ssl/statem/extensions.c

   1 /*
   2  * Copyright 2016 The OpenSSL Project Authors. All Rights Reserved.
   3  *
   4  * Licensed under the OpenSSL license (the "License").  You may not use
   5  * this file except in compliance with the License.  You can obtain a copy
   6  * in the file LICENSE in the source distribution or at
   7  * https://www.openssl.org/source/license.html
   8  */
   9
  10 #include "../ssl_locl.h"
  11 #include "statem_locl.h"
  12
  13 static int final_renegotiate(SSL *s, unsigned int context, int sent,
  14                                      int *al);
  15 static int init_server_name(SSL *s, unsigned int context);
  16 static int final_server_name(SSL *s, unsigned int context, int sent,
  17                                      int *al);
  18 #ifndef OPENSSL_NO_EC
  19 static int final_ec_pt_formats(SSL *s, unsigned int context, int sent,
  20                                        int *al);
  21 #endif
  22 static int init_session_ticket(SSL *s, unsigned int context);
  23 static int init_status_request(SSL *s, unsigned int context);
  24 static int final_status_request(SSL *s, unsigned int context, int sent,
  25                                         int *al);
  26 #ifndef OPENSSL_NO_NEXTPROTONEG
  27 static int init_npn(SSL *s, unsigned int context);
  28 #endif
  29 static int init_alpn(SSL *s, unsigned int context);
  30 static int final_alpn(SSL *s, unsigned int context, int sent, int *al);
  31 static int init_sig_algs(SSL *s, unsigned int context);
  32 #ifndef OPENSSL_NO_SRP
  33 static int init_srp(SSL *s, unsigned int context);
  34 #endif
  35 static int init_etm(SSL *s, unsigned int context);
  36 static int init_ems(SSL *s, unsigned int context);
  37 static int final_ems(SSL *s, unsigned int context, int sent, int *al);
  38 #ifndef OPENSSL_NO_SRTP
  39 static int init_srtp(SSL *s, unsigned int context);
  40 #endif
  41
  42 /* Structure to define a built-in extension */
  43 typedef struct extensions_definition_st {
  44     /* The defined type for the extension */
  45     unsigned int type;
  46     /*
  47      * The context that this extension applies to, e.g. what messages and
  48      * protocol versions
  49      */
  50     unsigned int context;
  51     /*
  52      * Initialise extension before parsing. Always called for relevant contexts
  53      * even if extension not present
  54      */
  55     int (*init)(SSL *s, unsigned int context);
  56     /* Parse extension sent from client to server */
  57     int (*parse_ctos)(SSL *s, PACKET *pkt, int *al);
  58     /* Parse extension send from server to client */
  59     int (*parse_stoc)(SSL *s, PACKET *pkt, int *al);
  60     /* Construct extension sent from server to client */
  61     int (*construct_stoc)(SSL *s, WPACKET *pkt, int *al);
  62     /* Construct extension sent from client to server */
  63     int (*construct_ctos)(SSL *s, WPACKET *pkt, int *al);
  64     /*
  65      * Finalise extension after parsing. Always called where an extensions was
  66      * initialised even if the extension was not present. |sent| is set to 1 if
  67      * the extension was seen, or 0 otherwise.
  68      */
  69     int (*final)(SSL *s, unsigned int context, int sent, int *al);
  70 } EXTENSION_DEFINITION;
  71
  72 /*
  73  * Definitions of all built-in extensions. NOTE: Changes in the number or order
  74  * of these extensions should be mirrored with equivalent changes to the indexes
  75  * defined in statem_locl.h.
  76  * Each extension has an initialiser, a client and
  77  * server side parser and a finaliser. The initialiser is called (if the
  78  * extension is relevant to the given context) even if we did not see the
  79  * extension in the message that we received. The parser functions are only
  80  * called if we see the extension in the message. The finalisers are always
  81  * called if the initialiser was called.
  82  * There are also server and client side constructor functions which are always
  83  * called during message construction if the extension is relevant for the
  84  * given context.
  85  * The initialisation, parsing, finalisation and construction functions are
  86  * always called in the order defined in this list. Some extensions may depend
  87  * on others having been processed first, so the order of this list is
  88  * significant.
  89  * The extension context is defined by a series of flags which specify which
  90  * messages the extension is relevant to. These flags also specify whether the
  91  * extension is relevant to a paricular protocol or protocol version.
  92  *
  93  * TODO(TLS1.3): Make sure we have a test to check the consistency of these
  94  */
  95 static const EXTENSION_DEFINITION ext_defs[] = {
  96     {
  97         TLSEXT_TYPE_renegotiate,
  98         EXT_CLIENT_HELLO | EXT_TLS1_2_SERVER_HELLO | EXT_SSL3_ALLOWED
  99         | EXT_TLS1_2_AND_BELOW_ONLY,
 100         NULL, tls_parse_ctos_renegotiate, tls_parse_stoc_renegotiate,
 101         tls_construct_stoc_renegotiate, tls_construct_ctos_renegotiate,
 102         final_renegotiate
 103     },
 104     {
 105         TLSEXT_TYPE_server_name,
 106         EXT_CLIENT_HELLO | EXT_TLS1_2_SERVER_HELLO
 107         | EXT_TLS1_3_ENCRYPTED_EXTENSIONS,
 108         init_server_name,
 109         tls_parse_ctos_server_name, tls_parse_stoc_server_name,
 110         tls_construct_stoc_server_name, tls_construct_ctos_server_name,
 111         final_server_name
 112     },
 113 #ifndef OPENSSL_NO_SRP
 114     {
 115         TLSEXT_TYPE_srp,
 116         EXT_CLIENT_HELLO | EXT_TLS1_2_AND_BELOW_ONLY,
 117         init_srp, tls_parse_ctos_srp, NULL, NULL, tls_construct_ctos_srp, NULL
 118     },
 119 #endif
 120 #ifndef OPENSSL_NO_EC
 121     {
 122         TLSEXT_TYPE_ec_point_formats,
 123         EXT_CLIENT_HELLO | EXT_TLS1_2_AND_BELOW_ONLY,
 124         NULL, tls_parse_ctos_ec_pt_formats, tls_parse_stoc_ec_pt_formats,
 125         tls_construct_stoc_ec_pt_formats, tls_construct_ctos_ec_pt_formats,
 126         final_ec_pt_formats
 127     },
 128     {
 129         TLSEXT_TYPE_supported_groups,
 130         EXT_CLIENT_HELLO | EXT_TLS1_3_ENCRYPTED_EXTENSIONS,
 131         NULL, tls_parse_ctos_supported_groups, NULL,
 132         NULL /* TODO(TLS1.3): Need to add this */,
 133         tls_construct_ctos_supported_groups, NULL
 134     },
 135 #endif
 136     {
 137         TLSEXT_TYPE_session_ticket,
 138         EXT_CLIENT_HELLO | EXT_TLS1_2_SERVER_HELLO | EXT_TLS1_2_AND_BELOW_ONLY,
 139         init_session_ticket, tls_parse_ctos_session_ticket,
 140         tls_parse_stoc_session_ticket, tls_construct_stoc_session_ticket,
 141         tls_construct_ctos_session_ticket, NULL
 142     },
 143     {
 144         TLSEXT_TYPE_signature_algorithms,
 145         EXT_CLIENT_HELLO,
 146         init_sig_algs, tls_parse_ctos_sig_algs, NULL, NULL,
 147         tls_construct_ctos_sig_algs, NULL
 148     },
 149 #ifndef OPENSSL_NO_OCSP
 150     {
 151         TLSEXT_TYPE_status_request,
 152         EXT_CLIENT_HELLO | EXT_TLS1_2_SERVER_HELLO
 153         | EXT_TLS1_3_CERTIFICATE,
 154         init_status_request, tls_parse_ctos_status_request,
 155         tls_parse_stoc_status_request, tls_construct_stoc_status_request,
 156         tls_construct_ctos_status_request, final_status_request
 157     },
 158 #endif
 159 #ifndef OPENSSL_NO_NEXTPROTONEG
 160     {
 161         TLSEXT_TYPE_next_proto_neg,
 162         EXT_CLIENT_HELLO | EXT_TLS1_2_SERVER_HELLO | EXT_TLS1_2_AND_BELOW_ONLY,
 163         init_npn, tls_parse_ctos_npn, tls_parse_stoc_npn,
 164         tls_construct_stoc_next_proto_neg, tls_construct_ctos_npn, NULL
 165     },
 166 #endif
 167     {
 168         /*
 169          * Must appear in this list after server_name so that finalisation
 170          * happens after server_name callbacks
 171          */
 172         TLSEXT_TYPE_application_layer_protocol_negotiation,
 173         EXT_CLIENT_HELLO | EXT_TLS1_2_SERVER_HELLO
 174         | EXT_TLS1_3_ENCRYPTED_EXTENSIONS,
 175         init_alpn, tls_parse_ctos_alpn, tls_parse_stoc_alpn,
 176         tls_construct_stoc_alpn, tls_construct_ctos_alpn, final_alpn
 177     },
 178 #ifndef OPENSSL_NO_SRTP
 179     {
 180         TLSEXT_TYPE_use_srtp,
 181         EXT_CLIENT_HELLO | EXT_TLS1_2_SERVER_HELLO
 182         | EXT_TLS1_3_ENCRYPTED_EXTENSIONS | EXT_DTLS_ONLY,
 183         init_srtp, tls_parse_ctos_use_srtp, tls_parse_stoc_use_srtp,
 184         tls_construct_stoc_use_srtp, tls_construct_ctos_use_srtp, NULL
 185     },
 186 #endif
 187     {
 188         TLSEXT_TYPE_encrypt_then_mac,
 189         EXT_CLIENT_HELLO | EXT_TLS1_2_SERVER_HELLO | EXT_TLS1_2_AND_BELOW_ONLY,
 190         init_etm, tls_parse_ctos_etm, tls_parse_stoc_etm,
 191         tls_construct_stoc_etm, tls_construct_ctos_etm, NULL
 192     },
 193 #ifndef OPENSSL_NO_CT
 194     {
 195         TLSEXT_TYPE_signed_certificate_timestamp,
 196         EXT_CLIENT_HELLO | EXT_TLS1_2_SERVER_HELLO
 197         | EXT_TLS1_3_CERTIFICATE,
 198         NULL,
 199         /*
 200          * No server side support for this, but can be provided by a custom
 201          * extension. This is an exception to the rule that custom extensions
 202          * cannot override built in ones.
 203          */
 204         NULL, tls_parse_stoc_sct, NULL, tls_construct_ctos_sct,  NULL
 205     },
 206 #endif
 207     {
 208         TLSEXT_TYPE_extended_master_secret,
 209         EXT_CLIENT_HELLO | EXT_TLS1_2_SERVER_HELLO | EXT_TLS1_2_AND_BELOW_ONLY,
 210         init_ems, tls_parse_ctos_ems, tls_parse_stoc_ems,
 211         tls_construct_stoc_ems, tls_construct_ctos_ems, final_ems
 212     },
 213     {
 214         TLSEXT_TYPE_supported_versions,
 215         EXT_CLIENT_HELLO | EXT_TLS_IMPLEMENTATION_ONLY | EXT_TLS1_3_ONLY,
 216         NULL,
 217         /* Processed inline as part of version selection */
 218         NULL, NULL, NULL, tls_construct_ctos_supported_versions, NULL
 219     },
 220     {
 221         /*
 222          * Must be in this list after supported_groups. We need that to have
 223          * been parsed before we do this one.
 224          */
 225         TLSEXT_TYPE_key_share,
 226         EXT_CLIENT_HELLO | EXT_TLS1_3_SERVER_HELLO
 227         | EXT_TLS1_3_HELLO_RETRY_REQUEST | EXT_TLS_IMPLEMENTATION_ONLY
 228         | EXT_TLS1_3_ONLY,
 229         NULL, tls_parse_ctos_key_share, tls_parse_stoc_key_share,
 230         tls_construct_stoc_key_share, tls_construct_ctos_key_share, NULL
 231     },
 232     {
 233         /*
 234          * Special unsolicited ServerHello extension only used when
 235          * SSL_OP_CRYPTOPRO_TLSEXT_BUG is set
 236          */
 237         TLSEXT_TYPE_cryptopro_bug,
 238         EXT_TLS1_2_SERVER_HELLO | EXT_TLS1_2_AND_BELOW_ONLY,
 239         NULL, NULL, NULL, tls_construct_stoc_cryptopro_bug, NULL, NULL
 240     },
 241     {
 242         /* Last in the list because it must be added as the last extension */
 243         TLSEXT_TYPE_padding,
 244         EXT_CLIENT_HELLO,
 245         NULL,
 246         /* We send this, but don't read it */
 247         NULL, NULL, NULL, tls_construct_ctos_padding, NULL
 248     }
 249 };
 250
 251 /*
 252  * Verify whether we are allowed to use the extension |type| in the current
 253  * |context|. Returns 1 to indicate the extension is allowed or unknown or 0 to
 254  * indicate the extension is not allowed. If returning 1 then |*found| is set to
 255  * 1 if we found a definition for the extension, and |*idx| is set to its index
 256  */
 257 static int verify_extension(SSL *s, unsigned int context, unsigned int type,
 258                             custom_ext_methods *meths, RAW_EXTENSION *rawexlist,
 259                             RAW_EXTENSION **found)
 260 {
 261     size_t i;
 262     size_t builtin_num = OSSL_NELEM(ext_defs);
 263     const EXTENSION_DEFINITION *thisext;
 264
 265     for (i = 0, thisext = ext_defs; i < builtin_num; i++, thisext++) {
 266         if (type == thisext->type) {
 267             /* Check we're allowed to use this extension in this context */
 268             if ((context & thisext->context) == 0)
 269                 return 0;
 270
 271             if (SSL_IS_DTLS(s)) {
 272                 if ((thisext->context & EXT_TLS_ONLY) != 0)
 273                     return 0;
 274             } else if ((thisext->context & EXT_DTLS_ONLY) != 0) {
 275                     return 0;
 276             }
 277
 278             *found = &rawexlist[i];
 279             return 1;
 280         }
 281     }
 282
 283     if ((context & (EXT_CLIENT_HELLO | EXT_TLS1_2_SERVER_HELLO)) == 0) {
 284         /*
 285          * Custom extensions only apply to <=TLS1.2. This extension is unknown
 286          * in this context - we allow it
 287          */
 288         *found = NULL;
 289         return 1;
 290     }
 291
 292     /* Check the custom extensions */
 293     if (meths != NULL) {
 294         for (i = builtin_num; i < builtin_num + meths->meths_count; i++) {
 295             if (meths->meths[i - builtin_num].ext_type == type) {
 296                 *found = &rawexlist[i];
 297                 return 1;
 298             }
 299         }
 300     }
 301
 302     /* Unknown extension. We allow it */
 303     *found = NULL;
 304     return 1;
 305 }
 306
 307 /*
 308  * Check whether the context defined for an extension |extctx| means whether
 309  * the extension is relevant for the current context |thisctx| or not. Returns
 310  * 1 if the extension is relevant for this context, and 0 otherwise
 311  */
 312 static int extension_is_relevant(SSL *s, unsigned int extctx,
 313                                  unsigned int thisctx)
 314 {
 315     if ((SSL_IS_DTLS(s)
 316                 && (extctx & EXT_TLS_IMPLEMENTATION_ONLY) != 0)
 317             || (s->version == SSL3_VERSION
 318                     && (extctx & EXT_SSL3_ALLOWED) == 0)
 319             || (SSL_IS_TLS13(s)
 320                 && (extctx & EXT_TLS1_2_AND_BELOW_ONLY) != 0)
 321             || (!SSL_IS_TLS13(s) && (extctx & EXT_TLS1_3_ONLY) != 0))
 322         return 0;
 323
 324     return 1;
 325 }
 326
 327 /*
 328  * Gather a list of all the extensions from the data in |packet]. |context|
 329  * tells us which message this extension is for. The raw extension data is
 330  * stored in |*res| on success. In the event of an error the alert type to use
 331  * is stored in |*al|. We don't actually process the content of the extensions
 332  * yet, except to check their types. This function also runs the initialiser
 333  * functions for all known extensions (whether we have collected them or not).
 334  * If successful the caller is responsible for freeing the contents of |*res|.
 335  *
 336  * Per http://tools.ietf.org/html/rfc5246#section-7.4.1.4, there may not be
 337  * more than one extension of the same type in a ClientHello or ServerHello.
 338  * This function returns 1 if all extensions are unique and we have parsed their
 339  * types, and 0 if the extensions contain duplicates, could not be successfully
 340  * found, or an internal error occurred. We only check duplicates for
 341  * extensions that we know about. We ignore others.
 342  */
 343 int tls_collect_extensions(SSL *s, PACKET *packet, unsigned int context,
 344                            RAW_EXTENSION **res, int *al)
 345 {
 346     PACKET extensions = *packet;
 347     size_t i = 0;
 348     custom_ext_methods *exts = NULL;
 349     RAW_EXTENSION *raw_extensions = NULL;
 350     const EXTENSION_DEFINITION *thisexd;
 351
 352     *res = NULL;
 353
 354     /*
 355      * Initialise server side custom extensions. Client side is done during
 356      * construction of extensions for the ClientHello.
 357      */
 358     if ((context & EXT_CLIENT_HELLO) != 0) {
 359         exts = &s->cert->srv_ext;
 360         custom_ext_init(&s->cert->srv_ext);
 361     } else if ((context & EXT_TLS1_2_SERVER_HELLO) != 0) {
 362         exts = &s->cert->cli_ext;
 363     }
 364
 365     raw_extensions = OPENSSL_zalloc((OSSL_NELEM(ext_defs)
 366                                      + (exts != NULL ? exts->meths_count : 0))
 367                                      * sizeof(*raw_extensions));
 368     if (raw_extensions == NULL) {
 369         *al = SSL_AD_INTERNAL_ERROR;
 370         SSLerr(SSL_F_TLS_COLLECT_EXTENSIONS, ERR_R_MALLOC_FAILURE);
 371         return 0;
 372     }
 373
 374     while (PACKET_remaining(&extensions) > 0) {
 375         unsigned int type;
 376         PACKET extension;
 377         RAW_EXTENSION *thisex;
 378
 379         if (!PACKET_get_net_2(&extensions, &type) ||
 380             !PACKET_get_length_prefixed_2(&extensions, &extension)) {
 381             SSLerr(SSL_F_TLS_COLLECT_EXTENSIONS, SSL_R_BAD_EXTENSION);
 382             *al = SSL_AD_DECODE_ERROR;
 383             goto err;
 384         }
 385         /*
 386          * Verify this extension is allowed. We only check duplicates for
 387          * extensions that we recognise.
 388          */
 389         if (!verify_extension(s, context, type, exts, raw_extensions, &thisex)
 390                 || (thisex != NULL && thisex->present == 1)) {
 391             SSLerr(SSL_F_TLS_COLLECT_EXTENSIONS, SSL_R_BAD_EXTENSION);
 392             *al = SSL_AD_ILLEGAL_PARAMETER;
 393             goto err;
 394         }
 395         if (thisex != NULL) {
 396             thisex->data = extension;
 397             thisex->present = 1;
 398             thisex->type = type;
 399         }
 400     }
 401
 402     /*
 403      * Initialise all known extensions relevant to this context, whether we have
 404      * found them or not
 405      */
 406     for (thisexd = ext_defs, i = 0; i < OSSL_NELEM(ext_defs); i++, thisexd++) {
 407         if(thisexd->init != NULL && (thisexd->context & context) != 0
 408                 && extension_is_relevant(s, thisexd->context, context)
 409                 && !thisexd->init(s, context)) {
 410             *al = SSL_AD_INTERNAL_ERROR;
 411             goto err;
 412         }
 413     }
 414
 415     *res = raw_extensions;
 416     return 1;
 417
 418  err:
 419     OPENSSL_free(raw_extensions);
 420     return 0;
 421 }
 422
 423 /*
 424  * Runs the parser for a given extension with index |idx|. |exts| contains the
 425  * list of all parsed extensions previously collected by
 426  * tls_collect_extensions(). The parser is only run if it is applicable for the
 427  * given |context| and the parser has not already been run. Returns 1 on success
 428  * or 0 on failure. In the event of a failure |*al| is populated with a suitable
 429  * alert code. If an extension is not present this counted as success.
 430  */
 431 int tls_parse_extension(SSL *s, TLSEXT_INDEX idx, int context,
 432                         RAW_EXTENSION *exts, int *al)
 433 {
 434     RAW_EXTENSION *currext = &exts[idx];
 435     int (*parser)(SSL *s, PACKET *pkt, int *al) = NULL;
 436
 437     /* Skip if the extension is not present */
 438     if (!currext->present)
 439         return 1;
 440
 441     if (s->tlsext_debug_cb)
 442         s->tlsext_debug_cb(s, !s->server, currext->type,
 443                            PACKET_data(&currext->data),
 444                            PACKET_remaining(&currext->data),
 445                            s->tlsext_debug_arg);
 446
 447     /* Skip if we've already parsed this extension */
 448     if (currext->parsed)
 449         return 1;
 450
 451     currext->parsed = 1;
 452
 453     if (idx < OSSL_NELEM(ext_defs)) {
 454         /* We are handling a built-in extension */
 455         const EXTENSION_DEFINITION *extdef = &ext_defs[idx];
 456
 457         /* Check if extension is defined for our protocol. If not, skip */
 458         if (!extension_is_relevant(s, extdef->context, context))
 459             return 1;
 460
 461         parser = s->server ? extdef->parse_ctos : extdef->parse_stoc;
 462
 463         if (parser != NULL)
 464             return parser(s, &currext->data, al);
 465
 466         /*
 467          * If the parser is NULL we fall through to the custom extension
 468          * processing
 469          */
 470     }
 471
 472     /*
 473      * This is a custom extension. We only allow this if it is a non
 474      * resumed session on the server side.
 475      *
 476      * TODO(TLS1.3): We only allow old style <=TLS1.2 custom extensions.
 477      * We're going to need a new mechanism for TLS1.3 to specify which
 478      * messages to add the custom extensions to.
 479      */
 480     if ((!s->hit || !s->server)
 481             && (context
 482                 & (EXT_CLIENT_HELLO | EXT_TLS1_2_SERVER_HELLO)) != 0
 483             && custom_ext_parse(s, s->server, currext->type,
 484                                 PACKET_data(&currext->data),
 485                                 PACKET_remaining(&currext->data),
 486                                 al) <= 0)
 487         return 0;
 488
 489     return 1;
 490 }
 491
 492 /*
 493  * Parse all remaining extensions that have not yet been parsed. Also calls the
 494  * finalisation for all extensions at the end, whether we collected them or not.
 495  * Returns 1 for success or 0 for failure. On failure, |*al| is populated with a
 496  * suitable alert code.
 497  */
 498 int tls_parse_all_extensions(SSL *s, int context, RAW_EXTENSION *exts, int *al)
 499 {
 500     size_t i, numexts = OSSL_NELEM(ext_defs);
 501     const EXTENSION_DEFINITION *thisexd;
 502
 503     /* Calculate the number of extensions in the extensions list */
 504     if ((context & EXT_CLIENT_HELLO) != 0) {
 505         numexts += s->cert->srv_ext.meths_count;
 506     } else if ((context & EXT_TLS1_2_SERVER_HELLO) != 0) {
 507         numexts += s->cert->cli_ext.meths_count;
 508     }
 509
 510     /* Parse each extension in turn */
 511     for (i = 0; i < numexts; i++) {
 512         if (!tls_parse_extension(s, i, context, exts, al))
 513             return 0;
 514     }
 515
 516     /*
 517      * Finalise all known extensions relevant to this context, whether we have
 518      * found them or not
 519      */
 520     for (i = 0, thisexd = ext_defs; i < OSSL_NELEM(ext_defs); i++, thisexd++) {
 521         if(thisexd->final != NULL
 522                 && (thisexd->context & context) != 0
 523                 && !thisexd->final(s, context, exts[i].present, al))
 524             return 0;
 525     }
 526
 527     return 1;
 528 }
 529
 530 /*
 531  * Construct all the extensions relevant to the current |context| and write
 532  * them to |pkt|. Returns 1 on success or 0 on failure. If a failure occurs then
 533  * |al| is populated with a suitable alert code. On a failure construction stops
 534  * at the first extension to fail to construct.
 535  */
 536 int tls_construct_extensions(SSL *s, WPACKET *pkt, unsigned int context,
 537                              int *al)
 538 {
 539     size_t i;
 540     int addcustom = 0, min_version, max_version = 0, reason, tmpal;
 541     const EXTENSION_DEFINITION *thisexd;
 542
 543     /*
 544      * Normally if something goes wrong during construction it's an internal
 545      * error. We can always override this later.
 546      */
 547     tmpal = SSL_AD_INTERNAL_ERROR;
 548
 549     if (!WPACKET_start_sub_packet_u16(pkt)
 550                /*
 551                 * If extensions are of zero length then we don't even add the
 552                 * extensions length bytes to a ClientHello/ServerHello in SSLv3
 553                 */
 554             || ((context & (EXT_CLIENT_HELLO | EXT_TLS1_2_SERVER_HELLO)) != 0
 555                && s->version == SSL3_VERSION
 556                && !WPACKET_set_flags(pkt,
 557                                      WPACKET_FLAGS_ABANDON_ON_ZERO_LENGTH))) {
 558         SSLerr(SSL_F_TLS_CONSTRUCT_EXTENSIONS, ERR_R_INTERNAL_ERROR);
 559         goto err;
 560     }
 561
 562     if ((context & EXT_CLIENT_HELLO) != 0) {
 563         reason = ssl_get_client_min_max_version(s, &min_version, &max_version);
 564         if (reason != 0) {
 565             SSLerr(SSL_F_TLS_CONSTRUCT_EXTENSIONS, reason);
 566             goto err;
 567         }
 568     }
 569
 570     /* Add custom extensions first */
 571     if ((context & EXT_CLIENT_HELLO) != 0) {
 572         custom_ext_init(&s->cert->cli_ext);
 573         addcustom = 1;
 574     } else if ((context & EXT_TLS1_2_SERVER_HELLO) != 0) {
 575         /*
 576          * We already initialised the custom extensions during ClientHello
 577          * parsing.
 578          *
 579          * TODO(TLS1.3): We're going to need a new custom extension mechanism
 580          * for TLS1.3, so that custom extensions can specify which of the
 581          * multiple message they wish to add themselves to.
 582          */
 583         addcustom = 1;
 584     }
 585
 586     if (addcustom && !custom_ext_add(s, s->server, pkt, &tmpal)) {
 587         SSLerr(SSL_F_TLS_CONSTRUCT_EXTENSIONS, ERR_R_INTERNAL_ERROR);
 588         goto err;
 589     }
 590
 591     for (i = 0, thisexd = ext_defs; i < OSSL_NELEM(ext_defs); i++, thisexd++) {
 592         int (*construct)(SSL *s, WPACKET *pkt, int *al);
 593
 594         /* Skip if not relevant for our context */
 595         if ((thisexd->context & context) == 0)
 596             continue;
 597
 598         construct = s->server ? thisexd->construct_stoc
 599                               : thisexd->construct_ctos;
 600
 601         /* Check if this extension is defined for our protocol. If not, skip */
 602         if ((SSL_IS_DTLS(s)
 603                     && (thisexd->context & EXT_TLS_IMPLEMENTATION_ONLY)
 604                        != 0)
 605                 || (s->version == SSL3_VERSION
 606                         && (thisexd->context & EXT_SSL3_ALLOWED) == 0)
 607                 || (SSL_IS_TLS13(s)
 608                     && (thisexd->context & EXT_TLS1_2_AND_BELOW_ONLY)
 609                        != 0)
 610                 || (!SSL_IS_TLS13(s)
 611                     && (thisexd->context & EXT_TLS1_3_ONLY) != 0
 612                     && (context & EXT_CLIENT_HELLO) == 0)
 613                 || ((thisexd->context & EXT_TLS1_3_ONLY) != 0
 614                     && (context & EXT_CLIENT_HELLO) != 0
 615                     && (SSL_IS_DTLS(s) || max_version < TLS1_3_VERSION))
 616                 || construct == NULL)
 617             continue;
 618
 619         if (!construct(s, pkt, &tmpal))
 620             goto err;
 621     }
 622
 623     if (!WPACKET_close(pkt)) {
 624         SSLerr(SSL_F_TLS_CONSTRUCT_EXTENSIONS, ERR_R_INTERNAL_ERROR);
 625         goto err;
 626     }
 627
 628     return 1;
 629
 630  err:
 631     *al = tmpal;
 632     return 0;
 633 }
 634
 635 /*
 636  * Built in extension finalisation and initialisation functions. All initialise
 637  * or finalise the associated extension type for the given |context|. For
 638  * finalisers |sent| is set to 1 if we saw the extension during parsing, and 0
 639  * otherwise. These functions return 1 on success or 0 on failure. In the event
 640  * of a failure then |*al| is populated with a suitable error code.
 641  */
 642
 643 static int final_renegotiate(SSL *s, unsigned int context, int sent,
 644                                      int *al)
 645 {
 646     if (!s->server) {
 647         /*
 648          * Check if we can connect to a server that doesn't support safe
 649          * renegotiation
 650          */
 651         if (!(s->options & SSL_OP_LEGACY_SERVER_CONNECT)
 652                 && !(s->options & SSL_OP_ALLOW_UNSAFE_LEGACY_RENEGOTIATION)
 653                 && !sent) {
 654             *al = SSL_AD_HANDSHAKE_FAILURE;
 655             SSLerr(SSL_F_FINAL_RENEGOTIATE,
 656                    SSL_R_UNSAFE_LEGACY_RENEGOTIATION_DISABLED);
 657             return 0;
 658         }
 659
 660         return 1;
 661     }
 662
 663     /* Need RI if renegotiating */
 664     if (s->renegotiate
 665             && !(s->options & SSL_OP_ALLOW_UNSAFE_LEGACY_RENEGOTIATION)
 666             && !sent) {
 667         *al = SSL_AD_HANDSHAKE_FAILURE;
 668         SSLerr(SSL_F_FINAL_RENEGOTIATE,
 669                SSL_R_UNSAFE_LEGACY_RENEGOTIATION_DISABLED);
 670         return 0;
 671     }
 672
 673
 674     return 1;
 675 }
 676
 677 static int init_server_name(SSL *s, unsigned int context)
 678 {
 679     if (s->server)
 680         s->servername_done = 0;
 681
 682     return 1;
 683 }
 684
 685 static int final_server_name(SSL *s, unsigned int context, int sent,
 686                                      int *al)
 687 {
 688     int ret = SSL_TLSEXT_ERR_NOACK;
 689     int altmp = SSL_AD_UNRECOGNIZED_NAME;
 690
 691     if (s->ctx != NULL && s->ctx->tlsext_servername_callback != 0)
 692         ret = s->ctx->tlsext_servername_callback(s, &altmp,
 693                                                  s->ctx->tlsext_servername_arg);
 694     else if (s->initial_ctx != NULL
 695              && s->initial_ctx->tlsext_servername_callback != 0)
 696         ret = s->initial_ctx->tlsext_servername_callback(s, &altmp,
 697                                        s->initial_ctx->tlsext_servername_arg);
 698
 699     switch (ret) {
 700     case SSL_TLSEXT_ERR_ALERT_FATAL:
 701         *al = altmp;
 702         return 0;
 703
 704     case SSL_TLSEXT_ERR_ALERT_WARNING:
 705         *al = altmp;
 706         return 1;
 707
 708     case SSL_TLSEXT_ERR_NOACK:
 709         s->servername_done = 0;
 710         return 1;
 711
 712     default:
 713         return 1;
 714     }
 715 }
 716
 717 #ifndef OPENSSL_NO_EC
 718 static int final_ec_pt_formats(SSL *s, unsigned int context, int sent,
 719                                        int *al)
 720 {
 721     unsigned long alg_k, alg_a;
 722
 723     if (s->server)
 724         return 1;
 725
 726     alg_k = s->s3->tmp.new_cipher->algorithm_mkey;
 727     alg_a = s->s3->tmp.new_cipher->algorithm_auth;
 728
 729     /*
 730      * If we are client and using an elliptic curve cryptography cipher
 731      * suite, then if server returns an EC point formats lists extension it
 732      * must contain uncompressed.
 733      */
 734     if (s->tlsext_ecpointformatlist != NULL
 735             && s->tlsext_ecpointformatlist_length > 0
 736             && s->session->tlsext_ecpointformatlist != NULL
 737             && s->session->tlsext_ecpointformatlist_length > 0
 738             && ((alg_k & SSL_kECDHE) || (alg_a & SSL_aECDSA))) {
 739         /* we are using an ECC cipher */
 740         size_t i;
 741         unsigned char *list = s->session->tlsext_ecpointformatlist;
 742
 743         for (i = 0; i < s->session->tlsext_ecpointformatlist_length; i++) {
 744             if (*list++ == TLSEXT_ECPOINTFORMAT_uncompressed)
 745                 break;
 746         }
 747         if (i == s->session->tlsext_ecpointformatlist_length) {
 748             SSLerr(SSL_F_FINAL_EC_PT_FORMATS,
 749                    SSL_R_TLS_INVALID_ECPOINTFORMAT_LIST);
 750             return 0;
 751         }
 752     }
 753
 754     return 1;
 755 }
 756 #endif
 757
 758 static int init_session_ticket(SSL *s, unsigned int context)
 759 {
 760     if (!s->server)
 761         s->tlsext_ticket_expected = 0;
 762
 763     return 1;
 764 }
 765
 766 static int init_status_request(SSL *s, unsigned int context)
 767 {
 768     if (s->server)
 769         s->tlsext_status_type = TLSEXT_STATUSTYPE_nothing;
 770
 771     return 1;
 772 }
 773
 774 static int final_status_request(SSL *s, unsigned int context, int sent,
 775                                         int *al)
 776 {
 777     if (s->server)
 778         return 1;
 779
 780     /*
 781      * Ensure we get sensible values passed to tlsext_status_cb in the event
 782      * that we don't receive a status message
 783      */
 784     OPENSSL_free(s->tlsext_ocsp_resp);
 785     s->tlsext_ocsp_resp = NULL;
 786     s->tlsext_ocsp_resplen = 0;
 787
 788     return 1;
 789 }
 790
 791 #ifndef OPENSSL_NO_NEXTPROTONEG
 792 static int init_npn(SSL *s, unsigned int context)
 793 {
 794     s->s3->next_proto_neg_seen = 0;
 795
 796     return 1;
 797 }
 798 #endif
 799
 800 static int init_alpn(SSL *s, unsigned int context)
 801 {
 802     OPENSSL_free(s->s3->alpn_selected);
 803     s->s3->alpn_selected = NULL;
 804     if (s->server) {
 805         s->s3->alpn_selected_len = 0;
 806         OPENSSL_free(s->s3->alpn_proposed);
 807         s->s3->alpn_proposed = NULL;
 808         s->s3->alpn_proposed_len = 0;
 809     }
 810     return 1;
 811 }
 812
 813 static int final_alpn(SSL *s, unsigned int context, int sent, int *al)
 814 {
 815     const unsigned char *selected = NULL;
 816     unsigned char selected_len = 0;
 817
 818     if (!s->server)
 819         return 1;
 820
 821     if (s->ctx->alpn_select_cb != NULL && s->s3->alpn_proposed != NULL) {
 822         int r = s->ctx->alpn_select_cb(s, &selected, &selected_len,
 823                                        s->s3->alpn_proposed,
 824                                        (unsigned int)s->s3->alpn_proposed_len,
 825                                        s->ctx->alpn_select_cb_arg);
 826
 827         if (r == SSL_TLSEXT_ERR_OK) {
 828             OPENSSL_free(s->s3->alpn_selected);
 829             s->s3->alpn_selected = OPENSSL_memdup(selected, selected_len);
 830             if (s->s3->alpn_selected == NULL) {
 831                 *al = SSL_AD_INTERNAL_ERROR;
 832                 return 0;
 833             }
 834             s->s3->alpn_selected_len = selected_len;
 835 #ifndef OPENSSL_NO_NEXTPROTONEG
 836             /* ALPN takes precedence over NPN. */
 837             s->s3->next_proto_neg_seen = 0;
 838 #endif
 839         } else {
 840             *al = SSL_AD_NO_APPLICATION_PROTOCOL;
 841             return 0;
 842         }
 843     }
 844
 845     return 1;
 846 }
 847
 848 static int init_sig_algs(SSL *s, unsigned int context)
 849 {
 850     /* Clear any signature algorithms extension received */
 851     OPENSSL_free(s->s3->tmp.peer_sigalgs);
 852     s->s3->tmp.peer_sigalgs = NULL;
 853
 854     return 1;
 855 }
 856
 857 #ifndef OPENSSL_NO_SRP
 858 static int init_srp(SSL *s, unsigned int context)
 859 {
 860     OPENSSL_free(s->srp_ctx.login);
 861     s->srp_ctx.login = NULL;
 862
 863     return 1;
 864 }
 865 #endif
 866
 867 static int init_etm(SSL *s, unsigned int context)
 868 {
 869     s->s3->flags &= ~TLS1_FLAGS_ENCRYPT_THEN_MAC;
 870
 871     return 1;
 872 }
 873
 874 static int init_ems(SSL *s, unsigned int context)
 875 {
 876     if (!s->server)
 877         s->s3->flags &= ~TLS1_FLAGS_RECEIVED_EXTMS;
 878
 879     return 1;
 880 }
 881
 882 static int final_ems(SSL *s, unsigned int context, int sent, int *al)
 883 {
 884     if (!s->server && s->hit) {
 885         /*
 886          * Check extended master secret extension is consistent with
 887          * original session.
 888          */
 889         if (!(s->s3->flags & TLS1_FLAGS_RECEIVED_EXTMS) !=
 890             !(s->session->flags & SSL_SESS_FLAG_EXTMS)) {
 891             *al = SSL_AD_HANDSHAKE_FAILURE;
 892             SSLerr(SSL_F_FINAL_EMS, SSL_R_INCONSISTENT_EXTMS);
 893             return 0;
 894         }
 895     }
 896
 897     return 1;
 898 }
 899
 900 #ifndef OPENSSL_NO_SRTP
 901 static int init_srtp(SSL *s, unsigned int context)
 902 {
 903     if (s->server)
 904         s->srtp_profile = NULL;
 905
 906     return 1;
 907 }
 908 #endif