2 * Copyright 2016-2023 The OpenSSL Project Authors. All Rights Reserved.
4 * Licensed under the Apache License 2.0 (the "License"). You may not use
5 * this file except in compliance with the License. You can obtain a copy
6 * in the file LICENSE in the source distribution or at
7 * https://www.openssl.org/source/license.html
10 #include <openssl/ocsp.h>
11 #include "../ssl_local.h"
12 #include "statem_local.h"
13 #include "internal/cryptlib.h"
15 #define COOKIE_STATE_FORMAT_VERSION 1
18 * 2 bytes for packet length, 2 bytes for format version, 2 bytes for
19 * protocol version, 2 bytes for group id, 2 bytes for cipher id, 1 byte for
20 * key_share present flag, 8 bytes for timestamp, 2 bytes for the hashlen,
21 * EVP_MAX_MD_SIZE for transcript hash, 1 byte for app cookie length, app cookie
22 * length bytes, SHA256_DIGEST_LENGTH bytes for the HMAC of the whole thing.
24 #define MAX_COOKIE_SIZE (2 + 2 + 2 + 2 + 2 + 1 + 8 + 2 + EVP_MAX_MD_SIZE + 1 \
25 + SSL_COOKIE_LENGTH + SHA256_DIGEST_LENGTH)
28 * Message header + 2 bytes for protocol version + number of random bytes +
29 * + 1 byte for legacy session id length + number of bytes in legacy session id
30 * + 2 bytes for ciphersuite + 1 byte for legacy compression
31 * + 2 bytes for extension block length + 6 bytes for key_share extension
32 * + 4 bytes for cookie extension header + the number of bytes in the cookie
34 #define MAX_HRR_SIZE (SSL3_HM_HEADER_LENGTH + 2 + SSL3_RANDOM_SIZE + 1 \
35 + SSL_MAX_SSL_SESSION_ID_LENGTH + 2 + 1 + 2 + 6 + 4 \
39 * Parse the client's renegotiation binding and abort if it's not right
41 int tls_parse_ctos_renegotiate(SSL_CONNECTION *s, PACKET *pkt,
43 X509 *x, size_t chainidx)
46 const unsigned char *data;
49 /* Parse the length byte */
50 if (!PACKET_get_1(pkt, &ilen)
51 || !PACKET_get_bytes(pkt, &data, ilen)) {
52 SSLfatal(s, SSL_AD_DECODE_ERROR, SSL_R_RENEGOTIATION_ENCODING_ERR);
56 /* Check that the extension matches */
57 if (ilen != s->s3.previous_client_finished_len) {
58 SSLfatal(s, SSL_AD_HANDSHAKE_FAILURE, SSL_R_RENEGOTIATION_MISMATCH);
62 ok = memcmp(data, s->s3.previous_client_finished,
63 s->s3.previous_client_finished_len);
64 #ifdef FUZZING_BUILD_MODE_UNSAFE_FOR_PRODUCTION
66 if ((data[0] ^ s->s3.previous_client_finished[0]) != 0xFF) {
72 SSLfatal(s, SSL_AD_HANDSHAKE_FAILURE, SSL_R_RENEGOTIATION_MISMATCH);
76 s->s3.send_connection_binding = 1;
82 * The servername extension is treated as follows:
84 * - Only the hostname type is supported with a maximum length of 255.
85 * - The servername is rejected if too long or if it contains zeros,
86 * in which case an fatal alert is generated.
87 * - The servername field is maintained together with the session cache.
88 * - When a session is resumed, the servername call back invoked in order
89 * to allow the application to position itself to the right context.
90 * - The servername is acknowledged if it is new for a session or when
91 * it is identical to a previously used for the same session.
92 * Applications can control the behaviour. They can at any time
93 * set a 'desirable' servername for a new SSL object. This can be the
94 * case for example with HTTPS when a Host: header field is received and
95 * a renegotiation is requested. In this case, a possible servername
96 * presented in the new client hello is only acknowledged if it matches
97 * the value of the Host: field.
98 * - Applications must use SSL_OP_NO_SESSION_RESUMPTION_ON_RENEGOTIATION
99 * if they provide for changing an explicit servername context for the
100 * session, i.e. when the session has been established with a servername
102 * - On session reconnect, the servername extension may be absent.
104 int tls_parse_ctos_server_name(SSL_CONNECTION *s, PACKET *pkt,
105 unsigned int context, X509 *x, size_t chainidx)
107 unsigned int servname_type;
108 PACKET sni, hostname;
110 if (!PACKET_as_length_prefixed_2(pkt, &sni)
111 /* ServerNameList must be at least 1 byte long. */
112 || PACKET_remaining(&sni) == 0) {
113 SSLfatal(s, SSL_AD_DECODE_ERROR, SSL_R_BAD_EXTENSION);
118 * Although the intent was for server_name to be extensible, RFC 4366
119 * was not clear about it; and so OpenSSL among other implementations,
120 * always and only allows a 'host_name' name types.
121 * RFC 6066 corrected the mistake but adding new name types
122 * is nevertheless no longer feasible, so act as if no other
123 * SNI types can exist, to simplify parsing.
125 * Also note that the RFC permits only one SNI value per type,
126 * i.e., we can only have a single hostname.
128 if (!PACKET_get_1(&sni, &servname_type)
129 || servname_type != TLSEXT_NAMETYPE_host_name
130 || !PACKET_as_length_prefixed_2(&sni, &hostname)) {
131 SSLfatal(s, SSL_AD_DECODE_ERROR, SSL_R_BAD_EXTENSION);
136 * In TLSv1.2 and below the SNI is associated with the session. In TLSv1.3
137 * we always use the SNI value from the handshake.
139 if (!s->hit || SSL_CONNECTION_IS_TLS13(s)) {
140 if (PACKET_remaining(&hostname) > TLSEXT_MAXLEN_host_name) {
141 SSLfatal(s, SSL_AD_UNRECOGNIZED_NAME, SSL_R_BAD_EXTENSION);
145 if (PACKET_contains_zero_byte(&hostname)) {
146 SSLfatal(s, SSL_AD_UNRECOGNIZED_NAME, SSL_R_BAD_EXTENSION);
151 * Store the requested SNI in the SSL as temporary storage.
152 * If we accept it, it will get stored in the SSL_SESSION as well.
154 OPENSSL_free(s->ext.hostname);
155 s->ext.hostname = NULL;
156 if (!PACKET_strndup(&hostname, &s->ext.hostname)) {
157 SSLfatal(s, SSL_AD_INTERNAL_ERROR, ERR_R_INTERNAL_ERROR);
161 s->servername_done = 1;
164 * In TLSv1.2 and below we should check if the SNI is consistent between
165 * the initial handshake and the resumption. In TLSv1.3 SNI is not
166 * associated with the session.
168 s->servername_done = (s->session->ext.hostname != NULL)
169 && PACKET_equal(&hostname, s->session->ext.hostname,
170 strlen(s->session->ext.hostname));
176 int tls_parse_ctos_maxfragmentlen(SSL_CONNECTION *s, PACKET *pkt,
177 unsigned int context,
178 X509 *x, size_t chainidx)
182 if (PACKET_remaining(pkt) != 1 || !PACKET_get_1(pkt, &value)) {
183 SSLfatal(s, SSL_AD_DECODE_ERROR, SSL_R_BAD_EXTENSION);
187 /* Received |value| should be a valid max-fragment-length code. */
188 if (!IS_MAX_FRAGMENT_LENGTH_EXT_VALID(value)) {
189 SSLfatal(s, SSL_AD_ILLEGAL_PARAMETER,
190 SSL_R_SSL3_EXT_INVALID_MAX_FRAGMENT_LENGTH);
195 * RFC 6066: The negotiated length applies for the duration of the session
196 * including session resumptions.
197 * We should receive the same code as in resumed session !
199 if (s->hit && s->session->ext.max_fragment_len_mode != value) {
200 SSLfatal(s, SSL_AD_ILLEGAL_PARAMETER,
201 SSL_R_SSL3_EXT_INVALID_MAX_FRAGMENT_LENGTH);
206 * Store it in session, so it'll become binding for us
207 * and we'll include it in a next Server Hello.
209 s->session->ext.max_fragment_len_mode = value;
213 #ifndef OPENSSL_NO_SRP
214 int tls_parse_ctos_srp(SSL_CONNECTION *s, PACKET *pkt, unsigned int context,
215 X509 *x, size_t chainidx)
219 if (!PACKET_as_length_prefixed_1(pkt, &srp_I)
220 || PACKET_contains_zero_byte(&srp_I)) {
221 SSLfatal(s, SSL_AD_DECODE_ERROR, SSL_R_BAD_EXTENSION);
225 if (!PACKET_strndup(&srp_I, &s->srp_ctx.login)) {
226 SSLfatal(s, SSL_AD_INTERNAL_ERROR, ERR_R_INTERNAL_ERROR);
234 int tls_parse_ctos_ec_pt_formats(SSL_CONNECTION *s, PACKET *pkt,
235 unsigned int context,
236 X509 *x, size_t chainidx)
238 PACKET ec_point_format_list;
240 if (!PACKET_as_length_prefixed_1(pkt, &ec_point_format_list)
241 || PACKET_remaining(&ec_point_format_list) == 0) {
242 SSLfatal(s, SSL_AD_DECODE_ERROR, SSL_R_BAD_EXTENSION);
247 if (!PACKET_memdup(&ec_point_format_list,
248 &s->ext.peer_ecpointformats,
249 &s->ext.peer_ecpointformats_len)) {
250 SSLfatal(s, SSL_AD_INTERNAL_ERROR, ERR_R_INTERNAL_ERROR);
258 int tls_parse_ctos_session_ticket(SSL_CONNECTION *s, PACKET *pkt,
259 unsigned int context,
260 X509 *x, size_t chainidx)
262 if (s->ext.session_ticket_cb &&
263 !s->ext.session_ticket_cb(SSL_CONNECTION_GET_SSL(s),
264 PACKET_data(pkt), PACKET_remaining(pkt),
265 s->ext.session_ticket_cb_arg)) {
266 SSLfatal(s, SSL_AD_INTERNAL_ERROR, ERR_R_INTERNAL_ERROR);
273 int tls_parse_ctos_sig_algs_cert(SSL_CONNECTION *s, PACKET *pkt,
274 ossl_unused unsigned int context,
276 ossl_unused size_t chainidx)
278 PACKET supported_sig_algs;
280 if (!PACKET_as_length_prefixed_2(pkt, &supported_sig_algs)
281 || PACKET_remaining(&supported_sig_algs) == 0) {
282 SSLfatal(s, SSL_AD_DECODE_ERROR, SSL_R_BAD_EXTENSION);
286 if (!s->hit && !tls1_save_sigalgs(s, &supported_sig_algs, 1)) {
287 SSLfatal(s, SSL_AD_DECODE_ERROR, SSL_R_BAD_EXTENSION);
294 int tls_parse_ctos_sig_algs(SSL_CONNECTION *s, PACKET *pkt,
295 unsigned int context, X509 *x, size_t chainidx)
297 PACKET supported_sig_algs;
299 if (!PACKET_as_length_prefixed_2(pkt, &supported_sig_algs)
300 || PACKET_remaining(&supported_sig_algs) == 0) {
301 SSLfatal(s, SSL_AD_DECODE_ERROR, SSL_R_BAD_EXTENSION);
305 if (!s->hit && !tls1_save_sigalgs(s, &supported_sig_algs, 0)) {
306 SSLfatal(s, SSL_AD_DECODE_ERROR, SSL_R_BAD_EXTENSION);
313 #ifndef OPENSSL_NO_OCSP
314 int tls_parse_ctos_status_request(SSL_CONNECTION *s, PACKET *pkt,
315 unsigned int context,
316 X509 *x, size_t chainidx)
318 PACKET responder_id_list, exts;
320 /* We ignore this in a resumption handshake */
324 /* Not defined if we get one of these in a client Certificate */
328 if (!PACKET_get_1(pkt, (unsigned int *)&s->ext.status_type)) {
329 SSLfatal(s, SSL_AD_DECODE_ERROR, SSL_R_BAD_EXTENSION);
333 if (s->ext.status_type != TLSEXT_STATUSTYPE_ocsp) {
335 * We don't know what to do with any other type so ignore it.
337 s->ext.status_type = TLSEXT_STATUSTYPE_nothing;
341 if (!PACKET_get_length_prefixed_2 (pkt, &responder_id_list)) {
342 SSLfatal(s, SSL_AD_DECODE_ERROR, SSL_R_BAD_EXTENSION);
347 * We remove any OCSP_RESPIDs from a previous handshake
348 * to prevent unbounded memory growth - CVE-2016-6304
350 sk_OCSP_RESPID_pop_free(s->ext.ocsp.ids, OCSP_RESPID_free);
351 if (PACKET_remaining(&responder_id_list) > 0) {
352 s->ext.ocsp.ids = sk_OCSP_RESPID_new_null();
353 if (s->ext.ocsp.ids == NULL) {
354 SSLfatal(s, SSL_AD_INTERNAL_ERROR, ERR_R_CRYPTO_LIB);
358 s->ext.ocsp.ids = NULL;
361 while (PACKET_remaining(&responder_id_list) > 0) {
364 const unsigned char *id_data;
366 if (!PACKET_get_length_prefixed_2(&responder_id_list, &responder_id)
367 || PACKET_remaining(&responder_id) == 0) {
368 SSLfatal(s, SSL_AD_DECODE_ERROR, SSL_R_BAD_EXTENSION);
372 id_data = PACKET_data(&responder_id);
373 id = d2i_OCSP_RESPID(NULL, &id_data,
374 (int)PACKET_remaining(&responder_id));
376 SSLfatal(s, SSL_AD_DECODE_ERROR, SSL_R_BAD_EXTENSION);
380 if (id_data != PACKET_end(&responder_id)) {
381 OCSP_RESPID_free(id);
382 SSLfatal(s, SSL_AD_DECODE_ERROR, SSL_R_BAD_EXTENSION);
387 if (!sk_OCSP_RESPID_push(s->ext.ocsp.ids, id)) {
388 OCSP_RESPID_free(id);
389 SSLfatal(s, SSL_AD_INTERNAL_ERROR, ERR_R_INTERNAL_ERROR);
395 /* Read in request_extensions */
396 if (!PACKET_as_length_prefixed_2(pkt, &exts)) {
397 SSLfatal(s, SSL_AD_DECODE_ERROR, SSL_R_BAD_EXTENSION);
401 if (PACKET_remaining(&exts) > 0) {
402 const unsigned char *ext_data = PACKET_data(&exts);
404 sk_X509_EXTENSION_pop_free(s->ext.ocsp.exts,
405 X509_EXTENSION_free);
407 d2i_X509_EXTENSIONS(NULL, &ext_data, (int)PACKET_remaining(&exts));
408 if (s->ext.ocsp.exts == NULL || ext_data != PACKET_end(&exts)) {
409 SSLfatal(s, SSL_AD_DECODE_ERROR, SSL_R_BAD_EXTENSION);
418 #ifndef OPENSSL_NO_NEXTPROTONEG
419 int tls_parse_ctos_npn(SSL_CONNECTION *s, PACKET *pkt, unsigned int context,
420 X509 *x, size_t chainidx)
423 * We shouldn't accept this extension on a
426 if (SSL_IS_FIRST_HANDSHAKE(s))
434 * Save the ALPN extension in a ClientHello.|pkt| holds the contents of the ALPN
435 * extension, not including type and length. Returns: 1 on success, 0 on error.
437 int tls_parse_ctos_alpn(SSL_CONNECTION *s, PACKET *pkt, unsigned int context,
438 X509 *x, size_t chainidx)
440 PACKET protocol_list, save_protocol_list, protocol;
442 if (!SSL_IS_FIRST_HANDSHAKE(s))
445 if (!PACKET_as_length_prefixed_2(pkt, &protocol_list)
446 || PACKET_remaining(&protocol_list) < 2) {
447 SSLfatal(s, SSL_AD_DECODE_ERROR, SSL_R_BAD_EXTENSION);
451 save_protocol_list = protocol_list;
453 /* Protocol names can't be empty. */
454 if (!PACKET_get_length_prefixed_1(&protocol_list, &protocol)
455 || PACKET_remaining(&protocol) == 0) {
456 SSLfatal(s, SSL_AD_DECODE_ERROR, SSL_R_BAD_EXTENSION);
459 } while (PACKET_remaining(&protocol_list) != 0);
461 OPENSSL_free(s->s3.alpn_proposed);
462 s->s3.alpn_proposed = NULL;
463 s->s3.alpn_proposed_len = 0;
464 if (!PACKET_memdup(&save_protocol_list,
465 &s->s3.alpn_proposed, &s->s3.alpn_proposed_len)) {
466 SSLfatal(s, SSL_AD_INTERNAL_ERROR, ERR_R_INTERNAL_ERROR);
473 #ifndef OPENSSL_NO_SRTP
474 int tls_parse_ctos_use_srtp(SSL_CONNECTION *s, PACKET *pkt,
475 unsigned int context, X509 *x, size_t chainidx)
477 STACK_OF(SRTP_PROTECTION_PROFILE) *srvr;
478 unsigned int ct, mki_len, id;
481 SSL *ssl = SSL_CONNECTION_GET_SSL(s);
483 /* Ignore this if we have no SRTP profiles */
484 if (SSL_get_srtp_profiles(ssl) == NULL)
487 /* Pull off the length of the cipher suite list and check it is even */
488 if (!PACKET_get_net_2(pkt, &ct) || (ct & 1) != 0
489 || !PACKET_get_sub_packet(pkt, &subpkt, ct)) {
490 SSLfatal(s, SSL_AD_DECODE_ERROR,
491 SSL_R_BAD_SRTP_PROTECTION_PROFILE_LIST);
495 srvr = SSL_get_srtp_profiles(ssl);
496 s->srtp_profile = NULL;
497 /* Search all profiles for a match initially */
498 srtp_pref = sk_SRTP_PROTECTION_PROFILE_num(srvr);
500 while (PACKET_remaining(&subpkt)) {
501 if (!PACKET_get_net_2(&subpkt, &id)) {
502 SSLfatal(s, SSL_AD_DECODE_ERROR,
503 SSL_R_BAD_SRTP_PROTECTION_PROFILE_LIST);
508 * Only look for match in profiles of higher preference than
510 * If no profiles have been have been configured then this
513 for (i = 0; i < srtp_pref; i++) {
514 SRTP_PROTECTION_PROFILE *sprof =
515 sk_SRTP_PROTECTION_PROFILE_value(srvr, i);
517 if (sprof->id == id) {
518 s->srtp_profile = sprof;
525 /* Now extract the MKI value as a sanity check, but discard it for now */
526 if (!PACKET_get_1(pkt, &mki_len)) {
527 SSLfatal(s, SSL_AD_DECODE_ERROR,
528 SSL_R_BAD_SRTP_PROTECTION_PROFILE_LIST);
532 if (!PACKET_forward(pkt, mki_len)
533 || PACKET_remaining(pkt)) {
534 SSLfatal(s, SSL_AD_DECODE_ERROR, SSL_R_BAD_SRTP_MKI_VALUE);
542 int tls_parse_ctos_etm(SSL_CONNECTION *s, PACKET *pkt, unsigned int context,
543 X509 *x, size_t chainidx)
545 if (!(s->options & SSL_OP_NO_ENCRYPT_THEN_MAC))
552 * Process a psk_kex_modes extension received in the ClientHello. |pkt| contains
553 * the raw PACKET data for the extension. Returns 1 on success or 0 on failure.
555 int tls_parse_ctos_psk_kex_modes(SSL_CONNECTION *s, PACKET *pkt,
556 unsigned int context,
557 X509 *x, size_t chainidx)
559 #ifndef OPENSSL_NO_TLS1_3
560 PACKET psk_kex_modes;
563 if (!PACKET_as_length_prefixed_1(pkt, &psk_kex_modes)
564 || PACKET_remaining(&psk_kex_modes) == 0) {
565 SSLfatal(s, SSL_AD_DECODE_ERROR, SSL_R_BAD_EXTENSION);
569 while (PACKET_get_1(&psk_kex_modes, &mode)) {
570 if (mode == TLSEXT_KEX_MODE_KE_DHE)
571 s->ext.psk_kex_mode |= TLSEXT_KEX_MODE_FLAG_KE_DHE;
572 else if (mode == TLSEXT_KEX_MODE_KE
573 && (s->options & SSL_OP_ALLOW_NO_DHE_KEX) != 0)
574 s->ext.psk_kex_mode |= TLSEXT_KEX_MODE_FLAG_KE;
577 if (((s->ext.psk_kex_mode & TLSEXT_KEX_MODE_FLAG_KE) != 0)
578 && (s->options & SSL_OP_PREFER_NO_DHE_KEX) != 0) {
581 * If NO_DHE is supported and preferred, then we only remember this
582 * mode. DHE PSK will not be used for sure, because in any case where
583 * it would be supported (i.e. if a key share is present), NO_DHE would
584 * be supported as well. As the latter is preferred it would be
585 * chosen. By removing DHE PSK here, we don't have to deal with the
586 * SSL_OP_PREFER_NO_DHE_KEX option in any other place.
588 s->ext.psk_kex_mode = TLSEXT_KEX_MODE_FLAG_KE;
597 * Process a key_share extension received in the ClientHello. |pkt| contains
598 * the raw PACKET data for the extension. Returns 1 on success or 0 on failure.
600 int tls_parse_ctos_key_share(SSL_CONNECTION *s, PACKET *pkt,
601 unsigned int context, X509 *x, size_t chainidx)
603 #ifndef OPENSSL_NO_TLS1_3
604 unsigned int group_id;
605 PACKET key_share_list, encoded_pt;
606 const uint16_t *clntgroups, *srvrgroups;
607 size_t clnt_num_groups, srvr_num_groups;
610 if (s->hit && (s->ext.psk_kex_mode & TLSEXT_KEX_MODE_FLAG_KE_DHE) == 0)
614 if (s->s3.peer_tmp != NULL) {
615 SSLfatal(s, SSL_AD_INTERNAL_ERROR, ERR_R_INTERNAL_ERROR);
619 if (!PACKET_as_length_prefixed_2(pkt, &key_share_list)) {
620 SSLfatal(s, SSL_AD_DECODE_ERROR, SSL_R_LENGTH_MISMATCH);
624 /* Get our list of supported groups */
625 tls1_get_supported_groups(s, &srvrgroups, &srvr_num_groups);
626 /* Get the clients list of supported groups. */
627 tls1_get_peer_groups(s, &clntgroups, &clnt_num_groups);
628 if (clnt_num_groups == 0) {
630 * This can only happen if the supported_groups extension was not sent,
631 * because we verify that the length is non-zero when we process that
634 SSLfatal(s, SSL_AD_MISSING_EXTENSION,
635 SSL_R_MISSING_SUPPORTED_GROUPS_EXTENSION);
639 if (s->s3.group_id != 0 && PACKET_remaining(&key_share_list) == 0) {
641 * If we set a group_id already, then we must have sent an HRR
642 * requesting a new key_share. If we haven't got one then that is an
645 SSLfatal(s, SSL_AD_ILLEGAL_PARAMETER, SSL_R_BAD_KEY_SHARE);
649 while (PACKET_remaining(&key_share_list) > 0) {
650 if (!PACKET_get_net_2(&key_share_list, &group_id)
651 || !PACKET_get_length_prefixed_2(&key_share_list, &encoded_pt)
652 || PACKET_remaining(&encoded_pt) == 0) {
653 SSLfatal(s, SSL_AD_DECODE_ERROR, SSL_R_LENGTH_MISMATCH);
658 * If we already found a suitable key_share we loop through the
659 * rest to verify the structure, but don't process them.
665 * If we sent an HRR then the key_share sent back MUST be for the group
666 * we requested, and must be the only key_share sent.
668 if (s->s3.group_id != 0
669 && (group_id != s->s3.group_id
670 || PACKET_remaining(&key_share_list) != 0)) {
671 SSLfatal(s, SSL_AD_ILLEGAL_PARAMETER, SSL_R_BAD_KEY_SHARE);
675 /* Check if this share is in supported_groups sent from client */
676 if (!check_in_list(s, group_id, clntgroups, clnt_num_groups, 0)) {
677 SSLfatal(s, SSL_AD_ILLEGAL_PARAMETER, SSL_R_BAD_KEY_SHARE);
681 /* Check if this share is for a group we can use */
682 if (!check_in_list(s, group_id, srvrgroups, srvr_num_groups, 1)
683 || !tls_group_allowed(s, group_id, SSL_SECOP_CURVE_SUPPORTED)
685 * We tolerate but ignore a group id that we don't think is
686 * suitable for TLSv1.3
688 || !tls_valid_group(s, group_id, TLS1_3_VERSION, TLS1_3_VERSION,
690 /* Share not suitable */
694 s->s3.group_id = group_id;
695 /* Cache the selected group ID in the SSL_SESSION */
696 s->session->kex_group = group_id;
698 if ((s->s3.peer_tmp = ssl_generate_param_group(s, group_id)) == NULL) {
699 SSLfatal(s, SSL_AD_INTERNAL_ERROR,
700 SSL_R_UNABLE_TO_FIND_ECDH_PARAMETERS);
704 if (tls13_set_encoded_pub_key(s->s3.peer_tmp,
705 PACKET_data(&encoded_pt),
706 PACKET_remaining(&encoded_pt)) <= 0) {
707 SSLfatal(s, SSL_AD_ILLEGAL_PARAMETER, SSL_R_BAD_ECPOINT);
718 int tls_parse_ctos_cookie(SSL_CONNECTION *s, PACKET *pkt, unsigned int context,
719 X509 *x, size_t chainidx)
721 #ifndef OPENSSL_NO_TLS1_3
722 unsigned int format, version, key_share, group_id;
725 PACKET cookie, raw, chhash, appcookie;
727 const unsigned char *data, *mdin, *ciphdata;
728 unsigned char hmac[SHA256_DIGEST_LENGTH];
729 unsigned char hrr[MAX_HRR_SIZE];
730 size_t rawlen, hmaclen, hrrlen, ciphlen;
732 SSL *ssl = SSL_CONNECTION_GET_SSL(s);
733 SSL_CTX *sctx = SSL_CONNECTION_GET_CTX(s);
735 /* Ignore any cookie if we're not set up to verify it */
736 if (sctx->verify_stateless_cookie_cb == NULL
737 || (s->s3.flags & TLS1_FLAGS_STATELESS) == 0)
740 if (!PACKET_as_length_prefixed_2(pkt, &cookie)) {
741 SSLfatal(s, SSL_AD_DECODE_ERROR, SSL_R_LENGTH_MISMATCH);
746 data = PACKET_data(&raw);
747 rawlen = PACKET_remaining(&raw);
748 if (rawlen < SHA256_DIGEST_LENGTH
749 || !PACKET_forward(&raw, rawlen - SHA256_DIGEST_LENGTH)) {
750 SSLfatal(s, SSL_AD_DECODE_ERROR, SSL_R_LENGTH_MISMATCH);
753 mdin = PACKET_data(&raw);
755 /* Verify the HMAC of the cookie */
756 hctx = EVP_MD_CTX_create();
757 pkey = EVP_PKEY_new_raw_private_key_ex(sctx->libctx, "HMAC",
759 s->session_ctx->ext.cookie_hmac_key,
760 sizeof(s->session_ctx->ext.cookie_hmac_key));
761 if (hctx == NULL || pkey == NULL) {
762 EVP_MD_CTX_free(hctx);
764 SSLfatal(s, SSL_AD_INTERNAL_ERROR, ERR_R_EVP_LIB);
768 hmaclen = SHA256_DIGEST_LENGTH;
769 if (EVP_DigestSignInit_ex(hctx, NULL, "SHA2-256", sctx->libctx,
770 sctx->propq, pkey, NULL) <= 0
771 || EVP_DigestSign(hctx, hmac, &hmaclen, data,
772 rawlen - SHA256_DIGEST_LENGTH) <= 0
773 || hmaclen != SHA256_DIGEST_LENGTH) {
774 EVP_MD_CTX_free(hctx);
776 SSLfatal(s, SSL_AD_INTERNAL_ERROR, ERR_R_INTERNAL_ERROR);
780 EVP_MD_CTX_free(hctx);
783 if (CRYPTO_memcmp(hmac, mdin, SHA256_DIGEST_LENGTH) != 0) {
784 SSLfatal(s, SSL_AD_ILLEGAL_PARAMETER, SSL_R_COOKIE_MISMATCH);
788 if (!PACKET_get_net_2(&cookie, &format)) {
789 SSLfatal(s, SSL_AD_DECODE_ERROR, SSL_R_LENGTH_MISMATCH);
792 /* Check the cookie format is something we recognise. Ignore it if not */
793 if (format != COOKIE_STATE_FORMAT_VERSION)
797 * The rest of these checks really shouldn't fail since we have verified the
801 /* Check the version number is sane */
802 if (!PACKET_get_net_2(&cookie, &version)) {
803 SSLfatal(s, SSL_AD_DECODE_ERROR, SSL_R_LENGTH_MISMATCH);
806 if (version != TLS1_3_VERSION) {
807 SSLfatal(s, SSL_AD_ILLEGAL_PARAMETER,
808 SSL_R_BAD_PROTOCOL_VERSION_NUMBER);
812 if (!PACKET_get_net_2(&cookie, &group_id)) {
813 SSLfatal(s, SSL_AD_DECODE_ERROR, SSL_R_LENGTH_MISMATCH);
817 ciphdata = PACKET_data(&cookie);
818 if (!PACKET_forward(&cookie, 2)) {
819 SSLfatal(s, SSL_AD_DECODE_ERROR, SSL_R_LENGTH_MISMATCH);
822 if (group_id != s->s3.group_id
823 || s->s3.tmp.new_cipher
824 != ssl_get_cipher_by_char(s, ciphdata, 0)) {
826 * We chose a different cipher or group id this time around to what is
827 * in the cookie. Something must have changed.
829 SSLfatal(s, SSL_AD_ILLEGAL_PARAMETER, SSL_R_BAD_CIPHER);
833 if (!PACKET_get_1(&cookie, &key_share)
834 || !PACKET_get_net_8(&cookie, &tm)
835 || !PACKET_get_length_prefixed_2(&cookie, &chhash)
836 || !PACKET_get_length_prefixed_1(&cookie, &appcookie)
837 || PACKET_remaining(&cookie) != SHA256_DIGEST_LENGTH) {
838 SSLfatal(s, SSL_AD_DECODE_ERROR, SSL_R_LENGTH_MISMATCH);
842 /* We tolerate a cookie age of up to 10 minutes (= 60 * 10 seconds) */
844 if (tm > now || (now - tm) > 600) {
845 /* Cookie is stale. Ignore it */
849 /* Verify the app cookie */
850 if (sctx->verify_stateless_cookie_cb(ssl,
851 PACKET_data(&appcookie),
852 PACKET_remaining(&appcookie)) == 0) {
853 SSLfatal(s, SSL_AD_ILLEGAL_PARAMETER, SSL_R_COOKIE_MISMATCH);
858 * Reconstruct the HRR that we would have sent in response to the original
859 * ClientHello so we can add it to the transcript hash.
860 * Note: This won't work with custom HRR extensions
862 if (!WPACKET_init_static_len(&hrrpkt, hrr, sizeof(hrr), 0)) {
863 SSLfatal(s, SSL_AD_INTERNAL_ERROR, ERR_R_INTERNAL_ERROR);
866 if (!WPACKET_put_bytes_u8(&hrrpkt, SSL3_MT_SERVER_HELLO)
867 || !WPACKET_start_sub_packet_u24(&hrrpkt)
868 || !WPACKET_put_bytes_u16(&hrrpkt, TLS1_2_VERSION)
869 || !WPACKET_memcpy(&hrrpkt, hrrrandom, SSL3_RANDOM_SIZE)
870 || !WPACKET_sub_memcpy_u8(&hrrpkt, s->tmp_session_id,
871 s->tmp_session_id_len)
872 || !ssl->method->put_cipher_by_char(s->s3.tmp.new_cipher, &hrrpkt,
874 || !WPACKET_put_bytes_u8(&hrrpkt, 0)
875 || !WPACKET_start_sub_packet_u16(&hrrpkt)) {
876 WPACKET_cleanup(&hrrpkt);
877 SSLfatal(s, SSL_AD_INTERNAL_ERROR, ERR_R_INTERNAL_ERROR);
880 if (!WPACKET_put_bytes_u16(&hrrpkt, TLSEXT_TYPE_supported_versions)
881 || !WPACKET_start_sub_packet_u16(&hrrpkt)
882 || !WPACKET_put_bytes_u16(&hrrpkt, s->version)
883 || !WPACKET_close(&hrrpkt)) {
884 WPACKET_cleanup(&hrrpkt);
885 SSLfatal(s, SSL_AD_INTERNAL_ERROR, ERR_R_INTERNAL_ERROR);
889 if (!WPACKET_put_bytes_u16(&hrrpkt, TLSEXT_TYPE_key_share)
890 || !WPACKET_start_sub_packet_u16(&hrrpkt)
891 || !WPACKET_put_bytes_u16(&hrrpkt, s->s3.group_id)
892 || !WPACKET_close(&hrrpkt)) {
893 WPACKET_cleanup(&hrrpkt);
894 SSLfatal(s, SSL_AD_INTERNAL_ERROR, ERR_R_INTERNAL_ERROR);
898 if (!WPACKET_put_bytes_u16(&hrrpkt, TLSEXT_TYPE_cookie)
899 || !WPACKET_start_sub_packet_u16(&hrrpkt)
900 || !WPACKET_sub_memcpy_u16(&hrrpkt, data, rawlen)
901 || !WPACKET_close(&hrrpkt) /* cookie extension */
902 || !WPACKET_close(&hrrpkt) /* extension block */
903 || !WPACKET_close(&hrrpkt) /* message */
904 || !WPACKET_get_total_written(&hrrpkt, &hrrlen)
905 || !WPACKET_finish(&hrrpkt)) {
906 WPACKET_cleanup(&hrrpkt);
907 SSLfatal(s, SSL_AD_INTERNAL_ERROR, ERR_R_INTERNAL_ERROR);
911 /* Reconstruct the transcript hash */
912 if (!create_synthetic_message_hash(s, PACKET_data(&chhash),
913 PACKET_remaining(&chhash), hrr,
915 /* SSLfatal() already called */
919 /* Act as if this ClientHello came after a HelloRetryRequest */
920 s->hello_retry_request = SSL_HRR_PENDING;
928 int tls_parse_ctos_supported_groups(SSL_CONNECTION *s, PACKET *pkt,
929 unsigned int context,
930 X509 *x, size_t chainidx)
932 PACKET supported_groups_list;
934 /* Each group is 2 bytes and we must have at least 1. */
935 if (!PACKET_as_length_prefixed_2(pkt, &supported_groups_list)
936 || PACKET_remaining(&supported_groups_list) == 0
937 || (PACKET_remaining(&supported_groups_list) % 2) != 0) {
938 SSLfatal(s, SSL_AD_DECODE_ERROR, SSL_R_BAD_EXTENSION);
942 if (!s->hit || SSL_CONNECTION_IS_TLS13(s)) {
943 OPENSSL_free(s->ext.peer_supportedgroups);
944 s->ext.peer_supportedgroups = NULL;
945 s->ext.peer_supportedgroups_len = 0;
946 if (!tls1_save_u16(&supported_groups_list,
947 &s->ext.peer_supportedgroups,
948 &s->ext.peer_supportedgroups_len)) {
949 SSLfatal(s, SSL_AD_INTERNAL_ERROR, ERR_R_INTERNAL_ERROR);
957 int tls_parse_ctos_ems(SSL_CONNECTION *s, PACKET *pkt, unsigned int context,
958 X509 *x, size_t chainidx)
960 /* The extension must always be empty */
961 if (PACKET_remaining(pkt) != 0) {
962 SSLfatal(s, SSL_AD_DECODE_ERROR, SSL_R_BAD_EXTENSION);
966 if (s->options & SSL_OP_NO_EXTENDED_MASTER_SECRET)
969 s->s3.flags |= TLS1_FLAGS_RECEIVED_EXTMS;
975 int tls_parse_ctos_early_data(SSL_CONNECTION *s, PACKET *pkt, unsigned int context,
976 X509 *x, size_t chainidx)
978 if (PACKET_remaining(pkt) != 0) {
979 SSLfatal(s, SSL_AD_DECODE_ERROR, SSL_R_BAD_EXTENSION);
983 if (s->hello_retry_request != SSL_HRR_NONE) {
984 SSLfatal(s, SSL_AD_ILLEGAL_PARAMETER, SSL_R_BAD_EXTENSION);
991 static SSL_TICKET_STATUS tls_get_stateful_ticket(SSL_CONNECTION *s, PACKET *tick,
994 SSL_SESSION *tmpsess = NULL;
996 s->ext.ticket_expected = 1;
998 switch (PACKET_remaining(tick)) {
1000 return SSL_TICKET_EMPTY;
1002 case SSL_MAX_SSL_SESSION_ID_LENGTH:
1006 return SSL_TICKET_NO_DECRYPT;
1009 tmpsess = lookup_sess_in_cache(s, PACKET_data(tick),
1010 SSL_MAX_SSL_SESSION_ID_LENGTH);
1012 if (tmpsess == NULL)
1013 return SSL_TICKET_NO_DECRYPT;
1016 return SSL_TICKET_SUCCESS;
1019 int tls_parse_ctos_psk(SSL_CONNECTION *s, PACKET *pkt, unsigned int context,
1020 X509 *x, size_t chainidx)
1022 PACKET identities, binders, binder;
1023 size_t binderoffset;
1025 SSL_SESSION *sess = NULL;
1026 unsigned int id, i, ext = 0;
1027 const EVP_MD *md = NULL;
1028 SSL_CTX *sctx = SSL_CONNECTION_GET_CTX(s);
1029 SSL *ssl = SSL_CONNECTION_GET_SSL(s);
1032 * If we have no PSK kex mode that we recognise then we can't resume so
1033 * ignore this extension
1035 if ((s->ext.psk_kex_mode
1036 & (TLSEXT_KEX_MODE_FLAG_KE | TLSEXT_KEX_MODE_FLAG_KE_DHE)) == 0)
1039 if (!PACKET_get_length_prefixed_2(pkt, &identities)) {
1040 SSLfatal(s, SSL_AD_DECODE_ERROR, SSL_R_BAD_EXTENSION);
1044 s->ext.ticket_expected = 0;
1045 for (id = 0; PACKET_remaining(&identities) != 0; id++) {
1047 unsigned long ticket_agel;
1050 if (!PACKET_get_length_prefixed_2(&identities, &identity)
1051 || !PACKET_get_net_4(&identities, &ticket_agel)) {
1052 SSLfatal(s, SSL_AD_DECODE_ERROR, SSL_R_BAD_EXTENSION);
1056 idlen = PACKET_remaining(&identity);
1057 if (s->psk_find_session_cb != NULL
1058 && !s->psk_find_session_cb(ssl, PACKET_data(&identity), idlen,
1060 SSLfatal(s, SSL_AD_INTERNAL_ERROR, SSL_R_BAD_EXTENSION);
1064 #ifndef OPENSSL_NO_PSK
1066 && s->psk_server_callback != NULL
1067 && idlen <= PSK_MAX_IDENTITY_LEN) {
1069 unsigned char pskdata[PSK_MAX_PSK_LEN];
1070 unsigned int pskdatalen;
1072 if (!PACKET_strndup(&identity, &pskid)) {
1073 SSLfatal(s, SSL_AD_INTERNAL_ERROR, ERR_R_INTERNAL_ERROR);
1076 pskdatalen = s->psk_server_callback(ssl, pskid, pskdata,
1078 OPENSSL_free(pskid);
1079 if (pskdatalen > PSK_MAX_PSK_LEN) {
1080 SSLfatal(s, SSL_AD_INTERNAL_ERROR, ERR_R_INTERNAL_ERROR);
1082 } else if (pskdatalen > 0) {
1083 const SSL_CIPHER *cipher;
1084 const unsigned char tls13_aes128gcmsha256_id[] = { 0x13, 0x01 };
1087 * We found a PSK using an old style callback. We don't know
1088 * the digest so we default to SHA256 as per the TLSv1.3 spec
1090 cipher = SSL_CIPHER_find(ssl, tls13_aes128gcmsha256_id);
1091 if (cipher == NULL) {
1092 OPENSSL_cleanse(pskdata, pskdatalen);
1093 SSLfatal(s, SSL_AD_INTERNAL_ERROR, ERR_R_INTERNAL_ERROR);
1097 sess = SSL_SESSION_new();
1099 || !SSL_SESSION_set1_master_key(sess, pskdata,
1101 || !SSL_SESSION_set_cipher(sess, cipher)
1102 || !SSL_SESSION_set_protocol_version(sess,
1104 OPENSSL_cleanse(pskdata, pskdatalen);
1105 SSLfatal(s, SSL_AD_INTERNAL_ERROR, ERR_R_INTERNAL_ERROR);
1108 OPENSSL_cleanse(pskdata, pskdatalen);
1111 #endif /* OPENSSL_NO_PSK */
1114 /* We found a PSK */
1115 SSL_SESSION *sesstmp = ssl_session_dup(sess, 0);
1117 if (sesstmp == NULL) {
1118 SSLfatal(s, SSL_AD_INTERNAL_ERROR, ERR_R_INTERNAL_ERROR);
1121 SSL_SESSION_free(sess);
1125 * We've just been told to use this session for this context so
1126 * make sure the sid_ctx matches up.
1128 memcpy(sess->sid_ctx, s->sid_ctx, s->sid_ctx_length);
1129 sess->sid_ctx_length = s->sid_ctx_length;
1132 s->ext.early_data_ok = 1;
1133 s->ext.ticket_expected = 1;
1135 OSSL_TIME t, age, expire;
1139 * If we are using anti-replay protection then we behave as if
1140 * SSL_OP_NO_TICKET is set - we are caching tickets anyway so there
1141 * is no point in using full stateless tickets.
1143 if ((s->options & SSL_OP_NO_TICKET) != 0
1144 || (s->max_early_data > 0
1145 && (s->options & SSL_OP_NO_ANTI_REPLAY) == 0))
1146 ret = tls_get_stateful_ticket(s, &identity, &sess);
1148 ret = tls_decrypt_ticket(s, PACKET_data(&identity),
1149 PACKET_remaining(&identity), NULL, 0,
1152 if (ret == SSL_TICKET_EMPTY) {
1153 SSLfatal(s, SSL_AD_DECODE_ERROR, SSL_R_BAD_EXTENSION);
1157 if (ret == SSL_TICKET_FATAL_ERR_MALLOC
1158 || ret == SSL_TICKET_FATAL_ERR_OTHER) {
1159 SSLfatal(s, SSL_AD_INTERNAL_ERROR, ERR_R_INTERNAL_ERROR);
1162 if (ret == SSL_TICKET_NONE || ret == SSL_TICKET_NO_DECRYPT)
1165 /* Check for replay */
1166 if (s->max_early_data > 0
1167 && (s->options & SSL_OP_NO_ANTI_REPLAY) == 0
1168 && !SSL_CTX_remove_session(s->session_ctx, sess)) {
1169 SSL_SESSION_free(sess);
1174 age = ossl_time_subtract(ossl_ms2time(ticket_agel),
1175 ossl_ms2time(sess->ext.tick_age_add));
1176 t = ossl_time_subtract(ossl_time_now(), sess->time);
1179 * Although internally we use OSS_TIME which has ns granularity,
1180 * when SSL_SESSION structures are serialised/deserialised we use
1181 * second granularity for the sess->time field. Therefore it could
1182 * appear that the client's ticket age is longer than ours (our
1183 * ticket age calculation should always be slightly longer than the
1184 * client's due to the network latency). Therefore we add 1000ms to
1185 * our age calculation to adjust for rounding errors.
1187 expire = ossl_time_add(t, ossl_ms2time(1000));
1190 && ossl_time_compare(sess->timeout, t) >= 0
1191 && ossl_time_compare(age, expire) <= 0
1192 && ossl_time_compare(ossl_time_add(age, TICKET_AGE_ALLOWANCE),
1195 * Ticket age is within tolerance and not expired. We allow it
1198 s->ext.early_data_ok = 1;
1202 md = ssl_md(sctx, sess->cipher->algorithm2);
1204 SSLfatal(s, SSL_AD_INTERNAL_ERROR, ERR_R_INTERNAL_ERROR);
1207 if (!EVP_MD_is_a(md,
1208 EVP_MD_get0_name(ssl_md(sctx,
1209 s->s3.tmp.new_cipher->algorithm2)))) {
1210 /* The ciphersuite is not compatible with this session. */
1211 SSL_SESSION_free(sess);
1213 s->ext.early_data_ok = 0;
1214 s->ext.ticket_expected = 0;
1223 binderoffset = PACKET_data(pkt) - (const unsigned char *)s->init_buf->data;
1224 hashsize = EVP_MD_get_size(md);
1228 if (!PACKET_get_length_prefixed_2(pkt, &binders)) {
1229 SSLfatal(s, SSL_AD_DECODE_ERROR, SSL_R_BAD_EXTENSION);
1233 for (i = 0; i <= id; i++) {
1234 if (!PACKET_get_length_prefixed_1(&binders, &binder)) {
1235 SSLfatal(s, SSL_AD_DECODE_ERROR, SSL_R_BAD_EXTENSION);
1240 if (PACKET_remaining(&binder) != (size_t)hashsize) {
1241 SSLfatal(s, SSL_AD_DECODE_ERROR, SSL_R_BAD_EXTENSION);
1244 if (tls_psk_do_binder(s, md, (const unsigned char *)s->init_buf->data,
1245 binderoffset, PACKET_data(&binder), NULL, sess, 0,
1247 /* SSLfatal() already called */
1251 s->ext.tick_identity = id;
1253 SSL_SESSION_free(s->session);
1257 SSL_SESSION_free(sess);
1261 int tls_parse_ctos_post_handshake_auth(SSL_CONNECTION *s, PACKET *pkt,
1262 ossl_unused unsigned int context,
1263 ossl_unused X509 *x,
1264 ossl_unused size_t chainidx)
1266 if (PACKET_remaining(pkt) != 0) {
1267 SSLfatal(s, SSL_AD_DECODE_ERROR,
1268 SSL_R_POST_HANDSHAKE_AUTH_ENCODING_ERR);
1272 s->post_handshake_auth = SSL_PHA_EXT_RECEIVED;
1278 * Add the server's renegotiation binding
1280 EXT_RETURN tls_construct_stoc_renegotiate(SSL_CONNECTION *s, WPACKET *pkt,
1281 unsigned int context, X509 *x,
1284 if (!s->s3.send_connection_binding)
1285 return EXT_RETURN_NOT_SENT;
1287 /* Still add this even if SSL_OP_NO_RENEGOTIATION is set */
1288 if (!WPACKET_put_bytes_u16(pkt, TLSEXT_TYPE_renegotiate)
1289 || !WPACKET_start_sub_packet_u16(pkt)
1290 || !WPACKET_start_sub_packet_u8(pkt)
1291 || !WPACKET_memcpy(pkt, s->s3.previous_client_finished,
1292 s->s3.previous_client_finished_len)
1293 || !WPACKET_memcpy(pkt, s->s3.previous_server_finished,
1294 s->s3.previous_server_finished_len)
1295 || !WPACKET_close(pkt)
1296 || !WPACKET_close(pkt)) {
1297 SSLfatal(s, SSL_AD_INTERNAL_ERROR, ERR_R_INTERNAL_ERROR);
1298 return EXT_RETURN_FAIL;
1301 return EXT_RETURN_SENT;
1304 EXT_RETURN tls_construct_stoc_server_name(SSL_CONNECTION *s, WPACKET *pkt,
1305 unsigned int context, X509 *x,
1308 if (s->servername_done != 1)
1309 return EXT_RETURN_NOT_SENT;
1312 * Prior to TLSv1.3 we ignore any SNI in the current handshake if resuming.
1313 * We just use the servername from the initial handshake.
1315 if (s->hit && !SSL_CONNECTION_IS_TLS13(s))
1316 return EXT_RETURN_NOT_SENT;
1318 if (!WPACKET_put_bytes_u16(pkt, TLSEXT_TYPE_server_name)
1319 || !WPACKET_put_bytes_u16(pkt, 0)) {
1320 SSLfatal(s, SSL_AD_INTERNAL_ERROR, ERR_R_INTERNAL_ERROR);
1321 return EXT_RETURN_FAIL;
1324 return EXT_RETURN_SENT;
1327 /* Add/include the server's max fragment len extension into ServerHello */
1328 EXT_RETURN tls_construct_stoc_maxfragmentlen(SSL_CONNECTION *s, WPACKET *pkt,
1329 unsigned int context, X509 *x,
1332 if (!USE_MAX_FRAGMENT_LENGTH_EXT(s->session))
1333 return EXT_RETURN_NOT_SENT;
1336 * 4 bytes for this extension type and extension length
1337 * 1 byte for the Max Fragment Length code value.
1339 if (!WPACKET_put_bytes_u16(pkt, TLSEXT_TYPE_max_fragment_length)
1340 || !WPACKET_start_sub_packet_u16(pkt)
1341 || !WPACKET_put_bytes_u8(pkt, s->session->ext.max_fragment_len_mode)
1342 || !WPACKET_close(pkt)) {
1343 SSLfatal(s, SSL_AD_INTERNAL_ERROR, ERR_R_INTERNAL_ERROR);
1344 return EXT_RETURN_FAIL;
1347 return EXT_RETURN_SENT;
1350 EXT_RETURN tls_construct_stoc_ec_pt_formats(SSL_CONNECTION *s, WPACKET *pkt,
1351 unsigned int context, X509 *x,
1354 unsigned long alg_k = s->s3.tmp.new_cipher->algorithm_mkey;
1355 unsigned long alg_a = s->s3.tmp.new_cipher->algorithm_auth;
1356 int using_ecc = ((alg_k & SSL_kECDHE) || (alg_a & SSL_aECDSA))
1357 && (s->ext.peer_ecpointformats != NULL);
1358 const unsigned char *plist;
1362 return EXT_RETURN_NOT_SENT;
1364 tls1_get_formatlist(s, &plist, &plistlen);
1365 if (!WPACKET_put_bytes_u16(pkt, TLSEXT_TYPE_ec_point_formats)
1366 || !WPACKET_start_sub_packet_u16(pkt)
1367 || !WPACKET_sub_memcpy_u8(pkt, plist, plistlen)
1368 || !WPACKET_close(pkt)) {
1369 SSLfatal(s, SSL_AD_INTERNAL_ERROR, ERR_R_INTERNAL_ERROR);
1370 return EXT_RETURN_FAIL;
1373 return EXT_RETURN_SENT;
1376 EXT_RETURN tls_construct_stoc_supported_groups(SSL_CONNECTION *s, WPACKET *pkt,
1377 unsigned int context, X509 *x,
1380 const uint16_t *groups;
1381 size_t numgroups, i, first = 1;
1384 /* s->s3.group_id is non zero if we accepted a key_share */
1385 if (s->s3.group_id == 0)
1386 return EXT_RETURN_NOT_SENT;
1388 /* Get our list of supported groups */
1389 tls1_get_supported_groups(s, &groups, &numgroups);
1390 if (numgroups == 0) {
1391 SSLfatal(s, SSL_AD_INTERNAL_ERROR, ERR_R_INTERNAL_ERROR);
1392 return EXT_RETURN_FAIL;
1395 /* Copy group ID if supported */
1396 version = SSL_version(SSL_CONNECTION_GET_SSL(s));
1397 for (i = 0; i < numgroups; i++) {
1398 uint16_t group = groups[i];
1400 if (tls_valid_group(s, group, version, version, 0, NULL)
1401 && tls_group_allowed(s, group, SSL_SECOP_CURVE_SUPPORTED)) {
1404 * Check if the client is already using our preferred group. If
1405 * so we don't need to add this extension
1407 if (s->s3.group_id == group)
1408 return EXT_RETURN_NOT_SENT;
1410 /* Add extension header */
1411 if (!WPACKET_put_bytes_u16(pkt, TLSEXT_TYPE_supported_groups)
1412 /* Sub-packet for supported_groups extension */
1413 || !WPACKET_start_sub_packet_u16(pkt)
1414 || !WPACKET_start_sub_packet_u16(pkt)) {
1415 SSLfatal(s, SSL_AD_INTERNAL_ERROR, ERR_R_INTERNAL_ERROR);
1416 return EXT_RETURN_FAIL;
1421 if (!WPACKET_put_bytes_u16(pkt, group)) {
1422 SSLfatal(s, SSL_AD_INTERNAL_ERROR, ERR_R_INTERNAL_ERROR);
1423 return EXT_RETURN_FAIL;
1428 if (!WPACKET_close(pkt) || !WPACKET_close(pkt)) {
1429 SSLfatal(s, SSL_AD_INTERNAL_ERROR, ERR_R_INTERNAL_ERROR);
1430 return EXT_RETURN_FAIL;
1433 return EXT_RETURN_SENT;
1436 EXT_RETURN tls_construct_stoc_session_ticket(SSL_CONNECTION *s, WPACKET *pkt,
1437 unsigned int context, X509 *x,
1440 if (!s->ext.ticket_expected || !tls_use_ticket(s)) {
1441 s->ext.ticket_expected = 0;
1442 return EXT_RETURN_NOT_SENT;
1445 if (!WPACKET_put_bytes_u16(pkt, TLSEXT_TYPE_session_ticket)
1446 || !WPACKET_put_bytes_u16(pkt, 0)) {
1447 SSLfatal(s, SSL_AD_INTERNAL_ERROR, ERR_R_INTERNAL_ERROR);
1448 return EXT_RETURN_FAIL;
1451 return EXT_RETURN_SENT;
1454 #ifndef OPENSSL_NO_OCSP
1455 EXT_RETURN tls_construct_stoc_status_request(SSL_CONNECTION *s, WPACKET *pkt,
1456 unsigned int context, X509 *x,
1459 /* We don't currently support this extension inside a CertificateRequest */
1460 if (context == SSL_EXT_TLS1_3_CERTIFICATE_REQUEST)
1461 return EXT_RETURN_NOT_SENT;
1463 if (!s->ext.status_expected)
1464 return EXT_RETURN_NOT_SENT;
1466 if (SSL_CONNECTION_IS_TLS13(s) && chainidx != 0)
1467 return EXT_RETURN_NOT_SENT;
1469 if (!WPACKET_put_bytes_u16(pkt, TLSEXT_TYPE_status_request)
1470 || !WPACKET_start_sub_packet_u16(pkt)) {
1471 SSLfatal(s, SSL_AD_INTERNAL_ERROR, ERR_R_INTERNAL_ERROR);
1472 return EXT_RETURN_FAIL;
1476 * In TLSv1.3 we include the certificate status itself. In <= TLSv1.2 we
1477 * send back an empty extension, with the certificate status appearing as a
1480 if (SSL_CONNECTION_IS_TLS13(s) && !tls_construct_cert_status_body(s, pkt)) {
1481 /* SSLfatal() already called */
1482 return EXT_RETURN_FAIL;
1484 if (!WPACKET_close(pkt)) {
1485 SSLfatal(s, SSL_AD_INTERNAL_ERROR, ERR_R_INTERNAL_ERROR);
1486 return EXT_RETURN_FAIL;
1489 return EXT_RETURN_SENT;
1493 #ifndef OPENSSL_NO_NEXTPROTONEG
1494 EXT_RETURN tls_construct_stoc_next_proto_neg(SSL_CONNECTION *s, WPACKET *pkt,
1495 unsigned int context, X509 *x,
1498 const unsigned char *npa;
1499 unsigned int npalen;
1501 int npn_seen = s->s3.npn_seen;
1502 SSL_CTX *sctx = SSL_CONNECTION_GET_CTX(s);
1505 if (!npn_seen || sctx->ext.npn_advertised_cb == NULL)
1506 return EXT_RETURN_NOT_SENT;
1508 ret = sctx->ext.npn_advertised_cb(SSL_CONNECTION_GET_SSL(s), &npa, &npalen,
1509 sctx->ext.npn_advertised_cb_arg);
1510 if (ret == SSL_TLSEXT_ERR_OK) {
1511 if (!WPACKET_put_bytes_u16(pkt, TLSEXT_TYPE_next_proto_neg)
1512 || !WPACKET_sub_memcpy_u16(pkt, npa, npalen)) {
1513 SSLfatal(s, SSL_AD_INTERNAL_ERROR, ERR_R_INTERNAL_ERROR);
1514 return EXT_RETURN_FAIL;
1519 return EXT_RETURN_SENT;
1523 EXT_RETURN tls_construct_stoc_alpn(SSL_CONNECTION *s, WPACKET *pkt, unsigned int context,
1524 X509 *x, size_t chainidx)
1526 if (s->s3.alpn_selected == NULL)
1527 return EXT_RETURN_NOT_SENT;
1529 if (!WPACKET_put_bytes_u16(pkt,
1530 TLSEXT_TYPE_application_layer_protocol_negotiation)
1531 || !WPACKET_start_sub_packet_u16(pkt)
1532 || !WPACKET_start_sub_packet_u16(pkt)
1533 || !WPACKET_sub_memcpy_u8(pkt, s->s3.alpn_selected,
1534 s->s3.alpn_selected_len)
1535 || !WPACKET_close(pkt)
1536 || !WPACKET_close(pkt)) {
1537 SSLfatal(s, SSL_AD_INTERNAL_ERROR, ERR_R_INTERNAL_ERROR);
1538 return EXT_RETURN_FAIL;
1541 return EXT_RETURN_SENT;
1544 #ifndef OPENSSL_NO_SRTP
1545 EXT_RETURN tls_construct_stoc_use_srtp(SSL_CONNECTION *s, WPACKET *pkt,
1546 unsigned int context, X509 *x,
1549 if (s->srtp_profile == NULL)
1550 return EXT_RETURN_NOT_SENT;
1552 if (!WPACKET_put_bytes_u16(pkt, TLSEXT_TYPE_use_srtp)
1553 || !WPACKET_start_sub_packet_u16(pkt)
1554 || !WPACKET_put_bytes_u16(pkt, 2)
1555 || !WPACKET_put_bytes_u16(pkt, s->srtp_profile->id)
1556 || !WPACKET_put_bytes_u8(pkt, 0)
1557 || !WPACKET_close(pkt)) {
1558 SSLfatal(s, SSL_AD_INTERNAL_ERROR, ERR_R_INTERNAL_ERROR);
1559 return EXT_RETURN_FAIL;
1562 return EXT_RETURN_SENT;
1566 EXT_RETURN tls_construct_stoc_etm(SSL_CONNECTION *s, WPACKET *pkt,
1567 unsigned int context,
1568 X509 *x, size_t chainidx)
1570 if (!s->ext.use_etm)
1571 return EXT_RETURN_NOT_SENT;
1574 * Don't use encrypt_then_mac if AEAD or RC4 might want to disable
1575 * for other cases too.
1577 if (s->s3.tmp.new_cipher->algorithm_mac == SSL_AEAD
1578 || s->s3.tmp.new_cipher->algorithm_enc == SSL_RC4
1579 || s->s3.tmp.new_cipher->algorithm_enc == SSL_eGOST2814789CNT
1580 || s->s3.tmp.new_cipher->algorithm_enc == SSL_eGOST2814789CNT12
1581 || s->s3.tmp.new_cipher->algorithm_enc == SSL_MAGMA
1582 || s->s3.tmp.new_cipher->algorithm_enc == SSL_KUZNYECHIK) {
1584 return EXT_RETURN_NOT_SENT;
1587 if (!WPACKET_put_bytes_u16(pkt, TLSEXT_TYPE_encrypt_then_mac)
1588 || !WPACKET_put_bytes_u16(pkt, 0)) {
1589 SSLfatal(s, SSL_AD_INTERNAL_ERROR, ERR_R_INTERNAL_ERROR);
1590 return EXT_RETURN_FAIL;
1593 return EXT_RETURN_SENT;
1596 EXT_RETURN tls_construct_stoc_ems(SSL_CONNECTION *s, WPACKET *pkt,
1597 unsigned int context,
1598 X509 *x, size_t chainidx)
1600 if ((s->s3.flags & TLS1_FLAGS_RECEIVED_EXTMS) == 0)
1601 return EXT_RETURN_NOT_SENT;
1603 if (!WPACKET_put_bytes_u16(pkt, TLSEXT_TYPE_extended_master_secret)
1604 || !WPACKET_put_bytes_u16(pkt, 0)) {
1605 SSLfatal(s, SSL_AD_INTERNAL_ERROR, ERR_R_INTERNAL_ERROR);
1606 return EXT_RETURN_FAIL;
1609 return EXT_RETURN_SENT;
1612 EXT_RETURN tls_construct_stoc_supported_versions(SSL_CONNECTION *s, WPACKET *pkt,
1613 unsigned int context, X509 *x,
1616 if (!ossl_assert(SSL_CONNECTION_IS_TLS13(s))) {
1617 SSLfatal(s, SSL_AD_INTERNAL_ERROR, ERR_R_INTERNAL_ERROR);
1618 return EXT_RETURN_FAIL;
1621 if (!WPACKET_put_bytes_u16(pkt, TLSEXT_TYPE_supported_versions)
1622 || !WPACKET_start_sub_packet_u16(pkt)
1623 || !WPACKET_put_bytes_u16(pkt, s->version)
1624 || !WPACKET_close(pkt)) {
1625 SSLfatal(s, SSL_AD_INTERNAL_ERROR, ERR_R_INTERNAL_ERROR);
1626 return EXT_RETURN_FAIL;
1629 return EXT_RETURN_SENT;
1632 EXT_RETURN tls_construct_stoc_key_share(SSL_CONNECTION *s, WPACKET *pkt,
1633 unsigned int context, X509 *x,
1636 #ifndef OPENSSL_NO_TLS1_3
1637 unsigned char *encodedPoint;
1638 size_t encoded_pt_len = 0;
1639 EVP_PKEY *ckey = s->s3.peer_tmp, *skey = NULL;
1640 const TLS_GROUP_INFO *ginf = NULL;
1642 if (s->hello_retry_request == SSL_HRR_PENDING) {
1644 /* Original key_share was acceptable so don't ask for another one */
1645 return EXT_RETURN_NOT_SENT;
1647 if (!WPACKET_put_bytes_u16(pkt, TLSEXT_TYPE_key_share)
1648 || !WPACKET_start_sub_packet_u16(pkt)
1649 || !WPACKET_put_bytes_u16(pkt, s->s3.group_id)
1650 || !WPACKET_close(pkt)) {
1651 SSLfatal(s, SSL_AD_INTERNAL_ERROR, ERR_R_INTERNAL_ERROR);
1652 return EXT_RETURN_FAIL;
1655 return EXT_RETURN_SENT;
1659 /* No key_share received from client - must be resuming */
1660 if (!s->hit || !tls13_generate_handshake_secret(s, NULL, 0)) {
1661 SSLfatal(s, SSL_AD_INTERNAL_ERROR, ERR_R_INTERNAL_ERROR);
1662 return EXT_RETURN_FAIL;
1664 return EXT_RETURN_NOT_SENT;
1667 if (s->hit && (s->ext.psk_kex_mode & TLSEXT_KEX_MODE_FLAG_KE_DHE) == 0) {
1669 * PSK ('hit') and explicitly not doing DHE. If the client sent the
1670 * DHE option, we take it by default, except if non-DHE would be
1671 * preferred by config, but this case would have been handled in
1672 * tls_parse_ctos_psk_kex_modes().
1674 return EXT_RETURN_NOT_SENT;
1677 if (!WPACKET_put_bytes_u16(pkt, TLSEXT_TYPE_key_share)
1678 || !WPACKET_start_sub_packet_u16(pkt)
1679 || !WPACKET_put_bytes_u16(pkt, s->s3.group_id)) {
1680 SSLfatal(s, SSL_AD_INTERNAL_ERROR, ERR_R_INTERNAL_ERROR);
1681 return EXT_RETURN_FAIL;
1684 if ((ginf = tls1_group_id_lookup(SSL_CONNECTION_GET_CTX(s),
1685 s->s3.group_id)) == NULL) {
1686 SSLfatal(s, SSL_AD_INTERNAL_ERROR, ERR_R_INTERNAL_ERROR);
1687 return EXT_RETURN_FAIL;
1690 if (!ginf->is_kem) {
1692 skey = ssl_generate_pkey(s, ckey);
1694 SSLfatal(s, SSL_AD_INTERNAL_ERROR, ERR_R_SSL_LIB);
1695 return EXT_RETURN_FAIL;
1698 /* Generate encoding of server key */
1699 encoded_pt_len = EVP_PKEY_get1_encoded_public_key(skey, &encodedPoint);
1700 if (encoded_pt_len == 0) {
1701 SSLfatal(s, SSL_AD_INTERNAL_ERROR, ERR_R_EC_LIB);
1702 EVP_PKEY_free(skey);
1703 return EXT_RETURN_FAIL;
1706 if (!WPACKET_sub_memcpy_u16(pkt, encodedPoint, encoded_pt_len)
1707 || !WPACKET_close(pkt)) {
1708 SSLfatal(s, SSL_AD_INTERNAL_ERROR, ERR_R_INTERNAL_ERROR);
1709 EVP_PKEY_free(skey);
1710 OPENSSL_free(encodedPoint);
1711 return EXT_RETURN_FAIL;
1713 OPENSSL_free(encodedPoint);
1716 * This causes the crypto state to be updated based on the derived keys
1718 s->s3.tmp.pkey = skey;
1719 if (ssl_derive(s, skey, ckey, 1) == 0) {
1720 /* SSLfatal() already called */
1721 return EXT_RETURN_FAIL;
1725 unsigned char *ct = NULL;
1729 * This does not update the crypto state.
1731 * The generated pms is stored in `s->s3.tmp.pms` to be later used via
1734 if (ssl_encapsulate(s, ckey, &ct, &ctlen, 0) == 0) {
1735 /* SSLfatal() already called */
1736 return EXT_RETURN_FAIL;
1740 SSLfatal(s, SSL_AD_INTERNAL_ERROR, ERR_R_INTERNAL_ERROR);
1742 return EXT_RETURN_FAIL;
1745 if (!WPACKET_sub_memcpy_u16(pkt, ct, ctlen)
1746 || !WPACKET_close(pkt)) {
1747 SSLfatal(s, SSL_AD_INTERNAL_ERROR, ERR_R_INTERNAL_ERROR);
1749 return EXT_RETURN_FAIL;
1754 * This causes the crypto state to be updated based on the generated pms
1756 if (ssl_gensecret(s, s->s3.tmp.pms, s->s3.tmp.pmslen) == 0) {
1757 /* SSLfatal() already called */
1758 return EXT_RETURN_FAIL;
1762 return EXT_RETURN_SENT;
1764 return EXT_RETURN_FAIL;
1768 EXT_RETURN tls_construct_stoc_cookie(SSL_CONNECTION *s, WPACKET *pkt,
1769 unsigned int context,
1770 X509 *x, size_t chainidx)
1772 #ifndef OPENSSL_NO_TLS1_3
1773 unsigned char *hashval1, *hashval2, *appcookie1, *appcookie2, *cookie;
1774 unsigned char *hmac, *hmac2;
1775 size_t startlen, ciphlen, totcookielen, hashlen, hmaclen, appcookielen;
1778 int ret = EXT_RETURN_FAIL;
1779 SSL_CTX *sctx = SSL_CONNECTION_GET_CTX(s);
1780 SSL *ssl = SSL_CONNECTION_GET_SSL(s);
1782 if ((s->s3.flags & TLS1_FLAGS_STATELESS) == 0)
1783 return EXT_RETURN_NOT_SENT;
1785 if (sctx->gen_stateless_cookie_cb == NULL) {
1786 SSLfatal(s, SSL_AD_INTERNAL_ERROR, SSL_R_NO_COOKIE_CALLBACK_SET);
1787 return EXT_RETURN_FAIL;
1790 if (!WPACKET_put_bytes_u16(pkt, TLSEXT_TYPE_cookie)
1791 || !WPACKET_start_sub_packet_u16(pkt)
1792 || !WPACKET_start_sub_packet_u16(pkt)
1793 || !WPACKET_get_total_written(pkt, &startlen)
1794 || !WPACKET_reserve_bytes(pkt, MAX_COOKIE_SIZE, &cookie)
1795 || !WPACKET_put_bytes_u16(pkt, COOKIE_STATE_FORMAT_VERSION)
1796 || !WPACKET_put_bytes_u16(pkt, TLS1_3_VERSION)
1797 || !WPACKET_put_bytes_u16(pkt, s->s3.group_id)
1798 || !ssl->method->put_cipher_by_char(s->s3.tmp.new_cipher, pkt,
1800 /* Is there a key_share extension present in this HRR? */
1801 || !WPACKET_put_bytes_u8(pkt, s->s3.peer_tmp == NULL)
1802 || !WPACKET_put_bytes_u64(pkt, time(NULL))
1803 || !WPACKET_start_sub_packet_u16(pkt)
1804 || !WPACKET_reserve_bytes(pkt, EVP_MAX_MD_SIZE, &hashval1)) {
1805 SSLfatal(s, SSL_AD_INTERNAL_ERROR, ERR_R_INTERNAL_ERROR);
1806 return EXT_RETURN_FAIL;
1810 * Get the hash of the initial ClientHello. ssl_handshake_hash() operates
1811 * on raw buffers, so we first reserve sufficient bytes (above) and then
1812 * subsequently allocate them (below)
1814 if (!ssl3_digest_cached_records(s, 0)
1815 || !ssl_handshake_hash(s, hashval1, EVP_MAX_MD_SIZE, &hashlen)) {
1816 /* SSLfatal() already called */
1817 return EXT_RETURN_FAIL;
1820 if (!WPACKET_allocate_bytes(pkt, hashlen, &hashval2)
1821 || !ossl_assert(hashval1 == hashval2)
1822 || !WPACKET_close(pkt)
1823 || !WPACKET_start_sub_packet_u8(pkt)
1824 || !WPACKET_reserve_bytes(pkt, SSL_COOKIE_LENGTH, &appcookie1)) {
1825 SSLfatal(s, SSL_AD_INTERNAL_ERROR, ERR_R_INTERNAL_ERROR);
1826 return EXT_RETURN_FAIL;
1829 /* Generate the application cookie */
1830 if (sctx->gen_stateless_cookie_cb(ssl, appcookie1,
1831 &appcookielen) == 0) {
1832 SSLfatal(s, SSL_AD_INTERNAL_ERROR, SSL_R_COOKIE_GEN_CALLBACK_FAILURE);
1833 return EXT_RETURN_FAIL;
1836 if (!WPACKET_allocate_bytes(pkt, appcookielen, &appcookie2)
1837 || !ossl_assert(appcookie1 == appcookie2)
1838 || !WPACKET_close(pkt)
1839 || !WPACKET_get_total_written(pkt, &totcookielen)
1840 || !WPACKET_reserve_bytes(pkt, SHA256_DIGEST_LENGTH, &hmac)) {
1841 SSLfatal(s, SSL_AD_INTERNAL_ERROR, ERR_R_INTERNAL_ERROR);
1842 return EXT_RETURN_FAIL;
1844 hmaclen = SHA256_DIGEST_LENGTH;
1846 totcookielen -= startlen;
1847 if (!ossl_assert(totcookielen <= MAX_COOKIE_SIZE - SHA256_DIGEST_LENGTH)) {
1848 SSLfatal(s, SSL_AD_INTERNAL_ERROR, ERR_R_INTERNAL_ERROR);
1849 return EXT_RETURN_FAIL;
1852 /* HMAC the cookie */
1853 hctx = EVP_MD_CTX_create();
1854 pkey = EVP_PKEY_new_raw_private_key_ex(sctx->libctx, "HMAC",
1856 s->session_ctx->ext.cookie_hmac_key,
1857 sizeof(s->session_ctx->ext.cookie_hmac_key));
1858 if (hctx == NULL || pkey == NULL) {
1859 SSLfatal(s, SSL_AD_INTERNAL_ERROR, ERR_R_EVP_LIB);
1863 if (EVP_DigestSignInit_ex(hctx, NULL, "SHA2-256", sctx->libctx,
1864 sctx->propq, pkey, NULL) <= 0
1865 || EVP_DigestSign(hctx, hmac, &hmaclen, cookie,
1866 totcookielen) <= 0) {
1867 SSLfatal(s, SSL_AD_INTERNAL_ERROR, ERR_R_INTERNAL_ERROR);
1871 if (!ossl_assert(totcookielen + hmaclen <= MAX_COOKIE_SIZE)) {
1872 SSLfatal(s, SSL_AD_INTERNAL_ERROR, ERR_R_INTERNAL_ERROR);
1876 if (!WPACKET_allocate_bytes(pkt, hmaclen, &hmac2)
1877 || !ossl_assert(hmac == hmac2)
1878 || !ossl_assert(cookie == hmac - totcookielen)
1879 || !WPACKET_close(pkt)
1880 || !WPACKET_close(pkt)) {
1881 SSLfatal(s, SSL_AD_INTERNAL_ERROR, ERR_R_INTERNAL_ERROR);
1885 ret = EXT_RETURN_SENT;
1888 EVP_MD_CTX_free(hctx);
1889 EVP_PKEY_free(pkey);
1892 return EXT_RETURN_FAIL;
1896 EXT_RETURN tls_construct_stoc_cryptopro_bug(SSL_CONNECTION *s, WPACKET *pkt,
1897 unsigned int context, X509 *x,
1900 const unsigned char cryptopro_ext[36] = {
1901 0xfd, 0xe8, /* 65000 */
1902 0x00, 0x20, /* 32 bytes length */
1903 0x30, 0x1e, 0x30, 0x08, 0x06, 0x06, 0x2a, 0x85,
1904 0x03, 0x02, 0x02, 0x09, 0x30, 0x08, 0x06, 0x06,
1905 0x2a, 0x85, 0x03, 0x02, 0x02, 0x16, 0x30, 0x08,
1906 0x06, 0x06, 0x2a, 0x85, 0x03, 0x02, 0x02, 0x17
1909 if (((s->s3.tmp.new_cipher->id & 0xFFFF) != 0x80
1910 && (s->s3.tmp.new_cipher->id & 0xFFFF) != 0x81)
1911 || (SSL_get_options(SSL_CONNECTION_GET_SSL(s))
1912 & SSL_OP_CRYPTOPRO_TLSEXT_BUG) == 0)
1913 return EXT_RETURN_NOT_SENT;
1915 if (!WPACKET_memcpy(pkt, cryptopro_ext, sizeof(cryptopro_ext))) {
1916 SSLfatal(s, SSL_AD_INTERNAL_ERROR, ERR_R_INTERNAL_ERROR);
1917 return EXT_RETURN_FAIL;
1920 return EXT_RETURN_SENT;
1923 EXT_RETURN tls_construct_stoc_early_data(SSL_CONNECTION *s, WPACKET *pkt,
1924 unsigned int context, X509 *x,
1927 if (context == SSL_EXT_TLS1_3_NEW_SESSION_TICKET) {
1928 if (s->max_early_data == 0)
1929 return EXT_RETURN_NOT_SENT;
1931 if (!WPACKET_put_bytes_u16(pkt, TLSEXT_TYPE_early_data)
1932 || !WPACKET_start_sub_packet_u16(pkt)
1933 || !WPACKET_put_bytes_u32(pkt, s->max_early_data)
1934 || !WPACKET_close(pkt)) {
1935 SSLfatal(s, SSL_AD_INTERNAL_ERROR, ERR_R_INTERNAL_ERROR);
1936 return EXT_RETURN_FAIL;
1939 return EXT_RETURN_SENT;
1942 if (s->ext.early_data != SSL_EARLY_DATA_ACCEPTED)
1943 return EXT_RETURN_NOT_SENT;
1945 if (!WPACKET_put_bytes_u16(pkt, TLSEXT_TYPE_early_data)
1946 || !WPACKET_start_sub_packet_u16(pkt)
1947 || !WPACKET_close(pkt)) {
1948 SSLfatal(s, SSL_AD_INTERNAL_ERROR, ERR_R_INTERNAL_ERROR);
1949 return EXT_RETURN_FAIL;
1952 return EXT_RETURN_SENT;
1955 EXT_RETURN tls_construct_stoc_psk(SSL_CONNECTION *s, WPACKET *pkt,
1956 unsigned int context,
1957 X509 *x, size_t chainidx)
1960 return EXT_RETURN_NOT_SENT;
1962 if (!WPACKET_put_bytes_u16(pkt, TLSEXT_TYPE_psk)
1963 || !WPACKET_start_sub_packet_u16(pkt)
1964 || !WPACKET_put_bytes_u16(pkt, s->ext.tick_identity)
1965 || !WPACKET_close(pkt)) {
1966 SSLfatal(s, SSL_AD_INTERNAL_ERROR, ERR_R_INTERNAL_ERROR);
1967 return EXT_RETURN_FAIL;
1970 return EXT_RETURN_SENT;
1973 EXT_RETURN tls_construct_stoc_client_cert_type(SSL_CONNECTION *sc, WPACKET *pkt,
1974 unsigned int context,
1975 X509 *x, size_t chainidx)
1977 if (sc->ext.client_cert_type_ctos == OSSL_CERT_TYPE_CTOS_ERROR
1978 && (send_certificate_request(sc)
1979 || sc->post_handshake_auth == SSL_PHA_EXT_RECEIVED)) {
1980 /* Did not receive an acceptable cert type - and doing client auth */
1981 SSLfatal(sc, SSL_AD_UNSUPPORTED_CERTIFICATE, SSL_R_BAD_EXTENSION);
1982 return EXT_RETURN_FAIL;
1985 if (sc->ext.client_cert_type == TLSEXT_cert_type_x509) {
1986 sc->ext.client_cert_type_ctos = OSSL_CERT_TYPE_CTOS_NONE;
1987 return EXT_RETURN_NOT_SENT;
1991 * Note: only supposed to send this if we are going to do a cert request,
1992 * but TLSv1.3 could do a PHA request if the client supports it
1994 if ((!send_certificate_request(sc) && sc->post_handshake_auth != SSL_PHA_EXT_RECEIVED)
1995 || sc->ext.client_cert_type_ctos != OSSL_CERT_TYPE_CTOS_GOOD
1996 || sc->client_cert_type == NULL) {
1997 /* if we don't send it, reset to TLSEXT_cert_type_x509 */
1998 sc->ext.client_cert_type_ctos = OSSL_CERT_TYPE_CTOS_NONE;
1999 sc->ext.client_cert_type = TLSEXT_cert_type_x509;
2000 return EXT_RETURN_NOT_SENT;
2003 if (!WPACKET_put_bytes_u16(pkt, TLSEXT_TYPE_client_cert_type)
2004 || !WPACKET_start_sub_packet_u16(pkt)
2005 || !WPACKET_put_bytes_u8(pkt, sc->ext.client_cert_type)
2006 || !WPACKET_close(pkt)) {
2007 SSLfatal(sc, SSL_AD_INTERNAL_ERROR, ERR_R_INTERNAL_ERROR);
2008 return EXT_RETURN_FAIL;
2010 return EXT_RETURN_SENT;
2013 /* One of |pref|, |other| is configured and the values are sanitized */
2014 static int reconcile_cert_type(const unsigned char *pref, size_t pref_len,
2015 const unsigned char *other, size_t other_len,
2016 uint8_t *chosen_cert_type)
2020 for (i = 0; i < pref_len; i++) {
2021 if (memchr(other, pref[i], other_len) != NULL) {
2022 *chosen_cert_type = pref[i];
2023 return OSSL_CERT_TYPE_CTOS_GOOD;
2026 return OSSL_CERT_TYPE_CTOS_ERROR;
2029 int tls_parse_ctos_client_cert_type(SSL_CONNECTION *sc, PACKET *pkt,
2030 unsigned int context,
2031 X509 *x, size_t chainidx)
2033 PACKET supported_cert_types;
2034 const unsigned char *data;
2037 /* Ignore the extension */
2038 if (sc->client_cert_type == NULL) {
2039 sc->ext.client_cert_type_ctos = OSSL_CERT_TYPE_CTOS_NONE;
2040 sc->ext.client_cert_type = TLSEXT_cert_type_x509;
2044 if (!PACKET_as_length_prefixed_1(pkt, &supported_cert_types)) {
2045 sc->ext.client_cert_type_ctos = OSSL_CERT_TYPE_CTOS_ERROR;
2046 SSLfatal(sc, SSL_AD_DECODE_ERROR, SSL_R_BAD_EXTENSION);
2049 if ((len = PACKET_remaining(&supported_cert_types)) == 0) {
2050 sc->ext.client_cert_type_ctos = OSSL_CERT_TYPE_CTOS_ERROR;
2051 SSLfatal(sc, SSL_AD_DECODE_ERROR, SSL_R_BAD_EXTENSION);
2054 if (!PACKET_get_bytes(&supported_cert_types, &data, len)) {
2055 sc->ext.client_cert_type_ctos = OSSL_CERT_TYPE_CTOS_ERROR;
2056 SSLfatal(sc, SSL_AD_DECODE_ERROR, SSL_R_BAD_EXTENSION);
2059 /* client_cert_type: client (peer) has priority */
2060 sc->ext.client_cert_type_ctos = reconcile_cert_type(data, len,
2061 sc->client_cert_type, sc->client_cert_type_len,
2062 &sc->ext.client_cert_type);
2064 /* Ignore the error until sending - so we can check cert auth*/
2068 EXT_RETURN tls_construct_stoc_server_cert_type(SSL_CONNECTION *sc, WPACKET *pkt,
2069 unsigned int context,
2070 X509 *x, size_t chainidx)
2072 if (sc->ext.server_cert_type == TLSEXT_cert_type_x509) {
2073 sc->ext.server_cert_type_ctos = OSSL_CERT_TYPE_CTOS_NONE;
2074 return EXT_RETURN_NOT_SENT;
2076 if (sc->ext.server_cert_type_ctos != OSSL_CERT_TYPE_CTOS_GOOD
2077 || sc->server_cert_type == NULL) {
2078 /* if we don't send it, reset to TLSEXT_cert_type_x509 */
2079 sc->ext.server_cert_type_ctos = OSSL_CERT_TYPE_CTOS_NONE;
2080 sc->ext.server_cert_type = TLSEXT_cert_type_x509;
2081 return EXT_RETURN_NOT_SENT;
2084 if (!WPACKET_put_bytes_u16(pkt, TLSEXT_TYPE_server_cert_type)
2085 || !WPACKET_start_sub_packet_u16(pkt)
2086 || !WPACKET_put_bytes_u8(pkt, sc->ext.server_cert_type)
2087 || !WPACKET_close(pkt)) {
2088 SSLfatal(sc, SSL_AD_INTERNAL_ERROR, ERR_R_INTERNAL_ERROR);
2089 return EXT_RETURN_FAIL;
2091 return EXT_RETURN_SENT;
2094 int tls_parse_ctos_server_cert_type(SSL_CONNECTION *sc, PACKET *pkt,
2095 unsigned int context,
2096 X509 *x, size_t chainidx)
2098 PACKET supported_cert_types;
2099 const unsigned char *data;
2102 /* Ignore the extension */
2103 if (sc->server_cert_type == NULL) {
2104 sc->ext.server_cert_type_ctos = OSSL_CERT_TYPE_CTOS_NONE;
2105 sc->ext.server_cert_type = TLSEXT_cert_type_x509;
2109 if (!PACKET_as_length_prefixed_1(pkt, &supported_cert_types)) {
2110 SSLfatal(sc, SSL_AD_DECODE_ERROR, SSL_R_BAD_EXTENSION);
2114 if ((len = PACKET_remaining(&supported_cert_types)) == 0) {
2115 SSLfatal(sc, SSL_AD_DECODE_ERROR, SSL_R_BAD_EXTENSION);
2118 if (!PACKET_get_bytes(&supported_cert_types, &data, len)) {
2119 SSLfatal(sc, SSL_AD_DECODE_ERROR, SSL_R_BAD_EXTENSION);
2122 /* server_cert_type: server (this) has priority */
2123 sc->ext.server_cert_type_ctos = reconcile_cert_type(sc->server_cert_type, sc->server_cert_type_len,
2125 &sc->ext.server_cert_type);
2126 if (sc->ext.server_cert_type_ctos == OSSL_CERT_TYPE_CTOS_GOOD)
2129 /* Did not receive an acceptable cert type */
2130 SSLfatal(sc, SSL_AD_UNSUPPORTED_CERTIFICATE, SSL_R_BAD_EXTENSION);