2 * Copyright 2016-2020 The OpenSSL Project Authors. All Rights Reserved.
4 * Licensed under the Apache License 2.0 (the "License"). You may not use
5 * this file except in compliance with the License. You can obtain a copy
6 * in the file LICENSE in the source distribution or at
7 * https://www.openssl.org/source/license.html
10 #include <openssl/ocsp.h>
11 #include "../ssl_local.h"
12 #include "statem_local.h"
13 #include "internal/cryptlib.h"
15 DEFINE_STACK_OF(OCSP_RESPID
)
16 DEFINE_STACK_OF(X509_EXTENSION
)
18 #define COOKIE_STATE_FORMAT_VERSION 0
21 * 2 bytes for packet length, 2 bytes for format version, 2 bytes for
22 * protocol version, 2 bytes for group id, 2 bytes for cipher id, 1 byte for
23 * key_share present flag, 4 bytes for timestamp, 2 bytes for the hashlen,
24 * EVP_MAX_MD_SIZE for transcript hash, 1 byte for app cookie length, app cookie
25 * length bytes, SHA256_DIGEST_LENGTH bytes for the HMAC of the whole thing.
27 #define MAX_COOKIE_SIZE (2 + 2 + 2 + 2 + 2 + 1 + 4 + 2 + EVP_MAX_MD_SIZE + 1 \
28 + SSL_COOKIE_LENGTH + SHA256_DIGEST_LENGTH)
31 * Message header + 2 bytes for protocol version + number of random bytes +
32 * + 1 byte for legacy session id length + number of bytes in legacy session id
33 * + 2 bytes for ciphersuite + 1 byte for legacy compression
34 * + 2 bytes for extension block length + 6 bytes for key_share extension
35 * + 4 bytes for cookie extension header + the number of bytes in the cookie
37 #define MAX_HRR_SIZE (SSL3_HM_HEADER_LENGTH + 2 + SSL3_RANDOM_SIZE + 1 \
38 + SSL_MAX_SSL_SESSION_ID_LENGTH + 2 + 1 + 2 + 6 + 4 \
42 * Parse the client's renegotiation binding and abort if it's not right
44 int tls_parse_ctos_renegotiate(SSL
*s
, PACKET
*pkt
, unsigned int context
,
45 X509
*x
, size_t chainidx
)
48 const unsigned char *data
;
50 /* Parse the length byte */
51 if (!PACKET_get_1(pkt
, &ilen
)
52 || !PACKET_get_bytes(pkt
, &data
, ilen
)) {
53 SSLfatal(s
, SSL_AD_DECODE_ERROR
, SSL_F_TLS_PARSE_CTOS_RENEGOTIATE
,
54 SSL_R_RENEGOTIATION_ENCODING_ERR
);
58 /* Check that the extension matches */
59 if (ilen
!= s
->s3
.previous_client_finished_len
) {
60 SSLfatal(s
, SSL_AD_HANDSHAKE_FAILURE
, SSL_F_TLS_PARSE_CTOS_RENEGOTIATE
,
61 SSL_R_RENEGOTIATION_MISMATCH
);
65 if (memcmp(data
, s
->s3
.previous_client_finished
,
66 s
->s3
.previous_client_finished_len
)) {
67 SSLfatal(s
, SSL_AD_HANDSHAKE_FAILURE
, SSL_F_TLS_PARSE_CTOS_RENEGOTIATE
,
68 SSL_R_RENEGOTIATION_MISMATCH
);
72 s
->s3
.send_connection_binding
= 1;
78 * The servername extension is treated as follows:
80 * - Only the hostname type is supported with a maximum length of 255.
81 * - The servername is rejected if too long or if it contains zeros,
82 * in which case an fatal alert is generated.
83 * - The servername field is maintained together with the session cache.
84 * - When a session is resumed, the servername call back invoked in order
85 * to allow the application to position itself to the right context.
86 * - The servername is acknowledged if it is new for a session or when
87 * it is identical to a previously used for the same session.
88 * Applications can control the behaviour. They can at any time
89 * set a 'desirable' servername for a new SSL object. This can be the
90 * case for example with HTTPS when a Host: header field is received and
91 * a renegotiation is requested. In this case, a possible servername
92 * presented in the new client hello is only acknowledged if it matches
93 * the value of the Host: field.
94 * - Applications must use SSL_OP_NO_SESSION_RESUMPTION_ON_RENEGOTIATION
95 * if they provide for changing an explicit servername context for the
96 * session, i.e. when the session has been established with a servername
98 * - On session reconnect, the servername extension may be absent.
100 int tls_parse_ctos_server_name(SSL
*s
, PACKET
*pkt
, unsigned int context
,
101 X509
*x
, size_t chainidx
)
103 unsigned int servname_type
;
104 PACKET sni
, hostname
;
106 if (!PACKET_as_length_prefixed_2(pkt
, &sni
)
107 /* ServerNameList must be at least 1 byte long. */
108 || PACKET_remaining(&sni
) == 0) {
109 SSLfatal(s
, SSL_AD_DECODE_ERROR
, SSL_F_TLS_PARSE_CTOS_SERVER_NAME
,
110 SSL_R_BAD_EXTENSION
);
115 * Although the intent was for server_name to be extensible, RFC 4366
116 * was not clear about it; and so OpenSSL among other implementations,
117 * always and only allows a 'host_name' name types.
118 * RFC 6066 corrected the mistake but adding new name types
119 * is nevertheless no longer feasible, so act as if no other
120 * SNI types can exist, to simplify parsing.
122 * Also note that the RFC permits only one SNI value per type,
123 * i.e., we can only have a single hostname.
125 if (!PACKET_get_1(&sni
, &servname_type
)
126 || servname_type
!= TLSEXT_NAMETYPE_host_name
127 || !PACKET_as_length_prefixed_2(&sni
, &hostname
)) {
128 SSLfatal(s
, SSL_AD_DECODE_ERROR
, SSL_F_TLS_PARSE_CTOS_SERVER_NAME
,
129 SSL_R_BAD_EXTENSION
);
134 * In TLSv1.2 and below the SNI is associated with the session. In TLSv1.3
135 * we always use the SNI value from the handshake.
137 if (!s
->hit
|| SSL_IS_TLS13(s
)) {
138 if (PACKET_remaining(&hostname
) > TLSEXT_MAXLEN_host_name
) {
139 SSLfatal(s
, SSL_AD_UNRECOGNIZED_NAME
,
140 SSL_F_TLS_PARSE_CTOS_SERVER_NAME
,
141 SSL_R_BAD_EXTENSION
);
145 if (PACKET_contains_zero_byte(&hostname
)) {
146 SSLfatal(s
, SSL_AD_UNRECOGNIZED_NAME
,
147 SSL_F_TLS_PARSE_CTOS_SERVER_NAME
,
148 SSL_R_BAD_EXTENSION
);
153 * Store the requested SNI in the SSL as temporary storage.
154 * If we accept it, it will get stored in the SSL_SESSION as well.
156 OPENSSL_free(s
->ext
.hostname
);
157 s
->ext
.hostname
= NULL
;
158 if (!PACKET_strndup(&hostname
, &s
->ext
.hostname
)) {
159 SSLfatal(s
, SSL_AD_INTERNAL_ERROR
, SSL_F_TLS_PARSE_CTOS_SERVER_NAME
,
160 ERR_R_INTERNAL_ERROR
);
164 s
->servername_done
= 1;
167 * In TLSv1.2 and below we should check if the SNI is consistent between
168 * the initial handshake and the resumption. In TLSv1.3 SNI is not
169 * associated with the session.
172 * TODO(openssl-team): if the SNI doesn't match, we MUST
173 * fall back to a full handshake.
175 s
->servername_done
= (s
->session
->ext
.hostname
!= NULL
)
176 && PACKET_equal(&hostname
, s
->session
->ext
.hostname
,
177 strlen(s
->session
->ext
.hostname
));
183 int tls_parse_ctos_maxfragmentlen(SSL
*s
, PACKET
*pkt
, unsigned int context
,
184 X509
*x
, size_t chainidx
)
188 if (PACKET_remaining(pkt
) != 1 || !PACKET_get_1(pkt
, &value
)) {
189 SSLfatal(s
, SSL_AD_DECODE_ERROR
, SSL_F_TLS_PARSE_CTOS_MAXFRAGMENTLEN
,
190 SSL_R_BAD_EXTENSION
);
194 /* Received |value| should be a valid max-fragment-length code. */
195 if (!IS_MAX_FRAGMENT_LENGTH_EXT_VALID(value
)) {
196 SSLfatal(s
, SSL_AD_ILLEGAL_PARAMETER
,
197 SSL_F_TLS_PARSE_CTOS_MAXFRAGMENTLEN
,
198 SSL_R_SSL3_EXT_INVALID_MAX_FRAGMENT_LENGTH
);
203 * RFC 6066: The negotiated length applies for the duration of the session
204 * including session resumptions.
205 * We should receive the same code as in resumed session !
207 if (s
->hit
&& s
->session
->ext
.max_fragment_len_mode
!= value
) {
208 SSLfatal(s
, SSL_AD_ILLEGAL_PARAMETER
,
209 SSL_F_TLS_PARSE_CTOS_MAXFRAGMENTLEN
,
210 SSL_R_SSL3_EXT_INVALID_MAX_FRAGMENT_LENGTH
);
215 * Store it in session, so it'll become binding for us
216 * and we'll include it in a next Server Hello.
218 s
->session
->ext
.max_fragment_len_mode
= value
;
222 #ifndef OPENSSL_NO_SRP
223 int tls_parse_ctos_srp(SSL
*s
, PACKET
*pkt
, unsigned int context
, X509
*x
,
228 if (!PACKET_as_length_prefixed_1(pkt
, &srp_I
)
229 || PACKET_contains_zero_byte(&srp_I
)) {
230 SSLfatal(s
, SSL_AD_DECODE_ERROR
,
231 SSL_F_TLS_PARSE_CTOS_SRP
,
232 SSL_R_BAD_EXTENSION
);
237 * TODO(openssl-team): currently, we re-authenticate the user
238 * upon resumption. Instead, we MUST ignore the login.
240 if (!PACKET_strndup(&srp_I
, &s
->srp_ctx
.login
)) {
241 SSLfatal(s
, SSL_AD_INTERNAL_ERROR
, SSL_F_TLS_PARSE_CTOS_SRP
,
242 ERR_R_INTERNAL_ERROR
);
250 #ifndef OPENSSL_NO_EC
251 int tls_parse_ctos_ec_pt_formats(SSL
*s
, PACKET
*pkt
, unsigned int context
,
252 X509
*x
, size_t chainidx
)
254 PACKET ec_point_format_list
;
256 if (!PACKET_as_length_prefixed_1(pkt
, &ec_point_format_list
)
257 || PACKET_remaining(&ec_point_format_list
) == 0) {
258 SSLfatal(s
, SSL_AD_DECODE_ERROR
, SSL_F_TLS_PARSE_CTOS_EC_PT_FORMATS
,
259 SSL_R_BAD_EXTENSION
);
264 if (!PACKET_memdup(&ec_point_format_list
,
265 &s
->ext
.peer_ecpointformats
,
266 &s
->ext
.peer_ecpointformats_len
)) {
267 SSLfatal(s
, SSL_AD_INTERNAL_ERROR
,
268 SSL_F_TLS_PARSE_CTOS_EC_PT_FORMATS
, ERR_R_INTERNAL_ERROR
);
275 #endif /* OPENSSL_NO_EC */
277 int tls_parse_ctos_session_ticket(SSL
*s
, PACKET
*pkt
, unsigned int context
,
278 X509
*x
, size_t chainidx
)
280 if (s
->ext
.session_ticket_cb
&&
281 !s
->ext
.session_ticket_cb(s
, PACKET_data(pkt
),
282 PACKET_remaining(pkt
),
283 s
->ext
.session_ticket_cb_arg
)) {
284 SSLfatal(s
, SSL_AD_INTERNAL_ERROR
,
285 SSL_F_TLS_PARSE_CTOS_SESSION_TICKET
, ERR_R_INTERNAL_ERROR
);
292 int tls_parse_ctos_sig_algs_cert(SSL
*s
, PACKET
*pkt
, unsigned int context
,
293 X509
*x
, size_t chainidx
)
295 PACKET supported_sig_algs
;
297 if (!PACKET_as_length_prefixed_2(pkt
, &supported_sig_algs
)
298 || PACKET_remaining(&supported_sig_algs
) == 0) {
299 SSLfatal(s
, SSL_AD_DECODE_ERROR
,
300 SSL_F_TLS_PARSE_CTOS_SIG_ALGS_CERT
, SSL_R_BAD_EXTENSION
);
304 if (!s
->hit
&& !tls1_save_sigalgs(s
, &supported_sig_algs
, 1)) {
305 SSLfatal(s
, SSL_AD_DECODE_ERROR
,
306 SSL_F_TLS_PARSE_CTOS_SIG_ALGS_CERT
, SSL_R_BAD_EXTENSION
);
313 int tls_parse_ctos_sig_algs(SSL
*s
, PACKET
*pkt
, unsigned int context
, X509
*x
,
316 PACKET supported_sig_algs
;
318 if (!PACKET_as_length_prefixed_2(pkt
, &supported_sig_algs
)
319 || PACKET_remaining(&supported_sig_algs
) == 0) {
320 SSLfatal(s
, SSL_AD_DECODE_ERROR
,
321 SSL_F_TLS_PARSE_CTOS_SIG_ALGS
, SSL_R_BAD_EXTENSION
);
325 if (!s
->hit
&& !tls1_save_sigalgs(s
, &supported_sig_algs
, 0)) {
326 SSLfatal(s
, SSL_AD_DECODE_ERROR
,
327 SSL_F_TLS_PARSE_CTOS_SIG_ALGS
, SSL_R_BAD_EXTENSION
);
334 #ifndef OPENSSL_NO_OCSP
335 int tls_parse_ctos_status_request(SSL
*s
, PACKET
*pkt
, unsigned int context
,
336 X509
*x
, size_t chainidx
)
338 PACKET responder_id_list
, exts
;
340 /* We ignore this in a resumption handshake */
344 /* Not defined if we get one of these in a client Certificate */
348 if (!PACKET_get_1(pkt
, (unsigned int *)&s
->ext
.status_type
)) {
349 SSLfatal(s
, SSL_AD_DECODE_ERROR
,
350 SSL_F_TLS_PARSE_CTOS_STATUS_REQUEST
, SSL_R_BAD_EXTENSION
);
354 if (s
->ext
.status_type
!= TLSEXT_STATUSTYPE_ocsp
) {
356 * We don't know what to do with any other type so ignore it.
358 s
->ext
.status_type
= TLSEXT_STATUSTYPE_nothing
;
362 if (!PACKET_get_length_prefixed_2 (pkt
, &responder_id_list
)) {
363 SSLfatal(s
, SSL_AD_DECODE_ERROR
,
364 SSL_F_TLS_PARSE_CTOS_STATUS_REQUEST
, SSL_R_BAD_EXTENSION
);
369 * We remove any OCSP_RESPIDs from a previous handshake
370 * to prevent unbounded memory growth - CVE-2016-6304
372 sk_OCSP_RESPID_pop_free(s
->ext
.ocsp
.ids
, OCSP_RESPID_free
);
373 if (PACKET_remaining(&responder_id_list
) > 0) {
374 s
->ext
.ocsp
.ids
= sk_OCSP_RESPID_new_null();
375 if (s
->ext
.ocsp
.ids
== NULL
) {
376 SSLfatal(s
, SSL_AD_INTERNAL_ERROR
,
377 SSL_F_TLS_PARSE_CTOS_STATUS_REQUEST
, ERR_R_MALLOC_FAILURE
);
381 s
->ext
.ocsp
.ids
= NULL
;
384 while (PACKET_remaining(&responder_id_list
) > 0) {
387 const unsigned char *id_data
;
389 if (!PACKET_get_length_prefixed_2(&responder_id_list
, &responder_id
)
390 || PACKET_remaining(&responder_id
) == 0) {
391 SSLfatal(s
, SSL_AD_DECODE_ERROR
,
392 SSL_F_TLS_PARSE_CTOS_STATUS_REQUEST
, SSL_R_BAD_EXTENSION
);
396 id_data
= PACKET_data(&responder_id
);
397 /* TODO(size_t): Convert d2i_* to size_t */
398 id
= d2i_OCSP_RESPID(NULL
, &id_data
,
399 (int)PACKET_remaining(&responder_id
));
401 SSLfatal(s
, SSL_AD_DECODE_ERROR
,
402 SSL_F_TLS_PARSE_CTOS_STATUS_REQUEST
, SSL_R_BAD_EXTENSION
);
406 if (id_data
!= PACKET_end(&responder_id
)) {
407 OCSP_RESPID_free(id
);
408 SSLfatal(s
, SSL_AD_DECODE_ERROR
,
409 SSL_F_TLS_PARSE_CTOS_STATUS_REQUEST
, SSL_R_BAD_EXTENSION
);
414 if (!sk_OCSP_RESPID_push(s
->ext
.ocsp
.ids
, id
)) {
415 OCSP_RESPID_free(id
);
416 SSLfatal(s
, SSL_AD_INTERNAL_ERROR
,
417 SSL_F_TLS_PARSE_CTOS_STATUS_REQUEST
, ERR_R_INTERNAL_ERROR
);
423 /* Read in request_extensions */
424 if (!PACKET_as_length_prefixed_2(pkt
, &exts
)) {
425 SSLfatal(s
, SSL_AD_DECODE_ERROR
,
426 SSL_F_TLS_PARSE_CTOS_STATUS_REQUEST
, SSL_R_BAD_EXTENSION
);
430 if (PACKET_remaining(&exts
) > 0) {
431 const unsigned char *ext_data
= PACKET_data(&exts
);
433 sk_X509_EXTENSION_pop_free(s
->ext
.ocsp
.exts
,
434 X509_EXTENSION_free
);
436 d2i_X509_EXTENSIONS(NULL
, &ext_data
, (int)PACKET_remaining(&exts
));
437 if (s
->ext
.ocsp
.exts
== NULL
|| ext_data
!= PACKET_end(&exts
)) {
438 SSLfatal(s
, SSL_AD_DECODE_ERROR
,
439 SSL_F_TLS_PARSE_CTOS_STATUS_REQUEST
, SSL_R_BAD_EXTENSION
);
448 #ifndef OPENSSL_NO_NEXTPROTONEG
449 int tls_parse_ctos_npn(SSL
*s
, PACKET
*pkt
, unsigned int context
, X509
*x
,
453 * We shouldn't accept this extension on a
456 if (SSL_IS_FIRST_HANDSHAKE(s
))
464 * Save the ALPN extension in a ClientHello.|pkt| holds the contents of the ALPN
465 * extension, not including type and length. Returns: 1 on success, 0 on error.
467 int tls_parse_ctos_alpn(SSL
*s
, PACKET
*pkt
, unsigned int context
, X509
*x
,
470 PACKET protocol_list
, save_protocol_list
, protocol
;
472 if (!SSL_IS_FIRST_HANDSHAKE(s
))
475 if (!PACKET_as_length_prefixed_2(pkt
, &protocol_list
)
476 || PACKET_remaining(&protocol_list
) < 2) {
477 SSLfatal(s
, SSL_AD_DECODE_ERROR
, SSL_F_TLS_PARSE_CTOS_ALPN
,
478 SSL_R_BAD_EXTENSION
);
482 save_protocol_list
= protocol_list
;
484 /* Protocol names can't be empty. */
485 if (!PACKET_get_length_prefixed_1(&protocol_list
, &protocol
)
486 || PACKET_remaining(&protocol
) == 0) {
487 SSLfatal(s
, SSL_AD_DECODE_ERROR
, SSL_F_TLS_PARSE_CTOS_ALPN
,
488 SSL_R_BAD_EXTENSION
);
491 } while (PACKET_remaining(&protocol_list
) != 0);
493 OPENSSL_free(s
->s3
.alpn_proposed
);
494 s
->s3
.alpn_proposed
= NULL
;
495 s
->s3
.alpn_proposed_len
= 0;
496 if (!PACKET_memdup(&save_protocol_list
,
497 &s
->s3
.alpn_proposed
, &s
->s3
.alpn_proposed_len
)) {
498 SSLfatal(s
, SSL_AD_INTERNAL_ERROR
, SSL_F_TLS_PARSE_CTOS_ALPN
,
499 ERR_R_INTERNAL_ERROR
);
506 #ifndef OPENSSL_NO_SRTP
507 int tls_parse_ctos_use_srtp(SSL
*s
, PACKET
*pkt
, unsigned int context
, X509
*x
,
510 STACK_OF(SRTP_PROTECTION_PROFILE
) *srvr
;
511 unsigned int ct
, mki_len
, id
;
515 /* Ignore this if we have no SRTP profiles */
516 if (SSL_get_srtp_profiles(s
) == NULL
)
519 /* Pull off the length of the cipher suite list and check it is even */
520 if (!PACKET_get_net_2(pkt
, &ct
) || (ct
& 1) != 0
521 || !PACKET_get_sub_packet(pkt
, &subpkt
, ct
)) {
522 SSLfatal(s
, SSL_AD_DECODE_ERROR
, SSL_F_TLS_PARSE_CTOS_USE_SRTP
,
523 SSL_R_BAD_SRTP_PROTECTION_PROFILE_LIST
);
527 srvr
= SSL_get_srtp_profiles(s
);
528 s
->srtp_profile
= NULL
;
529 /* Search all profiles for a match initially */
530 srtp_pref
= sk_SRTP_PROTECTION_PROFILE_num(srvr
);
532 while (PACKET_remaining(&subpkt
)) {
533 if (!PACKET_get_net_2(&subpkt
, &id
)) {
534 SSLfatal(s
, SSL_AD_DECODE_ERROR
, SSL_F_TLS_PARSE_CTOS_USE_SRTP
,
535 SSL_R_BAD_SRTP_PROTECTION_PROFILE_LIST
);
540 * Only look for match in profiles of higher preference than
542 * If no profiles have been have been configured then this
545 for (i
= 0; i
< srtp_pref
; i
++) {
546 SRTP_PROTECTION_PROFILE
*sprof
=
547 sk_SRTP_PROTECTION_PROFILE_value(srvr
, i
);
549 if (sprof
->id
== id
) {
550 s
->srtp_profile
= sprof
;
557 /* Now extract the MKI value as a sanity check, but discard it for now */
558 if (!PACKET_get_1(pkt
, &mki_len
)) {
559 SSLfatal(s
, SSL_AD_DECODE_ERROR
, SSL_F_TLS_PARSE_CTOS_USE_SRTP
,
560 SSL_R_BAD_SRTP_PROTECTION_PROFILE_LIST
);
564 if (!PACKET_forward(pkt
, mki_len
)
565 || PACKET_remaining(pkt
)) {
566 SSLfatal(s
, SSL_AD_DECODE_ERROR
, SSL_F_TLS_PARSE_CTOS_USE_SRTP
,
567 SSL_R_BAD_SRTP_MKI_VALUE
);
575 int tls_parse_ctos_etm(SSL
*s
, PACKET
*pkt
, unsigned int context
, X509
*x
,
578 if (!(s
->options
& SSL_OP_NO_ENCRYPT_THEN_MAC
))
585 * Process a psk_kex_modes extension received in the ClientHello. |pkt| contains
586 * the raw PACKET data for the extension. Returns 1 on success or 0 on failure.
588 int tls_parse_ctos_psk_kex_modes(SSL
*s
, PACKET
*pkt
, unsigned int context
,
589 X509
*x
, size_t chainidx
)
591 #ifndef OPENSSL_NO_TLS1_3
592 PACKET psk_kex_modes
;
595 if (!PACKET_as_length_prefixed_1(pkt
, &psk_kex_modes
)
596 || PACKET_remaining(&psk_kex_modes
) == 0) {
597 SSLfatal(s
, SSL_AD_DECODE_ERROR
, SSL_F_TLS_PARSE_CTOS_PSK_KEX_MODES
,
598 SSL_R_BAD_EXTENSION
);
602 while (PACKET_get_1(&psk_kex_modes
, &mode
)) {
603 if (mode
== TLSEXT_KEX_MODE_KE_DHE
)
604 s
->ext
.psk_kex_mode
|= TLSEXT_KEX_MODE_FLAG_KE_DHE
;
605 else if (mode
== TLSEXT_KEX_MODE_KE
606 && (s
->options
& SSL_OP_ALLOW_NO_DHE_KEX
) != 0)
607 s
->ext
.psk_kex_mode
|= TLSEXT_KEX_MODE_FLAG_KE
;
615 * Process a key_share extension received in the ClientHello. |pkt| contains
616 * the raw PACKET data for the extension. Returns 1 on success or 0 on failure.
618 int tls_parse_ctos_key_share(SSL
*s
, PACKET
*pkt
, unsigned int context
, X509
*x
,
621 #ifndef OPENSSL_NO_TLS1_3
622 unsigned int group_id
;
623 PACKET key_share_list
, encoded_pt
;
624 const uint16_t *clntgroups
, *srvrgroups
;
625 size_t clnt_num_groups
, srvr_num_groups
;
628 if (s
->hit
&& (s
->ext
.psk_kex_mode
& TLSEXT_KEX_MODE_FLAG_KE_DHE
) == 0)
632 if (s
->s3
.peer_tmp
!= NULL
) {
633 SSLfatal(s
, SSL_AD_INTERNAL_ERROR
, SSL_F_TLS_PARSE_CTOS_KEY_SHARE
,
634 ERR_R_INTERNAL_ERROR
);
638 if (!PACKET_as_length_prefixed_2(pkt
, &key_share_list
)) {
639 SSLfatal(s
, SSL_AD_DECODE_ERROR
, SSL_F_TLS_PARSE_CTOS_KEY_SHARE
,
640 SSL_R_LENGTH_MISMATCH
);
644 /* Get our list of supported groups */
645 tls1_get_supported_groups(s
, &srvrgroups
, &srvr_num_groups
);
646 /* Get the clients list of supported groups. */
647 tls1_get_peer_groups(s
, &clntgroups
, &clnt_num_groups
);
648 if (clnt_num_groups
== 0) {
650 * This can only happen if the supported_groups extension was not sent,
651 * because we verify that the length is non-zero when we process that
654 SSLfatal(s
, SSL_AD_MISSING_EXTENSION
, SSL_F_TLS_PARSE_CTOS_KEY_SHARE
,
655 SSL_R_MISSING_SUPPORTED_GROUPS_EXTENSION
);
659 if (s
->s3
.group_id
!= 0 && PACKET_remaining(&key_share_list
) == 0) {
661 * If we set a group_id already, then we must have sent an HRR
662 * requesting a new key_share. If we haven't got one then that is an
665 SSLfatal(s
, SSL_AD_ILLEGAL_PARAMETER
, SSL_F_TLS_PARSE_CTOS_KEY_SHARE
,
666 SSL_R_BAD_KEY_SHARE
);
670 while (PACKET_remaining(&key_share_list
) > 0) {
671 if (!PACKET_get_net_2(&key_share_list
, &group_id
)
672 || !PACKET_get_length_prefixed_2(&key_share_list
, &encoded_pt
)
673 || PACKET_remaining(&encoded_pt
) == 0) {
674 SSLfatal(s
, SSL_AD_DECODE_ERROR
, SSL_F_TLS_PARSE_CTOS_KEY_SHARE
,
675 SSL_R_LENGTH_MISMATCH
);
680 * If we already found a suitable key_share we loop through the
681 * rest to verify the structure, but don't process them.
687 * If we sent an HRR then the key_share sent back MUST be for the group
688 * we requested, and must be the only key_share sent.
690 if (s
->s3
.group_id
!= 0
691 && (group_id
!= s
->s3
.group_id
692 || PACKET_remaining(&key_share_list
) != 0)) {
693 SSLfatal(s
, SSL_AD_ILLEGAL_PARAMETER
,
694 SSL_F_TLS_PARSE_CTOS_KEY_SHARE
, SSL_R_BAD_KEY_SHARE
);
698 /* Check if this share is in supported_groups sent from client */
699 if (!check_in_list(s
, group_id
, clntgroups
, clnt_num_groups
, 0)) {
700 SSLfatal(s
, SSL_AD_ILLEGAL_PARAMETER
,
701 SSL_F_TLS_PARSE_CTOS_KEY_SHARE
, SSL_R_BAD_KEY_SHARE
);
705 /* Check if this share is for a group we can use */
706 if (!check_in_list(s
, group_id
, srvrgroups
, srvr_num_groups
, 1)) {
707 /* Share not suitable */
711 if ((s
->s3
.peer_tmp
= ssl_generate_param_group(s
, group_id
)) == NULL
) {
712 SSLfatal(s
, SSL_AD_INTERNAL_ERROR
, SSL_F_TLS_PARSE_CTOS_KEY_SHARE
,
713 SSL_R_UNABLE_TO_FIND_ECDH_PARAMETERS
);
717 s
->s3
.group_id
= group_id
;
719 if (!EVP_PKEY_set1_tls_encodedpoint(s
->s3
.peer_tmp
,
720 PACKET_data(&encoded_pt
),
721 PACKET_remaining(&encoded_pt
))) {
722 SSLfatal(s
, SSL_AD_ILLEGAL_PARAMETER
,
723 SSL_F_TLS_PARSE_CTOS_KEY_SHARE
, SSL_R_BAD_ECPOINT
);
734 int tls_parse_ctos_cookie(SSL
*s
, PACKET
*pkt
, unsigned int context
, X509
*x
,
737 #ifndef OPENSSL_NO_TLS1_3
738 unsigned int format
, version
, key_share
, group_id
;
741 PACKET cookie
, raw
, chhash
, appcookie
;
743 const unsigned char *data
, *mdin
, *ciphdata
;
744 unsigned char hmac
[SHA256_DIGEST_LENGTH
];
745 unsigned char hrr
[MAX_HRR_SIZE
];
746 size_t rawlen
, hmaclen
, hrrlen
, ciphlen
;
747 unsigned long tm
, now
;
749 /* Ignore any cookie if we're not set up to verify it */
750 if (s
->ctx
->verify_stateless_cookie_cb
== NULL
751 || (s
->s3
.flags
& TLS1_FLAGS_STATELESS
) == 0)
754 if (!PACKET_as_length_prefixed_2(pkt
, &cookie
)) {
755 SSLfatal(s
, SSL_AD_DECODE_ERROR
, SSL_F_TLS_PARSE_CTOS_COOKIE
,
756 SSL_R_LENGTH_MISMATCH
);
761 data
= PACKET_data(&raw
);
762 rawlen
= PACKET_remaining(&raw
);
763 if (rawlen
< SHA256_DIGEST_LENGTH
764 || !PACKET_forward(&raw
, rawlen
- SHA256_DIGEST_LENGTH
)) {
765 SSLfatal(s
, SSL_AD_DECODE_ERROR
, SSL_F_TLS_PARSE_CTOS_COOKIE
,
766 SSL_R_LENGTH_MISMATCH
);
769 mdin
= PACKET_data(&raw
);
771 /* Verify the HMAC of the cookie */
772 hctx
= EVP_MD_CTX_create();
773 pkey
= EVP_PKEY_new_raw_private_key_with_libctx(s
->ctx
->libctx
, "HMAC",
775 s
->session_ctx
->ext
.cookie_hmac_key
,
776 sizeof(s
->session_ctx
->ext
778 if (hctx
== NULL
|| pkey
== NULL
) {
779 EVP_MD_CTX_free(hctx
);
781 SSLfatal(s
, SSL_AD_INTERNAL_ERROR
, SSL_F_TLS_PARSE_CTOS_COOKIE
,
782 ERR_R_MALLOC_FAILURE
);
786 hmaclen
= SHA256_DIGEST_LENGTH
;
787 if (EVP_DigestSignInit_with_libctx(hctx
, NULL
, "SHA2-256",
788 s
->ctx
->libctx
, s
->ctx
->propq
, pkey
) <= 0
789 || EVP_DigestSign(hctx
, hmac
, &hmaclen
, data
,
790 rawlen
- SHA256_DIGEST_LENGTH
) <= 0
791 || hmaclen
!= SHA256_DIGEST_LENGTH
) {
792 EVP_MD_CTX_free(hctx
);
794 SSLfatal(s
, SSL_AD_INTERNAL_ERROR
, SSL_F_TLS_PARSE_CTOS_COOKIE
,
795 ERR_R_INTERNAL_ERROR
);
799 EVP_MD_CTX_free(hctx
);
802 if (CRYPTO_memcmp(hmac
, mdin
, SHA256_DIGEST_LENGTH
) != 0) {
803 SSLfatal(s
, SSL_AD_ILLEGAL_PARAMETER
, SSL_F_TLS_PARSE_CTOS_COOKIE
,
804 SSL_R_COOKIE_MISMATCH
);
808 if (!PACKET_get_net_2(&cookie
, &format
)) {
809 SSLfatal(s
, SSL_AD_DECODE_ERROR
, SSL_F_TLS_PARSE_CTOS_COOKIE
,
810 SSL_R_LENGTH_MISMATCH
);
813 /* Check the cookie format is something we recognise. Ignore it if not */
814 if (format
!= COOKIE_STATE_FORMAT_VERSION
)
818 * The rest of these checks really shouldn't fail since we have verified the
822 /* Check the version number is sane */
823 if (!PACKET_get_net_2(&cookie
, &version
)) {
824 SSLfatal(s
, SSL_AD_DECODE_ERROR
, SSL_F_TLS_PARSE_CTOS_COOKIE
,
825 SSL_R_LENGTH_MISMATCH
);
828 if (version
!= TLS1_3_VERSION
) {
829 SSLfatal(s
, SSL_AD_ILLEGAL_PARAMETER
, SSL_F_TLS_PARSE_CTOS_COOKIE
,
830 SSL_R_BAD_PROTOCOL_VERSION_NUMBER
);
834 if (!PACKET_get_net_2(&cookie
, &group_id
)) {
835 SSLfatal(s
, SSL_AD_DECODE_ERROR
, SSL_F_TLS_PARSE_CTOS_COOKIE
,
836 SSL_R_LENGTH_MISMATCH
);
840 ciphdata
= PACKET_data(&cookie
);
841 if (!PACKET_forward(&cookie
, 2)) {
842 SSLfatal(s
, SSL_AD_DECODE_ERROR
, SSL_F_TLS_PARSE_CTOS_COOKIE
,
843 SSL_R_LENGTH_MISMATCH
);
846 if (group_id
!= s
->s3
.group_id
847 || s
->s3
.tmp
.new_cipher
848 != ssl_get_cipher_by_char(s
, ciphdata
, 0)) {
850 * We chose a different cipher or group id this time around to what is
851 * in the cookie. Something must have changed.
853 SSLfatal(s
, SSL_AD_ILLEGAL_PARAMETER
, SSL_F_TLS_PARSE_CTOS_COOKIE
,
858 if (!PACKET_get_1(&cookie
, &key_share
)
859 || !PACKET_get_net_4(&cookie
, &tm
)
860 || !PACKET_get_length_prefixed_2(&cookie
, &chhash
)
861 || !PACKET_get_length_prefixed_1(&cookie
, &appcookie
)
862 || PACKET_remaining(&cookie
) != SHA256_DIGEST_LENGTH
) {
863 SSLfatal(s
, SSL_AD_DECODE_ERROR
, SSL_F_TLS_PARSE_CTOS_COOKIE
,
864 SSL_R_LENGTH_MISMATCH
);
868 /* We tolerate a cookie age of up to 10 minutes (= 60 * 10 seconds) */
869 now
= (unsigned long)time(NULL
);
870 if (tm
> now
|| (now
- tm
) > 600) {
871 /* Cookie is stale. Ignore it */
875 /* Verify the app cookie */
876 if (s
->ctx
->verify_stateless_cookie_cb(s
, PACKET_data(&appcookie
),
877 PACKET_remaining(&appcookie
)) == 0) {
878 SSLfatal(s
, SSL_AD_ILLEGAL_PARAMETER
, SSL_F_TLS_PARSE_CTOS_COOKIE
,
879 SSL_R_COOKIE_MISMATCH
);
884 * Reconstruct the HRR that we would have sent in response to the original
885 * ClientHello so we can add it to the transcript hash.
886 * Note: This won't work with custom HRR extensions
888 if (!WPACKET_init_static_len(&hrrpkt
, hrr
, sizeof(hrr
), 0)) {
889 SSLfatal(s
, SSL_AD_INTERNAL_ERROR
, SSL_F_TLS_PARSE_CTOS_COOKIE
,
890 ERR_R_INTERNAL_ERROR
);
893 if (!WPACKET_put_bytes_u8(&hrrpkt
, SSL3_MT_SERVER_HELLO
)
894 || !WPACKET_start_sub_packet_u24(&hrrpkt
)
895 || !WPACKET_put_bytes_u16(&hrrpkt
, TLS1_2_VERSION
)
896 || !WPACKET_memcpy(&hrrpkt
, hrrrandom
, SSL3_RANDOM_SIZE
)
897 || !WPACKET_sub_memcpy_u8(&hrrpkt
, s
->tmp_session_id
,
898 s
->tmp_session_id_len
)
899 || !s
->method
->put_cipher_by_char(s
->s3
.tmp
.new_cipher
, &hrrpkt
,
901 || !WPACKET_put_bytes_u8(&hrrpkt
, 0)
902 || !WPACKET_start_sub_packet_u16(&hrrpkt
)) {
903 WPACKET_cleanup(&hrrpkt
);
904 SSLfatal(s
, SSL_AD_INTERNAL_ERROR
, SSL_F_TLS_PARSE_CTOS_COOKIE
,
905 ERR_R_INTERNAL_ERROR
);
908 if (!WPACKET_put_bytes_u16(&hrrpkt
, TLSEXT_TYPE_supported_versions
)
909 || !WPACKET_start_sub_packet_u16(&hrrpkt
)
910 || !WPACKET_put_bytes_u16(&hrrpkt
, s
->version
)
911 || !WPACKET_close(&hrrpkt
)) {
912 WPACKET_cleanup(&hrrpkt
);
913 SSLfatal(s
, SSL_AD_INTERNAL_ERROR
, SSL_F_TLS_PARSE_CTOS_COOKIE
,
914 ERR_R_INTERNAL_ERROR
);
918 if (!WPACKET_put_bytes_u16(&hrrpkt
, TLSEXT_TYPE_key_share
)
919 || !WPACKET_start_sub_packet_u16(&hrrpkt
)
920 || !WPACKET_put_bytes_u16(&hrrpkt
, s
->s3
.group_id
)
921 || !WPACKET_close(&hrrpkt
)) {
922 WPACKET_cleanup(&hrrpkt
);
923 SSLfatal(s
, SSL_AD_INTERNAL_ERROR
, SSL_F_TLS_PARSE_CTOS_COOKIE
,
924 ERR_R_INTERNAL_ERROR
);
928 if (!WPACKET_put_bytes_u16(&hrrpkt
, TLSEXT_TYPE_cookie
)
929 || !WPACKET_start_sub_packet_u16(&hrrpkt
)
930 || !WPACKET_sub_memcpy_u16(&hrrpkt
, data
, rawlen
)
931 || !WPACKET_close(&hrrpkt
) /* cookie extension */
932 || !WPACKET_close(&hrrpkt
) /* extension block */
933 || !WPACKET_close(&hrrpkt
) /* message */
934 || !WPACKET_get_total_written(&hrrpkt
, &hrrlen
)
935 || !WPACKET_finish(&hrrpkt
)) {
936 WPACKET_cleanup(&hrrpkt
);
937 SSLfatal(s
, SSL_AD_INTERNAL_ERROR
, SSL_F_TLS_PARSE_CTOS_COOKIE
,
938 ERR_R_INTERNAL_ERROR
);
942 /* Reconstruct the transcript hash */
943 if (!create_synthetic_message_hash(s
, PACKET_data(&chhash
),
944 PACKET_remaining(&chhash
), hrr
,
946 /* SSLfatal() already called */
950 /* Act as if this ClientHello came after a HelloRetryRequest */
951 s
->hello_retry_request
= 1;
959 #if !defined(OPENSSL_NO_EC) || !defined(OPENSSL_NO_DH)
960 int tls_parse_ctos_supported_groups(SSL
*s
, PACKET
*pkt
, unsigned int context
,
961 X509
*x
, size_t chainidx
)
963 PACKET supported_groups_list
;
965 /* Each group is 2 bytes and we must have at least 1. */
966 if (!PACKET_as_length_prefixed_2(pkt
, &supported_groups_list
)
967 || PACKET_remaining(&supported_groups_list
) == 0
968 || (PACKET_remaining(&supported_groups_list
) % 2) != 0) {
969 SSLfatal(s
, SSL_AD_DECODE_ERROR
,
970 SSL_F_TLS_PARSE_CTOS_SUPPORTED_GROUPS
, SSL_R_BAD_EXTENSION
);
974 if (!s
->hit
|| SSL_IS_TLS13(s
)) {
975 OPENSSL_free(s
->ext
.peer_supportedgroups
);
976 s
->ext
.peer_supportedgroups
= NULL
;
977 s
->ext
.peer_supportedgroups_len
= 0;
978 if (!tls1_save_u16(&supported_groups_list
,
979 &s
->ext
.peer_supportedgroups
,
980 &s
->ext
.peer_supportedgroups_len
)) {
981 SSLfatal(s
, SSL_AD_INTERNAL_ERROR
,
982 SSL_F_TLS_PARSE_CTOS_SUPPORTED_GROUPS
,
983 ERR_R_INTERNAL_ERROR
);
992 int tls_parse_ctos_ems(SSL
*s
, PACKET
*pkt
, unsigned int context
, X509
*x
,
995 /* The extension must always be empty */
996 if (PACKET_remaining(pkt
) != 0) {
997 SSLfatal(s
, SSL_AD_DECODE_ERROR
,
998 SSL_F_TLS_PARSE_CTOS_EMS
, SSL_R_BAD_EXTENSION
);
1002 if (s
->options
& SSL_OP_NO_EXTENDED_MASTER_SECRET
)
1005 s
->s3
.flags
|= TLS1_FLAGS_RECEIVED_EXTMS
;
1011 int tls_parse_ctos_early_data(SSL
*s
, PACKET
*pkt
, unsigned int context
,
1012 X509
*x
, size_t chainidx
)
1014 if (PACKET_remaining(pkt
) != 0) {
1015 SSLfatal(s
, SSL_AD_DECODE_ERROR
,
1016 SSL_F_TLS_PARSE_CTOS_EARLY_DATA
, SSL_R_BAD_EXTENSION
);
1020 if (s
->hello_retry_request
!= SSL_HRR_NONE
) {
1021 SSLfatal(s
, SSL_AD_ILLEGAL_PARAMETER
,
1022 SSL_F_TLS_PARSE_CTOS_EARLY_DATA
, SSL_R_BAD_EXTENSION
);
1029 static SSL_TICKET_STATUS
tls_get_stateful_ticket(SSL
*s
, PACKET
*tick
,
1032 SSL_SESSION
*tmpsess
= NULL
;
1034 s
->ext
.ticket_expected
= 1;
1036 switch (PACKET_remaining(tick
)) {
1038 return SSL_TICKET_EMPTY
;
1040 case SSL_MAX_SSL_SESSION_ID_LENGTH
:
1044 return SSL_TICKET_NO_DECRYPT
;
1047 tmpsess
= lookup_sess_in_cache(s
, PACKET_data(tick
),
1048 SSL_MAX_SSL_SESSION_ID_LENGTH
);
1050 if (tmpsess
== NULL
)
1051 return SSL_TICKET_NO_DECRYPT
;
1054 return SSL_TICKET_SUCCESS
;
1057 int tls_parse_ctos_psk(SSL
*s
, PACKET
*pkt
, unsigned int context
, X509
*x
,
1060 PACKET identities
, binders
, binder
;
1061 size_t binderoffset
, hashsize
;
1062 SSL_SESSION
*sess
= NULL
;
1063 unsigned int id
, i
, ext
= 0;
1064 const EVP_MD
*md
= NULL
;
1067 * If we have no PSK kex mode that we recognise then we can't resume so
1068 * ignore this extension
1070 if ((s
->ext
.psk_kex_mode
1071 & (TLSEXT_KEX_MODE_FLAG_KE
| TLSEXT_KEX_MODE_FLAG_KE_DHE
)) == 0)
1074 if (!PACKET_get_length_prefixed_2(pkt
, &identities
)) {
1075 SSLfatal(s
, SSL_AD_DECODE_ERROR
,
1076 SSL_F_TLS_PARSE_CTOS_PSK
, SSL_R_BAD_EXTENSION
);
1080 s
->ext
.ticket_expected
= 0;
1081 for (id
= 0; PACKET_remaining(&identities
) != 0; id
++) {
1083 unsigned long ticket_agel
;
1086 if (!PACKET_get_length_prefixed_2(&identities
, &identity
)
1087 || !PACKET_get_net_4(&identities
, &ticket_agel
)) {
1088 SSLfatal(s
, SSL_AD_DECODE_ERROR
,
1089 SSL_F_TLS_PARSE_CTOS_PSK
, SSL_R_BAD_EXTENSION
);
1093 idlen
= PACKET_remaining(&identity
);
1094 if (s
->psk_find_session_cb
!= NULL
1095 && !s
->psk_find_session_cb(s
, PACKET_data(&identity
), idlen
,
1097 SSLfatal(s
, SSL_AD_INTERNAL_ERROR
,
1098 SSL_F_TLS_PARSE_CTOS_PSK
, SSL_R_BAD_EXTENSION
);
1102 #ifndef OPENSSL_NO_PSK
1104 && s
->psk_server_callback
!= NULL
1105 && idlen
<= PSK_MAX_IDENTITY_LEN
) {
1107 unsigned char pskdata
[PSK_MAX_PSK_LEN
];
1108 unsigned int pskdatalen
;
1110 if (!PACKET_strndup(&identity
, &pskid
)) {
1111 SSLfatal(s
, SSL_AD_INTERNAL_ERROR
, SSL_F_TLS_PARSE_CTOS_PSK
,
1112 ERR_R_INTERNAL_ERROR
);
1115 pskdatalen
= s
->psk_server_callback(s
, pskid
, pskdata
,
1117 OPENSSL_free(pskid
);
1118 if (pskdatalen
> PSK_MAX_PSK_LEN
) {
1119 SSLfatal(s
, SSL_AD_INTERNAL_ERROR
, SSL_F_TLS_PARSE_CTOS_PSK
,
1120 ERR_R_INTERNAL_ERROR
);
1122 } else if (pskdatalen
> 0) {
1123 const SSL_CIPHER
*cipher
;
1124 const unsigned char tls13_aes128gcmsha256_id
[] = { 0x13, 0x01 };
1127 * We found a PSK using an old style callback. We don't know
1128 * the digest so we default to SHA256 as per the TLSv1.3 spec
1130 cipher
= SSL_CIPHER_find(s
, tls13_aes128gcmsha256_id
);
1131 if (cipher
== NULL
) {
1132 OPENSSL_cleanse(pskdata
, pskdatalen
);
1133 SSLfatal(s
, SSL_AD_INTERNAL_ERROR
, SSL_F_TLS_PARSE_CTOS_PSK
,
1134 ERR_R_INTERNAL_ERROR
);
1138 sess
= SSL_SESSION_new();
1140 || !SSL_SESSION_set1_master_key(sess
, pskdata
,
1142 || !SSL_SESSION_set_cipher(sess
, cipher
)
1143 || !SSL_SESSION_set_protocol_version(sess
,
1145 OPENSSL_cleanse(pskdata
, pskdatalen
);
1146 SSLfatal(s
, SSL_AD_INTERNAL_ERROR
, SSL_F_TLS_PARSE_CTOS_PSK
,
1147 ERR_R_INTERNAL_ERROR
);
1150 OPENSSL_cleanse(pskdata
, pskdatalen
);
1153 #endif /* OPENSSL_NO_PSK */
1156 /* We found a PSK */
1157 SSL_SESSION
*sesstmp
= ssl_session_dup(sess
, 0);
1159 if (sesstmp
== NULL
) {
1160 SSLfatal(s
, SSL_AD_INTERNAL_ERROR
,
1161 SSL_F_TLS_PARSE_CTOS_PSK
, ERR_R_INTERNAL_ERROR
);
1164 SSL_SESSION_free(sess
);
1168 * We've just been told to use this session for this context so
1169 * make sure the sid_ctx matches up.
1171 memcpy(sess
->sid_ctx
, s
->sid_ctx
, s
->sid_ctx_length
);
1172 sess
->sid_ctx_length
= s
->sid_ctx_length
;
1175 s
->ext
.early_data_ok
= 1;
1176 s
->ext
.ticket_expected
= 1;
1178 uint32_t ticket_age
= 0, now
, agesec
, agems
;
1182 * If we are using anti-replay protection then we behave as if
1183 * SSL_OP_NO_TICKET is set - we are caching tickets anyway so there
1184 * is no point in using full stateless tickets.
1186 if ((s
->options
& SSL_OP_NO_TICKET
) != 0
1187 || (s
->max_early_data
> 0
1188 && (s
->options
& SSL_OP_NO_ANTI_REPLAY
) == 0))
1189 ret
= tls_get_stateful_ticket(s
, &identity
, &sess
);
1191 ret
= tls_decrypt_ticket(s
, PACKET_data(&identity
),
1192 PACKET_remaining(&identity
), NULL
, 0,
1195 if (ret
== SSL_TICKET_EMPTY
) {
1196 SSLfatal(s
, SSL_AD_DECODE_ERROR
, SSL_F_TLS_PARSE_CTOS_PSK
,
1197 SSL_R_BAD_EXTENSION
);
1201 if (ret
== SSL_TICKET_FATAL_ERR_MALLOC
1202 || ret
== SSL_TICKET_FATAL_ERR_OTHER
) {
1203 SSLfatal(s
, SSL_AD_INTERNAL_ERROR
,
1204 SSL_F_TLS_PARSE_CTOS_PSK
, ERR_R_INTERNAL_ERROR
);
1207 if (ret
== SSL_TICKET_NONE
|| ret
== SSL_TICKET_NO_DECRYPT
)
1210 /* Check for replay */
1211 if (s
->max_early_data
> 0
1212 && (s
->options
& SSL_OP_NO_ANTI_REPLAY
) == 0
1213 && !SSL_CTX_remove_session(s
->session_ctx
, sess
)) {
1214 SSL_SESSION_free(sess
);
1219 ticket_age
= (uint32_t)ticket_agel
;
1220 now
= (uint32_t)time(NULL
);
1221 agesec
= now
- (uint32_t)sess
->time
;
1222 agems
= agesec
* (uint32_t)1000;
1223 ticket_age
-= sess
->ext
.tick_age_add
;
1226 * For simplicity we do our age calculations in seconds. If the
1227 * client does it in ms then it could appear that their ticket age
1228 * is longer than ours (our ticket age calculation should always be
1229 * slightly longer than the client's due to the network latency).
1230 * Therefore we add 1000ms to our age calculation to adjust for
1234 && sess
->timeout
>= (long)agesec
1235 && agems
/ (uint32_t)1000 == agesec
1236 && ticket_age
<= agems
+ 1000
1237 && ticket_age
+ TICKET_AGE_ALLOWANCE
>= agems
+ 1000) {
1239 * Ticket age is within tolerance and not expired. We allow it
1242 s
->ext
.early_data_ok
= 1;
1246 md
= ssl_md(s
->ctx
, sess
->cipher
->algorithm2
);
1247 if (!EVP_MD_is_a(md
,
1248 EVP_MD_name(ssl_md(s
->ctx
, s
->s3
.tmp
.new_cipher
->algorithm2
)))) {
1249 /* The ciphersuite is not compatible with this session. */
1250 SSL_SESSION_free(sess
);
1252 s
->ext
.early_data_ok
= 0;
1253 s
->ext
.ticket_expected
= 0;
1262 binderoffset
= PACKET_data(pkt
) - (const unsigned char *)s
->init_buf
->data
;
1263 hashsize
= EVP_MD_size(md
);
1265 if (!PACKET_get_length_prefixed_2(pkt
, &binders
)) {
1266 SSLfatal(s
, SSL_AD_DECODE_ERROR
, SSL_F_TLS_PARSE_CTOS_PSK
,
1267 SSL_R_BAD_EXTENSION
);
1271 for (i
= 0; i
<= id
; i
++) {
1272 if (!PACKET_get_length_prefixed_1(&binders
, &binder
)) {
1273 SSLfatal(s
, SSL_AD_DECODE_ERROR
, SSL_F_TLS_PARSE_CTOS_PSK
,
1274 SSL_R_BAD_EXTENSION
);
1279 if (PACKET_remaining(&binder
) != hashsize
) {
1280 SSLfatal(s
, SSL_AD_DECODE_ERROR
, SSL_F_TLS_PARSE_CTOS_PSK
,
1281 SSL_R_BAD_EXTENSION
);
1284 if (tls_psk_do_binder(s
, md
, (const unsigned char *)s
->init_buf
->data
,
1285 binderoffset
, PACKET_data(&binder
), NULL
, sess
, 0,
1287 /* SSLfatal() already called */
1291 s
->ext
.tick_identity
= id
;
1293 SSL_SESSION_free(s
->session
);
1297 SSL_SESSION_free(sess
);
1301 int tls_parse_ctos_post_handshake_auth(SSL
*s
, PACKET
*pkt
, unsigned int context
,
1302 X509
*x
, size_t chainidx
)
1304 if (PACKET_remaining(pkt
) != 0) {
1305 SSLfatal(s
, SSL_AD_DECODE_ERROR
, SSL_F_TLS_PARSE_CTOS_POST_HANDSHAKE_AUTH
,
1306 SSL_R_POST_HANDSHAKE_AUTH_ENCODING_ERR
);
1310 s
->post_handshake_auth
= SSL_PHA_EXT_RECEIVED
;
1316 * Add the server's renegotiation binding
1318 EXT_RETURN
tls_construct_stoc_renegotiate(SSL
*s
, WPACKET
*pkt
,
1319 unsigned int context
, X509
*x
,
1322 if (!s
->s3
.send_connection_binding
)
1323 return EXT_RETURN_NOT_SENT
;
1325 /* Still add this even if SSL_OP_NO_RENEGOTIATION is set */
1326 if (!WPACKET_put_bytes_u16(pkt
, TLSEXT_TYPE_renegotiate
)
1327 || !WPACKET_start_sub_packet_u16(pkt
)
1328 || !WPACKET_start_sub_packet_u8(pkt
)
1329 || !WPACKET_memcpy(pkt
, s
->s3
.previous_client_finished
,
1330 s
->s3
.previous_client_finished_len
)
1331 || !WPACKET_memcpy(pkt
, s
->s3
.previous_server_finished
,
1332 s
->s3
.previous_server_finished_len
)
1333 || !WPACKET_close(pkt
)
1334 || !WPACKET_close(pkt
)) {
1335 SSLfatal(s
, SSL_AD_INTERNAL_ERROR
, SSL_F_TLS_CONSTRUCT_STOC_RENEGOTIATE
,
1336 ERR_R_INTERNAL_ERROR
);
1337 return EXT_RETURN_FAIL
;
1340 return EXT_RETURN_SENT
;
1343 EXT_RETURN
tls_construct_stoc_server_name(SSL
*s
, WPACKET
*pkt
,
1344 unsigned int context
, X509
*x
,
1347 if (s
->servername_done
!= 1)
1348 return EXT_RETURN_NOT_SENT
;
1351 * Prior to TLSv1.3 we ignore any SNI in the current handshake if resuming.
1352 * We just use the servername from the initial handshake.
1354 if (s
->hit
&& !SSL_IS_TLS13(s
))
1355 return EXT_RETURN_NOT_SENT
;
1357 if (!WPACKET_put_bytes_u16(pkt
, TLSEXT_TYPE_server_name
)
1358 || !WPACKET_put_bytes_u16(pkt
, 0)) {
1359 SSLfatal(s
, SSL_AD_INTERNAL_ERROR
, SSL_F_TLS_CONSTRUCT_STOC_SERVER_NAME
,
1360 ERR_R_INTERNAL_ERROR
);
1361 return EXT_RETURN_FAIL
;
1364 return EXT_RETURN_SENT
;
1367 /* Add/include the server's max fragment len extension into ServerHello */
1368 EXT_RETURN
tls_construct_stoc_maxfragmentlen(SSL
*s
, WPACKET
*pkt
,
1369 unsigned int context
, X509
*x
,
1372 if (!USE_MAX_FRAGMENT_LENGTH_EXT(s
->session
))
1373 return EXT_RETURN_NOT_SENT
;
1376 * 4 bytes for this extension type and extension length
1377 * 1 byte for the Max Fragment Length code value.
1379 if (!WPACKET_put_bytes_u16(pkt
, TLSEXT_TYPE_max_fragment_length
)
1380 || !WPACKET_start_sub_packet_u16(pkt
)
1381 || !WPACKET_put_bytes_u8(pkt
, s
->session
->ext
.max_fragment_len_mode
)
1382 || !WPACKET_close(pkt
)) {
1383 SSLfatal(s
, SSL_AD_INTERNAL_ERROR
,
1384 SSL_F_TLS_CONSTRUCT_STOC_MAXFRAGMENTLEN
, ERR_R_INTERNAL_ERROR
);
1385 return EXT_RETURN_FAIL
;
1388 return EXT_RETURN_SENT
;
1391 #ifndef OPENSSL_NO_EC
1392 EXT_RETURN
tls_construct_stoc_ec_pt_formats(SSL
*s
, WPACKET
*pkt
,
1393 unsigned int context
, X509
*x
,
1396 unsigned long alg_k
= s
->s3
.tmp
.new_cipher
->algorithm_mkey
;
1397 unsigned long alg_a
= s
->s3
.tmp
.new_cipher
->algorithm_auth
;
1398 int using_ecc
= ((alg_k
& SSL_kECDHE
) || (alg_a
& SSL_aECDSA
))
1399 && (s
->ext
.peer_ecpointformats
!= NULL
);
1400 const unsigned char *plist
;
1404 return EXT_RETURN_NOT_SENT
;
1406 tls1_get_formatlist(s
, &plist
, &plistlen
);
1407 if (!WPACKET_put_bytes_u16(pkt
, TLSEXT_TYPE_ec_point_formats
)
1408 || !WPACKET_start_sub_packet_u16(pkt
)
1409 || !WPACKET_sub_memcpy_u8(pkt
, plist
, plistlen
)
1410 || !WPACKET_close(pkt
)) {
1411 SSLfatal(s
, SSL_AD_INTERNAL_ERROR
,
1412 SSL_F_TLS_CONSTRUCT_STOC_EC_PT_FORMATS
, ERR_R_INTERNAL_ERROR
);
1413 return EXT_RETURN_FAIL
;
1416 return EXT_RETURN_SENT
;
1420 #if !defined(OPENSSL_NO_EC) || !defined(OPENSSL_NO_DH)
1421 EXT_RETURN
tls_construct_stoc_supported_groups(SSL
*s
, WPACKET
*pkt
,
1422 unsigned int context
, X509
*x
,
1425 const uint16_t *groups
;
1426 size_t numgroups
, i
, first
= 1;
1429 /* s->s3.group_id is non zero if we accepted a key_share */
1430 if (s
->s3
.group_id
== 0)
1431 return EXT_RETURN_NOT_SENT
;
1433 /* Get our list of supported groups */
1434 tls1_get_supported_groups(s
, &groups
, &numgroups
);
1435 if (numgroups
== 0) {
1436 SSLfatal(s
, SSL_AD_INTERNAL_ERROR
,
1437 SSL_F_TLS_CONSTRUCT_STOC_SUPPORTED_GROUPS
, ERR_R_INTERNAL_ERROR
);
1438 return EXT_RETURN_FAIL
;
1441 /* Copy group ID if supported */
1442 version
= SSL_version(s
);
1443 for (i
= 0; i
< numgroups
; i
++) {
1444 uint16_t group
= groups
[i
];
1446 if (tls_valid_group(s
, group
, version
, version
)
1447 && tls_group_allowed(s
, group
, SSL_SECOP_CURVE_SUPPORTED
)) {
1450 * Check if the client is already using our preferred group. If
1451 * so we don't need to add this extension
1453 if (s
->s3
.group_id
== group
)
1454 return EXT_RETURN_NOT_SENT
;
1456 /* Add extension header */
1457 if (!WPACKET_put_bytes_u16(pkt
, TLSEXT_TYPE_supported_groups
)
1458 /* Sub-packet for supported_groups extension */
1459 || !WPACKET_start_sub_packet_u16(pkt
)
1460 || !WPACKET_start_sub_packet_u16(pkt
)) {
1461 SSLfatal(s
, SSL_AD_INTERNAL_ERROR
,
1462 SSL_F_TLS_CONSTRUCT_STOC_SUPPORTED_GROUPS
,
1463 ERR_R_INTERNAL_ERROR
);
1464 return EXT_RETURN_FAIL
;
1469 if (!WPACKET_put_bytes_u16(pkt
, group
)) {
1470 SSLfatal(s
, SSL_AD_INTERNAL_ERROR
,
1471 SSL_F_TLS_CONSTRUCT_STOC_SUPPORTED_GROUPS
,
1472 ERR_R_INTERNAL_ERROR
);
1473 return EXT_RETURN_FAIL
;
1478 if (!WPACKET_close(pkt
) || !WPACKET_close(pkt
)) {
1479 SSLfatal(s
, SSL_AD_INTERNAL_ERROR
,
1480 SSL_F_TLS_CONSTRUCT_STOC_SUPPORTED_GROUPS
,
1481 ERR_R_INTERNAL_ERROR
);
1482 return EXT_RETURN_FAIL
;
1485 return EXT_RETURN_SENT
;
1489 EXT_RETURN
tls_construct_stoc_session_ticket(SSL
*s
, WPACKET
*pkt
,
1490 unsigned int context
, X509
*x
,
1493 if (!s
->ext
.ticket_expected
|| !tls_use_ticket(s
)) {
1494 s
->ext
.ticket_expected
= 0;
1495 return EXT_RETURN_NOT_SENT
;
1498 if (!WPACKET_put_bytes_u16(pkt
, TLSEXT_TYPE_session_ticket
)
1499 || !WPACKET_put_bytes_u16(pkt
, 0)) {
1500 SSLfatal(s
, SSL_AD_INTERNAL_ERROR
,
1501 SSL_F_TLS_CONSTRUCT_STOC_SESSION_TICKET
, ERR_R_INTERNAL_ERROR
);
1502 return EXT_RETURN_FAIL
;
1505 return EXT_RETURN_SENT
;
1508 #ifndef OPENSSL_NO_OCSP
1509 EXT_RETURN
tls_construct_stoc_status_request(SSL
*s
, WPACKET
*pkt
,
1510 unsigned int context
, X509
*x
,
1513 /* We don't currently support this extension inside a CertificateRequest */
1514 if (context
== SSL_EXT_TLS1_3_CERTIFICATE_REQUEST
)
1515 return EXT_RETURN_NOT_SENT
;
1517 if (!s
->ext
.status_expected
)
1518 return EXT_RETURN_NOT_SENT
;
1520 if (SSL_IS_TLS13(s
) && chainidx
!= 0)
1521 return EXT_RETURN_NOT_SENT
;
1523 if (!WPACKET_put_bytes_u16(pkt
, TLSEXT_TYPE_status_request
)
1524 || !WPACKET_start_sub_packet_u16(pkt
)) {
1525 SSLfatal(s
, SSL_AD_INTERNAL_ERROR
,
1526 SSL_F_TLS_CONSTRUCT_STOC_STATUS_REQUEST
, ERR_R_INTERNAL_ERROR
);
1527 return EXT_RETURN_FAIL
;
1531 * In TLSv1.3 we include the certificate status itself. In <= TLSv1.2 we
1532 * send back an empty extension, with the certificate status appearing as a
1535 if (SSL_IS_TLS13(s
) && !tls_construct_cert_status_body(s
, pkt
)) {
1536 /* SSLfatal() already called */
1537 return EXT_RETURN_FAIL
;
1539 if (!WPACKET_close(pkt
)) {
1540 SSLfatal(s
, SSL_AD_INTERNAL_ERROR
,
1541 SSL_F_TLS_CONSTRUCT_STOC_STATUS_REQUEST
, ERR_R_INTERNAL_ERROR
);
1542 return EXT_RETURN_FAIL
;
1545 return EXT_RETURN_SENT
;
1549 #ifndef OPENSSL_NO_NEXTPROTONEG
1550 EXT_RETURN
tls_construct_stoc_next_proto_neg(SSL
*s
, WPACKET
*pkt
,
1551 unsigned int context
, X509
*x
,
1554 const unsigned char *npa
;
1555 unsigned int npalen
;
1557 int npn_seen
= s
->s3
.npn_seen
;
1560 if (!npn_seen
|| s
->ctx
->ext
.npn_advertised_cb
== NULL
)
1561 return EXT_RETURN_NOT_SENT
;
1563 ret
= s
->ctx
->ext
.npn_advertised_cb(s
, &npa
, &npalen
,
1564 s
->ctx
->ext
.npn_advertised_cb_arg
);
1565 if (ret
== SSL_TLSEXT_ERR_OK
) {
1566 if (!WPACKET_put_bytes_u16(pkt
, TLSEXT_TYPE_next_proto_neg
)
1567 || !WPACKET_sub_memcpy_u16(pkt
, npa
, npalen
)) {
1568 SSLfatal(s
, SSL_AD_INTERNAL_ERROR
,
1569 SSL_F_TLS_CONSTRUCT_STOC_NEXT_PROTO_NEG
,
1570 ERR_R_INTERNAL_ERROR
);
1571 return EXT_RETURN_FAIL
;
1576 return EXT_RETURN_SENT
;
1580 EXT_RETURN
tls_construct_stoc_alpn(SSL
*s
, WPACKET
*pkt
, unsigned int context
,
1581 X509
*x
, size_t chainidx
)
1583 if (s
->s3
.alpn_selected
== NULL
)
1584 return EXT_RETURN_NOT_SENT
;
1586 if (!WPACKET_put_bytes_u16(pkt
,
1587 TLSEXT_TYPE_application_layer_protocol_negotiation
)
1588 || !WPACKET_start_sub_packet_u16(pkt
)
1589 || !WPACKET_start_sub_packet_u16(pkt
)
1590 || !WPACKET_sub_memcpy_u8(pkt
, s
->s3
.alpn_selected
,
1591 s
->s3
.alpn_selected_len
)
1592 || !WPACKET_close(pkt
)
1593 || !WPACKET_close(pkt
)) {
1594 SSLfatal(s
, SSL_AD_INTERNAL_ERROR
,
1595 SSL_F_TLS_CONSTRUCT_STOC_ALPN
, ERR_R_INTERNAL_ERROR
);
1596 return EXT_RETURN_FAIL
;
1599 return EXT_RETURN_SENT
;
1602 #ifndef OPENSSL_NO_SRTP
1603 EXT_RETURN
tls_construct_stoc_use_srtp(SSL
*s
, WPACKET
*pkt
,
1604 unsigned int context
, X509
*x
,
1607 if (s
->srtp_profile
== NULL
)
1608 return EXT_RETURN_NOT_SENT
;
1610 if (!WPACKET_put_bytes_u16(pkt
, TLSEXT_TYPE_use_srtp
)
1611 || !WPACKET_start_sub_packet_u16(pkt
)
1612 || !WPACKET_put_bytes_u16(pkt
, 2)
1613 || !WPACKET_put_bytes_u16(pkt
, s
->srtp_profile
->id
)
1614 || !WPACKET_put_bytes_u8(pkt
, 0)
1615 || !WPACKET_close(pkt
)) {
1616 SSLfatal(s
, SSL_AD_INTERNAL_ERROR
, SSL_F_TLS_CONSTRUCT_STOC_USE_SRTP
,
1617 ERR_R_INTERNAL_ERROR
);
1618 return EXT_RETURN_FAIL
;
1621 return EXT_RETURN_SENT
;
1625 EXT_RETURN
tls_construct_stoc_etm(SSL
*s
, WPACKET
*pkt
, unsigned int context
,
1626 X509
*x
, size_t chainidx
)
1628 if (!s
->ext
.use_etm
)
1629 return EXT_RETURN_NOT_SENT
;
1632 * Don't use encrypt_then_mac if AEAD or RC4 might want to disable
1633 * for other cases too.
1635 if (s
->s3
.tmp
.new_cipher
->algorithm_mac
== SSL_AEAD
1636 || s
->s3
.tmp
.new_cipher
->algorithm_enc
== SSL_RC4
1637 || s
->s3
.tmp
.new_cipher
->algorithm_enc
== SSL_eGOST2814789CNT
1638 || s
->s3
.tmp
.new_cipher
->algorithm_enc
== SSL_eGOST2814789CNT12
1639 || s
->s3
.tmp
.new_cipher
->algorithm_enc
== SSL_MAGMA
1640 || s
->s3
.tmp
.new_cipher
->algorithm_enc
== SSL_KUZNYECHIK
) {
1642 return EXT_RETURN_NOT_SENT
;
1645 if (!WPACKET_put_bytes_u16(pkt
, TLSEXT_TYPE_encrypt_then_mac
)
1646 || !WPACKET_put_bytes_u16(pkt
, 0)) {
1647 SSLfatal(s
, SSL_AD_INTERNAL_ERROR
, SSL_F_TLS_CONSTRUCT_STOC_ETM
,
1648 ERR_R_INTERNAL_ERROR
);
1649 return EXT_RETURN_FAIL
;
1652 return EXT_RETURN_SENT
;
1655 EXT_RETURN
tls_construct_stoc_ems(SSL
*s
, WPACKET
*pkt
, unsigned int context
,
1656 X509
*x
, size_t chainidx
)
1658 if ((s
->s3
.flags
& TLS1_FLAGS_RECEIVED_EXTMS
) == 0)
1659 return EXT_RETURN_NOT_SENT
;
1661 if (!WPACKET_put_bytes_u16(pkt
, TLSEXT_TYPE_extended_master_secret
)
1662 || !WPACKET_put_bytes_u16(pkt
, 0)) {
1663 SSLfatal(s
, SSL_AD_INTERNAL_ERROR
, SSL_F_TLS_CONSTRUCT_STOC_EMS
,
1664 ERR_R_INTERNAL_ERROR
);
1665 return EXT_RETURN_FAIL
;
1668 return EXT_RETURN_SENT
;
1671 EXT_RETURN
tls_construct_stoc_supported_versions(SSL
*s
, WPACKET
*pkt
,
1672 unsigned int context
, X509
*x
,
1675 if (!ossl_assert(SSL_IS_TLS13(s
))) {
1676 SSLfatal(s
, SSL_AD_INTERNAL_ERROR
,
1677 SSL_F_TLS_CONSTRUCT_STOC_SUPPORTED_VERSIONS
,
1678 ERR_R_INTERNAL_ERROR
);
1679 return EXT_RETURN_FAIL
;
1682 if (!WPACKET_put_bytes_u16(pkt
, TLSEXT_TYPE_supported_versions
)
1683 || !WPACKET_start_sub_packet_u16(pkt
)
1684 || !WPACKET_put_bytes_u16(pkt
, s
->version
)
1685 || !WPACKET_close(pkt
)) {
1686 SSLfatal(s
, SSL_AD_INTERNAL_ERROR
,
1687 SSL_F_TLS_CONSTRUCT_STOC_SUPPORTED_VERSIONS
,
1688 ERR_R_INTERNAL_ERROR
);
1689 return EXT_RETURN_FAIL
;
1692 return EXT_RETURN_SENT
;
1695 EXT_RETURN
tls_construct_stoc_key_share(SSL
*s
, WPACKET
*pkt
,
1696 unsigned int context
, X509
*x
,
1699 #ifndef OPENSSL_NO_TLS1_3
1700 unsigned char *encodedPoint
;
1701 size_t encoded_pt_len
= 0;
1702 EVP_PKEY
*ckey
= s
->s3
.peer_tmp
, *skey
= NULL
;
1704 if (s
->hello_retry_request
== SSL_HRR_PENDING
) {
1706 /* Original key_share was acceptable so don't ask for another one */
1707 return EXT_RETURN_NOT_SENT
;
1709 if (!WPACKET_put_bytes_u16(pkt
, TLSEXT_TYPE_key_share
)
1710 || !WPACKET_start_sub_packet_u16(pkt
)
1711 || !WPACKET_put_bytes_u16(pkt
, s
->s3
.group_id
)
1712 || !WPACKET_close(pkt
)) {
1713 SSLfatal(s
, SSL_AD_INTERNAL_ERROR
,
1714 SSL_F_TLS_CONSTRUCT_STOC_KEY_SHARE
,
1715 ERR_R_INTERNAL_ERROR
);
1716 return EXT_RETURN_FAIL
;
1719 return EXT_RETURN_SENT
;
1723 /* No key_share received from client - must be resuming */
1724 if (!s
->hit
|| !tls13_generate_handshake_secret(s
, NULL
, 0)) {
1725 SSLfatal(s
, SSL_AD_INTERNAL_ERROR
,
1726 SSL_F_TLS_CONSTRUCT_STOC_KEY_SHARE
, ERR_R_INTERNAL_ERROR
);
1727 return EXT_RETURN_FAIL
;
1729 return EXT_RETURN_NOT_SENT
;
1732 if (!WPACKET_put_bytes_u16(pkt
, TLSEXT_TYPE_key_share
)
1733 || !WPACKET_start_sub_packet_u16(pkt
)
1734 || !WPACKET_put_bytes_u16(pkt
, s
->s3
.group_id
)) {
1735 SSLfatal(s
, SSL_AD_INTERNAL_ERROR
,
1736 SSL_F_TLS_CONSTRUCT_STOC_KEY_SHARE
, ERR_R_INTERNAL_ERROR
);
1737 return EXT_RETURN_FAIL
;
1740 skey
= ssl_generate_pkey(s
, ckey
);
1742 SSLfatal(s
, SSL_AD_INTERNAL_ERROR
, SSL_F_TLS_CONSTRUCT_STOC_KEY_SHARE
,
1743 ERR_R_MALLOC_FAILURE
);
1744 return EXT_RETURN_FAIL
;
1747 /* Generate encoding of server key */
1748 encoded_pt_len
= EVP_PKEY_get1_tls_encodedpoint(skey
, &encodedPoint
);
1749 if (encoded_pt_len
== 0) {
1750 SSLfatal(s
, SSL_AD_INTERNAL_ERROR
, SSL_F_TLS_CONSTRUCT_STOC_KEY_SHARE
,
1752 EVP_PKEY_free(skey
);
1753 return EXT_RETURN_FAIL
;
1756 if (!WPACKET_sub_memcpy_u16(pkt
, encodedPoint
, encoded_pt_len
)
1757 || !WPACKET_close(pkt
)) {
1758 SSLfatal(s
, SSL_AD_INTERNAL_ERROR
, SSL_F_TLS_CONSTRUCT_STOC_KEY_SHARE
,
1759 ERR_R_INTERNAL_ERROR
);
1760 EVP_PKEY_free(skey
);
1761 OPENSSL_free(encodedPoint
);
1762 return EXT_RETURN_FAIL
;
1764 OPENSSL_free(encodedPoint
);
1766 /* This causes the crypto state to be updated based on the derived keys */
1767 s
->s3
.tmp
.pkey
= skey
;
1768 if (ssl_derive(s
, skey
, ckey
, 1) == 0) {
1769 /* SSLfatal() already called */
1770 return EXT_RETURN_FAIL
;
1772 return EXT_RETURN_SENT
;
1774 return EXT_RETURN_FAIL
;
1778 EXT_RETURN
tls_construct_stoc_cookie(SSL
*s
, WPACKET
*pkt
, unsigned int context
,
1779 X509
*x
, size_t chainidx
)
1781 #ifndef OPENSSL_NO_TLS1_3
1782 unsigned char *hashval1
, *hashval2
, *appcookie1
, *appcookie2
, *cookie
;
1783 unsigned char *hmac
, *hmac2
;
1784 size_t startlen
, ciphlen
, totcookielen
, hashlen
, hmaclen
, appcookielen
;
1787 int ret
= EXT_RETURN_FAIL
;
1789 if ((s
->s3
.flags
& TLS1_FLAGS_STATELESS
) == 0)
1790 return EXT_RETURN_NOT_SENT
;
1792 if (s
->ctx
->gen_stateless_cookie_cb
== NULL
) {
1793 SSLfatal(s
, SSL_AD_INTERNAL_ERROR
, SSL_F_TLS_CONSTRUCT_STOC_COOKIE
,
1794 SSL_R_NO_COOKIE_CALLBACK_SET
);
1795 return EXT_RETURN_FAIL
;
1798 if (!WPACKET_put_bytes_u16(pkt
, TLSEXT_TYPE_cookie
)
1799 || !WPACKET_start_sub_packet_u16(pkt
)
1800 || !WPACKET_start_sub_packet_u16(pkt
)
1801 || !WPACKET_get_total_written(pkt
, &startlen
)
1802 || !WPACKET_reserve_bytes(pkt
, MAX_COOKIE_SIZE
, &cookie
)
1803 || !WPACKET_put_bytes_u16(pkt
, COOKIE_STATE_FORMAT_VERSION
)
1804 || !WPACKET_put_bytes_u16(pkt
, TLS1_3_VERSION
)
1805 || !WPACKET_put_bytes_u16(pkt
, s
->s3
.group_id
)
1806 || !s
->method
->put_cipher_by_char(s
->s3
.tmp
.new_cipher
, pkt
,
1808 /* Is there a key_share extension present in this HRR? */
1809 || !WPACKET_put_bytes_u8(pkt
, s
->s3
.peer_tmp
== NULL
)
1810 || !WPACKET_put_bytes_u32(pkt
, (unsigned int)time(NULL
))
1811 || !WPACKET_start_sub_packet_u16(pkt
)
1812 || !WPACKET_reserve_bytes(pkt
, EVP_MAX_MD_SIZE
, &hashval1
)) {
1813 SSLfatal(s
, SSL_AD_INTERNAL_ERROR
, SSL_F_TLS_CONSTRUCT_STOC_COOKIE
,
1814 ERR_R_INTERNAL_ERROR
);
1815 return EXT_RETURN_FAIL
;
1819 * Get the hash of the initial ClientHello. ssl_handshake_hash() operates
1820 * on raw buffers, so we first reserve sufficient bytes (above) and then
1821 * subsequently allocate them (below)
1823 if (!ssl3_digest_cached_records(s
, 0)
1824 || !ssl_handshake_hash(s
, hashval1
, EVP_MAX_MD_SIZE
, &hashlen
)) {
1825 /* SSLfatal() already called */
1826 return EXT_RETURN_FAIL
;
1829 if (!WPACKET_allocate_bytes(pkt
, hashlen
, &hashval2
)
1830 || !ossl_assert(hashval1
== hashval2
)
1831 || !WPACKET_close(pkt
)
1832 || !WPACKET_start_sub_packet_u8(pkt
)
1833 || !WPACKET_reserve_bytes(pkt
, SSL_COOKIE_LENGTH
, &appcookie1
)) {
1834 SSLfatal(s
, SSL_AD_INTERNAL_ERROR
, SSL_F_TLS_CONSTRUCT_STOC_COOKIE
,
1835 ERR_R_INTERNAL_ERROR
);
1836 return EXT_RETURN_FAIL
;
1839 /* Generate the application cookie */
1840 if (s
->ctx
->gen_stateless_cookie_cb(s
, appcookie1
, &appcookielen
) == 0) {
1841 SSLfatal(s
, SSL_AD_INTERNAL_ERROR
, SSL_F_TLS_CONSTRUCT_STOC_COOKIE
,
1842 SSL_R_COOKIE_GEN_CALLBACK_FAILURE
);
1843 return EXT_RETURN_FAIL
;
1846 if (!WPACKET_allocate_bytes(pkt
, appcookielen
, &appcookie2
)
1847 || !ossl_assert(appcookie1
== appcookie2
)
1848 || !WPACKET_close(pkt
)
1849 || !WPACKET_get_total_written(pkt
, &totcookielen
)
1850 || !WPACKET_reserve_bytes(pkt
, SHA256_DIGEST_LENGTH
, &hmac
)) {
1851 SSLfatal(s
, SSL_AD_INTERNAL_ERROR
, SSL_F_TLS_CONSTRUCT_STOC_COOKIE
,
1852 ERR_R_INTERNAL_ERROR
);
1853 return EXT_RETURN_FAIL
;
1855 hmaclen
= SHA256_DIGEST_LENGTH
;
1857 totcookielen
-= startlen
;
1858 if (!ossl_assert(totcookielen
<= MAX_COOKIE_SIZE
- SHA256_DIGEST_LENGTH
)) {
1859 SSLfatal(s
, SSL_AD_INTERNAL_ERROR
, SSL_F_TLS_CONSTRUCT_STOC_COOKIE
,
1860 ERR_R_INTERNAL_ERROR
);
1861 return EXT_RETURN_FAIL
;
1864 /* HMAC the cookie */
1865 hctx
= EVP_MD_CTX_create();
1866 pkey
= EVP_PKEY_new_raw_private_key_with_libctx(s
->ctx
->libctx
, "HMAC",
1868 s
->session_ctx
->ext
.cookie_hmac_key
,
1869 sizeof(s
->session_ctx
->ext
1871 if (hctx
== NULL
|| pkey
== NULL
) {
1872 SSLfatal(s
, SSL_AD_INTERNAL_ERROR
, SSL_F_TLS_CONSTRUCT_STOC_COOKIE
,
1873 ERR_R_MALLOC_FAILURE
);
1877 if (EVP_DigestSignInit_with_libctx(hctx
, NULL
, "SHA2-256",
1878 s
->ctx
->libctx
, s
->ctx
->propq
,
1880 || EVP_DigestSign(hctx
, hmac
, &hmaclen
, cookie
,
1881 totcookielen
) <= 0) {
1882 SSLfatal(s
, SSL_AD_INTERNAL_ERROR
, SSL_F_TLS_CONSTRUCT_STOC_COOKIE
,
1883 ERR_R_INTERNAL_ERROR
);
1887 if (!ossl_assert(totcookielen
+ hmaclen
<= MAX_COOKIE_SIZE
)) {
1888 SSLfatal(s
, SSL_AD_INTERNAL_ERROR
, SSL_F_TLS_CONSTRUCT_STOC_COOKIE
,
1889 ERR_R_INTERNAL_ERROR
);
1893 if (!WPACKET_allocate_bytes(pkt
, hmaclen
, &hmac2
)
1894 || !ossl_assert(hmac
== hmac2
)
1895 || !ossl_assert(cookie
== hmac
- totcookielen
)
1896 || !WPACKET_close(pkt
)
1897 || !WPACKET_close(pkt
)) {
1898 SSLfatal(s
, SSL_AD_INTERNAL_ERROR
, SSL_F_TLS_CONSTRUCT_STOC_COOKIE
,
1899 ERR_R_INTERNAL_ERROR
);
1903 ret
= EXT_RETURN_SENT
;
1906 EVP_MD_CTX_free(hctx
);
1907 EVP_PKEY_free(pkey
);
1910 return EXT_RETURN_FAIL
;
1914 EXT_RETURN
tls_construct_stoc_cryptopro_bug(SSL
*s
, WPACKET
*pkt
,
1915 unsigned int context
, X509
*x
,
1918 const unsigned char cryptopro_ext
[36] = {
1919 0xfd, 0xe8, /* 65000 */
1920 0x00, 0x20, /* 32 bytes length */
1921 0x30, 0x1e, 0x30, 0x08, 0x06, 0x06, 0x2a, 0x85,
1922 0x03, 0x02, 0x02, 0x09, 0x30, 0x08, 0x06, 0x06,
1923 0x2a, 0x85, 0x03, 0x02, 0x02, 0x16, 0x30, 0x08,
1924 0x06, 0x06, 0x2a, 0x85, 0x03, 0x02, 0x02, 0x17
1927 if (((s
->s3
.tmp
.new_cipher
->id
& 0xFFFF) != 0x80
1928 && (s
->s3
.tmp
.new_cipher
->id
& 0xFFFF) != 0x81)
1929 || (SSL_get_options(s
) & SSL_OP_CRYPTOPRO_TLSEXT_BUG
) == 0)
1930 return EXT_RETURN_NOT_SENT
;
1932 if (!WPACKET_memcpy(pkt
, cryptopro_ext
, sizeof(cryptopro_ext
))) {
1933 SSLfatal(s
, SSL_AD_INTERNAL_ERROR
,
1934 SSL_F_TLS_CONSTRUCT_STOC_CRYPTOPRO_BUG
, ERR_R_INTERNAL_ERROR
);
1935 return EXT_RETURN_FAIL
;
1938 return EXT_RETURN_SENT
;
1941 EXT_RETURN
tls_construct_stoc_early_data(SSL
*s
, WPACKET
*pkt
,
1942 unsigned int context
, X509
*x
,
1945 if (context
== SSL_EXT_TLS1_3_NEW_SESSION_TICKET
) {
1946 if (s
->max_early_data
== 0)
1947 return EXT_RETURN_NOT_SENT
;
1949 if (!WPACKET_put_bytes_u16(pkt
, TLSEXT_TYPE_early_data
)
1950 || !WPACKET_start_sub_packet_u16(pkt
)
1951 || !WPACKET_put_bytes_u32(pkt
, s
->max_early_data
)
1952 || !WPACKET_close(pkt
)) {
1953 SSLfatal(s
, SSL_AD_INTERNAL_ERROR
,
1954 SSL_F_TLS_CONSTRUCT_STOC_EARLY_DATA
, ERR_R_INTERNAL_ERROR
);
1955 return EXT_RETURN_FAIL
;
1958 return EXT_RETURN_SENT
;
1961 if (s
->ext
.early_data
!= SSL_EARLY_DATA_ACCEPTED
)
1962 return EXT_RETURN_NOT_SENT
;
1964 if (!WPACKET_put_bytes_u16(pkt
, TLSEXT_TYPE_early_data
)
1965 || !WPACKET_start_sub_packet_u16(pkt
)
1966 || !WPACKET_close(pkt
)) {
1967 SSLfatal(s
, SSL_AD_INTERNAL_ERROR
, SSL_F_TLS_CONSTRUCT_STOC_EARLY_DATA
,
1968 ERR_R_INTERNAL_ERROR
);
1969 return EXT_RETURN_FAIL
;
1972 return EXT_RETURN_SENT
;
1975 EXT_RETURN
tls_construct_stoc_psk(SSL
*s
, WPACKET
*pkt
, unsigned int context
,
1976 X509
*x
, size_t chainidx
)
1979 return EXT_RETURN_NOT_SENT
;
1981 if (!WPACKET_put_bytes_u16(pkt
, TLSEXT_TYPE_psk
)
1982 || !WPACKET_start_sub_packet_u16(pkt
)
1983 || !WPACKET_put_bytes_u16(pkt
, s
->ext
.tick_identity
)
1984 || !WPACKET_close(pkt
)) {
1985 SSLfatal(s
, SSL_AD_INTERNAL_ERROR
,
1986 SSL_F_TLS_CONSTRUCT_STOC_PSK
, ERR_R_INTERNAL_ERROR
);
1987 return EXT_RETURN_FAIL
;
1990 return EXT_RETURN_SENT
;