* https://www.openssl.org/source/license.html
*/
+#include <string.h>
#include "../ssl_locl.h"
#include "statem_locl.h"
static int init_srtp(SSL *s, unsigned int context);
#endif
static int final_sig_algs(SSL *s, unsigned int context, int sent, int *al);
+static int final_early_data(SSL *s, unsigned int context, int sent, int *al);
/* Structure to define a built-in extension */
typedef struct extensions_definition_st {
#else
INVALID_EXTENSION,
#endif
- {
- TLSEXT_TYPE_early_data_info,
- EXT_TLS1_3_NEW_SESSION_TICKET,
- NULL, NULL, tls_parse_stoc_early_data_info,
- tls_construct_stoc_early_data_info, NULL, NULL
- },
- {
- TLSEXT_TYPE_early_data,
- EXT_CLIENT_HELLO | EXT_TLS1_3_ENCRYPTED_EXTENSIONS,
- NULL, tls_parse_ctos_early_data, tls_parse_stoc_early_data,
- tls_construct_stoc_early_data, tls_construct_ctos_early_data, NULL
- },
#ifndef OPENSSL_NO_EC
{
TLSEXT_TYPE_ec_point_formats,
final_key_share
},
#endif
+ {
+ TLSEXT_TYPE_cookie,
+ EXT_CLIENT_HELLO | EXT_TLS1_3_HELLO_RETRY_REQUEST
+ | EXT_TLS_IMPLEMENTATION_ONLY | EXT_TLS1_3_ONLY,
+ NULL, NULL, tls_parse_stoc_cookie, NULL, tls_construct_ctos_cookie,
+ NULL
+ },
{
/*
* Special unsolicited ServerHello extension only used when
EXT_TLS1_2_SERVER_HELLO | EXT_TLS1_2_AND_BELOW_ONLY,
NULL, NULL, NULL, tls_construct_stoc_cryptopro_bug, NULL, NULL
},
+ {
+ TLSEXT_TYPE_early_data,
+ EXT_CLIENT_HELLO | EXT_TLS1_3_ENCRYPTED_EXTENSIONS
+ | EXT_TLS1_3_NEW_SESSION_TICKET,
+ NULL, tls_parse_ctos_early_data, tls_parse_stoc_early_data,
+ tls_construct_stoc_early_data, tls_construct_ctos_early_data,
+ final_early_data
+ },
{
/* Must be immediately before pre_shared_key */
- /* TODO(TLS1.3): Fix me */
TLSEXT_TYPE_padding,
EXT_CLIENT_HELLO,
NULL,
}
/*
* Verify this extension is allowed. We only check duplicates for
- * extensions that we recognise.
+ * extensions that we recognise. We also have a special case for the
+ * PSK extension, which must be the last one in the ClientHello.
*/
if (!verify_extension(s, context, type, exts, raw_extensions, &thisex)
- || (thisex != NULL && thisex->present == 1)) {
+ || (thisex != NULL && thisex->present == 1)
+ || (type == TLSEXT_TYPE_psk
+ && (context & EXT_CLIENT_HELLO) != 0
+ && PACKET_remaining(&extensions) != 0)) {
SSLerr(SSL_F_TLS_COLLECT_EXTENSIONS, SSL_R_BAD_EXTENSION);
*al = SSL_AD_ILLEGAL_PARAMETER;
goto err;
{
OPENSSL_free(s->s3->alpn_selected);
s->s3->alpn_selected = NULL;
+ s->s3->alpn_selected_len = 0;
if (s->server) {
- s->s3->alpn_selected_len = 0;
OPENSSL_free(s->s3->alpn_proposed);
s->s3->alpn_proposed = NULL;
s->s3->alpn_proposed_len = 0;
return ret;
}
+
+static int final_early_data(SSL *s, unsigned int context, int sent, int *al)
+{
+ if (!s->server || !sent)
+ return 1;
+
+ if (s->max_early_data == 0
+ || !s->hit
+ || s->session->ext.tick_identity != 0
+ || s->early_data_state != SSL_EARLY_DATA_ACCEPTING
+ || !s->ext.early_data_ok
+ || s->hello_retry_request
+ || s->s3->alpn_selected_len != s->session->ext.alpn_selected_len
+ || (s->s3->alpn_selected_len > 0
+ && memcmp(s->s3->alpn_selected, s->session->ext.alpn_selected,
+ s->s3->alpn_selected_len) != 0)) {
+ s->ext.early_data = SSL_EARLY_DATA_REJECTED;
+ } else {
+ s->ext.early_data = SSL_EARLY_DATA_ACCEPTED;
+
+ if (!tls13_change_cipher_state(s,
+ SSL3_CC_EARLY | SSL3_CHANGE_CIPHER_SERVER_READ)) {
+ *al = SSL_AD_INTERNAL_ERROR;
+ return 0;
+ }
+ }
+
+ return 1;
+}