summaryrefslogtreecommitdiff
path: root/src/lib/libssl/tls13_lib.c
diff options
context:
space:
mode:
Diffstat (limited to 'src/lib/libssl/tls13_lib.c')
-rw-r--r--src/lib/libssl/tls13_lib.c701
1 files changed, 0 insertions, 701 deletions
diff --git a/src/lib/libssl/tls13_lib.c b/src/lib/libssl/tls13_lib.c
deleted file mode 100644
index 05f125adc8..0000000000
--- a/src/lib/libssl/tls13_lib.c
+++ /dev/null
@@ -1,701 +0,0 @@
1/* $OpenBSD: tls13_lib.c,v 1.76 2022/11/26 16:08:56 tb Exp $ */
2/*
3 * Copyright (c) 2018, 2019 Joel Sing <jsing@openbsd.org>
4 * Copyright (c) 2019 Bob Beck <beck@openbsd.org>
5 *
6 * Permission to use, copy, modify, and distribute this software for any
7 * purpose with or without fee is hereby granted, provided that the above
8 * copyright notice and this permission notice appear in all copies.
9 *
10 * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
11 * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
12 * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
13 * ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
14 * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
15 * ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
16 * OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
17 */
18
19#include <stddef.h>
20
21#include <openssl/evp.h>
22
23#include "ssl_local.h"
24#include "ssl_tlsext.h"
25#include "tls13_internal.h"
26
27/*
28 * RFC 8446, section 4.6.1. Servers must not indicate a lifetime longer than
29 * 7 days and clients must not cache tickets for longer than 7 days.
30 */
31
32#define TLS13_MAX_TICKET_LIFETIME (7 * 24 * 3600)
33
34/*
35 * Downgrade sentinels - RFC 8446 section 4.1.3, magic values which must be set
36 * by the server in server random if it is willing to downgrade but supports
37 * TLSv1.3
38 */
39const uint8_t tls13_downgrade_12[8] = {
40 0x44, 0x4f, 0x57, 0x4e, 0x47, 0x52, 0x44, 0x01,
41};
42const uint8_t tls13_downgrade_11[8] = {
43 0x44, 0x4f, 0x57, 0x4e, 0x47, 0x52, 0x44, 0x00,
44};
45
46/*
47 * HelloRetryRequest hash - RFC 8446 section 4.1.3.
48 */
49const uint8_t tls13_hello_retry_request_hash[32] = {
50 0xcf, 0x21, 0xad, 0x74, 0xe5, 0x9a, 0x61, 0x11,
51 0xbe, 0x1d, 0x8c, 0x02, 0x1e, 0x65, 0xb8, 0x91,
52 0xc2, 0xa2, 0x11, 0x16, 0x7a, 0xbb, 0x8c, 0x5e,
53 0x07, 0x9e, 0x09, 0xe2, 0xc8, 0xa8, 0x33, 0x9c,
54};
55
56/*
57 * Certificate Verify padding - RFC 8446 section 4.4.3.
58 */
59const uint8_t tls13_cert_verify_pad[64] = {
60 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20,
61 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20,
62 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20,
63 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20,
64 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20,
65 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20,
66 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20,
67 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20,
68};
69
70const uint8_t tls13_cert_client_verify_context[] =
71 "TLS 1.3, client CertificateVerify";
72const uint8_t tls13_cert_server_verify_context[] =
73 "TLS 1.3, server CertificateVerify";
74
75const EVP_AEAD *
76tls13_cipher_aead(const SSL_CIPHER *cipher)
77{
78 if (cipher == NULL)
79 return NULL;
80 if (cipher->algorithm_ssl != SSL_TLSV1_3)
81 return NULL;
82
83 switch (cipher->algorithm_enc) {
84 case SSL_AES128GCM:
85 return EVP_aead_aes_128_gcm();
86 case SSL_AES256GCM:
87 return EVP_aead_aes_256_gcm();
88 case SSL_CHACHA20POLY1305:
89 return EVP_aead_chacha20_poly1305();
90 }
91
92 return NULL;
93}
94
95const EVP_MD *
96tls13_cipher_hash(const SSL_CIPHER *cipher)
97{
98 if (cipher == NULL)
99 return NULL;
100 if (cipher->algorithm_ssl != SSL_TLSV1_3)
101 return NULL;
102
103 switch (cipher->algorithm2) {
104 case SSL_HANDSHAKE_MAC_SHA256:
105 return EVP_sha256();
106 case SSL_HANDSHAKE_MAC_SHA384:
107 return EVP_sha384();
108 }
109
110 return NULL;
111}
112
113void
114tls13_alert_received_cb(uint8_t alert_desc, void *arg)
115{
116 struct tls13_ctx *ctx = arg;
117
118 if (alert_desc == TLS13_ALERT_CLOSE_NOTIFY) {
119 ctx->close_notify_recv = 1;
120 ctx->ssl->shutdown |= SSL_RECEIVED_SHUTDOWN;
121 ctx->ssl->s3->warn_alert = alert_desc;
122 return;
123 }
124
125 if (alert_desc == TLS13_ALERT_USER_CANCELED) {
126 /*
127 * We treat this as advisory, since a close_notify alert
128 * SHOULD follow this alert (RFC 8446 section 6.1).
129 */
130 return;
131 }
132
133 /* All other alerts are treated as fatal in TLSv1.3. */
134 ctx->ssl->s3->fatal_alert = alert_desc;
135
136 SSLerror(ctx->ssl, SSL_AD_REASON_OFFSET + alert_desc);
137 ERR_asprintf_error_data("SSL alert number %d", alert_desc);
138
139 SSL_CTX_remove_session(ctx->ssl->ctx, ctx->ssl->session);
140}
141
142void
143tls13_alert_sent_cb(uint8_t alert_desc, void *arg)
144{
145 struct tls13_ctx *ctx = arg;
146
147 if (alert_desc == TLS13_ALERT_CLOSE_NOTIFY) {
148 ctx->close_notify_sent = 1;
149 return;
150 }
151
152 if (alert_desc == TLS13_ALERT_USER_CANCELED) {
153 return;
154 }
155
156 /* All other alerts are treated as fatal in TLSv1.3. */
157 if (ctx->error.code == 0)
158 SSLerror(ctx->ssl, SSL_AD_REASON_OFFSET + alert_desc);
159}
160
161static void
162tls13_legacy_handshake_message_recv_cb(void *arg)
163{
164 struct tls13_ctx *ctx = arg;
165 SSL *s = ctx->ssl;
166 CBS cbs;
167
168 if (s->msg_callback == NULL)
169 return;
170
171 tls13_handshake_msg_data(ctx->hs_msg, &cbs);
172 ssl_msg_callback_cbs(s, 0, SSL3_RT_HANDSHAKE, &cbs);
173}
174
175static void
176tls13_legacy_handshake_message_sent_cb(void *arg)
177{
178 struct tls13_ctx *ctx = arg;
179 SSL *s = ctx->ssl;
180 CBS cbs;
181
182 if (s->msg_callback == NULL)
183 return;
184
185 tls13_handshake_msg_data(ctx->hs_msg, &cbs);
186 ssl_msg_callback_cbs(s, 1, SSL3_RT_HANDSHAKE, &cbs);
187}
188
189static void
190tls13_legacy_info_cb(void *arg, int state, int ret)
191{
192 struct tls13_ctx *ctx = arg;
193 SSL *s = ctx->ssl;
194
195 ssl_info_callback(s, state, ret);
196}
197
198static int
199tls13_legacy_ocsp_status_recv_cb(void *arg)
200{
201 struct tls13_ctx *ctx = arg;
202 SSL *s = ctx->ssl;
203 int ret;
204
205 if (s->ctx->tlsext_status_cb == NULL)
206 return 1;
207
208 ret = s->ctx->tlsext_status_cb(s,
209 s->ctx->tlsext_status_arg);
210 if (ret < 0) {
211 ctx->alert = TLS13_ALERT_INTERNAL_ERROR;
212 SSLerror(s, ERR_R_MALLOC_FAILURE);
213 return 0;
214 }
215 if (ret == 0) {
216 ctx->alert = TLS13_ALERT_BAD_CERTIFICATE_STATUS_RESPONSE;
217 SSLerror(s, SSL_R_INVALID_STATUS_RESPONSE);
218 return 0;
219 }
220
221 return 1;
222}
223
224static int
225tls13_phh_update_read_traffic_secret(struct tls13_ctx *ctx)
226{
227 struct tls13_secrets *secrets = ctx->hs->tls13.secrets;
228 struct tls13_secret *secret;
229
230 if (ctx->mode == TLS13_HS_CLIENT) {
231 secret = &secrets->server_application_traffic;
232 if (!tls13_update_server_traffic_secret(secrets))
233 return 0;
234 } else {
235 secret = &secrets->client_application_traffic;
236 if (!tls13_update_client_traffic_secret(secrets))
237 return 0;
238 }
239
240 return tls13_record_layer_set_read_traffic_key(ctx->rl,
241 secret, ssl_encryption_application);
242}
243
244static int
245tls13_phh_update_write_traffic_secret(struct tls13_ctx *ctx)
246{
247 struct tls13_secrets *secrets = ctx->hs->tls13.secrets;
248 struct tls13_secret *secret;
249
250 if (ctx->mode == TLS13_HS_CLIENT) {
251 secret = &secrets->client_application_traffic;
252 if (!tls13_update_client_traffic_secret(secrets))
253 return 0;
254 } else {
255 secret = &secrets->server_application_traffic;
256 if (!tls13_update_server_traffic_secret(secrets))
257 return 0;
258 }
259
260 return tls13_record_layer_set_write_traffic_key(ctx->rl,
261 secret, ssl_encryption_application);
262}
263
264/*
265 * XXX arbitrarily chosen limit of 100 post handshake handshake
266 * messages in an hour - to avoid a hostile peer from constantly
267 * requesting certificates or key renegotiaitons, etc.
268 */
269static int
270tls13_phh_limit_check(struct tls13_ctx *ctx)
271{
272 time_t now = time(NULL);
273
274 if (ctx->phh_last_seen > now - TLS13_PHH_LIMIT_TIME) {
275 if (ctx->phh_count > TLS13_PHH_LIMIT)
276 return 0;
277 } else
278 ctx->phh_count = 0;
279 ctx->phh_count++;
280 ctx->phh_last_seen = now;
281 return 1;
282}
283
284static ssize_t
285tls13_key_update_recv(struct tls13_ctx *ctx, CBS *cbs)
286{
287 struct tls13_handshake_msg *hs_msg = NULL;
288 CBB cbb_hs;
289 CBS cbs_hs;
290 uint8_t alert = TLS13_ALERT_INTERNAL_ERROR;
291 uint8_t key_update_request;
292 ssize_t ret;
293
294 if (!CBS_get_u8(cbs, &key_update_request)) {
295 alert = TLS13_ALERT_DECODE_ERROR;
296 goto err;
297 }
298 if (CBS_len(cbs) != 0) {
299 alert = TLS13_ALERT_DECODE_ERROR;
300 goto err;
301 }
302 if (key_update_request > 1) {
303 alert = TLS13_ALERT_ILLEGAL_PARAMETER;
304 goto err;
305 }
306
307 if (!tls13_phh_update_read_traffic_secret(ctx))
308 goto err;
309
310 if (key_update_request == 0)
311 return TLS13_IO_SUCCESS;
312
313 /* Our peer requested that we update our write traffic keys. */
314 if ((hs_msg = tls13_handshake_msg_new()) == NULL)
315 goto err;
316 if (!tls13_handshake_msg_start(hs_msg, &cbb_hs, TLS13_MT_KEY_UPDATE))
317 goto err;
318 if (!CBB_add_u8(&cbb_hs, 0))
319 goto err;
320 if (!tls13_handshake_msg_finish(hs_msg))
321 goto err;
322
323 ctx->key_update_request = 1;
324 tls13_handshake_msg_data(hs_msg, &cbs_hs);
325 ret = tls13_record_layer_phh(ctx->rl, &cbs_hs);
326
327 tls13_handshake_msg_free(hs_msg);
328 hs_msg = NULL;
329
330 return ret;
331
332 err:
333 tls13_handshake_msg_free(hs_msg);
334
335 return tls13_send_alert(ctx->rl, alert);
336}
337
338/* RFC 8446 section 4.6.1 */
339static ssize_t
340tls13_new_session_ticket_recv(struct tls13_ctx *ctx, CBS *cbs)
341{
342 struct tls13_secrets *secrets = ctx->hs->tls13.secrets;
343 struct tls13_secret nonce;
344 uint32_t ticket_lifetime, ticket_age_add;
345 CBS ticket_nonce, ticket;
346 SSL_SESSION *sess = NULL;
347 int alert, session_id_length;
348 ssize_t ret = 0;
349
350 memset(&nonce, 0, sizeof(nonce));
351
352 if (ctx->mode != TLS13_HS_CLIENT) {
353 alert = TLS13_ALERT_UNEXPECTED_MESSAGE;
354 goto err;
355 }
356
357 alert = TLS13_ALERT_DECODE_ERROR;
358
359 if (!CBS_get_u32(cbs, &ticket_lifetime))
360 goto err;
361 if (!CBS_get_u32(cbs, &ticket_age_add))
362 goto err;
363 if (!CBS_get_u8_length_prefixed(cbs, &ticket_nonce))
364 goto err;
365 if (!CBS_get_u16_length_prefixed(cbs, &ticket))
366 goto err;
367 /* Extensions can only contain early_data, which we currently ignore. */
368 if (!tlsext_client_parse(ctx->ssl, SSL_TLSEXT_MSG_NST, cbs, &alert))
369 goto err;
370
371 if (CBS_len(cbs) != 0)
372 goto err;
373
374 /* Zero indicates that the ticket should be discarded immediately. */
375 if (ticket_lifetime == 0) {
376 ret = TLS13_IO_SUCCESS;
377 goto done;
378 }
379
380 /* Servers MUST NOT use any value larger than 7 days. */
381 if (ticket_lifetime > TLS13_MAX_TICKET_LIFETIME) {
382 alert = TLS13_ALERT_ILLEGAL_PARAMETER;
383 goto err;
384 }
385
386 alert = TLS13_ALERT_INTERNAL_ERROR;
387
388 /*
389 * Create new session instead of modifying the current session.
390 * The current session could already be in the session cache.
391 */
392 if ((sess = ssl_session_dup(ctx->ssl->session, 0)) == NULL)
393 goto err;
394
395 sess->time = time(NULL);
396
397 sess->tlsext_tick_lifetime_hint = ticket_lifetime;
398 sess->tlsext_tick_age_add = ticket_age_add;
399
400 if (!CBS_stow(&ticket, &sess->tlsext_tick, &sess->tlsext_ticklen))
401 goto err;
402
403 /* XXX - ensure this doesn't overflow session_id if hash is changed. */
404 if (!EVP_Digest(CBS_data(&ticket), CBS_len(&ticket),
405 sess->session_id, &session_id_length, EVP_sha256(), NULL))
406 goto err;
407 sess->session_id_length = session_id_length;
408
409 if (!CBS_stow(&ticket_nonce, &nonce.data, &nonce.len))
410 goto err;
411
412 if (!tls13_secret_init(&sess->resumption_master_secret, 256))
413 goto err;
414
415 if (!tls13_derive_secret(&sess->resumption_master_secret,
416 secrets->digest, &secrets->resumption_master, "resumption",
417 &nonce))
418 goto err;
419
420 SSL_SESSION_free(ctx->ssl->session);
421 ctx->ssl->session = sess;
422 sess = NULL;
423
424 ssl_update_cache(ctx->ssl, SSL_SESS_CACHE_CLIENT);
425
426 ret = TLS13_IO_SUCCESS;
427 goto done;
428
429 err:
430 ret = tls13_send_alert(ctx->rl, alert);
431
432 done:
433 tls13_secret_cleanup(&nonce);
434 SSL_SESSION_free(sess);
435
436 return ret;
437}
438
439ssize_t
440tls13_phh_received_cb(void *cb_arg)
441{
442 ssize_t ret = TLS13_IO_FAILURE;
443 struct tls13_ctx *ctx = cb_arg;
444 CBS cbs;
445
446 if (!tls13_phh_limit_check(ctx))
447 return tls13_send_alert(ctx->rl, TLS13_ALERT_UNEXPECTED_MESSAGE);
448
449 if ((ctx->hs_msg == NULL) &&
450 ((ctx->hs_msg = tls13_handshake_msg_new()) == NULL))
451 return TLS13_IO_FAILURE;
452
453 if ((ret = tls13_handshake_msg_recv(ctx->hs_msg, ctx->rl)) !=
454 TLS13_IO_SUCCESS)
455 return ret;
456
457 if (!tls13_handshake_msg_content(ctx->hs_msg, &cbs))
458 return TLS13_IO_FAILURE;
459
460 switch(tls13_handshake_msg_type(ctx->hs_msg)) {
461 case TLS13_MT_KEY_UPDATE:
462 ret = tls13_key_update_recv(ctx, &cbs);
463 break;
464 case TLS13_MT_NEW_SESSION_TICKET:
465 ret = tls13_new_session_ticket_recv(ctx, &cbs);
466 break;
467 case TLS13_MT_CERTIFICATE_REQUEST:
468 /* XXX add support if we choose to advertise this */
469 /* FALLTHROUGH */
470 default:
471 ret = TLS13_IO_FAILURE; /* XXX send alert */
472 break;
473 }
474
475 tls13_handshake_msg_free(ctx->hs_msg);
476 ctx->hs_msg = NULL;
477 return ret;
478}
479
480void
481tls13_phh_done_cb(void *cb_arg)
482{
483 struct tls13_ctx *ctx = cb_arg;
484
485 if (ctx->key_update_request) {
486 tls13_phh_update_write_traffic_secret(ctx);
487 ctx->key_update_request = 0;
488 }
489}
490
491static const struct tls13_record_layer_callbacks tls13_rl_callbacks = {
492 .wire_read = tls13_legacy_wire_read_cb,
493 .wire_write = tls13_legacy_wire_write_cb,
494 .wire_flush = tls13_legacy_wire_flush_cb,
495
496 .alert_recv = tls13_alert_received_cb,
497 .alert_sent = tls13_alert_sent_cb,
498 .phh_recv = tls13_phh_received_cb,
499 .phh_sent = tls13_phh_done_cb,
500};
501
502struct tls13_ctx *
503tls13_ctx_new(int mode, SSL *ssl)
504{
505 struct tls13_ctx *ctx = NULL;
506
507 if ((ctx = calloc(sizeof(struct tls13_ctx), 1)) == NULL)
508 goto err;
509
510 ctx->hs = &ssl->s3->hs;
511 ctx->mode = mode;
512 ctx->ssl = ssl;
513
514 if ((ctx->rl = tls13_record_layer_new(&tls13_rl_callbacks, ctx)) == NULL)
515 goto err;
516
517 ctx->handshake_message_sent_cb = tls13_legacy_handshake_message_sent_cb;
518 ctx->handshake_message_recv_cb = tls13_legacy_handshake_message_recv_cb;
519 ctx->info_cb = tls13_legacy_info_cb;
520 ctx->ocsp_status_recv_cb = tls13_legacy_ocsp_status_recv_cb;
521
522 ctx->middlebox_compat = 1;
523
524 ssl->tls13 = ctx;
525
526 if (SSL_is_quic(ssl)) {
527 if (!tls13_quic_init(ctx))
528 goto err;
529 }
530
531 return ctx;
532
533 err:
534 tls13_ctx_free(ctx);
535
536 return NULL;
537}
538
539void
540tls13_ctx_free(struct tls13_ctx *ctx)
541{
542 if (ctx == NULL)
543 return;
544
545 tls13_error_clear(&ctx->error);
546 tls13_record_layer_free(ctx->rl);
547 tls13_handshake_msg_free(ctx->hs_msg);
548
549 freezero(ctx, sizeof(struct tls13_ctx));
550}
551
552int
553tls13_cert_add(struct tls13_ctx *ctx, CBB *cbb, X509 *cert,
554 int (*build_extensions)(SSL *s, uint16_t msg_type, CBB *cbb))
555{
556 CBB cert_data, cert_exts;
557 uint8_t *data;
558 int cert_len;
559
560 if ((cert_len = i2d_X509(cert, NULL)) < 0)
561 return 0;
562
563 if (!CBB_add_u24_length_prefixed(cbb, &cert_data))
564 return 0;
565 if (!CBB_add_space(&cert_data, &data, cert_len))
566 return 0;
567 if (i2d_X509(cert, &data) != cert_len)
568 return 0;
569 if (build_extensions != NULL) {
570 if (!build_extensions(ctx->ssl, SSL_TLSEXT_MSG_CT, cbb))
571 return 0;
572 } else {
573 if (!CBB_add_u16_length_prefixed(cbb, &cert_exts))
574 return 0;
575 }
576 if (!CBB_flush(cbb))
577 return 0;
578
579 return 1;
580}
581
582int
583tls13_synthetic_handshake_message(struct tls13_ctx *ctx)
584{
585 struct tls13_handshake_msg *hm = NULL;
586 unsigned char buf[EVP_MAX_MD_SIZE];
587 size_t hash_len;
588 CBB cbb;
589 CBS cbs;
590 SSL *s = ctx->ssl;
591 int ret = 0;
592
593 /*
594 * Replace ClientHello with synthetic handshake message - see
595 * RFC 8446 section 4.4.1.
596 */
597 if (!tls1_transcript_hash_init(s))
598 goto err;
599 if (!tls1_transcript_hash_value(s, buf, sizeof(buf), &hash_len))
600 goto err;
601
602 if ((hm = tls13_handshake_msg_new()) == NULL)
603 goto err;
604 if (!tls13_handshake_msg_start(hm, &cbb, TLS13_MT_MESSAGE_HASH))
605 goto err;
606 if (!CBB_add_bytes(&cbb, buf, hash_len))
607 goto err;
608 if (!tls13_handshake_msg_finish(hm))
609 goto err;
610
611 tls13_handshake_msg_data(hm, &cbs);
612
613 tls1_transcript_reset(ctx->ssl);
614 if (!tls1_transcript_record(ctx->ssl, CBS_data(&cbs), CBS_len(&cbs)))
615 goto err;
616
617 ret = 1;
618
619 err:
620 tls13_handshake_msg_free(hm);
621
622 return ret;
623}
624
625int
626tls13_clienthello_hash_init(struct tls13_ctx *ctx)
627{
628 if (ctx->hs->tls13.clienthello_md_ctx != NULL)
629 return 0;
630 if ((ctx->hs->tls13.clienthello_md_ctx = EVP_MD_CTX_new()) == NULL)
631 return 0;
632 if (!EVP_DigestInit_ex(ctx->hs->tls13.clienthello_md_ctx,
633 EVP_sha256(), NULL))
634 return 0;
635
636 if ((ctx->hs->tls13.clienthello_hash == NULL) &&
637 (ctx->hs->tls13.clienthello_hash = calloc(1, EVP_MAX_MD_SIZE)) ==
638 NULL)
639 return 0;
640
641 return 1;
642}
643
644void
645tls13_clienthello_hash_clear(struct ssl_handshake_tls13_st *hs) /* XXX */
646{
647 EVP_MD_CTX_free(hs->clienthello_md_ctx);
648 hs->clienthello_md_ctx = NULL;
649 freezero(hs->clienthello_hash, EVP_MAX_MD_SIZE);
650 hs->clienthello_hash = NULL;
651}
652
653int
654tls13_clienthello_hash_update_bytes(struct tls13_ctx *ctx, void *data,
655 size_t len)
656{
657 return EVP_DigestUpdate(ctx->hs->tls13.clienthello_md_ctx, data, len);
658}
659
660int
661tls13_clienthello_hash_update(struct tls13_ctx *ctx, CBS *cbs)
662{
663 return tls13_clienthello_hash_update_bytes(ctx, (void *)CBS_data(cbs),
664 CBS_len(cbs));
665}
666
667int
668tls13_clienthello_hash_finalize(struct tls13_ctx *ctx)
669{
670 if (!EVP_DigestFinal_ex(ctx->hs->tls13.clienthello_md_ctx,
671 ctx->hs->tls13.clienthello_hash,
672 &ctx->hs->tls13.clienthello_hash_len))
673 return 0;
674 EVP_MD_CTX_free(ctx->hs->tls13.clienthello_md_ctx);
675 ctx->hs->tls13.clienthello_md_ctx = NULL;
676 return 1;
677}
678
679int
680tls13_clienthello_hash_validate(struct tls13_ctx *ctx)
681{
682 unsigned char new_ch_hash[EVP_MAX_MD_SIZE];
683 unsigned int new_ch_hash_len;
684
685 if (ctx->hs->tls13.clienthello_hash == NULL)
686 return 0;
687
688 if (!EVP_DigestFinal_ex(ctx->hs->tls13.clienthello_md_ctx,
689 new_ch_hash, &new_ch_hash_len))
690 return 0;
691 EVP_MD_CTX_free(ctx->hs->tls13.clienthello_md_ctx);
692 ctx->hs->tls13.clienthello_md_ctx = NULL;
693
694 if (ctx->hs->tls13.clienthello_hash_len != new_ch_hash_len)
695 return 0;
696 if (memcmp(ctx->hs->tls13.clienthello_hash, new_ch_hash,
697 new_ch_hash_len) != 0)
698 return 0;
699
700 return 1;
701}
generated by cgit v1.2.3-55-g6feb (git 2.39.1) at 2026-02-11 16:57:10 +0000