Branch data Line data Source code
1 : : /*
2 : : * Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved.
3 : : *
4 : : * Licensed under the Apache License, Version 2.0 (the "License").
5 : : * You may not use this file except in compliance with the License.
6 : : * A copy of the License is located at
7 : : *
8 : : * http://aws.amazon.com/apache2.0
9 : : *
10 : : * or in the "license" file accompanying this file. This file is distributed
11 : : * on an "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either
12 : : * express or implied. See the License for the specific language governing
13 : : * permissions and limitations under the License.
14 : : */
15 : :
16 : : #include <sys/param.h>
17 : : #include <time.h>
18 : :
19 : : #include "api/s2n.h"
20 : : #include "error/s2n_errno.h"
21 : : #include "stuffer/s2n_stuffer.h"
22 : : #include "tls/s2n_alerts.h"
23 : : #include "tls/s2n_connection.h"
24 : : #include "tls/s2n_record.h"
25 : : #include "tls/s2n_resume.h"
26 : : #include "tls/s2n_tls.h"
27 : : #include "tls/s2n_tls13_handshake.h"
28 : : #include "utils/s2n_random.h"
29 : : #include "utils/s2n_safety.h"
30 : :
31 : : /*
32 : : * The maximum size of the NewSessionTicket message, not taking into account the
33 : : * ticket itself.
34 : : *
35 : : * To get the actual maximum size required for the NewSessionTicket message, we'll need
36 : : * to add the size of the ticket, which is much less predictable.
37 : : *
38 : : * This constant is enforced via unit tests.
39 : : */
40 : 297 : #define S2N_TLS13_MAX_FIXED_NEW_SESSION_TICKET_SIZE 112
41 : :
42 : : int s2n_server_nst_recv(struct s2n_connection *conn)
43 : 18 : {
44 [ - + ]: 18 : POSIX_GUARD(s2n_stuffer_read_uint32(&conn->handshake.io, &conn->ticket_lifetime_hint));
45 : :
46 : 18 : uint16_t session_ticket_len = 0;
47 [ - + ]: 18 : POSIX_GUARD(s2n_stuffer_read_uint16(&conn->handshake.io, &session_ticket_len));
48 : :
49 [ + + ]: 18 : if (session_ticket_len > 0) {
50 [ - + ]: 17 : POSIX_GUARD(s2n_realloc(&conn->client_ticket, session_ticket_len));
51 : :
52 [ - + ]: 17 : POSIX_GUARD(s2n_stuffer_read(&conn->handshake.io, &conn->client_ticket));
53 : :
54 [ + + ]: 17 : if (conn->config->session_ticket_cb != NULL) {
55 : 7 : size_t session_len = s2n_connection_get_session_length(conn);
56 : :
57 : : /* Alloc some memory for the serialized session ticket */
58 : 7 : DEFER_CLEANUP(struct s2n_blob mem = { 0 }, s2n_free);
59 [ - + ]: 7 : POSIX_GUARD(s2n_alloc(&mem,
60 : 7 : S2N_STATE_FORMAT_LEN + S2N_SESSION_TICKET_SIZE_LEN + conn->client_ticket.size + S2N_TLS12_STATE_SIZE_IN_BYTES));
61 : :
62 [ - + ]: 7 : POSIX_GUARD(s2n_connection_get_session(conn, mem.data, session_len));
63 : 7 : uint32_t session_lifetime = s2n_connection_get_session_ticket_lifetime_hint(conn);
64 : :
65 : 7 : struct s2n_session_ticket ticket = { .ticket_data = mem, .session_lifetime = session_lifetime };
66 : :
67 [ - + ][ # # ]: 7 : POSIX_ENSURE(conn->config->session_ticket_cb(conn, conn->config->session_ticket_ctx, &ticket) >= S2N_SUCCESS,
68 : 7 : S2N_ERR_CANCELLED);
69 : 7 : }
70 : 17 : }
71 : :
72 : 18 : return S2N_SUCCESS;
73 : 18 : }
74 : :
75 : : static S2N_RESULT s2n_generate_ticket_lifetime(struct s2n_connection *conn, uint64_t key_intro_time,
76 : : uint32_t *ticket_lifetime)
77 : 402 : {
78 [ # # ][ - + ]: 402 : RESULT_ENSURE_REF(conn);
79 [ - + ][ # # ]: 402 : RESULT_ENSURE_REF(conn->config);
80 [ - + ][ # # ]: 402 : RESULT_ENSURE_MUT(ticket_lifetime);
81 : :
82 : 402 : uint64_t now = 0;
83 [ - + ]: 402 : RESULT_GUARD(s2n_config_wall_clock(conn->config, &now));
84 : :
85 : : /* Calculate ticket key age */
86 [ - + ][ # # ]: 402 : RESULT_ENSURE_GTE(now, key_intro_time);
87 : 402 : uint64_t ticket_key_age_in_nanos = now - key_intro_time;
88 : :
89 : : /* Calculate remaining key lifetime */
90 : 402 : uint64_t key_lifetime_in_nanos = conn->config->encrypt_decrypt_key_lifetime_in_nanos + conn->config->decrypt_key_lifetime_in_nanos;
91 [ - + ][ # # ]: 402 : RESULT_ENSURE_GTE(key_lifetime_in_nanos, ticket_key_age_in_nanos);
92 : 402 : uint32_t remaining_key_lifetime = (key_lifetime_in_nanos - ticket_key_age_in_nanos) / ONE_SEC_IN_NANOS;
93 : :
94 : 402 : uint32_t session_lifetime = conn->config->session_state_lifetime_in_nanos / ONE_SEC_IN_NANOS;
95 : :
96 : : /* Min of remaining key lifetime and session */
97 : 402 : uint32_t min_lifetime = MIN(remaining_key_lifetime, session_lifetime);
98 : :
99 : : /* In TLS1.3 we take into account keying material lifetime */
100 [ + + ]: 402 : if (conn->actual_protocol_version == S2N_TLS13) {
101 : 385 : uint32_t key_material_lifetime = conn->server_keying_material_lifetime;
102 : 385 : struct s2n_psk *chosen_psk = conn->psk_params.chosen_psk;
103 [ + + ]: 385 : if (chosen_psk) {
104 [ # # ][ - + ]: 186 : RESULT_ENSURE_GTE(chosen_psk->keying_material_expiration, now);
105 : 186 : uint32_t psk_key_material_lifetime = (chosen_psk->keying_material_expiration - now) / ONE_SEC_IN_NANOS;
106 : 186 : key_material_lifetime = MIN(key_material_lifetime, psk_key_material_lifetime);
107 : 186 : }
108 : 385 : min_lifetime = MIN(min_lifetime, key_material_lifetime);
109 : 385 : }
110 : :
111 : : /**
112 : : *= https://www.rfc-editor.org/rfc/rfc8446#section-4.6.1
113 : : *# Servers MUST NOT use any value greater than
114 : : *# 604800 seconds (7 days).
115 : : **/
116 : 402 : *ticket_lifetime = MIN(min_lifetime, ONE_WEEK_IN_SEC);
117 : :
118 : 402 : return S2N_RESULT_OK;
119 : 402 : }
120 : :
121 : : int s2n_server_nst_send(struct s2n_connection *conn)
122 : 21 : {
123 [ # # ][ - + ]: 21 : POSIX_ENSURE_REF(conn);
124 : :
125 : 21 : uint8_t data[S2N_TLS12_TICKET_SIZE_IN_BYTES] = { 0 };
126 : 21 : struct s2n_blob session_ticket = { 0 };
127 [ - + ]: 21 : POSIX_GUARD(s2n_blob_init(&session_ticket, data, sizeof(data)));
128 : :
129 : 21 : uint32_t lifetime_hint_in_secs = 0;
130 : :
131 : : /* Send a zero-length ticket in the NewSessionTicket message if the server changes
132 : : * its mind mid-handshake or if there are no valid encrypt keys currently available.
133 : : *
134 : : *= https://www.rfc-editor.org/rfc/rfc5077#section-3.3
135 : : *# If the server determines that it does not want to include a
136 : : *# ticket after it has included the SessionTicket extension in the
137 : : *# ServerHello, then it sends a zero-length ticket in the
138 : : *# NewSessionTicket handshake message.
139 : : **/
140 [ + + ]: 21 : if (s2n_result_is_error(s2n_server_nst_write(conn, &lifetime_hint_in_secs, &session_ticket))) {
141 [ - + ]: 3 : POSIX_GUARD(s2n_stuffer_write_uint32(&conn->handshake.io, 0));
142 [ - + ]: 3 : POSIX_GUARD(s2n_stuffer_write_uint16(&conn->handshake.io, 0));
143 : 3 : return S2N_SUCCESS;
144 : 3 : }
145 : :
146 [ - + ]: 18 : POSIX_GUARD(s2n_stuffer_write_uint32(&conn->handshake.io, lifetime_hint_in_secs));
147 [ - + ]: 18 : POSIX_GUARD(s2n_stuffer_write_uint16(&conn->handshake.io, session_ticket.size));
148 [ - + ]: 18 : POSIX_GUARD(s2n_stuffer_write(&conn->handshake.io, &session_ticket));
149 : :
150 : : /* For parity with TLS1.3, track the single ticket sent.
151 : : * This simplifies s2n_connection_get_tickets_sent.
152 : : */
153 : 18 : conn->tickets_sent++;
154 : 18 : return S2N_SUCCESS;
155 : 18 : }
156 : :
157 : : S2N_RESULT s2n_server_nst_write(struct s2n_connection *conn, uint32_t *lifetime_hint_in_secs,
158 : : struct s2n_blob *session_ticket)
159 : 21 : {
160 [ # # ][ - + ]: 21 : RESULT_ENSURE_REF(conn);
161 [ + - ][ + - ]: 21 : RESULT_ENSURE(s2n_server_sending_nst(conn), S2N_ERR_SENDING_NST);
[ + + ]
162 : :
163 : 19 : struct s2n_stuffer output = { 0 };
164 [ - + ]: 19 : RESULT_GUARD_POSIX(s2n_stuffer_init(&output, session_ticket));
165 : :
166 : 19 : struct s2n_ticket_key *key = s2n_get_ticket_encrypt_decrypt_key(conn->config);
167 [ + - ][ + + ]: 19 : RESULT_ENSURE(key != NULL, S2N_ERR_NO_TICKET_ENCRYPT_DECRYPT_KEY);
168 : :
169 [ - + ]: 18 : RESULT_GUARD(s2n_generate_ticket_lifetime(conn, key->intro_timestamp, lifetime_hint_in_secs));
170 [ - + ]: 18 : RESULT_GUARD(s2n_resume_encrypt_session_ticket(conn, key, &output));
171 : :
172 : 18 : return S2N_RESULT_OK;
173 : 18 : }
174 : :
175 : : S2N_RESULT s2n_tls13_server_nst_send(struct s2n_connection *conn, s2n_blocked_status *blocked)
176 : 49138 : {
177 [ # # ][ - + ]: 49138 : RESULT_ENSURE_REF(conn);
178 [ + + ][ + - ]: 49138 : RESULT_ENSURE_GTE(conn->actual_protocol_version, S2N_TLS13);
179 : :
180 : : /* Usually tickets are sent immediately after the handshake.
181 : : * If possible, reuse the handshake IO stuffer before it's wiped.
182 : : *
183 : : * Note: handshake.io isn't explicitly dedicated to only reading or only writing,
184 : : * so we have to be careful using it outside of s2n_negotiate.
185 : : * If we use it for writing here, we CAN'T use it for reading any post-handshake messages.
186 : : */
187 : 49137 : struct s2n_stuffer *nst_stuffer = &conn->handshake.io;
188 : :
189 [ + + ][ + + ]: 49137 : if (conn->mode != S2N_SERVER || !conn->config->use_tickets) {
190 : 48718 : return S2N_RESULT_OK;
191 : 48718 : }
192 : :
193 : : /* Legacy behavior is that the s2n server sends a NST even if the client did not indicate support
194 : : * for resumption or does not support the psk_dhe_ke mode. This is potentially wasteful so we
195 : : * choose to not extend this behavior to QUIC.
196 : : */
197 [ + + ][ + + ]: 419 : if (conn->quic_enabled && conn->psk_params.psk_ke_mode != S2N_PSK_DHE_KE) {
198 : 3 : return S2N_RESULT_OK;
199 : 3 : }
200 : :
201 : : /* No-op if all tickets already sent.
202 : : * Clean up the stuffer used for the ticket to conserve memory. */
203 [ + + ]: 416 : if (conn->tickets_to_send == conn->tickets_sent) {
204 [ - + ]: 118 : RESULT_GUARD_POSIX(s2n_stuffer_resize(nst_stuffer, 0));
205 : 118 : return S2N_RESULT_OK;
206 : 118 : }
207 : :
208 : : /**
209 : : *= https://www.rfc-editor.org/rfc/rfc8446#section-4.6.1
210 : : *# Note that in principle it is possible to continue issuing new tickets
211 : : *# which indefinitely extend the lifetime of the keying material
212 : : *# originally derived from an initial non-PSK handshake (which was most
213 : : *# likely tied to the peer's certificate). It is RECOMMENDED that
214 : : *# implementations place limits on the total lifetime of such keying
215 : : *# material; these limits should take into account the lifetime of the
216 : : *# peer's certificate, the likelihood of intervening revocation, and the
217 : : *# time since the peer's online CertificateVerify signature.
218 : : */
219 [ + + ]: 298 : if (s2n_result_is_error(s2n_psk_validate_keying_material(conn))) {
220 : 1 : conn->tickets_to_send = conn->tickets_sent;
221 : 1 : return S2N_RESULT_OK;
222 : 1 : }
223 : :
224 [ # # ][ - + ]: 297 : RESULT_ENSURE(conn->tickets_sent <= conn->tickets_to_send, S2N_ERR_INTEGER_OVERFLOW);
225 : :
226 : 297 : size_t session_state_size = 0;
227 [ - + ]: 297 : RESULT_GUARD(s2n_connection_get_session_state_size(conn, &session_state_size));
228 : 297 : const size_t maximum_nst_size = session_state_size + S2N_TLS13_MAX_FIXED_NEW_SESSION_TICKET_SIZE;
229 [ + + ]: 297 : if (s2n_stuffer_space_remaining(nst_stuffer) < maximum_nst_size) {
230 [ - + ]: 128 : RESULT_GUARD_POSIX(s2n_stuffer_resize(nst_stuffer, maximum_nst_size));
231 : 128 : }
232 : :
233 [ + + ]: 593 : while (conn->tickets_to_send - conn->tickets_sent > 0) {
234 [ + + ]: 322 : if (s2n_result_is_error(s2n_tls13_server_nst_write(conn, nst_stuffer))) {
235 : 5 : return S2N_RESULT_OK;
236 : 5 : }
237 : :
238 [ + + ]: 317 : RESULT_GUARD(s2n_post_handshake_write_records(conn, blocked));
239 : 317 : }
240 : :
241 : 271 : return S2N_RESULT_OK;
242 : 297 : }
243 : :
244 : : /**
245 : : *= https://www.rfc-editor.org/rfc/rfc8446#section-4.6.1
246 : : *# A per-ticket value that is unique across all tickets
247 : : *# issued on this connection.
248 : : **/
249 : : static S2N_RESULT s2n_generate_ticket_nonce(uint16_t value, struct s2n_blob *output)
250 : 384 : {
251 [ # # ][ - + ]: 384 : RESULT_ENSURE_MUT(output);
252 : :
253 : 384 : struct s2n_stuffer stuffer = { 0 };
254 [ - + ]: 384 : RESULT_GUARD_POSIX(s2n_stuffer_init(&stuffer, output));
255 [ - + ]: 384 : RESULT_GUARD_POSIX(s2n_stuffer_write_uint16(&stuffer, value));
256 : :
257 : 384 : return S2N_RESULT_OK;
258 : 384 : }
259 : :
260 : : /**
261 : : *= https://www.rfc-editor.org/rfc/rfc8446#section-4.6.1
262 : : *# A securely generated, random 32-bit value that is
263 : : *# used to obscure the age of the ticket that the client includes in
264 : : *# the "pre_shared_key" extension.
265 : : **/
266 : : static S2N_RESULT s2n_generate_ticket_age_add(struct s2n_blob *random_data, uint32_t *ticket_age_add)
267 : 384 : {
268 [ - + ][ # # ]: 384 : RESULT_ENSURE_REF(random_data);
269 [ - + ][ # # ]: 384 : RESULT_ENSURE_REF(ticket_age_add);
270 : :
271 : 384 : struct s2n_stuffer stuffer = { 0 };
272 [ - + ]: 384 : RESULT_GUARD_POSIX(s2n_stuffer_init(&stuffer, random_data));
273 [ - + ]: 384 : RESULT_GUARD_POSIX(s2n_stuffer_skip_write(&stuffer, random_data->size));
274 [ - + ]: 384 : RESULT_GUARD_POSIX(s2n_stuffer_read_uint32(&stuffer, ticket_age_add));
275 : :
276 : 384 : return S2N_RESULT_OK;
277 : 384 : }
278 : :
279 : : /**
280 : : *= https://www.rfc-editor.org/rfc/rfc8446#section-4.6.1
281 : : *# The PSK associated with the ticket is computed as:
282 : : *#
283 : : *# HKDF-Expand-Label(resumption_master_secret,
284 : : *# "resumption", ticket_nonce, Hash.length)
285 : : **/
286 : : static int s2n_generate_session_secret(struct s2n_connection *conn, struct s2n_blob *nonce, struct s2n_blob *output)
287 : 841 : {
288 [ - + ][ # # ]: 841 : POSIX_ENSURE_REF(conn);
289 [ - + ][ # # ]: 841 : POSIX_ENSURE_REF(nonce);
290 [ - + ][ # # ]: 841 : POSIX_ENSURE_REF(output);
291 : :
292 [ - + ]: 841 : s2n_tls13_connection_keys(secrets, conn);
293 : 841 : struct s2n_blob master_secret = { 0 };
294 [ - + ]: 841 : POSIX_GUARD(s2n_blob_init(&master_secret, conn->secrets.version.tls13.resumption_master_secret, secrets.size));
295 [ - + ]: 841 : POSIX_GUARD(s2n_realloc(output, secrets.size));
296 [ - + ]: 841 : POSIX_GUARD_RESULT(s2n_tls13_derive_session_ticket_secret(&secrets, &master_secret, nonce, output));
297 : :
298 : 841 : return S2N_SUCCESS;
299 : 841 : }
300 : :
301 : : S2N_RESULT s2n_tls13_server_nst_write(struct s2n_connection *conn, struct s2n_stuffer *output)
302 : 426 : {
303 [ - + ][ # # ]: 426 : RESULT_ENSURE_REF(conn);
304 [ - + ][ # # ]: 426 : RESULT_ENSURE_REF(output);
305 : :
306 : 426 : struct s2n_ticket_key *key = s2n_get_ticket_encrypt_decrypt_key(conn->config);
307 [ + + ][ + - ]: 426 : RESULT_ENSURE(key != NULL, S2N_ERR_NO_TICKET_ENCRYPT_DECRYPT_KEY);
308 : :
309 : 421 : struct s2n_ticket_fields *ticket_fields = &conn->tls13_ticket_fields;
310 : :
311 : : /* Write message type because session resumption in TLS13 is a post-handshake message */
312 [ - + ]: 421 : RESULT_GUARD_POSIX(s2n_stuffer_write_uint8(output, TLS_SERVER_NEW_SESSION_TICKET));
313 : :
314 : 421 : struct s2n_stuffer_reservation message_size = { 0 };
315 [ - + ]: 421 : RESULT_GUARD_POSIX(s2n_stuffer_reserve_uint24(output, &message_size));
316 : :
317 : 421 : uint32_t ticket_lifetime_in_secs = 0;
318 [ - + ]: 421 : RESULT_GUARD(s2n_generate_ticket_lifetime(conn, key->intro_timestamp, &ticket_lifetime_in_secs));
319 : :
320 [ + + ][ + - ]: 421 : RESULT_ENSURE(ticket_lifetime_in_secs > 0, S2N_ERR_ZERO_LIFETIME_TICKET);
321 [ - + ]: 419 : RESULT_GUARD_POSIX(s2n_stuffer_write_uint32(output, ticket_lifetime_in_secs));
322 : :
323 : : /* Get random data to use as ticket_age_add value */
324 : 419 : uint8_t data[sizeof(uint32_t)] = { 0 };
325 : 419 : struct s2n_blob random_data = { 0 };
326 [ - + ]: 419 : RESULT_GUARD_POSIX(s2n_blob_init(&random_data, data, sizeof(data)));
327 : : /**
328 : : *= https://www.rfc-editor.org/rfc/rfc8446#section-4.6.1
329 : : *# The server MUST generate a fresh value
330 : : *# for each ticket it sends.
331 : : **/
332 [ - + ]: 419 : RESULT_GUARD(s2n_get_private_random_data(&random_data));
333 [ - + ]: 419 : RESULT_GUARD(s2n_generate_ticket_age_add(&random_data, &ticket_fields->ticket_age_add));
334 [ - + ]: 419 : RESULT_GUARD_POSIX(s2n_stuffer_write_uint32(output, ticket_fields->ticket_age_add));
335 : :
336 : : /* Write ticket nonce */
337 : 419 : uint8_t nonce_data[sizeof(uint16_t)] = { 0 };
338 : 419 : struct s2n_blob nonce = { 0 };
339 [ - + ]: 419 : RESULT_GUARD_POSIX(s2n_blob_init(&nonce, nonce_data, sizeof(nonce_data)));
340 [ - + ]: 419 : RESULT_GUARD(s2n_generate_ticket_nonce(conn->tickets_sent, &nonce));
341 [ - + ]: 419 : RESULT_GUARD_POSIX(s2n_stuffer_write_uint8(output, nonce.size));
342 [ - + ]: 419 : RESULT_GUARD_POSIX(s2n_stuffer_write_bytes(output, nonce.data, nonce.size));
343 : :
344 : : /* Derive individual session ticket secret */
345 [ - + ]: 419 : RESULT_GUARD_POSIX(s2n_generate_session_secret(conn, &nonce, &ticket_fields->session_secret));
346 : :
347 : : /* Write ticket */
348 : 419 : struct s2n_stuffer_reservation ticket_size = { 0 };
349 [ - + ]: 419 : RESULT_GUARD_POSIX(s2n_stuffer_reserve_uint16(output, &ticket_size));
350 [ - + ]: 419 : RESULT_GUARD(s2n_resume_encrypt_session_ticket(conn, key, output));
351 [ + + ]: 419 : RESULT_GUARD_POSIX(s2n_stuffer_write_vector_size(&ticket_size));
352 : :
353 [ - + ]: 418 : RESULT_GUARD_POSIX(s2n_extension_list_send(S2N_EXTENSION_LIST_NST, conn, output));
354 : :
355 [ - + ]: 418 : RESULT_GUARD_POSIX(s2n_stuffer_write_vector_size(&message_size));
356 : :
357 [ + - ][ + + ]: 418 : RESULT_ENSURE(conn->tickets_sent < UINT16_MAX, S2N_ERR_INTEGER_OVERFLOW);
358 : 417 : conn->tickets_sent++;
359 : :
360 : 417 : return S2N_RESULT_OK;
361 : 418 : }
362 : :
363 : : /**
364 : : *= https://www.rfc-editor.org/rfc/rfc8446#section-4.6.1
365 : : *# struct {
366 : : *# uint32 ticket_lifetime;
367 : : *# uint32 ticket_age_add;
368 : : *# opaque ticket_nonce<0..255>;
369 : : *# opaque ticket<1..2^16-1>;
370 : : *# Extension extensions<0..2^16-2>;
371 : : *# } NewSessionTicket;
372 : : **/
373 : : S2N_RESULT s2n_tls13_server_nst_recv(struct s2n_connection *conn, struct s2n_stuffer *input)
374 : 476 : {
375 [ # # ][ - + ]: 476 : RESULT_ENSURE_REF(conn);
376 [ - + ][ # # ]: 476 : RESULT_ENSURE_REF(input);
377 [ # # ][ - + ]: 476 : RESULT_ENSURE_REF(conn->config);
378 : :
379 [ + - ][ + + ]: 476 : RESULT_ENSURE(conn->actual_protocol_version >= S2N_TLS13, S2N_ERR_BAD_MESSAGE);
380 [ + + ][ + - ]: 475 : RESULT_ENSURE(conn->mode == S2N_CLIENT, S2N_ERR_BAD_MESSAGE);
381 : :
382 [ + + ]: 472 : if (!conn->config->use_tickets) {
383 : 1 : return S2N_RESULT_OK;
384 : 1 : }
385 : 471 : struct s2n_ticket_fields *ticket_fields = &conn->tls13_ticket_fields;
386 : :
387 : : /* Handle `ticket_lifetime` field */
388 : 471 : uint32_t ticket_lifetime = 0;
389 [ - + ]: 471 : RESULT_GUARD_POSIX(s2n_stuffer_read_uint32(input, &ticket_lifetime));
390 : : /**
391 : : *= https://www.rfc-editor.org/rfc/rfc8446#section-4.6.1
392 : : *# Servers MUST NOT use any value greater than
393 : : *# 604800 seconds (7 days).
394 : : */
395 [ + + ][ + - ]: 471 : RESULT_ENSURE(ticket_lifetime <= ONE_WEEK_IN_SEC, S2N_ERR_BAD_MESSAGE);
396 : : /**
397 : : *= https://www.rfc-editor.org/rfc/rfc8446#section-4.6.1
398 : : *# The value of zero indicates that the
399 : : *# ticket should be discarded immediately.
400 : : */
401 [ + + ]: 470 : if (ticket_lifetime == 0) {
402 : 1 : return S2N_RESULT_OK;
403 : 1 : }
404 : 469 : conn->ticket_lifetime_hint = ticket_lifetime;
405 : :
406 : : /* Handle `ticket_age_add` field */
407 [ - + ]: 469 : RESULT_GUARD_POSIX(s2n_stuffer_read_uint32(input, &ticket_fields->ticket_age_add));
408 : :
409 : : /* Handle `ticket_nonce` field */
410 : 469 : uint8_t ticket_nonce_len = 0;
411 [ - + ]: 469 : RESULT_GUARD_POSIX(s2n_stuffer_read_uint8(input, &ticket_nonce_len));
412 : 469 : uint8_t nonce_data[UINT8_MAX] = { 0 };
413 : 469 : struct s2n_blob nonce = { 0 };
414 [ - + ]: 469 : RESULT_GUARD_POSIX(s2n_blob_init(&nonce, nonce_data, ticket_nonce_len));
415 [ - + ]: 469 : RESULT_GUARD_POSIX(s2n_stuffer_read_bytes(input, nonce.data, ticket_nonce_len));
416 [ - + ]: 469 : RESULT_GUARD_POSIX(s2n_generate_session_secret(conn, &nonce, &ticket_fields->session_secret));
417 : :
418 : : /* Handle `ticket` field */
419 : 469 : uint16_t session_ticket_len = 0;
420 [ - + ]: 469 : RESULT_GUARD_POSIX(s2n_stuffer_read_uint16(input, &session_ticket_len));
421 [ - + ][ # # ]: 469 : RESULT_ENSURE(session_ticket_len > 0, S2N_ERR_SAFETY);
422 [ - + ]: 469 : RESULT_GUARD_POSIX(s2n_realloc(&conn->client_ticket, session_ticket_len));
423 [ - + ]: 469 : RESULT_GUARD_POSIX(s2n_stuffer_read(input, &conn->client_ticket));
424 : :
425 : : /* Handle `extensions` field */
426 [ - + ]: 469 : RESULT_GUARD_POSIX(s2n_extension_list_recv(S2N_EXTENSION_LIST_NST, conn, input));
427 : :
428 [ + + ]: 469 : if (conn->config->session_ticket_cb != NULL) {
429 : : /* Retrieve serialized session data */
430 : 422 : const uint16_t session_state_size = s2n_connection_get_session_length(conn);
431 : 422 : DEFER_CLEANUP(struct s2n_blob session_state = { 0 }, s2n_free);
432 [ - + ]: 422 : RESULT_GUARD_POSIX(s2n_realloc(&session_state, session_state_size));
433 [ - + ]: 422 : RESULT_GUARD_POSIX(s2n_connection_get_session(conn, session_state.data, session_state.size));
434 : :
435 : 422 : struct s2n_session_ticket ticket = {
436 : 422 : .ticket_data = session_state,
437 : 422 : .session_lifetime = ticket_lifetime
438 : 422 : };
439 [ # # ][ - + ]: 422 : RESULT_ENSURE(conn->config->session_ticket_cb(conn, conn->config->session_ticket_ctx, &ticket) >= S2N_SUCCESS,
440 : 422 : S2N_ERR_CANCELLED);
441 : 422 : }
442 : :
443 : 469 : return S2N_RESULT_OK;
444 : 469 : }
|
