2 * Copyright 2016-2023 The OpenSSL Project Authors. All Rights Reserved.
4 * Licensed under the Apache License 2.0 (the "License"). You may not use
5 * this file except in compliance with the License. You can obtain a copy
6 * in the file LICENSE in the source distribution or at
7 * https://www.openssl.org/source/license.html
10 #if defined(__TANDEM) && defined(_SPT_MODEL_)
11 # include <spthread.h>
12 # include <spt_extensions.h> /* timeval */
16 #include "internal/nelem.h"
17 #include "internal/cryptlib.h"
18 #include "../ssl_local.h"
19 #include "statem_local.h"
21 static int final_renegotiate(SSL_CONNECTION *s, unsigned int context, int sent);
22 static int init_server_name(SSL_CONNECTION *s, unsigned int context);
23 static int final_server_name(SSL_CONNECTION *s, unsigned int context, int sent);
24 static int final_ec_pt_formats(SSL_CONNECTION *s, unsigned int context,
26 static int init_session_ticket(SSL_CONNECTION *s, unsigned int context);
27 #ifndef OPENSSL_NO_OCSP
28 static int init_status_request(SSL_CONNECTION *s, unsigned int context);
30 #ifndef OPENSSL_NO_NEXTPROTONEG
31 static int init_npn(SSL_CONNECTION *s, unsigned int context);
33 static int init_alpn(SSL_CONNECTION *s, unsigned int context);
34 static int final_alpn(SSL_CONNECTION *s, unsigned int context, int sent);
35 static int init_sig_algs_cert(SSL_CONNECTION *s, unsigned int context);
36 static int init_sig_algs(SSL_CONNECTION *s, unsigned int context);
37 static int init_server_cert_type(SSL_CONNECTION *sc, unsigned int context);
38 static int init_client_cert_type(SSL_CONNECTION *sc, unsigned int context);
39 static int init_certificate_authorities(SSL_CONNECTION *s,
40 unsigned int context);
41 static EXT_RETURN tls_construct_certificate_authorities(SSL_CONNECTION *s,
46 static int tls_parse_certificate_authorities(SSL_CONNECTION *s, PACKET *pkt,
47 unsigned int context, X509 *x,
49 #ifndef OPENSSL_NO_SRP
50 static int init_srp(SSL_CONNECTION *s, unsigned int context);
52 static int init_ec_point_formats(SSL_CONNECTION *s, unsigned int context);
53 static int init_etm(SSL_CONNECTION *s, unsigned int context);
54 static int init_ems(SSL_CONNECTION *s, unsigned int context);
55 static int final_ems(SSL_CONNECTION *s, unsigned int context, int sent);
56 static int init_psk_kex_modes(SSL_CONNECTION *s, unsigned int context);
57 static int final_key_share(SSL_CONNECTION *s, unsigned int context, int sent);
58 #ifndef OPENSSL_NO_SRTP
59 static int init_srtp(SSL_CONNECTION *s, unsigned int context);
61 static int final_sig_algs(SSL_CONNECTION *s, unsigned int context, int sent);
62 static int final_early_data(SSL_CONNECTION *s, unsigned int context, int sent);
63 static int final_maxfragmentlen(SSL_CONNECTION *s, unsigned int context,
65 static int init_post_handshake_auth(SSL_CONNECTION *s, unsigned int context);
66 static int final_psk(SSL_CONNECTION *s, unsigned int context, int sent);
67 static int tls_init_compress_certificate(SSL_CONNECTION *sc, unsigned int context);
68 static EXT_RETURN tls_construct_compress_certificate(SSL_CONNECTION *sc, WPACKET *pkt,
70 X509 *x, size_t chainidx);
71 static int tls_parse_compress_certificate(SSL_CONNECTION *sc, PACKET *pkt,
73 X509 *x, size_t chainidx);
75 /* Structure to define a built-in extension */
76 typedef struct extensions_definition_st {
77 /* The defined type for the extension */
80 * The context that this extension applies to, e.g. what messages and
85 * Initialise extension before parsing. Always called for relevant contexts
86 * even if extension not present
88 int (*init)(SSL_CONNECTION *s, unsigned int context);
89 /* Parse extension sent from client to server */
90 int (*parse_ctos)(SSL_CONNECTION *s, PACKET *pkt, unsigned int context,
91 X509 *x, size_t chainidx);
92 /* Parse extension send from server to client */
93 int (*parse_stoc)(SSL_CONNECTION *s, PACKET *pkt, unsigned int context,
94 X509 *x, size_t chainidx);
95 /* Construct extension sent from server to client */
96 EXT_RETURN (*construct_stoc)(SSL_CONNECTION *s, WPACKET *pkt,
98 X509 *x, size_t chainidx);
99 /* Construct extension sent from client to server */
100 EXT_RETURN (*construct_ctos)(SSL_CONNECTION *s, WPACKET *pkt,
101 unsigned int context,
102 X509 *x, size_t chainidx);
104 * Finalise extension after parsing. Always called where an extensions was
105 * initialised even if the extension was not present. |sent| is set to 1 if
106 * the extension was seen, or 0 otherwise.
108 int (*final)(SSL_CONNECTION *s, unsigned int context, int sent);
109 } EXTENSION_DEFINITION;
112 * Definitions of all built-in extensions. NOTE: Changes in the number or order
113 * of these extensions should be mirrored with equivalent changes to the
114 * indexes ( TLSEXT_IDX_* ) defined in ssl_local.h.
115 * Extensions should be added to test/ext_internal_test.c as well, as that
116 * tests the ordering of the extensions.
118 * Each extension has an initialiser, a client and
119 * server side parser and a finaliser. The initialiser is called (if the
120 * extension is relevant to the given context) even if we did not see the
121 * extension in the message that we received. The parser functions are only
122 * called if we see the extension in the message. The finalisers are always
123 * called if the initialiser was called.
124 * There are also server and client side constructor functions which are always
125 * called during message construction if the extension is relevant for the
127 * The initialisation, parsing, finalisation and construction functions are
128 * always called in the order defined in this list. Some extensions may depend
129 * on others having been processed first, so the order of this list is
131 * The extension context is defined by a series of flags which specify which
132 * messages the extension is relevant to. These flags also specify whether the
133 * extension is relevant to a particular protocol or protocol version.
135 * NOTE: WebSphere Application Server 7+ cannot handle empty extensions at
136 * the end, keep these extensions before signature_algorithm.
138 #define INVALID_EXTENSION { TLSEXT_TYPE_invalid, 0, NULL, NULL, NULL, NULL, NULL, NULL }
139 static const EXTENSION_DEFINITION ext_defs[] = {
141 TLSEXT_TYPE_renegotiate,
142 SSL_EXT_CLIENT_HELLO | SSL_EXT_TLS1_2_SERVER_HELLO
143 | SSL_EXT_SSL3_ALLOWED | SSL_EXT_TLS1_2_AND_BELOW_ONLY,
144 NULL, tls_parse_ctos_renegotiate, tls_parse_stoc_renegotiate,
145 tls_construct_stoc_renegotiate, tls_construct_ctos_renegotiate,
149 TLSEXT_TYPE_server_name,
150 SSL_EXT_CLIENT_HELLO | SSL_EXT_TLS1_2_SERVER_HELLO
151 | SSL_EXT_TLS1_3_ENCRYPTED_EXTENSIONS,
153 tls_parse_ctos_server_name, tls_parse_stoc_server_name,
154 tls_construct_stoc_server_name, tls_construct_ctos_server_name,
158 TLSEXT_TYPE_max_fragment_length,
159 SSL_EXT_CLIENT_HELLO | SSL_EXT_TLS1_2_SERVER_HELLO
160 | SSL_EXT_TLS1_3_ENCRYPTED_EXTENSIONS,
161 NULL, tls_parse_ctos_maxfragmentlen, tls_parse_stoc_maxfragmentlen,
162 tls_construct_stoc_maxfragmentlen, tls_construct_ctos_maxfragmentlen,
165 #ifndef OPENSSL_NO_SRP
168 SSL_EXT_CLIENT_HELLO | SSL_EXT_TLS1_2_AND_BELOW_ONLY,
169 init_srp, tls_parse_ctos_srp, NULL, NULL, tls_construct_ctos_srp, NULL
175 TLSEXT_TYPE_ec_point_formats,
176 SSL_EXT_CLIENT_HELLO | SSL_EXT_TLS1_2_SERVER_HELLO
177 | SSL_EXT_TLS1_2_AND_BELOW_ONLY,
178 init_ec_point_formats, tls_parse_ctos_ec_pt_formats, tls_parse_stoc_ec_pt_formats,
179 tls_construct_stoc_ec_pt_formats, tls_construct_ctos_ec_pt_formats,
184 * "supported_groups" is spread across several specifications.
185 * It was originally specified as "elliptic_curves" in RFC 4492,
186 * and broadened to include named FFDH groups by RFC 7919.
187 * Both RFCs 4492 and 7919 do not include a provision for the server
188 * to indicate to the client the complete list of groups supported
189 * by the server, with the server instead just indicating the
190 * selected group for this connection in the ServerKeyExchange
191 * message. TLS 1.3 adds a scheme for the server to indicate
192 * to the client its list of supported groups in the
193 * EncryptedExtensions message, but none of the relevant
194 * specifications permit sending supported_groups in the ServerHello.
195 * Nonetheless (possibly due to the close proximity to the
196 * "ec_point_formats" extension, which is allowed in the ServerHello),
197 * there are several servers that send this extension in the
198 * ServerHello anyway. Up to and including the 1.1.0 release,
199 * we did not check for the presence of nonpermitted extensions,
200 * so to avoid a regression, we must permit this extension in the
201 * TLS 1.2 ServerHello as well.
203 * Note that there is no tls_parse_stoc_supported_groups function,
204 * so we do not perform any additional parsing, validation, or
205 * processing on the server's group list -- this is just a minimal
206 * change to preserve compatibility with these misbehaving servers.
208 TLSEXT_TYPE_supported_groups,
209 SSL_EXT_CLIENT_HELLO | SSL_EXT_TLS1_3_ENCRYPTED_EXTENSIONS
210 | SSL_EXT_TLS1_2_SERVER_HELLO,
211 NULL, tls_parse_ctos_supported_groups, NULL,
212 tls_construct_stoc_supported_groups,
213 tls_construct_ctos_supported_groups, NULL
216 TLSEXT_TYPE_session_ticket,
217 SSL_EXT_CLIENT_HELLO | SSL_EXT_TLS1_2_SERVER_HELLO
218 | SSL_EXT_TLS1_2_AND_BELOW_ONLY,
219 init_session_ticket, tls_parse_ctos_session_ticket,
220 tls_parse_stoc_session_ticket, tls_construct_stoc_session_ticket,
221 tls_construct_ctos_session_ticket, NULL
223 #ifndef OPENSSL_NO_OCSP
225 TLSEXT_TYPE_status_request,
226 SSL_EXT_CLIENT_HELLO | SSL_EXT_TLS1_2_SERVER_HELLO
227 | SSL_EXT_TLS1_3_CERTIFICATE | SSL_EXT_TLS1_3_CERTIFICATE_REQUEST,
228 init_status_request, tls_parse_ctos_status_request,
229 tls_parse_stoc_status_request, tls_construct_stoc_status_request,
230 tls_construct_ctos_status_request, NULL
235 #ifndef OPENSSL_NO_NEXTPROTONEG
237 TLSEXT_TYPE_next_proto_neg,
238 SSL_EXT_CLIENT_HELLO | SSL_EXT_TLS1_2_SERVER_HELLO
239 | SSL_EXT_TLS1_2_AND_BELOW_ONLY,
240 init_npn, tls_parse_ctos_npn, tls_parse_stoc_npn,
241 tls_construct_stoc_next_proto_neg, tls_construct_ctos_npn, NULL
248 * Must appear in this list after server_name so that finalisation
249 * happens after server_name callbacks
251 TLSEXT_TYPE_application_layer_protocol_negotiation,
252 SSL_EXT_CLIENT_HELLO | SSL_EXT_TLS1_2_SERVER_HELLO
253 | SSL_EXT_TLS1_3_ENCRYPTED_EXTENSIONS,
254 init_alpn, tls_parse_ctos_alpn, tls_parse_stoc_alpn,
255 tls_construct_stoc_alpn, tls_construct_ctos_alpn, final_alpn
257 #ifndef OPENSSL_NO_SRTP
259 TLSEXT_TYPE_use_srtp,
260 SSL_EXT_CLIENT_HELLO | SSL_EXT_TLS1_2_SERVER_HELLO
261 | SSL_EXT_TLS1_3_ENCRYPTED_EXTENSIONS | SSL_EXT_DTLS_ONLY,
262 init_srtp, tls_parse_ctos_use_srtp, tls_parse_stoc_use_srtp,
263 tls_construct_stoc_use_srtp, tls_construct_ctos_use_srtp, NULL
269 TLSEXT_TYPE_encrypt_then_mac,
270 SSL_EXT_CLIENT_HELLO | SSL_EXT_TLS1_2_SERVER_HELLO
271 | SSL_EXT_TLS1_2_AND_BELOW_ONLY,
272 init_etm, tls_parse_ctos_etm, tls_parse_stoc_etm,
273 tls_construct_stoc_etm, tls_construct_ctos_etm, NULL
275 #ifndef OPENSSL_NO_CT
277 TLSEXT_TYPE_signed_certificate_timestamp,
278 SSL_EXT_CLIENT_HELLO | SSL_EXT_TLS1_2_SERVER_HELLO
279 | SSL_EXT_TLS1_3_CERTIFICATE | SSL_EXT_TLS1_3_CERTIFICATE_REQUEST,
282 * No server side support for this, but can be provided by a custom
283 * extension. This is an exception to the rule that custom extensions
284 * cannot override built in ones.
286 NULL, tls_parse_stoc_sct, NULL, tls_construct_ctos_sct, NULL
292 TLSEXT_TYPE_extended_master_secret,
293 SSL_EXT_CLIENT_HELLO | SSL_EXT_TLS1_2_SERVER_HELLO
294 | SSL_EXT_TLS1_2_AND_BELOW_ONLY,
295 init_ems, tls_parse_ctos_ems, tls_parse_stoc_ems,
296 tls_construct_stoc_ems, tls_construct_ctos_ems, final_ems
299 TLSEXT_TYPE_signature_algorithms_cert,
300 SSL_EXT_CLIENT_HELLO | SSL_EXT_TLS1_3_CERTIFICATE_REQUEST,
301 init_sig_algs_cert, tls_parse_ctos_sig_algs_cert,
302 tls_parse_ctos_sig_algs_cert,
303 /* We do not generate signature_algorithms_cert at present. */
307 TLSEXT_TYPE_post_handshake_auth,
308 SSL_EXT_CLIENT_HELLO | SSL_EXT_TLS1_3_ONLY,
309 init_post_handshake_auth,
310 tls_parse_ctos_post_handshake_auth, NULL,
311 NULL, tls_construct_ctos_post_handshake_auth,
315 TLSEXT_TYPE_client_cert_type,
316 SSL_EXT_CLIENT_HELLO | SSL_EXT_TLS1_3_ENCRYPTED_EXTENSIONS
317 | SSL_EXT_TLS1_2_SERVER_HELLO,
318 init_client_cert_type,
319 tls_parse_ctos_client_cert_type, tls_parse_stoc_client_cert_type,
320 tls_construct_stoc_client_cert_type, tls_construct_ctos_client_cert_type,
324 TLSEXT_TYPE_server_cert_type,
325 SSL_EXT_CLIENT_HELLO | SSL_EXT_TLS1_3_ENCRYPTED_EXTENSIONS
326 | SSL_EXT_TLS1_2_SERVER_HELLO,
327 init_server_cert_type,
328 tls_parse_ctos_server_cert_type, tls_parse_stoc_server_cert_type,
329 tls_construct_stoc_server_cert_type, tls_construct_ctos_server_cert_type,
333 TLSEXT_TYPE_signature_algorithms,
334 SSL_EXT_CLIENT_HELLO | SSL_EXT_TLS1_3_CERTIFICATE_REQUEST,
335 init_sig_algs, tls_parse_ctos_sig_algs,
336 tls_parse_ctos_sig_algs, tls_construct_ctos_sig_algs,
337 tls_construct_ctos_sig_algs, final_sig_algs
340 TLSEXT_TYPE_supported_versions,
341 SSL_EXT_CLIENT_HELLO | SSL_EXT_TLS1_3_SERVER_HELLO
342 | SSL_EXT_TLS1_3_HELLO_RETRY_REQUEST | SSL_EXT_TLS_IMPLEMENTATION_ONLY,
344 /* Processed inline as part of version selection */
345 NULL, tls_parse_stoc_supported_versions,
346 tls_construct_stoc_supported_versions,
347 tls_construct_ctos_supported_versions, NULL
350 TLSEXT_TYPE_psk_kex_modes,
351 SSL_EXT_CLIENT_HELLO | SSL_EXT_TLS_IMPLEMENTATION_ONLY
352 | SSL_EXT_TLS1_3_ONLY,
353 init_psk_kex_modes, tls_parse_ctos_psk_kex_modes, NULL, NULL,
354 tls_construct_ctos_psk_kex_modes, NULL
358 * Must be in this list after supported_groups. We need that to have
359 * been parsed before we do this one.
361 TLSEXT_TYPE_key_share,
362 SSL_EXT_CLIENT_HELLO | SSL_EXT_TLS1_3_SERVER_HELLO
363 | SSL_EXT_TLS1_3_HELLO_RETRY_REQUEST | SSL_EXT_TLS_IMPLEMENTATION_ONLY
364 | SSL_EXT_TLS1_3_ONLY,
365 NULL, tls_parse_ctos_key_share, tls_parse_stoc_key_share,
366 tls_construct_stoc_key_share, tls_construct_ctos_key_share,
370 /* Must be after key_share */
372 SSL_EXT_CLIENT_HELLO | SSL_EXT_TLS1_3_HELLO_RETRY_REQUEST
373 | SSL_EXT_TLS_IMPLEMENTATION_ONLY | SSL_EXT_TLS1_3_ONLY,
374 NULL, tls_parse_ctos_cookie, tls_parse_stoc_cookie,
375 tls_construct_stoc_cookie, tls_construct_ctos_cookie, NULL
379 * Special unsolicited ServerHello extension only used when
380 * SSL_OP_CRYPTOPRO_TLSEXT_BUG is set. We allow it in a ClientHello but
383 TLSEXT_TYPE_cryptopro_bug,
384 SSL_EXT_CLIENT_HELLO | SSL_EXT_TLS1_2_SERVER_HELLO
385 | SSL_EXT_TLS1_2_AND_BELOW_ONLY,
386 NULL, NULL, NULL, tls_construct_stoc_cryptopro_bug, NULL, NULL
389 TLSEXT_TYPE_compress_certificate,
390 SSL_EXT_CLIENT_HELLO | SSL_EXT_TLS1_3_CERTIFICATE_REQUEST
391 | SSL_EXT_TLS_IMPLEMENTATION_ONLY | SSL_EXT_TLS1_3_ONLY,
392 tls_init_compress_certificate,
393 tls_parse_compress_certificate, tls_parse_compress_certificate,
394 tls_construct_compress_certificate, tls_construct_compress_certificate,
398 TLSEXT_TYPE_early_data,
399 SSL_EXT_CLIENT_HELLO | SSL_EXT_TLS1_3_ENCRYPTED_EXTENSIONS
400 | SSL_EXT_TLS1_3_NEW_SESSION_TICKET | SSL_EXT_TLS1_3_ONLY,
401 NULL, tls_parse_ctos_early_data, tls_parse_stoc_early_data,
402 tls_construct_stoc_early_data, tls_construct_ctos_early_data,
406 TLSEXT_TYPE_certificate_authorities,
407 SSL_EXT_CLIENT_HELLO | SSL_EXT_TLS1_3_CERTIFICATE_REQUEST
408 | SSL_EXT_TLS1_3_ONLY,
409 init_certificate_authorities,
410 tls_parse_certificate_authorities, tls_parse_certificate_authorities,
411 tls_construct_certificate_authorities,
412 tls_construct_certificate_authorities, NULL,
415 /* Must be immediately before pre_shared_key */
417 SSL_EXT_CLIENT_HELLO,
419 /* We send this, but don't read it */
420 NULL, NULL, NULL, tls_construct_ctos_padding, NULL
423 /* Required by the TLSv1.3 spec to always be the last extension */
425 SSL_EXT_CLIENT_HELLO | SSL_EXT_TLS1_3_SERVER_HELLO
426 | SSL_EXT_TLS_IMPLEMENTATION_ONLY | SSL_EXT_TLS1_3_ONLY,
427 NULL, tls_parse_ctos_psk, tls_parse_stoc_psk, tls_construct_stoc_psk,
428 tls_construct_ctos_psk, final_psk
432 /* Returns a TLSEXT_TYPE for the given index */
433 unsigned int ossl_get_extension_type(size_t idx)
435 size_t num_exts = OSSL_NELEM(ext_defs);
438 return TLSEXT_TYPE_out_of_range;
440 return ext_defs[idx].type;
443 /* Check whether an extension's context matches the current context */
444 static int validate_context(SSL_CONNECTION *s, unsigned int extctx,
445 unsigned int thisctx)
447 /* Check we're allowed to use this extension in this context */
448 if ((thisctx & extctx) == 0)
451 if (SSL_CONNECTION_IS_DTLS(s)) {
452 if ((extctx & SSL_EXT_TLS_ONLY) != 0)
454 } else if ((extctx & SSL_EXT_DTLS_ONLY) != 0) {
461 int tls_validate_all_contexts(SSL_CONNECTION *s, unsigned int thisctx,
464 size_t i, num_exts, builtin_num = OSSL_NELEM(ext_defs), offset;
465 RAW_EXTENSION *thisext;
466 unsigned int context;
467 ENDPOINT role = ENDPOINT_BOTH;
469 if ((thisctx & SSL_EXT_CLIENT_HELLO) != 0)
470 role = ENDPOINT_SERVER;
471 else if ((thisctx & SSL_EXT_TLS1_2_SERVER_HELLO) != 0)
472 role = ENDPOINT_CLIENT;
474 /* Calculate the number of extensions in the extensions list */
475 num_exts = builtin_num + s->cert->custext.meths_count;
477 for (thisext = exts, i = 0; i < num_exts; i++, thisext++) {
478 if (!thisext->present)
481 if (i < builtin_num) {
482 context = ext_defs[i].context;
484 custom_ext_method *meth = NULL;
486 meth = custom_ext_find(&s->cert->custext, role, thisext->type,
488 if (!ossl_assert(meth != NULL))
490 context = meth->context;
493 if (!validate_context(s, context, thisctx))
501 * Verify whether we are allowed to use the extension |type| in the current
502 * |context|. Returns 1 to indicate the extension is allowed or unknown or 0 to
503 * indicate the extension is not allowed. If returning 1 then |*found| is set to
504 * the definition for the extension we found.
506 static int verify_extension(SSL_CONNECTION *s, unsigned int context,
507 unsigned int type, custom_ext_methods *meths,
508 RAW_EXTENSION *rawexlist, RAW_EXTENSION **found)
511 size_t builtin_num = OSSL_NELEM(ext_defs);
512 const EXTENSION_DEFINITION *thisext;
514 for (i = 0, thisext = ext_defs; i < builtin_num; i++, thisext++) {
515 if (type == thisext->type) {
516 if (!validate_context(s, thisext->context, context))
519 *found = &rawexlist[i];
524 /* Check the custom extensions */
527 ENDPOINT role = ENDPOINT_BOTH;
528 custom_ext_method *meth = NULL;
530 if ((context & SSL_EXT_CLIENT_HELLO) != 0)
531 role = ENDPOINT_SERVER;
532 else if ((context & SSL_EXT_TLS1_2_SERVER_HELLO) != 0)
533 role = ENDPOINT_CLIENT;
535 meth = custom_ext_find(meths, role, type, &offset);
537 if (!validate_context(s, meth->context, context))
539 *found = &rawexlist[offset + builtin_num];
544 /* Unknown extension. We allow it */
550 * Check whether the context defined for an extension |extctx| means whether
551 * the extension is relevant for the current context |thisctx| or not. Returns
552 * 1 if the extension is relevant for this context, and 0 otherwise
554 int extension_is_relevant(SSL_CONNECTION *s, unsigned int extctx,
555 unsigned int thisctx)
560 * For HRR we haven't selected the version yet but we know it will be
563 if ((thisctx & SSL_EXT_TLS1_3_HELLO_RETRY_REQUEST) != 0)
566 is_tls13 = SSL_CONNECTION_IS_TLS13(s);
568 if ((SSL_CONNECTION_IS_DTLS(s)
569 && (extctx & SSL_EXT_TLS_IMPLEMENTATION_ONLY) != 0)
570 || (s->version == SSL3_VERSION
571 && (extctx & SSL_EXT_SSL3_ALLOWED) == 0)
573 * Note that SSL_IS_TLS13() means "TLS 1.3 has been negotiated",
574 * which is never true when generating the ClientHello.
575 * However, version negotiation *has* occurred by the time the
576 * ClientHello extensions are being parsed.
577 * Be careful to allow TLS 1.3-only extensions when generating
580 || (is_tls13 && (extctx & SSL_EXT_TLS1_2_AND_BELOW_ONLY) != 0)
581 || (!is_tls13 && (extctx & SSL_EXT_TLS1_3_ONLY) != 0
582 && (thisctx & SSL_EXT_CLIENT_HELLO) == 0)
583 || (s->server && !is_tls13 && (extctx & SSL_EXT_TLS1_3_ONLY) != 0)
584 || (s->hit && (extctx & SSL_EXT_IGNORE_ON_RESUMPTION) != 0))
590 * Gather a list of all the extensions from the data in |packet]. |context|
591 * tells us which message this extension is for. The raw extension data is
592 * stored in |*res| on success. We don't actually process the content of the
593 * extensions yet, except to check their types. This function also runs the
594 * initialiser functions for all known extensions if |init| is nonzero (whether
595 * we have collected them or not). If successful the caller is responsible for
596 * freeing the contents of |*res|.
598 * Per http://tools.ietf.org/html/rfc5246#section-7.4.1.4, there may not be
599 * more than one extension of the same type in a ClientHello or ServerHello.
600 * This function returns 1 if all extensions are unique and we have parsed their
601 * types, and 0 if the extensions contain duplicates, could not be successfully
602 * found, or an internal error occurred. We only check duplicates for
603 * extensions that we know about. We ignore others.
605 int tls_collect_extensions(SSL_CONNECTION *s, PACKET *packet,
606 unsigned int context,
607 RAW_EXTENSION **res, size_t *len, int init)
609 PACKET extensions = *packet;
612 custom_ext_methods *exts = &s->cert->custext;
613 RAW_EXTENSION *raw_extensions = NULL;
614 const EXTENSION_DEFINITION *thisexd;
619 * Initialise server side custom extensions. Client side is done during
620 * construction of extensions for the ClientHello.
622 if ((context & SSL_EXT_CLIENT_HELLO) != 0)
623 custom_ext_init(&s->cert->custext);
625 num_exts = OSSL_NELEM(ext_defs) + (exts != NULL ? exts->meths_count : 0);
626 raw_extensions = OPENSSL_zalloc(num_exts * sizeof(*raw_extensions));
627 if (raw_extensions == NULL) {
628 SSLfatal(s, SSL_AD_INTERNAL_ERROR, ERR_R_CRYPTO_LIB);
633 while (PACKET_remaining(&extensions) > 0) {
634 unsigned int type, idx;
636 RAW_EXTENSION *thisex;
638 if (!PACKET_get_net_2(&extensions, &type) ||
639 !PACKET_get_length_prefixed_2(&extensions, &extension)) {
640 SSLfatal(s, SSL_AD_DECODE_ERROR, SSL_R_BAD_EXTENSION);
644 * Verify this extension is allowed. We only check duplicates for
645 * extensions that we recognise. We also have a special case for the
646 * PSK extension, which must be the last one in the ClientHello.
648 if (!verify_extension(s, context, type, exts, raw_extensions, &thisex)
649 || (thisex != NULL && thisex->present == 1)
650 || (type == TLSEXT_TYPE_psk
651 && (context & SSL_EXT_CLIENT_HELLO) != 0
652 && PACKET_remaining(&extensions) != 0)) {
653 SSLfatal(s, SSL_AD_ILLEGAL_PARAMETER, SSL_R_BAD_EXTENSION);
656 idx = thisex - raw_extensions;
658 * Check that we requested this extension (if appropriate). Requests can
659 * be sent in the ClientHello and CertificateRequest. Unsolicited
660 * extensions can be sent in the NewSessionTicket. We only do this for
661 * the built-in extensions. Custom extensions have a different but
662 * similar check elsewhere.
664 * - The HRR cookie extension is unsolicited
665 * - The renegotiate extension is unsolicited (the client signals
666 * support via an SCSV)
667 * - The signed_certificate_timestamp extension can be provided by a
668 * custom extension or by the built-in version. We let the extension
669 * itself handle unsolicited response checks.
671 if (idx < OSSL_NELEM(ext_defs)
672 && (context & (SSL_EXT_CLIENT_HELLO
673 | SSL_EXT_TLS1_3_CERTIFICATE_REQUEST
674 | SSL_EXT_TLS1_3_NEW_SESSION_TICKET)) == 0
675 && type != TLSEXT_TYPE_cookie
676 && type != TLSEXT_TYPE_renegotiate
677 && type != TLSEXT_TYPE_signed_certificate_timestamp
678 && (s->ext.extflags[idx] & SSL_EXT_FLAG_SENT) == 0
679 #ifndef OPENSSL_NO_GOST
680 && !((context & SSL_EXT_TLS1_2_SERVER_HELLO) != 0
681 && type == TLSEXT_TYPE_cryptopro_bug)
684 SSLfatal(s, SSL_AD_UNSUPPORTED_EXTENSION,
685 SSL_R_UNSOLICITED_EXTENSION);
688 if (thisex != NULL) {
689 thisex->data = extension;
692 thisex->received_order = i++;
694 s->ext.debug_cb(SSL_CONNECTION_GET_SSL(s), !s->server,
695 thisex->type, PACKET_data(&thisex->data),
696 PACKET_remaining(&thisex->data),
703 * Initialise all known extensions relevant to this context,
704 * whether we have found them or not
706 for (thisexd = ext_defs, i = 0; i < OSSL_NELEM(ext_defs);
708 if (thisexd->init != NULL && (thisexd->context & context) != 0
709 && extension_is_relevant(s, thisexd->context, context)
710 && !thisexd->init(s, context)) {
711 /* SSLfatal() already called */
717 *res = raw_extensions;
723 OPENSSL_free(raw_extensions);
728 * Runs the parser for a given extension with index |idx|. |exts| contains the
729 * list of all parsed extensions previously collected by
730 * tls_collect_extensions(). The parser is only run if it is applicable for the
731 * given |context| and the parser has not already been run. If this is for a
732 * Certificate message, then we also provide the parser with the relevant
733 * Certificate |x| and its position in the |chainidx| with 0 being the first
734 * Certificate. Returns 1 on success or 0 on failure. If an extension is not
735 * present this counted as success.
737 int tls_parse_extension(SSL_CONNECTION *s, TLSEXT_INDEX idx, int context,
738 RAW_EXTENSION *exts, X509 *x, size_t chainidx)
740 RAW_EXTENSION *currext = &exts[idx];
741 int (*parser)(SSL_CONNECTION *s, PACKET *pkt, unsigned int context, X509 *x,
742 size_t chainidx) = NULL;
744 /* Skip if the extension is not present */
745 if (!currext->present)
748 /* Skip if we've already parsed this extension */
754 if (idx < OSSL_NELEM(ext_defs)) {
755 /* We are handling a built-in extension */
756 const EXTENSION_DEFINITION *extdef = &ext_defs[idx];
758 /* Check if extension is defined for our protocol. If not, skip */
759 if (!extension_is_relevant(s, extdef->context, context))
762 parser = s->server ? extdef->parse_ctos : extdef->parse_stoc;
765 return parser(s, &currext->data, context, x, chainidx);
768 * If the parser is NULL we fall through to the custom extension
773 /* Parse custom extensions */
774 return custom_ext_parse(s, context, currext->type,
775 PACKET_data(&currext->data),
776 PACKET_remaining(&currext->data),
781 * Parse all remaining extensions that have not yet been parsed. Also calls the
782 * finalisation for all extensions at the end if |fin| is nonzero, whether we
783 * collected them or not. Returns 1 for success or 0 for failure. If we are
784 * working on a Certificate message then we also pass the Certificate |x| and
785 * its position in the |chainidx|, with 0 being the first certificate.
787 int tls_parse_all_extensions(SSL_CONNECTION *s, int context,
788 RAW_EXTENSION *exts, X509 *x,
789 size_t chainidx, int fin)
791 size_t i, numexts = OSSL_NELEM(ext_defs);
792 const EXTENSION_DEFINITION *thisexd;
794 /* Calculate the number of extensions in the extensions list */
795 numexts += s->cert->custext.meths_count;
797 /* Parse each extension in turn */
798 for (i = 0; i < numexts; i++) {
799 if (!tls_parse_extension(s, i, context, exts, x, chainidx)) {
800 /* SSLfatal() already called */
807 * Finalise all known extensions relevant to this context,
808 * whether we have found them or not
810 for (i = 0, thisexd = ext_defs; i < OSSL_NELEM(ext_defs);
812 if (thisexd->final != NULL && (thisexd->context & context) != 0
813 && !thisexd->final(s, context, exts[i].present)) {
814 /* SSLfatal() already called */
823 int should_add_extension(SSL_CONNECTION *s, unsigned int extctx,
824 unsigned int thisctx, int max_version)
826 /* Skip if not relevant for our context */
827 if ((extctx & thisctx) == 0)
830 /* Check if this extension is defined for our protocol. If not, skip */
831 if (!extension_is_relevant(s, extctx, thisctx)
832 || ((extctx & SSL_EXT_TLS1_3_ONLY) != 0
833 && (thisctx & SSL_EXT_CLIENT_HELLO) != 0
834 && (SSL_CONNECTION_IS_DTLS(s) || max_version < TLS1_3_VERSION)))
841 * Construct all the extensions relevant to the current |context| and write
842 * them to |pkt|. If this is an extension for a Certificate in a Certificate
843 * message, then |x| will be set to the Certificate we are handling, and
844 * |chainidx| will indicate the position in the chainidx we are processing (with
845 * 0 being the first in the chain). Returns 1 on success or 0 on failure. On a
846 * failure construction stops at the first extension to fail to construct.
848 int tls_construct_extensions(SSL_CONNECTION *s, WPACKET *pkt,
849 unsigned int context,
850 X509 *x, size_t chainidx)
853 int min_version, max_version = 0, reason;
854 const EXTENSION_DEFINITION *thisexd;
855 int for_comp = (context & SSL_EXT_TLS1_3_CERTIFICATE_COMPRESSION) != 0;
857 if (!WPACKET_start_sub_packet_u16(pkt)
859 * If extensions are of zero length then we don't even add the
860 * extensions length bytes to a ClientHello/ServerHello
864 (SSL_EXT_CLIENT_HELLO | SSL_EXT_TLS1_2_SERVER_HELLO)) != 0
865 && !WPACKET_set_flags(pkt,
866 WPACKET_FLAGS_ABANDON_ON_ZERO_LENGTH))) {
868 SSLfatal(s, SSL_AD_INTERNAL_ERROR, ERR_R_INTERNAL_ERROR);
872 if ((context & SSL_EXT_CLIENT_HELLO) != 0) {
873 reason = ssl_get_min_max_version(s, &min_version, &max_version, NULL);
876 SSLfatal(s, SSL_AD_INTERNAL_ERROR, reason);
881 /* Add custom extensions first */
882 if ((context & SSL_EXT_CLIENT_HELLO) != 0) {
883 /* On the server side with initialise during ClientHello parsing */
884 custom_ext_init(&s->cert->custext);
886 if (!custom_ext_add(s, context, pkt, x, chainidx, max_version)) {
887 /* SSLfatal() already called */
891 for (i = 0, thisexd = ext_defs; i < OSSL_NELEM(ext_defs); i++, thisexd++) {
892 EXT_RETURN (*construct)(SSL_CONNECTION *s, WPACKET *pkt,
893 unsigned int context,
894 X509 *x, size_t chainidx);
897 /* Skip if not relevant for our context */
898 if (!should_add_extension(s, thisexd->context, context, max_version))
901 construct = s->server ? thisexd->construct_stoc
902 : thisexd->construct_ctos;
904 if (construct == NULL)
907 ret = construct(s, pkt, context, x, chainidx);
908 if (ret == EXT_RETURN_FAIL) {
909 /* SSLfatal() already called */
912 if (ret == EXT_RETURN_SENT
913 && (context & (SSL_EXT_CLIENT_HELLO
914 | SSL_EXT_TLS1_3_CERTIFICATE_REQUEST
915 | SSL_EXT_TLS1_3_NEW_SESSION_TICKET)) != 0)
916 s->ext.extflags[i] |= SSL_EXT_FLAG_SENT;
919 if (!WPACKET_close(pkt)) {
921 SSLfatal(s, SSL_AD_INTERNAL_ERROR, ERR_R_INTERNAL_ERROR);
929 * Built in extension finalisation and initialisation functions. All initialise
930 * or finalise the associated extension type for the given |context|. For
931 * finalisers |sent| is set to 1 if we saw the extension during parsing, and 0
932 * otherwise. These functions return 1 on success or 0 on failure.
935 static int final_renegotiate(SSL_CONNECTION *s, unsigned int context, int sent)
939 * Check if we can connect to a server that doesn't support safe
942 if (!(s->options & SSL_OP_LEGACY_SERVER_CONNECT)
943 && !(s->options & SSL_OP_ALLOW_UNSAFE_LEGACY_RENEGOTIATION)
945 SSLfatal(s, SSL_AD_HANDSHAKE_FAILURE,
946 SSL_R_UNSAFE_LEGACY_RENEGOTIATION_DISABLED);
953 /* Need RI if renegotiating */
955 && !(s->options & SSL_OP_ALLOW_UNSAFE_LEGACY_RENEGOTIATION)
957 SSLfatal(s, SSL_AD_HANDSHAKE_FAILURE,
958 SSL_R_UNSAFE_LEGACY_RENEGOTIATION_DISABLED);
966 static ossl_inline void ssl_tsan_decr(const SSL_CTX *ctx,
967 TSAN_QUALIFIER int *stat)
969 if (ssl_tsan_lock(ctx)) {
971 ssl_tsan_unlock(ctx);
975 static int init_server_name(SSL_CONNECTION *s, unsigned int context)
978 s->servername_done = 0;
980 OPENSSL_free(s->ext.hostname);
981 s->ext.hostname = NULL;
987 static int final_server_name(SSL_CONNECTION *s, unsigned int context, int sent)
989 int ret = SSL_TLSEXT_ERR_NOACK;
990 int altmp = SSL_AD_UNRECOGNIZED_NAME;
991 SSL *ssl = SSL_CONNECTION_GET_SSL(s);
992 SSL_CTX *sctx = SSL_CONNECTION_GET_CTX(s);
993 int was_ticket = (SSL_get_options(ssl) & SSL_OP_NO_TICKET) == 0;
995 if (!ossl_assert(sctx != NULL) || !ossl_assert(s->session_ctx != NULL)) {
996 SSLfatal(s, SSL_AD_INTERNAL_ERROR, ERR_R_INTERNAL_ERROR);
1000 if (sctx->ext.servername_cb != NULL)
1001 ret = sctx->ext.servername_cb(ssl, &altmp,
1002 sctx->ext.servername_arg);
1003 else if (s->session_ctx->ext.servername_cb != NULL)
1004 ret = s->session_ctx->ext.servername_cb(ssl, &altmp,
1005 s->session_ctx->ext.servername_arg);
1008 * For servers, propagate the SNI hostname from the temporary
1009 * storage in the SSL to the persistent SSL_SESSION, now that we
1010 * know we accepted it.
1011 * Clients make this copy when parsing the server's response to
1012 * the extension, which is when they find out that the negotiation
1016 if (sent && ret == SSL_TLSEXT_ERR_OK && !s->hit) {
1017 /* Only store the hostname in the session if we accepted it. */
1018 OPENSSL_free(s->session->ext.hostname);
1019 s->session->ext.hostname = OPENSSL_strdup(s->ext.hostname);
1020 if (s->session->ext.hostname == NULL && s->ext.hostname != NULL) {
1021 SSLfatal(s, SSL_AD_INTERNAL_ERROR, ERR_R_INTERNAL_ERROR);
1027 * If we switched contexts (whether here or in the client_hello callback),
1028 * move the sess_accept increment from the session_ctx to the new
1029 * context, to avoid the confusing situation of having sess_accept_good
1030 * exceed sess_accept (zero) for the new context.
1032 if (SSL_IS_FIRST_HANDSHAKE(s) && sctx != s->session_ctx
1033 && s->hello_retry_request == SSL_HRR_NONE) {
1034 ssl_tsan_counter(sctx, &sctx->stats.sess_accept);
1035 ssl_tsan_decr(s->session_ctx, &s->session_ctx->stats.sess_accept);
1039 * If we're expecting to send a ticket, and tickets were previously enabled,
1040 * and now tickets are disabled, then turn off expected ticket.
1041 * Also, if this is not a resumption, create a new session ID
1043 if (ret == SSL_TLSEXT_ERR_OK && s->ext.ticket_expected
1044 && was_ticket && (SSL_get_options(ssl) & SSL_OP_NO_TICKET) != 0) {
1045 s->ext.ticket_expected = 0;
1047 SSL_SESSION* ss = SSL_get_session(ssl);
1050 OPENSSL_free(ss->ext.tick);
1051 ss->ext.tick = NULL;
1052 ss->ext.ticklen = 0;
1053 ss->ext.tick_lifetime_hint = 0;
1054 ss->ext.tick_age_add = 0;
1055 if (!ssl_generate_session_id(s, ss)) {
1056 SSLfatal(s, SSL_AD_INTERNAL_ERROR, ERR_R_INTERNAL_ERROR);
1060 SSLfatal(s, SSL_AD_INTERNAL_ERROR, ERR_R_INTERNAL_ERROR);
1067 case SSL_TLSEXT_ERR_ALERT_FATAL:
1068 SSLfatal(s, altmp, SSL_R_CALLBACK_FAILED);
1071 case SSL_TLSEXT_ERR_ALERT_WARNING:
1072 /* TLSv1.3 doesn't have warning alerts so we suppress this */
1073 if (!SSL_CONNECTION_IS_TLS13(s))
1074 ssl3_send_alert(s, SSL3_AL_WARNING, altmp);
1075 s->servername_done = 0;
1078 case SSL_TLSEXT_ERR_NOACK:
1079 s->servername_done = 0;
1087 static int final_ec_pt_formats(SSL_CONNECTION *s, unsigned int context,
1090 unsigned long alg_k, alg_a;
1095 alg_k = s->s3.tmp.new_cipher->algorithm_mkey;
1096 alg_a = s->s3.tmp.new_cipher->algorithm_auth;
1099 * If we are client and using an elliptic curve cryptography cipher
1100 * suite, then if server returns an EC point formats lists extension it
1101 * must contain uncompressed.
1103 if (s->ext.ecpointformats != NULL
1104 && s->ext.ecpointformats_len > 0
1105 && s->ext.peer_ecpointformats != NULL
1106 && s->ext.peer_ecpointformats_len > 0
1107 && ((alg_k & SSL_kECDHE) || (alg_a & SSL_aECDSA))) {
1108 /* we are using an ECC cipher */
1110 unsigned char *list = s->ext.peer_ecpointformats;
1112 for (i = 0; i < s->ext.peer_ecpointformats_len; i++) {
1113 if (*list++ == TLSEXT_ECPOINTFORMAT_uncompressed)
1116 if (i == s->ext.peer_ecpointformats_len) {
1117 SSLfatal(s, SSL_AD_ILLEGAL_PARAMETER,
1118 SSL_R_TLS_INVALID_ECPOINTFORMAT_LIST);
1126 static int init_session_ticket(SSL_CONNECTION *s, unsigned int context)
1129 s->ext.ticket_expected = 0;
1134 #ifndef OPENSSL_NO_OCSP
1135 static int init_status_request(SSL_CONNECTION *s, unsigned int context)
1138 s->ext.status_type = TLSEXT_STATUSTYPE_nothing;
1141 * Ensure we get sensible values passed to tlsext_status_cb in the event
1142 * that we don't receive a status message
1144 OPENSSL_free(s->ext.ocsp.resp);
1145 s->ext.ocsp.resp = NULL;
1146 s->ext.ocsp.resp_len = 0;
1153 #ifndef OPENSSL_NO_NEXTPROTONEG
1154 static int init_npn(SSL_CONNECTION *s, unsigned int context)
1162 static int init_alpn(SSL_CONNECTION *s, unsigned int context)
1164 OPENSSL_free(s->s3.alpn_selected);
1165 s->s3.alpn_selected = NULL;
1166 s->s3.alpn_selected_len = 0;
1168 OPENSSL_free(s->s3.alpn_proposed);
1169 s->s3.alpn_proposed = NULL;
1170 s->s3.alpn_proposed_len = 0;
1175 static int final_alpn(SSL_CONNECTION *s, unsigned int context, int sent)
1177 if (!s->server && !sent && s->session->ext.alpn_selected != NULL)
1178 s->ext.early_data_ok = 0;
1180 if (!s->server || !SSL_CONNECTION_IS_TLS13(s))
1184 * Call alpn_select callback if needed. Has to be done after SNI and
1185 * cipher negotiation (HTTP/2 restricts permitted ciphers). In TLSv1.3
1186 * we also have to do this before we decide whether to accept early_data.
1187 * In TLSv1.3 we've already negotiated our cipher so we do this call now.
1188 * For < TLSv1.3 we defer it until after cipher negotiation.
1190 * On failure SSLfatal() already called.
1192 return tls_handle_alpn(s);
1195 static int init_sig_algs(SSL_CONNECTION *s, unsigned int context)
1197 /* Clear any signature algorithms extension received */
1198 OPENSSL_free(s->s3.tmp.peer_sigalgs);
1199 s->s3.tmp.peer_sigalgs = NULL;
1200 s->s3.tmp.peer_sigalgslen = 0;
1205 static int init_sig_algs_cert(SSL_CONNECTION *s,
1206 ossl_unused unsigned int context)
1208 /* Clear any signature algorithms extension received */
1209 OPENSSL_free(s->s3.tmp.peer_cert_sigalgs);
1210 s->s3.tmp.peer_cert_sigalgs = NULL;
1211 s->s3.tmp.peer_cert_sigalgslen = 0;
1216 #ifndef OPENSSL_NO_SRP
1217 static int init_srp(SSL_CONNECTION *s, unsigned int context)
1219 OPENSSL_free(s->srp_ctx.login);
1220 s->srp_ctx.login = NULL;
1226 static int init_ec_point_formats(SSL_CONNECTION *s, unsigned int context)
1228 OPENSSL_free(s->ext.peer_ecpointformats);
1229 s->ext.peer_ecpointformats = NULL;
1230 s->ext.peer_ecpointformats_len = 0;
1235 static int init_etm(SSL_CONNECTION *s, unsigned int context)
1242 static int init_ems(SSL_CONNECTION *s, unsigned int context)
1244 if (s->s3.flags & TLS1_FLAGS_RECEIVED_EXTMS) {
1245 s->s3.flags &= ~TLS1_FLAGS_RECEIVED_EXTMS;
1246 s->s3.flags |= TLS1_FLAGS_REQUIRED_EXTMS;
1252 static int final_ems(SSL_CONNECTION *s, unsigned int context, int sent)
1255 * Check extended master secret extension is not dropped on
1258 if (!(s->s3.flags & TLS1_FLAGS_RECEIVED_EXTMS)
1259 && (s->s3.flags & TLS1_FLAGS_REQUIRED_EXTMS)) {
1260 SSLfatal(s, SSL_AD_HANDSHAKE_FAILURE, SSL_R_INCONSISTENT_EXTMS);
1263 if (!s->server && s->hit) {
1265 * Check extended master secret extension is consistent with
1268 if (!(s->s3.flags & TLS1_FLAGS_RECEIVED_EXTMS) !=
1269 !(s->session->flags & SSL_SESS_FLAG_EXTMS)) {
1270 SSLfatal(s, SSL_AD_HANDSHAKE_FAILURE, SSL_R_INCONSISTENT_EXTMS);
1278 static int init_certificate_authorities(SSL_CONNECTION *s, unsigned int context)
1280 sk_X509_NAME_pop_free(s->s3.tmp.peer_ca_names, X509_NAME_free);
1281 s->s3.tmp.peer_ca_names = NULL;
1285 static EXT_RETURN tls_construct_certificate_authorities(SSL_CONNECTION *s,
1287 unsigned int context,
1291 const STACK_OF(X509_NAME) *ca_sk = get_ca_names(s);
1293 if (ca_sk == NULL || sk_X509_NAME_num(ca_sk) == 0)
1294 return EXT_RETURN_NOT_SENT;
1296 if (!WPACKET_put_bytes_u16(pkt, TLSEXT_TYPE_certificate_authorities)
1297 || !WPACKET_start_sub_packet_u16(pkt)) {
1298 SSLfatal(s, SSL_AD_INTERNAL_ERROR, ERR_R_INTERNAL_ERROR);
1299 return EXT_RETURN_FAIL;
1302 if (!construct_ca_names(s, ca_sk, pkt)) {
1303 /* SSLfatal() already called */
1304 return EXT_RETURN_FAIL;
1307 if (!WPACKET_close(pkt)) {
1308 SSLfatal(s, SSL_AD_INTERNAL_ERROR, ERR_R_INTERNAL_ERROR);
1309 return EXT_RETURN_FAIL;
1312 return EXT_RETURN_SENT;
1315 static int tls_parse_certificate_authorities(SSL_CONNECTION *s, PACKET *pkt,
1316 unsigned int context, X509 *x,
1319 if (!parse_ca_names(s, pkt))
1321 if (PACKET_remaining(pkt) != 0) {
1322 SSLfatal(s, SSL_AD_DECODE_ERROR, SSL_R_BAD_EXTENSION);
1328 #ifndef OPENSSL_NO_SRTP
1329 static int init_srtp(SSL_CONNECTION *s, unsigned int context)
1332 s->srtp_profile = NULL;
1338 static int final_sig_algs(SSL_CONNECTION *s, unsigned int context, int sent)
1340 if (!sent && SSL_CONNECTION_IS_TLS13(s) && !s->hit) {
1341 SSLfatal(s, TLS13_AD_MISSING_EXTENSION,
1342 SSL_R_MISSING_SIGALGS_EXTENSION);
1349 static int final_key_share(SSL_CONNECTION *s, unsigned int context, int sent)
1351 #if !defined(OPENSSL_NO_TLS1_3)
1352 if (!SSL_CONNECTION_IS_TLS13(s))
1355 /* Nothing to do for key_share in an HRR */
1356 if ((context & SSL_EXT_TLS1_3_HELLO_RETRY_REQUEST) != 0)
1363 * we have no key_share
1365 * (we are not resuming
1366 * OR the kex_mode doesn't allow non key_share resumes)
1373 || (s->ext.psk_kex_mode & TLSEXT_KEX_MODE_FLAG_KE) == 0)) {
1374 /* Nothing left we can do - just fail */
1375 SSLfatal(s, SSL_AD_MISSING_EXTENSION, SSL_R_NO_SUITABLE_KEY_SHARE);
1383 * we have a suitable key_share
1386 * we are stateless AND we have no cookie
1388 * send a HelloRetryRequest
1391 * we didn't already send a HelloRetryRequest
1393 * the client sent a key_share extension
1395 * (we are not resuming
1396 * OR (the kex_mode allows key_share resumes
1397 * AND (kex_mode doesn't allow non-dh resumes OR non-dh is not preferred)))
1399 * a shared group exists
1401 * send a HelloRetryRequest
1403 * we are not resuming
1405 * the kex_mode doesn't allow non key_share resumes
1409 * we are stateless AND we have no cookie
1411 * send a HelloRetryRequest
1414 if (s->s3.peer_tmp != NULL) {
1415 /* We have a suitable key_share */
1416 if ((s->s3.flags & TLS1_FLAGS_STATELESS) != 0
1417 && !s->ext.cookieok) {
1418 if (!ossl_assert(s->hello_retry_request == SSL_HRR_NONE)) {
1420 * If we are stateless then we wouldn't know about any
1421 * previously sent HRR - so how can this be anything other
1424 SSLfatal(s, SSL_AD_INTERNAL_ERROR, ERR_R_INTERNAL_ERROR);
1427 s->hello_retry_request = SSL_HRR_PENDING;
1431 /* No suitable key_share */
1435 /* kex_mode allows key_share resume */
1436 (((s->ext.psk_kex_mode & TLSEXT_KEX_MODE_FLAG_KE_DHE) != 0)
1438 /* and psk-only is not available or not explicitly preferred */
1439 && ((((s->ext.psk_kex_mode & TLSEXT_KEX_MODE_FLAG_KE) == 0)
1440 || (s->options & SSL_OP_PREFER_NO_DHE_KEX) == 0)));
1442 if (s->hello_retry_request == SSL_HRR_NONE && sent
1443 && (!s->hit || dhe_psk)) {
1444 const uint16_t *pgroups, *clntgroups;
1445 size_t num_groups, clnt_num_groups, i;
1446 unsigned int group_id = 0;
1448 /* Check if a shared group exists */
1450 /* Get the clients list of supported groups. */
1451 tls1_get_peer_groups(s, &clntgroups, &clnt_num_groups);
1452 tls1_get_supported_groups(s, &pgroups, &num_groups);
1455 * Find the first group we allow that is also in client's list
1457 for (i = 0; i < num_groups; i++) {
1458 group_id = pgroups[i];
1460 if (check_in_list(s, group_id, clntgroups, clnt_num_groups,
1462 && tls_group_allowed(s, group_id,
1463 SSL_SECOP_CURVE_SUPPORTED)
1464 && tls_valid_group(s, group_id, TLS1_3_VERSION,
1465 TLS1_3_VERSION, 0, NULL))
1469 if (i < num_groups) {
1470 /* A shared group exists so send a HelloRetryRequest */
1471 s->s3.group_id = group_id;
1472 s->hello_retry_request = SSL_HRR_PENDING;
1477 || (s->ext.psk_kex_mode & TLSEXT_KEX_MODE_FLAG_KE) == 0) {
1478 /* Nothing left we can do - just fail */
1479 SSLfatal(s, sent ? SSL_AD_HANDSHAKE_FAILURE
1480 : SSL_AD_MISSING_EXTENSION,
1481 SSL_R_NO_SUITABLE_KEY_SHARE);
1485 if ((s->s3.flags & TLS1_FLAGS_STATELESS) != 0
1486 && !s->ext.cookieok) {
1487 if (!ossl_assert(s->hello_retry_request == SSL_HRR_NONE)) {
1489 * If we are stateless then we wouldn't know about any
1490 * previously sent HRR - so how can this be anything other
1493 SSLfatal(s, SSL_AD_INTERNAL_ERROR, ERR_R_INTERNAL_ERROR);
1496 s->hello_retry_request = SSL_HRR_PENDING;
1502 * We have a key_share so don't send any more HelloRetryRequest
1505 if (s->hello_retry_request == SSL_HRR_PENDING)
1506 s->hello_retry_request = SSL_HRR_COMPLETE;
1509 * For a client side resumption with no key_share we need to generate
1510 * the handshake secret (otherwise this is done during key_share
1513 if (!sent && !tls13_generate_handshake_secret(s, NULL, 0)) {
1514 SSLfatal(s, SSL_AD_INTERNAL_ERROR, ERR_R_INTERNAL_ERROR);
1518 #endif /* !defined(OPENSSL_NO_TLS1_3) */
1522 static int init_psk_kex_modes(SSL_CONNECTION *s, unsigned int context)
1524 s->ext.psk_kex_mode = TLSEXT_KEX_MODE_FLAG_NONE;
1528 int tls_psk_do_binder(SSL_CONNECTION *s, const EVP_MD *md,
1529 const unsigned char *msgstart,
1530 size_t binderoffset, const unsigned char *binderin,
1531 unsigned char *binderout, SSL_SESSION *sess, int sign,
1534 EVP_PKEY *mackey = NULL;
1535 EVP_MD_CTX *mctx = NULL;
1536 unsigned char hash[EVP_MAX_MD_SIZE], binderkey[EVP_MAX_MD_SIZE];
1537 unsigned char finishedkey[EVP_MAX_MD_SIZE], tmpbinder[EVP_MAX_MD_SIZE];
1538 unsigned char *early_secret;
1539 /* ASCII: "res binder", in hex for EBCDIC compatibility */
1540 static const unsigned char resumption_label[] = "\x72\x65\x73\x20\x62\x69\x6E\x64\x65\x72";
1541 /* ASCII: "ext binder", in hex for EBCDIC compatibility */
1542 static const unsigned char external_label[] = "\x65\x78\x74\x20\x62\x69\x6E\x64\x65\x72";
1543 const unsigned char *label;
1544 size_t bindersize, labelsize, hashsize;
1545 int hashsizei = EVP_MD_get_size(md);
1547 int usepskfored = 0;
1548 SSL_CTX *sctx = SSL_CONNECTION_GET_CTX(s);
1550 /* Ensure cast to size_t is safe */
1551 if (!ossl_assert(hashsizei >= 0)) {
1552 SSLfatal(s, SSL_AD_INTERNAL_ERROR, ERR_R_INTERNAL_ERROR);
1555 hashsize = (size_t)hashsizei;
1558 && s->early_data_state == SSL_EARLY_DATA_CONNECTING
1559 && s->session->ext.max_early_data == 0
1560 && sess->ext.max_early_data > 0)
1564 label = external_label;
1565 labelsize = sizeof(external_label) - 1;
1567 label = resumption_label;
1568 labelsize = sizeof(resumption_label) - 1;
1572 * Generate the early_secret. On the server side we've selected a PSK to
1573 * resume with (internal or external) so we always do this. On the client
1574 * side we do this for a non-external (i.e. resumption) PSK or external PSK
1575 * that will be used for early_data so that it is in place for sending early
1576 * data. For client side external PSK not being used for early_data we
1577 * generate it but store it away for later use.
1579 if (s->server || !external || usepskfored)
1580 early_secret = (unsigned char *)s->early_secret;
1582 early_secret = (unsigned char *)sess->early_secret;
1584 if (!tls13_generate_secret(s, md, NULL, sess->master_key,
1585 sess->master_key_length, early_secret)) {
1586 /* SSLfatal() already called */
1591 * Create the handshake hash for the binder key...the messages so far are
1594 mctx = EVP_MD_CTX_new();
1596 || EVP_DigestInit_ex(mctx, md, NULL) <= 0
1597 || EVP_DigestFinal_ex(mctx, hash, NULL) <= 0) {
1598 SSLfatal(s, SSL_AD_INTERNAL_ERROR, ERR_R_INTERNAL_ERROR);
1602 /* Generate the binder key */
1603 if (!tls13_hkdf_expand(s, md, early_secret, label, labelsize, hash,
1604 hashsize, binderkey, hashsize, 1)) {
1605 /* SSLfatal() already called */
1609 /* Generate the finished key */
1610 if (!tls13_derive_finishedkey(s, md, binderkey, finishedkey, hashsize)) {
1611 /* SSLfatal() already called */
1615 if (EVP_DigestInit_ex(mctx, md, NULL) <= 0) {
1616 SSLfatal(s, SSL_AD_INTERNAL_ERROR, ERR_R_INTERNAL_ERROR);
1621 * Get a hash of the ClientHello up to the start of the binders. If we are
1622 * following a HelloRetryRequest then this includes the hash of the first
1623 * ClientHello and the HelloRetryRequest itself.
1625 if (s->hello_retry_request == SSL_HRR_PENDING) {
1630 hdatalen = hdatalen_l =
1631 BIO_get_mem_data(s->s3.handshake_buffer, &hdata);
1632 if (hdatalen_l <= 0) {
1633 SSLfatal(s, SSL_AD_INTERNAL_ERROR, SSL_R_BAD_HANDSHAKE_LENGTH);
1638 * For servers the handshake buffer data will include the second
1639 * ClientHello - which we don't want - so we need to take that bit off.
1642 PACKET hashprefix, msg;
1644 /* Find how many bytes are left after the first two messages */
1645 if (!PACKET_buf_init(&hashprefix, hdata, hdatalen)
1646 || !PACKET_forward(&hashprefix, 1)
1647 || !PACKET_get_length_prefixed_3(&hashprefix, &msg)
1648 || !PACKET_forward(&hashprefix, 1)
1649 || !PACKET_get_length_prefixed_3(&hashprefix, &msg)) {
1650 SSLfatal(s, SSL_AD_INTERNAL_ERROR, ERR_R_INTERNAL_ERROR);
1653 hdatalen -= PACKET_remaining(&hashprefix);
1656 if (EVP_DigestUpdate(mctx, hdata, hdatalen) <= 0) {
1657 SSLfatal(s, SSL_AD_INTERNAL_ERROR, ERR_R_INTERNAL_ERROR);
1662 if (EVP_DigestUpdate(mctx, msgstart, binderoffset) <= 0
1663 || EVP_DigestFinal_ex(mctx, hash, NULL) <= 0) {
1664 SSLfatal(s, SSL_AD_INTERNAL_ERROR, ERR_R_INTERNAL_ERROR);
1668 mackey = EVP_PKEY_new_raw_private_key_ex(sctx->libctx, "HMAC",
1669 sctx->propq, finishedkey,
1671 if (mackey == NULL) {
1672 SSLfatal(s, SSL_AD_INTERNAL_ERROR, ERR_R_INTERNAL_ERROR);
1677 binderout = tmpbinder;
1679 bindersize = hashsize;
1680 if (EVP_DigestSignInit_ex(mctx, NULL, EVP_MD_get0_name(md), sctx->libctx,
1681 sctx->propq, mackey, NULL) <= 0
1682 || EVP_DigestSignUpdate(mctx, hash, hashsize) <= 0
1683 || EVP_DigestSignFinal(mctx, binderout, &bindersize) <= 0
1684 || bindersize != hashsize) {
1685 SSLfatal(s, SSL_AD_INTERNAL_ERROR, ERR_R_INTERNAL_ERROR);
1692 /* HMAC keys can't do EVP_DigestVerify* - use CRYPTO_memcmp instead */
1693 ret = (CRYPTO_memcmp(binderin, binderout, hashsize) == 0);
1695 SSLfatal(s, SSL_AD_ILLEGAL_PARAMETER, SSL_R_BINDER_DOES_NOT_VERIFY);
1699 OPENSSL_cleanse(binderkey, sizeof(binderkey));
1700 OPENSSL_cleanse(finishedkey, sizeof(finishedkey));
1701 EVP_PKEY_free(mackey);
1702 EVP_MD_CTX_free(mctx);
1707 static int final_early_data(SSL_CONNECTION *s, unsigned int context, int sent)
1713 if (context == SSL_EXT_TLS1_3_ENCRYPTED_EXTENSIONS
1715 && !s->ext.early_data_ok) {
1717 * If we get here then the server accepted our early_data but we
1718 * later realised that it shouldn't have done (e.g. inconsistent
1721 SSLfatal(s, SSL_AD_ILLEGAL_PARAMETER, SSL_R_BAD_EARLY_DATA);
1728 if (s->max_early_data == 0
1730 || s->early_data_state != SSL_EARLY_DATA_ACCEPTING
1731 || !s->ext.early_data_ok
1732 || s->hello_retry_request != SSL_HRR_NONE
1733 || (s->allow_early_data_cb != NULL
1734 && !s->allow_early_data_cb(SSL_CONNECTION_GET_SSL(s),
1735 s->allow_early_data_cb_data))) {
1736 s->ext.early_data = SSL_EARLY_DATA_REJECTED;
1738 s->ext.early_data = SSL_EARLY_DATA_ACCEPTED;
1740 if (!tls13_change_cipher_state(s,
1741 SSL3_CC_EARLY | SSL3_CHANGE_CIPHER_SERVER_READ)) {
1742 /* SSLfatal() already called */
1750 static int final_maxfragmentlen(SSL_CONNECTION *s, unsigned int context,
1754 * Session resumption on server-side with MFL extension active
1755 * BUT MFL extension packet was not resent (i.e. sent == 0)
1757 if (s->server && s->hit && USE_MAX_FRAGMENT_LENGTH_EXT(s->session)
1759 SSLfatal(s, SSL_AD_MISSING_EXTENSION, SSL_R_BAD_EXTENSION);
1763 if (s->session && USE_MAX_FRAGMENT_LENGTH_EXT(s->session)) {
1764 s->rlayer.rrlmethod->set_max_frag_len(s->rlayer.rrl,
1765 GET_MAX_FRAGMENT_LENGTH(s->session));
1766 s->rlayer.wrlmethod->set_max_frag_len(s->rlayer.wrl,
1767 ssl_get_max_send_fragment(s));
1773 static int init_post_handshake_auth(SSL_CONNECTION *s,
1774 ossl_unused unsigned int context)
1776 s->post_handshake_auth = SSL_PHA_NONE;
1782 * If clients offer "pre_shared_key" without a "psk_key_exchange_modes"
1783 * extension, servers MUST abort the handshake.
1785 static int final_psk(SSL_CONNECTION *s, unsigned int context, int sent)
1787 if (s->server && sent && s->clienthello != NULL
1788 && !s->clienthello->pre_proc_exts[TLSEXT_IDX_psk_kex_modes].present) {
1789 SSLfatal(s, TLS13_AD_MISSING_EXTENSION,
1790 SSL_R_MISSING_PSK_KEX_MODES_EXTENSION);
1797 static int tls_init_compress_certificate(SSL_CONNECTION *sc, unsigned int context)
1799 memset(sc->ext.compress_certificate_from_peer, 0,
1800 sizeof(sc->ext.compress_certificate_from_peer));
1804 /* The order these are put into the packet imply a preference order: [brotli, zlib, zstd] */
1805 static EXT_RETURN tls_construct_compress_certificate(SSL_CONNECTION *sc, WPACKET *pkt,
1806 unsigned int context,
1807 X509 *x, size_t chainidx)
1809 #ifndef OPENSSL_NO_COMP_ALG
1812 if (!ossl_comp_has_alg(0))
1813 return EXT_RETURN_NOT_SENT;
1815 /* Server: Don't attempt to compress a non-X509 (i.e. an RPK) */
1816 if (sc->server && sc->ext.server_cert_type != TLSEXT_cert_type_x509) {
1817 sc->cert_comp_prefs[0] = TLSEXT_comp_cert_none;
1818 return EXT_RETURN_NOT_SENT;
1821 /* Client: If we sent a client cert-type extension, don't indicate compression */
1822 if (!sc->server && sc->ext.client_cert_type_ctos) {
1823 sc->cert_comp_prefs[0] = TLSEXT_comp_cert_none;
1824 return EXT_RETURN_NOT_SENT;
1827 /* Do not indicate we support receiving compressed certificates */
1828 if ((sc->options & SSL_OP_NO_RX_CERTIFICATE_COMPRESSION) != 0)
1829 return EXT_RETURN_NOT_SENT;
1831 if (sc->cert_comp_prefs[0] == TLSEXT_comp_cert_none)
1832 return EXT_RETURN_NOT_SENT;
1834 if (!WPACKET_put_bytes_u16(pkt, TLSEXT_TYPE_compress_certificate)
1835 || !WPACKET_start_sub_packet_u16(pkt)
1836 || !WPACKET_start_sub_packet_u8(pkt))
1839 for (i = 0; sc->cert_comp_prefs[i] != TLSEXT_comp_cert_none; i++) {
1840 if (!WPACKET_put_bytes_u16(pkt, sc->cert_comp_prefs[i]))
1843 if (!WPACKET_close(pkt) || !WPACKET_close(pkt))
1846 sc->ext.compress_certificate_sent = 1;
1847 return EXT_RETURN_SENT;
1849 SSLfatal(sc, SSL_AD_INTERNAL_ERROR, ERR_R_INTERNAL_ERROR);
1850 return EXT_RETURN_FAIL;
1852 return EXT_RETURN_NOT_SENT;
1856 #ifndef OPENSSL_NO_COMP_ALG
1857 static int tls_comp_in_pref(SSL_CONNECTION *sc, int alg)
1861 /* ossl_comp_has_alg() considers 0 as "any" */
1864 /* Make sure algorithm is enabled */
1865 if (!ossl_comp_has_alg(alg))
1867 /* If no preferences are set, it's ok */
1868 if (sc->cert_comp_prefs[0] == TLSEXT_comp_cert_none)
1870 /* Find the algorithm */
1871 for (i = 0; i < TLSEXT_comp_cert_limit; i++)
1872 if (sc->cert_comp_prefs[i] == alg)
1878 int tls_parse_compress_certificate(SSL_CONNECTION *sc, PACKET *pkt, unsigned int context,
1879 X509 *x, size_t chainidx)
1881 #ifndef OPENSSL_NO_COMP_ALG
1882 PACKET supported_comp_algs;
1884 int already_set[TLSEXT_comp_cert_limit];
1887 /* If no algorithms are available, ignore the extension */
1888 if (!ossl_comp_has_alg(0))
1891 /* Don't attempt to compress a non-X509 (i.e. an RPK) */
1892 if (sc->server && sc->ext.server_cert_type != TLSEXT_cert_type_x509)
1894 if (!sc->server && sc->ext.client_cert_type != TLSEXT_cert_type_x509)
1897 /* Ignore the extension and don't send compressed certificates */
1898 if ((sc->options & SSL_OP_NO_TX_CERTIFICATE_COMPRESSION) != 0)
1901 if (!PACKET_as_length_prefixed_1(pkt, &supported_comp_algs)
1902 || PACKET_remaining(&supported_comp_algs) == 0) {
1903 SSLfatal(sc, SSL_AD_DECODE_ERROR, SSL_R_BAD_EXTENSION);
1907 memset(already_set, 0, sizeof(already_set));
1909 * The preference array has real values, so take a look at each
1910 * value coming in, and make sure it's in our preference list
1911 * The array is 0 (i.e. "none") terminated
1912 * The preference list only contains supported algorithms
1914 while (PACKET_get_net_2(&supported_comp_algs, &comp)) {
1915 if (tls_comp_in_pref(sc, comp) && !already_set[comp]) {
1916 sc->ext.compress_certificate_from_peer[j++] = comp;
1917 already_set[comp] = 1;
1924 static int init_server_cert_type(SSL_CONNECTION *sc, unsigned int context)
1926 /* Only reset when parsing client hello */
1928 sc->ext.server_cert_type_ctos = OSSL_CERT_TYPE_CTOS_NONE;
1929 sc->ext.server_cert_type = TLSEXT_cert_type_x509;
1934 static int init_client_cert_type(SSL_CONNECTION *sc, unsigned int context)
1936 /* Only reset when parsing client hello */
1938 sc->ext.client_cert_type_ctos = OSSL_CERT_TYPE_CTOS_NONE;
1939 sc->ext.client_cert_type = TLSEXT_cert_type_x509;