2 * Copyright 2016-2023 The OpenSSL Project Authors. All Rights Reserved.
4 * Licensed under the Apache License 2.0 (the "License"). You may not use
5 * this file except in compliance with the License. You can obtain a copy
6 * in the file LICENSE in the source distribution or at
7 * https://www.openssl.org/source/license.html
10 #include <openssl/ocsp.h>
11 #include "../ssl_local.h"
12 #include "statem_local.h"
13 #include "internal/cryptlib.h"
15 #define COOKIE_STATE_FORMAT_VERSION 1
18 * 2 bytes for packet length, 2 bytes for format version, 2 bytes for
19 * protocol version, 2 bytes for group id, 2 bytes for cipher id, 1 byte for
20 * key_share present flag, 8 bytes for timestamp, 2 bytes for the hashlen,
21 * EVP_MAX_MD_SIZE for transcript hash, 1 byte for app cookie length, app cookie
22 * length bytes, SHA256_DIGEST_LENGTH bytes for the HMAC of the whole thing.
24 #define MAX_COOKIE_SIZE (2 + 2 + 2 + 2 + 2 + 1 + 8 + 2 + EVP_MAX_MD_SIZE + 1 \
25 + SSL_COOKIE_LENGTH + SHA256_DIGEST_LENGTH)
28 * Message header + 2 bytes for protocol version + number of random bytes +
29 * + 1 byte for legacy session id length + number of bytes in legacy session id
30 * + 2 bytes for ciphersuite + 1 byte for legacy compression
31 * + 2 bytes for extension block length + 6 bytes for key_share extension
32 * + 4 bytes for cookie extension header + the number of bytes in the cookie
34 #define MAX_HRR_SIZE (SSL3_HM_HEADER_LENGTH + 2 + SSL3_RANDOM_SIZE + 1 \
35 + SSL_MAX_SSL_SESSION_ID_LENGTH + 2 + 1 + 2 + 6 + 4 \
39 * Parse the client's renegotiation binding and abort if it's not right
41 int tls_parse_ctos_renegotiate(SSL_CONNECTION
*s
, PACKET
*pkt
,
43 X509
*x
, size_t chainidx
)
46 const unsigned char *data
;
49 /* Parse the length byte */
50 if (!PACKET_get_1(pkt
, &ilen
)
51 || !PACKET_get_bytes(pkt
, &data
, ilen
)) {
52 SSLfatal(s
, SSL_AD_DECODE_ERROR
, SSL_R_RENEGOTIATION_ENCODING_ERR
);
56 /* Check that the extension matches */
57 if (ilen
!= s
->s3
.previous_client_finished_len
) {
58 SSLfatal(s
, SSL_AD_HANDSHAKE_FAILURE
, SSL_R_RENEGOTIATION_MISMATCH
);
62 ok
= memcmp(data
, s
->s3
.previous_client_finished
,
63 s
->s3
.previous_client_finished_len
);
64 #ifdef FUZZING_BUILD_MODE_UNSAFE_FOR_PRODUCTION
66 if ((data
[0] ^ s
->s3
.previous_client_finished
[0]) != 0xFF) {
72 SSLfatal(s
, SSL_AD_HANDSHAKE_FAILURE
, SSL_R_RENEGOTIATION_MISMATCH
);
76 s
->s3
.send_connection_binding
= 1;
82 * The servername extension is treated as follows:
84 * - Only the hostname type is supported with a maximum length of 255.
85 * - The servername is rejected if too long or if it contains zeros,
86 * in which case an fatal alert is generated.
87 * - The servername field is maintained together with the session cache.
88 * - When a session is resumed, the servername call back invoked in order
89 * to allow the application to position itself to the right context.
90 * - The servername is acknowledged if it is new for a session or when
91 * it is identical to a previously used for the same session.
92 * Applications can control the behaviour. They can at any time
93 * set a 'desirable' servername for a new SSL object. This can be the
94 * case for example with HTTPS when a Host: header field is received and
95 * a renegotiation is requested. In this case, a possible servername
96 * presented in the new client hello is only acknowledged if it matches
97 * the value of the Host: field.
98 * - Applications must use SSL_OP_NO_SESSION_RESUMPTION_ON_RENEGOTIATION
99 * if they provide for changing an explicit servername context for the
100 * session, i.e. when the session has been established with a servername
102 * - On session reconnect, the servername extension may be absent.
104 int tls_parse_ctos_server_name(SSL_CONNECTION
*s
, PACKET
*pkt
,
105 unsigned int context
, X509
*x
, size_t chainidx
)
107 unsigned int servname_type
;
108 PACKET sni
, hostname
;
110 if (!PACKET_as_length_prefixed_2(pkt
, &sni
)
111 /* ServerNameList must be at least 1 byte long. */
112 || PACKET_remaining(&sni
) == 0) {
113 SSLfatal(s
, SSL_AD_DECODE_ERROR
, SSL_R_BAD_EXTENSION
);
118 * Although the intent was for server_name to be extensible, RFC 4366
119 * was not clear about it; and so OpenSSL among other implementations,
120 * always and only allows a 'host_name' name types.
121 * RFC 6066 corrected the mistake but adding new name types
122 * is nevertheless no longer feasible, so act as if no other
123 * SNI types can exist, to simplify parsing.
125 * Also note that the RFC permits only one SNI value per type,
126 * i.e., we can only have a single hostname.
128 if (!PACKET_get_1(&sni
, &servname_type
)
129 || servname_type
!= TLSEXT_NAMETYPE_host_name
130 || !PACKET_as_length_prefixed_2(&sni
, &hostname
)) {
131 SSLfatal(s
, SSL_AD_DECODE_ERROR
, SSL_R_BAD_EXTENSION
);
136 * In TLSv1.2 and below the SNI is associated with the session. In TLSv1.3
137 * we always use the SNI value from the handshake.
139 if (!s
->hit
|| SSL_CONNECTION_IS_TLS13(s
)) {
140 if (PACKET_remaining(&hostname
) > TLSEXT_MAXLEN_host_name
) {
141 SSLfatal(s
, SSL_AD_UNRECOGNIZED_NAME
, SSL_R_BAD_EXTENSION
);
145 if (PACKET_contains_zero_byte(&hostname
)) {
146 SSLfatal(s
, SSL_AD_UNRECOGNIZED_NAME
, SSL_R_BAD_EXTENSION
);
151 * Store the requested SNI in the SSL as temporary storage.
152 * If we accept it, it will get stored in the SSL_SESSION as well.
154 OPENSSL_free(s
->ext
.hostname
);
155 s
->ext
.hostname
= NULL
;
156 if (!PACKET_strndup(&hostname
, &s
->ext
.hostname
)) {
157 SSLfatal(s
, SSL_AD_INTERNAL_ERROR
, ERR_R_INTERNAL_ERROR
);
161 s
->servername_done
= 1;
164 * In TLSv1.2 and below we should check if the SNI is consistent between
165 * the initial handshake and the resumption. In TLSv1.3 SNI is not
166 * associated with the session.
168 s
->servername_done
= (s
->session
->ext
.hostname
!= NULL
)
169 && PACKET_equal(&hostname
, s
->session
->ext
.hostname
,
170 strlen(s
->session
->ext
.hostname
));
176 int tls_parse_ctos_maxfragmentlen(SSL_CONNECTION
*s
, PACKET
*pkt
,
177 unsigned int context
,
178 X509
*x
, size_t chainidx
)
182 if (PACKET_remaining(pkt
) != 1 || !PACKET_get_1(pkt
, &value
)) {
183 SSLfatal(s
, SSL_AD_DECODE_ERROR
, SSL_R_BAD_EXTENSION
);
187 /* Received |value| should be a valid max-fragment-length code. */
188 if (!IS_MAX_FRAGMENT_LENGTH_EXT_VALID(value
)) {
189 SSLfatal(s
, SSL_AD_ILLEGAL_PARAMETER
,
190 SSL_R_SSL3_EXT_INVALID_MAX_FRAGMENT_LENGTH
);
195 * RFC 6066: The negotiated length applies for the duration of the session
196 * including session resumptions.
197 * We should receive the same code as in resumed session !
199 if (s
->hit
&& s
->session
->ext
.max_fragment_len_mode
!= value
) {
200 SSLfatal(s
, SSL_AD_ILLEGAL_PARAMETER
,
201 SSL_R_SSL3_EXT_INVALID_MAX_FRAGMENT_LENGTH
);
206 * Store it in session, so it'll become binding for us
207 * and we'll include it in a next Server Hello.
209 s
->session
->ext
.max_fragment_len_mode
= value
;
213 #ifndef OPENSSL_NO_SRP
214 int tls_parse_ctos_srp(SSL_CONNECTION
*s
, PACKET
*pkt
, unsigned int context
,
215 X509
*x
, size_t chainidx
)
219 if (!PACKET_as_length_prefixed_1(pkt
, &srp_I
)
220 || PACKET_contains_zero_byte(&srp_I
)) {
221 SSLfatal(s
, SSL_AD_DECODE_ERROR
, SSL_R_BAD_EXTENSION
);
225 if (!PACKET_strndup(&srp_I
, &s
->srp_ctx
.login
)) {
226 SSLfatal(s
, SSL_AD_INTERNAL_ERROR
, ERR_R_INTERNAL_ERROR
);
234 int tls_parse_ctos_ec_pt_formats(SSL_CONNECTION
*s
, PACKET
*pkt
,
235 unsigned int context
,
236 X509
*x
, size_t chainidx
)
238 PACKET ec_point_format_list
;
240 if (!PACKET_as_length_prefixed_1(pkt
, &ec_point_format_list
)
241 || PACKET_remaining(&ec_point_format_list
) == 0) {
242 SSLfatal(s
, SSL_AD_DECODE_ERROR
, SSL_R_BAD_EXTENSION
);
247 if (!PACKET_memdup(&ec_point_format_list
,
248 &s
->ext
.peer_ecpointformats
,
249 &s
->ext
.peer_ecpointformats_len
)) {
250 SSLfatal(s
, SSL_AD_INTERNAL_ERROR
, ERR_R_INTERNAL_ERROR
);
258 int tls_parse_ctos_session_ticket(SSL_CONNECTION
*s
, PACKET
*pkt
,
259 unsigned int context
,
260 X509
*x
, size_t chainidx
)
262 if (s
->ext
.session_ticket_cb
&&
263 !s
->ext
.session_ticket_cb(SSL_CONNECTION_GET_SSL(s
),
264 PACKET_data(pkt
), PACKET_remaining(pkt
),
265 s
->ext
.session_ticket_cb_arg
)) {
266 SSLfatal(s
, SSL_AD_INTERNAL_ERROR
, ERR_R_INTERNAL_ERROR
);
273 int tls_parse_ctos_sig_algs_cert(SSL_CONNECTION
*s
, PACKET
*pkt
,
274 ossl_unused
unsigned int context
,
276 ossl_unused
size_t chainidx
)
278 PACKET supported_sig_algs
;
280 if (!PACKET_as_length_prefixed_2(pkt
, &supported_sig_algs
)
281 || PACKET_remaining(&supported_sig_algs
) == 0) {
282 SSLfatal(s
, SSL_AD_DECODE_ERROR
, SSL_R_BAD_EXTENSION
);
286 if (!s
->hit
&& !tls1_save_sigalgs(s
, &supported_sig_algs
, 1)) {
287 SSLfatal(s
, SSL_AD_DECODE_ERROR
, SSL_R_BAD_EXTENSION
);
294 int tls_parse_ctos_sig_algs(SSL_CONNECTION
*s
, PACKET
*pkt
,
295 unsigned int context
, X509
*x
, size_t chainidx
)
297 PACKET supported_sig_algs
;
299 if (!PACKET_as_length_prefixed_2(pkt
, &supported_sig_algs
)
300 || PACKET_remaining(&supported_sig_algs
) == 0) {
301 SSLfatal(s
, SSL_AD_DECODE_ERROR
, SSL_R_BAD_EXTENSION
);
305 if (!s
->hit
&& !tls1_save_sigalgs(s
, &supported_sig_algs
, 0)) {
306 SSLfatal(s
, SSL_AD_DECODE_ERROR
, SSL_R_BAD_EXTENSION
);
313 #ifndef OPENSSL_NO_OCSP
314 int tls_parse_ctos_status_request(SSL_CONNECTION
*s
, PACKET
*pkt
,
315 unsigned int context
,
316 X509
*x
, size_t chainidx
)
318 PACKET responder_id_list
, exts
;
320 /* We ignore this in a resumption handshake */
324 /* Not defined if we get one of these in a client Certificate */
328 if (!PACKET_get_1(pkt
, (unsigned int *)&s
->ext
.status_type
)) {
329 SSLfatal(s
, SSL_AD_DECODE_ERROR
, SSL_R_BAD_EXTENSION
);
333 if (s
->ext
.status_type
!= TLSEXT_STATUSTYPE_ocsp
) {
335 * We don't know what to do with any other type so ignore it.
337 s
->ext
.status_type
= TLSEXT_STATUSTYPE_nothing
;
341 if (!PACKET_get_length_prefixed_2 (pkt
, &responder_id_list
)) {
342 SSLfatal(s
, SSL_AD_DECODE_ERROR
, SSL_R_BAD_EXTENSION
);
347 * We remove any OCSP_RESPIDs from a previous handshake
348 * to prevent unbounded memory growth - CVE-2016-6304
350 sk_OCSP_RESPID_pop_free(s
->ext
.ocsp
.ids
, OCSP_RESPID_free
);
351 if (PACKET_remaining(&responder_id_list
) > 0) {
352 s
->ext
.ocsp
.ids
= sk_OCSP_RESPID_new_null();
353 if (s
->ext
.ocsp
.ids
== NULL
) {
354 SSLfatal(s
, SSL_AD_INTERNAL_ERROR
, ERR_R_CRYPTO_LIB
);
358 s
->ext
.ocsp
.ids
= NULL
;
361 while (PACKET_remaining(&responder_id_list
) > 0) {
364 const unsigned char *id_data
;
366 if (!PACKET_get_length_prefixed_2(&responder_id_list
, &responder_id
)
367 || PACKET_remaining(&responder_id
) == 0) {
368 SSLfatal(s
, SSL_AD_DECODE_ERROR
, SSL_R_BAD_EXTENSION
);
372 id_data
= PACKET_data(&responder_id
);
373 id
= d2i_OCSP_RESPID(NULL
, &id_data
,
374 (int)PACKET_remaining(&responder_id
));
376 SSLfatal(s
, SSL_AD_DECODE_ERROR
, SSL_R_BAD_EXTENSION
);
380 if (id_data
!= PACKET_end(&responder_id
)) {
381 OCSP_RESPID_free(id
);
382 SSLfatal(s
, SSL_AD_DECODE_ERROR
, SSL_R_BAD_EXTENSION
);
387 if (!sk_OCSP_RESPID_push(s
->ext
.ocsp
.ids
, id
)) {
388 OCSP_RESPID_free(id
);
389 SSLfatal(s
, SSL_AD_INTERNAL_ERROR
, ERR_R_INTERNAL_ERROR
);
395 /* Read in request_extensions */
396 if (!PACKET_as_length_prefixed_2(pkt
, &exts
)) {
397 SSLfatal(s
, SSL_AD_DECODE_ERROR
, SSL_R_BAD_EXTENSION
);
401 if (PACKET_remaining(&exts
) > 0) {
402 const unsigned char *ext_data
= PACKET_data(&exts
);
404 sk_X509_EXTENSION_pop_free(s
->ext
.ocsp
.exts
,
405 X509_EXTENSION_free
);
407 d2i_X509_EXTENSIONS(NULL
, &ext_data
, (int)PACKET_remaining(&exts
));
408 if (s
->ext
.ocsp
.exts
== NULL
|| ext_data
!= PACKET_end(&exts
)) {
409 SSLfatal(s
, SSL_AD_DECODE_ERROR
, SSL_R_BAD_EXTENSION
);
418 #ifndef OPENSSL_NO_NEXTPROTONEG
419 int tls_parse_ctos_npn(SSL_CONNECTION
*s
, PACKET
*pkt
, unsigned int context
,
420 X509
*x
, size_t chainidx
)
423 * We shouldn't accept this extension on a
426 if (SSL_IS_FIRST_HANDSHAKE(s
))
434 * Save the ALPN extension in a ClientHello.|pkt| holds the contents of the ALPN
435 * extension, not including type and length. Returns: 1 on success, 0 on error.
437 int tls_parse_ctos_alpn(SSL_CONNECTION
*s
, PACKET
*pkt
, unsigned int context
,
438 X509
*x
, size_t chainidx
)
440 PACKET protocol_list
, save_protocol_list
, protocol
;
442 if (!SSL_IS_FIRST_HANDSHAKE(s
))
445 if (!PACKET_as_length_prefixed_2(pkt
, &protocol_list
)
446 || PACKET_remaining(&protocol_list
) < 2) {
447 SSLfatal(s
, SSL_AD_DECODE_ERROR
, SSL_R_BAD_EXTENSION
);
451 save_protocol_list
= protocol_list
;
453 /* Protocol names can't be empty. */
454 if (!PACKET_get_length_prefixed_1(&protocol_list
, &protocol
)
455 || PACKET_remaining(&protocol
) == 0) {
456 SSLfatal(s
, SSL_AD_DECODE_ERROR
, SSL_R_BAD_EXTENSION
);
459 } while (PACKET_remaining(&protocol_list
) != 0);
461 OPENSSL_free(s
->s3
.alpn_proposed
);
462 s
->s3
.alpn_proposed
= NULL
;
463 s
->s3
.alpn_proposed_len
= 0;
464 if (!PACKET_memdup(&save_protocol_list
,
465 &s
->s3
.alpn_proposed
, &s
->s3
.alpn_proposed_len
)) {
466 SSLfatal(s
, SSL_AD_INTERNAL_ERROR
, ERR_R_INTERNAL_ERROR
);
473 #ifndef OPENSSL_NO_SRTP
474 int tls_parse_ctos_use_srtp(SSL_CONNECTION
*s
, PACKET
*pkt
,
475 unsigned int context
, X509
*x
, size_t chainidx
)
477 STACK_OF(SRTP_PROTECTION_PROFILE
) *srvr
;
478 unsigned int ct
, mki_len
, id
;
481 SSL
*ssl
= SSL_CONNECTION_GET_SSL(s
);
483 /* Ignore this if we have no SRTP profiles */
484 if (SSL_get_srtp_profiles(ssl
) == NULL
)
487 /* Pull off the length of the cipher suite list and check it is even */
488 if (!PACKET_get_net_2(pkt
, &ct
) || (ct
& 1) != 0
489 || !PACKET_get_sub_packet(pkt
, &subpkt
, ct
)) {
490 SSLfatal(s
, SSL_AD_DECODE_ERROR
,
491 SSL_R_BAD_SRTP_PROTECTION_PROFILE_LIST
);
495 srvr
= SSL_get_srtp_profiles(ssl
);
496 s
->srtp_profile
= NULL
;
497 /* Search all profiles for a match initially */
498 srtp_pref
= sk_SRTP_PROTECTION_PROFILE_num(srvr
);
500 while (PACKET_remaining(&subpkt
)) {
501 if (!PACKET_get_net_2(&subpkt
, &id
)) {
502 SSLfatal(s
, SSL_AD_DECODE_ERROR
,
503 SSL_R_BAD_SRTP_PROTECTION_PROFILE_LIST
);
508 * Only look for match in profiles of higher preference than
510 * If no profiles have been have been configured then this
513 for (i
= 0; i
< srtp_pref
; i
++) {
514 SRTP_PROTECTION_PROFILE
*sprof
=
515 sk_SRTP_PROTECTION_PROFILE_value(srvr
, i
);
517 if (sprof
->id
== id
) {
518 s
->srtp_profile
= sprof
;
525 /* Now extract the MKI value as a sanity check, but discard it for now */
526 if (!PACKET_get_1(pkt
, &mki_len
)) {
527 SSLfatal(s
, SSL_AD_DECODE_ERROR
,
528 SSL_R_BAD_SRTP_PROTECTION_PROFILE_LIST
);
532 if (!PACKET_forward(pkt
, mki_len
)
533 || PACKET_remaining(pkt
)) {
534 SSLfatal(s
, SSL_AD_DECODE_ERROR
, SSL_R_BAD_SRTP_MKI_VALUE
);
542 int tls_parse_ctos_etm(SSL_CONNECTION
*s
, PACKET
*pkt
, unsigned int context
,
543 X509
*x
, size_t chainidx
)
545 if (!(s
->options
& SSL_OP_NO_ENCRYPT_THEN_MAC
))
552 * Process a psk_kex_modes extension received in the ClientHello. |pkt| contains
553 * the raw PACKET data for the extension. Returns 1 on success or 0 on failure.
555 int tls_parse_ctos_psk_kex_modes(SSL_CONNECTION
*s
, PACKET
*pkt
,
556 unsigned int context
,
557 X509
*x
, size_t chainidx
)
559 #ifndef OPENSSL_NO_TLS1_3
560 PACKET psk_kex_modes
;
563 if (!PACKET_as_length_prefixed_1(pkt
, &psk_kex_modes
)
564 || PACKET_remaining(&psk_kex_modes
) == 0) {
565 SSLfatal(s
, SSL_AD_DECODE_ERROR
, SSL_R_BAD_EXTENSION
);
569 while (PACKET_get_1(&psk_kex_modes
, &mode
)) {
570 if (mode
== TLSEXT_KEX_MODE_KE_DHE
)
571 s
->ext
.psk_kex_mode
|= TLSEXT_KEX_MODE_FLAG_KE_DHE
;
572 else if (mode
== TLSEXT_KEX_MODE_KE
573 && (s
->options
& SSL_OP_ALLOW_NO_DHE_KEX
) != 0)
574 s
->ext
.psk_kex_mode
|= TLSEXT_KEX_MODE_FLAG_KE
;
582 * Process a key_share extension received in the ClientHello. |pkt| contains
583 * the raw PACKET data for the extension. Returns 1 on success or 0 on failure.
585 int tls_parse_ctos_key_share(SSL_CONNECTION
*s
, PACKET
*pkt
,
586 unsigned int context
, X509
*x
, size_t chainidx
)
588 #ifndef OPENSSL_NO_TLS1_3
589 unsigned int group_id
;
590 PACKET key_share_list
, encoded_pt
;
591 const uint16_t *clntgroups
, *srvrgroups
;
592 size_t clnt_num_groups
, srvr_num_groups
;
595 if (s
->hit
&& (s
->ext
.psk_kex_mode
& TLSEXT_KEX_MODE_FLAG_KE_DHE
) == 0)
599 if (s
->s3
.peer_tmp
!= NULL
) {
600 SSLfatal(s
, SSL_AD_INTERNAL_ERROR
, ERR_R_INTERNAL_ERROR
);
604 if (!PACKET_as_length_prefixed_2(pkt
, &key_share_list
)) {
605 SSLfatal(s
, SSL_AD_DECODE_ERROR
, SSL_R_LENGTH_MISMATCH
);
609 /* Get our list of supported groups */
610 tls1_get_supported_groups(s
, &srvrgroups
, &srvr_num_groups
);
611 /* Get the clients list of supported groups. */
612 tls1_get_peer_groups(s
, &clntgroups
, &clnt_num_groups
);
613 if (clnt_num_groups
== 0) {
615 * This can only happen if the supported_groups extension was not sent,
616 * because we verify that the length is non-zero when we process that
619 SSLfatal(s
, SSL_AD_MISSING_EXTENSION
,
620 SSL_R_MISSING_SUPPORTED_GROUPS_EXTENSION
);
624 if (s
->s3
.group_id
!= 0 && PACKET_remaining(&key_share_list
) == 0) {
626 * If we set a group_id already, then we must have sent an HRR
627 * requesting a new key_share. If we haven't got one then that is an
630 SSLfatal(s
, SSL_AD_ILLEGAL_PARAMETER
, SSL_R_BAD_KEY_SHARE
);
634 while (PACKET_remaining(&key_share_list
) > 0) {
635 if (!PACKET_get_net_2(&key_share_list
, &group_id
)
636 || !PACKET_get_length_prefixed_2(&key_share_list
, &encoded_pt
)
637 || PACKET_remaining(&encoded_pt
) == 0) {
638 SSLfatal(s
, SSL_AD_DECODE_ERROR
, SSL_R_LENGTH_MISMATCH
);
643 * If we already found a suitable key_share we loop through the
644 * rest to verify the structure, but don't process them.
650 * If we sent an HRR then the key_share sent back MUST be for the group
651 * we requested, and must be the only key_share sent.
653 if (s
->s3
.group_id
!= 0
654 && (group_id
!= s
->s3
.group_id
655 || PACKET_remaining(&key_share_list
) != 0)) {
656 SSLfatal(s
, SSL_AD_ILLEGAL_PARAMETER
, SSL_R_BAD_KEY_SHARE
);
660 /* Check if this share is in supported_groups sent from client */
661 if (!check_in_list(s
, group_id
, clntgroups
, clnt_num_groups
, 0)) {
662 SSLfatal(s
, SSL_AD_ILLEGAL_PARAMETER
, SSL_R_BAD_KEY_SHARE
);
666 /* Check if this share is for a group we can use */
667 if (!check_in_list(s
, group_id
, srvrgroups
, srvr_num_groups
, 1)
668 || !tls_group_allowed(s
, group_id
, SSL_SECOP_CURVE_SUPPORTED
)
670 * We tolerate but ignore a group id that we don't think is
671 * suitable for TLSv1.3
673 || !tls_valid_group(s
, group_id
, TLS1_3_VERSION
, TLS1_3_VERSION
,
675 /* Share not suitable */
679 s
->s3
.group_id
= group_id
;
680 /* Cache the selected group ID in the SSL_SESSION */
681 s
->session
->kex_group
= group_id
;
683 if ((s
->s3
.peer_tmp
= ssl_generate_param_group(s
, group_id
)) == NULL
) {
684 SSLfatal(s
, SSL_AD_INTERNAL_ERROR
,
685 SSL_R_UNABLE_TO_FIND_ECDH_PARAMETERS
);
689 if (tls13_set_encoded_pub_key(s
->s3
.peer_tmp
,
690 PACKET_data(&encoded_pt
),
691 PACKET_remaining(&encoded_pt
)) <= 0) {
692 SSLfatal(s
, SSL_AD_ILLEGAL_PARAMETER
, SSL_R_BAD_ECPOINT
);
703 int tls_parse_ctos_cookie(SSL_CONNECTION
*s
, PACKET
*pkt
, unsigned int context
,
704 X509
*x
, size_t chainidx
)
706 #ifndef OPENSSL_NO_TLS1_3
707 unsigned int format
, version
, key_share
, group_id
;
710 PACKET cookie
, raw
, chhash
, appcookie
;
712 const unsigned char *data
, *mdin
, *ciphdata
;
713 unsigned char hmac
[SHA256_DIGEST_LENGTH
];
714 unsigned char hrr
[MAX_HRR_SIZE
];
715 size_t rawlen
, hmaclen
, hrrlen
, ciphlen
;
717 SSL
*ssl
= SSL_CONNECTION_GET_SSL(s
);
718 SSL_CTX
*sctx
= SSL_CONNECTION_GET_CTX(s
);
720 /* Ignore any cookie if we're not set up to verify it */
721 if (sctx
->verify_stateless_cookie_cb
== NULL
722 || (s
->s3
.flags
& TLS1_FLAGS_STATELESS
) == 0)
725 if (!PACKET_as_length_prefixed_2(pkt
, &cookie
)) {
726 SSLfatal(s
, SSL_AD_DECODE_ERROR
, SSL_R_LENGTH_MISMATCH
);
731 data
= PACKET_data(&raw
);
732 rawlen
= PACKET_remaining(&raw
);
733 if (rawlen
< SHA256_DIGEST_LENGTH
734 || !PACKET_forward(&raw
, rawlen
- SHA256_DIGEST_LENGTH
)) {
735 SSLfatal(s
, SSL_AD_DECODE_ERROR
, SSL_R_LENGTH_MISMATCH
);
738 mdin
= PACKET_data(&raw
);
740 /* Verify the HMAC of the cookie */
741 hctx
= EVP_MD_CTX_create();
742 pkey
= EVP_PKEY_new_raw_private_key_ex(sctx
->libctx
, "HMAC",
744 s
->session_ctx
->ext
.cookie_hmac_key
,
745 sizeof(s
->session_ctx
->ext
.cookie_hmac_key
));
746 if (hctx
== NULL
|| pkey
== NULL
) {
747 EVP_MD_CTX_free(hctx
);
749 SSLfatal(s
, SSL_AD_INTERNAL_ERROR
, ERR_R_EVP_LIB
);
753 hmaclen
= SHA256_DIGEST_LENGTH
;
754 if (EVP_DigestSignInit_ex(hctx
, NULL
, "SHA2-256", sctx
->libctx
,
755 sctx
->propq
, pkey
, NULL
) <= 0
756 || EVP_DigestSign(hctx
, hmac
, &hmaclen
, data
,
757 rawlen
- SHA256_DIGEST_LENGTH
) <= 0
758 || hmaclen
!= SHA256_DIGEST_LENGTH
) {
759 EVP_MD_CTX_free(hctx
);
761 SSLfatal(s
, SSL_AD_INTERNAL_ERROR
, ERR_R_INTERNAL_ERROR
);
765 EVP_MD_CTX_free(hctx
);
768 if (CRYPTO_memcmp(hmac
, mdin
, SHA256_DIGEST_LENGTH
) != 0) {
769 SSLfatal(s
, SSL_AD_ILLEGAL_PARAMETER
, SSL_R_COOKIE_MISMATCH
);
773 if (!PACKET_get_net_2(&cookie
, &format
)) {
774 SSLfatal(s
, SSL_AD_DECODE_ERROR
, SSL_R_LENGTH_MISMATCH
);
777 /* Check the cookie format is something we recognise. Ignore it if not */
778 if (format
!= COOKIE_STATE_FORMAT_VERSION
)
782 * The rest of these checks really shouldn't fail since we have verified the
786 /* Check the version number is sane */
787 if (!PACKET_get_net_2(&cookie
, &version
)) {
788 SSLfatal(s
, SSL_AD_DECODE_ERROR
, SSL_R_LENGTH_MISMATCH
);
791 if (version
!= TLS1_3_VERSION
) {
792 SSLfatal(s
, SSL_AD_ILLEGAL_PARAMETER
,
793 SSL_R_BAD_PROTOCOL_VERSION_NUMBER
);
797 if (!PACKET_get_net_2(&cookie
, &group_id
)) {
798 SSLfatal(s
, SSL_AD_DECODE_ERROR
, SSL_R_LENGTH_MISMATCH
);
802 ciphdata
= PACKET_data(&cookie
);
803 if (!PACKET_forward(&cookie
, 2)) {
804 SSLfatal(s
, SSL_AD_DECODE_ERROR
, SSL_R_LENGTH_MISMATCH
);
807 if (group_id
!= s
->s3
.group_id
808 || s
->s3
.tmp
.new_cipher
809 != ssl_get_cipher_by_char(s
, ciphdata
, 0)) {
811 * We chose a different cipher or group id this time around to what is
812 * in the cookie. Something must have changed.
814 SSLfatal(s
, SSL_AD_ILLEGAL_PARAMETER
, SSL_R_BAD_CIPHER
);
818 if (!PACKET_get_1(&cookie
, &key_share
)
819 || !PACKET_get_net_8(&cookie
, &tm
)
820 || !PACKET_get_length_prefixed_2(&cookie
, &chhash
)
821 || !PACKET_get_length_prefixed_1(&cookie
, &appcookie
)
822 || PACKET_remaining(&cookie
) != SHA256_DIGEST_LENGTH
) {
823 SSLfatal(s
, SSL_AD_DECODE_ERROR
, SSL_R_LENGTH_MISMATCH
);
827 /* We tolerate a cookie age of up to 10 minutes (= 60 * 10 seconds) */
829 if (tm
> now
|| (now
- tm
) > 600) {
830 /* Cookie is stale. Ignore it */
834 /* Verify the app cookie */
835 if (sctx
->verify_stateless_cookie_cb(ssl
,
836 PACKET_data(&appcookie
),
837 PACKET_remaining(&appcookie
)) == 0) {
838 SSLfatal(s
, SSL_AD_ILLEGAL_PARAMETER
, SSL_R_COOKIE_MISMATCH
);
843 * Reconstruct the HRR that we would have sent in response to the original
844 * ClientHello so we can add it to the transcript hash.
845 * Note: This won't work with custom HRR extensions
847 if (!WPACKET_init_static_len(&hrrpkt
, hrr
, sizeof(hrr
), 0)) {
848 SSLfatal(s
, SSL_AD_INTERNAL_ERROR
, ERR_R_INTERNAL_ERROR
);
851 if (!WPACKET_put_bytes_u8(&hrrpkt
, SSL3_MT_SERVER_HELLO
)
852 || !WPACKET_start_sub_packet_u24(&hrrpkt
)
853 || !WPACKET_put_bytes_u16(&hrrpkt
, TLS1_2_VERSION
)
854 || !WPACKET_memcpy(&hrrpkt
, hrrrandom
, SSL3_RANDOM_SIZE
)
855 || !WPACKET_sub_memcpy_u8(&hrrpkt
, s
->tmp_session_id
,
856 s
->tmp_session_id_len
)
857 || !ssl
->method
->put_cipher_by_char(s
->s3
.tmp
.new_cipher
, &hrrpkt
,
859 || !WPACKET_put_bytes_u8(&hrrpkt
, 0)
860 || !WPACKET_start_sub_packet_u16(&hrrpkt
)) {
861 WPACKET_cleanup(&hrrpkt
);
862 SSLfatal(s
, SSL_AD_INTERNAL_ERROR
, ERR_R_INTERNAL_ERROR
);
865 if (!WPACKET_put_bytes_u16(&hrrpkt
, TLSEXT_TYPE_supported_versions
)
866 || !WPACKET_start_sub_packet_u16(&hrrpkt
)
867 || !WPACKET_put_bytes_u16(&hrrpkt
, s
->version
)
868 || !WPACKET_close(&hrrpkt
)) {
869 WPACKET_cleanup(&hrrpkt
);
870 SSLfatal(s
, SSL_AD_INTERNAL_ERROR
, ERR_R_INTERNAL_ERROR
);
874 if (!WPACKET_put_bytes_u16(&hrrpkt
, TLSEXT_TYPE_key_share
)
875 || !WPACKET_start_sub_packet_u16(&hrrpkt
)
876 || !WPACKET_put_bytes_u16(&hrrpkt
, s
->s3
.group_id
)
877 || !WPACKET_close(&hrrpkt
)) {
878 WPACKET_cleanup(&hrrpkt
);
879 SSLfatal(s
, SSL_AD_INTERNAL_ERROR
, ERR_R_INTERNAL_ERROR
);
883 if (!WPACKET_put_bytes_u16(&hrrpkt
, TLSEXT_TYPE_cookie
)
884 || !WPACKET_start_sub_packet_u16(&hrrpkt
)
885 || !WPACKET_sub_memcpy_u16(&hrrpkt
, data
, rawlen
)
886 || !WPACKET_close(&hrrpkt
) /* cookie extension */
887 || !WPACKET_close(&hrrpkt
) /* extension block */
888 || !WPACKET_close(&hrrpkt
) /* message */
889 || !WPACKET_get_total_written(&hrrpkt
, &hrrlen
)
890 || !WPACKET_finish(&hrrpkt
)) {
891 WPACKET_cleanup(&hrrpkt
);
892 SSLfatal(s
, SSL_AD_INTERNAL_ERROR
, ERR_R_INTERNAL_ERROR
);
896 /* Reconstruct the transcript hash */
897 if (!create_synthetic_message_hash(s
, PACKET_data(&chhash
),
898 PACKET_remaining(&chhash
), hrr
,
900 /* SSLfatal() already called */
904 /* Act as if this ClientHello came after a HelloRetryRequest */
905 s
->hello_retry_request
= SSL_HRR_PENDING
;
913 int tls_parse_ctos_supported_groups(SSL_CONNECTION
*s
, PACKET
*pkt
,
914 unsigned int context
,
915 X509
*x
, size_t chainidx
)
917 PACKET supported_groups_list
;
919 /* Each group is 2 bytes and we must have at least 1. */
920 if (!PACKET_as_length_prefixed_2(pkt
, &supported_groups_list
)
921 || PACKET_remaining(&supported_groups_list
) == 0
922 || (PACKET_remaining(&supported_groups_list
) % 2) != 0) {
923 SSLfatal(s
, SSL_AD_DECODE_ERROR
, SSL_R_BAD_EXTENSION
);
927 if (!s
->hit
|| SSL_CONNECTION_IS_TLS13(s
)) {
928 OPENSSL_free(s
->ext
.peer_supportedgroups
);
929 s
->ext
.peer_supportedgroups
= NULL
;
930 s
->ext
.peer_supportedgroups_len
= 0;
931 if (!tls1_save_u16(&supported_groups_list
,
932 &s
->ext
.peer_supportedgroups
,
933 &s
->ext
.peer_supportedgroups_len
)) {
934 SSLfatal(s
, SSL_AD_INTERNAL_ERROR
, ERR_R_INTERNAL_ERROR
);
942 int tls_parse_ctos_ems(SSL_CONNECTION
*s
, PACKET
*pkt
, unsigned int context
,
943 X509
*x
, size_t chainidx
)
945 /* The extension must always be empty */
946 if (PACKET_remaining(pkt
) != 0) {
947 SSLfatal(s
, SSL_AD_DECODE_ERROR
, SSL_R_BAD_EXTENSION
);
951 if (s
->options
& SSL_OP_NO_EXTENDED_MASTER_SECRET
)
954 s
->s3
.flags
|= TLS1_FLAGS_RECEIVED_EXTMS
;
960 int tls_parse_ctos_early_data(SSL_CONNECTION
*s
, PACKET
*pkt
, unsigned int context
,
961 X509
*x
, size_t chainidx
)
963 if (PACKET_remaining(pkt
) != 0) {
964 SSLfatal(s
, SSL_AD_DECODE_ERROR
, SSL_R_BAD_EXTENSION
);
968 if (s
->hello_retry_request
!= SSL_HRR_NONE
) {
969 SSLfatal(s
, SSL_AD_ILLEGAL_PARAMETER
, SSL_R_BAD_EXTENSION
);
976 static SSL_TICKET_STATUS
tls_get_stateful_ticket(SSL_CONNECTION
*s
, PACKET
*tick
,
979 SSL_SESSION
*tmpsess
= NULL
;
981 s
->ext
.ticket_expected
= 1;
983 switch (PACKET_remaining(tick
)) {
985 return SSL_TICKET_EMPTY
;
987 case SSL_MAX_SSL_SESSION_ID_LENGTH
:
991 return SSL_TICKET_NO_DECRYPT
;
994 tmpsess
= lookup_sess_in_cache(s
, PACKET_data(tick
),
995 SSL_MAX_SSL_SESSION_ID_LENGTH
);
998 return SSL_TICKET_NO_DECRYPT
;
1001 return SSL_TICKET_SUCCESS
;
1004 int tls_parse_ctos_psk(SSL_CONNECTION
*s
, PACKET
*pkt
, unsigned int context
,
1005 X509
*x
, size_t chainidx
)
1007 PACKET identities
, binders
, binder
;
1008 size_t binderoffset
, hashsize
;
1009 SSL_SESSION
*sess
= NULL
;
1010 unsigned int id
, i
, ext
= 0;
1011 const EVP_MD
*md
= NULL
;
1012 SSL_CTX
*sctx
= SSL_CONNECTION_GET_CTX(s
);
1013 SSL
*ssl
= SSL_CONNECTION_GET_SSL(s
);
1016 * If we have no PSK kex mode that we recognise then we can't resume so
1017 * ignore this extension
1019 if ((s
->ext
.psk_kex_mode
1020 & (TLSEXT_KEX_MODE_FLAG_KE
| TLSEXT_KEX_MODE_FLAG_KE_DHE
)) == 0)
1023 if (!PACKET_get_length_prefixed_2(pkt
, &identities
)) {
1024 SSLfatal(s
, SSL_AD_DECODE_ERROR
, SSL_R_BAD_EXTENSION
);
1028 s
->ext
.ticket_expected
= 0;
1029 for (id
= 0; PACKET_remaining(&identities
) != 0; id
++) {
1031 unsigned long ticket_agel
;
1034 if (!PACKET_get_length_prefixed_2(&identities
, &identity
)
1035 || !PACKET_get_net_4(&identities
, &ticket_agel
)) {
1036 SSLfatal(s
, SSL_AD_DECODE_ERROR
, SSL_R_BAD_EXTENSION
);
1040 idlen
= PACKET_remaining(&identity
);
1041 if (s
->psk_find_session_cb
!= NULL
1042 && !s
->psk_find_session_cb(ssl
, PACKET_data(&identity
), idlen
,
1044 SSLfatal(s
, SSL_AD_INTERNAL_ERROR
, SSL_R_BAD_EXTENSION
);
1048 #ifndef OPENSSL_NO_PSK
1050 && s
->psk_server_callback
!= NULL
1051 && idlen
<= PSK_MAX_IDENTITY_LEN
) {
1053 unsigned char pskdata
[PSK_MAX_PSK_LEN
];
1054 unsigned int pskdatalen
;
1056 if (!PACKET_strndup(&identity
, &pskid
)) {
1057 SSLfatal(s
, SSL_AD_INTERNAL_ERROR
, ERR_R_INTERNAL_ERROR
);
1060 pskdatalen
= s
->psk_server_callback(ssl
, pskid
, pskdata
,
1062 OPENSSL_free(pskid
);
1063 if (pskdatalen
> PSK_MAX_PSK_LEN
) {
1064 SSLfatal(s
, SSL_AD_INTERNAL_ERROR
, ERR_R_INTERNAL_ERROR
);
1066 } else if (pskdatalen
> 0) {
1067 const SSL_CIPHER
*cipher
;
1068 const unsigned char tls13_aes128gcmsha256_id
[] = { 0x13, 0x01 };
1071 * We found a PSK using an old style callback. We don't know
1072 * the digest so we default to SHA256 as per the TLSv1.3 spec
1074 cipher
= SSL_CIPHER_find(ssl
, tls13_aes128gcmsha256_id
);
1075 if (cipher
== NULL
) {
1076 OPENSSL_cleanse(pskdata
, pskdatalen
);
1077 SSLfatal(s
, SSL_AD_INTERNAL_ERROR
, ERR_R_INTERNAL_ERROR
);
1081 sess
= SSL_SESSION_new();
1083 || !SSL_SESSION_set1_master_key(sess
, pskdata
,
1085 || !SSL_SESSION_set_cipher(sess
, cipher
)
1086 || !SSL_SESSION_set_protocol_version(sess
,
1088 OPENSSL_cleanse(pskdata
, pskdatalen
);
1089 SSLfatal(s
, SSL_AD_INTERNAL_ERROR
, ERR_R_INTERNAL_ERROR
);
1092 OPENSSL_cleanse(pskdata
, pskdatalen
);
1095 #endif /* OPENSSL_NO_PSK */
1098 /* We found a PSK */
1099 SSL_SESSION
*sesstmp
= ssl_session_dup(sess
, 0);
1101 if (sesstmp
== NULL
) {
1102 SSLfatal(s
, SSL_AD_INTERNAL_ERROR
, ERR_R_INTERNAL_ERROR
);
1105 SSL_SESSION_free(sess
);
1109 * We've just been told to use this session for this context so
1110 * make sure the sid_ctx matches up.
1112 memcpy(sess
->sid_ctx
, s
->sid_ctx
, s
->sid_ctx_length
);
1113 sess
->sid_ctx_length
= s
->sid_ctx_length
;
1116 s
->ext
.early_data_ok
= 1;
1117 s
->ext
.ticket_expected
= 1;
1119 OSSL_TIME t
, age
, expire
;
1123 * If we are using anti-replay protection then we behave as if
1124 * SSL_OP_NO_TICKET is set - we are caching tickets anyway so there
1125 * is no point in using full stateless tickets.
1127 if ((s
->options
& SSL_OP_NO_TICKET
) != 0
1128 || (s
->max_early_data
> 0
1129 && (s
->options
& SSL_OP_NO_ANTI_REPLAY
) == 0))
1130 ret
= tls_get_stateful_ticket(s
, &identity
, &sess
);
1132 ret
= tls_decrypt_ticket(s
, PACKET_data(&identity
),
1133 PACKET_remaining(&identity
), NULL
, 0,
1136 if (ret
== SSL_TICKET_EMPTY
) {
1137 SSLfatal(s
, SSL_AD_DECODE_ERROR
, SSL_R_BAD_EXTENSION
);
1141 if (ret
== SSL_TICKET_FATAL_ERR_MALLOC
1142 || ret
== SSL_TICKET_FATAL_ERR_OTHER
) {
1143 SSLfatal(s
, SSL_AD_INTERNAL_ERROR
, ERR_R_INTERNAL_ERROR
);
1146 if (ret
== SSL_TICKET_NONE
|| ret
== SSL_TICKET_NO_DECRYPT
)
1149 /* Check for replay */
1150 if (s
->max_early_data
> 0
1151 && (s
->options
& SSL_OP_NO_ANTI_REPLAY
) == 0
1152 && !SSL_CTX_remove_session(s
->session_ctx
, sess
)) {
1153 SSL_SESSION_free(sess
);
1158 age
= ossl_time_subtract(ossl_ms2time(ticket_agel
),
1159 ossl_ms2time(sess
->ext
.tick_age_add
));
1160 t
= ossl_time_subtract(ossl_time_now(), sess
->time
);
1163 * Although internally we use OSS_TIME which has ns granularity,
1164 * when SSL_SESSION structures are serialised/deserialised we use
1165 * second granularity for the sess->time field. Therefore it could
1166 * appear that the client's ticket age is longer than ours (our
1167 * ticket age calculation should always be slightly longer than the
1168 * client's due to the network latency). Therefore we add 1000ms to
1169 * our age calculation to adjust for rounding errors.
1171 expire
= ossl_time_add(t
, ossl_ms2time(1000));
1174 && ossl_time_compare(sess
->timeout
, t
) >= 0
1175 && ossl_time_compare(age
, expire
) <= 0
1176 && ossl_time_compare(ossl_time_add(age
, TICKET_AGE_ALLOWANCE
),
1179 * Ticket age is within tolerance and not expired. We allow it
1182 s
->ext
.early_data_ok
= 1;
1186 md
= ssl_md(sctx
, sess
->cipher
->algorithm2
);
1188 SSLfatal(s
, SSL_AD_INTERNAL_ERROR
, ERR_R_INTERNAL_ERROR
);
1191 if (!EVP_MD_is_a(md
,
1192 EVP_MD_get0_name(ssl_md(sctx
,
1193 s
->s3
.tmp
.new_cipher
->algorithm2
)))) {
1194 /* The ciphersuite is not compatible with this session. */
1195 SSL_SESSION_free(sess
);
1197 s
->ext
.early_data_ok
= 0;
1198 s
->ext
.ticket_expected
= 0;
1207 binderoffset
= PACKET_data(pkt
) - (const unsigned char *)s
->init_buf
->data
;
1208 hashsize
= EVP_MD_get_size(md
);
1210 if (!PACKET_get_length_prefixed_2(pkt
, &binders
)) {
1211 SSLfatal(s
, SSL_AD_DECODE_ERROR
, SSL_R_BAD_EXTENSION
);
1215 for (i
= 0; i
<= id
; i
++) {
1216 if (!PACKET_get_length_prefixed_1(&binders
, &binder
)) {
1217 SSLfatal(s
, SSL_AD_DECODE_ERROR
, SSL_R_BAD_EXTENSION
);
1222 if (PACKET_remaining(&binder
) != hashsize
) {
1223 SSLfatal(s
, SSL_AD_DECODE_ERROR
, SSL_R_BAD_EXTENSION
);
1226 if (tls_psk_do_binder(s
, md
, (const unsigned char *)s
->init_buf
->data
,
1227 binderoffset
, PACKET_data(&binder
), NULL
, sess
, 0,
1229 /* SSLfatal() already called */
1233 s
->ext
.tick_identity
= id
;
1235 SSL_SESSION_free(s
->session
);
1239 SSL_SESSION_free(sess
);
1243 int tls_parse_ctos_post_handshake_auth(SSL_CONNECTION
*s
, PACKET
*pkt
,
1244 ossl_unused
unsigned int context
,
1245 ossl_unused X509
*x
,
1246 ossl_unused
size_t chainidx
)
1248 if (PACKET_remaining(pkt
) != 0) {
1249 SSLfatal(s
, SSL_AD_DECODE_ERROR
,
1250 SSL_R_POST_HANDSHAKE_AUTH_ENCODING_ERR
);
1254 s
->post_handshake_auth
= SSL_PHA_EXT_RECEIVED
;
1260 * Add the server's renegotiation binding
1262 EXT_RETURN
tls_construct_stoc_renegotiate(SSL_CONNECTION
*s
, WPACKET
*pkt
,
1263 unsigned int context
, X509
*x
,
1266 if (!s
->s3
.send_connection_binding
)
1267 return EXT_RETURN_NOT_SENT
;
1269 /* Still add this even if SSL_OP_NO_RENEGOTIATION is set */
1270 if (!WPACKET_put_bytes_u16(pkt
, TLSEXT_TYPE_renegotiate
)
1271 || !WPACKET_start_sub_packet_u16(pkt
)
1272 || !WPACKET_start_sub_packet_u8(pkt
)
1273 || !WPACKET_memcpy(pkt
, s
->s3
.previous_client_finished
,
1274 s
->s3
.previous_client_finished_len
)
1275 || !WPACKET_memcpy(pkt
, s
->s3
.previous_server_finished
,
1276 s
->s3
.previous_server_finished_len
)
1277 || !WPACKET_close(pkt
)
1278 || !WPACKET_close(pkt
)) {
1279 SSLfatal(s
, SSL_AD_INTERNAL_ERROR
, ERR_R_INTERNAL_ERROR
);
1280 return EXT_RETURN_FAIL
;
1283 return EXT_RETURN_SENT
;
1286 EXT_RETURN
tls_construct_stoc_server_name(SSL_CONNECTION
*s
, WPACKET
*pkt
,
1287 unsigned int context
, X509
*x
,
1290 if (s
->servername_done
!= 1)
1291 return EXT_RETURN_NOT_SENT
;
1294 * Prior to TLSv1.3 we ignore any SNI in the current handshake if resuming.
1295 * We just use the servername from the initial handshake.
1297 if (s
->hit
&& !SSL_CONNECTION_IS_TLS13(s
))
1298 return EXT_RETURN_NOT_SENT
;
1300 if (!WPACKET_put_bytes_u16(pkt
, TLSEXT_TYPE_server_name
)
1301 || !WPACKET_put_bytes_u16(pkt
, 0)) {
1302 SSLfatal(s
, SSL_AD_INTERNAL_ERROR
, ERR_R_INTERNAL_ERROR
);
1303 return EXT_RETURN_FAIL
;
1306 return EXT_RETURN_SENT
;
1309 /* Add/include the server's max fragment len extension into ServerHello */
1310 EXT_RETURN
tls_construct_stoc_maxfragmentlen(SSL_CONNECTION
*s
, WPACKET
*pkt
,
1311 unsigned int context
, X509
*x
,
1314 if (!USE_MAX_FRAGMENT_LENGTH_EXT(s
->session
))
1315 return EXT_RETURN_NOT_SENT
;
1318 * 4 bytes for this extension type and extension length
1319 * 1 byte for the Max Fragment Length code value.
1321 if (!WPACKET_put_bytes_u16(pkt
, TLSEXT_TYPE_max_fragment_length
)
1322 || !WPACKET_start_sub_packet_u16(pkt
)
1323 || !WPACKET_put_bytes_u8(pkt
, s
->session
->ext
.max_fragment_len_mode
)
1324 || !WPACKET_close(pkt
)) {
1325 SSLfatal(s
, SSL_AD_INTERNAL_ERROR
, ERR_R_INTERNAL_ERROR
);
1326 return EXT_RETURN_FAIL
;
1329 return EXT_RETURN_SENT
;
1332 EXT_RETURN
tls_construct_stoc_ec_pt_formats(SSL_CONNECTION
*s
, WPACKET
*pkt
,
1333 unsigned int context
, X509
*x
,
1336 unsigned long alg_k
= s
->s3
.tmp
.new_cipher
->algorithm_mkey
;
1337 unsigned long alg_a
= s
->s3
.tmp
.new_cipher
->algorithm_auth
;
1338 int using_ecc
= ((alg_k
& SSL_kECDHE
) || (alg_a
& SSL_aECDSA
))
1339 && (s
->ext
.peer_ecpointformats
!= NULL
);
1340 const unsigned char *plist
;
1344 return EXT_RETURN_NOT_SENT
;
1346 tls1_get_formatlist(s
, &plist
, &plistlen
);
1347 if (!WPACKET_put_bytes_u16(pkt
, TLSEXT_TYPE_ec_point_formats
)
1348 || !WPACKET_start_sub_packet_u16(pkt
)
1349 || !WPACKET_sub_memcpy_u8(pkt
, plist
, plistlen
)
1350 || !WPACKET_close(pkt
)) {
1351 SSLfatal(s
, SSL_AD_INTERNAL_ERROR
, ERR_R_INTERNAL_ERROR
);
1352 return EXT_RETURN_FAIL
;
1355 return EXT_RETURN_SENT
;
1358 EXT_RETURN
tls_construct_stoc_supported_groups(SSL_CONNECTION
*s
, WPACKET
*pkt
,
1359 unsigned int context
, X509
*x
,
1362 const uint16_t *groups
;
1363 size_t numgroups
, i
, first
= 1;
1366 /* s->s3.group_id is non zero if we accepted a key_share */
1367 if (s
->s3
.group_id
== 0)
1368 return EXT_RETURN_NOT_SENT
;
1370 /* Get our list of supported groups */
1371 tls1_get_supported_groups(s
, &groups
, &numgroups
);
1372 if (numgroups
== 0) {
1373 SSLfatal(s
, SSL_AD_INTERNAL_ERROR
, ERR_R_INTERNAL_ERROR
);
1374 return EXT_RETURN_FAIL
;
1377 /* Copy group ID if supported */
1378 version
= SSL_version(SSL_CONNECTION_GET_SSL(s
));
1379 for (i
= 0; i
< numgroups
; i
++) {
1380 uint16_t group
= groups
[i
];
1382 if (tls_valid_group(s
, group
, version
, version
, 0, NULL
)
1383 && tls_group_allowed(s
, group
, SSL_SECOP_CURVE_SUPPORTED
)) {
1386 * Check if the client is already using our preferred group. If
1387 * so we don't need to add this extension
1389 if (s
->s3
.group_id
== group
)
1390 return EXT_RETURN_NOT_SENT
;
1392 /* Add extension header */
1393 if (!WPACKET_put_bytes_u16(pkt
, TLSEXT_TYPE_supported_groups
)
1394 /* Sub-packet for supported_groups extension */
1395 || !WPACKET_start_sub_packet_u16(pkt
)
1396 || !WPACKET_start_sub_packet_u16(pkt
)) {
1397 SSLfatal(s
, SSL_AD_INTERNAL_ERROR
, ERR_R_INTERNAL_ERROR
);
1398 return EXT_RETURN_FAIL
;
1403 if (!WPACKET_put_bytes_u16(pkt
, group
)) {
1404 SSLfatal(s
, SSL_AD_INTERNAL_ERROR
, ERR_R_INTERNAL_ERROR
);
1405 return EXT_RETURN_FAIL
;
1410 if (!WPACKET_close(pkt
) || !WPACKET_close(pkt
)) {
1411 SSLfatal(s
, SSL_AD_INTERNAL_ERROR
, ERR_R_INTERNAL_ERROR
);
1412 return EXT_RETURN_FAIL
;
1415 return EXT_RETURN_SENT
;
1418 EXT_RETURN
tls_construct_stoc_session_ticket(SSL_CONNECTION
*s
, WPACKET
*pkt
,
1419 unsigned int context
, X509
*x
,
1422 if (!s
->ext
.ticket_expected
|| !tls_use_ticket(s
)) {
1423 s
->ext
.ticket_expected
= 0;
1424 return EXT_RETURN_NOT_SENT
;
1427 if (!WPACKET_put_bytes_u16(pkt
, TLSEXT_TYPE_session_ticket
)
1428 || !WPACKET_put_bytes_u16(pkt
, 0)) {
1429 SSLfatal(s
, SSL_AD_INTERNAL_ERROR
, ERR_R_INTERNAL_ERROR
);
1430 return EXT_RETURN_FAIL
;
1433 return EXT_RETURN_SENT
;
1436 #ifndef OPENSSL_NO_OCSP
1437 EXT_RETURN
tls_construct_stoc_status_request(SSL_CONNECTION
*s
, WPACKET
*pkt
,
1438 unsigned int context
, X509
*x
,
1441 /* We don't currently support this extension inside a CertificateRequest */
1442 if (context
== SSL_EXT_TLS1_3_CERTIFICATE_REQUEST
)
1443 return EXT_RETURN_NOT_SENT
;
1445 if (!s
->ext
.status_expected
)
1446 return EXT_RETURN_NOT_SENT
;
1448 if (SSL_CONNECTION_IS_TLS13(s
) && chainidx
!= 0)
1449 return EXT_RETURN_NOT_SENT
;
1451 if (!WPACKET_put_bytes_u16(pkt
, TLSEXT_TYPE_status_request
)
1452 || !WPACKET_start_sub_packet_u16(pkt
)) {
1453 SSLfatal(s
, SSL_AD_INTERNAL_ERROR
, ERR_R_INTERNAL_ERROR
);
1454 return EXT_RETURN_FAIL
;
1458 * In TLSv1.3 we include the certificate status itself. In <= TLSv1.2 we
1459 * send back an empty extension, with the certificate status appearing as a
1462 if (SSL_CONNECTION_IS_TLS13(s
) && !tls_construct_cert_status_body(s
, pkt
)) {
1463 /* SSLfatal() already called */
1464 return EXT_RETURN_FAIL
;
1466 if (!WPACKET_close(pkt
)) {
1467 SSLfatal(s
, SSL_AD_INTERNAL_ERROR
, ERR_R_INTERNAL_ERROR
);
1468 return EXT_RETURN_FAIL
;
1471 return EXT_RETURN_SENT
;
1475 #ifndef OPENSSL_NO_NEXTPROTONEG
1476 EXT_RETURN
tls_construct_stoc_next_proto_neg(SSL_CONNECTION
*s
, WPACKET
*pkt
,
1477 unsigned int context
, X509
*x
,
1480 const unsigned char *npa
;
1481 unsigned int npalen
;
1483 int npn_seen
= s
->s3
.npn_seen
;
1484 SSL_CTX
*sctx
= SSL_CONNECTION_GET_CTX(s
);
1487 if (!npn_seen
|| sctx
->ext
.npn_advertised_cb
== NULL
)
1488 return EXT_RETURN_NOT_SENT
;
1490 ret
= sctx
->ext
.npn_advertised_cb(SSL_CONNECTION_GET_SSL(s
), &npa
, &npalen
,
1491 sctx
->ext
.npn_advertised_cb_arg
);
1492 if (ret
== SSL_TLSEXT_ERR_OK
) {
1493 if (!WPACKET_put_bytes_u16(pkt
, TLSEXT_TYPE_next_proto_neg
)
1494 || !WPACKET_sub_memcpy_u16(pkt
, npa
, npalen
)) {
1495 SSLfatal(s
, SSL_AD_INTERNAL_ERROR
, ERR_R_INTERNAL_ERROR
);
1496 return EXT_RETURN_FAIL
;
1501 return EXT_RETURN_SENT
;
1505 EXT_RETURN
tls_construct_stoc_alpn(SSL_CONNECTION
*s
, WPACKET
*pkt
, unsigned int context
,
1506 X509
*x
, size_t chainidx
)
1508 if (s
->s3
.alpn_selected
== NULL
)
1509 return EXT_RETURN_NOT_SENT
;
1511 if (!WPACKET_put_bytes_u16(pkt
,
1512 TLSEXT_TYPE_application_layer_protocol_negotiation
)
1513 || !WPACKET_start_sub_packet_u16(pkt
)
1514 || !WPACKET_start_sub_packet_u16(pkt
)
1515 || !WPACKET_sub_memcpy_u8(pkt
, s
->s3
.alpn_selected
,
1516 s
->s3
.alpn_selected_len
)
1517 || !WPACKET_close(pkt
)
1518 || !WPACKET_close(pkt
)) {
1519 SSLfatal(s
, SSL_AD_INTERNAL_ERROR
, ERR_R_INTERNAL_ERROR
);
1520 return EXT_RETURN_FAIL
;
1523 return EXT_RETURN_SENT
;
1526 #ifndef OPENSSL_NO_SRTP
1527 EXT_RETURN
tls_construct_stoc_use_srtp(SSL_CONNECTION
*s
, WPACKET
*pkt
,
1528 unsigned int context
, X509
*x
,
1531 if (s
->srtp_profile
== NULL
)
1532 return EXT_RETURN_NOT_SENT
;
1534 if (!WPACKET_put_bytes_u16(pkt
, TLSEXT_TYPE_use_srtp
)
1535 || !WPACKET_start_sub_packet_u16(pkt
)
1536 || !WPACKET_put_bytes_u16(pkt
, 2)
1537 || !WPACKET_put_bytes_u16(pkt
, s
->srtp_profile
->id
)
1538 || !WPACKET_put_bytes_u8(pkt
, 0)
1539 || !WPACKET_close(pkt
)) {
1540 SSLfatal(s
, SSL_AD_INTERNAL_ERROR
, ERR_R_INTERNAL_ERROR
);
1541 return EXT_RETURN_FAIL
;
1544 return EXT_RETURN_SENT
;
1548 EXT_RETURN
tls_construct_stoc_etm(SSL_CONNECTION
*s
, WPACKET
*pkt
,
1549 unsigned int context
,
1550 X509
*x
, size_t chainidx
)
1552 if (!s
->ext
.use_etm
)
1553 return EXT_RETURN_NOT_SENT
;
1556 * Don't use encrypt_then_mac if AEAD or RC4 might want to disable
1557 * for other cases too.
1559 if (s
->s3
.tmp
.new_cipher
->algorithm_mac
== SSL_AEAD
1560 || s
->s3
.tmp
.new_cipher
->algorithm_enc
== SSL_RC4
1561 || s
->s3
.tmp
.new_cipher
->algorithm_enc
== SSL_eGOST2814789CNT
1562 || s
->s3
.tmp
.new_cipher
->algorithm_enc
== SSL_eGOST2814789CNT12
1563 || s
->s3
.tmp
.new_cipher
->algorithm_enc
== SSL_MAGMA
1564 || s
->s3
.tmp
.new_cipher
->algorithm_enc
== SSL_KUZNYECHIK
) {
1566 return EXT_RETURN_NOT_SENT
;
1569 if (!WPACKET_put_bytes_u16(pkt
, TLSEXT_TYPE_encrypt_then_mac
)
1570 || !WPACKET_put_bytes_u16(pkt
, 0)) {
1571 SSLfatal(s
, SSL_AD_INTERNAL_ERROR
, ERR_R_INTERNAL_ERROR
);
1572 return EXT_RETURN_FAIL
;
1575 return EXT_RETURN_SENT
;
1578 EXT_RETURN
tls_construct_stoc_ems(SSL_CONNECTION
*s
, WPACKET
*pkt
,
1579 unsigned int context
,
1580 X509
*x
, size_t chainidx
)
1582 if ((s
->s3
.flags
& TLS1_FLAGS_RECEIVED_EXTMS
) == 0)
1583 return EXT_RETURN_NOT_SENT
;
1585 if (!WPACKET_put_bytes_u16(pkt
, TLSEXT_TYPE_extended_master_secret
)
1586 || !WPACKET_put_bytes_u16(pkt
, 0)) {
1587 SSLfatal(s
, SSL_AD_INTERNAL_ERROR
, ERR_R_INTERNAL_ERROR
);
1588 return EXT_RETURN_FAIL
;
1591 return EXT_RETURN_SENT
;
1594 EXT_RETURN
tls_construct_stoc_supported_versions(SSL_CONNECTION
*s
, WPACKET
*pkt
,
1595 unsigned int context
, X509
*x
,
1598 if (!ossl_assert(SSL_CONNECTION_IS_TLS13(s
))) {
1599 SSLfatal(s
, SSL_AD_INTERNAL_ERROR
, ERR_R_INTERNAL_ERROR
);
1600 return EXT_RETURN_FAIL
;
1603 if (!WPACKET_put_bytes_u16(pkt
, TLSEXT_TYPE_supported_versions
)
1604 || !WPACKET_start_sub_packet_u16(pkt
)
1605 || !WPACKET_put_bytes_u16(pkt
, s
->version
)
1606 || !WPACKET_close(pkt
)) {
1607 SSLfatal(s
, SSL_AD_INTERNAL_ERROR
, ERR_R_INTERNAL_ERROR
);
1608 return EXT_RETURN_FAIL
;
1611 return EXT_RETURN_SENT
;
1614 EXT_RETURN
tls_construct_stoc_key_share(SSL_CONNECTION
*s
, WPACKET
*pkt
,
1615 unsigned int context
, X509
*x
,
1618 #ifndef OPENSSL_NO_TLS1_3
1619 unsigned char *encodedPoint
;
1620 size_t encoded_pt_len
= 0;
1621 EVP_PKEY
*ckey
= s
->s3
.peer_tmp
, *skey
= NULL
;
1622 const TLS_GROUP_INFO
*ginf
= NULL
;
1624 if (s
->hello_retry_request
== SSL_HRR_PENDING
) {
1626 /* Original key_share was acceptable so don't ask for another one */
1627 return EXT_RETURN_NOT_SENT
;
1629 if (!WPACKET_put_bytes_u16(pkt
, TLSEXT_TYPE_key_share
)
1630 || !WPACKET_start_sub_packet_u16(pkt
)
1631 || !WPACKET_put_bytes_u16(pkt
, s
->s3
.group_id
)
1632 || !WPACKET_close(pkt
)) {
1633 SSLfatal(s
, SSL_AD_INTERNAL_ERROR
, ERR_R_INTERNAL_ERROR
);
1634 return EXT_RETURN_FAIL
;
1637 return EXT_RETURN_SENT
;
1641 /* No key_share received from client - must be resuming */
1642 if (!s
->hit
|| !tls13_generate_handshake_secret(s
, NULL
, 0)) {
1643 SSLfatal(s
, SSL_AD_INTERNAL_ERROR
, ERR_R_INTERNAL_ERROR
);
1644 return EXT_RETURN_FAIL
;
1646 return EXT_RETURN_NOT_SENT
;
1652 * If we're doing PSK ('hit') but the client doesn't support psk-dhe,
1653 * we don't need to send a key share.
1655 if ((s
->ext
.psk_kex_mode
& TLSEXT_KEX_MODE_FLAG_KE_DHE
) == 0)
1656 return EXT_RETURN_NOT_SENT
;
1659 * If both, psk_ke and psk_dh_ke are available, we do psk_dh_ke and
1660 * send a key share by default, but not if the server is explicitly
1661 * configured to prefer psk_ke.
1663 if (((s
->ext
.psk_kex_mode
& TLSEXT_KEX_MODE_FLAG_KE
) != 0)
1664 && ((s
->options
& SSL_OP_PREFER_NO_DHE_KEX
) != 0)) {
1665 return EXT_RETURN_NOT_SENT
;
1669 if (!WPACKET_put_bytes_u16(pkt
, TLSEXT_TYPE_key_share
)
1670 || !WPACKET_start_sub_packet_u16(pkt
)
1671 || !WPACKET_put_bytes_u16(pkt
, s
->s3
.group_id
)) {
1672 SSLfatal(s
, SSL_AD_INTERNAL_ERROR
, ERR_R_INTERNAL_ERROR
);
1673 return EXT_RETURN_FAIL
;
1676 if ((ginf
= tls1_group_id_lookup(SSL_CONNECTION_GET_CTX(s
),
1677 s
->s3
.group_id
)) == NULL
) {
1678 SSLfatal(s
, SSL_AD_INTERNAL_ERROR
, ERR_R_INTERNAL_ERROR
);
1679 return EXT_RETURN_FAIL
;
1682 if (!ginf
->is_kem
) {
1684 skey
= ssl_generate_pkey(s
, ckey
);
1686 SSLfatal(s
, SSL_AD_INTERNAL_ERROR
, ERR_R_SSL_LIB
);
1687 return EXT_RETURN_FAIL
;
1690 /* Generate encoding of server key */
1691 encoded_pt_len
= EVP_PKEY_get1_encoded_public_key(skey
, &encodedPoint
);
1692 if (encoded_pt_len
== 0) {
1693 SSLfatal(s
, SSL_AD_INTERNAL_ERROR
, ERR_R_EC_LIB
);
1694 EVP_PKEY_free(skey
);
1695 return EXT_RETURN_FAIL
;
1698 if (!WPACKET_sub_memcpy_u16(pkt
, encodedPoint
, encoded_pt_len
)
1699 || !WPACKET_close(pkt
)) {
1700 SSLfatal(s
, SSL_AD_INTERNAL_ERROR
, ERR_R_INTERNAL_ERROR
);
1701 EVP_PKEY_free(skey
);
1702 OPENSSL_free(encodedPoint
);
1703 return EXT_RETURN_FAIL
;
1705 OPENSSL_free(encodedPoint
);
1708 * This causes the crypto state to be updated based on the derived keys
1710 s
->s3
.tmp
.pkey
= skey
;
1711 if (ssl_derive(s
, skey
, ckey
, 1) == 0) {
1712 /* SSLfatal() already called */
1713 return EXT_RETURN_FAIL
;
1717 unsigned char *ct
= NULL
;
1721 * This does not update the crypto state.
1723 * The generated pms is stored in `s->s3.tmp.pms` to be later used via
1726 if (ssl_encapsulate(s
, ckey
, &ct
, &ctlen
, 0) == 0) {
1727 /* SSLfatal() already called */
1728 return EXT_RETURN_FAIL
;
1732 SSLfatal(s
, SSL_AD_INTERNAL_ERROR
, ERR_R_INTERNAL_ERROR
);
1734 return EXT_RETURN_FAIL
;
1737 if (!WPACKET_sub_memcpy_u16(pkt
, ct
, ctlen
)
1738 || !WPACKET_close(pkt
)) {
1739 SSLfatal(s
, SSL_AD_INTERNAL_ERROR
, ERR_R_INTERNAL_ERROR
);
1741 return EXT_RETURN_FAIL
;
1746 * This causes the crypto state to be updated based on the generated pms
1748 if (ssl_gensecret(s
, s
->s3
.tmp
.pms
, s
->s3
.tmp
.pmslen
) == 0) {
1749 /* SSLfatal() already called */
1750 return EXT_RETURN_FAIL
;
1754 return EXT_RETURN_SENT
;
1756 return EXT_RETURN_FAIL
;
1760 EXT_RETURN
tls_construct_stoc_cookie(SSL_CONNECTION
*s
, WPACKET
*pkt
,
1761 unsigned int context
,
1762 X509
*x
, size_t chainidx
)
1764 #ifndef OPENSSL_NO_TLS1_3
1765 unsigned char *hashval1
, *hashval2
, *appcookie1
, *appcookie2
, *cookie
;
1766 unsigned char *hmac
, *hmac2
;
1767 size_t startlen
, ciphlen
, totcookielen
, hashlen
, hmaclen
, appcookielen
;
1770 int ret
= EXT_RETURN_FAIL
;
1771 SSL_CTX
*sctx
= SSL_CONNECTION_GET_CTX(s
);
1772 SSL
*ssl
= SSL_CONNECTION_GET_SSL(s
);
1774 if ((s
->s3
.flags
& TLS1_FLAGS_STATELESS
) == 0)
1775 return EXT_RETURN_NOT_SENT
;
1777 if (sctx
->gen_stateless_cookie_cb
== NULL
) {
1778 SSLfatal(s
, SSL_AD_INTERNAL_ERROR
, SSL_R_NO_COOKIE_CALLBACK_SET
);
1779 return EXT_RETURN_FAIL
;
1782 if (!WPACKET_put_bytes_u16(pkt
, TLSEXT_TYPE_cookie
)
1783 || !WPACKET_start_sub_packet_u16(pkt
)
1784 || !WPACKET_start_sub_packet_u16(pkt
)
1785 || !WPACKET_get_total_written(pkt
, &startlen
)
1786 || !WPACKET_reserve_bytes(pkt
, MAX_COOKIE_SIZE
, &cookie
)
1787 || !WPACKET_put_bytes_u16(pkt
, COOKIE_STATE_FORMAT_VERSION
)
1788 || !WPACKET_put_bytes_u16(pkt
, TLS1_3_VERSION
)
1789 || !WPACKET_put_bytes_u16(pkt
, s
->s3
.group_id
)
1790 || !ssl
->method
->put_cipher_by_char(s
->s3
.tmp
.new_cipher
, pkt
,
1792 /* Is there a key_share extension present in this HRR? */
1793 || !WPACKET_put_bytes_u8(pkt
, s
->s3
.peer_tmp
== NULL
)
1794 || !WPACKET_put_bytes_u64(pkt
, time(NULL
))
1795 || !WPACKET_start_sub_packet_u16(pkt
)
1796 || !WPACKET_reserve_bytes(pkt
, EVP_MAX_MD_SIZE
, &hashval1
)) {
1797 SSLfatal(s
, SSL_AD_INTERNAL_ERROR
, ERR_R_INTERNAL_ERROR
);
1798 return EXT_RETURN_FAIL
;
1802 * Get the hash of the initial ClientHello. ssl_handshake_hash() operates
1803 * on raw buffers, so we first reserve sufficient bytes (above) and then
1804 * subsequently allocate them (below)
1806 if (!ssl3_digest_cached_records(s
, 0)
1807 || !ssl_handshake_hash(s
, hashval1
, EVP_MAX_MD_SIZE
, &hashlen
)) {
1808 /* SSLfatal() already called */
1809 return EXT_RETURN_FAIL
;
1812 if (!WPACKET_allocate_bytes(pkt
, hashlen
, &hashval2
)
1813 || !ossl_assert(hashval1
== hashval2
)
1814 || !WPACKET_close(pkt
)
1815 || !WPACKET_start_sub_packet_u8(pkt
)
1816 || !WPACKET_reserve_bytes(pkt
, SSL_COOKIE_LENGTH
, &appcookie1
)) {
1817 SSLfatal(s
, SSL_AD_INTERNAL_ERROR
, ERR_R_INTERNAL_ERROR
);
1818 return EXT_RETURN_FAIL
;
1821 /* Generate the application cookie */
1822 if (sctx
->gen_stateless_cookie_cb(ssl
, appcookie1
,
1823 &appcookielen
) == 0) {
1824 SSLfatal(s
, SSL_AD_INTERNAL_ERROR
, SSL_R_COOKIE_GEN_CALLBACK_FAILURE
);
1825 return EXT_RETURN_FAIL
;
1828 if (!WPACKET_allocate_bytes(pkt
, appcookielen
, &appcookie2
)
1829 || !ossl_assert(appcookie1
== appcookie2
)
1830 || !WPACKET_close(pkt
)
1831 || !WPACKET_get_total_written(pkt
, &totcookielen
)
1832 || !WPACKET_reserve_bytes(pkt
, SHA256_DIGEST_LENGTH
, &hmac
)) {
1833 SSLfatal(s
, SSL_AD_INTERNAL_ERROR
, ERR_R_INTERNAL_ERROR
);
1834 return EXT_RETURN_FAIL
;
1836 hmaclen
= SHA256_DIGEST_LENGTH
;
1838 totcookielen
-= startlen
;
1839 if (!ossl_assert(totcookielen
<= MAX_COOKIE_SIZE
- SHA256_DIGEST_LENGTH
)) {
1840 SSLfatal(s
, SSL_AD_INTERNAL_ERROR
, ERR_R_INTERNAL_ERROR
);
1841 return EXT_RETURN_FAIL
;
1844 /* HMAC the cookie */
1845 hctx
= EVP_MD_CTX_create();
1846 pkey
= EVP_PKEY_new_raw_private_key_ex(sctx
->libctx
, "HMAC",
1848 s
->session_ctx
->ext
.cookie_hmac_key
,
1849 sizeof(s
->session_ctx
->ext
.cookie_hmac_key
));
1850 if (hctx
== NULL
|| pkey
== NULL
) {
1851 SSLfatal(s
, SSL_AD_INTERNAL_ERROR
, ERR_R_EVP_LIB
);
1855 if (EVP_DigestSignInit_ex(hctx
, NULL
, "SHA2-256", sctx
->libctx
,
1856 sctx
->propq
, pkey
, NULL
) <= 0
1857 || EVP_DigestSign(hctx
, hmac
, &hmaclen
, cookie
,
1858 totcookielen
) <= 0) {
1859 SSLfatal(s
, SSL_AD_INTERNAL_ERROR
, ERR_R_INTERNAL_ERROR
);
1863 if (!ossl_assert(totcookielen
+ hmaclen
<= MAX_COOKIE_SIZE
)) {
1864 SSLfatal(s
, SSL_AD_INTERNAL_ERROR
, ERR_R_INTERNAL_ERROR
);
1868 if (!WPACKET_allocate_bytes(pkt
, hmaclen
, &hmac2
)
1869 || !ossl_assert(hmac
== hmac2
)
1870 || !ossl_assert(cookie
== hmac
- totcookielen
)
1871 || !WPACKET_close(pkt
)
1872 || !WPACKET_close(pkt
)) {
1873 SSLfatal(s
, SSL_AD_INTERNAL_ERROR
, ERR_R_INTERNAL_ERROR
);
1877 ret
= EXT_RETURN_SENT
;
1880 EVP_MD_CTX_free(hctx
);
1881 EVP_PKEY_free(pkey
);
1884 return EXT_RETURN_FAIL
;
1888 EXT_RETURN
tls_construct_stoc_cryptopro_bug(SSL_CONNECTION
*s
, WPACKET
*pkt
,
1889 unsigned int context
, X509
*x
,
1892 const unsigned char cryptopro_ext
[36] = {
1893 0xfd, 0xe8, /* 65000 */
1894 0x00, 0x20, /* 32 bytes length */
1895 0x30, 0x1e, 0x30, 0x08, 0x06, 0x06, 0x2a, 0x85,
1896 0x03, 0x02, 0x02, 0x09, 0x30, 0x08, 0x06, 0x06,
1897 0x2a, 0x85, 0x03, 0x02, 0x02, 0x16, 0x30, 0x08,
1898 0x06, 0x06, 0x2a, 0x85, 0x03, 0x02, 0x02, 0x17
1901 if (((s
->s3
.tmp
.new_cipher
->id
& 0xFFFF) != 0x80
1902 && (s
->s3
.tmp
.new_cipher
->id
& 0xFFFF) != 0x81)
1903 || (SSL_get_options(SSL_CONNECTION_GET_SSL(s
))
1904 & SSL_OP_CRYPTOPRO_TLSEXT_BUG
) == 0)
1905 return EXT_RETURN_NOT_SENT
;
1907 if (!WPACKET_memcpy(pkt
, cryptopro_ext
, sizeof(cryptopro_ext
))) {
1908 SSLfatal(s
, SSL_AD_INTERNAL_ERROR
, ERR_R_INTERNAL_ERROR
);
1909 return EXT_RETURN_FAIL
;
1912 return EXT_RETURN_SENT
;
1915 EXT_RETURN
tls_construct_stoc_early_data(SSL_CONNECTION
*s
, WPACKET
*pkt
,
1916 unsigned int context
, X509
*x
,
1919 if (context
== SSL_EXT_TLS1_3_NEW_SESSION_TICKET
) {
1920 if (s
->max_early_data
== 0)
1921 return EXT_RETURN_NOT_SENT
;
1923 if (!WPACKET_put_bytes_u16(pkt
, TLSEXT_TYPE_early_data
)
1924 || !WPACKET_start_sub_packet_u16(pkt
)
1925 || !WPACKET_put_bytes_u32(pkt
, s
->max_early_data
)
1926 || !WPACKET_close(pkt
)) {
1927 SSLfatal(s
, SSL_AD_INTERNAL_ERROR
, ERR_R_INTERNAL_ERROR
);
1928 return EXT_RETURN_FAIL
;
1931 return EXT_RETURN_SENT
;
1934 if (s
->ext
.early_data
!= SSL_EARLY_DATA_ACCEPTED
)
1935 return EXT_RETURN_NOT_SENT
;
1937 if (!WPACKET_put_bytes_u16(pkt
, TLSEXT_TYPE_early_data
)
1938 || !WPACKET_start_sub_packet_u16(pkt
)
1939 || !WPACKET_close(pkt
)) {
1940 SSLfatal(s
, SSL_AD_INTERNAL_ERROR
, ERR_R_INTERNAL_ERROR
);
1941 return EXT_RETURN_FAIL
;
1944 return EXT_RETURN_SENT
;
1947 EXT_RETURN
tls_construct_stoc_psk(SSL_CONNECTION
*s
, WPACKET
*pkt
,
1948 unsigned int context
,
1949 X509
*x
, size_t chainidx
)
1952 return EXT_RETURN_NOT_SENT
;
1954 if (!WPACKET_put_bytes_u16(pkt
, TLSEXT_TYPE_psk
)
1955 || !WPACKET_start_sub_packet_u16(pkt
)
1956 || !WPACKET_put_bytes_u16(pkt
, s
->ext
.tick_identity
)
1957 || !WPACKET_close(pkt
)) {
1958 SSLfatal(s
, SSL_AD_INTERNAL_ERROR
, ERR_R_INTERNAL_ERROR
);
1959 return EXT_RETURN_FAIL
;
1962 return EXT_RETURN_SENT
;
1965 EXT_RETURN
tls_construct_stoc_client_cert_type(SSL_CONNECTION
*sc
, WPACKET
*pkt
,
1966 unsigned int context
,
1967 X509
*x
, size_t chainidx
)
1969 if (sc
->ext
.client_cert_type_ctos
== OSSL_CERT_TYPE_CTOS_ERROR
1970 && (send_certificate_request(sc
)
1971 || sc
->post_handshake_auth
== SSL_PHA_EXT_RECEIVED
)) {
1972 /* Did not receive an acceptable cert type - and doing client auth */
1973 SSLfatal(sc
, SSL_AD_UNSUPPORTED_CERTIFICATE
, SSL_R_BAD_EXTENSION
);
1974 return EXT_RETURN_FAIL
;
1977 if (sc
->ext
.client_cert_type
== TLSEXT_cert_type_x509
) {
1978 sc
->ext
.client_cert_type_ctos
= OSSL_CERT_TYPE_CTOS_NONE
;
1979 return EXT_RETURN_NOT_SENT
;
1983 * Note: only supposed to send this if we are going to do a cert request,
1984 * but TLSv1.3 could do a PHA request if the client supports it
1986 if ((!send_certificate_request(sc
) && sc
->post_handshake_auth
!= SSL_PHA_EXT_RECEIVED
)
1987 || sc
->ext
.client_cert_type_ctos
!= OSSL_CERT_TYPE_CTOS_GOOD
1988 || sc
->client_cert_type
== NULL
) {
1989 /* if we don't send it, reset to TLSEXT_cert_type_x509 */
1990 sc
->ext
.client_cert_type_ctos
= OSSL_CERT_TYPE_CTOS_NONE
;
1991 sc
->ext
.client_cert_type
= TLSEXT_cert_type_x509
;
1992 return EXT_RETURN_NOT_SENT
;
1995 if (!WPACKET_put_bytes_u16(pkt
, TLSEXT_TYPE_client_cert_type
)
1996 || !WPACKET_start_sub_packet_u16(pkt
)
1997 || !WPACKET_put_bytes_u8(pkt
, sc
->ext
.client_cert_type
)
1998 || !WPACKET_close(pkt
)) {
1999 SSLfatal(sc
, SSL_AD_INTERNAL_ERROR
, ERR_R_INTERNAL_ERROR
);
2000 return EXT_RETURN_FAIL
;
2002 return EXT_RETURN_SENT
;
2005 /* One of |pref|, |other| is configured and the values are sanitized */
2006 static int reconcile_cert_type(const unsigned char *pref
, size_t pref_len
,
2007 const unsigned char *other
, size_t other_len
,
2008 uint8_t *chosen_cert_type
)
2012 for (i
= 0; i
< pref_len
; i
++) {
2013 if (memchr(other
, pref
[i
], other_len
) != NULL
) {
2014 *chosen_cert_type
= pref
[i
];
2015 return OSSL_CERT_TYPE_CTOS_GOOD
;
2018 return OSSL_CERT_TYPE_CTOS_ERROR
;
2021 int tls_parse_ctos_client_cert_type(SSL_CONNECTION
*sc
, PACKET
*pkt
,
2022 unsigned int context
,
2023 X509
*x
, size_t chainidx
)
2025 PACKET supported_cert_types
;
2026 const unsigned char *data
;
2029 /* Ignore the extension */
2030 if (sc
->client_cert_type
== NULL
) {
2031 sc
->ext
.client_cert_type_ctos
= OSSL_CERT_TYPE_CTOS_NONE
;
2032 sc
->ext
.client_cert_type
= TLSEXT_cert_type_x509
;
2036 if (!PACKET_as_length_prefixed_1(pkt
, &supported_cert_types
)) {
2037 sc
->ext
.client_cert_type_ctos
= OSSL_CERT_TYPE_CTOS_ERROR
;
2038 SSLfatal(sc
, SSL_AD_DECODE_ERROR
, SSL_R_BAD_EXTENSION
);
2041 if ((len
= PACKET_remaining(&supported_cert_types
)) == 0) {
2042 sc
->ext
.client_cert_type_ctos
= OSSL_CERT_TYPE_CTOS_ERROR
;
2043 SSLfatal(sc
, SSL_AD_DECODE_ERROR
, SSL_R_BAD_EXTENSION
);
2046 if (!PACKET_get_bytes(&supported_cert_types
, &data
, len
)) {
2047 sc
->ext
.client_cert_type_ctos
= OSSL_CERT_TYPE_CTOS_ERROR
;
2048 SSLfatal(sc
, SSL_AD_DECODE_ERROR
, SSL_R_BAD_EXTENSION
);
2051 /* client_cert_type: client (peer) has priority */
2052 sc
->ext
.client_cert_type_ctos
= reconcile_cert_type(data
, len
,
2053 sc
->client_cert_type
, sc
->client_cert_type_len
,
2054 &sc
->ext
.client_cert_type
);
2056 /* Ignore the error until sending - so we can check cert auth*/
2060 EXT_RETURN
tls_construct_stoc_server_cert_type(SSL_CONNECTION
*sc
, WPACKET
*pkt
,
2061 unsigned int context
,
2062 X509
*x
, size_t chainidx
)
2064 if (sc
->ext
.server_cert_type
== TLSEXT_cert_type_x509
) {
2065 sc
->ext
.server_cert_type_ctos
= OSSL_CERT_TYPE_CTOS_NONE
;
2066 return EXT_RETURN_NOT_SENT
;
2068 if (sc
->ext
.server_cert_type_ctos
!= OSSL_CERT_TYPE_CTOS_GOOD
2069 || sc
->server_cert_type
== NULL
) {
2070 /* if we don't send it, reset to TLSEXT_cert_type_x509 */
2071 sc
->ext
.server_cert_type_ctos
= OSSL_CERT_TYPE_CTOS_NONE
;
2072 sc
->ext
.server_cert_type
= TLSEXT_cert_type_x509
;
2073 return EXT_RETURN_NOT_SENT
;
2076 if (!WPACKET_put_bytes_u16(pkt
, TLSEXT_TYPE_server_cert_type
)
2077 || !WPACKET_start_sub_packet_u16(pkt
)
2078 || !WPACKET_put_bytes_u8(pkt
, sc
->ext
.server_cert_type
)
2079 || !WPACKET_close(pkt
)) {
2080 SSLfatal(sc
, SSL_AD_INTERNAL_ERROR
, ERR_R_INTERNAL_ERROR
);
2081 return EXT_RETURN_FAIL
;
2083 return EXT_RETURN_SENT
;
2086 int tls_parse_ctos_server_cert_type(SSL_CONNECTION
*sc
, PACKET
*pkt
,
2087 unsigned int context
,
2088 X509
*x
, size_t chainidx
)
2090 PACKET supported_cert_types
;
2091 const unsigned char *data
;
2094 /* Ignore the extension */
2095 if (sc
->server_cert_type
== NULL
) {
2096 sc
->ext
.server_cert_type_ctos
= OSSL_CERT_TYPE_CTOS_NONE
;
2097 sc
->ext
.server_cert_type
= TLSEXT_cert_type_x509
;
2101 if (!PACKET_as_length_prefixed_1(pkt
, &supported_cert_types
)) {
2102 SSLfatal(sc
, SSL_AD_DECODE_ERROR
, SSL_R_BAD_EXTENSION
);
2106 if ((len
= PACKET_remaining(&supported_cert_types
)) == 0) {
2107 SSLfatal(sc
, SSL_AD_DECODE_ERROR
, SSL_R_BAD_EXTENSION
);
2110 if (!PACKET_get_bytes(&supported_cert_types
, &data
, len
)) {
2111 SSLfatal(sc
, SSL_AD_DECODE_ERROR
, SSL_R_BAD_EXTENSION
);
2114 /* server_cert_type: server (this) has priority */
2115 sc
->ext
.server_cert_type_ctos
= reconcile_cert_type(sc
->server_cert_type
, sc
->server_cert_type_len
,
2117 &sc
->ext
.server_cert_type
);
2118 if (sc
->ext
.server_cert_type_ctos
== OSSL_CERT_TYPE_CTOS_GOOD
)
2121 /* Did not receive an acceptable cert type */
2122 SSLfatal(sc
, SSL_AD_UNSUPPORTED_CERTIFICATE
, SSL_R_BAD_EXTENSION
);