tortls.c 82 KB

1234567891011121314151617181920212223242526272829303132333435363738394041424344454647484950515253545556575859606162636465666768697071727374757677787980818283848586878889909192939495969798991001011021031041051061071081091101111121131141151161171181191201211221231241251261271281291301311321331341351361371381391401411421431441451461471481491501511521531541551561571581591601611621631641651661671681691701711721731741751761771781791801811821831841851861871881891901911921931941951961971981992002012022032042052062072082092102112122132142152162172182192202212222232242252262272282292302312322332342352362372382392402412422432442452462472482492502512522532542552562572582592602612622632642652662672682692702712722732742752762772782792802812822832842852862872882892902912922932942952962972982993003013023033043053063073083093103113123133143153163173183193203213223233243253263273283293303313323333343353363373383393403413423433443453463473483493503513523533543553563573583593603613623633643653663673683693703713723733743753763773783793803813823833843853863873883893903913923933943953963973983994004014024034044054064074084094104114124134144154164174184194204214224234244254264274284294304314324334344354364374384394404414424434444454464474484494504514524534544554564574584594604614624634644654664674684694704714724734744754764774784794804814824834844854864874884894904914924934944954964974984995005015025035045055065075085095105115125135145155165175185195205215225235245255265275285295305315325335345355365375385395405415425435445455465475485495505515525535545555565575585595605615625635645655665675685695705715725735745755765775785795805815825835845855865875885895905915925935945955965975985996006016026036046056066076086096106116126136146156166176186196206216226236246256266276286296306316326336346356366376386396406416426436446456466476486496506516526536546556566576586596606616626636646656666676686696706716726736746756766776786796806816826836846856866876886896906916926936946956966976986997007017027037047057067077087097107117127137147157167177187197207217227237247257267277287297307317327337347357367377387397407417427437447457467477487497507517527537547557567577587597607617627637647657667677687697707717727737747757767777787797807817827837847857867877887897907917927937947957967977987998008018028038048058068078088098108118128138148158168178188198208218228238248258268278288298308318328338348358368378388398408418428438448458468478488498508518528538548558568578588598608618628638648658668678688698708718728738748758768778788798808818828838848858868878888898908918928938948958968978988999009019029039049059069079089099109119129139149159169179189199209219229239249259269279289299309319329339349359369379389399409419429439449459469479489499509519529539549559569579589599609619629639649659669679689699709719729739749759769779789799809819829839849859869879889899909919929939949959969979989991000100110021003100410051006100710081009101010111012101310141015101610171018101910201021102210231024102510261027102810291030103110321033103410351036103710381039104010411042104310441045104610471048104910501051105210531054105510561057105810591060106110621063106410651066106710681069107010711072107310741075107610771078107910801081108210831084108510861087108810891090109110921093109410951096109710981099110011011102110311041105110611071108110911101111111211131114111511161117111811191120112111221123112411251126112711281129113011311132113311341135113611371138113911401141114211431144114511461147114811491150115111521153115411551156115711581159116011611162116311641165116611671168116911701171117211731174117511761177117811791180118111821183118411851186118711881189119011911192119311941195119611971198119912001201120212031204120512061207120812091210121112121213121412151216121712181219122012211222122312241225122612271228122912301231123212331234123512361237123812391240124112421243124412451246124712481249125012511252125312541255125612571258125912601261126212631264126512661267126812691270127112721273127412751276127712781279128012811282128312841285128612871288128912901291129212931294129512961297129812991300130113021303130413051306130713081309131013111312131313141315131613171318131913201321132213231324132513261327132813291330133113321333133413351336133713381339134013411342134313441345134613471348134913501351135213531354135513561357135813591360136113621363136413651366136713681369137013711372137313741375137613771378137913801381138213831384138513861387138813891390139113921393139413951396139713981399140014011402140314041405140614071408140914101411141214131414141514161417141814191420142114221423142414251426142714281429143014311432143314341435143614371438143914401441144214431444144514461447144814491450145114521453145414551456145714581459146014611462146314641465146614671468146914701471147214731474147514761477147814791480148114821483148414851486148714881489149014911492149314941495149614971498149915001501150215031504150515061507150815091510151115121513151415151516151715181519152015211522152315241525152615271528152915301531153215331534153515361537153815391540154115421543154415451546154715481549155015511552155315541555155615571558155915601561156215631564156515661567156815691570157115721573157415751576157715781579158015811582158315841585158615871588158915901591159215931594159515961597159815991600160116021603160416051606160716081609161016111612161316141615161616171618161916201621162216231624162516261627162816291630163116321633163416351636163716381639164016411642164316441645164616471648164916501651165216531654165516561657165816591660166116621663166416651666166716681669167016711672167316741675167616771678167916801681168216831684168516861687168816891690169116921693169416951696169716981699170017011702170317041705170617071708170917101711171217131714171517161717171817191720172117221723172417251726172717281729173017311732173317341735173617371738173917401741174217431744174517461747174817491750175117521753175417551756175717581759176017611762176317641765176617671768176917701771177217731774177517761777177817791780178117821783178417851786178717881789179017911792179317941795179617971798179918001801180218031804180518061807180818091810181118121813181418151816181718181819182018211822182318241825182618271828182918301831183218331834183518361837183818391840184118421843184418451846184718481849185018511852185318541855185618571858185918601861186218631864186518661867186818691870187118721873187418751876187718781879188018811882188318841885188618871888188918901891189218931894189518961897189818991900190119021903190419051906190719081909191019111912191319141915191619171918191919201921192219231924192519261927192819291930193119321933193419351936193719381939194019411942194319441945194619471948194919501951195219531954195519561957195819591960196119621963196419651966196719681969197019711972197319741975197619771978197919801981198219831984198519861987198819891990199119921993199419951996199719981999200020012002200320042005200620072008200920102011201220132014201520162017201820192020202120222023202420252026202720282029203020312032203320342035203620372038203920402041204220432044204520462047204820492050205120522053205420552056205720582059206020612062206320642065206620672068206920702071207220732074207520762077207820792080208120822083208420852086208720882089209020912092209320942095209620972098209921002101210221032104210521062107210821092110211121122113211421152116211721182119212021212122212321242125212621272128212921302131213221332134213521362137213821392140214121422143214421452146214721482149215021512152215321542155215621572158215921602161216221632164216521662167216821692170217121722173217421752176217721782179218021812182218321842185218621872188218921902191219221932194219521962197219821992200220122022203220422052206220722082209221022112212221322142215221622172218221922202221222222232224222522262227222822292230223122322233223422352236223722382239224022412242224322442245224622472248224922502251225222532254225522562257225822592260226122622263226422652266226722682269227022712272227322742275227622772278227922802281228222832284228522862287228822892290229122922293229422952296229722982299230023012302230323042305230623072308230923102311231223132314231523162317231823192320232123222323232423252326232723282329233023312332233323342335233623372338233923402341234223432344234523462347234823492350235123522353235423552356235723582359236023612362236323642365236623672368236923702371237223732374237523762377237823792380238123822383238423852386238723882389239023912392239323942395239623972398239924002401240224032404240524062407240824092410241124122413241424152416241724182419242024212422242324242425242624272428242924302431243224332434243524362437243824392440244124422443244424452446244724482449245024512452245324542455245624572458245924602461246224632464246524662467246824692470247124722473247424752476247724782479248024812482248324842485248624872488248924902491249224932494249524962497249824992500250125022503250425052506250725082509251025112512251325142515251625172518251925202521252225232524252525262527252825292530253125322533253425352536253725382539254025412542254325442545254625472548254925502551255225532554255525562557255825592560256125622563256425652566256725682569257025712572257325742575257625772578257925802581258225832584258525862587258825892590259125922593259425952596259725982599260026012602260326042605260626072608260926102611261226132614261526162617261826192620262126222623262426252626262726282629263026312632263326342635263626372638263926402641264226432644264526462647264826492650265126522653265426552656265726582659266026612662266326642665266626672668266926702671
  1. /* Copyright (c) 2003, Roger Dingledine.
  2. * Copyright (c) 2004-2006, Roger Dingledine, Nick Mathewson.
  3. * Copyright (c) 2007-2018, The Tor Project, Inc. */
  4. /* See LICENSE for licensing information */
  5. /**
  6. * \file tortls.c
  7. * \brief Wrapper functions to present a consistent interface to
  8. * TLS, SSL, and X.509 functions from OpenSSL.
  9. **/
  10. /* (Unlike other tor functions, these
  11. * are prefixed with tor_ in order to avoid conflicting with OpenSSL
  12. * functions and variables.)
  13. */
  14. #include "orconfig.h"
  15. #define TORTLS_PRIVATE
  16. #define TORTLS_OPENSSL_PRIVATE
  17. #ifdef _WIN32 /*wrkard for dtls1.h >= 0.9.8m of "#include <winsock.h>"*/
  18. #include <winsock2.h>
  19. #include <ws2tcpip.h>
  20. #endif
  21. #include "lib/crypt_ops/crypto_cipher.h"
  22. #include "lib/crypt_ops/crypto_rand.h"
  23. #include "lib/crypt_ops/crypto_dh.h"
  24. #include "lib/crypt_ops/crypto_util.h"
  25. /* Some versions of OpenSSL declare SSL_get_selected_srtp_profile twice in
  26. * srtp.h. Suppress the GCC warning so we can build with -Wredundant-decl. */
  27. DISABLE_GCC_WARNING(redundant-decls)
  28. #include <openssl/opensslv.h>
  29. #ifdef OPENSSL_NO_EC
  30. #error "We require OpenSSL with ECC support"
  31. #endif
  32. #include <openssl/ssl.h>
  33. #include <openssl/ssl3.h>
  34. #include <openssl/err.h>
  35. #include <openssl/tls1.h>
  36. #include <openssl/asn1.h>
  37. #include <openssl/bio.h>
  38. #include <openssl/bn.h>
  39. #include <openssl/rsa.h>
  40. ENABLE_GCC_WARNING(redundant-decls)
  41. #define TORTLS_PRIVATE
  42. #include "lib/tls/tortls.h"
  43. #include "lib/log/log.h"
  44. #include "lib/log/util_bug.h"
  45. #include "lib/container/smartlist.h"
  46. #include "lib/string/compat_string.h"
  47. #include "lib/string/printf.h"
  48. #include "lib/net/socket.h"
  49. #include "lib/intmath/cmp.h"
  50. #include "lib/ctime/di_ops.h"
  51. #include "lib/encoding/time_fmt.h"
  52. #include <stdlib.h>
  53. #include <string.h>
  54. #include "lib/arch/bytes.h"
  55. #ifdef OPENSSL_1_1_API
  56. #define X509_get_notBefore_const(cert) \
  57. X509_get0_notBefore(cert)
  58. #define X509_get_notAfter_const(cert) \
  59. X509_get0_notAfter(cert)
  60. #ifndef X509_get_notBefore
  61. #define X509_get_notBefore(cert) \
  62. X509_getm_notBefore(cert)
  63. #endif
  64. #ifndef X509_get_notAfter
  65. #define X509_get_notAfter(cert) \
  66. X509_getm_notAfter(cert)
  67. #endif
  68. #else /* ! OPENSSL_VERSION_NUMBER >= OPENSSL_V_SERIES(1,1,0) */
  69. #define X509_get_notBefore_const(cert) \
  70. ((const ASN1_TIME*) X509_get_notBefore((X509 *)cert))
  71. #define X509_get_notAfter_const(cert) \
  72. ((const ASN1_TIME*) X509_get_notAfter((X509 *)cert))
  73. #endif
  74. /* Copied from or.h */
  75. #define LEGAL_NICKNAME_CHARACTERS \
  76. "abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789"
  77. /** How long do identity certificates live? (sec) */
  78. #define IDENTITY_CERT_LIFETIME (365*24*60*60)
  79. #define ADDR(tls) (((tls) && (tls)->address) ? tls->address : "peer")
  80. #if OPENSSL_VERSION_NUMBER < OPENSSL_V(1,0,0,'f')
  81. /* This is a version of OpenSSL before 1.0.0f. It does not have
  82. * the CVE-2011-4576 fix, and as such it can't use RELEASE_BUFFERS and
  83. * SSL3 safely at the same time.
  84. */
  85. #define DISABLE_SSL3_HANDSHAKE
  86. #endif /* OPENSSL_VERSION_NUMBER < OPENSSL_V(1,0,0,'f') */
  87. /* We redefine these so that we can run correctly even if the vendor gives us
  88. * a version of OpenSSL that does not match its header files. (Apple: I am
  89. * looking at you.)
  90. */
  91. #ifndef SSL_OP_ALLOW_UNSAFE_LEGACY_RENEGOTIATION
  92. #define SSL_OP_ALLOW_UNSAFE_LEGACY_RENEGOTIATION 0x00040000L
  93. #endif
  94. #ifndef SSL3_FLAGS_ALLOW_UNSAFE_LEGACY_RENEGOTIATION
  95. #define SSL3_FLAGS_ALLOW_UNSAFE_LEGACY_RENEGOTIATION 0x0010
  96. #endif
  97. /** Return values for tor_tls_classify_client_ciphers.
  98. *
  99. * @{
  100. */
  101. /** An error occurred when examining the client ciphers */
  102. #define CIPHERS_ERR -1
  103. /** The client cipher list indicates that a v1 handshake was in use. */
  104. #define CIPHERS_V1 1
  105. /** The client cipher list indicates that the client is using the v2 or the
  106. * v3 handshake, but that it is (probably!) lying about what ciphers it
  107. * supports */
  108. #define CIPHERS_V2 2
  109. /** The client cipher list indicates that the client is using the v2 or the
  110. * v3 handshake, and that it is telling the truth about what ciphers it
  111. * supports */
  112. #define CIPHERS_UNRESTRICTED 3
  113. /** @} */
  114. /** The ex_data index in which we store a pointer to an SSL object's
  115. * corresponding tor_tls_t object. */
  116. STATIC int tor_tls_object_ex_data_index = -1;
  117. /** Helper: Allocate tor_tls_object_ex_data_index. */
  118. STATIC void
  119. tor_tls_allocate_tor_tls_object_ex_data_index(void)
  120. {
  121. if (tor_tls_object_ex_data_index == -1) {
  122. tor_tls_object_ex_data_index =
  123. SSL_get_ex_new_index(0, NULL, NULL, NULL, NULL);
  124. tor_assert(tor_tls_object_ex_data_index != -1);
  125. }
  126. }
  127. /** Helper: given a SSL* pointer, return the tor_tls_t object using that
  128. * pointer. */
  129. STATIC tor_tls_t *
  130. tor_tls_get_by_ssl(const SSL *ssl)
  131. {
  132. tor_tls_t *result = SSL_get_ex_data(ssl, tor_tls_object_ex_data_index);
  133. if (result)
  134. tor_assert(result->magic == TOR_TLS_MAGIC);
  135. return result;
  136. }
  137. static void tor_tls_context_decref(tor_tls_context_t *ctx);
  138. static void tor_tls_context_incref(tor_tls_context_t *ctx);
  139. static int check_cert_lifetime_internal(int severity, const X509 *cert,
  140. time_t now,
  141. int past_tolerance, int future_tolerance);
  142. /** Global TLS contexts. We keep them here because nobody else needs
  143. * to touch them.
  144. *
  145. * @{ */
  146. STATIC tor_tls_context_t *server_tls_context = NULL;
  147. STATIC tor_tls_context_t *client_tls_context = NULL;
  148. /**@}*/
  149. /** True iff tor_tls_init() has been called. */
  150. static int tls_library_is_initialized = 0;
  151. /* Module-internal error codes. */
  152. #define TOR_TLS_SYSCALL_ (MIN_TOR_TLS_ERROR_VAL_ - 2)
  153. #define TOR_TLS_ZERORETURN_ (MIN_TOR_TLS_ERROR_VAL_ - 1)
  154. /** Write a description of the current state of <b>tls</b> into the
  155. * <b>sz</b>-byte buffer at <b>buf</b>. */
  156. void
  157. tor_tls_get_state_description(tor_tls_t *tls, char *buf, size_t sz)
  158. {
  159. const char *ssl_state;
  160. const char *tortls_state;
  161. if (PREDICT_UNLIKELY(!tls || !tls->ssl)) {
  162. strlcpy(buf, "(No SSL object)", sz);
  163. return;
  164. }
  165. ssl_state = SSL_state_string_long(tls->ssl);
  166. switch (tls->state) {
  167. #define CASE(st) case TOR_TLS_ST_##st: tortls_state = " in "#st ; break
  168. CASE(HANDSHAKE);
  169. CASE(OPEN);
  170. CASE(GOTCLOSE);
  171. CASE(SENTCLOSE);
  172. CASE(CLOSED);
  173. CASE(RENEGOTIATE);
  174. #undef CASE
  175. case TOR_TLS_ST_BUFFEREVENT:
  176. tortls_state = "";
  177. break;
  178. default:
  179. tortls_state = " in unknown TLS state";
  180. break;
  181. }
  182. tor_snprintf(buf, sz, "%s%s", ssl_state, tortls_state);
  183. }
  184. /** Log a single error <b>err</b> as returned by ERR_get_error(), which was
  185. * received while performing an operation <b>doing</b> on <b>tls</b>. Log
  186. * the message at <b>severity</b>, in log domain <b>domain</b>. */
  187. void
  188. tor_tls_log_one_error(tor_tls_t *tls, unsigned long err,
  189. int severity, int domain, const char *doing)
  190. {
  191. const char *state = NULL, *addr;
  192. const char *msg, *lib, *func;
  193. state = (tls && tls->ssl)?SSL_state_string_long(tls->ssl):"---";
  194. addr = tls ? tls->address : NULL;
  195. /* Some errors are known-benign, meaning they are the fault of the other
  196. * side of the connection. The caller doesn't know this, so override the
  197. * priority for those cases. */
  198. switch (ERR_GET_REASON(err)) {
  199. case SSL_R_HTTP_REQUEST:
  200. case SSL_R_HTTPS_PROXY_REQUEST:
  201. case SSL_R_RECORD_LENGTH_MISMATCH:
  202. #ifndef OPENSSL_1_1_API
  203. case SSL_R_RECORD_TOO_LARGE:
  204. #endif
  205. case SSL_R_UNKNOWN_PROTOCOL:
  206. case SSL_R_UNSUPPORTED_PROTOCOL:
  207. severity = LOG_INFO;
  208. break;
  209. default:
  210. break;
  211. }
  212. msg = (const char*)ERR_reason_error_string(err);
  213. lib = (const char*)ERR_lib_error_string(err);
  214. func = (const char*)ERR_func_error_string(err);
  215. if (!msg) msg = "(null)";
  216. if (!lib) lib = "(null)";
  217. if (!func) func = "(null)";
  218. if (doing) {
  219. tor_log(severity, domain, "TLS error while %s%s%s: %s (in %s:%s:%s)",
  220. doing, addr?" with ":"", addr?addr:"",
  221. msg, lib, func, state);
  222. } else {
  223. tor_log(severity, domain, "TLS error%s%s: %s (in %s:%s:%s)",
  224. addr?" with ":"", addr?addr:"",
  225. msg, lib, func, state);
  226. }
  227. }
  228. /** Log all pending tls errors at level <b>severity</b> in log domain
  229. * <b>domain</b>. Use <b>doing</b> to describe our current activities.
  230. */
  231. STATIC void
  232. tls_log_errors(tor_tls_t *tls, int severity, int domain, const char *doing)
  233. {
  234. unsigned long err;
  235. while ((err = ERR_get_error()) != 0) {
  236. tor_tls_log_one_error(tls, err, severity, domain, doing);
  237. }
  238. }
  239. /** Convert an errno (or a WSAerrno on windows) into a TOR_TLS_* error
  240. * code. */
  241. STATIC int
  242. tor_errno_to_tls_error(int e)
  243. {
  244. switch (e) {
  245. case SOCK_ERRNO(ECONNRESET): // most common
  246. return TOR_TLS_ERROR_CONNRESET;
  247. case SOCK_ERRNO(ETIMEDOUT):
  248. return TOR_TLS_ERROR_TIMEOUT;
  249. case SOCK_ERRNO(EHOSTUNREACH):
  250. case SOCK_ERRNO(ENETUNREACH):
  251. return TOR_TLS_ERROR_NO_ROUTE;
  252. case SOCK_ERRNO(ECONNREFUSED):
  253. return TOR_TLS_ERROR_CONNREFUSED; // least common
  254. default:
  255. return TOR_TLS_ERROR_MISC;
  256. }
  257. }
  258. /** Given a TOR_TLS_* error code, return a string equivalent. */
  259. const char *
  260. tor_tls_err_to_string(int err)
  261. {
  262. if (err >= 0)
  263. return "[Not an error.]";
  264. switch (err) {
  265. case TOR_TLS_ERROR_MISC: return "misc error";
  266. case TOR_TLS_ERROR_IO: return "unexpected close";
  267. case TOR_TLS_ERROR_CONNREFUSED: return "connection refused";
  268. case TOR_TLS_ERROR_CONNRESET: return "connection reset";
  269. case TOR_TLS_ERROR_NO_ROUTE: return "host unreachable";
  270. case TOR_TLS_ERROR_TIMEOUT: return "connection timed out";
  271. case TOR_TLS_CLOSE: return "closed";
  272. case TOR_TLS_WANTREAD: return "want to read";
  273. case TOR_TLS_WANTWRITE: return "want to write";
  274. default: return "(unknown error code)";
  275. }
  276. }
  277. #define CATCH_SYSCALL 1
  278. #define CATCH_ZERO 2
  279. /** Given a TLS object and the result of an SSL_* call, use
  280. * SSL_get_error to determine whether an error has occurred, and if so
  281. * which one. Return one of TOR_TLS_{DONE|WANTREAD|WANTWRITE|ERROR}.
  282. * If extra&CATCH_SYSCALL is true, return TOR_TLS_SYSCALL_ instead of
  283. * reporting syscall errors. If extra&CATCH_ZERO is true, return
  284. * TOR_TLS_ZERORETURN_ instead of reporting zero-return errors.
  285. *
  286. * If an error has occurred, log it at level <b>severity</b> and describe the
  287. * current action as <b>doing</b>.
  288. */
  289. STATIC int
  290. tor_tls_get_error(tor_tls_t *tls, int r, int extra,
  291. const char *doing, int severity, int domain)
  292. {
  293. int err = SSL_get_error(tls->ssl, r);
  294. int tor_error = TOR_TLS_ERROR_MISC;
  295. switch (err) {
  296. case SSL_ERROR_NONE:
  297. return TOR_TLS_DONE;
  298. case SSL_ERROR_WANT_READ:
  299. return TOR_TLS_WANTREAD;
  300. case SSL_ERROR_WANT_WRITE:
  301. return TOR_TLS_WANTWRITE;
  302. case SSL_ERROR_SYSCALL:
  303. if (extra&CATCH_SYSCALL)
  304. return TOR_TLS_SYSCALL_;
  305. if (r == 0) {
  306. tor_log(severity, LD_NET, "TLS error: unexpected close while %s (%s)",
  307. doing, SSL_state_string_long(tls->ssl));
  308. tor_error = TOR_TLS_ERROR_IO;
  309. } else {
  310. int e = tor_socket_errno(tls->socket);
  311. tor_log(severity, LD_NET,
  312. "TLS error: <syscall error while %s> (errno=%d: %s; state=%s)",
  313. doing, e, tor_socket_strerror(e),
  314. SSL_state_string_long(tls->ssl));
  315. tor_error = tor_errno_to_tls_error(e);
  316. }
  317. tls_log_errors(tls, severity, domain, doing);
  318. return tor_error;
  319. case SSL_ERROR_ZERO_RETURN:
  320. if (extra&CATCH_ZERO)
  321. return TOR_TLS_ZERORETURN_;
  322. tor_log(severity, LD_NET, "TLS connection closed while %s in state %s",
  323. doing, SSL_state_string_long(tls->ssl));
  324. tls_log_errors(tls, severity, domain, doing);
  325. return TOR_TLS_CLOSE;
  326. default:
  327. tls_log_errors(tls, severity, domain, doing);
  328. return TOR_TLS_ERROR_MISC;
  329. }
  330. }
  331. /** Initialize OpenSSL, unless it has already been initialized.
  332. */
  333. static void
  334. tor_tls_init(void)
  335. {
  336. check_no_tls_errors();
  337. if (!tls_library_is_initialized) {
  338. #ifdef OPENSSL_1_1_API
  339. OPENSSL_init_ssl(OPENSSL_INIT_LOAD_SSL_STRINGS, NULL);
  340. #else
  341. SSL_library_init();
  342. SSL_load_error_strings();
  343. #endif
  344. #if (SIZEOF_VOID_P >= 8 && \
  345. OPENSSL_VERSION_NUMBER >= OPENSSL_V_SERIES(1,0,1))
  346. long version = OpenSSL_version_num();
  347. /* LCOV_EXCL_START : we can't test these lines on the same machine */
  348. if (version >= OPENSSL_V_SERIES(1,0,1)) {
  349. /* Warn if we could *almost* be running with much faster ECDH.
  350. If we're built for a 64-bit target, using OpenSSL 1.0.1, but we
  351. don't have one of the built-in __uint128-based speedups, we are
  352. just one build operation away from an accelerated handshake.
  353. (We could be looking at OPENSSL_NO_EC_NISTP_64_GCC_128 instead of
  354. doing this test, but that gives compile-time options, not runtime
  355. behavior.)
  356. */
  357. EC_KEY *key = EC_KEY_new_by_curve_name(NID_X9_62_prime256v1);
  358. const EC_GROUP *g = key ? EC_KEY_get0_group(key) : NULL;
  359. const EC_METHOD *m = g ? EC_GROUP_method_of(g) : NULL;
  360. const int warn = (m == EC_GFp_simple_method() ||
  361. m == EC_GFp_mont_method() ||
  362. m == EC_GFp_nist_method());
  363. EC_KEY_free(key);
  364. if (warn)
  365. log_notice(LD_GENERAL, "We were built to run on a 64-bit CPU, with "
  366. "OpenSSL 1.0.1 or later, but with a version of OpenSSL "
  367. "that apparently lacks accelerated support for the NIST "
  368. "P-224 and P-256 groups. Building openssl with such "
  369. "support (using the enable-ec_nistp_64_gcc_128 option "
  370. "when configuring it) would make ECDH much faster.");
  371. }
  372. /* LCOV_EXCL_STOP */
  373. #endif /* (SIZEOF_VOID_P >= 8 && ... */
  374. tor_tls_allocate_tor_tls_object_ex_data_index();
  375. tls_library_is_initialized = 1;
  376. }
  377. }
  378. /** Free all global TLS structures. */
  379. void
  380. tor_tls_free_all(void)
  381. {
  382. check_no_tls_errors();
  383. if (server_tls_context) {
  384. tor_tls_context_t *ctx = server_tls_context;
  385. server_tls_context = NULL;
  386. tor_tls_context_decref(ctx);
  387. }
  388. if (client_tls_context) {
  389. tor_tls_context_t *ctx = client_tls_context;
  390. client_tls_context = NULL;
  391. tor_tls_context_decref(ctx);
  392. }
  393. }
  394. /** We need to give OpenSSL a callback to verify certificates. This is
  395. * it: We always accept peer certs and complete the handshake. We
  396. * don't validate them until later.
  397. */
  398. STATIC int
  399. always_accept_verify_cb(int preverify_ok,
  400. X509_STORE_CTX *x509_ctx)
  401. {
  402. (void) preverify_ok;
  403. (void) x509_ctx;
  404. return 1;
  405. }
  406. /** Return a newly allocated X509 name with commonName <b>cname</b>. */
  407. static X509_NAME *
  408. tor_x509_name_new(const char *cname)
  409. {
  410. int nid;
  411. X509_NAME *name;
  412. /* LCOV_EXCL_BR_START : these branches will only fail on OOM errors */
  413. if (!(name = X509_NAME_new()))
  414. return NULL;
  415. if ((nid = OBJ_txt2nid("commonName")) == NID_undef) goto error;
  416. if (!(X509_NAME_add_entry_by_NID(name, nid, MBSTRING_ASC,
  417. (unsigned char*)cname, -1, -1, 0)))
  418. goto error;
  419. /* LCOV_EXCL_BR_STOP */
  420. return name;
  421. /* LCOV_EXCL_START : these lines will only execute on out of memory errors*/
  422. error:
  423. X509_NAME_free(name);
  424. return NULL;
  425. /* LCOV_EXCL_STOP */
  426. }
  427. /** Generate and sign an X509 certificate with the public key <b>rsa</b>,
  428. * signed by the private key <b>rsa_sign</b>. The commonName of the
  429. * certificate will be <b>cname</b>; the commonName of the issuer will be
  430. * <b>cname_sign</b>. The cert will be valid for <b>cert_lifetime</b>
  431. * seconds, starting from some time in the past.
  432. *
  433. * Return a certificate on success, NULL on failure.
  434. */
  435. MOCK_IMPL(STATIC X509 *,
  436. tor_tls_create_certificate,(crypto_pk_t *rsa,
  437. crypto_pk_t *rsa_sign,
  438. const char *cname,
  439. const char *cname_sign,
  440. unsigned int cert_lifetime))
  441. {
  442. /* OpenSSL generates self-signed certificates with random 64-bit serial
  443. * numbers, so let's do that too. */
  444. #define SERIAL_NUMBER_SIZE 8
  445. time_t start_time, end_time;
  446. BIGNUM *serial_number = NULL;
  447. unsigned char serial_tmp[SERIAL_NUMBER_SIZE];
  448. EVP_PKEY *sign_pkey = NULL, *pkey=NULL;
  449. X509 *x509 = NULL;
  450. X509_NAME *name = NULL, *name_issuer=NULL;
  451. tor_tls_init();
  452. /* Make sure we're part-way through the certificate lifetime, rather
  453. * than having it start right now. Don't choose quite uniformly, since
  454. * then we might pick a time where we're about to expire. Lastly, be
  455. * sure to start on a day boundary. */
  456. time_t now = time(NULL);
  457. /* Our certificate lifetime will be cert_lifetime no matter what, but if we
  458. * start cert_lifetime in the past, we'll have 0 real lifetime. instead we
  459. * start up to (cert_lifetime - min_real_lifetime - start_granularity) in
  460. * the past. */
  461. const time_t min_real_lifetime = 24*3600;
  462. const time_t start_granularity = 24*3600;
  463. time_t earliest_start_time;
  464. /* Don't actually start in the future! */
  465. if (cert_lifetime <= min_real_lifetime + start_granularity) {
  466. earliest_start_time = now - 1;
  467. } else {
  468. earliest_start_time = now + min_real_lifetime + start_granularity
  469. - cert_lifetime;
  470. }
  471. start_time = crypto_rand_time_range(earliest_start_time, now);
  472. /* Round the start time back to the start of a day. */
  473. start_time -= start_time % start_granularity;
  474. end_time = start_time + cert_lifetime;
  475. tor_assert(rsa);
  476. tor_assert(cname);
  477. tor_assert(rsa_sign);
  478. tor_assert(cname_sign);
  479. if (!(sign_pkey = crypto_pk_get_evp_pkey_(rsa_sign,1)))
  480. goto error;
  481. if (!(pkey = crypto_pk_get_evp_pkey_(rsa,0)))
  482. goto error;
  483. if (!(x509 = X509_new()))
  484. goto error;
  485. if (!(X509_set_version(x509, 2)))
  486. goto error;
  487. { /* our serial number is 8 random bytes. */
  488. crypto_rand((char *)serial_tmp, sizeof(serial_tmp));
  489. if (!(serial_number = BN_bin2bn(serial_tmp, sizeof(serial_tmp), NULL)))
  490. goto error;
  491. if (!(BN_to_ASN1_INTEGER(serial_number, X509_get_serialNumber(x509))))
  492. goto error;
  493. }
  494. if (!(name = tor_x509_name_new(cname)))
  495. goto error;
  496. if (!(X509_set_subject_name(x509, name)))
  497. goto error;
  498. if (!(name_issuer = tor_x509_name_new(cname_sign)))
  499. goto error;
  500. if (!(X509_set_issuer_name(x509, name_issuer)))
  501. goto error;
  502. if (!X509_time_adj(X509_get_notBefore(x509),0,&start_time))
  503. goto error;
  504. if (!X509_time_adj(X509_get_notAfter(x509),0,&end_time))
  505. goto error;
  506. if (!X509_set_pubkey(x509, pkey))
  507. goto error;
  508. if (!X509_sign(x509, sign_pkey, EVP_sha256()))
  509. goto error;
  510. goto done;
  511. error:
  512. if (x509) {
  513. X509_free(x509);
  514. x509 = NULL;
  515. }
  516. done:
  517. tls_log_errors(NULL, LOG_WARN, LD_NET, "generating certificate");
  518. if (sign_pkey)
  519. EVP_PKEY_free(sign_pkey);
  520. if (pkey)
  521. EVP_PKEY_free(pkey);
  522. if (serial_number)
  523. BN_clear_free(serial_number);
  524. if (name)
  525. X509_NAME_free(name);
  526. if (name_issuer)
  527. X509_NAME_free(name_issuer);
  528. return x509;
  529. #undef SERIAL_NUMBER_SIZE
  530. }
  531. /** List of ciphers that servers should select from when the client might be
  532. * claiming extra unsupported ciphers in order to avoid fingerprinting. */
  533. static const char SERVER_CIPHER_LIST[] =
  534. #ifdef TLS1_3_TXT_AES_128_GCM_SHA256
  535. /* This one can never actually get selected, since if the client lists it,
  536. * we will assume that the client is honest, and not use this list.
  537. * Nonetheless we list it if it's available, so that the server doesn't
  538. * conclude that it has no valid ciphers if it's running with TLS1.3.
  539. */
  540. TLS1_3_TXT_AES_128_GCM_SHA256 ":"
  541. #endif
  542. TLS1_TXT_DHE_RSA_WITH_AES_256_SHA ":"
  543. TLS1_TXT_DHE_RSA_WITH_AES_128_SHA;
  544. /** List of ciphers that servers should select from when we actually have
  545. * our choice of what cipher to use. */
  546. static const char UNRESTRICTED_SERVER_CIPHER_LIST[] =
  547. /* Here are the TLS 1.3 ciphers we like, in the order we prefer. */
  548. #ifdef TLS1_3_TXT_AES_256_GCM_SHA384
  549. TLS1_3_TXT_AES_256_GCM_SHA384 ":"
  550. #endif
  551. #ifdef TLS1_3_TXT_CHACHA20_POLY1305_SHA256
  552. TLS1_3_TXT_CHACHA20_POLY1305_SHA256 ":"
  553. #endif
  554. #ifdef TLS1_3_TXT_AES_128_GCM_SHA256
  555. TLS1_3_TXT_AES_128_GCM_SHA256 ":"
  556. #endif
  557. #ifdef TLS1_3_TXT_AES_128_CCM_SHA256
  558. TLS1_3_TXT_AES_128_CCM_SHA256 ":"
  559. #endif
  560. /* This list is autogenerated with the gen_server_ciphers.py script;
  561. * don't hand-edit it. */
  562. #ifdef TLS1_TXT_ECDHE_RSA_WITH_AES_256_GCM_SHA384
  563. TLS1_TXT_ECDHE_RSA_WITH_AES_256_GCM_SHA384 ":"
  564. #endif
  565. #ifdef TLS1_TXT_ECDHE_RSA_WITH_AES_128_GCM_SHA256
  566. TLS1_TXT_ECDHE_RSA_WITH_AES_128_GCM_SHA256 ":"
  567. #endif
  568. #ifdef TLS1_TXT_ECDHE_RSA_WITH_AES_256_SHA384
  569. TLS1_TXT_ECDHE_RSA_WITH_AES_256_SHA384 ":"
  570. #endif
  571. #ifdef TLS1_TXT_ECDHE_RSA_WITH_AES_128_SHA256
  572. TLS1_TXT_ECDHE_RSA_WITH_AES_128_SHA256 ":"
  573. #endif
  574. #ifdef TLS1_TXT_ECDHE_RSA_WITH_AES_256_CBC_SHA
  575. TLS1_TXT_ECDHE_RSA_WITH_AES_256_CBC_SHA ":"
  576. #endif
  577. #ifdef TLS1_TXT_ECDHE_RSA_WITH_AES_128_CBC_SHA
  578. TLS1_TXT_ECDHE_RSA_WITH_AES_128_CBC_SHA ":"
  579. #endif
  580. #ifdef TLS1_TXT_DHE_RSA_WITH_AES_256_GCM_SHA384
  581. TLS1_TXT_DHE_RSA_WITH_AES_256_GCM_SHA384 ":"
  582. #endif
  583. #ifdef TLS1_TXT_DHE_RSA_WITH_AES_128_GCM_SHA256
  584. TLS1_TXT_DHE_RSA_WITH_AES_128_GCM_SHA256 ":"
  585. #endif
  586. #ifdef TLS1_TXT_DHE_RSA_WITH_AES_256_CCM
  587. TLS1_TXT_DHE_RSA_WITH_AES_256_CCM ":"
  588. #endif
  589. #ifdef TLS1_TXT_DHE_RSA_WITH_AES_128_CCM
  590. TLS1_TXT_DHE_RSA_WITH_AES_128_CCM ":"
  591. #endif
  592. #ifdef TLS1_TXT_DHE_RSA_WITH_AES_256_SHA256
  593. TLS1_TXT_DHE_RSA_WITH_AES_256_SHA256 ":"
  594. #endif
  595. #ifdef TLS1_TXT_DHE_RSA_WITH_AES_128_SHA256
  596. TLS1_TXT_DHE_RSA_WITH_AES_128_SHA256 ":"
  597. #endif
  598. /* Required */
  599. TLS1_TXT_DHE_RSA_WITH_AES_256_SHA ":"
  600. /* Required */
  601. TLS1_TXT_DHE_RSA_WITH_AES_128_SHA ":"
  602. #ifdef TLS1_TXT_ECDHE_RSA_WITH_CHACHA20_POLY1305
  603. TLS1_TXT_ECDHE_RSA_WITH_CHACHA20_POLY1305 ":"
  604. #endif
  605. #ifdef TLS1_TXT_DHE_RSA_WITH_CHACHA20_POLY1305
  606. TLS1_TXT_DHE_RSA_WITH_CHACHA20_POLY1305
  607. #endif
  608. ;
  609. /* Note: to set up your own private testing network with link crypto
  610. * disabled, set your Tors' cipher list to
  611. * (SSL3_TXT_RSA_NULL_SHA). If you do this, you won't be able to communicate
  612. * with any of the "real" Tors, though. */
  613. #define CIPHER(id, name) name ":"
  614. #define XCIPHER(id, name)
  615. /** List of ciphers that clients should advertise, omitting items that
  616. * our OpenSSL doesn't know about. */
  617. static const char CLIENT_CIPHER_LIST[] =
  618. #include "ciphers.inc"
  619. /* Tell it not to use SSLv2 ciphers, so that it can select an SSLv3 version
  620. * of any cipher we say. */
  621. "!SSLv2"
  622. ;
  623. #undef CIPHER
  624. #undef XCIPHER
  625. /** Free all storage held in <b>cert</b> */
  626. void
  627. tor_x509_cert_free_(tor_x509_cert_t *cert)
  628. {
  629. if (! cert)
  630. return;
  631. if (cert->cert)
  632. X509_free(cert->cert);
  633. tor_free(cert->encoded);
  634. memwipe(cert, 0x03, sizeof(*cert));
  635. /* LCOV_EXCL_BR_START since cert will never be NULL here */
  636. tor_free(cert);
  637. /* LCOV_EXCL_BR_STOP */
  638. }
  639. /**
  640. * Allocate a new tor_x509_cert_t to hold the certificate "x509_cert".
  641. *
  642. * Steals a reference to x509_cert.
  643. */
  644. MOCK_IMPL(STATIC tor_x509_cert_t *,
  645. tor_x509_cert_new,(X509 *x509_cert))
  646. {
  647. tor_x509_cert_t *cert;
  648. EVP_PKEY *pkey;
  649. RSA *rsa;
  650. int length;
  651. unsigned char *buf = NULL;
  652. if (!x509_cert)
  653. return NULL;
  654. length = i2d_X509(x509_cert, &buf);
  655. cert = tor_malloc_zero(sizeof(tor_x509_cert_t));
  656. if (length <= 0 || buf == NULL) {
  657. goto err;
  658. }
  659. cert->encoded_len = (size_t) length;
  660. cert->encoded = tor_malloc(length);
  661. memcpy(cert->encoded, buf, length);
  662. OPENSSL_free(buf);
  663. cert->cert = x509_cert;
  664. crypto_common_digests(&cert->cert_digests,
  665. (char*)cert->encoded, cert->encoded_len);
  666. if ((pkey = X509_get_pubkey(x509_cert)) &&
  667. (rsa = EVP_PKEY_get1_RSA(pkey))) {
  668. crypto_pk_t *pk = crypto_new_pk_from_rsa_(rsa);
  669. if (crypto_pk_get_common_digests(pk, &cert->pkey_digests) < 0) {
  670. crypto_pk_free(pk);
  671. EVP_PKEY_free(pkey);
  672. goto err;
  673. }
  674. cert->pkey_digests_set = 1;
  675. crypto_pk_free(pk);
  676. EVP_PKEY_free(pkey);
  677. }
  678. return cert;
  679. err:
  680. /* LCOV_EXCL_START for the same reason as the exclusion above */
  681. tor_free(cert);
  682. log_err(LD_CRYPTO, "Couldn't wrap encoded X509 certificate.");
  683. X509_free(x509_cert);
  684. return NULL;
  685. /* LCOV_EXCL_STOP */
  686. }
  687. /** Return a new copy of <b>cert</b>. */
  688. tor_x509_cert_t *
  689. tor_x509_cert_dup(const tor_x509_cert_t *cert)
  690. {
  691. tor_assert(cert);
  692. X509 *x509 = cert->cert;
  693. return tor_x509_cert_new(X509_dup(x509));
  694. }
  695. /** Read a DER-encoded X509 cert, of length exactly <b>certificate_len</b>,
  696. * from a <b>certificate</b>. Return a newly allocated tor_x509_cert_t on
  697. * success and NULL on failure. */
  698. tor_x509_cert_t *
  699. tor_x509_cert_decode(const uint8_t *certificate, size_t certificate_len)
  700. {
  701. X509 *x509;
  702. const unsigned char *cp = (const unsigned char *)certificate;
  703. tor_x509_cert_t *newcert;
  704. tor_assert(certificate);
  705. check_no_tls_errors();
  706. if (certificate_len > INT_MAX)
  707. goto err;
  708. x509 = d2i_X509(NULL, &cp, (int)certificate_len);
  709. if (!x509)
  710. goto err; /* Couldn't decode */
  711. if (cp - certificate != (int)certificate_len) {
  712. X509_free(x509);
  713. goto err; /* Didn't use all the bytes */
  714. }
  715. newcert = tor_x509_cert_new(x509);
  716. if (!newcert) {
  717. goto err;
  718. }
  719. if (newcert->encoded_len != certificate_len ||
  720. fast_memneq(newcert->encoded, certificate, certificate_len)) {
  721. /* Cert wasn't in DER */
  722. tor_x509_cert_free(newcert);
  723. goto err;
  724. }
  725. return newcert;
  726. err:
  727. tls_log_errors(NULL, LOG_INFO, LD_CRYPTO, "decoding a certificate");
  728. return NULL;
  729. }
  730. /** Set *<b>encoded_out</b> and *<b>size_out</b> to <b>cert</b>'s encoded DER
  731. * representation and length, respectively. */
  732. void
  733. tor_x509_cert_get_der(const tor_x509_cert_t *cert,
  734. const uint8_t **encoded_out, size_t *size_out)
  735. {
  736. tor_assert(cert);
  737. tor_assert(encoded_out);
  738. tor_assert(size_out);
  739. *encoded_out = cert->encoded;
  740. *size_out = cert->encoded_len;
  741. }
  742. /** Return a set of digests for the public key in <b>cert</b>, or NULL if this
  743. * cert's public key is not one we know how to take the digest of. */
  744. const common_digests_t *
  745. tor_x509_cert_get_id_digests(const tor_x509_cert_t *cert)
  746. {
  747. if (cert->pkey_digests_set)
  748. return &cert->pkey_digests;
  749. else
  750. return NULL;
  751. }
  752. /** Return a set of digests for the public key in <b>cert</b>. */
  753. const common_digests_t *
  754. tor_x509_cert_get_cert_digests(const tor_x509_cert_t *cert)
  755. {
  756. return &cert->cert_digests;
  757. }
  758. /** Remove a reference to <b>ctx</b>, and free it if it has no more
  759. * references. */
  760. static void
  761. tor_tls_context_decref(tor_tls_context_t *ctx)
  762. {
  763. tor_assert(ctx);
  764. if (--ctx->refcnt == 0) {
  765. SSL_CTX_free(ctx->ctx);
  766. tor_x509_cert_free(ctx->my_link_cert);
  767. tor_x509_cert_free(ctx->my_id_cert);
  768. tor_x509_cert_free(ctx->my_auth_cert);
  769. crypto_pk_free(ctx->link_key);
  770. crypto_pk_free(ctx->auth_key);
  771. /* LCOV_EXCL_BR_START since ctx will never be NULL here */
  772. tor_free(ctx);
  773. /* LCOV_EXCL_BR_STOP */
  774. }
  775. }
  776. /** Set *<b>link_cert_out</b> and *<b>id_cert_out</b> to the link certificate
  777. * and ID certificate that we're currently using for our V3 in-protocol
  778. * handshake's certificate chain. If <b>server</b> is true, provide the certs
  779. * that we use in server mode (auth, ID); otherwise, provide the certs that we
  780. * use in client mode. (link, ID) */
  781. int
  782. tor_tls_get_my_certs(int server,
  783. const tor_x509_cert_t **link_cert_out,
  784. const tor_x509_cert_t **id_cert_out)
  785. {
  786. tor_tls_context_t *ctx = server ? server_tls_context : client_tls_context;
  787. if (! ctx)
  788. return -1;
  789. if (link_cert_out)
  790. *link_cert_out = server ? ctx->my_link_cert : ctx->my_auth_cert;
  791. if (id_cert_out)
  792. *id_cert_out = ctx->my_id_cert;
  793. return 0;
  794. }
  795. /**
  796. * Return the authentication key that we use to authenticate ourselves as a
  797. * client in the V3 in-protocol handshake.
  798. */
  799. crypto_pk_t *
  800. tor_tls_get_my_client_auth_key(void)
  801. {
  802. if (! client_tls_context)
  803. return NULL;
  804. return client_tls_context->auth_key;
  805. }
  806. /**
  807. * Return a newly allocated copy of the public key that a certificate
  808. * certifies. Watch out! This returns NULL if the cert's key is not RSA.
  809. */
  810. crypto_pk_t *
  811. tor_tls_cert_get_key(tor_x509_cert_t *cert)
  812. {
  813. crypto_pk_t *result = NULL;
  814. EVP_PKEY *pkey = X509_get_pubkey(cert->cert);
  815. RSA *rsa;
  816. if (!pkey)
  817. return NULL;
  818. rsa = EVP_PKEY_get1_RSA(pkey);
  819. if (!rsa) {
  820. EVP_PKEY_free(pkey);
  821. return NULL;
  822. }
  823. result = crypto_new_pk_from_rsa_(rsa);
  824. EVP_PKEY_free(pkey);
  825. return result;
  826. }
  827. /** Return true iff the other side of <b>tls</b> has authenticated to us, and
  828. * the key certified in <b>cert</b> is the same as the key they used to do it.
  829. */
  830. MOCK_IMPL(int,
  831. tor_tls_cert_matches_key,(const tor_tls_t *tls, const tor_x509_cert_t *cert))
  832. {
  833. X509 *peercert = SSL_get_peer_certificate(tls->ssl);
  834. EVP_PKEY *link_key = NULL, *cert_key = NULL;
  835. int result;
  836. if (!peercert)
  837. return 0;
  838. link_key = X509_get_pubkey(peercert);
  839. cert_key = X509_get_pubkey(cert->cert);
  840. result = link_key && cert_key && EVP_PKEY_cmp(cert_key, link_key) == 1;
  841. X509_free(peercert);
  842. if (link_key)
  843. EVP_PKEY_free(link_key);
  844. if (cert_key)
  845. EVP_PKEY_free(cert_key);
  846. return result;
  847. }
  848. /** Check whether <b>cert</b> is well-formed, currently live, and correctly
  849. * signed by the public key in <b>signing_cert</b>. If <b>check_rsa_1024</b>,
  850. * make sure that it has an RSA key with 1024 bits; otherwise, just check that
  851. * the key is long enough. Return 1 if the cert is good, and 0 if it's bad or
  852. * we couldn't check it. */
  853. int
  854. tor_tls_cert_is_valid(int severity,
  855. const tor_x509_cert_t *cert,
  856. const tor_x509_cert_t *signing_cert,
  857. time_t now,
  858. int check_rsa_1024)
  859. {
  860. check_no_tls_errors();
  861. EVP_PKEY *cert_key;
  862. int r, key_ok = 0;
  863. if (!signing_cert || !cert)
  864. goto bad;
  865. EVP_PKEY *signing_key = X509_get_pubkey(signing_cert->cert);
  866. if (!signing_key)
  867. goto bad;
  868. r = X509_verify(cert->cert, signing_key);
  869. EVP_PKEY_free(signing_key);
  870. if (r <= 0)
  871. goto bad;
  872. /* okay, the signature checked out right. Now let's check the check the
  873. * lifetime. */
  874. if (check_cert_lifetime_internal(severity, cert->cert, now,
  875. 48*60*60, 30*24*60*60) < 0)
  876. goto bad;
  877. cert_key = X509_get_pubkey(cert->cert);
  878. if (check_rsa_1024 && cert_key) {
  879. RSA *rsa = EVP_PKEY_get1_RSA(cert_key);
  880. #ifdef OPENSSL_1_1_API
  881. if (rsa && RSA_bits(rsa) == 1024)
  882. #else
  883. if (rsa && BN_num_bits(rsa->n) == 1024)
  884. #endif
  885. key_ok = 1;
  886. if (rsa)
  887. RSA_free(rsa);
  888. } else if (cert_key) {
  889. int min_bits = 1024;
  890. #ifdef EVP_PKEY_EC
  891. if (EVP_PKEY_base_id(cert_key) == EVP_PKEY_EC)
  892. min_bits = 128;
  893. #endif
  894. if (EVP_PKEY_bits(cert_key) >= min_bits)
  895. key_ok = 1;
  896. }
  897. EVP_PKEY_free(cert_key);
  898. if (!key_ok)
  899. goto bad;
  900. /* XXXX compare DNs or anything? */
  901. return 1;
  902. bad:
  903. tls_log_errors(NULL, LOG_INFO, LD_CRYPTO, "checking a certificate");
  904. return 0;
  905. }
  906. /** Increase the reference count of <b>ctx</b>. */
  907. static void
  908. tor_tls_context_incref(tor_tls_context_t *ctx)
  909. {
  910. ++ctx->refcnt;
  911. }
  912. /** Create new global client and server TLS contexts.
  913. *
  914. * If <b>server_identity</b> is NULL, this will not generate a server
  915. * TLS context. If TOR_TLS_CTX_IS_PUBLIC_SERVER is set in <b>flags</b>, use
  916. * the same TLS context for incoming and outgoing connections, and
  917. * ignore <b>client_identity</b>. If one of TOR_TLS_CTX_USE_ECDHE_P{224,256}
  918. * is set in <b>flags</b>, use that ECDHE group if possible; otherwise use
  919. * the default ECDHE group. */
  920. int
  921. tor_tls_context_init(unsigned flags,
  922. crypto_pk_t *client_identity,
  923. crypto_pk_t *server_identity,
  924. unsigned int key_lifetime)
  925. {
  926. int rv1 = 0;
  927. int rv2 = 0;
  928. const int is_public_server = flags & TOR_TLS_CTX_IS_PUBLIC_SERVER;
  929. check_no_tls_errors();
  930. if (is_public_server) {
  931. tor_tls_context_t *new_ctx;
  932. tor_tls_context_t *old_ctx;
  933. tor_assert(server_identity != NULL);
  934. rv1 = tor_tls_context_init_one(&server_tls_context,
  935. server_identity,
  936. key_lifetime, flags, 0);
  937. if (rv1 >= 0) {
  938. new_ctx = server_tls_context;
  939. tor_tls_context_incref(new_ctx);
  940. old_ctx = client_tls_context;
  941. client_tls_context = new_ctx;
  942. if (old_ctx != NULL) {
  943. tor_tls_context_decref(old_ctx);
  944. }
  945. }
  946. } else {
  947. if (server_identity != NULL) {
  948. rv1 = tor_tls_context_init_one(&server_tls_context,
  949. server_identity,
  950. key_lifetime,
  951. flags,
  952. 0);
  953. } else {
  954. tor_tls_context_t *old_ctx = server_tls_context;
  955. server_tls_context = NULL;
  956. if (old_ctx != NULL) {
  957. tor_tls_context_decref(old_ctx);
  958. }
  959. }
  960. rv2 = tor_tls_context_init_one(&client_tls_context,
  961. client_identity,
  962. key_lifetime,
  963. flags,
  964. 1);
  965. }
  966. tls_log_errors(NULL, LOG_WARN, LD_CRYPTO, "constructing a TLS context");
  967. return MIN(rv1, rv2);
  968. }
  969. /** Create a new global TLS context.
  970. *
  971. * You can call this function multiple times. Each time you call it,
  972. * it generates new certificates; all new connections will use
  973. * the new SSL context.
  974. */
  975. STATIC int
  976. tor_tls_context_init_one(tor_tls_context_t **ppcontext,
  977. crypto_pk_t *identity,
  978. unsigned int key_lifetime,
  979. unsigned int flags,
  980. int is_client)
  981. {
  982. tor_tls_context_t *new_ctx = tor_tls_context_new(identity,
  983. key_lifetime,
  984. flags,
  985. is_client);
  986. tor_tls_context_t *old_ctx = *ppcontext;
  987. if (new_ctx != NULL) {
  988. *ppcontext = new_ctx;
  989. /* Free the old context if one existed. */
  990. if (old_ctx != NULL) {
  991. /* This is safe even if there are open connections: we reference-
  992. * count tor_tls_context_t objects. */
  993. tor_tls_context_decref(old_ctx);
  994. }
  995. }
  996. return ((new_ctx != NULL) ? 0 : -1);
  997. }
  998. /** The group we should use for ecdhe when none was selected. */
  999. #define NID_tor_default_ecdhe_group NID_X9_62_prime256v1
  1000. #define RSA_LINK_KEY_BITS 2048
  1001. /** Create a new TLS context for use with Tor TLS handshakes.
  1002. * <b>identity</b> should be set to the identity key used to sign the
  1003. * certificate.
  1004. */
  1005. STATIC tor_tls_context_t *
  1006. tor_tls_context_new(crypto_pk_t *identity, unsigned int key_lifetime,
  1007. unsigned flags, int is_client)
  1008. {
  1009. crypto_pk_t *rsa = NULL, *rsa_auth = NULL;
  1010. EVP_PKEY *pkey = NULL;
  1011. tor_tls_context_t *result = NULL;
  1012. X509 *cert = NULL, *idcert = NULL, *authcert = NULL;
  1013. char *nickname = NULL, *nn2 = NULL;
  1014. tor_tls_init();
  1015. nickname = crypto_random_hostname(8, 20, "www.", ".net");
  1016. #ifdef DISABLE_V3_LINKPROTO_SERVERSIDE
  1017. nn2 = crypto_random_hostname(8, 20, "www.", ".net");
  1018. #else
  1019. nn2 = crypto_random_hostname(8, 20, "www.", ".com");
  1020. #endif
  1021. /* Generate short-term RSA key for use with TLS. */
  1022. if (!(rsa = crypto_pk_new()))
  1023. goto error;
  1024. if (crypto_pk_generate_key_with_bits(rsa, RSA_LINK_KEY_BITS)<0)
  1025. goto error;
  1026. if (!is_client) {
  1027. /* Generate short-term RSA key for use in the in-protocol ("v3")
  1028. * authentication handshake. */
  1029. if (!(rsa_auth = crypto_pk_new()))
  1030. goto error;
  1031. if (crypto_pk_generate_key(rsa_auth)<0)
  1032. goto error;
  1033. /* Create a link certificate signed by identity key. */
  1034. cert = tor_tls_create_certificate(rsa, identity, nickname, nn2,
  1035. key_lifetime);
  1036. /* Create self-signed certificate for identity key. */
  1037. idcert = tor_tls_create_certificate(identity, identity, nn2, nn2,
  1038. IDENTITY_CERT_LIFETIME);
  1039. /* Create an authentication certificate signed by identity key. */
  1040. authcert = tor_tls_create_certificate(rsa_auth, identity, nickname, nn2,
  1041. key_lifetime);
  1042. if (!cert || !idcert || !authcert) {
  1043. log_warn(LD_CRYPTO, "Error creating certificate");
  1044. goto error;
  1045. }
  1046. }
  1047. result = tor_malloc_zero(sizeof(tor_tls_context_t));
  1048. result->refcnt = 1;
  1049. if (!is_client) {
  1050. result->my_link_cert = tor_x509_cert_new(X509_dup(cert));
  1051. result->my_id_cert = tor_x509_cert_new(X509_dup(idcert));
  1052. result->my_auth_cert = tor_x509_cert_new(X509_dup(authcert));
  1053. if (!result->my_link_cert || !result->my_id_cert || !result->my_auth_cert)
  1054. goto error;
  1055. result->link_key = crypto_pk_dup_key(rsa);
  1056. result->auth_key = crypto_pk_dup_key(rsa_auth);
  1057. }
  1058. #if 0
  1059. /* Tell OpenSSL to only use TLS1. This may have subtly different results
  1060. * from SSLv23_method() with SSLv2 and SSLv3 disabled, so we need to do some
  1061. * investigation before we consider adjusting it. It should be compatible
  1062. * with existing Tors. */
  1063. if (!(result->ctx = SSL_CTX_new(TLSv1_method())))
  1064. goto error;
  1065. #endif /* 0 */
  1066. /* Tell OpenSSL to use TLS 1.0 or later but not SSL2 or SSL3. */
  1067. #ifdef HAVE_TLS_METHOD
  1068. if (!(result->ctx = SSL_CTX_new(TLS_method())))
  1069. goto error;
  1070. #else
  1071. if (!(result->ctx = SSL_CTX_new(SSLv23_method())))
  1072. goto error;
  1073. #endif /* defined(HAVE_TLS_METHOD) */
  1074. SSL_CTX_set_options(result->ctx, SSL_OP_NO_SSLv2);
  1075. SSL_CTX_set_options(result->ctx, SSL_OP_NO_SSLv3);
  1076. /* Prefer the server's ordering of ciphers: the client's ordering has
  1077. * historically been chosen for fingerprinting resistance. */
  1078. SSL_CTX_set_options(result->ctx, SSL_OP_CIPHER_SERVER_PREFERENCE);
  1079. /* Disable TLS tickets if they're supported. We never want to use them;
  1080. * using them can make our perfect forward secrecy a little worse, *and*
  1081. * create an opportunity to fingerprint us (since it's unusual to use them
  1082. * with TLS sessions turned off).
  1083. *
  1084. * In 0.2.4, clients advertise support for them though, to avoid a TLS
  1085. * distinguishability vector. This can give us worse PFS, though, if we
  1086. * get a server that doesn't set SSL_OP_NO_TICKET. With luck, there will
  1087. * be few such servers by the time 0.2.4 is more stable.
  1088. */
  1089. #ifdef SSL_OP_NO_TICKET
  1090. if (! is_client) {
  1091. SSL_CTX_set_options(result->ctx, SSL_OP_NO_TICKET);
  1092. }
  1093. #endif
  1094. SSL_CTX_set_options(result->ctx, SSL_OP_SINGLE_DH_USE);
  1095. SSL_CTX_set_options(result->ctx, SSL_OP_SINGLE_ECDH_USE);
  1096. #ifdef SSL_OP_NO_SESSION_RESUMPTION_ON_RENEGOTIATION
  1097. SSL_CTX_set_options(result->ctx,
  1098. SSL_OP_NO_SESSION_RESUMPTION_ON_RENEGOTIATION);
  1099. #endif
  1100. /* Yes, we know what we are doing here. No, we do not treat a renegotiation
  1101. * as authenticating any earlier-received data.
  1102. */
  1103. {
  1104. SSL_CTX_set_options(result->ctx,
  1105. SSL_OP_ALLOW_UNSAFE_LEGACY_RENEGOTIATION);
  1106. }
  1107. /* Don't actually allow compression; it uses RAM and time, it makes TLS
  1108. * vulnerable to CRIME-style attacks, and most of the data we transmit over
  1109. * TLS is encrypted (and therefore uncompressible) anyway. */
  1110. #ifdef SSL_OP_NO_COMPRESSION
  1111. SSL_CTX_set_options(result->ctx, SSL_OP_NO_COMPRESSION);
  1112. #endif
  1113. #if OPENSSL_VERSION_NUMBER < OPENSSL_V_SERIES(1,1,0)
  1114. #ifndef OPENSSL_NO_COMP
  1115. if (result->ctx->comp_methods)
  1116. result->ctx->comp_methods = NULL;
  1117. #endif
  1118. #endif /* OPENSSL_VERSION_NUMBER < OPENSSL_V_SERIES(1,1,0) */
  1119. #ifdef SSL_MODE_RELEASE_BUFFERS
  1120. SSL_CTX_set_mode(result->ctx, SSL_MODE_RELEASE_BUFFERS);
  1121. #endif
  1122. if (! is_client) {
  1123. if (cert && !SSL_CTX_use_certificate(result->ctx,cert))
  1124. goto error;
  1125. X509_free(cert); /* We just added a reference to cert. */
  1126. cert=NULL;
  1127. if (idcert) {
  1128. X509_STORE *s = SSL_CTX_get_cert_store(result->ctx);
  1129. tor_assert(s);
  1130. X509_STORE_add_cert(s, idcert);
  1131. X509_free(idcert); /* The context now owns the reference to idcert */
  1132. idcert = NULL;
  1133. }
  1134. }
  1135. SSL_CTX_set_session_cache_mode(result->ctx, SSL_SESS_CACHE_OFF);
  1136. if (!is_client) {
  1137. tor_assert(rsa);
  1138. if (!(pkey = crypto_pk_get_evp_pkey_(rsa,1)))
  1139. goto error;
  1140. if (!SSL_CTX_use_PrivateKey(result->ctx, pkey))
  1141. goto error;
  1142. EVP_PKEY_free(pkey);
  1143. pkey = NULL;
  1144. if (!SSL_CTX_check_private_key(result->ctx))
  1145. goto error;
  1146. }
  1147. {
  1148. crypto_dh_t *dh = crypto_dh_new(DH_TYPE_TLS);
  1149. tor_assert(dh);
  1150. SSL_CTX_set_tmp_dh(result->ctx, crypto_dh_get_dh_(dh));
  1151. crypto_dh_free(dh);
  1152. }
  1153. if (! is_client) {
  1154. int nid;
  1155. EC_KEY *ec_key;
  1156. if (flags & TOR_TLS_CTX_USE_ECDHE_P224)
  1157. nid = NID_secp224r1;
  1158. else if (flags & TOR_TLS_CTX_USE_ECDHE_P256)
  1159. nid = NID_X9_62_prime256v1;
  1160. else
  1161. nid = NID_tor_default_ecdhe_group;
  1162. /* Use P-256 for ECDHE. */
  1163. ec_key = EC_KEY_new_by_curve_name(nid);
  1164. if (ec_key != NULL) /*XXXX Handle errors? */
  1165. SSL_CTX_set_tmp_ecdh(result->ctx, ec_key);
  1166. EC_KEY_free(ec_key);
  1167. }
  1168. SSL_CTX_set_verify(result->ctx, SSL_VERIFY_PEER,
  1169. always_accept_verify_cb);
  1170. /* let us realloc bufs that we're writing from */
  1171. SSL_CTX_set_mode(result->ctx, SSL_MODE_ACCEPT_MOVING_WRITE_BUFFER);
  1172. if (rsa)
  1173. crypto_pk_free(rsa);
  1174. if (rsa_auth)
  1175. crypto_pk_free(rsa_auth);
  1176. X509_free(authcert);
  1177. tor_free(nickname);
  1178. tor_free(nn2);
  1179. return result;
  1180. error:
  1181. tls_log_errors(NULL, LOG_WARN, LD_NET, "creating TLS context");
  1182. tor_free(nickname);
  1183. tor_free(nn2);
  1184. if (pkey)
  1185. EVP_PKEY_free(pkey);
  1186. if (rsa)
  1187. crypto_pk_free(rsa);
  1188. if (rsa_auth)
  1189. crypto_pk_free(rsa_auth);
  1190. if (result)
  1191. tor_tls_context_decref(result);
  1192. if (cert)
  1193. X509_free(cert);
  1194. if (idcert)
  1195. X509_free(idcert);
  1196. if (authcert)
  1197. X509_free(authcert);
  1198. return NULL;
  1199. }
  1200. /** Invoked when a TLS state changes: log the change at severity 'debug' */
  1201. STATIC void
  1202. tor_tls_debug_state_callback(const SSL *ssl, int type, int val)
  1203. {
  1204. /* LCOV_EXCL_START since this depends on whether debug is captured or not */
  1205. log_debug(LD_HANDSHAKE, "SSL %p is now in state %s [type=%d,val=%d].",
  1206. ssl, SSL_state_string_long(ssl), type, val);
  1207. /* LCOV_EXCL_STOP */
  1208. }
  1209. /* Return the name of the negotiated ciphersuite in use on <b>tls</b> */
  1210. const char *
  1211. tor_tls_get_ciphersuite_name(tor_tls_t *tls)
  1212. {
  1213. return SSL_get_cipher(tls->ssl);
  1214. }
  1215. /* Here's the old V2 cipher list we sent from 0.2.1.1-alpha up to
  1216. * 0.2.3.17-beta. If a client is using this list, we can't believe the ciphers
  1217. * that it claims to support. We'll prune this list to remove the ciphers
  1218. * *we* don't recognize. */
  1219. STATIC uint16_t v2_cipher_list[] = {
  1220. 0xc00a, /* TLS1_TXT_ECDHE_ECDSA_WITH_AES_256_CBC_SHA */
  1221. 0xc014, /* TLS1_TXT_ECDHE_RSA_WITH_AES_256_CBC_SHA */
  1222. 0x0039, /* TLS1_TXT_DHE_RSA_WITH_AES_256_SHA */
  1223. 0x0038, /* TLS1_TXT_DHE_DSS_WITH_AES_256_SHA */
  1224. 0xc00f, /* TLS1_TXT_ECDH_RSA_WITH_AES_256_CBC_SHA */
  1225. 0xc005, /* TLS1_TXT_ECDH_ECDSA_WITH_AES_256_CBC_SHA */
  1226. 0x0035, /* TLS1_TXT_RSA_WITH_AES_256_SHA */
  1227. 0xc007, /* TLS1_TXT_ECDHE_ECDSA_WITH_RC4_128_SHA */
  1228. 0xc009, /* TLS1_TXT_ECDHE_ECDSA_WITH_AES_128_CBC_SHA */
  1229. 0xc011, /* TLS1_TXT_ECDHE_RSA_WITH_RC4_128_SHA */
  1230. 0xc013, /* TLS1_TXT_ECDHE_RSA_WITH_AES_128_CBC_SHA */
  1231. 0x0033, /* TLS1_TXT_DHE_RSA_WITH_AES_128_SHA */
  1232. 0x0032, /* TLS1_TXT_DHE_DSS_WITH_AES_128_SHA */
  1233. 0xc00c, /* TLS1_TXT_ECDH_RSA_WITH_RC4_128_SHA */
  1234. 0xc00e, /* TLS1_TXT_ECDH_RSA_WITH_AES_128_CBC_SHA */
  1235. 0xc002, /* TLS1_TXT_ECDH_ECDSA_WITH_RC4_128_SHA */
  1236. 0xc004, /* TLS1_TXT_ECDH_ECDSA_WITH_AES_128_CBC_SHA */
  1237. 0x0004, /* SSL3_TXT_RSA_RC4_128_MD5 */
  1238. 0x0005, /* SSL3_TXT_RSA_RC4_128_SHA */
  1239. 0x002f, /* TLS1_TXT_RSA_WITH_AES_128_SHA */
  1240. 0xc008, /* TLS1_TXT_ECDHE_ECDSA_WITH_DES_192_CBC3_SHA */
  1241. 0xc012, /* TLS1_TXT_ECDHE_RSA_WITH_DES_192_CBC3_SHA */
  1242. 0x0016, /* SSL3_TXT_EDH_RSA_DES_192_CBC3_SHA */
  1243. 0x0013, /* SSL3_TXT_EDH_DSS_DES_192_CBC3_SHA */
  1244. 0xc00d, /* TLS1_TXT_ECDH_RSA_WITH_DES_192_CBC3_SHA */
  1245. 0xc003, /* TLS1_TXT_ECDH_ECDSA_WITH_DES_192_CBC3_SHA */
  1246. 0xfeff, /* SSL3_TXT_RSA_FIPS_WITH_3DES_EDE_CBC_SHA */
  1247. 0x000a, /* SSL3_TXT_RSA_DES_192_CBC3_SHA */
  1248. 0
  1249. };
  1250. /** Have we removed the unrecognized ciphers from v2_cipher_list yet? */
  1251. static int v2_cipher_list_pruned = 0;
  1252. /** Return 0 if <b>m</b> does not support the cipher with ID <b>cipher</b>;
  1253. * return 1 if it does support it, or if we have no way to tell. */
  1254. STATIC int
  1255. find_cipher_by_id(const SSL *ssl, const SSL_METHOD *m, uint16_t cipher)
  1256. {
  1257. const SSL_CIPHER *c;
  1258. #ifdef HAVE_SSL_CIPHER_FIND
  1259. (void) m;
  1260. {
  1261. unsigned char cipherid[3];
  1262. tor_assert(ssl);
  1263. set_uint16(cipherid, tor_htons(cipher));
  1264. cipherid[2] = 0; /* If ssl23_get_cipher_by_char finds no cipher starting
  1265. * with a two-byte 'cipherid', it may look for a v2
  1266. * cipher with the appropriate 3 bytes. */
  1267. c = SSL_CIPHER_find((SSL*)ssl, cipherid);
  1268. if (c)
  1269. tor_assert((SSL_CIPHER_get_id(c) & 0xffff) == cipher);
  1270. return c != NULL;
  1271. }
  1272. #else /* !(defined(HAVE_SSL_CIPHER_FIND)) */
  1273. # if defined(HAVE_STRUCT_SSL_METHOD_ST_GET_CIPHER_BY_CHAR)
  1274. if (m && m->get_cipher_by_char) {
  1275. unsigned char cipherid[3];
  1276. set_uint16(cipherid, tor_htons(cipher));
  1277. cipherid[2] = 0; /* If ssl23_get_cipher_by_char finds no cipher starting
  1278. * with a two-byte 'cipherid', it may look for a v2
  1279. * cipher with the appropriate 3 bytes. */
  1280. c = m->get_cipher_by_char(cipherid);
  1281. if (c)
  1282. tor_assert((c->id & 0xffff) == cipher);
  1283. return c != NULL;
  1284. }
  1285. #endif /* defined(HAVE_STRUCT_SSL_METHOD_ST_GET_CIPHER_BY_CHAR) */
  1286. # ifndef OPENSSL_1_1_API
  1287. if (m && m->get_cipher && m->num_ciphers) {
  1288. /* It would seem that some of the "let's-clean-up-openssl" forks have
  1289. * removed the get_cipher_by_char function. Okay, so now you get a
  1290. * quadratic search.
  1291. */
  1292. int i;
  1293. for (i = 0; i < m->num_ciphers(); ++i) {
  1294. c = m->get_cipher(i);
  1295. if (c && (c->id & 0xffff) == cipher) {
  1296. return 1;
  1297. }
  1298. }
  1299. return 0;
  1300. }
  1301. #endif /* !defined(OPENSSL_1_1_API) */
  1302. (void) ssl;
  1303. (void) m;
  1304. (void) cipher;
  1305. return 1; /* No way to search */
  1306. #endif /* defined(HAVE_SSL_CIPHER_FIND) */
  1307. }
  1308. /** Remove from v2_cipher_list every cipher that we don't support, so that
  1309. * comparing v2_cipher_list to a client's cipher list will give a sensible
  1310. * result. */
  1311. static void
  1312. prune_v2_cipher_list(const SSL *ssl)
  1313. {
  1314. uint16_t *inp, *outp;
  1315. #ifdef HAVE_TLS_METHOD
  1316. const SSL_METHOD *m = TLS_method();
  1317. #else
  1318. const SSL_METHOD *m = SSLv23_method();
  1319. #endif
  1320. inp = outp = v2_cipher_list;
  1321. while (*inp) {
  1322. if (find_cipher_by_id(ssl, m, *inp)) {
  1323. *outp++ = *inp++;
  1324. } else {
  1325. inp++;
  1326. }
  1327. }
  1328. *outp = 0;
  1329. v2_cipher_list_pruned = 1;
  1330. }
  1331. /** Examine the client cipher list in <b>ssl</b>, and determine what kind of
  1332. * client it is. Return one of CIPHERS_ERR, CIPHERS_V1, CIPHERS_V2,
  1333. * CIPHERS_UNRESTRICTED.
  1334. **/
  1335. STATIC int
  1336. tor_tls_classify_client_ciphers(const SSL *ssl,
  1337. STACK_OF(SSL_CIPHER) *peer_ciphers)
  1338. {
  1339. int i, res;
  1340. tor_tls_t *tor_tls;
  1341. if (PREDICT_UNLIKELY(!v2_cipher_list_pruned))
  1342. prune_v2_cipher_list(ssl);
  1343. tor_tls = tor_tls_get_by_ssl(ssl);
  1344. if (tor_tls && tor_tls->client_cipher_list_type)
  1345. return tor_tls->client_cipher_list_type;
  1346. /* If we reached this point, we just got a client hello. See if there is
  1347. * a cipher list. */
  1348. if (!peer_ciphers) {
  1349. log_info(LD_NET, "No ciphers on session");
  1350. res = CIPHERS_ERR;
  1351. goto done;
  1352. }
  1353. /* Now we need to see if there are any ciphers whose presence means we're
  1354. * dealing with an updated Tor. */
  1355. for (i = 0; i < sk_SSL_CIPHER_num(peer_ciphers); ++i) {
  1356. const SSL_CIPHER *cipher = sk_SSL_CIPHER_value(peer_ciphers, i);
  1357. const char *ciphername = SSL_CIPHER_get_name(cipher);
  1358. if (strcmp(ciphername, TLS1_TXT_DHE_RSA_WITH_AES_128_SHA) &&
  1359. strcmp(ciphername, TLS1_TXT_DHE_RSA_WITH_AES_256_SHA) &&
  1360. strcmp(ciphername, SSL3_TXT_EDH_RSA_DES_192_CBC3_SHA) &&
  1361. strcmp(ciphername, "(NONE)")) {
  1362. log_debug(LD_NET, "Got a non-version-1 cipher called '%s'", ciphername);
  1363. // return 1;
  1364. goto v2_or_higher;
  1365. }
  1366. }
  1367. res = CIPHERS_V1;
  1368. goto done;
  1369. v2_or_higher:
  1370. {
  1371. const uint16_t *v2_cipher = v2_cipher_list;
  1372. for (i = 0; i < sk_SSL_CIPHER_num(peer_ciphers); ++i) {
  1373. const SSL_CIPHER *cipher = sk_SSL_CIPHER_value(peer_ciphers, i);
  1374. uint16_t id = SSL_CIPHER_get_id(cipher) & 0xffff;
  1375. if (id == 0x00ff) /* extended renegotiation indicator. */
  1376. continue;
  1377. if (!id || id != *v2_cipher) {
  1378. res = CIPHERS_UNRESTRICTED;
  1379. goto dump_ciphers;
  1380. }
  1381. ++v2_cipher;
  1382. }
  1383. if (*v2_cipher != 0) {
  1384. res = CIPHERS_UNRESTRICTED;
  1385. goto dump_ciphers;
  1386. }
  1387. res = CIPHERS_V2;
  1388. }
  1389. dump_ciphers:
  1390. {
  1391. smartlist_t *elts = smartlist_new();
  1392. char *s;
  1393. for (i = 0; i < sk_SSL_CIPHER_num(peer_ciphers); ++i) {
  1394. const SSL_CIPHER *cipher = sk_SSL_CIPHER_value(peer_ciphers, i);
  1395. const char *ciphername = SSL_CIPHER_get_name(cipher);
  1396. smartlist_add(elts, (char*)ciphername);
  1397. }
  1398. s = smartlist_join_strings(elts, ":", 0, NULL);
  1399. log_debug(LD_NET, "Got a %s V2/V3 cipher list from %s. It is: '%s'",
  1400. (res == CIPHERS_V2) ? "fictitious" : "real", ADDR(tor_tls), s);
  1401. tor_free(s);
  1402. smartlist_free(elts);
  1403. }
  1404. done:
  1405. if (tor_tls)
  1406. return tor_tls->client_cipher_list_type = res;
  1407. return res;
  1408. }
  1409. /** Return true iff the cipher list suggested by the client for <b>ssl</b> is
  1410. * a list that indicates that the client knows how to do the v2 TLS connection
  1411. * handshake. */
  1412. STATIC int
  1413. tor_tls_client_is_using_v2_ciphers(const SSL *ssl)
  1414. {
  1415. STACK_OF(SSL_CIPHER) *ciphers;
  1416. #ifdef HAVE_SSL_GET_CLIENT_CIPHERS
  1417. ciphers = SSL_get_client_ciphers(ssl);
  1418. #else
  1419. SSL_SESSION *session;
  1420. if (!(session = SSL_get_session((SSL *)ssl))) {
  1421. log_info(LD_NET, "No session on TLS?");
  1422. return CIPHERS_ERR;
  1423. }
  1424. ciphers = session->ciphers;
  1425. #endif /* defined(HAVE_SSL_GET_CLIENT_CIPHERS) */
  1426. return tor_tls_classify_client_ciphers(ssl, ciphers) >= CIPHERS_V2;
  1427. }
  1428. /** Invoked when we're accepting a connection on <b>ssl</b>, and the connection
  1429. * changes state. We use this:
  1430. * <ul><li>To alter the state of the handshake partway through, so we
  1431. * do not send or request extra certificates in v2 handshakes.</li>
  1432. * <li>To detect renegotiation</li></ul>
  1433. */
  1434. STATIC void
  1435. tor_tls_server_info_callback(const SSL *ssl, int type, int val)
  1436. {
  1437. tor_tls_t *tls;
  1438. (void) val;
  1439. IF_BUG_ONCE(ssl == NULL) {
  1440. return; // LCOV_EXCL_LINE
  1441. }
  1442. tor_tls_debug_state_callback(ssl, type, val);
  1443. if (type != SSL_CB_ACCEPT_LOOP)
  1444. return;
  1445. OSSL_HANDSHAKE_STATE ssl_state = SSL_get_state(ssl);
  1446. if (! STATE_IS_SW_SERVER_HELLO(ssl_state))
  1447. return;
  1448. tls = tor_tls_get_by_ssl(ssl);
  1449. if (tls) {
  1450. /* Check whether we're watching for renegotiates. If so, this is one! */
  1451. if (tls->negotiated_callback)
  1452. tls->got_renegotiate = 1;
  1453. if (tls->server_handshake_count < 127) /*avoid any overflow possibility*/
  1454. ++tls->server_handshake_count;
  1455. } else {
  1456. log_warn(LD_BUG, "Couldn't look up the tls for an SSL*. How odd!");
  1457. return;
  1458. }
  1459. /* Now check the cipher list. */
  1460. if (tor_tls_client_is_using_v2_ciphers(ssl)) {
  1461. if (tls->wasV2Handshake)
  1462. return; /* We already turned this stuff off for the first handshake;
  1463. * This is a renegotiation. */
  1464. /* Yes, we're casting away the const from ssl. This is very naughty of us.
  1465. * Let's hope openssl doesn't notice! */
  1466. /* Set SSL_MODE_NO_AUTO_CHAIN to keep from sending back any extra certs. */
  1467. SSL_set_mode((SSL*) ssl, SSL_MODE_NO_AUTO_CHAIN);
  1468. /* Don't send a hello request. */
  1469. SSL_set_verify((SSL*) ssl, SSL_VERIFY_NONE, NULL);
  1470. if (tls) {
  1471. tls->wasV2Handshake = 1;
  1472. } else {
  1473. /* LCOV_EXCL_START this line is not reachable */
  1474. log_warn(LD_BUG, "Couldn't look up the tls for an SSL*. How odd!");
  1475. /* LCOV_EXCL_STOP */
  1476. }
  1477. }
  1478. }
  1479. /** Callback to get invoked on a server after we've read the list of ciphers
  1480. * the client supports, but before we pick our own ciphersuite.
  1481. *
  1482. * We can't abuse an info_cb for this, since by the time one of the
  1483. * client_hello info_cbs is called, we've already picked which ciphersuite to
  1484. * use.
  1485. *
  1486. * Technically, this function is an abuse of this callback, since the point of
  1487. * a session_secret_cb is to try to set up and/or verify a shared-secret for
  1488. * authentication on the fly. But as long as we return 0, we won't actually be
  1489. * setting up a shared secret, and all will be fine.
  1490. */
  1491. STATIC int
  1492. tor_tls_session_secret_cb(SSL *ssl, void *secret, int *secret_len,
  1493. STACK_OF(SSL_CIPHER) *peer_ciphers,
  1494. CONST_IF_OPENSSL_1_1_API SSL_CIPHER **cipher,
  1495. void *arg)
  1496. {
  1497. (void) secret;
  1498. (void) secret_len;
  1499. (void) peer_ciphers;
  1500. (void) cipher;
  1501. (void) arg;
  1502. if (tor_tls_classify_client_ciphers(ssl, peer_ciphers) ==
  1503. CIPHERS_UNRESTRICTED) {
  1504. SSL_set_cipher_list(ssl, UNRESTRICTED_SERVER_CIPHER_LIST);
  1505. }
  1506. SSL_set_session_secret_cb(ssl, NULL, NULL);
  1507. return 0;
  1508. }
  1509. static void
  1510. tor_tls_setup_session_secret_cb(tor_tls_t *tls)
  1511. {
  1512. SSL_set_session_secret_cb(tls->ssl, tor_tls_session_secret_cb, NULL);
  1513. }
  1514. /** Create a new TLS object from a file descriptor, and a flag to
  1515. * determine whether it is functioning as a server.
  1516. */
  1517. tor_tls_t *
  1518. tor_tls_new(int sock, int isServer)
  1519. {
  1520. BIO *bio = NULL;
  1521. tor_tls_t *result = tor_malloc_zero(sizeof(tor_tls_t));
  1522. tor_tls_context_t *context = isServer ? server_tls_context :
  1523. client_tls_context;
  1524. result->magic = TOR_TLS_MAGIC;
  1525. check_no_tls_errors();
  1526. tor_assert(context); /* make sure somebody made it first */
  1527. if (!(result->ssl = SSL_new(context->ctx))) {
  1528. tls_log_errors(NULL, LOG_WARN, LD_NET, "creating SSL object");
  1529. tor_free(result);
  1530. goto err;
  1531. }
  1532. #ifdef SSL_set_tlsext_host_name
  1533. /* Browsers use the TLS hostname extension, so we should too. */
  1534. if (!isServer) {
  1535. char *fake_hostname = crypto_random_hostname(4,25, "www.",".com");
  1536. SSL_set_tlsext_host_name(result->ssl, fake_hostname);
  1537. tor_free(fake_hostname);
  1538. }
  1539. #endif /* defined(SSL_set_tlsext_host_name) */
  1540. if (!SSL_set_cipher_list(result->ssl,
  1541. isServer ? SERVER_CIPHER_LIST : CLIENT_CIPHER_LIST)) {
  1542. tls_log_errors(NULL, LOG_WARN, LD_NET, "setting ciphers");
  1543. #ifdef SSL_set_tlsext_host_name
  1544. SSL_set_tlsext_host_name(result->ssl, NULL);
  1545. #endif
  1546. SSL_free(result->ssl);
  1547. tor_free(result);
  1548. goto err;
  1549. }
  1550. result->socket = sock;
  1551. bio = BIO_new_socket(sock, BIO_NOCLOSE);
  1552. if (! bio) {
  1553. tls_log_errors(NULL, LOG_WARN, LD_NET, "opening BIO");
  1554. #ifdef SSL_set_tlsext_host_name
  1555. SSL_set_tlsext_host_name(result->ssl, NULL);
  1556. #endif
  1557. SSL_free(result->ssl);
  1558. tor_free(result);
  1559. goto err;
  1560. }
  1561. {
  1562. int set_worked =
  1563. SSL_set_ex_data(result->ssl, tor_tls_object_ex_data_index, result);
  1564. if (!set_worked) {
  1565. log_warn(LD_BUG,
  1566. "Couldn't set the tls for an SSL*; connection will fail");
  1567. }
  1568. }
  1569. SSL_set_bio(result->ssl, bio, bio);
  1570. tor_tls_context_incref(context);
  1571. result->context = context;
  1572. result->state = TOR_TLS_ST_HANDSHAKE;
  1573. result->isServer = isServer;
  1574. result->wantwrite_n = 0;
  1575. result->last_write_count = (unsigned long) BIO_number_written(bio);
  1576. result->last_read_count = (unsigned long) BIO_number_read(bio);
  1577. if (result->last_write_count || result->last_read_count) {
  1578. log_warn(LD_NET, "Newly created BIO has read count %lu, write count %lu",
  1579. result->last_read_count, result->last_write_count);
  1580. }
  1581. if (isServer) {
  1582. SSL_set_info_callback(result->ssl, tor_tls_server_info_callback);
  1583. } else {
  1584. SSL_set_info_callback(result->ssl, tor_tls_debug_state_callback);
  1585. }
  1586. if (isServer)
  1587. tor_tls_setup_session_secret_cb(result);
  1588. goto done;
  1589. err:
  1590. result = NULL;
  1591. done:
  1592. /* Not expected to get called. */
  1593. tls_log_errors(NULL, LOG_WARN, LD_NET, "creating tor_tls_t object");
  1594. return result;
  1595. }
  1596. /** Make future log messages about <b>tls</b> display the address
  1597. * <b>address</b>.
  1598. */
  1599. void
  1600. tor_tls_set_logged_address(tor_tls_t *tls, const char *address)
  1601. {
  1602. tor_assert(tls);
  1603. tor_free(tls->address);
  1604. tls->address = tor_strdup(address);
  1605. }
  1606. /** Set <b>cb</b> to be called with argument <b>arg</b> whenever <b>tls</b>
  1607. * next gets a client-side renegotiate in the middle of a read. Do not
  1608. * invoke this function until <em>after</em> initial handshaking is done!
  1609. */
  1610. void
  1611. tor_tls_set_renegotiate_callback(tor_tls_t *tls,
  1612. void (*cb)(tor_tls_t *, void *arg),
  1613. void *arg)
  1614. {
  1615. tls->negotiated_callback = cb;
  1616. tls->callback_arg = arg;
  1617. tls->got_renegotiate = 0;
  1618. if (cb) {
  1619. SSL_set_info_callback(tls->ssl, tor_tls_server_info_callback);
  1620. } else {
  1621. SSL_set_info_callback(tls->ssl, tor_tls_debug_state_callback);
  1622. }
  1623. }
  1624. /** If this version of openssl requires it, turn on renegotiation on
  1625. * <b>tls</b>.
  1626. */
  1627. void
  1628. tor_tls_unblock_renegotiation(tor_tls_t *tls)
  1629. {
  1630. /* Yes, we know what we are doing here. No, we do not treat a renegotiation
  1631. * as authenticating any earlier-received data. */
  1632. SSL_set_options(tls->ssl,
  1633. SSL_OP_ALLOW_UNSAFE_LEGACY_RENEGOTIATION);
  1634. }
  1635. /** If this version of openssl supports it, turn off renegotiation on
  1636. * <b>tls</b>. (Our protocol never requires this for security, but it's nice
  1637. * to use belt-and-suspenders here.)
  1638. */
  1639. void
  1640. tor_tls_block_renegotiation(tor_tls_t *tls)
  1641. {
  1642. #ifdef SUPPORT_UNSAFE_RENEGOTIATION_FLAG
  1643. tls->ssl->s3->flags &= ~SSL3_FLAGS_ALLOW_UNSAFE_LEGACY_RENEGOTIATION;
  1644. #else
  1645. (void) tls;
  1646. #endif
  1647. }
  1648. /** Assert that the flags that allow legacy renegotiation are still set */
  1649. void
  1650. tor_tls_assert_renegotiation_unblocked(tor_tls_t *tls)
  1651. {
  1652. #if defined(SSL_OP_ALLOW_UNSAFE_LEGACY_RENEGOTIATION) && \
  1653. SSL_OP_ALLOW_UNSAFE_LEGACY_RENEGOTIATION != 0
  1654. long options = SSL_get_options(tls->ssl);
  1655. tor_assert(0 != (options & SSL_OP_ALLOW_UNSAFE_LEGACY_RENEGOTIATION));
  1656. #else
  1657. (void) tls;
  1658. #endif /* defined(SSL_OP_ALLOW_UNSAFE_LEGACY_RENEGOTIATION) && ... */
  1659. }
  1660. /** Return whether this tls initiated the connect (client) or
  1661. * received it (server). */
  1662. int
  1663. tor_tls_is_server(tor_tls_t *tls)
  1664. {
  1665. tor_assert(tls);
  1666. return tls->isServer;
  1667. }
  1668. /** Release resources associated with a TLS object. Does not close the
  1669. * underlying file descriptor.
  1670. */
  1671. void
  1672. tor_tls_free_(tor_tls_t *tls)
  1673. {
  1674. if (!tls)
  1675. return;
  1676. tor_assert(tls->ssl);
  1677. {
  1678. size_t r,w;
  1679. tor_tls_get_n_raw_bytes(tls,&r,&w); /* ensure written_by_tls is updated */
  1680. }
  1681. #ifdef SSL_set_tlsext_host_name
  1682. SSL_set_tlsext_host_name(tls->ssl, NULL);
  1683. #endif
  1684. SSL_free(tls->ssl);
  1685. tls->ssl = NULL;
  1686. tls->negotiated_callback = NULL;
  1687. if (tls->context)
  1688. tor_tls_context_decref(tls->context);
  1689. tor_free(tls->address);
  1690. tls->magic = 0x99999999;
  1691. tor_free(tls);
  1692. }
  1693. /** Underlying function for TLS reading. Reads up to <b>len</b>
  1694. * characters from <b>tls</b> into <b>cp</b>. On success, returns the
  1695. * number of characters read. On failure, returns TOR_TLS_ERROR,
  1696. * TOR_TLS_CLOSE, TOR_TLS_WANTREAD, or TOR_TLS_WANTWRITE.
  1697. */
  1698. MOCK_IMPL(int,
  1699. tor_tls_read,(tor_tls_t *tls, char *cp, size_t len))
  1700. {
  1701. int r, err;
  1702. tor_assert(tls);
  1703. tor_assert(tls->ssl);
  1704. tor_assert(tls->state == TOR_TLS_ST_OPEN);
  1705. tor_assert(len<INT_MAX);
  1706. r = SSL_read(tls->ssl, cp, (int)len);
  1707. if (r > 0) {
  1708. if (tls->got_renegotiate) {
  1709. /* Renegotiation happened! */
  1710. log_info(LD_NET, "Got a TLS renegotiation from %s", ADDR(tls));
  1711. if (tls->negotiated_callback)
  1712. tls->negotiated_callback(tls, tls->callback_arg);
  1713. tls->got_renegotiate = 0;
  1714. }
  1715. return r;
  1716. }
  1717. err = tor_tls_get_error(tls, r, CATCH_ZERO, "reading", LOG_DEBUG, LD_NET);
  1718. if (err == TOR_TLS_ZERORETURN_ || err == TOR_TLS_CLOSE) {
  1719. log_debug(LD_NET,"read returned r=%d; TLS is closed",r);
  1720. tls->state = TOR_TLS_ST_CLOSED;
  1721. return TOR_TLS_CLOSE;
  1722. } else {
  1723. tor_assert(err != TOR_TLS_DONE);
  1724. log_debug(LD_NET,"read returned r=%d, err=%d",r,err);
  1725. return err;
  1726. }
  1727. }
  1728. /** Total number of bytes that we've used TLS to send. Used to track TLS
  1729. * overhead. */
  1730. STATIC uint64_t total_bytes_written_over_tls = 0;
  1731. /** Total number of bytes that TLS has put on the network for us. Used to
  1732. * track TLS overhead. */
  1733. STATIC uint64_t total_bytes_written_by_tls = 0;
  1734. /** Underlying function for TLS writing. Write up to <b>n</b>
  1735. * characters from <b>cp</b> onto <b>tls</b>. On success, returns the
  1736. * number of characters written. On failure, returns TOR_TLS_ERROR,
  1737. * TOR_TLS_WANTREAD, or TOR_TLS_WANTWRITE.
  1738. */
  1739. int
  1740. tor_tls_write(tor_tls_t *tls, const char *cp, size_t n)
  1741. {
  1742. int r, err;
  1743. tor_assert(tls);
  1744. tor_assert(tls->ssl);
  1745. tor_assert(tls->state == TOR_TLS_ST_OPEN);
  1746. tor_assert(n < INT_MAX);
  1747. if (n == 0)
  1748. return 0;
  1749. if (tls->wantwrite_n) {
  1750. /* if WANTWRITE last time, we must use the _same_ n as before */
  1751. tor_assert(n >= tls->wantwrite_n);
  1752. log_debug(LD_NET,"resuming pending-write, (%d to flush, reusing %d)",
  1753. (int)n, (int)tls->wantwrite_n);
  1754. n = tls->wantwrite_n;
  1755. tls->wantwrite_n = 0;
  1756. }
  1757. r = SSL_write(tls->ssl, cp, (int)n);
  1758. err = tor_tls_get_error(tls, r, 0, "writing", LOG_INFO, LD_NET);
  1759. if (err == TOR_TLS_DONE) {
  1760. total_bytes_written_over_tls += r;
  1761. return r;
  1762. }
  1763. if (err == TOR_TLS_WANTWRITE || err == TOR_TLS_WANTREAD) {
  1764. tls->wantwrite_n = n;
  1765. }
  1766. return err;
  1767. }
  1768. /** Perform initial handshake on <b>tls</b>. When finished, returns
  1769. * TOR_TLS_DONE. On failure, returns TOR_TLS_ERROR, TOR_TLS_WANTREAD,
  1770. * or TOR_TLS_WANTWRITE.
  1771. */
  1772. int
  1773. tor_tls_handshake(tor_tls_t *tls)
  1774. {
  1775. int r;
  1776. tor_assert(tls);
  1777. tor_assert(tls->ssl);
  1778. tor_assert(tls->state == TOR_TLS_ST_HANDSHAKE);
  1779. check_no_tls_errors();
  1780. OSSL_HANDSHAKE_STATE oldstate = SSL_get_state(tls->ssl);
  1781. if (tls->isServer) {
  1782. log_debug(LD_HANDSHAKE, "About to call SSL_accept on %p (%s)", tls,
  1783. SSL_state_string_long(tls->ssl));
  1784. r = SSL_accept(tls->ssl);
  1785. } else {
  1786. log_debug(LD_HANDSHAKE, "About to call SSL_connect on %p (%s)", tls,
  1787. SSL_state_string_long(tls->ssl));
  1788. r = SSL_connect(tls->ssl);
  1789. }
  1790. OSSL_HANDSHAKE_STATE newstate = SSL_get_state(tls->ssl);
  1791. if (oldstate != newstate)
  1792. log_debug(LD_HANDSHAKE, "After call, %p was in state %s",
  1793. tls, SSL_state_string_long(tls->ssl));
  1794. /* We need to call this here and not earlier, since OpenSSL has a penchant
  1795. * for clearing its flags when you say accept or connect. */
  1796. tor_tls_unblock_renegotiation(tls);
  1797. r = tor_tls_get_error(tls,r,0, "handshaking", LOG_INFO, LD_HANDSHAKE);
  1798. if (ERR_peek_error() != 0) {
  1799. tls_log_errors(tls, tls->isServer ? LOG_INFO : LOG_WARN, LD_HANDSHAKE,
  1800. "handshaking");
  1801. return TOR_TLS_ERROR_MISC;
  1802. }
  1803. if (r == TOR_TLS_DONE) {
  1804. tls->state = TOR_TLS_ST_OPEN;
  1805. return tor_tls_finish_handshake(tls);
  1806. }
  1807. return r;
  1808. }
  1809. /** Perform the final part of the initial TLS handshake on <b>tls</b>. This
  1810. * should be called for the first handshake only: it determines whether the v1
  1811. * or the v2 handshake was used, and adjusts things for the renegotiation
  1812. * handshake as appropriate.
  1813. *
  1814. * tor_tls_handshake() calls this on its own; you only need to call this if
  1815. * bufferevent is doing the handshake for you.
  1816. */
  1817. int
  1818. tor_tls_finish_handshake(tor_tls_t *tls)
  1819. {
  1820. int r = TOR_TLS_DONE;
  1821. check_no_tls_errors();
  1822. if (tls->isServer) {
  1823. SSL_set_info_callback(tls->ssl, NULL);
  1824. SSL_set_verify(tls->ssl, SSL_VERIFY_PEER, always_accept_verify_cb);
  1825. SSL_clear_mode(tls->ssl, SSL_MODE_NO_AUTO_CHAIN);
  1826. if (tor_tls_client_is_using_v2_ciphers(tls->ssl)) {
  1827. /* This check is redundant, but back when we did it in the callback,
  1828. * we might have not been able to look up the tor_tls_t if the code
  1829. * was buggy. Fixing that. */
  1830. if (!tls->wasV2Handshake) {
  1831. log_warn(LD_BUG, "For some reason, wasV2Handshake didn't"
  1832. " get set. Fixing that.");
  1833. }
  1834. tls->wasV2Handshake = 1;
  1835. log_debug(LD_HANDSHAKE, "Completed V2 TLS handshake with client; waiting"
  1836. " for renegotiation.");
  1837. } else {
  1838. tls->wasV2Handshake = 0;
  1839. }
  1840. } else {
  1841. /* Client-side */
  1842. tls->wasV2Handshake = 1;
  1843. /* XXXX this can move, probably? -NM */
  1844. if (SSL_set_cipher_list(tls->ssl, SERVER_CIPHER_LIST) == 0) {
  1845. tls_log_errors(NULL, LOG_WARN, LD_HANDSHAKE, "re-setting ciphers");
  1846. r = TOR_TLS_ERROR_MISC;
  1847. }
  1848. }
  1849. tls_log_errors(NULL, LOG_WARN, LD_NET, "finishing the handshake");
  1850. return r;
  1851. }
  1852. /** Shut down an open tls connection <b>tls</b>. When finished, returns
  1853. * TOR_TLS_DONE. On failure, returns TOR_TLS_ERROR, TOR_TLS_WANTREAD,
  1854. * or TOR_TLS_WANTWRITE.
  1855. */
  1856. int
  1857. tor_tls_shutdown(tor_tls_t *tls)
  1858. {
  1859. int r, err;
  1860. char buf[128];
  1861. tor_assert(tls);
  1862. tor_assert(tls->ssl);
  1863. check_no_tls_errors();
  1864. while (1) {
  1865. if (tls->state == TOR_TLS_ST_SENTCLOSE) {
  1866. /* If we've already called shutdown once to send a close message,
  1867. * we read until the other side has closed too.
  1868. */
  1869. do {
  1870. r = SSL_read(tls->ssl, buf, 128);
  1871. } while (r>0);
  1872. err = tor_tls_get_error(tls, r, CATCH_ZERO, "reading to shut down",
  1873. LOG_INFO, LD_NET);
  1874. if (err == TOR_TLS_ZERORETURN_) {
  1875. tls->state = TOR_TLS_ST_GOTCLOSE;
  1876. /* fall through... */
  1877. } else {
  1878. return err;
  1879. }
  1880. }
  1881. r = SSL_shutdown(tls->ssl);
  1882. if (r == 1) {
  1883. /* If shutdown returns 1, the connection is entirely closed. */
  1884. tls->state = TOR_TLS_ST_CLOSED;
  1885. return TOR_TLS_DONE;
  1886. }
  1887. err = tor_tls_get_error(tls, r, CATCH_SYSCALL|CATCH_ZERO, "shutting down",
  1888. LOG_INFO, LD_NET);
  1889. if (err == TOR_TLS_SYSCALL_) {
  1890. /* The underlying TCP connection closed while we were shutting down. */
  1891. tls->state = TOR_TLS_ST_CLOSED;
  1892. return TOR_TLS_DONE;
  1893. } else if (err == TOR_TLS_ZERORETURN_) {
  1894. /* The TLS connection says that it sent a shutdown record, but
  1895. * isn't done shutting down yet. Make sure that this hasn't
  1896. * happened before, then go back to the start of the function
  1897. * and try to read.
  1898. */
  1899. if (tls->state == TOR_TLS_ST_GOTCLOSE ||
  1900. tls->state == TOR_TLS_ST_SENTCLOSE) {
  1901. log_warn(LD_NET,
  1902. "TLS returned \"half-closed\" value while already half-closed");
  1903. return TOR_TLS_ERROR_MISC;
  1904. }
  1905. tls->state = TOR_TLS_ST_SENTCLOSE;
  1906. /* fall through ... */
  1907. } else {
  1908. return err;
  1909. }
  1910. } /* end loop */
  1911. }
  1912. /** Return true iff this TLS connection is authenticated.
  1913. */
  1914. int
  1915. tor_tls_peer_has_cert(tor_tls_t *tls)
  1916. {
  1917. X509 *cert;
  1918. cert = SSL_get_peer_certificate(tls->ssl);
  1919. tls_log_errors(tls, LOG_WARN, LD_HANDSHAKE, "getting peer certificate");
  1920. if (!cert)
  1921. return 0;
  1922. X509_free(cert);
  1923. return 1;
  1924. }
  1925. /** Return a newly allocated copy of the peer certificate, or NULL if there
  1926. * isn't one. */
  1927. MOCK_IMPL(tor_x509_cert_t *,
  1928. tor_tls_get_peer_cert,(tor_tls_t *tls))
  1929. {
  1930. X509 *cert;
  1931. cert = SSL_get_peer_certificate(tls->ssl);
  1932. tls_log_errors(tls, LOG_WARN, LD_HANDSHAKE, "getting peer certificate");
  1933. if (!cert)
  1934. return NULL;
  1935. return tor_x509_cert_new(cert);
  1936. }
  1937. /** Return a newly allocated copy of the cerficate we used on the connection,
  1938. * or NULL if somehow we didn't use one. */
  1939. MOCK_IMPL(tor_x509_cert_t *,
  1940. tor_tls_get_own_cert,(tor_tls_t *tls))
  1941. {
  1942. X509 *cert = SSL_get_certificate(tls->ssl);
  1943. tls_log_errors(tls, LOG_WARN, LD_HANDSHAKE,
  1944. "getting own-connection certificate");
  1945. if (!cert)
  1946. return NULL;
  1947. /* Fun inconsistency: SSL_get_peer_certificate increments the reference
  1948. * count, but SSL_get_certificate does not. */
  1949. X509 *duplicate = X509_dup(cert);
  1950. if (BUG(duplicate == NULL))
  1951. return NULL;
  1952. return tor_x509_cert_new(duplicate);
  1953. }
  1954. /** Warn that a certificate lifetime extends through a certain range. */
  1955. static void
  1956. log_cert_lifetime(int severity, const X509 *cert, const char *problem,
  1957. time_t now)
  1958. {
  1959. BIO *bio = NULL;
  1960. BUF_MEM *buf;
  1961. char *s1=NULL, *s2=NULL;
  1962. char mytime[33];
  1963. struct tm tm;
  1964. size_t n;
  1965. if (problem)
  1966. tor_log(severity, LD_GENERAL,
  1967. "Certificate %s. Either their clock is set wrong, or your clock "
  1968. "is wrong.",
  1969. problem);
  1970. if (!(bio = BIO_new(BIO_s_mem()))) {
  1971. log_warn(LD_GENERAL, "Couldn't allocate BIO!"); goto end;
  1972. }
  1973. if (!(ASN1_TIME_print(bio, X509_get_notBefore_const(cert)))) {
  1974. tls_log_errors(NULL, LOG_WARN, LD_NET, "printing certificate lifetime");
  1975. goto end;
  1976. }
  1977. BIO_get_mem_ptr(bio, &buf);
  1978. s1 = tor_strndup(buf->data, buf->length);
  1979. (void)BIO_reset(bio);
  1980. if (!(ASN1_TIME_print(bio, X509_get_notAfter_const(cert)))) {
  1981. tls_log_errors(NULL, LOG_WARN, LD_NET, "printing certificate lifetime");
  1982. goto end;
  1983. }
  1984. BIO_get_mem_ptr(bio, &buf);
  1985. s2 = tor_strndup(buf->data, buf->length);
  1986. n = strftime(mytime, 32, "%b %d %H:%M:%S %Y UTC", tor_gmtime_r(&now, &tm));
  1987. if (n > 0) {
  1988. tor_log(severity, LD_GENERAL,
  1989. "(certificate lifetime runs from %s through %s. Your time is %s.)",
  1990. s1,s2,mytime);
  1991. } else {
  1992. tor_log(severity, LD_GENERAL,
  1993. "(certificate lifetime runs from %s through %s. "
  1994. "Couldn't get your time.)",
  1995. s1, s2);
  1996. }
  1997. end:
  1998. /* Not expected to get invoked */
  1999. tls_log_errors(NULL, LOG_WARN, LD_NET, "getting certificate lifetime");
  2000. if (bio)
  2001. BIO_free(bio);
  2002. tor_free(s1);
  2003. tor_free(s2);
  2004. }
  2005. /** Helper function: try to extract a link certificate and an identity
  2006. * certificate from <b>tls</b>, and store them in *<b>cert_out</b> and
  2007. * *<b>id_cert_out</b> respectively. Log all messages at level
  2008. * <b>severity</b>.
  2009. *
  2010. * Note that a reference is added to cert_out, so it needs to be
  2011. * freed. id_cert_out doesn't. */
  2012. MOCK_IMPL(STATIC void,
  2013. try_to_extract_certs_from_tls,(int severity, tor_tls_t *tls,
  2014. X509 **cert_out, X509 **id_cert_out))
  2015. {
  2016. X509 *cert = NULL, *id_cert = NULL;
  2017. STACK_OF(X509) *chain = NULL;
  2018. int num_in_chain, i;
  2019. *cert_out = *id_cert_out = NULL;
  2020. if (!(cert = SSL_get_peer_certificate(tls->ssl)))
  2021. return;
  2022. *cert_out = cert;
  2023. if (!(chain = SSL_get_peer_cert_chain(tls->ssl)))
  2024. return;
  2025. num_in_chain = sk_X509_num(chain);
  2026. /* 1 means we're receiving (server-side), and it's just the id_cert.
  2027. * 2 means we're connecting (client-side), and it's both the link
  2028. * cert and the id_cert.
  2029. */
  2030. if (num_in_chain < 1) {
  2031. log_fn(severity,LD_PROTOCOL,
  2032. "Unexpected number of certificates in chain (%d)",
  2033. num_in_chain);
  2034. return;
  2035. }
  2036. for (i=0; i<num_in_chain; ++i) {
  2037. id_cert = sk_X509_value(chain, i);
  2038. if (X509_cmp(id_cert, cert) != 0)
  2039. break;
  2040. }
  2041. *id_cert_out = id_cert;
  2042. }
  2043. /** If the provided tls connection is authenticated and has a
  2044. * certificate chain that is currently valid and signed, then set
  2045. * *<b>identity_key</b> to the identity certificate's key and return
  2046. * 0. Else, return -1 and log complaints with log-level <b>severity</b>.
  2047. */
  2048. int
  2049. tor_tls_verify(int severity, tor_tls_t *tls, crypto_pk_t **identity_key)
  2050. {
  2051. X509 *cert = NULL, *id_cert = NULL;
  2052. EVP_PKEY *id_pkey = NULL;
  2053. RSA *rsa;
  2054. int r = -1;
  2055. check_no_tls_errors();
  2056. *identity_key = NULL;
  2057. try_to_extract_certs_from_tls(severity, tls, &cert, &id_cert);
  2058. if (!cert)
  2059. goto done;
  2060. if (!id_cert) {
  2061. log_fn(severity,LD_PROTOCOL,"No distinct identity certificate found");
  2062. goto done;
  2063. }
  2064. tls_log_errors(tls, severity, LD_HANDSHAKE, "before verifying certificate");
  2065. if (!(id_pkey = X509_get_pubkey(id_cert)) ||
  2066. X509_verify(cert, id_pkey) <= 0) {
  2067. log_fn(severity,LD_PROTOCOL,"X509_verify on cert and pkey returned <= 0");
  2068. tls_log_errors(tls, severity, LD_HANDSHAKE, "verifying certificate");
  2069. goto done;
  2070. }
  2071. rsa = EVP_PKEY_get1_RSA(id_pkey);
  2072. if (!rsa)
  2073. goto done;
  2074. *identity_key = crypto_new_pk_from_rsa_(rsa);
  2075. r = 0;
  2076. done:
  2077. if (cert)
  2078. X509_free(cert);
  2079. if (id_pkey)
  2080. EVP_PKEY_free(id_pkey);
  2081. /* This should never get invoked, but let's make sure in case OpenSSL
  2082. * acts unexpectedly. */
  2083. tls_log_errors(tls, LOG_WARN, LD_HANDSHAKE, "finishing tor_tls_verify");
  2084. return r;
  2085. }
  2086. /** Check whether the certificate set on the connection <b>tls</b> is expired
  2087. * give or take <b>past_tolerance</b> seconds, or not-yet-valid give or take
  2088. * <b>future_tolerance</b> seconds. Return 0 for valid, -1 for failure.
  2089. *
  2090. * NOTE: you should call tor_tls_verify before tor_tls_check_lifetime.
  2091. */
  2092. int
  2093. tor_tls_check_lifetime(int severity, tor_tls_t *tls,
  2094. time_t now,
  2095. int past_tolerance, int future_tolerance)
  2096. {
  2097. X509 *cert;
  2098. int r = -1;
  2099. if (!(cert = SSL_get_peer_certificate(tls->ssl)))
  2100. goto done;
  2101. if (check_cert_lifetime_internal(severity, cert, now,
  2102. past_tolerance, future_tolerance) < 0)
  2103. goto done;
  2104. r = 0;
  2105. done:
  2106. if (cert)
  2107. X509_free(cert);
  2108. /* Not expected to get invoked */
  2109. tls_log_errors(tls, LOG_WARN, LD_NET, "checking certificate lifetime");
  2110. return r;
  2111. }
  2112. /** Helper: check whether <b>cert</b> is expired give or take
  2113. * <b>past_tolerance</b> seconds, or not-yet-valid give or take
  2114. * <b>future_tolerance</b> seconds. (Relative to the current time
  2115. * <b>now</b>.) If it is live, return 0. If it is not live, log a message
  2116. * and return -1. */
  2117. static int
  2118. check_cert_lifetime_internal(int severity, const X509 *cert,
  2119. time_t now,
  2120. int past_tolerance, int future_tolerance)
  2121. {
  2122. time_t t;
  2123. t = now + future_tolerance;
  2124. if (X509_cmp_time(X509_get_notBefore_const(cert), &t) > 0) {
  2125. log_cert_lifetime(severity, cert, "not yet valid", now);
  2126. return -1;
  2127. }
  2128. t = now - past_tolerance;
  2129. if (X509_cmp_time(X509_get_notAfter_const(cert), &t) < 0) {
  2130. log_cert_lifetime(severity, cert, "already expired", now);
  2131. return -1;
  2132. }
  2133. return 0;
  2134. }
  2135. #ifdef TOR_UNIT_TESTS
  2136. /* Testing only: return a new x509 cert with the same contents as <b>inp</b>,
  2137. but with the expiration time <b>new_expiration_time</b>, signed with
  2138. <b>signing_key</b>. */
  2139. STATIC tor_x509_cert_t *
  2140. tor_x509_cert_replace_expiration(const tor_x509_cert_t *inp,
  2141. time_t new_expiration_time,
  2142. crypto_pk_t *signing_key)
  2143. {
  2144. X509 *newc = X509_dup(inp->cert);
  2145. X509_time_adj(X509_get_notAfter(newc), 0, &new_expiration_time);
  2146. EVP_PKEY *pk = crypto_pk_get_evp_pkey_(signing_key, 1);
  2147. tor_assert(X509_sign(newc, pk, EVP_sha256()));
  2148. EVP_PKEY_free(pk);
  2149. return tor_x509_cert_new(newc);
  2150. }
  2151. #endif /* defined(TOR_UNIT_TESTS) */
  2152. /** Return the number of bytes available for reading from <b>tls</b>.
  2153. */
  2154. int
  2155. tor_tls_get_pending_bytes(tor_tls_t *tls)
  2156. {
  2157. tor_assert(tls);
  2158. return SSL_pending(tls->ssl);
  2159. }
  2160. /** If <b>tls</b> requires that the next write be of a particular size,
  2161. * return that size. Otherwise, return 0. */
  2162. size_t
  2163. tor_tls_get_forced_write_size(tor_tls_t *tls)
  2164. {
  2165. return tls->wantwrite_n;
  2166. }
  2167. /** Sets n_read and n_written to the number of bytes read and written,
  2168. * respectively, on the raw socket used by <b>tls</b> since the last time this
  2169. * function was called on <b>tls</b>. */
  2170. void
  2171. tor_tls_get_n_raw_bytes(tor_tls_t *tls, size_t *n_read, size_t *n_written)
  2172. {
  2173. BIO *wbio, *tmpbio;
  2174. unsigned long r, w;
  2175. r = (unsigned long) BIO_number_read(SSL_get_rbio(tls->ssl));
  2176. /* We want the number of bytes actually for real written. Unfortunately,
  2177. * sometimes OpenSSL replaces the wbio on tls->ssl with a buffering bio,
  2178. * which makes the answer turn out wrong. Let's cope with that. Note
  2179. * that this approach will fail if we ever replace tls->ssl's BIOs with
  2180. * buffering bios for reasons of our own. As an alternative, we could
  2181. * save the original BIO for tls->ssl in the tor_tls_t structure, but
  2182. * that would be tempting fate. */
  2183. wbio = SSL_get_wbio(tls->ssl);
  2184. #if OPENSSL_VERSION_NUMBER >= OPENSSL_VER(1,1,0,0,5)
  2185. /* BIO structure is opaque as of OpenSSL 1.1.0-pre5-dev. Again, not
  2186. * supposed to use this form of the version macro, but the OpenSSL developers
  2187. * introduced major API changes in the pre-release stage.
  2188. */
  2189. if (BIO_method_type(wbio) == BIO_TYPE_BUFFER &&
  2190. (tmpbio = BIO_next(wbio)) != NULL)
  2191. wbio = tmpbio;
  2192. #else /* !(OPENSSL_VERSION_NUMBER >= OPENSSL_VER(1,1,0,0,5)) */
  2193. if (wbio->method == BIO_f_buffer() && (tmpbio = BIO_next(wbio)) != NULL)
  2194. wbio = tmpbio;
  2195. #endif /* OPENSSL_VERSION_NUMBER >= OPENSSL_VER(1,1,0,0,5) */
  2196. w = (unsigned long) BIO_number_written(wbio);
  2197. /* We are ok with letting these unsigned ints go "negative" here:
  2198. * If we wrapped around, this should still give us the right answer, unless
  2199. * we wrapped around by more than ULONG_MAX since the last time we called
  2200. * this function.
  2201. */
  2202. *n_read = (size_t)(r - tls->last_read_count);
  2203. *n_written = (size_t)(w - tls->last_write_count);
  2204. if (*n_read > INT_MAX || *n_written > INT_MAX) {
  2205. log_warn(LD_BUG, "Preposterously large value in tor_tls_get_n_raw_bytes. "
  2206. "r=%lu, last_read=%lu, w=%lu, last_written=%lu",
  2207. r, tls->last_read_count, w, tls->last_write_count);
  2208. }
  2209. total_bytes_written_by_tls += *n_written;
  2210. tls->last_read_count = r;
  2211. tls->last_write_count = w;
  2212. }
  2213. /** Return a ratio of the bytes that TLS has sent to the bytes that we've told
  2214. * it to send. Used to track whether our TLS records are getting too tiny. */
  2215. MOCK_IMPL(double,
  2216. tls_get_write_overhead_ratio,(void))
  2217. {
  2218. if (total_bytes_written_over_tls == 0)
  2219. return 1.0;
  2220. return ((double)total_bytes_written_by_tls) /
  2221. ((double)total_bytes_written_over_tls);
  2222. }
  2223. /** Implement check_no_tls_errors: If there are any pending OpenSSL
  2224. * errors, log an error message. */
  2225. void
  2226. check_no_tls_errors_(const char *fname, int line)
  2227. {
  2228. if (ERR_peek_error() == 0)
  2229. return;
  2230. log_warn(LD_CRYPTO, "Unhandled OpenSSL errors found at %s:%d: ",
  2231. tor_fix_source_file(fname), line);
  2232. tls_log_errors(NULL, LOG_WARN, LD_NET, NULL);
  2233. }
  2234. /** Return true iff the initial TLS connection at <b>tls</b> did not use a v2
  2235. * TLS handshake. Output is undefined if the handshake isn't finished. */
  2236. int
  2237. tor_tls_used_v1_handshake(tor_tls_t *tls)
  2238. {
  2239. return ! tls->wasV2Handshake;
  2240. }
  2241. /** Return the number of server handshakes that we've noticed doing on
  2242. * <b>tls</b>. */
  2243. int
  2244. tor_tls_get_num_server_handshakes(tor_tls_t *tls)
  2245. {
  2246. return tls->server_handshake_count;
  2247. }
  2248. /** Return true iff the server TLS connection <b>tls</b> got the renegotiation
  2249. * request it was waiting for. */
  2250. int
  2251. tor_tls_server_got_renegotiate(tor_tls_t *tls)
  2252. {
  2253. return tls->got_renegotiate;
  2254. }
  2255. #ifndef HAVE_SSL_GET_CLIENT_RANDOM
  2256. static size_t
  2257. SSL_get_client_random(SSL *s, uint8_t *out, size_t len)
  2258. {
  2259. if (len == 0)
  2260. return SSL3_RANDOM_SIZE;
  2261. tor_assert(len == SSL3_RANDOM_SIZE);
  2262. tor_assert(s->s3);
  2263. memcpy(out, s->s3->client_random, len);
  2264. return len;
  2265. }
  2266. #endif /* !defined(HAVE_SSL_GET_CLIENT_RANDOM) */
  2267. #ifndef HAVE_SSL_GET_SERVER_RANDOM
  2268. static size_t
  2269. SSL_get_server_random(SSL *s, uint8_t *out, size_t len)
  2270. {
  2271. if (len == 0)
  2272. return SSL3_RANDOM_SIZE;
  2273. tor_assert(len == SSL3_RANDOM_SIZE);
  2274. tor_assert(s->s3);
  2275. memcpy(out, s->s3->server_random, len);
  2276. return len;
  2277. }
  2278. #endif /* !defined(HAVE_SSL_GET_SERVER_RANDOM) */
  2279. #ifndef HAVE_SSL_SESSION_GET_MASTER_KEY
  2280. STATIC size_t
  2281. SSL_SESSION_get_master_key(SSL_SESSION *s, uint8_t *out, size_t len)
  2282. {
  2283. tor_assert(s);
  2284. if (len == 0)
  2285. return s->master_key_length;
  2286. tor_assert(len == (size_t)s->master_key_length);
  2287. tor_assert(out);
  2288. memcpy(out, s->master_key, len);
  2289. return len;
  2290. }
  2291. #endif /* !defined(HAVE_SSL_SESSION_GET_MASTER_KEY) */
  2292. /** Set the DIGEST256_LEN buffer at <b>secrets_out</b> to the value used in
  2293. * the v3 handshake to prove that the client knows the TLS secrets for the
  2294. * connection <b>tls</b>. Return 0 on success, -1 on failure.
  2295. */
  2296. MOCK_IMPL(int,
  2297. tor_tls_get_tlssecrets,(tor_tls_t *tls, uint8_t *secrets_out))
  2298. {
  2299. #define TLSSECRET_MAGIC "Tor V3 handshake TLS cross-certification"
  2300. uint8_t buf[128];
  2301. size_t len;
  2302. tor_assert(tls);
  2303. SSL *const ssl = tls->ssl;
  2304. SSL_SESSION *const session = SSL_get_session(ssl);
  2305. tor_assert(ssl);
  2306. tor_assert(session);
  2307. const size_t server_random_len = SSL_get_server_random(ssl, NULL, 0);
  2308. const size_t client_random_len = SSL_get_client_random(ssl, NULL, 0);
  2309. const size_t master_key_len = SSL_SESSION_get_master_key(session, NULL, 0);
  2310. tor_assert(server_random_len);
  2311. tor_assert(client_random_len);
  2312. tor_assert(master_key_len);
  2313. len = client_random_len + server_random_len + strlen(TLSSECRET_MAGIC) + 1;
  2314. tor_assert(len <= sizeof(buf));
  2315. {
  2316. size_t r = SSL_get_client_random(ssl, buf, client_random_len);
  2317. tor_assert(r == client_random_len);
  2318. }
  2319. {
  2320. size_t r = SSL_get_server_random(ssl,
  2321. buf+client_random_len,
  2322. server_random_len);
  2323. tor_assert(r == server_random_len);
  2324. }
  2325. uint8_t *master_key = tor_malloc_zero(master_key_len);
  2326. {
  2327. size_t r = SSL_SESSION_get_master_key(session, master_key, master_key_len);
  2328. tor_assert(r == master_key_len);
  2329. }
  2330. uint8_t *nextbuf = buf + client_random_len + server_random_len;
  2331. memcpy(nextbuf, TLSSECRET_MAGIC, strlen(TLSSECRET_MAGIC) + 1);
  2332. /*
  2333. The value is an HMAC, using the TLS master key as the HMAC key, of
  2334. client_random | server_random | TLSSECRET_MAGIC
  2335. */
  2336. crypto_hmac_sha256((char*)secrets_out,
  2337. (char*)master_key,
  2338. master_key_len,
  2339. (char*)buf, len);
  2340. memwipe(buf, 0, sizeof(buf));
  2341. memwipe(master_key, 0, master_key_len);
  2342. tor_free(master_key);
  2343. return 0;
  2344. }
  2345. /** Using the RFC5705 key material exporting construction, and the
  2346. * provided <b>context</b> (<b>context_len</b> bytes long) and
  2347. * <b>label</b> (a NUL-terminated string), compute a 32-byte secret in
  2348. * <b>secrets_out</b> that only the parties to this TLS session can
  2349. * compute. Return 0 on success and -1 on failure.
  2350. */
  2351. MOCK_IMPL(int,
  2352. tor_tls_export_key_material,(tor_tls_t *tls, uint8_t *secrets_out,
  2353. const uint8_t *context,
  2354. size_t context_len,
  2355. const char *label))
  2356. {
  2357. tor_assert(tls);
  2358. tor_assert(tls->ssl);
  2359. int r = SSL_export_keying_material(tls->ssl,
  2360. secrets_out, DIGEST256_LEN,
  2361. label, strlen(label),
  2362. context, context_len, 1);
  2363. return (r == 1) ? 0 : -1;
  2364. }
  2365. /** Examine the amount of memory used and available for buffers in <b>tls</b>.
  2366. * Set *<b>rbuf_capacity</b> to the amount of storage allocated for the read
  2367. * buffer and *<b>rbuf_bytes</b> to the amount actually used.
  2368. * Set *<b>wbuf_capacity</b> to the amount of storage allocated for the write
  2369. * buffer and *<b>wbuf_bytes</b> to the amount actually used.
  2370. *
  2371. * Return 0 on success, -1 on failure.*/
  2372. int
  2373. tor_tls_get_buffer_sizes(tor_tls_t *tls,
  2374. size_t *rbuf_capacity, size_t *rbuf_bytes,
  2375. size_t *wbuf_capacity, size_t *wbuf_bytes)
  2376. {
  2377. #if OPENSSL_VERSION_NUMBER >= OPENSSL_V_SERIES(1,1,0)
  2378. (void)tls;
  2379. (void)rbuf_capacity;
  2380. (void)rbuf_bytes;
  2381. (void)wbuf_capacity;
  2382. (void)wbuf_bytes;
  2383. return -1;
  2384. #else /* !(OPENSSL_VERSION_NUMBER >= OPENSSL_V_SERIES(1,1,0)) */
  2385. if (tls->ssl->s3->rbuf.buf)
  2386. *rbuf_capacity = tls->ssl->s3->rbuf.len;
  2387. else
  2388. *rbuf_capacity = 0;
  2389. if (tls->ssl->s3->wbuf.buf)
  2390. *wbuf_capacity = tls->ssl->s3->wbuf.len;
  2391. else
  2392. *wbuf_capacity = 0;
  2393. *rbuf_bytes = tls->ssl->s3->rbuf.left;
  2394. *wbuf_bytes = tls->ssl->s3->wbuf.left;
  2395. return 0;
  2396. #endif /* OPENSSL_VERSION_NUMBER >= OPENSSL_V_SERIES(1,1,0) */
  2397. }
  2398. /** Check whether the ECC group requested is supported by the current OpenSSL
  2399. * library instance. Return 1 if the group is supported, and 0 if not.
  2400. */
  2401. int
  2402. evaluate_ecgroup_for_tls(const char *ecgroup)
  2403. {
  2404. EC_KEY *ec_key;
  2405. int nid;
  2406. int ret;
  2407. if (!ecgroup)
  2408. nid = NID_tor_default_ecdhe_group;
  2409. else if (!strcasecmp(ecgroup, "P256"))
  2410. nid = NID_X9_62_prime256v1;
  2411. else if (!strcasecmp(ecgroup, "P224"))
  2412. nid = NID_secp224r1;
  2413. else
  2414. return 0;
  2415. ec_key = EC_KEY_new_by_curve_name(nid);
  2416. ret = (ec_key != NULL);
  2417. EC_KEY_free(ec_key);
  2418. return ret;
  2419. }