2
0

statem_local.h 31 KB

123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899100101102103104105106107108109110111112113114115116117118119120121122123124125126127128129130131132133134135136137138139140141142143144145146147148149150151152153154155156157158159160161162163164165166167168169170171172173174175176177178179180181182183184185186187188189190191192193194195196197198199200201202203204205206207208209210211212213214215216217218219220221222223224225226227228229230231232233234235236237238239240241242243244245246247248249250251252253254255256257258259260261262263264265266267268269270271272273274275276277278279280281282283284285286287288289290291292293294295296297298299300301302303304305306307308309310311312313314315316317318319320321322323324325326327328329330331332333334335336337338339340341342343344345346347348349350351352353354355356357358359360361362363364365366367368369370371372373374375376377378379380381382383384385386387388389390391392393394395396397398399400401402403404405406407408409410411412413414415416417418419420421422423424425426427428429430431432433434435436437438439440441442443444445446447448449450451452453454455456457458459460461462463464465466467468469470471472473474475476477478479480481482483484485486487488489490491492493494495496497498499500501502503504505506507508509510511512513514515516517518519520521522523524525526527528529530531532533534535536537538539540541542543544545546547548549550551552553554555556557558559560561562563564565566567568569570571572
  1. /*
  2. * Copyright 2015-2023 The OpenSSL Project Authors. All Rights Reserved.
  3. *
  4. * Licensed under the Apache License 2.0 (the "License"). You may not use
  5. * this file except in compliance with the License. You can obtain a copy
  6. * in the file LICENSE in the source distribution or at
  7. * https://www.openssl.org/source/license.html
  8. */
  9. /*****************************************************************************
  10. * *
  11. * The following definitions are PRIVATE to the state machine. They should *
  12. * NOT be used outside of the state machine. *
  13. * *
  14. *****************************************************************************/
  15. /* Max message length definitions */
  16. /* The spec allows for a longer length than this, but we limit it */
  17. #define HELLO_VERIFY_REQUEST_MAX_LENGTH 258
  18. #define END_OF_EARLY_DATA_MAX_LENGTH 0
  19. #define HELLO_RETRY_REQUEST_MAX_LENGTH 20000
  20. #define ENCRYPTED_EXTENSIONS_MAX_LENGTH 20000
  21. #define SESSION_TICKET_MAX_LENGTH_TLS13 131338
  22. #define SESSION_TICKET_MAX_LENGTH_TLS12 65541
  23. #define SERVER_KEY_EXCH_MAX_LENGTH 102400
  24. #define SERVER_HELLO_DONE_MAX_LENGTH 0
  25. #define KEY_UPDATE_MAX_LENGTH 1
  26. #define CCS_MAX_LENGTH 1
  27. /* Max ServerHello size permitted by RFC 8446 */
  28. #define SERVER_HELLO_MAX_LENGTH 65607
  29. /* Max CertificateVerify size permitted by RFC 8446 */
  30. #define CERTIFICATE_VERIFY_MAX_LENGTH 65539
  31. /* Max should actually be 36 but we are generous */
  32. #define FINISHED_MAX_LENGTH 64
  33. /* Dummy message type */
  34. #define SSL3_MT_DUMMY -1
  35. /* Invalid extension ID for non-supported extensions */
  36. #define TLSEXT_TYPE_invalid 0x10000
  37. #define TLSEXT_TYPE_out_of_range 0x10001
  38. unsigned int ossl_get_extension_type(size_t idx);
  39. extern const unsigned char hrrrandom[];
  40. /* Message processing return codes */
  41. typedef enum {
  42. /* Something bad happened */
  43. MSG_PROCESS_ERROR,
  44. /* We've finished reading - swap to writing */
  45. MSG_PROCESS_FINISHED_READING,
  46. /*
  47. * We've completed the main processing of this message but there is some
  48. * post processing to be done.
  49. */
  50. MSG_PROCESS_CONTINUE_PROCESSING,
  51. /* We've finished this message - read the next message */
  52. MSG_PROCESS_CONTINUE_READING
  53. } MSG_PROCESS_RETURN;
  54. typedef CON_FUNC_RETURN (*confunc_f) (SSL_CONNECTION *s, WPACKET *pkt);
  55. int ssl3_take_mac(SSL_CONNECTION *s);
  56. int check_in_list(SSL_CONNECTION *s, uint16_t group_id, const uint16_t *groups,
  57. size_t num_groups, int checkallow);
  58. int create_synthetic_message_hash(SSL_CONNECTION *s,
  59. const unsigned char *hashval,
  60. size_t hashlen, const unsigned char *hrr,
  61. size_t hrrlen);
  62. int parse_ca_names(SSL_CONNECTION *s, PACKET *pkt);
  63. const STACK_OF(X509_NAME) *get_ca_names(SSL_CONNECTION *s);
  64. int construct_ca_names(SSL_CONNECTION *s, const STACK_OF(X509_NAME) *ca_sk,
  65. WPACKET *pkt);
  66. size_t construct_key_exchange_tbs(SSL_CONNECTION *s, unsigned char **ptbs,
  67. const void *param, size_t paramlen);
  68. /*
  69. * TLS/DTLS client state machine functions
  70. */
  71. int ossl_statem_client_read_transition(SSL_CONNECTION *s, int mt);
  72. WRITE_TRAN ossl_statem_client_write_transition(SSL_CONNECTION *s);
  73. WORK_STATE ossl_statem_client_pre_work(SSL_CONNECTION *s, WORK_STATE wst);
  74. WORK_STATE ossl_statem_client_post_work(SSL_CONNECTION *s, WORK_STATE wst);
  75. int ossl_statem_client_construct_message(SSL_CONNECTION *s,
  76. confunc_f *confunc, int *mt);
  77. size_t ossl_statem_client_max_message_size(SSL_CONNECTION *s);
  78. MSG_PROCESS_RETURN ossl_statem_client_process_message(SSL_CONNECTION *s,
  79. PACKET *pkt);
  80. WORK_STATE ossl_statem_client_post_process_message(SSL_CONNECTION *s,
  81. WORK_STATE wst);
  82. /*
  83. * TLS/DTLS server state machine functions
  84. */
  85. int ossl_statem_server_read_transition(SSL_CONNECTION *s, int mt);
  86. WRITE_TRAN ossl_statem_server_write_transition(SSL_CONNECTION *s);
  87. WORK_STATE ossl_statem_server_pre_work(SSL_CONNECTION *s, WORK_STATE wst);
  88. WORK_STATE ossl_statem_server_post_work(SSL_CONNECTION *s, WORK_STATE wst);
  89. int ossl_statem_server_construct_message(SSL_CONNECTION *s,
  90. confunc_f *confunc,int *mt);
  91. size_t ossl_statem_server_max_message_size(SSL_CONNECTION *s);
  92. MSG_PROCESS_RETURN ossl_statem_server_process_message(SSL_CONNECTION *s,
  93. PACKET *pkt);
  94. WORK_STATE ossl_statem_server_post_process_message(SSL_CONNECTION *s,
  95. WORK_STATE wst);
  96. /* Functions for getting new message data */
  97. __owur int tls_get_message_header(SSL_CONNECTION *s, int *mt);
  98. __owur int tls_get_message_body(SSL_CONNECTION *s, size_t *len);
  99. __owur int dtls_get_message(SSL_CONNECTION *s, int *mt);
  100. __owur int dtls_get_message_body(SSL_CONNECTION *s, size_t *len);
  101. /* Message construction and processing functions */
  102. __owur int tls_process_initial_server_flight(SSL_CONNECTION *s);
  103. __owur MSG_PROCESS_RETURN tls_process_change_cipher_spec(SSL_CONNECTION *s,
  104. PACKET *pkt);
  105. __owur MSG_PROCESS_RETURN tls_process_finished(SSL_CONNECTION *s, PACKET *pkt);
  106. __owur CON_FUNC_RETURN tls_construct_change_cipher_spec(SSL_CONNECTION *s,
  107. WPACKET *pkt);
  108. __owur CON_FUNC_RETURN dtls_construct_change_cipher_spec(SSL_CONNECTION *s,
  109. WPACKET *pkt);
  110. __owur CON_FUNC_RETURN tls_construct_finished(SSL_CONNECTION *s, WPACKET *pkt);
  111. __owur CON_FUNC_RETURN tls_construct_key_update(SSL_CONNECTION *s, WPACKET *pkt);
  112. __owur MSG_PROCESS_RETURN tls_process_key_update(SSL_CONNECTION *s,
  113. PACKET *pkt);
  114. __owur WORK_STATE tls_finish_handshake(SSL_CONNECTION *s, WORK_STATE wst,
  115. int clearbufs, int stop);
  116. __owur WORK_STATE dtls_wait_for_dry(SSL_CONNECTION *s);
  117. #ifndef OPENSSL_NO_COMP_ALG
  118. __owur MSG_PROCESS_RETURN tls13_process_compressed_certificate(SSL_CONNECTION *sc,
  119. PACKET *pkt,
  120. PACKET *tmppkt,
  121. BUF_MEM *buf);
  122. #endif
  123. /* some client-only functions */
  124. __owur CON_FUNC_RETURN tls_construct_client_hello(SSL_CONNECTION *s,
  125. WPACKET *pkt);
  126. __owur MSG_PROCESS_RETURN tls_process_server_hello(SSL_CONNECTION *s,
  127. PACKET *pkt);
  128. __owur MSG_PROCESS_RETURN tls_process_certificate_request(SSL_CONNECTION *s,
  129. PACKET *pkt);
  130. __owur MSG_PROCESS_RETURN tls_process_new_session_ticket(SSL_CONNECTION *s,
  131. PACKET *pkt);
  132. __owur int tls_process_cert_status_body(SSL_CONNECTION *s, PACKET *pkt);
  133. __owur MSG_PROCESS_RETURN tls_process_cert_status(SSL_CONNECTION *s,
  134. PACKET *pkt);
  135. __owur MSG_PROCESS_RETURN tls_process_server_done(SSL_CONNECTION *s,
  136. PACKET *pkt);
  137. __owur CON_FUNC_RETURN tls_construct_cert_verify(SSL_CONNECTION *s,
  138. WPACKET *pkt);
  139. __owur WORK_STATE tls_prepare_client_certificate(SSL_CONNECTION *s,
  140. WORK_STATE wst);
  141. __owur CON_FUNC_RETURN tls_construct_client_certificate(SSL_CONNECTION *s,
  142. WPACKET *pkt);
  143. #ifndef OPENSSL_NO_COMP_ALG
  144. __owur CON_FUNC_RETURN tls_construct_client_compressed_certificate(SSL_CONNECTION *sc,
  145. WPACKET *pkt);
  146. #endif
  147. __owur int ssl_do_client_cert_cb(SSL_CONNECTION *s, X509 **px509,
  148. EVP_PKEY **ppkey);
  149. __owur CON_FUNC_RETURN tls_construct_client_key_exchange(SSL_CONNECTION *s,
  150. WPACKET *pkt);
  151. __owur int tls_client_key_exchange_post_work(SSL_CONNECTION *s);
  152. __owur int tls_construct_cert_status_body(SSL_CONNECTION *s, WPACKET *pkt);
  153. __owur CON_FUNC_RETURN tls_construct_cert_status(SSL_CONNECTION *s,
  154. WPACKET *pkt);
  155. __owur MSG_PROCESS_RETURN tls_process_key_exchange(SSL_CONNECTION *s,
  156. PACKET *pkt);
  157. __owur MSG_PROCESS_RETURN tls_process_server_rpk(SSL_CONNECTION *sc,
  158. PACKET *pkt);
  159. __owur MSG_PROCESS_RETURN tls_process_client_rpk(SSL_CONNECTION *sc,
  160. PACKET *pkt);
  161. __owur unsigned long tls_output_rpk(SSL_CONNECTION *sc, WPACKET *pkt,
  162. CERT_PKEY *cpk);
  163. __owur int tls_process_rpk(SSL_CONNECTION *s, PACKET *pkt, EVP_PKEY **peer_rpk);
  164. __owur MSG_PROCESS_RETURN tls_process_server_certificate(SSL_CONNECTION *s,
  165. PACKET *pkt);
  166. __owur WORK_STATE tls_post_process_server_certificate(SSL_CONNECTION *s,
  167. WORK_STATE wst);
  168. #ifndef OPENSSL_NO_COMP_ALG
  169. __owur MSG_PROCESS_RETURN tls_process_server_compressed_certificate(SSL_CONNECTION *sc,
  170. PACKET *pkt);
  171. #endif
  172. __owur int ssl3_check_cert_and_algorithm(SSL_CONNECTION *s);
  173. #ifndef OPENSSL_NO_NEXTPROTONEG
  174. __owur CON_FUNC_RETURN tls_construct_next_proto(SSL_CONNECTION *s, WPACKET *pkt);
  175. #endif
  176. __owur MSG_PROCESS_RETURN tls_process_hello_req(SSL_CONNECTION *s, PACKET *pkt);
  177. __owur MSG_PROCESS_RETURN dtls_process_hello_verify(SSL_CONNECTION *s, PACKET *pkt);
  178. __owur CON_FUNC_RETURN tls_construct_end_of_early_data(SSL_CONNECTION *s,
  179. WPACKET *pkt);
  180. /* some server-only functions */
  181. __owur MSG_PROCESS_RETURN tls_process_client_hello(SSL_CONNECTION *s,
  182. PACKET *pkt);
  183. __owur WORK_STATE tls_post_process_client_hello(SSL_CONNECTION *s,
  184. WORK_STATE wst);
  185. __owur CON_FUNC_RETURN tls_construct_server_hello(SSL_CONNECTION *s,
  186. WPACKET *pkt);
  187. __owur CON_FUNC_RETURN dtls_construct_hello_verify_request(SSL_CONNECTION *s,
  188. WPACKET *pkt);
  189. __owur CON_FUNC_RETURN tls_construct_server_certificate(SSL_CONNECTION *s,
  190. WPACKET *pkt);
  191. #ifndef OPENSSL_NO_COMP_ALG
  192. __owur CON_FUNC_RETURN tls_construct_server_compressed_certificate(SSL_CONNECTION *sc,
  193. WPACKET *pkt);
  194. #endif
  195. __owur CON_FUNC_RETURN tls_construct_server_key_exchange(SSL_CONNECTION *s,
  196. WPACKET *pkt);
  197. __owur CON_FUNC_RETURN tls_construct_certificate_request(SSL_CONNECTION *s,
  198. WPACKET *pkt);
  199. __owur CON_FUNC_RETURN tls_construct_server_done(SSL_CONNECTION *s,
  200. WPACKET *pkt);
  201. __owur MSG_PROCESS_RETURN tls_process_client_certificate(SSL_CONNECTION *s,
  202. PACKET *pkt);
  203. #ifndef OPENSSL_NO_COMP_ALG
  204. __owur MSG_PROCESS_RETURN tls_process_client_compressed_certificate(SSL_CONNECTION *sc,
  205. PACKET *pkt);
  206. #endif
  207. __owur MSG_PROCESS_RETURN tls_process_client_key_exchange(SSL_CONNECTION *s,
  208. PACKET *pkt);
  209. __owur WORK_STATE tls_post_process_client_key_exchange(SSL_CONNECTION *s,
  210. WORK_STATE wst);
  211. __owur MSG_PROCESS_RETURN tls_process_cert_verify(SSL_CONNECTION *s,
  212. PACKET *pkt);
  213. #ifndef OPENSSL_NO_NEXTPROTONEG
  214. __owur MSG_PROCESS_RETURN tls_process_next_proto(SSL_CONNECTION *s,
  215. PACKET *pkt);
  216. #endif
  217. __owur CON_FUNC_RETURN tls_construct_new_session_ticket(SSL_CONNECTION *s,
  218. WPACKET *pkt);
  219. MSG_PROCESS_RETURN tls_process_end_of_early_data(SSL_CONNECTION *s,
  220. PACKET *pkt);
  221. #ifndef OPENSSL_NO_GOST
  222. /* These functions are used in GOST18 CKE, both for client and server */
  223. int ossl_gost18_cke_cipher_nid(const SSL_CONNECTION *s);
  224. int ossl_gost_ukm(const SSL_CONNECTION *s, unsigned char *dgst_buf);
  225. #endif
  226. /* Extension processing */
  227. typedef enum ext_return_en {
  228. EXT_RETURN_FAIL,
  229. EXT_RETURN_SENT,
  230. EXT_RETURN_NOT_SENT
  231. } EXT_RETURN;
  232. __owur int tls_validate_all_contexts(SSL_CONNECTION *s, unsigned int thisctx,
  233. RAW_EXTENSION *exts);
  234. __owur int extension_is_relevant(SSL_CONNECTION *s, unsigned int extctx,
  235. unsigned int thisctx);
  236. __owur int tls_collect_extensions(SSL_CONNECTION *s, PACKET *packet,
  237. unsigned int context,
  238. RAW_EXTENSION **res, size_t *len, int init);
  239. __owur int tls_parse_extension(SSL_CONNECTION *s, TLSEXT_INDEX idx, int context,
  240. RAW_EXTENSION *exts, X509 *x, size_t chainidx);
  241. __owur int tls_parse_all_extensions(SSL_CONNECTION *s, int context,
  242. RAW_EXTENSION *exts,
  243. X509 *x, size_t chainidx, int fin);
  244. __owur int should_add_extension(SSL_CONNECTION *s, unsigned int extctx,
  245. unsigned int thisctx, int max_version);
  246. __owur int tls_construct_extensions(SSL_CONNECTION *s, WPACKET *pkt,
  247. unsigned int context,
  248. X509 *x, size_t chainidx);
  249. __owur int tls_psk_do_binder(SSL_CONNECTION *s, const EVP_MD *md,
  250. const unsigned char *msgstart,
  251. size_t binderoffset, const unsigned char *binderin,
  252. unsigned char *binderout,
  253. SSL_SESSION *sess, int sign, int external);
  254. /* Server Extension processing */
  255. int tls_parse_ctos_renegotiate(SSL_CONNECTION *s, PACKET *pkt,
  256. unsigned int context,
  257. X509 *x, size_t chainidx);
  258. int tls_parse_ctos_server_name(SSL_CONNECTION *s, PACKET *pkt,
  259. unsigned int context,
  260. X509 *x, size_t chainidx);
  261. int tls_parse_ctos_maxfragmentlen(SSL_CONNECTION *s, PACKET *pkt,
  262. unsigned int context,
  263. X509 *x, size_t chainidx);
  264. #ifndef OPENSSL_NO_SRP
  265. int tls_parse_ctos_srp(SSL_CONNECTION *s, PACKET *pkt, unsigned int context,
  266. X509 *x, size_t chainidx);
  267. #endif
  268. int tls_parse_ctos_early_data(SSL_CONNECTION *s, PACKET *pkt,
  269. unsigned int context,
  270. X509 *x, size_t chainidx);
  271. int tls_parse_ctos_ec_pt_formats(SSL_CONNECTION *s, PACKET *pkt,
  272. unsigned int context,
  273. X509 *x, size_t chainidx);
  274. int tls_parse_ctos_supported_groups(SSL_CONNECTION *s, PACKET *pkt,
  275. unsigned int context,
  276. X509 *x, size_t chainidxl);
  277. int tls_parse_ctos_session_ticket(SSL_CONNECTION *s, PACKET *pkt,
  278. unsigned int context,
  279. X509 *x, size_t chainidx);
  280. int tls_parse_ctos_sig_algs_cert(SSL_CONNECTION *s, PACKET *pkt,
  281. unsigned int context,
  282. X509 *x, size_t chainidx);
  283. int tls_parse_ctos_sig_algs(SSL_CONNECTION *s, PACKET *pkt,
  284. unsigned int context, X509 *x, size_t chainidx);
  285. #ifndef OPENSSL_NO_OCSP
  286. int tls_parse_ctos_status_request(SSL_CONNECTION *s, PACKET *pkt,
  287. unsigned int context,
  288. X509 *x, size_t chainidx);
  289. #endif
  290. #ifndef OPENSSL_NO_NEXTPROTONEG
  291. int tls_parse_ctos_npn(SSL_CONNECTION *s, PACKET *pkt, unsigned int context,
  292. X509 *x, size_t chainidx);
  293. #endif
  294. int tls_parse_ctos_alpn(SSL_CONNECTION *s, PACKET *pkt, unsigned int context,
  295. X509 *x, size_t chainidx);
  296. #ifndef OPENSSL_NO_SRTP
  297. int tls_parse_ctos_use_srtp(SSL_CONNECTION *s, PACKET *pkt,
  298. unsigned int context, X509 *x, size_t chainidx);
  299. #endif
  300. int tls_parse_ctos_etm(SSL_CONNECTION *s, PACKET *pkt, unsigned int context,
  301. X509 *x, size_t chainidx);
  302. int tls_parse_ctos_key_share(SSL_CONNECTION *s, PACKET *pkt,
  303. unsigned int context, X509 *x, size_t chainidx);
  304. int tls_parse_ctos_cookie(SSL_CONNECTION *s, PACKET *pkt, unsigned int context,
  305. X509 *x, size_t chainidx);
  306. int tls_parse_ctos_ems(SSL_CONNECTION *s, PACKET *pkt, unsigned int context,
  307. X509 *x, size_t chainidx);
  308. int tls_parse_ctos_psk_kex_modes(SSL_CONNECTION *s, PACKET *pkt,
  309. unsigned int context,
  310. X509 *x, size_t chainidx);
  311. int tls_parse_ctos_psk(SSL_CONNECTION *s, PACKET *pkt, unsigned int context,
  312. X509 *x, size_t chainidx);
  313. int tls_parse_ctos_post_handshake_auth(SSL_CONNECTION *, PACKET *pkt,
  314. unsigned int context,
  315. X509 *x, size_t chainidx);
  316. EXT_RETURN tls_construct_stoc_renegotiate(SSL_CONNECTION *s, WPACKET *pkt,
  317. unsigned int context, X509 *x,
  318. size_t chainidx);
  319. EXT_RETURN tls_construct_stoc_server_name(SSL_CONNECTION *s, WPACKET *pkt,
  320. unsigned int context, X509 *x,
  321. size_t chainidx);
  322. EXT_RETURN tls_construct_stoc_early_data(SSL_CONNECTION *s, WPACKET *pkt,
  323. unsigned int context, X509 *x,
  324. size_t chainidx);
  325. EXT_RETURN tls_construct_stoc_maxfragmentlen(SSL_CONNECTION *s, WPACKET *pkt,
  326. unsigned int context, X509 *x,
  327. size_t chainidx);
  328. EXT_RETURN tls_construct_stoc_ec_pt_formats(SSL_CONNECTION *s, WPACKET *pkt,
  329. unsigned int context, X509 *x,
  330. size_t chainidx);
  331. EXT_RETURN tls_construct_stoc_supported_groups(SSL_CONNECTION *s, WPACKET *pkt,
  332. unsigned int context, X509 *x,
  333. size_t chainidx);
  334. EXT_RETURN tls_construct_stoc_session_ticket(SSL_CONNECTION *s, WPACKET *pkt,
  335. unsigned int context, X509 *x,
  336. size_t chainidx);
  337. #ifndef OPENSSL_NO_OCSP
  338. EXT_RETURN tls_construct_stoc_status_request(SSL_CONNECTION *s, WPACKET *pkt,
  339. unsigned int context, X509 *x,
  340. size_t chainidx);
  341. #endif
  342. #ifndef OPENSSL_NO_NEXTPROTONEG
  343. EXT_RETURN tls_construct_stoc_next_proto_neg(SSL_CONNECTION *s, WPACKET *pkt,
  344. unsigned int context, X509 *x,
  345. size_t chainidx);
  346. #endif
  347. EXT_RETURN tls_construct_stoc_alpn(SSL_CONNECTION *s, WPACKET *pkt,
  348. unsigned int context,
  349. X509 *x, size_t chainidx);
  350. #ifndef OPENSSL_NO_SRTP
  351. EXT_RETURN tls_construct_stoc_use_srtp(SSL_CONNECTION *s, WPACKET *pkt,
  352. unsigned int context,
  353. X509 *x, size_t chainidx);
  354. #endif
  355. EXT_RETURN tls_construct_stoc_etm(SSL_CONNECTION *s, WPACKET *pkt,
  356. unsigned int context,
  357. X509 *x, size_t chainidx);
  358. EXT_RETURN tls_construct_stoc_ems(SSL_CONNECTION *s, WPACKET *pkt,
  359. unsigned int context,
  360. X509 *x, size_t chainidx);
  361. EXT_RETURN tls_construct_stoc_supported_versions(SSL_CONNECTION *s, WPACKET *pkt,
  362. unsigned int context, X509 *x,
  363. size_t chainidx);
  364. EXT_RETURN tls_construct_stoc_key_share(SSL_CONNECTION *s, WPACKET *pkt,
  365. unsigned int context, X509 *x,
  366. size_t chainidx);
  367. EXT_RETURN tls_construct_stoc_cookie(SSL_CONNECTION *s, WPACKET *pkt,
  368. unsigned int context,
  369. X509 *x, size_t chainidx);
  370. /*
  371. * Not in public headers as this is not an official extension. Only used when
  372. * SSL_OP_CRYPTOPRO_TLSEXT_BUG is set.
  373. */
  374. #define TLSEXT_TYPE_cryptopro_bug 0xfde8
  375. EXT_RETURN tls_construct_stoc_cryptopro_bug(SSL_CONNECTION *s, WPACKET *pkt,
  376. unsigned int context, X509 *x,
  377. size_t chainidx);
  378. EXT_RETURN tls_construct_stoc_psk(SSL_CONNECTION *s, WPACKET *pkt,
  379. unsigned int context,
  380. X509 *x, size_t chainidx);
  381. /* Client Extension processing */
  382. EXT_RETURN tls_construct_ctos_renegotiate(SSL_CONNECTION *s, WPACKET *pkt,
  383. unsigned int context,
  384. X509 *x, size_t chainidx);
  385. EXT_RETURN tls_construct_ctos_server_name(SSL_CONNECTION *s, WPACKET *pkt,
  386. unsigned int context,
  387. X509 *x, size_t chainidx);
  388. EXT_RETURN tls_construct_ctos_maxfragmentlen(SSL_CONNECTION *s, WPACKET *pkt,
  389. unsigned int context,
  390. X509 *x, size_t chainidx);
  391. #ifndef OPENSSL_NO_SRP
  392. EXT_RETURN tls_construct_ctos_srp(SSL_CONNECTION *s, WPACKET *pkt,
  393. unsigned int context, X509 *x,
  394. size_t chainidx);
  395. #endif
  396. EXT_RETURN tls_construct_ctos_ec_pt_formats(SSL_CONNECTION *s, WPACKET *pkt,
  397. unsigned int context, X509 *x,
  398. size_t chainidx);
  399. EXT_RETURN tls_construct_ctos_supported_groups(SSL_CONNECTION *s, WPACKET *pkt,
  400. unsigned int context, X509 *x,
  401. size_t chainidx);
  402. EXT_RETURN tls_construct_ctos_early_data(SSL_CONNECTION *s, WPACKET *pkt,
  403. unsigned int context, X509 *x,
  404. size_t chainidx);
  405. EXT_RETURN tls_construct_ctos_session_ticket(SSL_CONNECTION *s, WPACKET *pkt,
  406. unsigned int context, X509 *x,
  407. size_t chainidx);
  408. EXT_RETURN tls_construct_ctos_sig_algs(SSL_CONNECTION *s, WPACKET *pkt,
  409. unsigned int context, X509 *x,
  410. size_t chainidx);
  411. #ifndef OPENSSL_NO_OCSP
  412. EXT_RETURN tls_construct_ctos_status_request(SSL_CONNECTION *s, WPACKET *pkt,
  413. unsigned int context, X509 *x,
  414. size_t chainidx);
  415. #endif
  416. #ifndef OPENSSL_NO_NEXTPROTONEG
  417. EXT_RETURN tls_construct_ctos_npn(SSL_CONNECTION *s, WPACKET *pkt,
  418. unsigned int context,
  419. X509 *x, size_t chainidx);
  420. #endif
  421. EXT_RETURN tls_construct_ctos_alpn(SSL_CONNECTION *s, WPACKET *pkt,
  422. unsigned int context,
  423. X509 *x, size_t chainidx);
  424. #ifndef OPENSSL_NO_SRTP
  425. EXT_RETURN tls_construct_ctos_use_srtp(SSL_CONNECTION *s, WPACKET *pkt,
  426. unsigned int context,
  427. X509 *x, size_t chainidx);
  428. #endif
  429. EXT_RETURN tls_construct_ctos_etm(SSL_CONNECTION *s, WPACKET *pkt,
  430. unsigned int context,
  431. X509 *x, size_t chainidx);
  432. #ifndef OPENSSL_NO_CT
  433. EXT_RETURN tls_construct_ctos_sct(SSL_CONNECTION *s, WPACKET *pkt,
  434. unsigned int context,
  435. X509 *x, size_t chainidx);
  436. #endif
  437. EXT_RETURN tls_construct_ctos_ems(SSL_CONNECTION *s, WPACKET *pkt,
  438. unsigned int context,
  439. X509 *x, size_t chainidx);
  440. EXT_RETURN tls_construct_ctos_supported_versions(SSL_CONNECTION *s, WPACKET *pkt,
  441. unsigned int context, X509 *x,
  442. size_t chainidx);
  443. EXT_RETURN tls_construct_ctos_key_share(SSL_CONNECTION *s, WPACKET *pkt,
  444. unsigned int context, X509 *x,
  445. size_t chainidx);
  446. EXT_RETURN tls_construct_ctos_psk_kex_modes(SSL_CONNECTION *s, WPACKET *pkt,
  447. unsigned int context, X509 *x,
  448. size_t chainidx);
  449. EXT_RETURN tls_construct_ctos_cookie(SSL_CONNECTION *s, WPACKET *pkt,
  450. unsigned int context,
  451. X509 *x, size_t chainidx);
  452. EXT_RETURN tls_construct_ctos_padding(SSL_CONNECTION *s, WPACKET *pkt,
  453. unsigned int context, X509 *x,
  454. size_t chainidx);
  455. EXT_RETURN tls_construct_ctos_psk(SSL_CONNECTION *s, WPACKET *pkt,
  456. unsigned int context,
  457. X509 *x, size_t chainidx);
  458. EXT_RETURN tls_construct_ctos_post_handshake_auth(SSL_CONNECTION *s, WPACKET *pkt,
  459. unsigned int context,
  460. X509 *x, size_t chainidx);
  461. int tls_parse_stoc_renegotiate(SSL_CONNECTION *s, PACKET *pkt,
  462. unsigned int context,
  463. X509 *x, size_t chainidx);
  464. int tls_parse_stoc_server_name(SSL_CONNECTION *s, PACKET *pkt,
  465. unsigned int context,
  466. X509 *x, size_t chainidx);
  467. int tls_parse_stoc_early_data(SSL_CONNECTION *s, PACKET *pkt,
  468. unsigned int context,
  469. X509 *x, size_t chainidx);
  470. int tls_parse_stoc_maxfragmentlen(SSL_CONNECTION *s, PACKET *pkt,
  471. unsigned int context,
  472. X509 *x, size_t chainidx);
  473. int tls_parse_stoc_ec_pt_formats(SSL_CONNECTION *s, PACKET *pkt,
  474. unsigned int context,
  475. X509 *x, size_t chainidx);
  476. int tls_parse_stoc_session_ticket(SSL_CONNECTION *s, PACKET *pkt,
  477. unsigned int context,
  478. X509 *x, size_t chainidx);
  479. #ifndef OPENSSL_NO_OCSP
  480. int tls_parse_stoc_status_request(SSL_CONNECTION *s, PACKET *pkt,
  481. unsigned int context,
  482. X509 *x, size_t chainidx);
  483. #endif
  484. #ifndef OPENSSL_NO_CT
  485. int tls_parse_stoc_sct(SSL_CONNECTION *s, PACKET *pkt, unsigned int context,
  486. X509 *x, size_t chainidx);
  487. #endif
  488. #ifndef OPENSSL_NO_NEXTPROTONEG
  489. int tls_parse_stoc_npn(SSL_CONNECTION *s, PACKET *pkt, unsigned int context,
  490. X509 *x, size_t chainidx);
  491. #endif
  492. int tls_parse_stoc_alpn(SSL_CONNECTION *s, PACKET *pkt, unsigned int context,
  493. X509 *x, size_t chainidx);
  494. #ifndef OPENSSL_NO_SRTP
  495. int tls_parse_stoc_use_srtp(SSL_CONNECTION *s, PACKET *pkt,
  496. unsigned int context, X509 *x, size_t chainidx);
  497. #endif
  498. int tls_parse_stoc_etm(SSL_CONNECTION *s, PACKET *pkt, unsigned int context,
  499. X509 *x, size_t chainidx);
  500. int tls_parse_stoc_ems(SSL_CONNECTION *s, PACKET *pkt, unsigned int context,
  501. X509 *x, size_t chainidx);
  502. int tls_parse_stoc_supported_versions(SSL_CONNECTION *s, PACKET *pkt,
  503. unsigned int context,
  504. X509 *x, size_t chainidx);
  505. int tls_parse_stoc_key_share(SSL_CONNECTION *s, PACKET *pkt,
  506. unsigned int context, X509 *x, size_t chainidx);
  507. int tls_parse_stoc_cookie(SSL_CONNECTION *s, PACKET *pkt, unsigned int context,
  508. X509 *x, size_t chainidx);
  509. int tls_parse_stoc_psk(SSL_CONNECTION *s, PACKET *pkt, unsigned int context,
  510. X509 *x, size_t chainidx);
  511. int tls_handle_alpn(SSL_CONNECTION *s);
  512. int tls13_save_handshake_digest_for_pha(SSL_CONNECTION *s);
  513. int tls13_restore_handshake_digest_for_pha(SSL_CONNECTION *s);
  514. __owur EVP_PKEY* tls_get_peer_pkey(const SSL_CONNECTION *sc);
  515. /* RFC7250 */
  516. EXT_RETURN tls_construct_ctos_client_cert_type(SSL_CONNECTION *sc, WPACKET *pkt,
  517. unsigned int context,
  518. X509 *x, size_t chainidx);
  519. EXT_RETURN tls_construct_stoc_client_cert_type(SSL_CONNECTION *sc, WPACKET *pkt,
  520. unsigned int context,
  521. X509 *x, size_t chainidx);
  522. int tls_parse_ctos_client_cert_type(SSL_CONNECTION *sc, PACKET *pkt,
  523. unsigned int context,
  524. X509 *x, size_t chainidx);
  525. int tls_parse_stoc_client_cert_type(SSL_CONNECTION *sc, PACKET *pkt,
  526. unsigned int context,
  527. X509 *x, size_t chainidx);
  528. EXT_RETURN tls_construct_ctos_server_cert_type(SSL_CONNECTION *sc, WPACKET *pkt,
  529. unsigned int context,
  530. X509 *x, size_t chainidx);
  531. EXT_RETURN tls_construct_stoc_server_cert_type(SSL_CONNECTION *sc, WPACKET *pkt,
  532. unsigned int context,
  533. X509 *x, size_t chainidx);
  534. int tls_parse_ctos_server_cert_type(SSL_CONNECTION *sc, PACKET *pkt,
  535. unsigned int context,
  536. X509 *x, size_t chainidx);
  537. int tls_parse_stoc_server_cert_type(SSL_CONNECTION *s, PACKET *pkt,
  538. unsigned int context,
  539. X509 *x, size_t chainidx);