Commit 61138358 authored by Matt Caswell's avatar Matt Caswell
Browse files

Make the context available to the extensions parse and construction funcs

parent e0670973
Loading
Loading
Loading
Loading
+14 −11
Original line number Original line Diff line number Diff line
@@ -57,15 +57,17 @@ typedef struct extensions_definition_st {
     */
     */
    int (*init)(SSL *s, unsigned int context);
    int (*init)(SSL *s, unsigned int context);
    /* Parse extension sent from client to server */
    /* Parse extension sent from client to server */
    int (*parse_ctos)(SSL *s, PACKET *pkt, X509 *x, size_t chainidx, int *al);
    int (*parse_ctos)(SSL *s, PACKET *pkt, unsigned int context, X509 *x,
                      size_t chainidx, int *al);
    /* Parse extension send from server to client */
    /* Parse extension send from server to client */
    int (*parse_stoc)(SSL *s, PACKET *pkt, X509 *x, size_t chainidx, int *al);
    int (*parse_stoc)(SSL *s, PACKET *pkt, unsigned int context, X509 *x,
                      size_t chainidx, int *al);
    /* Construct extension sent from server to client */
    /* Construct extension sent from server to client */
    int (*construct_stoc)(SSL *s, WPACKET *pkt, X509 *x, size_t chainidx,
    int (*construct_stoc)(SSL *s, WPACKET *pkt, unsigned int context, X509 *x,
                          int *al);
                          size_t chainidx, int *al);
    /* Construct extension sent from client to server */
    /* Construct extension sent from client to server */
    int (*construct_ctos)(SSL *s, WPACKET *pkt, X509 *x, size_t chainidx,
    int (*construct_ctos)(SSL *s, WPACKET *pkt, unsigned int context, X509 *x,
                          int *al);
                          size_t chainidx, int *al);
    /*
    /*
     * Finalise extension after parsing. Always called where an extensions was
     * Finalise extension after parsing. Always called where an extensions was
     * initialised even if the extension was not present. |sent| is set to 1 if
     * initialised even if the extension was not present. |sent| is set to 1 if
@@ -470,7 +472,8 @@ int tls_parse_extension(SSL *s, TLSEXT_INDEX idx, int context,
                        RAW_EXTENSION *exts, X509 *x, size_t chainidx, int *al)
                        RAW_EXTENSION *exts, X509 *x, size_t chainidx, int *al)
{
{
    RAW_EXTENSION *currext = &exts[idx];
    RAW_EXTENSION *currext = &exts[idx];
    int (*parser)(SSL *s, PACKET *pkt, X509 *x, size_t chainidx, int *al) = NULL;
    int (*parser)(SSL *s, PACKET *pkt, unsigned int context, X509 *x,
                  size_t chainidx, int *al) = NULL;


    /* Skip if the extension is not present */
    /* Skip if the extension is not present */
    if (!currext->present)
    if (!currext->present)
@@ -499,7 +502,7 @@ int tls_parse_extension(SSL *s, TLSEXT_INDEX idx, int context,
        parser = s->server ? extdef->parse_ctos : extdef->parse_stoc;
        parser = s->server ? extdef->parse_ctos : extdef->parse_stoc;


        if (parser != NULL)
        if (parser != NULL)
            return parser(s, &currext->data, x, chainidx, al);
            return parser(s, &currext->data, context, x, chainidx, al);


        /*
        /*
         * If the parser is NULL we fall through to the custom extension
         * If the parser is NULL we fall through to the custom extension
@@ -633,8 +636,8 @@ int tls_construct_extensions(SSL *s, WPACKET *pkt, unsigned int context,
    }
    }


    for (i = 0, thisexd = ext_defs; i < OSSL_NELEM(ext_defs); i++, thisexd++) {
    for (i = 0, thisexd = ext_defs; i < OSSL_NELEM(ext_defs); i++, thisexd++) {
        int (*construct)(SSL *s, WPACKET *pkt, X509 *x, size_t chainidx,
        int (*construct)(SSL *s, WPACKET *pkt, unsigned int context, X509 *x,
                         int *al);
                         size_t chainidx, int *al);


        /* Skip if not relevant for our context */
        /* Skip if not relevant for our context */
        if ((thisexd->context & context) == 0)
        if ((thisexd->context & context) == 0)
@@ -661,7 +664,7 @@ int tls_construct_extensions(SSL *s, WPACKET *pkt, unsigned int context,
                || construct == NULL)
                || construct == NULL)
            continue;
            continue;


        if (!construct(s, pkt, x, chainidx, &tmpal))
        if (!construct(s, pkt, context, x, chainidx, &tmpal))
            goto err;
            goto err;
    }
    }


+64 −54
Original line number Original line Diff line number Diff line
@@ -12,8 +12,8 @@
#include "../ssl_locl.h"
#include "../ssl_locl.h"
#include "statem_locl.h"
#include "statem_locl.h"


int tls_construct_ctos_renegotiate(SSL *s, WPACKET *pkt, X509 *x,
int tls_construct_ctos_renegotiate(SSL *s, WPACKET *pkt, unsigned int context,
                                   size_t chainidx, int *al)
                                   X509 *x, size_t chainidx, int *al)
{
{
    /* Add RI if renegotiating */
    /* Add RI if renegotiating */
    if (!s->renegotiate)
    if (!s->renegotiate)
@@ -31,8 +31,8 @@ int tls_construct_ctos_renegotiate(SSL *s, WPACKET *pkt, X509 *x,
    return 1;
    return 1;
}
}


int tls_construct_ctos_server_name(SSL *s, WPACKET *pkt, X509 *x,
int tls_construct_ctos_server_name(SSL *s, WPACKET *pkt, unsigned int context,
                                   size_t chainidx, int *al)
                                   X509 *x, size_t chainidx, int *al)
{
{
    if (s->ext.hostname == NULL)
    if (s->ext.hostname == NULL)
        return 1;
        return 1;
@@ -56,8 +56,8 @@ int tls_construct_ctos_server_name(SSL *s, WPACKET *pkt, X509 *x,
}
}


#ifndef OPENSSL_NO_SRP
#ifndef OPENSSL_NO_SRP
int tls_construct_ctos_srp(SSL *s, WPACKET *pkt, X509 *x, size_t chainidx,
int tls_construct_ctos_srp(SSL *s, WPACKET *pkt, unsigned int context, X509 *x,
                           int *al)
                           size_t chainidx, int *al)
{
{
    /* Add SRP username if there is one */
    /* Add SRP username if there is one */
    if (s->srp_ctx.login == NULL)
    if (s->srp_ctx.login == NULL)
@@ -108,8 +108,8 @@ static int use_ecc(SSL *s)
    return i < end;
    return i < end;
}
}


int tls_construct_ctos_ec_pt_formats(SSL *s, WPACKET *pkt, X509 *x,
int tls_construct_ctos_ec_pt_formats(SSL *s, WPACKET *pkt, unsigned int context,
                                     size_t chainidx, int *al)
                                     X509 *x, size_t chainidx, int *al)
{
{
    const unsigned char *pformats;
    const unsigned char *pformats;
    size_t num_formats;
    size_t num_formats;
@@ -132,7 +132,8 @@ int tls_construct_ctos_ec_pt_formats(SSL *s, WPACKET *pkt, X509 *x,
    return 1;
    return 1;
}
}


int tls_construct_ctos_supported_groups(SSL *s, WPACKET *pkt, X509 *x,
int tls_construct_ctos_supported_groups(SSL *s, WPACKET *pkt,
                                        unsigned int context, X509 *x,
                                        size_t chainidx, int *al)
                                        size_t chainidx, int *al)
{
{
    const unsigned char *pcurves = NULL, *pcurvestmp;
    const unsigned char *pcurves = NULL, *pcurvestmp;
@@ -182,7 +183,8 @@ int tls_construct_ctos_supported_groups(SSL *s, WPACKET *pkt, X509 *x,
}
}
#endif
#endif


int tls_construct_ctos_session_ticket(SSL *s, WPACKET *pkt, X509 *x,
int tls_construct_ctos_session_ticket(SSL *s, WPACKET *pkt,
                                      unsigned int context, X509 *x,
                                      size_t chainidx, int *al)
                                      size_t chainidx, int *al)
{
{
    size_t ticklen;
    size_t ticklen;
@@ -223,8 +225,8 @@ int tls_construct_ctos_session_ticket(SSL *s, WPACKET *pkt, X509 *x,
    return 1;
    return 1;
}
}


int tls_construct_ctos_sig_algs(SSL *s, WPACKET *pkt, X509 *x, size_t chainidx,
int tls_construct_ctos_sig_algs(SSL *s, WPACKET *pkt, unsigned int context,
                                int *al)
                                X509 *x, size_t chainidx, int *al)
{
{
    size_t salglen;
    size_t salglen;
    const uint16_t *salg;
    const uint16_t *salg;
@@ -249,7 +251,8 @@ int tls_construct_ctos_sig_algs(SSL *s, WPACKET *pkt, X509 *x, size_t chainidx,
}
}


#ifndef OPENSSL_NO_OCSP
#ifndef OPENSSL_NO_OCSP
int tls_construct_ctos_status_request(SSL *s, WPACKET *pkt, X509 *x,
int tls_construct_ctos_status_request(SSL *s, WPACKET *pkt,
                                      unsigned int context, X509 *x,
                                      size_t chainidx, int *al)
                                      size_t chainidx, int *al)
{
{
    int i;
    int i;
@@ -316,8 +319,8 @@ int tls_construct_ctos_status_request(SSL *s, WPACKET *pkt, X509 *x,
#endif
#endif


#ifndef OPENSSL_NO_NEXTPROTONEG
#ifndef OPENSSL_NO_NEXTPROTONEG
int tls_construct_ctos_npn(SSL *s, WPACKET *pkt, X509 *x, size_t chainidx,
int tls_construct_ctos_npn(SSL *s, WPACKET *pkt, unsigned int context, X509 *x,
                           int *al)
                           size_t chainidx, int *al)
{
{
    if (s->ctx->ext.npn_select_cb == NULL || !SSL_IS_FIRST_HANDSHAKE(s))
    if (s->ctx->ext.npn_select_cb == NULL || !SSL_IS_FIRST_HANDSHAKE(s))
        return 1;
        return 1;
@@ -336,8 +339,8 @@ int tls_construct_ctos_npn(SSL *s, WPACKET *pkt, X509 *x, size_t chainidx,
}
}
#endif
#endif


int tls_construct_ctos_alpn(SSL *s, WPACKET *pkt, X509 *x, size_t chainidx,
int tls_construct_ctos_alpn(SSL *s, WPACKET *pkt, unsigned int context, X509 *x,
                            int *al)
                            size_t chainidx, int *al)
{
{
    s->s3->alpn_sent = 0;
    s->s3->alpn_sent = 0;


@@ -360,8 +363,8 @@ int tls_construct_ctos_alpn(SSL *s, WPACKET *pkt, X509 *x, size_t chainidx,




#ifndef OPENSSL_NO_SRTP
#ifndef OPENSSL_NO_SRTP
int tls_construct_ctos_use_srtp(SSL *s, WPACKET *pkt, X509 *x, size_t chainidx,
int tls_construct_ctos_use_srtp(SSL *s, WPACKET *pkt, unsigned int context,
                                int *al)
                                X509 *x, size_t chainidx, int *al)
{
{
    STACK_OF(SRTP_PROTECTION_PROFILE) *clnt = SSL_get_srtp_profiles(s);
    STACK_OF(SRTP_PROTECTION_PROFILE) *clnt = SSL_get_srtp_profiles(s);
    int i, end;
    int i, end;
@@ -400,8 +403,8 @@ int tls_construct_ctos_use_srtp(SSL *s, WPACKET *pkt, X509 *x, size_t chainidx,
}
}
#endif
#endif


int tls_construct_ctos_etm(SSL *s, WPACKET *pkt, X509 *x, size_t chainidx,
int tls_construct_ctos_etm(SSL *s, WPACKET *pkt, unsigned int context, X509 *x,
                           int *al)
                           size_t chainidx, int *al)
{
{
    if (s->options & SSL_OP_NO_ENCRYPT_THEN_MAC)
    if (s->options & SSL_OP_NO_ENCRYPT_THEN_MAC)
        return 1;
        return 1;
@@ -416,8 +419,8 @@ int tls_construct_ctos_etm(SSL *s, WPACKET *pkt, X509 *x, size_t chainidx,
}
}


#ifndef OPENSSL_NO_CT
#ifndef OPENSSL_NO_CT
int tls_construct_ctos_sct(SSL *s, WPACKET *pkt, X509 *x, size_t chainidx,
int tls_construct_ctos_sct(SSL *s, WPACKET *pkt, unsigned int context, X509 *x,
                           int *al)
                           size_t chainidx, int *al)
{
{
    if (s->ct_validation_callback == NULL)
    if (s->ct_validation_callback == NULL)
        return 1;
        return 1;
@@ -436,8 +439,8 @@ int tls_construct_ctos_sct(SSL *s, WPACKET *pkt, X509 *x, size_t chainidx,
}
}
#endif
#endif


int tls_construct_ctos_ems(SSL *s, WPACKET *pkt, X509 *x, size_t chainidx,
int tls_construct_ctos_ems(SSL *s, WPACKET *pkt, unsigned int context, X509 *x,
                           int *al)
                           size_t chainidx, int *al)
{
{
    if (!WPACKET_put_bytes_u16(pkt, TLSEXT_TYPE_extended_master_secret)
    if (!WPACKET_put_bytes_u16(pkt, TLSEXT_TYPE_extended_master_secret)
            || !WPACKET_put_bytes_u16(pkt, 0)) {
            || !WPACKET_put_bytes_u16(pkt, 0)) {
@@ -448,7 +451,8 @@ int tls_construct_ctos_ems(SSL *s, WPACKET *pkt, X509 *x, size_t chainidx,
    return 1;
    return 1;
}
}


int tls_construct_ctos_supported_versions(SSL *s, WPACKET *pkt, X509 *x,
int tls_construct_ctos_supported_versions(SSL *s, WPACKET *pkt,
                                          unsigned int context, X509 *x,
                                          size_t chainidx, int *al)
                                          size_t chainidx, int *al)
{
{
    int currv, min_version, max_version, reason;
    int currv, min_version, max_version, reason;
@@ -499,8 +503,8 @@ int tls_construct_ctos_supported_versions(SSL *s, WPACKET *pkt, X509 *x,
 * Construct a psk_kex_modes extension. We only have two modes we know about
 * Construct a psk_kex_modes extension. We only have two modes we know about
 * at this stage, so we send both.
 * at this stage, so we send both.
 */
 */
int tls_construct_ctos_psk_kex_modes(SSL *s, WPACKET *pkt, X509 *x,
int tls_construct_ctos_psk_kex_modes(SSL *s, WPACKET *pkt, unsigned int context,
                                     size_t chainidx, int *al)
                                     X509 *x, size_t chainidx, int *al)
{
{
#ifndef OPENSSL_NO_TLS1_3
#ifndef OPENSSL_NO_TLS1_3
    /*
    /*
@@ -524,8 +528,8 @@ int tls_construct_ctos_psk_kex_modes(SSL *s, WPACKET *pkt, X509 *x,
    return 1;
    return 1;
}
}


int tls_construct_ctos_key_share(SSL *s, WPACKET *pkt, X509 *x, size_t chainidx,
int tls_construct_ctos_key_share(SSL *s, WPACKET *pkt, unsigned int context,
                                 int *al)
                                 X509 *x, size_t chainidx, int *al)
{
{
#ifndef OPENSSL_NO_TLS1_3
#ifndef OPENSSL_NO_TLS1_3
    size_t i, sharessent = 0, num_curves = 0;
    size_t i, sharessent = 0, num_curves = 0;
@@ -615,8 +619,8 @@ int tls_construct_ctos_key_share(SSL *s, WPACKET *pkt, X509 *x, size_t chainidx,
#define F5_WORKAROUND_MIN_MSG_LEN   0xff
#define F5_WORKAROUND_MIN_MSG_LEN   0xff
#define F5_WORKAROUND_MAX_MSG_LEN   0x200
#define F5_WORKAROUND_MAX_MSG_LEN   0x200


int tls_construct_ctos_padding(SSL *s, WPACKET *pkt, X509 *x, size_t chainidx,
int tls_construct_ctos_padding(SSL *s, WPACKET *pkt, unsigned int context,
                               int *al)
                               X509 *x, size_t chainidx, int *al)
{
{
    unsigned char *padbytes;
    unsigned char *padbytes;
    size_t hlen;
    size_t hlen;
@@ -662,8 +666,8 @@ int tls_construct_ctos_padding(SSL *s, WPACKET *pkt, X509 *x, size_t chainidx,
/*
/*
 * Construct the pre_shared_key extension
 * Construct the pre_shared_key extension
 */
 */
int tls_construct_ctos_psk(SSL *s, WPACKET *pkt, X509 *x, size_t chainidx,
int tls_construct_ctos_psk(SSL *s, WPACKET *pkt, unsigned int context, X509 *x,
                           int *al)
                           size_t chainidx, int *al)
{
{
#ifndef OPENSSL_NO_TLS1_3
#ifndef OPENSSL_NO_TLS1_3
    uint32_t now, agesec, agems;
    uint32_t now, agesec, agems;
@@ -774,8 +778,8 @@ int tls_construct_ctos_psk(SSL *s, WPACKET *pkt, X509 *x, size_t chainidx,
/*
/*
 * Parse the server's renegotiation binding and abort if it's not right
 * Parse the server's renegotiation binding and abort if it's not right
 */
 */
int tls_parse_stoc_renegotiate(SSL *s, PACKET *pkt, X509 *x, size_t chainidx,
int tls_parse_stoc_renegotiate(SSL *s, PACKET *pkt, unsigned int context,
                               int *al)
                               X509 *x, size_t chainidx, int *al)
{
{
    size_t expected_len = s->s3->previous_client_finished_len
    size_t expected_len = s->s3->previous_client_finished_len
        + s->s3->previous_server_finished_len;
        + s->s3->previous_server_finished_len;
@@ -832,8 +836,8 @@ int tls_parse_stoc_renegotiate(SSL *s, PACKET *pkt, X509 *x, size_t chainidx,
    return 1;
    return 1;
}
}


int tls_parse_stoc_server_name(SSL *s, PACKET *pkt, X509 *x, size_t chainidx,
int tls_parse_stoc_server_name(SSL *s, PACKET *pkt, unsigned int context,
                               int *al)
                               X509 *x, size_t chainidx, int *al)
{
{
    if (s->ext.hostname == NULL || PACKET_remaining(pkt) > 0) {
    if (s->ext.hostname == NULL || PACKET_remaining(pkt) > 0) {
        *al = SSL_AD_UNRECOGNIZED_NAME;
        *al = SSL_AD_UNRECOGNIZED_NAME;
@@ -856,8 +860,8 @@ int tls_parse_stoc_server_name(SSL *s, PACKET *pkt, X509 *x, size_t chainidx,
}
}


#ifndef OPENSSL_NO_EC
#ifndef OPENSSL_NO_EC
int tls_parse_stoc_ec_pt_formats(SSL *s, PACKET *pkt, X509 *x, size_t chainidx,
int tls_parse_stoc_ec_pt_formats(SSL *s, PACKET *pkt, unsigned int context,
                                 int *al)
                                 X509 *x, size_t chainidx, int *al)
{
{
    unsigned int ecpointformats_len;
    unsigned int ecpointformats_len;
    PACKET ecptformatlist;
    PACKET ecptformatlist;
@@ -891,8 +895,8 @@ int tls_parse_stoc_ec_pt_formats(SSL *s, PACKET *pkt, X509 *x, size_t chainidx,
}
}
#endif
#endif


int tls_parse_stoc_session_ticket(SSL *s, PACKET *pkt, X509 *x, size_t chainidx,
int tls_parse_stoc_session_ticket(SSL *s, PACKET *pkt, unsigned int context,
                                  int *al)
                                  X509 *x, size_t chainidx, int *al)
{
{
    if (s->ext.session_ticket_cb != NULL &&
    if (s->ext.session_ticket_cb != NULL &&
        !s->ext.session_ticket_cb(s, PACKET_data(pkt),
        !s->ext.session_ticket_cb(s, PACKET_data(pkt),
@@ -913,8 +917,8 @@ int tls_parse_stoc_session_ticket(SSL *s, PACKET *pkt, X509 *x, size_t chainidx,
}
}


#ifndef OPENSSL_NO_OCSP
#ifndef OPENSSL_NO_OCSP
int tls_parse_stoc_status_request(SSL *s, PACKET *pkt, X509 *x, size_t chainidx,
int tls_parse_stoc_status_request(SSL *s, PACKET *pkt, unsigned int context,
                                  int *al)
                                  X509 *x, size_t chainidx, int *al)
{
{
    /*
    /*
     * MUST only be sent if we've requested a status
     * MUST only be sent if we've requested a status
@@ -944,7 +948,8 @@ int tls_parse_stoc_status_request(SSL *s, PACKET *pkt, X509 *x, size_t chainidx,




#ifndef OPENSSL_NO_CT
#ifndef OPENSSL_NO_CT
int tls_parse_stoc_sct(SSL *s, PACKET *pkt, X509 *x, size_t chainidx, int *al)
int tls_parse_stoc_sct(SSL *s, PACKET *pkt, unsigned int context, X509 *x,
                       size_t chainidx, int *al)
{
{
    /*
    /*
     * Only take it if we asked for it - i.e if there is no CT validation
     * Only take it if we asked for it - i.e if there is no CT validation
@@ -997,7 +1002,8 @@ static int ssl_next_proto_validate(PACKET *pkt)
    return 1;
    return 1;
}
}


int tls_parse_stoc_npn(SSL *s, PACKET *pkt, X509 *x, size_t chainidx, int *al)
int tls_parse_stoc_npn(SSL *s, PACKET *pkt, unsigned int context, X509 *x,
                       size_t chainidx, int *al)
{
{
    unsigned char *selected;
    unsigned char *selected;
    unsigned char selected_len;
    unsigned char selected_len;
@@ -1047,7 +1053,8 @@ int tls_parse_stoc_npn(SSL *s, PACKET *pkt, X509 *x, size_t chainidx, int *al)
}
}
#endif
#endif


int tls_parse_stoc_alpn(SSL *s, PACKET *pkt, X509 *x, size_t chainidx, int *al)
int tls_parse_stoc_alpn(SSL *s, PACKET *pkt, unsigned int context, X509 *x,
                        size_t chainidx, int *al)
{
{
    size_t len;
    size_t len;


@@ -1084,8 +1091,8 @@ int tls_parse_stoc_alpn(SSL *s, PACKET *pkt, X509 *x, size_t chainidx, int *al)
}
}


#ifndef OPENSSL_NO_SRTP
#ifndef OPENSSL_NO_SRTP
int tls_parse_stoc_use_srtp(SSL *s, PACKET *pkt, X509 *x, size_t chainidx,
int tls_parse_stoc_use_srtp(SSL *s, PACKET *pkt, unsigned int context, X509 *x,
                            int *al)
                            size_t chainidx, int *al)
{
{
    unsigned int id, ct, mki;
    unsigned int id, ct, mki;
    int i;
    int i;
@@ -1138,7 +1145,8 @@ int tls_parse_stoc_use_srtp(SSL *s, PACKET *pkt, X509 *x, size_t chainidx,
}
}
#endif
#endif


int tls_parse_stoc_etm(SSL *s, PACKET *pkt, X509 *x, size_t chainidx, int *al)
int tls_parse_stoc_etm(SSL *s, PACKET *pkt, unsigned int context, X509 *x,
                       size_t chainidx, int *al)
{
{
    /* Ignore if inappropriate ciphersuite */
    /* Ignore if inappropriate ciphersuite */
    if (!(s->options & SSL_OP_NO_ENCRYPT_THEN_MAC)
    if (!(s->options & SSL_OP_NO_ENCRYPT_THEN_MAC)
@@ -1149,7 +1157,8 @@ int tls_parse_stoc_etm(SSL *s, PACKET *pkt, X509 *x, size_t chainidx, int *al)
    return 1;
    return 1;
}
}


int tls_parse_stoc_ems(SSL *s, PACKET *pkt, X509 *x, size_t chainidx, int *al)
int tls_parse_stoc_ems(SSL *s, PACKET *pkt, unsigned int context, X509 *x,
                       size_t chainidx, int *al)
{
{
    s->s3->flags |= TLS1_FLAGS_RECEIVED_EXTMS;
    s->s3->flags |= TLS1_FLAGS_RECEIVED_EXTMS;
    if (!s->hit)
    if (!s->hit)
@@ -1158,8 +1167,8 @@ int tls_parse_stoc_ems(SSL *s, PACKET *pkt, X509 *x, size_t chainidx, int *al)
    return 1;
    return 1;
}
}


int tls_parse_stoc_key_share(SSL *s, PACKET *pkt, X509 *x, size_t chainidx,
int tls_parse_stoc_key_share(SSL *s, PACKET *pkt, unsigned int context, X509 *x,
                             int *al)
                             size_t chainidx, int *al)
{
{
#ifndef OPENSSL_NO_TLS1_3
#ifndef OPENSSL_NO_TLS1_3
    unsigned int group_id;
    unsigned int group_id;
@@ -1222,7 +1231,8 @@ int tls_parse_stoc_key_share(SSL *s, PACKET *pkt, X509 *x, size_t chainidx,
    return 1;
    return 1;
}
}


int tls_parse_stoc_psk(SSL *s, PACKET *pkt, X509 *x, size_t chainidx, int *al)
int tls_parse_stoc_psk(SSL *s, PACKET *pkt, unsigned int context, X509 *x,
                       size_t chainidx, int *al)
{
{
#ifndef OPENSSL_NO_TLS1_3
#ifndef OPENSSL_NO_TLS1_3
    unsigned int identity;
    unsigned int identity;
+59 −50
Original line number Original line Diff line number Diff line
@@ -14,8 +14,8 @@
/*
/*
 * Parse the client's renegotiation binding and abort if it's not right
 * Parse the client's renegotiation binding and abort if it's not right
 */
 */
int tls_parse_ctos_renegotiate(SSL *s, PACKET *pkt, X509 *x, size_t chainidx,
int tls_parse_ctos_renegotiate(SSL *s, PACKET *pkt, unsigned int context,
                               int *al)
                               X509 *x, size_t chainidx, int *al)
{
{
    unsigned int ilen;
    unsigned int ilen;
    const unsigned char *data;
    const unsigned char *data;
@@ -73,8 +73,8 @@ int tls_parse_ctos_renegotiate(SSL *s, PACKET *pkt, X509 *x, size_t chainidx,
 *   extension.
 *   extension.
 * - On session reconnect, the servername extension may be absent.
 * - On session reconnect, the servername extension may be absent.
 */
 */
int tls_parse_ctos_server_name(SSL *s, PACKET *pkt, X509 *x, size_t chainidx,
int tls_parse_ctos_server_name(SSL *s, PACKET *pkt, unsigned int context,
                               int *al)
                               X509 *x, size_t chainidx, int *al)
{
{
    unsigned int servname_type;
    unsigned int servname_type;
    PACKET sni, hostname;
    PACKET sni, hostname;
@@ -136,7 +136,8 @@ int tls_parse_ctos_server_name(SSL *s, PACKET *pkt, X509 *x, size_t chainidx,
}
}


#ifndef OPENSSL_NO_SRP
#ifndef OPENSSL_NO_SRP
int tls_parse_ctos_srp(SSL *s, PACKET *pkt, X509 *x, size_t chainidx, int *al)
int tls_parse_ctos_srp(SSL *s, PACKET *pkt, unsigned int context, X509 *x,
                       size_t chainidx, int *al)
{
{
    PACKET srp_I;
    PACKET srp_I;


@@ -160,8 +161,8 @@ int tls_parse_ctos_srp(SSL *s, PACKET *pkt, X509 *x, size_t chainidx, int *al)
#endif
#endif


#ifndef OPENSSL_NO_EC
#ifndef OPENSSL_NO_EC
int tls_parse_ctos_ec_pt_formats(SSL *s, PACKET *pkt, X509 *x, size_t chainidx,
int tls_parse_ctos_ec_pt_formats(SSL *s, PACKET *pkt, unsigned int context,
                                 int *al)
                                 X509 *x, size_t chainidx, int *al)
{
{
    PACKET ec_point_format_list;
    PACKET ec_point_format_list;


@@ -184,8 +185,8 @@ int tls_parse_ctos_ec_pt_formats(SSL *s, PACKET *pkt, X509 *x, size_t chainidx,
}
}
#endif                          /* OPENSSL_NO_EC */
#endif                          /* OPENSSL_NO_EC */


int tls_parse_ctos_session_ticket(SSL *s, PACKET *pkt, X509 *x, size_t chainidx,
int tls_parse_ctos_session_ticket(SSL *s, PACKET *pkt, unsigned int context,
                                  int *al)
                                  X509 *x, size_t chainidx, int *al)
{
{
    if (s->ext.session_ticket_cb &&
    if (s->ext.session_ticket_cb &&
            !s->ext.session_ticket_cb(s, PACKET_data(pkt),
            !s->ext.session_ticket_cb(s, PACKET_data(pkt),
@@ -198,8 +199,8 @@ int tls_parse_ctos_session_ticket(SSL *s, PACKET *pkt, X509 *x, size_t chainidx,
    return 1;
    return 1;
}
}


int tls_parse_ctos_sig_algs(SSL *s, PACKET *pkt, X509 *x, size_t chainidx,
int tls_parse_ctos_sig_algs(SSL *s, PACKET *pkt, unsigned int context, X509 *x,
                            int *al)
                            size_t chainidx, int *al)
{
{
    PACKET supported_sig_algs;
    PACKET supported_sig_algs;


@@ -218,8 +219,8 @@ int tls_parse_ctos_sig_algs(SSL *s, PACKET *pkt, X509 *x, size_t chainidx,
}
}


#ifndef OPENSSL_NO_OCSP
#ifndef OPENSSL_NO_OCSP
int tls_parse_ctos_status_request(SSL *s, PACKET *pkt, X509 *x, size_t chainidx,
int tls_parse_ctos_status_request(SSL *s, PACKET *pkt, unsigned int context,
                                  int *al)
                                  X509 *x, size_t chainidx, int *al)
{
{
    PACKET responder_id_list, exts;
    PACKET responder_id_list, exts;


@@ -317,7 +318,8 @@ int tls_parse_ctos_status_request(SSL *s, PACKET *pkt, X509 *x, size_t chainidx,
#endif
#endif


#ifndef OPENSSL_NO_NEXTPROTONEG
#ifndef OPENSSL_NO_NEXTPROTONEG
int tls_parse_ctos_npn(SSL *s, PACKET *pkt, X509 *x, size_t chainidx, int *al)
int tls_parse_ctos_npn(SSL *s, PACKET *pkt, unsigned int context, X509 *x,
                       size_t chainidx, int *al)
{
{
    /*
    /*
     * We shouldn't accept this extension on a
     * We shouldn't accept this extension on a
@@ -335,7 +337,8 @@ int tls_parse_ctos_npn(SSL *s, PACKET *pkt, X509 *x, size_t chainidx, int *al)
 * extension, not including type and length. |al| is a pointer to the alert
 * extension, not including type and length. |al| is a pointer to the alert
 * value to send in the event of a failure. Returns: 1 on success, 0 on error.
 * value to send in the event of a failure. Returns: 1 on success, 0 on error.
 */
 */
int tls_parse_ctos_alpn(SSL *s, PACKET *pkt, X509 *x, size_t chainidx, int *al)
int tls_parse_ctos_alpn(SSL *s, PACKET *pkt, unsigned int context, X509 *x,
                        size_t chainidx, int *al)
{
{
    PACKET protocol_list, save_protocol_list, protocol;
    PACKET protocol_list, save_protocol_list, protocol;


@@ -368,8 +371,8 @@ int tls_parse_ctos_alpn(SSL *s, PACKET *pkt, X509 *x, size_t chainidx, int *al)
}
}


#ifndef OPENSSL_NO_SRTP
#ifndef OPENSSL_NO_SRTP
int tls_parse_ctos_use_srtp(SSL *s, PACKET *pkt, X509 *x, size_t chainidx,
int tls_parse_ctos_use_srtp(SSL *s, PACKET *pkt, unsigned int context, X509 *x,
                            int *al)
                            size_t chainidx, int *al)
{
{
    STACK_OF(SRTP_PROTECTION_PROFILE) *srvr;
    STACK_OF(SRTP_PROTECTION_PROFILE) *srvr;
    unsigned int ct, mki_len, id;
    unsigned int ct, mki_len, id;
@@ -439,7 +442,8 @@ int tls_parse_ctos_use_srtp(SSL *s, PACKET *pkt, X509 *x, size_t chainidx,
}
}
#endif
#endif


int tls_parse_ctos_etm(SSL *s, PACKET *pkt, X509 *x, size_t chainidx, int *al)
int tls_parse_ctos_etm(SSL *s, PACKET *pkt, unsigned int context, X509 *x,
                       size_t chainidx, int *al)
{
{
    if (!(s->options & SSL_OP_NO_ENCRYPT_THEN_MAC))
    if (!(s->options & SSL_OP_NO_ENCRYPT_THEN_MAC))
        s->s3->flags |= TLS1_FLAGS_ENCRYPT_THEN_MAC;
        s->s3->flags |= TLS1_FLAGS_ENCRYPT_THEN_MAC;
@@ -483,8 +487,8 @@ static int check_in_list(SSL *s, unsigned int group_id,
 * the raw PACKET data for the extension. Returns 1 on success or 0 on failure.
 * the raw PACKET data for the extension. Returns 1 on success or 0 on failure.
 * If a failure occurs then |*al| is set to an appropriate alert value.
 * If a failure occurs then |*al| is set to an appropriate alert value.
 */
 */
int tls_parse_ctos_psk_kex_modes(SSL *s, PACKET *pkt, X509 *x, size_t chainidx,
int tls_parse_ctos_psk_kex_modes(SSL *s, PACKET *pkt, unsigned int context,
                                 int *al)
                                 X509 *x, size_t chainidx, int *al)
{
{
#ifndef OPENSSL_NO_TLS1_3
#ifndef OPENSSL_NO_TLS1_3
    PACKET psk_kex_modes;
    PACKET psk_kex_modes;
@@ -512,8 +516,8 @@ int tls_parse_ctos_psk_kex_modes(SSL *s, PACKET *pkt, X509 *x, size_t chainidx,
 * the raw PACKET data for the extension. Returns 1 on success or 0 on failure.
 * the raw PACKET data for the extension. Returns 1 on success or 0 on failure.
 * If a failure occurs then |*al| is set to an appropriate alert value.
 * If a failure occurs then |*al| is set to an appropriate alert value.
 */
 */
int tls_parse_ctos_key_share(SSL *s, PACKET *pkt, X509 *x, size_t chainidx,
int tls_parse_ctos_key_share(SSL *s, PACKET *pkt, unsigned int context, X509 *x,
                             int *al)
                             size_t chainidx, int *al)
{
{
#ifndef OPENSSL_NO_TLS1_3
#ifndef OPENSSL_NO_TLS1_3
    unsigned int group_id;
    unsigned int group_id;
@@ -642,8 +646,8 @@ int tls_parse_ctos_key_share(SSL *s, PACKET *pkt, X509 *x, size_t chainidx,
}
}


#ifndef OPENSSL_NO_EC
#ifndef OPENSSL_NO_EC
int tls_parse_ctos_supported_groups(SSL *s, PACKET *pkt, X509 *x,
int tls_parse_ctos_supported_groups(SSL *s, PACKET *pkt, unsigned int context,
                                    size_t chainidx, int *al)
                                    X509 *x, size_t chainidx, int *al)
{
{
    PACKET supported_groups_list;
    PACKET supported_groups_list;


@@ -666,7 +670,8 @@ int tls_parse_ctos_supported_groups(SSL *s, PACKET *pkt, X509 *x,
}
}
#endif
#endif


int tls_parse_ctos_ems(SSL *s, PACKET *pkt, X509 *x, size_t chainidx, int *al)
int tls_parse_ctos_ems(SSL *s, PACKET *pkt, unsigned int context, X509 *x,
                       size_t chainidx, int *al)
{
{
    /* The extension must always be empty */
    /* The extension must always be empty */
    if (PACKET_remaining(pkt) != 0) {
    if (PACKET_remaining(pkt) != 0) {
@@ -679,7 +684,8 @@ int tls_parse_ctos_ems(SSL *s, PACKET *pkt, X509 *x, size_t chainidx, int *al)
    return 1;
    return 1;
}
}


int tls_parse_ctos_psk(SSL *s, PACKET *pkt, X509 *x, size_t chainidx, int *al)
int tls_parse_ctos_psk(SSL *s, PACKET *pkt, unsigned int context, X509 *x,
                       size_t chainidx, int *al)
{
{
    PACKET identities, binders, binder;
    PACKET identities, binders, binder;
    size_t binderoffset, hashsize;
    size_t binderoffset, hashsize;
@@ -780,8 +786,8 @@ err:
/*
/*
 * Add the server's renegotiation binding
 * Add the server's renegotiation binding
 */
 */
int tls_construct_stoc_renegotiate(SSL *s, WPACKET *pkt, X509 *x, size_t
int tls_construct_stoc_renegotiate(SSL *s, WPACKET *pkt, unsigned int context,
                                   chainidx, int *al)
                                   X509 *x, size_t chainidx, int *al)
{
{
    if (!s->s3->send_connection_binding)
    if (!s->s3->send_connection_binding)
        return 1;
        return 1;
@@ -802,8 +808,8 @@ int tls_construct_stoc_renegotiate(SSL *s, WPACKET *pkt, X509 *x, size_t
    return 1;
    return 1;
}
}


int tls_construct_stoc_server_name(SSL *s, WPACKET *pkt, X509 *x,
int tls_construct_stoc_server_name(SSL *s, WPACKET *pkt, unsigned int context,
                                   size_t chainidx, int *al)
                                   X509 *x, size_t chainidx, int *al)
{
{
    if (s->hit || s->servername_done != 1
    if (s->hit || s->servername_done != 1
            || s->session->ext.hostname == NULL)
            || s->session->ext.hostname == NULL)
@@ -819,8 +825,8 @@ int tls_construct_stoc_server_name(SSL *s, WPACKET *pkt, X509 *x,
}
}


#ifndef OPENSSL_NO_EC
#ifndef OPENSSL_NO_EC
int tls_construct_stoc_ec_pt_formats(SSL *s, WPACKET *pkt, X509 *x,
int tls_construct_stoc_ec_pt_formats(SSL *s, WPACKET *pkt, unsigned int context,
                                     size_t chainidx, int *al)
                                     X509 *x, size_t chainidx, int *al)
{
{
    unsigned long alg_k = s->s3->tmp.new_cipher->algorithm_mkey;
    unsigned long alg_k = s->s3->tmp.new_cipher->algorithm_mkey;
    unsigned long alg_a = s->s3->tmp.new_cipher->algorithm_auth;
    unsigned long alg_a = s->s3->tmp.new_cipher->algorithm_auth;
@@ -845,7 +851,8 @@ int tls_construct_stoc_ec_pt_formats(SSL *s, WPACKET *pkt, X509 *x,
}
}
#endif
#endif


int tls_construct_stoc_session_ticket(SSL *s, WPACKET *pkt, X509 *x,
int tls_construct_stoc_session_ticket(SSL *s, WPACKET *pkt,
                                      unsigned int context, X509 *x,
                                      size_t chainidx, int *al)
                                      size_t chainidx, int *al)
{
{
    if (!s->ext.ticket_expected || !tls_use_ticket(s)) {
    if (!s->ext.ticket_expected || !tls_use_ticket(s)) {
@@ -863,7 +870,8 @@ int tls_construct_stoc_session_ticket(SSL *s, WPACKET *pkt, X509 *x,
}
}


#ifndef OPENSSL_NO_OCSP
#ifndef OPENSSL_NO_OCSP
int tls_construct_stoc_status_request(SSL *s, WPACKET *pkt, X509 *x,
int tls_construct_stoc_status_request(SSL *s, WPACKET *pkt,
                                      unsigned int context, X509 *x,
                                      size_t chainidx, int *al)
                                      size_t chainidx, int *al)
{
{
    if (!s->ext.status_expected)
    if (!s->ext.status_expected)
@@ -894,7 +902,8 @@ int tls_construct_stoc_status_request(SSL *s, WPACKET *pkt, X509 *x,
#endif
#endif


#ifndef OPENSSL_NO_NEXTPROTONEG
#ifndef OPENSSL_NO_NEXTPROTONEG
int tls_construct_stoc_next_proto_neg(SSL *s, WPACKET *pkt, X509 *x,
int tls_construct_stoc_next_proto_neg(SSL *s, WPACKET *pkt,
                                      unsigned int context, X509 *x,
                                      size_t chainidx, int *al)
                                      size_t chainidx, int *al)
{
{
    const unsigned char *npa;
    const unsigned char *npa;
@@ -922,8 +931,8 @@ int tls_construct_stoc_next_proto_neg(SSL *s, WPACKET *pkt, X509 *x,
}
}
#endif
#endif


int tls_construct_stoc_alpn(SSL *s, WPACKET *pkt, X509 *x, size_t chainidx,
int tls_construct_stoc_alpn(SSL *s, WPACKET *pkt, unsigned int context, X509 *x,
                            int *al)
                            size_t chainidx, int *al)
{
{
    if (s->s3->alpn_selected == NULL)
    if (s->s3->alpn_selected == NULL)
        return 1;
        return 1;
@@ -944,8 +953,8 @@ int tls_construct_stoc_alpn(SSL *s, WPACKET *pkt, X509 *x, size_t chainidx,
}
}


#ifndef OPENSSL_NO_SRTP
#ifndef OPENSSL_NO_SRTP
int tls_construct_stoc_use_srtp(SSL *s, WPACKET *pkt, X509 *x, size_t chainidx,
int tls_construct_stoc_use_srtp(SSL *s, WPACKET *pkt, unsigned int context,
                                int *al)
                                X509 *x, size_t chainidx, int *al)
{
{
    if (s->srtp_profile == NULL)
    if (s->srtp_profile == NULL)
        return 1;
        return 1;
@@ -964,8 +973,8 @@ int tls_construct_stoc_use_srtp(SSL *s, WPACKET *pkt, X509 *x, size_t chainidx,
}
}
#endif
#endif


int tls_construct_stoc_etm(SSL *s, WPACKET *pkt, X509 *x, size_t chainidx,
int tls_construct_stoc_etm(SSL *s, WPACKET *pkt, unsigned int context, X509 *x,
                           int *al)
                           size_t chainidx, int *al)
{
{
    if ((s->s3->flags & TLS1_FLAGS_ENCRYPT_THEN_MAC) == 0)
    if ((s->s3->flags & TLS1_FLAGS_ENCRYPT_THEN_MAC) == 0)
        return 1;
        return 1;
@@ -991,8 +1000,8 @@ int tls_construct_stoc_etm(SSL *s, WPACKET *pkt, X509 *x, size_t chainidx,
    return 1;
    return 1;
}
}


int tls_construct_stoc_ems(SSL *s, WPACKET *pkt, X509 *x, size_t chainidx,
int tls_construct_stoc_ems(SSL *s, WPACKET *pkt, unsigned int context, X509 *x,
                           int *al)
                           size_t chainidx, int *al)
{
{
    if ((s->s3->flags & TLS1_FLAGS_RECEIVED_EXTMS) == 0)
    if ((s->s3->flags & TLS1_FLAGS_RECEIVED_EXTMS) == 0)
        return 1;
        return 1;
@@ -1006,8 +1015,8 @@ int tls_construct_stoc_ems(SSL *s, WPACKET *pkt, X509 *x, size_t chainidx,
    return 1;
    return 1;
}
}


int tls_construct_stoc_key_share(SSL *s, WPACKET *pkt, X509 *x, size_t chainidx,
int tls_construct_stoc_key_share(SSL *s, WPACKET *pkt, unsigned int context,
                                 int *al)
                                 X509 *x, size_t chainidx, int *al)
{
{
#ifndef OPENSSL_NO_TLS1_3
#ifndef OPENSSL_NO_TLS1_3
    unsigned char *encodedPoint;
    unsigned char *encodedPoint;
@@ -1065,8 +1074,8 @@ int tls_construct_stoc_key_share(SSL *s, WPACKET *pkt, X509 *x, size_t chainidx,
    return 1;
    return 1;
}
}


int tls_construct_stoc_cryptopro_bug(SSL *s, WPACKET *pkt, X509 *x,
int tls_construct_stoc_cryptopro_bug(SSL *s, WPACKET *pkt, unsigned int context,
                                     size_t chainidx, int *al)
                                     X509 *x, size_t chainidx, int *al)
{
{
    const unsigned char cryptopro_ext[36] = {
    const unsigned char cryptopro_ext[36] = {
        0xfd, 0xe8,         /* 65000 */
        0xfd, 0xe8,         /* 65000 */
@@ -1090,8 +1099,8 @@ int tls_construct_stoc_cryptopro_bug(SSL *s, WPACKET *pkt, X509 *x,
    return 1;
    return 1;
}
}


int tls_construct_stoc_psk(SSL *s, WPACKET *pkt, X509 *x, size_t chainidx,
int tls_construct_stoc_psk(SSL *s, WPACKET *pkt, unsigned int context, X509 *x,
                           int *al)
                           size_t chainidx, int *al)
{
{
    if (!s->hit)
    if (!s->hit)
        return 1;
        return 1;
+122 −103

File changed.

Preview size limit exceeded, changes collapsed.