2 * Copyright 2016-2018 The OpenSSL Project Authors. All Rights Reserved.
4 * Licensed under the OpenSSL license (the "License"). You may not use
5 * this file except in compliance with the License. You can obtain a copy
6 * in the file LICENSE in the source distribution or at
7 * https://www.openssl.org/source/license.html
10 #include <openssl/ocsp.h>
11 #include "../ssl_locl.h"
12 #include "statem_locl.h"
13 #include "internal/cryptlib.h"
15 #define COOKIE_STATE_FORMAT_VERSION 0
18 * 2 bytes for packet length, 2 bytes for format version, 2 bytes for
19 * protocol version, 2 bytes for group id, 2 bytes for cipher id, 1 byte for
20 * key_share present flag, 4 bytes for timestamp, 2 bytes for the hashlen,
21 * EVP_MAX_MD_SIZE for transcript hash, 1 byte for app cookie length, app cookie
22 * length bytes, SHA256_DIGEST_LENGTH bytes for the HMAC of the whole thing.
24 #define MAX_COOKIE_SIZE (2 + 2 + 2 + 2 + 2 + 1 + 4 + 2 + EVP_MAX_MD_SIZE + 1 \
25 + SSL_COOKIE_LENGTH + SHA256_DIGEST_LENGTH)
28 * Message header + 2 bytes for protocol version + number of random bytes +
29 * + 1 byte for legacy session id length + number of bytes in legacy session id
30 * + 2 bytes for ciphersuite + 1 byte for legacy compression
31 * + 2 bytes for extension block length + 6 bytes for key_share extension
32 * + 4 bytes for cookie extension header + the number of bytes in the cookie
34 #define MAX_HRR_SIZE (SSL3_HM_HEADER_LENGTH + 2 + SSL3_RANDOM_SIZE + 1 \
35 + SSL_MAX_SSL_SESSION_ID_LENGTH + 2 + 1 + 2 + 6 + 4 \
39 * Parse the client's renegotiation binding and abort if it's not right
41 int tls_parse_ctos_renegotiate(SSL *s, PACKET *pkt, unsigned int context,
42 X509 *x, size_t chainidx)
45 const unsigned char *data;
47 /* Parse the length byte */
48 if (!PACKET_get_1(pkt, &ilen)
49 || !PACKET_get_bytes(pkt, &data, ilen)) {
50 SSLfatal(s, SSL_AD_DECODE_ERROR, SSL_F_TLS_PARSE_CTOS_RENEGOTIATE,
51 SSL_R_RENEGOTIATION_ENCODING_ERR);
55 /* Check that the extension matches */
56 if (ilen != s->s3->previous_client_finished_len) {
57 SSLfatal(s, SSL_AD_HANDSHAKE_FAILURE, SSL_F_TLS_PARSE_CTOS_RENEGOTIATE,
58 SSL_R_RENEGOTIATION_MISMATCH);
62 if (memcmp(data, s->s3->previous_client_finished,
63 s->s3->previous_client_finished_len)) {
64 SSLfatal(s, SSL_AD_HANDSHAKE_FAILURE, SSL_F_TLS_PARSE_CTOS_RENEGOTIATE,
65 SSL_R_RENEGOTIATION_MISMATCH);
69 s->s3->send_connection_binding = 1;
75 * The servername extension is treated as follows:
77 * - Only the hostname type is supported with a maximum length of 255.
78 * - The servername is rejected if too long or if it contains zeros,
79 * in which case an fatal alert is generated.
80 * - The servername field is maintained together with the session cache.
81 * - When a session is resumed, the servername call back invoked in order
82 * to allow the application to position itself to the right context.
83 * - The servername is acknowledged if it is new for a session or when
84 * it is identical to a previously used for the same session.
85 * Applications can control the behaviour. They can at any time
86 * set a 'desirable' servername for a new SSL object. This can be the
87 * case for example with HTTPS when a Host: header field is received and
88 * a renegotiation is requested. In this case, a possible servername
89 * presented in the new client hello is only acknowledged if it matches
90 * the value of the Host: field.
91 * - Applications must use SSL_OP_NO_SESSION_RESUMPTION_ON_RENEGOTIATION
92 * if they provide for changing an explicit servername context for the
93 * session, i.e. when the session has been established with a servername
95 * - On session reconnect, the servername extension may be absent.
97 int tls_parse_ctos_server_name(SSL *s, PACKET *pkt, unsigned int context,
98 X509 *x, size_t chainidx)
100 unsigned int servname_type;
101 PACKET sni, hostname;
103 if (!PACKET_as_length_prefixed_2(pkt, &sni)
104 /* ServerNameList must be at least 1 byte long. */
105 || PACKET_remaining(&sni) == 0) {
106 SSLfatal(s, SSL_AD_DECODE_ERROR, SSL_F_TLS_PARSE_CTOS_SERVER_NAME,
107 SSL_R_BAD_EXTENSION);
112 * Although the intent was for server_name to be extensible, RFC 4366
113 * was not clear about it; and so OpenSSL among other implementations,
114 * always and only allows a 'host_name' name types.
115 * RFC 6066 corrected the mistake but adding new name types
116 * is nevertheless no longer feasible, so act as if no other
117 * SNI types can exist, to simplify parsing.
119 * Also note that the RFC permits only one SNI value per type,
120 * i.e., we can only have a single hostname.
122 if (!PACKET_get_1(&sni, &servname_type)
123 || servname_type != TLSEXT_NAMETYPE_host_name
124 || !PACKET_as_length_prefixed_2(&sni, &hostname)) {
125 SSLfatal(s, SSL_AD_DECODE_ERROR, SSL_F_TLS_PARSE_CTOS_SERVER_NAME,
126 SSL_R_BAD_EXTENSION);
130 if (!s->hit || SSL_IS_TLS13(s)) {
131 if (PACKET_remaining(&hostname) > TLSEXT_MAXLEN_host_name) {
132 SSLfatal(s, SSL_AD_UNRECOGNIZED_NAME,
133 SSL_F_TLS_PARSE_CTOS_SERVER_NAME,
134 SSL_R_BAD_EXTENSION);
138 if (PACKET_contains_zero_byte(&hostname)) {
139 SSLfatal(s, SSL_AD_UNRECOGNIZED_NAME,
140 SSL_F_TLS_PARSE_CTOS_SERVER_NAME,
141 SSL_R_BAD_EXTENSION);
146 * Store the requested SNI in the SSL as temporary storage.
147 * If we accept it, it will get stored in the SSL_SESSION as well.
149 OPENSSL_free(s->ext.hostname);
150 s->ext.hostname = NULL;
151 if (!PACKET_strndup(&hostname, &s->ext.hostname)) {
152 SSLfatal(s, SSL_AD_INTERNAL_ERROR, SSL_F_TLS_PARSE_CTOS_SERVER_NAME,
153 ERR_R_INTERNAL_ERROR);
157 s->servername_done = 1;
161 * TODO(openssl-team): if the SNI doesn't match, we MUST
162 * fall back to a full handshake.
164 s->servername_done = (s->session->ext.hostname != NULL)
165 && PACKET_equal(&hostname, s->session->ext.hostname,
166 strlen(s->session->ext.hostname));
168 if (!s->servername_done && s->session->ext.hostname != NULL)
169 s->ext.early_data_ok = 0;
175 int tls_parse_ctos_maxfragmentlen(SSL *s, PACKET *pkt, unsigned int context,
176 X509 *x, size_t chainidx)
180 if (PACKET_remaining(pkt) != 1 || !PACKET_get_1(pkt, &value)) {
181 SSLfatal(s, SSL_AD_DECODE_ERROR, SSL_F_TLS_PARSE_CTOS_MAXFRAGMENTLEN,
182 SSL_R_BAD_EXTENSION);
186 /* Received |value| should be a valid max-fragment-length code. */
187 if (!IS_MAX_FRAGMENT_LENGTH_EXT_VALID(value)) {
188 SSLfatal(s, SSL_AD_ILLEGAL_PARAMETER,
189 SSL_F_TLS_PARSE_CTOS_MAXFRAGMENTLEN,
190 SSL_R_SSL3_EXT_INVALID_MAX_FRAGMENT_LENGTH);
195 * RFC 6066: The negotiated length applies for the duration of the session
196 * including session resumptions.
197 * We should receive the same code as in resumed session !
199 if (s->hit && s->session->ext.max_fragment_len_mode != value) {
200 SSLfatal(s, SSL_AD_ILLEGAL_PARAMETER,
201 SSL_F_TLS_PARSE_CTOS_MAXFRAGMENTLEN,
202 SSL_R_SSL3_EXT_INVALID_MAX_FRAGMENT_LENGTH);
207 * Store it in session, so it'll become binding for us
208 * and we'll include it in a next Server Hello.
210 s->session->ext.max_fragment_len_mode = value;
214 #ifndef OPENSSL_NO_SRP
215 int tls_parse_ctos_srp(SSL *s, PACKET *pkt, unsigned int context, X509 *x,
220 if (!PACKET_as_length_prefixed_1(pkt, &srp_I)
221 || PACKET_contains_zero_byte(&srp_I)) {
222 SSLfatal(s, SSL_AD_DECODE_ERROR,
223 SSL_F_TLS_PARSE_CTOS_SRP,
224 SSL_R_BAD_EXTENSION);
229 * TODO(openssl-team): currently, we re-authenticate the user
230 * upon resumption. Instead, we MUST ignore the login.
232 if (!PACKET_strndup(&srp_I, &s->srp_ctx.login)) {
233 SSLfatal(s, SSL_AD_INTERNAL_ERROR, SSL_F_TLS_PARSE_CTOS_SRP,
234 ERR_R_INTERNAL_ERROR);
242 #ifndef OPENSSL_NO_EC
243 int tls_parse_ctos_ec_pt_formats(SSL *s, PACKET *pkt, unsigned int context,
244 X509 *x, size_t chainidx)
246 PACKET ec_point_format_list;
248 if (!PACKET_as_length_prefixed_1(pkt, &ec_point_format_list)
249 || PACKET_remaining(&ec_point_format_list) == 0) {
250 SSLfatal(s, SSL_AD_DECODE_ERROR, SSL_F_TLS_PARSE_CTOS_EC_PT_FORMATS,
251 SSL_R_BAD_EXTENSION);
256 if (!PACKET_memdup(&ec_point_format_list,
257 &s->session->ext.ecpointformats,
258 &s->session->ext.ecpointformats_len)) {
259 SSLfatal(s, SSL_AD_INTERNAL_ERROR,
260 SSL_F_TLS_PARSE_CTOS_EC_PT_FORMATS, ERR_R_INTERNAL_ERROR);
267 #endif /* OPENSSL_NO_EC */
269 int tls_parse_ctos_session_ticket(SSL *s, PACKET *pkt, unsigned int context,
270 X509 *x, size_t chainidx)
272 if (s->ext.session_ticket_cb &&
273 !s->ext.session_ticket_cb(s, PACKET_data(pkt),
274 PACKET_remaining(pkt),
275 s->ext.session_ticket_cb_arg)) {
276 SSLfatal(s, SSL_AD_INTERNAL_ERROR,
277 SSL_F_TLS_PARSE_CTOS_SESSION_TICKET, ERR_R_INTERNAL_ERROR);
284 int tls_parse_ctos_sig_algs_cert(SSL *s, PACKET *pkt, unsigned int context,
285 X509 *x, size_t chainidx)
287 PACKET supported_sig_algs;
289 if (!PACKET_as_length_prefixed_2(pkt, &supported_sig_algs)
290 || PACKET_remaining(&supported_sig_algs) == 0) {
291 SSLfatal(s, SSL_AD_DECODE_ERROR,
292 SSL_F_TLS_PARSE_CTOS_SIG_ALGS_CERT, SSL_R_BAD_EXTENSION);
296 if (!s->hit && !tls1_save_sigalgs(s, &supported_sig_algs, 1)) {
297 SSLfatal(s, SSL_AD_DECODE_ERROR,
298 SSL_F_TLS_PARSE_CTOS_SIG_ALGS_CERT, SSL_R_BAD_EXTENSION);
305 int tls_parse_ctos_sig_algs(SSL *s, PACKET *pkt, unsigned int context, X509 *x,
308 PACKET supported_sig_algs;
310 if (!PACKET_as_length_prefixed_2(pkt, &supported_sig_algs)
311 || PACKET_remaining(&supported_sig_algs) == 0) {
312 SSLfatal(s, SSL_AD_DECODE_ERROR,
313 SSL_F_TLS_PARSE_CTOS_SIG_ALGS, SSL_R_BAD_EXTENSION);
317 if (!s->hit && !tls1_save_sigalgs(s, &supported_sig_algs, 0)) {
318 SSLfatal(s, SSL_AD_DECODE_ERROR,
319 SSL_F_TLS_PARSE_CTOS_SIG_ALGS, SSL_R_BAD_EXTENSION);
326 #ifndef OPENSSL_NO_OCSP
327 int tls_parse_ctos_status_request(SSL *s, PACKET *pkt, unsigned int context,
328 X509 *x, size_t chainidx)
330 PACKET responder_id_list, exts;
332 /* We ignore this in a resumption handshake */
336 /* Not defined if we get one of these in a client Certificate */
340 if (!PACKET_get_1(pkt, (unsigned int *)&s->ext.status_type)) {
341 SSLfatal(s, SSL_AD_DECODE_ERROR,
342 SSL_F_TLS_PARSE_CTOS_STATUS_REQUEST, SSL_R_BAD_EXTENSION);
346 if (s->ext.status_type != TLSEXT_STATUSTYPE_ocsp) {
348 * We don't know what to do with any other type so ignore it.
350 s->ext.status_type = TLSEXT_STATUSTYPE_nothing;
354 if (!PACKET_get_length_prefixed_2 (pkt, &responder_id_list)) {
355 SSLfatal(s, SSL_AD_DECODE_ERROR,
356 SSL_F_TLS_PARSE_CTOS_STATUS_REQUEST, SSL_R_BAD_EXTENSION);
361 * We remove any OCSP_RESPIDs from a previous handshake
362 * to prevent unbounded memory growth - CVE-2016-6304
364 sk_OCSP_RESPID_pop_free(s->ext.ocsp.ids, OCSP_RESPID_free);
365 if (PACKET_remaining(&responder_id_list) > 0) {
366 s->ext.ocsp.ids = sk_OCSP_RESPID_new_null();
367 if (s->ext.ocsp.ids == NULL) {
368 SSLfatal(s, SSL_AD_INTERNAL_ERROR,
369 SSL_F_TLS_PARSE_CTOS_STATUS_REQUEST, ERR_R_MALLOC_FAILURE);
373 s->ext.ocsp.ids = NULL;
376 while (PACKET_remaining(&responder_id_list) > 0) {
379 const unsigned char *id_data;
381 if (!PACKET_get_length_prefixed_2(&responder_id_list, &responder_id)
382 || PACKET_remaining(&responder_id) == 0) {
383 SSLfatal(s, SSL_AD_DECODE_ERROR,
384 SSL_F_TLS_PARSE_CTOS_STATUS_REQUEST, SSL_R_BAD_EXTENSION);
388 id_data = PACKET_data(&responder_id);
389 /* TODO(size_t): Convert d2i_* to size_t */
390 id = d2i_OCSP_RESPID(NULL, &id_data,
391 (int)PACKET_remaining(&responder_id));
393 SSLfatal(s, SSL_AD_DECODE_ERROR,
394 SSL_F_TLS_PARSE_CTOS_STATUS_REQUEST, SSL_R_BAD_EXTENSION);
398 if (id_data != PACKET_end(&responder_id)) {
399 OCSP_RESPID_free(id);
400 SSLfatal(s, SSL_AD_DECODE_ERROR,
401 SSL_F_TLS_PARSE_CTOS_STATUS_REQUEST, SSL_R_BAD_EXTENSION);
406 if (!sk_OCSP_RESPID_push(s->ext.ocsp.ids, id)) {
407 OCSP_RESPID_free(id);
408 SSLfatal(s, SSL_AD_INTERNAL_ERROR,
409 SSL_F_TLS_PARSE_CTOS_STATUS_REQUEST, ERR_R_INTERNAL_ERROR);
415 /* Read in request_extensions */
416 if (!PACKET_as_length_prefixed_2(pkt, &exts)) {
417 SSLfatal(s, SSL_AD_DECODE_ERROR,
418 SSL_F_TLS_PARSE_CTOS_STATUS_REQUEST, SSL_R_BAD_EXTENSION);
422 if (PACKET_remaining(&exts) > 0) {
423 const unsigned char *ext_data = PACKET_data(&exts);
425 sk_X509_EXTENSION_pop_free(s->ext.ocsp.exts,
426 X509_EXTENSION_free);
428 d2i_X509_EXTENSIONS(NULL, &ext_data, (int)PACKET_remaining(&exts));
429 if (s->ext.ocsp.exts == NULL || ext_data != PACKET_end(&exts)) {
430 SSLfatal(s, SSL_AD_DECODE_ERROR,
431 SSL_F_TLS_PARSE_CTOS_STATUS_REQUEST, SSL_R_BAD_EXTENSION);
440 #ifndef OPENSSL_NO_NEXTPROTONEG
441 int tls_parse_ctos_npn(SSL *s, PACKET *pkt, unsigned int context, X509 *x,
445 * We shouldn't accept this extension on a
448 if (SSL_IS_FIRST_HANDSHAKE(s))
456 * Save the ALPN extension in a ClientHello.|pkt| holds the contents of the ALPN
457 * extension, not including type and length. Returns: 1 on success, 0 on error.
459 int tls_parse_ctos_alpn(SSL *s, PACKET *pkt, unsigned int context, X509 *x,
462 PACKET protocol_list, save_protocol_list, protocol;
464 if (!SSL_IS_FIRST_HANDSHAKE(s))
467 if (!PACKET_as_length_prefixed_2(pkt, &protocol_list)
468 || PACKET_remaining(&protocol_list) < 2) {
469 SSLfatal(s, SSL_AD_DECODE_ERROR, SSL_F_TLS_PARSE_CTOS_ALPN,
470 SSL_R_BAD_EXTENSION);
474 save_protocol_list = protocol_list;
476 /* Protocol names can't be empty. */
477 if (!PACKET_get_length_prefixed_1(&protocol_list, &protocol)
478 || PACKET_remaining(&protocol) == 0) {
479 SSLfatal(s, SSL_AD_DECODE_ERROR, SSL_F_TLS_PARSE_CTOS_ALPN,
480 SSL_R_BAD_EXTENSION);
483 } while (PACKET_remaining(&protocol_list) != 0);
485 OPENSSL_free(s->s3->alpn_proposed);
486 s->s3->alpn_proposed = NULL;
487 s->s3->alpn_proposed_len = 0;
488 if (!PACKET_memdup(&save_protocol_list,
489 &s->s3->alpn_proposed, &s->s3->alpn_proposed_len)) {
490 SSLfatal(s, SSL_AD_INTERNAL_ERROR, SSL_F_TLS_PARSE_CTOS_ALPN,
491 ERR_R_INTERNAL_ERROR);
498 #ifndef OPENSSL_NO_SRTP
499 int tls_parse_ctos_use_srtp(SSL *s, PACKET *pkt, unsigned int context, X509 *x,
502 STACK_OF(SRTP_PROTECTION_PROFILE) *srvr;
503 unsigned int ct, mki_len, id;
507 /* Ignore this if we have no SRTP profiles */
508 if (SSL_get_srtp_profiles(s) == NULL)
511 /* Pull off the length of the cipher suite list and check it is even */
512 if (!PACKET_get_net_2(pkt, &ct) || (ct & 1) != 0
513 || !PACKET_get_sub_packet(pkt, &subpkt, ct)) {
514 SSLfatal(s, SSL_AD_DECODE_ERROR, SSL_F_TLS_PARSE_CTOS_USE_SRTP,
515 SSL_R_BAD_SRTP_PROTECTION_PROFILE_LIST);
519 srvr = SSL_get_srtp_profiles(s);
520 s->srtp_profile = NULL;
521 /* Search all profiles for a match initially */
522 srtp_pref = sk_SRTP_PROTECTION_PROFILE_num(srvr);
524 while (PACKET_remaining(&subpkt)) {
525 if (!PACKET_get_net_2(&subpkt, &id)) {
526 SSLfatal(s, SSL_AD_DECODE_ERROR, SSL_F_TLS_PARSE_CTOS_USE_SRTP,
527 SSL_R_BAD_SRTP_PROTECTION_PROFILE_LIST);
532 * Only look for match in profiles of higher preference than
534 * If no profiles have been have been configured then this
537 for (i = 0; i < srtp_pref; i++) {
538 SRTP_PROTECTION_PROFILE *sprof =
539 sk_SRTP_PROTECTION_PROFILE_value(srvr, i);
541 if (sprof->id == id) {
542 s->srtp_profile = sprof;
549 /* Now extract the MKI value as a sanity check, but discard it for now */
550 if (!PACKET_get_1(pkt, &mki_len)) {
551 SSLfatal(s, SSL_AD_DECODE_ERROR, SSL_F_TLS_PARSE_CTOS_USE_SRTP,
552 SSL_R_BAD_SRTP_PROTECTION_PROFILE_LIST);
556 if (!PACKET_forward(pkt, mki_len)
557 || PACKET_remaining(pkt)) {
558 SSLfatal(s, SSL_AD_DECODE_ERROR, SSL_F_TLS_PARSE_CTOS_USE_SRTP,
559 SSL_R_BAD_SRTP_MKI_VALUE);
567 int tls_parse_ctos_etm(SSL *s, PACKET *pkt, unsigned int context, X509 *x,
570 if (!(s->options & SSL_OP_NO_ENCRYPT_THEN_MAC))
577 * Process a psk_kex_modes extension received in the ClientHello. |pkt| contains
578 * the raw PACKET data for the extension. Returns 1 on success or 0 on failure.
580 int tls_parse_ctos_psk_kex_modes(SSL *s, PACKET *pkt, unsigned int context,
581 X509 *x, size_t chainidx)
583 #ifndef OPENSSL_NO_TLS1_3
584 PACKET psk_kex_modes;
587 if (!PACKET_as_length_prefixed_1(pkt, &psk_kex_modes)
588 || PACKET_remaining(&psk_kex_modes) == 0) {
589 SSLfatal(s, SSL_AD_DECODE_ERROR, SSL_F_TLS_PARSE_CTOS_PSK_KEX_MODES,
590 SSL_R_BAD_EXTENSION);
594 while (PACKET_get_1(&psk_kex_modes, &mode)) {
595 if (mode == TLSEXT_KEX_MODE_KE_DHE)
596 s->ext.psk_kex_mode |= TLSEXT_KEX_MODE_FLAG_KE_DHE;
597 else if (mode == TLSEXT_KEX_MODE_KE
598 && (s->options & SSL_OP_ALLOW_NO_DHE_KEX) != 0)
599 s->ext.psk_kex_mode |= TLSEXT_KEX_MODE_FLAG_KE;
607 * Process a key_share extension received in the ClientHello. |pkt| contains
608 * the raw PACKET data for the extension. Returns 1 on success or 0 on failure.
610 int tls_parse_ctos_key_share(SSL *s, PACKET *pkt, unsigned int context, X509 *x,
613 #ifndef OPENSSL_NO_TLS1_3
614 unsigned int group_id;
615 PACKET key_share_list, encoded_pt;
616 const uint16_t *clntgroups, *srvrgroups;
617 size_t clnt_num_groups, srvr_num_groups;
620 if (s->hit && (s->ext.psk_kex_mode & TLSEXT_KEX_MODE_FLAG_KE_DHE) == 0)
624 if (s->s3->peer_tmp != NULL) {
625 SSLfatal(s, SSL_AD_INTERNAL_ERROR, SSL_F_TLS_PARSE_CTOS_KEY_SHARE,
626 ERR_R_INTERNAL_ERROR);
630 if (!PACKET_as_length_prefixed_2(pkt, &key_share_list)) {
631 SSLfatal(s, SSL_AD_DECODE_ERROR, SSL_F_TLS_PARSE_CTOS_KEY_SHARE,
632 SSL_R_LENGTH_MISMATCH);
636 /* Get our list of supported groups */
637 tls1_get_supported_groups(s, &srvrgroups, &srvr_num_groups);
638 /* Get the clients list of supported groups. */
639 tls1_get_peer_groups(s, &clntgroups, &clnt_num_groups);
640 if (clnt_num_groups == 0) {
642 * This can only happen if the supported_groups extension was not sent,
643 * because we verify that the length is non-zero when we process that
646 SSLfatal(s, SSL_AD_MISSING_EXTENSION, SSL_F_TLS_PARSE_CTOS_KEY_SHARE,
647 SSL_R_MISSING_SUPPORTED_GROUPS_EXTENSION);
651 if (s->s3->group_id != 0 && PACKET_remaining(&key_share_list) == 0) {
653 * If we set a group_id already, then we must have sent an HRR
654 * requesting a new key_share. If we haven't got one then that is an
657 SSLfatal(s, SSL_AD_ILLEGAL_PARAMETER, SSL_F_TLS_PARSE_CTOS_KEY_SHARE,
658 SSL_R_BAD_KEY_SHARE);
662 while (PACKET_remaining(&key_share_list) > 0) {
663 if (!PACKET_get_net_2(&key_share_list, &group_id)
664 || !PACKET_get_length_prefixed_2(&key_share_list, &encoded_pt)
665 || PACKET_remaining(&encoded_pt) == 0) {
666 SSLfatal(s, SSL_AD_DECODE_ERROR, SSL_F_TLS_PARSE_CTOS_KEY_SHARE,
667 SSL_R_LENGTH_MISMATCH);
672 * If we already found a suitable key_share we loop through the
673 * rest to verify the structure, but don't process them.
679 * If we sent an HRR then the key_share sent back MUST be for the group
680 * we requested, and must be the only key_share sent.
682 if (s->s3->group_id != 0
683 && (group_id != s->s3->group_id
684 || PACKET_remaining(&key_share_list) != 0)) {
685 SSLfatal(s, SSL_AD_ILLEGAL_PARAMETER,
686 SSL_F_TLS_PARSE_CTOS_KEY_SHARE, SSL_R_BAD_KEY_SHARE);
690 /* Check if this share is in supported_groups sent from client */
691 if (!check_in_list(s, group_id, clntgroups, clnt_num_groups, 0)) {
692 SSLfatal(s, SSL_AD_ILLEGAL_PARAMETER,
693 SSL_F_TLS_PARSE_CTOS_KEY_SHARE, SSL_R_BAD_KEY_SHARE);
697 /* Check if this share is for a group we can use */
698 if (!check_in_list(s, group_id, srvrgroups, srvr_num_groups, 1)) {
699 /* Share not suitable */
703 if ((s->s3->peer_tmp = ssl_generate_param_group(group_id)) == NULL) {
704 SSLfatal(s, SSL_AD_INTERNAL_ERROR, SSL_F_TLS_PARSE_CTOS_KEY_SHARE,
705 SSL_R_UNABLE_TO_FIND_ECDH_PARAMETERS);
709 s->s3->group_id = group_id;
711 if (!EVP_PKEY_set1_tls_encodedpoint(s->s3->peer_tmp,
712 PACKET_data(&encoded_pt),
713 PACKET_remaining(&encoded_pt))) {
714 SSLfatal(s, SSL_AD_ILLEGAL_PARAMETER,
715 SSL_F_TLS_PARSE_CTOS_KEY_SHARE, SSL_R_BAD_ECPOINT);
726 int tls_parse_ctos_cookie(SSL *s, PACKET *pkt, unsigned int context, X509 *x,
729 #ifndef OPENSSL_NO_TLS1_3
730 unsigned int format, version, key_share, group_id;
733 PACKET cookie, raw, chhash, appcookie;
735 const unsigned char *data, *mdin, *ciphdata;
736 unsigned char hmac[SHA256_DIGEST_LENGTH];
737 unsigned char hrr[MAX_HRR_SIZE];
738 size_t rawlen, hmaclen, hrrlen, ciphlen;
739 unsigned long tm, now;
741 /* Ignore any cookie if we're not set up to verify it */
742 if (s->ctx->verify_stateless_cookie_cb == NULL
743 || (s->s3->flags & TLS1_FLAGS_STATELESS) == 0)
746 if (!PACKET_as_length_prefixed_2(pkt, &cookie)) {
747 SSLfatal(s, SSL_AD_DECODE_ERROR, SSL_F_TLS_PARSE_CTOS_COOKIE,
748 SSL_R_LENGTH_MISMATCH);
753 data = PACKET_data(&raw);
754 rawlen = PACKET_remaining(&raw);
755 if (rawlen < SHA256_DIGEST_LENGTH
756 || !PACKET_forward(&raw, rawlen - SHA256_DIGEST_LENGTH)) {
757 SSLfatal(s, SSL_AD_DECODE_ERROR, SSL_F_TLS_PARSE_CTOS_COOKIE,
758 SSL_R_LENGTH_MISMATCH);
761 mdin = PACKET_data(&raw);
763 /* Verify the HMAC of the cookie */
764 hctx = EVP_MD_CTX_create();
765 pkey = EVP_PKEY_new_raw_private_key(EVP_PKEY_HMAC, NULL,
766 s->session_ctx->ext.cookie_hmac_key,
767 sizeof(s->session_ctx->ext
769 if (hctx == NULL || pkey == NULL) {
770 EVP_MD_CTX_free(hctx);
772 SSLfatal(s, SSL_AD_INTERNAL_ERROR, SSL_F_TLS_PARSE_CTOS_COOKIE,
773 ERR_R_MALLOC_FAILURE);
777 hmaclen = SHA256_DIGEST_LENGTH;
778 if (EVP_DigestSignInit(hctx, NULL, EVP_sha256(), NULL, pkey) <= 0
779 || EVP_DigestSign(hctx, hmac, &hmaclen, data,
780 rawlen - SHA256_DIGEST_LENGTH) <= 0
781 || hmaclen != SHA256_DIGEST_LENGTH) {
782 EVP_MD_CTX_free(hctx);
784 SSLfatal(s, SSL_AD_INTERNAL_ERROR, SSL_F_TLS_PARSE_CTOS_COOKIE,
785 ERR_R_INTERNAL_ERROR);
789 EVP_MD_CTX_free(hctx);
792 if (CRYPTO_memcmp(hmac, mdin, SHA256_DIGEST_LENGTH) != 0) {
793 SSLfatal(s, SSL_AD_ILLEGAL_PARAMETER, SSL_F_TLS_PARSE_CTOS_COOKIE,
794 SSL_R_COOKIE_MISMATCH);
798 if (!PACKET_get_net_2(&cookie, &format)) {
799 SSLfatal(s, SSL_AD_DECODE_ERROR, SSL_F_TLS_PARSE_CTOS_COOKIE,
800 SSL_R_LENGTH_MISMATCH);
803 /* Check the cookie format is something we recognise. Ignore it if not */
804 if (format != COOKIE_STATE_FORMAT_VERSION)
808 * The rest of these checks really shouldn't fail since we have verified the
812 /* Check the version number is sane */
813 if (!PACKET_get_net_2(&cookie, &version)) {
814 SSLfatal(s, SSL_AD_DECODE_ERROR, SSL_F_TLS_PARSE_CTOS_COOKIE,
815 SSL_R_LENGTH_MISMATCH);
818 if (version != TLS1_3_VERSION) {
819 SSLfatal(s, SSL_AD_ILLEGAL_PARAMETER, SSL_F_TLS_PARSE_CTOS_COOKIE,
820 SSL_R_BAD_PROTOCOL_VERSION_NUMBER);
824 if (!PACKET_get_net_2(&cookie, &group_id)) {
825 SSLfatal(s, SSL_AD_DECODE_ERROR, SSL_F_TLS_PARSE_CTOS_COOKIE,
826 SSL_R_LENGTH_MISMATCH);
830 ciphdata = PACKET_data(&cookie);
831 if (!PACKET_forward(&cookie, 2)) {
832 SSLfatal(s, SSL_AD_DECODE_ERROR, SSL_F_TLS_PARSE_CTOS_COOKIE,
833 SSL_R_LENGTH_MISMATCH);
836 if (group_id != s->s3->group_id
837 || s->s3->tmp.new_cipher
838 != ssl_get_cipher_by_char(s, ciphdata, 0)) {
840 * We chose a different cipher or group id this time around to what is
841 * in the cookie. Something must have changed.
843 SSLfatal(s, SSL_AD_ILLEGAL_PARAMETER, SSL_F_TLS_PARSE_CTOS_COOKIE,
848 if (!PACKET_get_1(&cookie, &key_share)
849 || !PACKET_get_net_4(&cookie, &tm)
850 || !PACKET_get_length_prefixed_2(&cookie, &chhash)
851 || !PACKET_get_length_prefixed_1(&cookie, &appcookie)
852 || PACKET_remaining(&cookie) != SHA256_DIGEST_LENGTH) {
853 SSLfatal(s, SSL_AD_DECODE_ERROR, SSL_F_TLS_PARSE_CTOS_COOKIE,
854 SSL_R_LENGTH_MISMATCH);
858 /* We tolerate a cookie age of up to 10 minutes (= 60 * 10 seconds) */
859 now = (unsigned long)time(NULL);
860 if (tm > now || (now - tm) > 600) {
861 /* Cookie is stale. Ignore it */
865 /* Verify the app cookie */
866 if (s->ctx->verify_stateless_cookie_cb(s, PACKET_data(&appcookie),
867 PACKET_remaining(&appcookie)) == 0) {
868 SSLfatal(s, SSL_AD_ILLEGAL_PARAMETER, SSL_F_TLS_PARSE_CTOS_COOKIE,
869 SSL_R_COOKIE_MISMATCH);
874 * Reconstruct the HRR that we would have sent in response to the original
875 * ClientHello so we can add it to the transcript hash.
876 * Note: This won't work with custom HRR extensions
878 if (!WPACKET_init_static_len(&hrrpkt, hrr, sizeof(hrr), 0)) {
879 SSLfatal(s, SSL_AD_INTERNAL_ERROR, SSL_F_TLS_PARSE_CTOS_COOKIE,
880 ERR_R_INTERNAL_ERROR);
883 if (!WPACKET_put_bytes_u8(&hrrpkt, SSL3_MT_SERVER_HELLO)
884 || !WPACKET_start_sub_packet_u24(&hrrpkt)
885 || !WPACKET_put_bytes_u16(&hrrpkt, TLS1_2_VERSION)
886 || !WPACKET_memcpy(&hrrpkt, hrrrandom, SSL3_RANDOM_SIZE)
887 || !WPACKET_sub_memcpy_u8(&hrrpkt, s->tmp_session_id,
888 s->tmp_session_id_len)
889 || !s->method->put_cipher_by_char(s->s3->tmp.new_cipher, &hrrpkt,
891 || !WPACKET_put_bytes_u8(&hrrpkt, 0)
892 || !WPACKET_start_sub_packet_u16(&hrrpkt)) {
893 WPACKET_cleanup(&hrrpkt);
894 SSLfatal(s, SSL_AD_INTERNAL_ERROR, SSL_F_TLS_PARSE_CTOS_COOKIE,
895 ERR_R_INTERNAL_ERROR);
898 if (!WPACKET_put_bytes_u16(&hrrpkt, TLSEXT_TYPE_supported_versions)
899 || !WPACKET_start_sub_packet_u16(&hrrpkt)
900 /* TODO(TLS1.3): Fix this before release */
901 || !WPACKET_put_bytes_u16(&hrrpkt, s->version_draft)
902 || !WPACKET_close(&hrrpkt)) {
903 WPACKET_cleanup(&hrrpkt);
904 SSLfatal(s, SSL_AD_INTERNAL_ERROR, SSL_F_TLS_PARSE_CTOS_COOKIE,
905 ERR_R_INTERNAL_ERROR);
909 if (!WPACKET_put_bytes_u16(&hrrpkt, TLSEXT_TYPE_key_share)
910 || !WPACKET_start_sub_packet_u16(&hrrpkt)
911 || !WPACKET_put_bytes_u16(&hrrpkt, s->s3->group_id)
912 || !WPACKET_close(&hrrpkt)) {
913 WPACKET_cleanup(&hrrpkt);
914 SSLfatal(s, SSL_AD_INTERNAL_ERROR, SSL_F_TLS_PARSE_CTOS_COOKIE,
915 ERR_R_INTERNAL_ERROR);
919 if (!WPACKET_put_bytes_u16(&hrrpkt, TLSEXT_TYPE_cookie)
920 || !WPACKET_start_sub_packet_u16(&hrrpkt)
921 || !WPACKET_sub_memcpy_u16(&hrrpkt, data, rawlen)
922 || !WPACKET_close(&hrrpkt) /* cookie extension */
923 || !WPACKET_close(&hrrpkt) /* extension block */
924 || !WPACKET_close(&hrrpkt) /* message */
925 || !WPACKET_get_total_written(&hrrpkt, &hrrlen)
926 || !WPACKET_finish(&hrrpkt)) {
927 WPACKET_cleanup(&hrrpkt);
928 SSLfatal(s, SSL_AD_INTERNAL_ERROR, SSL_F_TLS_PARSE_CTOS_COOKIE,
929 ERR_R_INTERNAL_ERROR);
933 /* Reconstruct the transcript hash */
934 if (!create_synthetic_message_hash(s, PACKET_data(&chhash),
935 PACKET_remaining(&chhash), hrr,
937 /* SSLfatal() already called */
941 /* Act as if this ClientHello came after a HelloRetryRequest */
942 s->hello_retry_request = 1;
950 #ifndef OPENSSL_NO_EC
951 int tls_parse_ctos_supported_groups(SSL *s, PACKET *pkt, unsigned int context,
952 X509 *x, size_t chainidx)
954 PACKET supported_groups_list;
956 /* Each group is 2 bytes and we must have at least 1. */
957 if (!PACKET_as_length_prefixed_2(pkt, &supported_groups_list)
958 || PACKET_remaining(&supported_groups_list) == 0
959 || (PACKET_remaining(&supported_groups_list) % 2) != 0) {
960 SSLfatal(s, SSL_AD_DECODE_ERROR,
961 SSL_F_TLS_PARSE_CTOS_SUPPORTED_GROUPS, SSL_R_BAD_EXTENSION);
965 if (!s->hit || SSL_IS_TLS13(s)) {
966 OPENSSL_free(s->session->ext.supportedgroups);
967 s->session->ext.supportedgroups = NULL;
968 s->session->ext.supportedgroups_len = 0;
969 if (!tls1_save_u16(&supported_groups_list,
970 &s->session->ext.supportedgroups,
971 &s->session->ext.supportedgroups_len)) {
972 SSLfatal(s, SSL_AD_INTERNAL_ERROR,
973 SSL_F_TLS_PARSE_CTOS_SUPPORTED_GROUPS,
974 ERR_R_INTERNAL_ERROR);
983 int tls_parse_ctos_ems(SSL *s, PACKET *pkt, unsigned int context, X509 *x,
986 /* The extension must always be empty */
987 if (PACKET_remaining(pkt) != 0) {
988 SSLfatal(s, SSL_AD_DECODE_ERROR,
989 SSL_F_TLS_PARSE_CTOS_EMS, SSL_R_BAD_EXTENSION);
993 s->s3->flags |= TLS1_FLAGS_RECEIVED_EXTMS;
999 int tls_parse_ctos_early_data(SSL *s, PACKET *pkt, unsigned int context,
1000 X509 *x, size_t chainidx)
1002 if (PACKET_remaining(pkt) != 0) {
1003 SSLfatal(s, SSL_AD_DECODE_ERROR,
1004 SSL_F_TLS_PARSE_CTOS_EARLY_DATA, SSL_R_BAD_EXTENSION);
1008 if (s->hello_retry_request != SSL_HRR_NONE) {
1009 SSLfatal(s, SSL_AD_ILLEGAL_PARAMETER,
1010 SSL_F_TLS_PARSE_CTOS_EARLY_DATA, SSL_R_BAD_EXTENSION);
1017 static SSL_TICKET_STATUS tls_get_stateful_ticket(SSL *s, PACKET *tick,
1020 SSL_SESSION *tmpsess = NULL;
1022 s->ext.ticket_expected = 1;
1024 switch (PACKET_remaining(tick)) {
1026 return SSL_TICKET_EMPTY;
1028 case SSL_MAX_SSL_SESSION_ID_LENGTH:
1032 return SSL_TICKET_NO_DECRYPT;
1035 tmpsess = lookup_sess_in_cache(s, PACKET_data(tick),
1036 SSL_MAX_SSL_SESSION_ID_LENGTH);
1038 if (tmpsess == NULL)
1039 return SSL_TICKET_NO_DECRYPT;
1042 return SSL_TICKET_SUCCESS;
1045 int tls_parse_ctos_psk(SSL *s, PACKET *pkt, unsigned int context, X509 *x,
1048 PACKET identities, binders, binder;
1049 size_t binderoffset, hashsize;
1050 SSL_SESSION *sess = NULL;
1051 unsigned int id, i, ext = 0;
1052 const EVP_MD *md = NULL;
1055 * If we have no PSK kex mode that we recognise then we can't resume so
1056 * ignore this extension
1058 if ((s->ext.psk_kex_mode
1059 & (TLSEXT_KEX_MODE_FLAG_KE | TLSEXT_KEX_MODE_FLAG_KE_DHE)) == 0)
1062 if (!PACKET_get_length_prefixed_2(pkt, &identities)) {
1063 SSLfatal(s, SSL_AD_DECODE_ERROR,
1064 SSL_F_TLS_PARSE_CTOS_PSK, SSL_R_BAD_EXTENSION);
1068 s->ext.ticket_expected = 0;
1069 for (id = 0; PACKET_remaining(&identities) != 0; id++) {
1071 unsigned long ticket_agel;
1074 if (!PACKET_get_length_prefixed_2(&identities, &identity)
1075 || !PACKET_get_net_4(&identities, &ticket_agel)) {
1076 SSLfatal(s, SSL_AD_DECODE_ERROR,
1077 SSL_F_TLS_PARSE_CTOS_PSK, SSL_R_BAD_EXTENSION);
1081 idlen = PACKET_remaining(&identity);
1082 if (s->psk_find_session_cb != NULL
1083 && !s->psk_find_session_cb(s, PACKET_data(&identity), idlen,
1085 SSLfatal(s, SSL_AD_INTERNAL_ERROR,
1086 SSL_F_TLS_PARSE_CTOS_PSK, SSL_R_BAD_EXTENSION);
1090 #ifndef OPENSSL_NO_PSK
1092 && s->psk_server_callback != NULL
1093 && idlen <= PSK_MAX_IDENTITY_LEN) {
1095 unsigned char pskdata[PSK_MAX_PSK_LEN];
1096 unsigned int pskdatalen;
1098 if (!PACKET_strndup(&identity, &pskid)) {
1099 SSLfatal(s, SSL_AD_INTERNAL_ERROR, SSL_F_TLS_PARSE_CTOS_PSK,
1100 ERR_R_INTERNAL_ERROR);
1103 pskdatalen = s->psk_server_callback(s, pskid, pskdata,
1105 OPENSSL_free(pskid);
1106 if (pskdatalen > PSK_MAX_PSK_LEN) {
1107 SSLfatal(s, SSL_AD_INTERNAL_ERROR, SSL_F_TLS_PARSE_CTOS_PSK,
1108 ERR_R_INTERNAL_ERROR);
1110 } else if (pskdatalen > 0) {
1111 const SSL_CIPHER *cipher;
1112 const unsigned char tls13_aes128gcmsha256_id[] = { 0x13, 0x01 };
1115 * We found a PSK using an old style callback. We don't know
1116 * the digest so we default to SHA256 as per the TLSv1.3 spec
1118 cipher = SSL_CIPHER_find(s, tls13_aes128gcmsha256_id);
1119 if (cipher == NULL) {
1120 OPENSSL_cleanse(pskdata, pskdatalen);
1121 SSLfatal(s, SSL_AD_INTERNAL_ERROR, SSL_F_TLS_PARSE_CTOS_PSK,
1122 ERR_R_INTERNAL_ERROR);
1126 sess = SSL_SESSION_new();
1128 || !SSL_SESSION_set1_master_key(sess, pskdata,
1130 || !SSL_SESSION_set_cipher(sess, cipher)
1131 || !SSL_SESSION_set_protocol_version(sess,
1133 OPENSSL_cleanse(pskdata, pskdatalen);
1134 SSLfatal(s, SSL_AD_INTERNAL_ERROR, SSL_F_TLS_PARSE_CTOS_PSK,
1135 ERR_R_INTERNAL_ERROR);
1138 OPENSSL_cleanse(pskdata, pskdatalen);
1141 #endif /* OPENSSL_NO_PSK */
1144 /* We found a PSK */
1145 SSL_SESSION *sesstmp = ssl_session_dup(sess, 0);
1147 if (sesstmp == NULL) {
1148 SSLfatal(s, SSL_AD_INTERNAL_ERROR,
1149 SSL_F_TLS_PARSE_CTOS_PSK, ERR_R_INTERNAL_ERROR);
1152 SSL_SESSION_free(sess);
1156 * We've just been told to use this session for this context so
1157 * make sure the sid_ctx matches up.
1159 memcpy(sess->sid_ctx, s->sid_ctx, s->sid_ctx_length);
1160 sess->sid_ctx_length = s->sid_ctx_length;
1163 s->ext.early_data_ok = 1;
1165 uint32_t ticket_age = 0, now, agesec, agems;
1169 * If we are using anti-replay protection then we behave as if
1170 * SSL_OP_NO_TICKET is set - we are caching tickets anyway so there
1171 * is no point in using full stateless tickets.
1173 if ((s->options & SSL_OP_NO_TICKET) != 0
1174 || (s->max_early_data > 0
1175 && (s->options & SSL_OP_NO_ANTI_REPLAY) == 0))
1176 ret = tls_get_stateful_ticket(s, &identity, &sess);
1178 ret = tls_decrypt_ticket(s, PACKET_data(&identity),
1179 PACKET_remaining(&identity), NULL, 0,
1182 if (ret == SSL_TICKET_EMPTY) {
1183 SSLfatal(s, SSL_AD_DECODE_ERROR, SSL_F_TLS_PARSE_CTOS_PSK,
1184 SSL_R_BAD_EXTENSION);
1188 if (ret == SSL_TICKET_FATAL_ERR_MALLOC
1189 || ret == SSL_TICKET_FATAL_ERR_OTHER) {
1190 SSLfatal(s, SSL_AD_INTERNAL_ERROR,
1191 SSL_F_TLS_PARSE_CTOS_PSK, ERR_R_INTERNAL_ERROR);
1194 if (ret == SSL_TICKET_NONE || ret == SSL_TICKET_NO_DECRYPT)
1197 /* Check for replay */
1198 if (s->max_early_data > 0
1199 && (s->options & SSL_OP_NO_ANTI_REPLAY) == 0
1200 && !SSL_CTX_remove_session(s->session_ctx, sess)) {
1201 SSL_SESSION_free(sess);
1206 ticket_age = (uint32_t)ticket_agel;
1207 now = (uint32_t)time(NULL);
1208 agesec = now - (uint32_t)sess->time;
1209 agems = agesec * (uint32_t)1000;
1210 ticket_age -= sess->ext.tick_age_add;
1213 * For simplicity we do our age calculations in seconds. If the
1214 * client does it in ms then it could appear that their ticket age
1215 * is longer than ours (our ticket age calculation should always be
1216 * slightly longer than the client's due to the network latency).
1217 * Therefore we add 1000ms to our age calculation to adjust for
1221 && sess->timeout >= (long)agesec
1222 && agems / (uint32_t)1000 == agesec
1223 && ticket_age <= agems + 1000
1224 && ticket_age + TICKET_AGE_ALLOWANCE >= agems + 1000) {
1226 * Ticket age is within tolerance and not expired. We allow it
1229 s->ext.early_data_ok = 1;
1233 md = ssl_md(sess->cipher->algorithm2);
1234 if (md != ssl_md(s->s3->tmp.new_cipher->algorithm2)) {
1235 /* The ciphersuite is not compatible with this session. */
1236 SSL_SESSION_free(sess);
1238 s->ext.early_data_ok = 0;
1247 binderoffset = PACKET_data(pkt) - (const unsigned char *)s->init_buf->data;
1248 hashsize = EVP_MD_size(md);
1250 if (!PACKET_get_length_prefixed_2(pkt, &binders)) {
1251 SSLfatal(s, SSL_AD_DECODE_ERROR, SSL_F_TLS_PARSE_CTOS_PSK,
1252 SSL_R_BAD_EXTENSION);
1256 for (i = 0; i <= id; i++) {
1257 if (!PACKET_get_length_prefixed_1(&binders, &binder)) {
1258 SSLfatal(s, SSL_AD_DECODE_ERROR, SSL_F_TLS_PARSE_CTOS_PSK,
1259 SSL_R_BAD_EXTENSION);
1264 if (PACKET_remaining(&binder) != hashsize) {
1265 SSLfatal(s, SSL_AD_DECODE_ERROR, SSL_F_TLS_PARSE_CTOS_PSK,
1266 SSL_R_BAD_EXTENSION);
1269 if (tls_psk_do_binder(s, md, (const unsigned char *)s->init_buf->data,
1270 binderoffset, PACKET_data(&binder), NULL, sess, 0,
1272 /* SSLfatal() already called */
1276 sess->ext.tick_identity = id;
1278 SSL_SESSION_free(s->session);
1282 SSL_SESSION_free(sess);
1286 int tls_parse_ctos_post_handshake_auth(SSL *s, PACKET *pkt, unsigned int context,
1287 X509 *x, size_t chainidx)
1289 if (PACKET_remaining(pkt) != 0) {
1290 SSLfatal(s, SSL_AD_DECODE_ERROR, SSL_F_TLS_PARSE_CTOS_POST_HANDSHAKE_AUTH,
1291 SSL_R_POST_HANDSHAKE_AUTH_ENCODING_ERR);
1295 s->post_handshake_auth = SSL_PHA_EXT_RECEIVED;
1301 * Add the server's renegotiation binding
1303 EXT_RETURN tls_construct_stoc_renegotiate(SSL *s, WPACKET *pkt,
1304 unsigned int context, X509 *x,
1307 if (!s->s3->send_connection_binding)
1308 return EXT_RETURN_NOT_SENT;
1310 /* Still add this even if SSL_OP_NO_RENEGOTIATION is set */
1311 if (!WPACKET_put_bytes_u16(pkt, TLSEXT_TYPE_renegotiate)
1312 || !WPACKET_start_sub_packet_u16(pkt)
1313 || !WPACKET_start_sub_packet_u8(pkt)
1314 || !WPACKET_memcpy(pkt, s->s3->previous_client_finished,
1315 s->s3->previous_client_finished_len)
1316 || !WPACKET_memcpy(pkt, s->s3->previous_server_finished,
1317 s->s3->previous_server_finished_len)
1318 || !WPACKET_close(pkt)
1319 || !WPACKET_close(pkt)) {
1320 SSLfatal(s, SSL_AD_INTERNAL_ERROR, SSL_F_TLS_CONSTRUCT_STOC_RENEGOTIATE,
1321 ERR_R_INTERNAL_ERROR);
1322 return EXT_RETURN_FAIL;
1325 return EXT_RETURN_SENT;
1328 EXT_RETURN tls_construct_stoc_server_name(SSL *s, WPACKET *pkt,
1329 unsigned int context, X509 *x,
1332 if (s->hit || s->servername_done != 1
1333 || s->ext.hostname == NULL)
1334 return EXT_RETURN_NOT_SENT;
1336 if (!WPACKET_put_bytes_u16(pkt, TLSEXT_TYPE_server_name)
1337 || !WPACKET_put_bytes_u16(pkt, 0)) {
1338 SSLfatal(s, SSL_AD_INTERNAL_ERROR, SSL_F_TLS_CONSTRUCT_STOC_SERVER_NAME,
1339 ERR_R_INTERNAL_ERROR);
1340 return EXT_RETURN_FAIL;
1343 return EXT_RETURN_SENT;
1346 /* Add/include the server's max fragment len extension into ServerHello */
1347 EXT_RETURN tls_construct_stoc_maxfragmentlen(SSL *s, WPACKET *pkt,
1348 unsigned int context, X509 *x,
1351 if (!USE_MAX_FRAGMENT_LENGTH_EXT(s->session))
1352 return EXT_RETURN_NOT_SENT;
1355 * 4 bytes for this extension type and extension length
1356 * 1 byte for the Max Fragment Length code value.
1358 if (!WPACKET_put_bytes_u16(pkt, TLSEXT_TYPE_max_fragment_length)
1359 || !WPACKET_start_sub_packet_u16(pkt)
1360 || !WPACKET_put_bytes_u8(pkt, s->session->ext.max_fragment_len_mode)
1361 || !WPACKET_close(pkt)) {
1362 SSLfatal(s, SSL_AD_INTERNAL_ERROR,
1363 SSL_F_TLS_CONSTRUCT_STOC_MAXFRAGMENTLEN, ERR_R_INTERNAL_ERROR);
1364 return EXT_RETURN_FAIL;
1367 return EXT_RETURN_SENT;
1370 #ifndef OPENSSL_NO_EC
1371 EXT_RETURN tls_construct_stoc_ec_pt_formats(SSL *s, WPACKET *pkt,
1372 unsigned int context, X509 *x,
1375 unsigned long alg_k = s->s3->tmp.new_cipher->algorithm_mkey;
1376 unsigned long alg_a = s->s3->tmp.new_cipher->algorithm_auth;
1377 int using_ecc = ((alg_k & SSL_kECDHE) || (alg_a & SSL_aECDSA))
1378 && (s->session->ext.ecpointformats != NULL);
1379 const unsigned char *plist;
1383 return EXT_RETURN_NOT_SENT;
1385 tls1_get_formatlist(s, &plist, &plistlen);
1386 if (!WPACKET_put_bytes_u16(pkt, TLSEXT_TYPE_ec_point_formats)
1387 || !WPACKET_start_sub_packet_u16(pkt)
1388 || !WPACKET_sub_memcpy_u8(pkt, plist, plistlen)
1389 || !WPACKET_close(pkt)) {
1390 SSLfatal(s, SSL_AD_INTERNAL_ERROR,
1391 SSL_F_TLS_CONSTRUCT_STOC_EC_PT_FORMATS, ERR_R_INTERNAL_ERROR);
1392 return EXT_RETURN_FAIL;
1395 return EXT_RETURN_SENT;
1399 #ifndef OPENSSL_NO_EC
1400 EXT_RETURN tls_construct_stoc_supported_groups(SSL *s, WPACKET *pkt,
1401 unsigned int context, X509 *x,
1404 const uint16_t *groups;
1405 size_t numgroups, i, first = 1;
1407 /* s->s3->group_id is non zero if we accepted a key_share */
1408 if (s->s3->group_id == 0)
1409 return EXT_RETURN_NOT_SENT;
1411 /* Get our list of supported groups */
1412 tls1_get_supported_groups(s, &groups, &numgroups);
1413 if (numgroups == 0) {
1414 SSLfatal(s, SSL_AD_INTERNAL_ERROR,
1415 SSL_F_TLS_CONSTRUCT_STOC_SUPPORTED_GROUPS, ERR_R_INTERNAL_ERROR);
1416 return EXT_RETURN_FAIL;
1419 /* Copy group ID if supported */
1420 for (i = 0; i < numgroups; i++) {
1421 uint16_t group = groups[i];
1423 if (tls_curve_allowed(s, group, SSL_SECOP_CURVE_SUPPORTED)) {
1426 * Check if the client is already using our preferred group. If
1427 * so we don't need to add this extension
1429 if (s->s3->group_id == group)
1430 return EXT_RETURN_NOT_SENT;
1432 /* Add extension header */
1433 if (!WPACKET_put_bytes_u16(pkt, TLSEXT_TYPE_supported_groups)
1434 /* Sub-packet for supported_groups extension */
1435 || !WPACKET_start_sub_packet_u16(pkt)
1436 || !WPACKET_start_sub_packet_u16(pkt)) {
1437 SSLfatal(s, SSL_AD_INTERNAL_ERROR,
1438 SSL_F_TLS_CONSTRUCT_STOC_SUPPORTED_GROUPS,
1439 ERR_R_INTERNAL_ERROR);
1440 return EXT_RETURN_FAIL;
1445 if (!WPACKET_put_bytes_u16(pkt, group)) {
1446 SSLfatal(s, SSL_AD_INTERNAL_ERROR,
1447 SSL_F_TLS_CONSTRUCT_STOC_SUPPORTED_GROUPS,
1448 ERR_R_INTERNAL_ERROR);
1449 return EXT_RETURN_FAIL;
1454 if (!WPACKET_close(pkt) || !WPACKET_close(pkt)) {
1455 SSLfatal(s, SSL_AD_INTERNAL_ERROR,
1456 SSL_F_TLS_CONSTRUCT_STOC_SUPPORTED_GROUPS,
1457 ERR_R_INTERNAL_ERROR);
1458 return EXT_RETURN_FAIL;
1461 return EXT_RETURN_SENT;
1465 EXT_RETURN tls_construct_stoc_session_ticket(SSL *s, WPACKET *pkt,
1466 unsigned int context, X509 *x,
1469 if (!s->ext.ticket_expected || !tls_use_ticket(s)) {
1470 s->ext.ticket_expected = 0;
1471 return EXT_RETURN_NOT_SENT;
1474 if (!WPACKET_put_bytes_u16(pkt, TLSEXT_TYPE_session_ticket)
1475 || !WPACKET_put_bytes_u16(pkt, 0)) {
1476 SSLfatal(s, SSL_AD_INTERNAL_ERROR,
1477 SSL_F_TLS_CONSTRUCT_STOC_SESSION_TICKET, ERR_R_INTERNAL_ERROR);
1478 return EXT_RETURN_FAIL;
1481 return EXT_RETURN_SENT;
1484 #ifndef OPENSSL_NO_OCSP
1485 EXT_RETURN tls_construct_stoc_status_request(SSL *s, WPACKET *pkt,
1486 unsigned int context, X509 *x,
1489 if (!s->ext.status_expected)
1490 return EXT_RETURN_NOT_SENT;
1492 if (SSL_IS_TLS13(s) && chainidx != 0)
1493 return EXT_RETURN_NOT_SENT;
1495 if (!WPACKET_put_bytes_u16(pkt, TLSEXT_TYPE_status_request)
1496 || !WPACKET_start_sub_packet_u16(pkt)) {
1497 SSLfatal(s, SSL_AD_INTERNAL_ERROR,
1498 SSL_F_TLS_CONSTRUCT_STOC_STATUS_REQUEST, ERR_R_INTERNAL_ERROR);
1499 return EXT_RETURN_FAIL;
1503 * In TLSv1.3 we include the certificate status itself. In <= TLSv1.2 we
1504 * send back an empty extension, with the certificate status appearing as a
1507 if (SSL_IS_TLS13(s) && !tls_construct_cert_status_body(s, pkt)) {
1508 /* SSLfatal() already called */
1509 return EXT_RETURN_FAIL;
1511 if (!WPACKET_close(pkt)) {
1512 SSLfatal(s, SSL_AD_INTERNAL_ERROR,
1513 SSL_F_TLS_CONSTRUCT_STOC_STATUS_REQUEST, ERR_R_INTERNAL_ERROR);
1514 return EXT_RETURN_FAIL;
1517 return EXT_RETURN_SENT;
1521 #ifndef OPENSSL_NO_NEXTPROTONEG
1522 EXT_RETURN tls_construct_stoc_next_proto_neg(SSL *s, WPACKET *pkt,
1523 unsigned int context, X509 *x,
1526 const unsigned char *npa;
1527 unsigned int npalen;
1529 int npn_seen = s->s3->npn_seen;
1531 s->s3->npn_seen = 0;
1532 if (!npn_seen || s->ctx->ext.npn_advertised_cb == NULL)
1533 return EXT_RETURN_NOT_SENT;
1535 ret = s->ctx->ext.npn_advertised_cb(s, &npa, &npalen,
1536 s->ctx->ext.npn_advertised_cb_arg);
1537 if (ret == SSL_TLSEXT_ERR_OK) {
1538 if (!WPACKET_put_bytes_u16(pkt, TLSEXT_TYPE_next_proto_neg)
1539 || !WPACKET_sub_memcpy_u16(pkt, npa, npalen)) {
1540 SSLfatal(s, SSL_AD_INTERNAL_ERROR,
1541 SSL_F_TLS_CONSTRUCT_STOC_NEXT_PROTO_NEG,
1542 ERR_R_INTERNAL_ERROR);
1543 return EXT_RETURN_FAIL;
1545 s->s3->npn_seen = 1;
1548 return EXT_RETURN_SENT;
1552 EXT_RETURN tls_construct_stoc_alpn(SSL *s, WPACKET *pkt, unsigned int context,
1553 X509 *x, size_t chainidx)
1555 if (s->s3->alpn_selected == NULL)
1556 return EXT_RETURN_NOT_SENT;
1558 if (!WPACKET_put_bytes_u16(pkt,
1559 TLSEXT_TYPE_application_layer_protocol_negotiation)
1560 || !WPACKET_start_sub_packet_u16(pkt)
1561 || !WPACKET_start_sub_packet_u16(pkt)
1562 || !WPACKET_sub_memcpy_u8(pkt, s->s3->alpn_selected,
1563 s->s3->alpn_selected_len)
1564 || !WPACKET_close(pkt)
1565 || !WPACKET_close(pkt)) {
1566 SSLfatal(s, SSL_AD_INTERNAL_ERROR,
1567 SSL_F_TLS_CONSTRUCT_STOC_ALPN, ERR_R_INTERNAL_ERROR);
1568 return EXT_RETURN_FAIL;
1571 return EXT_RETURN_SENT;
1574 #ifndef OPENSSL_NO_SRTP
1575 EXT_RETURN tls_construct_stoc_use_srtp(SSL *s, WPACKET *pkt,
1576 unsigned int context, X509 *x,
1579 if (s->srtp_profile == NULL)
1580 return EXT_RETURN_NOT_SENT;
1582 if (!WPACKET_put_bytes_u16(pkt, TLSEXT_TYPE_use_srtp)
1583 || !WPACKET_start_sub_packet_u16(pkt)
1584 || !WPACKET_put_bytes_u16(pkt, 2)
1585 || !WPACKET_put_bytes_u16(pkt, s->srtp_profile->id)
1586 || !WPACKET_put_bytes_u8(pkt, 0)
1587 || !WPACKET_close(pkt)) {
1588 SSLfatal(s, SSL_AD_INTERNAL_ERROR, SSL_F_TLS_CONSTRUCT_STOC_USE_SRTP,
1589 ERR_R_INTERNAL_ERROR);
1590 return EXT_RETURN_FAIL;
1593 return EXT_RETURN_SENT;
1597 EXT_RETURN tls_construct_stoc_etm(SSL *s, WPACKET *pkt, unsigned int context,
1598 X509 *x, size_t chainidx)
1600 if (!s->ext.use_etm)
1601 return EXT_RETURN_NOT_SENT;
1604 * Don't use encrypt_then_mac if AEAD or RC4 might want to disable
1605 * for other cases too.
1607 if (s->s3->tmp.new_cipher->algorithm_mac == SSL_AEAD
1608 || s->s3->tmp.new_cipher->algorithm_enc == SSL_RC4
1609 || s->s3->tmp.new_cipher->algorithm_enc == SSL_eGOST2814789CNT
1610 || s->s3->tmp.new_cipher->algorithm_enc == SSL_eGOST2814789CNT12) {
1612 return EXT_RETURN_NOT_SENT;
1615 if (!WPACKET_put_bytes_u16(pkt, TLSEXT_TYPE_encrypt_then_mac)
1616 || !WPACKET_put_bytes_u16(pkt, 0)) {
1617 SSLfatal(s, SSL_AD_INTERNAL_ERROR, SSL_F_TLS_CONSTRUCT_STOC_ETM,
1618 ERR_R_INTERNAL_ERROR);
1619 return EXT_RETURN_FAIL;
1622 return EXT_RETURN_SENT;
1625 EXT_RETURN tls_construct_stoc_ems(SSL *s, WPACKET *pkt, unsigned int context,
1626 X509 *x, size_t chainidx)
1628 if ((s->s3->flags & TLS1_FLAGS_RECEIVED_EXTMS) == 0)
1629 return EXT_RETURN_NOT_SENT;
1631 if (!WPACKET_put_bytes_u16(pkt, TLSEXT_TYPE_extended_master_secret)
1632 || !WPACKET_put_bytes_u16(pkt, 0)) {
1633 SSLfatal(s, SSL_AD_INTERNAL_ERROR, SSL_F_TLS_CONSTRUCT_STOC_EMS,
1634 ERR_R_INTERNAL_ERROR);
1635 return EXT_RETURN_FAIL;
1638 return EXT_RETURN_SENT;
1641 EXT_RETURN tls_construct_stoc_supported_versions(SSL *s, WPACKET *pkt,
1642 unsigned int context, X509 *x,
1645 if (!ossl_assert(SSL_IS_TLS13(s))) {
1646 SSLfatal(s, SSL_AD_INTERNAL_ERROR,
1647 SSL_F_TLS_CONSTRUCT_STOC_SUPPORTED_VERSIONS,
1648 ERR_R_INTERNAL_ERROR);
1649 return EXT_RETURN_FAIL;
1652 if (!WPACKET_put_bytes_u16(pkt, TLSEXT_TYPE_supported_versions)
1653 || !WPACKET_start_sub_packet_u16(pkt)
1654 /* TODO(TLS1.3): Update to remove the TLSv1.3 draft indicator */
1655 || !WPACKET_put_bytes_u16(pkt, s->version_draft)
1656 || !WPACKET_close(pkt)) {
1657 SSLfatal(s, SSL_AD_INTERNAL_ERROR,
1658 SSL_F_TLS_CONSTRUCT_STOC_SUPPORTED_VERSIONS,
1659 ERR_R_INTERNAL_ERROR);
1660 return EXT_RETURN_FAIL;
1663 return EXT_RETURN_SENT;
1666 EXT_RETURN tls_construct_stoc_key_share(SSL *s, WPACKET *pkt,
1667 unsigned int context, X509 *x,
1670 #ifndef OPENSSL_NO_TLS1_3
1671 unsigned char *encodedPoint;
1672 size_t encoded_pt_len = 0;
1673 EVP_PKEY *ckey = s->s3->peer_tmp, *skey = NULL;
1675 if (s->hello_retry_request == SSL_HRR_PENDING) {
1677 /* Original key_share was acceptable so don't ask for another one */
1678 return EXT_RETURN_NOT_SENT;
1680 if (!WPACKET_put_bytes_u16(pkt, TLSEXT_TYPE_key_share)
1681 || !WPACKET_start_sub_packet_u16(pkt)
1682 || !WPACKET_put_bytes_u16(pkt, s->s3->group_id)
1683 || !WPACKET_close(pkt)) {
1684 SSLfatal(s, SSL_AD_INTERNAL_ERROR,
1685 SSL_F_TLS_CONSTRUCT_STOC_KEY_SHARE,
1686 ERR_R_INTERNAL_ERROR);
1687 return EXT_RETURN_FAIL;
1690 return EXT_RETURN_SENT;
1694 /* No key_share received from client - must be resuming */
1695 if (!s->hit || !tls13_generate_handshake_secret(s, NULL, 0)) {
1696 SSLfatal(s, SSL_AD_INTERNAL_ERROR,
1697 SSL_F_TLS_CONSTRUCT_STOC_KEY_SHARE, ERR_R_INTERNAL_ERROR);
1698 return EXT_RETURN_FAIL;
1700 return EXT_RETURN_NOT_SENT;
1703 if (!WPACKET_put_bytes_u16(pkt, TLSEXT_TYPE_key_share)
1704 || !WPACKET_start_sub_packet_u16(pkt)
1705 || !WPACKET_put_bytes_u16(pkt, s->s3->group_id)) {
1706 SSLfatal(s, SSL_AD_INTERNAL_ERROR,
1707 SSL_F_TLS_CONSTRUCT_STOC_KEY_SHARE, ERR_R_INTERNAL_ERROR);
1708 return EXT_RETURN_FAIL;
1711 skey = ssl_generate_pkey(ckey);
1713 SSLfatal(s, SSL_AD_INTERNAL_ERROR, SSL_F_TLS_CONSTRUCT_STOC_KEY_SHARE,
1714 ERR_R_MALLOC_FAILURE);
1715 return EXT_RETURN_FAIL;
1718 /* Generate encoding of server key */
1719 encoded_pt_len = EVP_PKEY_get1_tls_encodedpoint(skey, &encodedPoint);
1720 if (encoded_pt_len == 0) {
1721 SSLfatal(s, SSL_AD_INTERNAL_ERROR, SSL_F_TLS_CONSTRUCT_STOC_KEY_SHARE,
1723 EVP_PKEY_free(skey);
1724 return EXT_RETURN_FAIL;
1727 if (!WPACKET_sub_memcpy_u16(pkt, encodedPoint, encoded_pt_len)
1728 || !WPACKET_close(pkt)) {
1729 SSLfatal(s, SSL_AD_INTERNAL_ERROR, SSL_F_TLS_CONSTRUCT_STOC_KEY_SHARE,
1730 ERR_R_INTERNAL_ERROR);
1731 EVP_PKEY_free(skey);
1732 OPENSSL_free(encodedPoint);
1733 return EXT_RETURN_FAIL;
1735 OPENSSL_free(encodedPoint);
1737 /* This causes the crypto state to be updated based on the derived keys */
1738 s->s3->tmp.pkey = skey;
1739 if (ssl_derive(s, skey, ckey, 1) == 0) {
1740 /* SSLfatal() already called */
1741 return EXT_RETURN_FAIL;
1743 return EXT_RETURN_SENT;
1745 return EXT_RETURN_FAIL;
1749 EXT_RETURN tls_construct_stoc_cookie(SSL *s, WPACKET *pkt, unsigned int context,
1750 X509 *x, size_t chainidx)
1752 #ifndef OPENSSL_NO_TLS1_3
1753 unsigned char *hashval1, *hashval2, *appcookie1, *appcookie2, *cookie;
1754 unsigned char *hmac, *hmac2;
1755 size_t startlen, ciphlen, totcookielen, hashlen, hmaclen, appcookielen;
1758 int ret = EXT_RETURN_FAIL;
1760 if ((s->s3->flags & TLS1_FLAGS_STATELESS) == 0)
1761 return EXT_RETURN_NOT_SENT;
1763 if (s->ctx->gen_stateless_cookie_cb == NULL) {
1764 SSLfatal(s, SSL_AD_INTERNAL_ERROR, SSL_F_TLS_CONSTRUCT_STOC_COOKIE,
1765 SSL_R_NO_COOKIE_CALLBACK_SET);
1766 return EXT_RETURN_FAIL;
1769 if (!WPACKET_put_bytes_u16(pkt, TLSEXT_TYPE_cookie)
1770 || !WPACKET_start_sub_packet_u16(pkt)
1771 || !WPACKET_start_sub_packet_u16(pkt)
1772 || !WPACKET_get_total_written(pkt, &startlen)
1773 || !WPACKET_reserve_bytes(pkt, MAX_COOKIE_SIZE, &cookie)
1774 || !WPACKET_put_bytes_u16(pkt, COOKIE_STATE_FORMAT_VERSION)
1775 || !WPACKET_put_bytes_u16(pkt, TLS1_3_VERSION)
1776 || !WPACKET_put_bytes_u16(pkt, s->s3->group_id)
1777 || !s->method->put_cipher_by_char(s->s3->tmp.new_cipher, pkt,
1779 /* Is there a key_share extension present in this HRR? */
1780 || !WPACKET_put_bytes_u8(pkt, s->s3->peer_tmp == NULL)
1781 || !WPACKET_put_bytes_u32(pkt, (unsigned int)time(NULL))
1782 || !WPACKET_start_sub_packet_u16(pkt)
1783 || !WPACKET_reserve_bytes(pkt, EVP_MAX_MD_SIZE, &hashval1)) {
1784 SSLfatal(s, SSL_AD_INTERNAL_ERROR, SSL_F_TLS_CONSTRUCT_STOC_COOKIE,
1785 ERR_R_INTERNAL_ERROR);
1786 return EXT_RETURN_FAIL;
1790 * Get the hash of the initial ClientHello. ssl_handshake_hash() operates
1791 * on raw buffers, so we first reserve sufficient bytes (above) and then
1792 * subsequently allocate them (below)
1794 if (!ssl3_digest_cached_records(s, 0)
1795 || !ssl_handshake_hash(s, hashval1, EVP_MAX_MD_SIZE, &hashlen)) {
1796 /* SSLfatal() already called */
1797 return EXT_RETURN_FAIL;
1800 if (!WPACKET_allocate_bytes(pkt, hashlen, &hashval2)
1801 || !ossl_assert(hashval1 == hashval2)
1802 || !WPACKET_close(pkt)
1803 || !WPACKET_start_sub_packet_u8(pkt)
1804 || !WPACKET_reserve_bytes(pkt, SSL_COOKIE_LENGTH, &appcookie1)) {
1805 SSLfatal(s, SSL_AD_INTERNAL_ERROR, SSL_F_TLS_CONSTRUCT_STOC_COOKIE,
1806 ERR_R_INTERNAL_ERROR);
1807 return EXT_RETURN_FAIL;
1810 /* Generate the application cookie */
1811 if (s->ctx->gen_stateless_cookie_cb(s, appcookie1, &appcookielen) == 0) {
1812 SSLfatal(s, SSL_AD_INTERNAL_ERROR, SSL_F_TLS_CONSTRUCT_STOC_COOKIE,
1813 SSL_R_COOKIE_GEN_CALLBACK_FAILURE);
1814 return EXT_RETURN_FAIL;
1817 if (!WPACKET_allocate_bytes(pkt, appcookielen, &appcookie2)
1818 || !ossl_assert(appcookie1 == appcookie2)
1819 || !WPACKET_close(pkt)
1820 || !WPACKET_get_total_written(pkt, &totcookielen)
1821 || !WPACKET_reserve_bytes(pkt, SHA256_DIGEST_LENGTH, &hmac)) {
1822 SSLfatal(s, SSL_AD_INTERNAL_ERROR, SSL_F_TLS_CONSTRUCT_STOC_COOKIE,
1823 ERR_R_INTERNAL_ERROR);
1824 return EXT_RETURN_FAIL;
1826 hmaclen = SHA256_DIGEST_LENGTH;
1828 totcookielen -= startlen;
1829 if (!ossl_assert(totcookielen <= MAX_COOKIE_SIZE - SHA256_DIGEST_LENGTH)) {
1830 SSLfatal(s, SSL_AD_INTERNAL_ERROR, SSL_F_TLS_CONSTRUCT_STOC_COOKIE,
1831 ERR_R_INTERNAL_ERROR);
1832 return EXT_RETURN_FAIL;
1835 /* HMAC the cookie */
1836 hctx = EVP_MD_CTX_create();
1837 pkey = EVP_PKEY_new_raw_private_key(EVP_PKEY_HMAC, NULL,
1838 s->session_ctx->ext.cookie_hmac_key,
1839 sizeof(s->session_ctx->ext
1841 if (hctx == NULL || pkey == NULL) {
1842 SSLfatal(s, SSL_AD_INTERNAL_ERROR, SSL_F_TLS_CONSTRUCT_STOC_COOKIE,
1843 ERR_R_MALLOC_FAILURE);
1847 if (EVP_DigestSignInit(hctx, NULL, EVP_sha256(), NULL, pkey) <= 0
1848 || EVP_DigestSign(hctx, hmac, &hmaclen, cookie,
1849 totcookielen) <= 0) {
1850 SSLfatal(s, SSL_AD_INTERNAL_ERROR, SSL_F_TLS_CONSTRUCT_STOC_COOKIE,
1851 ERR_R_INTERNAL_ERROR);
1855 if (!ossl_assert(totcookielen + hmaclen <= MAX_COOKIE_SIZE)) {
1856 SSLfatal(s, SSL_AD_INTERNAL_ERROR, SSL_F_TLS_CONSTRUCT_STOC_COOKIE,
1857 ERR_R_INTERNAL_ERROR);
1861 if (!WPACKET_allocate_bytes(pkt, hmaclen, &hmac2)
1862 || !ossl_assert(hmac == hmac2)
1863 || !ossl_assert(cookie == hmac - totcookielen)
1864 || !WPACKET_close(pkt)
1865 || !WPACKET_close(pkt)) {
1866 SSLfatal(s, SSL_AD_INTERNAL_ERROR, SSL_F_TLS_CONSTRUCT_STOC_COOKIE,
1867 ERR_R_INTERNAL_ERROR);
1871 ret = EXT_RETURN_SENT;
1874 EVP_MD_CTX_free(hctx);
1875 EVP_PKEY_free(pkey);
1878 return EXT_RETURN_FAIL;
1882 EXT_RETURN tls_construct_stoc_cryptopro_bug(SSL *s, WPACKET *pkt,
1883 unsigned int context, X509 *x,
1886 const unsigned char cryptopro_ext[36] = {
1887 0xfd, 0xe8, /* 65000 */
1888 0x00, 0x20, /* 32 bytes length */
1889 0x30, 0x1e, 0x30, 0x08, 0x06, 0x06, 0x2a, 0x85,
1890 0x03, 0x02, 0x02, 0x09, 0x30, 0x08, 0x06, 0x06,
1891 0x2a, 0x85, 0x03, 0x02, 0x02, 0x16, 0x30, 0x08,
1892 0x06, 0x06, 0x2a, 0x85, 0x03, 0x02, 0x02, 0x17
1895 if (((s->s3->tmp.new_cipher->id & 0xFFFF) != 0x80
1896 && (s->s3->tmp.new_cipher->id & 0xFFFF) != 0x81)
1897 || (SSL_get_options(s) & SSL_OP_CRYPTOPRO_TLSEXT_BUG) == 0)
1898 return EXT_RETURN_NOT_SENT;
1900 if (!WPACKET_memcpy(pkt, cryptopro_ext, sizeof(cryptopro_ext))) {
1901 SSLfatal(s, SSL_AD_INTERNAL_ERROR,
1902 SSL_F_TLS_CONSTRUCT_STOC_CRYPTOPRO_BUG, ERR_R_INTERNAL_ERROR);
1903 return EXT_RETURN_FAIL;
1906 return EXT_RETURN_SENT;
1909 EXT_RETURN tls_construct_stoc_early_data(SSL *s, WPACKET *pkt,
1910 unsigned int context, X509 *x,
1913 if (context == SSL_EXT_TLS1_3_NEW_SESSION_TICKET) {
1914 if (s->max_early_data == 0)
1915 return EXT_RETURN_NOT_SENT;
1917 if (!WPACKET_put_bytes_u16(pkt, TLSEXT_TYPE_early_data)
1918 || !WPACKET_start_sub_packet_u16(pkt)
1919 || !WPACKET_put_bytes_u32(pkt, s->max_early_data)
1920 || !WPACKET_close(pkt)) {
1921 SSLfatal(s, SSL_AD_INTERNAL_ERROR,
1922 SSL_F_TLS_CONSTRUCT_STOC_EARLY_DATA, ERR_R_INTERNAL_ERROR);
1923 return EXT_RETURN_FAIL;
1926 return EXT_RETURN_SENT;
1929 if (s->ext.early_data != SSL_EARLY_DATA_ACCEPTED)
1930 return EXT_RETURN_NOT_SENT;
1932 if (!WPACKET_put_bytes_u16(pkt, TLSEXT_TYPE_early_data)
1933 || !WPACKET_start_sub_packet_u16(pkt)
1934 || !WPACKET_close(pkt)) {
1935 SSLfatal(s, SSL_AD_INTERNAL_ERROR, SSL_F_TLS_CONSTRUCT_STOC_EARLY_DATA,
1936 ERR_R_INTERNAL_ERROR);
1937 return EXT_RETURN_FAIL;
1940 return EXT_RETURN_SENT;
1943 EXT_RETURN tls_construct_stoc_psk(SSL *s, WPACKET *pkt, unsigned int context,
1944 X509 *x, size_t chainidx)
1947 return EXT_RETURN_NOT_SENT;
1949 if (!WPACKET_put_bytes_u16(pkt, TLSEXT_TYPE_psk)
1950 || !WPACKET_start_sub_packet_u16(pkt)
1951 || !WPACKET_put_bytes_u16(pkt, s->session->ext.tick_identity)
1952 || !WPACKET_close(pkt)) {
1953 SSLfatal(s, SSL_AD_INTERNAL_ERROR,
1954 SSL_F_TLS_CONSTRUCT_STOC_PSK, ERR_R_INTERNAL_ERROR);
1955 return EXT_RETURN_FAIL;
1958 return EXT_RETURN_SENT;