Cap the record layer version number of TLS ClientHello to TLS 1.0

net/third_party/nss/ssl/ssl3con.c

 /* -*- Mode: C; tab-width: 8; indent-tabs-mode: nil; c-basic-offset: 4 -*- */
 /*
  * SSL3 Protocol
  *
  * ***** BEGIN LICENSE BLOCK *****
  * Version: MPL 1.1/GPL 2.0/LGPL 2.1
  *
  * The contents of this file are subject to the Mozilla Public License Version
  * 1.1 (the "License"); you may not use this file except in compliance with
  * the License. You may obtain a copy of the License at
@@ skipping 2039 matching lines @@
         PK11_FreeSlot(slot);
     }
     return isPresent;
 }
 
 /* Caller must hold the spec read lock. */
 SECStatus
 ssl3_CompressMACEncryptRecord(ssl3CipherSpec *   cwSpec,
                               PRBool             isServer,
                               PRBool             isDTLS,
+                              PRBool             capsRecordVersion,

[Ryan Sleevi, 2012/07/13 21:20:53]

should this be singular - capRecordVersion - to indicate it's a command?

with capsRecordVersion, "caps" seems like a verb, so it's not clear what/who the
subject is. If I substitute in "peer", as in "the peer caps the record version",
this doesn't seem accurate, since it's not the peer who caps, it's the client
who needs to cap to talk to the peer.

Same for other occurrences of the pluralized form

                               SSL3ContentType    type,
                               const SSL3Opaque * pIn,
                               PRUint32           contentLen,
                               sslBuffer *        wrBuf)
 {
     const ssl3BulkCipherDef * cipher_def;
     SECStatus                 rv;
     PRUint32                  macLen = 0;
     PRUint32                  fragLen;
     PRUint32  p1Len, p2Len, oddLen = 0;
@@ skipping 139 matching lines @@
         wrBuf->buf[4] = (unsigned char)(cwSpec->write_seq_num.high >> 16);
         wrBuf->buf[5] = (unsigned char)(cwSpec->write_seq_num.high >>  8);
         wrBuf->buf[6] = (unsigned char)(cwSpec->write_seq_num.high >>  0);
         wrBuf->buf[7] = (unsigned char)(cwSpec->write_seq_num.low  >> 24);
         wrBuf->buf[8] = (unsigned char)(cwSpec->write_seq_num.low  >> 16);
         wrBuf->buf[9] = (unsigned char)(cwSpec->write_seq_num.low  >>  8);
         wrBuf->buf[10] = (unsigned char)(cwSpec->write_seq_num.low >>  0);
         wrBuf->buf[11] = MSB(cipherBytes);
         wrBuf->buf[12] = LSB(cipherBytes);
     } else {
-        wrBuf->buf[1] = MSB(cwSpec->version);
-        wrBuf->buf[2] = LSB(cwSpec->version);
+        SSL3ProtocolVersion version;
+
+        version = cwSpec->version;

[Ryan Sleevi, 2012/07/13 21:20:53]

nit:

SSL3ProtocolVersion version = cwSpec->version?

+        if (capsRecordVersion) {
+            version = PR_MIN(SSL_LIBRARY_VERSION_TLS_1_0, version);
+        }
+        wrBuf->buf[1] = MSB(version);
+        wrBuf->buf[2] = LSB(version);
         wrBuf->buf[3] = MSB(cipherBytes);
         wrBuf->buf[4] = LSB(cipherBytes);
     }
 
     ssl3_BumpSequenceNumber(&cwSpec->write_seq_num);
 
     return SECSuccess;
 }
 
 /* Process the plain text before sending it.
  * Returns the number of bytes of plaintext that were successfully sent
  *      plus the number of bytes of plaintext that were copied into the
  *      output (write) buffer.
  * Returns SECFailure on a hard IO error, memory error, or crypto error.
  * Does NOT return SECWouldBlock.
  *
  * Notes on the use of the private ssl flags:
  * (no private SSL flags)
  *    Attempt to make and send SSL records for all plaintext
  *    If non-blocking and a send gets WOULD_BLOCK,
  *    or if the pending (ciphertext) buffer is not empty,
  *    then buffer remaining bytes of ciphertext into pending buf,
  *    and continue to do that for all succssive records until all
  *    bytes are used.
  * ssl_SEND_FLAG_FORCE_INTO_BUFFER
  *    As above, except this suppresses all write attempts, and forces
  *    all ciphertext into the pending ciphertext buffer.
  * ssl_SEND_FLAG_USE_EPOCH (for DTLS)
  *    Forces the use of the provided epoch
- *
+ * ssl_SEND_FLAG_CAP_RECORD_VERSION
+ *    Caps the record layer version number of TLS ClientHello to { 3, 1 }
+ *    (TLS 1.0). Some TLS 1.0 servers (which seem to use F5 BIG-IP) ignore 
+ *    ClientHello.client_version and use the record layer version number
+ *    (TLSPlaintext.version) instead when negotiating protocol versions. In
+ *    addition, if the record layer version number of ClientHello is { 3, 2 }
+ *    (TLS 1.1) or higher, these servers reset the TCP connections. Set this
+ *    flag to work around such servers.
  */
 PRInt32
 ssl3_SendRecord(   sslSocket *        ss,
                    DTLSEpoch          epoch, /* DTLS only */
                    SSL3ContentType    type,
                    const SSL3Opaque * pIn,   /* input buffer */
                    PRInt32            nIn,   /* bytes of input */
                    PRInt32            flags)
 {
     sslBuffer      *          wrBuf       = &ss->sec.writeBuf;
     SECStatus                 rv;
     PRInt32                   totalSent   = 0;
+    PRBool                    capsRecordVersion;
 
     SSL_TRC(3, ("%d: SSL3[%d] SendRecord type: %s nIn=%d",
                 SSL_GETPID(), ss->fd, ssl3_DecodeContentType(type),
                 nIn));
     PRINT_BUF(3, (ss, "Send record (plain text)", pIn, nIn));
 
     PORT_Assert( ss->opt.noLocks || ssl_HaveXmitBufLock(ss) );
 
+    capsRecordVersion = ((flags & ssl_SEND_FLAG_CAP_RECORD_VERSION) != 0);
+
+    if (capsRecordVersion) {
+        /* ssl_SEND_FLAG_CAP_RECORD_VERSION can only be used with
+         * TLS ClientHello. */
+        PORT_Assert(!IS_DTLS(ss));
+        PORT_Assert(type == content_handshake);
+        PORT_Assert(ss->ssl3.hs.ws == wait_server_hello);

[Ryan Sleevi, 2012/07/13 21:20:53]

Is this true for client-initiated renegotiation? I would think the hs.ws may be
different then

[wtc, 2012/07/13 22:11:39]

Yes, ss->ssl3.hs.ws is also wait_server_hello for
client-initiated renegotiation.  ssl3_SendClientHello calls
ssl3_InitState at the beginning, which sets ss->ssl3.hs.ws
to wait_server_hello. Note that ssl3_SendClientHello also
sets ss->ssl3.hs.ws to wait_server_hello before returning,
but this assertion is checked before that.  This is a little
confusing because the side effect of ssl3_InitState is not
obvious.

Do you think I should remove this assertion to avoid that
confusion?  Alternatively I can change ssl3_SendClientHello
to explicitly set ss->ssl3.hs.ws to wait_server_hello earlier.

+    }
+
     if (ss->ssl3.initialized == PR_FALSE) {
         /* This can happen on a server if the very first incoming record
         ** looks like a defective ssl3 record (e.g. too long), and we're
         ** trying to send an alert.
         */
         PR_ASSERT(type == content_alert);
         rv = ssl3_InitState(ss);
         if (rv != SECSuccess) {
             return SECFailure;  /* ssl3_InitState has set the error code. */
         }
@@ skipping 36 matching lines @@
                          SSL_GETPID(), ss->fd, spaceNeeded));
                 goto spec_locked_loser; /* sslBuffer_Grow set error code. */
             }
         }
 
         if (numRecords == 2) {
             sslBuffer secondRecord;
 
             rv = ssl3_CompressMACEncryptRecord(ss->ssl3.cwSpec,
                                                ss->sec.isServer, IS_DTLS(ss),
-                                               type, pIn, 1, wrBuf);
+                                               capsRecordVersion, type, pIn,
+                                               1, wrBuf);
             if (rv != SECSuccess)
                 goto spec_locked_loser;
 
             PRINT_BUF(50, (ss, "send (encrypted) record data [1/2]:",
                            wrBuf->buf, wrBuf->len));
 
             secondRecord.buf = wrBuf->buf + wrBuf->len;
             secondRecord.len = 0;
             secondRecord.space = wrBuf->space - wrBuf->len;
 
             rv = ssl3_CompressMACEncryptRecord(ss->ssl3.cwSpec,
                                                ss->sec.isServer, IS_DTLS(ss),
-                                               type, pIn + 1, contentLen - 1,
+                                               capsRecordVersion, type,
+                                               pIn + 1, contentLen - 1,
                                                &secondRecord);
             if (rv == SECSuccess) {
                 PRINT_BUF(50, (ss, "send (encrypted) record data [2/2]:",
                                secondRecord.buf, secondRecord.len));
                 wrBuf->len += secondRecord.len;
             }
         } else {
             if (!IS_DTLS(ss)) {
                 rv = ssl3_CompressMACEncryptRecord(ss->ssl3.cwSpec,
                                                    ss->sec.isServer,
                                                    IS_DTLS(ss),
+                                                   capsRecordVersion,
                                                    type, pIn,
                                                    contentLen, wrBuf);
             } else {
                 rv = dtls_CompressMACEncryptRecord(ss, epoch,
                                                    !!(flags & ssl_SEND_FLAG_USE_EPOCH),
                                                    type, pIn,
                                                    contentLen, wrBuf);
             }
 
             if (rv == SECSuccess) {
@@ skipping 191 matching lines @@
 
 /* Attempt to send the content of sendBuf buffer in an SSL handshake record.
  * This function returns SECSuccess or SECFailure, never SECWouldBlock.
  * Always set sendBuf.len to 0, even when returning SECFailure.
  *
  * Called from ssl3_FlushHandshake
  */
 static SECStatus
 ssl3_FlushHandshakeMessages(sslSocket *ss, PRInt32 flags)
 {
+    static const PRInt32 allowedFlags = ssl_SEND_FLAG_FORCE_INTO_BUFFER |
+                                        ssl_SEND_FLAG_CAP_RECORD_VERSION;
     PRInt32 rv = SECSuccess;
 
     PORT_Assert( ss->opt.noLocks || ssl_HaveSSL3HandshakeLock(ss));
     PORT_Assert( ss->opt.noLocks || ssl_HaveXmitBufLock(ss) );
 
     if (!ss->sec.ci.sendBuf.buf || !ss->sec.ci.sendBuf.len)
         return rv;
 
-    /* only this flag is allowed */
-    PORT_Assert(!(flags & ~ssl_SEND_FLAG_FORCE_INTO_BUFFER));
-    if ((flags & ~ssl_SEND_FLAG_FORCE_INTO_BUFFER) != 0) {
+    /* only these flags are allowed */
+    PORT_Assert(!(flags & ~allowedFlags));
+    if ((flags & ~allowedFlags) != 0) {
         PORT_SetError(SEC_ERROR_INVALID_ARGS);
         rv = SECFailure;
     } else {
         rv = ssl3_SendRecord(ss, 0, content_handshake, ss->sec.ci.sendBuf.buf,
                              ss->sec.ci.sendBuf.len, flags);
     }
     if (rv < 0) { 
         int err = PORT_GetError();
         PORT_Assert(err != PR_WOULD_BLOCK_ERROR);
         if (err == PR_WOULD_BLOCK_ERROR) {
@@ skipping 1390 matching lines @@
 ssl3_SendClientHello(sslSocket *ss, PRBool resending)
 {
     sslSessionID *   sid;
     ssl3CipherSpec * cwSpec;
     SECStatus        rv;
     int              i;
     int              length;
     int              num_suites;
     int              actual_count = 0;
     PRBool           isTLS = PR_FALSE;
+    PRBool           serverVersionKnown = PR_FALSE;
     PRInt32          total_exten_len = 0;
     unsigned         numCompressionMethods;
+    PRInt32          flags;
 
     SSL_TRC(3, ("%d: SSL3[%d]: send client_hello handshake", SSL_GETPID(),
                 ss->fd));
 
     PORT_Assert( ss->opt.noLocks || ssl_HaveSSL3HandshakeLock(ss) );
     PORT_Assert( ss->opt.noLocks || ssl_HaveXmitBufLock(ss) );
 
     rv = ssl3_InitState(ss);
     if (rv != SECSuccess) {
         return rv;              /* ssl3_InitState has set the error code. */
@@ skipping 53 matching lines @@
             }
         }
         /* If we previously did client-auth, make sure that the token that
         ** holds the private key still exists, is logged in, hasn't been
         ** removed, etc.
         */
         if (sidOK && !ssl3_ClientAuthTokenPresent(sid)) {
             sidOK = PR_FALSE;
         }
 
         if (sidOK && ssl3_NegotiateVersion(ss, sid->version,

[wtc, 2012/07/13 21:04:27]

Note that if the client is trying to resume a session, it
caps the version with sid->version.  So we will set
serverVersionKnown to true for this case below.

                                            PR_FALSE) != SECSuccess) {
             sidOK = PR_FALSE;
         }
 
         if (!sidOK) {
             SSL_AtomicIncrementLong(& ssl3stats.sch_sid_cache_not_ok );
             (*ss->sec.uncache)(sid);
             ssl_FreeSID(sid);
             sid = NULL;
         }
     }
 
     if (sid) {
+        serverVersionKnown = PR_TRUE;
         SSL_AtomicIncrementLong(& ssl3stats.sch_sid_cache_hits );
 
         /* Are we attempting a stateless session resume? */
         if (sid->version > SSL_LIBRARY_VERSION_3_0 &&
             sid->u.ssl3.sessionTicket.ticket.data)
             SSL_AtomicIncrementLong(& ssl3stats.sch_sid_stateless_resumes );
 
         PRINT_BUF(4, (ss, "client, found session-id:", sid->u.ssl3.sessionID,
                       sid->u.ssl3.sessionIDLength));
 
@@ skipping 215 matching lines @@
         maxBytes -= extLen;
         PORT_Assert(!maxBytes);
     } 
     if (ss->ssl3.hs.sendingSCSV) {
         /* Since we sent the SCSV, pretend we sent empty RI extension. */
         TLSExtensionData *xtnData = &ss->xtnData;
         xtnData->advertised[xtnData->numAdvertised++] = 
             ssl_renegotiation_info_xtn;
     }
 
-    rv = ssl3_FlushHandshake(ss, 0);
+    flags = 0;
+    if (!serverVersionKnown && !IS_DTLS(ss)) {
+        flags |= ssl_SEND_FLAG_CAP_RECORD_VERSION;
+    }
+    rv = ssl3_FlushHandshake(ss, flags);
     if (rv != SECSuccess) {
         return rv;      /* error code set by ssl3_FlushHandshake */
     }
 
     ss->ssl3.hs.ws = wait_server_hello;
     return rv;
 }
 
 
 /* Called from ssl3_HandleHandshakeMessage() when it has deciphered a complete
@@ skipping 6437 matching lines @@
             PORT_Free(ss->ssl3.hs.recvdFragments.buf);
         }
     }
 
     ss->ssl3.initialized = PR_FALSE;
 
     SECITEM_FreeItem(&ss->ssl3.nextProto, PR_FALSE);
 }
 
 /* End of ssl3con.c */