]> git.ipfire.org Git - thirdparty/openssl.git/blame - ssl/statem/extensions_clnt.c
Coverity: misuses of time_t
[thirdparty/openssl.git] / ssl / statem / extensions_clnt.c
CommitLineData
6dd083fd 1/*
fecb3aae 2 * Copyright 2016-2022 The OpenSSL Project Authors. All Rights Reserved.
6dd083fd 3 *
2c18d164 4 * Licensed under the Apache License 2.0 (the "License"). You may not use
6dd083fd
MC
5 * this file except in compliance with the License. You can obtain a copy
6 * in the file LICENSE in the source distribution or at
7 * https://www.openssl.org/source/license.html
8 */
9
ab83e314 10#include <openssl/ocsp.h>
706457b7 11#include "../ssl_local.h"
67dc995e 12#include "internal/cryptlib.h"
706457b7 13#include "statem_local.h"
6dd083fd 14
38b051a1 15EXT_RETURN tls_construct_ctos_renegotiate(SSL_CONNECTION *s, WPACKET *pkt,
b186a592 16 unsigned int context, X509 *x,
f63a17d6 17 size_t chainidx)
ab83e314
MC
18{
19 /* Add RI if renegotiating */
20 if (!s->renegotiate)
b186a592 21 return EXT_RETURN_NOT_SENT;
ab83e314
MC
22
23 if (!WPACKET_put_bytes_u16(pkt, TLSEXT_TYPE_renegotiate)
24 || !WPACKET_start_sub_packet_u16(pkt)
555cbb32
TS
25 || !WPACKET_sub_memcpy_u8(pkt, s->s3.previous_client_finished,
26 s->s3.previous_client_finished_len)
ab83e314 27 || !WPACKET_close(pkt)) {
c48ffbcc 28 SSLfatal(s, SSL_AD_INTERNAL_ERROR, ERR_R_INTERNAL_ERROR);
b186a592 29 return EXT_RETURN_FAIL;
ab83e314
MC
30 }
31
b186a592 32 return EXT_RETURN_SENT;
ab83e314
MC
33}
34
38b051a1 35EXT_RETURN tls_construct_ctos_server_name(SSL_CONNECTION *s, WPACKET *pkt,
b186a592 36 unsigned int context, X509 *x,
f63a17d6 37 size_t chainidx)
ab83e314 38{
aff8c126 39 if (s->ext.hostname == NULL)
b186a592 40 return EXT_RETURN_NOT_SENT;
ab83e314
MC
41
42 /* Add TLS extension servername to the Client Hello message */
43 if (!WPACKET_put_bytes_u16(pkt, TLSEXT_TYPE_server_name)
44 /* Sub-packet for server_name extension */
45 || !WPACKET_start_sub_packet_u16(pkt)
46 /* Sub-packet for servername list (always 1 hostname)*/
47 || !WPACKET_start_sub_packet_u16(pkt)
48 || !WPACKET_put_bytes_u8(pkt, TLSEXT_NAMETYPE_host_name)
aff8c126
RS
49 || !WPACKET_sub_memcpy_u16(pkt, s->ext.hostname,
50 strlen(s->ext.hostname))
ab83e314
MC
51 || !WPACKET_close(pkt)
52 || !WPACKET_close(pkt)) {
c48ffbcc 53 SSLfatal(s, SSL_AD_INTERNAL_ERROR, ERR_R_INTERNAL_ERROR);
b186a592 54 return EXT_RETURN_FAIL;
ab83e314
MC
55 }
56
b186a592 57 return EXT_RETURN_SENT;
ab83e314
MC
58}
59
cf72c757 60/* Push a Max Fragment Len extension into ClientHello */
38b051a1 61EXT_RETURN tls_construct_ctos_maxfragmentlen(SSL_CONNECTION *s, WPACKET *pkt,
cf72c757 62 unsigned int context, X509 *x,
f63a17d6 63 size_t chainidx)
cf72c757
F
64{
65 if (s->ext.max_fragment_len_mode == TLSEXT_max_fragment_length_DISABLED)
66 return EXT_RETURN_NOT_SENT;
67
68 /* Add Max Fragment Length extension if client enabled it. */
69 /*-
70 * 4 bytes for this extension type and extension length
71 * 1 byte for the Max Fragment Length code value.
72 */
73 if (!WPACKET_put_bytes_u16(pkt, TLSEXT_TYPE_max_fragment_length)
74 /* Sub-packet for Max Fragment Length extension (1 byte) */
75 || !WPACKET_start_sub_packet_u16(pkt)
76 || !WPACKET_put_bytes_u8(pkt, s->ext.max_fragment_len_mode)
77 || !WPACKET_close(pkt)) {
c48ffbcc 78 SSLfatal(s, SSL_AD_INTERNAL_ERROR, ERR_R_INTERNAL_ERROR);
cf72c757
F
79 return EXT_RETURN_FAIL;
80 }
81
82 return EXT_RETURN_SENT;
83}
84
ab83e314 85#ifndef OPENSSL_NO_SRP
38b051a1
TM
86EXT_RETURN tls_construct_ctos_srp(SSL_CONNECTION *s, WPACKET *pkt,
87 unsigned int context,
f63a17d6 88 X509 *x, size_t chainidx)
ab83e314
MC
89{
90 /* Add SRP username if there is one */
91 if (s->srp_ctx.login == NULL)
b186a592 92 return EXT_RETURN_NOT_SENT;
ab83e314
MC
93
94 if (!WPACKET_put_bytes_u16(pkt, TLSEXT_TYPE_srp)
95 /* Sub-packet for SRP extension */
96 || !WPACKET_start_sub_packet_u16(pkt)
97 || !WPACKET_start_sub_packet_u8(pkt)
98 /* login must not be zero...internal error if so */
99 || !WPACKET_set_flags(pkt, WPACKET_FLAGS_NON_ZERO_LENGTH)
100 || !WPACKET_memcpy(pkt, s->srp_ctx.login,
101 strlen(s->srp_ctx.login))
102 || !WPACKET_close(pkt)
103 || !WPACKET_close(pkt)) {
c48ffbcc 104 SSLfatal(s, SSL_AD_INTERNAL_ERROR, ERR_R_INTERNAL_ERROR);
b186a592 105 return EXT_RETURN_FAIL;
ab83e314
MC
106 }
107
b186a592 108 return EXT_RETURN_SENT;
ab83e314
MC
109}
110#endif
111
38b051a1 112static int use_ecc(SSL_CONNECTION *s, int min_version, int max_version)
ab83e314 113{
589b6227 114 int i, end, ret = 0;
ab83e314
MC
115 unsigned long alg_k, alg_a;
116 STACK_OF(SSL_CIPHER) *cipher_stack = NULL;
dbc6268f
MC
117 const uint16_t *pgroups = NULL;
118 size_t num_groups, j;
38b051a1 119 SSL *ssl = SSL_CONNECTION_GET_SSL(s);
ab83e314
MC
120
121 /* See if we support any ECC ciphersuites */
122 if (s->version == SSL3_VERSION)
123 return 0;
124
38b051a1 125 cipher_stack = SSL_get1_supported_ciphers(ssl);
1266eefd
MC
126 end = sk_SSL_CIPHER_num(cipher_stack);
127 for (i = 0; i < end; i++) {
ab83e314
MC
128 const SSL_CIPHER *c = sk_SSL_CIPHER_value(cipher_stack, i);
129
130 alg_k = c->algorithm_mkey;
131 alg_a = c->algorithm_auth;
132 if ((alg_k & (SSL_kECDHE | SSL_kECDHEPSK))
1266eefd 133 || (alg_a & SSL_aECDSA)
589b6227
MC
134 || c->min_tls >= TLS1_3_VERSION) {
135 ret = 1;
136 break;
137 }
ab83e314 138 }
589b6227 139 sk_SSL_CIPHER_free(cipher_stack);
dbc6268f
MC
140 if (!ret)
141 return 0;
142
143 /* Check we have at least one EC supported group */
144 tls1_get_supported_groups(s, &pgroups, &num_groups);
145 for (j = 0; j < num_groups; j++) {
146 uint16_t ctmp = pgroups[j];
147
8b1db5d3 148 if (tls_valid_group(s, ctmp, min_version, max_version, 1, NULL)
dbc6268f
MC
149 && tls_group_allowed(s, ctmp, SSL_SECOP_CURVE_SUPPORTED))
150 return 1;
151 }
152
153 return 0;
ab83e314
MC
154}
155
38b051a1 156EXT_RETURN tls_construct_ctos_ec_pt_formats(SSL_CONNECTION *s, WPACKET *pkt,
b186a592 157 unsigned int context, X509 *x,
f63a17d6 158 size_t chainidx)
ab83e314
MC
159{
160 const unsigned char *pformats;
161 size_t num_formats;
dbc6268f 162 int reason, min_version, max_version;
ab83e314 163
dbc6268f
MC
164 reason = ssl_get_min_max_version(s, &min_version, &max_version, NULL);
165 if (reason != 0) {
c48ffbcc 166 SSLfatal(s, SSL_AD_INTERNAL_ERROR, reason);
dbc6268f
MC
167 return EXT_RETURN_FAIL;
168 }
9d2d857f 169 if (!use_ecc(s, min_version, max_version))
b186a592 170 return EXT_RETURN_NOT_SENT;
ab83e314
MC
171
172 /* Add TLS extension ECPointFormats to the ClientHello message */
ab83e314
MC
173 tls1_get_formatlist(s, &pformats, &num_formats);
174
175 if (!WPACKET_put_bytes_u16(pkt, TLSEXT_TYPE_ec_point_formats)
176 /* Sub-packet for formats extension */
177 || !WPACKET_start_sub_packet_u16(pkt)
178 || !WPACKET_sub_memcpy_u8(pkt, pformats, num_formats)
179 || !WPACKET_close(pkt)) {
c48ffbcc 180 SSLfatal(s, SSL_AD_INTERNAL_ERROR, ERR_R_INTERNAL_ERROR);
b186a592 181 return EXT_RETURN_FAIL;
ab83e314
MC
182 }
183
b186a592 184 return EXT_RETURN_SENT;
ab83e314
MC
185}
186
38b051a1 187EXT_RETURN tls_construct_ctos_supported_groups(SSL_CONNECTION *s, WPACKET *pkt,
b186a592 188 unsigned int context, X509 *x,
f63a17d6 189 size_t chainidx)
ab83e314 190{
f48d826e 191 const uint16_t *pgroups = NULL;
8b1db5d3 192 size_t num_groups = 0, i, tls13added = 0, added = 0;
9aaecbfc 193 int min_version, max_version, reason;
ab83e314 194
9aaecbfc 195 reason = ssl_get_min_max_version(s, &min_version, &max_version, NULL);
196 if (reason != 0) {
c48ffbcc 197 SSLfatal(s, SSL_AD_INTERNAL_ERROR, reason);
9aaecbfc 198 return EXT_RETURN_FAIL;
199 }
200
8b1db5d3
MC
201 /*
202 * We only support EC groups in TLSv1.2 or below, and in DTLS. Therefore
203 * if we don't have EC support then we don't send this extension.
204 */
205 if (!use_ecc(s, min_version, max_version)
38b051a1 206 && (SSL_CONNECTION_IS_DTLS(s) || max_version < TLS1_3_VERSION))
dbc6268f 207 return EXT_RETURN_NOT_SENT;
dbc6268f 208
ab83e314
MC
209 /*
210 * Add TLS extension supported_groups to the ClientHello message
211 */
f48d826e 212 tls1_get_supported_groups(s, &pgroups, &num_groups);
ab83e314
MC
213
214 if (!WPACKET_put_bytes_u16(pkt, TLSEXT_TYPE_supported_groups)
215 /* Sub-packet for supported_groups extension */
216 || !WPACKET_start_sub_packet_u16(pkt)
9aaecbfc 217 || !WPACKET_start_sub_packet_u16(pkt)
218 || !WPACKET_set_flags(pkt, WPACKET_FLAGS_NON_ZERO_LENGTH)) {
c48ffbcc 219 SSLfatal(s, SSL_AD_INTERNAL_ERROR, ERR_R_INTERNAL_ERROR);
b186a592 220 return EXT_RETURN_FAIL;
ab83e314 221 }
9aaecbfc 222 /* Copy group ID if supported */
f48d826e
DSH
223 for (i = 0; i < num_groups; i++) {
224 uint16_t ctmp = pgroups[i];
8b1db5d3 225 int okfortls13;
9e84a42d 226
8b1db5d3 227 if (tls_valid_group(s, ctmp, min_version, max_version, 0, &okfortls13)
dbc6268f 228 && tls_group_allowed(s, ctmp, SSL_SECOP_CURVE_SUPPORTED)) {
0a10825a
BE
229#ifndef OPENSSL_NO_TLS1_3
230 int ctmp13 = ssl_group_id_internal_to_tls13(ctmp);
231
232 if (ctmp13 != 0 && ctmp13 != ctmp
233 && max_version == TLS1_3_VERSION) {
234 if (!WPACKET_put_bytes_u16(pkt, ctmp13)) {
235 SSLfatal(s, SSL_AD_INTERNAL_ERROR, ERR_R_INTERNAL_ERROR);
236 return EXT_RETURN_FAIL;
237 }
238 tls13added++;
239 added++;
240 if (min_version == TLS1_3_VERSION)
241 continue;
242 }
243#endif
9e84a42d 244 if (!WPACKET_put_bytes_u16(pkt, ctmp)) {
c48ffbcc 245 SSLfatal(s, SSL_AD_INTERNAL_ERROR, ERR_R_INTERNAL_ERROR);
9aaecbfc 246 return EXT_RETURN_FAIL;
247 }
8b1db5d3
MC
248 if (okfortls13 && max_version == TLS1_3_VERSION)
249 tls13added++;
250 added++;
ab83e314
MC
251 }
252 }
253 if (!WPACKET_close(pkt) || !WPACKET_close(pkt)) {
9afc6c54 254 if (added == 0)
8b1db5d3
MC
255 SSLfatal_data(s, SSL_AD_INTERNAL_ERROR, SSL_R_NO_SUITABLE_GROUPS,
256 "No groups enabled for max supported SSL/TLS version");
257 else
258 SSLfatal(s, SSL_AD_INTERNAL_ERROR, ERR_R_INTERNAL_ERROR);
b186a592 259 return EXT_RETURN_FAIL;
9afc6c54
MC
260 }
261
262 if (tls13added == 0 && max_version == TLS1_3_VERSION) {
263 SSLfatal_data(s, SSL_AD_INTERNAL_ERROR, SSL_R_NO_SUITABLE_GROUPS,
264 "No groups enabled for max supported SSL/TLS version");
265 return EXT_RETURN_FAIL;
ab83e314
MC
266 }
267
b186a592 268 return EXT_RETURN_SENT;
ab83e314 269}
ab83e314 270
38b051a1 271EXT_RETURN tls_construct_ctos_session_ticket(SSL_CONNECTION *s, WPACKET *pkt,
b186a592 272 unsigned int context, X509 *x,
f63a17d6 273 size_t chainidx)
ab83e314
MC
274{
275 size_t ticklen;
276
277 if (!tls_use_ticket(s))
b186a592 278 return EXT_RETURN_NOT_SENT;
ab83e314
MC
279
280 if (!s->new_session && s->session != NULL
08191294
MC
281 && s->session->ext.tick != NULL
282 && s->session->ssl_version != TLS1_3_VERSION) {
aff8c126
RS
283 ticklen = s->session->ext.ticklen;
284 } else if (s->session && s->ext.session_ticket != NULL
285 && s->ext.session_ticket->data != NULL) {
286 ticklen = s->ext.session_ticket->length;
287 s->session->ext.tick = OPENSSL_malloc(ticklen);
288 if (s->session->ext.tick == NULL) {
c48ffbcc 289 SSLfatal(s, SSL_AD_INTERNAL_ERROR, ERR_R_INTERNAL_ERROR);
b186a592 290 return EXT_RETURN_FAIL;
ab83e314 291 }
aff8c126
RS
292 memcpy(s->session->ext.tick,
293 s->ext.session_ticket->data, ticklen);
294 s->session->ext.ticklen = ticklen;
ab83e314
MC
295 } else {
296 ticklen = 0;
297 }
298
aff8c126
RS
299 if (ticklen == 0 && s->ext.session_ticket != NULL &&
300 s->ext.session_ticket->data == NULL)
b186a592 301 return EXT_RETURN_NOT_SENT;
ab83e314
MC
302
303 if (!WPACKET_put_bytes_u16(pkt, TLSEXT_TYPE_session_ticket)
aff8c126 304 || !WPACKET_sub_memcpy_u16(pkt, s->session->ext.tick, ticklen)) {
c48ffbcc 305 SSLfatal(s, SSL_AD_INTERNAL_ERROR, ERR_R_INTERNAL_ERROR);
b186a592 306 return EXT_RETURN_FAIL;
ab83e314
MC
307 }
308
b186a592 309 return EXT_RETURN_SENT;
ab83e314
MC
310}
311
38b051a1 312EXT_RETURN tls_construct_ctos_sig_algs(SSL_CONNECTION *s, WPACKET *pkt,
b186a592 313 unsigned int context, X509 *x,
f63a17d6 314 size_t chainidx)
ab83e314
MC
315{
316 size_t salglen;
98c792d1 317 const uint16_t *salg;
ab83e314
MC
318
319 if (!SSL_CLIENT_USE_SIGALGS(s))
b186a592 320 return EXT_RETURN_NOT_SENT;
ab83e314 321
a9669ddc 322 salglen = tls12_get_psigalgs(s, 1, &salg);
ab83e314
MC
323 if (!WPACKET_put_bytes_u16(pkt, TLSEXT_TYPE_signature_algorithms)
324 /* Sub-packet for sig-algs extension */
325 || !WPACKET_start_sub_packet_u16(pkt)
326 /* Sub-packet for the actual list */
327 || !WPACKET_start_sub_packet_u16(pkt)
328 || !tls12_copy_sigalgs(s, pkt, salg, salglen)
329 || !WPACKET_close(pkt)
330 || !WPACKET_close(pkt)) {
c48ffbcc 331 SSLfatal(s, SSL_AD_INTERNAL_ERROR, ERR_R_INTERNAL_ERROR);
b186a592 332 return EXT_RETURN_FAIL;
ab83e314
MC
333 }
334
b186a592 335 return EXT_RETURN_SENT;
ab83e314
MC
336}
337
338#ifndef OPENSSL_NO_OCSP
38b051a1 339EXT_RETURN tls_construct_ctos_status_request(SSL_CONNECTION *s, WPACKET *pkt,
b186a592 340 unsigned int context, X509 *x,
f63a17d6 341 size_t chainidx)
ab83e314
MC
342{
343 int i;
344
e96e0f8e
MC
345 /* This extension isn't defined for client Certificates */
346 if (x != NULL)
b186a592 347 return EXT_RETURN_NOT_SENT;
e96e0f8e 348
aff8c126 349 if (s->ext.status_type != TLSEXT_STATUSTYPE_ocsp)
b186a592 350 return EXT_RETURN_NOT_SENT;
ab83e314
MC
351
352 if (!WPACKET_put_bytes_u16(pkt, TLSEXT_TYPE_status_request)
353 /* Sub-packet for status request extension */
354 || !WPACKET_start_sub_packet_u16(pkt)
355 || !WPACKET_put_bytes_u8(pkt, TLSEXT_STATUSTYPE_ocsp)
356 /* Sub-packet for the ids */
357 || !WPACKET_start_sub_packet_u16(pkt)) {
c48ffbcc 358 SSLfatal(s, SSL_AD_INTERNAL_ERROR, ERR_R_INTERNAL_ERROR);
b186a592 359 return EXT_RETURN_FAIL;
ab83e314 360 }
aff8c126 361 for (i = 0; i < sk_OCSP_RESPID_num(s->ext.ocsp.ids); i++) {
ab83e314 362 unsigned char *idbytes;
aff8c126 363 OCSP_RESPID *id = sk_OCSP_RESPID_value(s->ext.ocsp.ids, i);
1266eefd 364 int idlen = i2d_OCSP_RESPID(id, NULL);
ab83e314 365
ab83e314
MC
366 if (idlen <= 0
367 /* Sub-packet for an individual id */
368 || !WPACKET_sub_allocate_bytes_u16(pkt, idlen, &idbytes)
369 || i2d_OCSP_RESPID(id, &idbytes) != idlen) {
c48ffbcc 370 SSLfatal(s, SSL_AD_INTERNAL_ERROR, ERR_R_INTERNAL_ERROR);
b186a592 371 return EXT_RETURN_FAIL;
ab83e314
MC
372 }
373 }
374 if (!WPACKET_close(pkt)
375 || !WPACKET_start_sub_packet_u16(pkt)) {
c48ffbcc 376 SSLfatal(s, SSL_AD_INTERNAL_ERROR, ERR_R_INTERNAL_ERROR);
b186a592 377 return EXT_RETURN_FAIL;
ab83e314 378 }
aff8c126 379 if (s->ext.ocsp.exts) {
ab83e314 380 unsigned char *extbytes;
aff8c126 381 int extlen = i2d_X509_EXTENSIONS(s->ext.ocsp.exts, NULL);
ab83e314
MC
382
383 if (extlen < 0) {
c48ffbcc 384 SSLfatal(s, SSL_AD_INTERNAL_ERROR, ERR_R_INTERNAL_ERROR);
b186a592 385 return EXT_RETURN_FAIL;
ab83e314
MC
386 }
387 if (!WPACKET_allocate_bytes(pkt, extlen, &extbytes)
aff8c126 388 || i2d_X509_EXTENSIONS(s->ext.ocsp.exts, &extbytes)
ab83e314 389 != extlen) {
c48ffbcc 390 SSLfatal(s, SSL_AD_INTERNAL_ERROR, ERR_R_INTERNAL_ERROR);
b186a592 391 return EXT_RETURN_FAIL;
ab83e314
MC
392 }
393 }
394 if (!WPACKET_close(pkt) || !WPACKET_close(pkt)) {
c48ffbcc 395 SSLfatal(s, SSL_AD_INTERNAL_ERROR, ERR_R_INTERNAL_ERROR);
b186a592 396 return EXT_RETURN_FAIL;
ab83e314
MC
397 }
398
b186a592 399 return EXT_RETURN_SENT;
ab83e314
MC
400}
401#endif
402
403#ifndef OPENSSL_NO_NEXTPROTONEG
38b051a1
TM
404EXT_RETURN tls_construct_ctos_npn(SSL_CONNECTION *s, WPACKET *pkt,
405 unsigned int context,
f63a17d6 406 X509 *x, size_t chainidx)
ab83e314 407{
38b051a1
TM
408 if (SSL_CONNECTION_GET_CTX(s)->ext.npn_select_cb == NULL
409 || !SSL_IS_FIRST_HANDSHAKE(s))
b186a592 410 return EXT_RETURN_NOT_SENT;
ab83e314
MC
411
412 /*
413 * The client advertises an empty extension to indicate its support
414 * for Next Protocol Negotiation
415 */
416 if (!WPACKET_put_bytes_u16(pkt, TLSEXT_TYPE_next_proto_neg)
417 || !WPACKET_put_bytes_u16(pkt, 0)) {
c48ffbcc 418 SSLfatal(s, SSL_AD_INTERNAL_ERROR, ERR_R_INTERNAL_ERROR);
b186a592 419 return EXT_RETURN_FAIL;
ab83e314
MC
420 }
421
b186a592 422 return EXT_RETURN_SENT;
ab83e314
MC
423}
424#endif
425
38b051a1
TM
426EXT_RETURN tls_construct_ctos_alpn(SSL_CONNECTION *s, WPACKET *pkt,
427 unsigned int context,
f63a17d6 428 X509 *x, size_t chainidx)
ab83e314 429{
555cbb32 430 s->s3.alpn_sent = 0;
ab83e314 431
c7f47786 432 if (s->ext.alpn == NULL || !SSL_IS_FIRST_HANDSHAKE(s))
b186a592 433 return EXT_RETURN_NOT_SENT;
ab83e314
MC
434
435 if (!WPACKET_put_bytes_u16(pkt,
436 TLSEXT_TYPE_application_layer_protocol_negotiation)
437 /* Sub-packet ALPN extension */
438 || !WPACKET_start_sub_packet_u16(pkt)
aff8c126 439 || !WPACKET_sub_memcpy_u16(pkt, s->ext.alpn, s->ext.alpn_len)
ab83e314 440 || !WPACKET_close(pkt)) {
c48ffbcc 441 SSLfatal(s, SSL_AD_INTERNAL_ERROR, ERR_R_INTERNAL_ERROR);
b186a592 442 return EXT_RETURN_FAIL;
ab83e314 443 }
555cbb32 444 s->s3.alpn_sent = 1;
ab83e314 445
b186a592 446 return EXT_RETURN_SENT;
ab83e314
MC
447}
448
449
450#ifndef OPENSSL_NO_SRTP
38b051a1 451EXT_RETURN tls_construct_ctos_use_srtp(SSL_CONNECTION *s, WPACKET *pkt,
b186a592 452 unsigned int context, X509 *x,
f63a17d6 453 size_t chainidx)
ab83e314 454{
38b051a1
TM
455 SSL *ssl = SSL_CONNECTION_GET_SSL(s);
456 STACK_OF(SRTP_PROTECTION_PROFILE) *clnt = SSL_get_srtp_profiles(ssl);
1266eefd 457 int i, end;
ab83e314
MC
458
459 if (clnt == NULL)
b186a592 460 return EXT_RETURN_NOT_SENT;
ab83e314
MC
461
462 if (!WPACKET_put_bytes_u16(pkt, TLSEXT_TYPE_use_srtp)
463 /* Sub-packet for SRTP extension */
464 || !WPACKET_start_sub_packet_u16(pkt)
465 /* Sub-packet for the protection profile list */
466 || !WPACKET_start_sub_packet_u16(pkt)) {
c48ffbcc 467 SSLfatal(s, SSL_AD_INTERNAL_ERROR, ERR_R_INTERNAL_ERROR);
b186a592 468 return EXT_RETURN_FAIL;
ab83e314 469 }
1266eefd
MC
470
471 end = sk_SRTP_PROTECTION_PROFILE_num(clnt);
472 for (i = 0; i < end; i++) {
473 const SRTP_PROTECTION_PROFILE *prof =
474 sk_SRTP_PROTECTION_PROFILE_value(clnt, i);
475
ab83e314 476 if (prof == NULL || !WPACKET_put_bytes_u16(pkt, prof->id)) {
c48ffbcc 477 SSLfatal(s, SSL_AD_INTERNAL_ERROR, ERR_R_INTERNAL_ERROR);
b186a592 478 return EXT_RETURN_FAIL;
ab83e314
MC
479 }
480 }
481 if (!WPACKET_close(pkt)
482 /* Add an empty use_mki value */
483 || !WPACKET_put_bytes_u8(pkt, 0)
484 || !WPACKET_close(pkt)) {
c48ffbcc 485 SSLfatal(s, SSL_AD_INTERNAL_ERROR, ERR_R_INTERNAL_ERROR);
b186a592 486 return EXT_RETURN_FAIL;
ab83e314
MC
487 }
488
b186a592 489 return EXT_RETURN_SENT;
ab83e314
MC
490}
491#endif
492
38b051a1
TM
493EXT_RETURN tls_construct_ctos_etm(SSL_CONNECTION *s, WPACKET *pkt,
494 unsigned int context,
f63a17d6 495 X509 *x, size_t chainidx)
ab83e314
MC
496{
497 if (s->options & SSL_OP_NO_ENCRYPT_THEN_MAC)
b186a592 498 return EXT_RETURN_NOT_SENT;
ab83e314
MC
499
500 if (!WPACKET_put_bytes_u16(pkt, TLSEXT_TYPE_encrypt_then_mac)
501 || !WPACKET_put_bytes_u16(pkt, 0)) {
c48ffbcc 502 SSLfatal(s, SSL_AD_INTERNAL_ERROR, ERR_R_INTERNAL_ERROR);
b186a592 503 return EXT_RETURN_FAIL;
ab83e314
MC
504 }
505
b186a592 506 return EXT_RETURN_SENT;
ab83e314
MC
507}
508
509#ifndef OPENSSL_NO_CT
38b051a1
TM
510EXT_RETURN tls_construct_ctos_sct(SSL_CONNECTION *s, WPACKET *pkt,
511 unsigned int context,
f63a17d6 512 X509 *x, size_t chainidx)
ab83e314
MC
513{
514 if (s->ct_validation_callback == NULL)
b186a592 515 return EXT_RETURN_NOT_SENT;
ab83e314 516
e96e0f8e
MC
517 /* Not defined for client Certificates */
518 if (x != NULL)
b186a592 519 return EXT_RETURN_NOT_SENT;
e96e0f8e 520
ab83e314
MC
521 if (!WPACKET_put_bytes_u16(pkt, TLSEXT_TYPE_signed_certificate_timestamp)
522 || !WPACKET_put_bytes_u16(pkt, 0)) {
c48ffbcc 523 SSLfatal(s, SSL_AD_INTERNAL_ERROR, ERR_R_INTERNAL_ERROR);
b186a592 524 return EXT_RETURN_FAIL;
ab83e314
MC
525 }
526
b186a592 527 return EXT_RETURN_SENT;
ab83e314
MC
528}
529#endif
530
38b051a1
TM
531EXT_RETURN tls_construct_ctos_ems(SSL_CONNECTION *s, WPACKET *pkt,
532 unsigned int context,
f63a17d6 533 X509 *x, size_t chainidx)
ab83e314 534{
088dfa13
TS
535 if (s->options & SSL_OP_NO_EXTENDED_MASTER_SECRET)
536 return EXT_RETURN_NOT_SENT;
537
ab83e314
MC
538 if (!WPACKET_put_bytes_u16(pkt, TLSEXT_TYPE_extended_master_secret)
539 || !WPACKET_put_bytes_u16(pkt, 0)) {
c48ffbcc 540 SSLfatal(s, SSL_AD_INTERNAL_ERROR, ERR_R_INTERNAL_ERROR);
b186a592 541 return EXT_RETURN_FAIL;
ab83e314
MC
542 }
543
b186a592 544 return EXT_RETURN_SENT;
ab83e314
MC
545}
546
38b051a1 547EXT_RETURN tls_construct_ctos_supported_versions(SSL_CONNECTION *s, WPACKET *pkt,
b186a592 548 unsigned int context, X509 *x,
f63a17d6 549 size_t chainidx)
ab83e314
MC
550{
551 int currv, min_version, max_version, reason;
552
b5b993b2 553 reason = ssl_get_min_max_version(s, &min_version, &max_version, NULL);
88050dd1 554 if (reason != 0) {
c48ffbcc 555 SSLfatal(s, SSL_AD_INTERNAL_ERROR, reason);
88050dd1
MC
556 return EXT_RETURN_FAIL;
557 }
558
559 /*
560 * Don't include this if we can't negotiate TLSv1.3. We can do a straight
561 * comparison here because we will never be called in DTLS.
562 */
563 if (max_version < TLS1_3_VERSION)
564 return EXT_RETURN_NOT_SENT;
565
ab83e314
MC
566 if (!WPACKET_put_bytes_u16(pkt, TLSEXT_TYPE_supported_versions)
567 || !WPACKET_start_sub_packet_u16(pkt)
568 || !WPACKET_start_sub_packet_u8(pkt)) {
c48ffbcc 569 SSLfatal(s, SSL_AD_INTERNAL_ERROR, ERR_R_INTERNAL_ERROR);
b186a592 570 return EXT_RETURN_FAIL;
ab83e314
MC
571 }
572
ab83e314 573 for (currv = max_version; currv >= min_version; currv--) {
35e742ec 574 if (!WPACKET_put_bytes_u16(pkt, currv)) {
c48ffbcc 575 SSLfatal(s, SSL_AD_INTERNAL_ERROR, ERR_R_INTERNAL_ERROR);
b186a592 576 return EXT_RETURN_FAIL;
ab83e314
MC
577 }
578 }
579 if (!WPACKET_close(pkt) || !WPACKET_close(pkt)) {
c48ffbcc 580 SSLfatal(s, SSL_AD_INTERNAL_ERROR, ERR_R_INTERNAL_ERROR);
b186a592 581 return EXT_RETURN_FAIL;
ab83e314
MC
582 }
583
b186a592 584 return EXT_RETURN_SENT;
ab83e314
MC
585}
586
b2f7e8c0 587/*
e3c0d76b 588 * Construct a psk_kex_modes extension.
b2f7e8c0 589 */
38b051a1 590EXT_RETURN tls_construct_ctos_psk_kex_modes(SSL_CONNECTION *s, WPACKET *pkt,
b186a592 591 unsigned int context, X509 *x,
f63a17d6 592 size_t chainidx)
b2f7e8c0
MC
593{
594#ifndef OPENSSL_NO_TLS1_3
e3c0d76b
MC
595 int nodhe = s->options & SSL_OP_ALLOW_NO_DHE_KEX;
596
b2f7e8c0
MC
597 if (!WPACKET_put_bytes_u16(pkt, TLSEXT_TYPE_psk_kex_modes)
598 || !WPACKET_start_sub_packet_u16(pkt)
599 || !WPACKET_start_sub_packet_u8(pkt)
600 || !WPACKET_put_bytes_u8(pkt, TLSEXT_KEX_MODE_KE_DHE)
e3c0d76b 601 || (nodhe && !WPACKET_put_bytes_u8(pkt, TLSEXT_KEX_MODE_KE))
b2f7e8c0
MC
602 || !WPACKET_close(pkt)
603 || !WPACKET_close(pkt)) {
c48ffbcc 604 SSLfatal(s, SSL_AD_INTERNAL_ERROR, ERR_R_INTERNAL_ERROR);
b186a592 605 return EXT_RETURN_FAIL;
b2f7e8c0 606 }
b3ad72ce 607
e3c0d76b
MC
608 s->ext.psk_kex_mode = TLSEXT_KEX_MODE_FLAG_KE_DHE;
609 if (nodhe)
610 s->ext.psk_kex_mode |= TLSEXT_KEX_MODE_FLAG_KE;
b2f7e8c0
MC
611#endif
612
b186a592 613 return EXT_RETURN_SENT;
b2f7e8c0
MC
614}
615
3847d426 616#ifndef OPENSSL_NO_TLS1_3
38b051a1 617static int add_key_share(SSL_CONNECTION *s, WPACKET *pkt, unsigned int curve_id)
3847d426 618{
7b1ec1cf
MC
619 unsigned char *encoded_point = NULL;
620 EVP_PKEY *key_share_key = NULL;
3847d426
MC
621 size_t encodedlen;
622
555cbb32 623 if (s->s3.tmp.pkey != NULL) {
fc7129dc 624 if (!ossl_assert(s->hello_retry_request == SSL_HRR_PENDING)) {
c48ffbcc 625 SSLfatal(s, SSL_AD_INTERNAL_ERROR, ERR_R_INTERNAL_ERROR);
d8028b20 626 return 0;
7b1ec1cf
MC
627 }
628 /*
629 * Could happen if we got an HRR that wasn't requesting a new key_share
630 */
555cbb32 631 key_share_key = s->s3.tmp.pkey;
7b1ec1cf 632 } else {
f63a17d6 633 key_share_key = ssl_generate_pkey_group(s, curve_id);
7b1ec1cf 634 if (key_share_key == NULL) {
f63a17d6 635 /* SSLfatal() already called */
d8028b20 636 return 0;
7b1ec1cf 637 }
3847d426
MC
638 }
639
640 /* Encode the public key. */
5ac8fb58
MC
641 encodedlen = EVP_PKEY_get1_encoded_public_key(key_share_key,
642 &encoded_point);
3847d426 643 if (encodedlen == 0) {
c48ffbcc 644 SSLfatal(s, SSL_AD_INTERNAL_ERROR, ERR_R_EC_LIB);
7b1ec1cf 645 goto err;
3847d426
MC
646 }
647
648 /* Create KeyShareEntry */
0a10825a 649 if (!WPACKET_put_bytes_u16(pkt, ssl_group_id_internal_to_tls13(curve_id))
2248dbeb 650 || !WPACKET_sub_memcpy_u16(pkt, encoded_point, encodedlen)) {
c48ffbcc 651 SSLfatal(s, SSL_AD_INTERNAL_ERROR, ERR_R_INTERNAL_ERROR);
7b1ec1cf 652 goto err;
3847d426
MC
653 }
654
655 /*
407820c0 656 * When changing to send more than one key_share we're
3847d426
MC
657 * going to need to be able to save more than one EVP_PKEY. For now
658 * we reuse the existing tmp.pkey
659 */
555cbb32
TS
660 s->s3.tmp.pkey = key_share_key;
661 s->s3.group_id = curve_id;
2248dbeb 662 OPENSSL_free(encoded_point);
3847d426 663
d8028b20 664 return 1;
7b1ec1cf 665 err:
555cbb32 666 if (s->s3.tmp.pkey == NULL)
7b1ec1cf
MC
667 EVP_PKEY_free(key_share_key);
668 OPENSSL_free(encoded_point);
d8028b20 669 return 0;
3847d426
MC
670}
671#endif
672
38b051a1 673EXT_RETURN tls_construct_ctos_key_share(SSL_CONNECTION *s, WPACKET *pkt,
b186a592 674 unsigned int context, X509 *x,
f63a17d6 675 size_t chainidx)
ab83e314 676{
3cf96e88 677#ifndef OPENSSL_NO_TLS1_3
f48d826e
DSH
678 size_t i, num_groups = 0;
679 const uint16_t *pgroups = NULL;
9e84a42d 680 uint16_t curve_id = 0;
ab83e314
MC
681
682 /* key_share extension */
683 if (!WPACKET_put_bytes_u16(pkt, TLSEXT_TYPE_key_share)
684 /* Extension data sub-packet */
685 || !WPACKET_start_sub_packet_u16(pkt)
686 /* KeyShare list sub-packet */
687 || !WPACKET_start_sub_packet_u16(pkt)) {
c48ffbcc 688 SSLfatal(s, SSL_AD_INTERNAL_ERROR, ERR_R_INTERNAL_ERROR);
b186a592 689 return EXT_RETURN_FAIL;
ab83e314
MC
690 }
691
f48d826e 692 tls1_get_supported_groups(s, &pgroups, &num_groups);
ab83e314
MC
693
694 /*
407820c0
P
695 * Make the number of key_shares sent configurable. For
696 * now, we just send one
ab83e314 697 */
555cbb32
TS
698 if (s->s3.group_id != 0) {
699 curve_id = s->s3.group_id;
3847d426 700 } else {
f48d826e 701 for (i = 0; i < num_groups; i++) {
0a10825a
BE
702 if (ssl_group_id_internal_to_tls13(pgroups[i]) == 0)
703 continue;
ab83e314 704
dbc6268f 705 if (!tls_group_allowed(s, pgroups[i], SSL_SECOP_CURVE_SUPPORTED))
3847d426 706 continue;
ab83e314 707
f48d826e 708 curve_id = pgroups[i];
3847d426 709 break;
ab83e314 710 }
3847d426 711 }
ab83e314 712
3847d426 713 if (curve_id == 0) {
c48ffbcc 714 SSLfatal(s, SSL_AD_INTERNAL_ERROR, SSL_R_NO_SUITABLE_KEY_SHARE);
b186a592 715 return EXT_RETURN_FAIL;
ab83e314
MC
716 }
717
f63a17d6
MC
718 if (!add_key_share(s, pkt, curve_id)) {
719 /* SSLfatal() already called */
b186a592 720 return EXT_RETURN_FAIL;
f63a17d6 721 }
3847d426 722
ab83e314 723 if (!WPACKET_close(pkt) || !WPACKET_close(pkt)) {
c48ffbcc 724 SSLfatal(s, SSL_AD_INTERNAL_ERROR, ERR_R_INTERNAL_ERROR);
b186a592 725 return EXT_RETURN_FAIL;
ab83e314 726 }
b186a592 727 return EXT_RETURN_SENT;
aa2ed504
TS
728#else
729 return EXT_RETURN_NOT_SENT;
730#endif
ab83e314
MC
731}
732
38b051a1
TM
733EXT_RETURN tls_construct_ctos_cookie(SSL_CONNECTION *s, WPACKET *pkt,
734 unsigned int context,
f63a17d6 735 X509 *x, size_t chainidx)
cfef5027 736{
b186a592 737 EXT_RETURN ret = EXT_RETURN_FAIL;
cfef5027
MC
738
739 /* Should only be set if we've had an HRR */
740 if (s->ext.tls13_cookie_len == 0)
b186a592 741 return EXT_RETURN_NOT_SENT;
cfef5027
MC
742
743 if (!WPACKET_put_bytes_u16(pkt, TLSEXT_TYPE_cookie)
744 /* Extension data sub-packet */
745 || !WPACKET_start_sub_packet_u16(pkt)
746 || !WPACKET_sub_memcpy_u16(pkt, s->ext.tls13_cookie,
747 s->ext.tls13_cookie_len)
748 || !WPACKET_close(pkt)) {
c48ffbcc 749 SSLfatal(s, SSL_AD_INTERNAL_ERROR, ERR_R_INTERNAL_ERROR);
cfef5027
MC
750 goto end;
751 }
752
b186a592 753 ret = EXT_RETURN_SENT;
cfef5027
MC
754 end:
755 OPENSSL_free(s->ext.tls13_cookie);
febb0afa 756 s->ext.tls13_cookie = NULL;
cfef5027
MC
757 s->ext.tls13_cookie_len = 0;
758
759 return ret;
760}
761
38b051a1 762EXT_RETURN tls_construct_ctos_early_data(SSL_CONNECTION *s, WPACKET *pkt,
b186a592 763 unsigned int context, X509 *x,
f63a17d6 764 size_t chainidx)
38df5a45 765{
696de86f
PW
766#ifndef OPENSSL_NO_PSK
767 char identity[PSK_MAX_IDENTITY_LEN + 1];
768#endif /* OPENSSL_NO_PSK */
ccb76685 769 const unsigned char *id = NULL;
fff202e5 770 size_t idlen = 0;
add8d0e9 771 SSL_SESSION *psksess = NULL;
ffc5bbaa 772 SSL_SESSION *edsess = NULL;
add8d0e9 773 const EVP_MD *handmd = NULL;
38b051a1 774 SSL *ssl = SSL_CONNECTION_GET_SSL(s);
add8d0e9 775
fc7129dc 776 if (s->hello_retry_request == SSL_HRR_PENDING)
add8d0e9
MC
777 handmd = ssl_handshake_md(s);
778
779 if (s->psk_use_session_cb != NULL
38b051a1 780 && (!s->psk_use_session_cb(ssl, handmd, &id, &idlen, &psksess)
ffc5bbaa
MC
781 || (psksess != NULL
782 && psksess->ssl_version != TLS1_3_VERSION))) {
783 SSL_SESSION_free(psksess);
c48ffbcc 784 SSLfatal(s, SSL_AD_INTERNAL_ERROR, SSL_R_BAD_PSK);
add8d0e9
MC
785 return EXT_RETURN_FAIL;
786 }
787
c2b290c3 788#ifndef OPENSSL_NO_PSK
f3d40db1
MC
789 if (psksess == NULL && s->psk_client_callback != NULL) {
790 unsigned char psk[PSK_MAX_PSK_LEN];
791 size_t psklen = 0;
792
793 memset(identity, 0, sizeof(identity));
38b051a1
TM
794 psklen = s->psk_client_callback(ssl, NULL,
795 identity, sizeof(identity) - 1,
f3d40db1
MC
796 psk, sizeof(psk));
797
798 if (psklen > PSK_MAX_PSK_LEN) {
c48ffbcc 799 SSLfatal(s, SSL_AD_HANDSHAKE_FAILURE, ERR_R_INTERNAL_ERROR);
f3d40db1
MC
800 return EXT_RETURN_FAIL;
801 } else if (psklen > 0) {
802 const unsigned char tls13_aes128gcmsha256_id[] = { 0x13, 0x01 };
803 const SSL_CIPHER *cipher;
804
805 idlen = strlen(identity);
806 if (idlen > PSK_MAX_IDENTITY_LEN) {
c48ffbcc 807 SSLfatal(s, SSL_AD_INTERNAL_ERROR, ERR_R_INTERNAL_ERROR);
f3d40db1
MC
808 return EXT_RETURN_FAIL;
809 }
810 id = (unsigned char *)identity;
811
812 /*
813 * We found a PSK using an old style callback. We don't know
814 * the digest so we default to SHA256 as per the TLSv1.3 spec
815 */
38b051a1 816 cipher = SSL_CIPHER_find(ssl, tls13_aes128gcmsha256_id);
f3d40db1 817 if (cipher == NULL) {
c48ffbcc 818 SSLfatal(s, SSL_AD_INTERNAL_ERROR, ERR_R_INTERNAL_ERROR);
f3d40db1
MC
819 return EXT_RETURN_FAIL;
820 }
821
822 psksess = SSL_SESSION_new();
823 if (psksess == NULL
824 || !SSL_SESSION_set1_master_key(psksess, psk, psklen)
825 || !SSL_SESSION_set_cipher(psksess, cipher)
826 || !SSL_SESSION_set_protocol_version(psksess, TLS1_3_VERSION)) {
c48ffbcc 827 SSLfatal(s, SSL_AD_INTERNAL_ERROR, ERR_R_INTERNAL_ERROR);
f3d40db1
MC
828 OPENSSL_cleanse(psk, psklen);
829 return EXT_RETURN_FAIL;
830 }
831 OPENSSL_cleanse(psk, psklen);
832 }
833 }
c2b290c3 834#endif /* OPENSSL_NO_PSK */
f3d40db1 835
add8d0e9
MC
836 SSL_SESSION_free(s->psksession);
837 s->psksession = psksess;
838 if (psksess != NULL) {
839 OPENSSL_free(s->psksession_id);
840 s->psksession_id = OPENSSL_memdup(id, idlen);
841 if (s->psksession_id == NULL) {
39a14059 842 s->psksession_id_len = 0;
c48ffbcc 843 SSLfatal(s, SSL_AD_INTERNAL_ERROR, ERR_R_INTERNAL_ERROR);
add8d0e9
MC
844 return EXT_RETURN_FAIL;
845 }
846 s->psksession_id_len = idlen;
847 }
848
38df5a45 849 if (s->early_data_state != SSL_EARLY_DATA_CONNECTING
add8d0e9
MC
850 || (s->session->ext.max_early_data == 0
851 && (psksess == NULL || psksess->ext.max_early_data == 0))) {
38df5a45 852 s->max_early_data = 0;
b186a592 853 return EXT_RETURN_NOT_SENT;
38df5a45 854 }
ffc5bbaa
MC
855 edsess = s->session->ext.max_early_data != 0 ? s->session : psksess;
856 s->max_early_data = edsess->ext.max_early_data;
857
bfab12bb
MC
858 if (edsess->ext.hostname != NULL) {
859 if (s->ext.hostname == NULL
860 || (s->ext.hostname != NULL
861 && strcmp(s->ext.hostname, edsess->ext.hostname) != 0)) {
f63a17d6 862 SSLfatal(s, SSL_AD_INTERNAL_ERROR,
f63a17d6 863 SSL_R_INCONSISTENT_EARLY_DATA_SNI);
bfab12bb
MC
864 return EXT_RETURN_FAIL;
865 }
ffc5bbaa
MC
866 }
867
868 if ((s->ext.alpn == NULL && edsess->ext.alpn_selected != NULL)) {
c48ffbcc 869 SSLfatal(s, SSL_AD_INTERNAL_ERROR, SSL_R_INCONSISTENT_EARLY_DATA_ALPN);
ffc5bbaa
MC
870 return EXT_RETURN_FAIL;
871 }
872
873 /*
874 * Verify that we are offering an ALPN protocol consistent with the early
875 * data.
876 */
877 if (edsess->ext.alpn_selected != NULL) {
878 PACKET prots, alpnpkt;
879 int found = 0;
880
881 if (!PACKET_buf_init(&prots, s->ext.alpn, s->ext.alpn_len)) {
c48ffbcc 882 SSLfatal(s, SSL_AD_INTERNAL_ERROR, ERR_R_INTERNAL_ERROR);
ffc5bbaa
MC
883 return EXT_RETURN_FAIL;
884 }
885 while (PACKET_get_length_prefixed_1(&prots, &alpnpkt)) {
886 if (PACKET_equal(&alpnpkt, edsess->ext.alpn_selected,
887 edsess->ext.alpn_selected_len)) {
888 found = 1;
889 break;
890 }
891 }
892 if (!found) {
f63a17d6 893 SSLfatal(s, SSL_AD_INTERNAL_ERROR,
f63a17d6 894 SSL_R_INCONSISTENT_EARLY_DATA_ALPN);
ffc5bbaa
MC
895 return EXT_RETURN_FAIL;
896 }
897 }
38df5a45
MC
898
899 if (!WPACKET_put_bytes_u16(pkt, TLSEXT_TYPE_early_data)
900 || !WPACKET_start_sub_packet_u16(pkt)
901 || !WPACKET_close(pkt)) {
c48ffbcc 902 SSLfatal(s, SSL_AD_INTERNAL_ERROR, ERR_R_INTERNAL_ERROR);
b186a592 903 return EXT_RETURN_FAIL;
38df5a45
MC
904 }
905
906 /*
907 * We set this to rejected here. Later, if the server acknowledges the
908 * extension, we set it to accepted.
909 */
910 s->ext.early_data = SSL_EARLY_DATA_REJECTED;
4be3a7c7 911 s->ext.early_data_ok = 1;
38df5a45 912
b186a592 913 return EXT_RETURN_SENT;
38df5a45
MC
914}
915
1266eefd
MC
916#define F5_WORKAROUND_MIN_MSG_LEN 0xff
917#define F5_WORKAROUND_MAX_MSG_LEN 0x200
918
d702ad12
MC
919/*
920 * PSK pre binder overhead =
921 * 2 bytes for TLSEXT_TYPE_psk
922 * 2 bytes for extension length
923 * 2 bytes for identities list length
924 * 2 bytes for identity length
925 * 4 bytes for obfuscated_ticket_age
926 * 2 bytes for binder list length
927 * 1 byte for binder length
928 * The above excludes the number of bytes for the identity itself and the
929 * subsequent binder bytes
930 */
931#define PSK_PRE_BINDER_OVERHEAD (2 + 2 + 2 + 2 + 4 + 2 + 1)
932
38b051a1 933EXT_RETURN tls_construct_ctos_padding(SSL_CONNECTION *s, WPACKET *pkt,
b186a592 934 unsigned int context, X509 *x,
f63a17d6 935 size_t chainidx)
ab83e314
MC
936{
937 unsigned char *padbytes;
938 size_t hlen;
939
940 if ((s->options & SSL_OP_TLSEXT_PADDING) == 0)
b186a592 941 return EXT_RETURN_NOT_SENT;
ab83e314
MC
942
943 /*
d702ad12
MC
944 * Add padding to workaround bugs in F5 terminators. See RFC7685.
945 * This code calculates the length of all extensions added so far but
946 * excludes the PSK extension (because that MUST be written last). Therefore
947 * this extension MUST always appear second to last.
ab83e314
MC
948 */
949 if (!WPACKET_get_total_written(pkt, &hlen)) {
c48ffbcc 950 SSLfatal(s, SSL_AD_INTERNAL_ERROR, ERR_R_INTERNAL_ERROR);
b186a592 951 return EXT_RETURN_FAIL;
ab83e314
MC
952 }
953
d702ad12
MC
954 /*
955 * If we're going to send a PSK then that will be written out after this
956 * extension, so we need to calculate how long it is going to be.
957 */
958 if (s->session->ssl_version == TLS1_3_VERSION
959 && s->session->ext.ticklen != 0
960 && s->session->cipher != NULL) {
38b051a1
TM
961 const EVP_MD *md = ssl_md(SSL_CONNECTION_GET_CTX(s),
962 s->session->cipher->algorithm2);
d702ad12
MC
963
964 if (md != NULL) {
965 /*
966 * Add the fixed PSK overhead, the identity length and the binder
967 * length.
968 */
969 hlen += PSK_PRE_BINDER_OVERHEAD + s->session->ext.ticklen
ed576acd 970 + EVP_MD_get_size(md);
d702ad12
MC
971 }
972 }
973
1266eefd 974 if (hlen > F5_WORKAROUND_MIN_MSG_LEN && hlen < F5_WORKAROUND_MAX_MSG_LEN) {
1ee4b98e 975 /* Calculate the amount of padding we need to add */
1266eefd
MC
976 hlen = F5_WORKAROUND_MAX_MSG_LEN - hlen;
977
978 /*
979 * Take off the size of extension header itself (2 bytes for type and
10ed1b72
TS
980 * 2 bytes for length bytes), but ensure that the extension is at least
981 * 1 byte long so as not to have an empty extension last (WebSphere 7.x,
982 * 8.x are intolerant of that condition)
1266eefd 983 */
3d85c7f4 984 if (hlen > 4)
ab83e314
MC
985 hlen -= 4;
986 else
10ed1b72 987 hlen = 1;
ab83e314
MC
988
989 if (!WPACKET_put_bytes_u16(pkt, TLSEXT_TYPE_padding)
990 || !WPACKET_sub_allocate_bytes_u16(pkt, hlen, &padbytes)) {
c48ffbcc 991 SSLfatal(s, SSL_AD_INTERNAL_ERROR, ERR_R_INTERNAL_ERROR);
eb5fd03b 992 return EXT_RETURN_FAIL;
ab83e314
MC
993 }
994 memset(padbytes, 0, hlen);
995 }
996
b186a592 997 return EXT_RETURN_SENT;
ab83e314
MC
998}
999
ec15acb6
MC
1000/*
1001 * Construct the pre_shared_key extension
1002 */
38b051a1
TM
1003EXT_RETURN tls_construct_ctos_psk(SSL_CONNECTION *s, WPACKET *pkt,
1004 unsigned int context,
f63a17d6 1005 X509 *x, size_t chainidx)
ec15acb6
MC
1006{
1007#ifndef OPENSSL_NO_TLS1_3
e8a557dc 1008 uint32_t agesec, agems = 0;
add8d0e9 1009 size_t reshashsize = 0, pskhashsize = 0, binderoffset, msglen;
9368f865 1010 unsigned char *resbinder = NULL, *pskbinder = NULL, *msgstart = NULL;
15b1688a 1011 const EVP_MD *handmd = NULL, *mdres = NULL, *mdpsk = NULL;
9368f865 1012 int dores = 0;
38b051a1 1013 SSL_CTX *sctx = SSL_CONNECTION_GET_CTX(s);
ec15acb6 1014
c96ce52c 1015 s->ext.tick_identity = 0;
ec15acb6 1016
d702ad12
MC
1017 /*
1018 * Note: At this stage of the code we only support adding a single
1019 * resumption PSK. If we add support for multiple PSKs then the length
1020 * calculations in the padding extension will need to be adjusted.
1021 */
1022
ec15acb6 1023 /*
08191294
MC
1024 * If this is an incompatible or new session then we have nothing to resume
1025 * so don't add this extension.
ec15acb6 1026 */
08191294 1027 if (s->session->ssl_version != TLS1_3_VERSION
add8d0e9 1028 || (s->session->ext.ticklen == 0 && s->psksession == NULL))
b186a592 1029 return EXT_RETURN_NOT_SENT;
ec15acb6 1030
fc7129dc 1031 if (s->hello_retry_request == SSL_HRR_PENDING)
9368f865
MC
1032 handmd = ssl_handshake_md(s);
1033
9368f865 1034 if (s->session->ext.ticklen != 0) {
72257204 1035 /* Get the digest associated with the ciphersuite in the session */
9368f865 1036 if (s->session->cipher == NULL) {
c48ffbcc 1037 SSLfatal(s, SSL_AD_INTERNAL_ERROR, ERR_R_INTERNAL_ERROR);
635c8f77 1038 return EXT_RETURN_FAIL;
9368f865 1039 }
38b051a1 1040 mdres = ssl_md(sctx, s->session->cipher->algorithm2);
9368f865 1041 if (mdres == NULL) {
72257204
MC
1042 /*
1043 * Don't recognize this cipher so we can't use the session.
1044 * Ignore it
1045 */
9368f865
MC
1046 goto dopsksess;
1047 }
1048
fc7129dc 1049 if (s->hello_retry_request == SSL_HRR_PENDING && mdres != handmd) {
9368f865 1050 /*
72257204
MC
1051 * Selected ciphersuite hash does not match the hash for the session
1052 * so we can't use it.
9368f865
MC
1053 */
1054 goto dopsksess;
1055 }
1f5b44e9 1056
cf3e221b 1057 /*
9368f865 1058 * Technically the C standard just says time() returns a time_t and says
72257204
MC
1059 * nothing about the encoding of that type. In practice most
1060 * implementations follow POSIX which holds it as an integral type in
1061 * seconds since epoch. We've already made the assumption that we can do
1062 * this in multiple places in the code, so portability shouldn't be an
1063 * issue.
cf3e221b 1064 */
e8a557dc 1065 agesec = (uint32_t)(time(NULL) - s->session->time);
7e70213f
MC
1066 /*
1067 * We calculate the age in seconds but the server may work in ms. Due to
1068 * rounding errors we could overestimate the age by up to 1s. It is
1069 * better to underestimate it. Otherwise, if the RTT is very short, when
1070 * the server calculates the age reported by the client it could be
1071 * bigger than the age calculated on the server - which should never
1072 * happen.
1073 */
1074 if (agesec > 0)
1075 agesec--;
cf3e221b 1076
9368f865
MC
1077 if (s->session->ext.tick_lifetime_hint < agesec) {
1078 /* Ticket is too old. Ignore it. */
1079 goto dopsksess;
1080 }
ec15acb6 1081
9368f865
MC
1082 /*
1083 * Calculate age in ms. We're just doing it to nearest second. Should be
1084 * good enough.
1085 */
1086 agems = agesec * (uint32_t)1000;
fc24f0bf 1087
9368f865
MC
1088 if (agesec != 0 && agems / (uint32_t)1000 != agesec) {
1089 /*
72257204
MC
1090 * Overflow. Shouldn't happen unless this is a *really* old session.
1091 * If so we just ignore it.
9368f865
MC
1092 */
1093 goto dopsksess;
1094 }
ec15acb6 1095
ec15acb6 1096 /*
72257204
MC
1097 * Obfuscate the age. Overflow here is fine, this addition is supposed
1098 * to be mod 2^32.
ec15acb6 1099 */
9368f865
MC
1100 agems += s->session->ext.tick_age_add;
1101
ed576acd 1102 reshashsize = EVP_MD_get_size(mdres);
c96ce52c 1103 s->ext.tick_identity++;
9368f865 1104 dores = 1;
ec15acb6
MC
1105 }
1106
9368f865 1107 dopsksess:
add8d0e9 1108 if (!dores && s->psksession == NULL)
9368f865 1109 return EXT_RETURN_NOT_SENT;
ec15acb6 1110
add8d0e9 1111 if (s->psksession != NULL) {
38b051a1 1112 mdpsk = ssl_md(sctx, s->psksession->cipher->algorithm2);
9368f865
MC
1113 if (mdpsk == NULL) {
1114 /*
1115 * Don't recognize this cipher so we can't use the session.
1116 * If this happens it's an application bug.
1117 */
c48ffbcc 1118 SSLfatal(s, SSL_AD_INTERNAL_ERROR, SSL_R_BAD_PSK);
635c8f77 1119 return EXT_RETURN_FAIL;
9368f865
MC
1120 }
1121
fc7129dc 1122 if (s->hello_retry_request == SSL_HRR_PENDING && mdpsk != handmd) {
9368f865
MC
1123 /*
1124 * Selected ciphersuite hash does not match the hash for the PSK
1125 * session. This is an application bug.
1126 */
c48ffbcc 1127 SSLfatal(s, SSL_AD_INTERNAL_ERROR, SSL_R_BAD_PSK);
635c8f77 1128 return EXT_RETURN_FAIL;
9368f865
MC
1129 }
1130
ed576acd 1131 pskhashsize = EVP_MD_get_size(mdpsk);
9368f865 1132 }
ec15acb6
MC
1133
1134 /* Create the extension, but skip over the binder for now */
1135 if (!WPACKET_put_bytes_u16(pkt, TLSEXT_TYPE_psk)
1136 || !WPACKET_start_sub_packet_u16(pkt)
9368f865 1137 || !WPACKET_start_sub_packet_u16(pkt)) {
c48ffbcc 1138 SSLfatal(s, SSL_AD_INTERNAL_ERROR, ERR_R_INTERNAL_ERROR);
635c8f77 1139 return EXT_RETURN_FAIL;
9368f865
MC
1140 }
1141
1142 if (dores) {
1143 if (!WPACKET_sub_memcpy_u16(pkt, s->session->ext.tick,
1144 s->session->ext.ticklen)
1145 || !WPACKET_put_bytes_u32(pkt, agems)) {
c48ffbcc 1146 SSLfatal(s, SSL_AD_INTERNAL_ERROR, ERR_R_INTERNAL_ERROR);
635c8f77 1147 return EXT_RETURN_FAIL;
9368f865
MC
1148 }
1149 }
1150
add8d0e9
MC
1151 if (s->psksession != NULL) {
1152 if (!WPACKET_sub_memcpy_u16(pkt, s->psksession_id,
1153 s->psksession_id_len)
9368f865 1154 || !WPACKET_put_bytes_u32(pkt, 0)) {
c48ffbcc 1155 SSLfatal(s, SSL_AD_INTERNAL_ERROR, ERR_R_INTERNAL_ERROR);
635c8f77 1156 return EXT_RETURN_FAIL;
9368f865 1157 }
c96ce52c 1158 s->ext.tick_identity++;
9368f865
MC
1159 }
1160
1161 if (!WPACKET_close(pkt)
ec15acb6
MC
1162 || !WPACKET_get_total_written(pkt, &binderoffset)
1163 || !WPACKET_start_sub_packet_u16(pkt)
9368f865
MC
1164 || (dores
1165 && !WPACKET_sub_allocate_bytes_u8(pkt, reshashsize, &resbinder))
add8d0e9 1166 || (s->psksession != NULL
9368f865 1167 && !WPACKET_sub_allocate_bytes_u8(pkt, pskhashsize, &pskbinder))
ec15acb6
MC
1168 || !WPACKET_close(pkt)
1169 || !WPACKET_close(pkt)
1170 || !WPACKET_get_total_written(pkt, &msglen)
1171 /*
1172 * We need to fill in all the sub-packet lengths now so we can
1173 * calculate the HMAC of the message up to the binders
1174 */
1175 || !WPACKET_fill_lengths(pkt)) {
c48ffbcc 1176 SSLfatal(s, SSL_AD_INTERNAL_ERROR, ERR_R_INTERNAL_ERROR);
635c8f77 1177 return EXT_RETURN_FAIL;
ec15acb6
MC
1178 }
1179
1180 msgstart = WPACKET_get_curr(pkt) - msglen;
1181
72257204
MC
1182 if (dores
1183 && tls_psk_do_binder(s, mdres, msgstart, binderoffset, NULL,
1184 resbinder, s->session, 1, 0) != 1) {
635c8f77
MC
1185 /* SSLfatal() already called */
1186 return EXT_RETURN_FAIL;
ec15acb6
MC
1187 }
1188
add8d0e9 1189 if (s->psksession != NULL
72257204 1190 && tls_psk_do_binder(s, mdpsk, msgstart, binderoffset, NULL,
add8d0e9 1191 pskbinder, s->psksession, 1, 1) != 1) {
635c8f77
MC
1192 /* SSLfatal() already called */
1193 return EXT_RETURN_FAIL;
9368f865
MC
1194 }
1195
635c8f77 1196 return EXT_RETURN_SENT;
ec15acb6 1197#else
89bc9cf6 1198 return EXT_RETURN_NOT_SENT;
ec15acb6
MC
1199#endif
1200}
1201
38b051a1 1202EXT_RETURN tls_construct_ctos_post_handshake_auth(SSL_CONNECTION *s, WPACKET *pkt,
a7e6a3d8
P
1203 ossl_unused unsigned int context,
1204 ossl_unused X509 *x,
1205 ossl_unused size_t chainidx)
9d75dce3
TS
1206{
1207#ifndef OPENSSL_NO_TLS1_3
32097b33
MC
1208 if (!s->pha_enabled)
1209 return EXT_RETURN_NOT_SENT;
9d75dce3
TS
1210
1211 /* construct extension - 0 length, no contents */
1212 if (!WPACKET_put_bytes_u16(pkt, TLSEXT_TYPE_post_handshake_auth)
1213 || !WPACKET_start_sub_packet_u16(pkt)
1214 || !WPACKET_close(pkt)) {
c48ffbcc 1215 SSLfatal(s, SSL_AD_INTERNAL_ERROR, ERR_R_INTERNAL_ERROR);
9d75dce3
TS
1216 return EXT_RETURN_FAIL;
1217 }
1218
1219 s->post_handshake_auth = SSL_PHA_EXT_SENT;
1220
1221 return EXT_RETURN_SENT;
1222#else
1223 return EXT_RETURN_NOT_SENT;
1224#endif
1225}
1226
1227
6dd083fd
MC
1228/*
1229 * Parse the server's renegotiation binding and abort if it's not right
1230 */
38b051a1
TM
1231int tls_parse_stoc_renegotiate(SSL_CONNECTION *s, PACKET *pkt,
1232 unsigned int context,
f63a17d6 1233 X509 *x, size_t chainidx)
6dd083fd 1234{
555cbb32
TS
1235 size_t expected_len = s->s3.previous_client_finished_len
1236 + s->s3.previous_server_finished_len;
6dd083fd
MC
1237 size_t ilen;
1238 const unsigned char *data;
1239
1240 /* Check for logic errors */
b77f3ed1 1241 if (!ossl_assert(expected_len == 0
555cbb32 1242 || s->s3.previous_client_finished_len != 0)
b77f3ed1 1243 || !ossl_assert(expected_len == 0
555cbb32 1244 || s->s3.previous_server_finished_len != 0)) {
c48ffbcc 1245 SSLfatal(s, SSL_AD_INTERNAL_ERROR, ERR_R_INTERNAL_ERROR);
b77f3ed1
MC
1246 return 0;
1247 }
6dd083fd
MC
1248
1249 /* Parse the length byte */
1250 if (!PACKET_get_1_len(pkt, &ilen)) {
c48ffbcc 1251 SSLfatal(s, SSL_AD_DECODE_ERROR, SSL_R_RENEGOTIATION_ENCODING_ERR);
6dd083fd
MC
1252 return 0;
1253 }
1254
1255 /* Consistency check */
1256 if (PACKET_remaining(pkt) != ilen) {
c48ffbcc 1257 SSLfatal(s, SSL_AD_DECODE_ERROR, SSL_R_RENEGOTIATION_ENCODING_ERR);
6dd083fd
MC
1258 return 0;
1259 }
1260
1261 /* Check that the extension matches */
1262 if (ilen != expected_len) {
c48ffbcc 1263 SSLfatal(s, SSL_AD_ILLEGAL_PARAMETER, SSL_R_RENEGOTIATION_MISMATCH);
6dd083fd
MC
1264 return 0;
1265 }
1266
555cbb32
TS
1267 if (!PACKET_get_bytes(pkt, &data, s->s3.previous_client_finished_len)
1268 || memcmp(data, s->s3.previous_client_finished,
1269 s->s3.previous_client_finished_len) != 0) {
c48ffbcc 1270 SSLfatal(s, SSL_AD_ILLEGAL_PARAMETER, SSL_R_RENEGOTIATION_MISMATCH);
6dd083fd
MC
1271 return 0;
1272 }
1273
555cbb32
TS
1274 if (!PACKET_get_bytes(pkt, &data, s->s3.previous_server_finished_len)
1275 || memcmp(data, s->s3.previous_server_finished,
1276 s->s3.previous_server_finished_len) != 0) {
c48ffbcc 1277 SSLfatal(s, SSL_AD_ILLEGAL_PARAMETER, SSL_R_RENEGOTIATION_MISMATCH);
6dd083fd
MC
1278 return 0;
1279 }
555cbb32 1280 s->s3.send_connection_binding = 1;
6dd083fd
MC
1281
1282 return 1;
1283}
1284
cf72c757 1285/* Parse the server's max fragment len extension packet */
38b051a1
TM
1286int tls_parse_stoc_maxfragmentlen(SSL_CONNECTION *s, PACKET *pkt,
1287 unsigned int context,
f63a17d6 1288 X509 *x, size_t chainidx)
cf72c757
F
1289{
1290 unsigned int value;
1291
1292 if (PACKET_remaining(pkt) != 1 || !PACKET_get_1(pkt, &value)) {
c48ffbcc 1293 SSLfatal(s, SSL_AD_DECODE_ERROR, SSL_R_BAD_EXTENSION);
cf72c757
F
1294 return 0;
1295 }
1296
1297 /* |value| should contains a valid max-fragment-length code. */
1298 if (!IS_MAX_FRAGMENT_LENGTH_EXT_VALID(value)) {
f63a17d6 1299 SSLfatal(s, SSL_AD_ILLEGAL_PARAMETER,
f63a17d6 1300 SSL_R_SSL3_EXT_INVALID_MAX_FRAGMENT_LENGTH);
cf72c757
F
1301 return 0;
1302 }
1303
1304 /* Must be the same value as client-configured one who was sent to server */
1305 /*-
1306 * RFC 6066: if a client receives a maximum fragment length negotiation
1307 * response that differs from the length it requested, ...
1308 * It must abort with SSL_AD_ILLEGAL_PARAMETER alert
1309 */
1310 if (value != s->ext.max_fragment_len_mode) {
f63a17d6 1311 SSLfatal(s, SSL_AD_ILLEGAL_PARAMETER,
f63a17d6 1312 SSL_R_SSL3_EXT_INVALID_MAX_FRAGMENT_LENGTH);
cf72c757
F
1313 return 0;
1314 }
1315
1316 /*
1317 * Maximum Fragment Length Negotiation succeeded.
1318 * The negotiated Maximum Fragment Length is binding now.
1319 */
1320 s->session->ext.max_fragment_len_mode = value;
1321
1322 return 1;
1323}
1324
38b051a1
TM
1325int tls_parse_stoc_server_name(SSL_CONNECTION *s, PACKET *pkt,
1326 unsigned int context,
f63a17d6 1327 X509 *x, size_t chainidx)
6dd083fd 1328{
fb34a0f4 1329 if (s->ext.hostname == NULL) {
c48ffbcc 1330 SSLfatal(s, SSL_AD_INTERNAL_ERROR, ERR_R_INTERNAL_ERROR);
fb34a0f4
MC
1331 return 0;
1332 }
1333
1334 if (PACKET_remaining(pkt) > 0) {
c48ffbcc 1335 SSLfatal(s, SSL_AD_DECODE_ERROR, SSL_R_BAD_EXTENSION);
6dd083fd
MC
1336 return 0;
1337 }
1338
1339 if (!s->hit) {
aff8c126 1340 if (s->session->ext.hostname != NULL) {
c48ffbcc 1341 SSLfatal(s, SSL_AD_INTERNAL_ERROR, ERR_R_INTERNAL_ERROR);
6dd083fd
MC
1342 return 0;
1343 }
aff8c126
RS
1344 s->session->ext.hostname = OPENSSL_strdup(s->ext.hostname);
1345 if (s->session->ext.hostname == NULL) {
c48ffbcc 1346 SSLfatal(s, SSL_AD_INTERNAL_ERROR, ERR_R_INTERNAL_ERROR);
6dd083fd
MC
1347 return 0;
1348 }
1349 }
1350
1351 return 1;
1352}
1353
38b051a1
TM
1354int tls_parse_stoc_ec_pt_formats(SSL_CONNECTION *s, PACKET *pkt,
1355 unsigned int context,
f63a17d6 1356 X509 *x, size_t chainidx)
6dd083fd 1357{
848a950b 1358 size_t ecpointformats_len;
6dd083fd
MC
1359 PACKET ecptformatlist;
1360
1361 if (!PACKET_as_length_prefixed_1(pkt, &ecptformatlist)) {
c48ffbcc 1362 SSLfatal(s, SSL_AD_DECODE_ERROR, SSL_R_BAD_EXTENSION);
6dd083fd
MC
1363 return 0;
1364 }
1365 if (!s->hit) {
aff8c126 1366 ecpointformats_len = PACKET_remaining(&ecptformatlist);
848a950b 1367 if (ecpointformats_len == 0) {
c48ffbcc 1368 SSLfatal(s, SSL_AD_DECODE_ERROR, SSL_R_BAD_LENGTH);
848a950b
MC
1369 return 0;
1370 }
6dd083fd 1371
cd0fb43c
MC
1372 s->ext.peer_ecpointformats_len = 0;
1373 OPENSSL_free(s->ext.peer_ecpointformats);
1374 s->ext.peer_ecpointformats = OPENSSL_malloc(ecpointformats_len);
1375 if (s->ext.peer_ecpointformats == NULL) {
39a14059 1376 s->ext.peer_ecpointformats_len = 0;
c48ffbcc 1377 SSLfatal(s, SSL_AD_INTERNAL_ERROR, ERR_R_INTERNAL_ERROR);
6dd083fd
MC
1378 return 0;
1379 }
1380
cd0fb43c 1381 s->ext.peer_ecpointformats_len = ecpointformats_len;
6dd083fd
MC
1382
1383 if (!PACKET_copy_bytes(&ecptformatlist,
cd0fb43c 1384 s->ext.peer_ecpointformats,
aff8c126 1385 ecpointformats_len)) {
c48ffbcc 1386 SSLfatal(s, SSL_AD_INTERNAL_ERROR, ERR_R_INTERNAL_ERROR);
6dd083fd
MC
1387 return 0;
1388 }
1389 }
1390
1391 return 1;
1392}
6dd083fd 1393
38b051a1
TM
1394int tls_parse_stoc_session_ticket(SSL_CONNECTION *s, PACKET *pkt,
1395 unsigned int context,
f63a17d6 1396 X509 *x, size_t chainidx)
6dd083fd 1397{
38b051a1
TM
1398 SSL *ssl = SSL_CONNECTION_GET_SSL(s);
1399
aff8c126 1400 if (s->ext.session_ticket_cb != NULL &&
38b051a1
TM
1401 !s->ext.session_ticket_cb(ssl, PACKET_data(pkt),
1402 PACKET_remaining(pkt),
1403 s->ext.session_ticket_cb_arg)) {
c48ffbcc 1404 SSLfatal(s, SSL_AD_HANDSHAKE_FAILURE, SSL_R_BAD_EXTENSION);
6dd083fd
MC
1405 return 0;
1406 }
1266eefd 1407
fb34a0f4 1408 if (!tls_use_ticket(s)) {
c48ffbcc 1409 SSLfatal(s, SSL_AD_UNSUPPORTED_EXTENSION, SSL_R_BAD_EXTENSION);
6dd083fd
MC
1410 return 0;
1411 }
fb34a0f4 1412 if (PACKET_remaining(pkt) > 0) {
c48ffbcc 1413 SSLfatal(s, SSL_AD_DECODE_ERROR, SSL_R_BAD_EXTENSION);
fb34a0f4
MC
1414 return 0;
1415 }
1266eefd 1416
aff8c126 1417 s->ext.ticket_expected = 1;
6dd083fd
MC
1418
1419 return 1;
1420}
1421
ab83e314 1422#ifndef OPENSSL_NO_OCSP
38b051a1
TM
1423int tls_parse_stoc_status_request(SSL_CONNECTION *s, PACKET *pkt,
1424 unsigned int context,
f63a17d6 1425 X509 *x, size_t chainidx)
6dd083fd 1426{
5de683d2
MC
1427 if (context == SSL_EXT_TLS1_3_CERTIFICATE_REQUEST) {
1428 /* We ignore this if the server sends a CertificateRequest */
5de683d2
MC
1429 return 1;
1430 }
1431
6dd083fd 1432 /*
f63e4288
MC
1433 * MUST only be sent if we've requested a status
1434 * request message. In TLS <= 1.2 it must also be empty.
6dd083fd 1435 */
fb34a0f4 1436 if (s->ext.status_type != TLSEXT_STATUSTYPE_ocsp) {
c48ffbcc 1437 SSLfatal(s, SSL_AD_UNSUPPORTED_EXTENSION, SSL_R_BAD_EXTENSION);
6dd083fd
MC
1438 return 0;
1439 }
38b051a1 1440 if (!SSL_CONNECTION_IS_TLS13(s) && PACKET_remaining(pkt) > 0) {
c48ffbcc 1441 SSLfatal(s, SSL_AD_DECODE_ERROR, SSL_R_BAD_EXTENSION);
fb34a0f4
MC
1442 return 0;
1443 }
f63e4288 1444
38b051a1 1445 if (SSL_CONNECTION_IS_TLS13(s)) {
f63e4288 1446 /* We only know how to handle this if it's for the first Certificate in
1ee4b98e 1447 * the chain. We ignore any other responses.
f63e4288 1448 */
8521ced6 1449 if (chainidx != 0)
f63e4288 1450 return 1;
f63a17d6
MC
1451
1452 /* SSLfatal() already called */
1453 return tls_process_cert_status_body(s, pkt);
f63e4288
MC
1454 }
1455
6dd083fd 1456 /* Set flag to expect CertificateStatus message */
aff8c126 1457 s->ext.status_expected = 1;
6dd083fd
MC
1458
1459 return 1;
1460}
ab83e314 1461#endif
6dd083fd
MC
1462
1463
1464#ifndef OPENSSL_NO_CT
38b051a1
TM
1465int tls_parse_stoc_sct(SSL_CONNECTION *s, PACKET *pkt, unsigned int context,
1466 X509 *x, size_t chainidx)
6dd083fd 1467{
5de683d2
MC
1468 if (context == SSL_EXT_TLS1_3_CERTIFICATE_REQUEST) {
1469 /* We ignore this if the server sends it in a CertificateRequest */
5de683d2
MC
1470 return 1;
1471 }
1472
6dd083fd
MC
1473 /*
1474 * Only take it if we asked for it - i.e if there is no CT validation
1475 * callback set, then a custom extension MAY be processing it, so we
1476 * need to let control continue to flow to that.
1477 */
1478 if (s->ct_validation_callback != NULL) {
1479 size_t size = PACKET_remaining(pkt);
1480
1481 /* Simply copy it off for later processing */
aff8c126
RS
1482 OPENSSL_free(s->ext.scts);
1483 s->ext.scts = NULL;
1266eefd 1484
3a63c0ed 1485 s->ext.scts_len = (uint16_t)size;
6dd083fd 1486 if (size > 0) {
aff8c126 1487 s->ext.scts = OPENSSL_malloc(size);
39a14059
MC
1488 if (s->ext.scts == NULL) {
1489 s->ext.scts_len = 0;
1490 SSLfatal(s, SSL_AD_INTERNAL_ERROR, ERR_R_MALLOC_FAILURE);
1491 return 0;
1492 }
1493 if (!PACKET_copy_bytes(pkt, s->ext.scts, size)) {
c48ffbcc 1494 SSLfatal(s, SSL_AD_INTERNAL_ERROR, ERR_R_INTERNAL_ERROR);
6dd083fd
MC
1495 return 0;
1496 }
1497 }
1498 } else {
b186a592
MC
1499 ENDPOINT role = (context & SSL_EXT_TLS1_2_SERVER_HELLO) != 0
1500 ? ENDPOINT_CLIENT : ENDPOINT_BOTH;
1501
1502 /*
1503 * If we didn't ask for it then there must be a custom extension,
1504 * otherwise this is unsolicited.
1505 */
1506 if (custom_ext_find(&s->cert->custext, role,
1507 TLSEXT_TYPE_signed_certificate_timestamp,
1508 NULL) == NULL) {
c48ffbcc 1509 SSLfatal(s, TLS1_AD_UNSUPPORTED_EXTENSION, SSL_R_BAD_EXTENSION);
b186a592
MC
1510 return 0;
1511 }
1512
f63a17d6 1513 if (!custom_ext_parse(s, context,
43ae5eed
MC
1514 TLSEXT_TYPE_signed_certificate_timestamp,
1515 PACKET_data(pkt), PACKET_remaining(pkt),
f63a17d6
MC
1516 x, chainidx)) {
1517 /* SSLfatal already called */
6dd083fd 1518 return 0;
f63a17d6 1519 }
6dd083fd
MC
1520 }
1521
1522 return 1;
1523}
1524#endif
1525
1526
1527#ifndef OPENSSL_NO_NEXTPROTONEG
1528/*
1529 * ssl_next_proto_validate validates a Next Protocol Negotiation block. No
1530 * elements of zero length are allowed and the set of elements must exactly
1531 * fill the length of the block. Returns 1 on success or 0 on failure.
1532 */
38b051a1 1533static int ssl_next_proto_validate(SSL_CONNECTION *s, PACKET *pkt)
6dd083fd
MC
1534{
1535 PACKET tmp_protocol;
1536
1537 while (PACKET_remaining(pkt)) {
1538 if (!PACKET_get_length_prefixed_1(pkt, &tmp_protocol)
f63a17d6 1539 || PACKET_remaining(&tmp_protocol) == 0) {
c48ffbcc 1540 SSLfatal(s, SSL_AD_DECODE_ERROR, SSL_R_BAD_EXTENSION);
6dd083fd 1541 return 0;
f63a17d6 1542 }
6dd083fd
MC
1543 }
1544
1545 return 1;
1546}
1547
38b051a1
TM
1548int tls_parse_stoc_npn(SSL_CONNECTION *s, PACKET *pkt, unsigned int context,
1549 X509 *x, size_t chainidx)
6dd083fd
MC
1550{
1551 unsigned char *selected;
1552 unsigned char selected_len;
1553 PACKET tmppkt;
38b051a1 1554 SSL_CTX *sctx = SSL_CONNECTION_GET_CTX(s);
6dd083fd 1555
1266eefd 1556 /* Check if we are in a renegotiation. If so ignore this extension */
c7f47786 1557 if (!SSL_IS_FIRST_HANDSHAKE(s))
6dd083fd
MC
1558 return 1;
1559
1560 /* We must have requested it. */
38b051a1 1561 if (sctx->ext.npn_select_cb == NULL) {
c48ffbcc 1562 SSLfatal(s, SSL_AD_UNSUPPORTED_EXTENSION, SSL_R_BAD_EXTENSION);
6dd083fd
MC
1563 return 0;
1564 }
1266eefd 1565
6dd083fd
MC
1566 /* The data must be valid */
1567 tmppkt = *pkt;
f63a17d6
MC
1568 if (!ssl_next_proto_validate(s, &tmppkt)) {
1569 /* SSLfatal() already called */
6dd083fd
MC
1570 return 0;
1571 }
38b051a1
TM
1572 if (sctx->ext.npn_select_cb(SSL_CONNECTION_GET_SSL(s),
1573 &selected, &selected_len,
1574 PACKET_data(pkt), PACKET_remaining(pkt),
1575 sctx->ext.npn_select_cb_arg) !=
6dd083fd 1576 SSL_TLSEXT_ERR_OK) {
c48ffbcc 1577 SSLfatal(s, SSL_AD_HANDSHAKE_FAILURE, SSL_R_BAD_EXTENSION);
6dd083fd
MC
1578 return 0;
1579 }
1266eefd 1580
6dd083fd
MC
1581 /*
1582 * Could be non-NULL if server has sent multiple NPN extensions in
1583 * a single Serverhello
1584 */
aff8c126
RS
1585 OPENSSL_free(s->ext.npn);
1586 s->ext.npn = OPENSSL_malloc(selected_len);
1587 if (s->ext.npn == NULL) {
39a14059 1588 s->ext.npn_len = 0;
c48ffbcc 1589 SSLfatal(s, SSL_AD_INTERNAL_ERROR, ERR_R_INTERNAL_ERROR);
6dd083fd
MC
1590 return 0;
1591 }
1592
aff8c126
RS
1593 memcpy(s->ext.npn, selected, selected_len);
1594 s->ext.npn_len = selected_len;
555cbb32 1595 s->s3.npn_seen = 1;
6dd083fd
MC
1596
1597 return 1;
1598}
1599#endif
1600
38b051a1
TM
1601int tls_parse_stoc_alpn(SSL_CONNECTION *s, PACKET *pkt, unsigned int context,
1602 X509 *x, size_t chainidx)
6dd083fd
MC
1603{
1604 size_t len;
1605
1606 /* We must have requested it. */
555cbb32 1607 if (!s->s3.alpn_sent) {
c48ffbcc 1608 SSLfatal(s, SSL_AD_UNSUPPORTED_EXTENSION, SSL_R_BAD_EXTENSION);
6dd083fd
MC
1609 return 0;
1610 }
1611 /*-
1612 * The extension data consists of:
1613 * uint16 list_length
1614 * uint8 proto_length;
1615 * uint8 proto[proto_length];
1616 */
1617 if (!PACKET_get_net_2_len(pkt, &len)
1618 || PACKET_remaining(pkt) != len || !PACKET_get_1_len(pkt, &len)
1619 || PACKET_remaining(pkt) != len) {
c48ffbcc 1620 SSLfatal(s, SSL_AD_DECODE_ERROR, SSL_R_BAD_EXTENSION);
6dd083fd
MC
1621 return 0;
1622 }
555cbb32
TS
1623 OPENSSL_free(s->s3.alpn_selected);
1624 s->s3.alpn_selected = OPENSSL_malloc(len);
1625 if (s->s3.alpn_selected == NULL) {
39a14059 1626 s->s3.alpn_selected_len = 0;
c48ffbcc 1627 SSLfatal(s, SSL_AD_INTERNAL_ERROR, ERR_R_INTERNAL_ERROR);
6dd083fd
MC
1628 return 0;
1629 }
555cbb32 1630 if (!PACKET_copy_bytes(pkt, s->s3.alpn_selected, len)) {
c48ffbcc 1631 SSLfatal(s, SSL_AD_DECODE_ERROR, SSL_R_BAD_EXTENSION);
6dd083fd
MC
1632 return 0;
1633 }
555cbb32 1634 s->s3.alpn_selected_len = len;
6dd083fd 1635
0ef28021
MC
1636 if (s->session->ext.alpn_selected == NULL
1637 || s->session->ext.alpn_selected_len != len
555cbb32 1638 || memcmp(s->session->ext.alpn_selected, s->s3.alpn_selected, len)
0ef28021 1639 != 0) {
4be3a7c7
MC
1640 /* ALPN not consistent with the old session so cannot use early_data */
1641 s->ext.early_data_ok = 0;
1642 }
1643 if (!s->hit) {
9d5db9c9
MC
1644 /*
1645 * This is a new session and so alpn_selected should have been
1646 * initialised to NULL. We should update it with the selected ALPN.
1647 */
1648 if (!ossl_assert(s->session->ext.alpn_selected == NULL)) {
c48ffbcc 1649 SSLfatal(s, SSL_AD_INTERNAL_ERROR, ERR_R_INTERNAL_ERROR);
9d5db9c9
MC
1650 return 0;
1651 }
4be3a7c7 1652 s->session->ext.alpn_selected =
555cbb32 1653 OPENSSL_memdup(s->s3.alpn_selected, s->s3.alpn_selected_len);
4be3a7c7 1654 if (s->session->ext.alpn_selected == NULL) {
39a14059 1655 s->session->ext.alpn_selected_len = 0;
c48ffbcc 1656 SSLfatal(s, SSL_AD_INTERNAL_ERROR, ERR_R_INTERNAL_ERROR);
4be3a7c7
MC
1657 return 0;
1658 }
555cbb32 1659 s->session->ext.alpn_selected_len = s->s3.alpn_selected_len;
ae8d7d99
MC
1660 }
1661
6dd083fd
MC
1662 return 1;
1663}
1664
1665#ifndef OPENSSL_NO_SRTP
38b051a1
TM
1666int tls_parse_stoc_use_srtp(SSL_CONNECTION *s, PACKET *pkt,
1667 unsigned int context, X509 *x, size_t chainidx)
6dd083fd
MC
1668{
1669 unsigned int id, ct, mki;
1670 int i;
1671 STACK_OF(SRTP_PROTECTION_PROFILE) *clnt;
1672 SRTP_PROTECTION_PROFILE *prof;
1673
1266eefd
MC
1674 if (!PACKET_get_net_2(pkt, &ct) || ct != 2
1675 || !PACKET_get_net_2(pkt, &id)
1676 || !PACKET_get_1(pkt, &mki)
1677 || PACKET_remaining(pkt) != 0) {
c48ffbcc 1678 SSLfatal(s, SSL_AD_DECODE_ERROR,
f63a17d6 1679 SSL_R_BAD_SRTP_PROTECTION_PROFILE_LIST);
6dd083fd
MC
1680 return 0;
1681 }
1682
1683 if (mki != 0) {
1684 /* Must be no MKI, since we never offer one */
c48ffbcc 1685 SSLfatal(s, SSL_AD_ILLEGAL_PARAMETER, SSL_R_BAD_SRTP_MKI_VALUE);
6dd083fd
MC
1686 return 0;
1687 }
1688
6dd083fd 1689 /* Throw an error if the server gave us an unsolicited extension */
38b051a1 1690 clnt = SSL_get_srtp_profiles(SSL_CONNECTION_GET_SSL(s));
6dd083fd 1691 if (clnt == NULL) {
c48ffbcc 1692 SSLfatal(s, SSL_AD_DECODE_ERROR, SSL_R_NO_SRTP_PROFILES);
6dd083fd
MC
1693 return 0;
1694 }
1695
1696 /*
1697 * Check to see if the server gave us something we support (and
1698 * presumably offered)
1699 */
1700 for (i = 0; i < sk_SRTP_PROTECTION_PROFILE_num(clnt); i++) {
1701 prof = sk_SRTP_PROTECTION_PROFILE_value(clnt, i);
1702
1703 if (prof->id == id) {
1704 s->srtp_profile = prof;
6dd083fd
MC
1705 return 1;
1706 }
1707 }
1708
c48ffbcc 1709 SSLfatal(s, SSL_AD_DECODE_ERROR,
f63a17d6 1710 SSL_R_BAD_SRTP_PROTECTION_PROFILE_LIST);
6dd083fd
MC
1711 return 0;
1712}
1713#endif
1714
38b051a1
TM
1715int tls_parse_stoc_etm(SSL_CONNECTION *s, PACKET *pkt, unsigned int context,
1716 X509 *x, size_t chainidx)
6dd083fd
MC
1717{
1718 /* Ignore if inappropriate ciphersuite */
1719 if (!(s->options & SSL_OP_NO_ENCRYPT_THEN_MAC)
555cbb32 1720 && s->s3.tmp.new_cipher->algorithm_mac != SSL_AEAD
d724da69
DB
1721 && s->s3.tmp.new_cipher->algorithm_enc != SSL_RC4
1722 && s->s3.tmp.new_cipher->algorithm_enc != SSL_eGOST2814789CNT
1723 && s->s3.tmp.new_cipher->algorithm_enc != SSL_eGOST2814789CNT12
1724 && s->s3.tmp.new_cipher->algorithm_enc != SSL_MAGMA
1725 && s->s3.tmp.new_cipher->algorithm_enc != SSL_KUZNYECHIK)
28a31a0a 1726 s->ext.use_etm = 1;
6dd083fd
MC
1727
1728 return 1;
1729}
1730
38b051a1
TM
1731int tls_parse_stoc_ems(SSL_CONNECTION *s, PACKET *pkt, unsigned int context,
1732 X509 *x, size_t chainidx)
6dd083fd 1733{
088dfa13
TS
1734 if (s->options & SSL_OP_NO_EXTENDED_MASTER_SECRET)
1735 return 1;
555cbb32 1736 s->s3.flags |= TLS1_FLAGS_RECEIVED_EXTMS;
6dd083fd
MC
1737 if (!s->hit)
1738 s->session->flags |= SSL_SESS_FLAG_EXTMS;
1739
1740 return 1;
1741}
1742
38b051a1
TM
1743int tls_parse_stoc_supported_versions(SSL_CONNECTION *s, PACKET *pkt,
1744 unsigned int context,
88050dd1
MC
1745 X509 *x, size_t chainidx)
1746{
1747 unsigned int version;
1748
1749 if (!PACKET_get_net_2(pkt, &version)
1750 || PACKET_remaining(pkt) != 0) {
c48ffbcc 1751 SSLfatal(s, SSL_AD_DECODE_ERROR, SSL_R_LENGTH_MISMATCH);
88050dd1
MC
1752 return 0;
1753 }
1754
27e462f1
MC
1755 /*
1756 * The only protocol version we support which is valid in this extension in
1757 * a ServerHello is TLSv1.3 therefore we shouldn't be getting anything else.
1758 */
1759 if (version != TLS1_3_VERSION) {
1760 SSLfatal(s, SSL_AD_ILLEGAL_PARAMETER,
27e462f1
MC
1761 SSL_R_BAD_PROTOCOL_VERSION_NUMBER);
1762 return 0;
1763 }
1764
426dfc9f 1765 /* We ignore this extension for HRRs except to sanity check it */
27e462f1 1766 if (context == SSL_EXT_TLS1_3_HELLO_RETRY_REQUEST)
426dfc9f 1767 return 1;
426dfc9f 1768
88050dd1
MC
1769 /* We just set it here. We validate it in ssl_choose_client_version */
1770 s->version = version;
cffafb5f 1771 s->rlayer.rrlmethod->set_protocol_version(s->rlayer.rrl, version);
88050dd1
MC
1772
1773 return 1;
1774}
1775
38b051a1
TM
1776int tls_parse_stoc_key_share(SSL_CONNECTION *s, PACKET *pkt,
1777 unsigned int context, X509 *x,
f63a17d6 1778 size_t chainidx)
6dd083fd 1779{
3cf96e88 1780#ifndef OPENSSL_NO_TLS1_3
6dd083fd
MC
1781 unsigned int group_id;
1782 PACKET encoded_pt;
555cbb32 1783 EVP_PKEY *ckey = s->s3.tmp.pkey, *skey = NULL;
a011b586 1784 const TLS_GROUP_INFO *ginf = NULL;
6dd083fd
MC
1785
1786 /* Sanity check */
555cbb32 1787 if (ckey == NULL || s->s3.peer_tmp != NULL) {
c48ffbcc 1788 SSLfatal(s, SSL_AD_INTERNAL_ERROR, ERR_R_INTERNAL_ERROR);
6dd083fd
MC
1789 return 0;
1790 }
1791
1792 if (!PACKET_get_net_2(pkt, &group_id)) {
c48ffbcc 1793 SSLfatal(s, SSL_AD_DECODE_ERROR, SSL_R_LENGTH_MISMATCH);
6dd083fd
MC
1794 return 0;
1795 }
1796
0a10825a 1797 group_id = ssl_group_id_tls13_to_internal(group_id);
fe874d27 1798 if ((context & SSL_EXT_TLS1_3_HELLO_RETRY_REQUEST) != 0) {
f48d826e
DSH
1799 const uint16_t *pgroups = NULL;
1800 size_t i, num_groups;
3847d426
MC
1801
1802 if (PACKET_remaining(pkt) != 0) {
c48ffbcc 1803 SSLfatal(s, SSL_AD_DECODE_ERROR, SSL_R_LENGTH_MISMATCH);
3847d426
MC
1804 return 0;
1805 }
1806
1807 /*
1808 * It is an error if the HelloRetryRequest wants a key_share that we
1809 * already sent in the first ClientHello
1810 */
555cbb32 1811 if (group_id == s->s3.group_id) {
c48ffbcc 1812 SSLfatal(s, SSL_AD_ILLEGAL_PARAMETER, SSL_R_BAD_KEY_SHARE);
3847d426
MC
1813 return 0;
1814 }
1815
1816 /* Validate the selected group is one we support */
f48d826e
DSH
1817 tls1_get_supported_groups(s, &pgroups, &num_groups);
1818 for (i = 0; i < num_groups; i++) {
1819 if (group_id == pgroups[i])
3847d426
MC
1820 break;
1821 }
f48d826e 1822 if (i >= num_groups
dbc6268f 1823 || !tls_group_allowed(s, group_id, SSL_SECOP_CURVE_SUPPORTED)) {
c48ffbcc 1824 SSLfatal(s, SSL_AD_ILLEGAL_PARAMETER, SSL_R_BAD_KEY_SHARE);
3847d426
MC
1825 return 0;
1826 }
1827
555cbb32
TS
1828 s->s3.group_id = group_id;
1829 EVP_PKEY_free(s->s3.tmp.pkey);
1830 s->s3.tmp.pkey = NULL;
3847d426
MC
1831 return 1;
1832 }
1833
555cbb32 1834 if (group_id != s->s3.group_id) {
6dd083fd
MC
1835 /*
1836 * This isn't for the group that we sent in the original
1837 * key_share!
1838 */
c48ffbcc 1839 SSLfatal(s, SSL_AD_ILLEGAL_PARAMETER, SSL_R_BAD_KEY_SHARE);
6dd083fd
MC
1840 return 0;
1841 }
aa6bd216
BK
1842 /* Retain this group in the SSL_SESSION */
1843 if (!s->hit) {
1844 s->session->kex_group = group_id;
1845 } else if (group_id != s->session->kex_group) {
1846 /*
1847 * If this is a resumption but changed what group was used, we need
1848 * to record the new group in the session, but the session is not
1849 * a new session and could be in use by other threads. So, make
1850 * a copy of the session to record the new information so that it's
1851 * useful for any sessions resumed from tickets issued on this
1852 * connection.
1853 */
1854 SSL_SESSION *new_sess;
1855
1856 if ((new_sess = ssl_session_dup(s->session, 0)) == NULL) {
1857 SSLfatal(s, SSL_AD_INTERNAL_ERROR, ERR_R_MALLOC_FAILURE);
1858 return 0;
1859 }
1860 SSL_SESSION_free(s->session);
1861 s->session = new_sess;
1862 s->session->kex_group = group_id;
1863 }
6dd083fd 1864
38b051a1
TM
1865 if ((ginf = tls1_group_id_lookup(SSL_CONNECTION_GET_CTX(s),
1866 group_id)) == NULL) {
c48ffbcc 1867 SSLfatal(s, SSL_AD_ILLEGAL_PARAMETER, SSL_R_BAD_KEY_SHARE);
a011b586
NT
1868 return 0;
1869 }
1870
6dd083fd
MC
1871 if (!PACKET_as_length_prefixed_2(pkt, &encoded_pt)
1872 || PACKET_remaining(&encoded_pt) == 0) {
c48ffbcc 1873 SSLfatal(s, SSL_AD_DECODE_ERROR, SSL_R_LENGTH_MISMATCH);
6dd083fd
MC
1874 return 0;
1875 }
1876
a011b586
NT
1877 if (!ginf->is_kem) {
1878 /* Regular KEX */
1879 skey = EVP_PKEY_new();
1880 if (skey == NULL || EVP_PKEY_copy_parameters(skey, ckey) <= 0) {
c48ffbcc 1881 SSLfatal(s, SSL_AD_INTERNAL_ERROR, SSL_R_COPY_PARAMETERS_FAILED);
b3c34401 1882 EVP_PKEY_free(skey);
a011b586
NT
1883 return 0;
1884 }
afce590b 1885
d5530efa
TM
1886 if (tls13_set_encoded_pub_key(skey, PACKET_data(&encoded_pt),
1887 PACKET_remaining(&encoded_pt)) <= 0) {
c48ffbcc 1888 SSLfatal(s, SSL_AD_ILLEGAL_PARAMETER, SSL_R_BAD_ECPOINT);
a011b586
NT
1889 EVP_PKEY_free(skey);
1890 return 0;
1891 }
6dd083fd 1892
a011b586
NT
1893 if (ssl_derive(s, ckey, skey, 1) == 0) {
1894 /* SSLfatal() already called */
1895 EVP_PKEY_free(skey);
1896 return 0;
1897 }
1898 s->s3.peer_tmp = skey;
1899 } else {
1900 /* KEM Mode */
1901 const unsigned char *ct = PACKET_data(&encoded_pt);
1902 size_t ctlen = PACKET_remaining(&encoded_pt);
1903
1904 if (ssl_decapsulate(s, ckey, ct, ctlen, 1) == 0) {
1905 /* SSLfatal() already called */
1906 return 0;
1907 }
6dd083fd 1908 }
aa6bd216 1909 s->s3.did_kex = 1;
3cf96e88 1910#endif
6dd083fd
MC
1911
1912 return 1;
1913}
4ff65f77 1914
38b051a1
TM
1915int tls_parse_stoc_cookie(SSL_CONNECTION *s, PACKET *pkt, unsigned int context,
1916 X509 *x, size_t chainidx)
cfef5027
MC
1917{
1918 PACKET cookie;
1919
1920 if (!PACKET_as_length_prefixed_2(pkt, &cookie)
1921 || !PACKET_memdup(&cookie, &s->ext.tls13_cookie,
1922 &s->ext.tls13_cookie_len)) {
c48ffbcc 1923 SSLfatal(s, SSL_AD_DECODE_ERROR, SSL_R_LENGTH_MISMATCH);
cfef5027
MC
1924 return 0;
1925 }
1926
1927 return 1;
1928}
1929
38b051a1
TM
1930int tls_parse_stoc_early_data(SSL_CONNECTION *s, PACKET *pkt,
1931 unsigned int context,
f63a17d6 1932 X509 *x, size_t chainidx)
38df5a45 1933{
fe874d27 1934 if (context == SSL_EXT_TLS1_3_NEW_SESSION_TICKET) {
6594189f
MC
1935 unsigned long max_early_data;
1936
1937 if (!PACKET_get_net_4(pkt, &max_early_data)
1938 || PACKET_remaining(pkt) != 0) {
c48ffbcc 1939 SSLfatal(s, SSL_AD_DECODE_ERROR, SSL_R_INVALID_MAX_EARLY_DATA);
6594189f
MC
1940 return 0;
1941 }
1942
1943 s->session->ext.max_early_data = max_early_data;
1944
1945 return 1;
1946 }
1947
38df5a45 1948 if (PACKET_remaining(pkt) != 0) {
c48ffbcc 1949 SSLfatal(s, SSL_AD_DECODE_ERROR, SSL_R_BAD_EXTENSION);
38df5a45
MC
1950 return 0;
1951 }
1952
4be3a7c7 1953 if (!s->ext.early_data_ok
c96ce52c 1954 || !s->hit) {
38df5a45
MC
1955 /*
1956 * If we get here then we didn't send early data, or we didn't resume
4be3a7c7
MC
1957 * using the first identity, or the SNI/ALPN is not consistent so the
1958 * server should not be accepting it.
38df5a45 1959 */
c48ffbcc 1960 SSLfatal(s, SSL_AD_ILLEGAL_PARAMETER, SSL_R_BAD_EXTENSION);
38df5a45
MC
1961 return 0;
1962 }
1963
1964 s->ext.early_data = SSL_EARLY_DATA_ACCEPTED;
1965
1966 return 1;
1967}
1968
38b051a1
TM
1969int tls_parse_stoc_psk(SSL_CONNECTION *s, PACKET *pkt,
1970 unsigned int context, X509 *x,
f63a17d6 1971 size_t chainidx)
4ff65f77
MC
1972{
1973#ifndef OPENSSL_NO_TLS1_3
1974 unsigned int identity;
1975
1976 if (!PACKET_get_net_2(pkt, &identity) || PACKET_remaining(pkt) != 0) {
c48ffbcc 1977 SSLfatal(s, SSL_AD_DECODE_ERROR, SSL_R_LENGTH_MISMATCH);
4ff65f77
MC
1978 return 0;
1979 }
1980
c96ce52c 1981 if (identity >= (unsigned int)s->ext.tick_identity) {
c48ffbcc 1982 SSLfatal(s, SSL_AD_ILLEGAL_PARAMETER, SSL_R_BAD_PSK_IDENTITY);
c96ce52c
MC
1983 return 0;
1984 }
1985
1986 /*
1987 * Session resumption tickets are always sent before PSK tickets. If the
1988 * ticket index is 0 then it must be for a session resumption ticket if we
1989 * sent two tickets, or if we didn't send a PSK ticket.
1990 */
1991 if (identity == 0 && (s->psksession == NULL || s->ext.tick_identity == 2)) {
9368f865
MC
1992 s->hit = 1;
1993 SSL_SESSION_free(s->psksession);
1994 s->psksession = NULL;
1995 return 1;
1996 }
1997
c96ce52c
MC
1998 if (s->psksession == NULL) {
1999 /* Should never happen */
c48ffbcc 2000 SSLfatal(s, SSL_AD_INTERNAL_ERROR, ERR_R_INTERNAL_ERROR);
4ff65f77
MC
2001 return 0;
2002 }
2003
add8d0e9
MC
2004 /*
2005 * If we used the external PSK for sending early_data then s->early_secret
2006 * is already set up, so don't overwrite it. Otherwise we copy the
2007 * early_secret across that we generated earlier.
2008 */
2009 if ((s->early_data_state != SSL_EARLY_DATA_WRITE_RETRY
2010 && s->early_data_state != SSL_EARLY_DATA_FINISHED_WRITING)
2011 || s->session->ext.max_early_data > 0
2012 || s->psksession->ext.max_early_data == 0)
2013 memcpy(s->early_secret, s->psksession->early_secret, EVP_MAX_MD_SIZE);
2014
9368f865
MC
2015 SSL_SESSION_free(s->session);
2016 s->session = s->psksession;
2017 s->psksession = NULL;
4ff65f77 2018 s->hit = 1;
c96ce52c
MC
2019 /* Early data is only allowed if we used the first ticket */
2020 if (identity != 0)
2021 s->ext.early_data_ok = 0;
4ff65f77
MC
2022#endif
2023
2024 return 1;
2025}