1 /* Copyright (C) 1995-1998 Eric Young (eay@cryptsoft.com)
2 * All rights reserved.
3 *
4 * This package is an SSL implementation written
5 * by Eric Young (eay@cryptsoft.com).
6 * The implementation was written so as to conform with Netscapes SSL.
7 *
8 * This library is free for commercial and non-commercial use as long as
9 * the following conditions are aheared to. The following conditions
10 * apply to all code found in this distribution, be it the RC4, RSA,
11 * lhash, DES, etc., code; not just the SSL code. The SSL documentation
12 * included with this distribution is covered by the same copyright terms
13 * except that the holder is Tim Hudson (tjh@cryptsoft.com).
14 *
15 * Copyright remains Eric Young's, and as such any Copyright notices in
16 * the code are not to be removed.
17 * If this package is used in a product, Eric Young should be given attribution
18 * as the author of the parts of the library used.
19 * This can be in the form of a textual message at program startup or
20 * in documentation (online or textual) provided with the package.
21 *
22 * Redistribution and use in source and binary forms, with or without
23 * modification, are permitted provided that the following conditions
24 * are met:
25 * 1. Redistributions of source code must retain the copyright
26 * notice, this list of conditions and the following disclaimer.
27 * 2. Redistributions in binary form must reproduce the above copyright
28 * notice, this list of conditions and the following disclaimer in the
29 * documentation and/or other materials provided with the distribution.
30 * 3. All advertising materials mentioning features or use of this software
31 * must display the following acknowledgement:
32 * "This product includes cryptographic software written by
33 * Eric Young (eay@cryptsoft.com)"
34 * The word 'cryptographic' can be left out if the rouines from the library
35 * being used are not cryptographic related :-).
36 * 4. If you include any Windows specific code (or a derivative thereof) from
37 * the apps directory (application code) you must include an acknowledgement:
38 * "This product includes software written by Tim Hudson (tjh@cryptsoft.com)"
39 *
40 * THIS SOFTWARE IS PROVIDED BY ERIC YOUNG ``AS IS'' AND
41 * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
42 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
43 * ARE DISCLAIMED. IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE
44 * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
45 * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
46 * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
47 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
48 * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
49 * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
50 * SUCH DAMAGE.
51 *
52 * The licence and distribution terms for any publically available version or
53 * derivative of this code cannot be changed. i.e. this code cannot simply be
54 * copied and put under another distribution licence
55 * [including the GNU Public Licence.]
56 */
57 /* ====================================================================
58 * Copyright (c) 1998-2007 The OpenSSL Project. All rights reserved.
59 *
60 * Redistribution and use in source and binary forms, with or without
61 * modification, are permitted provided that the following conditions
62 * are met:
63 *
64 * 1. Redistributions of source code must retain the above copyright
65 * notice, this list of conditions and the following disclaimer.
66 *
67 * 2. Redistributions in binary form must reproduce the above copyright
68 * notice, this list of conditions and the following disclaimer in
69 * the documentation and/or other materials provided with the
70 * distribution.
71 *
72 * 3. All advertising materials mentioning features or use of this
73 * software must display the following acknowledgment:
74 * "This product includes software developed by the OpenSSL Project
75 * for use in the OpenSSL Toolkit. (http://www.openssl.org/)"
76 *
77 * 4. The names "OpenSSL Toolkit" and "OpenSSL Project" must not be used to
78 * endorse or promote products derived from this software without
79 * prior written permission. For written permission, please contact
80 * openssl-core@openssl.org.
81 *
82 * 5. Products derived from this software may not be called "OpenSSL"
83 * nor may "OpenSSL" appear in their names without prior written
84 * permission of the OpenSSL Project.
85 *
86 * 6. Redistributions of any form whatsoever must retain the following
87 * acknowledgment:
88 * "This product includes software developed by the OpenSSL Project
89 * for use in the OpenSSL Toolkit (http://www.openssl.org/)"
90 *
91 * THIS SOFTWARE IS PROVIDED BY THE OpenSSL PROJECT ``AS IS'' AND ANY
92 * EXPRESSED OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
93 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
94 * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE OpenSSL PROJECT OR
95 * ITS CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
96 * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
97 * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
98 * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
99 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT,
100 * STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
101 * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED
102 * OF THE POSSIBILITY OF SUCH DAMAGE.
103 * ====================================================================
104 *
105 * This product includes cryptographic software written by Eric Young
106 * (eay@cryptsoft.com). This product includes software written by Tim
107 * Hudson (tjh@cryptsoft.com).
108 *
109 */
110 /* ====================================================================
111 * Copyright 2002 Sun Microsystems, Inc. ALL RIGHTS RESERVED.
112 * ECC cipher suite support in OpenSSL originally developed by
113 * SUN MICROSYSTEMS, INC., and contributed to the OpenSSL project.
114 */
115 /* ====================================================================
116 * Copyright 2005 Nokia. All rights reserved.
117 *
118 * The portions of the attached software ("Contribution") is developed by
119 * Nokia Corporation and is licensed pursuant to the OpenSSL open source
120 * license.
121 *
122 * The Contribution, originally written by Mika Kousa and Pasi Eronen of
123 * Nokia Corporation, consists of the "PSK" (Pre-Shared Key) ciphersuites
124 * support (see RFC 4279) to OpenSSL.
125 *
126 * No patent licenses or other rights except those expressly stated in
127 * the OpenSSL open source license shall be deemed granted or received
128 * expressly, by implication, estoppel, or otherwise.
129 *
130 * No assurances are provided by Nokia that the Contribution does not
131 * infringe the patent or other intellectual property rights of any third
132 * party or that the license provides you with all the necessary rights
133 * to make use of the Contribution.
134 *
135 * THE SOFTWARE IS PROVIDED "AS IS" WITHOUT WARRANTY OF ANY KIND. IN
136 * ADDITION TO THE DISCLAIMERS INCLUDED IN THE LICENSE, NOKIA
137 * SPECIFICALLY DISCLAIMS ANY LIABILITY FOR CLAIMS BROUGHT BY YOU OR ANY
138 * OTHER ENTITY BASED ON INFRINGEMENT OF INTELLECTUAL PROPERTY RIGHTS OR
139 * OTHERWISE. */
140
141 #include <openssl/ssl.h>
142
143 #include <assert.h>
144 #include <stdlib.h>
145 #include <string.h>
146
147 #include <openssl/bytestring.h>
148 #include <openssl/crypto.h>
149 #include <openssl/err.h>
150 #include <openssl/lhash.h>
151 #include <openssl/mem.h>
152 #include <openssl/rand.h>
153
154 #include "internal.h"
155 #include "../crypto/internal.h"
156
157 #if defined(OPENSSL_WINDOWS)
158 #include <sys/timeb.h>
159 #else
160 #include <sys/socket.h>
161 #include <sys/time.h>
162 #endif
163
164
165 BSSL_NAMESPACE_BEGIN
166
167 // |SSL_R_UNKNOWN_PROTOCOL| is no longer emitted, but continue to define it
168 // to avoid downstream churn.
169 OPENSSL_DECLARE_ERROR_REASON(SSL, UNKNOWN_PROTOCOL)
170
171 // The following errors are no longer emitted, but are used in nginx without
172 // #ifdefs.
173 OPENSSL_DECLARE_ERROR_REASON(SSL, BLOCK_CIPHER_PAD_IS_WRONG)
174 OPENSSL_DECLARE_ERROR_REASON(SSL, NO_CIPHERS_SPECIFIED)
175
176 // Some error codes are special. Ensure the make_errors.go script never
177 // regresses this.
178 static_assert(SSL_R_TLSV1_ALERT_NO_RENEGOTIATION ==
179 SSL_AD_NO_RENEGOTIATION + SSL_AD_REASON_OFFSET,
180 "alert reason code mismatch");
181
182 // kMaxHandshakeSize is the maximum size, in bytes, of a handshake message.
183 static const size_t kMaxHandshakeSize = (1u << 24) - 1;
184
185 static CRYPTO_EX_DATA_CLASS g_ex_data_class_ssl =
186 CRYPTO_EX_DATA_CLASS_INIT_WITH_APP_DATA;
187 static CRYPTO_EX_DATA_CLASS g_ex_data_class_ssl_ctx =
188 CRYPTO_EX_DATA_CLASS_INIT_WITH_APP_DATA;
189
CBBFinishArray(CBB * cbb,Array<uint8_t> * out)190 bool CBBFinishArray(CBB *cbb, Array<uint8_t> *out) {
191 uint8_t *ptr;
192 size_t len;
193 if (!CBB_finish(cbb, &ptr, &len)) {
194 OPENSSL_PUT_ERROR(SSL, ERR_R_INTERNAL_ERROR);
195 return false;
196 }
197 out->Reset(ptr, len);
198 return true;
199 }
200
ssl_reset_error_state(SSL * ssl)201 void ssl_reset_error_state(SSL *ssl) {
202 // Functions which use |SSL_get_error| must reset I/O and error state on
203 // entry.
204 ssl->s3->rwstate = SSL_ERROR_NONE;
205 ERR_clear_error();
206 ERR_clear_system_error();
207 }
208
ssl_set_read_error(SSL * ssl)209 void ssl_set_read_error(SSL* ssl) {
210 ssl->s3->read_shutdown = ssl_shutdown_error;
211 ssl->s3->read_error.reset(ERR_save_state());
212 }
213
check_read_error(const SSL * ssl)214 static bool check_read_error(const SSL *ssl) {
215 if (ssl->s3->read_shutdown == ssl_shutdown_error) {
216 ERR_restore_state(ssl->s3->read_error.get());
217 return false;
218 }
219 return true;
220 }
221
ssl_can_write(const SSL * ssl)222 bool ssl_can_write(const SSL *ssl) {
223 return !SSL_in_init(ssl) || ssl->s3->hs->can_early_write;
224 }
225
ssl_can_read(const SSL * ssl)226 bool ssl_can_read(const SSL *ssl) {
227 return !SSL_in_init(ssl) || ssl->s3->hs->can_early_read;
228 }
229
ssl_open_handshake(SSL * ssl,size_t * out_consumed,uint8_t * out_alert,Span<uint8_t> in)230 ssl_open_record_t ssl_open_handshake(SSL *ssl, size_t *out_consumed,
231 uint8_t *out_alert, Span<uint8_t> in) {
232 *out_consumed = 0;
233 if (!check_read_error(ssl)) {
234 *out_alert = 0;
235 return ssl_open_record_error;
236 }
237 auto ret = ssl->method->open_handshake(ssl, out_consumed, out_alert, in);
238 if (ret == ssl_open_record_error) {
239 ssl_set_read_error(ssl);
240 }
241 return ret;
242 }
243
ssl_open_change_cipher_spec(SSL * ssl,size_t * out_consumed,uint8_t * out_alert,Span<uint8_t> in)244 ssl_open_record_t ssl_open_change_cipher_spec(SSL *ssl, size_t *out_consumed,
245 uint8_t *out_alert,
246 Span<uint8_t> in) {
247 *out_consumed = 0;
248 if (!check_read_error(ssl)) {
249 *out_alert = 0;
250 return ssl_open_record_error;
251 }
252 auto ret =
253 ssl->method->open_change_cipher_spec(ssl, out_consumed, out_alert, in);
254 if (ret == ssl_open_record_error) {
255 ssl_set_read_error(ssl);
256 }
257 return ret;
258 }
259
ssl_open_app_data(SSL * ssl,Span<uint8_t> * out,size_t * out_consumed,uint8_t * out_alert,Span<uint8_t> in)260 ssl_open_record_t ssl_open_app_data(SSL *ssl, Span<uint8_t> *out,
261 size_t *out_consumed, uint8_t *out_alert,
262 Span<uint8_t> in) {
263 *out_consumed = 0;
264 if (!check_read_error(ssl)) {
265 *out_alert = 0;
266 return ssl_open_record_error;
267 }
268 auto ret = ssl->method->open_app_data(ssl, out, out_consumed, out_alert, in);
269 if (ret == ssl_open_record_error) {
270 ssl_set_read_error(ssl);
271 }
272 return ret;
273 }
274
ssl_update_cache(SSL_HANDSHAKE * hs,int mode)275 void ssl_update_cache(SSL_HANDSHAKE *hs, int mode) {
276 SSL *const ssl = hs->ssl;
277 SSL_CTX *ctx = ssl->session_ctx.get();
278 // Never cache sessions with empty session IDs.
279 if (ssl->s3->established_session->session_id_length == 0 ||
280 ssl->s3->established_session->not_resumable ||
281 (ctx->session_cache_mode & mode) != mode) {
282 return;
283 }
284
285 // Clients never use the internal session cache.
286 int use_internal_cache = ssl->server && !(ctx->session_cache_mode &
287 SSL_SESS_CACHE_NO_INTERNAL_STORE);
288
289 // A client may see new sessions on abbreviated handshakes if the server
290 // decides to renew the ticket. Once the handshake is completed, it should be
291 // inserted into the cache.
292 if (ssl->s3->established_session.get() != ssl->session.get() ||
293 (!ssl->server && hs->ticket_expected)) {
294 if (use_internal_cache) {
295 SSL_CTX_add_session(ctx, ssl->s3->established_session.get());
296 }
297 if (ctx->new_session_cb != NULL) {
298 UniquePtr<SSL_SESSION> ref = UpRef(ssl->s3->established_session);
299 if (ctx->new_session_cb(ssl, ref.get())) {
300 // |new_session_cb|'s return value signals whether it took ownership.
301 ref.release();
302 }
303 }
304 }
305
306 if (use_internal_cache &&
307 !(ctx->session_cache_mode & SSL_SESS_CACHE_NO_AUTO_CLEAR)) {
308 // Automatically flush the internal session cache every 255 connections.
309 int flush_cache = 0;
310 CRYPTO_MUTEX_lock_write(&ctx->lock);
311 ctx->handshakes_since_cache_flush++;
312 if (ctx->handshakes_since_cache_flush >= 255) {
313 flush_cache = 1;
314 ctx->handshakes_since_cache_flush = 0;
315 }
316 CRYPTO_MUTEX_unlock_write(&ctx->lock);
317
318 if (flush_cache) {
319 struct OPENSSL_timeval now;
320 ssl_get_current_time(ssl, &now);
321 SSL_CTX_flush_sessions(ctx, now.tv_sec);
322 }
323 }
324 }
325
cbb_add_hex(CBB * cbb,Span<const uint8_t> in)326 static bool cbb_add_hex(CBB *cbb, Span<const uint8_t> in) {
327 static const char hextable[] = "0123456789abcdef";
328 uint8_t *out;
329
330 if (!CBB_add_space(cbb, &out, in.size() * 2)) {
331 return false;
332 }
333
334 for (uint8_t b : in) {
335 *(out++) = (uint8_t)hextable[b >> 4];
336 *(out++) = (uint8_t)hextable[b & 0xf];
337 }
338
339 return true;
340 }
341
ssl_log_secret(const SSL * ssl,const char * label,Span<const uint8_t> secret)342 bool ssl_log_secret(const SSL *ssl, const char *label,
343 Span<const uint8_t> secret) {
344 if (ssl->ctx->keylog_callback == NULL) {
345 return true;
346 }
347
348 ScopedCBB cbb;
349 Array<uint8_t> line;
350 if (!CBB_init(cbb.get(), strlen(label) + 1 + SSL3_RANDOM_SIZE * 2 + 1 +
351 secret.size() * 2 + 1) ||
352 !CBB_add_bytes(cbb.get(), reinterpret_cast<const uint8_t *>(label),
353 strlen(label)) ||
354 !CBB_add_u8(cbb.get(), ' ') ||
355 !cbb_add_hex(cbb.get(), ssl->s3->client_random) ||
356 !CBB_add_u8(cbb.get(), ' ') ||
357 !cbb_add_hex(cbb.get(), secret) ||
358 !CBB_add_u8(cbb.get(), 0 /* NUL */) ||
359 !CBBFinishArray(cbb.get(), &line)) {
360 return false;
361 }
362
363 ssl->ctx->keylog_callback(ssl, reinterpret_cast<const char *>(line.data()));
364 return true;
365 }
366
ssl_do_info_callback(const SSL * ssl,int type,int value)367 void ssl_do_info_callback(const SSL *ssl, int type, int value) {
368 void (*cb)(const SSL *ssl, int type, int value) = NULL;
369 if (ssl->info_callback != NULL) {
370 cb = ssl->info_callback;
371 } else if (ssl->ctx->info_callback != NULL) {
372 cb = ssl->ctx->info_callback;
373 }
374
375 if (cb != NULL) {
376 cb(ssl, type, value);
377 }
378 }
379
ssl_do_msg_callback(const SSL * ssl,int is_write,int content_type,Span<const uint8_t> in)380 void ssl_do_msg_callback(const SSL *ssl, int is_write, int content_type,
381 Span<const uint8_t> in) {
382 if (ssl->msg_callback == NULL) {
383 return;
384 }
385
386 // |version| is zero when calling for |SSL3_RT_HEADER| and |SSL2_VERSION| for
387 // a V2ClientHello.
388 int version;
389 switch (content_type) {
390 case 0:
391 // V2ClientHello
392 version = SSL2_VERSION;
393 break;
394 case SSL3_RT_HEADER:
395 version = 0;
396 break;
397 default:
398 version = SSL_version(ssl);
399 }
400
401 ssl->msg_callback(is_write, version, content_type, in.data(), in.size(),
402 const_cast<SSL *>(ssl), ssl->msg_callback_arg);
403 }
404
ssl_get_current_time(const SSL * ssl,struct OPENSSL_timeval * out_clock)405 void ssl_get_current_time(const SSL *ssl, struct OPENSSL_timeval *out_clock) {
406 // TODO(martinkr): Change callers to |ssl_ctx_get_current_time| and drop the
407 // |ssl| arg from |current_time_cb| if possible.
408 ssl_ctx_get_current_time(ssl->ctx.get(), out_clock);
409 }
410
ssl_ctx_get_current_time(const SSL_CTX * ctx,struct OPENSSL_timeval * out_clock)411 void ssl_ctx_get_current_time(const SSL_CTX *ctx,
412 struct OPENSSL_timeval *out_clock) {
413 if (ctx->current_time_cb != NULL) {
414 // TODO(davidben): Update current_time_cb to use OPENSSL_timeval. See
415 // https://crbug.com/boringssl/155.
416 struct timeval clock;
417 ctx->current_time_cb(nullptr /* ssl */, &clock);
418 if (clock.tv_sec < 0) {
419 assert(0);
420 out_clock->tv_sec = 0;
421 out_clock->tv_usec = 0;
422 } else {
423 out_clock->tv_sec = (uint64_t)clock.tv_sec;
424 out_clock->tv_usec = (uint32_t)clock.tv_usec;
425 }
426 return;
427 }
428
429 #if defined(BORINGSSL_UNSAFE_DETERMINISTIC_MODE)
430 out_clock->tv_sec = 1234;
431 out_clock->tv_usec = 1234;
432 #elif defined(OPENSSL_WINDOWS)
433 struct _timeb time;
434 _ftime(&time);
435 if (time.time < 0) {
436 assert(0);
437 out_clock->tv_sec = 0;
438 out_clock->tv_usec = 0;
439 } else {
440 out_clock->tv_sec = time.time;
441 out_clock->tv_usec = time.millitm * 1000;
442 }
443 #else
444 struct timeval clock;
445 gettimeofday(&clock, NULL);
446 if (clock.tv_sec < 0) {
447 assert(0);
448 out_clock->tv_sec = 0;
449 out_clock->tv_usec = 0;
450 } else {
451 out_clock->tv_sec = (uint64_t)clock.tv_sec;
452 out_clock->tv_usec = (uint32_t)clock.tv_usec;
453 }
454 #endif
455 }
456
SSL_CTX_set_handoff_mode(SSL_CTX * ctx,bool on)457 void SSL_CTX_set_handoff_mode(SSL_CTX *ctx, bool on) {
458 ctx->handoff = on;
459 }
460
ssl_can_renegotiate(const SSL * ssl)461 static bool ssl_can_renegotiate(const SSL *ssl) {
462 if (ssl->server || SSL_is_dtls(ssl)) {
463 return false;
464 }
465
466 if (ssl_protocol_version(ssl) >= TLS1_3_VERSION) {
467 return false;
468 }
469
470 // The config has already been shed.
471 if (!ssl->config) {
472 return false;
473 }
474
475 switch (ssl->renegotiate_mode) {
476 case ssl_renegotiate_ignore:
477 case ssl_renegotiate_never:
478 return false;
479
480 case ssl_renegotiate_freely:
481 case ssl_renegotiate_explicit:
482 return true;
483 case ssl_renegotiate_once:
484 return ssl->s3->total_renegotiations == 0;
485 }
486
487 assert(0);
488 return false;
489 }
490
ssl_maybe_shed_handshake_config(SSL * ssl)491 static void ssl_maybe_shed_handshake_config(SSL *ssl) {
492 if (ssl->s3->hs != nullptr ||
493 ssl->config == nullptr ||
494 !ssl->config->shed_handshake_config ||
495 ssl_can_renegotiate(ssl)) {
496 return;
497 }
498
499 ssl->config.reset();
500 }
501
SSL_set_handoff_mode(SSL * ssl,bool on)502 void SSL_set_handoff_mode(SSL *ssl, bool on) {
503 if (!ssl->config) {
504 return;
505 }
506 ssl->config->handoff = on;
507 }
508
SSL_get_traffic_secrets(const SSL * ssl,Span<const uint8_t> * out_read_traffic_secret,Span<const uint8_t> * out_write_traffic_secret)509 bool SSL_get_traffic_secrets(const SSL *ssl,
510 Span<const uint8_t> *out_read_traffic_secret,
511 Span<const uint8_t> *out_write_traffic_secret) {
512 if (SSL_version(ssl) < TLS1_3_VERSION) {
513 OPENSSL_PUT_ERROR(SSL, SSL_R_WRONG_SSL_VERSION);
514 return false;
515 }
516
517 if (!ssl->s3->initial_handshake_complete) {
518 OPENSSL_PUT_ERROR(SSL, SSL_R_HANDSHAKE_NOT_COMPLETE);
519 return false;
520 }
521
522 *out_read_traffic_secret = Span<const uint8_t>(
523 ssl->s3->read_traffic_secret, ssl->s3->read_traffic_secret_len);
524 *out_write_traffic_secret = Span<const uint8_t>(
525 ssl->s3->write_traffic_secret, ssl->s3->write_traffic_secret_len);
526
527 return true;
528 }
529
530 BSSL_NAMESPACE_END
531
532 using namespace bssl;
533
SSL_library_init(void)534 int SSL_library_init(void) {
535 CRYPTO_library_init();
536 return 1;
537 }
538
OPENSSL_init_ssl(uint64_t opts,const OPENSSL_INIT_SETTINGS * settings)539 int OPENSSL_init_ssl(uint64_t opts, const OPENSSL_INIT_SETTINGS *settings) {
540 CRYPTO_library_init();
541 return 1;
542 }
543
ssl_session_hash(const SSL_SESSION * sess)544 static uint32_t ssl_session_hash(const SSL_SESSION *sess) {
545 return ssl_hash_session_id(
546 MakeConstSpan(sess->session_id, sess->session_id_length));
547 }
548
ssl_session_cmp(const SSL_SESSION * a,const SSL_SESSION * b)549 static int ssl_session_cmp(const SSL_SESSION *a, const SSL_SESSION *b) {
550 if (a->session_id_length != b->session_id_length) {
551 return 1;
552 }
553
554 return OPENSSL_memcmp(a->session_id, b->session_id, a->session_id_length);
555 }
556
ssl_ctx_st(const SSL_METHOD * ssl_method)557 ssl_ctx_st::ssl_ctx_st(const SSL_METHOD *ssl_method)
558 : method(ssl_method->method),
559 x509_method(ssl_method->x509_method),
560 retain_only_sha256_of_client_certs(false),
561 quiet_shutdown(false),
562 ocsp_stapling_enabled(false),
563 signed_cert_timestamps_enabled(false),
564 channel_id_enabled(false),
565 grease_enabled(false),
566 allow_unknown_alpn_protos(false),
567 false_start_allowed_without_alpn(false),
568 ignore_tls13_downgrade(false),
569 handoff(false),
570 enable_early_data(false) {
571 CRYPTO_MUTEX_init(&lock);
572 CRYPTO_new_ex_data(&ex_data);
573 }
574
~ssl_ctx_st()575 ssl_ctx_st::~ssl_ctx_st() {
576 // Free the internal session cache. Note that this calls the caller-supplied
577 // remove callback, so we must do it before clearing ex_data. (See ticket
578 // [openssl.org #212].)
579 SSL_CTX_flush_sessions(this, 0);
580
581 CRYPTO_free_ex_data(&g_ex_data_class_ssl_ctx, this, &ex_data);
582
583 CRYPTO_MUTEX_cleanup(&lock);
584 lh_SSL_SESSION_free(sessions);
585 x509_method->ssl_ctx_free(this);
586 }
587
SSL_CTX_new(const SSL_METHOD * method)588 SSL_CTX *SSL_CTX_new(const SSL_METHOD *method) {
589 if (method == NULL) {
590 OPENSSL_PUT_ERROR(SSL, SSL_R_NULL_SSL_METHOD_PASSED);
591 return nullptr;
592 }
593
594 UniquePtr<SSL_CTX> ret = MakeUnique<SSL_CTX>(method);
595 if (!ret) {
596 return nullptr;
597 }
598
599 ret->cert = MakeUnique<CERT>(method->x509_method);
600 ret->sessions = lh_SSL_SESSION_new(ssl_session_hash, ssl_session_cmp);
601 ret->client_CA.reset(sk_CRYPTO_BUFFER_new_null());
602 if (ret->cert == nullptr ||
603 ret->sessions == nullptr ||
604 ret->client_CA == nullptr ||
605 !ret->x509_method->ssl_ctx_new(ret.get())) {
606 return nullptr;
607 }
608
609 if (!SSL_CTX_set_strict_cipher_list(ret.get(), SSL_DEFAULT_CIPHER_LIST) ||
610 // Lock the SSL_CTX to the specified version, for compatibility with
611 // legacy uses of SSL_METHOD.
612 !SSL_CTX_set_max_proto_version(ret.get(), method->version) ||
613 !SSL_CTX_set_min_proto_version(ret.get(), method->version)) {
614 OPENSSL_PUT_ERROR(SSL, ERR_R_INTERNAL_ERROR);
615 return nullptr;
616 }
617
618 return ret.release();
619 }
620
SSL_CTX_up_ref(SSL_CTX * ctx)621 int SSL_CTX_up_ref(SSL_CTX *ctx) {
622 CRYPTO_refcount_inc(&ctx->references);
623 return 1;
624 }
625
SSL_CTX_free(SSL_CTX * ctx)626 void SSL_CTX_free(SSL_CTX *ctx) {
627 if (ctx == NULL ||
628 !CRYPTO_refcount_dec_and_test_zero(&ctx->references)) {
629 return;
630 }
631
632 ctx->~ssl_ctx_st();
633 OPENSSL_free(ctx);
634 }
635
ssl_st(SSL_CTX * ctx_arg)636 ssl_st::ssl_st(SSL_CTX *ctx_arg)
637 : method(ctx_arg->method),
638 max_send_fragment(ctx_arg->max_send_fragment),
639 msg_callback(ctx_arg->msg_callback),
640 msg_callback_arg(ctx_arg->msg_callback_arg),
641 ctx(UpRef(ctx_arg)),
642 session_ctx(UpRef(ctx_arg)),
643 options(ctx->options),
644 mode(ctx->mode),
645 max_cert_list(ctx->max_cert_list),
646 server(false),
647 quiet_shutdown(ctx->quiet_shutdown),
648 enable_early_data(ctx->enable_early_data) {
649 CRYPTO_new_ex_data(&ex_data);
650 }
651
~ssl_st()652 ssl_st::~ssl_st() {
653 CRYPTO_free_ex_data(&g_ex_data_class_ssl, this, &ex_data);
654 // |config| refers to |this|, so we must release it earlier.
655 config.reset();
656 if (method != NULL) {
657 method->ssl_free(this);
658 }
659 }
660
SSL_new(SSL_CTX * ctx)661 SSL *SSL_new(SSL_CTX *ctx) {
662 if (ctx == nullptr) {
663 OPENSSL_PUT_ERROR(SSL, SSL_R_NULL_SSL_CTX);
664 return nullptr;
665 }
666
667 UniquePtr<SSL> ssl = MakeUnique<SSL>(ctx);
668 if (ssl == nullptr) {
669 return nullptr;
670 }
671
672 ssl->config = MakeUnique<SSL_CONFIG>(ssl.get());
673 if (ssl->config == nullptr) {
674 return nullptr;
675 }
676 ssl->config->conf_min_version = ctx->conf_min_version;
677 ssl->config->conf_max_version = ctx->conf_max_version;
678
679 ssl->config->cert = ssl_cert_dup(ctx->cert.get());
680 if (ssl->config->cert == nullptr) {
681 return nullptr;
682 }
683
684 ssl->config->verify_mode = ctx->verify_mode;
685 ssl->config->verify_callback = ctx->default_verify_callback;
686 ssl->config->custom_verify_callback = ctx->custom_verify_callback;
687 ssl->config->retain_only_sha256_of_client_certs =
688 ctx->retain_only_sha256_of_client_certs;
689
690 if (!ssl->config->supported_group_list.CopyFrom(ctx->supported_group_list) ||
691 !ssl->config->alpn_client_proto_list.CopyFrom(
692 ctx->alpn_client_proto_list) ||
693 !ssl->config->verify_sigalgs.CopyFrom(ctx->verify_sigalgs)) {
694 return nullptr;
695 }
696
697 if (ctx->psk_identity_hint) {
698 ssl->config->psk_identity_hint.reset(
699 OPENSSL_strdup(ctx->psk_identity_hint.get()));
700 if (ssl->config->psk_identity_hint == nullptr) {
701 return nullptr;
702 }
703 }
704 ssl->config->psk_client_callback = ctx->psk_client_callback;
705 ssl->config->psk_server_callback = ctx->psk_server_callback;
706
707 ssl->config->channel_id_enabled = ctx->channel_id_enabled;
708 ssl->config->channel_id_private = UpRef(ctx->channel_id_private);
709
710 ssl->config->signed_cert_timestamps_enabled =
711 ctx->signed_cert_timestamps_enabled;
712 ssl->config->ocsp_stapling_enabled = ctx->ocsp_stapling_enabled;
713 ssl->config->handoff = ctx->handoff;
714 ssl->config->ignore_tls13_downgrade = ctx->ignore_tls13_downgrade;
715 ssl->quic_method = ctx->quic_method;
716
717 if (!ssl->method->ssl_new(ssl.get()) ||
718 !ssl->ctx->x509_method->ssl_new(ssl->s3->hs.get())) {
719 return nullptr;
720 }
721
722 return ssl.release();
723 }
724
SSL_CONFIG(SSL * ssl_arg)725 SSL_CONFIG::SSL_CONFIG(SSL *ssl_arg)
726 : ssl(ssl_arg),
727 signed_cert_timestamps_enabled(false),
728 ocsp_stapling_enabled(false),
729 channel_id_enabled(false),
730 enforce_rsa_key_usage(false),
731 retain_only_sha256_of_client_certs(false),
732 handoff(false),
733 shed_handshake_config(false),
734 ignore_tls13_downgrade(false),
735 jdk11_workaround(false) {
736 assert(ssl);
737 }
738
~SSL_CONFIG()739 SSL_CONFIG::~SSL_CONFIG() {
740 if (ssl->ctx != nullptr) {
741 ssl->ctx->x509_method->ssl_config_free(this);
742 }
743 }
744
SSL_free(SSL * ssl)745 void SSL_free(SSL *ssl) {
746 Delete(ssl);
747 }
748
SSL_set_connect_state(SSL * ssl)749 void SSL_set_connect_state(SSL *ssl) {
750 ssl->server = false;
751 ssl->do_handshake = ssl_client_handshake;
752 }
753
SSL_set_accept_state(SSL * ssl)754 void SSL_set_accept_state(SSL *ssl) {
755 ssl->server = true;
756 ssl->do_handshake = ssl_server_handshake;
757 }
758
SSL_set0_rbio(SSL * ssl,BIO * rbio)759 void SSL_set0_rbio(SSL *ssl, BIO *rbio) {
760 ssl->rbio.reset(rbio);
761 }
762
SSL_set0_wbio(SSL * ssl,BIO * wbio)763 void SSL_set0_wbio(SSL *ssl, BIO *wbio) {
764 ssl->wbio.reset(wbio);
765 }
766
SSL_set_bio(SSL * ssl,BIO * rbio,BIO * wbio)767 void SSL_set_bio(SSL *ssl, BIO *rbio, BIO *wbio) {
768 // For historical reasons, this function has many different cases in ownership
769 // handling.
770
771 // If nothing has changed, do nothing
772 if (rbio == SSL_get_rbio(ssl) && wbio == SSL_get_wbio(ssl)) {
773 return;
774 }
775
776 // If the two arguments are equal, one fewer reference is granted than
777 // taken.
778 if (rbio != NULL && rbio == wbio) {
779 BIO_up_ref(rbio);
780 }
781
782 // If only the wbio is changed, adopt only one reference.
783 if (rbio == SSL_get_rbio(ssl)) {
784 SSL_set0_wbio(ssl, wbio);
785 return;
786 }
787
788 // There is an asymmetry here for historical reasons. If only the rbio is
789 // changed AND the rbio and wbio were originally different, then we only adopt
790 // one reference.
791 if (wbio == SSL_get_wbio(ssl) && SSL_get_rbio(ssl) != SSL_get_wbio(ssl)) {
792 SSL_set0_rbio(ssl, rbio);
793 return;
794 }
795
796 // Otherwise, adopt both references.
797 SSL_set0_rbio(ssl, rbio);
798 SSL_set0_wbio(ssl, wbio);
799 }
800
SSL_get_rbio(const SSL * ssl)801 BIO *SSL_get_rbio(const SSL *ssl) { return ssl->rbio.get(); }
802
SSL_get_wbio(const SSL * ssl)803 BIO *SSL_get_wbio(const SSL *ssl) { return ssl->wbio.get(); }
804
SSL_quic_max_handshake_flight_len(const SSL * ssl,enum ssl_encryption_level_t level)805 size_t SSL_quic_max_handshake_flight_len(const SSL *ssl,
806 enum ssl_encryption_level_t level) {
807 // Limits flights to 16K by default when there are no large
808 // (certificate-carrying) messages.
809 static const size_t kDefaultLimit = 16384;
810
811 switch (level) {
812 case ssl_encryption_initial:
813 return kDefaultLimit;
814 case ssl_encryption_early_data:
815 // QUIC does not send EndOfEarlyData.
816 return 0;
817 case ssl_encryption_handshake:
818 if (ssl->server) {
819 // Servers may receive Certificate message if configured to request
820 // client certificates.
821 if (!!(ssl->config->verify_mode & SSL_VERIFY_PEER) &&
822 ssl->max_cert_list > kDefaultLimit) {
823 return ssl->max_cert_list;
824 }
825 } else {
826 // Clients may receive both Certificate message and a CertificateRequest
827 // message.
828 if (2*ssl->max_cert_list > kDefaultLimit) {
829 return 2*ssl->max_cert_list;
830 }
831 }
832 return kDefaultLimit;
833 case ssl_encryption_application:
834 // Note there is not actually a bound on the number of NewSessionTickets
835 // one may send in a row. This level may need more involved flow
836 // control. See https://github.com/quicwg/base-drafts/issues/1834.
837 return kDefaultLimit;
838 }
839
840 return 0;
841 }
842
SSL_quic_read_level(const SSL * ssl)843 enum ssl_encryption_level_t SSL_quic_read_level(const SSL *ssl) {
844 return ssl->s3->read_level;
845 }
846
SSL_quic_write_level(const SSL * ssl)847 enum ssl_encryption_level_t SSL_quic_write_level(const SSL *ssl) {
848 return ssl->s3->write_level;
849 }
850
SSL_provide_quic_data(SSL * ssl,enum ssl_encryption_level_t level,const uint8_t * data,size_t len)851 int SSL_provide_quic_data(SSL *ssl, enum ssl_encryption_level_t level,
852 const uint8_t *data, size_t len) {
853 if (ssl->quic_method == nullptr) {
854 OPENSSL_PUT_ERROR(SSL, ERR_R_SHOULD_NOT_HAVE_BEEN_CALLED);
855 return 0;
856 }
857
858 if (level != ssl->s3->read_level) {
859 OPENSSL_PUT_ERROR(SSL, SSL_R_WRONG_ENCRYPTION_LEVEL_RECEIVED);
860 return 0;
861 }
862
863 size_t new_len = (ssl->s3->hs_buf ? ssl->s3->hs_buf->length : 0) + len;
864 if (new_len < len ||
865 new_len > SSL_quic_max_handshake_flight_len(ssl, level)) {
866 OPENSSL_PUT_ERROR(SSL, SSL_R_EXCESSIVE_MESSAGE_SIZE);
867 return 0;
868 }
869
870 return tls_append_handshake_data(ssl, MakeConstSpan(data, len));
871 }
872
SSL_do_handshake(SSL * ssl)873 int SSL_do_handshake(SSL *ssl) {
874 ssl_reset_error_state(ssl);
875
876 if (ssl->do_handshake == NULL) {
877 OPENSSL_PUT_ERROR(SSL, SSL_R_CONNECTION_TYPE_NOT_SET);
878 return -1;
879 }
880
881 if (!SSL_in_init(ssl)) {
882 return 1;
883 }
884
885 // Run the handshake.
886 SSL_HANDSHAKE *hs = ssl->s3->hs.get();
887
888 bool early_return = false;
889 int ret = ssl_run_handshake(hs, &early_return);
890 ssl_do_info_callback(
891 ssl, ssl->server ? SSL_CB_ACCEPT_EXIT : SSL_CB_CONNECT_EXIT, ret);
892 if (ret <= 0) {
893 return ret;
894 }
895
896 // Destroy the handshake object if the handshake has completely finished.
897 if (!early_return) {
898 ssl->s3->hs.reset();
899 ssl_maybe_shed_handshake_config(ssl);
900 }
901
902 return 1;
903 }
904
SSL_connect(SSL * ssl)905 int SSL_connect(SSL *ssl) {
906 if (ssl->do_handshake == NULL) {
907 // Not properly initialized yet
908 SSL_set_connect_state(ssl);
909 }
910
911 return SSL_do_handshake(ssl);
912 }
913
SSL_accept(SSL * ssl)914 int SSL_accept(SSL *ssl) {
915 if (ssl->do_handshake == NULL) {
916 // Not properly initialized yet
917 SSL_set_accept_state(ssl);
918 }
919
920 return SSL_do_handshake(ssl);
921 }
922
ssl_do_post_handshake(SSL * ssl,const SSLMessage & msg)923 static int ssl_do_post_handshake(SSL *ssl, const SSLMessage &msg) {
924 if (ssl_protocol_version(ssl) >= TLS1_3_VERSION) {
925 return tls13_post_handshake(ssl, msg);
926 }
927
928 // Check for renegotiation on the server before parsing to use the correct
929 // error. Renegotiation is triggered by a different message for servers.
930 if (ssl->server) {
931 OPENSSL_PUT_ERROR(SSL, SSL_R_NO_RENEGOTIATION);
932 ssl_send_alert(ssl, SSL3_AL_FATAL, SSL_AD_NO_RENEGOTIATION);
933 return 0;
934 }
935
936 if (msg.type != SSL3_MT_HELLO_REQUEST || CBS_len(&msg.body) != 0) {
937 ssl_send_alert(ssl, SSL3_AL_FATAL, SSL_AD_DECODE_ERROR);
938 OPENSSL_PUT_ERROR(SSL, SSL_R_BAD_HELLO_REQUEST);
939 return 0;
940 }
941
942 if (ssl->renegotiate_mode == ssl_renegotiate_ignore) {
943 return 1; // Ignore the HelloRequest.
944 }
945
946 ssl->s3->renegotiate_pending = true;
947 if (ssl->renegotiate_mode == ssl_renegotiate_explicit) {
948 return 1; // Handle it later.
949 }
950
951 if (!SSL_renegotiate(ssl)) {
952 ssl_send_alert(ssl, SSL3_AL_FATAL, SSL_AD_NO_RENEGOTIATION);
953 return 0;
954 }
955
956 return 1;
957 }
958
SSL_process_quic_post_handshake(SSL * ssl)959 int SSL_process_quic_post_handshake(SSL *ssl) {
960 ssl_reset_error_state(ssl);
961
962 if (SSL_in_init(ssl)) {
963 OPENSSL_PUT_ERROR(SSL, ERR_R_SHOULD_NOT_HAVE_BEEN_CALLED);
964 return 0;
965 }
966
967 // Replay post-handshake message errors.
968 if (!check_read_error(ssl)) {
969 return 0;
970 }
971
972 // Process any buffered post-handshake messages.
973 SSLMessage msg;
974 while (ssl->method->get_message(ssl, &msg)) {
975 // Handle the post-handshake message and try again.
976 if (!ssl_do_post_handshake(ssl, msg)) {
977 ssl_set_read_error(ssl);
978 return 0;
979 }
980 ssl->method->next_message(ssl);
981 }
982
983 return 1;
984 }
985
ssl_read_impl(SSL * ssl)986 static int ssl_read_impl(SSL *ssl) {
987 ssl_reset_error_state(ssl);
988
989 if (ssl->do_handshake == NULL) {
990 OPENSSL_PUT_ERROR(SSL, SSL_R_UNINITIALIZED);
991 return -1;
992 }
993
994 // Replay post-handshake message errors.
995 if (!check_read_error(ssl)) {
996 return -1;
997 }
998
999 while (ssl->s3->pending_app_data.empty()) {
1000 if (ssl->s3->renegotiate_pending) {
1001 ssl->s3->rwstate = SSL_ERROR_WANT_RENEGOTIATE;
1002 return -1;
1003 }
1004
1005 // Complete the current handshake, if any. False Start will cause
1006 // |SSL_do_handshake| to return mid-handshake, so this may require multiple
1007 // iterations.
1008 while (!ssl_can_read(ssl)) {
1009 int ret = SSL_do_handshake(ssl);
1010 if (ret < 0) {
1011 return ret;
1012 }
1013 if (ret == 0) {
1014 OPENSSL_PUT_ERROR(SSL, SSL_R_SSL_HANDSHAKE_FAILURE);
1015 return -1;
1016 }
1017 }
1018
1019 // Process any buffered post-handshake messages.
1020 SSLMessage msg;
1021 if (ssl->method->get_message(ssl, &msg)) {
1022 // If we received an interrupt in early read (EndOfEarlyData), loop again
1023 // for the handshake to process it.
1024 if (SSL_in_init(ssl)) {
1025 ssl->s3->hs->can_early_read = false;
1026 continue;
1027 }
1028
1029 // Handle the post-handshake message and try again.
1030 if (!ssl_do_post_handshake(ssl, msg)) {
1031 ssl_set_read_error(ssl);
1032 return -1;
1033 }
1034 ssl->method->next_message(ssl);
1035 continue; // Loop again. We may have begun a new handshake.
1036 }
1037
1038 uint8_t alert = SSL_AD_DECODE_ERROR;
1039 size_t consumed = 0;
1040 auto ret = ssl_open_app_data(ssl, &ssl->s3->pending_app_data, &consumed,
1041 &alert, ssl->s3->read_buffer.span());
1042 bool retry;
1043 int bio_ret = ssl_handle_open_record(ssl, &retry, ret, consumed, alert);
1044 if (bio_ret <= 0) {
1045 return bio_ret;
1046 }
1047 if (!retry) {
1048 assert(!ssl->s3->pending_app_data.empty());
1049 ssl->s3->key_update_count = 0;
1050 }
1051 }
1052
1053 return 1;
1054 }
1055
SSL_read(SSL * ssl,void * buf,int num)1056 int SSL_read(SSL *ssl, void *buf, int num) {
1057 int ret = SSL_peek(ssl, buf, num);
1058 if (ret <= 0) {
1059 return ret;
1060 }
1061 // TODO(davidben): In DTLS, should the rest of the record be discarded? DTLS
1062 // is not a stream. See https://crbug.com/boringssl/65.
1063 ssl->s3->pending_app_data =
1064 ssl->s3->pending_app_data.subspan(static_cast<size_t>(ret));
1065 if (ssl->s3->pending_app_data.empty()) {
1066 ssl->s3->read_buffer.DiscardConsumed();
1067 }
1068 return ret;
1069 }
1070
SSL_peek(SSL * ssl,void * buf,int num)1071 int SSL_peek(SSL *ssl, void *buf, int num) {
1072 if (ssl->quic_method != nullptr) {
1073 OPENSSL_PUT_ERROR(SSL, ERR_R_SHOULD_NOT_HAVE_BEEN_CALLED);
1074 return 0;
1075 }
1076
1077 int ret = ssl_read_impl(ssl);
1078 if (ret <= 0) {
1079 return ret;
1080 }
1081 if (num <= 0) {
1082 return num;
1083 }
1084 size_t todo =
1085 std::min(ssl->s3->pending_app_data.size(), static_cast<size_t>(num));
1086 OPENSSL_memcpy(buf, ssl->s3->pending_app_data.data(), todo);
1087 return static_cast<int>(todo);
1088 }
1089
SSL_write(SSL * ssl,const void * buf,int num)1090 int SSL_write(SSL *ssl, const void *buf, int num) {
1091 ssl_reset_error_state(ssl);
1092
1093 if (ssl->quic_method != nullptr) {
1094 OPENSSL_PUT_ERROR(SSL, ERR_R_SHOULD_NOT_HAVE_BEEN_CALLED);
1095 return 0;
1096 }
1097
1098 if (ssl->do_handshake == NULL) {
1099 OPENSSL_PUT_ERROR(SSL, SSL_R_UNINITIALIZED);
1100 return -1;
1101 }
1102
1103 if (ssl->s3->write_shutdown != ssl_shutdown_none) {
1104 OPENSSL_PUT_ERROR(SSL, SSL_R_PROTOCOL_IS_SHUTDOWN);
1105 return -1;
1106 }
1107
1108 int ret = 0;
1109 bool needs_handshake = false;
1110 do {
1111 // If necessary, complete the handshake implicitly.
1112 if (!ssl_can_write(ssl)) {
1113 ret = SSL_do_handshake(ssl);
1114 if (ret < 0) {
1115 return ret;
1116 }
1117 if (ret == 0) {
1118 OPENSSL_PUT_ERROR(SSL, SSL_R_SSL_HANDSHAKE_FAILURE);
1119 return -1;
1120 }
1121 }
1122
1123 ret = ssl->method->write_app_data(ssl, &needs_handshake,
1124 (const uint8_t *)buf, num);
1125 } while (needs_handshake);
1126 return ret;
1127 }
1128
SSL_key_update(SSL * ssl,int request_type)1129 int SSL_key_update(SSL *ssl, int request_type) {
1130 ssl_reset_error_state(ssl);
1131
1132 if (ssl->do_handshake == NULL) {
1133 OPENSSL_PUT_ERROR(SSL, SSL_R_UNINITIALIZED);
1134 return 0;
1135 }
1136
1137 if (ssl->ctx->quic_method != nullptr) {
1138 OPENSSL_PUT_ERROR(SSL, ERR_R_SHOULD_NOT_HAVE_BEEN_CALLED);
1139 return 0;
1140 }
1141
1142 if (!ssl->s3->initial_handshake_complete) {
1143 OPENSSL_PUT_ERROR(SSL, SSL_R_HANDSHAKE_NOT_COMPLETE);
1144 return 0;
1145 }
1146
1147 if (ssl_protocol_version(ssl) < TLS1_3_VERSION) {
1148 OPENSSL_PUT_ERROR(SSL, SSL_R_WRONG_SSL_VERSION);
1149 return 0;
1150 }
1151
1152 if (!ssl->s3->key_update_pending &&
1153 !tls13_add_key_update(ssl, request_type)) {
1154 return 0;
1155 }
1156
1157 return 1;
1158 }
1159
SSL_shutdown(SSL * ssl)1160 int SSL_shutdown(SSL *ssl) {
1161 ssl_reset_error_state(ssl);
1162
1163 if (ssl->do_handshake == NULL) {
1164 OPENSSL_PUT_ERROR(SSL, SSL_R_UNINITIALIZED);
1165 return -1;
1166 }
1167
1168 // If we are in the middle of a handshake, silently succeed. Consumers often
1169 // call this function before |SSL_free|, whether the handshake succeeded or
1170 // not. We assume the caller has already handled failed handshakes.
1171 if (SSL_in_init(ssl)) {
1172 return 1;
1173 }
1174
1175 if (ssl->quiet_shutdown) {
1176 // Do nothing if configured not to send a close_notify.
1177 ssl->s3->write_shutdown = ssl_shutdown_close_notify;
1178 ssl->s3->read_shutdown = ssl_shutdown_close_notify;
1179 return 1;
1180 }
1181
1182 // This function completes in two stages. It sends a close_notify and then it
1183 // waits for a close_notify to come in. Perform exactly one action and return
1184 // whether or not it succeeds.
1185
1186 if (ssl->s3->write_shutdown != ssl_shutdown_close_notify) {
1187 // Send a close_notify.
1188 if (ssl_send_alert_impl(ssl, SSL3_AL_WARNING, SSL_AD_CLOSE_NOTIFY) <= 0) {
1189 return -1;
1190 }
1191 } else if (ssl->s3->alert_dispatch) {
1192 // Finish sending the close_notify.
1193 if (ssl->method->dispatch_alert(ssl) <= 0) {
1194 return -1;
1195 }
1196 } else if (ssl->s3->read_shutdown != ssl_shutdown_close_notify) {
1197 if (SSL_is_dtls(ssl)) {
1198 // Bidirectional shutdown doesn't make sense for an unordered
1199 // transport. DTLS alerts also aren't delivered reliably, so we may even
1200 // time out because the peer never received our close_notify. Report to
1201 // the caller that the channel has fully shut down.
1202 if (ssl->s3->read_shutdown == ssl_shutdown_error) {
1203 ERR_restore_state(ssl->s3->read_error.get());
1204 return -1;
1205 }
1206 ssl->s3->read_shutdown = ssl_shutdown_close_notify;
1207 } else {
1208 // Process records until an error, close_notify, or application data.
1209 if (ssl_read_impl(ssl) > 0) {
1210 // We received some unexpected application data.
1211 OPENSSL_PUT_ERROR(SSL, SSL_R_APPLICATION_DATA_ON_SHUTDOWN);
1212 return -1;
1213 }
1214 if (ssl->s3->read_shutdown != ssl_shutdown_close_notify) {
1215 return -1;
1216 }
1217 }
1218 }
1219
1220 // Return 0 for unidirectional shutdown and 1 for bidirectional shutdown.
1221 return ssl->s3->read_shutdown == ssl_shutdown_close_notify;
1222 }
1223
SSL_send_fatal_alert(SSL * ssl,uint8_t alert)1224 int SSL_send_fatal_alert(SSL *ssl, uint8_t alert) {
1225 if (ssl->s3->alert_dispatch) {
1226 if (ssl->s3->send_alert[0] != SSL3_AL_FATAL ||
1227 ssl->s3->send_alert[1] != alert) {
1228 // We are already attempting to write a different alert.
1229 OPENSSL_PUT_ERROR(SSL, SSL_R_PROTOCOL_IS_SHUTDOWN);
1230 return -1;
1231 }
1232 return ssl->method->dispatch_alert(ssl);
1233 }
1234
1235 return ssl_send_alert_impl(ssl, SSL3_AL_FATAL, alert);
1236 }
1237
SSL_set_quic_transport_params(SSL * ssl,const uint8_t * params,size_t params_len)1238 int SSL_set_quic_transport_params(SSL *ssl, const uint8_t *params,
1239 size_t params_len) {
1240 return ssl->config && ssl->config->quic_transport_params.CopyFrom(
1241 MakeConstSpan(params, params_len));
1242 }
1243
SSL_get_peer_quic_transport_params(const SSL * ssl,const uint8_t ** out_params,size_t * out_params_len)1244 void SSL_get_peer_quic_transport_params(const SSL *ssl,
1245 const uint8_t **out_params,
1246 size_t *out_params_len) {
1247 *out_params = ssl->s3->peer_quic_transport_params.data();
1248 *out_params_len = ssl->s3->peer_quic_transport_params.size();
1249 }
1250
SSL_CTX_set_early_data_enabled(SSL_CTX * ctx,int enabled)1251 void SSL_CTX_set_early_data_enabled(SSL_CTX *ctx, int enabled) {
1252 ctx->enable_early_data = !!enabled;
1253 }
1254
SSL_set_early_data_enabled(SSL * ssl,int enabled)1255 void SSL_set_early_data_enabled(SSL *ssl, int enabled) {
1256 ssl->enable_early_data = !!enabled;
1257 }
1258
SSL_in_early_data(const SSL * ssl)1259 int SSL_in_early_data(const SSL *ssl) {
1260 if (ssl->s3->hs == NULL) {
1261 return 0;
1262 }
1263 return ssl->s3->hs->in_early_data;
1264 }
1265
SSL_early_data_accepted(const SSL * ssl)1266 int SSL_early_data_accepted(const SSL *ssl) {
1267 return ssl->s3->early_data_accepted;
1268 }
1269
SSL_reset_early_data_reject(SSL * ssl)1270 void SSL_reset_early_data_reject(SSL *ssl) {
1271 SSL_HANDSHAKE *hs = ssl->s3->hs.get();
1272 if (hs == NULL ||
1273 hs->wait != ssl_hs_early_data_rejected) {
1274 abort();
1275 }
1276
1277 hs->wait = ssl_hs_ok;
1278 hs->in_early_data = false;
1279 hs->early_session.reset();
1280
1281 // Discard any unfinished writes from the perspective of |SSL_write|'s
1282 // retry. The handshake will transparently flush out the pending record
1283 // (discarded by the server) to keep the framing correct.
1284 ssl->s3->wpend_pending = false;
1285 }
1286
SSL_get_early_data_reason(const SSL * ssl)1287 enum ssl_early_data_reason_t SSL_get_early_data_reason(const SSL *ssl) {
1288 return ssl->s3->early_data_reason;
1289 }
1290
bio_retry_reason_to_error(int reason)1291 static int bio_retry_reason_to_error(int reason) {
1292 switch (reason) {
1293 case BIO_RR_CONNECT:
1294 return SSL_ERROR_WANT_CONNECT;
1295 case BIO_RR_ACCEPT:
1296 return SSL_ERROR_WANT_ACCEPT;
1297 default:
1298 return SSL_ERROR_SYSCALL;
1299 }
1300 }
1301
SSL_get_error(const SSL * ssl,int ret_code)1302 int SSL_get_error(const SSL *ssl, int ret_code) {
1303 if (ret_code > 0) {
1304 return SSL_ERROR_NONE;
1305 }
1306
1307 // Make things return SSL_ERROR_SYSCALL when doing SSL_do_handshake etc,
1308 // where we do encode the error
1309 uint32_t err = ERR_peek_error();
1310 if (err != 0) {
1311 if (ERR_GET_LIB(err) == ERR_LIB_SYS) {
1312 return SSL_ERROR_SYSCALL;
1313 }
1314 return SSL_ERROR_SSL;
1315 }
1316
1317 if (ret_code == 0) {
1318 if (ssl->s3->read_shutdown == ssl_shutdown_close_notify) {
1319 return SSL_ERROR_ZERO_RETURN;
1320 }
1321 // An EOF was observed which violates the protocol, and the underlying
1322 // transport does not participate in the error queue. Bubble up to the
1323 // caller.
1324 return SSL_ERROR_SYSCALL;
1325 }
1326
1327 switch (ssl->s3->rwstate) {
1328 case SSL_ERROR_PENDING_SESSION:
1329 case SSL_ERROR_PENDING_CERTIFICATE:
1330 case SSL_ERROR_HANDOFF:
1331 case SSL_ERROR_HANDBACK:
1332 case SSL_ERROR_WANT_X509_LOOKUP:
1333 case SSL_ERROR_WANT_CHANNEL_ID_LOOKUP:
1334 case SSL_ERROR_WANT_PRIVATE_KEY_OPERATION:
1335 case SSL_ERROR_PENDING_TICKET:
1336 case SSL_ERROR_EARLY_DATA_REJECTED:
1337 case SSL_ERROR_WANT_CERTIFICATE_VERIFY:
1338 case SSL_ERROR_WANT_RENEGOTIATE:
1339 return ssl->s3->rwstate;
1340
1341 case SSL_ERROR_WANT_READ: {
1342 if (ssl->quic_method) {
1343 return SSL_ERROR_WANT_READ;
1344 }
1345 BIO *bio = SSL_get_rbio(ssl);
1346 if (BIO_should_read(bio)) {
1347 return SSL_ERROR_WANT_READ;
1348 }
1349
1350 if (BIO_should_write(bio)) {
1351 // TODO(davidben): OpenSSL historically checked for writes on the read
1352 // BIO. Can this be removed?
1353 return SSL_ERROR_WANT_WRITE;
1354 }
1355
1356 if (BIO_should_io_special(bio)) {
1357 return bio_retry_reason_to_error(BIO_get_retry_reason(bio));
1358 }
1359
1360 break;
1361 }
1362
1363 case SSL_ERROR_WANT_WRITE: {
1364 BIO *bio = SSL_get_wbio(ssl);
1365 if (BIO_should_write(bio)) {
1366 return SSL_ERROR_WANT_WRITE;
1367 }
1368
1369 if (BIO_should_read(bio)) {
1370 // TODO(davidben): OpenSSL historically checked for reads on the write
1371 // BIO. Can this be removed?
1372 return SSL_ERROR_WANT_READ;
1373 }
1374
1375 if (BIO_should_io_special(bio)) {
1376 return bio_retry_reason_to_error(BIO_get_retry_reason(bio));
1377 }
1378
1379 break;
1380 }
1381 }
1382
1383 return SSL_ERROR_SYSCALL;
1384 }
1385
SSL_error_description(int err)1386 const char *SSL_error_description(int err) {
1387 switch (err) {
1388 case SSL_ERROR_NONE:
1389 return "NONE";
1390 case SSL_ERROR_SSL:
1391 return "SSL";
1392 case SSL_ERROR_WANT_READ:
1393 return "WANT_READ";
1394 case SSL_ERROR_WANT_WRITE:
1395 return "WANT_WRITE";
1396 case SSL_ERROR_WANT_X509_LOOKUP:
1397 return "WANT_X509_LOOKUP";
1398 case SSL_ERROR_SYSCALL:
1399 return "SYSCALL";
1400 case SSL_ERROR_ZERO_RETURN:
1401 return "ZERO_RETURN";
1402 case SSL_ERROR_WANT_CONNECT:
1403 return "WANT_CONNECT";
1404 case SSL_ERROR_WANT_ACCEPT:
1405 return "WANT_ACCEPT";
1406 case SSL_ERROR_WANT_CHANNEL_ID_LOOKUP:
1407 return "WANT_CHANNEL_ID_LOOKUP";
1408 case SSL_ERROR_PENDING_SESSION:
1409 return "PENDING_SESSION";
1410 case SSL_ERROR_PENDING_CERTIFICATE:
1411 return "PENDING_CERTIFICATE";
1412 case SSL_ERROR_WANT_PRIVATE_KEY_OPERATION:
1413 return "WANT_PRIVATE_KEY_OPERATION";
1414 case SSL_ERROR_PENDING_TICKET:
1415 return "PENDING_TICKET";
1416 case SSL_ERROR_EARLY_DATA_REJECTED:
1417 return "EARLY_DATA_REJECTED";
1418 case SSL_ERROR_WANT_CERTIFICATE_VERIFY:
1419 return "WANT_CERTIFICATE_VERIFY";
1420 case SSL_ERROR_HANDOFF:
1421 return "HANDOFF";
1422 case SSL_ERROR_HANDBACK:
1423 return "HANDBACK";
1424 default:
1425 return nullptr;
1426 }
1427 }
1428
SSL_CTX_set_options(SSL_CTX * ctx,uint32_t options)1429 uint32_t SSL_CTX_set_options(SSL_CTX *ctx, uint32_t options) {
1430 ctx->options |= options;
1431 return ctx->options;
1432 }
1433
SSL_CTX_clear_options(SSL_CTX * ctx,uint32_t options)1434 uint32_t SSL_CTX_clear_options(SSL_CTX *ctx, uint32_t options) {
1435 ctx->options &= ~options;
1436 return ctx->options;
1437 }
1438
SSL_CTX_get_options(const SSL_CTX * ctx)1439 uint32_t SSL_CTX_get_options(const SSL_CTX *ctx) { return ctx->options; }
1440
SSL_set_options(SSL * ssl,uint32_t options)1441 uint32_t SSL_set_options(SSL *ssl, uint32_t options) {
1442 ssl->options |= options;
1443 return ssl->options;
1444 }
1445
SSL_clear_options(SSL * ssl,uint32_t options)1446 uint32_t SSL_clear_options(SSL *ssl, uint32_t options) {
1447 ssl->options &= ~options;
1448 return ssl->options;
1449 }
1450
SSL_get_options(const SSL * ssl)1451 uint32_t SSL_get_options(const SSL *ssl) { return ssl->options; }
1452
SSL_CTX_set_mode(SSL_CTX * ctx,uint32_t mode)1453 uint32_t SSL_CTX_set_mode(SSL_CTX *ctx, uint32_t mode) {
1454 ctx->mode |= mode;
1455 return ctx->mode;
1456 }
1457
SSL_CTX_clear_mode(SSL_CTX * ctx,uint32_t mode)1458 uint32_t SSL_CTX_clear_mode(SSL_CTX *ctx, uint32_t mode) {
1459 ctx->mode &= ~mode;
1460 return ctx->mode;
1461 }
1462
SSL_CTX_get_mode(const SSL_CTX * ctx)1463 uint32_t SSL_CTX_get_mode(const SSL_CTX *ctx) { return ctx->mode; }
1464
SSL_set_mode(SSL * ssl,uint32_t mode)1465 uint32_t SSL_set_mode(SSL *ssl, uint32_t mode) {
1466 ssl->mode |= mode;
1467 return ssl->mode;
1468 }
1469
SSL_clear_mode(SSL * ssl,uint32_t mode)1470 uint32_t SSL_clear_mode(SSL *ssl, uint32_t mode) {
1471 ssl->mode &= ~mode;
1472 return ssl->mode;
1473 }
1474
SSL_get_mode(const SSL * ssl)1475 uint32_t SSL_get_mode(const SSL *ssl) { return ssl->mode; }
1476
SSL_CTX_set0_buffer_pool(SSL_CTX * ctx,CRYPTO_BUFFER_POOL * pool)1477 void SSL_CTX_set0_buffer_pool(SSL_CTX *ctx, CRYPTO_BUFFER_POOL *pool) {
1478 ctx->pool = pool;
1479 }
1480
SSL_get_tls_unique(const SSL * ssl,uint8_t * out,size_t * out_len,size_t max_out)1481 int SSL_get_tls_unique(const SSL *ssl, uint8_t *out, size_t *out_len,
1482 size_t max_out) {
1483 *out_len = 0;
1484 OPENSSL_memset(out, 0, max_out);
1485
1486 // tls-unique is not defined for TLS 1.3.
1487 if (!ssl->s3->initial_handshake_complete ||
1488 ssl_protocol_version(ssl) >= TLS1_3_VERSION) {
1489 return 0;
1490 }
1491
1492 // The tls-unique value is the first Finished message in the handshake, which
1493 // is the client's in a full handshake and the server's for a resumption. See
1494 // https://tools.ietf.org/html/rfc5929#section-3.1.
1495 const uint8_t *finished = ssl->s3->previous_client_finished;
1496 size_t finished_len = ssl->s3->previous_client_finished_len;
1497 if (ssl->session != NULL) {
1498 // tls-unique is broken for resumed sessions unless EMS is used.
1499 if (!ssl->session->extended_master_secret) {
1500 return 0;
1501 }
1502 finished = ssl->s3->previous_server_finished;
1503 finished_len = ssl->s3->previous_server_finished_len;
1504 }
1505
1506 *out_len = finished_len;
1507 if (finished_len > max_out) {
1508 *out_len = max_out;
1509 }
1510
1511 OPENSSL_memcpy(out, finished, *out_len);
1512 return 1;
1513 }
1514
set_session_id_context(CERT * cert,const uint8_t * sid_ctx,size_t sid_ctx_len)1515 static int set_session_id_context(CERT *cert, const uint8_t *sid_ctx,
1516 size_t sid_ctx_len) {
1517 if (sid_ctx_len > sizeof(cert->sid_ctx)) {
1518 OPENSSL_PUT_ERROR(SSL, SSL_R_SSL_SESSION_ID_CONTEXT_TOO_LONG);
1519 return 0;
1520 }
1521
1522 static_assert(sizeof(cert->sid_ctx) < 256, "sid_ctx too large");
1523 cert->sid_ctx_length = (uint8_t)sid_ctx_len;
1524 OPENSSL_memcpy(cert->sid_ctx, sid_ctx, sid_ctx_len);
1525 return 1;
1526 }
1527
SSL_CTX_set_session_id_context(SSL_CTX * ctx,const uint8_t * sid_ctx,size_t sid_ctx_len)1528 int SSL_CTX_set_session_id_context(SSL_CTX *ctx, const uint8_t *sid_ctx,
1529 size_t sid_ctx_len) {
1530 return set_session_id_context(ctx->cert.get(), sid_ctx, sid_ctx_len);
1531 }
1532
SSL_set_session_id_context(SSL * ssl,const uint8_t * sid_ctx,size_t sid_ctx_len)1533 int SSL_set_session_id_context(SSL *ssl, const uint8_t *sid_ctx,
1534 size_t sid_ctx_len) {
1535 if (!ssl->config) {
1536 return 0;
1537 }
1538 return set_session_id_context(ssl->config->cert.get(), sid_ctx, sid_ctx_len);
1539 }
1540
SSL_get0_session_id_context(const SSL * ssl,size_t * out_len)1541 const uint8_t *SSL_get0_session_id_context(const SSL *ssl, size_t *out_len) {
1542 if (!ssl->config) {
1543 assert(ssl->config);
1544 *out_len = 0;
1545 return NULL;
1546 }
1547 *out_len = ssl->config->cert->sid_ctx_length;
1548 return ssl->config->cert->sid_ctx;
1549 }
1550
SSL_certs_clear(SSL * ssl)1551 void SSL_certs_clear(SSL *ssl) {
1552 if (!ssl->config) {
1553 return;
1554 }
1555 ssl_cert_clear_certs(ssl->config->cert.get());
1556 }
1557
SSL_get_fd(const SSL * ssl)1558 int SSL_get_fd(const SSL *ssl) { return SSL_get_rfd(ssl); }
1559
SSL_get_rfd(const SSL * ssl)1560 int SSL_get_rfd(const SSL *ssl) {
1561 int ret = -1;
1562 BIO *b = BIO_find_type(SSL_get_rbio(ssl), BIO_TYPE_DESCRIPTOR);
1563 if (b != NULL) {
1564 BIO_get_fd(b, &ret);
1565 }
1566 return ret;
1567 }
1568
SSL_get_wfd(const SSL * ssl)1569 int SSL_get_wfd(const SSL *ssl) {
1570 int ret = -1;
1571 BIO *b = BIO_find_type(SSL_get_wbio(ssl), BIO_TYPE_DESCRIPTOR);
1572 if (b != NULL) {
1573 BIO_get_fd(b, &ret);
1574 }
1575 return ret;
1576 }
1577
SSL_set_fd(SSL * ssl,int fd)1578 int SSL_set_fd(SSL *ssl, int fd) {
1579 BIO *bio = BIO_new(BIO_s_socket());
1580 if (bio == NULL) {
1581 OPENSSL_PUT_ERROR(SSL, ERR_R_BUF_LIB);
1582 return 0;
1583 }
1584 BIO_set_fd(bio, fd, BIO_NOCLOSE);
1585 SSL_set_bio(ssl, bio, bio);
1586 return 1;
1587 }
1588
SSL_set_wfd(SSL * ssl,int fd)1589 int SSL_set_wfd(SSL *ssl, int fd) {
1590 BIO *rbio = SSL_get_rbio(ssl);
1591 if (rbio == NULL || BIO_method_type(rbio) != BIO_TYPE_SOCKET ||
1592 BIO_get_fd(rbio, NULL) != fd) {
1593 BIO *bio = BIO_new(BIO_s_socket());
1594 if (bio == NULL) {
1595 OPENSSL_PUT_ERROR(SSL, ERR_R_BUF_LIB);
1596 return 0;
1597 }
1598 BIO_set_fd(bio, fd, BIO_NOCLOSE);
1599 SSL_set0_wbio(ssl, bio);
1600 } else {
1601 // Copy the rbio over to the wbio.
1602 BIO_up_ref(rbio);
1603 SSL_set0_wbio(ssl, rbio);
1604 }
1605
1606 return 1;
1607 }
1608
SSL_set_rfd(SSL * ssl,int fd)1609 int SSL_set_rfd(SSL *ssl, int fd) {
1610 BIO *wbio = SSL_get_wbio(ssl);
1611 if (wbio == NULL || BIO_method_type(wbio) != BIO_TYPE_SOCKET ||
1612 BIO_get_fd(wbio, NULL) != fd) {
1613 BIO *bio = BIO_new(BIO_s_socket());
1614 if (bio == NULL) {
1615 OPENSSL_PUT_ERROR(SSL, ERR_R_BUF_LIB);
1616 return 0;
1617 }
1618 BIO_set_fd(bio, fd, BIO_NOCLOSE);
1619 SSL_set0_rbio(ssl, bio);
1620 } else {
1621 // Copy the wbio over to the rbio.
1622 BIO_up_ref(wbio);
1623 SSL_set0_rbio(ssl, wbio);
1624 }
1625 return 1;
1626 }
1627
copy_finished(void * out,size_t out_len,const uint8_t * in,size_t in_len)1628 static size_t copy_finished(void *out, size_t out_len, const uint8_t *in,
1629 size_t in_len) {
1630 if (out_len > in_len) {
1631 out_len = in_len;
1632 }
1633 OPENSSL_memcpy(out, in, out_len);
1634 return in_len;
1635 }
1636
SSL_get_finished(const SSL * ssl,void * buf,size_t count)1637 size_t SSL_get_finished(const SSL *ssl, void *buf, size_t count) {
1638 if (!ssl->s3->initial_handshake_complete ||
1639 ssl_protocol_version(ssl) >= TLS1_3_VERSION) {
1640 return 0;
1641 }
1642
1643 if (ssl->server) {
1644 return copy_finished(buf, count, ssl->s3->previous_server_finished,
1645 ssl->s3->previous_server_finished_len);
1646 }
1647
1648 return copy_finished(buf, count, ssl->s3->previous_client_finished,
1649 ssl->s3->previous_client_finished_len);
1650 }
1651
SSL_get_peer_finished(const SSL * ssl,void * buf,size_t count)1652 size_t SSL_get_peer_finished(const SSL *ssl, void *buf, size_t count) {
1653 if (!ssl->s3->initial_handshake_complete ||
1654 ssl_protocol_version(ssl) >= TLS1_3_VERSION) {
1655 return 0;
1656 }
1657
1658 if (ssl->server) {
1659 return copy_finished(buf, count, ssl->s3->previous_client_finished,
1660 ssl->s3->previous_client_finished_len);
1661 }
1662
1663 return copy_finished(buf, count, ssl->s3->previous_server_finished,
1664 ssl->s3->previous_server_finished_len);
1665 }
1666
SSL_get_verify_mode(const SSL * ssl)1667 int SSL_get_verify_mode(const SSL *ssl) {
1668 if (!ssl->config) {
1669 assert(ssl->config);
1670 return -1;
1671 }
1672 return ssl->config->verify_mode;
1673 }
1674
SSL_get_extms_support(const SSL * ssl)1675 int SSL_get_extms_support(const SSL *ssl) {
1676 // TLS 1.3 does not require extended master secret and always reports as
1677 // supporting it.
1678 if (!ssl->s3->have_version) {
1679 return 0;
1680 }
1681 if (ssl_protocol_version(ssl) >= TLS1_3_VERSION) {
1682 return 1;
1683 }
1684
1685 // If the initial handshake completed, query the established session.
1686 if (ssl->s3->established_session != NULL) {
1687 return ssl->s3->established_session->extended_master_secret;
1688 }
1689
1690 // Otherwise, query the in-progress handshake.
1691 if (ssl->s3->hs != NULL) {
1692 return ssl->s3->hs->extended_master_secret;
1693 }
1694 assert(0);
1695 return 0;
1696 }
1697
SSL_CTX_get_read_ahead(const SSL_CTX * ctx)1698 int SSL_CTX_get_read_ahead(const SSL_CTX *ctx) { return 0; }
1699
SSL_get_read_ahead(const SSL * ssl)1700 int SSL_get_read_ahead(const SSL *ssl) { return 0; }
1701
SSL_CTX_set_read_ahead(SSL_CTX * ctx,int yes)1702 int SSL_CTX_set_read_ahead(SSL_CTX *ctx, int yes) { return 1; }
1703
SSL_set_read_ahead(SSL * ssl,int yes)1704 int SSL_set_read_ahead(SSL *ssl, int yes) { return 1; }
1705
SSL_pending(const SSL * ssl)1706 int SSL_pending(const SSL *ssl) {
1707 return static_cast<int>(ssl->s3->pending_app_data.size());
1708 }
1709
SSL_CTX_check_private_key(const SSL_CTX * ctx)1710 int SSL_CTX_check_private_key(const SSL_CTX *ctx) {
1711 return ssl_cert_check_private_key(ctx->cert.get(),
1712 ctx->cert->privatekey.get());
1713 }
1714
SSL_check_private_key(const SSL * ssl)1715 int SSL_check_private_key(const SSL *ssl) {
1716 if (!ssl->config) {
1717 return 0;
1718 }
1719 return ssl_cert_check_private_key(ssl->config->cert.get(),
1720 ssl->config->cert->privatekey.get());
1721 }
1722
SSL_get_default_timeout(const SSL * ssl)1723 long SSL_get_default_timeout(const SSL *ssl) {
1724 return SSL_DEFAULT_SESSION_TIMEOUT;
1725 }
1726
SSL_renegotiate(SSL * ssl)1727 int SSL_renegotiate(SSL *ssl) {
1728 // Caller-initiated renegotiation is not supported.
1729 if (!ssl->s3->renegotiate_pending) {
1730 OPENSSL_PUT_ERROR(SSL, ERR_R_SHOULD_NOT_HAVE_BEEN_CALLED);
1731 return 0;
1732 }
1733
1734 if (!ssl_can_renegotiate(ssl)) {
1735 OPENSSL_PUT_ERROR(SSL, SSL_R_NO_RENEGOTIATION);
1736 return 0;
1737 }
1738
1739 // Renegotiation is only supported at quiescent points in the application
1740 // protocol, namely in HTTPS, just before reading the HTTP response.
1741 // Require the record-layer be idle and avoid complexities of sending a
1742 // handshake record while an application_data record is being written.
1743 if (!ssl->s3->write_buffer.empty() ||
1744 ssl->s3->write_shutdown != ssl_shutdown_none) {
1745 OPENSSL_PUT_ERROR(SSL, SSL_R_NO_RENEGOTIATION);
1746 return 0;
1747 }
1748
1749 // Begin a new handshake.
1750 if (ssl->s3->hs != nullptr) {
1751 OPENSSL_PUT_ERROR(SSL, ERR_R_INTERNAL_ERROR);
1752 return 0;
1753 }
1754 ssl->s3->hs = ssl_handshake_new(ssl);
1755 if (ssl->s3->hs == nullptr) {
1756 return 0;
1757 }
1758
1759 ssl->s3->renegotiate_pending = false;
1760 ssl->s3->total_renegotiations++;
1761 return 1;
1762 }
1763
SSL_renegotiate_pending(SSL * ssl)1764 int SSL_renegotiate_pending(SSL *ssl) {
1765 return SSL_in_init(ssl) && ssl->s3->initial_handshake_complete;
1766 }
1767
SSL_total_renegotiations(const SSL * ssl)1768 int SSL_total_renegotiations(const SSL *ssl) {
1769 return ssl->s3->total_renegotiations;
1770 }
1771
SSL_CTX_get_max_cert_list(const SSL_CTX * ctx)1772 size_t SSL_CTX_get_max_cert_list(const SSL_CTX *ctx) {
1773 return ctx->max_cert_list;
1774 }
1775
SSL_CTX_set_max_cert_list(SSL_CTX * ctx,size_t max_cert_list)1776 void SSL_CTX_set_max_cert_list(SSL_CTX *ctx, size_t max_cert_list) {
1777 if (max_cert_list > kMaxHandshakeSize) {
1778 max_cert_list = kMaxHandshakeSize;
1779 }
1780 ctx->max_cert_list = (uint32_t)max_cert_list;
1781 }
1782
SSL_get_max_cert_list(const SSL * ssl)1783 size_t SSL_get_max_cert_list(const SSL *ssl) {
1784 return ssl->max_cert_list;
1785 }
1786
SSL_set_max_cert_list(SSL * ssl,size_t max_cert_list)1787 void SSL_set_max_cert_list(SSL *ssl, size_t max_cert_list) {
1788 if (max_cert_list > kMaxHandshakeSize) {
1789 max_cert_list = kMaxHandshakeSize;
1790 }
1791 ssl->max_cert_list = (uint32_t)max_cert_list;
1792 }
1793
SSL_CTX_set_max_send_fragment(SSL_CTX * ctx,size_t max_send_fragment)1794 int SSL_CTX_set_max_send_fragment(SSL_CTX *ctx, size_t max_send_fragment) {
1795 if (max_send_fragment < 512) {
1796 max_send_fragment = 512;
1797 }
1798 if (max_send_fragment > SSL3_RT_MAX_PLAIN_LENGTH) {
1799 max_send_fragment = SSL3_RT_MAX_PLAIN_LENGTH;
1800 }
1801 ctx->max_send_fragment = (uint16_t)max_send_fragment;
1802
1803 return 1;
1804 }
1805
SSL_set_max_send_fragment(SSL * ssl,size_t max_send_fragment)1806 int SSL_set_max_send_fragment(SSL *ssl, size_t max_send_fragment) {
1807 if (max_send_fragment < 512) {
1808 max_send_fragment = 512;
1809 }
1810 if (max_send_fragment > SSL3_RT_MAX_PLAIN_LENGTH) {
1811 max_send_fragment = SSL3_RT_MAX_PLAIN_LENGTH;
1812 }
1813 ssl->max_send_fragment = (uint16_t)max_send_fragment;
1814
1815 return 1;
1816 }
1817
SSL_set_mtu(SSL * ssl,unsigned mtu)1818 int SSL_set_mtu(SSL *ssl, unsigned mtu) {
1819 if (!SSL_is_dtls(ssl) || mtu < dtls1_min_mtu()) {
1820 return 0;
1821 }
1822 ssl->d1->mtu = mtu;
1823 return 1;
1824 }
1825
SSL_get_secure_renegotiation_support(const SSL * ssl)1826 int SSL_get_secure_renegotiation_support(const SSL *ssl) {
1827 if (!ssl->s3->have_version) {
1828 return 0;
1829 }
1830 return ssl_protocol_version(ssl) >= TLS1_3_VERSION ||
1831 ssl->s3->send_connection_binding;
1832 }
1833
SSL_CTX_sess_number(const SSL_CTX * ctx)1834 size_t SSL_CTX_sess_number(const SSL_CTX *ctx) {
1835 MutexReadLock lock(const_cast<CRYPTO_MUTEX *>(&ctx->lock));
1836 return lh_SSL_SESSION_num_items(ctx->sessions);
1837 }
1838
SSL_CTX_sess_set_cache_size(SSL_CTX * ctx,unsigned long size)1839 unsigned long SSL_CTX_sess_set_cache_size(SSL_CTX *ctx, unsigned long size) {
1840 unsigned long ret = ctx->session_cache_size;
1841 ctx->session_cache_size = size;
1842 return ret;
1843 }
1844
SSL_CTX_sess_get_cache_size(const SSL_CTX * ctx)1845 unsigned long SSL_CTX_sess_get_cache_size(const SSL_CTX *ctx) {
1846 return ctx->session_cache_size;
1847 }
1848
SSL_CTX_set_session_cache_mode(SSL_CTX * ctx,int mode)1849 int SSL_CTX_set_session_cache_mode(SSL_CTX *ctx, int mode) {
1850 int ret = ctx->session_cache_mode;
1851 ctx->session_cache_mode = mode;
1852 return ret;
1853 }
1854
SSL_CTX_get_session_cache_mode(const SSL_CTX * ctx)1855 int SSL_CTX_get_session_cache_mode(const SSL_CTX *ctx) {
1856 return ctx->session_cache_mode;
1857 }
1858
1859
SSL_CTX_get_tlsext_ticket_keys(SSL_CTX * ctx,void * out,size_t len)1860 int SSL_CTX_get_tlsext_ticket_keys(SSL_CTX *ctx, void *out, size_t len) {
1861 if (out == NULL) {
1862 return 48;
1863 }
1864 if (len != 48) {
1865 OPENSSL_PUT_ERROR(SSL, SSL_R_INVALID_TICKET_KEYS_LENGTH);
1866 return 0;
1867 }
1868
1869 // The default ticket keys are initialized lazily. Trigger a key
1870 // rotation to initialize them.
1871 if (!ssl_ctx_rotate_ticket_encryption_key(ctx)) {
1872 return 0;
1873 }
1874
1875 uint8_t *out_bytes = reinterpret_cast<uint8_t *>(out);
1876 MutexReadLock lock(&ctx->lock);
1877 OPENSSL_memcpy(out_bytes, ctx->ticket_key_current->name, 16);
1878 OPENSSL_memcpy(out_bytes + 16, ctx->ticket_key_current->hmac_key, 16);
1879 OPENSSL_memcpy(out_bytes + 32, ctx->ticket_key_current->aes_key, 16);
1880 return 1;
1881 }
1882
SSL_CTX_set_tlsext_ticket_keys(SSL_CTX * ctx,const void * in,size_t len)1883 int SSL_CTX_set_tlsext_ticket_keys(SSL_CTX *ctx, const void *in, size_t len) {
1884 if (in == NULL) {
1885 return 48;
1886 }
1887 if (len != 48) {
1888 OPENSSL_PUT_ERROR(SSL, SSL_R_INVALID_TICKET_KEYS_LENGTH);
1889 return 0;
1890 }
1891 auto key = MakeUnique<TicketKey>();
1892 if (!key) {
1893 return 0;
1894 }
1895 const uint8_t *in_bytes = reinterpret_cast<const uint8_t *>(in);
1896 OPENSSL_memcpy(key->name, in_bytes, 16);
1897 OPENSSL_memcpy(key->hmac_key, in_bytes + 16, 16);
1898 OPENSSL_memcpy(key->aes_key, in_bytes + 32, 16);
1899 // Disable automatic key rotation for manually-configured keys. This is now
1900 // the caller's responsibility.
1901 key->next_rotation_tv_sec = 0;
1902 ctx->ticket_key_current = std::move(key);
1903 ctx->ticket_key_prev.reset();
1904 return 1;
1905 }
1906
SSL_CTX_set_tlsext_ticket_key_cb(SSL_CTX * ctx,int (* callback)(SSL * ssl,uint8_t * key_name,uint8_t * iv,EVP_CIPHER_CTX * ctx,HMAC_CTX * hmac_ctx,int encrypt))1907 int SSL_CTX_set_tlsext_ticket_key_cb(
1908 SSL_CTX *ctx, int (*callback)(SSL *ssl, uint8_t *key_name, uint8_t *iv,
1909 EVP_CIPHER_CTX *ctx, HMAC_CTX *hmac_ctx,
1910 int encrypt)) {
1911 ctx->ticket_key_cb = callback;
1912 return 1;
1913 }
1914
SSL_CTX_set1_curves(SSL_CTX * ctx,const int * curves,size_t curves_len)1915 int SSL_CTX_set1_curves(SSL_CTX *ctx, const int *curves, size_t curves_len) {
1916 return tls1_set_curves(&ctx->supported_group_list,
1917 MakeConstSpan(curves, curves_len));
1918 }
1919
SSL_set1_curves(SSL * ssl,const int * curves,size_t curves_len)1920 int SSL_set1_curves(SSL *ssl, const int *curves, size_t curves_len) {
1921 if (!ssl->config) {
1922 return 0;
1923 }
1924 return tls1_set_curves(&ssl->config->supported_group_list,
1925 MakeConstSpan(curves, curves_len));
1926 }
1927
SSL_CTX_set1_curves_list(SSL_CTX * ctx,const char * curves)1928 int SSL_CTX_set1_curves_list(SSL_CTX *ctx, const char *curves) {
1929 return tls1_set_curves_list(&ctx->supported_group_list, curves);
1930 }
1931
SSL_set1_curves_list(SSL * ssl,const char * curves)1932 int SSL_set1_curves_list(SSL *ssl, const char *curves) {
1933 if (!ssl->config) {
1934 return 0;
1935 }
1936 return tls1_set_curves_list(&ssl->config->supported_group_list, curves);
1937 }
1938
SSL_get_curve_id(const SSL * ssl)1939 uint16_t SSL_get_curve_id(const SSL *ssl) {
1940 // TODO(davidben): This checks the wrong session if there is a renegotiation
1941 // in progress.
1942 SSL_SESSION *session = SSL_get_session(ssl);
1943 if (session == NULL) {
1944 return 0;
1945 }
1946
1947 return session->group_id;
1948 }
1949
SSL_CTX_set_tmp_dh(SSL_CTX * ctx,const DH * dh)1950 int SSL_CTX_set_tmp_dh(SSL_CTX *ctx, const DH *dh) {
1951 return 1;
1952 }
1953
SSL_set_tmp_dh(SSL * ssl,const DH * dh)1954 int SSL_set_tmp_dh(SSL *ssl, const DH *dh) {
1955 return 1;
1956 }
1957
STACK_OF(SSL_CIPHER)1958 STACK_OF(SSL_CIPHER) *SSL_CTX_get_ciphers(const SSL_CTX *ctx) {
1959 return ctx->cipher_list->ciphers.get();
1960 }
1961
SSL_CTX_cipher_in_group(const SSL_CTX * ctx,size_t i)1962 int SSL_CTX_cipher_in_group(const SSL_CTX *ctx, size_t i) {
1963 if (i >= sk_SSL_CIPHER_num(ctx->cipher_list->ciphers.get())) {
1964 return 0;
1965 }
1966 return ctx->cipher_list->in_group_flags[i];
1967 }
1968
STACK_OF(SSL_CIPHER)1969 STACK_OF(SSL_CIPHER) *SSL_get_ciphers(const SSL *ssl) {
1970 if (ssl == NULL) {
1971 return NULL;
1972 }
1973 if (ssl->config == NULL) {
1974 assert(ssl->config);
1975 return NULL;
1976 }
1977
1978 return ssl->config->cipher_list ? ssl->config->cipher_list->ciphers.get()
1979 : ssl->ctx->cipher_list->ciphers.get();
1980 }
1981
SSL_get_cipher_list(const SSL * ssl,int n)1982 const char *SSL_get_cipher_list(const SSL *ssl, int n) {
1983 if (ssl == NULL) {
1984 return NULL;
1985 }
1986
1987 STACK_OF(SSL_CIPHER) *sk = SSL_get_ciphers(ssl);
1988 if (sk == NULL || n < 0 || (size_t)n >= sk_SSL_CIPHER_num(sk)) {
1989 return NULL;
1990 }
1991
1992 const SSL_CIPHER *c = sk_SSL_CIPHER_value(sk, n);
1993 if (c == NULL) {
1994 return NULL;
1995 }
1996
1997 return c->name;
1998 }
1999
SSL_CTX_set_cipher_list(SSL_CTX * ctx,const char * str)2000 int SSL_CTX_set_cipher_list(SSL_CTX *ctx, const char *str) {
2001 return ssl_create_cipher_list(&ctx->cipher_list, str, false /* not strict */);
2002 }
2003
SSL_CTX_set_strict_cipher_list(SSL_CTX * ctx,const char * str)2004 int SSL_CTX_set_strict_cipher_list(SSL_CTX *ctx, const char *str) {
2005 return ssl_create_cipher_list(&ctx->cipher_list, str, true /* strict */);
2006 }
2007
SSL_set_cipher_list(SSL * ssl,const char * str)2008 int SSL_set_cipher_list(SSL *ssl, const char *str) {
2009 if (!ssl->config) {
2010 return 0;
2011 }
2012 return ssl_create_cipher_list(&ssl->config->cipher_list, str,
2013 false /* not strict */);
2014 }
2015
SSL_set_strict_cipher_list(SSL * ssl,const char * str)2016 int SSL_set_strict_cipher_list(SSL *ssl, const char *str) {
2017 if (!ssl->config) {
2018 return 0;
2019 }
2020 return ssl_create_cipher_list(&ssl->config->cipher_list, str,
2021 true /* strict */);
2022 }
2023
SSL_get_servername(const SSL * ssl,const int type)2024 const char *SSL_get_servername(const SSL *ssl, const int type) {
2025 if (type != TLSEXT_NAMETYPE_host_name) {
2026 return NULL;
2027 }
2028
2029 // Historically, |SSL_get_servername| was also the configuration getter
2030 // corresponding to |SSL_set_tlsext_host_name|.
2031 if (ssl->hostname != nullptr) {
2032 return ssl->hostname.get();
2033 }
2034
2035 return ssl->s3->hostname.get();
2036 }
2037
SSL_get_servername_type(const SSL * ssl)2038 int SSL_get_servername_type(const SSL *ssl) {
2039 if (SSL_get_servername(ssl, TLSEXT_NAMETYPE_host_name) == NULL) {
2040 return -1;
2041 }
2042 return TLSEXT_NAMETYPE_host_name;
2043 }
2044
SSL_CTX_set_custom_verify(SSL_CTX * ctx,int mode,enum ssl_verify_result_t (* callback)(SSL * ssl,uint8_t * out_alert))2045 void SSL_CTX_set_custom_verify(
2046 SSL_CTX *ctx, int mode,
2047 enum ssl_verify_result_t (*callback)(SSL *ssl, uint8_t *out_alert)) {
2048 ctx->verify_mode = mode;
2049 ctx->custom_verify_callback = callback;
2050 }
2051
SSL_set_custom_verify(SSL * ssl,int mode,enum ssl_verify_result_t (* callback)(SSL * ssl,uint8_t * out_alert))2052 void SSL_set_custom_verify(
2053 SSL *ssl, int mode,
2054 enum ssl_verify_result_t (*callback)(SSL *ssl, uint8_t *out_alert)) {
2055 if (!ssl->config) {
2056 return;
2057 }
2058 ssl->config->verify_mode = mode;
2059 ssl->config->custom_verify_callback = callback;
2060 }
2061
SSL_CTX_enable_signed_cert_timestamps(SSL_CTX * ctx)2062 void SSL_CTX_enable_signed_cert_timestamps(SSL_CTX *ctx) {
2063 ctx->signed_cert_timestamps_enabled = true;
2064 }
2065
SSL_enable_signed_cert_timestamps(SSL * ssl)2066 void SSL_enable_signed_cert_timestamps(SSL *ssl) {
2067 if (!ssl->config) {
2068 return;
2069 }
2070 ssl->config->signed_cert_timestamps_enabled = true;
2071 }
2072
SSL_CTX_enable_ocsp_stapling(SSL_CTX * ctx)2073 void SSL_CTX_enable_ocsp_stapling(SSL_CTX *ctx) {
2074 ctx->ocsp_stapling_enabled = true;
2075 }
2076
SSL_enable_ocsp_stapling(SSL * ssl)2077 void SSL_enable_ocsp_stapling(SSL *ssl) {
2078 if (!ssl->config) {
2079 return;
2080 }
2081 ssl->config->ocsp_stapling_enabled = true;
2082 }
2083
SSL_get0_signed_cert_timestamp_list(const SSL * ssl,const uint8_t ** out,size_t * out_len)2084 void SSL_get0_signed_cert_timestamp_list(const SSL *ssl, const uint8_t **out,
2085 size_t *out_len) {
2086 SSL_SESSION *session = SSL_get_session(ssl);
2087 if (ssl->server || !session || !session->signed_cert_timestamp_list) {
2088 *out_len = 0;
2089 *out = NULL;
2090 return;
2091 }
2092
2093 *out = CRYPTO_BUFFER_data(session->signed_cert_timestamp_list.get());
2094 *out_len = CRYPTO_BUFFER_len(session->signed_cert_timestamp_list.get());
2095 }
2096
SSL_get0_ocsp_response(const SSL * ssl,const uint8_t ** out,size_t * out_len)2097 void SSL_get0_ocsp_response(const SSL *ssl, const uint8_t **out,
2098 size_t *out_len) {
2099 SSL_SESSION *session = SSL_get_session(ssl);
2100 if (ssl->server || !session || !session->ocsp_response) {
2101 *out_len = 0;
2102 *out = NULL;
2103 return;
2104 }
2105
2106 *out = CRYPTO_BUFFER_data(session->ocsp_response.get());
2107 *out_len = CRYPTO_BUFFER_len(session->ocsp_response.get());
2108 }
2109
SSL_set_tlsext_host_name(SSL * ssl,const char * name)2110 int SSL_set_tlsext_host_name(SSL *ssl, const char *name) {
2111 ssl->hostname.reset();
2112 if (name == nullptr) {
2113 return 1;
2114 }
2115
2116 size_t len = strlen(name);
2117 if (len == 0 || len > TLSEXT_MAXLEN_host_name) {
2118 OPENSSL_PUT_ERROR(SSL, SSL_R_SSL3_EXT_INVALID_SERVERNAME);
2119 return 0;
2120 }
2121 ssl->hostname.reset(OPENSSL_strdup(name));
2122 if (ssl->hostname == nullptr) {
2123 OPENSSL_PUT_ERROR(SSL, ERR_R_MALLOC_FAILURE);
2124 return 0;
2125 }
2126 return 1;
2127 }
2128
SSL_CTX_set_tlsext_servername_callback(SSL_CTX * ctx,int (* callback)(SSL * ssl,int * out_alert,void * arg))2129 int SSL_CTX_set_tlsext_servername_callback(
2130 SSL_CTX *ctx, int (*callback)(SSL *ssl, int *out_alert, void *arg)) {
2131 ctx->servername_callback = callback;
2132 return 1;
2133 }
2134
SSL_CTX_set_tlsext_servername_arg(SSL_CTX * ctx,void * arg)2135 int SSL_CTX_set_tlsext_servername_arg(SSL_CTX *ctx, void *arg) {
2136 ctx->servername_arg = arg;
2137 return 1;
2138 }
2139
SSL_select_next_proto(uint8_t ** out,uint8_t * out_len,const uint8_t * peer,unsigned peer_len,const uint8_t * supported,unsigned supported_len)2140 int SSL_select_next_proto(uint8_t **out, uint8_t *out_len, const uint8_t *peer,
2141 unsigned peer_len, const uint8_t *supported,
2142 unsigned supported_len) {
2143 const uint8_t *result;
2144 int status;
2145
2146 // For each protocol in peer preference order, see if we support it.
2147 for (unsigned i = 0; i < peer_len;) {
2148 for (unsigned j = 0; j < supported_len;) {
2149 if (peer[i] == supported[j] &&
2150 OPENSSL_memcmp(&peer[i + 1], &supported[j + 1], peer[i]) == 0) {
2151 // We found a match
2152 result = &peer[i];
2153 status = OPENSSL_NPN_NEGOTIATED;
2154 goto found;
2155 }
2156 j += supported[j];
2157 j++;
2158 }
2159 i += peer[i];
2160 i++;
2161 }
2162
2163 // There's no overlap between our protocols and the peer's list.
2164 result = supported;
2165 status = OPENSSL_NPN_NO_OVERLAP;
2166
2167 found:
2168 *out = (uint8_t *)result + 1;
2169 *out_len = result[0];
2170 return status;
2171 }
2172
SSL_get0_next_proto_negotiated(const SSL * ssl,const uint8_t ** out_data,unsigned * out_len)2173 void SSL_get0_next_proto_negotiated(const SSL *ssl, const uint8_t **out_data,
2174 unsigned *out_len) {
2175 *out_data = ssl->s3->next_proto_negotiated.data();
2176 *out_len = ssl->s3->next_proto_negotiated.size();
2177 }
2178
SSL_CTX_set_next_protos_advertised_cb(SSL_CTX * ctx,int (* cb)(SSL * ssl,const uint8_t ** out,unsigned * out_len,void * arg),void * arg)2179 void SSL_CTX_set_next_protos_advertised_cb(
2180 SSL_CTX *ctx,
2181 int (*cb)(SSL *ssl, const uint8_t **out, unsigned *out_len, void *arg),
2182 void *arg) {
2183 ctx->next_protos_advertised_cb = cb;
2184 ctx->next_protos_advertised_cb_arg = arg;
2185 }
2186
SSL_CTX_set_next_proto_select_cb(SSL_CTX * ctx,int (* cb)(SSL * ssl,uint8_t ** out,uint8_t * out_len,const uint8_t * in,unsigned in_len,void * arg),void * arg)2187 void SSL_CTX_set_next_proto_select_cb(
2188 SSL_CTX *ctx, int (*cb)(SSL *ssl, uint8_t **out, uint8_t *out_len,
2189 const uint8_t *in, unsigned in_len, void *arg),
2190 void *arg) {
2191 ctx->next_proto_select_cb = cb;
2192 ctx->next_proto_select_cb_arg = arg;
2193 }
2194
SSL_CTX_set_alpn_protos(SSL_CTX * ctx,const uint8_t * protos,unsigned protos_len)2195 int SSL_CTX_set_alpn_protos(SSL_CTX *ctx, const uint8_t *protos,
2196 unsigned protos_len) {
2197 // Note this function's calling convention is backwards.
2198 return ctx->alpn_client_proto_list.CopyFrom(MakeConstSpan(protos, protos_len))
2199 ? 0
2200 : 1;
2201 }
2202
SSL_set_alpn_protos(SSL * ssl,const uint8_t * protos,unsigned protos_len)2203 int SSL_set_alpn_protos(SSL *ssl, const uint8_t *protos, unsigned protos_len) {
2204 // Note this function's calling convention is backwards.
2205 if (!ssl->config) {
2206 return 1;
2207 }
2208 return ssl->config->alpn_client_proto_list.CopyFrom(
2209 MakeConstSpan(protos, protos_len))
2210 ? 0
2211 : 1;
2212 }
2213
SSL_CTX_set_alpn_select_cb(SSL_CTX * ctx,int (* cb)(SSL * ssl,const uint8_t ** out,uint8_t * out_len,const uint8_t * in,unsigned in_len,void * arg),void * arg)2214 void SSL_CTX_set_alpn_select_cb(SSL_CTX *ctx,
2215 int (*cb)(SSL *ssl, const uint8_t **out,
2216 uint8_t *out_len, const uint8_t *in,
2217 unsigned in_len, void *arg),
2218 void *arg) {
2219 ctx->alpn_select_cb = cb;
2220 ctx->alpn_select_cb_arg = arg;
2221 }
2222
SSL_get0_alpn_selected(const SSL * ssl,const uint8_t ** out_data,unsigned * out_len)2223 void SSL_get0_alpn_selected(const SSL *ssl, const uint8_t **out_data,
2224 unsigned *out_len) {
2225 if (SSL_in_early_data(ssl) && !ssl->server) {
2226 *out_data = ssl->s3->hs->early_session->early_alpn.data();
2227 *out_len = ssl->s3->hs->early_session->early_alpn.size();
2228 } else {
2229 *out_data = ssl->s3->alpn_selected.data();
2230 *out_len = ssl->s3->alpn_selected.size();
2231 }
2232 }
2233
SSL_CTX_set_allow_unknown_alpn_protos(SSL_CTX * ctx,int enabled)2234 void SSL_CTX_set_allow_unknown_alpn_protos(SSL_CTX *ctx, int enabled) {
2235 ctx->allow_unknown_alpn_protos = !!enabled;
2236 }
2237
SSL_CTX_add_cert_compression_alg(SSL_CTX * ctx,uint16_t alg_id,ssl_cert_compression_func_t compress,ssl_cert_decompression_func_t decompress)2238 int SSL_CTX_add_cert_compression_alg(SSL_CTX *ctx, uint16_t alg_id,
2239 ssl_cert_compression_func_t compress,
2240 ssl_cert_decompression_func_t decompress) {
2241 assert(compress != nullptr || decompress != nullptr);
2242
2243 for (const auto &alg : ctx->cert_compression_algs) {
2244 if (alg.alg_id == alg_id) {
2245 return 0;
2246 }
2247 }
2248
2249 CertCompressionAlg alg;
2250 alg.alg_id = alg_id;
2251 alg.compress = compress;
2252 alg.decompress = decompress;
2253 return ctx->cert_compression_algs.Push(alg);
2254 }
2255
SSL_CTX_set_tls_channel_id_enabled(SSL_CTX * ctx,int enabled)2256 void SSL_CTX_set_tls_channel_id_enabled(SSL_CTX *ctx, int enabled) {
2257 ctx->channel_id_enabled = !!enabled;
2258 }
2259
SSL_CTX_enable_tls_channel_id(SSL_CTX * ctx)2260 int SSL_CTX_enable_tls_channel_id(SSL_CTX *ctx) {
2261 SSL_CTX_set_tls_channel_id_enabled(ctx, 1);
2262 return 1;
2263 }
2264
SSL_set_tls_channel_id_enabled(SSL * ssl,int enabled)2265 void SSL_set_tls_channel_id_enabled(SSL *ssl, int enabled) {
2266 if (!ssl->config) {
2267 return;
2268 }
2269 ssl->config->channel_id_enabled = !!enabled;
2270 }
2271
SSL_enable_tls_channel_id(SSL * ssl)2272 int SSL_enable_tls_channel_id(SSL *ssl) {
2273 SSL_set_tls_channel_id_enabled(ssl, 1);
2274 return 1;
2275 }
2276
is_p256_key(EVP_PKEY * private_key)2277 static int is_p256_key(EVP_PKEY *private_key) {
2278 const EC_KEY *ec_key = EVP_PKEY_get0_EC_KEY(private_key);
2279 return ec_key != NULL &&
2280 EC_GROUP_get_curve_name(EC_KEY_get0_group(ec_key)) ==
2281 NID_X9_62_prime256v1;
2282 }
2283
SSL_CTX_set1_tls_channel_id(SSL_CTX * ctx,EVP_PKEY * private_key)2284 int SSL_CTX_set1_tls_channel_id(SSL_CTX *ctx, EVP_PKEY *private_key) {
2285 if (!is_p256_key(private_key)) {
2286 OPENSSL_PUT_ERROR(SSL, SSL_R_CHANNEL_ID_NOT_P256);
2287 return 0;
2288 }
2289
2290 ctx->channel_id_private = UpRef(private_key);
2291 ctx->channel_id_enabled = true;
2292
2293 return 1;
2294 }
2295
SSL_set1_tls_channel_id(SSL * ssl,EVP_PKEY * private_key)2296 int SSL_set1_tls_channel_id(SSL *ssl, EVP_PKEY *private_key) {
2297 if (!ssl->config) {
2298 return 0;
2299 }
2300 if (!is_p256_key(private_key)) {
2301 OPENSSL_PUT_ERROR(SSL, SSL_R_CHANNEL_ID_NOT_P256);
2302 return 0;
2303 }
2304
2305 ssl->config->channel_id_private = UpRef(private_key);
2306 ssl->config->channel_id_enabled = true;
2307
2308 return 1;
2309 }
2310
SSL_get_tls_channel_id(SSL * ssl,uint8_t * out,size_t max_out)2311 size_t SSL_get_tls_channel_id(SSL *ssl, uint8_t *out, size_t max_out) {
2312 if (!ssl->s3->channel_id_valid) {
2313 return 0;
2314 }
2315 OPENSSL_memcpy(out, ssl->s3->channel_id, (max_out < 64) ? max_out : 64);
2316 return 64;
2317 }
2318
SSL_set_token_binding_params(SSL * ssl,const uint8_t * params,size_t len)2319 int SSL_set_token_binding_params(SSL *ssl, const uint8_t *params, size_t len) {
2320 if (!ssl->config) {
2321 return 0;
2322 }
2323 if (len > 256) {
2324 OPENSSL_PUT_ERROR(SSL, ERR_R_OVERFLOW);
2325 return 0;
2326 }
2327 return ssl->config->token_binding_params.CopyFrom(MakeConstSpan(params, len));
2328 }
2329
SSL_is_token_binding_negotiated(const SSL * ssl)2330 int SSL_is_token_binding_negotiated(const SSL *ssl) {
2331 return ssl->s3->token_binding_negotiated;
2332 }
2333
SSL_get_negotiated_token_binding_param(const SSL * ssl)2334 uint8_t SSL_get_negotiated_token_binding_param(const SSL *ssl) {
2335 return ssl->s3->negotiated_token_binding_param;
2336 }
2337
SSL_get0_certificate_types(const SSL * ssl,const uint8_t ** out_types)2338 size_t SSL_get0_certificate_types(const SSL *ssl, const uint8_t **out_types) {
2339 Span<const uint8_t> types;
2340 if (!ssl->server && ssl->s3->hs != nullptr) {
2341 types = ssl->s3->hs->certificate_types;
2342 }
2343 *out_types = types.data();
2344 return types.size();
2345 }
2346
SSL_get0_peer_verify_algorithms(const SSL * ssl,const uint16_t ** out_sigalgs)2347 size_t SSL_get0_peer_verify_algorithms(const SSL *ssl,
2348 const uint16_t **out_sigalgs) {
2349 Span<const uint16_t> sigalgs;
2350 if (ssl->s3->hs != nullptr) {
2351 sigalgs = ssl->s3->hs->peer_sigalgs;
2352 }
2353 *out_sigalgs = sigalgs.data();
2354 return sigalgs.size();
2355 }
2356
SSL_get_privatekey(const SSL * ssl)2357 EVP_PKEY *SSL_get_privatekey(const SSL *ssl) {
2358 if (!ssl->config) {
2359 assert(ssl->config);
2360 return NULL;
2361 }
2362 if (ssl->config->cert != NULL) {
2363 return ssl->config->cert->privatekey.get();
2364 }
2365
2366 return NULL;
2367 }
2368
SSL_CTX_get0_privatekey(const SSL_CTX * ctx)2369 EVP_PKEY *SSL_CTX_get0_privatekey(const SSL_CTX *ctx) {
2370 if (ctx->cert != NULL) {
2371 return ctx->cert->privatekey.get();
2372 }
2373
2374 return NULL;
2375 }
2376
SSL_get_current_cipher(const SSL * ssl)2377 const SSL_CIPHER *SSL_get_current_cipher(const SSL *ssl) {
2378 const SSL_SESSION *session = SSL_get_session(ssl);
2379 return session == nullptr ? nullptr : session->cipher;
2380 }
2381
SSL_session_reused(const SSL * ssl)2382 int SSL_session_reused(const SSL *ssl) {
2383 return ssl->s3->session_reused || SSL_in_early_data(ssl);
2384 }
2385
SSL_get_current_compression(SSL * ssl)2386 const COMP_METHOD *SSL_get_current_compression(SSL *ssl) { return NULL; }
2387
SSL_get_current_expansion(SSL * ssl)2388 const COMP_METHOD *SSL_get_current_expansion(SSL *ssl) { return NULL; }
2389
SSL_get_server_tmp_key(SSL * ssl,EVP_PKEY ** out_key)2390 int SSL_get_server_tmp_key(SSL *ssl, EVP_PKEY **out_key) { return 0; }
2391
SSL_CTX_set_quiet_shutdown(SSL_CTX * ctx,int mode)2392 void SSL_CTX_set_quiet_shutdown(SSL_CTX *ctx, int mode) {
2393 ctx->quiet_shutdown = (mode != 0);
2394 }
2395
SSL_CTX_get_quiet_shutdown(const SSL_CTX * ctx)2396 int SSL_CTX_get_quiet_shutdown(const SSL_CTX *ctx) {
2397 return ctx->quiet_shutdown;
2398 }
2399
SSL_set_quiet_shutdown(SSL * ssl,int mode)2400 void SSL_set_quiet_shutdown(SSL *ssl, int mode) {
2401 ssl->quiet_shutdown = (mode != 0);
2402 }
2403
SSL_get_quiet_shutdown(const SSL * ssl)2404 int SSL_get_quiet_shutdown(const SSL *ssl) { return ssl->quiet_shutdown; }
2405
SSL_set_shutdown(SSL * ssl,int mode)2406 void SSL_set_shutdown(SSL *ssl, int mode) {
2407 // It is an error to clear any bits that have already been set. (We can't try
2408 // to get a second close_notify or send two.)
2409 assert((SSL_get_shutdown(ssl) & mode) == SSL_get_shutdown(ssl));
2410
2411 if (mode & SSL_RECEIVED_SHUTDOWN &&
2412 ssl->s3->read_shutdown == ssl_shutdown_none) {
2413 ssl->s3->read_shutdown = ssl_shutdown_close_notify;
2414 }
2415
2416 if (mode & SSL_SENT_SHUTDOWN &&
2417 ssl->s3->write_shutdown == ssl_shutdown_none) {
2418 ssl->s3->write_shutdown = ssl_shutdown_close_notify;
2419 }
2420 }
2421
SSL_get_shutdown(const SSL * ssl)2422 int SSL_get_shutdown(const SSL *ssl) {
2423 int ret = 0;
2424 if (ssl->s3->read_shutdown != ssl_shutdown_none) {
2425 // Historically, OpenSSL set |SSL_RECEIVED_SHUTDOWN| on both close_notify
2426 // and fatal alert.
2427 ret |= SSL_RECEIVED_SHUTDOWN;
2428 }
2429 if (ssl->s3->write_shutdown == ssl_shutdown_close_notify) {
2430 // Historically, OpenSSL set |SSL_SENT_SHUTDOWN| on only close_notify.
2431 ret |= SSL_SENT_SHUTDOWN;
2432 }
2433 return ret;
2434 }
2435
SSL_get_SSL_CTX(const SSL * ssl)2436 SSL_CTX *SSL_get_SSL_CTX(const SSL *ssl) { return ssl->ctx.get(); }
2437
SSL_set_SSL_CTX(SSL * ssl,SSL_CTX * ctx)2438 SSL_CTX *SSL_set_SSL_CTX(SSL *ssl, SSL_CTX *ctx) {
2439 if (!ssl->config) {
2440 return NULL;
2441 }
2442 if (ssl->ctx.get() == ctx) {
2443 return ssl->ctx.get();
2444 }
2445
2446 // One cannot change the X.509 callbacks during a connection.
2447 if (ssl->ctx->x509_method != ctx->x509_method) {
2448 assert(0);
2449 return NULL;
2450 }
2451
2452 UniquePtr<CERT> new_cert = ssl_cert_dup(ctx->cert.get());
2453 if (!new_cert) {
2454 return nullptr;
2455 }
2456
2457 ssl->config->cert = std::move(new_cert);
2458 ssl->ctx = UpRef(ctx);
2459 ssl->enable_early_data = ssl->ctx->enable_early_data;
2460
2461 return ssl->ctx.get();
2462 }
2463
SSL_set_info_callback(SSL * ssl,void (* cb)(const SSL * ssl,int type,int value))2464 void SSL_set_info_callback(SSL *ssl,
2465 void (*cb)(const SSL *ssl, int type, int value)) {
2466 ssl->info_callback = cb;
2467 }
2468
SSL_get_info_callback(const SSL * ssl)2469 void (*SSL_get_info_callback(const SSL *ssl))(const SSL *ssl, int type,
2470 int value) {
2471 return ssl->info_callback;
2472 }
2473
SSL_state(const SSL * ssl)2474 int SSL_state(const SSL *ssl) {
2475 return SSL_in_init(ssl) ? SSL_ST_INIT : SSL_ST_OK;
2476 }
2477
SSL_set_state(SSL * ssl,int state)2478 void SSL_set_state(SSL *ssl, int state) { }
2479
SSL_get_shared_ciphers(const SSL * ssl,char * buf,int len)2480 char *SSL_get_shared_ciphers(const SSL *ssl, char *buf, int len) {
2481 if (len <= 0) {
2482 return NULL;
2483 }
2484 buf[0] = '\0';
2485 return buf;
2486 }
2487
SSL_get_shared_sigalgs(SSL * ssl,int idx,int * psign,int * phash,int * psignandhash,uint8_t * rsig,uint8_t * rhash)2488 int SSL_get_shared_sigalgs(SSL *ssl, int idx, int *psign, int *phash,
2489 int *psignandhash, uint8_t *rsig, uint8_t *rhash) {
2490 return 0;
2491 }
2492
SSL_CTX_set_quic_method(SSL_CTX * ctx,const SSL_QUIC_METHOD * quic_method)2493 int SSL_CTX_set_quic_method(SSL_CTX *ctx, const SSL_QUIC_METHOD *quic_method) {
2494 if (ctx->method->is_dtls) {
2495 return 0;
2496 }
2497 ctx->quic_method = quic_method;
2498 return 1;
2499 }
2500
SSL_set_quic_method(SSL * ssl,const SSL_QUIC_METHOD * quic_method)2501 int SSL_set_quic_method(SSL *ssl, const SSL_QUIC_METHOD *quic_method) {
2502 if (ssl->method->is_dtls) {
2503 return 0;
2504 }
2505 ssl->quic_method = quic_method;
2506 return 1;
2507 }
2508
SSL_get_ex_new_index(long argl,void * argp,CRYPTO_EX_unused * unused,CRYPTO_EX_dup * dup_unused,CRYPTO_EX_free * free_func)2509 int SSL_get_ex_new_index(long argl, void *argp, CRYPTO_EX_unused *unused,
2510 CRYPTO_EX_dup *dup_unused, CRYPTO_EX_free *free_func) {
2511 int index;
2512 if (!CRYPTO_get_ex_new_index(&g_ex_data_class_ssl, &index, argl, argp,
2513 free_func)) {
2514 return -1;
2515 }
2516 return index;
2517 }
2518
SSL_set_ex_data(SSL * ssl,int idx,void * data)2519 int SSL_set_ex_data(SSL *ssl, int idx, void *data) {
2520 return CRYPTO_set_ex_data(&ssl->ex_data, idx, data);
2521 }
2522
SSL_get_ex_data(const SSL * ssl,int idx)2523 void *SSL_get_ex_data(const SSL *ssl, int idx) {
2524 return CRYPTO_get_ex_data(&ssl->ex_data, idx);
2525 }
2526
SSL_CTX_get_ex_new_index(long argl,void * argp,CRYPTO_EX_unused * unused,CRYPTO_EX_dup * dup_unused,CRYPTO_EX_free * free_func)2527 int SSL_CTX_get_ex_new_index(long argl, void *argp, CRYPTO_EX_unused *unused,
2528 CRYPTO_EX_dup *dup_unused,
2529 CRYPTO_EX_free *free_func) {
2530 int index;
2531 if (!CRYPTO_get_ex_new_index(&g_ex_data_class_ssl_ctx, &index, argl, argp,
2532 free_func)) {
2533 return -1;
2534 }
2535 return index;
2536 }
2537
SSL_CTX_set_ex_data(SSL_CTX * ctx,int idx,void * data)2538 int SSL_CTX_set_ex_data(SSL_CTX *ctx, int idx, void *data) {
2539 return CRYPTO_set_ex_data(&ctx->ex_data, idx, data);
2540 }
2541
SSL_CTX_get_ex_data(const SSL_CTX * ctx,int idx)2542 void *SSL_CTX_get_ex_data(const SSL_CTX *ctx, int idx) {
2543 return CRYPTO_get_ex_data(&ctx->ex_data, idx);
2544 }
2545
SSL_want(const SSL * ssl)2546 int SSL_want(const SSL *ssl) { return ssl->s3->rwstate; }
2547
SSL_CTX_set_tmp_rsa_callback(SSL_CTX * ctx,RSA * (* cb)(SSL * ssl,int is_export,int keylength))2548 void SSL_CTX_set_tmp_rsa_callback(SSL_CTX *ctx,
2549 RSA *(*cb)(SSL *ssl, int is_export,
2550 int keylength)) {}
2551
SSL_set_tmp_rsa_callback(SSL * ssl,RSA * (* cb)(SSL * ssl,int is_export,int keylength))2552 void SSL_set_tmp_rsa_callback(SSL *ssl, RSA *(*cb)(SSL *ssl, int is_export,
2553 int keylength)) {}
2554
SSL_CTX_set_tmp_dh_callback(SSL_CTX * ctx,DH * (* cb)(SSL * ssl,int is_export,int keylength))2555 void SSL_CTX_set_tmp_dh_callback(SSL_CTX *ctx,
2556 DH *(*cb)(SSL *ssl, int is_export,
2557 int keylength)) {}
2558
SSL_set_tmp_dh_callback(SSL * ssl,DH * (* cb)(SSL * ssl,int is_export,int keylength))2559 void SSL_set_tmp_dh_callback(SSL *ssl, DH *(*cb)(SSL *ssl, int is_export,
2560 int keylength)) {}
2561
use_psk_identity_hint(UniquePtr<char> * out,const char * identity_hint)2562 static int use_psk_identity_hint(UniquePtr<char> *out,
2563 const char *identity_hint) {
2564 if (identity_hint != NULL && strlen(identity_hint) > PSK_MAX_IDENTITY_LEN) {
2565 OPENSSL_PUT_ERROR(SSL, SSL_R_DATA_LENGTH_TOO_LONG);
2566 return 0;
2567 }
2568
2569 // Clear currently configured hint, if any.
2570 out->reset();
2571
2572 // Treat the empty hint as not supplying one. Plain PSK makes it possible to
2573 // send either no hint (omit ServerKeyExchange) or an empty hint, while
2574 // ECDHE_PSK can only spell empty hint. Having different capabilities is odd,
2575 // so we interpret empty and missing as identical.
2576 if (identity_hint != NULL && identity_hint[0] != '\0') {
2577 out->reset(OPENSSL_strdup(identity_hint));
2578 if (*out == nullptr) {
2579 return 0;
2580 }
2581 }
2582
2583 return 1;
2584 }
2585
SSL_CTX_use_psk_identity_hint(SSL_CTX * ctx,const char * identity_hint)2586 int SSL_CTX_use_psk_identity_hint(SSL_CTX *ctx, const char *identity_hint) {
2587 return use_psk_identity_hint(&ctx->psk_identity_hint, identity_hint);
2588 }
2589
SSL_use_psk_identity_hint(SSL * ssl,const char * identity_hint)2590 int SSL_use_psk_identity_hint(SSL *ssl, const char *identity_hint) {
2591 if (!ssl->config) {
2592 return 0;
2593 }
2594 return use_psk_identity_hint(&ssl->config->psk_identity_hint, identity_hint);
2595 }
2596
SSL_get_psk_identity_hint(const SSL * ssl)2597 const char *SSL_get_psk_identity_hint(const SSL *ssl) {
2598 if (ssl == NULL) {
2599 return NULL;
2600 }
2601 if (ssl->config == NULL) {
2602 assert(ssl->config);
2603 return NULL;
2604 }
2605 return ssl->config->psk_identity_hint.get();
2606 }
2607
SSL_get_psk_identity(const SSL * ssl)2608 const char *SSL_get_psk_identity(const SSL *ssl) {
2609 if (ssl == NULL) {
2610 return NULL;
2611 }
2612 SSL_SESSION *session = SSL_get_session(ssl);
2613 if (session == NULL) {
2614 return NULL;
2615 }
2616 return session->psk_identity.get();
2617 }
2618
SSL_set_psk_client_callback(SSL * ssl,unsigned (* cb)(SSL * ssl,const char * hint,char * identity,unsigned max_identity_len,uint8_t * psk,unsigned max_psk_len))2619 void SSL_set_psk_client_callback(
2620 SSL *ssl, unsigned (*cb)(SSL *ssl, const char *hint, char *identity,
2621 unsigned max_identity_len, uint8_t *psk,
2622 unsigned max_psk_len)) {
2623 if (!ssl->config) {
2624 return;
2625 }
2626 ssl->config->psk_client_callback = cb;
2627 }
2628
SSL_CTX_set_psk_client_callback(SSL_CTX * ctx,unsigned (* cb)(SSL * ssl,const char * hint,char * identity,unsigned max_identity_len,uint8_t * psk,unsigned max_psk_len))2629 void SSL_CTX_set_psk_client_callback(
2630 SSL_CTX *ctx, unsigned (*cb)(SSL *ssl, const char *hint, char *identity,
2631 unsigned max_identity_len, uint8_t *psk,
2632 unsigned max_psk_len)) {
2633 ctx->psk_client_callback = cb;
2634 }
2635
SSL_set_psk_server_callback(SSL * ssl,unsigned (* cb)(SSL * ssl,const char * identity,uint8_t * psk,unsigned max_psk_len))2636 void SSL_set_psk_server_callback(
2637 SSL *ssl, unsigned (*cb)(SSL *ssl, const char *identity, uint8_t *psk,
2638 unsigned max_psk_len)) {
2639 if (!ssl->config) {
2640 return;
2641 }
2642 ssl->config->psk_server_callback = cb;
2643 }
2644
SSL_CTX_set_psk_server_callback(SSL_CTX * ctx,unsigned (* cb)(SSL * ssl,const char * identity,uint8_t * psk,unsigned max_psk_len))2645 void SSL_CTX_set_psk_server_callback(
2646 SSL_CTX *ctx, unsigned (*cb)(SSL *ssl, const char *identity,
2647 uint8_t *psk, unsigned max_psk_len)) {
2648 ctx->psk_server_callback = cb;
2649 }
2650
SSL_CTX_set_msg_callback(SSL_CTX * ctx,void (* cb)(int write_p,int version,int content_type,const void * buf,size_t len,SSL * ssl,void * arg))2651 void SSL_CTX_set_msg_callback(SSL_CTX *ctx,
2652 void (*cb)(int write_p, int version,
2653 int content_type, const void *buf,
2654 size_t len, SSL *ssl, void *arg)) {
2655 ctx->msg_callback = cb;
2656 }
2657
SSL_CTX_set_msg_callback_arg(SSL_CTX * ctx,void * arg)2658 void SSL_CTX_set_msg_callback_arg(SSL_CTX *ctx, void *arg) {
2659 ctx->msg_callback_arg = arg;
2660 }
2661
SSL_set_msg_callback(SSL * ssl,void (* cb)(int write_p,int version,int content_type,const void * buf,size_t len,SSL * ssl,void * arg))2662 void SSL_set_msg_callback(SSL *ssl,
2663 void (*cb)(int write_p, int version, int content_type,
2664 const void *buf, size_t len, SSL *ssl,
2665 void *arg)) {
2666 ssl->msg_callback = cb;
2667 }
2668
SSL_set_msg_callback_arg(SSL * ssl,void * arg)2669 void SSL_set_msg_callback_arg(SSL *ssl, void *arg) {
2670 ssl->msg_callback_arg = arg;
2671 }
2672
SSL_CTX_set_keylog_callback(SSL_CTX * ctx,void (* cb)(const SSL * ssl,const char * line))2673 void SSL_CTX_set_keylog_callback(SSL_CTX *ctx,
2674 void (*cb)(const SSL *ssl, const char *line)) {
2675 ctx->keylog_callback = cb;
2676 }
2677
SSL_CTX_get_keylog_callback(const SSL_CTX * ctx)2678 void (*SSL_CTX_get_keylog_callback(const SSL_CTX *ctx))(const SSL *ssl,
2679 const char *line) {
2680 return ctx->keylog_callback;
2681 }
2682
SSL_CTX_set_current_time_cb(SSL_CTX * ctx,void (* cb)(const SSL * ssl,struct timeval * out_clock))2683 void SSL_CTX_set_current_time_cb(SSL_CTX *ctx,
2684 void (*cb)(const SSL *ssl,
2685 struct timeval *out_clock)) {
2686 ctx->current_time_cb = cb;
2687 }
2688
SSL_is_init_finished(const SSL * ssl)2689 int SSL_is_init_finished(const SSL *ssl) {
2690 return !SSL_in_init(ssl);
2691 }
2692
SSL_in_init(const SSL * ssl)2693 int SSL_in_init(const SSL *ssl) {
2694 // This returns false once all the handshake state has been finalized, to
2695 // allow callbacks and getters based on SSL_in_init to return the correct
2696 // values.
2697 SSL_HANDSHAKE *hs = ssl->s3->hs.get();
2698 return hs != nullptr && !hs->handshake_finalized;
2699 }
2700
SSL_in_false_start(const SSL * ssl)2701 int SSL_in_false_start(const SSL *ssl) {
2702 if (ssl->s3->hs == NULL) {
2703 return 0;
2704 }
2705 return ssl->s3->hs->in_false_start;
2706 }
2707
SSL_cutthrough_complete(const SSL * ssl)2708 int SSL_cutthrough_complete(const SSL *ssl) {
2709 return SSL_in_false_start(ssl);
2710 }
2711
SSL_is_server(const SSL * ssl)2712 int SSL_is_server(const SSL *ssl) { return ssl->server; }
2713
SSL_is_dtls(const SSL * ssl)2714 int SSL_is_dtls(const SSL *ssl) { return ssl->method->is_dtls; }
2715
SSL_CTX_set_select_certificate_cb(SSL_CTX * ctx,enum ssl_select_cert_result_t (* cb)(const SSL_CLIENT_HELLO *))2716 void SSL_CTX_set_select_certificate_cb(
2717 SSL_CTX *ctx,
2718 enum ssl_select_cert_result_t (*cb)(const SSL_CLIENT_HELLO *)) {
2719 ctx->select_certificate_cb = cb;
2720 }
2721
SSL_CTX_set_dos_protection_cb(SSL_CTX * ctx,int (* cb)(const SSL_CLIENT_HELLO *))2722 void SSL_CTX_set_dos_protection_cb(SSL_CTX *ctx,
2723 int (*cb)(const SSL_CLIENT_HELLO *)) {
2724 ctx->dos_protection_cb = cb;
2725 }
2726
SSL_CTX_set_reverify_on_resume(SSL_CTX * ctx,int enabled)2727 void SSL_CTX_set_reverify_on_resume(SSL_CTX *ctx, int enabled) {
2728 ctx->reverify_on_resume = !!enabled;
2729 }
2730
SSL_set_enforce_rsa_key_usage(SSL * ssl,int enabled)2731 void SSL_set_enforce_rsa_key_usage(SSL *ssl, int enabled) {
2732 if (!ssl->config) {
2733 return;
2734 }
2735 ssl->config->enforce_rsa_key_usage = !!enabled;
2736 }
2737
SSL_set_renegotiate_mode(SSL * ssl,enum ssl_renegotiate_mode_t mode)2738 void SSL_set_renegotiate_mode(SSL *ssl, enum ssl_renegotiate_mode_t mode) {
2739 ssl->renegotiate_mode = mode;
2740
2741 // Check if |ssl_can_renegotiate| has changed and the configuration may now be
2742 // shed. HTTP clients may initially allow renegotiation for HTTP/1.1, and then
2743 // disable after the handshake once the ALPN protocol is known to be HTTP/2.
2744 ssl_maybe_shed_handshake_config(ssl);
2745 }
2746
SSL_get_ivs(const SSL * ssl,const uint8_t ** out_read_iv,const uint8_t ** out_write_iv,size_t * out_iv_len)2747 int SSL_get_ivs(const SSL *ssl, const uint8_t **out_read_iv,
2748 const uint8_t **out_write_iv, size_t *out_iv_len) {
2749 size_t write_iv_len;
2750 if (!ssl->s3->aead_read_ctx->GetIV(out_read_iv, out_iv_len) ||
2751 !ssl->s3->aead_write_ctx->GetIV(out_write_iv, &write_iv_len) ||
2752 *out_iv_len != write_iv_len) {
2753 return 0;
2754 }
2755
2756 return 1;
2757 }
2758
be_to_u64(const uint8_t in[8])2759 static uint64_t be_to_u64(const uint8_t in[8]) {
2760 return (((uint64_t)in[0]) << 56) | (((uint64_t)in[1]) << 48) |
2761 (((uint64_t)in[2]) << 40) | (((uint64_t)in[3]) << 32) |
2762 (((uint64_t)in[4]) << 24) | (((uint64_t)in[5]) << 16) |
2763 (((uint64_t)in[6]) << 8) | ((uint64_t)in[7]);
2764 }
2765
SSL_get_read_sequence(const SSL * ssl)2766 uint64_t SSL_get_read_sequence(const SSL *ssl) {
2767 // TODO(davidben): Internally represent sequence numbers as uint64_t.
2768 if (SSL_is_dtls(ssl)) {
2769 // max_seq_num already includes the epoch.
2770 assert(ssl->d1->r_epoch == (ssl->d1->bitmap.max_seq_num >> 48));
2771 return ssl->d1->bitmap.max_seq_num;
2772 }
2773 return be_to_u64(ssl->s3->read_sequence);
2774 }
2775
SSL_get_write_sequence(const SSL * ssl)2776 uint64_t SSL_get_write_sequence(const SSL *ssl) {
2777 uint64_t ret = be_to_u64(ssl->s3->write_sequence);
2778 if (SSL_is_dtls(ssl)) {
2779 assert((ret >> 48) == 0);
2780 ret |= ((uint64_t)ssl->d1->w_epoch) << 48;
2781 }
2782 return ret;
2783 }
2784
SSL_get_peer_signature_algorithm(const SSL * ssl)2785 uint16_t SSL_get_peer_signature_algorithm(const SSL *ssl) {
2786 // TODO(davidben): This checks the wrong session if there is a renegotiation
2787 // in progress.
2788 SSL_SESSION *session = SSL_get_session(ssl);
2789 if (session == NULL) {
2790 return 0;
2791 }
2792
2793 return session->peer_signature_algorithm;
2794 }
2795
SSL_get_client_random(const SSL * ssl,uint8_t * out,size_t max_out)2796 size_t SSL_get_client_random(const SSL *ssl, uint8_t *out, size_t max_out) {
2797 if (max_out == 0) {
2798 return sizeof(ssl->s3->client_random);
2799 }
2800 if (max_out > sizeof(ssl->s3->client_random)) {
2801 max_out = sizeof(ssl->s3->client_random);
2802 }
2803 OPENSSL_memcpy(out, ssl->s3->client_random, max_out);
2804 return max_out;
2805 }
2806
SSL_get_server_random(const SSL * ssl,uint8_t * out,size_t max_out)2807 size_t SSL_get_server_random(const SSL *ssl, uint8_t *out, size_t max_out) {
2808 if (max_out == 0) {
2809 return sizeof(ssl->s3->server_random);
2810 }
2811 if (max_out > sizeof(ssl->s3->server_random)) {
2812 max_out = sizeof(ssl->s3->server_random);
2813 }
2814 OPENSSL_memcpy(out, ssl->s3->server_random, max_out);
2815 return max_out;
2816 }
2817
SSL_get_pending_cipher(const SSL * ssl)2818 const SSL_CIPHER *SSL_get_pending_cipher(const SSL *ssl) {
2819 SSL_HANDSHAKE *hs = ssl->s3->hs.get();
2820 if (hs == NULL) {
2821 return NULL;
2822 }
2823 return hs->new_cipher;
2824 }
2825
SSL_set_retain_only_sha256_of_client_certs(SSL * ssl,int enabled)2826 void SSL_set_retain_only_sha256_of_client_certs(SSL *ssl, int enabled) {
2827 if (!ssl->config) {
2828 return;
2829 }
2830 ssl->config->retain_only_sha256_of_client_certs = !!enabled;
2831 }
2832
SSL_CTX_set_retain_only_sha256_of_client_certs(SSL_CTX * ctx,int enabled)2833 void SSL_CTX_set_retain_only_sha256_of_client_certs(SSL_CTX *ctx, int enabled) {
2834 ctx->retain_only_sha256_of_client_certs = !!enabled;
2835 }
2836
SSL_CTX_set_grease_enabled(SSL_CTX * ctx,int enabled)2837 void SSL_CTX_set_grease_enabled(SSL_CTX *ctx, int enabled) {
2838 ctx->grease_enabled = !!enabled;
2839 }
2840
SSL_get_ticket_age_skew(const SSL * ssl)2841 int32_t SSL_get_ticket_age_skew(const SSL *ssl) {
2842 return ssl->s3->ticket_age_skew;
2843 }
2844
SSL_CTX_set_false_start_allowed_without_alpn(SSL_CTX * ctx,int allowed)2845 void SSL_CTX_set_false_start_allowed_without_alpn(SSL_CTX *ctx, int allowed) {
2846 ctx->false_start_allowed_without_alpn = !!allowed;
2847 }
2848
SSL_is_tls13_downgrade(const SSL * ssl)2849 int SSL_is_tls13_downgrade(const SSL *ssl) { return ssl->s3->tls13_downgrade; }
2850
SSL_used_hello_retry_request(const SSL * ssl)2851 int SSL_used_hello_retry_request(const SSL *ssl) {
2852 return ssl->s3->used_hello_retry_request;
2853 }
2854
SSL_CTX_set_ignore_tls13_downgrade(SSL_CTX * ctx,int ignore)2855 void SSL_CTX_set_ignore_tls13_downgrade(SSL_CTX *ctx, int ignore) {
2856 ctx->ignore_tls13_downgrade = !!ignore;
2857 }
2858
SSL_set_ignore_tls13_downgrade(SSL * ssl,int ignore)2859 void SSL_set_ignore_tls13_downgrade(SSL *ssl, int ignore) {
2860 if (!ssl->config) {
2861 return;
2862 }
2863 ssl->config->ignore_tls13_downgrade = !!ignore;
2864 }
2865
SSL_set_shed_handshake_config(SSL * ssl,int enable)2866 void SSL_set_shed_handshake_config(SSL *ssl, int enable) {
2867 if (!ssl->config) {
2868 return;
2869 }
2870 ssl->config->shed_handshake_config = !!enable;
2871 }
2872
SSL_set_jdk11_workaround(SSL * ssl,int enable)2873 void SSL_set_jdk11_workaround(SSL *ssl, int enable) {
2874 if (!ssl->config) {
2875 return;
2876 }
2877 ssl->config->jdk11_workaround = !!enable;
2878 }
2879
SSL_clear(SSL * ssl)2880 int SSL_clear(SSL *ssl) {
2881 if (!ssl->config) {
2882 return 0; // SSL_clear may not be used after shedding config.
2883 }
2884
2885 // In OpenSSL, reusing a client |SSL| with |SSL_clear| causes the previously
2886 // established session to be offered the next time around. wpa_supplicant
2887 // depends on this behavior, so emulate it.
2888 UniquePtr<SSL_SESSION> session;
2889 if (!ssl->server && ssl->s3->established_session != NULL) {
2890 session = UpRef(ssl->s3->established_session);
2891 }
2892
2893 // The ssl->d1->mtu is simultaneously configuration (preserved across
2894 // clear) and connection-specific state (gets reset).
2895 //
2896 // TODO(davidben): Avoid this.
2897 unsigned mtu = 0;
2898 if (ssl->d1 != NULL) {
2899 mtu = ssl->d1->mtu;
2900 }
2901
2902 ssl->method->ssl_free(ssl);
2903 if (!ssl->method->ssl_new(ssl)) {
2904 return 0;
2905 }
2906
2907 if (SSL_is_dtls(ssl) && (SSL_get_options(ssl) & SSL_OP_NO_QUERY_MTU)) {
2908 ssl->d1->mtu = mtu;
2909 }
2910
2911 if (session != nullptr) {
2912 SSL_set_session(ssl, session.get());
2913 }
2914
2915 return 1;
2916 }
2917
SSL_CTX_sess_connect(const SSL_CTX * ctx)2918 int SSL_CTX_sess_connect(const SSL_CTX *ctx) { return 0; }
SSL_CTX_sess_connect_good(const SSL_CTX * ctx)2919 int SSL_CTX_sess_connect_good(const SSL_CTX *ctx) { return 0; }
SSL_CTX_sess_connect_renegotiate(const SSL_CTX * ctx)2920 int SSL_CTX_sess_connect_renegotiate(const SSL_CTX *ctx) { return 0; }
SSL_CTX_sess_accept(const SSL_CTX * ctx)2921 int SSL_CTX_sess_accept(const SSL_CTX *ctx) { return 0; }
SSL_CTX_sess_accept_renegotiate(const SSL_CTX * ctx)2922 int SSL_CTX_sess_accept_renegotiate(const SSL_CTX *ctx) { return 0; }
SSL_CTX_sess_accept_good(const SSL_CTX * ctx)2923 int SSL_CTX_sess_accept_good(const SSL_CTX *ctx) { return 0; }
SSL_CTX_sess_hits(const SSL_CTX * ctx)2924 int SSL_CTX_sess_hits(const SSL_CTX *ctx) { return 0; }
SSL_CTX_sess_cb_hits(const SSL_CTX * ctx)2925 int SSL_CTX_sess_cb_hits(const SSL_CTX *ctx) { return 0; }
SSL_CTX_sess_misses(const SSL_CTX * ctx)2926 int SSL_CTX_sess_misses(const SSL_CTX *ctx) { return 0; }
SSL_CTX_sess_timeouts(const SSL_CTX * ctx)2927 int SSL_CTX_sess_timeouts(const SSL_CTX *ctx) { return 0; }
SSL_CTX_sess_cache_full(const SSL_CTX * ctx)2928 int SSL_CTX_sess_cache_full(const SSL_CTX *ctx) { return 0; }
2929
SSL_num_renegotiations(const SSL * ssl)2930 int SSL_num_renegotiations(const SSL *ssl) {
2931 return SSL_total_renegotiations(ssl);
2932 }
2933
SSL_CTX_need_tmp_RSA(const SSL_CTX * ctx)2934 int SSL_CTX_need_tmp_RSA(const SSL_CTX *ctx) { return 0; }
SSL_need_tmp_RSA(const SSL * ssl)2935 int SSL_need_tmp_RSA(const SSL *ssl) { return 0; }
SSL_CTX_set_tmp_rsa(SSL_CTX * ctx,const RSA * rsa)2936 int SSL_CTX_set_tmp_rsa(SSL_CTX *ctx, const RSA *rsa) { return 1; }
SSL_set_tmp_rsa(SSL * ssl,const RSA * rsa)2937 int SSL_set_tmp_rsa(SSL *ssl, const RSA *rsa) { return 1; }
ERR_load_SSL_strings(void)2938 void ERR_load_SSL_strings(void) {}
SSL_load_error_strings(void)2939 void SSL_load_error_strings(void) {}
SSL_cache_hit(SSL * ssl)2940 int SSL_cache_hit(SSL *ssl) { return SSL_session_reused(ssl); }
2941
SSL_CTX_set_tmp_ecdh(SSL_CTX * ctx,const EC_KEY * ec_key)2942 int SSL_CTX_set_tmp_ecdh(SSL_CTX *ctx, const EC_KEY *ec_key) {
2943 if (ec_key == NULL || EC_KEY_get0_group(ec_key) == NULL) {
2944 OPENSSL_PUT_ERROR(SSL, ERR_R_PASSED_NULL_PARAMETER);
2945 return 0;
2946 }
2947 int nid = EC_GROUP_get_curve_name(EC_KEY_get0_group(ec_key));
2948 return SSL_CTX_set1_curves(ctx, &nid, 1);
2949 }
2950
SSL_set_tmp_ecdh(SSL * ssl,const EC_KEY * ec_key)2951 int SSL_set_tmp_ecdh(SSL *ssl, const EC_KEY *ec_key) {
2952 if (ec_key == NULL || EC_KEY_get0_group(ec_key) == NULL) {
2953 OPENSSL_PUT_ERROR(SSL, ERR_R_PASSED_NULL_PARAMETER);
2954 return 0;
2955 }
2956 int nid = EC_GROUP_get_curve_name(EC_KEY_get0_group(ec_key));
2957 return SSL_set1_curves(ssl, &nid, 1);
2958 }
2959
SSL_CTX_set_ticket_aead_method(SSL_CTX * ctx,const SSL_TICKET_AEAD_METHOD * aead_method)2960 void SSL_CTX_set_ticket_aead_method(SSL_CTX *ctx,
2961 const SSL_TICKET_AEAD_METHOD *aead_method) {
2962 ctx->ticket_aead_method = aead_method;
2963 }
2964
SSL_set_tlsext_status_type(SSL * ssl,int type)2965 int SSL_set_tlsext_status_type(SSL *ssl, int type) {
2966 if (!ssl->config) {
2967 return 0;
2968 }
2969 ssl->config->ocsp_stapling_enabled = type == TLSEXT_STATUSTYPE_ocsp;
2970 return 1;
2971 }
2972
SSL_get_tlsext_status_type(const SSL * ssl)2973 int SSL_get_tlsext_status_type(const SSL *ssl) {
2974 if (ssl->server) {
2975 SSL_HANDSHAKE *hs = ssl->s3->hs.get();
2976 return hs != nullptr && hs->ocsp_stapling_requested
2977 ? TLSEXT_STATUSTYPE_ocsp
2978 : TLSEXT_STATUSTYPE_nothing;
2979 }
2980
2981 return ssl->config != nullptr && ssl->config->ocsp_stapling_enabled
2982 ? TLSEXT_STATUSTYPE_ocsp
2983 : TLSEXT_STATUSTYPE_nothing;
2984 }
2985
SSL_set_tlsext_status_ocsp_resp(SSL * ssl,uint8_t * resp,size_t resp_len)2986 int SSL_set_tlsext_status_ocsp_resp(SSL *ssl, uint8_t *resp, size_t resp_len) {
2987 if (SSL_set_ocsp_response(ssl, resp, resp_len)) {
2988 OPENSSL_free(resp);
2989 return 1;
2990 }
2991 return 0;
2992 }
2993
SSL_get_tlsext_status_ocsp_resp(const SSL * ssl,const uint8_t ** out)2994 size_t SSL_get_tlsext_status_ocsp_resp(const SSL *ssl, const uint8_t **out) {
2995 size_t ret;
2996 SSL_get0_ocsp_response(ssl, out, &ret);
2997 return ret;
2998 }
2999
SSL_CTX_set_tlsext_status_cb(SSL_CTX * ctx,int (* callback)(SSL * ssl,void * arg))3000 int SSL_CTX_set_tlsext_status_cb(SSL_CTX *ctx,
3001 int (*callback)(SSL *ssl, void *arg)) {
3002 ctx->legacy_ocsp_callback = callback;
3003 return 1;
3004 }
3005
SSL_CTX_set_tlsext_status_arg(SSL_CTX * ctx,void * arg)3006 int SSL_CTX_set_tlsext_status_arg(SSL_CTX *ctx, void *arg) {
3007 ctx->legacy_ocsp_callback_arg = arg;
3008 return 1;
3009 }
3010