2 * Copyright 2016-2021 The OpenSSL Project Authors. All Rights Reserved.
4 * Licensed under the Apache License 2.0 (the "License"). You may not use
5 * this file except in compliance with the License. You can obtain a copy
6 * in the file LICENSE in the source distribution or at
7 * https://www.openssl.org/source/license.html
10 #include <openssl/ocsp.h>
11 #include "../ssl_local.h"
12 #include "statem_local.h"
13 #include "internal/cryptlib.h"
15 #define COOKIE_STATE_FORMAT_VERSION 0
18 * 2 bytes for packet length, 2 bytes for format version, 2 bytes for
19 * protocol version, 2 bytes for group id, 2 bytes for cipher id, 1 byte for
20 * key_share present flag, 4 bytes for timestamp, 2 bytes for the hashlen,
21 * EVP_MAX_MD_SIZE for transcript hash, 1 byte for app cookie length, app cookie
22 * length bytes, SHA256_DIGEST_LENGTH bytes for the HMAC of the whole thing.
24 #define MAX_COOKIE_SIZE (2 + 2 + 2 + 2 + 2 + 1 + 4 + 2 + EVP_MAX_MD_SIZE + 1 \
25 + SSL_COOKIE_LENGTH + SHA256_DIGEST_LENGTH)
28 * Message header + 2 bytes for protocol version + number of random bytes +
29 * + 1 byte for legacy session id length + number of bytes in legacy session id
30 * + 2 bytes for ciphersuite + 1 byte for legacy compression
31 * + 2 bytes for extension block length + 6 bytes for key_share extension
32 * + 4 bytes for cookie extension header + the number of bytes in the cookie
34 #define MAX_HRR_SIZE (SSL3_HM_HEADER_LENGTH + 2 + SSL3_RANDOM_SIZE + 1 \
35 + SSL_MAX_SSL_SESSION_ID_LENGTH + 2 + 1 + 2 + 6 + 4 \
39 * Parse the client's renegotiation binding and abort if it's not right
41 int tls_parse_ctos_renegotiate(SSL
*s
, PACKET
*pkt
, unsigned int context
,
42 X509
*x
, size_t chainidx
)
45 const unsigned char *data
;
47 /* Parse the length byte */
48 if (!PACKET_get_1(pkt
, &ilen
)
49 || !PACKET_get_bytes(pkt
, &data
, ilen
)) {
50 SSLfatal(s
, SSL_AD_DECODE_ERROR
, SSL_R_RENEGOTIATION_ENCODING_ERR
);
54 /* Check that the extension matches */
55 if (ilen
!= s
->s3
.previous_client_finished_len
) {
56 SSLfatal(s
, SSL_AD_HANDSHAKE_FAILURE
, SSL_R_RENEGOTIATION_MISMATCH
);
60 if (memcmp(data
, s
->s3
.previous_client_finished
,
61 s
->s3
.previous_client_finished_len
)) {
62 SSLfatal(s
, SSL_AD_HANDSHAKE_FAILURE
, SSL_R_RENEGOTIATION_MISMATCH
);
66 s
->s3
.send_connection_binding
= 1;
72 * The servername extension is treated as follows:
74 * - Only the hostname type is supported with a maximum length of 255.
75 * - The servername is rejected if too long or if it contains zeros,
76 * in which case an fatal alert is generated.
77 * - The servername field is maintained together with the session cache.
78 * - When a session is resumed, the servername call back invoked in order
79 * to allow the application to position itself to the right context.
80 * - The servername is acknowledged if it is new for a session or when
81 * it is identical to a previously used for the same session.
82 * Applications can control the behaviour. They can at any time
83 * set a 'desirable' servername for a new SSL object. This can be the
84 * case for example with HTTPS when a Host: header field is received and
85 * a renegotiation is requested. In this case, a possible servername
86 * presented in the new client hello is only acknowledged if it matches
87 * the value of the Host: field.
88 * - Applications must use SSL_OP_NO_SESSION_RESUMPTION_ON_RENEGOTIATION
89 * if they provide for changing an explicit servername context for the
90 * session, i.e. when the session has been established with a servername
92 * - On session reconnect, the servername extension may be absent.
94 int tls_parse_ctos_server_name(SSL
*s
, PACKET
*pkt
, unsigned int context
,
95 X509
*x
, size_t chainidx
)
97 unsigned int servname_type
;
100 if (!PACKET_as_length_prefixed_2(pkt
, &sni
)
101 /* ServerNameList must be at least 1 byte long. */
102 || PACKET_remaining(&sni
) == 0) {
103 SSLfatal(s
, SSL_AD_DECODE_ERROR
, SSL_R_BAD_EXTENSION
);
108 * Although the intent was for server_name to be extensible, RFC 4366
109 * was not clear about it; and so OpenSSL among other implementations,
110 * always and only allows a 'host_name' name types.
111 * RFC 6066 corrected the mistake but adding new name types
112 * is nevertheless no longer feasible, so act as if no other
113 * SNI types can exist, to simplify parsing.
115 * Also note that the RFC permits only one SNI value per type,
116 * i.e., we can only have a single hostname.
118 if (!PACKET_get_1(&sni
, &servname_type
)
119 || servname_type
!= TLSEXT_NAMETYPE_host_name
120 || !PACKET_as_length_prefixed_2(&sni
, &hostname
)) {
121 SSLfatal(s
, SSL_AD_DECODE_ERROR
, SSL_R_BAD_EXTENSION
);
126 * In TLSv1.2 and below the SNI is associated with the session. In TLSv1.3
127 * we always use the SNI value from the handshake.
129 if (!s
->hit
|| SSL_IS_TLS13(s
)) {
130 if (PACKET_remaining(&hostname
) > TLSEXT_MAXLEN_host_name
) {
131 SSLfatal(s
, SSL_AD_UNRECOGNIZED_NAME
, SSL_R_BAD_EXTENSION
);
135 if (PACKET_contains_zero_byte(&hostname
)) {
136 SSLfatal(s
, SSL_AD_UNRECOGNIZED_NAME
, SSL_R_BAD_EXTENSION
);
141 * Store the requested SNI in the SSL as temporary storage.
142 * If we accept it, it will get stored in the SSL_SESSION as well.
144 OPENSSL_free(s
->ext
.hostname
);
145 s
->ext
.hostname
= NULL
;
146 if (!PACKET_strndup(&hostname
, &s
->ext
.hostname
)) {
147 SSLfatal(s
, SSL_AD_INTERNAL_ERROR
, ERR_R_INTERNAL_ERROR
);
151 s
->servername_done
= 1;
154 * In TLSv1.2 and below we should check if the SNI is consistent between
155 * the initial handshake and the resumption. In TLSv1.3 SNI is not
156 * associated with the session.
159 * TODO(openssl-team): if the SNI doesn't match, we MUST
160 * fall back to a full handshake.
162 s
->servername_done
= (s
->session
->ext
.hostname
!= NULL
)
163 && PACKET_equal(&hostname
, s
->session
->ext
.hostname
,
164 strlen(s
->session
->ext
.hostname
));
170 int tls_parse_ctos_maxfragmentlen(SSL
*s
, PACKET
*pkt
, unsigned int context
,
171 X509
*x
, size_t chainidx
)
175 if (PACKET_remaining(pkt
) != 1 || !PACKET_get_1(pkt
, &value
)) {
176 SSLfatal(s
, SSL_AD_DECODE_ERROR
, SSL_R_BAD_EXTENSION
);
180 /* Received |value| should be a valid max-fragment-length code. */
181 if (!IS_MAX_FRAGMENT_LENGTH_EXT_VALID(value
)) {
182 SSLfatal(s
, SSL_AD_ILLEGAL_PARAMETER
,
183 SSL_R_SSL3_EXT_INVALID_MAX_FRAGMENT_LENGTH
);
188 * RFC 6066: The negotiated length applies for the duration of the session
189 * including session resumptions.
190 * We should receive the same code as in resumed session !
192 if (s
->hit
&& s
->session
->ext
.max_fragment_len_mode
!= value
) {
193 SSLfatal(s
, SSL_AD_ILLEGAL_PARAMETER
,
194 SSL_R_SSL3_EXT_INVALID_MAX_FRAGMENT_LENGTH
);
199 * Store it in session, so it'll become binding for us
200 * and we'll include it in a next Server Hello.
202 s
->session
->ext
.max_fragment_len_mode
= value
;
206 #ifndef OPENSSL_NO_SRP
207 int tls_parse_ctos_srp(SSL
*s
, PACKET
*pkt
, unsigned int context
, X509
*x
,
212 if (!PACKET_as_length_prefixed_1(pkt
, &srp_I
)
213 || PACKET_contains_zero_byte(&srp_I
)) {
214 SSLfatal(s
, SSL_AD_DECODE_ERROR
, SSL_R_BAD_EXTENSION
);
219 * TODO(openssl-team): currently, we re-authenticate the user
220 * upon resumption. Instead, we MUST ignore the login.
222 if (!PACKET_strndup(&srp_I
, &s
->srp_ctx
.login
)) {
223 SSLfatal(s
, SSL_AD_INTERNAL_ERROR
, ERR_R_INTERNAL_ERROR
);
231 int tls_parse_ctos_ec_pt_formats(SSL
*s
, PACKET
*pkt
, unsigned int context
,
232 X509
*x
, size_t chainidx
)
234 PACKET ec_point_format_list
;
236 if (!PACKET_as_length_prefixed_1(pkt
, &ec_point_format_list
)
237 || PACKET_remaining(&ec_point_format_list
) == 0) {
238 SSLfatal(s
, SSL_AD_DECODE_ERROR
, SSL_R_BAD_EXTENSION
);
243 if (!PACKET_memdup(&ec_point_format_list
,
244 &s
->ext
.peer_ecpointformats
,
245 &s
->ext
.peer_ecpointformats_len
)) {
246 SSLfatal(s
, SSL_AD_INTERNAL_ERROR
, ERR_R_INTERNAL_ERROR
);
254 int tls_parse_ctos_session_ticket(SSL
*s
, PACKET
*pkt
, unsigned int context
,
255 X509
*x
, size_t chainidx
)
257 if (s
->ext
.session_ticket_cb
&&
258 !s
->ext
.session_ticket_cb(s
, PACKET_data(pkt
),
259 PACKET_remaining(pkt
),
260 s
->ext
.session_ticket_cb_arg
)) {
261 SSLfatal(s
, SSL_AD_INTERNAL_ERROR
, ERR_R_INTERNAL_ERROR
);
268 int tls_parse_ctos_sig_algs_cert(SSL
*s
, PACKET
*pkt
,
269 ossl_unused
unsigned int context
,
271 ossl_unused
size_t chainidx
)
273 PACKET supported_sig_algs
;
275 if (!PACKET_as_length_prefixed_2(pkt
, &supported_sig_algs
)
276 || PACKET_remaining(&supported_sig_algs
) == 0) {
277 SSLfatal(s
, SSL_AD_DECODE_ERROR
, SSL_R_BAD_EXTENSION
);
281 if (!s
->hit
&& !tls1_save_sigalgs(s
, &supported_sig_algs
, 1)) {
282 SSLfatal(s
, SSL_AD_DECODE_ERROR
, SSL_R_BAD_EXTENSION
);
289 int tls_parse_ctos_sig_algs(SSL
*s
, PACKET
*pkt
, unsigned int context
, X509
*x
,
292 PACKET supported_sig_algs
;
294 if (!PACKET_as_length_prefixed_2(pkt
, &supported_sig_algs
)
295 || PACKET_remaining(&supported_sig_algs
) == 0) {
296 SSLfatal(s
, SSL_AD_DECODE_ERROR
, SSL_R_BAD_EXTENSION
);
300 if (!s
->hit
&& !tls1_save_sigalgs(s
, &supported_sig_algs
, 0)) {
301 SSLfatal(s
, SSL_AD_DECODE_ERROR
, SSL_R_BAD_EXTENSION
);
308 #ifndef OPENSSL_NO_OCSP
309 int tls_parse_ctos_status_request(SSL
*s
, PACKET
*pkt
, unsigned int context
,
310 X509
*x
, size_t chainidx
)
312 PACKET responder_id_list
, exts
;
314 /* We ignore this in a resumption handshake */
318 /* Not defined if we get one of these in a client Certificate */
322 if (!PACKET_get_1(pkt
, (unsigned int *)&s
->ext
.status_type
)) {
323 SSLfatal(s
, SSL_AD_DECODE_ERROR
, SSL_R_BAD_EXTENSION
);
327 if (s
->ext
.status_type
!= TLSEXT_STATUSTYPE_ocsp
) {
329 * We don't know what to do with any other type so ignore it.
331 s
->ext
.status_type
= TLSEXT_STATUSTYPE_nothing
;
335 if (!PACKET_get_length_prefixed_2 (pkt
, &responder_id_list
)) {
336 SSLfatal(s
, SSL_AD_DECODE_ERROR
, SSL_R_BAD_EXTENSION
);
341 * We remove any OCSP_RESPIDs from a previous handshake
342 * to prevent unbounded memory growth - CVE-2016-6304
344 sk_OCSP_RESPID_pop_free(s
->ext
.ocsp
.ids
, OCSP_RESPID_free
);
345 if (PACKET_remaining(&responder_id_list
) > 0) {
346 s
->ext
.ocsp
.ids
= sk_OCSP_RESPID_new_null();
347 if (s
->ext
.ocsp
.ids
== NULL
) {
348 SSLfatal(s
, SSL_AD_INTERNAL_ERROR
, ERR_R_MALLOC_FAILURE
);
352 s
->ext
.ocsp
.ids
= NULL
;
355 while (PACKET_remaining(&responder_id_list
) > 0) {
358 const unsigned char *id_data
;
360 if (!PACKET_get_length_prefixed_2(&responder_id_list
, &responder_id
)
361 || PACKET_remaining(&responder_id
) == 0) {
362 SSLfatal(s
, SSL_AD_DECODE_ERROR
, SSL_R_BAD_EXTENSION
);
366 id_data
= PACKET_data(&responder_id
);
367 /* TODO(size_t): Convert d2i_* to size_t */
368 id
= d2i_OCSP_RESPID(NULL
, &id_data
,
369 (int)PACKET_remaining(&responder_id
));
371 SSLfatal(s
, SSL_AD_DECODE_ERROR
, SSL_R_BAD_EXTENSION
);
375 if (id_data
!= PACKET_end(&responder_id
)) {
376 OCSP_RESPID_free(id
);
377 SSLfatal(s
, SSL_AD_DECODE_ERROR
, SSL_R_BAD_EXTENSION
);
382 if (!sk_OCSP_RESPID_push(s
->ext
.ocsp
.ids
, id
)) {
383 OCSP_RESPID_free(id
);
384 SSLfatal(s
, SSL_AD_INTERNAL_ERROR
, ERR_R_INTERNAL_ERROR
);
390 /* Read in request_extensions */
391 if (!PACKET_as_length_prefixed_2(pkt
, &exts
)) {
392 SSLfatal(s
, SSL_AD_DECODE_ERROR
, SSL_R_BAD_EXTENSION
);
396 if (PACKET_remaining(&exts
) > 0) {
397 const unsigned char *ext_data
= PACKET_data(&exts
);
399 sk_X509_EXTENSION_pop_free(s
->ext
.ocsp
.exts
,
400 X509_EXTENSION_free
);
402 d2i_X509_EXTENSIONS(NULL
, &ext_data
, (int)PACKET_remaining(&exts
));
403 if (s
->ext
.ocsp
.exts
== NULL
|| ext_data
!= PACKET_end(&exts
)) {
404 SSLfatal(s
, SSL_AD_DECODE_ERROR
, SSL_R_BAD_EXTENSION
);
413 #ifndef OPENSSL_NO_NEXTPROTONEG
414 int tls_parse_ctos_npn(SSL
*s
, PACKET
*pkt
, unsigned int context
, X509
*x
,
418 * We shouldn't accept this extension on a
421 if (SSL_IS_FIRST_HANDSHAKE(s
))
429 * Save the ALPN extension in a ClientHello.|pkt| holds the contents of the ALPN
430 * extension, not including type and length. Returns: 1 on success, 0 on error.
432 int tls_parse_ctos_alpn(SSL
*s
, PACKET
*pkt
, unsigned int context
, X509
*x
,
435 PACKET protocol_list
, save_protocol_list
, protocol
;
437 if (!SSL_IS_FIRST_HANDSHAKE(s
))
440 if (!PACKET_as_length_prefixed_2(pkt
, &protocol_list
)
441 || PACKET_remaining(&protocol_list
) < 2) {
442 SSLfatal(s
, SSL_AD_DECODE_ERROR
, SSL_R_BAD_EXTENSION
);
446 save_protocol_list
= protocol_list
;
448 /* Protocol names can't be empty. */
449 if (!PACKET_get_length_prefixed_1(&protocol_list
, &protocol
)
450 || PACKET_remaining(&protocol
) == 0) {
451 SSLfatal(s
, SSL_AD_DECODE_ERROR
, SSL_R_BAD_EXTENSION
);
454 } while (PACKET_remaining(&protocol_list
) != 0);
456 OPENSSL_free(s
->s3
.alpn_proposed
);
457 s
->s3
.alpn_proposed
= NULL
;
458 s
->s3
.alpn_proposed_len
= 0;
459 if (!PACKET_memdup(&save_protocol_list
,
460 &s
->s3
.alpn_proposed
, &s
->s3
.alpn_proposed_len
)) {
461 SSLfatal(s
, SSL_AD_INTERNAL_ERROR
, ERR_R_INTERNAL_ERROR
);
468 #ifndef OPENSSL_NO_SRTP
469 int tls_parse_ctos_use_srtp(SSL
*s
, PACKET
*pkt
, unsigned int context
, X509
*x
,
472 STACK_OF(SRTP_PROTECTION_PROFILE
) *srvr
;
473 unsigned int ct
, mki_len
, id
;
477 /* Ignore this if we have no SRTP profiles */
478 if (SSL_get_srtp_profiles(s
) == NULL
)
481 /* Pull off the length of the cipher suite list and check it is even */
482 if (!PACKET_get_net_2(pkt
, &ct
) || (ct
& 1) != 0
483 || !PACKET_get_sub_packet(pkt
, &subpkt
, ct
)) {
484 SSLfatal(s
, SSL_AD_DECODE_ERROR
,
485 SSL_R_BAD_SRTP_PROTECTION_PROFILE_LIST
);
489 srvr
= SSL_get_srtp_profiles(s
);
490 s
->srtp_profile
= NULL
;
491 /* Search all profiles for a match initially */
492 srtp_pref
= sk_SRTP_PROTECTION_PROFILE_num(srvr
);
494 while (PACKET_remaining(&subpkt
)) {
495 if (!PACKET_get_net_2(&subpkt
, &id
)) {
496 SSLfatal(s
, SSL_AD_DECODE_ERROR
,
497 SSL_R_BAD_SRTP_PROTECTION_PROFILE_LIST
);
502 * Only look for match in profiles of higher preference than
504 * If no profiles have been have been configured then this
507 for (i
= 0; i
< srtp_pref
; i
++) {
508 SRTP_PROTECTION_PROFILE
*sprof
=
509 sk_SRTP_PROTECTION_PROFILE_value(srvr
, i
);
511 if (sprof
->id
== id
) {
512 s
->srtp_profile
= sprof
;
519 /* Now extract the MKI value as a sanity check, but discard it for now */
520 if (!PACKET_get_1(pkt
, &mki_len
)) {
521 SSLfatal(s
, SSL_AD_DECODE_ERROR
,
522 SSL_R_BAD_SRTP_PROTECTION_PROFILE_LIST
);
526 if (!PACKET_forward(pkt
, mki_len
)
527 || PACKET_remaining(pkt
)) {
528 SSLfatal(s
, SSL_AD_DECODE_ERROR
, SSL_R_BAD_SRTP_MKI_VALUE
);
536 int tls_parse_ctos_etm(SSL
*s
, PACKET
*pkt
, unsigned int context
, X509
*x
,
539 if (!(s
->options
& SSL_OP_NO_ENCRYPT_THEN_MAC
))
546 * Process a psk_kex_modes extension received in the ClientHello. |pkt| contains
547 * the raw PACKET data for the extension. Returns 1 on success or 0 on failure.
549 int tls_parse_ctos_psk_kex_modes(SSL
*s
, PACKET
*pkt
, unsigned int context
,
550 X509
*x
, size_t chainidx
)
552 #ifndef OPENSSL_NO_TLS1_3
553 PACKET psk_kex_modes
;
556 if (!PACKET_as_length_prefixed_1(pkt
, &psk_kex_modes
)
557 || PACKET_remaining(&psk_kex_modes
) == 0) {
558 SSLfatal(s
, SSL_AD_DECODE_ERROR
, SSL_R_BAD_EXTENSION
);
562 while (PACKET_get_1(&psk_kex_modes
, &mode
)) {
563 if (mode
== TLSEXT_KEX_MODE_KE_DHE
)
564 s
->ext
.psk_kex_mode
|= TLSEXT_KEX_MODE_FLAG_KE_DHE
;
565 else if (mode
== TLSEXT_KEX_MODE_KE
566 && (s
->options
& SSL_OP_ALLOW_NO_DHE_KEX
) != 0)
567 s
->ext
.psk_kex_mode
|= TLSEXT_KEX_MODE_FLAG_KE
;
575 * Process a key_share extension received in the ClientHello. |pkt| contains
576 * the raw PACKET data for the extension. Returns 1 on success or 0 on failure.
578 int tls_parse_ctos_key_share(SSL
*s
, PACKET
*pkt
, unsigned int context
, X509
*x
,
581 #ifndef OPENSSL_NO_TLS1_3
582 unsigned int group_id
;
583 PACKET key_share_list
, encoded_pt
;
584 const uint16_t *clntgroups
, *srvrgroups
;
585 size_t clnt_num_groups
, srvr_num_groups
;
588 if (s
->hit
&& (s
->ext
.psk_kex_mode
& TLSEXT_KEX_MODE_FLAG_KE_DHE
) == 0)
592 if (s
->s3
.peer_tmp
!= NULL
) {
593 SSLfatal(s
, SSL_AD_INTERNAL_ERROR
, ERR_R_INTERNAL_ERROR
);
597 if (!PACKET_as_length_prefixed_2(pkt
, &key_share_list
)) {
598 SSLfatal(s
, SSL_AD_DECODE_ERROR
, SSL_R_LENGTH_MISMATCH
);
602 /* Get our list of supported groups */
603 tls1_get_supported_groups(s
, &srvrgroups
, &srvr_num_groups
);
604 /* Get the clients list of supported groups. */
605 tls1_get_peer_groups(s
, &clntgroups
, &clnt_num_groups
);
606 if (clnt_num_groups
== 0) {
608 * This can only happen if the supported_groups extension was not sent,
609 * because we verify that the length is non-zero when we process that
612 SSLfatal(s
, SSL_AD_MISSING_EXTENSION
,
613 SSL_R_MISSING_SUPPORTED_GROUPS_EXTENSION
);
617 if (s
->s3
.group_id
!= 0 && PACKET_remaining(&key_share_list
) == 0) {
619 * If we set a group_id already, then we must have sent an HRR
620 * requesting a new key_share. If we haven't got one then that is an
623 SSLfatal(s
, SSL_AD_ILLEGAL_PARAMETER
, SSL_R_BAD_KEY_SHARE
);
627 while (PACKET_remaining(&key_share_list
) > 0) {
628 if (!PACKET_get_net_2(&key_share_list
, &group_id
)
629 || !PACKET_get_length_prefixed_2(&key_share_list
, &encoded_pt
)
630 || PACKET_remaining(&encoded_pt
) == 0) {
631 SSLfatal(s
, SSL_AD_DECODE_ERROR
, SSL_R_LENGTH_MISMATCH
);
636 * If we already found a suitable key_share we loop through the
637 * rest to verify the structure, but don't process them.
643 * If we sent an HRR then the key_share sent back MUST be for the group
644 * we requested, and must be the only key_share sent.
646 if (s
->s3
.group_id
!= 0
647 && (group_id
!= s
->s3
.group_id
648 || PACKET_remaining(&key_share_list
) != 0)) {
649 SSLfatal(s
, SSL_AD_ILLEGAL_PARAMETER
, SSL_R_BAD_KEY_SHARE
);
653 /* Check if this share is in supported_groups sent from client */
654 if (!check_in_list(s
, group_id
, clntgroups
, clnt_num_groups
, 0)) {
655 SSLfatal(s
, SSL_AD_ILLEGAL_PARAMETER
, SSL_R_BAD_KEY_SHARE
);
659 /* Check if this share is for a group we can use */
660 if (!check_in_list(s
, group_id
, srvrgroups
, srvr_num_groups
, 1)) {
661 /* Share not suitable */
665 if ((s
->s3
.peer_tmp
= ssl_generate_param_group(s
, group_id
)) == NULL
) {
666 SSLfatal(s
, SSL_AD_INTERNAL_ERROR
,
667 SSL_R_UNABLE_TO_FIND_ECDH_PARAMETERS
);
671 s
->s3
.group_id
= group_id
;
672 /* Cache the selected group ID in the SSL_SESSION */
673 s
->session
->kex_group
= group_id
;
675 if (EVP_PKEY_set1_encoded_public_key(s
->s3
.peer_tmp
,
676 PACKET_data(&encoded_pt
),
677 PACKET_remaining(&encoded_pt
)) <= 0) {
678 SSLfatal(s
, SSL_AD_ILLEGAL_PARAMETER
, SSL_R_BAD_ECPOINT
);
689 int tls_parse_ctos_cookie(SSL
*s
, PACKET
*pkt
, unsigned int context
, X509
*x
,
692 #ifndef OPENSSL_NO_TLS1_3
693 unsigned int format
, version
, key_share
, group_id
;
696 PACKET cookie
, raw
, chhash
, appcookie
;
698 const unsigned char *data
, *mdin
, *ciphdata
;
699 unsigned char hmac
[SHA256_DIGEST_LENGTH
];
700 unsigned char hrr
[MAX_HRR_SIZE
];
701 size_t rawlen
, hmaclen
, hrrlen
, ciphlen
;
702 unsigned long tm
, now
;
704 /* Ignore any cookie if we're not set up to verify it */
705 if (s
->ctx
->verify_stateless_cookie_cb
== NULL
706 || (s
->s3
.flags
& TLS1_FLAGS_STATELESS
) == 0)
709 if (!PACKET_as_length_prefixed_2(pkt
, &cookie
)) {
710 SSLfatal(s
, SSL_AD_DECODE_ERROR
, SSL_R_LENGTH_MISMATCH
);
715 data
= PACKET_data(&raw
);
716 rawlen
= PACKET_remaining(&raw
);
717 if (rawlen
< SHA256_DIGEST_LENGTH
718 || !PACKET_forward(&raw
, rawlen
- SHA256_DIGEST_LENGTH
)) {
719 SSLfatal(s
, SSL_AD_DECODE_ERROR
, SSL_R_LENGTH_MISMATCH
);
722 mdin
= PACKET_data(&raw
);
724 /* Verify the HMAC of the cookie */
725 hctx
= EVP_MD_CTX_create();
726 pkey
= EVP_PKEY_new_raw_private_key_ex(s
->ctx
->libctx
, "HMAC",
728 s
->session_ctx
->ext
.cookie_hmac_key
,
729 sizeof(s
->session_ctx
->ext
.cookie_hmac_key
));
730 if (hctx
== NULL
|| pkey
== NULL
) {
731 EVP_MD_CTX_free(hctx
);
733 SSLfatal(s
, SSL_AD_INTERNAL_ERROR
, ERR_R_MALLOC_FAILURE
);
737 hmaclen
= SHA256_DIGEST_LENGTH
;
738 if (EVP_DigestSignInit_ex(hctx
, NULL
, "SHA2-256", s
->ctx
->libctx
,
739 s
->ctx
->propq
, pkey
, NULL
) <= 0
740 || EVP_DigestSign(hctx
, hmac
, &hmaclen
, data
,
741 rawlen
- SHA256_DIGEST_LENGTH
) <= 0
742 || hmaclen
!= SHA256_DIGEST_LENGTH
) {
743 EVP_MD_CTX_free(hctx
);
745 SSLfatal(s
, SSL_AD_INTERNAL_ERROR
, ERR_R_INTERNAL_ERROR
);
749 EVP_MD_CTX_free(hctx
);
752 if (CRYPTO_memcmp(hmac
, mdin
, SHA256_DIGEST_LENGTH
) != 0) {
753 SSLfatal(s
, SSL_AD_ILLEGAL_PARAMETER
, SSL_R_COOKIE_MISMATCH
);
757 if (!PACKET_get_net_2(&cookie
, &format
)) {
758 SSLfatal(s
, SSL_AD_DECODE_ERROR
, SSL_R_LENGTH_MISMATCH
);
761 /* Check the cookie format is something we recognise. Ignore it if not */
762 if (format
!= COOKIE_STATE_FORMAT_VERSION
)
766 * The rest of these checks really shouldn't fail since we have verified the
770 /* Check the version number is sane */
771 if (!PACKET_get_net_2(&cookie
, &version
)) {
772 SSLfatal(s
, SSL_AD_DECODE_ERROR
, SSL_R_LENGTH_MISMATCH
);
775 if (version
!= TLS1_3_VERSION
) {
776 SSLfatal(s
, SSL_AD_ILLEGAL_PARAMETER
,
777 SSL_R_BAD_PROTOCOL_VERSION_NUMBER
);
781 if (!PACKET_get_net_2(&cookie
, &group_id
)) {
782 SSLfatal(s
, SSL_AD_DECODE_ERROR
, SSL_R_LENGTH_MISMATCH
);
786 ciphdata
= PACKET_data(&cookie
);
787 if (!PACKET_forward(&cookie
, 2)) {
788 SSLfatal(s
, SSL_AD_DECODE_ERROR
, SSL_R_LENGTH_MISMATCH
);
791 if (group_id
!= s
->s3
.group_id
792 || s
->s3
.tmp
.new_cipher
793 != ssl_get_cipher_by_char(s
, ciphdata
, 0)) {
795 * We chose a different cipher or group id this time around to what is
796 * in the cookie. Something must have changed.
798 SSLfatal(s
, SSL_AD_ILLEGAL_PARAMETER
, SSL_R_BAD_CIPHER
);
802 if (!PACKET_get_1(&cookie
, &key_share
)
803 || !PACKET_get_net_4(&cookie
, &tm
)
804 || !PACKET_get_length_prefixed_2(&cookie
, &chhash
)
805 || !PACKET_get_length_prefixed_1(&cookie
, &appcookie
)
806 || PACKET_remaining(&cookie
) != SHA256_DIGEST_LENGTH
) {
807 SSLfatal(s
, SSL_AD_DECODE_ERROR
, SSL_R_LENGTH_MISMATCH
);
811 /* We tolerate a cookie age of up to 10 minutes (= 60 * 10 seconds) */
812 now
= (unsigned long)time(NULL
);
813 if (tm
> now
|| (now
- tm
) > 600) {
814 /* Cookie is stale. Ignore it */
818 /* Verify the app cookie */
819 if (s
->ctx
->verify_stateless_cookie_cb(s
, PACKET_data(&appcookie
),
820 PACKET_remaining(&appcookie
)) == 0) {
821 SSLfatal(s
, SSL_AD_ILLEGAL_PARAMETER
, SSL_R_COOKIE_MISMATCH
);
826 * Reconstruct the HRR that we would have sent in response to the original
827 * ClientHello so we can add it to the transcript hash.
828 * Note: This won't work with custom HRR extensions
830 if (!WPACKET_init_static_len(&hrrpkt
, hrr
, sizeof(hrr
), 0)) {
831 SSLfatal(s
, SSL_AD_INTERNAL_ERROR
, ERR_R_INTERNAL_ERROR
);
834 if (!WPACKET_put_bytes_u8(&hrrpkt
, SSL3_MT_SERVER_HELLO
)
835 || !WPACKET_start_sub_packet_u24(&hrrpkt
)
836 || !WPACKET_put_bytes_u16(&hrrpkt
, TLS1_2_VERSION
)
837 || !WPACKET_memcpy(&hrrpkt
, hrrrandom
, SSL3_RANDOM_SIZE
)
838 || !WPACKET_sub_memcpy_u8(&hrrpkt
, s
->tmp_session_id
,
839 s
->tmp_session_id_len
)
840 || !s
->method
->put_cipher_by_char(s
->s3
.tmp
.new_cipher
, &hrrpkt
,
842 || !WPACKET_put_bytes_u8(&hrrpkt
, 0)
843 || !WPACKET_start_sub_packet_u16(&hrrpkt
)) {
844 WPACKET_cleanup(&hrrpkt
);
845 SSLfatal(s
, SSL_AD_INTERNAL_ERROR
, ERR_R_INTERNAL_ERROR
);
848 if (!WPACKET_put_bytes_u16(&hrrpkt
, TLSEXT_TYPE_supported_versions
)
849 || !WPACKET_start_sub_packet_u16(&hrrpkt
)
850 || !WPACKET_put_bytes_u16(&hrrpkt
, s
->version
)
851 || !WPACKET_close(&hrrpkt
)) {
852 WPACKET_cleanup(&hrrpkt
);
853 SSLfatal(s
, SSL_AD_INTERNAL_ERROR
, ERR_R_INTERNAL_ERROR
);
857 if (!WPACKET_put_bytes_u16(&hrrpkt
, TLSEXT_TYPE_key_share
)
858 || !WPACKET_start_sub_packet_u16(&hrrpkt
)
859 || !WPACKET_put_bytes_u16(&hrrpkt
, s
->s3
.group_id
)
860 || !WPACKET_close(&hrrpkt
)) {
861 WPACKET_cleanup(&hrrpkt
);
862 SSLfatal(s
, SSL_AD_INTERNAL_ERROR
, ERR_R_INTERNAL_ERROR
);
866 if (!WPACKET_put_bytes_u16(&hrrpkt
, TLSEXT_TYPE_cookie
)
867 || !WPACKET_start_sub_packet_u16(&hrrpkt
)
868 || !WPACKET_sub_memcpy_u16(&hrrpkt
, data
, rawlen
)
869 || !WPACKET_close(&hrrpkt
) /* cookie extension */
870 || !WPACKET_close(&hrrpkt
) /* extension block */
871 || !WPACKET_close(&hrrpkt
) /* message */
872 || !WPACKET_get_total_written(&hrrpkt
, &hrrlen
)
873 || !WPACKET_finish(&hrrpkt
)) {
874 WPACKET_cleanup(&hrrpkt
);
875 SSLfatal(s
, SSL_AD_INTERNAL_ERROR
, ERR_R_INTERNAL_ERROR
);
879 /* Reconstruct the transcript hash */
880 if (!create_synthetic_message_hash(s
, PACKET_data(&chhash
),
881 PACKET_remaining(&chhash
), hrr
,
883 /* SSLfatal() already called */
887 /* Act as if this ClientHello came after a HelloRetryRequest */
888 s
->hello_retry_request
= 1;
896 int tls_parse_ctos_supported_groups(SSL
*s
, PACKET
*pkt
, unsigned int context
,
897 X509
*x
, size_t chainidx
)
899 PACKET supported_groups_list
;
901 /* Each group is 2 bytes and we must have at least 1. */
902 if (!PACKET_as_length_prefixed_2(pkt
, &supported_groups_list
)
903 || PACKET_remaining(&supported_groups_list
) == 0
904 || (PACKET_remaining(&supported_groups_list
) % 2) != 0) {
905 SSLfatal(s
, SSL_AD_DECODE_ERROR
, SSL_R_BAD_EXTENSION
);
909 if (!s
->hit
|| SSL_IS_TLS13(s
)) {
910 OPENSSL_free(s
->ext
.peer_supportedgroups
);
911 s
->ext
.peer_supportedgroups
= NULL
;
912 s
->ext
.peer_supportedgroups_len
= 0;
913 if (!tls1_save_u16(&supported_groups_list
,
914 &s
->ext
.peer_supportedgroups
,
915 &s
->ext
.peer_supportedgroups_len
)) {
916 SSLfatal(s
, SSL_AD_INTERNAL_ERROR
, ERR_R_INTERNAL_ERROR
);
924 int tls_parse_ctos_ems(SSL
*s
, PACKET
*pkt
, unsigned int context
, X509
*x
,
927 /* The extension must always be empty */
928 if (PACKET_remaining(pkt
) != 0) {
929 SSLfatal(s
, SSL_AD_DECODE_ERROR
, SSL_R_BAD_EXTENSION
);
933 if (s
->options
& SSL_OP_NO_EXTENDED_MASTER_SECRET
)
936 s
->s3
.flags
|= TLS1_FLAGS_RECEIVED_EXTMS
;
942 int tls_parse_ctos_early_data(SSL
*s
, PACKET
*pkt
, unsigned int context
,
943 X509
*x
, size_t chainidx
)
945 if (PACKET_remaining(pkt
) != 0) {
946 SSLfatal(s
, SSL_AD_DECODE_ERROR
, SSL_R_BAD_EXTENSION
);
950 if (s
->hello_retry_request
!= SSL_HRR_NONE
) {
951 SSLfatal(s
, SSL_AD_ILLEGAL_PARAMETER
, SSL_R_BAD_EXTENSION
);
958 static SSL_TICKET_STATUS
tls_get_stateful_ticket(SSL
*s
, PACKET
*tick
,
961 SSL_SESSION
*tmpsess
= NULL
;
963 s
->ext
.ticket_expected
= 1;
965 switch (PACKET_remaining(tick
)) {
967 return SSL_TICKET_EMPTY
;
969 case SSL_MAX_SSL_SESSION_ID_LENGTH
:
973 return SSL_TICKET_NO_DECRYPT
;
976 tmpsess
= lookup_sess_in_cache(s
, PACKET_data(tick
),
977 SSL_MAX_SSL_SESSION_ID_LENGTH
);
980 return SSL_TICKET_NO_DECRYPT
;
983 return SSL_TICKET_SUCCESS
;
986 int tls_parse_ctos_psk(SSL
*s
, PACKET
*pkt
, unsigned int context
, X509
*x
,
989 PACKET identities
, binders
, binder
;
990 size_t binderoffset
, hashsize
;
991 SSL_SESSION
*sess
= NULL
;
992 unsigned int id
, i
, ext
= 0;
993 const EVP_MD
*md
= NULL
;
996 * If we have no PSK kex mode that we recognise then we can't resume so
997 * ignore this extension
999 if ((s
->ext
.psk_kex_mode
1000 & (TLSEXT_KEX_MODE_FLAG_KE
| TLSEXT_KEX_MODE_FLAG_KE_DHE
)) == 0)
1003 if (!PACKET_get_length_prefixed_2(pkt
, &identities
)) {
1004 SSLfatal(s
, SSL_AD_DECODE_ERROR
, SSL_R_BAD_EXTENSION
);
1008 s
->ext
.ticket_expected
= 0;
1009 for (id
= 0; PACKET_remaining(&identities
) != 0; id
++) {
1011 unsigned long ticket_agel
;
1014 if (!PACKET_get_length_prefixed_2(&identities
, &identity
)
1015 || !PACKET_get_net_4(&identities
, &ticket_agel
)) {
1016 SSLfatal(s
, SSL_AD_DECODE_ERROR
, SSL_R_BAD_EXTENSION
);
1020 idlen
= PACKET_remaining(&identity
);
1021 if (s
->psk_find_session_cb
!= NULL
1022 && !s
->psk_find_session_cb(s
, PACKET_data(&identity
), idlen
,
1024 SSLfatal(s
, SSL_AD_INTERNAL_ERROR
, SSL_R_BAD_EXTENSION
);
1028 #ifndef OPENSSL_NO_PSK
1030 && s
->psk_server_callback
!= NULL
1031 && idlen
<= PSK_MAX_IDENTITY_LEN
) {
1033 unsigned char pskdata
[PSK_MAX_PSK_LEN
];
1034 unsigned int pskdatalen
;
1036 if (!PACKET_strndup(&identity
, &pskid
)) {
1037 SSLfatal(s
, SSL_AD_INTERNAL_ERROR
, ERR_R_INTERNAL_ERROR
);
1040 pskdatalen
= s
->psk_server_callback(s
, pskid
, pskdata
,
1042 OPENSSL_free(pskid
);
1043 if (pskdatalen
> PSK_MAX_PSK_LEN
) {
1044 SSLfatal(s
, SSL_AD_INTERNAL_ERROR
, ERR_R_INTERNAL_ERROR
);
1046 } else if (pskdatalen
> 0) {
1047 const SSL_CIPHER
*cipher
;
1048 const unsigned char tls13_aes128gcmsha256_id
[] = { 0x13, 0x01 };
1051 * We found a PSK using an old style callback. We don't know
1052 * the digest so we default to SHA256 as per the TLSv1.3 spec
1054 cipher
= SSL_CIPHER_find(s
, tls13_aes128gcmsha256_id
);
1055 if (cipher
== NULL
) {
1056 OPENSSL_cleanse(pskdata
, pskdatalen
);
1057 SSLfatal(s
, SSL_AD_INTERNAL_ERROR
, ERR_R_INTERNAL_ERROR
);
1061 sess
= SSL_SESSION_new();
1063 || !SSL_SESSION_set1_master_key(sess
, pskdata
,
1065 || !SSL_SESSION_set_cipher(sess
, cipher
)
1066 || !SSL_SESSION_set_protocol_version(sess
,
1068 OPENSSL_cleanse(pskdata
, pskdatalen
);
1069 SSLfatal(s
, SSL_AD_INTERNAL_ERROR
, ERR_R_INTERNAL_ERROR
);
1072 OPENSSL_cleanse(pskdata
, pskdatalen
);
1075 #endif /* OPENSSL_NO_PSK */
1078 /* We found a PSK */
1079 SSL_SESSION
*sesstmp
= ssl_session_dup(sess
, 0);
1081 if (sesstmp
== NULL
) {
1082 SSLfatal(s
, SSL_AD_INTERNAL_ERROR
, ERR_R_INTERNAL_ERROR
);
1085 SSL_SESSION_free(sess
);
1089 * We've just been told to use this session for this context so
1090 * make sure the sid_ctx matches up.
1092 memcpy(sess
->sid_ctx
, s
->sid_ctx
, s
->sid_ctx_length
);
1093 sess
->sid_ctx_length
= s
->sid_ctx_length
;
1096 s
->ext
.early_data_ok
= 1;
1097 s
->ext
.ticket_expected
= 1;
1099 uint32_t ticket_age
= 0, now
, agesec
, agems
;
1103 * If we are using anti-replay protection then we behave as if
1104 * SSL_OP_NO_TICKET is set - we are caching tickets anyway so there
1105 * is no point in using full stateless tickets.
1107 if ((s
->options
& SSL_OP_NO_TICKET
) != 0
1108 || (s
->max_early_data
> 0
1109 && (s
->options
& SSL_OP_NO_ANTI_REPLAY
) == 0))
1110 ret
= tls_get_stateful_ticket(s
, &identity
, &sess
);
1112 ret
= tls_decrypt_ticket(s
, PACKET_data(&identity
),
1113 PACKET_remaining(&identity
), NULL
, 0,
1116 if (ret
== SSL_TICKET_EMPTY
) {
1117 SSLfatal(s
, SSL_AD_DECODE_ERROR
, SSL_R_BAD_EXTENSION
);
1121 if (ret
== SSL_TICKET_FATAL_ERR_MALLOC
1122 || ret
== SSL_TICKET_FATAL_ERR_OTHER
) {
1123 SSLfatal(s
, SSL_AD_INTERNAL_ERROR
, ERR_R_INTERNAL_ERROR
);
1126 if (ret
== SSL_TICKET_NONE
|| ret
== SSL_TICKET_NO_DECRYPT
)
1129 /* Check for replay */
1130 if (s
->max_early_data
> 0
1131 && (s
->options
& SSL_OP_NO_ANTI_REPLAY
) == 0
1132 && !SSL_CTX_remove_session(s
->session_ctx
, sess
)) {
1133 SSL_SESSION_free(sess
);
1138 ticket_age
= (uint32_t)ticket_agel
;
1139 now
= (uint32_t)time(NULL
);
1140 agesec
= now
- (uint32_t)sess
->time
;
1141 agems
= agesec
* (uint32_t)1000;
1142 ticket_age
-= sess
->ext
.tick_age_add
;
1145 * For simplicity we do our age calculations in seconds. If the
1146 * client does it in ms then it could appear that their ticket age
1147 * is longer than ours (our ticket age calculation should always be
1148 * slightly longer than the client's due to the network latency).
1149 * Therefore we add 1000ms to our age calculation to adjust for
1153 && sess
->timeout
>= (long)agesec
1154 && agems
/ (uint32_t)1000 == agesec
1155 && ticket_age
<= agems
+ 1000
1156 && ticket_age
+ TICKET_AGE_ALLOWANCE
>= agems
+ 1000) {
1158 * Ticket age is within tolerance and not expired. We allow it
1161 s
->ext
.early_data_ok
= 1;
1165 md
= ssl_md(s
->ctx
, sess
->cipher
->algorithm2
);
1166 if (!EVP_MD_is_a(md
,
1167 EVP_MD_name(ssl_md(s
->ctx
, s
->s3
.tmp
.new_cipher
->algorithm2
)))) {
1168 /* The ciphersuite is not compatible with this session. */
1169 SSL_SESSION_free(sess
);
1171 s
->ext
.early_data_ok
= 0;
1172 s
->ext
.ticket_expected
= 0;
1181 binderoffset
= PACKET_data(pkt
) - (const unsigned char *)s
->init_buf
->data
;
1182 hashsize
= EVP_MD_size(md
);
1184 if (!PACKET_get_length_prefixed_2(pkt
, &binders
)) {
1185 SSLfatal(s
, SSL_AD_DECODE_ERROR
, SSL_R_BAD_EXTENSION
);
1189 for (i
= 0; i
<= id
; i
++) {
1190 if (!PACKET_get_length_prefixed_1(&binders
, &binder
)) {
1191 SSLfatal(s
, SSL_AD_DECODE_ERROR
, SSL_R_BAD_EXTENSION
);
1196 if (PACKET_remaining(&binder
) != hashsize
) {
1197 SSLfatal(s
, SSL_AD_DECODE_ERROR
, SSL_R_BAD_EXTENSION
);
1200 if (tls_psk_do_binder(s
, md
, (const unsigned char *)s
->init_buf
->data
,
1201 binderoffset
, PACKET_data(&binder
), NULL
, sess
, 0,
1203 /* SSLfatal() already called */
1207 s
->ext
.tick_identity
= id
;
1209 SSL_SESSION_free(s
->session
);
1213 SSL_SESSION_free(sess
);
1217 int tls_parse_ctos_post_handshake_auth(SSL
*s
, PACKET
*pkt
,
1218 ossl_unused
unsigned int context
,
1219 ossl_unused X509
*x
,
1220 ossl_unused
size_t chainidx
)
1222 if (PACKET_remaining(pkt
) != 0) {
1223 SSLfatal(s
, SSL_AD_DECODE_ERROR
,
1224 SSL_R_POST_HANDSHAKE_AUTH_ENCODING_ERR
);
1228 s
->post_handshake_auth
= SSL_PHA_EXT_RECEIVED
;
1234 * Add the server's renegotiation binding
1236 EXT_RETURN
tls_construct_stoc_renegotiate(SSL
*s
, WPACKET
*pkt
,
1237 unsigned int context
, X509
*x
,
1240 if (!s
->s3
.send_connection_binding
)
1241 return EXT_RETURN_NOT_SENT
;
1243 /* Still add this even if SSL_OP_NO_RENEGOTIATION is set */
1244 if (!WPACKET_put_bytes_u16(pkt
, TLSEXT_TYPE_renegotiate
)
1245 || !WPACKET_start_sub_packet_u16(pkt
)
1246 || !WPACKET_start_sub_packet_u8(pkt
)
1247 || !WPACKET_memcpy(pkt
, s
->s3
.previous_client_finished
,
1248 s
->s3
.previous_client_finished_len
)
1249 || !WPACKET_memcpy(pkt
, s
->s3
.previous_server_finished
,
1250 s
->s3
.previous_server_finished_len
)
1251 || !WPACKET_close(pkt
)
1252 || !WPACKET_close(pkt
)) {
1253 SSLfatal(s
, SSL_AD_INTERNAL_ERROR
, ERR_R_INTERNAL_ERROR
);
1254 return EXT_RETURN_FAIL
;
1257 return EXT_RETURN_SENT
;
1260 EXT_RETURN
tls_construct_stoc_server_name(SSL
*s
, WPACKET
*pkt
,
1261 unsigned int context
, X509
*x
,
1264 if (s
->servername_done
!= 1)
1265 return EXT_RETURN_NOT_SENT
;
1268 * Prior to TLSv1.3 we ignore any SNI in the current handshake if resuming.
1269 * We just use the servername from the initial handshake.
1271 if (s
->hit
&& !SSL_IS_TLS13(s
))
1272 return EXT_RETURN_NOT_SENT
;
1274 if (!WPACKET_put_bytes_u16(pkt
, TLSEXT_TYPE_server_name
)
1275 || !WPACKET_put_bytes_u16(pkt
, 0)) {
1276 SSLfatal(s
, SSL_AD_INTERNAL_ERROR
, ERR_R_INTERNAL_ERROR
);
1277 return EXT_RETURN_FAIL
;
1280 return EXT_RETURN_SENT
;
1283 /* Add/include the server's max fragment len extension into ServerHello */
1284 EXT_RETURN
tls_construct_stoc_maxfragmentlen(SSL
*s
, WPACKET
*pkt
,
1285 unsigned int context
, X509
*x
,
1288 if (!USE_MAX_FRAGMENT_LENGTH_EXT(s
->session
))
1289 return EXT_RETURN_NOT_SENT
;
1292 * 4 bytes for this extension type and extension length
1293 * 1 byte for the Max Fragment Length code value.
1295 if (!WPACKET_put_bytes_u16(pkt
, TLSEXT_TYPE_max_fragment_length
)
1296 || !WPACKET_start_sub_packet_u16(pkt
)
1297 || !WPACKET_put_bytes_u8(pkt
, s
->session
->ext
.max_fragment_len_mode
)
1298 || !WPACKET_close(pkt
)) {
1299 SSLfatal(s
, SSL_AD_INTERNAL_ERROR
, ERR_R_INTERNAL_ERROR
);
1300 return EXT_RETURN_FAIL
;
1303 return EXT_RETURN_SENT
;
1306 EXT_RETURN
tls_construct_stoc_ec_pt_formats(SSL
*s
, WPACKET
*pkt
,
1307 unsigned int context
, X509
*x
,
1310 unsigned long alg_k
= s
->s3
.tmp
.new_cipher
->algorithm_mkey
;
1311 unsigned long alg_a
= s
->s3
.tmp
.new_cipher
->algorithm_auth
;
1312 int using_ecc
= ((alg_k
& SSL_kECDHE
) || (alg_a
& SSL_aECDSA
))
1313 && (s
->ext
.peer_ecpointformats
!= NULL
);
1314 const unsigned char *plist
;
1318 return EXT_RETURN_NOT_SENT
;
1320 tls1_get_formatlist(s
, &plist
, &plistlen
);
1321 if (!WPACKET_put_bytes_u16(pkt
, TLSEXT_TYPE_ec_point_formats
)
1322 || !WPACKET_start_sub_packet_u16(pkt
)
1323 || !WPACKET_sub_memcpy_u8(pkt
, plist
, plistlen
)
1324 || !WPACKET_close(pkt
)) {
1325 SSLfatal(s
, SSL_AD_INTERNAL_ERROR
, ERR_R_INTERNAL_ERROR
);
1326 return EXT_RETURN_FAIL
;
1329 return EXT_RETURN_SENT
;
1332 EXT_RETURN
tls_construct_stoc_supported_groups(SSL
*s
, WPACKET
*pkt
,
1333 unsigned int context
, X509
*x
,
1336 const uint16_t *groups
;
1337 size_t numgroups
, i
, first
= 1;
1340 /* s->s3.group_id is non zero if we accepted a key_share */
1341 if (s
->s3
.group_id
== 0)
1342 return EXT_RETURN_NOT_SENT
;
1344 /* Get our list of supported groups */
1345 tls1_get_supported_groups(s
, &groups
, &numgroups
);
1346 if (numgroups
== 0) {
1347 SSLfatal(s
, SSL_AD_INTERNAL_ERROR
, ERR_R_INTERNAL_ERROR
);
1348 return EXT_RETURN_FAIL
;
1351 /* Copy group ID if supported */
1352 version
= SSL_version(s
);
1353 for (i
= 0; i
< numgroups
; i
++) {
1354 uint16_t group
= groups
[i
];
1356 if (tls_valid_group(s
, group
, version
, version
, 0, NULL
)
1357 && tls_group_allowed(s
, group
, SSL_SECOP_CURVE_SUPPORTED
)) {
1360 * Check if the client is already using our preferred group. If
1361 * so we don't need to add this extension
1363 if (s
->s3
.group_id
== group
)
1364 return EXT_RETURN_NOT_SENT
;
1366 /* Add extension header */
1367 if (!WPACKET_put_bytes_u16(pkt
, TLSEXT_TYPE_supported_groups
)
1368 /* Sub-packet for supported_groups extension */
1369 || !WPACKET_start_sub_packet_u16(pkt
)
1370 || !WPACKET_start_sub_packet_u16(pkt
)) {
1371 SSLfatal(s
, SSL_AD_INTERNAL_ERROR
, ERR_R_INTERNAL_ERROR
);
1372 return EXT_RETURN_FAIL
;
1377 if (!WPACKET_put_bytes_u16(pkt
, group
)) {
1378 SSLfatal(s
, SSL_AD_INTERNAL_ERROR
, ERR_R_INTERNAL_ERROR
);
1379 return EXT_RETURN_FAIL
;
1384 if (!WPACKET_close(pkt
) || !WPACKET_close(pkt
)) {
1385 SSLfatal(s
, SSL_AD_INTERNAL_ERROR
, ERR_R_INTERNAL_ERROR
);
1386 return EXT_RETURN_FAIL
;
1389 return EXT_RETURN_SENT
;
1392 EXT_RETURN
tls_construct_stoc_session_ticket(SSL
*s
, WPACKET
*pkt
,
1393 unsigned int context
, X509
*x
,
1396 if (!s
->ext
.ticket_expected
|| !tls_use_ticket(s
)) {
1397 s
->ext
.ticket_expected
= 0;
1398 return EXT_RETURN_NOT_SENT
;
1401 if (!WPACKET_put_bytes_u16(pkt
, TLSEXT_TYPE_session_ticket
)
1402 || !WPACKET_put_bytes_u16(pkt
, 0)) {
1403 SSLfatal(s
, SSL_AD_INTERNAL_ERROR
, ERR_R_INTERNAL_ERROR
);
1404 return EXT_RETURN_FAIL
;
1407 return EXT_RETURN_SENT
;
1410 #ifndef OPENSSL_NO_OCSP
1411 EXT_RETURN
tls_construct_stoc_status_request(SSL
*s
, WPACKET
*pkt
,
1412 unsigned int context
, X509
*x
,
1415 /* We don't currently support this extension inside a CertificateRequest */
1416 if (context
== SSL_EXT_TLS1_3_CERTIFICATE_REQUEST
)
1417 return EXT_RETURN_NOT_SENT
;
1419 if (!s
->ext
.status_expected
)
1420 return EXT_RETURN_NOT_SENT
;
1422 if (SSL_IS_TLS13(s
) && chainidx
!= 0)
1423 return EXT_RETURN_NOT_SENT
;
1425 if (!WPACKET_put_bytes_u16(pkt
, TLSEXT_TYPE_status_request
)
1426 || !WPACKET_start_sub_packet_u16(pkt
)) {
1427 SSLfatal(s
, SSL_AD_INTERNAL_ERROR
, ERR_R_INTERNAL_ERROR
);
1428 return EXT_RETURN_FAIL
;
1432 * In TLSv1.3 we include the certificate status itself. In <= TLSv1.2 we
1433 * send back an empty extension, with the certificate status appearing as a
1436 if (SSL_IS_TLS13(s
) && !tls_construct_cert_status_body(s
, pkt
)) {
1437 /* SSLfatal() already called */
1438 return EXT_RETURN_FAIL
;
1440 if (!WPACKET_close(pkt
)) {
1441 SSLfatal(s
, SSL_AD_INTERNAL_ERROR
, ERR_R_INTERNAL_ERROR
);
1442 return EXT_RETURN_FAIL
;
1445 return EXT_RETURN_SENT
;
1449 #ifndef OPENSSL_NO_NEXTPROTONEG
1450 EXT_RETURN
tls_construct_stoc_next_proto_neg(SSL
*s
, WPACKET
*pkt
,
1451 unsigned int context
, X509
*x
,
1454 const unsigned char *npa
;
1455 unsigned int npalen
;
1457 int npn_seen
= s
->s3
.npn_seen
;
1460 if (!npn_seen
|| s
->ctx
->ext
.npn_advertised_cb
== NULL
)
1461 return EXT_RETURN_NOT_SENT
;
1463 ret
= s
->ctx
->ext
.npn_advertised_cb(s
, &npa
, &npalen
,
1464 s
->ctx
->ext
.npn_advertised_cb_arg
);
1465 if (ret
== SSL_TLSEXT_ERR_OK
) {
1466 if (!WPACKET_put_bytes_u16(pkt
, TLSEXT_TYPE_next_proto_neg
)
1467 || !WPACKET_sub_memcpy_u16(pkt
, npa
, npalen
)) {
1468 SSLfatal(s
, SSL_AD_INTERNAL_ERROR
, ERR_R_INTERNAL_ERROR
);
1469 return EXT_RETURN_FAIL
;
1474 return EXT_RETURN_SENT
;
1478 EXT_RETURN
tls_construct_stoc_alpn(SSL
*s
, WPACKET
*pkt
, unsigned int context
,
1479 X509
*x
, size_t chainidx
)
1481 if (s
->s3
.alpn_selected
== NULL
)
1482 return EXT_RETURN_NOT_SENT
;
1484 if (!WPACKET_put_bytes_u16(pkt
,
1485 TLSEXT_TYPE_application_layer_protocol_negotiation
)
1486 || !WPACKET_start_sub_packet_u16(pkt
)
1487 || !WPACKET_start_sub_packet_u16(pkt
)
1488 || !WPACKET_sub_memcpy_u8(pkt
, s
->s3
.alpn_selected
,
1489 s
->s3
.alpn_selected_len
)
1490 || !WPACKET_close(pkt
)
1491 || !WPACKET_close(pkt
)) {
1492 SSLfatal(s
, SSL_AD_INTERNAL_ERROR
, ERR_R_INTERNAL_ERROR
);
1493 return EXT_RETURN_FAIL
;
1496 return EXT_RETURN_SENT
;
1499 #ifndef OPENSSL_NO_SRTP
1500 EXT_RETURN
tls_construct_stoc_use_srtp(SSL
*s
, WPACKET
*pkt
,
1501 unsigned int context
, X509
*x
,
1504 if (s
->srtp_profile
== NULL
)
1505 return EXT_RETURN_NOT_SENT
;
1507 if (!WPACKET_put_bytes_u16(pkt
, TLSEXT_TYPE_use_srtp
)
1508 || !WPACKET_start_sub_packet_u16(pkt
)
1509 || !WPACKET_put_bytes_u16(pkt
, 2)
1510 || !WPACKET_put_bytes_u16(pkt
, s
->srtp_profile
->id
)
1511 || !WPACKET_put_bytes_u8(pkt
, 0)
1512 || !WPACKET_close(pkt
)) {
1513 SSLfatal(s
, SSL_AD_INTERNAL_ERROR
, ERR_R_INTERNAL_ERROR
);
1514 return EXT_RETURN_FAIL
;
1517 return EXT_RETURN_SENT
;
1521 EXT_RETURN
tls_construct_stoc_etm(SSL
*s
, WPACKET
*pkt
, unsigned int context
,
1522 X509
*x
, size_t chainidx
)
1524 if (!s
->ext
.use_etm
)
1525 return EXT_RETURN_NOT_SENT
;
1528 * Don't use encrypt_then_mac if AEAD or RC4 might want to disable
1529 * for other cases too.
1531 if (s
->s3
.tmp
.new_cipher
->algorithm_mac
== SSL_AEAD
1532 || s
->s3
.tmp
.new_cipher
->algorithm_enc
== SSL_RC4
1533 || s
->s3
.tmp
.new_cipher
->algorithm_enc
== SSL_eGOST2814789CNT
1534 || s
->s3
.tmp
.new_cipher
->algorithm_enc
== SSL_eGOST2814789CNT12
1535 || s
->s3
.tmp
.new_cipher
->algorithm_enc
== SSL_MAGMA
1536 || s
->s3
.tmp
.new_cipher
->algorithm_enc
== SSL_KUZNYECHIK
) {
1538 return EXT_RETURN_NOT_SENT
;
1541 if (!WPACKET_put_bytes_u16(pkt
, TLSEXT_TYPE_encrypt_then_mac
)
1542 || !WPACKET_put_bytes_u16(pkt
, 0)) {
1543 SSLfatal(s
, SSL_AD_INTERNAL_ERROR
, ERR_R_INTERNAL_ERROR
);
1544 return EXT_RETURN_FAIL
;
1547 return EXT_RETURN_SENT
;
1550 EXT_RETURN
tls_construct_stoc_ems(SSL
*s
, WPACKET
*pkt
, unsigned int context
,
1551 X509
*x
, size_t chainidx
)
1553 if ((s
->s3
.flags
& TLS1_FLAGS_RECEIVED_EXTMS
) == 0)
1554 return EXT_RETURN_NOT_SENT
;
1556 if (!WPACKET_put_bytes_u16(pkt
, TLSEXT_TYPE_extended_master_secret
)
1557 || !WPACKET_put_bytes_u16(pkt
, 0)) {
1558 SSLfatal(s
, SSL_AD_INTERNAL_ERROR
, ERR_R_INTERNAL_ERROR
);
1559 return EXT_RETURN_FAIL
;
1562 return EXT_RETURN_SENT
;
1565 EXT_RETURN
tls_construct_stoc_supported_versions(SSL
*s
, WPACKET
*pkt
,
1566 unsigned int context
, X509
*x
,
1569 if (!ossl_assert(SSL_IS_TLS13(s
))) {
1570 SSLfatal(s
, SSL_AD_INTERNAL_ERROR
, ERR_R_INTERNAL_ERROR
);
1571 return EXT_RETURN_FAIL
;
1574 if (!WPACKET_put_bytes_u16(pkt
, TLSEXT_TYPE_supported_versions
)
1575 || !WPACKET_start_sub_packet_u16(pkt
)
1576 || !WPACKET_put_bytes_u16(pkt
, s
->version
)
1577 || !WPACKET_close(pkt
)) {
1578 SSLfatal(s
, SSL_AD_INTERNAL_ERROR
, ERR_R_INTERNAL_ERROR
);
1579 return EXT_RETURN_FAIL
;
1582 return EXT_RETURN_SENT
;
1585 EXT_RETURN
tls_construct_stoc_key_share(SSL
*s
, WPACKET
*pkt
,
1586 unsigned int context
, X509
*x
,
1589 #ifndef OPENSSL_NO_TLS1_3
1590 unsigned char *encodedPoint
;
1591 size_t encoded_pt_len
= 0;
1592 EVP_PKEY
*ckey
= s
->s3
.peer_tmp
, *skey
= NULL
;
1593 const TLS_GROUP_INFO
*ginf
= NULL
;
1595 if (s
->hello_retry_request
== SSL_HRR_PENDING
) {
1597 /* Original key_share was acceptable so don't ask for another one */
1598 return EXT_RETURN_NOT_SENT
;
1600 if (!WPACKET_put_bytes_u16(pkt
, TLSEXT_TYPE_key_share
)
1601 || !WPACKET_start_sub_packet_u16(pkt
)
1602 || !WPACKET_put_bytes_u16(pkt
, s
->s3
.group_id
)
1603 || !WPACKET_close(pkt
)) {
1604 SSLfatal(s
, SSL_AD_INTERNAL_ERROR
, ERR_R_INTERNAL_ERROR
);
1605 return EXT_RETURN_FAIL
;
1608 return EXT_RETURN_SENT
;
1612 /* No key_share received from client - must be resuming */
1613 if (!s
->hit
|| !tls13_generate_handshake_secret(s
, NULL
, 0)) {
1614 SSLfatal(s
, SSL_AD_INTERNAL_ERROR
, ERR_R_INTERNAL_ERROR
);
1615 return EXT_RETURN_FAIL
;
1617 return EXT_RETURN_NOT_SENT
;
1619 if (s
->hit
&& (s
->ext
.psk_kex_mode
& TLSEXT_KEX_MODE_FLAG_KE_DHE
) == 0) {
1621 * PSK ('hit') and explicitly not doing DHE (if the client sent the
1622 * DHE option we always take it); don't send key share.
1624 return EXT_RETURN_NOT_SENT
;
1627 if (!WPACKET_put_bytes_u16(pkt
, TLSEXT_TYPE_key_share
)
1628 || !WPACKET_start_sub_packet_u16(pkt
)
1629 || !WPACKET_put_bytes_u16(pkt
, s
->s3
.group_id
)) {
1630 SSLfatal(s
, SSL_AD_INTERNAL_ERROR
, ERR_R_INTERNAL_ERROR
);
1631 return EXT_RETURN_FAIL
;
1634 if ((ginf
= tls1_group_id_lookup(s
->ctx
, s
->s3
.group_id
)) == NULL
) {
1635 SSLfatal(s
, SSL_AD_INTERNAL_ERROR
, ERR_R_INTERNAL_ERROR
);
1636 return EXT_RETURN_FAIL
;
1639 if (!ginf
->is_kem
) {
1641 skey
= ssl_generate_pkey(s
, ckey
);
1643 SSLfatal(s
, SSL_AD_INTERNAL_ERROR
, ERR_R_MALLOC_FAILURE
);
1644 return EXT_RETURN_FAIL
;
1647 /* Generate encoding of server key */
1648 encoded_pt_len
= EVP_PKEY_get1_encoded_public_key(skey
, &encodedPoint
);
1649 if (encoded_pt_len
== 0) {
1650 SSLfatal(s
, SSL_AD_INTERNAL_ERROR
, ERR_R_EC_LIB
);
1651 EVP_PKEY_free(skey
);
1652 return EXT_RETURN_FAIL
;
1655 if (!WPACKET_sub_memcpy_u16(pkt
, encodedPoint
, encoded_pt_len
)
1656 || !WPACKET_close(pkt
)) {
1657 SSLfatal(s
, SSL_AD_INTERNAL_ERROR
, ERR_R_INTERNAL_ERROR
);
1658 EVP_PKEY_free(skey
);
1659 OPENSSL_free(encodedPoint
);
1660 return EXT_RETURN_FAIL
;
1662 OPENSSL_free(encodedPoint
);
1665 * This causes the crypto state to be updated based on the derived keys
1667 s
->s3
.tmp
.pkey
= skey
;
1668 if (ssl_derive(s
, skey
, ckey
, 1) == 0) {
1669 /* SSLfatal() already called */
1670 return EXT_RETURN_FAIL
;
1674 unsigned char *ct
= NULL
;
1678 * This does not update the crypto state.
1680 * The generated pms is stored in `s->s3.tmp.pms` to be later used via
1683 if (ssl_encapsulate(s
, ckey
, &ct
, &ctlen
, 0) == 0) {
1684 /* SSLfatal() already called */
1685 return EXT_RETURN_FAIL
;
1689 SSLfatal(s
, SSL_AD_INTERNAL_ERROR
, ERR_R_INTERNAL_ERROR
);
1691 return EXT_RETURN_FAIL
;
1694 if (!WPACKET_sub_memcpy_u16(pkt
, ct
, ctlen
)
1695 || !WPACKET_close(pkt
)) {
1696 SSLfatal(s
, SSL_AD_INTERNAL_ERROR
, ERR_R_INTERNAL_ERROR
);
1698 return EXT_RETURN_FAIL
;
1703 * This causes the crypto state to be updated based on the generated pms
1705 if (ssl_gensecret(s
, s
->s3
.tmp
.pms
, s
->s3
.tmp
.pmslen
) == 0) {
1706 /* SSLfatal() already called */
1707 return EXT_RETURN_FAIL
;
1711 return EXT_RETURN_SENT
;
1713 return EXT_RETURN_FAIL
;
1717 EXT_RETURN
tls_construct_stoc_cookie(SSL
*s
, WPACKET
*pkt
, unsigned int context
,
1718 X509
*x
, size_t chainidx
)
1720 #ifndef OPENSSL_NO_TLS1_3
1721 unsigned char *hashval1
, *hashval2
, *appcookie1
, *appcookie2
, *cookie
;
1722 unsigned char *hmac
, *hmac2
;
1723 size_t startlen
, ciphlen
, totcookielen
, hashlen
, hmaclen
, appcookielen
;
1726 int ret
= EXT_RETURN_FAIL
;
1728 if ((s
->s3
.flags
& TLS1_FLAGS_STATELESS
) == 0)
1729 return EXT_RETURN_NOT_SENT
;
1731 if (s
->ctx
->gen_stateless_cookie_cb
== NULL
) {
1732 SSLfatal(s
, SSL_AD_INTERNAL_ERROR
, SSL_R_NO_COOKIE_CALLBACK_SET
);
1733 return EXT_RETURN_FAIL
;
1736 if (!WPACKET_put_bytes_u16(pkt
, TLSEXT_TYPE_cookie
)
1737 || !WPACKET_start_sub_packet_u16(pkt
)
1738 || !WPACKET_start_sub_packet_u16(pkt
)
1739 || !WPACKET_get_total_written(pkt
, &startlen
)
1740 || !WPACKET_reserve_bytes(pkt
, MAX_COOKIE_SIZE
, &cookie
)
1741 || !WPACKET_put_bytes_u16(pkt
, COOKIE_STATE_FORMAT_VERSION
)
1742 || !WPACKET_put_bytes_u16(pkt
, TLS1_3_VERSION
)
1743 || !WPACKET_put_bytes_u16(pkt
, s
->s3
.group_id
)
1744 || !s
->method
->put_cipher_by_char(s
->s3
.tmp
.new_cipher
, pkt
,
1746 /* Is there a key_share extension present in this HRR? */
1747 || !WPACKET_put_bytes_u8(pkt
, s
->s3
.peer_tmp
== NULL
)
1748 || !WPACKET_put_bytes_u32(pkt
, (unsigned int)time(NULL
))
1749 || !WPACKET_start_sub_packet_u16(pkt
)
1750 || !WPACKET_reserve_bytes(pkt
, EVP_MAX_MD_SIZE
, &hashval1
)) {
1751 SSLfatal(s
, SSL_AD_INTERNAL_ERROR
, ERR_R_INTERNAL_ERROR
);
1752 return EXT_RETURN_FAIL
;
1756 * Get the hash of the initial ClientHello. ssl_handshake_hash() operates
1757 * on raw buffers, so we first reserve sufficient bytes (above) and then
1758 * subsequently allocate them (below)
1760 if (!ssl3_digest_cached_records(s
, 0)
1761 || !ssl_handshake_hash(s
, hashval1
, EVP_MAX_MD_SIZE
, &hashlen
)) {
1762 /* SSLfatal() already called */
1763 return EXT_RETURN_FAIL
;
1766 if (!WPACKET_allocate_bytes(pkt
, hashlen
, &hashval2
)
1767 || !ossl_assert(hashval1
== hashval2
)
1768 || !WPACKET_close(pkt
)
1769 || !WPACKET_start_sub_packet_u8(pkt
)
1770 || !WPACKET_reserve_bytes(pkt
, SSL_COOKIE_LENGTH
, &appcookie1
)) {
1771 SSLfatal(s
, SSL_AD_INTERNAL_ERROR
, ERR_R_INTERNAL_ERROR
);
1772 return EXT_RETURN_FAIL
;
1775 /* Generate the application cookie */
1776 if (s
->ctx
->gen_stateless_cookie_cb(s
, appcookie1
, &appcookielen
) == 0) {
1777 SSLfatal(s
, SSL_AD_INTERNAL_ERROR
, SSL_R_COOKIE_GEN_CALLBACK_FAILURE
);
1778 return EXT_RETURN_FAIL
;
1781 if (!WPACKET_allocate_bytes(pkt
, appcookielen
, &appcookie2
)
1782 || !ossl_assert(appcookie1
== appcookie2
)
1783 || !WPACKET_close(pkt
)
1784 || !WPACKET_get_total_written(pkt
, &totcookielen
)
1785 || !WPACKET_reserve_bytes(pkt
, SHA256_DIGEST_LENGTH
, &hmac
)) {
1786 SSLfatal(s
, SSL_AD_INTERNAL_ERROR
, ERR_R_INTERNAL_ERROR
);
1787 return EXT_RETURN_FAIL
;
1789 hmaclen
= SHA256_DIGEST_LENGTH
;
1791 totcookielen
-= startlen
;
1792 if (!ossl_assert(totcookielen
<= MAX_COOKIE_SIZE
- SHA256_DIGEST_LENGTH
)) {
1793 SSLfatal(s
, SSL_AD_INTERNAL_ERROR
, ERR_R_INTERNAL_ERROR
);
1794 return EXT_RETURN_FAIL
;
1797 /* HMAC the cookie */
1798 hctx
= EVP_MD_CTX_create();
1799 pkey
= EVP_PKEY_new_raw_private_key_ex(s
->ctx
->libctx
, "HMAC",
1801 s
->session_ctx
->ext
.cookie_hmac_key
,
1802 sizeof(s
->session_ctx
->ext
.cookie_hmac_key
));
1803 if (hctx
== NULL
|| pkey
== NULL
) {
1804 SSLfatal(s
, SSL_AD_INTERNAL_ERROR
, ERR_R_MALLOC_FAILURE
);
1808 if (EVP_DigestSignInit_ex(hctx
, NULL
, "SHA2-256", s
->ctx
->libctx
,
1809 s
->ctx
->propq
, pkey
, NULL
) <= 0
1810 || EVP_DigestSign(hctx
, hmac
, &hmaclen
, cookie
,
1811 totcookielen
) <= 0) {
1812 SSLfatal(s
, SSL_AD_INTERNAL_ERROR
, ERR_R_INTERNAL_ERROR
);
1816 if (!ossl_assert(totcookielen
+ hmaclen
<= MAX_COOKIE_SIZE
)) {
1817 SSLfatal(s
, SSL_AD_INTERNAL_ERROR
, ERR_R_INTERNAL_ERROR
);
1821 if (!WPACKET_allocate_bytes(pkt
, hmaclen
, &hmac2
)
1822 || !ossl_assert(hmac
== hmac2
)
1823 || !ossl_assert(cookie
== hmac
- totcookielen
)
1824 || !WPACKET_close(pkt
)
1825 || !WPACKET_close(pkt
)) {
1826 SSLfatal(s
, SSL_AD_INTERNAL_ERROR
, ERR_R_INTERNAL_ERROR
);
1830 ret
= EXT_RETURN_SENT
;
1833 EVP_MD_CTX_free(hctx
);
1834 EVP_PKEY_free(pkey
);
1837 return EXT_RETURN_FAIL
;
1841 EXT_RETURN
tls_construct_stoc_cryptopro_bug(SSL
*s
, WPACKET
*pkt
,
1842 unsigned int context
, X509
*x
,
1845 const unsigned char cryptopro_ext
[36] = {
1846 0xfd, 0xe8, /* 65000 */
1847 0x00, 0x20, /* 32 bytes length */
1848 0x30, 0x1e, 0x30, 0x08, 0x06, 0x06, 0x2a, 0x85,
1849 0x03, 0x02, 0x02, 0x09, 0x30, 0x08, 0x06, 0x06,
1850 0x2a, 0x85, 0x03, 0x02, 0x02, 0x16, 0x30, 0x08,
1851 0x06, 0x06, 0x2a, 0x85, 0x03, 0x02, 0x02, 0x17
1854 if (((s
->s3
.tmp
.new_cipher
->id
& 0xFFFF) != 0x80
1855 && (s
->s3
.tmp
.new_cipher
->id
& 0xFFFF) != 0x81)
1856 || (SSL_get_options(s
) & SSL_OP_CRYPTOPRO_TLSEXT_BUG
) == 0)
1857 return EXT_RETURN_NOT_SENT
;
1859 if (!WPACKET_memcpy(pkt
, cryptopro_ext
, sizeof(cryptopro_ext
))) {
1860 SSLfatal(s
, SSL_AD_INTERNAL_ERROR
, ERR_R_INTERNAL_ERROR
);
1861 return EXT_RETURN_FAIL
;
1864 return EXT_RETURN_SENT
;
1867 EXT_RETURN
tls_construct_stoc_early_data(SSL
*s
, WPACKET
*pkt
,
1868 unsigned int context
, X509
*x
,
1871 if (context
== SSL_EXT_TLS1_3_NEW_SESSION_TICKET
) {
1872 if (s
->max_early_data
== 0)
1873 return EXT_RETURN_NOT_SENT
;
1875 if (!WPACKET_put_bytes_u16(pkt
, TLSEXT_TYPE_early_data
)
1876 || !WPACKET_start_sub_packet_u16(pkt
)
1877 || !WPACKET_put_bytes_u32(pkt
, s
->max_early_data
)
1878 || !WPACKET_close(pkt
)) {
1879 SSLfatal(s
, SSL_AD_INTERNAL_ERROR
, ERR_R_INTERNAL_ERROR
);
1880 return EXT_RETURN_FAIL
;
1883 return EXT_RETURN_SENT
;
1886 if (s
->ext
.early_data
!= SSL_EARLY_DATA_ACCEPTED
)
1887 return EXT_RETURN_NOT_SENT
;
1889 if (!WPACKET_put_bytes_u16(pkt
, TLSEXT_TYPE_early_data
)
1890 || !WPACKET_start_sub_packet_u16(pkt
)
1891 || !WPACKET_close(pkt
)) {
1892 SSLfatal(s
, SSL_AD_INTERNAL_ERROR
, ERR_R_INTERNAL_ERROR
);
1893 return EXT_RETURN_FAIL
;
1896 return EXT_RETURN_SENT
;
1899 EXT_RETURN
tls_construct_stoc_psk(SSL
*s
, WPACKET
*pkt
, unsigned int context
,
1900 X509
*x
, size_t chainidx
)
1903 return EXT_RETURN_NOT_SENT
;
1905 if (!WPACKET_put_bytes_u16(pkt
, TLSEXT_TYPE_psk
)
1906 || !WPACKET_start_sub_packet_u16(pkt
)
1907 || !WPACKET_put_bytes_u16(pkt
, s
->ext
.tick_identity
)
1908 || !WPACKET_close(pkt
)) {
1909 SSLfatal(s
, SSL_AD_INTERNAL_ERROR
, ERR_R_INTERNAL_ERROR
);
1910 return EXT_RETURN_FAIL
;
1913 return EXT_RETURN_SENT
;