extensions_srvr.c@ 95000

Last change on this file since 95000 was 91772, checked in by vboxsync, 3 years ago
openssl-1.1.1l: Applied and adjusted our OpenSSL changes to 1.1.1l. bugref:10126
File size: 68.5 KB

Line
1	/*
2	* Copyright 2016-2021 The OpenSSL Project Authors. All Rights Reserved.
3	*
4	* Licensed under the OpenSSL license (the "License"). You may not use
5	* this file except in compliance with the License. You can obtain a copy
6	* in the file LICENSE in the source distribution or at
7	* https://www.openssl.org/source/license.html
8	*/
9
10	#include <openssl/ocsp.h>
11	#include "../ssl_local.h"
12	#include "statem_local.h"
13	#include "internal/cryptlib.h"
14
15	#define COOKIE_STATE_FORMAT_VERSION 0
16
17	/*
18	* 2 bytes for packet length, 2 bytes for format version, 2 bytes for
19	* protocol version, 2 bytes for group id, 2 bytes for cipher id, 1 byte for
20	* key_share present flag, 4 bytes for timestamp, 2 bytes for the hashlen,
21	* EVP_MAX_MD_SIZE for transcript hash, 1 byte for app cookie length, app cookie
22	* length bytes, SHA256_DIGEST_LENGTH bytes for the HMAC of the whole thing.
23	*/
24	#define MAX_COOKIE_SIZE (2 + 2 + 2 + 2 + 2 + 1 + 4 + 2 + EVP_MAX_MD_SIZE + 1 \
25	+ SSL_COOKIE_LENGTH + SHA256_DIGEST_LENGTH)
26
27	/*
28	* Message header + 2 bytes for protocol version + number of random bytes +
29	* + 1 byte for legacy session id length + number of bytes in legacy session id
30	* + 2 bytes for ciphersuite + 1 byte for legacy compression
31	* + 2 bytes for extension block length + 6 bytes for key_share extension
32	* + 4 bytes for cookie extension header + the number of bytes in the cookie
33	*/
34	#define MAX_HRR_SIZE (SSL3_HM_HEADER_LENGTH + 2 + SSL3_RANDOM_SIZE + 1 \
35	+ SSL_MAX_SSL_SESSION_ID_LENGTH + 2 + 1 + 2 + 6 + 4 \
36	+ MAX_COOKIE_SIZE)
37
38	/*
39	* Parse the client's renegotiation binding and abort if it's not right
40	*/
41	int tls_parse_ctos_renegotiate(SSL s, PACKET pkt, unsigned int context,
42	X509 *x, size_t chainidx)
43	{
44	unsigned int ilen;
45	const unsigned char *data;
46
47	/* Parse the length byte */
48	if (!PACKET_get_1(pkt, &ilen)
49	\|\| !PACKET_get_bytes(pkt, &data, ilen)) {
50	SSLfatal(s, SSL_AD_DECODE_ERROR, SSL_F_TLS_PARSE_CTOS_RENEGOTIATE,
51	SSL_R_RENEGOTIATION_ENCODING_ERR);
52	return 0;
53	}
54
55	/* Check that the extension matches */
56	if (ilen != s->s3->previous_client_finished_len) {
57	SSLfatal(s, SSL_AD_HANDSHAKE_FAILURE, SSL_F_TLS_PARSE_CTOS_RENEGOTIATE,
58	SSL_R_RENEGOTIATION_MISMATCH);
59	return 0;
60	}
61
62	if (memcmp(data, s->s3->previous_client_finished,
63	s->s3->previous_client_finished_len)) {
64	SSLfatal(s, SSL_AD_HANDSHAKE_FAILURE, SSL_F_TLS_PARSE_CTOS_RENEGOTIATE,
65	SSL_R_RENEGOTIATION_MISMATCH);
66	return 0;
67	}
68
69	s->s3->send_connection_binding = 1;
70
71	return 1;
72	}
73
74	/*-
75	* The servername extension is treated as follows:
76	*
77	* - Only the hostname type is supported with a maximum length of 255.
78	* - The servername is rejected if too long or if it contains zeros,
79	* in which case an fatal alert is generated.
80	* - The servername field is maintained together with the session cache.
81	* - When a session is resumed, the servername call back invoked in order
82	* to allow the application to position itself to the right context.
83	* - The servername is acknowledged if it is new for a session or when
84	* it is identical to a previously used for the same session.
85	* Applications can control the behaviour. They can at any time
86	* set a 'desirable' servername for a new SSL object. This can be the
87	* case for example with HTTPS when a Host: header field is received and
88	* a renegotiation is requested. In this case, a possible servername
89	* presented in the new client hello is only acknowledged if it matches
90	* the value of the Host: field.
91	* - Applications must use SSL_OP_NO_SESSION_RESUMPTION_ON_RENEGOTIATION
92	* if they provide for changing an explicit servername context for the
93	* session, i.e. when the session has been established with a servername
94	* extension.
95	* - On session reconnect, the servername extension may be absent.
96	*/
97	int tls_parse_ctos_server_name(SSL s, PACKET pkt, unsigned int context,
98	X509 *x, size_t chainidx)
99	{
100	unsigned int servname_type;
101	PACKET sni, hostname;
102
103	if (!PACKET_as_length_prefixed_2(pkt, &sni)
104	/* ServerNameList must be at least 1 byte long. */
105	\|\| PACKET_remaining(&sni) == 0) {
106	SSLfatal(s, SSL_AD_DECODE_ERROR, SSL_F_TLS_PARSE_CTOS_SERVER_NAME,
107	SSL_R_BAD_EXTENSION);
108	return 0;
109	}
110
111	/*
112	* Although the intent was for server_name to be extensible, RFC 4366
113	* was not clear about it; and so OpenSSL among other implementations,
114	* always and only allows a 'host_name' name types.
115	* RFC 6066 corrected the mistake but adding new name types
116	* is nevertheless no longer feasible, so act as if no other
117	* SNI types can exist, to simplify parsing.
118	*
119	* Also note that the RFC permits only one SNI value per type,
120	* i.e., we can only have a single hostname.
121	*/
122	if (!PACKET_get_1(&sni, &servname_type)
123	\|\| servname_type != TLSEXT_NAMETYPE_host_name
124	\|\| !PACKET_as_length_prefixed_2(&sni, &hostname)) {
125	SSLfatal(s, SSL_AD_DECODE_ERROR, SSL_F_TLS_PARSE_CTOS_SERVER_NAME,
126	SSL_R_BAD_EXTENSION);
127	return 0;
128	}
129
130	/*
131	* In TLSv1.2 and below the SNI is associated with the session. In TLSv1.3
132	* we always use the SNI value from the handshake.
133	*/
134	if (!s->hit \|\| SSL_IS_TLS13(s)) {
135	if (PACKET_remaining(&hostname) > TLSEXT_MAXLEN_host_name) {
136	SSLfatal(s, SSL_AD_UNRECOGNIZED_NAME,
137	SSL_F_TLS_PARSE_CTOS_SERVER_NAME,
138	SSL_R_BAD_EXTENSION);
139	return 0;
140	}
141
142	if (PACKET_contains_zero_byte(&hostname)) {
143	SSLfatal(s, SSL_AD_UNRECOGNIZED_NAME,
144	SSL_F_TLS_PARSE_CTOS_SERVER_NAME,
145	SSL_R_BAD_EXTENSION);
146	return 0;
147	}
148
149	/*
150	* Store the requested SNI in the SSL as temporary storage.
151	* If we accept it, it will get stored in the SSL_SESSION as well.
152	*/
153	OPENSSL_free(s->ext.hostname);
154	s->ext.hostname = NULL;
155	if (!PACKET_strndup(&hostname, &s->ext.hostname)) {
156	SSLfatal(s, SSL_AD_INTERNAL_ERROR, SSL_F_TLS_PARSE_CTOS_SERVER_NAME,
157	ERR_R_INTERNAL_ERROR);
158	return 0;
159	}
160
161	s->servername_done = 1;
162	} else {
163	/*
164	* In TLSv1.2 and below we should check if the SNI is consistent between
165	* the initial handshake and the resumption. In TLSv1.3 SNI is not
166	* associated with the session.
167	*/
168	/*
169	* TODO(openssl-team): if the SNI doesn't match, we MUST
170	* fall back to a full handshake.
171	*/
172	s->servername_done = (s->session->ext.hostname != NULL)
173	&& PACKET_equal(&hostname, s->session->ext.hostname,
174	strlen(s->session->ext.hostname));
175	}
176
177	return 1;
178	}
179
180	int tls_parse_ctos_maxfragmentlen(SSL s, PACKET pkt, unsigned int context,
181	X509 *x, size_t chainidx)
182	{
183	unsigned int value;
184
185	if (PACKET_remaining(pkt) != 1 \|\| !PACKET_get_1(pkt, &value)) {
186	SSLfatal(s, SSL_AD_DECODE_ERROR, SSL_F_TLS_PARSE_CTOS_MAXFRAGMENTLEN,
187	SSL_R_BAD_EXTENSION);
188	return 0;
189	}
190
191	/* Received \|value\| should be a valid max-fragment-length code. */
192	if (!IS_MAX_FRAGMENT_LENGTH_EXT_VALID(value)) {
193	SSLfatal(s, SSL_AD_ILLEGAL_PARAMETER,
194	SSL_F_TLS_PARSE_CTOS_MAXFRAGMENTLEN,
195	SSL_R_SSL3_EXT_INVALID_MAX_FRAGMENT_LENGTH);
196	return 0;
197	}
198
199	/*
200	* RFC 6066: The negotiated length applies for the duration of the session
201	* including session resumptions.
202	* We should receive the same code as in resumed session !
203	*/
204	if (s->hit && s->session->ext.max_fragment_len_mode != value) {
205	SSLfatal(s, SSL_AD_ILLEGAL_PARAMETER,
206	SSL_F_TLS_PARSE_CTOS_MAXFRAGMENTLEN,
207	SSL_R_SSL3_EXT_INVALID_MAX_FRAGMENT_LENGTH);
208	return 0;
209	}
210
211	/*
212	* Store it in session, so it'll become binding for us
213	* and we'll include it in a next Server Hello.
214	*/
215	s->session->ext.max_fragment_len_mode = value;
216	return 1;
217	}
218
219	#ifndef OPENSSL_NO_SRP
220	int tls_parse_ctos_srp(SSL s, PACKET pkt, unsigned int context, X509 *x,
221	size_t chainidx)
222	{
223	PACKET srp_I;
224
225	if (!PACKET_as_length_prefixed_1(pkt, &srp_I)
226	\|\| PACKET_contains_zero_byte(&srp_I)) {
227	SSLfatal(s, SSL_AD_DECODE_ERROR,
228	SSL_F_TLS_PARSE_CTOS_SRP,
229	SSL_R_BAD_EXTENSION);
230	return 0;
231	}
232
233	/*
234	* TODO(openssl-team): currently, we re-authenticate the user
235	* upon resumption. Instead, we MUST ignore the login.
236	*/
237	if (!PACKET_strndup(&srp_I, &s->srp_ctx.login)) {
238	SSLfatal(s, SSL_AD_INTERNAL_ERROR, SSL_F_TLS_PARSE_CTOS_SRP,
239	ERR_R_INTERNAL_ERROR);
240	return 0;
241	}
242
243	return 1;
244	}
245	#endif
246
247	#ifndef OPENSSL_NO_EC
248	int tls_parse_ctos_ec_pt_formats(SSL s, PACKET pkt, unsigned int context,
249	X509 *x, size_t chainidx)
250	{
251	PACKET ec_point_format_list;
252
253	if (!PACKET_as_length_prefixed_1(pkt, &ec_point_format_list)
254	\|\| PACKET_remaining(&ec_point_format_list) == 0) {
255	SSLfatal(s, SSL_AD_DECODE_ERROR, SSL_F_TLS_PARSE_CTOS_EC_PT_FORMATS,
256	SSL_R_BAD_EXTENSION);
257	return 0;
258	}
259
260	if (!s->hit) {
261	if (!PACKET_memdup(&ec_point_format_list,
262	&s->ext.peer_ecpointformats,
263	&s->ext.peer_ecpointformats_len)) {
264	SSLfatal(s, SSL_AD_INTERNAL_ERROR,
265	SSL_F_TLS_PARSE_CTOS_EC_PT_FORMATS, ERR_R_INTERNAL_ERROR);
266	return 0;
267	}
268	}
269
270	return 1;
271	}
272	#endif /* OPENSSL_NO_EC */
273
274	int tls_parse_ctos_session_ticket(SSL s, PACKET pkt, unsigned int context,
275	X509 *x, size_t chainidx)
276	{
277	if (s->ext.session_ticket_cb &&
278	!s->ext.session_ticket_cb(s, PACKET_data(pkt),
279	PACKET_remaining(pkt),
280	s->ext.session_ticket_cb_arg)) {
281	SSLfatal(s, SSL_AD_INTERNAL_ERROR,
282	SSL_F_TLS_PARSE_CTOS_SESSION_TICKET, ERR_R_INTERNAL_ERROR);
283	return 0;
284	}
285
286	return 1;
287	}
288
289	int tls_parse_ctos_sig_algs_cert(SSL s, PACKET pkt, unsigned int context,
290	X509 *x, size_t chainidx)
291	{
292	PACKET supported_sig_algs;
293
294	if (!PACKET_as_length_prefixed_2(pkt, &supported_sig_algs)
295	\|\| PACKET_remaining(&supported_sig_algs) == 0) {
296	SSLfatal(s, SSL_AD_DECODE_ERROR,
297	SSL_F_TLS_PARSE_CTOS_SIG_ALGS_CERT, SSL_R_BAD_EXTENSION);
298	return 0;
299	}
300
301	if (!s->hit && !tls1_save_sigalgs(s, &supported_sig_algs, 1)) {
302	SSLfatal(s, SSL_AD_DECODE_ERROR,
303	SSL_F_TLS_PARSE_CTOS_SIG_ALGS_CERT, SSL_R_BAD_EXTENSION);
304	return 0;
305	}
306
307	return 1;
308	}
309
310	int tls_parse_ctos_sig_algs(SSL s, PACKET pkt, unsigned int context, X509 *x,
311	size_t chainidx)
312	{
313	PACKET supported_sig_algs;
314
315	if (!PACKET_as_length_prefixed_2(pkt, &supported_sig_algs)
316	\|\| PACKET_remaining(&supported_sig_algs) == 0) {
317	SSLfatal(s, SSL_AD_DECODE_ERROR,
318	SSL_F_TLS_PARSE_CTOS_SIG_ALGS, SSL_R_BAD_EXTENSION);
319	return 0;
320	}
321
322	if (!s->hit && !tls1_save_sigalgs(s, &supported_sig_algs, 0)) {
323	SSLfatal(s, SSL_AD_DECODE_ERROR,
324	SSL_F_TLS_PARSE_CTOS_SIG_ALGS, SSL_R_BAD_EXTENSION);
325	return 0;
326	}
327
328	return 1;
329	}
330
331	#ifndef OPENSSL_NO_OCSP
332	int tls_parse_ctos_status_request(SSL s, PACKET pkt, unsigned int context,
333	X509 *x, size_t chainidx)
334	{
335	PACKET responder_id_list, exts;
336
337	/* We ignore this in a resumption handshake */
338	if (s->hit)
339	return 1;
340
341	/* Not defined if we get one of these in a client Certificate */
342	if (x != NULL)
343	return 1;
344
345	if (!PACKET_get_1(pkt, (unsigned int *)&s->ext.status_type)) {
346	SSLfatal(s, SSL_AD_DECODE_ERROR,
347	SSL_F_TLS_PARSE_CTOS_STATUS_REQUEST, SSL_R_BAD_EXTENSION);
348	return 0;
349	}
350
351	if (s->ext.status_type != TLSEXT_STATUSTYPE_ocsp) {
352	/*
353	* We don't know what to do with any other type so ignore it.
354	*/
355	s->ext.status_type = TLSEXT_STATUSTYPE_nothing;
356	return 1;
357	}
358
359	if (!PACKET_get_length_prefixed_2 (pkt, &responder_id_list)) {
360	SSLfatal(s, SSL_AD_DECODE_ERROR,
361	SSL_F_TLS_PARSE_CTOS_STATUS_REQUEST, SSL_R_BAD_EXTENSION);
362	return 0;
363	}
364
365	/*
366	* We remove any OCSP_RESPIDs from a previous handshake
367	* to prevent unbounded memory growth - CVE-2016-6304
368	*/
369	sk_OCSP_RESPID_pop_free(s->ext.ocsp.ids, OCSP_RESPID_free);
370	if (PACKET_remaining(&responder_id_list) > 0) {
371	s->ext.ocsp.ids = sk_OCSP_RESPID_new_null();
372	if (s->ext.ocsp.ids == NULL) {
373	SSLfatal(s, SSL_AD_INTERNAL_ERROR,
374	SSL_F_TLS_PARSE_CTOS_STATUS_REQUEST, ERR_R_MALLOC_FAILURE);
375	return 0;
376	}
377	} else {
378	s->ext.ocsp.ids = NULL;
379	}
380
381	while (PACKET_remaining(&responder_id_list) > 0) {
382	OCSP_RESPID *id;
383	PACKET responder_id;
384	const unsigned char *id_data;
385
386	if (!PACKET_get_length_prefixed_2(&responder_id_list, &responder_id)
387	\|\| PACKET_remaining(&responder_id) == 0) {
388	SSLfatal(s, SSL_AD_DECODE_ERROR,
389	SSL_F_TLS_PARSE_CTOS_STATUS_REQUEST, SSL_R_BAD_EXTENSION);
390	return 0;
391	}
392
393	id_data = PACKET_data(&responder_id);
394	/* TODO(size_t): Convert d2i_* to size_t */
395	id = d2i_OCSP_RESPID(NULL, &id_data,
396	(int)PACKET_remaining(&responder_id));
397	if (id == NULL) {
398	SSLfatal(s, SSL_AD_DECODE_ERROR,
399	SSL_F_TLS_PARSE_CTOS_STATUS_REQUEST, SSL_R_BAD_EXTENSION);
400	return 0;
401	}
402
403	if (id_data != PACKET_end(&responder_id)) {
404	OCSP_RESPID_free(id);
405	SSLfatal(s, SSL_AD_DECODE_ERROR,
406	SSL_F_TLS_PARSE_CTOS_STATUS_REQUEST, SSL_R_BAD_EXTENSION);
407
408	return 0;
409	}
410
411	if (!sk_OCSP_RESPID_push(s->ext.ocsp.ids, id)) {
412	OCSP_RESPID_free(id);
413	SSLfatal(s, SSL_AD_INTERNAL_ERROR,
414	SSL_F_TLS_PARSE_CTOS_STATUS_REQUEST, ERR_R_INTERNAL_ERROR);
415
416	return 0;
417	}
418	}
419
420	/* Read in request_extensions */
421	if (!PACKET_as_length_prefixed_2(pkt, &exts)) {
422	SSLfatal(s, SSL_AD_DECODE_ERROR,
423	SSL_F_TLS_PARSE_CTOS_STATUS_REQUEST, SSL_R_BAD_EXTENSION);
424	return 0;
425	}
426
427	if (PACKET_remaining(&exts) > 0) {
428	const unsigned char *ext_data = PACKET_data(&exts);
429
430	sk_X509_EXTENSION_pop_free(s->ext.ocsp.exts,
431	X509_EXTENSION_free);
432	s->ext.ocsp.exts =
433	d2i_X509_EXTENSIONS(NULL, &ext_data, (int)PACKET_remaining(&exts));
434	if (s->ext.ocsp.exts == NULL \|\| ext_data != PACKET_end(&exts)) {
435	SSLfatal(s, SSL_AD_DECODE_ERROR,
436	SSL_F_TLS_PARSE_CTOS_STATUS_REQUEST, SSL_R_BAD_EXTENSION);
437	return 0;
438	}
439	}
440
441	return 1;
442	}
443	#endif
444
445	#ifndef OPENSSL_NO_NEXTPROTONEG
446	int tls_parse_ctos_npn(SSL s, PACKET pkt, unsigned int context, X509 *x,
447	size_t chainidx)
448	{
449	/*
450	* We shouldn't accept this extension on a
451	* renegotiation.
452	*/
453	if (SSL_IS_FIRST_HANDSHAKE(s))
454	s->s3->npn_seen = 1;
455
456	return 1;
457	}
458	#endif
459
460	/*
461	* Save the ALPN extension in a ClientHello.\|pkt\| holds the contents of the ALPN
462	* extension, not including type and length. Returns: 1 on success, 0 on error.
463	*/
464	int tls_parse_ctos_alpn(SSL s, PACKET pkt, unsigned int context, X509 *x,
465	size_t chainidx)
466	{
467	PACKET protocol_list, save_protocol_list, protocol;
468
469	if (!SSL_IS_FIRST_HANDSHAKE(s))
470	return 1;
471
472	if (!PACKET_as_length_prefixed_2(pkt, &protocol_list)
473	\|\| PACKET_remaining(&protocol_list) < 2) {
474	SSLfatal(s, SSL_AD_DECODE_ERROR, SSL_F_TLS_PARSE_CTOS_ALPN,
475	SSL_R_BAD_EXTENSION);
476	return 0;
477	}
478
479	save_protocol_list = protocol_list;
480	do {
481	/* Protocol names can't be empty. */
482	if (!PACKET_get_length_prefixed_1(&protocol_list, &protocol)
483	\|\| PACKET_remaining(&protocol) == 0) {
484	SSLfatal(s, SSL_AD_DECODE_ERROR, SSL_F_TLS_PARSE_CTOS_ALPN,
485	SSL_R_BAD_EXTENSION);
486	return 0;
487	}
488	} while (PACKET_remaining(&protocol_list) != 0);
489
490	OPENSSL_free(s->s3->alpn_proposed);
491	s->s3->alpn_proposed = NULL;
492	s->s3->alpn_proposed_len = 0;
493	if (!PACKET_memdup(&save_protocol_list,
494	&s->s3->alpn_proposed, &s->s3->alpn_proposed_len)) {
495	SSLfatal(s, SSL_AD_INTERNAL_ERROR, SSL_F_TLS_PARSE_CTOS_ALPN,
496	ERR_R_INTERNAL_ERROR);
497	return 0;
498	}
499
500	return 1;
501	}
502
503	#ifndef OPENSSL_NO_SRTP
504	int tls_parse_ctos_use_srtp(SSL s, PACKET pkt, unsigned int context, X509 *x,
505	size_t chainidx)
506	{
507	STACK_OF(SRTP_PROTECTION_PROFILE) *srvr;
508	unsigned int ct, mki_len, id;
509	int i, srtp_pref;
510	PACKET subpkt;
511
512	/* Ignore this if we have no SRTP profiles */
513	if (SSL_get_srtp_profiles(s) == NULL)
514	return 1;
515
516	/* Pull off the length of the cipher suite list and check it is even */
517	if (!PACKET_get_net_2(pkt, &ct) \|\| (ct & 1) != 0
518	\|\| !PACKET_get_sub_packet(pkt, &subpkt, ct)) {
519	SSLfatal(s, SSL_AD_DECODE_ERROR, SSL_F_TLS_PARSE_CTOS_USE_SRTP,
520	SSL_R_BAD_SRTP_PROTECTION_PROFILE_LIST);
521	return 0;
522	}
523
524	srvr = SSL_get_srtp_profiles(s);
525	s->srtp_profile = NULL;
526	/* Search all profiles for a match initially */
527	srtp_pref = sk_SRTP_PROTECTION_PROFILE_num(srvr);
528
529	while (PACKET_remaining(&subpkt)) {
530	if (!PACKET_get_net_2(&subpkt, &id)) {
531	SSLfatal(s, SSL_AD_DECODE_ERROR, SSL_F_TLS_PARSE_CTOS_USE_SRTP,
532	SSL_R_BAD_SRTP_PROTECTION_PROFILE_LIST);
533	return 0;
534	}
535
536	/*
537	* Only look for match in profiles of higher preference than
538	* current match.
539	* If no profiles have been have been configured then this
540	* does nothing.
541	*/
542	for (i = 0; i < srtp_pref; i++) {
543	SRTP_PROTECTION_PROFILE *sprof =
544	sk_SRTP_PROTECTION_PROFILE_value(srvr, i);
545
546	if (sprof->id == id) {
547	s->srtp_profile = sprof;
548	srtp_pref = i;
549	break;
550	}
551	}
552	}
553
554	/* Now extract the MKI value as a sanity check, but discard it for now */
555	if (!PACKET_get_1(pkt, &mki_len)) {
556	SSLfatal(s, SSL_AD_DECODE_ERROR, SSL_F_TLS_PARSE_CTOS_USE_SRTP,
557	SSL_R_BAD_SRTP_PROTECTION_PROFILE_LIST);
558	return 0;
559	}
560
561	if (!PACKET_forward(pkt, mki_len)
562	\|\| PACKET_remaining(pkt)) {
563	SSLfatal(s, SSL_AD_DECODE_ERROR, SSL_F_TLS_PARSE_CTOS_USE_SRTP,
564	SSL_R_BAD_SRTP_MKI_VALUE);
565	return 0;
566	}
567
568	return 1;
569	}
570	#endif
571
572	int tls_parse_ctos_etm(SSL s, PACKET pkt, unsigned int context, X509 *x,
573	size_t chainidx)
574	{
575	if (!(s->options & SSL_OP_NO_ENCRYPT_THEN_MAC))
576	s->ext.use_etm = 1;
577
578	return 1;
579	}
580
581	/*
582	* Process a psk_kex_modes extension received in the ClientHello. \|pkt\| contains
583	* the raw PACKET data for the extension. Returns 1 on success or 0 on failure.
584	*/
585	int tls_parse_ctos_psk_kex_modes(SSL s, PACKET pkt, unsigned int context,
586	X509 *x, size_t chainidx)
587	{
588	#ifndef OPENSSL_NO_TLS1_3
589	PACKET psk_kex_modes;
590	unsigned int mode;
591
592	if (!PACKET_as_length_prefixed_1(pkt, &psk_kex_modes)
593	\|\| PACKET_remaining(&psk_kex_modes) == 0) {
594	SSLfatal(s, SSL_AD_DECODE_ERROR, SSL_F_TLS_PARSE_CTOS_PSK_KEX_MODES,
595	SSL_R_BAD_EXTENSION);
596	return 0;
597	}
598
599	while (PACKET_get_1(&psk_kex_modes, &mode)) {
600	if (mode == TLSEXT_KEX_MODE_KE_DHE)
601	s->ext.psk_kex_mode \|= TLSEXT_KEX_MODE_FLAG_KE_DHE;
602	else if (mode == TLSEXT_KEX_MODE_KE
603	&& (s->options & SSL_OP_ALLOW_NO_DHE_KEX) != 0)
604	s->ext.psk_kex_mode \|= TLSEXT_KEX_MODE_FLAG_KE;
605	}
606	#endif
607
608	return 1;
609	}
610
611	/*
612	* Process a key_share extension received in the ClientHello. \|pkt\| contains
613	* the raw PACKET data for the extension. Returns 1 on success or 0 on failure.
614	*/
615	int tls_parse_ctos_key_share(SSL s, PACKET pkt, unsigned int context, X509 *x,
616	size_t chainidx)
617	{
618	#ifndef OPENSSL_NO_TLS1_3
619	unsigned int group_id;
620	PACKET key_share_list, encoded_pt;
621	const uint16_t clntgroups, srvrgroups;
622	size_t clnt_num_groups, srvr_num_groups;
623	int found = 0;
624
625	if (s->hit && (s->ext.psk_kex_mode & TLSEXT_KEX_MODE_FLAG_KE_DHE) == 0)
626	return 1;
627
628	/* Sanity check */
629	if (s->s3->peer_tmp != NULL) {
630	SSLfatal(s, SSL_AD_INTERNAL_ERROR, SSL_F_TLS_PARSE_CTOS_KEY_SHARE,
631	ERR_R_INTERNAL_ERROR);
632	return 0;
633	}
634
635	if (!PACKET_as_length_prefixed_2(pkt, &key_share_list)) {
636	SSLfatal(s, SSL_AD_DECODE_ERROR, SSL_F_TLS_PARSE_CTOS_KEY_SHARE,
637	SSL_R_LENGTH_MISMATCH);
638	return 0;
639	}
640
641	/* Get our list of supported groups */
642	tls1_get_supported_groups(s, &srvrgroups, &srvr_num_groups);
643	/* Get the clients list of supported groups. */
644	tls1_get_peer_groups(s, &clntgroups, &clnt_num_groups);
645	if (clnt_num_groups == 0) {
646	/*
647	* This can only happen if the supported_groups extension was not sent,
648	* because we verify that the length is non-zero when we process that
649	* extension.
650	*/
651	SSLfatal(s, SSL_AD_MISSING_EXTENSION, SSL_F_TLS_PARSE_CTOS_KEY_SHARE,
652	SSL_R_MISSING_SUPPORTED_GROUPS_EXTENSION);
653	return 0;
654	}
655
656	if (s->s3->group_id != 0 && PACKET_remaining(&key_share_list) == 0) {
657	/*
658	* If we set a group_id already, then we must have sent an HRR
659	* requesting a new key_share. If we haven't got one then that is an
660	* error
661	*/
662	SSLfatal(s, SSL_AD_ILLEGAL_PARAMETER, SSL_F_TLS_PARSE_CTOS_KEY_SHARE,
663	SSL_R_BAD_KEY_SHARE);
664	return 0;
665	}
666
667	while (PACKET_remaining(&key_share_list) > 0) {
668	if (!PACKET_get_net_2(&key_share_list, &group_id)
669	\|\| !PACKET_get_length_prefixed_2(&key_share_list, &encoded_pt)
670	\|\| PACKET_remaining(&encoded_pt) == 0) {
671	SSLfatal(s, SSL_AD_DECODE_ERROR, SSL_F_TLS_PARSE_CTOS_KEY_SHARE,
672	SSL_R_LENGTH_MISMATCH);
673	return 0;
674	}
675
676	/*
677	* If we already found a suitable key_share we loop through the
678	* rest to verify the structure, but don't process them.
679	*/
680	if (found)
681	continue;
682
683	/*
684	* If we sent an HRR then the key_share sent back MUST be for the group
685	* we requested, and must be the only key_share sent.
686	*/
687	if (s->s3->group_id != 0
688	&& (group_id != s->s3->group_id
689	\|\| PACKET_remaining(&key_share_list) != 0)) {
690	SSLfatal(s, SSL_AD_ILLEGAL_PARAMETER,
691	SSL_F_TLS_PARSE_CTOS_KEY_SHARE, SSL_R_BAD_KEY_SHARE);
692	return 0;
693	}
694
695	/* Check if this share is in supported_groups sent from client */
696	if (!check_in_list(s, group_id, clntgroups, clnt_num_groups, 0)) {
697	SSLfatal(s, SSL_AD_ILLEGAL_PARAMETER,
698	SSL_F_TLS_PARSE_CTOS_KEY_SHARE, SSL_R_BAD_KEY_SHARE);
699	return 0;
700	}
701
702	/* Check if this share is for a group we can use */
703	if (!check_in_list(s, group_id, srvrgroups, srvr_num_groups, 1)) {
704	/* Share not suitable */
705	continue;
706	}
707
708	if ((s->s3->peer_tmp = ssl_generate_param_group(group_id)) == NULL) {
709	SSLfatal(s, SSL_AD_INTERNAL_ERROR, SSL_F_TLS_PARSE_CTOS_KEY_SHARE,
710	SSL_R_UNABLE_TO_FIND_ECDH_PARAMETERS);
711	return 0;
712	}
713
714	s->s3->group_id = group_id;
715
716	if (!EVP_PKEY_set1_tls_encodedpoint(s->s3->peer_tmp,
717	PACKET_data(&encoded_pt),
718	PACKET_remaining(&encoded_pt))) {
719	SSLfatal(s, SSL_AD_ILLEGAL_PARAMETER,
720	SSL_F_TLS_PARSE_CTOS_KEY_SHARE, SSL_R_BAD_ECPOINT);
721	return 0;
722	}
723
724	found = 1;
725	}
726	#endif
727
728	return 1;
729	}
730
731	int tls_parse_ctos_cookie(SSL s, PACKET pkt, unsigned int context, X509 *x,
732	size_t chainidx)
733	{
734	#ifndef OPENSSL_NO_TLS1_3
735	unsigned int format, version, key_share, group_id;
736	EVP_MD_CTX *hctx;
737	EVP_PKEY *pkey;
738	PACKET cookie, raw, chhash, appcookie;
739	WPACKET hrrpkt;
740	const unsigned char data, mdin, *ciphdata;
741	unsigned char hmac[SHA256_DIGEST_LENGTH];
742	unsigned char hrr[MAX_HRR_SIZE];
743	size_t rawlen, hmaclen, hrrlen, ciphlen;
744	unsigned long tm, now;
745
746	/* Ignore any cookie if we're not set up to verify it */
747	if (s->ctx->verify_stateless_cookie_cb == NULL
748	\|\| (s->s3->flags & TLS1_FLAGS_STATELESS) == 0)
749	return 1;
750
751	if (!PACKET_as_length_prefixed_2(pkt, &cookie)) {
752	SSLfatal(s, SSL_AD_DECODE_ERROR, SSL_F_TLS_PARSE_CTOS_COOKIE,
753	SSL_R_LENGTH_MISMATCH);
754	return 0;
755	}
756
757	raw = cookie;
758	data = PACKET_data(&raw);
759	rawlen = PACKET_remaining(&raw);
760	if (rawlen < SHA256_DIGEST_LENGTH
761	\|\| !PACKET_forward(&raw, rawlen - SHA256_DIGEST_LENGTH)) {
762	SSLfatal(s, SSL_AD_DECODE_ERROR, SSL_F_TLS_PARSE_CTOS_COOKIE,
763	SSL_R_LENGTH_MISMATCH);
764	return 0;
765	}
766	mdin = PACKET_data(&raw);
767
768	/* Verify the HMAC of the cookie */
769	hctx = EVP_MD_CTX_create();
770	pkey = EVP_PKEY_new_raw_private_key(EVP_PKEY_HMAC, NULL,
771	s->session_ctx->ext.cookie_hmac_key,
772	sizeof(s->session_ctx->ext
773	.cookie_hmac_key));
774	if (hctx == NULL \|\| pkey == NULL) {
775	EVP_MD_CTX_free(hctx);
776	EVP_PKEY_free(pkey);
777	SSLfatal(s, SSL_AD_INTERNAL_ERROR, SSL_F_TLS_PARSE_CTOS_COOKIE,
778	ERR_R_MALLOC_FAILURE);
779	return 0;
780	}
781
782	hmaclen = SHA256_DIGEST_LENGTH;
783	if (EVP_DigestSignInit(hctx, NULL, EVP_sha256(), NULL, pkey) <= 0
784	\|\| EVP_DigestSign(hctx, hmac, &hmaclen, data,
785	rawlen - SHA256_DIGEST_LENGTH) <= 0
786	\|\| hmaclen != SHA256_DIGEST_LENGTH) {
787	EVP_MD_CTX_free(hctx);
788	EVP_PKEY_free(pkey);
789	SSLfatal(s, SSL_AD_INTERNAL_ERROR, SSL_F_TLS_PARSE_CTOS_COOKIE,
790	ERR_R_INTERNAL_ERROR);
791	return 0;
792	}
793
794	EVP_MD_CTX_free(hctx);
795	EVP_PKEY_free(pkey);
796
797	if (CRYPTO_memcmp(hmac, mdin, SHA256_DIGEST_LENGTH) != 0) {
798	SSLfatal(s, SSL_AD_ILLEGAL_PARAMETER, SSL_F_TLS_PARSE_CTOS_COOKIE,
799	SSL_R_COOKIE_MISMATCH);
800	return 0;
801	}
802
803	if (!PACKET_get_net_2(&cookie, &format)) {
804	SSLfatal(s, SSL_AD_DECODE_ERROR, SSL_F_TLS_PARSE_CTOS_COOKIE,
805	SSL_R_LENGTH_MISMATCH);
806	return 0;
807	}
808	/* Check the cookie format is something we recognise. Ignore it if not */
809	if (format != COOKIE_STATE_FORMAT_VERSION)
810	return 1;
811
812	/*
813	* The rest of these checks really shouldn't fail since we have verified the
814	* HMAC above.
815	*/
816
817	/* Check the version number is sane */
818	if (!PACKET_get_net_2(&cookie, &version)) {
819	SSLfatal(s, SSL_AD_DECODE_ERROR, SSL_F_TLS_PARSE_CTOS_COOKIE,
820	SSL_R_LENGTH_MISMATCH);
821	return 0;
822	}
823	if (version != TLS1_3_VERSION) {
824	SSLfatal(s, SSL_AD_ILLEGAL_PARAMETER, SSL_F_TLS_PARSE_CTOS_COOKIE,
825	SSL_R_BAD_PROTOCOL_VERSION_NUMBER);
826	return 0;
827	}
828
829	if (!PACKET_get_net_2(&cookie, &group_id)) {
830	SSLfatal(s, SSL_AD_DECODE_ERROR, SSL_F_TLS_PARSE_CTOS_COOKIE,
831	SSL_R_LENGTH_MISMATCH);
832	return 0;
833	}
834
835	ciphdata = PACKET_data(&cookie);
836	if (!PACKET_forward(&cookie, 2)) {
837	SSLfatal(s, SSL_AD_DECODE_ERROR, SSL_F_TLS_PARSE_CTOS_COOKIE,
838	SSL_R_LENGTH_MISMATCH);
839	return 0;
840	}
841	if (group_id != s->s3->group_id
842	\|\| s->s3->tmp.new_cipher
843	!= ssl_get_cipher_by_char(s, ciphdata, 0)) {
844	/*
845	* We chose a different cipher or group id this time around to what is
846	* in the cookie. Something must have changed.
847	*/
848	SSLfatal(s, SSL_AD_ILLEGAL_PARAMETER, SSL_F_TLS_PARSE_CTOS_COOKIE,
849	SSL_R_BAD_CIPHER);
850	return 0;
851	}
852
853	if (!PACKET_get_1(&cookie, &key_share)
854	\|\| !PACKET_get_net_4(&cookie, &tm)
855	\|\| !PACKET_get_length_prefixed_2(&cookie, &chhash)
856	\|\| !PACKET_get_length_prefixed_1(&cookie, &appcookie)
857	\|\| PACKET_remaining(&cookie) != SHA256_DIGEST_LENGTH) {
858	SSLfatal(s, SSL_AD_DECODE_ERROR, SSL_F_TLS_PARSE_CTOS_COOKIE,
859	SSL_R_LENGTH_MISMATCH);
860	return 0;
861	}
862
863	/* We tolerate a cookie age of up to 10 minutes (= 60 * 10 seconds) */
864	now = (unsigned long)time(NULL);
865	if (tm > now \|\| (now - tm) > 600) {
866	/* Cookie is stale. Ignore it */
867	return 1;
868	}
869
870	/* Verify the app cookie */
871	if (s->ctx->verify_stateless_cookie_cb(s, PACKET_data(&appcookie),
872	PACKET_remaining(&appcookie)) == 0) {
873	SSLfatal(s, SSL_AD_ILLEGAL_PARAMETER, SSL_F_TLS_PARSE_CTOS_COOKIE,
874	SSL_R_COOKIE_MISMATCH);
875	return 0;
876	}
877
878	/*
879	* Reconstruct the HRR that we would have sent in response to the original
880	* ClientHello so we can add it to the transcript hash.
881	* Note: This won't work with custom HRR extensions
882	*/
883	if (!WPACKET_init_static_len(&hrrpkt, hrr, sizeof(hrr), 0)) {
884	SSLfatal(s, SSL_AD_INTERNAL_ERROR, SSL_F_TLS_PARSE_CTOS_COOKIE,
885	ERR_R_INTERNAL_ERROR);
886	return 0;
887	}
888	if (!WPACKET_put_bytes_u8(&hrrpkt, SSL3_MT_SERVER_HELLO)
889	\|\| !WPACKET_start_sub_packet_u24(&hrrpkt)
890	\|\| !WPACKET_put_bytes_u16(&hrrpkt, TLS1_2_VERSION)
891	\|\| !WPACKET_memcpy(&hrrpkt, hrrrandom, SSL3_RANDOM_SIZE)
892	\|\| !WPACKET_sub_memcpy_u8(&hrrpkt, s->tmp_session_id,
893	s->tmp_session_id_len)
894	\|\| !s->method->put_cipher_by_char(s->s3->tmp.new_cipher, &hrrpkt,
895	&ciphlen)
896	\|\| !WPACKET_put_bytes_u8(&hrrpkt, 0)
897	\|\| !WPACKET_start_sub_packet_u16(&hrrpkt)) {
898	WPACKET_cleanup(&hrrpkt);
899	SSLfatal(s, SSL_AD_INTERNAL_ERROR, SSL_F_TLS_PARSE_CTOS_COOKIE,
900	ERR_R_INTERNAL_ERROR);
901	return 0;
902	}
903	if (!WPACKET_put_bytes_u16(&hrrpkt, TLSEXT_TYPE_supported_versions)
904	\|\| !WPACKET_start_sub_packet_u16(&hrrpkt)
905	\|\| !WPACKET_put_bytes_u16(&hrrpkt, s->version)
906	\|\| !WPACKET_close(&hrrpkt)) {
907	WPACKET_cleanup(&hrrpkt);
908	SSLfatal(s, SSL_AD_INTERNAL_ERROR, SSL_F_TLS_PARSE_CTOS_COOKIE,
909	ERR_R_INTERNAL_ERROR);
910	return 0;
911	}
912	if (key_share) {
913	if (!WPACKET_put_bytes_u16(&hrrpkt, TLSEXT_TYPE_key_share)
914	\|\| !WPACKET_start_sub_packet_u16(&hrrpkt)
915	\|\| !WPACKET_put_bytes_u16(&hrrpkt, s->s3->group_id)
916	\|\| !WPACKET_close(&hrrpkt)) {
917	WPACKET_cleanup(&hrrpkt);
918	SSLfatal(s, SSL_AD_INTERNAL_ERROR, SSL_F_TLS_PARSE_CTOS_COOKIE,
919	ERR_R_INTERNAL_ERROR);
920	return 0;
921	}
922	}
923	if (!WPACKET_put_bytes_u16(&hrrpkt, TLSEXT_TYPE_cookie)
924	\|\| !WPACKET_start_sub_packet_u16(&hrrpkt)
925	\|\| !WPACKET_sub_memcpy_u16(&hrrpkt, data, rawlen)
926	\|\| !WPACKET_close(&hrrpkt) /* cookie extension */
927	\|\| !WPACKET_close(&hrrpkt) /* extension block */
928	\|\| !WPACKET_close(&hrrpkt) /* message */
929	\|\| !WPACKET_get_total_written(&hrrpkt, &hrrlen)
930	\|\| !WPACKET_finish(&hrrpkt)) {
931	WPACKET_cleanup(&hrrpkt);
932	SSLfatal(s, SSL_AD_INTERNAL_ERROR, SSL_F_TLS_PARSE_CTOS_COOKIE,
933	ERR_R_INTERNAL_ERROR);
934	return 0;
935	}
936
937	/* Reconstruct the transcript hash */
938	if (!create_synthetic_message_hash(s, PACKET_data(&chhash),
939	PACKET_remaining(&chhash), hrr,
940	hrrlen)) {
941	/* SSLfatal() already called */
942	return 0;
943	}
944
945	/* Act as if this ClientHello came after a HelloRetryRequest */
946	s->hello_retry_request = 1;
947
948	s->ext.cookieok = 1;
949	#endif
950
951	return 1;
952	}
953
954	#ifndef OPENSSL_NO_EC
955	int tls_parse_ctos_supported_groups(SSL s, PACKET pkt, unsigned int context,
956	X509 *x, size_t chainidx)
957	{
958	PACKET supported_groups_list;
959
960	/* Each group is 2 bytes and we must have at least 1. */
961	if (!PACKET_as_length_prefixed_2(pkt, &supported_groups_list)
962	\|\| PACKET_remaining(&supported_groups_list) == 0
963	\|\| (PACKET_remaining(&supported_groups_list) % 2) != 0) {
964	SSLfatal(s, SSL_AD_DECODE_ERROR,
965	SSL_F_TLS_PARSE_CTOS_SUPPORTED_GROUPS, SSL_R_BAD_EXTENSION);
966	return 0;
967	}
968
969	if (!s->hit \|\| SSL_IS_TLS13(s)) {
970	OPENSSL_free(s->ext.peer_supportedgroups);
971	s->ext.peer_supportedgroups = NULL;
972	s->ext.peer_supportedgroups_len = 0;
973	if (!tls1_save_u16(&supported_groups_list,
974	&s->ext.peer_supportedgroups,
975	&s->ext.peer_supportedgroups_len)) {
976	SSLfatal(s, SSL_AD_INTERNAL_ERROR,
977	SSL_F_TLS_PARSE_CTOS_SUPPORTED_GROUPS,
978	ERR_R_INTERNAL_ERROR);
979	return 0;
980	}
981	}
982
983	return 1;
984	}
985	#endif
986
987	int tls_parse_ctos_ems(SSL s, PACKET pkt, unsigned int context, X509 *x,
988	size_t chainidx)
989	{
990	/* The extension must always be empty */
991	if (PACKET_remaining(pkt) != 0) {
992	SSLfatal(s, SSL_AD_DECODE_ERROR,
993	SSL_F_TLS_PARSE_CTOS_EMS, SSL_R_BAD_EXTENSION);
994	return 0;
995	}
996
997	s->s3->flags \|= TLS1_FLAGS_RECEIVED_EXTMS;
998
999	return 1;
1000	}
1001
1002
1003	int tls_parse_ctos_early_data(SSL s, PACKET pkt, unsigned int context,
1004	X509 *x, size_t chainidx)
1005	{
1006	if (PACKET_remaining(pkt) != 0) {
1007	SSLfatal(s, SSL_AD_DECODE_ERROR,
1008	SSL_F_TLS_PARSE_CTOS_EARLY_DATA, SSL_R_BAD_EXTENSION);
1009	return 0;
1010	}
1011
1012	if (s->hello_retry_request != SSL_HRR_NONE) {
1013	SSLfatal(s, SSL_AD_ILLEGAL_PARAMETER,
1014	SSL_F_TLS_PARSE_CTOS_EARLY_DATA, SSL_R_BAD_EXTENSION);
1015	return 0;
1016	}
1017
1018	return 1;
1019	}
1020
1021	static SSL_TICKET_STATUS tls_get_stateful_ticket(SSL s, PACKET tick,
1022	SSL_SESSION **sess)
1023	{
1024	SSL_SESSION *tmpsess = NULL;
1025
1026	s->ext.ticket_expected = 1;
1027
1028	switch (PACKET_remaining(tick)) {
1029	case 0:
1030	return SSL_TICKET_EMPTY;
1031
1032	case SSL_MAX_SSL_SESSION_ID_LENGTH:
1033	break;
1034
1035	default:
1036	return SSL_TICKET_NO_DECRYPT;
1037	}
1038
1039	tmpsess = lookup_sess_in_cache(s, PACKET_data(tick),
1040	SSL_MAX_SSL_SESSION_ID_LENGTH);
1041
1042	if (tmpsess == NULL)
1043	return SSL_TICKET_NO_DECRYPT;
1044
1045	*sess = tmpsess;
1046	return SSL_TICKET_SUCCESS;
1047	}
1048
1049	int tls_parse_ctos_psk(SSL s, PACKET pkt, unsigned int context, X509 *x,
1050	size_t chainidx)
1051	{
1052	PACKET identities, binders, binder;
1053	size_t binderoffset, hashsize;
1054	SSL_SESSION *sess = NULL;
1055	unsigned int id, i, ext = 0;
1056	const EVP_MD *md = NULL;
1057
1058	/*
1059	* If we have no PSK kex mode that we recognise then we can't resume so
1060	* ignore this extension
1061	*/
1062	if ((s->ext.psk_kex_mode
1063	& (TLSEXT_KEX_MODE_FLAG_KE \| TLSEXT_KEX_MODE_FLAG_KE_DHE)) == 0)
1064	return 1;
1065
1066	if (!PACKET_get_length_prefixed_2(pkt, &identities)) {
1067	SSLfatal(s, SSL_AD_DECODE_ERROR,
1068	SSL_F_TLS_PARSE_CTOS_PSK, SSL_R_BAD_EXTENSION);
1069	return 0;
1070	}
1071
1072	s->ext.ticket_expected = 0;
1073	for (id = 0; PACKET_remaining(&identities) != 0; id++) {
1074	PACKET identity;
1075	unsigned long ticket_agel;
1076	size_t idlen;
1077
1078	if (!PACKET_get_length_prefixed_2(&identities, &identity)
1079	\|\| !PACKET_get_net_4(&identities, &ticket_agel)) {
1080	SSLfatal(s, SSL_AD_DECODE_ERROR,
1081	SSL_F_TLS_PARSE_CTOS_PSK, SSL_R_BAD_EXTENSION);
1082	return 0;
1083	}
1084
1085	idlen = PACKET_remaining(&identity);
1086	if (s->psk_find_session_cb != NULL
1087	&& !s->psk_find_session_cb(s, PACKET_data(&identity), idlen,
1088	&sess)) {
1089	SSLfatal(s, SSL_AD_INTERNAL_ERROR,
1090	SSL_F_TLS_PARSE_CTOS_PSK, SSL_R_BAD_EXTENSION);
1091	return 0;
1092	}
1093
1094	#ifndef OPENSSL_NO_PSK
1095	if(sess == NULL
1096	&& s->psk_server_callback != NULL
1097	&& idlen <= PSK_MAX_IDENTITY_LEN) {
1098	char *pskid = NULL;
1099	unsigned char pskdata[PSK_MAX_PSK_LEN];
1100	unsigned int pskdatalen;
1101
1102	if (!PACKET_strndup(&identity, &pskid)) {
1103	SSLfatal(s, SSL_AD_INTERNAL_ERROR, SSL_F_TLS_PARSE_CTOS_PSK,
1104	ERR_R_INTERNAL_ERROR);
1105	return 0;
1106	}
1107	pskdatalen = s->psk_server_callback(s, pskid, pskdata,
1108	sizeof(pskdata));
1109	OPENSSL_free(pskid);
1110	if (pskdatalen > PSK_MAX_PSK_LEN) {
1111	SSLfatal(s, SSL_AD_INTERNAL_ERROR, SSL_F_TLS_PARSE_CTOS_PSK,
1112	ERR_R_INTERNAL_ERROR);
1113	return 0;
1114	} else if (pskdatalen > 0) {
1115	const SSL_CIPHER *cipher;
1116	const unsigned char tls13_aes128gcmsha256_id[] = { 0x13, 0x01 };
1117
1118	/*
1119	* We found a PSK using an old style callback. We don't know
1120	* the digest so we default to SHA256 as per the TLSv1.3 spec
1121	*/
1122	cipher = SSL_CIPHER_find(s, tls13_aes128gcmsha256_id);
1123	if (cipher == NULL) {
1124	OPENSSL_cleanse(pskdata, pskdatalen);
1125	SSLfatal(s, SSL_AD_INTERNAL_ERROR, SSL_F_TLS_PARSE_CTOS_PSK,
1126	ERR_R_INTERNAL_ERROR);
1127	return 0;
1128	}
1129
1130	sess = SSL_SESSION_new();
1131	if (sess == NULL
1132	\|\| !SSL_SESSION_set1_master_key(sess, pskdata,
1133	pskdatalen)
1134	\|\| !SSL_SESSION_set_cipher(sess, cipher)
1135	\|\| !SSL_SESSION_set_protocol_version(sess,
1136	TLS1_3_VERSION)) {
1137	OPENSSL_cleanse(pskdata, pskdatalen);
1138	SSLfatal(s, SSL_AD_INTERNAL_ERROR, SSL_F_TLS_PARSE_CTOS_PSK,
1139	ERR_R_INTERNAL_ERROR);
1140	goto err;
1141	}
1142	OPENSSL_cleanse(pskdata, pskdatalen);
1143	}
1144	}
1145	#endif /* OPENSSL_NO_PSK */
1146
1147	if (sess != NULL) {
1148	/* We found a PSK */
1149	SSL_SESSION *sesstmp = ssl_session_dup(sess, 0);
1150
1151	if (sesstmp == NULL) {
1152	SSLfatal(s, SSL_AD_INTERNAL_ERROR,
1153	SSL_F_TLS_PARSE_CTOS_PSK, ERR_R_INTERNAL_ERROR);
1154	goto err;
1155	}
1156	SSL_SESSION_free(sess);
1157	sess = sesstmp;
1158
1159	/*
1160	* We've just been told to use this session for this context so
1161	* make sure the sid_ctx matches up.
1162	*/
1163	memcpy(sess->sid_ctx, s->sid_ctx, s->sid_ctx_length);
1164	sess->sid_ctx_length = s->sid_ctx_length;
1165	ext = 1;
1166	if (id == 0)
1167	s->ext.early_data_ok = 1;
1168	s->ext.ticket_expected = 1;
1169	} else {
1170	uint32_t ticket_age = 0, now, agesec, agems;
1171	int ret;
1172
1173	/*
1174	* If we are using anti-replay protection then we behave as if
1175	* SSL_OP_NO_TICKET is set - we are caching tickets anyway so there
1176	* is no point in using full stateless tickets.
1177	*/
1178	if ((s->options & SSL_OP_NO_TICKET) != 0
1179	\|\| (s->max_early_data > 0
1180	&& (s->options & SSL_OP_NO_ANTI_REPLAY) == 0))
1181	ret = tls_get_stateful_ticket(s, &identity, &sess);
1182	else
1183	ret = tls_decrypt_ticket(s, PACKET_data(&identity),
1184	PACKET_remaining(&identity), NULL, 0,
1185	&sess);
1186
1187	if (ret == SSL_TICKET_EMPTY) {
1188	SSLfatal(s, SSL_AD_DECODE_ERROR, SSL_F_TLS_PARSE_CTOS_PSK,
1189	SSL_R_BAD_EXTENSION);
1190	return 0;
1191	}
1192
1193	if (ret == SSL_TICKET_FATAL_ERR_MALLOC
1194	\|\| ret == SSL_TICKET_FATAL_ERR_OTHER) {
1195	SSLfatal(s, SSL_AD_INTERNAL_ERROR,
1196	SSL_F_TLS_PARSE_CTOS_PSK, ERR_R_INTERNAL_ERROR);
1197	return 0;
1198	}
1199	if (ret == SSL_TICKET_NONE \|\| ret == SSL_TICKET_NO_DECRYPT)
1200	continue;
1201
1202	/* Check for replay */
1203	if (s->max_early_data > 0
1204	&& (s->options & SSL_OP_NO_ANTI_REPLAY) == 0
1205	&& !SSL_CTX_remove_session(s->session_ctx, sess)) {
1206	SSL_SESSION_free(sess);
1207	sess = NULL;
1208	continue;
1209	}
1210
1211	ticket_age = (uint32_t)ticket_agel;
1212	now = (uint32_t)time(NULL);
1213	agesec = now - (uint32_t)sess->time;
1214	agems = agesec * (uint32_t)1000;
1215	ticket_age -= sess->ext.tick_age_add;
1216
1217	/*
1218	* For simplicity we do our age calculations in seconds. If the
1219	* client does it in ms then it could appear that their ticket age
1220	* is longer than ours (our ticket age calculation should always be
1221	* slightly longer than the client's due to the network latency).
1222	* Therefore we add 1000ms to our age calculation to adjust for
1223	* rounding errors.
1224	*/
1225	if (id == 0
1226	&& sess->timeout >= (long)agesec
1227	&& agems / (uint32_t)1000 == agesec
1228	&& ticket_age <= agems + 1000
1229	&& ticket_age + TICKET_AGE_ALLOWANCE >= agems + 1000) {
1230	/*
1231	* Ticket age is within tolerance and not expired. We allow it
1232	* for early data
1233	*/
1234	s->ext.early_data_ok = 1;
1235	}
1236	}
1237
1238	md = ssl_md(sess->cipher->algorithm2);
1239	if (md != ssl_md(s->s3->tmp.new_cipher->algorithm2)) {
1240	/* The ciphersuite is not compatible with this session. */
1241	SSL_SESSION_free(sess);
1242	sess = NULL;
1243	s->ext.early_data_ok = 0;
1244	s->ext.ticket_expected = 0;
1245	continue;
1246	}
1247	break;
1248	}
1249
1250	if (sess == NULL)
1251	return 1;
1252
1253	binderoffset = PACKET_data(pkt) - (const unsigned char *)s->init_buf->data;
1254	hashsize = EVP_MD_size(md);
1255
1256	if (!PACKET_get_length_prefixed_2(pkt, &binders)) {
1257	SSLfatal(s, SSL_AD_DECODE_ERROR, SSL_F_TLS_PARSE_CTOS_PSK,
1258	SSL_R_BAD_EXTENSION);
1259	goto err;
1260	}
1261
1262	for (i = 0; i <= id; i++) {
1263	if (!PACKET_get_length_prefixed_1(&binders, &binder)) {
1264	SSLfatal(s, SSL_AD_DECODE_ERROR, SSL_F_TLS_PARSE_CTOS_PSK,
1265	SSL_R_BAD_EXTENSION);
1266	goto err;
1267	}
1268	}
1269
1270	if (PACKET_remaining(&binder) != hashsize) {
1271	SSLfatal(s, SSL_AD_DECODE_ERROR, SSL_F_TLS_PARSE_CTOS_PSK,
1272	SSL_R_BAD_EXTENSION);
1273	goto err;
1274	}
1275	if (tls_psk_do_binder(s, md, (const unsigned char *)s->init_buf->data,
1276	binderoffset, PACKET_data(&binder), NULL, sess, 0,
1277	ext) != 1) {
1278	/* SSLfatal() already called */
1279	goto err;
1280	}
1281
1282	s->ext.tick_identity = id;
1283
1284	SSL_SESSION_free(s->session);
1285	s->session = sess;
1286	return 1;
1287	err:
1288	SSL_SESSION_free(sess);
1289	return 0;
1290	}
1291
1292	int tls_parse_ctos_post_handshake_auth(SSL s, PACKET pkt, unsigned int context,
1293	X509 *x, size_t chainidx)
1294	{
1295	if (PACKET_remaining(pkt) != 0) {
1296	SSLfatal(s, SSL_AD_DECODE_ERROR, SSL_F_TLS_PARSE_CTOS_POST_HANDSHAKE_AUTH,
1297	SSL_R_POST_HANDSHAKE_AUTH_ENCODING_ERR);
1298	return 0;
1299	}
1300
1301	s->post_handshake_auth = SSL_PHA_EXT_RECEIVED;
1302
1303	return 1;
1304	}
1305
1306	/*
1307	* Add the server's renegotiation binding
1308	*/
1309	EXT_RETURN tls_construct_stoc_renegotiate(SSL s, WPACKET pkt,
1310	unsigned int context, X509 *x,
1311	size_t chainidx)
1312	{
1313	if (!s->s3->send_connection_binding)
1314	return EXT_RETURN_NOT_SENT;
1315
1316	/* Still add this even if SSL_OP_NO_RENEGOTIATION is set */
1317	if (!WPACKET_put_bytes_u16(pkt, TLSEXT_TYPE_renegotiate)
1318	\|\| !WPACKET_start_sub_packet_u16(pkt)
1319	\|\| !WPACKET_start_sub_packet_u8(pkt)
1320	\|\| !WPACKET_memcpy(pkt, s->s3->previous_client_finished,
1321	s->s3->previous_client_finished_len)
1322	\|\| !WPACKET_memcpy(pkt, s->s3->previous_server_finished,
1323	s->s3->previous_server_finished_len)
1324	\|\| !WPACKET_close(pkt)
1325	\|\| !WPACKET_close(pkt)) {
1326	SSLfatal(s, SSL_AD_INTERNAL_ERROR, SSL_F_TLS_CONSTRUCT_STOC_RENEGOTIATE,
1327	ERR_R_INTERNAL_ERROR);
1328	return EXT_RETURN_FAIL;
1329	}
1330
1331	return EXT_RETURN_SENT;
1332	}
1333
1334	EXT_RETURN tls_construct_stoc_server_name(SSL s, WPACKET pkt,
1335	unsigned int context, X509 *x,
1336	size_t chainidx)
1337	{
1338	if (s->servername_done != 1)
1339	return EXT_RETURN_NOT_SENT;
1340
1341	/*
1342	* Prior to TLSv1.3 we ignore any SNI in the current handshake if resuming.
1343	* We just use the servername from the initial handshake.
1344	*/
1345	if (s->hit && !SSL_IS_TLS13(s))
1346	return EXT_RETURN_NOT_SENT;
1347
1348	if (!WPACKET_put_bytes_u16(pkt, TLSEXT_TYPE_server_name)
1349	\|\| !WPACKET_put_bytes_u16(pkt, 0)) {
1350	SSLfatal(s, SSL_AD_INTERNAL_ERROR, SSL_F_TLS_CONSTRUCT_STOC_SERVER_NAME,
1351	ERR_R_INTERNAL_ERROR);
1352	return EXT_RETURN_FAIL;
1353	}
1354
1355	return EXT_RETURN_SENT;
1356	}
1357
1358	/* Add/include the server's max fragment len extension into ServerHello */
1359	EXT_RETURN tls_construct_stoc_maxfragmentlen(SSL s, WPACKET pkt,
1360	unsigned int context, X509 *x,
1361	size_t chainidx)
1362	{
1363	if (!USE_MAX_FRAGMENT_LENGTH_EXT(s->session))
1364	return EXT_RETURN_NOT_SENT;
1365
1366	/*-
1367	* 4 bytes for this extension type and extension length
1368	* 1 byte for the Max Fragment Length code value.
1369	*/
1370	if (!WPACKET_put_bytes_u16(pkt, TLSEXT_TYPE_max_fragment_length)
1371	\|\| !WPACKET_start_sub_packet_u16(pkt)
1372	\|\| !WPACKET_put_bytes_u8(pkt, s->session->ext.max_fragment_len_mode)
1373	\|\| !WPACKET_close(pkt)) {
1374	SSLfatal(s, SSL_AD_INTERNAL_ERROR,
1375	SSL_F_TLS_CONSTRUCT_STOC_MAXFRAGMENTLEN, ERR_R_INTERNAL_ERROR);
1376	return EXT_RETURN_FAIL;
1377	}
1378
1379	return EXT_RETURN_SENT;
1380	}
1381
1382	#ifndef OPENSSL_NO_EC
1383	EXT_RETURN tls_construct_stoc_ec_pt_formats(SSL s, WPACKET pkt,
1384	unsigned int context, X509 *x,
1385	size_t chainidx)
1386	{
1387	unsigned long alg_k = s->s3->tmp.new_cipher->algorithm_mkey;
1388	unsigned long alg_a = s->s3->tmp.new_cipher->algorithm_auth;
1389	int using_ecc = ((alg_k & SSL_kECDHE) \|\| (alg_a & SSL_aECDSA))
1390	&& (s->ext.peer_ecpointformats != NULL);
1391	const unsigned char *plist;
1392	size_t plistlen;
1393
1394	if (!using_ecc)
1395	return EXT_RETURN_NOT_SENT;
1396
1397	tls1_get_formatlist(s, &plist, &plistlen);
1398	if (!WPACKET_put_bytes_u16(pkt, TLSEXT_TYPE_ec_point_formats)
1399	\|\| !WPACKET_start_sub_packet_u16(pkt)
1400	\|\| !WPACKET_sub_memcpy_u8(pkt, plist, plistlen)
1401	\|\| !WPACKET_close(pkt)) {
1402	SSLfatal(s, SSL_AD_INTERNAL_ERROR,
1403	SSL_F_TLS_CONSTRUCT_STOC_EC_PT_FORMATS, ERR_R_INTERNAL_ERROR);
1404	return EXT_RETURN_FAIL;
1405	}
1406
1407	return EXT_RETURN_SENT;
1408	}
1409	#endif
1410
1411	#ifndef OPENSSL_NO_EC
1412	EXT_RETURN tls_construct_stoc_supported_groups(SSL s, WPACKET pkt,
1413	unsigned int context, X509 *x,
1414	size_t chainidx)
1415	{
1416	const uint16_t *groups;
1417	size_t numgroups, i, first = 1;
1418
1419	/* s->s3->group_id is non zero if we accepted a key_share */
1420	if (s->s3->group_id == 0)
1421	return EXT_RETURN_NOT_SENT;
1422
1423	/* Get our list of supported groups */
1424	tls1_get_supported_groups(s, &groups, &numgroups);
1425	if (numgroups == 0) {
1426	SSLfatal(s, SSL_AD_INTERNAL_ERROR,
1427	SSL_F_TLS_CONSTRUCT_STOC_SUPPORTED_GROUPS, ERR_R_INTERNAL_ERROR);
1428	return EXT_RETURN_FAIL;
1429	}
1430
1431	/* Copy group ID if supported */
1432	for (i = 0; i < numgroups; i++) {
1433	uint16_t group = groups[i];
1434
1435	if (tls_curve_allowed(s, group, SSL_SECOP_CURVE_SUPPORTED)) {
1436	if (first) {
1437	/*
1438	* Check if the client is already using our preferred group. If
1439	* so we don't need to add this extension
1440	*/
1441	if (s->s3->group_id == group)
1442	return EXT_RETURN_NOT_SENT;
1443
1444	/* Add extension header */
1445	if (!WPACKET_put_bytes_u16(pkt, TLSEXT_TYPE_supported_groups)
1446	/* Sub-packet for supported_groups extension */
1447	\|\| !WPACKET_start_sub_packet_u16(pkt)
1448	\|\| !WPACKET_start_sub_packet_u16(pkt)) {
1449	SSLfatal(s, SSL_AD_INTERNAL_ERROR,
1450	SSL_F_TLS_CONSTRUCT_STOC_SUPPORTED_GROUPS,
1451	ERR_R_INTERNAL_ERROR);
1452	return EXT_RETURN_FAIL;
1453	}
1454
1455	first = 0;
1456	}
1457	if (!WPACKET_put_bytes_u16(pkt, group)) {
1458	SSLfatal(s, SSL_AD_INTERNAL_ERROR,
1459	SSL_F_TLS_CONSTRUCT_STOC_SUPPORTED_GROUPS,
1460	ERR_R_INTERNAL_ERROR);
1461	return EXT_RETURN_FAIL;
1462	}
1463	}
1464	}
1465
1466	if (!WPACKET_close(pkt) \|\| !WPACKET_close(pkt)) {
1467	SSLfatal(s, SSL_AD_INTERNAL_ERROR,
1468	SSL_F_TLS_CONSTRUCT_STOC_SUPPORTED_GROUPS,
1469	ERR_R_INTERNAL_ERROR);
1470	return EXT_RETURN_FAIL;
1471	}
1472
1473	return EXT_RETURN_SENT;
1474	}
1475	#endif
1476
1477	EXT_RETURN tls_construct_stoc_session_ticket(SSL s, WPACKET pkt,
1478	unsigned int context, X509 *x,
1479	size_t chainidx)
1480	{
1481	if (!s->ext.ticket_expected \|\| !tls_use_ticket(s)) {
1482	s->ext.ticket_expected = 0;
1483	return EXT_RETURN_NOT_SENT;
1484	}
1485
1486	if (!WPACKET_put_bytes_u16(pkt, TLSEXT_TYPE_session_ticket)
1487	\|\| !WPACKET_put_bytes_u16(pkt, 0)) {
1488	SSLfatal(s, SSL_AD_INTERNAL_ERROR,
1489	SSL_F_TLS_CONSTRUCT_STOC_SESSION_TICKET, ERR_R_INTERNAL_ERROR);
1490	return EXT_RETURN_FAIL;
1491	}
1492
1493	return EXT_RETURN_SENT;
1494	}
1495
1496	#ifndef OPENSSL_NO_OCSP
1497	EXT_RETURN tls_construct_stoc_status_request(SSL s, WPACKET pkt,
1498	unsigned int context, X509 *x,
1499	size_t chainidx)
1500	{
1501	/* We don't currently support this extension inside a CertificateRequest */
1502	if (context == SSL_EXT_TLS1_3_CERTIFICATE_REQUEST)
1503	return EXT_RETURN_NOT_SENT;
1504
1505	if (!s->ext.status_expected)
1506	return EXT_RETURN_NOT_SENT;
1507
1508	if (SSL_IS_TLS13(s) && chainidx != 0)
1509	return EXT_RETURN_NOT_SENT;
1510
1511	if (!WPACKET_put_bytes_u16(pkt, TLSEXT_TYPE_status_request)
1512	\|\| !WPACKET_start_sub_packet_u16(pkt)) {
1513	SSLfatal(s, SSL_AD_INTERNAL_ERROR,
1514	SSL_F_TLS_CONSTRUCT_STOC_STATUS_REQUEST, ERR_R_INTERNAL_ERROR);
1515	return EXT_RETURN_FAIL;
1516	}
1517
1518	/*
1519	* In TLSv1.3 we include the certificate status itself. In <= TLSv1.2 we
1520	* send back an empty extension, with the certificate status appearing as a
1521	* separate message
1522	*/
1523	if (SSL_IS_TLS13(s) && !tls_construct_cert_status_body(s, pkt)) {
1524	/* SSLfatal() already called */
1525	return EXT_RETURN_FAIL;
1526	}
1527	if (!WPACKET_close(pkt)) {
1528	SSLfatal(s, SSL_AD_INTERNAL_ERROR,
1529	SSL_F_TLS_CONSTRUCT_STOC_STATUS_REQUEST, ERR_R_INTERNAL_ERROR);
1530	return EXT_RETURN_FAIL;
1531	}
1532
1533	return EXT_RETURN_SENT;
1534	}
1535	#endif
1536
1537	#ifndef OPENSSL_NO_NEXTPROTONEG
1538	EXT_RETURN tls_construct_stoc_next_proto_neg(SSL s, WPACKET pkt,
1539	unsigned int context, X509 *x,
1540	size_t chainidx)
1541	{
1542	const unsigned char *npa;
1543	unsigned int npalen;
1544	int ret;
1545	int npn_seen = s->s3->npn_seen;
1546
1547	s->s3->npn_seen = 0;
1548	if (!npn_seen \|\| s->ctx->ext.npn_advertised_cb == NULL)
1549	return EXT_RETURN_NOT_SENT;
1550
1551	ret = s->ctx->ext.npn_advertised_cb(s, &npa, &npalen,
1552	s->ctx->ext.npn_advertised_cb_arg);
1553	if (ret == SSL_TLSEXT_ERR_OK) {
1554	if (!WPACKET_put_bytes_u16(pkt, TLSEXT_TYPE_next_proto_neg)
1555	\|\| !WPACKET_sub_memcpy_u16(pkt, npa, npalen)) {
1556	SSLfatal(s, SSL_AD_INTERNAL_ERROR,
1557	SSL_F_TLS_CONSTRUCT_STOC_NEXT_PROTO_NEG,
1558	ERR_R_INTERNAL_ERROR);
1559	return EXT_RETURN_FAIL;
1560	}
1561	s->s3->npn_seen = 1;
1562	}
1563
1564	return EXT_RETURN_SENT;
1565	}
1566	#endif
1567
1568	EXT_RETURN tls_construct_stoc_alpn(SSL s, WPACKET pkt, unsigned int context,
1569	X509 *x, size_t chainidx)
1570	{
1571	if (s->s3->alpn_selected == NULL)
1572	return EXT_RETURN_NOT_SENT;
1573
1574	if (!WPACKET_put_bytes_u16(pkt,
1575	TLSEXT_TYPE_application_layer_protocol_negotiation)
1576	\|\| !WPACKET_start_sub_packet_u16(pkt)
1577	\|\| !WPACKET_start_sub_packet_u16(pkt)
1578	\|\| !WPACKET_sub_memcpy_u8(pkt, s->s3->alpn_selected,
1579	s->s3->alpn_selected_len)
1580	\|\| !WPACKET_close(pkt)
1581	\|\| !WPACKET_close(pkt)) {
1582	SSLfatal(s, SSL_AD_INTERNAL_ERROR,
1583	SSL_F_TLS_CONSTRUCT_STOC_ALPN, ERR_R_INTERNAL_ERROR);
1584	return EXT_RETURN_FAIL;
1585	}
1586
1587	return EXT_RETURN_SENT;
1588	}
1589
1590	#ifndef OPENSSL_NO_SRTP
1591	EXT_RETURN tls_construct_stoc_use_srtp(SSL s, WPACKET pkt,
1592	unsigned int context, X509 *x,
1593	size_t chainidx)
1594	{
1595	if (s->srtp_profile == NULL)
1596	return EXT_RETURN_NOT_SENT;
1597
1598	if (!WPACKET_put_bytes_u16(pkt, TLSEXT_TYPE_use_srtp)
1599	\|\| !WPACKET_start_sub_packet_u16(pkt)
1600	\|\| !WPACKET_put_bytes_u16(pkt, 2)
1601	\|\| !WPACKET_put_bytes_u16(pkt, s->srtp_profile->id)
1602	\|\| !WPACKET_put_bytes_u8(pkt, 0)
1603	\|\| !WPACKET_close(pkt)) {
1604	SSLfatal(s, SSL_AD_INTERNAL_ERROR, SSL_F_TLS_CONSTRUCT_STOC_USE_SRTP,
1605	ERR_R_INTERNAL_ERROR);
1606	return EXT_RETURN_FAIL;
1607	}
1608
1609	return EXT_RETURN_SENT;
1610	}
1611	#endif
1612
1613	EXT_RETURN tls_construct_stoc_etm(SSL s, WPACKET pkt, unsigned int context,
1614	X509 *x, size_t chainidx)
1615	{
1616	if (!s->ext.use_etm)
1617	return EXT_RETURN_NOT_SENT;
1618
1619	/*
1620	* Don't use encrypt_then_mac if AEAD or RC4 might want to disable
1621	* for other cases too.
1622	*/
1623	if (s->s3->tmp.new_cipher->algorithm_mac == SSL_AEAD
1624	\|\| s->s3->tmp.new_cipher->algorithm_enc == SSL_RC4
1625	\|\| s->s3->tmp.new_cipher->algorithm_enc == SSL_eGOST2814789CNT
1626	\|\| s->s3->tmp.new_cipher->algorithm_enc == SSL_eGOST2814789CNT12) {
1627	s->ext.use_etm = 0;
1628	return EXT_RETURN_NOT_SENT;
1629	}
1630
1631	if (!WPACKET_put_bytes_u16(pkt, TLSEXT_TYPE_encrypt_then_mac)
1632	\|\| !WPACKET_put_bytes_u16(pkt, 0)) {
1633	SSLfatal(s, SSL_AD_INTERNAL_ERROR, SSL_F_TLS_CONSTRUCT_STOC_ETM,
1634	ERR_R_INTERNAL_ERROR);
1635	return EXT_RETURN_FAIL;
1636	}
1637
1638	return EXT_RETURN_SENT;
1639	}
1640
1641	EXT_RETURN tls_construct_stoc_ems(SSL s, WPACKET pkt, unsigned int context,
1642	X509 *x, size_t chainidx)
1643	{
1644	if ((s->s3->flags & TLS1_FLAGS_RECEIVED_EXTMS) == 0)
1645	return EXT_RETURN_NOT_SENT;
1646
1647	if (!WPACKET_put_bytes_u16(pkt, TLSEXT_TYPE_extended_master_secret)
1648	\|\| !WPACKET_put_bytes_u16(pkt, 0)) {
1649	SSLfatal(s, SSL_AD_INTERNAL_ERROR, SSL_F_TLS_CONSTRUCT_STOC_EMS,
1650	ERR_R_INTERNAL_ERROR);
1651	return EXT_RETURN_FAIL;
1652	}
1653
1654	return EXT_RETURN_SENT;
1655	}
1656
1657	EXT_RETURN tls_construct_stoc_supported_versions(SSL s, WPACKET pkt,
1658	unsigned int context, X509 *x,
1659	size_t chainidx)
1660	{
1661	if (!ossl_assert(SSL_IS_TLS13(s))) {
1662	SSLfatal(s, SSL_AD_INTERNAL_ERROR,
1663	SSL_F_TLS_CONSTRUCT_STOC_SUPPORTED_VERSIONS,
1664	ERR_R_INTERNAL_ERROR);
1665	return EXT_RETURN_FAIL;
1666	}
1667
1668	if (!WPACKET_put_bytes_u16(pkt, TLSEXT_TYPE_supported_versions)
1669	\|\| !WPACKET_start_sub_packet_u16(pkt)
1670	\|\| !WPACKET_put_bytes_u16(pkt, s->version)
1671	\|\| !WPACKET_close(pkt)) {
1672	SSLfatal(s, SSL_AD_INTERNAL_ERROR,
1673	SSL_F_TLS_CONSTRUCT_STOC_SUPPORTED_VERSIONS,
1674	ERR_R_INTERNAL_ERROR);
1675	return EXT_RETURN_FAIL;
1676	}
1677
1678	return EXT_RETURN_SENT;
1679	}
1680
1681	EXT_RETURN tls_construct_stoc_key_share(SSL s, WPACKET pkt,
1682	unsigned int context, X509 *x,
1683	size_t chainidx)
1684	{
1685	#ifndef OPENSSL_NO_TLS1_3
1686	unsigned char *encodedPoint;
1687	size_t encoded_pt_len = 0;
1688	EVP_PKEY ckey = s->s3->peer_tmp, skey = NULL;
1689
1690	if (s->hello_retry_request == SSL_HRR_PENDING) {
1691	if (ckey != NULL) {
1692	/* Original key_share was acceptable so don't ask for another one */
1693	return EXT_RETURN_NOT_SENT;
1694	}
1695	if (!WPACKET_put_bytes_u16(pkt, TLSEXT_TYPE_key_share)
1696	\|\| !WPACKET_start_sub_packet_u16(pkt)
1697	\|\| !WPACKET_put_bytes_u16(pkt, s->s3->group_id)
1698	\|\| !WPACKET_close(pkt)) {
1699	SSLfatal(s, SSL_AD_INTERNAL_ERROR,
1700	SSL_F_TLS_CONSTRUCT_STOC_KEY_SHARE,
1701	ERR_R_INTERNAL_ERROR);
1702	return EXT_RETURN_FAIL;
1703	}
1704
1705	return EXT_RETURN_SENT;
1706	}
1707
1708	if (ckey == NULL) {
1709	/* No key_share received from client - must be resuming */
1710	if (!s->hit \|\| !tls13_generate_handshake_secret(s, NULL, 0)) {
1711	SSLfatal(s, SSL_AD_INTERNAL_ERROR,
1712	SSL_F_TLS_CONSTRUCT_STOC_KEY_SHARE, ERR_R_INTERNAL_ERROR);
1713	return EXT_RETURN_FAIL;
1714	}
1715	return EXT_RETURN_NOT_SENT;
1716	}
1717	if (s->hit && (s->ext.psk_kex_mode & TLSEXT_KEX_MODE_FLAG_KE_DHE) == 0) {
1718	/*
1719	* PSK ('hit') and explicitly not doing DHE (if the client sent the
1720	* DHE option we always take it); don't send key share.
1721	*/
1722	return EXT_RETURN_NOT_SENT;
1723	}
1724
1725	if (!WPACKET_put_bytes_u16(pkt, TLSEXT_TYPE_key_share)
1726	\|\| !WPACKET_start_sub_packet_u16(pkt)
1727	\|\| !WPACKET_put_bytes_u16(pkt, s->s3->group_id)) {
1728	SSLfatal(s, SSL_AD_INTERNAL_ERROR,
1729	SSL_F_TLS_CONSTRUCT_STOC_KEY_SHARE, ERR_R_INTERNAL_ERROR);
1730	return EXT_RETURN_FAIL;
1731	}
1732
1733	skey = ssl_generate_pkey(ckey);
1734	if (skey == NULL) {
1735	SSLfatal(s, SSL_AD_INTERNAL_ERROR, SSL_F_TLS_CONSTRUCT_STOC_KEY_SHARE,
1736	ERR_R_MALLOC_FAILURE);
1737	return EXT_RETURN_FAIL;
1738	}
1739
1740	/* Generate encoding of server key */
1741	encoded_pt_len = EVP_PKEY_get1_tls_encodedpoint(skey, &encodedPoint);
1742	if (encoded_pt_len == 0) {
1743	SSLfatal(s, SSL_AD_INTERNAL_ERROR, SSL_F_TLS_CONSTRUCT_STOC_KEY_SHARE,
1744	ERR_R_EC_LIB);
1745	EVP_PKEY_free(skey);
1746	return EXT_RETURN_FAIL;
1747	}
1748
1749	if (!WPACKET_sub_memcpy_u16(pkt, encodedPoint, encoded_pt_len)
1750	\|\| !WPACKET_close(pkt)) {
1751	SSLfatal(s, SSL_AD_INTERNAL_ERROR, SSL_F_TLS_CONSTRUCT_STOC_KEY_SHARE,
1752	ERR_R_INTERNAL_ERROR);
1753	EVP_PKEY_free(skey);
1754	OPENSSL_free(encodedPoint);
1755	return EXT_RETURN_FAIL;
1756	}
1757	OPENSSL_free(encodedPoint);
1758
1759	/* This causes the crypto state to be updated based on the derived keys */
1760	s->s3->tmp.pkey = skey;
1761	if (ssl_derive(s, skey, ckey, 1) == 0) {
1762	/* SSLfatal() already called */
1763	return EXT_RETURN_FAIL;
1764	}
1765	return EXT_RETURN_SENT;
1766	#else
1767	return EXT_RETURN_FAIL;
1768	#endif
1769	}
1770
1771	EXT_RETURN tls_construct_stoc_cookie(SSL s, WPACKET pkt, unsigned int context,
1772	X509 *x, size_t chainidx)
1773	{
1774	#ifndef OPENSSL_NO_TLS1_3
1775	unsigned char hashval1, hashval2, appcookie1, appcookie2, *cookie;
1776	unsigned char hmac, hmac2;
1777	size_t startlen, ciphlen, totcookielen, hashlen, hmaclen, appcookielen;
1778	EVP_MD_CTX *hctx;
1779	EVP_PKEY *pkey;
1780	int ret = EXT_RETURN_FAIL;
1781
1782	if ((s->s3->flags & TLS1_FLAGS_STATELESS) == 0)
1783	return EXT_RETURN_NOT_SENT;
1784
1785	if (s->ctx->gen_stateless_cookie_cb == NULL) {
1786	SSLfatal(s, SSL_AD_INTERNAL_ERROR, SSL_F_TLS_CONSTRUCT_STOC_COOKIE,
1787	SSL_R_NO_COOKIE_CALLBACK_SET);
1788	return EXT_RETURN_FAIL;
1789	}
1790
1791	if (!WPACKET_put_bytes_u16(pkt, TLSEXT_TYPE_cookie)
1792	\|\| !WPACKET_start_sub_packet_u16(pkt)
1793	\|\| !WPACKET_start_sub_packet_u16(pkt)
1794	\|\| !WPACKET_get_total_written(pkt, &startlen)
1795	\|\| !WPACKET_reserve_bytes(pkt, MAX_COOKIE_SIZE, &cookie)
1796	\|\| !WPACKET_put_bytes_u16(pkt, COOKIE_STATE_FORMAT_VERSION)
1797	\|\| !WPACKET_put_bytes_u16(pkt, TLS1_3_VERSION)
1798	\|\| !WPACKET_put_bytes_u16(pkt, s->s3->group_id)
1799	\|\| !s->method->put_cipher_by_char(s->s3->tmp.new_cipher, pkt,
1800	&ciphlen)
1801	/* Is there a key_share extension present in this HRR? */
1802	\|\| !WPACKET_put_bytes_u8(pkt, s->s3->peer_tmp == NULL)
1803	\|\| !WPACKET_put_bytes_u32(pkt, (unsigned int)time(NULL))
1804	\|\| !WPACKET_start_sub_packet_u16(pkt)
1805	\|\| !WPACKET_reserve_bytes(pkt, EVP_MAX_MD_SIZE, &hashval1)) {
1806	SSLfatal(s, SSL_AD_INTERNAL_ERROR, SSL_F_TLS_CONSTRUCT_STOC_COOKIE,
1807	ERR_R_INTERNAL_ERROR);
1808	return EXT_RETURN_FAIL;
1809	}
1810
1811	/*
1812	* Get the hash of the initial ClientHello. ssl_handshake_hash() operates
1813	* on raw buffers, so we first reserve sufficient bytes (above) and then
1814	* subsequently allocate them (below)
1815	*/
1816	if (!ssl3_digest_cached_records(s, 0)
1817	\|\| !ssl_handshake_hash(s, hashval1, EVP_MAX_MD_SIZE, &hashlen)) {
1818	/* SSLfatal() already called */
1819	return EXT_RETURN_FAIL;
1820	}
1821
1822	if (!WPACKET_allocate_bytes(pkt, hashlen, &hashval2)
1823	\|\| !ossl_assert(hashval1 == hashval2)
1824	\|\| !WPACKET_close(pkt)
1825	\|\| !WPACKET_start_sub_packet_u8(pkt)
1826	\|\| !WPACKET_reserve_bytes(pkt, SSL_COOKIE_LENGTH, &appcookie1)) {
1827	SSLfatal(s, SSL_AD_INTERNAL_ERROR, SSL_F_TLS_CONSTRUCT_STOC_COOKIE,
1828	ERR_R_INTERNAL_ERROR);
1829	return EXT_RETURN_FAIL;
1830	}
1831
1832	/* Generate the application cookie */
1833	if (s->ctx->gen_stateless_cookie_cb(s, appcookie1, &appcookielen) == 0) {
1834	SSLfatal(s, SSL_AD_INTERNAL_ERROR, SSL_F_TLS_CONSTRUCT_STOC_COOKIE,
1835	SSL_R_COOKIE_GEN_CALLBACK_FAILURE);
1836	return EXT_RETURN_FAIL;
1837	}
1838
1839	if (!WPACKET_allocate_bytes(pkt, appcookielen, &appcookie2)
1840	\|\| !ossl_assert(appcookie1 == appcookie2)
1841	\|\| !WPACKET_close(pkt)
1842	\|\| !WPACKET_get_total_written(pkt, &totcookielen)
1843	\|\| !WPACKET_reserve_bytes(pkt, SHA256_DIGEST_LENGTH, &hmac)) {
1844	SSLfatal(s, SSL_AD_INTERNAL_ERROR, SSL_F_TLS_CONSTRUCT_STOC_COOKIE,
1845	ERR_R_INTERNAL_ERROR);
1846	return EXT_RETURN_FAIL;
1847	}
1848	hmaclen = SHA256_DIGEST_LENGTH;
1849
1850	totcookielen -= startlen;
1851	if (!ossl_assert(totcookielen <= MAX_COOKIE_SIZE - SHA256_DIGEST_LENGTH)) {
1852	SSLfatal(s, SSL_AD_INTERNAL_ERROR, SSL_F_TLS_CONSTRUCT_STOC_COOKIE,
1853	ERR_R_INTERNAL_ERROR);
1854	return EXT_RETURN_FAIL;
1855	}
1856
1857	/* HMAC the cookie */
1858	hctx = EVP_MD_CTX_create();
1859	pkey = EVP_PKEY_new_raw_private_key(EVP_PKEY_HMAC, NULL,
1860	s->session_ctx->ext.cookie_hmac_key,
1861	sizeof(s->session_ctx->ext
1862	.cookie_hmac_key));
1863	if (hctx == NULL \|\| pkey == NULL) {
1864	SSLfatal(s, SSL_AD_INTERNAL_ERROR, SSL_F_TLS_CONSTRUCT_STOC_COOKIE,
1865	ERR_R_MALLOC_FAILURE);
1866	goto err;
1867	}
1868
1869	if (EVP_DigestSignInit(hctx, NULL, EVP_sha256(), NULL, pkey) <= 0
1870	\|\| EVP_DigestSign(hctx, hmac, &hmaclen, cookie,
1871	totcookielen) <= 0) {
1872	SSLfatal(s, SSL_AD_INTERNAL_ERROR, SSL_F_TLS_CONSTRUCT_STOC_COOKIE,
1873	ERR_R_INTERNAL_ERROR);
1874	goto err;
1875	}
1876
1877	if (!ossl_assert(totcookielen + hmaclen <= MAX_COOKIE_SIZE)) {
1878	SSLfatal(s, SSL_AD_INTERNAL_ERROR, SSL_F_TLS_CONSTRUCT_STOC_COOKIE,
1879	ERR_R_INTERNAL_ERROR);
1880	goto err;
1881	}
1882
1883	if (!WPACKET_allocate_bytes(pkt, hmaclen, &hmac2)
1884	\|\| !ossl_assert(hmac == hmac2)
1885	\|\| !ossl_assert(cookie == hmac - totcookielen)
1886	\|\| !WPACKET_close(pkt)
1887	\|\| !WPACKET_close(pkt)) {
1888	SSLfatal(s, SSL_AD_INTERNAL_ERROR, SSL_F_TLS_CONSTRUCT_STOC_COOKIE,
1889	ERR_R_INTERNAL_ERROR);
1890	goto err;
1891	}
1892
1893	ret = EXT_RETURN_SENT;
1894
1895	err:
1896	EVP_MD_CTX_free(hctx);
1897	EVP_PKEY_free(pkey);
1898	return ret;
1899	#else
1900	return EXT_RETURN_FAIL;
1901	#endif
1902	}
1903
1904	EXT_RETURN tls_construct_stoc_cryptopro_bug(SSL s, WPACKET pkt,
1905	unsigned int context, X509 *x,
1906	size_t chainidx)
1907	{
1908	const unsigned char cryptopro_ext[36] = {
1909	0xfd, 0xe8, /* 65000 */
1910	0x00, 0x20, /* 32 bytes length */
1911	0x30, 0x1e, 0x30, 0x08, 0x06, 0x06, 0x2a, 0x85,
1912	0x03, 0x02, 0x02, 0x09, 0x30, 0x08, 0x06, 0x06,
1913	0x2a, 0x85, 0x03, 0x02, 0x02, 0x16, 0x30, 0x08,
1914	0x06, 0x06, 0x2a, 0x85, 0x03, 0x02, 0x02, 0x17
1915	};
1916
1917	if (((s->s3->tmp.new_cipher->id & 0xFFFF) != 0x80
1918	&& (s->s3->tmp.new_cipher->id & 0xFFFF) != 0x81)
1919	\|\| (SSL_get_options(s) & SSL_OP_CRYPTOPRO_TLSEXT_BUG) == 0)
1920	return EXT_RETURN_NOT_SENT;
1921
1922	if (!WPACKET_memcpy(pkt, cryptopro_ext, sizeof(cryptopro_ext))) {
1923	SSLfatal(s, SSL_AD_INTERNAL_ERROR,
1924	SSL_F_TLS_CONSTRUCT_STOC_CRYPTOPRO_BUG, ERR_R_INTERNAL_ERROR);
1925	return EXT_RETURN_FAIL;
1926	}
1927
1928	return EXT_RETURN_SENT;
1929	}
1930
1931	EXT_RETURN tls_construct_stoc_early_data(SSL s, WPACKET pkt,
1932	unsigned int context, X509 *x,
1933	size_t chainidx)
1934	{
1935	if (context == SSL_EXT_TLS1_3_NEW_SESSION_TICKET) {
1936	if (s->max_early_data == 0)
1937	return EXT_RETURN_NOT_SENT;
1938
1939	if (!WPACKET_put_bytes_u16(pkt, TLSEXT_TYPE_early_data)
1940	\|\| !WPACKET_start_sub_packet_u16(pkt)
1941	\|\| !WPACKET_put_bytes_u32(pkt, s->max_early_data)
1942	\|\| !WPACKET_close(pkt)) {
1943	SSLfatal(s, SSL_AD_INTERNAL_ERROR,
1944	SSL_F_TLS_CONSTRUCT_STOC_EARLY_DATA, ERR_R_INTERNAL_ERROR);
1945	return EXT_RETURN_FAIL;
1946	}
1947
1948	return EXT_RETURN_SENT;
1949	}
1950
1951	if (s->ext.early_data != SSL_EARLY_DATA_ACCEPTED)
1952	return EXT_RETURN_NOT_SENT;
1953
1954	if (!WPACKET_put_bytes_u16(pkt, TLSEXT_TYPE_early_data)
1955	\|\| !WPACKET_start_sub_packet_u16(pkt)
1956	\|\| !WPACKET_close(pkt)) {
1957	SSLfatal(s, SSL_AD_INTERNAL_ERROR, SSL_F_TLS_CONSTRUCT_STOC_EARLY_DATA,
1958	ERR_R_INTERNAL_ERROR);
1959	return EXT_RETURN_FAIL;
1960	}
1961
1962	return EXT_RETURN_SENT;
1963	}
1964
1965	EXT_RETURN tls_construct_stoc_psk(SSL s, WPACKET pkt, unsigned int context,
1966	X509 *x, size_t chainidx)
1967	{
1968	if (!s->hit)
1969	return EXT_RETURN_NOT_SENT;
1970
1971	if (!WPACKET_put_bytes_u16(pkt, TLSEXT_TYPE_psk)
1972	\|\| !WPACKET_start_sub_packet_u16(pkt)
1973	\|\| !WPACKET_put_bytes_u16(pkt, s->ext.tick_identity)
1974	\|\| !WPACKET_close(pkt)) {
1975	SSLfatal(s, SSL_AD_INTERNAL_ERROR,
1976	SSL_F_TLS_CONSTRUCT_STOC_PSK, ERR_R_INTERNAL_ERROR);
1977	return EXT_RETURN_FAIL;
1978	}
1979
1980	return EXT_RETURN_SENT;
1981	}

Note: See TracBrowser for help on using the repository browser.

source: vbox/trunk/src/libs/openssl-1.1.1l/ssl/statem/extensions_srvr.c@ 95000

Download in other formats: