2 * Copyright 2016-2023 The OpenSSL Project Authors. All Rights Reserved.
4 * Licensed under the Apache License 2.0 (the "License"). You may not use
5 * this file except in compliance with the License. You can obtain a copy
6 * in the file LICENSE in the source distribution or at
7 * https://www.openssl.org/source/license.html
10 #if defined(__TANDEM) && defined(_SPT_MODEL_)
11 # include <spthread.h>
12 # include <spt_extensions.h> /* timeval */
16 #include "internal/nelem.h"
17 #include "internal/cryptlib.h"
18 #include "../ssl_local.h"
19 #include "statem_local.h"
21 static int final_renegotiate(SSL_CONNECTION
*s
, unsigned int context
, int sent
);
22 static int init_server_name(SSL_CONNECTION
*s
, unsigned int context
);
23 static int final_server_name(SSL_CONNECTION
*s
, unsigned int context
, int sent
);
24 static int final_ec_pt_formats(SSL_CONNECTION
*s
, unsigned int context
,
26 static int init_session_ticket(SSL_CONNECTION
*s
, unsigned int context
);
27 #ifndef OPENSSL_NO_OCSP
28 static int init_status_request(SSL_CONNECTION
*s
, unsigned int context
);
30 #ifndef OPENSSL_NO_NEXTPROTONEG
31 static int init_npn(SSL_CONNECTION
*s
, unsigned int context
);
33 static int init_alpn(SSL_CONNECTION
*s
, unsigned int context
);
34 static int final_alpn(SSL_CONNECTION
*s
, unsigned int context
, int sent
);
35 static int init_sig_algs_cert(SSL_CONNECTION
*s
, unsigned int context
);
36 static int init_sig_algs(SSL_CONNECTION
*s
, unsigned int context
);
37 static int init_server_cert_type(SSL_CONNECTION
*sc
, unsigned int context
);
38 static int init_client_cert_type(SSL_CONNECTION
*sc
, unsigned int context
);
39 static int init_certificate_authorities(SSL_CONNECTION
*s
,
40 unsigned int context
);
41 static EXT_RETURN
tls_construct_certificate_authorities(SSL_CONNECTION
*s
,
46 static int tls_parse_certificate_authorities(SSL_CONNECTION
*s
, PACKET
*pkt
,
47 unsigned int context
, X509
*x
,
49 #ifndef OPENSSL_NO_SRP
50 static int init_srp(SSL_CONNECTION
*s
, unsigned int context
);
52 static int init_ec_point_formats(SSL_CONNECTION
*s
, unsigned int context
);
53 static int init_etm(SSL_CONNECTION
*s
, unsigned int context
);
54 static int init_ems(SSL_CONNECTION
*s
, unsigned int context
);
55 static int final_ems(SSL_CONNECTION
*s
, unsigned int context
, int sent
);
56 static int init_psk_kex_modes(SSL_CONNECTION
*s
, unsigned int context
);
57 static int final_key_share(SSL_CONNECTION
*s
, unsigned int context
, int sent
);
58 #ifndef OPENSSL_NO_SRTP
59 static int init_srtp(SSL_CONNECTION
*s
, unsigned int context
);
61 static int final_sig_algs(SSL_CONNECTION
*s
, unsigned int context
, int sent
);
62 static int final_early_data(SSL_CONNECTION
*s
, unsigned int context
, int sent
);
63 static int final_maxfragmentlen(SSL_CONNECTION
*s
, unsigned int context
,
65 static int init_post_handshake_auth(SSL_CONNECTION
*s
, unsigned int context
);
66 static int final_psk(SSL_CONNECTION
*s
, unsigned int context
, int sent
);
67 static int tls_init_compress_certificate(SSL_CONNECTION
*sc
, unsigned int context
);
68 static EXT_RETURN
tls_construct_compress_certificate(SSL_CONNECTION
*sc
, WPACKET
*pkt
,
70 X509
*x
, size_t chainidx
);
71 static int tls_parse_compress_certificate(SSL_CONNECTION
*sc
, PACKET
*pkt
,
73 X509
*x
, size_t chainidx
);
75 /* Structure to define a built-in extension */
76 typedef struct extensions_definition_st
{
77 /* The defined type for the extension */
80 * The context that this extension applies to, e.g. what messages and
85 * Initialise extension before parsing. Always called for relevant contexts
86 * even if extension not present
88 int (*init
)(SSL_CONNECTION
*s
, unsigned int context
);
89 /* Parse extension sent from client to server */
90 int (*parse_ctos
)(SSL_CONNECTION
*s
, PACKET
*pkt
, unsigned int context
,
91 X509
*x
, size_t chainidx
);
92 /* Parse extension send from server to client */
93 int (*parse_stoc
)(SSL_CONNECTION
*s
, PACKET
*pkt
, unsigned int context
,
94 X509
*x
, size_t chainidx
);
95 /* Construct extension sent from server to client */
96 EXT_RETURN (*construct_stoc
)(SSL_CONNECTION
*s
, WPACKET
*pkt
,
98 X509
*x
, size_t chainidx
);
99 /* Construct extension sent from client to server */
100 EXT_RETURN (*construct_ctos
)(SSL_CONNECTION
*s
, WPACKET
*pkt
,
101 unsigned int context
,
102 X509
*x
, size_t chainidx
);
104 * Finalise extension after parsing. Always called where an extensions was
105 * initialised even if the extension was not present. |sent| is set to 1 if
106 * the extension was seen, or 0 otherwise.
108 int (*final
)(SSL_CONNECTION
*s
, unsigned int context
, int sent
);
109 } EXTENSION_DEFINITION
;
112 * Definitions of all built-in extensions. NOTE: Changes in the number or order
113 * of these extensions should be mirrored with equivalent changes to the
114 * indexes ( TLSEXT_IDX_* ) defined in ssl_local.h.
115 * Extensions should be added to test/ext_internal_test.c as well, as that
116 * tests the ordering of the extensions.
118 * Each extension has an initialiser, a client and
119 * server side parser and a finaliser. The initialiser is called (if the
120 * extension is relevant to the given context) even if we did not see the
121 * extension in the message that we received. The parser functions are only
122 * called if we see the extension in the message. The finalisers are always
123 * called if the initialiser was called.
124 * There are also server and client side constructor functions which are always
125 * called during message construction if the extension is relevant for the
127 * The initialisation, parsing, finalisation and construction functions are
128 * always called in the order defined in this list. Some extensions may depend
129 * on others having been processed first, so the order of this list is
131 * The extension context is defined by a series of flags which specify which
132 * messages the extension is relevant to. These flags also specify whether the
133 * extension is relevant to a particular protocol or protocol version.
135 * NOTE: WebSphere Application Server 7+ cannot handle empty extensions at
136 * the end, keep these extensions before signature_algorithm.
138 #define INVALID_EXTENSION { TLSEXT_TYPE_invalid, 0, NULL, NULL, NULL, NULL, NULL, NULL }
139 static const EXTENSION_DEFINITION ext_defs
[] = {
141 TLSEXT_TYPE_renegotiate
,
142 SSL_EXT_CLIENT_HELLO
| SSL_EXT_TLS1_2_SERVER_HELLO
143 | SSL_EXT_SSL3_ALLOWED
| SSL_EXT_TLS1_2_AND_BELOW_ONLY
,
144 NULL
, tls_parse_ctos_renegotiate
, tls_parse_stoc_renegotiate
,
145 tls_construct_stoc_renegotiate
, tls_construct_ctos_renegotiate
,
149 TLSEXT_TYPE_server_name
,
150 SSL_EXT_CLIENT_HELLO
| SSL_EXT_TLS1_2_SERVER_HELLO
151 | SSL_EXT_TLS1_3_ENCRYPTED_EXTENSIONS
,
153 tls_parse_ctos_server_name
, tls_parse_stoc_server_name
,
154 tls_construct_stoc_server_name
, tls_construct_ctos_server_name
,
158 TLSEXT_TYPE_max_fragment_length
,
159 SSL_EXT_CLIENT_HELLO
| SSL_EXT_TLS1_2_SERVER_HELLO
160 | SSL_EXT_TLS1_3_ENCRYPTED_EXTENSIONS
,
161 NULL
, tls_parse_ctos_maxfragmentlen
, tls_parse_stoc_maxfragmentlen
,
162 tls_construct_stoc_maxfragmentlen
, tls_construct_ctos_maxfragmentlen
,
165 #ifndef OPENSSL_NO_SRP
168 SSL_EXT_CLIENT_HELLO
| SSL_EXT_TLS1_2_AND_BELOW_ONLY
,
169 init_srp
, tls_parse_ctos_srp
, NULL
, NULL
, tls_construct_ctos_srp
, NULL
175 TLSEXT_TYPE_ec_point_formats
,
176 SSL_EXT_CLIENT_HELLO
| SSL_EXT_TLS1_2_SERVER_HELLO
177 | SSL_EXT_TLS1_2_AND_BELOW_ONLY
,
178 init_ec_point_formats
, tls_parse_ctos_ec_pt_formats
, tls_parse_stoc_ec_pt_formats
,
179 tls_construct_stoc_ec_pt_formats
, tls_construct_ctos_ec_pt_formats
,
184 * "supported_groups" is spread across several specifications.
185 * It was originally specified as "elliptic_curves" in RFC 4492,
186 * and broadened to include named FFDH groups by RFC 7919.
187 * Both RFCs 4492 and 7919 do not include a provision for the server
188 * to indicate to the client the complete list of groups supported
189 * by the server, with the server instead just indicating the
190 * selected group for this connection in the ServerKeyExchange
191 * message. TLS 1.3 adds a scheme for the server to indicate
192 * to the client its list of supported groups in the
193 * EncryptedExtensions message, but none of the relevant
194 * specifications permit sending supported_groups in the ServerHello.
195 * Nonetheless (possibly due to the close proximity to the
196 * "ec_point_formats" extension, which is allowed in the ServerHello),
197 * there are several servers that send this extension in the
198 * ServerHello anyway. Up to and including the 1.1.0 release,
199 * we did not check for the presence of nonpermitted extensions,
200 * so to avoid a regression, we must permit this extension in the
201 * TLS 1.2 ServerHello as well.
203 * Note that there is no tls_parse_stoc_supported_groups function,
204 * so we do not perform any additional parsing, validation, or
205 * processing on the server's group list -- this is just a minimal
206 * change to preserve compatibility with these misbehaving servers.
208 TLSEXT_TYPE_supported_groups
,
209 SSL_EXT_CLIENT_HELLO
| SSL_EXT_TLS1_3_ENCRYPTED_EXTENSIONS
210 | SSL_EXT_TLS1_2_SERVER_HELLO
,
211 NULL
, tls_parse_ctos_supported_groups
, NULL
,
212 tls_construct_stoc_supported_groups
,
213 tls_construct_ctos_supported_groups
, NULL
216 TLSEXT_TYPE_session_ticket
,
217 SSL_EXT_CLIENT_HELLO
| SSL_EXT_TLS1_2_SERVER_HELLO
218 | SSL_EXT_TLS1_2_AND_BELOW_ONLY
,
219 init_session_ticket
, tls_parse_ctos_session_ticket
,
220 tls_parse_stoc_session_ticket
, tls_construct_stoc_session_ticket
,
221 tls_construct_ctos_session_ticket
, NULL
223 #ifndef OPENSSL_NO_OCSP
225 TLSEXT_TYPE_status_request
,
226 SSL_EXT_CLIENT_HELLO
| SSL_EXT_TLS1_2_SERVER_HELLO
227 | SSL_EXT_TLS1_3_CERTIFICATE
| SSL_EXT_TLS1_3_CERTIFICATE_REQUEST
,
228 init_status_request
, tls_parse_ctos_status_request
,
229 tls_parse_stoc_status_request
, tls_construct_stoc_status_request
,
230 tls_construct_ctos_status_request
, NULL
235 #ifndef OPENSSL_NO_NEXTPROTONEG
237 TLSEXT_TYPE_next_proto_neg
,
238 SSL_EXT_CLIENT_HELLO
| SSL_EXT_TLS1_2_SERVER_HELLO
239 | SSL_EXT_TLS1_2_AND_BELOW_ONLY
,
240 init_npn
, tls_parse_ctos_npn
, tls_parse_stoc_npn
,
241 tls_construct_stoc_next_proto_neg
, tls_construct_ctos_npn
, NULL
248 * Must appear in this list after server_name so that finalisation
249 * happens after server_name callbacks
251 TLSEXT_TYPE_application_layer_protocol_negotiation
,
252 SSL_EXT_CLIENT_HELLO
| SSL_EXT_TLS1_2_SERVER_HELLO
253 | SSL_EXT_TLS1_3_ENCRYPTED_EXTENSIONS
,
254 init_alpn
, tls_parse_ctos_alpn
, tls_parse_stoc_alpn
,
255 tls_construct_stoc_alpn
, tls_construct_ctos_alpn
, final_alpn
257 #ifndef OPENSSL_NO_SRTP
259 TLSEXT_TYPE_use_srtp
,
260 SSL_EXT_CLIENT_HELLO
| SSL_EXT_TLS1_2_SERVER_HELLO
261 | SSL_EXT_TLS1_3_ENCRYPTED_EXTENSIONS
| SSL_EXT_DTLS_ONLY
,
262 init_srtp
, tls_parse_ctos_use_srtp
, tls_parse_stoc_use_srtp
,
263 tls_construct_stoc_use_srtp
, tls_construct_ctos_use_srtp
, NULL
269 TLSEXT_TYPE_encrypt_then_mac
,
270 SSL_EXT_CLIENT_HELLO
| SSL_EXT_TLS1_2_SERVER_HELLO
271 | SSL_EXT_TLS1_2_AND_BELOW_ONLY
,
272 init_etm
, tls_parse_ctos_etm
, tls_parse_stoc_etm
,
273 tls_construct_stoc_etm
, tls_construct_ctos_etm
, NULL
275 #ifndef OPENSSL_NO_CT
277 TLSEXT_TYPE_signed_certificate_timestamp
,
278 SSL_EXT_CLIENT_HELLO
| SSL_EXT_TLS1_2_SERVER_HELLO
279 | SSL_EXT_TLS1_3_CERTIFICATE
| SSL_EXT_TLS1_3_CERTIFICATE_REQUEST
,
282 * No server side support for this, but can be provided by a custom
283 * extension. This is an exception to the rule that custom extensions
284 * cannot override built in ones.
286 NULL
, tls_parse_stoc_sct
, NULL
, tls_construct_ctos_sct
, NULL
292 TLSEXT_TYPE_extended_master_secret
,
293 SSL_EXT_CLIENT_HELLO
| SSL_EXT_TLS1_2_SERVER_HELLO
294 | SSL_EXT_TLS1_2_AND_BELOW_ONLY
,
295 init_ems
, tls_parse_ctos_ems
, tls_parse_stoc_ems
,
296 tls_construct_stoc_ems
, tls_construct_ctos_ems
, final_ems
299 TLSEXT_TYPE_signature_algorithms_cert
,
300 SSL_EXT_CLIENT_HELLO
| SSL_EXT_TLS1_3_CERTIFICATE_REQUEST
,
301 init_sig_algs_cert
, tls_parse_ctos_sig_algs_cert
,
302 tls_parse_ctos_sig_algs_cert
,
303 /* We do not generate signature_algorithms_cert at present. */
307 TLSEXT_TYPE_post_handshake_auth
,
308 SSL_EXT_CLIENT_HELLO
| SSL_EXT_TLS1_3_ONLY
,
309 init_post_handshake_auth
,
310 tls_parse_ctos_post_handshake_auth
, NULL
,
311 NULL
, tls_construct_ctos_post_handshake_auth
,
315 TLSEXT_TYPE_client_cert_type
,
316 SSL_EXT_CLIENT_HELLO
| SSL_EXT_TLS1_3_ENCRYPTED_EXTENSIONS
317 | SSL_EXT_TLS1_2_SERVER_HELLO
,
318 init_client_cert_type
,
319 tls_parse_ctos_client_cert_type
, tls_parse_stoc_client_cert_type
,
320 tls_construct_stoc_client_cert_type
, tls_construct_ctos_client_cert_type
,
324 TLSEXT_TYPE_server_cert_type
,
325 SSL_EXT_CLIENT_HELLO
| SSL_EXT_TLS1_3_ENCRYPTED_EXTENSIONS
326 | SSL_EXT_TLS1_2_SERVER_HELLO
,
327 init_server_cert_type
,
328 tls_parse_ctos_server_cert_type
, tls_parse_stoc_server_cert_type
,
329 tls_construct_stoc_server_cert_type
, tls_construct_ctos_server_cert_type
,
333 TLSEXT_TYPE_signature_algorithms
,
334 SSL_EXT_CLIENT_HELLO
| SSL_EXT_TLS1_3_CERTIFICATE_REQUEST
,
335 init_sig_algs
, tls_parse_ctos_sig_algs
,
336 tls_parse_ctos_sig_algs
, tls_construct_ctos_sig_algs
,
337 tls_construct_ctos_sig_algs
, final_sig_algs
340 TLSEXT_TYPE_supported_versions
,
341 SSL_EXT_CLIENT_HELLO
| SSL_EXT_TLS1_3_SERVER_HELLO
342 | SSL_EXT_TLS1_3_HELLO_RETRY_REQUEST
| SSL_EXT_TLS_IMPLEMENTATION_ONLY
,
344 /* Processed inline as part of version selection */
345 NULL
, tls_parse_stoc_supported_versions
,
346 tls_construct_stoc_supported_versions
,
347 tls_construct_ctos_supported_versions
, NULL
350 TLSEXT_TYPE_psk_kex_modes
,
351 SSL_EXT_CLIENT_HELLO
| SSL_EXT_TLS_IMPLEMENTATION_ONLY
352 | SSL_EXT_TLS1_3_ONLY
,
353 init_psk_kex_modes
, tls_parse_ctos_psk_kex_modes
, NULL
, NULL
,
354 tls_construct_ctos_psk_kex_modes
, NULL
358 * Must be in this list after supported_groups. We need that to have
359 * been parsed before we do this one.
361 TLSEXT_TYPE_key_share
,
362 SSL_EXT_CLIENT_HELLO
| SSL_EXT_TLS1_3_SERVER_HELLO
363 | SSL_EXT_TLS1_3_HELLO_RETRY_REQUEST
| SSL_EXT_TLS_IMPLEMENTATION_ONLY
364 | SSL_EXT_TLS1_3_ONLY
,
365 NULL
, tls_parse_ctos_key_share
, tls_parse_stoc_key_share
,
366 tls_construct_stoc_key_share
, tls_construct_ctos_key_share
,
370 /* Must be after key_share */
372 SSL_EXT_CLIENT_HELLO
| SSL_EXT_TLS1_3_HELLO_RETRY_REQUEST
373 | SSL_EXT_TLS_IMPLEMENTATION_ONLY
| SSL_EXT_TLS1_3_ONLY
,
374 NULL
, tls_parse_ctos_cookie
, tls_parse_stoc_cookie
,
375 tls_construct_stoc_cookie
, tls_construct_ctos_cookie
, NULL
379 * Special unsolicited ServerHello extension only used when
380 * SSL_OP_CRYPTOPRO_TLSEXT_BUG is set. We allow it in a ClientHello but
383 TLSEXT_TYPE_cryptopro_bug
,
384 SSL_EXT_CLIENT_HELLO
| SSL_EXT_TLS1_2_SERVER_HELLO
385 | SSL_EXT_TLS1_2_AND_BELOW_ONLY
,
386 NULL
, NULL
, NULL
, tls_construct_stoc_cryptopro_bug
, NULL
, NULL
389 TLSEXT_TYPE_compress_certificate
,
390 SSL_EXT_CLIENT_HELLO
| SSL_EXT_TLS1_3_CERTIFICATE_REQUEST
391 | SSL_EXT_TLS_IMPLEMENTATION_ONLY
| SSL_EXT_TLS1_3_ONLY
,
392 tls_init_compress_certificate
,
393 tls_parse_compress_certificate
, tls_parse_compress_certificate
,
394 tls_construct_compress_certificate
, tls_construct_compress_certificate
,
398 TLSEXT_TYPE_early_data
,
399 SSL_EXT_CLIENT_HELLO
| SSL_EXT_TLS1_3_ENCRYPTED_EXTENSIONS
400 | SSL_EXT_TLS1_3_NEW_SESSION_TICKET
| SSL_EXT_TLS1_3_ONLY
,
401 NULL
, tls_parse_ctos_early_data
, tls_parse_stoc_early_data
,
402 tls_construct_stoc_early_data
, tls_construct_ctos_early_data
,
406 TLSEXT_TYPE_certificate_authorities
,
407 SSL_EXT_CLIENT_HELLO
| SSL_EXT_TLS1_3_CERTIFICATE_REQUEST
408 | SSL_EXT_TLS1_3_ONLY
,
409 init_certificate_authorities
,
410 tls_parse_certificate_authorities
, tls_parse_certificate_authorities
,
411 tls_construct_certificate_authorities
,
412 tls_construct_certificate_authorities
, NULL
,
415 /* Must be immediately before pre_shared_key */
417 SSL_EXT_CLIENT_HELLO
,
419 /* We send this, but don't read it */
420 NULL
, NULL
, NULL
, tls_construct_ctos_padding
, NULL
423 /* Required by the TLSv1.3 spec to always be the last extension */
425 SSL_EXT_CLIENT_HELLO
| SSL_EXT_TLS1_3_SERVER_HELLO
426 | SSL_EXT_TLS_IMPLEMENTATION_ONLY
| SSL_EXT_TLS1_3_ONLY
,
427 NULL
, tls_parse_ctos_psk
, tls_parse_stoc_psk
, tls_construct_stoc_psk
,
428 tls_construct_ctos_psk
, final_psk
432 /* Returns a TLSEXT_TYPE for the given index */
433 unsigned int ossl_get_extension_type(size_t idx
)
435 size_t num_exts
= OSSL_NELEM(ext_defs
);
438 return TLSEXT_TYPE_out_of_range
;
440 return ext_defs
[idx
].type
;
443 /* Check whether an extension's context matches the current context */
444 static int validate_context(SSL_CONNECTION
*s
, unsigned int extctx
,
445 unsigned int thisctx
)
447 /* Check we're allowed to use this extension in this context */
448 if ((thisctx
& extctx
) == 0)
451 if (SSL_CONNECTION_IS_DTLS(s
)) {
452 if ((extctx
& SSL_EXT_TLS_ONLY
) != 0)
454 } else if ((extctx
& SSL_EXT_DTLS_ONLY
) != 0) {
461 int tls_validate_all_contexts(SSL_CONNECTION
*s
, unsigned int thisctx
,
464 size_t i
, num_exts
, builtin_num
= OSSL_NELEM(ext_defs
), offset
;
465 RAW_EXTENSION
*thisext
;
466 unsigned int context
;
467 ENDPOINT role
= ENDPOINT_BOTH
;
469 if ((thisctx
& SSL_EXT_CLIENT_HELLO
) != 0)
470 role
= ENDPOINT_SERVER
;
471 else if ((thisctx
& SSL_EXT_TLS1_2_SERVER_HELLO
) != 0)
472 role
= ENDPOINT_CLIENT
;
474 /* Calculate the number of extensions in the extensions list */
475 num_exts
= builtin_num
+ s
->cert
->custext
.meths_count
;
477 for (thisext
= exts
, i
= 0; i
< num_exts
; i
++, thisext
++) {
478 if (!thisext
->present
)
481 if (i
< builtin_num
) {
482 context
= ext_defs
[i
].context
;
484 custom_ext_method
*meth
= NULL
;
486 meth
= custom_ext_find(&s
->cert
->custext
, role
, thisext
->type
,
488 if (!ossl_assert(meth
!= NULL
))
490 context
= meth
->context
;
493 if (!validate_context(s
, context
, thisctx
))
501 * Verify whether we are allowed to use the extension |type| in the current
502 * |context|. Returns 1 to indicate the extension is allowed or unknown or 0 to
503 * indicate the extension is not allowed. If returning 1 then |*found| is set to
504 * the definition for the extension we found.
506 static int verify_extension(SSL_CONNECTION
*s
, unsigned int context
,
507 unsigned int type
, custom_ext_methods
*meths
,
508 RAW_EXTENSION
*rawexlist
, RAW_EXTENSION
**found
)
511 size_t builtin_num
= OSSL_NELEM(ext_defs
);
512 const EXTENSION_DEFINITION
*thisext
;
514 for (i
= 0, thisext
= ext_defs
; i
< builtin_num
; i
++, thisext
++) {
515 if (type
== thisext
->type
) {
516 if (!validate_context(s
, thisext
->context
, context
))
519 *found
= &rawexlist
[i
];
524 /* Check the custom extensions */
527 ENDPOINT role
= ENDPOINT_BOTH
;
528 custom_ext_method
*meth
= NULL
;
530 if ((context
& SSL_EXT_CLIENT_HELLO
) != 0)
531 role
= ENDPOINT_SERVER
;
532 else if ((context
& SSL_EXT_TLS1_2_SERVER_HELLO
) != 0)
533 role
= ENDPOINT_CLIENT
;
535 meth
= custom_ext_find(meths
, role
, type
, &offset
);
537 if (!validate_context(s
, meth
->context
, context
))
539 *found
= &rawexlist
[offset
+ builtin_num
];
544 /* Unknown extension. We allow it */
550 * Check whether the context defined for an extension |extctx| means whether
551 * the extension is relevant for the current context |thisctx| or not. Returns
552 * 1 if the extension is relevant for this context, and 0 otherwise
554 int extension_is_relevant(SSL_CONNECTION
*s
, unsigned int extctx
,
555 unsigned int thisctx
)
560 * For HRR we haven't selected the version yet but we know it will be
563 if ((thisctx
& SSL_EXT_TLS1_3_HELLO_RETRY_REQUEST
) != 0)
566 is_tls13
= SSL_CONNECTION_IS_TLS13(s
);
568 if ((SSL_CONNECTION_IS_DTLS(s
)
569 && (extctx
& SSL_EXT_TLS_IMPLEMENTATION_ONLY
) != 0)
570 || (s
->version
== SSL3_VERSION
571 && (extctx
& SSL_EXT_SSL3_ALLOWED
) == 0)
573 * Note that SSL_IS_TLS13() means "TLS 1.3 has been negotiated",
574 * which is never true when generating the ClientHello.
575 * However, version negotiation *has* occurred by the time the
576 * ClientHello extensions are being parsed.
577 * Be careful to allow TLS 1.3-only extensions when generating
580 || (is_tls13
&& (extctx
& SSL_EXT_TLS1_2_AND_BELOW_ONLY
) != 0)
581 || (!is_tls13
&& (extctx
& SSL_EXT_TLS1_3_ONLY
) != 0
582 && (thisctx
& SSL_EXT_CLIENT_HELLO
) == 0)
583 || (s
->server
&& !is_tls13
&& (extctx
& SSL_EXT_TLS1_3_ONLY
) != 0)
584 || (s
->hit
&& (extctx
& SSL_EXT_IGNORE_ON_RESUMPTION
) != 0))
590 * Gather a list of all the extensions from the data in |packet]. |context|
591 * tells us which message this extension is for. The raw extension data is
592 * stored in |*res| on success. We don't actually process the content of the
593 * extensions yet, except to check their types. This function also runs the
594 * initialiser functions for all known extensions if |init| is nonzero (whether
595 * we have collected them or not). If successful the caller is responsible for
596 * freeing the contents of |*res|.
598 * Per http://tools.ietf.org/html/rfc5246#section-7.4.1.4, there may not be
599 * more than one extension of the same type in a ClientHello or ServerHello.
600 * This function returns 1 if all extensions are unique and we have parsed their
601 * types, and 0 if the extensions contain duplicates, could not be successfully
602 * found, or an internal error occurred. We only check duplicates for
603 * extensions that we know about. We ignore others.
605 int tls_collect_extensions(SSL_CONNECTION
*s
, PACKET
*packet
,
606 unsigned int context
,
607 RAW_EXTENSION
**res
, size_t *len
, int init
)
609 PACKET extensions
= *packet
;
612 custom_ext_methods
*exts
= &s
->cert
->custext
;
613 RAW_EXTENSION
*raw_extensions
= NULL
;
614 const EXTENSION_DEFINITION
*thisexd
;
619 * Initialise server side custom extensions. Client side is done during
620 * construction of extensions for the ClientHello.
622 if ((context
& SSL_EXT_CLIENT_HELLO
) != 0)
623 custom_ext_init(&s
->cert
->custext
);
625 num_exts
= OSSL_NELEM(ext_defs
) + (exts
!= NULL
? exts
->meths_count
: 0);
626 raw_extensions
= OPENSSL_zalloc(num_exts
* sizeof(*raw_extensions
));
627 if (raw_extensions
== NULL
) {
628 SSLfatal(s
, SSL_AD_INTERNAL_ERROR
, ERR_R_CRYPTO_LIB
);
633 while (PACKET_remaining(&extensions
) > 0) {
634 unsigned int type
, idx
;
636 RAW_EXTENSION
*thisex
;
638 if (!PACKET_get_net_2(&extensions
, &type
) ||
639 !PACKET_get_length_prefixed_2(&extensions
, &extension
)) {
640 SSLfatal(s
, SSL_AD_DECODE_ERROR
, SSL_R_BAD_EXTENSION
);
644 * Verify this extension is allowed. We only check duplicates for
645 * extensions that we recognise. We also have a special case for the
646 * PSK extension, which must be the last one in the ClientHello.
648 if (!verify_extension(s
, context
, type
, exts
, raw_extensions
, &thisex
)
649 || (thisex
!= NULL
&& thisex
->present
== 1)
650 || (type
== TLSEXT_TYPE_psk
651 && (context
& SSL_EXT_CLIENT_HELLO
) != 0
652 && PACKET_remaining(&extensions
) != 0)) {
653 SSLfatal(s
, SSL_AD_ILLEGAL_PARAMETER
, SSL_R_BAD_EXTENSION
);
656 idx
= thisex
- raw_extensions
;
658 * Check that we requested this extension (if appropriate). Requests can
659 * be sent in the ClientHello and CertificateRequest. Unsolicited
660 * extensions can be sent in the NewSessionTicket. We only do this for
661 * the built-in extensions. Custom extensions have a different but
662 * similar check elsewhere.
664 * - The HRR cookie extension is unsolicited
665 * - The renegotiate extension is unsolicited (the client signals
666 * support via an SCSV)
667 * - The signed_certificate_timestamp extension can be provided by a
668 * custom extension or by the built-in version. We let the extension
669 * itself handle unsolicited response checks.
671 if (idx
< OSSL_NELEM(ext_defs
)
672 && (context
& (SSL_EXT_CLIENT_HELLO
673 | SSL_EXT_TLS1_3_CERTIFICATE_REQUEST
674 | SSL_EXT_TLS1_3_NEW_SESSION_TICKET
)) == 0
675 && type
!= TLSEXT_TYPE_cookie
676 && type
!= TLSEXT_TYPE_renegotiate
677 && type
!= TLSEXT_TYPE_signed_certificate_timestamp
678 && (s
->ext
.extflags
[idx
] & SSL_EXT_FLAG_SENT
) == 0
679 #ifndef OPENSSL_NO_GOST
680 && !((context
& SSL_EXT_TLS1_2_SERVER_HELLO
) != 0
681 && type
== TLSEXT_TYPE_cryptopro_bug
)
684 SSLfatal(s
, SSL_AD_UNSUPPORTED_EXTENSION
,
685 SSL_R_UNSOLICITED_EXTENSION
);
688 if (thisex
!= NULL
) {
689 thisex
->data
= extension
;
692 thisex
->received_order
= i
++;
694 s
->ext
.debug_cb(SSL_CONNECTION_GET_SSL(s
), !s
->server
,
695 thisex
->type
, PACKET_data(&thisex
->data
),
696 PACKET_remaining(&thisex
->data
),
703 * Initialise all known extensions relevant to this context,
704 * whether we have found them or not
706 for (thisexd
= ext_defs
, i
= 0; i
< OSSL_NELEM(ext_defs
);
708 if (thisexd
->init
!= NULL
&& (thisexd
->context
& context
) != 0
709 && extension_is_relevant(s
, thisexd
->context
, context
)
710 && !thisexd
->init(s
, context
)) {
711 /* SSLfatal() already called */
717 *res
= raw_extensions
;
723 OPENSSL_free(raw_extensions
);
728 * Runs the parser for a given extension with index |idx|. |exts| contains the
729 * list of all parsed extensions previously collected by
730 * tls_collect_extensions(). The parser is only run if it is applicable for the
731 * given |context| and the parser has not already been run. If this is for a
732 * Certificate message, then we also provide the parser with the relevant
733 * Certificate |x| and its position in the |chainidx| with 0 being the first
734 * Certificate. Returns 1 on success or 0 on failure. If an extension is not
735 * present this counted as success.
737 int tls_parse_extension(SSL_CONNECTION
*s
, TLSEXT_INDEX idx
, int context
,
738 RAW_EXTENSION
*exts
, X509
*x
, size_t chainidx
)
740 RAW_EXTENSION
*currext
= &exts
[idx
];
741 int (*parser
)(SSL_CONNECTION
*s
, PACKET
*pkt
, unsigned int context
, X509
*x
,
742 size_t chainidx
) = NULL
;
744 /* Skip if the extension is not present */
745 if (!currext
->present
)
748 /* Skip if we've already parsed this extension */
754 if (idx
< OSSL_NELEM(ext_defs
)) {
755 /* We are handling a built-in extension */
756 const EXTENSION_DEFINITION
*extdef
= &ext_defs
[idx
];
758 /* Check if extension is defined for our protocol. If not, skip */
759 if (!extension_is_relevant(s
, extdef
->context
, context
))
762 parser
= s
->server
? extdef
->parse_ctos
: extdef
->parse_stoc
;
765 return parser(s
, &currext
->data
, context
, x
, chainidx
);
768 * If the parser is NULL we fall through to the custom extension
773 /* Parse custom extensions */
774 return custom_ext_parse(s
, context
, currext
->type
,
775 PACKET_data(&currext
->data
),
776 PACKET_remaining(&currext
->data
),
781 * Parse all remaining extensions that have not yet been parsed. Also calls the
782 * finalisation for all extensions at the end if |fin| is nonzero, whether we
783 * collected them or not. Returns 1 for success or 0 for failure. If we are
784 * working on a Certificate message then we also pass the Certificate |x| and
785 * its position in the |chainidx|, with 0 being the first certificate.
787 int tls_parse_all_extensions(SSL_CONNECTION
*s
, int context
,
788 RAW_EXTENSION
*exts
, X509
*x
,
789 size_t chainidx
, int fin
)
791 size_t i
, numexts
= OSSL_NELEM(ext_defs
);
792 const EXTENSION_DEFINITION
*thisexd
;
794 /* Calculate the number of extensions in the extensions list */
795 numexts
+= s
->cert
->custext
.meths_count
;
797 /* Parse each extension in turn */
798 for (i
= 0; i
< numexts
; i
++) {
799 if (!tls_parse_extension(s
, i
, context
, exts
, x
, chainidx
)) {
800 /* SSLfatal() already called */
807 * Finalise all known extensions relevant to this context,
808 * whether we have found them or not
810 for (i
= 0, thisexd
= ext_defs
; i
< OSSL_NELEM(ext_defs
);
812 if (thisexd
->final
!= NULL
&& (thisexd
->context
& context
) != 0
813 && !thisexd
->final(s
, context
, exts
[i
].present
)) {
814 /* SSLfatal() already called */
823 int should_add_extension(SSL_CONNECTION
*s
, unsigned int extctx
,
824 unsigned int thisctx
, int max_version
)
826 /* Skip if not relevant for our context */
827 if ((extctx
& thisctx
) == 0)
830 /* Check if this extension is defined for our protocol. If not, skip */
831 if (!extension_is_relevant(s
, extctx
, thisctx
)
832 || ((extctx
& SSL_EXT_TLS1_3_ONLY
) != 0
833 && (thisctx
& SSL_EXT_CLIENT_HELLO
) != 0
834 && (SSL_CONNECTION_IS_DTLS(s
) || max_version
< TLS1_3_VERSION
)))
841 * Construct all the extensions relevant to the current |context| and write
842 * them to |pkt|. If this is an extension for a Certificate in a Certificate
843 * message, then |x| will be set to the Certificate we are handling, and
844 * |chainidx| will indicate the position in the chainidx we are processing (with
845 * 0 being the first in the chain). Returns 1 on success or 0 on failure. On a
846 * failure construction stops at the first extension to fail to construct.
848 int tls_construct_extensions(SSL_CONNECTION
*s
, WPACKET
*pkt
,
849 unsigned int context
,
850 X509
*x
, size_t chainidx
)
853 int min_version
, max_version
= 0, reason
;
854 const EXTENSION_DEFINITION
*thisexd
;
855 int for_comp
= (context
& SSL_EXT_TLS1_3_CERTIFICATE_COMPRESSION
) != 0;
857 if (!WPACKET_start_sub_packet_u16(pkt
)
859 * If extensions are of zero length then we don't even add the
860 * extensions length bytes to a ClientHello/ServerHello
864 (SSL_EXT_CLIENT_HELLO
| SSL_EXT_TLS1_2_SERVER_HELLO
)) != 0
865 && !WPACKET_set_flags(pkt
,
866 WPACKET_FLAGS_ABANDON_ON_ZERO_LENGTH
))) {
868 SSLfatal(s
, SSL_AD_INTERNAL_ERROR
, ERR_R_INTERNAL_ERROR
);
872 if ((context
& SSL_EXT_CLIENT_HELLO
) != 0) {
873 reason
= ssl_get_min_max_version(s
, &min_version
, &max_version
, NULL
);
876 SSLfatal(s
, SSL_AD_INTERNAL_ERROR
, reason
);
881 /* Add custom extensions first */
882 if ((context
& SSL_EXT_CLIENT_HELLO
) != 0) {
883 /* On the server side with initialise during ClientHello parsing */
884 custom_ext_init(&s
->cert
->custext
);
886 if (!custom_ext_add(s
, context
, pkt
, x
, chainidx
, max_version
)) {
887 /* SSLfatal() already called */
891 for (i
= 0, thisexd
= ext_defs
; i
< OSSL_NELEM(ext_defs
); i
++, thisexd
++) {
892 EXT_RETURN (*construct
)(SSL_CONNECTION
*s
, WPACKET
*pkt
,
893 unsigned int context
,
894 X509
*x
, size_t chainidx
);
897 /* Skip if not relevant for our context */
898 if (!should_add_extension(s
, thisexd
->context
, context
, max_version
))
901 construct
= s
->server
? thisexd
->construct_stoc
902 : thisexd
->construct_ctos
;
904 if (construct
== NULL
)
907 ret
= construct(s
, pkt
, context
, x
, chainidx
);
908 if (ret
== EXT_RETURN_FAIL
) {
909 /* SSLfatal() already called */
912 if (ret
== EXT_RETURN_SENT
913 && (context
& (SSL_EXT_CLIENT_HELLO
914 | SSL_EXT_TLS1_3_CERTIFICATE_REQUEST
915 | SSL_EXT_TLS1_3_NEW_SESSION_TICKET
)) != 0)
916 s
->ext
.extflags
[i
] |= SSL_EXT_FLAG_SENT
;
919 if (!WPACKET_close(pkt
)) {
921 SSLfatal(s
, SSL_AD_INTERNAL_ERROR
, ERR_R_INTERNAL_ERROR
);
929 * Built in extension finalisation and initialisation functions. All initialise
930 * or finalise the associated extension type for the given |context|. For
931 * finalisers |sent| is set to 1 if we saw the extension during parsing, and 0
932 * otherwise. These functions return 1 on success or 0 on failure.
935 static int final_renegotiate(SSL_CONNECTION
*s
, unsigned int context
, int sent
)
939 * Check if we can connect to a server that doesn't support safe
942 if (!(s
->options
& SSL_OP_LEGACY_SERVER_CONNECT
)
943 && !(s
->options
& SSL_OP_ALLOW_UNSAFE_LEGACY_RENEGOTIATION
)
945 SSLfatal(s
, SSL_AD_HANDSHAKE_FAILURE
,
946 SSL_R_UNSAFE_LEGACY_RENEGOTIATION_DISABLED
);
953 /* Need RI if renegotiating */
955 && !(s
->options
& SSL_OP_ALLOW_UNSAFE_LEGACY_RENEGOTIATION
)
957 SSLfatal(s
, SSL_AD_HANDSHAKE_FAILURE
,
958 SSL_R_UNSAFE_LEGACY_RENEGOTIATION_DISABLED
);
966 static ossl_inline
void ssl_tsan_decr(const SSL_CTX
*ctx
,
967 TSAN_QUALIFIER
int *stat
)
969 if (ssl_tsan_lock(ctx
)) {
971 ssl_tsan_unlock(ctx
);
975 static int init_server_name(SSL_CONNECTION
*s
, unsigned int context
)
978 s
->servername_done
= 0;
980 OPENSSL_free(s
->ext
.hostname
);
981 s
->ext
.hostname
= NULL
;
987 static int final_server_name(SSL_CONNECTION
*s
, unsigned int context
, int sent
)
989 int ret
= SSL_TLSEXT_ERR_NOACK
;
990 int altmp
= SSL_AD_UNRECOGNIZED_NAME
;
991 SSL
*ssl
= SSL_CONNECTION_GET_SSL(s
);
992 SSL_CTX
*sctx
= SSL_CONNECTION_GET_CTX(s
);
993 int was_ticket
= (SSL_get_options(ssl
) & SSL_OP_NO_TICKET
) == 0;
995 if (!ossl_assert(sctx
!= NULL
) || !ossl_assert(s
->session_ctx
!= NULL
)) {
996 SSLfatal(s
, SSL_AD_INTERNAL_ERROR
, ERR_R_INTERNAL_ERROR
);
1000 if (sctx
->ext
.servername_cb
!= NULL
)
1001 ret
= sctx
->ext
.servername_cb(ssl
, &altmp
,
1002 sctx
->ext
.servername_arg
);
1003 else if (s
->session_ctx
->ext
.servername_cb
!= NULL
)
1004 ret
= s
->session_ctx
->ext
.servername_cb(ssl
, &altmp
,
1005 s
->session_ctx
->ext
.servername_arg
);
1008 * For servers, propagate the SNI hostname from the temporary
1009 * storage in the SSL to the persistent SSL_SESSION, now that we
1010 * know we accepted it.
1011 * Clients make this copy when parsing the server's response to
1012 * the extension, which is when they find out that the negotiation
1016 if (sent
&& ret
== SSL_TLSEXT_ERR_OK
&& !s
->hit
) {
1017 /* Only store the hostname in the session if we accepted it. */
1018 OPENSSL_free(s
->session
->ext
.hostname
);
1019 s
->session
->ext
.hostname
= OPENSSL_strdup(s
->ext
.hostname
);
1020 if (s
->session
->ext
.hostname
== NULL
&& s
->ext
.hostname
!= NULL
) {
1021 SSLfatal(s
, SSL_AD_INTERNAL_ERROR
, ERR_R_INTERNAL_ERROR
);
1027 * If we switched contexts (whether here or in the client_hello callback),
1028 * move the sess_accept increment from the session_ctx to the new
1029 * context, to avoid the confusing situation of having sess_accept_good
1030 * exceed sess_accept (zero) for the new context.
1032 if (SSL_IS_FIRST_HANDSHAKE(s
) && sctx
!= s
->session_ctx
1033 && s
->hello_retry_request
== SSL_HRR_NONE
) {
1034 ssl_tsan_counter(sctx
, &sctx
->stats
.sess_accept
);
1035 ssl_tsan_decr(s
->session_ctx
, &s
->session_ctx
->stats
.sess_accept
);
1039 * If we're expecting to send a ticket, and tickets were previously enabled,
1040 * and now tickets are disabled, then turn off expected ticket.
1041 * Also, if this is not a resumption, create a new session ID
1043 if (ret
== SSL_TLSEXT_ERR_OK
&& s
->ext
.ticket_expected
1044 && was_ticket
&& (SSL_get_options(ssl
) & SSL_OP_NO_TICKET
) != 0) {
1045 s
->ext
.ticket_expected
= 0;
1047 SSL_SESSION
* ss
= SSL_get_session(ssl
);
1050 OPENSSL_free(ss
->ext
.tick
);
1051 ss
->ext
.tick
= NULL
;
1052 ss
->ext
.ticklen
= 0;
1053 ss
->ext
.tick_lifetime_hint
= 0;
1054 ss
->ext
.tick_age_add
= 0;
1055 if (!ssl_generate_session_id(s
, ss
)) {
1056 SSLfatal(s
, SSL_AD_INTERNAL_ERROR
, ERR_R_INTERNAL_ERROR
);
1060 SSLfatal(s
, SSL_AD_INTERNAL_ERROR
, ERR_R_INTERNAL_ERROR
);
1067 case SSL_TLSEXT_ERR_ALERT_FATAL
:
1068 SSLfatal(s
, altmp
, SSL_R_CALLBACK_FAILED
);
1071 case SSL_TLSEXT_ERR_ALERT_WARNING
:
1072 /* TLSv1.3 doesn't have warning alerts so we suppress this */
1073 if (!SSL_CONNECTION_IS_TLS13(s
))
1074 ssl3_send_alert(s
, SSL3_AL_WARNING
, altmp
);
1075 s
->servername_done
= 0;
1078 case SSL_TLSEXT_ERR_NOACK
:
1079 s
->servername_done
= 0;
1087 static int final_ec_pt_formats(SSL_CONNECTION
*s
, unsigned int context
,
1090 unsigned long alg_k
, alg_a
;
1095 alg_k
= s
->s3
.tmp
.new_cipher
->algorithm_mkey
;
1096 alg_a
= s
->s3
.tmp
.new_cipher
->algorithm_auth
;
1099 * If we are client and using an elliptic curve cryptography cipher
1100 * suite, then if server returns an EC point formats lists extension it
1101 * must contain uncompressed.
1103 if (s
->ext
.ecpointformats
!= NULL
1104 && s
->ext
.ecpointformats_len
> 0
1105 && s
->ext
.peer_ecpointformats
!= NULL
1106 && s
->ext
.peer_ecpointformats_len
> 0
1107 && ((alg_k
& SSL_kECDHE
) || (alg_a
& SSL_aECDSA
))) {
1108 /* we are using an ECC cipher */
1110 unsigned char *list
= s
->ext
.peer_ecpointformats
;
1112 for (i
= 0; i
< s
->ext
.peer_ecpointformats_len
; i
++) {
1113 if (*list
++ == TLSEXT_ECPOINTFORMAT_uncompressed
)
1116 if (i
== s
->ext
.peer_ecpointformats_len
) {
1117 SSLfatal(s
, SSL_AD_ILLEGAL_PARAMETER
,
1118 SSL_R_TLS_INVALID_ECPOINTFORMAT_LIST
);
1126 static int init_session_ticket(SSL_CONNECTION
*s
, unsigned int context
)
1129 s
->ext
.ticket_expected
= 0;
1134 #ifndef OPENSSL_NO_OCSP
1135 static int init_status_request(SSL_CONNECTION
*s
, unsigned int context
)
1138 s
->ext
.status_type
= TLSEXT_STATUSTYPE_nothing
;
1141 * Ensure we get sensible values passed to tlsext_status_cb in the event
1142 * that we don't receive a status message
1144 OPENSSL_free(s
->ext
.ocsp
.resp
);
1145 s
->ext
.ocsp
.resp
= NULL
;
1146 s
->ext
.ocsp
.resp_len
= 0;
1153 #ifndef OPENSSL_NO_NEXTPROTONEG
1154 static int init_npn(SSL_CONNECTION
*s
, unsigned int context
)
1162 static int init_alpn(SSL_CONNECTION
*s
, unsigned int context
)
1164 OPENSSL_free(s
->s3
.alpn_selected
);
1165 s
->s3
.alpn_selected
= NULL
;
1166 s
->s3
.alpn_selected_len
= 0;
1168 OPENSSL_free(s
->s3
.alpn_proposed
);
1169 s
->s3
.alpn_proposed
= NULL
;
1170 s
->s3
.alpn_proposed_len
= 0;
1175 static int final_alpn(SSL_CONNECTION
*s
, unsigned int context
, int sent
)
1177 if (!s
->server
&& !sent
&& s
->session
->ext
.alpn_selected
!= NULL
)
1178 s
->ext
.early_data_ok
= 0;
1180 if (!s
->server
|| !SSL_CONNECTION_IS_TLS13(s
))
1184 * Call alpn_select callback if needed. Has to be done after SNI and
1185 * cipher negotiation (HTTP/2 restricts permitted ciphers). In TLSv1.3
1186 * we also have to do this before we decide whether to accept early_data.
1187 * In TLSv1.3 we've already negotiated our cipher so we do this call now.
1188 * For < TLSv1.3 we defer it until after cipher negotiation.
1190 * On failure SSLfatal() already called.
1192 return tls_handle_alpn(s
);
1195 static int init_sig_algs(SSL_CONNECTION
*s
, unsigned int context
)
1197 /* Clear any signature algorithms extension received */
1198 OPENSSL_free(s
->s3
.tmp
.peer_sigalgs
);
1199 s
->s3
.tmp
.peer_sigalgs
= NULL
;
1200 s
->s3
.tmp
.peer_sigalgslen
= 0;
1205 static int init_sig_algs_cert(SSL_CONNECTION
*s
,
1206 ossl_unused
unsigned int context
)
1208 /* Clear any signature algorithms extension received */
1209 OPENSSL_free(s
->s3
.tmp
.peer_cert_sigalgs
);
1210 s
->s3
.tmp
.peer_cert_sigalgs
= NULL
;
1211 s
->s3
.tmp
.peer_cert_sigalgslen
= 0;
1216 #ifndef OPENSSL_NO_SRP
1217 static int init_srp(SSL_CONNECTION
*s
, unsigned int context
)
1219 OPENSSL_free(s
->srp_ctx
.login
);
1220 s
->srp_ctx
.login
= NULL
;
1226 static int init_ec_point_formats(SSL_CONNECTION
*s
, unsigned int context
)
1228 OPENSSL_free(s
->ext
.peer_ecpointformats
);
1229 s
->ext
.peer_ecpointformats
= NULL
;
1230 s
->ext
.peer_ecpointformats_len
= 0;
1235 static int init_etm(SSL_CONNECTION
*s
, unsigned int context
)
1242 static int init_ems(SSL_CONNECTION
*s
, unsigned int context
)
1244 if (s
->s3
.flags
& TLS1_FLAGS_RECEIVED_EXTMS
) {
1245 s
->s3
.flags
&= ~TLS1_FLAGS_RECEIVED_EXTMS
;
1246 s
->s3
.flags
|= TLS1_FLAGS_REQUIRED_EXTMS
;
1252 static int final_ems(SSL_CONNECTION
*s
, unsigned int context
, int sent
)
1255 * Check extended master secret extension is not dropped on
1258 if (!(s
->s3
.flags
& TLS1_FLAGS_RECEIVED_EXTMS
)
1259 && (s
->s3
.flags
& TLS1_FLAGS_REQUIRED_EXTMS
)) {
1260 SSLfatal(s
, SSL_AD_HANDSHAKE_FAILURE
, SSL_R_INCONSISTENT_EXTMS
);
1263 if (!s
->server
&& s
->hit
) {
1265 * Check extended master secret extension is consistent with
1268 if (!(s
->s3
.flags
& TLS1_FLAGS_RECEIVED_EXTMS
) !=
1269 !(s
->session
->flags
& SSL_SESS_FLAG_EXTMS
)) {
1270 SSLfatal(s
, SSL_AD_HANDSHAKE_FAILURE
, SSL_R_INCONSISTENT_EXTMS
);
1278 static int init_certificate_authorities(SSL_CONNECTION
*s
, unsigned int context
)
1280 sk_X509_NAME_pop_free(s
->s3
.tmp
.peer_ca_names
, X509_NAME_free
);
1281 s
->s3
.tmp
.peer_ca_names
= NULL
;
1285 static EXT_RETURN
tls_construct_certificate_authorities(SSL_CONNECTION
*s
,
1287 unsigned int context
,
1291 const STACK_OF(X509_NAME
) *ca_sk
= get_ca_names(s
);
1293 if (ca_sk
== NULL
|| sk_X509_NAME_num(ca_sk
) == 0)
1294 return EXT_RETURN_NOT_SENT
;
1296 if (!WPACKET_put_bytes_u16(pkt
, TLSEXT_TYPE_certificate_authorities
)
1297 || !WPACKET_start_sub_packet_u16(pkt
)) {
1298 SSLfatal(s
, SSL_AD_INTERNAL_ERROR
, ERR_R_INTERNAL_ERROR
);
1299 return EXT_RETURN_FAIL
;
1302 if (!construct_ca_names(s
, ca_sk
, pkt
)) {
1303 /* SSLfatal() already called */
1304 return EXT_RETURN_FAIL
;
1307 if (!WPACKET_close(pkt
)) {
1308 SSLfatal(s
, SSL_AD_INTERNAL_ERROR
, ERR_R_INTERNAL_ERROR
);
1309 return EXT_RETURN_FAIL
;
1312 return EXT_RETURN_SENT
;
1315 static int tls_parse_certificate_authorities(SSL_CONNECTION
*s
, PACKET
*pkt
,
1316 unsigned int context
, X509
*x
,
1319 if (!parse_ca_names(s
, pkt
))
1321 if (PACKET_remaining(pkt
) != 0) {
1322 SSLfatal(s
, SSL_AD_DECODE_ERROR
, SSL_R_BAD_EXTENSION
);
1328 #ifndef OPENSSL_NO_SRTP
1329 static int init_srtp(SSL_CONNECTION
*s
, unsigned int context
)
1332 s
->srtp_profile
= NULL
;
1338 static int final_sig_algs(SSL_CONNECTION
*s
, unsigned int context
, int sent
)
1340 if (!sent
&& SSL_CONNECTION_IS_TLS13(s
) && !s
->hit
) {
1341 SSLfatal(s
, TLS13_AD_MISSING_EXTENSION
,
1342 SSL_R_MISSING_SIGALGS_EXTENSION
);
1349 static int final_key_share(SSL_CONNECTION
*s
, unsigned int context
, int sent
)
1351 #if !defined(OPENSSL_NO_TLS1_3)
1352 if (!SSL_CONNECTION_IS_TLS13(s
))
1355 /* Nothing to do for key_share in an HRR */
1356 if ((context
& SSL_EXT_TLS1_3_HELLO_RETRY_REQUEST
) != 0)
1363 * we have no key_share
1365 * (we are not resuming
1366 * OR the kex_mode doesn't allow non key_share resumes)
1373 || (s
->ext
.psk_kex_mode
& TLSEXT_KEX_MODE_FLAG_KE
) == 0)) {
1374 /* Nothing left we can do - just fail */
1375 SSLfatal(s
, SSL_AD_MISSING_EXTENSION
, SSL_R_NO_SUITABLE_KEY_SHARE
);
1383 * we have a suitable key_share
1386 * we are stateless AND we have no cookie
1388 * send a HelloRetryRequest
1391 * we didn't already send a HelloRetryRequest
1393 * the client sent a key_share extension
1395 * (we are not resuming
1396 * OR (the kex_mode allows key_share resumes
1397 * AND (kex_mode doesn't allow non-dh resumes OR non-dh is not preferred)))
1399 * a shared group exists
1401 * send a HelloRetryRequest
1403 * we are not resuming
1405 * the kex_mode doesn't allow non key_share resumes
1409 * we are stateless AND we have no cookie
1411 * send a HelloRetryRequest
1414 if (s
->s3
.peer_tmp
!= NULL
) {
1415 /* We have a suitable key_share */
1416 if ((s
->s3
.flags
& TLS1_FLAGS_STATELESS
) != 0
1417 && !s
->ext
.cookieok
) {
1418 if (!ossl_assert(s
->hello_retry_request
== SSL_HRR_NONE
)) {
1420 * If we are stateless then we wouldn't know about any
1421 * previously sent HRR - so how can this be anything other
1424 SSLfatal(s
, SSL_AD_INTERNAL_ERROR
, ERR_R_INTERNAL_ERROR
);
1427 s
->hello_retry_request
= SSL_HRR_PENDING
;
1431 /* No suitable key_share */
1435 /* kex_mode allows key_share resume */
1436 (((s
->ext
.psk_kex_mode
& TLSEXT_KEX_MODE_FLAG_KE_DHE
) != 0)
1438 /* and psk-only is not available or not explicitly preferred */
1439 && ((((s
->ext
.psk_kex_mode
& TLSEXT_KEX_MODE_FLAG_KE
) == 0)
1440 || (s
->options
& SSL_OP_PREFER_NO_DHE_KEX
) == 0)));
1442 if (s
->hello_retry_request
== SSL_HRR_NONE
&& sent
1443 && (!s
->hit
|| dhe_psk
)) {
1444 const uint16_t *pgroups
, *clntgroups
;
1445 size_t num_groups
, clnt_num_groups
, i
;
1446 unsigned int group_id
= 0;
1448 /* Check if a shared group exists */
1450 /* Get the clients list of supported groups. */
1451 tls1_get_peer_groups(s
, &clntgroups
, &clnt_num_groups
);
1452 tls1_get_supported_groups(s
, &pgroups
, &num_groups
);
1455 * Find the first group we allow that is also in client's list
1457 for (i
= 0; i
< num_groups
; i
++) {
1458 group_id
= pgroups
[i
];
1460 if (check_in_list(s
, group_id
, clntgroups
, clnt_num_groups
,
1462 && tls_group_allowed(s
, group_id
,
1463 SSL_SECOP_CURVE_SUPPORTED
)
1464 && tls_valid_group(s
, group_id
, TLS1_3_VERSION
,
1465 TLS1_3_VERSION
, 0, NULL
))
1469 if (i
< num_groups
) {
1470 /* A shared group exists so send a HelloRetryRequest */
1471 s
->s3
.group_id
= group_id
;
1472 s
->hello_retry_request
= SSL_HRR_PENDING
;
1477 || (s
->ext
.psk_kex_mode
& TLSEXT_KEX_MODE_FLAG_KE
) == 0) {
1478 /* Nothing left we can do - just fail */
1479 SSLfatal(s
, sent
? SSL_AD_HANDSHAKE_FAILURE
1480 : SSL_AD_MISSING_EXTENSION
,
1481 SSL_R_NO_SUITABLE_KEY_SHARE
);
1485 if ((s
->s3
.flags
& TLS1_FLAGS_STATELESS
) != 0
1486 && !s
->ext
.cookieok
) {
1487 if (!ossl_assert(s
->hello_retry_request
== SSL_HRR_NONE
)) {
1489 * If we are stateless then we wouldn't know about any
1490 * previously sent HRR - so how can this be anything other
1493 SSLfatal(s
, SSL_AD_INTERNAL_ERROR
, ERR_R_INTERNAL_ERROR
);
1496 s
->hello_retry_request
= SSL_HRR_PENDING
;
1502 * We have a key_share so don't send any more HelloRetryRequest
1505 if (s
->hello_retry_request
== SSL_HRR_PENDING
)
1506 s
->hello_retry_request
= SSL_HRR_COMPLETE
;
1509 * For a client side resumption with no key_share we need to generate
1510 * the handshake secret (otherwise this is done during key_share
1513 if (!sent
&& !tls13_generate_handshake_secret(s
, NULL
, 0)) {
1514 SSLfatal(s
, SSL_AD_INTERNAL_ERROR
, ERR_R_INTERNAL_ERROR
);
1518 #endif /* !defined(OPENSSL_NO_TLS1_3) */
1522 static int init_psk_kex_modes(SSL_CONNECTION
*s
, unsigned int context
)
1524 s
->ext
.psk_kex_mode
= TLSEXT_KEX_MODE_FLAG_NONE
;
1528 int tls_psk_do_binder(SSL_CONNECTION
*s
, const EVP_MD
*md
,
1529 const unsigned char *msgstart
,
1530 size_t binderoffset
, const unsigned char *binderin
,
1531 unsigned char *binderout
, SSL_SESSION
*sess
, int sign
,
1534 EVP_PKEY
*mackey
= NULL
;
1535 EVP_MD_CTX
*mctx
= NULL
;
1536 unsigned char hash
[EVP_MAX_MD_SIZE
], binderkey
[EVP_MAX_MD_SIZE
];
1537 unsigned char finishedkey
[EVP_MAX_MD_SIZE
], tmpbinder
[EVP_MAX_MD_SIZE
];
1538 unsigned char *early_secret
;
1539 /* ASCII: "res binder", in hex for EBCDIC compatibility */
1540 static const unsigned char resumption_label
[] = "\x72\x65\x73\x20\x62\x69\x6E\x64\x65\x72";
1541 /* ASCII: "ext binder", in hex for EBCDIC compatibility */
1542 static const unsigned char external_label
[] = "\x65\x78\x74\x20\x62\x69\x6E\x64\x65\x72";
1543 const unsigned char *label
;
1544 size_t bindersize
, labelsize
, hashsize
;
1545 int hashsizei
= EVP_MD_get_size(md
);
1547 int usepskfored
= 0;
1548 SSL_CTX
*sctx
= SSL_CONNECTION_GET_CTX(s
);
1550 /* Ensure cast to size_t is safe */
1551 if (!ossl_assert(hashsizei
>= 0)) {
1552 SSLfatal(s
, SSL_AD_INTERNAL_ERROR
, ERR_R_INTERNAL_ERROR
);
1555 hashsize
= (size_t)hashsizei
;
1558 && s
->early_data_state
== SSL_EARLY_DATA_CONNECTING
1559 && s
->session
->ext
.max_early_data
== 0
1560 && sess
->ext
.max_early_data
> 0)
1564 label
= external_label
;
1565 labelsize
= sizeof(external_label
) - 1;
1567 label
= resumption_label
;
1568 labelsize
= sizeof(resumption_label
) - 1;
1572 * Generate the early_secret. On the server side we've selected a PSK to
1573 * resume with (internal or external) so we always do this. On the client
1574 * side we do this for a non-external (i.e. resumption) PSK or external PSK
1575 * that will be used for early_data so that it is in place for sending early
1576 * data. For client side external PSK not being used for early_data we
1577 * generate it but store it away for later use.
1579 if (s
->server
|| !external
|| usepskfored
)
1580 early_secret
= (unsigned char *)s
->early_secret
;
1582 early_secret
= (unsigned char *)sess
->early_secret
;
1584 if (!tls13_generate_secret(s
, md
, NULL
, sess
->master_key
,
1585 sess
->master_key_length
, early_secret
)) {
1586 /* SSLfatal() already called */
1591 * Create the handshake hash for the binder key...the messages so far are
1594 mctx
= EVP_MD_CTX_new();
1596 || EVP_DigestInit_ex(mctx
, md
, NULL
) <= 0
1597 || EVP_DigestFinal_ex(mctx
, hash
, NULL
) <= 0) {
1598 SSLfatal(s
, SSL_AD_INTERNAL_ERROR
, ERR_R_INTERNAL_ERROR
);
1602 /* Generate the binder key */
1603 if (!tls13_hkdf_expand(s
, md
, early_secret
, label
, labelsize
, hash
,
1604 hashsize
, binderkey
, hashsize
, 1)) {
1605 /* SSLfatal() already called */
1609 /* Generate the finished key */
1610 if (!tls13_derive_finishedkey(s
, md
, binderkey
, finishedkey
, hashsize
)) {
1611 /* SSLfatal() already called */
1615 if (EVP_DigestInit_ex(mctx
, md
, NULL
) <= 0) {
1616 SSLfatal(s
, SSL_AD_INTERNAL_ERROR
, ERR_R_INTERNAL_ERROR
);
1621 * Get a hash of the ClientHello up to the start of the binders. If we are
1622 * following a HelloRetryRequest then this includes the hash of the first
1623 * ClientHello and the HelloRetryRequest itself.
1625 if (s
->hello_retry_request
== SSL_HRR_PENDING
) {
1630 hdatalen
= hdatalen_l
=
1631 BIO_get_mem_data(s
->s3
.handshake_buffer
, &hdata
);
1632 if (hdatalen_l
<= 0) {
1633 SSLfatal(s
, SSL_AD_INTERNAL_ERROR
, SSL_R_BAD_HANDSHAKE_LENGTH
);
1638 * For servers the handshake buffer data will include the second
1639 * ClientHello - which we don't want - so we need to take that bit off.
1642 PACKET hashprefix
, msg
;
1644 /* Find how many bytes are left after the first two messages */
1645 if (!PACKET_buf_init(&hashprefix
, hdata
, hdatalen
)
1646 || !PACKET_forward(&hashprefix
, 1)
1647 || !PACKET_get_length_prefixed_3(&hashprefix
, &msg
)
1648 || !PACKET_forward(&hashprefix
, 1)
1649 || !PACKET_get_length_prefixed_3(&hashprefix
, &msg
)) {
1650 SSLfatal(s
, SSL_AD_INTERNAL_ERROR
, ERR_R_INTERNAL_ERROR
);
1653 hdatalen
-= PACKET_remaining(&hashprefix
);
1656 if (EVP_DigestUpdate(mctx
, hdata
, hdatalen
) <= 0) {
1657 SSLfatal(s
, SSL_AD_INTERNAL_ERROR
, ERR_R_INTERNAL_ERROR
);
1662 if (EVP_DigestUpdate(mctx
, msgstart
, binderoffset
) <= 0
1663 || EVP_DigestFinal_ex(mctx
, hash
, NULL
) <= 0) {
1664 SSLfatal(s
, SSL_AD_INTERNAL_ERROR
, ERR_R_INTERNAL_ERROR
);
1668 mackey
= EVP_PKEY_new_raw_private_key_ex(sctx
->libctx
, "HMAC",
1669 sctx
->propq
, finishedkey
,
1671 if (mackey
== NULL
) {
1672 SSLfatal(s
, SSL_AD_INTERNAL_ERROR
, ERR_R_INTERNAL_ERROR
);
1677 binderout
= tmpbinder
;
1679 bindersize
= hashsize
;
1680 if (EVP_DigestSignInit_ex(mctx
, NULL
, EVP_MD_get0_name(md
), sctx
->libctx
,
1681 sctx
->propq
, mackey
, NULL
) <= 0
1682 || EVP_DigestSignUpdate(mctx
, hash
, hashsize
) <= 0
1683 || EVP_DigestSignFinal(mctx
, binderout
, &bindersize
) <= 0
1684 || bindersize
!= hashsize
) {
1685 SSLfatal(s
, SSL_AD_INTERNAL_ERROR
, ERR_R_INTERNAL_ERROR
);
1692 /* HMAC keys can't do EVP_DigestVerify* - use CRYPTO_memcmp instead */
1693 ret
= (CRYPTO_memcmp(binderin
, binderout
, hashsize
) == 0);
1695 SSLfatal(s
, SSL_AD_ILLEGAL_PARAMETER
, SSL_R_BINDER_DOES_NOT_VERIFY
);
1699 OPENSSL_cleanse(binderkey
, sizeof(binderkey
));
1700 OPENSSL_cleanse(finishedkey
, sizeof(finishedkey
));
1701 EVP_PKEY_free(mackey
);
1702 EVP_MD_CTX_free(mctx
);
1707 static int final_early_data(SSL_CONNECTION
*s
, unsigned int context
, int sent
)
1713 if (context
== SSL_EXT_TLS1_3_ENCRYPTED_EXTENSIONS
1715 && !s
->ext
.early_data_ok
) {
1717 * If we get here then the server accepted our early_data but we
1718 * later realised that it shouldn't have done (e.g. inconsistent
1721 SSLfatal(s
, SSL_AD_ILLEGAL_PARAMETER
, SSL_R_BAD_EARLY_DATA
);
1728 if (s
->max_early_data
== 0
1730 || s
->early_data_state
!= SSL_EARLY_DATA_ACCEPTING
1731 || !s
->ext
.early_data_ok
1732 || s
->hello_retry_request
!= SSL_HRR_NONE
1733 || (s
->allow_early_data_cb
!= NULL
1734 && !s
->allow_early_data_cb(SSL_CONNECTION_GET_SSL(s
),
1735 s
->allow_early_data_cb_data
))) {
1736 s
->ext
.early_data
= SSL_EARLY_DATA_REJECTED
;
1738 s
->ext
.early_data
= SSL_EARLY_DATA_ACCEPTED
;
1740 if (!tls13_change_cipher_state(s
,
1741 SSL3_CC_EARLY
| SSL3_CHANGE_CIPHER_SERVER_READ
)) {
1742 /* SSLfatal() already called */
1750 static int final_maxfragmentlen(SSL_CONNECTION
*s
, unsigned int context
,
1754 * Session resumption on server-side with MFL extension active
1755 * BUT MFL extension packet was not resent (i.e. sent == 0)
1757 if (s
->server
&& s
->hit
&& USE_MAX_FRAGMENT_LENGTH_EXT(s
->session
)
1759 SSLfatal(s
, SSL_AD_MISSING_EXTENSION
, SSL_R_BAD_EXTENSION
);
1763 if (s
->session
&& USE_MAX_FRAGMENT_LENGTH_EXT(s
->session
)) {
1764 s
->rlayer
.rrlmethod
->set_max_frag_len(s
->rlayer
.rrl
,
1765 GET_MAX_FRAGMENT_LENGTH(s
->session
));
1766 s
->rlayer
.wrlmethod
->set_max_frag_len(s
->rlayer
.wrl
,
1767 ssl_get_max_send_fragment(s
));
1773 static int init_post_handshake_auth(SSL_CONNECTION
*s
,
1774 ossl_unused
unsigned int context
)
1776 s
->post_handshake_auth
= SSL_PHA_NONE
;
1782 * If clients offer "pre_shared_key" without a "psk_key_exchange_modes"
1783 * extension, servers MUST abort the handshake.
1785 static int final_psk(SSL_CONNECTION
*s
, unsigned int context
, int sent
)
1787 if (s
->server
&& sent
&& s
->clienthello
!= NULL
1788 && !s
->clienthello
->pre_proc_exts
[TLSEXT_IDX_psk_kex_modes
].present
) {
1789 SSLfatal(s
, TLS13_AD_MISSING_EXTENSION
,
1790 SSL_R_MISSING_PSK_KEX_MODES_EXTENSION
);
1797 static int tls_init_compress_certificate(SSL_CONNECTION
*sc
, unsigned int context
)
1799 memset(sc
->ext
.compress_certificate_from_peer
, 0,
1800 sizeof(sc
->ext
.compress_certificate_from_peer
));
1804 /* The order these are put into the packet imply a preference order: [brotli, zlib, zstd] */
1805 static EXT_RETURN
tls_construct_compress_certificate(SSL_CONNECTION
*sc
, WPACKET
*pkt
,
1806 unsigned int context
,
1807 X509
*x
, size_t chainidx
)
1809 #ifndef OPENSSL_NO_COMP_ALG
1812 if (!ossl_comp_has_alg(0))
1813 return EXT_RETURN_NOT_SENT
;
1815 /* Server: Don't attempt to compress a non-X509 (i.e. an RPK) */
1816 if (sc
->server
&& sc
->ext
.server_cert_type
!= TLSEXT_cert_type_x509
) {
1817 sc
->cert_comp_prefs
[0] = TLSEXT_comp_cert_none
;
1818 return EXT_RETURN_NOT_SENT
;
1821 /* Client: If we sent a client cert-type extension, don't indicate compression */
1822 if (!sc
->server
&& sc
->ext
.client_cert_type_ctos
) {
1823 sc
->cert_comp_prefs
[0] = TLSEXT_comp_cert_none
;
1824 return EXT_RETURN_NOT_SENT
;
1827 /* Do not indicate we support receiving compressed certificates */
1828 if ((sc
->options
& SSL_OP_NO_RX_CERTIFICATE_COMPRESSION
) != 0)
1829 return EXT_RETURN_NOT_SENT
;
1831 if (sc
->cert_comp_prefs
[0] == TLSEXT_comp_cert_none
)
1832 return EXT_RETURN_NOT_SENT
;
1834 if (!WPACKET_put_bytes_u16(pkt
, TLSEXT_TYPE_compress_certificate
)
1835 || !WPACKET_start_sub_packet_u16(pkt
)
1836 || !WPACKET_start_sub_packet_u8(pkt
))
1839 for (i
= 0; sc
->cert_comp_prefs
[i
] != TLSEXT_comp_cert_none
; i
++) {
1840 if (!WPACKET_put_bytes_u16(pkt
, sc
->cert_comp_prefs
[i
]))
1843 if (!WPACKET_close(pkt
) || !WPACKET_close(pkt
))
1846 sc
->ext
.compress_certificate_sent
= 1;
1847 return EXT_RETURN_SENT
;
1849 SSLfatal(sc
, SSL_AD_INTERNAL_ERROR
, ERR_R_INTERNAL_ERROR
);
1850 return EXT_RETURN_FAIL
;
1852 return EXT_RETURN_NOT_SENT
;
1856 #ifndef OPENSSL_NO_COMP_ALG
1857 static int tls_comp_in_pref(SSL_CONNECTION
*sc
, int alg
)
1861 /* ossl_comp_has_alg() considers 0 as "any" */
1864 /* Make sure algorithm is enabled */
1865 if (!ossl_comp_has_alg(alg
))
1867 /* If no preferences are set, it's ok */
1868 if (sc
->cert_comp_prefs
[0] == TLSEXT_comp_cert_none
)
1870 /* Find the algorithm */
1871 for (i
= 0; i
< TLSEXT_comp_cert_limit
; i
++)
1872 if (sc
->cert_comp_prefs
[i
] == alg
)
1878 int tls_parse_compress_certificate(SSL_CONNECTION
*sc
, PACKET
*pkt
, unsigned int context
,
1879 X509
*x
, size_t chainidx
)
1881 #ifndef OPENSSL_NO_COMP_ALG
1882 PACKET supported_comp_algs
;
1884 int already_set
[TLSEXT_comp_cert_limit
];
1887 /* If no algorithms are available, ignore the extension */
1888 if (!ossl_comp_has_alg(0))
1891 /* Don't attempt to compress a non-X509 (i.e. an RPK) */
1892 if (sc
->server
&& sc
->ext
.server_cert_type
!= TLSEXT_cert_type_x509
)
1894 if (!sc
->server
&& sc
->ext
.client_cert_type
!= TLSEXT_cert_type_x509
)
1897 /* Ignore the extension and don't send compressed certificates */
1898 if ((sc
->options
& SSL_OP_NO_TX_CERTIFICATE_COMPRESSION
) != 0)
1901 if (!PACKET_as_length_prefixed_1(pkt
, &supported_comp_algs
)
1902 || PACKET_remaining(&supported_comp_algs
) == 0) {
1903 SSLfatal(sc
, SSL_AD_DECODE_ERROR
, SSL_R_BAD_EXTENSION
);
1907 memset(already_set
, 0, sizeof(already_set
));
1909 * The preference array has real values, so take a look at each
1910 * value coming in, and make sure it's in our preference list
1911 * The array is 0 (i.e. "none") terminated
1912 * The preference list only contains supported algorithms
1914 while (PACKET_get_net_2(&supported_comp_algs
, &comp
)) {
1915 if (tls_comp_in_pref(sc
, comp
) && !already_set
[comp
]) {
1916 sc
->ext
.compress_certificate_from_peer
[j
++] = comp
;
1917 already_set
[comp
] = 1;
1924 static int init_server_cert_type(SSL_CONNECTION
*sc
, unsigned int context
)
1926 /* Only reset when parsing client hello */
1928 sc
->ext
.server_cert_type_ctos
= OSSL_CERT_TYPE_CTOS_NONE
;
1929 sc
->ext
.server_cert_type
= TLSEXT_cert_type_x509
;
1934 static int init_client_cert_type(SSL_CONNECTION
*sc
, unsigned int context
)
1936 /* Only reset when parsing client hello */
1938 sc
->ext
.client_cert_type_ctos
= OSSL_CERT_TYPE_CTOS_NONE
;
1939 sc
->ext
.client_cert_type
= TLSEXT_cert_type_x509
;