Chromium Code Reviews
chromiumcodereview-hr@appspot.gserviceaccount.com (chromiumcodereview-hr) | Please choose your nickname with Settings | Help | Chromium Project | Gerrit Changes | Sign out
(92)

Issues Search
    My Issues | Starred     Open | Closed | All

Side by Side Diff: net/third_party/nss/ssl/ssl3ext.c

Issue 992733002: Remove //net (except for Android test stuff) and sdch (Closed) Base URL: git@github.com:domokit/mojo.git@master
Patch Set: Created 5 years, 9 months ago
Use n/p to move between diff chunks; N/P to move between comments. Draft comments are only viewable by you.
Jump to:
View unified diff | Download patch
« no previous file with comments | « net/third_party/nss/ssl/ssl3ecc.c ('k') | net/third_party/nss/ssl/ssl3gthr.c » ('j') | no next file with comments »
Toggle Intra-line Diffs ('i') | Expand Comments ('e') | Collapse Comments ('c') | Show Comments Hide Comments ('s')
OLDNEW
(Empty)
1 /*
2 * SSL3 Protocol
3 *
4 * This Source Code Form is subject to the terms of the Mozilla Public
5 * License, v. 2.0. If a copy of the MPL was not distributed with this
6 * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
7
8 /* TLS extension code moved here from ssl3ecc.c */
9
10 #include "nssrenam.h"
11 #include "nss.h"
12 #include "ssl.h"
13 #include "sslimpl.h"
14 #include "sslproto.h"
15 #include "pk11pub.h"
16 #ifdef NO_PKCS11_BYPASS
17 #include "blapit.h"
18 #else
19 #include "blapi.h"
20 #endif
21 #include "prinit.h"
22
23 static unsigned char key_name[SESS_TICKET_KEY_NAME_LEN];
24 static PK11SymKey *session_ticket_enc_key_pkcs11 = NULL;
25 static PK11SymKey *session_ticket_mac_key_pkcs11 = NULL;
26
27 #ifndef NO_PKCS11_BYPASS
28 static unsigned char session_ticket_enc_key[AES_256_KEY_LENGTH];
29 static unsigned char session_ticket_mac_key[SHA256_LENGTH];
30
31 static PRBool session_ticket_keys_initialized = PR_FALSE;
32 #endif
33 static PRCallOnceType generate_session_keys_once;
34
35 /* forward static function declarations */
36 static SECStatus ssl3_ParseEncryptedSessionTicket(sslSocket *ss,
37 SECItem *data, EncryptedSessionTicket *enc_session_ticket);
38 static SECStatus ssl3_AppendToItem(SECItem *item, const unsigned char *buf,
39 PRUint32 bytes);
40 static SECStatus ssl3_AppendNumberToItem(SECItem *item, PRUint32 num,
41 PRInt32 lenSize);
42 static SECStatus ssl3_GetSessionTicketKeysPKCS11(sslSocket *ss,
43 PK11SymKey **aes_key, PK11SymKey **mac_key);
44 #ifndef NO_PKCS11_BYPASS
45 static SECStatus ssl3_GetSessionTicketKeys(const unsigned char **aes_key,
46 PRUint32 *aes_key_length, const unsigned char **mac_key,
47 PRUint32 *mac_key_length);
48 #endif
49 static PRInt32 ssl3_SendRenegotiationInfoXtn(sslSocket * ss,
50 PRBool append, PRUint32 maxBytes);
51 static SECStatus ssl3_HandleRenegotiationInfoXtn(sslSocket *ss,
52 PRUint16 ex_type, SECItem *data);
53 static SECStatus ssl3_ClientHandleNextProtoNegoXtn(sslSocket *ss,
54 PRUint16 ex_type, SECItem *data);
55 static SECStatus ssl3_ClientHandleAppProtoXtn(sslSocket *ss,
56 PRUint16 ex_type, SECItem *data);
57 static SECStatus ssl3_ServerHandleNextProtoNegoXtn(sslSocket *ss,
58 PRUint16 ex_type, SECItem *data);
59 static SECStatus ssl3_ServerHandleAppProtoXtn(sslSocket *ss, PRUint16 ex_type,
60 SECItem *data);
61 static PRInt32 ssl3_ClientSendNextProtoNegoXtn(sslSocket *ss, PRBool append,
62 PRUint32 maxBytes);
63 static PRInt32 ssl3_ClientSendAppProtoXtn(sslSocket *ss, PRBool append,
64 PRUint32 maxBytes);
65 static PRInt32 ssl3_ServerSendAppProtoXtn(sslSocket *ss, PRBool append,
66 PRUint32 maxBytes);
67 static PRInt32 ssl3_SendUseSRTPXtn(sslSocket *ss, PRBool append,
68 PRUint32 maxBytes);
69 static SECStatus ssl3_HandleUseSRTPXtn(sslSocket * ss, PRUint16 ex_type,
70 SECItem *data);
71 static SECStatus ssl3_ClientHandleChannelIDXtn(sslSocket *ss,
72 PRUint16 ex_type, SECItem *data);
73 static PRInt32 ssl3_ClientSendChannelIDXtn(sslSocket *ss, PRBool append,
74 PRUint32 maxBytes);
75 static SECStatus ssl3_ServerSendStatusRequestXtn(sslSocket * ss,
76 PRBool append, PRUint32 maxBytes);
77 static SECStatus ssl3_ServerHandleStatusRequestXtn(sslSocket *ss,
78 PRUint16 ex_type, SECItem *data);
79 static SECStatus ssl3_ClientHandleStatusRequestXtn(sslSocket *ss,
80 PRUint16 ex_type,
81 SECItem *data);
82 static PRInt32 ssl3_ClientSendStatusRequestXtn(sslSocket * ss, PRBool append,
83 PRUint32 maxBytes);
84 static PRInt32 ssl3_ClientSendSigAlgsXtn(sslSocket *ss, PRBool append,
85 PRUint32 maxBytes);
86 static SECStatus ssl3_ServerHandleSigAlgsXtn(sslSocket *ss, PRUint16 ex_type,
87 SECItem *data);
88 static PRInt32 ssl3_ClientSendSignedCertTimestampXtn(sslSocket *ss,
89 PRBool append,
90 PRUint32 maxBytes);
91 static SECStatus ssl3_ClientHandleSignedCertTimestampXtn(sslSocket *ss,
92 PRUint16 ex_type,
93 SECItem *data);
94
95 /*
96 * Write bytes. Using this function means the SECItem structure
97 * cannot be freed. The caller is expected to call this function
98 * on a shallow copy of the structure.
99 */
100 static SECStatus
101 ssl3_AppendToItem(SECItem *item, const unsigned char *buf, PRUint32 bytes)
102 {
103 if (bytes > item->len)
104 return SECFailure;
105
106 PORT_Memcpy(item->data, buf, bytes);
107 item->data += bytes;
108 item->len -= bytes;
109 return SECSuccess;
110 }
111
112 /*
113 * Write a number in network byte order. Using this function means the
114 * SECItem structure cannot be freed. The caller is expected to call
115 * this function on a shallow copy of the structure.
116 */
117 static SECStatus
118 ssl3_AppendNumberToItem(SECItem *item, PRUint32 num, PRInt32 lenSize)
119 {
120 SECStatus rv;
121 PRUint8 b[4];
122 PRUint8 * p = b;
123
124 switch (lenSize) {
125 case 4:
126 *p++ = (PRUint8) (num >> 24);
127 case 3:
128 *p++ = (PRUint8) (num >> 16);
129 case 2:
130 *p++ = (PRUint8) (num >> 8);
131 case 1:
132 *p = (PRUint8) num;
133 }
134 rv = ssl3_AppendToItem(item, &b[0], lenSize);
135 return rv;
136 }
137
138 static SECStatus ssl3_SessionTicketShutdown(void* appData, void* nssData)
139 {
140 if (session_ticket_enc_key_pkcs11) {
141 PK11_FreeSymKey(session_ticket_enc_key_pkcs11);
142 session_ticket_enc_key_pkcs11 = NULL;
143 }
144 if (session_ticket_mac_key_pkcs11) {
145 PK11_FreeSymKey(session_ticket_mac_key_pkcs11);
146 session_ticket_mac_key_pkcs11 = NULL;
147 }
148 PORT_Memset(&generate_session_keys_once, 0,
149 sizeof(generate_session_keys_once));
150 return SECSuccess;
151 }
152
153
154 static PRStatus
155 ssl3_GenerateSessionTicketKeysPKCS11(void *data)
156 {
157 SECStatus rv;
158 sslSocket *ss = (sslSocket *)data;
159 SECKEYPrivateKey *svrPrivKey = ss->serverCerts[kt_rsa].SERVERKEY;
160 SECKEYPublicKey *svrPubKey = ss->serverCerts[kt_rsa].serverKeyPair->pubKey;
161
162 if (svrPrivKey == NULL || svrPubKey == NULL) {
163 SSL_DBG(("%d: SSL[%d]: Pub or priv key(s) is NULL.",
164 SSL_GETPID(), ss->fd));
165 goto loser;
166 }
167
168 /* Get a copy of the session keys from shared memory. */
169 PORT_Memcpy(key_name, SESS_TICKET_KEY_NAME_PREFIX,
170 sizeof(SESS_TICKET_KEY_NAME_PREFIX));
171 if (!ssl_GetSessionTicketKeysPKCS11(svrPrivKey, svrPubKey,
172 ss->pkcs11PinArg, &key_name[SESS_TICKET_KEY_NAME_PREFIX_LEN],
173 &session_ticket_enc_key_pkcs11, &session_ticket_mac_key_pkcs11))
174 return PR_FAILURE;
175
176 rv = NSS_RegisterShutdown(ssl3_SessionTicketShutdown, NULL);
177 if (rv != SECSuccess)
178 goto loser;
179
180 return PR_SUCCESS;
181
182 loser:
183 ssl3_SessionTicketShutdown(NULL, NULL);
184 return PR_FAILURE;
185 }
186
187 static SECStatus
188 ssl3_GetSessionTicketKeysPKCS11(sslSocket *ss, PK11SymKey **aes_key,
189 PK11SymKey **mac_key)
190 {
191 if (PR_CallOnceWithArg(&generate_session_keys_once,
192 ssl3_GenerateSessionTicketKeysPKCS11, ss) != PR_SUCCESS)
193 return SECFailure;
194
195 if (session_ticket_enc_key_pkcs11 == NULL ||
196 session_ticket_mac_key_pkcs11 == NULL)
197 return SECFailure;
198
199 *aes_key = session_ticket_enc_key_pkcs11;
200 *mac_key = session_ticket_mac_key_pkcs11;
201 return SECSuccess;
202 }
203
204 #ifndef NO_PKCS11_BYPASS
205 static PRStatus
206 ssl3_GenerateSessionTicketKeys(void)
207 {
208 PORT_Memcpy(key_name, SESS_TICKET_KEY_NAME_PREFIX,
209 sizeof(SESS_TICKET_KEY_NAME_PREFIX));
210
211 if (!ssl_GetSessionTicketKeys(&key_name[SESS_TICKET_KEY_NAME_PREFIX_LEN],
212 session_ticket_enc_key, session_ticket_mac_key))
213 return PR_FAILURE;
214
215 session_ticket_keys_initialized = PR_TRUE;
216 return PR_SUCCESS;
217 }
218
219 static SECStatus
220 ssl3_GetSessionTicketKeys(const unsigned char **aes_key,
221 PRUint32 *aes_key_length, const unsigned char **mac_key,
222 PRUint32 *mac_key_length)
223 {
224 if (PR_CallOnce(&generate_session_keys_once,
225 ssl3_GenerateSessionTicketKeys) != PR_SUCCESS)
226 return SECFailure;
227
228 if (!session_ticket_keys_initialized)
229 return SECFailure;
230
231 *aes_key = session_ticket_enc_key;
232 *aes_key_length = sizeof(session_ticket_enc_key);
233 *mac_key = session_ticket_mac_key;
234 *mac_key_length = sizeof(session_ticket_mac_key);
235
236 return SECSuccess;
237 }
238 #endif
239
240 /* Table of handlers for received TLS hello extensions, one per extension.
241 * In the second generation, this table will be dynamic, and functions
242 * will be registered here.
243 */
244 /* This table is used by the server, to handle client hello extensions. */
245 static const ssl3HelloExtensionHandler clientHelloHandlers[] = {
246 { ssl_server_name_xtn, &ssl3_HandleServerNameXtn },
247 #ifdef NSS_ENABLE_ECC
248 { ssl_elliptic_curves_xtn, &ssl3_HandleSupportedCurvesXtn },
249 { ssl_ec_point_formats_xtn, &ssl3_HandleSupportedPointFormatsXtn },
250 #endif
251 { ssl_session_ticket_xtn, &ssl3_ServerHandleSessionTicketXtn },
252 { ssl_renegotiation_info_xtn, &ssl3_HandleRenegotiationInfoXtn },
253 { ssl_next_proto_nego_xtn, &ssl3_ServerHandleNextProtoNegoXtn },
254 { ssl_app_layer_protocol_xtn, &ssl3_ServerHandleAppProtoXtn },
255 { ssl_use_srtp_xtn, &ssl3_HandleUseSRTPXtn },
256 { ssl_cert_status_xtn, &ssl3_ServerHandleStatusRequestXtn },
257 { ssl_signature_algorithms_xtn, &ssl3_ServerHandleSigAlgsXtn },
258 { -1, NULL }
259 };
260
261 /* These two tables are used by the client, to handle server hello
262 * extensions. */
263 static const ssl3HelloExtensionHandler serverHelloHandlersTLS[] = {
264 { ssl_server_name_xtn, &ssl3_HandleServerNameXtn },
265 /* TODO: add a handler for ssl_ec_point_formats_xtn */
266 { ssl_session_ticket_xtn, &ssl3_ClientHandleSessionTicketXtn },
267 { ssl_renegotiation_info_xtn, &ssl3_HandleRenegotiationInfoXtn },
268 { ssl_next_proto_nego_xtn, &ssl3_ClientHandleNextProtoNegoXtn },
269 { ssl_app_layer_protocol_xtn, &ssl3_ClientHandleAppProtoXtn },
270 { ssl_use_srtp_xtn, &ssl3_HandleUseSRTPXtn },
271 { ssl_channel_id_xtn, &ssl3_ClientHandleChannelIDXtn },
272 { ssl_cert_status_xtn, &ssl3_ClientHandleStatusRequestXtn },
273 { ssl_signed_certificate_timestamp_xtn,
274 &ssl3_ClientHandleSignedCertTimestampXtn },
275 { -1, NULL }
276 };
277
278 static const ssl3HelloExtensionHandler serverHelloHandlersSSL3[] = {
279 { ssl_renegotiation_info_xtn, &ssl3_HandleRenegotiationInfoXtn },
280 { -1, NULL }
281 };
282
283 /* Tables of functions to format TLS hello extensions, one function per
284 * extension.
285 * These static tables are for the formatting of client hello extensions.
286 * The server's table of hello senders is dynamic, in the socket struct,
287 * and sender functions are registered there.
288 */
289 static const
290 ssl3HelloExtensionSender clientHelloSendersTLS[SSL_MAX_EXTENSIONS] = {
291 { ssl_server_name_xtn, &ssl3_SendServerNameXtn },
292 { ssl_renegotiation_info_xtn, &ssl3_SendRenegotiationInfoXtn },
293 #ifdef NSS_ENABLE_ECC
294 { ssl_elliptic_curves_xtn, &ssl3_SendSupportedCurvesXtn },
295 { ssl_ec_point_formats_xtn, &ssl3_SendSupportedPointFormatsXtn },
296 #endif
297 { ssl_session_ticket_xtn, &ssl3_SendSessionTicketXtn },
298 { ssl_next_proto_nego_xtn, &ssl3_ClientSendNextProtoNegoXtn },
299 { ssl_app_layer_protocol_xtn, &ssl3_ClientSendAppProtoXtn },
300 { ssl_use_srtp_xtn, &ssl3_SendUseSRTPXtn },
301 { ssl_channel_id_xtn, &ssl3_ClientSendChannelIDXtn },
302 { ssl_cert_status_xtn, &ssl3_ClientSendStatusRequestXtn },
303 { ssl_signed_certificate_timestamp_xtn,
304 &ssl3_ClientSendSignedCertTimestampXtn },
305 /* WebSphere Application Server 7.0 is intolerant to the last extension
306 * being zero-length. It is not intolerant of TLS 1.2, so move
307 * signature_algorithms to the end. */
308 { ssl_signature_algorithms_xtn, &ssl3_ClientSendSigAlgsXtn }
309 /* any extra entries will appear as { 0, NULL } */
310 };
311
312 static const
313 ssl3HelloExtensionSender clientHelloSendersSSL3[SSL_MAX_EXTENSIONS] = {
314 { ssl_renegotiation_info_xtn, &ssl3_SendRenegotiationInfoXtn }
315 /* any extra entries will appear as { 0, NULL } */
316 };
317
318 static PRBool
319 arrayContainsExtension(const PRUint16 *array, PRUint32 len, PRUint16 ex_type)
320 {
321 int i;
322 for (i = 0; i < len; i++) {
323 if (ex_type == array[i])
324 return PR_TRUE;
325 }
326 return PR_FALSE;
327 }
328
329 PRBool
330 ssl3_ExtensionNegotiated(sslSocket *ss, PRUint16 ex_type) {
331 TLSExtensionData *xtnData = &ss->xtnData;
332 return arrayContainsExtension(xtnData->negotiated,
333 xtnData->numNegotiated, ex_type);
334 }
335
336 static PRBool
337 ssl3_ClientExtensionAdvertised(sslSocket *ss, PRUint16 ex_type) {
338 TLSExtensionData *xtnData = &ss->xtnData;
339 return arrayContainsExtension(xtnData->advertised,
340 xtnData->numAdvertised, ex_type);
341 }
342
343 /* Format an SNI extension, using the name from the socket's URL,
344 * unless that name is a dotted decimal string.
345 * Used by client and server.
346 */
347 PRInt32
348 ssl3_SendServerNameXtn(sslSocket * ss, PRBool append,
349 PRUint32 maxBytes)
350 {
351 SECStatus rv;
352 if (!ss)
353 return 0;
354 if (!ss->sec.isServer) {
355 PRUint32 len;
356 PRNetAddr netAddr;
357
358 /* must have a hostname */
359 if (!ss->url || !ss->url[0])
360 return 0;
361 /* must not be an IPv4 or IPv6 address */
362 if (PR_SUCCESS == PR_StringToNetAddr(ss->url, &netAddr)) {
363 /* is an IP address (v4 or v6) */
364 return 0;
365 }
366 len = PORT_Strlen(ss->url);
367 if (append && maxBytes >= len + 9) {
368 /* extension_type */
369 rv = ssl3_AppendHandshakeNumber(ss, ssl_server_name_xtn, 2);
370 if (rv != SECSuccess) return -1;
371 /* length of extension_data */
372 rv = ssl3_AppendHandshakeNumber(ss, len + 5, 2);
373 if (rv != SECSuccess) return -1;
374 /* length of server_name_list */
375 rv = ssl3_AppendHandshakeNumber(ss, len + 3, 2);
376 if (rv != SECSuccess) return -1;
377 /* Name Type (sni_host_name) */
378 rv = ssl3_AppendHandshake(ss, "\0", 1);
379 if (rv != SECSuccess) return -1;
380 /* HostName (length and value) */
381 rv = ssl3_AppendHandshakeVariable(ss, (PRUint8 *)ss->url, len, 2);
382 if (rv != SECSuccess) return -1;
383 if (!ss->sec.isServer) {
384 TLSExtensionData *xtnData = &ss->xtnData;
385 xtnData->advertised[xtnData->numAdvertised++] =
386 ssl_server_name_xtn;
387 }
388 }
389 return len + 9;
390 }
391 /* Server side */
392 if (append && maxBytes >= 4) {
393 rv = ssl3_AppendHandshakeNumber(ss, ssl_server_name_xtn, 2);
394 if (rv != SECSuccess) return -1;
395 /* length of extension_data */
396 rv = ssl3_AppendHandshakeNumber(ss, 0, 2);
397 if (rv != SECSuccess) return -1;
398 }
399 return 4;
400 }
401
402 /* handle an incoming SNI extension, by ignoring it. */
403 SECStatus
404 ssl3_HandleServerNameXtn(sslSocket * ss, PRUint16 ex_type, SECItem *data)
405 {
406 SECItem *names = NULL;
407 PRUint32 listCount = 0, namesPos = 0, i;
408 TLSExtensionData *xtnData = &ss->xtnData;
409 SECItem ldata;
410 PRInt32 listLenBytes = 0;
411
412 if (!ss->sec.isServer) {
413 /* Verify extension_data is empty. */
414 if (data->data || data->len ||
415 !ssl3_ExtensionNegotiated(ss, ssl_server_name_xtn)) {
416 /* malformed or was not initiated by the client.*/
417 return SECFailure;
418 }
419 return SECSuccess;
420 }
421
422 /* Server side - consume client data and register server sender. */
423 /* do not parse the data if don't have user extension handling function. */
424 if (!ss->sniSocketConfig) {
425 return SECSuccess;
426 }
427 /* length of server_name_list */
428 listLenBytes = ssl3_ConsumeHandshakeNumber(ss, 2, &data->data, &data->len);
429 if (listLenBytes == 0 || listLenBytes != data->len) {
430 return SECFailure;
431 }
432 ldata = *data;
433 /* Calculate the size of the array.*/
434 while (listLenBytes > 0) {
435 SECItem litem;
436 SECStatus rv;
437 PRInt32 type;
438 /* Name Type (sni_host_name) */
439 type = ssl3_ConsumeHandshakeNumber(ss, 1, &ldata.data, &ldata.len);
440 if (!ldata.len) {
441 return SECFailure;
442 }
443 rv = ssl3_ConsumeHandshakeVariable(ss, &litem, 2, &ldata.data, &ldata.le n);
444 if (rv != SECSuccess) {
445 return SECFailure;
446 }
447 /* Adjust total length for cunsumed item, item len and type.*/
448 listLenBytes -= litem.len + 3;
449 if (listLenBytes > 0 && !ldata.len) {
450 return SECFailure;
451 }
452 listCount += 1;
453 }
454 if (!listCount) {
455 return SECFailure;
456 }
457 names = PORT_ZNewArray(SECItem, listCount);
458 if (!names) {
459 return SECFailure;
460 }
461 for (i = 0;i < listCount;i++) {
462 int j;
463 PRInt32 type;
464 SECStatus rv;
465 PRBool nametypePresent = PR_FALSE;
466 /* Name Type (sni_host_name) */
467 type = ssl3_ConsumeHandshakeNumber(ss, 1, &data->data, &data->len);
468 /* Check if we have such type in the list */
469 for (j = 0;j < listCount && names[j].data;j++) {
470 if (names[j].type == type) {
471 nametypePresent = PR_TRUE;
472 break;
473 }
474 }
475 /* HostName (length and value) */
476 rv = ssl3_ConsumeHandshakeVariable(ss, &names[namesPos], 2,
477 &data->data, &data->len);
478 if (rv != SECSuccess) {
479 goto loser;
480 }
481 if (nametypePresent == PR_FALSE) {
482 namesPos += 1;
483 }
484 }
485 /* Free old and set the new data. */
486 if (xtnData->sniNameArr) {
487 PORT_Free(ss->xtnData.sniNameArr);
488 }
489 xtnData->sniNameArr = names;
490 xtnData->sniNameArrSize = namesPos;
491 xtnData->negotiated[xtnData->numNegotiated++] = ssl_server_name_xtn;
492
493 return SECSuccess;
494
495 loser:
496 PORT_Free(names);
497 return SECFailure;
498 }
499
500 /* Called by both clients and servers.
501 * Clients sends a filled in session ticket if one is available, and otherwise
502 * sends an empty ticket. Servers always send empty tickets.
503 */
504 PRInt32
505 ssl3_SendSessionTicketXtn(
506 sslSocket * ss,
507 PRBool append,
508 PRUint32 maxBytes)
509 {
510 PRInt32 extension_length;
511 NewSessionTicket *session_ticket = NULL;
512 sslSessionID *sid = ss->sec.ci.sid;
513
514 /* Ignore the SessionTicket extension if processing is disabled. */
515 if (!ss->opt.enableSessionTickets)
516 return 0;
517
518 /* Empty extension length = extension_type (2-bytes) +
519 * length(extension_data) (2-bytes)
520 */
521 extension_length = 4;
522
523 /* If we are a client then send a session ticket if one is availble.
524 * Servers that support the extension and are willing to negotiate the
525 * the extension always respond with an empty extension.
526 */
527 if (!ss->sec.isServer) {
528 /* The caller must be holding sid->u.ssl3.lock for reading. We cannot
529 * just acquire and release the lock within this function because the
530 * caller will call this function twice, and we need the inputs to be
531 * consistent between the two calls. Note that currently the caller
532 * will only be holding the lock when we are the client and when we're
533 * attempting to resume an existing session.
534 */
535
536 session_ticket = &sid->u.ssl3.locked.sessionTicket;
537 if (session_ticket->ticket.data) {
538 if (ss->xtnData.ticketTimestampVerified) {
539 extension_length += session_ticket->ticket.len;
540 } else if (!append &&
541 (session_ticket->ticket_lifetime_hint == 0 ||
542 (session_ticket->ticket_lifetime_hint +
543 session_ticket->received_timestamp > ssl_Time()))) {
544 extension_length += session_ticket->ticket.len;
545 ss->xtnData.ticketTimestampVerified = PR_TRUE;
546 }
547 }
548 }
549
550 if (append && maxBytes >= extension_length) {
551 SECStatus rv;
552 /* extension_type */
553 rv = ssl3_AppendHandshakeNumber(ss, ssl_session_ticket_xtn, 2);
554 if (rv != SECSuccess)
555 goto loser;
556 if (session_ticket && session_ticket->ticket.data &&
557 ss->xtnData.ticketTimestampVerified) {
558 rv = ssl3_AppendHandshakeVariable(ss, session_ticket->ticket.data,
559 session_ticket->ticket.len, 2);
560 ss->xtnData.ticketTimestampVerified = PR_FALSE;
561 ss->xtnData.sentSessionTicketInClientHello = PR_TRUE;
562 } else {
563 rv = ssl3_AppendHandshakeNumber(ss, 0, 2);
564 }
565 if (rv != SECSuccess)
566 goto loser;
567
568 if (!ss->sec.isServer) {
569 TLSExtensionData *xtnData = &ss->xtnData;
570 xtnData->advertised[xtnData->numAdvertised++] =
571 ssl_session_ticket_xtn;
572 }
573 } else if (maxBytes < extension_length) {
574 PORT_Assert(0);
575 return 0;
576 }
577 return extension_length;
578
579 loser:
580 ss->xtnData.ticketTimestampVerified = PR_FALSE;
581 return -1;
582 }
583
584 /* handle an incoming Next Protocol Negotiation extension. */
585 static SECStatus
586 ssl3_ServerHandleNextProtoNegoXtn(sslSocket * ss, PRUint16 ex_type,
587 SECItem *data)
588 {
589 if (ss->firstHsDone || data->len != 0) {
590 /* Clients MUST send an empty NPN extension, if any. */
591 PORT_SetError(SSL_ERROR_NEXT_PROTOCOL_DATA_INVALID);
592 return SECFailure;
593 }
594
595 ss->xtnData.negotiated[ss->xtnData.numNegotiated++] = ex_type;
596
597 /* TODO: server side NPN support would require calling
598 * ssl3_RegisterServerHelloExtensionSender here in order to echo the
599 * extension back to the client. */
600
601 return SECSuccess;
602 }
603
604 /* ssl3_ValidateNextProtoNego checks that the given block of data is valid: none
605 * of the lengths may be 0 and the sum of the lengths must equal the length of
606 * the block. */
607 SECStatus
608 ssl3_ValidateNextProtoNego(const unsigned char* data, unsigned int length)
609 {
610 unsigned int offset = 0;
611
612 while (offset < length) {
613 unsigned int newOffset = offset + 1 + (unsigned int) data[offset];
614 /* Reject embedded nulls to protect against buggy applications that
615 * store protocol identifiers in null-terminated strings.
616 */
617 if (newOffset > length || data[offset] == 0) {
618 PORT_SetError(SSL_ERROR_NEXT_PROTOCOL_DATA_INVALID);
619 return SECFailure;
620 }
621 offset = newOffset;
622 }
623
624 if (offset > length) {
625 PORT_SetError(SSL_ERROR_NEXT_PROTOCOL_DATA_INVALID);
626 return SECFailure;
627 }
628
629 return SECSuccess;
630 }
631
632 /* protocol selection handler for ALPN (server side) and NPN (client side) */
633 static SECStatus
634 ssl3_SelectAppProtocol(sslSocket *ss, PRUint16 ex_type, SECItem *data)
635 {
636 SECStatus rv;
637 unsigned char resultBuffer[255];
638 SECItem result = { siBuffer, resultBuffer, 0 };
639
640 rv = ssl3_ValidateNextProtoNego(data->data, data->len);
641 if (rv != SECSuccess)
642 return rv;
643
644 PORT_Assert(ss->nextProtoCallback);
645 rv = ss->nextProtoCallback(ss->nextProtoArg, ss->fd, data->data, data->len,
646 result.data, &result.len, sizeof resultBuffer);
647 if (rv != SECSuccess)
648 return rv;
649 /* If the callback wrote more than allowed to |result| it has corrupted our
650 * stack. */
651 if (result.len > sizeof resultBuffer) {
652 PORT_SetError(SEC_ERROR_OUTPUT_LEN);
653 return SECFailure;
654 }
655
656 if (ex_type == ssl_app_layer_protocol_xtn &&
657 ss->ssl3.nextProtoState != SSL_NEXT_PROTO_NEGOTIATED) {
658 /* The callback might say OK, but then it's picked a default.
659 * That's OK for NPN, but not ALPN. */
660 SECITEM_FreeItem(&ss->ssl3.nextProto, PR_FALSE);
661 PORT_SetError(SSL_ERROR_NEXT_PROTOCOL_NO_PROTOCOL);
662 (void)SSL3_SendAlert(ss, alert_fatal, no_application_protocol);
663 return SECFailure;
664 }
665
666 ss->xtnData.negotiated[ss->xtnData.numNegotiated++] = ex_type;
667
668 SECITEM_FreeItem(&ss->ssl3.nextProto, PR_FALSE);
669 return SECITEM_CopyItem(NULL, &ss->ssl3.nextProto, &result);
670 }
671
672 /* handle an incoming ALPN extension at the server */
673 static SECStatus
674 ssl3_ServerHandleAppProtoXtn(sslSocket *ss, PRUint16 ex_type, SECItem *data)
675 {
676 int count;
677 SECStatus rv;
678
679 /* We expressly don't want to allow ALPN on renegotiation,
680 * despite it being permitted by the spec. */
681 if (ss->firstHsDone || data->len == 0) {
682 /* Clients MUST send a non-empty ALPN extension. */
683 PORT_SetError(SSL_ERROR_NEXT_PROTOCOL_DATA_INVALID);
684 return SECFailure;
685 }
686
687 /* unlike NPN, ALPN has extra redundant length information so that
688 * the extension is the same in both ClientHello and ServerHello */
689 count = ssl3_ConsumeHandshakeNumber(ss, 2, &data->data, &data->len);
690 if (count < 0) {
691 return SECFailure; /* fatal alert was sent */
692 }
693 if (count != data->len) {
694 return ssl3_DecodeError(ss);
695 }
696
697 if (!ss->nextProtoCallback) {
698 /* we're not configured for it */
699 return SECSuccess;
700 }
701
702 rv = ssl3_SelectAppProtocol(ss, ex_type, data);
703 if (rv != SECSuccess) {
704 return rv;
705 }
706
707 /* prepare to send back a response, if we negotiated */
708 if (ss->ssl3.nextProtoState == SSL_NEXT_PROTO_NEGOTIATED) {
709 return ssl3_RegisterServerHelloExtensionSender(
710 ss, ex_type, ssl3_ServerSendAppProtoXtn);
711 }
712 return SECSuccess;
713 }
714
715 static SECStatus
716 ssl3_ClientHandleNextProtoNegoXtn(sslSocket *ss, PRUint16 ex_type,
717 SECItem *data)
718 {
719 PORT_Assert(!ss->firstHsDone);
720
721 if (ssl3_ExtensionNegotiated(ss, ssl_app_layer_protocol_xtn)) {
722 /* If the server negotiated ALPN then it has already told us what protoc ol
723 * to use, so it doesn't make sense for us to try to negotiate a differe nt
724 * one by sending the NPN handshake message. However, if we've negotiate d
725 * NPN then we're required to send the NPN handshake message. Thus, thes e
726 * two extensions cannot both be negotiated on the same connection. */
727 PORT_SetError(SEC_ERROR_LIBRARY_FAILURE);
728 return SECFailure;
729 }
730
731 /* We should only get this call if we sent the extension, so
732 * ss->nextProtoCallback needs to be non-NULL. However, it is possible
733 * that an application erroneously cleared the callback between the time
734 * we sent the ClientHello and now. */
735 if (!ss->nextProtoCallback) {
736 PORT_SetError(SSL_ERROR_NEXT_PROTOCOL_NO_CALLBACK);
737 return SECFailure;
738 }
739
740 return ssl3_SelectAppProtocol(ss, ex_type, data);
741 }
742
743 static SECStatus
744 ssl3_ClientHandleAppProtoXtn(sslSocket *ss, PRUint16 ex_type, SECItem *data)
745 {
746 const unsigned char* d = data->data;
747 PRUint16 name_list_len;
748 SECItem protocol_name;
749
750 if (ssl3_ExtensionNegotiated(ss, ssl_next_proto_nego_xtn)) {
751 PORT_SetError(SEC_ERROR_LIBRARY_FAILURE);
752 return SECFailure;
753 }
754
755 /* The extension data from the server has the following format:
756 * uint16 name_list_len;
757 * uint8 len;
758 * uint8 protocol_name[len]; */
759 if (data->len < 4 || data->len > 2 + 1 + 255) {
760 PORT_SetError(SSL_ERROR_NEXT_PROTOCOL_DATA_INVALID);
761 return SECFailure;
762 }
763
764 name_list_len = ((PRUint16) d[0]) << 8 |
765 ((PRUint16) d[1]);
766 if (name_list_len != data->len - 2 || d[2] != data->len - 3) {
767 PORT_SetError(SSL_ERROR_NEXT_PROTOCOL_DATA_INVALID);
768 return SECFailure;
769 }
770
771 protocol_name.data = data->data + 3;
772 protocol_name.len = data->len - 3;
773
774 SECITEM_FreeItem(&ss->ssl3.nextProto, PR_FALSE);
775 ss->ssl3.nextProtoState = SSL_NEXT_PROTO_SELECTED;
776 ss->xtnData.negotiated[ss->xtnData.numNegotiated++] = ex_type;
777 return SECITEM_CopyItem(NULL, &ss->ssl3.nextProto, &protocol_name);
778 }
779
780 static PRInt32
781 ssl3_ClientSendNextProtoNegoXtn(sslSocket * ss, PRBool append,
782 PRUint32 maxBytes)
783 {
784 PRInt32 extension_length;
785
786 /* Renegotiations do not send this extension. */
787 if (!ss->opt.enableNPN || !ss->nextProtoCallback || ss->firstHsDone) {
788 return 0;
789 }
790
791 extension_length = 4;
792
793 if (append && maxBytes >= extension_length) {
794 SECStatus rv;
795 rv = ssl3_AppendHandshakeNumber(ss, ssl_next_proto_nego_xtn, 2);
796 if (rv != SECSuccess)
797 goto loser;
798 rv = ssl3_AppendHandshakeNumber(ss, 0, 2);
799 if (rv != SECSuccess)
800 goto loser;
801 ss->xtnData.advertised[ss->xtnData.numAdvertised++] =
802 ssl_next_proto_nego_xtn;
803 } else if (maxBytes < extension_length) {
804 return 0;
805 }
806
807 return extension_length;
808
809 loser:
810 return -1;
811 }
812
813 static PRInt32
814 ssl3_ClientSendAppProtoXtn(sslSocket * ss, PRBool append, PRUint32 maxBytes)
815 {
816 PRInt32 extension_length;
817 unsigned char *alpn_protos = NULL;
818
819 /* Renegotiations do not send this extension. */
820 if (!ss->opt.enableALPN || !ss->opt.nextProtoNego.data || ss->firstHsDone) {
821 return 0;
822 }
823
824 extension_length = 2 /* extension type */ + 2 /* extension length */ +
825 2 /* protocol name list length */ +
826 ss->opt.nextProtoNego.len;
827
828 if (append && maxBytes >= extension_length) {
829 /* NPN requires that the client's fallback protocol is first in the
830 * list. However, ALPN sends protocols in preference order. So we
831 * allocate a buffer and move the first protocol to the end of the
832 * list. */
833 SECStatus rv;
834 const unsigned int len = ss->opt.nextProtoNego.len;
835
836 alpn_protos = PORT_Alloc(len);
837 if (alpn_protos == NULL) {
838 return SECFailure;
839 }
840 if (len > 0) {
841 /* Each protocol string is prefixed with a single byte length. */
842 unsigned int i = ss->opt.nextProtoNego.data[0] + 1;
843 if (i <= len) {
844 memcpy(alpn_protos, &ss->opt.nextProtoNego.data[i], len - i);
845 memcpy(alpn_protos + len - i, ss->opt.nextProtoNego.data, i);
846 } else {
847 /* This seems to be invalid data so we'll send as-is. */
848 memcpy(alpn_protos, ss->opt.nextProtoNego.data, len);
849 }
850 }
851
852 rv = ssl3_AppendHandshakeNumber(ss, ssl_app_layer_protocol_xtn, 2);
853 if (rv != SECSuccess) {
854 goto loser;
855 }
856 rv = ssl3_AppendHandshakeNumber(ss, extension_length - 4, 2);
857 if (rv != SECSuccess) {
858 goto loser;
859 }
860 rv = ssl3_AppendHandshakeVariable(ss, alpn_protos, len, 2);
861 PORT_Free(alpn_protos);
862 alpn_protos = NULL;
863 if (rv != SECSuccess) {
864 goto loser;
865 }
866 ss->xtnData.advertised[ss->xtnData.numAdvertised++] =
867 ssl_app_layer_protocol_xtn;
868 } else if (maxBytes < extension_length) {
869 return 0;
870 }
871
872 return extension_length;
873
874 loser:
875 if (alpn_protos) {
876 PORT_Free(alpn_protos);
877 }
878 return -1;
879 }
880
881 static PRInt32
882 ssl3_ServerSendAppProtoXtn(sslSocket * ss, PRBool append, PRUint32 maxBytes)
883 {
884 PRInt32 extension_length;
885
886 PORT_Assert(ss->opt.enableALPN);
887 PORT_Assert(ss->ssl3.nextProto.data);
888 PORT_Assert(ss->ssl3.nextProto.len > 0);
889 PORT_Assert(ss->ssl3.nextProtoState == SSL_NEXT_PROTO_NEGOTIATED);
890 PORT_Assert(!ss->firstHsDone);
891
892 extension_length = 2 /* extension type */ + 2 /* extension length */ +
893 2 /* protocol name list */ + 1 /* name length */ +
894 ss->ssl3.nextProto.len;
895
896 if (append && maxBytes >= extension_length) {
897 SECStatus rv;
898 rv = ssl3_AppendHandshakeNumber(ss, ssl_app_layer_protocol_xtn, 2);
899 if (rv != SECSuccess) {
900 return -1;
901 }
902 rv = ssl3_AppendHandshakeNumber(ss, extension_length - 4, 2);
903 if (rv != SECSuccess) {
904 return -1;
905 }
906 rv = ssl3_AppendHandshakeNumber(ss, ss->ssl3.nextProto.len + 1, 2);
907 if (rv != SECSuccess) {
908 return -1;
909 }
910 rv = ssl3_AppendHandshakeVariable(ss, ss->ssl3.nextProto.data,
911 ss->ssl3.nextProto.len, 1);
912 if (rv != SECSuccess) {
913 return -1;
914 }
915 } else if (maxBytes < extension_length) {
916 return 0;
917 }
918
919 return extension_length;
920 }
921
922 static SECStatus
923 ssl3_ClientHandleChannelIDXtn(sslSocket *ss, PRUint16 ex_type,
924 SECItem *data)
925 {
926 PORT_Assert(ss->getChannelID != NULL);
927
928 if (data->len) {
929 PORT_SetError(SSL_ERROR_BAD_CHANNEL_ID_DATA);
930 return SECFailure;
931 }
932 ss->xtnData.negotiated[ss->xtnData.numNegotiated++] = ex_type;
933 return SECSuccess;
934 }
935
936 static PRInt32
937 ssl3_ClientSendChannelIDXtn(sslSocket * ss, PRBool append,
938 PRUint32 maxBytes)
939 {
940 PRInt32 extension_length = 4;
941
942 if (!ss->getChannelID)
943 return 0;
944
945 if (maxBytes < extension_length) {
946 PORT_Assert(0);
947 return 0;
948 }
949
950 if (ss->sec.ci.sid->cached != never_cached &&
951 ss->sec.ci.sid->u.ssl3.originalHandshakeHash.len == 0) {
952 /* We can't do ChannelID on a connection if we're resuming and didn't
953 * do ChannelID on the original connection: without ChannelID on the
954 * original connection we didn't record the handshake hashes needed for
955 * the signature. */
956 return 0;
957 }
958
959 if (append) {
960 SECStatus rv;
961 rv = ssl3_AppendHandshakeNumber(ss, ssl_channel_id_xtn, 2);
962 if (rv != SECSuccess)
963 goto loser;
964 rv = ssl3_AppendHandshakeNumber(ss, 0, 2);
965 if (rv != SECSuccess)
966 goto loser;
967 ss->xtnData.advertised[ss->xtnData.numAdvertised++] =
968 ssl_channel_id_xtn;
969 }
970
971 return extension_length;
972
973 loser:
974 return -1;
975 }
976
977 static SECStatus
978 ssl3_ClientHandleStatusRequestXtn(sslSocket *ss, PRUint16 ex_type,
979 SECItem *data)
980 {
981 /* The echoed extension must be empty. */
982 if (data->len != 0)
983 return SECFailure;
984
985 /* Keep track of negotiated extensions. */
986 ss->xtnData.negotiated[ss->xtnData.numNegotiated++] = ex_type;
987
988 return SECSuccess;
989 }
990
991 static PRInt32
992 ssl3_ServerSendStatusRequestXtn(
993 sslSocket * ss,
994 PRBool append,
995 PRUint32 maxBytes)
996 {
997 PRInt32 extension_length;
998 SECStatus rv;
999 int i;
1000 PRBool haveStatus = PR_FALSE;
1001
1002 for (i = kt_null; i < kt_kea_size; i++) {
1003 /* TODO: This is a temporary workaround.
1004 * The correct code needs to see if we have an OCSP response for
1005 * the server certificate being used, rather than if we have any
1006 * OCSP response. See also ssl3_SendCertificateStatus.
1007 */
1008 if (ss->certStatusArray[i] && ss->certStatusArray[i]->len) {
1009 haveStatus = PR_TRUE;
1010 break;
1011 }
1012 }
1013 if (!haveStatus)
1014 return 0;
1015
1016 extension_length = 2 + 2;
1017 if (append && maxBytes >= extension_length) {
1018 /* extension_type */
1019 rv = ssl3_AppendHandshakeNumber(ss, ssl_cert_status_xtn, 2);
1020 if (rv != SECSuccess)
1021 return -1;
1022 /* length of extension_data */
1023 rv = ssl3_AppendHandshakeNumber(ss, 0, 2);
1024 if (rv != SECSuccess)
1025 return -1;
1026 }
1027
1028 return extension_length;
1029 }
1030
1031 /* ssl3_ClientSendStatusRequestXtn builds the status_request extension on the
1032 * client side. See RFC 4366 section 3.6. */
1033 static PRInt32
1034 ssl3_ClientSendStatusRequestXtn(sslSocket * ss, PRBool append,
1035 PRUint32 maxBytes)
1036 {
1037 PRInt32 extension_length;
1038
1039 if (!ss->opt.enableOCSPStapling)
1040 return 0;
1041
1042 /* extension_type (2-bytes) +
1043 * length(extension_data) (2-bytes) +
1044 * status_type (1) +
1045 * responder_id_list length (2) +
1046 * request_extensions length (2)
1047 */
1048 extension_length = 9;
1049
1050 if (append && maxBytes >= extension_length) {
1051 SECStatus rv;
1052 TLSExtensionData *xtnData;
1053
1054 /* extension_type */
1055 rv = ssl3_AppendHandshakeNumber(ss, ssl_cert_status_xtn, 2);
1056 if (rv != SECSuccess)
1057 return -1;
1058 rv = ssl3_AppendHandshakeNumber(ss, extension_length - 4, 2);
1059 if (rv != SECSuccess)
1060 return -1;
1061 rv = ssl3_AppendHandshakeNumber(ss, 1 /* status_type ocsp */, 1);
1062 if (rv != SECSuccess)
1063 return -1;
1064 /* A zero length responder_id_list means that the responders are
1065 * implicitly known to the server. */
1066 rv = ssl3_AppendHandshakeNumber(ss, 0, 2);
1067 if (rv != SECSuccess)
1068 return -1;
1069 /* A zero length request_extensions means that there are no extensions.
1070 * Specifically, we don't set the id-pkix-ocsp-nonce extension. This
1071 * means that the server can replay a cached OCSP response to us. */
1072 rv = ssl3_AppendHandshakeNumber(ss, 0, 2);
1073 if (rv != SECSuccess)
1074 return -1;
1075
1076 xtnData = &ss->xtnData;
1077 xtnData->advertised[xtnData->numAdvertised++] = ssl_cert_status_xtn;
1078 } else if (maxBytes < extension_length) {
1079 PORT_Assert(0);
1080 return 0;
1081 }
1082 return extension_length;
1083 }
1084
1085 /*
1086 * NewSessionTicket
1087 * Called from ssl3_HandleFinished
1088 */
1089 SECStatus
1090 ssl3_SendNewSessionTicket(sslSocket *ss)
1091 {
1092 int i;
1093 SECStatus rv;
1094 NewSessionTicket ticket;
1095 SECItem plaintext;
1096 SECItem plaintext_item = {0, NULL, 0};
1097 SECItem ciphertext = {0, NULL, 0};
1098 PRUint32 ciphertext_length;
1099 PRBool ms_is_wrapped;
1100 unsigned char wrapped_ms[SSL3_MASTER_SECRET_LENGTH];
1101 SECItem ms_item = {0, NULL, 0};
1102 SSL3KEAType effectiveExchKeyType = ssl_kea_null;
1103 PRUint32 padding_length;
1104 PRUint32 message_length;
1105 PRUint32 cert_length;
1106 PRUint8 length_buf[4];
1107 PRUint32 now;
1108 PK11SymKey *aes_key_pkcs11;
1109 PK11SymKey *mac_key_pkcs11;
1110 #ifndef NO_PKCS11_BYPASS
1111 const unsigned char *aes_key;
1112 const unsigned char *mac_key;
1113 PRUint32 aes_key_length;
1114 PRUint32 mac_key_length;
1115 PRUint64 aes_ctx_buf[MAX_CIPHER_CONTEXT_LLONGS];
1116 AESContext *aes_ctx;
1117 const SECHashObject *hashObj = NULL;
1118 PRUint64 hmac_ctx_buf[MAX_MAC_CONTEXT_LLONGS];
1119 HMACContext *hmac_ctx;
1120 #endif
1121 CK_MECHANISM_TYPE cipherMech = CKM_AES_CBC;
1122 PK11Context *aes_ctx_pkcs11;
1123 CK_MECHANISM_TYPE macMech = CKM_SHA256_HMAC;
1124 PK11Context *hmac_ctx_pkcs11;
1125 unsigned char computed_mac[TLS_EX_SESS_TICKET_MAC_LENGTH];
1126 unsigned int computed_mac_length;
1127 unsigned char iv[AES_BLOCK_SIZE];
1128 SECItem ivItem;
1129 SECItem *srvName = NULL;
1130 PRUint32 srvNameLen = 0;
1131 CK_MECHANISM_TYPE msWrapMech = 0; /* dummy default value,
1132 * must be >= 0 */
1133
1134 SSL_TRC(3, ("%d: SSL3[%d]: send session_ticket handshake",
1135 SSL_GETPID(), ss->fd));
1136
1137 PORT_Assert( ss->opt.noLocks || ssl_HaveXmitBufLock(ss));
1138 PORT_Assert( ss->opt.noLocks || ssl_HaveSSL3HandshakeLock(ss));
1139
1140 ticket.ticket_lifetime_hint = TLS_EX_SESS_TICKET_LIFETIME_HINT;
1141 cert_length = (ss->opt.requestCertificate && ss->sec.ci.sid->peerCert) ?
1142 3 + ss->sec.ci.sid->peerCert->derCert.len : 0;
1143
1144 /* Get IV and encryption keys */
1145 ivItem.data = iv;
1146 ivItem.len = sizeof(iv);
1147 rv = PK11_GenerateRandom(iv, sizeof(iv));
1148 if (rv != SECSuccess) goto loser;
1149
1150 #ifndef NO_PKCS11_BYPASS
1151 if (ss->opt.bypassPKCS11) {
1152 rv = ssl3_GetSessionTicketKeys(&aes_key, &aes_key_length,
1153 &mac_key, &mac_key_length);
1154 } else
1155 #endif
1156 {
1157 rv = ssl3_GetSessionTicketKeysPKCS11(ss, &aes_key_pkcs11,
1158 &mac_key_pkcs11);
1159 }
1160 if (rv != SECSuccess) goto loser;
1161
1162 if (ss->ssl3.pwSpec->msItem.len && ss->ssl3.pwSpec->msItem.data) {
1163 /* The master secret is available unwrapped. */
1164 ms_item.data = ss->ssl3.pwSpec->msItem.data;
1165 ms_item.len = ss->ssl3.pwSpec->msItem.len;
1166 ms_is_wrapped = PR_FALSE;
1167 } else {
1168 /* Extract the master secret wrapped. */
1169 sslSessionID sid;
1170 PORT_Memset(&sid, 0, sizeof(sslSessionID));
1171
1172 if (ss->ssl3.hs.kea_def->kea == kea_ecdhe_rsa) {
1173 effectiveExchKeyType = kt_rsa;
1174 } else {
1175 effectiveExchKeyType = ss->ssl3.hs.kea_def->exchKeyType;
1176 }
1177
1178 rv = ssl3_CacheWrappedMasterSecret(ss, &sid, ss->ssl3.pwSpec,
1179 effectiveExchKeyType);
1180 if (rv == SECSuccess) {
1181 if (sid.u.ssl3.keys.wrapped_master_secret_len > sizeof(wrapped_ms))
1182 goto loser;
1183 memcpy(wrapped_ms, sid.u.ssl3.keys.wrapped_master_secret,
1184 sid.u.ssl3.keys.wrapped_master_secret_len);
1185 ms_item.data = wrapped_ms;
1186 ms_item.len = sid.u.ssl3.keys.wrapped_master_secret_len;
1187 msWrapMech = sid.u.ssl3.masterWrapMech;
1188 } else {
1189 /* TODO: else send an empty ticket. */
1190 goto loser;
1191 }
1192 ms_is_wrapped = PR_TRUE;
1193 }
1194 /* Prep to send negotiated name */
1195 srvName = &ss->ssl3.pwSpec->srvVirtName;
1196 if (srvName->data && srvName->len) {
1197 srvNameLen = 2 + srvName->len; /* len bytes + name len */
1198 }
1199
1200 ciphertext_length =
1201 sizeof(PRUint16) /* ticket_version */
1202 + sizeof(SSL3ProtocolVersion) /* ssl_version */
1203 + sizeof(ssl3CipherSuite) /* ciphersuite */
1204 + 1 /* compression */
1205 + 10 /* cipher spec parameters */
1206 + 1 /* SessionTicket.ms_is_wrapped */
1207 + 1 /* effectiveExchKeyType */
1208 + 4 /* msWrapMech */
1209 + 2 /* master_secret.length */
1210 + ms_item.len /* master_secret */
1211 + 1 /* client_auth_type */
1212 + cert_length /* cert */
1213 + 1 /* server name type */
1214 + srvNameLen /* name len + length field */
1215 + sizeof(ticket.ticket_lifetime_hint);
1216 padding_length = AES_BLOCK_SIZE -
1217 (ciphertext_length % AES_BLOCK_SIZE);
1218 ciphertext_length += padding_length;
1219
1220 message_length =
1221 sizeof(ticket.ticket_lifetime_hint) /* ticket_lifetime_hint */
1222 + 2 /* length field for NewSessionTicket.ticket */
1223 + SESS_TICKET_KEY_NAME_LEN /* key_name */
1224 + AES_BLOCK_SIZE /* iv */
1225 + 2 /* length field for NewSessionTicket.ticket.encrypted_state */
1226 + ciphertext_length /* encrypted_state */
1227 + TLS_EX_SESS_TICKET_MAC_LENGTH; /* mac */
1228
1229 if (SECITEM_AllocItem(NULL, &plaintext_item, ciphertext_length) == NULL)
1230 goto loser;
1231
1232 plaintext = plaintext_item;
1233
1234 /* ticket_version */
1235 rv = ssl3_AppendNumberToItem(&plaintext, TLS_EX_SESS_TICKET_VERSION,
1236 sizeof(PRUint16));
1237 if (rv != SECSuccess) goto loser;
1238
1239 /* ssl_version */
1240 rv = ssl3_AppendNumberToItem(&plaintext, ss->version,
1241 sizeof(SSL3ProtocolVersion));
1242 if (rv != SECSuccess) goto loser;
1243
1244 /* ciphersuite */
1245 rv = ssl3_AppendNumberToItem(&plaintext, ss->ssl3.hs.cipher_suite,
1246 sizeof(ssl3CipherSuite));
1247 if (rv != SECSuccess) goto loser;
1248
1249 /* compression */
1250 rv = ssl3_AppendNumberToItem(&plaintext, ss->ssl3.hs.compression, 1);
1251 if (rv != SECSuccess) goto loser;
1252
1253 /* cipher spec parameters */
1254 rv = ssl3_AppendNumberToItem(&plaintext, ss->sec.authAlgorithm, 1);
1255 if (rv != SECSuccess) goto loser;
1256 rv = ssl3_AppendNumberToItem(&plaintext, ss->sec.authKeyBits, 4);
1257 if (rv != SECSuccess) goto loser;
1258 rv = ssl3_AppendNumberToItem(&plaintext, ss->sec.keaType, 1);
1259 if (rv != SECSuccess) goto loser;
1260 rv = ssl3_AppendNumberToItem(&plaintext, ss->sec.keaKeyBits, 4);
1261 if (rv != SECSuccess) goto loser;
1262
1263 /* master_secret */
1264 rv = ssl3_AppendNumberToItem(&plaintext, ms_is_wrapped, 1);
1265 if (rv != SECSuccess) goto loser;
1266 rv = ssl3_AppendNumberToItem(&plaintext, effectiveExchKeyType, 1);
1267 if (rv != SECSuccess) goto loser;
1268 rv = ssl3_AppendNumberToItem(&plaintext, msWrapMech, 4);
1269 if (rv != SECSuccess) goto loser;
1270 rv = ssl3_AppendNumberToItem(&plaintext, ms_item.len, 2);
1271 if (rv != SECSuccess) goto loser;
1272 rv = ssl3_AppendToItem(&plaintext, ms_item.data, ms_item.len);
1273 if (rv != SECSuccess) goto loser;
1274
1275 /* client_identity */
1276 if (ss->opt.requestCertificate && ss->sec.ci.sid->peerCert) {
1277 rv = ssl3_AppendNumberToItem(&plaintext, CLIENT_AUTH_CERTIFICATE, 1);
1278 if (rv != SECSuccess) goto loser;
1279 rv = ssl3_AppendNumberToItem(&plaintext,
1280 ss->sec.ci.sid->peerCert->derCert.len, 3);
1281 if (rv != SECSuccess) goto loser;
1282 rv = ssl3_AppendToItem(&plaintext,
1283 ss->sec.ci.sid->peerCert->derCert.data,
1284 ss->sec.ci.sid->peerCert->derCert.len);
1285 if (rv != SECSuccess) goto loser;
1286 } else {
1287 rv = ssl3_AppendNumberToItem(&plaintext, 0, 1);
1288 if (rv != SECSuccess) goto loser;
1289 }
1290
1291 /* timestamp */
1292 now = ssl_Time();
1293 rv = ssl3_AppendNumberToItem(&plaintext, now,
1294 sizeof(ticket.ticket_lifetime_hint));
1295 if (rv != SECSuccess) goto loser;
1296
1297 if (srvNameLen) {
1298 /* Name Type (sni_host_name) */
1299 rv = ssl3_AppendNumberToItem(&plaintext, srvName->type, 1);
1300 if (rv != SECSuccess) goto loser;
1301 /* HostName (length and value) */
1302 rv = ssl3_AppendNumberToItem(&plaintext, srvName->len, 2);
1303 if (rv != SECSuccess) goto loser;
1304 rv = ssl3_AppendToItem(&plaintext, srvName->data, srvName->len);
1305 if (rv != SECSuccess) goto loser;
1306 } else {
1307 /* No Name */
1308 rv = ssl3_AppendNumberToItem(&plaintext, (char)TLS_STE_NO_SERVER_NAME,
1309 1);
1310 if (rv != SECSuccess) goto loser;
1311 }
1312
1313 PORT_Assert(plaintext.len == padding_length);
1314 for (i = 0; i < padding_length; i++)
1315 plaintext.data[i] = (unsigned char)padding_length;
1316
1317 if (SECITEM_AllocItem(NULL, &ciphertext, ciphertext_length) == NULL) {
1318 rv = SECFailure;
1319 goto loser;
1320 }
1321
1322 /* Generate encrypted portion of ticket. */
1323 #ifndef NO_PKCS11_BYPASS
1324 if (ss->opt.bypassPKCS11) {
1325 aes_ctx = (AESContext *)aes_ctx_buf;
1326 rv = AES_InitContext(aes_ctx, aes_key, aes_key_length, iv,
1327 NSS_AES_CBC, 1, AES_BLOCK_SIZE);
1328 if (rv != SECSuccess) goto loser;
1329
1330 rv = AES_Encrypt(aes_ctx, ciphertext.data, &ciphertext.len,
1331 ciphertext.len, plaintext_item.data,
1332 plaintext_item.len);
1333 if (rv != SECSuccess) goto loser;
1334 } else
1335 #endif
1336 {
1337 aes_ctx_pkcs11 = PK11_CreateContextBySymKey(cipherMech,
1338 CKA_ENCRYPT, aes_key_pkcs11, &ivItem);
1339 if (!aes_ctx_pkcs11)
1340 goto loser;
1341
1342 rv = PK11_CipherOp(aes_ctx_pkcs11, ciphertext.data,
1343 (int *)&ciphertext.len, ciphertext.len,
1344 plaintext_item.data, plaintext_item.len);
1345 PK11_Finalize(aes_ctx_pkcs11);
1346 PK11_DestroyContext(aes_ctx_pkcs11, PR_TRUE);
1347 if (rv != SECSuccess) goto loser;
1348 }
1349
1350 /* Convert ciphertext length to network order. */
1351 length_buf[0] = (ciphertext.len >> 8) & 0xff;
1352 length_buf[1] = (ciphertext.len ) & 0xff;
1353
1354 /* Compute MAC. */
1355 #ifndef NO_PKCS11_BYPASS
1356 if (ss->opt.bypassPKCS11) {
1357 hmac_ctx = (HMACContext *)hmac_ctx_buf;
1358 hashObj = HASH_GetRawHashObject(HASH_AlgSHA256);
1359 if (HMAC_Init(hmac_ctx, hashObj, mac_key,
1360 mac_key_length, PR_FALSE) != SECSuccess)
1361 goto loser;
1362
1363 HMAC_Begin(hmac_ctx);
1364 HMAC_Update(hmac_ctx, key_name, SESS_TICKET_KEY_NAME_LEN);
1365 HMAC_Update(hmac_ctx, iv, sizeof(iv));
1366 HMAC_Update(hmac_ctx, (unsigned char *)length_buf, 2);
1367 HMAC_Update(hmac_ctx, ciphertext.data, ciphertext.len);
1368 HMAC_Finish(hmac_ctx, computed_mac, &computed_mac_length,
1369 sizeof(computed_mac));
1370 } else
1371 #endif
1372 {
1373 SECItem macParam;
1374 macParam.data = NULL;
1375 macParam.len = 0;
1376 hmac_ctx_pkcs11 = PK11_CreateContextBySymKey(macMech,
1377 CKA_SIGN, mac_key_pkcs11, &macParam);
1378 if (!hmac_ctx_pkcs11)
1379 goto loser;
1380
1381 rv = PK11_DigestBegin(hmac_ctx_pkcs11);
1382 rv = PK11_DigestOp(hmac_ctx_pkcs11, key_name,
1383 SESS_TICKET_KEY_NAME_LEN);
1384 rv = PK11_DigestOp(hmac_ctx_pkcs11, iv, sizeof(iv));
1385 rv = PK11_DigestOp(hmac_ctx_pkcs11, (unsigned char *)length_buf, 2);
1386 rv = PK11_DigestOp(hmac_ctx_pkcs11, ciphertext.data, ciphertext.len);
1387 rv = PK11_DigestFinal(hmac_ctx_pkcs11, computed_mac,
1388 &computed_mac_length, sizeof(computed_mac));
1389 PK11_DestroyContext(hmac_ctx_pkcs11, PR_TRUE);
1390 if (rv != SECSuccess) goto loser;
1391 }
1392
1393 /* Serialize the handshake message. */
1394 rv = ssl3_AppendHandshakeHeader(ss, new_session_ticket, message_length);
1395 if (rv != SECSuccess) goto loser;
1396
1397 rv = ssl3_AppendHandshakeNumber(ss, ticket.ticket_lifetime_hint,
1398 sizeof(ticket.ticket_lifetime_hint));
1399 if (rv != SECSuccess) goto loser;
1400
1401 rv = ssl3_AppendHandshakeNumber(ss,
1402 message_length - sizeof(ticket.ticket_lifetime_hint) - 2, 2);
1403 if (rv != SECSuccess) goto loser;
1404
1405 rv = ssl3_AppendHandshake(ss, key_name, SESS_TICKET_KEY_NAME_LEN);
1406 if (rv != SECSuccess) goto loser;
1407
1408 rv = ssl3_AppendHandshake(ss, iv, sizeof(iv));
1409 if (rv != SECSuccess) goto loser;
1410
1411 rv = ssl3_AppendHandshakeVariable(ss, ciphertext.data, ciphertext.len, 2);
1412 if (rv != SECSuccess) goto loser;
1413
1414 rv = ssl3_AppendHandshake(ss, computed_mac, computed_mac_length);
1415 if (rv != SECSuccess) goto loser;
1416
1417 loser:
1418 if (plaintext_item.data)
1419 SECITEM_FreeItem(&plaintext_item, PR_FALSE);
1420 if (ciphertext.data)
1421 SECITEM_FreeItem(&ciphertext, PR_FALSE);
1422
1423 return rv;
1424 }
1425
1426 /* When a client receives a SessionTicket extension a NewSessionTicket
1427 * message is expected during the handshake.
1428 */
1429 SECStatus
1430 ssl3_ClientHandleSessionTicketXtn(sslSocket *ss, PRUint16 ex_type,
1431 SECItem *data)
1432 {
1433 if (data->len != 0)
1434 return SECFailure;
1435
1436 /* Keep track of negotiated extensions. */
1437 ss->xtnData.negotiated[ss->xtnData.numNegotiated++] = ex_type;
1438 return SECSuccess;
1439 }
1440
1441 SECStatus
1442 ssl3_ServerHandleSessionTicketXtn(sslSocket *ss, PRUint16 ex_type,
1443 SECItem *data)
1444 {
1445 SECStatus rv;
1446 SECItem *decrypted_state = NULL;
1447 SessionTicket *parsed_session_ticket = NULL;
1448 sslSessionID *sid = NULL;
1449 SSL3Statistics *ssl3stats;
1450
1451 /* Ignore the SessionTicket extension if processing is disabled. */
1452 if (!ss->opt.enableSessionTickets)
1453 return SECSuccess;
1454
1455 /* Keep track of negotiated extensions. */
1456 ss->xtnData.negotiated[ss->xtnData.numNegotiated++] = ex_type;
1457
1458 /* Parse the received ticket sent in by the client. We are
1459 * lenient about some parse errors, falling back to a fullshake
1460 * instead of terminating the current connection.
1461 */
1462 if (data->len == 0) {
1463 ss->xtnData.emptySessionTicket = PR_TRUE;
1464 } else {
1465 int i;
1466 SECItem extension_data;
1467 EncryptedSessionTicket enc_session_ticket;
1468 unsigned char computed_mac[TLS_EX_SESS_TICKET_MAC_LENGTH];
1469 unsigned int computed_mac_length;
1470 #ifndef NO_PKCS11_BYPASS
1471 const SECHashObject *hashObj;
1472 const unsigned char *aes_key;
1473 const unsigned char *mac_key;
1474 PRUint32 aes_key_length;
1475 PRUint32 mac_key_length;
1476 PRUint64 hmac_ctx_buf[MAX_MAC_CONTEXT_LLONGS];
1477 HMACContext *hmac_ctx;
1478 PRUint64 aes_ctx_buf[MAX_CIPHER_CONTEXT_LLONGS];
1479 AESContext *aes_ctx;
1480 #endif
1481 PK11SymKey *aes_key_pkcs11;
1482 PK11SymKey *mac_key_pkcs11;
1483 PK11Context *hmac_ctx_pkcs11;
1484 CK_MECHANISM_TYPE macMech = CKM_SHA256_HMAC;
1485 PK11Context *aes_ctx_pkcs11;
1486 CK_MECHANISM_TYPE cipherMech = CKM_AES_CBC;
1487 unsigned char * padding;
1488 PRUint32 padding_length;
1489 unsigned char *buffer;
1490 unsigned int buffer_len;
1491 PRInt32 temp;
1492 SECItem cert_item;
1493 PRInt8 nameType = TLS_STE_NO_SERVER_NAME;
1494
1495 /* Turn off stateless session resumption if the client sends a
1496 * SessionTicket extension, even if the extension turns out to be
1497 * malformed (ss->sec.ci.sid is non-NULL when doing session
1498 * renegotiation.)
1499 */
1500 if (ss->sec.ci.sid != NULL) {
1501 if (ss->sec.uncache)
1502 ss->sec.uncache(ss->sec.ci.sid);
1503 ssl_FreeSID(ss->sec.ci.sid);
1504 ss->sec.ci.sid = NULL;
1505 }
1506
1507 extension_data.data = data->data; /* Keep a copy for future use. */
1508 extension_data.len = data->len;
1509
1510 if (ssl3_ParseEncryptedSessionTicket(ss, data, &enc_session_ticket)
1511 != SECSuccess)
1512 return SECFailure;
1513
1514 /* Get session ticket keys. */
1515 #ifndef NO_PKCS11_BYPASS
1516 if (ss->opt.bypassPKCS11) {
1517 rv = ssl3_GetSessionTicketKeys(&aes_key, &aes_key_length,
1518 &mac_key, &mac_key_length);
1519 } else
1520 #endif
1521 {
1522 rv = ssl3_GetSessionTicketKeysPKCS11(ss, &aes_key_pkcs11,
1523 &mac_key_pkcs11);
1524 }
1525 if (rv != SECSuccess) {
1526 SSL_DBG(("%d: SSL[%d]: Unable to get/generate session ticket keys.",
1527 SSL_GETPID(), ss->fd));
1528 goto loser;
1529 }
1530
1531 /* If the ticket sent by the client was generated under a key different
1532 * from the one we have, bypass ticket processing.
1533 */
1534 if (PORT_Memcmp(enc_session_ticket.key_name, key_name,
1535 SESS_TICKET_KEY_NAME_LEN) != 0) {
1536 SSL_DBG(("%d: SSL[%d]: Session ticket key_name sent mismatch.",
1537 SSL_GETPID(), ss->fd));
1538 goto no_ticket;
1539 }
1540
1541 /* Verify the MAC on the ticket. MAC verification may also
1542 * fail if the MAC key has been recently refreshed.
1543 */
1544 #ifndef NO_PKCS11_BYPASS
1545 if (ss->opt.bypassPKCS11) {
1546 hmac_ctx = (HMACContext *)hmac_ctx_buf;
1547 hashObj = HASH_GetRawHashObject(HASH_AlgSHA256);
1548 if (HMAC_Init(hmac_ctx, hashObj, mac_key,
1549 sizeof(session_ticket_mac_key), PR_FALSE) != SECSuccess)
1550 goto no_ticket;
1551 HMAC_Begin(hmac_ctx);
1552 HMAC_Update(hmac_ctx, extension_data.data,
1553 extension_data.len - TLS_EX_SESS_TICKET_MAC_LENGTH);
1554 if (HMAC_Finish(hmac_ctx, computed_mac, &computed_mac_length,
1555 sizeof(computed_mac)) != SECSuccess)
1556 goto no_ticket;
1557 } else
1558 #endif
1559 {
1560 SECItem macParam;
1561 macParam.data = NULL;
1562 macParam.len = 0;
1563 hmac_ctx_pkcs11 = PK11_CreateContextBySymKey(macMech,
1564 CKA_SIGN, mac_key_pkcs11, &macParam);
1565 if (!hmac_ctx_pkcs11) {
1566 SSL_DBG(("%d: SSL[%d]: Unable to create HMAC context: %d.",
1567 SSL_GETPID(), ss->fd, PORT_GetError()));
1568 goto no_ticket;
1569 } else {
1570 SSL_DBG(("%d: SSL[%d]: Successfully created HMAC context.",
1571 SSL_GETPID(), ss->fd));
1572 }
1573 rv = PK11_DigestBegin(hmac_ctx_pkcs11);
1574 rv = PK11_DigestOp(hmac_ctx_pkcs11, extension_data.data,
1575 extension_data.len - TLS_EX_SESS_TICKET_MAC_LENGTH);
1576 if (rv != SECSuccess) {
1577 PK11_DestroyContext(hmac_ctx_pkcs11, PR_TRUE);
1578 goto no_ticket;
1579 }
1580 rv = PK11_DigestFinal(hmac_ctx_pkcs11, computed_mac,
1581 &computed_mac_length, sizeof(computed_mac));
1582 PK11_DestroyContext(hmac_ctx_pkcs11, PR_TRUE);
1583 if (rv != SECSuccess)
1584 goto no_ticket;
1585 }
1586 if (NSS_SecureMemcmp(computed_mac, enc_session_ticket.mac,
1587 computed_mac_length) != 0) {
1588 SSL_DBG(("%d: SSL[%d]: Session ticket MAC mismatch.",
1589 SSL_GETPID(), ss->fd));
1590 goto no_ticket;
1591 }
1592
1593 /* We ignore key_name for now.
1594 * This is ok as MAC verification succeeded.
1595 */
1596
1597 /* Decrypt the ticket. */
1598
1599 /* Plaintext is shorter than the ciphertext due to padding. */
1600 decrypted_state = SECITEM_AllocItem(NULL, NULL,
1601 enc_session_ticket.encrypted_state.len);
1602
1603 #ifndef NO_PKCS11_BYPASS
1604 if (ss->opt.bypassPKCS11) {
1605 aes_ctx = (AESContext *)aes_ctx_buf;
1606 rv = AES_InitContext(aes_ctx, aes_key,
1607 sizeof(session_ticket_enc_key), enc_session_ticket.iv,
1608 NSS_AES_CBC, 0,AES_BLOCK_SIZE);
1609 if (rv != SECSuccess) {
1610 SSL_DBG(("%d: SSL[%d]: Unable to create AES context.",
1611 SSL_GETPID(), ss->fd));
1612 goto no_ticket;
1613 }
1614
1615 rv = AES_Decrypt(aes_ctx, decrypted_state->data,
1616 &decrypted_state->len, decrypted_state->len,
1617 enc_session_ticket.encrypted_state.data,
1618 enc_session_ticket.encrypted_state.len);
1619 if (rv != SECSuccess)
1620 goto no_ticket;
1621 } else
1622 #endif
1623 {
1624 SECItem ivItem;
1625 ivItem.data = enc_session_ticket.iv;
1626 ivItem.len = AES_BLOCK_SIZE;
1627 aes_ctx_pkcs11 = PK11_CreateContextBySymKey(cipherMech,
1628 CKA_DECRYPT, aes_key_pkcs11, &ivItem);
1629 if (!aes_ctx_pkcs11) {
1630 SSL_DBG(("%d: SSL[%d]: Unable to create AES context.",
1631 SSL_GETPID(), ss->fd));
1632 goto no_ticket;
1633 }
1634
1635 rv = PK11_CipherOp(aes_ctx_pkcs11, decrypted_state->data,
1636 (int *)&decrypted_state->len, decrypted_state->len,
1637 enc_session_ticket.encrypted_state.data,
1638 enc_session_ticket.encrypted_state.len);
1639 PK11_Finalize(aes_ctx_pkcs11);
1640 PK11_DestroyContext(aes_ctx_pkcs11, PR_TRUE);
1641 if (rv != SECSuccess)
1642 goto no_ticket;
1643 }
1644
1645 /* Check padding. */
1646 padding_length =
1647 (PRUint32)decrypted_state->data[decrypted_state->len - 1];
1648 if (padding_length == 0 || padding_length > AES_BLOCK_SIZE)
1649 goto no_ticket;
1650
1651 padding = &decrypted_state->data[decrypted_state->len - padding_length];
1652 for (i = 0; i < padding_length; i++, padding++) {
1653 if (padding_length != (PRUint32)*padding)
1654 goto no_ticket;
1655 }
1656
1657 /* Deserialize session state. */
1658 buffer = decrypted_state->data;
1659 buffer_len = decrypted_state->len;
1660
1661 parsed_session_ticket = PORT_ZAlloc(sizeof(SessionTicket));
1662 if (parsed_session_ticket == NULL) {
1663 rv = SECFailure;
1664 goto loser;
1665 }
1666
1667 /* Read ticket_version (which is ignored for now.) */
1668 temp = ssl3_ConsumeHandshakeNumber(ss, 2, &buffer, &buffer_len);
1669 if (temp < 0) goto no_ticket;
1670 parsed_session_ticket->ticket_version = (SSL3ProtocolVersion)temp;
1671
1672 /* Read SSLVersion. */
1673 temp = ssl3_ConsumeHandshakeNumber(ss, 2, &buffer, &buffer_len);
1674 if (temp < 0) goto no_ticket;
1675 parsed_session_ticket->ssl_version = (SSL3ProtocolVersion)temp;
1676
1677 /* Read cipher_suite. */
1678 temp = ssl3_ConsumeHandshakeNumber(ss, 2, &buffer, &buffer_len);
1679 if (temp < 0) goto no_ticket;
1680 parsed_session_ticket->cipher_suite = (ssl3CipherSuite)temp;
1681
1682 /* Read compression_method. */
1683 temp = ssl3_ConsumeHandshakeNumber(ss, 1, &buffer, &buffer_len);
1684 if (temp < 0) goto no_ticket;
1685 parsed_session_ticket->compression_method = (SSLCompressionMethod)temp;
1686
1687 /* Read cipher spec parameters. */
1688 temp = ssl3_ConsumeHandshakeNumber(ss, 1, &buffer, &buffer_len);
1689 if (temp < 0) goto no_ticket;
1690 parsed_session_ticket->authAlgorithm = (SSLSignType)temp;
1691 temp = ssl3_ConsumeHandshakeNumber(ss, 4, &buffer, &buffer_len);
1692 if (temp < 0) goto no_ticket;
1693 parsed_session_ticket->authKeyBits = (PRUint32)temp;
1694 temp = ssl3_ConsumeHandshakeNumber(ss, 1, &buffer, &buffer_len);
1695 if (temp < 0) goto no_ticket;
1696 parsed_session_ticket->keaType = (SSLKEAType)temp;
1697 temp = ssl3_ConsumeHandshakeNumber(ss, 4, &buffer, &buffer_len);
1698 if (temp < 0) goto no_ticket;
1699 parsed_session_ticket->keaKeyBits = (PRUint32)temp;
1700
1701 /* Read wrapped master_secret. */
1702 temp = ssl3_ConsumeHandshakeNumber(ss, 1, &buffer, &buffer_len);
1703 if (temp < 0) goto no_ticket;
1704 parsed_session_ticket->ms_is_wrapped = (PRBool)temp;
1705
1706 temp = ssl3_ConsumeHandshakeNumber(ss, 1, &buffer, &buffer_len);
1707 if (temp < 0) goto no_ticket;
1708 parsed_session_ticket->exchKeyType = (SSL3KEAType)temp;
1709
1710 temp = ssl3_ConsumeHandshakeNumber(ss, 4, &buffer, &buffer_len);
1711 if (temp < 0) goto no_ticket;
1712 parsed_session_ticket->msWrapMech = (CK_MECHANISM_TYPE)temp;
1713
1714 temp = ssl3_ConsumeHandshakeNumber(ss, 2, &buffer, &buffer_len);
1715 if (temp < 0) goto no_ticket;
1716 parsed_session_ticket->ms_length = (PRUint16)temp;
1717 if (parsed_session_ticket->ms_length == 0 || /* sanity check MS. */
1718 parsed_session_ticket->ms_length >
1719 sizeof(parsed_session_ticket->master_secret))
1720 goto no_ticket;
1721
1722 /* Allow for the wrapped master secret to be longer. */
1723 if (buffer_len < parsed_session_ticket->ms_length)
1724 goto no_ticket;
1725 PORT_Memcpy(parsed_session_ticket->master_secret, buffer,
1726 parsed_session_ticket->ms_length);
1727 buffer += parsed_session_ticket->ms_length;
1728 buffer_len -= parsed_session_ticket->ms_length;
1729
1730 /* Read client_identity */
1731 temp = ssl3_ConsumeHandshakeNumber(ss, 1, &buffer, &buffer_len);
1732 if (temp < 0)
1733 goto no_ticket;
1734 parsed_session_ticket->client_identity.client_auth_type =
1735 (ClientAuthenticationType)temp;
1736 switch(parsed_session_ticket->client_identity.client_auth_type) {
1737 case CLIENT_AUTH_ANONYMOUS:
1738 break;
1739 case CLIENT_AUTH_CERTIFICATE:
1740 rv = ssl3_ConsumeHandshakeVariable(ss, &cert_item, 3,
1741 &buffer, &buffer_len);
1742 if (rv != SECSuccess) goto no_ticket;
1743 rv = SECITEM_CopyItem(NULL, &parsed_session_ticket->peer_cert,
1744 &cert_item);
1745 if (rv != SECSuccess) goto no_ticket;
1746 break;
1747 default:
1748 goto no_ticket;
1749 }
1750 /* Read timestamp. */
1751 temp = ssl3_ConsumeHandshakeNumber(ss, 4, &buffer, &buffer_len);
1752 if (temp < 0)
1753 goto no_ticket;
1754 parsed_session_ticket->timestamp = (PRUint32)temp;
1755
1756 /* Read server name */
1757 nameType =
1758 ssl3_ConsumeHandshakeNumber(ss, 1, &buffer, &buffer_len);
1759 if (nameType != TLS_STE_NO_SERVER_NAME) {
1760 SECItem name_item;
1761 rv = ssl3_ConsumeHandshakeVariable(ss, &name_item, 2, &buffer,
1762 &buffer_len);
1763 if (rv != SECSuccess) goto no_ticket;
1764 rv = SECITEM_CopyItem(NULL, &parsed_session_ticket->srvName,
1765 &name_item);
1766 if (rv != SECSuccess) goto no_ticket;
1767 parsed_session_ticket->srvName.type = nameType;
1768 }
1769
1770 /* Done parsing. Check that all bytes have been consumed. */
1771 if (buffer_len != padding_length)
1772 goto no_ticket;
1773
1774 /* Use the ticket if it has not expired, otherwise free the allocated
1775 * memory since the ticket is of no use.
1776 */
1777 if (parsed_session_ticket->timestamp != 0 &&
1778 parsed_session_ticket->timestamp +
1779 TLS_EX_SESS_TICKET_LIFETIME_HINT > ssl_Time()) {
1780
1781 sid = ssl3_NewSessionID(ss, PR_TRUE);
1782 if (sid == NULL) {
1783 rv = SECFailure;
1784 goto loser;
1785 }
1786
1787 /* Copy over parameters. */
1788 sid->version = parsed_session_ticket->ssl_version;
1789 sid->u.ssl3.cipherSuite = parsed_session_ticket->cipher_suite;
1790 sid->u.ssl3.compression = parsed_session_ticket->compression_method;
1791 sid->authAlgorithm = parsed_session_ticket->authAlgorithm;
1792 sid->authKeyBits = parsed_session_ticket->authKeyBits;
1793 sid->keaType = parsed_session_ticket->keaType;
1794 sid->keaKeyBits = parsed_session_ticket->keaKeyBits;
1795
1796 /* Copy master secret. */
1797 #ifndef NO_PKCS11_BYPASS
1798 if (ss->opt.bypassPKCS11 &&
1799 parsed_session_ticket->ms_is_wrapped)
1800 goto no_ticket;
1801 #endif
1802 if (parsed_session_ticket->ms_length >
1803 sizeof(sid->u.ssl3.keys.wrapped_master_secret))
1804 goto no_ticket;
1805 PORT_Memcpy(sid->u.ssl3.keys.wrapped_master_secret,
1806 parsed_session_ticket->master_secret,
1807 parsed_session_ticket->ms_length);
1808 sid->u.ssl3.keys.wrapped_master_secret_len =
1809 parsed_session_ticket->ms_length;
1810 sid->u.ssl3.exchKeyType = parsed_session_ticket->exchKeyType;
1811 sid->u.ssl3.masterWrapMech = parsed_session_ticket->msWrapMech;
1812 sid->u.ssl3.keys.msIsWrapped =
1813 parsed_session_ticket->ms_is_wrapped;
1814 sid->u.ssl3.masterValid = PR_TRUE;
1815 sid->u.ssl3.keys.resumable = PR_TRUE;
1816
1817 /* Copy over client cert from session ticket if there is one. */
1818 if (parsed_session_ticket->peer_cert.data != NULL) {
1819 if (sid->peerCert != NULL)
1820 CERT_DestroyCertificate(sid->peerCert);
1821 sid->peerCert = CERT_NewTempCertificate(ss->dbHandle,
1822 &parsed_session_ticket->peer_cert, NULL, PR_FALSE, PR_TRUE);
1823 if (sid->peerCert == NULL) {
1824 rv = SECFailure;
1825 goto loser;
1826 }
1827 }
1828 if (parsed_session_ticket->srvName.data != NULL) {
1829 sid->u.ssl3.srvName = parsed_session_ticket->srvName;
1830 }
1831 ss->statelessResume = PR_TRUE;
1832 ss->sec.ci.sid = sid;
1833 }
1834 }
1835
1836 if (0) {
1837 no_ticket:
1838 SSL_DBG(("%d: SSL[%d]: Session ticket parsing failed.",
1839 SSL_GETPID(), ss->fd));
1840 ssl3stats = SSL_GetStatistics();
1841 SSL_AtomicIncrementLong(& ssl3stats->hch_sid_ticket_parse_failures );
1842 }
1843 rv = SECSuccess;
1844
1845 loser:
1846 /* ss->sec.ci.sid == sid if it did NOT come here via goto statement
1847 * in that case do not free sid
1848 */
1849 if (sid && (ss->sec.ci.sid != sid)) {
1850 ssl_FreeSID(sid);
1851 sid = NULL;
1852 }
1853 if (decrypted_state != NULL) {
1854 SECITEM_FreeItem(decrypted_state, PR_TRUE);
1855 decrypted_state = NULL;
1856 }
1857
1858 if (parsed_session_ticket != NULL) {
1859 if (parsed_session_ticket->peer_cert.data) {
1860 SECITEM_FreeItem(&parsed_session_ticket->peer_cert, PR_FALSE);
1861 }
1862 PORT_ZFree(parsed_session_ticket, sizeof(SessionTicket));
1863 }
1864
1865 return rv;
1866 }
1867
1868 /*
1869 * Read bytes. Using this function means the SECItem structure
1870 * cannot be freed. The caller is expected to call this function
1871 * on a shallow copy of the structure.
1872 */
1873 static SECStatus
1874 ssl3_ConsumeFromItem(SECItem *item, unsigned char **buf, PRUint32 bytes)
1875 {
1876 if (bytes > item->len)
1877 return SECFailure;
1878
1879 *buf = item->data;
1880 item->data += bytes;
1881 item->len -= bytes;
1882 return SECSuccess;
1883 }
1884
1885 static SECStatus
1886 ssl3_ParseEncryptedSessionTicket(sslSocket *ss, SECItem *data,
1887 EncryptedSessionTicket *enc_session_ticket)
1888 {
1889 if (ssl3_ConsumeFromItem(data, &enc_session_ticket->key_name,
1890 SESS_TICKET_KEY_NAME_LEN) != SECSuccess)
1891 return SECFailure;
1892 if (ssl3_ConsumeFromItem(data, &enc_session_ticket->iv,
1893 AES_BLOCK_SIZE) != SECSuccess)
1894 return SECFailure;
1895 if (ssl3_ConsumeHandshakeVariable(ss, &enc_session_ticket->encrypted_state,
1896 2, &data->data, &data->len) != SECSuccess)
1897 return SECFailure;
1898 if (ssl3_ConsumeFromItem(data, &enc_session_ticket->mac,
1899 TLS_EX_SESS_TICKET_MAC_LENGTH) != SECSuccess)
1900 return SECFailure;
1901 if (data->len != 0) /* Make sure that we have consumed all bytes. */
1902 return SECFailure;
1903
1904 return SECSuccess;
1905 }
1906
1907 /* go through hello extensions in buffer "b".
1908 * For each one, find the extension handler in the table, and
1909 * if present, invoke that handler.
1910 * Servers ignore any extensions with unknown extension types.
1911 * Clients reject any extensions with unadvertised extension types.
1912 */
1913 SECStatus
1914 ssl3_HandleHelloExtensions(sslSocket *ss, SSL3Opaque **b, PRUint32 *length)
1915 {
1916 const ssl3HelloExtensionHandler * handlers;
1917
1918 if (ss->sec.isServer) {
1919 handlers = clientHelloHandlers;
1920 } else if (ss->version > SSL_LIBRARY_VERSION_3_0) {
1921 handlers = serverHelloHandlersTLS;
1922 } else {
1923 handlers = serverHelloHandlersSSL3;
1924 }
1925
1926 while (*length) {
1927 const ssl3HelloExtensionHandler * handler;
1928 SECStatus rv;
1929 PRInt32 extension_type;
1930 SECItem extension_data;
1931
1932 /* Get the extension's type field */
1933 extension_type = ssl3_ConsumeHandshakeNumber(ss, 2, b, length);
1934 if (extension_type < 0) /* failure to decode extension_type */
1935 return SECFailure; /* alert already sent */
1936
1937 /* get the data for this extension, so we can pass it or skip it. */
1938 rv = ssl3_ConsumeHandshakeVariable(ss, &extension_data, 2, b, length);
1939 if (rv != SECSuccess)
1940 return rv;
1941
1942 /* Check whether the server sent an extension which was not advertised
1943 * in the ClientHello.
1944 */
1945 if (!ss->sec.isServer &&
1946 !ssl3_ClientExtensionAdvertised(ss, extension_type))
1947 return SECFailure; /* TODO: send unsupported_extension alert */
1948
1949 /* Check whether an extension has been sent multiple times. */
1950 if (ssl3_ExtensionNegotiated(ss, extension_type))
1951 return SECFailure;
1952
1953 /* find extension_type in table of Hello Extension Handlers */
1954 for (handler = handlers; handler->ex_type >= 0; handler++) {
1955 /* if found, call this handler */
1956 if (handler->ex_type == extension_type) {
1957 rv = (*handler->ex_handler)(ss, (PRUint16)extension_type,
1958 &extension_data);
1959 /* Ignore this result */
1960 /* Treat all bad extensions as unrecognized types. */
1961 break;
1962 }
1963 }
1964 }
1965 return SECSuccess;
1966 }
1967
1968 /* Add a callback function to the table of senders of server hello extensions.
1969 */
1970 SECStatus
1971 ssl3_RegisterServerHelloExtensionSender(sslSocket *ss, PRUint16 ex_type,
1972 ssl3HelloExtensionSenderFunc cb)
1973 {
1974 int i;
1975 ssl3HelloExtensionSender *sender = &ss->xtnData.serverSenders[0];
1976
1977 for (i = 0; i < SSL_MAX_EXTENSIONS; ++i, ++sender) {
1978 if (!sender->ex_sender) {
1979 sender->ex_type = ex_type;
1980 sender->ex_sender = cb;
1981 return SECSuccess;
1982 }
1983 /* detect duplicate senders */
1984 PORT_Assert(sender->ex_type != ex_type);
1985 if (sender->ex_type == ex_type) {
1986 /* duplicate */
1987 break;
1988 }
1989 }
1990 PORT_Assert(i < SSL_MAX_EXTENSIONS); /* table needs to grow */
1991 PORT_SetError(SEC_ERROR_LIBRARY_FAILURE);
1992 return SECFailure;
1993 }
1994
1995 /* call each of the extension senders and return the accumulated length */
1996 PRInt32
1997 ssl3_CallHelloExtensionSenders(sslSocket *ss, PRBool append, PRUint32 maxBytes,
1998 const ssl3HelloExtensionSender *sender)
1999 {
2000 PRInt32 total_exten_len = 0;
2001 int i;
2002
2003 if (!sender) {
2004 sender = ss->version > SSL_LIBRARY_VERSION_3_0 ?
2005 &clientHelloSendersTLS[0] : &clientHelloSendersSSL3[0];
2006 }
2007
2008 for (i = 0; i < SSL_MAX_EXTENSIONS; ++i, ++sender) {
2009 if (sender->ex_sender) {
2010 PRInt32 extLen = (*sender->ex_sender)(ss, append, maxBytes);
2011 if (extLen < 0)
2012 return -1;
2013 maxBytes -= extLen;
2014 total_exten_len += extLen;
2015 }
2016 }
2017 return total_exten_len;
2018 }
2019
2020
2021 /* Extension format:
2022 * Extension number: 2 bytes
2023 * Extension length: 2 bytes
2024 * Verify Data Length: 1 byte
2025 * Verify Data (TLS): 12 bytes (client) or 24 bytes (server)
2026 * Verify Data (SSL): 36 bytes (client) or 72 bytes (server)
2027 */
2028 static PRInt32
2029 ssl3_SendRenegotiationInfoXtn(
2030 sslSocket * ss,
2031 PRBool append,
2032 PRUint32 maxBytes)
2033 {
2034 PRInt32 len, needed;
2035
2036 /* In draft-ietf-tls-renegotiation-03, it is NOT RECOMMENDED to send
2037 * both the SCSV and the empty RI, so when we send SCSV in
2038 * the initial handshake, we don't also send RI.
2039 */
2040 if (!ss || ss->ssl3.hs.sendingSCSV)
2041 return 0;
2042 len = !ss->firstHsDone ? 0 :
2043 (ss->sec.isServer ? ss->ssl3.hs.finishedBytes * 2
2044 : ss->ssl3.hs.finishedBytes);
2045 needed = 5 + len;
2046 if (append && maxBytes >= needed) {
2047 SECStatus rv;
2048 /* extension_type */
2049 rv = ssl3_AppendHandshakeNumber(ss, ssl_renegotiation_info_xtn, 2);
2050 if (rv != SECSuccess) return -1;
2051 /* length of extension_data */
2052 rv = ssl3_AppendHandshakeNumber(ss, len + 1, 2);
2053 if (rv != SECSuccess) return -1;
2054 /* verify_Data from previous Finished message(s) */
2055 rv = ssl3_AppendHandshakeVariable(ss,
2056 ss->ssl3.hs.finishedMsgs.data, len, 1);
2057 if (rv != SECSuccess) return -1;
2058 if (!ss->sec.isServer) {
2059 TLSExtensionData *xtnData = &ss->xtnData;
2060 xtnData->advertised[xtnData->numAdvertised++] =
2061 ssl_renegotiation_info_xtn;
2062 }
2063 }
2064 return needed;
2065 }
2066
2067 static SECStatus
2068 ssl3_ServerHandleStatusRequestXtn(sslSocket *ss, PRUint16 ex_type,
2069 SECItem *data)
2070 {
2071 SECStatus rv = SECSuccess;
2072
2073 /* remember that we got this extension. */
2074 ss->xtnData.negotiated[ss->xtnData.numNegotiated++] = ex_type;
2075 PORT_Assert(ss->sec.isServer);
2076 /* prepare to send back the appropriate response */
2077 rv = ssl3_RegisterServerHelloExtensionSender(ss, ex_type,
2078 ssl3_ServerSendStatusRequestXtn);
2079 return rv;
2080 }
2081
2082 /* This function runs in both the client and server. */
2083 static SECStatus
2084 ssl3_HandleRenegotiationInfoXtn(sslSocket *ss, PRUint16 ex_type, SECItem *data)
2085 {
2086 SECStatus rv = SECSuccess;
2087 PRUint32 len = 0;
2088
2089 if (ss->firstHsDone) {
2090 len = ss->sec.isServer ? ss->ssl3.hs.finishedBytes
2091 : ss->ssl3.hs.finishedBytes * 2;
2092 }
2093 if (data->len != 1 + len ||
2094 data->data[0] != len || (len &&
2095 NSS_SecureMemcmp(ss->ssl3.hs.finishedMsgs.data,
2096 data->data + 1, len))) {
2097 /* Can we do this here? Or, must we arrange for the caller to do it? */
2098 (void)SSL3_SendAlert(ss, alert_fatal, handshake_failure);
2099 PORT_SetError(SSL_ERROR_BAD_HANDSHAKE_HASH_VALUE);
2100 return SECFailure;
2101 }
2102 /* remember that we got this extension and it was correct. */
2103 ss->peerRequestedProtection = 1;
2104 ss->xtnData.negotiated[ss->xtnData.numNegotiated++] = ex_type;
2105 if (ss->sec.isServer) {
2106 /* prepare to send back the appropriate response */
2107 rv = ssl3_RegisterServerHelloExtensionSender(ss, ex_type,
2108 ssl3_SendRenegotiationInfoXtn);
2109 }
2110 return rv;
2111 }
2112
2113 static PRInt32
2114 ssl3_SendUseSRTPXtn(sslSocket *ss, PRBool append, PRUint32 maxBytes)
2115 {
2116 PRUint32 ext_data_len;
2117 PRInt16 i;
2118 SECStatus rv;
2119
2120 if (!ss)
2121 return 0;
2122
2123 if (!ss->sec.isServer) {
2124 /* Client side */
2125
2126 if (!IS_DTLS(ss) || !ss->ssl3.dtlsSRTPCipherCount)
2127 return 0; /* Not relevant */
2128
2129 ext_data_len = 2 + 2 * ss->ssl3.dtlsSRTPCipherCount + 1;
2130
2131 if (append && maxBytes >= 4 + ext_data_len) {
2132 /* Extension type */
2133 rv = ssl3_AppendHandshakeNumber(ss, ssl_use_srtp_xtn, 2);
2134 if (rv != SECSuccess) return -1;
2135 /* Length of extension data */
2136 rv = ssl3_AppendHandshakeNumber(ss, ext_data_len, 2);
2137 if (rv != SECSuccess) return -1;
2138 /* Length of the SRTP cipher list */
2139 rv = ssl3_AppendHandshakeNumber(ss,
2140 2 * ss->ssl3.dtlsSRTPCipherCount,
2141 2);
2142 if (rv != SECSuccess) return -1;
2143 /* The SRTP ciphers */
2144 for (i = 0; i < ss->ssl3.dtlsSRTPCipherCount; i++) {
2145 rv = ssl3_AppendHandshakeNumber(ss,
2146 ss->ssl3.dtlsSRTPCiphers[i],
2147 2);
2148 }
2149 /* Empty MKI value */
2150 ssl3_AppendHandshakeVariable(ss, NULL, 0, 1);
2151
2152 ss->xtnData.advertised[ss->xtnData.numAdvertised++] =
2153 ssl_use_srtp_xtn;
2154 }
2155
2156 return 4 + ext_data_len;
2157 }
2158
2159 /* Server side */
2160 if (append && maxBytes >= 9) {
2161 /* Extension type */
2162 rv = ssl3_AppendHandshakeNumber(ss, ssl_use_srtp_xtn, 2);
2163 if (rv != SECSuccess) return -1;
2164 /* Length of extension data */
2165 rv = ssl3_AppendHandshakeNumber(ss, 5, 2);
2166 if (rv != SECSuccess) return -1;
2167 /* Length of the SRTP cipher list */
2168 rv = ssl3_AppendHandshakeNumber(ss, 2, 2);
2169 if (rv != SECSuccess) return -1;
2170 /* The selected cipher */
2171 rv = ssl3_AppendHandshakeNumber(ss, ss->ssl3.dtlsSRTPCipherSuite, 2);
2172 if (rv != SECSuccess) return -1;
2173 /* Empty MKI value */
2174 ssl3_AppendHandshakeVariable(ss, NULL, 0, 1);
2175 }
2176
2177 return 9;
2178 }
2179
2180 static SECStatus
2181 ssl3_HandleUseSRTPXtn(sslSocket * ss, PRUint16 ex_type, SECItem *data)
2182 {
2183 SECStatus rv;
2184 SECItem ciphers = {siBuffer, NULL, 0};
2185 PRUint16 i;
2186 unsigned int j;
2187 PRUint16 cipher = 0;
2188 PRBool found = PR_FALSE;
2189 SECItem litem;
2190
2191 if (!ss->sec.isServer) {
2192 /* Client side */
2193 if (!data->data || !data->len) {
2194 /* malformed */
2195 return SECFailure;
2196 }
2197
2198 /* Get the cipher list */
2199 rv = ssl3_ConsumeHandshakeVariable(ss, &ciphers, 2,
2200 &data->data, &data->len);
2201 if (rv != SECSuccess) {
2202 return SECFailure;
2203 }
2204 /* Now check that the number of ciphers listed is 1 (len = 2) */
2205 if (ciphers.len != 2) {
2206 return SECFailure;
2207 }
2208
2209 /* Get the selected cipher */
2210 cipher = (ciphers.data[0] << 8) | ciphers.data[1];
2211
2212 /* Now check that this is one of the ciphers we offered */
2213 for (i = 0; i < ss->ssl3.dtlsSRTPCipherCount; i++) {
2214 if (cipher == ss->ssl3.dtlsSRTPCiphers[i]) {
2215 found = PR_TRUE;
2216 break;
2217 }
2218 }
2219
2220 if (!found) {
2221 return SECFailure;
2222 }
2223
2224 /* Get the srtp_mki value */
2225 rv = ssl3_ConsumeHandshakeVariable(ss, &litem, 1,
2226 &data->data, &data->len);
2227 if (rv != SECSuccess) {
2228 return SECFailure;
2229 }
2230
2231 /* We didn't offer an MKI, so this must be 0 length */
2232 /* XXX RFC 5764 Section 4.1.3 says:
2233 * If the client detects a nonzero-length MKI in the server's
2234 * response that is different than the one the client offered,
2235 * then the client MUST abort the handshake and SHOULD send an
2236 * invalid_parameter alert.
2237 *
2238 * Due to a limitation of the ssl3_HandleHelloExtensions function,
2239 * returning SECFailure here won't abort the handshake. It will
2240 * merely cause the use_srtp extension to be not negotiated. We
2241 * should fix this. See NSS bug 753136.
2242 */
2243 if (litem.len != 0) {
2244 return SECFailure;
2245 }
2246
2247 if (data->len != 0) {
2248 /* malformed */
2249 return SECFailure;
2250 }
2251
2252 /* OK, this looks fine. */
2253 ss->xtnData.negotiated[ss->xtnData.numNegotiated++] = ssl_use_srtp_xtn;
2254 ss->ssl3.dtlsSRTPCipherSuite = cipher;
2255 return SECSuccess;
2256 }
2257
2258 /* Server side */
2259 if (!IS_DTLS(ss) || !ss->ssl3.dtlsSRTPCipherCount) {
2260 /* Ignore the extension if we aren't doing DTLS or no DTLS-SRTP
2261 * preferences have been set. */
2262 return SECSuccess;
2263 }
2264
2265 if (!data->data || data->len < 5) {
2266 /* malformed */
2267 return SECFailure;
2268 }
2269
2270 /* Get the cipher list */
2271 rv = ssl3_ConsumeHandshakeVariable(ss, &ciphers, 2,
2272 &data->data, &data->len);
2273 if (rv != SECSuccess) {
2274 return SECFailure;
2275 }
2276 /* Check that the list is even length */
2277 if (ciphers.len % 2) {
2278 return SECFailure;
2279 }
2280
2281 /* Walk through the offered list and pick the most preferred of our
2282 * ciphers, if any */
2283 for (i = 0; !found && i < ss->ssl3.dtlsSRTPCipherCount; i++) {
2284 for (j = 0; j + 1 < ciphers.len; j += 2) {
2285 cipher = (ciphers.data[j] << 8) | ciphers.data[j + 1];
2286 if (cipher == ss->ssl3.dtlsSRTPCiphers[i]) {
2287 found = PR_TRUE;
2288 break;
2289 }
2290 }
2291 }
2292
2293 /* Get the srtp_mki value */
2294 rv = ssl3_ConsumeHandshakeVariable(ss, &litem, 1, &data->data, &data->len);
2295 if (rv != SECSuccess) {
2296 return SECFailure;
2297 }
2298
2299 if (data->len != 0) {
2300 return SECFailure; /* Malformed */
2301 }
2302
2303 /* Now figure out what to do */
2304 if (!found) {
2305 /* No matching ciphers */
2306 return SECSuccess;
2307 }
2308
2309 /* OK, we have a valid cipher and we've selected it */
2310 ss->ssl3.dtlsSRTPCipherSuite = cipher;
2311 ss->xtnData.negotiated[ss->xtnData.numNegotiated++] = ssl_use_srtp_xtn;
2312
2313 return ssl3_RegisterServerHelloExtensionSender(ss, ssl_use_srtp_xtn,
2314 ssl3_SendUseSRTPXtn);
2315 }
2316
2317 /* ssl3_ServerHandleSigAlgsXtn handles the signature_algorithms extension
2318 * from a client.
2319 * See https://tools.ietf.org/html/rfc5246#section-7.4.1.4.1 */
2320 static SECStatus
2321 ssl3_ServerHandleSigAlgsXtn(sslSocket * ss, PRUint16 ex_type, SECItem *data)
2322 {
2323 SECStatus rv;
2324 SECItem algorithms;
2325 const unsigned char *b;
2326 unsigned int numAlgorithms, i;
2327
2328 /* Ignore this extension if we aren't doing TLS 1.2 or greater. */
2329 if (ss->version < SSL_LIBRARY_VERSION_TLS_1_2) {
2330 return SECSuccess;
2331 }
2332
2333 /* Keep track of negotiated extensions. */
2334 ss->xtnData.negotiated[ss->xtnData.numNegotiated++] = ex_type;
2335
2336 rv = ssl3_ConsumeHandshakeVariable(ss, &algorithms, 2, &data->data,
2337 &data->len);
2338 if (rv != SECSuccess) {
2339 return SECFailure;
2340 }
2341 /* Trailing data, empty value, or odd-length value is invalid. */
2342 if (data->len != 0 || algorithms.len == 0 || (algorithms.len & 1) != 0) {
2343 PORT_SetError(SSL_ERROR_RX_MALFORMED_CLIENT_HELLO);
2344 return SECFailure;
2345 }
2346
2347 numAlgorithms = algorithms.len/2;
2348
2349 /* We don't care to process excessive numbers of algorithms. */
2350 if (numAlgorithms > 512) {
2351 numAlgorithms = 512;
2352 }
2353
2354 ss->ssl3.hs.clientSigAndHash =
2355 PORT_NewArray(SSL3SignatureAndHashAlgorithm, numAlgorithms);
2356 if (!ss->ssl3.hs.clientSigAndHash) {
2357 return SECFailure;
2358 }
2359 ss->ssl3.hs.numClientSigAndHash = 0;
2360
2361 b = algorithms.data;
2362 for (i = 0; i < numAlgorithms; i++) {
2363 unsigned char tls_hash = *(b++);
2364 unsigned char tls_sig = *(b++);
2365 SECOidTag hash = ssl3_TLSHashAlgorithmToOID(tls_hash);
2366
2367 if (hash == SEC_OID_UNKNOWN) {
2368 /* We ignore formats that we don't understand. */
2369 continue;
2370 }
2371 /* tls_sig support will be checked later in
2372 * ssl3_PickSignatureHashAlgorithm. */
2373 ss->ssl3.hs.clientSigAndHash[i].hashAlg = hash;
2374 ss->ssl3.hs.clientSigAndHash[i].sigAlg = tls_sig;
2375 ss->ssl3.hs.numClientSigAndHash++;
2376 }
2377
2378 if (!ss->ssl3.hs.numClientSigAndHash) {
2379 /* We didn't understand any of the client's requested signature
2380 * formats. We'll use the defaults. */
2381 PORT_Free(ss->ssl3.hs.clientSigAndHash);
2382 ss->ssl3.hs.clientSigAndHash = NULL;
2383 }
2384
2385 return SECSuccess;
2386 }
2387
2388 /* ssl3_ClientSendSigAlgsXtn sends the signature_algorithm extension for TLS
2389 * 1.2 ClientHellos. */
2390 static PRInt32
2391 ssl3_ClientSendSigAlgsXtn(sslSocket * ss, PRBool append, PRUint32 maxBytes)
2392 {
2393 static const unsigned char signatureAlgorithms[] = {
2394 /* This block is the contents of our signature_algorithms extension, in
2395 * wire format. See
2396 * https://tools.ietf.org/html/rfc5246#section-7.4.1.4.1 */
2397 tls_hash_sha256, tls_sig_rsa,
2398 tls_hash_sha384, tls_sig_rsa,
2399 tls_hash_sha1, tls_sig_rsa,
2400 #ifdef NSS_ENABLE_ECC
2401 tls_hash_sha256, tls_sig_ecdsa,
2402 tls_hash_sha384, tls_sig_ecdsa,
2403 tls_hash_sha1, tls_sig_ecdsa,
2404 #endif
2405 tls_hash_sha256, tls_sig_dsa,
2406 tls_hash_sha1, tls_sig_dsa,
2407 };
2408 PRInt32 extension_length;
2409
2410 if (ss->version < SSL_LIBRARY_VERSION_TLS_1_2) {
2411 return 0;
2412 }
2413
2414 extension_length =
2415 2 /* extension type */ +
2416 2 /* extension length */ +
2417 2 /* supported_signature_algorithms length */ +
2418 sizeof(signatureAlgorithms);
2419
2420 if (append && maxBytes >= extension_length) {
2421 SECStatus rv;
2422 rv = ssl3_AppendHandshakeNumber(ss, ssl_signature_algorithms_xtn, 2);
2423 if (rv != SECSuccess)
2424 goto loser;
2425 rv = ssl3_AppendHandshakeNumber(ss, extension_length - 4, 2);
2426 if (rv != SECSuccess)
2427 goto loser;
2428 rv = ssl3_AppendHandshakeVariable(ss, signatureAlgorithms,
2429 sizeof(signatureAlgorithms), 2);
2430 if (rv != SECSuccess)
2431 goto loser;
2432 ss->xtnData.advertised[ss->xtnData.numAdvertised++] =
2433 ssl_signature_algorithms_xtn;
2434 } else if (maxBytes < extension_length) {
2435 PORT_Assert(0);
2436 return 0;
2437 }
2438
2439 return extension_length;
2440
2441 loser:
2442 return -1;
2443 }
2444
2445 unsigned int
2446 ssl3_CalculatePaddingExtensionLength(unsigned int clientHelloLength)
2447 {
2448 unsigned int recordLength = 1 /* handshake message type */ +
2449 3 /* handshake message length */ +
2450 clientHelloLength;
2451 unsigned int extensionLength;
2452
2453 if (recordLength < 256 || recordLength >= 512) {
2454 return 0;
2455 }
2456
2457 extensionLength = 512 - recordLength;
2458 /* Extensions take at least four bytes to encode. Always include at least
2459 * one byte of data if including the extension. WebSphere Application Server
2460 * 7.0 is intolerant to the last extension being zero-length. */
2461 if (extensionLength < 4 + 1) {
2462 extensionLength = 4 + 1;
2463 }
2464
2465 return extensionLength;
2466 }
2467
2468 /* ssl3_AppendPaddingExtension possibly adds an extension which ensures that a
2469 * ClientHello record is either < 256 bytes or is >= 512 bytes. This ensures
2470 * that we don't trigger bugs in F5 products. */
2471 PRInt32
2472 ssl3_AppendPaddingExtension(sslSocket *ss, unsigned int extensionLen,
2473 PRUint32 maxBytes)
2474 {
2475 unsigned int paddingLen = extensionLen - 4;
2476 static unsigned char padding[256];
2477
2478 if (extensionLen == 0) {
2479 return 0;
2480 }
2481
2482 if (extensionLen < 4 ||
2483 extensionLen > maxBytes ||
2484 paddingLen > sizeof(padding)) {
2485 PORT_Assert(0);
2486 return -1;
2487 }
2488
2489 if (SECSuccess != ssl3_AppendHandshakeNumber(ss, ssl_padding_xtn, 2))
2490 return -1;
2491 if (SECSuccess != ssl3_AppendHandshakeNumber(ss, paddingLen, 2))
2492 return -1;
2493 if (SECSuccess != ssl3_AppendHandshake(ss, padding, paddingLen))
2494 return -1;
2495
2496 return extensionLen;
2497 }
2498
2499 /* ssl3_ClientSendSignedCertTimestampXtn sends the signed_certificate_timestamp
2500 * extension for TLS ClientHellos. */
2501 static PRInt32
2502 ssl3_ClientSendSignedCertTimestampXtn(sslSocket *ss, PRBool append,
2503 PRUint32 maxBytes)
2504 {
2505 PRInt32 extension_length = 2 /* extension_type */ +
2506 2 /* length(extension_data) */;
2507
2508 /* Only send the extension if processing is enabled. */
2509 if (!ss->opt.enableSignedCertTimestamps)
2510 return 0;
2511
2512 if (append && maxBytes >= extension_length) {
2513 SECStatus rv;
2514 /* extension_type */
2515 rv = ssl3_AppendHandshakeNumber(ss,
2516 ssl_signed_certificate_timestamp_xtn,
2517 2);
2518 if (rv != SECSuccess)
2519 goto loser;
2520 /* zero length */
2521 rv = ssl3_AppendHandshakeNumber(ss, 0, 2);
2522 if (rv != SECSuccess)
2523 goto loser;
2524 ss->xtnData.advertised[ss->xtnData.numAdvertised++] =
2525 ssl_signed_certificate_timestamp_xtn;
2526 } else if (maxBytes < extension_length) {
2527 PORT_Assert(0);
2528 return 0;
2529 }
2530
2531 return extension_length;
2532 loser:
2533 return -1;
2534 }
2535
2536 static SECStatus
2537 ssl3_ClientHandleSignedCertTimestampXtn(sslSocket *ss, PRUint16 ex_type,
2538 SECItem *data)
2539 {
2540 /* We do not yet know whether we'll be resuming a session or creating
2541 * a new one, so we keep a pointer to the data in the TLSExtensionData
2542 * structure. This pointer is only valid in the scope of
2543 * ssl3_HandleServerHello, and, if not resuming a session, the data is
2544 * copied once a new session structure has been set up.
2545 * All parsing is currently left to the application and we accept
2546 * everything, including empty data.
2547 */
2548 SECItem *scts = &ss->xtnData.signedCertTimestamps;
2549 PORT_Assert(!scts->data && !scts->len);
2550
2551 if (!data->len) {
2552 /* Empty extension data: RFC 6962 mandates non-empty contents. */
2553 return SECFailure;
2554 }
2555 *scts = *data;
2556 /* Keep track of negotiated extensions. */
2557 ss->xtnData.negotiated[ss->xtnData.numNegotiated++] = ex_type;
2558 return SECSuccess;
2559 }
OLDNEW
« no previous file with comments | « net/third_party/nss/ssl/ssl3ecc.c ('k') | net/third_party/nss/ssl/ssl3gthr.c » ('j') | no next file with comments »

Powered by Google App Engine
This is Rietveld 408576698