1 /*
2 * Copyright 1995-2021 The OpenSSL Project Authors. All Rights Reserved.
3 * Copyright (c) 2002, Oracle and/or its affiliates. All rights reserved
4 * Copyright 2005 Nokia. All rights reserved.
5 *
6 * Licensed under the Apache License 2.0 (the "License"). You may not use
7 * this file except in compliance with the License. You can obtain a copy
8 * in the file LICENSE in the source distribution or at
9 * https://www.openssl.org/source/license.html
10 */
11
12 #include <stdio.h>
13 #include "ssl_local.h"
14 #include "e_os.h"
15 #include <openssl/objects.h>
16 #include <openssl/x509v3.h>
17 #include <openssl/rand.h>
18 #include <openssl/ocsp.h>
19 #include <openssl/dh.h>
20 #include <openssl/engine.h>
21 #include <openssl/async.h>
22 #include <openssl/ct.h>
23 #include <openssl/trace.h>
24 #include "internal/cryptlib.h"
25 #include "internal/refcount.h"
26 #include "internal/ktls.h"
27
ssl_undefined_function_1(SSL * ssl,SSL3_RECORD * r,size_t s,int t,SSL_MAC_BUF * mac,size_t macsize)28 static int ssl_undefined_function_1(SSL *ssl, SSL3_RECORD *r, size_t s, int t,
29 SSL_MAC_BUF *mac, size_t macsize)
30 {
31 return ssl_undefined_function(ssl);
32 }
33
ssl_undefined_function_2(SSL * ssl,SSL3_RECORD * r,unsigned char * s,int t)34 static int ssl_undefined_function_2(SSL *ssl, SSL3_RECORD *r, unsigned char *s,
35 int t)
36 {
37 return ssl_undefined_function(ssl);
38 }
39
ssl_undefined_function_3(SSL * ssl,unsigned char * r,unsigned char * s,size_t t,size_t * u)40 static int ssl_undefined_function_3(SSL *ssl, unsigned char *r,
41 unsigned char *s, size_t t, size_t *u)
42 {
43 return ssl_undefined_function(ssl);
44 }
45
ssl_undefined_function_4(SSL * ssl,int r)46 static int ssl_undefined_function_4(SSL *ssl, int r)
47 {
48 return ssl_undefined_function(ssl);
49 }
50
ssl_undefined_function_5(SSL * ssl,const char * r,size_t s,unsigned char * t)51 static size_t ssl_undefined_function_5(SSL *ssl, const char *r, size_t s,
52 unsigned char *t)
53 {
54 return ssl_undefined_function(ssl);
55 }
56
ssl_undefined_function_6(int r)57 static int ssl_undefined_function_6(int r)
58 {
59 return ssl_undefined_function(NULL);
60 }
61
ssl_undefined_function_7(SSL * ssl,unsigned char * r,size_t s,const char * t,size_t u,const unsigned char * v,size_t w,int x)62 static int ssl_undefined_function_7(SSL *ssl, unsigned char *r, size_t s,
63 const char *t, size_t u,
64 const unsigned char *v, size_t w, int x)
65 {
66 return ssl_undefined_function(ssl);
67 }
68
69 SSL3_ENC_METHOD ssl3_undef_enc_method = {
70 ssl_undefined_function_1,
71 ssl_undefined_function_2,
72 ssl_undefined_function,
73 ssl_undefined_function_3,
74 ssl_undefined_function_4,
75 ssl_undefined_function_5,
76 NULL, /* client_finished_label */
77 0, /* client_finished_label_len */
78 NULL, /* server_finished_label */
79 0, /* server_finished_label_len */
80 ssl_undefined_function_6,
81 ssl_undefined_function_7,
82 };
83
84 struct ssl_async_args {
85 SSL *s;
86 void *buf;
87 size_t num;
88 enum { READFUNC, WRITEFUNC, OTHERFUNC } type;
89 union {
90 int (*func_read) (SSL *, void *, size_t, size_t *);
91 int (*func_write) (SSL *, const void *, size_t, size_t *);
92 int (*func_other) (SSL *);
93 } f;
94 };
95
96 static const struct {
97 uint8_t mtype;
98 uint8_t ord;
99 int nid;
100 } dane_mds[] = {
101 {
102 DANETLS_MATCHING_FULL, 0, NID_undef
103 },
104 {
105 DANETLS_MATCHING_2256, 1, NID_sha256
106 },
107 {
108 DANETLS_MATCHING_2512, 2, NID_sha512
109 },
110 };
111
dane_ctx_enable(struct dane_ctx_st * dctx)112 static int dane_ctx_enable(struct dane_ctx_st *dctx)
113 {
114 const EVP_MD **mdevp;
115 uint8_t *mdord;
116 uint8_t mdmax = DANETLS_MATCHING_LAST;
117 int n = ((int)mdmax) + 1; /* int to handle PrivMatch(255) */
118 size_t i;
119
120 if (dctx->mdevp != NULL)
121 return 1;
122
123 mdevp = OPENSSL_zalloc(n * sizeof(*mdevp));
124 mdord = OPENSSL_zalloc(n * sizeof(*mdord));
125
126 if (mdord == NULL || mdevp == NULL) {
127 OPENSSL_free(mdord);
128 OPENSSL_free(mdevp);
129 ERR_raise(ERR_LIB_SSL, ERR_R_MALLOC_FAILURE);
130 return 0;
131 }
132
133 /* Install default entries */
134 for (i = 0; i < OSSL_NELEM(dane_mds); ++i) {
135 const EVP_MD *md;
136
137 if (dane_mds[i].nid == NID_undef ||
138 (md = EVP_get_digestbynid(dane_mds[i].nid)) == NULL)
139 continue;
140 mdevp[dane_mds[i].mtype] = md;
141 mdord[dane_mds[i].mtype] = dane_mds[i].ord;
142 }
143
144 dctx->mdevp = mdevp;
145 dctx->mdord = mdord;
146 dctx->mdmax = mdmax;
147
148 return 1;
149 }
150
dane_ctx_final(struct dane_ctx_st * dctx)151 static void dane_ctx_final(struct dane_ctx_st *dctx)
152 {
153 OPENSSL_free(dctx->mdevp);
154 dctx->mdevp = NULL;
155
156 OPENSSL_free(dctx->mdord);
157 dctx->mdord = NULL;
158 dctx->mdmax = 0;
159 }
160
tlsa_free(danetls_record * t)161 static void tlsa_free(danetls_record *t)
162 {
163 if (t == NULL)
164 return;
165 OPENSSL_free(t->data);
166 EVP_PKEY_free(t->spki);
167 OPENSSL_free(t);
168 }
169
dane_final(SSL_DANE * dane)170 static void dane_final(SSL_DANE *dane)
171 {
172 sk_danetls_record_pop_free(dane->trecs, tlsa_free);
173 dane->trecs = NULL;
174
175 sk_X509_pop_free(dane->certs, X509_free);
176 dane->certs = NULL;
177
178 X509_free(dane->mcert);
179 dane->mcert = NULL;
180 dane->mtlsa = NULL;
181 dane->mdpth = -1;
182 dane->pdpth = -1;
183 }
184
185 /*
186 * dane_copy - Copy dane configuration, sans verification state.
187 */
ssl_dane_dup(SSL * to,SSL * from)188 static int ssl_dane_dup(SSL *to, SSL *from)
189 {
190 int num;
191 int i;
192
193 if (!DANETLS_ENABLED(&from->dane))
194 return 1;
195
196 num = sk_danetls_record_num(from->dane.trecs);
197 dane_final(&to->dane);
198 to->dane.flags = from->dane.flags;
199 to->dane.dctx = &to->ctx->dane;
200 to->dane.trecs = sk_danetls_record_new_reserve(NULL, num);
201
202 if (to->dane.trecs == NULL) {
203 ERR_raise(ERR_LIB_SSL, ERR_R_MALLOC_FAILURE);
204 return 0;
205 }
206
207 for (i = 0; i < num; ++i) {
208 danetls_record *t = sk_danetls_record_value(from->dane.trecs, i);
209
210 if (SSL_dane_tlsa_add(to, t->usage, t->selector, t->mtype,
211 t->data, t->dlen) <= 0)
212 return 0;
213 }
214 return 1;
215 }
216
dane_mtype_set(struct dane_ctx_st * dctx,const EVP_MD * md,uint8_t mtype,uint8_t ord)217 static int dane_mtype_set(struct dane_ctx_st *dctx,
218 const EVP_MD *md, uint8_t mtype, uint8_t ord)
219 {
220 int i;
221
222 if (mtype == DANETLS_MATCHING_FULL && md != NULL) {
223 ERR_raise(ERR_LIB_SSL, SSL_R_DANE_CANNOT_OVERRIDE_MTYPE_FULL);
224 return 0;
225 }
226
227 if (mtype > dctx->mdmax) {
228 const EVP_MD **mdevp;
229 uint8_t *mdord;
230 int n = ((int)mtype) + 1;
231
232 mdevp = OPENSSL_realloc(dctx->mdevp, n * sizeof(*mdevp));
233 if (mdevp == NULL) {
234 ERR_raise(ERR_LIB_SSL, ERR_R_MALLOC_FAILURE);
235 return -1;
236 }
237 dctx->mdevp = mdevp;
238
239 mdord = OPENSSL_realloc(dctx->mdord, n * sizeof(*mdord));
240 if (mdord == NULL) {
241 ERR_raise(ERR_LIB_SSL, ERR_R_MALLOC_FAILURE);
242 return -1;
243 }
244 dctx->mdord = mdord;
245
246 /* Zero-fill any gaps */
247 for (i = dctx->mdmax + 1; i < mtype; ++i) {
248 mdevp[i] = NULL;
249 mdord[i] = 0;
250 }
251
252 dctx->mdmax = mtype;
253 }
254
255 dctx->mdevp[mtype] = md;
256 /* Coerce ordinal of disabled matching types to 0 */
257 dctx->mdord[mtype] = (md == NULL) ? 0 : ord;
258
259 return 1;
260 }
261
tlsa_md_get(SSL_DANE * dane,uint8_t mtype)262 static const EVP_MD *tlsa_md_get(SSL_DANE *dane, uint8_t mtype)
263 {
264 if (mtype > dane->dctx->mdmax)
265 return NULL;
266 return dane->dctx->mdevp[mtype];
267 }
268
dane_tlsa_add(SSL_DANE * dane,uint8_t usage,uint8_t selector,uint8_t mtype,const unsigned char * data,size_t dlen)269 static int dane_tlsa_add(SSL_DANE *dane,
270 uint8_t usage,
271 uint8_t selector,
272 uint8_t mtype, const unsigned char *data, size_t dlen)
273 {
274 danetls_record *t;
275 const EVP_MD *md = NULL;
276 int ilen = (int)dlen;
277 int i;
278 int num;
279
280 if (dane->trecs == NULL) {
281 ERR_raise(ERR_LIB_SSL, SSL_R_DANE_NOT_ENABLED);
282 return -1;
283 }
284
285 if (ilen < 0 || dlen != (size_t)ilen) {
286 ERR_raise(ERR_LIB_SSL, SSL_R_DANE_TLSA_BAD_DATA_LENGTH);
287 return 0;
288 }
289
290 if (usage > DANETLS_USAGE_LAST) {
291 ERR_raise(ERR_LIB_SSL, SSL_R_DANE_TLSA_BAD_CERTIFICATE_USAGE);
292 return 0;
293 }
294
295 if (selector > DANETLS_SELECTOR_LAST) {
296 ERR_raise(ERR_LIB_SSL, SSL_R_DANE_TLSA_BAD_SELECTOR);
297 return 0;
298 }
299
300 if (mtype != DANETLS_MATCHING_FULL) {
301 md = tlsa_md_get(dane, mtype);
302 if (md == NULL) {
303 ERR_raise(ERR_LIB_SSL, SSL_R_DANE_TLSA_BAD_MATCHING_TYPE);
304 return 0;
305 }
306 }
307
308 if (md != NULL && dlen != (size_t)EVP_MD_get_size(md)) {
309 ERR_raise(ERR_LIB_SSL, SSL_R_DANE_TLSA_BAD_DIGEST_LENGTH);
310 return 0;
311 }
312 if (!data) {
313 ERR_raise(ERR_LIB_SSL, SSL_R_DANE_TLSA_NULL_DATA);
314 return 0;
315 }
316
317 if ((t = OPENSSL_zalloc(sizeof(*t))) == NULL) {
318 ERR_raise(ERR_LIB_SSL, ERR_R_MALLOC_FAILURE);
319 return -1;
320 }
321
322 t->usage = usage;
323 t->selector = selector;
324 t->mtype = mtype;
325 t->data = OPENSSL_malloc(dlen);
326 if (t->data == NULL) {
327 tlsa_free(t);
328 ERR_raise(ERR_LIB_SSL, ERR_R_MALLOC_FAILURE);
329 return -1;
330 }
331 memcpy(t->data, data, dlen);
332 t->dlen = dlen;
333
334 /* Validate and cache full certificate or public key */
335 if (mtype == DANETLS_MATCHING_FULL) {
336 const unsigned char *p = data;
337 X509 *cert = NULL;
338 EVP_PKEY *pkey = NULL;
339
340 switch (selector) {
341 case DANETLS_SELECTOR_CERT:
342 if (!d2i_X509(&cert, &p, ilen) || p < data ||
343 dlen != (size_t)(p - data)) {
344 tlsa_free(t);
345 ERR_raise(ERR_LIB_SSL, SSL_R_DANE_TLSA_BAD_CERTIFICATE);
346 return 0;
347 }
348 if (X509_get0_pubkey(cert) == NULL) {
349 tlsa_free(t);
350 ERR_raise(ERR_LIB_SSL, SSL_R_DANE_TLSA_BAD_CERTIFICATE);
351 return 0;
352 }
353
354 if ((DANETLS_USAGE_BIT(usage) & DANETLS_TA_MASK) == 0) {
355 X509_free(cert);
356 break;
357 }
358
359 /*
360 * For usage DANE-TA(2), we support authentication via "2 0 0" TLSA
361 * records that contain full certificates of trust-anchors that are
362 * not present in the wire chain. For usage PKIX-TA(0), we augment
363 * the chain with untrusted Full(0) certificates from DNS, in case
364 * they are missing from the chain.
365 */
366 if ((dane->certs == NULL &&
367 (dane->certs = sk_X509_new_null()) == NULL) ||
368 !sk_X509_push(dane->certs, cert)) {
369 ERR_raise(ERR_LIB_SSL, ERR_R_MALLOC_FAILURE);
370 X509_free(cert);
371 tlsa_free(t);
372 return -1;
373 }
374 break;
375
376 case DANETLS_SELECTOR_SPKI:
377 if (!d2i_PUBKEY(&pkey, &p, ilen) || p < data ||
378 dlen != (size_t)(p - data)) {
379 tlsa_free(t);
380 ERR_raise(ERR_LIB_SSL, SSL_R_DANE_TLSA_BAD_PUBLIC_KEY);
381 return 0;
382 }
383
384 /*
385 * For usage DANE-TA(2), we support authentication via "2 1 0" TLSA
386 * records that contain full bare keys of trust-anchors that are
387 * not present in the wire chain.
388 */
389 if (usage == DANETLS_USAGE_DANE_TA)
390 t->spki = pkey;
391 else
392 EVP_PKEY_free(pkey);
393 break;
394 }
395 }
396
397 /*-
398 * Find the right insertion point for the new record.
399 *
400 * See crypto/x509/x509_vfy.c. We sort DANE-EE(3) records first, so that
401 * they can be processed first, as they require no chain building, and no
402 * expiration or hostname checks. Because DANE-EE(3) is numerically
403 * largest, this is accomplished via descending sort by "usage".
404 *
405 * We also sort in descending order by matching ordinal to simplify
406 * the implementation of digest agility in the verification code.
407 *
408 * The choice of order for the selector is not significant, so we
409 * use the same descending order for consistency.
410 */
411 num = sk_danetls_record_num(dane->trecs);
412 for (i = 0; i < num; ++i) {
413 danetls_record *rec = sk_danetls_record_value(dane->trecs, i);
414
415 if (rec->usage > usage)
416 continue;
417 if (rec->usage < usage)
418 break;
419 if (rec->selector > selector)
420 continue;
421 if (rec->selector < selector)
422 break;
423 if (dane->dctx->mdord[rec->mtype] > dane->dctx->mdord[mtype])
424 continue;
425 break;
426 }
427
428 if (!sk_danetls_record_insert(dane->trecs, t, i)) {
429 tlsa_free(t);
430 ERR_raise(ERR_LIB_SSL, ERR_R_MALLOC_FAILURE);
431 return -1;
432 }
433 dane->umask |= DANETLS_USAGE_BIT(usage);
434
435 return 1;
436 }
437
438 /*
439 * Return 0 if there is only one version configured and it was disabled
440 * at configure time. Return 1 otherwise.
441 */
ssl_check_allowed_versions(int min_version,int max_version)442 static int ssl_check_allowed_versions(int min_version, int max_version)
443 {
444 int minisdtls = 0, maxisdtls = 0;
445
446 /* Figure out if we're doing DTLS versions or TLS versions */
447 if (min_version == DTLS1_BAD_VER
448 || min_version >> 8 == DTLS1_VERSION_MAJOR)
449 minisdtls = 1;
450 if (max_version == DTLS1_BAD_VER
451 || max_version >> 8 == DTLS1_VERSION_MAJOR)
452 maxisdtls = 1;
453 /* A wildcard version of 0 could be DTLS or TLS. */
454 if ((minisdtls && !maxisdtls && max_version != 0)
455 || (maxisdtls && !minisdtls && min_version != 0)) {
456 /* Mixing DTLS and TLS versions will lead to sadness; deny it. */
457 return 0;
458 }
459
460 if (minisdtls || maxisdtls) {
461 /* Do DTLS version checks. */
462 if (min_version == 0)
463 /* Ignore DTLS1_BAD_VER */
464 min_version = DTLS1_VERSION;
465 if (max_version == 0)
466 max_version = DTLS1_2_VERSION;
467 #ifdef OPENSSL_NO_DTLS1_2
468 if (max_version == DTLS1_2_VERSION)
469 max_version = DTLS1_VERSION;
470 #endif
471 #ifdef OPENSSL_NO_DTLS1
472 if (min_version == DTLS1_VERSION)
473 min_version = DTLS1_2_VERSION;
474 #endif
475 /* Done massaging versions; do the check. */
476 if (0
477 #ifdef OPENSSL_NO_DTLS1
478 || (DTLS_VERSION_GE(min_version, DTLS1_VERSION)
479 && DTLS_VERSION_GE(DTLS1_VERSION, max_version))
480 #endif
481 #ifdef OPENSSL_NO_DTLS1_2
482 || (DTLS_VERSION_GE(min_version, DTLS1_2_VERSION)
483 && DTLS_VERSION_GE(DTLS1_2_VERSION, max_version))
484 #endif
485 )
486 return 0;
487 } else {
488 /* Regular TLS version checks. */
489 if (min_version == 0)
490 min_version = SSL3_VERSION;
491 if (max_version == 0)
492 max_version = TLS1_3_VERSION;
493 #ifdef OPENSSL_NO_TLS1_3
494 if (max_version == TLS1_3_VERSION)
495 max_version = TLS1_2_VERSION;
496 #endif
497 #ifdef OPENSSL_NO_TLS1_2
498 if (max_version == TLS1_2_VERSION)
499 max_version = TLS1_1_VERSION;
500 #endif
501 #ifdef OPENSSL_NO_TLS1_1
502 if (max_version == TLS1_1_VERSION)
503 max_version = TLS1_VERSION;
504 #endif
505 #ifdef OPENSSL_NO_TLS1
506 if (max_version == TLS1_VERSION)
507 max_version = SSL3_VERSION;
508 #endif
509 #ifdef OPENSSL_NO_SSL3
510 if (min_version == SSL3_VERSION)
511 min_version = TLS1_VERSION;
512 #endif
513 #ifdef OPENSSL_NO_TLS1
514 if (min_version == TLS1_VERSION)
515 min_version = TLS1_1_VERSION;
516 #endif
517 #ifdef OPENSSL_NO_TLS1_1
518 if (min_version == TLS1_1_VERSION)
519 min_version = TLS1_2_VERSION;
520 #endif
521 #ifdef OPENSSL_NO_TLS1_2
522 if (min_version == TLS1_2_VERSION)
523 min_version = TLS1_3_VERSION;
524 #endif
525 /* Done massaging versions; do the check. */
526 if (0
527 #ifdef OPENSSL_NO_SSL3
528 || (min_version <= SSL3_VERSION && SSL3_VERSION <= max_version)
529 #endif
530 #ifdef OPENSSL_NO_TLS1
531 || (min_version <= TLS1_VERSION && TLS1_VERSION <= max_version)
532 #endif
533 #ifdef OPENSSL_NO_TLS1_1
534 || (min_version <= TLS1_1_VERSION && TLS1_1_VERSION <= max_version)
535 #endif
536 #ifdef OPENSSL_NO_TLS1_2
537 || (min_version <= TLS1_2_VERSION && TLS1_2_VERSION <= max_version)
538 #endif
539 #ifdef OPENSSL_NO_TLS1_3
540 || (min_version <= TLS1_3_VERSION && TLS1_3_VERSION <= max_version)
541 #endif
542 )
543 return 0;
544 }
545 return 1;
546 }
547
548 #if defined(__TANDEM) && defined(OPENSSL_VPROC)
549 /*
550 * Define a VPROC function for HP NonStop build ssl library.
551 * This is used by platform version identification tools.
552 * Do not inline this procedure or make it static.
553 */
554 # define OPENSSL_VPROC_STRING_(x) x##_SSL
555 # define OPENSSL_VPROC_STRING(x) OPENSSL_VPROC_STRING_(x)
556 # define OPENSSL_VPROC_FUNC OPENSSL_VPROC_STRING(OPENSSL_VPROC)
OPENSSL_VPROC_FUNC(void)557 void OPENSSL_VPROC_FUNC(void) {}
558 #endif
559
560
clear_ciphers(SSL * s)561 static void clear_ciphers(SSL *s)
562 {
563 /* clear the current cipher */
564 ssl_clear_cipher_ctx(s);
565 ssl_clear_hash_ctx(&s->read_hash);
566 ssl_clear_hash_ctx(&s->write_hash);
567 }
568
SSL_clear(SSL * s)569 int SSL_clear(SSL *s)
570 {
571 if (s->method == NULL) {
572 ERR_raise(ERR_LIB_SSL, SSL_R_NO_METHOD_SPECIFIED);
573 return 0;
574 }
575
576 if (ssl_clear_bad_session(s)) {
577 SSL_SESSION_free(s->session);
578 s->session = NULL;
579 }
580 SSL_SESSION_free(s->psksession);
581 s->psksession = NULL;
582 OPENSSL_free(s->psksession_id);
583 s->psksession_id = NULL;
584 s->psksession_id_len = 0;
585 s->hello_retry_request = 0;
586 s->sent_tickets = 0;
587
588 s->error = 0;
589 s->hit = 0;
590 s->shutdown = 0;
591
592 if (s->renegotiate) {
593 ERR_raise(ERR_LIB_SSL, ERR_R_INTERNAL_ERROR);
594 return 0;
595 }
596
597 ossl_statem_clear(s);
598
599 s->version = s->method->version;
600 s->client_version = s->version;
601 s->rwstate = SSL_NOTHING;
602
603 BUF_MEM_free(s->init_buf);
604 s->init_buf = NULL;
605 clear_ciphers(s);
606 s->first_packet = 0;
607
608 s->key_update = SSL_KEY_UPDATE_NONE;
609
610 EVP_MD_CTX_free(s->pha_dgst);
611 s->pha_dgst = NULL;
612
613 /* Reset DANE verification result state */
614 s->dane.mdpth = -1;
615 s->dane.pdpth = -1;
616 X509_free(s->dane.mcert);
617 s->dane.mcert = NULL;
618 s->dane.mtlsa = NULL;
619
620 /* Clear the verification result peername */
621 X509_VERIFY_PARAM_move_peername(s->param, NULL);
622
623 /* Clear any shared connection state */
624 OPENSSL_free(s->shared_sigalgs);
625 s->shared_sigalgs = NULL;
626 s->shared_sigalgslen = 0;
627
628 /*
629 * Check to see if we were changed into a different method, if so, revert
630 * back.
631 */
632 if (s->method != s->ctx->method) {
633 s->method->ssl_free(s);
634 s->method = s->ctx->method;
635 if (!s->method->ssl_new(s))
636 return 0;
637 } else {
638 if (!s->method->ssl_clear(s))
639 return 0;
640 }
641
642 RECORD_LAYER_clear(&s->rlayer);
643
644 return 1;
645 }
646
647 #ifndef OPENSSL_NO_DEPRECATED_3_0
648 /** Used to change an SSL_CTXs default SSL method type */
SSL_CTX_set_ssl_version(SSL_CTX * ctx,const SSL_METHOD * meth)649 int SSL_CTX_set_ssl_version(SSL_CTX *ctx, const SSL_METHOD *meth)
650 {
651 STACK_OF(SSL_CIPHER) *sk;
652
653 ctx->method = meth;
654
655 if (!SSL_CTX_set_ciphersuites(ctx, OSSL_default_ciphersuites())) {
656 ERR_raise(ERR_LIB_SSL, SSL_R_SSL_LIBRARY_HAS_NO_CIPHERS);
657 return 0;
658 }
659 sk = ssl_create_cipher_list(ctx,
660 ctx->tls13_ciphersuites,
661 &(ctx->cipher_list),
662 &(ctx->cipher_list_by_id),
663 OSSL_default_cipher_list(), ctx->cert);
664 if ((sk == NULL) || (sk_SSL_CIPHER_num(sk) <= 0)) {
665 ERR_raise(ERR_LIB_SSL, SSL_R_SSL_LIBRARY_HAS_NO_CIPHERS);
666 return 0;
667 }
668 return 1;
669 }
670 #endif
671
SSL_new(SSL_CTX * ctx)672 SSL *SSL_new(SSL_CTX *ctx)
673 {
674 SSL *s;
675
676 if (ctx == NULL) {
677 ERR_raise(ERR_LIB_SSL, SSL_R_NULL_SSL_CTX);
678 return NULL;
679 }
680 if (ctx->method == NULL) {
681 ERR_raise(ERR_LIB_SSL, SSL_R_SSL_CTX_HAS_NO_DEFAULT_SSL_VERSION);
682 return NULL;
683 }
684
685 s = OPENSSL_zalloc(sizeof(*s));
686 if (s == NULL)
687 goto err;
688
689 s->references = 1;
690 s->lock = CRYPTO_THREAD_lock_new();
691 if (s->lock == NULL) {
692 OPENSSL_free(s);
693 s = NULL;
694 goto err;
695 }
696
697 RECORD_LAYER_init(&s->rlayer, s);
698
699 s->options = ctx->options;
700 s->dane.flags = ctx->dane.flags;
701 s->min_proto_version = ctx->min_proto_version;
702 s->max_proto_version = ctx->max_proto_version;
703 s->mode = ctx->mode;
704 s->max_cert_list = ctx->max_cert_list;
705 s->max_early_data = ctx->max_early_data;
706 s->recv_max_early_data = ctx->recv_max_early_data;
707 s->num_tickets = ctx->num_tickets;
708 s->pha_enabled = ctx->pha_enabled;
709
710 /* Shallow copy of the ciphersuites stack */
711 s->tls13_ciphersuites = sk_SSL_CIPHER_dup(ctx->tls13_ciphersuites);
712 if (s->tls13_ciphersuites == NULL)
713 goto err;
714
715 /*
716 * Earlier library versions used to copy the pointer to the CERT, not
717 * its contents; only when setting new parameters for the per-SSL
718 * copy, ssl_cert_new would be called (and the direct reference to
719 * the per-SSL_CTX settings would be lost, but those still were
720 * indirectly accessed for various purposes, and for that reason they
721 * used to be known as s->ctx->default_cert). Now we don't look at the
722 * SSL_CTX's CERT after having duplicated it once.
723 */
724 s->cert = ssl_cert_dup(ctx->cert);
725 if (s->cert == NULL)
726 goto err;
727
728 RECORD_LAYER_set_read_ahead(&s->rlayer, ctx->read_ahead);
729 s->msg_callback = ctx->msg_callback;
730 s->msg_callback_arg = ctx->msg_callback_arg;
731 s->verify_mode = ctx->verify_mode;
732 s->not_resumable_session_cb = ctx->not_resumable_session_cb;
733 s->record_padding_cb = ctx->record_padding_cb;
734 s->record_padding_arg = ctx->record_padding_arg;
735 s->block_padding = ctx->block_padding;
736 s->sid_ctx_length = ctx->sid_ctx_length;
737 if (!ossl_assert(s->sid_ctx_length <= sizeof(s->sid_ctx)))
738 goto err;
739 memcpy(&s->sid_ctx, &ctx->sid_ctx, sizeof(s->sid_ctx));
740 s->verify_callback = ctx->default_verify_callback;
741 s->generate_session_id = ctx->generate_session_id;
742
743 s->param = X509_VERIFY_PARAM_new();
744 if (s->param == NULL)
745 goto err;
746 X509_VERIFY_PARAM_inherit(s->param, ctx->param);
747 s->quiet_shutdown = ctx->quiet_shutdown;
748
749 s->ext.max_fragment_len_mode = ctx->ext.max_fragment_len_mode;
750 s->max_send_fragment = ctx->max_send_fragment;
751 s->split_send_fragment = ctx->split_send_fragment;
752 s->max_pipelines = ctx->max_pipelines;
753 if (s->max_pipelines > 1)
754 RECORD_LAYER_set_read_ahead(&s->rlayer, 1);
755 if (ctx->default_read_buf_len > 0)
756 SSL_set_default_read_buffer_len(s, ctx->default_read_buf_len);
757
758 SSL_CTX_up_ref(ctx);
759 s->ctx = ctx;
760 s->ext.debug_cb = 0;
761 s->ext.debug_arg = NULL;
762 s->ext.ticket_expected = 0;
763 s->ext.status_type = ctx->ext.status_type;
764 s->ext.status_expected = 0;
765 s->ext.ocsp.ids = NULL;
766 s->ext.ocsp.exts = NULL;
767 s->ext.ocsp.resp = NULL;
768 s->ext.ocsp.resp_len = 0;
769 SSL_CTX_up_ref(ctx);
770 s->session_ctx = ctx;
771 if (ctx->ext.ecpointformats) {
772 s->ext.ecpointformats =
773 OPENSSL_memdup(ctx->ext.ecpointformats,
774 ctx->ext.ecpointformats_len);
775 if (!s->ext.ecpointformats) {
776 s->ext.ecpointformats_len = 0;
777 goto err;
778 }
779 s->ext.ecpointformats_len =
780 ctx->ext.ecpointformats_len;
781 }
782 if (ctx->ext.supportedgroups) {
783 s->ext.supportedgroups =
784 OPENSSL_memdup(ctx->ext.supportedgroups,
785 ctx->ext.supportedgroups_len
786 * sizeof(*ctx->ext.supportedgroups));
787 if (!s->ext.supportedgroups) {
788 s->ext.supportedgroups_len = 0;
789 goto err;
790 }
791 s->ext.supportedgroups_len = ctx->ext.supportedgroups_len;
792 }
793
794 #ifndef OPENSSL_NO_NEXTPROTONEG
795 s->ext.npn = NULL;
796 #endif
797
798 if (s->ctx->ext.alpn) {
799 s->ext.alpn = OPENSSL_malloc(s->ctx->ext.alpn_len);
800 if (s->ext.alpn == NULL) {
801 s->ext.alpn_len = 0;
802 goto err;
803 }
804 memcpy(s->ext.alpn, s->ctx->ext.alpn, s->ctx->ext.alpn_len);
805 s->ext.alpn_len = s->ctx->ext.alpn_len;
806 }
807
808 s->verified_chain = NULL;
809 s->verify_result = X509_V_OK;
810
811 s->default_passwd_callback = ctx->default_passwd_callback;
812 s->default_passwd_callback_userdata = ctx->default_passwd_callback_userdata;
813
814 s->method = ctx->method;
815
816 s->key_update = SSL_KEY_UPDATE_NONE;
817
818 s->allow_early_data_cb = ctx->allow_early_data_cb;
819 s->allow_early_data_cb_data = ctx->allow_early_data_cb_data;
820
821 if (!s->method->ssl_new(s))
822 goto err;
823
824 s->server = (ctx->method->ssl_accept == ssl_undefined_function) ? 0 : 1;
825
826 if (!SSL_clear(s))
827 goto err;
828
829 if (!CRYPTO_new_ex_data(CRYPTO_EX_INDEX_SSL, s, &s->ex_data))
830 goto err;
831
832 #ifndef OPENSSL_NO_PSK
833 s->psk_client_callback = ctx->psk_client_callback;
834 s->psk_server_callback = ctx->psk_server_callback;
835 #endif
836 s->psk_find_session_cb = ctx->psk_find_session_cb;
837 s->psk_use_session_cb = ctx->psk_use_session_cb;
838
839 s->async_cb = ctx->async_cb;
840 s->async_cb_arg = ctx->async_cb_arg;
841
842 s->job = NULL;
843
844 #ifndef OPENSSL_NO_CT
845 if (!SSL_set_ct_validation_callback(s, ctx->ct_validation_callback,
846 ctx->ct_validation_callback_arg))
847 goto err;
848 #endif
849
850 return s;
851 err:
852 SSL_free(s);
853 ERR_raise(ERR_LIB_SSL, ERR_R_MALLOC_FAILURE);
854 return NULL;
855 }
856
SSL_is_dtls(const SSL * s)857 int SSL_is_dtls(const SSL *s)
858 {
859 return SSL_IS_DTLS(s) ? 1 : 0;
860 }
861
SSL_up_ref(SSL * s)862 int SSL_up_ref(SSL *s)
863 {
864 int i;
865
866 if (CRYPTO_UP_REF(&s->references, &i, s->lock) <= 0)
867 return 0;
868
869 REF_PRINT_COUNT("SSL", s);
870 REF_ASSERT_ISNT(i < 2);
871 return ((i > 1) ? 1 : 0);
872 }
873
SSL_CTX_set_session_id_context(SSL_CTX * ctx,const unsigned char * sid_ctx,unsigned int sid_ctx_len)874 int SSL_CTX_set_session_id_context(SSL_CTX *ctx, const unsigned char *sid_ctx,
875 unsigned int sid_ctx_len)
876 {
877 if (sid_ctx_len > SSL_MAX_SID_CTX_LENGTH) {
878 ERR_raise(ERR_LIB_SSL, SSL_R_SSL_SESSION_ID_CONTEXT_TOO_LONG);
879 return 0;
880 }
881 ctx->sid_ctx_length = sid_ctx_len;
882 memcpy(ctx->sid_ctx, sid_ctx, sid_ctx_len);
883
884 return 1;
885 }
886
SSL_set_session_id_context(SSL * ssl,const unsigned char * sid_ctx,unsigned int sid_ctx_len)887 int SSL_set_session_id_context(SSL *ssl, const unsigned char *sid_ctx,
888 unsigned int sid_ctx_len)
889 {
890 if (sid_ctx_len > SSL_MAX_SID_CTX_LENGTH) {
891 ERR_raise(ERR_LIB_SSL, SSL_R_SSL_SESSION_ID_CONTEXT_TOO_LONG);
892 return 0;
893 }
894 ssl->sid_ctx_length = sid_ctx_len;
895 memcpy(ssl->sid_ctx, sid_ctx, sid_ctx_len);
896
897 return 1;
898 }
899
SSL_CTX_set_generate_session_id(SSL_CTX * ctx,GEN_SESSION_CB cb)900 int SSL_CTX_set_generate_session_id(SSL_CTX *ctx, GEN_SESSION_CB cb)
901 {
902 if (!CRYPTO_THREAD_write_lock(ctx->lock))
903 return 0;
904 ctx->generate_session_id = cb;
905 CRYPTO_THREAD_unlock(ctx->lock);
906 return 1;
907 }
908
SSL_set_generate_session_id(SSL * ssl,GEN_SESSION_CB cb)909 int SSL_set_generate_session_id(SSL *ssl, GEN_SESSION_CB cb)
910 {
911 if (!CRYPTO_THREAD_write_lock(ssl->lock))
912 return 0;
913 ssl->generate_session_id = cb;
914 CRYPTO_THREAD_unlock(ssl->lock);
915 return 1;
916 }
917
SSL_has_matching_session_id(const SSL * ssl,const unsigned char * id,unsigned int id_len)918 int SSL_has_matching_session_id(const SSL *ssl, const unsigned char *id,
919 unsigned int id_len)
920 {
921 /*
922 * A quick examination of SSL_SESSION_hash and SSL_SESSION_cmp shows how
923 * we can "construct" a session to give us the desired check - i.e. to
924 * find if there's a session in the hash table that would conflict with
925 * any new session built out of this id/id_len and the ssl_version in use
926 * by this SSL.
927 */
928 SSL_SESSION r, *p;
929
930 if (id_len > sizeof(r.session_id))
931 return 0;
932
933 r.ssl_version = ssl->version;
934 r.session_id_length = id_len;
935 memcpy(r.session_id, id, id_len);
936
937 if (!CRYPTO_THREAD_read_lock(ssl->session_ctx->lock))
938 return 0;
939 p = lh_SSL_SESSION_retrieve(ssl->session_ctx->sessions, &r);
940 CRYPTO_THREAD_unlock(ssl->session_ctx->lock);
941 return (p != NULL);
942 }
943
SSL_CTX_set_purpose(SSL_CTX * s,int purpose)944 int SSL_CTX_set_purpose(SSL_CTX *s, int purpose)
945 {
946 return X509_VERIFY_PARAM_set_purpose(s->param, purpose);
947 }
948
SSL_set_purpose(SSL * s,int purpose)949 int SSL_set_purpose(SSL *s, int purpose)
950 {
951 return X509_VERIFY_PARAM_set_purpose(s->param, purpose);
952 }
953
SSL_CTX_set_trust(SSL_CTX * s,int trust)954 int SSL_CTX_set_trust(SSL_CTX *s, int trust)
955 {
956 return X509_VERIFY_PARAM_set_trust(s->param, trust);
957 }
958
SSL_set_trust(SSL * s,int trust)959 int SSL_set_trust(SSL *s, int trust)
960 {
961 return X509_VERIFY_PARAM_set_trust(s->param, trust);
962 }
963
SSL_set1_host(SSL * s,const char * hostname)964 int SSL_set1_host(SSL *s, const char *hostname)
965 {
966 /* If a hostname is provided and parses as an IP address,
967 * treat it as such. */
968 if (hostname && X509_VERIFY_PARAM_set1_ip_asc(s->param, hostname) == 1)
969 return 1;
970
971 return X509_VERIFY_PARAM_set1_host(s->param, hostname, 0);
972 }
973
SSL_add1_host(SSL * s,const char * hostname)974 int SSL_add1_host(SSL *s, const char *hostname)
975 {
976 /* If a hostname is provided and parses as an IP address,
977 * treat it as such. */
978 if (hostname)
979 {
980 ASN1_OCTET_STRING *ip;
981 char *old_ip;
982
983 ip = a2i_IPADDRESS(hostname);
984 if (ip) {
985 /* We didn't want it; only to check if it *is* an IP address */
986 ASN1_OCTET_STRING_free(ip);
987
988 old_ip = X509_VERIFY_PARAM_get1_ip_asc(s->param);
989 if (old_ip)
990 {
991 OPENSSL_free(old_ip);
992 /* There can be only one IP address */
993 return 0;
994 }
995
996 return X509_VERIFY_PARAM_set1_ip_asc(s->param, hostname);
997 }
998 }
999
1000 return X509_VERIFY_PARAM_add1_host(s->param, hostname, 0);
1001 }
1002
SSL_set_hostflags(SSL * s,unsigned int flags)1003 void SSL_set_hostflags(SSL *s, unsigned int flags)
1004 {
1005 X509_VERIFY_PARAM_set_hostflags(s->param, flags);
1006 }
1007
SSL_get0_peername(SSL * s)1008 const char *SSL_get0_peername(SSL *s)
1009 {
1010 return X509_VERIFY_PARAM_get0_peername(s->param);
1011 }
1012
SSL_CTX_dane_enable(SSL_CTX * ctx)1013 int SSL_CTX_dane_enable(SSL_CTX *ctx)
1014 {
1015 return dane_ctx_enable(&ctx->dane);
1016 }
1017
SSL_CTX_dane_set_flags(SSL_CTX * ctx,unsigned long flags)1018 unsigned long SSL_CTX_dane_set_flags(SSL_CTX *ctx, unsigned long flags)
1019 {
1020 unsigned long orig = ctx->dane.flags;
1021
1022 ctx->dane.flags |= flags;
1023 return orig;
1024 }
1025
SSL_CTX_dane_clear_flags(SSL_CTX * ctx,unsigned long flags)1026 unsigned long SSL_CTX_dane_clear_flags(SSL_CTX *ctx, unsigned long flags)
1027 {
1028 unsigned long orig = ctx->dane.flags;
1029
1030 ctx->dane.flags &= ~flags;
1031 return orig;
1032 }
1033
SSL_dane_enable(SSL * s,const char * basedomain)1034 int SSL_dane_enable(SSL *s, const char *basedomain)
1035 {
1036 SSL_DANE *dane = &s->dane;
1037
1038 if (s->ctx->dane.mdmax == 0) {
1039 ERR_raise(ERR_LIB_SSL, SSL_R_CONTEXT_NOT_DANE_ENABLED);
1040 return 0;
1041 }
1042 if (dane->trecs != NULL) {
1043 ERR_raise(ERR_LIB_SSL, SSL_R_DANE_ALREADY_ENABLED);
1044 return 0;
1045 }
1046
1047 /*
1048 * Default SNI name. This rejects empty names, while set1_host below
1049 * accepts them and disables host name checks. To avoid side-effects with
1050 * invalid input, set the SNI name first.
1051 */
1052 if (s->ext.hostname == NULL) {
1053 if (!SSL_set_tlsext_host_name(s, basedomain)) {
1054 ERR_raise(ERR_LIB_SSL, SSL_R_ERROR_SETTING_TLSA_BASE_DOMAIN);
1055 return -1;
1056 }
1057 }
1058
1059 /* Primary RFC6125 reference identifier */
1060 if (!X509_VERIFY_PARAM_set1_host(s->param, basedomain, 0)) {
1061 ERR_raise(ERR_LIB_SSL, SSL_R_ERROR_SETTING_TLSA_BASE_DOMAIN);
1062 return -1;
1063 }
1064
1065 dane->mdpth = -1;
1066 dane->pdpth = -1;
1067 dane->dctx = &s->ctx->dane;
1068 dane->trecs = sk_danetls_record_new_null();
1069
1070 if (dane->trecs == NULL) {
1071 ERR_raise(ERR_LIB_SSL, ERR_R_MALLOC_FAILURE);
1072 return -1;
1073 }
1074 return 1;
1075 }
1076
SSL_dane_set_flags(SSL * ssl,unsigned long flags)1077 unsigned long SSL_dane_set_flags(SSL *ssl, unsigned long flags)
1078 {
1079 unsigned long orig = ssl->dane.flags;
1080
1081 ssl->dane.flags |= flags;
1082 return orig;
1083 }
1084
SSL_dane_clear_flags(SSL * ssl,unsigned long flags)1085 unsigned long SSL_dane_clear_flags(SSL *ssl, unsigned long flags)
1086 {
1087 unsigned long orig = ssl->dane.flags;
1088
1089 ssl->dane.flags &= ~flags;
1090 return orig;
1091 }
1092
SSL_get0_dane_authority(SSL * s,X509 ** mcert,EVP_PKEY ** mspki)1093 int SSL_get0_dane_authority(SSL *s, X509 **mcert, EVP_PKEY **mspki)
1094 {
1095 SSL_DANE *dane = &s->dane;
1096
1097 if (!DANETLS_ENABLED(dane) || s->verify_result != X509_V_OK)
1098 return -1;
1099 if (dane->mtlsa) {
1100 if (mcert)
1101 *mcert = dane->mcert;
1102 if (mspki)
1103 *mspki = (dane->mcert == NULL) ? dane->mtlsa->spki : NULL;
1104 }
1105 return dane->mdpth;
1106 }
1107
SSL_get0_dane_tlsa(SSL * s,uint8_t * usage,uint8_t * selector,uint8_t * mtype,const unsigned char ** data,size_t * dlen)1108 int SSL_get0_dane_tlsa(SSL *s, uint8_t *usage, uint8_t *selector,
1109 uint8_t *mtype, const unsigned char **data, size_t *dlen)
1110 {
1111 SSL_DANE *dane = &s->dane;
1112
1113 if (!DANETLS_ENABLED(dane) || s->verify_result != X509_V_OK)
1114 return -1;
1115 if (dane->mtlsa) {
1116 if (usage)
1117 *usage = dane->mtlsa->usage;
1118 if (selector)
1119 *selector = dane->mtlsa->selector;
1120 if (mtype)
1121 *mtype = dane->mtlsa->mtype;
1122 if (data)
1123 *data = dane->mtlsa->data;
1124 if (dlen)
1125 *dlen = dane->mtlsa->dlen;
1126 }
1127 return dane->mdpth;
1128 }
1129
SSL_get0_dane(SSL * s)1130 SSL_DANE *SSL_get0_dane(SSL *s)
1131 {
1132 return &s->dane;
1133 }
1134
SSL_dane_tlsa_add(SSL * s,uint8_t usage,uint8_t selector,uint8_t mtype,const unsigned char * data,size_t dlen)1135 int SSL_dane_tlsa_add(SSL *s, uint8_t usage, uint8_t selector,
1136 uint8_t mtype, const unsigned char *data, size_t dlen)
1137 {
1138 return dane_tlsa_add(&s->dane, usage, selector, mtype, data, dlen);
1139 }
1140
SSL_CTX_dane_mtype_set(SSL_CTX * ctx,const EVP_MD * md,uint8_t mtype,uint8_t ord)1141 int SSL_CTX_dane_mtype_set(SSL_CTX *ctx, const EVP_MD *md, uint8_t mtype,
1142 uint8_t ord)
1143 {
1144 return dane_mtype_set(&ctx->dane, md, mtype, ord);
1145 }
1146
SSL_CTX_set1_param(SSL_CTX * ctx,X509_VERIFY_PARAM * vpm)1147 int SSL_CTX_set1_param(SSL_CTX *ctx, X509_VERIFY_PARAM *vpm)
1148 {
1149 return X509_VERIFY_PARAM_set1(ctx->param, vpm);
1150 }
1151
SSL_set1_param(SSL * ssl,X509_VERIFY_PARAM * vpm)1152 int SSL_set1_param(SSL *ssl, X509_VERIFY_PARAM *vpm)
1153 {
1154 return X509_VERIFY_PARAM_set1(ssl->param, vpm);
1155 }
1156
SSL_CTX_get0_param(SSL_CTX * ctx)1157 X509_VERIFY_PARAM *SSL_CTX_get0_param(SSL_CTX *ctx)
1158 {
1159 return ctx->param;
1160 }
1161
SSL_get0_param(SSL * ssl)1162 X509_VERIFY_PARAM *SSL_get0_param(SSL *ssl)
1163 {
1164 return ssl->param;
1165 }
1166
SSL_certs_clear(SSL * s)1167 void SSL_certs_clear(SSL *s)
1168 {
1169 ssl_cert_clear_certs(s->cert);
1170 }
1171
SSL_free(SSL * s)1172 void SSL_free(SSL *s)
1173 {
1174 int i;
1175
1176 if (s == NULL)
1177 return;
1178 CRYPTO_DOWN_REF(&s->references, &i, s->lock);
1179 REF_PRINT_COUNT("SSL", s);
1180 if (i > 0)
1181 return;
1182 REF_ASSERT_ISNT(i < 0);
1183
1184 X509_VERIFY_PARAM_free(s->param);
1185 dane_final(&s->dane);
1186 CRYPTO_free_ex_data(CRYPTO_EX_INDEX_SSL, s, &s->ex_data);
1187
1188 RECORD_LAYER_release(&s->rlayer);
1189
1190 /* Ignore return value */
1191 ssl_free_wbio_buffer(s);
1192
1193 BIO_free_all(s->wbio);
1194 s->wbio = NULL;
1195 BIO_free_all(s->rbio);
1196 s->rbio = NULL;
1197
1198 BUF_MEM_free(s->init_buf);
1199
1200 /* add extra stuff */
1201 sk_SSL_CIPHER_free(s->cipher_list);
1202 sk_SSL_CIPHER_free(s->cipher_list_by_id);
1203 sk_SSL_CIPHER_free(s->tls13_ciphersuites);
1204 sk_SSL_CIPHER_free(s->peer_ciphers);
1205
1206 /* Make the next call work :-) */
1207 if (s->session != NULL) {
1208 ssl_clear_bad_session(s);
1209 SSL_SESSION_free(s->session);
1210 }
1211 SSL_SESSION_free(s->psksession);
1212 OPENSSL_free(s->psksession_id);
1213
1214 clear_ciphers(s);
1215
1216 ssl_cert_free(s->cert);
1217 OPENSSL_free(s->shared_sigalgs);
1218 /* Free up if allocated */
1219
1220 OPENSSL_free(s->ext.hostname);
1221 SSL_CTX_free(s->session_ctx);
1222 OPENSSL_free(s->ext.ecpointformats);
1223 OPENSSL_free(s->ext.peer_ecpointformats);
1224 OPENSSL_free(s->ext.supportedgroups);
1225 OPENSSL_free(s->ext.peer_supportedgroups);
1226 sk_X509_EXTENSION_pop_free(s->ext.ocsp.exts, X509_EXTENSION_free);
1227 #ifndef OPENSSL_NO_OCSP
1228 sk_OCSP_RESPID_pop_free(s->ext.ocsp.ids, OCSP_RESPID_free);
1229 #endif
1230 #ifndef OPENSSL_NO_CT
1231 SCT_LIST_free(s->scts);
1232 OPENSSL_free(s->ext.scts);
1233 #endif
1234 OPENSSL_free(s->ext.ocsp.resp);
1235 OPENSSL_free(s->ext.alpn);
1236 OPENSSL_free(s->ext.tls13_cookie);
1237 if (s->clienthello != NULL)
1238 OPENSSL_free(s->clienthello->pre_proc_exts);
1239 OPENSSL_free(s->clienthello);
1240 OPENSSL_free(s->pha_context);
1241 EVP_MD_CTX_free(s->pha_dgst);
1242
1243 sk_X509_NAME_pop_free(s->ca_names, X509_NAME_free);
1244 sk_X509_NAME_pop_free(s->client_ca_names, X509_NAME_free);
1245
1246 sk_X509_pop_free(s->verified_chain, X509_free);
1247
1248 if (s->method != NULL)
1249 s->method->ssl_free(s);
1250
1251 SSL_CTX_free(s->ctx);
1252
1253 ASYNC_WAIT_CTX_free(s->waitctx);
1254
1255 #if !defined(OPENSSL_NO_NEXTPROTONEG)
1256 OPENSSL_free(s->ext.npn);
1257 #endif
1258
1259 #ifndef OPENSSL_NO_SRTP
1260 sk_SRTP_PROTECTION_PROFILE_free(s->srtp_profiles);
1261 #endif
1262
1263 CRYPTO_THREAD_lock_free(s->lock);
1264
1265 OPENSSL_free(s);
1266 }
1267
SSL_set0_rbio(SSL * s,BIO * rbio)1268 void SSL_set0_rbio(SSL *s, BIO *rbio)
1269 {
1270 BIO_free_all(s->rbio);
1271 s->rbio = rbio;
1272 }
1273
SSL_set0_wbio(SSL * s,BIO * wbio)1274 void SSL_set0_wbio(SSL *s, BIO *wbio)
1275 {
1276 /*
1277 * If the output buffering BIO is still in place, remove it
1278 */
1279 if (s->bbio != NULL)
1280 s->wbio = BIO_pop(s->wbio);
1281
1282 BIO_free_all(s->wbio);
1283 s->wbio = wbio;
1284
1285 /* Re-attach |bbio| to the new |wbio|. */
1286 if (s->bbio != NULL)
1287 s->wbio = BIO_push(s->bbio, s->wbio);
1288 }
1289
SSL_set_bio(SSL * s,BIO * rbio,BIO * wbio)1290 void SSL_set_bio(SSL *s, BIO *rbio, BIO *wbio)
1291 {
1292 /*
1293 * For historical reasons, this function has many different cases in
1294 * ownership handling.
1295 */
1296
1297 /* If nothing has changed, do nothing */
1298 if (rbio == SSL_get_rbio(s) && wbio == SSL_get_wbio(s))
1299 return;
1300
1301 /*
1302 * If the two arguments are equal then one fewer reference is granted by the
1303 * caller than we want to take
1304 */
1305 if (rbio != NULL && rbio == wbio)
1306 BIO_up_ref(rbio);
1307
1308 /*
1309 * If only the wbio is changed only adopt one reference.
1310 */
1311 if (rbio == SSL_get_rbio(s)) {
1312 SSL_set0_wbio(s, wbio);
1313 return;
1314 }
1315 /*
1316 * There is an asymmetry here for historical reasons. If only the rbio is
1317 * changed AND the rbio and wbio were originally different, then we only
1318 * adopt one reference.
1319 */
1320 if (wbio == SSL_get_wbio(s) && SSL_get_rbio(s) != SSL_get_wbio(s)) {
1321 SSL_set0_rbio(s, rbio);
1322 return;
1323 }
1324
1325 /* Otherwise, adopt both references. */
1326 SSL_set0_rbio(s, rbio);
1327 SSL_set0_wbio(s, wbio);
1328 }
1329
SSL_get_rbio(const SSL * s)1330 BIO *SSL_get_rbio(const SSL *s)
1331 {
1332 return s->rbio;
1333 }
1334
SSL_get_wbio(const SSL * s)1335 BIO *SSL_get_wbio(const SSL *s)
1336 {
1337 if (s->bbio != NULL) {
1338 /*
1339 * If |bbio| is active, the true caller-configured BIO is its
1340 * |next_bio|.
1341 */
1342 return BIO_next(s->bbio);
1343 }
1344 return s->wbio;
1345 }
1346
SSL_get_fd(const SSL * s)1347 int SSL_get_fd(const SSL *s)
1348 {
1349 return SSL_get_rfd(s);
1350 }
1351
SSL_get_rfd(const SSL * s)1352 int SSL_get_rfd(const SSL *s)
1353 {
1354 int ret = -1;
1355 BIO *b, *r;
1356
1357 b = SSL_get_rbio(s);
1358 r = BIO_find_type(b, BIO_TYPE_DESCRIPTOR);
1359 if (r != NULL)
1360 BIO_get_fd(r, &ret);
1361 return ret;
1362 }
1363
SSL_get_wfd(const SSL * s)1364 int SSL_get_wfd(const SSL *s)
1365 {
1366 int ret = -1;
1367 BIO *b, *r;
1368
1369 b = SSL_get_wbio(s);
1370 r = BIO_find_type(b, BIO_TYPE_DESCRIPTOR);
1371 if (r != NULL)
1372 BIO_get_fd(r, &ret);
1373 return ret;
1374 }
1375
1376 #ifndef OPENSSL_NO_SOCK
SSL_set_fd(SSL * s,int fd)1377 int SSL_set_fd(SSL *s, int fd)
1378 {
1379 int ret = 0;
1380 BIO *bio = NULL;
1381
1382 bio = BIO_new(BIO_s_socket());
1383
1384 if (bio == NULL) {
1385 ERR_raise(ERR_LIB_SSL, ERR_R_BUF_LIB);
1386 goto err;
1387 }
1388 BIO_set_fd(bio, fd, BIO_NOCLOSE);
1389 SSL_set_bio(s, bio, bio);
1390 #ifndef OPENSSL_NO_KTLS
1391 /*
1392 * The new socket is created successfully regardless of ktls_enable.
1393 * ktls_enable doesn't change any functionality of the socket, except
1394 * changing the setsockopt to enable the processing of ktls_start.
1395 * Thus, it is not a problem to call it for non-TLS sockets.
1396 */
1397 ktls_enable(fd);
1398 #endif /* OPENSSL_NO_KTLS */
1399 ret = 1;
1400 err:
1401 return ret;
1402 }
1403
SSL_set_wfd(SSL * s,int fd)1404 int SSL_set_wfd(SSL *s, int fd)
1405 {
1406 BIO *rbio = SSL_get_rbio(s);
1407
1408 if (rbio == NULL || BIO_method_type(rbio) != BIO_TYPE_SOCKET
1409 || (int)BIO_get_fd(rbio, NULL) != fd) {
1410 BIO *bio = BIO_new(BIO_s_socket());
1411
1412 if (bio == NULL) {
1413 ERR_raise(ERR_LIB_SSL, ERR_R_BUF_LIB);
1414 return 0;
1415 }
1416 BIO_set_fd(bio, fd, BIO_NOCLOSE);
1417 SSL_set0_wbio(s, bio);
1418 #ifndef OPENSSL_NO_KTLS
1419 /*
1420 * The new socket is created successfully regardless of ktls_enable.
1421 * ktls_enable doesn't change any functionality of the socket, except
1422 * changing the setsockopt to enable the processing of ktls_start.
1423 * Thus, it is not a problem to call it for non-TLS sockets.
1424 */
1425 ktls_enable(fd);
1426 #endif /* OPENSSL_NO_KTLS */
1427 } else {
1428 BIO_up_ref(rbio);
1429 SSL_set0_wbio(s, rbio);
1430 }
1431 return 1;
1432 }
1433
SSL_set_rfd(SSL * s,int fd)1434 int SSL_set_rfd(SSL *s, int fd)
1435 {
1436 BIO *wbio = SSL_get_wbio(s);
1437
1438 if (wbio == NULL || BIO_method_type(wbio) != BIO_TYPE_SOCKET
1439 || ((int)BIO_get_fd(wbio, NULL) != fd)) {
1440 BIO *bio = BIO_new(BIO_s_socket());
1441
1442 if (bio == NULL) {
1443 ERR_raise(ERR_LIB_SSL, ERR_R_BUF_LIB);
1444 return 0;
1445 }
1446 BIO_set_fd(bio, fd, BIO_NOCLOSE);
1447 SSL_set0_rbio(s, bio);
1448 } else {
1449 BIO_up_ref(wbio);
1450 SSL_set0_rbio(s, wbio);
1451 }
1452
1453 return 1;
1454 }
1455 #endif
1456
1457 /* return length of latest Finished message we sent, copy to 'buf' */
SSL_get_finished(const SSL * s,void * buf,size_t count)1458 size_t SSL_get_finished(const SSL *s, void *buf, size_t count)
1459 {
1460 size_t ret = 0;
1461
1462 ret = s->s3.tmp.finish_md_len;
1463 if (count > ret)
1464 count = ret;
1465 memcpy(buf, s->s3.tmp.finish_md, count);
1466 return ret;
1467 }
1468
1469 /* return length of latest Finished message we expected, copy to 'buf' */
SSL_get_peer_finished(const SSL * s,void * buf,size_t count)1470 size_t SSL_get_peer_finished(const SSL *s, void *buf, size_t count)
1471 {
1472 size_t ret = 0;
1473
1474 ret = s->s3.tmp.peer_finish_md_len;
1475 if (count > ret)
1476 count = ret;
1477 memcpy(buf, s->s3.tmp.peer_finish_md, count);
1478 return ret;
1479 }
1480
SSL_get_verify_mode(const SSL * s)1481 int SSL_get_verify_mode(const SSL *s)
1482 {
1483 return s->verify_mode;
1484 }
1485
SSL_get_verify_depth(const SSL * s)1486 int SSL_get_verify_depth(const SSL *s)
1487 {
1488 return X509_VERIFY_PARAM_get_depth(s->param);
1489 }
1490
SSL_get_verify_callback(const SSL * s)1491 int (*SSL_get_verify_callback(const SSL *s)) (int, X509_STORE_CTX *) {
1492 return s->verify_callback;
1493 }
1494
SSL_CTX_get_verify_mode(const SSL_CTX * ctx)1495 int SSL_CTX_get_verify_mode(const SSL_CTX *ctx)
1496 {
1497 return ctx->verify_mode;
1498 }
1499
SSL_CTX_get_verify_depth(const SSL_CTX * ctx)1500 int SSL_CTX_get_verify_depth(const SSL_CTX *ctx)
1501 {
1502 return X509_VERIFY_PARAM_get_depth(ctx->param);
1503 }
1504
SSL_CTX_get_verify_callback(const SSL_CTX * ctx)1505 int (*SSL_CTX_get_verify_callback(const SSL_CTX *ctx)) (int, X509_STORE_CTX *) {
1506 return ctx->default_verify_callback;
1507 }
1508
SSL_set_verify(SSL * s,int mode,int (* callback)(int ok,X509_STORE_CTX * ctx))1509 void SSL_set_verify(SSL *s, int mode,
1510 int (*callback) (int ok, X509_STORE_CTX *ctx))
1511 {
1512 s->verify_mode = mode;
1513 if (callback != NULL)
1514 s->verify_callback = callback;
1515 }
1516
SSL_set_verify_depth(SSL * s,int depth)1517 void SSL_set_verify_depth(SSL *s, int depth)
1518 {
1519 X509_VERIFY_PARAM_set_depth(s->param, depth);
1520 }
1521
SSL_set_read_ahead(SSL * s,int yes)1522 void SSL_set_read_ahead(SSL *s, int yes)
1523 {
1524 RECORD_LAYER_set_read_ahead(&s->rlayer, yes);
1525 }
1526
SSL_get_read_ahead(const SSL * s)1527 int SSL_get_read_ahead(const SSL *s)
1528 {
1529 return RECORD_LAYER_get_read_ahead(&s->rlayer);
1530 }
1531
SSL_pending(const SSL * s)1532 int SSL_pending(const SSL *s)
1533 {
1534 size_t pending = s->method->ssl_pending(s);
1535
1536 /*
1537 * SSL_pending cannot work properly if read-ahead is enabled
1538 * (SSL_[CTX_]ctrl(..., SSL_CTRL_SET_READ_AHEAD, 1, NULL)), and it is
1539 * impossible to fix since SSL_pending cannot report errors that may be
1540 * observed while scanning the new data. (Note that SSL_pending() is
1541 * often used as a boolean value, so we'd better not return -1.)
1542 *
1543 * SSL_pending also cannot work properly if the value >INT_MAX. In that case
1544 * we just return INT_MAX.
1545 */
1546 return pending < INT_MAX ? (int)pending : INT_MAX;
1547 }
1548
SSL_has_pending(const SSL * s)1549 int SSL_has_pending(const SSL *s)
1550 {
1551 /*
1552 * Similar to SSL_pending() but returns a 1 to indicate that we have
1553 * unprocessed data available or 0 otherwise (as opposed to the number of
1554 * bytes available). Unlike SSL_pending() this will take into account
1555 * read_ahead data. A 1 return simply indicates that we have unprocessed
1556 * data. That data may not result in any application data, or we may fail
1557 * to parse the records for some reason.
1558 */
1559 if (RECORD_LAYER_processed_read_pending(&s->rlayer))
1560 return 1;
1561
1562 return RECORD_LAYER_read_pending(&s->rlayer);
1563 }
1564
SSL_get1_peer_certificate(const SSL * s)1565 X509 *SSL_get1_peer_certificate(const SSL *s)
1566 {
1567 X509 *r = SSL_get0_peer_certificate(s);
1568
1569 if (r != NULL)
1570 X509_up_ref(r);
1571
1572 return r;
1573 }
1574
SSL_get0_peer_certificate(const SSL * s)1575 X509 *SSL_get0_peer_certificate(const SSL *s)
1576 {
1577 if ((s == NULL) || (s->session == NULL))
1578 return NULL;
1579 else
1580 return s->session->peer;
1581 }
1582
STACK_OF(X509)1583 STACK_OF(X509) *SSL_get_peer_cert_chain(const SSL *s)
1584 {
1585 STACK_OF(X509) *r;
1586
1587 if ((s == NULL) || (s->session == NULL))
1588 r = NULL;
1589 else
1590 r = s->session->peer_chain;
1591
1592 /*
1593 * If we are a client, cert_chain includes the peer's own certificate; if
1594 * we are a server, it does not.
1595 */
1596
1597 return r;
1598 }
1599
1600 /*
1601 * Now in theory, since the calling process own 't' it should be safe to
1602 * modify. We need to be able to read f without being hassled
1603 */
SSL_copy_session_id(SSL * t,const SSL * f)1604 int SSL_copy_session_id(SSL *t, const SSL *f)
1605 {
1606 int i;
1607 /* Do we need to do SSL locking? */
1608 if (!SSL_set_session(t, SSL_get_session(f))) {
1609 return 0;
1610 }
1611
1612 /*
1613 * what if we are setup for one protocol version but want to talk another
1614 */
1615 if (t->method != f->method) {
1616 t->method->ssl_free(t);
1617 t->method = f->method;
1618 if (t->method->ssl_new(t) == 0)
1619 return 0;
1620 }
1621
1622 CRYPTO_UP_REF(&f->cert->references, &i, f->cert->lock);
1623 ssl_cert_free(t->cert);
1624 t->cert = f->cert;
1625 if (!SSL_set_session_id_context(t, f->sid_ctx, (int)f->sid_ctx_length)) {
1626 return 0;
1627 }
1628
1629 return 1;
1630 }
1631
1632 /* Fix this so it checks all the valid key/cert options */
SSL_CTX_check_private_key(const SSL_CTX * ctx)1633 int SSL_CTX_check_private_key(const SSL_CTX *ctx)
1634 {
1635 if ((ctx == NULL) || (ctx->cert->key->x509 == NULL)) {
1636 ERR_raise(ERR_LIB_SSL, SSL_R_NO_CERTIFICATE_ASSIGNED);
1637 return 0;
1638 }
1639 if (ctx->cert->key->privatekey == NULL) {
1640 ERR_raise(ERR_LIB_SSL, SSL_R_NO_PRIVATE_KEY_ASSIGNED);
1641 return 0;
1642 }
1643 return X509_check_private_key
1644 (ctx->cert->key->x509, ctx->cert->key->privatekey);
1645 }
1646
1647 /* Fix this function so that it takes an optional type parameter */
SSL_check_private_key(const SSL * ssl)1648 int SSL_check_private_key(const SSL *ssl)
1649 {
1650 if (ssl == NULL) {
1651 ERR_raise(ERR_LIB_SSL, ERR_R_PASSED_NULL_PARAMETER);
1652 return 0;
1653 }
1654 if (ssl->cert->key->x509 == NULL) {
1655 ERR_raise(ERR_LIB_SSL, SSL_R_NO_CERTIFICATE_ASSIGNED);
1656 return 0;
1657 }
1658 if (ssl->cert->key->privatekey == NULL) {
1659 ERR_raise(ERR_LIB_SSL, SSL_R_NO_PRIVATE_KEY_ASSIGNED);
1660 return 0;
1661 }
1662 return X509_check_private_key(ssl->cert->key->x509,
1663 ssl->cert->key->privatekey);
1664 }
1665
SSL_waiting_for_async(SSL * s)1666 int SSL_waiting_for_async(SSL *s)
1667 {
1668 if (s->job)
1669 return 1;
1670
1671 return 0;
1672 }
1673
SSL_get_all_async_fds(SSL * s,OSSL_ASYNC_FD * fds,size_t * numfds)1674 int SSL_get_all_async_fds(SSL *s, OSSL_ASYNC_FD *fds, size_t *numfds)
1675 {
1676 ASYNC_WAIT_CTX *ctx = s->waitctx;
1677
1678 if (ctx == NULL)
1679 return 0;
1680 return ASYNC_WAIT_CTX_get_all_fds(ctx, fds, numfds);
1681 }
1682
SSL_get_changed_async_fds(SSL * s,OSSL_ASYNC_FD * addfd,size_t * numaddfds,OSSL_ASYNC_FD * delfd,size_t * numdelfds)1683 int SSL_get_changed_async_fds(SSL *s, OSSL_ASYNC_FD *addfd, size_t *numaddfds,
1684 OSSL_ASYNC_FD *delfd, size_t *numdelfds)
1685 {
1686 ASYNC_WAIT_CTX *ctx = s->waitctx;
1687
1688 if (ctx == NULL)
1689 return 0;
1690 return ASYNC_WAIT_CTX_get_changed_fds(ctx, addfd, numaddfds, delfd,
1691 numdelfds);
1692 }
1693
SSL_CTX_set_async_callback(SSL_CTX * ctx,SSL_async_callback_fn callback)1694 int SSL_CTX_set_async_callback(SSL_CTX *ctx, SSL_async_callback_fn callback)
1695 {
1696 ctx->async_cb = callback;
1697 return 1;
1698 }
1699
SSL_CTX_set_async_callback_arg(SSL_CTX * ctx,void * arg)1700 int SSL_CTX_set_async_callback_arg(SSL_CTX *ctx, void *arg)
1701 {
1702 ctx->async_cb_arg = arg;
1703 return 1;
1704 }
1705
SSL_set_async_callback(SSL * s,SSL_async_callback_fn callback)1706 int SSL_set_async_callback(SSL *s, SSL_async_callback_fn callback)
1707 {
1708 s->async_cb = callback;
1709 return 1;
1710 }
1711
SSL_set_async_callback_arg(SSL * s,void * arg)1712 int SSL_set_async_callback_arg(SSL *s, void *arg)
1713 {
1714 s->async_cb_arg = arg;
1715 return 1;
1716 }
1717
SSL_get_async_status(SSL * s,int * status)1718 int SSL_get_async_status(SSL *s, int *status)
1719 {
1720 ASYNC_WAIT_CTX *ctx = s->waitctx;
1721
1722 if (ctx == NULL)
1723 return 0;
1724 *status = ASYNC_WAIT_CTX_get_status(ctx);
1725 return 1;
1726 }
1727
SSL_accept(SSL * s)1728 int SSL_accept(SSL *s)
1729 {
1730 if (s->handshake_func == NULL) {
1731 /* Not properly initialized yet */
1732 SSL_set_accept_state(s);
1733 }
1734
1735 return SSL_do_handshake(s);
1736 }
1737
SSL_connect(SSL * s)1738 int SSL_connect(SSL *s)
1739 {
1740 if (s->handshake_func == NULL) {
1741 /* Not properly initialized yet */
1742 SSL_set_connect_state(s);
1743 }
1744
1745 return SSL_do_handshake(s);
1746 }
1747
SSL_get_default_timeout(const SSL * s)1748 long SSL_get_default_timeout(const SSL *s)
1749 {
1750 return s->method->get_timeout();
1751 }
1752
ssl_async_wait_ctx_cb(void * arg)1753 static int ssl_async_wait_ctx_cb(void *arg)
1754 {
1755 SSL *s = (SSL *)arg;
1756
1757 return s->async_cb(s, s->async_cb_arg);
1758 }
1759
ssl_start_async_job(SSL * s,struct ssl_async_args * args,int (* func)(void *))1760 static int ssl_start_async_job(SSL *s, struct ssl_async_args *args,
1761 int (*func) (void *))
1762 {
1763 int ret;
1764 if (s->waitctx == NULL) {
1765 s->waitctx = ASYNC_WAIT_CTX_new();
1766 if (s->waitctx == NULL)
1767 return -1;
1768 if (s->async_cb != NULL
1769 && !ASYNC_WAIT_CTX_set_callback
1770 (s->waitctx, ssl_async_wait_ctx_cb, s))
1771 return -1;
1772 }
1773 switch (ASYNC_start_job(&s->job, s->waitctx, &ret, func, args,
1774 sizeof(struct ssl_async_args))) {
1775 case ASYNC_ERR:
1776 s->rwstate = SSL_NOTHING;
1777 ERR_raise(ERR_LIB_SSL, SSL_R_FAILED_TO_INIT_ASYNC);
1778 return -1;
1779 case ASYNC_PAUSE:
1780 s->rwstate = SSL_ASYNC_PAUSED;
1781 return -1;
1782 case ASYNC_NO_JOBS:
1783 s->rwstate = SSL_ASYNC_NO_JOBS;
1784 return -1;
1785 case ASYNC_FINISH:
1786 s->job = NULL;
1787 return ret;
1788 default:
1789 s->rwstate = SSL_NOTHING;
1790 ERR_raise(ERR_LIB_SSL, ERR_R_INTERNAL_ERROR);
1791 /* Shouldn't happen */
1792 return -1;
1793 }
1794 }
1795
ssl_io_intern(void * vargs)1796 static int ssl_io_intern(void *vargs)
1797 {
1798 struct ssl_async_args *args;
1799 SSL *s;
1800 void *buf;
1801 size_t num;
1802
1803 args = (struct ssl_async_args *)vargs;
1804 s = args->s;
1805 buf = args->buf;
1806 num = args->num;
1807 switch (args->type) {
1808 case READFUNC:
1809 return args->f.func_read(s, buf, num, &s->asyncrw);
1810 case WRITEFUNC:
1811 return args->f.func_write(s, buf, num, &s->asyncrw);
1812 case OTHERFUNC:
1813 return args->f.func_other(s);
1814 }
1815 return -1;
1816 }
1817
ssl_read_internal(SSL * s,void * buf,size_t num,size_t * readbytes)1818 int ssl_read_internal(SSL *s, void *buf, size_t num, size_t *readbytes)
1819 {
1820 if (s->handshake_func == NULL) {
1821 ERR_raise(ERR_LIB_SSL, SSL_R_UNINITIALIZED);
1822 return -1;
1823 }
1824
1825 if (s->shutdown & SSL_RECEIVED_SHUTDOWN) {
1826 s->rwstate = SSL_NOTHING;
1827 return 0;
1828 }
1829
1830 if (s->early_data_state == SSL_EARLY_DATA_CONNECT_RETRY
1831 || s->early_data_state == SSL_EARLY_DATA_ACCEPT_RETRY) {
1832 ERR_raise(ERR_LIB_SSL, ERR_R_SHOULD_NOT_HAVE_BEEN_CALLED);
1833 return 0;
1834 }
1835 /*
1836 * If we are a client and haven't received the ServerHello etc then we
1837 * better do that
1838 */
1839 ossl_statem_check_finish_init(s, 0);
1840
1841 if ((s->mode & SSL_MODE_ASYNC) && ASYNC_get_current_job() == NULL) {
1842 struct ssl_async_args args;
1843 int ret;
1844
1845 args.s = s;
1846 args.buf = buf;
1847 args.num = num;
1848 args.type = READFUNC;
1849 args.f.func_read = s->method->ssl_read;
1850
1851 ret = ssl_start_async_job(s, &args, ssl_io_intern);
1852 *readbytes = s->asyncrw;
1853 return ret;
1854 } else {
1855 return s->method->ssl_read(s, buf, num, readbytes);
1856 }
1857 }
1858
SSL_read(SSL * s,void * buf,int num)1859 int SSL_read(SSL *s, void *buf, int num)
1860 {
1861 int ret;
1862 size_t readbytes;
1863
1864 if (num < 0) {
1865 ERR_raise(ERR_LIB_SSL, SSL_R_BAD_LENGTH);
1866 return -1;
1867 }
1868
1869 ret = ssl_read_internal(s, buf, (size_t)num, &readbytes);
1870
1871 /*
1872 * The cast is safe here because ret should be <= INT_MAX because num is
1873 * <= INT_MAX
1874 */
1875 if (ret > 0)
1876 ret = (int)readbytes;
1877
1878 return ret;
1879 }
1880
SSL_read_ex(SSL * s,void * buf,size_t num,size_t * readbytes)1881 int SSL_read_ex(SSL *s, void *buf, size_t num, size_t *readbytes)
1882 {
1883 int ret = ssl_read_internal(s, buf, num, readbytes);
1884
1885 if (ret < 0)
1886 ret = 0;
1887 return ret;
1888 }
1889
SSL_read_early_data(SSL * s,void * buf,size_t num,size_t * readbytes)1890 int SSL_read_early_data(SSL *s, void *buf, size_t num, size_t *readbytes)
1891 {
1892 int ret;
1893
1894 if (!s->server) {
1895 ERR_raise(ERR_LIB_SSL, ERR_R_SHOULD_NOT_HAVE_BEEN_CALLED);
1896 return SSL_READ_EARLY_DATA_ERROR;
1897 }
1898
1899 switch (s->early_data_state) {
1900 case SSL_EARLY_DATA_NONE:
1901 if (!SSL_in_before(s)) {
1902 ERR_raise(ERR_LIB_SSL, ERR_R_SHOULD_NOT_HAVE_BEEN_CALLED);
1903 return SSL_READ_EARLY_DATA_ERROR;
1904 }
1905 /* fall through */
1906
1907 case SSL_EARLY_DATA_ACCEPT_RETRY:
1908 s->early_data_state = SSL_EARLY_DATA_ACCEPTING;
1909 ret = SSL_accept(s);
1910 if (ret <= 0) {
1911 /* NBIO or error */
1912 s->early_data_state = SSL_EARLY_DATA_ACCEPT_RETRY;
1913 return SSL_READ_EARLY_DATA_ERROR;
1914 }
1915 /* fall through */
1916
1917 case SSL_EARLY_DATA_READ_RETRY:
1918 if (s->ext.early_data == SSL_EARLY_DATA_ACCEPTED) {
1919 s->early_data_state = SSL_EARLY_DATA_READING;
1920 ret = SSL_read_ex(s, buf, num, readbytes);
1921 /*
1922 * State machine will update early_data_state to
1923 * SSL_EARLY_DATA_FINISHED_READING if we get an EndOfEarlyData
1924 * message
1925 */
1926 if (ret > 0 || (ret <= 0 && s->early_data_state
1927 != SSL_EARLY_DATA_FINISHED_READING)) {
1928 s->early_data_state = SSL_EARLY_DATA_READ_RETRY;
1929 return ret > 0 ? SSL_READ_EARLY_DATA_SUCCESS
1930 : SSL_READ_EARLY_DATA_ERROR;
1931 }
1932 } else {
1933 s->early_data_state = SSL_EARLY_DATA_FINISHED_READING;
1934 }
1935 *readbytes = 0;
1936 return SSL_READ_EARLY_DATA_FINISH;
1937
1938 default:
1939 ERR_raise(ERR_LIB_SSL, ERR_R_SHOULD_NOT_HAVE_BEEN_CALLED);
1940 return SSL_READ_EARLY_DATA_ERROR;
1941 }
1942 }
1943
SSL_get_early_data_status(const SSL * s)1944 int SSL_get_early_data_status(const SSL *s)
1945 {
1946 return s->ext.early_data;
1947 }
1948
ssl_peek_internal(SSL * s,void * buf,size_t num,size_t * readbytes)1949 static int ssl_peek_internal(SSL *s, void *buf, size_t num, size_t *readbytes)
1950 {
1951 if (s->handshake_func == NULL) {
1952 ERR_raise(ERR_LIB_SSL, SSL_R_UNINITIALIZED);
1953 return -1;
1954 }
1955
1956 if (s->shutdown & SSL_RECEIVED_SHUTDOWN) {
1957 return 0;
1958 }
1959 if ((s->mode & SSL_MODE_ASYNC) && ASYNC_get_current_job() == NULL) {
1960 struct ssl_async_args args;
1961 int ret;
1962
1963 args.s = s;
1964 args.buf = buf;
1965 args.num = num;
1966 args.type = READFUNC;
1967 args.f.func_read = s->method->ssl_peek;
1968
1969 ret = ssl_start_async_job(s, &args, ssl_io_intern);
1970 *readbytes = s->asyncrw;
1971 return ret;
1972 } else {
1973 return s->method->ssl_peek(s, buf, num, readbytes);
1974 }
1975 }
1976
SSL_peek(SSL * s,void * buf,int num)1977 int SSL_peek(SSL *s, void *buf, int num)
1978 {
1979 int ret;
1980 size_t readbytes;
1981
1982 if (num < 0) {
1983 ERR_raise(ERR_LIB_SSL, SSL_R_BAD_LENGTH);
1984 return -1;
1985 }
1986
1987 ret = ssl_peek_internal(s, buf, (size_t)num, &readbytes);
1988
1989 /*
1990 * The cast is safe here because ret should be <= INT_MAX because num is
1991 * <= INT_MAX
1992 */
1993 if (ret > 0)
1994 ret = (int)readbytes;
1995
1996 return ret;
1997 }
1998
1999
SSL_peek_ex(SSL * s,void * buf,size_t num,size_t * readbytes)2000 int SSL_peek_ex(SSL *s, void *buf, size_t num, size_t *readbytes)
2001 {
2002 int ret = ssl_peek_internal(s, buf, num, readbytes);
2003
2004 if (ret < 0)
2005 ret = 0;
2006 return ret;
2007 }
2008
ssl_write_internal(SSL * s,const void * buf,size_t num,size_t * written)2009 int ssl_write_internal(SSL *s, const void *buf, size_t num, size_t *written)
2010 {
2011 if (s->handshake_func == NULL) {
2012 ERR_raise(ERR_LIB_SSL, SSL_R_UNINITIALIZED);
2013 return -1;
2014 }
2015
2016 if (s->shutdown & SSL_SENT_SHUTDOWN) {
2017 s->rwstate = SSL_NOTHING;
2018 ERR_raise(ERR_LIB_SSL, SSL_R_PROTOCOL_IS_SHUTDOWN);
2019 return -1;
2020 }
2021
2022 if (s->early_data_state == SSL_EARLY_DATA_CONNECT_RETRY
2023 || s->early_data_state == SSL_EARLY_DATA_ACCEPT_RETRY
2024 || s->early_data_state == SSL_EARLY_DATA_READ_RETRY) {
2025 ERR_raise(ERR_LIB_SSL, ERR_R_SHOULD_NOT_HAVE_BEEN_CALLED);
2026 return 0;
2027 }
2028 /* If we are a client and haven't sent the Finished we better do that */
2029 ossl_statem_check_finish_init(s, 1);
2030
2031 if ((s->mode & SSL_MODE_ASYNC) && ASYNC_get_current_job() == NULL) {
2032 int ret;
2033 struct ssl_async_args args;
2034
2035 args.s = s;
2036 args.buf = (void *)buf;
2037 args.num = num;
2038 args.type = WRITEFUNC;
2039 args.f.func_write = s->method->ssl_write;
2040
2041 ret = ssl_start_async_job(s, &args, ssl_io_intern);
2042 *written = s->asyncrw;
2043 return ret;
2044 } else {
2045 return s->method->ssl_write(s, buf, num, written);
2046 }
2047 }
2048
SSL_sendfile(SSL * s,int fd,off_t offset,size_t size,int flags)2049 ossl_ssize_t SSL_sendfile(SSL *s, int fd, off_t offset, size_t size, int flags)
2050 {
2051 ossl_ssize_t ret;
2052
2053 if (s->handshake_func == NULL) {
2054 ERR_raise(ERR_LIB_SSL, SSL_R_UNINITIALIZED);
2055 return -1;
2056 }
2057
2058 if (s->shutdown & SSL_SENT_SHUTDOWN) {
2059 s->rwstate = SSL_NOTHING;
2060 ERR_raise(ERR_LIB_SSL, SSL_R_PROTOCOL_IS_SHUTDOWN);
2061 return -1;
2062 }
2063
2064 if (!BIO_get_ktls_send(s->wbio)) {
2065 ERR_raise(ERR_LIB_SSL, SSL_R_UNINITIALIZED);
2066 return -1;
2067 }
2068
2069 /* If we have an alert to send, lets send it */
2070 if (s->s3.alert_dispatch) {
2071 ret = (ossl_ssize_t)s->method->ssl_dispatch_alert(s);
2072 if (ret <= 0) {
2073 /* SSLfatal() already called if appropriate */
2074 return ret;
2075 }
2076 /* if it went, fall through and send more stuff */
2077 }
2078
2079 s->rwstate = SSL_WRITING;
2080 if (BIO_flush(s->wbio) <= 0) {
2081 if (!BIO_should_retry(s->wbio)) {
2082 s->rwstate = SSL_NOTHING;
2083 } else {
2084 #ifdef EAGAIN
2085 set_sys_error(EAGAIN);
2086 #endif
2087 }
2088 return -1;
2089 }
2090
2091 #ifdef OPENSSL_NO_KTLS
2092 ERR_raise_data(ERR_LIB_SSL, ERR_R_INTERNAL_ERROR,
2093 "can't call ktls_sendfile(), ktls disabled");
2094 return -1;
2095 #else
2096 ret = ktls_sendfile(SSL_get_wfd(s), fd, offset, size, flags);
2097 if (ret < 0) {
2098 #if defined(EAGAIN) && defined(EINTR) && defined(EBUSY)
2099 if ((get_last_sys_error() == EAGAIN) ||
2100 (get_last_sys_error() == EINTR) ||
2101 (get_last_sys_error() == EBUSY))
2102 BIO_set_retry_write(s->wbio);
2103 else
2104 #endif
2105 ERR_raise(ERR_LIB_SSL, SSL_R_UNINITIALIZED);
2106 return ret;
2107 }
2108 s->rwstate = SSL_NOTHING;
2109 return ret;
2110 #endif
2111 }
2112
SSL_write(SSL * s,const void * buf,int num)2113 int SSL_write(SSL *s, const void *buf, int num)
2114 {
2115 int ret;
2116 size_t written;
2117
2118 if (num < 0) {
2119 ERR_raise(ERR_LIB_SSL, SSL_R_BAD_LENGTH);
2120 return -1;
2121 }
2122
2123 ret = ssl_write_internal(s, buf, (size_t)num, &written);
2124
2125 /*
2126 * The cast is safe here because ret should be <= INT_MAX because num is
2127 * <= INT_MAX
2128 */
2129 if (ret > 0)
2130 ret = (int)written;
2131
2132 return ret;
2133 }
2134
SSL_write_ex(SSL * s,const void * buf,size_t num,size_t * written)2135 int SSL_write_ex(SSL *s, const void *buf, size_t num, size_t *written)
2136 {
2137 int ret = ssl_write_internal(s, buf, num, written);
2138
2139 if (ret < 0)
2140 ret = 0;
2141 return ret;
2142 }
2143
SSL_write_early_data(SSL * s,const void * buf,size_t num,size_t * written)2144 int SSL_write_early_data(SSL *s, const void *buf, size_t num, size_t *written)
2145 {
2146 int ret, early_data_state;
2147 size_t writtmp;
2148 uint32_t partialwrite;
2149
2150 switch (s->early_data_state) {
2151 case SSL_EARLY_DATA_NONE:
2152 if (s->server
2153 || !SSL_in_before(s)
2154 || ((s->session == NULL || s->session->ext.max_early_data == 0)
2155 && (s->psk_use_session_cb == NULL))) {
2156 ERR_raise(ERR_LIB_SSL, ERR_R_SHOULD_NOT_HAVE_BEEN_CALLED);
2157 return 0;
2158 }
2159 /* fall through */
2160
2161 case SSL_EARLY_DATA_CONNECT_RETRY:
2162 s->early_data_state = SSL_EARLY_DATA_CONNECTING;
2163 ret = SSL_connect(s);
2164 if (ret <= 0) {
2165 /* NBIO or error */
2166 s->early_data_state = SSL_EARLY_DATA_CONNECT_RETRY;
2167 return 0;
2168 }
2169 /* fall through */
2170
2171 case SSL_EARLY_DATA_WRITE_RETRY:
2172 s->early_data_state = SSL_EARLY_DATA_WRITING;
2173 /*
2174 * We disable partial write for early data because we don't keep track
2175 * of how many bytes we've written between the SSL_write_ex() call and
2176 * the flush if the flush needs to be retried)
2177 */
2178 partialwrite = s->mode & SSL_MODE_ENABLE_PARTIAL_WRITE;
2179 s->mode &= ~SSL_MODE_ENABLE_PARTIAL_WRITE;
2180 ret = SSL_write_ex(s, buf, num, &writtmp);
2181 s->mode |= partialwrite;
2182 if (!ret) {
2183 s->early_data_state = SSL_EARLY_DATA_WRITE_RETRY;
2184 return ret;
2185 }
2186 s->early_data_state = SSL_EARLY_DATA_WRITE_FLUSH;
2187 /* fall through */
2188
2189 case SSL_EARLY_DATA_WRITE_FLUSH:
2190 /* The buffering BIO is still in place so we need to flush it */
2191 if (statem_flush(s) != 1)
2192 return 0;
2193 *written = num;
2194 s->early_data_state = SSL_EARLY_DATA_WRITE_RETRY;
2195 return 1;
2196
2197 case SSL_EARLY_DATA_FINISHED_READING:
2198 case SSL_EARLY_DATA_READ_RETRY:
2199 early_data_state = s->early_data_state;
2200 /* We are a server writing to an unauthenticated client */
2201 s->early_data_state = SSL_EARLY_DATA_UNAUTH_WRITING;
2202 ret = SSL_write_ex(s, buf, num, written);
2203 /* The buffering BIO is still in place */
2204 if (ret)
2205 (void)BIO_flush(s->wbio);
2206 s->early_data_state = early_data_state;
2207 return ret;
2208
2209 default:
2210 ERR_raise(ERR_LIB_SSL, ERR_R_SHOULD_NOT_HAVE_BEEN_CALLED);
2211 return 0;
2212 }
2213 }
2214
SSL_shutdown(SSL * s)2215 int SSL_shutdown(SSL *s)
2216 {
2217 /*
2218 * Note that this function behaves differently from what one might
2219 * expect. Return values are 0 for no success (yet), 1 for success; but
2220 * calling it once is usually not enough, even if blocking I/O is used
2221 * (see ssl3_shutdown).
2222 */
2223
2224 if (s->handshake_func == NULL) {
2225 ERR_raise(ERR_LIB_SSL, SSL_R_UNINITIALIZED);
2226 return -1;
2227 }
2228
2229 if (!SSL_in_init(s)) {
2230 if ((s->mode & SSL_MODE_ASYNC) && ASYNC_get_current_job() == NULL) {
2231 struct ssl_async_args args;
2232
2233 args.s = s;
2234 args.type = OTHERFUNC;
2235 args.f.func_other = s->method->ssl_shutdown;
2236
2237 return ssl_start_async_job(s, &args, ssl_io_intern);
2238 } else {
2239 return s->method->ssl_shutdown(s);
2240 }
2241 } else {
2242 ERR_raise(ERR_LIB_SSL, SSL_R_SHUTDOWN_WHILE_IN_INIT);
2243 return -1;
2244 }
2245 }
2246
SSL_key_update(SSL * s,int updatetype)2247 int SSL_key_update(SSL *s, int updatetype)
2248 {
2249 if (!SSL_IS_TLS13(s)) {
2250 ERR_raise(ERR_LIB_SSL, SSL_R_WRONG_SSL_VERSION);
2251 return 0;
2252 }
2253
2254 if (updatetype != SSL_KEY_UPDATE_NOT_REQUESTED
2255 && updatetype != SSL_KEY_UPDATE_REQUESTED) {
2256 ERR_raise(ERR_LIB_SSL, SSL_R_INVALID_KEY_UPDATE_TYPE);
2257 return 0;
2258 }
2259
2260 if (!SSL_is_init_finished(s)) {
2261 ERR_raise(ERR_LIB_SSL, SSL_R_STILL_IN_INIT);
2262 return 0;
2263 }
2264
2265 if (RECORD_LAYER_write_pending(&s->rlayer)) {
2266 ERR_raise(ERR_LIB_SSL, SSL_R_BAD_WRITE_RETRY);
2267 return 0;
2268 }
2269
2270 ossl_statem_set_in_init(s, 1);
2271 s->key_update = updatetype;
2272 return 1;
2273 }
2274
SSL_get_key_update_type(const SSL * s)2275 int SSL_get_key_update_type(const SSL *s)
2276 {
2277 return s->key_update;
2278 }
2279
2280 /*
2281 * Can we accept a renegotiation request? If yes, set the flag and
2282 * return 1 if yes. If not, raise error and return 0.
2283 */
can_renegotiate(const SSL * s)2284 static int can_renegotiate(const SSL *s)
2285 {
2286 if (SSL_IS_TLS13(s)) {
2287 ERR_raise(ERR_LIB_SSL, SSL_R_WRONG_SSL_VERSION);
2288 return 0;
2289 }
2290
2291 if ((s->options & SSL_OP_NO_RENEGOTIATION) != 0) {
2292 ERR_raise(ERR_LIB_SSL, SSL_R_NO_RENEGOTIATION);
2293 return 0;
2294 }
2295
2296 return 1;
2297 }
2298
SSL_renegotiate(SSL * s)2299 int SSL_renegotiate(SSL *s)
2300 {
2301 if (!can_renegotiate(s))
2302 return 0;
2303
2304 s->renegotiate = 1;
2305 s->new_session = 1;
2306 return s->method->ssl_renegotiate(s);
2307 }
2308
SSL_renegotiate_abbreviated(SSL * s)2309 int SSL_renegotiate_abbreviated(SSL *s)
2310 {
2311 if (!can_renegotiate(s))
2312 return 0;
2313
2314 s->renegotiate = 1;
2315 s->new_session = 0;
2316 return s->method->ssl_renegotiate(s);
2317 }
2318
SSL_renegotiate_pending(const SSL * s)2319 int SSL_renegotiate_pending(const SSL *s)
2320 {
2321 /*
2322 * becomes true when negotiation is requested; false again once a
2323 * handshake has finished
2324 */
2325 return (s->renegotiate != 0);
2326 }
2327
SSL_new_session_ticket(SSL * s)2328 int SSL_new_session_ticket(SSL *s)
2329 {
2330 /* If we are in init because we're sending tickets, okay to send more. */
2331 if ((SSL_in_init(s) && s->ext.extra_tickets_expected == 0)
2332 || SSL_IS_FIRST_HANDSHAKE(s) || !s->server
2333 || !SSL_IS_TLS13(s))
2334 return 0;
2335 s->ext.extra_tickets_expected++;
2336 if (!RECORD_LAYER_write_pending(&s->rlayer) && !SSL_in_init(s))
2337 ossl_statem_set_in_init(s, 1);
2338 return 1;
2339 }
2340
SSL_ctrl(SSL * s,int cmd,long larg,void * parg)2341 long SSL_ctrl(SSL *s, int cmd, long larg, void *parg)
2342 {
2343 long l;
2344
2345 switch (cmd) {
2346 case SSL_CTRL_GET_READ_AHEAD:
2347 return RECORD_LAYER_get_read_ahead(&s->rlayer);
2348 case SSL_CTRL_SET_READ_AHEAD:
2349 l = RECORD_LAYER_get_read_ahead(&s->rlayer);
2350 RECORD_LAYER_set_read_ahead(&s->rlayer, larg);
2351 return l;
2352
2353 case SSL_CTRL_SET_MSG_CALLBACK_ARG:
2354 s->msg_callback_arg = parg;
2355 return 1;
2356
2357 case SSL_CTRL_MODE:
2358 return (s->mode |= larg);
2359 case SSL_CTRL_CLEAR_MODE:
2360 return (s->mode &= ~larg);
2361 case SSL_CTRL_GET_MAX_CERT_LIST:
2362 return (long)s->max_cert_list;
2363 case SSL_CTRL_SET_MAX_CERT_LIST:
2364 if (larg < 0)
2365 return 0;
2366 l = (long)s->max_cert_list;
2367 s->max_cert_list = (size_t)larg;
2368 return l;
2369 case SSL_CTRL_SET_MAX_SEND_FRAGMENT:
2370 if (larg < 512 || larg > SSL3_RT_MAX_PLAIN_LENGTH)
2371 return 0;
2372 #ifndef OPENSSL_NO_KTLS
2373 if (s->wbio != NULL && BIO_get_ktls_send(s->wbio))
2374 return 0;
2375 #endif /* OPENSSL_NO_KTLS */
2376 s->max_send_fragment = larg;
2377 if (s->max_send_fragment < s->split_send_fragment)
2378 s->split_send_fragment = s->max_send_fragment;
2379 return 1;
2380 case SSL_CTRL_SET_SPLIT_SEND_FRAGMENT:
2381 if ((size_t)larg > s->max_send_fragment || larg == 0)
2382 return 0;
2383 s->split_send_fragment = larg;
2384 return 1;
2385 case SSL_CTRL_SET_MAX_PIPELINES:
2386 if (larg < 1 || larg > SSL_MAX_PIPELINES)
2387 return 0;
2388 s->max_pipelines = larg;
2389 if (larg > 1)
2390 RECORD_LAYER_set_read_ahead(&s->rlayer, 1);
2391 return 1;
2392 case SSL_CTRL_GET_RI_SUPPORT:
2393 return s->s3.send_connection_binding;
2394 case SSL_CTRL_CERT_FLAGS:
2395 return (s->cert->cert_flags |= larg);
2396 case SSL_CTRL_CLEAR_CERT_FLAGS:
2397 return (s->cert->cert_flags &= ~larg);
2398
2399 case SSL_CTRL_GET_RAW_CIPHERLIST:
2400 if (parg) {
2401 if (s->s3.tmp.ciphers_raw == NULL)
2402 return 0;
2403 *(unsigned char **)parg = s->s3.tmp.ciphers_raw;
2404 return (int)s->s3.tmp.ciphers_rawlen;
2405 } else {
2406 return TLS_CIPHER_LEN;
2407 }
2408 case SSL_CTRL_GET_EXTMS_SUPPORT:
2409 if (!s->session || SSL_in_init(s) || ossl_statem_get_in_handshake(s))
2410 return -1;
2411 if (s->session->flags & SSL_SESS_FLAG_EXTMS)
2412 return 1;
2413 else
2414 return 0;
2415 case SSL_CTRL_SET_MIN_PROTO_VERSION:
2416 return ssl_check_allowed_versions(larg, s->max_proto_version)
2417 && ssl_set_version_bound(s->ctx->method->version, (int)larg,
2418 &s->min_proto_version);
2419 case SSL_CTRL_GET_MIN_PROTO_VERSION:
2420 return s->min_proto_version;
2421 case SSL_CTRL_SET_MAX_PROTO_VERSION:
2422 return ssl_check_allowed_versions(s->min_proto_version, larg)
2423 && ssl_set_version_bound(s->ctx->method->version, (int)larg,
2424 &s->max_proto_version);
2425 case SSL_CTRL_GET_MAX_PROTO_VERSION:
2426 return s->max_proto_version;
2427 default:
2428 return s->method->ssl_ctrl(s, cmd, larg, parg);
2429 }
2430 }
2431
SSL_callback_ctrl(SSL * s,int cmd,void (* fp)(void))2432 long SSL_callback_ctrl(SSL *s, int cmd, void (*fp) (void))
2433 {
2434 switch (cmd) {
2435 case SSL_CTRL_SET_MSG_CALLBACK:
2436 s->msg_callback = (void (*)
2437 (int write_p, int version, int content_type,
2438 const void *buf, size_t len, SSL *ssl,
2439 void *arg))(fp);
2440 return 1;
2441
2442 default:
2443 return s->method->ssl_callback_ctrl(s, cmd, fp);
2444 }
2445 }
2446
LHASH_OF(SSL_SESSION)2447 LHASH_OF(SSL_SESSION) *SSL_CTX_sessions(SSL_CTX *ctx)
2448 {
2449 return ctx->sessions;
2450 }
2451
SSL_CTX_ctrl(SSL_CTX * ctx,int cmd,long larg,void * parg)2452 long SSL_CTX_ctrl(SSL_CTX *ctx, int cmd, long larg, void *parg)
2453 {
2454 long l;
2455 /* For some cases with ctx == NULL perform syntax checks */
2456 if (ctx == NULL) {
2457 switch (cmd) {
2458 case SSL_CTRL_SET_GROUPS_LIST:
2459 return tls1_set_groups_list(ctx, NULL, NULL, parg);
2460 case SSL_CTRL_SET_SIGALGS_LIST:
2461 case SSL_CTRL_SET_CLIENT_SIGALGS_LIST:
2462 return tls1_set_sigalgs_list(NULL, parg, 0);
2463 default:
2464 return 0;
2465 }
2466 }
2467
2468 switch (cmd) {
2469 case SSL_CTRL_GET_READ_AHEAD:
2470 return ctx->read_ahead;
2471 case SSL_CTRL_SET_READ_AHEAD:
2472 l = ctx->read_ahead;
2473 ctx->read_ahead = larg;
2474 return l;
2475
2476 case SSL_CTRL_SET_MSG_CALLBACK_ARG:
2477 ctx->msg_callback_arg = parg;
2478 return 1;
2479
2480 case SSL_CTRL_GET_MAX_CERT_LIST:
2481 return (long)ctx->max_cert_list;
2482 case SSL_CTRL_SET_MAX_CERT_LIST:
2483 if (larg < 0)
2484 return 0;
2485 l = (long)ctx->max_cert_list;
2486 ctx->max_cert_list = (size_t)larg;
2487 return l;
2488
2489 case SSL_CTRL_SET_SESS_CACHE_SIZE:
2490 if (larg < 0)
2491 return 0;
2492 l = (long)ctx->session_cache_size;
2493 ctx->session_cache_size = (size_t)larg;
2494 return l;
2495 case SSL_CTRL_GET_SESS_CACHE_SIZE:
2496 return (long)ctx->session_cache_size;
2497 case SSL_CTRL_SET_SESS_CACHE_MODE:
2498 l = ctx->session_cache_mode;
2499 ctx->session_cache_mode = larg;
2500 return l;
2501 case SSL_CTRL_GET_SESS_CACHE_MODE:
2502 return ctx->session_cache_mode;
2503
2504 case SSL_CTRL_SESS_NUMBER:
2505 return lh_SSL_SESSION_num_items(ctx->sessions);
2506 case SSL_CTRL_SESS_CONNECT:
2507 return tsan_load(&ctx->stats.sess_connect);
2508 case SSL_CTRL_SESS_CONNECT_GOOD:
2509 return tsan_load(&ctx->stats.sess_connect_good);
2510 case SSL_CTRL_SESS_CONNECT_RENEGOTIATE:
2511 return tsan_load(&ctx->stats.sess_connect_renegotiate);
2512 case SSL_CTRL_SESS_ACCEPT:
2513 return tsan_load(&ctx->stats.sess_accept);
2514 case SSL_CTRL_SESS_ACCEPT_GOOD:
2515 return tsan_load(&ctx->stats.sess_accept_good);
2516 case SSL_CTRL_SESS_ACCEPT_RENEGOTIATE:
2517 return tsan_load(&ctx->stats.sess_accept_renegotiate);
2518 case SSL_CTRL_SESS_HIT:
2519 return tsan_load(&ctx->stats.sess_hit);
2520 case SSL_CTRL_SESS_CB_HIT:
2521 return tsan_load(&ctx->stats.sess_cb_hit);
2522 case SSL_CTRL_SESS_MISSES:
2523 return tsan_load(&ctx->stats.sess_miss);
2524 case SSL_CTRL_SESS_TIMEOUTS:
2525 return tsan_load(&ctx->stats.sess_timeout);
2526 case SSL_CTRL_SESS_CACHE_FULL:
2527 return tsan_load(&ctx->stats.sess_cache_full);
2528 case SSL_CTRL_MODE:
2529 return (ctx->mode |= larg);
2530 case SSL_CTRL_CLEAR_MODE:
2531 return (ctx->mode &= ~larg);
2532 case SSL_CTRL_SET_MAX_SEND_FRAGMENT:
2533 if (larg < 512 || larg > SSL3_RT_MAX_PLAIN_LENGTH)
2534 return 0;
2535 ctx->max_send_fragment = larg;
2536 if (ctx->max_send_fragment < ctx->split_send_fragment)
2537 ctx->split_send_fragment = ctx->max_send_fragment;
2538 return 1;
2539 case SSL_CTRL_SET_SPLIT_SEND_FRAGMENT:
2540 if ((size_t)larg > ctx->max_send_fragment || larg == 0)
2541 return 0;
2542 ctx->split_send_fragment = larg;
2543 return 1;
2544 case SSL_CTRL_SET_MAX_PIPELINES:
2545 if (larg < 1 || larg > SSL_MAX_PIPELINES)
2546 return 0;
2547 ctx->max_pipelines = larg;
2548 return 1;
2549 case SSL_CTRL_CERT_FLAGS:
2550 return (ctx->cert->cert_flags |= larg);
2551 case SSL_CTRL_CLEAR_CERT_FLAGS:
2552 return (ctx->cert->cert_flags &= ~larg);
2553 case SSL_CTRL_SET_MIN_PROTO_VERSION:
2554 return ssl_check_allowed_versions(larg, ctx->max_proto_version)
2555 && ssl_set_version_bound(ctx->method->version, (int)larg,
2556 &ctx->min_proto_version);
2557 case SSL_CTRL_GET_MIN_PROTO_VERSION:
2558 return ctx->min_proto_version;
2559 case SSL_CTRL_SET_MAX_PROTO_VERSION:
2560 return ssl_check_allowed_versions(ctx->min_proto_version, larg)
2561 && ssl_set_version_bound(ctx->method->version, (int)larg,
2562 &ctx->max_proto_version);
2563 case SSL_CTRL_GET_MAX_PROTO_VERSION:
2564 return ctx->max_proto_version;
2565 default:
2566 return ctx->method->ssl_ctx_ctrl(ctx, cmd, larg, parg);
2567 }
2568 }
2569
SSL_CTX_callback_ctrl(SSL_CTX * ctx,int cmd,void (* fp)(void))2570 long SSL_CTX_callback_ctrl(SSL_CTX *ctx, int cmd, void (*fp) (void))
2571 {
2572 switch (cmd) {
2573 case SSL_CTRL_SET_MSG_CALLBACK:
2574 ctx->msg_callback = (void (*)
2575 (int write_p, int version, int content_type,
2576 const void *buf, size_t len, SSL *ssl,
2577 void *arg))(fp);
2578 return 1;
2579
2580 default:
2581 return ctx->method->ssl_ctx_callback_ctrl(ctx, cmd, fp);
2582 }
2583 }
2584
ssl_cipher_id_cmp(const SSL_CIPHER * a,const SSL_CIPHER * b)2585 int ssl_cipher_id_cmp(const SSL_CIPHER *a, const SSL_CIPHER *b)
2586 {
2587 if (a->id > b->id)
2588 return 1;
2589 if (a->id < b->id)
2590 return -1;
2591 return 0;
2592 }
2593
ssl_cipher_ptr_id_cmp(const SSL_CIPHER * const * ap,const SSL_CIPHER * const * bp)2594 int ssl_cipher_ptr_id_cmp(const SSL_CIPHER *const *ap,
2595 const SSL_CIPHER *const *bp)
2596 {
2597 if ((*ap)->id > (*bp)->id)
2598 return 1;
2599 if ((*ap)->id < (*bp)->id)
2600 return -1;
2601 return 0;
2602 }
2603
2604 /** return a STACK of the ciphers available for the SSL and in order of
2605 * preference */
STACK_OF(SSL_CIPHER)2606 STACK_OF(SSL_CIPHER) *SSL_get_ciphers(const SSL *s)
2607 {
2608 if (s != NULL) {
2609 if (s->cipher_list != NULL) {
2610 return s->cipher_list;
2611 } else if ((s->ctx != NULL) && (s->ctx->cipher_list != NULL)) {
2612 return s->ctx->cipher_list;
2613 }
2614 }
2615 return NULL;
2616 }
2617
STACK_OF(SSL_CIPHER)2618 STACK_OF(SSL_CIPHER) *SSL_get_client_ciphers(const SSL *s)
2619 {
2620 if ((s == NULL) || !s->server)
2621 return NULL;
2622 return s->peer_ciphers;
2623 }
2624
STACK_OF(SSL_CIPHER)2625 STACK_OF(SSL_CIPHER) *SSL_get1_supported_ciphers(SSL *s)
2626 {
2627 STACK_OF(SSL_CIPHER) *sk = NULL, *ciphers;
2628 int i;
2629
2630 ciphers = SSL_get_ciphers(s);
2631 if (!ciphers)
2632 return NULL;
2633 if (!ssl_set_client_disabled(s))
2634 return NULL;
2635 for (i = 0; i < sk_SSL_CIPHER_num(ciphers); i++) {
2636 const SSL_CIPHER *c = sk_SSL_CIPHER_value(ciphers, i);
2637 if (!ssl_cipher_disabled(s, c, SSL_SECOP_CIPHER_SUPPORTED, 0)) {
2638 if (!sk)
2639 sk = sk_SSL_CIPHER_new_null();
2640 if (!sk)
2641 return NULL;
2642 if (!sk_SSL_CIPHER_push(sk, c)) {
2643 sk_SSL_CIPHER_free(sk);
2644 return NULL;
2645 }
2646 }
2647 }
2648 return sk;
2649 }
2650
2651 /** return a STACK of the ciphers available for the SSL and in order of
2652 * algorithm id */
STACK_OF(SSL_CIPHER)2653 STACK_OF(SSL_CIPHER) *ssl_get_ciphers_by_id(SSL *s)
2654 {
2655 if (s != NULL) {
2656 if (s->cipher_list_by_id != NULL) {
2657 return s->cipher_list_by_id;
2658 } else if ((s->ctx != NULL) && (s->ctx->cipher_list_by_id != NULL)) {
2659 return s->ctx->cipher_list_by_id;
2660 }
2661 }
2662 return NULL;
2663 }
2664
2665 /** The old interface to get the same thing as SSL_get_ciphers() */
SSL_get_cipher_list(const SSL * s,int n)2666 const char *SSL_get_cipher_list(const SSL *s, int n)
2667 {
2668 const SSL_CIPHER *c;
2669 STACK_OF(SSL_CIPHER) *sk;
2670
2671 if (s == NULL)
2672 return NULL;
2673 sk = SSL_get_ciphers(s);
2674 if ((sk == NULL) || (sk_SSL_CIPHER_num(sk) <= n))
2675 return NULL;
2676 c = sk_SSL_CIPHER_value(sk, n);
2677 if (c == NULL)
2678 return NULL;
2679 return c->name;
2680 }
2681
2682 /** return a STACK of the ciphers available for the SSL_CTX and in order of
2683 * preference */
STACK_OF(SSL_CIPHER)2684 STACK_OF(SSL_CIPHER) *SSL_CTX_get_ciphers(const SSL_CTX *ctx)
2685 {
2686 if (ctx != NULL)
2687 return ctx->cipher_list;
2688 return NULL;
2689 }
2690
2691 /*
2692 * Distinguish between ciphers controlled by set_ciphersuite() and
2693 * set_cipher_list() when counting.
2694 */
cipher_list_tls12_num(STACK_OF (SSL_CIPHER)* sk)2695 static int cipher_list_tls12_num(STACK_OF(SSL_CIPHER) *sk)
2696 {
2697 int i, num = 0;
2698 const SSL_CIPHER *c;
2699
2700 if (sk == NULL)
2701 return 0;
2702 for (i = 0; i < sk_SSL_CIPHER_num(sk); ++i) {
2703 c = sk_SSL_CIPHER_value(sk, i);
2704 if (c->min_tls >= TLS1_3_VERSION)
2705 continue;
2706 num++;
2707 }
2708 return num;
2709 }
2710
2711 /** specify the ciphers to be used by default by the SSL_CTX */
SSL_CTX_set_cipher_list(SSL_CTX * ctx,const char * str)2712 int SSL_CTX_set_cipher_list(SSL_CTX *ctx, const char *str)
2713 {
2714 STACK_OF(SSL_CIPHER) *sk;
2715
2716 sk = ssl_create_cipher_list(ctx, ctx->tls13_ciphersuites,
2717 &ctx->cipher_list, &ctx->cipher_list_by_id, str,
2718 ctx->cert);
2719 /*
2720 * ssl_create_cipher_list may return an empty stack if it was unable to
2721 * find a cipher matching the given rule string (for example if the rule
2722 * string specifies a cipher which has been disabled). This is not an
2723 * error as far as ssl_create_cipher_list is concerned, and hence
2724 * ctx->cipher_list and ctx->cipher_list_by_id has been updated.
2725 */
2726 if (sk == NULL)
2727 return 0;
2728 else if (cipher_list_tls12_num(sk) == 0) {
2729 ERR_raise(ERR_LIB_SSL, SSL_R_NO_CIPHER_MATCH);
2730 return 0;
2731 }
2732 return 1;
2733 }
2734
2735 /** specify the ciphers to be used by the SSL */
SSL_set_cipher_list(SSL * s,const char * str)2736 int SSL_set_cipher_list(SSL *s, const char *str)
2737 {
2738 STACK_OF(SSL_CIPHER) *sk;
2739
2740 sk = ssl_create_cipher_list(s->ctx, s->tls13_ciphersuites,
2741 &s->cipher_list, &s->cipher_list_by_id, str,
2742 s->cert);
2743 /* see comment in SSL_CTX_set_cipher_list */
2744 if (sk == NULL)
2745 return 0;
2746 else if (cipher_list_tls12_num(sk) == 0) {
2747 ERR_raise(ERR_LIB_SSL, SSL_R_NO_CIPHER_MATCH);
2748 return 0;
2749 }
2750 return 1;
2751 }
2752
SSL_get_shared_ciphers(const SSL * s,char * buf,int size)2753 char *SSL_get_shared_ciphers(const SSL *s, char *buf, int size)
2754 {
2755 char *p;
2756 STACK_OF(SSL_CIPHER) *clntsk, *srvrsk;
2757 const SSL_CIPHER *c;
2758 int i;
2759
2760 if (!s->server
2761 || s->peer_ciphers == NULL
2762 || size < 2)
2763 return NULL;
2764
2765 p = buf;
2766 clntsk = s->peer_ciphers;
2767 srvrsk = SSL_get_ciphers(s);
2768 if (clntsk == NULL || srvrsk == NULL)
2769 return NULL;
2770
2771 if (sk_SSL_CIPHER_num(clntsk) == 0 || sk_SSL_CIPHER_num(srvrsk) == 0)
2772 return NULL;
2773
2774 for (i = 0; i < sk_SSL_CIPHER_num(clntsk); i++) {
2775 int n;
2776
2777 c = sk_SSL_CIPHER_value(clntsk, i);
2778 if (sk_SSL_CIPHER_find(srvrsk, c) < 0)
2779 continue;
2780
2781 n = strlen(c->name);
2782 if (n + 1 > size) {
2783 if (p != buf)
2784 --p;
2785 *p = '\0';
2786 return buf;
2787 }
2788 strcpy(p, c->name);
2789 p += n;
2790 *(p++) = ':';
2791 size -= n + 1;
2792 }
2793 p[-1] = '\0';
2794 return buf;
2795 }
2796
2797 /**
2798 * Return the requested servername (SNI) value. Note that the behaviour varies
2799 * depending on:
2800 * - whether this is called by the client or the server,
2801 * - if we are before or during/after the handshake,
2802 * - if a resumption or normal handshake is being attempted/has occurred
2803 * - whether we have negotiated TLSv1.2 (or below) or TLSv1.3
2804 *
2805 * Note that only the host_name type is defined (RFC 3546).
2806 */
SSL_get_servername(const SSL * s,const int type)2807 const char *SSL_get_servername(const SSL *s, const int type)
2808 {
2809 /*
2810 * If we don't know if we are the client or the server yet then we assume
2811 * client.
2812 */
2813 int server = s->handshake_func == NULL ? 0 : s->server;
2814 if (type != TLSEXT_NAMETYPE_host_name)
2815 return NULL;
2816
2817 if (server) {
2818 /**
2819 * Server side
2820 * In TLSv1.3 on the server SNI is not associated with the session
2821 * but in TLSv1.2 or below it is.
2822 *
2823 * Before the handshake:
2824 * - return NULL
2825 *
2826 * During/after the handshake (TLSv1.2 or below resumption occurred):
2827 * - If a servername was accepted by the server in the original
2828 * handshake then it will return that servername, or NULL otherwise.
2829 *
2830 * During/after the handshake (TLSv1.2 or below resumption did not occur):
2831 * - The function will return the servername requested by the client in
2832 * this handshake or NULL if none was requested.
2833 */
2834 if (s->hit && !SSL_IS_TLS13(s))
2835 return s->session->ext.hostname;
2836 } else {
2837 /**
2838 * Client side
2839 *
2840 * Before the handshake:
2841 * - If a servername has been set via a call to
2842 * SSL_set_tlsext_host_name() then it will return that servername
2843 * - If one has not been set, but a TLSv1.2 resumption is being
2844 * attempted and the session from the original handshake had a
2845 * servername accepted by the server then it will return that
2846 * servername
2847 * - Otherwise it returns NULL
2848 *
2849 * During/after the handshake (TLSv1.2 or below resumption occurred):
2850 * - If the session from the original handshake had a servername accepted
2851 * by the server then it will return that servername.
2852 * - Otherwise it returns the servername set via
2853 * SSL_set_tlsext_host_name() (or NULL if it was not called).
2854 *
2855 * During/after the handshake (TLSv1.2 or below resumption did not occur):
2856 * - It will return the servername set via SSL_set_tlsext_host_name()
2857 * (or NULL if it was not called).
2858 */
2859 if (SSL_in_before(s)) {
2860 if (s->ext.hostname == NULL
2861 && s->session != NULL
2862 && s->session->ssl_version != TLS1_3_VERSION)
2863 return s->session->ext.hostname;
2864 } else {
2865 if (!SSL_IS_TLS13(s) && s->hit && s->session->ext.hostname != NULL)
2866 return s->session->ext.hostname;
2867 }
2868 }
2869
2870 return s->ext.hostname;
2871 }
2872
SSL_get_servername_type(const SSL * s)2873 int SSL_get_servername_type(const SSL *s)
2874 {
2875 if (SSL_get_servername(s, TLSEXT_NAMETYPE_host_name) != NULL)
2876 return TLSEXT_NAMETYPE_host_name;
2877 return -1;
2878 }
2879
2880 /*
2881 * SSL_select_next_proto implements the standard protocol selection. It is
2882 * expected that this function is called from the callback set by
2883 * SSL_CTX_set_next_proto_select_cb. The protocol data is assumed to be a
2884 * vector of 8-bit, length prefixed byte strings. The length byte itself is
2885 * not included in the length. A byte string of length 0 is invalid. No byte
2886 * string may be truncated. The current, but experimental algorithm for
2887 * selecting the protocol is: 1) If the server doesn't support NPN then this
2888 * is indicated to the callback. In this case, the client application has to
2889 * abort the connection or have a default application level protocol. 2) If
2890 * the server supports NPN, but advertises an empty list then the client
2891 * selects the first protocol in its list, but indicates via the API that this
2892 * fallback case was enacted. 3) Otherwise, the client finds the first
2893 * protocol in the server's list that it supports and selects this protocol.
2894 * This is because it's assumed that the server has better information about
2895 * which protocol a client should use. 4) If the client doesn't support any
2896 * of the server's advertised protocols, then this is treated the same as
2897 * case 2. It returns either OPENSSL_NPN_NEGOTIATED if a common protocol was
2898 * found, or OPENSSL_NPN_NO_OVERLAP if the fallback case was reached.
2899 */
SSL_select_next_proto(unsigned char ** out,unsigned char * outlen,const unsigned char * server,unsigned int server_len,const unsigned char * client,unsigned int client_len)2900 int SSL_select_next_proto(unsigned char **out, unsigned char *outlen,
2901 const unsigned char *server,
2902 unsigned int server_len,
2903 const unsigned char *client, unsigned int client_len)
2904 {
2905 unsigned int i, j;
2906 const unsigned char *result;
2907 int status = OPENSSL_NPN_UNSUPPORTED;
2908
2909 /*
2910 * For each protocol in server preference order, see if we support it.
2911 */
2912 for (i = 0; i < server_len;) {
2913 for (j = 0; j < client_len;) {
2914 if (server[i] == client[j] &&
2915 memcmp(&server[i + 1], &client[j + 1], server[i]) == 0) {
2916 /* We found a match */
2917 result = &server[i];
2918 status = OPENSSL_NPN_NEGOTIATED;
2919 goto found;
2920 }
2921 j += client[j];
2922 j++;
2923 }
2924 i += server[i];
2925 i++;
2926 }
2927
2928 /* There's no overlap between our protocols and the server's list. */
2929 result = client;
2930 status = OPENSSL_NPN_NO_OVERLAP;
2931
2932 found:
2933 *out = (unsigned char *)result + 1;
2934 *outlen = result[0];
2935 return status;
2936 }
2937
2938 #ifndef OPENSSL_NO_NEXTPROTONEG
2939 /*
2940 * SSL_get0_next_proto_negotiated sets *data and *len to point to the
2941 * client's requested protocol for this connection and returns 0. If the
2942 * client didn't request any protocol, then *data is set to NULL. Note that
2943 * the client can request any protocol it chooses. The value returned from
2944 * this function need not be a member of the list of supported protocols
2945 * provided by the callback.
2946 */
SSL_get0_next_proto_negotiated(const SSL * s,const unsigned char ** data,unsigned * len)2947 void SSL_get0_next_proto_negotiated(const SSL *s, const unsigned char **data,
2948 unsigned *len)
2949 {
2950 *data = s->ext.npn;
2951 if (*data == NULL) {
2952 *len = 0;
2953 } else {
2954 *len = (unsigned int)s->ext.npn_len;
2955 }
2956 }
2957
2958 /*
2959 * SSL_CTX_set_npn_advertised_cb sets a callback that is called when
2960 * a TLS server needs a list of supported protocols for Next Protocol
2961 * Negotiation. The returned list must be in wire format. The list is
2962 * returned by setting |out| to point to it and |outlen| to its length. This
2963 * memory will not be modified, but one should assume that the SSL* keeps a
2964 * reference to it. The callback should return SSL_TLSEXT_ERR_OK if it
2965 * wishes to advertise. Otherwise, no such extension will be included in the
2966 * ServerHello.
2967 */
SSL_CTX_set_npn_advertised_cb(SSL_CTX * ctx,SSL_CTX_npn_advertised_cb_func cb,void * arg)2968 void SSL_CTX_set_npn_advertised_cb(SSL_CTX *ctx,
2969 SSL_CTX_npn_advertised_cb_func cb,
2970 void *arg)
2971 {
2972 ctx->ext.npn_advertised_cb = cb;
2973 ctx->ext.npn_advertised_cb_arg = arg;
2974 }
2975
2976 /*
2977 * SSL_CTX_set_next_proto_select_cb sets a callback that is called when a
2978 * client needs to select a protocol from the server's provided list. |out|
2979 * must be set to point to the selected protocol (which may be within |in|).
2980 * The length of the protocol name must be written into |outlen|. The
2981 * server's advertised protocols are provided in |in| and |inlen|. The
2982 * callback can assume that |in| is syntactically valid. The client must
2983 * select a protocol. It is fatal to the connection if this callback returns
2984 * a value other than SSL_TLSEXT_ERR_OK.
2985 */
SSL_CTX_set_npn_select_cb(SSL_CTX * ctx,SSL_CTX_npn_select_cb_func cb,void * arg)2986 void SSL_CTX_set_npn_select_cb(SSL_CTX *ctx,
2987 SSL_CTX_npn_select_cb_func cb,
2988 void *arg)
2989 {
2990 ctx->ext.npn_select_cb = cb;
2991 ctx->ext.npn_select_cb_arg = arg;
2992 }
2993 #endif
2994
alpn_value_ok(const unsigned char * protos,unsigned int protos_len)2995 static int alpn_value_ok(const unsigned char *protos, unsigned int protos_len)
2996 {
2997 unsigned int idx;
2998
2999 if (protos_len < 2 || protos == NULL)
3000 return 0;
3001
3002 for (idx = 0; idx < protos_len; idx += protos[idx] + 1) {
3003 if (protos[idx] == 0)
3004 return 0;
3005 }
3006 return idx == protos_len;
3007 }
3008 /*
3009 * SSL_CTX_set_alpn_protos sets the ALPN protocol list on |ctx| to |protos|.
3010 * |protos| must be in wire-format (i.e. a series of non-empty, 8-bit
3011 * length-prefixed strings). Returns 0 on success.
3012 */
SSL_CTX_set_alpn_protos(SSL_CTX * ctx,const unsigned char * protos,unsigned int protos_len)3013 int SSL_CTX_set_alpn_protos(SSL_CTX *ctx, const unsigned char *protos,
3014 unsigned int protos_len)
3015 {
3016 unsigned char *alpn;
3017
3018 if (protos_len == 0 || protos == NULL) {
3019 OPENSSL_free(ctx->ext.alpn);
3020 ctx->ext.alpn = NULL;
3021 ctx->ext.alpn_len = 0;
3022 return 0;
3023 }
3024 /* Not valid per RFC */
3025 if (!alpn_value_ok(protos, protos_len))
3026 return 1;
3027
3028 alpn = OPENSSL_memdup(protos, protos_len);
3029 if (alpn == NULL) {
3030 ERR_raise(ERR_LIB_SSL, ERR_R_MALLOC_FAILURE);
3031 return 1;
3032 }
3033 OPENSSL_free(ctx->ext.alpn);
3034 ctx->ext.alpn = alpn;
3035 ctx->ext.alpn_len = protos_len;
3036
3037 return 0;
3038 }
3039
3040 /*
3041 * SSL_set_alpn_protos sets the ALPN protocol list on |ssl| to |protos|.
3042 * |protos| must be in wire-format (i.e. a series of non-empty, 8-bit
3043 * length-prefixed strings). Returns 0 on success.
3044 */
SSL_set_alpn_protos(SSL * ssl,const unsigned char * protos,unsigned int protos_len)3045 int SSL_set_alpn_protos(SSL *ssl, const unsigned char *protos,
3046 unsigned int protos_len)
3047 {
3048 unsigned char *alpn;
3049
3050 if (protos_len == 0 || protos == NULL) {
3051 OPENSSL_free(ssl->ext.alpn);
3052 ssl->ext.alpn = NULL;
3053 ssl->ext.alpn_len = 0;
3054 return 0;
3055 }
3056 /* Not valid per RFC */
3057 if (!alpn_value_ok(protos, protos_len))
3058 return 1;
3059
3060 alpn = OPENSSL_memdup(protos, protos_len);
3061 if (alpn == NULL) {
3062 ERR_raise(ERR_LIB_SSL, ERR_R_MALLOC_FAILURE);
3063 return 1;
3064 }
3065 OPENSSL_free(ssl->ext.alpn);
3066 ssl->ext.alpn = alpn;
3067 ssl->ext.alpn_len = protos_len;
3068
3069 return 0;
3070 }
3071
3072 /*
3073 * SSL_CTX_set_alpn_select_cb sets a callback function on |ctx| that is
3074 * called during ClientHello processing in order to select an ALPN protocol
3075 * from the client's list of offered protocols.
3076 */
SSL_CTX_set_alpn_select_cb(SSL_CTX * ctx,SSL_CTX_alpn_select_cb_func cb,void * arg)3077 void SSL_CTX_set_alpn_select_cb(SSL_CTX *ctx,
3078 SSL_CTX_alpn_select_cb_func cb,
3079 void *arg)
3080 {
3081 ctx->ext.alpn_select_cb = cb;
3082 ctx->ext.alpn_select_cb_arg = arg;
3083 }
3084
3085 /*
3086 * SSL_get0_alpn_selected gets the selected ALPN protocol (if any) from |ssl|.
3087 * On return it sets |*data| to point to |*len| bytes of protocol name
3088 * (not including the leading length-prefix byte). If the server didn't
3089 * respond with a negotiated protocol then |*len| will be zero.
3090 */
SSL_get0_alpn_selected(const SSL * ssl,const unsigned char ** data,unsigned int * len)3091 void SSL_get0_alpn_selected(const SSL *ssl, const unsigned char **data,
3092 unsigned int *len)
3093 {
3094 *data = ssl->s3.alpn_selected;
3095 if (*data == NULL)
3096 *len = 0;
3097 else
3098 *len = (unsigned int)ssl->s3.alpn_selected_len;
3099 }
3100
SSL_export_keying_material(SSL * s,unsigned char * out,size_t olen,const char * label,size_t llen,const unsigned char * context,size_t contextlen,int use_context)3101 int SSL_export_keying_material(SSL *s, unsigned char *out, size_t olen,
3102 const char *label, size_t llen,
3103 const unsigned char *context, size_t contextlen,
3104 int use_context)
3105 {
3106 if (s->session == NULL
3107 || (s->version < TLS1_VERSION && s->version != DTLS1_BAD_VER))
3108 return -1;
3109
3110 return s->method->ssl3_enc->export_keying_material(s, out, olen, label,
3111 llen, context,
3112 contextlen, use_context);
3113 }
3114
SSL_export_keying_material_early(SSL * s,unsigned char * out,size_t olen,const char * label,size_t llen,const unsigned char * context,size_t contextlen)3115 int SSL_export_keying_material_early(SSL *s, unsigned char *out, size_t olen,
3116 const char *label, size_t llen,
3117 const unsigned char *context,
3118 size_t contextlen)
3119 {
3120 if (s->version != TLS1_3_VERSION)
3121 return 0;
3122
3123 return tls13_export_keying_material_early(s, out, olen, label, llen,
3124 context, contextlen);
3125 }
3126
ssl_session_hash(const SSL_SESSION * a)3127 static unsigned long ssl_session_hash(const SSL_SESSION *a)
3128 {
3129 const unsigned char *session_id = a->session_id;
3130 unsigned long l;
3131 unsigned char tmp_storage[4];
3132
3133 if (a->session_id_length < sizeof(tmp_storage)) {
3134 memset(tmp_storage, 0, sizeof(tmp_storage));
3135 memcpy(tmp_storage, a->session_id, a->session_id_length);
3136 session_id = tmp_storage;
3137 }
3138
3139 l = (unsigned long)
3140 ((unsigned long)session_id[0]) |
3141 ((unsigned long)session_id[1] << 8L) |
3142 ((unsigned long)session_id[2] << 16L) |
3143 ((unsigned long)session_id[3] << 24L);
3144 return l;
3145 }
3146
3147 /*
3148 * NB: If this function (or indeed the hash function which uses a sort of
3149 * coarser function than this one) is changed, ensure
3150 * SSL_CTX_has_matching_session_id() is checked accordingly. It relies on
3151 * being able to construct an SSL_SESSION that will collide with any existing
3152 * session with a matching session ID.
3153 */
ssl_session_cmp(const SSL_SESSION * a,const SSL_SESSION * b)3154 static int ssl_session_cmp(const SSL_SESSION *a, const SSL_SESSION *b)
3155 {
3156 if (a->ssl_version != b->ssl_version)
3157 return 1;
3158 if (a->session_id_length != b->session_id_length)
3159 return 1;
3160 return memcmp(a->session_id, b->session_id, a->session_id_length);
3161 }
3162
3163 /*
3164 * These wrapper functions should remain rather than redeclaring
3165 * SSL_SESSION_hash and SSL_SESSION_cmp for void* types and casting each
3166 * variable. The reason is that the functions aren't static, they're exposed
3167 * via ssl.h.
3168 */
3169
SSL_CTX_new_ex(OSSL_LIB_CTX * libctx,const char * propq,const SSL_METHOD * meth)3170 SSL_CTX *SSL_CTX_new_ex(OSSL_LIB_CTX *libctx, const char *propq,
3171 const SSL_METHOD *meth)
3172 {
3173 SSL_CTX *ret = NULL;
3174
3175 if (meth == NULL) {
3176 ERR_raise(ERR_LIB_SSL, SSL_R_NULL_SSL_METHOD_PASSED);
3177 return NULL;
3178 }
3179
3180 if (!OPENSSL_init_ssl(OPENSSL_INIT_LOAD_SSL_STRINGS, NULL))
3181 return NULL;
3182
3183 if (SSL_get_ex_data_X509_STORE_CTX_idx() < 0) {
3184 ERR_raise(ERR_LIB_SSL, SSL_R_X509_VERIFICATION_SETUP_PROBLEMS);
3185 goto err;
3186 }
3187 ret = OPENSSL_zalloc(sizeof(*ret));
3188 if (ret == NULL)
3189 goto err;
3190
3191 /* Init the reference counting before any call to SSL_CTX_free */
3192 ret->references = 1;
3193 ret->lock = CRYPTO_THREAD_lock_new();
3194 if (ret->lock == NULL) {
3195 ERR_raise(ERR_LIB_SSL, ERR_R_MALLOC_FAILURE);
3196 OPENSSL_free(ret);
3197 return NULL;
3198 }
3199
3200 ret->libctx = libctx;
3201 if (propq != NULL) {
3202 ret->propq = OPENSSL_strdup(propq);
3203 if (ret->propq == NULL)
3204 goto err;
3205 }
3206
3207 ret->method = meth;
3208 ret->min_proto_version = 0;
3209 ret->max_proto_version = 0;
3210 ret->mode = SSL_MODE_AUTO_RETRY;
3211 ret->session_cache_mode = SSL_SESS_CACHE_SERVER;
3212 ret->session_cache_size = SSL_SESSION_CACHE_MAX_SIZE_DEFAULT;
3213 /* We take the system default. */
3214 ret->session_timeout = meth->get_timeout();
3215 ret->max_cert_list = SSL_MAX_CERT_LIST_DEFAULT;
3216 ret->verify_mode = SSL_VERIFY_NONE;
3217 if ((ret->cert = ssl_cert_new()) == NULL)
3218 goto err;
3219
3220 ret->sessions = lh_SSL_SESSION_new(ssl_session_hash, ssl_session_cmp);
3221 if (ret->sessions == NULL)
3222 goto err;
3223 ret->cert_store = X509_STORE_new();
3224 if (ret->cert_store == NULL)
3225 goto err;
3226 #ifndef OPENSSL_NO_CT
3227 ret->ctlog_store = CTLOG_STORE_new_ex(libctx, propq);
3228 if (ret->ctlog_store == NULL)
3229 goto err;
3230 #endif
3231
3232 /* initialize cipher/digest methods table */
3233 if (!ssl_load_ciphers(ret))
3234 goto err2;
3235 /* initialise sig algs */
3236 if (!ssl_setup_sig_algs(ret))
3237 goto err2;
3238
3239
3240 if (!ssl_load_groups(ret))
3241 goto err2;
3242
3243 if (!SSL_CTX_set_ciphersuites(ret, OSSL_default_ciphersuites()))
3244 goto err;
3245
3246 if (!ssl_create_cipher_list(ret,
3247 ret->tls13_ciphersuites,
3248 &ret->cipher_list, &ret->cipher_list_by_id,
3249 OSSL_default_cipher_list(), ret->cert)
3250 || sk_SSL_CIPHER_num(ret->cipher_list) <= 0) {
3251 ERR_raise(ERR_LIB_SSL, SSL_R_LIBRARY_HAS_NO_CIPHERS);
3252 goto err2;
3253 }
3254
3255 ret->param = X509_VERIFY_PARAM_new();
3256 if (ret->param == NULL)
3257 goto err;
3258
3259 /*
3260 * If these aren't available from the provider we'll get NULL returns.
3261 * That's fine but will cause errors later if SSLv3 is negotiated
3262 */
3263 ret->md5 = ssl_evp_md_fetch(libctx, NID_md5, propq);
3264 ret->sha1 = ssl_evp_md_fetch(libctx, NID_sha1, propq);
3265
3266 if ((ret->ca_names = sk_X509_NAME_new_null()) == NULL)
3267 goto err;
3268
3269 if ((ret->client_ca_names = sk_X509_NAME_new_null()) == NULL)
3270 goto err;
3271
3272 if (!CRYPTO_new_ex_data(CRYPTO_EX_INDEX_SSL_CTX, ret, &ret->ex_data))
3273 goto err;
3274
3275 if ((ret->ext.secure = OPENSSL_secure_zalloc(sizeof(*ret->ext.secure))) == NULL)
3276 goto err;
3277
3278 /* No compression for DTLS */
3279 if (!(meth->ssl3_enc->enc_flags & SSL_ENC_FLAG_DTLS))
3280 ret->comp_methods = SSL_COMP_get_compression_methods();
3281
3282 ret->max_send_fragment = SSL3_RT_MAX_PLAIN_LENGTH;
3283 ret->split_send_fragment = SSL3_RT_MAX_PLAIN_LENGTH;
3284
3285 /* Setup RFC5077 ticket keys */
3286 if ((RAND_bytes_ex(libctx, ret->ext.tick_key_name,
3287 sizeof(ret->ext.tick_key_name), 0) <= 0)
3288 || (RAND_priv_bytes_ex(libctx, ret->ext.secure->tick_hmac_key,
3289 sizeof(ret->ext.secure->tick_hmac_key), 0) <= 0)
3290 || (RAND_priv_bytes_ex(libctx, ret->ext.secure->tick_aes_key,
3291 sizeof(ret->ext.secure->tick_aes_key), 0) <= 0))
3292 ret->options |= SSL_OP_NO_TICKET;
3293
3294 if (RAND_priv_bytes_ex(libctx, ret->ext.cookie_hmac_key,
3295 sizeof(ret->ext.cookie_hmac_key), 0) <= 0)
3296 goto err;
3297
3298 #ifndef OPENSSL_NO_SRP
3299 if (!ssl_ctx_srp_ctx_init_intern(ret))
3300 goto err;
3301 #endif
3302 #ifndef OPENSSL_NO_ENGINE
3303 # ifdef OPENSSL_SSL_CLIENT_ENGINE_AUTO
3304 # define eng_strx(x) #x
3305 # define eng_str(x) eng_strx(x)
3306 /* Use specific client engine automatically... ignore errors */
3307 {
3308 ENGINE *eng;
3309 eng = ENGINE_by_id(eng_str(OPENSSL_SSL_CLIENT_ENGINE_AUTO));
3310 if (!eng) {
3311 ERR_clear_error();
3312 ENGINE_load_builtin_engines();
3313 eng = ENGINE_by_id(eng_str(OPENSSL_SSL_CLIENT_ENGINE_AUTO));
3314 }
3315 if (!eng || !SSL_CTX_set_client_cert_engine(ret, eng))
3316 ERR_clear_error();
3317 }
3318 # endif
3319 #endif
3320 /*
3321 * Disable compression by default to prevent CRIME. Applications can
3322 * re-enable compression by configuring
3323 * SSL_CTX_clear_options(ctx, SSL_OP_NO_COMPRESSION);
3324 * or by using the SSL_CONF library. Similarly we also enable TLSv1.3
3325 * middlebox compatibility by default. This may be disabled by default in
3326 * a later OpenSSL version.
3327 */
3328 ret->options |= SSL_OP_NO_COMPRESSION | SSL_OP_ENABLE_MIDDLEBOX_COMPAT;
3329
3330 ret->ext.status_type = TLSEXT_STATUSTYPE_nothing;
3331
3332 /*
3333 * We cannot usefully set a default max_early_data here (which gets
3334 * propagated in SSL_new(), for the following reason: setting the
3335 * SSL field causes tls_construct_stoc_early_data() to tell the
3336 * client that early data will be accepted when constructing a TLS 1.3
3337 * session ticket, and the client will accordingly send us early data
3338 * when using that ticket (if the client has early data to send).
3339 * However, in order for the early data to actually be consumed by
3340 * the application, the application must also have calls to
3341 * SSL_read_early_data(); otherwise we'll just skip past the early data
3342 * and ignore it. So, since the application must add calls to
3343 * SSL_read_early_data(), we also require them to add
3344 * calls to SSL_CTX_set_max_early_data() in order to use early data,
3345 * eliminating the bandwidth-wasting early data in the case described
3346 * above.
3347 */
3348 ret->max_early_data = 0;
3349
3350 /*
3351 * Default recv_max_early_data is a fully loaded single record. Could be
3352 * split across multiple records in practice. We set this differently to
3353 * max_early_data so that, in the default case, we do not advertise any
3354 * support for early_data, but if a client were to send us some (e.g.
3355 * because of an old, stale ticket) then we will tolerate it and skip over
3356 * it.
3357 */
3358 ret->recv_max_early_data = SSL3_RT_MAX_PLAIN_LENGTH;
3359
3360 /* By default we send two session tickets automatically in TLSv1.3 */
3361 ret->num_tickets = 2;
3362
3363 ssl_ctx_system_config(ret);
3364
3365 return ret;
3366 err:
3367 ERR_raise(ERR_LIB_SSL, ERR_R_MALLOC_FAILURE);
3368 err2:
3369 SSL_CTX_free(ret);
3370 return NULL;
3371 }
3372
SSL_CTX_new(const SSL_METHOD * meth)3373 SSL_CTX *SSL_CTX_new(const SSL_METHOD *meth)
3374 {
3375 return SSL_CTX_new_ex(NULL, NULL, meth);
3376 }
3377
SSL_CTX_up_ref(SSL_CTX * ctx)3378 int SSL_CTX_up_ref(SSL_CTX *ctx)
3379 {
3380 int i;
3381
3382 if (CRYPTO_UP_REF(&ctx->references, &i, ctx->lock) <= 0)
3383 return 0;
3384
3385 REF_PRINT_COUNT("SSL_CTX", ctx);
3386 REF_ASSERT_ISNT(i < 2);
3387 return ((i > 1) ? 1 : 0);
3388 }
3389
SSL_CTX_free(SSL_CTX * a)3390 void SSL_CTX_free(SSL_CTX *a)
3391 {
3392 int i;
3393 size_t j;
3394
3395 if (a == NULL)
3396 return;
3397
3398 CRYPTO_DOWN_REF(&a->references, &i, a->lock);
3399 REF_PRINT_COUNT("SSL_CTX", a);
3400 if (i > 0)
3401 return;
3402 REF_ASSERT_ISNT(i < 0);
3403
3404 X509_VERIFY_PARAM_free(a->param);
3405 dane_ctx_final(&a->dane);
3406
3407 /*
3408 * Free internal session cache. However: the remove_cb() may reference
3409 * the ex_data of SSL_CTX, thus the ex_data store can only be removed
3410 * after the sessions were flushed.
3411 * As the ex_data handling routines might also touch the session cache,
3412 * the most secure solution seems to be: empty (flush) the cache, then
3413 * free ex_data, then finally free the cache.
3414 * (See ticket [openssl.org #212].)
3415 */
3416 if (a->sessions != NULL)
3417 SSL_CTX_flush_sessions(a, 0);
3418
3419 CRYPTO_free_ex_data(CRYPTO_EX_INDEX_SSL_CTX, a, &a->ex_data);
3420 lh_SSL_SESSION_free(a->sessions);
3421 X509_STORE_free(a->cert_store);
3422 #ifndef OPENSSL_NO_CT
3423 CTLOG_STORE_free(a->ctlog_store);
3424 #endif
3425 sk_SSL_CIPHER_free(a->cipher_list);
3426 sk_SSL_CIPHER_free(a->cipher_list_by_id);
3427 sk_SSL_CIPHER_free(a->tls13_ciphersuites);
3428 ssl_cert_free(a->cert);
3429 sk_X509_NAME_pop_free(a->ca_names, X509_NAME_free);
3430 sk_X509_NAME_pop_free(a->client_ca_names, X509_NAME_free);
3431 sk_X509_pop_free(a->extra_certs, X509_free);
3432 a->comp_methods = NULL;
3433 #ifndef OPENSSL_NO_SRTP
3434 sk_SRTP_PROTECTION_PROFILE_free(a->srtp_profiles);
3435 #endif
3436 #ifndef OPENSSL_NO_SRP
3437 ssl_ctx_srp_ctx_free_intern(a);
3438 #endif
3439 #ifndef OPENSSL_NO_ENGINE
3440 tls_engine_finish(a->client_cert_engine);
3441 #endif
3442
3443 OPENSSL_free(a->ext.ecpointformats);
3444 OPENSSL_free(a->ext.supportedgroups);
3445 OPENSSL_free(a->ext.supported_groups_default);
3446 OPENSSL_free(a->ext.alpn);
3447 OPENSSL_secure_free(a->ext.secure);
3448
3449 ssl_evp_md_free(a->md5);
3450 ssl_evp_md_free(a->sha1);
3451
3452 for (j = 0; j < SSL_ENC_NUM_IDX; j++)
3453 ssl_evp_cipher_free(a->ssl_cipher_methods[j]);
3454 for (j = 0; j < SSL_MD_NUM_IDX; j++)
3455 ssl_evp_md_free(a->ssl_digest_methods[j]);
3456 for (j = 0; j < a->group_list_len; j++) {
3457 OPENSSL_free(a->group_list[j].tlsname);
3458 OPENSSL_free(a->group_list[j].realname);
3459 OPENSSL_free(a->group_list[j].algorithm);
3460 }
3461 OPENSSL_free(a->group_list);
3462
3463 OPENSSL_free(a->sigalg_lookup_cache);
3464
3465 CRYPTO_THREAD_lock_free(a->lock);
3466
3467 OPENSSL_free(a->propq);
3468
3469 OPENSSL_free(a);
3470 }
3471
SSL_CTX_set_default_passwd_cb(SSL_CTX * ctx,pem_password_cb * cb)3472 void SSL_CTX_set_default_passwd_cb(SSL_CTX *ctx, pem_password_cb *cb)
3473 {
3474 ctx->default_passwd_callback = cb;
3475 }
3476
SSL_CTX_set_default_passwd_cb_userdata(SSL_CTX * ctx,void * u)3477 void SSL_CTX_set_default_passwd_cb_userdata(SSL_CTX *ctx, void *u)
3478 {
3479 ctx->default_passwd_callback_userdata = u;
3480 }
3481
SSL_CTX_get_default_passwd_cb(SSL_CTX * ctx)3482 pem_password_cb *SSL_CTX_get_default_passwd_cb(SSL_CTX *ctx)
3483 {
3484 return ctx->default_passwd_callback;
3485 }
3486
SSL_CTX_get_default_passwd_cb_userdata(SSL_CTX * ctx)3487 void *SSL_CTX_get_default_passwd_cb_userdata(SSL_CTX *ctx)
3488 {
3489 return ctx->default_passwd_callback_userdata;
3490 }
3491
SSL_set_default_passwd_cb(SSL * s,pem_password_cb * cb)3492 void SSL_set_default_passwd_cb(SSL *s, pem_password_cb *cb)
3493 {
3494 s->default_passwd_callback = cb;
3495 }
3496
SSL_set_default_passwd_cb_userdata(SSL * s,void * u)3497 void SSL_set_default_passwd_cb_userdata(SSL *s, void *u)
3498 {
3499 s->default_passwd_callback_userdata = u;
3500 }
3501
SSL_get_default_passwd_cb(SSL * s)3502 pem_password_cb *SSL_get_default_passwd_cb(SSL *s)
3503 {
3504 return s->default_passwd_callback;
3505 }
3506
SSL_get_default_passwd_cb_userdata(SSL * s)3507 void *SSL_get_default_passwd_cb_userdata(SSL *s)
3508 {
3509 return s->default_passwd_callback_userdata;
3510 }
3511
SSL_CTX_set_cert_verify_callback(SSL_CTX * ctx,int (* cb)(X509_STORE_CTX *,void *),void * arg)3512 void SSL_CTX_set_cert_verify_callback(SSL_CTX *ctx,
3513 int (*cb) (X509_STORE_CTX *, void *),
3514 void *arg)
3515 {
3516 ctx->app_verify_callback = cb;
3517 ctx->app_verify_arg = arg;
3518 }
3519
SSL_CTX_set_verify(SSL_CTX * ctx,int mode,int (* cb)(int,X509_STORE_CTX *))3520 void SSL_CTX_set_verify(SSL_CTX *ctx, int mode,
3521 int (*cb) (int, X509_STORE_CTX *))
3522 {
3523 ctx->verify_mode = mode;
3524 ctx->default_verify_callback = cb;
3525 }
3526
SSL_CTX_set_verify_depth(SSL_CTX * ctx,int depth)3527 void SSL_CTX_set_verify_depth(SSL_CTX *ctx, int depth)
3528 {
3529 X509_VERIFY_PARAM_set_depth(ctx->param, depth);
3530 }
3531
SSL_CTX_set_cert_cb(SSL_CTX * c,int (* cb)(SSL * ssl,void * arg),void * arg)3532 void SSL_CTX_set_cert_cb(SSL_CTX *c, int (*cb) (SSL *ssl, void *arg), void *arg)
3533 {
3534 ssl_cert_set_cert_cb(c->cert, cb, arg);
3535 }
3536
SSL_set_cert_cb(SSL * s,int (* cb)(SSL * ssl,void * arg),void * arg)3537 void SSL_set_cert_cb(SSL *s, int (*cb) (SSL *ssl, void *arg), void *arg)
3538 {
3539 ssl_cert_set_cert_cb(s->cert, cb, arg);
3540 }
3541
ssl_set_masks(SSL * s)3542 void ssl_set_masks(SSL *s)
3543 {
3544 CERT *c = s->cert;
3545 uint32_t *pvalid = s->s3.tmp.valid_flags;
3546 int rsa_enc, rsa_sign, dh_tmp, dsa_sign;
3547 unsigned long mask_k, mask_a;
3548 int have_ecc_cert, ecdsa_ok;
3549
3550 if (c == NULL)
3551 return;
3552
3553 dh_tmp = (c->dh_tmp != NULL
3554 || c->dh_tmp_cb != NULL
3555 || c->dh_tmp_auto);
3556
3557 rsa_enc = pvalid[SSL_PKEY_RSA] & CERT_PKEY_VALID;
3558 rsa_sign = pvalid[SSL_PKEY_RSA] & CERT_PKEY_VALID;
3559 dsa_sign = pvalid[SSL_PKEY_DSA_SIGN] & CERT_PKEY_VALID;
3560 have_ecc_cert = pvalid[SSL_PKEY_ECC] & CERT_PKEY_VALID;
3561 mask_k = 0;
3562 mask_a = 0;
3563
3564 OSSL_TRACE4(TLS_CIPHER, "dh_tmp=%d rsa_enc=%d rsa_sign=%d dsa_sign=%d\n",
3565 dh_tmp, rsa_enc, rsa_sign, dsa_sign);
3566
3567 #ifndef OPENSSL_NO_GOST
3568 if (ssl_has_cert(s, SSL_PKEY_GOST12_512)) {
3569 mask_k |= SSL_kGOST | SSL_kGOST18;
3570 mask_a |= SSL_aGOST12;
3571 }
3572 if (ssl_has_cert(s, SSL_PKEY_GOST12_256)) {
3573 mask_k |= SSL_kGOST | SSL_kGOST18;
3574 mask_a |= SSL_aGOST12;
3575 }
3576 if (ssl_has_cert(s, SSL_PKEY_GOST01)) {
3577 mask_k |= SSL_kGOST;
3578 mask_a |= SSL_aGOST01;
3579 }
3580 #endif
3581
3582 if (rsa_enc)
3583 mask_k |= SSL_kRSA;
3584
3585 if (dh_tmp)
3586 mask_k |= SSL_kDHE;
3587
3588 /*
3589 * If we only have an RSA-PSS certificate allow RSA authentication
3590 * if TLS 1.2 and peer supports it.
3591 */
3592
3593 if (rsa_enc || rsa_sign || (ssl_has_cert(s, SSL_PKEY_RSA_PSS_SIGN)
3594 && pvalid[SSL_PKEY_RSA_PSS_SIGN] & CERT_PKEY_EXPLICIT_SIGN
3595 && TLS1_get_version(s) == TLS1_2_VERSION))
3596 mask_a |= SSL_aRSA;
3597
3598 if (dsa_sign) {
3599 mask_a |= SSL_aDSS;
3600 }
3601
3602 mask_a |= SSL_aNULL;
3603
3604 /*
3605 * An ECC certificate may be usable for ECDH and/or ECDSA cipher suites
3606 * depending on the key usage extension.
3607 */
3608 if (have_ecc_cert) {
3609 uint32_t ex_kusage;
3610 ex_kusage = X509_get_key_usage(c->pkeys[SSL_PKEY_ECC].x509);
3611 ecdsa_ok = ex_kusage & X509v3_KU_DIGITAL_SIGNATURE;
3612 if (!(pvalid[SSL_PKEY_ECC] & CERT_PKEY_SIGN))
3613 ecdsa_ok = 0;
3614 if (ecdsa_ok)
3615 mask_a |= SSL_aECDSA;
3616 }
3617 /* Allow Ed25519 for TLS 1.2 if peer supports it */
3618 if (!(mask_a & SSL_aECDSA) && ssl_has_cert(s, SSL_PKEY_ED25519)
3619 && pvalid[SSL_PKEY_ED25519] & CERT_PKEY_EXPLICIT_SIGN
3620 && TLS1_get_version(s) == TLS1_2_VERSION)
3621 mask_a |= SSL_aECDSA;
3622
3623 /* Allow Ed448 for TLS 1.2 if peer supports it */
3624 if (!(mask_a & SSL_aECDSA) && ssl_has_cert(s, SSL_PKEY_ED448)
3625 && pvalid[SSL_PKEY_ED448] & CERT_PKEY_EXPLICIT_SIGN
3626 && TLS1_get_version(s) == TLS1_2_VERSION)
3627 mask_a |= SSL_aECDSA;
3628
3629 mask_k |= SSL_kECDHE;
3630
3631 #ifndef OPENSSL_NO_PSK
3632 mask_k |= SSL_kPSK;
3633 mask_a |= SSL_aPSK;
3634 if (mask_k & SSL_kRSA)
3635 mask_k |= SSL_kRSAPSK;
3636 if (mask_k & SSL_kDHE)
3637 mask_k |= SSL_kDHEPSK;
3638 if (mask_k & SSL_kECDHE)
3639 mask_k |= SSL_kECDHEPSK;
3640 #endif
3641
3642 s->s3.tmp.mask_k = mask_k;
3643 s->s3.tmp.mask_a = mask_a;
3644 }
3645
ssl_check_srvr_ecc_cert_and_alg(X509 * x,SSL * s)3646 int ssl_check_srvr_ecc_cert_and_alg(X509 *x, SSL *s)
3647 {
3648 if (s->s3.tmp.new_cipher->algorithm_auth & SSL_aECDSA) {
3649 /* key usage, if present, must allow signing */
3650 if (!(X509_get_key_usage(x) & X509v3_KU_DIGITAL_SIGNATURE)) {
3651 ERR_raise(ERR_LIB_SSL, SSL_R_ECC_CERT_NOT_FOR_SIGNING);
3652 return 0;
3653 }
3654 }
3655 return 1; /* all checks are ok */
3656 }
3657
ssl_get_server_cert_serverinfo(SSL * s,const unsigned char ** serverinfo,size_t * serverinfo_length)3658 int ssl_get_server_cert_serverinfo(SSL *s, const unsigned char **serverinfo,
3659 size_t *serverinfo_length)
3660 {
3661 CERT_PKEY *cpk = s->s3.tmp.cert;
3662 *serverinfo_length = 0;
3663
3664 if (cpk == NULL || cpk->serverinfo == NULL)
3665 return 0;
3666
3667 *serverinfo = cpk->serverinfo;
3668 *serverinfo_length = cpk->serverinfo_length;
3669 return 1;
3670 }
3671
ssl_update_cache(SSL * s,int mode)3672 void ssl_update_cache(SSL *s, int mode)
3673 {
3674 int i;
3675
3676 /*
3677 * If the session_id_length is 0, we are not supposed to cache it, and it
3678 * would be rather hard to do anyway :-)
3679 */
3680 if (s->session->session_id_length == 0)
3681 return;
3682
3683 /*
3684 * If sid_ctx_length is 0 there is no specific application context
3685 * associated with this session, so when we try to resume it and
3686 * SSL_VERIFY_PEER is requested to verify the client identity, we have no
3687 * indication that this is actually a session for the proper application
3688 * context, and the *handshake* will fail, not just the resumption attempt.
3689 * Do not cache (on the server) these sessions that are not resumable
3690 * (clients can set SSL_VERIFY_PEER without needing a sid_ctx set).
3691 */
3692 if (s->server && s->session->sid_ctx_length == 0
3693 && (s->verify_mode & SSL_VERIFY_PEER) != 0)
3694 return;
3695
3696 i = s->session_ctx->session_cache_mode;
3697 if ((i & mode) != 0
3698 && (!s->hit || SSL_IS_TLS13(s))) {
3699 /*
3700 * Add the session to the internal cache. In server side TLSv1.3 we
3701 * normally don't do this because by default it's a full stateless ticket
3702 * with only a dummy session id so there is no reason to cache it,
3703 * unless:
3704 * - we are doing early_data, in which case we cache so that we can
3705 * detect replays
3706 * - the application has set a remove_session_cb so needs to know about
3707 * session timeout events
3708 * - SSL_OP_NO_TICKET is set in which case it is a stateful ticket
3709 */
3710 if ((i & SSL_SESS_CACHE_NO_INTERNAL_STORE) == 0
3711 && (!SSL_IS_TLS13(s)
3712 || !s->server
3713 || (s->max_early_data > 0
3714 && (s->options & SSL_OP_NO_ANTI_REPLAY) == 0)
3715 || s->session_ctx->remove_session_cb != NULL
3716 || (s->options & SSL_OP_NO_TICKET) != 0))
3717 SSL_CTX_add_session(s->session_ctx, s->session);
3718
3719 /*
3720 * Add the session to the external cache. We do this even in server side
3721 * TLSv1.3 without early data because some applications just want to
3722 * know about the creation of a session and aren't doing a full cache.
3723 */
3724 if (s->session_ctx->new_session_cb != NULL) {
3725 SSL_SESSION_up_ref(s->session);
3726 if (!s->session_ctx->new_session_cb(s, s->session))
3727 SSL_SESSION_free(s->session);
3728 }
3729 }
3730
3731 /* auto flush every 255 connections */
3732 if ((!(i & SSL_SESS_CACHE_NO_AUTO_CLEAR)) && ((i & mode) == mode)) {
3733 TSAN_QUALIFIER int *stat;
3734 if (mode & SSL_SESS_CACHE_CLIENT)
3735 stat = &s->session_ctx->stats.sess_connect_good;
3736 else
3737 stat = &s->session_ctx->stats.sess_accept_good;
3738 if ((tsan_load(stat) & 0xff) == 0xff)
3739 SSL_CTX_flush_sessions(s->session_ctx, (unsigned long)time(NULL));
3740 }
3741 }
3742
SSL_CTX_get_ssl_method(const SSL_CTX * ctx)3743 const SSL_METHOD *SSL_CTX_get_ssl_method(const SSL_CTX *ctx)
3744 {
3745 return ctx->method;
3746 }
3747
SSL_get_ssl_method(const SSL * s)3748 const SSL_METHOD *SSL_get_ssl_method(const SSL *s)
3749 {
3750 return s->method;
3751 }
3752
SSL_set_ssl_method(SSL * s,const SSL_METHOD * meth)3753 int SSL_set_ssl_method(SSL *s, const SSL_METHOD *meth)
3754 {
3755 int ret = 1;
3756
3757 if (s->method != meth) {
3758 const SSL_METHOD *sm = s->method;
3759 int (*hf) (SSL *) = s->handshake_func;
3760
3761 if (sm->version == meth->version)
3762 s->method = meth;
3763 else {
3764 sm->ssl_free(s);
3765 s->method = meth;
3766 ret = s->method->ssl_new(s);
3767 }
3768
3769 if (hf == sm->ssl_connect)
3770 s->handshake_func = meth->ssl_connect;
3771 else if (hf == sm->ssl_accept)
3772 s->handshake_func = meth->ssl_accept;
3773 }
3774 return ret;
3775 }
3776
SSL_get_error(const SSL * s,int i)3777 int SSL_get_error(const SSL *s, int i)
3778 {
3779 int reason;
3780 unsigned long l;
3781 BIO *bio;
3782
3783 if (i > 0)
3784 return SSL_ERROR_NONE;
3785
3786 /*
3787 * Make things return SSL_ERROR_SYSCALL when doing SSL_do_handshake etc,
3788 * where we do encode the error
3789 */
3790 if ((l = ERR_peek_error()) != 0) {
3791 if (ERR_GET_LIB(l) == ERR_LIB_SYS)
3792 return SSL_ERROR_SYSCALL;
3793 else
3794 return SSL_ERROR_SSL;
3795 }
3796
3797 if (SSL_want_read(s)) {
3798 bio = SSL_get_rbio(s);
3799 if (BIO_should_read(bio))
3800 return SSL_ERROR_WANT_READ;
3801 else if (BIO_should_write(bio))
3802 /*
3803 * This one doesn't make too much sense ... We never try to write
3804 * to the rbio, and an application program where rbio and wbio
3805 * are separate couldn't even know what it should wait for.
3806 * However if we ever set s->rwstate incorrectly (so that we have
3807 * SSL_want_read(s) instead of SSL_want_write(s)) and rbio and
3808 * wbio *are* the same, this test works around that bug; so it
3809 * might be safer to keep it.
3810 */
3811 return SSL_ERROR_WANT_WRITE;
3812 else if (BIO_should_io_special(bio)) {
3813 reason = BIO_get_retry_reason(bio);
3814 if (reason == BIO_RR_CONNECT)
3815 return SSL_ERROR_WANT_CONNECT;
3816 else if (reason == BIO_RR_ACCEPT)
3817 return SSL_ERROR_WANT_ACCEPT;
3818 else
3819 return SSL_ERROR_SYSCALL; /* unknown */
3820 }
3821 }
3822
3823 if (SSL_want_write(s)) {
3824 /* Access wbio directly - in order to use the buffered bio if present */
3825 bio = s->wbio;
3826 if (BIO_should_write(bio))
3827 return SSL_ERROR_WANT_WRITE;
3828 else if (BIO_should_read(bio))
3829 /*
3830 * See above (SSL_want_read(s) with BIO_should_write(bio))
3831 */
3832 return SSL_ERROR_WANT_READ;
3833 else if (BIO_should_io_special(bio)) {
3834 reason = BIO_get_retry_reason(bio);
3835 if (reason == BIO_RR_CONNECT)
3836 return SSL_ERROR_WANT_CONNECT;
3837 else if (reason == BIO_RR_ACCEPT)
3838 return SSL_ERROR_WANT_ACCEPT;
3839 else
3840 return SSL_ERROR_SYSCALL;
3841 }
3842 }
3843 if (SSL_want_x509_lookup(s))
3844 return SSL_ERROR_WANT_X509_LOOKUP;
3845 if (SSL_want_retry_verify(s))
3846 return SSL_ERROR_WANT_RETRY_VERIFY;
3847 if (SSL_want_async(s))
3848 return SSL_ERROR_WANT_ASYNC;
3849 if (SSL_want_async_job(s))
3850 return SSL_ERROR_WANT_ASYNC_JOB;
3851 if (SSL_want_client_hello_cb(s))
3852 return SSL_ERROR_WANT_CLIENT_HELLO_CB;
3853
3854 if ((s->shutdown & SSL_RECEIVED_SHUTDOWN) &&
3855 (s->s3.warn_alert == SSL_AD_CLOSE_NOTIFY))
3856 return SSL_ERROR_ZERO_RETURN;
3857
3858 return SSL_ERROR_SYSCALL;
3859 }
3860
ssl_do_handshake_intern(void * vargs)3861 static int ssl_do_handshake_intern(void *vargs)
3862 {
3863 struct ssl_async_args *args;
3864 SSL *s;
3865
3866 args = (struct ssl_async_args *)vargs;
3867 s = args->s;
3868
3869 return s->handshake_func(s);
3870 }
3871
SSL_do_handshake(SSL * s)3872 int SSL_do_handshake(SSL *s)
3873 {
3874 int ret = 1;
3875
3876 if (s->handshake_func == NULL) {
3877 ERR_raise(ERR_LIB_SSL, SSL_R_CONNECTION_TYPE_NOT_SET);
3878 return -1;
3879 }
3880
3881 ossl_statem_check_finish_init(s, -1);
3882
3883 s->method->ssl_renegotiate_check(s, 0);
3884
3885 if (SSL_in_init(s) || SSL_in_before(s)) {
3886 if ((s->mode & SSL_MODE_ASYNC) && ASYNC_get_current_job() == NULL) {
3887 struct ssl_async_args args;
3888
3889 args.s = s;
3890
3891 ret = ssl_start_async_job(s, &args, ssl_do_handshake_intern);
3892 } else {
3893 ret = s->handshake_func(s);
3894 }
3895 }
3896 return ret;
3897 }
3898
SSL_set_accept_state(SSL * s)3899 void SSL_set_accept_state(SSL *s)
3900 {
3901 s->server = 1;
3902 s->shutdown = 0;
3903 ossl_statem_clear(s);
3904 s->handshake_func = s->method->ssl_accept;
3905 clear_ciphers(s);
3906 }
3907
SSL_set_connect_state(SSL * s)3908 void SSL_set_connect_state(SSL *s)
3909 {
3910 s->server = 0;
3911 s->shutdown = 0;
3912 ossl_statem_clear(s);
3913 s->handshake_func = s->method->ssl_connect;
3914 clear_ciphers(s);
3915 }
3916
ssl_undefined_function(SSL * s)3917 int ssl_undefined_function(SSL *s)
3918 {
3919 ERR_raise(ERR_LIB_SSL, ERR_R_SHOULD_NOT_HAVE_BEEN_CALLED);
3920 return 0;
3921 }
3922
ssl_undefined_void_function(void)3923 int ssl_undefined_void_function(void)
3924 {
3925 ERR_raise(ERR_LIB_SSL, ERR_R_SHOULD_NOT_HAVE_BEEN_CALLED);
3926 return 0;
3927 }
3928
ssl_undefined_const_function(const SSL * s)3929 int ssl_undefined_const_function(const SSL *s)
3930 {
3931 return 0;
3932 }
3933
ssl_bad_method(int ver)3934 const SSL_METHOD *ssl_bad_method(int ver)
3935 {
3936 ERR_raise(ERR_LIB_SSL, ERR_R_SHOULD_NOT_HAVE_BEEN_CALLED);
3937 return NULL;
3938 }
3939
ssl_protocol_to_string(int version)3940 const char *ssl_protocol_to_string(int version)
3941 {
3942 switch(version)
3943 {
3944 case TLS1_3_VERSION:
3945 return "TLSv1.3";
3946
3947 case TLS1_2_VERSION:
3948 return "TLSv1.2";
3949
3950 case TLS1_1_VERSION:
3951 return "TLSv1.1";
3952
3953 case TLS1_VERSION:
3954 return "TLSv1";
3955
3956 case SSL3_VERSION:
3957 return "SSLv3";
3958
3959 case DTLS1_BAD_VER:
3960 return "DTLSv0.9";
3961
3962 case DTLS1_VERSION:
3963 return "DTLSv1";
3964
3965 case DTLS1_2_VERSION:
3966 return "DTLSv1.2";
3967
3968 default:
3969 return "unknown";
3970 }
3971 }
3972
SSL_get_version(const SSL * s)3973 const char *SSL_get_version(const SSL *s)
3974 {
3975 return ssl_protocol_to_string(s->version);
3976 }
3977
dup_ca_names(STACK_OF (X509_NAME)** dst,STACK_OF (X509_NAME)* src)3978 static int dup_ca_names(STACK_OF(X509_NAME) **dst, STACK_OF(X509_NAME) *src)
3979 {
3980 STACK_OF(X509_NAME) *sk;
3981 X509_NAME *xn;
3982 int i;
3983
3984 if (src == NULL) {
3985 *dst = NULL;
3986 return 1;
3987 }
3988
3989 if ((sk = sk_X509_NAME_new_null()) == NULL)
3990 return 0;
3991 for (i = 0; i < sk_X509_NAME_num(src); i++) {
3992 xn = X509_NAME_dup(sk_X509_NAME_value(src, i));
3993 if (xn == NULL) {
3994 sk_X509_NAME_pop_free(sk, X509_NAME_free);
3995 return 0;
3996 }
3997 if (sk_X509_NAME_insert(sk, xn, i) == 0) {
3998 X509_NAME_free(xn);
3999 sk_X509_NAME_pop_free(sk, X509_NAME_free);
4000 return 0;
4001 }
4002 }
4003 *dst = sk;
4004
4005 return 1;
4006 }
4007
SSL_dup(SSL * s)4008 SSL *SSL_dup(SSL *s)
4009 {
4010 SSL *ret;
4011 int i;
4012
4013 /* If we're not quiescent, just up_ref! */
4014 if (!SSL_in_init(s) || !SSL_in_before(s)) {
4015 CRYPTO_UP_REF(&s->references, &i, s->lock);
4016 return s;
4017 }
4018
4019 /*
4020 * Otherwise, copy configuration state, and session if set.
4021 */
4022 if ((ret = SSL_new(SSL_get_SSL_CTX(s))) == NULL)
4023 return NULL;
4024
4025 if (s->session != NULL) {
4026 /*
4027 * Arranges to share the same session via up_ref. This "copies"
4028 * session-id, SSL_METHOD, sid_ctx, and 'cert'
4029 */
4030 if (!SSL_copy_session_id(ret, s))
4031 goto err;
4032 } else {
4033 /*
4034 * No session has been established yet, so we have to expect that
4035 * s->cert or ret->cert will be changed later -- they should not both
4036 * point to the same object, and thus we can't use
4037 * SSL_copy_session_id.
4038 */
4039 if (!SSL_set_ssl_method(ret, s->method))
4040 goto err;
4041
4042 if (s->cert != NULL) {
4043 ssl_cert_free(ret->cert);
4044 ret->cert = ssl_cert_dup(s->cert);
4045 if (ret->cert == NULL)
4046 goto err;
4047 }
4048
4049 if (!SSL_set_session_id_context(ret, s->sid_ctx,
4050 (int)s->sid_ctx_length))
4051 goto err;
4052 }
4053
4054 if (!ssl_dane_dup(ret, s))
4055 goto err;
4056 ret->version = s->version;
4057 ret->options = s->options;
4058 ret->min_proto_version = s->min_proto_version;
4059 ret->max_proto_version = s->max_proto_version;
4060 ret->mode = s->mode;
4061 SSL_set_max_cert_list(ret, SSL_get_max_cert_list(s));
4062 SSL_set_read_ahead(ret, SSL_get_read_ahead(s));
4063 ret->msg_callback = s->msg_callback;
4064 ret->msg_callback_arg = s->msg_callback_arg;
4065 SSL_set_verify(ret, SSL_get_verify_mode(s), SSL_get_verify_callback(s));
4066 SSL_set_verify_depth(ret, SSL_get_verify_depth(s));
4067 ret->generate_session_id = s->generate_session_id;
4068
4069 SSL_set_info_callback(ret, SSL_get_info_callback(s));
4070
4071 /* copy app data, a little dangerous perhaps */
4072 if (!CRYPTO_dup_ex_data(CRYPTO_EX_INDEX_SSL, &ret->ex_data, &s->ex_data))
4073 goto err;
4074
4075 ret->server = s->server;
4076 if (s->handshake_func) {
4077 if (s->server)
4078 SSL_set_accept_state(ret);
4079 else
4080 SSL_set_connect_state(ret);
4081 }
4082 ret->shutdown = s->shutdown;
4083 ret->hit = s->hit;
4084
4085 ret->default_passwd_callback = s->default_passwd_callback;
4086 ret->default_passwd_callback_userdata = s->default_passwd_callback_userdata;
4087
4088 X509_VERIFY_PARAM_inherit(ret->param, s->param);
4089
4090 /* dup the cipher_list and cipher_list_by_id stacks */
4091 if (s->cipher_list != NULL) {
4092 if ((ret->cipher_list = sk_SSL_CIPHER_dup(s->cipher_list)) == NULL)
4093 goto err;
4094 }
4095 if (s->cipher_list_by_id != NULL)
4096 if ((ret->cipher_list_by_id = sk_SSL_CIPHER_dup(s->cipher_list_by_id))
4097 == NULL)
4098 goto err;
4099
4100 /* Dup the client_CA list */
4101 if (!dup_ca_names(&ret->ca_names, s->ca_names)
4102 || !dup_ca_names(&ret->client_ca_names, s->client_ca_names))
4103 goto err;
4104
4105 return ret;
4106
4107 err:
4108 SSL_free(ret);
4109 return NULL;
4110 }
4111
ssl_clear_cipher_ctx(SSL * s)4112 void ssl_clear_cipher_ctx(SSL *s)
4113 {
4114 if (s->enc_read_ctx != NULL) {
4115 EVP_CIPHER_CTX_free(s->enc_read_ctx);
4116 s->enc_read_ctx = NULL;
4117 }
4118 if (s->enc_write_ctx != NULL) {
4119 EVP_CIPHER_CTX_free(s->enc_write_ctx);
4120 s->enc_write_ctx = NULL;
4121 }
4122 #ifndef OPENSSL_NO_COMP
4123 COMP_CTX_free(s->expand);
4124 s->expand = NULL;
4125 COMP_CTX_free(s->compress);
4126 s->compress = NULL;
4127 #endif
4128 }
4129
SSL_get_certificate(const SSL * s)4130 X509 *SSL_get_certificate(const SSL *s)
4131 {
4132 if (s->cert != NULL)
4133 return s->cert->key->x509;
4134 else
4135 return NULL;
4136 }
4137
SSL_get_privatekey(const SSL * s)4138 EVP_PKEY *SSL_get_privatekey(const SSL *s)
4139 {
4140 if (s->cert != NULL)
4141 return s->cert->key->privatekey;
4142 else
4143 return NULL;
4144 }
4145
SSL_CTX_get0_certificate(const SSL_CTX * ctx)4146 X509 *SSL_CTX_get0_certificate(const SSL_CTX *ctx)
4147 {
4148 if (ctx->cert != NULL)
4149 return ctx->cert->key->x509;
4150 else
4151 return NULL;
4152 }
4153
SSL_CTX_get0_privatekey(const SSL_CTX * ctx)4154 EVP_PKEY *SSL_CTX_get0_privatekey(const SSL_CTX *ctx)
4155 {
4156 if (ctx->cert != NULL)
4157 return ctx->cert->key->privatekey;
4158 else
4159 return NULL;
4160 }
4161
SSL_get_current_cipher(const SSL * s)4162 const SSL_CIPHER *SSL_get_current_cipher(const SSL *s)
4163 {
4164 if ((s->session != NULL) && (s->session->cipher != NULL))
4165 return s->session->cipher;
4166 return NULL;
4167 }
4168
SSL_get_pending_cipher(const SSL * s)4169 const SSL_CIPHER *SSL_get_pending_cipher(const SSL *s)
4170 {
4171 return s->s3.tmp.new_cipher;
4172 }
4173
SSL_get_current_compression(const SSL * s)4174 const COMP_METHOD *SSL_get_current_compression(const SSL *s)
4175 {
4176 #ifndef OPENSSL_NO_COMP
4177 return s->compress ? COMP_CTX_get_method(s->compress) : NULL;
4178 #else
4179 return NULL;
4180 #endif
4181 }
4182
SSL_get_current_expansion(const SSL * s)4183 const COMP_METHOD *SSL_get_current_expansion(const SSL *s)
4184 {
4185 #ifndef OPENSSL_NO_COMP
4186 return s->expand ? COMP_CTX_get_method(s->expand) : NULL;
4187 #else
4188 return NULL;
4189 #endif
4190 }
4191
ssl_init_wbio_buffer(SSL * s)4192 int ssl_init_wbio_buffer(SSL *s)
4193 {
4194 BIO *bbio;
4195
4196 if (s->bbio != NULL) {
4197 /* Already buffered. */
4198 return 1;
4199 }
4200
4201 bbio = BIO_new(BIO_f_buffer());
4202 if (bbio == NULL || !BIO_set_read_buffer_size(bbio, 1)) {
4203 BIO_free(bbio);
4204 ERR_raise(ERR_LIB_SSL, ERR_R_BUF_LIB);
4205 return 0;
4206 }
4207 s->bbio = bbio;
4208 s->wbio = BIO_push(bbio, s->wbio);
4209
4210 return 1;
4211 }
4212
ssl_free_wbio_buffer(SSL * s)4213 int ssl_free_wbio_buffer(SSL *s)
4214 {
4215 /* callers ensure s is never null */
4216 if (s->bbio == NULL)
4217 return 1;
4218
4219 s->wbio = BIO_pop(s->wbio);
4220 BIO_free(s->bbio);
4221 s->bbio = NULL;
4222
4223 return 1;
4224 }
4225
SSL_CTX_set_quiet_shutdown(SSL_CTX * ctx,int mode)4226 void SSL_CTX_set_quiet_shutdown(SSL_CTX *ctx, int mode)
4227 {
4228 ctx->quiet_shutdown = mode;
4229 }
4230
SSL_CTX_get_quiet_shutdown(const SSL_CTX * ctx)4231 int SSL_CTX_get_quiet_shutdown(const SSL_CTX *ctx)
4232 {
4233 return ctx->quiet_shutdown;
4234 }
4235
SSL_set_quiet_shutdown(SSL * s,int mode)4236 void SSL_set_quiet_shutdown(SSL *s, int mode)
4237 {
4238 s->quiet_shutdown = mode;
4239 }
4240
SSL_get_quiet_shutdown(const SSL * s)4241 int SSL_get_quiet_shutdown(const SSL *s)
4242 {
4243 return s->quiet_shutdown;
4244 }
4245
SSL_set_shutdown(SSL * s,int mode)4246 void SSL_set_shutdown(SSL *s, int mode)
4247 {
4248 s->shutdown = mode;
4249 }
4250
SSL_get_shutdown(const SSL * s)4251 int SSL_get_shutdown(const SSL *s)
4252 {
4253 return s->shutdown;
4254 }
4255
SSL_version(const SSL * s)4256 int SSL_version(const SSL *s)
4257 {
4258 return s->version;
4259 }
4260
SSL_client_version(const SSL * s)4261 int SSL_client_version(const SSL *s)
4262 {
4263 return s->client_version;
4264 }
4265
SSL_get_SSL_CTX(const SSL * ssl)4266 SSL_CTX *SSL_get_SSL_CTX(const SSL *ssl)
4267 {
4268 return ssl->ctx;
4269 }
4270
SSL_set_SSL_CTX(SSL * ssl,SSL_CTX * ctx)4271 SSL_CTX *SSL_set_SSL_CTX(SSL *ssl, SSL_CTX *ctx)
4272 {
4273 CERT *new_cert;
4274 if (ssl->ctx == ctx)
4275 return ssl->ctx;
4276 if (ctx == NULL)
4277 ctx = ssl->session_ctx;
4278 new_cert = ssl_cert_dup(ctx->cert);
4279 if (new_cert == NULL) {
4280 return NULL;
4281 }
4282
4283 if (!custom_exts_copy_flags(&new_cert->custext, &ssl->cert->custext)) {
4284 ssl_cert_free(new_cert);
4285 return NULL;
4286 }
4287
4288 ssl_cert_free(ssl->cert);
4289 ssl->cert = new_cert;
4290
4291 /*
4292 * Program invariant: |sid_ctx| has fixed size (SSL_MAX_SID_CTX_LENGTH),
4293 * so setter APIs must prevent invalid lengths from entering the system.
4294 */
4295 if (!ossl_assert(ssl->sid_ctx_length <= sizeof(ssl->sid_ctx)))
4296 return NULL;
4297
4298 /*
4299 * If the session ID context matches that of the parent SSL_CTX,
4300 * inherit it from the new SSL_CTX as well. If however the context does
4301 * not match (i.e., it was set per-ssl with SSL_set_session_id_context),
4302 * leave it unchanged.
4303 */
4304 if ((ssl->ctx != NULL) &&
4305 (ssl->sid_ctx_length == ssl->ctx->sid_ctx_length) &&
4306 (memcmp(ssl->sid_ctx, ssl->ctx->sid_ctx, ssl->sid_ctx_length) == 0)) {
4307 ssl->sid_ctx_length = ctx->sid_ctx_length;
4308 memcpy(&ssl->sid_ctx, &ctx->sid_ctx, sizeof(ssl->sid_ctx));
4309 }
4310
4311 SSL_CTX_up_ref(ctx);
4312 SSL_CTX_free(ssl->ctx); /* decrement reference count */
4313 ssl->ctx = ctx;
4314
4315 return ssl->ctx;
4316 }
4317
SSL_CTX_set_default_verify_paths(SSL_CTX * ctx)4318 int SSL_CTX_set_default_verify_paths(SSL_CTX *ctx)
4319 {
4320 return X509_STORE_set_default_paths_ex(ctx->cert_store, ctx->libctx,
4321 ctx->propq);
4322 }
4323
SSL_CTX_set_default_verify_dir(SSL_CTX * ctx)4324 int SSL_CTX_set_default_verify_dir(SSL_CTX *ctx)
4325 {
4326 X509_LOOKUP *lookup;
4327
4328 lookup = X509_STORE_add_lookup(ctx->cert_store, X509_LOOKUP_hash_dir());
4329 if (lookup == NULL)
4330 return 0;
4331
4332 /* We ignore errors, in case the directory doesn't exist */
4333 ERR_set_mark();
4334
4335 X509_LOOKUP_add_dir(lookup, NULL, X509_FILETYPE_DEFAULT);
4336
4337 ERR_pop_to_mark();
4338
4339 return 1;
4340 }
4341
SSL_CTX_set_default_verify_file(SSL_CTX * ctx)4342 int SSL_CTX_set_default_verify_file(SSL_CTX *ctx)
4343 {
4344 X509_LOOKUP *lookup;
4345
4346 lookup = X509_STORE_add_lookup(ctx->cert_store, X509_LOOKUP_file());
4347 if (lookup == NULL)
4348 return 0;
4349
4350 /* We ignore errors, in case the file doesn't exist */
4351 ERR_set_mark();
4352
4353 X509_LOOKUP_load_file_ex(lookup, NULL, X509_FILETYPE_DEFAULT, ctx->libctx,
4354 ctx->propq);
4355
4356 ERR_pop_to_mark();
4357
4358 return 1;
4359 }
4360
SSL_CTX_set_default_verify_store(SSL_CTX * ctx)4361 int SSL_CTX_set_default_verify_store(SSL_CTX *ctx)
4362 {
4363 X509_LOOKUP *lookup;
4364
4365 lookup = X509_STORE_add_lookup(ctx->cert_store, X509_LOOKUP_store());
4366 if (lookup == NULL)
4367 return 0;
4368
4369 /* We ignore errors, in case the directory doesn't exist */
4370 ERR_set_mark();
4371
4372 X509_LOOKUP_add_store_ex(lookup, NULL, ctx->libctx, ctx->propq);
4373
4374 ERR_pop_to_mark();
4375
4376 return 1;
4377 }
4378
SSL_CTX_load_verify_file(SSL_CTX * ctx,const char * CAfile)4379 int SSL_CTX_load_verify_file(SSL_CTX *ctx, const char *CAfile)
4380 {
4381 return X509_STORE_load_file_ex(ctx->cert_store, CAfile, ctx->libctx,
4382 ctx->propq);
4383 }
4384
SSL_CTX_load_verify_dir(SSL_CTX * ctx,const char * CApath)4385 int SSL_CTX_load_verify_dir(SSL_CTX *ctx, const char *CApath)
4386 {
4387 return X509_STORE_load_path(ctx->cert_store, CApath);
4388 }
4389
SSL_CTX_load_verify_store(SSL_CTX * ctx,const char * CAstore)4390 int SSL_CTX_load_verify_store(SSL_CTX *ctx, const char *CAstore)
4391 {
4392 return X509_STORE_load_store_ex(ctx->cert_store, CAstore, ctx->libctx,
4393 ctx->propq);
4394 }
4395
SSL_CTX_load_verify_locations(SSL_CTX * ctx,const char * CAfile,const char * CApath)4396 int SSL_CTX_load_verify_locations(SSL_CTX *ctx, const char *CAfile,
4397 const char *CApath)
4398 {
4399 if (CAfile == NULL && CApath == NULL)
4400 return 0;
4401 if (CAfile != NULL && !SSL_CTX_load_verify_file(ctx, CAfile))
4402 return 0;
4403 if (CApath != NULL && !SSL_CTX_load_verify_dir(ctx, CApath))
4404 return 0;
4405 return 1;
4406 }
4407
SSL_set_info_callback(SSL * ssl,void (* cb)(const SSL * ssl,int type,int val))4408 void SSL_set_info_callback(SSL *ssl,
4409 void (*cb) (const SSL *ssl, int type, int val))
4410 {
4411 ssl->info_callback = cb;
4412 }
4413
4414 /*
4415 * One compiler (Diab DCC) doesn't like argument names in returned function
4416 * pointer.
4417 */
SSL_get_info_callback(const SSL * ssl)4418 void (*SSL_get_info_callback(const SSL *ssl)) (const SSL * /* ssl */ ,
4419 int /* type */ ,
4420 int /* val */ ) {
4421 return ssl->info_callback;
4422 }
4423
SSL_set_verify_result(SSL * ssl,long arg)4424 void SSL_set_verify_result(SSL *ssl, long arg)
4425 {
4426 ssl->verify_result = arg;
4427 }
4428
SSL_get_verify_result(const SSL * ssl)4429 long SSL_get_verify_result(const SSL *ssl)
4430 {
4431 return ssl->verify_result;
4432 }
4433
SSL_get_client_random(const SSL * ssl,unsigned char * out,size_t outlen)4434 size_t SSL_get_client_random(const SSL *ssl, unsigned char *out, size_t outlen)
4435 {
4436 if (outlen == 0)
4437 return sizeof(ssl->s3.client_random);
4438 if (outlen > sizeof(ssl->s3.client_random))
4439 outlen = sizeof(ssl->s3.client_random);
4440 memcpy(out, ssl->s3.client_random, outlen);
4441 return outlen;
4442 }
4443
SSL_get_server_random(const SSL * ssl,unsigned char * out,size_t outlen)4444 size_t SSL_get_server_random(const SSL *ssl, unsigned char *out, size_t outlen)
4445 {
4446 if (outlen == 0)
4447 return sizeof(ssl->s3.server_random);
4448 if (outlen > sizeof(ssl->s3.server_random))
4449 outlen = sizeof(ssl->s3.server_random);
4450 memcpy(out, ssl->s3.server_random, outlen);
4451 return outlen;
4452 }
4453
SSL_SESSION_get_master_key(const SSL_SESSION * session,unsigned char * out,size_t outlen)4454 size_t SSL_SESSION_get_master_key(const SSL_SESSION *session,
4455 unsigned char *out, size_t outlen)
4456 {
4457 if (outlen == 0)
4458 return session->master_key_length;
4459 if (outlen > session->master_key_length)
4460 outlen = session->master_key_length;
4461 memcpy(out, session->master_key, outlen);
4462 return outlen;
4463 }
4464
SSL_SESSION_set1_master_key(SSL_SESSION * sess,const unsigned char * in,size_t len)4465 int SSL_SESSION_set1_master_key(SSL_SESSION *sess, const unsigned char *in,
4466 size_t len)
4467 {
4468 if (len > sizeof(sess->master_key))
4469 return 0;
4470
4471 memcpy(sess->master_key, in, len);
4472 sess->master_key_length = len;
4473 return 1;
4474 }
4475
4476
SSL_set_ex_data(SSL * s,int idx,void * arg)4477 int SSL_set_ex_data(SSL *s, int idx, void *arg)
4478 {
4479 return CRYPTO_set_ex_data(&s->ex_data, idx, arg);
4480 }
4481
SSL_get_ex_data(const SSL * s,int idx)4482 void *SSL_get_ex_data(const SSL *s, int idx)
4483 {
4484 return CRYPTO_get_ex_data(&s->ex_data, idx);
4485 }
4486
SSL_CTX_set_ex_data(SSL_CTX * s,int idx,void * arg)4487 int SSL_CTX_set_ex_data(SSL_CTX *s, int idx, void *arg)
4488 {
4489 return CRYPTO_set_ex_data(&s->ex_data, idx, arg);
4490 }
4491
SSL_CTX_get_ex_data(const SSL_CTX * s,int idx)4492 void *SSL_CTX_get_ex_data(const SSL_CTX *s, int idx)
4493 {
4494 return CRYPTO_get_ex_data(&s->ex_data, idx);
4495 }
4496
SSL_CTX_get_cert_store(const SSL_CTX * ctx)4497 X509_STORE *SSL_CTX_get_cert_store(const SSL_CTX *ctx)
4498 {
4499 return ctx->cert_store;
4500 }
4501
SSL_CTX_set_cert_store(SSL_CTX * ctx,X509_STORE * store)4502 void SSL_CTX_set_cert_store(SSL_CTX *ctx, X509_STORE *store)
4503 {
4504 X509_STORE_free(ctx->cert_store);
4505 ctx->cert_store = store;
4506 }
4507
SSL_CTX_set1_cert_store(SSL_CTX * ctx,X509_STORE * store)4508 void SSL_CTX_set1_cert_store(SSL_CTX *ctx, X509_STORE *store)
4509 {
4510 if (store != NULL)
4511 X509_STORE_up_ref(store);
4512 SSL_CTX_set_cert_store(ctx, store);
4513 }
4514
SSL_want(const SSL * s)4515 int SSL_want(const SSL *s)
4516 {
4517 return s->rwstate;
4518 }
4519
4520 #ifndef OPENSSL_NO_PSK
SSL_CTX_use_psk_identity_hint(SSL_CTX * ctx,const char * identity_hint)4521 int SSL_CTX_use_psk_identity_hint(SSL_CTX *ctx, const char *identity_hint)
4522 {
4523 if (identity_hint != NULL && strlen(identity_hint) > PSK_MAX_IDENTITY_LEN) {
4524 ERR_raise(ERR_LIB_SSL, SSL_R_DATA_LENGTH_TOO_LONG);
4525 return 0;
4526 }
4527 OPENSSL_free(ctx->cert->psk_identity_hint);
4528 if (identity_hint != NULL) {
4529 ctx->cert->psk_identity_hint = OPENSSL_strdup(identity_hint);
4530 if (ctx->cert->psk_identity_hint == NULL)
4531 return 0;
4532 } else
4533 ctx->cert->psk_identity_hint = NULL;
4534 return 1;
4535 }
4536
SSL_use_psk_identity_hint(SSL * s,const char * identity_hint)4537 int SSL_use_psk_identity_hint(SSL *s, const char *identity_hint)
4538 {
4539 if (s == NULL)
4540 return 0;
4541
4542 if (identity_hint != NULL && strlen(identity_hint) > PSK_MAX_IDENTITY_LEN) {
4543 ERR_raise(ERR_LIB_SSL, SSL_R_DATA_LENGTH_TOO_LONG);
4544 return 0;
4545 }
4546 OPENSSL_free(s->cert->psk_identity_hint);
4547 if (identity_hint != NULL) {
4548 s->cert->psk_identity_hint = OPENSSL_strdup(identity_hint);
4549 if (s->cert->psk_identity_hint == NULL)
4550 return 0;
4551 } else
4552 s->cert->psk_identity_hint = NULL;
4553 return 1;
4554 }
4555
SSL_get_psk_identity_hint(const SSL * s)4556 const char *SSL_get_psk_identity_hint(const SSL *s)
4557 {
4558 if (s == NULL || s->session == NULL)
4559 return NULL;
4560 return s->session->psk_identity_hint;
4561 }
4562
SSL_get_psk_identity(const SSL * s)4563 const char *SSL_get_psk_identity(const SSL *s)
4564 {
4565 if (s == NULL || s->session == NULL)
4566 return NULL;
4567 return s->session->psk_identity;
4568 }
4569
SSL_set_psk_client_callback(SSL * s,SSL_psk_client_cb_func cb)4570 void SSL_set_psk_client_callback(SSL *s, SSL_psk_client_cb_func cb)
4571 {
4572 s->psk_client_callback = cb;
4573 }
4574
SSL_CTX_set_psk_client_callback(SSL_CTX * ctx,SSL_psk_client_cb_func cb)4575 void SSL_CTX_set_psk_client_callback(SSL_CTX *ctx, SSL_psk_client_cb_func cb)
4576 {
4577 ctx->psk_client_callback = cb;
4578 }
4579
SSL_set_psk_server_callback(SSL * s,SSL_psk_server_cb_func cb)4580 void SSL_set_psk_server_callback(SSL *s, SSL_psk_server_cb_func cb)
4581 {
4582 s->psk_server_callback = cb;
4583 }
4584
SSL_CTX_set_psk_server_callback(SSL_CTX * ctx,SSL_psk_server_cb_func cb)4585 void SSL_CTX_set_psk_server_callback(SSL_CTX *ctx, SSL_psk_server_cb_func cb)
4586 {
4587 ctx->psk_server_callback = cb;
4588 }
4589 #endif
4590
SSL_set_psk_find_session_callback(SSL * s,SSL_psk_find_session_cb_func cb)4591 void SSL_set_psk_find_session_callback(SSL *s, SSL_psk_find_session_cb_func cb)
4592 {
4593 s->psk_find_session_cb = cb;
4594 }
4595
SSL_CTX_set_psk_find_session_callback(SSL_CTX * ctx,SSL_psk_find_session_cb_func cb)4596 void SSL_CTX_set_psk_find_session_callback(SSL_CTX *ctx,
4597 SSL_psk_find_session_cb_func cb)
4598 {
4599 ctx->psk_find_session_cb = cb;
4600 }
4601
SSL_set_psk_use_session_callback(SSL * s,SSL_psk_use_session_cb_func cb)4602 void SSL_set_psk_use_session_callback(SSL *s, SSL_psk_use_session_cb_func cb)
4603 {
4604 s->psk_use_session_cb = cb;
4605 }
4606
SSL_CTX_set_psk_use_session_callback(SSL_CTX * ctx,SSL_psk_use_session_cb_func cb)4607 void SSL_CTX_set_psk_use_session_callback(SSL_CTX *ctx,
4608 SSL_psk_use_session_cb_func cb)
4609 {
4610 ctx->psk_use_session_cb = cb;
4611 }
4612
SSL_CTX_set_msg_callback(SSL_CTX * ctx,void (* cb)(int write_p,int version,int content_type,const void * buf,size_t len,SSL * ssl,void * arg))4613 void SSL_CTX_set_msg_callback(SSL_CTX *ctx,
4614 void (*cb) (int write_p, int version,
4615 int content_type, const void *buf,
4616 size_t len, SSL *ssl, void *arg))
4617 {
4618 SSL_CTX_callback_ctrl(ctx, SSL_CTRL_SET_MSG_CALLBACK, (void (*)(void))cb);
4619 }
4620
SSL_set_msg_callback(SSL * ssl,void (* cb)(int write_p,int version,int content_type,const void * buf,size_t len,SSL * ssl,void * arg))4621 void SSL_set_msg_callback(SSL *ssl,
4622 void (*cb) (int write_p, int version,
4623 int content_type, const void *buf,
4624 size_t len, SSL *ssl, void *arg))
4625 {
4626 SSL_callback_ctrl(ssl, SSL_CTRL_SET_MSG_CALLBACK, (void (*)(void))cb);
4627 }
4628
SSL_CTX_set_not_resumable_session_callback(SSL_CTX * ctx,int (* cb)(SSL * ssl,int is_forward_secure))4629 void SSL_CTX_set_not_resumable_session_callback(SSL_CTX *ctx,
4630 int (*cb) (SSL *ssl,
4631 int
4632 is_forward_secure))
4633 {
4634 SSL_CTX_callback_ctrl(ctx, SSL_CTRL_SET_NOT_RESUMABLE_SESS_CB,
4635 (void (*)(void))cb);
4636 }
4637
SSL_set_not_resumable_session_callback(SSL * ssl,int (* cb)(SSL * ssl,int is_forward_secure))4638 void SSL_set_not_resumable_session_callback(SSL *ssl,
4639 int (*cb) (SSL *ssl,
4640 int is_forward_secure))
4641 {
4642 SSL_callback_ctrl(ssl, SSL_CTRL_SET_NOT_RESUMABLE_SESS_CB,
4643 (void (*)(void))cb);
4644 }
4645
SSL_CTX_set_record_padding_callback(SSL_CTX * ctx,size_t (* cb)(SSL * ssl,int type,size_t len,void * arg))4646 void SSL_CTX_set_record_padding_callback(SSL_CTX *ctx,
4647 size_t (*cb) (SSL *ssl, int type,
4648 size_t len, void *arg))
4649 {
4650 ctx->record_padding_cb = cb;
4651 }
4652
SSL_CTX_set_record_padding_callback_arg(SSL_CTX * ctx,void * arg)4653 void SSL_CTX_set_record_padding_callback_arg(SSL_CTX *ctx, void *arg)
4654 {
4655 ctx->record_padding_arg = arg;
4656 }
4657
SSL_CTX_get_record_padding_callback_arg(const SSL_CTX * ctx)4658 void *SSL_CTX_get_record_padding_callback_arg(const SSL_CTX *ctx)
4659 {
4660 return ctx->record_padding_arg;
4661 }
4662
SSL_CTX_set_block_padding(SSL_CTX * ctx,size_t block_size)4663 int SSL_CTX_set_block_padding(SSL_CTX *ctx, size_t block_size)
4664 {
4665 /* block size of 0 or 1 is basically no padding */
4666 if (block_size == 1)
4667 ctx->block_padding = 0;
4668 else if (block_size <= SSL3_RT_MAX_PLAIN_LENGTH)
4669 ctx->block_padding = block_size;
4670 else
4671 return 0;
4672 return 1;
4673 }
4674
SSL_set_record_padding_callback(SSL * ssl,size_t (* cb)(SSL * ssl,int type,size_t len,void * arg))4675 int SSL_set_record_padding_callback(SSL *ssl,
4676 size_t (*cb) (SSL *ssl, int type,
4677 size_t len, void *arg))
4678 {
4679 BIO *b;
4680
4681 b = SSL_get_wbio(ssl);
4682 if (b == NULL || !BIO_get_ktls_send(b)) {
4683 ssl->record_padding_cb = cb;
4684 return 1;
4685 }
4686 return 0;
4687 }
4688
SSL_set_record_padding_callback_arg(SSL * ssl,void * arg)4689 void SSL_set_record_padding_callback_arg(SSL *ssl, void *arg)
4690 {
4691 ssl->record_padding_arg = arg;
4692 }
4693
SSL_get_record_padding_callback_arg(const SSL * ssl)4694 void *SSL_get_record_padding_callback_arg(const SSL *ssl)
4695 {
4696 return ssl->record_padding_arg;
4697 }
4698
SSL_set_block_padding(SSL * ssl,size_t block_size)4699 int SSL_set_block_padding(SSL *ssl, size_t block_size)
4700 {
4701 /* block size of 0 or 1 is basically no padding */
4702 if (block_size == 1)
4703 ssl->block_padding = 0;
4704 else if (block_size <= SSL3_RT_MAX_PLAIN_LENGTH)
4705 ssl->block_padding = block_size;
4706 else
4707 return 0;
4708 return 1;
4709 }
4710
SSL_set_num_tickets(SSL * s,size_t num_tickets)4711 int SSL_set_num_tickets(SSL *s, size_t num_tickets)
4712 {
4713 s->num_tickets = num_tickets;
4714
4715 return 1;
4716 }
4717
SSL_get_num_tickets(const SSL * s)4718 size_t SSL_get_num_tickets(const SSL *s)
4719 {
4720 return s->num_tickets;
4721 }
4722
SSL_CTX_set_num_tickets(SSL_CTX * ctx,size_t num_tickets)4723 int SSL_CTX_set_num_tickets(SSL_CTX *ctx, size_t num_tickets)
4724 {
4725 ctx->num_tickets = num_tickets;
4726
4727 return 1;
4728 }
4729
SSL_CTX_get_num_tickets(const SSL_CTX * ctx)4730 size_t SSL_CTX_get_num_tickets(const SSL_CTX *ctx)
4731 {
4732 return ctx->num_tickets;
4733 }
4734
4735 /*
4736 * Allocates new EVP_MD_CTX and sets pointer to it into given pointer
4737 * variable, freeing EVP_MD_CTX previously stored in that variable, if any.
4738 * If EVP_MD pointer is passed, initializes ctx with this |md|.
4739 * Returns the newly allocated ctx;
4740 */
4741
ssl_replace_hash(EVP_MD_CTX ** hash,const EVP_MD * md)4742 EVP_MD_CTX *ssl_replace_hash(EVP_MD_CTX **hash, const EVP_MD *md)
4743 {
4744 ssl_clear_hash_ctx(hash);
4745 *hash = EVP_MD_CTX_new();
4746 if (*hash == NULL || (md && EVP_DigestInit_ex(*hash, md, NULL) <= 0)) {
4747 EVP_MD_CTX_free(*hash);
4748 *hash = NULL;
4749 return NULL;
4750 }
4751 return *hash;
4752 }
4753
ssl_clear_hash_ctx(EVP_MD_CTX ** hash)4754 void ssl_clear_hash_ctx(EVP_MD_CTX **hash)
4755 {
4756
4757 EVP_MD_CTX_free(*hash);
4758 *hash = NULL;
4759 }
4760
4761 /* Retrieve handshake hashes */
ssl_handshake_hash(SSL * s,unsigned char * out,size_t outlen,size_t * hashlen)4762 int ssl_handshake_hash(SSL *s, unsigned char *out, size_t outlen,
4763 size_t *hashlen)
4764 {
4765 EVP_MD_CTX *ctx = NULL;
4766 EVP_MD_CTX *hdgst = s->s3.handshake_dgst;
4767 int hashleni = EVP_MD_CTX_get_size(hdgst);
4768 int ret = 0;
4769
4770 if (hashleni < 0 || (size_t)hashleni > outlen) {
4771 SSLfatal(s, SSL_AD_INTERNAL_ERROR, ERR_R_INTERNAL_ERROR);
4772 goto err;
4773 }
4774
4775 ctx = EVP_MD_CTX_new();
4776 if (ctx == NULL) {
4777 SSLfatal(s, SSL_AD_INTERNAL_ERROR, ERR_R_INTERNAL_ERROR);
4778 goto err;
4779 }
4780
4781 if (!EVP_MD_CTX_copy_ex(ctx, hdgst)
4782 || EVP_DigestFinal_ex(ctx, out, NULL) <= 0) {
4783 SSLfatal(s, SSL_AD_INTERNAL_ERROR, ERR_R_INTERNAL_ERROR);
4784 goto err;
4785 }
4786
4787 *hashlen = hashleni;
4788
4789 ret = 1;
4790 err:
4791 EVP_MD_CTX_free(ctx);
4792 return ret;
4793 }
4794
SSL_session_reused(const SSL * s)4795 int SSL_session_reused(const SSL *s)
4796 {
4797 return s->hit;
4798 }
4799
SSL_is_server(const SSL * s)4800 int SSL_is_server(const SSL *s)
4801 {
4802 return s->server;
4803 }
4804
4805 #ifndef OPENSSL_NO_DEPRECATED_1_1_0
SSL_set_debug(SSL * s,int debug)4806 void SSL_set_debug(SSL *s, int debug)
4807 {
4808 /* Old function was do-nothing anyway... */
4809 (void)s;
4810 (void)debug;
4811 }
4812 #endif
4813
SSL_set_security_level(SSL * s,int level)4814 void SSL_set_security_level(SSL *s, int level)
4815 {
4816 s->cert->sec_level = level;
4817 }
4818
SSL_get_security_level(const SSL * s)4819 int SSL_get_security_level(const SSL *s)
4820 {
4821 return s->cert->sec_level;
4822 }
4823
SSL_set_security_callback(SSL * s,int (* cb)(const SSL * s,const SSL_CTX * ctx,int op,int bits,int nid,void * other,void * ex))4824 void SSL_set_security_callback(SSL *s,
4825 int (*cb) (const SSL *s, const SSL_CTX *ctx,
4826 int op, int bits, int nid,
4827 void *other, void *ex))
4828 {
4829 s->cert->sec_cb = cb;
4830 }
4831
SSL_get_security_callback(const SSL * s)4832 int (*SSL_get_security_callback(const SSL *s)) (const SSL *s,
4833 const SSL_CTX *ctx, int op,
4834 int bits, int nid, void *other,
4835 void *ex) {
4836 return s->cert->sec_cb;
4837 }
4838
SSL_set0_security_ex_data(SSL * s,void * ex)4839 void SSL_set0_security_ex_data(SSL *s, void *ex)
4840 {
4841 s->cert->sec_ex = ex;
4842 }
4843
SSL_get0_security_ex_data(const SSL * s)4844 void *SSL_get0_security_ex_data(const SSL *s)
4845 {
4846 return s->cert->sec_ex;
4847 }
4848
SSL_CTX_set_security_level(SSL_CTX * ctx,int level)4849 void SSL_CTX_set_security_level(SSL_CTX *ctx, int level)
4850 {
4851 ctx->cert->sec_level = level;
4852 }
4853
SSL_CTX_get_security_level(const SSL_CTX * ctx)4854 int SSL_CTX_get_security_level(const SSL_CTX *ctx)
4855 {
4856 return ctx->cert->sec_level;
4857 }
4858
SSL_CTX_set_security_callback(SSL_CTX * ctx,int (* cb)(const SSL * s,const SSL_CTX * ctx,int op,int bits,int nid,void * other,void * ex))4859 void SSL_CTX_set_security_callback(SSL_CTX *ctx,
4860 int (*cb) (const SSL *s, const SSL_CTX *ctx,
4861 int op, int bits, int nid,
4862 void *other, void *ex))
4863 {
4864 ctx->cert->sec_cb = cb;
4865 }
4866
SSL_CTX_get_security_callback(const SSL_CTX * ctx)4867 int (*SSL_CTX_get_security_callback(const SSL_CTX *ctx)) (const SSL *s,
4868 const SSL_CTX *ctx,
4869 int op, int bits,
4870 int nid,
4871 void *other,
4872 void *ex) {
4873 return ctx->cert->sec_cb;
4874 }
4875
SSL_CTX_set0_security_ex_data(SSL_CTX * ctx,void * ex)4876 void SSL_CTX_set0_security_ex_data(SSL_CTX *ctx, void *ex)
4877 {
4878 ctx->cert->sec_ex = ex;
4879 }
4880
SSL_CTX_get0_security_ex_data(const SSL_CTX * ctx)4881 void *SSL_CTX_get0_security_ex_data(const SSL_CTX *ctx)
4882 {
4883 return ctx->cert->sec_ex;
4884 }
4885
SSL_CTX_get_options(const SSL_CTX * ctx)4886 uint64_t SSL_CTX_get_options(const SSL_CTX *ctx)
4887 {
4888 return ctx->options;
4889 }
4890
SSL_get_options(const SSL * s)4891 uint64_t SSL_get_options(const SSL *s)
4892 {
4893 return s->options;
4894 }
4895
SSL_CTX_set_options(SSL_CTX * ctx,uint64_t op)4896 uint64_t SSL_CTX_set_options(SSL_CTX *ctx, uint64_t op)
4897 {
4898 return ctx->options |= op;
4899 }
4900
SSL_set_options(SSL * s,uint64_t op)4901 uint64_t SSL_set_options(SSL *s, uint64_t op)
4902 {
4903 return s->options |= op;
4904 }
4905
SSL_CTX_clear_options(SSL_CTX * ctx,uint64_t op)4906 uint64_t SSL_CTX_clear_options(SSL_CTX *ctx, uint64_t op)
4907 {
4908 return ctx->options &= ~op;
4909 }
4910
SSL_clear_options(SSL * s,uint64_t op)4911 uint64_t SSL_clear_options(SSL *s, uint64_t op)
4912 {
4913 return s->options &= ~op;
4914 }
4915
STACK_OF(X509)4916 STACK_OF(X509) *SSL_get0_verified_chain(const SSL *s)
4917 {
4918 return s->verified_chain;
4919 }
4920
4921 IMPLEMENT_OBJ_BSEARCH_GLOBAL_CMP_FN(SSL_CIPHER, SSL_CIPHER, ssl_cipher_id);
4922
4923 #ifndef OPENSSL_NO_CT
4924
4925 /*
4926 * Moves SCTs from the |src| stack to the |dst| stack.
4927 * The source of each SCT will be set to |origin|.
4928 * If |dst| points to a NULL pointer, a new stack will be created and owned by
4929 * the caller.
4930 * Returns the number of SCTs moved, or a negative integer if an error occurs.
4931 */
ct_move_scts(STACK_OF (SCT)** dst,STACK_OF (SCT)* src,sct_source_t origin)4932 static int ct_move_scts(STACK_OF(SCT) **dst, STACK_OF(SCT) *src,
4933 sct_source_t origin)
4934 {
4935 int scts_moved = 0;
4936 SCT *sct = NULL;
4937
4938 if (*dst == NULL) {
4939 *dst = sk_SCT_new_null();
4940 if (*dst == NULL) {
4941 ERR_raise(ERR_LIB_SSL, ERR_R_MALLOC_FAILURE);
4942 goto err;
4943 }
4944 }
4945
4946 while ((sct = sk_SCT_pop(src)) != NULL) {
4947 if (SCT_set_source(sct, origin) != 1)
4948 goto err;
4949
4950 if (sk_SCT_push(*dst, sct) <= 0)
4951 goto err;
4952 scts_moved += 1;
4953 }
4954
4955 return scts_moved;
4956 err:
4957 if (sct != NULL)
4958 sk_SCT_push(src, sct); /* Put the SCT back */
4959 return -1;
4960 }
4961
4962 /*
4963 * Look for data collected during ServerHello and parse if found.
4964 * Returns the number of SCTs extracted.
4965 */
ct_extract_tls_extension_scts(SSL * s)4966 static int ct_extract_tls_extension_scts(SSL *s)
4967 {
4968 int scts_extracted = 0;
4969
4970 if (s->ext.scts != NULL) {
4971 const unsigned char *p = s->ext.scts;
4972 STACK_OF(SCT) *scts = o2i_SCT_LIST(NULL, &p, s->ext.scts_len);
4973
4974 scts_extracted = ct_move_scts(&s->scts, scts, SCT_SOURCE_TLS_EXTENSION);
4975
4976 SCT_LIST_free(scts);
4977 }
4978
4979 return scts_extracted;
4980 }
4981
4982 /*
4983 * Checks for an OCSP response and then attempts to extract any SCTs found if it
4984 * contains an SCT X509 extension. They will be stored in |s->scts|.
4985 * Returns:
4986 * - The number of SCTs extracted, assuming an OCSP response exists.
4987 * - 0 if no OCSP response exists or it contains no SCTs.
4988 * - A negative integer if an error occurs.
4989 */
ct_extract_ocsp_response_scts(SSL * s)4990 static int ct_extract_ocsp_response_scts(SSL *s)
4991 {
4992 # ifndef OPENSSL_NO_OCSP
4993 int scts_extracted = 0;
4994 const unsigned char *p;
4995 OCSP_BASICRESP *br = NULL;
4996 OCSP_RESPONSE *rsp = NULL;
4997 STACK_OF(SCT) *scts = NULL;
4998 int i;
4999
5000 if (s->ext.ocsp.resp == NULL || s->ext.ocsp.resp_len == 0)
5001 goto err;
5002
5003 p = s->ext.ocsp.resp;
5004 rsp = d2i_OCSP_RESPONSE(NULL, &p, (int)s->ext.ocsp.resp_len);
5005 if (rsp == NULL)
5006 goto err;
5007
5008 br = OCSP_response_get1_basic(rsp);
5009 if (br == NULL)
5010 goto err;
5011
5012 for (i = 0; i < OCSP_resp_count(br); ++i) {
5013 OCSP_SINGLERESP *single = OCSP_resp_get0(br, i);
5014
5015 if (single == NULL)
5016 continue;
5017
5018 scts =
5019 OCSP_SINGLERESP_get1_ext_d2i(single, NID_ct_cert_scts, NULL, NULL);
5020 scts_extracted =
5021 ct_move_scts(&s->scts, scts, SCT_SOURCE_OCSP_STAPLED_RESPONSE);
5022 if (scts_extracted < 0)
5023 goto err;
5024 }
5025 err:
5026 SCT_LIST_free(scts);
5027 OCSP_BASICRESP_free(br);
5028 OCSP_RESPONSE_free(rsp);
5029 return scts_extracted;
5030 # else
5031 /* Behave as if no OCSP response exists */
5032 return 0;
5033 # endif
5034 }
5035
5036 /*
5037 * Attempts to extract SCTs from the peer certificate.
5038 * Return the number of SCTs extracted, or a negative integer if an error
5039 * occurs.
5040 */
ct_extract_x509v3_extension_scts(SSL * s)5041 static int ct_extract_x509v3_extension_scts(SSL *s)
5042 {
5043 int scts_extracted = 0;
5044 X509 *cert = s->session != NULL ? s->session->peer : NULL;
5045
5046 if (cert != NULL) {
5047 STACK_OF(SCT) *scts =
5048 X509_get_ext_d2i(cert, NID_ct_precert_scts, NULL, NULL);
5049
5050 scts_extracted =
5051 ct_move_scts(&s->scts, scts, SCT_SOURCE_X509V3_EXTENSION);
5052
5053 SCT_LIST_free(scts);
5054 }
5055
5056 return scts_extracted;
5057 }
5058
5059 /*
5060 * Attempts to find all received SCTs by checking TLS extensions, the OCSP
5061 * response (if it exists) and X509v3 extensions in the certificate.
5062 * Returns NULL if an error occurs.
5063 */
STACK_OF(SCT)5064 const STACK_OF(SCT) *SSL_get0_peer_scts(SSL *s)
5065 {
5066 if (!s->scts_parsed) {
5067 if (ct_extract_tls_extension_scts(s) < 0 ||
5068 ct_extract_ocsp_response_scts(s) < 0 ||
5069 ct_extract_x509v3_extension_scts(s) < 0)
5070 goto err;
5071
5072 s->scts_parsed = 1;
5073 }
5074 return s->scts;
5075 err:
5076 return NULL;
5077 }
5078
ct_permissive(const CT_POLICY_EVAL_CTX * ctx,const STACK_OF (SCT)* scts,void * unused_arg)5079 static int ct_permissive(const CT_POLICY_EVAL_CTX * ctx,
5080 const STACK_OF(SCT) *scts, void *unused_arg)
5081 {
5082 return 1;
5083 }
5084
ct_strict(const CT_POLICY_EVAL_CTX * ctx,const STACK_OF (SCT)* scts,void * unused_arg)5085 static int ct_strict(const CT_POLICY_EVAL_CTX * ctx,
5086 const STACK_OF(SCT) *scts, void *unused_arg)
5087 {
5088 int count = scts != NULL ? sk_SCT_num(scts) : 0;
5089 int i;
5090
5091 for (i = 0; i < count; ++i) {
5092 SCT *sct = sk_SCT_value(scts, i);
5093 int status = SCT_get_validation_status(sct);
5094
5095 if (status == SCT_VALIDATION_STATUS_VALID)
5096 return 1;
5097 }
5098 ERR_raise(ERR_LIB_SSL, SSL_R_NO_VALID_SCTS);
5099 return 0;
5100 }
5101
SSL_set_ct_validation_callback(SSL * s,ssl_ct_validation_cb callback,void * arg)5102 int SSL_set_ct_validation_callback(SSL *s, ssl_ct_validation_cb callback,
5103 void *arg)
5104 {
5105 /*
5106 * Since code exists that uses the custom extension handler for CT, look
5107 * for this and throw an error if they have already registered to use CT.
5108 */
5109 if (callback != NULL && SSL_CTX_has_client_custom_ext(s->ctx,
5110 TLSEXT_TYPE_signed_certificate_timestamp))
5111 {
5112 ERR_raise(ERR_LIB_SSL, SSL_R_CUSTOM_EXT_HANDLER_ALREADY_INSTALLED);
5113 return 0;
5114 }
5115
5116 if (callback != NULL) {
5117 /*
5118 * If we are validating CT, then we MUST accept SCTs served via OCSP
5119 */
5120 if (!SSL_set_tlsext_status_type(s, TLSEXT_STATUSTYPE_ocsp))
5121 return 0;
5122 }
5123
5124 s->ct_validation_callback = callback;
5125 s->ct_validation_callback_arg = arg;
5126
5127 return 1;
5128 }
5129
SSL_CTX_set_ct_validation_callback(SSL_CTX * ctx,ssl_ct_validation_cb callback,void * arg)5130 int SSL_CTX_set_ct_validation_callback(SSL_CTX *ctx,
5131 ssl_ct_validation_cb callback, void *arg)
5132 {
5133 /*
5134 * Since code exists that uses the custom extension handler for CT, look for
5135 * this and throw an error if they have already registered to use CT.
5136 */
5137 if (callback != NULL && SSL_CTX_has_client_custom_ext(ctx,
5138 TLSEXT_TYPE_signed_certificate_timestamp))
5139 {
5140 ERR_raise(ERR_LIB_SSL, SSL_R_CUSTOM_EXT_HANDLER_ALREADY_INSTALLED);
5141 return 0;
5142 }
5143
5144 ctx->ct_validation_callback = callback;
5145 ctx->ct_validation_callback_arg = arg;
5146 return 1;
5147 }
5148
SSL_ct_is_enabled(const SSL * s)5149 int SSL_ct_is_enabled(const SSL *s)
5150 {
5151 return s->ct_validation_callback != NULL;
5152 }
5153
SSL_CTX_ct_is_enabled(const SSL_CTX * ctx)5154 int SSL_CTX_ct_is_enabled(const SSL_CTX *ctx)
5155 {
5156 return ctx->ct_validation_callback != NULL;
5157 }
5158
ssl_validate_ct(SSL * s)5159 int ssl_validate_ct(SSL *s)
5160 {
5161 int ret = 0;
5162 X509 *cert = s->session != NULL ? s->session->peer : NULL;
5163 X509 *issuer;
5164 SSL_DANE *dane = &s->dane;
5165 CT_POLICY_EVAL_CTX *ctx = NULL;
5166 const STACK_OF(SCT) *scts;
5167
5168 /*
5169 * If no callback is set, the peer is anonymous, or its chain is invalid,
5170 * skip SCT validation - just return success. Applications that continue
5171 * handshakes without certificates, with unverified chains, or pinned leaf
5172 * certificates are outside the scope of the WebPKI and CT.
5173 *
5174 * The above exclusions notwithstanding the vast majority of peers will
5175 * have rather ordinary certificate chains validated by typical
5176 * applications that perform certificate verification and therefore will
5177 * process SCTs when enabled.
5178 */
5179 if (s->ct_validation_callback == NULL || cert == NULL ||
5180 s->verify_result != X509_V_OK ||
5181 s->verified_chain == NULL || sk_X509_num(s->verified_chain) <= 1)
5182 return 1;
5183
5184 /*
5185 * CT not applicable for chains validated via DANE-TA(2) or DANE-EE(3)
5186 * trust-anchors. See https://tools.ietf.org/html/rfc7671#section-4.2
5187 */
5188 if (DANETLS_ENABLED(dane) && dane->mtlsa != NULL) {
5189 switch (dane->mtlsa->usage) {
5190 case DANETLS_USAGE_DANE_TA:
5191 case DANETLS_USAGE_DANE_EE:
5192 return 1;
5193 }
5194 }
5195
5196 ctx = CT_POLICY_EVAL_CTX_new_ex(s->ctx->libctx, s->ctx->propq);
5197 if (ctx == NULL) {
5198 SSLfatal(s, SSL_AD_INTERNAL_ERROR, ERR_R_MALLOC_FAILURE);
5199 goto end;
5200 }
5201
5202 issuer = sk_X509_value(s->verified_chain, 1);
5203 CT_POLICY_EVAL_CTX_set1_cert(ctx, cert);
5204 CT_POLICY_EVAL_CTX_set1_issuer(ctx, issuer);
5205 CT_POLICY_EVAL_CTX_set_shared_CTLOG_STORE(ctx, s->ctx->ctlog_store);
5206 CT_POLICY_EVAL_CTX_set_time(
5207 ctx, (uint64_t)SSL_SESSION_get_time(SSL_get0_session(s)) * 1000);
5208
5209 scts = SSL_get0_peer_scts(s);
5210
5211 /*
5212 * This function returns success (> 0) only when all the SCTs are valid, 0
5213 * when some are invalid, and < 0 on various internal errors (out of
5214 * memory, etc.). Having some, or even all, invalid SCTs is not sufficient
5215 * reason to abort the handshake, that decision is up to the callback.
5216 * Therefore, we error out only in the unexpected case that the return
5217 * value is negative.
5218 *
5219 * XXX: One might well argue that the return value of this function is an
5220 * unfortunate design choice. Its job is only to determine the validation
5221 * status of each of the provided SCTs. So long as it correctly separates
5222 * the wheat from the chaff it should return success. Failure in this case
5223 * ought to correspond to an inability to carry out its duties.
5224 */
5225 if (SCT_LIST_validate(scts, ctx) < 0) {
5226 SSLfatal(s, SSL_AD_HANDSHAKE_FAILURE, SSL_R_SCT_VERIFICATION_FAILED);
5227 goto end;
5228 }
5229
5230 ret = s->ct_validation_callback(ctx, scts, s->ct_validation_callback_arg);
5231 if (ret < 0)
5232 ret = 0; /* This function returns 0 on failure */
5233 if (!ret)
5234 SSLfatal(s, SSL_AD_HANDSHAKE_FAILURE, SSL_R_CALLBACK_FAILED);
5235
5236 end:
5237 CT_POLICY_EVAL_CTX_free(ctx);
5238 /*
5239 * With SSL_VERIFY_NONE the session may be cached and re-used despite a
5240 * failure return code here. Also the application may wish the complete
5241 * the handshake, and then disconnect cleanly at a higher layer, after
5242 * checking the verification status of the completed connection.
5243 *
5244 * We therefore force a certificate verification failure which will be
5245 * visible via SSL_get_verify_result() and cached as part of any resumed
5246 * session.
5247 *
5248 * Note: the permissive callback is for information gathering only, always
5249 * returns success, and does not affect verification status. Only the
5250 * strict callback or a custom application-specified callback can trigger
5251 * connection failure or record a verification error.
5252 */
5253 if (ret <= 0)
5254 s->verify_result = X509_V_ERR_NO_VALID_SCTS;
5255 return ret;
5256 }
5257
SSL_CTX_enable_ct(SSL_CTX * ctx,int validation_mode)5258 int SSL_CTX_enable_ct(SSL_CTX *ctx, int validation_mode)
5259 {
5260 switch (validation_mode) {
5261 default:
5262 ERR_raise(ERR_LIB_SSL, SSL_R_INVALID_CT_VALIDATION_TYPE);
5263 return 0;
5264 case SSL_CT_VALIDATION_PERMISSIVE:
5265 return SSL_CTX_set_ct_validation_callback(ctx, ct_permissive, NULL);
5266 case SSL_CT_VALIDATION_STRICT:
5267 return SSL_CTX_set_ct_validation_callback(ctx, ct_strict, NULL);
5268 }
5269 }
5270
SSL_enable_ct(SSL * s,int validation_mode)5271 int SSL_enable_ct(SSL *s, int validation_mode)
5272 {
5273 switch (validation_mode) {
5274 default:
5275 ERR_raise(ERR_LIB_SSL, SSL_R_INVALID_CT_VALIDATION_TYPE);
5276 return 0;
5277 case SSL_CT_VALIDATION_PERMISSIVE:
5278 return SSL_set_ct_validation_callback(s, ct_permissive, NULL);
5279 case SSL_CT_VALIDATION_STRICT:
5280 return SSL_set_ct_validation_callback(s, ct_strict, NULL);
5281 }
5282 }
5283
SSL_CTX_set_default_ctlog_list_file(SSL_CTX * ctx)5284 int SSL_CTX_set_default_ctlog_list_file(SSL_CTX *ctx)
5285 {
5286 return CTLOG_STORE_load_default_file(ctx->ctlog_store);
5287 }
5288
SSL_CTX_set_ctlog_list_file(SSL_CTX * ctx,const char * path)5289 int SSL_CTX_set_ctlog_list_file(SSL_CTX *ctx, const char *path)
5290 {
5291 return CTLOG_STORE_load_file(ctx->ctlog_store, path);
5292 }
5293
SSL_CTX_set0_ctlog_store(SSL_CTX * ctx,CTLOG_STORE * logs)5294 void SSL_CTX_set0_ctlog_store(SSL_CTX *ctx, CTLOG_STORE * logs)
5295 {
5296 CTLOG_STORE_free(ctx->ctlog_store);
5297 ctx->ctlog_store = logs;
5298 }
5299
SSL_CTX_get0_ctlog_store(const SSL_CTX * ctx)5300 const CTLOG_STORE *SSL_CTX_get0_ctlog_store(const SSL_CTX *ctx)
5301 {
5302 return ctx->ctlog_store;
5303 }
5304
5305 #endif /* OPENSSL_NO_CT */
5306
SSL_CTX_set_client_hello_cb(SSL_CTX * c,SSL_client_hello_cb_fn cb,void * arg)5307 void SSL_CTX_set_client_hello_cb(SSL_CTX *c, SSL_client_hello_cb_fn cb,
5308 void *arg)
5309 {
5310 c->client_hello_cb = cb;
5311 c->client_hello_cb_arg = arg;
5312 }
5313
SSL_client_hello_isv2(SSL * s)5314 int SSL_client_hello_isv2(SSL *s)
5315 {
5316 if (s->clienthello == NULL)
5317 return 0;
5318 return s->clienthello->isv2;
5319 }
5320
SSL_client_hello_get0_legacy_version(SSL * s)5321 unsigned int SSL_client_hello_get0_legacy_version(SSL *s)
5322 {
5323 if (s->clienthello == NULL)
5324 return 0;
5325 return s->clienthello->legacy_version;
5326 }
5327
SSL_client_hello_get0_random(SSL * s,const unsigned char ** out)5328 size_t SSL_client_hello_get0_random(SSL *s, const unsigned char **out)
5329 {
5330 if (s->clienthello == NULL)
5331 return 0;
5332 if (out != NULL)
5333 *out = s->clienthello->random;
5334 return SSL3_RANDOM_SIZE;
5335 }
5336
SSL_client_hello_get0_session_id(SSL * s,const unsigned char ** out)5337 size_t SSL_client_hello_get0_session_id(SSL *s, const unsigned char **out)
5338 {
5339 if (s->clienthello == NULL)
5340 return 0;
5341 if (out != NULL)
5342 *out = s->clienthello->session_id;
5343 return s->clienthello->session_id_len;
5344 }
5345
SSL_client_hello_get0_ciphers(SSL * s,const unsigned char ** out)5346 size_t SSL_client_hello_get0_ciphers(SSL *s, const unsigned char **out)
5347 {
5348 if (s->clienthello == NULL)
5349 return 0;
5350 if (out != NULL)
5351 *out = PACKET_data(&s->clienthello->ciphersuites);
5352 return PACKET_remaining(&s->clienthello->ciphersuites);
5353 }
5354
SSL_client_hello_get0_compression_methods(SSL * s,const unsigned char ** out)5355 size_t SSL_client_hello_get0_compression_methods(SSL *s, const unsigned char **out)
5356 {
5357 if (s->clienthello == NULL)
5358 return 0;
5359 if (out != NULL)
5360 *out = s->clienthello->compressions;
5361 return s->clienthello->compressions_len;
5362 }
5363
SSL_client_hello_get1_extensions_present(SSL * s,int ** out,size_t * outlen)5364 int SSL_client_hello_get1_extensions_present(SSL *s, int **out, size_t *outlen)
5365 {
5366 RAW_EXTENSION *ext;
5367 int *present;
5368 size_t num = 0, i;
5369
5370 if (s->clienthello == NULL || out == NULL || outlen == NULL)
5371 return 0;
5372 for (i = 0; i < s->clienthello->pre_proc_exts_len; i++) {
5373 ext = s->clienthello->pre_proc_exts + i;
5374 if (ext->present)
5375 num++;
5376 }
5377 if (num == 0) {
5378 *out = NULL;
5379 *outlen = 0;
5380 return 1;
5381 }
5382 if ((present = OPENSSL_malloc(sizeof(*present) * num)) == NULL) {
5383 ERR_raise(ERR_LIB_SSL, ERR_R_MALLOC_FAILURE);
5384 return 0;
5385 }
5386 for (i = 0; i < s->clienthello->pre_proc_exts_len; i++) {
5387 ext = s->clienthello->pre_proc_exts + i;
5388 if (ext->present) {
5389 if (ext->received_order >= num)
5390 goto err;
5391 present[ext->received_order] = ext->type;
5392 }
5393 }
5394 *out = present;
5395 *outlen = num;
5396 return 1;
5397 err:
5398 OPENSSL_free(present);
5399 return 0;
5400 }
5401
SSL_client_hello_get0_ext(SSL * s,unsigned int type,const unsigned char ** out,size_t * outlen)5402 int SSL_client_hello_get0_ext(SSL *s, unsigned int type, const unsigned char **out,
5403 size_t *outlen)
5404 {
5405 size_t i;
5406 RAW_EXTENSION *r;
5407
5408 if (s->clienthello == NULL)
5409 return 0;
5410 for (i = 0; i < s->clienthello->pre_proc_exts_len; ++i) {
5411 r = s->clienthello->pre_proc_exts + i;
5412 if (r->present && r->type == type) {
5413 if (out != NULL)
5414 *out = PACKET_data(&r->data);
5415 if (outlen != NULL)
5416 *outlen = PACKET_remaining(&r->data);
5417 return 1;
5418 }
5419 }
5420 return 0;
5421 }
5422
SSL_free_buffers(SSL * ssl)5423 int SSL_free_buffers(SSL *ssl)
5424 {
5425 RECORD_LAYER *rl = &ssl->rlayer;
5426
5427 if (RECORD_LAYER_read_pending(rl) || RECORD_LAYER_write_pending(rl))
5428 return 0;
5429
5430 RECORD_LAYER_release(rl);
5431 return 1;
5432 }
5433
SSL_alloc_buffers(SSL * ssl)5434 int SSL_alloc_buffers(SSL *ssl)
5435 {
5436 return ssl3_setup_buffers(ssl);
5437 }
5438
SSL_CTX_set_keylog_callback(SSL_CTX * ctx,SSL_CTX_keylog_cb_func cb)5439 void SSL_CTX_set_keylog_callback(SSL_CTX *ctx, SSL_CTX_keylog_cb_func cb)
5440 {
5441 ctx->keylog_callback = cb;
5442 }
5443
SSL_CTX_get_keylog_callback(const SSL_CTX * ctx)5444 SSL_CTX_keylog_cb_func SSL_CTX_get_keylog_callback(const SSL_CTX *ctx)
5445 {
5446 return ctx->keylog_callback;
5447 }
5448
nss_keylog_int(const char * prefix,SSL * ssl,const uint8_t * parameter_1,size_t parameter_1_len,const uint8_t * parameter_2,size_t parameter_2_len)5449 static int nss_keylog_int(const char *prefix,
5450 SSL *ssl,
5451 const uint8_t *parameter_1,
5452 size_t parameter_1_len,
5453 const uint8_t *parameter_2,
5454 size_t parameter_2_len)
5455 {
5456 char *out = NULL;
5457 char *cursor = NULL;
5458 size_t out_len = 0;
5459 size_t i;
5460 size_t prefix_len;
5461
5462 if (ssl->ctx->keylog_callback == NULL)
5463 return 1;
5464
5465 /*
5466 * Our output buffer will contain the following strings, rendered with
5467 * space characters in between, terminated by a NULL character: first the
5468 * prefix, then the first parameter, then the second parameter. The
5469 * meaning of each parameter depends on the specific key material being
5470 * logged. Note that the first and second parameters are encoded in
5471 * hexadecimal, so we need a buffer that is twice their lengths.
5472 */
5473 prefix_len = strlen(prefix);
5474 out_len = prefix_len + (2 * parameter_1_len) + (2 * parameter_2_len) + 3;
5475 if ((out = cursor = OPENSSL_malloc(out_len)) == NULL) {
5476 SSLfatal(ssl, SSL_AD_INTERNAL_ERROR, ERR_R_MALLOC_FAILURE);
5477 return 0;
5478 }
5479
5480 strcpy(cursor, prefix);
5481 cursor += prefix_len;
5482 *cursor++ = ' ';
5483
5484 for (i = 0; i < parameter_1_len; i++) {
5485 sprintf(cursor, "%02x", parameter_1[i]);
5486 cursor += 2;
5487 }
5488 *cursor++ = ' ';
5489
5490 for (i = 0; i < parameter_2_len; i++) {
5491 sprintf(cursor, "%02x", parameter_2[i]);
5492 cursor += 2;
5493 }
5494 *cursor = '\0';
5495
5496 ssl->ctx->keylog_callback(ssl, (const char *)out);
5497 OPENSSL_clear_free(out, out_len);
5498 return 1;
5499
5500 }
5501
ssl_log_rsa_client_key_exchange(SSL * ssl,const uint8_t * encrypted_premaster,size_t encrypted_premaster_len,const uint8_t * premaster,size_t premaster_len)5502 int ssl_log_rsa_client_key_exchange(SSL *ssl,
5503 const uint8_t *encrypted_premaster,
5504 size_t encrypted_premaster_len,
5505 const uint8_t *premaster,
5506 size_t premaster_len)
5507 {
5508 if (encrypted_premaster_len < 8) {
5509 SSLfatal(ssl, SSL_AD_INTERNAL_ERROR, ERR_R_INTERNAL_ERROR);
5510 return 0;
5511 }
5512
5513 /* We only want the first 8 bytes of the encrypted premaster as a tag. */
5514 return nss_keylog_int("RSA",
5515 ssl,
5516 encrypted_premaster,
5517 8,
5518 premaster,
5519 premaster_len);
5520 }
5521
ssl_log_secret(SSL * ssl,const char * label,const uint8_t * secret,size_t secret_len)5522 int ssl_log_secret(SSL *ssl,
5523 const char *label,
5524 const uint8_t *secret,
5525 size_t secret_len)
5526 {
5527 return nss_keylog_int(label,
5528 ssl,
5529 ssl->s3.client_random,
5530 SSL3_RANDOM_SIZE,
5531 secret,
5532 secret_len);
5533 }
5534
5535 #define SSLV2_CIPHER_LEN 3
5536
ssl_cache_cipherlist(SSL * s,PACKET * cipher_suites,int sslv2format)5537 int ssl_cache_cipherlist(SSL *s, PACKET *cipher_suites, int sslv2format)
5538 {
5539 int n;
5540
5541 n = sslv2format ? SSLV2_CIPHER_LEN : TLS_CIPHER_LEN;
5542
5543 if (PACKET_remaining(cipher_suites) == 0) {
5544 SSLfatal(s, SSL_AD_ILLEGAL_PARAMETER, SSL_R_NO_CIPHERS_SPECIFIED);
5545 return 0;
5546 }
5547
5548 if (PACKET_remaining(cipher_suites) % n != 0) {
5549 SSLfatal(s, SSL_AD_DECODE_ERROR, SSL_R_ERROR_IN_RECEIVED_CIPHER_LIST);
5550 return 0;
5551 }
5552
5553 OPENSSL_free(s->s3.tmp.ciphers_raw);
5554 s->s3.tmp.ciphers_raw = NULL;
5555 s->s3.tmp.ciphers_rawlen = 0;
5556
5557 if (sslv2format) {
5558 size_t numciphers = PACKET_remaining(cipher_suites) / n;
5559 PACKET sslv2ciphers = *cipher_suites;
5560 unsigned int leadbyte;
5561 unsigned char *raw;
5562
5563 /*
5564 * We store the raw ciphers list in SSLv3+ format so we need to do some
5565 * preprocessing to convert the list first. If there are any SSLv2 only
5566 * ciphersuites with a non-zero leading byte then we are going to
5567 * slightly over allocate because we won't store those. But that isn't a
5568 * problem.
5569 */
5570 raw = OPENSSL_malloc(numciphers * TLS_CIPHER_LEN);
5571 s->s3.tmp.ciphers_raw = raw;
5572 if (raw == NULL) {
5573 SSLfatal(s, SSL_AD_INTERNAL_ERROR, ERR_R_MALLOC_FAILURE);
5574 return 0;
5575 }
5576 for (s->s3.tmp.ciphers_rawlen = 0;
5577 PACKET_remaining(&sslv2ciphers) > 0;
5578 raw += TLS_CIPHER_LEN) {
5579 if (!PACKET_get_1(&sslv2ciphers, &leadbyte)
5580 || (leadbyte == 0
5581 && !PACKET_copy_bytes(&sslv2ciphers, raw,
5582 TLS_CIPHER_LEN))
5583 || (leadbyte != 0
5584 && !PACKET_forward(&sslv2ciphers, TLS_CIPHER_LEN))) {
5585 SSLfatal(s, SSL_AD_DECODE_ERROR, SSL_R_BAD_PACKET);
5586 OPENSSL_free(s->s3.tmp.ciphers_raw);
5587 s->s3.tmp.ciphers_raw = NULL;
5588 s->s3.tmp.ciphers_rawlen = 0;
5589 return 0;
5590 }
5591 if (leadbyte == 0)
5592 s->s3.tmp.ciphers_rawlen += TLS_CIPHER_LEN;
5593 }
5594 } else if (!PACKET_memdup(cipher_suites, &s->s3.tmp.ciphers_raw,
5595 &s->s3.tmp.ciphers_rawlen)) {
5596 SSLfatal(s, SSL_AD_INTERNAL_ERROR, ERR_R_INTERNAL_ERROR);
5597 return 0;
5598 }
5599 return 1;
5600 }
5601
SSL_bytes_to_cipher_list(SSL * s,const unsigned char * bytes,size_t len,int isv2format,STACK_OF (SSL_CIPHER)** sk,STACK_OF (SSL_CIPHER)** scsvs)5602 int SSL_bytes_to_cipher_list(SSL *s, const unsigned char *bytes, size_t len,
5603 int isv2format, STACK_OF(SSL_CIPHER) **sk,
5604 STACK_OF(SSL_CIPHER) **scsvs)
5605 {
5606 PACKET pkt;
5607
5608 if (!PACKET_buf_init(&pkt, bytes, len))
5609 return 0;
5610 return bytes_to_cipher_list(s, &pkt, sk, scsvs, isv2format, 0);
5611 }
5612
bytes_to_cipher_list(SSL * s,PACKET * cipher_suites,STACK_OF (SSL_CIPHER)** skp,STACK_OF (SSL_CIPHER)** scsvs_out,int sslv2format,int fatal)5613 int bytes_to_cipher_list(SSL *s, PACKET *cipher_suites,
5614 STACK_OF(SSL_CIPHER) **skp,
5615 STACK_OF(SSL_CIPHER) **scsvs_out,
5616 int sslv2format, int fatal)
5617 {
5618 const SSL_CIPHER *c;
5619 STACK_OF(SSL_CIPHER) *sk = NULL;
5620 STACK_OF(SSL_CIPHER) *scsvs = NULL;
5621 int n;
5622 /* 3 = SSLV2_CIPHER_LEN > TLS_CIPHER_LEN = 2. */
5623 unsigned char cipher[SSLV2_CIPHER_LEN];
5624
5625 n = sslv2format ? SSLV2_CIPHER_LEN : TLS_CIPHER_LEN;
5626
5627 if (PACKET_remaining(cipher_suites) == 0) {
5628 if (fatal)
5629 SSLfatal(s, SSL_AD_ILLEGAL_PARAMETER, SSL_R_NO_CIPHERS_SPECIFIED);
5630 else
5631 ERR_raise(ERR_LIB_SSL, SSL_R_NO_CIPHERS_SPECIFIED);
5632 return 0;
5633 }
5634
5635 if (PACKET_remaining(cipher_suites) % n != 0) {
5636 if (fatal)
5637 SSLfatal(s, SSL_AD_DECODE_ERROR,
5638 SSL_R_ERROR_IN_RECEIVED_CIPHER_LIST);
5639 else
5640 ERR_raise(ERR_LIB_SSL, SSL_R_ERROR_IN_RECEIVED_CIPHER_LIST);
5641 return 0;
5642 }
5643
5644 sk = sk_SSL_CIPHER_new_null();
5645 scsvs = sk_SSL_CIPHER_new_null();
5646 if (sk == NULL || scsvs == NULL) {
5647 if (fatal)
5648 SSLfatal(s, SSL_AD_INTERNAL_ERROR, ERR_R_MALLOC_FAILURE);
5649 else
5650 ERR_raise(ERR_LIB_SSL, ERR_R_MALLOC_FAILURE);
5651 goto err;
5652 }
5653
5654 while (PACKET_copy_bytes(cipher_suites, cipher, n)) {
5655 /*
5656 * SSLv3 ciphers wrapped in an SSLv2-compatible ClientHello have the
5657 * first byte set to zero, while true SSLv2 ciphers have a non-zero
5658 * first byte. We don't support any true SSLv2 ciphers, so skip them.
5659 */
5660 if (sslv2format && cipher[0] != '\0')
5661 continue;
5662
5663 /* For SSLv2-compat, ignore leading 0-byte. */
5664 c = ssl_get_cipher_by_char(s, sslv2format ? &cipher[1] : cipher, 1);
5665 if (c != NULL) {
5666 if ((c->valid && !sk_SSL_CIPHER_push(sk, c)) ||
5667 (!c->valid && !sk_SSL_CIPHER_push(scsvs, c))) {
5668 if (fatal)
5669 SSLfatal(s, SSL_AD_INTERNAL_ERROR, ERR_R_MALLOC_FAILURE);
5670 else
5671 ERR_raise(ERR_LIB_SSL, ERR_R_MALLOC_FAILURE);
5672 goto err;
5673 }
5674 }
5675 }
5676 if (PACKET_remaining(cipher_suites) > 0) {
5677 if (fatal)
5678 SSLfatal(s, SSL_AD_DECODE_ERROR, SSL_R_BAD_LENGTH);
5679 else
5680 ERR_raise(ERR_LIB_SSL, SSL_R_BAD_LENGTH);
5681 goto err;
5682 }
5683
5684 if (skp != NULL)
5685 *skp = sk;
5686 else
5687 sk_SSL_CIPHER_free(sk);
5688 if (scsvs_out != NULL)
5689 *scsvs_out = scsvs;
5690 else
5691 sk_SSL_CIPHER_free(scsvs);
5692 return 1;
5693 err:
5694 sk_SSL_CIPHER_free(sk);
5695 sk_SSL_CIPHER_free(scsvs);
5696 return 0;
5697 }
5698
SSL_CTX_set_max_early_data(SSL_CTX * ctx,uint32_t max_early_data)5699 int SSL_CTX_set_max_early_data(SSL_CTX *ctx, uint32_t max_early_data)
5700 {
5701 ctx->max_early_data = max_early_data;
5702
5703 return 1;
5704 }
5705
SSL_CTX_get_max_early_data(const SSL_CTX * ctx)5706 uint32_t SSL_CTX_get_max_early_data(const SSL_CTX *ctx)
5707 {
5708 return ctx->max_early_data;
5709 }
5710
SSL_set_max_early_data(SSL * s,uint32_t max_early_data)5711 int SSL_set_max_early_data(SSL *s, uint32_t max_early_data)
5712 {
5713 s->max_early_data = max_early_data;
5714
5715 return 1;
5716 }
5717
SSL_get_max_early_data(const SSL * s)5718 uint32_t SSL_get_max_early_data(const SSL *s)
5719 {
5720 return s->max_early_data;
5721 }
5722
SSL_CTX_set_recv_max_early_data(SSL_CTX * ctx,uint32_t recv_max_early_data)5723 int SSL_CTX_set_recv_max_early_data(SSL_CTX *ctx, uint32_t recv_max_early_data)
5724 {
5725 ctx->recv_max_early_data = recv_max_early_data;
5726
5727 return 1;
5728 }
5729
SSL_CTX_get_recv_max_early_data(const SSL_CTX * ctx)5730 uint32_t SSL_CTX_get_recv_max_early_data(const SSL_CTX *ctx)
5731 {
5732 return ctx->recv_max_early_data;
5733 }
5734
SSL_set_recv_max_early_data(SSL * s,uint32_t recv_max_early_data)5735 int SSL_set_recv_max_early_data(SSL *s, uint32_t recv_max_early_data)
5736 {
5737 s->recv_max_early_data = recv_max_early_data;
5738
5739 return 1;
5740 }
5741
SSL_get_recv_max_early_data(const SSL * s)5742 uint32_t SSL_get_recv_max_early_data(const SSL *s)
5743 {
5744 return s->recv_max_early_data;
5745 }
5746
ssl_get_max_send_fragment(const SSL * ssl)5747 __owur unsigned int ssl_get_max_send_fragment(const SSL *ssl)
5748 {
5749 /* Return any active Max Fragment Len extension */
5750 if (ssl->session != NULL && USE_MAX_FRAGMENT_LENGTH_EXT(ssl->session))
5751 return GET_MAX_FRAGMENT_LENGTH(ssl->session);
5752
5753 /* return current SSL connection setting */
5754 return ssl->max_send_fragment;
5755 }
5756
ssl_get_split_send_fragment(const SSL * ssl)5757 __owur unsigned int ssl_get_split_send_fragment(const SSL *ssl)
5758 {
5759 /* Return a value regarding an active Max Fragment Len extension */
5760 if (ssl->session != NULL && USE_MAX_FRAGMENT_LENGTH_EXT(ssl->session)
5761 && ssl->split_send_fragment > GET_MAX_FRAGMENT_LENGTH(ssl->session))
5762 return GET_MAX_FRAGMENT_LENGTH(ssl->session);
5763
5764 /* else limit |split_send_fragment| to current |max_send_fragment| */
5765 if (ssl->split_send_fragment > ssl->max_send_fragment)
5766 return ssl->max_send_fragment;
5767
5768 /* return current SSL connection setting */
5769 return ssl->split_send_fragment;
5770 }
5771
SSL_stateless(SSL * s)5772 int SSL_stateless(SSL *s)
5773 {
5774 int ret;
5775
5776 /* Ensure there is no state left over from a previous invocation */
5777 if (!SSL_clear(s))
5778 return 0;
5779
5780 ERR_clear_error();
5781
5782 s->s3.flags |= TLS1_FLAGS_STATELESS;
5783 ret = SSL_accept(s);
5784 s->s3.flags &= ~TLS1_FLAGS_STATELESS;
5785
5786 if (ret > 0 && s->ext.cookieok)
5787 return 1;
5788
5789 if (s->hello_retry_request == SSL_HRR_PENDING && !ossl_statem_in_error(s))
5790 return 0;
5791
5792 return -1;
5793 }
5794
SSL_CTX_set_post_handshake_auth(SSL_CTX * ctx,int val)5795 void SSL_CTX_set_post_handshake_auth(SSL_CTX *ctx, int val)
5796 {
5797 ctx->pha_enabled = val;
5798 }
5799
SSL_set_post_handshake_auth(SSL * ssl,int val)5800 void SSL_set_post_handshake_auth(SSL *ssl, int val)
5801 {
5802 ssl->pha_enabled = val;
5803 }
5804
SSL_verify_client_post_handshake(SSL * ssl)5805 int SSL_verify_client_post_handshake(SSL *ssl)
5806 {
5807 if (!SSL_IS_TLS13(ssl)) {
5808 ERR_raise(ERR_LIB_SSL, SSL_R_WRONG_SSL_VERSION);
5809 return 0;
5810 }
5811 if (!ssl->server) {
5812 ERR_raise(ERR_LIB_SSL, SSL_R_NOT_SERVER);
5813 return 0;
5814 }
5815
5816 if (!SSL_is_init_finished(ssl)) {
5817 ERR_raise(ERR_LIB_SSL, SSL_R_STILL_IN_INIT);
5818 return 0;
5819 }
5820
5821 switch (ssl->post_handshake_auth) {
5822 case SSL_PHA_NONE:
5823 ERR_raise(ERR_LIB_SSL, SSL_R_EXTENSION_NOT_RECEIVED);
5824 return 0;
5825 default:
5826 case SSL_PHA_EXT_SENT:
5827 ERR_raise(ERR_LIB_SSL, ERR_R_INTERNAL_ERROR);
5828 return 0;
5829 case SSL_PHA_EXT_RECEIVED:
5830 break;
5831 case SSL_PHA_REQUEST_PENDING:
5832 ERR_raise(ERR_LIB_SSL, SSL_R_REQUEST_PENDING);
5833 return 0;
5834 case SSL_PHA_REQUESTED:
5835 ERR_raise(ERR_LIB_SSL, SSL_R_REQUEST_SENT);
5836 return 0;
5837 }
5838
5839 ssl->post_handshake_auth = SSL_PHA_REQUEST_PENDING;
5840
5841 /* checks verify_mode and algorithm_auth */
5842 if (!send_certificate_request(ssl)) {
5843 ssl->post_handshake_auth = SSL_PHA_EXT_RECEIVED; /* restore on error */
5844 ERR_raise(ERR_LIB_SSL, SSL_R_INVALID_CONFIG);
5845 return 0;
5846 }
5847
5848 ossl_statem_set_in_init(ssl, 1);
5849 return 1;
5850 }
5851
SSL_CTX_set_session_ticket_cb(SSL_CTX * ctx,SSL_CTX_generate_session_ticket_fn gen_cb,SSL_CTX_decrypt_session_ticket_fn dec_cb,void * arg)5852 int SSL_CTX_set_session_ticket_cb(SSL_CTX *ctx,
5853 SSL_CTX_generate_session_ticket_fn gen_cb,
5854 SSL_CTX_decrypt_session_ticket_fn dec_cb,
5855 void *arg)
5856 {
5857 ctx->generate_ticket_cb = gen_cb;
5858 ctx->decrypt_ticket_cb = dec_cb;
5859 ctx->ticket_cb_data = arg;
5860 return 1;
5861 }
5862
SSL_CTX_set_allow_early_data_cb(SSL_CTX * ctx,SSL_allow_early_data_cb_fn cb,void * arg)5863 void SSL_CTX_set_allow_early_data_cb(SSL_CTX *ctx,
5864 SSL_allow_early_data_cb_fn cb,
5865 void *arg)
5866 {
5867 ctx->allow_early_data_cb = cb;
5868 ctx->allow_early_data_cb_data = arg;
5869 }
5870
SSL_set_allow_early_data_cb(SSL * s,SSL_allow_early_data_cb_fn cb,void * arg)5871 void SSL_set_allow_early_data_cb(SSL *s,
5872 SSL_allow_early_data_cb_fn cb,
5873 void *arg)
5874 {
5875 s->allow_early_data_cb = cb;
5876 s->allow_early_data_cb_data = arg;
5877 }
5878
ssl_evp_cipher_fetch(OSSL_LIB_CTX * libctx,int nid,const char * properties)5879 const EVP_CIPHER *ssl_evp_cipher_fetch(OSSL_LIB_CTX *libctx,
5880 int nid,
5881 const char *properties)
5882 {
5883 const EVP_CIPHER *ciph;
5884
5885 ciph = tls_get_cipher_from_engine(nid);
5886 if (ciph != NULL)
5887 return ciph;
5888
5889 /*
5890 * If there is no engine cipher then we do an explicit fetch. This may fail
5891 * and that could be ok
5892 */
5893 ERR_set_mark();
5894 ciph = EVP_CIPHER_fetch(libctx, OBJ_nid2sn(nid), properties);
5895 ERR_pop_to_mark();
5896 return ciph;
5897 }
5898
5899
ssl_evp_cipher_up_ref(const EVP_CIPHER * cipher)5900 int ssl_evp_cipher_up_ref(const EVP_CIPHER *cipher)
5901 {
5902 /* Don't up-ref an implicit EVP_CIPHER */
5903 if (EVP_CIPHER_get0_provider(cipher) == NULL)
5904 return 1;
5905
5906 /*
5907 * The cipher was explicitly fetched and therefore it is safe to cast
5908 * away the const
5909 */
5910 return EVP_CIPHER_up_ref((EVP_CIPHER *)cipher);
5911 }
5912
ssl_evp_cipher_free(const EVP_CIPHER * cipher)5913 void ssl_evp_cipher_free(const EVP_CIPHER *cipher)
5914 {
5915 if (cipher == NULL)
5916 return;
5917
5918 if (EVP_CIPHER_get0_provider(cipher) != NULL) {
5919 /*
5920 * The cipher was explicitly fetched and therefore it is safe to cast
5921 * away the const
5922 */
5923 EVP_CIPHER_free((EVP_CIPHER *)cipher);
5924 }
5925 }
5926
ssl_evp_md_fetch(OSSL_LIB_CTX * libctx,int nid,const char * properties)5927 const EVP_MD *ssl_evp_md_fetch(OSSL_LIB_CTX *libctx,
5928 int nid,
5929 const char *properties)
5930 {
5931 const EVP_MD *md;
5932
5933 md = tls_get_digest_from_engine(nid);
5934 if (md != NULL)
5935 return md;
5936
5937 /* Otherwise we do an explicit fetch */
5938 ERR_set_mark();
5939 md = EVP_MD_fetch(libctx, OBJ_nid2sn(nid), properties);
5940 ERR_pop_to_mark();
5941 return md;
5942 }
5943
ssl_evp_md_up_ref(const EVP_MD * md)5944 int ssl_evp_md_up_ref(const EVP_MD *md)
5945 {
5946 /* Don't up-ref an implicit EVP_MD */
5947 if (EVP_MD_get0_provider(md) == NULL)
5948 return 1;
5949
5950 /*
5951 * The digest was explicitly fetched and therefore it is safe to cast
5952 * away the const
5953 */
5954 return EVP_MD_up_ref((EVP_MD *)md);
5955 }
5956
ssl_evp_md_free(const EVP_MD * md)5957 void ssl_evp_md_free(const EVP_MD *md)
5958 {
5959 if (md == NULL)
5960 return;
5961
5962 if (EVP_MD_get0_provider(md) != NULL) {
5963 /*
5964 * The digest was explicitly fetched and therefore it is safe to cast
5965 * away the const
5966 */
5967 EVP_MD_free((EVP_MD *)md);
5968 }
5969 }
5970
SSL_set0_tmp_dh_pkey(SSL * s,EVP_PKEY * dhpkey)5971 int SSL_set0_tmp_dh_pkey(SSL *s, EVP_PKEY *dhpkey)
5972 {
5973 if (!ssl_security(s, SSL_SECOP_TMP_DH,
5974 EVP_PKEY_get_security_bits(dhpkey), 0, dhpkey)) {
5975 ERR_raise(ERR_LIB_SSL, SSL_R_DH_KEY_TOO_SMALL);
5976 EVP_PKEY_free(dhpkey);
5977 return 0;
5978 }
5979 EVP_PKEY_free(s->cert->dh_tmp);
5980 s->cert->dh_tmp = dhpkey;
5981 return 1;
5982 }
5983
SSL_CTX_set0_tmp_dh_pkey(SSL_CTX * ctx,EVP_PKEY * dhpkey)5984 int SSL_CTX_set0_tmp_dh_pkey(SSL_CTX *ctx, EVP_PKEY *dhpkey)
5985 {
5986 if (!ssl_ctx_security(ctx, SSL_SECOP_TMP_DH,
5987 EVP_PKEY_get_security_bits(dhpkey), 0, dhpkey)) {
5988 ERR_raise(ERR_LIB_SSL, SSL_R_DH_KEY_TOO_SMALL);
5989 EVP_PKEY_free(dhpkey);
5990 return 0;
5991 }
5992 EVP_PKEY_free(ctx->cert->dh_tmp);
5993 ctx->cert->dh_tmp = dhpkey;
5994 return 1;
5995 }
5996