xref: /freebsd/crypto/openssl/ssl/statem/extensions.c (revision 13ea0450a9c8742119d36f3bf8f47accdce46e54)
1 /*
2  * Copyright 2016-2019 The OpenSSL Project Authors. All Rights Reserved.
3  *
4  * Licensed under the OpenSSL license (the "License").  You may not use
5  * this file except in compliance with the License.  You can obtain a copy
6  * in the file LICENSE in the source distribution or at
7  * https://www.openssl.org/source/license.html
8  */
9 
10 #include <string.h>
11 #include "internal/nelem.h"
12 #include "internal/cryptlib.h"
13 #include "../ssl_locl.h"
14 #include "statem_locl.h"
15 #include "internal/cryptlib.h"
16 
17 static int final_renegotiate(SSL *s, unsigned int context, int sent);
18 static int init_server_name(SSL *s, unsigned int context);
19 static int final_server_name(SSL *s, unsigned int context, int sent);
20 #ifndef OPENSSL_NO_EC
21 static int final_ec_pt_formats(SSL *s, unsigned int context, int sent);
22 #endif
23 static int init_session_ticket(SSL *s, unsigned int context);
24 #ifndef OPENSSL_NO_OCSP
25 static int init_status_request(SSL *s, unsigned int context);
26 #endif
27 #ifndef OPENSSL_NO_NEXTPROTONEG
28 static int init_npn(SSL *s, unsigned int context);
29 #endif
30 static int init_alpn(SSL *s, unsigned int context);
31 static int final_alpn(SSL *s, unsigned int context, int sent);
32 static int init_sig_algs_cert(SSL *s, unsigned int context);
33 static int init_sig_algs(SSL *s, unsigned int context);
34 static int init_certificate_authorities(SSL *s, unsigned int context);
35 static EXT_RETURN tls_construct_certificate_authorities(SSL *s, WPACKET *pkt,
36                                                         unsigned int context,
37                                                         X509 *x,
38                                                         size_t chainidx);
39 static int tls_parse_certificate_authorities(SSL *s, PACKET *pkt,
40                                              unsigned int context, X509 *x,
41                                              size_t chainidx);
42 #ifndef OPENSSL_NO_SRP
43 static int init_srp(SSL *s, unsigned int context);
44 #endif
45 static int init_etm(SSL *s, unsigned int context);
46 static int init_ems(SSL *s, unsigned int context);
47 static int final_ems(SSL *s, unsigned int context, int sent);
48 static int init_psk_kex_modes(SSL *s, unsigned int context);
49 #ifndef OPENSSL_NO_EC
50 static int final_key_share(SSL *s, unsigned int context, int sent);
51 #endif
52 #ifndef OPENSSL_NO_SRTP
53 static int init_srtp(SSL *s, unsigned int context);
54 #endif
55 static int final_sig_algs(SSL *s, unsigned int context, int sent);
56 static int final_early_data(SSL *s, unsigned int context, int sent);
57 static int final_maxfragmentlen(SSL *s, unsigned int context, int sent);
58 static int init_post_handshake_auth(SSL *s, unsigned int context);
59 
60 /* Structure to define a built-in extension */
61 typedef struct extensions_definition_st {
62     /* The defined type for the extension */
63     unsigned int type;
64     /*
65      * The context that this extension applies to, e.g. what messages and
66      * protocol versions
67      */
68     unsigned int context;
69     /*
70      * Initialise extension before parsing. Always called for relevant contexts
71      * even if extension not present
72      */
73     int (*init)(SSL *s, unsigned int context);
74     /* Parse extension sent from client to server */
75     int (*parse_ctos)(SSL *s, PACKET *pkt, unsigned int context, X509 *x,
76                       size_t chainidx);
77     /* Parse extension send from server to client */
78     int (*parse_stoc)(SSL *s, PACKET *pkt, unsigned int context, X509 *x,
79                       size_t chainidx);
80     /* Construct extension sent from server to client */
81     EXT_RETURN (*construct_stoc)(SSL *s, WPACKET *pkt, unsigned int context,
82                                  X509 *x, size_t chainidx);
83     /* Construct extension sent from client to server */
84     EXT_RETURN (*construct_ctos)(SSL *s, WPACKET *pkt, unsigned int context,
85                                  X509 *x, size_t chainidx);
86     /*
87      * Finalise extension after parsing. Always called where an extensions was
88      * initialised even if the extension was not present. |sent| is set to 1 if
89      * the extension was seen, or 0 otherwise.
90      */
91     int (*final)(SSL *s, unsigned int context, int sent);
92 } EXTENSION_DEFINITION;
93 
94 /*
95  * Definitions of all built-in extensions. NOTE: Changes in the number or order
96  * of these extensions should be mirrored with equivalent changes to the
97  * indexes ( TLSEXT_IDX_* ) defined in ssl_locl.h.
98  * Each extension has an initialiser, a client and
99  * server side parser and a finaliser. The initialiser is called (if the
100  * extension is relevant to the given context) even if we did not see the
101  * extension in the message that we received. The parser functions are only
102  * called if we see the extension in the message. The finalisers are always
103  * called if the initialiser was called.
104  * There are also server and client side constructor functions which are always
105  * called during message construction if the extension is relevant for the
106  * given context.
107  * The initialisation, parsing, finalisation and construction functions are
108  * always called in the order defined in this list. Some extensions may depend
109  * on others having been processed first, so the order of this list is
110  * significant.
111  * The extension context is defined by a series of flags which specify which
112  * messages the extension is relevant to. These flags also specify whether the
113  * extension is relevant to a particular protocol or protocol version.
114  *
115  * TODO(TLS1.3): Make sure we have a test to check the consistency of these
116  *
117  * NOTE: WebSphere Application Server 7+ cannot handle empty extensions at
118  * the end, keep these extensions before signature_algorithm.
119  */
120 #define INVALID_EXTENSION { 0x10000, 0, NULL, NULL, NULL, NULL, NULL, NULL }
121 static const EXTENSION_DEFINITION ext_defs[] = {
122     {
123         TLSEXT_TYPE_renegotiate,
124         SSL_EXT_CLIENT_HELLO | SSL_EXT_TLS1_2_SERVER_HELLO
125         | SSL_EXT_SSL3_ALLOWED | SSL_EXT_TLS1_2_AND_BELOW_ONLY,
126         NULL, tls_parse_ctos_renegotiate, tls_parse_stoc_renegotiate,
127         tls_construct_stoc_renegotiate, tls_construct_ctos_renegotiate,
128         final_renegotiate
129     },
130     {
131         TLSEXT_TYPE_server_name,
132         SSL_EXT_CLIENT_HELLO | SSL_EXT_TLS1_2_SERVER_HELLO
133         | SSL_EXT_TLS1_3_ENCRYPTED_EXTENSIONS,
134         init_server_name,
135         tls_parse_ctos_server_name, tls_parse_stoc_server_name,
136         tls_construct_stoc_server_name, tls_construct_ctos_server_name,
137         final_server_name
138     },
139     {
140         TLSEXT_TYPE_max_fragment_length,
141         SSL_EXT_CLIENT_HELLO | SSL_EXT_TLS1_2_SERVER_HELLO
142         | SSL_EXT_TLS1_3_ENCRYPTED_EXTENSIONS,
143         NULL, tls_parse_ctos_maxfragmentlen, tls_parse_stoc_maxfragmentlen,
144         tls_construct_stoc_maxfragmentlen, tls_construct_ctos_maxfragmentlen,
145         final_maxfragmentlen
146     },
147 #ifndef OPENSSL_NO_SRP
148     {
149         TLSEXT_TYPE_srp,
150         SSL_EXT_CLIENT_HELLO | SSL_EXT_TLS1_2_AND_BELOW_ONLY,
151         init_srp, tls_parse_ctos_srp, NULL, NULL, tls_construct_ctos_srp, NULL
152     },
153 #else
154     INVALID_EXTENSION,
155 #endif
156 #ifndef OPENSSL_NO_EC
157     {
158         TLSEXT_TYPE_ec_point_formats,
159         SSL_EXT_CLIENT_HELLO | SSL_EXT_TLS1_2_SERVER_HELLO
160         | SSL_EXT_TLS1_2_AND_BELOW_ONLY,
161         NULL, tls_parse_ctos_ec_pt_formats, tls_parse_stoc_ec_pt_formats,
162         tls_construct_stoc_ec_pt_formats, tls_construct_ctos_ec_pt_formats,
163         final_ec_pt_formats
164     },
165     {
166         /*
167          * "supported_groups" is spread across several specifications.
168          * It was originally specified as "elliptic_curves" in RFC 4492,
169          * and broadened to include named FFDH groups by RFC 7919.
170          * Both RFCs 4492 and 7919 do not include a provision for the server
171          * to indicate to the client the complete list of groups supported
172          * by the server, with the server instead just indicating the
173          * selected group for this connection in the ServerKeyExchange
174          * message.  TLS 1.3 adds a scheme for the server to indicate
175          * to the client its list of supported groups in the
176          * EncryptedExtensions message, but none of the relevant
177          * specifications permit sending supported_groups in the ServerHello.
178          * Nonetheless (possibly due to the close proximity to the
179          * "ec_point_formats" extension, which is allowed in the ServerHello),
180          * there are several servers that send this extension in the
181          * ServerHello anyway.  Up to and including the 1.1.0 release,
182          * we did not check for the presence of nonpermitted extensions,
183          * so to avoid a regression, we must permit this extension in the
184          * TLS 1.2 ServerHello as well.
185          *
186          * Note that there is no tls_parse_stoc_supported_groups function,
187          * so we do not perform any additional parsing, validation, or
188          * processing on the server's group list -- this is just a minimal
189          * change to preserve compatibility with these misbehaving servers.
190          */
191         TLSEXT_TYPE_supported_groups,
192         SSL_EXT_CLIENT_HELLO | SSL_EXT_TLS1_3_ENCRYPTED_EXTENSIONS
193         | SSL_EXT_TLS1_2_SERVER_HELLO,
194         NULL, tls_parse_ctos_supported_groups, NULL,
195         tls_construct_stoc_supported_groups,
196         tls_construct_ctos_supported_groups, NULL
197     },
198 #else
199     INVALID_EXTENSION,
200     INVALID_EXTENSION,
201 #endif
202     {
203         TLSEXT_TYPE_session_ticket,
204         SSL_EXT_CLIENT_HELLO | SSL_EXT_TLS1_2_SERVER_HELLO
205         | SSL_EXT_TLS1_2_AND_BELOW_ONLY,
206         init_session_ticket, tls_parse_ctos_session_ticket,
207         tls_parse_stoc_session_ticket, tls_construct_stoc_session_ticket,
208         tls_construct_ctos_session_ticket, NULL
209     },
210 #ifndef OPENSSL_NO_OCSP
211     {
212         TLSEXT_TYPE_status_request,
213         SSL_EXT_CLIENT_HELLO | SSL_EXT_TLS1_2_SERVER_HELLO
214         | SSL_EXT_TLS1_3_CERTIFICATE | SSL_EXT_TLS1_3_CERTIFICATE_REQUEST,
215         init_status_request, tls_parse_ctos_status_request,
216         tls_parse_stoc_status_request, tls_construct_stoc_status_request,
217         tls_construct_ctos_status_request, NULL
218     },
219 #else
220     INVALID_EXTENSION,
221 #endif
222 #ifndef OPENSSL_NO_NEXTPROTONEG
223     {
224         TLSEXT_TYPE_next_proto_neg,
225         SSL_EXT_CLIENT_HELLO | SSL_EXT_TLS1_2_SERVER_HELLO
226         | SSL_EXT_TLS1_2_AND_BELOW_ONLY,
227         init_npn, tls_parse_ctos_npn, tls_parse_stoc_npn,
228         tls_construct_stoc_next_proto_neg, tls_construct_ctos_npn, NULL
229     },
230 #else
231     INVALID_EXTENSION,
232 #endif
233     {
234         /*
235          * Must appear in this list after server_name so that finalisation
236          * happens after server_name callbacks
237          */
238         TLSEXT_TYPE_application_layer_protocol_negotiation,
239         SSL_EXT_CLIENT_HELLO | SSL_EXT_TLS1_2_SERVER_HELLO
240         | SSL_EXT_TLS1_3_ENCRYPTED_EXTENSIONS,
241         init_alpn, tls_parse_ctos_alpn, tls_parse_stoc_alpn,
242         tls_construct_stoc_alpn, tls_construct_ctos_alpn, final_alpn
243     },
244 #ifndef OPENSSL_NO_SRTP
245     {
246         TLSEXT_TYPE_use_srtp,
247         SSL_EXT_CLIENT_HELLO | SSL_EXT_TLS1_2_SERVER_HELLO
248         | SSL_EXT_TLS1_3_ENCRYPTED_EXTENSIONS | SSL_EXT_DTLS_ONLY,
249         init_srtp, tls_parse_ctos_use_srtp, tls_parse_stoc_use_srtp,
250         tls_construct_stoc_use_srtp, tls_construct_ctos_use_srtp, NULL
251     },
252 #else
253     INVALID_EXTENSION,
254 #endif
255     {
256         TLSEXT_TYPE_encrypt_then_mac,
257         SSL_EXT_CLIENT_HELLO | SSL_EXT_TLS1_2_SERVER_HELLO
258         | SSL_EXT_TLS1_2_AND_BELOW_ONLY,
259         init_etm, tls_parse_ctos_etm, tls_parse_stoc_etm,
260         tls_construct_stoc_etm, tls_construct_ctos_etm, NULL
261     },
262 #ifndef OPENSSL_NO_CT
263     {
264         TLSEXT_TYPE_signed_certificate_timestamp,
265         SSL_EXT_CLIENT_HELLO | SSL_EXT_TLS1_2_SERVER_HELLO
266         | SSL_EXT_TLS1_3_CERTIFICATE | SSL_EXT_TLS1_3_CERTIFICATE_REQUEST,
267         NULL,
268         /*
269          * No server side support for this, but can be provided by a custom
270          * extension. This is an exception to the rule that custom extensions
271          * cannot override built in ones.
272          */
273         NULL, tls_parse_stoc_sct, NULL, tls_construct_ctos_sct,  NULL
274     },
275 #else
276     INVALID_EXTENSION,
277 #endif
278     {
279         TLSEXT_TYPE_extended_master_secret,
280         SSL_EXT_CLIENT_HELLO | SSL_EXT_TLS1_2_SERVER_HELLO
281         | SSL_EXT_TLS1_2_AND_BELOW_ONLY,
282         init_ems, tls_parse_ctos_ems, tls_parse_stoc_ems,
283         tls_construct_stoc_ems, tls_construct_ctos_ems, final_ems
284     },
285     {
286         TLSEXT_TYPE_signature_algorithms_cert,
287         SSL_EXT_CLIENT_HELLO | SSL_EXT_TLS1_3_CERTIFICATE_REQUEST,
288         init_sig_algs_cert, tls_parse_ctos_sig_algs_cert,
289         tls_parse_ctos_sig_algs_cert,
290         /* We do not generate signature_algorithms_cert at present. */
291         NULL, NULL, NULL
292     },
293     {
294         TLSEXT_TYPE_post_handshake_auth,
295         SSL_EXT_CLIENT_HELLO | SSL_EXT_TLS1_3_ONLY,
296         init_post_handshake_auth,
297         tls_parse_ctos_post_handshake_auth, NULL,
298         NULL, tls_construct_ctos_post_handshake_auth,
299         NULL,
300     },
301     {
302         TLSEXT_TYPE_signature_algorithms,
303         SSL_EXT_CLIENT_HELLO | SSL_EXT_TLS1_3_CERTIFICATE_REQUEST,
304         init_sig_algs, tls_parse_ctos_sig_algs,
305         tls_parse_ctos_sig_algs, tls_construct_ctos_sig_algs,
306         tls_construct_ctos_sig_algs, final_sig_algs
307     },
308     {
309         TLSEXT_TYPE_supported_versions,
310         SSL_EXT_CLIENT_HELLO | SSL_EXT_TLS1_3_SERVER_HELLO
311         | SSL_EXT_TLS1_3_HELLO_RETRY_REQUEST | SSL_EXT_TLS_IMPLEMENTATION_ONLY,
312         NULL,
313         /* Processed inline as part of version selection */
314         NULL, tls_parse_stoc_supported_versions,
315         tls_construct_stoc_supported_versions,
316         tls_construct_ctos_supported_versions, NULL
317     },
318     {
319         TLSEXT_TYPE_psk_kex_modes,
320         SSL_EXT_CLIENT_HELLO | SSL_EXT_TLS_IMPLEMENTATION_ONLY
321         | SSL_EXT_TLS1_3_ONLY,
322         init_psk_kex_modes, tls_parse_ctos_psk_kex_modes, NULL, NULL,
323         tls_construct_ctos_psk_kex_modes, NULL
324     },
325 #ifndef OPENSSL_NO_EC
326     {
327         /*
328          * Must be in this list after supported_groups. We need that to have
329          * been parsed before we do this one.
330          */
331         TLSEXT_TYPE_key_share,
332         SSL_EXT_CLIENT_HELLO | SSL_EXT_TLS1_3_SERVER_HELLO
333         | SSL_EXT_TLS1_3_HELLO_RETRY_REQUEST | SSL_EXT_TLS_IMPLEMENTATION_ONLY
334         | SSL_EXT_TLS1_3_ONLY,
335         NULL, tls_parse_ctos_key_share, tls_parse_stoc_key_share,
336         tls_construct_stoc_key_share, tls_construct_ctos_key_share,
337         final_key_share
338     },
339 #endif
340     {
341         /* Must be after key_share */
342         TLSEXT_TYPE_cookie,
343         SSL_EXT_CLIENT_HELLO | SSL_EXT_TLS1_3_HELLO_RETRY_REQUEST
344         | SSL_EXT_TLS_IMPLEMENTATION_ONLY | SSL_EXT_TLS1_3_ONLY,
345         NULL, tls_parse_ctos_cookie, tls_parse_stoc_cookie,
346         tls_construct_stoc_cookie, tls_construct_ctos_cookie, NULL
347     },
348     {
349         /*
350          * Special unsolicited ServerHello extension only used when
351          * SSL_OP_CRYPTOPRO_TLSEXT_BUG is set. We allow it in a ClientHello but
352          * ignore it.
353          */
354         TLSEXT_TYPE_cryptopro_bug,
355         SSL_EXT_CLIENT_HELLO | SSL_EXT_TLS1_2_SERVER_HELLO
356         | SSL_EXT_TLS1_2_AND_BELOW_ONLY,
357         NULL, NULL, NULL, tls_construct_stoc_cryptopro_bug, NULL, NULL
358     },
359     {
360         TLSEXT_TYPE_early_data,
361         SSL_EXT_CLIENT_HELLO | SSL_EXT_TLS1_3_ENCRYPTED_EXTENSIONS
362         | SSL_EXT_TLS1_3_NEW_SESSION_TICKET | SSL_EXT_TLS1_3_ONLY,
363         NULL, tls_parse_ctos_early_data, tls_parse_stoc_early_data,
364         tls_construct_stoc_early_data, tls_construct_ctos_early_data,
365         final_early_data
366     },
367     {
368         TLSEXT_TYPE_certificate_authorities,
369         SSL_EXT_CLIENT_HELLO | SSL_EXT_TLS1_3_CERTIFICATE_REQUEST
370         | SSL_EXT_TLS1_3_ONLY,
371         init_certificate_authorities,
372         tls_parse_certificate_authorities, tls_parse_certificate_authorities,
373         tls_construct_certificate_authorities,
374         tls_construct_certificate_authorities, NULL,
375     },
376     {
377         /* Must be immediately before pre_shared_key */
378         TLSEXT_TYPE_padding,
379         SSL_EXT_CLIENT_HELLO,
380         NULL,
381         /* We send this, but don't read it */
382         NULL, NULL, NULL, tls_construct_ctos_padding, NULL
383     },
384     {
385         /* Required by the TLSv1.3 spec to always be the last extension */
386         TLSEXT_TYPE_psk,
387         SSL_EXT_CLIENT_HELLO | SSL_EXT_TLS1_3_SERVER_HELLO
388         | SSL_EXT_TLS_IMPLEMENTATION_ONLY | SSL_EXT_TLS1_3_ONLY,
389         NULL, tls_parse_ctos_psk, tls_parse_stoc_psk, tls_construct_stoc_psk,
390         tls_construct_ctos_psk, NULL
391     }
392 };
393 
394 /* Check whether an extension's context matches the current context */
395 static int validate_context(SSL *s, unsigned int extctx, unsigned int thisctx)
396 {
397     /* Check we're allowed to use this extension in this context */
398     if ((thisctx & extctx) == 0)
399         return 0;
400 
401     if (SSL_IS_DTLS(s)) {
402         if ((extctx & SSL_EXT_TLS_ONLY) != 0)
403             return 0;
404     } else if ((extctx & SSL_EXT_DTLS_ONLY) != 0) {
405         return 0;
406     }
407 
408     return 1;
409 }
410 
411 int tls_validate_all_contexts(SSL *s, unsigned int thisctx, RAW_EXTENSION *exts)
412 {
413     size_t i, num_exts, builtin_num = OSSL_NELEM(ext_defs), offset;
414     RAW_EXTENSION *thisext;
415     unsigned int context;
416     ENDPOINT role = ENDPOINT_BOTH;
417 
418     if ((thisctx & SSL_EXT_CLIENT_HELLO) != 0)
419         role = ENDPOINT_SERVER;
420     else if ((thisctx & SSL_EXT_TLS1_2_SERVER_HELLO) != 0)
421         role = ENDPOINT_CLIENT;
422 
423     /* Calculate the number of extensions in the extensions list */
424     num_exts = builtin_num + s->cert->custext.meths_count;
425 
426     for (thisext = exts, i = 0; i < num_exts; i++, thisext++) {
427         if (!thisext->present)
428             continue;
429 
430         if (i < builtin_num) {
431             context = ext_defs[i].context;
432         } else {
433             custom_ext_method *meth = NULL;
434 
435             meth = custom_ext_find(&s->cert->custext, role, thisext->type,
436                                    &offset);
437             if (!ossl_assert(meth != NULL))
438                 return 0;
439             context = meth->context;
440         }
441 
442         if (!validate_context(s, context, thisctx))
443             return 0;
444     }
445 
446     return 1;
447 }
448 
449 /*
450  * Verify whether we are allowed to use the extension |type| in the current
451  * |context|. Returns 1 to indicate the extension is allowed or unknown or 0 to
452  * indicate the extension is not allowed. If returning 1 then |*found| is set to
453  * the definition for the extension we found.
454  */
455 static int verify_extension(SSL *s, unsigned int context, unsigned int type,
456                             custom_ext_methods *meths, RAW_EXTENSION *rawexlist,
457                             RAW_EXTENSION **found)
458 {
459     size_t i;
460     size_t builtin_num = OSSL_NELEM(ext_defs);
461     const EXTENSION_DEFINITION *thisext;
462 
463     for (i = 0, thisext = ext_defs; i < builtin_num; i++, thisext++) {
464         if (type == thisext->type) {
465             if (!validate_context(s, thisext->context, context))
466                 return 0;
467 
468             *found = &rawexlist[i];
469             return 1;
470         }
471     }
472 
473     /* Check the custom extensions */
474     if (meths != NULL) {
475         size_t offset = 0;
476         ENDPOINT role = ENDPOINT_BOTH;
477         custom_ext_method *meth = NULL;
478 
479         if ((context & SSL_EXT_CLIENT_HELLO) != 0)
480             role = ENDPOINT_SERVER;
481         else if ((context & SSL_EXT_TLS1_2_SERVER_HELLO) != 0)
482             role = ENDPOINT_CLIENT;
483 
484         meth = custom_ext_find(meths, role, type, &offset);
485         if (meth != NULL) {
486             if (!validate_context(s, meth->context, context))
487                 return 0;
488             *found = &rawexlist[offset + builtin_num];
489             return 1;
490         }
491     }
492 
493     /* Unknown extension. We allow it */
494     *found = NULL;
495     return 1;
496 }
497 
498 /*
499  * Check whether the context defined for an extension |extctx| means whether
500  * the extension is relevant for the current context |thisctx| or not. Returns
501  * 1 if the extension is relevant for this context, and 0 otherwise
502  */
503 int extension_is_relevant(SSL *s, unsigned int extctx, unsigned int thisctx)
504 {
505     int is_tls13;
506 
507     /*
508      * For HRR we haven't selected the version yet but we know it will be
509      * TLSv1.3
510      */
511     if ((thisctx & SSL_EXT_TLS1_3_HELLO_RETRY_REQUEST) != 0)
512         is_tls13 = 1;
513     else
514         is_tls13 = SSL_IS_TLS13(s);
515 
516     if ((SSL_IS_DTLS(s)
517                 && (extctx & SSL_EXT_TLS_IMPLEMENTATION_ONLY) != 0)
518             || (s->version == SSL3_VERSION
519                     && (extctx & SSL_EXT_SSL3_ALLOWED) == 0)
520             /*
521              * Note that SSL_IS_TLS13() means "TLS 1.3 has been negotiated",
522              * which is never true when generating the ClientHello.
523              * However, version negotiation *has* occurred by the time the
524              * ClientHello extensions are being parsed.
525              * Be careful to allow TLS 1.3-only extensions when generating
526              * the ClientHello.
527              */
528             || (is_tls13 && (extctx & SSL_EXT_TLS1_2_AND_BELOW_ONLY) != 0)
529             || (!is_tls13 && (extctx & SSL_EXT_TLS1_3_ONLY) != 0
530                 && (thisctx & SSL_EXT_CLIENT_HELLO) == 0)
531             || (s->server && !is_tls13 && (extctx & SSL_EXT_TLS1_3_ONLY) != 0)
532             || (s->hit && (extctx & SSL_EXT_IGNORE_ON_RESUMPTION) != 0))
533         return 0;
534     return 1;
535 }
536 
537 /*
538  * Gather a list of all the extensions from the data in |packet]. |context|
539  * tells us which message this extension is for. The raw extension data is
540  * stored in |*res| on success. We don't actually process the content of the
541  * extensions yet, except to check their types. This function also runs the
542  * initialiser functions for all known extensions if |init| is nonzero (whether
543  * we have collected them or not). If successful the caller is responsible for
544  * freeing the contents of |*res|.
545  *
546  * Per http://tools.ietf.org/html/rfc5246#section-7.4.1.4, there may not be
547  * more than one extension of the same type in a ClientHello or ServerHello.
548  * This function returns 1 if all extensions are unique and we have parsed their
549  * types, and 0 if the extensions contain duplicates, could not be successfully
550  * found, or an internal error occurred. We only check duplicates for
551  * extensions that we know about. We ignore others.
552  */
553 int tls_collect_extensions(SSL *s, PACKET *packet, unsigned int context,
554                            RAW_EXTENSION **res, size_t *len, int init)
555 {
556     PACKET extensions = *packet;
557     size_t i = 0;
558     size_t num_exts;
559     custom_ext_methods *exts = &s->cert->custext;
560     RAW_EXTENSION *raw_extensions = NULL;
561     const EXTENSION_DEFINITION *thisexd;
562 
563     *res = NULL;
564 
565     /*
566      * Initialise server side custom extensions. Client side is done during
567      * construction of extensions for the ClientHello.
568      */
569     if ((context & SSL_EXT_CLIENT_HELLO) != 0)
570         custom_ext_init(&s->cert->custext);
571 
572     num_exts = OSSL_NELEM(ext_defs) + (exts != NULL ? exts->meths_count : 0);
573     raw_extensions = OPENSSL_zalloc(num_exts * sizeof(*raw_extensions));
574     if (raw_extensions == NULL) {
575         SSLfatal(s, SSL_AD_INTERNAL_ERROR, SSL_F_TLS_COLLECT_EXTENSIONS,
576                  ERR_R_MALLOC_FAILURE);
577         return 0;
578     }
579 
580     i = 0;
581     while (PACKET_remaining(&extensions) > 0) {
582         unsigned int type, idx;
583         PACKET extension;
584         RAW_EXTENSION *thisex;
585 
586         if (!PACKET_get_net_2(&extensions, &type) ||
587             !PACKET_get_length_prefixed_2(&extensions, &extension)) {
588             SSLfatal(s, SSL_AD_DECODE_ERROR, SSL_F_TLS_COLLECT_EXTENSIONS,
589                      SSL_R_BAD_EXTENSION);
590             goto err;
591         }
592         /*
593          * Verify this extension is allowed. We only check duplicates for
594          * extensions that we recognise. We also have a special case for the
595          * PSK extension, which must be the last one in the ClientHello.
596          */
597         if (!verify_extension(s, context, type, exts, raw_extensions, &thisex)
598                 || (thisex != NULL && thisex->present == 1)
599                 || (type == TLSEXT_TYPE_psk
600                     && (context & SSL_EXT_CLIENT_HELLO) != 0
601                     && PACKET_remaining(&extensions) != 0)) {
602             SSLfatal(s, SSL_AD_ILLEGAL_PARAMETER, SSL_F_TLS_COLLECT_EXTENSIONS,
603                      SSL_R_BAD_EXTENSION);
604             goto err;
605         }
606         idx = thisex - raw_extensions;
607         /*-
608          * Check that we requested this extension (if appropriate). Requests can
609          * be sent in the ClientHello and CertificateRequest. Unsolicited
610          * extensions can be sent in the NewSessionTicket. We only do this for
611          * the built-in extensions. Custom extensions have a different but
612          * similar check elsewhere.
613          * Special cases:
614          * - The HRR cookie extension is unsolicited
615          * - The renegotiate extension is unsolicited (the client signals
616          *   support via an SCSV)
617          * - The signed_certificate_timestamp extension can be provided by a
618          * custom extension or by the built-in version. We let the extension
619          * itself handle unsolicited response checks.
620          */
621         if (idx < OSSL_NELEM(ext_defs)
622                 && (context & (SSL_EXT_CLIENT_HELLO
623                                | SSL_EXT_TLS1_3_CERTIFICATE_REQUEST
624                                | SSL_EXT_TLS1_3_NEW_SESSION_TICKET)) == 0
625                 && type != TLSEXT_TYPE_cookie
626                 && type != TLSEXT_TYPE_renegotiate
627                 && type != TLSEXT_TYPE_signed_certificate_timestamp
628                 && (s->ext.extflags[idx] & SSL_EXT_FLAG_SENT) == 0
629 #ifndef OPENSSL_NO_GOST
630                 && !((context & SSL_EXT_TLS1_2_SERVER_HELLO) != 0
631                      && type == TLSEXT_TYPE_cryptopro_bug)
632 #endif
633 								) {
634             SSLfatal(s, SSL_AD_UNSUPPORTED_EXTENSION,
635                      SSL_F_TLS_COLLECT_EXTENSIONS, SSL_R_UNSOLICITED_EXTENSION);
636             goto err;
637         }
638         if (thisex != NULL) {
639             thisex->data = extension;
640             thisex->present = 1;
641             thisex->type = type;
642             thisex->received_order = i++;
643             if (s->ext.debug_cb)
644                 s->ext.debug_cb(s, !s->server, thisex->type,
645                                 PACKET_data(&thisex->data),
646                                 PACKET_remaining(&thisex->data),
647                                 s->ext.debug_arg);
648         }
649     }
650 
651     if (init) {
652         /*
653          * Initialise all known extensions relevant to this context,
654          * whether we have found them or not
655          */
656         for (thisexd = ext_defs, i = 0; i < OSSL_NELEM(ext_defs);
657              i++, thisexd++) {
658             if (thisexd->init != NULL && (thisexd->context & context) != 0
659                 && extension_is_relevant(s, thisexd->context, context)
660                 && !thisexd->init(s, context)) {
661                 /* SSLfatal() already called */
662                 goto err;
663             }
664         }
665     }
666 
667     *res = raw_extensions;
668     if (len != NULL)
669         *len = num_exts;
670     return 1;
671 
672  err:
673     OPENSSL_free(raw_extensions);
674     return 0;
675 }
676 
677 /*
678  * Runs the parser for a given extension with index |idx|. |exts| contains the
679  * list of all parsed extensions previously collected by
680  * tls_collect_extensions(). The parser is only run if it is applicable for the
681  * given |context| and the parser has not already been run. If this is for a
682  * Certificate message, then we also provide the parser with the relevant
683  * Certificate |x| and its position in the |chainidx| with 0 being the first
684  * Certificate. Returns 1 on success or 0 on failure. If an extension is not
685  * present this counted as success.
686  */
687 int tls_parse_extension(SSL *s, TLSEXT_INDEX idx, int context,
688                         RAW_EXTENSION *exts, X509 *x, size_t chainidx)
689 {
690     RAW_EXTENSION *currext = &exts[idx];
691     int (*parser)(SSL *s, PACKET *pkt, unsigned int context, X509 *x,
692                   size_t chainidx) = NULL;
693 
694     /* Skip if the extension is not present */
695     if (!currext->present)
696         return 1;
697 
698     /* Skip if we've already parsed this extension */
699     if (currext->parsed)
700         return 1;
701 
702     currext->parsed = 1;
703 
704     if (idx < OSSL_NELEM(ext_defs)) {
705         /* We are handling a built-in extension */
706         const EXTENSION_DEFINITION *extdef = &ext_defs[idx];
707 
708         /* Check if extension is defined for our protocol. If not, skip */
709         if (!extension_is_relevant(s, extdef->context, context))
710             return 1;
711 
712         parser = s->server ? extdef->parse_ctos : extdef->parse_stoc;
713 
714         if (parser != NULL)
715             return parser(s, &currext->data, context, x, chainidx);
716 
717         /*
718          * If the parser is NULL we fall through to the custom extension
719          * processing
720          */
721     }
722 
723     /* Parse custom extensions */
724     return custom_ext_parse(s, context, currext->type,
725                             PACKET_data(&currext->data),
726                             PACKET_remaining(&currext->data),
727                             x, chainidx);
728 }
729 
730 /*
731  * Parse all remaining extensions that have not yet been parsed. Also calls the
732  * finalisation for all extensions at the end if |fin| is nonzero, whether we
733  * collected them or not. Returns 1 for success or 0 for failure. If we are
734  * working on a Certificate message then we also pass the Certificate |x| and
735  * its position in the |chainidx|, with 0 being the first certificate.
736  */
737 int tls_parse_all_extensions(SSL *s, int context, RAW_EXTENSION *exts, X509 *x,
738                              size_t chainidx, int fin)
739 {
740     size_t i, numexts = OSSL_NELEM(ext_defs);
741     const EXTENSION_DEFINITION *thisexd;
742 
743     /* Calculate the number of extensions in the extensions list */
744     numexts += s->cert->custext.meths_count;
745 
746     /* Parse each extension in turn */
747     for (i = 0; i < numexts; i++) {
748         if (!tls_parse_extension(s, i, context, exts, x, chainidx)) {
749             /* SSLfatal() already called */
750             return 0;
751         }
752     }
753 
754     if (fin) {
755         /*
756          * Finalise all known extensions relevant to this context,
757          * whether we have found them or not
758          */
759         for (i = 0, thisexd = ext_defs; i < OSSL_NELEM(ext_defs);
760              i++, thisexd++) {
761             if (thisexd->final != NULL && (thisexd->context & context) != 0
762                 && !thisexd->final(s, context, exts[i].present)) {
763                 /* SSLfatal() already called */
764                 return 0;
765             }
766         }
767     }
768 
769     return 1;
770 }
771 
772 int should_add_extension(SSL *s, unsigned int extctx, unsigned int thisctx,
773                          int max_version)
774 {
775     /* Skip if not relevant for our context */
776     if ((extctx & thisctx) == 0)
777         return 0;
778 
779     /* Check if this extension is defined for our protocol. If not, skip */
780     if (!extension_is_relevant(s, extctx, thisctx)
781             || ((extctx & SSL_EXT_TLS1_3_ONLY) != 0
782                 && (thisctx & SSL_EXT_CLIENT_HELLO) != 0
783                 && (SSL_IS_DTLS(s) || max_version < TLS1_3_VERSION)))
784         return 0;
785 
786     return 1;
787 }
788 
789 /*
790  * Construct all the extensions relevant to the current |context| and write
791  * them to |pkt|. If this is an extension for a Certificate in a Certificate
792  * message, then |x| will be set to the Certificate we are handling, and
793  * |chainidx| will indicate the position in the chainidx we are processing (with
794  * 0 being the first in the chain). Returns 1 on success or 0 on failure. On a
795  * failure construction stops at the first extension to fail to construct.
796  */
797 int tls_construct_extensions(SSL *s, WPACKET *pkt, unsigned int context,
798                              X509 *x, size_t chainidx)
799 {
800     size_t i;
801     int min_version, max_version = 0, reason;
802     const EXTENSION_DEFINITION *thisexd;
803 
804     if (!WPACKET_start_sub_packet_u16(pkt)
805                /*
806                 * If extensions are of zero length then we don't even add the
807                 * extensions length bytes to a ClientHello/ServerHello
808                 * (for non-TLSv1.3).
809                 */
810             || ((context &
811                  (SSL_EXT_CLIENT_HELLO | SSL_EXT_TLS1_2_SERVER_HELLO)) != 0
812                 && !WPACKET_set_flags(pkt,
813                                      WPACKET_FLAGS_ABANDON_ON_ZERO_LENGTH))) {
814         SSLfatal(s, SSL_AD_INTERNAL_ERROR, SSL_F_TLS_CONSTRUCT_EXTENSIONS,
815                  ERR_R_INTERNAL_ERROR);
816         return 0;
817     }
818 
819     if ((context & SSL_EXT_CLIENT_HELLO) != 0) {
820         reason = ssl_get_min_max_version(s, &min_version, &max_version, NULL);
821         if (reason != 0) {
822             SSLfatal(s, SSL_AD_INTERNAL_ERROR, SSL_F_TLS_CONSTRUCT_EXTENSIONS,
823                      reason);
824             return 0;
825         }
826     }
827 
828     /* Add custom extensions first */
829     if ((context & SSL_EXT_CLIENT_HELLO) != 0) {
830         /* On the server side with initialise during ClientHello parsing */
831         custom_ext_init(&s->cert->custext);
832     }
833     if (!custom_ext_add(s, context, pkt, x, chainidx, max_version)) {
834         /* SSLfatal() already called */
835         return 0;
836     }
837 
838     for (i = 0, thisexd = ext_defs; i < OSSL_NELEM(ext_defs); i++, thisexd++) {
839         EXT_RETURN (*construct)(SSL *s, WPACKET *pkt, unsigned int context,
840                                 X509 *x, size_t chainidx);
841         EXT_RETURN ret;
842 
843         /* Skip if not relevant for our context */
844         if (!should_add_extension(s, thisexd->context, context, max_version))
845             continue;
846 
847         construct = s->server ? thisexd->construct_stoc
848                               : thisexd->construct_ctos;
849 
850         if (construct == NULL)
851             continue;
852 
853         ret = construct(s, pkt, context, x, chainidx);
854         if (ret == EXT_RETURN_FAIL) {
855             /* SSLfatal() already called */
856             return 0;
857         }
858         if (ret == EXT_RETURN_SENT
859                 && (context & (SSL_EXT_CLIENT_HELLO
860                                | SSL_EXT_TLS1_3_CERTIFICATE_REQUEST
861                                | SSL_EXT_TLS1_3_NEW_SESSION_TICKET)) != 0)
862             s->ext.extflags[i] |= SSL_EXT_FLAG_SENT;
863     }
864 
865     if (!WPACKET_close(pkt)) {
866         SSLfatal(s, SSL_AD_INTERNAL_ERROR, SSL_F_TLS_CONSTRUCT_EXTENSIONS,
867                  ERR_R_INTERNAL_ERROR);
868         return 0;
869     }
870 
871     return 1;
872 }
873 
874 /*
875  * Built in extension finalisation and initialisation functions. All initialise
876  * or finalise the associated extension type for the given |context|. For
877  * finalisers |sent| is set to 1 if we saw the extension during parsing, and 0
878  * otherwise. These functions return 1 on success or 0 on failure.
879  */
880 
881 static int final_renegotiate(SSL *s, unsigned int context, int sent)
882 {
883     if (!s->server) {
884         /*
885          * Check if we can connect to a server that doesn't support safe
886          * renegotiation
887          */
888         if (!(s->options & SSL_OP_LEGACY_SERVER_CONNECT)
889                 && !(s->options & SSL_OP_ALLOW_UNSAFE_LEGACY_RENEGOTIATION)
890                 && !sent) {
891             SSLfatal(s, SSL_AD_HANDSHAKE_FAILURE, SSL_F_FINAL_RENEGOTIATE,
892                      SSL_R_UNSAFE_LEGACY_RENEGOTIATION_DISABLED);
893             return 0;
894         }
895 
896         return 1;
897     }
898 
899     /* Need RI if renegotiating */
900     if (s->renegotiate
901             && !(s->options & SSL_OP_ALLOW_UNSAFE_LEGACY_RENEGOTIATION)
902             && !sent) {
903         SSLfatal(s, SSL_AD_HANDSHAKE_FAILURE, SSL_F_FINAL_RENEGOTIATE,
904                  SSL_R_UNSAFE_LEGACY_RENEGOTIATION_DISABLED);
905         return 0;
906     }
907 
908 
909     return 1;
910 }
911 
912 static int init_server_name(SSL *s, unsigned int context)
913 {
914     if (s->server) {
915         s->servername_done = 0;
916 
917         OPENSSL_free(s->ext.hostname);
918         s->ext.hostname = NULL;
919     }
920 
921     return 1;
922 }
923 
924 static int final_server_name(SSL *s, unsigned int context, int sent)
925 {
926     int ret = SSL_TLSEXT_ERR_NOACK;
927     int altmp = SSL_AD_UNRECOGNIZED_NAME;
928     int was_ticket = (SSL_get_options(s) & SSL_OP_NO_TICKET) == 0;
929 
930     if (!ossl_assert(s->ctx != NULL) || !ossl_assert(s->session_ctx != NULL)) {
931         SSLfatal(s, SSL_AD_INTERNAL_ERROR, SSL_F_FINAL_SERVER_NAME,
932                  ERR_R_INTERNAL_ERROR);
933         return 0;
934     }
935 
936     if (s->ctx->ext.servername_cb != NULL)
937         ret = s->ctx->ext.servername_cb(s, &altmp,
938                                         s->ctx->ext.servername_arg);
939     else if (s->session_ctx->ext.servername_cb != NULL)
940         ret = s->session_ctx->ext.servername_cb(s, &altmp,
941                                        s->session_ctx->ext.servername_arg);
942 
943     /*
944      * For servers, propagate the SNI hostname from the temporary
945      * storage in the SSL to the persistent SSL_SESSION, now that we
946      * know we accepted it.
947      * Clients make this copy when parsing the server's response to
948      * the extension, which is when they find out that the negotiation
949      * was successful.
950      */
951     if (s->server) {
952         /* TODO(OpenSSL1.2) revisit !sent case */
953         if (sent && ret == SSL_TLSEXT_ERR_OK && (!s->hit || SSL_IS_TLS13(s))) {
954             /* Only store the hostname in the session if we accepted it. */
955             OPENSSL_free(s->session->ext.hostname);
956             s->session->ext.hostname = OPENSSL_strdup(s->ext.hostname);
957             if (s->session->ext.hostname == NULL && s->ext.hostname != NULL) {
958                 SSLfatal(s, SSL_AD_INTERNAL_ERROR, SSL_F_FINAL_SERVER_NAME,
959                          ERR_R_INTERNAL_ERROR);
960             }
961         }
962     }
963 
964     /*
965      * If we switched contexts (whether here or in the client_hello callback),
966      * move the sess_accept increment from the session_ctx to the new
967      * context, to avoid the confusing situation of having sess_accept_good
968      * exceed sess_accept (zero) for the new context.
969      */
970     if (SSL_IS_FIRST_HANDSHAKE(s) && s->ctx != s->session_ctx) {
971         tsan_counter(&s->ctx->stats.sess_accept);
972         tsan_decr(&s->session_ctx->stats.sess_accept);
973     }
974 
975     /*
976      * If we're expecting to send a ticket, and tickets were previously enabled,
977      * and now tickets are disabled, then turn off expected ticket.
978      * Also, if this is not a resumption, create a new session ID
979      */
980     if (ret == SSL_TLSEXT_ERR_OK && s->ext.ticket_expected
981             && was_ticket && (SSL_get_options(s) & SSL_OP_NO_TICKET) != 0) {
982         s->ext.ticket_expected = 0;
983         if (!s->hit) {
984             SSL_SESSION* ss = SSL_get_session(s);
985 
986             if (ss != NULL) {
987                 OPENSSL_free(ss->ext.tick);
988                 ss->ext.tick = NULL;
989                 ss->ext.ticklen = 0;
990                 ss->ext.tick_lifetime_hint = 0;
991                 ss->ext.tick_age_add = 0;
992                 ss->ext.tick_identity = 0;
993                 if (!ssl_generate_session_id(s, ss)) {
994                     SSLfatal(s, SSL_AD_INTERNAL_ERROR, SSL_F_FINAL_SERVER_NAME,
995                              ERR_R_INTERNAL_ERROR);
996                     return 0;
997                 }
998             } else {
999                 SSLfatal(s, SSL_AD_INTERNAL_ERROR, SSL_F_FINAL_SERVER_NAME,
1000                          ERR_R_INTERNAL_ERROR);
1001                 return 0;
1002             }
1003         }
1004     }
1005 
1006     switch (ret) {
1007     case SSL_TLSEXT_ERR_ALERT_FATAL:
1008         SSLfatal(s, altmp, SSL_F_FINAL_SERVER_NAME, SSL_R_CALLBACK_FAILED);
1009         return 0;
1010 
1011     case SSL_TLSEXT_ERR_ALERT_WARNING:
1012         /* TLSv1.3 doesn't have warning alerts so we suppress this */
1013         if (!SSL_IS_TLS13(s))
1014             ssl3_send_alert(s, SSL3_AL_WARNING, altmp);
1015         return 1;
1016 
1017     case SSL_TLSEXT_ERR_NOACK:
1018         s->servername_done = 0;
1019         return 1;
1020 
1021     default:
1022         return 1;
1023     }
1024 }
1025 
1026 #ifndef OPENSSL_NO_EC
1027 static int final_ec_pt_formats(SSL *s, unsigned int context, int sent)
1028 {
1029     unsigned long alg_k, alg_a;
1030 
1031     if (s->server)
1032         return 1;
1033 
1034     alg_k = s->s3->tmp.new_cipher->algorithm_mkey;
1035     alg_a = s->s3->tmp.new_cipher->algorithm_auth;
1036 
1037     /*
1038      * If we are client and using an elliptic curve cryptography cipher
1039      * suite, then if server returns an EC point formats lists extension it
1040      * must contain uncompressed.
1041      */
1042     if (s->ext.ecpointformats != NULL
1043             && s->ext.ecpointformats_len > 0
1044             && s->session->ext.ecpointformats != NULL
1045             && s->session->ext.ecpointformats_len > 0
1046             && ((alg_k & SSL_kECDHE) || (alg_a & SSL_aECDSA))) {
1047         /* we are using an ECC cipher */
1048         size_t i;
1049         unsigned char *list = s->session->ext.ecpointformats;
1050 
1051         for (i = 0; i < s->session->ext.ecpointformats_len; i++) {
1052             if (*list++ == TLSEXT_ECPOINTFORMAT_uncompressed)
1053                 break;
1054         }
1055         if (i == s->session->ext.ecpointformats_len) {
1056             SSLfatal(s, SSL_AD_ILLEGAL_PARAMETER, SSL_F_FINAL_EC_PT_FORMATS,
1057                      SSL_R_TLS_INVALID_ECPOINTFORMAT_LIST);
1058             return 0;
1059         }
1060     }
1061 
1062     return 1;
1063 }
1064 #endif
1065 
1066 static int init_session_ticket(SSL *s, unsigned int context)
1067 {
1068     if (!s->server)
1069         s->ext.ticket_expected = 0;
1070 
1071     return 1;
1072 }
1073 
1074 #ifndef OPENSSL_NO_OCSP
1075 static int init_status_request(SSL *s, unsigned int context)
1076 {
1077     if (s->server) {
1078         s->ext.status_type = TLSEXT_STATUSTYPE_nothing;
1079     } else {
1080         /*
1081          * Ensure we get sensible values passed to tlsext_status_cb in the event
1082          * that we don't receive a status message
1083          */
1084         OPENSSL_free(s->ext.ocsp.resp);
1085         s->ext.ocsp.resp = NULL;
1086         s->ext.ocsp.resp_len = 0;
1087     }
1088 
1089     return 1;
1090 }
1091 #endif
1092 
1093 #ifndef OPENSSL_NO_NEXTPROTONEG
1094 static int init_npn(SSL *s, unsigned int context)
1095 {
1096     s->s3->npn_seen = 0;
1097 
1098     return 1;
1099 }
1100 #endif
1101 
1102 static int init_alpn(SSL *s, unsigned int context)
1103 {
1104     OPENSSL_free(s->s3->alpn_selected);
1105     s->s3->alpn_selected = NULL;
1106     s->s3->alpn_selected_len = 0;
1107     if (s->server) {
1108         OPENSSL_free(s->s3->alpn_proposed);
1109         s->s3->alpn_proposed = NULL;
1110         s->s3->alpn_proposed_len = 0;
1111     }
1112     return 1;
1113 }
1114 
1115 static int final_alpn(SSL *s, unsigned int context, int sent)
1116 {
1117     if (!s->server && !sent && s->session->ext.alpn_selected != NULL)
1118             s->ext.early_data_ok = 0;
1119 
1120     if (!s->server || !SSL_IS_TLS13(s))
1121         return 1;
1122 
1123     /*
1124      * Call alpn_select callback if needed.  Has to be done after SNI and
1125      * cipher negotiation (HTTP/2 restricts permitted ciphers). In TLSv1.3
1126      * we also have to do this before we decide whether to accept early_data.
1127      * In TLSv1.3 we've already negotiated our cipher so we do this call now.
1128      * For < TLSv1.3 we defer it until after cipher negotiation.
1129      *
1130      * On failure SSLfatal() already called.
1131      */
1132     return tls_handle_alpn(s);
1133 }
1134 
1135 static int init_sig_algs(SSL *s, unsigned int context)
1136 {
1137     /* Clear any signature algorithms extension received */
1138     OPENSSL_free(s->s3->tmp.peer_sigalgs);
1139     s->s3->tmp.peer_sigalgs = NULL;
1140 
1141     return 1;
1142 }
1143 
1144 static int init_sig_algs_cert(SSL *s, unsigned int context)
1145 {
1146     /* Clear any signature algorithms extension received */
1147     OPENSSL_free(s->s3->tmp.peer_cert_sigalgs);
1148     s->s3->tmp.peer_cert_sigalgs = NULL;
1149 
1150     return 1;
1151 }
1152 
1153 #ifndef OPENSSL_NO_SRP
1154 static int init_srp(SSL *s, unsigned int context)
1155 {
1156     OPENSSL_free(s->srp_ctx.login);
1157     s->srp_ctx.login = NULL;
1158 
1159     return 1;
1160 }
1161 #endif
1162 
1163 static int init_etm(SSL *s, unsigned int context)
1164 {
1165     s->ext.use_etm = 0;
1166 
1167     return 1;
1168 }
1169 
1170 static int init_ems(SSL *s, unsigned int context)
1171 {
1172     if (!s->server)
1173         s->s3->flags &= ~TLS1_FLAGS_RECEIVED_EXTMS;
1174 
1175     return 1;
1176 }
1177 
1178 static int final_ems(SSL *s, unsigned int context, int sent)
1179 {
1180     if (!s->server && s->hit) {
1181         /*
1182          * Check extended master secret extension is consistent with
1183          * original session.
1184          */
1185         if (!(s->s3->flags & TLS1_FLAGS_RECEIVED_EXTMS) !=
1186             !(s->session->flags & SSL_SESS_FLAG_EXTMS)) {
1187             SSLfatal(s, SSL_AD_HANDSHAKE_FAILURE, SSL_F_FINAL_EMS,
1188                      SSL_R_INCONSISTENT_EXTMS);
1189             return 0;
1190         }
1191     }
1192 
1193     return 1;
1194 }
1195 
1196 static int init_certificate_authorities(SSL *s, unsigned int context)
1197 {
1198     sk_X509_NAME_pop_free(s->s3->tmp.peer_ca_names, X509_NAME_free);
1199     s->s3->tmp.peer_ca_names = NULL;
1200     return 1;
1201 }
1202 
1203 static EXT_RETURN tls_construct_certificate_authorities(SSL *s, WPACKET *pkt,
1204                                                         unsigned int context,
1205                                                         X509 *x,
1206                                                         size_t chainidx)
1207 {
1208     const STACK_OF(X509_NAME) *ca_sk = get_ca_names(s);
1209 
1210     if (ca_sk == NULL || sk_X509_NAME_num(ca_sk) == 0)
1211         return EXT_RETURN_NOT_SENT;
1212 
1213     if (!WPACKET_put_bytes_u16(pkt, TLSEXT_TYPE_certificate_authorities)
1214         || !WPACKET_start_sub_packet_u16(pkt)) {
1215         SSLfatal(s, SSL_AD_INTERNAL_ERROR,
1216                  SSL_F_TLS_CONSTRUCT_CERTIFICATE_AUTHORITIES,
1217                ERR_R_INTERNAL_ERROR);
1218         return EXT_RETURN_FAIL;
1219     }
1220 
1221     if (!construct_ca_names(s, ca_sk, pkt)) {
1222         /* SSLfatal() already called */
1223         return EXT_RETURN_FAIL;
1224     }
1225 
1226     if (!WPACKET_close(pkt)) {
1227         SSLfatal(s, SSL_AD_INTERNAL_ERROR,
1228                  SSL_F_TLS_CONSTRUCT_CERTIFICATE_AUTHORITIES,
1229                  ERR_R_INTERNAL_ERROR);
1230         return EXT_RETURN_FAIL;
1231     }
1232 
1233     return EXT_RETURN_SENT;
1234 }
1235 
1236 static int tls_parse_certificate_authorities(SSL *s, PACKET *pkt,
1237                                              unsigned int context, X509 *x,
1238                                              size_t chainidx)
1239 {
1240     if (!parse_ca_names(s, pkt))
1241         return 0;
1242     if (PACKET_remaining(pkt) != 0) {
1243         SSLfatal(s, SSL_AD_DECODE_ERROR,
1244                  SSL_F_TLS_PARSE_CERTIFICATE_AUTHORITIES, SSL_R_BAD_EXTENSION);
1245         return 0;
1246     }
1247     return 1;
1248 }
1249 
1250 #ifndef OPENSSL_NO_SRTP
1251 static int init_srtp(SSL *s, unsigned int context)
1252 {
1253     if (s->server)
1254         s->srtp_profile = NULL;
1255 
1256     return 1;
1257 }
1258 #endif
1259 
1260 static int final_sig_algs(SSL *s, unsigned int context, int sent)
1261 {
1262     if (!sent && SSL_IS_TLS13(s) && !s->hit) {
1263         SSLfatal(s, TLS13_AD_MISSING_EXTENSION, SSL_F_FINAL_SIG_ALGS,
1264                  SSL_R_MISSING_SIGALGS_EXTENSION);
1265         return 0;
1266     }
1267 
1268     return 1;
1269 }
1270 
1271 #ifndef OPENSSL_NO_EC
1272 static int final_key_share(SSL *s, unsigned int context, int sent)
1273 {
1274     if (!SSL_IS_TLS13(s))
1275         return 1;
1276 
1277     /* Nothing to do for key_share in an HRR */
1278     if ((context & SSL_EXT_TLS1_3_HELLO_RETRY_REQUEST) != 0)
1279         return 1;
1280 
1281     /*
1282      * If
1283      *     we are a client
1284      *     AND
1285      *     we have no key_share
1286      *     AND
1287      *     (we are not resuming
1288      *      OR the kex_mode doesn't allow non key_share resumes)
1289      * THEN
1290      *     fail;
1291      */
1292     if (!s->server
1293             && !sent
1294             && (!s->hit
1295                 || (s->ext.psk_kex_mode & TLSEXT_KEX_MODE_FLAG_KE) == 0)) {
1296         /* Nothing left we can do - just fail */
1297         SSLfatal(s, SSL_AD_MISSING_EXTENSION, SSL_F_FINAL_KEY_SHARE,
1298                  SSL_R_NO_SUITABLE_KEY_SHARE);
1299         return 0;
1300     }
1301     /*
1302      * IF
1303      *     we are a server
1304      * THEN
1305      *     IF
1306      *         we have a suitable key_share
1307      *     THEN
1308      *         IF
1309      *             we are stateless AND we have no cookie
1310      *         THEN
1311      *             send a HelloRetryRequest
1312      *     ELSE
1313      *         IF
1314      *             we didn't already send a HelloRetryRequest
1315      *             AND
1316      *             the client sent a key_share extension
1317      *             AND
1318      *             (we are not resuming
1319      *              OR the kex_mode allows key_share resumes)
1320      *             AND
1321      *             a shared group exists
1322      *         THEN
1323      *             send a HelloRetryRequest
1324      *         ELSE IF
1325      *             we are not resuming
1326      *             OR
1327      *             the kex_mode doesn't allow non key_share resumes
1328      *         THEN
1329      *             fail
1330      *         ELSE IF
1331      *             we are stateless AND we have no cookie
1332      *         THEN
1333      *             send a HelloRetryRequest
1334      */
1335     if (s->server) {
1336         if (s->s3->peer_tmp != NULL) {
1337             /* We have a suitable key_share */
1338             if ((s->s3->flags & TLS1_FLAGS_STATELESS) != 0
1339                     && !s->ext.cookieok) {
1340                 if (!ossl_assert(s->hello_retry_request == SSL_HRR_NONE)) {
1341                     /*
1342                      * If we are stateless then we wouldn't know about any
1343                      * previously sent HRR - so how can this be anything other
1344                      * than 0?
1345                      */
1346                     SSLfatal(s, SSL_AD_INTERNAL_ERROR, SSL_F_FINAL_KEY_SHARE,
1347                              ERR_R_INTERNAL_ERROR);
1348                     return 0;
1349                 }
1350                 s->hello_retry_request = SSL_HRR_PENDING;
1351                 return 1;
1352             }
1353         } else {
1354             /* No suitable key_share */
1355             if (s->hello_retry_request == SSL_HRR_NONE && sent
1356                     && (!s->hit
1357                         || (s->ext.psk_kex_mode & TLSEXT_KEX_MODE_FLAG_KE_DHE)
1358                            != 0)) {
1359                 const uint16_t *pgroups, *clntgroups;
1360                 size_t num_groups, clnt_num_groups, i;
1361                 unsigned int group_id = 0;
1362 
1363                 /* Check if a shared group exists */
1364 
1365                 /* Get the clients list of supported groups. */
1366                 tls1_get_peer_groups(s, &clntgroups, &clnt_num_groups);
1367                 tls1_get_supported_groups(s, &pgroups, &num_groups);
1368 
1369                 /*
1370                  * Find the first group we allow that is also in client's list
1371                  */
1372                 for (i = 0; i < num_groups; i++) {
1373                     group_id = pgroups[i];
1374 
1375                     if (check_in_list(s, group_id, clntgroups, clnt_num_groups,
1376                                       1))
1377                         break;
1378                 }
1379 
1380                 if (i < num_groups) {
1381                     /* A shared group exists so send a HelloRetryRequest */
1382                     s->s3->group_id = group_id;
1383                     s->hello_retry_request = SSL_HRR_PENDING;
1384                     return 1;
1385                 }
1386             }
1387             if (!s->hit
1388                     || (s->ext.psk_kex_mode & TLSEXT_KEX_MODE_FLAG_KE) == 0) {
1389                 /* Nothing left we can do - just fail */
1390                 SSLfatal(s, sent ? SSL_AD_HANDSHAKE_FAILURE
1391                                  : SSL_AD_MISSING_EXTENSION,
1392                          SSL_F_FINAL_KEY_SHARE, SSL_R_NO_SUITABLE_KEY_SHARE);
1393                 return 0;
1394             }
1395 
1396             if ((s->s3->flags & TLS1_FLAGS_STATELESS) != 0
1397                     && !s->ext.cookieok) {
1398                 if (!ossl_assert(s->hello_retry_request == SSL_HRR_NONE)) {
1399                     /*
1400                      * If we are stateless then we wouldn't know about any
1401                      * previously sent HRR - so how can this be anything other
1402                      * than 0?
1403                      */
1404                     SSLfatal(s, SSL_AD_INTERNAL_ERROR, SSL_F_FINAL_KEY_SHARE,
1405                              ERR_R_INTERNAL_ERROR);
1406                     return 0;
1407                 }
1408                 s->hello_retry_request = SSL_HRR_PENDING;
1409                 return 1;
1410             }
1411         }
1412 
1413         /*
1414          * We have a key_share so don't send any more HelloRetryRequest
1415          * messages
1416          */
1417         if (s->hello_retry_request == SSL_HRR_PENDING)
1418             s->hello_retry_request = SSL_HRR_COMPLETE;
1419     } else {
1420         /*
1421          * For a client side resumption with no key_share we need to generate
1422          * the handshake secret (otherwise this is done during key_share
1423          * processing).
1424          */
1425         if (!sent && !tls13_generate_handshake_secret(s, NULL, 0)) {
1426             SSLfatal(s, SSL_AD_INTERNAL_ERROR, SSL_F_FINAL_KEY_SHARE,
1427                      ERR_R_INTERNAL_ERROR);
1428             return 0;
1429         }
1430     }
1431 
1432     return 1;
1433 }
1434 #endif
1435 
1436 static int init_psk_kex_modes(SSL *s, unsigned int context)
1437 {
1438     s->ext.psk_kex_mode = TLSEXT_KEX_MODE_FLAG_NONE;
1439     return 1;
1440 }
1441 
1442 int tls_psk_do_binder(SSL *s, const EVP_MD *md, const unsigned char *msgstart,
1443                       size_t binderoffset, const unsigned char *binderin,
1444                       unsigned char *binderout, SSL_SESSION *sess, int sign,
1445                       int external)
1446 {
1447     EVP_PKEY *mackey = NULL;
1448     EVP_MD_CTX *mctx = NULL;
1449     unsigned char hash[EVP_MAX_MD_SIZE], binderkey[EVP_MAX_MD_SIZE];
1450     unsigned char finishedkey[EVP_MAX_MD_SIZE], tmpbinder[EVP_MAX_MD_SIZE];
1451     unsigned char *early_secret;
1452     static const unsigned char resumption_label[] = "res binder";
1453     static const unsigned char external_label[] = "ext binder";
1454     const unsigned char *label;
1455     size_t bindersize, labelsize, hashsize;
1456     int hashsizei = EVP_MD_size(md);
1457     int ret = -1;
1458     int usepskfored = 0;
1459 
1460     /* Ensure cast to size_t is safe */
1461     if (!ossl_assert(hashsizei >= 0)) {
1462         SSLfatal(s, SSL_AD_INTERNAL_ERROR, SSL_F_TLS_PSK_DO_BINDER,
1463                  ERR_R_INTERNAL_ERROR);
1464         goto err;
1465     }
1466     hashsize = (size_t)hashsizei;
1467 
1468     if (external
1469             && s->early_data_state == SSL_EARLY_DATA_CONNECTING
1470             && s->session->ext.max_early_data == 0
1471             && sess->ext.max_early_data > 0)
1472         usepskfored = 1;
1473 
1474     if (external) {
1475         label = external_label;
1476         labelsize = sizeof(external_label) - 1;
1477     } else {
1478         label = resumption_label;
1479         labelsize = sizeof(resumption_label) - 1;
1480     }
1481 
1482     /*
1483      * Generate the early_secret. On the server side we've selected a PSK to
1484      * resume with (internal or external) so we always do this. On the client
1485      * side we do this for a non-external (i.e. resumption) PSK or external PSK
1486      * that will be used for early_data so that it is in place for sending early
1487      * data. For client side external PSK not being used for early_data we
1488      * generate it but store it away for later use.
1489      */
1490     if (s->server || !external || usepskfored)
1491         early_secret = (unsigned char *)s->early_secret;
1492     else
1493         early_secret = (unsigned char *)sess->early_secret;
1494 
1495     if (!tls13_generate_secret(s, md, NULL, sess->master_key,
1496                                sess->master_key_length, early_secret)) {
1497         /* SSLfatal() already called */
1498         goto err;
1499     }
1500 
1501     /*
1502      * Create the handshake hash for the binder key...the messages so far are
1503      * empty!
1504      */
1505     mctx = EVP_MD_CTX_new();
1506     if (mctx == NULL
1507             || EVP_DigestInit_ex(mctx, md, NULL) <= 0
1508             || EVP_DigestFinal_ex(mctx, hash, NULL) <= 0) {
1509         SSLfatal(s, SSL_AD_INTERNAL_ERROR, SSL_F_TLS_PSK_DO_BINDER,
1510                  ERR_R_INTERNAL_ERROR);
1511         goto err;
1512     }
1513 
1514     /* Generate the binder key */
1515     if (!tls13_hkdf_expand(s, md, early_secret, label, labelsize, hash,
1516                            hashsize, binderkey, hashsize, 1)) {
1517         /* SSLfatal() already called */
1518         goto err;
1519     }
1520 
1521     /* Generate the finished key */
1522     if (!tls13_derive_finishedkey(s, md, binderkey, finishedkey, hashsize)) {
1523         /* SSLfatal() already called */
1524         goto err;
1525     }
1526 
1527     if (EVP_DigestInit_ex(mctx, md, NULL) <= 0) {
1528         SSLfatal(s, SSL_AD_INTERNAL_ERROR, SSL_F_TLS_PSK_DO_BINDER,
1529                  ERR_R_INTERNAL_ERROR);
1530         goto err;
1531     }
1532 
1533     /*
1534      * Get a hash of the ClientHello up to the start of the binders. If we are
1535      * following a HelloRetryRequest then this includes the hash of the first
1536      * ClientHello and the HelloRetryRequest itself.
1537      */
1538     if (s->hello_retry_request == SSL_HRR_PENDING) {
1539         size_t hdatalen;
1540         long hdatalen_l;
1541         void *hdata;
1542 
1543         hdatalen = hdatalen_l =
1544             BIO_get_mem_data(s->s3->handshake_buffer, &hdata);
1545         if (hdatalen_l <= 0) {
1546             SSLfatal(s, SSL_AD_INTERNAL_ERROR, SSL_F_TLS_PSK_DO_BINDER,
1547                      SSL_R_BAD_HANDSHAKE_LENGTH);
1548             goto err;
1549         }
1550 
1551         /*
1552          * For servers the handshake buffer data will include the second
1553          * ClientHello - which we don't want - so we need to take that bit off.
1554          */
1555         if (s->server) {
1556             PACKET hashprefix, msg;
1557 
1558             /* Find how many bytes are left after the first two messages */
1559             if (!PACKET_buf_init(&hashprefix, hdata, hdatalen)
1560                     || !PACKET_forward(&hashprefix, 1)
1561                     || !PACKET_get_length_prefixed_3(&hashprefix, &msg)
1562                     || !PACKET_forward(&hashprefix, 1)
1563                     || !PACKET_get_length_prefixed_3(&hashprefix, &msg)) {
1564                 SSLfatal(s, SSL_AD_INTERNAL_ERROR, SSL_F_TLS_PSK_DO_BINDER,
1565                          ERR_R_INTERNAL_ERROR);
1566                 goto err;
1567             }
1568             hdatalen -= PACKET_remaining(&hashprefix);
1569         }
1570 
1571         if (EVP_DigestUpdate(mctx, hdata, hdatalen) <= 0) {
1572             SSLfatal(s, SSL_AD_INTERNAL_ERROR, SSL_F_TLS_PSK_DO_BINDER,
1573                      ERR_R_INTERNAL_ERROR);
1574             goto err;
1575         }
1576     }
1577 
1578     if (EVP_DigestUpdate(mctx, msgstart, binderoffset) <= 0
1579             || EVP_DigestFinal_ex(mctx, hash, NULL) <= 0) {
1580         SSLfatal(s, SSL_AD_INTERNAL_ERROR, SSL_F_TLS_PSK_DO_BINDER,
1581                  ERR_R_INTERNAL_ERROR);
1582         goto err;
1583     }
1584 
1585     mackey = EVP_PKEY_new_raw_private_key(EVP_PKEY_HMAC, NULL, finishedkey,
1586                                           hashsize);
1587     if (mackey == NULL) {
1588         SSLfatal(s, SSL_AD_INTERNAL_ERROR, SSL_F_TLS_PSK_DO_BINDER,
1589                  ERR_R_INTERNAL_ERROR);
1590         goto err;
1591     }
1592 
1593     if (!sign)
1594         binderout = tmpbinder;
1595 
1596     bindersize = hashsize;
1597     if (EVP_DigestSignInit(mctx, NULL, md, NULL, mackey) <= 0
1598             || EVP_DigestSignUpdate(mctx, hash, hashsize) <= 0
1599             || EVP_DigestSignFinal(mctx, binderout, &bindersize) <= 0
1600             || bindersize != hashsize) {
1601         SSLfatal(s, SSL_AD_INTERNAL_ERROR, SSL_F_TLS_PSK_DO_BINDER,
1602                  ERR_R_INTERNAL_ERROR);
1603         goto err;
1604     }
1605 
1606     if (sign) {
1607         ret = 1;
1608     } else {
1609         /* HMAC keys can't do EVP_DigestVerify* - use CRYPTO_memcmp instead */
1610         ret = (CRYPTO_memcmp(binderin, binderout, hashsize) == 0);
1611         if (!ret)
1612             SSLfatal(s, SSL_AD_ILLEGAL_PARAMETER, SSL_F_TLS_PSK_DO_BINDER,
1613                      SSL_R_BINDER_DOES_NOT_VERIFY);
1614     }
1615 
1616  err:
1617     OPENSSL_cleanse(binderkey, sizeof(binderkey));
1618     OPENSSL_cleanse(finishedkey, sizeof(finishedkey));
1619     EVP_PKEY_free(mackey);
1620     EVP_MD_CTX_free(mctx);
1621 
1622     return ret;
1623 }
1624 
1625 static int final_early_data(SSL *s, unsigned int context, int sent)
1626 {
1627     if (!sent)
1628         return 1;
1629 
1630     if (!s->server) {
1631         if (context == SSL_EXT_TLS1_3_ENCRYPTED_EXTENSIONS
1632                 && sent
1633                 && !s->ext.early_data_ok) {
1634             /*
1635              * If we get here then the server accepted our early_data but we
1636              * later realised that it shouldn't have done (e.g. inconsistent
1637              * ALPN)
1638              */
1639             SSLfatal(s, SSL_AD_ILLEGAL_PARAMETER, SSL_F_FINAL_EARLY_DATA,
1640                      SSL_R_BAD_EARLY_DATA);
1641             return 0;
1642         }
1643 
1644         return 1;
1645     }
1646 
1647     if (s->max_early_data == 0
1648             || !s->hit
1649             || s->session->ext.tick_identity != 0
1650             || s->early_data_state != SSL_EARLY_DATA_ACCEPTING
1651             || !s->ext.early_data_ok
1652             || s->hello_retry_request != SSL_HRR_NONE
1653             || (s->ctx->allow_early_data_cb != NULL
1654                 && !s->ctx->allow_early_data_cb(s,
1655                                          s->ctx->allow_early_data_cb_data))) {
1656         s->ext.early_data = SSL_EARLY_DATA_REJECTED;
1657     } else {
1658         s->ext.early_data = SSL_EARLY_DATA_ACCEPTED;
1659 
1660         if (!tls13_change_cipher_state(s,
1661                     SSL3_CC_EARLY | SSL3_CHANGE_CIPHER_SERVER_READ)) {
1662             /* SSLfatal() already called */
1663             return 0;
1664         }
1665     }
1666 
1667     return 1;
1668 }
1669 
1670 static int final_maxfragmentlen(SSL *s, unsigned int context, int sent)
1671 {
1672     /*
1673      * Session resumption on server-side with MFL extension active
1674      *  BUT MFL extension packet was not resent (i.e. sent == 0)
1675      */
1676     if (s->server && s->hit && USE_MAX_FRAGMENT_LENGTH_EXT(s->session)
1677             && !sent ) {
1678         SSLfatal(s, SSL_AD_MISSING_EXTENSION, SSL_F_FINAL_MAXFRAGMENTLEN,
1679                  SSL_R_BAD_EXTENSION);
1680         return 0;
1681     }
1682 
1683     /* Current SSL buffer is lower than requested MFL */
1684     if (s->session && USE_MAX_FRAGMENT_LENGTH_EXT(s->session)
1685             && s->max_send_fragment < GET_MAX_FRAGMENT_LENGTH(s->session))
1686         /* trigger a larger buffer reallocation */
1687         if (!ssl3_setup_buffers(s)) {
1688             /* SSLfatal() already called */
1689             return 0;
1690         }
1691 
1692     return 1;
1693 }
1694 
1695 static int init_post_handshake_auth(SSL *s, unsigned int context)
1696 {
1697     s->post_handshake_auth = SSL_PHA_NONE;
1698 
1699     return 1;
1700 }
1701