X-Git-Url: https://git.openssl.org/?p=openssl.git;a=blobdiff_plain;f=ssl%2Fstatem%2Fextensions_srvr.c;h=2363c426e047b07b7d643e7a5d695432e319cd16;hp=381e72bb86657fc5cfb22ce9f8d90488f08a8490;hb=add8d0e9e0bb80728f4b89d15573bf2e70596ceb;hpb=cf53cbea5bbf9c3a1998e2ddd0173881a5a97475 diff --git a/ssl/statem/extensions_srvr.c b/ssl/statem/extensions_srvr.c index 381e72bb86..2363c426e0 100644 --- a/ssl/statem/extensions_srvr.c +++ b/ssl/statem/extensions_srvr.c @@ -1,5 +1,5 @@ /* - * Copyright 2016 The OpenSSL Project Authors. All Rights Reserved. + * Copyright 2016-2017 The OpenSSL Project Authors. All Rights Reserved. * * Licensed under the OpenSSL license (the "License"). You may not use * this file except in compliance with the License. You can obtain a copy @@ -25,7 +25,7 @@ int tls_parse_ctos_renegotiate(SSL *s, PACKET *pkt, unsigned int context, || !PACKET_get_bytes(pkt, &data, ilen)) { SSLerr(SSL_F_TLS_PARSE_CTOS_RENEGOTIATE, SSL_R_RENEGOTIATION_ENCODING_ERR); - *al = SSL_AD_ILLEGAL_PARAMETER; + *al = SSL_AD_DECODE_ERROR; return 0; } @@ -87,10 +87,9 @@ int tls_parse_ctos_server_name(SSL *s, PACKET *pkt, unsigned int context, } /* - * Although the server_name extension was intended to be - * extensible to new name types, RFC 4366 defined the - * syntax inextensibly and OpenSSL 1.0.x parses it as - * such. + * Although the intent was for server_name to be extensible, RFC 4366 + * was not clear about it; and so OpenSSL among other implementations, + * always and only allows a 'host_name' name types. * RFC 6066 corrected the mistake but adding new name types * is nevertheless no longer feasible, so act as if no other * SNI types can exist, to simplify parsing. @@ -154,7 +153,7 @@ int tls_parse_ctos_srp(SSL *s, PACKET *pkt, unsigned int context, X509 *x, * upon resumption. Instead, we MUST ignore the login. */ if (!PACKET_strndup(&srp_I, &s->srp_ctx.login)) { - *al = TLS1_AD_INTERNAL_ERROR; + *al = SSL_AD_INTERNAL_ERROR; return 0; } @@ -178,7 +177,7 @@ int tls_parse_ctos_ec_pt_formats(SSL *s, PACKET *pkt, unsigned int context, if (!PACKET_memdup(&ec_point_format_list, &s->session->ext.ecpointformats, &s->session->ext.ecpointformats_len)) { - *al = TLS1_AD_INTERNAL_ERROR; + *al = SSL_AD_INTERNAL_ERROR; return 0; } } @@ -194,7 +193,7 @@ int tls_parse_ctos_session_ticket(SSL *s, PACKET *pkt, unsigned int context, !s->ext.session_ticket_cb(s, PACKET_data(pkt), PACKET_remaining(pkt), s->ext.session_ticket_cb_arg)) { - *al = TLS1_AD_INTERNAL_ERROR; + *al = SSL_AD_INTERNAL_ERROR; return 0; } @@ -213,7 +212,7 @@ int tls_parse_ctos_sig_algs(SSL *s, PACKET *pkt, unsigned int context, X509 *x, } if (!s->hit && !tls1_save_sigalgs(s, &supported_sig_algs)) { - *al = TLS1_AD_DECODE_ERROR; + *al = SSL_AD_DECODE_ERROR; return 0; } @@ -368,7 +367,7 @@ int tls_parse_ctos_alpn(SSL *s, PACKET *pkt, unsigned int context, X509 *x, s->s3->alpn_proposed_len = 0; if (!PACKET_memdup(&save_protocol_list, &s->s3->alpn_proposed, &s->s3->alpn_proposed_len)) { - *al = TLS1_AD_INTERNAL_ERROR; + *al = SSL_AD_INTERNAL_ERROR; return 0; } @@ -477,7 +476,8 @@ int tls_parse_ctos_psk_kex_modes(SSL *s, PACKET *pkt, unsigned int context, while (PACKET_get_1(&psk_kex_modes, &mode)) { if (mode == TLSEXT_KEX_MODE_KE_DHE) s->ext.psk_kex_mode |= TLSEXT_KEX_MODE_FLAG_KE_DHE; - else if (mode == TLSEXT_KEX_MODE_KE) + else if (mode == TLSEXT_KEX_MODE_KE + && (s->options & SSL_OP_ALLOW_NO_DHE_KEX) != 0) s->ext.psk_kex_mode |= TLSEXT_KEX_MODE_FLAG_KE; } #endif @@ -512,7 +512,7 @@ int tls_parse_ctos_key_share(SSL *s, PACKET *pkt, unsigned int context, X509 *x, } if (!PACKET_as_length_prefixed_2(pkt, &key_share_list)) { - *al = SSL_AD_HANDSHAKE_FAILURE; + *al = SSL_AD_DECODE_ERROR; SSLerr(SSL_F_TLS_PARSE_CTOS_KEY_SHARE, SSL_R_LENGTH_MISMATCH); return 0; } @@ -524,22 +524,29 @@ int tls_parse_ctos_key_share(SSL *s, PACKET *pkt, unsigned int context, X509 *x, return 0; } - /* - * Get the clients list of supported curves. - * TODO(TLS1.3): We should validate that we actually received - * supported_groups! - */ + /* Get the clients list of supported curves. */ if (!tls1_get_curvelist(s, 1, &clntcurves, &clnt_num_curves)) { *al = SSL_AD_INTERNAL_ERROR; SSLerr(SSL_F_TLS_PARSE_CTOS_KEY_SHARE, ERR_R_INTERNAL_ERROR); return 0; } + if (clnt_num_curves == 0) { + /* + * This can only happen if the supported_groups extension was not sent, + * because we verify that the length is non-zero when we process that + * extension. + */ + *al = SSL_AD_MISSING_EXTENSION; + SSLerr(SSL_F_TLS_PARSE_CTOS_KEY_SHARE, + SSL_R_MISSING_SUPPORTED_GROUPS_EXTENSION); + return 0; + } while (PACKET_remaining(&key_share_list) > 0) { if (!PACKET_get_net_2(&key_share_list, &group_id) || !PACKET_get_length_prefixed_2(&key_share_list, &encoded_pt) || PACKET_remaining(&encoded_pt) == 0) { - *al = SSL_AD_HANDSHAKE_FAILURE; + *al = SSL_AD_DECODE_ERROR; SSLerr(SSL_F_TLS_PARSE_CTOS_KEY_SHARE, SSL_R_LENGTH_MISMATCH); return 0; @@ -554,7 +561,7 @@ int tls_parse_ctos_key_share(SSL *s, PACKET *pkt, unsigned int context, X509 *x, /* Check if this share is in supported_groups sent from client */ if (!check_in_list(s, group_id, clntcurves, clnt_num_curves, 0)) { - *al = SSL_AD_HANDSHAKE_FAILURE; + *al = SSL_AD_ILLEGAL_PARAMETER; SSLerr(SSL_F_TLS_PARSE_CTOS_KEY_SHARE, SSL_R_BAD_KEY_SHARE); return 0; } @@ -607,7 +614,7 @@ int tls_parse_ctos_key_share(SSL *s, PACKET *pkt, unsigned int context, X509 *x, if (!EVP_PKEY_set1_tls_encodedpoint(s->s3->peer_tmp, PACKET_data(&encoded_pt), PACKET_remaining(&encoded_pt))) { - *al = SSL_AD_DECODE_ERROR; + *al = SSL_AD_ILLEGAL_PARAMETER; SSLerr(SSL_F_TLS_PARSE_CTOS_KEY_SHARE, SSL_R_BAD_ECPOINT); return 0; } @@ -633,14 +640,16 @@ int tls_parse_ctos_supported_groups(SSL *s, PACKET *pkt, unsigned int context, return 0; } - OPENSSL_free(s->session->ext.supportedgroups); - s->session->ext.supportedgroups = NULL; - s->session->ext.supportedgroups_len = 0; - if (!PACKET_memdup(&supported_groups_list, - &s->session->ext.supportedgroups, - &s->session->ext.supportedgroups_len)) { - *al = SSL_AD_DECODE_ERROR; - return 0; + if (!s->hit || SSL_IS_TLS13(s)) { + OPENSSL_free(s->session->ext.supportedgroups); + s->session->ext.supportedgroups = NULL; + s->session->ext.supportedgroups_len = 0; + if (!PACKET_memdup(&supported_groups_list, + &s->session->ext.supportedgroups, + &s->session->ext.supportedgroups_len)) { + *al = SSL_AD_INTERNAL_ERROR; + return 0; + } } return 1; @@ -670,6 +679,11 @@ int tls_parse_ctos_early_data(SSL *s, PACKET *pkt, unsigned int context, return 0; } + if (s->hello_retry_request) { + *al = SSL_AD_ILLEGAL_PARAMETER; + return 0; + } + return 1; } @@ -679,9 +693,8 @@ int tls_parse_ctos_psk(SSL *s, PACKET *pkt, unsigned int context, X509 *x, PACKET identities, binders, binder; size_t binderoffset, hashsize; SSL_SESSION *sess = NULL; - unsigned int id, i; + unsigned int id, i, ext = 0; const EVP_MD *md = NULL; - uint32_t ticket_age = 0, now, agesec, agems; /* * If we have no PSK kex mode that we recognise then we can't resume so @@ -699,7 +712,6 @@ int tls_parse_ctos_psk(SSL *s, PACKET *pkt, unsigned int context, X509 *x, for (id = 0; PACKET_remaining(&identities) != 0; id++) { PACKET identity; unsigned long ticket_agel; - int ret; if (!PACKET_get_length_prefixed_2(&identities, &identity) || !PACKET_get_net_4(&identities, &ticket_agel)) { @@ -707,33 +719,80 @@ int tls_parse_ctos_psk(SSL *s, PACKET *pkt, unsigned int context, X509 *x, return 0; } - ticket_age = (uint32_t)ticket_agel; - - ret = tls_decrypt_ticket(s, PACKET_data(&identity), - PACKET_remaining(&identity), NULL, 0, &sess); - if (ret == TICKET_FATAL_ERR_MALLOC || ret == TICKET_FATAL_ERR_OTHER) { + if (s->psk_find_session_cb != NULL + && !s->psk_find_session_cb(s, PACKET_data(&identity), + PACKET_remaining(&identity), + &sess)) { *al = SSL_AD_INTERNAL_ERROR; return 0; } - if (ret == TICKET_NO_DECRYPT) - continue; - md = ssl_md(sess->cipher->algorithm2); - if (md == NULL) { + if (sess != NULL) { + /* We found a PSK */ + SSL_SESSION *sesstmp = ssl_session_dup(sess, 0); + + if (sesstmp == NULL) { + *al = SSL_AD_INTERNAL_ERROR; + return 0; + } + SSL_SESSION_free(sess); + sess = sesstmp; + /* - * Don't recognise this cipher so we can't use the session. - * Ignore it + * We've just been told to use this session for this context so + * make sure the sid_ctx matches up. */ + memcpy(sess->sid_ctx, s->sid_ctx, s->sid_ctx_length); + sess->sid_ctx_length = s->sid_ctx_length; + ext = 1; + s->ext.early_data_ok = 1; + } else { + uint32_t ticket_age = 0, now, agesec, agems; + int ret = tls_decrypt_ticket(s, PACKET_data(&identity), + PACKET_remaining(&identity), NULL, 0, + &sess); + + if (ret == TICKET_FATAL_ERR_MALLOC + || ret == TICKET_FATAL_ERR_OTHER) { + *al = SSL_AD_INTERNAL_ERROR; + return 0; + } + if (ret == TICKET_NO_DECRYPT) + continue; + + ticket_age = (uint32_t)ticket_agel; + now = (uint32_t)time(NULL); + agesec = now - (uint32_t)sess->time; + agems = agesec * (uint32_t)1000; + ticket_age -= sess->ext.tick_age_add; + + /* + * For simplicity we do our age calculations in seconds. If the + * client does it in ms then it could appear that their ticket age + * is longer than ours (our ticket age calculation should always be + * slightly longer than the client's due to the network latency). + * Therefore we add 1000ms to our age calculation to adjust for + * rounding errors. + */ + if (sess->timeout >= (long)agesec + && agems / (uint32_t)1000 == agesec + && ticket_age <= agems + 1000 + && ticket_age + TICKET_AGE_ALLOWANCE >= agems + 1000) { + /* + * Ticket age is within tolerance and not expired. We allow it + * for early data + */ + s->ext.early_data_ok = 1; + } + } + + md = ssl_md(sess->cipher->algorithm2); + if (md != ssl_md(s->s3->tmp.new_cipher->algorithm2)) { + /* The ciphersuite is not compatible with this session. */ SSL_SESSION_free(sess); sess = NULL; continue; } - - /* - * TODO(TLS1.3): Somehow we need to handle the case of a ticket renewal. - * Ignored for now - */ - break; } @@ -759,7 +818,7 @@ int tls_parse_ctos_psk(SSL *s, PACKET *pkt, unsigned int context, X509 *x, || tls_psk_do_binder(s, md, (const unsigned char *)s->init_buf->data, binderoffset, PACKET_data(&binder), NULL, - sess, 0) != 1) { + sess, 0, ext) != 1) { *al = SSL_AD_DECODE_ERROR; SSLerr(SSL_F_TLS_PARSE_CTOS_PSK, ERR_R_INTERNAL_ERROR); goto err; @@ -767,31 +826,6 @@ int tls_parse_ctos_psk(SSL *s, PACKET *pkt, unsigned int context, X509 *x, sess->ext.tick_identity = id; - now = (uint32_t)time(NULL); - agesec = now - (uint32_t)sess->time; - agems = agesec * (uint32_t)1000; - ticket_age -= sess->ext.tick_age_add; - - - /* - * For simplicity we do our age calculations in seconds. If the client does - * it in ms then it could appear that their ticket age is longer than ours - * (our ticket age calculation should always be slightly longer than the - * client's due to the network latency). Therefore we add 1000ms to our age - * calculation to adjust for rounding errors. - */ - if (sess->timeout >= (long)agesec - && agems / (uint32_t)1000 == agesec - && ticket_age <= agems + 1000 - && ticket_age + TICKET_AGE_ALLOWANCE >= agems + 1000) { - /* - * Ticket age is within tolerance and not expired. We allow it for early - * data - */ - s->ext.early_data_ok = 1; - } - - SSL_SESSION_free(s->session); s->session = sess; return 1; @@ -803,12 +837,14 @@ err: /* * Add the server's renegotiation binding */ -int tls_construct_stoc_renegotiate(SSL *s, WPACKET *pkt, unsigned int context, - X509 *x, size_t chainidx, int *al) +EXT_RETURN tls_construct_stoc_renegotiate(SSL *s, WPACKET *pkt, + unsigned int context, X509 *x, + size_t chainidx, int *al) { if (!s->s3->send_connection_binding) - return 1; + return EXT_RETURN_NOT_SENT; + /* Still add this even if SSL_OP_NO_RENEGOTIATION is set */ if (!WPACKET_put_bytes_u16(pkt, TLSEXT_TYPE_renegotiate) || !WPACKET_start_sub_packet_u16(pkt) || !WPACKET_start_sub_packet_u8(pkt) @@ -819,31 +855,33 @@ int tls_construct_stoc_renegotiate(SSL *s, WPACKET *pkt, unsigned int context, || !WPACKET_close(pkt) || !WPACKET_close(pkt)) { SSLerr(SSL_F_TLS_CONSTRUCT_STOC_RENEGOTIATE, ERR_R_INTERNAL_ERROR); - return 0; + return EXT_RETURN_FAIL; } - return 1; + return EXT_RETURN_SENT; } -int tls_construct_stoc_server_name(SSL *s, WPACKET *pkt, unsigned int context, - X509 *x, size_t chainidx, int *al) +EXT_RETURN tls_construct_stoc_server_name(SSL *s, WPACKET *pkt, + unsigned int context, X509 *x, + size_t chainidx, int *al) { if (s->hit || s->servername_done != 1 || s->session->ext.hostname == NULL) - return 1; + return EXT_RETURN_NOT_SENT; if (!WPACKET_put_bytes_u16(pkt, TLSEXT_TYPE_server_name) || !WPACKET_put_bytes_u16(pkt, 0)) { SSLerr(SSL_F_TLS_CONSTRUCT_STOC_SERVER_NAME, ERR_R_INTERNAL_ERROR); - return 0; + return EXT_RETURN_FAIL; } - return 1; + return EXT_RETURN_SENT; } #ifndef OPENSSL_NO_EC -int tls_construct_stoc_ec_pt_formats(SSL *s, WPACKET *pkt, unsigned int context, - X509 *x, size_t chainidx, int *al) +EXT_RETURN tls_construct_stoc_ec_pt_formats(SSL *s, WPACKET *pkt, + unsigned int context, X509 *x, + size_t chainidx, int *al) { unsigned long alg_k = s->s3->tmp.new_cipher->algorithm_mkey; unsigned long alg_a = s->s3->tmp.new_cipher->algorithm_auth; @@ -853,7 +891,7 @@ int tls_construct_stoc_ec_pt_formats(SSL *s, WPACKET *pkt, unsigned int context, size_t plistlen; if (!using_ecc) - return 1; + return EXT_RETURN_NOT_SENT; tls1_get_formatlist(s, &plist, &plistlen); if (!WPACKET_put_bytes_u16(pkt, TLSEXT_TYPE_ec_point_formats) @@ -861,29 +899,29 @@ int tls_construct_stoc_ec_pt_formats(SSL *s, WPACKET *pkt, unsigned int context, || !WPACKET_sub_memcpy_u8(pkt, plist, plistlen) || !WPACKET_close(pkt)) { SSLerr(SSL_F_TLS_CONSTRUCT_STOC_EC_PT_FORMATS, ERR_R_INTERNAL_ERROR); - return 0; + return EXT_RETURN_FAIL; } - return 1; + return EXT_RETURN_SENT; } #endif #ifndef OPENSSL_NO_EC -int tls_construct_stoc_supported_groups(SSL *s, WPACKET *pkt, - unsigned int context, X509 *x, - size_t chainidx, int *al) +EXT_RETURN tls_construct_stoc_supported_groups(SSL *s, WPACKET *pkt, + unsigned int context, X509 *x, + size_t chainidx, int *al) { const unsigned char *groups; size_t numgroups, i, first = 1; /* s->s3->group_id is non zero if we accepted a key_share */ if (s->s3->group_id == 0) - return 1; + return EXT_RETURN_NOT_SENT; /* Get our list of supported groups */ if (!tls1_get_curvelist(s, 0, &groups, &numgroups) || numgroups == 0) { SSLerr(SSL_F_TLS_CONSTRUCT_STOC_SUPPORTED_GROUPS, ERR_R_INTERNAL_ERROR); - return 0; + return EXT_RETURN_FAIL; } /* Copy group ID if supported */ @@ -895,7 +933,7 @@ int tls_construct_stoc_supported_groups(SSL *s, WPACKET *pkt, * so we don't need to add this extension */ if (s->s3->group_id == GET_GROUP_ID(groups, 0)) - return 1; + return EXT_RETURN_NOT_SENT; /* Add extension header */ if (!WPACKET_put_bytes_u16(pkt, TLSEXT_TYPE_supported_groups) @@ -904,7 +942,7 @@ int tls_construct_stoc_supported_groups(SSL *s, WPACKET *pkt, || !WPACKET_start_sub_packet_u16(pkt)) { SSLerr(SSL_F_TLS_CONSTRUCT_STOC_SUPPORTED_GROUPS, ERR_R_INTERNAL_ERROR); - return 0; + return EXT_RETURN_FAIL; } first = 0; @@ -912,53 +950,53 @@ int tls_construct_stoc_supported_groups(SSL *s, WPACKET *pkt, if (!WPACKET_put_bytes_u16(pkt, GET_GROUP_ID(groups, 0))) { SSLerr(SSL_F_TLS_CONSTRUCT_STOC_SUPPORTED_GROUPS, ERR_R_INTERNAL_ERROR); - return 0; + return EXT_RETURN_FAIL; } } } if (!WPACKET_close(pkt) || !WPACKET_close(pkt)) { SSLerr(SSL_F_TLS_CONSTRUCT_STOC_SUPPORTED_GROUPS, ERR_R_INTERNAL_ERROR); - return 0; + return EXT_RETURN_FAIL; } - return 1; + return EXT_RETURN_SENT; } #endif -int tls_construct_stoc_session_ticket(SSL *s, WPACKET *pkt, - unsigned int context, X509 *x, - size_t chainidx, int *al) +EXT_RETURN tls_construct_stoc_session_ticket(SSL *s, WPACKET *pkt, + unsigned int context, X509 *x, + size_t chainidx, int *al) { if (!s->ext.ticket_expected || !tls_use_ticket(s)) { s->ext.ticket_expected = 0; - return 1; + return EXT_RETURN_NOT_SENT; } if (!WPACKET_put_bytes_u16(pkt, TLSEXT_TYPE_session_ticket) || !WPACKET_put_bytes_u16(pkt, 0)) { SSLerr(SSL_F_TLS_CONSTRUCT_STOC_SESSION_TICKET, ERR_R_INTERNAL_ERROR); - return 0; + return EXT_RETURN_FAIL; } - return 1; + return EXT_RETURN_SENT; } #ifndef OPENSSL_NO_OCSP -int tls_construct_stoc_status_request(SSL *s, WPACKET *pkt, - unsigned int context, X509 *x, - size_t chainidx, int *al) +EXT_RETURN tls_construct_stoc_status_request(SSL *s, WPACKET *pkt, + unsigned int context, X509 *x, + size_t chainidx, int *al) { if (!s->ext.status_expected) - return 1; + return EXT_RETURN_NOT_SENT; if (SSL_IS_TLS13(s) && chainidx != 0) - return 1; + return EXT_RETURN_NOT_SENT; if (!WPACKET_put_bytes_u16(pkt, TLSEXT_TYPE_status_request) || !WPACKET_start_sub_packet_u16(pkt)) { SSLerr(SSL_F_TLS_CONSTRUCT_STOC_STATUS_REQUEST, ERR_R_INTERNAL_ERROR); - return 0; + return EXT_RETURN_FAIL; } /* @@ -969,17 +1007,17 @@ int tls_construct_stoc_status_request(SSL *s, WPACKET *pkt, if ((SSL_IS_TLS13(s) && !tls_construct_cert_status_body(s, pkt)) || !WPACKET_close(pkt)) { SSLerr(SSL_F_TLS_CONSTRUCT_STOC_STATUS_REQUEST, ERR_R_INTERNAL_ERROR); - return 0; + return EXT_RETURN_FAIL; } - return 1; + return EXT_RETURN_SENT; } #endif #ifndef OPENSSL_NO_NEXTPROTONEG -int tls_construct_stoc_next_proto_neg(SSL *s, WPACKET *pkt, - unsigned int context, X509 *x, - size_t chainidx, int *al) +EXT_RETURN tls_construct_stoc_next_proto_neg(SSL *s, WPACKET *pkt, + unsigned int context, X509 *x, + size_t chainidx, int *al) { const unsigned char *npa; unsigned int npalen; @@ -988,7 +1026,7 @@ int tls_construct_stoc_next_proto_neg(SSL *s, WPACKET *pkt, s->s3->npn_seen = 0; if (!npn_seen || s->ctx->ext.npn_advertised_cb == NULL) - return 1; + return EXT_RETURN_NOT_SENT; ret = s->ctx->ext.npn_advertised_cb(s, &npa, &npalen, s->ctx->ext.npn_advertised_cb_arg); @@ -997,20 +1035,20 @@ int tls_construct_stoc_next_proto_neg(SSL *s, WPACKET *pkt, || !WPACKET_sub_memcpy_u16(pkt, npa, npalen)) { SSLerr(SSL_F_TLS_CONSTRUCT_STOC_NEXT_PROTO_NEG, ERR_R_INTERNAL_ERROR); - return 0; + return EXT_RETURN_FAIL; } s->s3->npn_seen = 1; } - return 1; + return EXT_RETURN_SENT; } #endif -int tls_construct_stoc_alpn(SSL *s, WPACKET *pkt, unsigned int context, X509 *x, - size_t chainidx, int *al) +EXT_RETURN tls_construct_stoc_alpn(SSL *s, WPACKET *pkt, unsigned int context, + X509 *x, size_t chainidx, int *al) { if (s->s3->alpn_selected == NULL) - return 1; + return EXT_RETURN_NOT_SENT; if (!WPACKET_put_bytes_u16(pkt, TLSEXT_TYPE_application_layer_protocol_negotiation) @@ -1021,18 +1059,19 @@ int tls_construct_stoc_alpn(SSL *s, WPACKET *pkt, unsigned int context, X509 *x, || !WPACKET_close(pkt) || !WPACKET_close(pkt)) { SSLerr(SSL_F_TLS_CONSTRUCT_STOC_ALPN, ERR_R_INTERNAL_ERROR); - return 0; + return EXT_RETURN_FAIL; } - return 1; + return EXT_RETURN_SENT; } #ifndef OPENSSL_NO_SRTP -int tls_construct_stoc_use_srtp(SSL *s, WPACKET *pkt, unsigned int context, - X509 *x, size_t chainidx, int *al) +EXT_RETURN tls_construct_stoc_use_srtp(SSL *s, WPACKET *pkt, + unsigned int context, X509 *x, + size_t chainidx, int *al) { if (s->srtp_profile == NULL) - return 1; + return EXT_RETURN_NOT_SENT; if (!WPACKET_put_bytes_u16(pkt, TLSEXT_TYPE_use_srtp) || !WPACKET_start_sub_packet_u16(pkt) @@ -1041,18 +1080,18 @@ int tls_construct_stoc_use_srtp(SSL *s, WPACKET *pkt, unsigned int context, || !WPACKET_put_bytes_u8(pkt, 0) || !WPACKET_close(pkt)) { SSLerr(SSL_F_TLS_CONSTRUCT_STOC_USE_SRTP, ERR_R_INTERNAL_ERROR); - return 0; + return EXT_RETURN_FAIL; } - return 1; + return EXT_RETURN_SENT; } #endif -int tls_construct_stoc_etm(SSL *s, WPACKET *pkt, unsigned int context, X509 *x, - size_t chainidx, int *al) +EXT_RETURN tls_construct_stoc_etm(SSL *s, WPACKET *pkt, unsigned int context, + X509 *x, size_t chainidx, int *al) { if (!s->ext.use_etm) - return 1; + return EXT_RETURN_NOT_SENT; /* * Don't use encrypt_then_mac if AEAD or RC4 might want to disable @@ -1063,35 +1102,36 @@ int tls_construct_stoc_etm(SSL *s, WPACKET *pkt, unsigned int context, X509 *x, || s->s3->tmp.new_cipher->algorithm_enc == SSL_eGOST2814789CNT || s->s3->tmp.new_cipher->algorithm_enc == SSL_eGOST2814789CNT12) { s->ext.use_etm = 0; - return 1; + return EXT_RETURN_NOT_SENT; } if (!WPACKET_put_bytes_u16(pkt, TLSEXT_TYPE_encrypt_then_mac) || !WPACKET_put_bytes_u16(pkt, 0)) { SSLerr(SSL_F_TLS_CONSTRUCT_STOC_ETM, ERR_R_INTERNAL_ERROR); - return 0; + return EXT_RETURN_FAIL; } - return 1; + return EXT_RETURN_SENT; } -int tls_construct_stoc_ems(SSL *s, WPACKET *pkt, unsigned int context, X509 *x, - size_t chainidx, int *al) +EXT_RETURN tls_construct_stoc_ems(SSL *s, WPACKET *pkt, unsigned int context, + X509 *x, size_t chainidx, int *al) { if ((s->s3->flags & TLS1_FLAGS_RECEIVED_EXTMS) == 0) - return 1; + return EXT_RETURN_NOT_SENT; if (!WPACKET_put_bytes_u16(pkt, TLSEXT_TYPE_extended_master_secret) || !WPACKET_put_bytes_u16(pkt, 0)) { SSLerr(SSL_F_TLS_CONSTRUCT_STOC_EMS, ERR_R_INTERNAL_ERROR); - return 0; + return EXT_RETURN_FAIL; } - return 1; + return EXT_RETURN_SENT; } -int tls_construct_stoc_key_share(SSL *s, WPACKET *pkt, unsigned int context, - X509 *x, size_t chainidx, int *al) +EXT_RETURN tls_construct_stoc_key_share(SSL *s, WPACKET *pkt, + unsigned int context, X509 *x, + size_t chainidx, int *al) { #ifndef OPENSSL_NO_TLS1_3 unsigned char *encodedPoint; @@ -1107,32 +1147,32 @@ int tls_construct_stoc_key_share(SSL *s, WPACKET *pkt, unsigned int context, || !WPACKET_close(pkt)) { SSLerr(SSL_F_TLS_CONSTRUCT_STOC_KEY_SHARE, ERR_R_INTERNAL_ERROR); - return 0; + return EXT_RETURN_FAIL; } - return 1; + return EXT_RETURN_SENT; } /* Must be resuming. */ if (!s->hit || !tls13_generate_handshake_secret(s, NULL, 0)) { *al = SSL_AD_INTERNAL_ERROR; SSLerr(SSL_F_TLS_CONSTRUCT_STOC_KEY_SHARE, ERR_R_INTERNAL_ERROR); - return 0; + return EXT_RETURN_FAIL; } - return 1; + return EXT_RETURN_NOT_SENT; } if (!WPACKET_put_bytes_u16(pkt, TLSEXT_TYPE_key_share) || !WPACKET_start_sub_packet_u16(pkt) || !WPACKET_put_bytes_u16(pkt, s->s3->group_id)) { SSLerr(SSL_F_TLS_CONSTRUCT_STOC_KEY_SHARE, ERR_R_INTERNAL_ERROR); - return 0; + return EXT_RETURN_FAIL; } skey = ssl_generate_pkey(ckey); if (skey == NULL) { SSLerr(SSL_F_TLS_CONSTRUCT_STOC_KEY_SHARE, ERR_R_MALLOC_FAILURE); - return 0; + return EXT_RETURN_FAIL; } /* Generate encoding of server key */ @@ -1140,7 +1180,7 @@ int tls_construct_stoc_key_share(SSL *s, WPACKET *pkt, unsigned int context, if (encoded_pt_len == 0) { SSLerr(SSL_F_TLS_CONSTRUCT_STOC_KEY_SHARE, ERR_R_EC_LIB); EVP_PKEY_free(skey); - return 0; + return EXT_RETURN_FAIL; } if (!WPACKET_sub_memcpy_u16(pkt, encodedPoint, encoded_pt_len) @@ -1148,7 +1188,7 @@ int tls_construct_stoc_key_share(SSL *s, WPACKET *pkt, unsigned int context, SSLerr(SSL_F_TLS_CONSTRUCT_STOC_KEY_SHARE, ERR_R_INTERNAL_ERROR); EVP_PKEY_free(skey); OPENSSL_free(encodedPoint); - return 0; + return EXT_RETURN_FAIL; } OPENSSL_free(encodedPoint); @@ -1156,15 +1196,16 @@ int tls_construct_stoc_key_share(SSL *s, WPACKET *pkt, unsigned int context, s->s3->tmp.pkey = skey; if (ssl_derive(s, skey, ckey, 1) == 0) { SSLerr(SSL_F_TLS_CONSTRUCT_STOC_KEY_SHARE, ERR_R_INTERNAL_ERROR); - return 0; + return EXT_RETURN_FAIL; } #endif - return 1; + return EXT_RETURN_SENT; } -int tls_construct_stoc_cryptopro_bug(SSL *s, WPACKET *pkt, unsigned int context, - X509 *x, size_t chainidx, int *al) +EXT_RETURN tls_construct_stoc_cryptopro_bug(SSL *s, WPACKET *pkt, + unsigned int context, X509 *x, + size_t chainidx, int *al) { const unsigned char cryptopro_ext[36] = { 0xfd, 0xe8, /* 65000 */ @@ -1178,60 +1219,61 @@ int tls_construct_stoc_cryptopro_bug(SSL *s, WPACKET *pkt, unsigned int context, if (((s->s3->tmp.new_cipher->id & 0xFFFF) != 0x80 && (s->s3->tmp.new_cipher->id & 0xFFFF) != 0x81) || (SSL_get_options(s) & SSL_OP_CRYPTOPRO_TLSEXT_BUG) == 0) - return 1; + return EXT_RETURN_NOT_SENT; if (!WPACKET_memcpy(pkt, cryptopro_ext, sizeof(cryptopro_ext))) { SSLerr(SSL_F_TLS_CONSTRUCT_STOC_CRYPTOPRO_BUG, ERR_R_INTERNAL_ERROR); - return 0; + return EXT_RETURN_FAIL; } - return 1; + return EXT_RETURN_SENT; } -int tls_construct_stoc_early_data(SSL *s, WPACKET *pkt, unsigned int context, - X509 *x, size_t chainidx, int *al) +EXT_RETURN tls_construct_stoc_early_data(SSL *s, WPACKET *pkt, + unsigned int context, X509 *x, + size_t chainidx, int *al) { if (context == SSL_EXT_TLS1_3_NEW_SESSION_TICKET) { if (s->max_early_data == 0) - return 1; + return EXT_RETURN_NOT_SENT; if (!WPACKET_put_bytes_u16(pkt, TLSEXT_TYPE_early_data) || !WPACKET_start_sub_packet_u16(pkt) || !WPACKET_put_bytes_u32(pkt, s->max_early_data) || !WPACKET_close(pkt)) { SSLerr(SSL_F_TLS_CONSTRUCT_STOC_EARLY_DATA, ERR_R_INTERNAL_ERROR); - return 0; + return EXT_RETURN_FAIL; } - return 1; + return EXT_RETURN_SENT; } if (s->ext.early_data != SSL_EARLY_DATA_ACCEPTED) - return 1; + return EXT_RETURN_NOT_SENT; if (!WPACKET_put_bytes_u16(pkt, TLSEXT_TYPE_early_data) || !WPACKET_start_sub_packet_u16(pkt) || !WPACKET_close(pkt)) { SSLerr(SSL_F_TLS_CONSTRUCT_STOC_EARLY_DATA, ERR_R_INTERNAL_ERROR); - return 0; + return EXT_RETURN_FAIL; } - return 1; + return EXT_RETURN_SENT; } -int tls_construct_stoc_psk(SSL *s, WPACKET *pkt, unsigned int context, X509 *x, - size_t chainidx, int *al) +EXT_RETURN tls_construct_stoc_psk(SSL *s, WPACKET *pkt, unsigned int context, + X509 *x, size_t chainidx, int *al) { if (!s->hit) - return 1; + return EXT_RETURN_NOT_SENT; if (!WPACKET_put_bytes_u16(pkt, TLSEXT_TYPE_psk) || !WPACKET_start_sub_packet_u16(pkt) || !WPACKET_put_bytes_u16(pkt, s->session->ext.tick_identity) || !WPACKET_close(pkt)) { SSLerr(SSL_F_TLS_CONSTRUCT_STOC_PSK, ERR_R_INTERNAL_ERROR); - return 0; + return EXT_RETURN_FAIL; } - return 1; + return EXT_RETURN_SENT; }