1 /* 2 * Copyright 1995-2026 The OpenSSL Project Authors. All Rights Reserved. 3 * Copyright (c) 2002, Oracle and/or its affiliates. All rights reserved 4 * Copyright 2005 Nokia. All rights reserved. 5 * 6 * Licensed under the Apache License 2.0 (the "License"). You may not use 7 * this file except in compliance with the License. You can obtain a copy 8 * in the file LICENSE in the source distribution or at 9 * https://www.openssl.org/source/license.html 10 */ 11 12 #include "internal/e_os.h" 13 #include "internal/e_winsock.h" 14 #include "ssl_local.h" 15 16 #include <openssl/objects.h> 17 #include <openssl/x509v3.h> 18 #include <openssl/rand.h> 19 #include <openssl/ocsp.h> 20 #include <openssl/dh.h> 21 #include <openssl/engine.h> 22 #include <openssl/async.h> 23 #include <openssl/ct.h> 24 #include <openssl/trace.h> 25 #include <openssl/core_names.h> 26 #include <openssl/provider.h> 27 #include "internal/cryptlib.h" 28 #include "internal/nelem.h" 29 #include "internal/refcount.h" 30 #include "internal/thread_once.h" 31 #include "internal/ktls.h" 32 #include "internal/to_hex.h" 33 #include "internal/ssl_unwrap.h" 34 #include "quic/quic_local.h" 35 36 #ifndef OPENSSL_NO_SSLKEYLOG 37 #include <sys/stat.h> 38 #include <fcntl.h> 39 #endif 40 41 static int ssl_undefined_function_3(SSL_CONNECTION *sc, unsigned char *r, 42 unsigned char *s, size_t t, size_t *u) 43 { 44 return ssl_undefined_function(SSL_CONNECTION_GET_SSL(sc)); 45 } 46 47 static int ssl_undefined_function_4(SSL_CONNECTION *sc, int r) 48 { 49 return ssl_undefined_function(SSL_CONNECTION_GET_SSL(sc)); 50 } 51 52 static size_t ssl_undefined_function_5(SSL_CONNECTION *sc, const char *r, 53 size_t s, unsigned char *t) 54 { 55 return ssl_undefined_function(SSL_CONNECTION_GET_SSL(sc)); 56 } 57 58 static int ssl_undefined_function_6(int r) 59 { 60 return ssl_undefined_function(NULL); 61 } 62 63 static int ssl_undefined_function_7(SSL_CONNECTION *sc, unsigned char *r, 64 size_t s, const char *t, size_t u, 65 const unsigned char *v, size_t w, int x) 66 { 67 return ssl_undefined_function(SSL_CONNECTION_GET_SSL(sc)); 68 } 69 70 static int ssl_undefined_function_8(SSL_CONNECTION *sc) 71 { 72 return ssl_undefined_function(SSL_CONNECTION_GET_SSL(sc)); 73 } 74 75 const SSL3_ENC_METHOD ssl3_undef_enc_method = { 76 ssl_undefined_function_8, 77 ssl_undefined_function_3, 78 ssl_undefined_function_4, 79 ssl_undefined_function_5, 80 NULL, /* client_finished_label */ 81 0, /* client_finished_label_len */ 82 NULL, /* server_finished_label */ 83 0, /* server_finished_label_len */ 84 ssl_undefined_function_6, 85 ssl_undefined_function_7, 86 }; 87 88 struct ssl_async_args { 89 SSL *s; 90 void *buf; 91 size_t num; 92 enum { READFUNC, 93 WRITEFUNC, 94 OTHERFUNC } type; 95 union { 96 int (*func_read)(SSL *, void *, size_t, size_t *); 97 int (*func_write)(SSL *, const void *, size_t, size_t *); 98 int (*func_other)(SSL *); 99 } f; 100 }; 101 102 static const struct { 103 uint8_t mtype; 104 uint8_t ord; 105 int nid; 106 } dane_mds[] = { 107 { DANETLS_MATCHING_FULL, 0, NID_undef }, 108 { DANETLS_MATCHING_2256, 1, NID_sha256 }, 109 { DANETLS_MATCHING_2512, 2, NID_sha512 }, 110 }; 111 112 static int dane_ctx_enable(struct dane_ctx_st *dctx) 113 { 114 const EVP_MD **mdevp; 115 uint8_t *mdord; 116 uint8_t mdmax = DANETLS_MATCHING_LAST; 117 int n = ((int)mdmax) + 1; /* int to handle PrivMatch(255) */ 118 size_t i; 119 120 if (dctx->mdevp != NULL) 121 return 1; 122 123 mdevp = OPENSSL_zalloc(n * sizeof(*mdevp)); 124 mdord = OPENSSL_zalloc(n * sizeof(*mdord)); 125 126 if (mdord == NULL || mdevp == NULL) { 127 OPENSSL_free(mdord); 128 OPENSSL_free(mdevp); 129 return 0; 130 } 131 132 /* Install default entries */ 133 for (i = 0; i < OSSL_NELEM(dane_mds); ++i) { 134 const EVP_MD *md; 135 136 if (dane_mds[i].nid == NID_undef || (md = EVP_get_digestbynid(dane_mds[i].nid)) == NULL) 137 continue; 138 mdevp[dane_mds[i].mtype] = md; 139 mdord[dane_mds[i].mtype] = dane_mds[i].ord; 140 } 141 142 dctx->mdevp = mdevp; 143 dctx->mdord = mdord; 144 dctx->mdmax = mdmax; 145 146 return 1; 147 } 148 149 static void dane_ctx_final(struct dane_ctx_st *dctx) 150 { 151 OPENSSL_free(dctx->mdevp); 152 dctx->mdevp = NULL; 153 154 OPENSSL_free(dctx->mdord); 155 dctx->mdord = NULL; 156 dctx->mdmax = 0; 157 } 158 159 static void tlsa_free(danetls_record *t) 160 { 161 if (t == NULL) 162 return; 163 OPENSSL_free(t->data); 164 EVP_PKEY_free(t->spki); 165 OPENSSL_free(t); 166 } 167 168 static void dane_final(SSL_DANE *dane) 169 { 170 sk_danetls_record_pop_free(dane->trecs, tlsa_free); 171 dane->trecs = NULL; 172 173 OSSL_STACK_OF_X509_free(dane->certs); 174 dane->certs = NULL; 175 176 X509_free(dane->mcert); 177 dane->mcert = NULL; 178 dane->mtlsa = NULL; 179 dane->mdpth = -1; 180 dane->pdpth = -1; 181 } 182 183 /* 184 * dane_copy - Copy dane configuration, sans verification state. 185 */ 186 static int ssl_dane_dup(SSL_CONNECTION *to, SSL_CONNECTION *from) 187 { 188 int num; 189 int i; 190 191 if (!DANETLS_ENABLED(&from->dane)) 192 return 1; 193 194 num = sk_danetls_record_num(from->dane.trecs); 195 dane_final(&to->dane); 196 to->dane.flags = from->dane.flags; 197 to->dane.dctx = &SSL_CONNECTION_GET_CTX(to)->dane; 198 to->dane.trecs = sk_danetls_record_new_reserve(NULL, num); 199 200 if (to->dane.trecs == NULL) { 201 ERR_raise(ERR_LIB_SSL, ERR_R_CRYPTO_LIB); 202 return 0; 203 } 204 205 for (i = 0; i < num; ++i) { 206 danetls_record *t = sk_danetls_record_value(from->dane.trecs, i); 207 208 if (SSL_dane_tlsa_add(SSL_CONNECTION_GET_SSL(to), t->usage, 209 t->selector, t->mtype, t->data, t->dlen) 210 <= 0) 211 return 0; 212 } 213 return 1; 214 } 215 216 static int dane_mtype_set(struct dane_ctx_st *dctx, 217 const EVP_MD *md, uint8_t mtype, uint8_t ord) 218 { 219 int i; 220 221 if (mtype == DANETLS_MATCHING_FULL && md != NULL) { 222 ERR_raise(ERR_LIB_SSL, SSL_R_DANE_CANNOT_OVERRIDE_MTYPE_FULL); 223 return 0; 224 } 225 226 if (mtype > dctx->mdmax) { 227 const EVP_MD **mdevp; 228 uint8_t *mdord; 229 int n = ((int)mtype) + 1; 230 231 mdevp = OPENSSL_realloc(dctx->mdevp, n * sizeof(*mdevp)); 232 if (mdevp == NULL) 233 return -1; 234 dctx->mdevp = mdevp; 235 236 mdord = OPENSSL_realloc(dctx->mdord, n * sizeof(*mdord)); 237 if (mdord == NULL) 238 return -1; 239 dctx->mdord = mdord; 240 241 /* Zero-fill any gaps */ 242 for (i = dctx->mdmax + 1; i < mtype; ++i) { 243 mdevp[i] = NULL; 244 mdord[i] = 0; 245 } 246 247 dctx->mdmax = mtype; 248 } 249 250 dctx->mdevp[mtype] = md; 251 /* Coerce ordinal of disabled matching types to 0 */ 252 dctx->mdord[mtype] = (md == NULL) ? 0 : ord; 253 254 return 1; 255 } 256 257 static const EVP_MD *tlsa_md_get(SSL_DANE *dane, uint8_t mtype) 258 { 259 if (mtype > dane->dctx->mdmax) 260 return NULL; 261 return dane->dctx->mdevp[mtype]; 262 } 263 264 static int dane_tlsa_add(SSL_DANE *dane, 265 uint8_t usage, 266 uint8_t selector, 267 uint8_t mtype, const unsigned char *data, size_t dlen) 268 { 269 danetls_record *t; 270 const EVP_MD *md = NULL; 271 int ilen = (int)dlen; 272 int i; 273 int num; 274 int mdsize; 275 276 if (dane->trecs == NULL) { 277 ERR_raise(ERR_LIB_SSL, SSL_R_DANE_NOT_ENABLED); 278 return -1; 279 } 280 281 if (ilen < 0 || dlen != (size_t)ilen) { 282 ERR_raise(ERR_LIB_SSL, SSL_R_DANE_TLSA_BAD_DATA_LENGTH); 283 return 0; 284 } 285 286 if (usage > DANETLS_USAGE_LAST) { 287 ERR_raise(ERR_LIB_SSL, SSL_R_DANE_TLSA_BAD_CERTIFICATE_USAGE); 288 return 0; 289 } 290 291 if (selector > DANETLS_SELECTOR_LAST) { 292 ERR_raise(ERR_LIB_SSL, SSL_R_DANE_TLSA_BAD_SELECTOR); 293 return 0; 294 } 295 296 if (mtype != DANETLS_MATCHING_FULL) { 297 md = tlsa_md_get(dane, mtype); 298 if (md == NULL) { 299 ERR_raise(ERR_LIB_SSL, SSL_R_DANE_TLSA_BAD_MATCHING_TYPE); 300 return 0; 301 } 302 } 303 304 if (md != NULL) { 305 mdsize = EVP_MD_get_size(md); 306 if (mdsize <= 0 || dlen != (size_t)mdsize) { 307 ERR_raise(ERR_LIB_SSL, SSL_R_DANE_TLSA_BAD_DIGEST_LENGTH); 308 return 0; 309 } 310 } 311 if (!data) { 312 ERR_raise(ERR_LIB_SSL, SSL_R_DANE_TLSA_NULL_DATA); 313 return 0; 314 } 315 316 if ((t = OPENSSL_zalloc(sizeof(*t))) == NULL) 317 return -1; 318 319 t->usage = usage; 320 t->selector = selector; 321 t->mtype = mtype; 322 t->data = OPENSSL_malloc(dlen); 323 if (t->data == NULL) { 324 tlsa_free(t); 325 return -1; 326 } 327 memcpy(t->data, data, dlen); 328 t->dlen = dlen; 329 330 /* Validate and cache full certificate or public key */ 331 if (mtype == DANETLS_MATCHING_FULL) { 332 const unsigned char *p = data; 333 X509 *cert = NULL; 334 EVP_PKEY *pkey = NULL; 335 336 switch (selector) { 337 case DANETLS_SELECTOR_CERT: 338 if (!d2i_X509(&cert, &p, ilen) || p < data || dlen != (size_t)(p - data)) { 339 X509_free(cert); 340 tlsa_free(t); 341 ERR_raise(ERR_LIB_SSL, SSL_R_DANE_TLSA_BAD_CERTIFICATE); 342 return 0; 343 } 344 if (X509_get0_pubkey(cert) == NULL) { 345 X509_free(cert); 346 tlsa_free(t); 347 ERR_raise(ERR_LIB_SSL, SSL_R_DANE_TLSA_BAD_CERTIFICATE); 348 return 0; 349 } 350 351 if ((DANETLS_USAGE_BIT(usage) & DANETLS_TA_MASK) == 0) { 352 /* 353 * The Full(0) certificate decodes to a seemingly valid X.509 354 * object with a plausible key, so the TLSA record is well 355 * formed. However, we don't actually need the certificate for 356 * usages PKIX-EE(1) or DANE-EE(3), because at least the EE 357 * certificate is always presented by the peer. We discard the 358 * certificate, and just use the TLSA data as an opaque blob 359 * for matching the raw presented DER octets. 360 * 361 * DO NOT FREE `t` here, it will be added to the TLSA record 362 * list below! 363 */ 364 X509_free(cert); 365 break; 366 } 367 368 /* 369 * For usage DANE-TA(2), we support authentication via "2 0 0" TLSA 370 * records that contain full certificates of trust-anchors that are 371 * not present in the wire chain. For usage PKIX-TA(0), we augment 372 * the chain with untrusted Full(0) certificates from DNS, in case 373 * they are missing from the chain. 374 */ 375 if ((dane->certs == NULL && (dane->certs = sk_X509_new_null()) == NULL) || !sk_X509_push(dane->certs, cert)) { 376 ERR_raise(ERR_LIB_SSL, ERR_R_CRYPTO_LIB); 377 X509_free(cert); 378 tlsa_free(t); 379 return -1; 380 } 381 break; 382 383 case DANETLS_SELECTOR_SPKI: 384 if (!d2i_PUBKEY(&pkey, &p, ilen) || p < data || dlen != (size_t)(p - data)) { 385 EVP_PKEY_free(pkey); 386 tlsa_free(t); 387 ERR_raise(ERR_LIB_SSL, SSL_R_DANE_TLSA_BAD_PUBLIC_KEY); 388 return 0; 389 } 390 391 /* 392 * For usage DANE-TA(2), we support authentication via "2 1 0" TLSA 393 * records that contain full bare keys of trust-anchors that are 394 * not present in the wire chain. 395 */ 396 if (usage == DANETLS_USAGE_DANE_TA) 397 t->spki = pkey; 398 else 399 EVP_PKEY_free(pkey); 400 break; 401 } 402 } 403 404 /*- 405 * Find the right insertion point for the new record. 406 * 407 * See crypto/x509/x509_vfy.c. We sort DANE-EE(3) records first, so that 408 * they can be processed first, as they require no chain building, and no 409 * expiration or hostname checks. Because DANE-EE(3) is numerically 410 * largest, this is accomplished via descending sort by "usage". 411 * 412 * We also sort in descending order by matching ordinal to simplify 413 * the implementation of digest agility in the verification code. 414 * 415 * The choice of order for the selector is not significant, so we 416 * use the same descending order for consistency. 417 */ 418 num = sk_danetls_record_num(dane->trecs); 419 for (i = 0; i < num; ++i) { 420 danetls_record *rec = sk_danetls_record_value(dane->trecs, i); 421 422 if (rec->usage > usage) 423 continue; 424 if (rec->usage < usage) 425 break; 426 if (rec->selector > selector) 427 continue; 428 if (rec->selector < selector) 429 break; 430 if (dane->dctx->mdord[rec->mtype] > dane->dctx->mdord[mtype]) 431 continue; 432 break; 433 } 434 435 if (!sk_danetls_record_insert(dane->trecs, t, i)) { 436 tlsa_free(t); 437 ERR_raise(ERR_LIB_SSL, ERR_R_CRYPTO_LIB); 438 return -1; 439 } 440 dane->umask |= DANETLS_USAGE_BIT(usage); 441 442 return 1; 443 } 444 445 /* 446 * Return 0 if there is only one version configured and it was disabled 447 * at configure time. Return 1 otherwise. 448 */ 449 static int ssl_check_allowed_versions(int min_version, int max_version) 450 { 451 int minisdtls = 0, maxisdtls = 0; 452 453 /* Figure out if we're doing DTLS versions or TLS versions */ 454 if (min_version == DTLS1_BAD_VER 455 || min_version >> 8 == DTLS1_VERSION_MAJOR) 456 minisdtls = 1; 457 if (max_version == DTLS1_BAD_VER 458 || max_version >> 8 == DTLS1_VERSION_MAJOR) 459 maxisdtls = 1; 460 /* A wildcard version of 0 could be DTLS or TLS. */ 461 if ((minisdtls && !maxisdtls && max_version != 0) 462 || (maxisdtls && !minisdtls && min_version != 0)) { 463 /* Mixing DTLS and TLS versions will lead to sadness; deny it. */ 464 return 0; 465 } 466 467 if (minisdtls || maxisdtls) { 468 /* Do DTLS version checks. */ 469 if (min_version == 0) 470 /* Ignore DTLS1_BAD_VER */ 471 min_version = DTLS1_VERSION; 472 if (max_version == 0) 473 max_version = DTLS1_2_VERSION; 474 #ifdef OPENSSL_NO_DTLS1_2 475 if (max_version == DTLS1_2_VERSION) 476 max_version = DTLS1_VERSION; 477 #endif 478 #ifdef OPENSSL_NO_DTLS1 479 if (min_version == DTLS1_VERSION) 480 min_version = DTLS1_2_VERSION; 481 #endif 482 /* Done massaging versions; do the check. */ 483 if (0 484 #ifdef OPENSSL_NO_DTLS1 485 || (DTLS_VERSION_GE(min_version, DTLS1_VERSION) 486 && DTLS_VERSION_GE(DTLS1_VERSION, max_version)) 487 #endif 488 #ifdef OPENSSL_NO_DTLS1_2 489 || (DTLS_VERSION_GE(min_version, DTLS1_2_VERSION) 490 && DTLS_VERSION_GE(DTLS1_2_VERSION, max_version)) 491 #endif 492 ) 493 return 0; 494 } else { 495 /* Regular TLS version checks. */ 496 if (min_version == 0) 497 min_version = SSL3_VERSION; 498 if (max_version == 0) 499 max_version = TLS1_3_VERSION; 500 #ifdef OPENSSL_NO_TLS1_3 501 if (max_version == TLS1_3_VERSION) 502 max_version = TLS1_2_VERSION; 503 #endif 504 #ifdef OPENSSL_NO_TLS1_2 505 if (max_version == TLS1_2_VERSION) 506 max_version = TLS1_1_VERSION; 507 #endif 508 #ifdef OPENSSL_NO_TLS1_1 509 if (max_version == TLS1_1_VERSION) 510 max_version = TLS1_VERSION; 511 #endif 512 #ifdef OPENSSL_NO_TLS1 513 if (max_version == TLS1_VERSION) 514 max_version = SSL3_VERSION; 515 #endif 516 #ifdef OPENSSL_NO_SSL3 517 if (min_version == SSL3_VERSION) 518 min_version = TLS1_VERSION; 519 #endif 520 #ifdef OPENSSL_NO_TLS1 521 if (min_version == TLS1_VERSION) 522 min_version = TLS1_1_VERSION; 523 #endif 524 #ifdef OPENSSL_NO_TLS1_1 525 if (min_version == TLS1_1_VERSION) 526 min_version = TLS1_2_VERSION; 527 #endif 528 #ifdef OPENSSL_NO_TLS1_2 529 if (min_version == TLS1_2_VERSION) 530 min_version = TLS1_3_VERSION; 531 #endif 532 /* Done massaging versions; do the check. */ 533 if (0 534 #ifdef OPENSSL_NO_SSL3 535 || (min_version <= SSL3_VERSION && SSL3_VERSION <= max_version) 536 #endif 537 #ifdef OPENSSL_NO_TLS1 538 || (min_version <= TLS1_VERSION && TLS1_VERSION <= max_version) 539 #endif 540 #ifdef OPENSSL_NO_TLS1_1 541 || (min_version <= TLS1_1_VERSION && TLS1_1_VERSION <= max_version) 542 #endif 543 #ifdef OPENSSL_NO_TLS1_2 544 || (min_version <= TLS1_2_VERSION && TLS1_2_VERSION <= max_version) 545 #endif 546 #ifdef OPENSSL_NO_TLS1_3 547 || (min_version <= TLS1_3_VERSION && TLS1_3_VERSION <= max_version) 548 #endif 549 ) 550 return 0; 551 } 552 return 1; 553 } 554 555 #if defined(__TANDEM) && defined(OPENSSL_VPROC) 556 /* 557 * Define a VPROC function for HP NonStop build ssl library. 558 * This is used by platform version identification tools. 559 * Do not inline this procedure or make it static. 560 */ 561 #define OPENSSL_VPROC_STRING_(x) x##_SSL 562 #define OPENSSL_VPROC_STRING(x) OPENSSL_VPROC_STRING_(x) 563 #define OPENSSL_VPROC_FUNC OPENSSL_VPROC_STRING(OPENSSL_VPROC) 564 void OPENSSL_VPROC_FUNC(void) { } 565 #endif 566 567 int SSL_clear(SSL *s) 568 { 569 if (s->method == NULL) { 570 ERR_raise(ERR_LIB_SSL, SSL_R_NO_METHOD_SPECIFIED); 571 return 0; 572 } 573 574 return s->method->ssl_reset(s); 575 } 576 577 int ossl_ssl_connection_reset(SSL *s) 578 { 579 SSL_CONNECTION *sc = SSL_CONNECTION_FROM_SSL(s); 580 581 if (sc == NULL) 582 return 0; 583 584 if (ssl_clear_bad_session(sc)) { 585 SSL_SESSION_free(sc->session); 586 sc->session = NULL; 587 } 588 SSL_SESSION_free(sc->psksession); 589 sc->psksession = NULL; 590 OPENSSL_free(sc->psksession_id); 591 sc->psksession_id = NULL; 592 sc->psksession_id_len = 0; 593 sc->hello_retry_request = SSL_HRR_NONE; 594 sc->sent_tickets = 0; 595 596 sc->error = 0; 597 sc->hit = 0; 598 sc->shutdown = 0; 599 600 if (sc->renegotiate) { 601 ERR_raise(ERR_LIB_SSL, ERR_R_INTERNAL_ERROR); 602 return 0; 603 } 604 605 ossl_statem_clear(sc); 606 607 sc->version = s->method->version; 608 sc->client_version = sc->version; 609 sc->rwstate = SSL_NOTHING; 610 611 BUF_MEM_free(sc->init_buf); 612 sc->init_buf = NULL; 613 sc->first_packet = 0; 614 615 sc->key_update = SSL_KEY_UPDATE_NONE; 616 memset(sc->ext.compress_certificate_from_peer, 0, 617 sizeof(sc->ext.compress_certificate_from_peer)); 618 sc->ext.compress_certificate_sent = 0; 619 620 EVP_MD_CTX_free(sc->pha_dgst); 621 sc->pha_dgst = NULL; 622 623 /* Reset DANE verification result state */ 624 sc->dane.mdpth = -1; 625 sc->dane.pdpth = -1; 626 X509_free(sc->dane.mcert); 627 sc->dane.mcert = NULL; 628 sc->dane.mtlsa = NULL; 629 630 /* Clear the verification result peername */ 631 X509_VERIFY_PARAM_move_peername(sc->param, NULL); 632 633 /* Clear any shared connection state */ 634 OPENSSL_free(sc->shared_sigalgs); 635 sc->shared_sigalgs = NULL; 636 sc->shared_sigalgslen = 0; 637 638 /* 639 * Check to see if we were changed into a different method, if so, revert 640 * back. 641 */ 642 if (s->method != s->defltmeth) { 643 s->method->ssl_deinit(s); 644 s->method = s->defltmeth; 645 if (!s->method->ssl_init(s)) 646 return 0; 647 } else { 648 if (!s->method->ssl_clear(s)) 649 return 0; 650 } 651 652 ossl_quic_tls_clear(sc->qtls); 653 654 if (!RECORD_LAYER_reset(&sc->rlayer)) 655 return 0; 656 657 return 1; 658 } 659 660 #ifndef OPENSSL_NO_DEPRECATED_3_0 661 /** Used to change an SSL_CTXs default SSL method type */ 662 int SSL_CTX_set_ssl_version(SSL_CTX *ctx, const SSL_METHOD *meth) 663 { 664 STACK_OF(SSL_CIPHER) *sk; 665 666 if (IS_QUIC_CTX(ctx)) { 667 ERR_raise(ERR_LIB_SSL, SSL_R_WRONG_SSL_VERSION); 668 return 0; 669 } 670 671 ctx->method = meth; 672 673 if (!SSL_CTX_set_ciphersuites(ctx, OSSL_default_ciphersuites())) { 674 ERR_raise(ERR_LIB_SSL, SSL_R_SSL_LIBRARY_HAS_NO_CIPHERS); 675 return 0; 676 } 677 sk = ssl_create_cipher_list(ctx, 678 ctx->tls13_ciphersuites, 679 &(ctx->cipher_list), 680 &(ctx->cipher_list_by_id), 681 OSSL_default_cipher_list(), ctx->cert); 682 if ((sk == NULL) || (sk_SSL_CIPHER_num(sk) <= 0)) { 683 ERR_raise(ERR_LIB_SSL, SSL_R_SSL_LIBRARY_HAS_NO_CIPHERS); 684 return 0; 685 } 686 return 1; 687 } 688 #endif 689 690 SSL *SSL_new(SSL_CTX *ctx) 691 { 692 if (ctx == NULL) { 693 ERR_raise(ERR_LIB_SSL, SSL_R_NULL_SSL_CTX); 694 return NULL; 695 } 696 if (ctx->method == NULL) { 697 ERR_raise(ERR_LIB_SSL, SSL_R_SSL_CTX_HAS_NO_DEFAULT_SSL_VERSION); 698 return NULL; 699 } 700 return ctx->method->ssl_new(ctx); 701 } 702 703 int ossl_ssl_init(SSL *ssl, SSL_CTX *ctx, const SSL_METHOD *method, int type) 704 { 705 if (!SSL_CTX_up_ref(ctx)) 706 return 0; 707 708 ssl->lock = CRYPTO_THREAD_lock_new(); 709 710 if (ssl->lock == NULL || !CRYPTO_NEW_REF(&ssl->references, 1)) 711 goto err; 712 713 if (!CRYPTO_new_ex_data(CRYPTO_EX_INDEX_SSL, ssl, &ssl->ex_data)) { 714 CRYPTO_FREE_REF(&ssl->references); 715 goto err; 716 } 717 718 ssl->ctx = ctx; 719 ssl->type = type; 720 ssl->defltmeth = ssl->method = method; 721 722 return 1; 723 724 err: 725 CRYPTO_THREAD_lock_free(ssl->lock); 726 ssl->lock = NULL; 727 SSL_CTX_free(ctx); 728 return 0; 729 } 730 731 SSL *ossl_ssl_connection_new_int(SSL_CTX *ctx, SSL *user_ssl, 732 const SSL_METHOD *method) 733 { 734 SSL_CONNECTION *s; 735 SSL *ssl; 736 737 s = OPENSSL_zalloc(sizeof(*s)); 738 if (s == NULL) 739 return NULL; 740 741 ssl = &s->ssl; 742 s->user_ssl = (user_ssl == NULL) ? ssl : user_ssl; 743 744 if (!ossl_ssl_init(ssl, ctx, method, SSL_TYPE_SSL_CONNECTION)) { 745 OPENSSL_free(s); 746 s = NULL; 747 ssl = NULL; 748 goto sslerr; 749 } 750 751 RECORD_LAYER_init(&s->rlayer, s); 752 753 s->options = ctx->options; 754 755 s->dane.flags = ctx->dane.flags; 756 if (method->version == ctx->method->version) { 757 s->min_proto_version = ctx->min_proto_version; 758 s->max_proto_version = ctx->max_proto_version; 759 } 760 761 s->mode = ctx->mode; 762 s->max_cert_list = ctx->max_cert_list; 763 s->max_early_data = ctx->max_early_data; 764 s->recv_max_early_data = ctx->recv_max_early_data; 765 766 s->num_tickets = ctx->num_tickets; 767 s->pha_enabled = ctx->pha_enabled; 768 769 /* Shallow copy of the ciphersuites stack */ 770 s->tls13_ciphersuites = sk_SSL_CIPHER_dup(ctx->tls13_ciphersuites); 771 if (s->tls13_ciphersuites == NULL) 772 goto cerr; 773 774 /* 775 * Earlier library versions used to copy the pointer to the CERT, not 776 * its contents; only when setting new parameters for the per-SSL 777 * copy, ssl_cert_new would be called (and the direct reference to 778 * the per-SSL_CTX settings would be lost, but those still were 779 * indirectly accessed for various purposes, and for that reason they 780 * used to be known as s->ctx->default_cert). Now we don't look at the 781 * SSL_CTX's CERT after having duplicated it once. 782 */ 783 s->cert = ssl_cert_dup(ctx->cert); 784 if (s->cert == NULL) 785 goto sslerr; 786 787 RECORD_LAYER_set_read_ahead(&s->rlayer, ctx->read_ahead); 788 s->msg_callback = ctx->msg_callback; 789 s->msg_callback_arg = ctx->msg_callback_arg; 790 s->verify_mode = ctx->verify_mode; 791 s->not_resumable_session_cb = ctx->not_resumable_session_cb; 792 s->rlayer.record_padding_cb = ctx->record_padding_cb; 793 s->rlayer.record_padding_arg = ctx->record_padding_arg; 794 s->rlayer.block_padding = ctx->block_padding; 795 s->rlayer.hs_padding = ctx->hs_padding; 796 s->sid_ctx_length = ctx->sid_ctx_length; 797 if (!ossl_assert(s->sid_ctx_length <= sizeof(s->sid_ctx))) 798 goto err; 799 memcpy(&s->sid_ctx, &ctx->sid_ctx, sizeof(s->sid_ctx)); 800 s->verify_callback = ctx->default_verify_callback; 801 s->generate_session_id = ctx->generate_session_id; 802 803 s->param = X509_VERIFY_PARAM_new(); 804 if (s->param == NULL) 805 goto asn1err; 806 X509_VERIFY_PARAM_inherit(s->param, ctx->param); 807 s->quiet_shutdown = IS_QUIC_CTX(ctx) ? 0 : ctx->quiet_shutdown; 808 809 if (!IS_QUIC_CTX(ctx)) 810 s->ext.max_fragment_len_mode = ctx->ext.max_fragment_len_mode; 811 812 s->max_send_fragment = ctx->max_send_fragment; 813 s->split_send_fragment = ctx->split_send_fragment; 814 s->max_pipelines = ctx->max_pipelines; 815 s->rlayer.default_read_buf_len = ctx->default_read_buf_len; 816 817 s->ext.debug_cb = 0; 818 s->ext.debug_arg = NULL; 819 s->ext.ticket_expected = 0; 820 s->ext.status_type = ctx->ext.status_type; 821 s->ext.status_expected = 0; 822 s->ext.ocsp.ids = NULL; 823 s->ext.ocsp.exts = NULL; 824 s->ext.ocsp.resp = NULL; 825 s->ext.ocsp.resp_len = 0; 826 827 if (!SSL_CTX_up_ref(ctx)) 828 goto err; 829 830 s->session_ctx = ctx; 831 if (ctx->ext.ecpointformats != NULL) { 832 s->ext.ecpointformats = OPENSSL_memdup(ctx->ext.ecpointformats, 833 ctx->ext.ecpointformats_len); 834 if (s->ext.ecpointformats == NULL) { 835 s->ext.ecpointformats_len = 0; 836 goto err; 837 } 838 s->ext.ecpointformats_len = ctx->ext.ecpointformats_len; 839 } 840 if (ctx->ext.supportedgroups != NULL) { 841 size_t add = 0; 842 843 if (ctx->ext.supportedgroups_len == 0) 844 /* Add 1 so allocation won't fail */ 845 add = 1; 846 s->ext.supportedgroups = OPENSSL_memdup(ctx->ext.supportedgroups, 847 (ctx->ext.supportedgroups_len + add) 848 * sizeof(*ctx->ext.supportedgroups)); 849 if (s->ext.supportedgroups == NULL) { 850 s->ext.supportedgroups_len = 0; 851 goto err; 852 } 853 s->ext.supportedgroups_len = ctx->ext.supportedgroups_len; 854 } 855 if (ctx->ext.keyshares != NULL) { 856 size_t add = 0; 857 858 if (ctx->ext.keyshares_len == 0) 859 /* Add 1 so allocation won't fail */ 860 add = 1; 861 s->ext.keyshares = OPENSSL_memdup(ctx->ext.keyshares, 862 (ctx->ext.keyshares_len + add) 863 * sizeof(*ctx->ext.keyshares)); 864 if (s->ext.keyshares == NULL) { 865 s->ext.keyshares_len = 0; 866 goto err; 867 } 868 s->ext.keyshares_len = ctx->ext.keyshares_len; 869 } 870 if (ctx->ext.tuples != NULL) { 871 size_t add = 0; 872 873 if (ctx->ext.tuples_len == 0) 874 /* Add 1 so allocation won't fail */ 875 add = 1; 876 s->ext.tuples = OPENSSL_memdup(ctx->ext.tuples, 877 (ctx->ext.tuples_len + add) 878 * sizeof(*ctx->ext.tuples)); 879 if (s->ext.tuples == NULL) { 880 s->ext.tuples_len = 0; 881 goto err; 882 } 883 s->ext.tuples_len = ctx->ext.tuples_len; 884 } 885 886 #ifndef OPENSSL_NO_NEXTPROTONEG 887 s->ext.npn = NULL; 888 #endif 889 890 if (ctx->ext.alpn != NULL) { 891 s->ext.alpn = OPENSSL_malloc(ctx->ext.alpn_len); 892 if (s->ext.alpn == NULL) { 893 s->ext.alpn_len = 0; 894 goto err; 895 } 896 memcpy(s->ext.alpn, ctx->ext.alpn, ctx->ext.alpn_len); 897 s->ext.alpn_len = ctx->ext.alpn_len; 898 } 899 900 s->verified_chain = NULL; 901 s->verify_result = X509_V_OK; 902 903 s->default_passwd_callback = ctx->default_passwd_callback; 904 s->default_passwd_callback_userdata = ctx->default_passwd_callback_userdata; 905 906 s->key_update = SSL_KEY_UPDATE_NONE; 907 908 if (!IS_QUIC_CTX(ctx)) { 909 s->allow_early_data_cb = ctx->allow_early_data_cb; 910 s->allow_early_data_cb_data = ctx->allow_early_data_cb_data; 911 } 912 913 if (!method->ssl_init(ssl)) 914 goto sslerr; 915 916 s->server = (method->ssl_accept == ssl_undefined_function) ? 0 : 1; 917 918 if (!method->ssl_reset(ssl)) 919 goto sslerr; 920 921 #ifndef OPENSSL_NO_PSK 922 s->psk_client_callback = ctx->psk_client_callback; 923 s->psk_server_callback = ctx->psk_server_callback; 924 #endif 925 s->psk_find_session_cb = ctx->psk_find_session_cb; 926 s->psk_use_session_cb = ctx->psk_use_session_cb; 927 928 s->async_cb = ctx->async_cb; 929 s->async_cb_arg = ctx->async_cb_arg; 930 931 s->job = NULL; 932 933 #ifndef OPENSSL_NO_COMP_ALG 934 memcpy(s->cert_comp_prefs, ctx->cert_comp_prefs, sizeof(s->cert_comp_prefs)); 935 #endif 936 if (ctx->client_cert_type != NULL) { 937 s->client_cert_type = OPENSSL_memdup(ctx->client_cert_type, 938 ctx->client_cert_type_len); 939 if (s->client_cert_type == NULL) 940 goto sslerr; 941 s->client_cert_type_len = ctx->client_cert_type_len; 942 } 943 if (ctx->server_cert_type != NULL) { 944 s->server_cert_type = OPENSSL_memdup(ctx->server_cert_type, 945 ctx->server_cert_type_len); 946 if (s->server_cert_type == NULL) 947 goto sslerr; 948 s->server_cert_type_len = ctx->server_cert_type_len; 949 } 950 951 #ifndef OPENSSL_NO_CT 952 if (!SSL_set_ct_validation_callback(ssl, ctx->ct_validation_callback, 953 ctx->ct_validation_callback_arg)) 954 goto sslerr; 955 #endif 956 957 s->ssl_pkey_num = SSL_PKEY_NUM + ctx->sigalg_list_len; 958 return ssl; 959 cerr: 960 ERR_raise(ERR_LIB_SSL, ERR_R_CRYPTO_LIB); 961 goto err; 962 asn1err: 963 ERR_raise(ERR_LIB_SSL, ERR_R_ASN1_LIB); 964 goto err; 965 sslerr: 966 ERR_raise(ERR_LIB_SSL, ERR_R_SSL_LIB); 967 err: 968 SSL_free(ssl); 969 return NULL; 970 } 971 972 SSL *ossl_ssl_connection_new(SSL_CTX *ctx) 973 { 974 return ossl_ssl_connection_new_int(ctx, NULL, ctx->method); 975 } 976 977 int SSL_is_dtls(const SSL *s) 978 { 979 SSL_CONNECTION *sc = SSL_CONNECTION_FROM_SSL(s); 980 981 #ifndef OPENSSL_NO_QUIC 982 if (s->type == SSL_TYPE_QUIC_CONNECTION || s->type == SSL_TYPE_QUIC_XSO) 983 return 0; 984 #endif 985 986 if (sc == NULL) 987 return 0; 988 989 return SSL_CONNECTION_IS_DTLS(sc) ? 1 : 0; 990 } 991 992 int SSL_is_tls(const SSL *s) 993 { 994 SSL_CONNECTION *sc = SSL_CONNECTION_FROM_SSL(s); 995 996 #ifndef OPENSSL_NO_QUIC 997 if (s->type == SSL_TYPE_QUIC_CONNECTION || s->type == SSL_TYPE_QUIC_XSO) 998 return 0; 999 #endif 1000 1001 if (sc == NULL) 1002 return 0; 1003 1004 return SSL_CONNECTION_IS_DTLS(sc) ? 0 : 1; 1005 } 1006 1007 int SSL_is_quic(const SSL *s) 1008 { 1009 return IS_QUIC(s); 1010 } 1011 1012 int SSL_CTX_is_quic(const SSL_CTX *c) 1013 { 1014 return IS_QUIC_CTX(c); 1015 } 1016 1017 int SSL_up_ref(SSL *s) 1018 { 1019 int i; 1020 1021 if (CRYPTO_UP_REF(&s->references, &i) <= 0) 1022 return 0; 1023 1024 REF_PRINT_COUNT("SSL", i, s); 1025 REF_ASSERT_ISNT(i < 2); 1026 return ((i > 1) ? 1 : 0); 1027 } 1028 1029 int SSL_CTX_set_session_id_context(SSL_CTX *ctx, const unsigned char *sid_ctx, 1030 unsigned int sid_ctx_len) 1031 { 1032 if (sid_ctx_len > SSL_MAX_SID_CTX_LENGTH) { 1033 ERR_raise(ERR_LIB_SSL, SSL_R_SSL_SESSION_ID_CONTEXT_TOO_LONG); 1034 return 0; 1035 } 1036 ctx->sid_ctx_length = sid_ctx_len; 1037 memcpy(ctx->sid_ctx, sid_ctx, sid_ctx_len); 1038 1039 return 1; 1040 } 1041 1042 int SSL_set_session_id_context(SSL *ssl, const unsigned char *sid_ctx, 1043 unsigned int sid_ctx_len) 1044 { 1045 SSL_CONNECTION *sc = SSL_CONNECTION_FROM_SSL(ssl); 1046 1047 if (sc == NULL) 1048 return 0; 1049 1050 if (sid_ctx_len > SSL_MAX_SID_CTX_LENGTH) { 1051 ERR_raise(ERR_LIB_SSL, SSL_R_SSL_SESSION_ID_CONTEXT_TOO_LONG); 1052 return 0; 1053 } 1054 sc->sid_ctx_length = sid_ctx_len; 1055 memcpy(sc->sid_ctx, sid_ctx, sid_ctx_len); 1056 1057 return 1; 1058 } 1059 1060 int SSL_CTX_set_generate_session_id(SSL_CTX *ctx, GEN_SESSION_CB cb) 1061 { 1062 if (!CRYPTO_THREAD_write_lock(ctx->lock)) 1063 return 0; 1064 ctx->generate_session_id = cb; 1065 CRYPTO_THREAD_unlock(ctx->lock); 1066 return 1; 1067 } 1068 1069 int SSL_set_generate_session_id(SSL *ssl, GEN_SESSION_CB cb) 1070 { 1071 SSL_CONNECTION *sc = SSL_CONNECTION_FROM_SSL(ssl); 1072 1073 if (sc == NULL || !CRYPTO_THREAD_write_lock(ssl->lock)) 1074 return 0; 1075 sc->generate_session_id = cb; 1076 CRYPTO_THREAD_unlock(ssl->lock); 1077 return 1; 1078 } 1079 1080 int SSL_has_matching_session_id(const SSL *ssl, const unsigned char *id, 1081 unsigned int id_len) 1082 { 1083 /* 1084 * A quick examination of SSL_SESSION_hash and SSL_SESSION_cmp shows how 1085 * we can "construct" a session to give us the desired check - i.e. to 1086 * find if there's a session in the hash table that would conflict with 1087 * any new session built out of this id/id_len and the ssl_version in use 1088 * by this SSL. 1089 */ 1090 SSL_SESSION r, *p; 1091 const SSL_CONNECTION *sc = SSL_CONNECTION_FROM_CONST_SSL(ssl); 1092 1093 if (sc == NULL || id_len > sizeof(r.session_id)) 1094 return 0; 1095 1096 r.ssl_version = sc->version; 1097 r.session_id_length = id_len; 1098 memcpy(r.session_id, id, id_len); 1099 1100 if (!CRYPTO_THREAD_read_lock(sc->session_ctx->lock)) 1101 return 0; 1102 p = lh_SSL_SESSION_retrieve(sc->session_ctx->sessions, &r); 1103 CRYPTO_THREAD_unlock(sc->session_ctx->lock); 1104 return (p != NULL); 1105 } 1106 1107 int SSL_CTX_set_purpose(SSL_CTX *s, int purpose) 1108 { 1109 return X509_VERIFY_PARAM_set_purpose(s->param, purpose); 1110 } 1111 1112 int SSL_set_purpose(SSL *s, int purpose) 1113 { 1114 SSL_CONNECTION *sc = SSL_CONNECTION_FROM_SSL(s); 1115 1116 if (sc == NULL) 1117 return 0; 1118 1119 return X509_VERIFY_PARAM_set_purpose(sc->param, purpose); 1120 } 1121 1122 int SSL_CTX_set_trust(SSL_CTX *s, int trust) 1123 { 1124 return X509_VERIFY_PARAM_set_trust(s->param, trust); 1125 } 1126 1127 int SSL_set_trust(SSL *s, int trust) 1128 { 1129 SSL_CONNECTION *sc = SSL_CONNECTION_FROM_SSL(s); 1130 1131 if (sc == NULL) 1132 return 0; 1133 1134 return X509_VERIFY_PARAM_set_trust(sc->param, trust); 1135 } 1136 1137 int SSL_set1_host(SSL *s, const char *host) 1138 { 1139 SSL_CONNECTION *sc = SSL_CONNECTION_FROM_SSL(s); 1140 1141 if (sc == NULL) 1142 return 0; 1143 1144 /* clear hostname(s) and IP address in any case, also if host parses as an IP address */ 1145 (void)X509_VERIFY_PARAM_set1_host(sc->param, NULL, 0); 1146 (void)X509_VERIFY_PARAM_set1_ip(sc->param, NULL, 0); 1147 if (host == NULL) 1148 return 1; 1149 1150 /* If a host is provided and parses as an IP address, treat it as such. */ 1151 return X509_VERIFY_PARAM_set1_ip_asc(sc->param, host) 1152 || X509_VERIFY_PARAM_set1_host(sc->param, host, 0); 1153 } 1154 1155 int SSL_add1_host(SSL *s, const char *host) 1156 { 1157 SSL_CONNECTION *sc = SSL_CONNECTION_FROM_SSL(s); 1158 1159 if (sc == NULL) 1160 return 0; 1161 1162 /* If a host is provided and parses as an IP address, treat it as such. */ 1163 if (host != NULL) { 1164 ASN1_OCTET_STRING *ip; 1165 char *old_ip; 1166 1167 ip = a2i_IPADDRESS(host); 1168 if (ip != NULL) { 1169 /* We didn't want it; only to check if it *is* an IP address */ 1170 ASN1_OCTET_STRING_free(ip); 1171 1172 old_ip = X509_VERIFY_PARAM_get1_ip_asc(sc->param); 1173 if (old_ip != NULL) { 1174 OPENSSL_free(old_ip); 1175 /* There can be only one IP address */ 1176 ERR_raise_data(ERR_LIB_SSL, ERR_R_PASSED_INVALID_ARGUMENT, 1177 "IP address was already set"); 1178 return 0; 1179 } 1180 1181 return X509_VERIFY_PARAM_set1_ip_asc(sc->param, host); 1182 } 1183 } 1184 1185 return X509_VERIFY_PARAM_add1_host(sc->param, host, 0); 1186 } 1187 1188 void SSL_set_hostflags(SSL *s, unsigned int flags) 1189 { 1190 SSL_CONNECTION *sc = SSL_CONNECTION_FROM_SSL(s); 1191 1192 if (sc == NULL) 1193 return; 1194 1195 X509_VERIFY_PARAM_set_hostflags(sc->param, flags); 1196 } 1197 1198 const char *SSL_get0_peername(SSL *s) 1199 { 1200 SSL_CONNECTION *sc = SSL_CONNECTION_FROM_SSL(s); 1201 1202 if (sc == NULL) 1203 return NULL; 1204 1205 return X509_VERIFY_PARAM_get0_peername(sc->param); 1206 } 1207 1208 int SSL_CTX_dane_enable(SSL_CTX *ctx) 1209 { 1210 return dane_ctx_enable(&ctx->dane); 1211 } 1212 1213 unsigned long SSL_CTX_dane_set_flags(SSL_CTX *ctx, unsigned long flags) 1214 { 1215 unsigned long orig = ctx->dane.flags; 1216 1217 ctx->dane.flags |= flags; 1218 return orig; 1219 } 1220 1221 unsigned long SSL_CTX_dane_clear_flags(SSL_CTX *ctx, unsigned long flags) 1222 { 1223 unsigned long orig = ctx->dane.flags; 1224 1225 ctx->dane.flags &= ~flags; 1226 return orig; 1227 } 1228 1229 int SSL_dane_enable(SSL *s, const char *basedomain) 1230 { 1231 SSL_DANE *dane; 1232 SSL_CONNECTION *sc = SSL_CONNECTION_FROM_SSL(s); 1233 1234 if (sc == NULL) 1235 return 0; 1236 1237 dane = &sc->dane; 1238 if (s->ctx->dane.mdmax == 0) { 1239 ERR_raise(ERR_LIB_SSL, SSL_R_CONTEXT_NOT_DANE_ENABLED); 1240 return 0; 1241 } 1242 if (dane->trecs != NULL) { 1243 ERR_raise(ERR_LIB_SSL, SSL_R_DANE_ALREADY_ENABLED); 1244 return 0; 1245 } 1246 1247 /* 1248 * Default SNI name. This rejects empty names, while set1_host below 1249 * accepts them and disables hostname checks. To avoid side-effects with 1250 * invalid input, set the SNI name first. 1251 */ 1252 if (sc->ext.hostname == NULL) { 1253 if (!SSL_set_tlsext_host_name(s, basedomain)) { 1254 ERR_raise(ERR_LIB_SSL, SSL_R_ERROR_SETTING_TLSA_BASE_DOMAIN); 1255 return -1; 1256 } 1257 } 1258 1259 /* Primary RFC6125 reference identifier */ 1260 if (!X509_VERIFY_PARAM_set1_host(sc->param, basedomain, 0)) { 1261 ERR_raise(ERR_LIB_SSL, SSL_R_ERROR_SETTING_TLSA_BASE_DOMAIN); 1262 return -1; 1263 } 1264 1265 dane->mdpth = -1; 1266 dane->pdpth = -1; 1267 dane->dctx = &s->ctx->dane; 1268 dane->trecs = sk_danetls_record_new_null(); 1269 1270 if (dane->trecs == NULL) { 1271 ERR_raise(ERR_LIB_SSL, ERR_R_CRYPTO_LIB); 1272 return -1; 1273 } 1274 return 1; 1275 } 1276 1277 unsigned long SSL_dane_set_flags(SSL *ssl, unsigned long flags) 1278 { 1279 unsigned long orig; 1280 SSL_CONNECTION *sc = SSL_CONNECTION_FROM_SSL(ssl); 1281 1282 if (sc == NULL) 1283 return 0; 1284 1285 orig = sc->dane.flags; 1286 1287 sc->dane.flags |= flags; 1288 return orig; 1289 } 1290 1291 unsigned long SSL_dane_clear_flags(SSL *ssl, unsigned long flags) 1292 { 1293 unsigned long orig; 1294 SSL_CONNECTION *sc = SSL_CONNECTION_FROM_SSL(ssl); 1295 1296 if (sc == NULL) 1297 return 0; 1298 1299 orig = sc->dane.flags; 1300 1301 sc->dane.flags &= ~flags; 1302 return orig; 1303 } 1304 1305 int SSL_get0_dane_authority(SSL *s, X509 **mcert, EVP_PKEY **mspki) 1306 { 1307 SSL_DANE *dane; 1308 SSL_CONNECTION *sc = SSL_CONNECTION_FROM_SSL(s); 1309 1310 if (sc == NULL) 1311 return -1; 1312 1313 dane = &sc->dane; 1314 1315 if (!DANETLS_ENABLED(dane) || sc->verify_result != X509_V_OK) 1316 return -1; 1317 if (dane->mtlsa) { 1318 if (mcert) 1319 *mcert = dane->mcert; 1320 if (mspki) 1321 *mspki = (dane->mcert == NULL) ? dane->mtlsa->spki : NULL; 1322 } 1323 return dane->mdpth; 1324 } 1325 1326 int SSL_get0_dane_tlsa(SSL *s, uint8_t *usage, uint8_t *selector, 1327 uint8_t *mtype, const unsigned char **data, size_t *dlen) 1328 { 1329 SSL_DANE *dane; 1330 SSL_CONNECTION *sc = SSL_CONNECTION_FROM_SSL(s); 1331 1332 if (sc == NULL) 1333 return -1; 1334 1335 dane = &sc->dane; 1336 1337 if (!DANETLS_ENABLED(dane) || sc->verify_result != X509_V_OK) 1338 return -1; 1339 if (dane->mtlsa) { 1340 if (usage) 1341 *usage = dane->mtlsa->usage; 1342 if (selector) 1343 *selector = dane->mtlsa->selector; 1344 if (mtype) 1345 *mtype = dane->mtlsa->mtype; 1346 if (data) 1347 *data = dane->mtlsa->data; 1348 if (dlen) 1349 *dlen = dane->mtlsa->dlen; 1350 } 1351 return dane->mdpth; 1352 } 1353 1354 SSL_DANE *SSL_get0_dane(SSL *s) 1355 { 1356 SSL_CONNECTION *sc = SSL_CONNECTION_FROM_SSL(s); 1357 1358 if (sc == NULL) 1359 return NULL; 1360 1361 return &sc->dane; 1362 } 1363 1364 int SSL_dane_tlsa_add(SSL *s, uint8_t usage, uint8_t selector, 1365 uint8_t mtype, const unsigned char *data, size_t dlen) 1366 { 1367 SSL_CONNECTION *sc = SSL_CONNECTION_FROM_SSL(s); 1368 1369 if (sc == NULL) 1370 return 0; 1371 1372 return dane_tlsa_add(&sc->dane, usage, selector, mtype, data, dlen); 1373 } 1374 1375 int SSL_CTX_dane_mtype_set(SSL_CTX *ctx, const EVP_MD *md, uint8_t mtype, 1376 uint8_t ord) 1377 { 1378 return dane_mtype_set(&ctx->dane, md, mtype, ord); 1379 } 1380 1381 int SSL_CTX_set1_param(SSL_CTX *ctx, X509_VERIFY_PARAM *vpm) 1382 { 1383 return X509_VERIFY_PARAM_set1(ctx->param, vpm); 1384 } 1385 1386 int SSL_set1_param(SSL *ssl, X509_VERIFY_PARAM *vpm) 1387 { 1388 SSL_CONNECTION *sc = SSL_CONNECTION_FROM_SSL(ssl); 1389 1390 if (sc == NULL) 1391 return 0; 1392 1393 return X509_VERIFY_PARAM_set1(sc->param, vpm); 1394 } 1395 1396 X509_VERIFY_PARAM *SSL_CTX_get0_param(SSL_CTX *ctx) 1397 { 1398 return ctx->param; 1399 } 1400 1401 X509_VERIFY_PARAM *SSL_get0_param(SSL *ssl) 1402 { 1403 SSL_CONNECTION *sc = SSL_CONNECTION_FROM_SSL(ssl); 1404 1405 if (sc == NULL) 1406 return NULL; 1407 1408 return sc->param; 1409 } 1410 1411 void SSL_certs_clear(SSL *s) 1412 { 1413 SSL_CONNECTION *sc = SSL_CONNECTION_FROM_SSL(s); 1414 1415 if (sc == NULL) 1416 return; 1417 1418 ssl_cert_clear_certs(sc->cert); 1419 } 1420 1421 void SSL_free(SSL *s) 1422 { 1423 int i; 1424 1425 if (s == NULL) 1426 return; 1427 CRYPTO_DOWN_REF(&s->references, &i); 1428 REF_PRINT_COUNT("SSL", i, s); 1429 if (i > 0) 1430 return; 1431 REF_ASSERT_ISNT(i < 0); 1432 1433 if (s->method != NULL) 1434 s->method->ssl_free(s); 1435 1436 CRYPTO_free_ex_data(CRYPTO_EX_INDEX_SSL, s, &s->ex_data); 1437 SSL_CTX_free(s->ctx); 1438 CRYPTO_THREAD_lock_free(s->lock); 1439 CRYPTO_FREE_REF(&s->references); 1440 1441 OPENSSL_free(s); 1442 } 1443 1444 void ossl_ssl_connection_free(SSL *ssl) 1445 { 1446 SSL_CONNECTION *s; 1447 1448 s = SSL_CONNECTION_FROM_SSL_ONLY(ssl); 1449 if (s == NULL) 1450 return; 1451 1452 /* 1453 * Ignore return values. This could result in user callbacks being called 1454 * e.g. for the QUIC TLS record layer. So we do this early before we have 1455 * freed other things. 1456 */ 1457 ssl_free_wbio_buffer(s); 1458 RECORD_LAYER_clear(&s->rlayer); 1459 1460 X509_VERIFY_PARAM_free(s->param); 1461 dane_final(&s->dane); 1462 1463 BUF_MEM_free(s->init_buf); 1464 1465 /* add extra stuff */ 1466 sk_SSL_CIPHER_free(s->cipher_list); 1467 sk_SSL_CIPHER_free(s->cipher_list_by_id); 1468 sk_SSL_CIPHER_free(s->tls13_ciphersuites); 1469 sk_SSL_CIPHER_free(s->peer_ciphers); 1470 1471 /* Make the next call work :-) */ 1472 if (s->session != NULL) { 1473 ssl_clear_bad_session(s); 1474 SSL_SESSION_free(s->session); 1475 } 1476 SSL_SESSION_free(s->psksession); 1477 OPENSSL_free(s->psksession_id); 1478 1479 ssl_cert_free(s->cert); 1480 OPENSSL_free(s->shared_sigalgs); 1481 /* Free up if allocated */ 1482 1483 OPENSSL_free(s->ext.hostname); 1484 SSL_CTX_free(s->session_ctx); 1485 OPENSSL_free(s->ext.ecpointformats); 1486 OPENSSL_free(s->ext.peer_ecpointformats); 1487 OPENSSL_free(s->ext.supportedgroups); 1488 OPENSSL_free(s->ext.keyshares); 1489 OPENSSL_free(s->ext.tuples); 1490 OPENSSL_free(s->ext.peer_supportedgroups); 1491 sk_X509_EXTENSION_pop_free(s->ext.ocsp.exts, X509_EXTENSION_free); 1492 #ifndef OPENSSL_NO_OCSP 1493 sk_OCSP_RESPID_pop_free(s->ext.ocsp.ids, OCSP_RESPID_free); 1494 #endif 1495 #ifndef OPENSSL_NO_CT 1496 SCT_LIST_free(s->scts); 1497 OPENSSL_free(s->ext.scts); 1498 #endif 1499 OPENSSL_free(s->ext.ocsp.resp); 1500 OPENSSL_free(s->ext.alpn); 1501 OPENSSL_free(s->ext.tls13_cookie); 1502 if (s->clienthello != NULL) 1503 OPENSSL_free(s->clienthello->pre_proc_exts); 1504 OPENSSL_free(s->clienthello); 1505 OPENSSL_free(s->pha_context); 1506 EVP_MD_CTX_free(s->pha_dgst); 1507 1508 sk_X509_NAME_pop_free(s->ca_names, X509_NAME_free); 1509 sk_X509_NAME_pop_free(s->client_ca_names, X509_NAME_free); 1510 1511 OPENSSL_free(s->client_cert_type); 1512 OPENSSL_free(s->server_cert_type); 1513 1514 OSSL_STACK_OF_X509_free(s->verified_chain); 1515 1516 if (ssl->method != NULL) 1517 ssl->method->ssl_deinit(ssl); 1518 1519 ASYNC_WAIT_CTX_free(s->waitctx); 1520 1521 #if !defined(OPENSSL_NO_NEXTPROTONEG) 1522 OPENSSL_free(s->ext.npn); 1523 #endif 1524 1525 #ifndef OPENSSL_NO_SRTP 1526 sk_SRTP_PROTECTION_PROFILE_free(s->srtp_profiles); 1527 #endif 1528 1529 /* 1530 * We do this late. We want to ensure that any other references we held to 1531 * these BIOs are freed first *before* we call BIO_free_all(), because 1532 * BIO_free_all() will only free each BIO in the chain if the number of 1533 * references to the first BIO have dropped to 0 1534 */ 1535 BIO_free_all(s->wbio); 1536 s->wbio = NULL; 1537 BIO_free_all(s->rbio); 1538 s->rbio = NULL; 1539 OPENSSL_free(s->s3.tmp.valid_flags); 1540 } 1541 1542 void SSL_set0_rbio(SSL *s, BIO *rbio) 1543 { 1544 SSL_CONNECTION *sc = SSL_CONNECTION_FROM_SSL(s); 1545 1546 #ifndef OPENSSL_NO_QUIC 1547 if (IS_QUIC(s)) { 1548 ossl_quic_conn_set0_net_rbio(s, rbio); 1549 return; 1550 } 1551 #endif 1552 1553 if (sc == NULL) 1554 return; 1555 1556 BIO_free_all(sc->rbio); 1557 sc->rbio = rbio; 1558 sc->rlayer.rrlmethod->set1_bio(sc->rlayer.rrl, sc->rbio); 1559 } 1560 1561 void SSL_set0_wbio(SSL *s, BIO *wbio) 1562 { 1563 SSL_CONNECTION *sc = SSL_CONNECTION_FROM_SSL(s); 1564 1565 #ifndef OPENSSL_NO_QUIC 1566 if (IS_QUIC(s)) { 1567 ossl_quic_conn_set0_net_wbio(s, wbio); 1568 return; 1569 } 1570 #endif 1571 1572 if (sc == NULL) 1573 return; 1574 1575 /* 1576 * If the output buffering BIO is still in place, remove it 1577 */ 1578 if (sc->bbio != NULL) 1579 sc->wbio = BIO_pop(sc->wbio); 1580 1581 BIO_free_all(sc->wbio); 1582 sc->wbio = wbio; 1583 1584 /* Re-attach |bbio| to the new |wbio|. */ 1585 if (sc->bbio != NULL) 1586 sc->wbio = BIO_push(sc->bbio, sc->wbio); 1587 1588 sc->rlayer.wrlmethod->set1_bio(sc->rlayer.wrl, sc->wbio); 1589 } 1590 1591 void SSL_set_bio(SSL *s, BIO *rbio, BIO *wbio) 1592 { 1593 /* 1594 * For historical reasons, this function has many different cases in 1595 * ownership handling. 1596 */ 1597 1598 /* If nothing has changed, do nothing */ 1599 if (rbio == SSL_get_rbio(s) && wbio == SSL_get_wbio(s)) 1600 return; 1601 1602 /* 1603 * If the two arguments are equal then one fewer reference is granted by the 1604 * caller than we want to take 1605 */ 1606 if (rbio != NULL && rbio == wbio) { 1607 if (!BIO_up_ref(rbio)) 1608 return; 1609 } 1610 1611 /* 1612 * If only the wbio is changed only adopt one reference. 1613 */ 1614 if (rbio == SSL_get_rbio(s)) { 1615 SSL_set0_wbio(s, wbio); 1616 return; 1617 } 1618 /* 1619 * There is an asymmetry here for historical reasons. If only the rbio is 1620 * changed AND the rbio and wbio were originally different, then we only 1621 * adopt one reference. 1622 */ 1623 if (wbio == SSL_get_wbio(s) && SSL_get_rbio(s) != SSL_get_wbio(s)) { 1624 SSL_set0_rbio(s, rbio); 1625 return; 1626 } 1627 1628 /* Otherwise, adopt both references. */ 1629 SSL_set0_rbio(s, rbio); 1630 SSL_set0_wbio(s, wbio); 1631 } 1632 1633 BIO *SSL_get_rbio(const SSL *s) 1634 { 1635 const SSL_CONNECTION *sc = SSL_CONNECTION_FROM_CONST_SSL(s); 1636 1637 #ifndef OPENSSL_NO_QUIC 1638 if (IS_QUIC(s)) 1639 return ossl_quic_conn_get_net_rbio(s); 1640 #endif 1641 1642 if (sc == NULL) 1643 return NULL; 1644 1645 return sc->rbio; 1646 } 1647 1648 BIO *SSL_get_wbio(const SSL *s) 1649 { 1650 const SSL_CONNECTION *sc = SSL_CONNECTION_FROM_CONST_SSL(s); 1651 1652 #ifndef OPENSSL_NO_QUIC 1653 if (IS_QUIC(s)) 1654 return ossl_quic_conn_get_net_wbio(s); 1655 #endif 1656 1657 if (sc == NULL) 1658 return NULL; 1659 1660 if (sc->bbio != NULL) { 1661 /* 1662 * If |bbio| is active, the true caller-configured BIO is its 1663 * |next_bio|. 1664 */ 1665 return BIO_next(sc->bbio); 1666 } 1667 return sc->wbio; 1668 } 1669 1670 int SSL_get_fd(const SSL *s) 1671 { 1672 return SSL_get_rfd(s); 1673 } 1674 1675 int SSL_get_rfd(const SSL *s) 1676 { 1677 int ret = -1; 1678 BIO *b, *r; 1679 1680 b = SSL_get_rbio(s); 1681 r = BIO_find_type(b, BIO_TYPE_DESCRIPTOR); 1682 if (r != NULL) 1683 BIO_get_fd(r, &ret); 1684 return ret; 1685 } 1686 1687 int SSL_get_wfd(const SSL *s) 1688 { 1689 int ret = -1; 1690 BIO *b, *r; 1691 1692 b = SSL_get_wbio(s); 1693 r = BIO_find_type(b, BIO_TYPE_DESCRIPTOR); 1694 if (r != NULL) 1695 BIO_get_fd(r, &ret); 1696 return ret; 1697 } 1698 1699 #ifndef OPENSSL_NO_SOCK 1700 static const BIO_METHOD *fd_method(SSL *s) 1701 { 1702 #ifndef OPENSSL_NO_DGRAM 1703 if (IS_QUIC(s)) 1704 return BIO_s_datagram(); 1705 #endif 1706 1707 return BIO_s_socket(); 1708 } 1709 1710 int SSL_set_fd(SSL *s, int fd) 1711 { 1712 int ret = 0; 1713 BIO *bio = NULL; 1714 1715 if (s->type == SSL_TYPE_QUIC_XSO) { 1716 ERR_raise(ERR_LIB_SSL, SSL_R_CONN_USE_ONLY); 1717 goto err; 1718 } 1719 1720 bio = BIO_new(fd_method(s)); 1721 1722 if (bio == NULL) { 1723 ERR_raise(ERR_LIB_SSL, ERR_R_BUF_LIB); 1724 goto err; 1725 } 1726 BIO_set_fd(bio, fd, BIO_NOCLOSE); 1727 SSL_set_bio(s, bio, bio); 1728 ret = 1; 1729 err: 1730 return ret; 1731 } 1732 1733 int SSL_set_wfd(SSL *s, int fd) 1734 { 1735 BIO *rbio = SSL_get_rbio(s); 1736 int desired_type = IS_QUIC(s) ? BIO_TYPE_DGRAM : BIO_TYPE_SOCKET; 1737 1738 if (s->type == SSL_TYPE_QUIC_XSO) { 1739 ERR_raise(ERR_LIB_SSL, SSL_R_CONN_USE_ONLY); 1740 return 0; 1741 } 1742 1743 if (rbio == NULL || BIO_method_type(rbio) != desired_type 1744 || (int)BIO_get_fd(rbio, NULL) != fd) { 1745 BIO *bio = BIO_new(fd_method(s)); 1746 1747 if (bio == NULL) { 1748 ERR_raise(ERR_LIB_SSL, ERR_R_BUF_LIB); 1749 return 0; 1750 } 1751 BIO_set_fd(bio, fd, BIO_NOCLOSE); 1752 SSL_set0_wbio(s, bio); 1753 } else { 1754 if (!BIO_up_ref(rbio)) 1755 return 0; 1756 SSL_set0_wbio(s, rbio); 1757 } 1758 return 1; 1759 } 1760 1761 int SSL_set_rfd(SSL *s, int fd) 1762 { 1763 BIO *wbio = SSL_get_wbio(s); 1764 int desired_type = IS_QUIC(s) ? BIO_TYPE_DGRAM : BIO_TYPE_SOCKET; 1765 1766 if (s->type == SSL_TYPE_QUIC_XSO) { 1767 ERR_raise(ERR_LIB_SSL, SSL_R_CONN_USE_ONLY); 1768 return 0; 1769 } 1770 1771 if (wbio == NULL || BIO_method_type(wbio) != desired_type 1772 || ((int)BIO_get_fd(wbio, NULL) != fd)) { 1773 BIO *bio = BIO_new(fd_method(s)); 1774 1775 if (bio == NULL) { 1776 ERR_raise(ERR_LIB_SSL, ERR_R_BUF_LIB); 1777 return 0; 1778 } 1779 BIO_set_fd(bio, fd, BIO_NOCLOSE); 1780 SSL_set0_rbio(s, bio); 1781 } else { 1782 if (!BIO_up_ref(wbio)) 1783 return 0; 1784 SSL_set0_rbio(s, wbio); 1785 } 1786 1787 return 1; 1788 } 1789 #endif 1790 1791 /* return length of latest Finished message we sent, copy to 'buf' */ 1792 size_t SSL_get_finished(const SSL *s, void *buf, size_t count) 1793 { 1794 size_t ret = 0; 1795 const SSL_CONNECTION *sc = SSL_CONNECTION_FROM_CONST_SSL(s); 1796 1797 if (sc == NULL) 1798 return 0; 1799 1800 ret = sc->s3.tmp.finish_md_len; 1801 if (count > ret) 1802 count = ret; 1803 memcpy(buf, sc->s3.tmp.finish_md, count); 1804 return ret; 1805 } 1806 1807 /* return length of latest Finished message we expected, copy to 'buf' */ 1808 size_t SSL_get_peer_finished(const SSL *s, void *buf, size_t count) 1809 { 1810 size_t ret = 0; 1811 const SSL_CONNECTION *sc = SSL_CONNECTION_FROM_CONST_SSL(s); 1812 1813 if (sc == NULL) 1814 return 0; 1815 1816 ret = sc->s3.tmp.peer_finish_md_len; 1817 if (count > ret) 1818 count = ret; 1819 memcpy(buf, sc->s3.tmp.peer_finish_md, count); 1820 return ret; 1821 } 1822 1823 int SSL_get_verify_mode(const SSL *s) 1824 { 1825 const SSL_CONNECTION *sc = SSL_CONNECTION_FROM_CONST_SSL(s); 1826 1827 if (sc == NULL) 1828 return 0; 1829 1830 return sc->verify_mode; 1831 } 1832 1833 int SSL_get_verify_depth(const SSL *s) 1834 { 1835 const SSL_CONNECTION *sc = SSL_CONNECTION_FROM_CONST_SSL(s); 1836 1837 if (sc == NULL) 1838 return 0; 1839 1840 return X509_VERIFY_PARAM_get_depth(sc->param); 1841 } 1842 1843 int (*SSL_get_verify_callback(const SSL *s))(int, X509_STORE_CTX *) 1844 { 1845 const SSL_CONNECTION *sc = SSL_CONNECTION_FROM_CONST_SSL(s); 1846 1847 if (sc == NULL) 1848 return NULL; 1849 1850 return sc->verify_callback; 1851 } 1852 1853 int SSL_CTX_get_verify_mode(const SSL_CTX *ctx) 1854 { 1855 return ctx->verify_mode; 1856 } 1857 1858 int SSL_CTX_get_verify_depth(const SSL_CTX *ctx) 1859 { 1860 return X509_VERIFY_PARAM_get_depth(ctx->param); 1861 } 1862 1863 int (*SSL_CTX_get_verify_callback(const SSL_CTX *ctx))(int, X509_STORE_CTX *) 1864 { 1865 return ctx->default_verify_callback; 1866 } 1867 1868 void SSL_set_verify(SSL *s, int mode, 1869 int (*callback)(int ok, X509_STORE_CTX *ctx)) 1870 { 1871 SSL_CONNECTION *sc = SSL_CONNECTION_FROM_SSL(s); 1872 1873 if (sc == NULL) 1874 return; 1875 1876 sc->verify_mode = mode; 1877 if (callback != NULL) 1878 sc->verify_callback = callback; 1879 } 1880 1881 void SSL_set_verify_depth(SSL *s, int depth) 1882 { 1883 SSL_CONNECTION *sc = SSL_CONNECTION_FROM_SSL(s); 1884 1885 if (sc == NULL) 1886 return; 1887 1888 X509_VERIFY_PARAM_set_depth(sc->param, depth); 1889 } 1890 1891 void SSL_set_read_ahead(SSL *s, int yes) 1892 { 1893 SSL_CONNECTION *sc = SSL_CONNECTION_FROM_SSL_ONLY(s); 1894 OSSL_PARAM options[2], *opts = options; 1895 1896 if (sc == NULL) 1897 return; 1898 1899 RECORD_LAYER_set_read_ahead(&sc->rlayer, yes); 1900 1901 *opts++ = OSSL_PARAM_construct_int(OSSL_LIBSSL_RECORD_LAYER_PARAM_READ_AHEAD, 1902 &sc->rlayer.read_ahead); 1903 *opts = OSSL_PARAM_construct_end(); 1904 1905 /* Ignore return value */ 1906 sc->rlayer.rrlmethod->set_options(sc->rlayer.rrl, options); 1907 } 1908 1909 int SSL_get_read_ahead(const SSL *s) 1910 { 1911 const SSL_CONNECTION *sc = SSL_CONNECTION_FROM_CONST_SSL_ONLY(s); 1912 1913 if (sc == NULL) 1914 return 0; 1915 1916 return RECORD_LAYER_get_read_ahead(&sc->rlayer); 1917 } 1918 1919 int SSL_pending(const SSL *s) 1920 { 1921 size_t pending = s->method->ssl_pending(s); 1922 1923 /* 1924 * SSL_pending cannot work properly if read-ahead is enabled 1925 * (SSL_[CTX_]ctrl(..., SSL_CTRL_SET_READ_AHEAD, 1, NULL)), and it is 1926 * impossible to fix since SSL_pending cannot report errors that may be 1927 * observed while scanning the new data. (Note that SSL_pending() is 1928 * often used as a boolean value, so we'd better not return -1.) 1929 * 1930 * SSL_pending also cannot work properly if the value >INT_MAX. In that case 1931 * we just return INT_MAX. 1932 */ 1933 return pending < INT_MAX ? (int)pending : INT_MAX; 1934 } 1935 1936 int SSL_has_pending(const SSL *s) 1937 { 1938 /* 1939 * Similar to SSL_pending() but returns a 1 to indicate that we have 1940 * processed or unprocessed data available or 0 otherwise (as opposed to the 1941 * number of bytes available). Unlike SSL_pending() this will take into 1942 * account read_ahead data. A 1 return simply indicates that we have data. 1943 * That data may not result in any application data, or we may fail to parse 1944 * the records for some reason. 1945 */ 1946 const SSL_CONNECTION *sc; 1947 1948 #ifndef OPENSSL_NO_QUIC 1949 if (IS_QUIC(s)) 1950 return ossl_quic_has_pending(s); 1951 #endif 1952 1953 sc = SSL_CONNECTION_FROM_CONST_SSL(s); 1954 1955 /* Check buffered app data if any first */ 1956 if (SSL_CONNECTION_IS_DTLS(sc)) { 1957 TLS_RECORD *rdata; 1958 pitem *item, *iter; 1959 1960 iter = pqueue_iterator(sc->rlayer.d->buffered_app_data); 1961 while ((item = pqueue_next(&iter)) != NULL) { 1962 rdata = item->data; 1963 if (rdata->length > 0) 1964 return 1; 1965 } 1966 } 1967 1968 if (RECORD_LAYER_processed_read_pending(&sc->rlayer)) 1969 return 1; 1970 1971 return RECORD_LAYER_read_pending(&sc->rlayer); 1972 } 1973 1974 X509 *SSL_get1_peer_certificate(const SSL *s) 1975 { 1976 X509 *r = SSL_get0_peer_certificate(s); 1977 1978 if (r != NULL && !X509_up_ref(r)) 1979 return NULL; 1980 1981 return r; 1982 } 1983 1984 X509 *SSL_get0_peer_certificate(const SSL *s) 1985 { 1986 const SSL_CONNECTION *sc = SSL_CONNECTION_FROM_CONST_SSL(s); 1987 1988 if (sc == NULL) 1989 return NULL; 1990 1991 if (sc->session == NULL) 1992 return NULL; 1993 else 1994 return sc->session->peer; 1995 } 1996 1997 STACK_OF(X509) *SSL_get_peer_cert_chain(const SSL *s) 1998 { 1999 STACK_OF(X509) *r; 2000 const SSL_CONNECTION *sc = SSL_CONNECTION_FROM_CONST_SSL(s); 2001 2002 if (sc == NULL) 2003 return NULL; 2004 2005 if (sc->session == NULL) 2006 r = NULL; 2007 else 2008 r = sc->session->peer_chain; 2009 2010 /* 2011 * If we are a client, cert_chain includes the peer's own certificate; if 2012 * we are a server, it does not. 2013 */ 2014 2015 return r; 2016 } 2017 2018 /* 2019 * Now in theory, since the calling process own 't' it should be safe to 2020 * modify. We need to be able to read f without being hassled 2021 */ 2022 int SSL_copy_session_id(SSL *t, const SSL *f) 2023 { 2024 int i; 2025 /* TODO(QUIC FUTURE): Not allowed for QUIC currently. */ 2026 SSL_CONNECTION *tsc = SSL_CONNECTION_FROM_SSL_ONLY(t); 2027 const SSL_CONNECTION *fsc = SSL_CONNECTION_FROM_CONST_SSL_ONLY(f); 2028 2029 if (tsc == NULL || fsc == NULL) 2030 return 0; 2031 2032 /* Do we need to do SSL locking? */ 2033 if (!SSL_set_session(t, SSL_get_session(f))) { 2034 return 0; 2035 } 2036 2037 /* 2038 * what if we are setup for one protocol version but want to talk another 2039 */ 2040 if (t->method != f->method) { 2041 t->method->ssl_deinit(t); 2042 t->method = f->method; 2043 if (t->method->ssl_init(t) == 0) 2044 return 0; 2045 } 2046 2047 CRYPTO_UP_REF(&fsc->cert->references, &i); 2048 ssl_cert_free(tsc->cert); 2049 tsc->cert = fsc->cert; 2050 if (!SSL_set_session_id_context(t, fsc->sid_ctx, (int)fsc->sid_ctx_length)) { 2051 return 0; 2052 } 2053 2054 return 1; 2055 } 2056 2057 /* Fix this so it checks all the valid key/cert options */ 2058 int SSL_CTX_check_private_key(const SSL_CTX *ctx) 2059 { 2060 if ((ctx == NULL) || (ctx->cert->key->x509 == NULL)) { 2061 ERR_raise(ERR_LIB_SSL, SSL_R_NO_CERTIFICATE_ASSIGNED); 2062 return 0; 2063 } 2064 if (ctx->cert->key->privatekey == NULL) { 2065 ERR_raise(ERR_LIB_SSL, SSL_R_NO_PRIVATE_KEY_ASSIGNED); 2066 return 0; 2067 } 2068 return X509_check_private_key(ctx->cert->key->x509, ctx->cert->key->privatekey); 2069 } 2070 2071 /* Fix this function so that it takes an optional type parameter */ 2072 int SSL_check_private_key(const SSL *ssl) 2073 { 2074 const SSL_CONNECTION *sc; 2075 2076 if ((sc = SSL_CONNECTION_FROM_CONST_SSL(ssl)) == NULL) { 2077 ERR_raise(ERR_LIB_SSL, ERR_R_PASSED_NULL_PARAMETER); 2078 return 0; 2079 } 2080 if (sc->cert->key->x509 == NULL) { 2081 ERR_raise(ERR_LIB_SSL, SSL_R_NO_CERTIFICATE_ASSIGNED); 2082 return 0; 2083 } 2084 if (sc->cert->key->privatekey == NULL) { 2085 ERR_raise(ERR_LIB_SSL, SSL_R_NO_PRIVATE_KEY_ASSIGNED); 2086 return 0; 2087 } 2088 return X509_check_private_key(sc->cert->key->x509, 2089 sc->cert->key->privatekey); 2090 } 2091 2092 int SSL_waiting_for_async(SSL *s) 2093 { 2094 SSL_CONNECTION *sc = SSL_CONNECTION_FROM_SSL(s); 2095 2096 if (sc == NULL) 2097 return 0; 2098 2099 if (sc->job) 2100 return 1; 2101 2102 return 0; 2103 } 2104 2105 int SSL_get_all_async_fds(SSL *s, OSSL_ASYNC_FD *fds, size_t *numfds) 2106 { 2107 ASYNC_WAIT_CTX *ctx; 2108 SSL_CONNECTION *sc = SSL_CONNECTION_FROM_SSL(s); 2109 2110 if (sc == NULL) 2111 return 0; 2112 2113 if ((ctx = sc->waitctx) == NULL) 2114 return 0; 2115 return ASYNC_WAIT_CTX_get_all_fds(ctx, fds, numfds); 2116 } 2117 2118 int SSL_get_changed_async_fds(SSL *s, OSSL_ASYNC_FD *addfd, size_t *numaddfds, 2119 OSSL_ASYNC_FD *delfd, size_t *numdelfds) 2120 { 2121 ASYNC_WAIT_CTX *ctx; 2122 SSL_CONNECTION *sc = SSL_CONNECTION_FROM_SSL(s); 2123 2124 if (sc == NULL) 2125 return 0; 2126 2127 if ((ctx = sc->waitctx) == NULL) 2128 return 0; 2129 return ASYNC_WAIT_CTX_get_changed_fds(ctx, addfd, numaddfds, delfd, 2130 numdelfds); 2131 } 2132 2133 int SSL_CTX_set_async_callback(SSL_CTX *ctx, SSL_async_callback_fn callback) 2134 { 2135 ctx->async_cb = callback; 2136 return 1; 2137 } 2138 2139 int SSL_CTX_set_async_callback_arg(SSL_CTX *ctx, void *arg) 2140 { 2141 ctx->async_cb_arg = arg; 2142 return 1; 2143 } 2144 2145 int SSL_set_async_callback(SSL *s, SSL_async_callback_fn callback) 2146 { 2147 SSL_CONNECTION *sc = SSL_CONNECTION_FROM_SSL(s); 2148 2149 if (sc == NULL) 2150 return 0; 2151 2152 sc->async_cb = callback; 2153 return 1; 2154 } 2155 2156 int SSL_set_async_callback_arg(SSL *s, void *arg) 2157 { 2158 SSL_CONNECTION *sc = SSL_CONNECTION_FROM_SSL(s); 2159 2160 if (sc == NULL) 2161 return 0; 2162 2163 sc->async_cb_arg = arg; 2164 return 1; 2165 } 2166 2167 int SSL_get_async_status(SSL *s, int *status) 2168 { 2169 ASYNC_WAIT_CTX *ctx; 2170 SSL_CONNECTION *sc = SSL_CONNECTION_FROM_SSL(s); 2171 2172 if (sc == NULL) 2173 return 0; 2174 2175 if ((ctx = sc->waitctx) == NULL) 2176 return 0; 2177 *status = ASYNC_WAIT_CTX_get_status(ctx); 2178 return 1; 2179 } 2180 2181 int SSL_accept(SSL *s) 2182 { 2183 SSL_CONNECTION *sc = SSL_CONNECTION_FROM_SSL(s); 2184 2185 #ifndef OPENSSL_NO_QUIC 2186 if (IS_QUIC(s)) 2187 return s->method->ssl_accept(s); 2188 #endif 2189 2190 if (sc == NULL) 2191 return 0; 2192 2193 if (sc->handshake_func == NULL) { 2194 /* Not properly initialized yet */ 2195 SSL_set_accept_state(s); 2196 } 2197 2198 return SSL_do_handshake(s); 2199 } 2200 2201 int SSL_connect(SSL *s) 2202 { 2203 SSL_CONNECTION *sc = SSL_CONNECTION_FROM_SSL(s); 2204 2205 #ifndef OPENSSL_NO_QUIC 2206 if (IS_QUIC(s)) 2207 return s->method->ssl_connect(s); 2208 #endif 2209 2210 if (sc == NULL) 2211 return 0; 2212 2213 if (sc->handshake_func == NULL) { 2214 /* Not properly initialized yet */ 2215 SSL_set_connect_state(s); 2216 } 2217 2218 return SSL_do_handshake(s); 2219 } 2220 2221 long SSL_get_default_timeout(const SSL *s) 2222 { 2223 return (long int)ossl_time2seconds(s->method->get_timeout()); 2224 } 2225 2226 static int ssl_async_wait_ctx_cb(void *arg) 2227 { 2228 SSL *s = (SSL *)arg; 2229 SSL_CONNECTION *sc = SSL_CONNECTION_FROM_SSL(s); 2230 2231 if (sc == NULL) 2232 return 0; 2233 2234 return sc->async_cb(s, sc->async_cb_arg); 2235 } 2236 2237 static int ssl_start_async_job(SSL *s, struct ssl_async_args *args, 2238 int (*func)(void *)) 2239 { 2240 int ret; 2241 SSL_CONNECTION *sc = SSL_CONNECTION_FROM_SSL(s); 2242 2243 if (sc == NULL) 2244 return 0; 2245 2246 if (sc->waitctx == NULL) { 2247 sc->waitctx = ASYNC_WAIT_CTX_new(); 2248 if (sc->waitctx == NULL) 2249 return -1; 2250 if (sc->async_cb != NULL 2251 && !ASYNC_WAIT_CTX_set_callback(sc->waitctx, ssl_async_wait_ctx_cb, s)) 2252 return -1; 2253 } 2254 2255 sc->rwstate = SSL_NOTHING; 2256 switch (ASYNC_start_job(&sc->job, sc->waitctx, &ret, func, args, 2257 sizeof(struct ssl_async_args))) { 2258 case ASYNC_ERR: 2259 sc->rwstate = SSL_NOTHING; 2260 ERR_raise(ERR_LIB_SSL, SSL_R_FAILED_TO_INIT_ASYNC); 2261 return -1; 2262 case ASYNC_PAUSE: 2263 sc->rwstate = SSL_ASYNC_PAUSED; 2264 return -1; 2265 case ASYNC_NO_JOBS: 2266 sc->rwstate = SSL_ASYNC_NO_JOBS; 2267 return -1; 2268 case ASYNC_FINISH: 2269 sc->job = NULL; 2270 return ret; 2271 default: 2272 sc->rwstate = SSL_NOTHING; 2273 ERR_raise(ERR_LIB_SSL, ERR_R_INTERNAL_ERROR); 2274 /* Shouldn't happen */ 2275 return -1; 2276 } 2277 } 2278 2279 static int ssl_io_intern(void *vargs) 2280 { 2281 struct ssl_async_args *args; 2282 SSL *s; 2283 void *buf; 2284 size_t num; 2285 SSL_CONNECTION *sc; 2286 2287 args = (struct ssl_async_args *)vargs; 2288 s = args->s; 2289 buf = args->buf; 2290 num = args->num; 2291 if ((sc = SSL_CONNECTION_FROM_SSL(s)) == NULL) 2292 return -1; 2293 2294 switch (args->type) { 2295 case READFUNC: 2296 return args->f.func_read(s, buf, num, &sc->asyncrw); 2297 case WRITEFUNC: 2298 return args->f.func_write(s, buf, num, &sc->asyncrw); 2299 case OTHERFUNC: 2300 return args->f.func_other(s); 2301 } 2302 return -1; 2303 } 2304 2305 int ssl_read_internal(SSL *s, void *buf, size_t num, size_t *readbytes) 2306 { 2307 SSL_CONNECTION *sc = SSL_CONNECTION_FROM_SSL(s); 2308 2309 #ifndef OPENSSL_NO_QUIC 2310 if (IS_QUIC(s)) 2311 return s->method->ssl_read(s, buf, num, readbytes); 2312 #endif 2313 2314 if (sc == NULL) 2315 return -1; 2316 2317 if (sc->handshake_func == NULL) { 2318 ERR_raise(ERR_LIB_SSL, SSL_R_UNINITIALIZED); 2319 return -1; 2320 } 2321 2322 if (sc->shutdown & SSL_RECEIVED_SHUTDOWN) { 2323 sc->rwstate = SSL_NOTHING; 2324 return 0; 2325 } 2326 2327 if (sc->early_data_state == SSL_EARLY_DATA_CONNECT_RETRY 2328 || sc->early_data_state == SSL_EARLY_DATA_ACCEPT_RETRY) { 2329 ERR_raise(ERR_LIB_SSL, ERR_R_SHOULD_NOT_HAVE_BEEN_CALLED); 2330 return 0; 2331 } 2332 /* 2333 * If we are a client and haven't received the ServerHello etc then we 2334 * better do that 2335 */ 2336 if (!ossl_statem_check_finish_init(sc, 0)) 2337 return -1; 2338 2339 if ((sc->mode & SSL_MODE_ASYNC) && ASYNC_get_current_job() == NULL) { 2340 struct ssl_async_args args; 2341 int ret; 2342 2343 args.s = s; 2344 args.buf = buf; 2345 args.num = num; 2346 args.type = READFUNC; 2347 args.f.func_read = s->method->ssl_read; 2348 2349 ret = ssl_start_async_job(s, &args, ssl_io_intern); 2350 *readbytes = sc->asyncrw; 2351 return ret; 2352 } else { 2353 return s->method->ssl_read(s, buf, num, readbytes); 2354 } 2355 } 2356 2357 int SSL_read(SSL *s, void *buf, int num) 2358 { 2359 int ret; 2360 size_t readbytes; 2361 2362 if (num < 0) { 2363 ERR_raise(ERR_LIB_SSL, SSL_R_BAD_LENGTH); 2364 return -1; 2365 } 2366 2367 ret = ssl_read_internal(s, buf, (size_t)num, &readbytes); 2368 2369 /* 2370 * The cast is safe here because ret should be <= INT_MAX because num is 2371 * <= INT_MAX 2372 */ 2373 if (ret > 0) 2374 ret = (int)readbytes; 2375 2376 return ret; 2377 } 2378 2379 int SSL_read_ex(SSL *s, void *buf, size_t num, size_t *readbytes) 2380 { 2381 int ret = ssl_read_internal(s, buf, num, readbytes); 2382 2383 if (ret < 0) 2384 ret = 0; 2385 return ret; 2386 } 2387 2388 int SSL_read_early_data(SSL *s, void *buf, size_t num, size_t *readbytes) 2389 { 2390 int ret; 2391 SSL_CONNECTION *sc = SSL_CONNECTION_FROM_SSL_ONLY(s); 2392 2393 /* TODO(QUIC 0RTT): 0-RTT support */ 2394 if (sc == NULL || !sc->server) { 2395 ERR_raise(ERR_LIB_SSL, ERR_R_SHOULD_NOT_HAVE_BEEN_CALLED); 2396 return SSL_READ_EARLY_DATA_ERROR; 2397 } 2398 2399 switch (sc->early_data_state) { 2400 case SSL_EARLY_DATA_NONE: 2401 if (!SSL_in_before(s)) { 2402 ERR_raise(ERR_LIB_SSL, ERR_R_SHOULD_NOT_HAVE_BEEN_CALLED); 2403 return SSL_READ_EARLY_DATA_ERROR; 2404 } 2405 /* fall through */ 2406 2407 case SSL_EARLY_DATA_ACCEPT_RETRY: 2408 sc->early_data_state = SSL_EARLY_DATA_ACCEPTING; 2409 ret = SSL_accept(s); 2410 if (ret <= 0) { 2411 /* NBIO or error */ 2412 sc->early_data_state = SSL_EARLY_DATA_ACCEPT_RETRY; 2413 return SSL_READ_EARLY_DATA_ERROR; 2414 } 2415 /* fall through */ 2416 2417 case SSL_EARLY_DATA_READ_RETRY: 2418 if (sc->ext.early_data == SSL_EARLY_DATA_ACCEPTED) { 2419 sc->early_data_state = SSL_EARLY_DATA_READING; 2420 ret = SSL_read_ex(s, buf, num, readbytes); 2421 /* 2422 * State machine will update early_data_state to 2423 * SSL_EARLY_DATA_FINISHED_READING if we get an EndOfEarlyData 2424 * message 2425 */ 2426 if (ret > 0 || (ret <= 0 && sc->early_data_state != SSL_EARLY_DATA_FINISHED_READING)) { 2427 sc->early_data_state = SSL_EARLY_DATA_READ_RETRY; 2428 return ret > 0 ? SSL_READ_EARLY_DATA_SUCCESS 2429 : SSL_READ_EARLY_DATA_ERROR; 2430 } 2431 } else { 2432 sc->early_data_state = SSL_EARLY_DATA_FINISHED_READING; 2433 } 2434 *readbytes = 0; 2435 return SSL_READ_EARLY_DATA_FINISH; 2436 2437 default: 2438 ERR_raise(ERR_LIB_SSL, ERR_R_SHOULD_NOT_HAVE_BEEN_CALLED); 2439 return SSL_READ_EARLY_DATA_ERROR; 2440 } 2441 } 2442 2443 int SSL_get_early_data_status(const SSL *s) 2444 { 2445 const SSL_CONNECTION *sc = SSL_CONNECTION_FROM_CONST_SSL_ONLY(s); 2446 2447 /* TODO(QUIC 0RTT): 0-RTT support */ 2448 if (sc == NULL) 2449 return 0; 2450 2451 return sc->ext.early_data; 2452 } 2453 2454 static int ssl_peek_internal(SSL *s, void *buf, size_t num, size_t *readbytes) 2455 { 2456 SSL_CONNECTION *sc = SSL_CONNECTION_FROM_SSL(s); 2457 2458 #ifndef OPENSSL_NO_QUIC 2459 if (IS_QUIC(s)) 2460 return s->method->ssl_peek(s, buf, num, readbytes); 2461 #endif 2462 2463 if (sc == NULL) 2464 return 0; 2465 2466 if (sc->handshake_func == NULL) { 2467 ERR_raise(ERR_LIB_SSL, SSL_R_UNINITIALIZED); 2468 return -1; 2469 } 2470 2471 if (sc->shutdown & SSL_RECEIVED_SHUTDOWN) { 2472 return 0; 2473 } 2474 if ((sc->mode & SSL_MODE_ASYNC) && ASYNC_get_current_job() == NULL) { 2475 struct ssl_async_args args; 2476 int ret; 2477 2478 args.s = s; 2479 args.buf = buf; 2480 args.num = num; 2481 args.type = READFUNC; 2482 args.f.func_read = s->method->ssl_peek; 2483 2484 ret = ssl_start_async_job(s, &args, ssl_io_intern); 2485 *readbytes = sc->asyncrw; 2486 return ret; 2487 } else { 2488 return s->method->ssl_peek(s, buf, num, readbytes); 2489 } 2490 } 2491 2492 int SSL_peek(SSL *s, void *buf, int num) 2493 { 2494 int ret; 2495 size_t readbytes; 2496 2497 if (num < 0) { 2498 ERR_raise(ERR_LIB_SSL, SSL_R_BAD_LENGTH); 2499 return -1; 2500 } 2501 2502 ret = ssl_peek_internal(s, buf, (size_t)num, &readbytes); 2503 2504 /* 2505 * The cast is safe here because ret should be <= INT_MAX because num is 2506 * <= INT_MAX 2507 */ 2508 if (ret > 0) 2509 ret = (int)readbytes; 2510 2511 return ret; 2512 } 2513 2514 int SSL_peek_ex(SSL *s, void *buf, size_t num, size_t *readbytes) 2515 { 2516 int ret = ssl_peek_internal(s, buf, num, readbytes); 2517 2518 if (ret < 0) 2519 ret = 0; 2520 return ret; 2521 } 2522 2523 int ssl_write_internal(SSL *s, const void *buf, size_t num, 2524 uint64_t flags, size_t *written) 2525 { 2526 SSL_CONNECTION *sc = SSL_CONNECTION_FROM_SSL(s); 2527 2528 #ifndef OPENSSL_NO_QUIC 2529 if (IS_QUIC(s)) 2530 return ossl_quic_write_flags(s, buf, num, flags, written); 2531 #endif 2532 2533 if (sc == NULL) 2534 return 0; 2535 2536 if (sc->handshake_func == NULL) { 2537 ERR_raise(ERR_LIB_SSL, SSL_R_UNINITIALIZED); 2538 return -1; 2539 } 2540 2541 if (sc->shutdown & SSL_SENT_SHUTDOWN) { 2542 sc->rwstate = SSL_NOTHING; 2543 ERR_raise(ERR_LIB_SSL, SSL_R_PROTOCOL_IS_SHUTDOWN); 2544 return -1; 2545 } 2546 2547 if (flags != 0) { 2548 ERR_raise(ERR_LIB_SSL, SSL_R_UNSUPPORTED_WRITE_FLAG); 2549 return -1; 2550 } 2551 2552 if (sc->early_data_state == SSL_EARLY_DATA_CONNECT_RETRY 2553 || sc->early_data_state == SSL_EARLY_DATA_ACCEPT_RETRY 2554 || sc->early_data_state == SSL_EARLY_DATA_READ_RETRY) { 2555 ERR_raise(ERR_LIB_SSL, ERR_R_SHOULD_NOT_HAVE_BEEN_CALLED); 2556 return 0; 2557 } 2558 /* If we are a client and haven't sent the Finished we better do that */ 2559 if (!ossl_statem_check_finish_init(sc, 1)) 2560 return -1; 2561 2562 if ((sc->mode & SSL_MODE_ASYNC) && ASYNC_get_current_job() == NULL) { 2563 int ret; 2564 struct ssl_async_args args; 2565 2566 args.s = s; 2567 args.buf = (void *)buf; 2568 args.num = num; 2569 args.type = WRITEFUNC; 2570 args.f.func_write = s->method->ssl_write; 2571 2572 ret = ssl_start_async_job(s, &args, ssl_io_intern); 2573 *written = sc->asyncrw; 2574 return ret; 2575 } else { 2576 return s->method->ssl_write(s, buf, num, written); 2577 } 2578 } 2579 2580 ossl_ssize_t SSL_sendfile(SSL *s, int fd, off_t offset, size_t size, int flags) 2581 { 2582 ossl_ssize_t ret; 2583 SSL_CONNECTION *sc = SSL_CONNECTION_FROM_SSL_ONLY(s); 2584 2585 if (sc == NULL) 2586 return 0; 2587 2588 if (sc->handshake_func == NULL) { 2589 ERR_raise(ERR_LIB_SSL, SSL_R_UNINITIALIZED); 2590 return -1; 2591 } 2592 2593 if (sc->shutdown & SSL_SENT_SHUTDOWN) { 2594 sc->rwstate = SSL_NOTHING; 2595 ERR_raise(ERR_LIB_SSL, SSL_R_PROTOCOL_IS_SHUTDOWN); 2596 return -1; 2597 } 2598 2599 if (!BIO_get_ktls_send(sc->wbio)) { 2600 ERR_raise(ERR_LIB_SSL, SSL_R_UNINITIALIZED); 2601 return -1; 2602 } 2603 2604 /* If we have an alert to send, lets send it */ 2605 if (sc->s3.alert_dispatch > 0) { 2606 ret = (ossl_ssize_t)s->method->ssl_dispatch_alert(s); 2607 if (ret <= 0) { 2608 /* SSLfatal() already called if appropriate */ 2609 return ret; 2610 } 2611 /* if it went, fall through and send more stuff */ 2612 } 2613 2614 sc->rwstate = SSL_WRITING; 2615 if (BIO_flush(sc->wbio) <= 0) { 2616 if (!BIO_should_retry(sc->wbio)) { 2617 sc->rwstate = SSL_NOTHING; 2618 } else { 2619 #ifdef EAGAIN 2620 set_sys_error(EAGAIN); 2621 #endif 2622 } 2623 return -1; 2624 } 2625 2626 #ifdef OPENSSL_NO_KTLS 2627 ERR_raise_data(ERR_LIB_SSL, ERR_R_INTERNAL_ERROR, 2628 "can't call ktls_sendfile(), ktls disabled"); 2629 return -1; 2630 #else 2631 ret = ktls_sendfile(SSL_get_wfd(s), fd, offset, size, flags); 2632 if (ret < 0) { 2633 #if defined(EAGAIN) && defined(EINTR) && defined(EBUSY) 2634 if ((get_last_sys_error() == EAGAIN) || (get_last_sys_error() == EINTR) || (get_last_sys_error() == EBUSY)) 2635 BIO_set_retry_write(sc->wbio); 2636 else 2637 #endif 2638 ERR_raise_data(ERR_LIB_SYS, get_last_sys_error(), 2639 "ktls_sendfile failure"); 2640 return ret; 2641 } 2642 sc->rwstate = SSL_NOTHING; 2643 return ret; 2644 #endif 2645 } 2646 2647 int SSL_write(SSL *s, const void *buf, int num) 2648 { 2649 int ret; 2650 size_t written; 2651 2652 if (num < 0) { 2653 ERR_raise(ERR_LIB_SSL, SSL_R_BAD_LENGTH); 2654 return -1; 2655 } 2656 2657 ret = ssl_write_internal(s, buf, (size_t)num, 0, &written); 2658 2659 /* 2660 * The cast is safe here because ret should be <= INT_MAX because num is 2661 * <= INT_MAX 2662 */ 2663 if (ret > 0) 2664 ret = (int)written; 2665 2666 return ret; 2667 } 2668 2669 int SSL_write_ex(SSL *s, const void *buf, size_t num, size_t *written) 2670 { 2671 return SSL_write_ex2(s, buf, num, 0, written); 2672 } 2673 2674 int SSL_write_ex2(SSL *s, const void *buf, size_t num, uint64_t flags, 2675 size_t *written) 2676 { 2677 int ret = ssl_write_internal(s, buf, num, flags, written); 2678 2679 if (ret < 0) 2680 ret = 0; 2681 return ret; 2682 } 2683 2684 int SSL_write_early_data(SSL *s, const void *buf, size_t num, size_t *written) 2685 { 2686 int ret, early_data_state; 2687 size_t writtmp; 2688 uint32_t partialwrite; 2689 SSL_CONNECTION *sc = SSL_CONNECTION_FROM_SSL_ONLY(s); 2690 2691 /* TODO(QUIC 0RTT): This will need special handling for QUIC */ 2692 if (sc == NULL) 2693 return 0; 2694 2695 switch (sc->early_data_state) { 2696 case SSL_EARLY_DATA_NONE: 2697 if (sc->server 2698 || !SSL_in_before(s) 2699 || ((sc->session == NULL || sc->session->ext.max_early_data == 0) 2700 && (sc->psk_use_session_cb == NULL))) { 2701 ERR_raise(ERR_LIB_SSL, ERR_R_SHOULD_NOT_HAVE_BEEN_CALLED); 2702 return 0; 2703 } 2704 /* fall through */ 2705 2706 case SSL_EARLY_DATA_CONNECT_RETRY: 2707 sc->early_data_state = SSL_EARLY_DATA_CONNECTING; 2708 ret = SSL_connect(s); 2709 if (ret <= 0) { 2710 /* NBIO or error */ 2711 sc->early_data_state = SSL_EARLY_DATA_CONNECT_RETRY; 2712 return 0; 2713 } 2714 /* fall through */ 2715 2716 case SSL_EARLY_DATA_WRITE_RETRY: 2717 sc->early_data_state = SSL_EARLY_DATA_WRITING; 2718 /* 2719 * We disable partial write for early data because we don't keep track 2720 * of how many bytes we've written between the SSL_write_ex() call and 2721 * the flush if the flush needs to be retried) 2722 */ 2723 partialwrite = sc->mode & SSL_MODE_ENABLE_PARTIAL_WRITE; 2724 sc->mode &= ~SSL_MODE_ENABLE_PARTIAL_WRITE; 2725 ret = SSL_write_ex(s, buf, num, &writtmp); 2726 sc->mode |= partialwrite; 2727 if (!ret) { 2728 sc->early_data_state = SSL_EARLY_DATA_WRITE_RETRY; 2729 return ret; 2730 } 2731 sc->early_data_state = SSL_EARLY_DATA_WRITE_FLUSH; 2732 /* fall through */ 2733 2734 case SSL_EARLY_DATA_WRITE_FLUSH: 2735 /* The buffering BIO is still in place so we need to flush it */ 2736 if (statem_flush(sc) != 1) 2737 return 0; 2738 *written = num; 2739 sc->early_data_state = SSL_EARLY_DATA_WRITE_RETRY; 2740 return 1; 2741 2742 case SSL_EARLY_DATA_FINISHED_READING: 2743 case SSL_EARLY_DATA_READ_RETRY: 2744 early_data_state = sc->early_data_state; 2745 /* We are a server writing to an unauthenticated client */ 2746 sc->early_data_state = SSL_EARLY_DATA_UNAUTH_WRITING; 2747 ret = SSL_write_ex(s, buf, num, written); 2748 /* The buffering BIO is still in place */ 2749 if (ret) 2750 (void)BIO_flush(sc->wbio); 2751 sc->early_data_state = early_data_state; 2752 return ret; 2753 2754 default: 2755 ERR_raise(ERR_LIB_SSL, ERR_R_SHOULD_NOT_HAVE_BEEN_CALLED); 2756 return 0; 2757 } 2758 } 2759 2760 int SSL_shutdown(SSL *s) 2761 { 2762 /* 2763 * Note that this function behaves differently from what one might 2764 * expect. Return values are 0 for no success (yet), 1 for success; but 2765 * calling it once is usually not enough, even if blocking I/O is used 2766 * (see ssl3_shutdown). 2767 */ 2768 SSL_CONNECTION *sc = SSL_CONNECTION_FROM_SSL(s); 2769 2770 #ifndef OPENSSL_NO_QUIC 2771 if (IS_QUIC(s)) 2772 return ossl_quic_conn_shutdown(s, 0, NULL, 0); 2773 #endif 2774 2775 if (sc == NULL) 2776 return -1; 2777 2778 if (sc->handshake_func == NULL) { 2779 ERR_raise(ERR_LIB_SSL, SSL_R_UNINITIALIZED); 2780 return -1; 2781 } 2782 2783 if (!SSL_in_init(s)) { 2784 if ((sc->mode & SSL_MODE_ASYNC) && ASYNC_get_current_job() == NULL) { 2785 struct ssl_async_args args; 2786 2787 memset(&args, 0, sizeof(args)); 2788 args.s = s; 2789 args.type = OTHERFUNC; 2790 args.f.func_other = s->method->ssl_shutdown; 2791 2792 return ssl_start_async_job(s, &args, ssl_io_intern); 2793 } else { 2794 return s->method->ssl_shutdown(s); 2795 } 2796 } else { 2797 ERR_raise(ERR_LIB_SSL, SSL_R_SHUTDOWN_WHILE_IN_INIT); 2798 return -1; 2799 } 2800 } 2801 2802 int SSL_key_update(SSL *s, int updatetype) 2803 { 2804 SSL_CONNECTION *sc = SSL_CONNECTION_FROM_SSL(s); 2805 2806 #ifndef OPENSSL_NO_QUIC 2807 if (IS_QUIC(s)) 2808 return ossl_quic_key_update(s, updatetype); 2809 #endif 2810 2811 if (sc == NULL) 2812 return 0; 2813 2814 if (!SSL_CONNECTION_IS_TLS13(sc)) { 2815 ERR_raise(ERR_LIB_SSL, SSL_R_WRONG_SSL_VERSION); 2816 return 0; 2817 } 2818 2819 if (updatetype != SSL_KEY_UPDATE_NOT_REQUESTED 2820 && updatetype != SSL_KEY_UPDATE_REQUESTED) { 2821 ERR_raise(ERR_LIB_SSL, SSL_R_INVALID_KEY_UPDATE_TYPE); 2822 return 0; 2823 } 2824 2825 if (!SSL_is_init_finished(s)) { 2826 ERR_raise(ERR_LIB_SSL, SSL_R_STILL_IN_INIT); 2827 return 0; 2828 } 2829 2830 if (RECORD_LAYER_write_pending(&sc->rlayer)) { 2831 ERR_raise(ERR_LIB_SSL, SSL_R_BAD_WRITE_RETRY); 2832 return 0; 2833 } 2834 2835 ossl_statem_set_in_init(sc, 1); 2836 sc->key_update = updatetype; 2837 return 1; 2838 } 2839 2840 int SSL_get_key_update_type(const SSL *s) 2841 { 2842 const SSL_CONNECTION *sc = SSL_CONNECTION_FROM_CONST_SSL(s); 2843 2844 #ifndef OPENSSL_NO_QUIC 2845 if (IS_QUIC(s)) 2846 return ossl_quic_get_key_update_type(s); 2847 #endif 2848 2849 if (sc == NULL) 2850 return 0; 2851 2852 return sc->key_update; 2853 } 2854 2855 /* 2856 * Can we accept a renegotiation request? If yes, set the flag and 2857 * return 1 if yes. If not, raise error and return 0. 2858 */ 2859 static int can_renegotiate(const SSL_CONNECTION *sc) 2860 { 2861 if (SSL_CONNECTION_IS_TLS13(sc)) { 2862 ERR_raise(ERR_LIB_SSL, SSL_R_WRONG_SSL_VERSION); 2863 return 0; 2864 } 2865 2866 if ((sc->options & SSL_OP_NO_RENEGOTIATION) != 0) { 2867 ERR_raise(ERR_LIB_SSL, SSL_R_NO_RENEGOTIATION); 2868 return 0; 2869 } 2870 2871 return 1; 2872 } 2873 2874 int SSL_renegotiate(SSL *s) 2875 { 2876 SSL_CONNECTION *sc = SSL_CONNECTION_FROM_SSL_ONLY(s); 2877 2878 if (sc == NULL) 2879 return 0; 2880 2881 if (!can_renegotiate(sc)) 2882 return 0; 2883 2884 sc->renegotiate = 1; 2885 sc->new_session = 1; 2886 return s->method->ssl_renegotiate(s); 2887 } 2888 2889 int SSL_renegotiate_abbreviated(SSL *s) 2890 { 2891 SSL_CONNECTION *sc = SSL_CONNECTION_FROM_SSL_ONLY(s); 2892 2893 if (sc == NULL) 2894 return 0; 2895 2896 if (!can_renegotiate(sc)) 2897 return 0; 2898 2899 sc->renegotiate = 1; 2900 sc->new_session = 0; 2901 return s->method->ssl_renegotiate(s); 2902 } 2903 2904 int SSL_renegotiate_pending(const SSL *s) 2905 { 2906 SSL_CONNECTION *sc = SSL_CONNECTION_FROM_SSL_ONLY(s); 2907 2908 if (sc == NULL) 2909 return 0; 2910 2911 /* 2912 * becomes true when negotiation is requested; false again once a 2913 * handshake has finished 2914 */ 2915 return (sc->renegotiate != 0); 2916 } 2917 2918 int SSL_new_session_ticket(SSL *s) 2919 { 2920 SSL_CONNECTION *sc = SSL_CONNECTION_FROM_SSL(s); 2921 2922 if (sc == NULL) 2923 return 0; 2924 2925 /* If we are in init because we're sending tickets, okay to send more. */ 2926 if ((SSL_in_init(s) && sc->ext.extra_tickets_expected == 0) 2927 || SSL_IS_FIRST_HANDSHAKE(sc) || !sc->server 2928 || !SSL_CONNECTION_IS_TLS13(sc)) 2929 return 0; 2930 sc->ext.extra_tickets_expected++; 2931 if (!RECORD_LAYER_write_pending(&sc->rlayer) && !SSL_in_init(s)) 2932 ossl_statem_set_in_init(sc, 1); 2933 return 1; 2934 } 2935 2936 long SSL_ctrl(SSL *s, int cmd, long larg, void *parg) 2937 { 2938 return ossl_ctrl_internal(s, cmd, larg, parg, /*no_quic=*/0); 2939 } 2940 2941 long ossl_ctrl_internal(SSL *s, int cmd, long larg, void *parg, int no_quic) 2942 { 2943 long l; 2944 SSL_CONNECTION *sc = SSL_CONNECTION_FROM_SSL(s); 2945 2946 /* 2947 * Routing of ctrl calls for QUIC is a little counterintuitive: 2948 * 2949 * - Firstly (no_quic=0), we pass the ctrl directly to our QUIC 2950 * implementation in case it wants to handle the ctrl specially. 2951 * 2952 * - If our QUIC implementation does not care about the ctrl, it 2953 * will reenter this function with no_quic=1 and we will try to handle 2954 * it directly using the QCSO SSL object stub (not the handshake layer 2955 * SSL object). This is important for e.g. the version configuration 2956 * ctrls below, which must use s->defltmeth (and not sc->defltmeth). 2957 * 2958 * - If we don't handle a ctrl here specially, then processing is 2959 * redirected to the handshake layer SSL object. 2960 */ 2961 if (!no_quic && IS_QUIC(s)) 2962 return s->method->ssl_ctrl(s, cmd, larg, parg); 2963 2964 if (sc == NULL) 2965 return 0; 2966 2967 switch (cmd) { 2968 case SSL_CTRL_GET_READ_AHEAD: 2969 return RECORD_LAYER_get_read_ahead(&sc->rlayer); 2970 case SSL_CTRL_SET_READ_AHEAD: 2971 l = RECORD_LAYER_get_read_ahead(&sc->rlayer); 2972 RECORD_LAYER_set_read_ahead(&sc->rlayer, larg); 2973 return l; 2974 2975 case SSL_CTRL_MODE: { 2976 OSSL_PARAM options[2], *opts = options; 2977 2978 sc->mode |= larg; 2979 2980 *opts++ = OSSL_PARAM_construct_uint32(OSSL_LIBSSL_RECORD_LAYER_PARAM_MODE, 2981 &sc->mode); 2982 *opts = OSSL_PARAM_construct_end(); 2983 2984 /* Ignore return value */ 2985 sc->rlayer.rrlmethod->set_options(sc->rlayer.rrl, options); 2986 2987 return sc->mode; 2988 } 2989 case SSL_CTRL_CLEAR_MODE: 2990 return (sc->mode &= ~larg); 2991 case SSL_CTRL_GET_MAX_CERT_LIST: 2992 return (long)sc->max_cert_list; 2993 case SSL_CTRL_SET_MAX_CERT_LIST: 2994 if (larg < 0) 2995 return 0; 2996 l = (long)sc->max_cert_list; 2997 sc->max_cert_list = (size_t)larg; 2998 return l; 2999 case SSL_CTRL_SET_MAX_SEND_FRAGMENT: 3000 if (larg < 512 || larg > SSL3_RT_MAX_PLAIN_LENGTH) 3001 return 0; 3002 #ifndef OPENSSL_NO_KTLS 3003 if (sc->wbio != NULL && BIO_get_ktls_send(sc->wbio)) 3004 return 0; 3005 #endif /* OPENSSL_NO_KTLS */ 3006 sc->max_send_fragment = larg; 3007 if (sc->max_send_fragment < sc->split_send_fragment) 3008 sc->split_send_fragment = sc->max_send_fragment; 3009 sc->rlayer.wrlmethod->set_max_frag_len(sc->rlayer.wrl, larg); 3010 return 1; 3011 case SSL_CTRL_SET_SPLIT_SEND_FRAGMENT: 3012 if ((size_t)larg > sc->max_send_fragment || larg == 0) 3013 return 0; 3014 sc->split_send_fragment = larg; 3015 return 1; 3016 case SSL_CTRL_SET_MAX_PIPELINES: 3017 if (larg < 1 || larg > SSL_MAX_PIPELINES) 3018 return 0; 3019 sc->max_pipelines = larg; 3020 if (sc->rlayer.rrlmethod->set_max_pipelines != NULL) 3021 sc->rlayer.rrlmethod->set_max_pipelines(sc->rlayer.rrl, (size_t)larg); 3022 return 1; 3023 case SSL_CTRL_GET_RI_SUPPORT: 3024 return sc->s3.send_connection_binding; 3025 case SSL_CTRL_SET_RETRY_VERIFY: 3026 sc->rwstate = SSL_RETRY_VERIFY; 3027 return 1; 3028 case SSL_CTRL_CERT_FLAGS: 3029 return (sc->cert->cert_flags |= larg); 3030 case SSL_CTRL_CLEAR_CERT_FLAGS: 3031 return (sc->cert->cert_flags &= ~larg); 3032 3033 case SSL_CTRL_GET_RAW_CIPHERLIST: 3034 if (parg) { 3035 if (sc->s3.tmp.ciphers_raw == NULL) 3036 return 0; 3037 *(unsigned char **)parg = sc->s3.tmp.ciphers_raw; 3038 return (int)sc->s3.tmp.ciphers_rawlen; 3039 } else { 3040 return TLS_CIPHER_LEN; 3041 } 3042 case SSL_CTRL_GET_EXTMS_SUPPORT: 3043 if (!sc->session || SSL_in_init(s) || ossl_statem_get_in_handshake(sc)) 3044 return -1; 3045 if (sc->session->flags & SSL_SESS_FLAG_EXTMS) 3046 return 1; 3047 else 3048 return 0; 3049 case SSL_CTRL_SET_MIN_PROTO_VERSION: 3050 return ssl_check_allowed_versions(larg, sc->max_proto_version) 3051 && ssl_set_version_bound(s->defltmeth->version, (int)larg, 3052 &sc->min_proto_version); 3053 case SSL_CTRL_GET_MIN_PROTO_VERSION: 3054 return sc->min_proto_version; 3055 case SSL_CTRL_SET_MAX_PROTO_VERSION: 3056 return ssl_check_allowed_versions(sc->min_proto_version, larg) 3057 && ssl_set_version_bound(s->defltmeth->version, (int)larg, 3058 &sc->max_proto_version); 3059 case SSL_CTRL_GET_MAX_PROTO_VERSION: 3060 return sc->max_proto_version; 3061 default: 3062 if (IS_QUIC(s)) 3063 return SSL_ctrl((SSL *)sc, cmd, larg, parg); 3064 else 3065 return s->method->ssl_ctrl(s, cmd, larg, parg); 3066 } 3067 } 3068 3069 long SSL_callback_ctrl(SSL *s, int cmd, void (*fp)(void)) 3070 { 3071 return s->method->ssl_callback_ctrl(s, cmd, fp); 3072 } 3073 3074 LHASH_OF(SSL_SESSION) *SSL_CTX_sessions(SSL_CTX *ctx) 3075 { 3076 return ctx->sessions; 3077 } 3078 3079 static int ssl_tsan_load(SSL_CTX *ctx, TSAN_QUALIFIER int *stat) 3080 { 3081 int res = 0; 3082 3083 if (ssl_tsan_lock(ctx)) { 3084 res = tsan_load(stat); 3085 ssl_tsan_unlock(ctx); 3086 } 3087 return res; 3088 } 3089 3090 long SSL_CTX_ctrl(SSL_CTX *ctx, int cmd, long larg, void *parg) 3091 { 3092 long l; 3093 3094 /* For some cases with ctx == NULL or larg == 1 perform syntax checks */ 3095 if (cmd == SSL_CTRL_SET_GROUPS_LIST && larg == 1) 3096 return tls1_set_groups_list(ctx, NULL, NULL, NULL, NULL, NULL, NULL, parg); 3097 if (ctx == NULL) { 3098 switch (cmd) { 3099 case SSL_CTRL_SET_SIGALGS_LIST: 3100 case SSL_CTRL_SET_CLIENT_SIGALGS_LIST: 3101 return tls1_set_sigalgs_list(ctx, NULL, parg, 0); 3102 default: 3103 return 0; 3104 } 3105 } 3106 3107 switch (cmd) { 3108 case SSL_CTRL_GET_READ_AHEAD: 3109 return ctx->read_ahead; 3110 case SSL_CTRL_SET_READ_AHEAD: 3111 l = ctx->read_ahead; 3112 ctx->read_ahead = larg; 3113 return l; 3114 3115 case SSL_CTRL_SET_MSG_CALLBACK_ARG: 3116 ctx->msg_callback_arg = parg; 3117 return 1; 3118 3119 case SSL_CTRL_GET_MAX_CERT_LIST: 3120 return (long)ctx->max_cert_list; 3121 case SSL_CTRL_SET_MAX_CERT_LIST: 3122 if (larg < 0) 3123 return 0; 3124 l = (long)ctx->max_cert_list; 3125 ctx->max_cert_list = (size_t)larg; 3126 return l; 3127 3128 case SSL_CTRL_SET_SESS_CACHE_SIZE: 3129 if (larg < 0) 3130 return 0; 3131 l = (long)ctx->session_cache_size; 3132 ctx->session_cache_size = (size_t)larg; 3133 return l; 3134 case SSL_CTRL_GET_SESS_CACHE_SIZE: 3135 return (long)ctx->session_cache_size; 3136 case SSL_CTRL_SET_SESS_CACHE_MODE: 3137 l = ctx->session_cache_mode; 3138 ctx->session_cache_mode = larg; 3139 return l; 3140 case SSL_CTRL_GET_SESS_CACHE_MODE: 3141 return ctx->session_cache_mode; 3142 3143 case SSL_CTRL_SESS_NUMBER: 3144 return lh_SSL_SESSION_num_items(ctx->sessions); 3145 case SSL_CTRL_SESS_CONNECT: 3146 return ssl_tsan_load(ctx, &ctx->stats.sess_connect); 3147 case SSL_CTRL_SESS_CONNECT_GOOD: 3148 return ssl_tsan_load(ctx, &ctx->stats.sess_connect_good); 3149 case SSL_CTRL_SESS_CONNECT_RENEGOTIATE: 3150 return ssl_tsan_load(ctx, &ctx->stats.sess_connect_renegotiate); 3151 case SSL_CTRL_SESS_ACCEPT: 3152 return ssl_tsan_load(ctx, &ctx->stats.sess_accept); 3153 case SSL_CTRL_SESS_ACCEPT_GOOD: 3154 return ssl_tsan_load(ctx, &ctx->stats.sess_accept_good); 3155 case SSL_CTRL_SESS_ACCEPT_RENEGOTIATE: 3156 return ssl_tsan_load(ctx, &ctx->stats.sess_accept_renegotiate); 3157 case SSL_CTRL_SESS_HIT: 3158 return ssl_tsan_load(ctx, &ctx->stats.sess_hit); 3159 case SSL_CTRL_SESS_CB_HIT: 3160 return ssl_tsan_load(ctx, &ctx->stats.sess_cb_hit); 3161 case SSL_CTRL_SESS_MISSES: 3162 return ssl_tsan_load(ctx, &ctx->stats.sess_miss); 3163 case SSL_CTRL_SESS_TIMEOUTS: 3164 return ssl_tsan_load(ctx, &ctx->stats.sess_timeout); 3165 case SSL_CTRL_SESS_CACHE_FULL: 3166 return ssl_tsan_load(ctx, &ctx->stats.sess_cache_full); 3167 case SSL_CTRL_MODE: 3168 return (ctx->mode |= larg); 3169 case SSL_CTRL_CLEAR_MODE: 3170 return (ctx->mode &= ~larg); 3171 case SSL_CTRL_SET_MAX_SEND_FRAGMENT: 3172 if (larg < 512 || larg > SSL3_RT_MAX_PLAIN_LENGTH) 3173 return 0; 3174 ctx->max_send_fragment = larg; 3175 if (ctx->max_send_fragment < ctx->split_send_fragment) 3176 ctx->split_send_fragment = ctx->max_send_fragment; 3177 return 1; 3178 case SSL_CTRL_SET_SPLIT_SEND_FRAGMENT: 3179 if ((size_t)larg > ctx->max_send_fragment || larg == 0) 3180 return 0; 3181 ctx->split_send_fragment = larg; 3182 return 1; 3183 case SSL_CTRL_SET_MAX_PIPELINES: 3184 if (larg < 1 || larg > SSL_MAX_PIPELINES) 3185 return 0; 3186 ctx->max_pipelines = larg; 3187 return 1; 3188 case SSL_CTRL_CERT_FLAGS: 3189 return (ctx->cert->cert_flags |= larg); 3190 case SSL_CTRL_CLEAR_CERT_FLAGS: 3191 return (ctx->cert->cert_flags &= ~larg); 3192 case SSL_CTRL_SET_MIN_PROTO_VERSION: 3193 return ssl_check_allowed_versions(larg, ctx->max_proto_version) 3194 && ssl_set_version_bound(ctx->method->version, (int)larg, 3195 &ctx->min_proto_version); 3196 case SSL_CTRL_GET_MIN_PROTO_VERSION: 3197 return ctx->min_proto_version; 3198 case SSL_CTRL_SET_MAX_PROTO_VERSION: 3199 return ssl_check_allowed_versions(ctx->min_proto_version, larg) 3200 && ssl_set_version_bound(ctx->method->version, (int)larg, 3201 &ctx->max_proto_version); 3202 case SSL_CTRL_GET_MAX_PROTO_VERSION: 3203 return ctx->max_proto_version; 3204 default: 3205 return ctx->method->ssl_ctx_ctrl(ctx, cmd, larg, parg); 3206 } 3207 } 3208 3209 long SSL_CTX_callback_ctrl(SSL_CTX *ctx, int cmd, void (*fp)(void)) 3210 { 3211 switch (cmd) { 3212 case SSL_CTRL_SET_MSG_CALLBACK: 3213 ctx->msg_callback = (void (*)(int write_p, int version, int content_type, 3214 const void *buf, size_t len, SSL *ssl, 3215 void *arg))(fp); 3216 return 1; 3217 3218 default: 3219 return ctx->method->ssl_ctx_callback_ctrl(ctx, cmd, fp); 3220 } 3221 } 3222 3223 int ssl_cipher_id_cmp(const SSL_CIPHER *a, const SSL_CIPHER *b) 3224 { 3225 if (a->id > b->id) 3226 return 1; 3227 if (a->id < b->id) 3228 return -1; 3229 return 0; 3230 } 3231 3232 int ssl_cipher_ptr_id_cmp(const SSL_CIPHER *const *ap, 3233 const SSL_CIPHER *const *bp) 3234 { 3235 if ((*ap)->id > (*bp)->id) 3236 return 1; 3237 if ((*ap)->id < (*bp)->id) 3238 return -1; 3239 return 0; 3240 } 3241 3242 /* 3243 * return a STACK of the ciphers available for the SSL and in order of 3244 * preference 3245 */ 3246 STACK_OF(SSL_CIPHER) *SSL_get_ciphers(const SSL *s) 3247 { 3248 const SSL_CONNECTION *sc = SSL_CONNECTION_FROM_CONST_SSL(s); 3249 3250 if (sc != NULL) { 3251 if (sc->cipher_list != NULL) { 3252 return sc->cipher_list; 3253 } else if ((s->ctx != NULL) && (s->ctx->cipher_list != NULL)) { 3254 return s->ctx->cipher_list; 3255 } 3256 } 3257 return NULL; 3258 } 3259 3260 STACK_OF(SSL_CIPHER) *SSL_get_client_ciphers(const SSL *s) 3261 { 3262 const SSL_CONNECTION *sc = SSL_CONNECTION_FROM_CONST_SSL(s); 3263 3264 if (sc == NULL || !sc->server) 3265 return NULL; 3266 return sc->peer_ciphers; 3267 } 3268 3269 STACK_OF(SSL_CIPHER) *SSL_get1_supported_ciphers(SSL *s) 3270 { 3271 STACK_OF(SSL_CIPHER) *sk = NULL, *ciphers; 3272 int i; 3273 SSL_CONNECTION *sc = SSL_CONNECTION_FROM_SSL(s); 3274 3275 if (sc == NULL) 3276 return NULL; 3277 3278 ciphers = SSL_get_ciphers(s); 3279 if (!ciphers) 3280 return NULL; 3281 if (!ssl_set_client_disabled(sc)) 3282 return NULL; 3283 for (i = 0; i < sk_SSL_CIPHER_num(ciphers); i++) { 3284 const SSL_CIPHER *c = sk_SSL_CIPHER_value(ciphers, i); 3285 if (!ssl_cipher_disabled(sc, c, SSL_SECOP_CIPHER_SUPPORTED, 0)) { 3286 if (!sk) 3287 sk = sk_SSL_CIPHER_new_null(); 3288 if (!sk) 3289 return NULL; 3290 if (!sk_SSL_CIPHER_push(sk, c)) { 3291 sk_SSL_CIPHER_free(sk); 3292 return NULL; 3293 } 3294 } 3295 } 3296 return sk; 3297 } 3298 3299 /** return a STACK of the ciphers available for the SSL and in order of 3300 * algorithm id */ 3301 STACK_OF(SSL_CIPHER) *ssl_get_ciphers_by_id(SSL_CONNECTION *s) 3302 { 3303 if (s != NULL) { 3304 if (s->cipher_list_by_id != NULL) 3305 return s->cipher_list_by_id; 3306 else if (s->ssl.ctx != NULL 3307 && s->ssl.ctx->cipher_list_by_id != NULL) 3308 return s->ssl.ctx->cipher_list_by_id; 3309 } 3310 return NULL; 3311 } 3312 3313 /** The old interface to get the same thing as SSL_get_ciphers() */ 3314 const char *SSL_get_cipher_list(const SSL *s, int n) 3315 { 3316 const SSL_CIPHER *c; 3317 STACK_OF(SSL_CIPHER) *sk; 3318 3319 if (s == NULL) 3320 return NULL; 3321 sk = SSL_get_ciphers(s); 3322 if ((sk == NULL) || (sk_SSL_CIPHER_num(sk) <= n)) 3323 return NULL; 3324 c = sk_SSL_CIPHER_value(sk, n); 3325 if (c == NULL) 3326 return NULL; 3327 return c->name; 3328 } 3329 3330 /** return a STACK of the ciphers available for the SSL_CTX and in order of 3331 * preference */ 3332 STACK_OF(SSL_CIPHER) *SSL_CTX_get_ciphers(const SSL_CTX *ctx) 3333 { 3334 if (ctx != NULL) 3335 return ctx->cipher_list; 3336 return NULL; 3337 } 3338 3339 /* 3340 * Distinguish between ciphers controlled by set_ciphersuite() and 3341 * set_cipher_list() when counting. 3342 */ 3343 static int cipher_list_tls12_num(STACK_OF(SSL_CIPHER) *sk) 3344 { 3345 int i, num = 0; 3346 const SSL_CIPHER *c; 3347 3348 if (sk == NULL) 3349 return 0; 3350 for (i = 0; i < sk_SSL_CIPHER_num(sk); ++i) { 3351 c = sk_SSL_CIPHER_value(sk, i); 3352 if (c->min_tls >= TLS1_3_VERSION) 3353 continue; 3354 num++; 3355 } 3356 return num; 3357 } 3358 3359 /** specify the ciphers to be used by default by the SSL_CTX */ 3360 int SSL_CTX_set_cipher_list(SSL_CTX *ctx, const char *str) 3361 { 3362 STACK_OF(SSL_CIPHER) *sk; 3363 3364 sk = ssl_create_cipher_list(ctx, ctx->tls13_ciphersuites, 3365 &ctx->cipher_list, &ctx->cipher_list_by_id, str, 3366 ctx->cert); 3367 /* 3368 * ssl_create_cipher_list may return an empty stack if it was unable to 3369 * find a cipher matching the given rule string (for example if the rule 3370 * string specifies a cipher which has been disabled). This is not an 3371 * error as far as ssl_create_cipher_list is concerned, and hence 3372 * ctx->cipher_list and ctx->cipher_list_by_id has been updated. 3373 */ 3374 if (sk == NULL) 3375 return 0; 3376 if (ctx->method->num_ciphers() > 0 && cipher_list_tls12_num(sk) == 0) { 3377 ERR_raise(ERR_LIB_SSL, SSL_R_NO_CIPHER_MATCH); 3378 return 0; 3379 } 3380 return 1; 3381 } 3382 3383 /** specify the ciphers to be used by the SSL */ 3384 int SSL_set_cipher_list(SSL *s, const char *str) 3385 { 3386 STACK_OF(SSL_CIPHER) *sk; 3387 SSL_CONNECTION *sc = SSL_CONNECTION_FROM_SSL(s); 3388 SSL_CTX *ctx; 3389 3390 if (sc == NULL) 3391 return 0; 3392 3393 ctx = s->ctx; 3394 sk = ssl_create_cipher_list(ctx, sc->tls13_ciphersuites, 3395 &sc->cipher_list, &sc->cipher_list_by_id, str, 3396 sc->cert); 3397 /* see comment in SSL_CTX_set_cipher_list */ 3398 if (sk == NULL) 3399 return 0; 3400 if (ctx->method->num_ciphers() > 0 && cipher_list_tls12_num(sk) == 0) { 3401 ERR_raise(ERR_LIB_SSL, SSL_R_NO_CIPHER_MATCH); 3402 return 0; 3403 } 3404 return 1; 3405 } 3406 3407 char *SSL_get_shared_ciphers(const SSL *s, char *buf, int size) 3408 { 3409 char *p; 3410 STACK_OF(SSL_CIPHER) *clntsk, *srvrsk; 3411 const SSL_CIPHER *c; 3412 int i; 3413 const SSL_CONNECTION *sc = SSL_CONNECTION_FROM_CONST_SSL(s); 3414 3415 if (size < 2 || buf == NULL) 3416 return NULL; 3417 3418 buf[0] = '\0'; 3419 3420 if (sc == NULL || !sc->server) 3421 return NULL; 3422 3423 p = buf; 3424 clntsk = sc->peer_ciphers; 3425 srvrsk = SSL_get_ciphers(s); 3426 3427 if (clntsk == NULL || sk_SSL_CIPHER_num(clntsk) == 0 3428 || srvrsk == NULL || sk_SSL_CIPHER_num(srvrsk) == 0) 3429 return buf; 3430 3431 for (i = 0; i < sk_SSL_CIPHER_num(clntsk); i++) { 3432 int n; 3433 3434 c = sk_SSL_CIPHER_value(clntsk, i); 3435 if (sk_SSL_CIPHER_find(srvrsk, c) < 0) 3436 continue; 3437 3438 n = (int)OPENSSL_strnlen(c->name, size); 3439 if (n >= size) 3440 break; 3441 3442 memcpy(p, c->name, n); 3443 p += n; 3444 *(p++) = ':'; 3445 size -= n + 1; 3446 } 3447 3448 /* No overlap */ 3449 if (p != buf) 3450 p[-1] = '\0'; 3451 3452 return buf; 3453 } 3454 3455 /** 3456 * Return the requested servername (SNI) value. Note that the behaviour varies 3457 * depending on: 3458 * - whether this is called by the client or the server, 3459 * - if we are before or during/after the handshake, 3460 * - if a resumption or normal handshake is being attempted/has occurred 3461 * - whether we have negotiated TLSv1.2 (or below) or TLSv1.3 3462 * 3463 * Note that only the host_name type is defined (RFC 3546). 3464 */ 3465 const char *SSL_get_servername(const SSL *s, const int type) 3466 { 3467 const SSL_CONNECTION *sc = SSL_CONNECTION_FROM_CONST_SSL(s); 3468 int server; 3469 3470 if (sc == NULL) 3471 return NULL; 3472 3473 /* 3474 * If we don't know if we are the client or the server yet then we assume 3475 * client. 3476 */ 3477 server = sc->handshake_func == NULL ? 0 : sc->server; 3478 3479 if (type != TLSEXT_NAMETYPE_host_name) 3480 return NULL; 3481 3482 if (server) { 3483 /** 3484 * Server side 3485 * In TLSv1.3 on the server SNI is not associated with the session 3486 * but in TLSv1.2 or below it is. 3487 * 3488 * Before the handshake: 3489 * - return NULL 3490 * 3491 * During/after the handshake (TLSv1.2 or below resumption occurred): 3492 * - If a servername was accepted by the server in the original 3493 * handshake then it will return that servername, or NULL otherwise. 3494 * 3495 * During/after the handshake (TLSv1.2 or below resumption did not occur): 3496 * - The function will return the servername requested by the client in 3497 * this handshake or NULL if none was requested. 3498 */ 3499 if (sc->hit && !SSL_CONNECTION_IS_TLS13(sc)) 3500 return sc->session->ext.hostname; 3501 } else { 3502 /** 3503 * Client side 3504 * 3505 * Before the handshake: 3506 * - If a servername has been set via a call to 3507 * SSL_set_tlsext_host_name() then it will return that servername 3508 * - If one has not been set, but a TLSv1.2 resumption is being 3509 * attempted and the session from the original handshake had a 3510 * servername accepted by the server then it will return that 3511 * servername 3512 * - Otherwise it returns NULL 3513 * 3514 * During/after the handshake (TLSv1.2 or below resumption occurred): 3515 * - If the session from the original handshake had a servername accepted 3516 * by the server then it will return that servername. 3517 * - Otherwise it returns the servername set via 3518 * SSL_set_tlsext_host_name() (or NULL if it was not called). 3519 * 3520 * During/after the handshake (TLSv1.2 or below resumption did not occur): 3521 * - It will return the servername set via SSL_set_tlsext_host_name() 3522 * (or NULL if it was not called). 3523 */ 3524 if (SSL_in_before(s)) { 3525 if (sc->ext.hostname == NULL 3526 && sc->session != NULL 3527 && sc->session->ssl_version != TLS1_3_VERSION) 3528 return sc->session->ext.hostname; 3529 } else { 3530 if (!SSL_CONNECTION_IS_TLS13(sc) && sc->hit 3531 && sc->session->ext.hostname != NULL) 3532 return sc->session->ext.hostname; 3533 } 3534 } 3535 3536 return sc->ext.hostname; 3537 } 3538 3539 int SSL_get_servername_type(const SSL *s) 3540 { 3541 if (SSL_get_servername(s, TLSEXT_NAMETYPE_host_name) != NULL) 3542 return TLSEXT_NAMETYPE_host_name; 3543 return -1; 3544 } 3545 3546 /* 3547 * SSL_select_next_proto implements the standard protocol selection. It is 3548 * expected that this function is called from the callback set by 3549 * SSL_CTX_set_next_proto_select_cb. The protocol data is assumed to be a 3550 * vector of 8-bit, length prefixed byte strings. The length byte itself is 3551 * not included in the length. A byte string of length 0 is invalid. No byte 3552 * string may be truncated. The current, but experimental algorithm for 3553 * selecting the protocol is: 1) If the server doesn't support NPN then this 3554 * is indicated to the callback. In this case, the client application has to 3555 * abort the connection or have a default application level protocol. 2) If 3556 * the server supports NPN, but advertises an empty list then the client 3557 * selects the first protocol in its list, but indicates via the API that this 3558 * fallback case was enacted. 3) Otherwise, the client finds the first 3559 * protocol in the server's list that it supports and selects this protocol. 3560 * This is because it's assumed that the server has better information about 3561 * which protocol a client should use. 4) If the client doesn't support any 3562 * of the server's advertised protocols, then this is treated the same as 3563 * case 2. It returns either OPENSSL_NPN_NEGOTIATED if a common protocol was 3564 * found, or OPENSSL_NPN_NO_OVERLAP if the fallback case was reached. 3565 */ 3566 int SSL_select_next_proto(unsigned char **out, unsigned char *outlen, 3567 const unsigned char *server, 3568 unsigned int server_len, 3569 const unsigned char *client, unsigned int client_len) 3570 { 3571 PACKET cpkt, csubpkt, spkt, ssubpkt; 3572 3573 if (!PACKET_buf_init(&cpkt, client, client_len) 3574 || !PACKET_get_length_prefixed_1(&cpkt, &csubpkt) 3575 || PACKET_remaining(&csubpkt) == 0) { 3576 *out = NULL; 3577 *outlen = 0; 3578 return OPENSSL_NPN_NO_OVERLAP; 3579 } 3580 3581 /* 3582 * Set the default opportunistic protocol. Will be overwritten if we find 3583 * a match. 3584 */ 3585 *out = (unsigned char *)PACKET_data(&csubpkt); 3586 *outlen = (unsigned char)PACKET_remaining(&csubpkt); 3587 3588 /* 3589 * For each protocol in server preference order, see if we support it. 3590 */ 3591 if (PACKET_buf_init(&spkt, server, server_len)) { 3592 while (PACKET_get_length_prefixed_1(&spkt, &ssubpkt)) { 3593 if (PACKET_remaining(&ssubpkt) == 0) 3594 continue; /* Invalid - ignore it */ 3595 if (PACKET_buf_init(&cpkt, client, client_len)) { 3596 while (PACKET_get_length_prefixed_1(&cpkt, &csubpkt)) { 3597 if (PACKET_equal(&csubpkt, PACKET_data(&ssubpkt), 3598 PACKET_remaining(&ssubpkt))) { 3599 /* We found a match */ 3600 *out = (unsigned char *)PACKET_data(&ssubpkt); 3601 *outlen = (unsigned char)PACKET_remaining(&ssubpkt); 3602 return OPENSSL_NPN_NEGOTIATED; 3603 } 3604 } 3605 /* Ignore spurious trailing bytes in the client list */ 3606 } else { 3607 /* This should never happen */ 3608 return OPENSSL_NPN_NO_OVERLAP; 3609 } 3610 } 3611 /* Ignore spurious trailing bytes in the server list */ 3612 } 3613 3614 /* 3615 * There's no overlap between our protocols and the server's list. We use 3616 * the default opportunistic protocol selected earlier 3617 */ 3618 return OPENSSL_NPN_NO_OVERLAP; 3619 } 3620 3621 #ifndef OPENSSL_NO_NEXTPROTONEG 3622 /* 3623 * SSL_get0_next_proto_negotiated sets *data and *len to point to the 3624 * client's requested protocol for this connection and returns 0. If the 3625 * client didn't request any protocol, then *data is set to NULL. Note that 3626 * the client can request any protocol it chooses. The value returned from 3627 * this function need not be a member of the list of supported protocols 3628 * provided by the callback. 3629 */ 3630 void SSL_get0_next_proto_negotiated(const SSL *s, const unsigned char **data, 3631 unsigned *len) 3632 { 3633 const SSL_CONNECTION *sc = SSL_CONNECTION_FROM_CONST_SSL(s); 3634 3635 if (sc == NULL) { 3636 /* We have no other way to indicate error */ 3637 *data = NULL; 3638 *len = 0; 3639 return; 3640 } 3641 3642 *data = sc->ext.npn; 3643 if (*data == NULL) { 3644 *len = 0; 3645 } else { 3646 *len = (unsigned int)sc->ext.npn_len; 3647 } 3648 } 3649 3650 /* 3651 * SSL_CTX_set_npn_advertised_cb sets a callback that is called when 3652 * a TLS server needs a list of supported protocols for Next Protocol 3653 * Negotiation. The returned list must be in wire format. The list is 3654 * returned by setting |out| to point to it and |outlen| to its length. This 3655 * memory will not be modified, but one should assume that the SSL* keeps a 3656 * reference to it. The callback should return SSL_TLSEXT_ERR_OK if it 3657 * wishes to advertise. Otherwise, no such extension will be included in the 3658 * ServerHello. 3659 */ 3660 void SSL_CTX_set_npn_advertised_cb(SSL_CTX *ctx, 3661 SSL_CTX_npn_advertised_cb_func cb, 3662 void *arg) 3663 { 3664 if (IS_QUIC_CTX(ctx)) 3665 /* NPN not allowed for QUIC */ 3666 return; 3667 3668 ctx->ext.npn_advertised_cb = cb; 3669 ctx->ext.npn_advertised_cb_arg = arg; 3670 } 3671 3672 /* 3673 * SSL_CTX_set_next_proto_select_cb sets a callback that is called when a 3674 * client needs to select a protocol from the server's provided list. |out| 3675 * must be set to point to the selected protocol (which may be within |in|). 3676 * The length of the protocol name must be written into |outlen|. The 3677 * server's advertised protocols are provided in |in| and |inlen|. The 3678 * callback can assume that |in| is syntactically valid. The client must 3679 * select a protocol. It is fatal to the connection if this callback returns 3680 * a value other than SSL_TLSEXT_ERR_OK. 3681 */ 3682 void SSL_CTX_set_npn_select_cb(SSL_CTX *ctx, 3683 SSL_CTX_npn_select_cb_func cb, 3684 void *arg) 3685 { 3686 if (IS_QUIC_CTX(ctx)) 3687 /* NPN not allowed for QUIC */ 3688 return; 3689 3690 ctx->ext.npn_select_cb = cb; 3691 ctx->ext.npn_select_cb_arg = arg; 3692 } 3693 #endif 3694 3695 static int alpn_value_ok(const unsigned char *protos, unsigned int protos_len) 3696 { 3697 unsigned int idx; 3698 3699 if (protos_len < 2 || protos == NULL) 3700 return 0; 3701 3702 for (idx = 0; idx < protos_len; idx += protos[idx] + 1) { 3703 if (protos[idx] == 0) 3704 return 0; 3705 } 3706 return idx == protos_len; 3707 } 3708 /* 3709 * SSL_CTX_set_alpn_protos sets the ALPN protocol list on |ctx| to |protos|. 3710 * |protos| must be in wire-format (i.e. a series of non-empty, 8-bit 3711 * length-prefixed strings). Returns 0 on success. 3712 */ 3713 int SSL_CTX_set_alpn_protos(SSL_CTX *ctx, const unsigned char *protos, 3714 unsigned int protos_len) 3715 { 3716 unsigned char *alpn; 3717 3718 if (protos_len == 0 || protos == NULL) { 3719 OPENSSL_free(ctx->ext.alpn); 3720 ctx->ext.alpn = NULL; 3721 ctx->ext.alpn_len = 0; 3722 return 0; 3723 } 3724 /* Not valid per RFC */ 3725 if (!alpn_value_ok(protos, protos_len)) 3726 return 1; 3727 3728 alpn = OPENSSL_memdup(protos, protos_len); 3729 if (alpn == NULL) 3730 return 1; 3731 OPENSSL_free(ctx->ext.alpn); 3732 ctx->ext.alpn = alpn; 3733 ctx->ext.alpn_len = protos_len; 3734 3735 return 0; 3736 } 3737 3738 /* 3739 * SSL_set_alpn_protos sets the ALPN protocol list on |ssl| to |protos|. 3740 * |protos| must be in wire-format (i.e. a series of non-empty, 8-bit 3741 * length-prefixed strings). Returns 0 on success. 3742 */ 3743 int SSL_set_alpn_protos(SSL *ssl, const unsigned char *protos, 3744 unsigned int protos_len) 3745 { 3746 unsigned char *alpn; 3747 SSL_CONNECTION *sc = SSL_CONNECTION_FROM_SSL(ssl); 3748 3749 if (sc == NULL) 3750 return 1; 3751 3752 if (protos_len == 0 || protos == NULL) { 3753 OPENSSL_free(sc->ext.alpn); 3754 sc->ext.alpn = NULL; 3755 sc->ext.alpn_len = 0; 3756 return 0; 3757 } 3758 /* Not valid per RFC */ 3759 if (!alpn_value_ok(protos, protos_len)) 3760 return 1; 3761 3762 alpn = OPENSSL_memdup(protos, protos_len); 3763 if (alpn == NULL) 3764 return 1; 3765 OPENSSL_free(sc->ext.alpn); 3766 sc->ext.alpn = alpn; 3767 sc->ext.alpn_len = protos_len; 3768 3769 return 0; 3770 } 3771 3772 /* 3773 * SSL_CTX_set_alpn_select_cb sets a callback function on |ctx| that is 3774 * called during ClientHello processing in order to select an ALPN protocol 3775 * from the client's list of offered protocols. 3776 */ 3777 void SSL_CTX_set_alpn_select_cb(SSL_CTX *ctx, 3778 SSL_CTX_alpn_select_cb_func cb, 3779 void *arg) 3780 { 3781 ctx->ext.alpn_select_cb = cb; 3782 ctx->ext.alpn_select_cb_arg = arg; 3783 } 3784 3785 /* 3786 * SSL_get0_alpn_selected gets the selected ALPN protocol (if any) from |ssl|. 3787 * On return it sets |*data| to point to |*len| bytes of protocol name 3788 * (not including the leading length-prefix byte). If the server didn't 3789 * respond with a negotiated protocol then |*len| will be zero. 3790 */ 3791 void SSL_get0_alpn_selected(const SSL *ssl, const unsigned char **data, 3792 unsigned int *len) 3793 { 3794 const SSL_CONNECTION *sc = SSL_CONNECTION_FROM_CONST_SSL(ssl); 3795 3796 if (sc == NULL) { 3797 /* We have no other way to indicate error */ 3798 *data = NULL; 3799 *len = 0; 3800 return; 3801 } 3802 3803 *data = sc->s3.alpn_selected; 3804 if (*data == NULL) 3805 *len = 0; 3806 else 3807 *len = (unsigned int)sc->s3.alpn_selected_len; 3808 } 3809 3810 int SSL_export_keying_material(SSL *s, unsigned char *out, size_t olen, 3811 const char *label, size_t llen, 3812 const unsigned char *context, size_t contextlen, 3813 int use_context) 3814 { 3815 SSL_CONNECTION *sc = SSL_CONNECTION_FROM_SSL(s); 3816 3817 if (sc == NULL) 3818 return -1; 3819 3820 if (sc->session == NULL 3821 || (sc->version < TLS1_VERSION && sc->version != DTLS1_BAD_VER)) 3822 return -1; 3823 3824 return sc->ssl.method->ssl3_enc->export_keying_material(sc, out, olen, label, 3825 llen, context, 3826 contextlen, 3827 use_context); 3828 } 3829 3830 int SSL_export_keying_material_early(SSL *s, unsigned char *out, size_t olen, 3831 const char *label, size_t llen, 3832 const unsigned char *context, 3833 size_t contextlen) 3834 { 3835 SSL_CONNECTION *sc = SSL_CONNECTION_FROM_SSL(s); 3836 3837 if (sc == NULL) 3838 return -1; 3839 3840 if (sc->version != TLS1_3_VERSION) 3841 return 0; 3842 3843 return tls13_export_keying_material_early(sc, out, olen, label, llen, 3844 context, contextlen); 3845 } 3846 3847 static unsigned long ssl_session_hash(const SSL_SESSION *a) 3848 { 3849 const unsigned char *session_id = a->session_id; 3850 unsigned long l; 3851 unsigned char tmp_storage[4]; 3852 3853 if (a->session_id_length < sizeof(tmp_storage)) { 3854 memset(tmp_storage, 0, sizeof(tmp_storage)); 3855 memcpy(tmp_storage, a->session_id, a->session_id_length); 3856 session_id = tmp_storage; 3857 } 3858 3859 l = (unsigned long)((unsigned long)session_id[0]) | ((unsigned long)session_id[1] << 8L) | ((unsigned long)session_id[2] << 16L) | ((unsigned long)session_id[3] << 24L); 3860 return l; 3861 } 3862 3863 /* 3864 * NB: If this function (or indeed the hash function which uses a sort of 3865 * coarser function than this one) is changed, ensure 3866 * SSL_CTX_has_matching_session_id() is checked accordingly. It relies on 3867 * being able to construct an SSL_SESSION that will collide with any existing 3868 * session with a matching session ID. 3869 */ 3870 static int ssl_session_cmp(const SSL_SESSION *a, const SSL_SESSION *b) 3871 { 3872 if (a->ssl_version != b->ssl_version) 3873 return 1; 3874 if (a->session_id_length != b->session_id_length) 3875 return 1; 3876 return memcmp(a->session_id, b->session_id, a->session_id_length); 3877 } 3878 3879 #ifndef OPENSSL_NO_SSLKEYLOG 3880 /** 3881 * @brief Static initialization for a one-time action to initialize the SSL key log. 3882 */ 3883 static CRYPTO_ONCE ssl_keylog_once = CRYPTO_ONCE_STATIC_INIT; 3884 3885 /** 3886 * @brief Pointer to a read-write lock used to protect access to the key log. 3887 */ 3888 static CRYPTO_RWLOCK *keylog_lock = NULL; 3889 3890 /** 3891 * @brief Pointer to a BIO structure used for writing the key log information. 3892 */ 3893 static BIO *keylog_bio = NULL; 3894 3895 /** 3896 * @brief Initializes the SSLKEYLOGFILE lock. 3897 * 3898 * @return 1 on success, 0 on failure. 3899 */ 3900 DEFINE_RUN_ONCE_STATIC(ssl_keylog_init) 3901 { 3902 keylog_lock = CRYPTO_THREAD_lock_new(); 3903 if (keylog_lock == NULL) 3904 return 0; 3905 return 1; 3906 } 3907 3908 /** 3909 * @brief checks when a BIO refcount has reached zero, and sets 3910 * keylog_cb to NULL if it has 3911 * 3912 * @returns 1 always 3913 */ 3914 static long check_keylog_bio_free(BIO *b, int oper, const char *argp, 3915 size_t len, int argi, long argl, int ret, 3916 size_t *processed) 3917 { 3918 3919 /* 3920 * Note we _dont_ take the keylog_lock here 3921 * This is intentional, because we only free the keylog lock 3922 * During SSL_CTX_free, in which we already possess the lock, so 3923 * There's no need to grab it again here 3924 */ 3925 if (oper == BIO_CB_FREE) 3926 keylog_bio = NULL; 3927 return ret; 3928 } 3929 3930 /** 3931 * @brief records ssl secrets to a file 3932 */ 3933 static void do_sslkeylogfile(const SSL *ssl, const char *line) 3934 { 3935 if (keylog_lock == NULL) 3936 return; 3937 3938 if (!CRYPTO_THREAD_write_lock(keylog_lock)) 3939 return; 3940 if (keylog_bio != NULL) { 3941 BIO_printf(keylog_bio, "%s\n", line); 3942 (void)BIO_flush(keylog_bio); 3943 } 3944 CRYPTO_THREAD_unlock(keylog_lock); 3945 } 3946 #endif 3947 3948 /* 3949 * These wrapper functions should remain rather than redeclaring 3950 * SSL_SESSION_hash and SSL_SESSION_cmp for void* types and casting each 3951 * variable. The reason is that the functions aren't static, they're exposed 3952 * via ssl.h. 3953 */ 3954 3955 #ifndef OPENSSL_NO_SSLKEYLOG 3956 static BIO *get_sslkeylog_bio(const char *keylogfile) 3957 { 3958 #ifdef _POSIX_C_SOURCE 3959 BIO *b; 3960 int fdno = -1; 3961 FILE *fp = NULL; 3962 3963 fdno = open(keylogfile, O_WRONLY | O_CREAT | O_APPEND, 0600); 3964 if (fdno < 0) 3965 return NULL; 3966 3967 fp = fdopen(fdno, "a"); 3968 if (fp == NULL) { 3969 close(fdno); 3970 return NULL; 3971 } 3972 3973 if ((b = BIO_new_fp(fp, BIO_CLOSE)) == NULL) 3974 fclose(fp); 3975 return b; 3976 #else 3977 return BIO_new_file(keylogfile, "a"); 3978 #endif 3979 } 3980 #endif 3981 3982 SSL_CTX *SSL_CTX_new_ex(OSSL_LIB_CTX *libctx, const char *propq, 3983 const SSL_METHOD *meth) 3984 { 3985 SSL_CTX *ret = NULL; 3986 #ifndef OPENSSL_NO_SSLKEYLOG 3987 const char *keylogfile = ossl_safe_getenv("SSLKEYLOGFILE"); 3988 #endif 3989 #ifndef OPENSSL_NO_COMP_ALG 3990 int i; 3991 #endif 3992 3993 if (meth == NULL) { 3994 ERR_raise(ERR_LIB_SSL, SSL_R_NULL_SSL_METHOD_PASSED); 3995 return NULL; 3996 } 3997 3998 if (!OPENSSL_init_ssl(OPENSSL_INIT_LOAD_SSL_STRINGS, NULL)) 3999 return NULL; 4000 4001 /* Doing this for the run once effect */ 4002 if (SSL_get_ex_data_X509_STORE_CTX_idx() < 0) { 4003 ERR_raise(ERR_LIB_SSL, SSL_R_X509_VERIFICATION_SETUP_PROBLEMS); 4004 goto err; 4005 } 4006 4007 ret = OPENSSL_zalloc(sizeof(*ret)); 4008 if (ret == NULL) 4009 return NULL; 4010 4011 /* Init the reference counting before any call to SSL_CTX_free */ 4012 if (!CRYPTO_NEW_REF(&ret->references, 1)) { 4013 OPENSSL_free(ret); 4014 return NULL; 4015 } 4016 4017 ret->lock = CRYPTO_THREAD_lock_new(); 4018 if (ret->lock == NULL) { 4019 ERR_raise(ERR_LIB_SSL, ERR_R_CRYPTO_LIB); 4020 goto err; 4021 } 4022 4023 #ifdef TSAN_REQUIRES_LOCKING 4024 ret->tsan_lock = CRYPTO_THREAD_lock_new(); 4025 if (ret->tsan_lock == NULL) { 4026 ERR_raise(ERR_LIB_SSL, ERR_R_CRYPTO_LIB); 4027 goto err; 4028 } 4029 #endif 4030 4031 ret->libctx = libctx; 4032 if (propq != NULL) { 4033 ret->propq = OPENSSL_strdup(propq); 4034 if (ret->propq == NULL) 4035 goto err; 4036 } 4037 4038 ret->method = meth; 4039 ret->min_proto_version = 0; 4040 ret->max_proto_version = 0; 4041 ret->mode = SSL_MODE_AUTO_RETRY; 4042 ret->session_cache_mode = SSL_SESS_CACHE_SERVER; 4043 ret->session_cache_size = SSL_SESSION_CACHE_MAX_SIZE_DEFAULT; 4044 /* We take the system default. */ 4045 ret->session_timeout = meth->get_timeout(); 4046 ret->max_cert_list = SSL_MAX_CERT_LIST_DEFAULT; 4047 ret->verify_mode = SSL_VERIFY_NONE; 4048 4049 ret->sessions = lh_SSL_SESSION_new(ssl_session_hash, ssl_session_cmp); 4050 if (ret->sessions == NULL) { 4051 ERR_raise(ERR_LIB_SSL, ERR_R_CRYPTO_LIB); 4052 goto err; 4053 } 4054 ret->cert_store = X509_STORE_new(); 4055 if (ret->cert_store == NULL) { 4056 ERR_raise(ERR_LIB_SSL, ERR_R_X509_LIB); 4057 goto err; 4058 } 4059 #ifndef OPENSSL_NO_CT 4060 ret->ctlog_store = CTLOG_STORE_new_ex(libctx, propq); 4061 if (ret->ctlog_store == NULL) { 4062 ERR_raise(ERR_LIB_SSL, ERR_R_CT_LIB); 4063 goto err; 4064 } 4065 #endif 4066 4067 /* initialize cipher/digest methods table */ 4068 if (!ssl_load_ciphers(ret)) { 4069 ERR_raise(ERR_LIB_SSL, ERR_R_SSL_LIB); 4070 goto err; 4071 } 4072 4073 if (!ssl_load_groups(ret)) { 4074 ERR_raise(ERR_LIB_SSL, ERR_R_SSL_LIB); 4075 goto err; 4076 } 4077 4078 /* load provider sigalgs */ 4079 if (!ssl_load_sigalgs(ret)) { 4080 ERR_raise(ERR_LIB_SSL, ERR_R_SSL_LIB); 4081 goto err; 4082 } 4083 4084 /* initialise sig algs */ 4085 if (!ssl_setup_sigalgs(ret)) { 4086 ERR_raise(ERR_LIB_SSL, ERR_R_SSL_LIB); 4087 goto err; 4088 } 4089 4090 if (!SSL_CTX_set_ciphersuites(ret, OSSL_default_ciphersuites())) { 4091 ERR_raise(ERR_LIB_SSL, ERR_R_SSL_LIB); 4092 goto err; 4093 } 4094 4095 if ((ret->cert = ssl_cert_new(SSL_PKEY_NUM + ret->sigalg_list_len)) == NULL) { 4096 ERR_raise(ERR_LIB_SSL, ERR_R_SSL_LIB); 4097 goto err; 4098 } 4099 4100 if (!ssl_create_cipher_list(ret, 4101 ret->tls13_ciphersuites, 4102 &ret->cipher_list, &ret->cipher_list_by_id, 4103 OSSL_default_cipher_list(), ret->cert) 4104 || sk_SSL_CIPHER_num(ret->cipher_list) <= 0) { 4105 ERR_raise(ERR_LIB_SSL, SSL_R_LIBRARY_HAS_NO_CIPHERS); 4106 goto err; 4107 } 4108 4109 ret->param = X509_VERIFY_PARAM_new(); 4110 if (ret->param == NULL) { 4111 ERR_raise(ERR_LIB_SSL, ERR_R_X509_LIB); 4112 goto err; 4113 } 4114 4115 /* 4116 * If these aren't available from the provider we'll get NULL returns. 4117 * That's fine but will cause errors later if SSLv3 is negotiated 4118 */ 4119 ret->md5 = ssl_evp_md_fetch(libctx, NID_md5, propq); 4120 ret->sha1 = ssl_evp_md_fetch(libctx, NID_sha1, propq); 4121 4122 if ((ret->ca_names = sk_X509_NAME_new_null()) == NULL) { 4123 ERR_raise(ERR_LIB_SSL, ERR_R_CRYPTO_LIB); 4124 goto err; 4125 } 4126 4127 if ((ret->client_ca_names = sk_X509_NAME_new_null()) == NULL) { 4128 ERR_raise(ERR_LIB_SSL, ERR_R_CRYPTO_LIB); 4129 goto err; 4130 } 4131 4132 if (!CRYPTO_new_ex_data(CRYPTO_EX_INDEX_SSL_CTX, ret, &ret->ex_data)) { 4133 ERR_raise(ERR_LIB_SSL, ERR_R_CRYPTO_LIB); 4134 goto err; 4135 } 4136 4137 if ((ret->ext.secure = OPENSSL_secure_zalloc(sizeof(*ret->ext.secure))) == NULL) 4138 goto err; 4139 4140 /* No compression for DTLS */ 4141 if (!(meth->ssl3_enc->enc_flags & SSL_ENC_FLAG_DTLS)) 4142 ret->comp_methods = SSL_COMP_get_compression_methods(); 4143 4144 ret->max_send_fragment = SSL3_RT_MAX_PLAIN_LENGTH; 4145 ret->split_send_fragment = SSL3_RT_MAX_PLAIN_LENGTH; 4146 4147 /* Setup RFC5077 ticket keys */ 4148 if ((RAND_bytes_ex(libctx, ret->ext.tick_key_name, 4149 sizeof(ret->ext.tick_key_name), 0) 4150 <= 0) 4151 || (RAND_priv_bytes_ex(libctx, ret->ext.secure->tick_hmac_key, 4152 sizeof(ret->ext.secure->tick_hmac_key), 0) 4153 <= 0) 4154 || (RAND_priv_bytes_ex(libctx, ret->ext.secure->tick_aes_key, 4155 sizeof(ret->ext.secure->tick_aes_key), 0) 4156 <= 0)) 4157 ret->options |= SSL_OP_NO_TICKET; 4158 4159 if (RAND_priv_bytes_ex(libctx, ret->ext.cookie_hmac_key, 4160 sizeof(ret->ext.cookie_hmac_key), 0) 4161 <= 0) { 4162 ERR_raise(ERR_LIB_SSL, ERR_R_RAND_LIB); 4163 goto err; 4164 } 4165 4166 #ifndef OPENSSL_NO_SRP 4167 if (!ssl_ctx_srp_ctx_init_intern(ret)) { 4168 ERR_raise(ERR_LIB_SSL, ERR_R_SSL_LIB); 4169 goto err; 4170 } 4171 #endif 4172 #ifndef OPENSSL_NO_ENGINE 4173 #ifdef OPENSSL_SSL_CLIENT_ENGINE_AUTO 4174 #define eng_strx(x) #x 4175 #define eng_str(x) eng_strx(x) 4176 /* Use specific client engine automatically... ignore errors */ 4177 { 4178 ENGINE *eng; 4179 eng = ENGINE_by_id(eng_str(OPENSSL_SSL_CLIENT_ENGINE_AUTO)); 4180 if (!eng) { 4181 ERR_clear_error(); 4182 ENGINE_load_builtin_engines(); 4183 eng = ENGINE_by_id(eng_str(OPENSSL_SSL_CLIENT_ENGINE_AUTO)); 4184 } 4185 if (!eng || !SSL_CTX_set_client_cert_engine(ret, eng)) 4186 ERR_clear_error(); 4187 } 4188 #endif 4189 #endif 4190 4191 #ifndef OPENSSL_NO_COMP_ALG 4192 /* 4193 * Set the default order: brotli, zlib, zstd 4194 * Including only those enabled algorithms 4195 */ 4196 memset(ret->cert_comp_prefs, 0, sizeof(ret->cert_comp_prefs)); 4197 i = 0; 4198 if (ossl_comp_has_alg(TLSEXT_comp_cert_brotli)) 4199 ret->cert_comp_prefs[i++] = TLSEXT_comp_cert_brotli; 4200 if (ossl_comp_has_alg(TLSEXT_comp_cert_zlib)) 4201 ret->cert_comp_prefs[i++] = TLSEXT_comp_cert_zlib; 4202 if (ossl_comp_has_alg(TLSEXT_comp_cert_zstd)) 4203 ret->cert_comp_prefs[i++] = TLSEXT_comp_cert_zstd; 4204 #endif 4205 /* 4206 * Disable compression by default to prevent CRIME. Applications can 4207 * re-enable compression by configuring 4208 * SSL_CTX_clear_options(ctx, SSL_OP_NO_COMPRESSION); 4209 * or by using the SSL_CONF library. Similarly we also enable TLSv1.3 4210 * middlebox compatibility by default. This may be disabled by default in 4211 * a later OpenSSL version. 4212 */ 4213 ret->options |= SSL_OP_NO_COMPRESSION | SSL_OP_ENABLE_MIDDLEBOX_COMPAT; 4214 4215 ret->ext.status_type = TLSEXT_STATUSTYPE_nothing; 4216 4217 /* 4218 * We cannot usefully set a default max_early_data here (which gets 4219 * propagated in SSL_new(), for the following reason: setting the 4220 * SSL field causes tls_construct_stoc_early_data() to tell the 4221 * client that early data will be accepted when constructing a TLS 1.3 4222 * session ticket, and the client will accordingly send us early data 4223 * when using that ticket (if the client has early data to send). 4224 * However, in order for the early data to actually be consumed by 4225 * the application, the application must also have calls to 4226 * SSL_read_early_data(); otherwise we'll just skip past the early data 4227 * and ignore it. So, since the application must add calls to 4228 * SSL_read_early_data(), we also require them to add 4229 * calls to SSL_CTX_set_max_early_data() in order to use early data, 4230 * eliminating the bandwidth-wasting early data in the case described 4231 * above. 4232 */ 4233 ret->max_early_data = 0; 4234 4235 /* 4236 * Default recv_max_early_data is a fully loaded single record. Could be 4237 * split across multiple records in practice. We set this differently to 4238 * max_early_data so that, in the default case, we do not advertise any 4239 * support for early_data, but if a client were to send us some (e.g. 4240 * because of an old, stale ticket) then we will tolerate it and skip over 4241 * it. 4242 */ 4243 ret->recv_max_early_data = SSL3_RT_MAX_PLAIN_LENGTH; 4244 4245 /* By default we send two session tickets automatically in TLSv1.3 */ 4246 ret->num_tickets = 2; 4247 4248 #ifndef OPENSSL_NO_QUIC 4249 /* only create a cache for client CTX-es */ 4250 if (meth == OSSL_QUIC_client_method()) 4251 if ((ret->tokencache = ossl_quic_new_token_store()) == NULL) 4252 goto err; 4253 ret->domain_flags = 0; 4254 if (IS_QUIC_METHOD(meth)) { 4255 #if defined(OPENSSL_THREADS) 4256 if (meth == OSSL_QUIC_client_thread_method()) 4257 ret->domain_flags 4258 = SSL_DOMAIN_FLAG_MULTI_THREAD 4259 | SSL_DOMAIN_FLAG_THREAD_ASSISTED 4260 | SSL_DOMAIN_FLAG_BLOCKING; 4261 else 4262 ret->domain_flags 4263 = SSL_DOMAIN_FLAG_MULTI_THREAD 4264 | SSL_DOMAIN_FLAG_LEGACY_BLOCKING; 4265 #else 4266 ret->domain_flags 4267 = SSL_DOMAIN_FLAG_SINGLE_THREAD 4268 | SSL_DOMAIN_FLAG_LEGACY_BLOCKING; 4269 #endif 4270 } 4271 #endif 4272 4273 if (!ssl_ctx_system_config(ret)) { 4274 ERR_raise(ERR_LIB_SSL, SSL_R_ERROR_IN_SYSTEM_DEFAULT_CONFIG); 4275 goto err; 4276 } 4277 4278 #ifndef OPENSSL_NO_SSLKEYLOG 4279 if (keylogfile != NULL && strlen(keylogfile) != 0) { 4280 /* Make sure we have a global lock allocated */ 4281 if (!RUN_ONCE(&ssl_keylog_once, ssl_keylog_init)) { 4282 /* use a trace message as a warning */ 4283 OSSL_TRACE(TLS, "Unable to initialize keylog data\n"); 4284 goto out; 4285 } 4286 4287 /* Grab our global lock */ 4288 if (!CRYPTO_THREAD_write_lock(keylog_lock)) { 4289 OSSL_TRACE(TLS, "Unable to acquire keylog write lock\n"); 4290 goto out; 4291 } else { 4292 /* 4293 * If the bio for the requested keylog file hasn't been 4294 * created yet, go ahead and create it, and set it to append 4295 * if its already there. 4296 */ 4297 if (keylog_bio == NULL) { 4298 keylog_bio = get_sslkeylog_bio(keylogfile); 4299 if (keylog_bio == NULL) { 4300 OSSL_TRACE(TLS, "Unable to create keylog bio\n"); 4301 goto out; 4302 } 4303 BIO_set_callback_ex(keylog_bio, check_keylog_bio_free); 4304 } else { 4305 /* up our refcount for the already-created case */ 4306 BIO_up_ref(keylog_bio); 4307 } 4308 /* If we have a bio now, assign the callback handler */ 4309 if (keylog_bio != NULL) 4310 ret->do_sslkeylog = 1; 4311 /* unlock, and we're done */ 4312 CRYPTO_THREAD_unlock(keylog_lock); 4313 } 4314 } 4315 out: 4316 #endif 4317 return ret; 4318 err: 4319 SSL_CTX_free(ret); 4320 #ifndef OPENSSL_NO_SSLKEYLOG 4321 BIO_free(keylog_bio); 4322 #endif 4323 return NULL; 4324 } 4325 4326 SSL_CTX *SSL_CTX_new(const SSL_METHOD *meth) 4327 { 4328 return SSL_CTX_new_ex(NULL, NULL, meth); 4329 } 4330 4331 int SSL_CTX_up_ref(SSL_CTX *ctx) 4332 { 4333 int i; 4334 4335 if (CRYPTO_UP_REF(&ctx->references, &i) <= 0) 4336 return 0; 4337 4338 REF_PRINT_COUNT("SSL_CTX", i, ctx); 4339 REF_ASSERT_ISNT(i < 2); 4340 return ((i > 1) ? 1 : 0); 4341 } 4342 4343 void SSL_CTX_free(SSL_CTX *a) 4344 { 4345 int i; 4346 size_t j; 4347 4348 if (a == NULL) 4349 return; 4350 4351 CRYPTO_DOWN_REF(&a->references, &i); 4352 REF_PRINT_COUNT("SSL_CTX", i, a); 4353 if (i > 0) 4354 return; 4355 REF_ASSERT_ISNT(i < 0); 4356 4357 #ifndef OPENSSL_NO_SSLKEYLOG 4358 if (keylog_lock != NULL && CRYPTO_THREAD_write_lock(keylog_lock)) { 4359 if (a->do_sslkeylog == 1) 4360 BIO_free(keylog_bio); 4361 a->do_sslkeylog = 0; 4362 CRYPTO_THREAD_unlock(keylog_lock); 4363 } 4364 #endif 4365 4366 X509_VERIFY_PARAM_free(a->param); 4367 dane_ctx_final(&a->dane); 4368 4369 /* 4370 * Free internal session cache. However: the remove_cb() may reference 4371 * the ex_data of SSL_CTX, thus the ex_data store can only be removed 4372 * after the sessions were flushed. 4373 * As the ex_data handling routines might also touch the session cache, 4374 * the most secure solution seems to be: empty (flush) the cache, then 4375 * free ex_data, then finally free the cache. 4376 * (See ticket [openssl.org #212].) 4377 */ 4378 if (a->sessions != NULL) 4379 SSL_CTX_flush_sessions_ex(a, 0); 4380 4381 CRYPTO_free_ex_data(CRYPTO_EX_INDEX_SSL_CTX, a, &a->ex_data); 4382 lh_SSL_SESSION_free(a->sessions); 4383 X509_STORE_free(a->cert_store); 4384 #ifndef OPENSSL_NO_CT 4385 CTLOG_STORE_free(a->ctlog_store); 4386 #endif 4387 sk_SSL_CIPHER_free(a->cipher_list); 4388 sk_SSL_CIPHER_free(a->cipher_list_by_id); 4389 sk_SSL_CIPHER_free(a->tls13_ciphersuites); 4390 ssl_cert_free(a->cert); 4391 sk_X509_NAME_pop_free(a->ca_names, X509_NAME_free); 4392 sk_X509_NAME_pop_free(a->client_ca_names, X509_NAME_free); 4393 OSSL_STACK_OF_X509_free(a->extra_certs); 4394 a->comp_methods = NULL; 4395 #ifndef OPENSSL_NO_SRTP 4396 sk_SRTP_PROTECTION_PROFILE_free(a->srtp_profiles); 4397 #endif 4398 #ifndef OPENSSL_NO_SRP 4399 ssl_ctx_srp_ctx_free_intern(a); 4400 #endif 4401 #ifndef OPENSSL_NO_ENGINE 4402 tls_engine_finish(a->client_cert_engine); 4403 #endif 4404 4405 OPENSSL_free(a->ext.ecpointformats); 4406 OPENSSL_free(a->ext.supportedgroups); 4407 OPENSSL_free(a->ext.keyshares); 4408 OPENSSL_free(a->ext.tuples); 4409 OPENSSL_free(a->ext.alpn); 4410 OPENSSL_secure_free(a->ext.secure); 4411 4412 ssl_evp_md_free(a->md5); 4413 ssl_evp_md_free(a->sha1); 4414 4415 for (j = 0; j < SSL_ENC_NUM_IDX; j++) 4416 ssl_evp_cipher_free(a->ssl_cipher_methods[j]); 4417 for (j = 0; j < SSL_MD_NUM_IDX; j++) 4418 ssl_evp_md_free(a->ssl_digest_methods[j]); 4419 for (j = 0; j < a->group_list_len; j++) { 4420 OPENSSL_free(a->group_list[j].tlsname); 4421 OPENSSL_free(a->group_list[j].realname); 4422 OPENSSL_free(a->group_list[j].algorithm); 4423 } 4424 OPENSSL_free(a->group_list); 4425 for (j = 0; j < a->sigalg_list_len; j++) { 4426 OPENSSL_free(a->sigalg_list[j].name); 4427 OPENSSL_free(a->sigalg_list[j].sigalg_name); 4428 OPENSSL_free(a->sigalg_list[j].sigalg_oid); 4429 OPENSSL_free(a->sigalg_list[j].sig_name); 4430 OPENSSL_free(a->sigalg_list[j].sig_oid); 4431 OPENSSL_free(a->sigalg_list[j].hash_name); 4432 OPENSSL_free(a->sigalg_list[j].hash_oid); 4433 OPENSSL_free(a->sigalg_list[j].keytype); 4434 OPENSSL_free(a->sigalg_list[j].keytype_oid); 4435 } 4436 OPENSSL_free(a->sigalg_list); 4437 OPENSSL_free(a->ssl_cert_info); 4438 4439 OPENSSL_free(a->sigalg_lookup_cache); 4440 OPENSSL_free(a->tls12_sigalgs); 4441 4442 OPENSSL_free(a->client_cert_type); 4443 OPENSSL_free(a->server_cert_type); 4444 4445 CRYPTO_THREAD_lock_free(a->lock); 4446 CRYPTO_FREE_REF(&a->references); 4447 #ifdef TSAN_REQUIRES_LOCKING 4448 CRYPTO_THREAD_lock_free(a->tsan_lock); 4449 #endif 4450 4451 OPENSSL_free(a->propq); 4452 #ifndef OPENSSL_NO_QLOG 4453 OPENSSL_free(a->qlog_title); 4454 #endif 4455 4456 #ifndef OPENSSL_NO_QUIC 4457 ossl_quic_free_token_store(a->tokencache); 4458 #endif 4459 4460 OPENSSL_free(a); 4461 } 4462 4463 void SSL_CTX_set_default_passwd_cb(SSL_CTX *ctx, pem_password_cb *cb) 4464 { 4465 ctx->default_passwd_callback = cb; 4466 } 4467 4468 void SSL_CTX_set_default_passwd_cb_userdata(SSL_CTX *ctx, void *u) 4469 { 4470 ctx->default_passwd_callback_userdata = u; 4471 } 4472 4473 pem_password_cb *SSL_CTX_get_default_passwd_cb(SSL_CTX *ctx) 4474 { 4475 return ctx->default_passwd_callback; 4476 } 4477 4478 void *SSL_CTX_get_default_passwd_cb_userdata(SSL_CTX *ctx) 4479 { 4480 return ctx->default_passwd_callback_userdata; 4481 } 4482 4483 void SSL_set_default_passwd_cb(SSL *s, pem_password_cb *cb) 4484 { 4485 SSL_CONNECTION *sc = SSL_CONNECTION_FROM_SSL(s); 4486 4487 if (sc == NULL) 4488 return; 4489 4490 sc->default_passwd_callback = cb; 4491 } 4492 4493 void SSL_set_default_passwd_cb_userdata(SSL *s, void *u) 4494 { 4495 SSL_CONNECTION *sc = SSL_CONNECTION_FROM_SSL(s); 4496 4497 if (sc == NULL) 4498 return; 4499 4500 sc->default_passwd_callback_userdata = u; 4501 } 4502 4503 pem_password_cb *SSL_get_default_passwd_cb(SSL *s) 4504 { 4505 SSL_CONNECTION *sc = SSL_CONNECTION_FROM_SSL(s); 4506 4507 if (sc == NULL) 4508 return NULL; 4509 4510 return sc->default_passwd_callback; 4511 } 4512 4513 void *SSL_get_default_passwd_cb_userdata(SSL *s) 4514 { 4515 SSL_CONNECTION *sc = SSL_CONNECTION_FROM_SSL(s); 4516 4517 if (sc == NULL) 4518 return NULL; 4519 4520 return sc->default_passwd_callback_userdata; 4521 } 4522 4523 void SSL_CTX_set_cert_verify_callback(SSL_CTX *ctx, 4524 int (*cb)(X509_STORE_CTX *, void *), 4525 void *arg) 4526 { 4527 ctx->app_verify_callback = cb; 4528 ctx->app_verify_arg = arg; 4529 } 4530 4531 void SSL_CTX_set_verify(SSL_CTX *ctx, int mode, 4532 int (*cb)(int, X509_STORE_CTX *)) 4533 { 4534 ctx->verify_mode = mode; 4535 ctx->default_verify_callback = cb; 4536 } 4537 4538 void SSL_CTX_set_verify_depth(SSL_CTX *ctx, int depth) 4539 { 4540 X509_VERIFY_PARAM_set_depth(ctx->param, depth); 4541 } 4542 4543 void SSL_CTX_set_cert_cb(SSL_CTX *c, int (*cb)(SSL *ssl, void *arg), void *arg) 4544 { 4545 ssl_cert_set_cert_cb(c->cert, cb, arg); 4546 } 4547 4548 void SSL_set_cert_cb(SSL *s, int (*cb)(SSL *ssl, void *arg), void *arg) 4549 { 4550 SSL_CONNECTION *sc = SSL_CONNECTION_FROM_SSL(s); 4551 4552 if (sc == NULL) 4553 return; 4554 4555 ssl_cert_set_cert_cb(sc->cert, cb, arg); 4556 } 4557 4558 void ssl_set_masks(SSL_CONNECTION *s) 4559 { 4560 CERT *c = s->cert; 4561 uint32_t *pvalid = s->s3.tmp.valid_flags; 4562 int rsa_enc, rsa_sign, dh_tmp, dsa_sign; 4563 unsigned long mask_k, mask_a; 4564 int have_ecc_cert, ecdsa_ok; 4565 4566 if (c == NULL) 4567 return; 4568 4569 dh_tmp = (c->dh_tmp != NULL 4570 || c->dh_tmp_cb != NULL 4571 || c->dh_tmp_auto); 4572 4573 rsa_enc = pvalid[SSL_PKEY_RSA] & CERT_PKEY_VALID; 4574 rsa_sign = pvalid[SSL_PKEY_RSA] & CERT_PKEY_VALID; 4575 dsa_sign = pvalid[SSL_PKEY_DSA_SIGN] & CERT_PKEY_VALID; 4576 have_ecc_cert = pvalid[SSL_PKEY_ECC] & CERT_PKEY_VALID; 4577 mask_k = 0; 4578 mask_a = 0; 4579 4580 OSSL_TRACE4(TLS_CIPHER, "dh_tmp=%d rsa_enc=%d rsa_sign=%d dsa_sign=%d\n", 4581 dh_tmp, rsa_enc, rsa_sign, dsa_sign); 4582 4583 #ifndef OPENSSL_NO_GOST 4584 if (ssl_has_cert(s, SSL_PKEY_GOST12_512)) { 4585 mask_k |= SSL_kGOST | SSL_kGOST18; 4586 mask_a |= SSL_aGOST12; 4587 } 4588 if (ssl_has_cert(s, SSL_PKEY_GOST12_256)) { 4589 mask_k |= SSL_kGOST | SSL_kGOST18; 4590 mask_a |= SSL_aGOST12; 4591 } 4592 if (ssl_has_cert(s, SSL_PKEY_GOST01)) { 4593 mask_k |= SSL_kGOST; 4594 mask_a |= SSL_aGOST01; 4595 } 4596 #endif 4597 4598 if (rsa_enc) 4599 mask_k |= SSL_kRSA; 4600 4601 if (dh_tmp) 4602 mask_k |= SSL_kDHE; 4603 4604 /* 4605 * If we only have an RSA-PSS certificate allow RSA authentication 4606 * if TLS 1.2 and peer supports it. 4607 */ 4608 4609 if (rsa_enc || rsa_sign || (ssl_has_cert(s, SSL_PKEY_RSA_PSS_SIGN) && pvalid[SSL_PKEY_RSA_PSS_SIGN] & CERT_PKEY_EXPLICIT_SIGN && TLS1_get_version(&s->ssl) == TLS1_2_VERSION)) 4610 mask_a |= SSL_aRSA; 4611 4612 if (dsa_sign) { 4613 mask_a |= SSL_aDSS; 4614 } 4615 4616 mask_a |= SSL_aNULL; 4617 4618 /* 4619 * You can do anything with an RPK key, since there's no cert to restrict it 4620 * But we need to check for private keys 4621 */ 4622 if (pvalid[SSL_PKEY_RSA] & CERT_PKEY_RPK) { 4623 mask_a |= SSL_aRSA; 4624 mask_k |= SSL_kRSA; 4625 } 4626 if (pvalid[SSL_PKEY_ECC] & CERT_PKEY_RPK) 4627 mask_a |= SSL_aECDSA; 4628 if (TLS1_get_version(&s->ssl) == TLS1_2_VERSION) { 4629 if (pvalid[SSL_PKEY_RSA_PSS_SIGN] & CERT_PKEY_RPK) 4630 mask_a |= SSL_aRSA; 4631 if (pvalid[SSL_PKEY_ED25519] & CERT_PKEY_RPK 4632 || pvalid[SSL_PKEY_ED448] & CERT_PKEY_RPK) 4633 mask_a |= SSL_aECDSA; 4634 } 4635 4636 /* 4637 * An ECC certificate may be usable for ECDH and/or ECDSA cipher suites 4638 * depending on the key usage extension. 4639 */ 4640 if (have_ecc_cert) { 4641 uint32_t ex_kusage; 4642 ex_kusage = X509_get_key_usage(c->pkeys[SSL_PKEY_ECC].x509); 4643 ecdsa_ok = ex_kusage & X509v3_KU_DIGITAL_SIGNATURE; 4644 if (!(pvalid[SSL_PKEY_ECC] & CERT_PKEY_SIGN)) 4645 ecdsa_ok = 0; 4646 if (ecdsa_ok) 4647 mask_a |= SSL_aECDSA; 4648 } 4649 /* Allow Ed25519 for TLS 1.2 if peer supports it */ 4650 if (!(mask_a & SSL_aECDSA) && ssl_has_cert(s, SSL_PKEY_ED25519) 4651 && pvalid[SSL_PKEY_ED25519] & CERT_PKEY_EXPLICIT_SIGN 4652 && TLS1_get_version(&s->ssl) == TLS1_2_VERSION) 4653 mask_a |= SSL_aECDSA; 4654 4655 /* Allow Ed448 for TLS 1.2 if peer supports it */ 4656 if (!(mask_a & SSL_aECDSA) && ssl_has_cert(s, SSL_PKEY_ED448) 4657 && pvalid[SSL_PKEY_ED448] & CERT_PKEY_EXPLICIT_SIGN 4658 && TLS1_get_version(&s->ssl) == TLS1_2_VERSION) 4659 mask_a |= SSL_aECDSA; 4660 4661 mask_k |= SSL_kECDHE; 4662 4663 #ifndef OPENSSL_NO_PSK 4664 mask_k |= SSL_kPSK; 4665 mask_a |= SSL_aPSK; 4666 if (mask_k & SSL_kRSA) 4667 mask_k |= SSL_kRSAPSK; 4668 if (mask_k & SSL_kDHE) 4669 mask_k |= SSL_kDHEPSK; 4670 if (mask_k & SSL_kECDHE) 4671 mask_k |= SSL_kECDHEPSK; 4672 #endif 4673 4674 s->s3.tmp.mask_k = mask_k; 4675 s->s3.tmp.mask_a = mask_a; 4676 } 4677 4678 int ssl_check_srvr_ecc_cert_and_alg(X509 *x, SSL_CONNECTION *s) 4679 { 4680 if (s->s3.tmp.new_cipher->algorithm_auth & SSL_aECDSA) { 4681 /* key usage, if present, must allow signing */ 4682 if (!(X509_get_key_usage(x) & X509v3_KU_DIGITAL_SIGNATURE)) { 4683 ERR_raise(ERR_LIB_SSL, SSL_R_ECC_CERT_NOT_FOR_SIGNING); 4684 return 0; 4685 } 4686 } 4687 return 1; /* all checks are ok */ 4688 } 4689 4690 int ssl_get_server_cert_serverinfo(SSL_CONNECTION *s, 4691 const unsigned char **serverinfo, 4692 size_t *serverinfo_length) 4693 { 4694 CERT_PKEY *cpk = s->s3.tmp.cert; 4695 *serverinfo_length = 0; 4696 4697 if (cpk == NULL || cpk->serverinfo == NULL) 4698 return 0; 4699 4700 *serverinfo = cpk->serverinfo; 4701 *serverinfo_length = cpk->serverinfo_length; 4702 return 1; 4703 } 4704 4705 void ssl_update_cache(SSL_CONNECTION *s, int mode) 4706 { 4707 int i; 4708 4709 /* 4710 * If the session_id_length is 0, we are not supposed to cache it, and it 4711 * would be rather hard to do anyway :-). Also if the session has already 4712 * been marked as not_resumable we should not cache it for later reuse. 4713 */ 4714 if (s->session->session_id_length == 0 || s->session->not_resumable) 4715 return; 4716 4717 /* 4718 * If sid_ctx_length is 0 there is no specific application context 4719 * associated with this session, so when we try to resume it and 4720 * SSL_VERIFY_PEER is requested to verify the client identity, we have no 4721 * indication that this is actually a session for the proper application 4722 * context, and the *handshake* will fail, not just the resumption attempt. 4723 * Do not cache (on the server) these sessions that are not resumable 4724 * (clients can set SSL_VERIFY_PEER without needing a sid_ctx set). 4725 */ 4726 if (s->server && s->session->sid_ctx_length == 0 4727 && (s->verify_mode & SSL_VERIFY_PEER) != 0) 4728 return; 4729 4730 i = s->session_ctx->session_cache_mode; 4731 if ((i & mode) != 0 4732 && (!s->hit || SSL_CONNECTION_IS_TLS13(s))) { 4733 /* 4734 * Add the session to the internal cache. In server side TLSv1.3 we 4735 * normally don't do this because by default it's a full stateless ticket 4736 * with only a dummy session id so there is no reason to cache it, 4737 * unless: 4738 * - we are doing early_data, in which case we cache so that we can 4739 * detect replays 4740 * - the application has set a remove_session_cb so needs to know about 4741 * session timeout events 4742 * - SSL_OP_NO_TICKET is set in which case it is a stateful ticket 4743 */ 4744 if ((i & SSL_SESS_CACHE_NO_INTERNAL_STORE) == 0 4745 && (!SSL_CONNECTION_IS_TLS13(s) 4746 || !s->server 4747 || (s->max_early_data > 0 4748 && (s->options & SSL_OP_NO_ANTI_REPLAY) == 0) 4749 || s->session_ctx->remove_session_cb != NULL 4750 || (s->options & SSL_OP_NO_TICKET) != 0)) 4751 SSL_CTX_add_session(s->session_ctx, s->session); 4752 4753 /* 4754 * Add the session to the external cache. We do this even in server side 4755 * TLSv1.3 without early data because some applications just want to 4756 * know about the creation of a session and aren't doing a full cache. 4757 */ 4758 if (s->session_ctx->new_session_cb != NULL && SSL_SESSION_up_ref(s->session)) { 4759 if (!s->session_ctx->new_session_cb(SSL_CONNECTION_GET_USER_SSL(s), 4760 s->session)) 4761 SSL_SESSION_free(s->session); 4762 } 4763 } 4764 4765 /* auto flush every 255 connections */ 4766 if ((!(i & SSL_SESS_CACHE_NO_AUTO_CLEAR)) && ((i & mode) == mode)) { 4767 TSAN_QUALIFIER int *stat; 4768 4769 if (mode & SSL_SESS_CACHE_CLIENT) 4770 stat = &s->session_ctx->stats.sess_connect_good; 4771 else 4772 stat = &s->session_ctx->stats.sess_accept_good; 4773 if ((ssl_tsan_load(s->session_ctx, stat) & 0xff) == 0xff) 4774 SSL_CTX_flush_sessions_ex(s->session_ctx, time(NULL)); 4775 } 4776 } 4777 4778 const SSL_METHOD *SSL_CTX_get_ssl_method(const SSL_CTX *ctx) 4779 { 4780 return ctx->method; 4781 } 4782 4783 const SSL_METHOD *SSL_get_ssl_method(const SSL *s) 4784 { 4785 return s->method; 4786 } 4787 4788 int SSL_set_ssl_method(SSL *s, const SSL_METHOD *meth) 4789 { 4790 int ret = 1; 4791 SSL_CONNECTION *sc = SSL_CONNECTION_FROM_SSL(s); 4792 4793 /* Not allowed for QUIC */ 4794 if (sc == NULL 4795 || (s->type != SSL_TYPE_SSL_CONNECTION && s->method != meth) 4796 || (s->type == SSL_TYPE_SSL_CONNECTION && IS_QUIC_METHOD(meth))) 4797 return 0; 4798 4799 if (s->method != meth) { 4800 const SSL_METHOD *sm = s->method; 4801 int (*hf)(SSL *) = sc->handshake_func; 4802 4803 if (sm->version == meth->version) 4804 s->method = meth; 4805 else { 4806 sm->ssl_deinit(s); 4807 s->method = meth; 4808 ret = s->method->ssl_init(s); 4809 } 4810 4811 if (hf == sm->ssl_connect) 4812 sc->handshake_func = meth->ssl_connect; 4813 else if (hf == sm->ssl_accept) 4814 sc->handshake_func = meth->ssl_accept; 4815 } 4816 return ret; 4817 } 4818 4819 int SSL_get_error(const SSL *s, int i) 4820 { 4821 return ossl_ssl_get_error(s, i, /*check_err=*/1); 4822 } 4823 4824 int ossl_ssl_get_error(const SSL *s, int i, int check_err) 4825 { 4826 int reason; 4827 unsigned long l; 4828 BIO *bio; 4829 const SSL_CONNECTION *sc = SSL_CONNECTION_FROM_CONST_SSL(s); 4830 4831 if (i > 0) 4832 return SSL_ERROR_NONE; 4833 4834 #ifndef OPENSSL_NO_QUIC 4835 if (IS_QUIC(s)) { 4836 reason = ossl_quic_get_error(s, i); 4837 if (reason != SSL_ERROR_NONE) 4838 return reason; 4839 } 4840 #endif 4841 4842 if (sc == NULL) 4843 return SSL_ERROR_SSL; 4844 4845 /* 4846 * Make things return SSL_ERROR_SYSCALL when doing SSL_do_handshake etc, 4847 * where we do encode the error 4848 */ 4849 if (check_err && (l = ERR_peek_error()) != 0) { 4850 if (ERR_GET_LIB(l) == ERR_LIB_SYS) 4851 return SSL_ERROR_SYSCALL; 4852 else 4853 return SSL_ERROR_SSL; 4854 } 4855 4856 #ifndef OPENSSL_NO_QUIC 4857 if (!IS_QUIC(s)) 4858 #endif 4859 { 4860 if (SSL_want_read(s)) { 4861 bio = SSL_get_rbio(s); 4862 if (BIO_should_read(bio)) 4863 return SSL_ERROR_WANT_READ; 4864 else if (BIO_should_write(bio)) 4865 /* 4866 * This one doesn't make too much sense ... We never try to 4867 * write to the rbio, and an application program where rbio and 4868 * wbio are separate couldn't even know what it should wait for. 4869 * However if we ever set s->rwstate incorrectly (so that we 4870 * have SSL_want_read(s) instead of SSL_want_write(s)) and rbio 4871 * and wbio *are* the same, this test works around that bug; so 4872 * it might be safer to keep it. 4873 */ 4874 return SSL_ERROR_WANT_WRITE; 4875 else if (BIO_should_io_special(bio)) { 4876 reason = BIO_get_retry_reason(bio); 4877 if (reason == BIO_RR_CONNECT) 4878 return SSL_ERROR_WANT_CONNECT; 4879 else if (reason == BIO_RR_ACCEPT) 4880 return SSL_ERROR_WANT_ACCEPT; 4881 else 4882 return SSL_ERROR_SYSCALL; /* unknown */ 4883 } 4884 } 4885 4886 if (SSL_want_write(s)) { 4887 /* 4888 * Access wbio directly - in order to use the buffered bio if 4889 * present 4890 */ 4891 bio = sc->wbio; 4892 if (BIO_should_write(bio)) 4893 return SSL_ERROR_WANT_WRITE; 4894 else if (BIO_should_read(bio)) 4895 /* 4896 * See above (SSL_want_read(s) with BIO_should_write(bio)) 4897 */ 4898 return SSL_ERROR_WANT_READ; 4899 else if (BIO_should_io_special(bio)) { 4900 reason = BIO_get_retry_reason(bio); 4901 if (reason == BIO_RR_CONNECT) 4902 return SSL_ERROR_WANT_CONNECT; 4903 else if (reason == BIO_RR_ACCEPT) 4904 return SSL_ERROR_WANT_ACCEPT; 4905 else 4906 return SSL_ERROR_SYSCALL; 4907 } 4908 } 4909 } 4910 4911 if (SSL_want_x509_lookup(s)) 4912 return SSL_ERROR_WANT_X509_LOOKUP; 4913 if (SSL_want_retry_verify(s)) 4914 return SSL_ERROR_WANT_RETRY_VERIFY; 4915 if (SSL_want_async(s)) 4916 return SSL_ERROR_WANT_ASYNC; 4917 if (SSL_want_async_job(s)) 4918 return SSL_ERROR_WANT_ASYNC_JOB; 4919 if (SSL_want_client_hello_cb(s)) 4920 return SSL_ERROR_WANT_CLIENT_HELLO_CB; 4921 4922 if ((sc->shutdown & SSL_RECEIVED_SHUTDOWN) && (sc->s3.warn_alert == SSL_AD_CLOSE_NOTIFY)) 4923 return SSL_ERROR_ZERO_RETURN; 4924 4925 return SSL_ERROR_SYSCALL; 4926 } 4927 4928 static int ssl_do_handshake_intern(void *vargs) 4929 { 4930 struct ssl_async_args *args = (struct ssl_async_args *)vargs; 4931 SSL *s = args->s; 4932 SSL_CONNECTION *sc = SSL_CONNECTION_FROM_SSL(s); 4933 4934 if (sc == NULL) 4935 return -1; 4936 4937 return sc->handshake_func(s); 4938 } 4939 4940 int SSL_do_handshake(SSL *s) 4941 { 4942 int ret = 1; 4943 SSL_CONNECTION *sc = SSL_CONNECTION_FROM_SSL(s); 4944 4945 #ifndef OPENSSL_NO_QUIC 4946 if (IS_QUIC(s)) 4947 return ossl_quic_do_handshake(s); 4948 #endif 4949 4950 if (sc == NULL) 4951 return -1; 4952 4953 if (sc->handshake_func == NULL) { 4954 ERR_raise(ERR_LIB_SSL, SSL_R_CONNECTION_TYPE_NOT_SET); 4955 return -1; 4956 } 4957 4958 if (!ossl_statem_check_finish_init(sc, -1)) 4959 return -1; 4960 4961 s->method->ssl_renegotiate_check(s, 0); 4962 4963 if (SSL_in_init(s) || SSL_in_before(s)) { 4964 if ((sc->mode & SSL_MODE_ASYNC) && ASYNC_get_current_job() == NULL) { 4965 struct ssl_async_args args; 4966 4967 memset(&args, 0, sizeof(args)); 4968 args.s = s; 4969 4970 ret = ssl_start_async_job(s, &args, ssl_do_handshake_intern); 4971 } else { 4972 ret = sc->handshake_func(s); 4973 } 4974 } 4975 4976 return ret; 4977 } 4978 4979 void SSL_set_accept_state(SSL *s) 4980 { 4981 SSL_CONNECTION *sc = SSL_CONNECTION_FROM_SSL_ONLY(s); 4982 4983 #ifndef OPENSSL_NO_QUIC 4984 if (IS_QUIC(s)) { 4985 /* We suppress errors because this is a void function */ 4986 (void)ossl_quic_set_accept_state(s, 0 /* suppress errors */); 4987 return; 4988 } 4989 #endif 4990 4991 sc->server = 1; 4992 sc->shutdown = 0; 4993 ossl_statem_clear(sc); 4994 sc->handshake_func = s->method->ssl_accept; 4995 /* Ignore return value. Its a void public API function */ 4996 RECORD_LAYER_reset(&sc->rlayer); 4997 } 4998 4999 void SSL_set_connect_state(SSL *s) 5000 { 5001 SSL_CONNECTION *sc = SSL_CONNECTION_FROM_SSL_ONLY(s); 5002 5003 #ifndef OPENSSL_NO_QUIC 5004 if (IS_QUIC(s)) { 5005 /* We suppress errors because this is a void function */ 5006 (void)ossl_quic_set_connect_state(s, 0 /* suppress errors */); 5007 return; 5008 } 5009 #endif 5010 5011 sc->server = 0; 5012 sc->shutdown = 0; 5013 ossl_statem_clear(sc); 5014 sc->handshake_func = s->method->ssl_connect; 5015 /* Ignore return value. Its a void public API function */ 5016 RECORD_LAYER_reset(&sc->rlayer); 5017 } 5018 5019 int ssl_undefined_function(SSL *s) 5020 { 5021 ERR_raise(ERR_LIB_SSL, ERR_R_SHOULD_NOT_HAVE_BEEN_CALLED); 5022 return 0; 5023 } 5024 5025 int ssl_undefined_void_function(void) 5026 { 5027 ERR_raise(ERR_LIB_SSL, ERR_R_SHOULD_NOT_HAVE_BEEN_CALLED); 5028 return 0; 5029 } 5030 5031 const char *ssl_protocol_to_string(int version) 5032 { 5033 switch (version) { 5034 case TLS1_3_VERSION: 5035 return "TLSv1.3"; 5036 5037 case TLS1_2_VERSION: 5038 return "TLSv1.2"; 5039 5040 case TLS1_1_VERSION: 5041 return "TLSv1.1"; 5042 5043 case TLS1_VERSION: 5044 return "TLSv1"; 5045 5046 case SSL3_VERSION: 5047 return "SSLv3"; 5048 5049 case DTLS1_BAD_VER: 5050 return "DTLSv0.9"; 5051 5052 case DTLS1_VERSION: 5053 return "DTLSv1"; 5054 5055 case DTLS1_2_VERSION: 5056 return "DTLSv1.2"; 5057 5058 default: 5059 return "unknown"; 5060 } 5061 } 5062 5063 const char *SSL_get_version(const SSL *s) 5064 { 5065 const SSL_CONNECTION *sc = SSL_CONNECTION_FROM_CONST_SSL(s); 5066 5067 #ifndef OPENSSL_NO_QUIC 5068 /* We only support QUICv1 - so if its QUIC its QUICv1 */ 5069 if (s->type == SSL_TYPE_QUIC_CONNECTION || s->type == SSL_TYPE_QUIC_XSO) 5070 return "QUICv1"; 5071 #endif 5072 5073 if (sc == NULL) 5074 return NULL; 5075 5076 return ssl_protocol_to_string(sc->version); 5077 } 5078 5079 __owur int SSL_get_handshake_rtt(const SSL *s, uint64_t *rtt) 5080 { 5081 const SSL_CONNECTION *sc = SSL_CONNECTION_FROM_CONST_SSL(s); 5082 5083 if (sc == NULL) 5084 return -1; 5085 if (sc->ts_msg_write.t <= 0 || sc->ts_msg_read.t <= 0) 5086 return 0; /* data not (yet) available */ 5087 if (sc->ts_msg_read.t < sc->ts_msg_write.t) 5088 return -1; 5089 5090 *rtt = ossl_time2us(ossl_time_subtract(sc->ts_msg_read, sc->ts_msg_write)); 5091 return 1; 5092 } 5093 5094 static int dup_ca_names(STACK_OF(X509_NAME) **dst, STACK_OF(X509_NAME) *src) 5095 { 5096 STACK_OF(X509_NAME) *sk; 5097 X509_NAME *xn; 5098 int i; 5099 5100 if (src == NULL) { 5101 *dst = NULL; 5102 return 1; 5103 } 5104 5105 if ((sk = sk_X509_NAME_new_null()) == NULL) 5106 return 0; 5107 for (i = 0; i < sk_X509_NAME_num(src); i++) { 5108 xn = X509_NAME_dup(sk_X509_NAME_value(src, i)); 5109 if (xn == NULL) { 5110 sk_X509_NAME_pop_free(sk, X509_NAME_free); 5111 return 0; 5112 } 5113 if (sk_X509_NAME_insert(sk, xn, i) == 0) { 5114 X509_NAME_free(xn); 5115 sk_X509_NAME_pop_free(sk, X509_NAME_free); 5116 return 0; 5117 } 5118 } 5119 *dst = sk; 5120 5121 return 1; 5122 } 5123 5124 SSL *SSL_dup(SSL *s) 5125 { 5126 SSL *ret; 5127 int i; 5128 /* TODO(QUIC FUTURE): Add an SSL_METHOD function for duplication */ 5129 SSL_CONNECTION *retsc; 5130 SSL_CONNECTION *sc = SSL_CONNECTION_FROM_SSL_ONLY(s); 5131 5132 if (sc == NULL) 5133 return NULL; 5134 5135 /* If we're not quiescent, just up_ref! */ 5136 if (!SSL_in_init(s) || !SSL_in_before(s)) { 5137 CRYPTO_UP_REF(&s->references, &i); 5138 return s; 5139 } 5140 5141 /* 5142 * Otherwise, copy configuration state, and session if set. 5143 */ 5144 if ((ret = SSL_new(SSL_get_SSL_CTX(s))) == NULL) 5145 return NULL; 5146 if ((retsc = SSL_CONNECTION_FROM_SSL_ONLY(ret)) == NULL) 5147 goto err; 5148 5149 if (sc->session != NULL) { 5150 /* 5151 * Arranges to share the same session via up_ref. This "copies" 5152 * session-id, SSL_METHOD, sid_ctx, and 'cert' 5153 */ 5154 if (!SSL_copy_session_id(ret, s)) 5155 goto err; 5156 } else { 5157 /* 5158 * No session has been established yet, so we have to expect that 5159 * s->cert or ret->cert will be changed later -- they should not both 5160 * point to the same object, and thus we can't use 5161 * SSL_copy_session_id. 5162 */ 5163 if (!SSL_set_ssl_method(ret, s->method)) 5164 goto err; 5165 5166 if (sc->cert != NULL) { 5167 ssl_cert_free(retsc->cert); 5168 retsc->cert = ssl_cert_dup(sc->cert); 5169 if (retsc->cert == NULL) 5170 goto err; 5171 } 5172 5173 if (!SSL_set_session_id_context(ret, sc->sid_ctx, 5174 (int)sc->sid_ctx_length)) 5175 goto err; 5176 } 5177 5178 if (!ssl_dane_dup(retsc, sc)) 5179 goto err; 5180 retsc->version = sc->version; 5181 retsc->options = sc->options; 5182 retsc->min_proto_version = sc->min_proto_version; 5183 retsc->max_proto_version = sc->max_proto_version; 5184 retsc->mode = sc->mode; 5185 SSL_set_max_cert_list(ret, SSL_get_max_cert_list(s)); 5186 SSL_set_read_ahead(ret, SSL_get_read_ahead(s)); 5187 retsc->msg_callback = sc->msg_callback; 5188 retsc->msg_callback_arg = sc->msg_callback_arg; 5189 SSL_set_verify(ret, SSL_get_verify_mode(s), SSL_get_verify_callback(s)); 5190 SSL_set_verify_depth(ret, SSL_get_verify_depth(s)); 5191 retsc->generate_session_id = sc->generate_session_id; 5192 5193 SSL_set_info_callback(ret, SSL_get_info_callback(s)); 5194 5195 /* copy app data, a little dangerous perhaps */ 5196 if (!CRYPTO_dup_ex_data(CRYPTO_EX_INDEX_SSL, &ret->ex_data, &s->ex_data)) 5197 goto err; 5198 5199 retsc->server = sc->server; 5200 if (sc->handshake_func) { 5201 if (sc->server) 5202 SSL_set_accept_state(ret); 5203 else 5204 SSL_set_connect_state(ret); 5205 } 5206 retsc->shutdown = sc->shutdown; 5207 retsc->hit = sc->hit; 5208 5209 retsc->default_passwd_callback = sc->default_passwd_callback; 5210 retsc->default_passwd_callback_userdata = sc->default_passwd_callback_userdata; 5211 5212 X509_VERIFY_PARAM_inherit(retsc->param, sc->param); 5213 5214 /* dup the cipher_list and cipher_list_by_id stacks */ 5215 if (sc->cipher_list != NULL) { 5216 if ((retsc->cipher_list = sk_SSL_CIPHER_dup(sc->cipher_list)) == NULL) 5217 goto err; 5218 } 5219 if (sc->cipher_list_by_id != NULL) 5220 if ((retsc->cipher_list_by_id = sk_SSL_CIPHER_dup(sc->cipher_list_by_id)) 5221 == NULL) 5222 goto err; 5223 5224 /* Dup the client_CA list */ 5225 if (!dup_ca_names(&retsc->ca_names, sc->ca_names) 5226 || !dup_ca_names(&retsc->client_ca_names, sc->client_ca_names)) 5227 goto err; 5228 5229 return ret; 5230 5231 err: 5232 SSL_free(ret); 5233 return NULL; 5234 } 5235 5236 X509 *SSL_get_certificate(const SSL *s) 5237 { 5238 SSL_CONNECTION *sc = SSL_CONNECTION_FROM_SSL(s); 5239 5240 if (sc == NULL) 5241 return NULL; 5242 5243 if (sc->cert != NULL) 5244 return sc->cert->key->x509; 5245 else 5246 return NULL; 5247 } 5248 5249 EVP_PKEY *SSL_get_privatekey(const SSL *s) 5250 { 5251 const SSL_CONNECTION *sc = SSL_CONNECTION_FROM_CONST_SSL(s); 5252 5253 if (sc == NULL) 5254 return NULL; 5255 5256 if (sc->cert != NULL) 5257 return sc->cert->key->privatekey; 5258 else 5259 return NULL; 5260 } 5261 5262 X509 *SSL_CTX_get0_certificate(const SSL_CTX *ctx) 5263 { 5264 if (ctx->cert != NULL) 5265 return ctx->cert->key->x509; 5266 else 5267 return NULL; 5268 } 5269 5270 EVP_PKEY *SSL_CTX_get0_privatekey(const SSL_CTX *ctx) 5271 { 5272 if (ctx->cert != NULL) 5273 return ctx->cert->key->privatekey; 5274 else 5275 return NULL; 5276 } 5277 5278 const SSL_CIPHER *SSL_get_current_cipher(const SSL *s) 5279 { 5280 const SSL_CONNECTION *sc = SSL_CONNECTION_FROM_CONST_SSL(s); 5281 5282 if (sc == NULL) 5283 return NULL; 5284 5285 if ((sc->session != NULL) && (sc->session->cipher != NULL)) 5286 return sc->session->cipher; 5287 return NULL; 5288 } 5289 5290 const SSL_CIPHER *SSL_get_pending_cipher(const SSL *s) 5291 { 5292 const SSL_CONNECTION *sc = SSL_CONNECTION_FROM_CONST_SSL(s); 5293 5294 if (sc == NULL) 5295 return NULL; 5296 5297 return sc->s3.tmp.new_cipher; 5298 } 5299 5300 const COMP_METHOD *SSL_get_current_compression(const SSL *s) 5301 { 5302 #ifndef OPENSSL_NO_COMP 5303 const SSL_CONNECTION *sc = SSL_CONNECTION_FROM_CONST_SSL_ONLY(s); 5304 5305 if (sc == NULL) 5306 return NULL; 5307 5308 return sc->rlayer.wrlmethod->get_compression(sc->rlayer.wrl); 5309 #else 5310 return NULL; 5311 #endif 5312 } 5313 5314 const COMP_METHOD *SSL_get_current_expansion(const SSL *s) 5315 { 5316 #ifndef OPENSSL_NO_COMP 5317 const SSL_CONNECTION *sc = SSL_CONNECTION_FROM_CONST_SSL_ONLY(s); 5318 5319 if (sc == NULL) 5320 return NULL; 5321 5322 return sc->rlayer.rrlmethod->get_compression(sc->rlayer.rrl); 5323 #else 5324 return NULL; 5325 #endif 5326 } 5327 5328 int ssl_init_wbio_buffer(SSL_CONNECTION *s) 5329 { 5330 BIO *bbio; 5331 5332 if (s->bbio != NULL) { 5333 /* Already buffered. */ 5334 return 1; 5335 } 5336 5337 bbio = BIO_new(BIO_f_buffer()); 5338 if (bbio == NULL || BIO_set_read_buffer_size(bbio, 1) <= 0) { 5339 BIO_free(bbio); 5340 ERR_raise(ERR_LIB_SSL, ERR_R_BUF_LIB); 5341 return 0; 5342 } 5343 s->bbio = bbio; 5344 s->wbio = BIO_push(bbio, s->wbio); 5345 5346 s->rlayer.wrlmethod->set1_bio(s->rlayer.wrl, s->wbio); 5347 5348 return 1; 5349 } 5350 5351 int ssl_free_wbio_buffer(SSL_CONNECTION *s) 5352 { 5353 /* callers ensure s is never null */ 5354 if (s->bbio == NULL) 5355 return 1; 5356 5357 s->wbio = BIO_pop(s->wbio); 5358 s->rlayer.wrlmethod->set1_bio(s->rlayer.wrl, s->wbio); 5359 5360 BIO_free(s->bbio); 5361 s->bbio = NULL; 5362 5363 return 1; 5364 } 5365 5366 void SSL_CTX_set_quiet_shutdown(SSL_CTX *ctx, int mode) 5367 { 5368 ctx->quiet_shutdown = mode; 5369 } 5370 5371 int SSL_CTX_get_quiet_shutdown(const SSL_CTX *ctx) 5372 { 5373 return ctx->quiet_shutdown; 5374 } 5375 5376 void SSL_set_quiet_shutdown(SSL *s, int mode) 5377 { 5378 SSL_CONNECTION *sc = SSL_CONNECTION_FROM_SSL_ONLY(s); 5379 5380 /* Not supported with QUIC */ 5381 if (sc == NULL) 5382 return; 5383 5384 sc->quiet_shutdown = mode; 5385 } 5386 5387 int SSL_get_quiet_shutdown(const SSL *s) 5388 { 5389 const SSL_CONNECTION *sc = SSL_CONNECTION_FROM_CONST_SSL_ONLY(s); 5390 5391 /* Not supported with QUIC */ 5392 if (sc == NULL) 5393 return 0; 5394 5395 return sc->quiet_shutdown; 5396 } 5397 5398 void SSL_set_shutdown(SSL *s, int mode) 5399 { 5400 SSL_CONNECTION *sc = SSL_CONNECTION_FROM_SSL_ONLY(s); 5401 5402 /* Not supported with QUIC */ 5403 if (sc == NULL) 5404 return; 5405 5406 sc->shutdown = mode; 5407 } 5408 5409 int SSL_get_shutdown(const SSL *s) 5410 { 5411 const SSL_CONNECTION *sc = SSL_CONNECTION_FROM_CONST_SSL_ONLY(s); 5412 5413 #ifndef OPENSSL_NO_QUIC 5414 /* QUIC: Just indicate whether the connection was shutdown cleanly. */ 5415 if (IS_QUIC(s)) 5416 return ossl_quic_get_shutdown(s); 5417 #endif 5418 5419 if (sc == NULL) 5420 return 0; 5421 5422 return sc->shutdown; 5423 } 5424 5425 int SSL_version(const SSL *s) 5426 { 5427 const SSL_CONNECTION *sc = SSL_CONNECTION_FROM_CONST_SSL(s); 5428 5429 #ifndef OPENSSL_NO_QUIC 5430 /* We only support QUICv1 - so if its QUIC its QUICv1 */ 5431 if (s->type == SSL_TYPE_QUIC_CONNECTION || s->type == SSL_TYPE_QUIC_XSO) 5432 return OSSL_QUIC1_VERSION; 5433 #endif 5434 if (sc == NULL) 5435 return 0; 5436 5437 return sc->version; 5438 } 5439 5440 int SSL_client_version(const SSL *s) 5441 { 5442 const SSL_CONNECTION *sc = SSL_CONNECTION_FROM_CONST_SSL(s); 5443 5444 #ifndef OPENSSL_NO_QUIC 5445 /* We only support QUICv1 - so if its QUIC its QUICv1 */ 5446 if (s->type == SSL_TYPE_QUIC_CONNECTION || s->type == SSL_TYPE_QUIC_XSO) 5447 return OSSL_QUIC1_VERSION; 5448 #endif 5449 if (sc == NULL) 5450 return 0; 5451 5452 return sc->client_version; 5453 } 5454 5455 SSL_CTX *SSL_get_SSL_CTX(const SSL *ssl) 5456 { 5457 return ssl->ctx; 5458 } 5459 5460 SSL_CTX *SSL_set_SSL_CTX(SSL *ssl, SSL_CTX *ctx) 5461 { 5462 CERT *new_cert; 5463 SSL_CONNECTION *sc = SSL_CONNECTION_FROM_SSL_ONLY(ssl); 5464 5465 /* TODO(QUIC FUTURE): Add support for QUIC */ 5466 if (sc == NULL) 5467 return NULL; 5468 5469 if (ssl->ctx == ctx) 5470 return ssl->ctx; 5471 if (ctx == NULL) 5472 ctx = sc->session_ctx; 5473 new_cert = ssl_cert_dup(ctx->cert); 5474 if (new_cert == NULL) 5475 goto err; 5476 if (!custom_exts_copy_conn(&new_cert->custext, &sc->cert->custext)) 5477 goto err; 5478 if (!custom_exts_copy_flags(&new_cert->custext, &sc->cert->custext)) 5479 goto err; 5480 5481 /* 5482 * Program invariant: |sid_ctx| has fixed size (SSL_MAX_SID_CTX_LENGTH), 5483 * so setter APIs must prevent invalid lengths from entering the system. 5484 */ 5485 if (!ossl_assert(sc->sid_ctx_length <= sizeof(sc->sid_ctx))) 5486 goto err; 5487 if (!SSL_CTX_up_ref(ctx)) 5488 goto err; 5489 5490 /* 5491 * If the session ID context matches that of the parent SSL_CTX, 5492 * inherit it from the new SSL_CTX as well. If however the context does 5493 * not match (i.e., it was set per-ssl with SSL_set_session_id_context), 5494 * leave it unchanged. 5495 */ 5496 if ((ssl->ctx != NULL) && (sc->sid_ctx_length == ssl->ctx->sid_ctx_length) && (memcmp(sc->sid_ctx, ssl->ctx->sid_ctx, sc->sid_ctx_length) == 0)) { 5497 sc->sid_ctx_length = ctx->sid_ctx_length; 5498 memcpy(&sc->sid_ctx, &ctx->sid_ctx, sizeof(sc->sid_ctx)); 5499 } 5500 5501 ssl_cert_free(sc->cert); 5502 sc->cert = new_cert; 5503 SSL_CTX_free(ssl->ctx); /* decrement reference count */ 5504 ssl->ctx = ctx; 5505 5506 return ssl->ctx; 5507 5508 err: 5509 ssl_cert_free(new_cert); 5510 return NULL; 5511 } 5512 5513 int SSL_CTX_set_default_verify_paths(SSL_CTX *ctx) 5514 { 5515 return X509_STORE_set_default_paths_ex(ctx->cert_store, ctx->libctx, 5516 ctx->propq); 5517 } 5518 5519 int SSL_CTX_set_default_verify_dir(SSL_CTX *ctx) 5520 { 5521 X509_LOOKUP *lookup; 5522 5523 lookup = X509_STORE_add_lookup(ctx->cert_store, X509_LOOKUP_hash_dir()); 5524 if (lookup == NULL) 5525 return 0; 5526 5527 /* We ignore errors, in case the directory doesn't exist */ 5528 ERR_set_mark(); 5529 5530 X509_LOOKUP_add_dir(lookup, NULL, X509_FILETYPE_DEFAULT); 5531 5532 ERR_pop_to_mark(); 5533 5534 return 1; 5535 } 5536 5537 int SSL_CTX_set_default_verify_file(SSL_CTX *ctx) 5538 { 5539 X509_LOOKUP *lookup; 5540 5541 lookup = X509_STORE_add_lookup(ctx->cert_store, X509_LOOKUP_file()); 5542 if (lookup == NULL) 5543 return 0; 5544 5545 /* We ignore errors, in case the file doesn't exist */ 5546 ERR_set_mark(); 5547 5548 X509_LOOKUP_load_file_ex(lookup, NULL, X509_FILETYPE_DEFAULT, ctx->libctx, 5549 ctx->propq); 5550 5551 ERR_pop_to_mark(); 5552 5553 return 1; 5554 } 5555 5556 int SSL_CTX_set_default_verify_store(SSL_CTX *ctx) 5557 { 5558 X509_LOOKUP *lookup; 5559 5560 lookup = X509_STORE_add_lookup(ctx->cert_store, X509_LOOKUP_store()); 5561 if (lookup == NULL) 5562 return 0; 5563 5564 /* We ignore errors, in case the directory doesn't exist */ 5565 ERR_set_mark(); 5566 5567 X509_LOOKUP_add_store_ex(lookup, NULL, ctx->libctx, ctx->propq); 5568 5569 ERR_pop_to_mark(); 5570 5571 return 1; 5572 } 5573 5574 int SSL_CTX_load_verify_file(SSL_CTX *ctx, const char *CAfile) 5575 { 5576 return X509_STORE_load_file_ex(ctx->cert_store, CAfile, ctx->libctx, 5577 ctx->propq); 5578 } 5579 5580 int SSL_CTX_load_verify_dir(SSL_CTX *ctx, const char *CApath) 5581 { 5582 return X509_STORE_load_path(ctx->cert_store, CApath); 5583 } 5584 5585 int SSL_CTX_load_verify_store(SSL_CTX *ctx, const char *CAstore) 5586 { 5587 return X509_STORE_load_store_ex(ctx->cert_store, CAstore, ctx->libctx, 5588 ctx->propq); 5589 } 5590 5591 int SSL_CTX_load_verify_locations(SSL_CTX *ctx, const char *CAfile, 5592 const char *CApath) 5593 { 5594 if (CAfile == NULL && CApath == NULL) 5595 return 0; 5596 if (CAfile != NULL && !SSL_CTX_load_verify_file(ctx, CAfile)) 5597 return 0; 5598 if (CApath != NULL && !SSL_CTX_load_verify_dir(ctx, CApath)) 5599 return 0; 5600 return 1; 5601 } 5602 5603 void SSL_set_info_callback(SSL *ssl, 5604 void (*cb)(const SSL *ssl, int type, int val)) 5605 { 5606 SSL_CONNECTION *sc = SSL_CONNECTION_FROM_SSL(ssl); 5607 5608 if (sc == NULL) 5609 return; 5610 5611 sc->info_callback = cb; 5612 } 5613 5614 /* 5615 * One compiler (Diab DCC) doesn't like argument names in returned function 5616 * pointer. 5617 */ 5618 void (*SSL_get_info_callback(const SSL *ssl))(const SSL * /* ssl */, 5619 int /* type */, 5620 int /* val */) 5621 { 5622 const SSL_CONNECTION *sc = SSL_CONNECTION_FROM_CONST_SSL(ssl); 5623 5624 if (sc == NULL) 5625 return NULL; 5626 5627 return sc->info_callback; 5628 } 5629 5630 void SSL_set_verify_result(SSL *ssl, long arg) 5631 { 5632 SSL_CONNECTION *sc = SSL_CONNECTION_FROM_SSL(ssl); 5633 5634 if (sc == NULL) 5635 return; 5636 5637 sc->verify_result = arg; 5638 } 5639 5640 long SSL_get_verify_result(const SSL *ssl) 5641 { 5642 const SSL_CONNECTION *sc = SSL_CONNECTION_FROM_CONST_SSL(ssl); 5643 5644 if (sc == NULL) 5645 return 0; 5646 5647 return sc->verify_result; 5648 } 5649 5650 size_t SSL_get_client_random(const SSL *ssl, unsigned char *out, size_t outlen) 5651 { 5652 const SSL_CONNECTION *sc = SSL_CONNECTION_FROM_CONST_SSL(ssl); 5653 5654 if (sc == NULL) 5655 return 0; 5656 5657 if (outlen == 0) 5658 return sizeof(sc->s3.client_random); 5659 if (outlen > sizeof(sc->s3.client_random)) 5660 outlen = sizeof(sc->s3.client_random); 5661 memcpy(out, sc->s3.client_random, outlen); 5662 return outlen; 5663 } 5664 5665 size_t SSL_get_server_random(const SSL *ssl, unsigned char *out, size_t outlen) 5666 { 5667 const SSL_CONNECTION *sc = SSL_CONNECTION_FROM_CONST_SSL(ssl); 5668 5669 if (sc == NULL) 5670 return 0; 5671 5672 if (outlen == 0) 5673 return sizeof(sc->s3.server_random); 5674 if (outlen > sizeof(sc->s3.server_random)) 5675 outlen = sizeof(sc->s3.server_random); 5676 memcpy(out, sc->s3.server_random, outlen); 5677 return outlen; 5678 } 5679 5680 size_t SSL_SESSION_get_master_key(const SSL_SESSION *session, 5681 unsigned char *out, size_t outlen) 5682 { 5683 if (outlen == 0) 5684 return session->master_key_length; 5685 if (outlen > session->master_key_length) 5686 outlen = session->master_key_length; 5687 memcpy(out, session->master_key, outlen); 5688 return outlen; 5689 } 5690 5691 int SSL_SESSION_set1_master_key(SSL_SESSION *sess, const unsigned char *in, 5692 size_t len) 5693 { 5694 if (len > sizeof(sess->master_key)) 5695 return 0; 5696 5697 memcpy(sess->master_key, in, len); 5698 sess->master_key_length = len; 5699 return 1; 5700 } 5701 5702 int SSL_set_ex_data(SSL *s, int idx, void *arg) 5703 { 5704 return CRYPTO_set_ex_data(&s->ex_data, idx, arg); 5705 } 5706 5707 void *SSL_get_ex_data(const SSL *s, int idx) 5708 { 5709 return CRYPTO_get_ex_data(&s->ex_data, idx); 5710 } 5711 5712 int SSL_CTX_set_ex_data(SSL_CTX *s, int idx, void *arg) 5713 { 5714 return CRYPTO_set_ex_data(&s->ex_data, idx, arg); 5715 } 5716 5717 void *SSL_CTX_get_ex_data(const SSL_CTX *s, int idx) 5718 { 5719 return CRYPTO_get_ex_data(&s->ex_data, idx); 5720 } 5721 5722 X509_STORE *SSL_CTX_get_cert_store(const SSL_CTX *ctx) 5723 { 5724 return ctx->cert_store; 5725 } 5726 5727 void SSL_CTX_set_cert_store(SSL_CTX *ctx, X509_STORE *store) 5728 { 5729 X509_STORE_free(ctx->cert_store); 5730 ctx->cert_store = store; 5731 } 5732 5733 void SSL_CTX_set1_cert_store(SSL_CTX *ctx, X509_STORE *store) 5734 { 5735 if (store != NULL && !X509_STORE_up_ref(store)) 5736 return; 5737 5738 SSL_CTX_set_cert_store(ctx, store); 5739 } 5740 5741 int SSL_want(const SSL *s) 5742 { 5743 const SSL_CONNECTION *sc = SSL_CONNECTION_FROM_CONST_SSL(s); 5744 5745 #ifndef OPENSSL_NO_QUIC 5746 if (IS_QUIC(s)) 5747 return ossl_quic_want(s); 5748 #endif 5749 5750 if (sc == NULL) 5751 return SSL_NOTHING; 5752 5753 return sc->rwstate; 5754 } 5755 5756 #ifndef OPENSSL_NO_PSK 5757 int SSL_CTX_use_psk_identity_hint(SSL_CTX *ctx, const char *identity_hint) 5758 { 5759 if (identity_hint != NULL && strlen(identity_hint) > PSK_MAX_IDENTITY_LEN) { 5760 ERR_raise(ERR_LIB_SSL, SSL_R_DATA_LENGTH_TOO_LONG); 5761 return 0; 5762 } 5763 OPENSSL_free(ctx->cert->psk_identity_hint); 5764 if (identity_hint != NULL) { 5765 ctx->cert->psk_identity_hint = OPENSSL_strdup(identity_hint); 5766 if (ctx->cert->psk_identity_hint == NULL) 5767 return 0; 5768 } else 5769 ctx->cert->psk_identity_hint = NULL; 5770 return 1; 5771 } 5772 5773 int SSL_use_psk_identity_hint(SSL *s, const char *identity_hint) 5774 { 5775 SSL_CONNECTION *sc = SSL_CONNECTION_FROM_SSL(s); 5776 5777 if (sc == NULL) 5778 return 0; 5779 5780 if (identity_hint != NULL && strlen(identity_hint) > PSK_MAX_IDENTITY_LEN) { 5781 ERR_raise(ERR_LIB_SSL, SSL_R_DATA_LENGTH_TOO_LONG); 5782 return 0; 5783 } 5784 OPENSSL_free(sc->cert->psk_identity_hint); 5785 if (identity_hint != NULL) { 5786 sc->cert->psk_identity_hint = OPENSSL_strdup(identity_hint); 5787 if (sc->cert->psk_identity_hint == NULL) 5788 return 0; 5789 } else 5790 sc->cert->psk_identity_hint = NULL; 5791 return 1; 5792 } 5793 5794 const char *SSL_get_psk_identity_hint(const SSL *s) 5795 { 5796 const SSL_CONNECTION *sc = SSL_CONNECTION_FROM_CONST_SSL(s); 5797 5798 if (sc == NULL || sc->session == NULL) 5799 return NULL; 5800 5801 return sc->session->psk_identity_hint; 5802 } 5803 5804 const char *SSL_get_psk_identity(const SSL *s) 5805 { 5806 const SSL_CONNECTION *sc = SSL_CONNECTION_FROM_CONST_SSL(s); 5807 5808 if (sc == NULL || sc->session == NULL) 5809 return NULL; 5810 5811 return sc->session->psk_identity; 5812 } 5813 5814 void SSL_set_psk_client_callback(SSL *s, SSL_psk_client_cb_func cb) 5815 { 5816 SSL_CONNECTION *sc = SSL_CONNECTION_FROM_SSL(s); 5817 5818 if (sc == NULL) 5819 return; 5820 5821 sc->psk_client_callback = cb; 5822 } 5823 5824 void SSL_CTX_set_psk_client_callback(SSL_CTX *ctx, SSL_psk_client_cb_func cb) 5825 { 5826 ctx->psk_client_callback = cb; 5827 } 5828 5829 void SSL_set_psk_server_callback(SSL *s, SSL_psk_server_cb_func cb) 5830 { 5831 SSL_CONNECTION *sc = SSL_CONNECTION_FROM_SSL(s); 5832 5833 if (sc == NULL) 5834 return; 5835 5836 sc->psk_server_callback = cb; 5837 } 5838 5839 void SSL_CTX_set_psk_server_callback(SSL_CTX *ctx, SSL_psk_server_cb_func cb) 5840 { 5841 ctx->psk_server_callback = cb; 5842 } 5843 #endif 5844 5845 void SSL_set_psk_find_session_callback(SSL *s, SSL_psk_find_session_cb_func cb) 5846 { 5847 SSL_CONNECTION *sc = SSL_CONNECTION_FROM_SSL(s); 5848 5849 if (sc == NULL) 5850 return; 5851 5852 sc->psk_find_session_cb = cb; 5853 } 5854 5855 void SSL_CTX_set_psk_find_session_callback(SSL_CTX *ctx, 5856 SSL_psk_find_session_cb_func cb) 5857 { 5858 ctx->psk_find_session_cb = cb; 5859 } 5860 5861 void SSL_set_psk_use_session_callback(SSL *s, SSL_psk_use_session_cb_func cb) 5862 { 5863 SSL_CONNECTION *sc = SSL_CONNECTION_FROM_SSL(s); 5864 5865 if (sc == NULL) 5866 return; 5867 5868 sc->psk_use_session_cb = cb; 5869 } 5870 5871 void SSL_CTX_set_psk_use_session_callback(SSL_CTX *ctx, 5872 SSL_psk_use_session_cb_func cb) 5873 { 5874 ctx->psk_use_session_cb = cb; 5875 } 5876 5877 void SSL_CTX_set_msg_callback(SSL_CTX *ctx, 5878 void (*cb)(int write_p, int version, 5879 int content_type, const void *buf, 5880 size_t len, SSL *ssl, void *arg)) 5881 { 5882 SSL_CTX_callback_ctrl(ctx, SSL_CTRL_SET_MSG_CALLBACK, (void (*)(void))cb); 5883 } 5884 5885 void SSL_set_msg_callback(SSL *ssl, 5886 void (*cb)(int write_p, int version, 5887 int content_type, const void *buf, 5888 size_t len, SSL *ssl, void *arg)) 5889 { 5890 SSL_callback_ctrl(ssl, SSL_CTRL_SET_MSG_CALLBACK, (void (*)(void))cb); 5891 } 5892 5893 void SSL_CTX_set_not_resumable_session_callback(SSL_CTX *ctx, 5894 int (*cb)(SSL *ssl, 5895 int 5896 is_forward_secure)) 5897 { 5898 SSL_CTX_callback_ctrl(ctx, SSL_CTRL_SET_NOT_RESUMABLE_SESS_CB, 5899 (void (*)(void))cb); 5900 } 5901 5902 void SSL_set_not_resumable_session_callback(SSL *ssl, 5903 int (*cb)(SSL *ssl, 5904 int is_forward_secure)) 5905 { 5906 SSL_callback_ctrl(ssl, SSL_CTRL_SET_NOT_RESUMABLE_SESS_CB, 5907 (void (*)(void))cb); 5908 } 5909 5910 void SSL_CTX_set_record_padding_callback(SSL_CTX *ctx, 5911 size_t (*cb)(SSL *ssl, int type, 5912 size_t len, void *arg)) 5913 { 5914 ctx->record_padding_cb = cb; 5915 } 5916 5917 void SSL_CTX_set_record_padding_callback_arg(SSL_CTX *ctx, void *arg) 5918 { 5919 ctx->record_padding_arg = arg; 5920 } 5921 5922 void *SSL_CTX_get_record_padding_callback_arg(const SSL_CTX *ctx) 5923 { 5924 return ctx->record_padding_arg; 5925 } 5926 5927 int SSL_CTX_set_block_padding_ex(SSL_CTX *ctx, size_t app_block_size, 5928 size_t hs_block_size) 5929 { 5930 if (IS_QUIC_CTX(ctx) && (app_block_size > 1 || hs_block_size > 1)) 5931 return 0; 5932 5933 /* block size of 0 or 1 is basically no padding */ 5934 if (app_block_size == 1) { 5935 ctx->block_padding = 0; 5936 } else if (app_block_size <= SSL3_RT_MAX_PLAIN_LENGTH) { 5937 ctx->block_padding = app_block_size; 5938 } else { 5939 return 0; 5940 } 5941 if (hs_block_size == 1) { 5942 ctx->hs_padding = 0; 5943 } else if (hs_block_size <= SSL3_RT_MAX_PLAIN_LENGTH) { 5944 ctx->hs_padding = hs_block_size; 5945 } else { 5946 return 0; 5947 } 5948 return 1; 5949 } 5950 5951 int SSL_CTX_set_block_padding(SSL_CTX *ctx, size_t block_size) 5952 { 5953 return SSL_CTX_set_block_padding_ex(ctx, block_size, block_size); 5954 } 5955 5956 int SSL_set_record_padding_callback(SSL *ssl, 5957 size_t (*cb)(SSL *ssl, int type, 5958 size_t len, void *arg)) 5959 { 5960 BIO *b; 5961 SSL_CONNECTION *sc = SSL_CONNECTION_FROM_SSL_ONLY(ssl); 5962 5963 if (sc == NULL) 5964 return 0; 5965 5966 b = SSL_get_wbio(ssl); 5967 if (b == NULL || !BIO_get_ktls_send(b)) { 5968 sc->rlayer.record_padding_cb = cb; 5969 return 1; 5970 } 5971 return 0; 5972 } 5973 5974 void SSL_set_record_padding_callback_arg(SSL *ssl, void *arg) 5975 { 5976 SSL_CONNECTION *sc = SSL_CONNECTION_FROM_SSL(ssl); 5977 5978 if (sc == NULL) 5979 return; 5980 5981 sc->rlayer.record_padding_arg = arg; 5982 } 5983 5984 void *SSL_get_record_padding_callback_arg(const SSL *ssl) 5985 { 5986 const SSL_CONNECTION *sc = SSL_CONNECTION_FROM_CONST_SSL(ssl); 5987 5988 if (sc == NULL) 5989 return NULL; 5990 5991 return sc->rlayer.record_padding_arg; 5992 } 5993 5994 int SSL_set_block_padding_ex(SSL *ssl, size_t app_block_size, 5995 size_t hs_block_size) 5996 { 5997 SSL_CONNECTION *sc = SSL_CONNECTION_FROM_SSL(ssl); 5998 5999 if (sc == NULL 6000 || (IS_QUIC(ssl) 6001 && (app_block_size > 1 || hs_block_size > 1))) 6002 return 0; 6003 6004 /* block size of 0 or 1 is basically no padding */ 6005 if (app_block_size == 1) { 6006 sc->rlayer.block_padding = 0; 6007 } else if (app_block_size <= SSL3_RT_MAX_PLAIN_LENGTH) { 6008 sc->rlayer.block_padding = app_block_size; 6009 } else { 6010 return 0; 6011 } 6012 if (hs_block_size == 1) { 6013 sc->rlayer.hs_padding = 0; 6014 } else if (hs_block_size <= SSL3_RT_MAX_PLAIN_LENGTH) { 6015 sc->rlayer.hs_padding = hs_block_size; 6016 } else { 6017 return 0; 6018 } 6019 return 1; 6020 } 6021 6022 int SSL_set_block_padding(SSL *ssl, size_t block_size) 6023 { 6024 return SSL_set_block_padding_ex(ssl, block_size, block_size); 6025 } 6026 6027 int SSL_set_num_tickets(SSL *s, size_t num_tickets) 6028 { 6029 SSL_CONNECTION *sc = SSL_CONNECTION_FROM_SSL(s); 6030 6031 if (sc == NULL) 6032 return 0; 6033 6034 sc->num_tickets = num_tickets; 6035 6036 return 1; 6037 } 6038 6039 size_t SSL_get_num_tickets(const SSL *s) 6040 { 6041 const SSL_CONNECTION *sc = SSL_CONNECTION_FROM_CONST_SSL(s); 6042 6043 if (sc == NULL) 6044 return 0; 6045 6046 return sc->num_tickets; 6047 } 6048 6049 int SSL_CTX_set_num_tickets(SSL_CTX *ctx, size_t num_tickets) 6050 { 6051 ctx->num_tickets = num_tickets; 6052 6053 return 1; 6054 } 6055 6056 size_t SSL_CTX_get_num_tickets(const SSL_CTX *ctx) 6057 { 6058 return ctx->num_tickets; 6059 } 6060 6061 /* Retrieve handshake hashes */ 6062 int ssl_handshake_hash(SSL_CONNECTION *s, 6063 unsigned char *out, size_t outlen, 6064 size_t *hashlen) 6065 { 6066 EVP_MD_CTX *ctx = NULL; 6067 EVP_MD_CTX *hdgst = s->s3.handshake_dgst; 6068 int hashleni = EVP_MD_CTX_get_size(hdgst); 6069 int ret = 0; 6070 6071 if (hashleni < 0 || (size_t)hashleni > outlen) { 6072 SSLfatal(s, SSL_AD_INTERNAL_ERROR, ERR_R_INTERNAL_ERROR); 6073 goto err; 6074 } 6075 6076 ctx = EVP_MD_CTX_new(); 6077 if (ctx == NULL) { 6078 SSLfatal(s, SSL_AD_INTERNAL_ERROR, ERR_R_INTERNAL_ERROR); 6079 goto err; 6080 } 6081 6082 if (!EVP_MD_CTX_copy_ex(ctx, hdgst) 6083 || EVP_DigestFinal_ex(ctx, out, NULL) <= 0) { 6084 SSLfatal(s, SSL_AD_INTERNAL_ERROR, ERR_R_INTERNAL_ERROR); 6085 goto err; 6086 } 6087 6088 *hashlen = hashleni; 6089 6090 ret = 1; 6091 err: 6092 EVP_MD_CTX_free(ctx); 6093 return ret; 6094 } 6095 6096 int SSL_session_reused(const SSL *s) 6097 { 6098 const SSL_CONNECTION *sc = SSL_CONNECTION_FROM_CONST_SSL(s); 6099 6100 if (sc == NULL) 6101 return 0; 6102 6103 return sc->hit; 6104 } 6105 6106 int SSL_is_server(const SSL *s) 6107 { 6108 const SSL_CONNECTION *sc = SSL_CONNECTION_FROM_CONST_SSL(s); 6109 6110 if (sc == NULL) 6111 return 0; 6112 6113 return sc->server; 6114 } 6115 6116 #ifndef OPENSSL_NO_DEPRECATED_1_1_0 6117 void SSL_set_debug(SSL *s, int debug) 6118 { 6119 /* Old function was do-nothing anyway... */ 6120 (void)s; 6121 (void)debug; 6122 } 6123 #endif 6124 6125 void SSL_set_security_level(SSL *s, int level) 6126 { 6127 SSL_CONNECTION *sc = SSL_CONNECTION_FROM_SSL(s); 6128 6129 if (sc == NULL) 6130 return; 6131 6132 sc->cert->sec_level = level; 6133 } 6134 6135 int SSL_get_security_level(const SSL *s) 6136 { 6137 const SSL_CONNECTION *sc = SSL_CONNECTION_FROM_CONST_SSL(s); 6138 6139 if (sc == NULL) 6140 return 0; 6141 6142 return sc->cert->sec_level; 6143 } 6144 6145 void SSL_set_security_callback(SSL *s, 6146 int (*cb)(const SSL *s, const SSL_CTX *ctx, 6147 int op, int bits, int nid, 6148 void *other, void *ex)) 6149 { 6150 SSL_CONNECTION *sc = SSL_CONNECTION_FROM_SSL(s); 6151 6152 if (sc == NULL) 6153 return; 6154 6155 sc->cert->sec_cb = cb; 6156 } 6157 6158 int (*SSL_get_security_callback(const SSL *s))(const SSL *s, 6159 const SSL_CTX *ctx, int op, 6160 int bits, int nid, void *other, 6161 void *ex) 6162 { 6163 const SSL_CONNECTION *sc = SSL_CONNECTION_FROM_CONST_SSL(s); 6164 6165 if (sc == NULL) 6166 return NULL; 6167 6168 return sc->cert->sec_cb; 6169 } 6170 6171 void SSL_set0_security_ex_data(SSL *s, void *ex) 6172 { 6173 SSL_CONNECTION *sc = SSL_CONNECTION_FROM_SSL(s); 6174 6175 if (sc == NULL) 6176 return; 6177 6178 sc->cert->sec_ex = ex; 6179 } 6180 6181 void *SSL_get0_security_ex_data(const SSL *s) 6182 { 6183 const SSL_CONNECTION *sc = SSL_CONNECTION_FROM_CONST_SSL(s); 6184 6185 if (sc == NULL) 6186 return NULL; 6187 6188 return sc->cert->sec_ex; 6189 } 6190 6191 void SSL_CTX_set_security_level(SSL_CTX *ctx, int level) 6192 { 6193 ctx->cert->sec_level = level; 6194 } 6195 6196 int SSL_CTX_get_security_level(const SSL_CTX *ctx) 6197 { 6198 return ctx->cert->sec_level; 6199 } 6200 6201 void SSL_CTX_set_security_callback(SSL_CTX *ctx, 6202 int (*cb)(const SSL *s, const SSL_CTX *ctx, 6203 int op, int bits, int nid, 6204 void *other, void *ex)) 6205 { 6206 ctx->cert->sec_cb = cb; 6207 } 6208 6209 int (*SSL_CTX_get_security_callback(const SSL_CTX *ctx))(const SSL *s, 6210 const SSL_CTX *ctx, 6211 int op, int bits, 6212 int nid, 6213 void *other, 6214 void *ex) 6215 { 6216 return ctx->cert->sec_cb; 6217 } 6218 6219 void SSL_CTX_set0_security_ex_data(SSL_CTX *ctx, void *ex) 6220 { 6221 ctx->cert->sec_ex = ex; 6222 } 6223 6224 void *SSL_CTX_get0_security_ex_data(const SSL_CTX *ctx) 6225 { 6226 return ctx->cert->sec_ex; 6227 } 6228 6229 uint64_t SSL_CTX_get_options(const SSL_CTX *ctx) 6230 { 6231 return ctx->options; 6232 } 6233 6234 uint64_t SSL_get_options(const SSL *s) 6235 { 6236 const SSL_CONNECTION *sc = SSL_CONNECTION_FROM_CONST_SSL(s); 6237 6238 #ifndef OPENSSL_NO_QUIC 6239 if (IS_QUIC(s)) 6240 return ossl_quic_get_options(s); 6241 #endif 6242 6243 if (sc == NULL) 6244 return 0; 6245 6246 return sc->options; 6247 } 6248 6249 uint64_t SSL_CTX_set_options(SSL_CTX *ctx, uint64_t op) 6250 { 6251 return ctx->options |= op; 6252 } 6253 6254 uint64_t SSL_set_options(SSL *s, uint64_t op) 6255 { 6256 SSL_CONNECTION *sc; 6257 OSSL_PARAM options[2], *opts = options; 6258 6259 #ifndef OPENSSL_NO_QUIC 6260 if (IS_QUIC(s)) 6261 return ossl_quic_set_options(s, op); 6262 #endif 6263 6264 sc = SSL_CONNECTION_FROM_SSL(s); 6265 if (sc == NULL) 6266 return 0; 6267 6268 sc->options |= op; 6269 6270 *opts++ = OSSL_PARAM_construct_uint64(OSSL_LIBSSL_RECORD_LAYER_PARAM_OPTIONS, 6271 &sc->options); 6272 *opts = OSSL_PARAM_construct_end(); 6273 6274 /* Ignore return value */ 6275 sc->rlayer.rrlmethod->set_options(sc->rlayer.rrl, options); 6276 sc->rlayer.wrlmethod->set_options(sc->rlayer.wrl, options); 6277 6278 return sc->options; 6279 } 6280 6281 uint64_t SSL_CTX_clear_options(SSL_CTX *ctx, uint64_t op) 6282 { 6283 return ctx->options &= ~op; 6284 } 6285 6286 uint64_t SSL_clear_options(SSL *s, uint64_t op) 6287 { 6288 SSL_CONNECTION *sc = SSL_CONNECTION_FROM_SSL(s); 6289 OSSL_PARAM options[2], *opts = options; 6290 6291 #ifndef OPENSSL_NO_QUIC 6292 if (IS_QUIC(s)) 6293 return ossl_quic_clear_options(s, op); 6294 #endif 6295 6296 if (sc == NULL) 6297 return 0; 6298 6299 sc->options &= ~op; 6300 6301 *opts++ = OSSL_PARAM_construct_uint64(OSSL_LIBSSL_RECORD_LAYER_PARAM_OPTIONS, 6302 &sc->options); 6303 *opts = OSSL_PARAM_construct_end(); 6304 6305 /* Ignore return value */ 6306 sc->rlayer.rrlmethod->set_options(sc->rlayer.rrl, options); 6307 sc->rlayer.wrlmethod->set_options(sc->rlayer.wrl, options); 6308 6309 return sc->options; 6310 } 6311 6312 STACK_OF(X509) *SSL_get0_verified_chain(const SSL *s) 6313 { 6314 const SSL_CONNECTION *sc = SSL_CONNECTION_FROM_CONST_SSL(s); 6315 6316 if (sc == NULL) 6317 return NULL; 6318 6319 return sc->verified_chain; 6320 } 6321 6322 IMPLEMENT_OBJ_BSEARCH_GLOBAL_CMP_FN(SSL_CIPHER, SSL_CIPHER, ssl_cipher_id); 6323 6324 #ifndef OPENSSL_NO_CT 6325 6326 /* 6327 * Moves SCTs from the |src| stack to the |dst| stack. 6328 * The source of each SCT will be set to |origin|. 6329 * If |dst| points to a NULL pointer, a new stack will be created and owned by 6330 * the caller. 6331 * Returns the number of SCTs moved, or a negative integer if an error occurs. 6332 * The |dst| stack is created and possibly partially populated even in case 6333 * of error, likewise the |src| stack may be left in an intermediate state. 6334 */ 6335 static int ct_move_scts(STACK_OF(SCT) **dst, STACK_OF(SCT) *src, 6336 sct_source_t origin) 6337 { 6338 int scts_moved = 0; 6339 SCT *sct = NULL; 6340 6341 if (*dst == NULL) { 6342 *dst = sk_SCT_new_null(); 6343 if (*dst == NULL) { 6344 ERR_raise(ERR_LIB_SSL, ERR_R_CRYPTO_LIB); 6345 goto err; 6346 } 6347 } 6348 6349 while ((sct = sk_SCT_pop(src)) != NULL) { 6350 if (SCT_set_source(sct, origin) != 1) 6351 goto err; 6352 6353 if (!sk_SCT_push(*dst, sct)) 6354 goto err; 6355 scts_moved += 1; 6356 } 6357 6358 return scts_moved; 6359 err: 6360 SCT_free(sct); 6361 return -1; 6362 } 6363 6364 /* 6365 * Look for data collected during ServerHello and parse if found. 6366 * Returns the number of SCTs extracted. 6367 */ 6368 static int ct_extract_tls_extension_scts(SSL_CONNECTION *s) 6369 { 6370 int scts_extracted = 0; 6371 6372 if (s->ext.scts != NULL) { 6373 const unsigned char *p = s->ext.scts; 6374 STACK_OF(SCT) *scts = o2i_SCT_LIST(NULL, &p, s->ext.scts_len); 6375 6376 scts_extracted = ct_move_scts(&s->scts, scts, SCT_SOURCE_TLS_EXTENSION); 6377 6378 SCT_LIST_free(scts); 6379 } 6380 6381 return scts_extracted; 6382 } 6383 6384 /* 6385 * Checks for an OCSP response and then attempts to extract any SCTs found if it 6386 * contains an SCT X509 extension. They will be stored in |s->scts|. 6387 * Returns: 6388 * - The number of SCTs extracted, assuming an OCSP response exists. 6389 * - 0 if no OCSP response exists or it contains no SCTs. 6390 * - A negative integer if an error occurs. 6391 */ 6392 static int ct_extract_ocsp_response_scts(SSL_CONNECTION *s) 6393 { 6394 #ifndef OPENSSL_NO_OCSP 6395 int scts_extracted = 0; 6396 const unsigned char *p; 6397 OCSP_BASICRESP *br = NULL; 6398 OCSP_RESPONSE *rsp = NULL; 6399 STACK_OF(SCT) *scts = NULL; 6400 int i; 6401 6402 if (s->ext.ocsp.resp == NULL || s->ext.ocsp.resp_len == 0) 6403 goto err; 6404 6405 p = s->ext.ocsp.resp; 6406 rsp = d2i_OCSP_RESPONSE(NULL, &p, (int)s->ext.ocsp.resp_len); 6407 if (rsp == NULL) 6408 goto err; 6409 6410 br = OCSP_response_get1_basic(rsp); 6411 if (br == NULL) 6412 goto err; 6413 6414 for (i = 0; i < OCSP_resp_count(br); ++i) { 6415 OCSP_SINGLERESP *single = OCSP_resp_get0(br, i); 6416 6417 if (single == NULL) 6418 continue; 6419 6420 scts = OCSP_SINGLERESP_get1_ext_d2i(single, NID_ct_cert_scts, NULL, NULL); 6421 scts_extracted = ct_move_scts(&s->scts, scts, SCT_SOURCE_OCSP_STAPLED_RESPONSE); 6422 if (scts_extracted < 0) 6423 goto err; 6424 } 6425 err: 6426 SCT_LIST_free(scts); 6427 OCSP_BASICRESP_free(br); 6428 OCSP_RESPONSE_free(rsp); 6429 return scts_extracted; 6430 #else 6431 /* Behave as if no OCSP response exists */ 6432 return 0; 6433 #endif 6434 } 6435 6436 /* 6437 * Attempts to extract SCTs from the peer certificate. 6438 * Return the number of SCTs extracted, or a negative integer if an error 6439 * occurs. 6440 */ 6441 static int ct_extract_x509v3_extension_scts(SSL_CONNECTION *s) 6442 { 6443 int scts_extracted = 0; 6444 X509 *cert = s->session != NULL ? s->session->peer : NULL; 6445 6446 if (cert != NULL) { 6447 STACK_OF(SCT) *scts = X509_get_ext_d2i(cert, NID_ct_precert_scts, NULL, NULL); 6448 6449 scts_extracted = ct_move_scts(&s->scts, scts, SCT_SOURCE_X509V3_EXTENSION); 6450 6451 SCT_LIST_free(scts); 6452 } 6453 6454 return scts_extracted; 6455 } 6456 6457 /* 6458 * Attempts to find all received SCTs by checking TLS extensions, the OCSP 6459 * response (if it exists) and X509v3 extensions in the certificate. 6460 * Returns NULL if an error occurs. 6461 */ 6462 const STACK_OF(SCT) *SSL_get0_peer_scts(SSL *s) 6463 { 6464 SSL_CONNECTION *sc = SSL_CONNECTION_FROM_SSL(s); 6465 6466 if (sc == NULL) 6467 return NULL; 6468 6469 if (!sc->scts_parsed) { 6470 if (ct_extract_tls_extension_scts(sc) < 0 || ct_extract_ocsp_response_scts(sc) < 0 || ct_extract_x509v3_extension_scts(sc) < 0) 6471 goto err; 6472 6473 sc->scts_parsed = 1; 6474 } 6475 return sc->scts; 6476 err: 6477 return NULL; 6478 } 6479 6480 static int ct_permissive(const CT_POLICY_EVAL_CTX *ctx, 6481 const STACK_OF(SCT) *scts, void *unused_arg) 6482 { 6483 return 1; 6484 } 6485 6486 static int ct_strict(const CT_POLICY_EVAL_CTX *ctx, 6487 const STACK_OF(SCT) *scts, void *unused_arg) 6488 { 6489 int count = scts != NULL ? sk_SCT_num(scts) : 0; 6490 int i; 6491 6492 for (i = 0; i < count; ++i) { 6493 SCT *sct = sk_SCT_value(scts, i); 6494 int status = SCT_get_validation_status(sct); 6495 6496 if (status == SCT_VALIDATION_STATUS_VALID) 6497 return 1; 6498 } 6499 ERR_raise(ERR_LIB_SSL, SSL_R_NO_VALID_SCTS); 6500 return 0; 6501 } 6502 6503 int SSL_set_ct_validation_callback(SSL *s, ssl_ct_validation_cb callback, 6504 void *arg) 6505 { 6506 SSL_CONNECTION *sc = SSL_CONNECTION_FROM_SSL(s); 6507 6508 if (sc == NULL) 6509 return 0; 6510 6511 /* 6512 * Since code exists that uses the custom extension handler for CT, look 6513 * for this and throw an error if they have already registered to use CT. 6514 */ 6515 if (callback != NULL && SSL_CTX_has_client_custom_ext(s->ctx, TLSEXT_TYPE_signed_certificate_timestamp)) { 6516 ERR_raise(ERR_LIB_SSL, SSL_R_CUSTOM_EXT_HANDLER_ALREADY_INSTALLED); 6517 return 0; 6518 } 6519 6520 if (callback != NULL) { 6521 /* 6522 * If we are validating CT, then we MUST accept SCTs served via OCSP 6523 */ 6524 if (!SSL_set_tlsext_status_type(s, TLSEXT_STATUSTYPE_ocsp)) 6525 return 0; 6526 } 6527 6528 sc->ct_validation_callback = callback; 6529 sc->ct_validation_callback_arg = arg; 6530 6531 return 1; 6532 } 6533 6534 int SSL_CTX_set_ct_validation_callback(SSL_CTX *ctx, 6535 ssl_ct_validation_cb callback, void *arg) 6536 { 6537 /* 6538 * Since code exists that uses the custom extension handler for CT, look for 6539 * this and throw an error if they have already registered to use CT. 6540 */ 6541 if (callback != NULL && SSL_CTX_has_client_custom_ext(ctx, TLSEXT_TYPE_signed_certificate_timestamp)) { 6542 ERR_raise(ERR_LIB_SSL, SSL_R_CUSTOM_EXT_HANDLER_ALREADY_INSTALLED); 6543 return 0; 6544 } 6545 6546 ctx->ct_validation_callback = callback; 6547 ctx->ct_validation_callback_arg = arg; 6548 return 1; 6549 } 6550 6551 int SSL_ct_is_enabled(const SSL *s) 6552 { 6553 const SSL_CONNECTION *sc = SSL_CONNECTION_FROM_CONST_SSL(s); 6554 6555 if (sc == NULL) 6556 return 0; 6557 6558 return sc->ct_validation_callback != NULL; 6559 } 6560 6561 int SSL_CTX_ct_is_enabled(const SSL_CTX *ctx) 6562 { 6563 return ctx->ct_validation_callback != NULL; 6564 } 6565 6566 int ssl_validate_ct(SSL_CONNECTION *s) 6567 { 6568 int ret = 0; 6569 X509 *cert = s->session != NULL ? s->session->peer : NULL; 6570 X509 *issuer; 6571 SSL_DANE *dane = &s->dane; 6572 CT_POLICY_EVAL_CTX *ctx = NULL; 6573 const STACK_OF(SCT) *scts; 6574 6575 /* 6576 * If no callback is set, the peer is anonymous, or its chain is invalid, 6577 * skip SCT validation - just return success. Applications that continue 6578 * handshakes without certificates, with unverified chains, or pinned leaf 6579 * certificates are outside the scope of the WebPKI and CT. 6580 * 6581 * The above exclusions notwithstanding the vast majority of peers will 6582 * have rather ordinary certificate chains validated by typical 6583 * applications that perform certificate verification and therefore will 6584 * process SCTs when enabled. 6585 */ 6586 if (s->ct_validation_callback == NULL || cert == NULL || s->verify_result != X509_V_OK || s->verified_chain == NULL || sk_X509_num(s->verified_chain) <= 1) 6587 return 1; 6588 6589 /* 6590 * CT not applicable for chains validated via DANE-TA(2) or DANE-EE(3) 6591 * trust-anchors. See https://tools.ietf.org/html/rfc7671#section-4.2 6592 */ 6593 if (DANETLS_ENABLED(dane) && dane->mtlsa != NULL) { 6594 switch (dane->mtlsa->usage) { 6595 case DANETLS_USAGE_DANE_TA: 6596 case DANETLS_USAGE_DANE_EE: 6597 return 1; 6598 } 6599 } 6600 6601 ctx = CT_POLICY_EVAL_CTX_new_ex(SSL_CONNECTION_GET_CTX(s)->libctx, 6602 SSL_CONNECTION_GET_CTX(s)->propq); 6603 if (ctx == NULL) { 6604 SSLfatal(s, SSL_AD_INTERNAL_ERROR, ERR_R_CT_LIB); 6605 goto end; 6606 } 6607 6608 issuer = sk_X509_value(s->verified_chain, 1); 6609 CT_POLICY_EVAL_CTX_set1_cert(ctx, cert); 6610 CT_POLICY_EVAL_CTX_set1_issuer(ctx, issuer); 6611 CT_POLICY_EVAL_CTX_set_shared_CTLOG_STORE(ctx, 6612 SSL_CONNECTION_GET_CTX(s)->ctlog_store); 6613 CT_POLICY_EVAL_CTX_set_time( 6614 ctx, (uint64_t)SSL_SESSION_get_time_ex(s->session) * 1000); 6615 6616 scts = SSL_get0_peer_scts(SSL_CONNECTION_GET_SSL(s)); 6617 6618 /* 6619 * This function returns success (> 0) only when all the SCTs are valid, 0 6620 * when some are invalid, and < 0 on various internal errors (out of 6621 * memory, etc.). Having some, or even all, invalid SCTs is not sufficient 6622 * reason to abort the handshake, that decision is up to the callback. 6623 * Therefore, we error out only in the unexpected case that the return 6624 * value is negative. 6625 * 6626 * XXX: One might well argue that the return value of this function is an 6627 * unfortunate design choice. Its job is only to determine the validation 6628 * status of each of the provided SCTs. So long as it correctly separates 6629 * the wheat from the chaff it should return success. Failure in this case 6630 * ought to correspond to an inability to carry out its duties. 6631 */ 6632 if (SCT_LIST_validate(scts, ctx) < 0) { 6633 SSLfatal(s, SSL_AD_HANDSHAKE_FAILURE, SSL_R_SCT_VERIFICATION_FAILED); 6634 goto end; 6635 } 6636 6637 ret = s->ct_validation_callback(ctx, scts, s->ct_validation_callback_arg); 6638 if (ret < 0) 6639 ret = 0; /* This function returns 0 on failure */ 6640 if (!ret) 6641 SSLfatal(s, SSL_AD_HANDSHAKE_FAILURE, SSL_R_CALLBACK_FAILED); 6642 6643 end: 6644 CT_POLICY_EVAL_CTX_free(ctx); 6645 /* 6646 * With SSL_VERIFY_NONE the session may be cached and reused despite a 6647 * failure return code here. Also the application may wish the complete 6648 * the handshake, and then disconnect cleanly at a higher layer, after 6649 * checking the verification status of the completed connection. 6650 * 6651 * We therefore force a certificate verification failure which will be 6652 * visible via SSL_get_verify_result() and cached as part of any resumed 6653 * session. 6654 * 6655 * Note: the permissive callback is for information gathering only, always 6656 * returns success, and does not affect verification status. Only the 6657 * strict callback or a custom application-specified callback can trigger 6658 * connection failure or record a verification error. 6659 */ 6660 if (ret <= 0) 6661 s->verify_result = X509_V_ERR_NO_VALID_SCTS; 6662 return ret; 6663 } 6664 6665 int SSL_CTX_enable_ct(SSL_CTX *ctx, int validation_mode) 6666 { 6667 switch (validation_mode) { 6668 default: 6669 ERR_raise(ERR_LIB_SSL, SSL_R_INVALID_CT_VALIDATION_TYPE); 6670 return 0; 6671 case SSL_CT_VALIDATION_PERMISSIVE: 6672 return SSL_CTX_set_ct_validation_callback(ctx, ct_permissive, NULL); 6673 case SSL_CT_VALIDATION_STRICT: 6674 return SSL_CTX_set_ct_validation_callback(ctx, ct_strict, NULL); 6675 } 6676 } 6677 6678 int SSL_enable_ct(SSL *s, int validation_mode) 6679 { 6680 switch (validation_mode) { 6681 default: 6682 ERR_raise(ERR_LIB_SSL, SSL_R_INVALID_CT_VALIDATION_TYPE); 6683 return 0; 6684 case SSL_CT_VALIDATION_PERMISSIVE: 6685 return SSL_set_ct_validation_callback(s, ct_permissive, NULL); 6686 case SSL_CT_VALIDATION_STRICT: 6687 return SSL_set_ct_validation_callback(s, ct_strict, NULL); 6688 } 6689 } 6690 6691 int SSL_CTX_set_default_ctlog_list_file(SSL_CTX *ctx) 6692 { 6693 return CTLOG_STORE_load_default_file(ctx->ctlog_store); 6694 } 6695 6696 int SSL_CTX_set_ctlog_list_file(SSL_CTX *ctx, const char *path) 6697 { 6698 return CTLOG_STORE_load_file(ctx->ctlog_store, path); 6699 } 6700 6701 void SSL_CTX_set0_ctlog_store(SSL_CTX *ctx, CTLOG_STORE *logs) 6702 { 6703 CTLOG_STORE_free(ctx->ctlog_store); 6704 ctx->ctlog_store = logs; 6705 } 6706 6707 const CTLOG_STORE *SSL_CTX_get0_ctlog_store(const SSL_CTX *ctx) 6708 { 6709 return ctx->ctlog_store; 6710 } 6711 6712 #endif /* OPENSSL_NO_CT */ 6713 6714 void SSL_CTX_set_client_hello_cb(SSL_CTX *c, SSL_client_hello_cb_fn cb, 6715 void *arg) 6716 { 6717 c->client_hello_cb = cb; 6718 c->client_hello_cb_arg = arg; 6719 } 6720 6721 void SSL_CTX_set_new_pending_conn_cb(SSL_CTX *c, SSL_new_pending_conn_cb_fn cb, 6722 void *arg) 6723 { 6724 c->new_pending_conn_cb = cb; 6725 c->new_pending_conn_arg = arg; 6726 } 6727 6728 int SSL_client_hello_isv2(SSL *s) 6729 { 6730 const SSL_CONNECTION *sc = SSL_CONNECTION_FROM_SSL(s); 6731 6732 if (sc == NULL) 6733 return 0; 6734 6735 if (sc->clienthello == NULL) 6736 return 0; 6737 return sc->clienthello->isv2; 6738 } 6739 6740 unsigned int SSL_client_hello_get0_legacy_version(SSL *s) 6741 { 6742 const SSL_CONNECTION *sc = SSL_CONNECTION_FROM_SSL(s); 6743 6744 if (sc == NULL) 6745 return 0; 6746 6747 if (sc->clienthello == NULL) 6748 return 0; 6749 return sc->clienthello->legacy_version; 6750 } 6751 6752 size_t SSL_client_hello_get0_random(SSL *s, const unsigned char **out) 6753 { 6754 const SSL_CONNECTION *sc = SSL_CONNECTION_FROM_SSL(s); 6755 6756 if (sc == NULL) 6757 return 0; 6758 6759 if (sc->clienthello == NULL) 6760 return 0; 6761 if (out != NULL) 6762 *out = sc->clienthello->random; 6763 return SSL3_RANDOM_SIZE; 6764 } 6765 6766 size_t SSL_client_hello_get0_session_id(SSL *s, const unsigned char **out) 6767 { 6768 const SSL_CONNECTION *sc = SSL_CONNECTION_FROM_SSL(s); 6769 6770 if (sc == NULL) 6771 return 0; 6772 6773 if (sc->clienthello == NULL) 6774 return 0; 6775 if (out != NULL) 6776 *out = sc->clienthello->session_id; 6777 return sc->clienthello->session_id_len; 6778 } 6779 6780 size_t SSL_client_hello_get0_ciphers(SSL *s, const unsigned char **out) 6781 { 6782 const SSL_CONNECTION *sc = SSL_CONNECTION_FROM_SSL(s); 6783 6784 if (sc == NULL) 6785 return 0; 6786 6787 if (sc->clienthello == NULL) 6788 return 0; 6789 if (out != NULL) 6790 *out = PACKET_data(&sc->clienthello->ciphersuites); 6791 return PACKET_remaining(&sc->clienthello->ciphersuites); 6792 } 6793 6794 size_t SSL_client_hello_get0_compression_methods(SSL *s, const unsigned char **out) 6795 { 6796 const SSL_CONNECTION *sc = SSL_CONNECTION_FROM_SSL(s); 6797 6798 if (sc == NULL) 6799 return 0; 6800 6801 if (sc->clienthello == NULL) 6802 return 0; 6803 if (out != NULL) 6804 *out = sc->clienthello->compressions; 6805 return sc->clienthello->compressions_len; 6806 } 6807 6808 int SSL_client_hello_get1_extensions_present(SSL *s, int **out, size_t *outlen) 6809 { 6810 RAW_EXTENSION *ext; 6811 int *present; 6812 size_t num = 0, i; 6813 const SSL_CONNECTION *sc = SSL_CONNECTION_FROM_SSL(s); 6814 6815 if (sc == NULL) 6816 return 0; 6817 6818 if (sc->clienthello == NULL || out == NULL || outlen == NULL) 6819 return 0; 6820 for (i = 0; i < sc->clienthello->pre_proc_exts_len; i++) { 6821 ext = sc->clienthello->pre_proc_exts + i; 6822 if (ext->present) 6823 num++; 6824 } 6825 if (num == 0) { 6826 *out = NULL; 6827 *outlen = 0; 6828 return 1; 6829 } 6830 if ((present = OPENSSL_malloc(sizeof(*present) * num)) == NULL) 6831 return 0; 6832 for (i = 0; i < sc->clienthello->pre_proc_exts_len; i++) { 6833 ext = sc->clienthello->pre_proc_exts + i; 6834 if (ext->present) { 6835 if (ext->received_order >= num) 6836 goto err; 6837 present[ext->received_order] = ext->type; 6838 } 6839 } 6840 *out = present; 6841 *outlen = num; 6842 return 1; 6843 err: 6844 OPENSSL_free(present); 6845 return 0; 6846 } 6847 6848 int SSL_client_hello_get_extension_order(SSL *s, uint16_t *exts, size_t *num_exts) 6849 { 6850 RAW_EXTENSION *ext; 6851 size_t num = 0, i; 6852 const SSL_CONNECTION *sc = SSL_CONNECTION_FROM_SSL(s); 6853 6854 if (sc == NULL) 6855 return 0; 6856 6857 if (sc->clienthello == NULL || num_exts == NULL) 6858 return 0; 6859 for (i = 0; i < sc->clienthello->pre_proc_exts_len; i++) { 6860 ext = sc->clienthello->pre_proc_exts + i; 6861 if (ext->present) 6862 num++; 6863 } 6864 if (num == 0) { 6865 *num_exts = 0; 6866 return 1; 6867 } 6868 if (exts == NULL) { 6869 *num_exts = num; 6870 return 1; 6871 } 6872 if (*num_exts < num) 6873 return 0; 6874 for (i = 0; i < sc->clienthello->pre_proc_exts_len; i++) { 6875 ext = sc->clienthello->pre_proc_exts + i; 6876 if (ext->present) { 6877 if (ext->received_order >= num) 6878 return 0; 6879 exts[ext->received_order] = ext->type; 6880 } 6881 } 6882 *num_exts = num; 6883 return 1; 6884 } 6885 6886 int SSL_client_hello_get0_ext(SSL *s, unsigned int type, const unsigned char **out, 6887 size_t *outlen) 6888 { 6889 size_t i; 6890 RAW_EXTENSION *r; 6891 const SSL_CONNECTION *sc = SSL_CONNECTION_FROM_SSL(s); 6892 6893 if (sc == NULL) 6894 return 0; 6895 6896 if (sc->clienthello == NULL) 6897 return 0; 6898 for (i = 0; i < sc->clienthello->pre_proc_exts_len; ++i) { 6899 r = sc->clienthello->pre_proc_exts + i; 6900 if (r->present && r->type == type) { 6901 if (out != NULL) 6902 *out = PACKET_data(&r->data); 6903 if (outlen != NULL) 6904 *outlen = PACKET_remaining(&r->data); 6905 return 1; 6906 } 6907 } 6908 return 0; 6909 } 6910 6911 int SSL_free_buffers(SSL *ssl) 6912 { 6913 RECORD_LAYER *rl; 6914 SSL_CONNECTION *sc = SSL_CONNECTION_FROM_SSL_ONLY(ssl); 6915 6916 if (sc == NULL) 6917 return 0; 6918 6919 rl = &sc->rlayer; 6920 6921 return rl->rrlmethod->free_buffers(rl->rrl) 6922 && rl->wrlmethod->free_buffers(rl->wrl); 6923 } 6924 6925 int SSL_alloc_buffers(SSL *ssl) 6926 { 6927 RECORD_LAYER *rl; 6928 SSL_CONNECTION *sc = SSL_CONNECTION_FROM_SSL(ssl); 6929 6930 if (sc == NULL) 6931 return 0; 6932 6933 /* QUIC always has buffers allocated. */ 6934 if (IS_QUIC(ssl)) 6935 return 1; 6936 6937 rl = &sc->rlayer; 6938 6939 return rl->rrlmethod->alloc_buffers(rl->rrl) 6940 && rl->wrlmethod->alloc_buffers(rl->wrl); 6941 } 6942 6943 void SSL_CTX_set_keylog_callback(SSL_CTX *ctx, SSL_CTX_keylog_cb_func cb) 6944 { 6945 ctx->keylog_callback = cb; 6946 } 6947 6948 SSL_CTX_keylog_cb_func SSL_CTX_get_keylog_callback(const SSL_CTX *ctx) 6949 { 6950 return ctx->keylog_callback; 6951 } 6952 6953 static int nss_keylog_int(const char *prefix, 6954 SSL_CONNECTION *sc, 6955 const uint8_t *parameter_1, 6956 size_t parameter_1_len, 6957 const uint8_t *parameter_2, 6958 size_t parameter_2_len) 6959 { 6960 char *out = NULL; 6961 char *cursor = NULL; 6962 size_t out_len = 0, i, prefix_len; 6963 SSL_CTX *sctx = SSL_CONNECTION_GET_CTX(sc); 6964 6965 #ifndef OPENSSL_NO_SSLKEYLOG 6966 if (sctx->keylog_callback == NULL && sctx->do_sslkeylog == 0) 6967 return 1; 6968 #else 6969 if (sctx->keylog_callback == NULL) 6970 return 1; 6971 #endif 6972 6973 /* 6974 * Our output buffer will contain the following strings, rendered with 6975 * space characters in between, terminated by a NULL character: first the 6976 * prefix, then the first parameter, then the second parameter. The 6977 * meaning of each parameter depends on the specific key material being 6978 * logged. Note that the first and second parameters are encoded in 6979 * hexadecimal, so we need a buffer that is twice their lengths. 6980 */ 6981 prefix_len = strlen(prefix); 6982 out_len = prefix_len + (2 * parameter_1_len) + (2 * parameter_2_len) + 3; 6983 if ((out = cursor = OPENSSL_malloc(out_len)) == NULL) 6984 return 0; 6985 6986 memcpy(cursor, prefix, prefix_len); 6987 cursor += prefix_len; 6988 *cursor++ = ' '; 6989 6990 for (i = 0; i < parameter_1_len; ++i) 6991 cursor += ossl_to_lowerhex(cursor, parameter_1[i]); 6992 *cursor++ = ' '; 6993 6994 for (i = 0; i < parameter_2_len; ++i) 6995 cursor += ossl_to_lowerhex(cursor, parameter_2[i]); 6996 *cursor = '\0'; 6997 6998 #ifndef OPENSSL_NO_SSLKEYLOG 6999 if (sctx->do_sslkeylog == 1) 7000 do_sslkeylogfile(SSL_CONNECTION_GET_SSL(sc), (const char *)out); 7001 #endif 7002 if (sctx->keylog_callback != NULL) 7003 sctx->keylog_callback(SSL_CONNECTION_GET_USER_SSL(sc), (const char *)out); 7004 OPENSSL_clear_free(out, out_len); 7005 return 1; 7006 } 7007 7008 int ssl_log_rsa_client_key_exchange(SSL_CONNECTION *sc, 7009 const uint8_t *encrypted_premaster, 7010 size_t encrypted_premaster_len, 7011 const uint8_t *premaster, 7012 size_t premaster_len) 7013 { 7014 if (encrypted_premaster_len < 8) { 7015 SSLfatal(sc, SSL_AD_INTERNAL_ERROR, ERR_R_INTERNAL_ERROR); 7016 return 0; 7017 } 7018 7019 /* We only want the first 8 bytes of the encrypted premaster as a tag. */ 7020 return nss_keylog_int("RSA", 7021 sc, 7022 encrypted_premaster, 7023 8, 7024 premaster, 7025 premaster_len); 7026 } 7027 7028 int ssl_log_secret(SSL_CONNECTION *sc, 7029 const char *label, 7030 const uint8_t *secret, 7031 size_t secret_len) 7032 { 7033 return nss_keylog_int(label, 7034 sc, 7035 sc->s3.client_random, 7036 SSL3_RANDOM_SIZE, 7037 secret, 7038 secret_len); 7039 } 7040 7041 #define SSLV2_CIPHER_LEN 3 7042 7043 int ssl_cache_cipherlist(SSL_CONNECTION *s, PACKET *cipher_suites, int sslv2format) 7044 { 7045 int n; 7046 7047 n = sslv2format ? SSLV2_CIPHER_LEN : TLS_CIPHER_LEN; 7048 7049 if (PACKET_remaining(cipher_suites) == 0) { 7050 SSLfatal(s, SSL_AD_DECODE_ERROR, SSL_R_NO_CIPHERS_SPECIFIED); 7051 return 0; 7052 } 7053 7054 if (PACKET_remaining(cipher_suites) % n != 0) { 7055 SSLfatal(s, SSL_AD_DECODE_ERROR, SSL_R_ERROR_IN_RECEIVED_CIPHER_LIST); 7056 return 0; 7057 } 7058 7059 OPENSSL_free(s->s3.tmp.ciphers_raw); 7060 s->s3.tmp.ciphers_raw = NULL; 7061 s->s3.tmp.ciphers_rawlen = 0; 7062 7063 if (sslv2format) { 7064 size_t numciphers = PACKET_remaining(cipher_suites) / n; 7065 PACKET sslv2ciphers = *cipher_suites; 7066 unsigned int leadbyte; 7067 unsigned char *raw; 7068 7069 /* 7070 * We store the raw ciphers list in SSLv3+ format so we need to do some 7071 * preprocessing to convert the list first. If there are any SSLv2 only 7072 * ciphersuites with a non-zero leading byte then we are going to 7073 * slightly over allocate because we won't store those. But that isn't a 7074 * problem. 7075 */ 7076 raw = OPENSSL_malloc(numciphers * TLS_CIPHER_LEN); 7077 s->s3.tmp.ciphers_raw = raw; 7078 if (raw == NULL) { 7079 SSLfatal(s, SSL_AD_INTERNAL_ERROR, ERR_R_CRYPTO_LIB); 7080 return 0; 7081 } 7082 for (s->s3.tmp.ciphers_rawlen = 0; 7083 PACKET_remaining(&sslv2ciphers) > 0; 7084 raw += TLS_CIPHER_LEN) { 7085 if (!PACKET_get_1(&sslv2ciphers, &leadbyte) 7086 || (leadbyte == 0 7087 && !PACKET_copy_bytes(&sslv2ciphers, raw, 7088 TLS_CIPHER_LEN)) 7089 || (leadbyte != 0 7090 && !PACKET_forward(&sslv2ciphers, TLS_CIPHER_LEN))) { 7091 SSLfatal(s, SSL_AD_DECODE_ERROR, SSL_R_BAD_PACKET); 7092 OPENSSL_free(s->s3.tmp.ciphers_raw); 7093 s->s3.tmp.ciphers_raw = NULL; 7094 s->s3.tmp.ciphers_rawlen = 0; 7095 return 0; 7096 } 7097 if (leadbyte == 0) 7098 s->s3.tmp.ciphers_rawlen += TLS_CIPHER_LEN; 7099 } 7100 } else if (!PACKET_memdup(cipher_suites, &s->s3.tmp.ciphers_raw, 7101 &s->s3.tmp.ciphers_rawlen)) { 7102 SSLfatal(s, SSL_AD_INTERNAL_ERROR, ERR_R_INTERNAL_ERROR); 7103 return 0; 7104 } 7105 return 1; 7106 } 7107 7108 int SSL_bytes_to_cipher_list(SSL *s, const unsigned char *bytes, size_t len, 7109 int isv2format, STACK_OF(SSL_CIPHER) **sk, 7110 STACK_OF(SSL_CIPHER) **scsvs) 7111 { 7112 PACKET pkt; 7113 SSL_CONNECTION *sc = SSL_CONNECTION_FROM_SSL(s); 7114 7115 if (sc == NULL) 7116 return 0; 7117 7118 if (!PACKET_buf_init(&pkt, bytes, len)) 7119 return 0; 7120 return ossl_bytes_to_cipher_list(sc, &pkt, sk, scsvs, isv2format, 0); 7121 } 7122 7123 int ossl_bytes_to_cipher_list(SSL_CONNECTION *s, PACKET *cipher_suites, 7124 STACK_OF(SSL_CIPHER) **skp, 7125 STACK_OF(SSL_CIPHER) **scsvs_out, 7126 int sslv2format, int fatal) 7127 { 7128 const SSL_CIPHER *c; 7129 STACK_OF(SSL_CIPHER) *sk = NULL; 7130 STACK_OF(SSL_CIPHER) *scsvs = NULL; 7131 int n; 7132 /* 3 = SSLV2_CIPHER_LEN > TLS_CIPHER_LEN = 2. */ 7133 unsigned char cipher[SSLV2_CIPHER_LEN]; 7134 7135 n = sslv2format ? SSLV2_CIPHER_LEN : TLS_CIPHER_LEN; 7136 7137 if (PACKET_remaining(cipher_suites) == 0) { 7138 if (fatal) 7139 SSLfatal(s, SSL_AD_ILLEGAL_PARAMETER, SSL_R_NO_CIPHERS_SPECIFIED); 7140 else 7141 ERR_raise(ERR_LIB_SSL, SSL_R_NO_CIPHERS_SPECIFIED); 7142 return 0; 7143 } 7144 7145 if (PACKET_remaining(cipher_suites) % n != 0) { 7146 if (fatal) 7147 SSLfatal(s, SSL_AD_DECODE_ERROR, 7148 SSL_R_ERROR_IN_RECEIVED_CIPHER_LIST); 7149 else 7150 ERR_raise(ERR_LIB_SSL, SSL_R_ERROR_IN_RECEIVED_CIPHER_LIST); 7151 return 0; 7152 } 7153 7154 sk = sk_SSL_CIPHER_new_null(); 7155 scsvs = sk_SSL_CIPHER_new_null(); 7156 if (sk == NULL || scsvs == NULL) { 7157 if (fatal) 7158 SSLfatal(s, SSL_AD_INTERNAL_ERROR, ERR_R_CRYPTO_LIB); 7159 else 7160 ERR_raise(ERR_LIB_SSL, ERR_R_CRYPTO_LIB); 7161 goto err; 7162 } 7163 7164 while (PACKET_copy_bytes(cipher_suites, cipher, n)) { 7165 /* 7166 * SSLv3 ciphers wrapped in an SSLv2-compatible ClientHello have the 7167 * first byte set to zero, while true SSLv2 ciphers have a non-zero 7168 * first byte. We don't support any true SSLv2 ciphers, so skip them. 7169 */ 7170 if (sslv2format && cipher[0] != '\0') 7171 continue; 7172 7173 /* For SSLv2-compat, ignore leading 0-byte. */ 7174 c = ssl_get_cipher_by_char(s, sslv2format ? &cipher[1] : cipher, 1); 7175 if (c != NULL) { 7176 if ((c->valid && !sk_SSL_CIPHER_push(sk, c)) || (!c->valid && !sk_SSL_CIPHER_push(scsvs, c))) { 7177 if (fatal) 7178 SSLfatal(s, SSL_AD_INTERNAL_ERROR, ERR_R_CRYPTO_LIB); 7179 else 7180 ERR_raise(ERR_LIB_SSL, ERR_R_CRYPTO_LIB); 7181 goto err; 7182 } 7183 } 7184 } 7185 if (PACKET_remaining(cipher_suites) > 0) { 7186 if (fatal) 7187 SSLfatal(s, SSL_AD_DECODE_ERROR, SSL_R_BAD_LENGTH); 7188 else 7189 ERR_raise(ERR_LIB_SSL, SSL_R_BAD_LENGTH); 7190 goto err; 7191 } 7192 7193 if (skp != NULL) 7194 *skp = sk; 7195 else 7196 sk_SSL_CIPHER_free(sk); 7197 if (scsvs_out != NULL) 7198 *scsvs_out = scsvs; 7199 else 7200 sk_SSL_CIPHER_free(scsvs); 7201 return 1; 7202 err: 7203 sk_SSL_CIPHER_free(sk); 7204 sk_SSL_CIPHER_free(scsvs); 7205 return 0; 7206 } 7207 7208 int SSL_CTX_set_max_early_data(SSL_CTX *ctx, uint32_t max_early_data) 7209 { 7210 ctx->max_early_data = max_early_data; 7211 7212 return 1; 7213 } 7214 7215 uint32_t SSL_CTX_get_max_early_data(const SSL_CTX *ctx) 7216 { 7217 return ctx->max_early_data; 7218 } 7219 7220 int SSL_set_max_early_data(SSL *s, uint32_t max_early_data) 7221 { 7222 SSL_CONNECTION *sc = SSL_CONNECTION_FROM_SSL_ONLY(s); 7223 7224 if (sc == NULL) 7225 return 0; 7226 7227 sc->max_early_data = max_early_data; 7228 7229 return 1; 7230 } 7231 7232 uint32_t SSL_get_max_early_data(const SSL *s) 7233 { 7234 const SSL_CONNECTION *sc = SSL_CONNECTION_FROM_CONST_SSL(s); 7235 7236 if (sc == NULL) 7237 return 0; 7238 7239 return sc->max_early_data; 7240 } 7241 7242 int SSL_CTX_set_recv_max_early_data(SSL_CTX *ctx, uint32_t recv_max_early_data) 7243 { 7244 ctx->recv_max_early_data = recv_max_early_data; 7245 7246 return 1; 7247 } 7248 7249 uint32_t SSL_CTX_get_recv_max_early_data(const SSL_CTX *ctx) 7250 { 7251 return ctx->recv_max_early_data; 7252 } 7253 7254 int SSL_set_recv_max_early_data(SSL *s, uint32_t recv_max_early_data) 7255 { 7256 SSL_CONNECTION *sc = SSL_CONNECTION_FROM_SSL_ONLY(s); 7257 7258 if (sc == NULL) 7259 return 0; 7260 7261 sc->recv_max_early_data = recv_max_early_data; 7262 7263 return 1; 7264 } 7265 7266 uint32_t SSL_get_recv_max_early_data(const SSL *s) 7267 { 7268 const SSL_CONNECTION *sc = SSL_CONNECTION_FROM_CONST_SSL(s); 7269 7270 if (sc == NULL) 7271 return 0; 7272 7273 return sc->recv_max_early_data; 7274 } 7275 7276 __owur unsigned int ssl_get_max_send_fragment(const SSL_CONNECTION *sc) 7277 { 7278 /* Return any active Max Fragment Len extension */ 7279 if (sc->session != NULL && USE_MAX_FRAGMENT_LENGTH_EXT(sc->session)) 7280 return GET_MAX_FRAGMENT_LENGTH(sc->session); 7281 7282 /* return current SSL connection setting */ 7283 return sc->max_send_fragment; 7284 } 7285 7286 __owur unsigned int ssl_get_split_send_fragment(const SSL_CONNECTION *sc) 7287 { 7288 /* Return a value regarding an active Max Fragment Len extension */ 7289 if (sc->session != NULL && USE_MAX_FRAGMENT_LENGTH_EXT(sc->session) 7290 && sc->split_send_fragment > GET_MAX_FRAGMENT_LENGTH(sc->session)) 7291 return GET_MAX_FRAGMENT_LENGTH(sc->session); 7292 7293 /* else limit |split_send_fragment| to current |max_send_fragment| */ 7294 if (sc->split_send_fragment > sc->max_send_fragment) 7295 return sc->max_send_fragment; 7296 7297 /* return current SSL connection setting */ 7298 return sc->split_send_fragment; 7299 } 7300 7301 int SSL_stateless(SSL *s) 7302 { 7303 int ret; 7304 SSL_CONNECTION *sc = SSL_CONNECTION_FROM_SSL_ONLY(s); 7305 7306 if (sc == NULL) 7307 return 0; 7308 7309 /* Ensure there is no state left over from a previous invocation */ 7310 if (!SSL_clear(s)) 7311 return 0; 7312 7313 ERR_clear_error(); 7314 7315 sc->s3.flags |= TLS1_FLAGS_STATELESS; 7316 ret = SSL_accept(s); 7317 sc->s3.flags &= ~TLS1_FLAGS_STATELESS; 7318 7319 if (ret > 0 && sc->ext.cookieok) 7320 return 1; 7321 7322 if (sc->hello_retry_request == SSL_HRR_PENDING && !ossl_statem_in_error(sc)) 7323 return 0; 7324 7325 return -1; 7326 } 7327 7328 void SSL_CTX_set_post_handshake_auth(SSL_CTX *ctx, int val) 7329 { 7330 ctx->pha_enabled = val; 7331 } 7332 7333 void SSL_set_post_handshake_auth(SSL *ssl, int val) 7334 { 7335 SSL_CONNECTION *sc = SSL_CONNECTION_FROM_SSL_ONLY(ssl); 7336 7337 if (sc == NULL) 7338 return; 7339 7340 sc->pha_enabled = val; 7341 } 7342 7343 int SSL_verify_client_post_handshake(SSL *ssl) 7344 { 7345 SSL_CONNECTION *sc = SSL_CONNECTION_FROM_SSL(ssl); 7346 7347 #ifndef OPENSSL_NO_QUIC 7348 if (IS_QUIC(ssl)) { 7349 ERR_raise(ERR_LIB_SSL, SSL_R_WRONG_SSL_VERSION); 7350 return 0; 7351 } 7352 #endif 7353 7354 if (sc == NULL) 7355 return 0; 7356 7357 if (!SSL_CONNECTION_IS_TLS13(sc)) { 7358 ERR_raise(ERR_LIB_SSL, SSL_R_WRONG_SSL_VERSION); 7359 return 0; 7360 } 7361 if (!sc->server) { 7362 ERR_raise(ERR_LIB_SSL, SSL_R_NOT_SERVER); 7363 return 0; 7364 } 7365 7366 if (!SSL_is_init_finished(ssl)) { 7367 ERR_raise(ERR_LIB_SSL, SSL_R_STILL_IN_INIT); 7368 return 0; 7369 } 7370 7371 switch (sc->post_handshake_auth) { 7372 case SSL_PHA_NONE: 7373 ERR_raise(ERR_LIB_SSL, SSL_R_EXTENSION_NOT_RECEIVED); 7374 return 0; 7375 default: 7376 case SSL_PHA_EXT_SENT: 7377 ERR_raise(ERR_LIB_SSL, ERR_R_INTERNAL_ERROR); 7378 return 0; 7379 case SSL_PHA_EXT_RECEIVED: 7380 break; 7381 case SSL_PHA_REQUEST_PENDING: 7382 ERR_raise(ERR_LIB_SSL, SSL_R_REQUEST_PENDING); 7383 return 0; 7384 case SSL_PHA_REQUESTED: 7385 ERR_raise(ERR_LIB_SSL, SSL_R_REQUEST_SENT); 7386 return 0; 7387 } 7388 7389 sc->post_handshake_auth = SSL_PHA_REQUEST_PENDING; 7390 7391 /* checks verify_mode and algorithm_auth */ 7392 if (!send_certificate_request(sc)) { 7393 sc->post_handshake_auth = SSL_PHA_EXT_RECEIVED; /* restore on error */ 7394 ERR_raise(ERR_LIB_SSL, SSL_R_INVALID_CONFIG); 7395 return 0; 7396 } 7397 7398 ossl_statem_set_in_init(sc, 1); 7399 return 1; 7400 } 7401 7402 int SSL_CTX_set_session_ticket_cb(SSL_CTX *ctx, 7403 SSL_CTX_generate_session_ticket_fn gen_cb, 7404 SSL_CTX_decrypt_session_ticket_fn dec_cb, 7405 void *arg) 7406 { 7407 ctx->generate_ticket_cb = gen_cb; 7408 ctx->decrypt_ticket_cb = dec_cb; 7409 ctx->ticket_cb_data = arg; 7410 return 1; 7411 } 7412 7413 void SSL_CTX_set_allow_early_data_cb(SSL_CTX *ctx, 7414 SSL_allow_early_data_cb_fn cb, 7415 void *arg) 7416 { 7417 ctx->allow_early_data_cb = cb; 7418 ctx->allow_early_data_cb_data = arg; 7419 } 7420 7421 void SSL_set_allow_early_data_cb(SSL *s, 7422 SSL_allow_early_data_cb_fn cb, 7423 void *arg) 7424 { 7425 SSL_CONNECTION *sc = SSL_CONNECTION_FROM_SSL_ONLY(s); 7426 7427 if (sc == NULL) 7428 return; 7429 7430 sc->allow_early_data_cb = cb; 7431 sc->allow_early_data_cb_data = arg; 7432 } 7433 7434 const EVP_CIPHER *ssl_evp_cipher_fetch(OSSL_LIB_CTX *libctx, 7435 int nid, 7436 const char *properties) 7437 { 7438 const EVP_CIPHER *ciph; 7439 7440 ciph = tls_get_cipher_from_engine(nid); 7441 if (ciph != NULL) 7442 return ciph; 7443 7444 /* 7445 * If there is no engine cipher then we do an explicit fetch. This may fail 7446 * and that could be ok 7447 */ 7448 ERR_set_mark(); 7449 ciph = EVP_CIPHER_fetch(libctx, OBJ_nid2sn(nid), properties); 7450 if (ciph != NULL) { 7451 OSSL_PARAM params[2]; 7452 int decrypt_only = 0; 7453 7454 params[0] = OSSL_PARAM_construct_int(OSSL_CIPHER_PARAM_DECRYPT_ONLY, 7455 &decrypt_only); 7456 params[1] = OSSL_PARAM_construct_end(); 7457 if (EVP_CIPHER_get_params((EVP_CIPHER *)ciph, params) 7458 && decrypt_only) { 7459 /* If a cipher is decrypt-only, it is unusable */ 7460 EVP_CIPHER_free((EVP_CIPHER *)ciph); 7461 ciph = NULL; 7462 } 7463 } 7464 ERR_pop_to_mark(); 7465 return ciph; 7466 } 7467 7468 int ssl_evp_cipher_up_ref(const EVP_CIPHER *cipher) 7469 { 7470 /* Don't up-ref an implicit EVP_CIPHER */ 7471 if (EVP_CIPHER_get0_provider(cipher) == NULL) 7472 return 1; 7473 7474 /* 7475 * The cipher was explicitly fetched and therefore it is safe to cast 7476 * away the const 7477 */ 7478 return EVP_CIPHER_up_ref((EVP_CIPHER *)cipher); 7479 } 7480 7481 void ssl_evp_cipher_free(const EVP_CIPHER *cipher) 7482 { 7483 if (cipher == NULL) 7484 return; 7485 7486 if (EVP_CIPHER_get0_provider(cipher) != NULL) { 7487 /* 7488 * The cipher was explicitly fetched and therefore it is safe to cast 7489 * away the const 7490 */ 7491 EVP_CIPHER_free((EVP_CIPHER *)cipher); 7492 } 7493 } 7494 7495 const EVP_MD *ssl_evp_md_fetch(OSSL_LIB_CTX *libctx, 7496 int nid, 7497 const char *properties) 7498 { 7499 const EVP_MD *md; 7500 7501 md = tls_get_digest_from_engine(nid); 7502 if (md != NULL) 7503 return md; 7504 7505 /* Otherwise we do an explicit fetch */ 7506 ERR_set_mark(); 7507 md = EVP_MD_fetch(libctx, OBJ_nid2sn(nid), properties); 7508 ERR_pop_to_mark(); 7509 return md; 7510 } 7511 7512 int ssl_evp_md_up_ref(const EVP_MD *md) 7513 { 7514 /* Don't up-ref an implicit EVP_MD */ 7515 if (EVP_MD_get0_provider(md) == NULL) 7516 return 1; 7517 7518 /* 7519 * The digest was explicitly fetched and therefore it is safe to cast 7520 * away the const 7521 */ 7522 return EVP_MD_up_ref((EVP_MD *)md); 7523 } 7524 7525 void ssl_evp_md_free(const EVP_MD *md) 7526 { 7527 if (md == NULL) 7528 return; 7529 7530 if (EVP_MD_get0_provider(md) != NULL) { 7531 /* 7532 * The digest was explicitly fetched and therefore it is safe to cast 7533 * away the const 7534 */ 7535 EVP_MD_free((EVP_MD *)md); 7536 } 7537 } 7538 7539 int SSL_set0_tmp_dh_pkey(SSL *s, EVP_PKEY *dhpkey) 7540 { 7541 SSL_CONNECTION *sc = SSL_CONNECTION_FROM_SSL(s); 7542 7543 if (sc == NULL) 7544 return 0; 7545 7546 if (!ssl_security(sc, SSL_SECOP_TMP_DH, 7547 EVP_PKEY_get_security_bits(dhpkey), 0, dhpkey)) { 7548 ERR_raise(ERR_LIB_SSL, SSL_R_DH_KEY_TOO_SMALL); 7549 return 0; 7550 } 7551 EVP_PKEY_free(sc->cert->dh_tmp); 7552 sc->cert->dh_tmp = dhpkey; 7553 return 1; 7554 } 7555 7556 int SSL_CTX_set0_tmp_dh_pkey(SSL_CTX *ctx, EVP_PKEY *dhpkey) 7557 { 7558 if (!ssl_ctx_security(ctx, SSL_SECOP_TMP_DH, 7559 EVP_PKEY_get_security_bits(dhpkey), 0, dhpkey)) { 7560 ERR_raise(ERR_LIB_SSL, SSL_R_DH_KEY_TOO_SMALL); 7561 return 0; 7562 } 7563 EVP_PKEY_free(ctx->cert->dh_tmp); 7564 ctx->cert->dh_tmp = dhpkey; 7565 return 1; 7566 } 7567 7568 /* QUIC-specific methods which are supported on QUIC connections only. */ 7569 int SSL_handle_events(SSL *s) 7570 { 7571 SSL_CONNECTION *sc; 7572 7573 #ifndef OPENSSL_NO_QUIC 7574 if (IS_QUIC(s)) 7575 return ossl_quic_handle_events(s); 7576 #endif 7577 7578 sc = SSL_CONNECTION_FROM_SSL_ONLY(s); 7579 if (sc != NULL && SSL_CONNECTION_IS_DTLS(sc)) 7580 /* 7581 * DTLSv1_handle_timeout returns 0 if the timer wasn't expired yet, 7582 * which we consider a success case. Theoretically DTLSv1_handle_timeout 7583 * can also return 0 if s is NULL or not a DTLS object, but we've 7584 * already ruled out those possibilities above, so this is not possible 7585 * here. Thus the only failure cases are where DTLSv1_handle_timeout 7586 * returns -1. 7587 */ 7588 return DTLSv1_handle_timeout(s) >= 0; 7589 7590 return 1; 7591 } 7592 7593 int SSL_get_event_timeout(SSL *s, struct timeval *tv, int *is_infinite) 7594 { 7595 SSL_CONNECTION *sc; 7596 7597 #ifndef OPENSSL_NO_QUIC 7598 if (IS_QUIC(s)) 7599 return ossl_quic_get_event_timeout(s, tv, is_infinite); 7600 #endif 7601 7602 sc = SSL_CONNECTION_FROM_SSL_ONLY(s); 7603 if (sc != NULL && SSL_CONNECTION_IS_DTLS(sc) 7604 && DTLSv1_get_timeout(s, tv)) { 7605 *is_infinite = 0; 7606 return 1; 7607 } 7608 7609 tv->tv_sec = 1000000; 7610 tv->tv_usec = 0; 7611 *is_infinite = 1; 7612 return 1; 7613 } 7614 7615 int SSL_get_rpoll_descriptor(SSL *s, BIO_POLL_DESCRIPTOR *desc) 7616 { 7617 SSL_CONNECTION *sc = SSL_CONNECTION_FROM_SSL(s); 7618 7619 #ifndef OPENSSL_NO_QUIC 7620 if (IS_QUIC(s)) 7621 return ossl_quic_get_rpoll_descriptor(s, desc); 7622 #endif 7623 7624 if (sc == NULL || sc->rbio == NULL) 7625 return 0; 7626 7627 return BIO_get_rpoll_descriptor(sc->rbio, desc); 7628 } 7629 7630 int SSL_get_wpoll_descriptor(SSL *s, BIO_POLL_DESCRIPTOR *desc) 7631 { 7632 SSL_CONNECTION *sc = SSL_CONNECTION_FROM_SSL(s); 7633 7634 #ifndef OPENSSL_NO_QUIC 7635 if (IS_QUIC(s)) 7636 return ossl_quic_get_wpoll_descriptor(s, desc); 7637 #endif 7638 7639 if (sc == NULL || sc->wbio == NULL) 7640 return 0; 7641 7642 return BIO_get_wpoll_descriptor(sc->wbio, desc); 7643 } 7644 7645 int SSL_net_read_desired(SSL *s) 7646 { 7647 #ifndef OPENSSL_NO_QUIC 7648 if (!IS_QUIC(s)) 7649 return SSL_want_read(s); 7650 7651 return ossl_quic_get_net_read_desired(s); 7652 #else 7653 return SSL_want_read(s); 7654 #endif 7655 } 7656 7657 int SSL_net_write_desired(SSL *s) 7658 { 7659 #ifndef OPENSSL_NO_QUIC 7660 if (!IS_QUIC(s)) 7661 return SSL_want_write(s); 7662 7663 return ossl_quic_get_net_write_desired(s); 7664 #else 7665 return SSL_want_write(s); 7666 #endif 7667 } 7668 7669 int SSL_set_blocking_mode(SSL *s, int blocking) 7670 { 7671 #ifndef OPENSSL_NO_QUIC 7672 if (!IS_QUIC(s)) 7673 return 0; 7674 7675 return ossl_quic_conn_set_blocking_mode(s, blocking); 7676 #else 7677 return 0; 7678 #endif 7679 } 7680 7681 int SSL_get_blocking_mode(SSL *s) 7682 { 7683 #ifndef OPENSSL_NO_QUIC 7684 if (!IS_QUIC(s)) 7685 return -1; 7686 7687 return ossl_quic_conn_get_blocking_mode(s); 7688 #else 7689 return -1; 7690 #endif 7691 } 7692 7693 int SSL_set1_initial_peer_addr(SSL *s, const BIO_ADDR *peer_addr) 7694 { 7695 #ifndef OPENSSL_NO_QUIC 7696 if (!IS_QUIC(s)) 7697 return 0; 7698 7699 return ossl_quic_conn_set_initial_peer_addr(s, peer_addr); 7700 #else 7701 return 0; 7702 #endif 7703 } 7704 7705 int SSL_shutdown_ex(SSL *ssl, uint64_t flags, 7706 const SSL_SHUTDOWN_EX_ARGS *args, 7707 size_t args_len) 7708 { 7709 #ifndef OPENSSL_NO_QUIC 7710 if (!IS_QUIC(ssl)) 7711 return SSL_shutdown(ssl); 7712 7713 return ossl_quic_conn_shutdown(ssl, flags, args, args_len); 7714 #else 7715 return SSL_shutdown(ssl); 7716 #endif 7717 } 7718 7719 int SSL_stream_conclude(SSL *ssl, uint64_t flags) 7720 { 7721 #ifndef OPENSSL_NO_QUIC 7722 if (!IS_QUIC(ssl)) 7723 return 0; 7724 7725 return ossl_quic_conn_stream_conclude(ssl); 7726 #else 7727 return 0; 7728 #endif 7729 } 7730 7731 SSL *SSL_new_stream(SSL *s, uint64_t flags) 7732 { 7733 #ifndef OPENSSL_NO_QUIC 7734 if (!IS_QUIC(s)) 7735 return NULL; 7736 7737 return ossl_quic_conn_stream_new(s, flags); 7738 #else 7739 return NULL; 7740 #endif 7741 } 7742 7743 SSL *SSL_get0_connection(SSL *s) 7744 { 7745 #ifndef OPENSSL_NO_QUIC 7746 if (!IS_QUIC(s)) 7747 return s; 7748 7749 return ossl_quic_get0_connection(s); 7750 #else 7751 return s; 7752 #endif 7753 } 7754 7755 int SSL_is_connection(SSL *s) 7756 { 7757 return SSL_get0_connection(s) == s; 7758 } 7759 7760 SSL *SSL_get0_listener(SSL *s) 7761 { 7762 #ifndef OPENSSL_NO_QUIC 7763 if (!IS_QUIC(s)) 7764 return NULL; 7765 7766 return ossl_quic_get0_listener(s); 7767 #else 7768 return NULL; 7769 #endif 7770 } 7771 7772 SSL *SSL_get0_domain(SSL *s) 7773 { 7774 #ifndef OPENSSL_NO_QUIC 7775 if (!IS_QUIC(s)) 7776 return NULL; 7777 7778 return ossl_quic_get0_domain(s); 7779 #else 7780 return NULL; 7781 #endif 7782 } 7783 7784 int SSL_is_listener(SSL *s) 7785 { 7786 return SSL_get0_listener(s) == s; 7787 } 7788 7789 int SSL_is_domain(SSL *s) 7790 { 7791 return SSL_get0_domain(s) == s; 7792 } 7793 7794 int SSL_get_stream_type(SSL *s) 7795 { 7796 #ifndef OPENSSL_NO_QUIC 7797 if (!IS_QUIC(s)) 7798 return SSL_STREAM_TYPE_BIDI; 7799 7800 return ossl_quic_get_stream_type(s); 7801 #else 7802 return SSL_STREAM_TYPE_BIDI; 7803 #endif 7804 } 7805 7806 uint64_t SSL_get_stream_id(SSL *s) 7807 { 7808 #ifndef OPENSSL_NO_QUIC 7809 if (!IS_QUIC(s)) 7810 return UINT64_MAX; 7811 7812 return ossl_quic_get_stream_id(s); 7813 #else 7814 return UINT64_MAX; 7815 #endif 7816 } 7817 7818 int SSL_is_stream_local(SSL *s) 7819 { 7820 #ifndef OPENSSL_NO_QUIC 7821 if (!IS_QUIC(s)) 7822 return -1; 7823 7824 return ossl_quic_is_stream_local(s); 7825 #else 7826 return -1; 7827 #endif 7828 } 7829 7830 int SSL_set_default_stream_mode(SSL *s, uint32_t mode) 7831 { 7832 #ifndef OPENSSL_NO_QUIC 7833 if (!IS_QUIC(s)) 7834 return 0; 7835 7836 return ossl_quic_set_default_stream_mode(s, mode); 7837 #else 7838 return 0; 7839 #endif 7840 } 7841 7842 int SSL_set_incoming_stream_policy(SSL *s, int policy, uint64_t aec) 7843 { 7844 #ifndef OPENSSL_NO_QUIC 7845 if (!IS_QUIC(s)) 7846 return 0; 7847 7848 return ossl_quic_set_incoming_stream_policy(s, policy, aec); 7849 #else 7850 return 0; 7851 #endif 7852 } 7853 7854 SSL *SSL_accept_stream(SSL *s, uint64_t flags) 7855 { 7856 #ifndef OPENSSL_NO_QUIC 7857 if (!IS_QUIC(s)) 7858 return NULL; 7859 7860 return ossl_quic_accept_stream(s, flags); 7861 #else 7862 return NULL; 7863 #endif 7864 } 7865 7866 size_t SSL_get_accept_stream_queue_len(SSL *s) 7867 { 7868 #ifndef OPENSSL_NO_QUIC 7869 if (!IS_QUIC(s)) 7870 return 0; 7871 7872 return ossl_quic_get_accept_stream_queue_len(s); 7873 #else 7874 return 0; 7875 #endif 7876 } 7877 7878 int SSL_stream_reset(SSL *s, 7879 const SSL_STREAM_RESET_ARGS *args, 7880 size_t args_len) 7881 { 7882 #ifndef OPENSSL_NO_QUIC 7883 if (!IS_QUIC(s)) 7884 return 0; 7885 7886 return ossl_quic_stream_reset(s, args, args_len); 7887 #else 7888 return 0; 7889 #endif 7890 } 7891 7892 int SSL_get_stream_read_state(SSL *s) 7893 { 7894 #ifndef OPENSSL_NO_QUIC 7895 if (!IS_QUIC(s)) 7896 return SSL_STREAM_STATE_NONE; 7897 7898 return ossl_quic_get_stream_read_state(s); 7899 #else 7900 return SSL_STREAM_STATE_NONE; 7901 #endif 7902 } 7903 7904 int SSL_get_stream_write_state(SSL *s) 7905 { 7906 #ifndef OPENSSL_NO_QUIC 7907 if (!IS_QUIC(s)) 7908 return SSL_STREAM_STATE_NONE; 7909 7910 return ossl_quic_get_stream_write_state(s); 7911 #else 7912 return SSL_STREAM_STATE_NONE; 7913 #endif 7914 } 7915 7916 int SSL_get_stream_read_error_code(SSL *s, uint64_t *app_error_code) 7917 { 7918 #ifndef OPENSSL_NO_QUIC 7919 if (!IS_QUIC(s)) 7920 return -1; 7921 7922 return ossl_quic_get_stream_read_error_code(s, app_error_code); 7923 #else 7924 return -1; 7925 #endif 7926 } 7927 7928 int SSL_get_stream_write_error_code(SSL *s, uint64_t *app_error_code) 7929 { 7930 #ifndef OPENSSL_NO_QUIC 7931 if (!IS_QUIC(s)) 7932 return -1; 7933 7934 return ossl_quic_get_stream_write_error_code(s, app_error_code); 7935 #else 7936 return -1; 7937 #endif 7938 } 7939 7940 int SSL_get_conn_close_info(SSL *s, SSL_CONN_CLOSE_INFO *info, 7941 size_t info_len) 7942 { 7943 #ifndef OPENSSL_NO_QUIC 7944 if (!IS_QUIC(s)) 7945 return -1; 7946 7947 return ossl_quic_get_conn_close_info(s, info, info_len); 7948 #else 7949 return -1; 7950 #endif 7951 } 7952 7953 int SSL_get_value_uint(SSL *s, uint32_t class_, uint32_t id, 7954 uint64_t *value) 7955 { 7956 #ifndef OPENSSL_NO_QUIC 7957 if (IS_QUIC(s)) 7958 return ossl_quic_get_value_uint(s, class_, id, value); 7959 #endif 7960 7961 ERR_raise(ERR_LIB_SSL, SSL_R_UNSUPPORTED_PROTOCOL); 7962 return 0; 7963 } 7964 7965 int SSL_set_value_uint(SSL *s, uint32_t class_, uint32_t id, 7966 uint64_t value) 7967 { 7968 #ifndef OPENSSL_NO_QUIC 7969 if (IS_QUIC(s)) 7970 return ossl_quic_set_value_uint(s, class_, id, value); 7971 #endif 7972 7973 ERR_raise(ERR_LIB_SSL, SSL_R_UNSUPPORTED_PROTOCOL); 7974 return 0; 7975 } 7976 7977 SSL *SSL_new_listener(SSL_CTX *ctx, uint64_t flags) 7978 { 7979 #ifndef OPENSSL_NO_QUIC 7980 if (!IS_QUIC_CTX(ctx)) 7981 return NULL; 7982 7983 return ossl_quic_new_listener(ctx, flags); 7984 #else 7985 return NULL; 7986 #endif 7987 } 7988 7989 SSL *SSL_new_listener_from(SSL *ssl, uint64_t flags) 7990 { 7991 #ifndef OPENSSL_NO_QUIC 7992 if (!IS_QUIC(ssl)) 7993 return NULL; 7994 7995 return ossl_quic_new_listener_from(ssl, flags); 7996 #else 7997 return NULL; 7998 #endif 7999 } 8000 8001 SSL *SSL_new_from_listener(SSL *ssl, uint64_t flags) 8002 { 8003 #ifndef OPENSSL_NO_QUIC 8004 if (!IS_QUIC(ssl)) 8005 return NULL; 8006 8007 return ossl_quic_new_from_listener(ssl, flags); 8008 #else 8009 return NULL; 8010 #endif 8011 } 8012 8013 SSL *SSL_accept_connection(SSL *ssl, uint64_t flags) 8014 { 8015 #ifndef OPENSSL_NO_QUIC 8016 if (!IS_QUIC(ssl)) 8017 return NULL; 8018 8019 return ossl_quic_accept_connection(ssl, flags); 8020 #else 8021 return NULL; 8022 #endif 8023 } 8024 8025 size_t SSL_get_accept_connection_queue_len(SSL *ssl) 8026 { 8027 #ifndef OPENSSL_NO_QUIC 8028 if (!IS_QUIC(ssl)) 8029 return 0; 8030 8031 return ossl_quic_get_accept_connection_queue_len(ssl); 8032 #else 8033 return 0; 8034 #endif 8035 } 8036 8037 int SSL_listen(SSL *ssl) 8038 { 8039 #ifndef OPENSSL_NO_QUIC 8040 if (!IS_QUIC(ssl)) 8041 return 0; 8042 8043 return ossl_quic_listen(ssl); 8044 #else 8045 return 0; 8046 #endif 8047 } 8048 8049 SSL *SSL_new_domain(SSL_CTX *ctx, uint64_t flags) 8050 { 8051 #ifndef OPENSSL_NO_QUIC 8052 if (!IS_QUIC_CTX(ctx)) 8053 return NULL; 8054 8055 return ossl_quic_new_domain(ctx, flags); 8056 #else 8057 return NULL; 8058 #endif 8059 } 8060 8061 int ossl_adjust_domain_flags(uint64_t domain_flags, uint64_t *p_domain_flags) 8062 { 8063 if ((domain_flags & ~OSSL_QUIC_SUPPORTED_DOMAIN_FLAGS) != 0) { 8064 ERR_raise_data(ERR_LIB_SSL, ERR_R_UNSUPPORTED, 8065 "unsupported domain flag requested"); 8066 return 0; 8067 } 8068 8069 if ((domain_flags & SSL_DOMAIN_FLAG_THREAD_ASSISTED) != 0) 8070 domain_flags |= SSL_DOMAIN_FLAG_MULTI_THREAD; 8071 8072 if ((domain_flags & (SSL_DOMAIN_FLAG_MULTI_THREAD | SSL_DOMAIN_FLAG_SINGLE_THREAD)) == 0) 8073 domain_flags |= SSL_DOMAIN_FLAG_MULTI_THREAD; 8074 8075 if ((domain_flags & SSL_DOMAIN_FLAG_SINGLE_THREAD) != 0 8076 && (domain_flags & SSL_DOMAIN_FLAG_MULTI_THREAD) != 0) { 8077 ERR_raise_data(ERR_LIB_SSL, ERR_R_PASSED_INVALID_ARGUMENT, 8078 "mutually exclusive domain flags specified"); 8079 return 0; 8080 } 8081 8082 /* 8083 * Note: We treat MULTI_THREAD as a no-op in non-threaded builds, but 8084 * not THREAD_ASSISTED. 8085 */ 8086 #ifndef OPENSSL_THREADS 8087 if ((domain_flags & SSL_DOMAIN_FLAG_THREAD_ASSISTED) != 0) { 8088 ERR_raise_data(ERR_LIB_SSL, ERR_R_UNSUPPORTED, 8089 "thread assisted mode not available in this build"); 8090 return 0; 8091 } 8092 #endif 8093 8094 *p_domain_flags = domain_flags; 8095 return 1; 8096 } 8097 8098 int SSL_CTX_set_domain_flags(SSL_CTX *ctx, uint64_t domain_flags) 8099 { 8100 #ifndef OPENSSL_NO_QUIC 8101 if (IS_QUIC_CTX(ctx)) { 8102 if (!ossl_adjust_domain_flags(domain_flags, &domain_flags)) 8103 return 0; 8104 8105 ctx->domain_flags = domain_flags; 8106 return 1; 8107 } 8108 #endif 8109 8110 ERR_raise_data(ERR_LIB_SSL, ERR_R_UNSUPPORTED, 8111 "domain flags unsupported on this kind of SSL_CTX"); 8112 return 0; 8113 } 8114 8115 int SSL_CTX_get_domain_flags(const SSL_CTX *ctx, uint64_t *domain_flags) 8116 { 8117 #ifndef OPENSSL_NO_QUIC 8118 if (IS_QUIC_CTX(ctx)) { 8119 if (domain_flags != NULL) 8120 *domain_flags = ctx->domain_flags; 8121 8122 return 1; 8123 } 8124 #endif 8125 8126 ERR_raise_data(ERR_LIB_SSL, ERR_R_UNSUPPORTED, 8127 "domain flags unsupported on this kind of SSL_CTX"); 8128 return 0; 8129 } 8130 8131 int SSL_get_domain_flags(const SSL *ssl, uint64_t *domain_flags) 8132 { 8133 #ifndef OPENSSL_NO_QUIC 8134 if (IS_QUIC(ssl)) 8135 return ossl_quic_get_domain_flags(ssl, domain_flags); 8136 #endif 8137 8138 return 0; 8139 } 8140 8141 int SSL_add_expected_rpk(SSL *s, EVP_PKEY *rpk) 8142 { 8143 unsigned char *data = NULL; 8144 SSL_DANE *dane = SSL_get0_dane(s); 8145 int ret; 8146 8147 if (dane == NULL || dane->dctx == NULL) 8148 return 0; 8149 if ((ret = i2d_PUBKEY(rpk, &data)) <= 0) 8150 return 0; 8151 8152 ret = SSL_dane_tlsa_add(s, DANETLS_USAGE_DANE_EE, 8153 DANETLS_SELECTOR_SPKI, 8154 DANETLS_MATCHING_FULL, 8155 data, (size_t)ret) 8156 > 0; 8157 OPENSSL_free(data); 8158 return ret; 8159 } 8160 8161 EVP_PKEY *SSL_get0_peer_rpk(const SSL *s) 8162 { 8163 SSL_CONNECTION *sc = SSL_CONNECTION_FROM_SSL(s); 8164 8165 if (sc == NULL || sc->session == NULL) 8166 return NULL; 8167 return sc->session->peer_rpk; 8168 } 8169 8170 int SSL_get_negotiated_client_cert_type(const SSL *s) 8171 { 8172 SSL_CONNECTION *sc = SSL_CONNECTION_FROM_SSL(s); 8173 8174 if (sc == NULL) 8175 return 0; 8176 8177 return sc->ext.client_cert_type; 8178 } 8179 8180 int SSL_get_negotiated_server_cert_type(const SSL *s) 8181 { 8182 SSL_CONNECTION *sc = SSL_CONNECTION_FROM_SSL(s); 8183 8184 if (sc == NULL) 8185 return 0; 8186 8187 return sc->ext.server_cert_type; 8188 } 8189 8190 static int validate_cert_type(const unsigned char *val, size_t len) 8191 { 8192 size_t i; 8193 int saw_rpk = 0; 8194 int saw_x509 = 0; 8195 8196 if (val == NULL && len == 0) 8197 return 1; 8198 8199 if (val == NULL || len == 0) 8200 return 0; 8201 8202 for (i = 0; i < len; i++) { 8203 switch (val[i]) { 8204 case TLSEXT_cert_type_rpk: 8205 if (saw_rpk) 8206 return 0; 8207 saw_rpk = 1; 8208 break; 8209 case TLSEXT_cert_type_x509: 8210 if (saw_x509) 8211 return 0; 8212 saw_x509 = 1; 8213 break; 8214 case TLSEXT_cert_type_pgp: 8215 case TLSEXT_cert_type_1609dot2: 8216 default: 8217 return 0; 8218 } 8219 } 8220 return 1; 8221 } 8222 8223 static int set_cert_type(unsigned char **cert_type, 8224 size_t *cert_type_len, 8225 const unsigned char *val, 8226 size_t len) 8227 { 8228 unsigned char *tmp = NULL; 8229 8230 if (!validate_cert_type(val, len)) 8231 return 0; 8232 8233 if (val != NULL && (tmp = OPENSSL_memdup(val, len)) == NULL) 8234 return 0; 8235 8236 OPENSSL_free(*cert_type); 8237 *cert_type = tmp; 8238 *cert_type_len = len; 8239 return 1; 8240 } 8241 8242 int SSL_set1_client_cert_type(SSL *s, const unsigned char *val, size_t len) 8243 { 8244 SSL_CONNECTION *sc = SSL_CONNECTION_FROM_SSL(s); 8245 8246 if (sc == NULL) 8247 return 0; 8248 8249 return set_cert_type(&sc->client_cert_type, &sc->client_cert_type_len, 8250 val, len); 8251 } 8252 8253 int SSL_set1_server_cert_type(SSL *s, const unsigned char *val, size_t len) 8254 { 8255 SSL_CONNECTION *sc = SSL_CONNECTION_FROM_SSL(s); 8256 8257 if (sc == NULL) 8258 return 0; 8259 8260 return set_cert_type(&sc->server_cert_type, &sc->server_cert_type_len, 8261 val, len); 8262 } 8263 8264 int SSL_CTX_set1_client_cert_type(SSL_CTX *ctx, const unsigned char *val, size_t len) 8265 { 8266 return set_cert_type(&ctx->client_cert_type, &ctx->client_cert_type_len, 8267 val, len); 8268 } 8269 8270 int SSL_CTX_set1_server_cert_type(SSL_CTX *ctx, const unsigned char *val, size_t len) 8271 { 8272 return set_cert_type(&ctx->server_cert_type, &ctx->server_cert_type_len, 8273 val, len); 8274 } 8275 8276 int SSL_get0_client_cert_type(const SSL *s, unsigned char **t, size_t *len) 8277 { 8278 const SSL_CONNECTION *sc = SSL_CONNECTION_FROM_CONST_SSL(s); 8279 8280 if (t == NULL || len == NULL || sc == NULL) 8281 return 0; 8282 8283 *t = sc->client_cert_type; 8284 *len = sc->client_cert_type_len; 8285 return 1; 8286 } 8287 8288 int SSL_get0_server_cert_type(const SSL *s, unsigned char **t, size_t *len) 8289 { 8290 const SSL_CONNECTION *sc = SSL_CONNECTION_FROM_CONST_SSL(s); 8291 8292 if (t == NULL || len == NULL || sc == NULL) 8293 return 0; 8294 8295 *t = sc->server_cert_type; 8296 *len = sc->server_cert_type_len; 8297 return 1; 8298 } 8299 8300 int SSL_CTX_get0_client_cert_type(const SSL_CTX *ctx, unsigned char **t, size_t *len) 8301 { 8302 if (t == NULL || len == NULL) 8303 return 0; 8304 8305 *t = ctx->client_cert_type; 8306 *len = ctx->client_cert_type_len; 8307 return 1; 8308 } 8309 8310 int SSL_CTX_get0_server_cert_type(const SSL_CTX *ctx, unsigned char **t, size_t *len) 8311 { 8312 if (t == NULL || len == NULL) 8313 return 0; 8314 8315 *t = ctx->server_cert_type; 8316 *len = ctx->server_cert_type_len; 8317 return 1; 8318 } 8319
Indexes created Wed Jun 17 00:25:26 UTC 2026