]>
Commit | Line | Data |
---|---|---|
846e33c7 | 1 | /* |
a28d06f3 | 2 | * Copyright 2014-2021 The OpenSSL Project Authors. All Rights Reserved. |
ecf4d660 | 3 | * |
2c18d164 | 4 | * Licensed under the Apache License 2.0 (the "License"). You may not use |
846e33c7 RS |
5 | * this file except in compliance with the License. You can obtain a copy |
6 | * in the file LICENSE in the source distribution or at | |
7 | * https://www.openssl.org/source/license.html | |
ecf4d660 DSH |
8 | */ |
9 | ||
10 | /* Custom extension utility functions */ | |
11 | ||
3c27208f | 12 | #include <openssl/ct.h> |
706457b7 | 13 | #include "../ssl_local.h" |
67dc995e | 14 | #include "internal/cryptlib.h" |
706457b7 | 15 | #include "statem_local.h" |
ecf4d660 | 16 | |
43ae5eed MC |
17 | typedef struct { |
18 | void *add_arg; | |
19 | custom_ext_add_cb add_cb; | |
20 | custom_ext_free_cb free_cb; | |
21 | } custom_ext_add_cb_wrap; | |
22 | ||
23 | typedef struct { | |
24 | void *parse_arg; | |
25 | custom_ext_parse_cb parse_cb; | |
26 | } custom_ext_parse_cb_wrap; | |
27 | ||
28 | /* | |
29 | * Provide thin wrapper callbacks which convert new style arguments to old style | |
30 | */ | |
31 | static int custom_ext_add_old_cb_wrap(SSL *s, unsigned int ext_type, | |
32 | unsigned int context, | |
33 | const unsigned char **out, | |
34 | size_t *outlen, X509 *x, size_t chainidx, | |
35 | int *al, void *add_arg) | |
36 | { | |
37 | custom_ext_add_cb_wrap *add_cb_wrap = (custom_ext_add_cb_wrap *)add_arg; | |
38 | ||
39 | if (add_cb_wrap->add_cb == NULL) | |
40 | return 1; | |
41 | ||
42 | return add_cb_wrap->add_cb(s, ext_type, out, outlen, al, | |
43 | add_cb_wrap->add_arg); | |
44 | } | |
45 | ||
46 | static void custom_ext_free_old_cb_wrap(SSL *s, unsigned int ext_type, | |
47 | unsigned int context, | |
48 | const unsigned char *out, void *add_arg) | |
49 | { | |
50 | custom_ext_add_cb_wrap *add_cb_wrap = (custom_ext_add_cb_wrap *)add_arg; | |
51 | ||
52 | if (add_cb_wrap->free_cb == NULL) | |
53 | return; | |
54 | ||
55 | add_cb_wrap->free_cb(s, ext_type, out, add_cb_wrap->add_arg); | |
56 | } | |
57 | ||
58 | static int custom_ext_parse_old_cb_wrap(SSL *s, unsigned int ext_type, | |
59 | unsigned int context, | |
60 | const unsigned char *in, | |
61 | size_t inlen, X509 *x, size_t chainidx, | |
62 | int *al, void *parse_arg) | |
63 | { | |
64 | custom_ext_parse_cb_wrap *parse_cb_wrap = | |
65 | (custom_ext_parse_cb_wrap *)parse_arg; | |
66 | ||
e596c68c GE |
67 | if (parse_cb_wrap->parse_cb == NULL) |
68 | return 1; | |
69 | ||
43ae5eed MC |
70 | return parse_cb_wrap->parse_cb(s, ext_type, in, inlen, al, |
71 | parse_cb_wrap->parse_arg); | |
72 | } | |
73 | ||
74 | /* | |
787d9ec7 | 75 | * Find a custom extension from the list. The |role| param is there to |
43ae5eed | 76 | * support the legacy API where custom extensions for client and server could |
787d9ec7 MC |
77 | * be set independently on the same SSL_CTX. It is set to ENDPOINT_SERVER if we |
78 | * are trying to find a method relevant to the server, ENDPOINT_CLIENT for the | |
79 | * client, or ENDPOINT_BOTH for either | |
43ae5eed | 80 | */ |
787d9ec7 MC |
81 | custom_ext_method *custom_ext_find(const custom_ext_methods *exts, |
82 | ENDPOINT role, unsigned int ext_type, | |
83 | size_t *idx) | |
0f113f3e MC |
84 | { |
85 | size_t i; | |
86 | custom_ext_method *meth = exts->meths; | |
64350ab5 | 87 | |
0f113f3e | 88 | for (i = 0; i < exts->meths_count; i++, meth++) { |
43ae5eed | 89 | if (ext_type == meth->ext_type |
787d9ec7 MC |
90 | && (role == ENDPOINT_BOTH || role == meth->role |
91 | || meth->role == ENDPOINT_BOTH)) { | |
43ae5eed MC |
92 | if (idx != NULL) |
93 | *idx = i; | |
0f113f3e | 94 | return meth; |
43ae5eed | 95 | } |
0f113f3e MC |
96 | } |
97 | return NULL; | |
98 | } | |
99 | ||
100 | /* | |
101 | * Initialise custom extensions flags to indicate neither sent nor received. | |
28ea0a0c DSH |
102 | */ |
103 | void custom_ext_init(custom_ext_methods *exts) | |
0f113f3e MC |
104 | { |
105 | size_t i; | |
106 | custom_ext_method *meth = exts->meths; | |
64350ab5 | 107 | |
0f113f3e MC |
108 | for (i = 0; i < exts->meths_count; i++, meth++) |
109 | meth->ext_flags = 0; | |
110 | } | |
ecf4d660 | 111 | |
0cfefe4b | 112 | /* Pass received custom extension data to the application for parsing. */ |
43ae5eed MC |
113 | int custom_ext_parse(SSL *s, unsigned int context, unsigned int ext_type, |
114 | const unsigned char *ext_data, size_t ext_size, X509 *x, | |
f63a17d6 | 115 | size_t chainidx) |
0f113f3e | 116 | { |
f63a17d6 | 117 | int al; |
43ae5eed | 118 | custom_ext_methods *exts = &s->cert->custext; |
0f113f3e | 119 | custom_ext_method *meth; |
787d9ec7 | 120 | ENDPOINT role = ENDPOINT_BOTH; |
43ae5eed MC |
121 | |
122 | if ((context & (SSL_EXT_CLIENT_HELLO | SSL_EXT_TLS1_2_SERVER_HELLO)) != 0) | |
787d9ec7 | 123 | role = s->server ? ENDPOINT_SERVER : ENDPOINT_CLIENT; |
43ae5eed | 124 | |
787d9ec7 | 125 | meth = custom_ext_find(exts, role, ext_type, NULL); |
0f113f3e MC |
126 | /* If not found return success */ |
127 | if (!meth) | |
128 | return 1; | |
43ae5eed MC |
129 | |
130 | /* Check if extension is defined for our protocol. If not, skip */ | |
131 | if (!extension_is_relevant(s, meth->context, context)) | |
132 | return 1; | |
133 | ||
134 | if ((context & (SSL_EXT_TLS1_2_SERVER_HELLO | |
135 | | SSL_EXT_TLS1_3_SERVER_HELLO | |
136 | | SSL_EXT_TLS1_3_ENCRYPTED_EXTENSIONS)) != 0) { | |
0f113f3e | 137 | /* |
43ae5eed MC |
138 | * If it's ServerHello or EncryptedExtensions we can't have any |
139 | * extensions not sent in ClientHello. | |
0f113f3e | 140 | */ |
43ae5eed | 141 | if ((meth->ext_flags & SSL_EXT_FLAG_SENT) == 0) { |
c48ffbcc | 142 | SSLfatal(s, TLS1_AD_UNSUPPORTED_EXTENSION, SSL_R_BAD_EXTENSION); |
0f113f3e MC |
143 | return 0; |
144 | } | |
145 | } | |
43ae5eed MC |
146 | |
147 | /* | |
148 | * Extensions received in the ClientHello are marked with the | |
149 | * SSL_EXT_FLAG_RECEIVED. This is so we know to add the equivalent | |
150 | * extensions in the ServerHello/EncryptedExtensions message | |
151 | */ | |
152 | if ((context & SSL_EXT_CLIENT_HELLO) != 0) | |
153 | meth->ext_flags |= SSL_EXT_FLAG_RECEIVED; | |
154 | ||
0f113f3e MC |
155 | /* If no parse function set return success */ |
156 | if (!meth->parse_cb) | |
157 | return 1; | |
ecf4d660 | 158 | |
f63a17d6 MC |
159 | if (meth->parse_cb(s, ext_type, context, ext_data, ext_size, x, chainidx, |
160 | &al, meth->parse_arg) <= 0) { | |
c48ffbcc | 161 | SSLfatal(s, al, SSL_R_BAD_EXTENSION); |
f63a17d6 MC |
162 | return 0; |
163 | } | |
164 | ||
165 | return 1; | |
0f113f3e | 166 | } |
ecf4d660 | 167 | |
2c7b4dbc MC |
168 | /* |
169 | * Request custom extension data from the application and add to the return | |
170 | * buffer. | |
171 | */ | |
43ae5eed | 172 | int custom_ext_add(SSL *s, int context, WPACKET *pkt, X509 *x, size_t chainidx, |
f63a17d6 | 173 | int maxversion) |
2c7b4dbc | 174 | { |
43ae5eed | 175 | custom_ext_methods *exts = &s->cert->custext; |
2c7b4dbc MC |
176 | custom_ext_method *meth; |
177 | size_t i; | |
f63a17d6 | 178 | int al; |
2c7b4dbc MC |
179 | |
180 | for (i = 0; i < exts->meths_count; i++) { | |
181 | const unsigned char *out = NULL; | |
182 | size_t outlen = 0; | |
2c7b4dbc MC |
183 | |
184 | meth = exts->meths + i; | |
185 | ||
43ae5eed MC |
186 | if (!should_add_extension(s, meth->context, context, maxversion)) |
187 | continue; | |
188 | ||
189 | if ((context & (SSL_EXT_TLS1_2_SERVER_HELLO | |
190 | | SSL_EXT_TLS1_3_SERVER_HELLO | |
7f533d6f MC |
191 | | SSL_EXT_TLS1_3_ENCRYPTED_EXTENSIONS |
192 | | SSL_EXT_TLS1_3_CERTIFICATE | |
193 | | SSL_EXT_TLS1_3_HELLO_RETRY_REQUEST)) != 0) { | |
194 | /* Only send extensions present in ClientHello. */ | |
2c7b4dbc MC |
195 | if (!(meth->ext_flags & SSL_EXT_FLAG_RECEIVED)) |
196 | continue; | |
2c7b4dbc | 197 | } |
43ae5eed MC |
198 | /* |
199 | * We skip it if the callback is absent - except for a ClientHello where | |
200 | * we add an empty extension. | |
201 | */ | |
202 | if ((context & SSL_EXT_CLIENT_HELLO) == 0 && meth->add_cb == NULL) | |
203 | continue; | |
204 | ||
205 | if (meth->add_cb != NULL) { | |
64350ab5 | 206 | int cb_retval = meth->add_cb(s, meth->ext_type, context, &out, |
f63a17d6 | 207 | &outlen, x, chainidx, &al, |
64350ab5 MC |
208 | meth->add_arg); |
209 | ||
f63a17d6 | 210 | if (cb_retval < 0) { |
c48ffbcc | 211 | SSLfatal(s, al, SSL_R_CALLBACK_FAILED); |
2c7b4dbc | 212 | return 0; /* error */ |
f63a17d6 | 213 | } |
2c7b4dbc MC |
214 | if (cb_retval == 0) |
215 | continue; /* skip this extension */ | |
216 | } | |
217 | ||
08029dfa | 218 | if (!WPACKET_put_bytes_u16(pkt, meth->ext_type) |
de451856 | 219 | || !WPACKET_start_sub_packet_u16(pkt) |
0217dd19 MC |
220 | || (outlen > 0 && !WPACKET_memcpy(pkt, out, outlen)) |
221 | || !WPACKET_close(pkt)) { | |
c48ffbcc | 222 | SSLfatal(s, SSL_AD_INTERNAL_ERROR, ERR_R_INTERNAL_ERROR); |
2c7b4dbc MC |
223 | return 0; |
224 | } | |
43ae5eed MC |
225 | if ((context & SSL_EXT_CLIENT_HELLO) != 0) { |
226 | /* | |
227 | * We can't send duplicates: code logic should prevent this. | |
228 | */ | |
b77f3ed1 | 229 | if (!ossl_assert((meth->ext_flags & SSL_EXT_FLAG_SENT) == 0)) { |
c48ffbcc | 230 | SSLfatal(s, SSL_AD_INTERNAL_ERROR, ERR_R_INTERNAL_ERROR); |
b77f3ed1 MC |
231 | return 0; |
232 | } | |
43ae5eed MC |
233 | /* |
234 | * Indicate extension has been sent: this is both a sanity check to | |
235 | * ensure we don't send duplicate extensions and indicates that it | |
236 | * is not an error if the extension is present in ServerHello. | |
237 | */ | |
238 | meth->ext_flags |= SSL_EXT_FLAG_SENT; | |
239 | } | |
64350ab5 | 240 | if (meth->free_cb != NULL) |
43ae5eed | 241 | meth->free_cb(s, meth->ext_type, context, out, meth->add_arg); |
2c7b4dbc MC |
242 | } |
243 | return 1; | |
244 | } | |
245 | ||
21181889 MC |
246 | /* Copy the flags from src to dst for any extensions that exist in both */ |
247 | int custom_exts_copy_flags(custom_ext_methods *dst, | |
248 | const custom_ext_methods *src) | |
249 | { | |
250 | size_t i; | |
251 | custom_ext_method *methsrc = src->meths; | |
252 | ||
253 | for (i = 0; i < src->meths_count; i++, methsrc++) { | |
254 | custom_ext_method *methdst = custom_ext_find(dst, methsrc->role, | |
255 | methsrc->ext_type, NULL); | |
256 | ||
257 | if (methdst == NULL) | |
258 | continue; | |
259 | ||
260 | methdst->ext_flags = methsrc->ext_flags; | |
261 | } | |
262 | ||
263 | return 1; | |
264 | } | |
265 | ||
ecf4d660 | 266 | /* Copy table of custom extensions */ |
ecf4d660 | 267 | int custom_exts_copy(custom_ext_methods *dst, const custom_ext_methods *src) |
0f113f3e | 268 | { |
43ae5eed MC |
269 | size_t i; |
270 | int err = 0; | |
271 | ||
272 | if (src->meths_count > 0) { | |
0f113f3e | 273 | dst->meths = |
7644a9ae | 274 | OPENSSL_memdup(src->meths, |
64350ab5 | 275 | sizeof(*src->meths) * src->meths_count); |
0f113f3e MC |
276 | if (dst->meths == NULL) |
277 | return 0; | |
278 | dst->meths_count = src->meths_count; | |
43ae5eed MC |
279 | |
280 | for (i = 0; i < src->meths_count; i++) { | |
281 | custom_ext_method *methsrc = src->meths + i; | |
282 | custom_ext_method *methdst = dst->meths + i; | |
283 | ||
284 | if (methsrc->add_cb != custom_ext_add_old_cb_wrap) | |
285 | continue; | |
286 | ||
287 | /* | |
288 | * We have found an old style API wrapper. We need to copy the | |
289 | * arguments too. | |
290 | */ | |
291 | ||
292 | if (err) { | |
293 | methdst->add_arg = NULL; | |
294 | methdst->parse_arg = NULL; | |
295 | continue; | |
296 | } | |
297 | ||
298 | methdst->add_arg = OPENSSL_memdup(methsrc->add_arg, | |
299 | sizeof(custom_ext_add_cb_wrap)); | |
300 | methdst->parse_arg = OPENSSL_memdup(methsrc->parse_arg, | |
301 | sizeof(custom_ext_parse_cb_wrap)); | |
302 | ||
303 | if (methdst->add_arg == NULL || methdst->parse_arg == NULL) | |
304 | err = 1; | |
305 | } | |
306 | } | |
307 | ||
308 | if (err) { | |
309 | custom_exts_free(dst); | |
310 | return 0; | |
0f113f3e | 311 | } |
43ae5eed | 312 | |
0f113f3e MC |
313 | return 1; |
314 | } | |
ecf4d660 DSH |
315 | |
316 | void custom_exts_free(custom_ext_methods *exts) | |
0f113f3e | 317 | { |
43ae5eed | 318 | size_t i; |
64350ab5 | 319 | custom_ext_method *meth; |
43ae5eed | 320 | |
64350ab5 | 321 | for (i = 0, meth = exts->meths; i < exts->meths_count; i++, meth++) { |
43ae5eed MC |
322 | if (meth->add_cb != custom_ext_add_old_cb_wrap) |
323 | continue; | |
324 | ||
325 | /* Old style API wrapper. Need to free the arguments too */ | |
326 | OPENSSL_free(meth->add_arg); | |
327 | OPENSSL_free(meth->parse_arg); | |
328 | } | |
b548a1f1 | 329 | OPENSSL_free(exts->meths); |
0f113f3e | 330 | } |
ecf4d660 | 331 | |
43ae5eed MC |
332 | /* Return true if a client custom extension exists, false otherwise */ |
333 | int SSL_CTX_has_client_custom_ext(const SSL_CTX *ctx, unsigned int ext_type) | |
0f113f3e | 334 | { |
787d9ec7 MC |
335 | return custom_ext_find(&ctx->cert->custext, ENDPOINT_CLIENT, ext_type, |
336 | NULL) != NULL; | |
43ae5eed MC |
337 | } |
338 | ||
787d9ec7 | 339 | static int add_custom_ext_intern(SSL_CTX *ctx, ENDPOINT role, |
43ae5eed MC |
340 | unsigned int ext_type, |
341 | unsigned int context, | |
cd17bb19 MC |
342 | SSL_custom_ext_add_cb_ex add_cb, |
343 | SSL_custom_ext_free_cb_ex free_cb, | |
43ae5eed | 344 | void *add_arg, |
cd17bb19 | 345 | SSL_custom_ext_parse_cb_ex parse_cb, |
43ae5eed MC |
346 | void *parse_arg) |
347 | { | |
348 | custom_ext_methods *exts = &ctx->cert->custext; | |
7c0ef843 | 349 | custom_ext_method *meth, *tmp; |
43ae5eed | 350 | |
0f113f3e MC |
351 | /* |
352 | * Check application error: if add_cb is not set free_cb will never be | |
353 | * called. | |
354 | */ | |
64350ab5 | 355 | if (add_cb == NULL && free_cb != NULL) |
0f113f3e | 356 | return 0; |
43ae5eed MC |
357 | |
358 | #ifndef OPENSSL_NO_CT | |
359 | /* | |
360 | * We don't want applications registering callbacks for SCT extensions | |
361 | * whilst simultaneously using the built-in SCT validation features, as | |
362 | * these two things may not play well together. | |
363 | */ | |
364 | if (ext_type == TLSEXT_TYPE_signed_certificate_timestamp | |
365 | && (context & SSL_EXT_CLIENT_HELLO) != 0 | |
366 | && SSL_CTX_ct_is_enabled(ctx)) | |
367 | return 0; | |
368 | #endif | |
369 | ||
ed29e82a RP |
370 | /* |
371 | * Don't add if extension supported internally, but make exception | |
372 | * for extension types that previously were not supported, but now are. | |
373 | */ | |
43ae5eed MC |
374 | if (SSL_extension_supported(ext_type) |
375 | && ext_type != TLSEXT_TYPE_signed_certificate_timestamp) | |
0f113f3e | 376 | return 0; |
43ae5eed | 377 | |
0f113f3e MC |
378 | /* Extension type must fit in 16 bits */ |
379 | if (ext_type > 0xffff) | |
380 | return 0; | |
381 | /* Search for duplicate */ | |
787d9ec7 | 382 | if (custom_ext_find(exts, role, ext_type, NULL)) |
0f113f3e | 383 | return 0; |
7c0ef843 DSH |
384 | tmp = OPENSSL_realloc(exts->meths, |
385 | (exts->meths_count + 1) * sizeof(custom_ext_method)); | |
ed874fac | 386 | if (tmp == NULL) |
0f113f3e | 387 | return 0; |
ecf4d660 | 388 | |
7c0ef843 | 389 | exts->meths = tmp; |
0f113f3e | 390 | meth = exts->meths + exts->meths_count; |
16f8d4eb | 391 | memset(meth, 0, sizeof(*meth)); |
787d9ec7 | 392 | meth->role = role; |
43ae5eed | 393 | meth->context = context; |
0f113f3e MC |
394 | meth->parse_cb = parse_cb; |
395 | meth->add_cb = add_cb; | |
396 | meth->free_cb = free_cb; | |
397 | meth->ext_type = ext_type; | |
398 | meth->add_arg = add_arg; | |
399 | meth->parse_arg = parse_arg; | |
400 | exts->meths_count++; | |
401 | return 1; | |
402 | } | |
ecf4d660 | 403 | |
787d9ec7 MC |
404 | static int add_old_custom_ext(SSL_CTX *ctx, ENDPOINT role, |
405 | unsigned int ext_type, | |
43ae5eed MC |
406 | unsigned int context, |
407 | custom_ext_add_cb add_cb, | |
408 | custom_ext_free_cb free_cb, | |
409 | void *add_arg, | |
410 | custom_ext_parse_cb parse_cb, void *parse_arg) | |
ed29e82a | 411 | { |
43ae5eed | 412 | custom_ext_add_cb_wrap *add_cb_wrap |
64350ab5 | 413 | = OPENSSL_malloc(sizeof(*add_cb_wrap)); |
43ae5eed | 414 | custom_ext_parse_cb_wrap *parse_cb_wrap |
64350ab5 | 415 | = OPENSSL_malloc(sizeof(*parse_cb_wrap)); |
43ae5eed MC |
416 | int ret; |
417 | ||
418 | if (add_cb_wrap == NULL || parse_cb_wrap == NULL) { | |
419 | OPENSSL_free(add_cb_wrap); | |
420 | OPENSSL_free(parse_cb_wrap); | |
421 | return 0; | |
422 | } | |
423 | ||
424 | add_cb_wrap->add_arg = add_arg; | |
425 | add_cb_wrap->add_cb = add_cb; | |
426 | add_cb_wrap->free_cb = free_cb; | |
427 | parse_cb_wrap->parse_arg = parse_arg; | |
428 | parse_cb_wrap->parse_cb = parse_cb; | |
429 | ||
787d9ec7 | 430 | ret = add_custom_ext_intern(ctx, role, ext_type, |
43ae5eed MC |
431 | context, |
432 | custom_ext_add_old_cb_wrap, | |
433 | custom_ext_free_old_cb_wrap, | |
434 | add_cb_wrap, | |
435 | custom_ext_parse_old_cb_wrap, | |
436 | parse_cb_wrap); | |
437 | ||
438 | if (!ret) { | |
439 | OPENSSL_free(add_cb_wrap); | |
440 | OPENSSL_free(parse_cb_wrap); | |
441 | } | |
442 | ||
443 | return ret; | |
ed29e82a RP |
444 | } |
445 | ||
43ae5eed | 446 | /* Application level functions to add the old custom extension callbacks */ |
8cafe9e8 | 447 | int SSL_CTX_add_client_custom_ext(SSL_CTX *ctx, unsigned int ext_type, |
0f113f3e MC |
448 | custom_ext_add_cb add_cb, |
449 | custom_ext_free_cb free_cb, | |
0cfefe4b | 450 | void *add_arg, |
a230b26e | 451 | custom_ext_parse_cb parse_cb, void *parse_arg) |
0f113f3e | 452 | { |
787d9ec7 | 453 | return add_old_custom_ext(ctx, ENDPOINT_CLIENT, ext_type, |
43ae5eed MC |
454 | SSL_EXT_TLS1_2_AND_BELOW_ONLY |
455 | | SSL_EXT_CLIENT_HELLO | |
456 | | SSL_EXT_TLS1_2_SERVER_HELLO | |
457 | | SSL_EXT_IGNORE_ON_RESUMPTION, | |
458 | add_cb, free_cb, add_arg, parse_cb, parse_arg); | |
0f113f3e | 459 | } |
ecf4d660 | 460 | |
8cafe9e8 | 461 | int SSL_CTX_add_server_custom_ext(SSL_CTX *ctx, unsigned int ext_type, |
0f113f3e MC |
462 | custom_ext_add_cb add_cb, |
463 | custom_ext_free_cb free_cb, | |
0cfefe4b | 464 | void *add_arg, |
a230b26e | 465 | custom_ext_parse_cb parse_cb, void *parse_arg) |
0f113f3e | 466 | { |
787d9ec7 | 467 | return add_old_custom_ext(ctx, ENDPOINT_SERVER, ext_type, |
43ae5eed MC |
468 | SSL_EXT_TLS1_2_AND_BELOW_ONLY |
469 | | SSL_EXT_CLIENT_HELLO | |
470 | | SSL_EXT_TLS1_2_SERVER_HELLO | |
471 | | SSL_EXT_IGNORE_ON_RESUMPTION, | |
472 | add_cb, free_cb, add_arg, parse_cb, parse_arg); | |
473 | } | |
474 | ||
475 | int SSL_CTX_add_custom_ext(SSL_CTX *ctx, unsigned int ext_type, | |
476 | unsigned int context, | |
cd17bb19 MC |
477 | SSL_custom_ext_add_cb_ex add_cb, |
478 | SSL_custom_ext_free_cb_ex free_cb, | |
43ae5eed | 479 | void *add_arg, |
cd17bb19 | 480 | SSL_custom_ext_parse_cb_ex parse_cb, void *parse_arg) |
43ae5eed | 481 | { |
787d9ec7 MC |
482 | return add_custom_ext_intern(ctx, ENDPOINT_BOTH, ext_type, context, add_cb, |
483 | free_cb, add_arg, parse_cb, parse_arg); | |
0f113f3e | 484 | } |
c846a5f5 DSH |
485 | |
486 | int SSL_extension_supported(unsigned int ext_type) | |
0f113f3e MC |
487 | { |
488 | switch (ext_type) { | |
489 | /* Internally supported extensions. */ | |
490 | case TLSEXT_TYPE_application_layer_protocol_negotiation: | |
491 | case TLSEXT_TYPE_ec_point_formats: | |
de4d764e | 492 | case TLSEXT_TYPE_supported_groups: |
36abb6a2 | 493 | case TLSEXT_TYPE_key_share: |
1595ca02 | 494 | #ifndef OPENSSL_NO_NEXTPROTONEG |
0f113f3e | 495 | case TLSEXT_TYPE_next_proto_neg: |
1595ca02 | 496 | #endif |
0f113f3e MC |
497 | case TLSEXT_TYPE_padding: |
498 | case TLSEXT_TYPE_renegotiate: | |
cf72c757 | 499 | case TLSEXT_TYPE_max_fragment_length: |
0f113f3e MC |
500 | case TLSEXT_TYPE_server_name: |
501 | case TLSEXT_TYPE_session_ticket: | |
502 | case TLSEXT_TYPE_signature_algorithms: | |
36abb6a2 | 503 | #ifndef OPENSSL_NO_SRP |
0f113f3e | 504 | case TLSEXT_TYPE_srp: |
36abb6a2 MC |
505 | #endif |
506 | #ifndef OPENSSL_NO_OCSP | |
0f113f3e | 507 | case TLSEXT_TYPE_status_request: |
36abb6a2 MC |
508 | #endif |
509 | #ifndef OPENSSL_NO_CT | |
ed29e82a | 510 | case TLSEXT_TYPE_signed_certificate_timestamp: |
36abb6a2 MC |
511 | #endif |
512 | #ifndef OPENSSL_NO_SRTP | |
0f113f3e | 513 | case TLSEXT_TYPE_use_srtp: |
e481f9b9 | 514 | #endif |
36abb6a2 | 515 | case TLSEXT_TYPE_encrypt_then_mac: |
91b60e2a MC |
516 | case TLSEXT_TYPE_supported_versions: |
517 | case TLSEXT_TYPE_extended_master_secret: | |
36abb6a2 MC |
518 | case TLSEXT_TYPE_psk_kex_modes: |
519 | case TLSEXT_TYPE_cookie: | |
520 | case TLSEXT_TYPE_early_data: | |
521 | case TLSEXT_TYPE_certificate_authorities: | |
522 | case TLSEXT_TYPE_psk: | |
9d75dce3 | 523 | case TLSEXT_TYPE_post_handshake_auth: |
0f113f3e MC |
524 | return 1; |
525 | default: | |
526 | return 0; | |
527 | } | |
528 | } |