kris/boringssl
1
0
Fork 0
Code Issues Pull Requests Releases Wiki Activity
1e29a6b7c5
boringssl/ssl/s23_clnt.c

544 lines
15 KiB
C
Raw Normal View History

Inital import. Initial fork from f2d678e6e89b6508147086610e985d4e8416e867 (1.0.2 beta). (This change contains substantial changes from the original and effectively starts a new history.)
2014-06-20 20:00:00 +01:00
/* Copyright (C) 1995-1998 Eric Young (eay@cryptsoft.com)
* All rights reserved.
*
* This package is an SSL implementation written
* by Eric Young (eay@cryptsoft.com).
* The implementation was written so as to conform with Netscapes SSL.
*
* This library is free for commercial and non-commercial use as long as
* the following conditions are aheared to. The following conditions
* apply to all code found in this distribution, be it the RC4, RSA,
* lhash, DES, etc., code; not just the SSL code. The SSL documentation
* included with this distribution is covered by the same copyright terms
* except that the holder is Tim Hudson (tjh@cryptsoft.com).
*
* Copyright remains Eric Young's, and as such any Copyright notices in
* the code are not to be removed.
* If this package is used in a product, Eric Young should be given attribution
* as the author of the parts of the library used.
* This can be in the form of a textual message at program startup or
* in documentation (online or textual) provided with the package.
*
* Redistribution and use in source and binary forms, with or without
* modification, are permitted provided that the following conditions
* are met:
* 1. Redistributions of source code must retain the copyright
* notice, this list of conditions and the following disclaimer.
* 2. Redistributions in binary form must reproduce the above copyright
* notice, this list of conditions and the following disclaimer in the
* documentation and/or other materials provided with the distribution.
* 3. All advertising materials mentioning features or use of this software
* must display the following acknowledgement:
* "This product includes cryptographic software written by
* Eric Young (eay@cryptsoft.com)"
* The word 'cryptographic' can be left out if the rouines from the library
* being used are not cryptographic related :-).
* 4. If you include any Windows specific code (or a derivative thereof) from
* the apps directory (application code) you must include an acknowledgement:
* "This product includes software written by Tim Hudson (tjh@cryptsoft.com)"
*
* THIS SOFTWARE IS PROVIDED BY ERIC YOUNG ``AS IS'' AND
* ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
* IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
* ARE DISCLAIMED. IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE
* FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
* DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
* OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
* HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
* LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
* OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
* SUCH DAMAGE.
*
* The licence and distribution terms for any publically available version or
* derivative of this code cannot be changed. i.e. this code cannot simply be
* copied and put under another distribution licence
* [including the GNU Public Licence.]
*/
/* ====================================================================
* Copyright (c) 1998-2006 The OpenSSL Project. All rights reserved.
*
* Redistribution and use in source and binary forms, with or without
* modification, are permitted provided that the following conditions
* are met:
*
* 1. Redistributions of source code must retain the above copyright
* notice, this list of conditions and the following disclaimer.
*
* 2. Redistributions in binary form must reproduce the above copyright
* notice, this list of conditions and the following disclaimer in
* the documentation and/or other materials provided with the
* distribution.
*
* 3. All advertising materials mentioning features or use of this
* software must display the following acknowledgment:
* "This product includes software developed by the OpenSSL Project
* for use in the OpenSSL Toolkit. (http://www.openssl.org/)"
*
* 4. The names "OpenSSL Toolkit" and "OpenSSL Project" must not be used to
* endorse or promote products derived from this software without
* prior written permission. For written permission, please contact
* openssl-core@openssl.org.
*
* 5. Products derived from this software may not be called "OpenSSL"
* nor may "OpenSSL" appear in their names without prior written
* permission of the OpenSSL Project.
*
* 6. Redistributions of any form whatsoever must retain the following
* acknowledgment:
* "This product includes software developed by the OpenSSL Project
* for use in the OpenSSL Toolkit (http://www.openssl.org/)"
*
* THIS SOFTWARE IS PROVIDED BY THE OpenSSL PROJECT ``AS IS'' AND ANY
* EXPRESSED OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
* IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
* PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE OpenSSL PROJECT OR
* ITS CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
* SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
* NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
* LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
* HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT,
* STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
* ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED
* OF THE POSSIBILITY OF SUCH DAMAGE.
* ====================================================================
*
* This product includes cryptographic software written by Eric Young
* (eay@cryptsoft.com). This product includes software written by Tim
* Hudson (tjh@cryptsoft.com). */
Remove redundant s->server assignments in handshake. It should be set correctly prior to entering the handshake. Don't mask bugs by assigning it. Change-Id: Ib9bca8fad68916b3b242aad8819e3760e59e777a Reviewed-on: https://boringssl-review.googlesource.com/2443 Reviewed-by: Adam Langley <agl@google.com>
2014-11-30 07:58:52 +00:00
#include <assert.h>
Inital import. Initial fork from f2d678e6e89b6508147086610e985d4e8416e867 (1.0.2 beta). (This change contains substantial changes from the original and effectively starts a new history.)
2014-06-20 20:00:00 +01:00
#include <stdio.h>
#include <openssl/buf.h>
#include <openssl/err.h>
#include <openssl/evp.h>
#include <openssl/obj.h>
#include <openssl/rand.h>
#include "ssl_locl.h"
static int ssl23_client_hello(SSL *s);
static int ssl23_get_server_hello(SSL *s);
IMPLEMENT_ssl23_meth_func(SSLv23_client_method,
Merge client/server SSL_METHODs into the generic one. Supporting both schemes seems pointless. Now that s->server and s->state are set appropriately late and get_ssl_method is gone, the only difference is that the client/server ones have non-functional ssl_accept or ssl_connect hooks. We can't lose the generic ones, so let's unify on that. Note: this means a static linker will no longer drop the client or server handshake code if unused by a consumer linking statically. However, Chromium needs the server half anyway for DTLS and WebRTC, so that's probably a lost cause. Android also exposes server APIs. Change-Id: I290f5fb4ed558f59fadb5d1f84e9d9c405004c23 Reviewed-on: https://boringssl-review.googlesource.com/2440 Reviewed-by: Adam Langley <agl@google.com>
2014-11-23 20:47:20 +00:00
ssl23_accept,
Remove method swap in SSL_set_session. This is a bit of cleanup that probably should have been done at the same time as 30ddb434bfb845356fbacb6b2bd51f8814c7043c. For now, version negotiation is implemented with a method swap. It also performs this swap on SSL_set_session, but this was neutered in 30ddb434bfb845356fbacb6b2bd51f8814c7043c. Rather than hackishly neuter it, remove it outright. In addition, remove SSL_set_ssl_method. Now all method swaps are internal: SSLv23_method switch to a version-specific method and SSL_clear undoing it. Note that this does change behavior: if an SSL* is created with one version-specific method and we SSL_set_session to a session from a /different/ version, we would switch to the /other/ version-specific method. This is extremely confusing, so it's unlikely anyone was actually expecting it. Version-specific methods in general don't work well. Change-Id: I72a5c1f321ca9aeb1b52ebe0317072950ba25092 Reviewed-on: https://boringssl-review.googlesource.com/2390 Reviewed-by: Adam Langley <agl@google.com>
2014-11-22 19:32:53 +00:00
ssl23_connect)
Inital import. Initial fork from f2d678e6e89b6508147086610e985d4e8416e867 (1.0.2 beta). (This change contains substantial changes from the original and effectively starts a new history.)
2014-06-20 20:00:00 +01:00
int ssl23_connect(SSL *s)
{
BUF_MEM *buf=NULL;
void (*cb)(const SSL *ssl,int type,int val)=NULL;
int ret= -1;
int new_state,state;
Remove redundant s->server assignments in handshake. It should be set correctly prior to entering the handshake. Don't mask bugs by assigning it. Change-Id: Ib9bca8fad68916b3b242aad8819e3760e59e777a Reviewed-on: https://boringssl-review.googlesource.com/2443 Reviewed-by: Adam Langley <agl@google.com>
2014-11-30 07:58:52 +00:00
assert(s->handshake_func == ssl23_connect);
assert(!s->server);
Inital import. Initial fork from f2d678e6e89b6508147086610e985d4e8416e867 (1.0.2 beta). (This change contains substantial changes from the original and effectively starts a new history.)
2014-06-20 20:00:00 +01:00
ERR_clear_error();
ERR_clear_system_error();
if (s->info_callback != NULL)
cb=s->info_callback;
else if (s->ctx->info_callback != NULL)
cb=s->ctx->info_callback;
s->in_handshake++;
for (;;)
{
state=s->state;
switch(s->state)
{
case SSL_ST_CONNECT:
case SSL_ST_BEFORE|SSL_ST_CONNECT:
if (cb != NULL) cb(s,SSL_CB_HANDSHAKE_START,1);
if (s->init_buf == NULL)
{
if ((buf=BUF_MEM_new()) == NULL)
{
ret= -1;
goto end;
}
if (!BUF_MEM_grow(buf,SSL3_RT_MAX_PLAIN_LENGTH))
{
ret= -1;
goto end;
}
s->init_buf=buf;
buf=NULL;
}
if (!ssl3_setup_buffers(s)) { ret= -1; goto end; }
Add malloc failure tests. This commit fixes a number of crashes caused by malloc failures. They were found using the -malloc-test=0 option to runner.go which runs tests many times, causing a different allocation call to fail in each case. (This test only works on Linux and only looks for crashes caused by allocation failures, not memory leaks or other errors.) This is not the complete set of crashes! More can be found by collecting core dumps from running with -malloc-test=0. Change-Id: Ia61d19f51e373bccb7bc604642c51e043a74bd83 Reviewed-on: https://boringssl-review.googlesource.com/2320 Reviewed-by: Adam Langley <agl@google.com>
2014-11-18 01:26:55 +00:00
if (!ssl3_init_finished_mac(s))
{
OPENSSL_PUT_ERROR(SSL, ssl23_connect, ERR_R_INTERNAL_ERROR);
ret = -1;
goto end;
}
Inital import. Initial fork from f2d678e6e89b6508147086610e985d4e8416e867 (1.0.2 beta). (This change contains substantial changes from the original and effectively starts a new history.)
2014-06-20 20:00:00 +01:00
s->state=SSL23_ST_CW_CLNT_HELLO_A;
s->ctx->stats.sess_connect++;
s->init_num=0;
break;
case SSL23_ST_CW_CLNT_HELLO_A:
case SSL23_ST_CW_CLNT_HELLO_B:
s->shutdown=0;
ret=ssl23_client_hello(s);
if (ret <= 0) goto end;
s->state=SSL23_ST_CR_SRVR_HELLO_A;
s->init_num=0;
break;
case SSL23_ST_CR_SRVR_HELLO_A:
case SSL23_ST_CR_SRVR_HELLO_B:
ret=ssl23_get_server_hello(s);
if (ret >= 0) cb=NULL;
goto end;
/* break; */
default:
OPENSSL_PUT_ERROR(SSL, ssl23_connect, SSL_R_UNKNOWN_STATE);
ret= -1;
goto end;
/* break; */
}
if ((cb != NULL) && (s->state != state))
{
new_state=s->state;
s->state=state;
cb(s,SSL_CB_CONNECT_LOOP,1);
s->state=new_state;
}
}
end:
s->in_handshake--;
if (buf != NULL)
BUF_MEM_free(buf);
if (cb != NULL)
cb(s,SSL_CB_CONNECT_EXIT,ret);
return(ret);
}
Remove SSL_set_session_secret_cb (EAP-FAST) This is only used for EAP-FAST which we apparently don't need to support. Remove it outright. We broke it in 9eaeef81fa2d4fd6246dc02b6203fa936a5eaf67 by failing to account for session misses. If this changes and we need it later, we can resurrect it. Preferably implemented differently: the current implementation is bolted badly onto the handshake. Ideally use the supplied callbacks to fabricate an appropriate SSL_SESSION and resume that with as much of the normal session ticket flow as possible. The one difference is that EAP-FAST seems to require the probing mechanism for session tickets rather than the sane session ID echoing version. We can reimplement that by asking the record layer to probe ahead for one byte. Change-Id: I38304953cc36b2020611556a91e8ac091691edac Reviewed-on: https://boringssl-review.googlesource.com/2360 Reviewed-by: Adam Langley <agl@google.com>
2014-11-20 19:54:14 +00:00
/* Fill a ClientRandom or ServerRandom field of length len. Returns 0
Inital import. Initial fork from f2d678e6e89b6508147086610e985d4e8416e867 (1.0.2 beta). (This change contains substantial changes from the original and effectively starts a new history.)
2014-06-20 20:00:00 +01:00
* on failure, 1 on success. */
int ssl_fill_hello_random(SSL *s, int server, unsigned char *result, int len)
{
int send_time = 0;
if (len < 4)
return 0;
if (server)
send_time = (s->mode & SSL_MODE_SEND_SERVERHELLO_TIME) != 0;
else
send_time = (s->mode & SSL_MODE_SEND_CLIENTHELLO_TIME) != 0;
if (send_time)
{
unsigned long Time = (unsigned long)time(NULL);
unsigned char *p = result;
l2n(Time, p);
Remove SSL_set_session_secret_cb (EAP-FAST) This is only used for EAP-FAST which we apparently don't need to support. Remove it outright. We broke it in 9eaeef81fa2d4fd6246dc02b6203fa936a5eaf67 by failing to account for session misses. If this changes and we need it later, we can resurrect it. Preferably implemented differently: the current implementation is bolted badly onto the handshake. Ideally use the supplied callbacks to fabricate an appropriate SSL_SESSION and resume that with as much of the normal session ticket flow as possible. The one difference is that EAP-FAST seems to require the probing mechanism for session tickets rather than the sane session ID echoing version. We can reimplement that by asking the record layer to probe ahead for one byte. Change-Id: I38304953cc36b2020611556a91e8ac091691edac Reviewed-on: https://boringssl-review.googlesource.com/2360 Reviewed-by: Adam Langley <agl@google.com>
2014-11-20 19:54:14 +00:00
return RAND_bytes(p, len-4);
Inital import. Initial fork from f2d678e6e89b6508147086610e985d4e8416e867 (1.0.2 beta). (This change contains substantial changes from the original and effectively starts a new history.)
2014-06-20 20:00:00 +01:00
}
else
Remove SSL_set_session_secret_cb (EAP-FAST) This is only used for EAP-FAST which we apparently don't need to support. Remove it outright. We broke it in 9eaeef81fa2d4fd6246dc02b6203fa936a5eaf67 by failing to account for session misses. If this changes and we need it later, we can resurrect it. Preferably implemented differently: the current implementation is bolted badly onto the handshake. Ideally use the supplied callbacks to fabricate an appropriate SSL_SESSION and resume that with as much of the normal session ticket flow as possible. The one difference is that EAP-FAST seems to require the probing mechanism for session tickets rather than the sane session ID echoing version. We can reimplement that by asking the record layer to probe ahead for one byte. Change-Id: I38304953cc36b2020611556a91e8ac091691edac Reviewed-on: https://boringssl-review.googlesource.com/2360 Reviewed-by: Adam Langley <agl@google.com>
2014-11-20 19:54:14 +00:00
return RAND_bytes(result, len);
Inital import. Initial fork from f2d678e6e89b6508147086610e985d4e8416e867 (1.0.2 beta). (This change contains substantial changes from the original and effectively starts a new history.)
2014-06-20 20:00:00 +01:00
}
static int ssl23_client_hello(SSL *s)
{
unsigned char *buf;
unsigned char *p,*d;
Remove support for sending V2ClientHello. Accepting them as a server is still necessary, but this code is unreachable. Without SSLv2 support, none of the cipher suites are SSLv2, so ssl23_no_ssl2_ciphers always returns true and we send a V3ClientHello. Change-Id: I09030f2c6e375660453c74e4f094d95e9908c3e1 Reviewed-on: https://boringssl-review.googlesource.com/1258 Reviewed-by: Adam Langley <agl@google.com>
2014-07-20 17:01:32 +01:00
int i;
Inital import. Initial fork from f2d678e6e89b6508147086610e985d4e8416e867 (1.0.2 beta). (This change contains substantial changes from the original and effectively starts a new history.)
2014-06-20 20:00:00 +01:00
unsigned long l;
Factor out the client max-version logic into a helper function. Replace the comment with a clearer one and reimplement it much more tidily. The mask thing was more complicated than was needed. This slightly changes behavior on the DTLS_ANY_VERSION side in that, if only one method is enabled, we no longer short-circuit to the version-locked method early. This "optimization" seems unnecessary. Change-Id: I571c8b60ed16bd4357c67d65df0dd1ef9cc5eb57 Reviewed-on: https://boringssl-review.googlesource.com/2451 Reviewed-by: Adam Langley <agl@google.com>
2014-12-01 06:27:42 +00:00
uint16_t version;
uint8_t version_major, version_minor;
Inital import. Initial fork from f2d678e6e89b6508147086610e985d4e8416e867 (1.0.2 beta). (This change contains substantial changes from the original and effectively starts a new history.)
2014-06-20 20:00:00 +01:00
int ret;
Factor out the client max-version logic into a helper function. Replace the comment with a clearer one and reimplement it much more tidily. The mask thing was more complicated than was needed. This slightly changes behavior on the DTLS_ANY_VERSION side in that, if only one method is enabled, we no longer short-circuit to the version-locked method early. This "optimization" seems unnecessary. Change-Id: I571c8b60ed16bd4357c67d65df0dd1ef9cc5eb57 Reviewed-on: https://boringssl-review.googlesource.com/2451 Reviewed-by: Adam Langley <agl@google.com>
2014-12-01 06:27:42 +00:00
version = ssl3_get_max_client_version(s);
if (version == 0)
{
OPENSSL_PUT_ERROR(SSL, ssl23_client_hello, SSL_R_WRONG_SSL_VERSION);
return -1;
}
Inital import. Initial fork from f2d678e6e89b6508147086610e985d4e8416e867 (1.0.2 beta). (This change contains substantial changes from the original and effectively starts a new history.)
2014-06-20 20:00:00 +01:00
buf=(unsigned char *)s->init_buf->data;
if (s->state == SSL23_ST_CW_CLNT_HELLO_A)
{
Remove method swap in SSL_set_session. This is a bit of cleanup that probably should have been done at the same time as 30ddb434bfb845356fbacb6b2bd51f8814c7043c. For now, version negotiation is implemented with a method swap. It also performs this swap on SSL_set_session, but this was neutered in 30ddb434bfb845356fbacb6b2bd51f8814c7043c. Rather than hackishly neuter it, remove it outright. In addition, remove SSL_set_ssl_method. Now all method swaps are internal: SSLv23_method switch to a version-specific method and SSL_clear undoing it. Note that this does change behavior: if an SSL* is created with one version-specific method and we SSL_set_session to a session from a /different/ version, we would switch to the /other/ version-specific method. This is extremely confusing, so it's unlikely anyone was actually expecting it. Version-specific methods in general don't work well. Change-Id: I72a5c1f321ca9aeb1b52ebe0317072950ba25092 Reviewed-on: https://boringssl-review.googlesource.com/2390 Reviewed-by: Adam Langley <agl@google.com>
2014-11-22 19:32:53 +00:00
/* If the configured session was created at a version
* higher than our maximum version, drop it. */
if (s->session &&
(s->session->ssl_version > version ||
Handle session resumption in SSLv23_client_method. This fixes version mismatches on resumption without rewriting the entirety of OpenSSL's version negotiation logic. (Which still badly needs to happen.) BUG=chromium:417134 Change-Id: Ifa0c5dd2145e37fcd39eec25dfb3561ddb87c9f0 Reviewed-on: https://boringssl-review.googlesource.com/1823 Reviewed-by: Adam Langley <agl@google.com>
2014-09-24 22:56:34 +01:00
s->session->session_id_length == 0 ||
Remove method swap in SSL_set_session. This is a bit of cleanup that probably should have been done at the same time as 30ddb434bfb845356fbacb6b2bd51f8814c7043c. For now, version negotiation is implemented with a method swap. It also performs this swap on SSL_set_session, but this was neutered in 30ddb434bfb845356fbacb6b2bd51f8814c7043c. Rather than hackishly neuter it, remove it outright. In addition, remove SSL_set_ssl_method. Now all method swaps are internal: SSLv23_method switch to a version-specific method and SSL_clear undoing it. Note that this does change behavior: if an SSL* is created with one version-specific method and we SSL_set_session to a session from a /different/ version, we would switch to the /other/ version-specific method. This is extremely confusing, so it's unlikely anyone was actually expecting it. Version-specific methods in general don't work well. Change-Id: I72a5c1f321ca9aeb1b52ebe0317072950ba25092 Reviewed-on: https://boringssl-review.googlesource.com/2390 Reviewed-by: Adam Langley <agl@google.com>
2014-11-22 19:32:53 +00:00
s->session->not_resumable))
{
SSL_set_session(s, NULL);
Inital import. Initial fork from f2d678e6e89b6508147086610e985d4e8416e867 (1.0.2 beta). (This change contains substantial changes from the original and effectively starts a new history.)
2014-06-20 20:00:00 +01:00
}
p=s->s3->client_random;
if (ssl_fill_hello_random(s, 0, p, SSL3_RANDOM_SIZE) <= 0)
return -1;
if (version == TLS1_2_VERSION)
{
version_major = TLS1_2_VERSION_MAJOR;
version_minor = TLS1_2_VERSION_MINOR;
}
else if (version == TLS1_1_VERSION)
{
version_major = TLS1_1_VERSION_MAJOR;
version_minor = TLS1_1_VERSION_MINOR;
}
else if (version == TLS1_VERSION)
{
version_major = TLS1_VERSION_MAJOR;
version_minor = TLS1_VERSION_MINOR;
}
else if (version == SSL3_VERSION)
{
version_major = SSL3_VERSION_MAJOR;
version_minor = SSL3_VERSION_MINOR;
}
else
{
OPENSSL_PUT_ERROR(SSL, ssl23_client_hello, SSL_R_NO_PROTOCOLS_AVAILABLE);
return(-1);
}
s->client_version = version;
Remove support for sending V2ClientHello. Accepting them as a server is still necessary, but this code is unreachable. Without SSLv2 support, none of the cipher suites are SSLv2, so ssl23_no_ssl2_ciphers always returns true and we send a V3ClientHello. Change-Id: I09030f2c6e375660453c74e4f094d95e9908c3e1 Reviewed-on: https://boringssl-review.googlesource.com/1258 Reviewed-by: Adam Langley <agl@google.com>
2014-07-20 17:01:32 +01:00
/* create Client Hello in SSL 3.0/TLS 1.0 format */
Inital import. Initial fork from f2d678e6e89b6508147086610e985d4e8416e867 (1.0.2 beta). (This change contains substantial changes from the original and effectively starts a new history.)
2014-06-20 20:00:00 +01:00
Remove support for sending V2ClientHello. Accepting them as a server is still necessary, but this code is unreachable. Without SSLv2 support, none of the cipher suites are SSLv2, so ssl23_no_ssl2_ciphers always returns true and we send a V3ClientHello. Change-Id: I09030f2c6e375660453c74e4f094d95e9908c3e1 Reviewed-on: https://boringssl-review.googlesource.com/1258 Reviewed-by: Adam Langley <agl@google.com>
2014-07-20 17:01:32 +01:00
/* do the record header (5 bytes) and handshake message
* header (4 bytes) last. Note: the final argument to
* ssl_add_clienthello_tlsext below depends on the size
* of this prefix. */
d = p = &(buf[9]);
Inital import. Initial fork from f2d678e6e89b6508147086610e985d4e8416e867 (1.0.2 beta). (This change contains substantial changes from the original and effectively starts a new history.)
2014-06-20 20:00:00 +01:00
Remove support for sending V2ClientHello. Accepting them as a server is still necessary, but this code is unreachable. Without SSLv2 support, none of the cipher suites are SSLv2, so ssl23_no_ssl2_ciphers always returns true and we send a V3ClientHello. Change-Id: I09030f2c6e375660453c74e4f094d95e9908c3e1 Reviewed-on: https://boringssl-review.googlesource.com/1258 Reviewed-by: Adam Langley <agl@google.com>
2014-07-20 17:01:32 +01:00
*(p++) = version_major;
*(p++) = version_minor;
Inital import. Initial fork from f2d678e6e89b6508147086610e985d4e8416e867 (1.0.2 beta). (This change contains substantial changes from the original and effectively starts a new history.)
2014-06-20 20:00:00 +01:00
Remove support for sending V2ClientHello. Accepting them as a server is still necessary, but this code is unreachable. Without SSLv2 support, none of the cipher suites are SSLv2, so ssl23_no_ssl2_ciphers always returns true and we send a V3ClientHello. Change-Id: I09030f2c6e375660453c74e4f094d95e9908c3e1 Reviewed-on: https://boringssl-review.googlesource.com/1258 Reviewed-by: Adam Langley <agl@google.com>
2014-07-20 17:01:32 +01:00
/* Random stuff */
memcpy(p, s->s3->client_random, SSL3_RANDOM_SIZE);
p += SSL3_RANDOM_SIZE;
Inital import. Initial fork from f2d678e6e89b6508147086610e985d4e8416e867 (1.0.2 beta). (This change contains substantial changes from the original and effectively starts a new history.)
2014-06-20 20:00:00 +01:00
Handle session resumption in SSLv23_client_method. This fixes version mismatches on resumption without rewriting the entirety of OpenSSL's version negotiation logic. (Which still badly needs to happen.) BUG=chromium:417134 Change-Id: Ifa0c5dd2145e37fcd39eec25dfb3561ddb87c9f0 Reviewed-on: https://boringssl-review.googlesource.com/1823 Reviewed-by: Adam Langley <agl@google.com>
2014-09-24 22:56:34 +01:00
/* Session ID */
if (s->new_session || s->session == NULL)
i=0;
else
i=s->session->session_id_length;
*(p++)=i;
if (i != 0)
{
if (i > (int)sizeof(s->session->session_id))
{
OPENSSL_PUT_ERROR(SSL, ssl23_client_hello, ERR_R_INTERNAL_ERROR);
return -1;
}
memcpy(p,s->session->session_id,i);
p+=i;
}
Inital import. Initial fork from f2d678e6e89b6508147086610e985d4e8416e867 (1.0.2 beta). (This change contains substantial changes from the original and effectively starts a new history.)
2014-06-20 20:00:00 +01:00
Remove support for sending V2ClientHello. Accepting them as a server is still necessary, but this code is unreachable. Without SSLv2 support, none of the cipher suites are SSLv2, so ssl23_no_ssl2_ciphers always returns true and we send a V3ClientHello. Change-Id: I09030f2c6e375660453c74e4f094d95e9908c3e1 Reviewed-on: https://boringssl-review.googlesource.com/1258 Reviewed-by: Adam Langley <agl@google.com>
2014-07-20 17:01:32 +01:00
/* Ciphers supported (using SSL 3.0/TLS 1.0 format) */
Remove get_cipher_by_char and put_cipher_by_char. Without SSLv2, all cipher suite values are 2 bytes. Represent them as a uint16_t and make all functions pass those around rather than pointers. This removes SSL_CIPHER_find as it's unused. Change-Id: Iea0b75abee4352a8333a4b8e39a161430ae55ea6 Reviewed-on: https://boringssl-review.googlesource.com/1259 Reviewed-by: Adam Langley <agl@google.com>
2014-07-20 18:30:15 +01:00
i = ssl_cipher_list_to_bytes(s, SSL_get_ciphers(s), &p[2]);
Remove support for sending V2ClientHello. Accepting them as a server is still necessary, but this code is unreachable. Without SSLv2 support, none of the cipher suites are SSLv2, so ssl23_no_ssl2_ciphers always returns true and we send a V3ClientHello. Change-Id: I09030f2c6e375660453c74e4f094d95e9908c3e1 Reviewed-on: https://boringssl-review.googlesource.com/1258 Reviewed-by: Adam Langley <agl@google.com>
2014-07-20 17:01:32 +01:00
if (i == 0)
{
OPENSSL_PUT_ERROR(SSL, ssl23_client_hello, SSL_R_NO_CIPHERS_AVAILABLE);
return -1;
}
s2n(i,p);
p+=i;
Inital import. Initial fork from f2d678e6e89b6508147086610e985d4e8416e867 (1.0.2 beta). (This change contains substantial changes from the original and effectively starts a new history.)
2014-06-20 20:00:00 +01:00
Remove support for sending V2ClientHello. Accepting them as a server is still necessary, but this code is unreachable. Without SSLv2 support, none of the cipher suites are SSLv2, so ssl23_no_ssl2_ciphers always returns true and we send a V3ClientHello. Change-Id: I09030f2c6e375660453c74e4f094d95e9908c3e1 Reviewed-on: https://boringssl-review.googlesource.com/1258 Reviewed-by: Adam Langley <agl@google.com>
2014-07-20 17:01:32 +01:00
/* COMPRESSION */
*(p++)=1;
*(p++)=0; /* Add the NULL method */
Inital import. Initial fork from f2d678e6e89b6508147086610e985d4e8416e867 (1.0.2 beta). (This change contains substantial changes from the original and effectively starts a new history.)
2014-06-20 20:00:00 +01:00
Remove support for sending V2ClientHello. Accepting them as a server is still necessary, but this code is unreachable. Without SSLv2 support, none of the cipher suites are SSLv2, so ssl23_no_ssl2_ciphers always returns true and we send a V3ClientHello. Change-Id: I09030f2c6e375660453c74e4f094d95e9908c3e1 Reviewed-on: https://boringssl-review.googlesource.com/1258 Reviewed-by: Adam Langley <agl@google.com>
2014-07-20 17:01:32 +01:00
/* TLS extensions*/
if (ssl_prepare_clienthello_tlsext(s) <= 0)
{
OPENSSL_PUT_ERROR(SSL, ssl23_client_hello, SSL_R_CLIENTHELLO_TLSEXT);
return -1;
}
TLS extension limit check fixes. Fix limit checks in ssl_add_clienthello_tlsext and ssl_add_serverhello_tlsext. Some of the limit checks reference p rather than ret. p is the original buffer position, not the current one. Fix those and rename p to orig so it's clearer.
2014-06-20 20:00:00 +01:00
Remove support for sending V2ClientHello. Accepting them as a server is still necessary, but this code is unreachable. Without SSLv2 support, none of the cipher suites are SSLv2, so ssl23_no_ssl2_ciphers always returns true and we send a V3ClientHello. Change-Id: I09030f2c6e375660453c74e4f094d95e9908c3e1 Reviewed-on: https://boringssl-review.googlesource.com/1258 Reviewed-by: Adam Langley <agl@google.com>
2014-07-20 17:01:32 +01:00
/* The buffer includes the 5 byte record header, so
* subtract it to compute hlen for
* ssl_add_clienthello_tlsext. */
if ((p = ssl_add_clienthello_tlsext(s, p, buf+SSL3_RT_MAX_PLAIN_LENGTH, p-buf-5)) == NULL)
{
OPENSSL_PUT_ERROR(SSL, ssl23_client_hello, ERR_R_INTERNAL_ERROR);
return -1;
}
Inital import. Initial fork from f2d678e6e89b6508147086610e985d4e8416e867 (1.0.2 beta). (This change contains substantial changes from the original and effectively starts a new history.)
2014-06-20 20:00:00 +01:00
Remove support for sending V2ClientHello. Accepting them as a server is still necessary, but this code is unreachable. Without SSLv2 support, none of the cipher suites are SSLv2, so ssl23_no_ssl2_ciphers always returns true and we send a V3ClientHello. Change-Id: I09030f2c6e375660453c74e4f094d95e9908c3e1 Reviewed-on: https://boringssl-review.googlesource.com/1258 Reviewed-by: Adam Langley <agl@google.com>
2014-07-20 17:01:32 +01:00
l = p-d;
Inital import. Initial fork from f2d678e6e89b6508147086610e985d4e8416e867 (1.0.2 beta). (This change contains substantial changes from the original and effectively starts a new history.)
2014-06-20 20:00:00 +01:00
Remove support for sending V2ClientHello. Accepting them as a server is still necessary, but this code is unreachable. Without SSLv2 support, none of the cipher suites are SSLv2, so ssl23_no_ssl2_ciphers always returns true and we send a V3ClientHello. Change-Id: I09030f2c6e375660453c74e4f094d95e9908c3e1 Reviewed-on: https://boringssl-review.googlesource.com/1258 Reviewed-by: Adam Langley <agl@google.com>
2014-07-20 17:01:32 +01:00
/* fill in 4-byte handshake header */
d=&(buf[5]);
*(d++)=SSL3_MT_CLIENT_HELLO;
l2n3(l,d);
Inital import. Initial fork from f2d678e6e89b6508147086610e985d4e8416e867 (1.0.2 beta). (This change contains substantial changes from the original and effectively starts a new history.)
2014-06-20 20:00:00 +01:00
Remove support for sending V2ClientHello. Accepting them as a server is still necessary, but this code is unreachable. Without SSLv2 support, none of the cipher suites are SSLv2, so ssl23_no_ssl2_ciphers always returns true and we send a V3ClientHello. Change-Id: I09030f2c6e375660453c74e4f094d95e9908c3e1 Reviewed-on: https://boringssl-review.googlesource.com/1258 Reviewed-by: Adam Langley <agl@google.com>
2014-07-20 17:01:32 +01:00
l += 4;
Inital import. Initial fork from f2d678e6e89b6508147086610e985d4e8416e867 (1.0.2 beta). (This change contains substantial changes from the original and effectively starts a new history.)
2014-06-20 20:00:00 +01:00
Remove support for sending V2ClientHello. Accepting them as a server is still necessary, but this code is unreachable. Without SSLv2 support, none of the cipher suites are SSLv2, so ssl23_no_ssl2_ciphers always returns true and we send a V3ClientHello. Change-Id: I09030f2c6e375660453c74e4f094d95e9908c3e1 Reviewed-on: https://boringssl-review.googlesource.com/1258 Reviewed-by: Adam Langley <agl@google.com>
2014-07-20 17:01:32 +01:00
if (l > SSL3_RT_MAX_PLAIN_LENGTH)
{
OPENSSL_PUT_ERROR(SSL, ssl23_client_hello, ERR_R_INTERNAL_ERROR);
return -1;
Inital import. Initial fork from f2d678e6e89b6508147086610e985d4e8416e867 (1.0.2 beta). (This change contains substantial changes from the original and effectively starts a new history.)
2014-06-20 20:00:00 +01:00
}
Remove support for sending V2ClientHello. Accepting them as a server is still necessary, but this code is unreachable. Without SSLv2 support, none of the cipher suites are SSLv2, so ssl23_no_ssl2_ciphers always returns true and we send a V3ClientHello. Change-Id: I09030f2c6e375660453c74e4f094d95e9908c3e1 Reviewed-on: https://boringssl-review.googlesource.com/1258 Reviewed-by: Adam Langley <agl@google.com>
2014-07-20 17:01:32 +01:00
/* fill in 5-byte record header */
d=buf;
*(d++) = SSL3_RT_HANDSHAKE;
*(d++) = version_major;
/* Some servers hang if we use long client hellos
* and a record number > TLS 1.0.
*/
if (TLS1_get_client_version(s) > TLS1_VERSION)
*(d++) = 1;
else
*(d++) = version_minor;
s2n((int)l,d);
/* number of bytes to write */
s->init_num=p-buf;
s->init_off=0;
ssl3_finish_mac(s,&(buf[5]), s->init_num - 5);
Inital import. Initial fork from f2d678e6e89b6508147086610e985d4e8416e867 (1.0.2 beta). (This change contains substantial changes from the original and effectively starts a new history.)
2014-06-20 20:00:00 +01:00
s->state=SSL23_ST_CW_CLNT_HELLO_B;
s->init_off=0;
}
/* SSL3_ST_CW_CLNT_HELLO_B */
ret = ssl23_write_bytes(s);
if ((ret >= 2) && s->msg_callback)
{
/* Client Hello has been sent; tell msg_callback */
Remove support for sending V2ClientHello. Accepting them as a server is still necessary, but this code is unreachable. Without SSLv2 support, none of the cipher suites are SSLv2, so ssl23_no_ssl2_ciphers always returns true and we send a V3ClientHello. Change-Id: I09030f2c6e375660453c74e4f094d95e9908c3e1 Reviewed-on: https://boringssl-review.googlesource.com/1258 Reviewed-by: Adam Langley <agl@google.com>
2014-07-20 17:01:32 +01:00
s->msg_callback(1, version, SSL3_RT_HEADER, s->init_buf->data, 5, s, s->msg_callback_arg);
s->msg_callback(1, version, SSL3_RT_HANDSHAKE, s->init_buf->data+5, ret-5, s, s->msg_callback_arg);
Inital import. Initial fork from f2d678e6e89b6508147086610e985d4e8416e867 (1.0.2 beta). (This change contains substantial changes from the original and effectively starts a new history.)
2014-06-20 20:00:00 +01:00
}
return ret;
}
static int ssl23_get_server_hello(SSL *s)
{
char buf[8];
unsigned char *p;
int i;
int n;
n=ssl23_read_bytes(s,7);
if (n != 7) return(n);
p=s->packet;
memcpy(buf,p,n);
if ((p[0] & 0x80) && (p[2] == SSL2_MT_SERVER_HELLO) &&
(p[5] == 0x00) && (p[6] == 0x02))
{
OPENSSL_PUT_ERROR(SSL, ssl23_get_server_hello, SSL_R_UNSUPPORTED_PROTOCOL);
goto err;
}
else if (p[1] == SSL3_VERSION_MAJOR &&
p[2] <= TLS1_2_VERSION_MINOR &&
((p[0] == SSL3_RT_HANDSHAKE && p[5] == SSL3_MT_SERVER_HELLO) ||
(p[0] == SSL3_RT_ALERT && p[3] == 0 && p[4] == 2)))
{
/* we have sslv3 or tls1 (server hello or alert) */
if ((p[2] == SSL3_VERSION_MINOR) &&
!(s->options & SSL_OP_NO_SSLv3))
{
s->version=SSL3_VERSION;
s->method=SSLv3_client_method();
}
else if ((p[2] == TLS1_VERSION_MINOR) &&
!(s->options & SSL_OP_NO_TLSv1))
{
s->version=TLS1_VERSION;
s->method=TLSv1_client_method();
}
else if ((p[2] == TLS1_1_VERSION_MINOR) &&
!(s->options & SSL_OP_NO_TLSv1_1))
{
s->version=TLS1_1_VERSION;
s->method=TLSv1_1_client_method();
}
else if ((p[2] == TLS1_2_VERSION_MINOR) &&
!(s->options & SSL_OP_NO_TLSv1_2))
{
s->version=TLS1_2_VERSION;
s->method=TLSv1_2_client_method();
}
else
{
OPENSSL_PUT_ERROR(SSL, ssl23_get_server_hello, SSL_R_UNSUPPORTED_PROTOCOL);
goto err;
}
if (p[0] == SSL3_RT_ALERT && p[5] != SSL3_AL_WARNING)
{
/* fatal alert */
void (*cb)(const SSL *ssl,int type,int val)=NULL;
int j;
if (s->info_callback != NULL)
cb=s->info_callback;
else if (s->ctx->info_callback != NULL)
cb=s->ctx->info_callback;
i=p[5];
if (cb != NULL)
{
j=(i<<8)|p[6];
cb(s,SSL_CB_READ_ALERT,j);
}
if (s->msg_callback)
{
s->msg_callback(0, s->version, SSL3_RT_HEADER, p, 5, s, s->msg_callback_arg);
s->msg_callback(0, s->version, SSL3_RT_ALERT, p+5, 2, s, s->msg_callback_arg);
}
s->rwstate=SSL_NOTHING;
OPENSSL_PUT_ERROR(SSL, ssl23_get_server_hello, SSL_AD_REASON_OFFSET + p[6]);
goto err;
}
if (!ssl_init_wbio_buffer(s,1)) goto err;
/* we are in this state */
s->state=SSL3_ST_CR_SRVR_HELLO_A;
/* put the 7 bytes we have read into the input buffer
* for SSLv3 */
s->rstate=SSL_ST_READ_HEADER;
s->packet_length=n;
if (s->s3->rbuf.buf == NULL)
if (!ssl3_setup_read_buffer(s))
goto err;
s->packet= &(s->s3->rbuf.buf[0]);
memcpy(s->packet,buf,n);
s->s3->rbuf.left=n;
s->s3->rbuf.offset=0;
s->handshake_func=s->method->ssl_connect;
}
else
{
OPENSSL_PUT_ERROR(SSL, ssl23_get_server_hello, SSL_R_UNKNOWN_PROTOCOL);
goto err;
}
s->init_num=0;
return(SSL_connect(s));
err:
return(-1);
}
Reference in New Issue Copy Permalink