2 * Copyright 2014-2016 The OpenSSL Project Authors. All Rights Reserved.
4 * Licensed under the OpenSSL license (the "License"). You may not use
5 * this file except in compliance with the License. You can obtain a copy
6 * in the file LICENSE in the source distribution or at
7 * https://www.openssl.org/source/license.html
10 /* Custom extension utility functions */
12 #include <openssl/ct.h>
15 /* Find a custom extension from the list. */
16 static custom_ext_method
*custom_ext_find(const custom_ext_methods
*exts
,
17 unsigned int ext_type
)
20 custom_ext_method
*meth
= exts
->meths
;
21 for (i
= 0; i
< exts
->meths_count
; i
++, meth
++) {
22 if (ext_type
== meth
->ext_type
)
29 * Initialise custom extensions flags to indicate neither sent nor received.
31 void custom_ext_init(custom_ext_methods
*exts
)
34 custom_ext_method
*meth
= exts
->meths
;
35 for (i
= 0; i
< exts
->meths_count
; i
++, meth
++)
39 /* Pass received custom extension data to the application for parsing. */
40 int custom_ext_parse(SSL
*s
, int server
,
41 unsigned int ext_type
,
42 const unsigned char *ext_data
, size_t ext_size
, int *al
)
44 custom_ext_methods
*exts
= server
? &s
->cert
->srv_ext
: &s
->cert
->cli_ext
;
45 custom_ext_method
*meth
;
46 meth
= custom_ext_find(exts
, ext_type
);
47 /* If not found return success */
52 * If it's ServerHello we can't have any extensions not sent in
55 if (!(meth
->ext_flags
& SSL_EXT_FLAG_SENT
)) {
56 *al
= TLS1_AD_UNSUPPORTED_EXTENSION
;
60 /* If already present it's a duplicate */
61 if (meth
->ext_flags
& SSL_EXT_FLAG_RECEIVED
) {
62 *al
= TLS1_AD_DECODE_ERROR
;
65 meth
->ext_flags
|= SSL_EXT_FLAG_RECEIVED
;
66 /* If no parse function set return success */
70 return meth
->parse_cb(s
, ext_type
, ext_data
, ext_size
, al
, meth
->parse_arg
);
74 * Request custom extension data from the application and add to the return
77 int custom_ext_add(SSL
*s
, int server
, WPACKET
*pkt
, int *al
)
79 custom_ext_methods
*exts
= server
? &s
->cert
->srv_ext
: &s
->cert
->cli_ext
;
80 custom_ext_method
*meth
;
83 for (i
= 0; i
< exts
->meths_count
; i
++) {
84 const unsigned char *out
= NULL
;
87 meth
= exts
->meths
+ i
;
91 * For ServerHello only send extensions present in ClientHello.
93 if (!(meth
->ext_flags
& SSL_EXT_FLAG_RECEIVED
))
95 /* If callback absent for server skip it */
101 cb_retval
= meth
->add_cb(s
, meth
->ext_type
,
102 &out
, &outlen
, al
, meth
->add_arg
);
104 return 0; /* error */
106 continue; /* skip this extension */
109 if (!WPACKET_put_bytes_u16(pkt
, meth
->ext_type
)
110 || !WPACKET_start_sub_packet_u16(pkt
)
111 || (outlen
> 0 && !WPACKET_memcpy(pkt
, out
, outlen
))
112 || !WPACKET_close(pkt
)) {
113 *al
= SSL_AD_INTERNAL_ERROR
;
117 * We can't send duplicates: code logic should prevent this.
119 OPENSSL_assert(!(meth
->ext_flags
& SSL_EXT_FLAG_SENT
));
121 * Indicate extension has been sent: this is both a sanity check to
122 * ensure we don't send duplicate extensions and indicates that it is
123 * not an error if the extension is present in ServerHello.
125 meth
->ext_flags
|= SSL_EXT_FLAG_SENT
;
127 meth
->free_cb(s
, meth
->ext_type
, out
, meth
->add_arg
);
132 /* Copy table of custom extensions */
133 int custom_exts_copy(custom_ext_methods
*dst
, const custom_ext_methods
*src
)
135 if (src
->meths_count
) {
137 OPENSSL_memdup(src
->meths
,
138 sizeof(custom_ext_method
) * src
->meths_count
);
139 if (dst
->meths
== NULL
)
141 dst
->meths_count
= src
->meths_count
;
146 void custom_exts_free(custom_ext_methods
*exts
)
148 OPENSSL_free(exts
->meths
);
151 /* Set callbacks for a custom extension. */
152 static int custom_ext_meth_add(custom_ext_methods
*exts
,
153 unsigned int ext_type
,
154 custom_ext_add_cb add_cb
,
155 custom_ext_free_cb free_cb
,
157 custom_ext_parse_cb parse_cb
, void *parse_arg
)
159 custom_ext_method
*meth
, *tmp
;
161 * Check application error: if add_cb is not set free_cb will never be
164 if (!add_cb
&& free_cb
)
167 * Don't add if extension supported internally, but make exception
168 * for extension types that previously were not supported, but now are.
170 if (SSL_extension_supported(ext_type
) &&
171 ext_type
!= TLSEXT_TYPE_signed_certificate_timestamp
)
173 /* Extension type must fit in 16 bits */
174 if (ext_type
> 0xffff)
176 /* Search for duplicate */
177 if (custom_ext_find(exts
, ext_type
))
179 tmp
= OPENSSL_realloc(exts
->meths
,
180 (exts
->meths_count
+ 1) * sizeof(custom_ext_method
));
183 OPENSSL_free(exts
->meths
);
185 exts
->meths_count
= 0;
190 meth
= exts
->meths
+ exts
->meths_count
;
191 memset(meth
, 0, sizeof(*meth
));
192 meth
->parse_cb
= parse_cb
;
193 meth
->add_cb
= add_cb
;
194 meth
->free_cb
= free_cb
;
195 meth
->ext_type
= ext_type
;
196 meth
->add_arg
= add_arg
;
197 meth
->parse_arg
= parse_arg
;
202 /* Return true if a client custom extension exists, false otherwise */
203 int SSL_CTX_has_client_custom_ext(const SSL_CTX
*ctx
, unsigned int ext_type
)
205 return custom_ext_find(&ctx
->cert
->cli_ext
, ext_type
) != NULL
;
208 /* Application level functions to add custom extension callbacks */
209 int SSL_CTX_add_client_custom_ext(SSL_CTX
*ctx
, unsigned int ext_type
,
210 custom_ext_add_cb add_cb
,
211 custom_ext_free_cb free_cb
,
213 custom_ext_parse_cb parse_cb
, void *parse_arg
)
215 #ifndef OPENSSL_NO_CT
217 * We don't want applications registering callbacks for SCT extensions
218 * whilst simultaneously using the built-in SCT validation features, as
219 * these two things may not play well together.
221 if (ext_type
== TLSEXT_TYPE_signed_certificate_timestamp
&&
222 SSL_CTX_ct_is_enabled(ctx
))
225 return custom_ext_meth_add(&ctx
->cert
->cli_ext
, ext_type
, add_cb
,
226 free_cb
, add_arg
, parse_cb
, parse_arg
);
229 int SSL_CTX_add_server_custom_ext(SSL_CTX
*ctx
, unsigned int ext_type
,
230 custom_ext_add_cb add_cb
,
231 custom_ext_free_cb free_cb
,
233 custom_ext_parse_cb parse_cb
, void *parse_arg
)
235 return custom_ext_meth_add(&ctx
->cert
->srv_ext
, ext_type
,
236 add_cb
, free_cb
, add_arg
, parse_cb
, parse_arg
);
239 int SSL_extension_supported(unsigned int ext_type
)
242 /* Internally supported extensions. */
243 case TLSEXT_TYPE_application_layer_protocol_negotiation
:
244 case TLSEXT_TYPE_ec_point_formats
:
245 case TLSEXT_TYPE_supported_groups
:
246 #ifndef OPENSSL_NO_NEXTPROTONEG
247 case TLSEXT_TYPE_next_proto_neg
:
249 case TLSEXT_TYPE_padding
:
250 case TLSEXT_TYPE_renegotiate
:
251 case TLSEXT_TYPE_server_name
:
252 case TLSEXT_TYPE_session_ticket
:
253 case TLSEXT_TYPE_signature_algorithms
:
254 case TLSEXT_TYPE_srp
:
255 case TLSEXT_TYPE_status_request
:
256 case TLSEXT_TYPE_signed_certificate_timestamp
:
257 case TLSEXT_TYPE_use_srtp
:
258 #ifdef TLSEXT_TYPE_encrypt_then_mac
259 case TLSEXT_TYPE_encrypt_then_mac
:
261 case TLSEXT_TYPE_key_share
:
262 case TLSEXT_TYPE_supported_versions
:
263 case TLSEXT_TYPE_extended_master_secret
: