statem_srvr.c@ 91527

Last change on this file since 91527 was 90293, checked in by vboxsync, 3 years ago
openssl-1.1.1k: Applied and adjusted our OpenSSL changes to 1.1.1k. bugref:10072
File size: 141.4 KB

Line
1	/*
2	* Copyright 1995-2021 The OpenSSL Project Authors. All Rights Reserved.
3	* Copyright (c) 2002, Oracle and/or its affiliates. All rights reserved
4	* Copyright 2005 Nokia. All rights reserved.
5	*
6	* Licensed under the OpenSSL license (the "License"). You may not use
7	* this file except in compliance with the License. You can obtain a copy
8	* in the file LICENSE in the source distribution or at
9	* https://www.openssl.org/source/license.html
10	*/
11
12	#include <stdio.h>
13	#include "../ssl_local.h"
14	#include "statem_local.h"
15	#include "internal/constant_time.h"
16	#include "internal/cryptlib.h"
17	#include <openssl/buffer.h>
18	#include <openssl/rand.h>
19	#include <openssl/objects.h>
20	#include <openssl/evp.h>
21	#include <openssl/hmac.h>
22	#include <openssl/x509.h>
23	#include <openssl/dh.h>
24	#include <openssl/bn.h>
25	#include <openssl/md5.h>
26	#include <openssl/asn1t.h>
27
28	#define TICKET_NONCE_SIZE 8
29
30	typedef struct {
31	ASN1_TYPE *kxBlob;
32	ASN1_TYPE *opaqueBlob;
33	} GOST_KX_MESSAGE;
34
35	DECLARE_ASN1_FUNCTIONS(GOST_KX_MESSAGE)
36
37	ASN1_SEQUENCE(GOST_KX_MESSAGE) = {
38	ASN1_SIMPLE(GOST_KX_MESSAGE, kxBlob, ASN1_ANY),
39	ASN1_OPT(GOST_KX_MESSAGE, opaqueBlob, ASN1_ANY),
40	} ASN1_SEQUENCE_END(GOST_KX_MESSAGE)
41
42	IMPLEMENT_ASN1_FUNCTIONS(GOST_KX_MESSAGE)
43
44	static int tls_construct_encrypted_extensions(SSL s, WPACKET pkt);
45
46	/*
47	* ossl_statem_server13_read_transition() encapsulates the logic for the allowed
48	* handshake state transitions when a TLSv1.3 server is reading messages from
49	* the client. The message type that the client has sent is provided in \|mt\|.
50	* The current state is in \|s->statem.hand_state\|.
51	*
52	* Return values are 1 for success (transition allowed) and 0 on error
53	* (transition not allowed)
54	*/
55	static int ossl_statem_server13_read_transition(SSL *s, int mt)
56	{
57	OSSL_STATEM *st = &s->statem;
58
59	/*
60	* Note: There is no case for TLS_ST_BEFORE because at that stage we have
61	* not negotiated TLSv1.3 yet, so that case is handled by
62	* ossl_statem_server_read_transition()
63	*/
64	switch (st->hand_state) {
65	default:
66	break;
67
68	case TLS_ST_EARLY_DATA:
69	if (s->hello_retry_request == SSL_HRR_PENDING) {
70	if (mt == SSL3_MT_CLIENT_HELLO) {
71	st->hand_state = TLS_ST_SR_CLNT_HELLO;
72	return 1;
73	}
74	break;
75	} else if (s->ext.early_data == SSL_EARLY_DATA_ACCEPTED) {
76	if (mt == SSL3_MT_END_OF_EARLY_DATA) {
77	st->hand_state = TLS_ST_SR_END_OF_EARLY_DATA;
78	return 1;
79	}
80	break;
81	}
82	/* Fall through */
83
84	case TLS_ST_SR_END_OF_EARLY_DATA:
85	case TLS_ST_SW_FINISHED:
86	if (s->s3->tmp.cert_request) {
87	if (mt == SSL3_MT_CERTIFICATE) {
88	st->hand_state = TLS_ST_SR_CERT;
89	return 1;
90	}
91	} else {
92	if (mt == SSL3_MT_FINISHED) {
93	st->hand_state = TLS_ST_SR_FINISHED;
94	return 1;
95	}
96	}
97	break;
98
99	case TLS_ST_SR_CERT:
100	if (s->session->peer == NULL) {
101	if (mt == SSL3_MT_FINISHED) {
102	st->hand_state = TLS_ST_SR_FINISHED;
103	return 1;
104	}
105	} else {
106	if (mt == SSL3_MT_CERTIFICATE_VERIFY) {
107	st->hand_state = TLS_ST_SR_CERT_VRFY;
108	return 1;
109	}
110	}
111	break;
112
113	case TLS_ST_SR_CERT_VRFY:
114	if (mt == SSL3_MT_FINISHED) {
115	st->hand_state = TLS_ST_SR_FINISHED;
116	return 1;
117	}
118	break;
119
120	case TLS_ST_OK:
121	/*
122	* Its never ok to start processing handshake messages in the middle of
123	* early data (i.e. before we've received the end of early data alert)
124	*/
125	if (s->early_data_state == SSL_EARLY_DATA_READING)
126	break;
127
128	if (mt == SSL3_MT_CERTIFICATE
129	&& s->post_handshake_auth == SSL_PHA_REQUESTED) {
130	st->hand_state = TLS_ST_SR_CERT;
131	return 1;
132	}
133
134	if (mt == SSL3_MT_KEY_UPDATE) {
135	st->hand_state = TLS_ST_SR_KEY_UPDATE;
136	return 1;
137	}
138	break;
139	}
140
141	/* No valid transition found */
142	return 0;
143	}
144
145	/*
146	* ossl_statem_server_read_transition() encapsulates the logic for the allowed
147	* handshake state transitions when the server is reading messages from the
148	* client. The message type that the client has sent is provided in \|mt\|. The
149	* current state is in \|s->statem.hand_state\|.
150	*
151	* Return values are 1 for success (transition allowed) and 0 on error
152	* (transition not allowed)
153	*/
154	int ossl_statem_server_read_transition(SSL *s, int mt)
155	{
156	OSSL_STATEM *st = &s->statem;
157
158	if (SSL_IS_TLS13(s)) {
159	if (!ossl_statem_server13_read_transition(s, mt))
160	goto err;
161	return 1;
162	}
163
164	switch (st->hand_state) {
165	default:
166	break;
167
168	case TLS_ST_BEFORE:
169	case TLS_ST_OK:
170	case DTLS_ST_SW_HELLO_VERIFY_REQUEST:
171	if (mt == SSL3_MT_CLIENT_HELLO) {
172	st->hand_state = TLS_ST_SR_CLNT_HELLO;
173	return 1;
174	}
175	break;
176
177	case TLS_ST_SW_SRVR_DONE:
178	/*
179	* If we get a CKE message after a ServerDone then either
180	* 1) We didn't request a Certificate
181	* OR
182	* 2) If we did request one then
183	* a) We allow no Certificate to be returned
184	* AND
185	* b) We are running SSL3 (in TLS1.0+ the client must return a 0
186	* list if we requested a certificate)
187	*/
188	if (mt == SSL3_MT_CLIENT_KEY_EXCHANGE) {
189	if (s->s3->tmp.cert_request) {
190	if (s->version == SSL3_VERSION) {
191	if ((s->verify_mode & SSL_VERIFY_PEER)
192	&& (s->verify_mode & SSL_VERIFY_FAIL_IF_NO_PEER_CERT)) {
193	/*
194	* This isn't an unexpected message as such - we're just
195	* not going to accept it because we require a client
196	* cert.
197	*/
198	SSLfatal(s, SSL_AD_HANDSHAKE_FAILURE,
199	SSL_F_OSSL_STATEM_SERVER_READ_TRANSITION,
200	SSL_R_PEER_DID_NOT_RETURN_A_CERTIFICATE);
201	return 0;
202	}
203	st->hand_state = TLS_ST_SR_KEY_EXCH;
204	return 1;
205	}
206	} else {
207	st->hand_state = TLS_ST_SR_KEY_EXCH;
208	return 1;
209	}
210	} else if (s->s3->tmp.cert_request) {
211	if (mt == SSL3_MT_CERTIFICATE) {
212	st->hand_state = TLS_ST_SR_CERT;
213	return 1;
214	}
215	}
216	break;
217
218	case TLS_ST_SR_CERT:
219	if (mt == SSL3_MT_CLIENT_KEY_EXCHANGE) {
220	st->hand_state = TLS_ST_SR_KEY_EXCH;
221	return 1;
222	}
223	break;
224
225	case TLS_ST_SR_KEY_EXCH:
226	/*
227	* We should only process a CertificateVerify message if we have
228	* received a Certificate from the client. If so then \|s->session->peer\|
229	* will be non NULL. In some instances a CertificateVerify message is
230	* not required even if the peer has sent a Certificate (e.g. such as in
231	* the case of static DH). In that case \|st->no_cert_verify\| should be
232	* set.
233	*/
234	if (s->session->peer == NULL \|\| st->no_cert_verify) {
235	if (mt == SSL3_MT_CHANGE_CIPHER_SPEC) {
236	/*
237	* For the ECDH ciphersuites when the client sends its ECDH
238	* pub key in a certificate, the CertificateVerify message is
239	* not sent. Also for GOST ciphersuites when the client uses
240	* its key from the certificate for key exchange.
241	*/
242	st->hand_state = TLS_ST_SR_CHANGE;
243	return 1;
244	}
245	} else {
246	if (mt == SSL3_MT_CERTIFICATE_VERIFY) {
247	st->hand_state = TLS_ST_SR_CERT_VRFY;
248	return 1;
249	}
250	}
251	break;
252
253	case TLS_ST_SR_CERT_VRFY:
254	if (mt == SSL3_MT_CHANGE_CIPHER_SPEC) {
255	st->hand_state = TLS_ST_SR_CHANGE;
256	return 1;
257	}
258	break;
259
260	case TLS_ST_SR_CHANGE:
261	#ifndef OPENSSL_NO_NEXTPROTONEG
262	if (s->s3->npn_seen) {
263	if (mt == SSL3_MT_NEXT_PROTO) {
264	st->hand_state = TLS_ST_SR_NEXT_PROTO;
265	return 1;
266	}
267	} else {
268	#endif
269	if (mt == SSL3_MT_FINISHED) {
270	st->hand_state = TLS_ST_SR_FINISHED;
271	return 1;
272	}
273	#ifndef OPENSSL_NO_NEXTPROTONEG
274	}
275	#endif
276	break;
277
278	#ifndef OPENSSL_NO_NEXTPROTONEG
279	case TLS_ST_SR_NEXT_PROTO:
280	if (mt == SSL3_MT_FINISHED) {
281	st->hand_state = TLS_ST_SR_FINISHED;
282	return 1;
283	}
284	break;
285	#endif
286
287	case TLS_ST_SW_FINISHED:
288	if (mt == SSL3_MT_CHANGE_CIPHER_SPEC) {
289	st->hand_state = TLS_ST_SR_CHANGE;
290	return 1;
291	}
292	break;
293	}
294
295	err:
296	/* No valid transition found */
297	if (SSL_IS_DTLS(s) && mt == SSL3_MT_CHANGE_CIPHER_SPEC) {
298	BIO *rbio;
299
300	/*
301	* CCS messages don't have a message sequence number so this is probably
302	* because of an out-of-order CCS. We'll just drop it.
303	*/
304	s->init_num = 0;
305	s->rwstate = SSL_READING;
306	rbio = SSL_get_rbio(s);
307	BIO_clear_retry_flags(rbio);
308	BIO_set_retry_read(rbio);
309	return 0;
310	}
311	SSLfatal(s, SSL3_AD_UNEXPECTED_MESSAGE,
312	SSL_F_OSSL_STATEM_SERVER_READ_TRANSITION,
313	SSL_R_UNEXPECTED_MESSAGE);
314	return 0;
315	}
316
317	/*
318	* Should we send a ServerKeyExchange message?
319	*
320	* Valid return values are:
321	* 1: Yes
322	* 0: No
323	*/
324	static int send_server_key_exchange(SSL *s)
325	{
326	unsigned long alg_k = s->s3->tmp.new_cipher->algorithm_mkey;
327
328	/*
329	* only send a ServerKeyExchange if DH or fortezza but we have a
330	* sign only certificate PSK: may send PSK identity hints For
331	* ECC ciphersuites, we send a serverKeyExchange message only if
332	* the cipher suite is either ECDH-anon or ECDHE. In other cases,
333	* the server certificate contains the server's public key for
334	* key exchange.
335	*/
336	if (alg_k & (SSL_kDHE \| SSL_kECDHE)
337	/*
338	* PSK: send ServerKeyExchange if PSK identity hint if
339	* provided
340	*/
341	#ifndef OPENSSL_NO_PSK
342	/* Only send SKE if we have identity hint for plain PSK */
343	\|\| ((alg_k & (SSL_kPSK \| SSL_kRSAPSK))
344	&& s->cert->psk_identity_hint)
345	/* For other PSK always send SKE */
346	\|\| (alg_k & (SSL_PSK & (SSL_kDHEPSK \| SSL_kECDHEPSK)))
347	#endif
348	#ifndef OPENSSL_NO_SRP
349	/* SRP: send ServerKeyExchange */
350	\|\| (alg_k & SSL_kSRP)
351	#endif
352	) {
353	return 1;
354	}
355
356	return 0;
357	}
358
359	/*
360	* Should we send a CertificateRequest message?
361	*
362	* Valid return values are:
363	* 1: Yes
364	* 0: No
365	*/
366	int send_certificate_request(SSL *s)
367	{
368	if (
369	/* don't request cert unless asked for it: */
370	s->verify_mode & SSL_VERIFY_PEER
371	/*
372	* don't request if post-handshake-only unless doing
373	* post-handshake in TLSv1.3:
374	*/
375	&& (!SSL_IS_TLS13(s) \|\| !(s->verify_mode & SSL_VERIFY_POST_HANDSHAKE)
376	\|\| s->post_handshake_auth == SSL_PHA_REQUEST_PENDING)
377	/*
378	* if SSL_VERIFY_CLIENT_ONCE is set, don't request cert
379	* a second time:
380	*/
381	&& (s->certreqs_sent < 1 \|\|
382	!(s->verify_mode & SSL_VERIFY_CLIENT_ONCE))
383	/*
384	* never request cert in anonymous ciphersuites (see
385	* section "Certificate request" in SSL 3 drafts and in
386	* RFC 2246):
387	*/
388	&& (!(s->s3->tmp.new_cipher->algorithm_auth & SSL_aNULL)
389	/*
390	* ... except when the application insists on
391	* verification (against the specs, but statem_clnt.c accepts
392	* this for SSL 3)
393	*/
394	\|\| (s->verify_mode & SSL_VERIFY_FAIL_IF_NO_PEER_CERT))
395	/* don't request certificate for SRP auth */
396	&& !(s->s3->tmp.new_cipher->algorithm_auth & SSL_aSRP)
397	/*
398	* With normal PSK Certificates and Certificate Requests
399	* are omitted
400	*/
401	&& !(s->s3->tmp.new_cipher->algorithm_auth & SSL_aPSK)) {
402	return 1;
403	}
404
405	return 0;
406	}
407
408	/*
409	* ossl_statem_server13_write_transition() works out what handshake state to
410	* move to next when a TLSv1.3 server is writing messages to be sent to the
411	* client.
412	*/
413	static WRITE_TRAN ossl_statem_server13_write_transition(SSL *s)
414	{
415	OSSL_STATEM *st = &s->statem;
416
417	/*
418	* No case for TLS_ST_BEFORE, because at that stage we have not negotiated
419	* TLSv1.3 yet, so that is handled by ossl_statem_server_write_transition()
420	*/
421
422	switch (st->hand_state) {
423	default:
424	/* Shouldn't happen */
425	SSLfatal(s, SSL_AD_INTERNAL_ERROR,
426	SSL_F_OSSL_STATEM_SERVER13_WRITE_TRANSITION,
427	ERR_R_INTERNAL_ERROR);
428	return WRITE_TRAN_ERROR;
429
430	case TLS_ST_OK:
431	if (s->key_update != SSL_KEY_UPDATE_NONE) {
432	st->hand_state = TLS_ST_SW_KEY_UPDATE;
433	return WRITE_TRAN_CONTINUE;
434	}
435	if (s->post_handshake_auth == SSL_PHA_REQUEST_PENDING) {
436	st->hand_state = TLS_ST_SW_CERT_REQ;
437	return WRITE_TRAN_CONTINUE;
438	}
439	/* Try to read from the client instead */
440	return WRITE_TRAN_FINISHED;
441
442	case TLS_ST_SR_CLNT_HELLO:
443	st->hand_state = TLS_ST_SW_SRVR_HELLO;
444	return WRITE_TRAN_CONTINUE;
445
446	case TLS_ST_SW_SRVR_HELLO:
447	if ((s->options & SSL_OP_ENABLE_MIDDLEBOX_COMPAT) != 0
448	&& s->hello_retry_request != SSL_HRR_COMPLETE)
449	st->hand_state = TLS_ST_SW_CHANGE;
450	else if (s->hello_retry_request == SSL_HRR_PENDING)
451	st->hand_state = TLS_ST_EARLY_DATA;
452	else
453	st->hand_state = TLS_ST_SW_ENCRYPTED_EXTENSIONS;
454	return WRITE_TRAN_CONTINUE;
455
456	case TLS_ST_SW_CHANGE:
457	if (s->hello_retry_request == SSL_HRR_PENDING)
458	st->hand_state = TLS_ST_EARLY_DATA;
459	else
460	st->hand_state = TLS_ST_SW_ENCRYPTED_EXTENSIONS;
461	return WRITE_TRAN_CONTINUE;
462
463	case TLS_ST_SW_ENCRYPTED_EXTENSIONS:
464	if (s->hit)
465	st->hand_state = TLS_ST_SW_FINISHED;
466	else if (send_certificate_request(s))
467	st->hand_state = TLS_ST_SW_CERT_REQ;
468	else
469	st->hand_state = TLS_ST_SW_CERT;
470
471	return WRITE_TRAN_CONTINUE;
472
473	case TLS_ST_SW_CERT_REQ:
474	if (s->post_handshake_auth == SSL_PHA_REQUEST_PENDING) {
475	s->post_handshake_auth = SSL_PHA_REQUESTED;
476	st->hand_state = TLS_ST_OK;
477	} else {
478	st->hand_state = TLS_ST_SW_CERT;
479	}
480	return WRITE_TRAN_CONTINUE;
481
482	case TLS_ST_SW_CERT:
483	st->hand_state = TLS_ST_SW_CERT_VRFY;
484	return WRITE_TRAN_CONTINUE;
485
486	case TLS_ST_SW_CERT_VRFY:
487	st->hand_state = TLS_ST_SW_FINISHED;
488	return WRITE_TRAN_CONTINUE;
489
490	case TLS_ST_SW_FINISHED:
491	st->hand_state = TLS_ST_EARLY_DATA;
492	return WRITE_TRAN_CONTINUE;
493
494	case TLS_ST_EARLY_DATA:
495	return WRITE_TRAN_FINISHED;
496
497	case TLS_ST_SR_FINISHED:
498	/*
499	* Technically we have finished the handshake at this point, but we're
500	* going to remain "in_init" for now and write out any session tickets
501	* immediately.
502	*/
503	if (s->post_handshake_auth == SSL_PHA_REQUESTED) {
504	s->post_handshake_auth = SSL_PHA_EXT_RECEIVED;
505	} else if (!s->ext.ticket_expected) {
506	/*
507	* If we're not going to renew the ticket then we just finish the
508	* handshake at this point.
509	*/
510	st->hand_state = TLS_ST_OK;
511	return WRITE_TRAN_CONTINUE;
512	}
513	if (s->num_tickets > s->sent_tickets)
514	st->hand_state = TLS_ST_SW_SESSION_TICKET;
515	else
516	st->hand_state = TLS_ST_OK;
517	return WRITE_TRAN_CONTINUE;
518
519	case TLS_ST_SR_KEY_UPDATE:
520	case TLS_ST_SW_KEY_UPDATE:
521	st->hand_state = TLS_ST_OK;
522	return WRITE_TRAN_CONTINUE;
523
524	case TLS_ST_SW_SESSION_TICKET:
525	/* In a resumption we only ever send a maximum of one new ticket.
526	* Following an initial handshake we send the number of tickets we have
527	* been configured for.
528	*/
529	if (s->hit \|\| s->num_tickets <= s->sent_tickets) {
530	/* We've written enough tickets out. */
531	st->hand_state = TLS_ST_OK;
532	}
533	return WRITE_TRAN_CONTINUE;
534	}
535	}
536
537	/*
538	* ossl_statem_server_write_transition() works out what handshake state to move
539	* to next when the server is writing messages to be sent to the client.
540	*/
541	WRITE_TRAN ossl_statem_server_write_transition(SSL *s)
542	{
543	OSSL_STATEM *st = &s->statem;
544
545	/*
546	* Note that before the ClientHello we don't know what version we are going
547	* to negotiate yet, so we don't take this branch until later
548	*/
549
550	if (SSL_IS_TLS13(s))
551	return ossl_statem_server13_write_transition(s);
552
553	switch (st->hand_state) {
554	default:
555	/* Shouldn't happen */
556	SSLfatal(s, SSL_AD_INTERNAL_ERROR,
557	SSL_F_OSSL_STATEM_SERVER_WRITE_TRANSITION,
558	ERR_R_INTERNAL_ERROR);
559	return WRITE_TRAN_ERROR;
560
561	case TLS_ST_OK:
562	if (st->request_state == TLS_ST_SW_HELLO_REQ) {
563	/* We must be trying to renegotiate */
564	st->hand_state = TLS_ST_SW_HELLO_REQ;
565	st->request_state = TLS_ST_BEFORE;
566	return WRITE_TRAN_CONTINUE;
567	}
568	/* Must be an incoming ClientHello */
569	if (!tls_setup_handshake(s)) {
570	/* SSLfatal() already called */
571	return WRITE_TRAN_ERROR;
572	}
573	/* Fall through */
574
575	case TLS_ST_BEFORE:
576	/* Just go straight to trying to read from the client */
577	return WRITE_TRAN_FINISHED;
578
579	case TLS_ST_SW_HELLO_REQ:
580	st->hand_state = TLS_ST_OK;
581	return WRITE_TRAN_CONTINUE;
582
583	case TLS_ST_SR_CLNT_HELLO:
584	if (SSL_IS_DTLS(s) && !s->d1->cookie_verified
585	&& (SSL_get_options(s) & SSL_OP_COOKIE_EXCHANGE)) {
586	st->hand_state = DTLS_ST_SW_HELLO_VERIFY_REQUEST;
587	} else if (s->renegotiate == 0 && !SSL_IS_FIRST_HANDSHAKE(s)) {
588	/* We must have rejected the renegotiation */
589	st->hand_state = TLS_ST_OK;
590	return WRITE_TRAN_CONTINUE;
591	} else {
592	st->hand_state = TLS_ST_SW_SRVR_HELLO;
593	}
594	return WRITE_TRAN_CONTINUE;
595
596	case DTLS_ST_SW_HELLO_VERIFY_REQUEST:
597	return WRITE_TRAN_FINISHED;
598
599	case TLS_ST_SW_SRVR_HELLO:
600	if (s->hit) {
601	if (s->ext.ticket_expected)
602	st->hand_state = TLS_ST_SW_SESSION_TICKET;
603	else
604	st->hand_state = TLS_ST_SW_CHANGE;
605	} else {
606	/* Check if it is anon DH or anon ECDH, */
607	/* normal PSK or SRP */
608	if (!(s->s3->tmp.new_cipher->algorithm_auth &
609	(SSL_aNULL \| SSL_aSRP \| SSL_aPSK))) {
610	st->hand_state = TLS_ST_SW_CERT;
611	} else if (send_server_key_exchange(s)) {
612	st->hand_state = TLS_ST_SW_KEY_EXCH;
613	} else if (send_certificate_request(s)) {
614	st->hand_state = TLS_ST_SW_CERT_REQ;
615	} else {
616	st->hand_state = TLS_ST_SW_SRVR_DONE;
617	}
618	}
619	return WRITE_TRAN_CONTINUE;
620
621	case TLS_ST_SW_CERT:
622	if (s->ext.status_expected) {
623	st->hand_state = TLS_ST_SW_CERT_STATUS;
624	return WRITE_TRAN_CONTINUE;
625	}
626	/* Fall through */
627
628	case TLS_ST_SW_CERT_STATUS:
629	if (send_server_key_exchange(s)) {
630	st->hand_state = TLS_ST_SW_KEY_EXCH;
631	return WRITE_TRAN_CONTINUE;
632	}
633	/* Fall through */
634
635	case TLS_ST_SW_KEY_EXCH:
636	if (send_certificate_request(s)) {
637	st->hand_state = TLS_ST_SW_CERT_REQ;
638	return WRITE_TRAN_CONTINUE;
639	}
640	/* Fall through */
641
642	case TLS_ST_SW_CERT_REQ:
643	st->hand_state = TLS_ST_SW_SRVR_DONE;
644	return WRITE_TRAN_CONTINUE;
645
646	case TLS_ST_SW_SRVR_DONE:
647	return WRITE_TRAN_FINISHED;
648
649	case TLS_ST_SR_FINISHED:
650	if (s->hit) {
651	st->hand_state = TLS_ST_OK;
652	return WRITE_TRAN_CONTINUE;
653	} else if (s->ext.ticket_expected) {
654	st->hand_state = TLS_ST_SW_SESSION_TICKET;
655	} else {
656	st->hand_state = TLS_ST_SW_CHANGE;
657	}
658	return WRITE_TRAN_CONTINUE;
659
660	case TLS_ST_SW_SESSION_TICKET:
661	st->hand_state = TLS_ST_SW_CHANGE;
662	return WRITE_TRAN_CONTINUE;
663
664	case TLS_ST_SW_CHANGE:
665	st->hand_state = TLS_ST_SW_FINISHED;
666	return WRITE_TRAN_CONTINUE;
667
668	case TLS_ST_SW_FINISHED:
669	if (s->hit) {
670	return WRITE_TRAN_FINISHED;
671	}
672	st->hand_state = TLS_ST_OK;
673	return WRITE_TRAN_CONTINUE;
674	}
675	}
676
677	/*
678	* Perform any pre work that needs to be done prior to sending a message from
679	* the server to the client.
680	*/
681	WORK_STATE ossl_statem_server_pre_work(SSL *s, WORK_STATE wst)
682	{
683	OSSL_STATEM *st = &s->statem;
684
685	switch (st->hand_state) {
686	default:
687	/* No pre work to be done */
688	break;
689
690	case TLS_ST_SW_HELLO_REQ:
691	s->shutdown = 0;
692	if (SSL_IS_DTLS(s))
693	dtls1_clear_sent_buffer(s);
694	break;
695
696	case DTLS_ST_SW_HELLO_VERIFY_REQUEST:
697	s->shutdown = 0;
698	if (SSL_IS_DTLS(s)) {
699	dtls1_clear_sent_buffer(s);
700	/* We don't buffer this message so don't use the timer */
701	st->use_timer = 0;
702	}
703	break;
704
705	case TLS_ST_SW_SRVR_HELLO:
706	if (SSL_IS_DTLS(s)) {
707	/*
708	* Messages we write from now on should be buffered and
709	* retransmitted if necessary, so we need to use the timer now
710	*/
711	st->use_timer = 1;
712	}
713	break;
714
715	case TLS_ST_SW_SRVR_DONE:
716	#ifndef OPENSSL_NO_SCTP
717	if (SSL_IS_DTLS(s) && BIO_dgram_is_sctp(SSL_get_wbio(s))) {
718	/* Calls SSLfatal() as required */
719	return dtls_wait_for_dry(s);
720	}
721	#endif
722	return WORK_FINISHED_CONTINUE;
723
724	case TLS_ST_SW_SESSION_TICKET:
725	if (SSL_IS_TLS13(s) && s->sent_tickets == 0) {
726	/*
727	* Actually this is the end of the handshake, but we're going
728	* straight into writing the session ticket out. So we finish off
729	* the handshake, but keep the various buffers active.
730	*
731	* Calls SSLfatal as required.
732	*/
733	return tls_finish_handshake(s, wst, 0, 0);
734	} if (SSL_IS_DTLS(s)) {
735	/*
736	* We're into the last flight. We don't retransmit the last flight
737	* unless we need to, so we don't use the timer
738	*/
739	st->use_timer = 0;
740	}
741	break;
742
743	case TLS_ST_SW_CHANGE:
744	if (SSL_IS_TLS13(s))
745	break;
746	/* Writes to s->session are only safe for initial handshakes */
747	if (s->session->cipher == NULL) {
748	s->session->cipher = s->s3->tmp.new_cipher;
749	} else if (s->session->cipher != s->s3->tmp.new_cipher) {
750	SSLfatal(s, SSL_AD_INTERNAL_ERROR,
751	SSL_F_OSSL_STATEM_SERVER_PRE_WORK,
752	ERR_R_INTERNAL_ERROR);
753	return WORK_ERROR;
754	}
755	if (!s->method->ssl3_enc->setup_key_block(s)) {
756	/* SSLfatal() already called */
757	return WORK_ERROR;
758	}
759	if (SSL_IS_DTLS(s)) {
760	/*
761	* We're into the last flight. We don't retransmit the last flight
762	* unless we need to, so we don't use the timer. This might have
763	* already been set to 0 if we sent a NewSessionTicket message,
764	* but we'll set it again here in case we didn't.
765	*/
766	st->use_timer = 0;
767	}
768	return WORK_FINISHED_CONTINUE;
769
770	case TLS_ST_EARLY_DATA:
771	if (s->early_data_state != SSL_EARLY_DATA_ACCEPTING
772	&& (s->s3->flags & TLS1_FLAGS_STATELESS) == 0)
773	return WORK_FINISHED_CONTINUE;
774	/* Fall through */
775
776	case TLS_ST_OK:
777	/* Calls SSLfatal() as required */
778	return tls_finish_handshake(s, wst, 1, 1);
779	}
780
781	return WORK_FINISHED_CONTINUE;
782	}
783
784	static ossl_inline int conn_is_closed(void)
785	{
786	switch (get_last_sys_error()) {
787	#if defined(EPIPE)
788	case EPIPE:
789	return 1;
790	#endif
791	#if defined(ECONNRESET)
792	case ECONNRESET:
793	return 1;
794	#endif
795	#if defined(WSAECONNRESET)
796	case WSAECONNRESET:
797	return 1;
798	#endif
799	default:
800	return 0;
801	}
802	}
803
804	/*
805	* Perform any work that needs to be done after sending a message from the
806	* server to the client.
807	*/
808	WORK_STATE ossl_statem_server_post_work(SSL *s, WORK_STATE wst)
809	{
810	OSSL_STATEM *st = &s->statem;
811
812	s->init_num = 0;
813
814	switch (st->hand_state) {
815	default:
816	/* No post work to be done */
817	break;
818
819	case TLS_ST_SW_HELLO_REQ:
820	if (statem_flush(s) != 1)
821	return WORK_MORE_A;
822	if (!ssl3_init_finished_mac(s)) {
823	/* SSLfatal() already called */
824	return WORK_ERROR;
825	}
826	break;
827
828	case DTLS_ST_SW_HELLO_VERIFY_REQUEST:
829	if (statem_flush(s) != 1)
830	return WORK_MORE_A;
831	/* HelloVerifyRequest resets Finished MAC */
832	if (s->version != DTLS1_BAD_VER && !ssl3_init_finished_mac(s)) {
833	/* SSLfatal() already called */
834	return WORK_ERROR;
835	}
836	/*
837	* The next message should be another ClientHello which we need to
838	* treat like it was the first packet
839	*/
840	s->first_packet = 1;
841	break;
842
843	case TLS_ST_SW_SRVR_HELLO:
844	if (SSL_IS_TLS13(s) && s->hello_retry_request == SSL_HRR_PENDING) {
845	if ((s->options & SSL_OP_ENABLE_MIDDLEBOX_COMPAT) == 0
846	&& statem_flush(s) != 1)
847	return WORK_MORE_A;
848	break;
849	}
850	#ifndef OPENSSL_NO_SCTP
851	if (SSL_IS_DTLS(s) && s->hit) {
852	unsigned char sctpauthkey[64];
853	char labelbuffer[sizeof(DTLS1_SCTP_AUTH_LABEL)];
854	size_t labellen;
855
856	/*
857	* Add new shared key for SCTP-Auth, will be ignored if no
858	* SCTP used.
859	*/
860	memcpy(labelbuffer, DTLS1_SCTP_AUTH_LABEL,
861	sizeof(DTLS1_SCTP_AUTH_LABEL));
862
863	/* Don't include the terminating zero. */
864	labellen = sizeof(labelbuffer) - 1;
865	if (s->mode & SSL_MODE_DTLS_SCTP_LABEL_LENGTH_BUG)
866	labellen += 1;
867
868	if (SSL_export_keying_material(s, sctpauthkey,
869	sizeof(sctpauthkey), labelbuffer,
870	labellen, NULL, 0,
871	0) <= 0) {
872	SSLfatal(s, SSL_AD_INTERNAL_ERROR,
873	SSL_F_OSSL_STATEM_SERVER_POST_WORK,
874	ERR_R_INTERNAL_ERROR);
875	return WORK_ERROR;
876	}
877
878	BIO_ctrl(SSL_get_wbio(s), BIO_CTRL_DGRAM_SCTP_ADD_AUTH_KEY,
879	sizeof(sctpauthkey), sctpauthkey);
880	}
881	#endif
882	if (!SSL_IS_TLS13(s)
883	\|\| ((s->options & SSL_OP_ENABLE_MIDDLEBOX_COMPAT) != 0
884	&& s->hello_retry_request != SSL_HRR_COMPLETE))
885	break;
886	/* Fall through */
887
888	case TLS_ST_SW_CHANGE:
889	if (s->hello_retry_request == SSL_HRR_PENDING) {
890	if (!statem_flush(s))
891	return WORK_MORE_A;
892	break;
893	}
894
895	if (SSL_IS_TLS13(s)) {
896	if (!s->method->ssl3_enc->setup_key_block(s)
897	\|\| !s->method->ssl3_enc->change_cipher_state(s,
898	SSL3_CC_HANDSHAKE \| SSL3_CHANGE_CIPHER_SERVER_WRITE)) {
899	/* SSLfatal() already called */
900	return WORK_ERROR;
901	}
902
903	if (s->ext.early_data != SSL_EARLY_DATA_ACCEPTED
904	&& !s->method->ssl3_enc->change_cipher_state(s,
905	SSL3_CC_HANDSHAKE \|SSL3_CHANGE_CIPHER_SERVER_READ)) {
906	/* SSLfatal() already called */
907	return WORK_ERROR;
908	}
909	/*
910	* We don't yet know whether the next record we are going to receive
911	* is an unencrypted alert, an encrypted alert, or an encrypted
912	* handshake message. We temporarily tolerate unencrypted alerts.
913	*/
914	s->statem.enc_read_state = ENC_READ_STATE_ALLOW_PLAIN_ALERTS;
915	break;
916	}
917
918	#ifndef OPENSSL_NO_SCTP
919	if (SSL_IS_DTLS(s) && !s->hit) {
920	/*
921	* Change to new shared key of SCTP-Auth, will be ignored if
922	* no SCTP used.
923	*/
924	BIO_ctrl(SSL_get_wbio(s), BIO_CTRL_DGRAM_SCTP_NEXT_AUTH_KEY,
925	0, NULL);
926	}
927	#endif
928	if (!s->method->ssl3_enc->change_cipher_state(s,
929	SSL3_CHANGE_CIPHER_SERVER_WRITE))
930	{
931	/* SSLfatal() already called */
932	return WORK_ERROR;
933	}
934
935	if (SSL_IS_DTLS(s))
936	dtls1_reset_seq_numbers(s, SSL3_CC_WRITE);
937	break;
938
939	case TLS_ST_SW_SRVR_DONE:
940	if (statem_flush(s) != 1)
941	return WORK_MORE_A;
942	break;
943
944	case TLS_ST_SW_FINISHED:
945	if (statem_flush(s) != 1)
946	return WORK_MORE_A;
947	#ifndef OPENSSL_NO_SCTP
948	if (SSL_IS_DTLS(s) && s->hit) {
949	/*
950	* Change to new shared key of SCTP-Auth, will be ignored if
951	* no SCTP used.
952	*/
953	BIO_ctrl(SSL_get_wbio(s), BIO_CTRL_DGRAM_SCTP_NEXT_AUTH_KEY,
954	0, NULL);
955	}
956	#endif
957	if (SSL_IS_TLS13(s)) {
958	/* TLS 1.3 gets the secret size from the handshake md */
959	size_t dummy;
960	if (!s->method->ssl3_enc->generate_master_secret(s,
961	s->master_secret, s->handshake_secret, 0,
962	&dummy)
963	\|\| !s->method->ssl3_enc->change_cipher_state(s,
964	SSL3_CC_APPLICATION \| SSL3_CHANGE_CIPHER_SERVER_WRITE))
965	/* SSLfatal() already called */
966	return WORK_ERROR;
967	}
968	break;
969
970	case TLS_ST_SW_CERT_REQ:
971	if (s->post_handshake_auth == SSL_PHA_REQUEST_PENDING) {
972	if (statem_flush(s) != 1)
973	return WORK_MORE_A;
974	}
975	break;
976
977	case TLS_ST_SW_KEY_UPDATE:
978	if (statem_flush(s) != 1)
979	return WORK_MORE_A;
980	if (!tls13_update_key(s, 1)) {
981	/* SSLfatal() already called */
982	return WORK_ERROR;
983	}
984	break;
985
986	case TLS_ST_SW_SESSION_TICKET:
987	clear_sys_error();
988	if (SSL_IS_TLS13(s) && statem_flush(s) != 1) {
989	if (SSL_get_error(s, 0) == SSL_ERROR_SYSCALL
990	&& conn_is_closed()) {
991	/*
992	* We ignore connection closed errors in TLSv1.3 when sending a
993	* NewSessionTicket and behave as if we were successful. This is
994	* so that we are still able to read data sent to us by a client
995	* that closes soon after the end of the handshake without
996	* waiting to read our post-handshake NewSessionTickets.
997	*/
998	s->rwstate = SSL_NOTHING;
999	break;
1000	}
1001
1002	return WORK_MORE_A;
1003	}
1004	break;
1005	}
1006
1007	return WORK_FINISHED_CONTINUE;
1008	}
1009
1010	/*
1011	* Get the message construction function and message type for sending from the
1012	* server
1013	*
1014	* Valid return values are:
1015	* 1: Success
1016	* 0: Error
1017	*/
1018	int ossl_statem_server_construct_message(SSL s, WPACKET pkt,
1019	confunc_f confunc, int mt)
1020	{
1021	OSSL_STATEM *st = &s->statem;
1022
1023	switch (st->hand_state) {
1024	default:
1025	/* Shouldn't happen */
1026	SSLfatal(s, SSL_AD_INTERNAL_ERROR,
1027	SSL_F_OSSL_STATEM_SERVER_CONSTRUCT_MESSAGE,
1028	SSL_R_BAD_HANDSHAKE_STATE);
1029	return 0;
1030
1031	case TLS_ST_SW_CHANGE:
1032	if (SSL_IS_DTLS(s))
1033	*confunc = dtls_construct_change_cipher_spec;
1034	else
1035	*confunc = tls_construct_change_cipher_spec;
1036	*mt = SSL3_MT_CHANGE_CIPHER_SPEC;
1037	break;
1038
1039	case DTLS_ST_SW_HELLO_VERIFY_REQUEST:
1040	*confunc = dtls_construct_hello_verify_request;
1041	*mt = DTLS1_MT_HELLO_VERIFY_REQUEST;
1042	break;
1043
1044	case TLS_ST_SW_HELLO_REQ:
1045	/* No construction function needed */
1046	*confunc = NULL;
1047	*mt = SSL3_MT_HELLO_REQUEST;
1048	break;
1049
1050	case TLS_ST_SW_SRVR_HELLO:
1051	*confunc = tls_construct_server_hello;
1052	*mt = SSL3_MT_SERVER_HELLO;
1053	break;
1054
1055	case TLS_ST_SW_CERT:
1056	*confunc = tls_construct_server_certificate;
1057	*mt = SSL3_MT_CERTIFICATE;
1058	break;
1059
1060	case TLS_ST_SW_CERT_VRFY:
1061	*confunc = tls_construct_cert_verify;
1062	*mt = SSL3_MT_CERTIFICATE_VERIFY;
1063	break;
1064
1065
1066	case TLS_ST_SW_KEY_EXCH:
1067	*confunc = tls_construct_server_key_exchange;
1068	*mt = SSL3_MT_SERVER_KEY_EXCHANGE;
1069	break;
1070
1071	case TLS_ST_SW_CERT_REQ:
1072	*confunc = tls_construct_certificate_request;
1073	*mt = SSL3_MT_CERTIFICATE_REQUEST;
1074	break;
1075
1076	case TLS_ST_SW_SRVR_DONE:
1077	*confunc = tls_construct_server_done;
1078	*mt = SSL3_MT_SERVER_DONE;
1079	break;
1080
1081	case TLS_ST_SW_SESSION_TICKET:
1082	*confunc = tls_construct_new_session_ticket;
1083	*mt = SSL3_MT_NEWSESSION_TICKET;
1084	break;
1085
1086	case TLS_ST_SW_CERT_STATUS:
1087	*confunc = tls_construct_cert_status;
1088	*mt = SSL3_MT_CERTIFICATE_STATUS;
1089	break;
1090
1091	case TLS_ST_SW_FINISHED:
1092	*confunc = tls_construct_finished;
1093	*mt = SSL3_MT_FINISHED;
1094	break;
1095
1096	case TLS_ST_EARLY_DATA:
1097	*confunc = NULL;
1098	*mt = SSL3_MT_DUMMY;
1099	break;
1100
1101	case TLS_ST_SW_ENCRYPTED_EXTENSIONS:
1102	*confunc = tls_construct_encrypted_extensions;
1103	*mt = SSL3_MT_ENCRYPTED_EXTENSIONS;
1104	break;
1105
1106	case TLS_ST_SW_KEY_UPDATE:
1107	*confunc = tls_construct_key_update;
1108	*mt = SSL3_MT_KEY_UPDATE;
1109	break;
1110	}
1111
1112	return 1;
1113	}
1114
1115	/*
1116	* Maximum size (excluding the Handshake header) of a ClientHello message,
1117	* calculated as follows:
1118	*
1119	* 2 + # client_version
1120	* 32 + # only valid length for random
1121	* 1 + # length of session_id
1122	* 32 + # maximum size for session_id
1123	* 2 + # length of cipher suites
1124	* 2^16-2 + # maximum length of cipher suites array
1125	* 1 + # length of compression_methods
1126	* 2^8-1 + # maximum length of compression methods
1127	* 2 + # length of extensions
1128	* 2^16-1 # maximum length of extensions
1129	*/
1130	#define CLIENT_HELLO_MAX_LENGTH 131396
1131
1132	#define CLIENT_KEY_EXCH_MAX_LENGTH 2048
1133	#define NEXT_PROTO_MAX_LENGTH 514
1134
1135	/*
1136	* Returns the maximum allowed length for the current message that we are
1137	* reading. Excludes the message header.
1138	*/
1139	size_t ossl_statem_server_max_message_size(SSL *s)
1140	{
1141	OSSL_STATEM *st = &s->statem;
1142
1143	switch (st->hand_state) {
1144	default:
1145	/* Shouldn't happen */
1146	return 0;
1147
1148	case TLS_ST_SR_CLNT_HELLO:
1149	return CLIENT_HELLO_MAX_LENGTH;
1150
1151	case TLS_ST_SR_END_OF_EARLY_DATA:
1152	return END_OF_EARLY_DATA_MAX_LENGTH;
1153
1154	case TLS_ST_SR_CERT:
1155	return s->max_cert_list;
1156
1157	case TLS_ST_SR_KEY_EXCH:
1158	return CLIENT_KEY_EXCH_MAX_LENGTH;
1159
1160	case TLS_ST_SR_CERT_VRFY:
1161	return SSL3_RT_MAX_PLAIN_LENGTH;
1162
1163	#ifndef OPENSSL_NO_NEXTPROTONEG
1164	case TLS_ST_SR_NEXT_PROTO:
1165	return NEXT_PROTO_MAX_LENGTH;
1166	#endif
1167
1168	case TLS_ST_SR_CHANGE:
1169	return CCS_MAX_LENGTH;
1170
1171	case TLS_ST_SR_FINISHED:
1172	return FINISHED_MAX_LENGTH;
1173
1174	case TLS_ST_SR_KEY_UPDATE:
1175	return KEY_UPDATE_MAX_LENGTH;
1176	}
1177	}
1178
1179	/*
1180	* Process a message that the server has received from the client.
1181	*/
1182	MSG_PROCESS_RETURN ossl_statem_server_process_message(SSL s, PACKET pkt)
1183	{
1184	OSSL_STATEM *st = &s->statem;
1185
1186	switch (st->hand_state) {
1187	default:
1188	/* Shouldn't happen */
1189	SSLfatal(s, SSL_AD_INTERNAL_ERROR,
1190	SSL_F_OSSL_STATEM_SERVER_PROCESS_MESSAGE,
1191	ERR_R_INTERNAL_ERROR);
1192	return MSG_PROCESS_ERROR;
1193
1194	case TLS_ST_SR_CLNT_HELLO:
1195	return tls_process_client_hello(s, pkt);
1196
1197	case TLS_ST_SR_END_OF_EARLY_DATA:
1198	return tls_process_end_of_early_data(s, pkt);
1199
1200	case TLS_ST_SR_CERT:
1201	return tls_process_client_certificate(s, pkt);
1202
1203	case TLS_ST_SR_KEY_EXCH:
1204	return tls_process_client_key_exchange(s, pkt);
1205
1206	case TLS_ST_SR_CERT_VRFY:
1207	return tls_process_cert_verify(s, pkt);
1208
1209	#ifndef OPENSSL_NO_NEXTPROTONEG
1210	case TLS_ST_SR_NEXT_PROTO:
1211	return tls_process_next_proto(s, pkt);
1212	#endif
1213
1214	case TLS_ST_SR_CHANGE:
1215	return tls_process_change_cipher_spec(s, pkt);
1216
1217	case TLS_ST_SR_FINISHED:
1218	return tls_process_finished(s, pkt);
1219
1220	case TLS_ST_SR_KEY_UPDATE:
1221	return tls_process_key_update(s, pkt);
1222
1223	}
1224	}
1225
1226	/*
1227	* Perform any further processing required following the receipt of a message
1228	* from the client
1229	*/
1230	WORK_STATE ossl_statem_server_post_process_message(SSL *s, WORK_STATE wst)
1231	{
1232	OSSL_STATEM *st = &s->statem;
1233
1234	switch (st->hand_state) {
1235	default:
1236	/* Shouldn't happen */
1237	SSLfatal(s, SSL_AD_INTERNAL_ERROR,
1238	SSL_F_OSSL_STATEM_SERVER_POST_PROCESS_MESSAGE,
1239	ERR_R_INTERNAL_ERROR);
1240	return WORK_ERROR;
1241
1242	case TLS_ST_SR_CLNT_HELLO:
1243	return tls_post_process_client_hello(s, wst);
1244
1245	case TLS_ST_SR_KEY_EXCH:
1246	return tls_post_process_client_key_exchange(s, wst);
1247	}
1248	}
1249
1250	#ifndef OPENSSL_NO_SRP
1251	/* Returns 1 on success, 0 for retryable error, -1 for fatal error */
1252	static int ssl_check_srp_ext_ClientHello(SSL *s)
1253	{
1254	int ret;
1255	int al = SSL_AD_UNRECOGNIZED_NAME;
1256
1257	if ((s->s3->tmp.new_cipher->algorithm_mkey & SSL_kSRP) &&
1258	(s->srp_ctx.TLS_ext_srp_username_callback != NULL)) {
1259	if (s->srp_ctx.login == NULL) {
1260	/*
1261	* RFC 5054 says SHOULD reject, we do so if There is no srp
1262	* login name
1263	*/
1264	SSLfatal(s, SSL_AD_UNKNOWN_PSK_IDENTITY,
1265	SSL_F_SSL_CHECK_SRP_EXT_CLIENTHELLO,
1266	SSL_R_PSK_IDENTITY_NOT_FOUND);
1267	return -1;
1268	} else {
1269	ret = SSL_srp_server_param_with_username(s, &al);
1270	if (ret < 0)
1271	return 0;
1272	if (ret == SSL3_AL_FATAL) {
1273	SSLfatal(s, al, SSL_F_SSL_CHECK_SRP_EXT_CLIENTHELLO,
1274	al == SSL_AD_UNKNOWN_PSK_IDENTITY
1275	? SSL_R_PSK_IDENTITY_NOT_FOUND
1276	: SSL_R_CLIENTHELLO_TLSEXT);
1277	return -1;
1278	}
1279	}
1280	}
1281	return 1;
1282	}
1283	#endif
1284
1285	int dtls_raw_hello_verify_request(WPACKET pkt, unsigned char cookie,
1286	size_t cookie_len)
1287	{
1288	/* Always use DTLS 1.0 version: see RFC 6347 */
1289	if (!WPACKET_put_bytes_u16(pkt, DTLS1_VERSION)
1290	\|\| !WPACKET_sub_memcpy_u8(pkt, cookie, cookie_len))
1291	return 0;
1292
1293	return 1;
1294	}
1295
1296	int dtls_construct_hello_verify_request(SSL s, WPACKET pkt)
1297	{
1298	unsigned int cookie_leni;
1299	if (s->ctx->app_gen_cookie_cb == NULL \|\|
1300	s->ctx->app_gen_cookie_cb(s, s->d1->cookie,
1301	&cookie_leni) == 0 \|\|
1302	cookie_leni > 255) {
1303	SSLfatal(s, SSL_AD_NO_ALERT, SSL_F_DTLS_CONSTRUCT_HELLO_VERIFY_REQUEST,
1304	SSL_R_COOKIE_GEN_CALLBACK_FAILURE);
1305	return 0;
1306	}
1307	s->d1->cookie_len = cookie_leni;
1308
1309	if (!dtls_raw_hello_verify_request(pkt, s->d1->cookie,
1310	s->d1->cookie_len)) {
1311	SSLfatal(s, SSL_AD_NO_ALERT, SSL_F_DTLS_CONSTRUCT_HELLO_VERIFY_REQUEST,
1312	ERR_R_INTERNAL_ERROR);
1313	return 0;
1314	}
1315
1316	return 1;
1317	}
1318
1319	#ifndef OPENSSL_NO_EC
1320	/*-
1321	* ssl_check_for_safari attempts to fingerprint Safari using OS X
1322	* SecureTransport using the TLS extension block in \|hello\|.
1323	* Safari, since 10.6, sends exactly these extensions, in this order:
1324	* SNI,
1325	* elliptic_curves
1326	* ec_point_formats
1327	* signature_algorithms (for TLSv1.2 only)
1328	*
1329	* We wish to fingerprint Safari because they broke ECDHE-ECDSA support in 10.8,
1330	* but they advertise support. So enabling ECDHE-ECDSA ciphers breaks them.
1331	* Sadly we cannot differentiate 10.6, 10.7 and 10.8.4 (which work), from
1332	* 10.8..10.8.3 (which don't work).
1333	*/
1334	static void ssl_check_for_safari(SSL s, const CLIENTHELLO_MSG hello)
1335	{
1336	static const unsigned char kSafariExtensionsBlock[] = {
1337	0x00, 0x0a, /* elliptic_curves extension */
1338	0x00, 0x08, /* 8 bytes */
1339	0x00, 0x06, /* 6 bytes of curve ids */
1340	0x00, 0x17, /* P-256 */
1341	0x00, 0x18, /* P-384 */
1342	0x00, 0x19, /* P-521 */
1343
1344	0x00, 0x0b, /* ec_point_formats */
1345	0x00, 0x02, /* 2 bytes */
1346	0x01, /* 1 point format */
1347	0x00, /* uncompressed */
1348	/* The following is only present in TLS 1.2 */
1349	0x00, 0x0d, /* signature_algorithms */
1350	0x00, 0x0c, /* 12 bytes */
1351	0x00, 0x0a, /* 10 bytes */
1352	0x05, 0x01, /* SHA-384/RSA */
1353	0x04, 0x01, /* SHA-256/RSA */
1354	0x02, 0x01, /* SHA-1/RSA */
1355	0x04, 0x03, /* SHA-256/ECDSA */
1356	0x02, 0x03, /* SHA-1/ECDSA */
1357	};
1358	/* Length of the common prefix (first two extensions). */
1359	static const size_t kSafariCommonExtensionsLength = 18;
1360	unsigned int type;
1361	PACKET sni, tmppkt;
1362	size_t ext_len;
1363
1364	tmppkt = hello->extensions;
1365
1366	if (!PACKET_forward(&tmppkt, 2)
1367	\|\| !PACKET_get_net_2(&tmppkt, &type)
1368	\|\| !PACKET_get_length_prefixed_2(&tmppkt, &sni)) {
1369	return;
1370	}
1371
1372	if (type != TLSEXT_TYPE_server_name)
1373	return;
1374
1375	ext_len = TLS1_get_client_version(s) >= TLS1_2_VERSION ?
1376	sizeof(kSafariExtensionsBlock) : kSafariCommonExtensionsLength;
1377
1378	s->s3->is_probably_safari = PACKET_equal(&tmppkt, kSafariExtensionsBlock,
1379	ext_len);
1380	}
1381	#endif /* !OPENSSL_NO_EC */
1382
1383	MSG_PROCESS_RETURN tls_process_client_hello(SSL s, PACKET pkt)
1384	{
1385	/* \|cookie\| will only be initialized for DTLS. */
1386	PACKET session_id, compression, extensions, cookie;
1387	static const unsigned char null_compression = 0;
1388	CLIENTHELLO_MSG *clienthello = NULL;
1389
1390	/* Check if this is actually an unexpected renegotiation ClientHello */
1391	if (s->renegotiate == 0 && !SSL_IS_FIRST_HANDSHAKE(s)) {
1392	if (!ossl_assert(!SSL_IS_TLS13(s))) {
1393	SSLfatal(s, SSL_AD_INTERNAL_ERROR, SSL_F_TLS_PROCESS_CLIENT_HELLO,
1394	ERR_R_INTERNAL_ERROR);
1395	goto err;
1396	}
1397	if ((s->options & SSL_OP_NO_RENEGOTIATION) != 0
1398	\|\| (!s->s3->send_connection_binding
1399	&& (s->options
1400	& SSL_OP_ALLOW_UNSAFE_LEGACY_RENEGOTIATION) == 0)) {
1401	ssl3_send_alert(s, SSL3_AL_WARNING, SSL_AD_NO_RENEGOTIATION);
1402	return MSG_PROCESS_FINISHED_READING;
1403	}
1404	s->renegotiate = 1;
1405	s->new_session = 1;
1406	}
1407
1408	clienthello = OPENSSL_zalloc(sizeof(*clienthello));
1409	if (clienthello == NULL) {
1410	SSLfatal(s, SSL_AD_INTERNAL_ERROR, SSL_F_TLS_PROCESS_CLIENT_HELLO,
1411	ERR_R_INTERNAL_ERROR);
1412	goto err;
1413	}
1414
1415	/*
1416	* First, parse the raw ClientHello data into the CLIENTHELLO_MSG structure.
1417	*/
1418	clienthello->isv2 = RECORD_LAYER_is_sslv2_record(&s->rlayer);
1419	PACKET_null_init(&cookie);
1420
1421	if (clienthello->isv2) {
1422	unsigned int mt;
1423
1424	if (!SSL_IS_FIRST_HANDSHAKE(s)
1425	\|\| s->hello_retry_request != SSL_HRR_NONE) {
1426	SSLfatal(s, SSL_AD_UNEXPECTED_MESSAGE,
1427	SSL_F_TLS_PROCESS_CLIENT_HELLO, SSL_R_UNEXPECTED_MESSAGE);
1428	goto err;
1429	}
1430
1431	/*-
1432	* An SSLv3/TLSv1 backwards-compatible CLIENT-HELLO in an SSLv2
1433	* header is sent directly on the wire, not wrapped as a TLS
1434	* record. Our record layer just processes the message length and passes
1435	* the rest right through. Its format is:
1436	* Byte Content
1437	* 0-1 msg_length - decoded by the record layer
1438	* 2 msg_type - s->init_msg points here
1439	* 3-4 version
1440	* 5-6 cipher_spec_length
1441	* 7-8 session_id_length
1442	* 9-10 challenge_length
1443	* ... ...
1444	*/
1445
1446	if (!PACKET_get_1(pkt, &mt)
1447	\|\| mt != SSL2_MT_CLIENT_HELLO) {
1448	/*
1449	* Should never happen. We should have tested this in the record
1450	* layer in order to have determined that this is a SSLv2 record
1451	* in the first place
1452	*/
1453	SSLfatal(s, SSL_AD_INTERNAL_ERROR, SSL_F_TLS_PROCESS_CLIENT_HELLO,
1454	ERR_R_INTERNAL_ERROR);
1455	goto err;
1456	}
1457	}
1458
1459	if (!PACKET_get_net_2(pkt, &clienthello->legacy_version)) {
1460	SSLfatal(s, SSL_AD_DECODE_ERROR, SSL_F_TLS_PROCESS_CLIENT_HELLO,
1461	SSL_R_LENGTH_TOO_SHORT);
1462	goto err;
1463	}
1464
1465	/* Parse the message and load client random. */
1466	if (clienthello->isv2) {
1467	/*
1468	* Handle an SSLv2 backwards compatible ClientHello
1469	* Note, this is only for SSLv3+ using the backward compatible format.
1470	* Real SSLv2 is not supported, and is rejected below.
1471	*/
1472	unsigned int ciphersuite_len, session_id_len, challenge_len;
1473	PACKET challenge;
1474
1475	if (!PACKET_get_net_2(pkt, &ciphersuite_len)
1476	\|\| !PACKET_get_net_2(pkt, &session_id_len)
1477	\|\| !PACKET_get_net_2(pkt, &challenge_len)) {
1478	SSLfatal(s, SSL_AD_DECODE_ERROR, SSL_F_TLS_PROCESS_CLIENT_HELLO,
1479	SSL_R_RECORD_LENGTH_MISMATCH);
1480	goto err;
1481	}
1482
1483	if (session_id_len > SSL_MAX_SSL_SESSION_ID_LENGTH) {
1484	SSLfatal(s, SSL_AD_ILLEGAL_PARAMETER,
1485	SSL_F_TLS_PROCESS_CLIENT_HELLO, SSL_R_LENGTH_MISMATCH);
1486	goto err;
1487	}
1488
1489	if (!PACKET_get_sub_packet(pkt, &clienthello->ciphersuites,
1490	ciphersuite_len)
1491	\|\| !PACKET_copy_bytes(pkt, clienthello->session_id, session_id_len)
1492	\|\| !PACKET_get_sub_packet(pkt, &challenge, challenge_len)
1493	/* No extensions. */
1494	\|\| PACKET_remaining(pkt) != 0) {
1495	SSLfatal(s, SSL_AD_DECODE_ERROR, SSL_F_TLS_PROCESS_CLIENT_HELLO,
1496	SSL_R_RECORD_LENGTH_MISMATCH);
1497	goto err;
1498	}
1499	clienthello->session_id_len = session_id_len;
1500
1501	/* Load the client random and compression list. We use SSL3_RANDOM_SIZE
1502	* here rather than sizeof(clienthello->random) because that is the limit
1503	* for SSLv3 and it is fixed. It won't change even if
1504	* sizeof(clienthello->random) does.
1505	*/
1506	challenge_len = challenge_len > SSL3_RANDOM_SIZE
1507	? SSL3_RANDOM_SIZE : challenge_len;
1508	memset(clienthello->random, 0, SSL3_RANDOM_SIZE);
1509	if (!PACKET_copy_bytes(&challenge,
1510	clienthello->random + SSL3_RANDOM_SIZE -
1511	challenge_len, challenge_len)
1512	/* Advertise only null compression. */
1513	\|\| !PACKET_buf_init(&compression, &null_compression, 1)) {
1514	SSLfatal(s, SSL_AD_INTERNAL_ERROR, SSL_F_TLS_PROCESS_CLIENT_HELLO,
1515	ERR_R_INTERNAL_ERROR);
1516	goto err;
1517	}
1518
1519	PACKET_null_init(&clienthello->extensions);
1520	} else {
1521	/* Regular ClientHello. */
1522	if (!PACKET_copy_bytes(pkt, clienthello->random, SSL3_RANDOM_SIZE)
1523	\|\| !PACKET_get_length_prefixed_1(pkt, &session_id)
1524	\|\| !PACKET_copy_all(&session_id, clienthello->session_id,
1525	SSL_MAX_SSL_SESSION_ID_LENGTH,
1526	&clienthello->session_id_len)) {
1527	SSLfatal(s, SSL_AD_DECODE_ERROR, SSL_F_TLS_PROCESS_CLIENT_HELLO,
1528	SSL_R_LENGTH_MISMATCH);
1529	goto err;
1530	}
1531
1532	if (SSL_IS_DTLS(s)) {
1533	if (!PACKET_get_length_prefixed_1(pkt, &cookie)) {
1534	SSLfatal(s, SSL_AD_DECODE_ERROR, SSL_F_TLS_PROCESS_CLIENT_HELLO,
1535	SSL_R_LENGTH_MISMATCH);
1536	goto err;
1537	}
1538	if (!PACKET_copy_all(&cookie, clienthello->dtls_cookie,
1539	DTLS1_COOKIE_LENGTH,
1540	&clienthello->dtls_cookie_len)) {
1541	SSLfatal(s, SSL_AD_INTERNAL_ERROR,
1542	SSL_F_TLS_PROCESS_CLIENT_HELLO, ERR_R_INTERNAL_ERROR);
1543	goto err;
1544	}
1545	/*
1546	* If we require cookies and this ClientHello doesn't contain one,
1547	* just return since we do not want to allocate any memory yet.
1548	* So check cookie length...
1549	*/
1550	if (SSL_get_options(s) & SSL_OP_COOKIE_EXCHANGE) {
1551	if (clienthello->dtls_cookie_len == 0) {
1552	OPENSSL_free(clienthello);
1553	return MSG_PROCESS_FINISHED_READING;
1554	}
1555	}
1556	}
1557
1558	if (!PACKET_get_length_prefixed_2(pkt, &clienthello->ciphersuites)) {
1559	SSLfatal(s, SSL_AD_DECODE_ERROR, SSL_F_TLS_PROCESS_CLIENT_HELLO,
1560	SSL_R_LENGTH_MISMATCH);
1561	goto err;
1562	}
1563
1564	if (!PACKET_get_length_prefixed_1(pkt, &compression)) {
1565	SSLfatal(s, SSL_AD_DECODE_ERROR, SSL_F_TLS_PROCESS_CLIENT_HELLO,
1566	SSL_R_LENGTH_MISMATCH);
1567	goto err;
1568	}
1569
1570	/* Could be empty. */
1571	if (PACKET_remaining(pkt) == 0) {
1572	PACKET_null_init(&clienthello->extensions);
1573	} else {
1574	if (!PACKET_get_length_prefixed_2(pkt, &clienthello->extensions)
1575	\|\| PACKET_remaining(pkt) != 0) {
1576	SSLfatal(s, SSL_AD_DECODE_ERROR, SSL_F_TLS_PROCESS_CLIENT_HELLO,
1577	SSL_R_LENGTH_MISMATCH);
1578	goto err;
1579	}
1580	}
1581	}
1582
1583	if (!PACKET_copy_all(&compression, clienthello->compressions,
1584	MAX_COMPRESSIONS_SIZE,
1585	&clienthello->compressions_len)) {
1586	SSLfatal(s, SSL_AD_INTERNAL_ERROR, SSL_F_TLS_PROCESS_CLIENT_HELLO,
1587	ERR_R_INTERNAL_ERROR);
1588	goto err;
1589	}
1590
1591	/* Preserve the raw extensions PACKET for later use */
1592	extensions = clienthello->extensions;
1593	if (!tls_collect_extensions(s, &extensions, SSL_EXT_CLIENT_HELLO,
1594	&clienthello->pre_proc_exts,
1595	&clienthello->pre_proc_exts_len, 1)) {
1596	/* SSLfatal already been called */
1597	goto err;
1598	}
1599	s->clienthello = clienthello;
1600
1601	return MSG_PROCESS_CONTINUE_PROCESSING;
1602
1603	err:
1604	if (clienthello != NULL)
1605	OPENSSL_free(clienthello->pre_proc_exts);
1606	OPENSSL_free(clienthello);
1607
1608	return MSG_PROCESS_ERROR;
1609	}
1610
1611	static int tls_early_post_process_client_hello(SSL *s)
1612	{
1613	unsigned int j;
1614	int i, al = SSL_AD_INTERNAL_ERROR;
1615	int protverr;
1616	size_t loop;
1617	unsigned long id;
1618	#ifndef OPENSSL_NO_COMP
1619	SSL_COMP *comp = NULL;
1620	#endif
1621	const SSL_CIPHER *c;
1622	STACK_OF(SSL_CIPHER) *ciphers = NULL;
1623	STACK_OF(SSL_CIPHER) *scsvs = NULL;
1624	CLIENTHELLO_MSG *clienthello = s->clienthello;
1625	DOWNGRADE dgrd = DOWNGRADE_NONE;
1626
1627	/* Finished parsing the ClientHello, now we can start processing it */
1628	/* Give the ClientHello callback a crack at things */
1629	if (s->ctx->client_hello_cb != NULL) {
1630	/* A failure in the ClientHello callback terminates the connection. */
1631	switch (s->ctx->client_hello_cb(s, &al, s->ctx->client_hello_cb_arg)) {
1632	case SSL_CLIENT_HELLO_SUCCESS:
1633	break;
1634	case SSL_CLIENT_HELLO_RETRY:
1635	s->rwstate = SSL_CLIENT_HELLO_CB;
1636	return -1;
1637	case SSL_CLIENT_HELLO_ERROR:
1638	default:
1639	SSLfatal(s, al,
1640	SSL_F_TLS_EARLY_POST_PROCESS_CLIENT_HELLO,
1641	SSL_R_CALLBACK_FAILED);
1642	goto err;
1643	}
1644	}
1645
1646	/* Set up the client_random */
1647	memcpy(s->s3->client_random, clienthello->random, SSL3_RANDOM_SIZE);
1648
1649	/* Choose the version */
1650
1651	if (clienthello->isv2) {
1652	if (clienthello->legacy_version == SSL2_VERSION
1653	\|\| (clienthello->legacy_version & 0xff00)
1654	!= (SSL3_VERSION_MAJOR << 8)) {
1655	/*
1656	* This is real SSLv2 or something completely unknown. We don't
1657	* support it.
1658	*/
1659	SSLfatal(s, SSL_AD_PROTOCOL_VERSION,
1660	SSL_F_TLS_EARLY_POST_PROCESS_CLIENT_HELLO,
1661	SSL_R_UNKNOWN_PROTOCOL);
1662	goto err;
1663	}
1664	/* SSLv3/TLS */
1665	s->client_version = clienthello->legacy_version;
1666	}
1667	/*
1668	* Do SSL/TLS version negotiation if applicable. For DTLS we just check
1669	* versions are potentially compatible. Version negotiation comes later.
1670	*/
1671	if (!SSL_IS_DTLS(s)) {
1672	protverr = ssl_choose_server_version(s, clienthello, &dgrd);
1673	} else if (s->method->version != DTLS_ANY_VERSION &&
1674	DTLS_VERSION_LT((int)clienthello->legacy_version, s->version)) {
1675	protverr = SSL_R_VERSION_TOO_LOW;
1676	} else {
1677	protverr = 0;
1678	}
1679
1680	if (protverr) {
1681	if (SSL_IS_FIRST_HANDSHAKE(s)) {
1682	/* like ssl3_get_record, send alert using remote version number */
1683	s->version = s->client_version = clienthello->legacy_version;
1684	}
1685	SSLfatal(s, SSL_AD_PROTOCOL_VERSION,
1686	SSL_F_TLS_EARLY_POST_PROCESS_CLIENT_HELLO, protverr);
1687	goto err;
1688	}
1689
1690	/* TLSv1.3 specifies that a ClientHello must end on a record boundary */
1691	if (SSL_IS_TLS13(s) && RECORD_LAYER_processed_read_pending(&s->rlayer)) {
1692	SSLfatal(s, SSL_AD_UNEXPECTED_MESSAGE,
1693	SSL_F_TLS_EARLY_POST_PROCESS_CLIENT_HELLO,
1694	SSL_R_NOT_ON_RECORD_BOUNDARY);
1695	goto err;
1696	}
1697
1698	if (SSL_IS_DTLS(s)) {
1699	/* Empty cookie was already handled above by returning early. */
1700	if (SSL_get_options(s) & SSL_OP_COOKIE_EXCHANGE) {
1701	if (s->ctx->app_verify_cookie_cb != NULL) {
1702	if (s->ctx->app_verify_cookie_cb(s, clienthello->dtls_cookie,
1703	clienthello->dtls_cookie_len) == 0) {
1704	SSLfatal(s, SSL_AD_HANDSHAKE_FAILURE,
1705	SSL_F_TLS_EARLY_POST_PROCESS_CLIENT_HELLO,
1706	SSL_R_COOKIE_MISMATCH);
1707	goto err;
1708	/* else cookie verification succeeded */
1709	}
1710	/* default verification */
1711	} else if (s->d1->cookie_len != clienthello->dtls_cookie_len
1712	\|\| memcmp(clienthello->dtls_cookie, s->d1->cookie,
1713	s->d1->cookie_len) != 0) {
1714	SSLfatal(s, SSL_AD_HANDSHAKE_FAILURE,
1715	SSL_F_TLS_EARLY_POST_PROCESS_CLIENT_HELLO,
1716	SSL_R_COOKIE_MISMATCH);
1717	goto err;
1718	}
1719	s->d1->cookie_verified = 1;
1720	}
1721	if (s->method->version == DTLS_ANY_VERSION) {
1722	protverr = ssl_choose_server_version(s, clienthello, &dgrd);
1723	if (protverr != 0) {
1724	s->version = s->client_version;
1725	SSLfatal(s, SSL_AD_PROTOCOL_VERSION,
1726	SSL_F_TLS_EARLY_POST_PROCESS_CLIENT_HELLO, protverr);
1727	goto err;
1728	}
1729	}
1730	}
1731
1732	s->hit = 0;
1733
1734	if (!ssl_cache_cipherlist(s, &clienthello->ciphersuites,
1735	clienthello->isv2) \|\|
1736	!bytes_to_cipher_list(s, &clienthello->ciphersuites, &ciphers, &scsvs,
1737	clienthello->isv2, 1)) {
1738	/* SSLfatal() already called */
1739	goto err;
1740	}
1741
1742	s->s3->send_connection_binding = 0;
1743	/* Check what signalling cipher-suite values were received. */
1744	if (scsvs != NULL) {
1745	for(i = 0; i < sk_SSL_CIPHER_num(scsvs); i++) {
1746	c = sk_SSL_CIPHER_value(scsvs, i);
1747	if (SSL_CIPHER_get_id(c) == SSL3_CK_SCSV) {
1748	if (s->renegotiate) {
1749	/* SCSV is fatal if renegotiating */
1750	SSLfatal(s, SSL_AD_HANDSHAKE_FAILURE,
1751	SSL_F_TLS_EARLY_POST_PROCESS_CLIENT_HELLO,
1752	SSL_R_SCSV_RECEIVED_WHEN_RENEGOTIATING);
1753	goto err;
1754	}
1755	s->s3->send_connection_binding = 1;
1756	} else if (SSL_CIPHER_get_id(c) == SSL3_CK_FALLBACK_SCSV &&
1757	!ssl_check_version_downgrade(s)) {
1758	/*
1759	* This SCSV indicates that the client previously tried
1760	* a higher version. We should fail if the current version
1761	* is an unexpected downgrade, as that indicates that the first
1762	* connection may have been tampered with in order to trigger
1763	* an insecure downgrade.
1764	*/
1765	SSLfatal(s, SSL_AD_INAPPROPRIATE_FALLBACK,
1766	SSL_F_TLS_EARLY_POST_PROCESS_CLIENT_HELLO,
1767	SSL_R_INAPPROPRIATE_FALLBACK);
1768	goto err;
1769	}
1770	}
1771	}
1772
1773	/* For TLSv1.3 we must select the ciphersuite before session resumption */
1774	if (SSL_IS_TLS13(s)) {
1775	const SSL_CIPHER *cipher =
1776	ssl3_choose_cipher(s, ciphers, SSL_get_ciphers(s));
1777
1778	if (cipher == NULL) {
1779	SSLfatal(s, SSL_AD_HANDSHAKE_FAILURE,
1780	SSL_F_TLS_EARLY_POST_PROCESS_CLIENT_HELLO,
1781	SSL_R_NO_SHARED_CIPHER);
1782	goto err;
1783	}
1784	if (s->hello_retry_request == SSL_HRR_PENDING
1785	&& (s->s3->tmp.new_cipher == NULL
1786	\|\| s->s3->tmp.new_cipher->id != cipher->id)) {
1787	/*
1788	* A previous HRR picked a different ciphersuite to the one we
1789	* just selected. Something must have changed.
1790	*/
1791	SSLfatal(s, SSL_AD_ILLEGAL_PARAMETER,
1792	SSL_F_TLS_EARLY_POST_PROCESS_CLIENT_HELLO,
1793	SSL_R_BAD_CIPHER);
1794	goto err;
1795	}
1796	s->s3->tmp.new_cipher = cipher;
1797	}
1798
1799	/* We need to do this before getting the session */
1800	if (!tls_parse_extension(s, TLSEXT_IDX_extended_master_secret,
1801	SSL_EXT_CLIENT_HELLO,
1802	clienthello->pre_proc_exts, NULL, 0)) {
1803	/* SSLfatal() already called */
1804	goto err;
1805	}
1806
1807	/*
1808	* We don't allow resumption in a backwards compatible ClientHello.
1809	* TODO(openssl-team): in TLS1.1+, session_id MUST be empty.
1810	*
1811	* Versions before 0.9.7 always allow clients to resume sessions in
1812	* renegotiation. 0.9.7 and later allow this by default, but optionally
1813	* ignore resumption requests with flag
1814	* SSL_OP_NO_SESSION_RESUMPTION_ON_RENEGOTIATION (it's a new flag rather
1815	* than a change to default behavior so that applications relying on
1816	* this for security won't even compile against older library versions).
1817	* 1.0.1 and later also have a function SSL_renegotiate_abbreviated() to
1818	* request renegotiation but not a new session (s->new_session remains
1819	* unset): for servers, this essentially just means that the
1820	* SSL_OP_NO_SESSION_RESUMPTION_ON_RENEGOTIATION setting will be
1821	* ignored.
1822	*/
1823	if (clienthello->isv2 \|\|
1824	(s->new_session &&
1825	(s->options & SSL_OP_NO_SESSION_RESUMPTION_ON_RENEGOTIATION))) {
1826	if (!ssl_get_new_session(s, 1)) {
1827	/* SSLfatal() already called */
1828	goto err;
1829	}
1830	} else {
1831	i = ssl_get_prev_session(s, clienthello);
1832	if (i == 1) {
1833	/* previous session */
1834	s->hit = 1;
1835	} else if (i == -1) {
1836	/* SSLfatal() already called */
1837	goto err;
1838	} else {
1839	/* i == 0 */
1840	if (!ssl_get_new_session(s, 1)) {
1841	/* SSLfatal() already called */
1842	goto err;
1843	}
1844	}
1845	}
1846
1847	if (SSL_IS_TLS13(s)) {
1848	memcpy(s->tmp_session_id, s->clienthello->session_id,
1849	s->clienthello->session_id_len);
1850	s->tmp_session_id_len = s->clienthello->session_id_len;
1851	}
1852
1853	/*
1854	* If it is a hit, check that the cipher is in the list. In TLSv1.3 we check
1855	* ciphersuite compatibility with the session as part of resumption.
1856	*/
1857	if (!SSL_IS_TLS13(s) && s->hit) {
1858	j = 0;
1859	id = s->session->cipher->id;
1860
1861	#ifdef CIPHER_DEBUG
1862	fprintf(stderr, "client sent %d ciphers\n", sk_SSL_CIPHER_num(ciphers));
1863	#endif
1864	for (i = 0; i < sk_SSL_CIPHER_num(ciphers); i++) {
1865	c = sk_SSL_CIPHER_value(ciphers, i);
1866	#ifdef CIPHER_DEBUG
1867	fprintf(stderr, "client [%2d of %2d]:%s\n",
1868	i, sk_SSL_CIPHER_num(ciphers), SSL_CIPHER_get_name(c));
1869	#endif
1870	if (c->id == id) {
1871	j = 1;
1872	break;
1873	}
1874	}
1875	if (j == 0) {
1876	/*
1877	* we need to have the cipher in the cipher list if we are asked
1878	* to reuse it
1879	*/
1880	SSLfatal(s, SSL_AD_ILLEGAL_PARAMETER,
1881	SSL_F_TLS_EARLY_POST_PROCESS_CLIENT_HELLO,
1882	SSL_R_REQUIRED_CIPHER_MISSING);
1883	goto err;
1884	}
1885	}
1886
1887	for (loop = 0; loop < clienthello->compressions_len; loop++) {
1888	if (clienthello->compressions[loop] == 0)
1889	break;
1890	}
1891
1892	if (loop >= clienthello->compressions_len) {
1893	/* no compress */
1894	SSLfatal(s, SSL_AD_DECODE_ERROR,
1895	SSL_F_TLS_EARLY_POST_PROCESS_CLIENT_HELLO,
1896	SSL_R_NO_COMPRESSION_SPECIFIED);
1897	goto err;
1898	}
1899
1900	#ifndef OPENSSL_NO_EC
1901	if (s->options & SSL_OP_SAFARI_ECDHE_ECDSA_BUG)
1902	ssl_check_for_safari(s, clienthello);
1903	#endif /* !OPENSSL_NO_EC */
1904
1905	/* TLS extensions */
1906	if (!tls_parse_all_extensions(s, SSL_EXT_CLIENT_HELLO,
1907	clienthello->pre_proc_exts, NULL, 0, 1)) {
1908	/* SSLfatal() already called */
1909	goto err;
1910	}
1911
1912	/*
1913	* Check if we want to use external pre-shared secret for this handshake
1914	* for not reused session only. We need to generate server_random before
1915	* calling tls_session_secret_cb in order to allow SessionTicket
1916	* processing to use it in key derivation.
1917	*/
1918	{
1919	unsigned char *pos;
1920	pos = s->s3->server_random;
1921	if (ssl_fill_hello_random(s, 1, pos, SSL3_RANDOM_SIZE, dgrd) <= 0) {
1922	SSLfatal(s, SSL_AD_INTERNAL_ERROR,
1923	SSL_F_TLS_EARLY_POST_PROCESS_CLIENT_HELLO,
1924	ERR_R_INTERNAL_ERROR);
1925	goto err;
1926	}
1927	}
1928
1929	if (!s->hit
1930	&& s->version >= TLS1_VERSION
1931	&& !SSL_IS_TLS13(s)
1932	&& !SSL_IS_DTLS(s)
1933	&& s->ext.session_secret_cb) {
1934	const SSL_CIPHER *pref_cipher = NULL;
1935	/*
1936	* s->session->master_key_length is a size_t, but this is an int for
1937	* backwards compat reasons
1938	*/
1939	int master_key_length;
1940
1941	master_key_length = sizeof(s->session->master_key);
1942	if (s->ext.session_secret_cb(s, s->session->master_key,
1943	&master_key_length, ciphers,
1944	&pref_cipher,
1945	s->ext.session_secret_cb_arg)
1946	&& master_key_length > 0) {
1947	s->session->master_key_length = master_key_length;
1948	s->hit = 1;
1949	s->peer_ciphers = ciphers;
1950	s->session->verify_result = X509_V_OK;
1951
1952	ciphers = NULL;
1953
1954	/* check if some cipher was preferred by call back */
1955	if (pref_cipher == NULL)
1956	pref_cipher = ssl3_choose_cipher(s, s->peer_ciphers,
1957	SSL_get_ciphers(s));
1958	if (pref_cipher == NULL) {
1959	SSLfatal(s, SSL_AD_HANDSHAKE_FAILURE,
1960	SSL_F_TLS_EARLY_POST_PROCESS_CLIENT_HELLO,
1961	SSL_R_NO_SHARED_CIPHER);
1962	goto err;
1963	}
1964
1965	s->session->cipher = pref_cipher;
1966	sk_SSL_CIPHER_free(s->cipher_list);
1967	s->cipher_list = sk_SSL_CIPHER_dup(s->peer_ciphers);
1968	sk_SSL_CIPHER_free(s->cipher_list_by_id);
1969	s->cipher_list_by_id = sk_SSL_CIPHER_dup(s->peer_ciphers);
1970	}
1971	}
1972
1973	/*
1974	* Worst case, we will use the NULL compression, but if we have other
1975	* options, we will now look for them. We have complen-1 compression
1976	* algorithms from the client, starting at q.
1977	*/
1978	s->s3->tmp.new_compression = NULL;
1979	if (SSL_IS_TLS13(s)) {
1980	/*
1981	* We already checked above that the NULL compression method appears in
1982	* the list. Now we check there aren't any others (which is illegal in
1983	* a TLSv1.3 ClientHello.
1984	*/
1985	if (clienthello->compressions_len != 1) {
1986	SSLfatal(s, SSL_AD_ILLEGAL_PARAMETER,
1987	SSL_F_TLS_EARLY_POST_PROCESS_CLIENT_HELLO,
1988	SSL_R_INVALID_COMPRESSION_ALGORITHM);
1989	goto err;
1990	}
1991	}
1992	#ifndef OPENSSL_NO_COMP
1993	/* This only happens if we have a cache hit */
1994	else if (s->session->compress_meth != 0) {
1995	int m, comp_id = s->session->compress_meth;
1996	unsigned int k;
1997	/* Perform sanity checks on resumed compression algorithm */
1998	/* Can't disable compression */
1999	if (!ssl_allow_compression(s)) {
2000	SSLfatal(s, SSL_AD_HANDSHAKE_FAILURE,
2001	SSL_F_TLS_EARLY_POST_PROCESS_CLIENT_HELLO,
2002	SSL_R_INCONSISTENT_COMPRESSION);
2003	goto err;
2004	}
2005	/* Look for resumed compression method */
2006	for (m = 0; m < sk_SSL_COMP_num(s->ctx->comp_methods); m++) {
2007	comp = sk_SSL_COMP_value(s->ctx->comp_methods, m);
2008	if (comp_id == comp->id) {
2009	s->s3->tmp.new_compression = comp;
2010	break;
2011	}
2012	}
2013	if (s->s3->tmp.new_compression == NULL) {
2014	SSLfatal(s, SSL_AD_HANDSHAKE_FAILURE,
2015	SSL_F_TLS_EARLY_POST_PROCESS_CLIENT_HELLO,
2016	SSL_R_INVALID_COMPRESSION_ALGORITHM);
2017	goto err;
2018	}
2019	/* Look for resumed method in compression list */
2020	for (k = 0; k < clienthello->compressions_len; k++) {
2021	if (clienthello->compressions[k] == comp_id)
2022	break;
2023	}
2024	if (k >= clienthello->compressions_len) {
2025	SSLfatal(s, SSL_AD_ILLEGAL_PARAMETER,
2026	SSL_F_TLS_EARLY_POST_PROCESS_CLIENT_HELLO,
2027	SSL_R_REQUIRED_COMPRESSION_ALGORITHM_MISSING);
2028	goto err;
2029	}
2030	} else if (s->hit) {
2031	comp = NULL;
2032	} else if (ssl_allow_compression(s) && s->ctx->comp_methods) {
2033	/* See if we have a match */
2034	int m, nn, v, done = 0;
2035	unsigned int o;
2036
2037	nn = sk_SSL_COMP_num(s->ctx->comp_methods);
2038	for (m = 0; m < nn; m++) {
2039	comp = sk_SSL_COMP_value(s->ctx->comp_methods, m);
2040	v = comp->id;
2041	for (o = 0; o < clienthello->compressions_len; o++) {
2042	if (v == clienthello->compressions[o]) {
2043	done = 1;
2044	break;
2045	}
2046	}
2047	if (done)
2048	break;
2049	}
2050	if (done)
2051	s->s3->tmp.new_compression = comp;
2052	else
2053	comp = NULL;
2054	}
2055	#else
2056	/*
2057	* If compression is disabled we'd better not try to resume a session
2058	* using compression.
2059	*/
2060	if (s->session->compress_meth != 0) {
2061	SSLfatal(s, SSL_AD_HANDSHAKE_FAILURE,
2062	SSL_F_TLS_EARLY_POST_PROCESS_CLIENT_HELLO,
2063	SSL_R_INCONSISTENT_COMPRESSION);
2064	goto err;
2065	}
2066	#endif
2067
2068	/*
2069	* Given s->peer_ciphers and SSL_get_ciphers, we must pick a cipher
2070	*/
2071
2072	if (!s->hit \|\| SSL_IS_TLS13(s)) {
2073	sk_SSL_CIPHER_free(s->peer_ciphers);
2074	s->peer_ciphers = ciphers;
2075	if (ciphers == NULL) {
2076	SSLfatal(s, SSL_AD_INTERNAL_ERROR,
2077	SSL_F_TLS_EARLY_POST_PROCESS_CLIENT_HELLO,
2078	ERR_R_INTERNAL_ERROR);
2079	goto err;
2080	}
2081	ciphers = NULL;
2082	}
2083
2084	if (!s->hit) {
2085	#ifdef OPENSSL_NO_COMP
2086	s->session->compress_meth = 0;
2087	#else
2088	s->session->compress_meth = (comp == NULL) ? 0 : comp->id;
2089	#endif
2090	if (!tls1_set_server_sigalgs(s)) {
2091	/* SSLfatal() already called */
2092	goto err;
2093	}
2094	}
2095
2096	sk_SSL_CIPHER_free(ciphers);
2097	sk_SSL_CIPHER_free(scsvs);
2098	OPENSSL_free(clienthello->pre_proc_exts);
2099	OPENSSL_free(s->clienthello);
2100	s->clienthello = NULL;
2101	return 1;
2102	err:
2103	sk_SSL_CIPHER_free(ciphers);
2104	sk_SSL_CIPHER_free(scsvs);
2105	OPENSSL_free(clienthello->pre_proc_exts);
2106	OPENSSL_free(s->clienthello);
2107	s->clienthello = NULL;
2108
2109	return 0;
2110	}
2111
2112	/*
2113	* Call the status request callback if needed. Upon success, returns 1.
2114	* Upon failure, returns 0.
2115	*/
2116	static int tls_handle_status_request(SSL *s)
2117	{
2118	s->ext.status_expected = 0;
2119
2120	/*
2121	* If status request then ask callback what to do. Note: this must be
2122	* called after servername callbacks in case the certificate has changed,
2123	* and must be called after the cipher has been chosen because this may
2124	* influence which certificate is sent
2125	*/
2126	if (s->ext.status_type != TLSEXT_STATUSTYPE_nothing && s->ctx != NULL
2127	&& s->ctx->ext.status_cb != NULL) {
2128	int ret;
2129
2130	/* If no certificate can't return certificate status */
2131	if (s->s3->tmp.cert != NULL) {
2132	/*
2133	* Set current certificate to one we will use so SSL_get_certificate
2134	* et al can pick it up.
2135	*/
2136	s->cert->key = s->s3->tmp.cert;
2137	ret = s->ctx->ext.status_cb(s, s->ctx->ext.status_arg);
2138	switch (ret) {
2139	/* We don't want to send a status request response */
2140	case SSL_TLSEXT_ERR_NOACK:
2141	s->ext.status_expected = 0;
2142	break;
2143	/* status request response should be sent */
2144	case SSL_TLSEXT_ERR_OK:
2145	if (s->ext.ocsp.resp)
2146	s->ext.status_expected = 1;
2147	break;
2148	/* something bad happened */
2149	case SSL_TLSEXT_ERR_ALERT_FATAL:
2150	default:
2151	SSLfatal(s, SSL_AD_INTERNAL_ERROR,
2152	SSL_F_TLS_HANDLE_STATUS_REQUEST,
2153	SSL_R_CLIENTHELLO_TLSEXT);
2154	return 0;
2155	}
2156	}
2157	}
2158
2159	return 1;
2160	}
2161
2162	/*
2163	* Call the alpn_select callback if needed. Upon success, returns 1.
2164	* Upon failure, returns 0.
2165	*/
2166	int tls_handle_alpn(SSL *s)
2167	{
2168	const unsigned char *selected = NULL;
2169	unsigned char selected_len = 0;
2170
2171	if (s->ctx->ext.alpn_select_cb != NULL && s->s3->alpn_proposed != NULL) {
2172	int r = s->ctx->ext.alpn_select_cb(s, &selected, &selected_len,
2173	s->s3->alpn_proposed,
2174	(unsigned int)s->s3->alpn_proposed_len,
2175	s->ctx->ext.alpn_select_cb_arg);
2176
2177	if (r == SSL_TLSEXT_ERR_OK) {
2178	OPENSSL_free(s->s3->alpn_selected);
2179	s->s3->alpn_selected = OPENSSL_memdup(selected, selected_len);
2180	if (s->s3->alpn_selected == NULL) {
2181	s->s3->alpn_selected_len = 0;
2182	SSLfatal(s, SSL_AD_INTERNAL_ERROR, SSL_F_TLS_HANDLE_ALPN,
2183	ERR_R_INTERNAL_ERROR);
2184	return 0;
2185	}
2186	s->s3->alpn_selected_len = selected_len;
2187	#ifndef OPENSSL_NO_NEXTPROTONEG
2188	/* ALPN takes precedence over NPN. */
2189	s->s3->npn_seen = 0;
2190	#endif
2191
2192	/* Check ALPN is consistent with session */
2193	if (s->session->ext.alpn_selected == NULL
2194	\|\| selected_len != s->session->ext.alpn_selected_len
2195	\|\| memcmp(selected, s->session->ext.alpn_selected,
2196	selected_len) != 0) {
2197	/* Not consistent so can't be used for early_data */
2198	s->ext.early_data_ok = 0;
2199
2200	if (!s->hit) {
2201	/*
2202	* This is a new session and so alpn_selected should have
2203	* been initialised to NULL. We should update it with the
2204	* selected ALPN.
2205	*/
2206	if (!ossl_assert(s->session->ext.alpn_selected == NULL)) {
2207	SSLfatal(s, SSL_AD_INTERNAL_ERROR,
2208	SSL_F_TLS_HANDLE_ALPN,
2209	ERR_R_INTERNAL_ERROR);
2210	return 0;
2211	}
2212	s->session->ext.alpn_selected = OPENSSL_memdup(selected,
2213	selected_len);
2214	if (s->session->ext.alpn_selected == NULL) {
2215	SSLfatal(s, SSL_AD_INTERNAL_ERROR,
2216	SSL_F_TLS_HANDLE_ALPN,
2217	ERR_R_INTERNAL_ERROR);
2218	return 0;
2219	}
2220	s->session->ext.alpn_selected_len = selected_len;
2221	}
2222	}
2223
2224	return 1;
2225	} else if (r != SSL_TLSEXT_ERR_NOACK) {
2226	SSLfatal(s, SSL_AD_NO_APPLICATION_PROTOCOL, SSL_F_TLS_HANDLE_ALPN,
2227	SSL_R_NO_APPLICATION_PROTOCOL);
2228	return 0;
2229	}
2230	/*
2231	* If r == SSL_TLSEXT_ERR_NOACK then behave as if no callback was
2232	* present.
2233	*/
2234	}
2235
2236	/* Check ALPN is consistent with session */
2237	if (s->session->ext.alpn_selected != NULL) {
2238	/* Not consistent so can't be used for early_data */
2239	s->ext.early_data_ok = 0;
2240	}
2241
2242	return 1;
2243	}
2244
2245	WORK_STATE tls_post_process_client_hello(SSL *s, WORK_STATE wst)
2246	{
2247	const SSL_CIPHER *cipher;
2248
2249	if (wst == WORK_MORE_A) {
2250	int rv = tls_early_post_process_client_hello(s);
2251	if (rv == 0) {
2252	/* SSLfatal() was already called */
2253	goto err;
2254	}
2255	if (rv < 0)
2256	return WORK_MORE_A;
2257	wst = WORK_MORE_B;
2258	}
2259	if (wst == WORK_MORE_B) {
2260	if (!s->hit \|\| SSL_IS_TLS13(s)) {
2261	/* Let cert callback update server certificates if required */
2262	if (!s->hit && s->cert->cert_cb != NULL) {
2263	int rv = s->cert->cert_cb(s, s->cert->cert_cb_arg);
2264	if (rv == 0) {
2265	SSLfatal(s, SSL_AD_INTERNAL_ERROR,
2266	SSL_F_TLS_POST_PROCESS_CLIENT_HELLO,
2267	SSL_R_CERT_CB_ERROR);
2268	goto err;
2269	}
2270	if (rv < 0) {
2271	s->rwstate = SSL_X509_LOOKUP;
2272	return WORK_MORE_B;
2273	}
2274	s->rwstate = SSL_NOTHING;
2275	}
2276
2277	/* In TLSv1.3 we selected the ciphersuite before resumption */
2278	if (!SSL_IS_TLS13(s)) {
2279	cipher =
2280	ssl3_choose_cipher(s, s->peer_ciphers, SSL_get_ciphers(s));
2281
2282	if (cipher == NULL) {
2283	SSLfatal(s, SSL_AD_HANDSHAKE_FAILURE,
2284	SSL_F_TLS_POST_PROCESS_CLIENT_HELLO,
2285	SSL_R_NO_SHARED_CIPHER);
2286	goto err;
2287	}
2288	s->s3->tmp.new_cipher = cipher;
2289	}
2290	if (!s->hit) {
2291	if (!tls_choose_sigalg(s, 1)) {
2292	/* SSLfatal already called */
2293	goto err;
2294	}
2295	/* check whether we should disable session resumption */
2296	if (s->not_resumable_session_cb != NULL)
2297	s->session->not_resumable =
2298	s->not_resumable_session_cb(s,
2299	((s->s3->tmp.new_cipher->algorithm_mkey
2300	& (SSL_kDHE \| SSL_kECDHE)) != 0));
2301	if (s->session->not_resumable)
2302	/* do not send a session ticket */
2303	s->ext.ticket_expected = 0;
2304	}
2305	} else {
2306	/* Session-id reuse */
2307	s->s3->tmp.new_cipher = s->session->cipher;
2308	}
2309
2310	/*-
2311	* we now have the following setup.
2312	* client_random
2313	* cipher_list - our preferred list of ciphers
2314	* ciphers - the clients preferred list of ciphers
2315	* compression - basically ignored right now
2316	* ssl version is set - sslv3
2317	* s->session - The ssl session has been setup.
2318	* s->hit - session reuse flag
2319	* s->s3->tmp.new_cipher- the new cipher to use.
2320	*/
2321
2322	/*
2323	* Call status_request callback if needed. Has to be done after the
2324	* certificate callbacks etc above.
2325	*/
2326	if (!tls_handle_status_request(s)) {
2327	/* SSLfatal() already called */
2328	goto err;
2329	}
2330	/*
2331	* Call alpn_select callback if needed. Has to be done after SNI and
2332	* cipher negotiation (HTTP/2 restricts permitted ciphers). In TLSv1.3
2333	* we already did this because cipher negotiation happens earlier, and
2334	* we must handle ALPN before we decide whether to accept early_data.
2335	*/
2336	if (!SSL_IS_TLS13(s) && !tls_handle_alpn(s)) {
2337	/* SSLfatal() already called */
2338	goto err;
2339	}
2340
2341	wst = WORK_MORE_C;
2342	}
2343	#ifndef OPENSSL_NO_SRP
2344	if (wst == WORK_MORE_C) {
2345	int ret;
2346	if ((ret = ssl_check_srp_ext_ClientHello(s)) == 0) {
2347	/*
2348	* callback indicates further work to be done
2349	*/
2350	s->rwstate = SSL_X509_LOOKUP;
2351	return WORK_MORE_C;
2352	}
2353	if (ret < 0) {
2354	/* SSLfatal() already called */
2355	goto err;
2356	}
2357	}
2358	#endif
2359
2360	return WORK_FINISHED_STOP;
2361	err:
2362	return WORK_ERROR;
2363	}
2364
2365	int tls_construct_server_hello(SSL s, WPACKET pkt)
2366	{
2367	int compm;
2368	size_t sl, len;
2369	int version;
2370	unsigned char *session_id;
2371	int usetls13 = SSL_IS_TLS13(s) \|\| s->hello_retry_request == SSL_HRR_PENDING;
2372
2373	version = usetls13 ? TLS1_2_VERSION : s->version;
2374	if (!WPACKET_put_bytes_u16(pkt, version)
2375	/*
2376	* Random stuff. Filling of the server_random takes place in
2377	* tls_process_client_hello()
2378	*/
2379	\|\| !WPACKET_memcpy(pkt,
2380	s->hello_retry_request == SSL_HRR_PENDING
2381	? hrrrandom : s->s3->server_random,
2382	SSL3_RANDOM_SIZE)) {
2383	SSLfatal(s, SSL_AD_INTERNAL_ERROR, SSL_F_TLS_CONSTRUCT_SERVER_HELLO,
2384	ERR_R_INTERNAL_ERROR);
2385	return 0;
2386	}
2387
2388	/*-
2389	* There are several cases for the session ID to send
2390	* back in the server hello:
2391	* - For session reuse from the session cache,
2392	* we send back the old session ID.
2393	* - If stateless session reuse (using a session ticket)
2394	* is successful, we send back the client's "session ID"
2395	* (which doesn't actually identify the session).
2396	* - If it is a new session, we send back the new
2397	* session ID.
2398	* - However, if we want the new session to be single-use,
2399	* we send back a 0-length session ID.
2400	* - In TLSv1.3 we echo back the session id sent to us by the client
2401	* regardless
2402	* s->hit is non-zero in either case of session reuse,
2403	* so the following won't overwrite an ID that we're supposed
2404	* to send back.
2405	*/
2406	if (s->session->not_resumable \|\|
2407	(!(s->ctx->session_cache_mode & SSL_SESS_CACHE_SERVER)
2408	&& !s->hit))
2409	s->session->session_id_length = 0;
2410
2411	if (usetls13) {
2412	sl = s->tmp_session_id_len;
2413	session_id = s->tmp_session_id;
2414	} else {
2415	sl = s->session->session_id_length;
2416	session_id = s->session->session_id;
2417	}
2418
2419	if (sl > sizeof(s->session->session_id)) {
2420	SSLfatal(s, SSL_AD_INTERNAL_ERROR, SSL_F_TLS_CONSTRUCT_SERVER_HELLO,
2421	ERR_R_INTERNAL_ERROR);
2422	return 0;
2423	}
2424
2425	/* set up the compression method */
2426	#ifdef OPENSSL_NO_COMP
2427	compm = 0;
2428	#else
2429	if (usetls13 \|\| s->s3->tmp.new_compression == NULL)
2430	compm = 0;
2431	else
2432	compm = s->s3->tmp.new_compression->id;
2433	#endif
2434
2435	if (!WPACKET_sub_memcpy_u8(pkt, session_id, sl)
2436	\|\| !s->method->put_cipher_by_char(s->s3->tmp.new_cipher, pkt, &len)
2437	\|\| !WPACKET_put_bytes_u8(pkt, compm)) {
2438	SSLfatal(s, SSL_AD_INTERNAL_ERROR, SSL_F_TLS_CONSTRUCT_SERVER_HELLO,
2439	ERR_R_INTERNAL_ERROR);
2440	return 0;
2441	}
2442
2443	if (!tls_construct_extensions(s, pkt,
2444	s->hello_retry_request == SSL_HRR_PENDING
2445	? SSL_EXT_TLS1_3_HELLO_RETRY_REQUEST
2446	: (SSL_IS_TLS13(s)
2447	? SSL_EXT_TLS1_3_SERVER_HELLO
2448	: SSL_EXT_TLS1_2_SERVER_HELLO),
2449	NULL, 0)) {
2450	/* SSLfatal() already called */
2451	return 0;
2452	}
2453
2454	if (s->hello_retry_request == SSL_HRR_PENDING) {
2455	/* Ditch the session. We'll create a new one next time around */
2456	SSL_SESSION_free(s->session);
2457	s->session = NULL;
2458	s->hit = 0;
2459
2460	/*
2461	* Re-initialise the Transcript Hash. We're going to prepopulate it with
2462	* a synthetic message_hash in place of ClientHello1.
2463	*/
2464	if (!create_synthetic_message_hash(s, NULL, 0, NULL, 0)) {
2465	/* SSLfatal() already called */
2466	return 0;
2467	}
2468	} else if (!(s->verify_mode & SSL_VERIFY_PEER)
2469	&& !ssl3_digest_cached_records(s, 0)) {
2470	/* SSLfatal() already called */;
2471	return 0;
2472	}
2473
2474	return 1;
2475	}
2476
2477	int tls_construct_server_done(SSL s, WPACKET pkt)
2478	{
2479	if (!s->s3->tmp.cert_request) {
2480	if (!ssl3_digest_cached_records(s, 0)) {
2481	/* SSLfatal() already called */
2482	return 0;
2483	}
2484	}
2485	return 1;
2486	}
2487
2488	int tls_construct_server_key_exchange(SSL s, WPACKET pkt)
2489	{
2490	#ifndef OPENSSL_NO_DH
2491	EVP_PKEY *pkdh = NULL;
2492	#endif
2493	#ifndef OPENSSL_NO_EC
2494	unsigned char *encodedPoint = NULL;
2495	size_t encodedlen = 0;
2496	int curve_id = 0;
2497	#endif
2498	const SIGALG_LOOKUP *lu = s->s3->tmp.sigalg;
2499	int i;
2500	unsigned long type;
2501	const BIGNUM *r[4];
2502	EVP_MD_CTX *md_ctx = EVP_MD_CTX_new();
2503	EVP_PKEY_CTX *pctx = NULL;
2504	size_t paramlen, paramoffset;
2505
2506	if (!WPACKET_get_total_written(pkt, &paramoffset)) {
2507	SSLfatal(s, SSL_AD_INTERNAL_ERROR,
2508	SSL_F_TLS_CONSTRUCT_SERVER_KEY_EXCHANGE, ERR_R_INTERNAL_ERROR);
2509	goto err;
2510	}
2511
2512	if (md_ctx == NULL) {
2513	SSLfatal(s, SSL_AD_INTERNAL_ERROR,
2514	SSL_F_TLS_CONSTRUCT_SERVER_KEY_EXCHANGE, ERR_R_MALLOC_FAILURE);
2515	goto err;
2516	}
2517
2518	type = s->s3->tmp.new_cipher->algorithm_mkey;
2519
2520	r[0] = r[1] = r[2] = r[3] = NULL;
2521	#ifndef OPENSSL_NO_PSK
2522	/* Plain PSK or RSAPSK nothing to do */
2523	if (type & (SSL_kPSK \| SSL_kRSAPSK)) {
2524	} else
2525	#endif /* !OPENSSL_NO_PSK */
2526	#ifndef OPENSSL_NO_DH
2527	if (type & (SSL_kDHE \| SSL_kDHEPSK)) {
2528	CERT *cert = s->cert;
2529
2530	EVP_PKEY *pkdhp = NULL;
2531	DH *dh;
2532
2533	if (s->cert->dh_tmp_auto) {
2534	DH *dhp = ssl_get_auto_dh(s);
2535	pkdh = EVP_PKEY_new();
2536	if (pkdh == NULL \|\| dhp == NULL) {
2537	DH_free(dhp);
2538	SSLfatal(s, SSL_AD_INTERNAL_ERROR,
2539	SSL_F_TLS_CONSTRUCT_SERVER_KEY_EXCHANGE,
2540	ERR_R_INTERNAL_ERROR);
2541	goto err;
2542	}
2543	EVP_PKEY_assign_DH(pkdh, dhp);
2544	pkdhp = pkdh;
2545	} else {
2546	pkdhp = cert->dh_tmp;
2547	}
2548	if ((pkdhp == NULL) && (s->cert->dh_tmp_cb != NULL)) {
2549	DH *dhp = s->cert->dh_tmp_cb(s, 0, 1024);
2550	pkdh = ssl_dh_to_pkey(dhp);
2551	if (pkdh == NULL) {
2552	SSLfatal(s, SSL_AD_INTERNAL_ERROR,
2553	SSL_F_TLS_CONSTRUCT_SERVER_KEY_EXCHANGE,
2554	ERR_R_INTERNAL_ERROR);
2555	goto err;
2556	}
2557	pkdhp = pkdh;
2558	}
2559	if (pkdhp == NULL) {
2560	SSLfatal(s, SSL_AD_INTERNAL_ERROR,
2561	SSL_F_TLS_CONSTRUCT_SERVER_KEY_EXCHANGE,
2562	SSL_R_MISSING_TMP_DH_KEY);
2563	goto err;
2564	}
2565	if (!ssl_security(s, SSL_SECOP_TMP_DH,
2566	EVP_PKEY_security_bits(pkdhp), 0, pkdhp)) {
2567	SSLfatal(s, SSL_AD_HANDSHAKE_FAILURE,
2568	SSL_F_TLS_CONSTRUCT_SERVER_KEY_EXCHANGE,
2569	SSL_R_DH_KEY_TOO_SMALL);
2570	goto err;
2571	}
2572	if (s->s3->tmp.pkey != NULL) {
2573	SSLfatal(s, SSL_AD_INTERNAL_ERROR,
2574	SSL_F_TLS_CONSTRUCT_SERVER_KEY_EXCHANGE,
2575	ERR_R_INTERNAL_ERROR);
2576	goto err;
2577	}
2578
2579	s->s3->tmp.pkey = ssl_generate_pkey(pkdhp);
2580	if (s->s3->tmp.pkey == NULL) {
2581	SSLfatal(s, SSL_AD_INTERNAL_ERROR, 0, ERR_R_INTERNAL_ERROR);
2582	goto err;
2583	}
2584
2585	dh = EVP_PKEY_get0_DH(s->s3->tmp.pkey);
2586	if (dh == NULL) {
2587	SSLfatal(s, SSL_AD_INTERNAL_ERROR,
2588	SSL_F_TLS_CONSTRUCT_SERVER_KEY_EXCHANGE,
2589	ERR_R_INTERNAL_ERROR);
2590	goto err;
2591	}
2592
2593	EVP_PKEY_free(pkdh);
2594	pkdh = NULL;
2595
2596	DH_get0_pqg(dh, &r[0], NULL, &r[1]);
2597	DH_get0_key(dh, &r[2], NULL);
2598	} else
2599	#endif
2600	#ifndef OPENSSL_NO_EC
2601	if (type & (SSL_kECDHE \| SSL_kECDHEPSK)) {
2602
2603	if (s->s3->tmp.pkey != NULL) {
2604	SSLfatal(s, SSL_AD_INTERNAL_ERROR,
2605	SSL_F_TLS_CONSTRUCT_SERVER_KEY_EXCHANGE,
2606	ERR_R_INTERNAL_ERROR);
2607	goto err;
2608	}
2609
2610	/* Get NID of appropriate shared curve */
2611	curve_id = tls1_shared_group(s, -2);
2612	if (curve_id == 0) {
2613	SSLfatal(s, SSL_AD_HANDSHAKE_FAILURE,
2614	SSL_F_TLS_CONSTRUCT_SERVER_KEY_EXCHANGE,
2615	SSL_R_UNSUPPORTED_ELLIPTIC_CURVE);
2616	goto err;
2617	}
2618	s->s3->tmp.pkey = ssl_generate_pkey_group(s, curve_id);
2619	/* Generate a new key for this curve */
2620	if (s->s3->tmp.pkey == NULL) {
2621	/* SSLfatal() already called */
2622	goto err;
2623	}
2624
2625	/* Encode the public key. */
2626	encodedlen = EVP_PKEY_get1_tls_encodedpoint(s->s3->tmp.pkey,
2627	&encodedPoint);
2628	if (encodedlen == 0) {
2629	SSLfatal(s, SSL_AD_INTERNAL_ERROR,
2630	SSL_F_TLS_CONSTRUCT_SERVER_KEY_EXCHANGE, ERR_R_EC_LIB);
2631	goto err;
2632	}
2633
2634	/*
2635	* We'll generate the serverKeyExchange message explicitly so we
2636	* can set these to NULLs
2637	*/
2638	r[0] = NULL;
2639	r[1] = NULL;
2640	r[2] = NULL;
2641	r[3] = NULL;
2642	} else
2643	#endif /* !OPENSSL_NO_EC */
2644	#ifndef OPENSSL_NO_SRP
2645	if (type & SSL_kSRP) {
2646	if ((s->srp_ctx.N == NULL) \|\|
2647	(s->srp_ctx.g == NULL) \|\|
2648	(s->srp_ctx.s == NULL) \|\| (s->srp_ctx.B == NULL)) {
2649	SSLfatal(s, SSL_AD_INTERNAL_ERROR,
2650	SSL_F_TLS_CONSTRUCT_SERVER_KEY_EXCHANGE,
2651	SSL_R_MISSING_SRP_PARAM);
2652	goto err;
2653	}
2654	r[0] = s->srp_ctx.N;
2655	r[1] = s->srp_ctx.g;
2656	r[2] = s->srp_ctx.s;
2657	r[3] = s->srp_ctx.B;
2658	} else
2659	#endif
2660	{
2661	SSLfatal(s, SSL_AD_INTERNAL_ERROR,
2662	SSL_F_TLS_CONSTRUCT_SERVER_KEY_EXCHANGE,
2663	SSL_R_UNKNOWN_KEY_EXCHANGE_TYPE);
2664	goto err;
2665	}
2666
2667	if (((s->s3->tmp.new_cipher->algorithm_auth & (SSL_aNULL \| SSL_aSRP)) != 0)
2668	\|\| ((s->s3->tmp.new_cipher->algorithm_mkey & SSL_PSK)) != 0) {
2669	lu = NULL;
2670	} else if (lu == NULL) {
2671	SSLfatal(s, SSL_AD_DECODE_ERROR,
2672	SSL_F_TLS_CONSTRUCT_SERVER_KEY_EXCHANGE, ERR_R_INTERNAL_ERROR);
2673	goto err;
2674	}
2675
2676	#ifndef OPENSSL_NO_PSK
2677	if (type & SSL_PSK) {
2678	size_t len = (s->cert->psk_identity_hint == NULL)
2679	? 0 : strlen(s->cert->psk_identity_hint);
2680
2681	/*
2682	* It should not happen that len > PSK_MAX_IDENTITY_LEN - we already
2683	* checked this when we set the identity hint - but just in case
2684	*/
2685	if (len > PSK_MAX_IDENTITY_LEN
2686	\|\| !WPACKET_sub_memcpy_u16(pkt, s->cert->psk_identity_hint,
2687	len)) {
2688	SSLfatal(s, SSL_AD_INTERNAL_ERROR,
2689	SSL_F_TLS_CONSTRUCT_SERVER_KEY_EXCHANGE,
2690	ERR_R_INTERNAL_ERROR);
2691	goto err;
2692	}
2693	}
2694	#endif
2695
2696	for (i = 0; i < 4 && r[i] != NULL; i++) {
2697	unsigned char *binval;
2698	int res;
2699
2700	#ifndef OPENSSL_NO_SRP
2701	if ((i == 2) && (type & SSL_kSRP)) {
2702	res = WPACKET_start_sub_packet_u8(pkt);
2703	} else
2704	#endif
2705	res = WPACKET_start_sub_packet_u16(pkt);
2706
2707	if (!res) {
2708	SSLfatal(s, SSL_AD_INTERNAL_ERROR,
2709	SSL_F_TLS_CONSTRUCT_SERVER_KEY_EXCHANGE,
2710	ERR_R_INTERNAL_ERROR);
2711	goto err;
2712	}
2713
2714	#ifndef OPENSSL_NO_DH
2715	/*-
2716	* for interoperability with some versions of the Microsoft TLS
2717	* stack, we need to zero pad the DHE pub key to the same length
2718	* as the prime
2719	*/
2720	if ((i == 2) && (type & (SSL_kDHE \| SSL_kDHEPSK))) {
2721	size_t len = BN_num_bytes(r[0]) - BN_num_bytes(r[2]);
2722
2723	if (len > 0) {
2724	if (!WPACKET_allocate_bytes(pkt, len, &binval)) {
2725	SSLfatal(s, SSL_AD_INTERNAL_ERROR,
2726	SSL_F_TLS_CONSTRUCT_SERVER_KEY_EXCHANGE,
2727	ERR_R_INTERNAL_ERROR);
2728	goto err;
2729	}
2730	memset(binval, 0, len);
2731	}
2732	}
2733	#endif
2734	if (!WPACKET_allocate_bytes(pkt, BN_num_bytes(r[i]), &binval)
2735	\|\| !WPACKET_close(pkt)) {
2736	SSLfatal(s, SSL_AD_INTERNAL_ERROR,
2737	SSL_F_TLS_CONSTRUCT_SERVER_KEY_EXCHANGE,
2738	ERR_R_INTERNAL_ERROR);
2739	goto err;
2740	}
2741
2742	BN_bn2bin(r[i], binval);
2743	}
2744
2745	#ifndef OPENSSL_NO_EC
2746	if (type & (SSL_kECDHE \| SSL_kECDHEPSK)) {
2747	/*
2748	* We only support named (not generic) curves. In this situation, the
2749	* ServerKeyExchange message has: [1 byte CurveType], [2 byte CurveName]
2750	* [1 byte length of encoded point], followed by the actual encoded
2751	* point itself
2752	*/
2753	if (!WPACKET_put_bytes_u8(pkt, NAMED_CURVE_TYPE)
2754	\|\| !WPACKET_put_bytes_u8(pkt, 0)
2755	\|\| !WPACKET_put_bytes_u8(pkt, curve_id)
2756	\|\| !WPACKET_sub_memcpy_u8(pkt, encodedPoint, encodedlen)) {
2757	SSLfatal(s, SSL_AD_INTERNAL_ERROR,
2758	SSL_F_TLS_CONSTRUCT_SERVER_KEY_EXCHANGE,
2759	ERR_R_INTERNAL_ERROR);
2760	goto err;
2761	}
2762	OPENSSL_free(encodedPoint);
2763	encodedPoint = NULL;
2764	}
2765	#endif
2766
2767	/* not anonymous */
2768	if (lu != NULL) {
2769	EVP_PKEY *pkey = s->s3->tmp.cert->privatekey;
2770	const EVP_MD *md;
2771	unsigned char sigbytes1, sigbytes2, *tbs;
2772	size_t siglen, tbslen;
2773	int rv;
2774
2775	if (pkey == NULL \|\| !tls1_lookup_md(lu, &md)) {
2776	/* Should never happen */
2777	SSLfatal(s, SSL_AD_INTERNAL_ERROR,
2778	SSL_F_TLS_CONSTRUCT_SERVER_KEY_EXCHANGE,
2779	ERR_R_INTERNAL_ERROR);
2780	goto err;
2781	}
2782	/* Get length of the parameters we have written above */
2783	if (!WPACKET_get_length(pkt, &paramlen)) {
2784	SSLfatal(s, SSL_AD_INTERNAL_ERROR,
2785	SSL_F_TLS_CONSTRUCT_SERVER_KEY_EXCHANGE,
2786	ERR_R_INTERNAL_ERROR);
2787	goto err;
2788	}
2789	/* send signature algorithm */
2790	if (SSL_USE_SIGALGS(s) && !WPACKET_put_bytes_u16(pkt, lu->sigalg)) {
2791	SSLfatal(s, SSL_AD_INTERNAL_ERROR,
2792	SSL_F_TLS_CONSTRUCT_SERVER_KEY_EXCHANGE,
2793	ERR_R_INTERNAL_ERROR);
2794	goto err;
2795	}
2796	/*
2797	* Create the signature. We don't know the actual length of the sig
2798	* until after we've created it, so we reserve enough bytes for it
2799	* up front, and then properly allocate them in the WPACKET
2800	* afterwards.
2801	*/
2802	siglen = EVP_PKEY_size(pkey);
2803	if (!WPACKET_sub_reserve_bytes_u16(pkt, siglen, &sigbytes1)
2804	\|\| EVP_DigestSignInit(md_ctx, &pctx, md, NULL, pkey) <= 0) {
2805	SSLfatal(s, SSL_AD_INTERNAL_ERROR,
2806	SSL_F_TLS_CONSTRUCT_SERVER_KEY_EXCHANGE,
2807	ERR_R_INTERNAL_ERROR);
2808	goto err;
2809	}
2810	if (lu->sig == EVP_PKEY_RSA_PSS) {
2811	if (EVP_PKEY_CTX_set_rsa_padding(pctx, RSA_PKCS1_PSS_PADDING) <= 0
2812	\|\| EVP_PKEY_CTX_set_rsa_pss_saltlen(pctx, RSA_PSS_SALTLEN_DIGEST) <= 0) {
2813	SSLfatal(s, SSL_AD_INTERNAL_ERROR,
2814	SSL_F_TLS_CONSTRUCT_SERVER_KEY_EXCHANGE,
2815	ERR_R_EVP_LIB);
2816	goto err;
2817	}
2818	}
2819	tbslen = construct_key_exchange_tbs(s, &tbs,
2820	s->init_buf->data + paramoffset,
2821	paramlen);
2822	if (tbslen == 0) {
2823	/* SSLfatal() already called */
2824	goto err;
2825	}
2826	rv = EVP_DigestSign(md_ctx, sigbytes1, &siglen, tbs, tbslen);
2827	OPENSSL_free(tbs);
2828	if (rv <= 0 \|\| !WPACKET_sub_allocate_bytes_u16(pkt, siglen, &sigbytes2)
2829	\|\| sigbytes1 != sigbytes2) {
2830	SSLfatal(s, SSL_AD_INTERNAL_ERROR,
2831	SSL_F_TLS_CONSTRUCT_SERVER_KEY_EXCHANGE,
2832	ERR_R_INTERNAL_ERROR);
2833	goto err;
2834	}
2835	}
2836
2837	EVP_MD_CTX_free(md_ctx);
2838	return 1;
2839	err:
2840	#ifndef OPENSSL_NO_DH
2841	EVP_PKEY_free(pkdh);
2842	#endif
2843	#ifndef OPENSSL_NO_EC
2844	OPENSSL_free(encodedPoint);
2845	#endif
2846	EVP_MD_CTX_free(md_ctx);
2847	return 0;
2848	}
2849
2850	int tls_construct_certificate_request(SSL s, WPACKET pkt)
2851	{
2852	if (SSL_IS_TLS13(s)) {
2853	/* Send random context when doing post-handshake auth */
2854	if (s->post_handshake_auth == SSL_PHA_REQUEST_PENDING) {
2855	OPENSSL_free(s->pha_context);
2856	s->pha_context_len = 32;
2857	if ((s->pha_context = OPENSSL_malloc(s->pha_context_len)) == NULL) {
2858	s->pha_context_len = 0;
2859	SSLfatal(s, SSL_AD_INTERNAL_ERROR,
2860	SSL_F_TLS_CONSTRUCT_CERTIFICATE_REQUEST,
2861	ERR_R_INTERNAL_ERROR);
2862	return 0;
2863	}
2864	if (RAND_bytes(s->pha_context, s->pha_context_len) <= 0
2865	\|\| !WPACKET_sub_memcpy_u8(pkt, s->pha_context,
2866	s->pha_context_len)) {
2867	SSLfatal(s, SSL_AD_INTERNAL_ERROR,
2868	SSL_F_TLS_CONSTRUCT_CERTIFICATE_REQUEST,
2869	ERR_R_INTERNAL_ERROR);
2870	return 0;
2871	}
2872	/* reset the handshake hash back to just after the ClientFinished */
2873	if (!tls13_restore_handshake_digest_for_pha(s)) {
2874	/* SSLfatal() already called */
2875	return 0;
2876	}
2877	} else {
2878	if (!WPACKET_put_bytes_u8(pkt, 0)) {
2879	SSLfatal(s, SSL_AD_INTERNAL_ERROR,
2880	SSL_F_TLS_CONSTRUCT_CERTIFICATE_REQUEST,
2881	ERR_R_INTERNAL_ERROR);
2882	return 0;
2883	}
2884	}
2885
2886	if (!tls_construct_extensions(s, pkt,
2887	SSL_EXT_TLS1_3_CERTIFICATE_REQUEST, NULL,
2888	0)) {
2889	/* SSLfatal() already called */
2890	return 0;
2891	}
2892	goto done;
2893	}
2894
2895	/* get the list of acceptable cert types */
2896	if (!WPACKET_start_sub_packet_u8(pkt)
2897	\|\| !ssl3_get_req_cert_type(s, pkt) \|\| !WPACKET_close(pkt)) {
2898	SSLfatal(s, SSL_AD_INTERNAL_ERROR,
2899	SSL_F_TLS_CONSTRUCT_CERTIFICATE_REQUEST, ERR_R_INTERNAL_ERROR);
2900	return 0;
2901	}
2902
2903	if (SSL_USE_SIGALGS(s)) {
2904	const uint16_t *psigs;
2905	size_t nl = tls12_get_psigalgs(s, 1, &psigs);
2906
2907	if (!WPACKET_start_sub_packet_u16(pkt)
2908	\|\| !WPACKET_set_flags(pkt, WPACKET_FLAGS_NON_ZERO_LENGTH)
2909	\|\| !tls12_copy_sigalgs(s, pkt, psigs, nl)
2910	\|\| !WPACKET_close(pkt)) {
2911	SSLfatal(s, SSL_AD_INTERNAL_ERROR,
2912	SSL_F_TLS_CONSTRUCT_CERTIFICATE_REQUEST,
2913	ERR_R_INTERNAL_ERROR);
2914	return 0;
2915	}
2916	}
2917
2918	if (!construct_ca_names(s, get_ca_names(s), pkt)) {
2919	/* SSLfatal() already called */
2920	return 0;
2921	}
2922
2923	done:
2924	s->certreqs_sent++;
2925	s->s3->tmp.cert_request = 1;
2926	return 1;
2927	}
2928
2929	static int tls_process_cke_psk_preamble(SSL s, PACKET pkt)
2930	{
2931	#ifndef OPENSSL_NO_PSK
2932	unsigned char psk[PSK_MAX_PSK_LEN];
2933	size_t psklen;
2934	PACKET psk_identity;
2935
2936	if (!PACKET_get_length_prefixed_2(pkt, &psk_identity)) {
2937	SSLfatal(s, SSL_AD_DECODE_ERROR, SSL_F_TLS_PROCESS_CKE_PSK_PREAMBLE,
2938	SSL_R_LENGTH_MISMATCH);
2939	return 0;
2940	}
2941	if (PACKET_remaining(&psk_identity) > PSK_MAX_IDENTITY_LEN) {
2942	SSLfatal(s, SSL_AD_DECODE_ERROR, SSL_F_TLS_PROCESS_CKE_PSK_PREAMBLE,
2943	SSL_R_DATA_LENGTH_TOO_LONG);
2944	return 0;
2945	}
2946	if (s->psk_server_callback == NULL) {
2947	SSLfatal(s, SSL_AD_INTERNAL_ERROR, SSL_F_TLS_PROCESS_CKE_PSK_PREAMBLE,
2948	SSL_R_PSK_NO_SERVER_CB);
2949	return 0;
2950	}
2951
2952	if (!PACKET_strndup(&psk_identity, &s->session->psk_identity)) {
2953	SSLfatal(s, SSL_AD_INTERNAL_ERROR, SSL_F_TLS_PROCESS_CKE_PSK_PREAMBLE,
2954	ERR_R_INTERNAL_ERROR);
2955	return 0;
2956	}
2957
2958	psklen = s->psk_server_callback(s, s->session->psk_identity,
2959	psk, sizeof(psk));
2960
2961	if (psklen > PSK_MAX_PSK_LEN) {
2962	SSLfatal(s, SSL_AD_INTERNAL_ERROR, SSL_F_TLS_PROCESS_CKE_PSK_PREAMBLE,
2963	ERR_R_INTERNAL_ERROR);
2964	return 0;
2965	} else if (psklen == 0) {
2966	/*
2967	* PSK related to the given identity not found
2968	*/
2969	SSLfatal(s, SSL_AD_UNKNOWN_PSK_IDENTITY,
2970	SSL_F_TLS_PROCESS_CKE_PSK_PREAMBLE,
2971	SSL_R_PSK_IDENTITY_NOT_FOUND);
2972	return 0;
2973	}
2974
2975	OPENSSL_free(s->s3->tmp.psk);
2976	s->s3->tmp.psk = OPENSSL_memdup(psk, psklen);
2977	OPENSSL_cleanse(psk, psklen);
2978
2979	if (s->s3->tmp.psk == NULL) {
2980	s->s3->tmp.psklen = 0;
2981	SSLfatal(s, SSL_AD_INTERNAL_ERROR,
2982	SSL_F_TLS_PROCESS_CKE_PSK_PREAMBLE, ERR_R_MALLOC_FAILURE);
2983	return 0;
2984	}
2985
2986	s->s3->tmp.psklen = psklen;
2987
2988	return 1;
2989	#else
2990	/* Should never happen */
2991	SSLfatal(s, SSL_AD_INTERNAL_ERROR, SSL_F_TLS_PROCESS_CKE_PSK_PREAMBLE,
2992	ERR_R_INTERNAL_ERROR);
2993	return 0;
2994	#endif
2995	}
2996
2997	static int tls_process_cke_rsa(SSL s, PACKET pkt)
2998	{
2999	#ifndef OPENSSL_NO_RSA
3000	unsigned char rand_premaster_secret[SSL_MAX_MASTER_KEY_LENGTH];
3001	int decrypt_len;
3002	unsigned char decrypt_good, version_good;
3003	size_t j, padding_len;
3004	PACKET enc_premaster;
3005	RSA *rsa = NULL;
3006	unsigned char *rsa_decrypt = NULL;
3007	int ret = 0;
3008
3009	rsa = EVP_PKEY_get0_RSA(s->cert->pkeys[SSL_PKEY_RSA].privatekey);
3010	if (rsa == NULL) {
3011	SSLfatal(s, SSL_AD_INTERNAL_ERROR, SSL_F_TLS_PROCESS_CKE_RSA,
3012	SSL_R_MISSING_RSA_CERTIFICATE);
3013	return 0;
3014	}
3015
3016	/* SSLv3 and pre-standard DTLS omit the length bytes. */
3017	if (s->version == SSL3_VERSION \|\| s->version == DTLS1_BAD_VER) {
3018	enc_premaster = *pkt;
3019	} else {
3020	if (!PACKET_get_length_prefixed_2(pkt, &enc_premaster)
3021	\|\| PACKET_remaining(pkt) != 0) {
3022	SSLfatal(s, SSL_AD_DECODE_ERROR, SSL_F_TLS_PROCESS_CKE_RSA,
3023	SSL_R_LENGTH_MISMATCH);
3024	return 0;
3025	}
3026	}
3027
3028	/*
3029	* We want to be sure that the plaintext buffer size makes it safe to
3030	* iterate over the entire size of a premaster secret
3031	* (SSL_MAX_MASTER_KEY_LENGTH). Reject overly short RSA keys because
3032	* their ciphertext cannot accommodate a premaster secret anyway.
3033	*/
3034	if (RSA_size(rsa) < SSL_MAX_MASTER_KEY_LENGTH) {
3035	SSLfatal(s, SSL_AD_INTERNAL_ERROR, SSL_F_TLS_PROCESS_CKE_RSA,
3036	RSA_R_KEY_SIZE_TOO_SMALL);
3037	return 0;
3038	}
3039
3040	rsa_decrypt = OPENSSL_malloc(RSA_size(rsa));
3041	if (rsa_decrypt == NULL) {
3042	SSLfatal(s, SSL_AD_INTERNAL_ERROR, SSL_F_TLS_PROCESS_CKE_RSA,
3043	ERR_R_MALLOC_FAILURE);
3044	return 0;
3045	}
3046
3047	/*
3048	* We must not leak whether a decryption failure occurs because of
3049	* Bleichenbacher's attack on PKCS #1 v1.5 RSA padding (see RFC 2246,
3050	* section 7.4.7.1). The code follows that advice of the TLS RFC and
3051	* generates a random premaster secret for the case that the decrypt
3052	* fails. See https://tools.ietf.org/html/rfc5246#section-7.4.7.1
3053	*/
3054
3055	if (RAND_priv_bytes(rand_premaster_secret,
3056	sizeof(rand_premaster_secret)) <= 0) {
3057	SSLfatal(s, SSL_AD_INTERNAL_ERROR, SSL_F_TLS_PROCESS_CKE_RSA,
3058	ERR_R_INTERNAL_ERROR);
3059	goto err;
3060	}
3061
3062	/*
3063	* Decrypt with no padding. PKCS#1 padding will be removed as part of
3064	* the timing-sensitive code below.
3065	*/
3066	/* TODO(size_t): Convert this function */
3067	decrypt_len = (int)RSA_private_decrypt((int)PACKET_remaining(&enc_premaster),
3068	PACKET_data(&enc_premaster),
3069	rsa_decrypt, rsa, RSA_NO_PADDING);
3070	if (decrypt_len < 0) {
3071	SSLfatal(s, SSL_AD_DECRYPT_ERROR, SSL_F_TLS_PROCESS_CKE_RSA,
3072	ERR_R_INTERNAL_ERROR);
3073	goto err;
3074	}
3075
3076	/* Check the padding. See RFC 3447, section 7.2.2. */
3077
3078	/*
3079	* The smallest padded premaster is 11 bytes of overhead. Small keys
3080	* are publicly invalid, so this may return immediately. This ensures
3081	* PS is at least 8 bytes.
3082	*/
3083	if (decrypt_len < 11 + SSL_MAX_MASTER_KEY_LENGTH) {
3084	SSLfatal(s, SSL_AD_DECRYPT_ERROR, SSL_F_TLS_PROCESS_CKE_RSA,
3085	SSL_R_DECRYPTION_FAILED);
3086	goto err;
3087	}
3088
3089	padding_len = decrypt_len - SSL_MAX_MASTER_KEY_LENGTH;
3090	decrypt_good = constant_time_eq_int_8(rsa_decrypt[0], 0) &
3091	constant_time_eq_int_8(rsa_decrypt[1], 2);
3092	for (j = 2; j < padding_len - 1; j++) {
3093	decrypt_good &= ~constant_time_is_zero_8(rsa_decrypt[j]);
3094	}
3095	decrypt_good &= constant_time_is_zero_8(rsa_decrypt[padding_len - 1]);
3096
3097	/*
3098	* If the version in the decrypted pre-master secret is correct then
3099	* version_good will be 0xff, otherwise it'll be zero. The
3100	* Klima-Pokorny-Rosa extension of Bleichenbacher's attack
3101	* (http://eprint.iacr.org/2003/052/) exploits the version number
3102	* check as a "bad version oracle". Thus version checks are done in
3103	* constant time and are treated like any other decryption error.
3104	*/
3105	version_good =
3106	constant_time_eq_8(rsa_decrypt[padding_len],
3107	(unsigned)(s->client_version >> 8));
3108	version_good &=
3109	constant_time_eq_8(rsa_decrypt[padding_len + 1],
3110	(unsigned)(s->client_version & 0xff));
3111
3112	/*
3113	* The premaster secret must contain the same version number as the
3114	* ClientHello to detect version rollback attacks (strangely, the
3115	* protocol does not offer such protection for DH ciphersuites).
3116	* However, buggy clients exist that send the negotiated protocol
3117	* version instead if the server does not support the requested
3118	* protocol version. If SSL_OP_TLS_ROLLBACK_BUG is set, tolerate such
3119	* clients.
3120	*/
3121	if (s->options & SSL_OP_TLS_ROLLBACK_BUG) {
3122	unsigned char workaround_good;
3123	workaround_good = constant_time_eq_8(rsa_decrypt[padding_len],
3124	(unsigned)(s->version >> 8));
3125	workaround_good &=
3126	constant_time_eq_8(rsa_decrypt[padding_len + 1],
3127	(unsigned)(s->version & 0xff));
3128	version_good \|= workaround_good;
3129	}
3130
3131	/*
3132	* Both decryption and version must be good for decrypt_good to
3133	* remain non-zero (0xff).
3134	*/
3135	decrypt_good &= version_good;
3136
3137	/*
3138	* Now copy rand_premaster_secret over from p using
3139	* decrypt_good_mask. If decryption failed, then p does not
3140	* contain valid plaintext, however, a check above guarantees
3141	* it is still sufficiently large to read from.
3142	*/
3143	for (j = 0; j < sizeof(rand_premaster_secret); j++) {
3144	rsa_decrypt[padding_len + j] =
3145	constant_time_select_8(decrypt_good,
3146	rsa_decrypt[padding_len + j],
3147	rand_premaster_secret[j]);
3148	}
3149
3150	if (!ssl_generate_master_secret(s, rsa_decrypt + padding_len,
3151	sizeof(rand_premaster_secret), 0)) {
3152	/* SSLfatal() already called */
3153	goto err;
3154	}
3155
3156	ret = 1;
3157	err:
3158	OPENSSL_free(rsa_decrypt);
3159	return ret;
3160	#else
3161	/* Should never happen */
3162	SSLfatal(s, SSL_AD_INTERNAL_ERROR, SSL_F_TLS_PROCESS_CKE_RSA,
3163	ERR_R_INTERNAL_ERROR);
3164	return 0;
3165	#endif
3166	}
3167
3168	static int tls_process_cke_dhe(SSL s, PACKET pkt)
3169	{
3170	#ifndef OPENSSL_NO_DH
3171	EVP_PKEY *skey = NULL;
3172	DH *cdh;
3173	unsigned int i;
3174	BIGNUM *pub_key;
3175	const unsigned char *data;
3176	EVP_PKEY *ckey = NULL;
3177	int ret = 0;
3178
3179	if (!PACKET_get_net_2(pkt, &i) \|\| PACKET_remaining(pkt) != i) {
3180	SSLfatal(s, SSL_AD_DECODE_ERROR, SSL_F_TLS_PROCESS_CKE_DHE,
3181	SSL_R_DH_PUBLIC_VALUE_LENGTH_IS_WRONG);
3182	goto err;
3183	}
3184	skey = s->s3->tmp.pkey;
3185	if (skey == NULL) {
3186	SSLfatal(s, SSL_AD_INTERNAL_ERROR, SSL_F_TLS_PROCESS_CKE_DHE,
3187	SSL_R_MISSING_TMP_DH_KEY);
3188	goto err;
3189	}
3190
3191	if (PACKET_remaining(pkt) == 0L) {
3192	SSLfatal(s, SSL_AD_DECODE_ERROR, SSL_F_TLS_PROCESS_CKE_DHE,
3193	SSL_R_MISSING_TMP_DH_KEY);
3194	goto err;
3195	}
3196	if (!PACKET_get_bytes(pkt, &data, i)) {
3197	/* We already checked we have enough data */
3198	SSLfatal(s, SSL_AD_INTERNAL_ERROR, SSL_F_TLS_PROCESS_CKE_DHE,
3199	ERR_R_INTERNAL_ERROR);
3200	goto err;
3201	}
3202	ckey = EVP_PKEY_new();
3203	if (ckey == NULL \|\| EVP_PKEY_copy_parameters(ckey, skey) == 0) {
3204	SSLfatal(s, SSL_AD_INTERNAL_ERROR, SSL_F_TLS_PROCESS_CKE_DHE,
3205	SSL_R_BN_LIB);
3206	goto err;
3207	}
3208
3209	cdh = EVP_PKEY_get0_DH(ckey);
3210	pub_key = BN_bin2bn(data, i, NULL);
3211	if (pub_key == NULL \|\| cdh == NULL \|\| !DH_set0_key(cdh, pub_key, NULL)) {
3212	SSLfatal(s, SSL_AD_INTERNAL_ERROR, SSL_F_TLS_PROCESS_CKE_DHE,
3213	ERR_R_INTERNAL_ERROR);
3214	BN_free(pub_key);
3215	goto err;
3216	}
3217
3218	if (ssl_derive(s, skey, ckey, 1) == 0) {
3219	/* SSLfatal() already called */
3220	goto err;
3221	}
3222
3223	ret = 1;
3224	EVP_PKEY_free(s->s3->tmp.pkey);
3225	s->s3->tmp.pkey = NULL;
3226	err:
3227	EVP_PKEY_free(ckey);
3228	return ret;
3229	#else
3230	/* Should never happen */
3231	SSLfatal(s, SSL_AD_INTERNAL_ERROR, SSL_F_TLS_PROCESS_CKE_DHE,
3232	ERR_R_INTERNAL_ERROR);
3233	return 0;
3234	#endif
3235	}
3236
3237	static int tls_process_cke_ecdhe(SSL s, PACKET pkt)
3238	{
3239	#ifndef OPENSSL_NO_EC
3240	EVP_PKEY *skey = s->s3->tmp.pkey;
3241	EVP_PKEY *ckey = NULL;
3242	int ret = 0;
3243
3244	if (PACKET_remaining(pkt) == 0L) {
3245	/* We don't support ECDH client auth */
3246	SSLfatal(s, SSL_AD_HANDSHAKE_FAILURE, SSL_F_TLS_PROCESS_CKE_ECDHE,
3247	SSL_R_MISSING_TMP_ECDH_KEY);
3248	goto err;
3249	} else {
3250	unsigned int i;
3251	const unsigned char *data;
3252
3253	/*
3254	* Get client's public key from encoded point in the
3255	* ClientKeyExchange message.
3256	*/
3257
3258	/* Get encoded point length */
3259	if (!PACKET_get_1(pkt, &i) \|\| !PACKET_get_bytes(pkt, &data, i)
3260	\|\| PACKET_remaining(pkt) != 0) {
3261	SSLfatal(s, SSL_AD_DECODE_ERROR, SSL_F_TLS_PROCESS_CKE_ECDHE,
3262	SSL_R_LENGTH_MISMATCH);
3263	goto err;
3264	}
3265	if (skey == NULL) {
3266	SSLfatal(s, SSL_AD_INTERNAL_ERROR, SSL_F_TLS_PROCESS_CKE_ECDHE,
3267	SSL_R_MISSING_TMP_ECDH_KEY);
3268	goto err;
3269	}
3270
3271	ckey = EVP_PKEY_new();
3272	if (ckey == NULL \|\| EVP_PKEY_copy_parameters(ckey, skey) <= 0) {
3273	SSLfatal(s, SSL_AD_INTERNAL_ERROR, SSL_F_TLS_PROCESS_CKE_ECDHE,
3274	ERR_R_EVP_LIB);
3275	goto err;
3276	}
3277	if (EVP_PKEY_set1_tls_encodedpoint(ckey, data, i) == 0) {
3278	SSLfatal(s, SSL_AD_INTERNAL_ERROR, SSL_F_TLS_PROCESS_CKE_ECDHE,
3279	ERR_R_EC_LIB);
3280	goto err;
3281	}
3282	}
3283
3284	if (ssl_derive(s, skey, ckey, 1) == 0) {
3285	/* SSLfatal() already called */
3286	goto err;
3287	}
3288
3289	ret = 1;
3290	EVP_PKEY_free(s->s3->tmp.pkey);
3291	s->s3->tmp.pkey = NULL;
3292	err:
3293	EVP_PKEY_free(ckey);
3294
3295	return ret;
3296	#else
3297	/* Should never happen */
3298	SSLfatal(s, SSL_AD_INTERNAL_ERROR, SSL_F_TLS_PROCESS_CKE_ECDHE,
3299	ERR_R_INTERNAL_ERROR);
3300	return 0;
3301	#endif
3302	}
3303
3304	static int tls_process_cke_srp(SSL s, PACKET pkt)
3305	{
3306	#ifndef OPENSSL_NO_SRP
3307	unsigned int i;
3308	const unsigned char *data;
3309
3310	if (!PACKET_get_net_2(pkt, &i)
3311	\|\| !PACKET_get_bytes(pkt, &data, i)) {
3312	SSLfatal(s, SSL_AD_DECODE_ERROR, SSL_F_TLS_PROCESS_CKE_SRP,
3313	SSL_R_BAD_SRP_A_LENGTH);
3314	return 0;
3315	}
3316	if ((s->srp_ctx.A = BN_bin2bn(data, i, NULL)) == NULL) {
3317	SSLfatal(s, SSL_AD_INTERNAL_ERROR, SSL_F_TLS_PROCESS_CKE_SRP,
3318	ERR_R_BN_LIB);
3319	return 0;
3320	}
3321	if (BN_ucmp(s->srp_ctx.A, s->srp_ctx.N) >= 0 \|\| BN_is_zero(s->srp_ctx.A)) {
3322	SSLfatal(s, SSL_AD_ILLEGAL_PARAMETER, SSL_F_TLS_PROCESS_CKE_SRP,
3323	SSL_R_BAD_SRP_PARAMETERS);
3324	return 0;
3325	}
3326	OPENSSL_free(s->session->srp_username);
3327	s->session->srp_username = OPENSSL_strdup(s->srp_ctx.login);
3328	if (s->session->srp_username == NULL) {
3329	SSLfatal(s, SSL_AD_INTERNAL_ERROR, SSL_F_TLS_PROCESS_CKE_SRP,
3330	ERR_R_MALLOC_FAILURE);
3331	return 0;
3332	}
3333
3334	if (!srp_generate_server_master_secret(s)) {
3335	/* SSLfatal() already called */
3336	return 0;
3337	}
3338
3339	return 1;
3340	#else
3341	/* Should never happen */
3342	SSLfatal(s, SSL_AD_INTERNAL_ERROR, SSL_F_TLS_PROCESS_CKE_SRP,
3343	ERR_R_INTERNAL_ERROR);
3344	return 0;
3345	#endif
3346	}
3347
3348	static int tls_process_cke_gost(SSL s, PACKET pkt)
3349	{
3350	#ifndef OPENSSL_NO_GOST
3351	EVP_PKEY_CTX *pkey_ctx;
3352	EVP_PKEY client_pub_pkey = NULL, pk = NULL;
3353	unsigned char premaster_secret[32];
3354	const unsigned char *start;
3355	size_t outlen = 32, inlen;
3356	unsigned long alg_a;
3357	GOST_KX_MESSAGE *pKX = NULL;
3358	const unsigned char *ptr;
3359	int ret = 0;
3360
3361	/* Get our certificate private key */
3362	alg_a = s->s3->tmp.new_cipher->algorithm_auth;
3363	if (alg_a & SSL_aGOST12) {
3364	/*
3365	* New GOST ciphersuites have SSL_aGOST01 bit too
3366	*/
3367	pk = s->cert->pkeys[SSL_PKEY_GOST12_512].privatekey;
3368	if (pk == NULL) {
3369	pk = s->cert->pkeys[SSL_PKEY_GOST12_256].privatekey;
3370	}
3371	if (pk == NULL) {
3372	pk = s->cert->pkeys[SSL_PKEY_GOST01].privatekey;
3373	}
3374	} else if (alg_a & SSL_aGOST01) {
3375	pk = s->cert->pkeys[SSL_PKEY_GOST01].privatekey;
3376	}
3377
3378	pkey_ctx = EVP_PKEY_CTX_new(pk, NULL);
3379	if (pkey_ctx == NULL) {
3380	SSLfatal(s, SSL_AD_INTERNAL_ERROR, SSL_F_TLS_PROCESS_CKE_GOST,
3381	ERR_R_MALLOC_FAILURE);
3382	return 0;
3383	}
3384	if (EVP_PKEY_decrypt_init(pkey_ctx) <= 0) {
3385	SSLfatal(s, SSL_AD_INTERNAL_ERROR, SSL_F_TLS_PROCESS_CKE_GOST,
3386	ERR_R_INTERNAL_ERROR);
3387	return 0;
3388	}
3389	/*
3390	* If client certificate is present and is of the same type, maybe
3391	* use it for key exchange. Don't mind errors from
3392	* EVP_PKEY_derive_set_peer, because it is completely valid to use a
3393	* client certificate for authorization only.
3394	*/
3395	client_pub_pkey = X509_get0_pubkey(s->session->peer);
3396	if (client_pub_pkey) {
3397	if (EVP_PKEY_derive_set_peer(pkey_ctx, client_pub_pkey) <= 0)
3398	ERR_clear_error();
3399	}
3400
3401	ptr = PACKET_data(pkt);
3402	/* Some implementations provide extra data in the opaqueBlob
3403	* We have nothing to do with this blob so we just skip it */
3404	pKX = d2i_GOST_KX_MESSAGE(NULL, &ptr, PACKET_remaining(pkt));
3405	if (pKX == NULL
3406	\|\| pKX->kxBlob == NULL
3407	\|\| ASN1_TYPE_get(pKX->kxBlob) != V_ASN1_SEQUENCE) {
3408	SSLfatal(s, SSL_AD_DECODE_ERROR, SSL_F_TLS_PROCESS_CKE_GOST,
3409	SSL_R_DECRYPTION_FAILED);
3410	goto err;
3411	}
3412
3413	if (!PACKET_forward(pkt, ptr - PACKET_data(pkt))) {
3414	SSLfatal(s, SSL_AD_INTERNAL_ERROR, SSL_F_TLS_PROCESS_CKE_GOST,
3415	SSL_R_DECRYPTION_FAILED);
3416	goto err;
3417	}
3418
3419	if (PACKET_remaining(pkt) != 0) {
3420	SSLfatal(s, SSL_AD_INTERNAL_ERROR, SSL_F_TLS_PROCESS_CKE_GOST,
3421	SSL_R_DECRYPTION_FAILED);
3422	goto err;
3423	}
3424
3425	inlen = pKX->kxBlob->value.sequence->length;
3426	start = pKX->kxBlob->value.sequence->data;
3427
3428	if (EVP_PKEY_decrypt(pkey_ctx, premaster_secret, &outlen, start,
3429	inlen) <= 0) {
3430	SSLfatal(s, SSL_AD_DECODE_ERROR, SSL_F_TLS_PROCESS_CKE_GOST,
3431	SSL_R_DECRYPTION_FAILED);
3432	goto err;
3433	}
3434	/* Generate master secret */
3435	if (!ssl_generate_master_secret(s, premaster_secret,
3436	sizeof(premaster_secret), 0)) {
3437	/* SSLfatal() already called */
3438	goto err;
3439	}
3440	/* Check if pubkey from client certificate was used */
3441	if (EVP_PKEY_CTX_ctrl(pkey_ctx, -1, -1, EVP_PKEY_CTRL_PEER_KEY, 2,
3442	NULL) > 0)
3443	s->statem.no_cert_verify = 1;
3444
3445	ret = 1;
3446	err:
3447	EVP_PKEY_CTX_free(pkey_ctx);
3448	GOST_KX_MESSAGE_free(pKX);
3449	return ret;
3450	#else
3451	/* Should never happen */
3452	SSLfatal(s, SSL_AD_INTERNAL_ERROR, SSL_F_TLS_PROCESS_CKE_GOST,
3453	ERR_R_INTERNAL_ERROR);
3454	return 0;
3455	#endif
3456	}
3457
3458	MSG_PROCESS_RETURN tls_process_client_key_exchange(SSL s, PACKET pkt)
3459	{
3460	unsigned long alg_k;
3461
3462	alg_k = s->s3->tmp.new_cipher->algorithm_mkey;
3463
3464	/* For PSK parse and retrieve identity, obtain PSK key */
3465	if ((alg_k & SSL_PSK) && !tls_process_cke_psk_preamble(s, pkt)) {
3466	/* SSLfatal() already called */
3467	goto err;
3468	}
3469
3470	if (alg_k & SSL_kPSK) {
3471	/* Identity extracted earlier: should be nothing left */
3472	if (PACKET_remaining(pkt) != 0) {
3473	SSLfatal(s, SSL_AD_DECODE_ERROR,
3474	SSL_F_TLS_PROCESS_CLIENT_KEY_EXCHANGE,
3475	SSL_R_LENGTH_MISMATCH);
3476	goto err;
3477	}
3478	/* PSK handled by ssl_generate_master_secret */
3479	if (!ssl_generate_master_secret(s, NULL, 0, 0)) {
3480	/* SSLfatal() already called */
3481	goto err;
3482	}
3483	} else if (alg_k & (SSL_kRSA \| SSL_kRSAPSK)) {
3484	if (!tls_process_cke_rsa(s, pkt)) {
3485	/* SSLfatal() already called */
3486	goto err;
3487	}
3488	} else if (alg_k & (SSL_kDHE \| SSL_kDHEPSK)) {
3489	if (!tls_process_cke_dhe(s, pkt)) {
3490	/* SSLfatal() already called */
3491	goto err;
3492	}
3493	} else if (alg_k & (SSL_kECDHE \| SSL_kECDHEPSK)) {
3494	if (!tls_process_cke_ecdhe(s, pkt)) {
3495	/* SSLfatal() already called */
3496	goto err;
3497	}
3498	} else if (alg_k & SSL_kSRP) {
3499	if (!tls_process_cke_srp(s, pkt)) {
3500	/* SSLfatal() already called */
3501	goto err;
3502	}
3503	} else if (alg_k & SSL_kGOST) {
3504	if (!tls_process_cke_gost(s, pkt)) {
3505	/* SSLfatal() already called */
3506	goto err;
3507	}
3508	} else {
3509	SSLfatal(s, SSL_AD_INTERNAL_ERROR,
3510	SSL_F_TLS_PROCESS_CLIENT_KEY_EXCHANGE,
3511	SSL_R_UNKNOWN_CIPHER_TYPE);
3512	goto err;
3513	}
3514
3515	return MSG_PROCESS_CONTINUE_PROCESSING;
3516	err:
3517	#ifndef OPENSSL_NO_PSK
3518	OPENSSL_clear_free(s->s3->tmp.psk, s->s3->tmp.psklen);
3519	s->s3->tmp.psk = NULL;
3520	s->s3->tmp.psklen = 0;
3521	#endif
3522	return MSG_PROCESS_ERROR;
3523	}
3524
3525	WORK_STATE tls_post_process_client_key_exchange(SSL *s, WORK_STATE wst)
3526	{
3527	#ifndef OPENSSL_NO_SCTP
3528	if (wst == WORK_MORE_A) {
3529	if (SSL_IS_DTLS(s)) {
3530	unsigned char sctpauthkey[64];
3531	char labelbuffer[sizeof(DTLS1_SCTP_AUTH_LABEL)];
3532	size_t labellen;
3533	/*
3534	* Add new shared key for SCTP-Auth, will be ignored if no SCTP
3535	* used.
3536	*/
3537	memcpy(labelbuffer, DTLS1_SCTP_AUTH_LABEL,
3538	sizeof(DTLS1_SCTP_AUTH_LABEL));
3539
3540	/* Don't include the terminating zero. */
3541	labellen = sizeof(labelbuffer) - 1;
3542	if (s->mode & SSL_MODE_DTLS_SCTP_LABEL_LENGTH_BUG)
3543	labellen += 1;
3544
3545	if (SSL_export_keying_material(s, sctpauthkey,
3546	sizeof(sctpauthkey), labelbuffer,
3547	labellen, NULL, 0,
3548	0) <= 0) {
3549	SSLfatal(s, SSL_AD_INTERNAL_ERROR,
3550	SSL_F_TLS_POST_PROCESS_CLIENT_KEY_EXCHANGE,
3551	ERR_R_INTERNAL_ERROR);
3552	return WORK_ERROR;
3553	}
3554
3555	BIO_ctrl(SSL_get_wbio(s), BIO_CTRL_DGRAM_SCTP_ADD_AUTH_KEY,
3556	sizeof(sctpauthkey), sctpauthkey);
3557	}
3558	}
3559	#endif
3560
3561	if (s->statem.no_cert_verify \|\| !s->session->peer) {
3562	/*
3563	* No certificate verify or no peer certificate so we no longer need
3564	* the handshake_buffer
3565	*/
3566	if (!ssl3_digest_cached_records(s, 0)) {
3567	/* SSLfatal() already called */
3568	return WORK_ERROR;
3569	}
3570	return WORK_FINISHED_CONTINUE;
3571	} else {
3572	if (!s->s3->handshake_buffer) {
3573	SSLfatal(s, SSL_AD_INTERNAL_ERROR,
3574	SSL_F_TLS_POST_PROCESS_CLIENT_KEY_EXCHANGE,
3575	ERR_R_INTERNAL_ERROR);
3576	return WORK_ERROR;
3577	}
3578	/*
3579	* For sigalgs freeze the handshake buffer. If we support
3580	* extms we've done this already so this is a no-op
3581	*/
3582	if (!ssl3_digest_cached_records(s, 1)) {
3583	/* SSLfatal() already called */
3584	return WORK_ERROR;
3585	}
3586	}
3587
3588	return WORK_FINISHED_CONTINUE;
3589	}
3590
3591	MSG_PROCESS_RETURN tls_process_client_certificate(SSL s, PACKET pkt)
3592	{
3593	int i;
3594	MSG_PROCESS_RETURN ret = MSG_PROCESS_ERROR;
3595	X509 *x = NULL;
3596	unsigned long l;
3597	const unsigned char certstart, certbytes;
3598	STACK_OF(X509) *sk = NULL;
3599	PACKET spkt, context;
3600	size_t chainidx;
3601	SSL_SESSION *new_sess = NULL;
3602
3603	/*
3604	* To get this far we must have read encrypted data from the client. We no
3605	* longer tolerate unencrypted alerts. This value is ignored if less than
3606	* TLSv1.3
3607	*/
3608	s->statem.enc_read_state = ENC_READ_STATE_VALID;
3609
3610	if ((sk = sk_X509_new_null()) == NULL) {
3611	SSLfatal(s, SSL_AD_INTERNAL_ERROR, SSL_F_TLS_PROCESS_CLIENT_CERTIFICATE,
3612	ERR_R_MALLOC_FAILURE);
3613	goto err;
3614	}
3615
3616	if (SSL_IS_TLS13(s) && (!PACKET_get_length_prefixed_1(pkt, &context)
3617	\|\| (s->pha_context == NULL && PACKET_remaining(&context) != 0)
3618	\|\| (s->pha_context != NULL &&
3619	!PACKET_equal(&context, s->pha_context, s->pha_context_len)))) {
3620	SSLfatal(s, SSL_AD_DECODE_ERROR, SSL_F_TLS_PROCESS_CLIENT_CERTIFICATE,
3621	SSL_R_INVALID_CONTEXT);
3622	goto err;
3623	}
3624
3625	if (!PACKET_get_length_prefixed_3(pkt, &spkt)
3626	\|\| PACKET_remaining(pkt) != 0) {
3627	SSLfatal(s, SSL_AD_DECODE_ERROR, SSL_F_TLS_PROCESS_CLIENT_CERTIFICATE,
3628	SSL_R_LENGTH_MISMATCH);
3629	goto err;
3630	}
3631
3632	for (chainidx = 0; PACKET_remaining(&spkt) > 0; chainidx++) {
3633	if (!PACKET_get_net_3(&spkt, &l)
3634	\|\| !PACKET_get_bytes(&spkt, &certbytes, l)) {
3635	SSLfatal(s, SSL_AD_DECODE_ERROR,
3636	SSL_F_TLS_PROCESS_CLIENT_CERTIFICATE,
3637	SSL_R_CERT_LENGTH_MISMATCH);
3638	goto err;
3639	}
3640
3641	certstart = certbytes;
3642	x = d2i_X509(NULL, (const unsigned char **)&certbytes, l);
3643	if (x == NULL) {
3644	SSLfatal(s, SSL_AD_DECODE_ERROR,
3645	SSL_F_TLS_PROCESS_CLIENT_CERTIFICATE, ERR_R_ASN1_LIB);
3646	goto err;
3647	}
3648	if (certbytes != (certstart + l)) {
3649	SSLfatal(s, SSL_AD_DECODE_ERROR,
3650	SSL_F_TLS_PROCESS_CLIENT_CERTIFICATE,
3651	SSL_R_CERT_LENGTH_MISMATCH);
3652	goto err;
3653	}
3654
3655	if (SSL_IS_TLS13(s)) {
3656	RAW_EXTENSION *rawexts = NULL;
3657	PACKET extensions;
3658
3659	if (!PACKET_get_length_prefixed_2(&spkt, &extensions)) {
3660	SSLfatal(s, SSL_AD_DECODE_ERROR,
3661	SSL_F_TLS_PROCESS_CLIENT_CERTIFICATE,
3662	SSL_R_BAD_LENGTH);
3663	goto err;
3664	}
3665	if (!tls_collect_extensions(s, &extensions,
3666	SSL_EXT_TLS1_3_CERTIFICATE, &rawexts,
3667	NULL, chainidx == 0)
3668	\|\| !tls_parse_all_extensions(s, SSL_EXT_TLS1_3_CERTIFICATE,
3669	rawexts, x, chainidx,
3670	PACKET_remaining(&spkt) == 0)) {
3671	OPENSSL_free(rawexts);
3672	goto err;
3673	}
3674	OPENSSL_free(rawexts);
3675	}
3676
3677	if (!sk_X509_push(sk, x)) {
3678	SSLfatal(s, SSL_AD_INTERNAL_ERROR,
3679	SSL_F_TLS_PROCESS_CLIENT_CERTIFICATE,
3680	ERR_R_MALLOC_FAILURE);
3681	goto err;
3682	}
3683	x = NULL;
3684	}
3685
3686	if (sk_X509_num(sk) <= 0) {
3687	/* TLS does not mind 0 certs returned */
3688	if (s->version == SSL3_VERSION) {
3689	SSLfatal(s, SSL_AD_HANDSHAKE_FAILURE,
3690	SSL_F_TLS_PROCESS_CLIENT_CERTIFICATE,
3691	SSL_R_NO_CERTIFICATES_RETURNED);
3692	goto err;
3693	}
3694	/* Fail for TLS only if we required a certificate */
3695	else if ((s->verify_mode & SSL_VERIFY_PEER) &&
3696	(s->verify_mode & SSL_VERIFY_FAIL_IF_NO_PEER_CERT)) {
3697	SSLfatal(s, SSL_AD_CERTIFICATE_REQUIRED,
3698	SSL_F_TLS_PROCESS_CLIENT_CERTIFICATE,
3699	SSL_R_PEER_DID_NOT_RETURN_A_CERTIFICATE);
3700	goto err;
3701	}
3702	/* No client certificate so digest cached records */
3703	if (s->s3->handshake_buffer && !ssl3_digest_cached_records(s, 0)) {
3704	/* SSLfatal() already called */
3705	goto err;
3706	}
3707	} else {
3708	EVP_PKEY *pkey;
3709	i = ssl_verify_cert_chain(s, sk);
3710	if (i <= 0) {
3711	SSLfatal(s, ssl_x509err2alert(s->verify_result),
3712	SSL_F_TLS_PROCESS_CLIENT_CERTIFICATE,
3713	SSL_R_CERTIFICATE_VERIFY_FAILED);
3714	goto err;
3715	}
3716	if (i > 1) {
3717	SSLfatal(s, SSL_AD_HANDSHAKE_FAILURE,
3718	SSL_F_TLS_PROCESS_CLIENT_CERTIFICATE, i);
3719	goto err;
3720	}
3721	pkey = X509_get0_pubkey(sk_X509_value(sk, 0));
3722	if (pkey == NULL) {
3723	SSLfatal(s, SSL_AD_HANDSHAKE_FAILURE,
3724	SSL_F_TLS_PROCESS_CLIENT_CERTIFICATE,
3725	SSL_R_UNKNOWN_CERTIFICATE_TYPE);
3726	goto err;
3727	}
3728	}
3729
3730	/*
3731	* Sessions must be immutable once they go into the session cache. Otherwise
3732	* we can get multi-thread problems. Therefore we don't "update" sessions,
3733	* we replace them with a duplicate. Here, we need to do this every time
3734	* a new certificate is received via post-handshake authentication, as the
3735	* session may have already gone into the session cache.
3736	*/
3737
3738	if (s->post_handshake_auth == SSL_PHA_REQUESTED) {
3739	if ((new_sess = ssl_session_dup(s->session, 0)) == 0) {
3740	SSLfatal(s, SSL_AD_INTERNAL_ERROR,
3741	SSL_F_TLS_PROCESS_CLIENT_CERTIFICATE,
3742	ERR_R_MALLOC_FAILURE);
3743	goto err;
3744	}
3745
3746	SSL_SESSION_free(s->session);
3747	s->session = new_sess;
3748	}
3749
3750	X509_free(s->session->peer);
3751	s->session->peer = sk_X509_shift(sk);
3752	s->session->verify_result = s->verify_result;
3753
3754	sk_X509_pop_free(s->session->peer_chain, X509_free);
3755	s->session->peer_chain = sk;
3756
3757	/*
3758	* Freeze the handshake buffer. For <TLS1.3 we do this after the CKE
3759	* message
3760	*/
3761	if (SSL_IS_TLS13(s) && !ssl3_digest_cached_records(s, 1)) {
3762	/* SSLfatal() already called */
3763	goto err;
3764	}
3765
3766	/*
3767	* Inconsistency alert: cert_chain does not include the peer's own
3768	* certificate, while we do include it in statem_clnt.c
3769	*/
3770	sk = NULL;
3771
3772	/* Save the current hash state for when we receive the CertificateVerify */
3773	if (SSL_IS_TLS13(s)) {
3774	if (!ssl_handshake_hash(s, s->cert_verify_hash,
3775	sizeof(s->cert_verify_hash),
3776	&s->cert_verify_hash_len)) {
3777	/* SSLfatal() already called */
3778	goto err;
3779	}
3780
3781	/* Resend session tickets */
3782	s->sent_tickets = 0;
3783	}
3784
3785	ret = MSG_PROCESS_CONTINUE_READING;
3786
3787	err:
3788	X509_free(x);
3789	sk_X509_pop_free(sk, X509_free);
3790	return ret;
3791	}
3792
3793	int tls_construct_server_certificate(SSL s, WPACKET pkt)
3794	{
3795	CERT_PKEY *cpk = s->s3->tmp.cert;
3796
3797	if (cpk == NULL) {
3798	SSLfatal(s, SSL_AD_INTERNAL_ERROR,
3799	SSL_F_TLS_CONSTRUCT_SERVER_CERTIFICATE, ERR_R_INTERNAL_ERROR);
3800	return 0;
3801	}
3802
3803	/*
3804	* In TLSv1.3 the certificate chain is always preceded by a 0 length context
3805	* for the server Certificate message
3806	*/
3807	if (SSL_IS_TLS13(s) && !WPACKET_put_bytes_u8(pkt, 0)) {
3808	SSLfatal(s, SSL_AD_INTERNAL_ERROR,
3809	SSL_F_TLS_CONSTRUCT_SERVER_CERTIFICATE, ERR_R_INTERNAL_ERROR);
3810	return 0;
3811	}
3812	if (!ssl3_output_cert_chain(s, pkt, cpk)) {
3813	/* SSLfatal() already called */
3814	return 0;
3815	}
3816
3817	return 1;
3818	}
3819
3820	static int create_ticket_prequel(SSL s, WPACKET pkt, uint32_t age_add,
3821	unsigned char *tick_nonce)
3822	{
3823	/*
3824	* Ticket lifetime hint: For TLSv1.2 this is advisory only and we leave this
3825	* unspecified for resumed session (for simplicity).
3826	* In TLSv1.3 we reset the "time" field above, and always specify the
3827	* timeout.
3828	*/
3829	if (!WPACKET_put_bytes_u32(pkt,
3830	(s->hit && !SSL_IS_TLS13(s))
3831	? 0 : s->session->timeout)) {
3832	SSLfatal(s, SSL_AD_INTERNAL_ERROR, SSL_F_CREATE_TICKET_PREQUEL,
3833	ERR_R_INTERNAL_ERROR);
3834	return 0;
3835	}
3836
3837	if (SSL_IS_TLS13(s)) {
3838	if (!WPACKET_put_bytes_u32(pkt, age_add)
3839	\|\| !WPACKET_sub_memcpy_u8(pkt, tick_nonce, TICKET_NONCE_SIZE)) {
3840	SSLfatal(s, SSL_AD_INTERNAL_ERROR, SSL_F_CREATE_TICKET_PREQUEL,
3841	ERR_R_INTERNAL_ERROR);
3842	return 0;
3843	}
3844	}
3845
3846	/* Start the sub-packet for the actual ticket data */
3847	if (!WPACKET_start_sub_packet_u16(pkt)) {
3848	SSLfatal(s, SSL_AD_INTERNAL_ERROR, SSL_F_CREATE_TICKET_PREQUEL,
3849	ERR_R_INTERNAL_ERROR);
3850	return 0;
3851	}
3852
3853	return 1;
3854	}
3855
3856	static int construct_stateless_ticket(SSL s, WPACKET pkt, uint32_t age_add,
3857	unsigned char *tick_nonce)
3858	{
3859	unsigned char *senc = NULL;
3860	EVP_CIPHER_CTX *ctx = NULL;
3861	HMAC_CTX *hctx = NULL;
3862	unsigned char p, encdata1, encdata2, macdata1, *macdata2;
3863	const unsigned char *const_p;
3864	int len, slen_full, slen, lenfinal;
3865	SSL_SESSION *sess;
3866	unsigned int hlen;
3867	SSL_CTX *tctx = s->session_ctx;
3868	unsigned char iv[EVP_MAX_IV_LENGTH];
3869	unsigned char key_name[TLSEXT_KEYNAME_LENGTH];
3870	int iv_len, ok = 0;
3871	size_t macoffset, macendoffset;
3872
3873	/* get session encoding length */
3874	slen_full = i2d_SSL_SESSION(s->session, NULL);
3875	/*
3876	* Some length values are 16 bits, so forget it if session is too
3877	* long
3878	*/
3879	if (slen_full == 0 \|\| slen_full > 0xFF00) {
3880	SSLfatal(s, SSL_AD_INTERNAL_ERROR, SSL_F_CONSTRUCT_STATELESS_TICKET,
3881	ERR_R_INTERNAL_ERROR);
3882	goto err;
3883	}
3884	senc = OPENSSL_malloc(slen_full);
3885	if (senc == NULL) {
3886	SSLfatal(s, SSL_AD_INTERNAL_ERROR,
3887	SSL_F_CONSTRUCT_STATELESS_TICKET, ERR_R_MALLOC_FAILURE);
3888	goto err;
3889	}
3890
3891	ctx = EVP_CIPHER_CTX_new();
3892	hctx = HMAC_CTX_new();
3893	if (ctx == NULL \|\| hctx == NULL) {
3894	SSLfatal(s, SSL_AD_INTERNAL_ERROR, SSL_F_CONSTRUCT_STATELESS_TICKET,
3895	ERR_R_MALLOC_FAILURE);
3896	goto err;
3897	}
3898
3899	p = senc;
3900	if (!i2d_SSL_SESSION(s->session, &p)) {
3901	SSLfatal(s, SSL_AD_INTERNAL_ERROR, SSL_F_CONSTRUCT_STATELESS_TICKET,
3902	ERR_R_INTERNAL_ERROR);
3903	goto err;
3904	}
3905
3906	/*
3907	* create a fresh copy (not shared with other threads) to clean up
3908	*/
3909	const_p = senc;
3910	sess = d2i_SSL_SESSION(NULL, &const_p, slen_full);
3911	if (sess == NULL) {
3912	SSLfatal(s, SSL_AD_INTERNAL_ERROR, SSL_F_CONSTRUCT_STATELESS_TICKET,
3913	ERR_R_INTERNAL_ERROR);
3914	goto err;
3915	}
3916
3917	slen = i2d_SSL_SESSION(sess, NULL);
3918	if (slen == 0 \|\| slen > slen_full) {
3919	/* shouldn't ever happen */
3920	SSLfatal(s, SSL_AD_INTERNAL_ERROR, SSL_F_CONSTRUCT_STATELESS_TICKET,
3921	ERR_R_INTERNAL_ERROR);
3922	SSL_SESSION_free(sess);
3923	goto err;
3924	}
3925	p = senc;
3926	if (!i2d_SSL_SESSION(sess, &p)) {
3927	SSLfatal(s, SSL_AD_INTERNAL_ERROR, SSL_F_CONSTRUCT_STATELESS_TICKET,
3928	ERR_R_INTERNAL_ERROR);
3929	SSL_SESSION_free(sess);
3930	goto err;
3931	}
3932	SSL_SESSION_free(sess);
3933
3934	/*
3935	* Initialize HMAC and cipher contexts. If callback present it does
3936	* all the work otherwise use generated values from parent ctx.
3937	*/
3938	if (tctx->ext.ticket_key_cb) {
3939	/* if 0 is returned, write an empty ticket */
3940	int ret = tctx->ext.ticket_key_cb(s, key_name, iv, ctx,
3941	hctx, 1);
3942
3943	if (ret == 0) {
3944
3945	/* Put timeout and length */
3946	if (!WPACKET_put_bytes_u32(pkt, 0)
3947	\|\| !WPACKET_put_bytes_u16(pkt, 0)) {
3948	SSLfatal(s, SSL_AD_INTERNAL_ERROR,
3949	SSL_F_CONSTRUCT_STATELESS_TICKET,
3950	ERR_R_INTERNAL_ERROR);
3951	goto err;
3952	}
3953	OPENSSL_free(senc);
3954	EVP_CIPHER_CTX_free(ctx);
3955	HMAC_CTX_free(hctx);
3956	return 1;
3957	}
3958	if (ret < 0) {
3959	SSLfatal(s, SSL_AD_INTERNAL_ERROR, SSL_F_CONSTRUCT_STATELESS_TICKET,
3960	SSL_R_CALLBACK_FAILED);
3961	goto err;
3962	}
3963	iv_len = EVP_CIPHER_CTX_iv_length(ctx);
3964	} else {
3965	const EVP_CIPHER *cipher = EVP_aes_256_cbc();
3966
3967	iv_len = EVP_CIPHER_iv_length(cipher);
3968	if (RAND_bytes(iv, iv_len) <= 0
3969	\|\| !EVP_EncryptInit_ex(ctx, cipher, NULL,
3970	tctx->ext.secure->tick_aes_key, iv)
3971	\|\| !HMAC_Init_ex(hctx, tctx->ext.secure->tick_hmac_key,
3972	sizeof(tctx->ext.secure->tick_hmac_key),
3973	EVP_sha256(), NULL)) {
3974	SSLfatal(s, SSL_AD_INTERNAL_ERROR, SSL_F_CONSTRUCT_STATELESS_TICKET,
3975	ERR_R_INTERNAL_ERROR);
3976	goto err;
3977	}
3978	memcpy(key_name, tctx->ext.tick_key_name,
3979	sizeof(tctx->ext.tick_key_name));
3980	}
3981
3982	if (!create_ticket_prequel(s, pkt, age_add, tick_nonce)) {
3983	/* SSLfatal() already called */
3984	goto err;
3985	}
3986
3987	if (!WPACKET_get_total_written(pkt, &macoffset)
3988	/* Output key name */
3989	\|\| !WPACKET_memcpy(pkt, key_name, sizeof(key_name))
3990	/* output IV */
3991	\|\| !WPACKET_memcpy(pkt, iv, iv_len)
3992	\|\| !WPACKET_reserve_bytes(pkt, slen + EVP_MAX_BLOCK_LENGTH,
3993	&encdata1)
3994	/* Encrypt session data */
3995	\|\| !EVP_EncryptUpdate(ctx, encdata1, &len, senc, slen)
3996	\|\| !WPACKET_allocate_bytes(pkt, len, &encdata2)
3997	\|\| encdata1 != encdata2
3998	\|\| !EVP_EncryptFinal(ctx, encdata1 + len, &lenfinal)
3999	\|\| !WPACKET_allocate_bytes(pkt, lenfinal, &encdata2)
4000	\|\| encdata1 + len != encdata2
4001	\|\| len + lenfinal > slen + EVP_MAX_BLOCK_LENGTH
4002	\|\| !WPACKET_get_total_written(pkt, &macendoffset)
4003	\|\| !HMAC_Update(hctx,
4004	(unsigned char *)s->init_buf->data + macoffset,
4005	macendoffset - macoffset)
4006	\|\| !WPACKET_reserve_bytes(pkt, EVP_MAX_MD_SIZE, &macdata1)
4007	\|\| !HMAC_Final(hctx, macdata1, &hlen)
4008	\|\| hlen > EVP_MAX_MD_SIZE
4009	\|\| !WPACKET_allocate_bytes(pkt, hlen, &macdata2)
4010	\|\| macdata1 != macdata2) {
4011	SSLfatal(s, SSL_AD_INTERNAL_ERROR,
4012	SSL_F_CONSTRUCT_STATELESS_TICKET, ERR_R_INTERNAL_ERROR);
4013	goto err;
4014	}
4015
4016	/* Close the sub-packet created by create_ticket_prequel() */
4017	if (!WPACKET_close(pkt)) {
4018	SSLfatal(s, SSL_AD_INTERNAL_ERROR, SSL_F_CONSTRUCT_STATELESS_TICKET,
4019	ERR_R_INTERNAL_ERROR);
4020	goto err;
4021	}
4022
4023	ok = 1;
4024	err:
4025	OPENSSL_free(senc);
4026	EVP_CIPHER_CTX_free(ctx);
4027	HMAC_CTX_free(hctx);
4028	return ok;
4029	}
4030
4031	static int construct_stateful_ticket(SSL s, WPACKET pkt, uint32_t age_add,
4032	unsigned char *tick_nonce)
4033	{
4034	if (!create_ticket_prequel(s, pkt, age_add, tick_nonce)) {
4035	/* SSLfatal() already called */
4036	return 0;
4037	}
4038
4039	if (!WPACKET_memcpy(pkt, s->session->session_id,
4040	s->session->session_id_length)
4041	\|\| !WPACKET_close(pkt)) {
4042	SSLfatal(s, SSL_AD_INTERNAL_ERROR, SSL_F_CONSTRUCT_STATEFUL_TICKET,
4043	ERR_R_INTERNAL_ERROR);
4044	return 0;
4045	}
4046
4047	return 1;
4048	}
4049
4050	int tls_construct_new_session_ticket(SSL s, WPACKET pkt)
4051	{
4052	SSL_CTX *tctx = s->session_ctx;
4053	unsigned char tick_nonce[TICKET_NONCE_SIZE];
4054	union {
4055	unsigned char age_add_c[sizeof(uint32_t)];
4056	uint32_t age_add;
4057	} age_add_u;
4058
4059	age_add_u.age_add = 0;
4060
4061	if (SSL_IS_TLS13(s)) {
4062	size_t i, hashlen;
4063	uint64_t nonce;
4064	static const unsigned char nonce_label[] = "resumption";
4065	const EVP_MD *md = ssl_handshake_md(s);
4066	int hashleni = EVP_MD_size(md);
4067
4068	/* Ensure cast to size_t is safe */
4069	if (!ossl_assert(hashleni >= 0)) {
4070	SSLfatal(s, SSL_AD_INTERNAL_ERROR,
4071	SSL_F_TLS_CONSTRUCT_NEW_SESSION_TICKET,
4072	ERR_R_INTERNAL_ERROR);
4073	goto err;
4074	}
4075	hashlen = (size_t)hashleni;
4076
4077	/*
4078	* If we already sent one NewSessionTicket, or we resumed then
4079	* s->session may already be in a cache and so we must not modify it.
4080	* Instead we need to take a copy of it and modify that.
4081	*/
4082	if (s->sent_tickets != 0 \|\| s->hit) {
4083	SSL_SESSION *new_sess = ssl_session_dup(s->session, 0);
4084
4085	if (new_sess == NULL) {
4086	/* SSLfatal already called */
4087	goto err;
4088	}
4089
4090	SSL_SESSION_free(s->session);
4091	s->session = new_sess;
4092	}
4093
4094	if (!ssl_generate_session_id(s, s->session)) {
4095	/* SSLfatal() already called */
4096	goto err;
4097	}
4098	if (RAND_bytes(age_add_u.age_add_c, sizeof(age_add_u)) <= 0) {
4099	SSLfatal(s, SSL_AD_INTERNAL_ERROR,
4100	SSL_F_TLS_CONSTRUCT_NEW_SESSION_TICKET,
4101	ERR_R_INTERNAL_ERROR);
4102	goto err;
4103	}
4104	s->session->ext.tick_age_add = age_add_u.age_add;
4105
4106	nonce = s->next_ticket_nonce;
4107	for (i = TICKET_NONCE_SIZE; i > 0; i--) {
4108	tick_nonce[i - 1] = (unsigned char)(nonce & 0xff);
4109	nonce >>= 8;
4110	}
4111
4112	if (!tls13_hkdf_expand(s, md, s->resumption_master_secret,
4113	nonce_label,
4114	sizeof(nonce_label) - 1,
4115	tick_nonce,
4116	TICKET_NONCE_SIZE,
4117	s->session->master_key,
4118	hashlen, 1)) {
4119	/* SSLfatal() already called */
4120	goto err;
4121	}
4122	s->session->master_key_length = hashlen;
4123
4124	s->session->time = (long)time(NULL);
4125	if (s->s3->alpn_selected != NULL) {
4126	OPENSSL_free(s->session->ext.alpn_selected);
4127	s->session->ext.alpn_selected =
4128	OPENSSL_memdup(s->s3->alpn_selected, s->s3->alpn_selected_len);
4129	if (s->session->ext.alpn_selected == NULL) {
4130	s->session->ext.alpn_selected_len = 0;
4131	SSLfatal(s, SSL_AD_INTERNAL_ERROR,
4132	SSL_F_TLS_CONSTRUCT_NEW_SESSION_TICKET,
4133	ERR_R_MALLOC_FAILURE);
4134	goto err;
4135	}
4136	s->session->ext.alpn_selected_len = s->s3->alpn_selected_len;
4137	}
4138	s->session->ext.max_early_data = s->max_early_data;
4139	}
4140
4141	if (tctx->generate_ticket_cb != NULL &&
4142	tctx->generate_ticket_cb(s, tctx->ticket_cb_data) == 0)
4143	goto err;
4144
4145	/*
4146	* If we are using anti-replay protection then we behave as if
4147	* SSL_OP_NO_TICKET is set - we are caching tickets anyway so there
4148	* is no point in using full stateless tickets.
4149	*/
4150	if (SSL_IS_TLS13(s)
4151	&& ((s->options & SSL_OP_NO_TICKET) != 0
4152	\|\| (s->max_early_data > 0
4153	&& (s->options & SSL_OP_NO_ANTI_REPLAY) == 0))) {
4154	if (!construct_stateful_ticket(s, pkt, age_add_u.age_add, tick_nonce)) {
4155	/* SSLfatal() already called */
4156	goto err;
4157	}
4158	} else if (!construct_stateless_ticket(s, pkt, age_add_u.age_add,
4159	tick_nonce)) {
4160	/* SSLfatal() already called */
4161	goto err;
4162	}
4163
4164	if (SSL_IS_TLS13(s)) {
4165	if (!tls_construct_extensions(s, pkt,
4166	SSL_EXT_TLS1_3_NEW_SESSION_TICKET,
4167	NULL, 0)) {
4168	/* SSLfatal() already called */
4169	goto err;
4170	}
4171	/*
4172	* Increment both \|sent_tickets\| and \|next_ticket_nonce\|. \|sent_tickets\|
4173	* gets reset to 0 if we send more tickets following a post-handshake
4174	* auth, but \|next_ticket_nonce\| does not.
4175	*/
4176	s->sent_tickets++;
4177	s->next_ticket_nonce++;
4178	ssl_update_cache(s, SSL_SESS_CACHE_SERVER);
4179	}
4180
4181	return 1;
4182	err:
4183	return 0;
4184	}
4185
4186	/*
4187	* In TLSv1.3 this is called from the extensions code, otherwise it is used to
4188	* create a separate message. Returns 1 on success or 0 on failure.
4189	*/
4190	int tls_construct_cert_status_body(SSL s, WPACKET pkt)
4191	{
4192	if (!WPACKET_put_bytes_u8(pkt, s->ext.status_type)
4193	\|\| !WPACKET_sub_memcpy_u24(pkt, s->ext.ocsp.resp,
4194	s->ext.ocsp.resp_len)) {
4195	SSLfatal(s, SSL_AD_INTERNAL_ERROR, SSL_F_TLS_CONSTRUCT_CERT_STATUS_BODY,
4196	ERR_R_INTERNAL_ERROR);
4197	return 0;
4198	}
4199
4200	return 1;
4201	}
4202
4203	int tls_construct_cert_status(SSL s, WPACKET pkt)
4204	{
4205	if (!tls_construct_cert_status_body(s, pkt)) {
4206	/* SSLfatal() already called */
4207	return 0;
4208	}
4209
4210	return 1;
4211	}
4212
4213	#ifndef OPENSSL_NO_NEXTPROTONEG
4214	/*
4215	* tls_process_next_proto reads a Next Protocol Negotiation handshake message.
4216	* It sets the next_proto member in s if found
4217	*/
4218	MSG_PROCESS_RETURN tls_process_next_proto(SSL s, PACKET pkt)
4219	{
4220	PACKET next_proto, padding;
4221	size_t next_proto_len;
4222
4223	/*-
4224	* The payload looks like:
4225	* uint8 proto_len;
4226	* uint8 proto[proto_len];
4227	* uint8 padding_len;
4228	* uint8 padding[padding_len];
4229	*/
4230	if (!PACKET_get_length_prefixed_1(pkt, &next_proto)
4231	\|\| !PACKET_get_length_prefixed_1(pkt, &padding)
4232	\|\| PACKET_remaining(pkt) > 0) {
4233	SSLfatal(s, SSL_AD_DECODE_ERROR, SSL_F_TLS_PROCESS_NEXT_PROTO,
4234	SSL_R_LENGTH_MISMATCH);
4235	return MSG_PROCESS_ERROR;
4236	}
4237
4238	if (!PACKET_memdup(&next_proto, &s->ext.npn, &next_proto_len)) {
4239	s->ext.npn_len = 0;
4240	SSLfatal(s, SSL_AD_INTERNAL_ERROR, SSL_F_TLS_PROCESS_NEXT_PROTO,
4241	ERR_R_INTERNAL_ERROR);
4242	return MSG_PROCESS_ERROR;
4243	}
4244
4245	s->ext.npn_len = (unsigned char)next_proto_len;
4246
4247	return MSG_PROCESS_CONTINUE_READING;
4248	}
4249	#endif
4250
4251	static int tls_construct_encrypted_extensions(SSL s, WPACKET pkt)
4252	{
4253	if (!tls_construct_extensions(s, pkt, SSL_EXT_TLS1_3_ENCRYPTED_EXTENSIONS,
4254	NULL, 0)) {
4255	/* SSLfatal() already called */
4256	return 0;
4257	}
4258
4259	return 1;
4260	}
4261
4262	MSG_PROCESS_RETURN tls_process_end_of_early_data(SSL s, PACKET pkt)
4263	{
4264	if (PACKET_remaining(pkt) != 0) {
4265	SSLfatal(s, SSL_AD_DECODE_ERROR, SSL_F_TLS_PROCESS_END_OF_EARLY_DATA,
4266	SSL_R_LENGTH_MISMATCH);
4267	return MSG_PROCESS_ERROR;
4268	}
4269
4270	if (s->early_data_state != SSL_EARLY_DATA_READING
4271	&& s->early_data_state != SSL_EARLY_DATA_READ_RETRY) {
4272	SSLfatal(s, SSL_AD_INTERNAL_ERROR, SSL_F_TLS_PROCESS_END_OF_EARLY_DATA,
4273	ERR_R_INTERNAL_ERROR);
4274	return MSG_PROCESS_ERROR;
4275	}
4276
4277	/*
4278	* EndOfEarlyData signals a key change so the end of the message must be on
4279	* a record boundary.
4280	*/
4281	if (RECORD_LAYER_processed_read_pending(&s->rlayer)) {
4282	SSLfatal(s, SSL_AD_UNEXPECTED_MESSAGE,
4283	SSL_F_TLS_PROCESS_END_OF_EARLY_DATA,
4284	SSL_R_NOT_ON_RECORD_BOUNDARY);
4285	return MSG_PROCESS_ERROR;
4286	}
4287
4288	s->early_data_state = SSL_EARLY_DATA_FINISHED_READING;
4289	if (!s->method->ssl3_enc->change_cipher_state(s,
4290	SSL3_CC_HANDSHAKE \| SSL3_CHANGE_CIPHER_SERVER_READ)) {
4291	/* SSLfatal() already called */
4292	return MSG_PROCESS_ERROR;
4293	}
4294
4295	return MSG_PROCESS_CONTINUE_READING;
4296	}

Note: See TracBrowser for help on using the repository browser.

source: vbox/trunk/src/libs/openssl-1.1.1k/ssl/statem/statem_srvr.c@ 91527

Download in other formats: