1/* $OpenBSD: tls13_legacy.c,v 1.44 2024/01/30 14:50:50 jsing Exp $ */ 2/* 3 * Copyright (c) 2018, 2019 Joel Sing <jsing@openbsd.org> 4 * 5 * Permission to use, copy, modify, and distribute this software for any 6 * purpose with or without fee is hereby granted, provided that the above 7 * copyright notice and this permission notice appear in all copies. 8 * 9 * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES 10 * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF 11 * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR 12 * ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES 13 * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN 14 * ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF 15 * OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE. 16 */ 17 18#include <limits.h> 19 20#include "ssl_local.h" 21#include "tls13_internal.h" 22 23static ssize_t 24tls13_legacy_wire_read(SSL *ssl, uint8_t *buf, size_t len) 25{ 26 int n; 27 28 if (ssl->rbio == NULL) { 29 SSLerror(ssl, SSL_R_BIO_NOT_SET); 30 return TLS13_IO_FAILURE; 31 } 32 33 ssl->rwstate = SSL_READING; 34 errno = 0; 35 36 if ((n = BIO_read(ssl->rbio, buf, len)) <= 0) { 37 if (BIO_should_read(ssl->rbio)) 38 return TLS13_IO_WANT_POLLIN; 39 if (n == 0) 40 return TLS13_IO_EOF; 41 42 if (ERR_peek_error() == 0 && errno != 0) 43 SYSerror(errno); 44 45 return TLS13_IO_FAILURE; 46 } 47 48 if (n == len) 49 ssl->rwstate = SSL_NOTHING; 50 51 return n; 52} 53 54ssize_t 55tls13_legacy_wire_read_cb(void *buf, size_t n, void *arg) 56{ 57 struct tls13_ctx *ctx = arg; 58 59 return tls13_legacy_wire_read(ctx->ssl, buf, n); 60} 61 62static ssize_t 63tls13_legacy_wire_write(SSL *ssl, const uint8_t *buf, size_t len) 64{ 65 int n; 66 67 if (ssl->wbio == NULL) { 68 SSLerror(ssl, SSL_R_BIO_NOT_SET); 69 return TLS13_IO_FAILURE; 70 } 71 72 ssl->rwstate = SSL_WRITING; 73 errno = 0; 74 75 if ((n = BIO_write(ssl->wbio, buf, len)) <= 0) { 76 if (BIO_should_write(ssl->wbio)) 77 return TLS13_IO_WANT_POLLOUT; 78 79 if (ERR_peek_error() == 0 && errno != 0) 80 SYSerror(errno); 81 82 return TLS13_IO_FAILURE; 83 } 84 85 if (n == len) 86 ssl->rwstate = SSL_NOTHING; 87 88 return n; 89} 90 91ssize_t 92tls13_legacy_wire_write_cb(const void *buf, size_t n, void *arg) 93{ 94 struct tls13_ctx *ctx = arg; 95 96 return tls13_legacy_wire_write(ctx->ssl, buf, n); 97} 98 99static ssize_t 100tls13_legacy_wire_flush(SSL *ssl) 101{ 102 if (BIO_flush(ssl->wbio) <= 0) { 103 if (BIO_should_write(ssl->wbio)) 104 return TLS13_IO_WANT_POLLOUT; 105 106 if (ERR_peek_error() == 0 && errno != 0) 107 SYSerror(errno); 108 109 return TLS13_IO_FAILURE; 110 } 111 112 return TLS13_IO_SUCCESS; 113} 114 115ssize_t 116tls13_legacy_wire_flush_cb(void *arg) 117{ 118 struct tls13_ctx *ctx = arg; 119 120 return tls13_legacy_wire_flush(ctx->ssl); 121} 122 123static void 124tls13_legacy_error(SSL *ssl) 125{ 126 struct tls13_ctx *ctx = ssl->tls13; 127 int reason = SSL_R_UNKNOWN; 128 129 /* If we received a fatal alert we already put an error on the stack. */ 130 if (ssl->s3->fatal_alert != 0) 131 return; 132 133 switch (ctx->error.code) { 134 case TLS13_ERR_VERIFY_FAILED: 135 reason = SSL_R_CERTIFICATE_VERIFY_FAILED; 136 break; 137 case TLS13_ERR_HRR_FAILED: 138 reason = SSL_R_NO_CIPHERS_AVAILABLE; 139 break; 140 case TLS13_ERR_TRAILING_DATA: 141 reason = SSL_R_EXTRA_DATA_IN_MESSAGE; 142 break; 143 case TLS13_ERR_NO_SHARED_CIPHER: 144 reason = SSL_R_NO_SHARED_CIPHER; 145 break; 146 case TLS13_ERR_NO_CERTIFICATE: 147 reason = SSL_R_MISSING_RSA_CERTIFICATE; /* XXX */ 148 break; 149 case TLS13_ERR_NO_PEER_CERTIFICATE: 150 reason = SSL_R_PEER_DID_NOT_RETURN_A_CERTIFICATE; 151 break; 152 } 153 154 /* Something (probably libcrypto) already pushed an error on the stack. */ 155 if (reason == SSL_R_UNKNOWN && ERR_peek_error() != 0) 156 return; 157 158 ERR_put_error(ERR_LIB_SSL, (0xfff), reason, ctx->error.file, 159 ctx->error.line); 160} 161 162static int 163tls13_legacy_return_code(SSL *ssl, ssize_t ret) 164{ 165 if (ret > INT_MAX) { 166 SSLerror(ssl, ERR_R_INTERNAL_ERROR); 167 return -1; 168 } 169 170 /* A successful read, write or other operation. */ 171 if (ret > 0) 172 return ret; 173 174 ssl->rwstate = SSL_NOTHING; 175 176 switch (ret) { 177 case TLS13_IO_EOF: 178 return 0; 179 180 case TLS13_IO_FAILURE: 181 tls13_legacy_error(ssl); 182 return -1; 183 184 case TLS13_IO_ALERT: 185 tls13_legacy_error(ssl); 186 return -1; 187 188 case TLS13_IO_WANT_POLLIN: 189 BIO_set_retry_read(ssl->rbio); 190 ssl->rwstate = SSL_READING; 191 return -1; 192 193 case TLS13_IO_WANT_POLLOUT: 194 BIO_set_retry_write(ssl->wbio); 195 ssl->rwstate = SSL_WRITING; 196 return -1; 197 198 case TLS13_IO_WANT_RETRY: 199 SSLerror(ssl, ERR_R_INTERNAL_ERROR); 200 return -1; 201 } 202 203 SSLerror(ssl, ERR_R_INTERNAL_ERROR); 204 return -1; 205} 206 207int 208tls13_legacy_pending(const SSL *ssl) 209{ 210 struct tls13_ctx *ctx = ssl->tls13; 211 ssize_t ret; 212 213 if (ctx == NULL) 214 return 0; 215 216 ret = tls13_pending_application_data(ctx->rl); 217 if (ret < 0 || ret > INT_MAX) 218 return 0; 219 220 return ret; 221} 222 223int 224tls13_legacy_read_bytes(SSL *ssl, int type, unsigned char *buf, int len, int peek) 225{ 226 struct tls13_ctx *ctx = ssl->tls13; 227 ssize_t ret; 228 229 if (ctx == NULL || !ctx->handshake_completed) { 230 if ((ret = ssl->handshake_func(ssl)) <= 0) 231 return ret; 232 if (len == 0) 233 return 0; 234 return tls13_legacy_return_code(ssl, TLS13_IO_WANT_POLLIN); 235 } 236 237 tls13_record_layer_set_retry_after_phh(ctx->rl, 238 (ctx->ssl->mode & SSL_MODE_AUTO_RETRY) != 0); 239 240 if (type != SSL3_RT_APPLICATION_DATA) { 241 SSLerror(ssl, ERR_R_SHOULD_NOT_HAVE_BEEN_CALLED); 242 return -1; 243 } 244 if (len < 0) { 245 SSLerror(ssl, SSL_R_BAD_LENGTH); 246 return -1; 247 } 248 249 if (peek) 250 ret = tls13_peek_application_data(ctx->rl, buf, len); 251 else 252 ret = tls13_read_application_data(ctx->rl, buf, len); 253 254 return tls13_legacy_return_code(ssl, ret); 255} 256 257int 258tls13_legacy_write_bytes(SSL *ssl, int type, const void *vbuf, int len) 259{ 260 struct tls13_ctx *ctx = ssl->tls13; 261 const uint8_t *buf = vbuf; 262 size_t n, sent; 263 ssize_t ret; 264 265 if (ctx == NULL || !ctx->handshake_completed) { 266 if ((ret = ssl->handshake_func(ssl)) <= 0) 267 return ret; 268 if (len == 0) 269 return 0; 270 return tls13_legacy_return_code(ssl, TLS13_IO_WANT_POLLOUT); 271 } 272 273 if (type != SSL3_RT_APPLICATION_DATA) { 274 SSLerror(ssl, ERR_R_SHOULD_NOT_HAVE_BEEN_CALLED); 275 return -1; 276 } 277 if (len < 0) { 278 SSLerror(ssl, SSL_R_BAD_LENGTH); 279 return -1; 280 } 281 282 /* 283 * The TLSv1.3 record layer write behaviour is the same as 284 * SSL_MODE_ENABLE_PARTIAL_WRITE. 285 */ 286 if (ssl->mode & SSL_MODE_ENABLE_PARTIAL_WRITE) { 287 ret = tls13_write_application_data(ctx->rl, buf, len); 288 return tls13_legacy_return_code(ssl, ret); 289 } 290 291 /* 292 * In the non-SSL_MODE_ENABLE_PARTIAL_WRITE case we have to loop until 293 * we have written out all of the requested data. 294 */ 295 sent = ssl->s3->wnum; 296 if (len < sent) { 297 SSLerror(ssl, SSL_R_BAD_LENGTH); 298 return -1; 299 } 300 n = len - sent; 301 for (;;) { 302 if (n == 0) { 303 ssl->s3->wnum = 0; 304 return sent; 305 } 306 if ((ret = tls13_write_application_data(ctx->rl, 307 &buf[sent], n)) <= 0) { 308 ssl->s3->wnum = sent; 309 return tls13_legacy_return_code(ssl, ret); 310 } 311 sent += ret; 312 n -= ret; 313 } 314} 315 316static int 317tls13_use_legacy_stack(struct tls13_ctx *ctx) 318{ 319 SSL *s = ctx->ssl; 320 CBB cbb, fragment; 321 CBS cbs; 322 323 memset(&cbb, 0, sizeof(cbb)); 324 325 if (!ssl3_setup_init_buffer(s)) 326 goto err; 327 if (!ssl3_setup_buffers(s)) 328 goto err; 329 if (!ssl_init_wbio_buffer(s, 1)) 330 goto err; 331 332 /* Stash any unprocessed data from the last record. */ 333 tls13_record_layer_rcontent(ctx->rl, &cbs); 334 if (CBS_len(&cbs) > 0) { 335 if (!CBB_init_fixed(&cbb, s->s3->rbuf.buf, 336 s->s3->rbuf.len)) 337 goto err; 338 if (!CBB_add_u8(&cbb, SSL3_RT_HANDSHAKE)) 339 goto err; 340 if (!CBB_add_u16(&cbb, TLS1_2_VERSION)) 341 goto err; 342 if (!CBB_add_u16_length_prefixed(&cbb, &fragment)) 343 goto err; 344 if (!CBB_add_bytes(&fragment, CBS_data(&cbs), CBS_len(&cbs))) 345 goto err; 346 if (!CBB_finish(&cbb, NULL, NULL)) 347 goto err; 348 349 s->s3->rbuf.offset = SSL3_RT_HEADER_LENGTH; 350 s->s3->rbuf.left = CBS_len(&cbs); 351 s->s3->rrec.type = SSL3_RT_HANDSHAKE; 352 s->s3->rrec.length = CBS_len(&cbs); 353 s->rstate = SSL_ST_READ_BODY; 354 s->packet = s->s3->rbuf.buf; 355 s->packet_length = SSL3_RT_HEADER_LENGTH; 356 s->mac_packet = 1; 357 } 358 359 /* Stash the current handshake message. */ 360 tls13_handshake_msg_data(ctx->hs_msg, &cbs); 361 if (!BUF_MEM_grow_clean(s->init_buf, CBS_len(&cbs))) 362 goto err; 363 if (!CBS_write_bytes(&cbs, s->init_buf->data, 364 s->init_buf->length, NULL)) 365 goto err; 366 367 s->s3->hs.tls12.reuse_message = 1; 368 s->s3->hs.tls12.message_type = tls13_handshake_msg_type(ctx->hs_msg); 369 s->s3->hs.tls12.message_size = CBS_len(&cbs) - SSL3_HM_HEADER_LENGTH; 370 371 /* 372 * Only switch the method after initialization is complete 373 * as we start part way into the legacy state machine. 374 */ 375 s->method = tls_legacy_method(); 376 377 return 1; 378 379 err: 380 CBB_cleanup(&cbb); 381 382 return 0; 383} 384 385int 386tls13_use_legacy_client(struct tls13_ctx *ctx) 387{ 388 SSL *s = ctx->ssl; 389 390 if (!tls13_use_legacy_stack(ctx)) 391 return 0; 392 393 s->handshake_func = s->method->ssl_connect; 394 s->version = s->method->max_tls_version; 395 396 return 1; 397} 398 399int 400tls13_use_legacy_server(struct tls13_ctx *ctx) 401{ 402 SSL *s = ctx->ssl; 403 404 if (!tls13_use_legacy_stack(ctx)) 405 return 0; 406 407 s->handshake_func = s->method->ssl_accept; 408 s->version = s->method->max_tls_version; 409 s->server = 1; 410 411 return 1; 412} 413 414int 415tls13_legacy_accept(SSL *ssl) 416{ 417 struct tls13_ctx *ctx = ssl->tls13; 418 int ret; 419 420 if (ctx == NULL) { 421 if ((ctx = tls13_ctx_new(TLS13_HS_SERVER, ssl)) == NULL) { 422 SSLerror(ssl, ERR_R_INTERNAL_ERROR); /* XXX */ 423 return -1; 424 } 425 if (!tls13_server_init(ctx)) { 426 if (ERR_peek_error() == 0) 427 SSLerror(ssl, ERR_R_INTERNAL_ERROR); /* XXX */ 428 return -1; 429 } 430 } 431 432 ERR_clear_error(); 433 434 ret = tls13_server_accept(ctx); 435 if (ret == TLS13_IO_USE_LEGACY) 436 return ssl->method->ssl_accept(ssl); 437 438 ret = tls13_legacy_return_code(ssl, ret); 439 440 if (ctx->info_cb != NULL) 441 ctx->info_cb(ctx, TLS13_INFO_ACCEPT_EXIT, ret); 442 443 return ret; 444} 445 446int 447tls13_legacy_connect(SSL *ssl) 448{ 449 struct tls13_ctx *ctx = ssl->tls13; 450 int ret; 451 452 if (ctx == NULL) { 453 if ((ctx = tls13_ctx_new(TLS13_HS_CLIENT, ssl)) == NULL) { 454 SSLerror(ssl, ERR_R_INTERNAL_ERROR); /* XXX */ 455 return -1; 456 } 457 if (!tls13_client_init(ctx)) { 458 if (ERR_peek_error() == 0) 459 SSLerror(ssl, ERR_R_INTERNAL_ERROR); /* XXX */ 460 return -1; 461 } 462 } 463 464 ERR_clear_error(); 465 466 ret = tls13_client_connect(ctx); 467 if (ret == TLS13_IO_USE_LEGACY) 468 return ssl->method->ssl_connect(ssl); 469 470 ret = tls13_legacy_return_code(ssl, ret); 471 472 if (ctx->info_cb != NULL) 473 ctx->info_cb(ctx, TLS13_INFO_CONNECT_EXIT, ret); 474 475 return ret; 476} 477 478int 479tls13_legacy_shutdown(SSL *ssl) 480{ 481 struct tls13_ctx *ctx = ssl->tls13; 482 uint8_t buf[512]; /* XXX */ 483 ssize_t ret; 484 485 /* 486 * We need to return 0 at the point that we have completed sending a 487 * close-notify. We return 1 when we have sent and received close-notify 488 * alerts. All other cases, including EOF, return -1 and set internal 489 * state appropriately. Note that all of this insanity can also be 490 * externally controlled by manipulating the shutdown flags. 491 */ 492 if (ctx == NULL || ssl->quiet_shutdown) { 493 ssl->shutdown = SSL_SENT_SHUTDOWN | SSL_RECEIVED_SHUTDOWN; 494 return 1; 495 } 496 497 if ((ssl->shutdown & SSL_SENT_SHUTDOWN) == 0) { 498 ssl->shutdown |= SSL_SENT_SHUTDOWN; 499 ret = tls13_send_alert(ctx->rl, TLS13_ALERT_CLOSE_NOTIFY); 500 if (ret == TLS13_IO_EOF) 501 return -1; 502 if (ret != TLS13_IO_SUCCESS) 503 return tls13_legacy_return_code(ssl, ret); 504 goto done; 505 } 506 507 ret = tls13_record_layer_send_pending(ctx->rl); 508 if (ret == TLS13_IO_EOF) 509 return -1; 510 if (ret != TLS13_IO_SUCCESS) 511 return tls13_legacy_return_code(ssl, ret); 512 513 if ((ssl->shutdown & SSL_RECEIVED_SHUTDOWN) == 0) { 514 /* 515 * If there is no application data pending, attempt to read more 516 * data in order to receive a close-notify. This should trigger 517 * a record to be read from the wire, which may be application 518 * handshake or alert data. Only one attempt is made with no 519 * error handling, in order to match previous semantics. 520 */ 521 if (tls13_pending_application_data(ctx->rl) == 0) { 522 (void)tls13_read_application_data(ctx->rl, buf, sizeof(buf)); 523 if (!ctx->close_notify_recv) 524 return -1; 525 } 526 } 527 528 done: 529 if (ssl->shutdown == (SSL_SENT_SHUTDOWN | SSL_RECEIVED_SHUTDOWN)) 530 return 1; 531 532 return 0; 533} 534 535int 536tls13_legacy_servername_process(struct tls13_ctx *ctx, uint8_t *alert) 537{ 538 int legacy_alert = SSL_AD_UNRECOGNIZED_NAME; 539 int ret = SSL_TLSEXT_ERR_NOACK; 540 SSL_CTX *ssl_ctx = ctx->ssl->ctx; 541 SSL *s = ctx->ssl; 542 543 if (ssl_ctx->tlsext_servername_callback == NULL) 544 ssl_ctx = s->initial_ctx; 545 if (ssl_ctx->tlsext_servername_callback == NULL) 546 return 1; 547 548 ret = ssl_ctx->tlsext_servername_callback(s, &legacy_alert, 549 ssl_ctx->tlsext_servername_arg); 550 551 /* 552 * Ignore SSL_TLSEXT_ERR_ALERT_WARNING returns to match OpenSSL's 553 * behavior: the only warning alerts in TLSv1.3 are close_notify and 554 * user_canceled, neither of which should be returned by the callback. 555 */ 556 if (ret == SSL_TLSEXT_ERR_ALERT_FATAL) { 557 if (legacy_alert >= 0 && legacy_alert <= 255) 558 *alert = legacy_alert; 559 return 0; 560 } 561 562 return 1; 563} 564