2 * Copyright 2016 The OpenSSL Project Authors. All Rights Reserved.
4 * Licensed under the OpenSSL license (the "License"). You may not use
5 * this file except in compliance with the License. You can obtain a copy
6 * in the file LICENSE in the source distribution or at
7 * https://www.openssl.org/source/license.html
10 #include <openssl/ocsp.h>
11 #include "../ssl_locl.h"
12 #include "statem_locl.h"
15 * Parse the client's renegotiation binding and abort if it's not right
17 int tls_parse_ctos_renegotiate(SSL *s, PACKET *pkt, unsigned int context,
18 X509 *x, size_t chainidx, int *al)
21 const unsigned char *data;
23 /* Parse the length byte */
24 if (!PACKET_get_1(pkt, &ilen)
25 || !PACKET_get_bytes(pkt, &data, ilen)) {
26 SSLerr(SSL_F_TLS_PARSE_CTOS_RENEGOTIATE,
27 SSL_R_RENEGOTIATION_ENCODING_ERR);
28 *al = SSL_AD_ILLEGAL_PARAMETER;
32 /* Check that the extension matches */
33 if (ilen != s->s3->previous_client_finished_len) {
34 SSLerr(SSL_F_TLS_PARSE_CTOS_RENEGOTIATE,
35 SSL_R_RENEGOTIATION_MISMATCH);
36 *al = SSL_AD_HANDSHAKE_FAILURE;
40 if (memcmp(data, s->s3->previous_client_finished,
41 s->s3->previous_client_finished_len)) {
42 SSLerr(SSL_F_TLS_PARSE_CTOS_RENEGOTIATE,
43 SSL_R_RENEGOTIATION_MISMATCH);
44 *al = SSL_AD_HANDSHAKE_FAILURE;
48 s->s3->send_connection_binding = 1;
54 * The servername extension is treated as follows:
56 * - Only the hostname type is supported with a maximum length of 255.
57 * - The servername is rejected if too long or if it contains zeros,
58 * in which case an fatal alert is generated.
59 * - The servername field is maintained together with the session cache.
60 * - When a session is resumed, the servername call back invoked in order
61 * to allow the application to position itself to the right context.
62 * - The servername is acknowledged if it is new for a session or when
63 * it is identical to a previously used for the same session.
64 * Applications can control the behaviour. They can at any time
65 * set a 'desirable' servername for a new SSL object. This can be the
66 * case for example with HTTPS when a Host: header field is received and
67 * a renegotiation is requested. In this case, a possible servername
68 * presented in the new client hello is only acknowledged if it matches
69 * the value of the Host: field.
70 * - Applications must use SSL_OP_NO_SESSION_RESUMPTION_ON_RENEGOTIATION
71 * if they provide for changing an explicit servername context for the
72 * session, i.e. when the session has been established with a servername
74 * - On session reconnect, the servername extension may be absent.
76 int tls_parse_ctos_server_name(SSL *s, PACKET *pkt, unsigned int context,
77 X509 *x, size_t chainidx, int *al)
79 unsigned int servname_type;
82 if (!PACKET_as_length_prefixed_2(pkt, &sni)
83 /* ServerNameList must be at least 1 byte long. */
84 || PACKET_remaining(&sni) == 0) {
85 *al = SSL_AD_DECODE_ERROR;
90 * Although the server_name extension was intended to be
91 * extensible to new name types, RFC 4366 defined the
92 * syntax inextensibly and OpenSSL 1.0.x parses it as
94 * RFC 6066 corrected the mistake but adding new name types
95 * is nevertheless no longer feasible, so act as if no other
96 * SNI types can exist, to simplify parsing.
98 * Also note that the RFC permits only one SNI value per type,
99 * i.e., we can only have a single hostname.
101 if (!PACKET_get_1(&sni, &servname_type)
102 || servname_type != TLSEXT_NAMETYPE_host_name
103 || !PACKET_as_length_prefixed_2(&sni, &hostname)) {
104 *al = SSL_AD_DECODE_ERROR;
109 if (PACKET_remaining(&hostname) > TLSEXT_MAXLEN_host_name) {
110 *al = TLS1_AD_UNRECOGNIZED_NAME;
114 if (PACKET_contains_zero_byte(&hostname)) {
115 *al = TLS1_AD_UNRECOGNIZED_NAME;
119 OPENSSL_free(s->session->ext.hostname);
120 s->session->ext.hostname = NULL;
121 if (!PACKET_strndup(&hostname, &s->session->ext.hostname)) {
122 *al = TLS1_AD_INTERNAL_ERROR;
126 s->servername_done = 1;
129 * TODO(openssl-team): if the SNI doesn't match, we MUST
130 * fall back to a full handshake.
132 s->servername_done = s->session->ext.hostname
133 && PACKET_equal(&hostname, s->session->ext.hostname,
134 strlen(s->session->ext.hostname));
140 #ifndef OPENSSL_NO_SRP
141 int tls_parse_ctos_srp(SSL *s, PACKET *pkt, unsigned int context, X509 *x,
142 size_t chainidx, int *al)
146 if (!PACKET_as_length_prefixed_1(pkt, &srp_I)
147 || PACKET_contains_zero_byte(&srp_I)) {
148 *al = SSL_AD_DECODE_ERROR;
153 * TODO(openssl-team): currently, we re-authenticate the user
154 * upon resumption. Instead, we MUST ignore the login.
156 if (!PACKET_strndup(&srp_I, &s->srp_ctx.login)) {
157 *al = TLS1_AD_INTERNAL_ERROR;
165 int tls_parse_ctos_early_data(SSL *s, PACKET *pkt, unsigned int context,
166 X509 *x, size_t chainidx, int *al)
168 if (PACKET_remaining(pkt) != 0) {
169 *al = SSL_AD_DECODE_ERROR;
173 s->ext.expect_early_data = 1;
178 #ifndef OPENSSL_NO_EC
179 int tls_parse_ctos_ec_pt_formats(SSL *s, PACKET *pkt, unsigned int context,
180 X509 *x, size_t chainidx, int *al)
182 PACKET ec_point_format_list;
184 if (!PACKET_as_length_prefixed_1(pkt, &ec_point_format_list)
185 || PACKET_remaining(&ec_point_format_list) == 0) {
186 *al = SSL_AD_DECODE_ERROR;
191 if (!PACKET_memdup(&ec_point_format_list,
192 &s->session->ext.ecpointformats,
193 &s->session->ext.ecpointformats_len)) {
194 *al = TLS1_AD_INTERNAL_ERROR;
201 #endif /* OPENSSL_NO_EC */
203 int tls_parse_ctos_session_ticket(SSL *s, PACKET *pkt, unsigned int context,
204 X509 *x, size_t chainidx, int *al)
206 if (s->ext.session_ticket_cb &&
207 !s->ext.session_ticket_cb(s, PACKET_data(pkt),
208 PACKET_remaining(pkt),
209 s->ext.session_ticket_cb_arg)) {
210 *al = TLS1_AD_INTERNAL_ERROR;
217 int tls_parse_ctos_sig_algs(SSL *s, PACKET *pkt, unsigned int context, X509 *x,
218 size_t chainidx, int *al)
220 PACKET supported_sig_algs;
222 if (!PACKET_as_length_prefixed_2(pkt, &supported_sig_algs)
223 || PACKET_remaining(&supported_sig_algs) == 0) {
224 *al = SSL_AD_DECODE_ERROR;
228 if (!s->hit && !tls1_save_sigalgs(s, &supported_sig_algs)) {
229 *al = TLS1_AD_DECODE_ERROR;
236 #ifndef OPENSSL_NO_OCSP
237 int tls_parse_ctos_status_request(SSL *s, PACKET *pkt, unsigned int context,
238 X509 *x, size_t chainidx, int *al)
240 PACKET responder_id_list, exts;
242 /* Not defined if we get one of these in a client Certificate */
246 if (!PACKET_get_1(pkt, (unsigned int *)&s->ext.status_type)) {
247 *al = SSL_AD_DECODE_ERROR;
251 if (s->ext.status_type != TLSEXT_STATUSTYPE_ocsp) {
253 * We don't know what to do with any other type so ignore it.
255 s->ext.status_type = TLSEXT_STATUSTYPE_nothing;
259 if (!PACKET_get_length_prefixed_2 (pkt, &responder_id_list)) {
260 *al = SSL_AD_DECODE_ERROR;
265 * We remove any OCSP_RESPIDs from a previous handshake
266 * to prevent unbounded memory growth - CVE-2016-6304
268 sk_OCSP_RESPID_pop_free(s->ext.ocsp.ids, OCSP_RESPID_free);
269 if (PACKET_remaining(&responder_id_list) > 0) {
270 s->ext.ocsp.ids = sk_OCSP_RESPID_new_null();
271 if (s->ext.ocsp.ids == NULL) {
272 *al = SSL_AD_INTERNAL_ERROR;
276 s->ext.ocsp.ids = NULL;
279 while (PACKET_remaining(&responder_id_list) > 0) {
282 const unsigned char *id_data;
284 if (!PACKET_get_length_prefixed_2(&responder_id_list, &responder_id)
285 || PACKET_remaining(&responder_id) == 0) {
286 *al = SSL_AD_DECODE_ERROR;
290 id_data = PACKET_data(&responder_id);
291 /* TODO(size_t): Convert d2i_* to size_t */
292 id = d2i_OCSP_RESPID(NULL, &id_data,
293 (int)PACKET_remaining(&responder_id));
295 *al = SSL_AD_DECODE_ERROR;
299 if (id_data != PACKET_end(&responder_id)) {
300 OCSP_RESPID_free(id);
301 *al = SSL_AD_DECODE_ERROR;
305 if (!sk_OCSP_RESPID_push(s->ext.ocsp.ids, id)) {
306 OCSP_RESPID_free(id);
307 *al = SSL_AD_INTERNAL_ERROR;
312 /* Read in request_extensions */
313 if (!PACKET_as_length_prefixed_2(pkt, &exts)) {
314 *al = SSL_AD_DECODE_ERROR;
318 if (PACKET_remaining(&exts) > 0) {
319 const unsigned char *ext_data = PACKET_data(&exts);
321 sk_X509_EXTENSION_pop_free(s->ext.ocsp.exts,
322 X509_EXTENSION_free);
324 d2i_X509_EXTENSIONS(NULL, &ext_data, (int)PACKET_remaining(&exts));
325 if (s->ext.ocsp.exts == NULL || ext_data != PACKET_end(&exts)) {
326 *al = SSL_AD_DECODE_ERROR;
335 #ifndef OPENSSL_NO_NEXTPROTONEG
336 int tls_parse_ctos_npn(SSL *s, PACKET *pkt, unsigned int context, X509 *x,
337 size_t chainidx, int *al)
340 * We shouldn't accept this extension on a
343 if (SSL_IS_FIRST_HANDSHAKE(s))
351 * Save the ALPN extension in a ClientHello.|pkt| holds the contents of the ALPN
352 * extension, not including type and length. |al| is a pointer to the alert
353 * value to send in the event of a failure. Returns: 1 on success, 0 on error.
355 int tls_parse_ctos_alpn(SSL *s, PACKET *pkt, unsigned int context, X509 *x,
356 size_t chainidx, int *al)
358 PACKET protocol_list, save_protocol_list, protocol;
360 if (!SSL_IS_FIRST_HANDSHAKE(s))
363 if (!PACKET_as_length_prefixed_2(pkt, &protocol_list)
364 || PACKET_remaining(&protocol_list) < 2) {
365 *al = SSL_AD_DECODE_ERROR;
369 save_protocol_list = protocol_list;
371 /* Protocol names can't be empty. */
372 if (!PACKET_get_length_prefixed_1(&protocol_list, &protocol)
373 || PACKET_remaining(&protocol) == 0) {
374 *al = SSL_AD_DECODE_ERROR;
377 } while (PACKET_remaining(&protocol_list) != 0);
379 OPENSSL_free(s->s3->alpn_proposed);
380 s->s3->alpn_proposed = NULL;
381 s->s3->alpn_proposed_len = 0;
382 if (!PACKET_memdup(&save_protocol_list,
383 &s->s3->alpn_proposed, &s->s3->alpn_proposed_len)) {
384 *al = TLS1_AD_INTERNAL_ERROR;
391 #ifndef OPENSSL_NO_SRTP
392 int tls_parse_ctos_use_srtp(SSL *s, PACKET *pkt, unsigned int context, X509 *x,
393 size_t chainidx, int *al)
395 STACK_OF(SRTP_PROTECTION_PROFILE) *srvr;
396 unsigned int ct, mki_len, id;
400 /* Ignore this if we have no SRTP profiles */
401 if (SSL_get_srtp_profiles(s) == NULL)
404 /* Pull off the length of the cipher suite list and check it is even */
405 if (!PACKET_get_net_2(pkt, &ct) || (ct & 1) != 0
406 || !PACKET_get_sub_packet(pkt, &subpkt, ct)) {
407 SSLerr(SSL_F_TLS_PARSE_CTOS_USE_SRTP,
408 SSL_R_BAD_SRTP_PROTECTION_PROFILE_LIST);
409 *al = SSL_AD_DECODE_ERROR;
413 srvr = SSL_get_srtp_profiles(s);
414 s->srtp_profile = NULL;
415 /* Search all profiles for a match initially */
416 srtp_pref = sk_SRTP_PROTECTION_PROFILE_num(srvr);
418 while (PACKET_remaining(&subpkt)) {
419 if (!PACKET_get_net_2(&subpkt, &id)) {
420 SSLerr(SSL_F_TLS_PARSE_CTOS_USE_SRTP,
421 SSL_R_BAD_SRTP_PROTECTION_PROFILE_LIST);
422 *al = SSL_AD_DECODE_ERROR;
427 * Only look for match in profiles of higher preference than
429 * If no profiles have been have been configured then this
432 for (i = 0; i < srtp_pref; i++) {
433 SRTP_PROTECTION_PROFILE *sprof =
434 sk_SRTP_PROTECTION_PROFILE_value(srvr, i);
436 if (sprof->id == id) {
437 s->srtp_profile = sprof;
444 /* Now extract the MKI value as a sanity check, but discard it for now */
445 if (!PACKET_get_1(pkt, &mki_len)) {
446 SSLerr(SSL_F_TLS_PARSE_CTOS_USE_SRTP,
447 SSL_R_BAD_SRTP_PROTECTION_PROFILE_LIST);
448 *al = SSL_AD_DECODE_ERROR;
452 if (!PACKET_forward(pkt, mki_len)
453 || PACKET_remaining(pkt)) {
454 SSLerr(SSL_F_TLS_PARSE_CTOS_USE_SRTP, SSL_R_BAD_SRTP_MKI_VALUE);
455 *al = SSL_AD_DECODE_ERROR;
463 int tls_parse_ctos_etm(SSL *s, PACKET *pkt, unsigned int context, X509 *x,
464 size_t chainidx, int *al)
466 if (!(s->options & SSL_OP_NO_ENCRYPT_THEN_MAC))
473 * Process a psk_kex_modes extension received in the ClientHello. |pkt| contains
474 * the raw PACKET data for the extension. Returns 1 on success or 0 on failure.
475 * If a failure occurs then |*al| is set to an appropriate alert value.
477 int tls_parse_ctos_psk_kex_modes(SSL *s, PACKET *pkt, unsigned int context,
478 X509 *x, size_t chainidx, int *al)
480 #ifndef OPENSSL_NO_TLS1_3
481 PACKET psk_kex_modes;
484 if (!PACKET_as_length_prefixed_1(pkt, &psk_kex_modes)
485 || PACKET_remaining(&psk_kex_modes) == 0) {
486 *al = SSL_AD_DECODE_ERROR;
490 while (PACKET_get_1(&psk_kex_modes, &mode)) {
491 if (mode == TLSEXT_KEX_MODE_KE_DHE)
492 s->ext.psk_kex_mode |= TLSEXT_KEX_MODE_FLAG_KE_DHE;
493 else if (mode == TLSEXT_KEX_MODE_KE)
494 s->ext.psk_kex_mode |= TLSEXT_KEX_MODE_FLAG_KE;
502 * Process a key_share extension received in the ClientHello. |pkt| contains
503 * the raw PACKET data for the extension. Returns 1 on success or 0 on failure.
504 * If a failure occurs then |*al| is set to an appropriate alert value.
506 int tls_parse_ctos_key_share(SSL *s, PACKET *pkt, unsigned int context, X509 *x,
507 size_t chainidx, int *al)
509 #ifndef OPENSSL_NO_TLS1_3
510 unsigned int group_id;
511 PACKET key_share_list, encoded_pt;
512 const unsigned char *clntcurves, *srvrcurves;
513 size_t clnt_num_curves, srvr_num_curves;
514 int group_nid, found = 0;
515 unsigned int curve_flags;
517 if (s->hit && (s->ext.psk_kex_mode & TLSEXT_KEX_MODE_FLAG_KE_DHE) == 0)
521 if (s->s3->peer_tmp != NULL) {
522 *al = SSL_AD_INTERNAL_ERROR;
523 SSLerr(SSL_F_TLS_PARSE_CTOS_KEY_SHARE, ERR_R_INTERNAL_ERROR);
527 if (!PACKET_as_length_prefixed_2(pkt, &key_share_list)) {
528 *al = SSL_AD_HANDSHAKE_FAILURE;
529 SSLerr(SSL_F_TLS_PARSE_CTOS_KEY_SHARE, SSL_R_LENGTH_MISMATCH);
533 /* Get our list of supported curves */
534 if (!tls1_get_curvelist(s, 0, &srvrcurves, &srvr_num_curves)) {
535 *al = SSL_AD_INTERNAL_ERROR;
536 SSLerr(SSL_F_TLS_PARSE_CTOS_KEY_SHARE, ERR_R_INTERNAL_ERROR);
541 * Get the clients list of supported curves.
542 * TODO(TLS1.3): We should validate that we actually received
545 if (!tls1_get_curvelist(s, 1, &clntcurves, &clnt_num_curves)) {
546 *al = SSL_AD_INTERNAL_ERROR;
547 SSLerr(SSL_F_TLS_PARSE_CTOS_KEY_SHARE, ERR_R_INTERNAL_ERROR);
551 while (PACKET_remaining(&key_share_list) > 0) {
552 if (!PACKET_get_net_2(&key_share_list, &group_id)
553 || !PACKET_get_length_prefixed_2(&key_share_list, &encoded_pt)
554 || PACKET_remaining(&encoded_pt) == 0) {
555 *al = SSL_AD_HANDSHAKE_FAILURE;
556 SSLerr(SSL_F_TLS_PARSE_CTOS_KEY_SHARE,
557 SSL_R_LENGTH_MISMATCH);
562 * If we already found a suitable key_share we loop through the
563 * rest to verify the structure, but don't process them.
568 /* Check if this share is in supported_groups sent from client */
569 if (!check_in_list(s, group_id, clntcurves, clnt_num_curves, 0)) {
570 *al = SSL_AD_HANDSHAKE_FAILURE;
571 SSLerr(SSL_F_TLS_PARSE_CTOS_KEY_SHARE, SSL_R_BAD_KEY_SHARE);
575 /* Check if this share is for a group we can use */
576 if (!check_in_list(s, group_id, srvrcurves, srvr_num_curves, 1)) {
577 /* Share not suitable */
581 group_nid = tls1_ec_curve_id2nid(group_id, &curve_flags);
583 if (group_nid == 0) {
584 *al = SSL_AD_INTERNAL_ERROR;
585 SSLerr(SSL_F_TLS_PARSE_CTOS_KEY_SHARE,
586 SSL_R_UNABLE_TO_FIND_ECDH_PARAMETERS);
590 if ((curve_flags & TLS_CURVE_TYPE) == TLS_CURVE_CUSTOM) {
591 /* Can happen for some curves, e.g. X25519 */
592 EVP_PKEY *key = EVP_PKEY_new();
594 if (key == NULL || !EVP_PKEY_set_type(key, group_nid)) {
595 *al = SSL_AD_INTERNAL_ERROR;
596 SSLerr(SSL_F_TLS_PARSE_CTOS_KEY_SHARE, ERR_R_EVP_LIB);
600 s->s3->peer_tmp = key;
602 /* Set up EVP_PKEY with named curve as parameters */
603 EVP_PKEY_CTX *pctx = EVP_PKEY_CTX_new_id(EVP_PKEY_EC, NULL);
606 || EVP_PKEY_paramgen_init(pctx) <= 0
607 || EVP_PKEY_CTX_set_ec_paramgen_curve_nid(pctx,
609 || EVP_PKEY_paramgen(pctx, &s->s3->peer_tmp) <= 0) {
610 *al = SSL_AD_INTERNAL_ERROR;
611 SSLerr(SSL_F_TLS_PARSE_CTOS_KEY_SHARE, ERR_R_EVP_LIB);
612 EVP_PKEY_CTX_free(pctx);
615 EVP_PKEY_CTX_free(pctx);
618 s->s3->group_id = group_id;
620 if (!EVP_PKEY_set1_tls_encodedpoint(s->s3->peer_tmp,
621 PACKET_data(&encoded_pt),
622 PACKET_remaining(&encoded_pt))) {
623 *al = SSL_AD_DECODE_ERROR;
624 SSLerr(SSL_F_TLS_PARSE_CTOS_KEY_SHARE, SSL_R_BAD_ECPOINT);
635 #ifndef OPENSSL_NO_EC
636 int tls_parse_ctos_supported_groups(SSL *s, PACKET *pkt, unsigned int context,
637 X509 *x, size_t chainidx, int *al)
639 PACKET supported_groups_list;
641 /* Each group is 2 bytes and we must have at least 1. */
642 if (!PACKET_as_length_prefixed_2(pkt, &supported_groups_list)
643 || PACKET_remaining(&supported_groups_list) == 0
644 || (PACKET_remaining(&supported_groups_list) % 2) != 0) {
645 *al = SSL_AD_DECODE_ERROR;
649 OPENSSL_free(s->session->ext.supportedgroups);
650 s->session->ext.supportedgroups = NULL;
651 s->session->ext.supportedgroups_len = 0;
652 if (!PACKET_memdup(&supported_groups_list,
653 &s->session->ext.supportedgroups,
654 &s->session->ext.supportedgroups_len)) {
655 *al = SSL_AD_DECODE_ERROR;
663 int tls_parse_ctos_ems(SSL *s, PACKET *pkt, unsigned int context, X509 *x,
664 size_t chainidx, int *al)
666 /* The extension must always be empty */
667 if (PACKET_remaining(pkt) != 0) {
668 *al = SSL_AD_DECODE_ERROR;
672 s->s3->flags |= TLS1_FLAGS_RECEIVED_EXTMS;
677 int tls_parse_ctos_psk(SSL *s, PACKET *pkt, unsigned int context, X509 *x,
678 size_t chainidx, int *al)
680 PACKET identities, binders, binder;
681 size_t binderoffset, hashsize;
682 SSL_SESSION *sess = NULL;
684 const EVP_MD *md = NULL;
687 * If we have no PSK kex mode that we recognise then we can't resume so
688 * ignore this extension
690 if ((s->ext.psk_kex_mode
691 & (TLSEXT_KEX_MODE_FLAG_KE | TLSEXT_KEX_MODE_FLAG_KE_DHE)) == 0)
694 if (!PACKET_get_length_prefixed_2(pkt, &identities)) {
695 *al = SSL_AD_DECODE_ERROR;
699 for (id = 0; PACKET_remaining(&identities) != 0; id++) {
701 unsigned long ticket_age;
704 if (!PACKET_get_length_prefixed_2(&identities, &identity)
705 || !PACKET_get_net_4(&identities, &ticket_age)) {
706 *al = SSL_AD_DECODE_ERROR;
710 /* TODO(TLS1.3): Should we validate the ticket age? */
712 ret = tls_decrypt_ticket(s, PACKET_data(&identity),
713 PACKET_remaining(&identity), NULL, 0, &sess);
714 if (ret == TICKET_FATAL_ERR_MALLOC || ret == TICKET_FATAL_ERR_OTHER) {
715 *al = SSL_AD_INTERNAL_ERROR;
718 if (ret == TICKET_NO_DECRYPT)
721 md = ssl_md(sess->cipher->algorithm2);
724 * Don't recognise this cipher so we can't use the session.
727 SSL_SESSION_free(sess);
733 * TODO(TLS1.3): Somehow we need to handle the case of a ticket renewal.
743 binderoffset = PACKET_data(pkt) - (const unsigned char *)s->init_buf->data;
744 hashsize = EVP_MD_size(md);
746 if (!PACKET_get_length_prefixed_2(pkt, &binders)) {
747 *al = SSL_AD_DECODE_ERROR;
751 for (i = 0; i <= id; i++) {
752 if (!PACKET_get_length_prefixed_1(&binders, &binder)) {
753 *al = SSL_AD_DECODE_ERROR;
758 if (PACKET_remaining(&binder) != hashsize
759 || tls_psk_do_binder(s, md,
760 (const unsigned char *)s->init_buf->data,
761 binderoffset, PACKET_data(&binder), NULL,
763 *al = SSL_AD_DECODE_ERROR;
764 SSLerr(SSL_F_TLS_PARSE_CTOS_PSK, ERR_R_INTERNAL_ERROR);
768 sess->ext.tick_identity = id;
769 SSL_SESSION_free(s->session);
777 * Add the server's renegotiation binding
779 int tls_construct_stoc_renegotiate(SSL *s, WPACKET *pkt, unsigned int context,
780 X509 *x, size_t chainidx, int *al)
782 if (!s->s3->send_connection_binding)
785 if (!WPACKET_put_bytes_u16(pkt, TLSEXT_TYPE_renegotiate)
786 || !WPACKET_start_sub_packet_u16(pkt)
787 || !WPACKET_start_sub_packet_u8(pkt)
788 || !WPACKET_memcpy(pkt, s->s3->previous_client_finished,
789 s->s3->previous_client_finished_len)
790 || !WPACKET_memcpy(pkt, s->s3->previous_server_finished,
791 s->s3->previous_server_finished_len)
792 || !WPACKET_close(pkt)
793 || !WPACKET_close(pkt)) {
794 SSLerr(SSL_F_TLS_CONSTRUCT_STOC_RENEGOTIATE, ERR_R_INTERNAL_ERROR);
801 int tls_construct_stoc_server_name(SSL *s, WPACKET *pkt, unsigned int context,
802 X509 *x, size_t chainidx, int *al)
804 if (s->hit || s->servername_done != 1
805 || s->session->ext.hostname == NULL)
808 if (!WPACKET_put_bytes_u16(pkt, TLSEXT_TYPE_server_name)
809 || !WPACKET_put_bytes_u16(pkt, 0)) {
810 SSLerr(SSL_F_TLS_CONSTRUCT_STOC_SERVER_NAME, ERR_R_INTERNAL_ERROR);
817 int tls_construct_stoc_early_data_info(SSL *s, WPACKET *pkt,
818 unsigned int context, X509 *x,
819 size_t chainidx, int *al)
821 if (s->max_early_data == 0)
824 if (!WPACKET_put_bytes_u16(pkt, TLSEXT_TYPE_early_data_info)
825 || !WPACKET_start_sub_packet_u16(pkt)
826 || !WPACKET_put_bytes_u32(pkt, s->max_early_data)
827 || !WPACKET_close(pkt)) {
828 SSLerr(SSL_F_TLS_CONSTRUCT_STOC_EARLY_DATA_INFO, ERR_R_INTERNAL_ERROR);
835 #ifndef OPENSSL_NO_EC
836 int tls_construct_stoc_ec_pt_formats(SSL *s, WPACKET *pkt, unsigned int context,
837 X509 *x, size_t chainidx, int *al)
839 unsigned long alg_k = s->s3->tmp.new_cipher->algorithm_mkey;
840 unsigned long alg_a = s->s3->tmp.new_cipher->algorithm_auth;
841 int using_ecc = ((alg_k & SSL_kECDHE) || (alg_a & SSL_aECDSA))
842 && (s->session->ext.ecpointformats != NULL);
843 const unsigned char *plist;
849 tls1_get_formatlist(s, &plist, &plistlen);
850 if (!WPACKET_put_bytes_u16(pkt, TLSEXT_TYPE_ec_point_formats)
851 || !WPACKET_start_sub_packet_u16(pkt)
852 || !WPACKET_sub_memcpy_u8(pkt, plist, plistlen)
853 || !WPACKET_close(pkt)) {
854 SSLerr(SSL_F_TLS_CONSTRUCT_STOC_EC_PT_FORMATS, ERR_R_INTERNAL_ERROR);
862 int tls_construct_stoc_session_ticket(SSL *s, WPACKET *pkt,
863 unsigned int context, X509 *x,
864 size_t chainidx, int *al)
866 if (!s->ext.ticket_expected || !tls_use_ticket(s)) {
867 s->ext.ticket_expected = 0;
871 if (!WPACKET_put_bytes_u16(pkt, TLSEXT_TYPE_session_ticket)
872 || !WPACKET_put_bytes_u16(pkt, 0)) {
873 SSLerr(SSL_F_TLS_CONSTRUCT_STOC_SESSION_TICKET, ERR_R_INTERNAL_ERROR);
880 #ifndef OPENSSL_NO_OCSP
881 int tls_construct_stoc_status_request(SSL *s, WPACKET *pkt,
882 unsigned int context, X509 *x,
883 size_t chainidx, int *al)
885 if (!s->ext.status_expected)
888 if (SSL_IS_TLS13(s) && chainidx != 0)
891 if (!WPACKET_put_bytes_u16(pkt, TLSEXT_TYPE_status_request)
892 || !WPACKET_start_sub_packet_u16(pkt)) {
893 SSLerr(SSL_F_TLS_CONSTRUCT_STOC_STATUS_REQUEST, ERR_R_INTERNAL_ERROR);
898 * In TLSv1.3 we include the certificate status itself. In <= TLSv1.2 we
899 * send back an empty extension, with the certificate status appearing as a
902 if ((SSL_IS_TLS13(s) && !tls_construct_cert_status_body(s, pkt))
903 || !WPACKET_close(pkt)) {
904 SSLerr(SSL_F_TLS_CONSTRUCT_STOC_STATUS_REQUEST, ERR_R_INTERNAL_ERROR);
912 #ifndef OPENSSL_NO_NEXTPROTONEG
913 int tls_construct_stoc_next_proto_neg(SSL *s, WPACKET *pkt,
914 unsigned int context, X509 *x,
915 size_t chainidx, int *al)
917 const unsigned char *npa;
920 int npn_seen = s->s3->npn_seen;
923 if (!npn_seen || s->ctx->ext.npn_advertised_cb == NULL)
926 ret = s->ctx->ext.npn_advertised_cb(s, &npa, &npalen,
927 s->ctx->ext.npn_advertised_cb_arg);
928 if (ret == SSL_TLSEXT_ERR_OK) {
929 if (!WPACKET_put_bytes_u16(pkt, TLSEXT_TYPE_next_proto_neg)
930 || !WPACKET_sub_memcpy_u16(pkt, npa, npalen)) {
931 SSLerr(SSL_F_TLS_CONSTRUCT_STOC_NEXT_PROTO_NEG,
932 ERR_R_INTERNAL_ERROR);
942 int tls_construct_stoc_alpn(SSL *s, WPACKET *pkt, unsigned int context, X509 *x,
943 size_t chainidx, int *al)
945 if (s->s3->alpn_selected == NULL)
948 if (!WPACKET_put_bytes_u16(pkt,
949 TLSEXT_TYPE_application_layer_protocol_negotiation)
950 || !WPACKET_start_sub_packet_u16(pkt)
951 || !WPACKET_start_sub_packet_u16(pkt)
952 || !WPACKET_sub_memcpy_u8(pkt, s->s3->alpn_selected,
953 s->s3->alpn_selected_len)
954 || !WPACKET_close(pkt)
955 || !WPACKET_close(pkt)) {
956 SSLerr(SSL_F_TLS_CONSTRUCT_STOC_ALPN, ERR_R_INTERNAL_ERROR);
963 #ifndef OPENSSL_NO_SRTP
964 int tls_construct_stoc_use_srtp(SSL *s, WPACKET *pkt, unsigned int context,
965 X509 *x, size_t chainidx, int *al)
967 if (s->srtp_profile == NULL)
970 if (!WPACKET_put_bytes_u16(pkt, TLSEXT_TYPE_use_srtp)
971 || !WPACKET_start_sub_packet_u16(pkt)
972 || !WPACKET_put_bytes_u16(pkt, 2)
973 || !WPACKET_put_bytes_u16(pkt, s->srtp_profile->id)
974 || !WPACKET_put_bytes_u8(pkt, 0)
975 || !WPACKET_close(pkt)) {
976 SSLerr(SSL_F_TLS_CONSTRUCT_STOC_USE_SRTP, ERR_R_INTERNAL_ERROR);
984 int tls_construct_stoc_etm(SSL *s, WPACKET *pkt, unsigned int context, X509 *x,
985 size_t chainidx, int *al)
991 * Don't use encrypt_then_mac if AEAD or RC4 might want to disable
992 * for other cases too.
994 if (s->s3->tmp.new_cipher->algorithm_mac == SSL_AEAD
995 || s->s3->tmp.new_cipher->algorithm_enc == SSL_RC4
996 || s->s3->tmp.new_cipher->algorithm_enc == SSL_eGOST2814789CNT
997 || s->s3->tmp.new_cipher->algorithm_enc == SSL_eGOST2814789CNT12) {
1002 if (!WPACKET_put_bytes_u16(pkt, TLSEXT_TYPE_encrypt_then_mac)
1003 || !WPACKET_put_bytes_u16(pkt, 0)) {
1004 SSLerr(SSL_F_TLS_CONSTRUCT_STOC_ETM, ERR_R_INTERNAL_ERROR);
1011 int tls_construct_stoc_ems(SSL *s, WPACKET *pkt, unsigned int context, X509 *x,
1012 size_t chainidx, int *al)
1014 if ((s->s3->flags & TLS1_FLAGS_RECEIVED_EXTMS) == 0)
1017 if (!WPACKET_put_bytes_u16(pkt, TLSEXT_TYPE_extended_master_secret)
1018 || !WPACKET_put_bytes_u16(pkt, 0)) {
1019 SSLerr(SSL_F_TLS_CONSTRUCT_STOC_EMS, ERR_R_INTERNAL_ERROR);
1026 int tls_construct_stoc_key_share(SSL *s, WPACKET *pkt, unsigned int context,
1027 X509 *x, size_t chainidx, int *al)
1029 #ifndef OPENSSL_NO_TLS1_3
1030 unsigned char *encodedPoint;
1031 size_t encoded_pt_len = 0;
1032 EVP_PKEY *ckey = s->s3->peer_tmp, *skey = NULL;
1035 /* No key_share received from client */
1036 if (s->hello_retry_request) {
1037 if (!WPACKET_put_bytes_u16(pkt, TLSEXT_TYPE_key_share)
1038 || !WPACKET_start_sub_packet_u16(pkt)
1039 || !WPACKET_put_bytes_u16(pkt, s->s3->group_id)
1040 || !WPACKET_close(pkt)) {
1041 SSLerr(SSL_F_TLS_CONSTRUCT_STOC_KEY_SHARE,
1042 ERR_R_INTERNAL_ERROR);
1049 /* Must be resuming. */
1050 if (!s->hit || !tls13_generate_handshake_secret(s, NULL, 0)) {
1051 *al = SSL_AD_INTERNAL_ERROR;
1052 SSLerr(SSL_F_TLS_CONSTRUCT_STOC_KEY_SHARE, ERR_R_INTERNAL_ERROR);
1058 if (!WPACKET_put_bytes_u16(pkt, TLSEXT_TYPE_key_share)
1059 || !WPACKET_start_sub_packet_u16(pkt)
1060 || !WPACKET_put_bytes_u16(pkt, s->s3->group_id)) {
1061 SSLerr(SSL_F_TLS_CONSTRUCT_STOC_KEY_SHARE, ERR_R_INTERNAL_ERROR);
1065 skey = ssl_generate_pkey(ckey);
1067 SSLerr(SSL_F_TLS_CONSTRUCT_STOC_KEY_SHARE, ERR_R_MALLOC_FAILURE);
1071 /* Generate encoding of server key */
1072 encoded_pt_len = EVP_PKEY_get1_tls_encodedpoint(skey, &encodedPoint);
1073 if (encoded_pt_len == 0) {
1074 SSLerr(SSL_F_TLS_CONSTRUCT_STOC_KEY_SHARE, ERR_R_EC_LIB);
1075 EVP_PKEY_free(skey);
1079 if (!WPACKET_sub_memcpy_u16(pkt, encodedPoint, encoded_pt_len)
1080 || !WPACKET_close(pkt)) {
1081 SSLerr(SSL_F_TLS_CONSTRUCT_STOC_KEY_SHARE, ERR_R_INTERNAL_ERROR);
1082 EVP_PKEY_free(skey);
1083 OPENSSL_free(encodedPoint);
1086 OPENSSL_free(encodedPoint);
1088 /* This causes the crypto state to be updated based on the derived keys */
1089 s->s3->tmp.pkey = skey;
1090 if (ssl_derive(s, skey, ckey, 1) == 0) {
1091 SSLerr(SSL_F_TLS_CONSTRUCT_STOC_KEY_SHARE, ERR_R_INTERNAL_ERROR);
1099 int tls_construct_stoc_cryptopro_bug(SSL *s, WPACKET *pkt, unsigned int context,
1100 X509 *x, size_t chainidx, int *al)
1102 const unsigned char cryptopro_ext[36] = {
1103 0xfd, 0xe8, /* 65000 */
1104 0x00, 0x20, /* 32 bytes length */
1105 0x30, 0x1e, 0x30, 0x08, 0x06, 0x06, 0x2a, 0x85,
1106 0x03, 0x02, 0x02, 0x09, 0x30, 0x08, 0x06, 0x06,
1107 0x2a, 0x85, 0x03, 0x02, 0x02, 0x16, 0x30, 0x08,
1108 0x06, 0x06, 0x2a, 0x85, 0x03, 0x02, 0x02, 0x17
1111 if (((s->s3->tmp.new_cipher->id & 0xFFFF) != 0x80
1112 && (s->s3->tmp.new_cipher->id & 0xFFFF) != 0x81)
1113 || (SSL_get_options(s) & SSL_OP_CRYPTOPRO_TLSEXT_BUG) == 0)
1116 if (!WPACKET_memcpy(pkt, cryptopro_ext, sizeof(cryptopro_ext))) {
1117 SSLerr(SSL_F_TLS_CONSTRUCT_STOC_CRYPTOPRO_BUG, ERR_R_INTERNAL_ERROR);
1124 int tls_construct_stoc_psk(SSL *s, WPACKET *pkt, unsigned int context, X509 *x,
1125 size_t chainidx, int *al)
1130 if (!WPACKET_put_bytes_u16(pkt, TLSEXT_TYPE_psk)
1131 || !WPACKET_start_sub_packet_u16(pkt)
1132 || !WPACKET_put_bytes_u16(pkt, s->session->ext.tick_identity)
1133 || !WPACKET_close(pkt)) {
1134 SSLerr(SSL_F_TLS_CONSTRUCT_STOC_PSK, ERR_R_INTERNAL_ERROR);