* https://www.openssl.org/source/license.html
*/
+#include <string.h>
#include "../ssl_locl.h"
#include "statem_locl.h"
static int init_ems(SSL *s, unsigned int context);
static int final_ems(SSL *s, unsigned int context, int sent, int *al);
static int init_psk_kex_modes(SSL *s, unsigned int context);
+#ifndef OPENSSL_NO_EC
static int final_key_share(SSL *s, unsigned int context, int sent, int *al);
+#endif
#ifndef OPENSSL_NO_SRTP
static int init_srtp(SSL *s, unsigned int context);
#endif
static int final_sig_algs(SSL *s, unsigned int context, int sent, int *al);
+static int final_early_data(SSL *s, unsigned int context, int sent, int *al);
/* Structure to define a built-in extension */
typedef struct extensions_definition_st {
#endif
{
TLSEXT_TYPE_encrypt_then_mac,
- EXT_CLIENT_HELLO | EXT_TLS1_2_SERVER_HELLO | EXT_TLS1_2_AND_BELOW_ONLY,
+ EXT_CLIENT_HELLO | EXT_TLS1_2_SERVER_HELLO | EXT_TLS1_2_AND_BELOW_ONLY | EXT_SSL3_ALLOWED,
init_etm, tls_parse_ctos_etm, tls_parse_stoc_etm,
tls_construct_stoc_etm, tls_construct_ctos_etm, NULL
},
init_psk_kex_modes, tls_parse_ctos_psk_kex_modes, NULL, NULL,
tls_construct_ctos_psk_kex_modes, NULL
},
+#ifndef OPENSSL_NO_EC
{
/*
* Must be in this list after supported_groups. We need that to have
tls_construct_stoc_key_share, tls_construct_ctos_key_share,
final_key_share
},
+#endif
+ {
+ TLSEXT_TYPE_cookie,
+ EXT_CLIENT_HELLO | EXT_TLS1_3_HELLO_RETRY_REQUEST
+ | EXT_TLS_IMPLEMENTATION_ONLY | EXT_TLS1_3_ONLY,
+ NULL, NULL, tls_parse_stoc_cookie, NULL, tls_construct_ctos_cookie,
+ NULL
+ },
{
/*
* Special unsolicited ServerHello extension only used when
EXT_TLS1_2_SERVER_HELLO | EXT_TLS1_2_AND_BELOW_ONLY,
NULL, NULL, NULL, tls_construct_stoc_cryptopro_bug, NULL, NULL
},
+ {
+ TLSEXT_TYPE_early_data,
+ EXT_CLIENT_HELLO | EXT_TLS1_3_ENCRYPTED_EXTENSIONS
+ | EXT_TLS1_3_NEW_SESSION_TICKET,
+ NULL, tls_parse_ctos_early_data, tls_parse_stoc_early_data,
+ tls_construct_stoc_early_data, tls_construct_ctos_early_data,
+ final_early_data
+ },
{
/* Must be immediately before pre_shared_key */
- /* TODO(TLS1.3): Fix me */
TLSEXT_TYPE_padding,
EXT_CLIENT_HELLO,
NULL,
* extensions that we know about. We ignore others.
*/
int tls_collect_extensions(SSL *s, PACKET *packet, unsigned int context,
- RAW_EXTENSION **res, int *al)
+ RAW_EXTENSION **res, int *al, size_t *len)
{
PACKET extensions = *packet;
size_t i = 0;
+ size_t num_exts;
custom_ext_methods *exts = NULL;
RAW_EXTENSION *raw_extensions = NULL;
const EXTENSION_DEFINITION *thisexd;
exts = &s->cert->cli_ext;
}
- raw_extensions = OPENSSL_zalloc((OSSL_NELEM(ext_defs)
- + (exts != NULL ? exts->meths_count : 0))
- * sizeof(*raw_extensions));
+ num_exts = OSSL_NELEM(ext_defs) + (exts != NULL ? exts->meths_count : 0);
+ raw_extensions = OPENSSL_zalloc(num_exts * sizeof(*raw_extensions));
if (raw_extensions == NULL) {
*al = SSL_AD_INTERNAL_ERROR;
SSLerr(SSL_F_TLS_COLLECT_EXTENSIONS, ERR_R_MALLOC_FAILURE);
}
/*
* Verify this extension is allowed. We only check duplicates for
- * extensions that we recognise.
+ * extensions that we recognise. We also have a special case for the
+ * PSK extension, which must be the last one in the ClientHello.
*/
if (!verify_extension(s, context, type, exts, raw_extensions, &thisex)
- || (thisex != NULL && thisex->present == 1)) {
+ || (thisex != NULL && thisex->present == 1)
+ || (type == TLSEXT_TYPE_psk
+ && (context & EXT_CLIENT_HELLO) != 0
+ && PACKET_remaining(&extensions) != 0)) {
SSLerr(SSL_F_TLS_COLLECT_EXTENSIONS, SSL_R_BAD_EXTENSION);
*al = SSL_AD_ILLEGAL_PARAMETER;
goto err;
}
*res = raw_extensions;
+ if (len != NULL)
+ *len = num_exts;
return 1;
err:
{
OPENSSL_free(s->s3->alpn_selected);
s->s3->alpn_selected = NULL;
+ s->s3->alpn_selected_len = 0;
if (s->server) {
- s->s3->alpn_selected_len = 0;
OPENSSL_free(s->s3->alpn_proposed);
s->s3->alpn_proposed = NULL;
s->s3->alpn_proposed_len = 0;
static int init_etm(SSL *s, unsigned int context)
{
- s->s3->flags &= ~TLS1_FLAGS_ENCRYPT_THEN_MAC;
+ s->ext.use_etm = 0;
return 1;
}
return 1;
}
-
+#ifndef OPENSSL_NO_EC
static int final_key_share(SSL *s, unsigned int context, int sent, int *al)
{
if (!SSL_IS_TLS13(s))
!= 0)) {
const unsigned char *pcurves, *pcurvestmp, *clntcurves;
size_t num_curves, clnt_num_curves, i;
- unsigned int group_id;
+ unsigned int group_id = 0;
- /* Check a shared group exists */
+ /* Check if a shared group exists */
/* Get the clients list of supported groups. */
if (!tls1_get_curvelist(s, 1, &clntcurves, &clnt_num_curves)) {
/* Find the first group we allow that is also in client's list */
for (i = 0, pcurvestmp = pcurves; i < num_curves;
i++, pcurvestmp += 2) {
- group_id = pcurvestmp[0] << 8 | pcurvestmp[1];
+ group_id = bytestogroup(pcurvestmp);
if (check_in_list(s, group_id, clntcurves, clnt_num_curves, 1))
break;
return 1;
}
+#endif
static int init_psk_kex_modes(SSL *s, unsigned int context)
{
return ret;
}
+
+static int final_early_data(SSL *s, unsigned int context, int sent, int *al)
+{
+ if (!s->server || !sent)
+ return 1;
+
+ if (s->max_early_data == 0
+ || !s->hit
+ || s->session->ext.tick_identity != 0
+ || s->early_data_state != SSL_EARLY_DATA_ACCEPTING
+ || !s->ext.early_data_ok
+ || s->hello_retry_request
+ || s->s3->alpn_selected_len != s->session->ext.alpn_selected_len
+ || (s->s3->alpn_selected_len > 0
+ && memcmp(s->s3->alpn_selected, s->session->ext.alpn_selected,
+ s->s3->alpn_selected_len) != 0)) {
+ s->ext.early_data = SSL_EARLY_DATA_REJECTED;
+ } else {
+ s->ext.early_data = SSL_EARLY_DATA_ACCEPTED;
+
+ if (!tls13_change_cipher_state(s,
+ SSL3_CC_EARLY | SSL3_CHANGE_CIPHER_SERVER_READ)) {
+ *al = SSL_AD_INTERNAL_ERROR;
+ return 0;
+ }
+ }
+
+ return 1;
+}