppendHandshakeNumber(ss, extensions_len, 2); + if (rv != SECSuccess) { + LOG_ERROR(ss, SEC_ERROR_LIBRARY_FAILURE); + return SECFailure; + } + sent_len = ssl3_CallHelloExtensionSenders( + ss, PR_TRUE, extensions_len, + &ss->xtnData.encryptedExtensionsSenders[0]); + PORT_Assert(sent_len == extensions_len); + if (sent_len != extensions_len) { + LOG_ERROR(ss, SEC_ERROR_LIBRARY_FAILURE); + PORT_Assert(sent_len == 0); + return SECFailure; + } + + return SECSuccess; +} + +SECStatus +tls13_SendCertificateVerify(sslSocket *ss, SECKEYPrivateKey *privKey) +{ + SECStatus rv = SECFailure; + SECItem buf = { siBuffer, NULL, 0 }; + unsigned int len; + SSLHashType hashAlg; + SSL3Hashes hash; + SSL3Hashes tbsHash; /* The hash "to be signed". */ + + PORT_Assert(ss->opt.noLocks || ssl_HaveXmitBufLock(ss)); + PORT_Assert(ss->opt.noLocks || ssl_HaveSSL3HandshakeLock(ss)); + + SSL_TRC(3, ("%d: TLS13[%d]: send certificate_verify handshake", + SSL_GETPID(), ss->fd)); + + PORT_Assert(ss->ssl3.hs.hashType == handshake_hash_single); + rv = tls13_ComputeHandshakeHashes(ss, &hash); + if (rv != SECSuccess) { + return SECFailure; + } + + /* We should have picked a signature scheme when we received a + * CertificateRequest, or when we picked a server certificate. */ + PORT_Assert(ss->ssl3.hs.signatureScheme != ssl_sig_none); + if (ss->ssl3.hs.signatureScheme == ssl_sig_none) { + PORT_SetError(SEC_ERROR_LIBRARY_FAILURE); + return SECFailure; + } + hashAlg = ssl_SignatureSchemeToHashType(ss->ssl3.hs.signatureScheme); + rv = tls13_AddContextToHashes(ss, &hash, hashAlg, + PR_TRUE, &tbsHash); + if (rv != SECSuccess) { + return SECFailure; + } + + rv = ssl3_SignHashes(ss, &tbsHash, privKey, &buf); + if (rv == SECSuccess && !ss->sec.isServer) { + /* Remember the info about the slot that did the signing. + * Later, when doing an SSL restart handshake, verify this. + * These calls are mere accessors, and can't fail. + */ + PK11SlotInfo *slot; + sslSessionID *sid = ss->sec.ci.sid; + + slot = PK11_GetSlotFromPrivateKey(privKey); + sid->u.ssl3.clAuthSeries = PK11_GetSlotSeries(slot); + sid->u.ssl3.clAuthSlotID = PK11_GetSlotID(slot); + sid->u.ssl3.clAuthModuleID = PK11_GetModuleID(slot); + sid->u.ssl3.clAuthValid = PR_TRUE; + PK11_FreeSlot(slot); + } + if (rv != SECSuccess) { + goto done; /* err code was set by ssl3_SignHashes */ + } + + len = buf.len + 2 + 2; + + rv = ssl3_AppendHandshakeHeader(ss, certificate_verify, len); + if (rv != SECSuccess) { + goto done; /* error code set by AppendHandshake */ + } + + rv = ssl3_AppendHandshakeNumber(ss, ss->ssl3.hs.signatureScheme, 2); + if (rv != SECSuccess) { + goto done; /* err set by AppendHandshakeNumber */ + } + + rv = ssl3_AppendHandshakeVariable(ss, buf.data, buf.len, 2); + if (rv != SECSuccess) { + goto done; /* error code set by AppendHandshake */ + } + +done: + /* For parity with the allocation functions, which don't use + * SECITEM_AllocItem(). */ + if (buf.data) + PORT_Free(buf.data); + return rv; +} + +/* Called from tls13_CompleteHandleHandshakeMessage() when it has deciphered a complete + * tls13 CertificateVerify message + * Caller must hold Handshake and RecvBuf locks. + */ +SECStatus +tls13_HandleCertificateVerify(sslSocket *ss, SSL3Opaque *b, PRUint32 length, + SSL3Hashes *hashes) +{ + SECItem signed_hash = { siBuffer, NULL, 0 }; + SECStatus rv; + SSLSignatureScheme sigScheme; + SSLHashType hashAlg; + SSL3Hashes tbsHash; + + SSL_TRC(3, ("%d: TLS13[%d]: handle certificate_verify handshake", + SSL_GETPID(), ss->fd)); + PORT_Assert(ss->opt.noLocks || ssl_HaveRecvBufLock(ss)); + PORT_Assert(ss->opt.noLocks || ssl_HaveSSL3HandshakeLock(ss)); + + rv = TLS13_CHECK_HS_STATE(ss, SSL_ERROR_RX_UNEXPECTED_CERT_VERIFY, + wait_cert_verify); + if (rv != SECSuccess) { + return SECFailure; + } + PORT_Assert(hashes); + + rv = ssl_ConsumeSignatureScheme(ss, &b, &length, &sigScheme); + if (rv != SECSuccess) { + PORT_SetError(SSL_ERROR_RX_MALFORMED_CERT_VERIFY); + return SECFailure; + } + + rv = ssl_CheckSignatureSchemeConsistency(ss, sigScheme, ss->sec.peerCert); + if (rv != SECSuccess) { + /* Error set already */ + return SECFailure; + } + hashAlg = ssl_SignatureSchemeToHashType(sigScheme); + + rv = tls13_AddContextToHashes(ss, hashes, hashAlg, PR_FALSE, &tbsHash); + if (rv != SECSuccess) { + FATAL_ERROR(ss, SSL_ERROR_DIGEST_FAILURE, internal_error); + return SECFailure; + } + + rv = ssl3_ConsumeHandshakeVariable(ss, &signed_hash, 2, &b, &length); + if (rv != SECSuccess) { + PORT_SetError(SSL_ERROR_RX_MALFORMED_CERT_VERIFY); + return SECFailure; + } + + if (length != 0) { + FATAL_ERROR(ss, SSL_ERROR_RX_MALFORMED_CERT_VERIFY, decode_error); + return SECFailure; + } + + rv = ssl3_VerifySignedHashes(ss, sigScheme, &tbsHash, &signed_hash); + if (rv != SECSuccess) { + FATAL_ERROR(ss, PORT_GetError(), decrypt_error); + return SECFailure; + } + + /* Set the auth type. */ + if (!ss->sec.isServer) { + switch (ssl_SignatureSchemeToKeyType(sigScheme)) { + case rsaKey: + ss->sec.authType = ssl_auth_rsa_sign; + break; + case ecKey: + ss->sec.authType = ssl_auth_ecdsa; + break; + default: + PORT_Assert(PR_FALSE); + } + } + + /* Request a client certificate now if one was requested. */ + if (ss->ssl3.hs.certificateRequest) { + TLS13CertificateRequest *req = ss->ssl3.hs.certificateRequest; + + PORT_Assert(!ss->sec.isServer); + rv = ssl3_CompleteHandleCertificateRequest(ss, req->signatureSchemes, + req->signatureSchemeCount, + &req->ca_list); + if (rv != SECSuccess) { + FATAL_ERROR(ss, SEC_ERROR_LIBRARY_FAILURE, internal_error); + return rv; + } + } + + TLS13_SET_HS_STATE(ss, wait_finished); + + return SECSuccess; +} + +static SECStatus +tls13_ComputePskBinderHash(sslSocket *ss, unsigned long prefixLength, + SSL3Hashes *hashes) +{ + SECStatus rv; + + PORT_Assert(ss->ssl3.hs.hashType == handshake_hash_unknown); + PORT_Assert(ss->opt.noLocks || ssl_HaveSSL3HandshakeLock(ss)); + PORT_Assert(prefixLength <= ss->ssl3.hs.messages.len); + + PRINT_BUF(10, (NULL, "Handshake hash computed over ClientHello prefix", + ss->ssl3.hs.messages.buf, prefixLength)); + rv = PK11_HashBuf(ssl3_HashTypeToOID(tls13_GetHash(ss)), + hashes->u.raw, + ss->ssl3.hs.messages.buf, prefixLength); + if (rv != SECSuccess) { + ssl_MapLowLevelError(SSL_ERROR_SHA_DIGEST_FAILURE); + goto loser; + } + hashes->len = tls13_GetHashSize(ss); + + PRINT_BUF(10, (NULL, "PSK Binder hash", + hashes->u.raw, hashes->len)); + + return SECSuccess; + +loser: + return SECFailure; +} +/* Compute the PSK Binder This is kind of sneaky.*/ +SECStatus +tls13_ComputePskBinder(sslSocket *ss, PRBool sending, + unsigned int prefixLength, + PRUint8 *output, unsigned int *outputLen, + unsigned int maxOutputLen) +{ + SSL3Hashes hashes; + SECStatus rv; + + rv = tls13_ComputePskBinderHash(ss, prefixLength, &hashes); + if (rv != SECSuccess) + return SECFailure; + + return tls13_ComputeFinished(ss, ss->ssl3.hs.pskBinderKey, &hashes, + sending, output, outputLen, maxOutputLen); +} + +static SECStatus +tls13_ComputeFinished(sslSocket *ss, PK11SymKey *baseKey, + const SSL3Hashes *hashes, + PRBool sending, PRUint8 *output, unsigned int *outputLen, + unsigned int maxOutputLen) +{ + SECStatus rv; + PK11Context *hmacCtx = NULL; + CK_MECHANISM_TYPE macAlg = tls13_GetHmacMechanism(ss); + SECItem param = { siBuffer, NULL, 0 }; + unsigned int outputLenUint; + const char *label = kHkdfLabelFinishedSecret; + PK11SymKey *secret = NULL; + + PORT_Assert(baseKey); + SSL_TRC(3, ("%d: TLS13[%d]: %s calculate finished", + SSL_GETPID(), ss->fd, SSL_ROLE(ss))); + PRINT_BUF(50, (ss, "Handshake hash", hashes->u.raw, hashes->len)); + + /* Now derive the appropriate finished secret from the base secret. */ + rv = tls13_HkdfExpandLabel(baseKey, + tls13_GetHash(ss), + NULL, 0, + label, strlen(label), + tls13_GetHmacMechanism(ss), + tls13_GetHashSize(ss), &secret); + if (rv != SECSuccess) { + goto abort; + } + + PORT_Assert(hashes->len == tls13_GetHashSize(ss)); + hmacCtx = PK11_CreateContextBySymKey(macAlg, CKA_SIGN, + secret, ¶m); + if (!hmacCtx) { + goto abort; + } + + rv = PK11_DigestBegin(hmacCtx); + if (rv != SECSuccess) + goto abort; + + rv = PK11_DigestOp(hmacCtx, hashes->u.raw, hashes->len); + if (rv != SECSuccess) + goto abort; + + PORT_Assert(maxOutputLen >= tls13_GetHashSize(ss)); + rv = PK11_DigestFinal(hmacCtx, output, &outputLenUint, maxOutputLen); + if (rv != SECSuccess) + goto abort; + *outputLen = outputLenUint; + + PK11_FreeSymKey(secret); + PK11_DestroyContext(hmacCtx, PR_TRUE); + return SECSuccess; + +abort: + if (secret) { + PK11_FreeSymKey(secret); + } + + if (hmacCtx) { + PK11_DestroyContext(hmacCtx, PR_TRUE); + } + + PORT_SetError(SEC_ERROR_LIBRARY_FAILURE); + return SECFailure; +} + +static SECStatus +tls13_SendFinished(sslSocket *ss, PK11SymKey *baseKey) +{ + SECStatus rv; + PRUint8 finishedBuf[TLS13_MAX_FINISHED_SIZE]; + unsigned int finishedLen; + SSL3Hashes hashes; + + SSL_TRC(3, ("%d: TLS13[%d]: send finished handshake", SSL_GETPID(), ss->fd)); + + PORT_Assert(ss->opt.noLocks || ssl_HaveXmitBufLock(ss)); + PORT_Assert(ss->opt.noLocks || ssl_HaveSSL3HandshakeLock(ss)); + + rv = tls13_ComputeHandshakeHashes(ss, &hashes); + if (rv != SECSuccess) { + LOG_ERROR(ss, SEC_ERROR_LIBRARY_FAILURE); + return SECFailure; + } + + ssl_GetSpecReadLock(ss); + rv = tls13_ComputeFinished(ss, baseKey, &hashes, PR_TRUE, + finishedBuf, &finishedLen, sizeof(finishedBuf)); + ssl_ReleaseSpecReadLock(ss); + if (rv != SECSuccess) { + LOG_ERROR(ss, SEC_ERROR_LIBRARY_FAILURE); + return SECFailure; + } + + rv = ssl3_AppendHandshakeHeader(ss, finished, finishedLen); + if (rv != SECSuccess) { + return SECFailure; /* Error code already set. */ + } + + rv = ssl3_AppendHandshake(ss, finishedBuf, finishedLen); + if (rv != SECSuccess) { + return SECFailure; /* Error code already set. */ + } + + /* TODO(ekr@rtfm.com): Record key log */ + return SECSuccess; +} + +static SECStatus +tls13_VerifyFinished(sslSocket *ss, SSL3HandshakeType message, + PK11SymKey *secret, + SSL3Opaque *b, PRUint32 length, + const SSL3Hashes *hashes) +{ + SECStatus rv; + PRUint8 finishedBuf[TLS13_MAX_FINISHED_SIZE]; + unsigned int finishedLen; + + if (!hashes) { + FATAL_ERROR(ss, SEC_ERROR_LIBRARY_FAILURE, internal_error); + return SECFailure; + } + + rv = tls13_ComputeFinished(ss, secret, hashes, PR_FALSE, + finishedBuf, &finishedLen, sizeof(finishedBuf)); + if (rv != SECSuccess) { + FATAL_ERROR(ss, SEC_ERROR_LIBRARY_FAILURE, internal_error); + return SECFailure; + } + + if (length != finishedLen) { +#ifndef UNSAFE_FUZZER_MODE + FATAL_ERROR(ss, message == finished ? SSL_ERROR_RX_MALFORMED_FINISHED : SSL_ERROR_RX_MALFORMED_CLIENT_HELLO, illegal_parameter); + return SECFailure; +#endif + } + + if (NSS_SecureMemcmp(b, finishedBuf, finishedLen) != 0) { +#ifndef UNSAFE_FUZZER_MODE + FATAL_ERROR(ss, SSL_ERROR_BAD_HANDSHAKE_HASH_VALUE, + decrypt_error); + return SECFailure; +#endif + } + + return SECSuccess; +} + +static SECStatus +tls13_ClientHandleFinished(sslSocket *ss, SSL3Opaque *b, PRUint32 length, + const SSL3Hashes *hashes) +{ + SECStatus rv; + + PORT_Assert(ss->opt.noLocks || ssl_HaveRecvBufLock(ss)); + PORT_Assert(ss->opt.noLocks || ssl_HaveSSL3HandshakeLock(ss)); + + SSL_TRC(3, ("%d: TLS13[%d]: client handle finished handshake", + SSL_GETPID(), ss->fd)); + + rv = TLS13_CHECK_HS_STATE(ss, SSL_ERROR_RX_UNEXPECTED_FINISHED, + wait_finished); + if (rv != SECSuccess) { + return SECFailure; + } + + rv = tls13_VerifyFinished(ss, finished, + ss->ssl3.hs.serverHsTrafficSecret, + b, length, hashes); + if (rv != SECSuccess) + return SECFailure; + + return tls13_SendClientSecondRound(ss); +} + +static SECStatus +tls13_ServerHandleFinished(sslSocket *ss, SSL3Opaque *b, PRUint32 length, + const SSL3Hashes *hashes) +{ + SECStatus rv; + PK11SymKey *secret; + + PORT_Assert(ss->opt.noLocks || ssl_HaveRecvBufLock(ss)); + PORT_Assert(ss->opt.noLocks || ssl_HaveSSL3HandshakeLock(ss)); + + SSL_TRC(3, ("%d: TLS13[%d]: server handle finished handshake", + SSL_GETPID(), ss->fd)); + + rv = TLS13_CHECK_HS_STATE(ss, SSL_ERROR_RX_UNEXPECTED_FINISHED, wait_finished); + if (rv != SECSuccess) { + return SECFailure; + } + + if (TLS13_IN_HS_STATE(ss, wait_finished)) { + secret = ss->ssl3.hs.clientHsTrafficSecret; + } else { + secret = ss->ssl3.hs.clientEarlyTrafficSecret; + } + + rv = tls13_VerifyFinished(ss, finished, secret, b, length, hashes); + if (rv != SECSuccess) + return SECFailure; + + rv = tls13_SetCipherSpec(ss, TrafficKeyApplicationData, + CipherSpecRead, PR_TRUE); + if (rv != SECSuccess) { + FATAL_ERROR(ss, SEC_ERROR_LIBRARY_FAILURE, internal_error); + return SECFailure; + } + + rv = tls13_FinishHandshake(ss); + if (rv != SECSuccess) { + return SECFailure; /* Error code and alerts handled below */ + } + ssl_GetXmitBufLock(ss); + if (ss->opt.enableSessionTickets) { + rv = tls13_SendNewSessionTicket(ss); + if (rv != SECSuccess) { + ssl_ReleaseXmitBufLock(ss); + return SECFailure; /* Error code and alerts handled below */ + } + rv = ssl3_FlushHandshake(ss, 0); + } + ssl_ReleaseXmitBufLock(ss); + if (rv != SECSuccess) + return SECFailure; + + return SECSuccess; +} + +static SECStatus +tls13_FinishHandshake(sslSocket *ss) +{ + SECStatus rv; + + PORT_Assert(ss->opt.noLocks || ssl_HaveRecvBufLock(ss)); + PORT_Assert(ss->opt.noLocks || ssl_HaveSSL3HandshakeLock(ss)); + PORT_Assert(ss->ssl3.hs.restartTarget == NULL); + + rv = tls13_ComputeFinalSecrets(ss); + if (rv != SECSuccess) + return SECFailure; + + /* The first handshake is now completed. */ + ss->handshake = NULL; + + /* Don't need this. */ + PK11_FreeSymKey(ss->ssl3.hs.clientHsTrafficSecret); + ss->ssl3.hs.clientHsTrafficSecret = NULL; + PK11_FreeSymKey(ss->ssl3.hs.serverHsTrafficSecret); + ss->ssl3.hs.serverHsTrafficSecret = NULL; + + TLS13_SET_HS_STATE(ss, idle_handshake); + + ssl_FinishHandshake(ss); + + return SECSuccess; +} + +/* Do the parts of sending the client's second round that require + * the XmitBuf lock. */ +static SECStatus +tls13_SendClientSecondFlight(sslSocket *ss, PRBool sendClientCert, + SSL3AlertDescription *sendAlert) +{ + SECStatus rv; + + PORT_Assert(ss->opt.noLocks || ssl_HaveXmitBufLock(ss)); + + *sendAlert = internal_error; + + if (ss->ssl3.sendEmptyCert) { + ss->ssl3.sendEmptyCert = PR_FALSE; + rv = ssl3_SendEmptyCertificate(ss); + /* Don't send verify */ + if (rv != SECSuccess) { + return SECFailure; /* error code is set. */ + } + } else if (sendClientCert) { + rv = tls13_SendCertificate(ss); + if (rv != SECSuccess) { + return SECFailure; /* error code is set. */ + } + } + if (ss->ssl3.hs.certificateRequest) { + PORT_FreeArena(ss->ssl3.hs.certificateRequest->arena, PR_FALSE); + ss->ssl3.hs.certificateRequest = NULL; + } + + if (sendClientCert) { + rv = tls13_SendCertificateVerify(ss, ss->ssl3.clientPrivateKey); + SECKEY_DestroyPrivateKey(ss->ssl3.clientPrivateKey); + ss->ssl3.clientPrivateKey = NULL; + if (rv != SECSuccess) { + return SECFailure; /* err is set. */ + } + } + + rv = tls13_SendFinished(ss, ss->ssl3.hs.clientHsTrafficSecret); + if (rv != SECSuccess) { + return SECFailure; /* err code was set. */ + } + rv = ssl3_FlushHandshake(ss, IS_DTLS(ss) ? ssl_SEND_FLAG_NO_RETRANSMIT : 0); + if (rv != SECSuccess) { + /* No point in sending an alert here because we're not going to + * be able to send it if we couldn't flush the handshake. */ + *sendAlert = no_alert; + return SECFailure; + } + + rv = dtls_StartHolddownTimer(ss); + if (rv != SECSuccess) { + return SECFailure; /* err code was set. */ + } + + return SECSuccess; +} + +static SECStatus +tls13_SendClientSecondRound(sslSocket *ss) +{ + SECStatus rv; + PRBool sendClientCert; + SSL3AlertDescription sendAlert = no_alert; + + PORT_Assert(ss->opt.noLocks || ssl_HaveRecvBufLock(ss)); + PORT_Assert(ss->opt.noLocks || ssl_HaveSSL3HandshakeLock(ss)); + + sendClientCert = !ss->ssl3.sendEmptyCert && + ss->ssl3.clientCertChain != NULL && + ss->ssl3.clientPrivateKey != NULL; + + /* Defer client authentication sending if we are still waiting for server + * authentication. This avoids unnecessary disclosure of client credentials + * to an unauthenticated server. + */ + if (ss->ssl3.hs.restartTarget) { + PR_NOT_REACHED("unexpected ss->ssl3.hs.restartTarget"); + PORT_SetError(SEC_ERROR_LIBRARY_FAILURE); + return SECFailure; + } + if (ss->ssl3.hs.authCertificatePending) { + SSL_TRC(3, ("%d: TLS13[%d]: deferring ssl3_SendClientSecondRound because" + " certificate authentication is still pending.", + SSL_GETPID(), ss->fd)); + ss->ssl3.hs.restartTarget = tls13_SendClientSecondRound; + return SECWouldBlock; + } + + if (ss->ssl3.hs.zeroRttState != ssl_0rtt_none) { + if (ss->ssl3.hs.zeroRttState == ssl_0rtt_accepted) { + rv = tls13_SendEndOfEarlyData(ss); + if (rv != SECSuccess) { + return SECFailure; /* Error code already set. */ + } + } + if (IS_DTLS(ss) && !ss->ssl3.hs.helloRetry) { + /* Reset the counters so that the next epoch isn't set + * incorrectly. */ + tls13_SetNullCipherSpec(ss, &ss->ssl3.cwSpec); + } + } + + rv = tls13_SetCipherSpec(ss, TrafficKeyHandshake, + CipherSpecWrite, PR_FALSE); + if (rv != SECSuccess) { + FATAL_ERROR(ss, SSL_ERROR_INIT_CIPHER_SUITE_FAILURE, internal_error); + return SECFailure; + } + + rv = tls13_ComputeApplicationSecrets(ss); + if (rv != SECSuccess) { + FATAL_ERROR(ss, SEC_ERROR_LIBRARY_FAILURE, internal_error); + return SECFailure; + } + + rv = tls13_SetCipherSpec(ss, TrafficKeyApplicationData, + CipherSpecRead, PR_FALSE); + if (rv != SECSuccess) { + FATAL_ERROR(ss, SEC_ERROR_LIBRARY_FAILURE, internal_error); + return SECFailure; + } + + ssl_GetXmitBufLock(ss); /*******************************/ + rv = tls13_SendClientSecondFlight(ss, sendClientCert, &sendAlert); + ssl_ReleaseXmitBufLock(ss); /*******************************/ + if (rv != SECSuccess) { + if (sendAlert != no_alert) { + FATAL_ERROR(ss, PORT_GetError(), sendAlert); + } else { + LOG_ERROR(ss, PORT_GetError()); + } + return SECFailure; + } + rv = tls13_SetCipherSpec(ss, TrafficKeyApplicationData, + CipherSpecWrite, PR_TRUE); + if (rv != SECSuccess) { + PORT_SetError(SEC_ERROR_LIBRARY_FAILURE); + return SECFailure; + } + + /* The handshake is now finished */ + return tls13_FinishHandshake(ss); +} + +/* + * enum { (65535) } TicketExtensionType; + * + * struct { + * TicketExtensionType extension_type; + * opaque extension_data<0..2^16-1>; + * } TicketExtension; + * + * struct { + * uint32 ticket_lifetime; + * uint32 ticket_age_add; + * opaque ticket<1..2^16-1>; + * TicketExtension extensions<0..2^16-2>; + * } NewSessionTicket; + */ + +#define MAX_EARLY_DATA_SIZE (2 << 16) /* Arbitrary limit. */ + +SECStatus +tls13_SendNewSessionTicket(sslSocket *ss) +{ + PRUint16 message_length; + SECItem ticket_data = { 0, NULL, 0 }; + SECStatus rv; + NewSessionTicket ticket = { 0 }; + PRUint32 max_early_data_size_len = 0; + ticket.flags = 0; + if (ss->opt.enable0RttData) { + ticket.flags |= ticket_allow_early_data; + max_early_data_size_len = 8; /* type + len + value. */ + } + ticket.ticket_lifetime_hint = TLS_EX_SESS_TICKET_LIFETIME_HINT; + + rv = ssl3_EncodeSessionTicket(ss, &ticket, &ticket_data); + if (rv != SECSuccess) + goto loser; + + message_length = + 4 + /* lifetime */ + 4 + /* ticket_age_add */ + 2 + max_early_data_size_len + /* max_early_data_size_len */ + 2 + /* ticket length */ + ticket_data.len; + + rv = ssl3_AppendHandshakeHeader(ss, new_session_ticket, + message_length); + if (rv != SECSuccess) + goto loser; + + /* This is a fixed value. */ + rv = ssl3_AppendHandshakeNumber(ss, TLS_EX_SESS_TICKET_LIFETIME_HINT, 4); + if (rv != SECSuccess) + goto loser; + + /* The ticket age obfuscator. */ + rv = PK11_GenerateRandom((PRUint8 *)&ticket.ticket_age_add, + sizeof(ticket.ticket_age_add)); + if (rv != SECSuccess) + goto loser; + + rv = ssl3_AppendHandshakeNumber(ss, ticket.ticket_age_add, 4); + if (rv != SECSuccess) + goto loser; + + /* Encode the ticket. */ + rv = ssl3_AppendHandshakeVariable( + ss, ticket_data.data, ticket_data.len, 2); + if (rv != SECSuccess) + goto loser; + + /* Extensions. */ + rv = ssl3_AppendHandshakeNumber(ss, max_early_data_size_len, 2); + if (rv != SECSuccess) + goto loser; + + if (max_early_data_size_len) { + rv = ssl3_AppendHandshakeNumber( + ss, ssl_tls13_ticket_early_data_info_xtn, 2); + if (rv != SECSuccess) + goto loser; + + /* Length */ + rv = ssl3_AppendHandshakeNumber(ss, 4, 2); + if (rv != SECSuccess) + goto loser; + + rv = ssl3_AppendHandshakeNumber(ss, MAX_EARLY_DATA_SIZE, 4); + if (rv != SECSuccess) + goto loser; + } + + SECITEM_FreeItem(&ticket_data, PR_FALSE); + return SECSuccess; + +loser: + if (ticket_data.data) { + SECITEM_FreeItem(&ticket_data, PR_FALSE); + } + return SECFailure; +} + +static SECStatus +tls13_HandleNewSessionTicket(sslSocket *ss, SSL3Opaque *b, PRUint32 length) +{ + SECStatus rv; + PRInt32 tmp; + PRUint32 utmp; + NewSessionTicket ticket = { 0 }; + SECItem data; + SECItem ticket_data; + + SSL_TRC(3, ("%d: TLS13[%d]: handle new session ticket message", + SSL_GETPID(), ss->fd)); + + rv = TLS13_CHECK_HS_STATE(ss, SSL_ERROR_RX_UNEXPECTED_NEW_SESSION_TICKET, + idle_handshake); + if (rv != SECSuccess) { + return SECFailure; + } + if (!ss->firstHsDone || ss->sec.isServer) { + FATAL_ERROR(ss, SSL_ERROR_RX_UNEXPECTED_NEW_SESSION_TICKET, + unexpected_message); + return SECFailure; + } + + ticket.received_timestamp = ssl_Time(); + tmp = ssl3_ConsumeHandshakeNumber(ss, 4, &b, &length); + if (tmp < 0) { + FATAL_ERROR(ss, SSL_ERROR_RX_MALFORMED_NEW_SESSION_TICKET, + decode_error); + return SECFailure; + } + ticket.ticket_lifetime_hint = (PRUint32)tmp; + ticket.ticket.type = siBuffer; + + rv = ssl3_ConsumeHandshake(ss, &utmp, sizeof(utmp), + &b, &length); + if (rv != SECSuccess) { + PORT_SetError(SSL_ERROR_RX_MALFORMED_NEW_SESSION_TICKET); + return SECFailure; + } + ticket.ticket_age_add = PR_ntohl(utmp); + + /* Get the ticket value. */ + rv = ssl3_ConsumeHandshakeVariable(ss, &ticket_data, 2, &b, &length); + if (rv != SECSuccess || !ticket_data.len) { + FATAL_ERROR(ss, SSL_ERROR_RX_MALFORMED_NEW_SESSION_TICKET, + decode_error); + return SECFailure; + } + + /* Parse extensions. */ + rv = ssl3_ConsumeHandshakeVariable(ss, &data, 2, &b, &length); + if (rv != SECSuccess) { + FATAL_ERROR(ss, SSL_ERROR_RX_MALFORMED_NEW_SESSION_TICKET, + decode_error); + return SECFailure; + } + + rv = ssl3_HandleExtensions(ss, &data.data, + &data.len, new_session_ticket); + if (rv != SECSuccess) { + FATAL_ERROR(ss, SSL_ERROR_RX_MALFORMED_NEW_SESSION_TICKET, + decode_error); + return SECFailure; + } + if (ss->xtnData.max_early_data_size) { + ticket.flags |= ticket_allow_early_data; + ticket.max_early_data_size = ss->xtnData.max_early_data_size; + } + + if (length != 0) { + FATAL_ERROR(ss, SSL_ERROR_RX_MALFORMED_NEW_SESSION_TICKET, + decode_error); + return SECFailure; + } + + if (!ss->opt.noCache) { + PORT_Assert(ss->sec.ci.sid); + rv = SECITEM_CopyItem(NULL, &ticket.ticket, &ticket_data); + if (rv != SECSuccess) { + FATAL_ERROR(ss, SEC_ERROR_NO_MEMORY, internal_error); + return SECFailure; + } + PRINT_BUF(50, (ss, "Caching session ticket", + ticket.ticket.data, + ticket.ticket.len)); + + /* Replace a previous session ticket when + * we receive a second NewSessionTicket message. */ + if (ss->sec.ci.sid->cached == in_client_cache) { + /* Create a new session ID. */ + sslSessionID *sid = ssl3_NewSessionID(ss, PR_FALSE); + if (!sid) { + return SECFailure; + } + + /* Copy over the peerCert. */ + PORT_Assert(ss->sec.ci.sid->peerCert); + sid->peerCert = CERT_DupCertificate(ss->sec.ci.sid->peerCert); + if (!sid->peerCert) { + ssl_FreeSID(sid); + return SECFailure; + } + + /* Destroy the old SID. */ + ss->sec.uncache(ss->sec.ci.sid); + ssl_FreeSID(ss->sec.ci.sid); + ss->sec.ci.sid = sid; + } + + ssl3_SetSIDSessionTicket(ss->sec.ci.sid, &ticket); + PORT_Assert(!ticket.ticket.data); + + rv = ssl3_FillInCachedSID(ss, ss->sec.ci.sid); + if (rv != SECSuccess) + return SECFailure; + + /* Cache the session. */ + ss->sec.cache(ss->sec.ci.sid); + } + + return SECSuccess; +} + +typedef enum { + ExtensionNotUsed, + ExtensionClientOnly, + ExtensionSendClear, + ExtensionSendClearOrHrr, + ExtensionSendHrr, + ExtensionSendEncrypted, + ExtensionSendCertificate, + ExtensionNewSessionTicket +} Tls13ExtensionStatus; + +static const struct { + PRUint16 ex_value; + Tls13ExtensionStatus status; +} KnownExtensions[] = { + { ssl_server_name_xtn, ExtensionSendEncrypted }, + { ssl_supported_groups_xtn, ExtensionSendEncrypted }, + { ssl_ec_point_formats_xtn, ExtensionNotUsed }, + { ssl_signature_algorithms_xtn, ExtensionClientOnly }, + { ssl_use_srtp_xtn, ExtensionSendEncrypted }, + { ssl_app_layer_protocol_xtn, ExtensionSendEncrypted }, + { ssl_padding_xtn, ExtensionNotUsed }, + { ssl_extended_master_secret_xtn, ExtensionNotUsed }, + { ssl_session_ticket_xtn, ExtensionClientOnly }, + { ssl_tls13_key_share_xtn, ExtensionSendClearOrHrr }, + { ssl_tls13_pre_shared_key_xtn, ExtensionSendClear }, + { ssl_tls13_early_data_xtn, ExtensionSendEncrypted }, + { ssl_next_proto_nego_xtn, ExtensionNotUsed }, + { ssl_renegotiation_info_xtn, ExtensionNotUsed }, + { ssl_signed_cert_timestamp_xtn, ExtensionSendCertificate }, + { ssl_cert_status_xtn, ExtensionSendCertificate }, + { ssl_tls13_ticket_early_data_info_xtn, ExtensionNewSessionTicket }, + { ssl_tls13_cookie_xtn, ExtensionSendHrr }, + { ssl_tls13_short_header_xtn, ExtensionSendClear } +}; + +PRBool +tls13_ExtensionAllowed(PRUint16 extension, SSL3HandshakeType message) +{ + unsigned int i; + + PORT_Assert((message == client_hello) || + (message == server_hello) || + (message == hello_retry_request) || + (message == encrypted_extensions) || + (message == new_session_ticket) || + (message == certificate)); + + for (i = 0; i < PR_ARRAY_SIZE(KnownExtensions); i++) { + if (KnownExtensions[i].ex_value == extension) + break; + } + if (i == PR_ARRAY_SIZE(KnownExtensions)) { + /* We have never heard of this extension which is OK + * in client_hello and new_session_ticket. */ + return (message == client_hello) || + (message == new_session_ticket); + } + + switch (KnownExtensions[i].status) { + case ExtensionNotUsed: + return PR_FALSE; + case ExtensionClientOnly: + return message == client_hello; + case ExtensionSendClear: + return message == client_hello || + message == server_hello; + case ExtensionSendClearOrHrr: + return message == client_hello || + message == server_hello || + message == hello_retry_request; + case ExtensionSendHrr: + return message == client_hello || + message == hello_retry_request; + case ExtensionSendEncrypted: + return message == client_hello || + message == encrypted_extensions; + case ExtensionNewSessionTicket: + return message == new_session_ticket; + case ExtensionSendCertificate: + return message == client_hello || + message == certificate; + } + + PORT_Assert(0); + + /* Not reached */ + return PR_TRUE; +} + +/* TLS 1.3 doesn't actually have additional data but the aead function + * signature overloads additional data to carry the record sequence + * number and that's what we put here. The TLS 1.3 AEAD functions + * just use this input as the sequence number and not as additional + * data. */ +static void +tls13_FormatAdditionalData(PRUint8 *aad, unsigned int length, + sslSequenceNumber seqNum) +{ + PRUint8 *ptr = aad; + + PORT_Assert(length == 8); + ptr = ssl_EncodeUintX(seqNum, 8, ptr); + PORT_Assert((ptr - aad) == length); +} + +SECStatus +tls13_ProtectRecord(sslSocket *ss, + ssl3CipherSpec *cwSpec, + SSL3ContentType type, + const SSL3Opaque *pIn, + PRUint32 contentLen, + sslBuffer *wrBuf) +{ + const ssl3BulkCipherDef *cipher_def = cwSpec->cipher_def; + const int tagLen = cipher_def->tag_size; + SECStatus rv; + + SSL_TRC(3, ("%d: TLS13[%d]: spec=%d (%s) protect record 0x%0llx len=%u", + SSL_GETPID(), ss->fd, cwSpec, cwSpec->phase, + cwSpec->write_seq_num, contentLen)); + + if (contentLen + 1 + tagLen > wrBuf->space) { + PORT_SetError(SEC_ERROR_LIBRARY_FAILURE); + return SECFailure; + } + + /* Copy the data into the wrBuf. We're going to encrypt in-place + * in the AEAD branch anyway */ + PORT_Memcpy(wrBuf->buf, pIn, contentLen); + + if (cipher_def->calg == ssl_calg_null) { + /* Shortcut for plaintext */ + wrBuf->len = contentLen; + } else { + PRUint8 aad[8]; + PORT_Assert(cipher_def->type == type_aead); + + /* Add the content type at the end. */ + wrBuf->buf[contentLen] = type; + + tls13_FormatAdditionalData(aad, sizeof(aad), cwSpec->write_seq_num); + rv = cwSpec->aead( + ss->sec.isServer ? &cwSpec->server : &cwSpec->client, + PR_FALSE, /* do encrypt */ + wrBuf->buf, /* output */ + (int *)&wrBuf->len, /* out len */ + wrBuf->space, /* max out */ + wrBuf->buf, contentLen + 1, /* input */ + aad, sizeof(aad)); + if (rv != SECSuccess) { + PORT_SetError(SSL_ERROR_ENCRYPTION_FAILURE); + return SECFailure; + } + } + + return SECSuccess; +} + +/* Unprotect a TLS 1.3 record and leave the result in plaintext. + * + * Called by ssl3_HandleRecord. Caller must hold the spec read lock. + * Therefore, we MUST not call SSL3_SendAlert(). + * + * If SECFailure is returned, we: + * 1. Set |*alert| to the alert to be sent. + * 2. Call PORT_SetError() witn an appropriate code. + */ +SECStatus +tls13_UnprotectRecord(sslSocket *ss, SSL3Ciphertext *cText, sslBuffer *plaintext, + SSL3AlertDescription *alert) +{ + ssl3CipherSpec *crSpec = ss->ssl3.crSpec; + const ssl3BulkCipherDef *cipher_def = crSpec->cipher_def; + PRUint8 aad[8]; + SECStatus rv; + + *alert = bad_record_mac; /* Default alert for most issues. */ + + SSL_TRC(3, ("%d: TLS13[%d]: spec=%d (%s) unprotect record 0x%0llx len=%u", + SSL_GETPID(), ss->fd, crSpec, crSpec->phase, + crSpec->read_seq_num, cText->buf->len)); + + /* We can perform this test in variable time because the record's total + * length and the ciphersuite are both public knowledge. */ + if (cText->buf->len < cipher_def->tag_size) { + SSL_TRC(3, + ("%d: TLS13[%d]: record too short to contain valid AEAD data", + SSL_GETPID(), ss->fd)); + PORT_SetError(SSL_ERROR_BAD_MAC_READ); + return SECFailure; + } + + /* Verify that the content type is right, even though we overwrite it. */ + if (cText->type != content_application_data) { + SSL_TRC(3, + ("%d: TLS13[%d]: record has invalid exterior content type=%d", + SSL_GETPID(), ss->fd, cText->type)); + /* Do we need a better error here? */ + PORT_SetError(SSL_ERROR_BAD_MAC_READ); + return SECFailure; + } + + /* Check the version number in the record */ + if ((IS_DTLS(ss) && cText->version != kDtlsRecordVersion) || + (!IS_DTLS(ss) && cText->version != kTlsRecordVersion)) { + /* Do we need a better error here? */ + SSL_TRC(3, + ("%d: TLS13[%d]: record has bogus version", + SSL_GETPID(), ss->fd)); + return SECFailure; + } + + /* Decrypt */ + PORT_Assert(cipher_def->type == type_aead); + tls13_FormatAdditionalData(aad, sizeof(aad), + IS_DTLS(ss) ? cText->seq_num + : crSpec->read_seq_num); + rv = crSpec->aead( + ss->sec.isServer ? &crSpec->client : &crSpec->server, + PR_TRUE, /* do decrypt */ + plaintext->buf, /* out */ + (int *)&plaintext->len, /* outlen */ + plaintext->space, /* maxout */ + cText->buf->buf, /* in */ + cText->buf->len, /* inlen */ + aad, sizeof(aad)); + if (rv != SECSuccess) { + SSL_TRC(3, + ("%d: TLS13[%d]: record has bogus MAC", + SSL_GETPID(), ss->fd)); + PORT_SetError(SSL_ERROR_BAD_MAC_READ); + return SECFailure; + } + + /* The record is right-padded with 0s, followed by the true + * content type, so read from the right until we receive a + * nonzero byte. */ + while (plaintext->len > 0 && !(plaintext->buf[plaintext->len - 1])) { + --plaintext->len; + } + + /* Bogus padding. */ + if (plaintext->len < 1) { + SSL_TRC(3, + ("%d: TLS13[%d]: empty record", + SSL_GETPID(), ss->fd, cText->type)); + /* It's safe to report this specifically because it happened + * after the MAC has been verified. */ + PORT_SetError(SSL_ERROR_BAD_BLOCK_PADDING); + return SECFailure; + } + + /* Record the type. */ + cText->type = plaintext->buf[plaintext->len - 1]; + --plaintext->len; + + SSL_TRC(10, + ("%d: TLS13[%d]: %s received record of length=%d type=%d", + SSL_GETPID(), ss->fd, SSL_ROLE(ss), + plaintext->len, cText->type)); + + return SECSuccess; +} + +/* 0-RTT is only permitted if: + * + * 1. We are doing TLS 1.3 + * 2. This isn't a second ClientHello (in response to HelloRetryRequest) + * 3. The 0-RTT option is set. + * 4. We have a valid ticket. + * 5. The server is willing to accept 0-RTT. + * 6. We have not changed our ALPN settings to disallow the ALPN tag + * in the ticket. + * + * Called from tls13_ClientSendEarlyDataXtn(). + */ +PRBool +tls13_ClientAllow0Rtt(const sslSocket *ss, const sslSessionID *sid) +{ + /* We checked that the cipher suite was still allowed back in + * ssl3_SendClientHello. */ + if (sid->version < SSL_LIBRARY_VERSION_TLS_1_3) + return PR_FALSE; + if (ss->ssl3.hs.helloRetry) + return PR_FALSE; + if (!ss->opt.enable0RttData) + return PR_FALSE; + if (!ss->statelessResume) + return PR_FALSE; + if ((sid->u.ssl3.locked.sessionTicket.flags & ticket_allow_early_data) == 0) + return PR_FALSE; + return tls13_AlpnTagAllowed(ss, &sid->u.ssl3.alpnSelection); +} + +SECStatus +tls13_MaybeDo0RTTHandshake(sslSocket *ss) +{ + SECStatus rv; + + /* Don't do anything if there is no early_data xtn, which means we're + * not doing early data. */ + if (!ssl3_ClientExtensionAdvertised(ss, ssl_tls13_early_data_xtn)) { + return SECSuccess; + } + + ss->ssl3.hs.zeroRttState = ssl_0rtt_sent; + ss->ssl3.hs.zeroRttSuite = ss->ssl3.hs.cipher_suite; + + SSL_TRC(3, ("%d: TLS13[%d]: in 0-RTT mode", SSL_GETPID(), ss->fd)); + + /* Set the ALPN data as if it was negotiated. We check in the ServerHello + * handler that the server negotiates the same value. */ + if (ss->sec.ci.sid->u.ssl3.alpnSelection.len) { + ss->xtnData.nextProtoState = SSL_NEXT_PROTO_EARLY_VALUE; + rv = SECITEM_CopyItem(NULL, &ss->xtnData.nextProto, + &ss->sec.ci.sid->u.ssl3.alpnSelection); + if (rv != SECSuccess) + return rv; + } + + /* Null spec... */ + ssl_GetSpecReadLock(ss); + ss->ssl3.hs.nullSpec = ss->ssl3.cwSpec; + tls13_CipherSpecAddRef(ss->ssl3.hs.nullSpec); + ssl_ReleaseSpecReadLock(ss); + + /* Cipher suite already set in tls13_SetupClientHello. */ + ss->ssl3.hs.preliminaryInfo = 0; /* TODO(ekr@rtfm.com) Fill this in. + * bug 1281255. */ + + rv = tls13_DeriveSecret(ss, ss->ssl3.hs.currentSecret, + kHkdfLabelClient, + kHkdfLabelEarlyTrafficSecret, + NULL, + &ss->ssl3.hs.clientEarlyTrafficSecret); + if (rv != SECSuccess) + return SECFailure; + + rv = tls13_SetCipherSpec(ss, TrafficKeyEarlyApplicationData, + CipherSpecWrite, PR_TRUE); + if (rv != SECSuccess) { + return rv; + } + + return SECSuccess; +} + +PRInt32 +tls13_Read0RttData(sslSocket *ss, void *buf, PRInt32 len) +{ + TLS13EarlyData *msg; + + PORT_Assert(!PR_CLIST_IS_EMPTY(&ss->ssl3.hs.bufferedEarlyData)); + msg = (TLS13EarlyData *)PR_NEXT_LINK(&ss->ssl3.hs.bufferedEarlyData); + + PR_REMOVE_LINK(&msg->link); + if (msg->data.len > len) { + PORT_SetError(SSL_ERROR_ILLEGAL_PARAMETER_ALERT); + return SECFailure; + } + len = msg->data.len; + + PORT_Memcpy(buf, msg->data.data, msg->data.len); + SECITEM_ZfreeItem(&msg->data, PR_FALSE); + PORT_ZFree(msg, sizeof(*msg)); + + return len; +} + +/* 0-RTT data will be followed by a different cipher spec; this resets the + * current spec to the null spec so that the following state can be set as + * though 0-RTT didn't happen. TODO: work out if this is the best plan. */ +static void +tls13_SetNullCipherSpec(sslSocket *ss, ssl3CipherSpec **specp) +{ + PORT_Assert(ss->ssl3.hs.nullSpec); + + ssl_GetSpecWriteLock(ss); + tls13_CipherSpecRelease(*specp); + *specp = ss->ssl3.hs.nullSpec; + ssl_ReleaseSpecWriteLock(ss); + ss->ssl3.hs.nullSpec = NULL; +} + +static SECStatus +tls13_SendEndOfEarlyData(sslSocket *ss) +{ + SECStatus rv; + + SSL_TRC(3, ("%d: TLS13[%d]: send end_of_early_data extension", + SSL_GETPID(), ss->fd)); + + rv = SSL3_SendAlert(ss, alert_warning, end_of_early_data); + if (rv != SECSuccess) { + FATAL_ERROR(ss, SEC_ERROR_LIBRARY_FAILURE, internal_error); + return SECFailure; + } + + ss->ssl3.hs.zeroRttState = ssl_0rtt_done; + return SECSuccess; +} + +SECStatus +tls13_HandleEndOfEarlyData(sslSocket *ss) +{ + SECStatus rv; + + if (ss->version < SSL_LIBRARY_VERSION_TLS_1_3 || + ss->ssl3.hs.zeroRttState != ssl_0rtt_accepted) { + (void)SSL3_SendAlert(ss, alert_fatal, unexpected_message); + PORT_SetError(SSL_ERROR_END_OF_EARLY_DATA_ALERT); + return SECFailure; + } + + PORT_Assert(TLS13_IN_HS_STATE(ss, ss->opt.requestCertificate ? wait_client_cert : wait_finished)); + + if (IS_DTLS(ss)) { + /* Reset the cipher spec so that the epoch counter is properly reset. */ + tls13_SetNullCipherSpec(ss, &ss->ssl3.crSpec); + } + + rv = tls13_SetCipherSpec(ss, TrafficKeyHandshake, + CipherSpecRead, PR_FALSE); + if (rv != SECSuccess) { + PORT_SetError(SEC_ERROR_LIBRARY_FAILURE); + return SECFailure; + } + + ss->ssl3.hs.zeroRttState = ssl_0rtt_done; + return SECSuccess; +} + +SECStatus +tls13_HandleEarlyApplicationData(sslSocket *ss, sslBuffer *origBuf) +{ + TLS13EarlyData *ed; + SECItem it = { siBuffer, NULL, 0 }; + + PORT_Assert(ss->sec.isServer); + PORT_Assert(ss->ssl3.hs.zeroRttState == ssl_0rtt_accepted); + if (ss->ssl3.hs.zeroRttState != ssl_0rtt_accepted) { + /* Belt and suspenders. */ + FATAL_ERROR(ss, SEC_ERROR_LIBRARY_FAILURE, internal_error); + return SECFailure; + } + + PRINT_BUF(3, (NULL, "Received early application data", + origBuf->buf, origBuf->len)); + ed = PORT_ZNew(TLS13EarlyData); + if (!ed) { + FATAL_ERROR(ss, SEC_ERROR_NO_MEMORY, internal_error); + return SECFailure; + } + it.data = origBuf->buf; + it.len = origBuf->len; + if (SECITEM_CopyItem(NULL, &ed->data, &it) != SECSuccess) { + FATAL_ERROR(ss, SEC_ERROR_NO_MEMORY, internal_error); + return SECFailure; + } + PR_APPEND_LINK(&ed->link, &ss->ssl3.hs.bufferedEarlyData); + + origBuf->len = 0; /* So ssl3_GatherAppDataRecord will keep looping. */ + + return SECSuccess; +} + +PRUint16 +tls13_EncodeDraftVersion(SSL3ProtocolVersion version) +{ +#ifdef TLS_1_3_DRAFT_VERSION + if (version == SSL_LIBRARY_VERSION_TLS_1_3) { + return 0x7f00 | TLS_1_3_DRAFT_VERSION; + } +#endif + return (PRUint16)version; +} + +/* Pick the highest version we support that is also advertised. */ +SECStatus +tls13_NegotiateVersion(sslSocket *ss, const TLSExtension *supported_versions) +{ + PRUint16 version; + /* Make a copy so we're nondestructive*/ + SECItem data = supported_versions->data; + SECItem versions; + SECStatus rv; + + rv = ssl3_ConsumeHandshakeVariable(ss, &versions, 1, + &data.data, &data.len); + if (rv != SECSuccess) { + return SECFailure; + } + if (data.len || !versions.len || (versions.len & 1)) { + FATAL_ERROR(ss, SSL_ERROR_RX_MALFORMED_CLIENT_HELLO, illegal_parameter); + return SECFailure; + } + for (version = ss->vrange.max; version >= ss->vrange.min; --version) { + PRUint16 wire = tls13_EncodeDraftVersion(version); + unsigned long offset; + + for (offset = 0; offset < versions.len; offset += 2) { + PRUint16 supported = + (versions.data[offset] << 8) | versions.data[offset + 1]; + if (supported == wire) { + ss->version = version; + return SECSuccess; + } + } + } + + FATAL_ERROR(ss, SSL_ERROR_UNSUPPORTED_VERSION, protocol_version); + return SECFailure; +} diff --git a/security/nss/lib/ssl/tls13con.h b/security/nss/lib/ssl/tls13con.h new file mode 100644 index 000000000..c39c62a69 --- /dev/null +++ b/security/nss/lib/ssl/tls13con.h @@ -0,0 +1,88 @@ +/* -*- Mode: C; tab-width: 8; indent-tabs-mode: nil; c-basic-offset: 4 -*- */ +/* + * This file is PRIVATE to SSL. + * + * This Source Code Form is subject to the terms of the Mozilla Public + * License, v. 2.0. If a copy of the MPL was not distributed with this + * file, You can obtain one at http://mozilla.org/MPL/2.0/. */ + +#ifndef __tls13con_h_ +#define __tls13con_h_ + +typedef enum { + StaticSharedSecret, + EphemeralSharedSecret +} SharedSecretType; + +#define TLS13_MAX_FINISHED_SIZE 64 + +SECStatus tls13_UnprotectRecord( + sslSocket *ss, SSL3Ciphertext *cText, sslBuffer *plaintext, + SSL3AlertDescription *alert); + +#if defined(WIN32) +#define __func__ __FUNCTION__ +#endif + +void tls13_SetHsState(sslSocket *ss, SSL3WaitState ws, + const char *func, const char *file, int line); +#define TLS13_SET_HS_STATE(ss, ws) \ + tls13_SetHsState(ss, ws, __func__, __FILE__, __LINE__) + +/* Return PR_TRUE if the socket is in one of the given states, else return + * PR_FALSE. Only call the macro not the function, because the trailing + * wait_invalid is needed to terminate the argument list. */ +PRBool tls13_InHsState(sslSocket *ss, ...); +#define TLS13_IN_HS_STATE(ss, ...) \ + tls13_InHsState(ss, __VA_ARGS__, wait_invalid) + +SSLHashType tls13_GetHashForCipherSuite(ssl3CipherSuite suite); +SSLHashType tls13_GetHash(const sslSocket *ss); +unsigned int tls13_GetHashSizeForHash(SSLHashType hash); +unsigned int tls13_GetHashSize(const sslSocket *ss); +CK_MECHANISM_TYPE tls13_GetHkdfMechanism(sslSocket *ss); +void tls13_FatalError(sslSocket *ss, PRErrorCode prError, + SSL3AlertDescription desc); +SECStatus tls13_SetupClientHello(sslSocket *ss); +SECStatus tls13_MaybeDo0RTTHandshake(sslSocket *ss); +PRBool tls13_AllowPskCipher(const sslSocket *ss, + const ssl3CipherSuiteDef *cipher_def); +PRBool tls13_PskSuiteEnabled(sslSocket *ss); +SECStatus tls13_ComputePskBinder(sslSocket *ss, PRBool sending, + unsigned int prefixLength, + PRUint8 *output, unsigned int *outputLen, + unsigned int maxOutputLen); +SECStatus tls13_HandleClientHelloPart2(sslSocket *ss, + const SECItem *suites, + sslSessionID *sid); +SECStatus tls13_HandleServerHelloPart2(sslSocket *ss); +SECStatus tls13_HandlePostHelloHandshakeMessage(sslSocket *ss, SSL3Opaque *b, + PRUint32 length, + SSL3Hashes *hashesPtr); +SECStatus tls13_HandleHelloRetryRequest(sslSocket *ss, SSL3Opaque *b, + PRUint32 length); +void tls13_DestroyKeyShareEntry(TLS13KeyShareEntry *entry); +void tls13_DestroyKeyShares(PRCList *list); +SECStatus tls13_CreateKeyShare(sslSocket *ss, const sslNamedGroupDef *groupDef); +void tls13_DestroyEarlyData(PRCList *list); +void tls13_CipherSpecAddRef(ssl3CipherSpec *spec); +void tls13_CipherSpecRelease(ssl3CipherSpec *spec); +void tls13_DestroyCipherSpecs(PRCList *list); +PRBool tls13_ExtensionAllowed(PRUint16 extension, SSL3HandshakeType message); +SECStatus tls13_ProtectRecord(sslSocket *ss, + ssl3CipherSpec *cwSpec, + SSL3ContentType type, + const SSL3Opaque *pIn, + PRUint32 contentLen, + sslBuffer *wrBuf); +PRInt32 tls13_Read0RttData(sslSocket *ss, void *buf, PRInt32 len); +SECStatus tls13_HandleEndOfEarlyData(sslSocket *ss); +SECStatus tls13_HandleEarlyApplicationData(sslSocket *ss, sslBuffer *origBuf); +PRBool tls13_ClientAllow0Rtt(const sslSocket *ss, const sslSessionID *sid); +PRUint16 tls13_EncodeDraftVersion(SSL3ProtocolVersion version); +PRUint16 tls13_DecodeDraftVersion(PRUint16 version); +SECStatus tls13_NegotiateVersion(sslSocket *ss, + const TLSExtension *supported_versions); +SECStatus tls13_SendNewSessionTicket(sslSocket *ss); + +#endif /* __tls13con_h_ */ diff --git a/security/nss/lib/ssl/tls13exthandle.c b/security/nss/lib/ssl/tls13exthandle.c new file mode 100644 index 000000000..be93b97db --- /dev/null +++ b/security/nss/lib/ssl/tls13exthandle.c @@ -0,0 +1,1169 @@ +/* -*- Mode: C; tab-width: 8; indent-tabs-mode: nil; c-basic-offset: 4 -*- */ +/* + * This Source Code Form is subject to the terms of the Mozilla Public + * License, v. 2.0. If a copy of the MPL was not distributed with this + * file, You can obtain one at http://mozilla.org/MPL/2.0/. */ + +#include "nssrenam.h" +#include "nss.h" +#include "ssl.h" +#include "sslproto.h" +#include "sslimpl.h" +#include "pk11pub.h" +#include "ssl3ext.h" +#include "ssl3exthandle.h" +#include "tls13exthandle.h" + +PRInt32 +tls13_ServerSendStatusRequestXtn( + const sslSocket *ss, + TLSExtensionData *xtnData, + PRBool append, + PRUint32 maxBytes) +{ + PRInt32 extension_length; + const sslServerCert *serverCert = ss->sec.serverCert; + const SECItem *item; + SECStatus rv; + + if (!serverCert->certStatusArray || + !serverCert->certStatusArray->len) { + return 0; + } + + item = &serverCert->certStatusArray->items[0]; + + /* Only send the first entry. */ + extension_length = 2 + 2 + 1 /* status_type */ + 3 + item->len; + if (maxBytes < (PRUint32)extension_length) { + return 0; + } + if (append) { + /* extension_type */ + rv = ssl3_ExtAppendHandshakeNumber(ss, ssl_cert_status_xtn, 2); + if (rv != SECSuccess) + return -1; + /* length of extension_data */ + rv = ssl3_ExtAppendHandshakeNumber(ss, extension_length - 4, 2); + if (rv != SECSuccess) + return -1; + /* status_type == ocsp */ + rv = ssl3_ExtAppendHandshakeNumber(ss, 1 /*ocsp*/, 1); + if (rv != SECSuccess) + return rv; /* err set by AppendHandshake. */ + /* opaque OCSPResponse<1..2^24-1> */ + rv = ssl3_ExtAppendHandshakeVariable(ss, item->data, item->len, 3); + if (rv != SECSuccess) + return rv; /* err set by AppendHandshake. */ + } + + return extension_length; +} + +/* + * [draft-ietf-tls-tls13-11] Section 6.3.2.3. + * + * struct { + * NamedGroup group; + * opaque key_exchange<1..2^16-1>; + * } KeyShareEntry; + * + * struct { + * select (role) { + * case client: + * KeyShareEntry client_shares<4..2^16-1>; + * + * case server: + * KeyShareEntry server_share; + * } + * } KeyShare; + * + * DH is Section 6.3.2.3.1. + * + * opaque dh_Y<1..2^16-1>; + * + * ECDH is Section 6.3.2.3.2. + * + * opaque point <1..2^8-1>; + */ +static PRUint32 +tls13_SizeOfKeyShareEntry(const SECKEYPublicKey *pubKey) +{ + /* Size = NamedGroup(2) + length(2) + opaque<?> share */ + switch (pubKey->keyType) { + case ecKey: + return 2 + 2 + pubKey->u.ec.publicValue.len; + case dhKey: + return 2 + 2 + pubKey->u.dh.prime.len; + default: + PORT_Assert(0); + } + return 0; +} + +static PRUint32 +tls13_SizeOfClientKeyShareExtension(const sslSocket *ss) +{ + PRCList *cursor; + /* Size is: extension(2) + extension_len(2) + client_shares(2) */ + PRUint32 size = 2 + 2 + 2; + for (cursor = PR_NEXT_LINK(&ss->ephemeralKeyPairs); + cursor != &ss->ephemeralKeyPairs; + cursor = PR_NEXT_LINK(cursor)) { + sslEphemeralKeyPair *keyPair = (sslEphemeralKeyPair *)cursor; + size += tls13_SizeOfKeyShareEntry(keyPair->keys->pubKey); + } + return size; +} + +static SECStatus +tls13_EncodeKeyShareEntry(const sslSocket *ss, const sslEphemeralKeyPair *keyPair) +{ + SECStatus rv; + SECKEYPublicKey *pubKey = keyPair->keys->pubKey; + unsigned int size = tls13_SizeOfKeyShareEntry(pubKey); + + rv = ssl3_ExtAppendHandshakeNumber(ss, keyPair->group->name, 2); + if (rv != SECSuccess) + return rv; + rv = ssl3_ExtAppendHandshakeNumber(ss, size - 4, 2); + if (rv != SECSuccess) + return rv; + + switch (pubKey->keyType) { + case ecKey: + rv = tls13_EncodeECDHEKeyShareKEX(ss, pubKey); + break; + case dhKey: + rv = ssl_AppendPaddedDHKeyShare(ss, pubKey, PR_FALSE); + break; + default: + PORT_Assert(0); + PORT_SetError(SEC_ERROR_LIBRARY_FAILURE); + break; + } + + return rv; +} + +PRInt32 +tls13_ClientSendKeyShareXtn(const sslSocket *ss, TLSExtensionData *xtnData, PRBool append, + PRUint32 maxBytes) +{ + PRUint32 extension_length; + + if (ss->vrange.max < SSL_LIBRARY_VERSION_TLS_1_3) { + return 0; + } + + /* Optimistically try to send an ECDHE key using the + * preexisting key (in future will be keys) */ + SSL_TRC(3, ("%d: TLS13[%d]: send client key share xtn", + SSL_GETPID(), ss->fd)); + + extension_length = tls13_SizeOfClientKeyShareExtension(ss); + if (maxBytes < extension_length) { + PORT_Assert(0); + return 0; + } + + if (append) { + SECStatus rv; + PRCList *cursor; + + rv = ssl3_ExtAppendHandshakeNumber(ss, ssl_tls13_key_share_xtn, 2); + if (rv != SECSuccess) + goto loser; + + /* The extension length */ + rv = ssl3_ExtAppendHandshakeNumber(ss, extension_length - 4, 2); + if (rv != SECSuccess) + goto loser; + + /* The length of KeyShares */ + rv = ssl3_ExtAppendHandshakeNumber(ss, extension_length - 6, 2); + if (rv != SECSuccess) + goto loser; + + for (cursor = PR_NEXT_LINK(&ss->ephemeralKeyPairs); + cursor != &ss->ephemeralKeyPairs; + cursor = PR_NEXT_LINK(cursor)) { + sslEphemeralKeyPair *keyPair = (sslEphemeralKeyPair *)cursor; + rv = tls13_EncodeKeyShareEntry(ss, keyPair); + if (rv != SECSuccess) + goto loser; + } + + xtnData->advertised[xtnData->numAdvertised++] = + ssl_tls13_key_share_xtn; + } + + return extension_length; + +loser: + return -1; +} + +static SECStatus +tls13_HandleKeyShareEntry(const sslSocket *ss, TLSExtensionData *xtnData, SECItem *data) +{ + SECStatus rv; + PRInt32 group; + const sslNamedGroupDef *groupDef; + TLS13KeyShareEntry *ks = NULL; + SECItem share = { siBuffer, NULL, 0 }; + + group = ssl3_ExtConsumeHandshakeNumber(ss, 2, &data->data, &data->len); + if (group < 0) { + PORT_SetError(SSL_ERROR_RX_MALFORMED_KEY_SHARE); + goto loser; + } + groupDef = ssl_LookupNamedGroup(group); + rv = ssl3_ExtConsumeHandshakeVariable(ss, &share, 2, &data->data, + &data->len); + if (rv != SECSuccess) { + goto loser; + } + /* If the group is disabled, continue. */ + if (!groupDef) { + return SECSuccess; + } + + ks = PORT_ZNew(TLS13KeyShareEntry); + if (!ks) + goto loser; + ks->group = groupDef; + + rv = SECITEM_CopyItem(NULL, &ks->key_exchange, &share); + if (rv != SECSuccess) + goto loser; + + PR_APPEND_LINK(&ks->link, &xtnData->remoteKeyShares); + return SECSuccess; + +loser: + if (ks) + tls13_DestroyKeyShareEntry(ks); + return SECFailure; +} +/* Handle an incoming KeyShare extension at the client and copy to + * |xtnData->remoteKeyShares| for future use. The key + * share is processed in tls13_HandleServerKeyShare(). */ +SECStatus +tls13_ClientHandleKeyShareXtn(const sslSocket *ss, TLSExtensionData *xtnData, PRUint16 ex_type, SECItem *data) +{ + SECStatus rv; + PORT_Assert(PR_CLIST_IS_EMPTY(&xtnData->remoteKeyShares)); + + PORT_Assert(!ss->sec.isServer); + if (ss->version < SSL_LIBRARY_VERSION_TLS_1_3) { + /* This can't happen because the extension processing + * code filters out TLS 1.3 extensions when not in + * TLS 1.3 mode. */ + PORT_SetError(SEC_ERROR_LIBRARY_FAILURE); + return SECFailure; + } + + SSL_TRC(3, ("%d: SSL3[%d]: handle key_share extension", + SSL_GETPID(), ss->fd)); + + rv = tls13_HandleKeyShareEntry(ss, xtnData, data); + if (rv != SECSuccess) { + PORT_SetError(SSL_ERROR_RX_MALFORMED_KEY_SHARE); + return SECFailure; + } + + if (data->len) { + PORT_SetError(SSL_ERROR_RX_MALFORMED_KEY_SHARE); + return SECFailure; + } + + return SECSuccess; +} + +SECStatus +tls13_ClientHandleKeyShareXtnHrr(const sslSocket *ss, TLSExtensionData *xtnData, PRUint16 ex_type, SECItem *data) +{ + SECStatus rv; + PRInt32 tmp; + const sslNamedGroupDef *group; + + PORT_Assert(!ss->sec.isServer); + PORT_Assert(ss->vrange.max >= SSL_LIBRARY_VERSION_TLS_1_3); + + SSL_TRC(3, ("%d: SSL3[%d]: handle key_share extension in HRR", + SSL_GETPID(), ss->fd)); + + tmp = ssl3_ExtConsumeHandshakeNumber(ss, 2, &data->data, &data->len); + if (tmp < 0) { + return SECFailure; /* error code already set */ + } + if (data->len) { + ssl3_ExtSendAlert(ss, alert_fatal, decode_error); + PORT_SetError(SSL_ERROR_RX_MALFORMED_HELLO_RETRY_REQUEST); + return SECFailure; + } + + group = ssl_LookupNamedGroup((SSLNamedGroup)tmp); + /* If the group is not enabled, or we already have a share for the + * requested group, abort. */ + if (!ssl_NamedGroupEnabled(ss, group) || + ssl_HaveEphemeralKeyPair(ss, group)) { + ssl3_ExtSendAlert(ss, alert_fatal, illegal_parameter); + PORT_SetError(SSL_ERROR_RX_MALFORMED_HELLO_RETRY_REQUEST); + return SECFailure; + } + + /* Now delete all the key shares per [draft-ietf-tls-tls13 S 4.1.2] */ + ssl_FreeEphemeralKeyPairs(CONST_CAST(sslSocket, ss)); + + /* And replace with our new share. */ + rv = tls13_CreateKeyShare(CONST_CAST(sslSocket, ss), group); + if (rv != SECSuccess) { + ssl3_ExtSendAlert(ss, alert_fatal, internal_error); + PORT_SetError(SEC_ERROR_KEYGEN_FAIL); + return SECFailure; + } + + return SECSuccess; +} + +/* Handle an incoming KeyShare extension at the server and copy to + * |xtnData->remoteKeyShares| for future use. The key + * share is processed in tls13_HandleClientKeyShare(). */ +SECStatus +tls13_ServerHandleKeyShareXtn(const sslSocket *ss, TLSExtensionData *xtnData, PRUint16 ex_type, SECItem *data) +{ + SECStatus rv; + PRInt32 length; + + PORT_Assert(ss->sec.isServer); + PORT_Assert(PR_CLIST_IS_EMPTY(&xtnData->remoteKeyShares)); + + if (ss->version < SSL_LIBRARY_VERSION_TLS_1_3) { + return SECSuccess; + } + + SSL_TRC(3, ("%d: SSL3[%d]: handle key_share extension", + SSL_GETPID(), ss->fd)); + + /* Redundant length because of TLS encoding (this vector consumes + * the entire extension.) */ + length = ssl3_ExtConsumeHandshakeNumber(ss, 2, &data->data, + &data->len); + if (length < 0) + goto loser; + if (length != data->len) { + /* Check for consistency */ + PORT_SetError(SSL_ERROR_RX_MALFORMED_KEY_SHARE); + goto loser; + } + + while (data->len) { + rv = tls13_HandleKeyShareEntry(ss, xtnData, data); + if (rv != SECSuccess) + goto loser; + } + + /* Check that the client only offered one share if this is + * after HRR. */ + if (ss->ssl3.hs.helloRetry) { + if (PR_PREV_LINK(&xtnData->remoteKeyShares) != + PR_NEXT_LINK(&xtnData->remoteKeyShares)) { + PORT_SetError(SSL_ERROR_RX_MALFORMED_CLIENT_HELLO); + goto loser; + } + } + + return SECSuccess; + +loser: + tls13_DestroyKeyShares(&xtnData->remoteKeyShares); + return SECFailure; +} + +PRInt32 +tls13_ServerSendKeyShareXtn(const sslSocket *ss, TLSExtensionData *xtnData, PRBool append, + PRUint32 maxBytes) +{ + PRUint32 extension_length; + PRUint32 entry_length; + SECStatus rv; + sslEphemeralKeyPair *keyPair; + + /* There should be exactly one key share. */ + PORT_Assert(!PR_CLIST_IS_EMPTY(&ss->ephemeralKeyPairs)); + PORT_Assert(PR_PREV_LINK(&ss->ephemeralKeyPairs) == + PR_NEXT_LINK(&ss->ephemeralKeyPairs)); + + keyPair = (sslEphemeralKeyPair *)PR_NEXT_LINK(&ss->ephemeralKeyPairs); + + entry_length = tls13_SizeOfKeyShareEntry(keyPair->keys->pubKey); + extension_length = 2 + 2 + entry_length; /* Type + length + entry_length */ + if (maxBytes < extension_length) { + PORT_Assert(0); + return 0; + } + + if (append) { + rv = ssl3_ExtAppendHandshakeNumber(ss, ssl_tls13_key_share_xtn, 2); + if (rv != SECSuccess) + goto loser; + + rv = ssl3_ExtAppendHandshakeNumber(ss, entry_length, 2); + if (rv != SECSuccess) + goto loser; + + rv = tls13_EncodeKeyShareEntry(ss, keyPair); + if (rv != SECSuccess) + goto loser; + } + + return extension_length; + +loser: + return -1; +} + +/* Called by clients. + * + * struct { + * opaque identity<0..2^16-1>; + * uint32 obfuscated_ticket_age; + * } PskIdentity; + * + * opaque PskBinderEntry<32..255>; + * + * struct { + * select (Handshake.msg_type) { + * case client_hello: + * PskIdentity identities<6..2^16-1>; + * PskBinderEntry binders<33..2^16-1>; + * + * case server_hello: + * uint16 selected_identity; + * }; + * + * } PreSharedKeyExtension; + + * Presently the only way to get a PSK is by resumption, so this is + * really a ticket label and there will be at most one. + */ +PRInt32 +tls13_ClientSendPreSharedKeyXtn(const sslSocket *ss, TLSExtensionData *xtnData, + PRBool append, + PRUint32 maxBytes) +{ + PRInt32 extension_length; + PRInt32 identities_length; + PRInt32 binders_length; + NewSessionTicket *session_ticket; + + /* We only set statelessResume on the client in TLS 1.3 code. */ + if (!ss->statelessResume) + return 0; + + PORT_Assert(ss->vrange.max >= SSL_LIBRARY_VERSION_TLS_1_3); + + /* The length computations are simplified by the fact that there + * is just one ticket at most. */ + session_ticket = &ss->sec.ci.sid->u.ssl3.locked.sessionTicket; + identities_length = + 2 + /* vector length */ + 2 + session_ticket->ticket.len + /* identity length + ticket len */ + 4; /* obfuscated_ticket_age */ + binders_length = + 2 + /* vector length */ + 1 + tls13_GetHashSizeForHash( + tls13_GetHashForCipherSuite(ss->sec.ci.sid->u.ssl3.cipherSuite)); + extension_length = + 2 + 2 + /* Type + length */ + identities_length + binders_length; + + if (maxBytes < (PRUint32)extension_length) { + PORT_Assert(0); + return 0; + } + + if (append) { + SECStatus rv; + PRUint32 age; + unsigned int prefixLength; + PRUint8 binder[TLS13_MAX_FINISHED_SIZE]; + unsigned int binderLen; + + /* extension_type */ + rv = ssl3_ExtAppendHandshakeNumber(ss, ssl_tls13_pre_shared_key_xtn, 2); + if (rv != SECSuccess) + goto loser; + rv = ssl3_ExtAppendHandshakeNumber(ss, extension_length - 4, 2); + if (rv != SECSuccess) + goto loser; + rv = ssl3_ExtAppendHandshakeNumber(ss, identities_length - 2, 2); + if (rv != SECSuccess) + goto loser; + rv = ssl3_ExtAppendHandshakeVariable(ss, session_ticket->ticket.data, + session_ticket->ticket.len, 2); + if (rv != SECSuccess) + goto loser; + + /* Obfuscated age. */ + age = ssl_Time() - session_ticket->received_timestamp; + age += session_ticket->ticket_age_add; + rv = ssl3_ExtAppendHandshakeNumber(ss, age, 4); + if (rv != SECSuccess) + goto loser; + + /* Now the binders. */ + prefixLength = ss->ssl3.hs.messages.len; + rv = tls13_ComputePskBinder(CONST_CAST(sslSocket, ss), PR_TRUE, + prefixLength, binder, &binderLen, + sizeof(binder)); + if (rv != SECSuccess) + goto loser; + PORT_Assert(binderLen == tls13_GetHashSize(ss)); + rv = ssl3_ExtAppendHandshakeNumber(ss, binders_length - 2, 2); + if (rv != SECSuccess) + goto loser; + rv = ssl3_ExtAppendHandshakeVariable(ss, + binder, binderLen, 1); + if (rv != SECSuccess) + goto loser; + + PRINT_BUF(50, (ss, "Sending PreSharedKey value", + session_ticket->ticket.data, + session_ticket->ticket.len)); + + xtnData->sentSessionTicketInClientHello = PR_TRUE; + xtnData->advertised[xtnData->numAdvertised++] = + ssl_tls13_pre_shared_key_xtn; + } + return extension_length; + +loser: + xtnData->ticketTimestampVerified = PR_FALSE; + return -1; +} + +/* Handle a TLS 1.3 PreSharedKey Extension. We only accept PSKs + * that contain session tickets. */ +SECStatus +tls13_ServerHandlePreSharedKeyXtn(const sslSocket *ss, TLSExtensionData *xtnData, PRUint16 ex_type, + SECItem *data) +{ + SECItem inner; + SECStatus rv; + unsigned int numIdentities = 0; + unsigned int numBinders = 0; + + SSL_TRC(3, ("%d: SSL3[%d]: handle pre_shared_key extension", + SSL_GETPID(), ss->fd)); + + /* If we are doing < TLS 1.3, then ignore this. */ + if (ss->version < SSL_LIBRARY_VERSION_TLS_1_3) { + return SECSuccess; + } + + /* Parse the identities list. */ + rv = ssl3_ExtConsumeHandshakeVariable(ss, + &inner, 2, &data->data, &data->len); + if (rv != SECSuccess) { + return SECFailure; + } + + while (inner.len) { + SECItem label; + PRUint32 utmp; + + rv = ssl3_ExtConsumeHandshakeVariable(ss, &label, 2, + &inner.data, &inner.len); + if (rv != SECSuccess) + return rv; + if (!label.len) { + goto alert_loser; + } + + /* Read and discard session ticket age. Bug 1295163 */ + rv = ssl3_ExtConsumeHandshake(ss, &utmp, 4, + &inner.data, &inner.len); + if (rv != SECSuccess) + return rv; + + if (!numIdentities) { + PRINT_BUF(50, (ss, "Handling PreSharedKey value", + label.data, label.len)); + rv = ssl3_ProcessSessionTicketCommon( + CONST_CAST(sslSocket, ss), &label); + /* This only happens if we have an internal error, not + * a malformed ticket. Bogus tickets just don't resume + * and return SECSuccess. */ + if (rv != SECSuccess) + return SECFailure; + } + ++numIdentities; + } + + xtnData->pskBinderPrefixLen = ss->ssl3.hs.messages.len - data->len; + + /* Parse the binders list. */ + rv = ssl3_ExtConsumeHandshakeVariable(ss, + &inner, 2, &data->data, &data->len); + if (rv != SECSuccess) + return SECFailure; + if (data->len) { + goto alert_loser; + } + + while (inner.len) { + SECItem binder; + rv = ssl3_ExtConsumeHandshakeVariable(ss, &binder, 1, + &inner.data, &inner.len); + if (rv != SECSuccess) + return rv; + if (binder.len < 32) { + goto alert_loser; + } + + if (!numBinders) { + xtnData->pskBinder = binder; + } + ++numBinders; + } + + if (numBinders != numIdentities) + goto alert_loser; + + /* Keep track of negotiated extensions. Note that this does not + * mean we are resuming. */ + xtnData->negotiated[xtnData->numNegotiated++] = ex_type; + + return SECSuccess; + +alert_loser: + ssl3_ExtSendAlert(ss, alert_fatal, illegal_parameter); + PORT_SetError(SSL_ERROR_MALFORMED_PRE_SHARED_KEY); + return SECFailure; +} + +PRInt32 +tls13_ServerSendPreSharedKeyXtn(const sslSocket *ss, TLSExtensionData *xtnData, + PRBool append, + PRUint32 maxBytes) +{ + PRInt32 extension_length = + 2 + 2 + 2; /* type + len + index */ + SECStatus rv; + + if (maxBytes < (PRUint32)extension_length) { + PORT_Assert(0); + return 0; + } + + if (append) { + rv = ssl3_ExtAppendHandshakeNumber(ss, ssl_tls13_pre_shared_key_xtn, 2); + if (rv != SECSuccess) + return -1; + + rv = ssl3_ExtAppendHandshakeNumber(ss, 2, 2); + if (rv != SECSuccess) + return -1; + + /* We only process the first session ticket the client sends, + * so the index is always 0. */ + rv = ssl3_ExtAppendHandshakeNumber(ss, 0, 2); + if (rv != SECSuccess) + return -1; + } + + return extension_length; +} + +/* Handle a TLS 1.3 PreSharedKey Extension. We only accept PSKs + * that contain session tickets. */ +SECStatus +tls13_ClientHandlePreSharedKeyXtn(const sslSocket *ss, TLSExtensionData *xtnData, PRUint16 ex_type, + SECItem *data) +{ + PRInt32 index; + + SSL_TRC(3, ("%d: SSL3[%d]: handle pre_shared_key extension", + SSL_GETPID(), ss->fd)); + + /* If we are doing < TLS 1.3, then ignore this. */ + if (ss->version < SSL_LIBRARY_VERSION_TLS_1_3) { + return SECSuccess; + } + + index = ssl3_ExtConsumeHandshakeNumber(ss, 2, &data->data, &data->len); + if (index < 0) + return SECFailure; + + /* This should be the end of the extension. */ + if (data->len) { + PORT_SetError(SSL_ERROR_MALFORMED_PRE_SHARED_KEY); + return SECFailure; + } + + /* We only sent one PSK label so index must be equal to 0 */ + if (index) { + PORT_SetError(SSL_ERROR_MALFORMED_PRE_SHARED_KEY); + return SECFailure; + } + + /* Keep track of negotiated extensions. */ + xtnData->negotiated[xtnData->numNegotiated++] = ex_type; + + return SECSuccess; +} + +/* + * struct { } EarlyDataIndication; + */ +PRInt32 +tls13_ClientSendEarlyDataXtn(const sslSocket *ss, TLSExtensionData *xtnData, + PRBool append, + PRUint32 maxBytes) +{ + SECStatus rv; + PRInt32 extension_length; + + if (!tls13_ClientAllow0Rtt(ss, ss->sec.ci.sid)) + return 0; + + /* type + length */ + extension_length = 2 + 2; + + if (maxBytes < (PRUint32)extension_length) { + PORT_Assert(0); + return 0; + } + + if (append) { + rv = ssl3_ExtAppendHandshakeNumber(ss, ssl_tls13_early_data_xtn, 2); + if (rv != SECSuccess) + return -1; + + rv = ssl3_ExtAppendHandshakeNumber(ss, 0, 2); + if (rv != SECSuccess) + return -1; + } + + xtnData->advertised[xtnData->numAdvertised++] = + ssl_tls13_early_data_xtn; + + return extension_length; +} + +SECStatus +tls13_ServerHandleEarlyDataXtn(const sslSocket *ss, TLSExtensionData *xtnData, PRUint16 ex_type, + SECItem *data) +{ + SSL_TRC(3, ("%d: TLS13[%d]: handle early_data extension", + SSL_GETPID(), ss->fd)); + + /* If we are doing < TLS 1.3, then ignore this. */ + if (ss->version < SSL_LIBRARY_VERSION_TLS_1_3) { + return SECSuccess; + } + + if (data->len) { + PORT_SetError(SSL_ERROR_MALFORMED_EARLY_DATA); + return SECFailure; + } + + xtnData->negotiated[xtnData->numNegotiated++] = ex_type; + + return SECSuccess; +} + +/* This is only registered if we are sending it. */ +PRInt32 +tls13_ServerSendEarlyDataXtn(const sslSocket *ss, TLSExtensionData *xtnData, + PRBool append, + PRUint32 maxBytes) +{ + SSL_TRC(3, ("%d: TLS13[%d]: send early_data extension", + SSL_GETPID(), ss->fd)); + + PORT_Assert(ss->ssl3.hs.zeroRttState == ssl_0rtt_accepted); + if (maxBytes < 4) { + PORT_Assert(0); + return 0; + } + + if (append) { + SECStatus rv; + + rv = ssl3_ExtAppendHandshakeNumber(ss, ssl_tls13_early_data_xtn, 2); + if (rv != SECSuccess) + return -1; + + rv = ssl3_ExtAppendHandshakeNumber(ss, 0, 2); + if (rv != SECSuccess) + return -1; + } + + return 4; +} + +/* This will only be called if we also offered the extension. */ +SECStatus +tls13_ClientHandleEarlyDataXtn(const sslSocket *ss, TLSExtensionData *xtnData, PRUint16 ex_type, + SECItem *data) +{ + SSL_TRC(3, ("%d: TLS13[%d]: handle early_data extension", + SSL_GETPID(), ss->fd)); + + /* If we are doing < TLS 1.3, then ignore this. */ + if (ss->version < SSL_LIBRARY_VERSION_TLS_1_3) { + PORT_SetError(SSL_ERROR_EXTENSION_DISALLOWED_FOR_VERSION); + return SECFailure; + } + + if (data->len) { + PORT_SetError(SSL_ERROR_MALFORMED_EARLY_DATA); + return SECFailure; + } + + /* Keep track of negotiated extensions. */ + xtnData->negotiated[xtnData->numNegotiated++] = ex_type; + + return SECSuccess; +} + +SECStatus +tls13_ClientHandleTicketEarlyDataInfoXtn(const sslSocket *ss, TLSExtensionData *xtnData, PRUint16 ex_type, + SECItem *data) +{ + PRUint32 utmp; + SECStatus rv; + + SSL_TRC(3, ("%d: TLS13[%d]: handle early_data_info extension", + SSL_GETPID(), ss->fd)); + + /* If we are doing < TLS 1.3, then ignore this. */ + if (ss->version < SSL_LIBRARY_VERSION_TLS_1_3) { + PORT_SetError(SSL_ERROR_EXTENSION_DISALLOWED_FOR_VERSION); + return SECFailure; + } + + rv = ssl3_ExtConsumeHandshake(ss, &utmp, sizeof(utmp), + &data->data, &data->len); + if (rv != SECSuccess) { + PORT_SetError(SSL_ERROR_RX_MALFORMED_NEW_SESSION_TICKET); + return SECFailure; + } + if (data->len) { + PORT_SetError(SSL_ERROR_RX_MALFORMED_NEW_SESSION_TICKET); + return SECFailure; + } + + xtnData->max_early_data_size = PR_ntohl(utmp); + + return SECSuccess; +} + +/* + * struct { + * ProtocolVersion versions<2..254>; + * } SupportedVersions; + */ +PRInt32 +tls13_ClientSendSupportedVersionsXtn(const sslSocket *ss, TLSExtensionData *xtnData, PRBool append, + PRUint32 maxBytes) +{ + PRInt32 extensions_len; + PRUint16 version; + SECStatus rv; + + if (ss->vrange.max < SSL_LIBRARY_VERSION_TLS_1_3) { + return 0; + } + + SSL_TRC(3, ("%d: TLS13[%d]: send supported_versions extension", + SSL_GETPID(), ss->fd)); + + /* Extension type, extension len fiels, vector len field, + * length of the values. */ + extensions_len = 2 + 2 + 1 + + 2 * (ss->vrange.max - ss->vrange.min + 1); + + if (maxBytes < (PRUint32)extensions_len) { + PORT_Assert(0); + return 0; + } + + if (append) { + rv = ssl3_ExtAppendHandshakeNumber(ss, ssl_tls13_supported_versions_xtn, 2); + if (rv != SECSuccess) + return -1; + + rv = ssl3_ExtAppendHandshakeNumber(ss, extensions_len - 4, 2); + if (rv != SECSuccess) + return -1; + + rv = ssl3_ExtAppendHandshakeNumber(ss, extensions_len - 5, 1); + if (rv != SECSuccess) + return -1; + + for (version = ss->vrange.max; version >= ss->vrange.min; --version) { + rv = ssl3_ExtAppendHandshakeNumber( + ss, tls13_EncodeDraftVersion(version), 2); + if (rv != SECSuccess) + return -1; + } + } + + return extensions_len; +} + +/* + * struct { + * opaque cookie<1..2^16-1>; + * } Cookie; + */ +SECStatus +tls13_ClientHandleHrrCookie(const sslSocket *ss, TLSExtensionData *xtnData, PRUint16 ex_type, SECItem *data) +{ + SECStatus rv; + + SSL_TRC(3, ("%d: TLS13[%d]: handle cookie extension", + SSL_GETPID(), ss->fd)); + + PORT_Assert(ss->vrange.max >= SSL_LIBRARY_VERSION_TLS_1_3); + + /* IMPORTANT: this is only valid while the HelloRetryRequest is still valid. */ + rv = ssl3_ExtConsumeHandshakeVariable( + ss, &CONST_CAST(sslSocket, ss)->ssl3.hs.cookie, 2, + &data->data, &data->len); + if (rv != SECSuccess) { + PORT_SetError(SSL_ERROR_RX_MALFORMED_HELLO_RETRY_REQUEST); + return SECFailure; + } + if (!ss->ssl3.hs.cookie.len || data->len) { + ssl3_ExtSendAlert(ss, alert_fatal, decode_error); + PORT_SetError(SSL_ERROR_RX_MALFORMED_HELLO_RETRY_REQUEST); + return SECFailure; + } + + return SECSuccess; +} + +PRInt32 +tls13_ClientSendHrrCookieXtn(const sslSocket *ss, TLSExtensionData *xtnData, PRBool append, PRUint32 maxBytes) +{ + PRInt32 extension_len; + + if (ss->vrange.max < SSL_LIBRARY_VERSION_TLS_1_3 || + !ss->ssl3.hs.cookie.len) { + return 0; + } + + SSL_TRC(3, ("%d: TLS13[%d]: send cookie extension", SSL_GETPID(), ss->fd)); + + /* Extension type, length, cookie length, cookie value. */ + extension_len = 2 + 2 + 2 + ss->ssl3.hs.cookie.len; + + if (maxBytes < (PRUint32)extension_len) { + PORT_Assert(0); + return 0; + } + + if (append) { + SECStatus rv = ssl3_ExtAppendHandshakeNumber(ss, ssl_tls13_cookie_xtn, 2); + if (rv != SECSuccess) + return -1; + + rv = ssl3_ExtAppendHandshakeNumber(ss, extension_len - 4, 2); + if (rv != SECSuccess) + return -1; + + rv = ssl3_ExtAppendHandshakeVariable(ss, ss->ssl3.hs.cookie.data, + ss->ssl3.hs.cookie.len, 2); + if (rv != SECSuccess) + return -1; + } + return extension_len; +} + +/* + * enum { psk_ke(0), psk_dhe_ke(1), (255) } PskKeyExchangeMode; + * + * struct { + * PskKeyExchangeMode ke_modes<1..255>; + * } PskKeyExchangeModes; + */ +PRInt32 +tls13_ClientSendPskKeyExchangeModesXtn(const sslSocket *ss, + TLSExtensionData *xtnData, + PRBool append, PRUint32 maxBytes) +{ + static const PRUint8 ke_modes[] = { tls13_psk_dh_ke }; + static const unsigned long ke_modes_len = sizeof(ke_modes); + PRInt32 extension_len; + + if (ss->vrange.max < SSL_LIBRARY_VERSION_TLS_1_3 || + ss->opt.noCache) { + return 0; + } + + extension_len = + 2 + 2 + /* Type + length */ + 1 + ke_modes_len; /* key exchange modes vector */ + + SSL_TRC(3, ("%d: TLS13[%d]: send psk key exchange modes extension", + SSL_GETPID(), ss->fd)); + + if (maxBytes < (PRUint32)extension_len) { + PORT_Assert(0); + return 0; + } + + if (append) { + SECStatus rv = ssl3_ExtAppendHandshakeNumber( + ss, ssl_tls13_psk_key_exchange_modes_xtn, 2); + if (rv != SECSuccess) + return -1; + + rv = ssl3_ExtAppendHandshakeNumber(ss, extension_len - 4, 2); + if (rv != SECSuccess) + return -1; + + rv = ssl3_ExtAppendHandshakeVariable( + ss, ke_modes, ke_modes_len, 1); + if (rv != SECSuccess) + return -1; + } + return extension_len; +} + +SECStatus +tls13_ServerHandlePskKeyExchangeModesXtn(const sslSocket *ss, + TLSExtensionData *xtnData, + PRUint16 ex_type, SECItem *data) +{ + SECStatus rv; + + /* If we are doing < TLS 1.3, then ignore this. */ + if (ss->version < SSL_LIBRARY_VERSION_TLS_1_3) { + return SECSuccess; + } + + SSL_TRC(3, ("%d: TLS13[%d]: handle PSK key exchange modes extension", + SSL_GETPID(), ss->fd)); + + /* IMPORTANT: We aren't copying these values, just setting pointers. + * They will only be valid as long as the ClientHello is in memory. */ + rv = ssl3_ExtConsumeHandshakeVariable(ss, + &xtnData->psk_ke_modes, 1, + &data->data, &data->len); + if (rv != SECSuccess) + return rv; + if (!xtnData->psk_ke_modes.len || data->len) { + PORT_SetError(SSL_ERROR_MALFORMED_PSK_KEY_EXCHANGE_MODES); + return SECFailure; + } + + /* Keep track of negotiated extensions. */ + xtnData->negotiated[xtnData->numNegotiated++] = ex_type; + + return SECSuccess; +} + +PRInt32 +tls13_SendShortHeaderXtn(const sslSocket *ss, + TLSExtensionData *xtnData, + PRBool append, PRUint32 maxBytes) +{ + PRUint32 extension_len = 2 + 2; /* Type + length (0). */ + + if (!ss->opt.enableShortHeaders) { + return 0; + } + + /* Presently this is incompatible with 0-RTT. We will fix if + * it becomes more than an experiment. */ + if (ss->opt.enable0RttData) { + return 0; + } + + if (IS_DTLS(ss)) { + return 0; + } + + SSL_TRC(3, ("%d: TLS13[%d]: send short_header extension", + SSL_GETPID(), ss->fd)); + + if (maxBytes < extension_len) { + PORT_Assert(0); + return 0; + } + + if (append) { + SECStatus rv; + + rv = ssl3_ExtAppendHandshakeNumber(ss, ssl_tls13_short_header_xtn, 2); + if (rv != SECSuccess) + return -1; + + rv = ssl3_ExtAppendHandshakeNumber(ss, 0, 2); + if (rv != SECSuccess) + return -1; + + xtnData->advertised[xtnData->numAdvertised++] = + ssl_tls13_short_header_xtn; + } + + return extension_len; +} + +SECStatus +tls13_HandleShortHeaderXtn( + const sslSocket *ss, TLSExtensionData *xtnData, PRUint16 ex_type, + SECItem *data) +{ + SSL_TRC(3, ("%d: TLS13[%d]: handle early_data extension", + SSL_GETPID(), ss->fd)); + + /* If we are doing < TLS 1.3, then ignore this. */ + if (ss->version < SSL_LIBRARY_VERSION_TLS_1_3) { + return SECSuccess; + } + + /* Presently this is incompatible with 0-RTT. We will fix if + * it becomes more than an experiment. */ + if (ss->opt.enable0RttData) { + return SECSuccess; + } + + if (IS_DTLS(ss)) { + PORT_SetError(SSL_ERROR_EXTENSION_DISALLOWED_FOR_VERSION); + return SECFailure; + } + + if (data->len) { + PORT_SetError(SSL_ERROR_RX_MALFORMED_HANDSHAKE); + return SECFailure; + } + + if (!ss->opt.enableShortHeaders) { + /* Ignore. */ + return SECSuccess; + } + + /* Keep track of negotiated extensions. */ + xtnData->negotiated[xtnData->numNegotiated++] = ex_type; + + if (ss->sec.isServer) { + SECStatus rv; + + rv = ssl3_RegisterExtensionSender(ss, xtnData, + ssl_tls13_short_header_xtn, + tls13_SendShortHeaderXtn); + if (rv != SECSuccess) { + return SECFailure; + } + } + + return SECSuccess; +} diff --git a/security/nss/lib/ssl/tls13exthandle.h b/security/nss/lib/ssl/tls13exthandle.h new file mode 100644 index 000000000..b798c6b55 --- /dev/null +++ b/security/nss/lib/ssl/tls13exthandle.h @@ -0,0 +1,74 @@ +/* -*- Mode: C; tab-width: 8; indent-tabs-mode: nil; c-basic-offset: 4 -*- */ +/* + * This file is PRIVATE to SSL. + * + * This Source Code Form is subject to the terms of the Mozilla Public + * License, v. 2.0. If a copy of the MPL was not distributed with this + * file, You can obtain one at http://mozilla.org/MPL/2.0/. */ + +#ifndef __tls13exthandle_h_ +#define __tls13exthandle_h_ + +PRInt32 tls13_ServerSendStatusRequestXtn(const sslSocket *ss, TLSExtensionData *xtnData, + PRBool append, PRUint32 maxBytes); +PRInt32 tls13_ClientSendKeyShareXtn(const sslSocket *ss, TLSExtensionData *xtnData, PRBool append, + PRUint32 maxBytes); +SECStatus tls13_ClientHandleKeyShareXtn(const sslSocket *ss, TLSExtensionData *xtnData, + PRUint16 ex_type, + SECItem *data); +SECStatus tls13_ClientHandleKeyShareXtnHrr(const sslSocket *ss, TLSExtensionData *xtnData, + PRUint16 ex_type, + SECItem *data); +SECStatus tls13_ServerHandleKeyShareXtn(const sslSocket *ss, TLSExtensionData *xtnData, + PRUint16 ex_type, + SECItem *data); +PRInt32 tls13_ServerSendKeyShareXtn(const sslSocket *ss, + TLSExtensionData *xtnData, + PRBool append, + PRUint32 maxBytes); +PRInt32 tls13_ClientSendPreSharedKeyXtn(const sslSocket *ss, TLSExtensionData *xtnData, PRBool append, + PRUint32 maxBytes); +SECStatus tls13_ServerHandlePreSharedKeyXtn(const sslSocket *ss, TLSExtensionData *xtnData, + PRUint16 ex_type, + SECItem *data); +SECStatus tls13_ClientHandlePreSharedKeyXtn(const sslSocket *ss, TLSExtensionData *xtnData, + PRUint16 ex_type, + SECItem *data); +PRInt32 tls13_ServerSendPreSharedKeyXtn(const sslSocket *ss, TLSExtensionData *xtnData, + PRBool append, + PRUint32 maxBytes); +PRInt32 tls13_ClientSendEarlyDataXtn(const sslSocket *ss, TLSExtensionData *xtnData, + PRBool append, + PRUint32 maxBytes); +SECStatus tls13_ServerHandleEarlyDataXtn(const sslSocket *ss, TLSExtensionData *xtnData, PRUint16 ex_type, + SECItem *data); +SECStatus tls13_ClientHandleEarlyDataXtn(const sslSocket *ss, TLSExtensionData *xtnData, PRUint16 ex_type, + SECItem *data); +PRInt32 tls13_ServerSendEarlyDataXtn(const sslSocket *ss, TLSExtensionData *xtnData, + PRBool append, + PRUint32 maxBytes); +SECStatus tls13_ClientHandleTicketEarlyDataInfoXtn( + const sslSocket *ss, TLSExtensionData *xtnData, PRUint16 ex_type, + SECItem *data); +PRInt32 tls13_ClientSendSupportedVersionsXtn(const sslSocket *ss, TLSExtensionData *xtnData, + PRBool append, + PRUint32 maxBytes); +SECStatus tls13_ClientHandleHrrCookie(const sslSocket *ss, TLSExtensionData *xtnData, PRUint16 ex_type, + SECItem *data); +PRInt32 tls13_ClientSendHrrCookieXtn(const sslSocket *ss, TLSExtensionData *xtnData, + PRBool append, + PRUint32 maxBytes); +PRInt32 tls13_ClientSendPskKeyExchangeModesXtn(const sslSocket *ss, + TLSExtensionData *xtnData, + PRBool append, PRUint32 maxBytes); +SECStatus tls13_ServerHandlePskKeyExchangeModesXtn(const sslSocket *ss, + TLSExtensionData *xtnData, + PRUint16 ex_type, SECItem *data); +PRInt32 tls13_SendShortHeaderXtn(const sslSocket *ss, + TLSExtensionData *xtnData, + PRBool append, PRUint32 maxBytes); +SECStatus tls13_HandleShortHeaderXtn( + const sslSocket *ss, TLSExtensionData *xtnData, PRUint16 ex_type, + SECItem *data); + +#endif diff --git a/security/nss/lib/ssl/tls13hkdf.c b/security/nss/lib/ssl/tls13hkdf.c new file mode 100644 index 000000000..7e69bb882 --- /dev/null +++ b/security/nss/lib/ssl/tls13hkdf.c @@ -0,0 +1,270 @@ +/* -*- Mode: C; tab-width: 8; indent-tabs-mode: nil; c-basic-offset: 4 -*- */ +/* + * TLS 1.3 Protocol + * + * This Source Code Form is subject to the terms of the Mozilla Public + * License, v. 2.0. If a copy of the MPL was not distributed with this + * file, You can obtain one at http://mozilla.org/MPL/2.0/. */ + +#include "keyhi.h" +#include "pk11func.h" +#include "secitem.h" +#include "ssl.h" +#include "sslt.h" +#include "sslerr.h" +#include "sslimpl.h" + +/* This table contains the mapping between TLS hash identifiers and the + * PKCS#11 identifiers */ +static const struct { + SSLHashType hash; + CK_MECHANISM_TYPE pkcs11Mech; + unsigned int hashSize; +} kTlsHkdfInfo[] = { + { ssl_hash_none, 0, 0 }, + { ssl_hash_md5, 0, 0 }, + { ssl_hash_sha1, 0, 0 }, + { ssl_hash_sha224, 0 }, + { ssl_hash_sha256, CKM_NSS_HKDF_SHA256, 32 }, + { ssl_hash_sha384, CKM_NSS_HKDF_SHA384, 48 }, + { ssl_hash_sha512, CKM_NSS_HKDF_SHA512, 64 } +}; + +SECStatus +tls13_HkdfExtract(PK11SymKey *ikm1, PK11SymKey *ikm2in, SSLHashType baseHash, + PK11SymKey **prkp) +{ + CK_NSS_HKDFParams params; + SECItem paramsi; + SECStatus rv; + SECItem *salt; + PK11SymKey *prk; + static const PRUint8 zeroKeyBuf[HASH_LENGTH_MAX]; + PK11SymKey *zeroKey = NULL; + PK11SlotInfo *slot = NULL; + PK11SymKey *ikm2; + + params.bExtract = CK_TRUE; + params.bExpand = CK_FALSE; + params.pInfo = NULL; + params.ulInfoLen = 0UL; + + if (ikm1) { + /* TODO(ekr@rtfm.com): This violates the PKCS#11 key boundary + * but is imposed on us by the present HKDF interface. */ + rv = PK11_ExtractKeyValue(ikm1); + if (rv != SECSuccess) + return rv; + + salt = PK11_GetKeyData(ikm1); + if (!salt) + return SECFailure; + + params.pSalt = salt->data; + params.ulSaltLen = salt->len; + PORT_Assert(salt->len > 0); + } else { + /* Per documentation for CKM_NSS_HKDF_*: + * + * If the optional salt is given, it is used; otherwise, the salt is + * set to a sequence of zeros equal in length to the HMAC output. + */ + params.pSalt = NULL; + params.ulSaltLen = 0UL; + } + paramsi.data = (unsigned char *)¶ms; + paramsi.len = sizeof(params); + + PORT_Assert(kTlsHkdfInfo[baseHash].pkcs11Mech); + PORT_Assert(kTlsHkdfInfo[baseHash].hashSize); + PORT_Assert(kTlsHkdfInfo[baseHash].hash == baseHash); + + /* A zero ikm2 is a key of hash-length 0s. */ + if (!ikm2in) { + SECItem zeroItem = { + siBuffer, + (unsigned char *)zeroKeyBuf, + kTlsHkdfInfo[baseHash].hashSize + }; + slot = PK11_GetInternalSlot(); + if (!slot) { + return SECFailure; + } + zeroKey = PK11_ImportSymKey(slot, + kTlsHkdfInfo[baseHash].pkcs11Mech, + PK11_OriginUnwrap, + CKA_DERIVE, &zeroItem, NULL); + if (!zeroKey) + return SECFailure; + ikm2 = zeroKey; + } else { + ikm2 = ikm2in; + } + PORT_Assert(ikm2); + + PRINT_BUF(50, (NULL, "HKDF Extract: IKM1/Salt", params.pSalt, params.ulSaltLen)); + PRINT_KEY(50, (NULL, "HKDF Extract: IKM2", ikm2)); + + prk = PK11_Derive(ikm2, kTlsHkdfInfo[baseHash].pkcs11Mech, + ¶msi, kTlsHkdfInfo[baseHash].pkcs11Mech, + CKA_DERIVE, kTlsHkdfInfo[baseHash].hashSize); + if (zeroKey) + PK11_FreeSymKey(zeroKey); + if (slot) + PK11_FreeSlot(slot); + if (!prk) + return SECFailure; + + PRINT_KEY(50, (NULL, "HKDF Extract", prk)); + *prkp = prk; + + return SECSuccess; +} + +SECStatus +tls13_HkdfExpandLabel(PK11SymKey *prk, SSLHashType baseHash, + const PRUint8 *handshakeHash, unsigned int handshakeHashLen, + const char *label, unsigned int labelLen, + CK_MECHANISM_TYPE algorithm, unsigned int keySize, + PK11SymKey **keyp) +{ + CK_NSS_HKDFParams params; + SECItem paramsi = { siBuffer, NULL, 0 }; + /* Size of info array needs to be big enough to hold the maximum Prefix, + * Label, plus HandshakeHash. If it's ever to small, the code will abort. + */ + PRUint8 info[256]; + PRUint8 *ptr = info; + unsigned int infoLen; + PK11SymKey *derived; + const char *kLabelPrefix = "TLS 1.3, "; + const unsigned int kLabelPrefixLen = strlen(kLabelPrefix); + + if (handshakeHash) { + if (handshakeHashLen > 255) { + PORT_Assert(0); + PORT_SetError(SEC_ERROR_INVALID_ARGS); + return SECFailure; + } + } else { + PORT_Assert(!handshakeHashLen); + } + + /* + * [draft-ietf-tls-tls13-11] Section 7.1: + * + * HKDF-Expand-Label(Secret, Label, HashValue, Length) = + * HKDF-Expand(Secret, HkdfLabel, Length) + * + * Where HkdfLabel is specified as: + * + * struct HkdfLabel { + * uint16 length; + * opaque label<9..255>; + * opaque hash_value<0..255>; + * }; + * + * Where: + * - HkdfLabel.length is Length + * - HkdfLabel.hash_value is HashValue. + * - HkdfLabel.label is "TLS 1.3, " + Label + * + */ + infoLen = 2 + 1 + kLabelPrefixLen + labelLen + 1 + handshakeHashLen; + if (infoLen > sizeof(info)) { + PORT_Assert(0); + goto abort; + } + + ptr = ssl_EncodeUintX(keySize, 2, ptr); + ptr = ssl_EncodeUintX(labelLen + kLabelPrefixLen, 1, ptr); + PORT_Memcpy(ptr, kLabelPrefix, kLabelPrefixLen); + ptr += kLabelPrefixLen; + PORT_Memcpy(ptr, label, labelLen); + ptr += labelLen; + ptr = ssl_EncodeUintX(handshakeHashLen, 1, ptr); + if (handshakeHash) { + PORT_Memcpy(ptr, handshakeHash, handshakeHashLen); + ptr += handshakeHashLen; + } + PORT_Assert((ptr - info) == infoLen); + + params.bExtract = CK_FALSE; + params.bExpand = CK_TRUE; + params.pInfo = info; + params.ulInfoLen = infoLen; + paramsi.data = (unsigned char *)¶ms; + paramsi.len = sizeof(params); + + derived = PK11_DeriveWithFlags(prk, kTlsHkdfInfo[baseHash].pkcs11Mech, + ¶msi, algorithm, + CKA_DERIVE, keySize, + CKF_SIGN | CKF_VERIFY); + if (!derived) + return SECFailure; + + *keyp = derived; + +#ifdef TRACE + if (ssl_trace >= 10) { + /* Make sure the label is null terminated. */ + char labelStr[100]; + PORT_Memcpy(labelStr, label, labelLen); + labelStr[labelLen] = 0; + SSL_TRC(50, ("HKDF Expand: label=[TLS 1.3, ] + '%s',requested length=%d", + labelStr, keySize)); + } + PRINT_KEY(50, (NULL, "PRK", prk)); + PRINT_BUF(50, (NULL, "Hash", handshakeHash, handshakeHashLen)); + PRINT_BUF(50, (NULL, "Info", info, infoLen)); + PRINT_KEY(50, (NULL, "Derived key", derived)); +#endif + + return SECSuccess; + +abort: + PORT_SetError(SSL_ERROR_SYM_KEY_CONTEXT_FAILURE); + return SECFailure; +} + +SECStatus +tls13_HkdfExpandLabelRaw(PK11SymKey *prk, SSLHashType baseHash, + const PRUint8 *handshakeHash, unsigned int handshakeHashLen, + const char *label, unsigned int labelLen, + unsigned char *output, unsigned int outputLen) +{ + PK11SymKey *derived = NULL; + SECItem *rawkey; + SECStatus rv; + + rv = tls13_HkdfExpandLabel(prk, baseHash, handshakeHash, handshakeHashLen, + label, labelLen, + kTlsHkdfInfo[baseHash].pkcs11Mech, outputLen, + &derived); + if (rv != SECSuccess || !derived) { + goto abort; + } + + rv = PK11_ExtractKeyValue(derived); + if (rv != SECSuccess) { + goto abort; + } + + rawkey = PK11_GetKeyData(derived); + if (!rawkey) { + goto abort; + } + + PORT_Assert(rawkey->len == outputLen); + memcpy(output, rawkey->data, outputLen); + PK11_FreeSymKey(derived); + + return SECSuccess; + +abort: + if (derived) { + PK11_FreeSymKey(derived); + } + PORT_SetError(SSL_ERROR_SYM_KEY_CONTEXT_FAILURE); + return SECFailure; +} diff --git a/security/nss/lib/ssl/tls13hkdf.h b/security/nss/lib/ssl/tls13hkdf.h new file mode 100644 index 000000000..78347a11d --- /dev/null +++ b/security/nss/lib/ssl/tls13hkdf.h @@ -0,0 +1,38 @@ +/* -*- Mode: C; tab-width: 8; indent-tabs-mode: nil; c-basic-offset: 4 -*- */ +/* + * This file is PRIVATE to SSL. + * + * This Source Code Form is subject to the terms of the Mozilla Public + * License, v. 2.0. If a copy of the MPL was not distributed with this + * file, You can obtain one at http://mozilla.org/MPL/2.0/. */ + +#ifndef __tls13hkdf_h_ +#define __tls13hkdf_h_ + +#include "keyhi.h" +#include "sslt.h" + +#ifdef __cplusplus +extern "C" { +#endif + +SECStatus tls13_HkdfExtract( + PK11SymKey *ikm1, PK11SymKey *ikm2, SSLHashType baseHash, + PK11SymKey **prkp); +SECStatus tls13_HkdfExpandLabelRaw( + PK11SymKey *prk, SSLHashType baseHash, + const PRUint8 *handshakeHash, unsigned int handshakeHashLen, + const char *label, unsigned int labelLen, + unsigned char *output, unsigned int outputLen); +SECStatus tls13_HkdfExpandLabel( + PK11SymKey *prk, SSLHashType baseHash, + const PRUint8 *handshakeHash, unsigned int handshakeHashLen, + const char *label, unsigned int labelLen, + CK_MECHANISM_TYPE algorithm, unsigned int keySize, + PK11SymKey **keyp); + +#ifdef __cplusplus +} +#endif + +#endif diff --git a/security/nss/lib/ssl/unix_err.c b/security/nss/lib/ssl/unix_err.c new file mode 100644 index 000000000..d4390b8c7 --- /dev/null +++ b/security/nss/lib/ssl/unix_err.c @@ -0,0 +1,837 @@ +/* -*- Mode: C++; tab-width: 4; indent-tabs-mode: nil; c-basic-offset: 2 -*- */ +/* + * This file essentially replicates NSPR's source for the functions that + * map system-specific error codes to NSPR error codes. We would use + * NSPR's functions, instead of duplicating them, but they're private. + * As long as SSL's server session cache code must do platform native I/O + * to accomplish its job, and NSPR's error mapping functions remain private, + * this code will continue to need to be replicated. + * + * This Source Code Form is subject to the terms of the Mozilla Public + * License, v. 2.0. If a copy of the MPL was not distributed with this + * file, You can obtain one at http://mozilla.org/MPL/2.0/. */ + +#if 0 +#include "primpl.h" +#else +#define _PR_POLL_AVAILABLE 1 +#include "prerror.h" +#endif + +#if defined(__bsdi__) || defined(NTO) || defined(DARWIN) || defined(BEOS) +#undef _PR_POLL_AVAILABLE +#endif + +#if defined(_PR_POLL_AVAILABLE) +#include <poll.h> +#endif +#include <errno.h> + +/* forward declarations. */ +void nss_MD_unix_map_default_error(int err); + +void +nss_MD_unix_map_opendir_error(int err) +{ + nss_MD_unix_map_default_error(err); +} + +void +nss_MD_unix_map_closedir_error(int err) +{ + PRErrorCode prError; + switch (err) { + case EINVAL: + prError = PR_BAD_DESCRIPTOR_ERROR; + break; + default: + nss_MD_unix_map_default_error(err); + return; + } + PR_SetError(prError, err); +} + +void +nss_MD_unix_readdir_error(int err) +{ + PRErrorCode prError; + + switch (err) { + case ENOENT: + prError = PR_NO_MORE_FILES_ERROR; + break; +#ifdef EOVERFLOW + case EOVERFLOW: + prError = PR_IO_ERROR; + break; +#endif + case EINVAL: + prError = PR_IO_ERROR; + break; + case ENXIO: + prError = PR_IO_ERROR; + break; + default: + nss_MD_unix_map_default_error(err); + return; + } + PR_SetError(prError, err); +} + +void +nss_MD_unix_map_unlink_error(int err) +{ + PRErrorCode prError; + switch (err) { + case EPERM: + prError = PR_IS_DIRECTORY_ERROR; + break; + default: + nss_MD_unix_map_default_error(err); + return; + } + PR_SetError(prError, err); +} + +void +nss_MD_unix_map_stat_error(int err) +{ + PRErrorCode prError; + switch (err) { + case ETIMEDOUT: + prError = PR_REMOTE_FILE_ERROR; + break; + default: + nss_MD_unix_map_default_error(err); + return; + } + PR_SetError(prError, err); +} + +void +nss_MD_unix_map_fstat_error(int err) +{ + PRErrorCode prError; + switch (err) { + case ETIMEDOUT: + prError = PR_REMOTE_FILE_ERROR; + break; + default: + nss_MD_unix_map_default_error(err); + return; + } + PR_SetError(prError, err); +} + +void +nss_MD_unix_map_rename_error(int err) +{ + PRErrorCode prError; + switch (err) { + case EEXIST: + prError = PR_DIRECTORY_NOT_EMPTY_ERROR; + break; + default: + nss_MD_unix_map_default_error(err); + return; + } + PR_SetError(prError, err); +} + +void +nss_MD_unix_map_access_error(int err) +{ + PRErrorCode prError; + switch (err) { + case ETIMEDOUT: + prError = PR_REMOTE_FILE_ERROR; + break; + default: + nss_MD_unix_map_default_error(err); + return; + } + PR_SetError(prError, err); +} + +void +nss_MD_unix_map_mkdir_error(int err) +{ + nss_MD_unix_map_default_error(err); +} + +void +nss_MD_unix_map_rmdir_error(int err) +{ + PRErrorCode prError; + + switch (err) { + case EEXIST: + prError = PR_DIRECTORY_NOT_EMPTY_ERROR; + break; + case EINVAL: + prError = PR_DIRECTORY_NOT_EMPTY_ERROR; + break; + case ETIMEDOUT: + prError = PR_REMOTE_FILE_ERROR; + break; + default: + nss_MD_unix_map_default_error(err); + return; + } + PR_SetError(prError, err); +} + +void +nss_MD_unix_map_read_error(int err) +{ + PRErrorCode prError; + switch (err) { + case EINVAL: + prError = PR_INVALID_METHOD_ERROR; + break; + case ENXIO: + prError = PR_INVALID_ARGUMENT_ERROR; + break; + default: + nss_MD_unix_map_default_error(err); + return; + } + PR_SetError(prError, err); +} + +void +nss_MD_unix_map_write_error(int err) +{ + PRErrorCode prError; + switch (err) { + case EINVAL: + prError = PR_INVALID_METHOD_ERROR; + break; + case ENXIO: + prError = PR_INVALID_METHOD_ERROR; + break; + case ETIMEDOUT: + prError = PR_REMOTE_FILE_ERROR; + break; + default: + nss_MD_unix_map_default_error(err); + return; + } + PR_SetError(prError, err); +} + +void +nss_MD_unix_map_lseek_error(int err) +{ + nss_MD_unix_map_default_error(err); +} + +void +nss_MD_unix_map_fsync_error(int err) +{ + PRErrorCode prError; + switch (err) { + case ETIMEDOUT: + prError = PR_REMOTE_FILE_ERROR; + break; + case EINVAL: + prError = PR_INVALID_METHOD_ERROR; + break; + default: + nss_MD_unix_map_default_error(err); + return; + } + PR_SetError(prError, err); +} + +void +nss_MD_unix_map_close_error(int err) +{ + PRErrorCode prError; + switch (err) { + case ETIMEDOUT: + prError = PR_REMOTE_FILE_ERROR; + break; + default: + nss_MD_unix_map_default_error(err); + return; + } + PR_SetError(prError, err); +} + +void +nss_MD_unix_map_socket_error(int err) +{ + PRErrorCode prError; + switch (err) { + case ENOMEM: + prError = PR_INSUFFICIENT_RESOURCES_ERROR; + break; + default: + nss_MD_unix_map_default_error(err); + return; + } + PR_SetError(prError, err); +} + +void +nss_MD_unix_map_socketavailable_error(int err) +{ + PR_SetError(PR_BAD_DESCRIPTOR_ERROR, err); +} + +void +nss_MD_unix_map_recv_error(int err) +{ + nss_MD_unix_map_default_error(err); +} + +void +nss_MD_unix_map_recvfrom_error(int err) +{ + nss_MD_unix_map_default_error(err); +} + +void +nss_MD_unix_map_send_error(int err) +{ + nss_MD_unix_map_default_error(err); +} + +void +nss_MD_unix_map_sendto_error(int err) +{ + nss_MD_unix_map_default_error(err); +} + +void +nss_MD_unix_map_writev_error(int err) +{ + nss_MD_unix_map_default_error(err); +} + +void +nss_MD_unix_map_accept_error(int err) +{ + PRErrorCode prError; + switch (err) { + case ENODEV: + prError = PR_NOT_TCP_SOCKET_ERROR; + break; + default: + nss_MD_unix_map_default_error(err); + return; + } + PR_SetError(prError, err); +} + +void +nss_MD_unix_map_connect_error(int err) +{ + PRErrorCode prError; + switch (err) { + case EACCES: + prError = PR_ADDRESS_NOT_SUPPORTED_ERROR; + break; +#if defined(UNIXWARE) || defined(SNI) || defined(NEC) + /* + * On some platforms, if we connect to a port on the local host + * (the loopback address) that no process is listening on, we get + * EIO instead of ECONNREFUSED. + */ + case EIO: + prError = PR_CONNECT_REFUSED_ERROR; + break; +#endif + case ELOOP: + prError = PR_ADDRESS_NOT_SUPPORTED_ERROR; + break; + case ENOENT: + prError = PR_ADDRESS_NOT_SUPPORTED_ERROR; + break; + case ENXIO: + prError = PR_IO_ERROR; + break; + default: + nss_MD_unix_map_default_error(err); + return; + } + PR_SetError(prError, err); +} + +void +nss_MD_unix_map_bind_error(int err) +{ + PRErrorCode prError; + switch (err) { + case EINVAL: + prError = PR_SOCKET_ADDRESS_IS_BOUND_ERROR; + break; + /* + * UNIX domain sockets are not supported in NSPR + */ + case EIO: + prError = PR_ADDRESS_NOT_SUPPORTED_ERROR; + break; + case EISDIR: + prError = PR_ADDRESS_NOT_SUPPORTED_ERROR; + break; + case ELOOP: + prError = PR_ADDRESS_NOT_SUPPORTED_ERROR; + break; + case ENOENT: + prError = PR_ADDRESS_NOT_SUPPORTED_ERROR; + break; + case ENOTDIR: + prError = PR_ADDRESS_NOT_SUPPORTED_ERROR; + break; + case EROFS: + prError = PR_ADDRESS_NOT_SUPPORTED_ERROR; + break; + default: + nss_MD_unix_map_default_error(err); + return; + } + PR_SetError(prError, err); +} + +void +nss_MD_unix_map_listen_error(int err) +{ + nss_MD_unix_map_default_error(err); +} + +void +nss_MD_unix_map_shutdown_error(int err) +{ + nss_MD_unix_map_default_error(err); +} + +void +nss_MD_unix_map_socketpair_error(int err) +{ + PRErrorCode prError; + switch (err) { + case ENOMEM: + prError = PR_INSUFFICIENT_RESOURCES_ERROR; + break; + default: + nss_MD_unix_map_default_error(err); + return; + } + PR_SetError(prError, err); +} + +void +nss_MD_unix_map_getsockname_error(int err) +{ + PRErrorCode prError; + switch (err) { + case ENOMEM: + prError = PR_INSUFFICIENT_RESOURCES_ERROR; + break; + default: + nss_MD_unix_map_default_error(err); + return; + } + PR_SetError(prError, err); +} + +void +nss_MD_unix_map_getpeername_error(int err) +{ + PRErrorCode prError; + + switch (err) { + case ENOMEM: + prError = PR_INSUFFICIENT_RESOURCES_ERROR; + break; + default: + nss_MD_unix_map_default_error(err); + return; + } + PR_SetError(prError, err); +} + +void +nss_MD_unix_map_getsockopt_error(int err) +{ + PRErrorCode prError; + switch (err) { + case EINVAL: + prError = PR_BUFFER_OVERFLOW_ERROR; + break; + case ENOMEM: + prError = PR_INSUFFICIENT_RESOURCES_ERROR; + break; + default: + nss_MD_unix_map_default_error(err); + return; + } + PR_SetError(prError, err); +} + +void +nss_MD_unix_map_setsockopt_error(int err) +{ + PRErrorCode prError; + switch (err) { + case EINVAL: + prError = PR_BUFFER_OVERFLOW_ERROR; + break; + case ENOMEM: + prError = PR_INSUFFICIENT_RESOURCES_ERROR; + break; + default: + nss_MD_unix_map_default_error(err); + return; + } + PR_SetError(prError, err); +} + +void +nss_MD_unix_map_open_error(int err) +{ + PRErrorCode prError; + switch (err) { + case EAGAIN: + prError = PR_INSUFFICIENT_RESOURCES_ERROR; + break; + case EBUSY: + prError = PR_IO_ERROR; + break; + case ENODEV: + prError = PR_FILE_NOT_FOUND_ERROR; + break; + case ENOMEM: + prError = PR_INSUFFICIENT_RESOURCES_ERROR; + break; + case ETIMEDOUT: + prError = PR_REMOTE_FILE_ERROR; + break; + default: + nss_MD_unix_map_default_error(err); + return; + } + PR_SetError(prError, err); +} + +void +nss_MD_unix_map_mmap_error(int err) +{ + PRErrorCode prError; + switch (err) { + case EAGAIN: + prError = PR_INSUFFICIENT_RESOURCES_ERROR; + break; + case EMFILE: + prError = PR_INSUFFICIENT_RESOURCES_ERROR; + break; + case ENODEV: + prError = PR_OPERATION_NOT_SUPPORTED_ERROR; + break; + case ENXIO: + prError = PR_INVALID_ARGUMENT_ERROR; + break; + default: + nss_MD_unix_map_default_error(err); + return; + } + PR_SetError(prError, err); +} + +void +nss_MD_unix_map_gethostname_error(int err) +{ + nss_MD_unix_map_default_error(err); +} + +void +nss_MD_unix_map_select_error(int err) +{ + nss_MD_unix_map_default_error(err); +} + +#ifdef _PR_POLL_AVAILABLE +void +nss_MD_unix_map_poll_error(int err) +{ + PRErrorCode prError; + + switch (err) { + case EAGAIN: + prError = PR_INSUFFICIENT_RESOURCES_ERROR; + break; + default: + nss_MD_unix_map_default_error(err); + return; + } + PR_SetError(prError, err); +} + +void +nss_MD_unix_map_poll_revents_error(int err) +{ + if (err & POLLNVAL) + PR_SetError(PR_BAD_DESCRIPTOR_ERROR, EBADF); + else if (err & POLLHUP) + PR_SetError(PR_CONNECT_RESET_ERROR, EPIPE); + else if (err & POLLERR) + PR_SetError(PR_IO_ERROR, EIO); + else + PR_SetError(PR_UNKNOWN_ERROR, err); +} +#endif /* _PR_POLL_AVAILABLE */ + +void +nss_MD_unix_map_flock_error(int err) +{ + PRErrorCode prError; + switch (err) { + case EINVAL: + prError = PR_BAD_DESCRIPTOR_ERROR; + break; + case EWOULDBLOCK: + prError = PR_FILE_IS_LOCKED_ERROR; + break; + default: + nss_MD_unix_map_default_error(err); + return; + } + PR_SetError(prError, err); +} + +void +nss_MD_unix_map_lockf_error(int err) +{ + PRErrorCode prError; + switch (err) { + case EACCES: + prError = PR_FILE_IS_LOCKED_ERROR; + break; + case EDEADLK: + prError = PR_INSUFFICIENT_RESOURCES_ERROR; + break; + default: + nss_MD_unix_map_default_error(err); + return; + } + PR_SetError(prError, err); +} + +#ifdef HPUX11 +void +nss_MD_hpux_map_sendfile_error(int err) +{ + nss_MD_unix_map_default_error(err); +} +#endif /* HPUX11 */ + +void +nss_MD_unix_map_default_error(int err) +{ + PRErrorCode prError; + switch (err) { + case EACCES: + prError = PR_NO_ACCESS_RIGHTS_ERROR; + break; + case EADDRINUSE: + prError = PR_ADDRESS_IN_USE_ERROR; + break; + case EADDRNOTAVAIL: + prError = PR_ADDRESS_NOT_AVAILABLE_ERROR; + break; + case EAFNOSUPPORT: + prError = PR_ADDRESS_NOT_SUPPORTED_ERROR; + break; + case EAGAIN: + prError = PR_WOULD_BLOCK_ERROR; + break; +/* + * On QNX and Neutrino, EALREADY is defined as EBUSY. + */ +#if EALREADY != EBUSY + case EALREADY: + prError = PR_ALREADY_INITIATED_ERROR; + break; +#endif + case EBADF: + prError = PR_BAD_DESCRIPTOR_ERROR; + break; +#ifdef EBADMSG + case EBADMSG: + prError = PR_IO_ERROR; + break; +#endif + case EBUSY: + prError = PR_FILESYSTEM_MOUNTED_ERROR; + break; + case ECONNREFUSED: + prError = PR_CONNECT_REFUSED_ERROR; + break; + case ECONNRESET: + prError = PR_CONNECT_RESET_ERROR; + break; + case EDEADLK: + prError = PR_DEADLOCK_ERROR; + break; +#ifdef EDIRCORRUPTED + case EDIRCORRUPTED: + prError = PR_DIRECTORY_CORRUPTED_ERROR; + break; +#endif +#ifdef EDQUOT + case EDQUOT: + prError = PR_NO_DEVICE_SPACE_ERROR; + break; +#endif + case EEXIST: + prError = PR_FILE_EXISTS_ERROR; + break; + case EFAULT: + prError = PR_ACCESS_FAULT_ERROR; + break; + case EFBIG: + prError = PR_FILE_TOO_BIG_ERROR; + break; + case EINPROGRESS: + prError = PR_IN_PROGRESS_ERROR; + break; + case EINTR: + prError = PR_PENDING_INTERRUPT_ERROR; + break; + case EINVAL: + prError = PR_INVALID_ARGUMENT_ERROR; + break; + case EIO: + prError = PR_IO_ERROR; + break; + case EISCONN: + prError = PR_IS_CONNECTED_ERROR; + break; + case EISDIR: + prError = PR_IS_DIRECTORY_ERROR; + break; + case ELOOP: + prError = PR_LOOP_ERROR; + break; + case EMFILE: + prError = PR_PROC_DESC_TABLE_FULL_ERROR; + break; + case EMLINK: + prError = PR_MAX_DIRECTORY_ENTRIES_ERROR; + break; + case EMSGSIZE: + prError = PR_INVALID_ARGUMENT_ERROR; + break; +#ifdef EMULTIHOP + case EMULTIHOP: + prError = PR_REMOTE_FILE_ERROR; + break; +#endif + case ENAMETOOLONG: + prError = PR_NAME_TOO_LONG_ERROR; + break; + case ENETUNREACH: + prError = PR_NETWORK_UNREACHABLE_ERROR; + break; + case ENFILE: + prError = PR_SYS_DESC_TABLE_FULL_ERROR; + break; +#if !defined(SCO) + case ENOBUFS: + prError = PR_INSUFFICIENT_RESOURCES_ERROR; + break; +#endif + case ENODEV: + prError = PR_FILE_NOT_FOUND_ERROR; + break; + case ENOENT: + prError = PR_FILE_NOT_FOUND_ERROR; + break; + case ENOLCK: + prError = PR_FILE_IS_LOCKED_ERROR; + break; +#ifdef ENOLINK + case ENOLINK: + prError = PR_REMOTE_FILE_ERROR; + break; +#endif + case ENOMEM: + prError = PR_OUT_OF_MEMORY_ERROR; + break; + case ENOPROTOOPT: + prError = PR_INVALID_ARGUMENT_ERROR; + break; + case ENOSPC: + prError = PR_NO_DEVICE_SPACE_ERROR; + break; +#ifdef ENOSR + case ENOSR: + prError = PR_INSUFFICIENT_RESOURCES_ERROR; + break; +#endif + case ENOTCONN: + prError = PR_NOT_CONNECTED_ERROR; + break; + case ENOTDIR: + prError = PR_NOT_DIRECTORY_ERROR; + break; + case ENOTSOCK: + prError = PR_NOT_SOCKET_ERROR; + break; + case ENXIO: + prError = PR_FILE_NOT_FOUND_ERROR; + break; + case EOPNOTSUPP: + prError = PR_NOT_TCP_SOCKET_ERROR; + break; +#ifdef EOVERFLOW + case EOVERFLOW: + prError = PR_BUFFER_OVERFLOW_ERROR; + break; +#endif + case EPERM: + prError = PR_NO_ACCESS_RIGHTS_ERROR; + break; + case EPIPE: + prError = PR_CONNECT_RESET_ERROR; + break; +#ifdef EPROTO + case EPROTO: + prError = PR_IO_ERROR; + break; +#endif + case EPROTONOSUPPORT: + prError = PR_PROTOCOL_NOT_SUPPORTED_ERROR; + break; + case EPROTOTYPE: + prError = PR_ADDRESS_NOT_SUPPORTED_ERROR; + break; + case ERANGE: + prError = PR_INVALID_METHOD_ERROR; + break; + case EROFS: + prError = PR_READ_ONLY_FILESYSTEM_ERROR; + break; + case ESPIPE: + prError = PR_INVALID_METHOD_ERROR; + break; + case ETIMEDOUT: + prError = PR_IO_TIMEOUT_ERROR; + break; +#if EWOULDBLOCK != EAGAIN + case EWOULDBLOCK: + prError = PR_WOULD_BLOCK_ERROR; + break; +#endif + case EXDEV: + prError = PR_NOT_SAME_DEVICE_ERROR; + break; + + default: + prError = PR_UNKNOWN_ERROR; + break; + } + PR_SetError(prError, err); +} diff --git a/security/nss/lib/ssl/unix_err.h b/security/nss/lib/ssl/unix_err.h new file mode 100644 index 000000000..5d7d547bf --- /dev/null +++ b/security/nss/lib/ssl/unix_err.h @@ -0,0 +1,57 @@ +/* + * This file essentially replicates NSPR's source for the functions that + * map system-specific error codes to NSPR error codes. We would use + * NSPR's functions, instead of duplicating them, but they're private. + * As long as SSL's server session cache code must do platform native I/O + * to accomplish its job, and NSPR's error mapping functions remain private, + * this code will continue to need to be replicated. + * + * This Source Code Form is subject to the terms of the Mozilla Public + * License, v. 2.0. If a copy of the MPL was not distributed with this + * file, You can obtain one at http://mozilla.org/MPL/2.0/. */ + +/* NSPR doesn't make these functions public, so we have to duplicate +** them in NSS. +*/ +extern void nss_MD_hpux_map_sendfile_error(int err); +extern void nss_MD_unix_map_accept_error(int err); +extern void nss_MD_unix_map_access_error(int err); +extern void nss_MD_unix_map_bind_error(int err); +extern void nss_MD_unix_map_close_error(int err); +extern void nss_MD_unix_map_closedir_error(int err); +extern void nss_MD_unix_map_connect_error(int err); +extern void nss_MD_unix_map_default_error(int err); +extern void nss_MD_unix_map_flock_error(int err); +extern void nss_MD_unix_map_fstat_error(int err); +extern void nss_MD_unix_map_fsync_error(int err); +extern void nss_MD_unix_map_gethostname_error(int err); +extern void nss_MD_unix_map_getpeername_error(int err); +extern void nss_MD_unix_map_getsockname_error(int err); +extern void nss_MD_unix_map_getsockopt_error(int err); +extern void nss_MD_unix_map_listen_error(int err); +extern void nss_MD_unix_map_lockf_error(int err); +extern void nss_MD_unix_map_lseek_error(int err); +extern void nss_MD_unix_map_mkdir_error(int err); +extern void nss_MD_unix_map_mmap_error(int err); +extern void nss_MD_unix_map_open_error(int err); +extern void nss_MD_unix_map_opendir_error(int err); +extern void nss_MD_unix_map_poll_error(int err); +extern void nss_MD_unix_map_poll_revents_error(int err); +extern void nss_MD_unix_map_read_error(int err); +extern void nss_MD_unix_map_readdir_error(int err); +extern void nss_MD_unix_map_recv_error(int err); +extern void nss_MD_unix_map_recvfrom_error(int err); +extern void nss_MD_unix_map_rename_error(int err); +extern void nss_MD_unix_map_rmdir_error(int err); +extern void nss_MD_unix_map_select_error(int err); +extern void nss_MD_unix_map_send_error(int err); +extern void nss_MD_unix_map_sendto_error(int err); +extern void nss_MD_unix_map_setsockopt_error(int err); +extern void nss_MD_unix_map_shutdown_error(int err); +extern void nss_MD_unix_map_socket_error(int err); +extern void nss_MD_unix_map_socketavailable_error(int err); +extern void nss_MD_unix_map_socketpair_error(int err); +extern void nss_MD_unix_map_stat_error(int err); +extern void nss_MD_unix_map_unlink_error(int err); +extern void nss_MD_unix_map_write_error(int err); +extern void nss_MD_unix_map_writev_error(int err); diff --git a/security/nss/lib/ssl/win32err.c b/security/nss/lib/ssl/win32err.c new file mode 100644 index 000000000..caa12b956 --- /dev/null +++ b/security/nss/lib/ssl/win32err.c @@ -0,0 +1,550 @@ +/* -*- Mode: C++; tab-width: 4; indent-tabs-mode: nil; c-basic-offset: 2 -*- */ +/* + * This file essentially replicates NSPR's source for the functions that + * map system-specific error codes to NSPR error codes. We would use + * NSPR's functions, instead of duplicating them, but they're private. + * As long as SSL's server session cache code must do platform native I/O + * to accomplish its job, and NSPR's error mapping functions remain private, + * this code will continue to need to be replicated. + * + * This Source Code Form is subject to the terms of the Mozilla Public + * License, v. 2.0. If a copy of the MPL was not distributed with this + * file, You can obtain one at http://mozilla.org/MPL/2.0/. */ + +#include "prerror.h" +#include "prlog.h" +#include <errno.h> +#include <windows.h> + +/* + * On Win32, we map three kinds of error codes: + * - GetLastError(): for Win32 functions + * - WSAGetLastError(): for Winsock functions + * - errno: for standard C library functions + * + * We do not check for WSAEINPROGRESS and WSAEINTR because we do not + * use blocking Winsock 1.1 calls. + * + * Except for the 'socket' call, we do not check for WSAEINITIALISED. + * It is assumed that if Winsock is not initialized, that fact will + * be detected at the time we create new sockets. + */ + +/* forward declaration. */ +void nss_MD_win32_map_default_error(PRInt32 err); + +void +nss_MD_win32_map_opendir_error(PRInt32 err) +{ + nss_MD_win32_map_default_error(err); +} + +void +nss_MD_win32_map_closedir_error(PRInt32 err) +{ + nss_MD_win32_map_default_error(err); +} + +void +nss_MD_win32_map_readdir_error(PRInt32 err) +{ + nss_MD_win32_map_default_error(err); +} + +void +nss_MD_win32_map_delete_error(PRInt32 err) +{ + nss_MD_win32_map_default_error(err); +} + +/* The error code for stat() is in errno. */ +void +nss_MD_win32_map_stat_error(PRInt32 err) +{ + nss_MD_win32_map_default_error(err); +} + +void +nss_MD_win32_map_fstat_error(PRInt32 err) +{ + nss_MD_win32_map_default_error(err); +} + +void +nss_MD_win32_map_rename_error(PRInt32 err) +{ + nss_MD_win32_map_default_error(err); +} + +/* The error code for access() is in errno. */ +void +nss_MD_win32_map_access_error(PRInt32 err) +{ + nss_MD_win32_map_default_error(err); +} + +void +nss_MD_win32_map_mkdir_error(PRInt32 err) +{ + nss_MD_win32_map_default_error(err); +} + +void +nss_MD_win32_map_rmdir_error(PRInt32 err) +{ + nss_MD_win32_map_default_error(err); +} + +void +nss_MD_win32_map_read_error(PRInt32 err) +{ + nss_MD_win32_map_default_error(err); +} + +void +nss_MD_win32_map_transmitfile_error(PRInt32 err) +{ + nss_MD_win32_map_default_error(err); +} + +void +nss_MD_win32_map_write_error(PRInt32 err) +{ + nss_MD_win32_map_default_error(err); +} + +void +nss_MD_win32_map_lseek_error(PRInt32 err) +{ + nss_MD_win32_map_default_error(err); +} + +void +nss_MD_win32_map_fsync_error(PRInt32 err) +{ + nss_MD_win32_map_default_error(err); +} + +/* + * For both CloseHandle() and closesocket(). + */ +void +nss_MD_win32_map_close_error(PRInt32 err) +{ + nss_MD_win32_map_default_error(err); +} + +void +nss_MD_win32_map_socket_error(PRInt32 err) +{ + PR_ASSERT(err != WSANOTINITIALISED); + nss_MD_win32_map_default_error(err); +} + +void +nss_MD_win32_map_recv_error(PRInt32 err) +{ + nss_MD_win32_map_default_error(err); +} + +void +nss_MD_win32_map_recvfrom_error(PRInt32 err) +{ + nss_MD_win32_map_default_error(err); +} + +void +nss_MD_win32_map_send_error(PRInt32 err) +{ + PRErrorCode prError; + switch (err) { + case WSAEMSGSIZE: + prError = PR_INVALID_ARGUMENT_ERROR; + break; + default: + nss_MD_win32_map_default_error(err); + return; + } + PR_SetError(prError, err); +} + +void +nss_MD_win32_map_sendto_error(PRInt32 err) +{ + PRErrorCode prError; + switch (err) { + case WSAEMSGSIZE: + prError = PR_INVALID_ARGUMENT_ERROR; + break; + default: + nss_MD_win32_map_default_error(err); + return; + } + PR_SetError(prError, err); +} + +void +nss_MD_win32_map_accept_error(PRInt32 err) +{ + PRErrorCode prError; + switch (err) { + case WSAEOPNOTSUPP: + prError = PR_NOT_TCP_SOCKET_ERROR; + break; + case WSAEINVAL: + prError = PR_INVALID_STATE_ERROR; + break; + default: + nss_MD_win32_map_default_error(err); + return; + } + PR_SetError(prError, err); +} + +void +nss_MD_win32_map_acceptex_error(PRInt32 err) +{ + nss_MD_win32_map_default_error(err); +} + +void +nss_MD_win32_map_connect_error(PRInt32 err) +{ + PRErrorCode prError; + switch (err) { + case WSAEWOULDBLOCK: + prError = PR_IN_PROGRESS_ERROR; + break; + case WSAEINVAL: + prError = PR_ALREADY_INITIATED_ERROR; + break; + case WSAETIMEDOUT: + prError = PR_IO_TIMEOUT_ERROR; + break; + default: + nss_MD_win32_map_default_error(err); + return; + } + PR_SetError(prError, err); +} + +void +nss_MD_win32_map_bind_error(PRInt32 err) +{ + PRErrorCode prError; + switch (err) { + case WSAEINVAL: + prError = PR_SOCKET_ADDRESS_IS_BOUND_ERROR; + break; + default: + nss_MD_win32_map_default_error(err); + return; + } + PR_SetError(prError, err); +} + +void +nss_MD_win32_map_listen_error(PRInt32 err) +{ + PRErrorCode prError; + switch (err) { + case WSAEOPNOTSUPP: + prError = PR_NOT_TCP_SOCKET_ERROR; + break; + case WSAEINVAL: + prError = PR_INVALID_STATE_ERROR; + break; + default: + nss_MD_win32_map_default_error(err); + return; + } + PR_SetError(prError, err); +} + +void +nss_MD_win32_map_shutdown_error(PRInt32 err) +{ + nss_MD_win32_map_default_error(err); +} + +void +nss_MD_win32_map_getsockname_error(PRInt32 err) +{ + PRErrorCode prError; + switch (err) { + case WSAEINVAL: + prError = PR_INVALID_STATE_ERROR; + break; + default: + nss_MD_win32_map_default_error(err); + return; + } + PR_SetError(prError, err); +} + +void +nss_MD_win32_map_getpeername_error(PRInt32 err) +{ + nss_MD_win32_map_default_error(err); +} + +void +nss_MD_win32_map_getsockopt_error(PRInt32 err) +{ + nss_MD_win32_map_default_error(err); +} + +void +nss_MD_win32_map_setsockopt_error(PRInt32 err) +{ + nss_MD_win32_map_default_error(err); +} + +void +nss_MD_win32_map_open_error(PRInt32 err) +{ + nss_MD_win32_map_default_error(err); +} + +void +nss_MD_win32_map_gethostname_error(PRInt32 err) +{ + nss_MD_win32_map_default_error(err); +} + +/* Win32 select() only works on sockets. So in this +** context, WSAENOTSOCK is equivalent to EBADF on Unix. +*/ +void +nss_MD_win32_map_select_error(PRInt32 err) +{ + PRErrorCode prError; + switch (err) { + case WSAENOTSOCK: + prError = PR_BAD_DESCRIPTOR_ERROR; + break; + default: + nss_MD_win32_map_default_error(err); + return; + } + PR_SetError(prError, err); +} + +void +nss_MD_win32_map_lockf_error(PRInt32 err) +{ + nss_MD_win32_map_default_error(err); +} + +void +nss_MD_win32_map_default_error(PRInt32 err) +{ + PRErrorCode prError; + + switch (err) { + case EACCES: + prError = PR_NO_ACCESS_RIGHTS_ERROR; + break; + case ENOENT: + prError = PR_FILE_NOT_FOUND_ERROR; + break; + case ERROR_ACCESS_DENIED: + prError = PR_NO_ACCESS_RIGHTS_ERROR; + break; + case ERROR_ALREADY_EXISTS: + prError = PR_FILE_EXISTS_ERROR; + break; + case ERROR_DISK_CORRUPT: + prError = PR_IO_ERROR; + break; + case ERROR_DISK_FULL: + prError = PR_NO_DEVICE_SPACE_ERROR; + break; + case ERROR_DISK_OPERATION_FAILED: + prError = PR_IO_ERROR; + break; + case ERROR_DRIVE_LOCKED: + prError = PR_FILE_IS_LOCKED_ERROR; + break; + case ERROR_FILENAME_EXCED_RANGE: + prError = PR_NAME_TOO_LONG_ERROR; + break; + case ERROR_FILE_CORRUPT: + prError = PR_IO_ERROR; + break; + case ERROR_FILE_EXISTS: + prError = PR_FILE_EXISTS_ERROR; + break; + case ERROR_FILE_INVALID: + prError = PR_BAD_DESCRIPTOR_ERROR; + break; +#if ERROR_FILE_NOT_FOUND != ENOENT + case ERROR_FILE_NOT_FOUND: + prError = PR_FILE_NOT_FOUND_ERROR; + break; +#endif + case ERROR_HANDLE_DISK_FULL: + prError = PR_NO_DEVICE_SPACE_ERROR; + break; + case ERROR_INVALID_ADDRESS: + prError = PR_ACCESS_FAULT_ERROR; + break; + case ERROR_INVALID_HANDLE: + prError = PR_BAD_DESCRIPTOR_ERROR; + break; + case ERROR_INVALID_NAME: + prError = PR_INVALID_ARGUMENT_ERROR; + break; + case ERROR_INVALID_PARAMETER: + prError = PR_INVALID_ARGUMENT_ERROR; + break; + case ERROR_INVALID_USER_BUFFER: + prError = PR_INSUFFICIENT_RESOURCES_ERROR; + break; + case ERROR_LOCKED: + prError = PR_FILE_IS_LOCKED_ERROR; + break; + case ERROR_NETNAME_DELETED: + prError = PR_CONNECT_RESET_ERROR; + break; + case ERROR_NOACCESS: + prError = PR_ACCESS_FAULT_ERROR; + break; + case ERROR_NOT_ENOUGH_MEMORY: + prError = PR_INSUFFICIENT_RESOURCES_ERROR; + break; + case ERROR_NOT_ENOUGH_QUOTA: + prError = PR_OUT_OF_MEMORY_ERROR; + break; + case ERROR_NOT_READY: + prError = PR_IO_ERROR; + break; + case ERROR_NO_MORE_FILES: + prError = PR_NO_MORE_FILES_ERROR; + break; + case ERROR_OPEN_FAILED: + prError = PR_IO_ERROR; + break; + case ERROR_OPEN_FILES: + prError = PR_IO_ERROR; + break; + case ERROR_OUTOFMEMORY: + prError = PR_INSUFFICIENT_RESOURCES_ERROR; + break; + case ERROR_PATH_BUSY: + prError = PR_IO_ERROR; + break; + case ERROR_PATH_NOT_FOUND: + prError = PR_FILE_NOT_FOUND_ERROR; + break; + case ERROR_SEEK_ON_DEVICE: + prError = PR_IO_ERROR; + break; + case ERROR_SHARING_VIOLATION: + prError = PR_FILE_IS_BUSY_ERROR; + break; + case ERROR_STACK_OVERFLOW: + prError = PR_ACCESS_FAULT_ERROR; + break; + case ERROR_TOO_MANY_OPEN_FILES: + prError = PR_SYS_DESC_TABLE_FULL_ERROR; + break; + case ERROR_WRITE_PROTECT: + prError = PR_NO_ACCESS_RIGHTS_ERROR; + break; + case WSAEACCES: + prError = PR_NO_ACCESS_RIGHTS_ERROR; + break; + case WSAEADDRINUSE: + prError = PR_ADDRESS_IN_USE_ERROR; + break; + case WSAEADDRNOTAVAIL: + prError = PR_ADDRESS_NOT_AVAILABLE_ERROR; + break; + case WSAEAFNOSUPPORT: + prError = PR_ADDRESS_NOT_SUPPORTED_ERROR; + break; + case WSAEALREADY: + prError = PR_ALREADY_INITIATED_ERROR; + break; + case WSAEBADF: + prError = PR_BAD_DESCRIPTOR_ERROR; + break; + case WSAECONNABORTED: + prError = PR_CONNECT_ABORTED_ERROR; + break; + case WSAECONNREFUSED: + prError = PR_CONNECT_REFUSED_ERROR; + break; + case WSAECONNRESET: + prError = PR_CONNECT_RESET_ERROR; + break; + case WSAEDESTADDRREQ: + prError = PR_INVALID_ARGUMENT_ERROR; + break; + case WSAEFAULT: + prError = PR_ACCESS_FAULT_ERROR; + break; + case WSAEHOSTUNREACH: + prError = PR_HOST_UNREACHABLE_ERROR; + break; + case WSAEINVAL: + prError = PR_INVALID_ARGUMENT_ERROR; + break; + case WSAEISCONN: + prError = PR_IS_CONNECTED_ERROR; + break; + case WSAEMFILE: + prError = PR_PROC_DESC_TABLE_FULL_ERROR; + break; + case WSAEMSGSIZE: + prError = PR_BUFFER_OVERFLOW_ERROR; + break; + case WSAENETDOWN: + prError = PR_NETWORK_DOWN_ERROR; + break; + case WSAENETRESET: + prError = PR_CONNECT_ABORTED_ERROR; + break; + case WSAENETUNREACH: + prError = PR_NETWORK_UNREACHABLE_ERROR; + break; + case WSAENOBUFS: + prError = PR_INSUFFICIENT_RESOURCES_ERROR; + break; + case WSAENOPROTOOPT: + prError = PR_INVALID_ARGUMENT_ERROR; + break; + case WSAENOTCONN: + prError = PR_NOT_CONNECTED_ERROR; + break; + case WSAENOTSOCK: + prError = PR_NOT_SOCKET_ERROR; + break; + case WSAEOPNOTSUPP: + prError = PR_OPERATION_NOT_SUPPORTED_ERROR; + break; + case WSAEPROTONOSUPPORT: + prError = PR_PROTOCOL_NOT_SUPPORTED_ERROR; + break; + case WSAEPROTOTYPE: + prError = PR_INVALID_ARGUMENT_ERROR; + break; + case WSAESHUTDOWN: + prError = PR_SOCKET_SHUTDOWN_ERROR; + break; + case WSAESOCKTNOSUPPORT: + prError = PR_INVALID_ARGUMENT_ERROR; + break; + case WSAETIMEDOUT: + prError = PR_CONNECT_ABORTED_ERROR; + break; + case WSAEWOULDBLOCK: + prError = PR_WOULD_BLOCK_ERROR; + break; + default: + prError = PR_UNKNOWN_ERROR; + break; + } + PR_SetError(prError, err); +} diff --git a/security/nss/lib/ssl/win32err.h b/security/nss/lib/ssl/win32err.h new file mode 100644 index 000000000..a69884906 --- /dev/null +++ b/security/nss/lib/ssl/win32err.h @@ -0,0 +1,51 @@ +/* + * This file essentially replicates NSPR's source for the functions that + * map system-specific error codes to NSPR error codes. We would use + * NSPR's functions, instead of duplicating them, but they're private. + * As long as SSL's server session cache code must do platform native I/O + * to accomplish its job, and NSPR's error mapping functions remain private, + * This code will continue to need to be replicated. + * + * This Source Code Form is subject to the terms of the Mozilla Public + * License, v. 2.0. If a copy of the MPL was not distributed with this + * file, You can obtain one at http://mozilla.org/MPL/2.0/. */ + +/* NSPR doesn't make these functions public, so we have to duplicate +** them in NSS. +*/ +extern void nss_MD_win32_map_accept_error(PRInt32 err); +extern void nss_MD_win32_map_acceptex_error(PRInt32 err); +extern void nss_MD_win32_map_access_error(PRInt32 err); +extern void nss_MD_win32_map_bind_error(PRInt32 err); +extern void nss_MD_win32_map_close_error(PRInt32 err); +extern void nss_MD_win32_map_closedir_error(PRInt32 err); +extern void nss_MD_win32_map_connect_error(PRInt32 err); +extern void nss_MD_win32_map_default_error(PRInt32 err); +extern void nss_MD_win32_map_delete_error(PRInt32 err); +extern void nss_MD_win32_map_fstat_error(PRInt32 err); +extern void nss_MD_win32_map_fsync_error(PRInt32 err); +extern void nss_MD_win32_map_gethostname_error(PRInt32 err); +extern void nss_MD_win32_map_getpeername_error(PRInt32 err); +extern void nss_MD_win32_map_getsockname_error(PRInt32 err); +extern void nss_MD_win32_map_getsockopt_error(PRInt32 err); +extern void nss_MD_win32_map_listen_error(PRInt32 err); +extern void nss_MD_win32_map_lockf_error(PRInt32 err); +extern void nss_MD_win32_map_lseek_error(PRInt32 err); +extern void nss_MD_win32_map_mkdir_error(PRInt32 err); +extern void nss_MD_win32_map_open_error(PRInt32 err); +extern void nss_MD_win32_map_opendir_error(PRInt32 err); +extern void nss_MD_win32_map_read_error(PRInt32 err); +extern void nss_MD_win32_map_readdir_error(PRInt32 err); +extern void nss_MD_win32_map_recv_error(PRInt32 err); +extern void nss_MD_win32_map_recvfrom_error(PRInt32 err); +extern void nss_MD_win32_map_rename_error(PRInt32 err); +extern void nss_MD_win32_map_rmdir_error(PRInt32 err); +extern void nss_MD_win32_map_select_error(PRInt32 err); +extern void nss_MD_win32_map_send_error(PRInt32 err); +extern void nss_MD_win32_map_sendto_error(PRInt32 err); +extern void nss_MD_win32_map_setsockopt_error(PRInt32 err); +extern void nss_MD_win32_map_shutdown_error(PRInt32 err); +extern void nss_MD_win32_map_socket_error(PRInt32 err); +extern void nss_MD_win32_map_stat_error(PRInt32 err); +extern void nss_MD_win32_map_transmitfile_error(PRInt32 err); +extern void nss_MD_win32_map_write_error(PRInt32 err); |