int tls_parse_stoc_ec_pt_formats(SSL *s, PACKET *pkt, unsigned int context,
X509 *x, size_t chainidx, int *al)
{
unsigned int ecpointformats_len;
PACKET ecptformatlist;
if (!PACKET_as_length_prefixed_1(pkt, &ecptformatlist)) {
*al = SSL_AD_DECODE_ERROR;
return 0;
}
if (!s->hit) {
ecpointformats_len = PACKET_remaining(&ecptformatlist);
s->session->ext.ecpointformats_len = 0;
OPENSSL_free(s->session->ext.ecpointformats);
s->session->ext.ecpointformats = OPENSSL_malloc(ecpointformats_len);
if (s->session->ext.ecpointformats == NULL) {
*al = SSL_AD_INTERNAL_ERROR;
return 0;
}
s->session->ext.ecpointformats_len = ecpointformats_len;
if (!PACKET_copy_bytes(&ecptformatlist,
s->session->ext.ecpointformats,
ecpointformats_len)) {
*al = SSL_AD_INTERNAL_ERROR;
return 0;
}
}
return 1;
}
int tls_parse_stoc_sct(SSL *s, PACKET *pkt, unsigned int context, X509 *x,
size_t chainidx, int *al)
{
/*
* Only take it if we asked for it - i.e if there is no CT validation
* callback set, then a custom extension MAY be processing it, so we
* need to let control continue to flow to that.
*/
if (s->ct_validation_callback != NULL) {
size_t size = PACKET_remaining(pkt);
/* Simply copy it off for later processing */
OPENSSL_free(s->ext.scts);
s->ext.scts = NULL;
s->ext.scts_len = size;
if (size > 0) {
s->ext.scts = OPENSSL_malloc(size);
if (s->ext.scts == NULL
|| !PACKET_copy_bytes(pkt, s->ext.scts, size)) {
*al = SSL_AD_INTERNAL_ERROR;
return 0;
}
}
} else {
if (custom_ext_parse(s, 0, TLSEXT_TYPE_signed_certificate_timestamp,
PACKET_data(pkt), PACKET_remaining(pkt), al) <= 0)
return 0;
}
return 1;
}
int tls_parse_stoc_alpn(SSL *s, PACKET *pkt, int *al)
{
size_t len;
/* We must have requested it. */
if (!s->s3->alpn_sent) {
*al = SSL_AD_UNSUPPORTED_EXTENSION;
return 0;
}
/*-
* The extension data consists of:
* uint16 list_length
* uint8 proto_length;
* uint8 proto[proto_length];
*/
if (!PACKET_get_net_2_len(pkt, &len)
|| PACKET_remaining(pkt) != len || !PACKET_get_1_len(pkt, &len)
|| PACKET_remaining(pkt) != len) {
*al = SSL_AD_DECODE_ERROR;
return 0;
}
OPENSSL_free(s->s3->alpn_selected);
s->s3->alpn_selected = OPENSSL_malloc(len);
if (s->s3->alpn_selected == NULL) {
*al = SSL_AD_INTERNAL_ERROR;
return 0;
}
if (!PACKET_copy_bytes(pkt, s->s3->alpn_selected, len)) {
*al = SSL_AD_DECODE_ERROR;
return 0;
}
s->s3->alpn_selected_len = len;
return 1;
}
int tls_parse_stoc_ec_pt_formats(SSL *s, PACKET *pkt, int *al)
{
unsigned int ecpointformatlist_length;
PACKET ecptformatlist;
if (!PACKET_as_length_prefixed_1(pkt, &ecptformatlist)) {
*al = SSL_AD_DECODE_ERROR;
return 0;
}
if (!s->hit) {
ecpointformatlist_length = PACKET_remaining(&ecptformatlist);
s->session->tlsext_ecpointformatlist_length = 0;
OPENSSL_free(s->session->tlsext_ecpointformatlist);
s->session->tlsext_ecpointformatlist =
OPENSSL_malloc(ecpointformatlist_length);
if (s->session->tlsext_ecpointformatlist == NULL) {
*al = SSL_AD_INTERNAL_ERROR;
return 0;
}
s->session->tlsext_ecpointformatlist_length = ecpointformatlist_length;
if (!PACKET_copy_bytes(&ecptformatlist,
s->session->tlsext_ecpointformatlist,
ecpointformatlist_length)) {
*al = SSL_AD_INTERNAL_ERROR;
return 0;
}
}
return 1;
}
static int test_PACKET_copy_bytes(PACKET *pkt, size_t start)
{
unsigned char bytes[4];
if ( !PACKET_goto_bookmark(pkt, start)
|| !PACKET_copy_bytes(pkt, bytes, 4)
|| bytes[0] != 2 || bytes[1] != 4
|| bytes[2] != 6 || bytes[3] != 8
|| PACKET_remaining(pkt) != BUF_LEN - 4
|| !PACKET_forward(pkt, BUF_LEN - 8)
|| !PACKET_copy_bytes(pkt, bytes, 4)
|| bytes[0] != 0xf8 || bytes[1] != 0xfa
|| bytes[2] != 0xfc || bytes[3] != 0xfe
|| PACKET_remaining(pkt)) {
fprintf(stderr, "test_PACKET_copy_bytes() failed\n");
return 0;
}
return 1;
}
static int test_PACKET_copy_bytes(unsigned char buf[BUF_LEN])
{
unsigned char bytes[4];
PACKET pkt;
if ( !PACKET_buf_init(&pkt, buf, BUF_LEN)
|| !PACKET_copy_bytes(&pkt, bytes, 4)
|| bytes[0] != 2 || bytes[1] != 4
|| bytes[2] != 6 || bytes[3] != 8
|| PACKET_remaining(&pkt) != BUF_LEN - 4
|| !PACKET_forward(&pkt, BUF_LEN - 8)
|| !PACKET_copy_bytes(&pkt, bytes, 4)
|| bytes[0] != 0xf8 || bytes[1] != 0xfa
|| bytes[2] != 0xfc || bytes[3] != 0xfe
|| PACKET_remaining(&pkt)) {
fprintf(stderr, "test_PACKET_copy_bytes() failed\n");
return 0;
}
return 1;
}
static int test_PACKET_copy_bytes()
{
unsigned char bytes[4];
PACKET pkt;
if (!TEST_true(PACKET_buf_init(&pkt, smbuf, BUF_LEN))
|| !TEST_true(PACKET_copy_bytes(&pkt, bytes, 4))
|| !TEST_char_eq(bytes[0], 2)
|| !TEST_char_eq(bytes[1], 4)
|| !TEST_char_eq(bytes[2], 6)
|| !TEST_char_eq(bytes[3], 8)
|| !TEST_size_t_eq(PACKET_remaining(&pkt), BUF_LEN - 4)
|| !TEST_true(PACKET_forward(&pkt, BUF_LEN - 8))
|| !TEST_true(PACKET_copy_bytes(&pkt, bytes, 4))
|| !TEST_uchar_eq(bytes[0], 0xf8)
|| !TEST_uchar_eq(bytes[1], 0xfa)
|| !TEST_uchar_eq(bytes[2], 0xfc)
|| !TEST_uchar_eq(bytes[3], 0xfe)
|| !TEST_false(PACKET_remaining(&pkt)))
return 0;
return 1;
}
int DTLSv1_listen(SSL *s, BIO_ADDR *client)
{
int next, n, ret = 0, clearpkt = 0;
unsigned char cookie[DTLS1_COOKIE_LENGTH];
unsigned char seq[SEQ_NUM_SIZE];
const unsigned char *data;
unsigned char *p, *buf;
unsigned long reclen, fragoff, fraglen, msglen;
unsigned int rectype, versmajor, msgseq, msgtype, clientvers, cookielen;
BIO *rbio, *wbio;
BUF_MEM *bufm;
BIO_ADDR *tmpclient = NULL;
PACKET pkt, msgpkt, msgpayload, session, cookiepkt;
/* Ensure there is no state left over from a previous invocation */
if (!SSL_clear(s))
return -1;
ERR_clear_error();
rbio = SSL_get_rbio(s);
wbio = SSL_get_wbio(s);
if (!rbio || !wbio) {
SSLerr(SSL_F_DTLSV1_LISTEN, SSL_R_BIO_NOT_SET);
return -1;
}
/*
* We only peek at incoming ClientHello's until we're sure we are going to
* to respond with a HelloVerifyRequest. If its a ClientHello with a valid
* cookie then we leave it in the BIO for accept to handle.
*/
BIO_ctrl(SSL_get_rbio(s), BIO_CTRL_DGRAM_SET_PEEK_MODE, 1, NULL);
/*
* Note: This check deliberately excludes DTLS1_BAD_VER because that version
* requires the MAC to be calculated *including* the first ClientHello
* (without the cookie). Since DTLSv1_listen is stateless that cannot be
* supported. DTLS1_BAD_VER must use cookies in a stateful manner (e.g. via
* SSL_accept)
*/
if ((s->version & 0xff00) != (DTLS1_VERSION & 0xff00)) {
SSLerr(SSL_F_DTLSV1_LISTEN, SSL_R_UNSUPPORTED_SSL_VERSION);
return -1;
}
if (s->init_buf == NULL) {
if ((bufm = BUF_MEM_new()) == NULL) {
SSLerr(SSL_F_DTLSV1_LISTEN, ERR_R_MALLOC_FAILURE);
return -1;
}
if (!BUF_MEM_grow(bufm, SSL3_RT_MAX_PLAIN_LENGTH)) {
BUF_MEM_free(bufm);
SSLerr(SSL_F_DTLSV1_LISTEN, ERR_R_MALLOC_FAILURE);
return -1;
}
s->init_buf = bufm;
}
buf = (unsigned char *)s->init_buf->data;
do {
/* Get a packet */
clear_sys_error();
/*
* Technically a ClientHello could be SSL3_RT_MAX_PLAIN_LENGTH
* + DTLS1_RT_HEADER_LENGTH bytes long. Normally init_buf does not store
* the record header as well, but we do here. We've set up init_buf to
* be the standard size for simplicity. In practice we shouldn't ever
* receive a ClientHello as long as this. If we do it will get dropped
* in the record length check below.
*/
n = BIO_read(rbio, buf, SSL3_RT_MAX_PLAIN_LENGTH);
if (n <= 0) {
if (BIO_should_retry(rbio)) {
/* Non-blocking IO */
goto end;
}
return -1;
}
/* If we hit any problems we need to clear this packet from the BIO */
clearpkt = 1;
if (!PACKET_buf_init(&pkt, buf, n)) {
SSLerr(SSL_F_DTLSV1_LISTEN, ERR_R_INTERNAL_ERROR);
return -1;
}
/*
* Parse the received record. If there are any problems with it we just
* dump it - with no alert. RFC6347 says this "Unlike TLS, DTLS is
* resilient in the face of invalid records (e.g., invalid formatting,
* length, MAC, etc.). In general, invalid records SHOULD be silently
* discarded, thus preserving the association; however, an error MAY be
* logged for diagnostic purposes."
*/
/* this packet contained a partial record, dump it */
if (n < DTLS1_RT_HEADER_LENGTH) {
SSLerr(SSL_F_DTLSV1_LISTEN, SSL_R_RECORD_TOO_SMALL);
goto end;
}
if (s->msg_callback)
s->msg_callback(0, 0, SSL3_RT_HEADER, buf,
DTLS1_RT_HEADER_LENGTH, s, s->msg_callback_arg);
/* Get the record header */
if (!PACKET_get_1(&pkt, &rectype)
|| !PACKET_get_1(&pkt, &versmajor)) {
SSLerr(SSL_F_DTLSV1_LISTEN, SSL_R_LENGTH_MISMATCH);
goto end;
}
if (rectype != SSL3_RT_HANDSHAKE) {
SSLerr(SSL_F_DTLSV1_LISTEN, SSL_R_UNEXPECTED_MESSAGE);
goto end;
}
/*
* Check record version number. We only check that the major version is
* the same.
*/
if (versmajor != DTLS1_VERSION_MAJOR) {
SSLerr(SSL_F_DTLSV1_LISTEN, SSL_R_BAD_PROTOCOL_VERSION_NUMBER);
goto end;
}
if (!PACKET_forward(&pkt, 1)
/* Save the sequence number: 64 bits, with top 2 bytes = epoch */
|| !PACKET_copy_bytes(&pkt, seq, SEQ_NUM_SIZE)
|| !PACKET_get_length_prefixed_2(&pkt, &msgpkt)) {
SSLerr(SSL_F_DTLSV1_LISTEN, SSL_R_LENGTH_MISMATCH);
goto end;
}
/*
* We allow data remaining at the end of the packet because there could
* be a second record (but we ignore it)
*/
/* This is an initial ClientHello so the epoch has to be 0 */
if (seq[0] != 0 || seq[1] != 0) {
SSLerr(SSL_F_DTLSV1_LISTEN, SSL_R_UNEXPECTED_MESSAGE);
goto end;
}
/* Get a pointer to the raw message for the later callback */
data = PACKET_data(&msgpkt);
/* Finished processing the record header, now process the message */
if (!PACKET_get_1(&msgpkt, &msgtype)
|| !PACKET_get_net_3(&msgpkt, &msglen)
|| !PACKET_get_net_2(&msgpkt, &msgseq)
|| !PACKET_get_net_3(&msgpkt, &fragoff)
|| !PACKET_get_net_3(&msgpkt, &fraglen)
|| !PACKET_get_sub_packet(&msgpkt, &msgpayload, fraglen)
|| PACKET_remaining(&msgpkt) != 0) {
SSLerr(SSL_F_DTLSV1_LISTEN, SSL_R_LENGTH_MISMATCH);
goto end;
}
if (msgtype != SSL3_MT_CLIENT_HELLO) {
SSLerr(SSL_F_DTLSV1_LISTEN, SSL_R_UNEXPECTED_MESSAGE);
goto end;
}
/* Message sequence number can only be 0 or 1 */
if (msgseq > 2) {
SSLerr(SSL_F_DTLSV1_LISTEN, SSL_R_INVALID_SEQUENCE_NUMBER);
goto end;
}
/*
* We don't support fragment reassembly for ClientHellos whilst
* listening because that would require server side state (which is
* against the whole point of the ClientHello/HelloVerifyRequest
* mechanism). Instead we only look at the first ClientHello fragment
* and require that the cookie must be contained within it.
*/
if (fragoff != 0 || fraglen > msglen) {
/* Non initial ClientHello fragment (or bad fragment) */
SSLerr(SSL_F_DTLSV1_LISTEN, SSL_R_FRAGMENTED_CLIENT_HELLO);
goto end;
}
if (s->msg_callback)
s->msg_callback(0, s->version, SSL3_RT_HANDSHAKE, data,
fraglen + DTLS1_HM_HEADER_LENGTH, s,
s->msg_callback_arg);
if (!PACKET_get_net_2(&msgpayload, &clientvers)) {
SSLerr(SSL_F_DTLSV1_LISTEN, SSL_R_LENGTH_MISMATCH);
goto end;
}
/*
* Verify client version is supported
*/
if (DTLS_VERSION_LT(clientvers, (unsigned int)s->method->version) &&
s->method->version != DTLS_ANY_VERSION) {
SSLerr(SSL_F_DTLSV1_LISTEN, SSL_R_WRONG_VERSION_NUMBER);
goto end;
}
if (!PACKET_forward(&msgpayload, SSL3_RANDOM_SIZE)
|| !PACKET_get_length_prefixed_1(&msgpayload, &session)
|| !PACKET_get_length_prefixed_1(&msgpayload, &cookiepkt)) {
/*
* Could be malformed or the cookie does not fit within the initial
* ClientHello fragment. Either way we can't handle it.
*/
SSLerr(SSL_F_DTLSV1_LISTEN, SSL_R_LENGTH_MISMATCH);
goto end;
}
/*
* Check if we have a cookie or not. If not we need to send a
* HelloVerifyRequest.
*/
if (PACKET_remaining(&cookiepkt) == 0) {
next = LISTEN_SEND_VERIFY_REQUEST;
} else {
/*
* We have a cookie, so lets check it.
*/
if (s->ctx->app_verify_cookie_cb == NULL) {
SSLerr(SSL_F_DTLSV1_LISTEN, SSL_R_NO_VERIFY_COOKIE_CALLBACK);
/* This is fatal */
return -1;
}
if (s->ctx->app_verify_cookie_cb(s, PACKET_data(&cookiepkt),
PACKET_remaining(&cookiepkt)) ==
0) {
/*
* We treat invalid cookies in the same was as no cookie as
* per RFC6347
*/
next = LISTEN_SEND_VERIFY_REQUEST;
} else {
/* Cookie verification succeeded */
next = LISTEN_SUCCESS;
}
}
if (next == LISTEN_SEND_VERIFY_REQUEST) {
/*
* There was no cookie in the ClientHello so we need to send a
* HelloVerifyRequest. If this fails we do not worry about trying
* to resend, we just drop it.
*/
/*
* Dump the read packet, we don't need it any more. Ignore return
* value
*/
BIO_ctrl(SSL_get_rbio(s), BIO_CTRL_DGRAM_SET_PEEK_MODE, 0, NULL);
BIO_read(rbio, buf, SSL3_RT_MAX_PLAIN_LENGTH);
BIO_ctrl(SSL_get_rbio(s), BIO_CTRL_DGRAM_SET_PEEK_MODE, 1, NULL);
/* Generate the cookie */
if (s->ctx->app_gen_cookie_cb == NULL ||
s->ctx->app_gen_cookie_cb(s, cookie, &cookielen) == 0 ||
cookielen > 255) {
SSLerr(SSL_F_DTLSV1_LISTEN, SSL_R_COOKIE_GEN_CALLBACK_FAILURE);
/* This is fatal */
return -1;
}
p = &buf[DTLS1_RT_HEADER_LENGTH];
msglen = dtls_raw_hello_verify_request(p + DTLS1_HM_HEADER_LENGTH,
cookie, cookielen);
*p++ = DTLS1_MT_HELLO_VERIFY_REQUEST;
/* Message length */
l2n3(msglen, p);
/* Message sequence number is always 0 for a HelloVerifyRequest */
s2n(0, p);
/*
* We never fragment a HelloVerifyRequest, so fragment offset is 0
* and fragment length is message length
*/
l2n3(0, p);
l2n3(msglen, p);
/* Set reclen equal to length of whole handshake message */
reclen = msglen + DTLS1_HM_HEADER_LENGTH;
/* Add the record header */
p = buf;
*(p++) = SSL3_RT_HANDSHAKE;
/*
* Special case: for hello verify request, client version 1.0 and we
* haven't decided which version to use yet send back using version
* 1.0 header: otherwise some clients will ignore it.
*/
if (s->method->version == DTLS_ANY_VERSION) {
*(p++) = DTLS1_VERSION >> 8;
*(p++) = DTLS1_VERSION & 0xff;
} else {
*(p++) = s->version >> 8;
*(p++) = s->version & 0xff;
}
/*
* Record sequence number is always the same as in the received
* ClientHello
*/
memcpy(p, seq, SEQ_NUM_SIZE);
p += SEQ_NUM_SIZE;
/* Length */
s2n(reclen, p);
/*
* Set reclen equal to length of whole record including record
* header
*/
reclen += DTLS1_RT_HEADER_LENGTH;
if (s->msg_callback)
s->msg_callback(1, 0, SSL3_RT_HEADER, buf,
DTLS1_RT_HEADER_LENGTH, s, s->msg_callback_arg);
if ((tmpclient = BIO_ADDR_new()) == NULL) {
SSLerr(SSL_F_DTLSV1_LISTEN, ERR_R_MALLOC_FAILURE);
goto end;
}
/*
* This is unnecessary if rbio and wbio are one and the same - but
* maybe they're not. We ignore errors here - some BIOs do not
* support this.
*/
if (BIO_dgram_get_peer(rbio, tmpclient) > 0) {
(void)BIO_dgram_set_peer(wbio, tmpclient);
}
BIO_ADDR_free(tmpclient);
tmpclient = NULL;
if (BIO_write(wbio, buf, reclen) < (int)reclen) {
if (BIO_should_retry(wbio)) {
/*
* Non-blocking IO...but we're stateless, so we're just
* going to drop this packet.
*/
goto end;
}
return -1;
}
if (BIO_flush(wbio) <= 0) {
if (BIO_should_retry(wbio)) {
/*
* Non-blocking IO...but we're stateless, so we're just
* going to drop this packet.
*/
goto end;
}
return -1;
}
}
static int watchccs_write(BIO *bio, const char *in, int inl)
{
int ret = 0;
BIO *next = BIO_next(bio);
PACKET pkt, msg, msgbody, sessionid;
unsigned int rectype, recvers, msgtype, expectedrecvers;
if (inl <= 0)
return 0;
if (next == NULL)
return 0;
BIO_clear_retry_flags(bio);
if (!PACKET_buf_init(&pkt, (const unsigned char *)in, inl))
return 0;
/* We assume that we always write complete records each time */
while (PACKET_remaining(&pkt)) {
if (!PACKET_get_1(&pkt, &rectype)
|| !PACKET_get_net_2(&pkt, &recvers)
|| !PACKET_get_length_prefixed_2(&pkt, &msg))
return 0;
expectedrecvers = TLS1_2_VERSION;
if (rectype == SSL3_RT_HANDSHAKE) {
if (!PACKET_get_1(&msg, &msgtype)
|| !PACKET_get_length_prefixed_3(&msg, &msgbody))
return 0;
if (msgtype == SSL3_MT_CLIENT_HELLO) {
chseen++;
/*
* Skip legacy_version (2 bytes) and Random (32 bytes) to read
* session_id.
*/
if (!PACKET_forward(&msgbody, 34)
|| !PACKET_get_length_prefixed_1(&msgbody, &sessionid))
return 0;
if (chseen == 1) {
expectedrecvers = TLS1_VERSION;
/* Save the session id for later */
chsessidlen = PACKET_remaining(&sessionid);
if (!PACKET_copy_bytes(&sessionid, chsessid, chsessidlen))
return 0;
} else {
/*
* Check the session id for the second ClientHello is the
* same as the first one.
*/
if (PACKET_remaining(&sessionid) != chsessidlen
|| (chsessidlen > 0
&& memcmp(chsessid, PACKET_data(&sessionid),
chsessidlen) != 0))
badsessid = 1;
}
} else if (msgtype == SSL3_MT_SERVER_HELLO) {
shseen++;
/*
* Skip legacy_version (2 bytes) and Random (32 bytes) to read
* session_id.
*/
if (!PACKET_forward(&msgbody, 34)
|| !PACKET_get_length_prefixed_1(&msgbody, &sessionid))
return 0;
/*
* Check the session id is the same as the one in the
* ClientHello
*/
if (PACKET_remaining(&sessionid) != chsessidlen
|| (chsessidlen > 0
&& memcmp(chsessid, PACKET_data(&sessionid),
chsessidlen) != 0))
badsessid = 1;
}
} else if (rectype == SSL3_RT_CHANGE_CIPHER_SPEC) {
if (bio == s_to_c_fbio) {
/*
* Server writing. We shouldn't have written any app data
* yet, and we should have seen both the ClientHello and the
* ServerHello
*/
if (!sappdataseen
&& chseen == 1
&& shseen == 1
&& !sccsseen)
sccsseen = 1;
else
badccs = 1;
} else if (!cappdataseen) {
/*
* Client writing. We shouldn't have written any app data
* yet, and we should have seen the ClientHello
*/
if (shseen == 1 && !ccsaftersh)
ccsaftersh = 1;
else if (shseen == 0 && !ccsbeforesh)
ccsbeforesh = 1;
else
badccs = 1;
} else {
badccs = 1;
}
} else if(rectype == SSL3_RT_APPLICATION_DATA) {
if (bio == s_to_c_fbio)
sappdataseen = 1;
else
cappdataseen = 1;
}
if (recvers != expectedrecvers)
badvers = 1;
}
ret = BIO_write(next, in, inl);
if (ret <= 0 && BIO_should_write(next))
BIO_set_retry_write(bio);
return ret;
}
