2 * Copyright 2014-2016 The OpenSSL Project Authors. All Rights Reserved.
4 * Licensed under the OpenSSL license (the "License"). You may not use
5 * this file except in compliance with the License. You can obtain a copy
6 * in the file LICENSE in the source distribution or at
7 * https://www.openssl.org/source/license.html
10 /* Custom extension utility functions */
12 #include <openssl/ct.h>
15 /* Find a custom extension from the list. */
16 static custom_ext_method *custom_ext_find(const custom_ext_methods *exts,
17 unsigned int ext_type)
20 custom_ext_method *meth = exts->meths;
21 for (i = 0; i < exts->meths_count; i++, meth++) {
22 if (ext_type == meth->ext_type)
29 * Initialise custom extensions flags to indicate neither sent nor received.
31 void custom_ext_init(custom_ext_methods *exts)
34 custom_ext_method *meth = exts->meths;
35 for (i = 0; i < exts->meths_count; i++, meth++)
39 /* Pass received custom extension data to the application for parsing. */
40 int custom_ext_parse(SSL *s, int server,
41 unsigned int ext_type,
42 const unsigned char *ext_data, size_t ext_size, int *al)
44 custom_ext_methods *exts = server ? &s->cert->srv_ext : &s->cert->cli_ext;
45 custom_ext_method *meth;
46 meth = custom_ext_find(exts, ext_type);
47 /* If not found return success */
52 * If it's ServerHello we can't have any extensions not sent in
55 if (!(meth->ext_flags & SSL_EXT_FLAG_SENT)) {
56 *al = TLS1_AD_UNSUPPORTED_EXTENSION;
60 /* If already present it's a duplicate */
61 if (meth->ext_flags & SSL_EXT_FLAG_RECEIVED) {
62 *al = TLS1_AD_DECODE_ERROR;
65 meth->ext_flags |= SSL_EXT_FLAG_RECEIVED;
66 /* If no parse function set return success */
70 return meth->parse_cb(s, ext_type, ext_data, ext_size, al, meth->parse_arg);
74 * Request custom extension data from the application and add to the return
75 * buffer. This is the old style function signature prior to PACKETW. This is
76 * here temporarily until the conversion to PACKETW is completed, i.e. it is
77 * used by code that hasn't been converted yet.
78 * TODO - REMOVE THIS FUNCTION
80 int custom_ext_add_old(SSL *s, int server,
81 unsigned char **pret, unsigned char *limit, int *al)
83 custom_ext_methods *exts = server ? &s->cert->srv_ext : &s->cert->cli_ext;
84 custom_ext_method *meth;
85 unsigned char *ret = *pret;
88 for (i = 0; i < exts->meths_count; i++) {
89 const unsigned char *out = NULL;
91 meth = exts->meths + i;
95 * For ServerHello only send extensions present in ClientHello.
97 if (!(meth->ext_flags & SSL_EXT_FLAG_RECEIVED))
99 /* If callback absent for server skip it */
105 cb_retval = meth->add_cb(s, meth->ext_type,
106 &out, &outlen, al, meth->add_arg);
108 return 0; /* error */
110 continue; /* skip this extension */
112 if (4 > limit - ret || outlen > (size_t)(limit - ret - 4))
114 s2n(meth->ext_type, ret);
117 memcpy(ret, out, outlen);
121 * We can't send duplicates: code logic should prevent this.
123 OPENSSL_assert(!(meth->ext_flags & SSL_EXT_FLAG_SENT));
125 * Indicate extension has been sent: this is both a sanity check to
126 * ensure we don't send duplicate extensions and indicates that it is
127 * not an error if the extension is present in ServerHello.
129 meth->ext_flags |= SSL_EXT_FLAG_SENT;
131 meth->free_cb(s, meth->ext_type, out, meth->add_arg);
139 * Request custom extension data from the application and add to the return
142 int custom_ext_add(SSL *s, int server, PACKETW *pkt, int *al)
144 custom_ext_methods *exts = server ? &s->cert->srv_ext : &s->cert->cli_ext;
145 custom_ext_method *meth;
148 for (i = 0; i < exts->meths_count; i++) {
149 const unsigned char *out = NULL;
153 meth = exts->meths + i;
157 * For ServerHello only send extensions present in ClientHello.
159 if (!(meth->ext_flags & SSL_EXT_FLAG_RECEIVED))
161 /* If callback absent for server skip it */
167 cb_retval = meth->add_cb(s, meth->ext_type,
168 &out, &outlen, al, meth->add_arg);
170 return 0; /* error */
172 continue; /* skip this extension */
175 if (!PACKETW_put_bytes(pkt, meth->ext_type, 2)
176 || !PACKETW_get_sub_packet_len(pkt, &spkt, 2)
177 || (outlen > 0 && !PACKETW_memcpy(&spkt, out, outlen))
178 || !PACKETW_close(&spkt)) {
179 *al = SSL_AD_INTERNAL_ERROR;
183 * We can't send duplicates: code logic should prevent this.
185 OPENSSL_assert(!(meth->ext_flags & SSL_EXT_FLAG_SENT));
187 * Indicate extension has been sent: this is both a sanity check to
188 * ensure we don't send duplicate extensions and indicates that it is
189 * not an error if the extension is present in ServerHello.
191 meth->ext_flags |= SSL_EXT_FLAG_SENT;
193 meth->free_cb(s, meth->ext_type, out, meth->add_arg);
198 /* Copy table of custom extensions */
199 int custom_exts_copy(custom_ext_methods *dst, const custom_ext_methods *src)
201 if (src->meths_count) {
203 OPENSSL_memdup(src->meths,
204 sizeof(custom_ext_method) * src->meths_count);
205 if (dst->meths == NULL)
207 dst->meths_count = src->meths_count;
212 void custom_exts_free(custom_ext_methods *exts)
214 OPENSSL_free(exts->meths);
217 /* Set callbacks for a custom extension. */
218 static int custom_ext_meth_add(custom_ext_methods *exts,
219 unsigned int ext_type,
220 custom_ext_add_cb add_cb,
221 custom_ext_free_cb free_cb,
223 custom_ext_parse_cb parse_cb, void *parse_arg)
225 custom_ext_method *meth, *tmp;
227 * Check application error: if add_cb is not set free_cb will never be
230 if (!add_cb && free_cb)
233 * Don't add if extension supported internally, but make exception
234 * for extension types that previously were not supported, but now are.
236 if (SSL_extension_supported(ext_type) &&
237 ext_type != TLSEXT_TYPE_signed_certificate_timestamp)
239 /* Extension type must fit in 16 bits */
240 if (ext_type > 0xffff)
242 /* Search for duplicate */
243 if (custom_ext_find(exts, ext_type))
245 tmp = OPENSSL_realloc(exts->meths,
246 (exts->meths_count + 1) * sizeof(custom_ext_method));
249 OPENSSL_free(exts->meths);
251 exts->meths_count = 0;
256 meth = exts->meths + exts->meths_count;
257 memset(meth, 0, sizeof(*meth));
258 meth->parse_cb = parse_cb;
259 meth->add_cb = add_cb;
260 meth->free_cb = free_cb;
261 meth->ext_type = ext_type;
262 meth->add_arg = add_arg;
263 meth->parse_arg = parse_arg;
268 /* Return true if a client custom extension exists, false otherwise */
269 int SSL_CTX_has_client_custom_ext(const SSL_CTX *ctx, unsigned int ext_type)
271 return custom_ext_find(&ctx->cert->cli_ext, ext_type) != NULL;
274 /* Application level functions to add custom extension callbacks */
275 int SSL_CTX_add_client_custom_ext(SSL_CTX *ctx, unsigned int ext_type,
276 custom_ext_add_cb add_cb,
277 custom_ext_free_cb free_cb,
279 custom_ext_parse_cb parse_cb, void *parse_arg)
281 #ifndef OPENSSL_NO_CT
283 * We don't want applications registering callbacks for SCT extensions
284 * whilst simultaneously using the built-in SCT validation features, as
285 * these two things may not play well together.
287 if (ext_type == TLSEXT_TYPE_signed_certificate_timestamp &&
288 SSL_CTX_ct_is_enabled(ctx))
291 return custom_ext_meth_add(&ctx->cert->cli_ext, ext_type, add_cb,
292 free_cb, add_arg, parse_cb, parse_arg);
295 int SSL_CTX_add_server_custom_ext(SSL_CTX *ctx, unsigned int ext_type,
296 custom_ext_add_cb add_cb,
297 custom_ext_free_cb free_cb,
299 custom_ext_parse_cb parse_cb, void *parse_arg)
301 return custom_ext_meth_add(&ctx->cert->srv_ext, ext_type,
302 add_cb, free_cb, add_arg, parse_cb, parse_arg);
305 int SSL_extension_supported(unsigned int ext_type)
308 /* Internally supported extensions. */
309 case TLSEXT_TYPE_application_layer_protocol_negotiation:
310 case TLSEXT_TYPE_ec_point_formats:
311 case TLSEXT_TYPE_elliptic_curves:
312 case TLSEXT_TYPE_heartbeat:
313 #ifndef OPENSSL_NO_NEXTPROTONEG
314 case TLSEXT_TYPE_next_proto_neg:
316 case TLSEXT_TYPE_padding:
317 case TLSEXT_TYPE_renegotiate:
318 case TLSEXT_TYPE_server_name:
319 case TLSEXT_TYPE_session_ticket:
320 case TLSEXT_TYPE_signature_algorithms:
321 case TLSEXT_TYPE_srp:
322 case TLSEXT_TYPE_status_request:
323 case TLSEXT_TYPE_signed_certificate_timestamp:
324 case TLSEXT_TYPE_use_srtp:
325 #ifdef TLSEXT_TYPE_encrypt_then_mac
326 case TLSEXT_TYPE_encrypt_then_mac: