| 1 | /*
|
|---|
| 2 | * Copyright 2015-2021 The OpenSSL Project Authors. All Rights Reserved.
|
|---|
| 3 | *
|
|---|
| 4 | * Licensed under the OpenSSL license (the "License"). You may not use
|
|---|
| 5 | * this file except in compliance with the License. You can obtain a copy
|
|---|
| 6 | * in the file LICENSE in the source distribution or at
|
|---|
| 7 | * https://www.openssl.org/source/license.html
|
|---|
| 8 | */
|
|---|
| 9 |
|
|---|
| 10 | /*****************************************************************************
|
|---|
| 11 | * *
|
|---|
| 12 | * The following definitions are PRIVATE to the state machine. They should *
|
|---|
| 13 | * NOT be used outside of the state machine. *
|
|---|
| 14 | * *
|
|---|
| 15 | *****************************************************************************/
|
|---|
| 16 |
|
|---|
| 17 | /* Max message length definitions */
|
|---|
| 18 |
|
|---|
| 19 | /* The spec allows for a longer length than this, but we limit it */
|
|---|
| 20 | #define HELLO_VERIFY_REQUEST_MAX_LENGTH 258
|
|---|
| 21 | #define END_OF_EARLY_DATA_MAX_LENGTH 0
|
|---|
| 22 | #define SERVER_HELLO_MAX_LENGTH 20000
|
|---|
| 23 | #define HELLO_RETRY_REQUEST_MAX_LENGTH 20000
|
|---|
| 24 | #define ENCRYPTED_EXTENSIONS_MAX_LENGTH 20000
|
|---|
| 25 | #define SESSION_TICKET_MAX_LENGTH_TLS13 131338
|
|---|
| 26 | #define SESSION_TICKET_MAX_LENGTH_TLS12 65541
|
|---|
| 27 | #define SERVER_KEY_EXCH_MAX_LENGTH 102400
|
|---|
| 28 | #define SERVER_HELLO_DONE_MAX_LENGTH 0
|
|---|
| 29 | #define KEY_UPDATE_MAX_LENGTH 1
|
|---|
| 30 | #define CCS_MAX_LENGTH 1
|
|---|
| 31 | /* Max should actually be 36 but we are generous */
|
|---|
| 32 | #define FINISHED_MAX_LENGTH 64
|
|---|
| 33 |
|
|---|
| 34 | /* Dummy message type */
|
|---|
| 35 | #define SSL3_MT_DUMMY -1
|
|---|
| 36 |
|
|---|
| 37 | extern const unsigned char hrrrandom[];
|
|---|
| 38 |
|
|---|
| 39 | /* Message processing return codes */
|
|---|
| 40 | typedef enum {
|
|---|
| 41 | /* Something bad happened */
|
|---|
| 42 | MSG_PROCESS_ERROR,
|
|---|
| 43 | /* We've finished reading - swap to writing */
|
|---|
| 44 | MSG_PROCESS_FINISHED_READING,
|
|---|
| 45 | /*
|
|---|
| 46 | * We've completed the main processing of this message but there is some
|
|---|
| 47 | * post processing to be done.
|
|---|
| 48 | */
|
|---|
| 49 | MSG_PROCESS_CONTINUE_PROCESSING,
|
|---|
| 50 | /* We've finished this message - read the next message */
|
|---|
| 51 | MSG_PROCESS_CONTINUE_READING
|
|---|
| 52 | } MSG_PROCESS_RETURN;
|
|---|
| 53 |
|
|---|
| 54 | typedef int (*confunc_f) (SSL *s, WPACKET *pkt);
|
|---|
| 55 |
|
|---|
| 56 | int ssl3_take_mac(SSL *s);
|
|---|
| 57 | int check_in_list(SSL *s, uint16_t group_id, const uint16_t *groups,
|
|---|
| 58 | size_t num_groups, int checkallow);
|
|---|
| 59 | int create_synthetic_message_hash(SSL *s, const unsigned char *hashval,
|
|---|
| 60 | size_t hashlen, const unsigned char *hrr,
|
|---|
| 61 | size_t hrrlen);
|
|---|
| 62 | int parse_ca_names(SSL *s, PACKET *pkt);
|
|---|
| 63 | const STACK_OF(X509_NAME) *get_ca_names(SSL *s);
|
|---|
| 64 | int construct_ca_names(SSL *s, const STACK_OF(X509_NAME) *ca_sk, WPACKET *pkt);
|
|---|
| 65 | size_t construct_key_exchange_tbs(SSL *s, unsigned char **ptbs,
|
|---|
| 66 | const void *param, size_t paramlen);
|
|---|
| 67 |
|
|---|
| 68 | /*
|
|---|
| 69 | * TLS/DTLS client state machine functions
|
|---|
| 70 | */
|
|---|
| 71 | int ossl_statem_client_read_transition(SSL *s, int mt);
|
|---|
| 72 | WRITE_TRAN ossl_statem_client_write_transition(SSL *s);
|
|---|
| 73 | WORK_STATE ossl_statem_client_pre_work(SSL *s, WORK_STATE wst);
|
|---|
| 74 | WORK_STATE ossl_statem_client_post_work(SSL *s, WORK_STATE wst);
|
|---|
| 75 | int ossl_statem_client_construct_message(SSL *s, WPACKET *pkt,
|
|---|
| 76 | confunc_f *confunc, int *mt);
|
|---|
| 77 | size_t ossl_statem_client_max_message_size(SSL *s);
|
|---|
| 78 | MSG_PROCESS_RETURN ossl_statem_client_process_message(SSL *s, PACKET *pkt);
|
|---|
| 79 | WORK_STATE ossl_statem_client_post_process_message(SSL *s, WORK_STATE wst);
|
|---|
| 80 |
|
|---|
| 81 | /*
|
|---|
| 82 | * TLS/DTLS server state machine functions
|
|---|
| 83 | */
|
|---|
| 84 | int ossl_statem_server_read_transition(SSL *s, int mt);
|
|---|
| 85 | WRITE_TRAN ossl_statem_server_write_transition(SSL *s);
|
|---|
| 86 | WORK_STATE ossl_statem_server_pre_work(SSL *s, WORK_STATE wst);
|
|---|
| 87 | WORK_STATE ossl_statem_server_post_work(SSL *s, WORK_STATE wst);
|
|---|
| 88 | int ossl_statem_server_construct_message(SSL *s, WPACKET *pkt,
|
|---|
| 89 | confunc_f *confunc,int *mt);
|
|---|
| 90 | size_t ossl_statem_server_max_message_size(SSL *s);
|
|---|
| 91 | MSG_PROCESS_RETURN ossl_statem_server_process_message(SSL *s, PACKET *pkt);
|
|---|
| 92 | WORK_STATE ossl_statem_server_post_process_message(SSL *s, WORK_STATE wst);
|
|---|
| 93 |
|
|---|
| 94 | /* Functions for getting new message data */
|
|---|
| 95 | __owur int tls_get_message_header(SSL *s, int *mt);
|
|---|
| 96 | __owur int tls_get_message_body(SSL *s, size_t *len);
|
|---|
| 97 | __owur int dtls_get_message(SSL *s, int *mt, size_t *len);
|
|---|
| 98 |
|
|---|
| 99 | /* Message construction and processing functions */
|
|---|
| 100 | __owur int tls_process_initial_server_flight(SSL *s);
|
|---|
| 101 | __owur MSG_PROCESS_RETURN tls_process_change_cipher_spec(SSL *s, PACKET *pkt);
|
|---|
| 102 | __owur MSG_PROCESS_RETURN tls_process_finished(SSL *s, PACKET *pkt);
|
|---|
| 103 | __owur int tls_construct_change_cipher_spec(SSL *s, WPACKET *pkt);
|
|---|
| 104 | __owur int dtls_construct_change_cipher_spec(SSL *s, WPACKET *pkt);
|
|---|
| 105 |
|
|---|
| 106 | __owur int tls_construct_finished(SSL *s, WPACKET *pkt);
|
|---|
| 107 | __owur int tls_construct_key_update(SSL *s, WPACKET *pkt);
|
|---|
| 108 | __owur MSG_PROCESS_RETURN tls_process_key_update(SSL *s, PACKET *pkt);
|
|---|
| 109 | __owur WORK_STATE tls_finish_handshake(SSL *s, WORK_STATE wst, int clearbufs,
|
|---|
| 110 | int stop);
|
|---|
| 111 | __owur WORK_STATE dtls_wait_for_dry(SSL *s);
|
|---|
| 112 |
|
|---|
| 113 | /* some client-only functions */
|
|---|
| 114 | __owur int tls_construct_client_hello(SSL *s, WPACKET *pkt);
|
|---|
| 115 | __owur MSG_PROCESS_RETURN tls_process_server_hello(SSL *s, PACKET *pkt);
|
|---|
| 116 | __owur MSG_PROCESS_RETURN tls_process_certificate_request(SSL *s, PACKET *pkt);
|
|---|
| 117 | __owur MSG_PROCESS_RETURN tls_process_new_session_ticket(SSL *s, PACKET *pkt);
|
|---|
| 118 | __owur int tls_process_cert_status_body(SSL *s, PACKET *pkt);
|
|---|
| 119 | __owur MSG_PROCESS_RETURN tls_process_cert_status(SSL *s, PACKET *pkt);
|
|---|
| 120 | __owur MSG_PROCESS_RETURN tls_process_server_done(SSL *s, PACKET *pkt);
|
|---|
| 121 | __owur int tls_construct_cert_verify(SSL *s, WPACKET *pkt);
|
|---|
| 122 | __owur WORK_STATE tls_prepare_client_certificate(SSL *s, WORK_STATE wst);
|
|---|
| 123 | __owur int tls_construct_client_certificate(SSL *s, WPACKET *pkt);
|
|---|
| 124 | __owur int ssl_do_client_cert_cb(SSL *s, X509 **px509, EVP_PKEY **ppkey);
|
|---|
| 125 | __owur int tls_construct_client_key_exchange(SSL *s, WPACKET *pkt);
|
|---|
| 126 | __owur int tls_client_key_exchange_post_work(SSL *s);
|
|---|
| 127 | __owur int tls_construct_cert_status_body(SSL *s, WPACKET *pkt);
|
|---|
| 128 | __owur int tls_construct_cert_status(SSL *s, WPACKET *pkt);
|
|---|
| 129 | __owur MSG_PROCESS_RETURN tls_process_key_exchange(SSL *s, PACKET *pkt);
|
|---|
| 130 | __owur MSG_PROCESS_RETURN tls_process_server_certificate(SSL *s, PACKET *pkt);
|
|---|
| 131 | __owur int ssl3_check_cert_and_algorithm(SSL *s);
|
|---|
| 132 | #ifndef OPENSSL_NO_NEXTPROTONEG
|
|---|
| 133 | __owur int tls_construct_next_proto(SSL *s, WPACKET *pkt);
|
|---|
| 134 | #endif
|
|---|
| 135 | __owur MSG_PROCESS_RETURN tls_process_hello_req(SSL *s, PACKET *pkt);
|
|---|
| 136 | __owur MSG_PROCESS_RETURN dtls_process_hello_verify(SSL *s, PACKET *pkt);
|
|---|
| 137 | __owur int tls_construct_end_of_early_data(SSL *s, WPACKET *pkt);
|
|---|
| 138 |
|
|---|
| 139 | /* some server-only functions */
|
|---|
| 140 | __owur MSG_PROCESS_RETURN tls_process_client_hello(SSL *s, PACKET *pkt);
|
|---|
| 141 | __owur WORK_STATE tls_post_process_client_hello(SSL *s, WORK_STATE wst);
|
|---|
| 142 | __owur int tls_construct_server_hello(SSL *s, WPACKET *pkt);
|
|---|
| 143 | __owur int dtls_construct_hello_verify_request(SSL *s, WPACKET *pkt);
|
|---|
| 144 | __owur int tls_construct_server_certificate(SSL *s, WPACKET *pkt);
|
|---|
| 145 | __owur int tls_construct_server_key_exchange(SSL *s, WPACKET *pkt);
|
|---|
| 146 | __owur int tls_construct_certificate_request(SSL *s, WPACKET *pkt);
|
|---|
| 147 | __owur int tls_construct_server_done(SSL *s, WPACKET *pkt);
|
|---|
| 148 | __owur MSG_PROCESS_RETURN tls_process_client_certificate(SSL *s, PACKET *pkt);
|
|---|
| 149 | __owur MSG_PROCESS_RETURN tls_process_client_key_exchange(SSL *s, PACKET *pkt);
|
|---|
| 150 | __owur WORK_STATE tls_post_process_client_key_exchange(SSL *s, WORK_STATE wst);
|
|---|
| 151 | __owur MSG_PROCESS_RETURN tls_process_cert_verify(SSL *s, PACKET *pkt);
|
|---|
| 152 | #ifndef OPENSSL_NO_NEXTPROTONEG
|
|---|
| 153 | __owur MSG_PROCESS_RETURN tls_process_next_proto(SSL *s, PACKET *pkt);
|
|---|
| 154 | #endif
|
|---|
| 155 | __owur int tls_construct_new_session_ticket(SSL *s, WPACKET *pkt);
|
|---|
| 156 | MSG_PROCESS_RETURN tls_process_end_of_early_data(SSL *s, PACKET *pkt);
|
|---|
| 157 |
|
|---|
| 158 |
|
|---|
| 159 | /* Extension processing */
|
|---|
| 160 |
|
|---|
| 161 | typedef enum ext_return_en {
|
|---|
| 162 | EXT_RETURN_FAIL,
|
|---|
| 163 | EXT_RETURN_SENT,
|
|---|
| 164 | EXT_RETURN_NOT_SENT
|
|---|
| 165 | } EXT_RETURN;
|
|---|
| 166 |
|
|---|
| 167 | __owur int tls_validate_all_contexts(SSL *s, unsigned int thisctx,
|
|---|
| 168 | RAW_EXTENSION *exts);
|
|---|
| 169 | __owur int extension_is_relevant(SSL *s, unsigned int extctx,
|
|---|
| 170 | unsigned int thisctx);
|
|---|
| 171 | __owur int tls_collect_extensions(SSL *s, PACKET *packet, unsigned int context,
|
|---|
| 172 | RAW_EXTENSION **res, size_t *len, int init);
|
|---|
| 173 | __owur int tls_parse_extension(SSL *s, TLSEXT_INDEX idx, int context,
|
|---|
| 174 | RAW_EXTENSION *exts, X509 *x, size_t chainidx);
|
|---|
| 175 | __owur int tls_parse_all_extensions(SSL *s, int context, RAW_EXTENSION *exts,
|
|---|
| 176 | X509 *x, size_t chainidx, int fin);
|
|---|
| 177 | __owur int should_add_extension(SSL *s, unsigned int extctx,
|
|---|
| 178 | unsigned int thisctx, int max_version);
|
|---|
| 179 | __owur int tls_construct_extensions(SSL *s, WPACKET *pkt, unsigned int context,
|
|---|
| 180 | X509 *x, size_t chainidx);
|
|---|
| 181 |
|
|---|
| 182 | __owur int tls_psk_do_binder(SSL *s, const EVP_MD *md,
|
|---|
| 183 | const unsigned char *msgstart,
|
|---|
| 184 | size_t binderoffset, const unsigned char *binderin,
|
|---|
| 185 | unsigned char *binderout,
|
|---|
| 186 | SSL_SESSION *sess, int sign, int external);
|
|---|
| 187 |
|
|---|
| 188 | /* Server Extension processing */
|
|---|
| 189 | int tls_parse_ctos_renegotiate(SSL *s, PACKET *pkt, unsigned int context,
|
|---|
| 190 | X509 *x, size_t chainidx);
|
|---|
| 191 | int tls_parse_ctos_server_name(SSL *s, PACKET *pkt, unsigned int context,
|
|---|
| 192 | X509 *x, size_t chainidx);
|
|---|
| 193 | int tls_parse_ctos_maxfragmentlen(SSL *s, PACKET *pkt, unsigned int context,
|
|---|
| 194 | X509 *x, size_t chainidx);
|
|---|
| 195 | #ifndef OPENSSL_NO_SRP
|
|---|
| 196 | int tls_parse_ctos_srp(SSL *s, PACKET *pkt, unsigned int context, X509 *x,
|
|---|
| 197 | size_t chainidx);
|
|---|
| 198 | #endif
|
|---|
| 199 | int tls_parse_ctos_early_data(SSL *s, PACKET *pkt, unsigned int context,
|
|---|
| 200 | X509 *x, size_t chainidx);
|
|---|
| 201 | #ifndef OPENSSL_NO_EC
|
|---|
| 202 | int tls_parse_ctos_ec_pt_formats(SSL *s, PACKET *pkt, unsigned int context,
|
|---|
| 203 | X509 *x, size_t chainidx);
|
|---|
| 204 | int tls_parse_ctos_supported_groups(SSL *s, PACKET *pkt, unsigned int context,
|
|---|
| 205 | X509 *x, size_t chainidxl);
|
|---|
| 206 | #endif
|
|---|
| 207 | int tls_parse_ctos_session_ticket(SSL *s, PACKET *pkt, unsigned int context,
|
|---|
| 208 | X509 *x, size_t chainidx);
|
|---|
| 209 | int tls_parse_ctos_sig_algs_cert(SSL *s, PACKET *pkt, unsigned int context,
|
|---|
| 210 | X509 *x, size_t chainidx);
|
|---|
| 211 | int tls_parse_ctos_sig_algs(SSL *s, PACKET *pkt, unsigned int context, X509 *x,
|
|---|
| 212 | size_t chainidx);
|
|---|
| 213 | #ifndef OPENSSL_NO_OCSP
|
|---|
| 214 | int tls_parse_ctos_status_request(SSL *s, PACKET *pkt, unsigned int context,
|
|---|
| 215 | X509 *x, size_t chainidx);
|
|---|
| 216 | #endif
|
|---|
| 217 | #ifndef OPENSSL_NO_NEXTPROTONEG
|
|---|
| 218 | int tls_parse_ctos_npn(SSL *s, PACKET *pkt, unsigned int context, X509 *x,
|
|---|
| 219 | size_t chainidx);
|
|---|
| 220 | #endif
|
|---|
| 221 | int tls_parse_ctos_alpn(SSL *s, PACKET *pkt, unsigned int context, X509 *x,
|
|---|
| 222 | size_t chainidx);
|
|---|
| 223 | #ifndef OPENSSL_NO_SRTP
|
|---|
| 224 | int tls_parse_ctos_use_srtp(SSL *s, PACKET *pkt, unsigned int context, X509 *x,
|
|---|
| 225 | size_t chainidx);
|
|---|
| 226 | #endif
|
|---|
| 227 | int tls_parse_ctos_etm(SSL *s, PACKET *pkt, unsigned int context, X509 *x,
|
|---|
| 228 | size_t chainidx);
|
|---|
| 229 | int tls_parse_ctos_key_share(SSL *s, PACKET *pkt, unsigned int context, X509 *x,
|
|---|
| 230 | size_t chainidx);
|
|---|
| 231 | int tls_parse_ctos_cookie(SSL *s, PACKET *pkt, unsigned int context, X509 *x,
|
|---|
| 232 | size_t chainidx);
|
|---|
| 233 | int tls_parse_ctos_ems(SSL *s, PACKET *pkt, unsigned int context, X509 *x,
|
|---|
| 234 | size_t chainidx);
|
|---|
| 235 | int tls_parse_ctos_psk_kex_modes(SSL *s, PACKET *pkt, unsigned int context,
|
|---|
| 236 | X509 *x, size_t chainidx);
|
|---|
| 237 | int tls_parse_ctos_psk(SSL *s, PACKET *pkt, unsigned int context, X509 *x,
|
|---|
| 238 | size_t chainidx);
|
|---|
| 239 | int tls_parse_ctos_post_handshake_auth(SSL *, PACKET *pkt, unsigned int context,
|
|---|
| 240 | X509 *x, size_t chainidx);
|
|---|
| 241 |
|
|---|
| 242 | EXT_RETURN tls_construct_stoc_renegotiate(SSL *s, WPACKET *pkt,
|
|---|
| 243 | unsigned int context, X509 *x,
|
|---|
| 244 | size_t chainidx);
|
|---|
| 245 | EXT_RETURN tls_construct_stoc_server_name(SSL *s, WPACKET *pkt,
|
|---|
| 246 | unsigned int context, X509 *x,
|
|---|
| 247 | size_t chainidx);
|
|---|
| 248 | EXT_RETURN tls_construct_stoc_early_data(SSL *s, WPACKET *pkt,
|
|---|
| 249 | unsigned int context, X509 *x,
|
|---|
| 250 | size_t chainidx);
|
|---|
| 251 | EXT_RETURN tls_construct_stoc_maxfragmentlen(SSL *s, WPACKET *pkt,
|
|---|
| 252 | unsigned int context, X509 *x,
|
|---|
| 253 | size_t chainidx);
|
|---|
| 254 | #ifndef OPENSSL_NO_EC
|
|---|
| 255 | EXT_RETURN tls_construct_stoc_ec_pt_formats(SSL *s, WPACKET *pkt,
|
|---|
| 256 | unsigned int context, X509 *x,
|
|---|
| 257 | size_t chainidx);
|
|---|
| 258 | #endif
|
|---|
| 259 | EXT_RETURN tls_construct_stoc_supported_groups(SSL *s, WPACKET *pkt,
|
|---|
| 260 | unsigned int context, X509 *x,
|
|---|
| 261 | size_t chainidx);
|
|---|
| 262 | EXT_RETURN tls_construct_stoc_session_ticket(SSL *s, WPACKET *pkt,
|
|---|
| 263 | unsigned int context, X509 *x,
|
|---|
| 264 | size_t chainidx);
|
|---|
| 265 | #ifndef OPENSSL_NO_OCSP
|
|---|
| 266 | EXT_RETURN tls_construct_stoc_status_request(SSL *s, WPACKET *pkt,
|
|---|
| 267 | unsigned int context, X509 *x,
|
|---|
| 268 | size_t chainidx);
|
|---|
| 269 | #endif
|
|---|
| 270 | #ifndef OPENSSL_NO_NEXTPROTONEG
|
|---|
| 271 | EXT_RETURN tls_construct_stoc_next_proto_neg(SSL *s, WPACKET *pkt,
|
|---|
| 272 | unsigned int context, X509 *x,
|
|---|
| 273 | size_t chainidx);
|
|---|
| 274 | #endif
|
|---|
| 275 | EXT_RETURN tls_construct_stoc_alpn(SSL *s, WPACKET *pkt, unsigned int context,
|
|---|
| 276 | X509 *x, size_t chainidx);
|
|---|
| 277 | #ifndef OPENSSL_NO_SRTP
|
|---|
| 278 | EXT_RETURN tls_construct_stoc_use_srtp(SSL *s, WPACKET *pkt, unsigned int context,
|
|---|
| 279 | X509 *x, size_t chainidx);
|
|---|
| 280 | #endif
|
|---|
| 281 | EXT_RETURN tls_construct_stoc_etm(SSL *s, WPACKET *pkt, unsigned int context,
|
|---|
| 282 | X509 *x, size_t chainidx);
|
|---|
| 283 | EXT_RETURN tls_construct_stoc_ems(SSL *s, WPACKET *pkt, unsigned int context,
|
|---|
| 284 | X509 *x, size_t chainidx);
|
|---|
| 285 | EXT_RETURN tls_construct_stoc_supported_versions(SSL *s, WPACKET *pkt,
|
|---|
| 286 | unsigned int context, X509 *x,
|
|---|
| 287 | size_t chainidx);
|
|---|
| 288 | EXT_RETURN tls_construct_stoc_key_share(SSL *s, WPACKET *pkt,
|
|---|
| 289 | unsigned int context, X509 *x,
|
|---|
| 290 | size_t chainidx);
|
|---|
| 291 | EXT_RETURN tls_construct_stoc_cookie(SSL *s, WPACKET *pkt, unsigned int context,
|
|---|
| 292 | X509 *x, size_t chainidx);
|
|---|
| 293 | /*
|
|---|
| 294 | * Not in public headers as this is not an official extension. Only used when
|
|---|
| 295 | * SSL_OP_CRYPTOPRO_TLSEXT_BUG is set.
|
|---|
| 296 | */
|
|---|
| 297 | #define TLSEXT_TYPE_cryptopro_bug 0xfde8
|
|---|
| 298 | EXT_RETURN tls_construct_stoc_cryptopro_bug(SSL *s, WPACKET *pkt,
|
|---|
| 299 | unsigned int context, X509 *x,
|
|---|
| 300 | size_t chainidx);
|
|---|
| 301 | EXT_RETURN tls_construct_stoc_psk(SSL *s, WPACKET *pkt, unsigned int context,
|
|---|
| 302 | X509 *x, size_t chainidx);
|
|---|
| 303 |
|
|---|
| 304 | /* Client Extension processing */
|
|---|
| 305 | EXT_RETURN tls_construct_ctos_renegotiate(SSL *s, WPACKET *pkt, unsigned int context,
|
|---|
| 306 | X509 *x, size_t chainidx);
|
|---|
| 307 | EXT_RETURN tls_construct_ctos_server_name(SSL *s, WPACKET *pkt, unsigned int context,
|
|---|
| 308 | X509 *x, size_t chainidx);
|
|---|
| 309 | EXT_RETURN tls_construct_ctos_maxfragmentlen(SSL *s, WPACKET *pkt, unsigned int context,
|
|---|
| 310 | X509 *x, size_t chainidx);
|
|---|
| 311 | #ifndef OPENSSL_NO_SRP
|
|---|
| 312 | EXT_RETURN tls_construct_ctos_srp(SSL *s, WPACKET *pkt, unsigned int context, X509 *x,
|
|---|
| 313 | size_t chainidx);
|
|---|
| 314 | #endif
|
|---|
| 315 | #ifndef OPENSSL_NO_EC
|
|---|
| 316 | EXT_RETURN tls_construct_ctos_ec_pt_formats(SSL *s, WPACKET *pkt,
|
|---|
| 317 | unsigned int context, X509 *x,
|
|---|
| 318 | size_t chainidx);
|
|---|
| 319 | EXT_RETURN tls_construct_ctos_supported_groups(SSL *s, WPACKET *pkt,
|
|---|
| 320 | unsigned int context, X509 *x,
|
|---|
| 321 | size_t chainidx);
|
|---|
| 322 | #endif
|
|---|
| 323 | EXT_RETURN tls_construct_ctos_early_data(SSL *s, WPACKET *pkt,
|
|---|
| 324 | unsigned int context, X509 *x,
|
|---|
| 325 | size_t chainidx);
|
|---|
| 326 | EXT_RETURN tls_construct_ctos_session_ticket(SSL *s, WPACKET *pkt,
|
|---|
| 327 | unsigned int context, X509 *x,
|
|---|
| 328 | size_t chainidx);
|
|---|
| 329 | EXT_RETURN tls_construct_ctos_sig_algs(SSL *s, WPACKET *pkt,
|
|---|
| 330 | unsigned int context, X509 *x,
|
|---|
| 331 | size_t chainidx);
|
|---|
| 332 | #ifndef OPENSSL_NO_OCSP
|
|---|
| 333 | EXT_RETURN tls_construct_ctos_status_request(SSL *s, WPACKET *pkt,
|
|---|
| 334 | unsigned int context, X509 *x,
|
|---|
| 335 | size_t chainidx);
|
|---|
| 336 | #endif
|
|---|
| 337 | #ifndef OPENSSL_NO_NEXTPROTONEG
|
|---|
| 338 | EXT_RETURN tls_construct_ctos_npn(SSL *s, WPACKET *pkt, unsigned int context,
|
|---|
| 339 | X509 *x, size_t chainidx);
|
|---|
| 340 | #endif
|
|---|
| 341 | EXT_RETURN tls_construct_ctos_alpn(SSL *s, WPACKET *pkt, unsigned int context,
|
|---|
| 342 | X509 *x, size_t chainidx);
|
|---|
| 343 | #ifndef OPENSSL_NO_SRTP
|
|---|
| 344 | EXT_RETURN tls_construct_ctos_use_srtp(SSL *s, WPACKET *pkt, unsigned int context,
|
|---|
| 345 | X509 *x, size_t chainidx);
|
|---|
| 346 | #endif
|
|---|
| 347 | EXT_RETURN tls_construct_ctos_etm(SSL *s, WPACKET *pkt, unsigned int context,
|
|---|
| 348 | X509 *x, size_t chainidx);
|
|---|
| 349 | #ifndef OPENSSL_NO_CT
|
|---|
| 350 | EXT_RETURN tls_construct_ctos_sct(SSL *s, WPACKET *pkt, unsigned int context,
|
|---|
| 351 | X509 *x, size_t chainidx);
|
|---|
| 352 | #endif
|
|---|
| 353 | EXT_RETURN tls_construct_ctos_ems(SSL *s, WPACKET *pkt, unsigned int context,
|
|---|
| 354 | X509 *x, size_t chainidx);
|
|---|
| 355 | EXT_RETURN tls_construct_ctos_supported_versions(SSL *s, WPACKET *pkt,
|
|---|
| 356 | unsigned int context, X509 *x,
|
|---|
| 357 | size_t chainidx);
|
|---|
| 358 | EXT_RETURN tls_construct_ctos_key_share(SSL *s, WPACKET *pkt,
|
|---|
| 359 | unsigned int context, X509 *x,
|
|---|
| 360 | size_t chainidx);
|
|---|
| 361 | EXT_RETURN tls_construct_ctos_psk_kex_modes(SSL *s, WPACKET *pkt,
|
|---|
| 362 | unsigned int context, X509 *x,
|
|---|
| 363 | size_t chainidx);
|
|---|
| 364 | EXT_RETURN tls_construct_ctos_cookie(SSL *s, WPACKET *pkt, unsigned int context,
|
|---|
| 365 | X509 *x, size_t chainidx);
|
|---|
| 366 | EXT_RETURN tls_construct_ctos_padding(SSL *s, WPACKET *pkt,
|
|---|
| 367 | unsigned int context, X509 *x,
|
|---|
| 368 | size_t chainidx);
|
|---|
| 369 | EXT_RETURN tls_construct_ctos_psk(SSL *s, WPACKET *pkt, unsigned int context,
|
|---|
| 370 | X509 *x, size_t chainidx);
|
|---|
| 371 | EXT_RETURN tls_construct_ctos_post_handshake_auth(SSL *s, WPACKET *pkt, unsigned int context,
|
|---|
| 372 | X509 *x, size_t chainidx);
|
|---|
| 373 |
|
|---|
| 374 | int tls_parse_stoc_renegotiate(SSL *s, PACKET *pkt, unsigned int context,
|
|---|
| 375 | X509 *x, size_t chainidx);
|
|---|
| 376 | int tls_parse_stoc_server_name(SSL *s, PACKET *pkt, unsigned int context,
|
|---|
| 377 | X509 *x, size_t chainidx);
|
|---|
| 378 | int tls_parse_stoc_early_data(SSL *s, PACKET *pkt, unsigned int context,
|
|---|
| 379 | X509 *x, size_t chainidx);
|
|---|
| 380 | int tls_parse_stoc_maxfragmentlen(SSL *s, PACKET *pkt, unsigned int context,
|
|---|
| 381 | X509 *x, size_t chainidx);
|
|---|
| 382 | #ifndef OPENSSL_NO_EC
|
|---|
| 383 | int tls_parse_stoc_ec_pt_formats(SSL *s, PACKET *pkt, unsigned int context,
|
|---|
| 384 | X509 *x, size_t chainidx);
|
|---|
| 385 | #endif
|
|---|
| 386 | int tls_parse_stoc_session_ticket(SSL *s, PACKET *pkt, unsigned int context,
|
|---|
| 387 | X509 *x, size_t chainidx);
|
|---|
| 388 | #ifndef OPENSSL_NO_OCSP
|
|---|
| 389 | int tls_parse_stoc_status_request(SSL *s, PACKET *pkt, unsigned int context,
|
|---|
| 390 | X509 *x, size_t chainidx);
|
|---|
| 391 | #endif
|
|---|
| 392 | #ifndef OPENSSL_NO_CT
|
|---|
| 393 | int tls_parse_stoc_sct(SSL *s, PACKET *pkt, unsigned int context, X509 *x,
|
|---|
| 394 | size_t chainidx);
|
|---|
| 395 | #endif
|
|---|
| 396 | #ifndef OPENSSL_NO_NEXTPROTONEG
|
|---|
| 397 | int tls_parse_stoc_npn(SSL *s, PACKET *pkt, unsigned int context, X509 *x,
|
|---|
| 398 | size_t chainidx);
|
|---|
| 399 | #endif
|
|---|
| 400 | int tls_parse_stoc_alpn(SSL *s, PACKET *pkt, unsigned int context, X509 *x,
|
|---|
| 401 | size_t chainidx);
|
|---|
| 402 | #ifndef OPENSSL_NO_SRTP
|
|---|
| 403 | int tls_parse_stoc_use_srtp(SSL *s, PACKET *pkt, unsigned int context, X509 *x,
|
|---|
| 404 | size_t chainidx);
|
|---|
| 405 | #endif
|
|---|
| 406 | int tls_parse_stoc_etm(SSL *s, PACKET *pkt, unsigned int context, X509 *x,
|
|---|
| 407 | size_t chainidx);
|
|---|
| 408 | int tls_parse_stoc_ems(SSL *s, PACKET *pkt, unsigned int context, X509 *x,
|
|---|
| 409 | size_t chainidx);
|
|---|
| 410 | int tls_parse_stoc_supported_versions(SSL *s, PACKET *pkt, unsigned int context,
|
|---|
| 411 | X509 *x, size_t chainidx);
|
|---|
| 412 | int tls_parse_stoc_key_share(SSL *s, PACKET *pkt, unsigned int context, X509 *x,
|
|---|
| 413 | size_t chainidx);
|
|---|
| 414 | int tls_parse_stoc_cookie(SSL *s, PACKET *pkt, unsigned int context, X509 *x,
|
|---|
| 415 | size_t chainidx);
|
|---|
| 416 | int tls_parse_stoc_psk(SSL *s, PACKET *pkt, unsigned int context, X509 *x,
|
|---|
| 417 | size_t chainidx);
|
|---|
| 418 |
|
|---|
| 419 | int tls_handle_alpn(SSL *s);
|
|---|
| 420 |
|
|---|
| 421 | int tls13_save_handshake_digest_for_pha(SSL *s);
|
|---|
| 422 | int tls13_restore_handshake_digest_for_pha(SSL *s);
|
|---|
