ssl_lib.c

Last change on this file was 109052, checked in by vboxsync, 4 weeks ago
openssl-3.4.1: Applied our changes, regenerated files, added missing files and functions. This time with a three way merge. bugref:10890
Property svn:eol-style set to `native` Property svn:keywords set to `Author Date Id Revision`
File size: 211.4 KB

Line
1	/*
2	* Copyright 1995-2024 The OpenSSL Project Authors. All Rights Reserved.
3	* Copyright (c) 2002, Oracle and/or its affiliates. All rights reserved
4	* Copyright 2005 Nokia. All rights reserved.
5	*
6	* Licensed under the Apache License 2.0 (the "License"). You may not use
7	* this file except in compliance with the License. You can obtain a copy
8	* in the file LICENSE in the source distribution or at
9	* https://www.openssl.org/source/license.html
10	*/
11
12	#include "ssl_local.h"
13	#include "internal/e_os.h"
14	#include <openssl/objects.h>
15	#include <openssl/x509v3.h>
16	#include <openssl/rand.h>
17	#include <openssl/ocsp.h>
18	#include <openssl/dh.h>
19	#include <openssl/engine.h>
20	#include <openssl/async.h>
21	#include <openssl/ct.h>
22	#include <openssl/trace.h>
23	#include <openssl/core_names.h>
24	#include <openssl/provider.h>
25	#include "internal/cryptlib.h"
26	#include "internal/nelem.h"
27	#include "internal/refcount.h"
28	#include "internal/ktls.h"
29	#include "internal/to_hex.h"
30	#include "quic/quic_local.h"
31
32	static int ssl_undefined_function_3(SSL_CONNECTION sc, unsigned char r,
33	unsigned char s, size_t t, size_t u)
34	{
35	return ssl_undefined_function(SSL_CONNECTION_GET_SSL(sc));
36	}
37
38	static int ssl_undefined_function_4(SSL_CONNECTION *sc, int r)
39	{
40	return ssl_undefined_function(SSL_CONNECTION_GET_SSL(sc));
41	}
42
43	static size_t ssl_undefined_function_5(SSL_CONNECTION sc, const char r,
44	size_t s, unsigned char *t)
45	{
46	return ssl_undefined_function(SSL_CONNECTION_GET_SSL(sc));
47	}
48
49	static int ssl_undefined_function_6(int r)
50	{
51	return ssl_undefined_function(NULL);
52	}
53
54	static int ssl_undefined_function_7(SSL_CONNECTION sc, unsigned char r,
55	size_t s, const char *t, size_t u,
56	const unsigned char *v, size_t w, int x)
57	{
58	return ssl_undefined_function(SSL_CONNECTION_GET_SSL(sc));
59	}
60
61	static int ssl_undefined_function_8(SSL_CONNECTION *sc)
62	{
63	return ssl_undefined_function(SSL_CONNECTION_GET_SSL(sc));
64	}
65
66	const SSL3_ENC_METHOD ssl3_undef_enc_method = {
67	ssl_undefined_function_8,
68	ssl_undefined_function_3,
69	ssl_undefined_function_4,
70	ssl_undefined_function_5,
71	NULL, /* client_finished_label */
72	0, /* client_finished_label_len */
73	NULL, /* server_finished_label */
74	0, /* server_finished_label_len */
75	ssl_undefined_function_6,
76	ssl_undefined_function_7,
77	};
78
79	struct ssl_async_args {
80	SSL *s;
81	void *buf;
82	size_t num;
83	enum { READFUNC, WRITEFUNC, OTHERFUNC } type;
84	union {
85	int (func_read) (SSL , void , size_t, size_t );
86	int (func_write) (SSL , const void , size_t, size_t );
87	int (func_other) (SSL );
88	} f;
89	};
90
91	static const struct {
92	uint8_t mtype;
93	uint8_t ord;
94	int nid;
95	} dane_mds[] = {
96	{
97	DANETLS_MATCHING_FULL, 0, NID_undef
98	},
99	{
100	DANETLS_MATCHING_2256, 1, NID_sha256
101	},
102	{
103	DANETLS_MATCHING_2512, 2, NID_sha512
104	},
105	};
106
107	static int dane_ctx_enable(struct dane_ctx_st *dctx)
108	{
109	const EVP_MD **mdevp;
110	uint8_t *mdord;
111	uint8_t mdmax = DANETLS_MATCHING_LAST;
112	int n = ((int)mdmax) + 1; /* int to handle PrivMatch(255) */
113	size_t i;
114
115	if (dctx->mdevp != NULL)
116	return 1;
117
118	mdevp = OPENSSL_zalloc(n * sizeof(*mdevp));
119	mdord = OPENSSL_zalloc(n * sizeof(*mdord));
120
121	if (mdord == NULL \|\| mdevp == NULL) {
122	OPENSSL_free(mdord);
123	OPENSSL_free(mdevp);
124	return 0;
125	}
126
127	/* Install default entries */
128	for (i = 0; i < OSSL_NELEM(dane_mds); ++i) {
129	const EVP_MD *md;
130
131	if (dane_mds[i].nid == NID_undef \|\|
132	(md = EVP_get_digestbynid(dane_mds[i].nid)) == NULL)
133	continue;
134	mdevp[dane_mds[i].mtype] = md;
135	mdord[dane_mds[i].mtype] = dane_mds[i].ord;
136	}
137
138	dctx->mdevp = mdevp;
139	dctx->mdord = mdord;
140	dctx->mdmax = mdmax;
141
142	return 1;
143	}
144
145	static void dane_ctx_final(struct dane_ctx_st *dctx)
146	{
147	OPENSSL_free(dctx->mdevp);
148	dctx->mdevp = NULL;
149
150	OPENSSL_free(dctx->mdord);
151	dctx->mdord = NULL;
152	dctx->mdmax = 0;
153	}
154
155	static void tlsa_free(danetls_record *t)
156	{
157	if (t == NULL)
158	return;
159	OPENSSL_free(t->data);
160	EVP_PKEY_free(t->spki);
161	OPENSSL_free(t);
162	}
163
164	static void dane_final(SSL_DANE *dane)
165	{
166	sk_danetls_record_pop_free(dane->trecs, tlsa_free);
167	dane->trecs = NULL;
168
169	OSSL_STACK_OF_X509_free(dane->certs);
170	dane->certs = NULL;
171
172	X509_free(dane->mcert);
173	dane->mcert = NULL;
174	dane->mtlsa = NULL;
175	dane->mdpth = -1;
176	dane->pdpth = -1;
177	}
178
179	/*
180	* dane_copy - Copy dane configuration, sans verification state.
181	*/
182	static int ssl_dane_dup(SSL_CONNECTION to, SSL_CONNECTION from)
183	{
184	int num;
185	int i;
186
187	if (!DANETLS_ENABLED(&from->dane))
188	return 1;
189
190	num = sk_danetls_record_num(from->dane.trecs);
191	dane_final(&to->dane);
192	to->dane.flags = from->dane.flags;
193	to->dane.dctx = &SSL_CONNECTION_GET_CTX(to)->dane;
194	to->dane.trecs = sk_danetls_record_new_reserve(NULL, num);
195
196	if (to->dane.trecs == NULL) {
197	ERR_raise(ERR_LIB_SSL, ERR_R_CRYPTO_LIB);
198	return 0;
199	}
200
201	for (i = 0; i < num; ++i) {
202	danetls_record *t = sk_danetls_record_value(from->dane.trecs, i);
203
204	if (SSL_dane_tlsa_add(SSL_CONNECTION_GET_SSL(to), t->usage,
205	t->selector, t->mtype, t->data, t->dlen) <= 0)
206	return 0;
207	}
208	return 1;
209	}
210
211	static int dane_mtype_set(struct dane_ctx_st *dctx,
212	const EVP_MD *md, uint8_t mtype, uint8_t ord)
213	{
214	int i;
215
216	if (mtype == DANETLS_MATCHING_FULL && md != NULL) {
217	ERR_raise(ERR_LIB_SSL, SSL_R_DANE_CANNOT_OVERRIDE_MTYPE_FULL);
218	return 0;
219	}
220
221	if (mtype > dctx->mdmax) {
222	const EVP_MD **mdevp;
223	uint8_t *mdord;
224	int n = ((int)mtype) + 1;
225
226	mdevp = OPENSSL_realloc(dctx->mdevp, n * sizeof(*mdevp));
227	if (mdevp == NULL)
228	return -1;
229	dctx->mdevp = mdevp;
230
231	mdord = OPENSSL_realloc(dctx->mdord, n * sizeof(*mdord));
232	if (mdord == NULL)
233	return -1;
234	dctx->mdord = mdord;
235
236	/* Zero-fill any gaps */
237	for (i = dctx->mdmax + 1; i < mtype; ++i) {
238	mdevp[i] = NULL;
239	mdord[i] = 0;
240	}
241
242	dctx->mdmax = mtype;
243	}
244
245	dctx->mdevp[mtype] = md;
246	/* Coerce ordinal of disabled matching types to 0 */
247	dctx->mdord[mtype] = (md == NULL) ? 0 : ord;
248
249	return 1;
250	}
251
252	static const EVP_MD tlsa_md_get(SSL_DANE dane, uint8_t mtype)
253	{
254	if (mtype > dane->dctx->mdmax)
255	return NULL;
256	return dane->dctx->mdevp[mtype];
257	}
258
259	static int dane_tlsa_add(SSL_DANE *dane,
260	uint8_t usage,
261	uint8_t selector,
262	uint8_t mtype, const unsigned char *data, size_t dlen)
263	{
264	danetls_record *t;
265	const EVP_MD *md = NULL;
266	int ilen = (int)dlen;
267	int i;
268	int num;
269	int mdsize;
270
271	if (dane->trecs == NULL) {
272	ERR_raise(ERR_LIB_SSL, SSL_R_DANE_NOT_ENABLED);
273	return -1;
274	}
275
276	if (ilen < 0 \|\| dlen != (size_t)ilen) {
277	ERR_raise(ERR_LIB_SSL, SSL_R_DANE_TLSA_BAD_DATA_LENGTH);
278	return 0;
279	}
280
281	if (usage > DANETLS_USAGE_LAST) {
282	ERR_raise(ERR_LIB_SSL, SSL_R_DANE_TLSA_BAD_CERTIFICATE_USAGE);
283	return 0;
284	}
285
286	if (selector > DANETLS_SELECTOR_LAST) {
287	ERR_raise(ERR_LIB_SSL, SSL_R_DANE_TLSA_BAD_SELECTOR);
288	return 0;
289	}
290
291	if (mtype != DANETLS_MATCHING_FULL) {
292	md = tlsa_md_get(dane, mtype);
293	if (md == NULL) {
294	ERR_raise(ERR_LIB_SSL, SSL_R_DANE_TLSA_BAD_MATCHING_TYPE);
295	return 0;
296	}
297	}
298
299	if (md != NULL) {
300	mdsize = EVP_MD_get_size(md);
301	if (mdsize <= 0 \|\| dlen != (size_t)mdsize) {
302	ERR_raise(ERR_LIB_SSL, SSL_R_DANE_TLSA_BAD_DIGEST_LENGTH);
303	return 0;
304	}
305	}
306	if (!data) {
307	ERR_raise(ERR_LIB_SSL, SSL_R_DANE_TLSA_NULL_DATA);
308	return 0;
309	}
310
311	if ((t = OPENSSL_zalloc(sizeof(*t))) == NULL)
312	return -1;
313
314	t->usage = usage;
315	t->selector = selector;
316	t->mtype = mtype;
317	t->data = OPENSSL_malloc(dlen);
318	if (t->data == NULL) {
319	tlsa_free(t);
320	return -1;
321	}
322	memcpy(t->data, data, dlen);
323	t->dlen = dlen;
324
325	/* Validate and cache full certificate or public key */
326	if (mtype == DANETLS_MATCHING_FULL) {
327	const unsigned char *p = data;
328	X509 *cert = NULL;
329	EVP_PKEY *pkey = NULL;
330
331	switch (selector) {
332	case DANETLS_SELECTOR_CERT:
333	if (!d2i_X509(&cert, &p, ilen) \|\| p < data \|\|
334	dlen != (size_t)(p - data)) {
335	X509_free(cert);
336	tlsa_free(t);
337	ERR_raise(ERR_LIB_SSL, SSL_R_DANE_TLSA_BAD_CERTIFICATE);
338	return 0;
339	}
340	if (X509_get0_pubkey(cert) == NULL) {
341	X509_free(cert);
342	tlsa_free(t);
343	ERR_raise(ERR_LIB_SSL, SSL_R_DANE_TLSA_BAD_CERTIFICATE);
344	return 0;
345	}
346
347	if ((DANETLS_USAGE_BIT(usage) & DANETLS_TA_MASK) == 0) {
348	/*
349	* The Full(0) certificate decodes to a seemingly valid X.509
350	* object with a plausible key, so the TLSA record is well
351	* formed. However, we don't actually need the certificate for
352	* usages PKIX-EE(1) or DANE-EE(3), because at least the EE
353	* certificate is always presented by the peer. We discard the
354	* certificate, and just use the TLSA data as an opaque blob
355	* for matching the raw presented DER octets.
356	*
357	* DO NOT FREE `t` here, it will be added to the TLSA record
358	* list below!
359	*/
360	X509_free(cert);
361	break;
362	}
363
364	/*
365	* For usage DANE-TA(2), we support authentication via "2 0 0" TLSA
366	* records that contain full certificates of trust-anchors that are
367	* not present in the wire chain. For usage PKIX-TA(0), we augment
368	* the chain with untrusted Full(0) certificates from DNS, in case
369	* they are missing from the chain.
370	*/
371	if ((dane->certs == NULL &&
372	(dane->certs = sk_X509_new_null()) == NULL) \|\|
373	!sk_X509_push(dane->certs, cert)) {
374	ERR_raise(ERR_LIB_SSL, ERR_R_CRYPTO_LIB);
375	X509_free(cert);
376	tlsa_free(t);
377	return -1;
378	}
379	break;
380
381	case DANETLS_SELECTOR_SPKI:
382	if (!d2i_PUBKEY(&pkey, &p, ilen) \|\| p < data \|\|
383	dlen != (size_t)(p - data)) {
384	EVP_PKEY_free(pkey);
385	tlsa_free(t);
386	ERR_raise(ERR_LIB_SSL, SSL_R_DANE_TLSA_BAD_PUBLIC_KEY);
387	return 0;
388	}
389
390	/*
391	* For usage DANE-TA(2), we support authentication via "2 1 0" TLSA
392	* records that contain full bare keys of trust-anchors that are
393	* not present in the wire chain.
394	*/
395	if (usage == DANETLS_USAGE_DANE_TA)
396	t->spki = pkey;
397	else
398	EVP_PKEY_free(pkey);
399	break;
400	}
401	}
402
403	/*-
404	* Find the right insertion point for the new record.
405	*
406	* See crypto/x509/x509_vfy.c. We sort DANE-EE(3) records first, so that
407	* they can be processed first, as they require no chain building, and no
408	* expiration or hostname checks. Because DANE-EE(3) is numerically
409	* largest, this is accomplished via descending sort by "usage".
410	*
411	* We also sort in descending order by matching ordinal to simplify
412	* the implementation of digest agility in the verification code.
413	*
414	* The choice of order for the selector is not significant, so we
415	* use the same descending order for consistency.
416	*/
417	num = sk_danetls_record_num(dane->trecs);
418	for (i = 0; i < num; ++i) {
419	danetls_record *rec = sk_danetls_record_value(dane->trecs, i);
420
421	if (rec->usage > usage)
422	continue;
423	if (rec->usage < usage)
424	break;
425	if (rec->selector > selector)
426	continue;
427	if (rec->selector < selector)
428	break;
429	if (dane->dctx->mdord[rec->mtype] > dane->dctx->mdord[mtype])
430	continue;
431	break;
432	}
433
434	if (!sk_danetls_record_insert(dane->trecs, t, i)) {
435	tlsa_free(t);
436	ERR_raise(ERR_LIB_SSL, ERR_R_CRYPTO_LIB);
437	return -1;
438	}
439	dane->umask \|= DANETLS_USAGE_BIT(usage);
440
441	return 1;
442	}
443
444	/*
445	* Return 0 if there is only one version configured and it was disabled
446	* at configure time. Return 1 otherwise.
447	*/
448	static int ssl_check_allowed_versions(int min_version, int max_version)
449	{
450	int minisdtls = 0, maxisdtls = 0;
451
452	/* Figure out if we're doing DTLS versions or TLS versions */
453	if (min_version == DTLS1_BAD_VER
454	\|\| min_version >> 8 == DTLS1_VERSION_MAJOR)
455	minisdtls = 1;
456	if (max_version == DTLS1_BAD_VER
457	\|\| max_version >> 8 == DTLS1_VERSION_MAJOR)
458	maxisdtls = 1;
459	/* A wildcard version of 0 could be DTLS or TLS. */
460	if ((minisdtls && !maxisdtls && max_version != 0)
461	\|\| (maxisdtls && !minisdtls && min_version != 0)) {
462	/* Mixing DTLS and TLS versions will lead to sadness; deny it. */
463	return 0;
464	}
465
466	if (minisdtls \|\| maxisdtls) {
467	/* Do DTLS version checks. */
468	if (min_version == 0)
469	/* Ignore DTLS1_BAD_VER */
470	min_version = DTLS1_VERSION;
471	if (max_version == 0)
472	max_version = DTLS1_2_VERSION;
473	#ifdef OPENSSL_NO_DTLS1_2
474	if (max_version == DTLS1_2_VERSION)
475	max_version = DTLS1_VERSION;
476	#endif
477	#ifdef OPENSSL_NO_DTLS1
478	if (min_version == DTLS1_VERSION)
479	min_version = DTLS1_2_VERSION;
480	#endif
481	/* Done massaging versions; do the check. */
482	if (0
483	#ifdef OPENSSL_NO_DTLS1
484	\|\| (DTLS_VERSION_GE(min_version, DTLS1_VERSION)
485	&& DTLS_VERSION_GE(DTLS1_VERSION, max_version))
486	#endif
487	#ifdef OPENSSL_NO_DTLS1_2
488	\|\| (DTLS_VERSION_GE(min_version, DTLS1_2_VERSION)
489	&& DTLS_VERSION_GE(DTLS1_2_VERSION, max_version))
490	#endif
491	)
492	return 0;
493	} else {
494	/* Regular TLS version checks. */
495	if (min_version == 0)
496	min_version = SSL3_VERSION;
497	if (max_version == 0)
498	max_version = TLS1_3_VERSION;
499	#ifdef OPENSSL_NO_TLS1_3
500	if (max_version == TLS1_3_VERSION)
501	max_version = TLS1_2_VERSION;
502	#endif
503	#ifdef OPENSSL_NO_TLS1_2
504	if (max_version == TLS1_2_VERSION)
505	max_version = TLS1_1_VERSION;
506	#endif
507	#ifdef OPENSSL_NO_TLS1_1
508	if (max_version == TLS1_1_VERSION)
509	max_version = TLS1_VERSION;
510	#endif
511	#ifdef OPENSSL_NO_TLS1
512	if (max_version == TLS1_VERSION)
513	max_version = SSL3_VERSION;
514	#endif
515	#ifdef OPENSSL_NO_SSL3
516	if (min_version == SSL3_VERSION)
517	min_version = TLS1_VERSION;
518	#endif
519	#ifdef OPENSSL_NO_TLS1
520	if (min_version == TLS1_VERSION)
521	min_version = TLS1_1_VERSION;
522	#endif
523	#ifdef OPENSSL_NO_TLS1_1
524	if (min_version == TLS1_1_VERSION)
525	min_version = TLS1_2_VERSION;
526	#endif
527	#ifdef OPENSSL_NO_TLS1_2
528	if (min_version == TLS1_2_VERSION)
529	min_version = TLS1_3_VERSION;
530	#endif
531	/* Done massaging versions; do the check. */
532	if (0
533	#ifdef OPENSSL_NO_SSL3
534	\|\| (min_version <= SSL3_VERSION && SSL3_VERSION <= max_version)
535	#endif
536	#ifdef OPENSSL_NO_TLS1
537	\|\| (min_version <= TLS1_VERSION && TLS1_VERSION <= max_version)
538	#endif
539	#ifdef OPENSSL_NO_TLS1_1
540	\|\| (min_version <= TLS1_1_VERSION && TLS1_1_VERSION <= max_version)
541	#endif
542	#ifdef OPENSSL_NO_TLS1_2
543	\|\| (min_version <= TLS1_2_VERSION && TLS1_2_VERSION <= max_version)
544	#endif
545	#ifdef OPENSSL_NO_TLS1_3
546	\|\| (min_version <= TLS1_3_VERSION && TLS1_3_VERSION <= max_version)
547	#endif
548	)
549	return 0;
550	}
551	return 1;
552	}
553
554	#if defined(__TANDEM) && defined(OPENSSL_VPROC)
555	/*
556	* Define a VPROC function for HP NonStop build ssl library.
557	* This is used by platform version identification tools.
558	* Do not inline this procedure or make it static.
559	*/
560	# define OPENSSL_VPROC_STRING_(x) x##_SSL
561	# define OPENSSL_VPROC_STRING(x) OPENSSL_VPROC_STRING_(x)
562	# define OPENSSL_VPROC_FUNC OPENSSL_VPROC_STRING(OPENSSL_VPROC)
563	void OPENSSL_VPROC_FUNC(void) {}
564	#endif
565
566	int SSL_clear(SSL *s)
567	{
568	if (s->method == NULL) {
569	ERR_raise(ERR_LIB_SSL, SSL_R_NO_METHOD_SPECIFIED);
570	return 0;
571	}
572
573	return s->method->ssl_reset(s);
574	}
575
576	int ossl_ssl_connection_reset(SSL *s)
577	{
578	SSL_CONNECTION *sc = SSL_CONNECTION_FROM_SSL(s);
579
580	if (sc == NULL)
581	return 0;
582
583	if (ssl_clear_bad_session(sc)) {
584	SSL_SESSION_free(sc->session);
585	sc->session = NULL;
586	}
587	SSL_SESSION_free(sc->psksession);
588	sc->psksession = NULL;
589	OPENSSL_free(sc->psksession_id);
590	sc->psksession_id = NULL;
591	sc->psksession_id_len = 0;
592	sc->hello_retry_request = SSL_HRR_NONE;
593	sc->sent_tickets = 0;
594
595	sc->error = 0;
596	sc->hit = 0;
597	sc->shutdown = 0;
598
599	if (sc->renegotiate) {
600	ERR_raise(ERR_LIB_SSL, ERR_R_INTERNAL_ERROR);
601	return 0;
602	}
603
604	ossl_statem_clear(sc);
605
606	sc->version = s->method->version;
607	sc->client_version = sc->version;
608	sc->rwstate = SSL_NOTHING;
609
610	BUF_MEM_free(sc->init_buf);
611	sc->init_buf = NULL;
612	sc->first_packet = 0;
613
614	sc->key_update = SSL_KEY_UPDATE_NONE;
615	memset(sc->ext.compress_certificate_from_peer, 0,
616	sizeof(sc->ext.compress_certificate_from_peer));
617	sc->ext.compress_certificate_sent = 0;
618
619	EVP_MD_CTX_free(sc->pha_dgst);
620	sc->pha_dgst = NULL;
621
622	/* Reset DANE verification result state */
623	sc->dane.mdpth = -1;
624	sc->dane.pdpth = -1;
625	X509_free(sc->dane.mcert);
626	sc->dane.mcert = NULL;
627	sc->dane.mtlsa = NULL;
628
629	/* Clear the verification result peername */
630	X509_VERIFY_PARAM_move_peername(sc->param, NULL);
631
632	/* Clear any shared connection state */
633	OPENSSL_free(sc->shared_sigalgs);
634	sc->shared_sigalgs = NULL;
635	sc->shared_sigalgslen = 0;
636
637	/*
638	* Check to see if we were changed into a different method, if so, revert
639	* back.
640	*/
641	if (s->method != s->defltmeth) {
642	s->method->ssl_deinit(s);
643	s->method = s->defltmeth;
644	if (!s->method->ssl_init(s))
645	return 0;
646	} else {
647	if (!s->method->ssl_clear(s))
648	return 0;
649	}
650
651	if (!RECORD_LAYER_reset(&sc->rlayer))
652	return 0;
653
654	return 1;
655	}
656
657	#ifndef OPENSSL_NO_DEPRECATED_3_0
658	/** Used to change an SSL_CTXs default SSL method type */
659	int SSL_CTX_set_ssl_version(SSL_CTX ctx, const SSL_METHOD meth)
660	{
661	STACK_OF(SSL_CIPHER) *sk;
662
663	if (IS_QUIC_CTX(ctx)) {
664	ERR_raise(ERR_LIB_SSL, SSL_R_WRONG_SSL_VERSION);
665	return 0;
666	}
667
668	ctx->method = meth;
669
670	if (!SSL_CTX_set_ciphersuites(ctx, OSSL_default_ciphersuites())) {
671	ERR_raise(ERR_LIB_SSL, SSL_R_SSL_LIBRARY_HAS_NO_CIPHERS);
672	return 0;
673	}
674	sk = ssl_create_cipher_list(ctx,
675	ctx->tls13_ciphersuites,
676	&(ctx->cipher_list),
677	&(ctx->cipher_list_by_id),
678	OSSL_default_cipher_list(), ctx->cert);
679	if ((sk == NULL) \|\| (sk_SSL_CIPHER_num(sk) <= 0)) {
680	ERR_raise(ERR_LIB_SSL, SSL_R_SSL_LIBRARY_HAS_NO_CIPHERS);
681	return 0;
682	}
683	return 1;
684	}
685	#endif
686
687	SSL SSL_new(SSL_CTX ctx)
688	{
689	if (ctx == NULL) {
690	ERR_raise(ERR_LIB_SSL, SSL_R_NULL_SSL_CTX);
691	return NULL;
692	}
693	if (ctx->method == NULL) {
694	ERR_raise(ERR_LIB_SSL, SSL_R_SSL_CTX_HAS_NO_DEFAULT_SSL_VERSION);
695	return NULL;
696	}
697	return ctx->method->ssl_new(ctx);
698	}
699
700	int ossl_ssl_init(SSL ssl, SSL_CTX ctx, const SSL_METHOD *method, int type)
701	{
702	ssl->type = type;
703
704	ssl->lock = CRYPTO_THREAD_lock_new();
705	if (ssl->lock == NULL)
706	return 0;
707
708	if (!CRYPTO_NEW_REF(&ssl->references, 1)) {
709	CRYPTO_THREAD_lock_free(ssl->lock);
710	return 0;
711	}
712
713	if (!CRYPTO_new_ex_data(CRYPTO_EX_INDEX_SSL, ssl, &ssl->ex_data)) {
714	CRYPTO_THREAD_lock_free(ssl->lock);
715	CRYPTO_FREE_REF(&ssl->references);
716	ssl->lock = NULL;
717	return 0;
718	}
719
720	SSL_CTX_up_ref(ctx);
721	ssl->ctx = ctx;
722
723	ssl->defltmeth = ssl->method = method;
724
725	return 1;
726	}
727
728	SSL ossl_ssl_connection_new_int(SSL_CTX ctx, SSL *user_ssl,
729	const SSL_METHOD *method)
730	{
731	SSL_CONNECTION *s;
732	SSL *ssl;
733
734	s = OPENSSL_zalloc(sizeof(*s));
735	if (s == NULL)
736	return NULL;
737
738	ssl = &s->ssl;
739	s->user_ssl = (user_ssl == NULL) ? ssl : user_ssl;
740
741	if (!ossl_ssl_init(ssl, ctx, method, SSL_TYPE_SSL_CONNECTION)) {
742	OPENSSL_free(s);
743	s = NULL;
744	ssl = NULL;
745	goto sslerr;
746	}
747
748	RECORD_LAYER_init(&s->rlayer, s);
749
750	s->options = ctx->options;
751
752	s->dane.flags = ctx->dane.flags;
753	if (method->version == ctx->method->version) {
754	s->min_proto_version = ctx->min_proto_version;
755	s->max_proto_version = ctx->max_proto_version;
756	}
757
758	s->mode = ctx->mode;
759	s->max_cert_list = ctx->max_cert_list;
760	s->max_early_data = ctx->max_early_data;
761	s->recv_max_early_data = ctx->recv_max_early_data;
762
763	s->num_tickets = ctx->num_tickets;
764	s->pha_enabled = ctx->pha_enabled;
765
766	/* Shallow copy of the ciphersuites stack */
767	s->tls13_ciphersuites = sk_SSL_CIPHER_dup(ctx->tls13_ciphersuites);
768	if (s->tls13_ciphersuites == NULL)
769	goto cerr;
770
771	/*
772	* Earlier library versions used to copy the pointer to the CERT, not
773	* its contents; only when setting new parameters for the per-SSL
774	* copy, ssl_cert_new would be called (and the direct reference to
775	* the per-SSL_CTX settings would be lost, but those still were
776	* indirectly accessed for various purposes, and for that reason they
777	* used to be known as s->ctx->default_cert). Now we don't look at the
778	* SSL_CTX's CERT after having duplicated it once.
779	*/
780	s->cert = ssl_cert_dup(ctx->cert);
781	if (s->cert == NULL)
782	goto sslerr;
783
784	RECORD_LAYER_set_read_ahead(&s->rlayer, ctx->read_ahead);
785	s->msg_callback = ctx->msg_callback;
786	s->msg_callback_arg = ctx->msg_callback_arg;
787	s->verify_mode = ctx->verify_mode;
788	s->not_resumable_session_cb = ctx->not_resumable_session_cb;
789	s->rlayer.record_padding_cb = ctx->record_padding_cb;
790	s->rlayer.record_padding_arg = ctx->record_padding_arg;
791	s->rlayer.block_padding = ctx->block_padding;
792	s->rlayer.hs_padding = ctx->hs_padding;
793	s->sid_ctx_length = ctx->sid_ctx_length;
794	if (!ossl_assert(s->sid_ctx_length <= sizeof(s->sid_ctx)))
795	goto err;
796	memcpy(&s->sid_ctx, &ctx->sid_ctx, sizeof(s->sid_ctx));
797	s->verify_callback = ctx->default_verify_callback;
798	s->generate_session_id = ctx->generate_session_id;
799
800	s->param = X509_VERIFY_PARAM_new();
801	if (s->param == NULL)
802	goto asn1err;
803	X509_VERIFY_PARAM_inherit(s->param, ctx->param);
804	s->quiet_shutdown = IS_QUIC_CTX(ctx) ? 0 : ctx->quiet_shutdown;
805
806	if (!IS_QUIC_CTX(ctx))
807	s->ext.max_fragment_len_mode = ctx->ext.max_fragment_len_mode;
808
809	s->max_send_fragment = ctx->max_send_fragment;
810	s->split_send_fragment = ctx->split_send_fragment;
811	s->max_pipelines = ctx->max_pipelines;
812	s->rlayer.default_read_buf_len = ctx->default_read_buf_len;
813
814	s->ext.debug_cb = 0;
815	s->ext.debug_arg = NULL;
816	s->ext.ticket_expected = 0;
817	s->ext.status_type = ctx->ext.status_type;
818	s->ext.status_expected = 0;
819	s->ext.ocsp.ids = NULL;
820	s->ext.ocsp.exts = NULL;
821	s->ext.ocsp.resp = NULL;
822	s->ext.ocsp.resp_len = 0;
823	SSL_CTX_up_ref(ctx);
824	s->session_ctx = ctx;
825	if (ctx->ext.ecpointformats) {
826	s->ext.ecpointformats =
827	OPENSSL_memdup(ctx->ext.ecpointformats,
828	ctx->ext.ecpointformats_len);
829	if (!s->ext.ecpointformats) {
830	s->ext.ecpointformats_len = 0;
831	goto err;
832	}
833	s->ext.ecpointformats_len =
834	ctx->ext.ecpointformats_len;
835	}
836	if (ctx->ext.supportedgroups) {
837	s->ext.supportedgroups =
838	OPENSSL_memdup(ctx->ext.supportedgroups,
839	ctx->ext.supportedgroups_len
840	* sizeof(*ctx->ext.supportedgroups));
841	if (!s->ext.supportedgroups) {
842	s->ext.supportedgroups_len = 0;
843	goto err;
844	}
845	s->ext.supportedgroups_len = ctx->ext.supportedgroups_len;
846	}
847
848	#ifndef OPENSSL_NO_NEXTPROTONEG
849	s->ext.npn = NULL;
850	#endif
851
852	if (ctx->ext.alpn != NULL) {
853	s->ext.alpn = OPENSSL_malloc(ctx->ext.alpn_len);
854	if (s->ext.alpn == NULL) {
855	s->ext.alpn_len = 0;
856	goto err;
857	}
858	memcpy(s->ext.alpn, ctx->ext.alpn, ctx->ext.alpn_len);
859	s->ext.alpn_len = ctx->ext.alpn_len;
860	}
861
862	s->verified_chain = NULL;
863	s->verify_result = X509_V_OK;
864
865	s->default_passwd_callback = ctx->default_passwd_callback;
866	s->default_passwd_callback_userdata = ctx->default_passwd_callback_userdata;
867
868	s->key_update = SSL_KEY_UPDATE_NONE;
869
870	if (!IS_QUIC_CTX(ctx)) {
871	s->allow_early_data_cb = ctx->allow_early_data_cb;
872	s->allow_early_data_cb_data = ctx->allow_early_data_cb_data;
873	}
874
875	if (!method->ssl_init(ssl))
876	goto sslerr;
877
878	s->server = (method->ssl_accept == ssl_undefined_function) ? 0 : 1;
879
880	if (!method->ssl_reset(ssl))
881	goto sslerr;
882
883	#ifndef OPENSSL_NO_PSK
884	s->psk_client_callback = ctx->psk_client_callback;
885	s->psk_server_callback = ctx->psk_server_callback;
886	#endif
887	s->psk_find_session_cb = ctx->psk_find_session_cb;
888	s->psk_use_session_cb = ctx->psk_use_session_cb;
889
890	s->async_cb = ctx->async_cb;
891	s->async_cb_arg = ctx->async_cb_arg;
892
893	s->job = NULL;
894
895	#ifndef OPENSSL_NO_COMP_ALG
896	memcpy(s->cert_comp_prefs, ctx->cert_comp_prefs, sizeof(s->cert_comp_prefs));
897	#endif
898	if (ctx->client_cert_type != NULL) {
899	s->client_cert_type = OPENSSL_memdup(ctx->client_cert_type,
900	ctx->client_cert_type_len);
901	if (s->client_cert_type == NULL)
902	goto sslerr;
903	s->client_cert_type_len = ctx->client_cert_type_len;
904	}
905	if (ctx->server_cert_type != NULL) {
906	s->server_cert_type = OPENSSL_memdup(ctx->server_cert_type,
907	ctx->server_cert_type_len);
908	if (s->server_cert_type == NULL)
909	goto sslerr;
910	s->server_cert_type_len = ctx->server_cert_type_len;
911	}
912
913	#ifndef OPENSSL_NO_CT
914	if (!SSL_set_ct_validation_callback(ssl, ctx->ct_validation_callback,
915	ctx->ct_validation_callback_arg))
916	goto sslerr;
917	#endif
918
919	s->ssl_pkey_num = SSL_PKEY_NUM + ctx->sigalg_list_len;
920	return ssl;
921	cerr:
922	ERR_raise(ERR_LIB_SSL, ERR_R_CRYPTO_LIB);
923	goto err;
924	asn1err:
925	ERR_raise(ERR_LIB_SSL, ERR_R_ASN1_LIB);
926	goto err;
927	sslerr:
928	ERR_raise(ERR_LIB_SSL, ERR_R_SSL_LIB);
929	err:
930	SSL_free(ssl);
931	return NULL;
932	}
933
934	SSL ossl_ssl_connection_new(SSL_CTX ctx)
935	{
936	return ossl_ssl_connection_new_int(ctx, NULL, ctx->method);
937	}
938
939	int SSL_is_dtls(const SSL *s)
940	{
941	SSL_CONNECTION *sc = SSL_CONNECTION_FROM_SSL(s);
942
943	#ifndef OPENSSL_NO_QUIC
944	if (s->type == SSL_TYPE_QUIC_CONNECTION \|\| s->type == SSL_TYPE_QUIC_XSO)
945	return 0;
946	#endif
947
948	if (sc == NULL)
949	return 0;
950
951	return SSL_CONNECTION_IS_DTLS(sc) ? 1 : 0;
952	}
953
954	int SSL_is_tls(const SSL *s)
955	{
956	SSL_CONNECTION *sc = SSL_CONNECTION_FROM_SSL(s);
957
958	#ifndef OPENSSL_NO_QUIC
959	if (s->type == SSL_TYPE_QUIC_CONNECTION \|\| s->type == SSL_TYPE_QUIC_XSO)
960	return 0;
961	#endif
962
963	if (sc == NULL)
964	return 0;
965
966	return SSL_CONNECTION_IS_DTLS(sc) ? 0 : 1;
967	}
968
969	int SSL_is_quic(const SSL *s)
970	{
971	#ifndef OPENSSL_NO_QUIC
972	if (s->type == SSL_TYPE_QUIC_CONNECTION \|\| s->type == SSL_TYPE_QUIC_XSO)
973	return 1;
974	#endif
975	return 0;
976	}
977
978	int SSL_up_ref(SSL *s)
979	{
980	int i;
981
982	if (CRYPTO_UP_REF(&s->references, &i) <= 0)
983	return 0;
984
985	REF_PRINT_COUNT("SSL", i, s);
986	REF_ASSERT_ISNT(i < 2);
987	return ((i > 1) ? 1 : 0);
988	}
989
990	int SSL_CTX_set_session_id_context(SSL_CTX ctx, const unsigned char sid_ctx,
991	unsigned int sid_ctx_len)
992	{
993	if (sid_ctx_len > SSL_MAX_SID_CTX_LENGTH) {
994	ERR_raise(ERR_LIB_SSL, SSL_R_SSL_SESSION_ID_CONTEXT_TOO_LONG);
995	return 0;
996	}
997	ctx->sid_ctx_length = sid_ctx_len;
998	memcpy(ctx->sid_ctx, sid_ctx, sid_ctx_len);
999
1000	return 1;
1001	}
1002
1003	int SSL_set_session_id_context(SSL ssl, const unsigned char sid_ctx,
1004	unsigned int sid_ctx_len)
1005	{
1006	SSL_CONNECTION *sc = SSL_CONNECTION_FROM_SSL(ssl);
1007
1008	if (sc == NULL)
1009	return 0;
1010
1011	if (sid_ctx_len > SSL_MAX_SID_CTX_LENGTH) {
1012	ERR_raise(ERR_LIB_SSL, SSL_R_SSL_SESSION_ID_CONTEXT_TOO_LONG);
1013	return 0;
1014	}
1015	sc->sid_ctx_length = sid_ctx_len;
1016	memcpy(sc->sid_ctx, sid_ctx, sid_ctx_len);
1017
1018	return 1;
1019	}
1020
1021	int SSL_CTX_set_generate_session_id(SSL_CTX *ctx, GEN_SESSION_CB cb)
1022	{
1023	if (!CRYPTO_THREAD_write_lock(ctx->lock))
1024	return 0;
1025	ctx->generate_session_id = cb;
1026	CRYPTO_THREAD_unlock(ctx->lock);
1027	return 1;
1028	}
1029
1030	int SSL_set_generate_session_id(SSL *ssl, GEN_SESSION_CB cb)
1031	{
1032	SSL_CONNECTION *sc = SSL_CONNECTION_FROM_SSL(ssl);
1033
1034	if (sc == NULL \|\| !CRYPTO_THREAD_write_lock(ssl->lock))
1035	return 0;
1036	sc->generate_session_id = cb;
1037	CRYPTO_THREAD_unlock(ssl->lock);
1038	return 1;
1039	}
1040
1041	int SSL_has_matching_session_id(const SSL ssl, const unsigned char id,
1042	unsigned int id_len)
1043	{
1044	/*
1045	* A quick examination of SSL_SESSION_hash and SSL_SESSION_cmp shows how
1046	* we can "construct" a session to give us the desired check - i.e. to
1047	* find if there's a session in the hash table that would conflict with
1048	* any new session built out of this id/id_len and the ssl_version in use
1049	* by this SSL.
1050	*/
1051	SSL_SESSION r, *p;
1052	const SSL_CONNECTION *sc = SSL_CONNECTION_FROM_CONST_SSL(ssl);
1053
1054	if (sc == NULL \|\| id_len > sizeof(r.session_id))
1055	return 0;
1056
1057	r.ssl_version = sc->version;
1058	r.session_id_length = id_len;
1059	memcpy(r.session_id, id, id_len);
1060
1061	if (!CRYPTO_THREAD_read_lock(sc->session_ctx->lock))
1062	return 0;
1063	p = lh_SSL_SESSION_retrieve(sc->session_ctx->sessions, &r);
1064	CRYPTO_THREAD_unlock(sc->session_ctx->lock);
1065	return (p != NULL);
1066	}
1067
1068	int SSL_CTX_set_purpose(SSL_CTX *s, int purpose)
1069	{
1070	return X509_VERIFY_PARAM_set_purpose(s->param, purpose);
1071	}
1072
1073	int SSL_set_purpose(SSL *s, int purpose)
1074	{
1075	SSL_CONNECTION *sc = SSL_CONNECTION_FROM_SSL(s);
1076
1077	if (sc == NULL)
1078	return 0;
1079
1080	return X509_VERIFY_PARAM_set_purpose(sc->param, purpose);
1081	}
1082
1083	int SSL_CTX_set_trust(SSL_CTX *s, int trust)
1084	{
1085	return X509_VERIFY_PARAM_set_trust(s->param, trust);
1086	}
1087
1088	int SSL_set_trust(SSL *s, int trust)
1089	{
1090	SSL_CONNECTION *sc = SSL_CONNECTION_FROM_SSL(s);
1091
1092	if (sc == NULL)
1093	return 0;
1094
1095	return X509_VERIFY_PARAM_set_trust(sc->param, trust);
1096	}
1097
1098	int SSL_set1_host(SSL s, const char hostname)
1099	{
1100	SSL_CONNECTION *sc = SSL_CONNECTION_FROM_SSL(s);
1101
1102	if (sc == NULL)
1103	return 0;
1104
1105	/* If a hostname is provided and parses as an IP address,
1106	* treat it as such. */
1107	if (hostname != NULL
1108	&& X509_VERIFY_PARAM_set1_ip_asc(sc->param, hostname) == 1)
1109	return 1;
1110
1111	return X509_VERIFY_PARAM_set1_host(sc->param, hostname, 0);
1112	}
1113
1114	int SSL_add1_host(SSL s, const char hostname)
1115	{
1116	SSL_CONNECTION *sc = SSL_CONNECTION_FROM_SSL(s);
1117
1118	if (sc == NULL)
1119	return 0;
1120
1121	/* If a hostname is provided and parses as an IP address,
1122	* treat it as such. */
1123	if (hostname) {
1124	ASN1_OCTET_STRING *ip;
1125	char *old_ip;
1126
1127	ip = a2i_IPADDRESS(hostname);
1128	if (ip) {
1129	/* We didn't want it; only to check if it is an IP address */
1130	ASN1_OCTET_STRING_free(ip);
1131
1132	old_ip = X509_VERIFY_PARAM_get1_ip_asc(sc->param);
1133	if (old_ip) {
1134	OPENSSL_free(old_ip);
1135	/* There can be only one IP address */
1136	return 0;
1137	}
1138
1139	return X509_VERIFY_PARAM_set1_ip_asc(sc->param, hostname);
1140	}
1141	}
1142
1143	return X509_VERIFY_PARAM_add1_host(sc->param, hostname, 0);
1144	}
1145
1146	void SSL_set_hostflags(SSL *s, unsigned int flags)
1147	{
1148	SSL_CONNECTION *sc = SSL_CONNECTION_FROM_SSL(s);
1149
1150	if (sc == NULL)
1151	return;
1152
1153	X509_VERIFY_PARAM_set_hostflags(sc->param, flags);
1154	}
1155
1156	const char SSL_get0_peername(SSL s)
1157	{
1158	SSL_CONNECTION *sc = SSL_CONNECTION_FROM_SSL(s);
1159
1160	if (sc == NULL)
1161	return NULL;
1162
1163	return X509_VERIFY_PARAM_get0_peername(sc->param);
1164	}
1165
1166	int SSL_CTX_dane_enable(SSL_CTX *ctx)
1167	{
1168	return dane_ctx_enable(&ctx->dane);
1169	}
1170
1171	unsigned long SSL_CTX_dane_set_flags(SSL_CTX *ctx, unsigned long flags)
1172	{
1173	unsigned long orig = ctx->dane.flags;
1174
1175	ctx->dane.flags \|= flags;
1176	return orig;
1177	}
1178
1179	unsigned long SSL_CTX_dane_clear_flags(SSL_CTX *ctx, unsigned long flags)
1180	{
1181	unsigned long orig = ctx->dane.flags;
1182
1183	ctx->dane.flags &= ~flags;
1184	return orig;
1185	}
1186
1187	int SSL_dane_enable(SSL s, const char basedomain)
1188	{
1189	SSL_DANE *dane;
1190	SSL_CONNECTION *sc = SSL_CONNECTION_FROM_SSL(s);
1191
1192	if (sc == NULL)
1193	return 0;
1194
1195	dane = &sc->dane;
1196	if (s->ctx->dane.mdmax == 0) {
1197	ERR_raise(ERR_LIB_SSL, SSL_R_CONTEXT_NOT_DANE_ENABLED);
1198	return 0;
1199	}
1200	if (dane->trecs != NULL) {
1201	ERR_raise(ERR_LIB_SSL, SSL_R_DANE_ALREADY_ENABLED);
1202	return 0;
1203	}
1204
1205	/*
1206	* Default SNI name. This rejects empty names, while set1_host below
1207	* accepts them and disables hostname checks. To avoid side-effects with
1208	* invalid input, set the SNI name first.
1209	*/
1210	if (sc->ext.hostname == NULL) {
1211	if (!SSL_set_tlsext_host_name(s, basedomain)) {
1212	ERR_raise(ERR_LIB_SSL, SSL_R_ERROR_SETTING_TLSA_BASE_DOMAIN);
1213	return -1;
1214	}
1215	}
1216
1217	/* Primary RFC6125 reference identifier */
1218	if (!X509_VERIFY_PARAM_set1_host(sc->param, basedomain, 0)) {
1219	ERR_raise(ERR_LIB_SSL, SSL_R_ERROR_SETTING_TLSA_BASE_DOMAIN);
1220	return -1;
1221	}
1222
1223	dane->mdpth = -1;
1224	dane->pdpth = -1;
1225	dane->dctx = &s->ctx->dane;
1226	dane->trecs = sk_danetls_record_new_null();
1227
1228	if (dane->trecs == NULL) {
1229	ERR_raise(ERR_LIB_SSL, ERR_R_CRYPTO_LIB);
1230	return -1;
1231	}
1232	return 1;
1233	}
1234
1235	unsigned long SSL_dane_set_flags(SSL *ssl, unsigned long flags)
1236	{
1237	unsigned long orig;
1238	SSL_CONNECTION *sc = SSL_CONNECTION_FROM_SSL(ssl);
1239
1240	if (sc == NULL)
1241	return 0;
1242
1243	orig = sc->dane.flags;
1244
1245	sc->dane.flags \|= flags;
1246	return orig;
1247	}
1248
1249	unsigned long SSL_dane_clear_flags(SSL *ssl, unsigned long flags)
1250	{
1251	unsigned long orig;
1252	SSL_CONNECTION *sc = SSL_CONNECTION_FROM_SSL(ssl);
1253
1254	if (sc == NULL)
1255	return 0;
1256
1257	orig = sc->dane.flags;
1258
1259	sc->dane.flags &= ~flags;
1260	return orig;
1261	}
1262
1263	int SSL_get0_dane_authority(SSL s, X509 mcert, EVP_PKEY *mspki)
1264	{
1265	SSL_DANE *dane;
1266	SSL_CONNECTION *sc = SSL_CONNECTION_FROM_SSL(s);
1267
1268	if (sc == NULL)
1269	return -1;
1270
1271	dane = &sc->dane;
1272
1273	if (!DANETLS_ENABLED(dane) \|\| sc->verify_result != X509_V_OK)
1274	return -1;
1275	if (dane->mtlsa) {
1276	if (mcert)
1277	*mcert = dane->mcert;
1278	if (mspki)
1279	*mspki = (dane->mcert == NULL) ? dane->mtlsa->spki : NULL;
1280	}
1281	return dane->mdpth;
1282	}
1283
1284	int SSL_get0_dane_tlsa(SSL s, uint8_t usage, uint8_t *selector,
1285	uint8_t mtype, const unsigned char data, size_t dlen)
1286	{
1287	SSL_DANE *dane;
1288	SSL_CONNECTION *sc = SSL_CONNECTION_FROM_SSL(s);
1289
1290	if (sc == NULL)
1291	return -1;
1292
1293	dane = &sc->dane;
1294
1295	if (!DANETLS_ENABLED(dane) \|\| sc->verify_result != X509_V_OK)
1296	return -1;
1297	if (dane->mtlsa) {
1298	if (usage)
1299	*usage = dane->mtlsa->usage;
1300	if (selector)
1301	*selector = dane->mtlsa->selector;
1302	if (mtype)
1303	*mtype = dane->mtlsa->mtype;
1304	if (data)
1305	*data = dane->mtlsa->data;
1306	if (dlen)
1307	*dlen = dane->mtlsa->dlen;
1308	}
1309	return dane->mdpth;
1310	}
1311
1312	SSL_DANE SSL_get0_dane(SSL s)
1313	{
1314	SSL_CONNECTION *sc = SSL_CONNECTION_FROM_SSL(s);
1315
1316	if (sc == NULL)
1317	return NULL;
1318
1319	return &sc->dane;
1320	}
1321
1322	int SSL_dane_tlsa_add(SSL *s, uint8_t usage, uint8_t selector,
1323	uint8_t mtype, const unsigned char *data, size_t dlen)
1324	{
1325	SSL_CONNECTION *sc = SSL_CONNECTION_FROM_SSL(s);
1326
1327	if (sc == NULL)
1328	return 0;
1329
1330	return dane_tlsa_add(&sc->dane, usage, selector, mtype, data, dlen);
1331	}
1332
1333	int SSL_CTX_dane_mtype_set(SSL_CTX ctx, const EVP_MD md, uint8_t mtype,
1334	uint8_t ord)
1335	{
1336	return dane_mtype_set(&ctx->dane, md, mtype, ord);
1337	}
1338
1339	int SSL_CTX_set1_param(SSL_CTX ctx, X509_VERIFY_PARAM vpm)
1340	{
1341	return X509_VERIFY_PARAM_set1(ctx->param, vpm);
1342	}
1343
1344	int SSL_set1_param(SSL ssl, X509_VERIFY_PARAM vpm)
1345	{
1346	SSL_CONNECTION *sc = SSL_CONNECTION_FROM_SSL(ssl);
1347
1348	if (sc == NULL)
1349	return 0;
1350
1351	return X509_VERIFY_PARAM_set1(sc->param, vpm);
1352	}
1353
1354	X509_VERIFY_PARAM SSL_CTX_get0_param(SSL_CTX ctx)
1355	{
1356	return ctx->param;
1357	}
1358
1359	X509_VERIFY_PARAM SSL_get0_param(SSL ssl)
1360	{
1361	SSL_CONNECTION *sc = SSL_CONNECTION_FROM_SSL(ssl);
1362
1363	if (sc == NULL)
1364	return NULL;
1365
1366	return sc->param;
1367	}
1368
1369	void SSL_certs_clear(SSL *s)
1370	{
1371	SSL_CONNECTION *sc = SSL_CONNECTION_FROM_SSL(s);
1372
1373	if (sc == NULL)
1374	return;
1375
1376	ssl_cert_clear_certs(sc->cert);
1377	}
1378
1379	void SSL_free(SSL *s)
1380	{
1381	int i;
1382
1383	if (s == NULL)
1384	return;
1385	CRYPTO_DOWN_REF(&s->references, &i);
1386	REF_PRINT_COUNT("SSL", i, s);
1387	if (i > 0)
1388	return;
1389	REF_ASSERT_ISNT(i < 0);
1390
1391	CRYPTO_free_ex_data(CRYPTO_EX_INDEX_SSL, s, &s->ex_data);
1392
1393	if (s->method != NULL)
1394	s->method->ssl_free(s);
1395
1396	SSL_CTX_free(s->ctx);
1397	CRYPTO_THREAD_lock_free(s->lock);
1398	CRYPTO_FREE_REF(&s->references);
1399
1400	OPENSSL_free(s);
1401	}
1402
1403	void ossl_ssl_connection_free(SSL *ssl)
1404	{
1405	SSL_CONNECTION *s;
1406
1407	s = SSL_CONNECTION_FROM_SSL_ONLY(ssl);
1408	if (s == NULL)
1409	return;
1410
1411	X509_VERIFY_PARAM_free(s->param);
1412	dane_final(&s->dane);
1413
1414	/* Ignore return value */
1415	ssl_free_wbio_buffer(s);
1416
1417	/* Ignore return value */
1418	RECORD_LAYER_clear(&s->rlayer);
1419
1420	BUF_MEM_free(s->init_buf);
1421
1422	/* add extra stuff */
1423	sk_SSL_CIPHER_free(s->cipher_list);
1424	sk_SSL_CIPHER_free(s->cipher_list_by_id);
1425	sk_SSL_CIPHER_free(s->tls13_ciphersuites);
1426	sk_SSL_CIPHER_free(s->peer_ciphers);
1427
1428	/* Make the next call work :-) */
1429	if (s->session != NULL) {
1430	ssl_clear_bad_session(s);
1431	SSL_SESSION_free(s->session);
1432	}
1433	SSL_SESSION_free(s->psksession);
1434	OPENSSL_free(s->psksession_id);
1435
1436	ssl_cert_free(s->cert);
1437	OPENSSL_free(s->shared_sigalgs);
1438	/* Free up if allocated */
1439
1440	OPENSSL_free(s->ext.hostname);
1441	SSL_CTX_free(s->session_ctx);
1442	OPENSSL_free(s->ext.ecpointformats);
1443	OPENSSL_free(s->ext.peer_ecpointformats);
1444	OPENSSL_free(s->ext.supportedgroups);
1445	OPENSSL_free(s->ext.peer_supportedgroups);
1446	sk_X509_EXTENSION_pop_free(s->ext.ocsp.exts, X509_EXTENSION_free);
1447	#ifndef OPENSSL_NO_OCSP
1448	sk_OCSP_RESPID_pop_free(s->ext.ocsp.ids, OCSP_RESPID_free);
1449	#endif
1450	#ifndef OPENSSL_NO_CT
1451	SCT_LIST_free(s->scts);
1452	OPENSSL_free(s->ext.scts);
1453	#endif
1454	OPENSSL_free(s->ext.ocsp.resp);
1455	OPENSSL_free(s->ext.alpn);
1456	OPENSSL_free(s->ext.tls13_cookie);
1457	if (s->clienthello != NULL)
1458	OPENSSL_free(s->clienthello->pre_proc_exts);
1459	OPENSSL_free(s->clienthello);
1460	OPENSSL_free(s->pha_context);
1461	EVP_MD_CTX_free(s->pha_dgst);
1462
1463	sk_X509_NAME_pop_free(s->ca_names, X509_NAME_free);
1464	sk_X509_NAME_pop_free(s->client_ca_names, X509_NAME_free);
1465
1466	OPENSSL_free(s->client_cert_type);
1467	OPENSSL_free(s->server_cert_type);
1468
1469	OSSL_STACK_OF_X509_free(s->verified_chain);
1470
1471	if (ssl->method != NULL)
1472	ssl->method->ssl_deinit(ssl);
1473
1474	ASYNC_WAIT_CTX_free(s->waitctx);
1475
1476	#if !defined(OPENSSL_NO_NEXTPROTONEG)
1477	OPENSSL_free(s->ext.npn);
1478	#endif
1479
1480	#ifndef OPENSSL_NO_SRTP
1481	sk_SRTP_PROTECTION_PROFILE_free(s->srtp_profiles);
1482	#endif
1483
1484	/*
1485	* We do this late. We want to ensure that any other references we held to
1486	* these BIOs are freed first before we call BIO_free_all(), because
1487	* BIO_free_all() will only free each BIO in the chain if the number of
1488	* references to the first BIO have dropped to 0
1489	*/
1490	BIO_free_all(s->wbio);
1491	s->wbio = NULL;
1492	BIO_free_all(s->rbio);
1493	s->rbio = NULL;
1494	OPENSSL_free(s->s3.tmp.valid_flags);
1495	}
1496
1497	void SSL_set0_rbio(SSL s, BIO rbio)
1498	{
1499	SSL_CONNECTION *sc = SSL_CONNECTION_FROM_SSL(s);
1500
1501	#ifndef OPENSSL_NO_QUIC
1502	if (IS_QUIC(s)) {
1503	ossl_quic_conn_set0_net_rbio(s, rbio);
1504	return;
1505	}
1506	#endif
1507
1508	if (sc == NULL)
1509	return;
1510
1511	BIO_free_all(sc->rbio);
1512	sc->rbio = rbio;
1513	sc->rlayer.rrlmethod->set1_bio(sc->rlayer.rrl, sc->rbio);
1514	}
1515
1516	void SSL_set0_wbio(SSL s, BIO wbio)
1517	{
1518	SSL_CONNECTION *sc = SSL_CONNECTION_FROM_SSL(s);
1519
1520	#ifndef OPENSSL_NO_QUIC
1521	if (IS_QUIC(s)) {
1522	ossl_quic_conn_set0_net_wbio(s, wbio);
1523	return;
1524	}
1525	#endif
1526
1527	if (sc == NULL)
1528	return;
1529
1530	/*
1531	* If the output buffering BIO is still in place, remove it
1532	*/
1533	if (sc->bbio != NULL)
1534	sc->wbio = BIO_pop(sc->wbio);
1535
1536	BIO_free_all(sc->wbio);
1537	sc->wbio = wbio;
1538
1539	/* Re-attach \|bbio\| to the new \|wbio\|. */
1540	if (sc->bbio != NULL)
1541	sc->wbio = BIO_push(sc->bbio, sc->wbio);
1542
1543	sc->rlayer.wrlmethod->set1_bio(sc->rlayer.wrl, sc->wbio);
1544	}
1545
1546	void SSL_set_bio(SSL s, BIO rbio, BIO *wbio)
1547	{
1548	/*
1549	* For historical reasons, this function has many different cases in
1550	* ownership handling.
1551	*/
1552
1553	/* If nothing has changed, do nothing */
1554	if (rbio == SSL_get_rbio(s) && wbio == SSL_get_wbio(s))
1555	return;
1556
1557	/*
1558	* If the two arguments are equal then one fewer reference is granted by the
1559	* caller than we want to take
1560	*/
1561	if (rbio != NULL && rbio == wbio)
1562	BIO_up_ref(rbio);
1563
1564	/*
1565	* If only the wbio is changed only adopt one reference.
1566	*/
1567	if (rbio == SSL_get_rbio(s)) {
1568	SSL_set0_wbio(s, wbio);
1569	return;
1570	}
1571	/*
1572	* There is an asymmetry here for historical reasons. If only the rbio is
1573	* changed AND the rbio and wbio were originally different, then we only
1574	* adopt one reference.
1575	*/
1576	if (wbio == SSL_get_wbio(s) && SSL_get_rbio(s) != SSL_get_wbio(s)) {
1577	SSL_set0_rbio(s, rbio);
1578	return;
1579	}
1580
1581	/* Otherwise, adopt both references. */
1582	SSL_set0_rbio(s, rbio);
1583	SSL_set0_wbio(s, wbio);
1584	}
1585
1586	BIO SSL_get_rbio(const SSL s)
1587	{
1588	const SSL_CONNECTION *sc = SSL_CONNECTION_FROM_CONST_SSL(s);
1589
1590	#ifndef OPENSSL_NO_QUIC
1591	if (IS_QUIC(s))
1592	return ossl_quic_conn_get_net_rbio(s);
1593	#endif
1594
1595	if (sc == NULL)
1596	return NULL;
1597
1598	return sc->rbio;
1599	}
1600
1601	BIO SSL_get_wbio(const SSL s)
1602	{
1603	const SSL_CONNECTION *sc = SSL_CONNECTION_FROM_CONST_SSL(s);
1604
1605	#ifndef OPENSSL_NO_QUIC
1606	if (IS_QUIC(s))
1607	return ossl_quic_conn_get_net_wbio(s);
1608	#endif
1609
1610	if (sc == NULL)
1611	return NULL;
1612
1613	if (sc->bbio != NULL) {
1614	/*
1615	* If \|bbio\| is active, the true caller-configured BIO is its
1616	* \|next_bio\|.
1617	*/
1618	return BIO_next(sc->bbio);
1619	}
1620	return sc->wbio;
1621	}
1622
1623	int SSL_get_fd(const SSL *s)
1624	{
1625	return SSL_get_rfd(s);
1626	}
1627
1628	int SSL_get_rfd(const SSL *s)
1629	{
1630	int ret = -1;
1631	BIO b, r;
1632
1633	b = SSL_get_rbio(s);
1634	r = BIO_find_type(b, BIO_TYPE_DESCRIPTOR);
1635	if (r != NULL)
1636	BIO_get_fd(r, &ret);
1637	return ret;
1638	}
1639
1640	int SSL_get_wfd(const SSL *s)
1641	{
1642	int ret = -1;
1643	BIO b, r;
1644
1645	b = SSL_get_wbio(s);
1646	r = BIO_find_type(b, BIO_TYPE_DESCRIPTOR);
1647	if (r != NULL)
1648	BIO_get_fd(r, &ret);
1649	return ret;
1650	}
1651
1652	#ifndef OPENSSL_NO_SOCK
1653	static const BIO_METHOD fd_method(SSL s)
1654	{
1655	#ifndef OPENSSL_NO_DGRAM
1656	if (IS_QUIC(s))
1657	return BIO_s_datagram();
1658	#endif
1659
1660	return BIO_s_socket();
1661	}
1662
1663	int SSL_set_fd(SSL *s, int fd)
1664	{
1665	int ret = 0;
1666	BIO *bio = NULL;
1667
1668	if (s->type == SSL_TYPE_QUIC_XSO) {
1669	ERR_raise(ERR_LIB_SSL, SSL_R_CONN_USE_ONLY);
1670	goto err;
1671	}
1672
1673	bio = BIO_new(fd_method(s));
1674
1675	if (bio == NULL) {
1676	ERR_raise(ERR_LIB_SSL, ERR_R_BUF_LIB);
1677	goto err;
1678	}
1679	BIO_set_fd(bio, fd, BIO_NOCLOSE);
1680	SSL_set_bio(s, bio, bio);
1681	#ifndef OPENSSL_NO_KTLS
1682	/*
1683	* The new socket is created successfully regardless of ktls_enable.
1684	* ktls_enable doesn't change any functionality of the socket, except
1685	* changing the setsockopt to enable the processing of ktls_start.
1686	* Thus, it is not a problem to call it for non-TLS sockets.
1687	*/
1688	ktls_enable(fd);
1689	#endif /* OPENSSL_NO_KTLS */
1690	ret = 1;
1691	err:
1692	return ret;
1693	}
1694
1695	int SSL_set_wfd(SSL *s, int fd)
1696	{
1697	BIO *rbio = SSL_get_rbio(s);
1698	int desired_type = IS_QUIC(s) ? BIO_TYPE_DGRAM : BIO_TYPE_SOCKET;
1699
1700	if (s->type == SSL_TYPE_QUIC_XSO) {
1701	ERR_raise(ERR_LIB_SSL, SSL_R_CONN_USE_ONLY);
1702	return 0;
1703	}
1704
1705	if (rbio == NULL \|\| BIO_method_type(rbio) != desired_type
1706	\|\| (int)BIO_get_fd(rbio, NULL) != fd) {
1707	BIO *bio = BIO_new(fd_method(s));
1708
1709	if (bio == NULL) {
1710	ERR_raise(ERR_LIB_SSL, ERR_R_BUF_LIB);
1711	return 0;
1712	}
1713	BIO_set_fd(bio, fd, BIO_NOCLOSE);
1714	SSL_set0_wbio(s, bio);
1715	#ifndef OPENSSL_NO_KTLS
1716	/*
1717	* The new socket is created successfully regardless of ktls_enable.
1718	* ktls_enable doesn't change any functionality of the socket, except
1719	* changing the setsockopt to enable the processing of ktls_start.
1720	* Thus, it is not a problem to call it for non-TLS sockets.
1721	*/
1722	ktls_enable(fd);
1723	#endif /* OPENSSL_NO_KTLS */
1724	} else {
1725	BIO_up_ref(rbio);
1726	SSL_set0_wbio(s, rbio);
1727	}
1728	return 1;
1729	}
1730
1731	int SSL_set_rfd(SSL *s, int fd)
1732	{
1733	BIO *wbio = SSL_get_wbio(s);
1734	int desired_type = IS_QUIC(s) ? BIO_TYPE_DGRAM : BIO_TYPE_SOCKET;
1735
1736	if (s->type == SSL_TYPE_QUIC_XSO) {
1737	ERR_raise(ERR_LIB_SSL, SSL_R_CONN_USE_ONLY);
1738	return 0;
1739	}
1740
1741	if (wbio == NULL \|\| BIO_method_type(wbio) != desired_type
1742	\|\| ((int)BIO_get_fd(wbio, NULL) != fd)) {
1743	BIO *bio = BIO_new(fd_method(s));
1744
1745	if (bio == NULL) {
1746	ERR_raise(ERR_LIB_SSL, ERR_R_BUF_LIB);
1747	return 0;
1748	}
1749	BIO_set_fd(bio, fd, BIO_NOCLOSE);
1750	SSL_set0_rbio(s, bio);
1751	} else {
1752	BIO_up_ref(wbio);
1753	SSL_set0_rbio(s, wbio);
1754	}
1755
1756	return 1;
1757	}
1758	#endif
1759
1760	/* return length of latest Finished message we sent, copy to 'buf' */
1761	size_t SSL_get_finished(const SSL s, void buf, size_t count)
1762	{
1763	size_t ret = 0;
1764	const SSL_CONNECTION *sc = SSL_CONNECTION_FROM_CONST_SSL(s);
1765
1766	if (sc == NULL)
1767	return 0;
1768
1769	ret = sc->s3.tmp.finish_md_len;
1770	if (count > ret)
1771	count = ret;
1772	memcpy(buf, sc->s3.tmp.finish_md, count);
1773	return ret;
1774	}
1775
1776	/* return length of latest Finished message we expected, copy to 'buf' */
1777	size_t SSL_get_peer_finished(const SSL s, void buf, size_t count)
1778	{
1779	size_t ret = 0;
1780	const SSL_CONNECTION *sc = SSL_CONNECTION_FROM_CONST_SSL(s);
1781
1782	if (sc == NULL)
1783	return 0;
1784
1785	ret = sc->s3.tmp.peer_finish_md_len;
1786	if (count > ret)
1787	count = ret;
1788	memcpy(buf, sc->s3.tmp.peer_finish_md, count);
1789	return ret;
1790	}
1791
1792	int SSL_get_verify_mode(const SSL *s)
1793	{
1794	const SSL_CONNECTION *sc = SSL_CONNECTION_FROM_CONST_SSL(s);
1795
1796	if (sc == NULL)
1797	return 0;
1798
1799	return sc->verify_mode;
1800	}
1801
1802	int SSL_get_verify_depth(const SSL *s)
1803	{
1804	const SSL_CONNECTION *sc = SSL_CONNECTION_FROM_CONST_SSL(s);
1805
1806	if (sc == NULL)
1807	return 0;
1808
1809	return X509_VERIFY_PARAM_get_depth(sc->param);
1810	}
1811
1812	int (SSL_get_verify_callback(const SSL s)) (int, X509_STORE_CTX *) {
1813	const SSL_CONNECTION *sc = SSL_CONNECTION_FROM_CONST_SSL(s);
1814
1815	if (sc == NULL)
1816	return NULL;
1817
1818	return sc->verify_callback;
1819	}
1820
1821	int SSL_CTX_get_verify_mode(const SSL_CTX *ctx)
1822	{
1823	return ctx->verify_mode;
1824	}
1825
1826	int SSL_CTX_get_verify_depth(const SSL_CTX *ctx)
1827	{
1828	return X509_VERIFY_PARAM_get_depth(ctx->param);
1829	}
1830
1831	int (SSL_CTX_get_verify_callback(const SSL_CTX ctx)) (int, X509_STORE_CTX *) {
1832	return ctx->default_verify_callback;
1833	}
1834
1835	void SSL_set_verify(SSL *s, int mode,
1836	int (callback) (int ok, X509_STORE_CTX ctx))
1837	{
1838	SSL_CONNECTION *sc = SSL_CONNECTION_FROM_SSL(s);
1839
1840	if (sc == NULL)
1841	return;
1842
1843	sc->verify_mode = mode;
1844	if (callback != NULL)
1845	sc->verify_callback = callback;
1846	}
1847
1848	void SSL_set_verify_depth(SSL *s, int depth)
1849	{
1850	SSL_CONNECTION *sc = SSL_CONNECTION_FROM_SSL(s);
1851
1852	if (sc == NULL)
1853	return;
1854
1855	X509_VERIFY_PARAM_set_depth(sc->param, depth);
1856	}
1857
1858	void SSL_set_read_ahead(SSL *s, int yes)
1859	{
1860	SSL_CONNECTION *sc = SSL_CONNECTION_FROM_SSL_ONLY(s);
1861	OSSL_PARAM options[2], *opts = options;
1862
1863	if (sc == NULL)
1864	return;
1865
1866	RECORD_LAYER_set_read_ahead(&sc->rlayer, yes);
1867
1868	*opts++ = OSSL_PARAM_construct_int(OSSL_LIBSSL_RECORD_LAYER_PARAM_READ_AHEAD,
1869	&sc->rlayer.read_ahead);
1870	*opts = OSSL_PARAM_construct_end();
1871
1872	/* Ignore return value */
1873	sc->rlayer.rrlmethod->set_options(sc->rlayer.rrl, options);
1874	}
1875
1876	int SSL_get_read_ahead(const SSL *s)
1877	{
1878	const SSL_CONNECTION *sc = SSL_CONNECTION_FROM_CONST_SSL_ONLY(s);
1879
1880	if (sc == NULL)
1881	return 0;
1882
1883	return RECORD_LAYER_get_read_ahead(&sc->rlayer);
1884	}
1885
1886	int SSL_pending(const SSL *s)
1887	{
1888	size_t pending = s->method->ssl_pending(s);
1889
1890	/*
1891	* SSL_pending cannot work properly if read-ahead is enabled
1892	* (SSL_[CTX_]ctrl(..., SSL_CTRL_SET_READ_AHEAD, 1, NULL)), and it is
1893	* impossible to fix since SSL_pending cannot report errors that may be
1894	* observed while scanning the new data. (Note that SSL_pending() is
1895	* often used as a boolean value, so we'd better not return -1.)
1896	*
1897	* SSL_pending also cannot work properly if the value >INT_MAX. In that case
1898	* we just return INT_MAX.
1899	*/
1900	return pending < INT_MAX ? (int)pending : INT_MAX;
1901	}
1902
1903	int SSL_has_pending(const SSL *s)
1904	{
1905	/*
1906	* Similar to SSL_pending() but returns a 1 to indicate that we have
1907	* processed or unprocessed data available or 0 otherwise (as opposed to the
1908	* number of bytes available). Unlike SSL_pending() this will take into
1909	* account read_ahead data. A 1 return simply indicates that we have data.
1910	* That data may not result in any application data, or we may fail to parse
1911	* the records for some reason.
1912	*/
1913	const SSL_CONNECTION *sc;
1914
1915	#ifndef OPENSSL_NO_QUIC
1916	if (IS_QUIC(s))
1917	return ossl_quic_has_pending(s);
1918	#endif
1919
1920	sc = SSL_CONNECTION_FROM_CONST_SSL(s);
1921
1922	/* Check buffered app data if any first */
1923	if (SSL_CONNECTION_IS_DTLS(sc)) {
1924	TLS_RECORD *rdata;
1925	pitem item, iter;
1926
1927	iter = pqueue_iterator(sc->rlayer.d->buffered_app_data);
1928	while ((item = pqueue_next(&iter)) != NULL) {
1929	rdata = item->data;
1930	if (rdata->length > 0)
1931	return 1;
1932	}
1933	}
1934
1935	if (RECORD_LAYER_processed_read_pending(&sc->rlayer))
1936	return 1;
1937
1938	return RECORD_LAYER_read_pending(&sc->rlayer);
1939	}
1940
1941	X509 SSL_get1_peer_certificate(const SSL s)
1942	{
1943	X509 *r = SSL_get0_peer_certificate(s);
1944
1945	if (r != NULL)
1946	X509_up_ref(r);
1947
1948	return r;
1949	}
1950
1951	X509 SSL_get0_peer_certificate(const SSL s)
1952	{
1953	const SSL_CONNECTION *sc = SSL_CONNECTION_FROM_CONST_SSL(s);
1954
1955	if (sc == NULL)
1956	return NULL;
1957
1958	if (sc->session == NULL)
1959	return NULL;
1960	else
1961	return sc->session->peer;
1962	}
1963
1964	STACK_OF(X509) SSL_get_peer_cert_chain(const SSL s)
1965	{
1966	STACK_OF(X509) *r;
1967	const SSL_CONNECTION *sc = SSL_CONNECTION_FROM_CONST_SSL(s);
1968
1969	if (sc == NULL)
1970	return NULL;
1971
1972	if (sc->session == NULL)
1973	r = NULL;
1974	else
1975	r = sc->session->peer_chain;
1976
1977	/*
1978	* If we are a client, cert_chain includes the peer's own certificate; if
1979	* we are a server, it does not.
1980	*/
1981
1982	return r;
1983	}
1984
1985	/*
1986	* Now in theory, since the calling process own 't' it should be safe to
1987	* modify. We need to be able to read f without being hassled
1988	*/
1989	int SSL_copy_session_id(SSL t, const SSL f)
1990	{
1991	int i;
1992	/* TODO(QUIC FUTURE): Not allowed for QUIC currently. */
1993	SSL_CONNECTION *tsc = SSL_CONNECTION_FROM_SSL_ONLY(t);
1994	const SSL_CONNECTION *fsc = SSL_CONNECTION_FROM_CONST_SSL_ONLY(f);
1995
1996	if (tsc == NULL \|\| fsc == NULL)
1997	return 0;
1998
1999	/* Do we need to do SSL locking? */
2000	if (!SSL_set_session(t, SSL_get_session(f))) {
2001	return 0;
2002	}
2003
2004	/*
2005	* what if we are setup for one protocol version but want to talk another
2006	*/
2007	if (t->method != f->method) {
2008	t->method->ssl_deinit(t);
2009	t->method = f->method;
2010	if (t->method->ssl_init(t) == 0)
2011	return 0;
2012	}
2013
2014	CRYPTO_UP_REF(&fsc->cert->references, &i);
2015	ssl_cert_free(tsc->cert);
2016	tsc->cert = fsc->cert;
2017	if (!SSL_set_session_id_context(t, fsc->sid_ctx, (int)fsc->sid_ctx_length)) {
2018	return 0;
2019	}
2020
2021	return 1;
2022	}
2023
2024	/* Fix this so it checks all the valid key/cert options */
2025	int SSL_CTX_check_private_key(const SSL_CTX *ctx)
2026	{
2027	if ((ctx == NULL) \|\| (ctx->cert->key->x509 == NULL)) {
2028	ERR_raise(ERR_LIB_SSL, SSL_R_NO_CERTIFICATE_ASSIGNED);
2029	return 0;
2030	}
2031	if (ctx->cert->key->privatekey == NULL) {
2032	ERR_raise(ERR_LIB_SSL, SSL_R_NO_PRIVATE_KEY_ASSIGNED);
2033	return 0;
2034	}
2035	return X509_check_private_key
2036	(ctx->cert->key->x509, ctx->cert->key->privatekey);
2037	}
2038
2039	/* Fix this function so that it takes an optional type parameter */
2040	int SSL_check_private_key(const SSL *ssl)
2041	{
2042	const SSL_CONNECTION *sc;
2043
2044	if ((sc = SSL_CONNECTION_FROM_CONST_SSL(ssl)) == NULL) {
2045	ERR_raise(ERR_LIB_SSL, ERR_R_PASSED_NULL_PARAMETER);
2046	return 0;
2047	}
2048	if (sc->cert->key->x509 == NULL) {
2049	ERR_raise(ERR_LIB_SSL, SSL_R_NO_CERTIFICATE_ASSIGNED);
2050	return 0;
2051	}
2052	if (sc->cert->key->privatekey == NULL) {
2053	ERR_raise(ERR_LIB_SSL, SSL_R_NO_PRIVATE_KEY_ASSIGNED);
2054	return 0;
2055	}
2056	return X509_check_private_key(sc->cert->key->x509,
2057	sc->cert->key->privatekey);
2058	}
2059
2060	int SSL_waiting_for_async(SSL *s)
2061	{
2062	SSL_CONNECTION *sc = SSL_CONNECTION_FROM_SSL(s);
2063
2064	if (sc == NULL)
2065	return 0;
2066
2067	if (sc->job)
2068	return 1;
2069
2070	return 0;
2071	}
2072
2073	int SSL_get_all_async_fds(SSL s, OSSL_ASYNC_FD fds, size_t *numfds)
2074	{
2075	ASYNC_WAIT_CTX *ctx;
2076	SSL_CONNECTION *sc = SSL_CONNECTION_FROM_SSL(s);
2077
2078	if (sc == NULL)
2079	return 0;
2080
2081	if ((ctx = sc->waitctx) == NULL)
2082	return 0;
2083	return ASYNC_WAIT_CTX_get_all_fds(ctx, fds, numfds);
2084	}
2085
2086	int SSL_get_changed_async_fds(SSL s, OSSL_ASYNC_FD addfd, size_t *numaddfds,
2087	OSSL_ASYNC_FD delfd, size_t numdelfds)
2088	{
2089	ASYNC_WAIT_CTX *ctx;
2090	SSL_CONNECTION *sc = SSL_CONNECTION_FROM_SSL(s);
2091
2092	if (sc == NULL)
2093	return 0;
2094
2095	if ((ctx = sc->waitctx) == NULL)
2096	return 0;
2097	return ASYNC_WAIT_CTX_get_changed_fds(ctx, addfd, numaddfds, delfd,
2098	numdelfds);
2099	}
2100
2101	int SSL_CTX_set_async_callback(SSL_CTX *ctx, SSL_async_callback_fn callback)
2102	{
2103	ctx->async_cb = callback;
2104	return 1;
2105	}
2106
2107	int SSL_CTX_set_async_callback_arg(SSL_CTX ctx, void arg)
2108	{
2109	ctx->async_cb_arg = arg;
2110	return 1;
2111	}
2112
2113	int SSL_set_async_callback(SSL *s, SSL_async_callback_fn callback)
2114	{
2115	SSL_CONNECTION *sc = SSL_CONNECTION_FROM_SSL(s);
2116
2117	if (sc == NULL)
2118	return 0;
2119
2120	sc->async_cb = callback;
2121	return 1;
2122	}
2123
2124	int SSL_set_async_callback_arg(SSL s, void arg)
2125	{
2126	SSL_CONNECTION *sc = SSL_CONNECTION_FROM_SSL(s);
2127
2128	if (sc == NULL)
2129	return 0;
2130
2131	sc->async_cb_arg = arg;
2132	return 1;
2133	}
2134
2135	int SSL_get_async_status(SSL s, int status)
2136	{
2137	ASYNC_WAIT_CTX *ctx;
2138	SSL_CONNECTION *sc = SSL_CONNECTION_FROM_SSL(s);
2139
2140	if (sc == NULL)
2141	return 0;
2142
2143	if ((ctx = sc->waitctx) == NULL)
2144	return 0;
2145	*status = ASYNC_WAIT_CTX_get_status(ctx);
2146	return 1;
2147	}
2148
2149	int SSL_accept(SSL *s)
2150	{
2151	SSL_CONNECTION *sc = SSL_CONNECTION_FROM_SSL(s);
2152
2153	#ifndef OPENSSL_NO_QUIC
2154	if (IS_QUIC(s))
2155	return s->method->ssl_accept(s);
2156	#endif
2157
2158	if (sc == NULL)
2159	return 0;
2160
2161	if (sc->handshake_func == NULL) {
2162	/* Not properly initialized yet */
2163	SSL_set_accept_state(s);
2164	}
2165
2166	return SSL_do_handshake(s);
2167	}
2168
2169	int SSL_connect(SSL *s)
2170	{
2171	SSL_CONNECTION *sc = SSL_CONNECTION_FROM_SSL(s);
2172
2173	#ifndef OPENSSL_NO_QUIC
2174	if (IS_QUIC(s))
2175	return s->method->ssl_connect(s);
2176	#endif
2177
2178	if (sc == NULL)
2179	return 0;
2180
2181	if (sc->handshake_func == NULL) {
2182	/* Not properly initialized yet */
2183	SSL_set_connect_state(s);
2184	}
2185
2186	return SSL_do_handshake(s);
2187	}
2188
2189	long SSL_get_default_timeout(const SSL *s)
2190	{
2191	return (long int)ossl_time2seconds(s->method->get_timeout());
2192	}
2193
2194	static int ssl_async_wait_ctx_cb(void *arg)
2195	{
2196	SSL s = (SSL )arg;
2197	SSL_CONNECTION *sc = SSL_CONNECTION_FROM_SSL(s);
2198
2199	if (sc == NULL)
2200	return 0;
2201
2202	return sc->async_cb(s, sc->async_cb_arg);
2203	}
2204
2205	static int ssl_start_async_job(SSL s, struct ssl_async_args args,
2206	int (func) (void ))
2207	{
2208	int ret;
2209	SSL_CONNECTION *sc = SSL_CONNECTION_FROM_SSL(s);
2210
2211	if (sc == NULL)
2212	return 0;
2213
2214	if (sc->waitctx == NULL) {
2215	sc->waitctx = ASYNC_WAIT_CTX_new();
2216	if (sc->waitctx == NULL)
2217	return -1;
2218	if (sc->async_cb != NULL
2219	&& !ASYNC_WAIT_CTX_set_callback
2220	(sc->waitctx, ssl_async_wait_ctx_cb, s))
2221	return -1;
2222	}
2223
2224	sc->rwstate = SSL_NOTHING;
2225	switch (ASYNC_start_job(&sc->job, sc->waitctx, &ret, func, args,
2226	sizeof(struct ssl_async_args))) {
2227	case ASYNC_ERR:
2228	sc->rwstate = SSL_NOTHING;
2229	ERR_raise(ERR_LIB_SSL, SSL_R_FAILED_TO_INIT_ASYNC);
2230	return -1;
2231	case ASYNC_PAUSE:
2232	sc->rwstate = SSL_ASYNC_PAUSED;
2233	return -1;
2234	case ASYNC_NO_JOBS:
2235	sc->rwstate = SSL_ASYNC_NO_JOBS;
2236	return -1;
2237	case ASYNC_FINISH:
2238	sc->job = NULL;
2239	return ret;
2240	default:
2241	sc->rwstate = SSL_NOTHING;
2242	ERR_raise(ERR_LIB_SSL, ERR_R_INTERNAL_ERROR);
2243	/* Shouldn't happen */
2244	return -1;
2245	}
2246	}
2247
2248	static int ssl_io_intern(void *vargs)
2249	{
2250	struct ssl_async_args *args;
2251	SSL *s;
2252	void *buf;
2253	size_t num;
2254	SSL_CONNECTION *sc;
2255
2256	args = (struct ssl_async_args *)vargs;
2257	s = args->s;
2258	buf = args->buf;
2259	num = args->num;
2260	if ((sc = SSL_CONNECTION_FROM_SSL(s)) == NULL)
2261	return -1;
2262
2263	switch (args->type) {
2264	case READFUNC:
2265	return args->f.func_read(s, buf, num, &sc->asyncrw);
2266	case WRITEFUNC:
2267	return args->f.func_write(s, buf, num, &sc->asyncrw);
2268	case OTHERFUNC:
2269	return args->f.func_other(s);
2270	}
2271	return -1;
2272	}
2273
2274	int ssl_read_internal(SSL s, void buf, size_t num, size_t *readbytes)
2275	{
2276	SSL_CONNECTION *sc = SSL_CONNECTION_FROM_SSL(s);
2277
2278	#ifndef OPENSSL_NO_QUIC
2279	if (IS_QUIC(s))
2280	return s->method->ssl_read(s, buf, num, readbytes);
2281	#endif
2282
2283	if (sc == NULL)
2284	return -1;
2285
2286	if (sc->handshake_func == NULL) {
2287	ERR_raise(ERR_LIB_SSL, SSL_R_UNINITIALIZED);
2288	return -1;
2289	}
2290
2291	if (sc->shutdown & SSL_RECEIVED_SHUTDOWN) {
2292	sc->rwstate = SSL_NOTHING;
2293	return 0;
2294	}
2295
2296	if (sc->early_data_state == SSL_EARLY_DATA_CONNECT_RETRY
2297	\|\| sc->early_data_state == SSL_EARLY_DATA_ACCEPT_RETRY) {
2298	ERR_raise(ERR_LIB_SSL, ERR_R_SHOULD_NOT_HAVE_BEEN_CALLED);
2299	return 0;
2300	}
2301	/*
2302	* If we are a client and haven't received the ServerHello etc then we
2303	* better do that
2304	*/
2305	ossl_statem_check_finish_init(sc, 0);
2306
2307	if ((sc->mode & SSL_MODE_ASYNC) && ASYNC_get_current_job() == NULL) {
2308	struct ssl_async_args args;
2309	int ret;
2310
2311	args.s = s;
2312	args.buf = buf;
2313	args.num = num;
2314	args.type = READFUNC;
2315	args.f.func_read = s->method->ssl_read;
2316
2317	ret = ssl_start_async_job(s, &args, ssl_io_intern);
2318	*readbytes = sc->asyncrw;
2319	return ret;
2320	} else {
2321	return s->method->ssl_read(s, buf, num, readbytes);
2322	}
2323	}
2324
2325	int SSL_read(SSL s, void buf, int num)
2326	{
2327	int ret;
2328	size_t readbytes;
2329
2330	if (num < 0) {
2331	ERR_raise(ERR_LIB_SSL, SSL_R_BAD_LENGTH);
2332	return -1;
2333	}
2334
2335	ret = ssl_read_internal(s, buf, (size_t)num, &readbytes);
2336
2337	/*
2338	* The cast is safe here because ret should be <= INT_MAX because num is
2339	* <= INT_MAX
2340	*/
2341	if (ret > 0)
2342	ret = (int)readbytes;
2343
2344	return ret;
2345	}
2346
2347	int SSL_read_ex(SSL s, void buf, size_t num, size_t *readbytes)
2348	{
2349	int ret = ssl_read_internal(s, buf, num, readbytes);
2350
2351	if (ret < 0)
2352	ret = 0;
2353	return ret;
2354	}
2355
2356	int SSL_read_early_data(SSL s, void buf, size_t num, size_t *readbytes)
2357	{
2358	int ret;
2359	SSL_CONNECTION *sc = SSL_CONNECTION_FROM_SSL_ONLY(s);
2360
2361	/* TODO(QUIC 0RTT): 0-RTT support */
2362	if (sc == NULL \|\| !sc->server) {
2363	ERR_raise(ERR_LIB_SSL, ERR_R_SHOULD_NOT_HAVE_BEEN_CALLED);
2364	return SSL_READ_EARLY_DATA_ERROR;
2365	}
2366
2367	switch (sc->early_data_state) {
2368	case SSL_EARLY_DATA_NONE:
2369	if (!SSL_in_before(s)) {
2370	ERR_raise(ERR_LIB_SSL, ERR_R_SHOULD_NOT_HAVE_BEEN_CALLED);
2371	return SSL_READ_EARLY_DATA_ERROR;
2372	}
2373	/* fall through */
2374
2375	case SSL_EARLY_DATA_ACCEPT_RETRY:
2376	sc->early_data_state = SSL_EARLY_DATA_ACCEPTING;
2377	ret = SSL_accept(s);
2378	if (ret <= 0) {
2379	/* NBIO or error */
2380	sc->early_data_state = SSL_EARLY_DATA_ACCEPT_RETRY;
2381	return SSL_READ_EARLY_DATA_ERROR;
2382	}
2383	/* fall through */
2384
2385	case SSL_EARLY_DATA_READ_RETRY:
2386	if (sc->ext.early_data == SSL_EARLY_DATA_ACCEPTED) {
2387	sc->early_data_state = SSL_EARLY_DATA_READING;
2388	ret = SSL_read_ex(s, buf, num, readbytes);
2389	/*
2390	* State machine will update early_data_state to
2391	* SSL_EARLY_DATA_FINISHED_READING if we get an EndOfEarlyData
2392	* message
2393	*/
2394	if (ret > 0 \|\| (ret <= 0 && sc->early_data_state
2395	!= SSL_EARLY_DATA_FINISHED_READING)) {
2396	sc->early_data_state = SSL_EARLY_DATA_READ_RETRY;
2397	return ret > 0 ? SSL_READ_EARLY_DATA_SUCCESS
2398	: SSL_READ_EARLY_DATA_ERROR;
2399	}
2400	} else {
2401	sc->early_data_state = SSL_EARLY_DATA_FINISHED_READING;
2402	}
2403	*readbytes = 0;
2404	return SSL_READ_EARLY_DATA_FINISH;
2405
2406	default:
2407	ERR_raise(ERR_LIB_SSL, ERR_R_SHOULD_NOT_HAVE_BEEN_CALLED);
2408	return SSL_READ_EARLY_DATA_ERROR;
2409	}
2410	}
2411
2412	int SSL_get_early_data_status(const SSL *s)
2413	{
2414	const SSL_CONNECTION *sc = SSL_CONNECTION_FROM_CONST_SSL_ONLY(s);
2415
2416	/* TODO(QUIC 0RTT): 0-RTT support */
2417	if (sc == NULL)
2418	return 0;
2419
2420	return sc->ext.early_data;
2421	}
2422
2423	static int ssl_peek_internal(SSL s, void buf, size_t num, size_t *readbytes)
2424	{
2425	SSL_CONNECTION *sc = SSL_CONNECTION_FROM_SSL(s);
2426
2427	#ifndef OPENSSL_NO_QUIC
2428	if (IS_QUIC(s))
2429	return s->method->ssl_peek(s, buf, num, readbytes);
2430	#endif
2431
2432	if (sc == NULL)
2433	return 0;
2434
2435	if (sc->handshake_func == NULL) {
2436	ERR_raise(ERR_LIB_SSL, SSL_R_UNINITIALIZED);
2437	return -1;
2438	}
2439
2440	if (sc->shutdown & SSL_RECEIVED_SHUTDOWN) {
2441	return 0;
2442	}
2443	if ((sc->mode & SSL_MODE_ASYNC) && ASYNC_get_current_job() == NULL) {
2444	struct ssl_async_args args;
2445	int ret;
2446
2447	args.s = s;
2448	args.buf = buf;
2449	args.num = num;
2450	args.type = READFUNC;
2451	args.f.func_read = s->method->ssl_peek;
2452
2453	ret = ssl_start_async_job(s, &args, ssl_io_intern);
2454	*readbytes = sc->asyncrw;
2455	return ret;
2456	} else {
2457	return s->method->ssl_peek(s, buf, num, readbytes);
2458	}
2459	}
2460
2461	int SSL_peek(SSL s, void buf, int num)
2462	{
2463	int ret;
2464	size_t readbytes;
2465
2466	if (num < 0) {
2467	ERR_raise(ERR_LIB_SSL, SSL_R_BAD_LENGTH);
2468	return -1;
2469	}
2470
2471	ret = ssl_peek_internal(s, buf, (size_t)num, &readbytes);
2472
2473	/*
2474	* The cast is safe here because ret should be <= INT_MAX because num is
2475	* <= INT_MAX
2476	*/
2477	if (ret > 0)
2478	ret = (int)readbytes;
2479
2480	return ret;
2481	}
2482
2483
2484	int SSL_peek_ex(SSL s, void buf, size_t num, size_t *readbytes)
2485	{
2486	int ret = ssl_peek_internal(s, buf, num, readbytes);
2487
2488	if (ret < 0)
2489	ret = 0;
2490	return ret;
2491	}
2492
2493	int ssl_write_internal(SSL s, const void buf, size_t num,
2494	uint64_t flags, size_t *written)
2495	{
2496	SSL_CONNECTION *sc = SSL_CONNECTION_FROM_SSL(s);
2497
2498	#ifndef OPENSSL_NO_QUIC
2499	if (IS_QUIC(s))
2500	return ossl_quic_write_flags(s, buf, num, flags, written);
2501	#endif
2502
2503	if (sc == NULL)
2504	return 0;
2505
2506	if (sc->handshake_func == NULL) {
2507	ERR_raise(ERR_LIB_SSL, SSL_R_UNINITIALIZED);
2508	return -1;
2509	}
2510
2511	if (sc->shutdown & SSL_SENT_SHUTDOWN) {
2512	sc->rwstate = SSL_NOTHING;
2513	ERR_raise(ERR_LIB_SSL, SSL_R_PROTOCOL_IS_SHUTDOWN);
2514	return -1;
2515	}
2516
2517	if (flags != 0) {
2518	ERR_raise(ERR_LIB_SSL, SSL_R_UNSUPPORTED_WRITE_FLAG);
2519	return -1;
2520	}
2521
2522	if (sc->early_data_state == SSL_EARLY_DATA_CONNECT_RETRY
2523	\|\| sc->early_data_state == SSL_EARLY_DATA_ACCEPT_RETRY
2524	\|\| sc->early_data_state == SSL_EARLY_DATA_READ_RETRY) {
2525	ERR_raise(ERR_LIB_SSL, ERR_R_SHOULD_NOT_HAVE_BEEN_CALLED);
2526	return 0;
2527	}
2528	/* If we are a client and haven't sent the Finished we better do that */
2529	ossl_statem_check_finish_init(sc, 1);
2530
2531	if ((sc->mode & SSL_MODE_ASYNC) && ASYNC_get_current_job() == NULL) {
2532	int ret;
2533	struct ssl_async_args args;
2534
2535	args.s = s;
2536	args.buf = (void *)buf;
2537	args.num = num;
2538	args.type = WRITEFUNC;
2539	args.f.func_write = s->method->ssl_write;
2540
2541	ret = ssl_start_async_job(s, &args, ssl_io_intern);
2542	*written = sc->asyncrw;
2543	return ret;
2544	} else {
2545	return s->method->ssl_write(s, buf, num, written);
2546	}
2547	}
2548
2549	ossl_ssize_t SSL_sendfile(SSL *s, int fd, off_t offset, size_t size, int flags)
2550	{
2551	ossl_ssize_t ret;
2552	SSL_CONNECTION *sc = SSL_CONNECTION_FROM_SSL_ONLY(s);
2553
2554	if (sc == NULL)
2555	return 0;
2556
2557	if (sc->handshake_func == NULL) {
2558	ERR_raise(ERR_LIB_SSL, SSL_R_UNINITIALIZED);
2559	return -1;
2560	}
2561
2562	if (sc->shutdown & SSL_SENT_SHUTDOWN) {
2563	sc->rwstate = SSL_NOTHING;
2564	ERR_raise(ERR_LIB_SSL, SSL_R_PROTOCOL_IS_SHUTDOWN);
2565	return -1;
2566	}
2567
2568	if (!BIO_get_ktls_send(sc->wbio)) {
2569	ERR_raise(ERR_LIB_SSL, SSL_R_UNINITIALIZED);
2570	return -1;
2571	}
2572
2573	/* If we have an alert to send, lets send it */
2574	if (sc->s3.alert_dispatch > 0) {
2575	ret = (ossl_ssize_t)s->method->ssl_dispatch_alert(s);
2576	if (ret <= 0) {
2577	/* SSLfatal() already called if appropriate */
2578	return ret;
2579	}
2580	/* if it went, fall through and send more stuff */
2581	}
2582
2583	sc->rwstate = SSL_WRITING;
2584	if (BIO_flush(sc->wbio) <= 0) {
2585	if (!BIO_should_retry(sc->wbio)) {
2586	sc->rwstate = SSL_NOTHING;
2587	} else {
2588	#ifdef EAGAIN
2589	set_sys_error(EAGAIN);
2590	#endif
2591	}
2592	return -1;
2593	}
2594
2595	#ifdef OPENSSL_NO_KTLS
2596	ERR_raise_data(ERR_LIB_SSL, ERR_R_INTERNAL_ERROR,
2597	"can't call ktls_sendfile(), ktls disabled");
2598	return -1;
2599	#else
2600	ret = ktls_sendfile(SSL_get_wfd(s), fd, offset, size, flags);
2601	if (ret < 0) {
2602	#if defined(EAGAIN) && defined(EINTR) && defined(EBUSY)
2603	if ((get_last_sys_error() == EAGAIN) \|\|
2604	(get_last_sys_error() == EINTR) \|\|
2605	(get_last_sys_error() == EBUSY))
2606	BIO_set_retry_write(sc->wbio);
2607	else
2608	#endif
2609	ERR_raise_data(ERR_LIB_SYS, get_last_sys_error(),
2610	"ktls_sendfile failure");
2611	return ret;
2612	}
2613	sc->rwstate = SSL_NOTHING;
2614	return ret;
2615	#endif
2616	}
2617
2618	int SSL_write(SSL s, const void buf, int num)
2619	{
2620	int ret;
2621	size_t written;
2622
2623	if (num < 0) {
2624	ERR_raise(ERR_LIB_SSL, SSL_R_BAD_LENGTH);
2625	return -1;
2626	}
2627
2628	ret = ssl_write_internal(s, buf, (size_t)num, 0, &written);
2629
2630	/*
2631	* The cast is safe here because ret should be <= INT_MAX because num is
2632	* <= INT_MAX
2633	*/
2634	if (ret > 0)
2635	ret = (int)written;
2636
2637	return ret;
2638	}
2639
2640	int SSL_write_ex(SSL s, const void buf, size_t num, size_t *written)
2641	{
2642	return SSL_write_ex2(s, buf, num, 0, written);
2643	}
2644
2645	int SSL_write_ex2(SSL s, const void buf, size_t num, uint64_t flags,
2646	size_t *written)
2647	{
2648	int ret = ssl_write_internal(s, buf, num, flags, written);
2649
2650	if (ret < 0)
2651	ret = 0;
2652	return ret;
2653	}
2654
2655	int SSL_write_early_data(SSL s, const void buf, size_t num, size_t *written)
2656	{
2657	int ret, early_data_state;
2658	size_t writtmp;
2659	uint32_t partialwrite;
2660	SSL_CONNECTION *sc = SSL_CONNECTION_FROM_SSL_ONLY(s);
2661
2662	/* TODO(QUIC 0RTT): This will need special handling for QUIC */
2663	if (sc == NULL)
2664	return 0;
2665
2666	switch (sc->early_data_state) {
2667	case SSL_EARLY_DATA_NONE:
2668	if (sc->server
2669	\|\| !SSL_in_before(s)
2670	\|\| ((sc->session == NULL \|\| sc->session->ext.max_early_data == 0)
2671	&& (sc->psk_use_session_cb == NULL))) {
2672	ERR_raise(ERR_LIB_SSL, ERR_R_SHOULD_NOT_HAVE_BEEN_CALLED);
2673	return 0;
2674	}
2675	/* fall through */
2676
2677	case SSL_EARLY_DATA_CONNECT_RETRY:
2678	sc->early_data_state = SSL_EARLY_DATA_CONNECTING;
2679	ret = SSL_connect(s);
2680	if (ret <= 0) {
2681	/* NBIO or error */
2682	sc->early_data_state = SSL_EARLY_DATA_CONNECT_RETRY;
2683	return 0;
2684	}
2685	/* fall through */
2686
2687	case SSL_EARLY_DATA_WRITE_RETRY:
2688	sc->early_data_state = SSL_EARLY_DATA_WRITING;
2689	/*
2690	* We disable partial write for early data because we don't keep track
2691	* of how many bytes we've written between the SSL_write_ex() call and
2692	* the flush if the flush needs to be retried)
2693	*/
2694	partialwrite = sc->mode & SSL_MODE_ENABLE_PARTIAL_WRITE;
2695	sc->mode &= ~SSL_MODE_ENABLE_PARTIAL_WRITE;
2696	ret = SSL_write_ex(s, buf, num, &writtmp);
2697	sc->mode \|= partialwrite;
2698	if (!ret) {
2699	sc->early_data_state = SSL_EARLY_DATA_WRITE_RETRY;
2700	return ret;
2701	}
2702	sc->early_data_state = SSL_EARLY_DATA_WRITE_FLUSH;
2703	/* fall through */
2704
2705	case SSL_EARLY_DATA_WRITE_FLUSH:
2706	/* The buffering BIO is still in place so we need to flush it */
2707	if (statem_flush(sc) != 1)
2708	return 0;
2709	*written = num;
2710	sc->early_data_state = SSL_EARLY_DATA_WRITE_RETRY;
2711	return 1;
2712
2713	case SSL_EARLY_DATA_FINISHED_READING:
2714	case SSL_EARLY_DATA_READ_RETRY:
2715	early_data_state = sc->early_data_state;
2716	/* We are a server writing to an unauthenticated client */
2717	sc->early_data_state = SSL_EARLY_DATA_UNAUTH_WRITING;
2718	ret = SSL_write_ex(s, buf, num, written);
2719	/* The buffering BIO is still in place */
2720	if (ret)
2721	(void)BIO_flush(sc->wbio);
2722	sc->early_data_state = early_data_state;
2723	return ret;
2724
2725	default:
2726	ERR_raise(ERR_LIB_SSL, ERR_R_SHOULD_NOT_HAVE_BEEN_CALLED);
2727	return 0;
2728	}
2729	}
2730
2731	int SSL_shutdown(SSL *s)
2732	{
2733	/*
2734	* Note that this function behaves differently from what one might
2735	* expect. Return values are 0 for no success (yet), 1 for success; but
2736	* calling it once is usually not enough, even if blocking I/O is used
2737	* (see ssl3_shutdown).
2738	*/
2739	SSL_CONNECTION *sc = SSL_CONNECTION_FROM_SSL(s);
2740
2741	#ifndef OPENSSL_NO_QUIC
2742	if (IS_QUIC(s))
2743	return ossl_quic_conn_shutdown(s, 0, NULL, 0);
2744	#endif
2745
2746	if (sc == NULL)
2747	return -1;
2748
2749	if (sc->handshake_func == NULL) {
2750	ERR_raise(ERR_LIB_SSL, SSL_R_UNINITIALIZED);
2751	return -1;
2752	}
2753
2754	if (!SSL_in_init(s)) {
2755	if ((sc->mode & SSL_MODE_ASYNC) && ASYNC_get_current_job() == NULL) {
2756	struct ssl_async_args args;
2757
2758	memset(&args, 0, sizeof(args));
2759	args.s = s;
2760	args.type = OTHERFUNC;
2761	args.f.func_other = s->method->ssl_shutdown;
2762
2763	return ssl_start_async_job(s, &args, ssl_io_intern);
2764	} else {
2765	return s->method->ssl_shutdown(s);
2766	}
2767	} else {
2768	ERR_raise(ERR_LIB_SSL, SSL_R_SHUTDOWN_WHILE_IN_INIT);
2769	return -1;
2770	}
2771	}
2772
2773	int SSL_key_update(SSL *s, int updatetype)
2774	{
2775	SSL_CONNECTION *sc = SSL_CONNECTION_FROM_SSL(s);
2776
2777	#ifndef OPENSSL_NO_QUIC
2778	if (IS_QUIC(s))
2779	return ossl_quic_key_update(s, updatetype);
2780	#endif
2781
2782	if (sc == NULL)
2783	return 0;
2784
2785	if (!SSL_CONNECTION_IS_TLS13(sc)) {
2786	ERR_raise(ERR_LIB_SSL, SSL_R_WRONG_SSL_VERSION);
2787	return 0;
2788	}
2789
2790	if (updatetype != SSL_KEY_UPDATE_NOT_REQUESTED
2791	&& updatetype != SSL_KEY_UPDATE_REQUESTED) {
2792	ERR_raise(ERR_LIB_SSL, SSL_R_INVALID_KEY_UPDATE_TYPE);
2793	return 0;
2794	}
2795
2796	if (!SSL_is_init_finished(s)) {
2797	ERR_raise(ERR_LIB_SSL, SSL_R_STILL_IN_INIT);
2798	return 0;
2799	}
2800
2801	if (RECORD_LAYER_write_pending(&sc->rlayer)) {
2802	ERR_raise(ERR_LIB_SSL, SSL_R_BAD_WRITE_RETRY);
2803	return 0;
2804	}
2805
2806	ossl_statem_set_in_init(sc, 1);
2807	sc->key_update = updatetype;
2808	return 1;
2809	}
2810
2811	int SSL_get_key_update_type(const SSL *s)
2812	{
2813	const SSL_CONNECTION *sc = SSL_CONNECTION_FROM_CONST_SSL(s);
2814
2815	#ifndef OPENSSL_NO_QUIC
2816	if (IS_QUIC(s))
2817	return ossl_quic_get_key_update_type(s);
2818	#endif
2819
2820	if (sc == NULL)
2821	return 0;
2822
2823	return sc->key_update;
2824	}
2825
2826	/*
2827	* Can we accept a renegotiation request? If yes, set the flag and
2828	* return 1 if yes. If not, raise error and return 0.
2829	*/
2830	static int can_renegotiate(const SSL_CONNECTION *sc)
2831	{
2832	if (SSL_CONNECTION_IS_TLS13(sc)) {
2833	ERR_raise(ERR_LIB_SSL, SSL_R_WRONG_SSL_VERSION);
2834	return 0;
2835	}
2836
2837	if ((sc->options & SSL_OP_NO_RENEGOTIATION) != 0) {
2838	ERR_raise(ERR_LIB_SSL, SSL_R_NO_RENEGOTIATION);
2839	return 0;
2840	}
2841
2842	return 1;
2843	}
2844
2845	int SSL_renegotiate(SSL *s)
2846	{
2847	SSL_CONNECTION *sc = SSL_CONNECTION_FROM_SSL_ONLY(s);
2848
2849	if (sc == NULL)
2850	return 0;
2851
2852	if (!can_renegotiate(sc))
2853	return 0;
2854
2855	sc->renegotiate = 1;
2856	sc->new_session = 1;
2857	return s->method->ssl_renegotiate(s);
2858	}
2859
2860	int SSL_renegotiate_abbreviated(SSL *s)
2861	{
2862	SSL_CONNECTION *sc = SSL_CONNECTION_FROM_SSL_ONLY(s);
2863
2864	if (sc == NULL)
2865	return 0;
2866
2867	if (!can_renegotiate(sc))
2868	return 0;
2869
2870	sc->renegotiate = 1;
2871	sc->new_session = 0;
2872	return s->method->ssl_renegotiate(s);
2873	}
2874
2875	int SSL_renegotiate_pending(const SSL *s)
2876	{
2877	SSL_CONNECTION *sc = SSL_CONNECTION_FROM_SSL_ONLY(s);
2878
2879	if (sc == NULL)
2880	return 0;
2881
2882	/*
2883	* becomes true when negotiation is requested; false again once a
2884	* handshake has finished
2885	*/
2886	return (sc->renegotiate != 0);
2887	}
2888
2889	int SSL_new_session_ticket(SSL *s)
2890	{
2891	SSL_CONNECTION *sc = SSL_CONNECTION_FROM_SSL(s);
2892
2893	if (sc == NULL)
2894	return 0;
2895
2896	/* If we are in init because we're sending tickets, okay to send more. */
2897	if ((SSL_in_init(s) && sc->ext.extra_tickets_expected == 0)
2898	\|\| SSL_IS_FIRST_HANDSHAKE(sc) \|\| !sc->server
2899	\|\| !SSL_CONNECTION_IS_TLS13(sc))
2900	return 0;
2901	sc->ext.extra_tickets_expected++;
2902	if (!RECORD_LAYER_write_pending(&sc->rlayer) && !SSL_in_init(s))
2903	ossl_statem_set_in_init(sc, 1);
2904	return 1;
2905	}
2906
2907	long SSL_ctrl(SSL s, int cmd, long larg, void parg)
2908	{
2909	return ossl_ctrl_internal(s, cmd, larg, parg, /no_quic=/0);
2910	}
2911
2912	long ossl_ctrl_internal(SSL s, int cmd, long larg, void parg, int no_quic)
2913	{
2914	long l;
2915	SSL_CONNECTION *sc = SSL_CONNECTION_FROM_SSL(s);
2916
2917	/*
2918	* Routing of ctrl calls for QUIC is a little counterintuitive:
2919	*
2920	* - Firstly (no_quic=0), we pass the ctrl directly to our QUIC
2921	* implementation in case it wants to handle the ctrl specially.
2922	*
2923	* - If our QUIC implementation does not care about the ctrl, it
2924	* will reenter this function with no_quic=1 and we will try to handle
2925	* it directly using the QCSO SSL object stub (not the handshake layer
2926	* SSL object). This is important for e.g. the version configuration
2927	* ctrls below, which must use s->defltmeth (and not sc->defltmeth).
2928	*
2929	* - If we don't handle a ctrl here specially, then processing is
2930	* redirected to the handshake layer SSL object.
2931	*/
2932	if (!no_quic && IS_QUIC(s))
2933	return s->method->ssl_ctrl(s, cmd, larg, parg);
2934
2935	if (sc == NULL)
2936	return 0;
2937
2938	switch (cmd) {
2939	case SSL_CTRL_GET_READ_AHEAD:
2940	return RECORD_LAYER_get_read_ahead(&sc->rlayer);
2941	case SSL_CTRL_SET_READ_AHEAD:
2942	l = RECORD_LAYER_get_read_ahead(&sc->rlayer);
2943	RECORD_LAYER_set_read_ahead(&sc->rlayer, larg);
2944	return l;
2945
2946	case SSL_CTRL_MODE:
2947	{
2948	OSSL_PARAM options[2], *opts = options;
2949
2950	sc->mode \|= larg;
2951
2952	*opts++ = OSSL_PARAM_construct_uint32(OSSL_LIBSSL_RECORD_LAYER_PARAM_MODE,
2953	&sc->mode);
2954	*opts = OSSL_PARAM_construct_end();
2955
2956	/* Ignore return value */
2957	sc->rlayer.rrlmethod->set_options(sc->rlayer.rrl, options);
2958
2959	return sc->mode;
2960	}
2961	case SSL_CTRL_CLEAR_MODE:
2962	return (sc->mode &= ~larg);
2963	case SSL_CTRL_GET_MAX_CERT_LIST:
2964	return (long)sc->max_cert_list;
2965	case SSL_CTRL_SET_MAX_CERT_LIST:
2966	if (larg < 0)
2967	return 0;
2968	l = (long)sc->max_cert_list;
2969	sc->max_cert_list = (size_t)larg;
2970	return l;
2971	case SSL_CTRL_SET_MAX_SEND_FRAGMENT:
2972	if (larg < 512 \|\| larg > SSL3_RT_MAX_PLAIN_LENGTH)
2973	return 0;
2974	#ifndef OPENSSL_NO_KTLS
2975	if (sc->wbio != NULL && BIO_get_ktls_send(sc->wbio))
2976	return 0;
2977	#endif /* OPENSSL_NO_KTLS */
2978	sc->max_send_fragment = larg;
2979	if (sc->max_send_fragment < sc->split_send_fragment)
2980	sc->split_send_fragment = sc->max_send_fragment;
2981	sc->rlayer.wrlmethod->set_max_frag_len(sc->rlayer.wrl, larg);
2982	return 1;
2983	case SSL_CTRL_SET_SPLIT_SEND_FRAGMENT:
2984	if ((size_t)larg > sc->max_send_fragment \|\| larg == 0)
2985	return 0;
2986	sc->split_send_fragment = larg;
2987	return 1;
2988	case SSL_CTRL_SET_MAX_PIPELINES:
2989	if (larg < 1 \|\| larg > SSL_MAX_PIPELINES)
2990	return 0;
2991	sc->max_pipelines = larg;
2992	if (sc->rlayer.rrlmethod->set_max_pipelines != NULL)
2993	sc->rlayer.rrlmethod->set_max_pipelines(sc->rlayer.rrl, (size_t)larg);
2994	return 1;
2995	case SSL_CTRL_GET_RI_SUPPORT:
2996	return sc->s3.send_connection_binding;
2997	case SSL_CTRL_SET_RETRY_VERIFY:
2998	sc->rwstate = SSL_RETRY_VERIFY;
2999	return 1;
3000	case SSL_CTRL_CERT_FLAGS:
3001	return (sc->cert->cert_flags \|= larg);
3002	case SSL_CTRL_CLEAR_CERT_FLAGS:
3003	return (sc->cert->cert_flags &= ~larg);
3004
3005	case SSL_CTRL_GET_RAW_CIPHERLIST:
3006	if (parg) {
3007	if (sc->s3.tmp.ciphers_raw == NULL)
3008	return 0;
3009	(unsigned char *)parg = sc->s3.tmp.ciphers_raw;
3010	return (int)sc->s3.tmp.ciphers_rawlen;
3011	} else {
3012	return TLS_CIPHER_LEN;
3013	}
3014	case SSL_CTRL_GET_EXTMS_SUPPORT:
3015	if (!sc->session \|\| SSL_in_init(s) \|\| ossl_statem_get_in_handshake(sc))
3016	return -1;
3017	if (sc->session->flags & SSL_SESS_FLAG_EXTMS)
3018	return 1;
3019	else
3020	return 0;
3021	case SSL_CTRL_SET_MIN_PROTO_VERSION:
3022	return ssl_check_allowed_versions(larg, sc->max_proto_version)
3023	&& ssl_set_version_bound(s->defltmeth->version, (int)larg,
3024	&sc->min_proto_version);
3025	case SSL_CTRL_GET_MIN_PROTO_VERSION:
3026	return sc->min_proto_version;
3027	case SSL_CTRL_SET_MAX_PROTO_VERSION:
3028	return ssl_check_allowed_versions(sc->min_proto_version, larg)
3029	&& ssl_set_version_bound(s->defltmeth->version, (int)larg,
3030	&sc->max_proto_version);
3031	case SSL_CTRL_GET_MAX_PROTO_VERSION:
3032	return sc->max_proto_version;
3033	default:
3034	if (IS_QUIC(s))
3035	return SSL_ctrl((SSL *)sc, cmd, larg, parg);
3036	else
3037	return s->method->ssl_ctrl(s, cmd, larg, parg);
3038	}
3039	}
3040
3041	long SSL_callback_ctrl(SSL s, int cmd, void (fp) (void))
3042	{
3043	return s->method->ssl_callback_ctrl(s, cmd, fp);
3044	}
3045
3046	LHASH_OF(SSL_SESSION) SSL_CTX_sessions(SSL_CTX ctx)
3047	{
3048	return ctx->sessions;
3049	}
3050
3051	static int ssl_tsan_load(SSL_CTX ctx, TSAN_QUALIFIER int stat)
3052	{
3053	int res = 0;
3054
3055	if (ssl_tsan_lock(ctx)) {
3056	res = tsan_load(stat);
3057	ssl_tsan_unlock(ctx);
3058	}
3059	return res;
3060	}
3061
3062	long SSL_CTX_ctrl(SSL_CTX ctx, int cmd, long larg, void parg)
3063	{
3064	long l;
3065	/* For some cases with ctx == NULL perform syntax checks */
3066	if (ctx == NULL) {
3067	switch (cmd) {
3068	case SSL_CTRL_SET_GROUPS_LIST:
3069	return tls1_set_groups_list(ctx, NULL, NULL, parg);
3070	case SSL_CTRL_SET_SIGALGS_LIST:
3071	case SSL_CTRL_SET_CLIENT_SIGALGS_LIST:
3072	return tls1_set_sigalgs_list(ctx, NULL, parg, 0);
3073	default:
3074	return 0;
3075	}
3076	}
3077
3078	switch (cmd) {
3079	case SSL_CTRL_GET_READ_AHEAD:
3080	return ctx->read_ahead;
3081	case SSL_CTRL_SET_READ_AHEAD:
3082	l = ctx->read_ahead;
3083	ctx->read_ahead = larg;
3084	return l;
3085
3086	case SSL_CTRL_SET_MSG_CALLBACK_ARG:
3087	ctx->msg_callback_arg = parg;
3088	return 1;
3089
3090	case SSL_CTRL_GET_MAX_CERT_LIST:
3091	return (long)ctx->max_cert_list;
3092	case SSL_CTRL_SET_MAX_CERT_LIST:
3093	if (larg < 0)
3094	return 0;
3095	l = (long)ctx->max_cert_list;
3096	ctx->max_cert_list = (size_t)larg;
3097	return l;
3098
3099	case SSL_CTRL_SET_SESS_CACHE_SIZE:
3100	if (larg < 0)
3101	return 0;
3102	l = (long)ctx->session_cache_size;
3103	ctx->session_cache_size = (size_t)larg;
3104	return l;
3105	case SSL_CTRL_GET_SESS_CACHE_SIZE:
3106	return (long)ctx->session_cache_size;
3107	case SSL_CTRL_SET_SESS_CACHE_MODE:
3108	l = ctx->session_cache_mode;
3109	ctx->session_cache_mode = larg;
3110	return l;
3111	case SSL_CTRL_GET_SESS_CACHE_MODE:
3112	return ctx->session_cache_mode;
3113
3114	case SSL_CTRL_SESS_NUMBER:
3115	return lh_SSL_SESSION_num_items(ctx->sessions);
3116	case SSL_CTRL_SESS_CONNECT:
3117	return ssl_tsan_load(ctx, &ctx->stats.sess_connect);
3118	case SSL_CTRL_SESS_CONNECT_GOOD:
3119	return ssl_tsan_load(ctx, &ctx->stats.sess_connect_good);
3120	case SSL_CTRL_SESS_CONNECT_RENEGOTIATE:
3121	return ssl_tsan_load(ctx, &ctx->stats.sess_connect_renegotiate);
3122	case SSL_CTRL_SESS_ACCEPT:
3123	return ssl_tsan_load(ctx, &ctx->stats.sess_accept);
3124	case SSL_CTRL_SESS_ACCEPT_GOOD:
3125	return ssl_tsan_load(ctx, &ctx->stats.sess_accept_good);
3126	case SSL_CTRL_SESS_ACCEPT_RENEGOTIATE:
3127	return ssl_tsan_load(ctx, &ctx->stats.sess_accept_renegotiate);
3128	case SSL_CTRL_SESS_HIT:
3129	return ssl_tsan_load(ctx, &ctx->stats.sess_hit);
3130	case SSL_CTRL_SESS_CB_HIT:
3131	return ssl_tsan_load(ctx, &ctx->stats.sess_cb_hit);
3132	case SSL_CTRL_SESS_MISSES:
3133	return ssl_tsan_load(ctx, &ctx->stats.sess_miss);
3134	case SSL_CTRL_SESS_TIMEOUTS:
3135	return ssl_tsan_load(ctx, &ctx->stats.sess_timeout);
3136	case SSL_CTRL_SESS_CACHE_FULL:
3137	return ssl_tsan_load(ctx, &ctx->stats.sess_cache_full);
3138	case SSL_CTRL_MODE:
3139	return (ctx->mode \|= larg);
3140	case SSL_CTRL_CLEAR_MODE:
3141	return (ctx->mode &= ~larg);
3142	case SSL_CTRL_SET_MAX_SEND_FRAGMENT:
3143	if (larg < 512 \|\| larg > SSL3_RT_MAX_PLAIN_LENGTH)
3144	return 0;
3145	ctx->max_send_fragment = larg;
3146	if (ctx->max_send_fragment < ctx->split_send_fragment)
3147	ctx->split_send_fragment = ctx->max_send_fragment;
3148	return 1;
3149	case SSL_CTRL_SET_SPLIT_SEND_FRAGMENT:
3150	if ((size_t)larg > ctx->max_send_fragment \|\| larg == 0)
3151	return 0;
3152	ctx->split_send_fragment = larg;
3153	return 1;
3154	case SSL_CTRL_SET_MAX_PIPELINES:
3155	if (larg < 1 \|\| larg > SSL_MAX_PIPELINES)
3156	return 0;
3157	ctx->max_pipelines = larg;
3158	return 1;
3159	case SSL_CTRL_CERT_FLAGS:
3160	return (ctx->cert->cert_flags \|= larg);
3161	case SSL_CTRL_CLEAR_CERT_FLAGS:
3162	return (ctx->cert->cert_flags &= ~larg);
3163	case SSL_CTRL_SET_MIN_PROTO_VERSION:
3164	return ssl_check_allowed_versions(larg, ctx->max_proto_version)
3165	&& ssl_set_version_bound(ctx->method->version, (int)larg,
3166	&ctx->min_proto_version);
3167	case SSL_CTRL_GET_MIN_PROTO_VERSION:
3168	return ctx->min_proto_version;
3169	case SSL_CTRL_SET_MAX_PROTO_VERSION:
3170	return ssl_check_allowed_versions(ctx->min_proto_version, larg)
3171	&& ssl_set_version_bound(ctx->method->version, (int)larg,
3172	&ctx->max_proto_version);
3173	case SSL_CTRL_GET_MAX_PROTO_VERSION:
3174	return ctx->max_proto_version;
3175	default:
3176	return ctx->method->ssl_ctx_ctrl(ctx, cmd, larg, parg);
3177	}
3178	}
3179
3180	long SSL_CTX_callback_ctrl(SSL_CTX ctx, int cmd, void (fp) (void))
3181	{
3182	switch (cmd) {
3183	case SSL_CTRL_SET_MSG_CALLBACK:
3184	ctx->msg_callback = (void (*)
3185	(int write_p, int version, int content_type,
3186	const void buf, size_t len, SSL ssl,
3187	void *arg))(fp);
3188	return 1;
3189
3190	default:
3191	return ctx->method->ssl_ctx_callback_ctrl(ctx, cmd, fp);
3192	}
3193	}
3194
3195	int ssl_cipher_id_cmp(const SSL_CIPHER a, const SSL_CIPHER b)
3196	{
3197	if (a->id > b->id)
3198	return 1;
3199	if (a->id < b->id)
3200	return -1;
3201	return 0;
3202	}
3203
3204	int ssl_cipher_ptr_id_cmp(const SSL_CIPHER const ap,
3205	const SSL_CIPHER const bp)
3206	{
3207	if ((ap)->id > (bp)->id)
3208	return 1;
3209	if ((ap)->id < (bp)->id)
3210	return -1;
3211	return 0;
3212	}
3213
3214	/*
3215	* return a STACK of the ciphers available for the SSL and in order of
3216	* preference
3217	*/
3218	STACK_OF(SSL_CIPHER) SSL_get_ciphers(const SSL s)
3219	{
3220	const SSL_CONNECTION *sc = SSL_CONNECTION_FROM_CONST_SSL(s);
3221
3222	if (sc != NULL) {
3223	if (sc->cipher_list != NULL) {
3224	return sc->cipher_list;
3225	} else if ((s->ctx != NULL) && (s->ctx->cipher_list != NULL)) {
3226	return s->ctx->cipher_list;
3227	}
3228	}
3229	return NULL;
3230	}
3231
3232	STACK_OF(SSL_CIPHER) SSL_get_client_ciphers(const SSL s)
3233	{
3234	const SSL_CONNECTION *sc = SSL_CONNECTION_FROM_CONST_SSL(s);
3235
3236	if (sc == NULL \|\| !sc->server)
3237	return NULL;
3238	return sc->peer_ciphers;
3239	}
3240
3241	STACK_OF(SSL_CIPHER) SSL_get1_supported_ciphers(SSL s)
3242	{
3243	STACK_OF(SSL_CIPHER) sk = NULL, ciphers;
3244	int i;
3245	SSL_CONNECTION *sc = SSL_CONNECTION_FROM_SSL(s);
3246
3247	if (sc == NULL)
3248	return NULL;
3249
3250	ciphers = SSL_get_ciphers(s);
3251	if (!ciphers)
3252	return NULL;
3253	if (!ssl_set_client_disabled(sc))
3254	return NULL;
3255	for (i = 0; i < sk_SSL_CIPHER_num(ciphers); i++) {
3256	const SSL_CIPHER *c = sk_SSL_CIPHER_value(ciphers, i);
3257	if (!ssl_cipher_disabled(sc, c, SSL_SECOP_CIPHER_SUPPORTED, 0)) {
3258	if (!sk)
3259	sk = sk_SSL_CIPHER_new_null();
3260	if (!sk)
3261	return NULL;
3262	if (!sk_SSL_CIPHER_push(sk, c)) {
3263	sk_SSL_CIPHER_free(sk);
3264	return NULL;
3265	}
3266	}
3267	}
3268	return sk;
3269	}
3270
3271	/** return a STACK of the ciphers available for the SSL and in order of
3272	* algorithm id */
3273	STACK_OF(SSL_CIPHER) ssl_get_ciphers_by_id(SSL_CONNECTION s)
3274	{
3275	if (s != NULL) {
3276	if (s->cipher_list_by_id != NULL)
3277	return s->cipher_list_by_id;
3278	else if (s->ssl.ctx != NULL
3279	&& s->ssl.ctx->cipher_list_by_id != NULL)
3280	return s->ssl.ctx->cipher_list_by_id;
3281	}
3282	return NULL;
3283	}
3284
3285	/** The old interface to get the same thing as SSL_get_ciphers() */
3286	const char SSL_get_cipher_list(const SSL s, int n)
3287	{
3288	const SSL_CIPHER *c;
3289	STACK_OF(SSL_CIPHER) *sk;
3290
3291	if (s == NULL)
3292	return NULL;
3293	sk = SSL_get_ciphers(s);
3294	if ((sk == NULL) \|\| (sk_SSL_CIPHER_num(sk) <= n))
3295	return NULL;
3296	c = sk_SSL_CIPHER_value(sk, n);
3297	if (c == NULL)
3298	return NULL;
3299	return c->name;
3300	}
3301
3302	/** return a STACK of the ciphers available for the SSL_CTX and in order of
3303	* preference */
3304	STACK_OF(SSL_CIPHER) SSL_CTX_get_ciphers(const SSL_CTX ctx)
3305	{
3306	if (ctx != NULL)
3307	return ctx->cipher_list;
3308	return NULL;
3309	}
3310
3311	/*
3312	* Distinguish between ciphers controlled by set_ciphersuite() and
3313	* set_cipher_list() when counting.
3314	*/
3315	static int cipher_list_tls12_num(STACK_OF(SSL_CIPHER) *sk)
3316	{
3317	int i, num = 0;
3318	const SSL_CIPHER *c;
3319
3320	if (sk == NULL)
3321	return 0;
3322	for (i = 0; i < sk_SSL_CIPHER_num(sk); ++i) {
3323	c = sk_SSL_CIPHER_value(sk, i);
3324	if (c->min_tls >= TLS1_3_VERSION)
3325	continue;
3326	num++;
3327	}
3328	return num;
3329	}
3330
3331	/** specify the ciphers to be used by default by the SSL_CTX */
3332	int SSL_CTX_set_cipher_list(SSL_CTX ctx, const char str)
3333	{
3334	STACK_OF(SSL_CIPHER) *sk;
3335
3336	sk = ssl_create_cipher_list(ctx, ctx->tls13_ciphersuites,
3337	&ctx->cipher_list, &ctx->cipher_list_by_id, str,
3338	ctx->cert);
3339	/*
3340	* ssl_create_cipher_list may return an empty stack if it was unable to
3341	* find a cipher matching the given rule string (for example if the rule
3342	* string specifies a cipher which has been disabled). This is not an
3343	* error as far as ssl_create_cipher_list is concerned, and hence
3344	* ctx->cipher_list and ctx->cipher_list_by_id has been updated.
3345	*/
3346	if (sk == NULL)
3347	return 0;
3348	if (ctx->method->num_ciphers() > 0 && cipher_list_tls12_num(sk) == 0) {
3349	ERR_raise(ERR_LIB_SSL, SSL_R_NO_CIPHER_MATCH);
3350	return 0;
3351	}
3352	return 1;
3353	}
3354
3355	/** specify the ciphers to be used by the SSL */
3356	int SSL_set_cipher_list(SSL s, const char str)
3357	{
3358	STACK_OF(SSL_CIPHER) *sk;
3359	SSL_CONNECTION *sc = SSL_CONNECTION_FROM_SSL(s);
3360	SSL_CTX *ctx;
3361
3362	if (sc == NULL)
3363	return 0;
3364
3365	ctx = s->ctx;
3366	sk = ssl_create_cipher_list(ctx, sc->tls13_ciphersuites,
3367	&sc->cipher_list, &sc->cipher_list_by_id, str,
3368	sc->cert);
3369	/* see comment in SSL_CTX_set_cipher_list */
3370	if (sk == NULL)
3371	return 0;
3372	if (ctx->method->num_ciphers() > 0 && cipher_list_tls12_num(sk) == 0) {
3373	ERR_raise(ERR_LIB_SSL, SSL_R_NO_CIPHER_MATCH);
3374	return 0;
3375	}
3376	return 1;
3377	}
3378
3379	char SSL_get_shared_ciphers(const SSL s, char *buf, int size)
3380	{
3381	char *p;
3382	STACK_OF(SSL_CIPHER) clntsk, srvrsk;
3383	const SSL_CIPHER *c;
3384	int i;
3385	const SSL_CONNECTION *sc = SSL_CONNECTION_FROM_CONST_SSL(s);
3386
3387	if (sc == NULL)
3388	return NULL;
3389
3390	if (!sc->server
3391	\|\| sc->peer_ciphers == NULL
3392	\|\| size < 2)
3393	return NULL;
3394
3395	p = buf;
3396	clntsk = sc->peer_ciphers;
3397	srvrsk = SSL_get_ciphers(s);
3398	if (clntsk == NULL \|\| srvrsk == NULL)
3399	return NULL;
3400
3401	if (sk_SSL_CIPHER_num(clntsk) == 0 \|\| sk_SSL_CIPHER_num(srvrsk) == 0)
3402	return NULL;
3403
3404	for (i = 0; i < sk_SSL_CIPHER_num(clntsk); i++) {
3405	int n;
3406
3407	c = sk_SSL_CIPHER_value(clntsk, i);
3408	if (sk_SSL_CIPHER_find(srvrsk, c) < 0)
3409	continue;
3410
3411	n = OPENSSL_strnlen(c->name, size);
3412	if (n >= size) {
3413	if (p != buf)
3414	--p;
3415	*p = '\0';
3416	return buf;
3417	}
3418	memcpy(p, c->name, n);
3419	p += n;
3420	*(p++) = ':';
3421	size -= n + 1;
3422	}
3423	p[-1] = '\0';
3424	return buf;
3425	}
3426
3427	/**
3428	* Return the requested servername (SNI) value. Note that the behaviour varies
3429	* depending on:
3430	* - whether this is called by the client or the server,
3431	* - if we are before or during/after the handshake,
3432	* - if a resumption or normal handshake is being attempted/has occurred
3433	* - whether we have negotiated TLSv1.2 (or below) or TLSv1.3
3434	*
3435	* Note that only the host_name type is defined (RFC 3546).
3436	*/
3437	const char SSL_get_servername(const SSL s, const int type)
3438	{
3439	const SSL_CONNECTION *sc = SSL_CONNECTION_FROM_CONST_SSL(s);
3440	int server;
3441
3442	if (sc == NULL)
3443	return NULL;
3444
3445	/*
3446	* If we don't know if we are the client or the server yet then we assume
3447	* client.
3448	*/
3449	server = sc->handshake_func == NULL ? 0 : sc->server;
3450
3451	if (type != TLSEXT_NAMETYPE_host_name)
3452	return NULL;
3453
3454	if (server) {
3455	/**
3456	* Server side
3457	* In TLSv1.3 on the server SNI is not associated with the session
3458	* but in TLSv1.2 or below it is.
3459	*
3460	* Before the handshake:
3461	* - return NULL
3462	*
3463	* During/after the handshake (TLSv1.2 or below resumption occurred):
3464	* - If a servername was accepted by the server in the original
3465	* handshake then it will return that servername, or NULL otherwise.
3466	*
3467	* During/after the handshake (TLSv1.2 or below resumption did not occur):
3468	* - The function will return the servername requested by the client in
3469	* this handshake or NULL if none was requested.
3470	*/
3471	if (sc->hit && !SSL_CONNECTION_IS_TLS13(sc))
3472	return sc->session->ext.hostname;
3473	} else {
3474	/**
3475	* Client side
3476	*
3477	* Before the handshake:
3478	* - If a servername has been set via a call to
3479	* SSL_set_tlsext_host_name() then it will return that servername
3480	* - If one has not been set, but a TLSv1.2 resumption is being
3481	* attempted and the session from the original handshake had a
3482	* servername accepted by the server then it will return that
3483	* servername
3484	* - Otherwise it returns NULL
3485	*
3486	* During/after the handshake (TLSv1.2 or below resumption occurred):
3487	* - If the session from the original handshake had a servername accepted
3488	* by the server then it will return that servername.
3489	* - Otherwise it returns the servername set via
3490	* SSL_set_tlsext_host_name() (or NULL if it was not called).
3491	*
3492	* During/after the handshake (TLSv1.2 or below resumption did not occur):
3493	* - It will return the servername set via SSL_set_tlsext_host_name()
3494	* (or NULL if it was not called).
3495	*/
3496	if (SSL_in_before(s)) {
3497	if (sc->ext.hostname == NULL
3498	&& sc->session != NULL
3499	&& sc->session->ssl_version != TLS1_3_VERSION)
3500	return sc->session->ext.hostname;
3501	} else {
3502	if (!SSL_CONNECTION_IS_TLS13(sc) && sc->hit
3503	&& sc->session->ext.hostname != NULL)
3504	return sc->session->ext.hostname;
3505	}
3506	}
3507
3508	return sc->ext.hostname;
3509	}
3510
3511	int SSL_get_servername_type(const SSL *s)
3512	{
3513	if (SSL_get_servername(s, TLSEXT_NAMETYPE_host_name) != NULL)
3514	return TLSEXT_NAMETYPE_host_name;
3515	return -1;
3516	}
3517
3518	/*
3519	* SSL_select_next_proto implements the standard protocol selection. It is
3520	* expected that this function is called from the callback set by
3521	* SSL_CTX_set_next_proto_select_cb. The protocol data is assumed to be a
3522	* vector of 8-bit, length prefixed byte strings. The length byte itself is
3523	* not included in the length. A byte string of length 0 is invalid. No byte
3524	* string may be truncated. The current, but experimental algorithm for
3525	* selecting the protocol is: 1) If the server doesn't support NPN then this
3526	* is indicated to the callback. In this case, the client application has to
3527	* abort the connection or have a default application level protocol. 2) If
3528	* the server supports NPN, but advertises an empty list then the client
3529	* selects the first protocol in its list, but indicates via the API that this
3530	* fallback case was enacted. 3) Otherwise, the client finds the first
3531	* protocol in the server's list that it supports and selects this protocol.
3532	* This is because it's assumed that the server has better information about
3533	* which protocol a client should use. 4) If the client doesn't support any
3534	* of the server's advertised protocols, then this is treated the same as
3535	* case 2. It returns either OPENSSL_NPN_NEGOTIATED if a common protocol was
3536	* found, or OPENSSL_NPN_NO_OVERLAP if the fallback case was reached.
3537	*/
3538	int SSL_select_next_proto(unsigned char *out, unsigned char outlen,
3539	const unsigned char *server,
3540	unsigned int server_len,
3541	const unsigned char *client, unsigned int client_len)
3542	{
3543	PACKET cpkt, csubpkt, spkt, ssubpkt;
3544
3545	if (!PACKET_buf_init(&cpkt, client, client_len)
3546	\|\| !PACKET_get_length_prefixed_1(&cpkt, &csubpkt)
3547	\|\| PACKET_remaining(&csubpkt) == 0) {
3548	*out = NULL;
3549	*outlen = 0;
3550	return OPENSSL_NPN_NO_OVERLAP;
3551	}
3552
3553	/*
3554	* Set the default opportunistic protocol. Will be overwritten if we find
3555	* a match.
3556	*/
3557	out = (unsigned char )PACKET_data(&csubpkt);
3558	*outlen = (unsigned char)PACKET_remaining(&csubpkt);
3559
3560	/*
3561	* For each protocol in server preference order, see if we support it.
3562	*/
3563	if (PACKET_buf_init(&spkt, server, server_len)) {
3564	while (PACKET_get_length_prefixed_1(&spkt, &ssubpkt)) {
3565	if (PACKET_remaining(&ssubpkt) == 0)
3566	continue; /* Invalid - ignore it */
3567	if (PACKET_buf_init(&cpkt, client, client_len)) {
3568	while (PACKET_get_length_prefixed_1(&cpkt, &csubpkt)) {
3569	if (PACKET_equal(&csubpkt, PACKET_data(&ssubpkt),
3570	PACKET_remaining(&ssubpkt))) {
3571	/* We found a match */
3572	out = (unsigned char )PACKET_data(&ssubpkt);
3573	*outlen = (unsigned char)PACKET_remaining(&ssubpkt);
3574	return OPENSSL_NPN_NEGOTIATED;
3575	}
3576	}
3577	/* Ignore spurious trailing bytes in the client list */
3578	} else {
3579	/* This should never happen */
3580	return OPENSSL_NPN_NO_OVERLAP;
3581	}
3582	}
3583	/* Ignore spurious trailing bytes in the server list */
3584	}
3585
3586	/*
3587	* There's no overlap between our protocols and the server's list. We use
3588	* the default opportunistic protocol selected earlier
3589	*/
3590	return OPENSSL_NPN_NO_OVERLAP;
3591	}
3592
3593	#ifndef OPENSSL_NO_NEXTPROTONEG
3594	/*
3595	* SSL_get0_next_proto_negotiated sets data and len to point to the
3596	* client's requested protocol for this connection and returns 0. If the
3597	* client didn't request any protocol, then *data is set to NULL. Note that
3598	* the client can request any protocol it chooses. The value returned from
3599	* this function need not be a member of the list of supported protocols
3600	* provided by the callback.
3601	*/
3602	void SSL_get0_next_proto_negotiated(const SSL s, const unsigned char *data,
3603	unsigned *len)
3604	{
3605	const SSL_CONNECTION *sc = SSL_CONNECTION_FROM_CONST_SSL(s);
3606
3607	if (sc == NULL) {
3608	/* We have no other way to indicate error */
3609	*data = NULL;
3610	*len = 0;
3611	return;
3612	}
3613
3614	*data = sc->ext.npn;
3615	if (*data == NULL) {
3616	*len = 0;
3617	} else {
3618	*len = (unsigned int)sc->ext.npn_len;
3619	}
3620	}
3621
3622	/*
3623	* SSL_CTX_set_npn_advertised_cb sets a callback that is called when
3624	* a TLS server needs a list of supported protocols for Next Protocol
3625	* Negotiation. The returned list must be in wire format. The list is
3626	* returned by setting \|out\| to point to it and \|outlen\| to its length. This
3627	* memory will not be modified, but one should assume that the SSL* keeps a
3628	* reference to it. The callback should return SSL_TLSEXT_ERR_OK if it
3629	* wishes to advertise. Otherwise, no such extension will be included in the
3630	* ServerHello.
3631	*/
3632	void SSL_CTX_set_npn_advertised_cb(SSL_CTX *ctx,
3633	SSL_CTX_npn_advertised_cb_func cb,
3634	void *arg)
3635	{
3636	if (IS_QUIC_CTX(ctx))
3637	/* NPN not allowed for QUIC */
3638	return;
3639
3640	ctx->ext.npn_advertised_cb = cb;
3641	ctx->ext.npn_advertised_cb_arg = arg;
3642	}
3643
3644	/*
3645	* SSL_CTX_set_next_proto_select_cb sets a callback that is called when a
3646	* client needs to select a protocol from the server's provided list. \|out\|
3647	* must be set to point to the selected protocol (which may be within \|in\|).
3648	* The length of the protocol name must be written into \|outlen\|. The
3649	* server's advertised protocols are provided in \|in\| and \|inlen\|. The
3650	* callback can assume that \|in\| is syntactically valid. The client must
3651	* select a protocol. It is fatal to the connection if this callback returns
3652	* a value other than SSL_TLSEXT_ERR_OK.
3653	*/
3654	void SSL_CTX_set_npn_select_cb(SSL_CTX *ctx,
3655	SSL_CTX_npn_select_cb_func cb,
3656	void *arg)
3657	{
3658	if (IS_QUIC_CTX(ctx))
3659	/* NPN not allowed for QUIC */
3660	return;
3661
3662	ctx->ext.npn_select_cb = cb;
3663	ctx->ext.npn_select_cb_arg = arg;
3664	}
3665	#endif
3666
3667	static int alpn_value_ok(const unsigned char *protos, unsigned int protos_len)
3668	{
3669	unsigned int idx;
3670
3671	if (protos_len < 2 \|\| protos == NULL)
3672	return 0;
3673
3674	for (idx = 0; idx < protos_len; idx += protos[idx] + 1) {
3675	if (protos[idx] == 0)
3676	return 0;
3677	}
3678	return idx == protos_len;
3679	}
3680	/*
3681	* SSL_CTX_set_alpn_protos sets the ALPN protocol list on \|ctx\| to \|protos\|.
3682	* \|protos\| must be in wire-format (i.e. a series of non-empty, 8-bit
3683	* length-prefixed strings). Returns 0 on success.
3684	*/
3685	int SSL_CTX_set_alpn_protos(SSL_CTX ctx, const unsigned char protos,
3686	unsigned int protos_len)
3687	{
3688	unsigned char *alpn;
3689
3690	if (protos_len == 0 \|\| protos == NULL) {
3691	OPENSSL_free(ctx->ext.alpn);
3692	ctx->ext.alpn = NULL;
3693	ctx->ext.alpn_len = 0;
3694	return 0;
3695	}
3696	/* Not valid per RFC */
3697	if (!alpn_value_ok(protos, protos_len))
3698	return 1;
3699
3700	alpn = OPENSSL_memdup(protos, protos_len);
3701	if (alpn == NULL)
3702	return 1;
3703	OPENSSL_free(ctx->ext.alpn);
3704	ctx->ext.alpn = alpn;
3705	ctx->ext.alpn_len = protos_len;
3706
3707	return 0;
3708	}
3709
3710	/*
3711	* SSL_set_alpn_protos sets the ALPN protocol list on \|ssl\| to \|protos\|.
3712	* \|protos\| must be in wire-format (i.e. a series of non-empty, 8-bit
3713	* length-prefixed strings). Returns 0 on success.
3714	*/
3715	int SSL_set_alpn_protos(SSL ssl, const unsigned char protos,
3716	unsigned int protos_len)
3717	{
3718	unsigned char *alpn;
3719	SSL_CONNECTION *sc = SSL_CONNECTION_FROM_SSL(ssl);
3720
3721	if (sc == NULL)
3722	return 1;
3723
3724	if (protos_len == 0 \|\| protos == NULL) {
3725	OPENSSL_free(sc->ext.alpn);
3726	sc->ext.alpn = NULL;
3727	sc->ext.alpn_len = 0;
3728	return 0;
3729	}
3730	/* Not valid per RFC */
3731	if (!alpn_value_ok(protos, protos_len))
3732	return 1;
3733
3734	alpn = OPENSSL_memdup(protos, protos_len);
3735	if (alpn == NULL)
3736	return 1;
3737	OPENSSL_free(sc->ext.alpn);
3738	sc->ext.alpn = alpn;
3739	sc->ext.alpn_len = protos_len;
3740
3741	return 0;
3742	}
3743
3744	/*
3745	* SSL_CTX_set_alpn_select_cb sets a callback function on \|ctx\| that is
3746	* called during ClientHello processing in order to select an ALPN protocol
3747	* from the client's list of offered protocols.
3748	*/
3749	void SSL_CTX_set_alpn_select_cb(SSL_CTX *ctx,
3750	SSL_CTX_alpn_select_cb_func cb,
3751	void *arg)
3752	{
3753	ctx->ext.alpn_select_cb = cb;
3754	ctx->ext.alpn_select_cb_arg = arg;
3755	}
3756
3757	/*
3758	* SSL_get0_alpn_selected gets the selected ALPN protocol (if any) from \|ssl\|.
3759	* On return it sets \|data\| to point to \|len\| bytes of protocol name
3760	* (not including the leading length-prefix byte). If the server didn't
3761	* respond with a negotiated protocol then \|*len\| will be zero.
3762	*/
3763	void SSL_get0_alpn_selected(const SSL ssl, const unsigned char *data,
3764	unsigned int *len)
3765	{
3766	const SSL_CONNECTION *sc = SSL_CONNECTION_FROM_CONST_SSL(ssl);
3767
3768	if (sc == NULL) {
3769	/* We have no other way to indicate error */
3770	*data = NULL;
3771	*len = 0;
3772	return;
3773	}
3774
3775	*data = sc->s3.alpn_selected;
3776	if (*data == NULL)
3777	*len = 0;
3778	else
3779	*len = (unsigned int)sc->s3.alpn_selected_len;
3780	}
3781
3782	int SSL_export_keying_material(SSL s, unsigned char out, size_t olen,
3783	const char *label, size_t llen,
3784	const unsigned char *context, size_t contextlen,
3785	int use_context)
3786	{
3787	SSL_CONNECTION *sc = SSL_CONNECTION_FROM_SSL(s);
3788
3789	if (sc == NULL)
3790	return -1;
3791
3792	if (sc->session == NULL
3793	\|\| (sc->version < TLS1_VERSION && sc->version != DTLS1_BAD_VER))
3794	return -1;
3795
3796	return sc->ssl.method->ssl3_enc->export_keying_material(sc, out, olen, label,
3797	llen, context,
3798	contextlen,
3799	use_context);
3800	}
3801
3802	int SSL_export_keying_material_early(SSL s, unsigned char out, size_t olen,
3803	const char *label, size_t llen,
3804	const unsigned char *context,
3805	size_t contextlen)
3806	{
3807	SSL_CONNECTION *sc = SSL_CONNECTION_FROM_SSL(s);
3808
3809	if (sc == NULL)
3810	return -1;
3811
3812	if (sc->version != TLS1_3_VERSION)
3813	return 0;
3814
3815	return tls13_export_keying_material_early(sc, out, olen, label, llen,
3816	context, contextlen);
3817	}
3818
3819	static unsigned long ssl_session_hash(const SSL_SESSION *a)
3820	{
3821	const unsigned char *session_id = a->session_id;
3822	unsigned long l;
3823	unsigned char tmp_storage[4];
3824
3825	if (a->session_id_length < sizeof(tmp_storage)) {
3826	memset(tmp_storage, 0, sizeof(tmp_storage));
3827	memcpy(tmp_storage, a->session_id, a->session_id_length);
3828	session_id = tmp_storage;
3829	}
3830
3831	l = (unsigned long)
3832	((unsigned long)session_id[0]) \|
3833	((unsigned long)session_id[1] << 8L) \|
3834	((unsigned long)session_id[2] << 16L) \|
3835	((unsigned long)session_id[3] << 24L);
3836	return l;
3837	}
3838
3839	/*
3840	* NB: If this function (or indeed the hash function which uses a sort of
3841	* coarser function than this one) is changed, ensure
3842	* SSL_CTX_has_matching_session_id() is checked accordingly. It relies on
3843	* being able to construct an SSL_SESSION that will collide with any existing
3844	* session with a matching session ID.
3845	*/
3846	static int ssl_session_cmp(const SSL_SESSION a, const SSL_SESSION b)
3847	{
3848	if (a->ssl_version != b->ssl_version)
3849	return 1;
3850	if (a->session_id_length != b->session_id_length)
3851	return 1;
3852	return memcmp(a->session_id, b->session_id, a->session_id_length);
3853	}
3854
3855	/*
3856	* These wrapper functions should remain rather than redeclaring
3857	* SSL_SESSION_hash and SSL_SESSION_cmp for void* types and casting each
3858	* variable. The reason is that the functions aren't static, they're exposed
3859	* via ssl.h.
3860	*/
3861
3862	SSL_CTX SSL_CTX_new_ex(OSSL_LIB_CTX libctx, const char *propq,
3863	const SSL_METHOD *meth)
3864	{
3865	SSL_CTX *ret = NULL;
3866	#ifndef OPENSSL_NO_COMP_ALG
3867	int i;
3868	#endif
3869
3870	if (meth == NULL) {
3871	ERR_raise(ERR_LIB_SSL, SSL_R_NULL_SSL_METHOD_PASSED);
3872	return NULL;
3873	}
3874
3875	if (!OPENSSL_init_ssl(OPENSSL_INIT_LOAD_SSL_STRINGS, NULL))
3876	return NULL;
3877
3878	/* Doing this for the run once effect */
3879	if (SSL_get_ex_data_X509_STORE_CTX_idx() < 0) {
3880	ERR_raise(ERR_LIB_SSL, SSL_R_X509_VERIFICATION_SETUP_PROBLEMS);
3881	goto err;
3882	}
3883
3884	ret = OPENSSL_zalloc(sizeof(*ret));
3885	if (ret == NULL)
3886	return NULL;
3887
3888	/* Init the reference counting before any call to SSL_CTX_free */
3889	if (!CRYPTO_NEW_REF(&ret->references, 1)) {
3890	OPENSSL_free(ret);
3891	return NULL;
3892	}
3893
3894	ret->lock = CRYPTO_THREAD_lock_new();
3895	if (ret->lock == NULL) {
3896	ERR_raise(ERR_LIB_SSL, ERR_R_CRYPTO_LIB);
3897	goto err;
3898	}
3899
3900	#ifdef TSAN_REQUIRES_LOCKING
3901	ret->tsan_lock = CRYPTO_THREAD_lock_new();
3902	if (ret->tsan_lock == NULL) {
3903	ERR_raise(ERR_LIB_SSL, ERR_R_CRYPTO_LIB);
3904	goto err;
3905	}
3906	#endif
3907
3908	ret->libctx = libctx;
3909	if (propq != NULL) {
3910	ret->propq = OPENSSL_strdup(propq);
3911	if (ret->propq == NULL)
3912	goto err;
3913	}
3914
3915	ret->method = meth;
3916	ret->min_proto_version = 0;
3917	ret->max_proto_version = 0;
3918	ret->mode = SSL_MODE_AUTO_RETRY;
3919	ret->session_cache_mode = SSL_SESS_CACHE_SERVER;
3920	ret->session_cache_size = SSL_SESSION_CACHE_MAX_SIZE_DEFAULT;
3921	/* We take the system default. */
3922	ret->session_timeout = meth->get_timeout();
3923	ret->max_cert_list = SSL_MAX_CERT_LIST_DEFAULT;
3924	ret->verify_mode = SSL_VERIFY_NONE;
3925
3926	ret->sessions = lh_SSL_SESSION_new(ssl_session_hash, ssl_session_cmp);
3927	if (ret->sessions == NULL) {
3928	ERR_raise(ERR_LIB_SSL, ERR_R_CRYPTO_LIB);
3929	goto err;
3930	}
3931	ret->cert_store = X509_STORE_new();
3932	if (ret->cert_store == NULL) {
3933	ERR_raise(ERR_LIB_SSL, ERR_R_X509_LIB);
3934	goto err;
3935	}
3936	#ifndef OPENSSL_NO_CT
3937	ret->ctlog_store = CTLOG_STORE_new_ex(libctx, propq);
3938	if (ret->ctlog_store == NULL) {
3939	ERR_raise(ERR_LIB_SSL, ERR_R_CT_LIB);
3940	goto err;
3941	}
3942	#endif
3943
3944	/* initialize cipher/digest methods table */
3945	if (!ssl_load_ciphers(ret)) {
3946	ERR_raise(ERR_LIB_SSL, ERR_R_SSL_LIB);
3947	goto err;
3948	}
3949
3950	if (!ssl_load_groups(ret)) {
3951	ERR_raise(ERR_LIB_SSL, ERR_R_SSL_LIB);
3952	goto err;
3953	}
3954
3955	/* load provider sigalgs */
3956	if (!ssl_load_sigalgs(ret)) {
3957	ERR_raise(ERR_LIB_SSL, ERR_R_SSL_LIB);
3958	goto err;
3959	}
3960
3961	/* initialise sig algs */
3962	if (!ssl_setup_sigalgs(ret)) {
3963	ERR_raise(ERR_LIB_SSL, ERR_R_SSL_LIB);
3964	goto err;
3965	}
3966
3967	if (!SSL_CTX_set_ciphersuites(ret, OSSL_default_ciphersuites())) {
3968	ERR_raise(ERR_LIB_SSL, ERR_R_SSL_LIB);
3969	goto err;
3970	}
3971
3972	if ((ret->cert = ssl_cert_new(SSL_PKEY_NUM + ret->sigalg_list_len)) == NULL) {
3973	ERR_raise(ERR_LIB_SSL, ERR_R_SSL_LIB);
3974	goto err;
3975	}
3976
3977	if (!ssl_create_cipher_list(ret,
3978	ret->tls13_ciphersuites,
3979	&ret->cipher_list, &ret->cipher_list_by_id,
3980	OSSL_default_cipher_list(), ret->cert)
3981	\|\| sk_SSL_CIPHER_num(ret->cipher_list) <= 0) {
3982	ERR_raise(ERR_LIB_SSL, SSL_R_LIBRARY_HAS_NO_CIPHERS);
3983	goto err;
3984	}
3985
3986	ret->param = X509_VERIFY_PARAM_new();
3987	if (ret->param == NULL) {
3988	ERR_raise(ERR_LIB_SSL, ERR_R_X509_LIB);
3989	goto err;
3990	}
3991
3992	/*
3993	* If these aren't available from the provider we'll get NULL returns.
3994	* That's fine but will cause errors later if SSLv3 is negotiated
3995	*/
3996	ret->md5 = ssl_evp_md_fetch(libctx, NID_md5, propq);
3997	ret->sha1 = ssl_evp_md_fetch(libctx, NID_sha1, propq);
3998
3999	if ((ret->ca_names = sk_X509_NAME_new_null()) == NULL) {
4000	ERR_raise(ERR_LIB_SSL, ERR_R_CRYPTO_LIB);
4001	goto err;
4002	}
4003
4004	if ((ret->client_ca_names = sk_X509_NAME_new_null()) == NULL) {
4005	ERR_raise(ERR_LIB_SSL, ERR_R_CRYPTO_LIB);
4006	goto err;
4007	}
4008
4009	if (!CRYPTO_new_ex_data(CRYPTO_EX_INDEX_SSL_CTX, ret, &ret->ex_data)) {
4010	ERR_raise(ERR_LIB_SSL, ERR_R_CRYPTO_LIB);
4011	goto err;
4012	}
4013
4014	if ((ret->ext.secure = OPENSSL_secure_zalloc(sizeof(*ret->ext.secure))) == NULL)
4015	goto err;
4016
4017	/* No compression for DTLS */
4018	if (!(meth->ssl3_enc->enc_flags & SSL_ENC_FLAG_DTLS))
4019	ret->comp_methods = SSL_COMP_get_compression_methods();
4020
4021	ret->max_send_fragment = SSL3_RT_MAX_PLAIN_LENGTH;
4022	ret->split_send_fragment = SSL3_RT_MAX_PLAIN_LENGTH;
4023
4024	/* Setup RFC5077 ticket keys */
4025	if ((RAND_bytes_ex(libctx, ret->ext.tick_key_name,
4026	sizeof(ret->ext.tick_key_name), 0) <= 0)
4027	\|\| (RAND_priv_bytes_ex(libctx, ret->ext.secure->tick_hmac_key,
4028	sizeof(ret->ext.secure->tick_hmac_key), 0) <= 0)
4029	\|\| (RAND_priv_bytes_ex(libctx, ret->ext.secure->tick_aes_key,
4030	sizeof(ret->ext.secure->tick_aes_key), 0) <= 0))
4031	ret->options \|= SSL_OP_NO_TICKET;
4032
4033	if (RAND_priv_bytes_ex(libctx, ret->ext.cookie_hmac_key,
4034	sizeof(ret->ext.cookie_hmac_key), 0) <= 0) {
4035	ERR_raise(ERR_LIB_SSL, ERR_R_RAND_LIB);
4036	goto err;
4037	}
4038
4039	#ifndef OPENSSL_NO_SRP
4040	if (!ssl_ctx_srp_ctx_init_intern(ret)) {
4041	ERR_raise(ERR_LIB_SSL, ERR_R_SSL_LIB);
4042	goto err;
4043	}
4044	#endif
4045	#ifndef OPENSSL_NO_ENGINE
4046	# ifdef OPENSSL_SSL_CLIENT_ENGINE_AUTO
4047	# define eng_strx(x) #x
4048	# define eng_str(x) eng_strx(x)
4049	/* Use specific client engine automatically... ignore errors */
4050	{
4051	ENGINE *eng;
4052	eng = ENGINE_by_id(eng_str(OPENSSL_SSL_CLIENT_ENGINE_AUTO));
4053	if (!eng) {
4054	ERR_clear_error();
4055	ENGINE_load_builtin_engines();
4056	eng = ENGINE_by_id(eng_str(OPENSSL_SSL_CLIENT_ENGINE_AUTO));
4057	}
4058	if (!eng \|\| !SSL_CTX_set_client_cert_engine(ret, eng))
4059	ERR_clear_error();
4060	}
4061	# endif
4062	#endif
4063
4064	#ifndef OPENSSL_NO_COMP_ALG
4065	/*
4066	* Set the default order: brotli, zlib, zstd
4067	* Including only those enabled algorithms
4068	*/
4069	memset(ret->cert_comp_prefs, 0, sizeof(ret->cert_comp_prefs));
4070	i = 0;
4071	if (ossl_comp_has_alg(TLSEXT_comp_cert_brotli))
4072	ret->cert_comp_prefs[i++] = TLSEXT_comp_cert_brotli;
4073	if (ossl_comp_has_alg(TLSEXT_comp_cert_zlib))
4074	ret->cert_comp_prefs[i++] = TLSEXT_comp_cert_zlib;
4075	if (ossl_comp_has_alg(TLSEXT_comp_cert_zstd))
4076	ret->cert_comp_prefs[i++] = TLSEXT_comp_cert_zstd;
4077	#endif
4078	/*
4079	* Disable compression by default to prevent CRIME. Applications can
4080	* re-enable compression by configuring
4081	* SSL_CTX_clear_options(ctx, SSL_OP_NO_COMPRESSION);
4082	* or by using the SSL_CONF library. Similarly we also enable TLSv1.3
4083	* middlebox compatibility by default. This may be disabled by default in
4084	* a later OpenSSL version.
4085	*/
4086	ret->options \|= SSL_OP_NO_COMPRESSION \| SSL_OP_ENABLE_MIDDLEBOX_COMPAT;
4087
4088	ret->ext.status_type = TLSEXT_STATUSTYPE_nothing;
4089
4090	/*
4091	* We cannot usefully set a default max_early_data here (which gets
4092	* propagated in SSL_new(), for the following reason: setting the
4093	* SSL field causes tls_construct_stoc_early_data() to tell the
4094	* client that early data will be accepted when constructing a TLS 1.3
4095	* session ticket, and the client will accordingly send us early data
4096	* when using that ticket (if the client has early data to send).
4097	* However, in order for the early data to actually be consumed by
4098	* the application, the application must also have calls to
4099	* SSL_read_early_data(); otherwise we'll just skip past the early data
4100	* and ignore it. So, since the application must add calls to
4101	* SSL_read_early_data(), we also require them to add
4102	* calls to SSL_CTX_set_max_early_data() in order to use early data,
4103	* eliminating the bandwidth-wasting early data in the case described
4104	* above.
4105	*/
4106	ret->max_early_data = 0;
4107
4108	/*
4109	* Default recv_max_early_data is a fully loaded single record. Could be
4110	* split across multiple records in practice. We set this differently to
4111	* max_early_data so that, in the default case, we do not advertise any
4112	* support for early_data, but if a client were to send us some (e.g.
4113	* because of an old, stale ticket) then we will tolerate it and skip over
4114	* it.
4115	*/
4116	ret->recv_max_early_data = SSL3_RT_MAX_PLAIN_LENGTH;
4117
4118	/* By default we send two session tickets automatically in TLSv1.3 */
4119	ret->num_tickets = 2;
4120
4121	if (!ssl_ctx_system_config(ret)) {
4122	ERR_raise(ERR_LIB_SSL, SSL_R_ERROR_IN_SYSTEM_DEFAULT_CONFIG);
4123	goto err;
4124	}
4125
4126	return ret;
4127	err:
4128	SSL_CTX_free(ret);
4129	return NULL;
4130	}
4131
4132	SSL_CTX SSL_CTX_new(const SSL_METHOD meth)
4133	{
4134	return SSL_CTX_new_ex(NULL, NULL, meth);
4135	}
4136
4137	int SSL_CTX_up_ref(SSL_CTX *ctx)
4138	{
4139	int i;
4140
4141	if (CRYPTO_UP_REF(&ctx->references, &i) <= 0)
4142	return 0;
4143
4144	REF_PRINT_COUNT("SSL_CTX", i, ctx);
4145	REF_ASSERT_ISNT(i < 2);
4146	return ((i > 1) ? 1 : 0);
4147	}
4148
4149	void SSL_CTX_free(SSL_CTX *a)
4150	{
4151	int i;
4152	size_t j;
4153
4154	if (a == NULL)
4155	return;
4156
4157	CRYPTO_DOWN_REF(&a->references, &i);
4158	REF_PRINT_COUNT("SSL_CTX", i, a);
4159	if (i > 0)
4160	return;
4161	REF_ASSERT_ISNT(i < 0);
4162
4163	X509_VERIFY_PARAM_free(a->param);
4164	dane_ctx_final(&a->dane);
4165
4166	/*
4167	* Free internal session cache. However: the remove_cb() may reference
4168	* the ex_data of SSL_CTX, thus the ex_data store can only be removed
4169	* after the sessions were flushed.
4170	* As the ex_data handling routines might also touch the session cache,
4171	* the most secure solution seems to be: empty (flush) the cache, then
4172	* free ex_data, then finally free the cache.
4173	* (See ticket [openssl.org #212].)
4174	*/
4175	if (a->sessions != NULL)
4176	SSL_CTX_flush_sessions_ex(a, 0);
4177
4178	CRYPTO_free_ex_data(CRYPTO_EX_INDEX_SSL_CTX, a, &a->ex_data);
4179	lh_SSL_SESSION_free(a->sessions);
4180	X509_STORE_free(a->cert_store);
4181	#ifndef OPENSSL_NO_CT
4182	CTLOG_STORE_free(a->ctlog_store);
4183	#endif
4184	sk_SSL_CIPHER_free(a->cipher_list);
4185	sk_SSL_CIPHER_free(a->cipher_list_by_id);
4186	sk_SSL_CIPHER_free(a->tls13_ciphersuites);
4187	ssl_cert_free(a->cert);
4188	sk_X509_NAME_pop_free(a->ca_names, X509_NAME_free);
4189	sk_X509_NAME_pop_free(a->client_ca_names, X509_NAME_free);
4190	OSSL_STACK_OF_X509_free(a->extra_certs);
4191	a->comp_methods = NULL;
4192	#ifndef OPENSSL_NO_SRTP
4193	sk_SRTP_PROTECTION_PROFILE_free(a->srtp_profiles);
4194	#endif
4195	#ifndef OPENSSL_NO_SRP
4196	ssl_ctx_srp_ctx_free_intern(a);
4197	#endif
4198	#ifndef OPENSSL_NO_ENGINE
4199	tls_engine_finish(a->client_cert_engine);
4200	#endif
4201
4202	OPENSSL_free(a->ext.ecpointformats);
4203	OPENSSL_free(a->ext.supportedgroups);
4204	OPENSSL_free(a->ext.supported_groups_default);
4205	OPENSSL_free(a->ext.alpn);
4206	OPENSSL_secure_free(a->ext.secure);
4207
4208	ssl_evp_md_free(a->md5);
4209	ssl_evp_md_free(a->sha1);
4210
4211	for (j = 0; j < SSL_ENC_NUM_IDX; j++)
4212	ssl_evp_cipher_free(a->ssl_cipher_methods[j]);
4213	for (j = 0; j < SSL_MD_NUM_IDX; j++)
4214	ssl_evp_md_free(a->ssl_digest_methods[j]);
4215	for (j = 0; j < a->group_list_len; j++) {
4216	OPENSSL_free(a->group_list[j].tlsname);
4217	OPENSSL_free(a->group_list[j].realname);
4218	OPENSSL_free(a->group_list[j].algorithm);
4219	}
4220	OPENSSL_free(a->group_list);
4221	for (j = 0; j < a->sigalg_list_len; j++) {
4222	OPENSSL_free(a->sigalg_list[j].name);
4223	OPENSSL_free(a->sigalg_list[j].sigalg_name);
4224	OPENSSL_free(a->sigalg_list[j].sigalg_oid);
4225	OPENSSL_free(a->sigalg_list[j].sig_name);
4226	OPENSSL_free(a->sigalg_list[j].sig_oid);
4227	OPENSSL_free(a->sigalg_list[j].hash_name);
4228	OPENSSL_free(a->sigalg_list[j].hash_oid);
4229	OPENSSL_free(a->sigalg_list[j].keytype);
4230	OPENSSL_free(a->sigalg_list[j].keytype_oid);
4231	}
4232	OPENSSL_free(a->sigalg_list);
4233	OPENSSL_free(a->ssl_cert_info);
4234
4235	OPENSSL_free(a->sigalg_lookup_cache);
4236	OPENSSL_free(a->tls12_sigalgs);
4237
4238	OPENSSL_free(a->client_cert_type);
4239	OPENSSL_free(a->server_cert_type);
4240
4241	CRYPTO_THREAD_lock_free(a->lock);
4242	CRYPTO_FREE_REF(&a->references);
4243	#ifdef TSAN_REQUIRES_LOCKING
4244	CRYPTO_THREAD_lock_free(a->tsan_lock);
4245	#endif
4246
4247	OPENSSL_free(a->propq);
4248	#ifndef OPENSSL_NO_QLOG
4249	OPENSSL_free(a->qlog_title);
4250	#endif
4251
4252	OPENSSL_free(a);
4253	}
4254
4255	void SSL_CTX_set_default_passwd_cb(SSL_CTX ctx, pem_password_cb cb)
4256	{
4257	ctx->default_passwd_callback = cb;
4258	}
4259
4260	void SSL_CTX_set_default_passwd_cb_userdata(SSL_CTX ctx, void u)
4261	{
4262	ctx->default_passwd_callback_userdata = u;
4263	}
4264
4265	pem_password_cb SSL_CTX_get_default_passwd_cb(SSL_CTX ctx)
4266	{
4267	return ctx->default_passwd_callback;
4268	}
4269
4270	void SSL_CTX_get_default_passwd_cb_userdata(SSL_CTX ctx)
4271	{
4272	return ctx->default_passwd_callback_userdata;
4273	}
4274
4275	void SSL_set_default_passwd_cb(SSL s, pem_password_cb cb)
4276	{
4277	SSL_CONNECTION *sc = SSL_CONNECTION_FROM_SSL(s);
4278
4279	if (sc == NULL)
4280	return;
4281
4282	sc->default_passwd_callback = cb;
4283	}
4284
4285	void SSL_set_default_passwd_cb_userdata(SSL s, void u)
4286	{
4287	SSL_CONNECTION *sc = SSL_CONNECTION_FROM_SSL(s);
4288
4289	if (sc == NULL)
4290	return;
4291
4292	sc->default_passwd_callback_userdata = u;
4293	}
4294
4295	pem_password_cb SSL_get_default_passwd_cb(SSL s)
4296	{
4297	SSL_CONNECTION *sc = SSL_CONNECTION_FROM_SSL(s);
4298
4299	if (sc == NULL)
4300	return NULL;
4301
4302	return sc->default_passwd_callback;
4303	}
4304
4305	void SSL_get_default_passwd_cb_userdata(SSL s)
4306	{
4307	SSL_CONNECTION *sc = SSL_CONNECTION_FROM_SSL(s);
4308
4309	if (sc == NULL)
4310	return NULL;
4311
4312	return sc->default_passwd_callback_userdata;
4313	}
4314
4315	void SSL_CTX_set_cert_verify_callback(SSL_CTX *ctx,
4316	int (cb) (X509_STORE_CTX , void *),
4317	void *arg)
4318	{
4319	ctx->app_verify_callback = cb;
4320	ctx->app_verify_arg = arg;
4321	}
4322
4323	void SSL_CTX_set_verify(SSL_CTX *ctx, int mode,
4324	int (cb) (int, X509_STORE_CTX ))
4325	{
4326	ctx->verify_mode = mode;
4327	ctx->default_verify_callback = cb;
4328	}
4329
4330	void SSL_CTX_set_verify_depth(SSL_CTX *ctx, int depth)
4331	{
4332	X509_VERIFY_PARAM_set_depth(ctx->param, depth);
4333	}
4334
4335	void SSL_CTX_set_cert_cb(SSL_CTX c, int (cb) (SSL ssl, void arg), void *arg)
4336	{
4337	ssl_cert_set_cert_cb(c->cert, cb, arg);
4338	}
4339
4340	void SSL_set_cert_cb(SSL s, int (cb) (SSL ssl, void arg), void *arg)
4341	{
4342	SSL_CONNECTION *sc = SSL_CONNECTION_FROM_SSL(s);
4343
4344	if (sc == NULL)
4345	return;
4346
4347	ssl_cert_set_cert_cb(sc->cert, cb, arg);
4348	}
4349
4350	void ssl_set_masks(SSL_CONNECTION *s)
4351	{
4352	CERT *c = s->cert;
4353	uint32_t *pvalid = s->s3.tmp.valid_flags;
4354	int rsa_enc, rsa_sign, dh_tmp, dsa_sign;
4355	unsigned long mask_k, mask_a;
4356	int have_ecc_cert, ecdsa_ok;
4357
4358	if (c == NULL)
4359	return;
4360
4361	dh_tmp = (c->dh_tmp != NULL
4362	\|\| c->dh_tmp_cb != NULL
4363	\|\| c->dh_tmp_auto);
4364
4365	rsa_enc = pvalid[SSL_PKEY_RSA] & CERT_PKEY_VALID;
4366	rsa_sign = pvalid[SSL_PKEY_RSA] & CERT_PKEY_VALID;
4367	dsa_sign = pvalid[SSL_PKEY_DSA_SIGN] & CERT_PKEY_VALID;
4368	have_ecc_cert = pvalid[SSL_PKEY_ECC] & CERT_PKEY_VALID;
4369	mask_k = 0;
4370	mask_a = 0;
4371
4372	OSSL_TRACE4(TLS_CIPHER, "dh_tmp=%d rsa_enc=%d rsa_sign=%d dsa_sign=%d\n",
4373	dh_tmp, rsa_enc, rsa_sign, dsa_sign);
4374
4375	#ifndef OPENSSL_NO_GOST
4376	if (ssl_has_cert(s, SSL_PKEY_GOST12_512)) {
4377	mask_k \|= SSL_kGOST \| SSL_kGOST18;
4378	mask_a \|= SSL_aGOST12;
4379	}
4380	if (ssl_has_cert(s, SSL_PKEY_GOST12_256)) {
4381	mask_k \|= SSL_kGOST \| SSL_kGOST18;
4382	mask_a \|= SSL_aGOST12;
4383	}
4384	if (ssl_has_cert(s, SSL_PKEY_GOST01)) {
4385	mask_k \|= SSL_kGOST;
4386	mask_a \|= SSL_aGOST01;
4387	}
4388	#endif
4389
4390	if (rsa_enc)
4391	mask_k \|= SSL_kRSA;
4392
4393	if (dh_tmp)
4394	mask_k \|= SSL_kDHE;
4395
4396	/*
4397	* If we only have an RSA-PSS certificate allow RSA authentication
4398	* if TLS 1.2 and peer supports it.
4399	*/
4400
4401	if (rsa_enc \|\| rsa_sign \|\| (ssl_has_cert(s, SSL_PKEY_RSA_PSS_SIGN)
4402	&& pvalid[SSL_PKEY_RSA_PSS_SIGN] & CERT_PKEY_EXPLICIT_SIGN
4403	&& TLS1_get_version(&s->ssl) == TLS1_2_VERSION))
4404	mask_a \|= SSL_aRSA;
4405
4406	if (dsa_sign) {
4407	mask_a \|= SSL_aDSS;
4408	}
4409
4410	mask_a \|= SSL_aNULL;
4411
4412	/*
4413	* You can do anything with an RPK key, since there's no cert to restrict it
4414	* But we need to check for private keys
4415	*/
4416	if (pvalid[SSL_PKEY_RSA] & CERT_PKEY_RPK) {
4417	mask_a \|= SSL_aRSA;
4418	mask_k \|= SSL_kRSA;
4419	}
4420	if (pvalid[SSL_PKEY_ECC] & CERT_PKEY_RPK)
4421	mask_a \|= SSL_aECDSA;
4422	if (TLS1_get_version(&s->ssl) == TLS1_2_VERSION) {
4423	if (pvalid[SSL_PKEY_RSA_PSS_SIGN] & CERT_PKEY_RPK)
4424	mask_a \|= SSL_aRSA;
4425	if (pvalid[SSL_PKEY_ED25519] & CERT_PKEY_RPK
4426	\|\| pvalid[SSL_PKEY_ED448] & CERT_PKEY_RPK)
4427	mask_a \|= SSL_aECDSA;
4428	}
4429
4430	/*
4431	* An ECC certificate may be usable for ECDH and/or ECDSA cipher suites
4432	* depending on the key usage extension.
4433	*/
4434	if (have_ecc_cert) {
4435	uint32_t ex_kusage;
4436	ex_kusage = X509_get_key_usage(c->pkeys[SSL_PKEY_ECC].x509);
4437	ecdsa_ok = ex_kusage & X509v3_KU_DIGITAL_SIGNATURE;
4438	if (!(pvalid[SSL_PKEY_ECC] & CERT_PKEY_SIGN))
4439	ecdsa_ok = 0;
4440	if (ecdsa_ok)
4441	mask_a \|= SSL_aECDSA;
4442	}
4443	/* Allow Ed25519 for TLS 1.2 if peer supports it */
4444	if (!(mask_a & SSL_aECDSA) && ssl_has_cert(s, SSL_PKEY_ED25519)
4445	&& pvalid[SSL_PKEY_ED25519] & CERT_PKEY_EXPLICIT_SIGN
4446	&& TLS1_get_version(&s->ssl) == TLS1_2_VERSION)
4447	mask_a \|= SSL_aECDSA;
4448
4449	/* Allow Ed448 for TLS 1.2 if peer supports it */
4450	if (!(mask_a & SSL_aECDSA) && ssl_has_cert(s, SSL_PKEY_ED448)
4451	&& pvalid[SSL_PKEY_ED448] & CERT_PKEY_EXPLICIT_SIGN
4452	&& TLS1_get_version(&s->ssl) == TLS1_2_VERSION)
4453	mask_a \|= SSL_aECDSA;
4454
4455	mask_k \|= SSL_kECDHE;
4456
4457	#ifndef OPENSSL_NO_PSK
4458	mask_k \|= SSL_kPSK;
4459	mask_a \|= SSL_aPSK;
4460	if (mask_k & SSL_kRSA)
4461	mask_k \|= SSL_kRSAPSK;
4462	if (mask_k & SSL_kDHE)
4463	mask_k \|= SSL_kDHEPSK;
4464	if (mask_k & SSL_kECDHE)
4465	mask_k \|= SSL_kECDHEPSK;
4466	#endif
4467
4468	s->s3.tmp.mask_k = mask_k;
4469	s->s3.tmp.mask_a = mask_a;
4470	}
4471
4472	int ssl_check_srvr_ecc_cert_and_alg(X509 x, SSL_CONNECTION s)
4473	{
4474	if (s->s3.tmp.new_cipher->algorithm_auth & SSL_aECDSA) {
4475	/* key usage, if present, must allow signing */
4476	if (!(X509_get_key_usage(x) & X509v3_KU_DIGITAL_SIGNATURE)) {
4477	ERR_raise(ERR_LIB_SSL, SSL_R_ECC_CERT_NOT_FOR_SIGNING);
4478	return 0;
4479	}
4480	}
4481	return 1; /* all checks are ok */
4482	}
4483
4484	int ssl_get_server_cert_serverinfo(SSL_CONNECTION *s,
4485	const unsigned char **serverinfo,
4486	size_t *serverinfo_length)
4487	{
4488	CERT_PKEY *cpk = s->s3.tmp.cert;
4489	*serverinfo_length = 0;
4490
4491	if (cpk == NULL \|\| cpk->serverinfo == NULL)
4492	return 0;
4493
4494	*serverinfo = cpk->serverinfo;
4495	*serverinfo_length = cpk->serverinfo_length;
4496	return 1;
4497	}
4498
4499	void ssl_update_cache(SSL_CONNECTION *s, int mode)
4500	{
4501	int i;
4502
4503	/*
4504	* If the session_id_length is 0, we are not supposed to cache it, and it
4505	* would be rather hard to do anyway :-). Also if the session has already
4506	* been marked as not_resumable we should not cache it for later reuse.
4507	*/
4508	if (s->session->session_id_length == 0 \|\| s->session->not_resumable)
4509	return;
4510
4511	/*
4512	* If sid_ctx_length is 0 there is no specific application context
4513	* associated with this session, so when we try to resume it and
4514	* SSL_VERIFY_PEER is requested to verify the client identity, we have no
4515	* indication that this is actually a session for the proper application
4516	* context, and the handshake will fail, not just the resumption attempt.
4517	* Do not cache (on the server) these sessions that are not resumable
4518	* (clients can set SSL_VERIFY_PEER without needing a sid_ctx set).
4519	*/
4520	if (s->server && s->session->sid_ctx_length == 0
4521	&& (s->verify_mode & SSL_VERIFY_PEER) != 0)
4522	return;
4523
4524	i = s->session_ctx->session_cache_mode;
4525	if ((i & mode) != 0
4526	&& (!s->hit \|\| SSL_CONNECTION_IS_TLS13(s))) {
4527	/*
4528	* Add the session to the internal cache. In server side TLSv1.3 we
4529	* normally don't do this because by default it's a full stateless ticket
4530	* with only a dummy session id so there is no reason to cache it,
4531	* unless:
4532	* - we are doing early_data, in which case we cache so that we can
4533	* detect replays
4534	* - the application has set a remove_session_cb so needs to know about
4535	* session timeout events
4536	* - SSL_OP_NO_TICKET is set in which case it is a stateful ticket
4537	*/
4538	if ((i & SSL_SESS_CACHE_NO_INTERNAL_STORE) == 0
4539	&& (!SSL_CONNECTION_IS_TLS13(s)
4540	\|\| !s->server
4541	\|\| (s->max_early_data > 0
4542	&& (s->options & SSL_OP_NO_ANTI_REPLAY) == 0)
4543	\|\| s->session_ctx->remove_session_cb != NULL
4544	\|\| (s->options & SSL_OP_NO_TICKET) != 0))
4545	SSL_CTX_add_session(s->session_ctx, s->session);
4546
4547	/*
4548	* Add the session to the external cache. We do this even in server side
4549	* TLSv1.3 without early data because some applications just want to
4550	* know about the creation of a session and aren't doing a full cache.
4551	*/
4552	if (s->session_ctx->new_session_cb != NULL) {
4553	SSL_SESSION_up_ref(s->session);
4554	if (!s->session_ctx->new_session_cb(SSL_CONNECTION_GET_USER_SSL(s),
4555	s->session))
4556	SSL_SESSION_free(s->session);
4557	}
4558	}
4559
4560	/* auto flush every 255 connections */
4561	if ((!(i & SSL_SESS_CACHE_NO_AUTO_CLEAR)) && ((i & mode) == mode)) {
4562	TSAN_QUALIFIER int *stat;
4563
4564	if (mode & SSL_SESS_CACHE_CLIENT)
4565	stat = &s->session_ctx->stats.sess_connect_good;
4566	else
4567	stat = &s->session_ctx->stats.sess_accept_good;
4568	if ((ssl_tsan_load(s->session_ctx, stat) & 0xff) == 0xff)
4569	SSL_CTX_flush_sessions_ex(s->session_ctx, time(NULL));
4570	}
4571	}
4572
4573	const SSL_METHOD SSL_CTX_get_ssl_method(const SSL_CTX ctx)
4574	{
4575	return ctx->method;
4576	}
4577
4578	const SSL_METHOD SSL_get_ssl_method(const SSL s)
4579	{
4580	return s->method;
4581	}
4582
4583	int SSL_set_ssl_method(SSL s, const SSL_METHOD meth)
4584	{
4585	int ret = 1;
4586	SSL_CONNECTION *sc = SSL_CONNECTION_FROM_SSL(s);
4587
4588	/* Not allowed for QUIC */
4589	if (sc == NULL
4590	\|\| (s->type != SSL_TYPE_SSL_CONNECTION && s->method != meth)
4591	\|\| (s->type == SSL_TYPE_SSL_CONNECTION && IS_QUIC_METHOD(meth)))
4592	return 0;
4593
4594	if (s->method != meth) {
4595	const SSL_METHOD *sm = s->method;
4596	int (hf) (SSL ) = sc->handshake_func;
4597
4598	if (sm->version == meth->version)
4599	s->method = meth;
4600	else {
4601	sm->ssl_deinit(s);
4602	s->method = meth;
4603	ret = s->method->ssl_init(s);
4604	}
4605
4606	if (hf == sm->ssl_connect)
4607	sc->handshake_func = meth->ssl_connect;
4608	else if (hf == sm->ssl_accept)
4609	sc->handshake_func = meth->ssl_accept;
4610	}
4611	return ret;
4612	}
4613
4614	int SSL_get_error(const SSL *s, int i)
4615	{
4616	return ossl_ssl_get_error(s, i, /check_err=/1);
4617	}
4618
4619	int ossl_ssl_get_error(const SSL *s, int i, int check_err)
4620	{
4621	int reason;
4622	unsigned long l;
4623	BIO *bio;
4624	const SSL_CONNECTION *sc = SSL_CONNECTION_FROM_CONST_SSL(s);
4625
4626	if (i > 0)
4627	return SSL_ERROR_NONE;
4628
4629	#ifndef OPENSSL_NO_QUIC
4630	if (IS_QUIC(s)) {
4631	reason = ossl_quic_get_error(s, i);
4632	if (reason != SSL_ERROR_NONE)
4633	return reason;
4634	}
4635	#endif
4636
4637	if (sc == NULL)
4638	return SSL_ERROR_SSL;
4639
4640	/*
4641	* Make things return SSL_ERROR_SYSCALL when doing SSL_do_handshake etc,
4642	* where we do encode the error
4643	*/
4644	if (check_err && (l = ERR_peek_error()) != 0) {
4645	if (ERR_GET_LIB(l) == ERR_LIB_SYS)
4646	return SSL_ERROR_SYSCALL;
4647	else
4648	return SSL_ERROR_SSL;
4649	}
4650
4651	#ifndef OPENSSL_NO_QUIC
4652	if (!IS_QUIC(s))
4653	#endif
4654	{
4655	if (SSL_want_read(s)) {
4656	bio = SSL_get_rbio(s);
4657	if (BIO_should_read(bio))
4658	return SSL_ERROR_WANT_READ;
4659	else if (BIO_should_write(bio))
4660	/*
4661	* This one doesn't make too much sense ... We never try to
4662	* write to the rbio, and an application program where rbio and
4663	* wbio are separate couldn't even know what it should wait for.
4664	* However if we ever set s->rwstate incorrectly (so that we
4665	* have SSL_want_read(s) instead of SSL_want_write(s)) and rbio
4666	* and wbio are the same, this test works around that bug; so
4667	* it might be safer to keep it.
4668	*/
4669	return SSL_ERROR_WANT_WRITE;
4670	else if (BIO_should_io_special(bio)) {
4671	reason = BIO_get_retry_reason(bio);
4672	if (reason == BIO_RR_CONNECT)
4673	return SSL_ERROR_WANT_CONNECT;
4674	else if (reason == BIO_RR_ACCEPT)
4675	return SSL_ERROR_WANT_ACCEPT;
4676	else
4677	return SSL_ERROR_SYSCALL; /* unknown */
4678	}
4679	}
4680
4681	if (SSL_want_write(s)) {
4682	/*
4683	* Access wbio directly - in order to use the buffered bio if
4684	* present
4685	*/
4686	bio = sc->wbio;
4687	if (BIO_should_write(bio))
4688	return SSL_ERROR_WANT_WRITE;
4689	else if (BIO_should_read(bio))
4690	/*
4691	* See above (SSL_want_read(s) with BIO_should_write(bio))
4692	*/
4693	return SSL_ERROR_WANT_READ;
4694	else if (BIO_should_io_special(bio)) {
4695	reason = BIO_get_retry_reason(bio);
4696	if (reason == BIO_RR_CONNECT)
4697	return SSL_ERROR_WANT_CONNECT;
4698	else if (reason == BIO_RR_ACCEPT)
4699	return SSL_ERROR_WANT_ACCEPT;
4700	else
4701	return SSL_ERROR_SYSCALL;
4702	}
4703	}
4704	}
4705
4706	if (SSL_want_x509_lookup(s))
4707	return SSL_ERROR_WANT_X509_LOOKUP;
4708	if (SSL_want_retry_verify(s))
4709	return SSL_ERROR_WANT_RETRY_VERIFY;
4710	if (SSL_want_async(s))
4711	return SSL_ERROR_WANT_ASYNC;
4712	if (SSL_want_async_job(s))
4713	return SSL_ERROR_WANT_ASYNC_JOB;
4714	if (SSL_want_client_hello_cb(s))
4715	return SSL_ERROR_WANT_CLIENT_HELLO_CB;
4716
4717	if ((sc->shutdown & SSL_RECEIVED_SHUTDOWN) &&
4718	(sc->s3.warn_alert == SSL_AD_CLOSE_NOTIFY))
4719	return SSL_ERROR_ZERO_RETURN;
4720
4721	return SSL_ERROR_SYSCALL;
4722	}
4723
4724	static int ssl_do_handshake_intern(void *vargs)
4725	{
4726	struct ssl_async_args args = (struct ssl_async_args )vargs;
4727	SSL *s = args->s;
4728	SSL_CONNECTION *sc = SSL_CONNECTION_FROM_SSL(s);
4729
4730	if (sc == NULL)
4731	return -1;
4732
4733	return sc->handshake_func(s);
4734	}
4735
4736	int SSL_do_handshake(SSL *s)
4737	{
4738	int ret = 1;
4739	SSL_CONNECTION *sc = SSL_CONNECTION_FROM_SSL(s);
4740
4741	#ifndef OPENSSL_NO_QUIC
4742	if (IS_QUIC(s))
4743	return ossl_quic_do_handshake(s);
4744	#endif
4745
4746	if (sc->handshake_func == NULL) {
4747	ERR_raise(ERR_LIB_SSL, SSL_R_CONNECTION_TYPE_NOT_SET);
4748	return -1;
4749	}
4750
4751	ossl_statem_check_finish_init(sc, -1);
4752
4753	s->method->ssl_renegotiate_check(s, 0);
4754
4755	if (SSL_in_init(s) \|\| SSL_in_before(s)) {
4756	if ((sc->mode & SSL_MODE_ASYNC) && ASYNC_get_current_job() == NULL) {
4757	struct ssl_async_args args;
4758
4759	memset(&args, 0, sizeof(args));
4760	args.s = s;
4761
4762	ret = ssl_start_async_job(s, &args, ssl_do_handshake_intern);
4763	} else {
4764	ret = sc->handshake_func(s);
4765	}
4766	}
4767	return ret;
4768	}
4769
4770	void SSL_set_accept_state(SSL *s)
4771	{
4772	SSL_CONNECTION *sc = SSL_CONNECTION_FROM_SSL_ONLY(s);
4773
4774	#ifndef OPENSSL_NO_QUIC
4775	if (IS_QUIC(s)) {
4776	ossl_quic_set_accept_state(s);
4777	return;
4778	}
4779	#endif
4780
4781	sc->server = 1;
4782	sc->shutdown = 0;
4783	ossl_statem_clear(sc);
4784	sc->handshake_func = s->method->ssl_accept;
4785	/* Ignore return value. Its a void public API function */
4786	RECORD_LAYER_reset(&sc->rlayer);
4787	}
4788
4789	void SSL_set_connect_state(SSL *s)
4790	{
4791	SSL_CONNECTION *sc = SSL_CONNECTION_FROM_SSL_ONLY(s);
4792
4793	#ifndef OPENSSL_NO_QUIC
4794	if (IS_QUIC(s)) {
4795	ossl_quic_set_connect_state(s);
4796	return;
4797	}
4798	#endif
4799
4800	sc->server = 0;
4801	sc->shutdown = 0;
4802	ossl_statem_clear(sc);
4803	sc->handshake_func = s->method->ssl_connect;
4804	/* Ignore return value. Its a void public API function */
4805	RECORD_LAYER_reset(&sc->rlayer);
4806	}
4807
4808	int ssl_undefined_function(SSL *s)
4809	{
4810	ERR_raise(ERR_LIB_SSL, ERR_R_SHOULD_NOT_HAVE_BEEN_CALLED);
4811	return 0;
4812	}
4813
4814	int ssl_undefined_void_function(void)
4815	{
4816	ERR_raise(ERR_LIB_SSL, ERR_R_SHOULD_NOT_HAVE_BEEN_CALLED);
4817	return 0;
4818	}
4819
4820	int ssl_undefined_const_function(const SSL *s)
4821	{
4822	return 0;
4823	}
4824
4825	const char *ssl_protocol_to_string(int version)
4826	{
4827	switch (version) {
4828	case TLS1_3_VERSION:
4829	return "TLSv1.3";
4830
4831	case TLS1_2_VERSION:
4832	return "TLSv1.2";
4833
4834	case TLS1_1_VERSION:
4835	return "TLSv1.1";
4836
4837	case TLS1_VERSION:
4838	return "TLSv1";
4839
4840	case SSL3_VERSION:
4841	return "SSLv3";
4842
4843	case DTLS1_BAD_VER:
4844	return "DTLSv0.9";
4845
4846	case DTLS1_VERSION:
4847	return "DTLSv1";
4848
4849	case DTLS1_2_VERSION:
4850	return "DTLSv1.2";
4851
4852	default:
4853	return "unknown";
4854	}
4855	}
4856
4857	const char SSL_get_version(const SSL s)
4858	{
4859	const SSL_CONNECTION *sc = SSL_CONNECTION_FROM_CONST_SSL(s);
4860
4861	#ifndef OPENSSL_NO_QUIC
4862	/* We only support QUICv1 - so if its QUIC its QUICv1 */
4863	if (s->type == SSL_TYPE_QUIC_CONNECTION \|\| s->type == SSL_TYPE_QUIC_XSO)
4864	return "QUICv1";
4865	#endif
4866
4867	if (sc == NULL)
4868	return NULL;
4869
4870	return ssl_protocol_to_string(sc->version);
4871	}
4872
4873	__owur int SSL_get_handshake_rtt(const SSL s, uint64_t rtt)
4874	{
4875	const SSL_CONNECTION *sc = SSL_CONNECTION_FROM_CONST_SSL(s);
4876
4877	if (sc == NULL)
4878	return -1;
4879	if (sc->ts_msg_write.t <= 0 \|\| sc->ts_msg_read.t <= 0)
4880	return 0; /* data not (yet) available */
4881	if (sc->ts_msg_read.t < sc->ts_msg_write.t)
4882	return -1;
4883
4884	*rtt = ossl_time2us(ossl_time_subtract(sc->ts_msg_read, sc->ts_msg_write));
4885	return 1;
4886	}
4887
4888	static int dup_ca_names(STACK_OF(X509_NAME) *dst, STACK_OF(X509_NAME) src)
4889	{
4890	STACK_OF(X509_NAME) *sk;
4891	X509_NAME *xn;
4892	int i;
4893
4894	if (src == NULL) {
4895	*dst = NULL;
4896	return 1;
4897	}
4898
4899	if ((sk = sk_X509_NAME_new_null()) == NULL)
4900	return 0;
4901	for (i = 0; i < sk_X509_NAME_num(src); i++) {
4902	xn = X509_NAME_dup(sk_X509_NAME_value(src, i));
4903	if (xn == NULL) {
4904	sk_X509_NAME_pop_free(sk, X509_NAME_free);
4905	return 0;
4906	}
4907	if (sk_X509_NAME_insert(sk, xn, i) == 0) {
4908	X509_NAME_free(xn);
4909	sk_X509_NAME_pop_free(sk, X509_NAME_free);
4910	return 0;
4911	}
4912	}
4913	*dst = sk;
4914
4915	return 1;
4916	}
4917
4918	SSL SSL_dup(SSL s)
4919	{
4920	SSL *ret;
4921	int i;
4922	/* TODO(QUIC FUTURE): Add a SSL_METHOD function for duplication */
4923	SSL_CONNECTION *retsc;
4924	SSL_CONNECTION *sc = SSL_CONNECTION_FROM_SSL_ONLY(s);
4925
4926	if (sc == NULL)
4927	return NULL;
4928
4929	/* If we're not quiescent, just up_ref! */
4930	if (!SSL_in_init(s) \|\| !SSL_in_before(s)) {
4931	CRYPTO_UP_REF(&s->references, &i);
4932	return s;
4933	}
4934
4935	/*
4936	* Otherwise, copy configuration state, and session if set.
4937	*/
4938	if ((ret = SSL_new(SSL_get_SSL_CTX(s))) == NULL)
4939	return NULL;
4940	if ((retsc = SSL_CONNECTION_FROM_SSL_ONLY(ret)) == NULL)
4941	goto err;
4942
4943	if (sc->session != NULL) {
4944	/*
4945	* Arranges to share the same session via up_ref. This "copies"
4946	* session-id, SSL_METHOD, sid_ctx, and 'cert'
4947	*/
4948	if (!SSL_copy_session_id(ret, s))
4949	goto err;
4950	} else {
4951	/*
4952	* No session has been established yet, so we have to expect that
4953	* s->cert or ret->cert will be changed later -- they should not both
4954	* point to the same object, and thus we can't use
4955	* SSL_copy_session_id.
4956	*/
4957	if (!SSL_set_ssl_method(ret, s->method))
4958	goto err;
4959
4960	if (sc->cert != NULL) {
4961	ssl_cert_free(retsc->cert);
4962	retsc->cert = ssl_cert_dup(sc->cert);
4963	if (retsc->cert == NULL)
4964	goto err;
4965	}
4966
4967	if (!SSL_set_session_id_context(ret, sc->sid_ctx,
4968	(int)sc->sid_ctx_length))
4969	goto err;
4970	}
4971
4972	if (!ssl_dane_dup(retsc, sc))
4973	goto err;
4974	retsc->version = sc->version;
4975	retsc->options = sc->options;
4976	retsc->min_proto_version = sc->min_proto_version;
4977	retsc->max_proto_version = sc->max_proto_version;
4978	retsc->mode = sc->mode;
4979	SSL_set_max_cert_list(ret, SSL_get_max_cert_list(s));
4980	SSL_set_read_ahead(ret, SSL_get_read_ahead(s));
4981	retsc->msg_callback = sc->msg_callback;
4982	retsc->msg_callback_arg = sc->msg_callback_arg;
4983	SSL_set_verify(ret, SSL_get_verify_mode(s), SSL_get_verify_callback(s));
4984	SSL_set_verify_depth(ret, SSL_get_verify_depth(s));
4985	retsc->generate_session_id = sc->generate_session_id;
4986
4987	SSL_set_info_callback(ret, SSL_get_info_callback(s));
4988
4989	/* copy app data, a little dangerous perhaps */
4990	if (!CRYPTO_dup_ex_data(CRYPTO_EX_INDEX_SSL, &ret->ex_data, &s->ex_data))
4991	goto err;
4992
4993	retsc->server = sc->server;
4994	if (sc->handshake_func) {
4995	if (sc->server)
4996	SSL_set_accept_state(ret);
4997	else
4998	SSL_set_connect_state(ret);
4999	}
5000	retsc->shutdown = sc->shutdown;
5001	retsc->hit = sc->hit;
5002
5003	retsc->default_passwd_callback = sc->default_passwd_callback;
5004	retsc->default_passwd_callback_userdata = sc->default_passwd_callback_userdata;
5005
5006	X509_VERIFY_PARAM_inherit(retsc->param, sc->param);
5007
5008	/* dup the cipher_list and cipher_list_by_id stacks */
5009	if (sc->cipher_list != NULL) {
5010	if ((retsc->cipher_list = sk_SSL_CIPHER_dup(sc->cipher_list)) == NULL)
5011	goto err;
5012	}
5013	if (sc->cipher_list_by_id != NULL)
5014	if ((retsc->cipher_list_by_id = sk_SSL_CIPHER_dup(sc->cipher_list_by_id))
5015	== NULL)
5016	goto err;
5017
5018	/* Dup the client_CA list */
5019	if (!dup_ca_names(&retsc->ca_names, sc->ca_names)
5020	\|\| !dup_ca_names(&retsc->client_ca_names, sc->client_ca_names))
5021	goto err;
5022
5023	return ret;
5024
5025	err:
5026	SSL_free(ret);
5027	return NULL;
5028	}
5029
5030	X509 SSL_get_certificate(const SSL s)
5031	{
5032	SSL_CONNECTION *sc = SSL_CONNECTION_FROM_SSL(s);
5033
5034	if (sc == NULL)
5035	return NULL;
5036
5037	if (sc->cert != NULL)
5038	return sc->cert->key->x509;
5039	else
5040	return NULL;
5041	}
5042
5043	EVP_PKEY SSL_get_privatekey(const SSL s)
5044	{
5045	const SSL_CONNECTION *sc = SSL_CONNECTION_FROM_CONST_SSL(s);
5046
5047	if (sc == NULL)
5048	return NULL;
5049
5050	if (sc->cert != NULL)
5051	return sc->cert->key->privatekey;
5052	else
5053	return NULL;
5054	}
5055
5056	X509 SSL_CTX_get0_certificate(const SSL_CTX ctx)
5057	{
5058	if (ctx->cert != NULL)
5059	return ctx->cert->key->x509;
5060	else
5061	return NULL;
5062	}
5063
5064	EVP_PKEY SSL_CTX_get0_privatekey(const SSL_CTX ctx)
5065	{
5066	if (ctx->cert != NULL)
5067	return ctx->cert->key->privatekey;
5068	else
5069	return NULL;
5070	}
5071
5072	const SSL_CIPHER SSL_get_current_cipher(const SSL s)
5073	{
5074	const SSL_CONNECTION *sc = SSL_CONNECTION_FROM_CONST_SSL(s);
5075
5076	if (sc == NULL)
5077	return NULL;
5078
5079	if ((sc->session != NULL) && (sc->session->cipher != NULL))
5080	return sc->session->cipher;
5081	return NULL;
5082	}
5083
5084	const SSL_CIPHER SSL_get_pending_cipher(const SSL s)
5085	{
5086	const SSL_CONNECTION *sc = SSL_CONNECTION_FROM_CONST_SSL(s);
5087
5088	if (sc == NULL)
5089	return NULL;
5090
5091	return sc->s3.tmp.new_cipher;
5092	}
5093
5094	const COMP_METHOD SSL_get_current_compression(const SSL s)
5095	{
5096	#ifndef OPENSSL_NO_COMP
5097	const SSL_CONNECTION *sc = SSL_CONNECTION_FROM_CONST_SSL_ONLY(s);
5098
5099	if (sc == NULL)
5100	return NULL;
5101
5102	return sc->rlayer.wrlmethod->get_compression(sc->rlayer.wrl);
5103	#else
5104	return NULL;
5105	#endif
5106	}
5107
5108	const COMP_METHOD SSL_get_current_expansion(const SSL s)
5109	{
5110	#ifndef OPENSSL_NO_COMP
5111	const SSL_CONNECTION *sc = SSL_CONNECTION_FROM_CONST_SSL_ONLY(s);
5112
5113	if (sc == NULL)
5114	return NULL;
5115
5116	return sc->rlayer.rrlmethod->get_compression(sc->rlayer.rrl);
5117	#else
5118	return NULL;
5119	#endif
5120	}
5121
5122	int ssl_init_wbio_buffer(SSL_CONNECTION *s)
5123	{
5124	BIO *bbio;
5125
5126	if (s->bbio != NULL) {
5127	/* Already buffered. */
5128	return 1;
5129	}
5130
5131	bbio = BIO_new(BIO_f_buffer());
5132	if (bbio == NULL \|\| BIO_set_read_buffer_size(bbio, 1) <= 0) {
5133	BIO_free(bbio);
5134	ERR_raise(ERR_LIB_SSL, ERR_R_BUF_LIB);
5135	return 0;
5136	}
5137	s->bbio = bbio;
5138	s->wbio = BIO_push(bbio, s->wbio);
5139
5140	s->rlayer.wrlmethod->set1_bio(s->rlayer.wrl, s->wbio);
5141
5142	return 1;
5143	}
5144
5145	int ssl_free_wbio_buffer(SSL_CONNECTION *s)
5146	{
5147	/* callers ensure s is never null */
5148	if (s->bbio == NULL)
5149	return 1;
5150
5151	s->wbio = BIO_pop(s->wbio);
5152	s->rlayer.wrlmethod->set1_bio(s->rlayer.wrl, s->wbio);
5153
5154	BIO_free(s->bbio);
5155	s->bbio = NULL;
5156
5157	return 1;
5158	}
5159
5160	void SSL_CTX_set_quiet_shutdown(SSL_CTX *ctx, int mode)
5161	{
5162	ctx->quiet_shutdown = mode;
5163	}
5164
5165	int SSL_CTX_get_quiet_shutdown(const SSL_CTX *ctx)
5166	{
5167	return ctx->quiet_shutdown;
5168	}
5169
5170	void SSL_set_quiet_shutdown(SSL *s, int mode)
5171	{
5172	SSL_CONNECTION *sc = SSL_CONNECTION_FROM_SSL_ONLY(s);
5173
5174	/* Not supported with QUIC */
5175	if (sc == NULL)
5176	return;
5177
5178	sc->quiet_shutdown = mode;
5179	}
5180
5181	int SSL_get_quiet_shutdown(const SSL *s)
5182	{
5183	const SSL_CONNECTION *sc = SSL_CONNECTION_FROM_CONST_SSL_ONLY(s);
5184
5185	/* Not supported with QUIC */
5186	if (sc == NULL)
5187	return 0;
5188
5189	return sc->quiet_shutdown;
5190	}
5191
5192	void SSL_set_shutdown(SSL *s, int mode)
5193	{
5194	SSL_CONNECTION *sc = SSL_CONNECTION_FROM_SSL_ONLY(s);
5195
5196	/* Not supported with QUIC */
5197	if (sc == NULL)
5198	return;
5199
5200	sc->shutdown = mode;
5201	}
5202
5203	int SSL_get_shutdown(const SSL *s)
5204	{
5205	const SSL_CONNECTION *sc = SSL_CONNECTION_FROM_CONST_SSL_ONLY(s);
5206
5207	#ifndef OPENSSL_NO_QUIC
5208	/* QUIC: Just indicate whether the connection was shutdown cleanly. */
5209	if (IS_QUIC(s))
5210	return ossl_quic_get_shutdown(s);
5211	#endif
5212
5213	if (sc == NULL)
5214	return 0;
5215
5216	return sc->shutdown;
5217	}
5218
5219	int SSL_version(const SSL *s)
5220	{
5221	const SSL_CONNECTION *sc = SSL_CONNECTION_FROM_CONST_SSL(s);
5222
5223	#ifndef OPENSSL_NO_QUIC
5224	/* We only support QUICv1 - so if its QUIC its QUICv1 */
5225	if (s->type == SSL_TYPE_QUIC_CONNECTION \|\| s->type == SSL_TYPE_QUIC_XSO)
5226	return OSSL_QUIC1_VERSION;
5227	#endif
5228	if (sc == NULL)
5229	return 0;
5230
5231	return sc->version;
5232	}
5233
5234	int SSL_client_version(const SSL *s)
5235	{
5236	const SSL_CONNECTION *sc = SSL_CONNECTION_FROM_CONST_SSL(s);
5237
5238	#ifndef OPENSSL_NO_QUIC
5239	/* We only support QUICv1 - so if its QUIC its QUICv1 */
5240	if (s->type == SSL_TYPE_QUIC_CONNECTION \|\| s->type == SSL_TYPE_QUIC_XSO)
5241	return OSSL_QUIC1_VERSION;
5242	#endif
5243	if (sc == NULL)
5244	return 0;
5245
5246	return sc->client_version;
5247	}
5248
5249	SSL_CTX SSL_get_SSL_CTX(const SSL ssl)
5250	{
5251	return ssl->ctx;
5252	}
5253
5254	SSL_CTX SSL_set_SSL_CTX(SSL ssl, SSL_CTX *ctx)
5255	{
5256	CERT *new_cert;
5257	SSL_CONNECTION *sc = SSL_CONNECTION_FROM_SSL_ONLY(ssl);
5258
5259	/* TODO(QUIC FUTURE): Add support for QUIC */
5260	if (sc == NULL)
5261	return NULL;
5262
5263	if (ssl->ctx == ctx)
5264	return ssl->ctx;
5265	if (ctx == NULL)
5266	ctx = sc->session_ctx;
5267	new_cert = ssl_cert_dup(ctx->cert);
5268	if (new_cert == NULL) {
5269	return NULL;
5270	}
5271
5272	if (!custom_exts_copy_flags(&new_cert->custext, &sc->cert->custext)) {
5273	ssl_cert_free(new_cert);
5274	return NULL;
5275	}
5276
5277	ssl_cert_free(sc->cert);
5278	sc->cert = new_cert;
5279
5280	/*
5281	* Program invariant: \|sid_ctx\| has fixed size (SSL_MAX_SID_CTX_LENGTH),
5282	* so setter APIs must prevent invalid lengths from entering the system.
5283	*/
5284	if (!ossl_assert(sc->sid_ctx_length <= sizeof(sc->sid_ctx)))
5285	return NULL;
5286
5287	/*
5288	* If the session ID context matches that of the parent SSL_CTX,
5289	* inherit it from the new SSL_CTX as well. If however the context does
5290	* not match (i.e., it was set per-ssl with SSL_set_session_id_context),
5291	* leave it unchanged.
5292	*/
5293	if ((ssl->ctx != NULL) &&
5294	(sc->sid_ctx_length == ssl->ctx->sid_ctx_length) &&
5295	(memcmp(sc->sid_ctx, ssl->ctx->sid_ctx, sc->sid_ctx_length) == 0)) {
5296	sc->sid_ctx_length = ctx->sid_ctx_length;
5297	memcpy(&sc->sid_ctx, &ctx->sid_ctx, sizeof(sc->sid_ctx));
5298	}
5299
5300	SSL_CTX_up_ref(ctx);
5301	SSL_CTX_free(ssl->ctx); /* decrement reference count */
5302	ssl->ctx = ctx;
5303
5304	return ssl->ctx;
5305	}
5306
5307	int SSL_CTX_set_default_verify_paths(SSL_CTX *ctx)
5308	{
5309	return X509_STORE_set_default_paths_ex(ctx->cert_store, ctx->libctx,
5310	ctx->propq);
5311	}
5312
5313	int SSL_CTX_set_default_verify_dir(SSL_CTX *ctx)
5314	{
5315	X509_LOOKUP *lookup;
5316
5317	lookup = X509_STORE_add_lookup(ctx->cert_store, X509_LOOKUP_hash_dir());
5318	if (lookup == NULL)
5319	return 0;
5320
5321	/* We ignore errors, in case the directory doesn't exist */
5322	ERR_set_mark();
5323
5324	X509_LOOKUP_add_dir(lookup, NULL, X509_FILETYPE_DEFAULT);
5325
5326	ERR_pop_to_mark();
5327
5328	return 1;
5329	}
5330
5331	int SSL_CTX_set_default_verify_file(SSL_CTX *ctx)
5332	{
5333	X509_LOOKUP *lookup;
5334
5335	lookup = X509_STORE_add_lookup(ctx->cert_store, X509_LOOKUP_file());
5336	if (lookup == NULL)
5337	return 0;
5338
5339	/* We ignore errors, in case the file doesn't exist */
5340	ERR_set_mark();
5341
5342	X509_LOOKUP_load_file_ex(lookup, NULL, X509_FILETYPE_DEFAULT, ctx->libctx,
5343	ctx->propq);
5344
5345	ERR_pop_to_mark();
5346
5347	return 1;
5348	}
5349
5350	int SSL_CTX_set_default_verify_store(SSL_CTX *ctx)
5351	{
5352	X509_LOOKUP *lookup;
5353
5354	lookup = X509_STORE_add_lookup(ctx->cert_store, X509_LOOKUP_store());
5355	if (lookup == NULL)
5356	return 0;
5357
5358	/* We ignore errors, in case the directory doesn't exist */
5359	ERR_set_mark();
5360
5361	X509_LOOKUP_add_store_ex(lookup, NULL, ctx->libctx, ctx->propq);
5362
5363	ERR_pop_to_mark();
5364
5365	return 1;
5366	}
5367
5368	int SSL_CTX_load_verify_file(SSL_CTX ctx, const char CAfile)
5369	{
5370	return X509_STORE_load_file_ex(ctx->cert_store, CAfile, ctx->libctx,
5371	ctx->propq);
5372	}
5373
5374	int SSL_CTX_load_verify_dir(SSL_CTX ctx, const char CApath)
5375	{
5376	return X509_STORE_load_path(ctx->cert_store, CApath);
5377	}
5378
5379	int SSL_CTX_load_verify_store(SSL_CTX ctx, const char CAstore)
5380	{
5381	return X509_STORE_load_store_ex(ctx->cert_store, CAstore, ctx->libctx,
5382	ctx->propq);
5383	}
5384
5385	int SSL_CTX_load_verify_locations(SSL_CTX ctx, const char CAfile,
5386	const char *CApath)
5387	{
5388	if (CAfile == NULL && CApath == NULL)
5389	return 0;
5390	if (CAfile != NULL && !SSL_CTX_load_verify_file(ctx, CAfile))
5391	return 0;
5392	if (CApath != NULL && !SSL_CTX_load_verify_dir(ctx, CApath))
5393	return 0;
5394	return 1;
5395	}
5396
5397	void SSL_set_info_callback(SSL *ssl,
5398	void (cb) (const SSL ssl, int type, int val))
5399	{
5400	SSL_CONNECTION *sc = SSL_CONNECTION_FROM_SSL(ssl);
5401
5402	if (sc == NULL)
5403	return;
5404
5405	sc->info_callback = cb;
5406	}
5407
5408	/*
5409	* One compiler (Diab DCC) doesn't like argument names in returned function
5410	* pointer.
5411	*/
5412	void (SSL_get_info_callback(const SSL ssl)) (const SSL * /* ssl */ ,
5413	int /* type */ ,
5414	int /* val */ ) {
5415	const SSL_CONNECTION *sc = SSL_CONNECTION_FROM_CONST_SSL(ssl);
5416
5417	if (sc == NULL)
5418	return NULL;
5419
5420	return sc->info_callback;
5421	}
5422
5423	void SSL_set_verify_result(SSL *ssl, long arg)
5424	{
5425	SSL_CONNECTION *sc = SSL_CONNECTION_FROM_SSL(ssl);
5426
5427	if (sc == NULL)
5428	return;
5429
5430	sc->verify_result = arg;
5431	}
5432
5433	long SSL_get_verify_result(const SSL *ssl)
5434	{
5435	const SSL_CONNECTION *sc = SSL_CONNECTION_FROM_CONST_SSL(ssl);
5436
5437	if (sc == NULL)
5438	return 0;
5439
5440	return sc->verify_result;
5441	}
5442
5443	size_t SSL_get_client_random(const SSL ssl, unsigned char out, size_t outlen)
5444	{
5445	const SSL_CONNECTION *sc = SSL_CONNECTION_FROM_CONST_SSL(ssl);
5446
5447	if (sc == NULL)
5448	return 0;
5449
5450	if (outlen == 0)
5451	return sizeof(sc->s3.client_random);
5452	if (outlen > sizeof(sc->s3.client_random))
5453	outlen = sizeof(sc->s3.client_random);
5454	memcpy(out, sc->s3.client_random, outlen);
5455	return outlen;
5456	}
5457
5458	size_t SSL_get_server_random(const SSL ssl, unsigned char out, size_t outlen)
5459	{
5460	const SSL_CONNECTION *sc = SSL_CONNECTION_FROM_CONST_SSL(ssl);
5461
5462	if (sc == NULL)
5463	return 0;
5464
5465	if (outlen == 0)
5466	return sizeof(sc->s3.server_random);
5467	if (outlen > sizeof(sc->s3.server_random))
5468	outlen = sizeof(sc->s3.server_random);
5469	memcpy(out, sc->s3.server_random, outlen);
5470	return outlen;
5471	}
5472
5473	size_t SSL_SESSION_get_master_key(const SSL_SESSION *session,
5474	unsigned char *out, size_t outlen)
5475	{
5476	if (outlen == 0)
5477	return session->master_key_length;
5478	if (outlen > session->master_key_length)
5479	outlen = session->master_key_length;
5480	memcpy(out, session->master_key, outlen);
5481	return outlen;
5482	}
5483
5484	int SSL_SESSION_set1_master_key(SSL_SESSION sess, const unsigned char in,
5485	size_t len)
5486	{
5487	if (len > sizeof(sess->master_key))
5488	return 0;
5489
5490	memcpy(sess->master_key, in, len);
5491	sess->master_key_length = len;
5492	return 1;
5493	}
5494
5495
5496	int SSL_set_ex_data(SSL s, int idx, void arg)
5497	{
5498	return CRYPTO_set_ex_data(&s->ex_data, idx, arg);
5499	}
5500
5501	void SSL_get_ex_data(const SSL s, int idx)
5502	{
5503	return CRYPTO_get_ex_data(&s->ex_data, idx);
5504	}
5505
5506	int SSL_CTX_set_ex_data(SSL_CTX s, int idx, void arg)
5507	{
5508	return CRYPTO_set_ex_data(&s->ex_data, idx, arg);
5509	}
5510
5511	void SSL_CTX_get_ex_data(const SSL_CTX s, int idx)
5512	{
5513	return CRYPTO_get_ex_data(&s->ex_data, idx);
5514	}
5515
5516	X509_STORE SSL_CTX_get_cert_store(const SSL_CTX ctx)
5517	{
5518	return ctx->cert_store;
5519	}
5520
5521	void SSL_CTX_set_cert_store(SSL_CTX ctx, X509_STORE store)
5522	{
5523	X509_STORE_free(ctx->cert_store);
5524	ctx->cert_store = store;
5525	}
5526
5527	void SSL_CTX_set1_cert_store(SSL_CTX ctx, X509_STORE store)
5528	{
5529	if (store != NULL)
5530	X509_STORE_up_ref(store);
5531	SSL_CTX_set_cert_store(ctx, store);
5532	}
5533
5534	int SSL_want(const SSL *s)
5535	{
5536	const SSL_CONNECTION *sc = SSL_CONNECTION_FROM_CONST_SSL(s);
5537
5538	#ifndef OPENSSL_NO_QUIC
5539	if (IS_QUIC(s))
5540	return ossl_quic_want(s);
5541	#endif
5542
5543	if (sc == NULL)
5544	return SSL_NOTHING;
5545
5546	return sc->rwstate;
5547	}
5548
5549	#ifndef OPENSSL_NO_PSK
5550	int SSL_CTX_use_psk_identity_hint(SSL_CTX ctx, const char identity_hint)
5551	{
5552	if (identity_hint != NULL && strlen(identity_hint) > PSK_MAX_IDENTITY_LEN) {
5553	ERR_raise(ERR_LIB_SSL, SSL_R_DATA_LENGTH_TOO_LONG);
5554	return 0;
5555	}
5556	OPENSSL_free(ctx->cert->psk_identity_hint);
5557	if (identity_hint != NULL) {
5558	ctx->cert->psk_identity_hint = OPENSSL_strdup(identity_hint);
5559	if (ctx->cert->psk_identity_hint == NULL)
5560	return 0;
5561	} else
5562	ctx->cert->psk_identity_hint = NULL;
5563	return 1;
5564	}
5565
5566	int SSL_use_psk_identity_hint(SSL s, const char identity_hint)
5567	{
5568	SSL_CONNECTION *sc = SSL_CONNECTION_FROM_SSL(s);
5569
5570	if (sc == NULL)
5571	return 0;
5572
5573	if (identity_hint != NULL && strlen(identity_hint) > PSK_MAX_IDENTITY_LEN) {
5574	ERR_raise(ERR_LIB_SSL, SSL_R_DATA_LENGTH_TOO_LONG);
5575	return 0;
5576	}
5577	OPENSSL_free(sc->cert->psk_identity_hint);
5578	if (identity_hint != NULL) {
5579	sc->cert->psk_identity_hint = OPENSSL_strdup(identity_hint);
5580	if (sc->cert->psk_identity_hint == NULL)
5581	return 0;
5582	} else
5583	sc->cert->psk_identity_hint = NULL;
5584	return 1;
5585	}
5586
5587	const char SSL_get_psk_identity_hint(const SSL s)
5588	{
5589	const SSL_CONNECTION *sc = SSL_CONNECTION_FROM_CONST_SSL(s);
5590
5591	if (sc == NULL \|\| sc->session == NULL)
5592	return NULL;
5593
5594	return sc->session->psk_identity_hint;
5595	}
5596
5597	const char SSL_get_psk_identity(const SSL s)
5598	{
5599	const SSL_CONNECTION *sc = SSL_CONNECTION_FROM_CONST_SSL(s);
5600
5601	if (sc == NULL \|\| sc->session == NULL)
5602	return NULL;
5603
5604	return sc->session->psk_identity;
5605	}
5606
5607	void SSL_set_psk_client_callback(SSL *s, SSL_psk_client_cb_func cb)
5608	{
5609	SSL_CONNECTION *sc = SSL_CONNECTION_FROM_SSL(s);
5610
5611	if (sc == NULL)
5612	return;
5613
5614	sc->psk_client_callback = cb;
5615	}
5616
5617	void SSL_CTX_set_psk_client_callback(SSL_CTX *ctx, SSL_psk_client_cb_func cb)
5618	{
5619	ctx->psk_client_callback = cb;
5620	}
5621
5622	void SSL_set_psk_server_callback(SSL *s, SSL_psk_server_cb_func cb)
5623	{
5624	SSL_CONNECTION *sc = SSL_CONNECTION_FROM_SSL(s);
5625
5626	if (sc == NULL)
5627	return;
5628
5629	sc->psk_server_callback = cb;
5630	}
5631
5632	void SSL_CTX_set_psk_server_callback(SSL_CTX *ctx, SSL_psk_server_cb_func cb)
5633	{
5634	ctx->psk_server_callback = cb;
5635	}
5636	#endif
5637
5638	void SSL_set_psk_find_session_callback(SSL *s, SSL_psk_find_session_cb_func cb)
5639	{
5640	SSL_CONNECTION *sc = SSL_CONNECTION_FROM_SSL(s);
5641
5642	if (sc == NULL)
5643	return;
5644
5645	sc->psk_find_session_cb = cb;
5646	}
5647
5648	void SSL_CTX_set_psk_find_session_callback(SSL_CTX *ctx,
5649	SSL_psk_find_session_cb_func cb)
5650	{
5651	ctx->psk_find_session_cb = cb;
5652	}
5653
5654	void SSL_set_psk_use_session_callback(SSL *s, SSL_psk_use_session_cb_func cb)
5655	{
5656	SSL_CONNECTION *sc = SSL_CONNECTION_FROM_SSL(s);
5657
5658	if (sc == NULL)
5659	return;
5660
5661	sc->psk_use_session_cb = cb;
5662	}
5663
5664	void SSL_CTX_set_psk_use_session_callback(SSL_CTX *ctx,
5665	SSL_psk_use_session_cb_func cb)
5666	{
5667	ctx->psk_use_session_cb = cb;
5668	}
5669
5670	void SSL_CTX_set_msg_callback(SSL_CTX *ctx,
5671	void (*cb) (int write_p, int version,
5672	int content_type, const void *buf,
5673	size_t len, SSL ssl, void arg))
5674	{
5675	SSL_CTX_callback_ctrl(ctx, SSL_CTRL_SET_MSG_CALLBACK, (void (*)(void))cb);
5676	}
5677
5678	void SSL_set_msg_callback(SSL *ssl,
5679	void (*cb) (int write_p, int version,
5680	int content_type, const void *buf,
5681	size_t len, SSL ssl, void arg))
5682	{
5683	SSL_callback_ctrl(ssl, SSL_CTRL_SET_MSG_CALLBACK, (void (*)(void))cb);
5684	}
5685
5686	void SSL_CTX_set_not_resumable_session_callback(SSL_CTX *ctx,
5687	int (cb) (SSL ssl,
5688	int
5689	is_forward_secure))
5690	{
5691	SSL_CTX_callback_ctrl(ctx, SSL_CTRL_SET_NOT_RESUMABLE_SESS_CB,
5692	(void (*)(void))cb);
5693	}
5694
5695	void SSL_set_not_resumable_session_callback(SSL *ssl,
5696	int (cb) (SSL ssl,
5697	int is_forward_secure))
5698	{
5699	SSL_callback_ctrl(ssl, SSL_CTRL_SET_NOT_RESUMABLE_SESS_CB,
5700	(void (*)(void))cb);
5701	}
5702
5703	void SSL_CTX_set_record_padding_callback(SSL_CTX *ctx,
5704	size_t (cb) (SSL ssl, int type,
5705	size_t len, void *arg))
5706	{
5707	ctx->record_padding_cb = cb;
5708	}
5709
5710	void SSL_CTX_set_record_padding_callback_arg(SSL_CTX ctx, void arg)
5711	{
5712	ctx->record_padding_arg = arg;
5713	}
5714
5715	void SSL_CTX_get_record_padding_callback_arg(const SSL_CTX ctx)
5716	{
5717	return ctx->record_padding_arg;
5718	}
5719
5720	int SSL_CTX_set_block_padding_ex(SSL_CTX *ctx, size_t app_block_size,
5721	size_t hs_block_size)
5722	{
5723	if (IS_QUIC_CTX(ctx) && (app_block_size > 1 \|\| hs_block_size > 1))
5724	return 0;
5725
5726	/* block size of 0 or 1 is basically no padding */
5727	if (app_block_size == 1) {
5728	ctx->block_padding = 0;
5729	} else if (app_block_size <= SSL3_RT_MAX_PLAIN_LENGTH) {
5730	ctx->block_padding = app_block_size;
5731	} else {
5732	return 0;
5733	}
5734	if (hs_block_size == 1) {
5735	ctx->hs_padding = 0;
5736	} else if (hs_block_size <= SSL3_RT_MAX_PLAIN_LENGTH) {
5737	ctx->hs_padding = hs_block_size;
5738	} else {
5739	return 0;
5740	}
5741	return 1;
5742	}
5743
5744	int SSL_CTX_set_block_padding(SSL_CTX *ctx, size_t block_size)
5745	{
5746	return SSL_CTX_set_block_padding_ex(ctx, block_size, block_size);
5747	}
5748
5749	int SSL_set_record_padding_callback(SSL *ssl,
5750	size_t (cb) (SSL ssl, int type,
5751	size_t len, void *arg))
5752	{
5753	BIO *b;
5754	SSL_CONNECTION *sc = SSL_CONNECTION_FROM_SSL_ONLY(ssl);
5755
5756	if (sc == NULL)
5757	return 0;
5758
5759	b = SSL_get_wbio(ssl);
5760	if (b == NULL \|\| !BIO_get_ktls_send(b)) {
5761	sc->rlayer.record_padding_cb = cb;
5762	return 1;
5763	}
5764	return 0;
5765	}
5766
5767	void SSL_set_record_padding_callback_arg(SSL ssl, void arg)
5768	{
5769	SSL_CONNECTION *sc = SSL_CONNECTION_FROM_SSL(ssl);
5770
5771	if (sc == NULL)
5772	return;
5773
5774	sc->rlayer.record_padding_arg = arg;
5775	}
5776
5777	void SSL_get_record_padding_callback_arg(const SSL ssl)
5778	{
5779	const SSL_CONNECTION *sc = SSL_CONNECTION_FROM_CONST_SSL(ssl);
5780
5781	if (sc == NULL)
5782	return NULL;
5783
5784	return sc->rlayer.record_padding_arg;
5785	}
5786
5787	int SSL_set_block_padding_ex(SSL *ssl, size_t app_block_size,
5788	size_t hs_block_size)
5789	{
5790	SSL_CONNECTION *sc = SSL_CONNECTION_FROM_SSL(ssl);
5791
5792	if (sc == NULL
5793	\|\| (IS_QUIC(ssl)
5794	&& (app_block_size > 1 \|\| hs_block_size > 1)))
5795	return 0;
5796
5797	/* block size of 0 or 1 is basically no padding */
5798	if (app_block_size == 1) {
5799	sc->rlayer.block_padding = 0;
5800	} else if (app_block_size <= SSL3_RT_MAX_PLAIN_LENGTH) {
5801	sc->rlayer.block_padding = app_block_size;
5802	} else {
5803	return 0;
5804	}
5805	if (hs_block_size == 1) {
5806	sc->rlayer.hs_padding = 0;
5807	} else if (hs_block_size <= SSL3_RT_MAX_PLAIN_LENGTH) {
5808	sc->rlayer.hs_padding = hs_block_size;
5809	} else {
5810	return 0;
5811	}
5812	return 1;
5813	}
5814
5815	int SSL_set_block_padding(SSL *ssl, size_t block_size)
5816	{
5817	return SSL_set_block_padding_ex(ssl, block_size, block_size);
5818	}
5819
5820	int SSL_set_num_tickets(SSL *s, size_t num_tickets)
5821	{
5822	SSL_CONNECTION *sc = SSL_CONNECTION_FROM_SSL(s);
5823
5824	if (sc == NULL)
5825	return 0;
5826
5827	sc->num_tickets = num_tickets;
5828
5829	return 1;
5830	}
5831
5832	size_t SSL_get_num_tickets(const SSL *s)
5833	{
5834	const SSL_CONNECTION *sc = SSL_CONNECTION_FROM_CONST_SSL(s);
5835
5836	if (sc == NULL)
5837	return 0;
5838
5839	return sc->num_tickets;
5840	}
5841
5842	int SSL_CTX_set_num_tickets(SSL_CTX *ctx, size_t num_tickets)
5843	{
5844	ctx->num_tickets = num_tickets;
5845
5846	return 1;
5847	}
5848
5849	size_t SSL_CTX_get_num_tickets(const SSL_CTX *ctx)
5850	{
5851	return ctx->num_tickets;
5852	}
5853
5854	/* Retrieve handshake hashes */
5855	int ssl_handshake_hash(SSL_CONNECTION *s,
5856	unsigned char *out, size_t outlen,
5857	size_t *hashlen)
5858	{
5859	EVP_MD_CTX *ctx = NULL;
5860	EVP_MD_CTX *hdgst = s->s3.handshake_dgst;
5861	int hashleni = EVP_MD_CTX_get_size(hdgst);
5862	int ret = 0;
5863
5864	if (hashleni < 0 \|\| (size_t)hashleni > outlen) {
5865	SSLfatal(s, SSL_AD_INTERNAL_ERROR, ERR_R_INTERNAL_ERROR);
5866	goto err;
5867	}
5868
5869	ctx = EVP_MD_CTX_new();
5870	if (ctx == NULL) {
5871	SSLfatal(s, SSL_AD_INTERNAL_ERROR, ERR_R_INTERNAL_ERROR);
5872	goto err;
5873	}
5874
5875	if (!EVP_MD_CTX_copy_ex(ctx, hdgst)
5876	\|\| EVP_DigestFinal_ex(ctx, out, NULL) <= 0) {
5877	SSLfatal(s, SSL_AD_INTERNAL_ERROR, ERR_R_INTERNAL_ERROR);
5878	goto err;
5879	}
5880
5881	*hashlen = hashleni;
5882
5883	ret = 1;
5884	err:
5885	EVP_MD_CTX_free(ctx);
5886	return ret;
5887	}
5888
5889	int SSL_session_reused(const SSL *s)
5890	{
5891	const SSL_CONNECTION *sc = SSL_CONNECTION_FROM_CONST_SSL(s);
5892
5893	if (sc == NULL)
5894	return 0;
5895
5896	return sc->hit;
5897	}
5898
5899	int SSL_is_server(const SSL *s)
5900	{
5901	const SSL_CONNECTION *sc = SSL_CONNECTION_FROM_CONST_SSL(s);
5902
5903	if (sc == NULL)
5904	return 0;
5905
5906	return sc->server;
5907	}
5908
5909	#ifndef OPENSSL_NO_DEPRECATED_1_1_0
5910	void SSL_set_debug(SSL *s, int debug)
5911	{
5912	/* Old function was do-nothing anyway... */
5913	(void)s;
5914	(void)debug;
5915	}
5916	#endif
5917
5918	void SSL_set_security_level(SSL *s, int level)
5919	{
5920	SSL_CONNECTION *sc = SSL_CONNECTION_FROM_SSL(s);
5921
5922	if (sc == NULL)
5923	return;
5924
5925	sc->cert->sec_level = level;
5926	}
5927
5928	int SSL_get_security_level(const SSL *s)
5929	{
5930	const SSL_CONNECTION *sc = SSL_CONNECTION_FROM_CONST_SSL(s);
5931
5932	if (sc == NULL)
5933	return 0;
5934
5935	return sc->cert->sec_level;
5936	}
5937
5938	void SSL_set_security_callback(SSL *s,
5939	int (cb) (const SSL s, const SSL_CTX *ctx,
5940	int op, int bits, int nid,
5941	void other, void ex))
5942	{
5943	SSL_CONNECTION *sc = SSL_CONNECTION_FROM_SSL(s);
5944
5945	if (sc == NULL)
5946	return;
5947
5948	sc->cert->sec_cb = cb;
5949	}
5950
5951	int (SSL_get_security_callback(const SSL s)) (const SSL *s,
5952	const SSL_CTX *ctx, int op,
5953	int bits, int nid, void *other,
5954	void *ex) {
5955	const SSL_CONNECTION *sc = SSL_CONNECTION_FROM_CONST_SSL(s);
5956
5957	if (sc == NULL)
5958	return NULL;
5959
5960	return sc->cert->sec_cb;
5961	}
5962
5963	void SSL_set0_security_ex_data(SSL s, void ex)
5964	{
5965	SSL_CONNECTION *sc = SSL_CONNECTION_FROM_SSL(s);
5966
5967	if (sc == NULL)
5968	return;
5969
5970	sc->cert->sec_ex = ex;
5971	}
5972
5973	void SSL_get0_security_ex_data(const SSL s)
5974	{
5975	const SSL_CONNECTION *sc = SSL_CONNECTION_FROM_CONST_SSL(s);
5976
5977	if (sc == NULL)
5978	return NULL;
5979
5980	return sc->cert->sec_ex;
5981	}
5982
5983	void SSL_CTX_set_security_level(SSL_CTX *ctx, int level)
5984	{
5985	ctx->cert->sec_level = level;
5986	}
5987
5988	int SSL_CTX_get_security_level(const SSL_CTX *ctx)
5989	{
5990	return ctx->cert->sec_level;
5991	}
5992
5993	void SSL_CTX_set_security_callback(SSL_CTX *ctx,
5994	int (cb) (const SSL s, const SSL_CTX *ctx,
5995	int op, int bits, int nid,
5996	void other, void ex))
5997	{
5998	ctx->cert->sec_cb = cb;
5999	}
6000
6001	int (SSL_CTX_get_security_callback(const SSL_CTX ctx)) (const SSL *s,
6002	const SSL_CTX *ctx,
6003	int op, int bits,
6004	int nid,
6005	void *other,
6006	void *ex) {
6007	return ctx->cert->sec_cb;
6008	}
6009
6010	void SSL_CTX_set0_security_ex_data(SSL_CTX ctx, void ex)
6011	{
6012	ctx->cert->sec_ex = ex;
6013	}
6014
6015	void SSL_CTX_get0_security_ex_data(const SSL_CTX ctx)
6016	{
6017	return ctx->cert->sec_ex;
6018	}
6019
6020	uint64_t SSL_CTX_get_options(const SSL_CTX *ctx)
6021	{
6022	return ctx->options;
6023	}
6024
6025	uint64_t SSL_get_options(const SSL *s)
6026	{
6027	const SSL_CONNECTION *sc = SSL_CONNECTION_FROM_CONST_SSL(s);
6028
6029	#ifndef OPENSSL_NO_QUIC
6030	if (IS_QUIC(s))
6031	return ossl_quic_get_options(s);
6032	#endif
6033
6034	if (sc == NULL)
6035	return 0;
6036
6037	return sc->options;
6038	}
6039
6040	uint64_t SSL_CTX_set_options(SSL_CTX *ctx, uint64_t op)
6041	{
6042	return ctx->options \|= op;
6043	}
6044
6045	uint64_t SSL_set_options(SSL *s, uint64_t op)
6046	{
6047	SSL_CONNECTION *sc;
6048	OSSL_PARAM options[2], *opts = options;
6049
6050	#ifndef OPENSSL_NO_QUIC
6051	if (IS_QUIC(s))
6052	return ossl_quic_set_options(s, op);
6053	#endif
6054
6055	sc = SSL_CONNECTION_FROM_SSL(s);
6056	if (sc == NULL)
6057	return 0;
6058
6059	sc->options \|= op;
6060
6061	*opts++ = OSSL_PARAM_construct_uint64(OSSL_LIBSSL_RECORD_LAYER_PARAM_OPTIONS,
6062	&sc->options);
6063	*opts = OSSL_PARAM_construct_end();
6064
6065	/* Ignore return value */
6066	sc->rlayer.rrlmethod->set_options(sc->rlayer.rrl, options);
6067	sc->rlayer.wrlmethod->set_options(sc->rlayer.wrl, options);
6068
6069	return sc->options;
6070	}
6071
6072	uint64_t SSL_CTX_clear_options(SSL_CTX *ctx, uint64_t op)
6073	{
6074	return ctx->options &= ~op;
6075	}
6076
6077	uint64_t SSL_clear_options(SSL *s, uint64_t op)
6078	{
6079	SSL_CONNECTION *sc = SSL_CONNECTION_FROM_SSL(s);
6080	OSSL_PARAM options[2], *opts = options;
6081
6082	#ifndef OPENSSL_NO_QUIC
6083	if (IS_QUIC(s))
6084	return ossl_quic_clear_options(s, op);
6085	#endif
6086
6087	if (sc == NULL)
6088	return 0;
6089
6090	sc->options &= ~op;
6091
6092	*opts++ = OSSL_PARAM_construct_uint64(OSSL_LIBSSL_RECORD_LAYER_PARAM_OPTIONS,
6093	&sc->options);
6094	*opts = OSSL_PARAM_construct_end();
6095
6096	/* Ignore return value */
6097	sc->rlayer.rrlmethod->set_options(sc->rlayer.rrl, options);
6098	sc->rlayer.wrlmethod->set_options(sc->rlayer.wrl, options);
6099
6100	return sc->options;
6101	}
6102
6103	STACK_OF(X509) SSL_get0_verified_chain(const SSL s)
6104	{
6105	const SSL_CONNECTION *sc = SSL_CONNECTION_FROM_CONST_SSL(s);
6106
6107	if (sc == NULL)
6108	return NULL;
6109
6110	return sc->verified_chain;
6111	}
6112
6113	IMPLEMENT_OBJ_BSEARCH_GLOBAL_CMP_FN(SSL_CIPHER, SSL_CIPHER, ssl_cipher_id);
6114
6115	#ifndef OPENSSL_NO_CT
6116
6117	/*
6118	* Moves SCTs from the \|src\| stack to the \|dst\| stack.
6119	* The source of each SCT will be set to \|origin\|.
6120	* If \|dst\| points to a NULL pointer, a new stack will be created and owned by
6121	* the caller.
6122	* Returns the number of SCTs moved, or a negative integer if an error occurs.
6123	* The \|dst\| stack is created and possibly partially populated even in case
6124	* of error, likewise the \|src\| stack may be left in an intermediate state.
6125	*/
6126	static int ct_move_scts(STACK_OF(SCT) *dst, STACK_OF(SCT) src,
6127	sct_source_t origin)
6128	{
6129	int scts_moved = 0;
6130	SCT *sct = NULL;
6131
6132	if (*dst == NULL) {
6133	*dst = sk_SCT_new_null();
6134	if (*dst == NULL) {
6135	ERR_raise(ERR_LIB_SSL, ERR_R_CRYPTO_LIB);
6136	goto err;
6137	}
6138	}
6139
6140	while ((sct = sk_SCT_pop(src)) != NULL) {
6141	if (SCT_set_source(sct, origin) != 1)
6142	goto err;
6143
6144	if (!sk_SCT_push(*dst, sct))
6145	goto err;
6146	scts_moved += 1;
6147	}
6148
6149	return scts_moved;
6150	err:
6151	SCT_free(sct);
6152	return -1;
6153	}
6154
6155	/*
6156	* Look for data collected during ServerHello and parse if found.
6157	* Returns the number of SCTs extracted.
6158	*/
6159	static int ct_extract_tls_extension_scts(SSL_CONNECTION *s)
6160	{
6161	int scts_extracted = 0;
6162
6163	if (s->ext.scts != NULL) {
6164	const unsigned char *p = s->ext.scts;
6165	STACK_OF(SCT) *scts = o2i_SCT_LIST(NULL, &p, s->ext.scts_len);
6166
6167	scts_extracted = ct_move_scts(&s->scts, scts, SCT_SOURCE_TLS_EXTENSION);
6168
6169	SCT_LIST_free(scts);
6170	}
6171
6172	return scts_extracted;
6173	}
6174
6175	/*
6176	* Checks for an OCSP response and then attempts to extract any SCTs found if it
6177	* contains an SCT X509 extension. They will be stored in \|s->scts\|.
6178	* Returns:
6179	* - The number of SCTs extracted, assuming an OCSP response exists.
6180	* - 0 if no OCSP response exists or it contains no SCTs.
6181	* - A negative integer if an error occurs.
6182	*/
6183	static int ct_extract_ocsp_response_scts(SSL_CONNECTION *s)
6184	{
6185	# ifndef OPENSSL_NO_OCSP
6186	int scts_extracted = 0;
6187	const unsigned char *p;
6188	OCSP_BASICRESP *br = NULL;
6189	OCSP_RESPONSE *rsp = NULL;
6190	STACK_OF(SCT) *scts = NULL;
6191	int i;
6192
6193	if (s->ext.ocsp.resp == NULL \|\| s->ext.ocsp.resp_len == 0)
6194	goto err;
6195
6196	p = s->ext.ocsp.resp;
6197	rsp = d2i_OCSP_RESPONSE(NULL, &p, (int)s->ext.ocsp.resp_len);
6198	if (rsp == NULL)
6199	goto err;
6200
6201	br = OCSP_response_get1_basic(rsp);
6202	if (br == NULL)
6203	goto err;
6204
6205	for (i = 0; i < OCSP_resp_count(br); ++i) {
6206	OCSP_SINGLERESP *single = OCSP_resp_get0(br, i);
6207
6208	if (single == NULL)
6209	continue;
6210
6211	scts =
6212	OCSP_SINGLERESP_get1_ext_d2i(single, NID_ct_cert_scts, NULL, NULL);
6213	scts_extracted =
6214	ct_move_scts(&s->scts, scts, SCT_SOURCE_OCSP_STAPLED_RESPONSE);
6215	if (scts_extracted < 0)
6216	goto err;
6217	}
6218	err:
6219	SCT_LIST_free(scts);
6220	OCSP_BASICRESP_free(br);
6221	OCSP_RESPONSE_free(rsp);
6222	return scts_extracted;
6223	# else
6224	/* Behave as if no OCSP response exists */
6225	return 0;
6226	# endif
6227	}
6228
6229	/*
6230	* Attempts to extract SCTs from the peer certificate.
6231	* Return the number of SCTs extracted, or a negative integer if an error
6232	* occurs.
6233	*/
6234	static int ct_extract_x509v3_extension_scts(SSL_CONNECTION *s)
6235	{
6236	int scts_extracted = 0;
6237	X509 *cert = s->session != NULL ? s->session->peer : NULL;
6238
6239	if (cert != NULL) {
6240	STACK_OF(SCT) *scts =
6241	X509_get_ext_d2i(cert, NID_ct_precert_scts, NULL, NULL);
6242
6243	scts_extracted =
6244	ct_move_scts(&s->scts, scts, SCT_SOURCE_X509V3_EXTENSION);
6245
6246	SCT_LIST_free(scts);
6247	}
6248
6249	return scts_extracted;
6250	}
6251
6252	/*
6253	* Attempts to find all received SCTs by checking TLS extensions, the OCSP
6254	* response (if it exists) and X509v3 extensions in the certificate.
6255	* Returns NULL if an error occurs.
6256	*/
6257	const STACK_OF(SCT) SSL_get0_peer_scts(SSL s)
6258	{
6259	SSL_CONNECTION *sc = SSL_CONNECTION_FROM_SSL(s);
6260
6261	if (sc == NULL)
6262	return NULL;
6263
6264	if (!sc->scts_parsed) {
6265	if (ct_extract_tls_extension_scts(sc) < 0 \|\|
6266	ct_extract_ocsp_response_scts(sc) < 0 \|\|
6267	ct_extract_x509v3_extension_scts(sc) < 0)
6268	goto err;
6269
6270	sc->scts_parsed = 1;
6271	}
6272	return sc->scts;
6273	err:
6274	return NULL;
6275	}
6276
6277	static int ct_permissive(const CT_POLICY_EVAL_CTX *ctx,
6278	const STACK_OF(SCT) scts, void unused_arg)
6279	{
6280	return 1;
6281	}
6282
6283	static int ct_strict(const CT_POLICY_EVAL_CTX *ctx,
6284	const STACK_OF(SCT) scts, void unused_arg)
6285	{
6286	int count = scts != NULL ? sk_SCT_num(scts) : 0;
6287	int i;
6288
6289	for (i = 0; i < count; ++i) {
6290	SCT *sct = sk_SCT_value(scts, i);
6291	int status = SCT_get_validation_status(sct);
6292
6293	if (status == SCT_VALIDATION_STATUS_VALID)
6294	return 1;
6295	}
6296	ERR_raise(ERR_LIB_SSL, SSL_R_NO_VALID_SCTS);
6297	return 0;
6298	}
6299
6300	int SSL_set_ct_validation_callback(SSL *s, ssl_ct_validation_cb callback,
6301	void *arg)
6302	{
6303	SSL_CONNECTION *sc = SSL_CONNECTION_FROM_SSL(s);
6304
6305	if (sc == NULL)
6306	return 0;
6307
6308	/*
6309	* Since code exists that uses the custom extension handler for CT, look
6310	* for this and throw an error if they have already registered to use CT.
6311	*/
6312	if (callback != NULL && SSL_CTX_has_client_custom_ext(s->ctx,
6313	TLSEXT_TYPE_signed_certificate_timestamp))
6314	{
6315	ERR_raise(ERR_LIB_SSL, SSL_R_CUSTOM_EXT_HANDLER_ALREADY_INSTALLED);
6316	return 0;
6317	}
6318
6319	if (callback != NULL) {
6320	/*
6321	* If we are validating CT, then we MUST accept SCTs served via OCSP
6322	*/
6323	if (!SSL_set_tlsext_status_type(s, TLSEXT_STATUSTYPE_ocsp))
6324	return 0;
6325	}
6326
6327	sc->ct_validation_callback = callback;
6328	sc->ct_validation_callback_arg = arg;
6329
6330	return 1;
6331	}
6332
6333	int SSL_CTX_set_ct_validation_callback(SSL_CTX *ctx,
6334	ssl_ct_validation_cb callback, void *arg)
6335	{
6336	/*
6337	* Since code exists that uses the custom extension handler for CT, look for
6338	* this and throw an error if they have already registered to use CT.
6339	*/
6340	if (callback != NULL && SSL_CTX_has_client_custom_ext(ctx,
6341	TLSEXT_TYPE_signed_certificate_timestamp))
6342	{
6343	ERR_raise(ERR_LIB_SSL, SSL_R_CUSTOM_EXT_HANDLER_ALREADY_INSTALLED);
6344	return 0;
6345	}
6346
6347	ctx->ct_validation_callback = callback;
6348	ctx->ct_validation_callback_arg = arg;
6349	return 1;
6350	}
6351
6352	int SSL_ct_is_enabled(const SSL *s)
6353	{
6354	const SSL_CONNECTION *sc = SSL_CONNECTION_FROM_CONST_SSL(s);
6355
6356	if (sc == NULL)
6357	return 0;
6358
6359	return sc->ct_validation_callback != NULL;
6360	}
6361
6362	int SSL_CTX_ct_is_enabled(const SSL_CTX *ctx)
6363	{
6364	return ctx->ct_validation_callback != NULL;
6365	}
6366
6367	int ssl_validate_ct(SSL_CONNECTION *s)
6368	{
6369	int ret = 0;
6370	X509 *cert = s->session != NULL ? s->session->peer : NULL;
6371	X509 *issuer;
6372	SSL_DANE *dane = &s->dane;
6373	CT_POLICY_EVAL_CTX *ctx = NULL;
6374	const STACK_OF(SCT) *scts;
6375
6376	/*
6377	* If no callback is set, the peer is anonymous, or its chain is invalid,
6378	* skip SCT validation - just return success. Applications that continue
6379	* handshakes without certificates, with unverified chains, or pinned leaf
6380	* certificates are outside the scope of the WebPKI and CT.
6381	*
6382	* The above exclusions notwithstanding the vast majority of peers will
6383	* have rather ordinary certificate chains validated by typical
6384	* applications that perform certificate verification and therefore will
6385	* process SCTs when enabled.
6386	*/
6387	if (s->ct_validation_callback == NULL \|\| cert == NULL \|\|
6388	s->verify_result != X509_V_OK \|\|
6389	s->verified_chain == NULL \|\| sk_X509_num(s->verified_chain) <= 1)
6390	return 1;
6391
6392	/*
6393	* CT not applicable for chains validated via DANE-TA(2) or DANE-EE(3)
6394	* trust-anchors. See https://tools.ietf.org/html/rfc7671#section-4.2
6395	*/
6396	if (DANETLS_ENABLED(dane) && dane->mtlsa != NULL) {
6397	switch (dane->mtlsa->usage) {
6398	case DANETLS_USAGE_DANE_TA:
6399	case DANETLS_USAGE_DANE_EE:
6400	return 1;
6401	}
6402	}
6403
6404	ctx = CT_POLICY_EVAL_CTX_new_ex(SSL_CONNECTION_GET_CTX(s)->libctx,
6405	SSL_CONNECTION_GET_CTX(s)->propq);
6406	if (ctx == NULL) {
6407	SSLfatal(s, SSL_AD_INTERNAL_ERROR, ERR_R_CT_LIB);
6408	goto end;
6409	}
6410
6411	issuer = sk_X509_value(s->verified_chain, 1);
6412	CT_POLICY_EVAL_CTX_set1_cert(ctx, cert);
6413	CT_POLICY_EVAL_CTX_set1_issuer(ctx, issuer);
6414	CT_POLICY_EVAL_CTX_set_shared_CTLOG_STORE(ctx,
6415	SSL_CONNECTION_GET_CTX(s)->ctlog_store);
6416	CT_POLICY_EVAL_CTX_set_time(
6417	ctx, (uint64_t)SSL_SESSION_get_time_ex(s->session) * 1000);
6418
6419	scts = SSL_get0_peer_scts(SSL_CONNECTION_GET_SSL(s));
6420
6421	/*
6422	* This function returns success (> 0) only when all the SCTs are valid, 0
6423	* when some are invalid, and < 0 on various internal errors (out of
6424	* memory, etc.). Having some, or even all, invalid SCTs is not sufficient
6425	* reason to abort the handshake, that decision is up to the callback.
6426	* Therefore, we error out only in the unexpected case that the return
6427	* value is negative.
6428	*
6429	* XXX: One might well argue that the return value of this function is an
6430	* unfortunate design choice. Its job is only to determine the validation
6431	* status of each of the provided SCTs. So long as it correctly separates
6432	* the wheat from the chaff it should return success. Failure in this case
6433	* ought to correspond to an inability to carry out its duties.
6434	*/
6435	if (SCT_LIST_validate(scts, ctx) < 0) {
6436	SSLfatal(s, SSL_AD_HANDSHAKE_FAILURE, SSL_R_SCT_VERIFICATION_FAILED);
6437	goto end;
6438	}
6439
6440	ret = s->ct_validation_callback(ctx, scts, s->ct_validation_callback_arg);
6441	if (ret < 0)
6442	ret = 0; /* This function returns 0 on failure */
6443	if (!ret)
6444	SSLfatal(s, SSL_AD_HANDSHAKE_FAILURE, SSL_R_CALLBACK_FAILED);
6445
6446	end:
6447	CT_POLICY_EVAL_CTX_free(ctx);
6448	/*
6449	* With SSL_VERIFY_NONE the session may be cached and reused despite a
6450	* failure return code here. Also the application may wish the complete
6451	* the handshake, and then disconnect cleanly at a higher layer, after
6452	* checking the verification status of the completed connection.
6453	*
6454	* We therefore force a certificate verification failure which will be
6455	* visible via SSL_get_verify_result() and cached as part of any resumed
6456	* session.
6457	*
6458	* Note: the permissive callback is for information gathering only, always
6459	* returns success, and does not affect verification status. Only the
6460	* strict callback or a custom application-specified callback can trigger
6461	* connection failure or record a verification error.
6462	*/
6463	if (ret <= 0)
6464	s->verify_result = X509_V_ERR_NO_VALID_SCTS;
6465	return ret;
6466	}
6467
6468	int SSL_CTX_enable_ct(SSL_CTX *ctx, int validation_mode)
6469	{
6470	switch (validation_mode) {
6471	default:
6472	ERR_raise(ERR_LIB_SSL, SSL_R_INVALID_CT_VALIDATION_TYPE);
6473	return 0;
6474	case SSL_CT_VALIDATION_PERMISSIVE:
6475	return SSL_CTX_set_ct_validation_callback(ctx, ct_permissive, NULL);
6476	case SSL_CT_VALIDATION_STRICT:
6477	return SSL_CTX_set_ct_validation_callback(ctx, ct_strict, NULL);
6478	}
6479	}
6480
6481	int SSL_enable_ct(SSL *s, int validation_mode)
6482	{
6483	switch (validation_mode) {
6484	default:
6485	ERR_raise(ERR_LIB_SSL, SSL_R_INVALID_CT_VALIDATION_TYPE);
6486	return 0;
6487	case SSL_CT_VALIDATION_PERMISSIVE:
6488	return SSL_set_ct_validation_callback(s, ct_permissive, NULL);
6489	case SSL_CT_VALIDATION_STRICT:
6490	return SSL_set_ct_validation_callback(s, ct_strict, NULL);
6491	}
6492	}
6493
6494	int SSL_CTX_set_default_ctlog_list_file(SSL_CTX *ctx)
6495	{
6496	return CTLOG_STORE_load_default_file(ctx->ctlog_store);
6497	}
6498
6499	int SSL_CTX_set_ctlog_list_file(SSL_CTX ctx, const char path)
6500	{
6501	return CTLOG_STORE_load_file(ctx->ctlog_store, path);
6502	}
6503
6504	void SSL_CTX_set0_ctlog_store(SSL_CTX ctx, CTLOG_STORE logs)
6505	{
6506	CTLOG_STORE_free(ctx->ctlog_store);
6507	ctx->ctlog_store = logs;
6508	}
6509
6510	const CTLOG_STORE SSL_CTX_get0_ctlog_store(const SSL_CTX ctx)
6511	{
6512	return ctx->ctlog_store;
6513	}
6514
6515	#endif /* OPENSSL_NO_CT */
6516
6517	void SSL_CTX_set_client_hello_cb(SSL_CTX *c, SSL_client_hello_cb_fn cb,
6518	void *arg)
6519	{
6520	c->client_hello_cb = cb;
6521	c->client_hello_cb_arg = arg;
6522	}
6523
6524	int SSL_client_hello_isv2(SSL *s)
6525	{
6526	const SSL_CONNECTION *sc = SSL_CONNECTION_FROM_SSL(s);
6527
6528	if (sc == NULL)
6529	return 0;
6530
6531	if (sc->clienthello == NULL)
6532	return 0;
6533	return sc->clienthello->isv2;
6534	}
6535
6536	unsigned int SSL_client_hello_get0_legacy_version(SSL *s)
6537	{
6538	const SSL_CONNECTION *sc = SSL_CONNECTION_FROM_SSL(s);
6539
6540	if (sc == NULL)
6541	return 0;
6542
6543	if (sc->clienthello == NULL)
6544	return 0;
6545	return sc->clienthello->legacy_version;
6546	}
6547
6548	size_t SSL_client_hello_get0_random(SSL s, const unsigned char *out)
6549	{
6550	const SSL_CONNECTION *sc = SSL_CONNECTION_FROM_SSL(s);
6551
6552	if (sc == NULL)
6553	return 0;
6554
6555	if (sc->clienthello == NULL)
6556	return 0;
6557	if (out != NULL)
6558	*out = sc->clienthello->random;
6559	return SSL3_RANDOM_SIZE;
6560	}
6561
6562	size_t SSL_client_hello_get0_session_id(SSL s, const unsigned char *out)
6563	{
6564	const SSL_CONNECTION *sc = SSL_CONNECTION_FROM_SSL(s);
6565
6566	if (sc == NULL)
6567	return 0;
6568
6569	if (sc->clienthello == NULL)
6570	return 0;
6571	if (out != NULL)
6572	*out = sc->clienthello->session_id;
6573	return sc->clienthello->session_id_len;
6574	}
6575
6576	size_t SSL_client_hello_get0_ciphers(SSL s, const unsigned char *out)
6577	{
6578	const SSL_CONNECTION *sc = SSL_CONNECTION_FROM_SSL(s);
6579
6580	if (sc == NULL)
6581	return 0;
6582
6583	if (sc->clienthello == NULL)
6584	return 0;
6585	if (out != NULL)
6586	*out = PACKET_data(&sc->clienthello->ciphersuites);
6587	return PACKET_remaining(&sc->clienthello->ciphersuites);
6588	}
6589
6590	size_t SSL_client_hello_get0_compression_methods(SSL s, const unsigned char *out)
6591	{
6592	const SSL_CONNECTION *sc = SSL_CONNECTION_FROM_SSL(s);
6593
6594	if (sc == NULL)
6595	return 0;
6596
6597	if (sc->clienthello == NULL)
6598	return 0;
6599	if (out != NULL)
6600	*out = sc->clienthello->compressions;
6601	return sc->clienthello->compressions_len;
6602	}
6603
6604	int SSL_client_hello_get1_extensions_present(SSL s, int out, size_t outlen)
6605	{
6606	RAW_EXTENSION *ext;
6607	int *present;
6608	size_t num = 0, i;
6609	const SSL_CONNECTION *sc = SSL_CONNECTION_FROM_SSL(s);
6610
6611	if (sc == NULL)
6612	return 0;
6613
6614	if (sc->clienthello == NULL \|\| out == NULL \|\| outlen == NULL)
6615	return 0;
6616	for (i = 0; i < sc->clienthello->pre_proc_exts_len; i++) {
6617	ext = sc->clienthello->pre_proc_exts + i;
6618	if (ext->present)
6619	num++;
6620	}
6621	if (num == 0) {
6622	*out = NULL;
6623	*outlen = 0;
6624	return 1;
6625	}
6626	if ((present = OPENSSL_malloc(sizeof(present) num)) == NULL)
6627	return 0;
6628	for (i = 0; i < sc->clienthello->pre_proc_exts_len; i++) {
6629	ext = sc->clienthello->pre_proc_exts + i;
6630	if (ext->present) {
6631	if (ext->received_order >= num)
6632	goto err;
6633	present[ext->received_order] = ext->type;
6634	}
6635	}
6636	*out = present;
6637	*outlen = num;
6638	return 1;
6639	err:
6640	OPENSSL_free(present);
6641	return 0;
6642	}
6643
6644	int SSL_client_hello_get_extension_order(SSL s, uint16_t exts, size_t *num_exts)
6645	{
6646	RAW_EXTENSION *ext;
6647	size_t num = 0, i;
6648	const SSL_CONNECTION *sc = SSL_CONNECTION_FROM_SSL(s);
6649
6650	if (sc == NULL)
6651	return 0;
6652
6653	if (sc->clienthello == NULL \|\| num_exts == NULL)
6654	return 0;
6655	for (i = 0; i < sc->clienthello->pre_proc_exts_len; i++) {
6656	ext = sc->clienthello->pre_proc_exts + i;
6657	if (ext->present)
6658	num++;
6659	}
6660	if (num == 0) {
6661	*num_exts = 0;
6662	return 1;
6663	}
6664	if (exts == NULL) {
6665	*num_exts = num;
6666	return 1;
6667	}
6668	if (*num_exts < num)
6669	return 0;
6670	for (i = 0; i < sc->clienthello->pre_proc_exts_len; i++) {
6671	ext = sc->clienthello->pre_proc_exts + i;
6672	if (ext->present) {
6673	if (ext->received_order >= num)
6674	return 0;
6675	exts[ext->received_order] = ext->type;
6676	}
6677	}
6678	*num_exts = num;
6679	return 1;
6680	}
6681
6682	int SSL_client_hello_get0_ext(SSL s, unsigned int type, const unsigned char *out,
6683	size_t *outlen)
6684	{
6685	size_t i;
6686	RAW_EXTENSION *r;
6687	const SSL_CONNECTION *sc = SSL_CONNECTION_FROM_SSL(s);
6688
6689	if (sc == NULL)
6690	return 0;
6691
6692	if (sc->clienthello == NULL)
6693	return 0;
6694	for (i = 0; i < sc->clienthello->pre_proc_exts_len; ++i) {
6695	r = sc->clienthello->pre_proc_exts + i;
6696	if (r->present && r->type == type) {
6697	if (out != NULL)
6698	*out = PACKET_data(&r->data);
6699	if (outlen != NULL)
6700	*outlen = PACKET_remaining(&r->data);
6701	return 1;
6702	}
6703	}
6704	return 0;
6705	}
6706
6707	int SSL_free_buffers(SSL *ssl)
6708	{
6709	RECORD_LAYER *rl;
6710	SSL_CONNECTION *sc = SSL_CONNECTION_FROM_SSL_ONLY(ssl);
6711
6712	if (sc == NULL)
6713	return 0;
6714
6715	rl = &sc->rlayer;
6716
6717	return rl->rrlmethod->free_buffers(rl->rrl)
6718	&& rl->wrlmethod->free_buffers(rl->wrl);
6719	}
6720
6721	int SSL_alloc_buffers(SSL *ssl)
6722	{
6723	RECORD_LAYER *rl;
6724	SSL_CONNECTION *sc = SSL_CONNECTION_FROM_SSL(ssl);
6725
6726	if (sc == NULL)
6727	return 0;
6728
6729	/* QUIC always has buffers allocated. */
6730	if (IS_QUIC(ssl))
6731	return 1;
6732
6733	rl = &sc->rlayer;
6734
6735	return rl->rrlmethod->alloc_buffers(rl->rrl)
6736	&& rl->wrlmethod->alloc_buffers(rl->wrl);
6737	}
6738
6739	void SSL_CTX_set_keylog_callback(SSL_CTX *ctx, SSL_CTX_keylog_cb_func cb)
6740	{
6741	ctx->keylog_callback = cb;
6742	}
6743
6744	SSL_CTX_keylog_cb_func SSL_CTX_get_keylog_callback(const SSL_CTX *ctx)
6745	{
6746	return ctx->keylog_callback;
6747	}
6748
6749	static int nss_keylog_int(const char *prefix,
6750	SSL_CONNECTION *sc,
6751	const uint8_t *parameter_1,
6752	size_t parameter_1_len,
6753	const uint8_t *parameter_2,
6754	size_t parameter_2_len)
6755	{
6756	char *out = NULL;
6757	char *cursor = NULL;
6758	size_t out_len = 0, i, prefix_len;
6759	SSL_CTX *sctx = SSL_CONNECTION_GET_CTX(sc);
6760
6761	if (sctx->keylog_callback == NULL)
6762	return 1;
6763
6764	/*
6765	* Our output buffer will contain the following strings, rendered with
6766	* space characters in between, terminated by a NULL character: first the
6767	* prefix, then the first parameter, then the second parameter. The
6768	* meaning of each parameter depends on the specific key material being
6769	* logged. Note that the first and second parameters are encoded in
6770	* hexadecimal, so we need a buffer that is twice their lengths.
6771	*/
6772	prefix_len = strlen(prefix);
6773	out_len = prefix_len + (2 * parameter_1_len) + (2 * parameter_2_len) + 3;
6774	if ((out = cursor = OPENSSL_malloc(out_len)) == NULL)
6775	return 0;
6776
6777	memcpy(cursor, prefix, prefix_len);
6778	cursor += prefix_len;
6779	*cursor++ = ' ';
6780
6781	for (i = 0; i < parameter_1_len; ++i)
6782	cursor += ossl_to_lowerhex(cursor, parameter_1[i]);
6783	*cursor++ = ' ';
6784
6785	for (i = 0; i < parameter_2_len; ++i)
6786	cursor += ossl_to_lowerhex(cursor, parameter_2[i]);
6787	*cursor = '\0';
6788
6789	sctx->keylog_callback(SSL_CONNECTION_GET_USER_SSL(sc), (const char *)out);
6790	OPENSSL_clear_free(out, out_len);
6791	return 1;
6792	}
6793
6794	int ssl_log_rsa_client_key_exchange(SSL_CONNECTION *sc,
6795	const uint8_t *encrypted_premaster,
6796	size_t encrypted_premaster_len,
6797	const uint8_t *premaster,
6798	size_t premaster_len)
6799	{
6800	if (encrypted_premaster_len < 8) {
6801	SSLfatal(sc, SSL_AD_INTERNAL_ERROR, ERR_R_INTERNAL_ERROR);
6802	return 0;
6803	}
6804
6805	/* We only want the first 8 bytes of the encrypted premaster as a tag. */
6806	return nss_keylog_int("RSA",
6807	sc,
6808	encrypted_premaster,
6809	8,
6810	premaster,
6811	premaster_len);
6812	}
6813
6814	int ssl_log_secret(SSL_CONNECTION *sc,
6815	const char *label,
6816	const uint8_t *secret,
6817	size_t secret_len)
6818	{
6819	return nss_keylog_int(label,
6820	sc,
6821	sc->s3.client_random,
6822	SSL3_RANDOM_SIZE,
6823	secret,
6824	secret_len);
6825	}
6826
6827	#define SSLV2_CIPHER_LEN 3
6828
6829	int ssl_cache_cipherlist(SSL_CONNECTION s, PACKET cipher_suites, int sslv2format)
6830	{
6831	int n;
6832
6833	n = sslv2format ? SSLV2_CIPHER_LEN : TLS_CIPHER_LEN;
6834
6835	if (PACKET_remaining(cipher_suites) == 0) {
6836	SSLfatal(s, SSL_AD_ILLEGAL_PARAMETER, SSL_R_NO_CIPHERS_SPECIFIED);
6837	return 0;
6838	}
6839
6840	if (PACKET_remaining(cipher_suites) % n != 0) {
6841	SSLfatal(s, SSL_AD_DECODE_ERROR, SSL_R_ERROR_IN_RECEIVED_CIPHER_LIST);
6842	return 0;
6843	}
6844
6845	OPENSSL_free(s->s3.tmp.ciphers_raw);
6846	s->s3.tmp.ciphers_raw = NULL;
6847	s->s3.tmp.ciphers_rawlen = 0;
6848
6849	if (sslv2format) {
6850	size_t numciphers = PACKET_remaining(cipher_suites) / n;
6851	PACKET sslv2ciphers = *cipher_suites;
6852	unsigned int leadbyte;
6853	unsigned char *raw;
6854
6855	/*
6856	* We store the raw ciphers list in SSLv3+ format so we need to do some
6857	* preprocessing to convert the list first. If there are any SSLv2 only
6858	* ciphersuites with a non-zero leading byte then we are going to
6859	* slightly over allocate because we won't store those. But that isn't a
6860	* problem.
6861	*/
6862	raw = OPENSSL_malloc(numciphers * TLS_CIPHER_LEN);
6863	s->s3.tmp.ciphers_raw = raw;
6864	if (raw == NULL) {
6865	SSLfatal(s, SSL_AD_INTERNAL_ERROR, ERR_R_CRYPTO_LIB);
6866	return 0;
6867	}
6868	for (s->s3.tmp.ciphers_rawlen = 0;
6869	PACKET_remaining(&sslv2ciphers) > 0;
6870	raw += TLS_CIPHER_LEN) {
6871	if (!PACKET_get_1(&sslv2ciphers, &leadbyte)
6872	\|\| (leadbyte == 0
6873	&& !PACKET_copy_bytes(&sslv2ciphers, raw,
6874	TLS_CIPHER_LEN))
6875	\|\| (leadbyte != 0
6876	&& !PACKET_forward(&sslv2ciphers, TLS_CIPHER_LEN))) {
6877	SSLfatal(s, SSL_AD_DECODE_ERROR, SSL_R_BAD_PACKET);
6878	OPENSSL_free(s->s3.tmp.ciphers_raw);
6879	s->s3.tmp.ciphers_raw = NULL;
6880	s->s3.tmp.ciphers_rawlen = 0;
6881	return 0;
6882	}
6883	if (leadbyte == 0)
6884	s->s3.tmp.ciphers_rawlen += TLS_CIPHER_LEN;
6885	}
6886	} else if (!PACKET_memdup(cipher_suites, &s->s3.tmp.ciphers_raw,
6887	&s->s3.tmp.ciphers_rawlen)) {
6888	SSLfatal(s, SSL_AD_INTERNAL_ERROR, ERR_R_INTERNAL_ERROR);
6889	return 0;
6890	}
6891	return 1;
6892	}
6893
6894	int SSL_bytes_to_cipher_list(SSL s, const unsigned char bytes, size_t len,
6895	int isv2format, STACK_OF(SSL_CIPHER) **sk,
6896	STACK_OF(SSL_CIPHER) **scsvs)
6897	{
6898	PACKET pkt;
6899	SSL_CONNECTION *sc = SSL_CONNECTION_FROM_SSL(s);
6900
6901	if (sc == NULL)
6902	return 0;
6903
6904	if (!PACKET_buf_init(&pkt, bytes, len))
6905	return 0;
6906	return ossl_bytes_to_cipher_list(sc, &pkt, sk, scsvs, isv2format, 0);
6907	}
6908
6909	int ossl_bytes_to_cipher_list(SSL_CONNECTION s, PACKET cipher_suites,
6910	STACK_OF(SSL_CIPHER) **skp,
6911	STACK_OF(SSL_CIPHER) **scsvs_out,
6912	int sslv2format, int fatal)
6913	{
6914	const SSL_CIPHER *c;
6915	STACK_OF(SSL_CIPHER) *sk = NULL;
6916	STACK_OF(SSL_CIPHER) *scsvs = NULL;
6917	int n;
6918	/* 3 = SSLV2_CIPHER_LEN > TLS_CIPHER_LEN = 2. */
6919	unsigned char cipher[SSLV2_CIPHER_LEN];
6920
6921	n = sslv2format ? SSLV2_CIPHER_LEN : TLS_CIPHER_LEN;
6922
6923	if (PACKET_remaining(cipher_suites) == 0) {
6924	if (fatal)
6925	SSLfatal(s, SSL_AD_ILLEGAL_PARAMETER, SSL_R_NO_CIPHERS_SPECIFIED);
6926	else
6927	ERR_raise(ERR_LIB_SSL, SSL_R_NO_CIPHERS_SPECIFIED);
6928	return 0;
6929	}
6930
6931	if (PACKET_remaining(cipher_suites) % n != 0) {
6932	if (fatal)
6933	SSLfatal(s, SSL_AD_DECODE_ERROR,
6934	SSL_R_ERROR_IN_RECEIVED_CIPHER_LIST);
6935	else
6936	ERR_raise(ERR_LIB_SSL, SSL_R_ERROR_IN_RECEIVED_CIPHER_LIST);
6937	return 0;
6938	}
6939
6940	sk = sk_SSL_CIPHER_new_null();
6941	scsvs = sk_SSL_CIPHER_new_null();
6942	if (sk == NULL \|\| scsvs == NULL) {
6943	if (fatal)
6944	SSLfatal(s, SSL_AD_INTERNAL_ERROR, ERR_R_CRYPTO_LIB);
6945	else
6946	ERR_raise(ERR_LIB_SSL, ERR_R_CRYPTO_LIB);
6947	goto err;
6948	}
6949
6950	while (PACKET_copy_bytes(cipher_suites, cipher, n)) {
6951	/*
6952	* SSLv3 ciphers wrapped in an SSLv2-compatible ClientHello have the
6953	* first byte set to zero, while true SSLv2 ciphers have a non-zero
6954	* first byte. We don't support any true SSLv2 ciphers, so skip them.
6955	*/
6956	if (sslv2format && cipher[0] != '\0')
6957	continue;
6958
6959	/* For SSLv2-compat, ignore leading 0-byte. */
6960	c = ssl_get_cipher_by_char(s, sslv2format ? &cipher[1] : cipher, 1);
6961	if (c != NULL) {
6962	if ((c->valid && !sk_SSL_CIPHER_push(sk, c)) \|\|
6963	(!c->valid && !sk_SSL_CIPHER_push(scsvs, c))) {
6964	if (fatal)
6965	SSLfatal(s, SSL_AD_INTERNAL_ERROR, ERR_R_CRYPTO_LIB);
6966	else
6967	ERR_raise(ERR_LIB_SSL, ERR_R_CRYPTO_LIB);
6968	goto err;
6969	}
6970	}
6971	}
6972	if (PACKET_remaining(cipher_suites) > 0) {
6973	if (fatal)
6974	SSLfatal(s, SSL_AD_DECODE_ERROR, SSL_R_BAD_LENGTH);
6975	else
6976	ERR_raise(ERR_LIB_SSL, SSL_R_BAD_LENGTH);
6977	goto err;
6978	}
6979
6980	if (skp != NULL)
6981	*skp = sk;
6982	else
6983	sk_SSL_CIPHER_free(sk);
6984	if (scsvs_out != NULL)
6985	*scsvs_out = scsvs;
6986	else
6987	sk_SSL_CIPHER_free(scsvs);
6988	return 1;
6989	err:
6990	sk_SSL_CIPHER_free(sk);
6991	sk_SSL_CIPHER_free(scsvs);
6992	return 0;
6993	}
6994
6995	int SSL_CTX_set_max_early_data(SSL_CTX *ctx, uint32_t max_early_data)
6996	{
6997	ctx->max_early_data = max_early_data;
6998
6999	return 1;
7000	}
7001
7002	uint32_t SSL_CTX_get_max_early_data(const SSL_CTX *ctx)
7003	{
7004	return ctx->max_early_data;
7005	}
7006
7007	int SSL_set_max_early_data(SSL *s, uint32_t max_early_data)
7008	{
7009	SSL_CONNECTION *sc = SSL_CONNECTION_FROM_SSL_ONLY(s);
7010
7011	if (sc == NULL)
7012	return 0;
7013
7014	sc->max_early_data = max_early_data;
7015
7016	return 1;
7017	}
7018
7019	uint32_t SSL_get_max_early_data(const SSL *s)
7020	{
7021	const SSL_CONNECTION *sc = SSL_CONNECTION_FROM_CONST_SSL(s);
7022
7023	if (sc == NULL)
7024	return 0;
7025
7026	return sc->max_early_data;
7027	}
7028
7029	int SSL_CTX_set_recv_max_early_data(SSL_CTX *ctx, uint32_t recv_max_early_data)
7030	{
7031	ctx->recv_max_early_data = recv_max_early_data;
7032
7033	return 1;
7034	}
7035
7036	uint32_t SSL_CTX_get_recv_max_early_data(const SSL_CTX *ctx)
7037	{
7038	return ctx->recv_max_early_data;
7039	}
7040
7041	int SSL_set_recv_max_early_data(SSL *s, uint32_t recv_max_early_data)
7042	{
7043	SSL_CONNECTION *sc = SSL_CONNECTION_FROM_SSL_ONLY(s);
7044
7045	if (sc == NULL)
7046	return 0;
7047
7048	sc->recv_max_early_data = recv_max_early_data;
7049
7050	return 1;
7051	}
7052
7053	uint32_t SSL_get_recv_max_early_data(const SSL *s)
7054	{
7055	const SSL_CONNECTION *sc = SSL_CONNECTION_FROM_CONST_SSL(s);
7056
7057	if (sc == NULL)
7058	return 0;
7059
7060	return sc->recv_max_early_data;
7061	}
7062
7063	__owur unsigned int ssl_get_max_send_fragment(const SSL_CONNECTION *sc)
7064	{
7065	/* Return any active Max Fragment Len extension */
7066	if (sc->session != NULL && USE_MAX_FRAGMENT_LENGTH_EXT(sc->session))
7067	return GET_MAX_FRAGMENT_LENGTH(sc->session);
7068
7069	/* return current SSL connection setting */
7070	return sc->max_send_fragment;
7071	}
7072
7073	__owur unsigned int ssl_get_split_send_fragment(const SSL_CONNECTION *sc)
7074	{
7075	/* Return a value regarding an active Max Fragment Len extension */
7076	if (sc->session != NULL && USE_MAX_FRAGMENT_LENGTH_EXT(sc->session)
7077	&& sc->split_send_fragment > GET_MAX_FRAGMENT_LENGTH(sc->session))
7078	return GET_MAX_FRAGMENT_LENGTH(sc->session);
7079
7080	/* else limit \|split_send_fragment\| to current \|max_send_fragment\| */
7081	if (sc->split_send_fragment > sc->max_send_fragment)
7082	return sc->max_send_fragment;
7083
7084	/* return current SSL connection setting */
7085	return sc->split_send_fragment;
7086	}
7087
7088	int SSL_stateless(SSL *s)
7089	{
7090	int ret;
7091	SSL_CONNECTION *sc = SSL_CONNECTION_FROM_SSL_ONLY(s);
7092
7093	if (sc == NULL)
7094	return 0;
7095
7096	/* Ensure there is no state left over from a previous invocation */
7097	if (!SSL_clear(s))
7098	return 0;
7099
7100	ERR_clear_error();
7101
7102	sc->s3.flags \|= TLS1_FLAGS_STATELESS;
7103	ret = SSL_accept(s);
7104	sc->s3.flags &= ~TLS1_FLAGS_STATELESS;
7105
7106	if (ret > 0 && sc->ext.cookieok)
7107	return 1;
7108
7109	if (sc->hello_retry_request == SSL_HRR_PENDING && !ossl_statem_in_error(sc))
7110	return 0;
7111
7112	return -1;
7113	}
7114
7115	void SSL_CTX_set_post_handshake_auth(SSL_CTX *ctx, int val)
7116	{
7117	ctx->pha_enabled = val;
7118	}
7119
7120	void SSL_set_post_handshake_auth(SSL *ssl, int val)
7121	{
7122	SSL_CONNECTION *sc = SSL_CONNECTION_FROM_SSL_ONLY(ssl);
7123
7124	if (sc == NULL)
7125	return;
7126
7127	sc->pha_enabled = val;
7128	}
7129
7130	int SSL_verify_client_post_handshake(SSL *ssl)
7131	{
7132	SSL_CONNECTION *sc = SSL_CONNECTION_FROM_SSL(ssl);
7133
7134	#ifndef OPENSSL_NO_QUIC
7135	if (IS_QUIC(ssl)) {
7136	ERR_raise(ERR_LIB_SSL, SSL_R_WRONG_SSL_VERSION);
7137	return 0;
7138	}
7139	#endif
7140
7141	if (sc == NULL)
7142	return 0;
7143
7144	if (!SSL_CONNECTION_IS_TLS13(sc)) {
7145	ERR_raise(ERR_LIB_SSL, SSL_R_WRONG_SSL_VERSION);
7146	return 0;
7147	}
7148	if (!sc->server) {
7149	ERR_raise(ERR_LIB_SSL, SSL_R_NOT_SERVER);
7150	return 0;
7151	}
7152
7153	if (!SSL_is_init_finished(ssl)) {
7154	ERR_raise(ERR_LIB_SSL, SSL_R_STILL_IN_INIT);
7155	return 0;
7156	}
7157
7158	switch (sc->post_handshake_auth) {
7159	case SSL_PHA_NONE:
7160	ERR_raise(ERR_LIB_SSL, SSL_R_EXTENSION_NOT_RECEIVED);
7161	return 0;
7162	default:
7163	case SSL_PHA_EXT_SENT:
7164	ERR_raise(ERR_LIB_SSL, ERR_R_INTERNAL_ERROR);
7165	return 0;
7166	case SSL_PHA_EXT_RECEIVED:
7167	break;
7168	case SSL_PHA_REQUEST_PENDING:
7169	ERR_raise(ERR_LIB_SSL, SSL_R_REQUEST_PENDING);
7170	return 0;
7171	case SSL_PHA_REQUESTED:
7172	ERR_raise(ERR_LIB_SSL, SSL_R_REQUEST_SENT);
7173	return 0;
7174	}
7175
7176	sc->post_handshake_auth = SSL_PHA_REQUEST_PENDING;
7177
7178	/* checks verify_mode and algorithm_auth */
7179	if (!send_certificate_request(sc)) {
7180	sc->post_handshake_auth = SSL_PHA_EXT_RECEIVED; /* restore on error */
7181	ERR_raise(ERR_LIB_SSL, SSL_R_INVALID_CONFIG);
7182	return 0;
7183	}
7184
7185	ossl_statem_set_in_init(sc, 1);
7186	return 1;
7187	}
7188
7189	int SSL_CTX_set_session_ticket_cb(SSL_CTX *ctx,
7190	SSL_CTX_generate_session_ticket_fn gen_cb,
7191	SSL_CTX_decrypt_session_ticket_fn dec_cb,
7192	void *arg)
7193	{
7194	ctx->generate_ticket_cb = gen_cb;
7195	ctx->decrypt_ticket_cb = dec_cb;
7196	ctx->ticket_cb_data = arg;
7197	return 1;
7198	}
7199
7200	void SSL_CTX_set_allow_early_data_cb(SSL_CTX *ctx,
7201	SSL_allow_early_data_cb_fn cb,
7202	void *arg)
7203	{
7204	ctx->allow_early_data_cb = cb;
7205	ctx->allow_early_data_cb_data = arg;
7206	}
7207
7208	void SSL_set_allow_early_data_cb(SSL *s,
7209	SSL_allow_early_data_cb_fn cb,
7210	void *arg)
7211	{
7212	SSL_CONNECTION *sc = SSL_CONNECTION_FROM_SSL_ONLY(s);
7213
7214	if (sc == NULL)
7215	return;
7216
7217	sc->allow_early_data_cb = cb;
7218	sc->allow_early_data_cb_data = arg;
7219	}
7220
7221	const EVP_CIPHER ssl_evp_cipher_fetch(OSSL_LIB_CTX libctx,
7222	int nid,
7223	const char *properties)
7224	{
7225	const EVP_CIPHER *ciph;
7226
7227	ciph = tls_get_cipher_from_engine(nid);
7228	if (ciph != NULL)
7229	return ciph;
7230
7231	/*
7232	* If there is no engine cipher then we do an explicit fetch. This may fail
7233	* and that could be ok
7234	*/
7235	ERR_set_mark();
7236	ciph = EVP_CIPHER_fetch(libctx, OBJ_nid2sn(nid), properties);
7237	if (ciph != NULL) {
7238	OSSL_PARAM params[2];
7239	int decrypt_only = 0;
7240
7241	params[0] = OSSL_PARAM_construct_int(OSSL_CIPHER_PARAM_DECRYPT_ONLY,
7242	&decrypt_only);
7243	params[1] = OSSL_PARAM_construct_end();
7244	if (EVP_CIPHER_get_params((EVP_CIPHER *)ciph, params)
7245	&& decrypt_only) {
7246	/* If a cipher is decrypt-only, it is unusable */
7247	EVP_CIPHER_free((EVP_CIPHER *)ciph);
7248	ciph = NULL;
7249	}
7250	}
7251	ERR_pop_to_mark();
7252	return ciph;
7253	}
7254
7255
7256	int ssl_evp_cipher_up_ref(const EVP_CIPHER *cipher)
7257	{
7258	/* Don't up-ref an implicit EVP_CIPHER */
7259	if (EVP_CIPHER_get0_provider(cipher) == NULL)
7260	return 1;
7261
7262	/*
7263	* The cipher was explicitly fetched and therefore it is safe to cast
7264	* away the const
7265	*/
7266	return EVP_CIPHER_up_ref((EVP_CIPHER *)cipher);
7267	}
7268
7269	void ssl_evp_cipher_free(const EVP_CIPHER *cipher)
7270	{
7271	if (cipher == NULL)
7272	return;
7273
7274	if (EVP_CIPHER_get0_provider(cipher) != NULL) {
7275	/*
7276	* The cipher was explicitly fetched and therefore it is safe to cast
7277	* away the const
7278	*/
7279	EVP_CIPHER_free((EVP_CIPHER *)cipher);
7280	}
7281	}
7282
7283	const EVP_MD ssl_evp_md_fetch(OSSL_LIB_CTX libctx,
7284	int nid,
7285	const char *properties)
7286	{
7287	const EVP_MD *md;
7288
7289	md = tls_get_digest_from_engine(nid);
7290	if (md != NULL)
7291	return md;
7292
7293	/* Otherwise we do an explicit fetch */
7294	ERR_set_mark();
7295	md = EVP_MD_fetch(libctx, OBJ_nid2sn(nid), properties);
7296	ERR_pop_to_mark();
7297	return md;
7298	}
7299
7300	int ssl_evp_md_up_ref(const EVP_MD *md)
7301	{
7302	/* Don't up-ref an implicit EVP_MD */
7303	if (EVP_MD_get0_provider(md) == NULL)
7304	return 1;
7305
7306	/*
7307	* The digest was explicitly fetched and therefore it is safe to cast
7308	* away the const
7309	*/
7310	return EVP_MD_up_ref((EVP_MD *)md);
7311	}
7312
7313	void ssl_evp_md_free(const EVP_MD *md)
7314	{
7315	if (md == NULL)
7316	return;
7317
7318	if (EVP_MD_get0_provider(md) != NULL) {
7319	/*
7320	* The digest was explicitly fetched and therefore it is safe to cast
7321	* away the const
7322	*/
7323	EVP_MD_free((EVP_MD *)md);
7324	}
7325	}
7326
7327	int SSL_set0_tmp_dh_pkey(SSL s, EVP_PKEY dhpkey)
7328	{
7329	SSL_CONNECTION *sc = SSL_CONNECTION_FROM_SSL(s);
7330
7331	if (sc == NULL)
7332	return 0;
7333
7334	if (!ssl_security(sc, SSL_SECOP_TMP_DH,
7335	EVP_PKEY_get_security_bits(dhpkey), 0, dhpkey)) {
7336	ERR_raise(ERR_LIB_SSL, SSL_R_DH_KEY_TOO_SMALL);
7337	return 0;
7338	}
7339	EVP_PKEY_free(sc->cert->dh_tmp);
7340	sc->cert->dh_tmp = dhpkey;
7341	return 1;
7342	}
7343
7344	int SSL_CTX_set0_tmp_dh_pkey(SSL_CTX ctx, EVP_PKEY dhpkey)
7345	{
7346	if (!ssl_ctx_security(ctx, SSL_SECOP_TMP_DH,
7347	EVP_PKEY_get_security_bits(dhpkey), 0, dhpkey)) {
7348	ERR_raise(ERR_LIB_SSL, SSL_R_DH_KEY_TOO_SMALL);
7349	return 0;
7350	}
7351	EVP_PKEY_free(ctx->cert->dh_tmp);
7352	ctx->cert->dh_tmp = dhpkey;
7353	return 1;
7354	}
7355
7356	/* QUIC-specific methods which are supported on QUIC connections only. */
7357	int SSL_handle_events(SSL *s)
7358	{
7359	SSL_CONNECTION *sc;
7360
7361	#ifndef OPENSSL_NO_QUIC
7362	if (IS_QUIC(s))
7363	return ossl_quic_handle_events(s);
7364	#endif
7365
7366	sc = SSL_CONNECTION_FROM_SSL_ONLY(s);
7367	if (sc != NULL && SSL_CONNECTION_IS_DTLS(sc))
7368	/*
7369	* DTLSv1_handle_timeout returns 0 if the timer wasn't expired yet,
7370	* which we consider a success case. Theoretically DTLSv1_handle_timeout
7371	* can also return 0 if s is NULL or not a DTLS object, but we've
7372	* already ruled out those possibilities above, so this is not possible
7373	* here. Thus the only failure cases are where DTLSv1_handle_timeout
7374	* returns -1.
7375	*/
7376	return DTLSv1_handle_timeout(s) >= 0;
7377
7378	return 1;
7379	}
7380
7381	int SSL_get_event_timeout(SSL s, struct timeval tv, int *is_infinite)
7382	{
7383	SSL_CONNECTION *sc;
7384
7385	#ifndef OPENSSL_NO_QUIC
7386	if (IS_QUIC(s))
7387	return ossl_quic_get_event_timeout(s, tv, is_infinite);
7388	#endif
7389
7390	sc = SSL_CONNECTION_FROM_SSL_ONLY(s);
7391	if (sc != NULL && SSL_CONNECTION_IS_DTLS(sc)
7392	&& DTLSv1_get_timeout(s, tv)) {
7393	*is_infinite = 0;
7394	return 1;
7395	}
7396
7397	tv->tv_sec = 1000000;
7398	tv->tv_usec = 0;
7399	*is_infinite = 1;
7400	return 1;
7401	}
7402
7403	int SSL_get_rpoll_descriptor(SSL s, BIO_POLL_DESCRIPTOR desc)
7404	{
7405	SSL_CONNECTION *sc = SSL_CONNECTION_FROM_SSL(s);
7406
7407	#ifndef OPENSSL_NO_QUIC
7408	if (IS_QUIC(s))
7409	return ossl_quic_get_rpoll_descriptor(s, desc);
7410	#endif
7411
7412	if (sc == NULL \|\| sc->rbio == NULL)
7413	return 0;
7414
7415	return BIO_get_rpoll_descriptor(sc->rbio, desc);
7416	}
7417
7418	int SSL_get_wpoll_descriptor(SSL s, BIO_POLL_DESCRIPTOR desc)
7419	{
7420	SSL_CONNECTION *sc = SSL_CONNECTION_FROM_SSL(s);
7421
7422	#ifndef OPENSSL_NO_QUIC
7423	if (IS_QUIC(s))
7424	return ossl_quic_get_wpoll_descriptor(s, desc);
7425	#endif
7426
7427	if (sc == NULL \|\| sc->wbio == NULL)
7428	return 0;
7429
7430	return BIO_get_wpoll_descriptor(sc->wbio, desc);
7431	}
7432
7433	int SSL_net_read_desired(SSL *s)
7434	{
7435	#ifndef OPENSSL_NO_QUIC
7436	if (!IS_QUIC(s))
7437	return SSL_want_read(s);
7438
7439	return ossl_quic_get_net_read_desired(s);
7440	#else
7441	return SSL_want_read(s);
7442	#endif
7443	}
7444
7445	int SSL_net_write_desired(SSL *s)
7446	{
7447	#ifndef OPENSSL_NO_QUIC
7448	if (!IS_QUIC(s))
7449	return SSL_want_write(s);
7450
7451	return ossl_quic_get_net_write_desired(s);
7452	#else
7453	return SSL_want_write(s);
7454	#endif
7455	}
7456
7457	int SSL_set_blocking_mode(SSL *s, int blocking)
7458	{
7459	#ifndef OPENSSL_NO_QUIC
7460	if (!IS_QUIC(s))
7461	return 0;
7462
7463	return ossl_quic_conn_set_blocking_mode(s, blocking);
7464	#else
7465	return 0;
7466	#endif
7467	}
7468
7469	int SSL_get_blocking_mode(SSL *s)
7470	{
7471	#ifndef OPENSSL_NO_QUIC
7472	if (!IS_QUIC(s))
7473	return -1;
7474
7475	return ossl_quic_conn_get_blocking_mode(s);
7476	#else
7477	return -1;
7478	#endif
7479	}
7480
7481	int SSL_set1_initial_peer_addr(SSL s, const BIO_ADDR peer_addr)
7482	{
7483	#ifndef OPENSSL_NO_QUIC
7484	if (!IS_QUIC(s))
7485	return 0;
7486
7487	return ossl_quic_conn_set_initial_peer_addr(s, peer_addr);
7488	#else
7489	return 0;
7490	#endif
7491	}
7492
7493	int SSL_shutdown_ex(SSL *ssl, uint64_t flags,
7494	const SSL_SHUTDOWN_EX_ARGS *args,
7495	size_t args_len)
7496	{
7497	#ifndef OPENSSL_NO_QUIC
7498	if (!IS_QUIC(ssl))
7499	return SSL_shutdown(ssl);
7500
7501	return ossl_quic_conn_shutdown(ssl, flags, args, args_len);
7502	#else
7503	return SSL_shutdown(ssl);
7504	#endif
7505	}
7506
7507	int SSL_stream_conclude(SSL *ssl, uint64_t flags)
7508	{
7509	#ifndef OPENSSL_NO_QUIC
7510	if (!IS_QUIC(ssl))
7511	return 0;
7512
7513	return ossl_quic_conn_stream_conclude(ssl);
7514	#else
7515	return 0;
7516	#endif
7517	}
7518
7519	SSL SSL_new_stream(SSL s, uint64_t flags)
7520	{
7521	#ifndef OPENSSL_NO_QUIC
7522	if (!IS_QUIC(s))
7523	return NULL;
7524
7525	return ossl_quic_conn_stream_new(s, flags);
7526	#else
7527	return NULL;
7528	#endif
7529	}
7530
7531	SSL SSL_get0_connection(SSL s)
7532	{
7533	#ifndef OPENSSL_NO_QUIC
7534	if (!IS_QUIC(s))
7535	return s;
7536
7537	return ossl_quic_get0_connection(s);
7538	#else
7539	return s;
7540	#endif
7541	}
7542
7543	int SSL_is_connection(SSL *s)
7544	{
7545	return SSL_get0_connection(s) == s;
7546	}
7547
7548	int SSL_get_stream_type(SSL *s)
7549	{
7550	#ifndef OPENSSL_NO_QUIC
7551	if (!IS_QUIC(s))
7552	return SSL_STREAM_TYPE_BIDI;
7553
7554	return ossl_quic_get_stream_type(s);
7555	#else
7556	return SSL_STREAM_TYPE_BIDI;
7557	#endif
7558	}
7559
7560	uint64_t SSL_get_stream_id(SSL *s)
7561	{
7562	#ifndef OPENSSL_NO_QUIC
7563	if (!IS_QUIC(s))
7564	return UINT64_MAX;
7565
7566	return ossl_quic_get_stream_id(s);
7567	#else
7568	return UINT64_MAX;
7569	#endif
7570	}
7571
7572	int SSL_is_stream_local(SSL *s)
7573	{
7574	#ifndef OPENSSL_NO_QUIC
7575	if (!IS_QUIC(s))
7576	return -1;
7577
7578	return ossl_quic_is_stream_local(s);
7579	#else
7580	return -1;
7581	#endif
7582	}
7583
7584	int SSL_set_default_stream_mode(SSL *s, uint32_t mode)
7585	{
7586	#ifndef OPENSSL_NO_QUIC
7587	if (!IS_QUIC(s))
7588	return 0;
7589
7590	return ossl_quic_set_default_stream_mode(s, mode);
7591	#else
7592	return 0;
7593	#endif
7594	}
7595
7596	int SSL_set_incoming_stream_policy(SSL *s, int policy, uint64_t aec)
7597	{
7598	#ifndef OPENSSL_NO_QUIC
7599	if (!IS_QUIC(s))
7600	return 0;
7601
7602	return ossl_quic_set_incoming_stream_policy(s, policy, aec);
7603	#else
7604	return 0;
7605	#endif
7606	}
7607
7608	SSL SSL_accept_stream(SSL s, uint64_t flags)
7609	{
7610	#ifndef OPENSSL_NO_QUIC
7611	if (!IS_QUIC(s))
7612	return NULL;
7613
7614	return ossl_quic_accept_stream(s, flags);
7615	#else
7616	return NULL;
7617	#endif
7618	}
7619
7620	size_t SSL_get_accept_stream_queue_len(SSL *s)
7621	{
7622	#ifndef OPENSSL_NO_QUIC
7623	if (!IS_QUIC(s))
7624	return 0;
7625
7626	return ossl_quic_get_accept_stream_queue_len(s);
7627	#else
7628	return 0;
7629	#endif
7630	}
7631
7632	int SSL_stream_reset(SSL *s,
7633	const SSL_STREAM_RESET_ARGS *args,
7634	size_t args_len)
7635	{
7636	#ifndef OPENSSL_NO_QUIC
7637	if (!IS_QUIC(s))
7638	return 0;
7639
7640	return ossl_quic_stream_reset(s, args, args_len);
7641	#else
7642	return 0;
7643	#endif
7644	}
7645
7646	int SSL_get_stream_read_state(SSL *s)
7647	{
7648	#ifndef OPENSSL_NO_QUIC
7649	if (!IS_QUIC(s))
7650	return SSL_STREAM_STATE_NONE;
7651
7652	return ossl_quic_get_stream_read_state(s);
7653	#else
7654	return SSL_STREAM_STATE_NONE;
7655	#endif
7656	}
7657
7658	int SSL_get_stream_write_state(SSL *s)
7659	{
7660	#ifndef OPENSSL_NO_QUIC
7661	if (!IS_QUIC(s))
7662	return SSL_STREAM_STATE_NONE;
7663
7664	return ossl_quic_get_stream_write_state(s);
7665	#else
7666	return SSL_STREAM_STATE_NONE;
7667	#endif
7668	}
7669
7670	int SSL_get_stream_read_error_code(SSL s, uint64_t app_error_code)
7671	{
7672	#ifndef OPENSSL_NO_QUIC
7673	if (!IS_QUIC(s))
7674	return -1;
7675
7676	return ossl_quic_get_stream_read_error_code(s, app_error_code);
7677	#else
7678	return -1;
7679	#endif
7680	}
7681
7682	int SSL_get_stream_write_error_code(SSL s, uint64_t app_error_code)
7683	{
7684	#ifndef OPENSSL_NO_QUIC
7685	if (!IS_QUIC(s))
7686	return -1;
7687
7688	return ossl_quic_get_stream_write_error_code(s, app_error_code);
7689	#else
7690	return -1;
7691	#endif
7692	}
7693
7694	int SSL_get_conn_close_info(SSL s, SSL_CONN_CLOSE_INFO info,
7695	size_t info_len)
7696	{
7697	#ifndef OPENSSL_NO_QUIC
7698	if (!IS_QUIC(s))
7699	return -1;
7700
7701	return ossl_quic_get_conn_close_info(s, info, info_len);
7702	#else
7703	return -1;
7704	#endif
7705	}
7706
7707	int SSL_get_value_uint(SSL *s, uint32_t class_, uint32_t id,
7708	uint64_t *value)
7709	{
7710	#ifndef OPENSSL_NO_QUIC
7711	if (IS_QUIC(s))
7712	return ossl_quic_get_value_uint(s, class_, id, value);
7713	#endif
7714
7715	ERR_raise(ERR_LIB_SSL, SSL_R_UNSUPPORTED_PROTOCOL);
7716	return 0;
7717	}
7718
7719	int SSL_set_value_uint(SSL *s, uint32_t class_, uint32_t id,
7720	uint64_t value)
7721	{
7722	#ifndef OPENSSL_NO_QUIC
7723	if (IS_QUIC(s))
7724	return ossl_quic_set_value_uint(s, class_, id, value);
7725	#endif
7726
7727	ERR_raise(ERR_LIB_SSL, SSL_R_UNSUPPORTED_PROTOCOL);
7728	return 0;
7729	}
7730
7731	int SSL_add_expected_rpk(SSL s, EVP_PKEY rpk)
7732	{
7733	unsigned char *data = NULL;
7734	SSL_DANE *dane = SSL_get0_dane(s);
7735	int ret;
7736
7737	if (dane == NULL \|\| dane->dctx == NULL)
7738	return 0;
7739	if ((ret = i2d_PUBKEY(rpk, &data)) <= 0)
7740	return 0;
7741
7742	ret = SSL_dane_tlsa_add(s, DANETLS_USAGE_DANE_EE,
7743	DANETLS_SELECTOR_SPKI,
7744	DANETLS_MATCHING_FULL,
7745	data, (size_t)ret) > 0;
7746	OPENSSL_free(data);
7747	return ret;
7748	}
7749
7750	EVP_PKEY SSL_get0_peer_rpk(const SSL s)
7751	{
7752	SSL_CONNECTION *sc = SSL_CONNECTION_FROM_SSL(s);
7753
7754	if (sc == NULL \|\| sc->session == NULL)
7755	return NULL;
7756	return sc->session->peer_rpk;
7757	}
7758
7759	int SSL_get_negotiated_client_cert_type(const SSL *s)
7760	{
7761	SSL_CONNECTION *sc = SSL_CONNECTION_FROM_SSL(s);
7762
7763	if (sc == NULL)
7764	return 0;
7765
7766	return sc->ext.client_cert_type;
7767	}
7768
7769	int SSL_get_negotiated_server_cert_type(const SSL *s)
7770	{
7771	SSL_CONNECTION *sc = SSL_CONNECTION_FROM_SSL(s);
7772
7773	if (sc == NULL)
7774	return 0;
7775
7776	return sc->ext.server_cert_type;
7777	}
7778
7779	static int validate_cert_type(const unsigned char *val, size_t len)
7780	{
7781	size_t i;
7782	int saw_rpk = 0;
7783	int saw_x509 = 0;
7784
7785	if (val == NULL && len == 0)
7786	return 1;
7787
7788	if (val == NULL \|\| len == 0)
7789	return 0;
7790
7791	for (i = 0; i < len; i++) {
7792	switch (val[i]) {
7793	case TLSEXT_cert_type_rpk:
7794	if (saw_rpk)
7795	return 0;
7796	saw_rpk = 1;
7797	break;
7798	case TLSEXT_cert_type_x509:
7799	if (saw_x509)
7800	return 0;
7801	saw_x509 = 1;
7802	break;
7803	case TLSEXT_cert_type_pgp:
7804	case TLSEXT_cert_type_1609dot2:
7805	default:
7806	return 0;
7807	}
7808	}
7809	return 1;
7810	}
7811
7812	static int set_cert_type(unsigned char **cert_type,
7813	size_t *cert_type_len,
7814	const unsigned char *val,
7815	size_t len)
7816	{
7817	unsigned char *tmp = NULL;
7818
7819	if (!validate_cert_type(val, len))
7820	return 0;
7821
7822	if (val != NULL && (tmp = OPENSSL_memdup(val, len)) == NULL)
7823	return 0;
7824
7825	OPENSSL_free(*cert_type);
7826	*cert_type = tmp;
7827	*cert_type_len = len;
7828	return 1;
7829	}
7830
7831	int SSL_set1_client_cert_type(SSL s, const unsigned char val, size_t len)
7832	{
7833	SSL_CONNECTION *sc = SSL_CONNECTION_FROM_SSL(s);
7834
7835	return set_cert_type(&sc->client_cert_type, &sc->client_cert_type_len,
7836	val, len);
7837	}
7838
7839	int SSL_set1_server_cert_type(SSL s, const unsigned char val, size_t len)
7840	{
7841	SSL_CONNECTION *sc = SSL_CONNECTION_FROM_SSL(s);
7842
7843	return set_cert_type(&sc->server_cert_type, &sc->server_cert_type_len,
7844	val, len);
7845	}
7846
7847	int SSL_CTX_set1_client_cert_type(SSL_CTX ctx, const unsigned char val, size_t len)
7848	{
7849	return set_cert_type(&ctx->client_cert_type, &ctx->client_cert_type_len,
7850	val, len);
7851	}
7852
7853	int SSL_CTX_set1_server_cert_type(SSL_CTX ctx, const unsigned char val, size_t len)
7854	{
7855	return set_cert_type(&ctx->server_cert_type, &ctx->server_cert_type_len,
7856	val, len);
7857	}
7858
7859	int SSL_get0_client_cert_type(const SSL s, unsigned char t, size_t len)
7860	{
7861	const SSL_CONNECTION *sc = SSL_CONNECTION_FROM_CONST_SSL(s);
7862
7863	if (t == NULL \|\| len == NULL)
7864	return 0;
7865
7866	*t = sc->client_cert_type;
7867	*len = sc->client_cert_type_len;
7868	return 1;
7869	}
7870
7871	int SSL_get0_server_cert_type(const SSL s, unsigned char t, size_t len)
7872	{
7873	const SSL_CONNECTION *sc = SSL_CONNECTION_FROM_CONST_SSL(s);
7874
7875	if (t == NULL \|\| len == NULL)
7876	return 0;
7877
7878	*t = sc->server_cert_type;
7879	*len = sc->server_cert_type_len;
7880	return 1;
7881	}
7882
7883	int SSL_CTX_get0_client_cert_type(const SSL_CTX ctx, unsigned char t, size_t len)
7884	{
7885	if (t == NULL \|\| len == NULL)
7886	return 0;
7887
7888	*t = ctx->client_cert_type;
7889	*len = ctx->client_cert_type_len;
7890	return 1;
7891	}
7892
7893	int SSL_CTX_get0_server_cert_type(const SSL_CTX ctx, unsigned char t, size_t len)
7894	{
7895	if (t == NULL \|\| len == NULL)
7896	return 0;
7897
7898	*t = ctx->server_cert_type;
7899	*len = ctx->server_cert_type_len;
7900	return 1;
7901	}

Note: See TracBrowser for help on using the repository browser.

source: vbox/trunk/src/libs/openssl-3.4.1/ssl/ssl_lib.c

Download in other formats: