9front - general discussion about 9front
 help / color / mirror / Atom feed
* [9front] [PATCH] libsec: add minimal support for the tls renegotiation extension
@ 2022-11-10  2:24 Anthony Martin
  0 siblings, 0 replies; only message in thread
From: Anthony Martin @ 2022-11-10  2:24 UTC (permalink / raw)
  To: 9front

OpenSSL 3.0 clients refuse to connect to servers that do not
support the renegotiation extension (RFC 5746) unless the default
configuration is changed to allow it. Since we do not support
renegotiation, we only need to make minor changes to the initial
handshake to comply with the specification:

1. For tlsClient, simply add the proper SCSV to the ClientHello
cipher list (cf. RFC 5746 § 3.3);

2. For tlsServer, respond with an empty renegotiation extension
in the ServerHello if we received either the SCSV or an empty
renegotiation extension in the ClientHello.

Since we close the hand file and never open it after the initial
handshake, we can rely on tls(3) to send the "no renegotiation"
alerts if subsequent handshake records are received.

---
diff e5d29a2bd91951a24fccecd958416856cecef444 d75905c2e41425e0add855e77527b016384c46ec
--- a/sys/src/libsec/port/tlshand.c	Tue Nov 8 14:11:29 2022
+++ b/sys/src/libsec/port/tlshand.c	Wed Nov 9 18:24:40 2022
@@ -68,6 +68,7 @@
 	uchar sec[MasterSecretSize];	// master secret
 	uchar srandom[RandomSize];	// server random
 	uchar crandom[RandomSize];	// client random
+	int reneg;			// secure renegotiation flag
 
 	Namedcurve *nc; // selected curve for ECDHE
 	// diffie hellman state
@@ -251,6 +252,7 @@
 	TLS_PSK_WITH_AES_128_CBC_SHA		= 0x008C,
 
 	TLS_FALLBACK_SCSV = 0x5600,
+	TLS_EMPTY_RENEGOTIATION_INFO_SCSV = 0x00FF,
 };
 
 // compression methods
@@ -271,6 +273,7 @@
 	Extec = 0x000a,
 	Extecp = 0x000b,
 	Extsigalgs = 0x000d,
+	Extreneg = 0xff01,
 };
 
 static Algs cipherAlgs[] = {
@@ -670,6 +673,16 @@
 						break;
 					}
 			break;
+		case Extreneg:
+			if(n < 1 || *p != (n -= 1))
+				goto Short;
+			if(*p != 0){
+				tlsError(c, EHandshakeFailure, "invalid renegotiation extension");
+				return -1;
+			}
+			c->sec->reneg = 1;
+			p++;
+
 		}
 	}
 
@@ -679,13 +692,37 @@
 	return -1; 
 } 
 
+static uchar*
+tlsServerExtensions(TlsConnection *c, int *plen)
+{
+	uchar *b, *p;
+	int m;
+
+	p = b = nil;
+
+	// RFC5746 - Renegotiation Indication
+	if(c->sec->reneg){
+		m = p - b;
+		b = erealloc(b, m + 2+2+1);
+		p = b + m;
+
+		put16(p, Extreneg), p += 2;	/* Type: renegotiation_info */
+		put16(p, 1), p += 2;		/* Length */
+		*p++ = 0;			/* Renegotiated Connection Length */
+	}
+
+	*plen = p - b;
+	return b;
+}
+
 static TlsConnection *
 tlsServer2(int ctl, int hand,
 	uchar *cert, int certlen,
 	char *pskid, uchar *psk, int psklen,
 	int (*trace)(char*fmt, ...), PEMChain *chp)
 {
-	int cipher, compressor, numcerts, i;
+	int cipher, compressor, numcerts, i, extlen;
+	uchar *ext;
 	TlsConnection *c;
 	Msg m;
 
@@ -741,8 +778,11 @@
 			goto Err;
 		}
 	}
+	if(lookupid(m.u.clientHello.ciphers, TLS_EMPTY_RENEGOTIATION_INFO_SCSV) >= 0)
+		c->sec->reneg = 1;
 	if(checkClientExtensions(c, m.u.clientHello.extensions) < 0)
 		goto Err;
+	ext = tlsServerExtensions(c, &extlen);
 	cipher = okCipher(m.u.clientHello.ciphers, psklen > 0, c->sec->nc != nil);
 	if(cipher < 0 || !setAlgs(c, cipher)) {
 		tlsError(c, EHandshakeFailure, "no matching cipher suite");
@@ -763,6 +803,7 @@
 	m.u.serverHello.cipher = cipher;
 	m.u.serverHello.compressor = compressor;
 	m.u.serverHello.sid = makebytes(nil, 0);
+	m.u.serverHello.extensions = makebytes(ext, extlen);
 	if(!msgSend(c, &m, AQueue))
 		goto Err;
 
@@ -2273,6 +2314,7 @@
 	for(i = 0; i < nelem(cipherAlgs); i++)
 		if(cipherAlgs[i].ok && isPSK(cipherAlgs[i].tlsid) == ispsk)
 			is->data[j++] = cipherAlgs[i].tlsid;
+	is->data[j++] = TLS_EMPTY_RENEGOTIATION_INFO_SCSV;
 	is->len = j;
 	return is;
 }

^ permalink raw reply	[flat|nested] only message in thread

only message in thread, other threads:[~2022-11-10  4:31 UTC | newest]

Thread overview: (only message) (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2022-11-10  2:24 [9front] [PATCH] libsec: add minimal support for the tls renegotiation extension Anthony Martin

This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).