1 /* 2 * Copyright 1995-2026 The OpenSSL Project Authors. All Rights Reserved. 3 * Copyright (c) 2002, Oracle and/or its affiliates. All rights reserved 4 * Copyright 2005 Nokia. All rights reserved. 5 * 6 * Licensed under the Apache License 2.0 (the "License"). You may not use 7 * this file except in compliance with the License. You can obtain a copy 8 * in the file LICENSE in the source distribution or at 9 * https://www.openssl.org/source/license.html 10 */ 11 12 #include "internal/e_os.h" 13 #include "internal/e_winsock.h" 14 #include "ssl_local.h" 15 16 #include <openssl/objects.h> 17 #include <openssl/x509v3.h> 18 #include <openssl/rand.h> 19 #include <openssl/ocsp.h> 20 #include <openssl/dh.h> 21 #include <openssl/engine.h> 22 #include <openssl/async.h> 23 #include <openssl/ct.h> 24 #include <openssl/trace.h> 25 #include <openssl/core_names.h> 26 #include <openssl/provider.h> 27 #include "internal/cryptlib.h" 28 #include "internal/nelem.h" 29 #include "internal/refcount.h" 30 #include "internal/thread_once.h" 31 #include "internal/ktls.h" 32 #include "internal/to_hex.h" 33 #include "internal/ssl_unwrap.h" 34 #include "quic/quic_local.h" 35 36 #ifndef OPENSSL_NO_SSLKEYLOG 37 #include <sys/stat.h> 38 #include <fcntl.h> 39 #endif 40 41 static int ssl_undefined_function_3(SSL_CONNECTION *sc, unsigned char *r, 42 unsigned char *s, size_t t, size_t *u) 43 { 44 return ssl_undefined_function(SSL_CONNECTION_GET_SSL(sc)); 45 } 46 47 static int ssl_undefined_function_4(SSL_CONNECTION *sc, int r) 48 { 49 return ssl_undefined_function(SSL_CONNECTION_GET_SSL(sc)); 50 } 51 52 static size_t ssl_undefined_function_5(SSL_CONNECTION *sc, const char *r, 53 size_t s, unsigned char *t) 54 { 55 return ssl_undefined_function(SSL_CONNECTION_GET_SSL(sc)); 56 } 57 58 static int ssl_undefined_function_6(int r) 59 { 60 return ssl_undefined_function(NULL); 61 } 62 63 static int ssl_undefined_function_7(SSL_CONNECTION *sc, unsigned char *r, 64 size_t s, const char *t, size_t u, 65 const unsigned char *v, size_t w, int x) 66 { 67 return ssl_undefined_function(SSL_CONNECTION_GET_SSL(sc)); 68 } 69 70 static int ssl_undefined_function_8(SSL_CONNECTION *sc) 71 { 72 return ssl_undefined_function(SSL_CONNECTION_GET_SSL(sc)); 73 } 74 75 const SSL3_ENC_METHOD ssl3_undef_enc_method = { 76 ssl_undefined_function_8, 77 ssl_undefined_function_3, 78 ssl_undefined_function_4, 79 ssl_undefined_function_5, 80 NULL, /* client_finished_label */ 81 0, /* client_finished_label_len */ 82 NULL, /* server_finished_label */ 83 0, /* server_finished_label_len */ 84 ssl_undefined_function_6, 85 ssl_undefined_function_7, 86 }; 87 88 struct ssl_async_args { 89 SSL *s; 90 void *buf; 91 size_t num; 92 enum { READFUNC, 93 WRITEFUNC, 94 OTHERFUNC } type; 95 union { 96 int (*func_read)(SSL *, void *, size_t, size_t *); 97 int (*func_write)(SSL *, const void *, size_t, size_t *); 98 int (*func_other)(SSL *); 99 } f; 100 }; 101 102 static const struct { 103 uint8_t mtype; 104 uint8_t ord; 105 int nid; 106 } dane_mds[] = { 107 { DANETLS_MATCHING_FULL, 0, NID_undef }, 108 { DANETLS_MATCHING_2256, 1, NID_sha256 }, 109 { DANETLS_MATCHING_2512, 2, NID_sha512 }, 110 }; 111 112 static int dane_ctx_enable(struct dane_ctx_st *dctx) 113 { 114 const EVP_MD **mdevp; 115 uint8_t *mdord; 116 uint8_t mdmax = DANETLS_MATCHING_LAST; 117 int n = ((int)mdmax) + 1; /* int to handle PrivMatch(255) */ 118 size_t i; 119 120 if (dctx->mdevp != NULL) 121 return 1; 122 123 mdevp = OPENSSL_zalloc(n * sizeof(*mdevp)); 124 mdord = OPENSSL_zalloc(n * sizeof(*mdord)); 125 126 if (mdord == NULL || mdevp == NULL) { 127 OPENSSL_free(mdord); 128 OPENSSL_free(mdevp); 129 return 0; 130 } 131 132 /* Install default entries */ 133 for (i = 0; i < OSSL_NELEM(dane_mds); ++i) { 134 const EVP_MD *md; 135 136 if (dane_mds[i].nid == NID_undef || (md = EVP_get_digestbynid(dane_mds[i].nid)) == NULL) 137 continue; 138 mdevp[dane_mds[i].mtype] = md; 139 mdord[dane_mds[i].mtype] = dane_mds[i].ord; 140 } 141 142 dctx->mdevp = mdevp; 143 dctx->mdord = mdord; 144 dctx->mdmax = mdmax; 145 146 return 1; 147 } 148 149 static void dane_ctx_final(struct dane_ctx_st *dctx) 150 { 151 OPENSSL_free(dctx->mdevp); 152 dctx->mdevp = NULL; 153 154 OPENSSL_free(dctx->mdord); 155 dctx->mdord = NULL; 156 dctx->mdmax = 0; 157 } 158 159 static void tlsa_free(danetls_record *t) 160 { 161 if (t == NULL) 162 return; 163 OPENSSL_free(t->data); 164 EVP_PKEY_free(t->spki); 165 OPENSSL_free(t); 166 } 167 168 static void dane_final(SSL_DANE *dane) 169 { 170 sk_danetls_record_pop_free(dane->trecs, tlsa_free); 171 dane->trecs = NULL; 172 173 OSSL_STACK_OF_X509_free(dane->certs); 174 dane->certs = NULL; 175 176 X509_free(dane->mcert); 177 dane->mcert = NULL; 178 dane->mtlsa = NULL; 179 dane->mdpth = -1; 180 dane->pdpth = -1; 181 } 182 183 /* 184 * dane_copy - Copy dane configuration, sans verification state. 185 */ 186 static int ssl_dane_dup(SSL_CONNECTION *to, SSL_CONNECTION *from) 187 { 188 int num; 189 int i; 190 191 if (!DANETLS_ENABLED(&from->dane)) 192 return 1; 193 194 num = sk_danetls_record_num(from->dane.trecs); 195 dane_final(&to->dane); 196 to->dane.flags = from->dane.flags; 197 to->dane.dctx = &SSL_CONNECTION_GET_CTX(to)->dane; 198 to->dane.trecs = sk_danetls_record_new_reserve(NULL, num); 199 200 if (to->dane.trecs == NULL) { 201 ERR_raise(ERR_LIB_SSL, ERR_R_CRYPTO_LIB); 202 return 0; 203 } 204 205 for (i = 0; i < num; ++i) { 206 danetls_record *t = sk_danetls_record_value(from->dane.trecs, i); 207 208 if (SSL_dane_tlsa_add(SSL_CONNECTION_GET_SSL(to), t->usage, 209 t->selector, t->mtype, t->data, t->dlen) 210 <= 0) 211 return 0; 212 } 213 return 1; 214 } 215 216 static int dane_mtype_set(struct dane_ctx_st *dctx, 217 const EVP_MD *md, uint8_t mtype, uint8_t ord) 218 { 219 int i; 220 221 if (mtype == DANETLS_MATCHING_FULL && md != NULL) { 222 ERR_raise(ERR_LIB_SSL, SSL_R_DANE_CANNOT_OVERRIDE_MTYPE_FULL); 223 return 0; 224 } 225 226 if (mtype > dctx->mdmax) { 227 const EVP_MD **mdevp; 228 uint8_t *mdord; 229 int n = ((int)mtype) + 1; 230 231 mdevp = OPENSSL_realloc(dctx->mdevp, n * sizeof(*mdevp)); 232 if (mdevp == NULL) 233 return -1; 234 dctx->mdevp = mdevp; 235 236 mdord = OPENSSL_realloc(dctx->mdord, n * sizeof(*mdord)); 237 if (mdord == NULL) 238 return -1; 239 dctx->mdord = mdord; 240 241 /* Zero-fill any gaps */ 242 for (i = dctx->mdmax + 1; i < mtype; ++i) { 243 mdevp[i] = NULL; 244 mdord[i] = 0; 245 } 246 247 dctx->mdmax = mtype; 248 } 249 250 dctx->mdevp[mtype] = md; 251 /* Coerce ordinal of disabled matching types to 0 */ 252 dctx->mdord[mtype] = (md == NULL) ? 0 : ord; 253 254 return 1; 255 } 256 257 static const EVP_MD *tlsa_md_get(SSL_DANE *dane, uint8_t mtype) 258 { 259 if (mtype > dane->dctx->mdmax) 260 return NULL; 261 return dane->dctx->mdevp[mtype]; 262 } 263 264 static int dane_tlsa_add(SSL_DANE *dane, 265 uint8_t usage, 266 uint8_t selector, 267 uint8_t mtype, const unsigned char *data, size_t dlen) 268 { 269 danetls_record *t; 270 const EVP_MD *md = NULL; 271 int ilen = (int)dlen; 272 int i; 273 int num; 274 int mdsize; 275 276 if (dane->trecs == NULL) { 277 ERR_raise(ERR_LIB_SSL, SSL_R_DANE_NOT_ENABLED); 278 return -1; 279 } 280 281 if (ilen < 0 || dlen != (size_t)ilen) { 282 ERR_raise(ERR_LIB_SSL, SSL_R_DANE_TLSA_BAD_DATA_LENGTH); 283 return 0; 284 } 285 286 if (usage > DANETLS_USAGE_LAST) { 287 ERR_raise(ERR_LIB_SSL, SSL_R_DANE_TLSA_BAD_CERTIFICATE_USAGE); 288 return 0; 289 } 290 291 if (selector > DANETLS_SELECTOR_LAST) { 292 ERR_raise(ERR_LIB_SSL, SSL_R_DANE_TLSA_BAD_SELECTOR); 293 return 0; 294 } 295 296 if (mtype != DANETLS_MATCHING_FULL) { 297 md = tlsa_md_get(dane, mtype); 298 if (md == NULL) { 299 ERR_raise(ERR_LIB_SSL, SSL_R_DANE_TLSA_BAD_MATCHING_TYPE); 300 return 0; 301 } 302 } 303 304 if (md != NULL) { 305 mdsize = EVP_MD_get_size(md); 306 if (mdsize <= 0 || dlen != (size_t)mdsize) { 307 ERR_raise(ERR_LIB_SSL, SSL_R_DANE_TLSA_BAD_DIGEST_LENGTH); 308 return 0; 309 } 310 } 311 if (!data) { 312 ERR_raise(ERR_LIB_SSL, SSL_R_DANE_TLSA_NULL_DATA); 313 return 0; 314 } 315 316 if ((t = OPENSSL_zalloc(sizeof(*t))) == NULL) 317 return -1; 318 319 t->usage = usage; 320 t->selector = selector; 321 t->mtype = mtype; 322 t->data = OPENSSL_malloc(dlen); 323 if (t->data == NULL) { 324 tlsa_free(t); 325 return -1; 326 } 327 memcpy(t->data, data, dlen); 328 t->dlen = dlen; 329 330 /* Validate and cache full certificate or public key */ 331 if (mtype == DANETLS_MATCHING_FULL) { 332 const unsigned char *p = data; 333 X509 *cert = NULL; 334 EVP_PKEY *pkey = NULL; 335 336 switch (selector) { 337 case DANETLS_SELECTOR_CERT: 338 if (!d2i_X509(&cert, &p, ilen) || p < data || dlen != (size_t)(p - data)) { 339 X509_free(cert); 340 tlsa_free(t); 341 ERR_raise(ERR_LIB_SSL, SSL_R_DANE_TLSA_BAD_CERTIFICATE); 342 return 0; 343 } 344 if (X509_get0_pubkey(cert) == NULL) { 345 X509_free(cert); 346 tlsa_free(t); 347 ERR_raise(ERR_LIB_SSL, SSL_R_DANE_TLSA_BAD_CERTIFICATE); 348 return 0; 349 } 350 351 if ((DANETLS_USAGE_BIT(usage) & DANETLS_TA_MASK) == 0) { 352 /* 353 * The Full(0) certificate decodes to a seemingly valid X.509 354 * object with a plausible key, so the TLSA record is well 355 * formed. However, we don't actually need the certificate for 356 * usages PKIX-EE(1) or DANE-EE(3), because at least the EE 357 * certificate is always presented by the peer. We discard the 358 * certificate, and just use the TLSA data as an opaque blob 359 * for matching the raw presented DER octets. 360 * 361 * DO NOT FREE `t` here, it will be added to the TLSA record 362 * list below! 363 */ 364 X509_free(cert); 365 break; 366 } 367 368 /* 369 * For usage DANE-TA(2), we support authentication via "2 0 0" TLSA 370 * records that contain full certificates of trust-anchors that are 371 * not present in the wire chain. For usage PKIX-TA(0), we augment 372 * the chain with untrusted Full(0) certificates from DNS, in case 373 * they are missing from the chain. 374 */ 375 if ((dane->certs == NULL && (dane->certs = sk_X509_new_null()) == NULL) || !sk_X509_push(dane->certs, cert)) { 376 ERR_raise(ERR_LIB_SSL, ERR_R_CRYPTO_LIB); 377 X509_free(cert); 378 tlsa_free(t); 379 return -1; 380 } 381 break; 382 383 case DANETLS_SELECTOR_SPKI: 384 if (!d2i_PUBKEY(&pkey, &p, ilen) || p < data || dlen != (size_t)(p - data)) { 385 EVP_PKEY_free(pkey); 386 tlsa_free(t); 387 ERR_raise(ERR_LIB_SSL, SSL_R_DANE_TLSA_BAD_PUBLIC_KEY); 388 return 0; 389 } 390 391 /* 392 * For usage DANE-TA(2), we support authentication via "2 1 0" TLSA 393 * records that contain full bare keys of trust-anchors that are 394 * not present in the wire chain. 395 */ 396 if (usage == DANETLS_USAGE_DANE_TA) 397 t->spki = pkey; 398 else 399 EVP_PKEY_free(pkey); 400 break; 401 } 402 } 403 404 /*- 405 * Find the right insertion point for the new record. 406 * 407 * See crypto/x509/x509_vfy.c. We sort DANE-EE(3) records first, so that 408 * they can be processed first, as they require no chain building, and no 409 * expiration or hostname checks. Because DANE-EE(3) is numerically 410 * largest, this is accomplished via descending sort by "usage". 411 * 412 * We also sort in descending order by matching ordinal to simplify 413 * the implementation of digest agility in the verification code. 414 * 415 * The choice of order for the selector is not significant, so we 416 * use the same descending order for consistency. 417 */ 418 num = sk_danetls_record_num(dane->trecs); 419 for (i = 0; i < num; ++i) { 420 danetls_record *rec = sk_danetls_record_value(dane->trecs, i); 421 422 if (rec->usage > usage) 423 continue; 424 if (rec->usage < usage) 425 break; 426 if (rec->selector > selector) 427 continue; 428 if (rec->selector < selector) 429 break; 430 if (dane->dctx->mdord[rec->mtype] > dane->dctx->mdord[mtype]) 431 continue; 432 break; 433 } 434 435 if (!sk_danetls_record_insert(dane->trecs, t, i)) { 436 tlsa_free(t); 437 ERR_raise(ERR_LIB_SSL, ERR_R_CRYPTO_LIB); 438 return -1; 439 } 440 dane->umask |= DANETLS_USAGE_BIT(usage); 441 442 return 1; 443 } 444 445 /* 446 * Return 0 if there is only one version configured and it was disabled 447 * at configure time. Return 1 otherwise. 448 */ 449 static int ssl_check_allowed_versions(int min_version, int max_version) 450 { 451 int minisdtls = 0, maxisdtls = 0; 452 453 /* Figure out if we're doing DTLS versions or TLS versions */ 454 if (min_version == DTLS1_BAD_VER 455 || min_version >> 8 == DTLS1_VERSION_MAJOR) 456 minisdtls = 1; 457 if (max_version == DTLS1_BAD_VER 458 || max_version >> 8 == DTLS1_VERSION_MAJOR) 459 maxisdtls = 1; 460 /* A wildcard version of 0 could be DTLS or TLS. */ 461 if ((minisdtls && !maxisdtls && max_version != 0) 462 || (maxisdtls && !minisdtls && min_version != 0)) { 463 /* Mixing DTLS and TLS versions will lead to sadness; deny it. */ 464 return 0; 465 } 466 467 if (minisdtls || maxisdtls) { 468 /* Do DTLS version checks. */ 469 if (min_version == 0) 470 /* Ignore DTLS1_BAD_VER */ 471 min_version = DTLS1_VERSION; 472 if (max_version == 0) 473 max_version = DTLS1_2_VERSION; 474 #ifdef OPENSSL_NO_DTLS1_2 475 if (max_version == DTLS1_2_VERSION) 476 max_version = DTLS1_VERSION; 477 #endif 478 #ifdef OPENSSL_NO_DTLS1 479 if (min_version == DTLS1_VERSION) 480 min_version = DTLS1_2_VERSION; 481 #endif 482 /* Done massaging versions; do the check. */ 483 if (0 484 #ifdef OPENSSL_NO_DTLS1 485 || (DTLS_VERSION_GE(min_version, DTLS1_VERSION) 486 && DTLS_VERSION_GE(DTLS1_VERSION, max_version)) 487 #endif 488 #ifdef OPENSSL_NO_DTLS1_2 489 || (DTLS_VERSION_GE(min_version, DTLS1_2_VERSION) 490 && DTLS_VERSION_GE(DTLS1_2_VERSION, max_version)) 491 #endif 492 ) 493 return 0; 494 } else { 495 /* Regular TLS version checks. */ 496 if (min_version == 0) 497 min_version = SSL3_VERSION; 498 if (max_version == 0) 499 max_version = TLS1_3_VERSION; 500 #ifdef OPENSSL_NO_TLS1_3 501 if (max_version == TLS1_3_VERSION) 502 max_version = TLS1_2_VERSION; 503 #endif 504 #ifdef OPENSSL_NO_TLS1_2 505 if (max_version == TLS1_2_VERSION) 506 max_version = TLS1_1_VERSION; 507 #endif 508 #ifdef OPENSSL_NO_TLS1_1 509 if (max_version == TLS1_1_VERSION) 510 max_version = TLS1_VERSION; 511 #endif 512 #ifdef OPENSSL_NO_TLS1 513 if (max_version == TLS1_VERSION) 514 max_version = SSL3_VERSION; 515 #endif 516 #ifdef OPENSSL_NO_SSL3 517 if (min_version == SSL3_VERSION) 518 min_version = TLS1_VERSION; 519 #endif 520 #ifdef OPENSSL_NO_TLS1 521 if (min_version == TLS1_VERSION) 522 min_version = TLS1_1_VERSION; 523 #endif 524 #ifdef OPENSSL_NO_TLS1_1 525 if (min_version == TLS1_1_VERSION) 526 min_version = TLS1_2_VERSION; 527 #endif 528 #ifdef OPENSSL_NO_TLS1_2 529 if (min_version == TLS1_2_VERSION) 530 min_version = TLS1_3_VERSION; 531 #endif 532 /* Done massaging versions; do the check. */ 533 if (0 534 #ifdef OPENSSL_NO_SSL3 535 || (min_version <= SSL3_VERSION && SSL3_VERSION <= max_version) 536 #endif 537 #ifdef OPENSSL_NO_TLS1 538 || (min_version <= TLS1_VERSION && TLS1_VERSION <= max_version) 539 #endif 540 #ifdef OPENSSL_NO_TLS1_1 541 || (min_version <= TLS1_1_VERSION && TLS1_1_VERSION <= max_version) 542 #endif 543 #ifdef OPENSSL_NO_TLS1_2 544 || (min_version <= TLS1_2_VERSION && TLS1_2_VERSION <= max_version) 545 #endif 546 #ifdef OPENSSL_NO_TLS1_3 547 || (min_version <= TLS1_3_VERSION && TLS1_3_VERSION <= max_version) 548 #endif 549 ) 550 return 0; 551 } 552 return 1; 553 } 554 555 #if defined(__TANDEM) && defined(OPENSSL_VPROC) 556 /* 557 * Define a VPROC function for HP NonStop build ssl library. 558 * This is used by platform version identification tools. 559 * Do not inline this procedure or make it static. 560 */ 561 #define OPENSSL_VPROC_STRING_(x) x##_SSL 562 #define OPENSSL_VPROC_STRING(x) OPENSSL_VPROC_STRING_(x) 563 #define OPENSSL_VPROC_FUNC OPENSSL_VPROC_STRING(OPENSSL_VPROC) 564 void OPENSSL_VPROC_FUNC(void) { } 565 #endif 566 567 int SSL_clear(SSL *s) 568 { 569 if (s->method == NULL) { 570 ERR_raise(ERR_LIB_SSL, SSL_R_NO_METHOD_SPECIFIED); 571 return 0; 572 } 573 574 return s->method->ssl_reset(s); 575 } 576 577 int ossl_ssl_connection_reset(SSL *s) 578 { 579 SSL_CONNECTION *sc = SSL_CONNECTION_FROM_SSL(s); 580 581 if (sc == NULL) 582 return 0; 583 584 if (ssl_clear_bad_session(sc)) { 585 SSL_SESSION_free(sc->session); 586 sc->session = NULL; 587 } 588 SSL_SESSION_free(sc->psksession); 589 sc->psksession = NULL; 590 OPENSSL_free(sc->psksession_id); 591 sc->psksession_id = NULL; 592 sc->psksession_id_len = 0; 593 sc->hello_retry_request = SSL_HRR_NONE; 594 sc->sent_tickets = 0; 595 596 sc->error = 0; 597 sc->hit = 0; 598 sc->shutdown = 0; 599 600 if (sc->renegotiate) { 601 ERR_raise(ERR_LIB_SSL, ERR_R_INTERNAL_ERROR); 602 return 0; 603 } 604 605 ossl_statem_clear(sc); 606 607 sc->version = s->method->version; 608 sc->client_version = sc->version; 609 sc->rwstate = SSL_NOTHING; 610 611 BUF_MEM_free(sc->init_buf); 612 sc->init_buf = NULL; 613 sc->first_packet = 0; 614 615 sc->key_update = SSL_KEY_UPDATE_NONE; 616 memset(sc->ext.compress_certificate_from_peer, 0, 617 sizeof(sc->ext.compress_certificate_from_peer)); 618 sc->ext.compress_certificate_sent = 0; 619 620 EVP_MD_CTX_free(sc->pha_dgst); 621 sc->pha_dgst = NULL; 622 623 /* Reset DANE verification result state */ 624 sc->dane.mdpth = -1; 625 sc->dane.pdpth = -1; 626 X509_free(sc->dane.mcert); 627 sc->dane.mcert = NULL; 628 sc->dane.mtlsa = NULL; 629 630 /* Clear the verification result peername */ 631 X509_VERIFY_PARAM_move_peername(sc->param, NULL); 632 633 /* Clear any shared connection state */ 634 OPENSSL_free(sc->shared_sigalgs); 635 sc->shared_sigalgs = NULL; 636 sc->shared_sigalgslen = 0; 637 638 /* 639 * Check to see if we were changed into a different method, if so, revert 640 * back. 641 */ 642 if (s->method != s->defltmeth) { 643 s->method->ssl_deinit(s); 644 s->method = s->defltmeth; 645 if (!s->method->ssl_init(s)) 646 return 0; 647 } else { 648 if (!s->method->ssl_clear(s)) 649 return 0; 650 } 651 652 ossl_quic_tls_clear(sc->qtls); 653 654 if (!RECORD_LAYER_reset(&sc->rlayer)) 655 return 0; 656 657 return 1; 658 } 659 660 #ifndef OPENSSL_NO_DEPRECATED_3_0 661 /** Used to change an SSL_CTXs default SSL method type */ 662 int SSL_CTX_set_ssl_version(SSL_CTX *ctx, const SSL_METHOD *meth) 663 { 664 STACK_OF(SSL_CIPHER) *sk; 665 666 if (IS_QUIC_CTX(ctx)) { 667 ERR_raise(ERR_LIB_SSL, SSL_R_WRONG_SSL_VERSION); 668 return 0; 669 } 670 671 ctx->method = meth; 672 673 if (!SSL_CTX_set_ciphersuites(ctx, OSSL_default_ciphersuites())) { 674 ERR_raise(ERR_LIB_SSL, SSL_R_SSL_LIBRARY_HAS_NO_CIPHERS); 675 return 0; 676 } 677 sk = ssl_create_cipher_list(ctx, 678 ctx->tls13_ciphersuites, 679 &(ctx->cipher_list), 680 &(ctx->cipher_list_by_id), 681 OSSL_default_cipher_list(), ctx->cert); 682 if ((sk == NULL) || (sk_SSL_CIPHER_num(sk) <= 0)) { 683 ERR_raise(ERR_LIB_SSL, SSL_R_SSL_LIBRARY_HAS_NO_CIPHERS); 684 return 0; 685 } 686 return 1; 687 } 688 #endif 689 690 SSL *SSL_new(SSL_CTX *ctx) 691 { 692 if (ctx == NULL) { 693 ERR_raise(ERR_LIB_SSL, SSL_R_NULL_SSL_CTX); 694 return NULL; 695 } 696 if (ctx->method == NULL) { 697 ERR_raise(ERR_LIB_SSL, SSL_R_SSL_CTX_HAS_NO_DEFAULT_SSL_VERSION); 698 return NULL; 699 } 700 return ctx->method->ssl_new(ctx); 701 } 702 703 int ossl_ssl_init(SSL *ssl, SSL_CTX *ctx, const SSL_METHOD *method, int type) 704 { 705 if (!SSL_CTX_up_ref(ctx)) 706 return 0; 707 708 ssl->lock = CRYPTO_THREAD_lock_new(); 709 710 if (ssl->lock == NULL || !CRYPTO_NEW_REF(&ssl->references, 1)) 711 goto err; 712 713 if (!CRYPTO_new_ex_data(CRYPTO_EX_INDEX_SSL, ssl, &ssl->ex_data)) { 714 CRYPTO_FREE_REF(&ssl->references); 715 goto err; 716 } 717 718 ssl->ctx = ctx; 719 ssl->type = type; 720 ssl->defltmeth = ssl->method = method; 721 722 return 1; 723 724 err: 725 CRYPTO_THREAD_lock_free(ssl->lock); 726 ssl->lock = NULL; 727 SSL_CTX_free(ctx); 728 return 0; 729 } 730 731 SSL *ossl_ssl_connection_new_int(SSL_CTX *ctx, SSL *user_ssl, 732 const SSL_METHOD *method) 733 { 734 SSL_CONNECTION *s; 735 SSL *ssl; 736 737 s = OPENSSL_zalloc(sizeof(*s)); 738 if (s == NULL) 739 return NULL; 740 741 ssl = &s->ssl; 742 s->user_ssl = (user_ssl == NULL) ? ssl : user_ssl; 743 744 if (!ossl_ssl_init(ssl, ctx, method, SSL_TYPE_SSL_CONNECTION)) { 745 OPENSSL_free(s); 746 s = NULL; 747 ssl = NULL; 748 goto sslerr; 749 } 750 751 RECORD_LAYER_init(&s->rlayer, s); 752 753 s->options = ctx->options; 754 755 s->dane.flags = ctx->dane.flags; 756 if (method->version == ctx->method->version) { 757 s->min_proto_version = ctx->min_proto_version; 758 s->max_proto_version = ctx->max_proto_version; 759 } 760 761 s->mode = ctx->mode; 762 s->max_cert_list = ctx->max_cert_list; 763 s->max_early_data = ctx->max_early_data; 764 s->recv_max_early_data = ctx->recv_max_early_data; 765 766 s->num_tickets = ctx->num_tickets; 767 s->pha_enabled = ctx->pha_enabled; 768 769 /* Shallow copy of the ciphersuites stack */ 770 s->tls13_ciphersuites = sk_SSL_CIPHER_dup(ctx->tls13_ciphersuites); 771 if (s->tls13_ciphersuites == NULL) 772 goto cerr; 773 774 /* 775 * Earlier library versions used to copy the pointer to the CERT, not 776 * its contents; only when setting new parameters for the per-SSL 777 * copy, ssl_cert_new would be called (and the direct reference to 778 * the per-SSL_CTX settings would be lost, but those still were 779 * indirectly accessed for various purposes, and for that reason they 780 * used to be known as s->ctx->default_cert). Now we don't look at the 781 * SSL_CTX's CERT after having duplicated it once. 782 */ 783 s->cert = ssl_cert_dup(ctx->cert); 784 if (s->cert == NULL) 785 goto sslerr; 786 787 RECORD_LAYER_set_read_ahead(&s->rlayer, ctx->read_ahead); 788 s->msg_callback = ctx->msg_callback; 789 s->msg_callback_arg = ctx->msg_callback_arg; 790 s->verify_mode = ctx->verify_mode; 791 s->not_resumable_session_cb = ctx->not_resumable_session_cb; 792 s->rlayer.record_padding_cb = ctx->record_padding_cb; 793 s->rlayer.record_padding_arg = ctx->record_padding_arg; 794 s->rlayer.block_padding = ctx->block_padding; 795 s->rlayer.hs_padding = ctx->hs_padding; 796 s->sid_ctx_length = ctx->sid_ctx_length; 797 if (!ossl_assert(s->sid_ctx_length <= sizeof(s->sid_ctx))) 798 goto err; 799 memcpy(&s->sid_ctx, &ctx->sid_ctx, sizeof(s->sid_ctx)); 800 s->verify_callback = ctx->default_verify_callback; 801 s->generate_session_id = ctx->generate_session_id; 802 803 s->param = X509_VERIFY_PARAM_new(); 804 if (s->param == NULL) 805 goto asn1err; 806 X509_VERIFY_PARAM_inherit(s->param, ctx->param); 807 s->quiet_shutdown = IS_QUIC_CTX(ctx) ? 0 : ctx->quiet_shutdown; 808 809 if (!IS_QUIC_CTX(ctx)) 810 s->ext.max_fragment_len_mode = ctx->ext.max_fragment_len_mode; 811 812 s->max_send_fragment = ctx->max_send_fragment; 813 s->split_send_fragment = ctx->split_send_fragment; 814 s->max_pipelines = ctx->max_pipelines; 815 s->rlayer.default_read_buf_len = ctx->default_read_buf_len; 816 817 s->ext.debug_cb = 0; 818 s->ext.debug_arg = NULL; 819 s->ext.ticket_expected = 0; 820 s->ext.status_type = ctx->ext.status_type; 821 s->ext.status_expected = 0; 822 s->ext.ocsp.ids = NULL; 823 s->ext.ocsp.exts = NULL; 824 s->ext.ocsp.resp = NULL; 825 s->ext.ocsp.resp_len = 0; 826 827 if (!SSL_CTX_up_ref(ctx)) 828 goto err; 829 830 s->session_ctx = ctx; 831 if (ctx->ext.ecpointformats != NULL) { 832 s->ext.ecpointformats = OPENSSL_memdup(ctx->ext.ecpointformats, 833 ctx->ext.ecpointformats_len); 834 if (s->ext.ecpointformats == NULL) { 835 s->ext.ecpointformats_len = 0; 836 goto err; 837 } 838 s->ext.ecpointformats_len = ctx->ext.ecpointformats_len; 839 } 840 if (ctx->ext.supportedgroups != NULL) { 841 size_t add = 0; 842 843 if (ctx->ext.supportedgroups_len == 0) 844 /* Add 1 so allocation won't fail */ 845 add = 1; 846 s->ext.supportedgroups = OPENSSL_memdup(ctx->ext.supportedgroups, 847 (ctx->ext.supportedgroups_len + add) 848 * sizeof(*ctx->ext.supportedgroups)); 849 if (s->ext.supportedgroups == NULL) { 850 s->ext.supportedgroups_len = 0; 851 goto err; 852 } 853 s->ext.supportedgroups_len = ctx->ext.supportedgroups_len; 854 } 855 if (ctx->ext.keyshares != NULL) { 856 size_t add = 0; 857 858 if (ctx->ext.keyshares_len == 0) 859 /* Add 1 so allocation won't fail */ 860 add = 1; 861 s->ext.keyshares = OPENSSL_memdup(ctx->ext.keyshares, 862 (ctx->ext.keyshares_len + add) 863 * sizeof(*ctx->ext.keyshares)); 864 if (s->ext.keyshares == NULL) { 865 s->ext.keyshares_len = 0; 866 goto err; 867 } 868 s->ext.keyshares_len = ctx->ext.keyshares_len; 869 } 870 if (ctx->ext.tuples != NULL) { 871 size_t add = 0; 872 873 if (ctx->ext.tuples_len == 0) 874 /* Add 1 so allocation won't fail */ 875 add = 1; 876 s->ext.tuples = OPENSSL_memdup(ctx->ext.tuples, 877 (ctx->ext.tuples_len + add) 878 * sizeof(*ctx->ext.tuples)); 879 if (s->ext.tuples == NULL) { 880 s->ext.tuples_len = 0; 881 goto err; 882 } 883 s->ext.tuples_len = ctx->ext.tuples_len; 884 } 885 886 #ifndef OPENSSL_NO_NEXTPROTONEG 887 s->ext.npn = NULL; 888 #endif 889 890 if (ctx->ext.alpn != NULL) { 891 s->ext.alpn = OPENSSL_malloc(ctx->ext.alpn_len); 892 if (s->ext.alpn == NULL) { 893 s->ext.alpn_len = 0; 894 goto err; 895 } 896 memcpy(s->ext.alpn, ctx->ext.alpn, ctx->ext.alpn_len); 897 s->ext.alpn_len = ctx->ext.alpn_len; 898 } 899 900 s->verified_chain = NULL; 901 s->verify_result = X509_V_OK; 902 903 s->default_passwd_callback = ctx->default_passwd_callback; 904 s->default_passwd_callback_userdata = ctx->default_passwd_callback_userdata; 905 906 s->key_update = SSL_KEY_UPDATE_NONE; 907 908 if (!IS_QUIC_CTX(ctx)) { 909 s->allow_early_data_cb = ctx->allow_early_data_cb; 910 s->allow_early_data_cb_data = ctx->allow_early_data_cb_data; 911 } 912 913 if (!method->ssl_init(ssl)) 914 goto sslerr; 915 916 s->server = (method->ssl_accept == ssl_undefined_function) ? 0 : 1; 917 918 if (!method->ssl_reset(ssl)) 919 goto sslerr; 920 921 #ifndef OPENSSL_NO_PSK 922 s->psk_client_callback = ctx->psk_client_callback; 923 s->psk_server_callback = ctx->psk_server_callback; 924 #endif 925 s->psk_find_session_cb = ctx->psk_find_session_cb; 926 s->psk_use_session_cb = ctx->psk_use_session_cb; 927 928 s->async_cb = ctx->async_cb; 929 s->async_cb_arg = ctx->async_cb_arg; 930 931 s->job = NULL; 932 933 #ifndef OPENSSL_NO_COMP_ALG 934 memcpy(s->cert_comp_prefs, ctx->cert_comp_prefs, sizeof(s->cert_comp_prefs)); 935 #endif 936 if (ctx->client_cert_type != NULL) { 937 s->client_cert_type = OPENSSL_memdup(ctx->client_cert_type, 938 ctx->client_cert_type_len); 939 if (s->client_cert_type == NULL) 940 goto sslerr; 941 s->client_cert_type_len = ctx->client_cert_type_len; 942 } 943 if (ctx->server_cert_type != NULL) { 944 s->server_cert_type = OPENSSL_memdup(ctx->server_cert_type, 945 ctx->server_cert_type_len); 946 if (s->server_cert_type == NULL) 947 goto sslerr; 948 s->server_cert_type_len = ctx->server_cert_type_len; 949 } 950 951 #ifndef OPENSSL_NO_CT 952 if (!SSL_set_ct_validation_callback(ssl, ctx->ct_validation_callback, 953 ctx->ct_validation_callback_arg)) 954 goto sslerr; 955 #endif 956 957 s->ssl_pkey_num = SSL_PKEY_NUM + ctx->sigalg_list_len; 958 return ssl; 959 cerr: 960 ERR_raise(ERR_LIB_SSL, ERR_R_CRYPTO_LIB); 961 goto err; 962 asn1err: 963 ERR_raise(ERR_LIB_SSL, ERR_R_ASN1_LIB); 964 goto err; 965 sslerr: 966 ERR_raise(ERR_LIB_SSL, ERR_R_SSL_LIB); 967 err: 968 SSL_free(ssl); 969 return NULL; 970 } 971 972 SSL *ossl_ssl_connection_new(SSL_CTX *ctx) 973 { 974 return ossl_ssl_connection_new_int(ctx, NULL, ctx->method); 975 } 976 977 int SSL_is_dtls(const SSL *s) 978 { 979 SSL_CONNECTION *sc = SSL_CONNECTION_FROM_SSL(s); 980 981 #ifndef OPENSSL_NO_QUIC 982 if (s->type == SSL_TYPE_QUIC_CONNECTION || s->type == SSL_TYPE_QUIC_XSO) 983 return 0; 984 #endif 985 986 if (sc == NULL) 987 return 0; 988 989 return SSL_CONNECTION_IS_DTLS(sc) ? 1 : 0; 990 } 991 992 int SSL_is_tls(const SSL *s) 993 { 994 SSL_CONNECTION *sc = SSL_CONNECTION_FROM_SSL(s); 995 996 #ifndef OPENSSL_NO_QUIC 997 if (s->type == SSL_TYPE_QUIC_CONNECTION || s->type == SSL_TYPE_QUIC_XSO) 998 return 0; 999 #endif 1000 1001 if (sc == NULL) 1002 return 0; 1003 1004 return SSL_CONNECTION_IS_DTLS(sc) ? 0 : 1; 1005 } 1006 1007 int SSL_is_quic(const SSL *s) 1008 { 1009 return IS_QUIC(s); 1010 } 1011 1012 int SSL_CTX_is_quic(const SSL_CTX *c) 1013 { 1014 return IS_QUIC_CTX(c); 1015 } 1016 1017 int SSL_up_ref(SSL *s) 1018 { 1019 int i; 1020 1021 if (CRYPTO_UP_REF(&s->references, &i) <= 0) 1022 return 0; 1023 1024 REF_PRINT_COUNT("SSL", i, s); 1025 REF_ASSERT_ISNT(i < 2); 1026 return ((i > 1) ? 1 : 0); 1027 } 1028 1029 int SSL_CTX_set_session_id_context(SSL_CTX *ctx, const unsigned char *sid_ctx, 1030 unsigned int sid_ctx_len) 1031 { 1032 if (sid_ctx_len > SSL_MAX_SID_CTX_LENGTH) { 1033 ERR_raise(ERR_LIB_SSL, SSL_R_SSL_SESSION_ID_CONTEXT_TOO_LONG); 1034 return 0; 1035 } 1036 ctx->sid_ctx_length = sid_ctx_len; 1037 memcpy(ctx->sid_ctx, sid_ctx, sid_ctx_len); 1038 1039 return 1; 1040 } 1041 1042 int SSL_set_session_id_context(SSL *ssl, const unsigned char *sid_ctx, 1043 unsigned int sid_ctx_len) 1044 { 1045 SSL_CONNECTION *sc = SSL_CONNECTION_FROM_SSL(ssl); 1046 1047 if (sc == NULL) 1048 return 0; 1049 1050 if (sid_ctx_len > SSL_MAX_SID_CTX_LENGTH) { 1051 ERR_raise(ERR_LIB_SSL, SSL_R_SSL_SESSION_ID_CONTEXT_TOO_LONG); 1052 return 0; 1053 } 1054 sc->sid_ctx_length = sid_ctx_len; 1055 memcpy(sc->sid_ctx, sid_ctx, sid_ctx_len); 1056 1057 return 1; 1058 } 1059 1060 int SSL_CTX_set_generate_session_id(SSL_CTX *ctx, GEN_SESSION_CB cb) 1061 { 1062 if (!CRYPTO_THREAD_write_lock(ctx->lock)) 1063 return 0; 1064 ctx->generate_session_id = cb; 1065 CRYPTO_THREAD_unlock(ctx->lock); 1066 return 1; 1067 } 1068 1069 int SSL_set_generate_session_id(SSL *ssl, GEN_SESSION_CB cb) 1070 { 1071 SSL_CONNECTION *sc = SSL_CONNECTION_FROM_SSL(ssl); 1072 1073 if (sc == NULL || !CRYPTO_THREAD_write_lock(ssl->lock)) 1074 return 0; 1075 sc->generate_session_id = cb; 1076 CRYPTO_THREAD_unlock(ssl->lock); 1077 return 1; 1078 } 1079 1080 int SSL_has_matching_session_id(const SSL *ssl, const unsigned char *id, 1081 unsigned int id_len) 1082 { 1083 /* 1084 * A quick examination of SSL_SESSION_hash and SSL_SESSION_cmp shows how 1085 * we can "construct" a session to give us the desired check - i.e. to 1086 * find if there's a session in the hash table that would conflict with 1087 * any new session built out of this id/id_len and the ssl_version in use 1088 * by this SSL. 1089 */ 1090 SSL_SESSION r, *p; 1091 const SSL_CONNECTION *sc = SSL_CONNECTION_FROM_CONST_SSL(ssl); 1092 1093 if (sc == NULL || id_len > sizeof(r.session_id)) 1094 return 0; 1095 1096 r.ssl_version = sc->version; 1097 r.session_id_length = id_len; 1098 memcpy(r.session_id, id, id_len); 1099 1100 if (!CRYPTO_THREAD_read_lock(sc->session_ctx->lock)) 1101 return 0; 1102 p = lh_SSL_SESSION_retrieve(sc->session_ctx->sessions, &r); 1103 CRYPTO_THREAD_unlock(sc->session_ctx->lock); 1104 return (p != NULL); 1105 } 1106 1107 int SSL_CTX_set_purpose(SSL_CTX *s, int purpose) 1108 { 1109 return X509_VERIFY_PARAM_set_purpose(s->param, purpose); 1110 } 1111 1112 int SSL_set_purpose(SSL *s, int purpose) 1113 { 1114 SSL_CONNECTION *sc = SSL_CONNECTION_FROM_SSL(s); 1115 1116 if (sc == NULL) 1117 return 0; 1118 1119 return X509_VERIFY_PARAM_set_purpose(sc->param, purpose); 1120 } 1121 1122 int SSL_CTX_set_trust(SSL_CTX *s, int trust) 1123 { 1124 return X509_VERIFY_PARAM_set_trust(s->param, trust); 1125 } 1126 1127 int SSL_set_trust(SSL *s, int trust) 1128 { 1129 SSL_CONNECTION *sc = SSL_CONNECTION_FROM_SSL(s); 1130 1131 if (sc == NULL) 1132 return 0; 1133 1134 return X509_VERIFY_PARAM_set_trust(sc->param, trust); 1135 } 1136 1137 int SSL_set1_host(SSL *s, const char *host) 1138 { 1139 SSL_CONNECTION *sc = SSL_CONNECTION_FROM_SSL(s); 1140 1141 if (sc == NULL) 1142 return 0; 1143 1144 /* clear hostname(s) and IP address in any case, also if host parses as an IP address */ 1145 (void)X509_VERIFY_PARAM_set1_host(sc->param, NULL, 0); 1146 (void)X509_VERIFY_PARAM_set1_ip(sc->param, NULL, 0); 1147 if (host == NULL) 1148 return 1; 1149 1150 /* If a host is provided and parses as an IP address, treat it as such. */ 1151 return X509_VERIFY_PARAM_set1_ip_asc(sc->param, host) 1152 || X509_VERIFY_PARAM_set1_host(sc->param, host, 0); 1153 } 1154 1155 int SSL_add1_host(SSL *s, const char *host) 1156 { 1157 SSL_CONNECTION *sc = SSL_CONNECTION_FROM_SSL(s); 1158 1159 if (sc == NULL) 1160 return 0; 1161 1162 /* If a host is provided and parses as an IP address, treat it as such. */ 1163 if (host != NULL) { 1164 ASN1_OCTET_STRING *ip; 1165 char *old_ip; 1166 1167 ip = a2i_IPADDRESS(host); 1168 if (ip != NULL) { 1169 /* We didn't want it; only to check if it *is* an IP address */ 1170 ASN1_OCTET_STRING_free(ip); 1171 1172 old_ip = X509_VERIFY_PARAM_get1_ip_asc(sc->param); 1173 if (old_ip != NULL) { 1174 OPENSSL_free(old_ip); 1175 /* There can be only one IP address */ 1176 ERR_raise_data(ERR_LIB_SSL, ERR_R_PASSED_INVALID_ARGUMENT, 1177 "IP address was already set"); 1178 return 0; 1179 } 1180 1181 return X509_VERIFY_PARAM_set1_ip_asc(sc->param, host); 1182 } 1183 } 1184 1185 return X509_VERIFY_PARAM_add1_host(sc->param, host, 0); 1186 } 1187 1188 void SSL_set_hostflags(SSL *s, unsigned int flags) 1189 { 1190 SSL_CONNECTION *sc = SSL_CONNECTION_FROM_SSL(s); 1191 1192 if (sc == NULL) 1193 return; 1194 1195 X509_VERIFY_PARAM_set_hostflags(sc->param, flags); 1196 } 1197 1198 const char *SSL_get0_peername(SSL *s) 1199 { 1200 SSL_CONNECTION *sc = SSL_CONNECTION_FROM_SSL(s); 1201 1202 if (sc == NULL) 1203 return NULL; 1204 1205 return X509_VERIFY_PARAM_get0_peername(sc->param); 1206 } 1207 1208 int SSL_CTX_dane_enable(SSL_CTX *ctx) 1209 { 1210 return dane_ctx_enable(&ctx->dane); 1211 } 1212 1213 unsigned long SSL_CTX_dane_set_flags(SSL_CTX *ctx, unsigned long flags) 1214 { 1215 unsigned long orig = ctx->dane.flags; 1216 1217 ctx->dane.flags |= flags; 1218 return orig; 1219 } 1220 1221 unsigned long SSL_CTX_dane_clear_flags(SSL_CTX *ctx, unsigned long flags) 1222 { 1223 unsigned long orig = ctx->dane.flags; 1224 1225 ctx->dane.flags &= ~flags; 1226 return orig; 1227 } 1228 1229 int SSL_dane_enable(SSL *s, const char *basedomain) 1230 { 1231 SSL_DANE *dane; 1232 SSL_CONNECTION *sc = SSL_CONNECTION_FROM_SSL(s); 1233 1234 if (sc == NULL) 1235 return 0; 1236 1237 dane = &sc->dane; 1238 if (s->ctx->dane.mdmax == 0) { 1239 ERR_raise(ERR_LIB_SSL, SSL_R_CONTEXT_NOT_DANE_ENABLED); 1240 return 0; 1241 } 1242 if (dane->trecs != NULL) { 1243 ERR_raise(ERR_LIB_SSL, SSL_R_DANE_ALREADY_ENABLED); 1244 return 0; 1245 } 1246 1247 /* 1248 * Default SNI name. This rejects empty names, while set1_host below 1249 * accepts them and disables hostname checks. To avoid side-effects with 1250 * invalid input, set the SNI name first. 1251 */ 1252 if (sc->ext.hostname == NULL) { 1253 if (!SSL_set_tlsext_host_name(s, basedomain)) { 1254 ERR_raise(ERR_LIB_SSL, SSL_R_ERROR_SETTING_TLSA_BASE_DOMAIN); 1255 return -1; 1256 } 1257 } 1258 1259 /* Primary RFC6125 reference identifier */ 1260 if (!X509_VERIFY_PARAM_set1_host(sc->param, basedomain, 0)) { 1261 ERR_raise(ERR_LIB_SSL, SSL_R_ERROR_SETTING_TLSA_BASE_DOMAIN); 1262 return -1; 1263 } 1264 1265 dane->mdpth = -1; 1266 dane->pdpth = -1; 1267 dane->dctx = &s->ctx->dane; 1268 dane->trecs = sk_danetls_record_new_null(); 1269 1270 if (dane->trecs == NULL) { 1271 ERR_raise(ERR_LIB_SSL, ERR_R_CRYPTO_LIB); 1272 return -1; 1273 } 1274 return 1; 1275 } 1276 1277 unsigned long SSL_dane_set_flags(SSL *ssl, unsigned long flags) 1278 { 1279 unsigned long orig; 1280 SSL_CONNECTION *sc = SSL_CONNECTION_FROM_SSL(ssl); 1281 1282 if (sc == NULL) 1283 return 0; 1284 1285 orig = sc->dane.flags; 1286 1287 sc->dane.flags |= flags; 1288 return orig; 1289 } 1290 1291 unsigned long SSL_dane_clear_flags(SSL *ssl, unsigned long flags) 1292 { 1293 unsigned long orig; 1294 SSL_CONNECTION *sc = SSL_CONNECTION_FROM_SSL(ssl); 1295 1296 if (sc == NULL) 1297 return 0; 1298 1299 orig = sc->dane.flags; 1300 1301 sc->dane.flags &= ~flags; 1302 return orig; 1303 } 1304 1305 int SSL_get0_dane_authority(SSL *s, X509 **mcert, EVP_PKEY **mspki) 1306 { 1307 SSL_DANE *dane; 1308 SSL_CONNECTION *sc = SSL_CONNECTION_FROM_SSL(s); 1309 1310 if (sc == NULL) 1311 return -1; 1312 1313 dane = &sc->dane; 1314 1315 if (!DANETLS_ENABLED(dane) || sc->verify_result != X509_V_OK) 1316 return -1; 1317 if (dane->mtlsa) { 1318 if (mcert) 1319 *mcert = dane->mcert; 1320 if (mspki) 1321 *mspki = (dane->mcert == NULL) ? dane->mtlsa->spki : NULL; 1322 } 1323 return dane->mdpth; 1324 } 1325 1326 int SSL_get0_dane_tlsa(SSL *s, uint8_t *usage, uint8_t *selector, 1327 uint8_t *mtype, const unsigned char **data, size_t *dlen) 1328 { 1329 SSL_DANE *dane; 1330 SSL_CONNECTION *sc = SSL_CONNECTION_FROM_SSL(s); 1331 1332 if (sc == NULL) 1333 return -1; 1334 1335 dane = &sc->dane; 1336 1337 if (!DANETLS_ENABLED(dane) || sc->verify_result != X509_V_OK) 1338 return -1; 1339 if (dane->mtlsa) { 1340 if (usage) 1341 *usage = dane->mtlsa->usage; 1342 if (selector) 1343 *selector = dane->mtlsa->selector; 1344 if (mtype) 1345 *mtype = dane->mtlsa->mtype; 1346 if (data) 1347 *data = dane->mtlsa->data; 1348 if (dlen) 1349 *dlen = dane->mtlsa->dlen; 1350 } 1351 return dane->mdpth; 1352 } 1353 1354 SSL_DANE *SSL_get0_dane(SSL *s) 1355 { 1356 SSL_CONNECTION *sc = SSL_CONNECTION_FROM_SSL(s); 1357 1358 if (sc == NULL) 1359 return NULL; 1360 1361 return &sc->dane; 1362 } 1363 1364 int SSL_dane_tlsa_add(SSL *s, uint8_t usage, uint8_t selector, 1365 uint8_t mtype, const unsigned char *data, size_t dlen) 1366 { 1367 SSL_CONNECTION *sc = SSL_CONNECTION_FROM_SSL(s); 1368 1369 if (sc == NULL) 1370 return 0; 1371 1372 return dane_tlsa_add(&sc->dane, usage, selector, mtype, data, dlen); 1373 } 1374 1375 int SSL_CTX_dane_mtype_set(SSL_CTX *ctx, const EVP_MD *md, uint8_t mtype, 1376 uint8_t ord) 1377 { 1378 return dane_mtype_set(&ctx->dane, md, mtype, ord); 1379 } 1380 1381 int SSL_CTX_set1_param(SSL_CTX *ctx, X509_VERIFY_PARAM *vpm) 1382 { 1383 return X509_VERIFY_PARAM_set1(ctx->param, vpm); 1384 } 1385 1386 int SSL_set1_param(SSL *ssl, X509_VERIFY_PARAM *vpm) 1387 { 1388 SSL_CONNECTION *sc = SSL_CONNECTION_FROM_SSL(ssl); 1389 1390 if (sc == NULL) 1391 return 0; 1392 1393 return X509_VERIFY_PARAM_set1(sc->param, vpm); 1394 } 1395 1396 X509_VERIFY_PARAM *SSL_CTX_get0_param(SSL_CTX *ctx) 1397 { 1398 return ctx->param; 1399 } 1400 1401 X509_VERIFY_PARAM *SSL_get0_param(SSL *ssl) 1402 { 1403 SSL_CONNECTION *sc = SSL_CONNECTION_FROM_SSL(ssl); 1404 1405 if (sc == NULL) 1406 return NULL; 1407 1408 return sc->param; 1409 } 1410 1411 void SSL_certs_clear(SSL *s) 1412 { 1413 SSL_CONNECTION *sc = SSL_CONNECTION_FROM_SSL(s); 1414 1415 if (sc == NULL) 1416 return; 1417 1418 ssl_cert_clear_certs(sc->cert); 1419 } 1420 1421 void SSL_free(SSL *s) 1422 { 1423 int i; 1424 1425 if (s == NULL) 1426 return; 1427 CRYPTO_DOWN_REF(&s->references, &i); 1428 REF_PRINT_COUNT("SSL", i, s); 1429 if (i > 0) 1430 return; 1431 REF_ASSERT_ISNT(i < 0); 1432 1433 if (s->method != NULL) 1434 s->method->ssl_free(s); 1435 1436 CRYPTO_free_ex_data(CRYPTO_EX_INDEX_SSL, s, &s->ex_data); 1437 SSL_CTX_free(s->ctx); 1438 CRYPTO_THREAD_lock_free(s->lock); 1439 CRYPTO_FREE_REF(&s->references); 1440 1441 OPENSSL_free(s); 1442 } 1443 1444 void ossl_ssl_connection_free(SSL *ssl) 1445 { 1446 SSL_CONNECTION *s; 1447 1448 s = SSL_CONNECTION_FROM_SSL_ONLY(ssl); 1449 if (s == NULL) 1450 return; 1451 1452 /* 1453 * Ignore return values. This could result in user callbacks being called 1454 * e.g. for the QUIC TLS record layer. So we do this early before we have 1455 * freed other things. 1456 */ 1457 ssl_free_wbio_buffer(s); 1458 RECORD_LAYER_clear(&s->rlayer); 1459 1460 X509_VERIFY_PARAM_free(s->param); 1461 dane_final(&s->dane); 1462 1463 BUF_MEM_free(s->init_buf); 1464 1465 /* add extra stuff */ 1466 sk_SSL_CIPHER_free(s->cipher_list); 1467 sk_SSL_CIPHER_free(s->cipher_list_by_id); 1468 sk_SSL_CIPHER_free(s->tls13_ciphersuites); 1469 sk_SSL_CIPHER_free(s->peer_ciphers); 1470 1471 /* Make the next call work :-) */ 1472 if (s->session != NULL) { 1473 ssl_clear_bad_session(s); 1474 SSL_SESSION_free(s->session); 1475 } 1476 SSL_SESSION_free(s->psksession); 1477 OPENSSL_free(s->psksession_id); 1478 1479 ssl_cert_free(s->cert); 1480 OPENSSL_free(s->shared_sigalgs); 1481 /* Free up if allocated */ 1482 1483 OPENSSL_free(s->ext.hostname); 1484 SSL_CTX_free(s->session_ctx); 1485 OPENSSL_free(s->ext.ecpointformats); 1486 OPENSSL_free(s->ext.peer_ecpointformats); 1487 OPENSSL_free(s->ext.supportedgroups); 1488 OPENSSL_free(s->ext.keyshares); 1489 OPENSSL_free(s->ext.tuples); 1490 OPENSSL_free(s->ext.peer_supportedgroups); 1491 sk_X509_EXTENSION_pop_free(s->ext.ocsp.exts, X509_EXTENSION_free); 1492 #ifndef OPENSSL_NO_OCSP 1493 sk_OCSP_RESPID_pop_free(s->ext.ocsp.ids, OCSP_RESPID_free); 1494 #endif 1495 #ifndef OPENSSL_NO_CT 1496 SCT_LIST_free(s->scts); 1497 OPENSSL_free(s->ext.scts); 1498 #endif 1499 OPENSSL_free(s->ext.ocsp.resp); 1500 OPENSSL_free(s->ext.alpn); 1501 OPENSSL_free(s->ext.tls13_cookie); 1502 if (s->clienthello != NULL) 1503 OPENSSL_free(s->clienthello->pre_proc_exts); 1504 OPENSSL_free(s->clienthello); 1505 OPENSSL_free(s->pha_context); 1506 EVP_MD_CTX_free(s->pha_dgst); 1507 1508 sk_X509_NAME_pop_free(s->ca_names, X509_NAME_free); 1509 sk_X509_NAME_pop_free(s->client_ca_names, X509_NAME_free); 1510 1511 OPENSSL_free(s->client_cert_type); 1512 OPENSSL_free(s->server_cert_type); 1513 1514 OSSL_STACK_OF_X509_free(s->verified_chain); 1515 1516 if (ssl->method != NULL) 1517 ssl->method->ssl_deinit(ssl); 1518 1519 ASYNC_WAIT_CTX_free(s->waitctx); 1520 1521 #if !defined(OPENSSL_NO_NEXTPROTONEG) 1522 OPENSSL_free(s->ext.npn); 1523 #endif 1524 1525 #ifndef OPENSSL_NO_SRTP 1526 sk_SRTP_PROTECTION_PROFILE_free(s->srtp_profiles); 1527 #endif 1528 1529 /* 1530 * We do this late. We want to ensure that any other references we held to 1531 * these BIOs are freed first *before* we call BIO_free_all(), because 1532 * BIO_free_all() will only free each BIO in the chain if the number of 1533 * references to the first BIO have dropped to 0 1534 */ 1535 BIO_free_all(s->wbio); 1536 s->wbio = NULL; 1537 BIO_free_all(s->rbio); 1538 s->rbio = NULL; 1539 OPENSSL_free(s->s3.tmp.valid_flags); 1540 } 1541 1542 void SSL_set0_rbio(SSL *s, BIO *rbio) 1543 { 1544 SSL_CONNECTION *sc = SSL_CONNECTION_FROM_SSL(s); 1545 1546 #ifndef OPENSSL_NO_QUIC 1547 if (IS_QUIC(s)) { 1548 ossl_quic_conn_set0_net_rbio(s, rbio); 1549 return; 1550 } 1551 #endif 1552 1553 if (sc == NULL) 1554 return; 1555 1556 BIO_free_all(sc->rbio); 1557 sc->rbio = rbio; 1558 sc->rlayer.rrlmethod->set1_bio(sc->rlayer.rrl, sc->rbio); 1559 } 1560 1561 void SSL_set0_wbio(SSL *s, BIO *wbio) 1562 { 1563 SSL_CONNECTION *sc = SSL_CONNECTION_FROM_SSL(s); 1564 1565 #ifndef OPENSSL_NO_QUIC 1566 if (IS_QUIC(s)) { 1567 ossl_quic_conn_set0_net_wbio(s, wbio); 1568 return; 1569 } 1570 #endif 1571 1572 if (sc == NULL) 1573 return; 1574 1575 /* 1576 * If the output buffering BIO is still in place, remove it 1577 */ 1578 if (sc->bbio != NULL) 1579 sc->wbio = BIO_pop(sc->wbio); 1580 1581 BIO_free_all(sc->wbio); 1582 sc->wbio = wbio; 1583 1584 /* Re-attach |bbio| to the new |wbio|. */ 1585 if (sc->bbio != NULL) 1586 sc->wbio = BIO_push(sc->bbio, sc->wbio); 1587 1588 sc->rlayer.wrlmethod->set1_bio(sc->rlayer.wrl, sc->wbio); 1589 } 1590 1591 void SSL_set_bio(SSL *s, BIO *rbio, BIO *wbio) 1592 { 1593 /* 1594 * For historical reasons, this function has many different cases in 1595 * ownership handling. 1596 */ 1597 1598 /* If nothing has changed, do nothing */ 1599 if (rbio == SSL_get_rbio(s) && wbio == SSL_get_wbio(s)) 1600 return; 1601 1602 /* 1603 * If the two arguments are equal then one fewer reference is granted by the 1604 * caller than we want to take 1605 */ 1606 if (rbio != NULL && rbio == wbio) { 1607 if (!BIO_up_ref(rbio)) 1608 return; 1609 } 1610 1611 /* 1612 * If only the wbio is changed only adopt one reference. 1613 */ 1614 if (rbio == SSL_get_rbio(s)) { 1615 SSL_set0_wbio(s, wbio); 1616 return; 1617 } 1618 /* 1619 * There is an asymmetry here for historical reasons. If only the rbio is 1620 * changed AND the rbio and wbio were originally different, then we only 1621 * adopt one reference. 1622 */ 1623 if (wbio == SSL_get_wbio(s) && SSL_get_rbio(s) != SSL_get_wbio(s)) { 1624 SSL_set0_rbio(s, rbio); 1625 return; 1626 } 1627 1628 /* Otherwise, adopt both references. */ 1629 SSL_set0_rbio(s, rbio); 1630 SSL_set0_wbio(s, wbio); 1631 } 1632 1633 BIO *SSL_get_rbio(const SSL *s) 1634 { 1635 const SSL_CONNECTION *sc = SSL_CONNECTION_FROM_CONST_SSL(s); 1636 1637 #ifndef OPENSSL_NO_QUIC 1638 if (IS_QUIC(s)) 1639 return ossl_quic_conn_get_net_rbio(s); 1640 #endif 1641 1642 if (sc == NULL) 1643 return NULL; 1644 1645 return sc->rbio; 1646 } 1647 1648 BIO *SSL_get_wbio(const SSL *s) 1649 { 1650 const SSL_CONNECTION *sc = SSL_CONNECTION_FROM_CONST_SSL(s); 1651 1652 #ifndef OPENSSL_NO_QUIC 1653 if (IS_QUIC(s)) 1654 return ossl_quic_conn_get_net_wbio(s); 1655 #endif 1656 1657 if (sc == NULL) 1658 return NULL; 1659 1660 if (sc->bbio != NULL) { 1661 /* 1662 * If |bbio| is active, the true caller-configured BIO is its 1663 * |next_bio|. 1664 */ 1665 return BIO_next(sc->bbio); 1666 } 1667 return sc->wbio; 1668 } 1669 1670 int SSL_get_fd(const SSL *s) 1671 { 1672 return SSL_get_rfd(s); 1673 } 1674 1675 int SSL_get_rfd(const SSL *s) 1676 { 1677 int ret = -1; 1678 BIO *b, *r; 1679 1680 b = SSL_get_rbio(s); 1681 r = BIO_find_type(b, BIO_TYPE_DESCRIPTOR); 1682 if (r != NULL) 1683 BIO_get_fd(r, &ret); 1684 return ret; 1685 } 1686 1687 int SSL_get_wfd(const SSL *s) 1688 { 1689 int ret = -1; 1690 BIO *b, *r; 1691 1692 b = SSL_get_wbio(s); 1693 r = BIO_find_type(b, BIO_TYPE_DESCRIPTOR); 1694 if (r != NULL) 1695 BIO_get_fd(r, &ret); 1696 return ret; 1697 } 1698 1699 #ifndef OPENSSL_NO_SOCK 1700 static const BIO_METHOD *fd_method(SSL *s) 1701 { 1702 #ifndef OPENSSL_NO_DGRAM 1703 if (IS_QUIC(s)) 1704 return BIO_s_datagram(); 1705 #endif 1706 1707 return BIO_s_socket(); 1708 } 1709 1710 int SSL_set_fd(SSL *s, int fd) 1711 { 1712 int ret = 0; 1713 BIO *bio = NULL; 1714 1715 if (s->type == SSL_TYPE_QUIC_XSO) { 1716 ERR_raise(ERR_LIB_SSL, SSL_R_CONN_USE_ONLY); 1717 goto err; 1718 } 1719 1720 bio = BIO_new(fd_method(s)); 1721 1722 if (bio == NULL) { 1723 ERR_raise(ERR_LIB_SSL, ERR_R_BUF_LIB); 1724 goto err; 1725 } 1726 BIO_set_fd(bio, fd, BIO_NOCLOSE); 1727 SSL_set_bio(s, bio, bio); 1728 ret = 1; 1729 err: 1730 return ret; 1731 } 1732 1733 int SSL_set_wfd(SSL *s, int fd) 1734 { 1735 BIO *rbio = SSL_get_rbio(s); 1736 int desired_type = IS_QUIC(s) ? BIO_TYPE_DGRAM : BIO_TYPE_SOCKET; 1737 1738 if (s->type == SSL_TYPE_QUIC_XSO) { 1739 ERR_raise(ERR_LIB_SSL, SSL_R_CONN_USE_ONLY); 1740 return 0; 1741 } 1742 1743 if (rbio == NULL || BIO_method_type(rbio) != desired_type 1744 || (int)BIO_get_fd(rbio, NULL) != fd) { 1745 BIO *bio = BIO_new(fd_method(s)); 1746 1747 if (bio == NULL) { 1748 ERR_raise(ERR_LIB_SSL, ERR_R_BUF_LIB); 1749 return 0; 1750 } 1751 BIO_set_fd(bio, fd, BIO_NOCLOSE); 1752 SSL_set0_wbio(s, bio); 1753 } else { 1754 if (!BIO_up_ref(rbio)) 1755 return 0; 1756 SSL_set0_wbio(s, rbio); 1757 } 1758 return 1; 1759 } 1760 1761 int SSL_set_rfd(SSL *s, int fd) 1762 { 1763 BIO *wbio = SSL_get_wbio(s); 1764 int desired_type = IS_QUIC(s) ? BIO_TYPE_DGRAM : BIO_TYPE_SOCKET; 1765 1766 if (s->type == SSL_TYPE_QUIC_XSO) { 1767 ERR_raise(ERR_LIB_SSL, SSL_R_CONN_USE_ONLY); 1768 return 0; 1769 } 1770 1771 if (wbio == NULL || BIO_method_type(wbio) != desired_type 1772 || ((int)BIO_get_fd(wbio, NULL) != fd)) { 1773 BIO *bio = BIO_new(fd_method(s)); 1774 1775 if (bio == NULL) { 1776 ERR_raise(ERR_LIB_SSL, ERR_R_BUF_LIB); 1777 return 0; 1778 } 1779 BIO_set_fd(bio, fd, BIO_NOCLOSE); 1780 SSL_set0_rbio(s, bio); 1781 } else { 1782 if (!BIO_up_ref(wbio)) 1783 return 0; 1784 SSL_set0_rbio(s, wbio); 1785 } 1786 1787 return 1; 1788 } 1789 #endif 1790 1791 /* return length of latest Finished message we sent, copy to 'buf' */ 1792 size_t SSL_get_finished(const SSL *s, void *buf, size_t count) 1793 { 1794 size_t ret = 0; 1795 const SSL_CONNECTION *sc = SSL_CONNECTION_FROM_CONST_SSL(s); 1796 1797 if (sc == NULL) 1798 return 0; 1799 1800 ret = sc->s3.tmp.finish_md_len; 1801 if (count > ret) 1802 count = ret; 1803 memcpy(buf, sc->s3.tmp.finish_md, count); 1804 return ret; 1805 } 1806 1807 /* return length of latest Finished message we expected, copy to 'buf' */ 1808 size_t SSL_get_peer_finished(const SSL *s, void *buf, size_t count) 1809 { 1810 size_t ret = 0; 1811 const SSL_CONNECTION *sc = SSL_CONNECTION_FROM_CONST_SSL(s); 1812 1813 if (sc == NULL) 1814 return 0; 1815 1816 ret = sc->s3.tmp.peer_finish_md_len; 1817 if (count > ret) 1818 count = ret; 1819 memcpy(buf, sc->s3.tmp.peer_finish_md, count); 1820 return ret; 1821 } 1822 1823 int SSL_get_verify_mode(const SSL *s) 1824 { 1825 const SSL_CONNECTION *sc = SSL_CONNECTION_FROM_CONST_SSL(s); 1826 1827 if (sc == NULL) 1828 return 0; 1829 1830 return sc->verify_mode; 1831 } 1832 1833 int SSL_get_verify_depth(const SSL *s) 1834 { 1835 const SSL_CONNECTION *sc = SSL_CONNECTION_FROM_CONST_SSL(s); 1836 1837 if (sc == NULL) 1838 return 0; 1839 1840 return X509_VERIFY_PARAM_get_depth(sc->param); 1841 } 1842 1843 int (*SSL_get_verify_callback(const SSL *s))(int, X509_STORE_CTX *) 1844 { 1845 const SSL_CONNECTION *sc = SSL_CONNECTION_FROM_CONST_SSL(s); 1846 1847 if (sc == NULL) 1848 return NULL; 1849 1850 return sc->verify_callback; 1851 } 1852 1853 int SSL_CTX_get_verify_mode(const SSL_CTX *ctx) 1854 { 1855 return ctx->verify_mode; 1856 } 1857 1858 int SSL_CTX_get_verify_depth(const SSL_CTX *ctx) 1859 { 1860 return X509_VERIFY_PARAM_get_depth(ctx->param); 1861 } 1862 1863 int (*SSL_CTX_get_verify_callback(const SSL_CTX *ctx))(int, X509_STORE_CTX *) 1864 { 1865 return ctx->default_verify_callback; 1866 } 1867 1868 void SSL_set_verify(SSL *s, int mode, 1869 int (*callback)(int ok, X509_STORE_CTX *ctx)) 1870 { 1871 SSL_CONNECTION *sc = SSL_CONNECTION_FROM_SSL(s); 1872 1873 if (sc == NULL) 1874 return; 1875 1876 sc->verify_mode = mode; 1877 if (callback != NULL) 1878 sc->verify_callback = callback; 1879 } 1880 1881 void SSL_set_verify_depth(SSL *s, int depth) 1882 { 1883 SSL_CONNECTION *sc = SSL_CONNECTION_FROM_SSL(s); 1884 1885 if (sc == NULL) 1886 return; 1887 1888 X509_VERIFY_PARAM_set_depth(sc->param, depth); 1889 } 1890 1891 void SSL_set_read_ahead(SSL *s, int yes) 1892 { 1893 SSL_CONNECTION *sc = SSL_CONNECTION_FROM_SSL_ONLY(s); 1894 OSSL_PARAM options[2], *opts = options; 1895 1896 if (sc == NULL) 1897 return; 1898 1899 RECORD_LAYER_set_read_ahead(&sc->rlayer, yes); 1900 1901 *opts++ = OSSL_PARAM_construct_int(OSSL_LIBSSL_RECORD_LAYER_PARAM_READ_AHEAD, 1902 &sc->rlayer.read_ahead); 1903 *opts = OSSL_PARAM_construct_end(); 1904 1905 /* Ignore return value */ 1906 sc->rlayer.rrlmethod->set_options(sc->rlayer.rrl, options); 1907 } 1908 1909 int SSL_get_read_ahead(const SSL *s) 1910 { 1911 const SSL_CONNECTION *sc = SSL_CONNECTION_FROM_CONST_SSL_ONLY(s); 1912 1913 if (sc == NULL) 1914 return 0; 1915 1916 return RECORD_LAYER_get_read_ahead(&sc->rlayer); 1917 } 1918 1919 int SSL_pending(const SSL *s) 1920 { 1921 size_t pending = s->method->ssl_pending(s); 1922 1923 /* 1924 * SSL_pending cannot work properly if read-ahead is enabled 1925 * (SSL_[CTX_]ctrl(..., SSL_CTRL_SET_READ_AHEAD, 1, NULL)), and it is 1926 * impossible to fix since SSL_pending cannot report errors that may be 1927 * observed while scanning the new data. (Note that SSL_pending() is 1928 * often used as a boolean value, so we'd better not return -1.) 1929 * 1930 * SSL_pending also cannot work properly if the value >INT_MAX. In that case 1931 * we just return INT_MAX. 1932 */ 1933 return pending < INT_MAX ? (int)pending : INT_MAX; 1934 } 1935 1936 int SSL_has_pending(const SSL *s) 1937 { 1938 /* 1939 * Similar to SSL_pending() but returns a 1 to indicate that we have 1940 * processed or unprocessed data available or 0 otherwise (as opposed to the 1941 * number of bytes available). Unlike SSL_pending() this will take into 1942 * account read_ahead data. A 1 return simply indicates that we have data. 1943 * That data may not result in any application data, or we may fail to parse 1944 * the records for some reason. 1945 */ 1946 const SSL_CONNECTION *sc; 1947 1948 #ifndef OPENSSL_NO_QUIC 1949 if (IS_QUIC(s)) 1950 return ossl_quic_has_pending(s); 1951 #endif 1952 1953 sc = SSL_CONNECTION_FROM_CONST_SSL(s); 1954 1955 /* Check buffered app data if any first */ 1956 if (SSL_CONNECTION_IS_DTLS(sc)) { 1957 TLS_RECORD *rdata; 1958 pitem *item, *iter; 1959 1960 iter = pqueue_iterator(sc->rlayer.d->buffered_app_data); 1961 while ((item = pqueue_next(&iter)) != NULL) { 1962 rdata = item->data; 1963 if (rdata->length > 0) 1964 return 1; 1965 } 1966 } 1967 1968 if (RECORD_LAYER_processed_read_pending(&sc->rlayer)) 1969 return 1; 1970 1971 return RECORD_LAYER_read_pending(&sc->rlayer); 1972 } 1973 1974 X509 *SSL_get1_peer_certificate(const SSL *s) 1975 { 1976 X509 *r = SSL_get0_peer_certificate(s); 1977 1978 if (r != NULL && !X509_up_ref(r)) 1979 return NULL; 1980 1981 return r; 1982 } 1983 1984 X509 *SSL_get0_peer_certificate(const SSL *s) 1985 { 1986 const SSL_CONNECTION *sc = SSL_CONNECTION_FROM_CONST_SSL(s); 1987 1988 if (sc == NULL) 1989 return NULL; 1990 1991 if (sc->session == NULL) 1992 return NULL; 1993 else 1994 return sc->session->peer; 1995 } 1996 1997 STACK_OF(X509) *SSL_get_peer_cert_chain(const SSL *s) 1998 { 1999 STACK_OF(X509) *r; 2000 const SSL_CONNECTION *sc = SSL_CONNECTION_FROM_CONST_SSL(s); 2001 2002 if (sc == NULL) 2003 return NULL; 2004 2005 if (sc->session == NULL) 2006 r = NULL; 2007 else 2008 r = sc->session->peer_chain; 2009 2010 /* 2011 * If we are a client, cert_chain includes the peer's own certificate; if 2012 * we are a server, it does not. 2013 */ 2014 2015 return r; 2016 } 2017 2018 /* 2019 * Now in theory, since the calling process own 't' it should be safe to 2020 * modify. We need to be able to read f without being hassled 2021 */ 2022 int SSL_copy_session_id(SSL *t, const SSL *f) 2023 { 2024 int i; 2025 /* TODO(QUIC FUTURE): Not allowed for QUIC currently. */ 2026 SSL_CONNECTION *tsc = SSL_CONNECTION_FROM_SSL_ONLY(t); 2027 const SSL_CONNECTION *fsc = SSL_CONNECTION_FROM_CONST_SSL_ONLY(f); 2028 2029 if (tsc == NULL || fsc == NULL) 2030 return 0; 2031 2032 /* Do we need to do SSL locking? */ 2033 if (!SSL_set_session(t, SSL_get_session(f))) { 2034 return 0; 2035 } 2036 2037 /* 2038 * what if we are setup for one protocol version but want to talk another 2039 */ 2040 if (t->method != f->method) { 2041 t->method->ssl_deinit(t); 2042 t->method = f->method; 2043 if (t->method->ssl_init(t) == 0) 2044 return 0; 2045 } 2046 2047 CRYPTO_UP_REF(&fsc->cert->references, &i); 2048 ssl_cert_free(tsc->cert); 2049 tsc->cert = fsc->cert; 2050 if (!SSL_set_session_id_context(t, fsc->sid_ctx, (int)fsc->sid_ctx_length)) { 2051 return 0; 2052 } 2053 2054 return 1; 2055 } 2056 2057 /* Fix this so it checks all the valid key/cert options */ 2058 int SSL_CTX_check_private_key(const SSL_CTX *ctx) 2059 { 2060 if ((ctx == NULL) || (ctx->cert->key->x509 == NULL)) { 2061 ERR_raise(ERR_LIB_SSL, SSL_R_NO_CERTIFICATE_ASSIGNED); 2062 return 0; 2063 } 2064 if (ctx->cert->key->privatekey == NULL) { 2065 ERR_raise(ERR_LIB_SSL, SSL_R_NO_PRIVATE_KEY_ASSIGNED); 2066 return 0; 2067 } 2068 return X509_check_private_key(ctx->cert->key->x509, ctx->cert->key->privatekey); 2069 } 2070 2071 /* Fix this function so that it takes an optional type parameter */ 2072 int SSL_check_private_key(const SSL *ssl) 2073 { 2074 const SSL_CONNECTION *sc; 2075 2076 if ((sc = SSL_CONNECTION_FROM_CONST_SSL(ssl)) == NULL) { 2077 ERR_raise(ERR_LIB_SSL, ERR_R_PASSED_NULL_PARAMETER); 2078 return 0; 2079 } 2080 if (sc->cert->key->x509 == NULL) { 2081 ERR_raise(ERR_LIB_SSL, SSL_R_NO_CERTIFICATE_ASSIGNED); 2082 return 0; 2083 } 2084 if (sc->cert->key->privatekey == NULL) { 2085 ERR_raise(ERR_LIB_SSL, SSL_R_NO_PRIVATE_KEY_ASSIGNED); 2086 return 0; 2087 } 2088 return X509_check_private_key(sc->cert->key->x509, 2089 sc->cert->key->privatekey); 2090 } 2091 2092 int SSL_waiting_for_async(SSL *s) 2093 { 2094 SSL_CONNECTION *sc = SSL_CONNECTION_FROM_SSL(s); 2095 2096 if (sc == NULL) 2097 return 0; 2098 2099 if (sc->job) 2100 return 1; 2101 2102 return 0; 2103 } 2104 2105 int SSL_get_all_async_fds(SSL *s, OSSL_ASYNC_FD *fds, size_t *numfds) 2106 { 2107 ASYNC_WAIT_CTX *ctx; 2108 SSL_CONNECTION *sc = SSL_CONNECTION_FROM_SSL(s); 2109 2110 if (sc == NULL) 2111 return 0; 2112 2113 if ((ctx = sc->waitctx) == NULL) 2114 return 0; 2115 return ASYNC_WAIT_CTX_get_all_fds(ctx, fds, numfds); 2116 } 2117 2118 int SSL_get_changed_async_fds(SSL *s, OSSL_ASYNC_FD *addfd, size_t *numaddfds, 2119 OSSL_ASYNC_FD *delfd, size_t *numdelfds) 2120 { 2121 ASYNC_WAIT_CTX *ctx; 2122 SSL_CONNECTION *sc = SSL_CONNECTION_FROM_SSL(s); 2123 2124 if (sc == NULL) 2125 return 0; 2126 2127 if ((ctx = sc->waitctx) == NULL) 2128 return 0; 2129 return ASYNC_WAIT_CTX_get_changed_fds(ctx, addfd, numaddfds, delfd, 2130 numdelfds); 2131 } 2132 2133 int SSL_CTX_set_async_callback(SSL_CTX *ctx, SSL_async_callback_fn callback) 2134 { 2135 ctx->async_cb = callback; 2136 return 1; 2137 } 2138 2139 int SSL_CTX_set_async_callback_arg(SSL_CTX *ctx, void *arg) 2140 { 2141 ctx->async_cb_arg = arg; 2142 return 1; 2143 } 2144 2145 int SSL_set_async_callback(SSL *s, SSL_async_callback_fn callback) 2146 { 2147 SSL_CONNECTION *sc = SSL_CONNECTION_FROM_SSL(s); 2148 2149 if (sc == NULL) 2150 return 0; 2151 2152 sc->async_cb = callback; 2153 return 1; 2154 } 2155 2156 int SSL_set_async_callback_arg(SSL *s, void *arg) 2157 { 2158 SSL_CONNECTION *sc = SSL_CONNECTION_FROM_SSL(s); 2159 2160 if (sc == NULL) 2161 return 0; 2162 2163 sc->async_cb_arg = arg; 2164 return 1; 2165 } 2166 2167 int SSL_get_async_status(SSL *s, int *status) 2168 { 2169 ASYNC_WAIT_CTX *ctx; 2170 SSL_CONNECTION *sc = SSL_CONNECTION_FROM_SSL(s); 2171 2172 if (sc == NULL) 2173 return 0; 2174 2175 if ((ctx = sc->waitctx) == NULL) 2176 return 0; 2177 *status = ASYNC_WAIT_CTX_get_status(ctx); 2178 return 1; 2179 } 2180 2181 int SSL_accept(SSL *s) 2182 { 2183 SSL_CONNECTION *sc = SSL_CONNECTION_FROM_SSL(s); 2184 2185 #ifndef OPENSSL_NO_QUIC 2186 if (IS_QUIC(s)) 2187 return s->method->ssl_accept(s); 2188 #endif 2189 2190 if (sc == NULL) 2191 return 0; 2192 2193 if (sc->handshake_func == NULL) { 2194 /* Not properly initialized yet */ 2195 SSL_set_accept_state(s); 2196 } 2197 2198 return SSL_do_handshake(s); 2199 } 2200 2201 int SSL_connect(SSL *s) 2202 { 2203 SSL_CONNECTION *sc = SSL_CONNECTION_FROM_SSL(s); 2204 2205 #ifndef OPENSSL_NO_QUIC 2206 if (IS_QUIC(s)) 2207 return s->method->ssl_connect(s); 2208 #endif 2209 2210 if (sc == NULL) 2211 return 0; 2212 2213 if (sc->handshake_func == NULL) { 2214 /* Not properly initialized yet */ 2215 SSL_set_connect_state(s); 2216 } 2217 2218 return SSL_do_handshake(s); 2219 } 2220 2221 long SSL_get_default_timeout(const SSL *s) 2222 { 2223 return (long int)ossl_time2seconds(s->method->get_timeout()); 2224 } 2225 2226 static int ssl_async_wait_ctx_cb(void *arg) 2227 { 2228 SSL *s = (SSL *)arg; 2229 SSL_CONNECTION *sc = SSL_CONNECTION_FROM_SSL(s); 2230 2231 if (sc == NULL) 2232 return 0; 2233 2234 return sc->async_cb(s, sc->async_cb_arg); 2235 } 2236 2237 static int ssl_start_async_job(SSL *s, struct ssl_async_args *args, 2238 int (*func)(void *)) 2239 { 2240 int ret; 2241 SSL_CONNECTION *sc = SSL_CONNECTION_FROM_SSL(s); 2242 2243 if (sc == NULL) 2244 return 0; 2245 2246 if (sc->waitctx == NULL) { 2247 sc->waitctx = ASYNC_WAIT_CTX_new(); 2248 if (sc->waitctx == NULL) 2249 return -1; 2250 if (sc->async_cb != NULL 2251 && !ASYNC_WAIT_CTX_set_callback(sc->waitctx, ssl_async_wait_ctx_cb, s)) 2252 return -1; 2253 } 2254 2255 sc->rwstate = SSL_NOTHING; 2256 switch (ASYNC_start_job(&sc->job, sc->waitctx, &ret, func, args, 2257 sizeof(struct ssl_async_args))) { 2258 case ASYNC_ERR: 2259 sc->rwstate = SSL_NOTHING; 2260 ERR_raise(ERR_LIB_SSL, SSL_R_FAILED_TO_INIT_ASYNC); 2261 return -1; 2262 case ASYNC_PAUSE: 2263 sc->rwstate = SSL_ASYNC_PAUSED; 2264 return -1; 2265 case ASYNC_NO_JOBS: 2266 sc->rwstate = SSL_ASYNC_NO_JOBS; 2267 return -1; 2268 case ASYNC_FINISH: 2269 sc->job = NULL; 2270 return ret; 2271 default: 2272 sc->rwstate = SSL_NOTHING; 2273 ERR_raise(ERR_LIB_SSL, ERR_R_INTERNAL_ERROR); 2274 /* Shouldn't happen */ 2275 return -1; 2276 } 2277 } 2278 2279 static int ssl_io_intern(void *vargs) 2280 { 2281 struct ssl_async_args *args; 2282 SSL *s; 2283 void *buf; 2284 size_t num; 2285 SSL_CONNECTION *sc; 2286 2287 args = (struct ssl_async_args *)vargs; 2288 s = args->s; 2289 buf = args->buf; 2290 num = args->num; 2291 if ((sc = SSL_CONNECTION_FROM_SSL(s)) == NULL) 2292 return -1; 2293 2294 switch (args->type) { 2295 case READFUNC: 2296 return args->f.func_read(s, buf, num, &sc->asyncrw); 2297 case WRITEFUNC: 2298 return args->f.func_write(s, buf, num, &sc->asyncrw); 2299 case OTHERFUNC: 2300 return args->f.func_other(s); 2301 } 2302 return -1; 2303 } 2304 2305 int ssl_read_internal(SSL *s, void *buf, size_t num, size_t *readbytes) 2306 { 2307 SSL_CONNECTION *sc = SSL_CONNECTION_FROM_SSL(s); 2308 2309 #ifndef OPENSSL_NO_QUIC 2310 if (IS_QUIC(s)) 2311 return s->method->ssl_read(s, buf, num, readbytes); 2312 #endif 2313 2314 if (sc == NULL) 2315 return -1; 2316 2317 if (sc->handshake_func == NULL) { 2318 ERR_raise(ERR_LIB_SSL, SSL_R_UNINITIALIZED); 2319 return -1; 2320 } 2321 2322 if (sc->shutdown & SSL_RECEIVED_SHUTDOWN) { 2323 sc->rwstate = SSL_NOTHING; 2324 return 0; 2325 } 2326 2327 if (sc->early_data_state == SSL_EARLY_DATA_CONNECT_RETRY 2328 || sc->early_data_state == SSL_EARLY_DATA_ACCEPT_RETRY) { 2329 ERR_raise(ERR_LIB_SSL, ERR_R_SHOULD_NOT_HAVE_BEEN_CALLED); 2330 return 0; 2331 } 2332 /* 2333 * If we are a client and haven't received the ServerHello etc then we 2334 * better do that 2335 */ 2336 if (!ossl_statem_check_finish_init(sc, 0)) 2337 return -1; 2338 2339 if ((sc->mode & SSL_MODE_ASYNC) && ASYNC_get_current_job() == NULL) { 2340 struct ssl_async_args args; 2341 int ret; 2342 2343 args.s = s; 2344 args.buf = buf; 2345 args.num = num; 2346 args.type = READFUNC; 2347 args.f.func_read = s->method->ssl_read; 2348 2349 ret = ssl_start_async_job(s, &args, ssl_io_intern); 2350 *readbytes = sc->asyncrw; 2351 return ret; 2352 } else { 2353 return s->method->ssl_read(s, buf, num, readbytes); 2354 } 2355 } 2356 2357 int SSL_read(SSL *s, void *buf, int num) 2358 { 2359 int ret; 2360 size_t readbytes; 2361 2362 if (num < 0) { 2363 ERR_raise(ERR_LIB_SSL, SSL_R_BAD_LENGTH); 2364 return -1; 2365 } 2366 2367 ret = ssl_read_internal(s, buf, (size_t)num, &readbytes); 2368 2369 /* 2370 * The cast is safe here because ret should be <= INT_MAX because num is 2371 * <= INT_MAX 2372 */ 2373 if (ret > 0) 2374 ret = (int)readbytes; 2375 2376 return ret; 2377 } 2378 2379 int SSL_read_ex(SSL *s, void *buf, size_t num, size_t *readbytes) 2380 { 2381 int ret = ssl_read_internal(s, buf, num, readbytes); 2382 2383 if (ret < 0) 2384 ret = 0; 2385 return ret; 2386 } 2387 2388 int SSL_read_early_data(SSL *s, void *buf, size_t num, size_t *readbytes) 2389 { 2390 int ret; 2391 SSL_CONNECTION *sc = SSL_CONNECTION_FROM_SSL_ONLY(s); 2392 2393 /* TODO(QUIC 0RTT): 0-RTT support */ 2394 if (sc == NULL || !sc->server) { 2395 ERR_raise(ERR_LIB_SSL, ERR_R_SHOULD_NOT_HAVE_BEEN_CALLED); 2396 return SSL_READ_EARLY_DATA_ERROR; 2397 } 2398 2399 switch (sc->early_data_state) { 2400 case SSL_EARLY_DATA_NONE: 2401 if (!SSL_in_before(s)) { 2402 ERR_raise(ERR_LIB_SSL, ERR_R_SHOULD_NOT_HAVE_BEEN_CALLED); 2403 return SSL_READ_EARLY_DATA_ERROR; 2404 } 2405 /* fall through */ 2406 2407 case SSL_EARLY_DATA_ACCEPT_RETRY: 2408 sc->early_data_state = SSL_EARLY_DATA_ACCEPTING; 2409 ret = SSL_accept(s); 2410 if (ret <= 0) { 2411 /* NBIO or error */ 2412 sc->early_data_state = SSL_EARLY_DATA_ACCEPT_RETRY; 2413 return SSL_READ_EARLY_DATA_ERROR; 2414 } 2415 /* fall through */ 2416 2417 case SSL_EARLY_DATA_READ_RETRY: 2418 if (sc->ext.early_data == SSL_EARLY_DATA_ACCEPTED) { 2419 sc->early_data_state = SSL_EARLY_DATA_READING; 2420 ret = SSL_read_ex(s, buf, num, readbytes); 2421 /* 2422 * State machine will update early_data_state to 2423 * SSL_EARLY_DATA_FINISHED_READING if we get an EndOfEarlyData 2424 * message 2425 */ 2426 if (ret > 0 || (ret <= 0 && sc->early_data_state != SSL_EARLY_DATA_FINISHED_READING)) { 2427 sc->early_data_state = SSL_EARLY_DATA_READ_RETRY; 2428 return ret > 0 ? SSL_READ_EARLY_DATA_SUCCESS 2429 : SSL_READ_EARLY_DATA_ERROR; 2430 } 2431 } else { 2432 sc->early_data_state = SSL_EARLY_DATA_FINISHED_READING; 2433 } 2434 *readbytes = 0; 2435 return SSL_READ_EARLY_DATA_FINISH; 2436 2437 default: 2438 ERR_raise(ERR_LIB_SSL, ERR_R_SHOULD_NOT_HAVE_BEEN_CALLED); 2439 return SSL_READ_EARLY_DATA_ERROR; 2440 } 2441 } 2442 2443 int SSL_get_early_data_status(const SSL *s) 2444 { 2445 const SSL_CONNECTION *sc = SSL_CONNECTION_FROM_CONST_SSL_ONLY(s); 2446 2447 /* TODO(QUIC 0RTT): 0-RTT support */ 2448 if (sc == NULL) 2449 return 0; 2450 2451 return sc->ext.early_data; 2452 } 2453 2454 static int ssl_peek_internal(SSL *s, void *buf, size_t num, size_t *readbytes) 2455 { 2456 SSL_CONNECTION *sc = SSL_CONNECTION_FROM_SSL(s); 2457 2458 #ifndef OPENSSL_NO_QUIC 2459 if (IS_QUIC(s)) 2460 return s->method->ssl_peek(s, buf, num, readbytes); 2461 #endif 2462 2463 if (sc == NULL) 2464 return 0; 2465 2466 if (sc->handshake_func == NULL) { 2467 ERR_raise(ERR_LIB_SSL, SSL_R_UNINITIALIZED); 2468 return -1; 2469 } 2470 2471 if (sc->shutdown & SSL_RECEIVED_SHUTDOWN) { 2472 return 0; 2473 } 2474 if ((sc->mode & SSL_MODE_ASYNC) && ASYNC_get_current_job() == NULL) { 2475 struct ssl_async_args args; 2476 int ret; 2477 2478 args.s = s; 2479 args.buf = buf; 2480 args.num = num; 2481 args.type = READFUNC; 2482 args.f.func_read = s->method->ssl_peek; 2483 2484 ret = ssl_start_async_job(s, &args, ssl_io_intern); 2485 *readbytes = sc->asyncrw; 2486 return ret; 2487 } else { 2488 return s->method->ssl_peek(s, buf, num, readbytes); 2489 } 2490 } 2491 2492 int SSL_peek(SSL *s, void *buf, int num) 2493 { 2494 int ret; 2495 size_t readbytes; 2496 2497 if (num < 0) { 2498 ERR_raise(ERR_LIB_SSL, SSL_R_BAD_LENGTH); 2499 return -1; 2500 } 2501 2502 ret = ssl_peek_internal(s, buf, (size_t)num, &readbytes); 2503 2504 /* 2505 * The cast is safe here because ret should be <= INT_MAX because num is 2506 * <= INT_MAX 2507 */ 2508 if (ret > 0) 2509 ret = (int)readbytes; 2510 2511 return ret; 2512 } 2513 2514 int SSL_peek_ex(SSL *s, void *buf, size_t num, size_t *readbytes) 2515 { 2516 int ret = ssl_peek_internal(s, buf, num, readbytes); 2517 2518 if (ret < 0) 2519 ret = 0; 2520 return ret; 2521 } 2522 2523 int ssl_write_internal(SSL *s, const void *buf, size_t num, 2524 uint64_t flags, size_t *written) 2525 { 2526 SSL_CONNECTION *sc = SSL_CONNECTION_FROM_SSL(s); 2527 2528 #ifndef OPENSSL_NO_QUIC 2529 if (IS_QUIC(s)) 2530 return ossl_quic_write_flags(s, buf, num, flags, written); 2531 #endif 2532 2533 if (sc == NULL) 2534 return 0; 2535 2536 if (sc->handshake_func == NULL) { 2537 ERR_raise(ERR_LIB_SSL, SSL_R_UNINITIALIZED); 2538 return -1; 2539 } 2540 2541 if (sc->shutdown & SSL_SENT_SHUTDOWN) { 2542 sc->rwstate = SSL_NOTHING; 2543 ERR_raise(ERR_LIB_SSL, SSL_R_PROTOCOL_IS_SHUTDOWN); 2544 return -1; 2545 } 2546 2547 if (flags != 0) { 2548 ERR_raise(ERR_LIB_SSL, SSL_R_UNSUPPORTED_WRITE_FLAG); 2549 return -1; 2550 } 2551 2552 if (sc->early_data_state == SSL_EARLY_DATA_CONNECT_RETRY 2553 || sc->early_data_state == SSL_EARLY_DATA_ACCEPT_RETRY 2554 || sc->early_data_state == SSL_EARLY_DATA_READ_RETRY) { 2555 ERR_raise(ERR_LIB_SSL, ERR_R_SHOULD_NOT_HAVE_BEEN_CALLED); 2556 return 0; 2557 } 2558 /* If we are a client and haven't sent the Finished we better do that */ 2559 if (!ossl_statem_check_finish_init(sc, 1)) 2560 return -1; 2561 2562 if ((sc->mode & SSL_MODE_ASYNC) && ASYNC_get_current_job() == NULL) { 2563 int ret; 2564 struct ssl_async_args args; 2565 2566 args.s = s; 2567 args.buf = (void *)buf; 2568 args.num = num; 2569 args.type = WRITEFUNC; 2570 args.f.func_write = s->method->ssl_write; 2571 2572 ret = ssl_start_async_job(s, &args, ssl_io_intern); 2573 *written = sc->asyncrw; 2574 return ret; 2575 } else { 2576 return s->method->ssl_write(s, buf, num, written); 2577 } 2578 } 2579 2580 ossl_ssize_t SSL_sendfile(SSL *s, int fd, off_t offset, size_t size, int flags) 2581 { 2582 ossl_ssize_t ret; 2583 SSL_CONNECTION *sc = SSL_CONNECTION_FROM_SSL_ONLY(s); 2584 2585 if (sc == NULL) 2586 return 0; 2587 2588 if (sc->handshake_func == NULL) { 2589 ERR_raise(ERR_LIB_SSL, SSL_R_UNINITIALIZED); 2590 return -1; 2591 } 2592 2593 if (sc->shutdown & SSL_SENT_SHUTDOWN) { 2594 sc->rwstate = SSL_NOTHING; 2595 ERR_raise(ERR_LIB_SSL, SSL_R_PROTOCOL_IS_SHUTDOWN); 2596 return -1; 2597 } 2598 2599 if (!BIO_get_ktls_send(sc->wbio)) { 2600 ERR_raise(ERR_LIB_SSL, SSL_R_UNINITIALIZED); 2601 return -1; 2602 } 2603 2604 /* If we have an alert to send, lets send it */ 2605 if (sc->s3.alert_dispatch > 0) { 2606 ret = (ossl_ssize_t)s->method->ssl_dispatch_alert(s); 2607 if (ret <= 0) { 2608 /* SSLfatal() already called if appropriate */ 2609 return ret; 2610 } 2611 /* if it went, fall through and send more stuff */ 2612 } 2613 2614 sc->rwstate = SSL_WRITING; 2615 if (BIO_flush(sc->wbio) <= 0) { 2616 if (!BIO_should_retry(sc->wbio)) { 2617 sc->rwstate = SSL_NOTHING; 2618 } else { 2619 #ifdef EAGAIN 2620 set_sys_error(EAGAIN); 2621 #endif 2622 } 2623 return -1; 2624 } 2625 2626 #ifdef OPENSSL_NO_KTLS 2627 ERR_raise_data(ERR_LIB_SSL, ERR_R_INTERNAL_ERROR, 2628 "can't call ktls_sendfile(), ktls disabled"); 2629 return -1; 2630 #else 2631 ret = ktls_sendfile(SSL_get_wfd(s), fd, offset, size, flags); 2632 if (ret < 0) { 2633 #if defined(EAGAIN) && defined(EINTR) && defined(EBUSY) 2634 if ((get_last_sys_error() == EAGAIN) || (get_last_sys_error() == EINTR) || (get_last_sys_error() == EBUSY)) 2635 BIO_set_retry_write(sc->wbio); 2636 else 2637 #endif 2638 ERR_raise_data(ERR_LIB_SYS, get_last_sys_error(), 2639 "ktls_sendfile failure"); 2640 return ret; 2641 } 2642 sc->rwstate = SSL_NOTHING; 2643 return ret; 2644 #endif 2645 } 2646 2647 int SSL_write(SSL *s, const void *buf, int num) 2648 { 2649 int ret; 2650 size_t written; 2651 2652 if (num < 0) { 2653 ERR_raise(ERR_LIB_SSL, SSL_R_BAD_LENGTH); 2654 return -1; 2655 } 2656 2657 ret = ssl_write_internal(s, buf, (size_t)num, 0, &written); 2658 2659 /* 2660 * The cast is safe here because ret should be <= INT_MAX because num is 2661 * <= INT_MAX 2662 */ 2663 if (ret > 0) 2664 ret = (int)written; 2665 2666 return ret; 2667 } 2668 2669 int SSL_write_ex(SSL *s, const void *buf, size_t num, size_t *written) 2670 { 2671 return SSL_write_ex2(s, buf, num, 0, written); 2672 } 2673 2674 int SSL_write_ex2(SSL *s, const void *buf, size_t num, uint64_t flags, 2675 size_t *written) 2676 { 2677 int ret = ssl_write_internal(s, buf, num, flags, written); 2678 2679 if (ret < 0) 2680 ret = 0; 2681 return ret; 2682 } 2683 2684 int SSL_write_early_data(SSL *s, const void *buf, size_t num, size_t *written) 2685 { 2686 int ret, early_data_state; 2687 size_t writtmp; 2688 uint32_t partialwrite; 2689 SSL_CONNECTION *sc = SSL_CONNECTION_FROM_SSL_ONLY(s); 2690 2691 /* TODO(QUIC 0RTT): This will need special handling for QUIC */ 2692 if (sc == NULL) 2693 return 0; 2694 2695 switch (sc->early_data_state) { 2696 case SSL_EARLY_DATA_NONE: 2697 if (sc->server 2698 || !SSL_in_before(s) 2699 || ((sc->session == NULL || sc->session->ext.max_early_data == 0) 2700 && (sc->psk_use_session_cb == NULL))) { 2701 ERR_raise(ERR_LIB_SSL, ERR_R_SHOULD_NOT_HAVE_BEEN_CALLED); 2702 return 0; 2703 } 2704 /* fall through */ 2705 2706 case SSL_EARLY_DATA_CONNECT_RETRY: 2707 sc->early_data_state = SSL_EARLY_DATA_CONNECTING; 2708 ret = SSL_connect(s); 2709 if (ret <= 0) { 2710 /* NBIO or error */ 2711 sc->early_data_state = SSL_EARLY_DATA_CONNECT_RETRY; 2712 return 0; 2713 } 2714 /* fall through */ 2715 2716 case SSL_EARLY_DATA_WRITE_RETRY: 2717 sc->early_data_state = SSL_EARLY_DATA_WRITING; 2718 /* 2719 * We disable partial write for early data because we don't keep track 2720 * of how many bytes we've written between the SSL_write_ex() call and 2721 * the flush if the flush needs to be retried) 2722 */ 2723 partialwrite = sc->mode & SSL_MODE_ENABLE_PARTIAL_WRITE; 2724 sc->mode &= ~SSL_MODE_ENABLE_PARTIAL_WRITE; 2725 ret = SSL_write_ex(s, buf, num, &writtmp); 2726 sc->mode |= partialwrite; 2727 if (!ret) { 2728 sc->early_data_state = SSL_EARLY_DATA_WRITE_RETRY; 2729 return ret; 2730 } 2731 sc->early_data_state = SSL_EARLY_DATA_WRITE_FLUSH; 2732 /* fall through */ 2733 2734 case SSL_EARLY_DATA_WRITE_FLUSH: 2735 /* The buffering BIO is still in place so we need to flush it */ 2736 if (statem_flush(sc) != 1) 2737 return 0; 2738 *written = num; 2739 sc->early_data_state = SSL_EARLY_DATA_WRITE_RETRY; 2740 return 1; 2741 2742 case SSL_EARLY_DATA_FINISHED_READING: 2743 case SSL_EARLY_DATA_READ_RETRY: 2744 early_data_state = sc->early_data_state; 2745 /* We are a server writing to an unauthenticated client */ 2746 sc->early_data_state = SSL_EARLY_DATA_UNAUTH_WRITING; 2747 ret = SSL_write_ex(s, buf, num, written); 2748 /* The buffering BIO is still in place */ 2749 if (ret) 2750 (void)BIO_flush(sc->wbio); 2751 sc->early_data_state = early_data_state; 2752 return ret; 2753 2754 default: 2755 ERR_raise(ERR_LIB_SSL, ERR_R_SHOULD_NOT_HAVE_BEEN_CALLED); 2756 return 0; 2757 } 2758 } 2759 2760 int SSL_shutdown(SSL *s) 2761 { 2762 /* 2763 * Note that this function behaves differently from what one might 2764 * expect. Return values are 0 for no success (yet), 1 for success; but 2765 * calling it once is usually not enough, even if blocking I/O is used 2766 * (see ssl3_shutdown). 2767 */ 2768 SSL_CONNECTION *sc = SSL_CONNECTION_FROM_SSL(s); 2769 2770 #ifndef OPENSSL_NO_QUIC 2771 if (IS_QUIC(s)) 2772 return ossl_quic_conn_shutdown(s, 0, NULL, 0); 2773 #endif 2774 2775 if (sc == NULL) 2776 return -1; 2777 2778 if (sc->handshake_func == NULL) { 2779 ERR_raise(ERR_LIB_SSL, SSL_R_UNINITIALIZED); 2780 return -1; 2781 } 2782 2783 if (!SSL_in_init(s)) { 2784 if ((sc->mode & SSL_MODE_ASYNC) && ASYNC_get_current_job() == NULL) { 2785 struct ssl_async_args args; 2786 2787 memset(&args, 0, sizeof(args)); 2788 args.s = s; 2789 args.type = OTHERFUNC; 2790 args.f.func_other = s->method->ssl_shutdown; 2791 2792 return ssl_start_async_job(s, &args, ssl_io_intern); 2793 } else { 2794 return s->method->ssl_shutdown(s); 2795 } 2796 } else { 2797 ERR_raise(ERR_LIB_SSL, SSL_R_SHUTDOWN_WHILE_IN_INIT); 2798 return -1; 2799 } 2800 } 2801 2802 int SSL_key_update(SSL *s, int updatetype) 2803 { 2804 SSL_CONNECTION *sc = SSL_CONNECTION_FROM_SSL(s); 2805 2806 #ifndef OPENSSL_NO_QUIC 2807 if (IS_QUIC(s)) 2808 return ossl_quic_key_update(s, updatetype); 2809 #endif 2810 2811 if (sc == NULL) 2812 return 0; 2813 2814 if (!SSL_CONNECTION_IS_TLS13(sc)) { 2815 ERR_raise(ERR_LIB_SSL, SSL_R_WRONG_SSL_VERSION); 2816 return 0; 2817 } 2818 2819 if (updatetype != SSL_KEY_UPDATE_NOT_REQUESTED 2820 && updatetype != SSL_KEY_UPDATE_REQUESTED) { 2821 ERR_raise(ERR_LIB_SSL, SSL_R_INVALID_KEY_UPDATE_TYPE); 2822 return 0; 2823 } 2824 2825 if (!SSL_is_init_finished(s)) { 2826 ERR_raise(ERR_LIB_SSL, SSL_R_STILL_IN_INIT); 2827 return 0; 2828 } 2829 2830 if (RECORD_LAYER_write_pending(&sc->rlayer)) { 2831 ERR_raise(ERR_LIB_SSL, SSL_R_BAD_WRITE_RETRY); 2832 return 0; 2833 } 2834 2835 ossl_statem_set_in_init(sc, 1); 2836 sc->key_update = updatetype; 2837 return 1; 2838 } 2839 2840 int SSL_get_key_update_type(const SSL *s) 2841 { 2842 const SSL_CONNECTION *sc = SSL_CONNECTION_FROM_CONST_SSL(s); 2843 2844 #ifndef OPENSSL_NO_QUIC 2845 if (IS_QUIC(s)) 2846 return ossl_quic_get_key_update_type(s); 2847 #endif 2848 2849 if (sc == NULL) 2850 return 0; 2851 2852 return sc->key_update; 2853 } 2854 2855 /* 2856 * Can we accept a renegotiation request? If yes, set the flag and 2857 * return 1 if yes. If not, raise error and return 0. 2858 */ 2859 static int can_renegotiate(const SSL_CONNECTION *sc) 2860 { 2861 if (SSL_CONNECTION_IS_TLS13(sc)) { 2862 ERR_raise(ERR_LIB_SSL, SSL_R_WRONG_SSL_VERSION); 2863 return 0; 2864 } 2865 2866 if ((sc->options & SSL_OP_NO_RENEGOTIATION) != 0) { 2867 ERR_raise(ERR_LIB_SSL, SSL_R_NO_RENEGOTIATION); 2868 return 0; 2869 } 2870 2871 return 1; 2872 } 2873 2874 int SSL_renegotiate(SSL *s) 2875 { 2876 SSL_CONNECTION *sc = SSL_CONNECTION_FROM_SSL_ONLY(s); 2877 2878 if (sc == NULL) 2879 return 0; 2880 2881 if (!can_renegotiate(sc)) 2882 return 0; 2883 2884 sc->renegotiate = 1; 2885 sc->new_session = 1; 2886 return s->method->ssl_renegotiate(s); 2887 } 2888 2889 int SSL_renegotiate_abbreviated(SSL *s) 2890 { 2891 SSL_CONNECTION *sc = SSL_CONNECTION_FROM_SSL_ONLY(s); 2892 2893 if (sc == NULL) 2894 return 0; 2895 2896 if (!can_renegotiate(sc)) 2897 return 0; 2898 2899 sc->renegotiate = 1; 2900 sc->new_session = 0; 2901 return s->method->ssl_renegotiate(s); 2902 } 2903 2904 int SSL_renegotiate_pending(const SSL *s) 2905 { 2906 SSL_CONNECTION *sc = SSL_CONNECTION_FROM_SSL_ONLY(s); 2907 2908 if (sc == NULL) 2909 return 0; 2910 2911 /* 2912 * becomes true when negotiation is requested; false again once a 2913 * handshake has finished 2914 */ 2915 return (sc->renegotiate != 0); 2916 } 2917 2918 int SSL_new_session_ticket(SSL *s) 2919 { 2920 SSL_CONNECTION *sc = SSL_CONNECTION_FROM_SSL(s); 2921 2922 if (sc == NULL) 2923 return 0; 2924 2925 /* If we are in init because we're sending tickets, okay to send more. */ 2926 if ((SSL_in_init(s) && sc->ext.extra_tickets_expected == 0) 2927 || SSL_IS_FIRST_HANDSHAKE(sc) || !sc->server 2928 || !SSL_CONNECTION_IS_TLS13(sc)) 2929 return 0; 2930 sc->ext.extra_tickets_expected++; 2931 if (!RECORD_LAYER_write_pending(&sc->rlayer) && !SSL_in_init(s)) 2932 ossl_statem_set_in_init(sc, 1); 2933 return 1; 2934 } 2935 2936 long SSL_ctrl(SSL *s, int cmd, long larg, void *parg) 2937 { 2938 return ossl_ctrl_internal(s, cmd, larg, parg, /*no_quic=*/0); 2939 } 2940 2941 long ossl_ctrl_internal(SSL *s, int cmd, long larg, void *parg, int no_quic) 2942 { 2943 long l; 2944 SSL_CONNECTION *sc = SSL_CONNECTION_FROM_SSL(s); 2945 2946 /* 2947 * Routing of ctrl calls for QUIC is a little counterintuitive: 2948 * 2949 * - Firstly (no_quic=0), we pass the ctrl directly to our QUIC 2950 * implementation in case it wants to handle the ctrl specially. 2951 * 2952 * - If our QUIC implementation does not care about the ctrl, it 2953 * will reenter this function with no_quic=1 and we will try to handle 2954 * it directly using the QCSO SSL object stub (not the handshake layer 2955 * SSL object). This is important for e.g. the version configuration 2956 * ctrls below, which must use s->defltmeth (and not sc->defltmeth). 2957 * 2958 * - If we don't handle a ctrl here specially, then processing is 2959 * redirected to the handshake layer SSL object. 2960 */ 2961 if (!no_quic && IS_QUIC(s)) 2962 return s->method->ssl_ctrl(s, cmd, larg, parg); 2963 2964 if (sc == NULL) 2965 return 0; 2966 2967 switch (cmd) { 2968 case SSL_CTRL_GET_READ_AHEAD: 2969 return RECORD_LAYER_get_read_ahead(&sc->rlayer); 2970 case SSL_CTRL_SET_READ_AHEAD: 2971 l = RECORD_LAYER_get_read_ahead(&sc->rlayer); 2972 RECORD_LAYER_set_read_ahead(&sc->rlayer, larg); 2973 return l; 2974 2975 case SSL_CTRL_MODE: { 2976 OSSL_PARAM options[2], *opts = options; 2977 2978 sc->mode |= larg; 2979 2980 *opts++ = OSSL_PARAM_construct_uint32(OSSL_LIBSSL_RECORD_LAYER_PARAM_MODE, 2981 &sc->mode); 2982 *opts = OSSL_PARAM_construct_end(); 2983 2984 /* Ignore return value */ 2985 sc->rlayer.rrlmethod->set_options(sc->rlayer.rrl, options); 2986 2987 return sc->mode; 2988 } 2989 case SSL_CTRL_CLEAR_MODE: 2990 return (sc->mode &= ~larg); 2991 case SSL_CTRL_GET_MAX_CERT_LIST: 2992 return (long)sc->max_cert_list; 2993 case SSL_CTRL_SET_MAX_CERT_LIST: 2994 if (larg < 0) 2995 return 0; 2996 l = (long)sc->max_cert_list; 2997 sc->max_cert_list = (size_t)larg; 2998 return l; 2999 case SSL_CTRL_SET_MAX_SEND_FRAGMENT: 3000 if (larg < 512 || larg > SSL3_RT_MAX_PLAIN_LENGTH) 3001 return 0; 3002 #ifndef OPENSSL_NO_KTLS 3003 if (sc->wbio != NULL && BIO_get_ktls_send(sc->wbio)) 3004 return 0; 3005 #endif /* OPENSSL_NO_KTLS */ 3006 sc->max_send_fragment = larg; 3007 if (sc->max_send_fragment < sc->split_send_fragment) 3008 sc->split_send_fragment = sc->max_send_fragment; 3009 sc->rlayer.wrlmethod->set_max_frag_len(sc->rlayer.wrl, larg); 3010 return 1; 3011 case SSL_CTRL_SET_SPLIT_SEND_FRAGMENT: 3012 if ((size_t)larg > sc->max_send_fragment || larg == 0) 3013 return 0; 3014 sc->split_send_fragment = larg; 3015 return 1; 3016 case SSL_CTRL_SET_MAX_PIPELINES: 3017 if (larg < 1 || larg > SSL_MAX_PIPELINES) 3018 return 0; 3019 sc->max_pipelines = larg; 3020 if (sc->rlayer.rrlmethod->set_max_pipelines != NULL) 3021 sc->rlayer.rrlmethod->set_max_pipelines(sc->rlayer.rrl, (size_t)larg); 3022 return 1; 3023 case SSL_CTRL_GET_RI_SUPPORT: 3024 return sc->s3.send_connection_binding; 3025 case SSL_CTRL_SET_RETRY_VERIFY: 3026 sc->rwstate = SSL_RETRY_VERIFY; 3027 return 1; 3028 case SSL_CTRL_CERT_FLAGS: 3029 return (sc->cert->cert_flags |= larg); 3030 case SSL_CTRL_CLEAR_CERT_FLAGS: 3031 return (sc->cert->cert_flags &= ~larg); 3032 3033 case SSL_CTRL_GET_RAW_CIPHERLIST: 3034 if (parg) { 3035 if (sc->s3.tmp.ciphers_raw == NULL) 3036 return 0; 3037 *(unsigned char **)parg = sc->s3.tmp.ciphers_raw; 3038 return (int)sc->s3.tmp.ciphers_rawlen; 3039 } else { 3040 return TLS_CIPHER_LEN; 3041 } 3042 case SSL_CTRL_GET_EXTMS_SUPPORT: 3043 if (!sc->session || SSL_in_init(s) || ossl_statem_get_in_handshake(sc)) 3044 return -1; 3045 if (sc->session->flags & SSL_SESS_FLAG_EXTMS) 3046 return 1; 3047 else 3048 return 0; 3049 case SSL_CTRL_SET_MIN_PROTO_VERSION: 3050 return ssl_check_allowed_versions(larg, sc->max_proto_version) 3051 && ssl_set_version_bound(s->defltmeth->version, (int)larg, 3052 &sc->min_proto_version); 3053 case SSL_CTRL_GET_MIN_PROTO_VERSION: 3054 return sc->min_proto_version; 3055 case SSL_CTRL_SET_MAX_PROTO_VERSION: 3056 return ssl_check_allowed_versions(sc->min_proto_version, larg) 3057 && ssl_set_version_bound(s->defltmeth->version, (int)larg, 3058 &sc->max_proto_version); 3059 case SSL_CTRL_GET_MAX_PROTO_VERSION: 3060 return sc->max_proto_version; 3061 default: 3062 if (IS_QUIC(s)) 3063 return SSL_ctrl((SSL *)sc, cmd, larg, parg); 3064 else 3065 return s->method->ssl_ctrl(s, cmd, larg, parg); 3066 } 3067 } 3068 3069 long SSL_callback_ctrl(SSL *s, int cmd, void (*fp)(void)) 3070 { 3071 return s->method->ssl_callback_ctrl(s, cmd, fp); 3072 } 3073 3074 LHASH_OF(SSL_SESSION) *SSL_CTX_sessions(SSL_CTX *ctx) 3075 { 3076 return ctx->sessions; 3077 } 3078 3079 static int ssl_tsan_load(SSL_CTX *ctx, TSAN_QUALIFIER int *stat) 3080 { 3081 int res = 0; 3082 3083 if (ssl_tsan_lock(ctx)) { 3084 res = tsan_load(stat); 3085 ssl_tsan_unlock(ctx); 3086 } 3087 return res; 3088 } 3089 3090 long SSL_CTX_ctrl(SSL_CTX *ctx, int cmd, long larg, void *parg) 3091 { 3092 long l; 3093 3094 /* For some cases with ctx == NULL or larg == 1 perform syntax checks */ 3095 if (cmd == SSL_CTRL_SET_GROUPS_LIST && larg == 1) 3096 return tls1_set_groups_list(ctx, NULL, NULL, NULL, NULL, NULL, NULL, parg); 3097 if (ctx == NULL) { 3098 switch (cmd) { 3099 case SSL_CTRL_SET_SIGALGS_LIST: 3100 case SSL_CTRL_SET_CLIENT_SIGALGS_LIST: 3101 return tls1_set_sigalgs_list(ctx, NULL, parg, 0); 3102 default: 3103 return 0; 3104 } 3105 } 3106 3107 switch (cmd) { 3108 case SSL_CTRL_GET_READ_AHEAD: 3109 return ctx->read_ahead; 3110 case SSL_CTRL_SET_READ_AHEAD: 3111 l = ctx->read_ahead; 3112 ctx->read_ahead = larg; 3113 return l; 3114 3115 case SSL_CTRL_SET_MSG_CALLBACK_ARG: 3116 ctx->msg_callback_arg = parg; 3117 return 1; 3118 3119 case SSL_CTRL_GET_MAX_CERT_LIST: 3120 return (long)ctx->max_cert_list; 3121 case SSL_CTRL_SET_MAX_CERT_LIST: 3122 if (larg < 0) 3123 return 0; 3124 l = (long)ctx->max_cert_list; 3125 ctx->max_cert_list = (size_t)larg; 3126 return l; 3127 3128 case SSL_CTRL_SET_SESS_CACHE_SIZE: 3129 if (larg < 0) 3130 return 0; 3131 l = (long)ctx->session_cache_size; 3132 ctx->session_cache_size = (size_t)larg; 3133 return l; 3134 case SSL_CTRL_GET_SESS_CACHE_SIZE: 3135 return (long)ctx->session_cache_size; 3136 case SSL_CTRL_SET_SESS_CACHE_MODE: 3137 l = ctx->session_cache_mode; 3138 ctx->session_cache_mode = larg; 3139 return l; 3140 case SSL_CTRL_GET_SESS_CACHE_MODE: 3141 return ctx->session_cache_mode; 3142 3143 case SSL_CTRL_SESS_NUMBER: 3144 return lh_SSL_SESSION_num_items(ctx->sessions); 3145 case SSL_CTRL_SESS_CONNECT: 3146 return ssl_tsan_load(ctx, &ctx->stats.sess_connect); 3147 case SSL_CTRL_SESS_CONNECT_GOOD: 3148 return ssl_tsan_load(ctx, &ctx->stats.sess_connect_good); 3149 case SSL_CTRL_SESS_CONNECT_RENEGOTIATE: 3150 return ssl_tsan_load(ctx, &ctx->stats.sess_connect_renegotiate); 3151 case SSL_CTRL_SESS_ACCEPT: 3152 return ssl_tsan_load(ctx, &ctx->stats.sess_accept); 3153 case SSL_CTRL_SESS_ACCEPT_GOOD: 3154 return ssl_tsan_load(ctx, &ctx->stats.sess_accept_good); 3155 case SSL_CTRL_SESS_ACCEPT_RENEGOTIATE: 3156 return ssl_tsan_load(ctx, &ctx->stats.sess_accept_renegotiate); 3157 case SSL_CTRL_SESS_HIT: 3158 return ssl_tsan_load(ctx, &ctx->stats.sess_hit); 3159 case SSL_CTRL_SESS_CB_HIT: 3160 return ssl_tsan_load(ctx, &ctx->stats.sess_cb_hit); 3161 case SSL_CTRL_SESS_MISSES: 3162 return ssl_tsan_load(ctx, &ctx->stats.sess_miss); 3163 case SSL_CTRL_SESS_TIMEOUTS: 3164 return ssl_tsan_load(ctx, &ctx->stats.sess_timeout); 3165 case SSL_CTRL_SESS_CACHE_FULL: 3166 return ssl_tsan_load(ctx, &ctx->stats.sess_cache_full); 3167 case SSL_CTRL_MODE: 3168 return (ctx->mode |= larg); 3169 case SSL_CTRL_CLEAR_MODE: 3170 return (ctx->mode &= ~larg); 3171 case SSL_CTRL_SET_MAX_SEND_FRAGMENT: 3172 if (larg < 512 || larg > SSL3_RT_MAX_PLAIN_LENGTH) 3173 return 0; 3174 ctx->max_send_fragment = larg; 3175 if (ctx->max_send_fragment < ctx->split_send_fragment) 3176 ctx->split_send_fragment = ctx->max_send_fragment; 3177 return 1; 3178 case SSL_CTRL_SET_SPLIT_SEND_FRAGMENT: 3179 if ((size_t)larg > ctx->max_send_fragment || larg == 0) 3180 return 0; 3181 ctx->split_send_fragment = larg; 3182 return 1; 3183 case SSL_CTRL_SET_MAX_PIPELINES: 3184 if (larg < 1 || larg > SSL_MAX_PIPELINES) 3185 return 0; 3186 ctx->max_pipelines = larg; 3187 return 1; 3188 case SSL_CTRL_CERT_FLAGS: 3189 return (ctx->cert->cert_flags |= larg); 3190 case SSL_CTRL_CLEAR_CERT_FLAGS: 3191 return (ctx->cert->cert_flags &= ~larg); 3192 case SSL_CTRL_SET_MIN_PROTO_VERSION: 3193 return ssl_check_allowed_versions(larg, ctx->max_proto_version) 3194 && ssl_set_version_bound(ctx->method->version, (int)larg, 3195 &ctx->min_proto_version); 3196 case SSL_CTRL_GET_MIN_PROTO_VERSION: 3197 return ctx->min_proto_version; 3198 case SSL_CTRL_SET_MAX_PROTO_VERSION: 3199 return ssl_check_allowed_versions(ctx->min_proto_version, larg) 3200 && ssl_set_version_bound(ctx->method->version, (int)larg, 3201 &ctx->max_proto_version); 3202 case SSL_CTRL_GET_MAX_PROTO_VERSION: 3203 return ctx->max_proto_version; 3204 default: 3205 return ctx->method->ssl_ctx_ctrl(ctx, cmd, larg, parg); 3206 } 3207 } 3208 3209 long SSL_CTX_callback_ctrl(SSL_CTX *ctx, int cmd, void (*fp)(void)) 3210 { 3211 switch (cmd) { 3212 case SSL_CTRL_SET_MSG_CALLBACK: 3213 ctx->msg_callback = (void (*)(int write_p, int version, int content_type, 3214 const void *buf, size_t len, SSL *ssl, 3215 void *arg))(fp); 3216 return 1; 3217 3218 default: 3219 return ctx->method->ssl_ctx_callback_ctrl(ctx, cmd, fp); 3220 } 3221 } 3222 3223 int ssl_cipher_id_cmp(const SSL_CIPHER *a, const SSL_CIPHER *b) 3224 { 3225 if (a->id > b->id) 3226 return 1; 3227 if (a->id < b->id) 3228 return -1; 3229 return 0; 3230 } 3231 3232 int ssl_cipher_ptr_id_cmp(const SSL_CIPHER *const *ap, 3233 const SSL_CIPHER *const *bp) 3234 { 3235 if ((*ap)->id > (*bp)->id) 3236 return 1; 3237 if ((*ap)->id < (*bp)->id) 3238 return -1; 3239 return 0; 3240 } 3241 3242 /* 3243 * return a STACK of the ciphers available for the SSL and in order of 3244 * preference 3245 */ 3246 STACK_OF(SSL_CIPHER) *SSL_get_ciphers(const SSL *s) 3247 { 3248 const SSL_CONNECTION *sc = SSL_CONNECTION_FROM_CONST_SSL(s); 3249 3250 if (sc != NULL) { 3251 if (sc->cipher_list != NULL) { 3252 return sc->cipher_list; 3253 } else if ((s->ctx != NULL) && (s->ctx->cipher_list != NULL)) { 3254 return s->ctx->cipher_list; 3255 } 3256 } 3257 return NULL; 3258 } 3259 3260 STACK_OF(SSL_CIPHER) *SSL_get_client_ciphers(const SSL *s) 3261 { 3262 const SSL_CONNECTION *sc = SSL_CONNECTION_FROM_CONST_SSL(s); 3263 3264 if (sc == NULL || !sc->server) 3265 return NULL; 3266 return sc->peer_ciphers; 3267 } 3268 3269 STACK_OF(SSL_CIPHER) *SSL_get1_supported_ciphers(SSL *s) 3270 { 3271 STACK_OF(SSL_CIPHER) *sk = NULL, *ciphers; 3272 int i; 3273 SSL_CONNECTION *sc = SSL_CONNECTION_FROM_SSL(s); 3274 3275 if (sc == NULL) 3276 return NULL; 3277 3278 ciphers = SSL_get_ciphers(s); 3279 if (!ciphers) 3280 return NULL; 3281 if (!ssl_set_client_disabled(sc)) 3282 return NULL; 3283 for (i = 0; i < sk_SSL_CIPHER_num(ciphers); i++) { 3284 const SSL_CIPHER *c = sk_SSL_CIPHER_value(ciphers, i); 3285 if (!ssl_cipher_disabled(sc, c, SSL_SECOP_CIPHER_SUPPORTED, 0)) { 3286 if (!sk) 3287 sk = sk_SSL_CIPHER_new_null(); 3288 if (!sk) 3289 return NULL; 3290 if (!sk_SSL_CIPHER_push(sk, c)) { 3291 sk_SSL_CIPHER_free(sk); 3292 return NULL; 3293 } 3294 } 3295 } 3296 return sk; 3297 } 3298 3299 /** return a STACK of the ciphers available for the SSL and in order of 3300 * algorithm id */ 3301 STACK_OF(SSL_CIPHER) *ssl_get_ciphers_by_id(SSL_CONNECTION *s) 3302 { 3303 if (s != NULL) { 3304 if (s->cipher_list_by_id != NULL) 3305 return s->cipher_list_by_id; 3306 else if (s->ssl.ctx != NULL 3307 && s->ssl.ctx->cipher_list_by_id != NULL) 3308 return s->ssl.ctx->cipher_list_by_id; 3309 } 3310 return NULL; 3311 } 3312 3313 /** The old interface to get the same thing as SSL_get_ciphers() */ 3314 const char *SSL_get_cipher_list(const SSL *s, int n) 3315 { 3316 const SSL_CIPHER *c; 3317 STACK_OF(SSL_CIPHER) *sk; 3318 3319 if (s == NULL) 3320 return NULL; 3321 sk = SSL_get_ciphers(s); 3322 if ((sk == NULL) || (sk_SSL_CIPHER_num(sk) <= n)) 3323 return NULL; 3324 c = sk_SSL_CIPHER_value(sk, n); 3325 if (c == NULL) 3326 return NULL; 3327 return c->name; 3328 } 3329 3330 /** return a STACK of the ciphers available for the SSL_CTX and in order of 3331 * preference */ 3332 STACK_OF(SSL_CIPHER) *SSL_CTX_get_ciphers(const SSL_CTX *ctx) 3333 { 3334 if (ctx != NULL) 3335 return ctx->cipher_list; 3336 return NULL; 3337 } 3338 3339 /* 3340 * Distinguish between ciphers controlled by set_ciphersuite() and 3341 * set_cipher_list() when counting. 3342 */ 3343 static int cipher_list_tls12_num(STACK_OF(SSL_CIPHER) *sk) 3344 { 3345 int i, num = 0; 3346 const SSL_CIPHER *c; 3347 3348 if (sk == NULL) 3349 return 0; 3350 for (i = 0; i < sk_SSL_CIPHER_num(sk); ++i) { 3351 c = sk_SSL_CIPHER_value(sk, i); 3352 if (c->min_tls >= TLS1_3_VERSION) 3353 continue; 3354 num++; 3355 } 3356 return num; 3357 } 3358 3359 /** specify the ciphers to be used by default by the SSL_CTX */ 3360 int SSL_CTX_set_cipher_list(SSL_CTX *ctx, const char *str) 3361 { 3362 STACK_OF(SSL_CIPHER) *sk; 3363 3364 sk = ssl_create_cipher_list(ctx, ctx->tls13_ciphersuites, 3365 &ctx->cipher_list, &ctx->cipher_list_by_id, str, 3366 ctx->cert); 3367 /* 3368 * ssl_create_cipher_list may return an empty stack if it was unable to 3369 * find a cipher matching the given rule string (for example if the rule 3370 * string specifies a cipher which has been disabled). This is not an 3371 * error as far as ssl_create_cipher_list is concerned, and hence 3372 * ctx->cipher_list and ctx->cipher_list_by_id has been updated. 3373 */ 3374 if (sk == NULL) 3375 return 0; 3376 if (ctx->method->num_ciphers() > 0 && cipher_list_tls12_num(sk) == 0) { 3377 ERR_raise(ERR_LIB_SSL, SSL_R_NO_CIPHER_MATCH); 3378 return 0; 3379 } 3380 return 1; 3381 } 3382 3383 /** specify the ciphers to be used by the SSL */ 3384 int SSL_set_cipher_list(SSL *s, const char *str) 3385 { 3386 STACK_OF(SSL_CIPHER) *sk; 3387 SSL_CONNECTION *sc = SSL_CONNECTION_FROM_SSL(s); 3388 SSL_CTX *ctx; 3389 3390 if (sc == NULL) 3391 return 0; 3392 3393 ctx = s->ctx; 3394 sk = ssl_create_cipher_list(ctx, sc->tls13_ciphersuites, 3395 &sc->cipher_list, &sc->cipher_list_by_id, str, 3396 sc->cert); 3397 /* see comment in SSL_CTX_set_cipher_list */ 3398 if (sk == NULL) 3399 return 0; 3400 if (ctx->method->num_ciphers() > 0 && cipher_list_tls12_num(sk) == 0) { 3401 ERR_raise(ERR_LIB_SSL, SSL_R_NO_CIPHER_MATCH); 3402 return 0; 3403 } 3404 return 1; 3405 } 3406 3407 char *SSL_get_shared_ciphers(const SSL *s, char *buf, int size) 3408 { 3409 char *p; 3410 STACK_OF(SSL_CIPHER) *clntsk, *srvrsk; 3411 const SSL_CIPHER *c; 3412 int i; 3413 const SSL_CONNECTION *sc = SSL_CONNECTION_FROM_CONST_SSL(s); 3414 3415 if (size < 2 || buf == NULL) 3416 return NULL; 3417 3418 buf[0] = '\0'; 3419 3420 if (sc == NULL || !sc->server) 3421 return NULL; 3422 3423 p = buf; 3424 clntsk = sc->peer_ciphers; 3425 srvrsk = SSL_get_ciphers(s); 3426 3427 if (clntsk == NULL || sk_SSL_CIPHER_num(clntsk) == 0 3428 || srvrsk == NULL || sk_SSL_CIPHER_num(srvrsk) == 0) 3429 return buf; 3430 3431 for (i = 0; i < sk_SSL_CIPHER_num(clntsk); i++) { 3432 int n; 3433 3434 c = sk_SSL_CIPHER_value(clntsk, i); 3435 if (sk_SSL_CIPHER_find(srvrsk, c) < 0) 3436 continue; 3437 3438 n = (int)OPENSSL_strnlen(c->name, size); 3439 if (n >= size) 3440 break; 3441 3442 memcpy(p, c->name, n); 3443 p += n; 3444 *(p++) = ':'; 3445 size -= n + 1; 3446 } 3447 3448 /* No overlap */ 3449 if (p != buf) 3450 p[-1] = '\0'; 3451 3452 return buf; 3453 } 3454 3455 /** 3456 * Return the requested servername (SNI) value. Note that the behaviour varies 3457 * depending on: 3458 * - whether this is called by the client or the server, 3459 * - if we are before or during/after the handshake, 3460 * - if a resumption or normal handshake is being attempted/has occurred 3461 * - whether we have negotiated TLSv1.2 (or below) or TLSv1.3 3462 * 3463 * Note that only the host_name type is defined (RFC 3546). 3464 */ 3465 const char *SSL_get_servername(const SSL *s, const int type) 3466 { 3467 const SSL_CONNECTION *sc = SSL_CONNECTION_FROM_CONST_SSL(s); 3468 int server; 3469 3470 if (sc == NULL) 3471 return NULL; 3472 3473 /* 3474 * If we don't know if we are the client or the server yet then we assume 3475 * client. 3476 */ 3477 server = sc->handshake_func == NULL ? 0 : sc->server; 3478 3479 if (type != TLSEXT_NAMETYPE_host_name) 3480 return NULL; 3481 3482 if (server) { 3483 /** 3484 * Server side 3485 * In TLSv1.3 on the server SNI is not associated with the session 3486 * but in TLSv1.2 or below it is. 3487 * 3488 * Before the handshake: 3489 * - return NULL 3490 * 3491 * During/after the handshake (TLSv1.2 or below resumption occurred): 3492 * - If a servername was accepted by the server in the original 3493 * handshake then it will return that servername, or NULL otherwise. 3494 * 3495 * During/after the handshake (TLSv1.2 or below resumption did not occur): 3496 * - The function will return the servername requested by the client in 3497 * this handshake or NULL if none was requested. 3498 */ 3499 if (sc->hit && !SSL_CONNECTION_IS_TLS13(sc)) 3500 return sc->session->ext.hostname; 3501 } else { 3502 /** 3503 * Client side 3504 * 3505 * Before the handshake: 3506 * - If a servername has been set via a call to 3507 * SSL_set_tlsext_host_name() then it will return that servername 3508 * - If one has not been set, but a TLSv1.2 resumption is being 3509 * attempted and the session from the original handshake had a 3510 * servername accepted by the server then it will return that 3511 * servername 3512 * - Otherwise it returns NULL 3513 * 3514 * During/after the handshake (TLSv1.2 or below resumption occurred): 3515 * - If the session from the original handshake had a servername accepted 3516 * by the server then it will return that servername. 3517 * - Otherwise it returns the servername set via 3518 * SSL_set_tlsext_host_name() (or NULL if it was not called). 3519 * 3520 * During/after the handshake (TLSv1.2 or below resumption did not occur): 3521 * - It will return the servername set via SSL_set_tlsext_host_name() 3522 * (or NULL if it was not called). 3523 */ 3524 if (SSL_in_before(s)) { 3525 if (sc->ext.hostname == NULL 3526 && sc->session != NULL 3527 && sc->session->ssl_version != TLS1_3_VERSION) 3528 return sc->session->ext.hostname; 3529 } else { 3530 if (!SSL_CONNECTION_IS_TLS13(sc) && sc->hit 3531 && sc->session->ext.hostname != NULL) 3532 return sc->session->ext.hostname; 3533 } 3534 } 3535 3536 return sc->ext.hostname; 3537 } 3538 3539 int SSL_get_servername_type(const SSL *s) 3540 { 3541 if (SSL_get_servername(s, TLSEXT_NAMETYPE_host_name) != NULL) 3542 return TLSEXT_NAMETYPE_host_name; 3543 return -1; 3544 } 3545 3546 /* 3547 * SSL_select_next_proto implements the standard protocol selection. It is 3548 * expected that this function is called from the callback set by 3549 * SSL_CTX_set_next_proto_select_cb. The protocol data is assumed to be a 3550 * vector of 8-bit, length prefixed byte strings. The length byte itself is 3551 * not included in the length. A byte string of length 0 is invalid. No byte 3552 * string may be truncated. The current, but experimental algorithm for 3553 * selecting the protocol is: 1) If the server doesn't support NPN then this 3554 * is indicated to the callback. In this case, the client application has to 3555 * abort the connection or have a default application level protocol. 2) If 3556 * the server supports NPN, but advertises an empty list then the client 3557 * selects the first protocol in its list, but indicates via the API that this 3558 * fallback case was enacted. 3) Otherwise, the client finds the first 3559 * protocol in the server's list that it supports and selects this protocol. 3560 * This is because it's assumed that the server has better information about 3561 * which protocol a client should use. 4) If the client doesn't support any 3562 * of the server's advertised protocols, then this is treated the same as 3563 * case 2. It returns either OPENSSL_NPN_NEGOTIATED if a common protocol was 3564 * found, or OPENSSL_NPN_NO_OVERLAP if the fallback case was reached. 3565 */ 3566 int SSL_select_next_proto(unsigned char **out, unsigned char *outlen, 3567 const unsigned char *server, 3568 unsigned int server_len, 3569 const unsigned char *client, unsigned int client_len) 3570 { 3571 PACKET cpkt, csubpkt, spkt, ssubpkt; 3572 3573 if (!PACKET_buf_init(&cpkt, client, client_len) 3574 || !PACKET_get_length_prefixed_1(&cpkt, &csubpkt) 3575 || PACKET_remaining(&csubpkt) == 0) { 3576 *out = NULL; 3577 *outlen = 0; 3578 return OPENSSL_NPN_NO_OVERLAP; 3579 } 3580 3581 /* 3582 * Set the default opportunistic protocol. Will be overwritten if we find 3583 * a match. 3584 */ 3585 *out = (unsigned char *)PACKET_data(&csubpkt); 3586 *outlen = (unsigned char)PACKET_remaining(&csubpkt); 3587 3588 /* 3589 * For each protocol in server preference order, see if we support it. 3590 */ 3591 if (PACKET_buf_init(&spkt, server, server_len)) { 3592 while (PACKET_get_length_prefixed_1(&spkt, &ssubpkt)) { 3593 if (PACKET_remaining(&ssubpkt) == 0) 3594 continue; /* Invalid - ignore it */ 3595 if (PACKET_buf_init(&cpkt, client, client_len)) { 3596 while (PACKET_get_length_prefixed_1(&cpkt, &csubpkt)) { 3597 if (PACKET_equal(&csubpkt, PACKET_data(&ssubpkt), 3598 PACKET_remaining(&ssubpkt))) { 3599 /* We found a match */ 3600 *out = (unsigned char *)PACKET_data(&ssubpkt); 3601 *outlen = (unsigned char)PACKET_remaining(&ssubpkt); 3602 return OPENSSL_NPN_NEGOTIATED; 3603 } 3604 } 3605 /* Ignore spurious trailing bytes in the client list */ 3606 } else { 3607 /* This should never happen */ 3608 return OPENSSL_NPN_NO_OVERLAP; 3609 } 3610 } 3611 /* Ignore spurious trailing bytes in the server list */ 3612 } 3613 3614 /* 3615 * There's no overlap between our protocols and the server's list. We use 3616 * the default opportunistic protocol selected earlier 3617 */ 3618 return OPENSSL_NPN_NO_OVERLAP; 3619 } 3620 3621 #ifndef OPENSSL_NO_NEXTPROTONEG 3622 /* 3623 * SSL_get0_next_proto_negotiated sets *data and *len to point to the 3624 * client's requested protocol for this connection and returns 0. If the 3625 * client didn't request any protocol, then *data is set to NULL. Note that 3626 * the client can request any protocol it chooses. The value returned from 3627 * this function need not be a member of the list of supported protocols 3628 * provided by the callback. 3629 */ 3630 void SSL_get0_next_proto_negotiated(const SSL *s, const unsigned char **data, 3631 unsigned *len) 3632 { 3633 const SSL_CONNECTION *sc = SSL_CONNECTION_FROM_CONST_SSL(s); 3634 3635 if (sc == NULL) { 3636 /* We have no other way to indicate error */ 3637 *data = NULL; 3638 *len = 0; 3639 return; 3640 } 3641 3642 *data = sc->ext.npn; 3643 if (*data == NULL) { 3644 *len = 0; 3645 } else { 3646 *len = (unsigned int)sc->ext.npn_len; 3647 } 3648 } 3649 3650 /* 3651 * SSL_CTX_set_npn_advertised_cb sets a callback that is called when 3652 * a TLS server needs a list of supported protocols for Next Protocol 3653 * Negotiation. The returned list must be in wire format. The list is 3654 * returned by setting |out| to point to it and |outlen| to its length. This 3655 * memory will not be modified, but one should assume that the SSL* keeps a 3656 * reference to it. The callback should return SSL_TLSEXT_ERR_OK if it 3657 * wishes to advertise. Otherwise, no such extension will be included in the 3658 * ServerHello. 3659 */ 3660 void SSL_CTX_set_npn_advertised_cb(SSL_CTX *ctx, 3661 SSL_CTX_npn_advertised_cb_func cb, 3662 void *arg) 3663 { 3664 if (IS_QUIC_CTX(ctx)) 3665 /* NPN not allowed for QUIC */ 3666 return; 3667 3668 ctx->ext.npn_advertised_cb = cb; 3669 ctx->ext.npn_advertised_cb_arg = arg; 3670 } 3671 3672 /* 3673 * SSL_CTX_set_next_proto_select_cb sets a callback that is called when a 3674 * client needs to select a protocol from the server's provided list. |out| 3675 * must be set to point to the selected protocol (which may be within |in|). 3676 * The length of the protocol name must be written into |outlen|. The 3677 * server's advertised protocols are provided in |in| and |inlen|. The 3678 * callback can assume that |in| is syntactically valid. The client must 3679 * select a protocol. It is fatal to the connection if this callback returns 3680 * a value other than SSL_TLSEXT_ERR_OK. 3681 */ 3682 void SSL_CTX_set_npn_select_cb(SSL_CTX *ctx, 3683 SSL_CTX_npn_select_cb_func cb, 3684 void *arg) 3685 { 3686 if (IS_QUIC_CTX(ctx)) 3687 /* NPN not allowed for QUIC */ 3688 return; 3689 3690 ctx->ext.npn_select_cb = cb; 3691 ctx->ext.npn_select_cb_arg = arg; 3692 } 3693 #endif 3694 3695 static int alpn_value_ok(const unsigned char *protos, unsigned int protos_len) 3696 { 3697 unsigned int idx; 3698 3699 if (protos_len < 2 || protos == NULL) 3700 return 0; 3701 3702 for (idx = 0; idx < protos_len; idx += protos[idx] + 1) { 3703 if (protos[idx] == 0) 3704 return 0; 3705 } 3706 return idx == protos_len; 3707 } 3708 /* 3709 * SSL_CTX_set_alpn_protos sets the ALPN protocol list on |ctx| to |protos|. 3710 * |protos| must be in wire-format (i.e. a series of non-empty, 8-bit 3711 * length-prefixed strings). Returns 0 on success. 3712 */ 3713 int SSL_CTX_set_alpn_protos(SSL_CTX *ctx, const unsigned char *protos, 3714 unsigned int protos_len) 3715 { 3716 unsigned char *alpn; 3717 3718 if (protos_len == 0 || protos == NULL) { 3719 OPENSSL_free(ctx->ext.alpn); 3720 ctx->ext.alpn = NULL; 3721 ctx->ext.alpn_len = 0; 3722 return 0; 3723 } 3724 /* Not valid per RFC */ 3725 if (!alpn_value_ok(protos, protos_len)) 3726 return 1; 3727 3728 alpn = OPENSSL_memdup(protos, protos_len); 3729 if (alpn == NULL) 3730 return 1; 3731 OPENSSL_free(ctx->ext.alpn); 3732 ctx->ext.alpn = alpn; 3733 ctx->ext.alpn_len = protos_len; 3734 3735 return 0; 3736 } 3737 3738 /* 3739 * SSL_set_alpn_protos sets the ALPN protocol list on |ssl| to |protos|. 3740 * |protos| must be in wire-format (i.e. a series of non-empty, 8-bit 3741 * length-prefixed strings). Returns 0 on success. 3742 */ 3743 int SSL_set_alpn_protos(SSL *ssl, const unsigned char *protos, 3744 unsigned int protos_len) 3745 { 3746 unsigned char *alpn; 3747 SSL_CONNECTION *sc = SSL_CONNECTION_FROM_SSL(ssl); 3748 3749 if (sc == NULL) 3750 return 1; 3751 3752 if (protos_len == 0 || protos == NULL) { 3753 OPENSSL_free(sc->ext.alpn); 3754 sc->ext.alpn = NULL; 3755 sc->ext.alpn_len = 0; 3756 return 0; 3757 } 3758 /* Not valid per RFC */ 3759 if (!alpn_value_ok(protos, protos_len)) 3760 return 1; 3761 3762 alpn = OPENSSL_memdup(protos, protos_len); 3763 if (alpn == NULL) 3764 return 1; 3765 OPENSSL_free(sc->ext.alpn); 3766 sc->ext.alpn = alpn; 3767 sc->ext.alpn_len = protos_len; 3768 3769 return 0; 3770 } 3771 3772 /* 3773 * SSL_CTX_set_alpn_select_cb sets a callback function on |ctx| that is 3774 * called during ClientHello processing in order to select an ALPN protocol 3775 * from the client's list of offered protocols. 3776 */ 3777 void SSL_CTX_set_alpn_select_cb(SSL_CTX *ctx, 3778 SSL_CTX_alpn_select_cb_func cb, 3779 void *arg) 3780 { 3781 ctx->ext.alpn_select_cb = cb; 3782 ctx->ext.alpn_select_cb_arg = arg; 3783 } 3784 3785 /* 3786 * SSL_get0_alpn_selected gets the selected ALPN protocol (if any) from |ssl|. 3787 * On return it sets |*data| to point to |*len| bytes of protocol name 3788 * (not including the leading length-prefix byte). If the server didn't 3789 * respond with a negotiated protocol then |*len| will be zero. 3790 */ 3791 void SSL_get0_alpn_selected(const SSL *ssl, const unsigned char **data, 3792 unsigned int *len) 3793 { 3794 const SSL_CONNECTION *sc = SSL_CONNECTION_FROM_CONST_SSL(ssl); 3795 3796 if (sc == NULL) { 3797 /* We have no other way to indicate error */ 3798 *data = NULL; 3799 *len = 0; 3800 return; 3801 } 3802 3803 *data = sc->s3.alpn_selected; 3804 if (*data == NULL) 3805 *len = 0; 3806 else 3807 *len = (unsigned int)sc->s3.alpn_selected_len; 3808 } 3809 3810 int SSL_export_keying_material(SSL *s, unsigned char *out, size_t olen, 3811 const char *label, size_t llen, 3812 const unsigned char *context, size_t contextlen, 3813 int use_context) 3814 { 3815 SSL_CONNECTION *sc = SSL_CONNECTION_FROM_SSL(s); 3816 3817 if (sc == NULL) 3818 return -1; 3819 3820 if (sc->session == NULL 3821 || (sc->version < TLS1_VERSION && sc->version != DTLS1_BAD_VER)) 3822 return -1; 3823 3824 return sc->ssl.method->ssl3_enc->export_keying_material(sc, out, olen, label, 3825 llen, context, 3826 contextlen, 3827 use_context); 3828 } 3829 3830 int SSL_export_keying_material_early(SSL *s, unsigned char *out, size_t olen, 3831 const char *label, size_t llen, 3832 const unsigned char *context, 3833 size_t contextlen) 3834 { 3835 SSL_CONNECTION *sc = SSL_CONNECTION_FROM_SSL(s); 3836 3837 if (sc == NULL) 3838 return -1; 3839 3840 if (sc->version != TLS1_3_VERSION) 3841 return 0; 3842 3843 return tls13_export_keying_material_early(sc, out, olen, label, llen, 3844 context, contextlen); 3845 } 3846 3847 static unsigned long ssl_session_hash(const SSL_SESSION *a) 3848 { 3849 const unsigned char *session_id = a->session_id; 3850 unsigned long l; 3851 unsigned char tmp_storage[4]; 3852 3853 if (a->session_id_length < sizeof(tmp_storage)) { 3854 memset(tmp_storage, 0, sizeof(tmp_storage)); 3855 memcpy(tmp_storage, a->session_id, a->session_id_length); 3856 session_id = tmp_storage; 3857 } 3858 3859 l = (unsigned long)((unsigned long)session_id[0]) | ((unsigned long)session_id[1] << 8L) | ((unsigned long)session_id[2] << 16L) | ((unsigned long)session_id[3] << 24L); 3860 return l; 3861 } 3862 3863 /* 3864 * NB: If this function (or indeed the hash function which uses a sort of 3865 * coarser function than this one) is changed, ensure 3866 * SSL_CTX_has_matching_session_id() is checked accordingly. It relies on 3867 * being able to construct an SSL_SESSION that will collide with any existing 3868 * session with a matching session ID. 3869 */ 3870 static int ssl_session_cmp(const SSL_SESSION *a, const SSL_SESSION *b) 3871 { 3872 if (a->ssl_version != b->ssl_version) 3873 return 1; 3874 if (a->session_id_length != b->session_id_length) 3875 return 1; 3876 return memcmp(a->session_id, b->session_id, a->session_id_length); 3877 } 3878 3879 #ifndef OPENSSL_NO_SSLKEYLOG 3880 /** 3881 * @brief Static initialization for a one-time action to initialize the SSL key log. 3882 */ 3883 static CRYPTO_ONCE ssl_keylog_once = CRYPTO_ONCE_STATIC_INIT; 3884 3885 /** 3886 * @brief Pointer to a read-write lock used to protect access to the key log. 3887 */ 3888 static CRYPTO_RWLOCK *keylog_lock = NULL; 3889 3890 /** 3891 * @brief Pointer to a BIO structure used for writing the key log information. 3892 */ 3893 static BIO *keylog_bio = NULL; 3894 3895 /** 3896 * @brief Initializes the SSLKEYLOGFILE lock. 3897 * 3898 * @return 1 on success, 0 on failure. 3899 */ 3900 DEFINE_RUN_ONCE_STATIC(ssl_keylog_init) 3901 { 3902 keylog_lock = CRYPTO_THREAD_lock_new(); 3903 if (keylog_lock == NULL) 3904 return 0; 3905 return 1; 3906 } 3907 3908 /** 3909 * @brief checks when a BIO refcount has reached zero, and sets 3910 * keylog_cb to NULL if it has 3911 * 3912 * @returns 1 always 3913 */ 3914 static long check_keylog_bio_free(BIO *b, int oper, const char *argp, 3915 size_t len, int argi, long argl, int ret, 3916 size_t *processed) 3917 { 3918 3919 /* 3920 * Note we _dont_ take the keylog_lock here 3921 * This is intentional, because we only free the keylog lock 3922 * During SSL_CTX_free, in which we already possess the lock, so 3923 * There's no need to grab it again here 3924 */ 3925 if (oper == BIO_CB_FREE) 3926 keylog_bio = NULL; 3927 return ret; 3928 } 3929 3930 /** 3931 * @brief records ssl secrets to a file 3932 */ 3933 static void do_sslkeylogfile(const SSL *ssl, const char *line) 3934 { 3935 if (keylog_lock == NULL) 3936 return; 3937 3938 if (!CRYPTO_THREAD_write_lock(keylog_lock)) 3939 return; 3940 if (keylog_bio != NULL) { 3941 BIO_printf(keylog_bio, "%s\n", line); 3942 (void)BIO_flush(keylog_bio); 3943 } 3944 CRYPTO_THREAD_unlock(keylog_lock); 3945 } 3946 #endif 3947 3948 /* 3949 * These wrapper functions should remain rather than redeclaring 3950 * SSL_SESSION_hash and SSL_SESSION_cmp for void* types and casting each 3951 * variable. The reason is that the functions aren't static, they're exposed 3952 * via ssl.h. 3953 */ 3954 3955 #ifndef OPENSSL_NO_SSLKEYLOG 3956 static BIO *get_sslkeylog_bio(const char *keylogfile) 3957 { 3958 #ifdef _POSIX_C_SOURCE 3959 BIO *b; 3960 int fdno = -1; 3961 FILE *fp = NULL; 3962 3963 fdno = open(keylogfile, O_WRONLY | O_CREAT | O_APPEND, 0600); 3964 if (fdno < 0) 3965 return NULL; 3966 3967 fp = fdopen(fdno, "a"); 3968 if (fp == NULL) { 3969 close(fdno); 3970 return NULL; 3971 } 3972 3973 if ((b = BIO_new_fp(fp, BIO_CLOSE)) == NULL) 3974 fclose(fp); 3975 return b; 3976 #else 3977 return BIO_new_file(keylogfile, "a"); 3978 #endif 3979 } 3980 #endif 3981 3982 SSL_CTX *SSL_CTX_new_ex(OSSL_LIB_CTX *libctx, const char *propq, 3983 const SSL_METHOD *meth) 3984 { 3985 SSL_CTX *ret = NULL; 3986 #ifndef OPENSSL_NO_SSLKEYLOG 3987 const char *keylogfile = ossl_safe_getenv("SSLKEYLOGFILE"); 3988 #endif 3989 #ifndef OPENSSL_NO_COMP_ALG 3990 int i; 3991 #endif 3992 3993 if (meth == NULL) { 3994 ERR_raise(ERR_LIB_SSL, SSL_R_NULL_SSL_METHOD_PASSED); 3995 return NULL; 3996 } 3997 3998 if (!OPENSSL_init_ssl(OPENSSL_INIT_LOAD_SSL_STRINGS, NULL)) 3999 return NULL; 4000 4001 /* Doing this for the run once effect */ 4002 if (SSL_get_ex_data_X509_STORE_CTX_idx() < 0) { 4003 ERR_raise(ERR_LIB_SSL, SSL_R_X509_VERIFICATION_SETUP_PROBLEMS); 4004 goto err; 4005 } 4006 4007 ret = OPENSSL_zalloc(sizeof(*ret)); 4008 if (ret == NULL) 4009 return NULL; 4010 4011 /* Init the reference counting before any call to SSL_CTX_free */ 4012 if (!CRYPTO_NEW_REF(&ret->references, 1)) { 4013 OPENSSL_free(ret); 4014 return NULL; 4015 } 4016 4017 ret->lock = CRYPTO_THREAD_lock_new(); 4018 if (ret->lock == NULL) { 4019 ERR_raise(ERR_LIB_SSL, ERR_R_CRYPTO_LIB); 4020 goto err; 4021 } 4022 4023 #ifdef TSAN_REQUIRES_LOCKING 4024 ret->tsan_lock = CRYPTO_THREAD_lock_new(); 4025 if (ret->tsan_lock == NULL) { 4026 ERR_raise(ERR_LIB_SSL, ERR_R_CRYPTO_LIB); 4027 goto err; 4028 } 4029 #endif 4030 4031 ret->libctx = libctx; 4032 if (propq != NULL) { 4033 ret->propq = OPENSSL_strdup(propq); 4034 if (ret->propq == NULL) 4035 goto err; 4036 } 4037 4038 ret->method = meth; 4039 ret->min_proto_version = 0; 4040 ret->max_proto_version = 0; 4041 ret->mode = SSL_MODE_AUTO_RETRY; 4042 ret->session_cache_mode = SSL_SESS_CACHE_SERVER; 4043 ret->session_cache_size = SSL_SESSION_CACHE_MAX_SIZE_DEFAULT; 4044 /* We take the system default. */ 4045 ret->session_timeout = meth->get_timeout(); 4046 ret->max_cert_list = SSL_MAX_CERT_LIST_DEFAULT; 4047 ret->verify_mode = SSL_VERIFY_NONE; 4048 4049 ret->sessions = lh_SSL_SESSION_new(ssl_session_hash, ssl_session_cmp); 4050 if (ret->sessions == NULL) { 4051 ERR_raise(ERR_LIB_SSL, ERR_R_CRYPTO_LIB); 4052 goto err; 4053 } 4054 ret->cert_store = X509_STORE_new(); 4055 if (ret->cert_store == NULL) { 4056 ERR_raise(ERR_LIB_SSL, ERR_R_X509_LIB); 4057 goto err; 4058 } 4059 #ifndef OPENSSL_NO_CT 4060 ret->ctlog_store = CTLOG_STORE_new_ex(libctx, propq); 4061 if (ret->ctlog_store == NULL) { 4062 ERR_raise(ERR_LIB_SSL, ERR_R_CT_LIB); 4063 goto err; 4064 } 4065 #endif 4066 4067 /* initialize cipher/digest methods table */ 4068 if (!ssl_load_ciphers(ret)) { 4069 ERR_raise(ERR_LIB_SSL, ERR_R_SSL_LIB); 4070 goto err; 4071 } 4072 4073 if (!ssl_load_groups(ret)) { 4074 ERR_raise(ERR_LIB_SSL, ERR_R_SSL_LIB); 4075 goto err; 4076 } 4077 4078 /* load provider sigalgs */ 4079 if (!ssl_load_sigalgs(ret)) { 4080 ERR_raise(ERR_LIB_SSL, ERR_R_SSL_LIB); 4081 goto err; 4082 } 4083 4084 /* initialise sig algs */ 4085 if (!ssl_setup_sigalgs(ret)) { 4086 ERR_raise(ERR_LIB_SSL, ERR_R_SSL_LIB); 4087 goto err; 4088 } 4089 4090 if (!SSL_CTX_set_ciphersuites(ret, OSSL_default_ciphersuites())) { 4091 ERR_raise(ERR_LIB_SSL, ERR_R_SSL_LIB); 4092 goto err; 4093 } 4094 4095 if ((ret->cert = ssl_cert_new(SSL_PKEY_NUM + ret->sigalg_list_len)) == NULL) { 4096 ERR_raise(ERR_LIB_SSL, ERR_R_SSL_LIB); 4097 goto err; 4098 } 4099 4100 if (!ssl_create_cipher_list(ret, 4101 ret->tls13_ciphersuites, 4102 &ret->cipher_list, &ret->cipher_list_by_id, 4103 OSSL_default_cipher_list(), ret->cert) 4104 || sk_SSL_CIPHER_num(ret->cipher_list) <= 0) { 4105 ERR_raise(ERR_LIB_SSL, SSL_R_LIBRARY_HAS_NO_CIPHERS); 4106 goto err; 4107 } 4108 4109 ret->param = X509_VERIFY_PARAM_new(); 4110 if (ret->param == NULL) { 4111 ERR_raise(ERR_LIB_SSL, ERR_R_X509_LIB); 4112 goto err; 4113 } 4114 4115 /* 4116 * If these aren't available from the provider we'll get NULL returns. 4117 * That's fine but will cause errors later if SSLv3 is negotiated 4118 */ 4119 ret->md5 = ssl_evp_md_fetch(libctx, NID_md5, propq); 4120 ret->sha1 = ssl_evp_md_fetch(libctx, NID_sha1, propq); 4121 4122 if ((ret->ca_names = sk_X509_NAME_new_null()) == NULL) { 4123 ERR_raise(ERR_LIB_SSL, ERR_R_CRYPTO_LIB); 4124 goto err; 4125 } 4126 4127 if ((ret->client_ca_names = sk_X509_NAME_new_null()) == NULL) { 4128 ERR_raise(ERR_LIB_SSL, ERR_R_CRYPTO_LIB); 4129 goto err; 4130 } 4131 4132 if (!CRYPTO_new_ex_data(CRYPTO_EX_INDEX_SSL_CTX, ret, &ret->ex_data)) { 4133 ERR_raise(ERR_LIB_SSL, ERR_R_CRYPTO_LIB); 4134 goto err; 4135 } 4136 4137 if ((ret->ext.secure = OPENSSL_secure_zalloc(sizeof(*ret->ext.secure))) == NULL) 4138 goto err; 4139 4140 /* No compression for DTLS */ 4141 if (!(meth->ssl3_enc->enc_flags & SSL_ENC_FLAG_DTLS)) 4142 ret->comp_methods = SSL_COMP_get_compression_methods(); 4143 4144 ret->max_send_fragment = SSL3_RT_MAX_PLAIN_LENGTH; 4145 ret->split_send_fragment = SSL3_RT_MAX_PLAIN_LENGTH; 4146 4147 /* Setup RFC5077 ticket keys */ 4148 if ((RAND_bytes_ex(libctx, ret->ext.tick_key_name, 4149 sizeof(ret->ext.tick_key_name), 0) 4150 <= 0) 4151 || (RAND_priv_bytes_ex(libctx, ret->ext.secure->tick_hmac_key, 4152 sizeof(ret->ext.secure->tick_hmac_key), 0) 4153 <= 0) 4154 || (RAND_priv_bytes_ex(libctx, ret->ext.secure->tick_aes_key, 4155 sizeof(ret->ext.secure->tick_aes_key), 0) 4156 <= 0)) 4157 ret->options |= SSL_OP_NO_TICKET; 4158 4159 if (RAND_priv_bytes_ex(libctx, ret->ext.cookie_hmac_key, 4160 sizeof(ret->ext.cookie_hmac_key), 0) 4161 <= 0) { 4162 ERR_raise(ERR_LIB_SSL, ERR_R_RAND_LIB); 4163 goto err; 4164 } 4165 4166 #ifndef OPENSSL_NO_SRP 4167 if (!ssl_ctx_srp_ctx_init_intern(ret)) { 4168 ERR_raise(ERR_LIB_SSL, ERR_R_SSL_LIB); 4169 goto err; 4170 } 4171 #endif 4172 #ifndef OPENSSL_NO_ENGINE 4173 #ifdef OPENSSL_SSL_CLIENT_ENGINE_AUTO 4174 #define eng_strx(x) #x 4175 #define eng_str(x) eng_strx(x) 4176 /* Use specific client engine automatically... ignore errors */ 4177 { 4178 ENGINE *eng; 4179 eng = ENGINE_by_id(eng_str(OPENSSL_SSL_CLIENT_ENGINE_AUTO)); 4180 if (!eng) { 4181 ERR_clear_error(); 4182 ENGINE_load_builtin_engines(); 4183 eng = ENGINE_by_id(eng_str(OPENSSL_SSL_CLIENT_ENGINE_AUTO)); 4184 } 4185 if (!eng || !SSL_CTX_set_client_cert_engine(ret, eng)) 4186 ERR_clear_error(); 4187 } 4188 #endif 4189 #endif 4190 4191 #ifndef OPENSSL_NO_COMP_ALG 4192 /* 4193 * Set the default order: brotli, zlib, zstd 4194 * Including only those enabled algorithms 4195 */ 4196 memset(ret->cert_comp_prefs, 0, sizeof(ret->cert_comp_prefs)); 4197 i = 0; 4198 if (ossl_comp_has_alg(TLSEXT_comp_cert_brotli)) 4199 ret->cert_comp_prefs[i++] = TLSEXT_comp_cert_brotli; 4200 if (ossl_comp_has_alg(TLSEXT_comp_cert_zlib)) 4201 ret->cert_comp_prefs[i++] = TLSEXT_comp_cert_zlib; 4202 if (ossl_comp_has_alg(TLSEXT_comp_cert_zstd)) 4203 ret->cert_comp_prefs[i++] = TLSEXT_comp_cert_zstd; 4204 #endif 4205 /* 4206 * Disable compression by default to prevent CRIME. Applications can 4207 * re-enable compression by configuring 4208 * SSL_CTX_clear_options(ctx, SSL_OP_NO_COMPRESSION); 4209 * or by using the SSL_CONF library. Similarly we also enable TLSv1.3 4210 * middlebox compatibility by default. This may be disabled by default in 4211 * a later OpenSSL version. 4212 */ 4213 ret->options |= SSL_OP_NO_COMPRESSION | SSL_OP_ENABLE_MIDDLEBOX_COMPAT; 4214 4215 ret->ext.status_type = TLSEXT_STATUSTYPE_nothing; 4216 4217 /* 4218 * We cannot usefully set a default max_early_data here (which gets 4219 * propagated in SSL_new(), for the following reason: setting the 4220 * SSL field causes tls_construct_stoc_early_data() to tell the 4221 * client that early data will be accepted when constructing a TLS 1.3 4222 * session ticket, and the client will accordingly send us early data 4223 * when using that ticket (if the client has early data to send). 4224 * However, in order for the early data to actually be consumed by 4225 * the application, the application must also have calls to 4226 * SSL_read_early_data(); otherwise we'll just skip past the early data 4227 * and ignore it. So, since the application must add calls to 4228 * SSL_read_early_data(), we also require them to add 4229 * calls to SSL_CTX_set_max_early_data() in order to use early data, 4230 * eliminating the bandwidth-wasting early data in the case described 4231 * above. 4232 */ 4233 ret->max_early_data = 0; 4234 4235 /* 4236 * Default recv_max_early_data is a fully loaded single record. Could be 4237 * split across multiple records in practice. We set this differently to 4238 * max_early_data so that, in the default case, we do not advertise any 4239 * support for early_data, but if a client were to send us some (e.g. 4240 * because of an old, stale ticket) then we will tolerate it and skip over 4241 * it. 4242 */ 4243 ret->recv_max_early_data = SSL3_RT_MAX_PLAIN_LENGTH; 4244 4245 /* By default we send two session tickets automatically in TLSv1.3 */ 4246 ret->num_tickets = 2; 4247 4248 #ifndef OPENSSL_NO_QUIC 4249 /* only create a cache for client CTX-es */ 4250 if (meth == OSSL_QUIC_client_method()) 4251 if ((ret->tokencache = ossl_quic_new_token_store()) == NULL) 4252 goto err; 4253 ret->domain_flags = 0; 4254 if (IS_QUIC_METHOD(meth)) { 4255 #if defined(OPENSSL_THREADS) 4256 if (meth == OSSL_QUIC_client_thread_method()) 4257 ret->domain_flags 4258 = SSL_DOMAIN_FLAG_MULTI_THREAD 4259 | SSL_DOMAIN_FLAG_THREAD_ASSISTED 4260 | SSL_DOMAIN_FLAG_BLOCKING; 4261 else 4262 ret->domain_flags 4263 = SSL_DOMAIN_FLAG_MULTI_THREAD 4264 | SSL_DOMAIN_FLAG_LEGACY_BLOCKING; 4265 #else 4266 ret->domain_flags 4267 = SSL_DOMAIN_FLAG_SINGLE_THREAD 4268 | SSL_DOMAIN_FLAG_LEGACY_BLOCKING; 4269 #endif 4270 } 4271 #endif 4272 4273 if (!ssl_ctx_system_config(ret)) { 4274 ERR_raise(ERR_LIB_SSL, SSL_R_ERROR_IN_SYSTEM_DEFAULT_CONFIG); 4275 goto err; 4276 } 4277 4278 #ifndef OPENSSL_NO_SSLKEYLOG 4279 if (keylogfile != NULL && strlen(keylogfile) != 0) { 4280 /* Make sure we have a global lock allocated */ 4281 if (!RUN_ONCE(&ssl_keylog_once, ssl_keylog_init)) { 4282 /* use a trace message as a warning */ 4283 OSSL_TRACE(TLS, "Unable to initialize keylog data\n"); 4284 goto out; 4285 } 4286 4287 /* Grab our global lock */ 4288 if (!CRYPTO_THREAD_write_lock(keylog_lock)) { 4289 OSSL_TRACE(TLS, "Unable to acquire keylog write lock\n"); 4290 goto out; 4291 } else { 4292 /* 4293 * If the bio for the requested keylog file hasn't been 4294 * created yet, go ahead and create it, and set it to append 4295 * if its already there. 4296 */ 4297 if (keylog_bio == NULL) { 4298 keylog_bio = get_sslkeylog_bio(keylogfile); 4299 if (keylog_bio == NULL) { 4300 OSSL_TRACE(TLS, "Unable to create keylog bio\n"); 4301 goto out; 4302 } 4303 BIO_set_callback_ex(keylog_bio, check_keylog_bio_free); 4304 } else { 4305 /* up our refcount for the already-created case */ 4306 BIO_up_ref(keylog_bio); 4307 } 4308 /* If we have a bio now, assign the callback handler */ 4309 if (keylog_bio != NULL) 4310 ret->do_sslkeylog = 1; 4311 /* unlock, and we're done */ 4312 CRYPTO_THREAD_unlock(keylog_lock); 4313 } 4314 } 4315 out: 4316 #endif 4317 return ret; 4318 err: 4319 SSL_CTX_free(ret); 4320 #ifndef OPENSSL_NO_SSLKEYLOG 4321 BIO_free(keylog_bio); 4322 #endif 4323 return NULL; 4324 } 4325 4326 SSL_CTX *SSL_CTX_new(const SSL_METHOD *meth) 4327 { 4328 return SSL_CTX_new_ex(NULL, NULL, meth); 4329 } 4330 4331 int SSL_CTX_up_ref(SSL_CTX *ctx) 4332 { 4333 int i; 4334 4335 if (CRYPTO_UP_REF(&ctx->references, &i) <= 0) 4336 return 0; 4337 4338 REF_PRINT_COUNT("SSL_CTX", i, ctx); 4339 REF_ASSERT_ISNT(i < 2); 4340 return ((i > 1) ? 1 : 0); 4341 } 4342 4343 void SSL_CTX_free(SSL_CTX *a) 4344 { 4345 int i; 4346 size_t j; 4347 4348 if (a == NULL) 4349 return; 4350 4351 CRYPTO_DOWN_REF(&a->references, &i); 4352 REF_PRINT_COUNT("SSL_CTX", i, a); 4353 if (i > 0) 4354 return; 4355 REF_ASSERT_ISNT(i < 0); 4356 4357 #ifndef OPENSSL_NO_SSLKEYLOG 4358 if (keylog_lock != NULL && CRYPTO_THREAD_write_lock(keylog_lock)) { 4359 if (a->do_sslkeylog == 1) 4360 BIO_free(keylog_bio); 4361 a->do_sslkeylog = 0; 4362 CRYPTO_THREAD_unlock(keylog_lock); 4363 } 4364 #endif 4365 4366 X509_VERIFY_PARAM_free(a->param); 4367 dane_ctx_final(&a->dane); 4368 4369 /* 4370 * Free internal session cache. However: the remove_cb() may reference 4371 * the ex_data of SSL_CTX, thus the ex_data store can only be removed 4372 * after the sessions were flushed. 4373 * As the ex_data handling routines might also touch the session cache, 4374 * the most secure solution seems to be: empty (flush) the cache, then 4375 * free ex_data, then finally free the cache. 4376 * (See ticket [openssl.org #212].) 4377 */ 4378 if (a->sessions != NULL) 4379 SSL_CTX_flush_sessions_ex(a, 0); 4380 4381 CRYPTO_free_ex_data(CRYPTO_EX_INDEX_SSL_CTX, a, &a->ex_data); 4382 lh_SSL_SESSION_free(a->sessions); 4383 X509_STORE_free(a->cert_store); 4384 #ifndef OPENSSL_NO_CT 4385 CTLOG_STORE_free(a->ctlog_store); 4386 #endif 4387 sk_SSL_CIPHER_free(a->cipher_list); 4388 sk_SSL_CIPHER_free(a->cipher_list_by_id); 4389 sk_SSL_CIPHER_free(a->tls13_ciphersuites); 4390 ssl_cert_free(a->cert); 4391 sk_X509_NAME_pop_free(a->ca_names, X509_NAME_free); 4392 sk_X509_NAME_pop_free(a->client_ca_names, X509_NAME_free); 4393 OSSL_STACK_OF_X509_free(a->extra_certs); 4394 a->comp_methods = NULL; 4395 #ifndef OPENSSL_NO_SRTP 4396 sk_SRTP_PROTECTION_PROFILE_free(a->srtp_profiles); 4397 #endif 4398 #ifndef OPENSSL_NO_SRP 4399 ssl_ctx_srp_ctx_free_intern(a); 4400 #endif 4401 #ifndef OPENSSL_NO_ENGINE 4402 tls_engine_finish(a->client_cert_engine); 4403 #endif 4404 4405 OPENSSL_free(a->ext.ecpointformats); 4406 OPENSSL_free(a->ext.supportedgroups); 4407 OPENSSL_free(a->ext.keyshares); 4408 OPENSSL_free(a->ext.tuples); 4409 OPENSSL_free(a->ext.alpn); 4410 OPENSSL_secure_free(a->ext.secure); 4411 4412 ssl_evp_md_free(a->md5); 4413 ssl_evp_md_free(a->sha1); 4414 4415 for (j = 0; j < SSL_ENC_NUM_IDX; j++) 4416 ssl_evp_cipher_free(a->ssl_cipher_methods[j]); 4417 for (j = 0; j < SSL_MD_NUM_IDX; j++) 4418 ssl_evp_md_free(a->ssl_digest_methods[j]); 4419 for (j = 0; j < a->group_list_len; j++) { 4420 OPENSSL_free(a->group_list[j].tlsname); 4421 OPENSSL_free(a->group_list[j].realname); 4422 OPENSSL_free(a->group_list[j].algorithm); 4423 } 4424 OPENSSL_free(a->group_list); 4425 for (j = 0; j < a->sigalg_list_len; j++) { 4426 OPENSSL_free(a->sigalg_list[j].name); 4427 OPENSSL_free(a->sigalg_list[j].sigalg_name); 4428 OPENSSL_free(a->sigalg_list[j].sigalg_oid); 4429 OPENSSL_free(a->sigalg_list[j].sig_name); 4430 OPENSSL_free(a->sigalg_list[j].sig_oid); 4431 OPENSSL_free(a->sigalg_list[j].hash_name); 4432 OPENSSL_free(a->sigalg_list[j].hash_oid); 4433 OPENSSL_free(a->sigalg_list[j].keytype); 4434 OPENSSL_free(a->sigalg_list[j].keytype_oid); 4435 } 4436 OPENSSL_free(a->sigalg_list); 4437 OPENSSL_free(a->ssl_cert_info); 4438 4439 OPENSSL_free(a->sigalg_lookup_cache); 4440 OPENSSL_free(a->tls12_sigalgs); 4441 4442 OPENSSL_free(a->client_cert_type); 4443 OPENSSL_free(a->server_cert_type); 4444 4445 CRYPTO_THREAD_lock_free(a->lock); 4446 CRYPTO_FREE_REF(&a->references); 4447 #ifdef TSAN_REQUIRES_LOCKING 4448 CRYPTO_THREAD_lock_free(a->tsan_lock); 4449 #endif 4450 4451 OPENSSL_free(a->propq); 4452 #ifndef OPENSSL_NO_QLOG 4453 OPENSSL_free(a->qlog_title); 4454 #endif 4455 4456 #ifndef OPENSSL_NO_QUIC 4457 ossl_quic_free_token_store(a->tokencache); 4458 #endif 4459 4460 OPENSSL_free(a); 4461 } 4462 4463 void SSL_CTX_set_default_passwd_cb(SSL_CTX *ctx, pem_password_cb *cb) 4464 { 4465 ctx->default_passwd_callback = cb; 4466 } 4467 4468 void SSL_CTX_set_default_passwd_cb_userdata(SSL_CTX *ctx, void *u) 4469 { 4470 ctx->default_passwd_callback_userdata = u; 4471 } 4472 4473 pem_password_cb *SSL_CTX_get_default_passwd_cb(SSL_CTX *ctx) 4474 { 4475 return ctx->default_passwd_callback; 4476 } 4477 4478 void *SSL_CTX_get_default_passwd_cb_userdata(SSL_CTX *ctx) 4479 { 4480 return ctx->default_passwd_callback_userdata; 4481 } 4482 4483 void SSL_set_default_passwd_cb(SSL *s, pem_password_cb *cb) 4484 { 4485 SSL_CONNECTION *sc = SSL_CONNECTION_FROM_SSL(s); 4486 4487 if (sc == NULL) 4488 return; 4489 4490 sc->default_passwd_callback = cb; 4491 } 4492 4493 void SSL_set_default_passwd_cb_userdata(SSL *s, void *u) 4494 { 4495 SSL_CONNECTION *sc = SSL_CONNECTION_FROM_SSL(s); 4496 4497 if (sc == NULL) 4498 return; 4499 4500 sc->default_passwd_callback_userdata = u; 4501 } 4502 4503 pem_password_cb *SSL_get_default_passwd_cb(SSL *s) 4504 { 4505 SSL_CONNECTION *sc = SSL_CONNECTION_FROM_SSL(s); 4506 4507 if (sc == NULL) 4508 return NULL; 4509 4510 return sc->default_passwd_callback; 4511 } 4512 4513 void *SSL_get_default_passwd_cb_userdata(SSL *s) 4514 { 4515 SSL_CONNECTION *sc = SSL_CONNECTION_FROM_SSL(s); 4516 4517 if (sc == NULL) 4518 return NULL; 4519 4520 return sc->default_passwd_callback_userdata; 4521 } 4522 4523 void SSL_CTX_set_cert_verify_callback(SSL_CTX *ctx, 4524 int (*cb)(X509_STORE_CTX *, void *), 4525 void *arg) 4526 { 4527 ctx->app_verify_callback = cb; 4528 ctx->app_verify_arg = arg; 4529 } 4530 4531 void SSL_CTX_set_verify(SSL_CTX *ctx, int mode, 4532 int (*cb)(int, X509_STORE_CTX *)) 4533 { 4534 ctx->verify_mode = mode; 4535 ctx->default_verify_callback = cb; 4536 } 4537 4538 void SSL_CTX_set_verify_depth(SSL_CTX *ctx, int depth) 4539 { 4540 X509_VERIFY_PARAM_set_depth(ctx->param, depth); 4541 } 4542 4543 void SSL_CTX_set_cert_cb(SSL_CTX *c, int (*cb)(SSL *ssl, void *arg), void *arg) 4544 { 4545 ssl_cert_set_cert_cb(c->cert, cb, arg); 4546 } 4547 4548 void SSL_set_cert_cb(SSL *s, int (*cb)(SSL *ssl, void *arg), void *arg) 4549 { 4550 SSL_CONNECTION *sc = SSL_CONNECTION_FROM_SSL(s); 4551 4552 if (sc == NULL) 4553 return; 4554 4555 ssl_cert_set_cert_cb(sc->cert, cb, arg); 4556 } 4557 4558 void ssl_set_masks(SSL_CONNECTION *s) 4559 { 4560 CERT *c = s->cert; 4561 uint32_t *pvalid = s->s3.tmp.valid_flags; 4562 int rsa_enc, rsa_sign, dh_tmp, dsa_sign; 4563 unsigned long mask_k, mask_a; 4564 int have_ecc_cert, ecdsa_ok; 4565 4566 if (c == NULL) 4567 return; 4568 4569 dh_tmp = (c->dh_tmp != NULL 4570 || c->dh_tmp_cb != NULL 4571 || c->dh_tmp_auto); 4572 4573 rsa_enc = pvalid[SSL_PKEY_RSA] & CERT_PKEY_VALID; 4574 rsa_sign = pvalid[SSL_PKEY_RSA] & CERT_PKEY_VALID; 4575 dsa_sign = pvalid[SSL_PKEY_DSA_SIGN] & CERT_PKEY_VALID; 4576 have_ecc_cert = pvalid[SSL_PKEY_ECC] & CERT_PKEY_VALID; 4577 mask_k = 0; 4578 mask_a = 0; 4579 4580 OSSL_TRACE4(TLS_CIPHER, "dh_tmp=%d rsa_enc=%d rsa_sign=%d dsa_sign=%d\n", 4581 dh_tmp, rsa_enc, rsa_sign, dsa_sign); 4582 4583 #ifndef OPENSSL_NO_GOST 4584 if (ssl_has_cert(s, SSL_PKEY_GOST12_512)) { 4585 mask_k |= SSL_kGOST | SSL_kGOST18; 4586 mask_a |= SSL_aGOST12; 4587 } 4588 if (ssl_has_cert(s, SSL_PKEY_GOST12_256)) { 4589 mask_k |= SSL_kGOST | SSL_kGOST18; 4590 mask_a |= SSL_aGOST12; 4591 } 4592 if (ssl_has_cert(s, SSL_PKEY_GOST01)) { 4593 mask_k |= SSL_kGOST; 4594 mask_a |= SSL_aGOST01; 4595 } 4596 #endif 4597 4598 if (rsa_enc) 4599 mask_k |= SSL_kRSA; 4600 4601 if (dh_tmp) 4602 mask_k |= SSL_kDHE; 4603 4604 /* 4605 * If we only have an RSA-PSS certificate allow RSA authentication 4606 * if TLS 1.2 and peer supports it. 4607 */ 4608 4609 if (rsa_enc || rsa_sign || (ssl_has_cert(s, SSL_PKEY_RSA_PSS_SIGN) && pvalid[SSL_PKEY_RSA_PSS_SIGN] & CERT_PKEY_EXPLICIT_SIGN && TLS1_get_version(&s->ssl) == TLS1_2_VERSION)) 4610 mask_a |= SSL_aRSA; 4611 4612 if (dsa_sign) { 4613 mask_a |= SSL_aDSS; 4614 } 4615 4616 mask_a |= SSL_aNULL; 4617 4618 /* 4619 * You can do anything with an RPK key, since there's no cert to restrict it 4620 * But we need to check for private keys 4621 */ 4622 if (pvalid[SSL_PKEY_RSA] & CERT_PKEY_RPK) { 4623 mask_a |= SSL_aRSA; 4624 mask_k |= SSL_kRSA; 4625 } 4626 if (pvalid[SSL_PKEY_ECC] & CERT_PKEY_RPK) 4627 mask_a |= SSL_aECDSA; 4628 if (TLS1_get_version(&s->ssl) == TLS1_2_VERSION) { 4629 if (pvalid[SSL_PKEY_RSA_PSS_SIGN] & CERT_PKEY_RPK) 4630 mask_a |= SSL_aRSA; 4631 if (pvalid[SSL_PKEY_ED25519] & CERT_PKEY_RPK 4632 || pvalid[SSL_PKEY_ED448] & CERT_PKEY_RPK) 4633 mask_a |= SSL_aECDSA; 4634 } 4635 4636 /* 4637 * An ECC certificate may be usable for ECDH and/or ECDSA cipher suites 4638 * depending on the key usage extension. 4639 */ 4640 if (have_ecc_cert) { 4641 uint32_t ex_kusage; 4642 ex_kusage = X509_get_key_usage(c->pkeys[SSL_PKEY_ECC].x509); 4643 ecdsa_ok = ex_kusage & X509v3_KU_DIGITAL_SIGNATURE; 4644 if (!(pvalid[SSL_PKEY_ECC] & CERT_PKEY_SIGN)) 4645 ecdsa_ok = 0; 4646 if (ecdsa_ok) 4647 mask_a |= SSL_aECDSA; 4648 } 4649 /* Allow Ed25519 for TLS 1.2 if peer supports it */ 4650 if (!(mask_a & SSL_aECDSA) && ssl_has_cert(s, SSL_PKEY_ED25519) 4651 && pvalid[SSL_PKEY_ED25519] & CERT_PKEY_EXPLICIT_SIGN 4652 && TLS1_get_version(&s->ssl) == TLS1_2_VERSION) 4653 mask_a |= SSL_aECDSA; 4654 4655 /* Allow Ed448 for TLS 1.2 if peer supports it */ 4656 if (!(mask_a & SSL_aECDSA) && ssl_has_cert(s, SSL_PKEY_ED448) 4657 && pvalid[SSL_PKEY_ED448] & CERT_PKEY_EXPLICIT_SIGN 4658 && TLS1_get_version(&s->ssl) == TLS1_2_VERSION) 4659 mask_a |= SSL_aECDSA; 4660 4661 mask_k |= SSL_kECDHE; 4662 4663 #ifndef OPENSSL_NO_PSK 4664 mask_k |= SSL_kPSK; 4665 mask_a |= SSL_aPSK; 4666 if (mask_k & SSL_kRSA) 4667 mask_k |= SSL_kRSAPSK; 4668 if (mask_k & SSL_kDHE) 4669 mask_k |= SSL_kDHEPSK; 4670 if (mask_k & SSL_kECDHE) 4671 mask_k |= SSL_kECDHEPSK; 4672 #endif 4673 4674 s->s3.tmp.mask_k = mask_k; 4675 s->s3.tmp.mask_a = mask_a; 4676 } 4677 4678 int ssl_check_srvr_ecc_cert_and_alg(X509 *x, SSL_CONNECTION *s) 4679 { 4680 if (s->s3.tmp.new_cipher->algorithm_auth & SSL_aECDSA) { 4681 /* key usage, if present, must allow signing */ 4682 if (!(X509_get_key_usage(x) & X509v3_KU_DIGITAL_SIGNATURE)) { 4683 ERR_raise(ERR_LIB_SSL, SSL_R_ECC_CERT_NOT_FOR_SIGNING); 4684 return 0; 4685 } 4686 } 4687 return 1; /* all checks are ok */ 4688 } 4689 4690 int ssl_get_server_cert_serverinfo(SSL_CONNECTION *s, 4691 const unsigned char **serverinfo, 4692 size_t *serverinfo_length) 4693 { 4694 CERT_PKEY *cpk = s->s3.tmp.cert; 4695 *serverinfo_length = 0; 4696 4697 if (cpk == NULL || cpk->serverinfo == NULL) 4698 return 0; 4699 4700 *serverinfo = cpk->serverinfo; 4701 *serverinfo_length = cpk->serverinfo_length; 4702 return 1; 4703 } 4704 4705 void ssl_update_cache(SSL_CONNECTION *s, int mode) 4706 { 4707 int i; 4708 4709 /* 4710 * If the session_id_length is 0, we are not supposed to cache it, and it 4711 * would be rather hard to do anyway :-). Also if the session has already 4712 * been marked as not_resumable we should not cache it for later reuse. 4713 */ 4714 if (s->session->session_id_length == 0 || s->session->not_resumable) 4715 return; 4716 4717 /* 4718 * If sid_ctx_length is 0 there is no specific application context 4719 * associated with this session, so when we try to resume it and 4720 * SSL_VERIFY_PEER is requested to verify the client identity, we have no 4721 * indication that this is actually a session for the proper application 4722 * context, and the *handshake* will fail, not just the resumption attempt. 4723 * Do not cache (on the server) these sessions that are not resumable 4724 * (clients can set SSL_VERIFY_PEER without needing a sid_ctx set). 4725 */ 4726 if (s->server && s->session->sid_ctx_length == 0 4727 && (s->verify_mode & SSL_VERIFY_PEER) != 0) 4728 return; 4729 4730 i = s->session_ctx->session_cache_mode; 4731 if ((i & mode) != 0 4732 && (!s->hit || SSL_CONNECTION_IS_TLS13(s))) { 4733 /* 4734 * Add the session to the internal cache. In server side TLSv1.3 we 4735 * normally don't do this because by default it's a full stateless ticket 4736 * with only a dummy session id so there is no reason to cache it, 4737 * unless: 4738 * - we are doing early_data, in which case we cache so that we can 4739 * detect replays 4740 * - the application has set a remove_session_cb so needs to know about 4741 * session timeout events 4742 * - SSL_OP_NO_TICKET is set in which case it is a stateful ticket 4743 */ 4744 if ((i & SSL_SESS_CACHE_NO_INTERNAL_STORE) == 0 4745 && (!SSL_CONNECTION_IS_TLS13(s) 4746 || !s->server 4747 || (s->max_early_data > 0 4748 && (s->options & SSL_OP_NO_ANTI_REPLAY) == 0) 4749 || s->session_ctx->remove_session_cb != NULL 4750 || (s->options & SSL_OP_NO_TICKET) != 0)) 4751 SSL_CTX_add_session(s->session_ctx, s->session); 4752 4753 /* 4754 * Add the session to the external cache. We do this even in server side 4755 * TLSv1.3 without early data because some applications just want to 4756 * know about the creation of a session and aren't doing a full cache. 4757 */ 4758 if (s->session_ctx->new_session_cb != NULL && SSL_SESSION_up_ref(s->session)) { 4759 if (!s->session_ctx->new_session_cb(SSL_CONNECTION_GET_USER_SSL(s), 4760 s->session)) 4761 SSL_SESSION_free(s->session); 4762 } 4763 } 4764 4765 /* auto flush every 255 connections */ 4766 if ((!(i & SSL_SESS_CACHE_NO_AUTO_CLEAR)) && ((i & mode) == mode)) { 4767 TSAN_QUALIFIER int *stat; 4768 4769 if (mode & SSL_SESS_CACHE_CLIENT) 4770 stat = &s->session_ctx->stats.sess_connect_good; 4771 else 4772 stat = &s->session_ctx->stats.sess_accept_good; 4773 if ((ssl_tsan_load(s->session_ctx, stat) & 0xff) == 0xff) 4774 SSL_CTX_flush_sessions_ex(s->session_ctx, time(NULL)); 4775 } 4776 } 4777 4778 const SSL_METHOD *SSL_CTX_get_ssl_method(const SSL_CTX *ctx) 4779 { 4780 return ctx->method; 4781 } 4782 4783 const SSL_METHOD *SSL_get_ssl_method(const SSL *s) 4784 { 4785 return s->method; 4786 } 4787 4788 int SSL_set_ssl_method(SSL *s, const SSL_METHOD *meth) 4789 { 4790 int ret = 1; 4791 SSL_CONNECTION *sc = SSL_CONNECTION_FROM_SSL(s); 4792 4793 /* Not allowed for QUIC */ 4794 if (sc == NULL 4795 || (s->type != SSL_TYPE_SSL_CONNECTION && s->method != meth) 4796 || (s->type == SSL_TYPE_SSL_CONNECTION && IS_QUIC_METHOD(meth))) 4797 return 0; 4798 4799 if (s->method != meth) { 4800 const SSL_METHOD *sm = s->method; 4801 int (*hf)(SSL *) = sc->handshake_func; 4802 4803 if (sm->version == meth->version) 4804 s->method = meth; 4805 else { 4806 sm->ssl_deinit(s); 4807 s->method = meth; 4808 ret = s->method->ssl_init(s); 4809 } 4810 4811 if (hf == sm->ssl_connect) 4812 sc->handshake_func = meth->ssl_connect; 4813 else if (hf == sm->ssl_accept) 4814 sc->handshake_func = meth->ssl_accept; 4815 } 4816 return ret; 4817 } 4818 4819 int SSL_get_error(const SSL *s, int i) 4820 { 4821 return ossl_ssl_get_error(s, i, /*check_err=*/1); 4822 } 4823 4824 int ossl_ssl_get_error(const SSL *s, int i, int check_err) 4825 { 4826 int reason; 4827 unsigned long l; 4828 BIO *bio; 4829 const SSL_CONNECTION *sc = SSL_CONNECTION_FROM_CONST_SSL(s); 4830 4831 if (i > 0) 4832 return SSL_ERROR_NONE; 4833 4834 #ifndef OPENSSL_NO_QUIC 4835 if (IS_QUIC(s)) { 4836 reason = ossl_quic_get_error(s, i); 4837 if (reason != SSL_ERROR_NONE) 4838 return reason; 4839 } 4840 #endif 4841 4842 if (sc == NULL) 4843 return SSL_ERROR_SSL; 4844 4845 /* 4846 * Make things return SSL_ERROR_SYSCALL when doing SSL_do_handshake etc, 4847 * where we do encode the error 4848 */ 4849 if (check_err && (l = ERR_peek_error()) != 0) { 4850 if (ERR_GET_LIB(l) == ERR_LIB_SYS) 4851 return SSL_ERROR_SYSCALL; 4852 else 4853 return SSL_ERROR_SSL; 4854 } 4855 4856 #ifndef OPENSSL_NO_QUIC 4857 if (!IS_QUIC(s)) 4858 #endif 4859 { 4860 if (SSL_want_read(s)) { 4861 bio = SSL_get_rbio(s); 4862 if (BIO_should_read(bio)) 4863 return SSL_ERROR_WANT_READ; 4864 else if (BIO_should_write(bio)) 4865 /* 4866 * This one doesn't make too much sense ... We never try to 4867 * write to the rbio, and an application program where rbio and 4868 * wbio are separate couldn't even know what it should wait for. 4869 * However if we ever set s->rwstate incorrectly (so that we 4870 * have SSL_want_read(s) instead of SSL_want_write(s)) and rbio 4871 * and wbio *are* the same, this test works around that bug; so 4872 * it might be safer to keep it. 4873 */ 4874 return SSL_ERROR_WANT_WRITE; 4875 else if (BIO_should_io_special(bio)) { 4876 reason = BIO_get_retry_reason(bio); 4877 if (reason == BIO_RR_CONNECT) 4878 return SSL_ERROR_WANT_CONNECT; 4879 else if (reason == BIO_RR_ACCEPT) 4880 return SSL_ERROR_WANT_ACCEPT; 4881 else 4882 return SSL_ERROR_SYSCALL; /* unknown */ 4883 } 4884 } 4885 4886 if (SSL_want_write(s)) { 4887 /* 4888 * Access wbio directly - in order to use the buffered bio if 4889 * present 4890 */ 4891 bio = sc->wbio; 4892 if (BIO_should_write(bio)) 4893 return SSL_ERROR_WANT_WRITE; 4894 else if (BIO_should_read(bio)) 4895 /* 4896 * See above (SSL_want_read(s) with BIO_should_write(bio)) 4897 */ 4898 return SSL_ERROR_WANT_READ; 4899 else if (BIO_should_io_special(bio)) { 4900 reason = BIO_get_retry_reason(bio); 4901 if (reason == BIO_RR_CONNECT) 4902 return SSL_ERROR_WANT_CONNECT; 4903 else if (reason == BIO_RR_ACCEPT) 4904 return SSL_ERROR_WANT_ACCEPT; 4905 else 4906 return SSL_ERROR_SYSCALL; 4907 } 4908 } 4909 } 4910 4911 if (SSL_want_x509_lookup(s)) 4912 return SSL_ERROR_WANT_X509_LOOKUP; 4913 if (SSL_want_retry_verify(s)) 4914 return SSL_ERROR_WANT_RETRY_VERIFY; 4915 if (SSL_want_async(s)) 4916 return SSL_ERROR_WANT_ASYNC; 4917 if (SSL_want_async_job(s)) 4918 return SSL_ERROR_WANT_ASYNC_JOB; 4919 if (SSL_want_client_hello_cb(s)) 4920 return SSL_ERROR_WANT_CLIENT_HELLO_CB; 4921 4922 if ((sc->shutdown & SSL_RECEIVED_SHUTDOWN) && (sc->s3.warn_alert == SSL_AD_CLOSE_NOTIFY)) 4923 return SSL_ERROR_ZERO_RETURN; 4924 4925 return SSL_ERROR_SYSCALL; 4926 } 4927 4928 static int ssl_do_handshake_intern(void *vargs) 4929 { 4930 struct ssl_async_args *args = (struct ssl_async_args *)vargs; 4931 SSL *s = args->s; 4932 SSL_CONNECTION *sc = SSL_CONNECTION_FROM_SSL(s); 4933 4934 if (sc == NULL) 4935 return -1; 4936 4937 return sc->handshake_func(s); 4938 } 4939 4940 int SSL_do_handshake(SSL *s) 4941 { 4942 int ret = 1; 4943 SSL_CONNECTION *sc = SSL_CONNECTION_FROM_SSL(s); 4944 4945 #ifndef OPENSSL_NO_QUIC 4946 if (IS_QUIC(s)) 4947 return ossl_quic_do_handshake(s); 4948 #endif 4949 4950 if (sc == NULL) 4951 return -1; 4952 4953 if (sc->handshake_func == NULL) { 4954 ERR_raise(ERR_LIB_SSL, SSL_R_CONNECTION_TYPE_NOT_SET); 4955 return -1; 4956 } 4957 4958 if (!ossl_statem_check_finish_init(sc, -1)) 4959 return -1; 4960 4961 s->method->ssl_renegotiate_check(s, 0); 4962 4963 if (SSL_in_init(s) || SSL_in_before(s)) { 4964 if ((sc->mode & SSL_MODE_ASYNC) && ASYNC_get_current_job() == NULL) { 4965 struct ssl_async_args args; 4966 4967 memset(&args, 0, sizeof(args)); 4968 args.s = s; 4969 4970 ret = ssl_start_async_job(s, &args, ssl_do_handshake_intern); 4971 } else { 4972 ret = sc->handshake_func(s); 4973 } 4974 } 4975 4976 return ret; 4977 } 4978 4979 void SSL_set_accept_state(SSL *s) 4980 { 4981 SSL_CONNECTION *sc = SSL_CONNECTION_FROM_SSL_ONLY(s); 4982 4983 #ifndef OPENSSL_NO_QUIC 4984 if (IS_QUIC(s)) { 4985 /* We suppress errors because this is a void function */ 4986 (void)ossl_quic_set_accept_state(s, 0 /* suppress errors */); 4987 return; 4988 } 4989 #endif 4990 4991 sc->server = 1; 4992 sc->shutdown = 0; 4993 ossl_statem_clear(sc); 4994 sc->handshake_func = s->method->ssl_accept; 4995 /* Ignore return value. Its a void public API function */ 4996 RECORD_LAYER_reset(&sc->rlayer); 4997 } 4998 4999 void SSL_set_connect_state(SSL *s) 5000 { 5001 SSL_CONNECTION *sc = SSL_CONNECTION_FROM_SSL_ONLY(s); 5002 5003 #ifndef OPENSSL_NO_QUIC 5004 if (IS_QUIC(s)) { 5005 /* We suppress errors because this is a void function */ 5006 (void)ossl_quic_set_connect_state(s, 0 /* suppress errors */); 5007 return; 5008 } 5009 #endif 5010 5011 sc->server = 0; 5012 sc->shutdown = 0; 5013 ossl_statem_clear(sc); 5014 sc->handshake_func = s->method->ssl_connect; 5015 /* Ignore return value. Its a void public API function */ 5016 RECORD_LAYER_reset(&sc->rlayer); 5017 } 5018 5019 int ssl_undefined_function(SSL *s) 5020 { 5021 ERR_raise(ERR_LIB_SSL, ERR_R_SHOULD_NOT_HAVE_BEEN_CALLED); 5022 return 0; 5023 } 5024 5025 int ssl_undefined_void_function(void) 5026 { 5027 ERR_raise(ERR_LIB_SSL, ERR_R_SHOULD_NOT_HAVE_BEEN_CALLED); 5028 return 0; 5029 } 5030 5031 const char *ssl_protocol_to_string(int version) 5032 { 5033 switch (version) { 5034 case TLS1_3_VERSION: 5035 return "TLSv1.3"; 5036 5037 case TLS1_2_VERSION: 5038 return "TLSv1.2"; 5039 5040 case TLS1_1_VERSION: 5041 return "TLSv1.1"; 5042 5043 case TLS1_VERSION: 5044 return "TLSv1"; 5045 5046 case SSL3_VERSION: 5047 return "SSLv3"; 5048 5049 case DTLS1_BAD_VER: 5050 return "DTLSv0.9"; 5051 5052 case DTLS1_VERSION: 5053 return "DTLSv1"; 5054 5055 case DTLS1_2_VERSION: 5056 return "DTLSv1.2"; 5057 5058 default: 5059 return "unknown"; 5060 } 5061 } 5062 5063 const char *SSL_get_version(const SSL *s) 5064 { 5065 const SSL_CONNECTION *sc = SSL_CONNECTION_FROM_CONST_SSL(s); 5066 5067 #ifndef OPENSSL_NO_QUIC 5068 /* We only support QUICv1 - so if its QUIC its QUICv1 */ 5069 if (s->type == SSL_TYPE_QUIC_CONNECTION || s->type == SSL_TYPE_QUIC_XSO) 5070 return "QUICv1"; 5071 #endif 5072 5073 if (sc == NULL) 5074 return NULL; 5075 5076 return ssl_protocol_to_string(sc->version); 5077 } 5078 5079 __owur int SSL_get_handshake_rtt(const SSL *s, uint64_t *rtt) 5080 { 5081 const SSL_CONNECTION *sc = SSL_CONNECTION_FROM_CONST_SSL(s); 5082 5083 if (sc == NULL) 5084 return -1; 5085 if (sc->ts_msg_write.t <= 0 || sc->ts_msg_read.t <= 0) 5086 return 0; /* data not (yet) available */ 5087 if (sc->ts_msg_read.t < sc->ts_msg_write.t) 5088 return -1; 5089 5090 *rtt = ossl_time2us(ossl_time_subtract(sc->ts_msg_read, sc->ts_msg_write)); 5091 return 1; 5092 } 5093 5094 static int dup_ca_names(STACK_OF(X509_NAME) **dst, STACK_OF(X509_NAME) *src) 5095 { 5096 STACK_OF(X509_NAME) *sk; 5097 X509_NAME *xn; 5098 int i; 5099 5100 if (src == NULL) { 5101 *dst = NULL; 5102 return 1; 5103 } 5104 5105 if ((sk = sk_X509_NAME_new_null()) == NULL) 5106 return 0; 5107 for (i = 0; i < sk_X509_NAME_num(src); i++) { 5108 xn = X509_NAME_dup(sk_X509_NAME_value(src, i)); 5109 if (xn == NULL) { 5110 sk_X509_NAME_pop_free(sk, X509_NAME_free); 5111 return 0; 5112 } 5113 if (sk_X509_NAME_insert(sk, xn, i) == 0) { 5114 X509_NAME_free(xn); 5115 sk_X509_NAME_pop_free(sk, X509_NAME_free); 5116 return 0; 5117 } 5118 } 5119 *dst = sk; 5120 5121 return 1; 5122 } 5123 5124 SSL *SSL_dup(SSL *s) 5125 { 5126 SSL *ret; 5127 int i; 5128 /* TODO(QUIC FUTURE): Add an SSL_METHOD function for duplication */ 5129 SSL_CONNECTION *retsc; 5130 SSL_CONNECTION *sc = SSL_CONNECTION_FROM_SSL_ONLY(s); 5131 5132 if (sc == NULL) 5133 return NULL; 5134 5135 /* If we're not quiescent, just up_ref! */ 5136 if (!SSL_in_init(s) || !SSL_in_before(s)) { 5137 CRYPTO_UP_REF(&s->references, &i); 5138 return s; 5139 } 5140 5141 /* 5142 * Otherwise, copy configuration state, and session if set. 5143 */ 5144 if ((ret = SSL_new(SSL_get_SSL_CTX(s))) == NULL) 5145 return NULL; 5146 if ((retsc = SSL_CONNECTION_FROM_SSL_ONLY(ret)) == NULL) 5147 goto err; 5148 5149 if (sc->session != NULL) { 5150 /* 5151 * Arranges to share the same session via up_ref. This "copies" 5152 * session-id, SSL_METHOD, sid_ctx, and 'cert' 5153 */ 5154 if (!SSL_copy_session_id(ret, s)) 5155 goto err; 5156 } else { 5157 /* 5158 * No session has been established yet, so we have to expect that 5159 * s->cert or ret->cert will be changed later -- they should not both 5160 * point to the same object, and thus we can't use 5161 * SSL_copy_session_id. 5162 */ 5163 if (!SSL_set_ssl_method(ret, s->method)) 5164 goto err; 5165 5166 if (sc->cert != NULL) { 5167 ssl_cert_free(retsc->cert); 5168 retsc->cert = ssl_cert_dup(sc->cert); 5169 if (retsc->cert == NULL) 5170 goto err; 5171 } 5172 5173 if (!SSL_set_session_id_context(ret, sc->sid_ctx, 5174 (int)sc->sid_ctx_length)) 5175 goto err; 5176 } 5177 5178 if (!ssl_dane_dup(retsc, sc)) 5179 goto err; 5180 retsc->version = sc->version; 5181 retsc->options = sc->options; 5182 retsc->min_proto_version = sc->min_proto_version; 5183 retsc->max_proto_version = sc->max_proto_version; 5184 retsc->mode = sc->mode; 5185 SSL_set_max_cert_list(ret, SSL_get_max_cert_list(s)); 5186 SSL_set_read_ahead(ret, SSL_get_read_ahead(s)); 5187 retsc->msg_callback = sc->msg_callback; 5188 retsc->msg_callback_arg = sc->msg_callback_arg; 5189 SSL_set_verify(ret, SSL_get_verify_mode(s), SSL_get_verify_callback(s)); 5190 SSL_set_verify_depth(ret, SSL_get_verify_depth(s)); 5191 retsc->generate_session_id = sc->generate_session_id; 5192 5193 SSL_set_info_callback(ret, SSL_get_info_callback(s)); 5194 5195 /* copy app data, a little dangerous perhaps */ 5196 if (!CRYPTO_dup_ex_data(CRYPTO_EX_INDEX_SSL, &ret->ex_data, &s->ex_data)) 5197 goto err; 5198 5199 retsc->server = sc->server; 5200 if (sc->handshake_func) { 5201 if (sc->server) 5202 SSL_set_accept_state(ret); 5203 else 5204 SSL_set_connect_state(ret); 5205 } 5206 retsc->shutdown = sc->shutdown; 5207 retsc->hit = sc->hit; 5208 5209 retsc->default_passwd_callback = sc->default_passwd_callback; 5210 retsc->default_passwd_callback_userdata = sc->default_passwd_callback_userdata; 5211 5212 X509_VERIFY_PARAM_inherit(retsc->param, sc->param); 5213 5214 /* dup the cipher_list and cipher_list_by_id stacks */ 5215 if (sc->cipher_list != NULL) { 5216 if ((retsc->cipher_list = sk_SSL_CIPHER_dup(sc->cipher_list)) == NULL) 5217 goto err; 5218 } 5219 if (sc->cipher_list_by_id != NULL) 5220 if ((retsc->cipher_list_by_id = sk_SSL_CIPHER_dup(sc->cipher_list_by_id)) 5221 == NULL) 5222 goto err; 5223 5224 /* Dup the client_CA list */ 5225 if (!dup_ca_names(&retsc->ca_names, sc->ca_names) 5226 || !dup_ca_names(&retsc->client_ca_names, sc->client_ca_names)) 5227 goto err; 5228 5229 if (sc->server_cert_type != NULL) { 5230 OPENSSL_free(retsc->server_cert_type); 5231 retsc->server_cert_type = OPENSSL_memdup(sc->server_cert_type, 5232 sc->server_cert_type_len); 5233 if (retsc->server_cert_type == NULL) 5234 goto err; 5235 retsc->server_cert_type_len = sc->server_cert_type_len; 5236 } 5237 5238 if (sc->client_cert_type != NULL) { 5239 OPENSSL_free(retsc->client_cert_type); 5240 retsc->client_cert_type = OPENSSL_memdup(sc->client_cert_type, 5241 sc->client_cert_type_len); 5242 if (retsc->client_cert_type == NULL) 5243 goto err; 5244 retsc->client_cert_type_len = sc->client_cert_type_len; 5245 } 5246 5247 #ifndef OPENSSL_NO_CT 5248 retsc->ct_validation_callback = sc->ct_validation_callback; 5249 retsc->ct_validation_callback_arg = sc->ct_validation_callback_arg; 5250 #endif 5251 5252 retsc->ext.status_type = sc->ext.status_type; 5253 5254 return ret; 5255 5256 err: 5257 SSL_free(ret); 5258 return NULL; 5259 } 5260 5261 X509 *SSL_get_certificate(const SSL *s) 5262 { 5263 SSL_CONNECTION *sc = SSL_CONNECTION_FROM_SSL(s); 5264 5265 if (sc == NULL) 5266 return NULL; 5267 5268 if (sc->cert != NULL) 5269 return sc->cert->key->x509; 5270 else 5271 return NULL; 5272 } 5273 5274 EVP_PKEY *SSL_get_privatekey(const SSL *s) 5275 { 5276 const SSL_CONNECTION *sc = SSL_CONNECTION_FROM_CONST_SSL(s); 5277 5278 if (sc == NULL) 5279 return NULL; 5280 5281 if (sc->cert != NULL) 5282 return sc->cert->key->privatekey; 5283 else 5284 return NULL; 5285 } 5286 5287 X509 *SSL_CTX_get0_certificate(const SSL_CTX *ctx) 5288 { 5289 if (ctx->cert != NULL) 5290 return ctx->cert->key->x509; 5291 else 5292 return NULL; 5293 } 5294 5295 EVP_PKEY *SSL_CTX_get0_privatekey(const SSL_CTX *ctx) 5296 { 5297 if (ctx->cert != NULL) 5298 return ctx->cert->key->privatekey; 5299 else 5300 return NULL; 5301 } 5302 5303 const SSL_CIPHER *SSL_get_current_cipher(const SSL *s) 5304 { 5305 const SSL_CONNECTION *sc = SSL_CONNECTION_FROM_CONST_SSL(s); 5306 5307 if (sc == NULL) 5308 return NULL; 5309 5310 if ((sc->session != NULL) && (sc->session->cipher != NULL)) 5311 return sc->session->cipher; 5312 return NULL; 5313 } 5314 5315 const SSL_CIPHER *SSL_get_pending_cipher(const SSL *s) 5316 { 5317 const SSL_CONNECTION *sc = SSL_CONNECTION_FROM_CONST_SSL(s); 5318 5319 if (sc == NULL) 5320 return NULL; 5321 5322 return sc->s3.tmp.new_cipher; 5323 } 5324 5325 const COMP_METHOD *SSL_get_current_compression(const SSL *s) 5326 { 5327 #ifndef OPENSSL_NO_COMP 5328 const SSL_CONNECTION *sc = SSL_CONNECTION_FROM_CONST_SSL_ONLY(s); 5329 5330 if (sc == NULL) 5331 return NULL; 5332 5333 return sc->rlayer.wrlmethod->get_compression(sc->rlayer.wrl); 5334 #else 5335 return NULL; 5336 #endif 5337 } 5338 5339 const COMP_METHOD *SSL_get_current_expansion(const SSL *s) 5340 { 5341 #ifndef OPENSSL_NO_COMP 5342 const SSL_CONNECTION *sc = SSL_CONNECTION_FROM_CONST_SSL_ONLY(s); 5343 5344 if (sc == NULL) 5345 return NULL; 5346 5347 return sc->rlayer.rrlmethod->get_compression(sc->rlayer.rrl); 5348 #else 5349 return NULL; 5350 #endif 5351 } 5352 5353 int ssl_init_wbio_buffer(SSL_CONNECTION *s) 5354 { 5355 BIO *bbio; 5356 5357 if (s->bbio != NULL) { 5358 /* Already buffered. */ 5359 return 1; 5360 } 5361 5362 bbio = BIO_new(BIO_f_buffer()); 5363 if (bbio == NULL || BIO_set_read_buffer_size(bbio, 1) <= 0) { 5364 BIO_free(bbio); 5365 ERR_raise(ERR_LIB_SSL, ERR_R_BUF_LIB); 5366 return 0; 5367 } 5368 s->bbio = bbio; 5369 s->wbio = BIO_push(bbio, s->wbio); 5370 5371 s->rlayer.wrlmethod->set1_bio(s->rlayer.wrl, s->wbio); 5372 5373 return 1; 5374 } 5375 5376 int ssl_free_wbio_buffer(SSL_CONNECTION *s) 5377 { 5378 /* callers ensure s is never null */ 5379 if (s->bbio == NULL) 5380 return 1; 5381 5382 s->wbio = BIO_pop(s->wbio); 5383 s->rlayer.wrlmethod->set1_bio(s->rlayer.wrl, s->wbio); 5384 5385 BIO_free(s->bbio); 5386 s->bbio = NULL; 5387 5388 return 1; 5389 } 5390 5391 void SSL_CTX_set_quiet_shutdown(SSL_CTX *ctx, int mode) 5392 { 5393 ctx->quiet_shutdown = mode; 5394 } 5395 5396 int SSL_CTX_get_quiet_shutdown(const SSL_CTX *ctx) 5397 { 5398 return ctx->quiet_shutdown; 5399 } 5400 5401 void SSL_set_quiet_shutdown(SSL *s, int mode) 5402 { 5403 SSL_CONNECTION *sc = SSL_CONNECTION_FROM_SSL_ONLY(s); 5404 5405 /* Not supported with QUIC */ 5406 if (sc == NULL) 5407 return; 5408 5409 sc->quiet_shutdown = mode; 5410 } 5411 5412 int SSL_get_quiet_shutdown(const SSL *s) 5413 { 5414 const SSL_CONNECTION *sc = SSL_CONNECTION_FROM_CONST_SSL_ONLY(s); 5415 5416 /* Not supported with QUIC */ 5417 if (sc == NULL) 5418 return 0; 5419 5420 return sc->quiet_shutdown; 5421 } 5422 5423 void SSL_set_shutdown(SSL *s, int mode) 5424 { 5425 SSL_CONNECTION *sc = SSL_CONNECTION_FROM_SSL_ONLY(s); 5426 5427 /* Not supported with QUIC */ 5428 if (sc == NULL) 5429 return; 5430 5431 sc->shutdown = mode; 5432 } 5433 5434 int SSL_get_shutdown(const SSL *s) 5435 { 5436 const SSL_CONNECTION *sc = SSL_CONNECTION_FROM_CONST_SSL_ONLY(s); 5437 5438 #ifndef OPENSSL_NO_QUIC 5439 /* QUIC: Just indicate whether the connection was shutdown cleanly. */ 5440 if (IS_QUIC(s)) 5441 return ossl_quic_get_shutdown(s); 5442 #endif 5443 5444 if (sc == NULL) 5445 return 0; 5446 5447 return sc->shutdown; 5448 } 5449 5450 int SSL_version(const SSL *s) 5451 { 5452 const SSL_CONNECTION *sc = SSL_CONNECTION_FROM_CONST_SSL(s); 5453 5454 #ifndef OPENSSL_NO_QUIC 5455 /* We only support QUICv1 - so if its QUIC its QUICv1 */ 5456 if (s->type == SSL_TYPE_QUIC_CONNECTION || s->type == SSL_TYPE_QUIC_XSO) 5457 return OSSL_QUIC1_VERSION; 5458 #endif 5459 if (sc == NULL) 5460 return 0; 5461 5462 return sc->version; 5463 } 5464 5465 int SSL_client_version(const SSL *s) 5466 { 5467 const SSL_CONNECTION *sc = SSL_CONNECTION_FROM_CONST_SSL(s); 5468 5469 #ifndef OPENSSL_NO_QUIC 5470 /* We only support QUICv1 - so if its QUIC its QUICv1 */ 5471 if (s->type == SSL_TYPE_QUIC_CONNECTION || s->type == SSL_TYPE_QUIC_XSO) 5472 return OSSL_QUIC1_VERSION; 5473 #endif 5474 if (sc == NULL) 5475 return 0; 5476 5477 return sc->client_version; 5478 } 5479 5480 SSL_CTX *SSL_get_SSL_CTX(const SSL *ssl) 5481 { 5482 return ssl->ctx; 5483 } 5484 5485 SSL_CTX *SSL_set_SSL_CTX(SSL *ssl, SSL_CTX *ctx) 5486 { 5487 CERT *new_cert; 5488 SSL_CONNECTION *sc = SSL_CONNECTION_FROM_SSL_ONLY(ssl); 5489 5490 /* TODO(QUIC FUTURE): Add support for QUIC */ 5491 if (sc == NULL) 5492 return NULL; 5493 5494 if (ssl->ctx == ctx) 5495 return ssl->ctx; 5496 if (ctx == NULL) 5497 ctx = sc->session_ctx; 5498 new_cert = ssl_cert_dup(ctx->cert); 5499 if (new_cert == NULL) 5500 goto err; 5501 if (!custom_exts_copy_conn(&new_cert->custext, &sc->cert->custext)) 5502 goto err; 5503 if (!custom_exts_copy_flags(&new_cert->custext, &sc->cert->custext)) 5504 goto err; 5505 5506 /* 5507 * Program invariant: |sid_ctx| has fixed size (SSL_MAX_SID_CTX_LENGTH), 5508 * so setter APIs must prevent invalid lengths from entering the system. 5509 */ 5510 if (!ossl_assert(sc->sid_ctx_length <= sizeof(sc->sid_ctx))) 5511 goto err; 5512 if (!SSL_CTX_up_ref(ctx)) 5513 goto err; 5514 5515 /* 5516 * If the session ID context matches that of the parent SSL_CTX, 5517 * inherit it from the new SSL_CTX as well. If however the context does 5518 * not match (i.e., it was set per-ssl with SSL_set_session_id_context), 5519 * leave it unchanged. 5520 */ 5521 if ((ssl->ctx != NULL) && (sc->sid_ctx_length == ssl->ctx->sid_ctx_length) && (memcmp(sc->sid_ctx, ssl->ctx->sid_ctx, sc->sid_ctx_length) == 0)) { 5522 sc->sid_ctx_length = ctx->sid_ctx_length; 5523 memcpy(&sc->sid_ctx, &ctx->sid_ctx, sizeof(sc->sid_ctx)); 5524 } 5525 5526 ssl_cert_free(sc->cert); 5527 sc->cert = new_cert; 5528 SSL_CTX_free(ssl->ctx); /* decrement reference count */ 5529 ssl->ctx = ctx; 5530 5531 return ssl->ctx; 5532 5533 err: 5534 ssl_cert_free(new_cert); 5535 return NULL; 5536 } 5537 5538 int SSL_CTX_set_default_verify_paths(SSL_CTX *ctx) 5539 { 5540 return X509_STORE_set_default_paths_ex(ctx->cert_store, ctx->libctx, 5541 ctx->propq); 5542 } 5543 5544 int SSL_CTX_set_default_verify_dir(SSL_CTX *ctx) 5545 { 5546 X509_LOOKUP *lookup; 5547 5548 lookup = X509_STORE_add_lookup(ctx->cert_store, X509_LOOKUP_hash_dir()); 5549 if (lookup == NULL) 5550 return 0; 5551 5552 /* We ignore errors, in case the directory doesn't exist */ 5553 ERR_set_mark(); 5554 5555 X509_LOOKUP_add_dir(lookup, NULL, X509_FILETYPE_DEFAULT); 5556 5557 ERR_pop_to_mark(); 5558 5559 return 1; 5560 } 5561 5562 int SSL_CTX_set_default_verify_file(SSL_CTX *ctx) 5563 { 5564 X509_LOOKUP *lookup; 5565 5566 lookup = X509_STORE_add_lookup(ctx->cert_store, X509_LOOKUP_file()); 5567 if (lookup == NULL) 5568 return 0; 5569 5570 /* We ignore errors, in case the file doesn't exist */ 5571 ERR_set_mark(); 5572 5573 X509_LOOKUP_load_file_ex(lookup, NULL, X509_FILETYPE_DEFAULT, ctx->libctx, 5574 ctx->propq); 5575 5576 ERR_pop_to_mark(); 5577 5578 return 1; 5579 } 5580 5581 int SSL_CTX_set_default_verify_store(SSL_CTX *ctx) 5582 { 5583 X509_LOOKUP *lookup; 5584 5585 lookup = X509_STORE_add_lookup(ctx->cert_store, X509_LOOKUP_store()); 5586 if (lookup == NULL) 5587 return 0; 5588 5589 /* We ignore errors, in case the directory doesn't exist */ 5590 ERR_set_mark(); 5591 5592 X509_LOOKUP_add_store_ex(lookup, NULL, ctx->libctx, ctx->propq); 5593 5594 ERR_pop_to_mark(); 5595 5596 return 1; 5597 } 5598 5599 int SSL_CTX_load_verify_file(SSL_CTX *ctx, const char *CAfile) 5600 { 5601 return X509_STORE_load_file_ex(ctx->cert_store, CAfile, ctx->libctx, 5602 ctx->propq); 5603 } 5604 5605 int SSL_CTX_load_verify_dir(SSL_CTX *ctx, const char *CApath) 5606 { 5607 return X509_STORE_load_path(ctx->cert_store, CApath); 5608 } 5609 5610 int SSL_CTX_load_verify_store(SSL_CTX *ctx, const char *CAstore) 5611 { 5612 return X509_STORE_load_store_ex(ctx->cert_store, CAstore, ctx->libctx, 5613 ctx->propq); 5614 } 5615 5616 int SSL_CTX_load_verify_locations(SSL_CTX *ctx, const char *CAfile, 5617 const char *CApath) 5618 { 5619 if (CAfile == NULL && CApath == NULL) 5620 return 0; 5621 if (CAfile != NULL && !SSL_CTX_load_verify_file(ctx, CAfile)) 5622 return 0; 5623 if (CApath != NULL && !SSL_CTX_load_verify_dir(ctx, CApath)) 5624 return 0; 5625 return 1; 5626 } 5627 5628 void SSL_set_info_callback(SSL *ssl, 5629 void (*cb)(const SSL *ssl, int type, int val)) 5630 { 5631 SSL_CONNECTION *sc = SSL_CONNECTION_FROM_SSL(ssl); 5632 5633 if (sc == NULL) 5634 return; 5635 5636 sc->info_callback = cb; 5637 } 5638 5639 /* 5640 * One compiler (Diab DCC) doesn't like argument names in returned function 5641 * pointer. 5642 */ 5643 void (*SSL_get_info_callback(const SSL *ssl))(const SSL * /* ssl */, 5644 int /* type */, 5645 int /* val */) 5646 { 5647 const SSL_CONNECTION *sc = SSL_CONNECTION_FROM_CONST_SSL(ssl); 5648 5649 if (sc == NULL) 5650 return NULL; 5651 5652 return sc->info_callback; 5653 } 5654 5655 void SSL_set_verify_result(SSL *ssl, long arg) 5656 { 5657 SSL_CONNECTION *sc = SSL_CONNECTION_FROM_SSL(ssl); 5658 5659 if (sc == NULL) 5660 return; 5661 5662 sc->verify_result = arg; 5663 } 5664 5665 long SSL_get_verify_result(const SSL *ssl) 5666 { 5667 const SSL_CONNECTION *sc = SSL_CONNECTION_FROM_CONST_SSL(ssl); 5668 5669 if (sc == NULL) 5670 return 0; 5671 5672 return sc->verify_result; 5673 } 5674 5675 size_t SSL_get_client_random(const SSL *ssl, unsigned char *out, size_t outlen) 5676 { 5677 const SSL_CONNECTION *sc = SSL_CONNECTION_FROM_CONST_SSL(ssl); 5678 5679 if (sc == NULL) 5680 return 0; 5681 5682 if (outlen == 0) 5683 return sizeof(sc->s3.client_random); 5684 if (outlen > sizeof(sc->s3.client_random)) 5685 outlen = sizeof(sc->s3.client_random); 5686 memcpy(out, sc->s3.client_random, outlen); 5687 return outlen; 5688 } 5689 5690 size_t SSL_get_server_random(const SSL *ssl, unsigned char *out, size_t outlen) 5691 { 5692 const SSL_CONNECTION *sc = SSL_CONNECTION_FROM_CONST_SSL(ssl); 5693 5694 if (sc == NULL) 5695 return 0; 5696 5697 if (outlen == 0) 5698 return sizeof(sc->s3.server_random); 5699 if (outlen > sizeof(sc->s3.server_random)) 5700 outlen = sizeof(sc->s3.server_random); 5701 memcpy(out, sc->s3.server_random, outlen); 5702 return outlen; 5703 } 5704 5705 size_t SSL_SESSION_get_master_key(const SSL_SESSION *session, 5706 unsigned char *out, size_t outlen) 5707 { 5708 if (outlen == 0) 5709 return session->master_key_length; 5710 if (outlen > session->master_key_length) 5711 outlen = session->master_key_length; 5712 memcpy(out, session->master_key, outlen); 5713 return outlen; 5714 } 5715 5716 int SSL_SESSION_set1_master_key(SSL_SESSION *sess, const unsigned char *in, 5717 size_t len) 5718 { 5719 if (len > sizeof(sess->master_key)) 5720 return 0; 5721 5722 memcpy(sess->master_key, in, len); 5723 sess->master_key_length = len; 5724 return 1; 5725 } 5726 5727 int SSL_set_ex_data(SSL *s, int idx, void *arg) 5728 { 5729 return CRYPTO_set_ex_data(&s->ex_data, idx, arg); 5730 } 5731 5732 void *SSL_get_ex_data(const SSL *s, int idx) 5733 { 5734 return CRYPTO_get_ex_data(&s->ex_data, idx); 5735 } 5736 5737 int SSL_CTX_set_ex_data(SSL_CTX *s, int idx, void *arg) 5738 { 5739 return CRYPTO_set_ex_data(&s->ex_data, idx, arg); 5740 } 5741 5742 void *SSL_CTX_get_ex_data(const SSL_CTX *s, int idx) 5743 { 5744 return CRYPTO_get_ex_data(&s->ex_data, idx); 5745 } 5746 5747 X509_STORE *SSL_CTX_get_cert_store(const SSL_CTX *ctx) 5748 { 5749 return ctx->cert_store; 5750 } 5751 5752 void SSL_CTX_set_cert_store(SSL_CTX *ctx, X509_STORE *store) 5753 { 5754 X509_STORE_free(ctx->cert_store); 5755 ctx->cert_store = store; 5756 } 5757 5758 void SSL_CTX_set1_cert_store(SSL_CTX *ctx, X509_STORE *store) 5759 { 5760 if (store != NULL && !X509_STORE_up_ref(store)) 5761 return; 5762 5763 SSL_CTX_set_cert_store(ctx, store); 5764 } 5765 5766 int SSL_want(const SSL *s) 5767 { 5768 const SSL_CONNECTION *sc = SSL_CONNECTION_FROM_CONST_SSL(s); 5769 5770 #ifndef OPENSSL_NO_QUIC 5771 if (IS_QUIC(s)) 5772 return ossl_quic_want(s); 5773 #endif 5774 5775 if (sc == NULL) 5776 return SSL_NOTHING; 5777 5778 return sc->rwstate; 5779 } 5780 5781 #ifndef OPENSSL_NO_PSK 5782 int SSL_CTX_use_psk_identity_hint(SSL_CTX *ctx, const char *identity_hint) 5783 { 5784 if (identity_hint != NULL && strlen(identity_hint) > PSK_MAX_IDENTITY_LEN) { 5785 ERR_raise(ERR_LIB_SSL, SSL_R_DATA_LENGTH_TOO_LONG); 5786 return 0; 5787 } 5788 OPENSSL_free(ctx->cert->psk_identity_hint); 5789 if (identity_hint != NULL) { 5790 ctx->cert->psk_identity_hint = OPENSSL_strdup(identity_hint); 5791 if (ctx->cert->psk_identity_hint == NULL) 5792 return 0; 5793 } else 5794 ctx->cert->psk_identity_hint = NULL; 5795 return 1; 5796 } 5797 5798 int SSL_use_psk_identity_hint(SSL *s, const char *identity_hint) 5799 { 5800 SSL_CONNECTION *sc = SSL_CONNECTION_FROM_SSL(s); 5801 5802 if (sc == NULL) 5803 return 0; 5804 5805 if (identity_hint != NULL && strlen(identity_hint) > PSK_MAX_IDENTITY_LEN) { 5806 ERR_raise(ERR_LIB_SSL, SSL_R_DATA_LENGTH_TOO_LONG); 5807 return 0; 5808 } 5809 OPENSSL_free(sc->cert->psk_identity_hint); 5810 if (identity_hint != NULL) { 5811 sc->cert->psk_identity_hint = OPENSSL_strdup(identity_hint); 5812 if (sc->cert->psk_identity_hint == NULL) 5813 return 0; 5814 } else 5815 sc->cert->psk_identity_hint = NULL; 5816 return 1; 5817 } 5818 5819 const char *SSL_get_psk_identity_hint(const SSL *s) 5820 { 5821 const SSL_CONNECTION *sc = SSL_CONNECTION_FROM_CONST_SSL(s); 5822 5823 if (sc == NULL || sc->session == NULL) 5824 return NULL; 5825 5826 return sc->session->psk_identity_hint; 5827 } 5828 5829 const char *SSL_get_psk_identity(const SSL *s) 5830 { 5831 const SSL_CONNECTION *sc = SSL_CONNECTION_FROM_CONST_SSL(s); 5832 5833 if (sc == NULL || sc->session == NULL) 5834 return NULL; 5835 5836 return sc->session->psk_identity; 5837 } 5838 5839 void SSL_set_psk_client_callback(SSL *s, SSL_psk_client_cb_func cb) 5840 { 5841 SSL_CONNECTION *sc = SSL_CONNECTION_FROM_SSL(s); 5842 5843 if (sc == NULL) 5844 return; 5845 5846 sc->psk_client_callback = cb; 5847 } 5848 5849 void SSL_CTX_set_psk_client_callback(SSL_CTX *ctx, SSL_psk_client_cb_func cb) 5850 { 5851 ctx->psk_client_callback = cb; 5852 } 5853 5854 void SSL_set_psk_server_callback(SSL *s, SSL_psk_server_cb_func cb) 5855 { 5856 SSL_CONNECTION *sc = SSL_CONNECTION_FROM_SSL(s); 5857 5858 if (sc == NULL) 5859 return; 5860 5861 sc->psk_server_callback = cb; 5862 } 5863 5864 void SSL_CTX_set_psk_server_callback(SSL_CTX *ctx, SSL_psk_server_cb_func cb) 5865 { 5866 ctx->psk_server_callback = cb; 5867 } 5868 #endif 5869 5870 void SSL_set_psk_find_session_callback(SSL *s, SSL_psk_find_session_cb_func cb) 5871 { 5872 SSL_CONNECTION *sc = SSL_CONNECTION_FROM_SSL(s); 5873 5874 if (sc == NULL) 5875 return; 5876 5877 sc->psk_find_session_cb = cb; 5878 } 5879 5880 void SSL_CTX_set_psk_find_session_callback(SSL_CTX *ctx, 5881 SSL_psk_find_session_cb_func cb) 5882 { 5883 ctx->psk_find_session_cb = cb; 5884 } 5885 5886 void SSL_set_psk_use_session_callback(SSL *s, SSL_psk_use_session_cb_func cb) 5887 { 5888 SSL_CONNECTION *sc = SSL_CONNECTION_FROM_SSL(s); 5889 5890 if (sc == NULL) 5891 return; 5892 5893 sc->psk_use_session_cb = cb; 5894 } 5895 5896 void SSL_CTX_set_psk_use_session_callback(SSL_CTX *ctx, 5897 SSL_psk_use_session_cb_func cb) 5898 { 5899 ctx->psk_use_session_cb = cb; 5900 } 5901 5902 void SSL_CTX_set_msg_callback(SSL_CTX *ctx, 5903 void (*cb)(int write_p, int version, 5904 int content_type, const void *buf, 5905 size_t len, SSL *ssl, void *arg)) 5906 { 5907 SSL_CTX_callback_ctrl(ctx, SSL_CTRL_SET_MSG_CALLBACK, (void (*)(void))cb); 5908 } 5909 5910 void SSL_set_msg_callback(SSL *ssl, 5911 void (*cb)(int write_p, int version, 5912 int content_type, const void *buf, 5913 size_t len, SSL *ssl, void *arg)) 5914 { 5915 SSL_callback_ctrl(ssl, SSL_CTRL_SET_MSG_CALLBACK, (void (*)(void))cb); 5916 } 5917 5918 void SSL_CTX_set_not_resumable_session_callback(SSL_CTX *ctx, 5919 int (*cb)(SSL *ssl, 5920 int 5921 is_forward_secure)) 5922 { 5923 SSL_CTX_callback_ctrl(ctx, SSL_CTRL_SET_NOT_RESUMABLE_SESS_CB, 5924 (void (*)(void))cb); 5925 } 5926 5927 void SSL_set_not_resumable_session_callback(SSL *ssl, 5928 int (*cb)(SSL *ssl, 5929 int is_forward_secure)) 5930 { 5931 SSL_callback_ctrl(ssl, SSL_CTRL_SET_NOT_RESUMABLE_SESS_CB, 5932 (void (*)(void))cb); 5933 } 5934 5935 void SSL_CTX_set_record_padding_callback(SSL_CTX *ctx, 5936 size_t (*cb)(SSL *ssl, int type, 5937 size_t len, void *arg)) 5938 { 5939 ctx->record_padding_cb = cb; 5940 } 5941 5942 void SSL_CTX_set_record_padding_callback_arg(SSL_CTX *ctx, void *arg) 5943 { 5944 ctx->record_padding_arg = arg; 5945 } 5946 5947 void *SSL_CTX_get_record_padding_callback_arg(const SSL_CTX *ctx) 5948 { 5949 return ctx->record_padding_arg; 5950 } 5951 5952 int SSL_CTX_set_block_padding_ex(SSL_CTX *ctx, size_t app_block_size, 5953 size_t hs_block_size) 5954 { 5955 if (IS_QUIC_CTX(ctx) && (app_block_size > 1 || hs_block_size > 1)) 5956 return 0; 5957 5958 /* block size of 0 or 1 is basically no padding */ 5959 if (app_block_size == 1) { 5960 ctx->block_padding = 0; 5961 } else if (app_block_size <= SSL3_RT_MAX_PLAIN_LENGTH) { 5962 ctx->block_padding = app_block_size; 5963 } else { 5964 return 0; 5965 } 5966 if (hs_block_size == 1) { 5967 ctx->hs_padding = 0; 5968 } else if (hs_block_size <= SSL3_RT_MAX_PLAIN_LENGTH) { 5969 ctx->hs_padding = hs_block_size; 5970 } else { 5971 return 0; 5972 } 5973 return 1; 5974 } 5975 5976 int SSL_CTX_set_block_padding(SSL_CTX *ctx, size_t block_size) 5977 { 5978 return SSL_CTX_set_block_padding_ex(ctx, block_size, block_size); 5979 } 5980 5981 int SSL_set_record_padding_callback(SSL *ssl, 5982 size_t (*cb)(SSL *ssl, int type, 5983 size_t len, void *arg)) 5984 { 5985 BIO *b; 5986 SSL_CONNECTION *sc = SSL_CONNECTION_FROM_SSL_ONLY(ssl); 5987 5988 if (sc == NULL) 5989 return 0; 5990 5991 b = SSL_get_wbio(ssl); 5992 if (b == NULL || !BIO_get_ktls_send(b)) { 5993 sc->rlayer.record_padding_cb = cb; 5994 return 1; 5995 } 5996 return 0; 5997 } 5998 5999 void SSL_set_record_padding_callback_arg(SSL *ssl, void *arg) 6000 { 6001 SSL_CONNECTION *sc = SSL_CONNECTION_FROM_SSL(ssl); 6002 6003 if (sc == NULL) 6004 return; 6005 6006 sc->rlayer.record_padding_arg = arg; 6007 } 6008 6009 void *SSL_get_record_padding_callback_arg(const SSL *ssl) 6010 { 6011 const SSL_CONNECTION *sc = SSL_CONNECTION_FROM_CONST_SSL(ssl); 6012 6013 if (sc == NULL) 6014 return NULL; 6015 6016 return sc->rlayer.record_padding_arg; 6017 } 6018 6019 int SSL_set_block_padding_ex(SSL *ssl, size_t app_block_size, 6020 size_t hs_block_size) 6021 { 6022 SSL_CONNECTION *sc = SSL_CONNECTION_FROM_SSL(ssl); 6023 6024 if (sc == NULL 6025 || (IS_QUIC(ssl) 6026 && (app_block_size > 1 || hs_block_size > 1))) 6027 return 0; 6028 6029 /* block size of 0 or 1 is basically no padding */ 6030 if (app_block_size == 1) { 6031 sc->rlayer.block_padding = 0; 6032 } else if (app_block_size <= SSL3_RT_MAX_PLAIN_LENGTH) { 6033 sc->rlayer.block_padding = app_block_size; 6034 } else { 6035 return 0; 6036 } 6037 if (hs_block_size == 1) { 6038 sc->rlayer.hs_padding = 0; 6039 } else if (hs_block_size <= SSL3_RT_MAX_PLAIN_LENGTH) { 6040 sc->rlayer.hs_padding = hs_block_size; 6041 } else { 6042 return 0; 6043 } 6044 return 1; 6045 } 6046 6047 int SSL_set_block_padding(SSL *ssl, size_t block_size) 6048 { 6049 return SSL_set_block_padding_ex(ssl, block_size, block_size); 6050 } 6051 6052 int SSL_set_num_tickets(SSL *s, size_t num_tickets) 6053 { 6054 SSL_CONNECTION *sc = SSL_CONNECTION_FROM_SSL(s); 6055 6056 if (sc == NULL) 6057 return 0; 6058 6059 sc->num_tickets = num_tickets; 6060 6061 return 1; 6062 } 6063 6064 size_t SSL_get_num_tickets(const SSL *s) 6065 { 6066 const SSL_CONNECTION *sc = SSL_CONNECTION_FROM_CONST_SSL(s); 6067 6068 if (sc == NULL) 6069 return 0; 6070 6071 return sc->num_tickets; 6072 } 6073 6074 int SSL_CTX_set_num_tickets(SSL_CTX *ctx, size_t num_tickets) 6075 { 6076 ctx->num_tickets = num_tickets; 6077 6078 return 1; 6079 } 6080 6081 size_t SSL_CTX_get_num_tickets(const SSL_CTX *ctx) 6082 { 6083 return ctx->num_tickets; 6084 } 6085 6086 /* Retrieve handshake hashes */ 6087 int ssl_handshake_hash(SSL_CONNECTION *s, 6088 unsigned char *out, size_t outlen, 6089 size_t *hashlen) 6090 { 6091 EVP_MD_CTX *ctx = NULL; 6092 EVP_MD_CTX *hdgst = s->s3.handshake_dgst; 6093 int hashleni = EVP_MD_CTX_get_size(hdgst); 6094 int ret = 0; 6095 6096 if (hashleni < 0 || (size_t)hashleni > outlen) { 6097 SSLfatal(s, SSL_AD_INTERNAL_ERROR, ERR_R_INTERNAL_ERROR); 6098 goto err; 6099 } 6100 6101 ctx = EVP_MD_CTX_new(); 6102 if (ctx == NULL) { 6103 SSLfatal(s, SSL_AD_INTERNAL_ERROR, ERR_R_INTERNAL_ERROR); 6104 goto err; 6105 } 6106 6107 if (!EVP_MD_CTX_copy_ex(ctx, hdgst) 6108 || EVP_DigestFinal_ex(ctx, out, NULL) <= 0) { 6109 SSLfatal(s, SSL_AD_INTERNAL_ERROR, ERR_R_INTERNAL_ERROR); 6110 goto err; 6111 } 6112 6113 *hashlen = hashleni; 6114 6115 ret = 1; 6116 err: 6117 EVP_MD_CTX_free(ctx); 6118 return ret; 6119 } 6120 6121 int SSL_session_reused(const SSL *s) 6122 { 6123 const SSL_CONNECTION *sc = SSL_CONNECTION_FROM_CONST_SSL(s); 6124 6125 if (sc == NULL) 6126 return 0; 6127 6128 return sc->hit; 6129 } 6130 6131 int SSL_is_server(const SSL *s) 6132 { 6133 const SSL_CONNECTION *sc = SSL_CONNECTION_FROM_CONST_SSL(s); 6134 6135 if (sc == NULL) 6136 return 0; 6137 6138 return sc->server; 6139 } 6140 6141 #ifndef OPENSSL_NO_DEPRECATED_1_1_0 6142 void SSL_set_debug(SSL *s, int debug) 6143 { 6144 /* Old function was do-nothing anyway... */ 6145 (void)s; 6146 (void)debug; 6147 } 6148 #endif 6149 6150 void SSL_set_security_level(SSL *s, int level) 6151 { 6152 SSL_CONNECTION *sc = SSL_CONNECTION_FROM_SSL(s); 6153 6154 if (sc == NULL) 6155 return; 6156 6157 sc->cert->sec_level = level; 6158 } 6159 6160 int SSL_get_security_level(const SSL *s) 6161 { 6162 const SSL_CONNECTION *sc = SSL_CONNECTION_FROM_CONST_SSL(s); 6163 6164 if (sc == NULL) 6165 return 0; 6166 6167 return sc->cert->sec_level; 6168 } 6169 6170 void SSL_set_security_callback(SSL *s, 6171 int (*cb)(const SSL *s, const SSL_CTX *ctx, 6172 int op, int bits, int nid, 6173 void *other, void *ex)) 6174 { 6175 SSL_CONNECTION *sc = SSL_CONNECTION_FROM_SSL(s); 6176 6177 if (sc == NULL) 6178 return; 6179 6180 sc->cert->sec_cb = cb; 6181 } 6182 6183 int (*SSL_get_security_callback(const SSL *s))(const SSL *s, 6184 const SSL_CTX *ctx, int op, 6185 int bits, int nid, void *other, 6186 void *ex) 6187 { 6188 const SSL_CONNECTION *sc = SSL_CONNECTION_FROM_CONST_SSL(s); 6189 6190 if (sc == NULL) 6191 return NULL; 6192 6193 return sc->cert->sec_cb; 6194 } 6195 6196 void SSL_set0_security_ex_data(SSL *s, void *ex) 6197 { 6198 SSL_CONNECTION *sc = SSL_CONNECTION_FROM_SSL(s); 6199 6200 if (sc == NULL) 6201 return; 6202 6203 sc->cert->sec_ex = ex; 6204 } 6205 6206 void *SSL_get0_security_ex_data(const SSL *s) 6207 { 6208 const SSL_CONNECTION *sc = SSL_CONNECTION_FROM_CONST_SSL(s); 6209 6210 if (sc == NULL) 6211 return NULL; 6212 6213 return sc->cert->sec_ex; 6214 } 6215 6216 void SSL_CTX_set_security_level(SSL_CTX *ctx, int level) 6217 { 6218 ctx->cert->sec_level = level; 6219 } 6220 6221 int SSL_CTX_get_security_level(const SSL_CTX *ctx) 6222 { 6223 return ctx->cert->sec_level; 6224 } 6225 6226 void SSL_CTX_set_security_callback(SSL_CTX *ctx, 6227 int (*cb)(const SSL *s, const SSL_CTX *ctx, 6228 int op, int bits, int nid, 6229 void *other, void *ex)) 6230 { 6231 ctx->cert->sec_cb = cb; 6232 } 6233 6234 int (*SSL_CTX_get_security_callback(const SSL_CTX *ctx))(const SSL *s, 6235 const SSL_CTX *ctx, 6236 int op, int bits, 6237 int nid, 6238 void *other, 6239 void *ex) 6240 { 6241 return ctx->cert->sec_cb; 6242 } 6243 6244 void SSL_CTX_set0_security_ex_data(SSL_CTX *ctx, void *ex) 6245 { 6246 ctx->cert->sec_ex = ex; 6247 } 6248 6249 void *SSL_CTX_get0_security_ex_data(const SSL_CTX *ctx) 6250 { 6251 return ctx->cert->sec_ex; 6252 } 6253 6254 uint64_t SSL_CTX_get_options(const SSL_CTX *ctx) 6255 { 6256 return ctx->options; 6257 } 6258 6259 uint64_t SSL_get_options(const SSL *s) 6260 { 6261 const SSL_CONNECTION *sc = SSL_CONNECTION_FROM_CONST_SSL(s); 6262 6263 #ifndef OPENSSL_NO_QUIC 6264 if (IS_QUIC(s)) 6265 return ossl_quic_get_options(s); 6266 #endif 6267 6268 if (sc == NULL) 6269 return 0; 6270 6271 return sc->options; 6272 } 6273 6274 uint64_t SSL_CTX_set_options(SSL_CTX *ctx, uint64_t op) 6275 { 6276 return ctx->options |= op; 6277 } 6278 6279 uint64_t SSL_set_options(SSL *s, uint64_t op) 6280 { 6281 SSL_CONNECTION *sc; 6282 OSSL_PARAM options[2], *opts = options; 6283 6284 #ifndef OPENSSL_NO_QUIC 6285 if (IS_QUIC(s)) 6286 return ossl_quic_set_options(s, op); 6287 #endif 6288 6289 sc = SSL_CONNECTION_FROM_SSL(s); 6290 if (sc == NULL) 6291 return 0; 6292 6293 sc->options |= op; 6294 6295 *opts++ = OSSL_PARAM_construct_uint64(OSSL_LIBSSL_RECORD_LAYER_PARAM_OPTIONS, 6296 &sc->options); 6297 *opts = OSSL_PARAM_construct_end(); 6298 6299 /* Ignore return value */ 6300 sc->rlayer.rrlmethod->set_options(sc->rlayer.rrl, options); 6301 sc->rlayer.wrlmethod->set_options(sc->rlayer.wrl, options); 6302 6303 return sc->options; 6304 } 6305 6306 uint64_t SSL_CTX_clear_options(SSL_CTX *ctx, uint64_t op) 6307 { 6308 return ctx->options &= ~op; 6309 } 6310 6311 uint64_t SSL_clear_options(SSL *s, uint64_t op) 6312 { 6313 SSL_CONNECTION *sc = SSL_CONNECTION_FROM_SSL(s); 6314 OSSL_PARAM options[2], *opts = options; 6315 6316 #ifndef OPENSSL_NO_QUIC 6317 if (IS_QUIC(s)) 6318 return ossl_quic_clear_options(s, op); 6319 #endif 6320 6321 if (sc == NULL) 6322 return 0; 6323 6324 sc->options &= ~op; 6325 6326 *opts++ = OSSL_PARAM_construct_uint64(OSSL_LIBSSL_RECORD_LAYER_PARAM_OPTIONS, 6327 &sc->options); 6328 *opts = OSSL_PARAM_construct_end(); 6329 6330 /* Ignore return value */ 6331 sc->rlayer.rrlmethod->set_options(sc->rlayer.rrl, options); 6332 sc->rlayer.wrlmethod->set_options(sc->rlayer.wrl, options); 6333 6334 return sc->options; 6335 } 6336 6337 STACK_OF(X509) *SSL_get0_verified_chain(const SSL *s) 6338 { 6339 const SSL_CONNECTION *sc = SSL_CONNECTION_FROM_CONST_SSL(s); 6340 6341 if (sc == NULL) 6342 return NULL; 6343 6344 return sc->verified_chain; 6345 } 6346 6347 IMPLEMENT_OBJ_BSEARCH_GLOBAL_CMP_FN(SSL_CIPHER, SSL_CIPHER, ssl_cipher_id); 6348 6349 #ifndef OPENSSL_NO_CT 6350 6351 /* 6352 * Moves SCTs from the |src| stack to the |dst| stack. 6353 * The source of each SCT will be set to |origin|. 6354 * If |dst| points to a NULL pointer, a new stack will be created and owned by 6355 * the caller. 6356 * Returns the number of SCTs moved, or a negative integer if an error occurs. 6357 * The |dst| stack is created and possibly partially populated even in case 6358 * of error, likewise the |src| stack may be left in an intermediate state. 6359 */ 6360 static int ct_move_scts(STACK_OF(SCT) **dst, STACK_OF(SCT) *src, 6361 sct_source_t origin) 6362 { 6363 int scts_moved = 0; 6364 SCT *sct = NULL; 6365 6366 if (*dst == NULL) { 6367 *dst = sk_SCT_new_null(); 6368 if (*dst == NULL) { 6369 ERR_raise(ERR_LIB_SSL, ERR_R_CRYPTO_LIB); 6370 goto err; 6371 } 6372 } 6373 6374 while ((sct = sk_SCT_pop(src)) != NULL) { 6375 if (SCT_set_source(sct, origin) != 1) 6376 goto err; 6377 6378 if (!sk_SCT_push(*dst, sct)) 6379 goto err; 6380 scts_moved += 1; 6381 } 6382 6383 return scts_moved; 6384 err: 6385 SCT_free(sct); 6386 return -1; 6387 } 6388 6389 /* 6390 * Look for data collected during ServerHello and parse if found. 6391 * Returns the number of SCTs extracted. 6392 */ 6393 static int ct_extract_tls_extension_scts(SSL_CONNECTION *s) 6394 { 6395 int scts_extracted = 0; 6396 6397 if (s->ext.scts != NULL) { 6398 const unsigned char *p = s->ext.scts; 6399 STACK_OF(SCT) *scts = o2i_SCT_LIST(NULL, &p, s->ext.scts_len); 6400 6401 scts_extracted = ct_move_scts(&s->scts, scts, SCT_SOURCE_TLS_EXTENSION); 6402 6403 SCT_LIST_free(scts); 6404 } 6405 6406 return scts_extracted; 6407 } 6408 6409 /* 6410 * Checks for an OCSP response and then attempts to extract any SCTs found if it 6411 * contains an SCT X509 extension. They will be stored in |s->scts|. 6412 * Returns: 6413 * - The number of SCTs extracted, assuming an OCSP response exists. 6414 * - 0 if no OCSP response exists or it contains no SCTs. 6415 * - A negative integer if an error occurs. 6416 */ 6417 static int ct_extract_ocsp_response_scts(SSL_CONNECTION *s) 6418 { 6419 #ifndef OPENSSL_NO_OCSP 6420 int scts_extracted = 0; 6421 const unsigned char *p; 6422 OCSP_BASICRESP *br = NULL; 6423 OCSP_RESPONSE *rsp = NULL; 6424 STACK_OF(SCT) *scts = NULL; 6425 int i; 6426 6427 if (s->ext.ocsp.resp == NULL || s->ext.ocsp.resp_len == 0) 6428 goto err; 6429 6430 p = s->ext.ocsp.resp; 6431 rsp = d2i_OCSP_RESPONSE(NULL, &p, (int)s->ext.ocsp.resp_len); 6432 if (rsp == NULL) 6433 goto err; 6434 6435 br = OCSP_response_get1_basic(rsp); 6436 if (br == NULL) 6437 goto err; 6438 6439 for (i = 0; i < OCSP_resp_count(br); ++i) { 6440 OCSP_SINGLERESP *single = OCSP_resp_get0(br, i); 6441 6442 if (single == NULL) 6443 continue; 6444 6445 scts = OCSP_SINGLERESP_get1_ext_d2i(single, NID_ct_cert_scts, NULL, NULL); 6446 scts_extracted = ct_move_scts(&s->scts, scts, SCT_SOURCE_OCSP_STAPLED_RESPONSE); 6447 if (scts_extracted < 0) 6448 goto err; 6449 } 6450 err: 6451 SCT_LIST_free(scts); 6452 OCSP_BASICRESP_free(br); 6453 OCSP_RESPONSE_free(rsp); 6454 return scts_extracted; 6455 #else 6456 /* Behave as if no OCSP response exists */ 6457 return 0; 6458 #endif 6459 } 6460 6461 /* 6462 * Attempts to extract SCTs from the peer certificate. 6463 * Return the number of SCTs extracted, or a negative integer if an error 6464 * occurs. 6465 */ 6466 static int ct_extract_x509v3_extension_scts(SSL_CONNECTION *s) 6467 { 6468 int scts_extracted = 0; 6469 X509 *cert = s->session != NULL ? s->session->peer : NULL; 6470 6471 if (cert != NULL) { 6472 STACK_OF(SCT) *scts = X509_get_ext_d2i(cert, NID_ct_precert_scts, NULL, NULL); 6473 6474 scts_extracted = ct_move_scts(&s->scts, scts, SCT_SOURCE_X509V3_EXTENSION); 6475 6476 SCT_LIST_free(scts); 6477 } 6478 6479 return scts_extracted; 6480 } 6481 6482 /* 6483 * Attempts to find all received SCTs by checking TLS extensions, the OCSP 6484 * response (if it exists) and X509v3 extensions in the certificate. 6485 * Returns NULL if an error occurs. 6486 */ 6487 const STACK_OF(SCT) *SSL_get0_peer_scts(SSL *s) 6488 { 6489 SSL_CONNECTION *sc = SSL_CONNECTION_FROM_SSL(s); 6490 6491 if (sc == NULL) 6492 return NULL; 6493 6494 if (!sc->scts_parsed) { 6495 if (ct_extract_tls_extension_scts(sc) < 0 || ct_extract_ocsp_response_scts(sc) < 0 || ct_extract_x509v3_extension_scts(sc) < 0) 6496 goto err; 6497 6498 sc->scts_parsed = 1; 6499 } 6500 return sc->scts; 6501 err: 6502 return NULL; 6503 } 6504 6505 static int ct_permissive(const CT_POLICY_EVAL_CTX *ctx, 6506 const STACK_OF(SCT) *scts, void *unused_arg) 6507 { 6508 return 1; 6509 } 6510 6511 static int ct_strict(const CT_POLICY_EVAL_CTX *ctx, 6512 const STACK_OF(SCT) *scts, void *unused_arg) 6513 { 6514 int count = scts != NULL ? sk_SCT_num(scts) : 0; 6515 int i; 6516 6517 for (i = 0; i < count; ++i) { 6518 SCT *sct = sk_SCT_value(scts, i); 6519 int status = SCT_get_validation_status(sct); 6520 6521 if (status == SCT_VALIDATION_STATUS_VALID) 6522 return 1; 6523 } 6524 ERR_raise(ERR_LIB_SSL, SSL_R_NO_VALID_SCTS); 6525 return 0; 6526 } 6527 6528 int SSL_set_ct_validation_callback(SSL *s, ssl_ct_validation_cb callback, 6529 void *arg) 6530 { 6531 SSL_CONNECTION *sc = SSL_CONNECTION_FROM_SSL(s); 6532 6533 if (sc == NULL) 6534 return 0; 6535 6536 /* 6537 * Since code exists that uses the custom extension handler for CT, look 6538 * for this and throw an error if they have already registered to use CT. 6539 */ 6540 if (callback != NULL && SSL_CTX_has_client_custom_ext(s->ctx, TLSEXT_TYPE_signed_certificate_timestamp)) { 6541 ERR_raise(ERR_LIB_SSL, SSL_R_CUSTOM_EXT_HANDLER_ALREADY_INSTALLED); 6542 return 0; 6543 } 6544 6545 if (callback != NULL) { 6546 /* 6547 * If we are validating CT, then we MUST accept SCTs served via OCSP 6548 */ 6549 if (!SSL_set_tlsext_status_type(s, TLSEXT_STATUSTYPE_ocsp)) 6550 return 0; 6551 } 6552 6553 sc->ct_validation_callback = callback; 6554 sc->ct_validation_callback_arg = arg; 6555 6556 return 1; 6557 } 6558 6559 int SSL_CTX_set_ct_validation_callback(SSL_CTX *ctx, 6560 ssl_ct_validation_cb callback, void *arg) 6561 { 6562 /* 6563 * Since code exists that uses the custom extension handler for CT, look for 6564 * this and throw an error if they have already registered to use CT. 6565 */ 6566 if (callback != NULL && SSL_CTX_has_client_custom_ext(ctx, TLSEXT_TYPE_signed_certificate_timestamp)) { 6567 ERR_raise(ERR_LIB_SSL, SSL_R_CUSTOM_EXT_HANDLER_ALREADY_INSTALLED); 6568 return 0; 6569 } 6570 6571 ctx->ct_validation_callback = callback; 6572 ctx->ct_validation_callback_arg = arg; 6573 return 1; 6574 } 6575 6576 int SSL_ct_is_enabled(const SSL *s) 6577 { 6578 const SSL_CONNECTION *sc = SSL_CONNECTION_FROM_CONST_SSL(s); 6579 6580 if (sc == NULL) 6581 return 0; 6582 6583 return sc->ct_validation_callback != NULL; 6584 } 6585 6586 int SSL_CTX_ct_is_enabled(const SSL_CTX *ctx) 6587 { 6588 return ctx->ct_validation_callback != NULL; 6589 } 6590 6591 int ssl_validate_ct(SSL_CONNECTION *s) 6592 { 6593 int ret = 0; 6594 X509 *cert = s->session != NULL ? s->session->peer : NULL; 6595 X509 *issuer; 6596 SSL_DANE *dane = &s->dane; 6597 CT_POLICY_EVAL_CTX *ctx = NULL; 6598 const STACK_OF(SCT) *scts; 6599 6600 /* 6601 * If no callback is set, the peer is anonymous, or its chain is invalid, 6602 * skip SCT validation - just return success. Applications that continue 6603 * handshakes without certificates, with unverified chains, or pinned leaf 6604 * certificates are outside the scope of the WebPKI and CT. 6605 * 6606 * The above exclusions notwithstanding the vast majority of peers will 6607 * have rather ordinary certificate chains validated by typical 6608 * applications that perform certificate verification and therefore will 6609 * process SCTs when enabled. 6610 */ 6611 if (s->ct_validation_callback == NULL || cert == NULL || s->verify_result != X509_V_OK || s->verified_chain == NULL || sk_X509_num(s->verified_chain) <= 1) 6612 return 1; 6613 6614 /* 6615 * CT not applicable for chains validated via DANE-TA(2) or DANE-EE(3) 6616 * trust-anchors. See https://tools.ietf.org/html/rfc7671#section-4.2 6617 */ 6618 if (DANETLS_ENABLED(dane) && dane->mtlsa != NULL) { 6619 switch (dane->mtlsa->usage) { 6620 case DANETLS_USAGE_DANE_TA: 6621 case DANETLS_USAGE_DANE_EE: 6622 return 1; 6623 } 6624 } 6625 6626 ctx = CT_POLICY_EVAL_CTX_new_ex(SSL_CONNECTION_GET_CTX(s)->libctx, 6627 SSL_CONNECTION_GET_CTX(s)->propq); 6628 if (ctx == NULL) { 6629 SSLfatal(s, SSL_AD_INTERNAL_ERROR, ERR_R_CT_LIB); 6630 goto end; 6631 } 6632 6633 issuer = sk_X509_value(s->verified_chain, 1); 6634 CT_POLICY_EVAL_CTX_set1_cert(ctx, cert); 6635 CT_POLICY_EVAL_CTX_set1_issuer(ctx, issuer); 6636 CT_POLICY_EVAL_CTX_set_shared_CTLOG_STORE(ctx, 6637 SSL_CONNECTION_GET_CTX(s)->ctlog_store); 6638 CT_POLICY_EVAL_CTX_set_time( 6639 ctx, (uint64_t)SSL_SESSION_get_time_ex(s->session) * 1000); 6640 6641 scts = SSL_get0_peer_scts(SSL_CONNECTION_GET_SSL(s)); 6642 6643 /* 6644 * This function returns success (> 0) only when all the SCTs are valid, 0 6645 * when some are invalid, and < 0 on various internal errors (out of 6646 * memory, etc.). Having some, or even all, invalid SCTs is not sufficient 6647 * reason to abort the handshake, that decision is up to the callback. 6648 * Therefore, we error out only in the unexpected case that the return 6649 * value is negative. 6650 * 6651 * XXX: One might well argue that the return value of this function is an 6652 * unfortunate design choice. Its job is only to determine the validation 6653 * status of each of the provided SCTs. So long as it correctly separates 6654 * the wheat from the chaff it should return success. Failure in this case 6655 * ought to correspond to an inability to carry out its duties. 6656 */ 6657 if (SCT_LIST_validate(scts, ctx) < 0) { 6658 SSLfatal(s, SSL_AD_HANDSHAKE_FAILURE, SSL_R_SCT_VERIFICATION_FAILED); 6659 goto end; 6660 } 6661 6662 ret = s->ct_validation_callback(ctx, scts, s->ct_validation_callback_arg); 6663 if (ret < 0) 6664 ret = 0; /* This function returns 0 on failure */ 6665 if (!ret) 6666 SSLfatal(s, SSL_AD_HANDSHAKE_FAILURE, SSL_R_CALLBACK_FAILED); 6667 6668 end: 6669 CT_POLICY_EVAL_CTX_free(ctx); 6670 /* 6671 * With SSL_VERIFY_NONE the session may be cached and reused despite a 6672 * failure return code here. Also the application may wish the complete 6673 * the handshake, and then disconnect cleanly at a higher layer, after 6674 * checking the verification status of the completed connection. 6675 * 6676 * We therefore force a certificate verification failure which will be 6677 * visible via SSL_get_verify_result() and cached as part of any resumed 6678 * session. 6679 * 6680 * Note: the permissive callback is for information gathering only, always 6681 * returns success, and does not affect verification status. Only the 6682 * strict callback or a custom application-specified callback can trigger 6683 * connection failure or record a verification error. 6684 */ 6685 if (ret <= 0) 6686 s->verify_result = X509_V_ERR_NO_VALID_SCTS; 6687 return ret; 6688 } 6689 6690 int SSL_CTX_enable_ct(SSL_CTX *ctx, int validation_mode) 6691 { 6692 switch (validation_mode) { 6693 default: 6694 ERR_raise(ERR_LIB_SSL, SSL_R_INVALID_CT_VALIDATION_TYPE); 6695 return 0; 6696 case SSL_CT_VALIDATION_PERMISSIVE: 6697 return SSL_CTX_set_ct_validation_callback(ctx, ct_permissive, NULL); 6698 case SSL_CT_VALIDATION_STRICT: 6699 return SSL_CTX_set_ct_validation_callback(ctx, ct_strict, NULL); 6700 } 6701 } 6702 6703 int SSL_enable_ct(SSL *s, int validation_mode) 6704 { 6705 switch (validation_mode) { 6706 default: 6707 ERR_raise(ERR_LIB_SSL, SSL_R_INVALID_CT_VALIDATION_TYPE); 6708 return 0; 6709 case SSL_CT_VALIDATION_PERMISSIVE: 6710 return SSL_set_ct_validation_callback(s, ct_permissive, NULL); 6711 case SSL_CT_VALIDATION_STRICT: 6712 return SSL_set_ct_validation_callback(s, ct_strict, NULL); 6713 } 6714 } 6715 6716 int SSL_CTX_set_default_ctlog_list_file(SSL_CTX *ctx) 6717 { 6718 return CTLOG_STORE_load_default_file(ctx->ctlog_store); 6719 } 6720 6721 int SSL_CTX_set_ctlog_list_file(SSL_CTX *ctx, const char *path) 6722 { 6723 return CTLOG_STORE_load_file(ctx->ctlog_store, path); 6724 } 6725 6726 void SSL_CTX_set0_ctlog_store(SSL_CTX *ctx, CTLOG_STORE *logs) 6727 { 6728 CTLOG_STORE_free(ctx->ctlog_store); 6729 ctx->ctlog_store = logs; 6730 } 6731 6732 const CTLOG_STORE *SSL_CTX_get0_ctlog_store(const SSL_CTX *ctx) 6733 { 6734 return ctx->ctlog_store; 6735 } 6736 6737 #endif /* OPENSSL_NO_CT */ 6738 6739 void SSL_CTX_set_client_hello_cb(SSL_CTX *c, SSL_client_hello_cb_fn cb, 6740 void *arg) 6741 { 6742 c->client_hello_cb = cb; 6743 c->client_hello_cb_arg = arg; 6744 } 6745 6746 void SSL_CTX_set_new_pending_conn_cb(SSL_CTX *c, SSL_new_pending_conn_cb_fn cb, 6747 void *arg) 6748 { 6749 c->new_pending_conn_cb = cb; 6750 c->new_pending_conn_arg = arg; 6751 } 6752 6753 int SSL_client_hello_isv2(SSL *s) 6754 { 6755 const SSL_CONNECTION *sc = SSL_CONNECTION_FROM_SSL(s); 6756 6757 if (sc == NULL) 6758 return 0; 6759 6760 if (sc->clienthello == NULL) 6761 return 0; 6762 return sc->clienthello->isv2; 6763 } 6764 6765 unsigned int SSL_client_hello_get0_legacy_version(SSL *s) 6766 { 6767 const SSL_CONNECTION *sc = SSL_CONNECTION_FROM_SSL(s); 6768 6769 if (sc == NULL) 6770 return 0; 6771 6772 if (sc->clienthello == NULL) 6773 return 0; 6774 return sc->clienthello->legacy_version; 6775 } 6776 6777 size_t SSL_client_hello_get0_random(SSL *s, const unsigned char **out) 6778 { 6779 const SSL_CONNECTION *sc = SSL_CONNECTION_FROM_SSL(s); 6780 6781 if (sc == NULL) 6782 return 0; 6783 6784 if (sc->clienthello == NULL) 6785 return 0; 6786 if (out != NULL) 6787 *out = sc->clienthello->random; 6788 return SSL3_RANDOM_SIZE; 6789 } 6790 6791 size_t SSL_client_hello_get0_session_id(SSL *s, const unsigned char **out) 6792 { 6793 const SSL_CONNECTION *sc = SSL_CONNECTION_FROM_SSL(s); 6794 6795 if (sc == NULL) 6796 return 0; 6797 6798 if (sc->clienthello == NULL) 6799 return 0; 6800 if (out != NULL) 6801 *out = sc->clienthello->session_id; 6802 return sc->clienthello->session_id_len; 6803 } 6804 6805 size_t SSL_client_hello_get0_ciphers(SSL *s, const unsigned char **out) 6806 { 6807 const SSL_CONNECTION *sc = SSL_CONNECTION_FROM_SSL(s); 6808 6809 if (sc == NULL) 6810 return 0; 6811 6812 if (sc->clienthello == NULL) 6813 return 0; 6814 if (out != NULL) 6815 *out = PACKET_data(&sc->clienthello->ciphersuites); 6816 return PACKET_remaining(&sc->clienthello->ciphersuites); 6817 } 6818 6819 size_t SSL_client_hello_get0_compression_methods(SSL *s, const unsigned char **out) 6820 { 6821 const SSL_CONNECTION *sc = SSL_CONNECTION_FROM_SSL(s); 6822 6823 if (sc == NULL) 6824 return 0; 6825 6826 if (sc->clienthello == NULL) 6827 return 0; 6828 if (out != NULL) 6829 *out = sc->clienthello->compressions; 6830 return sc->clienthello->compressions_len; 6831 } 6832 6833 int SSL_client_hello_get1_extensions_present(SSL *s, int **out, size_t *outlen) 6834 { 6835 RAW_EXTENSION *ext; 6836 int *present; 6837 size_t num = 0, i; 6838 const SSL_CONNECTION *sc = SSL_CONNECTION_FROM_SSL(s); 6839 6840 if (sc == NULL) 6841 return 0; 6842 6843 if (sc->clienthello == NULL || out == NULL || outlen == NULL) 6844 return 0; 6845 for (i = 0; i < sc->clienthello->pre_proc_exts_len; i++) { 6846 ext = sc->clienthello->pre_proc_exts + i; 6847 if (ext->present) 6848 num++; 6849 } 6850 if (num == 0) { 6851 *out = NULL; 6852 *outlen = 0; 6853 return 1; 6854 } 6855 if ((present = OPENSSL_malloc(sizeof(*present) * num)) == NULL) 6856 return 0; 6857 for (i = 0; i < sc->clienthello->pre_proc_exts_len; i++) { 6858 ext = sc->clienthello->pre_proc_exts + i; 6859 if (ext->present) { 6860 if (ext->received_order >= num) 6861 goto err; 6862 present[ext->received_order] = ext->type; 6863 } 6864 } 6865 *out = present; 6866 *outlen = num; 6867 return 1; 6868 err: 6869 OPENSSL_free(present); 6870 return 0; 6871 } 6872 6873 int SSL_client_hello_get_extension_order(SSL *s, uint16_t *exts, size_t *num_exts) 6874 { 6875 RAW_EXTENSION *ext; 6876 size_t num = 0, i; 6877 const SSL_CONNECTION *sc = SSL_CONNECTION_FROM_SSL(s); 6878 6879 if (sc == NULL) 6880 return 0; 6881 6882 if (sc->clienthello == NULL || num_exts == NULL) 6883 return 0; 6884 for (i = 0; i < sc->clienthello->pre_proc_exts_len; i++) { 6885 ext = sc->clienthello->pre_proc_exts + i; 6886 if (ext->present) 6887 num++; 6888 } 6889 if (num == 0) { 6890 *num_exts = 0; 6891 return 1; 6892 } 6893 if (exts == NULL) { 6894 *num_exts = num; 6895 return 1; 6896 } 6897 if (*num_exts < num) 6898 return 0; 6899 for (i = 0; i < sc->clienthello->pre_proc_exts_len; i++) { 6900 ext = sc->clienthello->pre_proc_exts + i; 6901 if (ext->present) { 6902 if (ext->received_order >= num) 6903 return 0; 6904 exts[ext->received_order] = ext->type; 6905 } 6906 } 6907 *num_exts = num; 6908 return 1; 6909 } 6910 6911 int SSL_client_hello_get0_ext(SSL *s, unsigned int type, const unsigned char **out, 6912 size_t *outlen) 6913 { 6914 size_t i; 6915 RAW_EXTENSION *r; 6916 const SSL_CONNECTION *sc = SSL_CONNECTION_FROM_SSL(s); 6917 6918 if (sc == NULL) 6919 return 0; 6920 6921 if (sc->clienthello == NULL) 6922 return 0; 6923 for (i = 0; i < sc->clienthello->pre_proc_exts_len; ++i) { 6924 r = sc->clienthello->pre_proc_exts + i; 6925 if (r->present && r->type == type) { 6926 if (out != NULL) 6927 *out = PACKET_data(&r->data); 6928 if (outlen != NULL) 6929 *outlen = PACKET_remaining(&r->data); 6930 return 1; 6931 } 6932 } 6933 return 0; 6934 } 6935 6936 int SSL_free_buffers(SSL *ssl) 6937 { 6938 RECORD_LAYER *rl; 6939 SSL_CONNECTION *sc = SSL_CONNECTION_FROM_SSL_ONLY(ssl); 6940 6941 if (sc == NULL) 6942 return 0; 6943 6944 rl = &sc->rlayer; 6945 6946 return rl->rrlmethod->free_buffers(rl->rrl) 6947 && rl->wrlmethod->free_buffers(rl->wrl); 6948 } 6949 6950 int SSL_alloc_buffers(SSL *ssl) 6951 { 6952 RECORD_LAYER *rl; 6953 SSL_CONNECTION *sc = SSL_CONNECTION_FROM_SSL(ssl); 6954 6955 if (sc == NULL) 6956 return 0; 6957 6958 /* QUIC always has buffers allocated. */ 6959 if (IS_QUIC(ssl)) 6960 return 1; 6961 6962 rl = &sc->rlayer; 6963 6964 return rl->rrlmethod->alloc_buffers(rl->rrl) 6965 && rl->wrlmethod->alloc_buffers(rl->wrl); 6966 } 6967 6968 void SSL_CTX_set_keylog_callback(SSL_CTX *ctx, SSL_CTX_keylog_cb_func cb) 6969 { 6970 ctx->keylog_callback = cb; 6971 } 6972 6973 SSL_CTX_keylog_cb_func SSL_CTX_get_keylog_callback(const SSL_CTX *ctx) 6974 { 6975 return ctx->keylog_callback; 6976 } 6977 6978 static int nss_keylog_int(const char *prefix, 6979 SSL_CONNECTION *sc, 6980 const uint8_t *parameter_1, 6981 size_t parameter_1_len, 6982 const uint8_t *parameter_2, 6983 size_t parameter_2_len) 6984 { 6985 char *out = NULL; 6986 char *cursor = NULL; 6987 size_t out_len = 0, i, prefix_len; 6988 SSL_CTX *sctx = SSL_CONNECTION_GET_CTX(sc); 6989 6990 #ifndef OPENSSL_NO_SSLKEYLOG 6991 if (sctx->keylog_callback == NULL && sctx->do_sslkeylog == 0) 6992 return 1; 6993 #else 6994 if (sctx->keylog_callback == NULL) 6995 return 1; 6996 #endif 6997 6998 /* 6999 * Our output buffer will contain the following strings, rendered with 7000 * space characters in between, terminated by a NULL character: first the 7001 * prefix, then the first parameter, then the second parameter. The 7002 * meaning of each parameter depends on the specific key material being 7003 * logged. Note that the first and second parameters are encoded in 7004 * hexadecimal, so we need a buffer that is twice their lengths. 7005 */ 7006 prefix_len = strlen(prefix); 7007 out_len = prefix_len + (2 * parameter_1_len) + (2 * parameter_2_len) + 3; 7008 if ((out = cursor = OPENSSL_malloc(out_len)) == NULL) 7009 return 0; 7010 7011 memcpy(cursor, prefix, prefix_len); 7012 cursor += prefix_len; 7013 *cursor++ = ' '; 7014 7015 for (i = 0; i < parameter_1_len; ++i) 7016 cursor += ossl_to_lowerhex(cursor, parameter_1[i]); 7017 *cursor++ = ' '; 7018 7019 for (i = 0; i < parameter_2_len; ++i) 7020 cursor += ossl_to_lowerhex(cursor, parameter_2[i]); 7021 *cursor = '\0'; 7022 7023 #ifndef OPENSSL_NO_SSLKEYLOG 7024 if (sctx->do_sslkeylog == 1) 7025 do_sslkeylogfile(SSL_CONNECTION_GET_SSL(sc), (const char *)out); 7026 #endif 7027 if (sctx->keylog_callback != NULL) 7028 sctx->keylog_callback(SSL_CONNECTION_GET_USER_SSL(sc), (const char *)out); 7029 OPENSSL_clear_free(out, out_len); 7030 return 1; 7031 } 7032 7033 int ssl_log_rsa_client_key_exchange(SSL_CONNECTION *sc, 7034 const uint8_t *encrypted_premaster, 7035 size_t encrypted_premaster_len, 7036 const uint8_t *premaster, 7037 size_t premaster_len) 7038 { 7039 if (encrypted_premaster_len < 8) { 7040 SSLfatal(sc, SSL_AD_INTERNAL_ERROR, ERR_R_INTERNAL_ERROR); 7041 return 0; 7042 } 7043 7044 /* We only want the first 8 bytes of the encrypted premaster as a tag. */ 7045 return nss_keylog_int("RSA", 7046 sc, 7047 encrypted_premaster, 7048 8, 7049 premaster, 7050 premaster_len); 7051 } 7052 7053 int ssl_log_secret(SSL_CONNECTION *sc, 7054 const char *label, 7055 const uint8_t *secret, 7056 size_t secret_len) 7057 { 7058 return nss_keylog_int(label, 7059 sc, 7060 sc->s3.client_random, 7061 SSL3_RANDOM_SIZE, 7062 secret, 7063 secret_len); 7064 } 7065 7066 #define SSLV2_CIPHER_LEN 3 7067 7068 int ssl_cache_cipherlist(SSL_CONNECTION *s, PACKET *cipher_suites, int sslv2format) 7069 { 7070 int n; 7071 7072 n = sslv2format ? SSLV2_CIPHER_LEN : TLS_CIPHER_LEN; 7073 7074 if (PACKET_remaining(cipher_suites) == 0) { 7075 SSLfatal(s, SSL_AD_DECODE_ERROR, SSL_R_NO_CIPHERS_SPECIFIED); 7076 return 0; 7077 } 7078 7079 if (PACKET_remaining(cipher_suites) % n != 0) { 7080 SSLfatal(s, SSL_AD_DECODE_ERROR, SSL_R_ERROR_IN_RECEIVED_CIPHER_LIST); 7081 return 0; 7082 } 7083 7084 OPENSSL_free(s->s3.tmp.ciphers_raw); 7085 s->s3.tmp.ciphers_raw = NULL; 7086 s->s3.tmp.ciphers_rawlen = 0; 7087 7088 if (sslv2format) { 7089 size_t numciphers = PACKET_remaining(cipher_suites) / n; 7090 PACKET sslv2ciphers = *cipher_suites; 7091 unsigned int leadbyte; 7092 unsigned char *raw; 7093 7094 /* 7095 * We store the raw ciphers list in SSLv3+ format so we need to do some 7096 * preprocessing to convert the list first. If there are any SSLv2 only 7097 * ciphersuites with a non-zero leading byte then we are going to 7098 * slightly over allocate because we won't store those. But that isn't a 7099 * problem. 7100 */ 7101 raw = OPENSSL_malloc(numciphers * TLS_CIPHER_LEN); 7102 s->s3.tmp.ciphers_raw = raw; 7103 if (raw == NULL) { 7104 SSLfatal(s, SSL_AD_INTERNAL_ERROR, ERR_R_CRYPTO_LIB); 7105 return 0; 7106 } 7107 for (s->s3.tmp.ciphers_rawlen = 0; 7108 PACKET_remaining(&sslv2ciphers) > 0; 7109 raw += TLS_CIPHER_LEN) { 7110 if (!PACKET_get_1(&sslv2ciphers, &leadbyte) 7111 || (leadbyte == 0 7112 && !PACKET_copy_bytes(&sslv2ciphers, raw, 7113 TLS_CIPHER_LEN)) 7114 || (leadbyte != 0 7115 && !PACKET_forward(&sslv2ciphers, TLS_CIPHER_LEN))) { 7116 SSLfatal(s, SSL_AD_DECODE_ERROR, SSL_R_BAD_PACKET); 7117 OPENSSL_free(s->s3.tmp.ciphers_raw); 7118 s->s3.tmp.ciphers_raw = NULL; 7119 s->s3.tmp.ciphers_rawlen = 0; 7120 return 0; 7121 } 7122 if (leadbyte == 0) 7123 s->s3.tmp.ciphers_rawlen += TLS_CIPHER_LEN; 7124 } 7125 } else if (!PACKET_memdup(cipher_suites, &s->s3.tmp.ciphers_raw, 7126 &s->s3.tmp.ciphers_rawlen)) { 7127 SSLfatal(s, SSL_AD_INTERNAL_ERROR, ERR_R_INTERNAL_ERROR); 7128 return 0; 7129 } 7130 return 1; 7131 } 7132 7133 int SSL_bytes_to_cipher_list(SSL *s, const unsigned char *bytes, size_t len, 7134 int isv2format, STACK_OF(SSL_CIPHER) **sk, 7135 STACK_OF(SSL_CIPHER) **scsvs) 7136 { 7137 PACKET pkt; 7138 SSL_CONNECTION *sc = SSL_CONNECTION_FROM_SSL(s); 7139 7140 if (sc == NULL) 7141 return 0; 7142 7143 if (!PACKET_buf_init(&pkt, bytes, len)) 7144 return 0; 7145 return ossl_bytes_to_cipher_list(sc, &pkt, sk, scsvs, isv2format, 0); 7146 } 7147 7148 int ossl_bytes_to_cipher_list(SSL_CONNECTION *s, PACKET *cipher_suites, 7149 STACK_OF(SSL_CIPHER) **skp, 7150 STACK_OF(SSL_CIPHER) **scsvs_out, 7151 int sslv2format, int fatal) 7152 { 7153 const SSL_CIPHER *c; 7154 STACK_OF(SSL_CIPHER) *sk = NULL; 7155 STACK_OF(SSL_CIPHER) *scsvs = NULL; 7156 int n; 7157 /* 3 = SSLV2_CIPHER_LEN > TLS_CIPHER_LEN = 2. */ 7158 unsigned char cipher[SSLV2_CIPHER_LEN]; 7159 7160 n = sslv2format ? SSLV2_CIPHER_LEN : TLS_CIPHER_LEN; 7161 7162 if (PACKET_remaining(cipher_suites) == 0) { 7163 if (fatal) 7164 SSLfatal(s, SSL_AD_ILLEGAL_PARAMETER, SSL_R_NO_CIPHERS_SPECIFIED); 7165 else 7166 ERR_raise(ERR_LIB_SSL, SSL_R_NO_CIPHERS_SPECIFIED); 7167 return 0; 7168 } 7169 7170 if (PACKET_remaining(cipher_suites) % n != 0) { 7171 if (fatal) 7172 SSLfatal(s, SSL_AD_DECODE_ERROR, 7173 SSL_R_ERROR_IN_RECEIVED_CIPHER_LIST); 7174 else 7175 ERR_raise(ERR_LIB_SSL, SSL_R_ERROR_IN_RECEIVED_CIPHER_LIST); 7176 return 0; 7177 } 7178 7179 sk = sk_SSL_CIPHER_new_null(); 7180 scsvs = sk_SSL_CIPHER_new_null(); 7181 if (sk == NULL || scsvs == NULL) { 7182 if (fatal) 7183 SSLfatal(s, SSL_AD_INTERNAL_ERROR, ERR_R_CRYPTO_LIB); 7184 else 7185 ERR_raise(ERR_LIB_SSL, ERR_R_CRYPTO_LIB); 7186 goto err; 7187 } 7188 7189 while (PACKET_copy_bytes(cipher_suites, cipher, n)) { 7190 /* 7191 * SSLv3 ciphers wrapped in an SSLv2-compatible ClientHello have the 7192 * first byte set to zero, while true SSLv2 ciphers have a non-zero 7193 * first byte. We don't support any true SSLv2 ciphers, so skip them. 7194 */ 7195 if (sslv2format && cipher[0] != '\0') 7196 continue; 7197 7198 /* For SSLv2-compat, ignore leading 0-byte. */ 7199 c = ssl_get_cipher_by_char(s, sslv2format ? &cipher[1] : cipher, 1); 7200 if (c != NULL) { 7201 if ((c->valid && !sk_SSL_CIPHER_push(sk, c)) || (!c->valid && !sk_SSL_CIPHER_push(scsvs, c))) { 7202 if (fatal) 7203 SSLfatal(s, SSL_AD_INTERNAL_ERROR, ERR_R_CRYPTO_LIB); 7204 else 7205 ERR_raise(ERR_LIB_SSL, ERR_R_CRYPTO_LIB); 7206 goto err; 7207 } 7208 } 7209 } 7210 if (PACKET_remaining(cipher_suites) > 0) { 7211 if (fatal) 7212 SSLfatal(s, SSL_AD_DECODE_ERROR, SSL_R_BAD_LENGTH); 7213 else 7214 ERR_raise(ERR_LIB_SSL, SSL_R_BAD_LENGTH); 7215 goto err; 7216 } 7217 7218 if (skp != NULL) 7219 *skp = sk; 7220 else 7221 sk_SSL_CIPHER_free(sk); 7222 if (scsvs_out != NULL) 7223 *scsvs_out = scsvs; 7224 else 7225 sk_SSL_CIPHER_free(scsvs); 7226 return 1; 7227 err: 7228 sk_SSL_CIPHER_free(sk); 7229 sk_SSL_CIPHER_free(scsvs); 7230 return 0; 7231 } 7232 7233 int SSL_CTX_set_max_early_data(SSL_CTX *ctx, uint32_t max_early_data) 7234 { 7235 ctx->max_early_data = max_early_data; 7236 7237 return 1; 7238 } 7239 7240 uint32_t SSL_CTX_get_max_early_data(const SSL_CTX *ctx) 7241 { 7242 return ctx->max_early_data; 7243 } 7244 7245 int SSL_set_max_early_data(SSL *s, uint32_t max_early_data) 7246 { 7247 SSL_CONNECTION *sc = SSL_CONNECTION_FROM_SSL_ONLY(s); 7248 7249 if (sc == NULL) 7250 return 0; 7251 7252 sc->max_early_data = max_early_data; 7253 7254 return 1; 7255 } 7256 7257 uint32_t SSL_get_max_early_data(const SSL *s) 7258 { 7259 const SSL_CONNECTION *sc = SSL_CONNECTION_FROM_CONST_SSL(s); 7260 7261 if (sc == NULL) 7262 return 0; 7263 7264 return sc->max_early_data; 7265 } 7266 7267 int SSL_CTX_set_recv_max_early_data(SSL_CTX *ctx, uint32_t recv_max_early_data) 7268 { 7269 ctx->recv_max_early_data = recv_max_early_data; 7270 7271 return 1; 7272 } 7273 7274 uint32_t SSL_CTX_get_recv_max_early_data(const SSL_CTX *ctx) 7275 { 7276 return ctx->recv_max_early_data; 7277 } 7278 7279 int SSL_set_recv_max_early_data(SSL *s, uint32_t recv_max_early_data) 7280 { 7281 SSL_CONNECTION *sc = SSL_CONNECTION_FROM_SSL_ONLY(s); 7282 7283 if (sc == NULL) 7284 return 0; 7285 7286 sc->recv_max_early_data = recv_max_early_data; 7287 7288 return 1; 7289 } 7290 7291 uint32_t SSL_get_recv_max_early_data(const SSL *s) 7292 { 7293 const SSL_CONNECTION *sc = SSL_CONNECTION_FROM_CONST_SSL(s); 7294 7295 if (sc == NULL) 7296 return 0; 7297 7298 return sc->recv_max_early_data; 7299 } 7300 7301 __owur unsigned int ssl_get_max_send_fragment(const SSL_CONNECTION *sc) 7302 { 7303 /* Return any active Max Fragment Len extension */ 7304 if (sc->session != NULL && USE_MAX_FRAGMENT_LENGTH_EXT(sc->session)) 7305 return GET_MAX_FRAGMENT_LENGTH(sc->session); 7306 7307 /* return current SSL connection setting */ 7308 return sc->max_send_fragment; 7309 } 7310 7311 __owur unsigned int ssl_get_split_send_fragment(const SSL_CONNECTION *sc) 7312 { 7313 /* Return a value regarding an active Max Fragment Len extension */ 7314 if (sc->session != NULL && USE_MAX_FRAGMENT_LENGTH_EXT(sc->session) 7315 && sc->split_send_fragment > GET_MAX_FRAGMENT_LENGTH(sc->session)) 7316 return GET_MAX_FRAGMENT_LENGTH(sc->session); 7317 7318 /* else limit |split_send_fragment| to current |max_send_fragment| */ 7319 if (sc->split_send_fragment > sc->max_send_fragment) 7320 return sc->max_send_fragment; 7321 7322 /* return current SSL connection setting */ 7323 return sc->split_send_fragment; 7324 } 7325 7326 int SSL_stateless(SSL *s) 7327 { 7328 int ret; 7329 SSL_CONNECTION *sc = SSL_CONNECTION_FROM_SSL_ONLY(s); 7330 7331 if (sc == NULL) 7332 return 0; 7333 7334 /* Ensure there is no state left over from a previous invocation */ 7335 if (!SSL_clear(s)) 7336 return 0; 7337 7338 ERR_clear_error(); 7339 7340 sc->s3.flags |= TLS1_FLAGS_STATELESS; 7341 ret = SSL_accept(s); 7342 sc->s3.flags &= ~TLS1_FLAGS_STATELESS; 7343 7344 if (ret > 0 && sc->ext.cookieok) 7345 return 1; 7346 7347 if (sc->hello_retry_request == SSL_HRR_PENDING && !ossl_statem_in_error(sc)) 7348 return 0; 7349 7350 return -1; 7351 } 7352 7353 void SSL_CTX_set_post_handshake_auth(SSL_CTX *ctx, int val) 7354 { 7355 ctx->pha_enabled = val; 7356 } 7357 7358 void SSL_set_post_handshake_auth(SSL *ssl, int val) 7359 { 7360 SSL_CONNECTION *sc = SSL_CONNECTION_FROM_SSL_ONLY(ssl); 7361 7362 if (sc == NULL) 7363 return; 7364 7365 sc->pha_enabled = val; 7366 } 7367 7368 int SSL_verify_client_post_handshake(SSL *ssl) 7369 { 7370 SSL_CONNECTION *sc = SSL_CONNECTION_FROM_SSL(ssl); 7371 7372 #ifndef OPENSSL_NO_QUIC 7373 if (IS_QUIC(ssl)) { 7374 ERR_raise(ERR_LIB_SSL, SSL_R_WRONG_SSL_VERSION); 7375 return 0; 7376 } 7377 #endif 7378 7379 if (sc == NULL) 7380 return 0; 7381 7382 if (!SSL_CONNECTION_IS_TLS13(sc)) { 7383 ERR_raise(ERR_LIB_SSL, SSL_R_WRONG_SSL_VERSION); 7384 return 0; 7385 } 7386 if (!sc->server) { 7387 ERR_raise(ERR_LIB_SSL, SSL_R_NOT_SERVER); 7388 return 0; 7389 } 7390 7391 if (!SSL_is_init_finished(ssl)) { 7392 ERR_raise(ERR_LIB_SSL, SSL_R_STILL_IN_INIT); 7393 return 0; 7394 } 7395 7396 switch (sc->post_handshake_auth) { 7397 case SSL_PHA_NONE: 7398 ERR_raise(ERR_LIB_SSL, SSL_R_EXTENSION_NOT_RECEIVED); 7399 return 0; 7400 default: 7401 case SSL_PHA_EXT_SENT: 7402 ERR_raise(ERR_LIB_SSL, ERR_R_INTERNAL_ERROR); 7403 return 0; 7404 case SSL_PHA_EXT_RECEIVED: 7405 break; 7406 case SSL_PHA_REQUEST_PENDING: 7407 ERR_raise(ERR_LIB_SSL, SSL_R_REQUEST_PENDING); 7408 return 0; 7409 case SSL_PHA_REQUESTED: 7410 ERR_raise(ERR_LIB_SSL, SSL_R_REQUEST_SENT); 7411 return 0; 7412 } 7413 7414 sc->post_handshake_auth = SSL_PHA_REQUEST_PENDING; 7415 7416 /* checks verify_mode and algorithm_auth */ 7417 if (!send_certificate_request(sc)) { 7418 sc->post_handshake_auth = SSL_PHA_EXT_RECEIVED; /* restore on error */ 7419 ERR_raise(ERR_LIB_SSL, SSL_R_INVALID_CONFIG); 7420 return 0; 7421 } 7422 7423 ossl_statem_set_in_init(sc, 1); 7424 return 1; 7425 } 7426 7427 int SSL_CTX_set_session_ticket_cb(SSL_CTX *ctx, 7428 SSL_CTX_generate_session_ticket_fn gen_cb, 7429 SSL_CTX_decrypt_session_ticket_fn dec_cb, 7430 void *arg) 7431 { 7432 ctx->generate_ticket_cb = gen_cb; 7433 ctx->decrypt_ticket_cb = dec_cb; 7434 ctx->ticket_cb_data = arg; 7435 return 1; 7436 } 7437 7438 void SSL_CTX_set_allow_early_data_cb(SSL_CTX *ctx, 7439 SSL_allow_early_data_cb_fn cb, 7440 void *arg) 7441 { 7442 ctx->allow_early_data_cb = cb; 7443 ctx->allow_early_data_cb_data = arg; 7444 } 7445 7446 void SSL_set_allow_early_data_cb(SSL *s, 7447 SSL_allow_early_data_cb_fn cb, 7448 void *arg) 7449 { 7450 SSL_CONNECTION *sc = SSL_CONNECTION_FROM_SSL_ONLY(s); 7451 7452 if (sc == NULL) 7453 return; 7454 7455 sc->allow_early_data_cb = cb; 7456 sc->allow_early_data_cb_data = arg; 7457 } 7458 7459 const EVP_CIPHER *ssl_evp_cipher_fetch(OSSL_LIB_CTX *libctx, 7460 int nid, 7461 const char *properties) 7462 { 7463 const EVP_CIPHER *ciph; 7464 7465 ciph = tls_get_cipher_from_engine(nid); 7466 if (ciph != NULL) 7467 return ciph; 7468 7469 /* 7470 * If there is no engine cipher then we do an explicit fetch. This may fail 7471 * and that could be ok 7472 */ 7473 ERR_set_mark(); 7474 ciph = EVP_CIPHER_fetch(libctx, OBJ_nid2sn(nid), properties); 7475 if (ciph != NULL) { 7476 OSSL_PARAM params[2]; 7477 int decrypt_only = 0; 7478 7479 params[0] = OSSL_PARAM_construct_int(OSSL_CIPHER_PARAM_DECRYPT_ONLY, 7480 &decrypt_only); 7481 params[1] = OSSL_PARAM_construct_end(); 7482 if (EVP_CIPHER_get_params((EVP_CIPHER *)ciph, params) 7483 && decrypt_only) { 7484 /* If a cipher is decrypt-only, it is unusable */ 7485 EVP_CIPHER_free((EVP_CIPHER *)ciph); 7486 ciph = NULL; 7487 } 7488 } 7489 ERR_pop_to_mark(); 7490 return ciph; 7491 } 7492 7493 int ssl_evp_cipher_up_ref(const EVP_CIPHER *cipher) 7494 { 7495 /* Don't up-ref an implicit EVP_CIPHER */ 7496 if (EVP_CIPHER_get0_provider(cipher) == NULL) 7497 return 1; 7498 7499 /* 7500 * The cipher was explicitly fetched and therefore it is safe to cast 7501 * away the const 7502 */ 7503 return EVP_CIPHER_up_ref((EVP_CIPHER *)cipher); 7504 } 7505 7506 void ssl_evp_cipher_free(const EVP_CIPHER *cipher) 7507 { 7508 if (cipher == NULL) 7509 return; 7510 7511 if (EVP_CIPHER_get0_provider(cipher) != NULL) { 7512 /* 7513 * The cipher was explicitly fetched and therefore it is safe to cast 7514 * away the const 7515 */ 7516 EVP_CIPHER_free((EVP_CIPHER *)cipher); 7517 } 7518 } 7519 7520 const EVP_MD *ssl_evp_md_fetch(OSSL_LIB_CTX *libctx, 7521 int nid, 7522 const char *properties) 7523 { 7524 const EVP_MD *md; 7525 7526 md = tls_get_digest_from_engine(nid); 7527 if (md != NULL) 7528 return md; 7529 7530 /* Otherwise we do an explicit fetch */ 7531 ERR_set_mark(); 7532 md = EVP_MD_fetch(libctx, OBJ_nid2sn(nid), properties); 7533 ERR_pop_to_mark(); 7534 return md; 7535 } 7536 7537 int ssl_evp_md_up_ref(const EVP_MD *md) 7538 { 7539 /* Don't up-ref an implicit EVP_MD */ 7540 if (EVP_MD_get0_provider(md) == NULL) 7541 return 1; 7542 7543 /* 7544 * The digest was explicitly fetched and therefore it is safe to cast 7545 * away the const 7546 */ 7547 return EVP_MD_up_ref((EVP_MD *)md); 7548 } 7549 7550 void ssl_evp_md_free(const EVP_MD *md) 7551 { 7552 if (md == NULL) 7553 return; 7554 7555 if (EVP_MD_get0_provider(md) != NULL) { 7556 /* 7557 * The digest was explicitly fetched and therefore it is safe to cast 7558 * away the const 7559 */ 7560 EVP_MD_free((EVP_MD *)md); 7561 } 7562 } 7563 7564 int SSL_set0_tmp_dh_pkey(SSL *s, EVP_PKEY *dhpkey) 7565 { 7566 SSL_CONNECTION *sc = SSL_CONNECTION_FROM_SSL(s); 7567 7568 if (sc == NULL) 7569 return 0; 7570 7571 if (!ssl_security(sc, SSL_SECOP_TMP_DH, 7572 EVP_PKEY_get_security_bits(dhpkey), 0, dhpkey)) { 7573 ERR_raise(ERR_LIB_SSL, SSL_R_DH_KEY_TOO_SMALL); 7574 return 0; 7575 } 7576 EVP_PKEY_free(sc->cert->dh_tmp); 7577 sc->cert->dh_tmp = dhpkey; 7578 return 1; 7579 } 7580 7581 int SSL_CTX_set0_tmp_dh_pkey(SSL_CTX *ctx, EVP_PKEY *dhpkey) 7582 { 7583 if (!ssl_ctx_security(ctx, SSL_SECOP_TMP_DH, 7584 EVP_PKEY_get_security_bits(dhpkey), 0, dhpkey)) { 7585 ERR_raise(ERR_LIB_SSL, SSL_R_DH_KEY_TOO_SMALL); 7586 return 0; 7587 } 7588 EVP_PKEY_free(ctx->cert->dh_tmp); 7589 ctx->cert->dh_tmp = dhpkey; 7590 return 1; 7591 } 7592 7593 /* QUIC-specific methods which are supported on QUIC connections only. */ 7594 int SSL_handle_events(SSL *s) 7595 { 7596 SSL_CONNECTION *sc; 7597 7598 #ifndef OPENSSL_NO_QUIC 7599 if (IS_QUIC(s)) 7600 return ossl_quic_handle_events(s); 7601 #endif 7602 7603 sc = SSL_CONNECTION_FROM_SSL_ONLY(s); 7604 if (sc != NULL && SSL_CONNECTION_IS_DTLS(sc)) 7605 /* 7606 * DTLSv1_handle_timeout returns 0 if the timer wasn't expired yet, 7607 * which we consider a success case. Theoretically DTLSv1_handle_timeout 7608 * can also return 0 if s is NULL or not a DTLS object, but we've 7609 * already ruled out those possibilities above, so this is not possible 7610 * here. Thus the only failure cases are where DTLSv1_handle_timeout 7611 * returns -1. 7612 */ 7613 return DTLSv1_handle_timeout(s) >= 0; 7614 7615 return 1; 7616 } 7617 7618 int SSL_get_event_timeout(SSL *s, struct timeval *tv, int *is_infinite) 7619 { 7620 SSL_CONNECTION *sc; 7621 7622 #ifndef OPENSSL_NO_QUIC 7623 if (IS_QUIC(s)) 7624 return ossl_quic_get_event_timeout(s, tv, is_infinite); 7625 #endif 7626 7627 sc = SSL_CONNECTION_FROM_SSL_ONLY(s); 7628 if (sc != NULL && SSL_CONNECTION_IS_DTLS(sc) 7629 && DTLSv1_get_timeout(s, tv)) { 7630 *is_infinite = 0; 7631 return 1; 7632 } 7633 7634 tv->tv_sec = 1000000; 7635 tv->tv_usec = 0; 7636 *is_infinite = 1; 7637 return 1; 7638 } 7639 7640 int SSL_get_rpoll_descriptor(SSL *s, BIO_POLL_DESCRIPTOR *desc) 7641 { 7642 SSL_CONNECTION *sc = SSL_CONNECTION_FROM_SSL(s); 7643 7644 #ifndef OPENSSL_NO_QUIC 7645 if (IS_QUIC(s)) 7646 return ossl_quic_get_rpoll_descriptor(s, desc); 7647 #endif 7648 7649 if (sc == NULL || sc->rbio == NULL) 7650 return 0; 7651 7652 return BIO_get_rpoll_descriptor(sc->rbio, desc); 7653 } 7654 7655 int SSL_get_wpoll_descriptor(SSL *s, BIO_POLL_DESCRIPTOR *desc) 7656 { 7657 SSL_CONNECTION *sc = SSL_CONNECTION_FROM_SSL(s); 7658 7659 #ifndef OPENSSL_NO_QUIC 7660 if (IS_QUIC(s)) 7661 return ossl_quic_get_wpoll_descriptor(s, desc); 7662 #endif 7663 7664 if (sc == NULL || sc->wbio == NULL) 7665 return 0; 7666 7667 return BIO_get_wpoll_descriptor(sc->wbio, desc); 7668 } 7669 7670 int SSL_net_read_desired(SSL *s) 7671 { 7672 #ifndef OPENSSL_NO_QUIC 7673 if (!IS_QUIC(s)) 7674 return SSL_want_read(s); 7675 7676 return ossl_quic_get_net_read_desired(s); 7677 #else 7678 return SSL_want_read(s); 7679 #endif 7680 } 7681 7682 int SSL_net_write_desired(SSL *s) 7683 { 7684 #ifndef OPENSSL_NO_QUIC 7685 if (!IS_QUIC(s)) 7686 return SSL_want_write(s); 7687 7688 return ossl_quic_get_net_write_desired(s); 7689 #else 7690 return SSL_want_write(s); 7691 #endif 7692 } 7693 7694 int SSL_set_blocking_mode(SSL *s, int blocking) 7695 { 7696 #ifndef OPENSSL_NO_QUIC 7697 if (!IS_QUIC(s)) 7698 return 0; 7699 7700 return ossl_quic_conn_set_blocking_mode(s, blocking); 7701 #else 7702 return 0; 7703 #endif 7704 } 7705 7706 int SSL_get_blocking_mode(SSL *s) 7707 { 7708 #ifndef OPENSSL_NO_QUIC 7709 if (!IS_QUIC(s)) 7710 return -1; 7711 7712 return ossl_quic_conn_get_blocking_mode(s); 7713 #else 7714 return -1; 7715 #endif 7716 } 7717 7718 int SSL_set1_initial_peer_addr(SSL *s, const BIO_ADDR *peer_addr) 7719 { 7720 #ifndef OPENSSL_NO_QUIC 7721 if (!IS_QUIC(s)) 7722 return 0; 7723 7724 return ossl_quic_conn_set_initial_peer_addr(s, peer_addr); 7725 #else 7726 return 0; 7727 #endif 7728 } 7729 7730 int SSL_shutdown_ex(SSL *ssl, uint64_t flags, 7731 const SSL_SHUTDOWN_EX_ARGS *args, 7732 size_t args_len) 7733 { 7734 #ifndef OPENSSL_NO_QUIC 7735 if (!IS_QUIC(ssl)) 7736 return SSL_shutdown(ssl); 7737 7738 return ossl_quic_conn_shutdown(ssl, flags, args, args_len); 7739 #else 7740 return SSL_shutdown(ssl); 7741 #endif 7742 } 7743 7744 int SSL_stream_conclude(SSL *ssl, uint64_t flags) 7745 { 7746 #ifndef OPENSSL_NO_QUIC 7747 if (!IS_QUIC(ssl)) 7748 return 0; 7749 7750 return ossl_quic_conn_stream_conclude(ssl); 7751 #else 7752 return 0; 7753 #endif 7754 } 7755 7756 SSL *SSL_new_stream(SSL *s, uint64_t flags) 7757 { 7758 #ifndef OPENSSL_NO_QUIC 7759 if (!IS_QUIC(s)) 7760 return NULL; 7761 7762 return ossl_quic_conn_stream_new(s, flags); 7763 #else 7764 return NULL; 7765 #endif 7766 } 7767 7768 SSL *SSL_get0_connection(SSL *s) 7769 { 7770 #ifndef OPENSSL_NO_QUIC 7771 if (!IS_QUIC(s)) 7772 return s; 7773 7774 return ossl_quic_get0_connection(s); 7775 #else 7776 return s; 7777 #endif 7778 } 7779 7780 int SSL_is_connection(SSL *s) 7781 { 7782 return SSL_get0_connection(s) == s; 7783 } 7784 7785 SSL *SSL_get0_listener(SSL *s) 7786 { 7787 #ifndef OPENSSL_NO_QUIC 7788 if (!IS_QUIC(s)) 7789 return NULL; 7790 7791 return ossl_quic_get0_listener(s); 7792 #else 7793 return NULL; 7794 #endif 7795 } 7796 7797 SSL *SSL_get0_domain(SSL *s) 7798 { 7799 #ifndef OPENSSL_NO_QUIC 7800 if (!IS_QUIC(s)) 7801 return NULL; 7802 7803 return ossl_quic_get0_domain(s); 7804 #else 7805 return NULL; 7806 #endif 7807 } 7808 7809 int SSL_is_listener(SSL *s) 7810 { 7811 return SSL_get0_listener(s) == s; 7812 } 7813 7814 int SSL_is_domain(SSL *s) 7815 { 7816 return SSL_get0_domain(s) == s; 7817 } 7818 7819 int SSL_get_stream_type(SSL *s) 7820 { 7821 #ifndef OPENSSL_NO_QUIC 7822 if (!IS_QUIC(s)) 7823 return SSL_STREAM_TYPE_BIDI; 7824 7825 return ossl_quic_get_stream_type(s); 7826 #else 7827 return SSL_STREAM_TYPE_BIDI; 7828 #endif 7829 } 7830 7831 uint64_t SSL_get_stream_id(SSL *s) 7832 { 7833 #ifndef OPENSSL_NO_QUIC 7834 if (!IS_QUIC(s)) 7835 return UINT64_MAX; 7836 7837 return ossl_quic_get_stream_id(s); 7838 #else 7839 return UINT64_MAX; 7840 #endif 7841 } 7842 7843 int SSL_is_stream_local(SSL *s) 7844 { 7845 #ifndef OPENSSL_NO_QUIC 7846 if (!IS_QUIC(s)) 7847 return -1; 7848 7849 return ossl_quic_is_stream_local(s); 7850 #else 7851 return -1; 7852 #endif 7853 } 7854 7855 int SSL_set_default_stream_mode(SSL *s, uint32_t mode) 7856 { 7857 #ifndef OPENSSL_NO_QUIC 7858 if (!IS_QUIC(s)) 7859 return 0; 7860 7861 return ossl_quic_set_default_stream_mode(s, mode); 7862 #else 7863 return 0; 7864 #endif 7865 } 7866 7867 int SSL_set_incoming_stream_policy(SSL *s, int policy, uint64_t aec) 7868 { 7869 #ifndef OPENSSL_NO_QUIC 7870 if (!IS_QUIC(s)) 7871 return 0; 7872 7873 return ossl_quic_set_incoming_stream_policy(s, policy, aec); 7874 #else 7875 return 0; 7876 #endif 7877 } 7878 7879 SSL *SSL_accept_stream(SSL *s, uint64_t flags) 7880 { 7881 #ifndef OPENSSL_NO_QUIC 7882 if (!IS_QUIC(s)) 7883 return NULL; 7884 7885 return ossl_quic_accept_stream(s, flags); 7886 #else 7887 return NULL; 7888 #endif 7889 } 7890 7891 size_t SSL_get_accept_stream_queue_len(SSL *s) 7892 { 7893 #ifndef OPENSSL_NO_QUIC 7894 if (!IS_QUIC(s)) 7895 return 0; 7896 7897 return ossl_quic_get_accept_stream_queue_len(s); 7898 #else 7899 return 0; 7900 #endif 7901 } 7902 7903 int SSL_stream_reset(SSL *s, 7904 const SSL_STREAM_RESET_ARGS *args, 7905 size_t args_len) 7906 { 7907 #ifndef OPENSSL_NO_QUIC 7908 if (!IS_QUIC(s)) 7909 return 0; 7910 7911 return ossl_quic_stream_reset(s, args, args_len); 7912 #else 7913 return 0; 7914 #endif 7915 } 7916 7917 int SSL_get_stream_read_state(SSL *s) 7918 { 7919 #ifndef OPENSSL_NO_QUIC 7920 if (!IS_QUIC(s)) 7921 return SSL_STREAM_STATE_NONE; 7922 7923 return ossl_quic_get_stream_read_state(s); 7924 #else 7925 return SSL_STREAM_STATE_NONE; 7926 #endif 7927 } 7928 7929 int SSL_get_stream_write_state(SSL *s) 7930 { 7931 #ifndef OPENSSL_NO_QUIC 7932 if (!IS_QUIC(s)) 7933 return SSL_STREAM_STATE_NONE; 7934 7935 return ossl_quic_get_stream_write_state(s); 7936 #else 7937 return SSL_STREAM_STATE_NONE; 7938 #endif 7939 } 7940 7941 int SSL_get_stream_read_error_code(SSL *s, uint64_t *app_error_code) 7942 { 7943 #ifndef OPENSSL_NO_QUIC 7944 if (!IS_QUIC(s)) 7945 return -1; 7946 7947 return ossl_quic_get_stream_read_error_code(s, app_error_code); 7948 #else 7949 return -1; 7950 #endif 7951 } 7952 7953 int SSL_get_stream_write_error_code(SSL *s, uint64_t *app_error_code) 7954 { 7955 #ifndef OPENSSL_NO_QUIC 7956 if (!IS_QUIC(s)) 7957 return -1; 7958 7959 return ossl_quic_get_stream_write_error_code(s, app_error_code); 7960 #else 7961 return -1; 7962 #endif 7963 } 7964 7965 int SSL_get_conn_close_info(SSL *s, SSL_CONN_CLOSE_INFO *info, 7966 size_t info_len) 7967 { 7968 #ifndef OPENSSL_NO_QUIC 7969 if (!IS_QUIC(s)) 7970 return -1; 7971 7972 return ossl_quic_get_conn_close_info(s, info, info_len); 7973 #else 7974 return -1; 7975 #endif 7976 } 7977 7978 int SSL_get_value_uint(SSL *s, uint32_t class_, uint32_t id, 7979 uint64_t *value) 7980 { 7981 #ifndef OPENSSL_NO_QUIC 7982 if (IS_QUIC(s)) 7983 return ossl_quic_get_value_uint(s, class_, id, value); 7984 #endif 7985 7986 ERR_raise(ERR_LIB_SSL, SSL_R_UNSUPPORTED_PROTOCOL); 7987 return 0; 7988 } 7989 7990 int SSL_set_value_uint(SSL *s, uint32_t class_, uint32_t id, 7991 uint64_t value) 7992 { 7993 #ifndef OPENSSL_NO_QUIC 7994 if (IS_QUIC(s)) 7995 return ossl_quic_set_value_uint(s, class_, id, value); 7996 #endif 7997 7998 ERR_raise(ERR_LIB_SSL, SSL_R_UNSUPPORTED_PROTOCOL); 7999 return 0; 8000 } 8001 8002 SSL *SSL_new_listener(SSL_CTX *ctx, uint64_t flags) 8003 { 8004 #ifndef OPENSSL_NO_QUIC 8005 if (!IS_QUIC_CTX(ctx)) 8006 return NULL; 8007 8008 return ossl_quic_new_listener(ctx, flags); 8009 #else 8010 return NULL; 8011 #endif 8012 } 8013 8014 SSL *SSL_new_listener_from(SSL *ssl, uint64_t flags) 8015 { 8016 #ifndef OPENSSL_NO_QUIC 8017 if (!IS_QUIC(ssl)) 8018 return NULL; 8019 8020 return ossl_quic_new_listener_from(ssl, flags); 8021 #else 8022 return NULL; 8023 #endif 8024 } 8025 8026 SSL *SSL_new_from_listener(SSL *ssl, uint64_t flags) 8027 { 8028 #ifndef OPENSSL_NO_QUIC 8029 if (!IS_QUIC(ssl)) 8030 return NULL; 8031 8032 return ossl_quic_new_from_listener(ssl, flags); 8033 #else 8034 return NULL; 8035 #endif 8036 } 8037 8038 SSL *SSL_accept_connection(SSL *ssl, uint64_t flags) 8039 { 8040 #ifndef OPENSSL_NO_QUIC 8041 if (!IS_QUIC(ssl)) 8042 return NULL; 8043 8044 return ossl_quic_accept_connection(ssl, flags); 8045 #else 8046 return NULL; 8047 #endif 8048 } 8049 8050 size_t SSL_get_accept_connection_queue_len(SSL *ssl) 8051 { 8052 #ifndef OPENSSL_NO_QUIC 8053 if (!IS_QUIC(ssl)) 8054 return 0; 8055 8056 return ossl_quic_get_accept_connection_queue_len(ssl); 8057 #else 8058 return 0; 8059 #endif 8060 } 8061 8062 int SSL_listen(SSL *ssl) 8063 { 8064 #ifndef OPENSSL_NO_QUIC 8065 if (!IS_QUIC(ssl)) 8066 return 0; 8067 8068 return ossl_quic_listen(ssl); 8069 #else 8070 return 0; 8071 #endif 8072 } 8073 8074 SSL *SSL_new_domain(SSL_CTX *ctx, uint64_t flags) 8075 { 8076 #ifndef OPENSSL_NO_QUIC 8077 if (!IS_QUIC_CTX(ctx)) 8078 return NULL; 8079 8080 return ossl_quic_new_domain(ctx, flags); 8081 #else 8082 return NULL; 8083 #endif 8084 } 8085 8086 int ossl_adjust_domain_flags(uint64_t domain_flags, uint64_t *p_domain_flags) 8087 { 8088 if ((domain_flags & ~OSSL_QUIC_SUPPORTED_DOMAIN_FLAGS) != 0) { 8089 ERR_raise_data(ERR_LIB_SSL, ERR_R_UNSUPPORTED, 8090 "unsupported domain flag requested"); 8091 return 0; 8092 } 8093 8094 if ((domain_flags & SSL_DOMAIN_FLAG_THREAD_ASSISTED) != 0) 8095 domain_flags |= SSL_DOMAIN_FLAG_MULTI_THREAD; 8096 8097 if ((domain_flags & (SSL_DOMAIN_FLAG_MULTI_THREAD | SSL_DOMAIN_FLAG_SINGLE_THREAD)) == 0) 8098 domain_flags |= SSL_DOMAIN_FLAG_MULTI_THREAD; 8099 8100 if ((domain_flags & SSL_DOMAIN_FLAG_SINGLE_THREAD) != 0 8101 && (domain_flags & SSL_DOMAIN_FLAG_MULTI_THREAD) != 0) { 8102 ERR_raise_data(ERR_LIB_SSL, ERR_R_PASSED_INVALID_ARGUMENT, 8103 "mutually exclusive domain flags specified"); 8104 return 0; 8105 } 8106 8107 /* 8108 * Note: We treat MULTI_THREAD as a no-op in non-threaded builds, but 8109 * not THREAD_ASSISTED. 8110 */ 8111 #ifndef OPENSSL_THREADS 8112 if ((domain_flags & SSL_DOMAIN_FLAG_THREAD_ASSISTED) != 0) { 8113 ERR_raise_data(ERR_LIB_SSL, ERR_R_UNSUPPORTED, 8114 "thread assisted mode not available in this build"); 8115 return 0; 8116 } 8117 #endif 8118 8119 *p_domain_flags = domain_flags; 8120 return 1; 8121 } 8122 8123 int SSL_CTX_set_domain_flags(SSL_CTX *ctx, uint64_t domain_flags) 8124 { 8125 #ifndef OPENSSL_NO_QUIC 8126 if (IS_QUIC_CTX(ctx)) { 8127 if (!ossl_adjust_domain_flags(domain_flags, &domain_flags)) 8128 return 0; 8129 8130 ctx->domain_flags = domain_flags; 8131 return 1; 8132 } 8133 #endif 8134 8135 ERR_raise_data(ERR_LIB_SSL, ERR_R_UNSUPPORTED, 8136 "domain flags unsupported on this kind of SSL_CTX"); 8137 return 0; 8138 } 8139 8140 int SSL_CTX_get_domain_flags(const SSL_CTX *ctx, uint64_t *domain_flags) 8141 { 8142 #ifndef OPENSSL_NO_QUIC 8143 if (IS_QUIC_CTX(ctx)) { 8144 if (domain_flags != NULL) 8145 *domain_flags = ctx->domain_flags; 8146 8147 return 1; 8148 } 8149 #endif 8150 8151 ERR_raise_data(ERR_LIB_SSL, ERR_R_UNSUPPORTED, 8152 "domain flags unsupported on this kind of SSL_CTX"); 8153 return 0; 8154 } 8155 8156 int SSL_get_domain_flags(const SSL *ssl, uint64_t *domain_flags) 8157 { 8158 #ifndef OPENSSL_NO_QUIC 8159 if (IS_QUIC(ssl)) 8160 return ossl_quic_get_domain_flags(ssl, domain_flags); 8161 #endif 8162 8163 return 0; 8164 } 8165 8166 int SSL_add_expected_rpk(SSL *s, EVP_PKEY *rpk) 8167 { 8168 unsigned char *data = NULL; 8169 SSL_DANE *dane = SSL_get0_dane(s); 8170 int ret; 8171 8172 if (dane == NULL || dane->dctx == NULL) 8173 return 0; 8174 if ((ret = i2d_PUBKEY(rpk, &data)) <= 0) 8175 return 0; 8176 8177 ret = SSL_dane_tlsa_add(s, DANETLS_USAGE_DANE_EE, 8178 DANETLS_SELECTOR_SPKI, 8179 DANETLS_MATCHING_FULL, 8180 data, (size_t)ret) 8181 > 0; 8182 OPENSSL_free(data); 8183 return ret; 8184 } 8185 8186 EVP_PKEY *SSL_get0_peer_rpk(const SSL *s) 8187 { 8188 SSL_CONNECTION *sc = SSL_CONNECTION_FROM_SSL(s); 8189 8190 if (sc == NULL || sc->session == NULL) 8191 return NULL; 8192 return sc->session->peer_rpk; 8193 } 8194 8195 int SSL_get_negotiated_client_cert_type(const SSL *s) 8196 { 8197 SSL_CONNECTION *sc = SSL_CONNECTION_FROM_SSL(s); 8198 8199 if (sc == NULL) 8200 return 0; 8201 8202 return sc->ext.client_cert_type; 8203 } 8204 8205 int SSL_get_negotiated_server_cert_type(const SSL *s) 8206 { 8207 SSL_CONNECTION *sc = SSL_CONNECTION_FROM_SSL(s); 8208 8209 if (sc == NULL) 8210 return 0; 8211 8212 return sc->ext.server_cert_type; 8213 } 8214 8215 static int validate_cert_type(const unsigned char *val, size_t len) 8216 { 8217 size_t i; 8218 int saw_rpk = 0; 8219 int saw_x509 = 0; 8220 8221 if (val == NULL && len == 0) 8222 return 1; 8223 8224 if (val == NULL || len == 0) 8225 return 0; 8226 8227 for (i = 0; i < len; i++) { 8228 switch (val[i]) { 8229 case TLSEXT_cert_type_rpk: 8230 if (saw_rpk) 8231 return 0; 8232 saw_rpk = 1; 8233 break; 8234 case TLSEXT_cert_type_x509: 8235 if (saw_x509) 8236 return 0; 8237 saw_x509 = 1; 8238 break; 8239 case TLSEXT_cert_type_pgp: 8240 case TLSEXT_cert_type_1609dot2: 8241 default: 8242 return 0; 8243 } 8244 } 8245 return 1; 8246 } 8247 8248 static int set_cert_type(unsigned char **cert_type, 8249 size_t *cert_type_len, 8250 const unsigned char *val, 8251 size_t len) 8252 { 8253 unsigned char *tmp = NULL; 8254 8255 if (!validate_cert_type(val, len)) 8256 return 0; 8257 8258 if (val != NULL && (tmp = OPENSSL_memdup(val, len)) == NULL) 8259 return 0; 8260 8261 OPENSSL_free(*cert_type); 8262 *cert_type = tmp; 8263 *cert_type_len = len; 8264 return 1; 8265 } 8266 8267 int SSL_set1_client_cert_type(SSL *s, const unsigned char *val, size_t len) 8268 { 8269 SSL_CONNECTION *sc = SSL_CONNECTION_FROM_SSL(s); 8270 8271 if (sc == NULL) 8272 return 0; 8273 8274 return set_cert_type(&sc->client_cert_type, &sc->client_cert_type_len, 8275 val, len); 8276 } 8277 8278 int SSL_set1_server_cert_type(SSL *s, const unsigned char *val, size_t len) 8279 { 8280 SSL_CONNECTION *sc = SSL_CONNECTION_FROM_SSL(s); 8281 8282 if (sc == NULL) 8283 return 0; 8284 8285 return set_cert_type(&sc->server_cert_type, &sc->server_cert_type_len, 8286 val, len); 8287 } 8288 8289 int SSL_CTX_set1_client_cert_type(SSL_CTX *ctx, const unsigned char *val, size_t len) 8290 { 8291 return set_cert_type(&ctx->client_cert_type, &ctx->client_cert_type_len, 8292 val, len); 8293 } 8294 8295 int SSL_CTX_set1_server_cert_type(SSL_CTX *ctx, const unsigned char *val, size_t len) 8296 { 8297 return set_cert_type(&ctx->server_cert_type, &ctx->server_cert_type_len, 8298 val, len); 8299 } 8300 8301 int SSL_get0_client_cert_type(const SSL *s, unsigned char **t, size_t *len) 8302 { 8303 const SSL_CONNECTION *sc = SSL_CONNECTION_FROM_CONST_SSL(s); 8304 8305 if (t == NULL || len == NULL || sc == NULL) 8306 return 0; 8307 8308 *t = sc->client_cert_type; 8309 *len = sc->client_cert_type_len; 8310 return 1; 8311 } 8312 8313 int SSL_get0_server_cert_type(const SSL *s, unsigned char **t, size_t *len) 8314 { 8315 const SSL_CONNECTION *sc = SSL_CONNECTION_FROM_CONST_SSL(s); 8316 8317 if (t == NULL || len == NULL || sc == NULL) 8318 return 0; 8319 8320 *t = sc->server_cert_type; 8321 *len = sc->server_cert_type_len; 8322 return 1; 8323 } 8324 8325 int SSL_CTX_get0_client_cert_type(const SSL_CTX *ctx, unsigned char **t, size_t *len) 8326 { 8327 if (t == NULL || len == NULL) 8328 return 0; 8329 8330 *t = ctx->client_cert_type; 8331 *len = ctx->client_cert_type_len; 8332 return 1; 8333 } 8334 8335 int SSL_CTX_get0_server_cert_type(const SSL_CTX *ctx, unsigned char **t, size_t *len) 8336 { 8337 if (t == NULL || len == NULL) 8338 return 0; 8339 8340 *t = ctx->server_cert_type; 8341 *len = ctx->server_cert_type_len; 8342 return 1; 8343 } 8344