This is errata/6.8/013_libressl.patch.siglibressl-v3.2.4

Various interoperability issues and memory leaks were discovered in
libcrypto and libssl.

The new verifier is not bug compatible with the old verifier and caused
many issues by failing to propagate errors correctly, returning different
error codes than some software was trained to expect and otherwise failing
when it shouldn't. While much of this is fixed in -current, it's still not
perfect, so switching back to the legacy verifier is preferable at this
point.

Other included fixes:

* Unbreak DTLS retransmissions for flights that include a CCS
* Only check BIO_should_read() on read and BIO_should_write() on write
* Implement autochain for the TLSv1.3 server
* Use the legacy verifier for AUTO_CHAIN
* Implement exporter for TLSv1.3
* Free alert_data and phh_data in tls13_record_layer_free()
* Plug leak in x509_verify_chain_dup()
* Free the policy tree in x509_vfy_check_policy()

Original commits by jsing and tb

ok inoguchi jsing

1 files changed, 73 insertions, 1 deletions

diff --git a/src/lib/libssl/tls13_lib.c b/src/lib/libssl/tls13_lib.c
index 590426ad8a..af3de58f93 100644
--- a/src/lib/libssl/tls13_lib.c
+++ b/src/lib/libssl/tls13_lib.c
@@ -1,4 +1,4 @@
-/*      $OpenBSD: tls13_lib.c,v 1.54 2020/09/11 15:03:36 jsing Exp $ */
+/*      $OpenBSD: tls13_lib.c,v 1.54.4.1 2021/02/03 07:06:14 tb Exp $ */
 /*
  * Copyright (c) 2018, 2019 Joel Sing <jsing@openbsd.org>
  * Copyright (c) 2019 Bob Beck <beck@openbsd.org>
@@ -579,3 +579,75 @@ tls13_clienthello_hash_validate(struct tls13_ctx *ctx)
         return 1;
 }
 
+int
+tls13_exporter(struct tls13_ctx *ctx, const uint8_t *label, size_t label_len,
+    const uint8_t *context_value, size_t context_value_len, uint8_t *out,
+    size_t out_len)
+{
+        struct tls13_secret context, export_out, export_secret;
+        struct tls13_secrets *secrets = ctx->hs->secrets;
+        EVP_MD_CTX *md_ctx = NULL;
+        unsigned int md_out_len;
+        int md_len;
+        int ret = 0;
+
+        /*
+         * RFC 8446 Section 7.5.
+         */
+
+        memset(&context, 0, sizeof(context));
+        memset(&export_secret, 0, sizeof(export_secret));
+
+        export_out.data = out;
+        export_out.len = out_len;
+
+        if (!ctx->handshake_completed)
+                return 0;
+
+        md_len = EVP_MD_size(secrets->digest);
+        if (md_len <= 0 || md_len > EVP_MAX_MD_SIZE)
+                goto err;
+
+        if ((export_secret.data = calloc(1, md_len)) == NULL)
+                goto err;
+        export_secret.len = md_len;
+
+        if ((context.data = calloc(1, md_len)) == NULL)
+                goto err;
+        context.len = md_len;
+
+        /* In TLSv1.3 no context is equivalent to an empty context. */
+        if (context_value == NULL) {
+                context_value = "";
+                context_value_len = 0;
+        }
+
+        if ((md_ctx = EVP_MD_CTX_new()) == NULL)
+                goto err;
+        if (!EVP_DigestInit_ex(md_ctx, secrets->digest, NULL))
+                goto err;
+        if (!EVP_DigestUpdate(md_ctx, context_value, context_value_len))
+                goto err;
+        if (!EVP_DigestFinal_ex(md_ctx, context.data, &md_out_len))
+                goto err;
+        if (md_len != md_out_len)
+                goto err;
+
+        if (!tls13_derive_secret_with_label_length(&export_secret,
+            secrets->digest, &secrets->exporter_master, label, label_len,
+            &secrets->empty_hash))
+                goto err;
+
+        if (!tls13_hkdf_expand_label(&export_out, secrets->digest,
+            &export_secret, "exporter", &context))
+                goto err;
+
+        ret = 1;
+
+ err:
+        EVP_MD_CTX_free(md_ctx);
+        freezero(context.data, context.len);
+        freezero(export_secret.data, export_secret.len);
+
+        return ret;
+}