1 /* Copyright (C) 1995-1998 Eric Young (eay@cryptsoft.com)
2 * All rights reserved.
3 *
4 * This package is an SSL implementation written
5 * by Eric Young (eay@cryptsoft.com).
6 * The implementation was written so as to conform with Netscapes SSL.
7 *
8 * This library is free for commercial and non-commercial use as long as
9 * the following conditions are aheared to. The following conditions
10 * apply to all code found in this distribution, be it the RC4, RSA,
11 * lhash, DES, etc., code; not just the SSL code. The SSL documentation
12 * included with this distribution is covered by the same copyright terms
13 * except that the holder is Tim Hudson (tjh@cryptsoft.com).
14 *
15 * Copyright remains Eric Young's, and as such any Copyright notices in
16 * the code are not to be removed.
17 * If this package is used in a product, Eric Young should be given attribution
18 * as the author of the parts of the library used.
19 * This can be in the form of a textual message at program startup or
20 * in documentation (online or textual) provided with the package.
21 *
22 * Redistribution and use in source and binary forms, with or without
23 * modification, are permitted provided that the following conditions
24 * are met:
25 * 1. Redistributions of source code must retain the copyright
26 * notice, this list of conditions and the following disclaimer.
27 * 2. Redistributions in binary form must reproduce the above copyright
28 * notice, this list of conditions and the following disclaimer in the
29 * documentation and/or other materials provided with the distribution.
30 * 3. All advertising materials mentioning features or use of this software
31 * must display the following acknowledgement:
32 * "This product includes cryptographic software written by
33 * Eric Young (eay@cryptsoft.com)"
34 * The word 'cryptographic' can be left out if the rouines from the library
35 * being used are not cryptographic related :-).
36 * 4. If you include any Windows specific code (or a derivative thereof) from
37 * the apps directory (application code) you must include an acknowledgement:
38 * "This product includes software written by Tim Hudson (tjh@cryptsoft.com)"
39 *
40 * THIS SOFTWARE IS PROVIDED BY ERIC YOUNG ``AS IS'' AND
41 * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
42 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
43 * ARE DISCLAIMED. IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE
44 * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
45 * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
46 * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
47 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
48 * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
49 * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
50 * SUCH DAMAGE.
51 *
52 * The licence and distribution terms for any publically available version or
53 * derivative of this code cannot be changed. i.e. this code cannot simply be
54 * copied and put under another distribution licence
55 * [including the GNU Public Licence.]
56 */
57 /* ====================================================================
58 * Copyright (c) 1998-2007 The OpenSSL Project. All rights reserved.
59 *
60 * Redistribution and use in source and binary forms, with or without
61 * modification, are permitted provided that the following conditions
62 * are met:
63 *
64 * 1. Redistributions of source code must retain the above copyright
65 * notice, this list of conditions and the following disclaimer.
66 *
67 * 2. Redistributions in binary form must reproduce the above copyright
68 * notice, this list of conditions and the following disclaimer in
69 * the documentation and/or other materials provided with the
70 * distribution.
71 *
72 * 3. All advertising materials mentioning features or use of this
73 * software must display the following acknowledgment:
74 * "This product includes software developed by the OpenSSL Project
75 * for use in the OpenSSL Toolkit. (http://www.openssl.org/)"
76 *
77 * 4. The names "OpenSSL Toolkit" and "OpenSSL Project" must not be used to
78 * endorse or promote products derived from this software without
79 * prior written permission. For written permission, please contact
80 * openssl-core@openssl.org.
81 *
82 * 5. Products derived from this software may not be called "OpenSSL"
83 * nor may "OpenSSL" appear in their names without prior written
84 * permission of the OpenSSL Project.
85 *
86 * 6. Redistributions of any form whatsoever must retain the following
87 * acknowledgment:
88 * "This product includes software developed by the OpenSSL Project
89 * for use in the OpenSSL Toolkit (http://www.openssl.org/)"
90 *
91 * THIS SOFTWARE IS PROVIDED BY THE OpenSSL PROJECT ``AS IS'' AND ANY
92 * EXPRESSED OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
93 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
94 * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE OpenSSL PROJECT OR
95 * ITS CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
96 * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
97 * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
98 * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
99 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT,
100 * STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
101 * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED
102 * OF THE POSSIBILITY OF SUCH DAMAGE.
103 * ====================================================================
104 *
105 * This product includes cryptographic software written by Eric Young
106 * (eay@cryptsoft.com). This product includes software written by Tim
107 * Hudson (tjh@cryptsoft.com).
108 *
109 */
110 /* ====================================================================
111 * Copyright 2002 Sun Microsystems, Inc. ALL RIGHTS RESERVED.
112 * ECC cipher suite support in OpenSSL originally developed by
113 * SUN MICROSYSTEMS, INC., and contributed to the OpenSSL project.
114 */
115 /* ====================================================================
116 * Copyright 2005 Nokia. All rights reserved.
117 *
118 * The portions of the attached software ("Contribution") is developed by
119 * Nokia Corporation and is licensed pursuant to the OpenSSL open source
120 * license.
121 *
122 * The Contribution, originally written by Mika Kousa and Pasi Eronen of
123 * Nokia Corporation, consists of the "PSK" (Pre-Shared Key) ciphersuites
124 * support (see RFC 4279) to OpenSSL.
125 *
126 * No patent licenses or other rights except those expressly stated in
127 * the OpenSSL open source license shall be deemed granted or received
128 * expressly, by implication, estoppel, or otherwise.
129 *
130 * No assurances are provided by Nokia that the Contribution does not
131 * infringe the patent or other intellectual property rights of any third
132 * party or that the license provides you with all the necessary rights
133 * to make use of the Contribution.
134 *
135 * THE SOFTWARE IS PROVIDED "AS IS" WITHOUT WARRANTY OF ANY KIND. IN
136 * ADDITION TO THE DISCLAIMERS INCLUDED IN THE LICENSE, NOKIA
137 * SPECIFICALLY DISCLAIMS ANY LIABILITY FOR CLAIMS BROUGHT BY YOU OR ANY
138 * OTHER ENTITY BASED ON INFRINGEMENT OF INTELLECTUAL PROPERTY RIGHTS OR
139 * OTHERWISE. */
140
141 #include <openssl/ssl.h>
142
143 #include <assert.h>
144 #include <stdlib.h>
145 #include <string.h>
146
147 #include <openssl/bytestring.h>
148 #include <openssl/crypto.h>
149 #include <openssl/err.h>
150 #include <openssl/lhash.h>
151 #include <openssl/mem.h>
152 #include <openssl/rand.h>
153
154 #include "internal.h"
155 #include "../crypto/internal.h"
156
157 #if defined(OPENSSL_WINDOWS)
158 #include <sys/timeb.h>
159 #else
160 #include <sys/socket.h>
161 #include <sys/time.h>
162 #endif
163
164
165 BSSL_NAMESPACE_BEGIN
166
167 // |SSL_R_UNKNOWN_PROTOCOL| is no longer emitted, but continue to define it
168 // to avoid downstream churn.
169 OPENSSL_DECLARE_ERROR_REASON(SSL, UNKNOWN_PROTOCOL)
170
171 // The following errors are no longer emitted, but are used in nginx without
172 // #ifdefs.
173 OPENSSL_DECLARE_ERROR_REASON(SSL, BLOCK_CIPHER_PAD_IS_WRONG)
174 OPENSSL_DECLARE_ERROR_REASON(SSL, NO_CIPHERS_SPECIFIED)
175
176 // Some error codes are special. Ensure the make_errors.go script never
177 // regresses this.
178 static_assert(SSL_R_TLSV1_ALERT_NO_RENEGOTIATION ==
179 SSL_AD_NO_RENEGOTIATION + SSL_AD_REASON_OFFSET,
180 "alert reason code mismatch");
181
182 // kMaxHandshakeSize is the maximum size, in bytes, of a handshake message.
183 static const size_t kMaxHandshakeSize = (1u << 24) - 1;
184
185 static CRYPTO_EX_DATA_CLASS g_ex_data_class_ssl =
186 CRYPTO_EX_DATA_CLASS_INIT_WITH_APP_DATA;
187 static CRYPTO_EX_DATA_CLASS g_ex_data_class_ssl_ctx =
188 CRYPTO_EX_DATA_CLASS_INIT_WITH_APP_DATA;
189
CBBFinishArray(CBB * cbb,Array<uint8_t> * out)190 bool CBBFinishArray(CBB *cbb, Array<uint8_t> *out) {
191 uint8_t *ptr;
192 size_t len;
193 if (!CBB_finish(cbb, &ptr, &len)) {
194 OPENSSL_PUT_ERROR(SSL, ERR_R_INTERNAL_ERROR);
195 return false;
196 }
197 out->Reset(ptr, len);
198 return true;
199 }
200
ssl_reset_error_state(SSL * ssl)201 void ssl_reset_error_state(SSL *ssl) {
202 // Functions which use |SSL_get_error| must reset I/O and error state on
203 // entry.
204 ssl->s3->rwstate = SSL_ERROR_NONE;
205 ERR_clear_error();
206 ERR_clear_system_error();
207 }
208
ssl_set_read_error(SSL * ssl)209 void ssl_set_read_error(SSL* ssl) {
210 ssl->s3->read_shutdown = ssl_shutdown_error;
211 ssl->s3->read_error.reset(ERR_save_state());
212 }
213
check_read_error(const SSL * ssl)214 static bool check_read_error(const SSL *ssl) {
215 if (ssl->s3->read_shutdown == ssl_shutdown_error) {
216 ERR_restore_state(ssl->s3->read_error.get());
217 return false;
218 }
219 return true;
220 }
221
ssl_can_write(const SSL * ssl)222 bool ssl_can_write(const SSL *ssl) {
223 return !SSL_in_init(ssl) || ssl->s3->hs->can_early_write;
224 }
225
ssl_can_read(const SSL * ssl)226 bool ssl_can_read(const SSL *ssl) {
227 return !SSL_in_init(ssl) || ssl->s3->hs->can_early_read;
228 }
229
ssl_open_handshake(SSL * ssl,size_t * out_consumed,uint8_t * out_alert,Span<uint8_t> in)230 ssl_open_record_t ssl_open_handshake(SSL *ssl, size_t *out_consumed,
231 uint8_t *out_alert, Span<uint8_t> in) {
232 *out_consumed = 0;
233 if (!check_read_error(ssl)) {
234 *out_alert = 0;
235 return ssl_open_record_error;
236 }
237 auto ret = ssl->method->open_handshake(ssl, out_consumed, out_alert, in);
238 if (ret == ssl_open_record_error) {
239 ssl_set_read_error(ssl);
240 }
241 return ret;
242 }
243
ssl_open_change_cipher_spec(SSL * ssl,size_t * out_consumed,uint8_t * out_alert,Span<uint8_t> in)244 ssl_open_record_t ssl_open_change_cipher_spec(SSL *ssl, size_t *out_consumed,
245 uint8_t *out_alert,
246 Span<uint8_t> in) {
247 *out_consumed = 0;
248 if (!check_read_error(ssl)) {
249 *out_alert = 0;
250 return ssl_open_record_error;
251 }
252 auto ret =
253 ssl->method->open_change_cipher_spec(ssl, out_consumed, out_alert, in);
254 if (ret == ssl_open_record_error) {
255 ssl_set_read_error(ssl);
256 }
257 return ret;
258 }
259
ssl_open_app_data(SSL * ssl,Span<uint8_t> * out,size_t * out_consumed,uint8_t * out_alert,Span<uint8_t> in)260 ssl_open_record_t ssl_open_app_data(SSL *ssl, Span<uint8_t> *out,
261 size_t *out_consumed, uint8_t *out_alert,
262 Span<uint8_t> in) {
263 *out_consumed = 0;
264 if (!check_read_error(ssl)) {
265 *out_alert = 0;
266 return ssl_open_record_error;
267 }
268 auto ret = ssl->method->open_app_data(ssl, out, out_consumed, out_alert, in);
269 if (ret == ssl_open_record_error) {
270 ssl_set_read_error(ssl);
271 }
272 return ret;
273 }
274
cbb_add_hex(CBB * cbb,Span<const uint8_t> in)275 static bool cbb_add_hex(CBB *cbb, Span<const uint8_t> in) {
276 static const char hextable[] = "0123456789abcdef";
277 uint8_t *out;
278
279 if (!CBB_add_space(cbb, &out, in.size() * 2)) {
280 return false;
281 }
282
283 for (uint8_t b : in) {
284 *(out++) = (uint8_t)hextable[b >> 4];
285 *(out++) = (uint8_t)hextable[b & 0xf];
286 }
287
288 return true;
289 }
290
ssl_log_secret(const SSL * ssl,const char * label,Span<const uint8_t> secret)291 bool ssl_log_secret(const SSL *ssl, const char *label,
292 Span<const uint8_t> secret) {
293 if (ssl->ctx->keylog_callback == NULL) {
294 return true;
295 }
296
297 ScopedCBB cbb;
298 Array<uint8_t> line;
299 if (!CBB_init(cbb.get(), strlen(label) + 1 + SSL3_RANDOM_SIZE * 2 + 1 +
300 secret.size() * 2 + 1) ||
301 !CBB_add_bytes(cbb.get(), reinterpret_cast<const uint8_t *>(label),
302 strlen(label)) ||
303 !CBB_add_u8(cbb.get(), ' ') ||
304 !cbb_add_hex(cbb.get(), ssl->s3->client_random) ||
305 !CBB_add_u8(cbb.get(), ' ') ||
306 !cbb_add_hex(cbb.get(), secret) ||
307 !CBB_add_u8(cbb.get(), 0 /* NUL */) ||
308 !CBBFinishArray(cbb.get(), &line)) {
309 return false;
310 }
311
312 ssl->ctx->keylog_callback(ssl, reinterpret_cast<const char *>(line.data()));
313 return true;
314 }
315
ssl_do_info_callback(const SSL * ssl,int type,int value)316 void ssl_do_info_callback(const SSL *ssl, int type, int value) {
317 void (*cb)(const SSL *ssl, int type, int value) = NULL;
318 if (ssl->info_callback != NULL) {
319 cb = ssl->info_callback;
320 } else if (ssl->ctx->info_callback != NULL) {
321 cb = ssl->ctx->info_callback;
322 }
323
324 if (cb != NULL) {
325 cb(ssl, type, value);
326 }
327 }
328
ssl_do_msg_callback(const SSL * ssl,int is_write,int content_type,Span<const uint8_t> in)329 void ssl_do_msg_callback(const SSL *ssl, int is_write, int content_type,
330 Span<const uint8_t> in) {
331 if (ssl->msg_callback == NULL) {
332 return;
333 }
334
335 // |version| is zero when calling for |SSL3_RT_HEADER| and |SSL2_VERSION| for
336 // a V2ClientHello.
337 int version;
338 switch (content_type) {
339 case 0:
340 // V2ClientHello
341 version = SSL2_VERSION;
342 break;
343 case SSL3_RT_HEADER:
344 version = 0;
345 break;
346 default:
347 version = SSL_version(ssl);
348 }
349
350 ssl->msg_callback(is_write, version, content_type, in.data(), in.size(),
351 const_cast<SSL *>(ssl), ssl->msg_callback_arg);
352 }
353
ssl_get_current_time(const SSL * ssl,struct OPENSSL_timeval * out_clock)354 void ssl_get_current_time(const SSL *ssl, struct OPENSSL_timeval *out_clock) {
355 // TODO(martinkr): Change callers to |ssl_ctx_get_current_time| and drop the
356 // |ssl| arg from |current_time_cb| if possible.
357 ssl_ctx_get_current_time(ssl->ctx.get(), out_clock);
358 }
359
ssl_ctx_get_current_time(const SSL_CTX * ctx,struct OPENSSL_timeval * out_clock)360 void ssl_ctx_get_current_time(const SSL_CTX *ctx,
361 struct OPENSSL_timeval *out_clock) {
362 if (ctx->current_time_cb != NULL) {
363 // TODO(davidben): Update current_time_cb to use OPENSSL_timeval. See
364 // https://crbug.com/boringssl/155.
365 struct timeval clock;
366 ctx->current_time_cb(nullptr /* ssl */, &clock);
367 if (clock.tv_sec < 0) {
368 assert(0);
369 out_clock->tv_sec = 0;
370 out_clock->tv_usec = 0;
371 } else {
372 out_clock->tv_sec = (uint64_t)clock.tv_sec;
373 out_clock->tv_usec = (uint32_t)clock.tv_usec;
374 }
375 return;
376 }
377
378 #if defined(BORINGSSL_UNSAFE_DETERMINISTIC_MODE)
379 out_clock->tv_sec = 1234;
380 out_clock->tv_usec = 1234;
381 #elif defined(OPENSSL_WINDOWS)
382 struct _timeb time;
383 _ftime(&time);
384 if (time.time < 0) {
385 assert(0);
386 out_clock->tv_sec = 0;
387 out_clock->tv_usec = 0;
388 } else {
389 out_clock->tv_sec = time.time;
390 out_clock->tv_usec = time.millitm * 1000;
391 }
392 #else
393 struct timeval clock;
394 gettimeofday(&clock, NULL);
395 if (clock.tv_sec < 0) {
396 assert(0);
397 out_clock->tv_sec = 0;
398 out_clock->tv_usec = 0;
399 } else {
400 out_clock->tv_sec = (uint64_t)clock.tv_sec;
401 out_clock->tv_usec = (uint32_t)clock.tv_usec;
402 }
403 #endif
404 }
405
SSL_CTX_set_handoff_mode(SSL_CTX * ctx,bool on)406 void SSL_CTX_set_handoff_mode(SSL_CTX *ctx, bool on) {
407 ctx->handoff = on;
408 }
409
ssl_can_renegotiate(const SSL * ssl)410 static bool ssl_can_renegotiate(const SSL *ssl) {
411 if (ssl->server || SSL_is_dtls(ssl)) {
412 return false;
413 }
414
415 if (ssl->s3->have_version &&
416 ssl_protocol_version(ssl) >= TLS1_3_VERSION) {
417 return false;
418 }
419
420 // The config has already been shed.
421 if (!ssl->config) {
422 return false;
423 }
424
425 switch (ssl->renegotiate_mode) {
426 case ssl_renegotiate_ignore:
427 case ssl_renegotiate_never:
428 return false;
429
430 case ssl_renegotiate_freely:
431 case ssl_renegotiate_explicit:
432 return true;
433 case ssl_renegotiate_once:
434 return ssl->s3->total_renegotiations == 0;
435 }
436
437 assert(0);
438 return false;
439 }
440
ssl_maybe_shed_handshake_config(SSL * ssl)441 static void ssl_maybe_shed_handshake_config(SSL *ssl) {
442 if (ssl->s3->hs != nullptr ||
443 ssl->config == nullptr ||
444 !ssl->config->shed_handshake_config ||
445 ssl_can_renegotiate(ssl)) {
446 return;
447 }
448
449 ssl->config.reset();
450 }
451
SSL_set_handoff_mode(SSL * ssl,bool on)452 void SSL_set_handoff_mode(SSL *ssl, bool on) {
453 if (!ssl->config) {
454 return;
455 }
456 ssl->config->handoff = on;
457 }
458
SSL_get_traffic_secrets(const SSL * ssl,Span<const uint8_t> * out_read_traffic_secret,Span<const uint8_t> * out_write_traffic_secret)459 bool SSL_get_traffic_secrets(const SSL *ssl,
460 Span<const uint8_t> *out_read_traffic_secret,
461 Span<const uint8_t> *out_write_traffic_secret) {
462 if (SSL_version(ssl) < TLS1_3_VERSION) {
463 OPENSSL_PUT_ERROR(SSL, SSL_R_WRONG_SSL_VERSION);
464 return false;
465 }
466
467 if (!ssl->s3->initial_handshake_complete) {
468 OPENSSL_PUT_ERROR(SSL, SSL_R_HANDSHAKE_NOT_COMPLETE);
469 return false;
470 }
471
472 *out_read_traffic_secret = Span<const uint8_t>(
473 ssl->s3->read_traffic_secret, ssl->s3->read_traffic_secret_len);
474 *out_write_traffic_secret = Span<const uint8_t>(
475 ssl->s3->write_traffic_secret, ssl->s3->write_traffic_secret_len);
476
477 return true;
478 }
479
480 BSSL_NAMESPACE_END
481
482 using namespace bssl;
483
SSL_library_init(void)484 int SSL_library_init(void) {
485 CRYPTO_library_init();
486 return 1;
487 }
488
OPENSSL_init_ssl(uint64_t opts,const OPENSSL_INIT_SETTINGS * settings)489 int OPENSSL_init_ssl(uint64_t opts, const OPENSSL_INIT_SETTINGS *settings) {
490 CRYPTO_library_init();
491 return 1;
492 }
493
ssl_session_hash(const SSL_SESSION * sess)494 static uint32_t ssl_session_hash(const SSL_SESSION *sess) {
495 return ssl_hash_session_id(
496 MakeConstSpan(sess->session_id, sess->session_id_length));
497 }
498
ssl_session_cmp(const SSL_SESSION * a,const SSL_SESSION * b)499 static int ssl_session_cmp(const SSL_SESSION *a, const SSL_SESSION *b) {
500 if (a->session_id_length != b->session_id_length) {
501 return 1;
502 }
503
504 return OPENSSL_memcmp(a->session_id, b->session_id, a->session_id_length);
505 }
506
ssl_ctx_st(const SSL_METHOD * ssl_method)507 ssl_ctx_st::ssl_ctx_st(const SSL_METHOD *ssl_method)
508 : method(ssl_method->method),
509 x509_method(ssl_method->x509_method),
510 retain_only_sha256_of_client_certs(false),
511 quiet_shutdown(false),
512 ocsp_stapling_enabled(false),
513 signed_cert_timestamps_enabled(false),
514 channel_id_enabled(false),
515 grease_enabled(false),
516 permute_extensions(false),
517 allow_unknown_alpn_protos(false),
518 false_start_allowed_without_alpn(false),
519 handoff(false),
520 enable_early_data(false) {
521 CRYPTO_MUTEX_init(&lock);
522 CRYPTO_new_ex_data(&ex_data);
523 }
524
~ssl_ctx_st()525 ssl_ctx_st::~ssl_ctx_st() {
526 // Free the internal session cache. Note that this calls the caller-supplied
527 // remove callback, so we must do it before clearing ex_data. (See ticket
528 // [openssl.org #212].)
529 SSL_CTX_flush_sessions(this, 0);
530
531 CRYPTO_free_ex_data(&g_ex_data_class_ssl_ctx, this, &ex_data);
532
533 CRYPTO_MUTEX_cleanup(&lock);
534 lh_SSL_SESSION_free(sessions);
535 x509_method->ssl_ctx_free(this);
536 }
537
SSL_CTX_new(const SSL_METHOD * method)538 SSL_CTX *SSL_CTX_new(const SSL_METHOD *method) {
539 if (method == NULL) {
540 OPENSSL_PUT_ERROR(SSL, SSL_R_NULL_SSL_METHOD_PASSED);
541 return nullptr;
542 }
543
544 UniquePtr<SSL_CTX> ret = MakeUnique<SSL_CTX>(method);
545 if (!ret) {
546 return nullptr;
547 }
548
549 ret->cert = MakeUnique<CERT>(method->x509_method);
550 ret->sessions = lh_SSL_SESSION_new(ssl_session_hash, ssl_session_cmp);
551 ret->client_CA.reset(sk_CRYPTO_BUFFER_new_null());
552 if (ret->cert == nullptr ||
553 ret->sessions == nullptr ||
554 ret->client_CA == nullptr ||
555 !ret->x509_method->ssl_ctx_new(ret.get())) {
556 return nullptr;
557 }
558
559 if (!SSL_CTX_set_strict_cipher_list(ret.get(), SSL_DEFAULT_CIPHER_LIST) ||
560 // Lock the SSL_CTX to the specified version, for compatibility with
561 // legacy uses of SSL_METHOD.
562 !SSL_CTX_set_max_proto_version(ret.get(), method->version) ||
563 !SSL_CTX_set_min_proto_version(ret.get(), method->version)) {
564 OPENSSL_PUT_ERROR(SSL, ERR_R_INTERNAL_ERROR);
565 return nullptr;
566 }
567
568 return ret.release();
569 }
570
SSL_CTX_up_ref(SSL_CTX * ctx)571 int SSL_CTX_up_ref(SSL_CTX *ctx) {
572 CRYPTO_refcount_inc(&ctx->references);
573 return 1;
574 }
575
SSL_CTX_free(SSL_CTX * ctx)576 void SSL_CTX_free(SSL_CTX *ctx) {
577 if (ctx == NULL ||
578 !CRYPTO_refcount_dec_and_test_zero(&ctx->references)) {
579 return;
580 }
581
582 ctx->~ssl_ctx_st();
583 OPENSSL_free(ctx);
584 }
585
ssl_st(SSL_CTX * ctx_arg)586 ssl_st::ssl_st(SSL_CTX *ctx_arg)
587 : method(ctx_arg->method),
588 max_send_fragment(ctx_arg->max_send_fragment),
589 msg_callback(ctx_arg->msg_callback),
590 msg_callback_arg(ctx_arg->msg_callback_arg),
591 ctx(UpRef(ctx_arg)),
592 session_ctx(UpRef(ctx_arg)),
593 options(ctx->options),
594 mode(ctx->mode),
595 max_cert_list(ctx->max_cert_list),
596 server(false),
597 quiet_shutdown(ctx->quiet_shutdown),
598 enable_early_data(ctx->enable_early_data) {
599 CRYPTO_new_ex_data(&ex_data);
600 }
601
~ssl_st()602 ssl_st::~ssl_st() {
603 CRYPTO_free_ex_data(&g_ex_data_class_ssl, this, &ex_data);
604 // |config| refers to |this|, so we must release it earlier.
605 config.reset();
606 if (method != NULL) {
607 method->ssl_free(this);
608 }
609 }
610
SSL_new(SSL_CTX * ctx)611 SSL *SSL_new(SSL_CTX *ctx) {
612 if (ctx == nullptr) {
613 OPENSSL_PUT_ERROR(SSL, SSL_R_NULL_SSL_CTX);
614 return nullptr;
615 }
616
617 UniquePtr<SSL> ssl = MakeUnique<SSL>(ctx);
618 if (ssl == nullptr) {
619 return nullptr;
620 }
621
622 ssl->config = MakeUnique<SSL_CONFIG>(ssl.get());
623 if (ssl->config == nullptr) {
624 return nullptr;
625 }
626 ssl->config->conf_min_version = ctx->conf_min_version;
627 ssl->config->conf_max_version = ctx->conf_max_version;
628
629 ssl->config->cert = ssl_cert_dup(ctx->cert.get());
630 if (ssl->config->cert == nullptr) {
631 return nullptr;
632 }
633
634 ssl->config->verify_mode = ctx->verify_mode;
635 ssl->config->verify_callback = ctx->default_verify_callback;
636 ssl->config->custom_verify_callback = ctx->custom_verify_callback;
637 ssl->config->retain_only_sha256_of_client_certs =
638 ctx->retain_only_sha256_of_client_certs;
639 ssl->config->permute_extensions = ctx->permute_extensions;
640
641 if (!ssl->config->supported_group_list.CopyFrom(ctx->supported_group_list) ||
642 !ssl->config->alpn_client_proto_list.CopyFrom(
643 ctx->alpn_client_proto_list) ||
644 !ssl->config->verify_sigalgs.CopyFrom(ctx->verify_sigalgs)) {
645 return nullptr;
646 }
647
648 if (ctx->psk_identity_hint) {
649 ssl->config->psk_identity_hint.reset(
650 OPENSSL_strdup(ctx->psk_identity_hint.get()));
651 if (ssl->config->psk_identity_hint == nullptr) {
652 return nullptr;
653 }
654 }
655 ssl->config->psk_client_callback = ctx->psk_client_callback;
656 ssl->config->psk_server_callback = ctx->psk_server_callback;
657
658 ssl->config->channel_id_enabled = ctx->channel_id_enabled;
659 ssl->config->channel_id_private = UpRef(ctx->channel_id_private);
660
661 ssl->config->signed_cert_timestamps_enabled =
662 ctx->signed_cert_timestamps_enabled;
663 ssl->config->ocsp_stapling_enabled = ctx->ocsp_stapling_enabled;
664 ssl->config->handoff = ctx->handoff;
665 ssl->quic_method = ctx->quic_method;
666
667 if (!ssl->method->ssl_new(ssl.get()) ||
668 !ssl->ctx->x509_method->ssl_new(ssl->s3->hs.get())) {
669 return nullptr;
670 }
671
672 return ssl.release();
673 }
674
SSL_CONFIG(SSL * ssl_arg)675 SSL_CONFIG::SSL_CONFIG(SSL *ssl_arg)
676 : ssl(ssl_arg),
677 ech_grease_enabled(false),
678 signed_cert_timestamps_enabled(false),
679 ocsp_stapling_enabled(false),
680 channel_id_enabled(false),
681 enforce_rsa_key_usage(false),
682 retain_only_sha256_of_client_certs(false),
683 handoff(false),
684 shed_handshake_config(false),
685 jdk11_workaround(false),
686 quic_use_legacy_codepoint(false),
687 permute_extensions(false) {
688 assert(ssl);
689 }
690
~SSL_CONFIG()691 SSL_CONFIG::~SSL_CONFIG() {
692 if (ssl->ctx != nullptr) {
693 ssl->ctx->x509_method->ssl_config_free(this);
694 }
695 }
696
SSL_free(SSL * ssl)697 void SSL_free(SSL *ssl) {
698 Delete(ssl);
699 }
700
SSL_set_connect_state(SSL * ssl)701 void SSL_set_connect_state(SSL *ssl) {
702 ssl->server = false;
703 ssl->do_handshake = ssl_client_handshake;
704 }
705
SSL_set_accept_state(SSL * ssl)706 void SSL_set_accept_state(SSL *ssl) {
707 ssl->server = true;
708 ssl->do_handshake = ssl_server_handshake;
709 }
710
SSL_set0_rbio(SSL * ssl,BIO * rbio)711 void SSL_set0_rbio(SSL *ssl, BIO *rbio) {
712 ssl->rbio.reset(rbio);
713 }
714
SSL_set0_wbio(SSL * ssl,BIO * wbio)715 void SSL_set0_wbio(SSL *ssl, BIO *wbio) {
716 ssl->wbio.reset(wbio);
717 }
718
SSL_set_bio(SSL * ssl,BIO * rbio,BIO * wbio)719 void SSL_set_bio(SSL *ssl, BIO *rbio, BIO *wbio) {
720 // For historical reasons, this function has many different cases in ownership
721 // handling.
722
723 // If nothing has changed, do nothing
724 if (rbio == SSL_get_rbio(ssl) && wbio == SSL_get_wbio(ssl)) {
725 return;
726 }
727
728 // If the two arguments are equal, one fewer reference is granted than
729 // taken.
730 if (rbio != NULL && rbio == wbio) {
731 BIO_up_ref(rbio);
732 }
733
734 // If only the wbio is changed, adopt only one reference.
735 if (rbio == SSL_get_rbio(ssl)) {
736 SSL_set0_wbio(ssl, wbio);
737 return;
738 }
739
740 // There is an asymmetry here for historical reasons. If only the rbio is
741 // changed AND the rbio and wbio were originally different, then we only adopt
742 // one reference.
743 if (wbio == SSL_get_wbio(ssl) && SSL_get_rbio(ssl) != SSL_get_wbio(ssl)) {
744 SSL_set0_rbio(ssl, rbio);
745 return;
746 }
747
748 // Otherwise, adopt both references.
749 SSL_set0_rbio(ssl, rbio);
750 SSL_set0_wbio(ssl, wbio);
751 }
752
SSL_get_rbio(const SSL * ssl)753 BIO *SSL_get_rbio(const SSL *ssl) { return ssl->rbio.get(); }
754
SSL_get_wbio(const SSL * ssl)755 BIO *SSL_get_wbio(const SSL *ssl) { return ssl->wbio.get(); }
756
SSL_quic_max_handshake_flight_len(const SSL * ssl,enum ssl_encryption_level_t level)757 size_t SSL_quic_max_handshake_flight_len(const SSL *ssl,
758 enum ssl_encryption_level_t level) {
759 // Limits flights to 16K by default when there are no large
760 // (certificate-carrying) messages.
761 static const size_t kDefaultLimit = 16384;
762
763 switch (level) {
764 case ssl_encryption_initial:
765 return kDefaultLimit;
766 case ssl_encryption_early_data:
767 // QUIC does not send EndOfEarlyData.
768 return 0;
769 case ssl_encryption_handshake:
770 if (ssl->server) {
771 // Servers may receive Certificate message if configured to request
772 // client certificates.
773 if (!!(ssl->config->verify_mode & SSL_VERIFY_PEER) &&
774 ssl->max_cert_list > kDefaultLimit) {
775 return ssl->max_cert_list;
776 }
777 } else {
778 // Clients may receive both Certificate message and a CertificateRequest
779 // message.
780 if (2*ssl->max_cert_list > kDefaultLimit) {
781 return 2*ssl->max_cert_list;
782 }
783 }
784 return kDefaultLimit;
785 case ssl_encryption_application:
786 // Note there is not actually a bound on the number of NewSessionTickets
787 // one may send in a row. This level may need more involved flow
788 // control. See https://github.com/quicwg/base-drafts/issues/1834.
789 return kDefaultLimit;
790 }
791
792 return 0;
793 }
794
SSL_quic_read_level(const SSL * ssl)795 enum ssl_encryption_level_t SSL_quic_read_level(const SSL *ssl) {
796 return ssl->s3->read_level;
797 }
798
SSL_quic_write_level(const SSL * ssl)799 enum ssl_encryption_level_t SSL_quic_write_level(const SSL *ssl) {
800 return ssl->s3->write_level;
801 }
802
SSL_provide_quic_data(SSL * ssl,enum ssl_encryption_level_t level,const uint8_t * data,size_t len)803 int SSL_provide_quic_data(SSL *ssl, enum ssl_encryption_level_t level,
804 const uint8_t *data, size_t len) {
805 if (ssl->quic_method == nullptr) {
806 OPENSSL_PUT_ERROR(SSL, ERR_R_SHOULD_NOT_HAVE_BEEN_CALLED);
807 return 0;
808 }
809
810 if (level != ssl->s3->read_level) {
811 OPENSSL_PUT_ERROR(SSL, SSL_R_WRONG_ENCRYPTION_LEVEL_RECEIVED);
812 return 0;
813 }
814
815 size_t new_len = (ssl->s3->hs_buf ? ssl->s3->hs_buf->length : 0) + len;
816 if (new_len < len ||
817 new_len > SSL_quic_max_handshake_flight_len(ssl, level)) {
818 OPENSSL_PUT_ERROR(SSL, SSL_R_EXCESSIVE_MESSAGE_SIZE);
819 return 0;
820 }
821
822 return tls_append_handshake_data(ssl, MakeConstSpan(data, len));
823 }
824
SSL_do_handshake(SSL * ssl)825 int SSL_do_handshake(SSL *ssl) {
826 ssl_reset_error_state(ssl);
827
828 if (ssl->do_handshake == NULL) {
829 OPENSSL_PUT_ERROR(SSL, SSL_R_CONNECTION_TYPE_NOT_SET);
830 return -1;
831 }
832
833 if (!SSL_in_init(ssl)) {
834 return 1;
835 }
836
837 // Run the handshake.
838 SSL_HANDSHAKE *hs = ssl->s3->hs.get();
839
840 bool early_return = false;
841 int ret = ssl_run_handshake(hs, &early_return);
842 ssl_do_info_callback(
843 ssl, ssl->server ? SSL_CB_ACCEPT_EXIT : SSL_CB_CONNECT_EXIT, ret);
844 if (ret <= 0) {
845 return ret;
846 }
847
848 // Destroy the handshake object if the handshake has completely finished.
849 if (!early_return) {
850 ssl->s3->hs.reset();
851 ssl_maybe_shed_handshake_config(ssl);
852 }
853
854 return 1;
855 }
856
SSL_connect(SSL * ssl)857 int SSL_connect(SSL *ssl) {
858 if (ssl->do_handshake == NULL) {
859 // Not properly initialized yet
860 SSL_set_connect_state(ssl);
861 }
862
863 return SSL_do_handshake(ssl);
864 }
865
SSL_accept(SSL * ssl)866 int SSL_accept(SSL *ssl) {
867 if (ssl->do_handshake == NULL) {
868 // Not properly initialized yet
869 SSL_set_accept_state(ssl);
870 }
871
872 return SSL_do_handshake(ssl);
873 }
874
ssl_do_post_handshake(SSL * ssl,const SSLMessage & msg)875 static int ssl_do_post_handshake(SSL *ssl, const SSLMessage &msg) {
876 if (ssl_protocol_version(ssl) >= TLS1_3_VERSION) {
877 return tls13_post_handshake(ssl, msg);
878 }
879
880 // Check for renegotiation on the server before parsing to use the correct
881 // error. Renegotiation is triggered by a different message for servers.
882 if (ssl->server) {
883 OPENSSL_PUT_ERROR(SSL, SSL_R_NO_RENEGOTIATION);
884 ssl_send_alert(ssl, SSL3_AL_FATAL, SSL_AD_NO_RENEGOTIATION);
885 return 0;
886 }
887
888 if (msg.type != SSL3_MT_HELLO_REQUEST || CBS_len(&msg.body) != 0) {
889 ssl_send_alert(ssl, SSL3_AL_FATAL, SSL_AD_DECODE_ERROR);
890 OPENSSL_PUT_ERROR(SSL, SSL_R_BAD_HELLO_REQUEST);
891 return 0;
892 }
893
894 if (ssl->renegotiate_mode == ssl_renegotiate_ignore) {
895 return 1; // Ignore the HelloRequest.
896 }
897
898 ssl->s3->renegotiate_pending = true;
899 if (ssl->renegotiate_mode == ssl_renegotiate_explicit) {
900 return 1; // Handle it later.
901 }
902
903 if (!SSL_renegotiate(ssl)) {
904 ssl_send_alert(ssl, SSL3_AL_FATAL, SSL_AD_NO_RENEGOTIATION);
905 return 0;
906 }
907
908 return 1;
909 }
910
SSL_process_quic_post_handshake(SSL * ssl)911 int SSL_process_quic_post_handshake(SSL *ssl) {
912 ssl_reset_error_state(ssl);
913
914 if (SSL_in_init(ssl)) {
915 OPENSSL_PUT_ERROR(SSL, ERR_R_SHOULD_NOT_HAVE_BEEN_CALLED);
916 return 0;
917 }
918
919 // Replay post-handshake message errors.
920 if (!check_read_error(ssl)) {
921 return 0;
922 }
923
924 // Process any buffered post-handshake messages.
925 SSLMessage msg;
926 while (ssl->method->get_message(ssl, &msg)) {
927 // Handle the post-handshake message and try again.
928 if (!ssl_do_post_handshake(ssl, msg)) {
929 ssl_set_read_error(ssl);
930 return 0;
931 }
932 ssl->method->next_message(ssl);
933 }
934
935 return 1;
936 }
937
ssl_read_impl(SSL * ssl)938 static int ssl_read_impl(SSL *ssl) {
939 ssl_reset_error_state(ssl);
940
941 if (ssl->do_handshake == NULL) {
942 OPENSSL_PUT_ERROR(SSL, SSL_R_UNINITIALIZED);
943 return -1;
944 }
945
946 // Replay post-handshake message errors.
947 if (!check_read_error(ssl)) {
948 return -1;
949 }
950
951 while (ssl->s3->pending_app_data.empty()) {
952 if (ssl->s3->renegotiate_pending) {
953 ssl->s3->rwstate = SSL_ERROR_WANT_RENEGOTIATE;
954 return -1;
955 }
956
957 // Complete the current handshake, if any. False Start will cause
958 // |SSL_do_handshake| to return mid-handshake, so this may require multiple
959 // iterations.
960 while (!ssl_can_read(ssl)) {
961 int ret = SSL_do_handshake(ssl);
962 if (ret < 0) {
963 return ret;
964 }
965 if (ret == 0) {
966 OPENSSL_PUT_ERROR(SSL, SSL_R_SSL_HANDSHAKE_FAILURE);
967 return -1;
968 }
969 }
970
971 // Process any buffered post-handshake messages.
972 SSLMessage msg;
973 if (ssl->method->get_message(ssl, &msg)) {
974 // If we received an interrupt in early read (EndOfEarlyData), loop again
975 // for the handshake to process it.
976 if (SSL_in_init(ssl)) {
977 ssl->s3->hs->can_early_read = false;
978 continue;
979 }
980
981 // Handle the post-handshake message and try again.
982 if (!ssl_do_post_handshake(ssl, msg)) {
983 ssl_set_read_error(ssl);
984 return -1;
985 }
986 ssl->method->next_message(ssl);
987 continue; // Loop again. We may have begun a new handshake.
988 }
989
990 uint8_t alert = SSL_AD_DECODE_ERROR;
991 size_t consumed = 0;
992 auto ret = ssl_open_app_data(ssl, &ssl->s3->pending_app_data, &consumed,
993 &alert, ssl->s3->read_buffer.span());
994 bool retry;
995 int bio_ret = ssl_handle_open_record(ssl, &retry, ret, consumed, alert);
996 if (bio_ret <= 0) {
997 return bio_ret;
998 }
999 if (!retry) {
1000 assert(!ssl->s3->pending_app_data.empty());
1001 ssl->s3->key_update_count = 0;
1002 }
1003 }
1004
1005 return 1;
1006 }
1007
SSL_read(SSL * ssl,void * buf,int num)1008 int SSL_read(SSL *ssl, void *buf, int num) {
1009 int ret = SSL_peek(ssl, buf, num);
1010 if (ret <= 0) {
1011 return ret;
1012 }
1013 // TODO(davidben): In DTLS, should the rest of the record be discarded? DTLS
1014 // is not a stream. See https://crbug.com/boringssl/65.
1015 ssl->s3->pending_app_data =
1016 ssl->s3->pending_app_data.subspan(static_cast<size_t>(ret));
1017 if (ssl->s3->pending_app_data.empty()) {
1018 ssl->s3->read_buffer.DiscardConsumed();
1019 }
1020 return ret;
1021 }
1022
SSL_peek(SSL * ssl,void * buf,int num)1023 int SSL_peek(SSL *ssl, void *buf, int num) {
1024 if (ssl->quic_method != nullptr) {
1025 OPENSSL_PUT_ERROR(SSL, ERR_R_SHOULD_NOT_HAVE_BEEN_CALLED);
1026 return -1;
1027 }
1028
1029 int ret = ssl_read_impl(ssl);
1030 if (ret <= 0) {
1031 return ret;
1032 }
1033 if (num <= 0) {
1034 return num;
1035 }
1036 size_t todo =
1037 std::min(ssl->s3->pending_app_data.size(), static_cast<size_t>(num));
1038 OPENSSL_memcpy(buf, ssl->s3->pending_app_data.data(), todo);
1039 return static_cast<int>(todo);
1040 }
1041
SSL_write(SSL * ssl,const void * buf,int num)1042 int SSL_write(SSL *ssl, const void *buf, int num) {
1043 ssl_reset_error_state(ssl);
1044
1045 if (ssl->quic_method != nullptr) {
1046 OPENSSL_PUT_ERROR(SSL, ERR_R_SHOULD_NOT_HAVE_BEEN_CALLED);
1047 return -1;
1048 }
1049
1050 if (ssl->do_handshake == NULL) {
1051 OPENSSL_PUT_ERROR(SSL, SSL_R_UNINITIALIZED);
1052 return -1;
1053 }
1054
1055 int ret = 0;
1056 bool needs_handshake = false;
1057 do {
1058 // If necessary, complete the handshake implicitly.
1059 if (!ssl_can_write(ssl)) {
1060 ret = SSL_do_handshake(ssl);
1061 if (ret < 0) {
1062 return ret;
1063 }
1064 if (ret == 0) {
1065 OPENSSL_PUT_ERROR(SSL, SSL_R_SSL_HANDSHAKE_FAILURE);
1066 return -1;
1067 }
1068 }
1069
1070 ret = ssl->method->write_app_data(ssl, &needs_handshake,
1071 (const uint8_t *)buf, num);
1072 } while (needs_handshake);
1073 return ret;
1074 }
1075
SSL_key_update(SSL * ssl,int request_type)1076 int SSL_key_update(SSL *ssl, int request_type) {
1077 ssl_reset_error_state(ssl);
1078
1079 if (ssl->do_handshake == NULL) {
1080 OPENSSL_PUT_ERROR(SSL, SSL_R_UNINITIALIZED);
1081 return 0;
1082 }
1083
1084 if (ssl->ctx->quic_method != nullptr) {
1085 OPENSSL_PUT_ERROR(SSL, ERR_R_SHOULD_NOT_HAVE_BEEN_CALLED);
1086 return 0;
1087 }
1088
1089 if (!ssl->s3->initial_handshake_complete) {
1090 OPENSSL_PUT_ERROR(SSL, SSL_R_HANDSHAKE_NOT_COMPLETE);
1091 return 0;
1092 }
1093
1094 if (ssl_protocol_version(ssl) < TLS1_3_VERSION) {
1095 OPENSSL_PUT_ERROR(SSL, SSL_R_WRONG_SSL_VERSION);
1096 return 0;
1097 }
1098
1099 if (!ssl->s3->key_update_pending &&
1100 !tls13_add_key_update(ssl, request_type)) {
1101 return 0;
1102 }
1103
1104 return 1;
1105 }
1106
SSL_shutdown(SSL * ssl)1107 int SSL_shutdown(SSL *ssl) {
1108 ssl_reset_error_state(ssl);
1109
1110 if (ssl->do_handshake == NULL) {
1111 OPENSSL_PUT_ERROR(SSL, SSL_R_UNINITIALIZED);
1112 return -1;
1113 }
1114
1115 // If we are in the middle of a handshake, silently succeed. Consumers often
1116 // call this function before |SSL_free|, whether the handshake succeeded or
1117 // not. We assume the caller has already handled failed handshakes.
1118 if (SSL_in_init(ssl)) {
1119 return 1;
1120 }
1121
1122 if (ssl->quiet_shutdown) {
1123 // Do nothing if configured not to send a close_notify.
1124 ssl->s3->write_shutdown = ssl_shutdown_close_notify;
1125 ssl->s3->read_shutdown = ssl_shutdown_close_notify;
1126 return 1;
1127 }
1128
1129 // This function completes in two stages. It sends a close_notify and then it
1130 // waits for a close_notify to come in. Perform exactly one action and return
1131 // whether or not it succeeds.
1132
1133 if (ssl->s3->write_shutdown != ssl_shutdown_close_notify) {
1134 // Send a close_notify.
1135 if (ssl_send_alert_impl(ssl, SSL3_AL_WARNING, SSL_AD_CLOSE_NOTIFY) <= 0) {
1136 return -1;
1137 }
1138 } else if (ssl->s3->alert_dispatch) {
1139 // Finish sending the close_notify.
1140 if (ssl->method->dispatch_alert(ssl) <= 0) {
1141 return -1;
1142 }
1143 } else if (ssl->s3->read_shutdown != ssl_shutdown_close_notify) {
1144 if (SSL_is_dtls(ssl)) {
1145 // Bidirectional shutdown doesn't make sense for an unordered
1146 // transport. DTLS alerts also aren't delivered reliably, so we may even
1147 // time out because the peer never received our close_notify. Report to
1148 // the caller that the channel has fully shut down.
1149 if (ssl->s3->read_shutdown == ssl_shutdown_error) {
1150 ERR_restore_state(ssl->s3->read_error.get());
1151 return -1;
1152 }
1153 ssl->s3->read_shutdown = ssl_shutdown_close_notify;
1154 } else {
1155 // Process records until an error, close_notify, or application data.
1156 if (ssl_read_impl(ssl) > 0) {
1157 // We received some unexpected application data.
1158 OPENSSL_PUT_ERROR(SSL, SSL_R_APPLICATION_DATA_ON_SHUTDOWN);
1159 return -1;
1160 }
1161 if (ssl->s3->read_shutdown != ssl_shutdown_close_notify) {
1162 return -1;
1163 }
1164 }
1165 }
1166
1167 // Return 0 for unidirectional shutdown and 1 for bidirectional shutdown.
1168 return ssl->s3->read_shutdown == ssl_shutdown_close_notify;
1169 }
1170
SSL_send_fatal_alert(SSL * ssl,uint8_t alert)1171 int SSL_send_fatal_alert(SSL *ssl, uint8_t alert) {
1172 if (ssl->s3->alert_dispatch) {
1173 if (ssl->s3->send_alert[0] != SSL3_AL_FATAL ||
1174 ssl->s3->send_alert[1] != alert) {
1175 // We are already attempting to write a different alert.
1176 OPENSSL_PUT_ERROR(SSL, SSL_R_PROTOCOL_IS_SHUTDOWN);
1177 return -1;
1178 }
1179 return ssl->method->dispatch_alert(ssl);
1180 }
1181
1182 return ssl_send_alert_impl(ssl, SSL3_AL_FATAL, alert);
1183 }
1184
SSL_set_quic_transport_params(SSL * ssl,const uint8_t * params,size_t params_len)1185 int SSL_set_quic_transport_params(SSL *ssl, const uint8_t *params,
1186 size_t params_len) {
1187 return ssl->config && ssl->config->quic_transport_params.CopyFrom(
1188 MakeConstSpan(params, params_len));
1189 }
1190
SSL_get_peer_quic_transport_params(const SSL * ssl,const uint8_t ** out_params,size_t * out_params_len)1191 void SSL_get_peer_quic_transport_params(const SSL *ssl,
1192 const uint8_t **out_params,
1193 size_t *out_params_len) {
1194 *out_params = ssl->s3->peer_quic_transport_params.data();
1195 *out_params_len = ssl->s3->peer_quic_transport_params.size();
1196 }
1197
SSL_set_quic_early_data_context(SSL * ssl,const uint8_t * context,size_t context_len)1198 int SSL_set_quic_early_data_context(SSL *ssl, const uint8_t *context,
1199 size_t context_len) {
1200 return ssl->config && ssl->config->quic_early_data_context.CopyFrom(
1201 MakeConstSpan(context, context_len));
1202 }
1203
SSL_CTX_set_early_data_enabled(SSL_CTX * ctx,int enabled)1204 void SSL_CTX_set_early_data_enabled(SSL_CTX *ctx, int enabled) {
1205 ctx->enable_early_data = !!enabled;
1206 }
1207
SSL_set_early_data_enabled(SSL * ssl,int enabled)1208 void SSL_set_early_data_enabled(SSL *ssl, int enabled) {
1209 ssl->enable_early_data = !!enabled;
1210 }
1211
SSL_in_early_data(const SSL * ssl)1212 int SSL_in_early_data(const SSL *ssl) {
1213 if (ssl->s3->hs == NULL) {
1214 return 0;
1215 }
1216 return ssl->s3->hs->in_early_data;
1217 }
1218
SSL_early_data_accepted(const SSL * ssl)1219 int SSL_early_data_accepted(const SSL *ssl) {
1220 return ssl->s3->early_data_accepted;
1221 }
1222
SSL_reset_early_data_reject(SSL * ssl)1223 void SSL_reset_early_data_reject(SSL *ssl) {
1224 SSL_HANDSHAKE *hs = ssl->s3->hs.get();
1225 if (hs == NULL ||
1226 hs->wait != ssl_hs_early_data_rejected) {
1227 abort();
1228 }
1229
1230 hs->wait = ssl_hs_ok;
1231 hs->in_early_data = false;
1232 hs->early_session.reset();
1233
1234 // Discard any unfinished writes from the perspective of |SSL_write|'s
1235 // retry. The handshake will transparently flush out the pending record
1236 // (discarded by the server) to keep the framing correct.
1237 ssl->s3->wpend_pending = false;
1238 }
1239
SSL_get_early_data_reason(const SSL * ssl)1240 enum ssl_early_data_reason_t SSL_get_early_data_reason(const SSL *ssl) {
1241 return ssl->s3->early_data_reason;
1242 }
1243
SSL_early_data_reason_string(enum ssl_early_data_reason_t reason)1244 const char *SSL_early_data_reason_string(enum ssl_early_data_reason_t reason) {
1245 switch (reason) {
1246 case ssl_early_data_unknown:
1247 return "unknown";
1248 case ssl_early_data_disabled:
1249 return "disabled";
1250 case ssl_early_data_accepted:
1251 return "accepted";
1252 case ssl_early_data_protocol_version:
1253 return "protocol_version";
1254 case ssl_early_data_peer_declined:
1255 return "peer_declined";
1256 case ssl_early_data_no_session_offered:
1257 return "no_session_offered";
1258 case ssl_early_data_session_not_resumed:
1259 return "session_not_resumed";
1260 case ssl_early_data_unsupported_for_session:
1261 return "unsupported_for_session";
1262 case ssl_early_data_hello_retry_request:
1263 return "hello_retry_request";
1264 case ssl_early_data_alpn_mismatch:
1265 return "alpn_mismatch";
1266 case ssl_early_data_channel_id:
1267 return "channel_id";
1268 case ssl_early_data_ticket_age_skew:
1269 return "ticket_age_skew";
1270 case ssl_early_data_quic_parameter_mismatch:
1271 return "quic_parameter_mismatch";
1272 case ssl_early_data_alps_mismatch:
1273 return "alps_mismatch";
1274 }
1275
1276 return nullptr;
1277 }
1278
bio_retry_reason_to_error(int reason)1279 static int bio_retry_reason_to_error(int reason) {
1280 switch (reason) {
1281 case BIO_RR_CONNECT:
1282 return SSL_ERROR_WANT_CONNECT;
1283 case BIO_RR_ACCEPT:
1284 return SSL_ERROR_WANT_ACCEPT;
1285 default:
1286 return SSL_ERROR_SYSCALL;
1287 }
1288 }
1289
SSL_get_error(const SSL * ssl,int ret_code)1290 int SSL_get_error(const SSL *ssl, int ret_code) {
1291 if (ret_code > 0) {
1292 return SSL_ERROR_NONE;
1293 }
1294
1295 // Make things return SSL_ERROR_SYSCALL when doing SSL_do_handshake etc,
1296 // where we do encode the error
1297 uint32_t err = ERR_peek_error();
1298 if (err != 0) {
1299 if (ERR_GET_LIB(err) == ERR_LIB_SYS) {
1300 return SSL_ERROR_SYSCALL;
1301 }
1302 return SSL_ERROR_SSL;
1303 }
1304
1305 if (ret_code == 0) {
1306 if (ssl->s3->read_shutdown == ssl_shutdown_close_notify) {
1307 return SSL_ERROR_ZERO_RETURN;
1308 }
1309 // An EOF was observed which violates the protocol, and the underlying
1310 // transport does not participate in the error queue. Bubble up to the
1311 // caller.
1312 return SSL_ERROR_SYSCALL;
1313 }
1314
1315 switch (ssl->s3->rwstate) {
1316 case SSL_ERROR_PENDING_SESSION:
1317 case SSL_ERROR_PENDING_CERTIFICATE:
1318 case SSL_ERROR_HANDOFF:
1319 case SSL_ERROR_HANDBACK:
1320 case SSL_ERROR_WANT_X509_LOOKUP:
1321 case SSL_ERROR_WANT_PRIVATE_KEY_OPERATION:
1322 case SSL_ERROR_PENDING_TICKET:
1323 case SSL_ERROR_EARLY_DATA_REJECTED:
1324 case SSL_ERROR_WANT_CERTIFICATE_VERIFY:
1325 case SSL_ERROR_WANT_RENEGOTIATE:
1326 case SSL_ERROR_HANDSHAKE_HINTS_READY:
1327 return ssl->s3->rwstate;
1328
1329 case SSL_ERROR_WANT_READ: {
1330 if (ssl->quic_method) {
1331 return SSL_ERROR_WANT_READ;
1332 }
1333 BIO *bio = SSL_get_rbio(ssl);
1334 if (BIO_should_read(bio)) {
1335 return SSL_ERROR_WANT_READ;
1336 }
1337
1338 if (BIO_should_write(bio)) {
1339 // TODO(davidben): OpenSSL historically checked for writes on the read
1340 // BIO. Can this be removed?
1341 return SSL_ERROR_WANT_WRITE;
1342 }
1343
1344 if (BIO_should_io_special(bio)) {
1345 return bio_retry_reason_to_error(BIO_get_retry_reason(bio));
1346 }
1347
1348 break;
1349 }
1350
1351 case SSL_ERROR_WANT_WRITE: {
1352 BIO *bio = SSL_get_wbio(ssl);
1353 if (BIO_should_write(bio)) {
1354 return SSL_ERROR_WANT_WRITE;
1355 }
1356
1357 if (BIO_should_read(bio)) {
1358 // TODO(davidben): OpenSSL historically checked for reads on the write
1359 // BIO. Can this be removed?
1360 return SSL_ERROR_WANT_READ;
1361 }
1362
1363 if (BIO_should_io_special(bio)) {
1364 return bio_retry_reason_to_error(BIO_get_retry_reason(bio));
1365 }
1366
1367 break;
1368 }
1369 }
1370
1371 return SSL_ERROR_SYSCALL;
1372 }
1373
SSL_error_description(int err)1374 const char *SSL_error_description(int err) {
1375 switch (err) {
1376 case SSL_ERROR_NONE:
1377 return "NONE";
1378 case SSL_ERROR_SSL:
1379 return "SSL";
1380 case SSL_ERROR_WANT_READ:
1381 return "WANT_READ";
1382 case SSL_ERROR_WANT_WRITE:
1383 return "WANT_WRITE";
1384 case SSL_ERROR_WANT_X509_LOOKUP:
1385 return "WANT_X509_LOOKUP";
1386 case SSL_ERROR_SYSCALL:
1387 return "SYSCALL";
1388 case SSL_ERROR_ZERO_RETURN:
1389 return "ZERO_RETURN";
1390 case SSL_ERROR_WANT_CONNECT:
1391 return "WANT_CONNECT";
1392 case SSL_ERROR_WANT_ACCEPT:
1393 return "WANT_ACCEPT";
1394 case SSL_ERROR_PENDING_SESSION:
1395 return "PENDING_SESSION";
1396 case SSL_ERROR_PENDING_CERTIFICATE:
1397 return "PENDING_CERTIFICATE";
1398 case SSL_ERROR_WANT_PRIVATE_KEY_OPERATION:
1399 return "WANT_PRIVATE_KEY_OPERATION";
1400 case SSL_ERROR_PENDING_TICKET:
1401 return "PENDING_TICKET";
1402 case SSL_ERROR_EARLY_DATA_REJECTED:
1403 return "EARLY_DATA_REJECTED";
1404 case SSL_ERROR_WANT_CERTIFICATE_VERIFY:
1405 return "WANT_CERTIFICATE_VERIFY";
1406 case SSL_ERROR_HANDOFF:
1407 return "HANDOFF";
1408 case SSL_ERROR_HANDBACK:
1409 return "HANDBACK";
1410 case SSL_ERROR_WANT_RENEGOTIATE:
1411 return "WANT_RENEGOTIATE";
1412 case SSL_ERROR_HANDSHAKE_HINTS_READY:
1413 return "HANDSHAKE_HINTS_READY";
1414 default:
1415 return nullptr;
1416 }
1417 }
1418
SSL_CTX_set_options(SSL_CTX * ctx,uint32_t options)1419 uint32_t SSL_CTX_set_options(SSL_CTX *ctx, uint32_t options) {
1420 ctx->options |= options;
1421 return ctx->options;
1422 }
1423
SSL_CTX_clear_options(SSL_CTX * ctx,uint32_t options)1424 uint32_t SSL_CTX_clear_options(SSL_CTX *ctx, uint32_t options) {
1425 ctx->options &= ~options;
1426 return ctx->options;
1427 }
1428
SSL_CTX_get_options(const SSL_CTX * ctx)1429 uint32_t SSL_CTX_get_options(const SSL_CTX *ctx) { return ctx->options; }
1430
SSL_set_options(SSL * ssl,uint32_t options)1431 uint32_t SSL_set_options(SSL *ssl, uint32_t options) {
1432 ssl->options |= options;
1433 return ssl->options;
1434 }
1435
SSL_clear_options(SSL * ssl,uint32_t options)1436 uint32_t SSL_clear_options(SSL *ssl, uint32_t options) {
1437 ssl->options &= ~options;
1438 return ssl->options;
1439 }
1440
SSL_get_options(const SSL * ssl)1441 uint32_t SSL_get_options(const SSL *ssl) { return ssl->options; }
1442
SSL_CTX_set_mode(SSL_CTX * ctx,uint32_t mode)1443 uint32_t SSL_CTX_set_mode(SSL_CTX *ctx, uint32_t mode) {
1444 ctx->mode |= mode;
1445 return ctx->mode;
1446 }
1447
SSL_CTX_clear_mode(SSL_CTX * ctx,uint32_t mode)1448 uint32_t SSL_CTX_clear_mode(SSL_CTX *ctx, uint32_t mode) {
1449 ctx->mode &= ~mode;
1450 return ctx->mode;
1451 }
1452
SSL_CTX_get_mode(const SSL_CTX * ctx)1453 uint32_t SSL_CTX_get_mode(const SSL_CTX *ctx) { return ctx->mode; }
1454
SSL_set_mode(SSL * ssl,uint32_t mode)1455 uint32_t SSL_set_mode(SSL *ssl, uint32_t mode) {
1456 ssl->mode |= mode;
1457 return ssl->mode;
1458 }
1459
SSL_clear_mode(SSL * ssl,uint32_t mode)1460 uint32_t SSL_clear_mode(SSL *ssl, uint32_t mode) {
1461 ssl->mode &= ~mode;
1462 return ssl->mode;
1463 }
1464
SSL_get_mode(const SSL * ssl)1465 uint32_t SSL_get_mode(const SSL *ssl) { return ssl->mode; }
1466
SSL_CTX_set0_buffer_pool(SSL_CTX * ctx,CRYPTO_BUFFER_POOL * pool)1467 void SSL_CTX_set0_buffer_pool(SSL_CTX *ctx, CRYPTO_BUFFER_POOL *pool) {
1468 ctx->pool = pool;
1469 }
1470
SSL_get_tls_unique(const SSL * ssl,uint8_t * out,size_t * out_len,size_t max_out)1471 int SSL_get_tls_unique(const SSL *ssl, uint8_t *out, size_t *out_len,
1472 size_t max_out) {
1473 *out_len = 0;
1474 OPENSSL_memset(out, 0, max_out);
1475
1476 // tls-unique is not defined for TLS 1.3.
1477 if (!ssl->s3->initial_handshake_complete ||
1478 ssl_protocol_version(ssl) >= TLS1_3_VERSION) {
1479 return 0;
1480 }
1481
1482 // The tls-unique value is the first Finished message in the handshake, which
1483 // is the client's in a full handshake and the server's for a resumption. See
1484 // https://tools.ietf.org/html/rfc5929#section-3.1.
1485 const uint8_t *finished = ssl->s3->previous_client_finished;
1486 size_t finished_len = ssl->s3->previous_client_finished_len;
1487 if (ssl->session != NULL) {
1488 // tls-unique is broken for resumed sessions unless EMS is used.
1489 if (!ssl->session->extended_master_secret) {
1490 return 0;
1491 }
1492 finished = ssl->s3->previous_server_finished;
1493 finished_len = ssl->s3->previous_server_finished_len;
1494 }
1495
1496 *out_len = finished_len;
1497 if (finished_len > max_out) {
1498 *out_len = max_out;
1499 }
1500
1501 OPENSSL_memcpy(out, finished, *out_len);
1502 return 1;
1503 }
1504
set_session_id_context(CERT * cert,const uint8_t * sid_ctx,size_t sid_ctx_len)1505 static int set_session_id_context(CERT *cert, const uint8_t *sid_ctx,
1506 size_t sid_ctx_len) {
1507 if (sid_ctx_len > sizeof(cert->sid_ctx)) {
1508 OPENSSL_PUT_ERROR(SSL, SSL_R_SSL_SESSION_ID_CONTEXT_TOO_LONG);
1509 return 0;
1510 }
1511
1512 static_assert(sizeof(cert->sid_ctx) < 256, "sid_ctx too large");
1513 cert->sid_ctx_length = (uint8_t)sid_ctx_len;
1514 OPENSSL_memcpy(cert->sid_ctx, sid_ctx, sid_ctx_len);
1515 return 1;
1516 }
1517
SSL_CTX_set_session_id_context(SSL_CTX * ctx,const uint8_t * sid_ctx,size_t sid_ctx_len)1518 int SSL_CTX_set_session_id_context(SSL_CTX *ctx, const uint8_t *sid_ctx,
1519 size_t sid_ctx_len) {
1520 return set_session_id_context(ctx->cert.get(), sid_ctx, sid_ctx_len);
1521 }
1522
SSL_set_session_id_context(SSL * ssl,const uint8_t * sid_ctx,size_t sid_ctx_len)1523 int SSL_set_session_id_context(SSL *ssl, const uint8_t *sid_ctx,
1524 size_t sid_ctx_len) {
1525 if (!ssl->config) {
1526 return 0;
1527 }
1528 return set_session_id_context(ssl->config->cert.get(), sid_ctx, sid_ctx_len);
1529 }
1530
SSL_get0_session_id_context(const SSL * ssl,size_t * out_len)1531 const uint8_t *SSL_get0_session_id_context(const SSL *ssl, size_t *out_len) {
1532 if (!ssl->config) {
1533 assert(ssl->config);
1534 *out_len = 0;
1535 return NULL;
1536 }
1537 *out_len = ssl->config->cert->sid_ctx_length;
1538 return ssl->config->cert->sid_ctx;
1539 }
1540
SSL_certs_clear(SSL * ssl)1541 void SSL_certs_clear(SSL *ssl) {
1542 if (!ssl->config) {
1543 return;
1544 }
1545 ssl_cert_clear_certs(ssl->config->cert.get());
1546 }
1547
SSL_get_fd(const SSL * ssl)1548 int SSL_get_fd(const SSL *ssl) { return SSL_get_rfd(ssl); }
1549
SSL_get_rfd(const SSL * ssl)1550 int SSL_get_rfd(const SSL *ssl) {
1551 int ret = -1;
1552 BIO *b = BIO_find_type(SSL_get_rbio(ssl), BIO_TYPE_DESCRIPTOR);
1553 if (b != NULL) {
1554 BIO_get_fd(b, &ret);
1555 }
1556 return ret;
1557 }
1558
SSL_get_wfd(const SSL * ssl)1559 int SSL_get_wfd(const SSL *ssl) {
1560 int ret = -1;
1561 BIO *b = BIO_find_type(SSL_get_wbio(ssl), BIO_TYPE_DESCRIPTOR);
1562 if (b != NULL) {
1563 BIO_get_fd(b, &ret);
1564 }
1565 return ret;
1566 }
1567
SSL_set_fd(SSL * ssl,int fd)1568 int SSL_set_fd(SSL *ssl, int fd) {
1569 BIO *bio = BIO_new(BIO_s_socket());
1570 if (bio == NULL) {
1571 OPENSSL_PUT_ERROR(SSL, ERR_R_BUF_LIB);
1572 return 0;
1573 }
1574 BIO_set_fd(bio, fd, BIO_NOCLOSE);
1575 SSL_set_bio(ssl, bio, bio);
1576 return 1;
1577 }
1578
SSL_set_wfd(SSL * ssl,int fd)1579 int SSL_set_wfd(SSL *ssl, int fd) {
1580 BIO *rbio = SSL_get_rbio(ssl);
1581 if (rbio == NULL || BIO_method_type(rbio) != BIO_TYPE_SOCKET ||
1582 BIO_get_fd(rbio, NULL) != fd) {
1583 BIO *bio = BIO_new(BIO_s_socket());
1584 if (bio == NULL) {
1585 OPENSSL_PUT_ERROR(SSL, ERR_R_BUF_LIB);
1586 return 0;
1587 }
1588 BIO_set_fd(bio, fd, BIO_NOCLOSE);
1589 SSL_set0_wbio(ssl, bio);
1590 } else {
1591 // Copy the rbio over to the wbio.
1592 BIO_up_ref(rbio);
1593 SSL_set0_wbio(ssl, rbio);
1594 }
1595
1596 return 1;
1597 }
1598
SSL_set_rfd(SSL * ssl,int fd)1599 int SSL_set_rfd(SSL *ssl, int fd) {
1600 BIO *wbio = SSL_get_wbio(ssl);
1601 if (wbio == NULL || BIO_method_type(wbio) != BIO_TYPE_SOCKET ||
1602 BIO_get_fd(wbio, NULL) != fd) {
1603 BIO *bio = BIO_new(BIO_s_socket());
1604 if (bio == NULL) {
1605 OPENSSL_PUT_ERROR(SSL, ERR_R_BUF_LIB);
1606 return 0;
1607 }
1608 BIO_set_fd(bio, fd, BIO_NOCLOSE);
1609 SSL_set0_rbio(ssl, bio);
1610 } else {
1611 // Copy the wbio over to the rbio.
1612 BIO_up_ref(wbio);
1613 SSL_set0_rbio(ssl, wbio);
1614 }
1615 return 1;
1616 }
1617
copy_finished(void * out,size_t out_len,const uint8_t * in,size_t in_len)1618 static size_t copy_finished(void *out, size_t out_len, const uint8_t *in,
1619 size_t in_len) {
1620 if (out_len > in_len) {
1621 out_len = in_len;
1622 }
1623 OPENSSL_memcpy(out, in, out_len);
1624 return in_len;
1625 }
1626
SSL_get_finished(const SSL * ssl,void * buf,size_t count)1627 size_t SSL_get_finished(const SSL *ssl, void *buf, size_t count) {
1628 if (!ssl->s3->initial_handshake_complete ||
1629 ssl_protocol_version(ssl) >= TLS1_3_VERSION) {
1630 return 0;
1631 }
1632
1633 if (ssl->server) {
1634 return copy_finished(buf, count, ssl->s3->previous_server_finished,
1635 ssl->s3->previous_server_finished_len);
1636 }
1637
1638 return copy_finished(buf, count, ssl->s3->previous_client_finished,
1639 ssl->s3->previous_client_finished_len);
1640 }
1641
SSL_get_peer_finished(const SSL * ssl,void * buf,size_t count)1642 size_t SSL_get_peer_finished(const SSL *ssl, void *buf, size_t count) {
1643 if (!ssl->s3->initial_handshake_complete ||
1644 ssl_protocol_version(ssl) >= TLS1_3_VERSION) {
1645 return 0;
1646 }
1647
1648 if (ssl->server) {
1649 return copy_finished(buf, count, ssl->s3->previous_client_finished,
1650 ssl->s3->previous_client_finished_len);
1651 }
1652
1653 return copy_finished(buf, count, ssl->s3->previous_server_finished,
1654 ssl->s3->previous_server_finished_len);
1655 }
1656
SSL_get_verify_mode(const SSL * ssl)1657 int SSL_get_verify_mode(const SSL *ssl) {
1658 if (!ssl->config) {
1659 assert(ssl->config);
1660 return -1;
1661 }
1662 return ssl->config->verify_mode;
1663 }
1664
SSL_get_extms_support(const SSL * ssl)1665 int SSL_get_extms_support(const SSL *ssl) {
1666 // TLS 1.3 does not require extended master secret and always reports as
1667 // supporting it.
1668 if (!ssl->s3->have_version) {
1669 return 0;
1670 }
1671 if (ssl_protocol_version(ssl) >= TLS1_3_VERSION) {
1672 return 1;
1673 }
1674
1675 // If the initial handshake completed, query the established session.
1676 if (ssl->s3->established_session != NULL) {
1677 return ssl->s3->established_session->extended_master_secret;
1678 }
1679
1680 // Otherwise, query the in-progress handshake.
1681 if (ssl->s3->hs != NULL) {
1682 return ssl->s3->hs->extended_master_secret;
1683 }
1684 assert(0);
1685 return 0;
1686 }
1687
SSL_CTX_get_read_ahead(const SSL_CTX * ctx)1688 int SSL_CTX_get_read_ahead(const SSL_CTX *ctx) { return 0; }
1689
SSL_get_read_ahead(const SSL * ssl)1690 int SSL_get_read_ahead(const SSL *ssl) { return 0; }
1691
SSL_CTX_set_read_ahead(SSL_CTX * ctx,int yes)1692 int SSL_CTX_set_read_ahead(SSL_CTX *ctx, int yes) { return 1; }
1693
SSL_set_read_ahead(SSL * ssl,int yes)1694 int SSL_set_read_ahead(SSL *ssl, int yes) { return 1; }
1695
SSL_pending(const SSL * ssl)1696 int SSL_pending(const SSL *ssl) {
1697 return static_cast<int>(ssl->s3->pending_app_data.size());
1698 }
1699
SSL_CTX_check_private_key(const SSL_CTX * ctx)1700 int SSL_CTX_check_private_key(const SSL_CTX *ctx) {
1701 return ssl_cert_check_private_key(ctx->cert.get(),
1702 ctx->cert->privatekey.get());
1703 }
1704
SSL_check_private_key(const SSL * ssl)1705 int SSL_check_private_key(const SSL *ssl) {
1706 if (!ssl->config) {
1707 return 0;
1708 }
1709 return ssl_cert_check_private_key(ssl->config->cert.get(),
1710 ssl->config->cert->privatekey.get());
1711 }
1712
SSL_get_default_timeout(const SSL * ssl)1713 long SSL_get_default_timeout(const SSL *ssl) {
1714 return SSL_DEFAULT_SESSION_TIMEOUT;
1715 }
1716
SSL_renegotiate(SSL * ssl)1717 int SSL_renegotiate(SSL *ssl) {
1718 // Caller-initiated renegotiation is not supported.
1719 if (!ssl->s3->renegotiate_pending) {
1720 OPENSSL_PUT_ERROR(SSL, ERR_R_SHOULD_NOT_HAVE_BEEN_CALLED);
1721 return 0;
1722 }
1723
1724 if (!ssl_can_renegotiate(ssl)) {
1725 OPENSSL_PUT_ERROR(SSL, SSL_R_NO_RENEGOTIATION);
1726 return 0;
1727 }
1728
1729 // We should not have told the caller to release the private key.
1730 assert(!SSL_can_release_private_key(ssl));
1731
1732 // Renegotiation is only supported at quiescent points in the application
1733 // protocol, namely in HTTPS, just before reading the HTTP response.
1734 // Require the record-layer be idle and avoid complexities of sending a
1735 // handshake record while an application_data record is being written.
1736 if (!ssl->s3->write_buffer.empty() ||
1737 ssl->s3->write_shutdown != ssl_shutdown_none) {
1738 OPENSSL_PUT_ERROR(SSL, SSL_R_NO_RENEGOTIATION);
1739 return 0;
1740 }
1741
1742 // Begin a new handshake.
1743 if (ssl->s3->hs != nullptr) {
1744 OPENSSL_PUT_ERROR(SSL, ERR_R_INTERNAL_ERROR);
1745 return 0;
1746 }
1747 ssl->s3->hs = ssl_handshake_new(ssl);
1748 if (ssl->s3->hs == nullptr) {
1749 return 0;
1750 }
1751
1752 ssl->s3->renegotiate_pending = false;
1753 ssl->s3->total_renegotiations++;
1754 return 1;
1755 }
1756
SSL_renegotiate_pending(SSL * ssl)1757 int SSL_renegotiate_pending(SSL *ssl) {
1758 return SSL_in_init(ssl) && ssl->s3->initial_handshake_complete;
1759 }
1760
SSL_total_renegotiations(const SSL * ssl)1761 int SSL_total_renegotiations(const SSL *ssl) {
1762 return ssl->s3->total_renegotiations;
1763 }
1764
SSL_CTX_get_max_cert_list(const SSL_CTX * ctx)1765 size_t SSL_CTX_get_max_cert_list(const SSL_CTX *ctx) {
1766 return ctx->max_cert_list;
1767 }
1768
SSL_CTX_set_max_cert_list(SSL_CTX * ctx,size_t max_cert_list)1769 void SSL_CTX_set_max_cert_list(SSL_CTX *ctx, size_t max_cert_list) {
1770 if (max_cert_list > kMaxHandshakeSize) {
1771 max_cert_list = kMaxHandshakeSize;
1772 }
1773 ctx->max_cert_list = (uint32_t)max_cert_list;
1774 }
1775
SSL_get_max_cert_list(const SSL * ssl)1776 size_t SSL_get_max_cert_list(const SSL *ssl) {
1777 return ssl->max_cert_list;
1778 }
1779
SSL_set_max_cert_list(SSL * ssl,size_t max_cert_list)1780 void SSL_set_max_cert_list(SSL *ssl, size_t max_cert_list) {
1781 if (max_cert_list > kMaxHandshakeSize) {
1782 max_cert_list = kMaxHandshakeSize;
1783 }
1784 ssl->max_cert_list = (uint32_t)max_cert_list;
1785 }
1786
SSL_CTX_set_max_send_fragment(SSL_CTX * ctx,size_t max_send_fragment)1787 int SSL_CTX_set_max_send_fragment(SSL_CTX *ctx, size_t max_send_fragment) {
1788 if (max_send_fragment < 512) {
1789 max_send_fragment = 512;
1790 }
1791 if (max_send_fragment > SSL3_RT_MAX_PLAIN_LENGTH) {
1792 max_send_fragment = SSL3_RT_MAX_PLAIN_LENGTH;
1793 }
1794 ctx->max_send_fragment = (uint16_t)max_send_fragment;
1795
1796 return 1;
1797 }
1798
SSL_set_max_send_fragment(SSL * ssl,size_t max_send_fragment)1799 int SSL_set_max_send_fragment(SSL *ssl, size_t max_send_fragment) {
1800 if (max_send_fragment < 512) {
1801 max_send_fragment = 512;
1802 }
1803 if (max_send_fragment > SSL3_RT_MAX_PLAIN_LENGTH) {
1804 max_send_fragment = SSL3_RT_MAX_PLAIN_LENGTH;
1805 }
1806 ssl->max_send_fragment = (uint16_t)max_send_fragment;
1807
1808 return 1;
1809 }
1810
SSL_set_mtu(SSL * ssl,unsigned mtu)1811 int SSL_set_mtu(SSL *ssl, unsigned mtu) {
1812 if (!SSL_is_dtls(ssl) || mtu < dtls1_min_mtu()) {
1813 return 0;
1814 }
1815 ssl->d1->mtu = mtu;
1816 return 1;
1817 }
1818
SSL_get_secure_renegotiation_support(const SSL * ssl)1819 int SSL_get_secure_renegotiation_support(const SSL *ssl) {
1820 if (!ssl->s3->have_version) {
1821 return 0;
1822 }
1823 return ssl_protocol_version(ssl) >= TLS1_3_VERSION ||
1824 ssl->s3->send_connection_binding;
1825 }
1826
SSL_CTX_sess_number(const SSL_CTX * ctx)1827 size_t SSL_CTX_sess_number(const SSL_CTX *ctx) {
1828 MutexReadLock lock(const_cast<CRYPTO_MUTEX *>(&ctx->lock));
1829 return lh_SSL_SESSION_num_items(ctx->sessions);
1830 }
1831
SSL_CTX_sess_set_cache_size(SSL_CTX * ctx,unsigned long size)1832 unsigned long SSL_CTX_sess_set_cache_size(SSL_CTX *ctx, unsigned long size) {
1833 unsigned long ret = ctx->session_cache_size;
1834 ctx->session_cache_size = size;
1835 return ret;
1836 }
1837
SSL_CTX_sess_get_cache_size(const SSL_CTX * ctx)1838 unsigned long SSL_CTX_sess_get_cache_size(const SSL_CTX *ctx) {
1839 return ctx->session_cache_size;
1840 }
1841
SSL_CTX_set_session_cache_mode(SSL_CTX * ctx,int mode)1842 int SSL_CTX_set_session_cache_mode(SSL_CTX *ctx, int mode) {
1843 int ret = ctx->session_cache_mode;
1844 ctx->session_cache_mode = mode;
1845 return ret;
1846 }
1847
SSL_CTX_get_session_cache_mode(const SSL_CTX * ctx)1848 int SSL_CTX_get_session_cache_mode(const SSL_CTX *ctx) {
1849 return ctx->session_cache_mode;
1850 }
1851
1852
SSL_CTX_get_tlsext_ticket_keys(SSL_CTX * ctx,void * out,size_t len)1853 int SSL_CTX_get_tlsext_ticket_keys(SSL_CTX *ctx, void *out, size_t len) {
1854 if (out == NULL) {
1855 return 48;
1856 }
1857 if (len != 48) {
1858 OPENSSL_PUT_ERROR(SSL, SSL_R_INVALID_TICKET_KEYS_LENGTH);
1859 return 0;
1860 }
1861
1862 // The default ticket keys are initialized lazily. Trigger a key
1863 // rotation to initialize them.
1864 if (!ssl_ctx_rotate_ticket_encryption_key(ctx)) {
1865 return 0;
1866 }
1867
1868 uint8_t *out_bytes = reinterpret_cast<uint8_t *>(out);
1869 MutexReadLock lock(&ctx->lock);
1870 OPENSSL_memcpy(out_bytes, ctx->ticket_key_current->name, 16);
1871 OPENSSL_memcpy(out_bytes + 16, ctx->ticket_key_current->hmac_key, 16);
1872 OPENSSL_memcpy(out_bytes + 32, ctx->ticket_key_current->aes_key, 16);
1873 return 1;
1874 }
1875
SSL_CTX_set_tlsext_ticket_keys(SSL_CTX * ctx,const void * in,size_t len)1876 int SSL_CTX_set_tlsext_ticket_keys(SSL_CTX *ctx, const void *in, size_t len) {
1877 if (in == NULL) {
1878 return 48;
1879 }
1880 if (len != 48) {
1881 OPENSSL_PUT_ERROR(SSL, SSL_R_INVALID_TICKET_KEYS_LENGTH);
1882 return 0;
1883 }
1884 auto key = MakeUnique<TicketKey>();
1885 if (!key) {
1886 return 0;
1887 }
1888 const uint8_t *in_bytes = reinterpret_cast<const uint8_t *>(in);
1889 OPENSSL_memcpy(key->name, in_bytes, 16);
1890 OPENSSL_memcpy(key->hmac_key, in_bytes + 16, 16);
1891 OPENSSL_memcpy(key->aes_key, in_bytes + 32, 16);
1892 // Disable automatic key rotation for manually-configured keys. This is now
1893 // the caller's responsibility.
1894 key->next_rotation_tv_sec = 0;
1895 ctx->ticket_key_current = std::move(key);
1896 ctx->ticket_key_prev.reset();
1897 return 1;
1898 }
1899
SSL_CTX_set_tlsext_ticket_key_cb(SSL_CTX * ctx,int (* callback)(SSL * ssl,uint8_t * key_name,uint8_t * iv,EVP_CIPHER_CTX * ctx,HMAC_CTX * hmac_ctx,int encrypt))1900 int SSL_CTX_set_tlsext_ticket_key_cb(
1901 SSL_CTX *ctx, int (*callback)(SSL *ssl, uint8_t *key_name, uint8_t *iv,
1902 EVP_CIPHER_CTX *ctx, HMAC_CTX *hmac_ctx,
1903 int encrypt)) {
1904 ctx->ticket_key_cb = callback;
1905 return 1;
1906 }
1907
SSL_CTX_set1_curves(SSL_CTX * ctx,const int * curves,size_t curves_len)1908 int SSL_CTX_set1_curves(SSL_CTX *ctx, const int *curves, size_t curves_len) {
1909 return tls1_set_curves(&ctx->supported_group_list,
1910 MakeConstSpan(curves, curves_len));
1911 }
1912
SSL_set1_curves(SSL * ssl,const int * curves,size_t curves_len)1913 int SSL_set1_curves(SSL *ssl, const int *curves, size_t curves_len) {
1914 if (!ssl->config) {
1915 return 0;
1916 }
1917 return tls1_set_curves(&ssl->config->supported_group_list,
1918 MakeConstSpan(curves, curves_len));
1919 }
1920
SSL_CTX_set1_curves_list(SSL_CTX * ctx,const char * curves)1921 int SSL_CTX_set1_curves_list(SSL_CTX *ctx, const char *curves) {
1922 return tls1_set_curves_list(&ctx->supported_group_list, curves);
1923 }
1924
SSL_set1_curves_list(SSL * ssl,const char * curves)1925 int SSL_set1_curves_list(SSL *ssl, const char *curves) {
1926 if (!ssl->config) {
1927 return 0;
1928 }
1929 return tls1_set_curves_list(&ssl->config->supported_group_list, curves);
1930 }
1931
SSL_get_curve_id(const SSL * ssl)1932 uint16_t SSL_get_curve_id(const SSL *ssl) {
1933 // TODO(davidben): This checks the wrong session if there is a renegotiation
1934 // in progress.
1935 SSL_SESSION *session = SSL_get_session(ssl);
1936 if (session == NULL) {
1937 return 0;
1938 }
1939
1940 return session->group_id;
1941 }
1942
SSL_CTX_set_tmp_dh(SSL_CTX * ctx,const DH * dh)1943 int SSL_CTX_set_tmp_dh(SSL_CTX *ctx, const DH *dh) {
1944 return 1;
1945 }
1946
SSL_set_tmp_dh(SSL * ssl,const DH * dh)1947 int SSL_set_tmp_dh(SSL *ssl, const DH *dh) {
1948 return 1;
1949 }
1950
STACK_OF(SSL_CIPHER)1951 STACK_OF(SSL_CIPHER) *SSL_CTX_get_ciphers(const SSL_CTX *ctx) {
1952 return ctx->cipher_list->ciphers.get();
1953 }
1954
SSL_CTX_cipher_in_group(const SSL_CTX * ctx,size_t i)1955 int SSL_CTX_cipher_in_group(const SSL_CTX *ctx, size_t i) {
1956 if (i >= sk_SSL_CIPHER_num(ctx->cipher_list->ciphers.get())) {
1957 return 0;
1958 }
1959 return ctx->cipher_list->in_group_flags[i];
1960 }
1961
STACK_OF(SSL_CIPHER)1962 STACK_OF(SSL_CIPHER) *SSL_get_ciphers(const SSL *ssl) {
1963 if (ssl == NULL) {
1964 return NULL;
1965 }
1966 if (ssl->config == NULL) {
1967 assert(ssl->config);
1968 return NULL;
1969 }
1970
1971 return ssl->config->cipher_list ? ssl->config->cipher_list->ciphers.get()
1972 : ssl->ctx->cipher_list->ciphers.get();
1973 }
1974
SSL_get_cipher_list(const SSL * ssl,int n)1975 const char *SSL_get_cipher_list(const SSL *ssl, int n) {
1976 if (ssl == NULL) {
1977 return NULL;
1978 }
1979
1980 STACK_OF(SSL_CIPHER) *sk = SSL_get_ciphers(ssl);
1981 if (sk == NULL || n < 0 || (size_t)n >= sk_SSL_CIPHER_num(sk)) {
1982 return NULL;
1983 }
1984
1985 const SSL_CIPHER *c = sk_SSL_CIPHER_value(sk, n);
1986 if (c == NULL) {
1987 return NULL;
1988 }
1989
1990 return c->name;
1991 }
1992
SSL_CTX_set_cipher_list(SSL_CTX * ctx,const char * str)1993 int SSL_CTX_set_cipher_list(SSL_CTX *ctx, const char *str) {
1994 return ssl_create_cipher_list(&ctx->cipher_list, str, false /* not strict */);
1995 }
1996
SSL_CTX_set_strict_cipher_list(SSL_CTX * ctx,const char * str)1997 int SSL_CTX_set_strict_cipher_list(SSL_CTX *ctx, const char *str) {
1998 return ssl_create_cipher_list(&ctx->cipher_list, str, true /* strict */);
1999 }
2000
SSL_set_cipher_list(SSL * ssl,const char * str)2001 int SSL_set_cipher_list(SSL *ssl, const char *str) {
2002 if (!ssl->config) {
2003 return 0;
2004 }
2005 return ssl_create_cipher_list(&ssl->config->cipher_list, str,
2006 false /* not strict */);
2007 }
2008
SSL_set_strict_cipher_list(SSL * ssl,const char * str)2009 int SSL_set_strict_cipher_list(SSL *ssl, const char *str) {
2010 if (!ssl->config) {
2011 return 0;
2012 }
2013 return ssl_create_cipher_list(&ssl->config->cipher_list, str,
2014 true /* strict */);
2015 }
2016
SSL_get_servername(const SSL * ssl,const int type)2017 const char *SSL_get_servername(const SSL *ssl, const int type) {
2018 if (type != TLSEXT_NAMETYPE_host_name) {
2019 return NULL;
2020 }
2021
2022 // Historically, |SSL_get_servername| was also the configuration getter
2023 // corresponding to |SSL_set_tlsext_host_name|.
2024 if (ssl->hostname != nullptr) {
2025 return ssl->hostname.get();
2026 }
2027
2028 return ssl->s3->hostname.get();
2029 }
2030
SSL_get_servername_type(const SSL * ssl)2031 int SSL_get_servername_type(const SSL *ssl) {
2032 if (SSL_get_servername(ssl, TLSEXT_NAMETYPE_host_name) == NULL) {
2033 return -1;
2034 }
2035 return TLSEXT_NAMETYPE_host_name;
2036 }
2037
SSL_CTX_set_custom_verify(SSL_CTX * ctx,int mode,enum ssl_verify_result_t (* callback)(SSL * ssl,uint8_t * out_alert))2038 void SSL_CTX_set_custom_verify(
2039 SSL_CTX *ctx, int mode,
2040 enum ssl_verify_result_t (*callback)(SSL *ssl, uint8_t *out_alert)) {
2041 ctx->verify_mode = mode;
2042 ctx->custom_verify_callback = callback;
2043 }
2044
SSL_set_custom_verify(SSL * ssl,int mode,enum ssl_verify_result_t (* callback)(SSL * ssl,uint8_t * out_alert))2045 void SSL_set_custom_verify(
2046 SSL *ssl, int mode,
2047 enum ssl_verify_result_t (*callback)(SSL *ssl, uint8_t *out_alert)) {
2048 if (!ssl->config) {
2049 return;
2050 }
2051 ssl->config->verify_mode = mode;
2052 ssl->config->custom_verify_callback = callback;
2053 }
2054
SSL_CTX_enable_signed_cert_timestamps(SSL_CTX * ctx)2055 void SSL_CTX_enable_signed_cert_timestamps(SSL_CTX *ctx) {
2056 ctx->signed_cert_timestamps_enabled = true;
2057 }
2058
SSL_enable_signed_cert_timestamps(SSL * ssl)2059 void SSL_enable_signed_cert_timestamps(SSL *ssl) {
2060 if (!ssl->config) {
2061 return;
2062 }
2063 ssl->config->signed_cert_timestamps_enabled = true;
2064 }
2065
SSL_CTX_enable_ocsp_stapling(SSL_CTX * ctx)2066 void SSL_CTX_enable_ocsp_stapling(SSL_CTX *ctx) {
2067 ctx->ocsp_stapling_enabled = true;
2068 }
2069
SSL_enable_ocsp_stapling(SSL * ssl)2070 void SSL_enable_ocsp_stapling(SSL *ssl) {
2071 if (!ssl->config) {
2072 return;
2073 }
2074 ssl->config->ocsp_stapling_enabled = true;
2075 }
2076
SSL_get0_signed_cert_timestamp_list(const SSL * ssl,const uint8_t ** out,size_t * out_len)2077 void SSL_get0_signed_cert_timestamp_list(const SSL *ssl, const uint8_t **out,
2078 size_t *out_len) {
2079 SSL_SESSION *session = SSL_get_session(ssl);
2080 if (ssl->server || !session || !session->signed_cert_timestamp_list) {
2081 *out_len = 0;
2082 *out = NULL;
2083 return;
2084 }
2085
2086 *out = CRYPTO_BUFFER_data(session->signed_cert_timestamp_list.get());
2087 *out_len = CRYPTO_BUFFER_len(session->signed_cert_timestamp_list.get());
2088 }
2089
SSL_get0_ocsp_response(const SSL * ssl,const uint8_t ** out,size_t * out_len)2090 void SSL_get0_ocsp_response(const SSL *ssl, const uint8_t **out,
2091 size_t *out_len) {
2092 SSL_SESSION *session = SSL_get_session(ssl);
2093 if (ssl->server || !session || !session->ocsp_response) {
2094 *out_len = 0;
2095 *out = NULL;
2096 return;
2097 }
2098
2099 *out = CRYPTO_BUFFER_data(session->ocsp_response.get());
2100 *out_len = CRYPTO_BUFFER_len(session->ocsp_response.get());
2101 }
2102
SSL_set_tlsext_host_name(SSL * ssl,const char * name)2103 int SSL_set_tlsext_host_name(SSL *ssl, const char *name) {
2104 ssl->hostname.reset();
2105 if (name == nullptr) {
2106 return 1;
2107 }
2108
2109 size_t len = strlen(name);
2110 if (len == 0 || len > TLSEXT_MAXLEN_host_name) {
2111 OPENSSL_PUT_ERROR(SSL, SSL_R_SSL3_EXT_INVALID_SERVERNAME);
2112 return 0;
2113 }
2114 ssl->hostname.reset(OPENSSL_strdup(name));
2115 if (ssl->hostname == nullptr) {
2116 OPENSSL_PUT_ERROR(SSL, ERR_R_MALLOC_FAILURE);
2117 return 0;
2118 }
2119 return 1;
2120 }
2121
SSL_CTX_set_tlsext_servername_callback(SSL_CTX * ctx,int (* callback)(SSL * ssl,int * out_alert,void * arg))2122 int SSL_CTX_set_tlsext_servername_callback(
2123 SSL_CTX *ctx, int (*callback)(SSL *ssl, int *out_alert, void *arg)) {
2124 ctx->servername_callback = callback;
2125 return 1;
2126 }
2127
SSL_CTX_set_tlsext_servername_arg(SSL_CTX * ctx,void * arg)2128 int SSL_CTX_set_tlsext_servername_arg(SSL_CTX *ctx, void *arg) {
2129 ctx->servername_arg = arg;
2130 return 1;
2131 }
2132
SSL_select_next_proto(uint8_t ** out,uint8_t * out_len,const uint8_t * peer,unsigned peer_len,const uint8_t * supported,unsigned supported_len)2133 int SSL_select_next_proto(uint8_t **out, uint8_t *out_len, const uint8_t *peer,
2134 unsigned peer_len, const uint8_t *supported,
2135 unsigned supported_len) {
2136 const uint8_t *result;
2137 int status;
2138
2139 // For each protocol in peer preference order, see if we support it.
2140 for (unsigned i = 0; i < peer_len;) {
2141 for (unsigned j = 0; j < supported_len;) {
2142 if (peer[i] == supported[j] &&
2143 OPENSSL_memcmp(&peer[i + 1], &supported[j + 1], peer[i]) == 0) {
2144 // We found a match
2145 result = &peer[i];
2146 status = OPENSSL_NPN_NEGOTIATED;
2147 goto found;
2148 }
2149 j += supported[j];
2150 j++;
2151 }
2152 i += peer[i];
2153 i++;
2154 }
2155
2156 // There's no overlap between our protocols and the peer's list.
2157 result = supported;
2158 status = OPENSSL_NPN_NO_OVERLAP;
2159
2160 found:
2161 *out = (uint8_t *)result + 1;
2162 *out_len = result[0];
2163 return status;
2164 }
2165
SSL_get0_next_proto_negotiated(const SSL * ssl,const uint8_t ** out_data,unsigned * out_len)2166 void SSL_get0_next_proto_negotiated(const SSL *ssl, const uint8_t **out_data,
2167 unsigned *out_len) {
2168 *out_data = ssl->s3->next_proto_negotiated.data();
2169 *out_len = ssl->s3->next_proto_negotiated.size();
2170 }
2171
SSL_CTX_set_next_protos_advertised_cb(SSL_CTX * ctx,int (* cb)(SSL * ssl,const uint8_t ** out,unsigned * out_len,void * arg),void * arg)2172 void SSL_CTX_set_next_protos_advertised_cb(
2173 SSL_CTX *ctx,
2174 int (*cb)(SSL *ssl, const uint8_t **out, unsigned *out_len, void *arg),
2175 void *arg) {
2176 ctx->next_protos_advertised_cb = cb;
2177 ctx->next_protos_advertised_cb_arg = arg;
2178 }
2179
SSL_CTX_set_next_proto_select_cb(SSL_CTX * ctx,int (* cb)(SSL * ssl,uint8_t ** out,uint8_t * out_len,const uint8_t * in,unsigned in_len,void * arg),void * arg)2180 void SSL_CTX_set_next_proto_select_cb(
2181 SSL_CTX *ctx, int (*cb)(SSL *ssl, uint8_t **out, uint8_t *out_len,
2182 const uint8_t *in, unsigned in_len, void *arg),
2183 void *arg) {
2184 ctx->next_proto_select_cb = cb;
2185 ctx->next_proto_select_cb_arg = arg;
2186 }
2187
SSL_CTX_set_alpn_protos(SSL_CTX * ctx,const uint8_t * protos,unsigned protos_len)2188 int SSL_CTX_set_alpn_protos(SSL_CTX *ctx, const uint8_t *protos,
2189 unsigned protos_len) {
2190 // Note this function's return value is backwards.
2191 auto span = MakeConstSpan(protos, protos_len);
2192 if (!span.empty() && !ssl_is_valid_alpn_list(span)) {
2193 OPENSSL_PUT_ERROR(SSL, SSL_R_INVALID_ALPN_PROTOCOL_LIST);
2194 return 1;
2195 }
2196 return ctx->alpn_client_proto_list.CopyFrom(span) ? 0 : 1;
2197 }
2198
SSL_set_alpn_protos(SSL * ssl,const uint8_t * protos,unsigned protos_len)2199 int SSL_set_alpn_protos(SSL *ssl, const uint8_t *protos, unsigned protos_len) {
2200 // Note this function's return value is backwards.
2201 if (!ssl->config) {
2202 return 1;
2203 }
2204 auto span = MakeConstSpan(protos, protos_len);
2205 if (!span.empty() && !ssl_is_valid_alpn_list(span)) {
2206 OPENSSL_PUT_ERROR(SSL, SSL_R_INVALID_ALPN_PROTOCOL_LIST);
2207 return 1;
2208 }
2209 return ssl->config->alpn_client_proto_list.CopyFrom(span) ? 0 : 1;
2210 }
2211
SSL_CTX_set_alpn_select_cb(SSL_CTX * ctx,int (* cb)(SSL * ssl,const uint8_t ** out,uint8_t * out_len,const uint8_t * in,unsigned in_len,void * arg),void * arg)2212 void SSL_CTX_set_alpn_select_cb(SSL_CTX *ctx,
2213 int (*cb)(SSL *ssl, const uint8_t **out,
2214 uint8_t *out_len, const uint8_t *in,
2215 unsigned in_len, void *arg),
2216 void *arg) {
2217 ctx->alpn_select_cb = cb;
2218 ctx->alpn_select_cb_arg = arg;
2219 }
2220
SSL_get0_alpn_selected(const SSL * ssl,const uint8_t ** out_data,unsigned * out_len)2221 void SSL_get0_alpn_selected(const SSL *ssl, const uint8_t **out_data,
2222 unsigned *out_len) {
2223 if (SSL_in_early_data(ssl) && !ssl->server) {
2224 *out_data = ssl->s3->hs->early_session->early_alpn.data();
2225 *out_len = ssl->s3->hs->early_session->early_alpn.size();
2226 } else {
2227 *out_data = ssl->s3->alpn_selected.data();
2228 *out_len = ssl->s3->alpn_selected.size();
2229 }
2230 }
2231
SSL_CTX_set_allow_unknown_alpn_protos(SSL_CTX * ctx,int enabled)2232 void SSL_CTX_set_allow_unknown_alpn_protos(SSL_CTX *ctx, int enabled) {
2233 ctx->allow_unknown_alpn_protos = !!enabled;
2234 }
2235
SSL_add_application_settings(SSL * ssl,const uint8_t * proto,size_t proto_len,const uint8_t * settings,size_t settings_len)2236 int SSL_add_application_settings(SSL *ssl, const uint8_t *proto,
2237 size_t proto_len, const uint8_t *settings,
2238 size_t settings_len) {
2239 if (!ssl->config) {
2240 return 0;
2241 }
2242 ALPSConfig config;
2243 if (!config.protocol.CopyFrom(MakeConstSpan(proto, proto_len)) ||
2244 !config.settings.CopyFrom(MakeConstSpan(settings, settings_len)) ||
2245 !ssl->config->alps_configs.Push(std::move(config))) {
2246 return 0;
2247 }
2248 return 1;
2249 }
2250
SSL_get0_peer_application_settings(const SSL * ssl,const uint8_t ** out_data,size_t * out_len)2251 void SSL_get0_peer_application_settings(const SSL *ssl,
2252 const uint8_t **out_data,
2253 size_t *out_len) {
2254 const SSL_SESSION *session = SSL_get_session(ssl);
2255 Span<const uint8_t> settings =
2256 session ? session->peer_application_settings : Span<const uint8_t>();
2257 *out_data = settings.data();
2258 *out_len = settings.size();
2259 }
2260
SSL_has_application_settings(const SSL * ssl)2261 int SSL_has_application_settings(const SSL *ssl) {
2262 const SSL_SESSION *session = SSL_get_session(ssl);
2263 return session && session->has_application_settings;
2264 }
2265
SSL_CTX_add_cert_compression_alg(SSL_CTX * ctx,uint16_t alg_id,ssl_cert_compression_func_t compress,ssl_cert_decompression_func_t decompress)2266 int SSL_CTX_add_cert_compression_alg(SSL_CTX *ctx, uint16_t alg_id,
2267 ssl_cert_compression_func_t compress,
2268 ssl_cert_decompression_func_t decompress) {
2269 assert(compress != nullptr || decompress != nullptr);
2270
2271 for (const auto &alg : ctx->cert_compression_algs) {
2272 if (alg.alg_id == alg_id) {
2273 return 0;
2274 }
2275 }
2276
2277 CertCompressionAlg alg;
2278 alg.alg_id = alg_id;
2279 alg.compress = compress;
2280 alg.decompress = decompress;
2281 return ctx->cert_compression_algs.Push(alg);
2282 }
2283
SSL_CTX_set_tls_channel_id_enabled(SSL_CTX * ctx,int enabled)2284 void SSL_CTX_set_tls_channel_id_enabled(SSL_CTX *ctx, int enabled) {
2285 ctx->channel_id_enabled = !!enabled;
2286 }
2287
SSL_CTX_enable_tls_channel_id(SSL_CTX * ctx)2288 int SSL_CTX_enable_tls_channel_id(SSL_CTX *ctx) {
2289 SSL_CTX_set_tls_channel_id_enabled(ctx, 1);
2290 return 1;
2291 }
2292
SSL_set_tls_channel_id_enabled(SSL * ssl,int enabled)2293 void SSL_set_tls_channel_id_enabled(SSL *ssl, int enabled) {
2294 if (!ssl->config) {
2295 return;
2296 }
2297 ssl->config->channel_id_enabled = !!enabled;
2298 }
2299
SSL_enable_tls_channel_id(SSL * ssl)2300 int SSL_enable_tls_channel_id(SSL *ssl) {
2301 SSL_set_tls_channel_id_enabled(ssl, 1);
2302 return 1;
2303 }
2304
is_p256_key(EVP_PKEY * private_key)2305 static int is_p256_key(EVP_PKEY *private_key) {
2306 const EC_KEY *ec_key = EVP_PKEY_get0_EC_KEY(private_key);
2307 return ec_key != NULL &&
2308 EC_GROUP_get_curve_name(EC_KEY_get0_group(ec_key)) ==
2309 NID_X9_62_prime256v1;
2310 }
2311
SSL_CTX_set1_tls_channel_id(SSL_CTX * ctx,EVP_PKEY * private_key)2312 int SSL_CTX_set1_tls_channel_id(SSL_CTX *ctx, EVP_PKEY *private_key) {
2313 if (!is_p256_key(private_key)) {
2314 OPENSSL_PUT_ERROR(SSL, SSL_R_CHANNEL_ID_NOT_P256);
2315 return 0;
2316 }
2317
2318 ctx->channel_id_private = UpRef(private_key);
2319 return 1;
2320 }
2321
SSL_set1_tls_channel_id(SSL * ssl,EVP_PKEY * private_key)2322 int SSL_set1_tls_channel_id(SSL *ssl, EVP_PKEY *private_key) {
2323 if (!ssl->config) {
2324 return 0;
2325 }
2326 if (!is_p256_key(private_key)) {
2327 OPENSSL_PUT_ERROR(SSL, SSL_R_CHANNEL_ID_NOT_P256);
2328 return 0;
2329 }
2330
2331 ssl->config->channel_id_private = UpRef(private_key);
2332 return 1;
2333 }
2334
SSL_get_tls_channel_id(SSL * ssl,uint8_t * out,size_t max_out)2335 size_t SSL_get_tls_channel_id(SSL *ssl, uint8_t *out, size_t max_out) {
2336 if (!ssl->s3->channel_id_valid) {
2337 return 0;
2338 }
2339 OPENSSL_memcpy(out, ssl->s3->channel_id, (max_out < 64) ? max_out : 64);
2340 return 64;
2341 }
2342
SSL_get0_certificate_types(const SSL * ssl,const uint8_t ** out_types)2343 size_t SSL_get0_certificate_types(const SSL *ssl, const uint8_t **out_types) {
2344 Span<const uint8_t> types;
2345 if (!ssl->server && ssl->s3->hs != nullptr) {
2346 types = ssl->s3->hs->certificate_types;
2347 }
2348 *out_types = types.data();
2349 return types.size();
2350 }
2351
SSL_get0_peer_verify_algorithms(const SSL * ssl,const uint16_t ** out_sigalgs)2352 size_t SSL_get0_peer_verify_algorithms(const SSL *ssl,
2353 const uint16_t **out_sigalgs) {
2354 Span<const uint16_t> sigalgs;
2355 if (ssl->s3->hs != nullptr) {
2356 sigalgs = ssl->s3->hs->peer_sigalgs;
2357 }
2358 *out_sigalgs = sigalgs.data();
2359 return sigalgs.size();
2360 }
2361
SSL_get0_peer_delegation_algorithms(const SSL * ssl,const uint16_t ** out_sigalgs)2362 size_t SSL_get0_peer_delegation_algorithms(const SSL *ssl,
2363 const uint16_t **out_sigalgs){
2364 Span<const uint16_t> sigalgs;
2365 if (ssl->s3->hs != nullptr) {
2366 sigalgs = ssl->s3->hs->peer_delegated_credential_sigalgs;
2367 }
2368 *out_sigalgs = sigalgs.data();
2369 return sigalgs.size();
2370 }
2371
SSL_get_privatekey(const SSL * ssl)2372 EVP_PKEY *SSL_get_privatekey(const SSL *ssl) {
2373 if (!ssl->config) {
2374 assert(ssl->config);
2375 return NULL;
2376 }
2377 if (ssl->config->cert != NULL) {
2378 return ssl->config->cert->privatekey.get();
2379 }
2380
2381 return NULL;
2382 }
2383
SSL_CTX_get0_privatekey(const SSL_CTX * ctx)2384 EVP_PKEY *SSL_CTX_get0_privatekey(const SSL_CTX *ctx) {
2385 if (ctx->cert != NULL) {
2386 return ctx->cert->privatekey.get();
2387 }
2388
2389 return NULL;
2390 }
2391
SSL_get_current_cipher(const SSL * ssl)2392 const SSL_CIPHER *SSL_get_current_cipher(const SSL *ssl) {
2393 const SSL_SESSION *session = SSL_get_session(ssl);
2394 return session == nullptr ? nullptr : session->cipher;
2395 }
2396
SSL_session_reused(const SSL * ssl)2397 int SSL_session_reused(const SSL *ssl) {
2398 return ssl->s3->session_reused || SSL_in_early_data(ssl);
2399 }
2400
SSL_get_current_compression(SSL * ssl)2401 const COMP_METHOD *SSL_get_current_compression(SSL *ssl) { return NULL; }
2402
SSL_get_current_expansion(SSL * ssl)2403 const COMP_METHOD *SSL_get_current_expansion(SSL *ssl) { return NULL; }
2404
SSL_get_server_tmp_key(SSL * ssl,EVP_PKEY ** out_key)2405 int SSL_get_server_tmp_key(SSL *ssl, EVP_PKEY **out_key) { return 0; }
2406
SSL_CTX_set_quiet_shutdown(SSL_CTX * ctx,int mode)2407 void SSL_CTX_set_quiet_shutdown(SSL_CTX *ctx, int mode) {
2408 ctx->quiet_shutdown = (mode != 0);
2409 }
2410
SSL_CTX_get_quiet_shutdown(const SSL_CTX * ctx)2411 int SSL_CTX_get_quiet_shutdown(const SSL_CTX *ctx) {
2412 return ctx->quiet_shutdown;
2413 }
2414
SSL_set_quiet_shutdown(SSL * ssl,int mode)2415 void SSL_set_quiet_shutdown(SSL *ssl, int mode) {
2416 ssl->quiet_shutdown = (mode != 0);
2417 }
2418
SSL_get_quiet_shutdown(const SSL * ssl)2419 int SSL_get_quiet_shutdown(const SSL *ssl) { return ssl->quiet_shutdown; }
2420
SSL_set_shutdown(SSL * ssl,int mode)2421 void SSL_set_shutdown(SSL *ssl, int mode) {
2422 // It is an error to clear any bits that have already been set. (We can't try
2423 // to get a second close_notify or send two.)
2424 assert((SSL_get_shutdown(ssl) & mode) == SSL_get_shutdown(ssl));
2425
2426 if (mode & SSL_RECEIVED_SHUTDOWN &&
2427 ssl->s3->read_shutdown == ssl_shutdown_none) {
2428 ssl->s3->read_shutdown = ssl_shutdown_close_notify;
2429 }
2430
2431 if (mode & SSL_SENT_SHUTDOWN &&
2432 ssl->s3->write_shutdown == ssl_shutdown_none) {
2433 ssl->s3->write_shutdown = ssl_shutdown_close_notify;
2434 }
2435 }
2436
SSL_get_shutdown(const SSL * ssl)2437 int SSL_get_shutdown(const SSL *ssl) {
2438 int ret = 0;
2439 if (ssl->s3->read_shutdown != ssl_shutdown_none) {
2440 // Historically, OpenSSL set |SSL_RECEIVED_SHUTDOWN| on both close_notify
2441 // and fatal alert.
2442 ret |= SSL_RECEIVED_SHUTDOWN;
2443 }
2444 if (ssl->s3->write_shutdown == ssl_shutdown_close_notify) {
2445 // Historically, OpenSSL set |SSL_SENT_SHUTDOWN| on only close_notify.
2446 ret |= SSL_SENT_SHUTDOWN;
2447 }
2448 return ret;
2449 }
2450
SSL_get_SSL_CTX(const SSL * ssl)2451 SSL_CTX *SSL_get_SSL_CTX(const SSL *ssl) { return ssl->ctx.get(); }
2452
SSL_set_SSL_CTX(SSL * ssl,SSL_CTX * ctx)2453 SSL_CTX *SSL_set_SSL_CTX(SSL *ssl, SSL_CTX *ctx) {
2454 if (!ssl->config) {
2455 return NULL;
2456 }
2457 if (ssl->ctx.get() == ctx) {
2458 return ssl->ctx.get();
2459 }
2460
2461 // One cannot change the X.509 callbacks during a connection.
2462 if (ssl->ctx->x509_method != ctx->x509_method) {
2463 assert(0);
2464 return NULL;
2465 }
2466
2467 UniquePtr<CERT> new_cert = ssl_cert_dup(ctx->cert.get());
2468 if (!new_cert) {
2469 return nullptr;
2470 }
2471
2472 ssl->config->cert = std::move(new_cert);
2473 ssl->ctx = UpRef(ctx);
2474 ssl->enable_early_data = ssl->ctx->enable_early_data;
2475
2476 return ssl->ctx.get();
2477 }
2478
SSL_set_info_callback(SSL * ssl,void (* cb)(const SSL * ssl,int type,int value))2479 void SSL_set_info_callback(SSL *ssl,
2480 void (*cb)(const SSL *ssl, int type, int value)) {
2481 ssl->info_callback = cb;
2482 }
2483
SSL_get_info_callback(const SSL * ssl)2484 void (*SSL_get_info_callback(const SSL *ssl))(const SSL *ssl, int type,
2485 int value) {
2486 return ssl->info_callback;
2487 }
2488
SSL_state(const SSL * ssl)2489 int SSL_state(const SSL *ssl) {
2490 return SSL_in_init(ssl) ? SSL_ST_INIT : SSL_ST_OK;
2491 }
2492
SSL_set_state(SSL * ssl,int state)2493 void SSL_set_state(SSL *ssl, int state) { }
2494
SSL_get_shared_ciphers(const SSL * ssl,char * buf,int len)2495 char *SSL_get_shared_ciphers(const SSL *ssl, char *buf, int len) {
2496 if (len <= 0) {
2497 return NULL;
2498 }
2499 buf[0] = '\0';
2500 return buf;
2501 }
2502
SSL_get_shared_sigalgs(SSL * ssl,int idx,int * psign,int * phash,int * psignandhash,uint8_t * rsig,uint8_t * rhash)2503 int SSL_get_shared_sigalgs(SSL *ssl, int idx, int *psign, int *phash,
2504 int *psignandhash, uint8_t *rsig, uint8_t *rhash) {
2505 return 0;
2506 }
2507
SSL_CTX_set_quic_method(SSL_CTX * ctx,const SSL_QUIC_METHOD * quic_method)2508 int SSL_CTX_set_quic_method(SSL_CTX *ctx, const SSL_QUIC_METHOD *quic_method) {
2509 if (ctx->method->is_dtls) {
2510 return 0;
2511 }
2512 ctx->quic_method = quic_method;
2513 return 1;
2514 }
2515
SSL_set_quic_method(SSL * ssl,const SSL_QUIC_METHOD * quic_method)2516 int SSL_set_quic_method(SSL *ssl, const SSL_QUIC_METHOD *quic_method) {
2517 if (ssl->method->is_dtls) {
2518 return 0;
2519 }
2520 ssl->quic_method = quic_method;
2521 return 1;
2522 }
2523
SSL_get_ex_new_index(long argl,void * argp,CRYPTO_EX_unused * unused,CRYPTO_EX_dup * dup_unused,CRYPTO_EX_free * free_func)2524 int SSL_get_ex_new_index(long argl, void *argp, CRYPTO_EX_unused *unused,
2525 CRYPTO_EX_dup *dup_unused, CRYPTO_EX_free *free_func) {
2526 int index;
2527 if (!CRYPTO_get_ex_new_index(&g_ex_data_class_ssl, &index, argl, argp,
2528 free_func)) {
2529 return -1;
2530 }
2531 return index;
2532 }
2533
SSL_set_ex_data(SSL * ssl,int idx,void * data)2534 int SSL_set_ex_data(SSL *ssl, int idx, void *data) {
2535 return CRYPTO_set_ex_data(&ssl->ex_data, idx, data);
2536 }
2537
SSL_get_ex_data(const SSL * ssl,int idx)2538 void *SSL_get_ex_data(const SSL *ssl, int idx) {
2539 return CRYPTO_get_ex_data(&ssl->ex_data, idx);
2540 }
2541
SSL_CTX_get_ex_new_index(long argl,void * argp,CRYPTO_EX_unused * unused,CRYPTO_EX_dup * dup_unused,CRYPTO_EX_free * free_func)2542 int SSL_CTX_get_ex_new_index(long argl, void *argp, CRYPTO_EX_unused *unused,
2543 CRYPTO_EX_dup *dup_unused,
2544 CRYPTO_EX_free *free_func) {
2545 int index;
2546 if (!CRYPTO_get_ex_new_index(&g_ex_data_class_ssl_ctx, &index, argl, argp,
2547 free_func)) {
2548 return -1;
2549 }
2550 return index;
2551 }
2552
SSL_CTX_set_ex_data(SSL_CTX * ctx,int idx,void * data)2553 int SSL_CTX_set_ex_data(SSL_CTX *ctx, int idx, void *data) {
2554 return CRYPTO_set_ex_data(&ctx->ex_data, idx, data);
2555 }
2556
SSL_CTX_get_ex_data(const SSL_CTX * ctx,int idx)2557 void *SSL_CTX_get_ex_data(const SSL_CTX *ctx, int idx) {
2558 return CRYPTO_get_ex_data(&ctx->ex_data, idx);
2559 }
2560
SSL_want(const SSL * ssl)2561 int SSL_want(const SSL *ssl) { return ssl->s3->rwstate; }
2562
SSL_CTX_set_tmp_rsa_callback(SSL_CTX * ctx,RSA * (* cb)(SSL * ssl,int is_export,int keylength))2563 void SSL_CTX_set_tmp_rsa_callback(SSL_CTX *ctx,
2564 RSA *(*cb)(SSL *ssl, int is_export,
2565 int keylength)) {}
2566
SSL_set_tmp_rsa_callback(SSL * ssl,RSA * (* cb)(SSL * ssl,int is_export,int keylength))2567 void SSL_set_tmp_rsa_callback(SSL *ssl, RSA *(*cb)(SSL *ssl, int is_export,
2568 int keylength)) {}
2569
SSL_CTX_set_tmp_dh_callback(SSL_CTX * ctx,DH * (* cb)(SSL * ssl,int is_export,int keylength))2570 void SSL_CTX_set_tmp_dh_callback(SSL_CTX *ctx,
2571 DH *(*cb)(SSL *ssl, int is_export,
2572 int keylength)) {}
2573
SSL_set_tmp_dh_callback(SSL * ssl,DH * (* cb)(SSL * ssl,int is_export,int keylength))2574 void SSL_set_tmp_dh_callback(SSL *ssl, DH *(*cb)(SSL *ssl, int is_export,
2575 int keylength)) {}
2576
use_psk_identity_hint(UniquePtr<char> * out,const char * identity_hint)2577 static int use_psk_identity_hint(UniquePtr<char> *out,
2578 const char *identity_hint) {
2579 if (identity_hint != NULL && strlen(identity_hint) > PSK_MAX_IDENTITY_LEN) {
2580 OPENSSL_PUT_ERROR(SSL, SSL_R_DATA_LENGTH_TOO_LONG);
2581 return 0;
2582 }
2583
2584 // Clear currently configured hint, if any.
2585 out->reset();
2586
2587 // Treat the empty hint as not supplying one. Plain PSK makes it possible to
2588 // send either no hint (omit ServerKeyExchange) or an empty hint, while
2589 // ECDHE_PSK can only spell empty hint. Having different capabilities is odd,
2590 // so we interpret empty and missing as identical.
2591 if (identity_hint != NULL && identity_hint[0] != '\0') {
2592 out->reset(OPENSSL_strdup(identity_hint));
2593 if (*out == nullptr) {
2594 return 0;
2595 }
2596 }
2597
2598 return 1;
2599 }
2600
SSL_CTX_use_psk_identity_hint(SSL_CTX * ctx,const char * identity_hint)2601 int SSL_CTX_use_psk_identity_hint(SSL_CTX *ctx, const char *identity_hint) {
2602 return use_psk_identity_hint(&ctx->psk_identity_hint, identity_hint);
2603 }
2604
SSL_use_psk_identity_hint(SSL * ssl,const char * identity_hint)2605 int SSL_use_psk_identity_hint(SSL *ssl, const char *identity_hint) {
2606 if (!ssl->config) {
2607 return 0;
2608 }
2609 return use_psk_identity_hint(&ssl->config->psk_identity_hint, identity_hint);
2610 }
2611
SSL_get_psk_identity_hint(const SSL * ssl)2612 const char *SSL_get_psk_identity_hint(const SSL *ssl) {
2613 if (ssl == NULL) {
2614 return NULL;
2615 }
2616 if (ssl->config == NULL) {
2617 assert(ssl->config);
2618 return NULL;
2619 }
2620 return ssl->config->psk_identity_hint.get();
2621 }
2622
SSL_get_psk_identity(const SSL * ssl)2623 const char *SSL_get_psk_identity(const SSL *ssl) {
2624 if (ssl == NULL) {
2625 return NULL;
2626 }
2627 SSL_SESSION *session = SSL_get_session(ssl);
2628 if (session == NULL) {
2629 return NULL;
2630 }
2631 return session->psk_identity.get();
2632 }
2633
SSL_set_psk_client_callback(SSL * ssl,unsigned (* cb)(SSL * ssl,const char * hint,char * identity,unsigned max_identity_len,uint8_t * psk,unsigned max_psk_len))2634 void SSL_set_psk_client_callback(
2635 SSL *ssl, unsigned (*cb)(SSL *ssl, const char *hint, char *identity,
2636 unsigned max_identity_len, uint8_t *psk,
2637 unsigned max_psk_len)) {
2638 if (!ssl->config) {
2639 return;
2640 }
2641 ssl->config->psk_client_callback = cb;
2642 }
2643
SSL_CTX_set_psk_client_callback(SSL_CTX * ctx,unsigned (* cb)(SSL * ssl,const char * hint,char * identity,unsigned max_identity_len,uint8_t * psk,unsigned max_psk_len))2644 void SSL_CTX_set_psk_client_callback(
2645 SSL_CTX *ctx, unsigned (*cb)(SSL *ssl, const char *hint, char *identity,
2646 unsigned max_identity_len, uint8_t *psk,
2647 unsigned max_psk_len)) {
2648 ctx->psk_client_callback = cb;
2649 }
2650
SSL_set_psk_server_callback(SSL * ssl,unsigned (* cb)(SSL * ssl,const char * identity,uint8_t * psk,unsigned max_psk_len))2651 void SSL_set_psk_server_callback(
2652 SSL *ssl, unsigned (*cb)(SSL *ssl, const char *identity, uint8_t *psk,
2653 unsigned max_psk_len)) {
2654 if (!ssl->config) {
2655 return;
2656 }
2657 ssl->config->psk_server_callback = cb;
2658 }
2659
SSL_CTX_set_psk_server_callback(SSL_CTX * ctx,unsigned (* cb)(SSL * ssl,const char * identity,uint8_t * psk,unsigned max_psk_len))2660 void SSL_CTX_set_psk_server_callback(
2661 SSL_CTX *ctx, unsigned (*cb)(SSL *ssl, const char *identity,
2662 uint8_t *psk, unsigned max_psk_len)) {
2663 ctx->psk_server_callback = cb;
2664 }
2665
SSL_CTX_set_msg_callback(SSL_CTX * ctx,void (* cb)(int write_p,int version,int content_type,const void * buf,size_t len,SSL * ssl,void * arg))2666 void SSL_CTX_set_msg_callback(SSL_CTX *ctx,
2667 void (*cb)(int write_p, int version,
2668 int content_type, const void *buf,
2669 size_t len, SSL *ssl, void *arg)) {
2670 ctx->msg_callback = cb;
2671 }
2672
SSL_CTX_set_msg_callback_arg(SSL_CTX * ctx,void * arg)2673 void SSL_CTX_set_msg_callback_arg(SSL_CTX *ctx, void *arg) {
2674 ctx->msg_callback_arg = arg;
2675 }
2676
SSL_set_msg_callback(SSL * ssl,void (* cb)(int write_p,int version,int content_type,const void * buf,size_t len,SSL * ssl,void * arg))2677 void SSL_set_msg_callback(SSL *ssl,
2678 void (*cb)(int write_p, int version, int content_type,
2679 const void *buf, size_t len, SSL *ssl,
2680 void *arg)) {
2681 ssl->msg_callback = cb;
2682 }
2683
SSL_set_msg_callback_arg(SSL * ssl,void * arg)2684 void SSL_set_msg_callback_arg(SSL *ssl, void *arg) {
2685 ssl->msg_callback_arg = arg;
2686 }
2687
SSL_CTX_set_keylog_callback(SSL_CTX * ctx,void (* cb)(const SSL * ssl,const char * line))2688 void SSL_CTX_set_keylog_callback(SSL_CTX *ctx,
2689 void (*cb)(const SSL *ssl, const char *line)) {
2690 ctx->keylog_callback = cb;
2691 }
2692
SSL_CTX_get_keylog_callback(const SSL_CTX * ctx)2693 void (*SSL_CTX_get_keylog_callback(const SSL_CTX *ctx))(const SSL *ssl,
2694 const char *line) {
2695 return ctx->keylog_callback;
2696 }
2697
SSL_CTX_set_current_time_cb(SSL_CTX * ctx,void (* cb)(const SSL * ssl,struct timeval * out_clock))2698 void SSL_CTX_set_current_time_cb(SSL_CTX *ctx,
2699 void (*cb)(const SSL *ssl,
2700 struct timeval *out_clock)) {
2701 ctx->current_time_cb = cb;
2702 }
2703
SSL_can_release_private_key(const SSL * ssl)2704 int SSL_can_release_private_key(const SSL *ssl) {
2705 if (ssl_can_renegotiate(ssl)) {
2706 // If the connection can renegotiate (client only), the private key may be
2707 // used in a future handshake.
2708 return 0;
2709 }
2710
2711 // Otherwise, this is determined by the current handshake.
2712 return !ssl->s3->hs || ssl->s3->hs->can_release_private_key;
2713 }
2714
SSL_is_init_finished(const SSL * ssl)2715 int SSL_is_init_finished(const SSL *ssl) {
2716 return !SSL_in_init(ssl);
2717 }
2718
SSL_in_init(const SSL * ssl)2719 int SSL_in_init(const SSL *ssl) {
2720 // This returns false once all the handshake state has been finalized, to
2721 // allow callbacks and getters based on SSL_in_init to return the correct
2722 // values.
2723 SSL_HANDSHAKE *hs = ssl->s3->hs.get();
2724 return hs != nullptr && !hs->handshake_finalized;
2725 }
2726
SSL_in_false_start(const SSL * ssl)2727 int SSL_in_false_start(const SSL *ssl) {
2728 if (ssl->s3->hs == NULL) {
2729 return 0;
2730 }
2731 return ssl->s3->hs->in_false_start;
2732 }
2733
SSL_cutthrough_complete(const SSL * ssl)2734 int SSL_cutthrough_complete(const SSL *ssl) {
2735 return SSL_in_false_start(ssl);
2736 }
2737
SSL_is_server(const SSL * ssl)2738 int SSL_is_server(const SSL *ssl) { return ssl->server; }
2739
SSL_is_dtls(const SSL * ssl)2740 int SSL_is_dtls(const SSL *ssl) { return ssl->method->is_dtls; }
2741
SSL_CTX_set_select_certificate_cb(SSL_CTX * ctx,enum ssl_select_cert_result_t (* cb)(const SSL_CLIENT_HELLO *))2742 void SSL_CTX_set_select_certificate_cb(
2743 SSL_CTX *ctx,
2744 enum ssl_select_cert_result_t (*cb)(const SSL_CLIENT_HELLO *)) {
2745 ctx->select_certificate_cb = cb;
2746 }
2747
SSL_CTX_set_dos_protection_cb(SSL_CTX * ctx,int (* cb)(const SSL_CLIENT_HELLO *))2748 void SSL_CTX_set_dos_protection_cb(SSL_CTX *ctx,
2749 int (*cb)(const SSL_CLIENT_HELLO *)) {
2750 ctx->dos_protection_cb = cb;
2751 }
2752
SSL_CTX_set_reverify_on_resume(SSL_CTX * ctx,int enabled)2753 void SSL_CTX_set_reverify_on_resume(SSL_CTX *ctx, int enabled) {
2754 ctx->reverify_on_resume = !!enabled;
2755 }
2756
SSL_set_enforce_rsa_key_usage(SSL * ssl,int enabled)2757 void SSL_set_enforce_rsa_key_usage(SSL *ssl, int enabled) {
2758 if (!ssl->config) {
2759 return;
2760 }
2761 ssl->config->enforce_rsa_key_usage = !!enabled;
2762 }
2763
SSL_set_renegotiate_mode(SSL * ssl,enum ssl_renegotiate_mode_t mode)2764 void SSL_set_renegotiate_mode(SSL *ssl, enum ssl_renegotiate_mode_t mode) {
2765 ssl->renegotiate_mode = mode;
2766
2767 // Check if |ssl_can_renegotiate| has changed and the configuration may now be
2768 // shed. HTTP clients may initially allow renegotiation for HTTP/1.1, and then
2769 // disable after the handshake once the ALPN protocol is known to be HTTP/2.
2770 ssl_maybe_shed_handshake_config(ssl);
2771 }
2772
SSL_get_ivs(const SSL * ssl,const uint8_t ** out_read_iv,const uint8_t ** out_write_iv,size_t * out_iv_len)2773 int SSL_get_ivs(const SSL *ssl, const uint8_t **out_read_iv,
2774 const uint8_t **out_write_iv, size_t *out_iv_len) {
2775 size_t write_iv_len;
2776 if (!ssl->s3->aead_read_ctx->GetIV(out_read_iv, out_iv_len) ||
2777 !ssl->s3->aead_write_ctx->GetIV(out_write_iv, &write_iv_len) ||
2778 *out_iv_len != write_iv_len) {
2779 return 0;
2780 }
2781
2782 return 1;
2783 }
2784
be_to_u64(const uint8_t in[8])2785 static uint64_t be_to_u64(const uint8_t in[8]) {
2786 return (((uint64_t)in[0]) << 56) | (((uint64_t)in[1]) << 48) |
2787 (((uint64_t)in[2]) << 40) | (((uint64_t)in[3]) << 32) |
2788 (((uint64_t)in[4]) << 24) | (((uint64_t)in[5]) << 16) |
2789 (((uint64_t)in[6]) << 8) | ((uint64_t)in[7]);
2790 }
2791
SSL_get_read_sequence(const SSL * ssl)2792 uint64_t SSL_get_read_sequence(const SSL *ssl) {
2793 // TODO(davidben): Internally represent sequence numbers as uint64_t.
2794 if (SSL_is_dtls(ssl)) {
2795 // max_seq_num already includes the epoch.
2796 assert(ssl->d1->r_epoch == (ssl->d1->bitmap.max_seq_num >> 48));
2797 return ssl->d1->bitmap.max_seq_num;
2798 }
2799 return be_to_u64(ssl->s3->read_sequence);
2800 }
2801
SSL_get_write_sequence(const SSL * ssl)2802 uint64_t SSL_get_write_sequence(const SSL *ssl) {
2803 uint64_t ret = be_to_u64(ssl->s3->write_sequence);
2804 if (SSL_is_dtls(ssl)) {
2805 assert((ret >> 48) == 0);
2806 ret |= ((uint64_t)ssl->d1->w_epoch) << 48;
2807 }
2808 return ret;
2809 }
2810
SSL_get_peer_signature_algorithm(const SSL * ssl)2811 uint16_t SSL_get_peer_signature_algorithm(const SSL *ssl) {
2812 // TODO(davidben): This checks the wrong session if there is a renegotiation
2813 // in progress.
2814 SSL_SESSION *session = SSL_get_session(ssl);
2815 if (session == NULL) {
2816 return 0;
2817 }
2818
2819 return session->peer_signature_algorithm;
2820 }
2821
SSL_get_client_random(const SSL * ssl,uint8_t * out,size_t max_out)2822 size_t SSL_get_client_random(const SSL *ssl, uint8_t *out, size_t max_out) {
2823 if (max_out == 0) {
2824 return sizeof(ssl->s3->client_random);
2825 }
2826 if (max_out > sizeof(ssl->s3->client_random)) {
2827 max_out = sizeof(ssl->s3->client_random);
2828 }
2829 OPENSSL_memcpy(out, ssl->s3->client_random, max_out);
2830 return max_out;
2831 }
2832
SSL_get_server_random(const SSL * ssl,uint8_t * out,size_t max_out)2833 size_t SSL_get_server_random(const SSL *ssl, uint8_t *out, size_t max_out) {
2834 if (max_out == 0) {
2835 return sizeof(ssl->s3->server_random);
2836 }
2837 if (max_out > sizeof(ssl->s3->server_random)) {
2838 max_out = sizeof(ssl->s3->server_random);
2839 }
2840 OPENSSL_memcpy(out, ssl->s3->server_random, max_out);
2841 return max_out;
2842 }
2843
SSL_get_pending_cipher(const SSL * ssl)2844 const SSL_CIPHER *SSL_get_pending_cipher(const SSL *ssl) {
2845 SSL_HANDSHAKE *hs = ssl->s3->hs.get();
2846 if (hs == NULL) {
2847 return NULL;
2848 }
2849 return hs->new_cipher;
2850 }
2851
SSL_set_retain_only_sha256_of_client_certs(SSL * ssl,int enabled)2852 void SSL_set_retain_only_sha256_of_client_certs(SSL *ssl, int enabled) {
2853 if (!ssl->config) {
2854 return;
2855 }
2856 ssl->config->retain_only_sha256_of_client_certs = !!enabled;
2857 }
2858
SSL_CTX_set_retain_only_sha256_of_client_certs(SSL_CTX * ctx,int enabled)2859 void SSL_CTX_set_retain_only_sha256_of_client_certs(SSL_CTX *ctx, int enabled) {
2860 ctx->retain_only_sha256_of_client_certs = !!enabled;
2861 }
2862
SSL_CTX_set_grease_enabled(SSL_CTX * ctx,int enabled)2863 void SSL_CTX_set_grease_enabled(SSL_CTX *ctx, int enabled) {
2864 ctx->grease_enabled = !!enabled;
2865 }
2866
SSL_CTX_set_permute_extensions(SSL_CTX * ctx,int enabled)2867 void SSL_CTX_set_permute_extensions(SSL_CTX *ctx, int enabled) {
2868 ctx->permute_extensions = !!enabled;
2869 }
2870
SSL_set_permute_extensions(SSL * ssl,int enabled)2871 void SSL_set_permute_extensions(SSL *ssl, int enabled) {
2872 if (!ssl->config) {
2873 return;
2874 }
2875 ssl->config->permute_extensions = !!enabled;
2876 }
2877
SSL_get_ticket_age_skew(const SSL * ssl)2878 int32_t SSL_get_ticket_age_skew(const SSL *ssl) {
2879 return ssl->s3->ticket_age_skew;
2880 }
2881
SSL_CTX_set_false_start_allowed_without_alpn(SSL_CTX * ctx,int allowed)2882 void SSL_CTX_set_false_start_allowed_without_alpn(SSL_CTX *ctx, int allowed) {
2883 ctx->false_start_allowed_without_alpn = !!allowed;
2884 }
2885
SSL_used_hello_retry_request(const SSL * ssl)2886 int SSL_used_hello_retry_request(const SSL *ssl) {
2887 return ssl->s3->used_hello_retry_request;
2888 }
2889
SSL_set_shed_handshake_config(SSL * ssl,int enable)2890 void SSL_set_shed_handshake_config(SSL *ssl, int enable) {
2891 if (!ssl->config) {
2892 return;
2893 }
2894 ssl->config->shed_handshake_config = !!enable;
2895 }
2896
SSL_set_jdk11_workaround(SSL * ssl,int enable)2897 void SSL_set_jdk11_workaround(SSL *ssl, int enable) {
2898 if (!ssl->config) {
2899 return;
2900 }
2901 ssl->config->jdk11_workaround = !!enable;
2902 }
2903
SSL_set_quic_use_legacy_codepoint(SSL * ssl,int use_legacy)2904 void SSL_set_quic_use_legacy_codepoint(SSL *ssl, int use_legacy) {
2905 if (!ssl->config) {
2906 return;
2907 }
2908 ssl->config->quic_use_legacy_codepoint = !!use_legacy;
2909 }
2910
SSL_clear(SSL * ssl)2911 int SSL_clear(SSL *ssl) {
2912 if (!ssl->config) {
2913 return 0; // SSL_clear may not be used after shedding config.
2914 }
2915
2916 // In OpenSSL, reusing a client |SSL| with |SSL_clear| causes the previously
2917 // established session to be offered the next time around. wpa_supplicant
2918 // depends on this behavior, so emulate it.
2919 UniquePtr<SSL_SESSION> session;
2920 if (!ssl->server && ssl->s3->established_session != NULL) {
2921 session = UpRef(ssl->s3->established_session);
2922 }
2923
2924 // The ssl->d1->mtu is simultaneously configuration (preserved across
2925 // clear) and connection-specific state (gets reset).
2926 //
2927 // TODO(davidben): Avoid this.
2928 unsigned mtu = 0;
2929 if (ssl->d1 != NULL) {
2930 mtu = ssl->d1->mtu;
2931 }
2932
2933 ssl->method->ssl_free(ssl);
2934 if (!ssl->method->ssl_new(ssl)) {
2935 return 0;
2936 }
2937
2938 if (SSL_is_dtls(ssl) && (SSL_get_options(ssl) & SSL_OP_NO_QUERY_MTU)) {
2939 ssl->d1->mtu = mtu;
2940 }
2941
2942 if (session != nullptr) {
2943 SSL_set_session(ssl, session.get());
2944 }
2945
2946 return 1;
2947 }
2948
SSL_CTX_sess_connect(const SSL_CTX * ctx)2949 int SSL_CTX_sess_connect(const SSL_CTX *ctx) { return 0; }
SSL_CTX_sess_connect_good(const SSL_CTX * ctx)2950 int SSL_CTX_sess_connect_good(const SSL_CTX *ctx) { return 0; }
SSL_CTX_sess_connect_renegotiate(const SSL_CTX * ctx)2951 int SSL_CTX_sess_connect_renegotiate(const SSL_CTX *ctx) { return 0; }
SSL_CTX_sess_accept(const SSL_CTX * ctx)2952 int SSL_CTX_sess_accept(const SSL_CTX *ctx) { return 0; }
SSL_CTX_sess_accept_renegotiate(const SSL_CTX * ctx)2953 int SSL_CTX_sess_accept_renegotiate(const SSL_CTX *ctx) { return 0; }
SSL_CTX_sess_accept_good(const SSL_CTX * ctx)2954 int SSL_CTX_sess_accept_good(const SSL_CTX *ctx) { return 0; }
SSL_CTX_sess_hits(const SSL_CTX * ctx)2955 int SSL_CTX_sess_hits(const SSL_CTX *ctx) { return 0; }
SSL_CTX_sess_cb_hits(const SSL_CTX * ctx)2956 int SSL_CTX_sess_cb_hits(const SSL_CTX *ctx) { return 0; }
SSL_CTX_sess_misses(const SSL_CTX * ctx)2957 int SSL_CTX_sess_misses(const SSL_CTX *ctx) { return 0; }
SSL_CTX_sess_timeouts(const SSL_CTX * ctx)2958 int SSL_CTX_sess_timeouts(const SSL_CTX *ctx) { return 0; }
SSL_CTX_sess_cache_full(const SSL_CTX * ctx)2959 int SSL_CTX_sess_cache_full(const SSL_CTX *ctx) { return 0; }
2960
SSL_num_renegotiations(const SSL * ssl)2961 int SSL_num_renegotiations(const SSL *ssl) {
2962 return SSL_total_renegotiations(ssl);
2963 }
2964
SSL_CTX_need_tmp_RSA(const SSL_CTX * ctx)2965 int SSL_CTX_need_tmp_RSA(const SSL_CTX *ctx) { return 0; }
SSL_need_tmp_RSA(const SSL * ssl)2966 int SSL_need_tmp_RSA(const SSL *ssl) { return 0; }
SSL_CTX_set_tmp_rsa(SSL_CTX * ctx,const RSA * rsa)2967 int SSL_CTX_set_tmp_rsa(SSL_CTX *ctx, const RSA *rsa) { return 1; }
SSL_set_tmp_rsa(SSL * ssl,const RSA * rsa)2968 int SSL_set_tmp_rsa(SSL *ssl, const RSA *rsa) { return 1; }
ERR_load_SSL_strings(void)2969 void ERR_load_SSL_strings(void) {}
SSL_load_error_strings(void)2970 void SSL_load_error_strings(void) {}
SSL_cache_hit(SSL * ssl)2971 int SSL_cache_hit(SSL *ssl) { return SSL_session_reused(ssl); }
2972
SSL_CTX_set_tmp_ecdh(SSL_CTX * ctx,const EC_KEY * ec_key)2973 int SSL_CTX_set_tmp_ecdh(SSL_CTX *ctx, const EC_KEY *ec_key) {
2974 if (ec_key == NULL || EC_KEY_get0_group(ec_key) == NULL) {
2975 OPENSSL_PUT_ERROR(SSL, ERR_R_PASSED_NULL_PARAMETER);
2976 return 0;
2977 }
2978 int nid = EC_GROUP_get_curve_name(EC_KEY_get0_group(ec_key));
2979 return SSL_CTX_set1_curves(ctx, &nid, 1);
2980 }
2981
SSL_set_tmp_ecdh(SSL * ssl,const EC_KEY * ec_key)2982 int SSL_set_tmp_ecdh(SSL *ssl, const EC_KEY *ec_key) {
2983 if (ec_key == NULL || EC_KEY_get0_group(ec_key) == NULL) {
2984 OPENSSL_PUT_ERROR(SSL, ERR_R_PASSED_NULL_PARAMETER);
2985 return 0;
2986 }
2987 int nid = EC_GROUP_get_curve_name(EC_KEY_get0_group(ec_key));
2988 return SSL_set1_curves(ssl, &nid, 1);
2989 }
2990
SSL_CTX_set_ticket_aead_method(SSL_CTX * ctx,const SSL_TICKET_AEAD_METHOD * aead_method)2991 void SSL_CTX_set_ticket_aead_method(SSL_CTX *ctx,
2992 const SSL_TICKET_AEAD_METHOD *aead_method) {
2993 ctx->ticket_aead_method = aead_method;
2994 }
2995
SSL_process_tls13_new_session_ticket(SSL * ssl,const uint8_t * buf,size_t buf_len)2996 SSL_SESSION *SSL_process_tls13_new_session_ticket(SSL *ssl, const uint8_t *buf,
2997 size_t buf_len) {
2998 if (SSL_in_init(ssl) ||
2999 ssl_protocol_version(ssl) != TLS1_3_VERSION ||
3000 ssl->server) {
3001 // Only TLS 1.3 clients are supported.
3002 OPENSSL_PUT_ERROR(SSL, ERR_R_SHOULD_NOT_HAVE_BEEN_CALLED);
3003 return nullptr;
3004 }
3005
3006 CBS cbs, body;
3007 CBS_init(&cbs, buf, buf_len);
3008 uint8_t type;
3009 if (!CBS_get_u8(&cbs, &type) ||
3010 !CBS_get_u24_length_prefixed(&cbs, &body) ||
3011 CBS_len(&cbs) != 0) {
3012 OPENSSL_PUT_ERROR(SSL, SSL_R_DECODE_ERROR);
3013 return nullptr;
3014 }
3015
3016 UniquePtr<SSL_SESSION> session = tls13_create_session_with_ticket(ssl, &body);
3017 if (!session) {
3018 // |tls13_create_session_with_ticket| puts the correct error.
3019 return nullptr;
3020 }
3021 return session.release();
3022 }
3023
SSL_set_tlsext_status_type(SSL * ssl,int type)3024 int SSL_set_tlsext_status_type(SSL *ssl, int type) {
3025 if (!ssl->config) {
3026 return 0;
3027 }
3028 ssl->config->ocsp_stapling_enabled = type == TLSEXT_STATUSTYPE_ocsp;
3029 return 1;
3030 }
3031
SSL_get_tlsext_status_type(const SSL * ssl)3032 int SSL_get_tlsext_status_type(const SSL *ssl) {
3033 if (ssl->server) {
3034 SSL_HANDSHAKE *hs = ssl->s3->hs.get();
3035 return hs != nullptr && hs->ocsp_stapling_requested
3036 ? TLSEXT_STATUSTYPE_ocsp
3037 : TLSEXT_STATUSTYPE_nothing;
3038 }
3039
3040 return ssl->config != nullptr && ssl->config->ocsp_stapling_enabled
3041 ? TLSEXT_STATUSTYPE_ocsp
3042 : TLSEXT_STATUSTYPE_nothing;
3043 }
3044
SSL_set_tlsext_status_ocsp_resp(SSL * ssl,uint8_t * resp,size_t resp_len)3045 int SSL_set_tlsext_status_ocsp_resp(SSL *ssl, uint8_t *resp, size_t resp_len) {
3046 if (SSL_set_ocsp_response(ssl, resp, resp_len)) {
3047 OPENSSL_free(resp);
3048 return 1;
3049 }
3050 return 0;
3051 }
3052
SSL_get_tlsext_status_ocsp_resp(const SSL * ssl,const uint8_t ** out)3053 size_t SSL_get_tlsext_status_ocsp_resp(const SSL *ssl, const uint8_t **out) {
3054 size_t ret;
3055 SSL_get0_ocsp_response(ssl, out, &ret);
3056 return ret;
3057 }
3058
SSL_CTX_set_tlsext_status_cb(SSL_CTX * ctx,int (* callback)(SSL * ssl,void * arg))3059 int SSL_CTX_set_tlsext_status_cb(SSL_CTX *ctx,
3060 int (*callback)(SSL *ssl, void *arg)) {
3061 ctx->legacy_ocsp_callback = callback;
3062 return 1;
3063 }
3064
SSL_CTX_set_tlsext_status_arg(SSL_CTX * ctx,void * arg)3065 int SSL_CTX_set_tlsext_status_arg(SSL_CTX *ctx, void *arg) {
3066 ctx->legacy_ocsp_callback_arg = arg;
3067 return 1;
3068 }
3069