Make the context available to the extensions parse and construction funcs (61138358) · Commits · CYBER - Cyber Security / TS 103 523 MSP / ETS / ETS OpenSSL

ssl/statem/extensions.c

+14 −11

Original line number	Original line	Diff line number	Diff line
	@@ -57,15 +57,17 @@ typedef struct extensions_definition_st {
	*/		*/
	int (init)(SSL s, unsigned int context);		int (init)(SSL s, unsigned int context);
	/* Parse extension sent from client to server */		/* Parse extension sent from client to server */
	int (parse_ctos)(SSL s, PACKET pkt, X509 x, size_t chainidx, int *al);		int (parse_ctos)(SSL s, PACKET pkt, unsigned int context, X509 x,
			size_t chainidx, int *al);
	/* Parse extension send from server to client */		/* Parse extension send from server to client */
	int (parse_stoc)(SSL s, PACKET pkt, X509 x, size_t chainidx, int *al);		int (parse_stoc)(SSL s, PACKET pkt, unsigned int context, X509 x,
			size_t chainidx, int *al);
	/* Construct extension sent from server to client */		/* Construct extension sent from server to client */
	int (construct_stoc)(SSL s, WPACKET pkt, X509 x, size_t chainidx,		int (construct_stoc)(SSL s, WPACKET pkt, unsigned int context, X509 x,
	int *al);		size_t chainidx, int *al);
	/* Construct extension sent from client to server */		/* Construct extension sent from client to server */
	int (construct_ctos)(SSL s, WPACKET pkt, X509 x, size_t chainidx,		int (construct_ctos)(SSL s, WPACKET pkt, unsigned int context, X509 x,
	int *al);		size_t chainidx, int *al);
	/*		/*
	* Finalise extension after parsing. Always called where an extensions was		* Finalise extension after parsing. Always called where an extensions was
	* initialised even if the extension was not present. \|sent\| is set to 1 if		* initialised even if the extension was not present. \|sent\| is set to 1 if
	@@ -470,7 +472,8 @@ int tls_parse_extension(SSL *s, TLSEXT_INDEX idx, int context,
	RAW_EXTENSION exts, X509 x, size_t chainidx, int *al)		RAW_EXTENSION exts, X509 x, size_t chainidx, int *al)
	{		{
	RAW_EXTENSION *currext = &exts[idx];		RAW_EXTENSION *currext = &exts[idx];
	int (parser)(SSL s, PACKET pkt, X509 x, size_t chainidx, int *al) = NULL;		int (parser)(SSL s, PACKET pkt, unsigned int context, X509 x,
			size_t chainidx, int *al) = NULL;

	/* Skip if the extension is not present */		/* Skip if the extension is not present */
	if (!currext->present)		if (!currext->present)
	@@ -499,7 +502,7 @@ int tls_parse_extension(SSL *s, TLSEXT_INDEX idx, int context,
	parser = s->server ? extdef->parse_ctos : extdef->parse_stoc;		parser = s->server ? extdef->parse_ctos : extdef->parse_stoc;

	if (parser != NULL)		if (parser != NULL)
	return parser(s, &currext->data, x, chainidx, al);		return parser(s, &currext->data, context, x, chainidx, al);

	/*		/*
	* If the parser is NULL we fall through to the custom extension		* If the parser is NULL we fall through to the custom extension
	@@ -633,8 +636,8 @@ int tls_construct_extensions(SSL s, WPACKET pkt, unsigned int context,
	}		}

	for (i = 0, thisexd = ext_defs; i < OSSL_NELEM(ext_defs); i++, thisexd++) {		for (i = 0, thisexd = ext_defs; i < OSSL_NELEM(ext_defs); i++, thisexd++) {
	int (construct)(SSL s, WPACKET pkt, X509 x, size_t chainidx,		int (construct)(SSL s, WPACKET pkt, unsigned int context, X509 x,
	int *al);		size_t chainidx, int *al);

	/* Skip if not relevant for our context */		/* Skip if not relevant for our context */
	if ((thisexd->context & context) == 0)		if ((thisexd->context & context) == 0)
	@@ -661,7 +664,7 @@ int tls_construct_extensions(SSL s, WPACKET pkt, unsigned int context,
	\|\| construct == NULL)		\|\| construct == NULL)
	continue;		continue;

	if (!construct(s, pkt, x, chainidx, &tmpal))		if (!construct(s, pkt, context, x, chainidx, &tmpal))
	goto err;		goto err;
	}		}

ssl/statem/extensions_clnt.c

+64 −54

Original line number	Original line	Diff line number	Diff line
	@@ -12,8 +12,8 @@
	#include "../ssl_locl.h"		#include "../ssl_locl.h"
	#include "statem_locl.h"		#include "statem_locl.h"

	int tls_construct_ctos_renegotiate(SSL s, WPACKET pkt, X509 *x,		int tls_construct_ctos_renegotiate(SSL s, WPACKET pkt, unsigned int context,
	size_t chainidx, int *al)		X509 x, size_t chainidx, int al)
	{		{
	/* Add RI if renegotiating */		/* Add RI if renegotiating */
	if (!s->renegotiate)		if (!s->renegotiate)
	@@ -31,8 +31,8 @@ int tls_construct_ctos_renegotiate(SSL s, WPACKET pkt, X509 *x,
	return 1;		return 1;
	}		}

	int tls_construct_ctos_server_name(SSL s, WPACKET pkt, X509 *x,		int tls_construct_ctos_server_name(SSL s, WPACKET pkt, unsigned int context,
	size_t chainidx, int *al)		X509 x, size_t chainidx, int al)
	{		{
	if (s->ext.hostname == NULL)		if (s->ext.hostname == NULL)
	return 1;		return 1;
	@@ -56,8 +56,8 @@ int tls_construct_ctos_server_name(SSL s, WPACKET pkt, X509 *x,
	}		}

	#ifndef OPENSSL_NO_SRP		#ifndef OPENSSL_NO_SRP
	int tls_construct_ctos_srp(SSL s, WPACKET pkt, X509 *x, size_t chainidx,		int tls_construct_ctos_srp(SSL s, WPACKET pkt, unsigned int context, X509 *x,
	int *al)		size_t chainidx, int *al)
	{		{
	/* Add SRP username if there is one */		/* Add SRP username if there is one */
	if (s->srp_ctx.login == NULL)		if (s->srp_ctx.login == NULL)
	@@ -108,8 +108,8 @@ static int use_ecc(SSL *s)
	return i < end;		return i < end;
	}		}

	int tls_construct_ctos_ec_pt_formats(SSL s, WPACKET pkt, X509 *x,		int tls_construct_ctos_ec_pt_formats(SSL s, WPACKET pkt, unsigned int context,
	size_t chainidx, int *al)		X509 x, size_t chainidx, int al)
	{		{
	const unsigned char *pformats;		const unsigned char *pformats;
	size_t num_formats;		size_t num_formats;
	@@ -132,7 +132,8 @@ int tls_construct_ctos_ec_pt_formats(SSL s, WPACKET pkt, X509 *x,
	return 1;		return 1;
	}		}

	int tls_construct_ctos_supported_groups(SSL s, WPACKET pkt, X509 *x,		int tls_construct_ctos_supported_groups(SSL s, WPACKET pkt,
			unsigned int context, X509 *x,
	size_t chainidx, int *al)		size_t chainidx, int *al)
	{		{
	const unsigned char pcurves = NULL, pcurvestmp;		const unsigned char pcurves = NULL, pcurvestmp;
	@@ -182,7 +183,8 @@ int tls_construct_ctos_supported_groups(SSL s, WPACKET pkt, X509 *x,
	}		}
	#endif		#endif

	int tls_construct_ctos_session_ticket(SSL s, WPACKET pkt, X509 *x,		int tls_construct_ctos_session_ticket(SSL s, WPACKET pkt,
			unsigned int context, X509 *x,
	size_t chainidx, int *al)		size_t chainidx, int *al)
	{		{
	size_t ticklen;		size_t ticklen;
	@@ -223,8 +225,8 @@ int tls_construct_ctos_session_ticket(SSL s, WPACKET pkt, X509 *x,
	return 1;		return 1;
	}		}

	int tls_construct_ctos_sig_algs(SSL s, WPACKET pkt, X509 *x, size_t chainidx,		int tls_construct_ctos_sig_algs(SSL s, WPACKET pkt, unsigned int context,
	int *al)		X509 x, size_t chainidx, int al)
	{		{
	size_t salglen;		size_t salglen;
	const uint16_t *salg;		const uint16_t *salg;
	@@ -249,7 +251,8 @@ int tls_construct_ctos_sig_algs(SSL s, WPACKET pkt, X509 *x, size_t chainidx,
	}		}

	#ifndef OPENSSL_NO_OCSP		#ifndef OPENSSL_NO_OCSP
	int tls_construct_ctos_status_request(SSL s, WPACKET pkt, X509 *x,		int tls_construct_ctos_status_request(SSL s, WPACKET pkt,
			unsigned int context, X509 *x,
	size_t chainidx, int *al)		size_t chainidx, int *al)
	{		{
	int i;		int i;
	@@ -316,8 +319,8 @@ int tls_construct_ctos_status_request(SSL s, WPACKET pkt, X509 *x,
	#endif		#endif

	#ifndef OPENSSL_NO_NEXTPROTONEG		#ifndef OPENSSL_NO_NEXTPROTONEG
	int tls_construct_ctos_npn(SSL s, WPACKET pkt, X509 *x, size_t chainidx,		int tls_construct_ctos_npn(SSL s, WPACKET pkt, unsigned int context, X509 *x,
	int *al)		size_t chainidx, int *al)
	{		{
	if (s->ctx->ext.npn_select_cb == NULL \|\| !SSL_IS_FIRST_HANDSHAKE(s))		if (s->ctx->ext.npn_select_cb == NULL \|\| !SSL_IS_FIRST_HANDSHAKE(s))
	return 1;		return 1;
	@@ -336,8 +339,8 @@ int tls_construct_ctos_npn(SSL s, WPACKET pkt, X509 *x, size_t chainidx,
	}		}
	#endif		#endif

	int tls_construct_ctos_alpn(SSL s, WPACKET pkt, X509 *x, size_t chainidx,		int tls_construct_ctos_alpn(SSL s, WPACKET pkt, unsigned int context, X509 *x,
	int *al)		size_t chainidx, int *al)
	{		{
	s->s3->alpn_sent = 0;		s->s3->alpn_sent = 0;

	@@ -360,8 +363,8 @@ int tls_construct_ctos_alpn(SSL s, WPACKET pkt, X509 *x, size_t chainidx,


	#ifndef OPENSSL_NO_SRTP		#ifndef OPENSSL_NO_SRTP
	int tls_construct_ctos_use_srtp(SSL s, WPACKET pkt, X509 *x, size_t chainidx,		int tls_construct_ctos_use_srtp(SSL s, WPACKET pkt, unsigned int context,
	int *al)		X509 x, size_t chainidx, int al)
	{		{
	STACK_OF(SRTP_PROTECTION_PROFILE) *clnt = SSL_get_srtp_profiles(s);		STACK_OF(SRTP_PROTECTION_PROFILE) *clnt = SSL_get_srtp_profiles(s);
	int i, end;		int i, end;
	@@ -400,8 +403,8 @@ int tls_construct_ctos_use_srtp(SSL s, WPACKET pkt, X509 *x, size_t chainidx,
	}		}
	#endif		#endif

	int tls_construct_ctos_etm(SSL s, WPACKET pkt, X509 *x, size_t chainidx,		int tls_construct_ctos_etm(SSL s, WPACKET pkt, unsigned int context, X509 *x,
	int *al)		size_t chainidx, int *al)
	{		{
	if (s->options & SSL_OP_NO_ENCRYPT_THEN_MAC)		if (s->options & SSL_OP_NO_ENCRYPT_THEN_MAC)
	return 1;		return 1;
	@@ -416,8 +419,8 @@ int tls_construct_ctos_etm(SSL s, WPACKET pkt, X509 *x, size_t chainidx,
	}		}

	#ifndef OPENSSL_NO_CT		#ifndef OPENSSL_NO_CT
	int tls_construct_ctos_sct(SSL s, WPACKET pkt, X509 *x, size_t chainidx,		int tls_construct_ctos_sct(SSL s, WPACKET pkt, unsigned int context, X509 *x,
	int *al)		size_t chainidx, int *al)
	{		{
	if (s->ct_validation_callback == NULL)		if (s->ct_validation_callback == NULL)
	return 1;		return 1;
	@@ -436,8 +439,8 @@ int tls_construct_ctos_sct(SSL s, WPACKET pkt, X509 *x, size_t chainidx,
	}		}
	#endif		#endif

	int tls_construct_ctos_ems(SSL s, WPACKET pkt, X509 *x, size_t chainidx,		int tls_construct_ctos_ems(SSL s, WPACKET pkt, unsigned int context, X509 *x,
	int *al)		size_t chainidx, int *al)
	{		{
	if (!WPACKET_put_bytes_u16(pkt, TLSEXT_TYPE_extended_master_secret)		if (!WPACKET_put_bytes_u16(pkt, TLSEXT_TYPE_extended_master_secret)
	\|\| !WPACKET_put_bytes_u16(pkt, 0)) {		\|\| !WPACKET_put_bytes_u16(pkt, 0)) {
	@@ -448,7 +451,8 @@ int tls_construct_ctos_ems(SSL s, WPACKET pkt, X509 *x, size_t chainidx,
	return 1;		return 1;
	}		}

	int tls_construct_ctos_supported_versions(SSL s, WPACKET pkt, X509 *x,		int tls_construct_ctos_supported_versions(SSL s, WPACKET pkt,
			unsigned int context, X509 *x,
	size_t chainidx, int *al)		size_t chainidx, int *al)
	{		{
	int currv, min_version, max_version, reason;		int currv, min_version, max_version, reason;
	@@ -499,8 +503,8 @@ int tls_construct_ctos_supported_versions(SSL s, WPACKET pkt, X509 *x,
	* Construct a psk_kex_modes extension. We only have two modes we know about		* Construct a psk_kex_modes extension. We only have two modes we know about
	* at this stage, so we send both.		* at this stage, so we send both.
	*/		*/
	int tls_construct_ctos_psk_kex_modes(SSL s, WPACKET pkt, X509 *x,		int tls_construct_ctos_psk_kex_modes(SSL s, WPACKET pkt, unsigned int context,
	size_t chainidx, int *al)		X509 x, size_t chainidx, int al)
	{		{
	#ifndef OPENSSL_NO_TLS1_3		#ifndef OPENSSL_NO_TLS1_3
	/*		/*
	@@ -524,8 +528,8 @@ int tls_construct_ctos_psk_kex_modes(SSL s, WPACKET pkt, X509 *x,
	return 1;		return 1;
	}		}

	int tls_construct_ctos_key_share(SSL s, WPACKET pkt, X509 *x, size_t chainidx,		int tls_construct_ctos_key_share(SSL s, WPACKET pkt, unsigned int context,
	int *al)		X509 x, size_t chainidx, int al)
	{		{
	#ifndef OPENSSL_NO_TLS1_3		#ifndef OPENSSL_NO_TLS1_3
	size_t i, sharessent = 0, num_curves = 0;		size_t i, sharessent = 0, num_curves = 0;
	@@ -615,8 +619,8 @@ int tls_construct_ctos_key_share(SSL s, WPACKET pkt, X509 *x, size_t chainidx,
	#define F5_WORKAROUND_MIN_MSG_LEN 0xff		#define F5_WORKAROUND_MIN_MSG_LEN 0xff
	#define F5_WORKAROUND_MAX_MSG_LEN 0x200		#define F5_WORKAROUND_MAX_MSG_LEN 0x200

	int tls_construct_ctos_padding(SSL s, WPACKET pkt, X509 *x, size_t chainidx,		int tls_construct_ctos_padding(SSL s, WPACKET pkt, unsigned int context,
	int *al)		X509 x, size_t chainidx, int al)
	{		{
	unsigned char *padbytes;		unsigned char *padbytes;
	size_t hlen;		size_t hlen;
	@@ -662,8 +666,8 @@ int tls_construct_ctos_padding(SSL s, WPACKET pkt, X509 *x, size_t chainidx,
	/*		/*
	* Construct the pre_shared_key extension		* Construct the pre_shared_key extension
	*/		*/
	int tls_construct_ctos_psk(SSL s, WPACKET pkt, X509 *x, size_t chainidx,		int tls_construct_ctos_psk(SSL s, WPACKET pkt, unsigned int context, X509 *x,
	int *al)		size_t chainidx, int *al)
	{		{
	#ifndef OPENSSL_NO_TLS1_3		#ifndef OPENSSL_NO_TLS1_3
	uint32_t now, agesec, agems;		uint32_t now, agesec, agems;
	@@ -774,8 +778,8 @@ int tls_construct_ctos_psk(SSL s, WPACKET pkt, X509 *x, size_t chainidx,
	/*		/*
	* Parse the server's renegotiation binding and abort if it's not right		* Parse the server's renegotiation binding and abort if it's not right
	*/		*/
	int tls_parse_stoc_renegotiate(SSL s, PACKET pkt, X509 *x, size_t chainidx,		int tls_parse_stoc_renegotiate(SSL s, PACKET pkt, unsigned int context,
	int *al)		X509 x, size_t chainidx, int al)
	{		{
	size_t expected_len = s->s3->previous_client_finished_len		size_t expected_len = s->s3->previous_client_finished_len
	+ s->s3->previous_server_finished_len;		+ s->s3->previous_server_finished_len;
	@@ -832,8 +836,8 @@ int tls_parse_stoc_renegotiate(SSL s, PACKET pkt, X509 *x, size_t chainidx,
	return 1;		return 1;
	}		}

	int tls_parse_stoc_server_name(SSL s, PACKET pkt, X509 *x, size_t chainidx,		int tls_parse_stoc_server_name(SSL s, PACKET pkt, unsigned int context,
	int *al)		X509 x, size_t chainidx, int al)
	{		{
	if (s->ext.hostname == NULL \|\| PACKET_remaining(pkt) > 0) {		if (s->ext.hostname == NULL \|\| PACKET_remaining(pkt) > 0) {
	*al = SSL_AD_UNRECOGNIZED_NAME;		*al = SSL_AD_UNRECOGNIZED_NAME;
	@@ -856,8 +860,8 @@ int tls_parse_stoc_server_name(SSL s, PACKET pkt, X509 *x, size_t chainidx,
	}		}

	#ifndef OPENSSL_NO_EC		#ifndef OPENSSL_NO_EC
	int tls_parse_stoc_ec_pt_formats(SSL s, PACKET pkt, X509 *x, size_t chainidx,		int tls_parse_stoc_ec_pt_formats(SSL s, PACKET pkt, unsigned int context,
	int *al)		X509 x, size_t chainidx, int al)
	{		{
	unsigned int ecpointformats_len;		unsigned int ecpointformats_len;
	PACKET ecptformatlist;		PACKET ecptformatlist;
	@@ -891,8 +895,8 @@ int tls_parse_stoc_ec_pt_formats(SSL s, PACKET pkt, X509 *x, size_t chainidx,
	}		}
	#endif		#endif

	int tls_parse_stoc_session_ticket(SSL s, PACKET pkt, X509 *x, size_t chainidx,		int tls_parse_stoc_session_ticket(SSL s, PACKET pkt, unsigned int context,
	int *al)		X509 x, size_t chainidx, int al)
	{		{
	if (s->ext.session_ticket_cb != NULL &&		if (s->ext.session_ticket_cb != NULL &&
	!s->ext.session_ticket_cb(s, PACKET_data(pkt),		!s->ext.session_ticket_cb(s, PACKET_data(pkt),
	@@ -913,8 +917,8 @@ int tls_parse_stoc_session_ticket(SSL s, PACKET pkt, X509 *x, size_t chainidx,
	}		}

	#ifndef OPENSSL_NO_OCSP		#ifndef OPENSSL_NO_OCSP
	int tls_parse_stoc_status_request(SSL s, PACKET pkt, X509 *x, size_t chainidx,		int tls_parse_stoc_status_request(SSL s, PACKET pkt, unsigned int context,
	int *al)		X509 x, size_t chainidx, int al)
	{		{
	/*		/*
	* MUST only be sent if we've requested a status		* MUST only be sent if we've requested a status
	@@ -944,7 +948,8 @@ int tls_parse_stoc_status_request(SSL s, PACKET pkt, X509 *x, size_t chainidx,


	#ifndef OPENSSL_NO_CT		#ifndef OPENSSL_NO_CT
	int tls_parse_stoc_sct(SSL s, PACKET pkt, X509 x, size_t chainidx, int al)		int tls_parse_stoc_sct(SSL s, PACKET pkt, unsigned int context, X509 *x,
			size_t chainidx, int *al)
	{		{
	/*		/*
	* Only take it if we asked for it - i.e if there is no CT validation		* Only take it if we asked for it - i.e if there is no CT validation
	@@ -997,7 +1002,8 @@ static int ssl_next_proto_validate(PACKET *pkt)
	return 1;		return 1;
	}		}

	int tls_parse_stoc_npn(SSL s, PACKET pkt, X509 x, size_t chainidx, int al)		int tls_parse_stoc_npn(SSL s, PACKET pkt, unsigned int context, X509 *x,
			size_t chainidx, int *al)
	{		{
	unsigned char *selected;		unsigned char *selected;
	unsigned char selected_len;		unsigned char selected_len;
	@@ -1047,7 +1053,8 @@ int tls_parse_stoc_npn(SSL s, PACKET pkt, X509 x, size_t chainidx, int al)
	}		}
	#endif		#endif

	int tls_parse_stoc_alpn(SSL s, PACKET pkt, X509 x, size_t chainidx, int al)		int tls_parse_stoc_alpn(SSL s, PACKET pkt, unsigned int context, X509 *x,
			size_t chainidx, int *al)
	{		{
	size_t len;		size_t len;

	@@ -1084,8 +1091,8 @@ int tls_parse_stoc_alpn(SSL s, PACKET pkt, X509 x, size_t chainidx, int al)
	}		}

	#ifndef OPENSSL_NO_SRTP		#ifndef OPENSSL_NO_SRTP
	int tls_parse_stoc_use_srtp(SSL s, PACKET pkt, X509 *x, size_t chainidx,		int tls_parse_stoc_use_srtp(SSL s, PACKET pkt, unsigned int context, X509 *x,
	int *al)		size_t chainidx, int *al)
	{		{
	unsigned int id, ct, mki;		unsigned int id, ct, mki;
	int i;		int i;
	@@ -1138,7 +1145,8 @@ int tls_parse_stoc_use_srtp(SSL s, PACKET pkt, X509 *x, size_t chainidx,
	}		}
	#endif		#endif

	int tls_parse_stoc_etm(SSL s, PACKET pkt, X509 x, size_t chainidx, int al)		int tls_parse_stoc_etm(SSL s, PACKET pkt, unsigned int context, X509 *x,
			size_t chainidx, int *al)
	{		{
	/* Ignore if inappropriate ciphersuite */		/* Ignore if inappropriate ciphersuite */
	if (!(s->options & SSL_OP_NO_ENCRYPT_THEN_MAC)		if (!(s->options & SSL_OP_NO_ENCRYPT_THEN_MAC)
	@@ -1149,7 +1157,8 @@ int tls_parse_stoc_etm(SSL s, PACKET pkt, X509 x, size_t chainidx, int al)
	return 1;		return 1;
	}		}

	int tls_parse_stoc_ems(SSL s, PACKET pkt, X509 x, size_t chainidx, int al)		int tls_parse_stoc_ems(SSL s, PACKET pkt, unsigned int context, X509 *x,
			size_t chainidx, int *al)
	{		{
	s->s3->flags \|= TLS1_FLAGS_RECEIVED_EXTMS;		s->s3->flags \|= TLS1_FLAGS_RECEIVED_EXTMS;
	if (!s->hit)		if (!s->hit)
	@@ -1158,8 +1167,8 @@ int tls_parse_stoc_ems(SSL s, PACKET pkt, X509 x, size_t chainidx, int al)
	return 1;		return 1;
	}		}

	int tls_parse_stoc_key_share(SSL s, PACKET pkt, X509 *x, size_t chainidx,		int tls_parse_stoc_key_share(SSL s, PACKET pkt, unsigned int context, X509 *x,
	int *al)		size_t chainidx, int *al)
	{		{
	#ifndef OPENSSL_NO_TLS1_3		#ifndef OPENSSL_NO_TLS1_3
	unsigned int group_id;		unsigned int group_id;
	@@ -1222,7 +1231,8 @@ int tls_parse_stoc_key_share(SSL s, PACKET pkt, X509 *x, size_t chainidx,
	return 1;		return 1;
	}		}

	int tls_parse_stoc_psk(SSL s, PACKET pkt, X509 x, size_t chainidx, int al)		int tls_parse_stoc_psk(SSL s, PACKET pkt, unsigned int context, X509 *x,
			size_t chainidx, int *al)
	{		{
	#ifndef OPENSSL_NO_TLS1_3		#ifndef OPENSSL_NO_TLS1_3
	unsigned int identity;		unsigned int identity;

ssl/statem/extensions_srvr.c

+59 −50

Original line number	Original line	Diff line number	Diff line
	@@ -14,8 +14,8 @@
	/*		/*
	* Parse the client's renegotiation binding and abort if it's not right		* Parse the client's renegotiation binding and abort if it's not right
	*/		*/
	int tls_parse_ctos_renegotiate(SSL s, PACKET pkt, X509 *x, size_t chainidx,		int tls_parse_ctos_renegotiate(SSL s, PACKET pkt, unsigned int context,
	int *al)		X509 x, size_t chainidx, int al)
	{		{
	unsigned int ilen;		unsigned int ilen;
	const unsigned char *data;		const unsigned char *data;
	@@ -73,8 +73,8 @@ int tls_parse_ctos_renegotiate(SSL s, PACKET pkt, X509 *x, size_t chainidx,
	* extension.		* extension.
	* - On session reconnect, the servername extension may be absent.		* - On session reconnect, the servername extension may be absent.
	*/		*/
	int tls_parse_ctos_server_name(SSL s, PACKET pkt, X509 *x, size_t chainidx,		int tls_parse_ctos_server_name(SSL s, PACKET pkt, unsigned int context,
	int *al)		X509 x, size_t chainidx, int al)
	{		{
	unsigned int servname_type;		unsigned int servname_type;
	PACKET sni, hostname;		PACKET sni, hostname;
	@@ -136,7 +136,8 @@ int tls_parse_ctos_server_name(SSL s, PACKET pkt, X509 *x, size_t chainidx,
	}		}

	#ifndef OPENSSL_NO_SRP		#ifndef OPENSSL_NO_SRP
	int tls_parse_ctos_srp(SSL s, PACKET pkt, X509 x, size_t chainidx, int al)		int tls_parse_ctos_srp(SSL s, PACKET pkt, unsigned int context, X509 *x,
			size_t chainidx, int *al)
	{		{
	PACKET srp_I;		PACKET srp_I;

	@@ -160,8 +161,8 @@ int tls_parse_ctos_srp(SSL s, PACKET pkt, X509 x, size_t chainidx, int al)
	#endif		#endif

	#ifndef OPENSSL_NO_EC		#ifndef OPENSSL_NO_EC
	int tls_parse_ctos_ec_pt_formats(SSL s, PACKET pkt, X509 *x, size_t chainidx,		int tls_parse_ctos_ec_pt_formats(SSL s, PACKET pkt, unsigned int context,
	int *al)		X509 x, size_t chainidx, int al)
	{		{
	PACKET ec_point_format_list;		PACKET ec_point_format_list;

	@@ -184,8 +185,8 @@ int tls_parse_ctos_ec_pt_formats(SSL s, PACKET pkt, X509 *x, size_t chainidx,
	}		}
	#endif /* OPENSSL_NO_EC */		#endif /* OPENSSL_NO_EC */

	int tls_parse_ctos_session_ticket(SSL s, PACKET pkt, X509 *x, size_t chainidx,		int tls_parse_ctos_session_ticket(SSL s, PACKET pkt, unsigned int context,
	int *al)		X509 x, size_t chainidx, int al)
	{		{
	if (s->ext.session_ticket_cb &&		if (s->ext.session_ticket_cb &&
	!s->ext.session_ticket_cb(s, PACKET_data(pkt),		!s->ext.session_ticket_cb(s, PACKET_data(pkt),
	@@ -198,8 +199,8 @@ int tls_parse_ctos_session_ticket(SSL s, PACKET pkt, X509 *x, size_t chainidx,
	return 1;		return 1;
	}		}

	int tls_parse_ctos_sig_algs(SSL s, PACKET pkt, X509 *x, size_t chainidx,		int tls_parse_ctos_sig_algs(SSL s, PACKET pkt, unsigned int context, X509 *x,
	int *al)		size_t chainidx, int *al)
	{		{
	PACKET supported_sig_algs;		PACKET supported_sig_algs;

	@@ -218,8 +219,8 @@ int tls_parse_ctos_sig_algs(SSL s, PACKET pkt, X509 *x, size_t chainidx,
	}		}

	#ifndef OPENSSL_NO_OCSP		#ifndef OPENSSL_NO_OCSP
	int tls_parse_ctos_status_request(SSL s, PACKET pkt, X509 *x, size_t chainidx,		int tls_parse_ctos_status_request(SSL s, PACKET pkt, unsigned int context,
	int *al)		X509 x, size_t chainidx, int al)
	{		{
	PACKET responder_id_list, exts;		PACKET responder_id_list, exts;

	@@ -317,7 +318,8 @@ int tls_parse_ctos_status_request(SSL s, PACKET pkt, X509 *x, size_t chainidx,
	#endif		#endif

	#ifndef OPENSSL_NO_NEXTPROTONEG		#ifndef OPENSSL_NO_NEXTPROTONEG
	int tls_parse_ctos_npn(SSL s, PACKET pkt, X509 x, size_t chainidx, int al)		int tls_parse_ctos_npn(SSL s, PACKET pkt, unsigned int context, X509 *x,
			size_t chainidx, int *al)
	{		{
	/*		/*
	* We shouldn't accept this extension on a		* We shouldn't accept this extension on a
	@@ -335,7 +337,8 @@ int tls_parse_ctos_npn(SSL s, PACKET pkt, X509 x, size_t chainidx, int al)
	* extension, not including type and length. \|al\| is a pointer to the alert		* extension, not including type and length. \|al\| is a pointer to the alert
	* value to send in the event of a failure. Returns: 1 on success, 0 on error.		* value to send in the event of a failure. Returns: 1 on success, 0 on error.
	*/		*/
	int tls_parse_ctos_alpn(SSL s, PACKET pkt, X509 x, size_t chainidx, int al)		int tls_parse_ctos_alpn(SSL s, PACKET pkt, unsigned int context, X509 *x,
			size_t chainidx, int *al)
	{		{
	PACKET protocol_list, save_protocol_list, protocol;		PACKET protocol_list, save_protocol_list, protocol;

	@@ -368,8 +371,8 @@ int tls_parse_ctos_alpn(SSL s, PACKET pkt, X509 x, size_t chainidx, int al)
	}		}

	#ifndef OPENSSL_NO_SRTP		#ifndef OPENSSL_NO_SRTP
	int tls_parse_ctos_use_srtp(SSL s, PACKET pkt, X509 *x, size_t chainidx,		int tls_parse_ctos_use_srtp(SSL s, PACKET pkt, unsigned int context, X509 *x,
	int *al)		size_t chainidx, int *al)
	{		{
	STACK_OF(SRTP_PROTECTION_PROFILE) *srvr;		STACK_OF(SRTP_PROTECTION_PROFILE) *srvr;
	unsigned int ct, mki_len, id;		unsigned int ct, mki_len, id;
	@@ -439,7 +442,8 @@ int tls_parse_ctos_use_srtp(SSL s, PACKET pkt, X509 *x, size_t chainidx,
	}		}
	#endif		#endif

	int tls_parse_ctos_etm(SSL s, PACKET pkt, X509 x, size_t chainidx, int al)		int tls_parse_ctos_etm(SSL s, PACKET pkt, unsigned int context, X509 *x,
			size_t chainidx, int *al)
	{		{
	if (!(s->options & SSL_OP_NO_ENCRYPT_THEN_MAC))		if (!(s->options & SSL_OP_NO_ENCRYPT_THEN_MAC))
	s->s3->flags \|= TLS1_FLAGS_ENCRYPT_THEN_MAC;		s->s3->flags \|= TLS1_FLAGS_ENCRYPT_THEN_MAC;
	@@ -483,8 +487,8 @@ static int check_in_list(SSL *s, unsigned int group_id,
	* the raw PACKET data for the extension. Returns 1 on success or 0 on failure.		* the raw PACKET data for the extension. Returns 1 on success or 0 on failure.
	* If a failure occurs then \|*al\| is set to an appropriate alert value.		* If a failure occurs then \|*al\| is set to an appropriate alert value.
	*/		*/
	int tls_parse_ctos_psk_kex_modes(SSL s, PACKET pkt, X509 *x, size_t chainidx,		int tls_parse_ctos_psk_kex_modes(SSL s, PACKET pkt, unsigned int context,
	int *al)		X509 x, size_t chainidx, int al)
	{		{
	#ifndef OPENSSL_NO_TLS1_3		#ifndef OPENSSL_NO_TLS1_3
	PACKET psk_kex_modes;		PACKET psk_kex_modes;
	@@ -512,8 +516,8 @@ int tls_parse_ctos_psk_kex_modes(SSL s, PACKET pkt, X509 *x, size_t chainidx,
	* the raw PACKET data for the extension. Returns 1 on success or 0 on failure.		* the raw PACKET data for the extension. Returns 1 on success or 0 on failure.
	* If a failure occurs then \|*al\| is set to an appropriate alert value.		* If a failure occurs then \|*al\| is set to an appropriate alert value.
	*/		*/
	int tls_parse_ctos_key_share(SSL s, PACKET pkt, X509 *x, size_t chainidx,		int tls_parse_ctos_key_share(SSL s, PACKET pkt, unsigned int context, X509 *x,
	int *al)		size_t chainidx, int *al)
	{		{
	#ifndef OPENSSL_NO_TLS1_3		#ifndef OPENSSL_NO_TLS1_3
	unsigned int group_id;		unsigned int group_id;
	@@ -642,8 +646,8 @@ int tls_parse_ctos_key_share(SSL s, PACKET pkt, X509 *x, size_t chainidx,
	}		}

	#ifndef OPENSSL_NO_EC		#ifndef OPENSSL_NO_EC
	int tls_parse_ctos_supported_groups(SSL s, PACKET pkt, X509 *x,		int tls_parse_ctos_supported_groups(SSL s, PACKET pkt, unsigned int context,
	size_t chainidx, int *al)		X509 x, size_t chainidx, int al)
	{		{
	PACKET supported_groups_list;		PACKET supported_groups_list;

	@@ -666,7 +670,8 @@ int tls_parse_ctos_supported_groups(SSL s, PACKET pkt, X509 *x,
	}		}
	#endif		#endif

	int tls_parse_ctos_ems(SSL s, PACKET pkt, X509 x, size_t chainidx, int al)		int tls_parse_ctos_ems(SSL s, PACKET pkt, unsigned int context, X509 *x,
			size_t chainidx, int *al)
	{		{
	/* The extension must always be empty */		/* The extension must always be empty */
	if (PACKET_remaining(pkt) != 0) {		if (PACKET_remaining(pkt) != 0) {
	@@ -679,7 +684,8 @@ int tls_parse_ctos_ems(SSL s, PACKET pkt, X509 x, size_t chainidx, int al)
	return 1;		return 1;
	}		}

	int tls_parse_ctos_psk(SSL s, PACKET pkt, X509 x, size_t chainidx, int al)		int tls_parse_ctos_psk(SSL s, PACKET pkt, unsigned int context, X509 *x,
			size_t chainidx, int *al)
	{		{
	PACKET identities, binders, binder;		PACKET identities, binders, binder;
	size_t binderoffset, hashsize;		size_t binderoffset, hashsize;
	@@ -780,8 +786,8 @@ err:
	/*		/*
	* Add the server's renegotiation binding		* Add the server's renegotiation binding
	*/		*/
	int tls_construct_stoc_renegotiate(SSL s, WPACKET pkt, X509 *x, size_t		int tls_construct_stoc_renegotiate(SSL s, WPACKET pkt, unsigned int context,
	chainidx, int *al)		X509 x, size_t chainidx, int al)
	{		{
	if (!s->s3->send_connection_binding)		if (!s->s3->send_connection_binding)
	return 1;		return 1;
	@@ -802,8 +808,8 @@ int tls_construct_stoc_renegotiate(SSL s, WPACKET pkt, X509 *x, size_t
	return 1;		return 1;
	}		}

	int tls_construct_stoc_server_name(SSL s, WPACKET pkt, X509 *x,		int tls_construct_stoc_server_name(SSL s, WPACKET pkt, unsigned int context,
	size_t chainidx, int *al)		X509 x, size_t chainidx, int al)
	{		{
	if (s->hit \|\| s->servername_done != 1		if (s->hit \|\| s->servername_done != 1
	\|\| s->session->ext.hostname == NULL)		\|\| s->session->ext.hostname == NULL)
	@@ -819,8 +825,8 @@ int tls_construct_stoc_server_name(SSL s, WPACKET pkt, X509 *x,
	}		}

	#ifndef OPENSSL_NO_EC		#ifndef OPENSSL_NO_EC
	int tls_construct_stoc_ec_pt_formats(SSL s, WPACKET pkt, X509 *x,		int tls_construct_stoc_ec_pt_formats(SSL s, WPACKET pkt, unsigned int context,
	size_t chainidx, int *al)		X509 x, size_t chainidx, int al)
	{		{
	unsigned long alg_k = s->s3->tmp.new_cipher->algorithm_mkey;		unsigned long alg_k = s->s3->tmp.new_cipher->algorithm_mkey;
	unsigned long alg_a = s->s3->tmp.new_cipher->algorithm_auth;		unsigned long alg_a = s->s3->tmp.new_cipher->algorithm_auth;
	@@ -845,7 +851,8 @@ int tls_construct_stoc_ec_pt_formats(SSL s, WPACKET pkt, X509 *x,
	}		}
	#endif		#endif

	int tls_construct_stoc_session_ticket(SSL s, WPACKET pkt, X509 *x,		int tls_construct_stoc_session_ticket(SSL s, WPACKET pkt,
			unsigned int context, X509 *x,
	size_t chainidx, int *al)		size_t chainidx, int *al)
	{		{
	if (!s->ext.ticket_expected \|\| !tls_use_ticket(s)) {		if (!s->ext.ticket_expected \|\| !tls_use_ticket(s)) {
	@@ -863,7 +870,8 @@ int tls_construct_stoc_session_ticket(SSL s, WPACKET pkt, X509 *x,
	}		}

	#ifndef OPENSSL_NO_OCSP		#ifndef OPENSSL_NO_OCSP
	int tls_construct_stoc_status_request(SSL s, WPACKET pkt, X509 *x,		int tls_construct_stoc_status_request(SSL s, WPACKET pkt,
			unsigned int context, X509 *x,
	size_t chainidx, int *al)		size_t chainidx, int *al)
	{		{
	if (!s->ext.status_expected)		if (!s->ext.status_expected)
	@@ -894,7 +902,8 @@ int tls_construct_stoc_status_request(SSL s, WPACKET pkt, X509 *x,
	#endif		#endif

	#ifndef OPENSSL_NO_NEXTPROTONEG		#ifndef OPENSSL_NO_NEXTPROTONEG
	int tls_construct_stoc_next_proto_neg(SSL s, WPACKET pkt, X509 *x,		int tls_construct_stoc_next_proto_neg(SSL s, WPACKET pkt,
			unsigned int context, X509 *x,
	size_t chainidx, int *al)		size_t chainidx, int *al)
	{		{
	const unsigned char *npa;		const unsigned char *npa;
	@@ -922,8 +931,8 @@ int tls_construct_stoc_next_proto_neg(SSL s, WPACKET pkt, X509 *x,
	}		}
	#endif		#endif

	int tls_construct_stoc_alpn(SSL s, WPACKET pkt, X509 *x, size_t chainidx,		int tls_construct_stoc_alpn(SSL s, WPACKET pkt, unsigned int context, X509 *x,
	int *al)		size_t chainidx, int *al)
	{		{
	if (s->s3->alpn_selected == NULL)		if (s->s3->alpn_selected == NULL)
	return 1;		return 1;
	@@ -944,8 +953,8 @@ int tls_construct_stoc_alpn(SSL s, WPACKET pkt, X509 *x, size_t chainidx,
	}		}

	#ifndef OPENSSL_NO_SRTP		#ifndef OPENSSL_NO_SRTP
	int tls_construct_stoc_use_srtp(SSL s, WPACKET pkt, X509 *x, size_t chainidx,		int tls_construct_stoc_use_srtp(SSL s, WPACKET pkt, unsigned int context,
	int *al)		X509 x, size_t chainidx, int al)
	{		{
	if (s->srtp_profile == NULL)		if (s->srtp_profile == NULL)
	return 1;		return 1;
	@@ -964,8 +973,8 @@ int tls_construct_stoc_use_srtp(SSL s, WPACKET pkt, X509 *x, size_t chainidx,
	}		}
	#endif		#endif

	int tls_construct_stoc_etm(SSL s, WPACKET pkt, X509 *x, size_t chainidx,		int tls_construct_stoc_etm(SSL s, WPACKET pkt, unsigned int context, X509 *x,
	int *al)		size_t chainidx, int *al)
	{		{
	if ((s->s3->flags & TLS1_FLAGS_ENCRYPT_THEN_MAC) == 0)		if ((s->s3->flags & TLS1_FLAGS_ENCRYPT_THEN_MAC) == 0)
	return 1;		return 1;
	@@ -991,8 +1000,8 @@ int tls_construct_stoc_etm(SSL s, WPACKET pkt, X509 *x, size_t chainidx,
	return 1;		return 1;
	}		}

	int tls_construct_stoc_ems(SSL s, WPACKET pkt, X509 *x, size_t chainidx,		int tls_construct_stoc_ems(SSL s, WPACKET pkt, unsigned int context, X509 *x,
	int *al)		size_t chainidx, int *al)
	{		{
	if ((s->s3->flags & TLS1_FLAGS_RECEIVED_EXTMS) == 0)		if ((s->s3->flags & TLS1_FLAGS_RECEIVED_EXTMS) == 0)
	return 1;		return 1;
	@@ -1006,8 +1015,8 @@ int tls_construct_stoc_ems(SSL s, WPACKET pkt, X509 *x, size_t chainidx,
	return 1;		return 1;
	}		}

	int tls_construct_stoc_key_share(SSL s, WPACKET pkt, X509 *x, size_t chainidx,		int tls_construct_stoc_key_share(SSL s, WPACKET pkt, unsigned int context,
	int *al)		X509 x, size_t chainidx, int al)
	{		{
	#ifndef OPENSSL_NO_TLS1_3		#ifndef OPENSSL_NO_TLS1_3
	unsigned char *encodedPoint;		unsigned char *encodedPoint;
	@@ -1065,8 +1074,8 @@ int tls_construct_stoc_key_share(SSL s, WPACKET pkt, X509 *x, size_t chainidx,
	return 1;		return 1;
	}		}

	int tls_construct_stoc_cryptopro_bug(SSL s, WPACKET pkt, X509 *x,		int tls_construct_stoc_cryptopro_bug(SSL s, WPACKET pkt, unsigned int context,
	size_t chainidx, int *al)		X509 x, size_t chainidx, int al)
	{		{
	const unsigned char cryptopro_ext[36] = {		const unsigned char cryptopro_ext[36] = {
	0xfd, 0xe8, /* 65000 */		0xfd, 0xe8, /* 65000 */
	@@ -1090,8 +1099,8 @@ int tls_construct_stoc_cryptopro_bug(SSL s, WPACKET pkt, X509 *x,
	return 1;		return 1;
	}		}

	int tls_construct_stoc_psk(SSL s, WPACKET pkt, X509 *x, size_t chainidx,		int tls_construct_stoc_psk(SSL s, WPACKET pkt, unsigned int context, X509 *x,
	int *al)		size_t chainidx, int *al)
	{		{
	if (!s->hit)		if (!s->hit)
	return 1;		return 1;

ssl/statem/statem_locl.h

+122 −103

File changed.

Preview size limit exceeded, changes collapsed.

Admin message