Commit 61138358 authored by Matt Caswell's avatar Matt Caswell
Browse files

Make the context available to the extensions parse and construction funcs 



Reviewed-by: default avatarRichard Levitte <levitte@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/2341)
parent e0670973

ssl/statem/extensions.c

+14 −11
Original line number Diff line number Diff line
@@ -57,15 +57,17 @@ typedef struct extensions_definition_st { 
     */

    int (*init)(SSL *s, unsigned int context);

    /* Parse extension sent from client to server */

    int (*parse_ctos)(SSL *s, PACKET *pkt, X509 *x, size_t chainidx, int *al);

    int (*parse_ctos)(SSL *s, PACKET *pkt, unsigned int context, X509 *x,

                      size_t chainidx, int *al);

    /* Parse extension send from server to client */

    int (*parse_stoc)(SSL *s, PACKET *pkt, X509 *x, size_t chainidx, int *al);

    int (*parse_stoc)(SSL *s, PACKET *pkt, unsigned int context, X509 *x,

                      size_t chainidx, int *al);

    /* Construct extension sent from server to client */

    int (*construct_stoc)(SSL *s, WPACKET *pkt, X509 *x, size_t chainidx,

                          int *al);

    int (*construct_stoc)(SSL *s, WPACKET *pkt, unsigned int context, X509 *x,

                          size_t chainidx, int *al);

    /* Construct extension sent from client to server */

    int (*construct_ctos)(SSL *s, WPACKET *pkt, X509 *x, size_t chainidx,

                          int *al);

    int (*construct_ctos)(SSL *s, WPACKET *pkt, unsigned int context, X509 *x,

                          size_t chainidx, int *al);

    /*

     * Finalise extension after parsing. Always called where an extensions was

     * initialised even if the extension was not present. |sent| is set to 1 if
@@ -470,7 +472,8 @@ int tls_parse_extension(SSL *s, TLSEXT_INDEX idx, int context, 
                        RAW_EXTENSION *exts, X509 *x, size_t chainidx, int *al)

{

    RAW_EXTENSION *currext = &exts[idx];

    int (*parser)(SSL *s, PACKET *pkt, X509 *x, size_t chainidx, int *al) = NULL;

    int (*parser)(SSL *s, PACKET *pkt, unsigned int context, X509 *x,

                  size_t chainidx, int *al) = NULL;



    /* Skip if the extension is not present */

    if (!currext->present)
@@ -499,7 +502,7 @@ int tls_parse_extension(SSL *s, TLSEXT_INDEX idx, int context, 
        parser = s->server ? extdef->parse_ctos : extdef->parse_stoc;



        if (parser != NULL)

            return parser(s, &currext->data, x, chainidx, al);

            return parser(s, &currext->data, context, x, chainidx, al);



        /*

         * If the parser is NULL we fall through to the custom extension
@@ -633,8 +636,8 @@ int tls_construct_extensions(SSL *s, WPACKET *pkt, unsigned int context, 
    }



    for (i = 0, thisexd = ext_defs; i < OSSL_NELEM(ext_defs); i++, thisexd++) {

        int (*construct)(SSL *s, WPACKET *pkt, X509 *x, size_t chainidx,

                         int *al);

        int (*construct)(SSL *s, WPACKET *pkt, unsigned int context, X509 *x,

                         size_t chainidx, int *al);



        /* Skip if not relevant for our context */

        if ((thisexd->context & context) == 0)
@@ -661,7 +664,7 @@ int tls_construct_extensions(SSL *s, WPACKET *pkt, unsigned int context, 
                || construct == NULL)

            continue;



        if (!construct(s, pkt, x, chainidx, &tmpal))

        if (!construct(s, pkt, context, x, chainidx, &tmpal))

            goto err;

    }

ssl/statem/extensions_clnt.c

+64 −54
Original line number Diff line number Diff line
@@ -12,8 +12,8 @@ 
#include "../ssl_locl.h"

#include "statem_locl.h"



int tls_construct_ctos_renegotiate(SSL *s, WPACKET *pkt, X509 *x,

                                   size_t chainidx, int *al)

int tls_construct_ctos_renegotiate(SSL *s, WPACKET *pkt, unsigned int context,

                                   X509 *x, size_t chainidx, int *al)

{

    /* Add RI if renegotiating */

    if (!s->renegotiate)
@@ -31,8 +31,8 @@ int tls_construct_ctos_renegotiate(SSL *s, WPACKET *pkt, X509 *x, 
    return 1;

}



int tls_construct_ctos_server_name(SSL *s, WPACKET *pkt, X509 *x,

                                   size_t chainidx, int *al)

int tls_construct_ctos_server_name(SSL *s, WPACKET *pkt, unsigned int context,

                                   X509 *x, size_t chainidx, int *al)

{

    if (s->ext.hostname == NULL)

        return 1;
@@ -56,8 +56,8 @@ int tls_construct_ctos_server_name(SSL *s, WPACKET *pkt, X509 *x, 
}



#ifndef OPENSSL_NO_SRP

int tls_construct_ctos_srp(SSL *s, WPACKET *pkt, X509 *x, size_t chainidx,

                           int *al)

int tls_construct_ctos_srp(SSL *s, WPACKET *pkt, unsigned int context, X509 *x,

                           size_t chainidx, int *al)

{

    /* Add SRP username if there is one */

    if (s->srp_ctx.login == NULL)
@@ -108,8 +108,8 @@ static int use_ecc(SSL *s) 
    return i < end;

}



int tls_construct_ctos_ec_pt_formats(SSL *s, WPACKET *pkt, X509 *x,

                                     size_t chainidx, int *al)

int tls_construct_ctos_ec_pt_formats(SSL *s, WPACKET *pkt, unsigned int context,

                                     X509 *x, size_t chainidx, int *al)

{

    const unsigned char *pformats;

    size_t num_formats;
@@ -132,7 +132,8 @@ int tls_construct_ctos_ec_pt_formats(SSL *s, WPACKET *pkt, X509 *x, 
    return 1;

}



int tls_construct_ctos_supported_groups(SSL *s, WPACKET *pkt, X509 *x,

int tls_construct_ctos_supported_groups(SSL *s, WPACKET *pkt,

                                        unsigned int context, X509 *x,

                                        size_t chainidx, int *al)

{

    const unsigned char *pcurves = NULL, *pcurvestmp;
@@ -182,7 +183,8 @@ int tls_construct_ctos_supported_groups(SSL *s, WPACKET *pkt, X509 *x, 
}

#endif



int tls_construct_ctos_session_ticket(SSL *s, WPACKET *pkt, X509 *x,

int tls_construct_ctos_session_ticket(SSL *s, WPACKET *pkt,

                                      unsigned int context, X509 *x,

                                      size_t chainidx, int *al)

{

    size_t ticklen;
@@ -223,8 +225,8 @@ int tls_construct_ctos_session_ticket(SSL *s, WPACKET *pkt, X509 *x, 
    return 1;

}



int tls_construct_ctos_sig_algs(SSL *s, WPACKET *pkt, X509 *x, size_t chainidx,

                                int *al)

int tls_construct_ctos_sig_algs(SSL *s, WPACKET *pkt, unsigned int context,

                                X509 *x, size_t chainidx, int *al)

{

    size_t salglen;

    const uint16_t *salg;
@@ -249,7 +251,8 @@ int tls_construct_ctos_sig_algs(SSL *s, WPACKET *pkt, X509 *x, size_t chainidx, 
}



#ifndef OPENSSL_NO_OCSP

int tls_construct_ctos_status_request(SSL *s, WPACKET *pkt, X509 *x,

int tls_construct_ctos_status_request(SSL *s, WPACKET *pkt,

                                      unsigned int context, X509 *x,

                                      size_t chainidx, int *al)

{

    int i;
@@ -316,8 +319,8 @@ int tls_construct_ctos_status_request(SSL *s, WPACKET *pkt, X509 *x, 
#endif



#ifndef OPENSSL_NO_NEXTPROTONEG

int tls_construct_ctos_npn(SSL *s, WPACKET *pkt, X509 *x, size_t chainidx,

                           int *al)

int tls_construct_ctos_npn(SSL *s, WPACKET *pkt, unsigned int context, X509 *x,

                           size_t chainidx, int *al)

{

    if (s->ctx->ext.npn_select_cb == NULL || !SSL_IS_FIRST_HANDSHAKE(s))

        return 1;
@@ -336,8 +339,8 @@ int tls_construct_ctos_npn(SSL *s, WPACKET *pkt, X509 *x, size_t chainidx, 
}

#endif



int tls_construct_ctos_alpn(SSL *s, WPACKET *pkt, X509 *x, size_t chainidx,

                            int *al)

int tls_construct_ctos_alpn(SSL *s, WPACKET *pkt, unsigned int context, X509 *x,

                            size_t chainidx, int *al)

{

    s->s3->alpn_sent = 0;
@@ -360,8 +363,8 @@ int tls_construct_ctos_alpn(SSL *s, WPACKET *pkt, X509 *x, size_t chainidx, 




#ifndef OPENSSL_NO_SRTP

int tls_construct_ctos_use_srtp(SSL *s, WPACKET *pkt, X509 *x, size_t chainidx,

                                int *al)

int tls_construct_ctos_use_srtp(SSL *s, WPACKET *pkt, unsigned int context,

                                X509 *x, size_t chainidx, int *al)

{

    STACK_OF(SRTP_PROTECTION_PROFILE) *clnt = SSL_get_srtp_profiles(s);

    int i, end;
@@ -400,8 +403,8 @@ int tls_construct_ctos_use_srtp(SSL *s, WPACKET *pkt, X509 *x, size_t chainidx, 
}

#endif



int tls_construct_ctos_etm(SSL *s, WPACKET *pkt, X509 *x, size_t chainidx,

                           int *al)

int tls_construct_ctos_etm(SSL *s, WPACKET *pkt, unsigned int context, X509 *x,

                           size_t chainidx, int *al)

{

    if (s->options & SSL_OP_NO_ENCRYPT_THEN_MAC)

        return 1;
@@ -416,8 +419,8 @@ int tls_construct_ctos_etm(SSL *s, WPACKET *pkt, X509 *x, size_t chainidx, 
}



#ifndef OPENSSL_NO_CT

int tls_construct_ctos_sct(SSL *s, WPACKET *pkt, X509 *x, size_t chainidx,

                           int *al)

int tls_construct_ctos_sct(SSL *s, WPACKET *pkt, unsigned int context, X509 *x,

                           size_t chainidx, int *al)

{

    if (s->ct_validation_callback == NULL)

        return 1;
@@ -436,8 +439,8 @@ int tls_construct_ctos_sct(SSL *s, WPACKET *pkt, X509 *x, size_t chainidx, 
}

#endif



int tls_construct_ctos_ems(SSL *s, WPACKET *pkt, X509 *x, size_t chainidx,

                           int *al)

int tls_construct_ctos_ems(SSL *s, WPACKET *pkt, unsigned int context, X509 *x,

                           size_t chainidx, int *al)

{

    if (!WPACKET_put_bytes_u16(pkt, TLSEXT_TYPE_extended_master_secret)

            || !WPACKET_put_bytes_u16(pkt, 0)) {
@@ -448,7 +451,8 @@ int tls_construct_ctos_ems(SSL *s, WPACKET *pkt, X509 *x, size_t chainidx, 
    return 1;

}



int tls_construct_ctos_supported_versions(SSL *s, WPACKET *pkt, X509 *x,

int tls_construct_ctos_supported_versions(SSL *s, WPACKET *pkt,

                                          unsigned int context, X509 *x,

                                          size_t chainidx, int *al)

{

    int currv, min_version, max_version, reason;
@@ -499,8 +503,8 @@ int tls_construct_ctos_supported_versions(SSL *s, WPACKET *pkt, X509 *x, 
 * Construct a psk_kex_modes extension. We only have two modes we know about

 * at this stage, so we send both.

 */

int tls_construct_ctos_psk_kex_modes(SSL *s, WPACKET *pkt, X509 *x,

                                     size_t chainidx, int *al)

int tls_construct_ctos_psk_kex_modes(SSL *s, WPACKET *pkt, unsigned int context,

                                     X509 *x, size_t chainidx, int *al)

{

#ifndef OPENSSL_NO_TLS1_3

    /*
@@ -524,8 +528,8 @@ int tls_construct_ctos_psk_kex_modes(SSL *s, WPACKET *pkt, X509 *x, 
    return 1;

}



int tls_construct_ctos_key_share(SSL *s, WPACKET *pkt, X509 *x, size_t chainidx,

                                 int *al)

int tls_construct_ctos_key_share(SSL *s, WPACKET *pkt, unsigned int context,

                                 X509 *x, size_t chainidx, int *al)

{

#ifndef OPENSSL_NO_TLS1_3

    size_t i, sharessent = 0, num_curves = 0;
@@ -615,8 +619,8 @@ int tls_construct_ctos_key_share(SSL *s, WPACKET *pkt, X509 *x, size_t chainidx, 
#define F5_WORKAROUND_MIN_MSG_LEN   0xff

#define F5_WORKAROUND_MAX_MSG_LEN   0x200



int tls_construct_ctos_padding(SSL *s, WPACKET *pkt, X509 *x, size_t chainidx,

                               int *al)

int tls_construct_ctos_padding(SSL *s, WPACKET *pkt, unsigned int context,

                               X509 *x, size_t chainidx, int *al)

{

    unsigned char *padbytes;

    size_t hlen;
@@ -662,8 +666,8 @@ int tls_construct_ctos_padding(SSL *s, WPACKET *pkt, X509 *x, size_t chainidx, 
/*

 * Construct the pre_shared_key extension

 */

int tls_construct_ctos_psk(SSL *s, WPACKET *pkt, X509 *x, size_t chainidx,

                           int *al)

int tls_construct_ctos_psk(SSL *s, WPACKET *pkt, unsigned int context, X509 *x,

                           size_t chainidx, int *al)

{

#ifndef OPENSSL_NO_TLS1_3

    uint32_t now, agesec, agems;
@@ -774,8 +778,8 @@ int tls_construct_ctos_psk(SSL *s, WPACKET *pkt, X509 *x, size_t chainidx, 
/*

 * Parse the server's renegotiation binding and abort if it's not right

 */

int tls_parse_stoc_renegotiate(SSL *s, PACKET *pkt, X509 *x, size_t chainidx,

                               int *al)

int tls_parse_stoc_renegotiate(SSL *s, PACKET *pkt, unsigned int context,

                               X509 *x, size_t chainidx, int *al)

{

    size_t expected_len = s->s3->previous_client_finished_len

        + s->s3->previous_server_finished_len;
@@ -832,8 +836,8 @@ int tls_parse_stoc_renegotiate(SSL *s, PACKET *pkt, X509 *x, size_t chainidx, 
    return 1;

}



int tls_parse_stoc_server_name(SSL *s, PACKET *pkt, X509 *x, size_t chainidx,

                               int *al)

int tls_parse_stoc_server_name(SSL *s, PACKET *pkt, unsigned int context,

                               X509 *x, size_t chainidx, int *al)

{

    if (s->ext.hostname == NULL || PACKET_remaining(pkt) > 0) {

        *al = SSL_AD_UNRECOGNIZED_NAME;
@@ -856,8 +860,8 @@ int tls_parse_stoc_server_name(SSL *s, PACKET *pkt, X509 *x, size_t chainidx, 
}



#ifndef OPENSSL_NO_EC

int tls_parse_stoc_ec_pt_formats(SSL *s, PACKET *pkt, X509 *x, size_t chainidx,

                                 int *al)

int tls_parse_stoc_ec_pt_formats(SSL *s, PACKET *pkt, unsigned int context,

                                 X509 *x, size_t chainidx, int *al)

{

    unsigned int ecpointformats_len;

    PACKET ecptformatlist;
@@ -891,8 +895,8 @@ int tls_parse_stoc_ec_pt_formats(SSL *s, PACKET *pkt, X509 *x, size_t chainidx, 
}

#endif



int tls_parse_stoc_session_ticket(SSL *s, PACKET *pkt, X509 *x, size_t chainidx,

                                  int *al)

int tls_parse_stoc_session_ticket(SSL *s, PACKET *pkt, unsigned int context,

                                  X509 *x, size_t chainidx, int *al)

{

    if (s->ext.session_ticket_cb != NULL &&

        !s->ext.session_ticket_cb(s, PACKET_data(pkt),
@@ -913,8 +917,8 @@ int tls_parse_stoc_session_ticket(SSL *s, PACKET *pkt, X509 *x, size_t chainidx, 
}



#ifndef OPENSSL_NO_OCSP

int tls_parse_stoc_status_request(SSL *s, PACKET *pkt, X509 *x, size_t chainidx,

                                  int *al)

int tls_parse_stoc_status_request(SSL *s, PACKET *pkt, unsigned int context,

                                  X509 *x, size_t chainidx, int *al)

{

    /*

     * MUST only be sent if we've requested a status
@@ -944,7 +948,8 @@ int tls_parse_stoc_status_request(SSL *s, PACKET *pkt, X509 *x, size_t chainidx, 




#ifndef OPENSSL_NO_CT

int tls_parse_stoc_sct(SSL *s, PACKET *pkt, X509 *x, size_t chainidx, int *al)

int tls_parse_stoc_sct(SSL *s, PACKET *pkt, unsigned int context, X509 *x,

                       size_t chainidx, int *al)

{

    /*

     * Only take it if we asked for it - i.e if there is no CT validation
@@ -997,7 +1002,8 @@ static int ssl_next_proto_validate(PACKET *pkt) 
    return 1;

}



int tls_parse_stoc_npn(SSL *s, PACKET *pkt, X509 *x, size_t chainidx, int *al)

int tls_parse_stoc_npn(SSL *s, PACKET *pkt, unsigned int context, X509 *x,

                       size_t chainidx, int *al)

{

    unsigned char *selected;

    unsigned char selected_len;
@@ -1047,7 +1053,8 @@ int tls_parse_stoc_npn(SSL *s, PACKET *pkt, X509 *x, size_t chainidx, int *al) 
}

#endif



int tls_parse_stoc_alpn(SSL *s, PACKET *pkt, X509 *x, size_t chainidx, int *al)

int tls_parse_stoc_alpn(SSL *s, PACKET *pkt, unsigned int context, X509 *x,

                        size_t chainidx, int *al)

{

    size_t len;
@@ -1084,8 +1091,8 @@ int tls_parse_stoc_alpn(SSL *s, PACKET *pkt, X509 *x, size_t chainidx, int *al) 
}



#ifndef OPENSSL_NO_SRTP

int tls_parse_stoc_use_srtp(SSL *s, PACKET *pkt, X509 *x, size_t chainidx,

                            int *al)

int tls_parse_stoc_use_srtp(SSL *s, PACKET *pkt, unsigned int context, X509 *x,

                            size_t chainidx, int *al)

{

    unsigned int id, ct, mki;

    int i;
@@ -1138,7 +1145,8 @@ int tls_parse_stoc_use_srtp(SSL *s, PACKET *pkt, X509 *x, size_t chainidx, 
}

#endif



int tls_parse_stoc_etm(SSL *s, PACKET *pkt, X509 *x, size_t chainidx, int *al)

int tls_parse_stoc_etm(SSL *s, PACKET *pkt, unsigned int context, X509 *x,

                       size_t chainidx, int *al)

{

    /* Ignore if inappropriate ciphersuite */

    if (!(s->options & SSL_OP_NO_ENCRYPT_THEN_MAC)
@@ -1149,7 +1157,8 @@ int tls_parse_stoc_etm(SSL *s, PACKET *pkt, X509 *x, size_t chainidx, int *al) 
    return 1;

}



int tls_parse_stoc_ems(SSL *s, PACKET *pkt, X509 *x, size_t chainidx, int *al)

int tls_parse_stoc_ems(SSL *s, PACKET *pkt, unsigned int context, X509 *x,

                       size_t chainidx, int *al)

{

    s->s3->flags |= TLS1_FLAGS_RECEIVED_EXTMS;

    if (!s->hit)
@@ -1158,8 +1167,8 @@ int tls_parse_stoc_ems(SSL *s, PACKET *pkt, X509 *x, size_t chainidx, int *al) 
    return 1;

}



int tls_parse_stoc_key_share(SSL *s, PACKET *pkt, X509 *x, size_t chainidx,

                             int *al)

int tls_parse_stoc_key_share(SSL *s, PACKET *pkt, unsigned int context, X509 *x,

                             size_t chainidx, int *al)

{

#ifndef OPENSSL_NO_TLS1_3

    unsigned int group_id;
@@ -1222,7 +1231,8 @@ int tls_parse_stoc_key_share(SSL *s, PACKET *pkt, X509 *x, size_t chainidx, 
    return 1;

}



int tls_parse_stoc_psk(SSL *s, PACKET *pkt, X509 *x, size_t chainidx, int *al)

int tls_parse_stoc_psk(SSL *s, PACKET *pkt, unsigned int context, X509 *x,

                       size_t chainidx, int *al)

{

#ifndef OPENSSL_NO_TLS1_3

    unsigned int identity;

ssl/statem/extensions_srvr.c

+59 −50
Original line number Diff line number Diff line
@@ -14,8 +14,8 @@ 
/*

 * Parse the client's renegotiation binding and abort if it's not right

 */

int tls_parse_ctos_renegotiate(SSL *s, PACKET *pkt, X509 *x, size_t chainidx,

                               int *al)

int tls_parse_ctos_renegotiate(SSL *s, PACKET *pkt, unsigned int context,

                               X509 *x, size_t chainidx, int *al)

{

    unsigned int ilen;

    const unsigned char *data;
@@ -73,8 +73,8 @@ int tls_parse_ctos_renegotiate(SSL *s, PACKET *pkt, X509 *x, size_t chainidx, 
 *   extension.

 * - On session reconnect, the servername extension may be absent.

 */

int tls_parse_ctos_server_name(SSL *s, PACKET *pkt, X509 *x, size_t chainidx,

                               int *al)

int tls_parse_ctos_server_name(SSL *s, PACKET *pkt, unsigned int context,

                               X509 *x, size_t chainidx, int *al)

{

    unsigned int servname_type;

    PACKET sni, hostname;
@@ -136,7 +136,8 @@ int tls_parse_ctos_server_name(SSL *s, PACKET *pkt, X509 *x, size_t chainidx, 
}



#ifndef OPENSSL_NO_SRP

int tls_parse_ctos_srp(SSL *s, PACKET *pkt, X509 *x, size_t chainidx, int *al)

int tls_parse_ctos_srp(SSL *s, PACKET *pkt, unsigned int context, X509 *x,

                       size_t chainidx, int *al)

{

    PACKET srp_I;
@@ -160,8 +161,8 @@ int tls_parse_ctos_srp(SSL *s, PACKET *pkt, X509 *x, size_t chainidx, int *al) 
#endif



#ifndef OPENSSL_NO_EC

int tls_parse_ctos_ec_pt_formats(SSL *s, PACKET *pkt, X509 *x, size_t chainidx,

                                 int *al)

int tls_parse_ctos_ec_pt_formats(SSL *s, PACKET *pkt, unsigned int context,

                                 X509 *x, size_t chainidx, int *al)

{

    PACKET ec_point_format_list;
@@ -184,8 +185,8 @@ int tls_parse_ctos_ec_pt_formats(SSL *s, PACKET *pkt, X509 *x, size_t chainidx, 
}

#endif                          /* OPENSSL_NO_EC */



int tls_parse_ctos_session_ticket(SSL *s, PACKET *pkt, X509 *x, size_t chainidx,

                                  int *al)

int tls_parse_ctos_session_ticket(SSL *s, PACKET *pkt, unsigned int context,

                                  X509 *x, size_t chainidx, int *al)

{

    if (s->ext.session_ticket_cb &&

            !s->ext.session_ticket_cb(s, PACKET_data(pkt),
@@ -198,8 +199,8 @@ int tls_parse_ctos_session_ticket(SSL *s, PACKET *pkt, X509 *x, size_t chainidx, 
    return 1;

}



int tls_parse_ctos_sig_algs(SSL *s, PACKET *pkt, X509 *x, size_t chainidx,

                            int *al)

int tls_parse_ctos_sig_algs(SSL *s, PACKET *pkt, unsigned int context, X509 *x,

                            size_t chainidx, int *al)

{

    PACKET supported_sig_algs;
@@ -218,8 +219,8 @@ int tls_parse_ctos_sig_algs(SSL *s, PACKET *pkt, X509 *x, size_t chainidx, 
}



#ifndef OPENSSL_NO_OCSP

int tls_parse_ctos_status_request(SSL *s, PACKET *pkt, X509 *x, size_t chainidx,

                                  int *al)

int tls_parse_ctos_status_request(SSL *s, PACKET *pkt, unsigned int context,

                                  X509 *x, size_t chainidx, int *al)

{

    PACKET responder_id_list, exts;
@@ -317,7 +318,8 @@ int tls_parse_ctos_status_request(SSL *s, PACKET *pkt, X509 *x, size_t chainidx, 
#endif



#ifndef OPENSSL_NO_NEXTPROTONEG

int tls_parse_ctos_npn(SSL *s, PACKET *pkt, X509 *x, size_t chainidx, int *al)

int tls_parse_ctos_npn(SSL *s, PACKET *pkt, unsigned int context, X509 *x,

                       size_t chainidx, int *al)

{

    /*

     * We shouldn't accept this extension on a
@@ -335,7 +337,8 @@ int tls_parse_ctos_npn(SSL *s, PACKET *pkt, X509 *x, size_t chainidx, int *al) 
 * extension, not including type and length. |al| is a pointer to the alert

 * value to send in the event of a failure. Returns: 1 on success, 0 on error.

 */

int tls_parse_ctos_alpn(SSL *s, PACKET *pkt, X509 *x, size_t chainidx, int *al)

int tls_parse_ctos_alpn(SSL *s, PACKET *pkt, unsigned int context, X509 *x,

                        size_t chainidx, int *al)

{

    PACKET protocol_list, save_protocol_list, protocol;
@@ -368,8 +371,8 @@ int tls_parse_ctos_alpn(SSL *s, PACKET *pkt, X509 *x, size_t chainidx, int *al) 
}



#ifndef OPENSSL_NO_SRTP

int tls_parse_ctos_use_srtp(SSL *s, PACKET *pkt, X509 *x, size_t chainidx,

                            int *al)

int tls_parse_ctos_use_srtp(SSL *s, PACKET *pkt, unsigned int context, X509 *x,

                            size_t chainidx, int *al)

{

    STACK_OF(SRTP_PROTECTION_PROFILE) *srvr;

    unsigned int ct, mki_len, id;
@@ -439,7 +442,8 @@ int tls_parse_ctos_use_srtp(SSL *s, PACKET *pkt, X509 *x, size_t chainidx, 
}

#endif



int tls_parse_ctos_etm(SSL *s, PACKET *pkt, X509 *x, size_t chainidx, int *al)

int tls_parse_ctos_etm(SSL *s, PACKET *pkt, unsigned int context, X509 *x,

                       size_t chainidx, int *al)

{

    if (!(s->options & SSL_OP_NO_ENCRYPT_THEN_MAC))

        s->s3->flags |= TLS1_FLAGS_ENCRYPT_THEN_MAC;
@@ -483,8 +487,8 @@ static int check_in_list(SSL *s, unsigned int group_id, 
 * the raw PACKET data for the extension. Returns 1 on success or 0 on failure.

 * If a failure occurs then |*al| is set to an appropriate alert value.

 */

int tls_parse_ctos_psk_kex_modes(SSL *s, PACKET *pkt, X509 *x, size_t chainidx,

                                 int *al)

int tls_parse_ctos_psk_kex_modes(SSL *s, PACKET *pkt, unsigned int context,

                                 X509 *x, size_t chainidx, int *al)

{

#ifndef OPENSSL_NO_TLS1_3

    PACKET psk_kex_modes;
@@ -512,8 +516,8 @@ int tls_parse_ctos_psk_kex_modes(SSL *s, PACKET *pkt, X509 *x, size_t chainidx, 
 * the raw PACKET data for the extension. Returns 1 on success or 0 on failure.

 * If a failure occurs then |*al| is set to an appropriate alert value.

 */

int tls_parse_ctos_key_share(SSL *s, PACKET *pkt, X509 *x, size_t chainidx,

                             int *al)

int tls_parse_ctos_key_share(SSL *s, PACKET *pkt, unsigned int context, X509 *x,

                             size_t chainidx, int *al)

{

#ifndef OPENSSL_NO_TLS1_3

    unsigned int group_id;
@@ -642,8 +646,8 @@ int tls_parse_ctos_key_share(SSL *s, PACKET *pkt, X509 *x, size_t chainidx, 
}



#ifndef OPENSSL_NO_EC

int tls_parse_ctos_supported_groups(SSL *s, PACKET *pkt, X509 *x,

                                    size_t chainidx, int *al)

int tls_parse_ctos_supported_groups(SSL *s, PACKET *pkt, unsigned int context,

                                    X509 *x, size_t chainidx, int *al)

{

    PACKET supported_groups_list;
@@ -666,7 +670,8 @@ int tls_parse_ctos_supported_groups(SSL *s, PACKET *pkt, X509 *x, 
}

#endif



int tls_parse_ctos_ems(SSL *s, PACKET *pkt, X509 *x, size_t chainidx, int *al)

int tls_parse_ctos_ems(SSL *s, PACKET *pkt, unsigned int context, X509 *x,

                       size_t chainidx, int *al)

{

    /* The extension must always be empty */

    if (PACKET_remaining(pkt) != 0) {
@@ -679,7 +684,8 @@ int tls_parse_ctos_ems(SSL *s, PACKET *pkt, X509 *x, size_t chainidx, int *al) 
    return 1;

}



int tls_parse_ctos_psk(SSL *s, PACKET *pkt, X509 *x, size_t chainidx, int *al)

int tls_parse_ctos_psk(SSL *s, PACKET *pkt, unsigned int context, X509 *x,

                       size_t chainidx, int *al)

{

    PACKET identities, binders, binder;

    size_t binderoffset, hashsize;
@@ -780,8 +786,8 @@ err: 
/*

 * Add the server's renegotiation binding

 */

int tls_construct_stoc_renegotiate(SSL *s, WPACKET *pkt, X509 *x, size_t

                                   chainidx, int *al)

int tls_construct_stoc_renegotiate(SSL *s, WPACKET *pkt, unsigned int context,

                                   X509 *x, size_t chainidx, int *al)

{

    if (!s->s3->send_connection_binding)

        return 1;
@@ -802,8 +808,8 @@ int tls_construct_stoc_renegotiate(SSL *s, WPACKET *pkt, X509 *x, size_t 
    return 1;

}



int tls_construct_stoc_server_name(SSL *s, WPACKET *pkt, X509 *x,

                                   size_t chainidx, int *al)

int tls_construct_stoc_server_name(SSL *s, WPACKET *pkt, unsigned int context,

                                   X509 *x, size_t chainidx, int *al)

{

    if (s->hit || s->servername_done != 1

            || s->session->ext.hostname == NULL)
@@ -819,8 +825,8 @@ int tls_construct_stoc_server_name(SSL *s, WPACKET *pkt, X509 *x, 
}



#ifndef OPENSSL_NO_EC

int tls_construct_stoc_ec_pt_formats(SSL *s, WPACKET *pkt, X509 *x,

                                     size_t chainidx, int *al)

int tls_construct_stoc_ec_pt_formats(SSL *s, WPACKET *pkt, unsigned int context,

                                     X509 *x, size_t chainidx, int *al)

{

    unsigned long alg_k = s->s3->tmp.new_cipher->algorithm_mkey;

    unsigned long alg_a = s->s3->tmp.new_cipher->algorithm_auth;
@@ -845,7 +851,8 @@ int tls_construct_stoc_ec_pt_formats(SSL *s, WPACKET *pkt, X509 *x, 
}

#endif



int tls_construct_stoc_session_ticket(SSL *s, WPACKET *pkt, X509 *x,

int tls_construct_stoc_session_ticket(SSL *s, WPACKET *pkt,

                                      unsigned int context, X509 *x,

                                      size_t chainidx, int *al)

{

    if (!s->ext.ticket_expected || !tls_use_ticket(s)) {
@@ -863,7 +870,8 @@ int tls_construct_stoc_session_ticket(SSL *s, WPACKET *pkt, X509 *x, 
}



#ifndef OPENSSL_NO_OCSP

int tls_construct_stoc_status_request(SSL *s, WPACKET *pkt, X509 *x,

int tls_construct_stoc_status_request(SSL *s, WPACKET *pkt,

                                      unsigned int context, X509 *x,

                                      size_t chainidx, int *al)

{

    if (!s->ext.status_expected)
@@ -894,7 +902,8 @@ int tls_construct_stoc_status_request(SSL *s, WPACKET *pkt, X509 *x, 
#endif



#ifndef OPENSSL_NO_NEXTPROTONEG

int tls_construct_stoc_next_proto_neg(SSL *s, WPACKET *pkt, X509 *x,

int tls_construct_stoc_next_proto_neg(SSL *s, WPACKET *pkt,

                                      unsigned int context, X509 *x,

                                      size_t chainidx, int *al)

{

    const unsigned char *npa;
@@ -922,8 +931,8 @@ int tls_construct_stoc_next_proto_neg(SSL *s, WPACKET *pkt, X509 *x, 
}

#endif



int tls_construct_stoc_alpn(SSL *s, WPACKET *pkt, X509 *x, size_t chainidx,

                            int *al)

int tls_construct_stoc_alpn(SSL *s, WPACKET *pkt, unsigned int context, X509 *x,

                            size_t chainidx, int *al)

{

    if (s->s3->alpn_selected == NULL)

        return 1;
@@ -944,8 +953,8 @@ int tls_construct_stoc_alpn(SSL *s, WPACKET *pkt, X509 *x, size_t chainidx, 
}



#ifndef OPENSSL_NO_SRTP

int tls_construct_stoc_use_srtp(SSL *s, WPACKET *pkt, X509 *x, size_t chainidx,

                                int *al)

int tls_construct_stoc_use_srtp(SSL *s, WPACKET *pkt, unsigned int context,

                                X509 *x, size_t chainidx, int *al)

{

    if (s->srtp_profile == NULL)

        return 1;
@@ -964,8 +973,8 @@ int tls_construct_stoc_use_srtp(SSL *s, WPACKET *pkt, X509 *x, size_t chainidx, 
}

#endif



int tls_construct_stoc_etm(SSL *s, WPACKET *pkt, X509 *x, size_t chainidx,

                           int *al)

int tls_construct_stoc_etm(SSL *s, WPACKET *pkt, unsigned int context, X509 *x,

                           size_t chainidx, int *al)

{

    if ((s->s3->flags & TLS1_FLAGS_ENCRYPT_THEN_MAC) == 0)

        return 1;
@@ -991,8 +1000,8 @@ int tls_construct_stoc_etm(SSL *s, WPACKET *pkt, X509 *x, size_t chainidx, 
    return 1;

}



int tls_construct_stoc_ems(SSL *s, WPACKET *pkt, X509 *x, size_t chainidx,

                           int *al)

int tls_construct_stoc_ems(SSL *s, WPACKET *pkt, unsigned int context, X509 *x,

                           size_t chainidx, int *al)

{

    if ((s->s3->flags & TLS1_FLAGS_RECEIVED_EXTMS) == 0)

        return 1;
@@ -1006,8 +1015,8 @@ int tls_construct_stoc_ems(SSL *s, WPACKET *pkt, X509 *x, size_t chainidx, 
    return 1;

}



int tls_construct_stoc_key_share(SSL *s, WPACKET *pkt, X509 *x, size_t chainidx,

                                 int *al)

int tls_construct_stoc_key_share(SSL *s, WPACKET *pkt, unsigned int context,

                                 X509 *x, size_t chainidx, int *al)

{

#ifndef OPENSSL_NO_TLS1_3

    unsigned char *encodedPoint;
@@ -1065,8 +1074,8 @@ int tls_construct_stoc_key_share(SSL *s, WPACKET *pkt, X509 *x, size_t chainidx, 
    return 1;

}



int tls_construct_stoc_cryptopro_bug(SSL *s, WPACKET *pkt, X509 *x,

                                     size_t chainidx, int *al)

int tls_construct_stoc_cryptopro_bug(SSL *s, WPACKET *pkt, unsigned int context,

                                     X509 *x, size_t chainidx, int *al)

{

    const unsigned char cryptopro_ext[36] = {

        0xfd, 0xe8,         /* 65000 */
@@ -1090,8 +1099,8 @@ int tls_construct_stoc_cryptopro_bug(SSL *s, WPACKET *pkt, X509 *x, 
    return 1;

}



int tls_construct_stoc_psk(SSL *s, WPACKET *pkt, X509 *x, size_t chainidx,

                           int *al)

int tls_construct_stoc_psk(SSL *s, WPACKET *pkt, unsigned int context, X509 *x,

                           size_t chainidx, int *al)

{

    if (!s->hit)

        return 1;

ssl/statem/statem_locl.h

+122 −103

File changed.

Preview size limit exceeded, changes collapsed.