| // Copyright 1995-2016 The OpenSSL Project Authors. All Rights Reserved. |
| // Copyright 2005 Nokia. All rights reserved. |
| // |
| // Licensed under the Apache License, Version 2.0 (the "License"); |
| // you may not use this file except in compliance with the License. |
| // You may obtain a copy of the License at |
| // |
| // https://www.apache.org/licenses/LICENSE-2.0 |
| // |
| // Unless required by applicable law or agreed to in writing, software |
| // distributed under the License is distributed on an "AS IS" BASIS, |
| // WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. |
| // See the License for the specific language governing permissions and |
| // limitations under the License. |
| |
| #include <openssl/ssl.h> |
| |
| #include <string_view> |
| |
| #include <openssl/buf.h> |
| #include <openssl/digest.h> |
| #include <openssl/err.h> |
| |
| #include "internal.h" |
| |
| |
| BSSL_NAMESPACE_BEGIN |
| |
| SSLTranscript::SSLTranscript(bool is_dtls) : is_dtls_(is_dtls) {} |
| |
| SSLTranscript::~SSLTranscript() {} |
| |
| bool SSLTranscript::Init() { |
| buffer_.reset(BUF_MEM_new()); |
| if (!buffer_) { |
| return false; |
| } |
| |
| hash_.Reset(); |
| return true; |
| } |
| |
| bool SSLTranscript::InitHash(uint16_t version, const SSL_CIPHER *cipher) { |
| version_ = version; |
| const EVP_MD *md = ssl_get_handshake_digest(version, cipher); |
| if (Digest() == md) { |
| // No need to re-hash the buffer. |
| return true; |
| } |
| if (!HashBuffer(hash_.get(), md)) { |
| return false; |
| } |
| if (is_dtls_ && version_ >= TLS1_3_VERSION) { |
| // In DTLS 1.3, prior to the call to InitHash, the message (if present) in |
| // the buffer has the DTLS 1.2 header. After the call to InitHash, the TLS |
| // 1.3 header is written by SSLTranscript::Update. If the buffer isn't freed |
| // here, it would have a mix of different header formats and using it would |
| // yield wrong results. However, there's no need for the buffer once the |
| // version and the digest for the cipher suite are known, so the buffer is |
| // freed here to avoid potential misuse of the SSLTranscript object. |
| FreeBuffer(); |
| } |
| return true; |
| } |
| |
| bool SSLTranscript::HashBuffer(EVP_MD_CTX *ctx, const EVP_MD *digest) const { |
| if (!EVP_DigestInit_ex(ctx, digest, nullptr)) { |
| return false; |
| } |
| if (!is_dtls_ || version_ < TLS1_3_VERSION) { |
| return EVP_DigestUpdate(ctx, buffer_->data, buffer_->length); |
| } |
| |
| // If the version is DTLS 1.3 and we still have a buffer, then there should be |
| // at most a single DTLSHandshake message in the buffer, for the ClientHello. |
| // On the server side, the version (DTLS 1.3) and cipher suite are chosen in |
| // response to the first ClientHello, and InitHash is called before that |
| // ClientHello is added to the SSLTranscript, so the buffer is empty if this |
| // SSLTranscript is on the server. |
| if (buffer_->length == 0) { |
| return true; |
| } |
| |
| // On the client side, we can receive either a ServerHello or |
| // HelloRetryRequest in response to the ClientHello. Regardless of which |
| // message we receive, the client code calls InitHash before updating the |
| // transcript with that message, so the ClientHello is the only message in the |
| // buffer. In DTLS 1.3, we need to skip the message_seq, fragment_offset, and |
| // fragment_length fields from the DTLSHandshake message in the buffer. The |
| // structure of a DTLSHandshake message is as follows (RFC 9147, section 5.2): |
| // |
| // struct { |
| // HandshakeType msg_type; /* handshake type */ |
| // uint24 length; /* bytes in message */ |
| // uint16 message_seq; /* DTLS-required field */ |
| // uint24 fragment_offset; /* DTLS-required field */ |
| // uint24 fragment_length; /* DTLS-required field */ |
| // select (msg_type) { |
| // /* omitted for brevity */ |
| // } body; |
| // } DTLSHandshake; |
| CBS buf, header; |
| CBS_init(&buf, reinterpret_cast<uint8_t *>(buffer_->data), buffer_->length); |
| if (!CBS_get_bytes(&buf, &header, 4) || // |
| !CBS_skip(&buf, 8) || // |
| !EVP_DigestUpdate(ctx, CBS_data(&header), CBS_len(&header)) || // |
| !EVP_DigestUpdate(ctx, CBS_data(&buf), CBS_len(&buf))) { |
| return false; |
| } |
| return true; |
| } |
| |
| void SSLTranscript::FreeBuffer() { buffer_.reset(); } |
| |
| size_t SSLTranscript::DigestLen() const { return EVP_MD_size(Digest()); } |
| |
| const EVP_MD *SSLTranscript::Digest() const { |
| return EVP_MD_CTX_get0_md(hash_.get()); |
| } |
| |
| bool SSLTranscript::UpdateForHelloRetryRequest() { |
| if (buffer_) { |
| buffer_->length = 0; |
| } |
| |
| uint8_t old_hash[EVP_MAX_MD_SIZE]; |
| size_t hash_len; |
| if (!GetHash(old_hash, &hash_len)) { |
| return false; |
| } |
| const uint8_t header[4] = {SSL3_MT_MESSAGE_HASH, 0, 0, |
| static_cast<uint8_t>(hash_len)}; |
| if (!EVP_DigestInit_ex(hash_.get(), Digest(), nullptr) || |
| !AddToBufferOrHash(header) || |
| !AddToBufferOrHash(Span(old_hash, hash_len))) { |
| return false; |
| } |
| return true; |
| } |
| |
| bool SSLTranscript::CopyToHashContext(EVP_MD_CTX *ctx, |
| const EVP_MD *digest) const { |
| const EVP_MD *transcript_digest = Digest(); |
| if (transcript_digest != nullptr && |
| EVP_MD_type(transcript_digest) == EVP_MD_type(digest)) { |
| return EVP_MD_CTX_copy_ex(ctx, hash_.get()); |
| } |
| |
| if (buffer_) { |
| return HashBuffer(ctx, digest); |
| } |
| |
| OPENSSL_PUT_ERROR(SSL, ERR_R_INTERNAL_ERROR); |
| return false; |
| } |
| |
| bool SSLTranscript::Update(Span<const uint8_t> in) { |
| if (!is_dtls_ || version_ < TLS1_3_VERSION) { |
| return AddToBufferOrHash(in); |
| } |
| if (in.size() < DTLS1_HM_HEADER_LENGTH) { |
| return false; |
| } |
| // The message passed into Update is the whole Handshake or DTLSHandshake |
| // message, including the msg_type and length. In DTLS, the DTLSHandshake |
| // message also has message_seq, fragment_offset, and fragment_length |
| // fields. In DTLS 1.3, those fields are omitted so that the same |
| // transcript format as TLS 1.3 is used. This means we write the 1-byte |
| // msg_type, 3-byte length, then skip 2+3+3 bytes for the DTLS-specific |
| // fields that get omitted. |
| if (!AddToBufferOrHash(in.subspan(0, 4)) || |
| !AddToBufferOrHash(in.subspan(12))) { |
| return false; |
| } |
| return true; |
| } |
| |
| bool SSLTranscript::AddToBufferOrHash(Span<const uint8_t> in) { |
| // Depending on the state of the handshake, either the handshake buffer may be |
| // active, the rolling hash, or both. |
| if (buffer_ && // |
| !BUF_MEM_append(buffer_.get(), in.data(), in.size())) { |
| return false; |
| } |
| |
| if (EVP_MD_CTX_md(hash_.get()) != NULL) { |
| EVP_DigestUpdate(hash_.get(), in.data(), in.size()); |
| } |
| |
| return true; |
| } |
| |
| bool SSLTranscript::GetHash(uint8_t *out, size_t *out_len) const { |
| ScopedEVP_MD_CTX ctx; |
| unsigned len; |
| if (!EVP_MD_CTX_copy_ex(ctx.get(), hash_.get()) || |
| !EVP_DigestFinal_ex(ctx.get(), out, &len)) { |
| return false; |
| } |
| *out_len = len; |
| return true; |
| } |
| |
| bool SSLTranscript::GetFinishedMAC(uint8_t *out, size_t *out_len, |
| const SSL_SESSION *session, |
| bool from_server) const { |
| uint8_t digest[EVP_MAX_MD_SIZE]; |
| size_t digest_len; |
| if (!GetHash(digest, &digest_len)) { |
| return false; |
| } |
| |
| std::string_view label = from_server ? "server finished" : "client finished"; |
| static const size_t kFinishedLen = 12; |
| if (!tls1_prf(Digest(), Span(out, kFinishedLen), session->secret, label, |
| Span(digest, digest_len), {})) { |
| return false; |
| } |
| |
| *out_len = kFinishedLen; |
| return true; |
| } |
| |
| BSSL_NAMESPACE_END |