2 * Copyright 2016-2022 The OpenSSL Project Authors. All Rights Reserved.
4 * Licensed under the Apache License 2.0 (the "License"). You may not use
5 * this file except in compliance with the License. You can obtain a copy
6 * in the file LICENSE in the source distribution or at
7 * https://www.openssl.org/source/license.html
10 #include <openssl/ocsp.h>
11 #include "../ssl_local.h"
12 #include "statem_local.h"
13 #include "internal/cryptlib.h"
15 #define COOKIE_STATE_FORMAT_VERSION 1
18 * 2 bytes for packet length, 2 bytes for format version, 2 bytes for
19 * protocol version, 2 bytes for group id, 2 bytes for cipher id, 1 byte for
20 * key_share present flag, 8 bytes for timestamp, 2 bytes for the hashlen,
21 * EVP_MAX_MD_SIZE for transcript hash, 1 byte for app cookie length, app cookie
22 * length bytes, SHA256_DIGEST_LENGTH bytes for the HMAC of the whole thing.
24 #define MAX_COOKIE_SIZE (2 + 2 + 2 + 2 + 2 + 1 + 8 + 2 + EVP_MAX_MD_SIZE + 1 \
25 + SSL_COOKIE_LENGTH + SHA256_DIGEST_LENGTH)
28 * Message header + 2 bytes for protocol version + number of random bytes +
29 * + 1 byte for legacy session id length + number of bytes in legacy session id
30 * + 2 bytes for ciphersuite + 1 byte for legacy compression
31 * + 2 bytes for extension block length + 6 bytes for key_share extension
32 * + 4 bytes for cookie extension header + the number of bytes in the cookie
34 #define MAX_HRR_SIZE (SSL3_HM_HEADER_LENGTH + 2 + SSL3_RANDOM_SIZE + 1 \
35 + SSL_MAX_SSL_SESSION_ID_LENGTH + 2 + 1 + 2 + 6 + 4 \
39 * Parse the client's renegotiation binding and abort if it's not right
41 int tls_parse_ctos_renegotiate(SSL_CONNECTION
*s
, PACKET
*pkt
,
43 X509
*x
, size_t chainidx
)
46 const unsigned char *data
;
48 /* Parse the length byte */
49 if (!PACKET_get_1(pkt
, &ilen
)
50 || !PACKET_get_bytes(pkt
, &data
, ilen
)) {
51 SSLfatal(s
, SSL_AD_DECODE_ERROR
, SSL_R_RENEGOTIATION_ENCODING_ERR
);
55 /* Check that the extension matches */
56 if (ilen
!= s
->s3
.previous_client_finished_len
) {
57 SSLfatal(s
, SSL_AD_HANDSHAKE_FAILURE
, SSL_R_RENEGOTIATION_MISMATCH
);
61 if (memcmp(data
, s
->s3
.previous_client_finished
,
62 s
->s3
.previous_client_finished_len
)) {
63 SSLfatal(s
, SSL_AD_HANDSHAKE_FAILURE
, SSL_R_RENEGOTIATION_MISMATCH
);
67 s
->s3
.send_connection_binding
= 1;
73 * The servername extension is treated as follows:
75 * - Only the hostname type is supported with a maximum length of 255.
76 * - The servername is rejected if too long or if it contains zeros,
77 * in which case an fatal alert is generated.
78 * - The servername field is maintained together with the session cache.
79 * - When a session is resumed, the servername call back invoked in order
80 * to allow the application to position itself to the right context.
81 * - The servername is acknowledged if it is new for a session or when
82 * it is identical to a previously used for the same session.
83 * Applications can control the behaviour. They can at any time
84 * set a 'desirable' servername for a new SSL object. This can be the
85 * case for example with HTTPS when a Host: header field is received and
86 * a renegotiation is requested. In this case, a possible servername
87 * presented in the new client hello is only acknowledged if it matches
88 * the value of the Host: field.
89 * - Applications must use SSL_OP_NO_SESSION_RESUMPTION_ON_RENEGOTIATION
90 * if they provide for changing an explicit servername context for the
91 * session, i.e. when the session has been established with a servername
93 * - On session reconnect, the servername extension may be absent.
95 int tls_parse_ctos_server_name(SSL_CONNECTION
*s
, PACKET
*pkt
,
96 unsigned int context
, X509
*x
, size_t chainidx
)
98 unsigned int servname_type
;
101 if (!PACKET_as_length_prefixed_2(pkt
, &sni
)
102 /* ServerNameList must be at least 1 byte long. */
103 || PACKET_remaining(&sni
) == 0) {
104 SSLfatal(s
, SSL_AD_DECODE_ERROR
, SSL_R_BAD_EXTENSION
);
109 * Although the intent was for server_name to be extensible, RFC 4366
110 * was not clear about it; and so OpenSSL among other implementations,
111 * always and only allows a 'host_name' name types.
112 * RFC 6066 corrected the mistake but adding new name types
113 * is nevertheless no longer feasible, so act as if no other
114 * SNI types can exist, to simplify parsing.
116 * Also note that the RFC permits only one SNI value per type,
117 * i.e., we can only have a single hostname.
119 if (!PACKET_get_1(&sni
, &servname_type
)
120 || servname_type
!= TLSEXT_NAMETYPE_host_name
121 || !PACKET_as_length_prefixed_2(&sni
, &hostname
)) {
122 SSLfatal(s
, SSL_AD_DECODE_ERROR
, SSL_R_BAD_EXTENSION
);
127 * In TLSv1.2 and below the SNI is associated with the session. In TLSv1.3
128 * we always use the SNI value from the handshake.
130 if (!s
->hit
|| SSL_CONNECTION_IS_TLS13(s
)) {
131 if (PACKET_remaining(&hostname
) > TLSEXT_MAXLEN_host_name
) {
132 SSLfatal(s
, SSL_AD_UNRECOGNIZED_NAME
, SSL_R_BAD_EXTENSION
);
136 if (PACKET_contains_zero_byte(&hostname
)) {
137 SSLfatal(s
, SSL_AD_UNRECOGNIZED_NAME
, SSL_R_BAD_EXTENSION
);
142 * Store the requested SNI in the SSL as temporary storage.
143 * If we accept it, it will get stored in the SSL_SESSION as well.
145 OPENSSL_free(s
->ext
.hostname
);
146 s
->ext
.hostname
= NULL
;
147 if (!PACKET_strndup(&hostname
, &s
->ext
.hostname
)) {
148 SSLfatal(s
, SSL_AD_INTERNAL_ERROR
, ERR_R_INTERNAL_ERROR
);
152 s
->servername_done
= 1;
155 * In TLSv1.2 and below we should check if the SNI is consistent between
156 * the initial handshake and the resumption. In TLSv1.3 SNI is not
157 * associated with the session.
159 s
->servername_done
= (s
->session
->ext
.hostname
!= NULL
)
160 && PACKET_equal(&hostname
, s
->session
->ext
.hostname
,
161 strlen(s
->session
->ext
.hostname
));
167 int tls_parse_ctos_maxfragmentlen(SSL_CONNECTION
*s
, PACKET
*pkt
,
168 unsigned int context
,
169 X509
*x
, size_t chainidx
)
173 if (PACKET_remaining(pkt
) != 1 || !PACKET_get_1(pkt
, &value
)) {
174 SSLfatal(s
, SSL_AD_DECODE_ERROR
, SSL_R_BAD_EXTENSION
);
178 /* Received |value| should be a valid max-fragment-length code. */
179 if (!IS_MAX_FRAGMENT_LENGTH_EXT_VALID(value
)) {
180 SSLfatal(s
, SSL_AD_ILLEGAL_PARAMETER
,
181 SSL_R_SSL3_EXT_INVALID_MAX_FRAGMENT_LENGTH
);
186 * RFC 6066: The negotiated length applies for the duration of the session
187 * including session resumptions.
188 * We should receive the same code as in resumed session !
190 if (s
->hit
&& s
->session
->ext
.max_fragment_len_mode
!= value
) {
191 SSLfatal(s
, SSL_AD_ILLEGAL_PARAMETER
,
192 SSL_R_SSL3_EXT_INVALID_MAX_FRAGMENT_LENGTH
);
197 * Store it in session, so it'll become binding for us
198 * and we'll include it in a next Server Hello.
200 s
->session
->ext
.max_fragment_len_mode
= value
;
204 #ifndef OPENSSL_NO_SRP
205 int tls_parse_ctos_srp(SSL_CONNECTION
*s
, PACKET
*pkt
, unsigned int context
,
206 X509
*x
, size_t chainidx
)
210 if (!PACKET_as_length_prefixed_1(pkt
, &srp_I
)
211 || PACKET_contains_zero_byte(&srp_I
)) {
212 SSLfatal(s
, SSL_AD_DECODE_ERROR
, SSL_R_BAD_EXTENSION
);
216 if (!PACKET_strndup(&srp_I
, &s
->srp_ctx
.login
)) {
217 SSLfatal(s
, SSL_AD_INTERNAL_ERROR
, ERR_R_INTERNAL_ERROR
);
225 int tls_parse_ctos_ec_pt_formats(SSL_CONNECTION
*s
, PACKET
*pkt
,
226 unsigned int context
,
227 X509
*x
, size_t chainidx
)
229 PACKET ec_point_format_list
;
231 if (!PACKET_as_length_prefixed_1(pkt
, &ec_point_format_list
)
232 || PACKET_remaining(&ec_point_format_list
) == 0) {
233 SSLfatal(s
, SSL_AD_DECODE_ERROR
, SSL_R_BAD_EXTENSION
);
238 if (!PACKET_memdup(&ec_point_format_list
,
239 &s
->ext
.peer_ecpointformats
,
240 &s
->ext
.peer_ecpointformats_len
)) {
241 SSLfatal(s
, SSL_AD_INTERNAL_ERROR
, ERR_R_INTERNAL_ERROR
);
249 int tls_parse_ctos_session_ticket(SSL_CONNECTION
*s
, PACKET
*pkt
,
250 unsigned int context
,
251 X509
*x
, size_t chainidx
)
253 if (s
->ext
.session_ticket_cb
&&
254 !s
->ext
.session_ticket_cb(SSL_CONNECTION_GET_SSL(s
),
255 PACKET_data(pkt
), PACKET_remaining(pkt
),
256 s
->ext
.session_ticket_cb_arg
)) {
257 SSLfatal(s
, SSL_AD_INTERNAL_ERROR
, ERR_R_INTERNAL_ERROR
);
264 int tls_parse_ctos_sig_algs_cert(SSL_CONNECTION
*s
, PACKET
*pkt
,
265 ossl_unused
unsigned int context
,
267 ossl_unused
size_t chainidx
)
269 PACKET supported_sig_algs
;
271 if (!PACKET_as_length_prefixed_2(pkt
, &supported_sig_algs
)
272 || PACKET_remaining(&supported_sig_algs
) == 0) {
273 SSLfatal(s
, SSL_AD_DECODE_ERROR
, SSL_R_BAD_EXTENSION
);
277 if (!s
->hit
&& !tls1_save_sigalgs(s
, &supported_sig_algs
, 1)) {
278 SSLfatal(s
, SSL_AD_DECODE_ERROR
, SSL_R_BAD_EXTENSION
);
285 int tls_parse_ctos_sig_algs(SSL_CONNECTION
*s
, PACKET
*pkt
,
286 unsigned int context
, X509
*x
, size_t chainidx
)
288 PACKET supported_sig_algs
;
290 if (!PACKET_as_length_prefixed_2(pkt
, &supported_sig_algs
)
291 || PACKET_remaining(&supported_sig_algs
) == 0) {
292 SSLfatal(s
, SSL_AD_DECODE_ERROR
, SSL_R_BAD_EXTENSION
);
296 if (!s
->hit
&& !tls1_save_sigalgs(s
, &supported_sig_algs
, 0)) {
297 SSLfatal(s
, SSL_AD_DECODE_ERROR
, SSL_R_BAD_EXTENSION
);
304 #ifndef OPENSSL_NO_OCSP
305 int tls_parse_ctos_status_request(SSL_CONNECTION
*s
, PACKET
*pkt
,
306 unsigned int context
,
307 X509
*x
, size_t chainidx
)
309 PACKET responder_id_list
, exts
;
311 /* We ignore this in a resumption handshake */
315 /* Not defined if we get one of these in a client Certificate */
319 if (!PACKET_get_1(pkt
, (unsigned int *)&s
->ext
.status_type
)) {
320 SSLfatal(s
, SSL_AD_DECODE_ERROR
, SSL_R_BAD_EXTENSION
);
324 if (s
->ext
.status_type
!= TLSEXT_STATUSTYPE_ocsp
) {
326 * We don't know what to do with any other type so ignore it.
328 s
->ext
.status_type
= TLSEXT_STATUSTYPE_nothing
;
332 if (!PACKET_get_length_prefixed_2 (pkt
, &responder_id_list
)) {
333 SSLfatal(s
, SSL_AD_DECODE_ERROR
, SSL_R_BAD_EXTENSION
);
338 * We remove any OCSP_RESPIDs from a previous handshake
339 * to prevent unbounded memory growth - CVE-2016-6304
341 sk_OCSP_RESPID_pop_free(s
->ext
.ocsp
.ids
, OCSP_RESPID_free
);
342 if (PACKET_remaining(&responder_id_list
) > 0) {
343 s
->ext
.ocsp
.ids
= sk_OCSP_RESPID_new_null();
344 if (s
->ext
.ocsp
.ids
== NULL
) {
345 SSLfatal(s
, SSL_AD_INTERNAL_ERROR
, ERR_R_CRYPTO_LIB
);
349 s
->ext
.ocsp
.ids
= NULL
;
352 while (PACKET_remaining(&responder_id_list
) > 0) {
355 const unsigned char *id_data
;
357 if (!PACKET_get_length_prefixed_2(&responder_id_list
, &responder_id
)
358 || PACKET_remaining(&responder_id
) == 0) {
359 SSLfatal(s
, SSL_AD_DECODE_ERROR
, SSL_R_BAD_EXTENSION
);
363 id_data
= PACKET_data(&responder_id
);
364 id
= d2i_OCSP_RESPID(NULL
, &id_data
,
365 (int)PACKET_remaining(&responder_id
));
367 SSLfatal(s
, SSL_AD_DECODE_ERROR
, SSL_R_BAD_EXTENSION
);
371 if (id_data
!= PACKET_end(&responder_id
)) {
372 OCSP_RESPID_free(id
);
373 SSLfatal(s
, SSL_AD_DECODE_ERROR
, SSL_R_BAD_EXTENSION
);
378 if (!sk_OCSP_RESPID_push(s
->ext
.ocsp
.ids
, id
)) {
379 OCSP_RESPID_free(id
);
380 SSLfatal(s
, SSL_AD_INTERNAL_ERROR
, ERR_R_INTERNAL_ERROR
);
386 /* Read in request_extensions */
387 if (!PACKET_as_length_prefixed_2(pkt
, &exts
)) {
388 SSLfatal(s
, SSL_AD_DECODE_ERROR
, SSL_R_BAD_EXTENSION
);
392 if (PACKET_remaining(&exts
) > 0) {
393 const unsigned char *ext_data
= PACKET_data(&exts
);
395 sk_X509_EXTENSION_pop_free(s
->ext
.ocsp
.exts
,
396 X509_EXTENSION_free
);
398 d2i_X509_EXTENSIONS(NULL
, &ext_data
, (int)PACKET_remaining(&exts
));
399 if (s
->ext
.ocsp
.exts
== NULL
|| ext_data
!= PACKET_end(&exts
)) {
400 SSLfatal(s
, SSL_AD_DECODE_ERROR
, SSL_R_BAD_EXTENSION
);
409 #ifndef OPENSSL_NO_NEXTPROTONEG
410 int tls_parse_ctos_npn(SSL_CONNECTION
*s
, PACKET
*pkt
, unsigned int context
,
411 X509
*x
, size_t chainidx
)
414 * We shouldn't accept this extension on a
417 if (SSL_IS_FIRST_HANDSHAKE(s
))
425 * Save the ALPN extension in a ClientHello.|pkt| holds the contents of the ALPN
426 * extension, not including type and length. Returns: 1 on success, 0 on error.
428 int tls_parse_ctos_alpn(SSL_CONNECTION
*s
, PACKET
*pkt
, unsigned int context
,
429 X509
*x
, size_t chainidx
)
431 PACKET protocol_list
, save_protocol_list
, protocol
;
433 if (!SSL_IS_FIRST_HANDSHAKE(s
))
436 if (!PACKET_as_length_prefixed_2(pkt
, &protocol_list
)
437 || PACKET_remaining(&protocol_list
) < 2) {
438 SSLfatal(s
, SSL_AD_DECODE_ERROR
, SSL_R_BAD_EXTENSION
);
442 save_protocol_list
= protocol_list
;
444 /* Protocol names can't be empty. */
445 if (!PACKET_get_length_prefixed_1(&protocol_list
, &protocol
)
446 || PACKET_remaining(&protocol
) == 0) {
447 SSLfatal(s
, SSL_AD_DECODE_ERROR
, SSL_R_BAD_EXTENSION
);
450 } while (PACKET_remaining(&protocol_list
) != 0);
452 OPENSSL_free(s
->s3
.alpn_proposed
);
453 s
->s3
.alpn_proposed
= NULL
;
454 s
->s3
.alpn_proposed_len
= 0;
455 if (!PACKET_memdup(&save_protocol_list
,
456 &s
->s3
.alpn_proposed
, &s
->s3
.alpn_proposed_len
)) {
457 SSLfatal(s
, SSL_AD_INTERNAL_ERROR
, ERR_R_INTERNAL_ERROR
);
464 #ifndef OPENSSL_NO_SRTP
465 int tls_parse_ctos_use_srtp(SSL_CONNECTION
*s
, PACKET
*pkt
,
466 unsigned int context
, X509
*x
, size_t chainidx
)
468 STACK_OF(SRTP_PROTECTION_PROFILE
) *srvr
;
469 unsigned int ct
, mki_len
, id
;
472 SSL
*ssl
= SSL_CONNECTION_GET_SSL(s
);
474 /* Ignore this if we have no SRTP profiles */
475 if (SSL_get_srtp_profiles(ssl
) == NULL
)
478 /* Pull off the length of the cipher suite list and check it is even */
479 if (!PACKET_get_net_2(pkt
, &ct
) || (ct
& 1) != 0
480 || !PACKET_get_sub_packet(pkt
, &subpkt
, ct
)) {
481 SSLfatal(s
, SSL_AD_DECODE_ERROR
,
482 SSL_R_BAD_SRTP_PROTECTION_PROFILE_LIST
);
486 srvr
= SSL_get_srtp_profiles(ssl
);
487 s
->srtp_profile
= NULL
;
488 /* Search all profiles for a match initially */
489 srtp_pref
= sk_SRTP_PROTECTION_PROFILE_num(srvr
);
491 while (PACKET_remaining(&subpkt
)) {
492 if (!PACKET_get_net_2(&subpkt
, &id
)) {
493 SSLfatal(s
, SSL_AD_DECODE_ERROR
,
494 SSL_R_BAD_SRTP_PROTECTION_PROFILE_LIST
);
499 * Only look for match in profiles of higher preference than
501 * If no profiles have been have been configured then this
504 for (i
= 0; i
< srtp_pref
; i
++) {
505 SRTP_PROTECTION_PROFILE
*sprof
=
506 sk_SRTP_PROTECTION_PROFILE_value(srvr
, i
);
508 if (sprof
->id
== id
) {
509 s
->srtp_profile
= sprof
;
516 /* Now extract the MKI value as a sanity check, but discard it for now */
517 if (!PACKET_get_1(pkt
, &mki_len
)) {
518 SSLfatal(s
, SSL_AD_DECODE_ERROR
,
519 SSL_R_BAD_SRTP_PROTECTION_PROFILE_LIST
);
523 if (!PACKET_forward(pkt
, mki_len
)
524 || PACKET_remaining(pkt
)) {
525 SSLfatal(s
, SSL_AD_DECODE_ERROR
, SSL_R_BAD_SRTP_MKI_VALUE
);
533 int tls_parse_ctos_etm(SSL_CONNECTION
*s
, PACKET
*pkt
, unsigned int context
,
534 X509
*x
, size_t chainidx
)
536 if (!(s
->options
& SSL_OP_NO_ENCRYPT_THEN_MAC
))
543 * Process a psk_kex_modes extension received in the ClientHello. |pkt| contains
544 * the raw PACKET data for the extension. Returns 1 on success or 0 on failure.
546 int tls_parse_ctos_psk_kex_modes(SSL_CONNECTION
*s
, PACKET
*pkt
,
547 unsigned int context
,
548 X509
*x
, size_t chainidx
)
550 #ifndef OPENSSL_NO_TLS1_3
551 PACKET psk_kex_modes
;
554 if (!PACKET_as_length_prefixed_1(pkt
, &psk_kex_modes
)
555 || PACKET_remaining(&psk_kex_modes
) == 0) {
556 SSLfatal(s
, SSL_AD_DECODE_ERROR
, SSL_R_BAD_EXTENSION
);
560 while (PACKET_get_1(&psk_kex_modes
, &mode
)) {
561 if (mode
== TLSEXT_KEX_MODE_KE_DHE
)
562 s
->ext
.psk_kex_mode
|= TLSEXT_KEX_MODE_FLAG_KE_DHE
;
563 else if (mode
== TLSEXT_KEX_MODE_KE
564 && (s
->options
& SSL_OP_ALLOW_NO_DHE_KEX
) != 0)
565 s
->ext
.psk_kex_mode
|= TLSEXT_KEX_MODE_FLAG_KE
;
573 * Process a key_share extension received in the ClientHello. |pkt| contains
574 * the raw PACKET data for the extension. Returns 1 on success or 0 on failure.
576 int tls_parse_ctos_key_share(SSL_CONNECTION
*s
, PACKET
*pkt
,
577 unsigned int context
, X509
*x
, size_t chainidx
)
579 #ifndef OPENSSL_NO_TLS1_3
580 unsigned int group_id
;
581 PACKET key_share_list
, encoded_pt
;
582 const uint16_t *clntgroups
, *srvrgroups
;
583 size_t clnt_num_groups
, srvr_num_groups
;
586 if (s
->hit
&& (s
->ext
.psk_kex_mode
& TLSEXT_KEX_MODE_FLAG_KE_DHE
) == 0)
590 if (s
->s3
.peer_tmp
!= NULL
) {
591 SSLfatal(s
, SSL_AD_INTERNAL_ERROR
, ERR_R_INTERNAL_ERROR
);
595 if (!PACKET_as_length_prefixed_2(pkt
, &key_share_list
)) {
596 SSLfatal(s
, SSL_AD_DECODE_ERROR
, SSL_R_LENGTH_MISMATCH
);
600 /* Get our list of supported groups */
601 tls1_get_supported_groups(s
, &srvrgroups
, &srvr_num_groups
);
602 /* Get the clients list of supported groups. */
603 tls1_get_peer_groups(s
, &clntgroups
, &clnt_num_groups
);
604 if (clnt_num_groups
== 0) {
606 * This can only happen if the supported_groups extension was not sent,
607 * because we verify that the length is non-zero when we process that
610 SSLfatal(s
, SSL_AD_MISSING_EXTENSION
,
611 SSL_R_MISSING_SUPPORTED_GROUPS_EXTENSION
);
615 if (s
->s3
.group_id
!= 0 && PACKET_remaining(&key_share_list
) == 0) {
617 * If we set a group_id already, then we must have sent an HRR
618 * requesting a new key_share. If we haven't got one then that is an
621 SSLfatal(s
, SSL_AD_ILLEGAL_PARAMETER
, SSL_R_BAD_KEY_SHARE
);
625 while (PACKET_remaining(&key_share_list
) > 0) {
626 if (!PACKET_get_net_2(&key_share_list
, &group_id
)
627 || !PACKET_get_length_prefixed_2(&key_share_list
, &encoded_pt
)
628 || PACKET_remaining(&encoded_pt
) == 0) {
629 SSLfatal(s
, SSL_AD_DECODE_ERROR
, SSL_R_LENGTH_MISMATCH
);
634 * If we already found a suitable key_share we loop through the
635 * rest to verify the structure, but don't process them.
641 * If we sent an HRR then the key_share sent back MUST be for the group
642 * we requested, and must be the only key_share sent.
644 if (s
->s3
.group_id
!= 0
645 && (group_id
!= s
->s3
.group_id
646 || PACKET_remaining(&key_share_list
) != 0)) {
647 SSLfatal(s
, SSL_AD_ILLEGAL_PARAMETER
, SSL_R_BAD_KEY_SHARE
);
651 /* Check if this share is in supported_groups sent from client */
652 if (!check_in_list(s
, group_id
, clntgroups
, clnt_num_groups
, 0)) {
653 SSLfatal(s
, SSL_AD_ILLEGAL_PARAMETER
, SSL_R_BAD_KEY_SHARE
);
657 /* Check if this share is for a group we can use */
658 if (!check_in_list(s
, group_id
, srvrgroups
, srvr_num_groups
, 1)) {
659 /* Share not suitable */
663 s
->s3
.group_id
= group_id
;
664 /* Cache the selected group ID in the SSL_SESSION */
665 s
->session
->kex_group
= group_id
;
667 if ((s
->s3
.peer_tmp
= ssl_generate_param_group(s
, group_id
)) == NULL
) {
668 SSLfatal(s
, SSL_AD_INTERNAL_ERROR
,
669 SSL_R_UNABLE_TO_FIND_ECDH_PARAMETERS
);
673 if (tls13_set_encoded_pub_key(s
->s3
.peer_tmp
,
674 PACKET_data(&encoded_pt
),
675 PACKET_remaining(&encoded_pt
)) <= 0) {
676 SSLfatal(s
, SSL_AD_ILLEGAL_PARAMETER
, SSL_R_BAD_ECPOINT
);
687 int tls_parse_ctos_cookie(SSL_CONNECTION
*s
, PACKET
*pkt
, unsigned int context
,
688 X509
*x
, size_t chainidx
)
690 #ifndef OPENSSL_NO_TLS1_3
691 unsigned int format
, version
, key_share
, group_id
;
694 PACKET cookie
, raw
, chhash
, appcookie
;
696 const unsigned char *data
, *mdin
, *ciphdata
;
697 unsigned char hmac
[SHA256_DIGEST_LENGTH
];
698 unsigned char hrr
[MAX_HRR_SIZE
];
699 size_t rawlen
, hmaclen
, hrrlen
, ciphlen
;
701 SSL
*ssl
= SSL_CONNECTION_GET_SSL(s
);
702 SSL_CTX
*sctx
= SSL_CONNECTION_GET_CTX(s
);
704 /* Ignore any cookie if we're not set up to verify it */
705 if (sctx
->verify_stateless_cookie_cb
== NULL
706 || (s
->s3
.flags
& TLS1_FLAGS_STATELESS
) == 0)
709 if (!PACKET_as_length_prefixed_2(pkt
, &cookie
)) {
710 SSLfatal(s
, SSL_AD_DECODE_ERROR
, SSL_R_LENGTH_MISMATCH
);
715 data
= PACKET_data(&raw
);
716 rawlen
= PACKET_remaining(&raw
);
717 if (rawlen
< SHA256_DIGEST_LENGTH
718 || !PACKET_forward(&raw
, rawlen
- SHA256_DIGEST_LENGTH
)) {
719 SSLfatal(s
, SSL_AD_DECODE_ERROR
, SSL_R_LENGTH_MISMATCH
);
722 mdin
= PACKET_data(&raw
);
724 /* Verify the HMAC of the cookie */
725 hctx
= EVP_MD_CTX_create();
726 pkey
= EVP_PKEY_new_raw_private_key_ex(sctx
->libctx
, "HMAC",
728 s
->session_ctx
->ext
.cookie_hmac_key
,
729 sizeof(s
->session_ctx
->ext
.cookie_hmac_key
));
730 if (hctx
== NULL
|| pkey
== NULL
) {
731 EVP_MD_CTX_free(hctx
);
733 SSLfatal(s
, SSL_AD_INTERNAL_ERROR
, ERR_R_EVP_LIB
);
737 hmaclen
= SHA256_DIGEST_LENGTH
;
738 if (EVP_DigestSignInit_ex(hctx
, NULL
, "SHA2-256", sctx
->libctx
,
739 sctx
->propq
, pkey
, NULL
) <= 0
740 || EVP_DigestSign(hctx
, hmac
, &hmaclen
, data
,
741 rawlen
- SHA256_DIGEST_LENGTH
) <= 0
742 || hmaclen
!= SHA256_DIGEST_LENGTH
) {
743 EVP_MD_CTX_free(hctx
);
745 SSLfatal(s
, SSL_AD_INTERNAL_ERROR
, ERR_R_INTERNAL_ERROR
);
749 EVP_MD_CTX_free(hctx
);
752 if (CRYPTO_memcmp(hmac
, mdin
, SHA256_DIGEST_LENGTH
) != 0) {
753 SSLfatal(s
, SSL_AD_ILLEGAL_PARAMETER
, SSL_R_COOKIE_MISMATCH
);
757 if (!PACKET_get_net_2(&cookie
, &format
)) {
758 SSLfatal(s
, SSL_AD_DECODE_ERROR
, SSL_R_LENGTH_MISMATCH
);
761 /* Check the cookie format is something we recognise. Ignore it if not */
762 if (format
!= COOKIE_STATE_FORMAT_VERSION
)
766 * The rest of these checks really shouldn't fail since we have verified the
770 /* Check the version number is sane */
771 if (!PACKET_get_net_2(&cookie
, &version
)) {
772 SSLfatal(s
, SSL_AD_DECODE_ERROR
, SSL_R_LENGTH_MISMATCH
);
775 if (version
!= TLS1_3_VERSION
) {
776 SSLfatal(s
, SSL_AD_ILLEGAL_PARAMETER
,
777 SSL_R_BAD_PROTOCOL_VERSION_NUMBER
);
781 if (!PACKET_get_net_2(&cookie
, &group_id
)) {
782 SSLfatal(s
, SSL_AD_DECODE_ERROR
, SSL_R_LENGTH_MISMATCH
);
786 ciphdata
= PACKET_data(&cookie
);
787 if (!PACKET_forward(&cookie
, 2)) {
788 SSLfatal(s
, SSL_AD_DECODE_ERROR
, SSL_R_LENGTH_MISMATCH
);
791 if (group_id
!= s
->s3
.group_id
792 || s
->s3
.tmp
.new_cipher
793 != ssl_get_cipher_by_char(s
, ciphdata
, 0)) {
795 * We chose a different cipher or group id this time around to what is
796 * in the cookie. Something must have changed.
798 SSLfatal(s
, SSL_AD_ILLEGAL_PARAMETER
, SSL_R_BAD_CIPHER
);
802 if (!PACKET_get_1(&cookie
, &key_share
)
803 || !PACKET_get_net_8(&cookie
, &tm
)
804 || !PACKET_get_length_prefixed_2(&cookie
, &chhash
)
805 || !PACKET_get_length_prefixed_1(&cookie
, &appcookie
)
806 || PACKET_remaining(&cookie
) != SHA256_DIGEST_LENGTH
) {
807 SSLfatal(s
, SSL_AD_DECODE_ERROR
, SSL_R_LENGTH_MISMATCH
);
811 /* We tolerate a cookie age of up to 10 minutes (= 60 * 10 seconds) */
813 if (tm
> now
|| (now
- tm
) > 600) {
814 /* Cookie is stale. Ignore it */
818 /* Verify the app cookie */
819 if (sctx
->verify_stateless_cookie_cb(ssl
,
820 PACKET_data(&appcookie
),
821 PACKET_remaining(&appcookie
)) == 0) {
822 SSLfatal(s
, SSL_AD_ILLEGAL_PARAMETER
, SSL_R_COOKIE_MISMATCH
);
827 * Reconstruct the HRR that we would have sent in response to the original
828 * ClientHello so we can add it to the transcript hash.
829 * Note: This won't work with custom HRR extensions
831 if (!WPACKET_init_static_len(&hrrpkt
, hrr
, sizeof(hrr
), 0)) {
832 SSLfatal(s
, SSL_AD_INTERNAL_ERROR
, ERR_R_INTERNAL_ERROR
);
835 if (!WPACKET_put_bytes_u8(&hrrpkt
, SSL3_MT_SERVER_HELLO
)
836 || !WPACKET_start_sub_packet_u24(&hrrpkt
)
837 || !WPACKET_put_bytes_u16(&hrrpkt
, TLS1_2_VERSION
)
838 || !WPACKET_memcpy(&hrrpkt
, hrrrandom
, SSL3_RANDOM_SIZE
)
839 || !WPACKET_sub_memcpy_u8(&hrrpkt
, s
->tmp_session_id
,
840 s
->tmp_session_id_len
)
841 || !ssl
->method
->put_cipher_by_char(s
->s3
.tmp
.new_cipher
, &hrrpkt
,
843 || !WPACKET_put_bytes_u8(&hrrpkt
, 0)
844 || !WPACKET_start_sub_packet_u16(&hrrpkt
)) {
845 WPACKET_cleanup(&hrrpkt
);
846 SSLfatal(s
, SSL_AD_INTERNAL_ERROR
, ERR_R_INTERNAL_ERROR
);
849 if (!WPACKET_put_bytes_u16(&hrrpkt
, TLSEXT_TYPE_supported_versions
)
850 || !WPACKET_start_sub_packet_u16(&hrrpkt
)
851 || !WPACKET_put_bytes_u16(&hrrpkt
, s
->version
)
852 || !WPACKET_close(&hrrpkt
)) {
853 WPACKET_cleanup(&hrrpkt
);
854 SSLfatal(s
, SSL_AD_INTERNAL_ERROR
, ERR_R_INTERNAL_ERROR
);
858 if (!WPACKET_put_bytes_u16(&hrrpkt
, TLSEXT_TYPE_key_share
)
859 || !WPACKET_start_sub_packet_u16(&hrrpkt
)
860 || !WPACKET_put_bytes_u16(&hrrpkt
, s
->s3
.group_id
)
861 || !WPACKET_close(&hrrpkt
)) {
862 WPACKET_cleanup(&hrrpkt
);
863 SSLfatal(s
, SSL_AD_INTERNAL_ERROR
, ERR_R_INTERNAL_ERROR
);
867 if (!WPACKET_put_bytes_u16(&hrrpkt
, TLSEXT_TYPE_cookie
)
868 || !WPACKET_start_sub_packet_u16(&hrrpkt
)
869 || !WPACKET_sub_memcpy_u16(&hrrpkt
, data
, rawlen
)
870 || !WPACKET_close(&hrrpkt
) /* cookie extension */
871 || !WPACKET_close(&hrrpkt
) /* extension block */
872 || !WPACKET_close(&hrrpkt
) /* message */
873 || !WPACKET_get_total_written(&hrrpkt
, &hrrlen
)
874 || !WPACKET_finish(&hrrpkt
)) {
875 WPACKET_cleanup(&hrrpkt
);
876 SSLfatal(s
, SSL_AD_INTERNAL_ERROR
, ERR_R_INTERNAL_ERROR
);
880 /* Reconstruct the transcript hash */
881 if (!create_synthetic_message_hash(s
, PACKET_data(&chhash
),
882 PACKET_remaining(&chhash
), hrr
,
884 /* SSLfatal() already called */
888 /* Act as if this ClientHello came after a HelloRetryRequest */
889 s
->hello_retry_request
= 1;
897 int tls_parse_ctos_supported_groups(SSL_CONNECTION
*s
, PACKET
*pkt
,
898 unsigned int context
,
899 X509
*x
, size_t chainidx
)
901 PACKET supported_groups_list
;
903 /* Each group is 2 bytes and we must have at least 1. */
904 if (!PACKET_as_length_prefixed_2(pkt
, &supported_groups_list
)
905 || PACKET_remaining(&supported_groups_list
) == 0
906 || (PACKET_remaining(&supported_groups_list
) % 2) != 0) {
907 SSLfatal(s
, SSL_AD_DECODE_ERROR
, SSL_R_BAD_EXTENSION
);
911 if (!s
->hit
|| SSL_CONNECTION_IS_TLS13(s
)) {
912 OPENSSL_free(s
->ext
.peer_supportedgroups
);
913 s
->ext
.peer_supportedgroups
= NULL
;
914 s
->ext
.peer_supportedgroups_len
= 0;
915 if (!tls1_save_u16(&supported_groups_list
,
916 &s
->ext
.peer_supportedgroups
,
917 &s
->ext
.peer_supportedgroups_len
)) {
918 SSLfatal(s
, SSL_AD_INTERNAL_ERROR
, ERR_R_INTERNAL_ERROR
);
926 int tls_parse_ctos_ems(SSL_CONNECTION
*s
, PACKET
*pkt
, unsigned int context
,
927 X509
*x
, size_t chainidx
)
929 /* The extension must always be empty */
930 if (PACKET_remaining(pkt
) != 0) {
931 SSLfatal(s
, SSL_AD_DECODE_ERROR
, SSL_R_BAD_EXTENSION
);
935 if (s
->options
& SSL_OP_NO_EXTENDED_MASTER_SECRET
)
938 s
->s3
.flags
|= TLS1_FLAGS_RECEIVED_EXTMS
;
944 int tls_parse_ctos_early_data(SSL_CONNECTION
*s
, PACKET
*pkt
, unsigned int context
,
945 X509
*x
, size_t chainidx
)
947 if (PACKET_remaining(pkt
) != 0) {
948 SSLfatal(s
, SSL_AD_DECODE_ERROR
, SSL_R_BAD_EXTENSION
);
952 if (s
->hello_retry_request
!= SSL_HRR_NONE
) {
953 SSLfatal(s
, SSL_AD_ILLEGAL_PARAMETER
, SSL_R_BAD_EXTENSION
);
960 static SSL_TICKET_STATUS
tls_get_stateful_ticket(SSL_CONNECTION
*s
, PACKET
*tick
,
963 SSL_SESSION
*tmpsess
= NULL
;
965 s
->ext
.ticket_expected
= 1;
967 switch (PACKET_remaining(tick
)) {
969 return SSL_TICKET_EMPTY
;
971 case SSL_MAX_SSL_SESSION_ID_LENGTH
:
975 return SSL_TICKET_NO_DECRYPT
;
978 tmpsess
= lookup_sess_in_cache(s
, PACKET_data(tick
),
979 SSL_MAX_SSL_SESSION_ID_LENGTH
);
982 return SSL_TICKET_NO_DECRYPT
;
985 return SSL_TICKET_SUCCESS
;
988 int tls_parse_ctos_psk(SSL_CONNECTION
*s
, PACKET
*pkt
, unsigned int context
,
989 X509
*x
, size_t chainidx
)
991 PACKET identities
, binders
, binder
;
992 size_t binderoffset
, hashsize
;
993 SSL_SESSION
*sess
= NULL
;
994 unsigned int id
, i
, ext
= 0;
995 const EVP_MD
*md
= NULL
;
996 SSL_CTX
*sctx
= SSL_CONNECTION_GET_CTX(s
);
997 SSL
*ssl
= SSL_CONNECTION_GET_SSL(s
);
1000 * If we have no PSK kex mode that we recognise then we can't resume so
1001 * ignore this extension
1003 if ((s
->ext
.psk_kex_mode
1004 & (TLSEXT_KEX_MODE_FLAG_KE
| TLSEXT_KEX_MODE_FLAG_KE_DHE
)) == 0)
1007 if (!PACKET_get_length_prefixed_2(pkt
, &identities
)) {
1008 SSLfatal(s
, SSL_AD_DECODE_ERROR
, SSL_R_BAD_EXTENSION
);
1012 s
->ext
.ticket_expected
= 0;
1013 for (id
= 0; PACKET_remaining(&identities
) != 0; id
++) {
1015 unsigned long ticket_agel
;
1018 if (!PACKET_get_length_prefixed_2(&identities
, &identity
)
1019 || !PACKET_get_net_4(&identities
, &ticket_agel
)) {
1020 SSLfatal(s
, SSL_AD_DECODE_ERROR
, SSL_R_BAD_EXTENSION
);
1024 idlen
= PACKET_remaining(&identity
);
1025 if (s
->psk_find_session_cb
!= NULL
1026 && !s
->psk_find_session_cb(ssl
, PACKET_data(&identity
), idlen
,
1028 SSLfatal(s
, SSL_AD_INTERNAL_ERROR
, SSL_R_BAD_EXTENSION
);
1032 #ifndef OPENSSL_NO_PSK
1034 && s
->psk_server_callback
!= NULL
1035 && idlen
<= PSK_MAX_IDENTITY_LEN
) {
1037 unsigned char pskdata
[PSK_MAX_PSK_LEN
];
1038 unsigned int pskdatalen
;
1040 if (!PACKET_strndup(&identity
, &pskid
)) {
1041 SSLfatal(s
, SSL_AD_INTERNAL_ERROR
, ERR_R_INTERNAL_ERROR
);
1044 pskdatalen
= s
->psk_server_callback(ssl
, pskid
, pskdata
,
1046 OPENSSL_free(pskid
);
1047 if (pskdatalen
> PSK_MAX_PSK_LEN
) {
1048 SSLfatal(s
, SSL_AD_INTERNAL_ERROR
, ERR_R_INTERNAL_ERROR
);
1050 } else if (pskdatalen
> 0) {
1051 const SSL_CIPHER
*cipher
;
1052 const unsigned char tls13_aes128gcmsha256_id
[] = { 0x13, 0x01 };
1055 * We found a PSK using an old style callback. We don't know
1056 * the digest so we default to SHA256 as per the TLSv1.3 spec
1058 cipher
= SSL_CIPHER_find(ssl
, tls13_aes128gcmsha256_id
);
1059 if (cipher
== NULL
) {
1060 OPENSSL_cleanse(pskdata
, pskdatalen
);
1061 SSLfatal(s
, SSL_AD_INTERNAL_ERROR
, ERR_R_INTERNAL_ERROR
);
1065 sess
= SSL_SESSION_new();
1067 || !SSL_SESSION_set1_master_key(sess
, pskdata
,
1069 || !SSL_SESSION_set_cipher(sess
, cipher
)
1070 || !SSL_SESSION_set_protocol_version(sess
,
1072 OPENSSL_cleanse(pskdata
, pskdatalen
);
1073 SSLfatal(s
, SSL_AD_INTERNAL_ERROR
, ERR_R_INTERNAL_ERROR
);
1076 OPENSSL_cleanse(pskdata
, pskdatalen
);
1079 #endif /* OPENSSL_NO_PSK */
1082 /* We found a PSK */
1083 SSL_SESSION
*sesstmp
= ssl_session_dup(sess
, 0);
1085 if (sesstmp
== NULL
) {
1086 SSLfatal(s
, SSL_AD_INTERNAL_ERROR
, ERR_R_INTERNAL_ERROR
);
1089 SSL_SESSION_free(sess
);
1093 * We've just been told to use this session for this context so
1094 * make sure the sid_ctx matches up.
1096 memcpy(sess
->sid_ctx
, s
->sid_ctx
, s
->sid_ctx_length
);
1097 sess
->sid_ctx_length
= s
->sid_ctx_length
;
1100 s
->ext
.early_data_ok
= 1;
1101 s
->ext
.ticket_expected
= 1;
1103 OSSL_TIME t
, age
, expire
;
1107 * If we are using anti-replay protection then we behave as if
1108 * SSL_OP_NO_TICKET is set - we are caching tickets anyway so there
1109 * is no point in using full stateless tickets.
1111 if ((s
->options
& SSL_OP_NO_TICKET
) != 0
1112 || (s
->max_early_data
> 0
1113 && (s
->options
& SSL_OP_NO_ANTI_REPLAY
) == 0))
1114 ret
= tls_get_stateful_ticket(s
, &identity
, &sess
);
1116 ret
= tls_decrypt_ticket(s
, PACKET_data(&identity
),
1117 PACKET_remaining(&identity
), NULL
, 0,
1120 if (ret
== SSL_TICKET_EMPTY
) {
1121 SSLfatal(s
, SSL_AD_DECODE_ERROR
, SSL_R_BAD_EXTENSION
);
1125 if (ret
== SSL_TICKET_FATAL_ERR_MALLOC
1126 || ret
== SSL_TICKET_FATAL_ERR_OTHER
) {
1127 SSLfatal(s
, SSL_AD_INTERNAL_ERROR
, ERR_R_INTERNAL_ERROR
);
1130 if (ret
== SSL_TICKET_NONE
|| ret
== SSL_TICKET_NO_DECRYPT
)
1133 /* Check for replay */
1134 if (s
->max_early_data
> 0
1135 && (s
->options
& SSL_OP_NO_ANTI_REPLAY
) == 0
1136 && !SSL_CTX_remove_session(s
->session_ctx
, sess
)) {
1137 SSL_SESSION_free(sess
);
1142 age
= ossl_time_subtract(ossl_seconds2time(ticket_agel
),
1143 ossl_seconds2time(sess
->ext
.tick_age_add
));
1144 t
= ossl_time_subtract(ossl_time_now(), sess
->time
);
1147 * Beause we use second granuality, it could appear that
1148 * the client's ticket age is longer than ours (our ticket
1149 * age calculation should always be slightly longer than the
1150 * client's due to the network latency). Therefore we add
1151 * 1000ms to our age calculation to adjust for rounding errors.
1153 expire
= ossl_time_add(t
, ossl_ms2time(1000));
1156 && ossl_time_compare(sess
->timeout
, t
) >= 0
1157 && ossl_time_compare(age
, expire
) <= 0
1158 && ossl_time_compare(ossl_time_add(age
, TICKET_AGE_ALLOWANCE
),
1161 * Ticket age is within tolerance and not expired. We allow it
1164 s
->ext
.early_data_ok
= 1;
1168 md
= ssl_md(sctx
, sess
->cipher
->algorithm2
);
1170 SSLfatal(s
, SSL_AD_INTERNAL_ERROR
, ERR_R_INTERNAL_ERROR
);
1173 if (!EVP_MD_is_a(md
,
1174 EVP_MD_get0_name(ssl_md(sctx
,
1175 s
->s3
.tmp
.new_cipher
->algorithm2
)))) {
1176 /* The ciphersuite is not compatible with this session. */
1177 SSL_SESSION_free(sess
);
1179 s
->ext
.early_data_ok
= 0;
1180 s
->ext
.ticket_expected
= 0;
1189 binderoffset
= PACKET_data(pkt
) - (const unsigned char *)s
->init_buf
->data
;
1190 hashsize
= EVP_MD_get_size(md
);
1192 if (!PACKET_get_length_prefixed_2(pkt
, &binders
)) {
1193 SSLfatal(s
, SSL_AD_DECODE_ERROR
, SSL_R_BAD_EXTENSION
);
1197 for (i
= 0; i
<= id
; i
++) {
1198 if (!PACKET_get_length_prefixed_1(&binders
, &binder
)) {
1199 SSLfatal(s
, SSL_AD_DECODE_ERROR
, SSL_R_BAD_EXTENSION
);
1204 if (PACKET_remaining(&binder
) != hashsize
) {
1205 SSLfatal(s
, SSL_AD_DECODE_ERROR
, SSL_R_BAD_EXTENSION
);
1208 if (tls_psk_do_binder(s
, md
, (const unsigned char *)s
->init_buf
->data
,
1209 binderoffset
, PACKET_data(&binder
), NULL
, sess
, 0,
1211 /* SSLfatal() already called */
1215 s
->ext
.tick_identity
= id
;
1217 SSL_SESSION_free(s
->session
);
1221 SSL_SESSION_free(sess
);
1225 int tls_parse_ctos_post_handshake_auth(SSL_CONNECTION
*s
, PACKET
*pkt
,
1226 ossl_unused
unsigned int context
,
1227 ossl_unused X509
*x
,
1228 ossl_unused
size_t chainidx
)
1230 if (PACKET_remaining(pkt
) != 0) {
1231 SSLfatal(s
, SSL_AD_DECODE_ERROR
,
1232 SSL_R_POST_HANDSHAKE_AUTH_ENCODING_ERR
);
1236 s
->post_handshake_auth
= SSL_PHA_EXT_RECEIVED
;
1242 * Add the server's renegotiation binding
1244 EXT_RETURN
tls_construct_stoc_renegotiate(SSL_CONNECTION
*s
, WPACKET
*pkt
,
1245 unsigned int context
, X509
*x
,
1248 if (!s
->s3
.send_connection_binding
)
1249 return EXT_RETURN_NOT_SENT
;
1251 /* Still add this even if SSL_OP_NO_RENEGOTIATION is set */
1252 if (!WPACKET_put_bytes_u16(pkt
, TLSEXT_TYPE_renegotiate
)
1253 || !WPACKET_start_sub_packet_u16(pkt
)
1254 || !WPACKET_start_sub_packet_u8(pkt
)
1255 || !WPACKET_memcpy(pkt
, s
->s3
.previous_client_finished
,
1256 s
->s3
.previous_client_finished_len
)
1257 || !WPACKET_memcpy(pkt
, s
->s3
.previous_server_finished
,
1258 s
->s3
.previous_server_finished_len
)
1259 || !WPACKET_close(pkt
)
1260 || !WPACKET_close(pkt
)) {
1261 SSLfatal(s
, SSL_AD_INTERNAL_ERROR
, ERR_R_INTERNAL_ERROR
);
1262 return EXT_RETURN_FAIL
;
1265 return EXT_RETURN_SENT
;
1268 EXT_RETURN
tls_construct_stoc_server_name(SSL_CONNECTION
*s
, WPACKET
*pkt
,
1269 unsigned int context
, X509
*x
,
1272 if (s
->servername_done
!= 1)
1273 return EXT_RETURN_NOT_SENT
;
1276 * Prior to TLSv1.3 we ignore any SNI in the current handshake if resuming.
1277 * We just use the servername from the initial handshake.
1279 if (s
->hit
&& !SSL_CONNECTION_IS_TLS13(s
))
1280 return EXT_RETURN_NOT_SENT
;
1282 if (!WPACKET_put_bytes_u16(pkt
, TLSEXT_TYPE_server_name
)
1283 || !WPACKET_put_bytes_u16(pkt
, 0)) {
1284 SSLfatal(s
, SSL_AD_INTERNAL_ERROR
, ERR_R_INTERNAL_ERROR
);
1285 return EXT_RETURN_FAIL
;
1288 return EXT_RETURN_SENT
;
1291 /* Add/include the server's max fragment len extension into ServerHello */
1292 EXT_RETURN
tls_construct_stoc_maxfragmentlen(SSL_CONNECTION
*s
, WPACKET
*pkt
,
1293 unsigned int context
, X509
*x
,
1296 if (!USE_MAX_FRAGMENT_LENGTH_EXT(s
->session
))
1297 return EXT_RETURN_NOT_SENT
;
1300 * 4 bytes for this extension type and extension length
1301 * 1 byte for the Max Fragment Length code value.
1303 if (!WPACKET_put_bytes_u16(pkt
, TLSEXT_TYPE_max_fragment_length
)
1304 || !WPACKET_start_sub_packet_u16(pkt
)
1305 || !WPACKET_put_bytes_u8(pkt
, s
->session
->ext
.max_fragment_len_mode
)
1306 || !WPACKET_close(pkt
)) {
1307 SSLfatal(s
, SSL_AD_INTERNAL_ERROR
, ERR_R_INTERNAL_ERROR
);
1308 return EXT_RETURN_FAIL
;
1311 return EXT_RETURN_SENT
;
1314 EXT_RETURN
tls_construct_stoc_ec_pt_formats(SSL_CONNECTION
*s
, WPACKET
*pkt
,
1315 unsigned int context
, X509
*x
,
1318 unsigned long alg_k
= s
->s3
.tmp
.new_cipher
->algorithm_mkey
;
1319 unsigned long alg_a
= s
->s3
.tmp
.new_cipher
->algorithm_auth
;
1320 int using_ecc
= ((alg_k
& SSL_kECDHE
) || (alg_a
& SSL_aECDSA
))
1321 && (s
->ext
.peer_ecpointformats
!= NULL
);
1322 const unsigned char *plist
;
1326 return EXT_RETURN_NOT_SENT
;
1328 tls1_get_formatlist(s
, &plist
, &plistlen
);
1329 if (!WPACKET_put_bytes_u16(pkt
, TLSEXT_TYPE_ec_point_formats
)
1330 || !WPACKET_start_sub_packet_u16(pkt
)
1331 || !WPACKET_sub_memcpy_u8(pkt
, plist
, plistlen
)
1332 || !WPACKET_close(pkt
)) {
1333 SSLfatal(s
, SSL_AD_INTERNAL_ERROR
, ERR_R_INTERNAL_ERROR
);
1334 return EXT_RETURN_FAIL
;
1337 return EXT_RETURN_SENT
;
1340 EXT_RETURN
tls_construct_stoc_supported_groups(SSL_CONNECTION
*s
, WPACKET
*pkt
,
1341 unsigned int context
, X509
*x
,
1344 const uint16_t *groups
;
1345 size_t numgroups
, i
, first
= 1;
1348 /* s->s3.group_id is non zero if we accepted a key_share */
1349 if (s
->s3
.group_id
== 0)
1350 return EXT_RETURN_NOT_SENT
;
1352 /* Get our list of supported groups */
1353 tls1_get_supported_groups(s
, &groups
, &numgroups
);
1354 if (numgroups
== 0) {
1355 SSLfatal(s
, SSL_AD_INTERNAL_ERROR
, ERR_R_INTERNAL_ERROR
);
1356 return EXT_RETURN_FAIL
;
1359 /* Copy group ID if supported */
1360 version
= SSL_version(SSL_CONNECTION_GET_SSL(s
));
1361 for (i
= 0; i
< numgroups
; i
++) {
1362 uint16_t group
= groups
[i
];
1364 if (tls_valid_group(s
, group
, version
, version
, 0, NULL
)
1365 && tls_group_allowed(s
, group
, SSL_SECOP_CURVE_SUPPORTED
)) {
1368 * Check if the client is already using our preferred group. If
1369 * so we don't need to add this extension
1371 if (s
->s3
.group_id
== group
)
1372 return EXT_RETURN_NOT_SENT
;
1374 /* Add extension header */
1375 if (!WPACKET_put_bytes_u16(pkt
, TLSEXT_TYPE_supported_groups
)
1376 /* Sub-packet for supported_groups extension */
1377 || !WPACKET_start_sub_packet_u16(pkt
)
1378 || !WPACKET_start_sub_packet_u16(pkt
)) {
1379 SSLfatal(s
, SSL_AD_INTERNAL_ERROR
, ERR_R_INTERNAL_ERROR
);
1380 return EXT_RETURN_FAIL
;
1385 if (!WPACKET_put_bytes_u16(pkt
, group
)) {
1386 SSLfatal(s
, SSL_AD_INTERNAL_ERROR
, ERR_R_INTERNAL_ERROR
);
1387 return EXT_RETURN_FAIL
;
1392 if (!WPACKET_close(pkt
) || !WPACKET_close(pkt
)) {
1393 SSLfatal(s
, SSL_AD_INTERNAL_ERROR
, ERR_R_INTERNAL_ERROR
);
1394 return EXT_RETURN_FAIL
;
1397 return EXT_RETURN_SENT
;
1400 EXT_RETURN
tls_construct_stoc_session_ticket(SSL_CONNECTION
*s
, WPACKET
*pkt
,
1401 unsigned int context
, X509
*x
,
1404 if (!s
->ext
.ticket_expected
|| !tls_use_ticket(s
)) {
1405 s
->ext
.ticket_expected
= 0;
1406 return EXT_RETURN_NOT_SENT
;
1409 if (!WPACKET_put_bytes_u16(pkt
, TLSEXT_TYPE_session_ticket
)
1410 || !WPACKET_put_bytes_u16(pkt
, 0)) {
1411 SSLfatal(s
, SSL_AD_INTERNAL_ERROR
, ERR_R_INTERNAL_ERROR
);
1412 return EXT_RETURN_FAIL
;
1415 return EXT_RETURN_SENT
;
1418 #ifndef OPENSSL_NO_OCSP
1419 EXT_RETURN
tls_construct_stoc_status_request(SSL_CONNECTION
*s
, WPACKET
*pkt
,
1420 unsigned int context
, X509
*x
,
1423 /* We don't currently support this extension inside a CertificateRequest */
1424 if (context
== SSL_EXT_TLS1_3_CERTIFICATE_REQUEST
)
1425 return EXT_RETURN_NOT_SENT
;
1427 if (!s
->ext
.status_expected
)
1428 return EXT_RETURN_NOT_SENT
;
1430 if (SSL_CONNECTION_IS_TLS13(s
) && chainidx
!= 0)
1431 return EXT_RETURN_NOT_SENT
;
1433 if (!WPACKET_put_bytes_u16(pkt
, TLSEXT_TYPE_status_request
)
1434 || !WPACKET_start_sub_packet_u16(pkt
)) {
1435 SSLfatal(s
, SSL_AD_INTERNAL_ERROR
, ERR_R_INTERNAL_ERROR
);
1436 return EXT_RETURN_FAIL
;
1440 * In TLSv1.3 we include the certificate status itself. In <= TLSv1.2 we
1441 * send back an empty extension, with the certificate status appearing as a
1444 if (SSL_CONNECTION_IS_TLS13(s
) && !tls_construct_cert_status_body(s
, pkt
)) {
1445 /* SSLfatal() already called */
1446 return EXT_RETURN_FAIL
;
1448 if (!WPACKET_close(pkt
)) {
1449 SSLfatal(s
, SSL_AD_INTERNAL_ERROR
, ERR_R_INTERNAL_ERROR
);
1450 return EXT_RETURN_FAIL
;
1453 return EXT_RETURN_SENT
;
1457 #ifndef OPENSSL_NO_NEXTPROTONEG
1458 EXT_RETURN
tls_construct_stoc_next_proto_neg(SSL_CONNECTION
*s
, WPACKET
*pkt
,
1459 unsigned int context
, X509
*x
,
1462 const unsigned char *npa
;
1463 unsigned int npalen
;
1465 int npn_seen
= s
->s3
.npn_seen
;
1466 SSL_CTX
*sctx
= SSL_CONNECTION_GET_CTX(s
);
1469 if (!npn_seen
|| sctx
->ext
.npn_advertised_cb
== NULL
)
1470 return EXT_RETURN_NOT_SENT
;
1472 ret
= sctx
->ext
.npn_advertised_cb(SSL_CONNECTION_GET_SSL(s
), &npa
, &npalen
,
1473 sctx
->ext
.npn_advertised_cb_arg
);
1474 if (ret
== SSL_TLSEXT_ERR_OK
) {
1475 if (!WPACKET_put_bytes_u16(pkt
, TLSEXT_TYPE_next_proto_neg
)
1476 || !WPACKET_sub_memcpy_u16(pkt
, npa
, npalen
)) {
1477 SSLfatal(s
, SSL_AD_INTERNAL_ERROR
, ERR_R_INTERNAL_ERROR
);
1478 return EXT_RETURN_FAIL
;
1483 return EXT_RETURN_SENT
;
1487 EXT_RETURN
tls_construct_stoc_alpn(SSL_CONNECTION
*s
, WPACKET
*pkt
, unsigned int context
,
1488 X509
*x
, size_t chainidx
)
1490 if (s
->s3
.alpn_selected
== NULL
)
1491 return EXT_RETURN_NOT_SENT
;
1493 if (!WPACKET_put_bytes_u16(pkt
,
1494 TLSEXT_TYPE_application_layer_protocol_negotiation
)
1495 || !WPACKET_start_sub_packet_u16(pkt
)
1496 || !WPACKET_start_sub_packet_u16(pkt
)
1497 || !WPACKET_sub_memcpy_u8(pkt
, s
->s3
.alpn_selected
,
1498 s
->s3
.alpn_selected_len
)
1499 || !WPACKET_close(pkt
)
1500 || !WPACKET_close(pkt
)) {
1501 SSLfatal(s
, SSL_AD_INTERNAL_ERROR
, ERR_R_INTERNAL_ERROR
);
1502 return EXT_RETURN_FAIL
;
1505 return EXT_RETURN_SENT
;
1508 #ifndef OPENSSL_NO_SRTP
1509 EXT_RETURN
tls_construct_stoc_use_srtp(SSL_CONNECTION
*s
, WPACKET
*pkt
,
1510 unsigned int context
, X509
*x
,
1513 if (s
->srtp_profile
== NULL
)
1514 return EXT_RETURN_NOT_SENT
;
1516 if (!WPACKET_put_bytes_u16(pkt
, TLSEXT_TYPE_use_srtp
)
1517 || !WPACKET_start_sub_packet_u16(pkt
)
1518 || !WPACKET_put_bytes_u16(pkt
, 2)
1519 || !WPACKET_put_bytes_u16(pkt
, s
->srtp_profile
->id
)
1520 || !WPACKET_put_bytes_u8(pkt
, 0)
1521 || !WPACKET_close(pkt
)) {
1522 SSLfatal(s
, SSL_AD_INTERNAL_ERROR
, ERR_R_INTERNAL_ERROR
);
1523 return EXT_RETURN_FAIL
;
1526 return EXT_RETURN_SENT
;
1530 EXT_RETURN
tls_construct_stoc_etm(SSL_CONNECTION
*s
, WPACKET
*pkt
,
1531 unsigned int context
,
1532 X509
*x
, size_t chainidx
)
1534 if (!s
->ext
.use_etm
)
1535 return EXT_RETURN_NOT_SENT
;
1538 * Don't use encrypt_then_mac if AEAD or RC4 might want to disable
1539 * for other cases too.
1541 if (s
->s3
.tmp
.new_cipher
->algorithm_mac
== SSL_AEAD
1542 || s
->s3
.tmp
.new_cipher
->algorithm_enc
== SSL_RC4
1543 || s
->s3
.tmp
.new_cipher
->algorithm_enc
== SSL_eGOST2814789CNT
1544 || s
->s3
.tmp
.new_cipher
->algorithm_enc
== SSL_eGOST2814789CNT12
1545 || s
->s3
.tmp
.new_cipher
->algorithm_enc
== SSL_MAGMA
1546 || s
->s3
.tmp
.new_cipher
->algorithm_enc
== SSL_KUZNYECHIK
) {
1548 return EXT_RETURN_NOT_SENT
;
1551 if (!WPACKET_put_bytes_u16(pkt
, TLSEXT_TYPE_encrypt_then_mac
)
1552 || !WPACKET_put_bytes_u16(pkt
, 0)) {
1553 SSLfatal(s
, SSL_AD_INTERNAL_ERROR
, ERR_R_INTERNAL_ERROR
);
1554 return EXT_RETURN_FAIL
;
1557 return EXT_RETURN_SENT
;
1560 EXT_RETURN
tls_construct_stoc_ems(SSL_CONNECTION
*s
, WPACKET
*pkt
,
1561 unsigned int context
,
1562 X509
*x
, size_t chainidx
)
1564 if ((s
->s3
.flags
& TLS1_FLAGS_RECEIVED_EXTMS
) == 0)
1565 return EXT_RETURN_NOT_SENT
;
1567 if (!WPACKET_put_bytes_u16(pkt
, TLSEXT_TYPE_extended_master_secret
)
1568 || !WPACKET_put_bytes_u16(pkt
, 0)) {
1569 SSLfatal(s
, SSL_AD_INTERNAL_ERROR
, ERR_R_INTERNAL_ERROR
);
1570 return EXT_RETURN_FAIL
;
1573 return EXT_RETURN_SENT
;
1576 EXT_RETURN
tls_construct_stoc_supported_versions(SSL_CONNECTION
*s
, WPACKET
*pkt
,
1577 unsigned int context
, X509
*x
,
1580 if (!ossl_assert(SSL_CONNECTION_IS_TLS13(s
))) {
1581 SSLfatal(s
, SSL_AD_INTERNAL_ERROR
, ERR_R_INTERNAL_ERROR
);
1582 return EXT_RETURN_FAIL
;
1585 if (!WPACKET_put_bytes_u16(pkt
, TLSEXT_TYPE_supported_versions
)
1586 || !WPACKET_start_sub_packet_u16(pkt
)
1587 || !WPACKET_put_bytes_u16(pkt
, s
->version
)
1588 || !WPACKET_close(pkt
)) {
1589 SSLfatal(s
, SSL_AD_INTERNAL_ERROR
, ERR_R_INTERNAL_ERROR
);
1590 return EXT_RETURN_FAIL
;
1593 return EXT_RETURN_SENT
;
1596 EXT_RETURN
tls_construct_stoc_key_share(SSL_CONNECTION
*s
, WPACKET
*pkt
,
1597 unsigned int context
, X509
*x
,
1600 #ifndef OPENSSL_NO_TLS1_3
1601 unsigned char *encodedPoint
;
1602 size_t encoded_pt_len
= 0;
1603 EVP_PKEY
*ckey
= s
->s3
.peer_tmp
, *skey
= NULL
;
1604 const TLS_GROUP_INFO
*ginf
= NULL
;
1606 if (s
->hello_retry_request
== SSL_HRR_PENDING
) {
1608 /* Original key_share was acceptable so don't ask for another one */
1609 return EXT_RETURN_NOT_SENT
;
1611 if (!WPACKET_put_bytes_u16(pkt
, TLSEXT_TYPE_key_share
)
1612 || !WPACKET_start_sub_packet_u16(pkt
)
1613 || !WPACKET_put_bytes_u16(pkt
, s
->s3
.group_id
)
1614 || !WPACKET_close(pkt
)) {
1615 SSLfatal(s
, SSL_AD_INTERNAL_ERROR
, ERR_R_INTERNAL_ERROR
);
1616 return EXT_RETURN_FAIL
;
1619 return EXT_RETURN_SENT
;
1623 /* No key_share received from client - must be resuming */
1624 if (!s
->hit
|| !tls13_generate_handshake_secret(s
, NULL
, 0)) {
1625 SSLfatal(s
, SSL_AD_INTERNAL_ERROR
, ERR_R_INTERNAL_ERROR
);
1626 return EXT_RETURN_FAIL
;
1628 return EXT_RETURN_NOT_SENT
;
1630 if (s
->hit
&& (s
->ext
.psk_kex_mode
& TLSEXT_KEX_MODE_FLAG_KE_DHE
) == 0) {
1632 * PSK ('hit') and explicitly not doing DHE (if the client sent the
1633 * DHE option we always take it); don't send key share.
1635 return EXT_RETURN_NOT_SENT
;
1638 if (!WPACKET_put_bytes_u16(pkt
, TLSEXT_TYPE_key_share
)
1639 || !WPACKET_start_sub_packet_u16(pkt
)
1640 || !WPACKET_put_bytes_u16(pkt
, s
->s3
.group_id
)) {
1641 SSLfatal(s
, SSL_AD_INTERNAL_ERROR
, ERR_R_INTERNAL_ERROR
);
1642 return EXT_RETURN_FAIL
;
1645 if ((ginf
= tls1_group_id_lookup(SSL_CONNECTION_GET_CTX(s
),
1646 s
->s3
.group_id
)) == NULL
) {
1647 SSLfatal(s
, SSL_AD_INTERNAL_ERROR
, ERR_R_INTERNAL_ERROR
);
1648 return EXT_RETURN_FAIL
;
1651 if (!ginf
->is_kem
) {
1653 skey
= ssl_generate_pkey(s
, ckey
);
1655 SSLfatal(s
, SSL_AD_INTERNAL_ERROR
, ERR_R_SSL_LIB
);
1656 return EXT_RETURN_FAIL
;
1659 /* Generate encoding of server key */
1660 encoded_pt_len
= EVP_PKEY_get1_encoded_public_key(skey
, &encodedPoint
);
1661 if (encoded_pt_len
== 0) {
1662 SSLfatal(s
, SSL_AD_INTERNAL_ERROR
, ERR_R_EC_LIB
);
1663 EVP_PKEY_free(skey
);
1664 return EXT_RETURN_FAIL
;
1667 if (!WPACKET_sub_memcpy_u16(pkt
, encodedPoint
, encoded_pt_len
)
1668 || !WPACKET_close(pkt
)) {
1669 SSLfatal(s
, SSL_AD_INTERNAL_ERROR
, ERR_R_INTERNAL_ERROR
);
1670 EVP_PKEY_free(skey
);
1671 OPENSSL_free(encodedPoint
);
1672 return EXT_RETURN_FAIL
;
1674 OPENSSL_free(encodedPoint
);
1677 * This causes the crypto state to be updated based on the derived keys
1679 s
->s3
.tmp
.pkey
= skey
;
1680 if (ssl_derive(s
, skey
, ckey
, 1) == 0) {
1681 /* SSLfatal() already called */
1682 return EXT_RETURN_FAIL
;
1686 unsigned char *ct
= NULL
;
1690 * This does not update the crypto state.
1692 * The generated pms is stored in `s->s3.tmp.pms` to be later used via
1695 if (ssl_encapsulate(s
, ckey
, &ct
, &ctlen
, 0) == 0) {
1696 /* SSLfatal() already called */
1697 return EXT_RETURN_FAIL
;
1701 SSLfatal(s
, SSL_AD_INTERNAL_ERROR
, ERR_R_INTERNAL_ERROR
);
1703 return EXT_RETURN_FAIL
;
1706 if (!WPACKET_sub_memcpy_u16(pkt
, ct
, ctlen
)
1707 || !WPACKET_close(pkt
)) {
1708 SSLfatal(s
, SSL_AD_INTERNAL_ERROR
, ERR_R_INTERNAL_ERROR
);
1710 return EXT_RETURN_FAIL
;
1715 * This causes the crypto state to be updated based on the generated pms
1717 if (ssl_gensecret(s
, s
->s3
.tmp
.pms
, s
->s3
.tmp
.pmslen
) == 0) {
1718 /* SSLfatal() already called */
1719 return EXT_RETURN_FAIL
;
1723 return EXT_RETURN_SENT
;
1725 return EXT_RETURN_FAIL
;
1729 EXT_RETURN
tls_construct_stoc_cookie(SSL_CONNECTION
*s
, WPACKET
*pkt
,
1730 unsigned int context
,
1731 X509
*x
, size_t chainidx
)
1733 #ifndef OPENSSL_NO_TLS1_3
1734 unsigned char *hashval1
, *hashval2
, *appcookie1
, *appcookie2
, *cookie
;
1735 unsigned char *hmac
, *hmac2
;
1736 size_t startlen
, ciphlen
, totcookielen
, hashlen
, hmaclen
, appcookielen
;
1739 int ret
= EXT_RETURN_FAIL
;
1740 SSL_CTX
*sctx
= SSL_CONNECTION_GET_CTX(s
);
1741 SSL
*ssl
= SSL_CONNECTION_GET_SSL(s
);
1743 if ((s
->s3
.flags
& TLS1_FLAGS_STATELESS
) == 0)
1744 return EXT_RETURN_NOT_SENT
;
1746 if (sctx
->gen_stateless_cookie_cb
== NULL
) {
1747 SSLfatal(s
, SSL_AD_INTERNAL_ERROR
, SSL_R_NO_COOKIE_CALLBACK_SET
);
1748 return EXT_RETURN_FAIL
;
1751 if (!WPACKET_put_bytes_u16(pkt
, TLSEXT_TYPE_cookie
)
1752 || !WPACKET_start_sub_packet_u16(pkt
)
1753 || !WPACKET_start_sub_packet_u16(pkt
)
1754 || !WPACKET_get_total_written(pkt
, &startlen
)
1755 || !WPACKET_reserve_bytes(pkt
, MAX_COOKIE_SIZE
, &cookie
)
1756 || !WPACKET_put_bytes_u16(pkt
, COOKIE_STATE_FORMAT_VERSION
)
1757 || !WPACKET_put_bytes_u16(pkt
, TLS1_3_VERSION
)
1758 || !WPACKET_put_bytes_u16(pkt
, s
->s3
.group_id
)
1759 || !ssl
->method
->put_cipher_by_char(s
->s3
.tmp
.new_cipher
, pkt
,
1761 /* Is there a key_share extension present in this HRR? */
1762 || !WPACKET_put_bytes_u8(pkt
, s
->s3
.peer_tmp
== NULL
)
1763 || !WPACKET_put_bytes_u64(pkt
, time(NULL
))
1764 || !WPACKET_start_sub_packet_u16(pkt
)
1765 || !WPACKET_reserve_bytes(pkt
, EVP_MAX_MD_SIZE
, &hashval1
)) {
1766 SSLfatal(s
, SSL_AD_INTERNAL_ERROR
, ERR_R_INTERNAL_ERROR
);
1767 return EXT_RETURN_FAIL
;
1771 * Get the hash of the initial ClientHello. ssl_handshake_hash() operates
1772 * on raw buffers, so we first reserve sufficient bytes (above) and then
1773 * subsequently allocate them (below)
1775 if (!ssl3_digest_cached_records(s
, 0)
1776 || !ssl_handshake_hash(s
, hashval1
, EVP_MAX_MD_SIZE
, &hashlen
)) {
1777 /* SSLfatal() already called */
1778 return EXT_RETURN_FAIL
;
1781 if (!WPACKET_allocate_bytes(pkt
, hashlen
, &hashval2
)
1782 || !ossl_assert(hashval1
== hashval2
)
1783 || !WPACKET_close(pkt
)
1784 || !WPACKET_start_sub_packet_u8(pkt
)
1785 || !WPACKET_reserve_bytes(pkt
, SSL_COOKIE_LENGTH
, &appcookie1
)) {
1786 SSLfatal(s
, SSL_AD_INTERNAL_ERROR
, ERR_R_INTERNAL_ERROR
);
1787 return EXT_RETURN_FAIL
;
1790 /* Generate the application cookie */
1791 if (sctx
->gen_stateless_cookie_cb(ssl
, appcookie1
,
1792 &appcookielen
) == 0) {
1793 SSLfatal(s
, SSL_AD_INTERNAL_ERROR
, SSL_R_COOKIE_GEN_CALLBACK_FAILURE
);
1794 return EXT_RETURN_FAIL
;
1797 if (!WPACKET_allocate_bytes(pkt
, appcookielen
, &appcookie2
)
1798 || !ossl_assert(appcookie1
== appcookie2
)
1799 || !WPACKET_close(pkt
)
1800 || !WPACKET_get_total_written(pkt
, &totcookielen
)
1801 || !WPACKET_reserve_bytes(pkt
, SHA256_DIGEST_LENGTH
, &hmac
)) {
1802 SSLfatal(s
, SSL_AD_INTERNAL_ERROR
, ERR_R_INTERNAL_ERROR
);
1803 return EXT_RETURN_FAIL
;
1805 hmaclen
= SHA256_DIGEST_LENGTH
;
1807 totcookielen
-= startlen
;
1808 if (!ossl_assert(totcookielen
<= MAX_COOKIE_SIZE
- SHA256_DIGEST_LENGTH
)) {
1809 SSLfatal(s
, SSL_AD_INTERNAL_ERROR
, ERR_R_INTERNAL_ERROR
);
1810 return EXT_RETURN_FAIL
;
1813 /* HMAC the cookie */
1814 hctx
= EVP_MD_CTX_create();
1815 pkey
= EVP_PKEY_new_raw_private_key_ex(sctx
->libctx
, "HMAC",
1817 s
->session_ctx
->ext
.cookie_hmac_key
,
1818 sizeof(s
->session_ctx
->ext
.cookie_hmac_key
));
1819 if (hctx
== NULL
|| pkey
== NULL
) {
1820 SSLfatal(s
, SSL_AD_INTERNAL_ERROR
, ERR_R_EVP_LIB
);
1824 if (EVP_DigestSignInit_ex(hctx
, NULL
, "SHA2-256", sctx
->libctx
,
1825 sctx
->propq
, pkey
, NULL
) <= 0
1826 || EVP_DigestSign(hctx
, hmac
, &hmaclen
, cookie
,
1827 totcookielen
) <= 0) {
1828 SSLfatal(s
, SSL_AD_INTERNAL_ERROR
, ERR_R_INTERNAL_ERROR
);
1832 if (!ossl_assert(totcookielen
+ hmaclen
<= MAX_COOKIE_SIZE
)) {
1833 SSLfatal(s
, SSL_AD_INTERNAL_ERROR
, ERR_R_INTERNAL_ERROR
);
1837 if (!WPACKET_allocate_bytes(pkt
, hmaclen
, &hmac2
)
1838 || !ossl_assert(hmac
== hmac2
)
1839 || !ossl_assert(cookie
== hmac
- totcookielen
)
1840 || !WPACKET_close(pkt
)
1841 || !WPACKET_close(pkt
)) {
1842 SSLfatal(s
, SSL_AD_INTERNAL_ERROR
, ERR_R_INTERNAL_ERROR
);
1846 ret
= EXT_RETURN_SENT
;
1849 EVP_MD_CTX_free(hctx
);
1850 EVP_PKEY_free(pkey
);
1853 return EXT_RETURN_FAIL
;
1857 EXT_RETURN
tls_construct_stoc_cryptopro_bug(SSL_CONNECTION
*s
, WPACKET
*pkt
,
1858 unsigned int context
, X509
*x
,
1861 const unsigned char cryptopro_ext
[36] = {
1862 0xfd, 0xe8, /* 65000 */
1863 0x00, 0x20, /* 32 bytes length */
1864 0x30, 0x1e, 0x30, 0x08, 0x06, 0x06, 0x2a, 0x85,
1865 0x03, 0x02, 0x02, 0x09, 0x30, 0x08, 0x06, 0x06,
1866 0x2a, 0x85, 0x03, 0x02, 0x02, 0x16, 0x30, 0x08,
1867 0x06, 0x06, 0x2a, 0x85, 0x03, 0x02, 0x02, 0x17
1870 if (((s
->s3
.tmp
.new_cipher
->id
& 0xFFFF) != 0x80
1871 && (s
->s3
.tmp
.new_cipher
->id
& 0xFFFF) != 0x81)
1872 || (SSL_get_options(SSL_CONNECTION_GET_SSL(s
))
1873 & SSL_OP_CRYPTOPRO_TLSEXT_BUG
) == 0)
1874 return EXT_RETURN_NOT_SENT
;
1876 if (!WPACKET_memcpy(pkt
, cryptopro_ext
, sizeof(cryptopro_ext
))) {
1877 SSLfatal(s
, SSL_AD_INTERNAL_ERROR
, ERR_R_INTERNAL_ERROR
);
1878 return EXT_RETURN_FAIL
;
1881 return EXT_RETURN_SENT
;
1884 EXT_RETURN
tls_construct_stoc_early_data(SSL_CONNECTION
*s
, WPACKET
*pkt
,
1885 unsigned int context
, X509
*x
,
1888 if (context
== SSL_EXT_TLS1_3_NEW_SESSION_TICKET
) {
1889 if (s
->max_early_data
== 0)
1890 return EXT_RETURN_NOT_SENT
;
1892 if (!WPACKET_put_bytes_u16(pkt
, TLSEXT_TYPE_early_data
)
1893 || !WPACKET_start_sub_packet_u16(pkt
)
1894 || !WPACKET_put_bytes_u32(pkt
, s
->max_early_data
)
1895 || !WPACKET_close(pkt
)) {
1896 SSLfatal(s
, SSL_AD_INTERNAL_ERROR
, ERR_R_INTERNAL_ERROR
);
1897 return EXT_RETURN_FAIL
;
1900 return EXT_RETURN_SENT
;
1903 if (s
->ext
.early_data
!= SSL_EARLY_DATA_ACCEPTED
)
1904 return EXT_RETURN_NOT_SENT
;
1906 if (!WPACKET_put_bytes_u16(pkt
, TLSEXT_TYPE_early_data
)
1907 || !WPACKET_start_sub_packet_u16(pkt
)
1908 || !WPACKET_close(pkt
)) {
1909 SSLfatal(s
, SSL_AD_INTERNAL_ERROR
, ERR_R_INTERNAL_ERROR
);
1910 return EXT_RETURN_FAIL
;
1913 return EXT_RETURN_SENT
;
1916 EXT_RETURN
tls_construct_stoc_psk(SSL_CONNECTION
*s
, WPACKET
*pkt
,
1917 unsigned int context
,
1918 X509
*x
, size_t chainidx
)
1921 return EXT_RETURN_NOT_SENT
;
1923 if (!WPACKET_put_bytes_u16(pkt
, TLSEXT_TYPE_psk
)
1924 || !WPACKET_start_sub_packet_u16(pkt
)
1925 || !WPACKET_put_bytes_u16(pkt
, s
->ext
.tick_identity
)
1926 || !WPACKET_close(pkt
)) {
1927 SSLfatal(s
, SSL_AD_INTERNAL_ERROR
, ERR_R_INTERNAL_ERROR
);
1928 return EXT_RETURN_FAIL
;
1931 return EXT_RETURN_SENT
;