Branch data Line data Source code
1 : : /*
2 : : * Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved.
3 : : *
4 : : * Licensed under the Apache License, Version 2.0 (the "License").
5 : : * You may not use this file except in compliance with the License.
6 : : * A copy of the License is located at
7 : : *
8 : : * http://aws.amazon.com/apache2.0
9 : : *
10 : : * or in the "license" file accompanying this file. This file is distributed
11 : : * on an "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either
12 : : * express or implied. See the License for the specific language governing
13 : : * permissions and limitations under the License.
14 : : */
15 : :
16 : : #include <sys/param.h>
17 : : #include <time.h>
18 : :
19 : : #include "api/s2n.h"
20 : : #include "crypto/s2n_fips.h"
21 : : #include "error/s2n_errno.h"
22 : : #include "stuffer/s2n_stuffer.h"
23 : : #include "tls/s2n_alerts.h"
24 : : #include "tls/s2n_cipher_preferences.h"
25 : : #include "tls/s2n_cipher_suites.h"
26 : : #include "tls/s2n_connection.h"
27 : : #include "tls/s2n_security_policies.h"
28 : : #include "tls/s2n_server_extensions.h"
29 : : #include "tls/s2n_tls.h"
30 : : #include "tls/s2n_tls13.h"
31 : : #include "tls/s2n_tls13_handshake.h"
32 : : #include "tls/s2n_tls13_key_schedule.h"
33 : : #include "utils/s2n_bitmap.h"
34 : : #include "utils/s2n_random.h"
35 : : #include "utils/s2n_safety.h"
36 : :
37 : : /* From RFC5246 7.4.1.2. */
38 : : #define S2N_TLS_COMPRESSION_METHOD_NULL 0
39 : :
40 : : /* From RFC8446 4.1.3. */
41 : 9468 : #define S2N_DOWNGRADE_PROTECTION_SIZE 8
42 : : const uint8_t tls12_downgrade_protection_bytes[] = {
43 : : 0x44, 0x4F, 0x57, 0x4E, 0x47, 0x52, 0x44, 0x01
44 : : };
45 : :
46 : : const uint8_t tls11_downgrade_protection_bytes[] = {
47 : : 0x44, 0x4F, 0x57, 0x4E, 0x47, 0x52, 0x44, 0x00
48 : : };
49 : :
50 : : static int s2n_random_value_is_hello_retry(struct s2n_connection *conn)
51 : 7216 : {
52 [ - + ][ # # ]: 7216 : POSIX_ENSURE_REF(conn);
53 : :
54 [ + - ][ + + ]: 7216 : POSIX_ENSURE(s2n_constant_time_equals(hello_retry_req_random, conn->handshake_params.server_random, S2N_TLS_RANDOM_DATA_LEN),
55 : 615 : S2N_ERR_INVALID_HELLO_RETRY);
56 : :
57 : 615 : return S2N_SUCCESS;
58 : 7216 : }
59 : :
60 : : static int s2n_client_detect_downgrade_mechanism(struct s2n_connection *conn)
61 : 2322 : {
62 [ - + ][ # # ]: 2322 : POSIX_ENSURE_REF(conn);
63 : 2322 : uint8_t *downgrade_bytes = &conn->handshake_params.server_random[S2N_TLS_RANDOM_DATA_LEN - S2N_DOWNGRADE_PROTECTION_SIZE];
64 : :
65 : : /* Detect downgrade attacks according to RFC 8446 section 4.1.3 */
66 [ + + ][ + + ]: 2322 : if (conn->client_protocol_version == S2N_TLS13 && conn->server_protocol_version == S2N_TLS12) {
67 [ + + ]: 320 : if (s2n_constant_time_equals(downgrade_bytes, tls12_downgrade_protection_bytes, S2N_DOWNGRADE_PROTECTION_SIZE)) {
68 [ + - ]: 2 : POSIX_BAIL(S2N_ERR_PROTOCOL_DOWNGRADE_DETECTED);
69 : 2 : }
70 [ + + ][ + - ]: 2002 : } else if (conn->client_protocol_version == S2N_TLS13 && conn->server_protocol_version <= S2N_TLS11) {
71 [ + + ]: 250 : if (s2n_constant_time_equals(downgrade_bytes, tls11_downgrade_protection_bytes, S2N_DOWNGRADE_PROTECTION_SIZE)) {
72 [ + - ]: 1 : POSIX_BAIL(S2N_ERR_PROTOCOL_DOWNGRADE_DETECTED);
73 : 1 : }
74 : 250 : }
75 : :
76 : 2319 : return 0;
77 : 2322 : }
78 : :
79 : : static int s2n_server_add_downgrade_mechanism(struct s2n_connection *conn)
80 : 6576 : {
81 [ # # ][ - + ]: 6576 : POSIX_ENSURE_REF(conn);
82 : 6576 : uint8_t *downgrade_bytes = &conn->handshake_params.server_random[S2N_TLS_RANDOM_DATA_LEN - S2N_DOWNGRADE_PROTECTION_SIZE];
83 : :
84 : : /* Protect against downgrade attacks according to RFC 8446 section 4.1.3 */
85 [ + + ][ + + ]: 6576 : if (conn->server_protocol_version >= S2N_TLS13 && conn->actual_protocol_version == S2N_TLS12) {
86 : : /* TLS1.3 servers MUST use a special random value when negotiating TLS1.2 */
87 [ # # ][ - + ]: 37 : POSIX_CHECKED_MEMCPY(downgrade_bytes, tls12_downgrade_protection_bytes, S2N_DOWNGRADE_PROTECTION_SIZE);
[ + - ]
88 [ + + ][ + + ]: 6539 : } else if (conn->server_protocol_version >= S2N_TLS13 && conn->actual_protocol_version <= S2N_TLS11) {
89 : : /* TLS1.3 servers MUST, use a special random value when negotiating TLS1.1 or below */
90 [ - + ][ # # ]: 5 : POSIX_CHECKED_MEMCPY(downgrade_bytes, tls11_downgrade_protection_bytes, S2N_DOWNGRADE_PROTECTION_SIZE);
[ + - ]
91 : 5 : }
92 : :
93 : 6576 : return 0;
94 : 6576 : }
95 : :
96 : : static int s2n_server_hello_parse(struct s2n_connection *conn)
97 : 7216 : {
98 [ # # ][ - + ]: 7216 : POSIX_ENSURE_REF(conn);
99 [ # # ][ - + ]: 7216 : POSIX_ENSURE_REF(conn->secure);
100 : :
101 : 7216 : struct s2n_stuffer *in = &conn->handshake.io;
102 : 7216 : uint8_t compression_method = 0;
103 : 7216 : uint8_t session_id_len = 0;
104 : 7216 : uint8_t protocol_version[S2N_TLS_PROTOCOL_VERSION_LEN];
105 : 7216 : uint8_t session_id[S2N_TLS_SESSION_ID_MAX_LEN];
106 : :
107 [ - + ]: 7216 : POSIX_GUARD(s2n_stuffer_read_bytes(in, protocol_version, S2N_TLS_PROTOCOL_VERSION_LEN));
108 [ - + ]: 7216 : POSIX_GUARD(s2n_stuffer_read_bytes(in, conn->handshake_params.server_random, S2N_TLS_RANDOM_DATA_LEN));
109 : :
110 : 7216 : uint8_t legacy_version = (uint8_t) (protocol_version[0] * 10) + protocol_version[1];
111 : :
112 : : /**
113 : : *= https://www.rfc-editor.org/rfc/rfc8446#4.1.3
114 : : *# Upon receiving a message with type server_hello, implementations MUST
115 : : *# first examine the Random value and, if it matches this value, process
116 : : *# it as described in Section 4.1.4).
117 : : **/
118 [ + + ]: 7216 : if (s2n_random_value_is_hello_retry(conn) == S2N_SUCCESS) {
119 : : /**
120 : : *= https://www.rfc-editor.org/rfc/rfc8446#4.1.4
121 : : *# If a client receives a second
122 : : *# HelloRetryRequest in the same connection (i.e., where the ClientHello
123 : : *# was itself in response to a HelloRetryRequest), it MUST abort the
124 : : *# handshake with an "unexpected_message" alert.
125 : : **/
126 [ - + ][ # # ]: 615 : POSIX_ENSURE(!s2n_is_hello_retry_handshake(conn), S2N_ERR_INVALID_HELLO_RETRY);
127 : :
128 : : /**
129 : : *= https://www.rfc-editor.org/rfc/rfc8446#4.1.4
130 : : *# Upon receipt of a HelloRetryRequest, the client MUST check the
131 : : *# legacy_version
132 : : **/
133 [ # # ][ - + ]: 615 : POSIX_ENSURE(legacy_version == S2N_TLS12, S2N_ERR_INVALID_HELLO_RETRY);
134 : :
135 [ - + ]: 615 : POSIX_GUARD(s2n_set_hello_retry_required(conn));
136 : 615 : }
137 : :
138 [ - + ]: 7216 : POSIX_GUARD(s2n_stuffer_read_uint8(in, &session_id_len));
139 [ - + ][ # # ]: 7216 : S2N_ERROR_IF(session_id_len > S2N_TLS_SESSION_ID_MAX_LEN, S2N_ERR_BAD_MESSAGE);
140 [ - + ]: 7216 : POSIX_GUARD(s2n_stuffer_read_bytes(in, session_id, session_id_len));
141 : :
142 : 7216 : uint8_t *cipher_suite_wire = s2n_stuffer_raw_read(in, S2N_TLS_CIPHER_SUITE_LEN);
143 [ - + ][ # # ]: 7216 : POSIX_ENSURE_REF(cipher_suite_wire);
144 : :
145 [ - + ]: 7216 : POSIX_GUARD(s2n_stuffer_read_uint8(in, &compression_method));
146 : :
147 : : /**
148 : : *= https://www.rfc-editor.org/rfc/rfc8446#4.1.3
149 : : *# legacy_compression_method: A single byte which MUST have the
150 : : *# value 0.
151 : : *
152 : : *= https://www.rfc-editor.org/rfc/rfc8446#4.1.4
153 : : *# Upon receipt of a HelloRetryRequest, the client MUST check the
154 : : *# legacy_version, legacy_session_id_echo, cipher_suite, and
155 : : *# legacy_compression_method
156 : : **/
157 [ - + ][ # # ]: 7216 : S2N_ERROR_IF(compression_method != S2N_TLS_COMPRESSION_METHOD_NULL, S2N_ERR_BAD_MESSAGE);
158 : :
159 [ + + ][ + + ]: 7216 : bool session_ids_match = session_id_len != 0 && session_id_len == conn->session_id_len
160 [ + + ]: 7216 : && s2n_constant_time_equals(session_id, conn->session_id, session_id_len);
161 [ + + ]: 7216 : if (!session_ids_match) {
162 : 2365 : conn->ems_negotiated = false;
163 : 2365 : }
164 : :
165 [ + + ]: 7216 : POSIX_GUARD(s2n_server_extensions_recv(conn, in));
166 : :
167 : : /**
168 : : *= https://www.rfc-editor.org/rfc/rfc8446#4.1.4
169 : : *# The server's extensions MUST contain "supported_versions".
170 : : **/
171 [ + + ]: 7215 : if (s2n_is_hello_retry_message(conn)) {
172 : 615 : s2n_extension_type_id supported_versions_id = s2n_unsupported_extension;
173 [ - + ]: 615 : POSIX_GUARD(s2n_extension_supported_iana_value_to_id(TLS_EXTENSION_SUPPORTED_VERSIONS, &supported_versions_id));
174 [ # # ][ - + ]: 615 : POSIX_ENSURE(S2N_CBIT_TEST(conn->extension_responses_received, supported_versions_id),
175 : 615 : S2N_ERR_MISSING_EXTENSION);
176 : 615 : }
177 : :
178 [ + + ]: 7215 : if (conn->server_protocol_version >= S2N_TLS13) {
179 [ - + ][ # # ]: 4893 : POSIX_ENSURE(!conn->handshake.renegotiation, S2N_ERR_PROTOCOL_VERSION_UNSUPPORTED);
180 : :
181 : : /**
182 : : *= https://www.rfc-editor.org/rfc/rfc8446#section-4.1.3
183 : : *# A client which
184 : : *# receives a legacy_session_id_echo field that does not match what
185 : : *# it sent in the ClientHello MUST abort the handshake with an
186 : : *# "illegal_parameter" alert.
187 : : *
188 : : *= https://www.rfc-editor.org/rfc/rfc8446#4.1.4
189 : : *# Upon receipt of a HelloRetryRequest, the client MUST check the
190 : : *# legacy_version, legacy_session_id_echo
191 : : **/
192 [ + - ][ + + ]: 4893 : POSIX_ENSURE(session_ids_match || (session_id_len == 0 && conn->session_id_len == 0), S2N_ERR_BAD_MESSAGE);
[ + - ][ + + ]
193 : :
194 : 4828 : conn->actual_protocol_version = conn->server_protocol_version;
195 [ - + ]: 4828 : POSIX_GUARD(s2n_set_cipher_as_client(conn, cipher_suite_wire));
196 : :
197 : : /* Erase TLS 1.2 client session ticket which might have been set for session resumption */
198 [ - + ]: 4828 : POSIX_GUARD(s2n_free(&conn->client_ticket));
199 : 4828 : } else {
200 : 2322 : conn->server_protocol_version = legacy_version;
201 : :
202 [ + - ][ + + ]: 2322 : POSIX_ENSURE(!s2n_client_detect_downgrade_mechanism(conn), S2N_ERR_PROTOCOL_DOWNGRADE_DETECTED);
203 [ + + ][ + - ]: 2319 : POSIX_ENSURE(!s2n_connection_is_quic_enabled(conn), S2N_ERR_PROTOCOL_VERSION_UNSUPPORTED);
204 : :
205 : : /* Hello retries are only supported in >=TLS1.3. */
206 [ - + ][ # # ]: 2318 : POSIX_ENSURE(!s2n_is_hello_retry_handshake(conn), S2N_ERR_BAD_MESSAGE);
207 : :
208 : : /*
209 : : *= https://www.rfc-editor.org/rfc/rfc8446#appendix-D.3
210 : : *# A client that attempts to send 0-RTT data MUST fail a connection if
211 : : *# it receives a ServerHello with TLS 1.2 or older.
212 : : */
213 [ + + ][ + - ]: 2318 : POSIX_ENSURE(conn->early_data_state != S2N_EARLY_DATA_REQUESTED, S2N_ERR_PROTOCOL_VERSION_UNSUPPORTED);
214 : :
215 : 2316 : const struct s2n_security_policy *security_policy = NULL;
216 [ - + ]: 2316 : POSIX_GUARD(s2n_connection_get_security_policy(conn, &security_policy));
217 : :
218 [ - + ]: 2316 : if (conn->server_protocol_version < security_policy->minimum_protocol_version
219 [ - + ]: 2316 : || conn->server_protocol_version > conn->client_protocol_version) {
220 [ # # ]: 0 : POSIX_GUARD(s2n_queue_reader_unsupported_protocol_version_alert(conn));
221 [ # # ]: 0 : POSIX_BAIL(S2N_ERR_PROTOCOL_VERSION_UNSUPPORTED);
222 : 0 : }
223 : :
224 : 2316 : conn->actual_protocol_version = MIN(conn->server_protocol_version, conn->client_protocol_version);
225 : :
226 : : /*
227 : : *= https://www.rfc-editor.org/rfc/rfc5077#section-3.4
228 : : *# If the server accepts the ticket
229 : : *# and the Session ID is not empty, then it MUST respond with the same
230 : : *# Session ID present in the ClientHello. This allows the client to
231 : : *# easily differentiate when the server is resuming a session from when
232 : : *# it is falling back to a full handshake.
233 : : */
234 [ + + ]: 2316 : if (session_ids_match) {
235 : : /* check if the resumed session state is valid */
236 [ + + ][ + - ]: 25 : POSIX_ENSURE(conn->resume_protocol_version == conn->actual_protocol_version, S2N_ERR_BAD_MESSAGE);
237 [ + + ][ + - ]: 23 : POSIX_ENSURE(s2n_constant_time_equals(conn->secure->cipher_suite->iana_value, cipher_suite_wire, S2N_TLS_CIPHER_SUITE_LEN),
238 : 22 : S2N_ERR_BAD_MESSAGE);
239 : :
240 : : /* Session is resumed */
241 : 22 : conn->client_session_resumed = 1;
242 : 2291 : } else {
243 : 2291 : conn->session_id_len = session_id_len;
244 [ - + ][ # # ]: 2291 : POSIX_CHECKED_MEMCPY(conn->session_id, session_id, session_id_len);
[ + + ]
245 [ + + ]: 2291 : POSIX_GUARD(s2n_set_cipher_as_client(conn, cipher_suite_wire));
246 : : /* Erase master secret which might have been set for session resumption */
247 [ - + ][ # # ]: 2290 : POSIX_CHECKED_MEMSET((uint8_t *) conn->secrets.version.tls12.master_secret, 0, S2N_TLS_SECRET_LEN);
[ + - ]
248 : :
249 : : /* Erase client session ticket which might have been set for session resumption */
250 [ - + ]: 2290 : POSIX_GUARD(s2n_free(&conn->client_ticket));
251 : 2290 : }
252 : 2316 : }
253 : :
254 : : /* If it is not possible to accept early data on this connection
255 : : * (for example, because no PSK was negotiated) we need to reject early data now.
256 : : * Otherwise, early data logic may make certain invalid assumptions about the
257 : : * state of the connection (for example, that the prf is the early data prf).
258 : : */
259 [ - + ]: 7140 : POSIX_GUARD_RESULT(s2n_early_data_accept_or_reject(conn));
260 [ + + ]: 7140 : if (conn->early_data_state == S2N_EARLY_DATA_REJECTED) {
261 [ - + ]: 914 : POSIX_GUARD_RESULT(s2n_tls13_key_schedule_reset(conn));
262 : 914 : }
263 : :
264 : 7140 : return 0;
265 : 7140 : }
266 : :
267 : : int s2n_server_hello_recv(struct s2n_connection *conn)
268 : 7265 : {
269 [ - + ][ # # ]: 7265 : POSIX_ENSURE_REF(conn);
270 : :
271 : : /* Read the message off the wire */
272 [ + + ]: 7265 : POSIX_GUARD(s2n_server_hello_parse(conn));
273 : :
274 : 7180 : conn->actual_protocol_version_established = 1;
275 : :
276 [ - + ]: 7180 : POSIX_GUARD(s2n_conn_set_handshake_type(conn));
277 : :
278 : : /* If this is a HelloRetryRequest, we don't process the ServerHello.
279 : : * Instead we proceed with retry logic. */
280 [ + + ]: 7180 : if (s2n_is_hello_retry_message(conn)) {
281 [ + + ]: 645 : POSIX_GUARD(s2n_server_hello_retry_recv(conn));
282 : 644 : return 0;
283 : 645 : }
284 : :
285 [ + + ][ + + ]: 6535 : if (conn->actual_protocol_version < S2N_TLS13 && s2n_connection_is_session_resumed(conn)) {
286 [ - + ]: 22 : POSIX_GUARD(s2n_prf_key_expansion(conn));
287 : 22 : }
288 : :
289 : : /* Update the required hashes for this connection */
290 [ - + ]: 6535 : POSIX_GUARD(s2n_conn_update_required_handshake_hashes(conn));
291 : :
292 : 6535 : return 0;
293 : 6535 : }
294 : :
295 : : int s2n_server_hello_write_message(struct s2n_connection *conn)
296 : 7243 : {
297 [ # # ][ - + ]: 7243 : POSIX_ENSURE_REF(conn);
298 [ - + ][ # # ]: 7243 : POSIX_ENSURE_REF(conn->secure);
299 : :
300 : : /* The actual_protocol_version is set while processing the CLIENT_HELLO message, so
301 : : * it could be S2N_TLS13. SERVER_HELLO should always respond with the legacy version.
302 : : * https://tools.ietf.org/html/rfc8446#section-4.1.3 */
303 : 7243 : const uint16_t legacy_protocol_version = MIN(conn->actual_protocol_version, S2N_TLS12);
304 : 7243 : uint8_t protocol_version[S2N_TLS_PROTOCOL_VERSION_LEN];
305 : 7243 : protocol_version[0] = (uint8_t) (legacy_protocol_version / 10);
306 : 7243 : protocol_version[1] = (uint8_t) (legacy_protocol_version % 10);
307 : :
308 [ - + ]: 7243 : POSIX_GUARD(s2n_stuffer_write_bytes(&conn->handshake.io, protocol_version, S2N_TLS_PROTOCOL_VERSION_LEN));
309 [ - + ]: 7243 : POSIX_GUARD(s2n_stuffer_write_bytes(&conn->handshake.io, conn->handshake_params.server_random, S2N_TLS_RANDOM_DATA_LEN));
310 [ - + ]: 7243 : POSIX_GUARD(s2n_stuffer_write_uint8(&conn->handshake.io, conn->session_id_len));
311 [ - + ]: 7243 : POSIX_GUARD(s2n_stuffer_write_bytes(&conn->handshake.io, conn->session_id, conn->session_id_len));
312 [ - + ]: 7243 : POSIX_GUARD(s2n_stuffer_write_bytes(&conn->handshake.io, conn->secure->cipher_suite->iana_value, S2N_TLS_CIPHER_SUITE_LEN));
313 [ - + ]: 7243 : POSIX_GUARD(s2n_stuffer_write_uint8(&conn->handshake.io, S2N_TLS_COMPRESSION_METHOD_NULL));
314 : :
315 : 7243 : return 0;
316 : 7243 : }
317 : :
318 : : int s2n_server_hello_send(struct s2n_connection *conn)
319 : 6589 : {
320 [ - + ][ # # ]: 6589 : POSIX_ENSURE_REF(conn);
321 : :
322 : 6589 : struct s2n_stuffer server_random = { 0 };
323 : 6589 : struct s2n_blob b = { 0 };
324 [ - + ]: 6589 : POSIX_GUARD(s2n_blob_init(&b, conn->handshake_params.server_random, S2N_TLS_RANDOM_DATA_LEN));
325 : :
326 : : /* Create the server random data */
327 [ - + ]: 6589 : POSIX_GUARD(s2n_stuffer_init(&server_random, &b));
328 : :
329 : 6589 : struct s2n_blob rand_data = { 0 };
330 [ - + ]: 6589 : POSIX_GUARD(s2n_blob_init(&rand_data, s2n_stuffer_raw_write(&server_random, S2N_TLS_RANDOM_DATA_LEN), S2N_TLS_RANDOM_DATA_LEN));
331 [ - + ][ # # ]: 6589 : POSIX_ENSURE_REF(rand_data.data);
332 [ - + ]: 6589 : POSIX_GUARD_RESULT(s2n_get_public_random_data(&rand_data));
333 : :
334 : : /* Add a downgrade detection mechanism if required */
335 [ - + ]: 6589 : POSIX_GUARD(s2n_server_add_downgrade_mechanism(conn));
336 : :
337 [ - + ]: 6589 : POSIX_GUARD(s2n_server_hello_write_message(conn));
338 : :
339 [ - + ]: 6589 : POSIX_GUARD(s2n_server_extensions_send(conn, &conn->handshake.io));
340 : :
341 : 6589 : conn->actual_protocol_version_established = 1;
342 : :
343 : 6589 : return 0;
344 : 6589 : }
|
