summaryrefslogtreecommitdiff
path: root/src
diff options
context:
space:
mode:
Diffstat (limited to '')
-rw-r--r--src/lib/libssl/tls13_client.c25
-rw-r--r--src/lib/libssl/tls13_internal.h7
-rw-r--r--src/lib/libssl/tls13_lib.c45
-rw-r--r--src/lib/libssl/tls13_server.c51
4 files changed, 60 insertions, 68 deletions
diff --git a/src/lib/libssl/tls13_client.c b/src/lib/libssl/tls13_client.c
index fb21b54621..5dffd2d33a 100644
--- a/src/lib/libssl/tls13_client.c
+++ b/src/lib/libssl/tls13_client.c
@@ -1,4 +1,4 @@
1/* $OpenBSD: tls13_client.c,v 1.34 2020/01/25 14:23:27 jsing Exp $ */ 1/* $OpenBSD: tls13_client.c,v 1.35 2020/01/26 02:45:27 beck Exp $ */
2/* 2/*
3 * Copyright (c) 2018, 2019 Joel Sing <jsing@openbsd.org> 3 * Copyright (c) 2018, 2019 Joel Sing <jsing@openbsd.org>
4 * 4 *
@@ -587,22 +587,6 @@ tls13_server_certificate_recv(struct tls13_ctx *ctx, CBS *cbs)
587 return ret; 587 return ret;
588} 588}
589 589
590/*
591 * Certificate Verify padding - RFC 8446 section 4.4.3.
592 */
593static uint8_t cert_verify_pad[64] = {
594 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20,
595 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20,
596 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20,
597 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20,
598 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20,
599 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20,
600 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20,
601 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20,
602};
603
604static uint8_t server_cert_verify_context[] = "TLS 1.3, server CertificateVerify";
605
606int 590int
607tls13_server_certificate_verify_recv(struct tls13_ctx *ctx, CBS *cbs) 591tls13_server_certificate_verify_recv(struct tls13_ctx *ctx, CBS *cbs)
608{ 592{
@@ -631,10 +615,11 @@ tls13_server_certificate_verify_recv(struct tls13_ctx *ctx, CBS *cbs)
631 615
632 if (!CBB_init(&cbb, 0)) 616 if (!CBB_init(&cbb, 0))
633 goto err; 617 goto err;
634 if (!CBB_add_bytes(&cbb, cert_verify_pad, sizeof(cert_verify_pad))) 618 if (!CBB_add_bytes(&cbb, tls13_cert_verify_pad,
619 sizeof(tls13_cert_verify_pad)))
635 goto err; 620 goto err;
636 if (!CBB_add_bytes(&cbb, server_cert_verify_context, 621 if (!CBB_add_bytes(&cbb, tls13_cert_server_verify_context,
637 strlen(server_cert_verify_context))) 622 strlen(tls13_cert_server_verify_context)))
638 goto err; 623 goto err;
639 if (!CBB_add_u8(&cbb, 0)) 624 if (!CBB_add_u8(&cbb, 0))
640 goto err; 625 goto err;
diff --git a/src/lib/libssl/tls13_internal.h b/src/lib/libssl/tls13_internal.h
index 4cae2ebcce..ec58525c2b 100644
--- a/src/lib/libssl/tls13_internal.h
+++ b/src/lib/libssl/tls13_internal.h
@@ -1,4 +1,4 @@
1/* $OpenBSD: tls13_internal.h,v 1.56 2020/01/25 19:01:43 tb Exp $ */ 1/* $OpenBSD: tls13_internal.h,v 1.57 2020/01/26 02:45:27 beck Exp $ */
2/* 2/*
3 * Copyright (c) 2018 Bob Beck <beck@openbsd.org> 3 * Copyright (c) 2018 Bob Beck <beck@openbsd.org>
4 * Copyright (c) 2018 Theo Buehler <tb@openbsd.org> 4 * Copyright (c) 2018 Theo Buehler <tb@openbsd.org>
@@ -302,6 +302,8 @@ int tls13_server_finished_sent(struct tls13_ctx *ctx);
302 302
303void tls13_error_clear(struct tls13_error *error); 303void tls13_error_clear(struct tls13_error *error);
304 304
305int tls13_cert_add(CBB *cbb, X509 *cert);
306
305int tls13_error_set(struct tls13_error *error, int code, int subcode, 307int tls13_error_set(struct tls13_error *error, int code, int subcode,
306 const char *file, int line, const char *fmt, ...); 308 const char *file, int line, const char *fmt, ...);
307int tls13_error_setx(struct tls13_error *error, int code, int subcode, 309int tls13_error_setx(struct tls13_error *error, int code, int subcode,
@@ -316,6 +318,9 @@ int tls13_error_setx(struct tls13_error *error, int code, int subcode,
316 318
317extern uint8_t tls13_downgrade_12[8]; 319extern uint8_t tls13_downgrade_12[8];
318extern uint8_t tls13_downgrade_11[8]; 320extern uint8_t tls13_downgrade_11[8];
321extern uint8_t tls13_cert_verify_pad[64];
322extern uint8_t tls13_cert_client_verify_context[];
323extern uint8_t tls13_cert_server_verify_context[];
319 324
320__END_HIDDEN_DECLS 325__END_HIDDEN_DECLS
321 326
diff --git a/src/lib/libssl/tls13_lib.c b/src/lib/libssl/tls13_lib.c
index 950b5a4019..2a13e8f773 100644
--- a/src/lib/libssl/tls13_lib.c
+++ b/src/lib/libssl/tls13_lib.c
@@ -1,4 +1,4 @@
1/* $OpenBSD: tls13_lib.c,v 1.30 2020/01/25 13:11:20 tb Exp $ */ 1/* $OpenBSD: tls13_lib.c,v 1.31 2020/01/26 02:45:27 beck Exp $ */
2/* 2/*
3 * Copyright (c) 2018, 2019 Joel Sing <jsing@openbsd.org> 3 * Copyright (c) 2018, 2019 Joel Sing <jsing@openbsd.org>
4 * Copyright (c) 2019 Bob Beck <beck@openbsd.org> 4 * Copyright (c) 2019 Bob Beck <beck@openbsd.org>
@@ -607,3 +607,46 @@ tls13_legacy_shutdown(SSL *ssl)
607 607
608 return 0; 608 return 0;
609} 609}
610
611/*
612 * Certificate Verify padding - RFC 8446 section 4.4.3.
613 */
614uint8_t tls13_cert_verify_pad[64] = {
615 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20,
616 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20,
617 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20,
618 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20,
619 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20,
620 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20,
621 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20,
622 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20,
623};
624
625uint8_t tls13_cert_client_verify_context[] = "TLS 1.3, client CertificateVerify";
626uint8_t tls13_cert_server_verify_context[] = "TLS 1.3, server CertificateVerify";
627
628int
629tls13_cert_add(CBB *cbb, X509 *cert)
630{
631 CBB cert_data, cert_exts;
632 uint8_t *data;
633 int cert_len;
634
635 if ((cert_len = i2d_X509(cert, NULL)) < 0)
636 return 0;
637
638 if (!CBB_add_u24_length_prefixed(cbb, &cert_data))
639 return 0;
640 if (!CBB_add_space(&cert_data, &data, cert_len))
641 return 0;
642 if (i2d_X509(cert, &data) != cert_len)
643 return 0;
644
645 if (!CBB_add_u16_length_prefixed(cbb, &cert_exts))
646 return 0;
647
648 if (!CBB_flush(cbb))
649 return 0;
650
651 return 1;
652}
diff --git a/src/lib/libssl/tls13_server.c b/src/lib/libssl/tls13_server.c
index 628e824313..8ed2a6ea11 100644
--- a/src/lib/libssl/tls13_server.c
+++ b/src/lib/libssl/tls13_server.c
@@ -1,4 +1,4 @@
1/* $OpenBSD: tls13_server.c,v 1.16 2020/01/24 08:21:24 jsing Exp $ */ 1/* $OpenBSD: tls13_server.c,v 1.17 2020/01/26 02:45:27 beck Exp $ */
2/* 2/*
3 * Copyright (c) 2019, 2020 Joel Sing <jsing@openbsd.org> 3 * Copyright (c) 2019, 2020 Joel Sing <jsing@openbsd.org>
4 * Copyright (c) 2020 Bob Beck <beck@openbsd.org> 4 * Copyright (c) 2020 Bob Beck <beck@openbsd.org>
@@ -476,32 +476,6 @@ tls13_server_encrypted_extensions_send(struct tls13_ctx *ctx, CBB *cbb)
476 return 0; 476 return 0;
477} 477}
478 478
479static int
480tls13_cert_add(CBB *cbb, X509 *cert)
481{
482 CBB cert_data, cert_exts;
483 uint8_t *data;
484 int cert_len;
485
486 if ((cert_len = i2d_X509(cert, NULL)) < 0)
487 return 0;
488
489 if (!CBB_add_u24_length_prefixed(cbb, &cert_data))
490 return 0;
491 if (!CBB_add_space(&cert_data, &data, cert_len))
492 return 0;
493 if (i2d_X509(cert, &data) != cert_len)
494 return 0;
495
496 if (!CBB_add_u16_length_prefixed(cbb, &cert_exts))
497 return 0;
498
499 if (!CBB_flush(cbb))
500 return 0;
501
502 return 1;
503}
504
505int 479int
506tls13_server_certificate_send(struct tls13_ctx *ctx, CBB *cbb) 480tls13_server_certificate_send(struct tls13_ctx *ctx, CBB *cbb)
507{ 481{
@@ -564,22 +538,6 @@ tls13_server_certificate_request_send(struct tls13_ctx *ctx, CBB *cbb)
564 return 0; 538 return 0;
565} 539}
566 540
567/*
568 * Certificate Verify padding - RFC 8446 section 4.4.3.
569 */
570static uint8_t cert_verify_pad[64] = {
571 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20,
572 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20,
573 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20,
574 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20,
575 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20,
576 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20,
577 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20,
578 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20,
579};
580
581static uint8_t server_cert_verify_context[] = "TLS 1.3, server CertificateVerify";
582
583int 541int
584tls13_server_certificate_verify_send(struct tls13_ctx *ctx, CBB *cbb) 542tls13_server_certificate_verify_send(struct tls13_ctx *ctx, CBB *cbb)
585{ 543{
@@ -607,10 +565,11 @@ tls13_server_certificate_verify_send(struct tls13_ctx *ctx, CBB *cbb)
607 565
608 if (!CBB_init(&sig_cbb, 0)) 566 if (!CBB_init(&sig_cbb, 0))
609 goto err; 567 goto err;
610 if (!CBB_add_bytes(&sig_cbb, cert_verify_pad, sizeof(cert_verify_pad))) 568 if (!CBB_add_bytes(&sig_cbb, tls13_cert_verify_pad,
569 sizeof(tls13_cert_verify_pad)))
611 goto err; 570 goto err;
612 if (!CBB_add_bytes(&sig_cbb, server_cert_verify_context, 571 if (!CBB_add_bytes(&sig_cbb, tls13_cert_server_verify_context,
613 strlen(server_cert_verify_context))) 572 strlen(tls13_cert_server_verify_context)))
614 goto err; 573 goto err;
615 if (!CBB_add_u8(&sig_cbb, 0)) 574 if (!CBB_add_u8(&sig_cbb, 0))
616 goto err; 575 goto err;
generated by cgit v1.2.3-55-g6feb (git 2.39.1) at 2025-11-11 09:30:59 +0000