VirtualBox

source: vbox/trunk/src/libs/openssl-3.3.2/ssl/ssl_asn1.c@ 108453

最後變更 在這個檔案從108453是 108206,由 vboxsync 提交於 4 週 前

openssl-3.3.2: Exported all files to OSE and removed .scm-settings ​bugref:10757
  • 屬性 svn:eol-style 設為 native
  • 屬性 svn:keywords 設為 Author Date Id Revision
檔案大小: 13.5 KB
行 
1/*
2 * Copyright 1995-2023 The OpenSSL Project Authors. All Rights Reserved.
3 * Copyright 2005 Nokia. All rights reserved.
4 *
5 * Licensed under the Apache License 2.0 (the "License"). You may not use
6 * this file except in compliance with the License. You can obtain a copy
7 * in the file LICENSE in the source distribution or at
8 * https://www.openssl.org/source/license.html
9 */
10
11#include <stdio.h>
12#include <stdlib.h>
13#include "ssl_local.h"
14#include <openssl/asn1t.h>
15#include <openssl/encoder.h>
16#include <openssl/x509.h>
17
18typedef struct {
19 uint32_t version;
20 int32_t ssl_version;
21 ASN1_OCTET_STRING *cipher;
22 ASN1_OCTET_STRING *comp_id;
23 ASN1_OCTET_STRING *master_key;
24 ASN1_OCTET_STRING *session_id;
25 ASN1_OCTET_STRING *key_arg;
26 int64_t time;
27 int64_t timeout;
28 X509 *peer;
29 ASN1_OCTET_STRING *session_id_context;
30 int32_t verify_result;
31 ASN1_OCTET_STRING *tlsext_hostname;
32 uint64_t tlsext_tick_lifetime_hint;
33 uint32_t tlsext_tick_age_add;
34 ASN1_OCTET_STRING *tlsext_tick;
35#ifndef OPENSSL_NO_PSK
36 ASN1_OCTET_STRING *psk_identity_hint;
37 ASN1_OCTET_STRING *psk_identity;
38#endif
39#ifndef OPENSSL_NO_SRP
40 ASN1_OCTET_STRING *srp_username;
41#endif
42 uint64_t flags;
43 uint32_t max_early_data;
44 ASN1_OCTET_STRING *alpn_selected;
45 uint32_t tlsext_max_fragment_len_mode;
46 ASN1_OCTET_STRING *ticket_appdata;
47 uint32_t kex_group;
48 ASN1_OCTET_STRING *peer_rpk;
49} SSL_SESSION_ASN1;
50
51ASN1_SEQUENCE(SSL_SESSION_ASN1) = {
52 ASN1_EMBED(SSL_SESSION_ASN1, version, UINT32),
53 ASN1_EMBED(SSL_SESSION_ASN1, ssl_version, INT32),
54 ASN1_SIMPLE(SSL_SESSION_ASN1, cipher, ASN1_OCTET_STRING),
55 ASN1_SIMPLE(SSL_SESSION_ASN1, session_id, ASN1_OCTET_STRING),
56 ASN1_SIMPLE(SSL_SESSION_ASN1, master_key, ASN1_OCTET_STRING),
57 ASN1_IMP_OPT(SSL_SESSION_ASN1, key_arg, ASN1_OCTET_STRING, 0),
58 ASN1_EXP_OPT_EMBED(SSL_SESSION_ASN1, time, ZINT64, 1),
59 ASN1_EXP_OPT_EMBED(SSL_SESSION_ASN1, timeout, ZINT64, 2),
60 ASN1_EXP_OPT(SSL_SESSION_ASN1, peer, X509, 3),
61 ASN1_EXP_OPT(SSL_SESSION_ASN1, session_id_context, ASN1_OCTET_STRING, 4),
62 ASN1_EXP_OPT_EMBED(SSL_SESSION_ASN1, verify_result, ZINT32, 5),
63 ASN1_EXP_OPT(SSL_SESSION_ASN1, tlsext_hostname, ASN1_OCTET_STRING, 6),
64#ifndef OPENSSL_NO_PSK
65 ASN1_EXP_OPT(SSL_SESSION_ASN1, psk_identity_hint, ASN1_OCTET_STRING, 7),
66 ASN1_EXP_OPT(SSL_SESSION_ASN1, psk_identity, ASN1_OCTET_STRING, 8),
67#endif
68 ASN1_EXP_OPT_EMBED(SSL_SESSION_ASN1, tlsext_tick_lifetime_hint, ZUINT64, 9),
69 ASN1_EXP_OPT(SSL_SESSION_ASN1, tlsext_tick, ASN1_OCTET_STRING, 10),
70 ASN1_EXP_OPT(SSL_SESSION_ASN1, comp_id, ASN1_OCTET_STRING, 11),
71#ifndef OPENSSL_NO_SRP
72 ASN1_EXP_OPT(SSL_SESSION_ASN1, srp_username, ASN1_OCTET_STRING, 12),
73#endif
74 ASN1_EXP_OPT_EMBED(SSL_SESSION_ASN1, flags, ZUINT64, 13),
75 ASN1_EXP_OPT_EMBED(SSL_SESSION_ASN1, tlsext_tick_age_add, ZUINT32, 14),
76 ASN1_EXP_OPT_EMBED(SSL_SESSION_ASN1, max_early_data, ZUINT32, 15),
77 ASN1_EXP_OPT(SSL_SESSION_ASN1, alpn_selected, ASN1_OCTET_STRING, 16),
78 ASN1_EXP_OPT_EMBED(SSL_SESSION_ASN1, tlsext_max_fragment_len_mode, ZUINT32, 17),
79 ASN1_EXP_OPT(SSL_SESSION_ASN1, ticket_appdata, ASN1_OCTET_STRING, 18),
80 ASN1_EXP_OPT_EMBED(SSL_SESSION_ASN1, kex_group, UINT32, 19),
81 ASN1_EXP_OPT(SSL_SESSION_ASN1, peer_rpk, ASN1_OCTET_STRING, 20)
82} static_ASN1_SEQUENCE_END(SSL_SESSION_ASN1)
83
84IMPLEMENT_STATIC_ASN1_ENCODE_FUNCTIONS(SSL_SESSION_ASN1)
85
86/* Utility functions for i2d_SSL_SESSION */
87
88/* Initialise OCTET STRING from buffer and length */
89
90static void ssl_session_oinit(ASN1_OCTET_STRING **dest, ASN1_OCTET_STRING *os,
91 const unsigned char *data, size_t len)
92{
93 os->data = (unsigned char *)data; /* justified cast: data is not modified */
94 os->length = (int)len;
95 os->flags = 0;
96 *dest = os;
97}
98
99/* Initialise OCTET STRING from string */
100static void ssl_session_sinit(ASN1_OCTET_STRING **dest, ASN1_OCTET_STRING *os,
101 const char *data)
102{
103 if (data != NULL)
104 ssl_session_oinit(dest, os, (const unsigned char *)data, strlen(data));
105 else
106 *dest = NULL;
107}
108
109int i2d_SSL_SESSION(const SSL_SESSION *in, unsigned char **pp)
110{
111
112 SSL_SESSION_ASN1 as;
113
114 ASN1_OCTET_STRING cipher;
115 unsigned char cipher_data[2];
116 ASN1_OCTET_STRING master_key, session_id, sid_ctx;
117
118#ifndef OPENSSL_NO_COMP
119 ASN1_OCTET_STRING comp_id;
120 unsigned char comp_id_data;
121#endif
122 ASN1_OCTET_STRING tlsext_hostname, tlsext_tick;
123#ifndef OPENSSL_NO_SRP
124 ASN1_OCTET_STRING srp_username;
125#endif
126#ifndef OPENSSL_NO_PSK
127 ASN1_OCTET_STRING psk_identity, psk_identity_hint;
128#endif
129 ASN1_OCTET_STRING alpn_selected;
130 ASN1_OCTET_STRING ticket_appdata;
131 ASN1_OCTET_STRING peer_rpk;
132
133 long l;
134 int ret;
135
136 if ((in == NULL) || ((in->cipher == NULL) && (in->cipher_id == 0)))
137 return 0;
138
139 memset(&as, 0, sizeof(as));
140
141 as.version = SSL_SESSION_ASN1_VERSION;
142 as.ssl_version = in->ssl_version;
143
144 as.kex_group = in->kex_group;
145
146 if (in->cipher == NULL)
147 l = in->cipher_id;
148 else
149 l = in->cipher->id;
150 cipher_data[0] = ((unsigned char)(l >> 8L)) & 0xff;
151 cipher_data[1] = ((unsigned char)(l)) & 0xff;
152
153 ssl_session_oinit(&as.cipher, &cipher, cipher_data, 2);
154
155#ifndef OPENSSL_NO_COMP
156 if (in->compress_meth) {
157 comp_id_data = (unsigned char)in->compress_meth;
158 ssl_session_oinit(&as.comp_id, &comp_id, &comp_id_data, 1);
159 }
160#endif
161
162 ssl_session_oinit(&as.master_key, &master_key,
163 in->master_key, in->master_key_length);
164
165 ssl_session_oinit(&as.session_id, &session_id,
166 in->session_id, in->session_id_length);
167
168 ssl_session_oinit(&as.session_id_context, &sid_ctx,
169 in->sid_ctx, in->sid_ctx_length);
170
171 as.time = (int64_t)ossl_time_to_time_t(in->time);
172 as.timeout = (int64_t)ossl_time2seconds(in->timeout);
173 as.verify_result = in->verify_result;
174
175 as.peer = in->peer;
176
177 as.peer_rpk = NULL;
178 peer_rpk.data = NULL;
179 if (in->peer_rpk != NULL) {
180 peer_rpk.length = i2d_PUBKEY(in->peer_rpk, &peer_rpk.data);
181 if (peer_rpk.length > 0 && peer_rpk.data != NULL)
182 as.peer_rpk = &peer_rpk;
183 }
184
185 ssl_session_sinit(&as.tlsext_hostname, &tlsext_hostname,
186 in->ext.hostname);
187 if (in->ext.tick) {
188 ssl_session_oinit(&as.tlsext_tick, &tlsext_tick,
189 in->ext.tick, in->ext.ticklen);
190 }
191 if (in->ext.tick_lifetime_hint > 0)
192 as.tlsext_tick_lifetime_hint = in->ext.tick_lifetime_hint;
193 as.tlsext_tick_age_add = in->ext.tick_age_add;
194#ifndef OPENSSL_NO_PSK
195 ssl_session_sinit(&as.psk_identity_hint, &psk_identity_hint,
196 in->psk_identity_hint);
197 ssl_session_sinit(&as.psk_identity, &psk_identity, in->psk_identity);
198#endif /* OPENSSL_NO_PSK */
199#ifndef OPENSSL_NO_SRP
200 ssl_session_sinit(&as.srp_username, &srp_username, in->srp_username);
201#endif /* OPENSSL_NO_SRP */
202
203 as.flags = in->flags;
204 as.max_early_data = in->ext.max_early_data;
205
206 if (in->ext.alpn_selected == NULL)
207 as.alpn_selected = NULL;
208 else
209 ssl_session_oinit(&as.alpn_selected, &alpn_selected,
210 in->ext.alpn_selected, in->ext.alpn_selected_len);
211
212 as.tlsext_max_fragment_len_mode = in->ext.max_fragment_len_mode;
213
214 if (in->ticket_appdata == NULL)
215 as.ticket_appdata = NULL;
216 else
217 ssl_session_oinit(&as.ticket_appdata, &ticket_appdata,
218 in->ticket_appdata, in->ticket_appdata_len);
219
220 ret = i2d_SSL_SESSION_ASN1(&as, pp);
221 OPENSSL_free(peer_rpk.data);
222 return ret;
223}
224
225/* Utility functions for d2i_SSL_SESSION */
226
227/* OPENSSL_strndup an OCTET STRING */
228
229static int ssl_session_strndup(char **pdst, ASN1_OCTET_STRING *src)
230{
231 OPENSSL_free(*pdst);
232 *pdst = NULL;
233 if (src == NULL)
234 return 1;
235 *pdst = OPENSSL_strndup((char *)src->data, src->length);
236 if (*pdst == NULL)
237 return 0;
238 return 1;
239}
240
241/* Copy an OCTET STRING, return error if it exceeds maximum length */
242
243static int ssl_session_memcpy(unsigned char *dst, size_t *pdstlen,
244 ASN1_OCTET_STRING *src, size_t maxlen)
245{
246 if (src == NULL || src->length == 0) {
247 *pdstlen = 0;
248 return 1;
249 }
250 if (src->length < 0 || src->length > (int)maxlen)
251 return 0;
252 memcpy(dst, src->data, src->length);
253 *pdstlen = src->length;
254 return 1;
255}
256
257SSL_SESSION *d2i_SSL_SESSION(SSL_SESSION **a, const unsigned char **pp,
258 long length)
259{
260 return d2i_SSL_SESSION_ex(a, pp, length, NULL, NULL);
261}
262SSL_SESSION *d2i_SSL_SESSION_ex(SSL_SESSION **a, const unsigned char **pp,
263 long length, OSSL_LIB_CTX *libctx,
264 const char *propq)
265{
266 long id;
267 size_t tmpl;
268 const unsigned char *p = *pp;
269 SSL_SESSION_ASN1 *as = NULL;
270 SSL_SESSION *ret = NULL;
271
272 as = d2i_SSL_SESSION_ASN1(NULL, &p, length);
273 /* ASN.1 code returns suitable error */
274 if (as == NULL)
275 goto err;
276
277 if (a == NULL || *a == NULL) {
278 ret = SSL_SESSION_new();
279 if (ret == NULL)
280 goto err;
281 } else {
282 ret = *a;
283 }
284
285 if (as->version != SSL_SESSION_ASN1_VERSION) {
286 ERR_raise(ERR_LIB_SSL, SSL_R_UNKNOWN_SSL_VERSION);
287 goto err;
288 }
289
290 if ((as->ssl_version >> 8) != SSL3_VERSION_MAJOR
291 && (as->ssl_version >> 8) != DTLS1_VERSION_MAJOR
292 && as->ssl_version != DTLS1_BAD_VER) {
293 ERR_raise(ERR_LIB_SSL, SSL_R_UNSUPPORTED_SSL_VERSION);
294 goto err;
295 }
296
297 ret->ssl_version = (int)as->ssl_version;
298
299 ret->kex_group = as->kex_group;
300
301 if (as->cipher->length != 2) {
302 ERR_raise(ERR_LIB_SSL, SSL_R_CIPHER_CODE_WRONG_LENGTH);
303 goto err;
304 }
305
306 id = 0x03000000L | ((unsigned long)as->cipher->data[0] << 8L)
307 | (unsigned long)as->cipher->data[1];
308
309 ret->cipher_id = id;
310 ret->cipher = ssl3_get_cipher_by_id(id);
311 if (ret->cipher == NULL)
312 goto err;
313
314 if (!ssl_session_memcpy(ret->session_id, &ret->session_id_length,
315 as->session_id, SSL3_MAX_SSL_SESSION_ID_LENGTH))
316 goto err;
317
318 if (!ssl_session_memcpy(ret->master_key, &tmpl,
319 as->master_key, TLS13_MAX_RESUMPTION_PSK_LENGTH))
320 goto err;
321
322 ret->master_key_length = tmpl;
323
324 if (as->time != 0)
325 ret->time = ossl_time_from_time_t(as->time);
326 else
327 ret->time = ossl_time_now();
328
329 if (as->timeout != 0)
330 ret->timeout = ossl_seconds2time(as->timeout);
331 else
332 ret->timeout = ossl_seconds2time(3);
333 ssl_session_calculate_timeout(ret);
334
335 X509_free(ret->peer);
336 ret->peer = as->peer;
337 as->peer = NULL;
338
339 EVP_PKEY_free(ret->peer_rpk);
340 ret->peer_rpk = NULL;
341 if (as->peer_rpk != NULL) {
342 const unsigned char *data = as->peer_rpk->data;
343
344 /*
345 * |data| is incremented; we don't want to lose original ptr
346 */
347 ret->peer_rpk = d2i_PUBKEY_ex(NULL, &data, as->peer_rpk->length, libctx, propq);
348 if (ret->peer_rpk == NULL)
349 goto err;
350 }
351
352 if (!ssl_session_memcpy(ret->sid_ctx, &ret->sid_ctx_length,
353 as->session_id_context, SSL_MAX_SID_CTX_LENGTH))
354 goto err;
355
356 /* NB: this defaults to zero which is X509_V_OK */
357 ret->verify_result = as->verify_result;
358
359 if (!ssl_session_strndup(&ret->ext.hostname, as->tlsext_hostname))
360 goto err;
361
362#ifndef OPENSSL_NO_PSK
363 if (!ssl_session_strndup(&ret->psk_identity_hint, as->psk_identity_hint))
364 goto err;
365 if (!ssl_session_strndup(&ret->psk_identity, as->psk_identity))
366 goto err;
367#endif
368
369 ret->ext.tick_lifetime_hint = (unsigned long)as->tlsext_tick_lifetime_hint;
370 ret->ext.tick_age_add = as->tlsext_tick_age_add;
371 OPENSSL_free(ret->ext.tick);
372 if (as->tlsext_tick != NULL) {
373 ret->ext.tick = as->tlsext_tick->data;
374 ret->ext.ticklen = as->tlsext_tick->length;
375 as->tlsext_tick->data = NULL;
376 } else {
377 ret->ext.tick = NULL;
378 }
379#ifndef OPENSSL_NO_COMP
380 if (as->comp_id) {
381 if (as->comp_id->length != 1) {
382 ERR_raise(ERR_LIB_SSL, SSL_R_BAD_LENGTH);
383 goto err;
384 }
385 ret->compress_meth = as->comp_id->data[0];
386 } else {
387 ret->compress_meth = 0;
388 }
389#endif
390
391#ifndef OPENSSL_NO_SRP
392 if (!ssl_session_strndup(&ret->srp_username, as->srp_username))
393 goto err;
394#endif /* OPENSSL_NO_SRP */
395 /* Flags defaults to zero which is fine */
396 ret->flags = (int32_t)as->flags;
397 ret->ext.max_early_data = as->max_early_data;
398
399 OPENSSL_free(ret->ext.alpn_selected);
400 if (as->alpn_selected != NULL) {
401 ret->ext.alpn_selected = as->alpn_selected->data;
402 ret->ext.alpn_selected_len = as->alpn_selected->length;
403 as->alpn_selected->data = NULL;
404 } else {
405 ret->ext.alpn_selected = NULL;
406 ret->ext.alpn_selected_len = 0;
407 }
408
409 ret->ext.max_fragment_len_mode = as->tlsext_max_fragment_len_mode;
410
411 OPENSSL_free(ret->ticket_appdata);
412 if (as->ticket_appdata != NULL) {
413 ret->ticket_appdata = as->ticket_appdata->data;
414 ret->ticket_appdata_len = as->ticket_appdata->length;
415 as->ticket_appdata->data = NULL;
416 } else {
417 ret->ticket_appdata = NULL;
418 ret->ticket_appdata_len = 0;
419 }
420
421 M_ASN1_free_of(as, SSL_SESSION_ASN1);
422
423 if ((a != NULL) && (*a == NULL))
424 *a = ret;
425 *pp = p;
426 return ret;
427
428 err:
429 M_ASN1_free_of(as, SSL_SESSION_ASN1);
430 if ((a == NULL) || (*a != ret))
431 SSL_SESSION_free(ret);
432 return NULL;
433}
注意: 瀏覽 TracBrowser 來幫助您使用儲存庫瀏覽器

© 2025 Oracle Support Privacy / Do Not Sell My Info Terms of Use Trademark Policy Automated Access Etiquette