visaljs 0.0.2 → 0.0.3

package/runtime/third_party/boringssl/ssl/ssl_stat.cc

@@ -0,0 +1,162 @@
+// Copyright 1995-2016 The OpenSSL Project Authors. All Rights Reserved.
+// Copyright 2005 Nokia. All rights reserved.
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//     https://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+#include <openssl/ssl.h>
+
+#include <assert.h>
+
+#include "internal.h"
+
+
+using namespace bssl;
+
+const char *SSL_state_string_long(const SSL *ssl) {
+  const auto *ssl_impl = FromOpaque(ssl);
+  if (ssl_impl->s3->hs == nullptr) {
+    return "SSL negotiation finished successfully";
+  }
+
+  return ssl_impl->server ? ssl_server_handshake_state(ssl_impl->s3->hs.get())
+                          : ssl_client_handshake_state(ssl_impl->s3->hs.get());
+}
+
+const char *SSL_state_string(const SSL *ssl) { return "!!!!!!"; }
+
+const char *SSL_alert_type_string_long(int value) {
+  value >>= 8;
+  if (value == SSL3_AL_WARNING) {
+    return "warning";
+  } else if (value == SSL3_AL_FATAL) {
+    return "fatal";
+  }
+
+  return "unknown";
+}
+
+const char *SSL_alert_type_string(int value) { return "!"; }
+
+const char *SSL_alert_desc_string(int value) { return "!!"; }
+
+const char *SSL_alert_desc_string_long(int value) {
+  switch (value & 0xff) {
+    case SSL3_AD_CLOSE_NOTIFY:
+      return "close notify";
+
+    case SSL3_AD_UNEXPECTED_MESSAGE:
+      return "unexpected_message";
+
+    case SSL3_AD_BAD_RECORD_MAC:
+      return "bad record mac";
+
+    case SSL3_AD_DECOMPRESSION_FAILURE:
+      return "decompression failure";
+
+    case SSL3_AD_HANDSHAKE_FAILURE:
+      return "handshake failure";
+
+    case SSL3_AD_NO_CERTIFICATE:
+      return "no certificate";
+
+    case SSL3_AD_BAD_CERTIFICATE:
+      return "bad certificate";
+
+    case SSL3_AD_UNSUPPORTED_CERTIFICATE:
+      return "unsupported certificate";
+
+    case SSL3_AD_CERTIFICATE_REVOKED:
+      return "certificate revoked";
+
+    case SSL3_AD_CERTIFICATE_EXPIRED:
+      return "certificate expired";
+
+    case SSL3_AD_CERTIFICATE_UNKNOWN:
+      return "certificate unknown";
+
+    case SSL3_AD_ILLEGAL_PARAMETER:
+      return "illegal parameter";
+
+    case TLS1_AD_DECRYPTION_FAILED:
+      return "decryption failed";
+
+    case TLS1_AD_RECORD_OVERFLOW:
+      return "record overflow";
+
+    case TLS1_AD_UNKNOWN_CA:
+      return "unknown CA";
+
+    case TLS1_AD_ACCESS_DENIED:
+      return "access denied";
+
+    case TLS1_AD_DECODE_ERROR:
+      return "decode error";
+
+    case TLS1_AD_DECRYPT_ERROR:
+      return "decrypt error";
+
+    case TLS1_AD_EXPORT_RESTRICTION:
+      return "export restriction";
+
+    case TLS1_AD_PROTOCOL_VERSION:
+      return "protocol version";
+
+    case TLS1_AD_INSUFFICIENT_SECURITY:
+      return "insufficient security";
+
+    case TLS1_AD_INTERNAL_ERROR:
+      return "internal error";
+
+    case SSL3_AD_INAPPROPRIATE_FALLBACK:
+      return "inappropriate fallback";
+
+    case TLS1_AD_USER_CANCELLED:
+      return "user canceled";
+
+    case TLS1_AD_NO_RENEGOTIATION:
+      return "no renegotiation";
+
+    case TLS1_AD_MISSING_EXTENSION:
+      return "missing extension";
+
+    case TLS1_AD_UNSUPPORTED_EXTENSION:
+      return "unsupported extension";
+
+    case TLS1_AD_CERTIFICATE_UNOBTAINABLE:
+      return "certificate unobtainable";
+
+    case TLS1_AD_UNRECOGNIZED_NAME:
+      return "unrecognized name";
+
+    case TLS1_AD_BAD_CERTIFICATE_STATUS_RESPONSE:
+      return "bad certificate status response";
+
+    case TLS1_AD_BAD_CERTIFICATE_HASH_VALUE:
+      return "bad certificate hash value";
+
+    case TLS1_AD_UNKNOWN_PSK_IDENTITY:
+      return "unknown PSK identity";
+
+    case TLS1_AD_CERTIFICATE_REQUIRED:
+      return "certificate required";
+
+    case TLS1_AD_NO_APPLICATION_PROTOCOL:
+      return "no application protocol";
+
+    case TLS1_AD_ECH_REQUIRED:
+      return "ECH required";
+
+    default:
+      return "unknown";
+  }
+}

package/runtime/third_party/boringssl/ssl/ssl_transcript.cc

@@ -0,0 +1,224 @@
+// Copyright 1995-2016 The OpenSSL Project Authors. All Rights Reserved.
+// Copyright 2005 Nokia. All rights reserved.
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//     https://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+#include <openssl/ssl.h>
+
+#include <string_view>
+
+#include <openssl/buf.h>
+#include <openssl/digest.h>
+#include <openssl/err.h>
+
+#include "internal.h"
+
+
+BSSL_NAMESPACE_BEGIN
+
+SSLTranscript::SSLTranscript(bool is_dtls) : is_dtls_(is_dtls) {}
+
+SSLTranscript::~SSLTranscript() {}
+
+bool SSLTranscript::Init() {
+  buffer_.reset(BUF_MEM_new());
+  if (!buffer_) {
+    return false;
+  }
+
+  hash_.Reset();
+  return true;
+}
+
+bool SSLTranscript::InitHash(uint16_t version, const SSL_CIPHER *cipher) {
+  version_ = version;
+  const EVP_MD *md = ssl_get_handshake_digest(version, cipher);
+  if (Digest() == md) {
+    // No need to re-hash the buffer.
+    return true;
+  }
+  if (!HashBuffer(hash_.get(), md)) {
+    return false;
+  }
+  if (is_dtls_ && version_ >= TLS1_3_VERSION) {
+    // In DTLS 1.3, prior to the call to InitHash, the message (if present) in
+    // the buffer has the DTLS 1.2 header. After the call to InitHash, the TLS
+    // 1.3 header is written by SSLTranscript::Update. If the buffer isn't freed
+    // here, it would have a mix of different header formats and using it would
+    // yield wrong results. However, there's no need for the buffer once the
+    // version and the digest for the cipher suite are known, so the buffer is
+    // freed here to avoid potential misuse of the SSLTranscript object.
+    FreeBuffer();
+  }
+  return true;
+}
+
+bool SSLTranscript::HashBuffer(EVP_MD_CTX *ctx, const EVP_MD *digest) const {
+  if (!EVP_DigestInit_ex(ctx, digest, nullptr)) {
+    return false;
+  }
+  if (!is_dtls_ || version_ < TLS1_3_VERSION) {
+    return EVP_DigestUpdate(ctx, buffer_->data, buffer_->length);
+  }
+
+  // If the version is DTLS 1.3 and we still have a buffer, then there should be
+  // at most a single DTLSHandshake message in the buffer, for the ClientHello.
+  // On the server side, the version (DTLS 1.3) and cipher suite are chosen in
+  // response to the first ClientHello, and InitHash is called before that
+  // ClientHello is added to the SSLTranscript, so the buffer is empty if this
+  // SSLTranscript is on the server.
+  if (buffer_->length == 0) {
+    return true;
+  }
+
+  // On the client side, we can receive either a ServerHello or
+  // HelloRetryRequest in response to the ClientHello. Regardless of which
+  // message we receive, the client code calls InitHash before updating the
+  // transcript with that message, so the ClientHello is the only message in the
+  // buffer. In DTLS 1.3, we need to skip the message_seq, fragment_offset, and
+  // fragment_length fields from the DTLSHandshake message in the buffer. The
+  // structure of a DTLSHandshake message is as follows (RFC 9147, section 5.2):
+  //
+  //   struct {
+  //       HandshakeType msg_type;    /* handshake type */
+  //       uint24 length;             /* bytes in message */
+  //       uint16 message_seq;        /* DTLS-required field */
+  //       uint24 fragment_offset;    /* DTLS-required field */
+  //       uint24 fragment_length;    /* DTLS-required field */
+  //       select (msg_type) {
+  //         /* omitted for brevity */
+  //       } body;
+  //   } DTLSHandshake;
+  CBS buf, header;
+  CBS_init(&buf, reinterpret_cast<uint8_t *>(buffer_->data), buffer_->length);
+  if (!CBS_get_bytes(&buf, &header, 4) ||                             //
+      !CBS_skip(&buf, 8) ||                                           //
+      !EVP_DigestUpdate(ctx, CBS_data(&header), CBS_len(&header)) ||  //
+      !EVP_DigestUpdate(ctx, CBS_data(&buf), CBS_len(&buf))) {
+    return false;
+  }
+  return true;
+}
+
+void SSLTranscript::FreeBuffer() { buffer_.reset(); }
+
+size_t SSLTranscript::DigestLen() const { return EVP_MD_size(Digest()); }
+
+const EVP_MD *SSLTranscript::Digest() const {
+  return EVP_MD_CTX_get0_md(hash_.get());
+}
+
+bool SSLTranscript::UpdateForHelloRetryRequest() {
+  if (buffer_) {
+    buffer_->length = 0;
+  }
+
+  uint8_t old_hash[EVP_MAX_MD_SIZE];
+  size_t hash_len;
+  if (!GetHash(old_hash, &hash_len)) {
+    return false;
+  }
+  const uint8_t header[4] = {SSL3_MT_MESSAGE_HASH, 0, 0,
+                             static_cast<uint8_t>(hash_len)};
+  if (!EVP_DigestInit_ex(hash_.get(), Digest(), nullptr) ||
+      !AddToBufferOrHash(header) ||
+      !AddToBufferOrHash(Span(old_hash, hash_len))) {
+    return false;
+  }
+  return true;
+}
+
+bool SSLTranscript::CopyToHashContext(EVP_MD_CTX *ctx,
+                                      const EVP_MD *digest) const {
+  const EVP_MD *transcript_digest = Digest();
+  if (transcript_digest != nullptr &&
+      EVP_MD_type(transcript_digest) == EVP_MD_type(digest)) {
+    return EVP_MD_CTX_copy_ex(ctx, hash_.get());
+  }
+
+  if (buffer_) {
+    return HashBuffer(ctx, digest);
+  }
+
+  OPENSSL_PUT_ERROR(SSL, ERR_R_INTERNAL_ERROR);
+  return false;
+}
+
+bool SSLTranscript::Update(Span<const uint8_t> in) {
+  if (!is_dtls_ || version_ < TLS1_3_VERSION) {
+    return AddToBufferOrHash(in);
+  }
+  if (in.size() < DTLS1_HM_HEADER_LENGTH) {
+    return false;
+  }
+  // The message passed into Update is the whole Handshake or DTLSHandshake
+  // message, including the msg_type and length. In DTLS, the DTLSHandshake
+  // message also has message_seq, fragment_offset, and fragment_length
+  // fields. In DTLS 1.3, those fields are omitted so that the same
+  // transcript format as TLS 1.3 is used. This means we write the 1-byte
+  // msg_type, 3-byte length, then skip 2+3+3 bytes for the DTLS-specific
+  // fields that get omitted.
+  if (!AddToBufferOrHash(in.first<4>()) ||
+      !AddToBufferOrHash(in.subspan<12>())) {
+    return false;
+  }
+  return true;
+}
+
+bool SSLTranscript::AddToBufferOrHash(Span<const uint8_t> in) {
+  // Depending on the state of the handshake, either the handshake buffer may be
+  // active, the rolling hash, or both.
+  if (buffer_ &&  //
+      !BUF_MEM_append(buffer_.get(), in.data(), in.size())) {
+    return false;
+  }
+
+  if (EVP_MD_CTX_md(hash_.get()) != nullptr) {
+    EVP_DigestUpdate(hash_.get(), in.data(), in.size());
+  }
+
+  return true;
+}
+
+bool SSLTranscript::GetHash(uint8_t *out, size_t *out_len) const {
+  ScopedEVP_MD_CTX ctx;
+  unsigned len;
+  if (!EVP_MD_CTX_copy_ex(ctx.get(), hash_.get()) ||
+      !EVP_DigestFinal_ex(ctx.get(), out, &len)) {
+    return false;
+  }
+  *out_len = len;
+  return true;
+}
+
+bool SSLTranscript::GetFinishedMAC(uint8_t *out, size_t *out_len,
+                                   const SSLSession *session,
+                                   bool from_server) const {
+  uint8_t digest[EVP_MAX_MD_SIZE];
+  size_t digest_len;
+  if (!GetHash(digest, &digest_len)) {
+    return false;
+  }
+
+  std::string_view label = from_server ? "server finished" : "client finished";
+  static const size_t kFinishedLen = 12;
+  if (!tls1_prf(Digest(), Span(out, kFinishedLen), session->secret, label,
+                Span(digest, digest_len), {})) {
+    return false;
+  }
+
+  *out_len = kFinishedLen;
+  return true;
+}
+
+BSSL_NAMESPACE_END