summaryrefslogtreecommitdiff
path: root/src/lib/libssl/tls13_legacy.c
diff options
context:
space:
mode:
Diffstat (limited to 'src/lib/libssl/tls13_legacy.c')
-rw-r--r--src/lib/libssl/tls13_legacy.c526
1 files changed, 0 insertions, 526 deletions
diff --git a/src/lib/libssl/tls13_legacy.c b/src/lib/libssl/tls13_legacy.c
deleted file mode 100644
index beb8952402..0000000000
--- a/src/lib/libssl/tls13_legacy.c
+++ /dev/null
@@ -1,526 +0,0 @@
1/* $OpenBSD: tls13_legacy.c,v 1.26 2021/07/01 17:53:39 jsing Exp $ */
2/*
3 * Copyright (c) 2018, 2019 Joel Sing <jsing@openbsd.org>
4 *
5 * Permission to use, copy, modify, and distribute this software for any
6 * purpose with or without fee is hereby granted, provided that the above
7 * copyright notice and this permission notice appear in all copies.
8 *
9 * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
10 * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
11 * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
12 * ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
13 * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
14 * ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
15 * OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
16 */
17
18#include <limits.h>
19
20#include "ssl_locl.h"
21#include "tls13_internal.h"
22
23static ssize_t
24tls13_legacy_wire_read(SSL *ssl, uint8_t *buf, size_t len)
25{
26 int n;
27
28 if (ssl->rbio == NULL) {
29 SSLerror(ssl, SSL_R_BIO_NOT_SET);
30 return TLS13_IO_FAILURE;
31 }
32
33 ssl->internal->rwstate = SSL_READING;
34 errno = 0;
35
36 if ((n = BIO_read(ssl->rbio, buf, len)) <= 0) {
37 if (BIO_should_read(ssl->rbio))
38 return TLS13_IO_WANT_POLLIN;
39 if (n == 0)
40 return TLS13_IO_EOF;
41
42 if (ERR_peek_error() == 0 && errno != 0)
43 SYSerror(errno);
44
45 return TLS13_IO_FAILURE;
46 }
47
48 if (n == len)
49 ssl->internal->rwstate = SSL_NOTHING;
50
51 return n;
52}
53
54ssize_t
55tls13_legacy_wire_read_cb(void *buf, size_t n, void *arg)
56{
57 struct tls13_ctx *ctx = arg;
58
59 return tls13_legacy_wire_read(ctx->ssl, buf, n);
60}
61
62static ssize_t
63tls13_legacy_wire_write(SSL *ssl, const uint8_t *buf, size_t len)
64{
65 int n;
66
67 if (ssl->wbio == NULL) {
68 SSLerror(ssl, SSL_R_BIO_NOT_SET);
69 return TLS13_IO_FAILURE;
70 }
71
72 ssl->internal->rwstate = SSL_WRITING;
73 errno = 0;
74
75 if ((n = BIO_write(ssl->wbio, buf, len)) <= 0) {
76 if (BIO_should_write(ssl->wbio))
77 return TLS13_IO_WANT_POLLOUT;
78
79 if (ERR_peek_error() == 0 && errno != 0)
80 SYSerror(errno);
81
82 return TLS13_IO_FAILURE;
83 }
84
85 if (n == len)
86 ssl->internal->rwstate = SSL_NOTHING;
87
88 return n;
89}
90
91ssize_t
92tls13_legacy_wire_write_cb(const void *buf, size_t n, void *arg)
93{
94 struct tls13_ctx *ctx = arg;
95
96 return tls13_legacy_wire_write(ctx->ssl, buf, n);
97}
98
99static void
100tls13_legacy_error(SSL *ssl)
101{
102 struct tls13_ctx *ctx = ssl->internal->tls13;
103 int reason = SSL_R_UNKNOWN;
104
105 /* If we received a fatal alert we already put an error on the stack. */
106 if (S3I(ssl)->fatal_alert != 0)
107 return;
108
109 switch (ctx->error.code) {
110 case TLS13_ERR_VERIFY_FAILED:
111 reason = SSL_R_CERTIFICATE_VERIFY_FAILED;
112 break;
113 case TLS13_ERR_HRR_FAILED:
114 reason = SSL_R_NO_CIPHERS_AVAILABLE;
115 break;
116 case TLS13_ERR_TRAILING_DATA:
117 reason = SSL_R_EXTRA_DATA_IN_MESSAGE;
118 break;
119 case TLS13_ERR_NO_SHARED_CIPHER:
120 reason = SSL_R_NO_SHARED_CIPHER;
121 break;
122 case TLS13_ERR_NO_CERTIFICATE:
123 reason = SSL_R_MISSING_RSA_CERTIFICATE; /* XXX */
124 break;
125 case TLS13_ERR_NO_PEER_CERTIFICATE:
126 reason = SSL_R_PEER_DID_NOT_RETURN_A_CERTIFICATE;
127 break;
128 }
129
130 /* Something (probably libcrypto) already pushed an error on the stack. */
131 if (reason == SSL_R_UNKNOWN && ERR_peek_error() != 0)
132 return;
133
134 ERR_put_error(ERR_LIB_SSL, (0xfff), reason, ctx->error.file,
135 ctx->error.line);
136}
137
138int
139tls13_legacy_return_code(SSL *ssl, ssize_t ret)
140{
141 if (ret > INT_MAX) {
142 SSLerror(ssl, ERR_R_INTERNAL_ERROR);
143 return -1;
144 }
145
146 /* A successful read, write or other operation. */
147 if (ret > 0)
148 return ret;
149
150 ssl->internal->rwstate = SSL_NOTHING;
151
152 switch (ret) {
153 case TLS13_IO_EOF:
154 return 0;
155
156 case TLS13_IO_FAILURE:
157 tls13_legacy_error(ssl);
158 return -1;
159
160 case TLS13_IO_ALERT:
161 tls13_legacy_error(ssl);
162 return -1;
163
164 case TLS13_IO_WANT_POLLIN:
165 BIO_set_retry_read(ssl->rbio);
166 ssl->internal->rwstate = SSL_READING;
167 return -1;
168
169 case TLS13_IO_WANT_POLLOUT:
170 BIO_set_retry_write(ssl->wbio);
171 ssl->internal->rwstate = SSL_WRITING;
172 return -1;
173
174 case TLS13_IO_WANT_RETRY:
175 SSLerror(ssl, ERR_R_INTERNAL_ERROR);
176 return -1;
177 }
178
179 SSLerror(ssl, ERR_R_INTERNAL_ERROR);
180 return -1;
181}
182
183int
184tls13_legacy_pending(const SSL *ssl)
185{
186 struct tls13_ctx *ctx = ssl->internal->tls13;
187 ssize_t ret;
188
189 if (ctx == NULL)
190 return 0;
191
192 ret = tls13_pending_application_data(ctx->rl);
193 if (ret < 0 || ret > INT_MAX)
194 return 0;
195
196 return ret;
197}
198
199int
200tls13_legacy_read_bytes(SSL *ssl, int type, unsigned char *buf, int len, int peek)
201{
202 struct tls13_ctx *ctx = ssl->internal->tls13;
203 ssize_t ret;
204
205 if (ctx == NULL || !ctx->handshake_completed) {
206 if ((ret = ssl->internal->handshake_func(ssl)) <= 0)
207 return ret;
208 return tls13_legacy_return_code(ssl, TLS13_IO_WANT_POLLIN);
209 }
210
211 tls13_record_layer_set_retry_after_phh(ctx->rl,
212 (ctx->ssl->internal->mode & SSL_MODE_AUTO_RETRY) != 0);
213
214 if (type != SSL3_RT_APPLICATION_DATA) {
215 SSLerror(ssl, ERR_R_SHOULD_NOT_HAVE_BEEN_CALLED);
216 return -1;
217 }
218 if (len < 0) {
219 SSLerror(ssl, SSL_R_BAD_LENGTH);
220 return -1;
221 }
222
223 if (peek)
224 ret = tls13_peek_application_data(ctx->rl, buf, len);
225 else
226 ret = tls13_read_application_data(ctx->rl, buf, len);
227
228 return tls13_legacy_return_code(ssl, ret);
229}
230
231int
232tls13_legacy_write_bytes(SSL *ssl, int type, const void *vbuf, int len)
233{
234 struct tls13_ctx *ctx = ssl->internal->tls13;
235 const uint8_t *buf = vbuf;
236 size_t n, sent;
237 ssize_t ret;
238
239 if (ctx == NULL || !ctx->handshake_completed) {
240 if ((ret = ssl->internal->handshake_func(ssl)) <= 0)
241 return ret;
242 return tls13_legacy_return_code(ssl, TLS13_IO_WANT_POLLOUT);
243 }
244
245 if (type != SSL3_RT_APPLICATION_DATA) {
246 SSLerror(ssl, ERR_R_SHOULD_NOT_HAVE_BEEN_CALLED);
247 return -1;
248 }
249 if (len < 0) {
250 SSLerror(ssl, SSL_R_BAD_LENGTH);
251 return -1;
252 }
253
254 /*
255 * The TLSv1.3 record layer write behaviour is the same as
256 * SSL_MODE_ENABLE_PARTIAL_WRITE.
257 */
258 if (ssl->internal->mode & SSL_MODE_ENABLE_PARTIAL_WRITE) {
259 ret = tls13_write_application_data(ctx->rl, buf, len);
260 return tls13_legacy_return_code(ssl, ret);
261 }
262
263 /*
264 * In the non-SSL_MODE_ENABLE_PARTIAL_WRITE case we have to loop until
265 * we have written out all of the requested data.
266 */
267 sent = S3I(ssl)->wnum;
268 if (len < sent) {
269 SSLerror(ssl, SSL_R_BAD_LENGTH);
270 return -1;
271 }
272 n = len - sent;
273 for (;;) {
274 if (n == 0) {
275 S3I(ssl)->wnum = 0;
276 return sent;
277 }
278 if ((ret = tls13_write_application_data(ctx->rl,
279 &buf[sent], n)) <= 0) {
280 S3I(ssl)->wnum = sent;
281 return tls13_legacy_return_code(ssl, ret);
282 }
283 sent += ret;
284 n -= ret;
285 }
286}
287
288static int
289tls13_use_legacy_stack(struct tls13_ctx *ctx)
290{
291 SSL *s = ctx->ssl;
292 CBB cbb, fragment;
293 CBS cbs;
294
295 memset(&cbb, 0, sizeof(cbb));
296
297 s->method = tls_legacy_method();
298
299 if (!ssl3_setup_init_buffer(s))
300 goto err;
301 if (!ssl3_setup_buffers(s))
302 goto err;
303 if (!ssl_init_wbio_buffer(s, 1))
304 goto err;
305
306 /* Stash any unprocessed data from the last record. */
307 tls13_record_layer_rbuf(ctx->rl, &cbs);
308 if (CBS_len(&cbs) > 0) {
309 if (!CBB_init_fixed(&cbb, S3I(s)->rbuf.buf,
310 S3I(s)->rbuf.len))
311 goto err;
312 if (!CBB_add_u8(&cbb, SSL3_RT_HANDSHAKE))
313 goto err;
314 if (!CBB_add_u16(&cbb, TLS1_2_VERSION))
315 goto err;
316 if (!CBB_add_u16_length_prefixed(&cbb, &fragment))
317 goto err;
318 if (!CBB_add_bytes(&fragment, CBS_data(&cbs), CBS_len(&cbs)))
319 goto err;
320 if (!CBB_finish(&cbb, NULL, NULL))
321 goto err;
322
323 S3I(s)->rbuf.offset = SSL3_RT_HEADER_LENGTH;
324 S3I(s)->rbuf.left = CBS_len(&cbs);
325 S3I(s)->rrec.type = SSL3_RT_HANDSHAKE;
326 S3I(s)->rrec.length = CBS_len(&cbs);
327 s->internal->rstate = SSL_ST_READ_BODY;
328 s->internal->packet = S3I(s)->rbuf.buf;
329 s->internal->packet_length = SSL3_RT_HEADER_LENGTH;
330 s->internal->mac_packet = 1;
331 }
332
333 /* Stash the current handshake message. */
334 tls13_handshake_msg_data(ctx->hs_msg, &cbs);
335 if (!BUF_MEM_grow_clean(s->internal->init_buf, CBS_len(&cbs)))
336 goto err;
337 if (!CBS_write_bytes(&cbs, s->internal->init_buf->data,
338 s->internal->init_buf->length, NULL))
339 goto err;
340
341 S3I(s)->hs.tls12.reuse_message = 1;
342 S3I(s)->hs.tls12.message_type = tls13_handshake_msg_type(ctx->hs_msg);
343 S3I(s)->hs.tls12.message_size = CBS_len(&cbs);
344
345 return 1;
346
347 err:
348 CBB_cleanup(&cbb);
349
350 return 0;
351}
352
353int
354tls13_use_legacy_client(struct tls13_ctx *ctx)
355{
356 SSL *s = ctx->ssl;
357
358 if (!tls13_use_legacy_stack(ctx))
359 return 0;
360
361 s->internal->handshake_func = s->method->ssl_connect;
362 s->client_version = s->version = s->method->max_tls_version;
363
364 return 1;
365}
366
367int
368tls13_use_legacy_server(struct tls13_ctx *ctx)
369{
370 SSL *s = ctx->ssl;
371
372 if (!tls13_use_legacy_stack(ctx))
373 return 0;
374
375 s->internal->handshake_func = s->method->ssl_accept;
376 s->client_version = s->version = s->method->max_tls_version;
377 s->server = 1;
378
379 return 1;
380}
381
382int
383tls13_legacy_accept(SSL *ssl)
384{
385 struct tls13_ctx *ctx = ssl->internal->tls13;
386 int ret;
387
388 if (ctx == NULL) {
389 if ((ctx = tls13_ctx_new(TLS13_HS_SERVER)) == NULL) {
390 SSLerror(ssl, ERR_R_INTERNAL_ERROR); /* XXX */
391 return -1;
392 }
393 ssl->internal->tls13 = ctx;
394 ctx->ssl = ssl;
395 ctx->hs = &S3I(ssl)->hs;
396
397 if (!tls13_server_init(ctx)) {
398 if (ERR_peek_error() == 0)
399 SSLerror(ssl, ERR_R_INTERNAL_ERROR); /* XXX */
400 return -1;
401 }
402 }
403
404 ERR_clear_error();
405
406 ret = tls13_server_accept(ctx);
407 if (ret == TLS13_IO_USE_LEGACY)
408 return ssl->method->ssl_accept(ssl);
409
410 return tls13_legacy_return_code(ssl, ret);
411}
412
413int
414tls13_legacy_connect(SSL *ssl)
415{
416 struct tls13_ctx *ctx = ssl->internal->tls13;
417 int ret;
418
419#ifdef TLS13_USE_LEGACY_CLIENT_AUTH
420 /* XXX drop back to legacy for client auth for now */
421 if (ssl->cert->key->privatekey != NULL) {
422 ssl->method = tls_legacy_client_method();
423 return ssl->method->ssl_connect(ssl);
424 }
425#endif
426
427 if (ctx == NULL) {
428 if ((ctx = tls13_ctx_new(TLS13_HS_CLIENT)) == NULL) {
429 SSLerror(ssl, ERR_R_INTERNAL_ERROR); /* XXX */
430 return -1;
431 }
432 ssl->internal->tls13 = ctx;
433 ctx->ssl = ssl;
434 ctx->hs = &S3I(ssl)->hs;
435
436 if (!tls13_client_init(ctx)) {
437 if (ERR_peek_error() == 0)
438 SSLerror(ssl, ERR_R_INTERNAL_ERROR); /* XXX */
439 return -1;
440 }
441 }
442
443 ERR_clear_error();
444
445 ret = tls13_client_connect(ctx);
446 if (ret == TLS13_IO_USE_LEGACY)
447 return ssl->method->ssl_connect(ssl);
448
449 return tls13_legacy_return_code(ssl, ret);
450}
451
452int
453tls13_legacy_shutdown(SSL *ssl)
454{
455 struct tls13_ctx *ctx = ssl->internal->tls13;
456 uint8_t buf[512]; /* XXX */
457 ssize_t ret;
458
459 /*
460 * We need to return 0 when we have sent a close-notify but have not
461 * yet received one. We return 1 only once we have sent and received
462 * close-notify alerts. All other cases return -1 and set internal
463 * state appropriately.
464 */
465 if (ctx == NULL || ssl->internal->quiet_shutdown) {
466 ssl->internal->shutdown = SSL_SENT_SHUTDOWN | SSL_RECEIVED_SHUTDOWN;
467 return 1;
468 }
469
470 if (!ctx->close_notify_sent) {
471 /* Enqueue and send close notify. */
472 if (!(ssl->internal->shutdown & SSL_SENT_SHUTDOWN)) {
473 ssl->internal->shutdown |= SSL_SENT_SHUTDOWN;
474 if ((ret = tls13_send_alert(ctx->rl,
475 TLS13_ALERT_CLOSE_NOTIFY)) < 0)
476 return tls13_legacy_return_code(ssl, ret);
477 }
478 if ((ret = tls13_record_layer_send_pending(ctx->rl)) !=
479 TLS13_IO_SUCCESS)
480 return tls13_legacy_return_code(ssl, ret);
481 } else if (!ctx->close_notify_recv) {
482 /*
483 * If there is no application data pending, attempt to read more
484 * data in order to receive a close notify. This should trigger
485 * a record to be read from the wire, which may be application
486 * handshake or alert data. Only one attempt is made to match
487 * previous semantics.
488 */
489 if (tls13_pending_application_data(ctx->rl) == 0) {
490 if ((ret = tls13_read_application_data(ctx->rl, buf,
491 sizeof(buf))) < 0)
492 return tls13_legacy_return_code(ssl, ret);
493 }
494 }
495
496 if (ctx->close_notify_recv)
497 return 1;
498
499 return 0;
500}
501
502int
503tls13_legacy_servername_process(struct tls13_ctx *ctx, uint8_t *alert)
504{
505 int legacy_alert = SSL_AD_UNRECOGNIZED_NAME;
506 int ret = SSL_TLSEXT_ERR_NOACK;
507 SSL_CTX *ssl_ctx = ctx->ssl->ctx;
508 SSL *s = ctx->ssl;
509
510 if (ssl_ctx->internal->tlsext_servername_callback == NULL)
511 ssl_ctx = s->initial_ctx;
512 if (ssl_ctx->internal->tlsext_servername_callback == NULL)
513 return 1;
514
515 ret = ssl_ctx->internal->tlsext_servername_callback(s, &legacy_alert,
516 ssl_ctx->internal->tlsext_servername_arg);
517
518 if (ret == SSL_TLSEXT_ERR_ALERT_FATAL ||
519 ret == SSL_TLSEXT_ERR_ALERT_WARNING) {
520 if (legacy_alert >= 0 && legacy_alert <= 255)
521 *alert = legacy_alert;
522 return 0;
523 }
524
525 return 1;
526}
generated by cgit v1.2.3-55-g6feb (git 2.39.1) at 2026-02-12 20:51:44 +0000