diff options
| author | jsing <> | 2022-01-04 11:14:54 +0000 |
|---|---|---|
| committer | jsing <> | 2022-01-04 11:14:54 +0000 |
| commit | 7d200a7d3a5fc2b8545169036a9f387002d98fce (patch) | |
| tree | 682ea777b9eeb854698e31c97e29976955d3ebe2 /src/lib | |
| parent | 3baa905e223f4d3616de758891259e622b0c1f74 (diff) | |
| download | openbsd-7d200a7d3a5fc2b8545169036a9f387002d98fce.tar.gz openbsd-7d200a7d3a5fc2b8545169036a9f387002d98fce.tar.bz2 openbsd-7d200a7d3a5fc2b8545169036a9f387002d98fce.zip | |
Refactor ssl3_get_server_kex_ecdhe() to separate parsing and validation.
If we receive something other than a "named curve", send a handshake
failure alert as we're unable to complete the handshake with the given
parameters. If the server responded with a curve that we did not advertise
send an illegal parameter alert.
ok inoguchi@ tb@
Diffstat (limited to 'src/lib')
| -rw-r--r-- | src/lib/libssl/ssl_clnt.c | 38 |
1 files changed, 18 insertions, 20 deletions
diff --git a/src/lib/libssl/ssl_clnt.c b/src/lib/libssl/ssl_clnt.c index 1242796f58..618126720c 100644 --- a/src/lib/libssl/ssl_clnt.c +++ b/src/lib/libssl/ssl_clnt.c | |||
| @@ -1,4 +1,4 @@ | |||
| 1 | /* $OpenBSD: ssl_clnt.c,v 1.123 2021/12/09 17:50:48 tb Exp $ */ | 1 | /* $OpenBSD: ssl_clnt.c,v 1.124 2022/01/04 11:14:54 jsing Exp $ */ |
| 2 | /* Copyright (C) 1995-1998 Eric Young (eay@cryptsoft.com) | 2 | /* Copyright (C) 1995-1998 Eric Young (eay@cryptsoft.com) |
| 3 | * All rights reserved. | 3 | * All rights reserved. |
| 4 | * | 4 | * |
| @@ -1335,39 +1335,41 @@ ssl3_get_server_kex_ecdhe(SSL *s, EVP_PKEY **pkey, CBS *cbs) | |||
| 1335 | SESS_CERT *sc; | 1335 | SESS_CERT *sc; |
| 1336 | long alg_a; | 1336 | long alg_a; |
| 1337 | int nid; | 1337 | int nid; |
| 1338 | int al; | ||
| 1339 | 1338 | ||
| 1340 | alg_a = S3I(s)->hs.cipher->algorithm_auth; | 1339 | alg_a = S3I(s)->hs.cipher->algorithm_auth; |
| 1341 | sc = s->session->sess_cert; | 1340 | sc = s->session->sess_cert; |
| 1342 | 1341 | ||
| 1342 | if (!CBS_get_u8(cbs, &curve_type)) | ||
| 1343 | goto decode_err; | ||
| 1344 | if (!CBS_get_u16(cbs, &curve_id)) | ||
| 1345 | goto decode_err; | ||
| 1346 | |||
| 1343 | /* Only named curves are supported. */ | 1347 | /* Only named curves are supported. */ |
| 1344 | if (!CBS_get_u8(cbs, &curve_type) || | 1348 | if (curve_type != NAMED_CURVE_TYPE) { |
| 1345 | curve_type != NAMED_CURVE_TYPE || | 1349 | ssl3_send_alert(s, SSL3_AL_FATAL, SSL_AD_HANDSHAKE_FAILURE); |
| 1346 | !CBS_get_u16(cbs, &curve_id)) { | 1350 | SSLerror(s, SSL_R_UNSUPPORTED_ELLIPTIC_CURVE); |
| 1347 | al = SSL_AD_DECODE_ERROR; | 1351 | goto err; |
| 1348 | SSLerror(s, SSL_R_LENGTH_TOO_SHORT); | ||
| 1349 | goto fatal_err; | ||
| 1350 | } | 1352 | } |
| 1351 | 1353 | ||
| 1354 | if (!CBS_get_u8_length_prefixed(cbs, &public)) | ||
| 1355 | goto decode_err; | ||
| 1356 | |||
| 1352 | /* | 1357 | /* |
| 1353 | * Check that the curve is one of our preferences - if it is not, | 1358 | * Check that the curve is one of our preferences - if it is not, |
| 1354 | * the server has sent us an invalid curve. | 1359 | * the server has sent us an invalid curve. |
| 1355 | */ | 1360 | */ |
| 1356 | if (tls1_check_curve(s, curve_id) != 1) { | 1361 | if (tls1_check_curve(s, curve_id) != 1) { |
| 1357 | al = SSL_AD_DECODE_ERROR; | ||
| 1358 | SSLerror(s, SSL_R_WRONG_CURVE); | 1362 | SSLerror(s, SSL_R_WRONG_CURVE); |
| 1359 | goto fatal_err; | 1363 | ssl3_send_alert(s, SSL3_AL_FATAL, SSL_AD_ILLEGAL_PARAMETER); |
| 1364 | goto err; | ||
| 1360 | } | 1365 | } |
| 1361 | 1366 | ||
| 1362 | if ((nid = tls1_ec_curve_id2nid(curve_id)) == 0) { | 1367 | if ((nid = tls1_ec_curve_id2nid(curve_id)) == 0) { |
| 1363 | al = SSL_AD_INTERNAL_ERROR; | ||
| 1364 | SSLerror(s, SSL_R_UNABLE_TO_FIND_ECDH_PARAMETERS); | 1368 | SSLerror(s, SSL_R_UNABLE_TO_FIND_ECDH_PARAMETERS); |
| 1365 | goto fatal_err; | 1369 | ssl3_send_alert(s, SSL3_AL_FATAL, SSL_AD_INTERNAL_ERROR); |
| 1370 | goto err; | ||
| 1366 | } | 1371 | } |
| 1367 | 1372 | ||
| 1368 | if (!CBS_get_u8_length_prefixed(cbs, &public)) | ||
| 1369 | goto decode_err; | ||
| 1370 | |||
| 1371 | if (nid == NID_X25519) { | 1373 | if (nid == NID_X25519) { |
| 1372 | if (ssl3_get_server_kex_ecdhe_ecx(s, sc, nid, &public) != 1) | 1374 | if (ssl3_get_server_kex_ecdhe_ecx(s, sc, nid, &public) != 1) |
| 1373 | goto err; | 1375 | goto err; |
| @@ -1392,12 +1394,8 @@ ssl3_get_server_kex_ecdhe(SSL *s, EVP_PKEY **pkey, CBS *cbs) | |||
| 1392 | return (1); | 1394 | return (1); |
| 1393 | 1395 | ||
| 1394 | decode_err: | 1396 | decode_err: |
| 1395 | al = SSL_AD_DECODE_ERROR; | 1397 | ssl3_send_alert(s, SSL3_AL_FATAL, SSL_AD_DECODE_ERROR); |
| 1396 | SSLerror(s, SSL_R_BAD_PACKET_LENGTH); | 1398 | SSLerror(s, SSL_R_BAD_PACKET_LENGTH); |
| 1397 | |||
| 1398 | fatal_err: | ||
| 1399 | ssl3_send_alert(s, SSL3_AL_FATAL, al); | ||
| 1400 | |||
| 1401 | err: | 1399 | err: |
| 1402 | return (-1); | 1400 | return (-1); |
| 1403 | } | 1401 | } |