1/*
2 * Copyright 1995-2021 The OpenSSL Project Authors. All Rights Reserved.
3 * Copyright (c) 2002, Oracle and/or its affiliates. All rights reserved
4 * Copyright 2005 Nokia. All rights reserved.
5 *
6 * Licensed under the OpenSSL license (the "License").  You may not use
7 * this file except in compliance with the License.  You can obtain a copy
8 * in the file LICENSE in the source distribution or at
9 * https://www.openssl.org/source/license.html
10 */
11
12#include <stdio.h>
13#include "ssl_local.h"
14#include "e_os.h"
15#include <openssl/objects.h>
16#include <openssl/x509v3.h>
17#include <openssl/rand.h>
18#include <openssl/rand_drbg.h>
19#include <openssl/ocsp.h>
20#include <openssl/dh.h>
21#include <openssl/engine.h>
22#include <openssl/async.h>
23#include <openssl/ct.h>
24#include "internal/cryptlib.h"
25#include "internal/refcount.h"
26#include "internal/ktls.h"
27
28const char SSL_version_str[] = OPENSSL_VERSION_TEXT;
29
30static int ssl_undefined_function_1(SSL *ssl, SSL3_RECORD *r, size_t s, int t)
31{
32    (void)r;
33    (void)s;
34    (void)t;
35    return ssl_undefined_function(ssl);
36}
37
38static int ssl_undefined_function_2(SSL *ssl, SSL3_RECORD *r, unsigned char *s,
39                                    int t)
40{
41    (void)r;
42    (void)s;
43    (void)t;
44    return ssl_undefined_function(ssl);
45}
46
47static int ssl_undefined_function_3(SSL *ssl, unsigned char *r,
48                                    unsigned char *s, size_t t, size_t *u)
49{
50    (void)r;
51    (void)s;
52    (void)t;
53    (void)u;
54    return ssl_undefined_function(ssl);
55}
56
57static int ssl_undefined_function_4(SSL *ssl, int r)
58{
59    (void)r;
60    return ssl_undefined_function(ssl);
61}
62
63static size_t ssl_undefined_function_5(SSL *ssl, const char *r, size_t s,
64                                       unsigned char *t)
65{
66    (void)r;
67    (void)s;
68    (void)t;
69    return ssl_undefined_function(ssl);
70}
71
72static int ssl_undefined_function_6(int r)
73{
74    (void)r;
75    return ssl_undefined_function(NULL);
76}
77
78static int ssl_undefined_function_7(SSL *ssl, unsigned char *r, size_t s,
79                                    const char *t, size_t u,
80                                    const unsigned char *v, size_t w, int x)
81{
82    (void)r;
83    (void)s;
84    (void)t;
85    (void)u;
86    (void)v;
87    (void)w;
88    (void)x;
89    return ssl_undefined_function(ssl);
90}
91
92SSL3_ENC_METHOD ssl3_undef_enc_method = {
93    ssl_undefined_function_1,
94    ssl_undefined_function_2,
95    ssl_undefined_function,
96    ssl_undefined_function_3,
97    ssl_undefined_function_4,
98    ssl_undefined_function_5,
99    NULL,                       /* client_finished_label */
100    0,                          /* client_finished_label_len */
101    NULL,                       /* server_finished_label */
102    0,                          /* server_finished_label_len */
103    ssl_undefined_function_6,
104    ssl_undefined_function_7,
105};
106
107struct ssl_async_args {
108    SSL *s;
109    void *buf;
110    size_t num;
111    enum { READFUNC, WRITEFUNC, OTHERFUNC } type;
112    union {
113        int (*func_read) (SSL *, void *, size_t, size_t *);
114        int (*func_write) (SSL *, const void *, size_t, size_t *);
115        int (*func_other) (SSL *);
116    } f;
117};
118
119static const struct {
120    uint8_t mtype;
121    uint8_t ord;
122    int nid;
123} dane_mds[] = {
124    {
125        DANETLS_MATCHING_FULL, 0, NID_undef
126    },
127    {
128        DANETLS_MATCHING_2256, 1, NID_sha256
129    },
130    {
131        DANETLS_MATCHING_2512, 2, NID_sha512
132    },
133};
134
135static int dane_ctx_enable(struct dane_ctx_st *dctx)
136{
137    const EVP_MD **mdevp;
138    uint8_t *mdord;
139    uint8_t mdmax = DANETLS_MATCHING_LAST;
140    int n = ((int)mdmax) + 1;   /* int to handle PrivMatch(255) */
141    size_t i;
142
143    if (dctx->mdevp != NULL)
144        return 1;
145
146    mdevp = OPENSSL_zalloc(n * sizeof(*mdevp));
147    mdord = OPENSSL_zalloc(n * sizeof(*mdord));
148
149    if (mdord == NULL || mdevp == NULL) {
150        OPENSSL_free(mdord);
151        OPENSSL_free(mdevp);
152        SSLerr(SSL_F_DANE_CTX_ENABLE, ERR_R_MALLOC_FAILURE);
153        return 0;
154    }
155
156    /* Install default entries */
157    for (i = 0; i < OSSL_NELEM(dane_mds); ++i) {
158        const EVP_MD *md;
159
160        if (dane_mds[i].nid == NID_undef ||
161            (md = EVP_get_digestbynid(dane_mds[i].nid)) == NULL)
162            continue;
163        mdevp[dane_mds[i].mtype] = md;
164        mdord[dane_mds[i].mtype] = dane_mds[i].ord;
165    }
166
167    dctx->mdevp = mdevp;
168    dctx->mdord = mdord;
169    dctx->mdmax = mdmax;
170
171    return 1;
172}
173
174static void dane_ctx_final(struct dane_ctx_st *dctx)
175{
176    OPENSSL_free(dctx->mdevp);
177    dctx->mdevp = NULL;
178
179    OPENSSL_free(dctx->mdord);
180    dctx->mdord = NULL;
181    dctx->mdmax = 0;
182}
183
184static void tlsa_free(danetls_record *t)
185{
186    if (t == NULL)
187        return;
188    OPENSSL_free(t->data);
189    EVP_PKEY_free(t->spki);
190    OPENSSL_free(t);
191}
192
193static void dane_final(SSL_DANE *dane)
194{
195    sk_danetls_record_pop_free(dane->trecs, tlsa_free);
196    dane->trecs = NULL;
197
198    sk_X509_pop_free(dane->certs, X509_free);
199    dane->certs = NULL;
200
201    X509_free(dane->mcert);
202    dane->mcert = NULL;
203    dane->mtlsa = NULL;
204    dane->mdpth = -1;
205    dane->pdpth = -1;
206}
207
208/*
209 * dane_copy - Copy dane configuration, sans verification state.
210 */
211static int ssl_dane_dup(SSL *to, SSL *from)
212{
213    int num;
214    int i;
215
216    if (!DANETLS_ENABLED(&from->dane))
217        return 1;
218
219    num = sk_danetls_record_num(from->dane.trecs);
220    dane_final(&to->dane);
221    to->dane.flags = from->dane.flags;
222    to->dane.dctx = &to->ctx->dane;
223    to->dane.trecs = sk_danetls_record_new_reserve(NULL, num);
224
225    if (to->dane.trecs == NULL) {
226        SSLerr(SSL_F_SSL_DANE_DUP, ERR_R_MALLOC_FAILURE);
227        return 0;
228    }
229
230    for (i = 0; i < num; ++i) {
231        danetls_record *t = sk_danetls_record_value(from->dane.trecs, i);
232
233        if (SSL_dane_tlsa_add(to, t->usage, t->selector, t->mtype,
234                              t->data, t->dlen) <= 0)
235            return 0;
236    }
237    return 1;
238}
239
240static int dane_mtype_set(struct dane_ctx_st *dctx,
241                          const EVP_MD *md, uint8_t mtype, uint8_t ord)
242{
243    int i;
244
245    if (mtype == DANETLS_MATCHING_FULL && md != NULL) {
246        SSLerr(SSL_F_DANE_MTYPE_SET, SSL_R_DANE_CANNOT_OVERRIDE_MTYPE_FULL);
247        return 0;
248    }
249
250    if (mtype > dctx->mdmax) {
251        const EVP_MD **mdevp;
252        uint8_t *mdord;
253        int n = ((int)mtype) + 1;
254
255        mdevp = OPENSSL_realloc(dctx->mdevp, n * sizeof(*mdevp));
256        if (mdevp == NULL) {
257            SSLerr(SSL_F_DANE_MTYPE_SET, ERR_R_MALLOC_FAILURE);
258            return -1;
259        }
260        dctx->mdevp = mdevp;
261
262        mdord = OPENSSL_realloc(dctx->mdord, n * sizeof(*mdord));
263        if (mdord == NULL) {
264            SSLerr(SSL_F_DANE_MTYPE_SET, ERR_R_MALLOC_FAILURE);
265            return -1;
266        }
267        dctx->mdord = mdord;
268
269        /* Zero-fill any gaps */
270        for (i = dctx->mdmax + 1; i < mtype; ++i) {
271            mdevp[i] = NULL;
272            mdord[i] = 0;
273        }
274
275        dctx->mdmax = mtype;
276    }
277
278    dctx->mdevp[mtype] = md;
279    /* Coerce ordinal of disabled matching types to 0 */
280    dctx->mdord[mtype] = (md == NULL) ? 0 : ord;
281
282    return 1;
283}
284
285static const EVP_MD *tlsa_md_get(SSL_DANE *dane, uint8_t mtype)
286{
287    if (mtype > dane->dctx->mdmax)
288        return NULL;
289    return dane->dctx->mdevp[mtype];
290}
291
292static int dane_tlsa_add(SSL_DANE *dane,
293                         uint8_t usage,
294                         uint8_t selector,
295                         uint8_t mtype, unsigned const char *data, size_t dlen)
296{
297    danetls_record *t;
298    const EVP_MD *md = NULL;
299    int ilen = (int)dlen;
300    int i;
301    int num;
302
303    if (dane->trecs == NULL) {
304        SSLerr(SSL_F_DANE_TLSA_ADD, SSL_R_DANE_NOT_ENABLED);
305        return -1;
306    }
307
308    if (ilen < 0 || dlen != (size_t)ilen) {
309        SSLerr(SSL_F_DANE_TLSA_ADD, SSL_R_DANE_TLSA_BAD_DATA_LENGTH);
310        return 0;
311    }
312
313    if (usage > DANETLS_USAGE_LAST) {
314        SSLerr(SSL_F_DANE_TLSA_ADD, SSL_R_DANE_TLSA_BAD_CERTIFICATE_USAGE);
315        return 0;
316    }
317
318    if (selector > DANETLS_SELECTOR_LAST) {
319        SSLerr(SSL_F_DANE_TLSA_ADD, SSL_R_DANE_TLSA_BAD_SELECTOR);
320        return 0;
321    }
322
323    if (mtype != DANETLS_MATCHING_FULL) {
324        md = tlsa_md_get(dane, mtype);
325        if (md == NULL) {
326            SSLerr(SSL_F_DANE_TLSA_ADD, SSL_R_DANE_TLSA_BAD_MATCHING_TYPE);
327            return 0;
328        }
329    }
330
331    if (md != NULL && dlen != (size_t)EVP_MD_size(md)) {
332        SSLerr(SSL_F_DANE_TLSA_ADD, SSL_R_DANE_TLSA_BAD_DIGEST_LENGTH);
333        return 0;
334    }
335    if (!data) {
336        SSLerr(SSL_F_DANE_TLSA_ADD, SSL_R_DANE_TLSA_NULL_DATA);
337        return 0;
338    }
339
340    if ((t = OPENSSL_zalloc(sizeof(*t))) == NULL) {
341        SSLerr(SSL_F_DANE_TLSA_ADD, ERR_R_MALLOC_FAILURE);
342        return -1;
343    }
344
345    t->usage = usage;
346    t->selector = selector;
347    t->mtype = mtype;
348    t->data = OPENSSL_malloc(dlen);
349    if (t->data == NULL) {
350        tlsa_free(t);
351        SSLerr(SSL_F_DANE_TLSA_ADD, ERR_R_MALLOC_FAILURE);
352        return -1;
353    }
354    memcpy(t->data, data, dlen);
355    t->dlen = dlen;
356
357    /* Validate and cache full certificate or public key */
358    if (mtype == DANETLS_MATCHING_FULL) {
359        const unsigned char *p = data;
360        X509 *cert = NULL;
361        EVP_PKEY *pkey = NULL;
362
363        switch (selector) {
364        case DANETLS_SELECTOR_CERT:
365            if (!d2i_X509(&cert, &p, ilen) || p < data ||
366                dlen != (size_t)(p - data)) {
367                tlsa_free(t);
368                SSLerr(SSL_F_DANE_TLSA_ADD, SSL_R_DANE_TLSA_BAD_CERTIFICATE);
369                return 0;
370            }
371            if (X509_get0_pubkey(cert) == NULL) {
372                tlsa_free(t);
373                SSLerr(SSL_F_DANE_TLSA_ADD, SSL_R_DANE_TLSA_BAD_CERTIFICATE);
374                return 0;
375            }
376
377            if ((DANETLS_USAGE_BIT(usage) & DANETLS_TA_MASK) == 0) {
378                X509_free(cert);
379                break;
380            }
381
382            /*
383             * For usage DANE-TA(2), we support authentication via "2 0 0" TLSA
384             * records that contain full certificates of trust-anchors that are
385             * not present in the wire chain.  For usage PKIX-TA(0), we augment
386             * the chain with untrusted Full(0) certificates from DNS, in case
387             * they are missing from the chain.
388             */
389            if ((dane->certs == NULL &&
390                 (dane->certs = sk_X509_new_null()) == NULL) ||
391                !sk_X509_push(dane->certs, cert)) {
392                SSLerr(SSL_F_DANE_TLSA_ADD, ERR_R_MALLOC_FAILURE);
393                X509_free(cert);
394                tlsa_free(t);
395                return -1;
396            }
397            break;
398
399        case DANETLS_SELECTOR_SPKI:
400            if (!d2i_PUBKEY(&pkey, &p, ilen) || p < data ||
401                dlen != (size_t)(p - data)) {
402                tlsa_free(t);
403                SSLerr(SSL_F_DANE_TLSA_ADD, SSL_R_DANE_TLSA_BAD_PUBLIC_KEY);
404                return 0;
405            }
406
407            /*
408             * For usage DANE-TA(2), we support authentication via "2 1 0" TLSA
409             * records that contain full bare keys of trust-anchors that are
410             * not present in the wire chain.
411             */
412            if (usage == DANETLS_USAGE_DANE_TA)
413                t->spki = pkey;
414            else
415                EVP_PKEY_free(pkey);
416            break;
417        }
418    }
419
420    /*-
421     * Find the right insertion point for the new record.
422     *
423     * See crypto/x509/x509_vfy.c.  We sort DANE-EE(3) records first, so that
424     * they can be processed first, as they require no chain building, and no
425     * expiration or hostname checks.  Because DANE-EE(3) is numerically
426     * largest, this is accomplished via descending sort by "usage".
427     *
428     * We also sort in descending order by matching ordinal to simplify
429     * the implementation of digest agility in the verification code.
430     *
431     * The choice of order for the selector is not significant, so we
432     * use the same descending order for consistency.
433     */
434    num = sk_danetls_record_num(dane->trecs);
435    for (i = 0; i < num; ++i) {
436        danetls_record *rec = sk_danetls_record_value(dane->trecs, i);
437
438        if (rec->usage > usage)
439            continue;
440        if (rec->usage < usage)
441            break;
442        if (rec->selector > selector)
443            continue;
444        if (rec->selector < selector)
445            break;
446        if (dane->dctx->mdord[rec->mtype] > dane->dctx->mdord[mtype])
447            continue;
448        break;
449    }
450
451    if (!sk_danetls_record_insert(dane->trecs, t, i)) {
452        tlsa_free(t);
453        SSLerr(SSL_F_DANE_TLSA_ADD, ERR_R_MALLOC_FAILURE);
454        return -1;
455    }
456    dane->umask |= DANETLS_USAGE_BIT(usage);
457
458    return 1;
459}
460
461/*
462 * Return 0 if there is only one version configured and it was disabled
463 * at configure time.  Return 1 otherwise.
464 */
465static int ssl_check_allowed_versions(int min_version, int max_version)
466{
467    int minisdtls = 0, maxisdtls = 0;
468
469    /* Figure out if we're doing DTLS versions or TLS versions */
470    if (min_version == DTLS1_BAD_VER
471        || min_version >> 8 == DTLS1_VERSION_MAJOR)
472        minisdtls = 1;
473    if (max_version == DTLS1_BAD_VER
474        || max_version >> 8 == DTLS1_VERSION_MAJOR)
475        maxisdtls = 1;
476    /* A wildcard version of 0 could be DTLS or TLS. */
477    if ((minisdtls && !maxisdtls && max_version != 0)
478        || (maxisdtls && !minisdtls && min_version != 0)) {
479        /* Mixing DTLS and TLS versions will lead to sadness; deny it. */
480        return 0;
481    }
482
483    if (minisdtls || maxisdtls) {
484        /* Do DTLS version checks. */
485        if (min_version == 0)
486            /* Ignore DTLS1_BAD_VER */
487            min_version = DTLS1_VERSION;
488        if (max_version == 0)
489            max_version = DTLS1_2_VERSION;
490#ifdef OPENSSL_NO_DTLS1_2
491        if (max_version == DTLS1_2_VERSION)
492            max_version = DTLS1_VERSION;
493#endif
494#ifdef OPENSSL_NO_DTLS1
495        if (min_version == DTLS1_VERSION)
496            min_version = DTLS1_2_VERSION;
497#endif
498        /* Done massaging versions; do the check. */
499        if (0
500#ifdef OPENSSL_NO_DTLS1
501            || (DTLS_VERSION_GE(min_version, DTLS1_VERSION)
502                && DTLS_VERSION_GE(DTLS1_VERSION, max_version))
503#endif
504#ifdef OPENSSL_NO_DTLS1_2
505            || (DTLS_VERSION_GE(min_version, DTLS1_2_VERSION)
506                && DTLS_VERSION_GE(DTLS1_2_VERSION, max_version))
507#endif
508            )
509            return 0;
510    } else {
511        /* Regular TLS version checks. */
512        if (min_version == 0)
513            min_version = SSL3_VERSION;
514        if (max_version == 0)
515            max_version = TLS1_3_VERSION;
516#ifdef OPENSSL_NO_TLS1_3
517        if (max_version == TLS1_3_VERSION)
518            max_version = TLS1_2_VERSION;
519#endif
520#ifdef OPENSSL_NO_TLS1_2
521        if (max_version == TLS1_2_VERSION)
522            max_version = TLS1_1_VERSION;
523#endif
524#ifdef OPENSSL_NO_TLS1_1
525        if (max_version == TLS1_1_VERSION)
526            max_version = TLS1_VERSION;
527#endif
528#ifdef OPENSSL_NO_TLS1
529        if (max_version == TLS1_VERSION)
530            max_version = SSL3_VERSION;
531#endif
532#ifdef OPENSSL_NO_SSL3
533        if (min_version == SSL3_VERSION)
534            min_version = TLS1_VERSION;
535#endif
536#ifdef OPENSSL_NO_TLS1
537        if (min_version == TLS1_VERSION)
538            min_version = TLS1_1_VERSION;
539#endif
540#ifdef OPENSSL_NO_TLS1_1
541        if (min_version == TLS1_1_VERSION)
542            min_version = TLS1_2_VERSION;
543#endif
544#ifdef OPENSSL_NO_TLS1_2
545        if (min_version == TLS1_2_VERSION)
546            min_version = TLS1_3_VERSION;
547#endif
548        /* Done massaging versions; do the check. */
549        if (0
550#ifdef OPENSSL_NO_SSL3
551            || (min_version <= SSL3_VERSION && SSL3_VERSION <= max_version)
552#endif
553#ifdef OPENSSL_NO_TLS1
554            || (min_version <= TLS1_VERSION && TLS1_VERSION <= max_version)
555#endif
556#ifdef OPENSSL_NO_TLS1_1
557            || (min_version <= TLS1_1_VERSION && TLS1_1_VERSION <= max_version)
558#endif
559#ifdef OPENSSL_NO_TLS1_2
560            || (min_version <= TLS1_2_VERSION && TLS1_2_VERSION <= max_version)
561#endif
562#ifdef OPENSSL_NO_TLS1_3
563            || (min_version <= TLS1_3_VERSION && TLS1_3_VERSION <= max_version)
564#endif
565            )
566            return 0;
567    }
568    return 1;
569}
570
571static void clear_ciphers(SSL *s)
572{
573    /* clear the current cipher */
574    ssl_clear_cipher_ctx(s);
575    ssl_clear_hash_ctx(&s->read_hash);
576    ssl_clear_hash_ctx(&s->write_hash);
577}
578
579int SSL_clear(SSL *s)
580{
581    if (s->method == NULL) {
582        SSLerr(SSL_F_SSL_CLEAR, SSL_R_NO_METHOD_SPECIFIED);
583        return 0;
584    }
585
586    if (ssl_clear_bad_session(s)) {
587        SSL_SESSION_free(s->session);
588        s->session = NULL;
589    }
590    SSL_SESSION_free(s->psksession);
591    s->psksession = NULL;
592    OPENSSL_free(s->psksession_id);
593    s->psksession_id = NULL;
594    s->psksession_id_len = 0;
595    s->hello_retry_request = 0;
596    s->sent_tickets = 0;
597
598    s->error = 0;
599    s->hit = 0;
600    s->shutdown = 0;
601
602    if (s->renegotiate) {
603        SSLerr(SSL_F_SSL_CLEAR, ERR_R_INTERNAL_ERROR);
604        return 0;
605    }
606
607    ossl_statem_clear(s);
608
609    s->version = s->method->version;
610    s->client_version = s->version;
611    s->rwstate = SSL_NOTHING;
612
613    BUF_MEM_free(s->init_buf);
614    s->init_buf = NULL;
615    clear_ciphers(s);
616    s->first_packet = 0;
617
618    s->key_update = SSL_KEY_UPDATE_NONE;
619
620    EVP_MD_CTX_free(s->pha_dgst);
621    s->pha_dgst = NULL;
622
623    /* Reset DANE verification result state */
624    s->dane.mdpth = -1;
625    s->dane.pdpth = -1;
626    X509_free(s->dane.mcert);
627    s->dane.mcert = NULL;
628    s->dane.mtlsa = NULL;
629
630    /* Clear the verification result peername */
631    X509_VERIFY_PARAM_move_peername(s->param, NULL);
632
633    /* Clear any shared connection state */
634    OPENSSL_free(s->shared_sigalgs);
635    s->shared_sigalgs = NULL;
636    s->shared_sigalgslen = 0;
637
638    /*
639     * Check to see if we were changed into a different method, if so, revert
640     * back.
641     */
642    if (s->method != s->ctx->method) {
643        s->method->ssl_free(s);
644        s->method = s->ctx->method;
645        if (!s->method->ssl_new(s))
646            return 0;
647    } else {
648        if (!s->method->ssl_clear(s))
649            return 0;
650    }
651
652    RECORD_LAYER_clear(&s->rlayer);
653
654    return 1;
655}
656
657/** Used to change an SSL_CTXs default SSL method type */
658int SSL_CTX_set_ssl_version(SSL_CTX *ctx, const SSL_METHOD *meth)
659{
660    STACK_OF(SSL_CIPHER) *sk;
661
662    ctx->method = meth;
663
664    if (!SSL_CTX_set_ciphersuites(ctx, TLS_DEFAULT_CIPHERSUITES)) {
665        SSLerr(SSL_F_SSL_CTX_SET_SSL_VERSION, SSL_R_SSL_LIBRARY_HAS_NO_CIPHERS);
666        return 0;
667    }
668    sk = ssl_create_cipher_list(ctx->method,
669                                ctx->tls13_ciphersuites,
670                                &(ctx->cipher_list),
671                                &(ctx->cipher_list_by_id),
672                                SSL_DEFAULT_CIPHER_LIST, ctx->cert);
673    if ((sk == NULL) || (sk_SSL_CIPHER_num(sk) <= 0)) {
674        SSLerr(SSL_F_SSL_CTX_SET_SSL_VERSION, SSL_R_SSL_LIBRARY_HAS_NO_CIPHERS);
675        return 0;
676    }
677    return 1;
678}
679
680SSL *SSL_new(SSL_CTX *ctx)
681{
682    SSL *s;
683
684    if (ctx == NULL) {
685        SSLerr(SSL_F_SSL_NEW, SSL_R_NULL_SSL_CTX);
686        return NULL;
687    }
688    if (ctx->method == NULL) {
689        SSLerr(SSL_F_SSL_NEW, SSL_R_SSL_CTX_HAS_NO_DEFAULT_SSL_VERSION);
690        return NULL;
691    }
692
693    s = OPENSSL_zalloc(sizeof(*s));
694    if (s == NULL)
695        goto err;
696
697    s->references = 1;
698    s->lock = CRYPTO_THREAD_lock_new();
699    if (s->lock == NULL) {
700        OPENSSL_free(s);
701        s = NULL;
702        goto err;
703    }
704
705    RECORD_LAYER_init(&s->rlayer, s);
706
707    s->options = ctx->options;
708    s->dane.flags = ctx->dane.flags;
709    s->min_proto_version = ctx->min_proto_version;
710    s->max_proto_version = ctx->max_proto_version;
711    s->mode = ctx->mode;
712    s->max_cert_list = ctx->max_cert_list;
713    s->max_early_data = ctx->max_early_data;
714    s->recv_max_early_data = ctx->recv_max_early_data;
715    s->num_tickets = ctx->num_tickets;
716    s->pha_enabled = ctx->pha_enabled;
717
718    /* Shallow copy of the ciphersuites stack */
719    s->tls13_ciphersuites = sk_SSL_CIPHER_dup(ctx->tls13_ciphersuites);
720    if (s->tls13_ciphersuites == NULL)
721        goto err;
722
723    /*
724     * Earlier library versions used to copy the pointer to the CERT, not
725     * its contents; only when setting new parameters for the per-SSL
726     * copy, ssl_cert_new would be called (and the direct reference to
727     * the per-SSL_CTX settings would be lost, but those still were
728     * indirectly accessed for various purposes, and for that reason they
729     * used to be known as s->ctx->default_cert). Now we don't look at the
730     * SSL_CTX's CERT after having duplicated it once.
731     */
732    s->cert = ssl_cert_dup(ctx->cert);
733    if (s->cert == NULL)
734        goto err;
735
736    RECORD_LAYER_set_read_ahead(&s->rlayer, ctx->read_ahead);
737    s->msg_callback = ctx->msg_callback;
738    s->msg_callback_arg = ctx->msg_callback_arg;
739    s->verify_mode = ctx->verify_mode;
740    s->not_resumable_session_cb = ctx->not_resumable_session_cb;
741    s->record_padding_cb = ctx->record_padding_cb;
742    s->record_padding_arg = ctx->record_padding_arg;
743    s->block_padding = ctx->block_padding;
744    s->sid_ctx_length = ctx->sid_ctx_length;
745    if (!ossl_assert(s->sid_ctx_length <= sizeof(s->sid_ctx)))
746        goto err;
747    memcpy(&s->sid_ctx, &ctx->sid_ctx, sizeof(s->sid_ctx));
748    s->verify_callback = ctx->default_verify_callback;
749    s->generate_session_id = ctx->generate_session_id;
750
751    s->param = X509_VERIFY_PARAM_new();
752    if (s->param == NULL)
753        goto err;
754    X509_VERIFY_PARAM_inherit(s->param, ctx->param);
755    s->quiet_shutdown = ctx->quiet_shutdown;
756
757    s->ext.max_fragment_len_mode = ctx->ext.max_fragment_len_mode;
758    s->max_send_fragment = ctx->max_send_fragment;
759    s->split_send_fragment = ctx->split_send_fragment;
760    s->max_pipelines = ctx->max_pipelines;
761    if (s->max_pipelines > 1)
762        RECORD_LAYER_set_read_ahead(&s->rlayer, 1);
763    if (ctx->default_read_buf_len > 0)
764        SSL_set_default_read_buffer_len(s, ctx->default_read_buf_len);
765
766    SSL_CTX_up_ref(ctx);
767    s->ctx = ctx;
768    s->ext.debug_cb = 0;
769    s->ext.debug_arg = NULL;
770    s->ext.ticket_expected = 0;
771    s->ext.status_type = ctx->ext.status_type;
772    s->ext.status_expected = 0;
773    s->ext.ocsp.ids = NULL;
774    s->ext.ocsp.exts = NULL;
775    s->ext.ocsp.resp = NULL;
776    s->ext.ocsp.resp_len = 0;
777    SSL_CTX_up_ref(ctx);
778    s->session_ctx = ctx;
779#ifndef OPENSSL_NO_EC
780    if (ctx->ext.ecpointformats) {
781        s->ext.ecpointformats =
782            OPENSSL_memdup(ctx->ext.ecpointformats,
783                           ctx->ext.ecpointformats_len);
784        if (!s->ext.ecpointformats) {
785            s->ext.ecpointformats_len = 0;
786            goto err;
787        }
788        s->ext.ecpointformats_len =
789            ctx->ext.ecpointformats_len;
790    }
791    if (ctx->ext.supportedgroups) {
792        s->ext.supportedgroups =
793            OPENSSL_memdup(ctx->ext.supportedgroups,
794                           ctx->ext.supportedgroups_len
795                                * sizeof(*ctx->ext.supportedgroups));
796        if (!s->ext.supportedgroups) {
797            s->ext.supportedgroups_len = 0;
798            goto err;
799        }
800        s->ext.supportedgroups_len = ctx->ext.supportedgroups_len;
801    }
802#endif
803#ifndef OPENSSL_NO_NEXTPROTONEG
804    s->ext.npn = NULL;
805#endif
806
807    if (s->ctx->ext.alpn) {
808        s->ext.alpn = OPENSSL_malloc(s->ctx->ext.alpn_len);
809        if (s->ext.alpn == NULL) {
810            s->ext.alpn_len = 0;
811            goto err;
812        }
813        memcpy(s->ext.alpn, s->ctx->ext.alpn, s->ctx->ext.alpn_len);
814        s->ext.alpn_len = s->ctx->ext.alpn_len;
815    }
816
817    s->verified_chain = NULL;
818    s->verify_result = X509_V_OK;
819
820    s->default_passwd_callback = ctx->default_passwd_callback;
821    s->default_passwd_callback_userdata = ctx->default_passwd_callback_userdata;
822
823    s->method = ctx->method;
824
825    s->key_update = SSL_KEY_UPDATE_NONE;
826
827    s->allow_early_data_cb = ctx->allow_early_data_cb;
828    s->allow_early_data_cb_data = ctx->allow_early_data_cb_data;
829
830    if (!s->method->ssl_new(s))
831        goto err;
832
833    s->server = (ctx->method->ssl_accept == ssl_undefined_function) ? 0 : 1;
834
835    if (!SSL_clear(s))
836        goto err;
837
838    if (!CRYPTO_new_ex_data(CRYPTO_EX_INDEX_SSL, s, &s->ex_data))
839        goto err;
840
841#ifndef OPENSSL_NO_PSK
842    s->psk_client_callback = ctx->psk_client_callback;
843    s->psk_server_callback = ctx->psk_server_callback;
844#endif
845    s->psk_find_session_cb = ctx->psk_find_session_cb;
846    s->psk_use_session_cb = ctx->psk_use_session_cb;
847
848    s->job = NULL;
849
850#ifndef OPENSSL_NO_CT
851    if (!SSL_set_ct_validation_callback(s, ctx->ct_validation_callback,
852                                        ctx->ct_validation_callback_arg))
853        goto err;
854#endif
855
856    return s;
857 err:
858    SSL_free(s);
859    SSLerr(SSL_F_SSL_NEW, ERR_R_MALLOC_FAILURE);
860    return NULL;
861}
862
863int SSL_is_dtls(const SSL *s)
864{
865    return SSL_IS_DTLS(s) ? 1 : 0;
866}
867
868int SSL_up_ref(SSL *s)
869{
870    int i;
871
872    if (CRYPTO_UP_REF(&s->references, &i, s->lock) <= 0)
873        return 0;
874
875    REF_PRINT_COUNT("SSL", s);
876    REF_ASSERT_ISNT(i < 2);
877    return ((i > 1) ? 1 : 0);
878}
879
880int SSL_CTX_set_session_id_context(SSL_CTX *ctx, const unsigned char *sid_ctx,
881                                   unsigned int sid_ctx_len)
882{
883    if (sid_ctx_len > SSL_MAX_SID_CTX_LENGTH) {
884        SSLerr(SSL_F_SSL_CTX_SET_SESSION_ID_CONTEXT,
885               SSL_R_SSL_SESSION_ID_CONTEXT_TOO_LONG);
886        return 0;
887    }
888    ctx->sid_ctx_length = sid_ctx_len;
889    memcpy(ctx->sid_ctx, sid_ctx, sid_ctx_len);
890
891    return 1;
892}
893
894int SSL_set_session_id_context(SSL *ssl, const unsigned char *sid_ctx,
895                               unsigned int sid_ctx_len)
896{
897    if (sid_ctx_len > SSL_MAX_SID_CTX_LENGTH) {
898        SSLerr(SSL_F_SSL_SET_SESSION_ID_CONTEXT,
899               SSL_R_SSL_SESSION_ID_CONTEXT_TOO_LONG);
900        return 0;
901    }
902    ssl->sid_ctx_length = sid_ctx_len;
903    memcpy(ssl->sid_ctx, sid_ctx, sid_ctx_len);
904
905    return 1;
906}
907
908int SSL_CTX_set_generate_session_id(SSL_CTX *ctx, GEN_SESSION_CB cb)
909{
910    CRYPTO_THREAD_write_lock(ctx->lock);
911    ctx->generate_session_id = cb;
912    CRYPTO_THREAD_unlock(ctx->lock);
913    return 1;
914}
915
916int SSL_set_generate_session_id(SSL *ssl, GEN_SESSION_CB cb)
917{
918    CRYPTO_THREAD_write_lock(ssl->lock);
919    ssl->generate_session_id = cb;
920    CRYPTO_THREAD_unlock(ssl->lock);
921    return 1;
922}
923
924int SSL_has_matching_session_id(const SSL *ssl, const unsigned char *id,
925                                unsigned int id_len)
926{
927    /*
928     * A quick examination of SSL_SESSION_hash and SSL_SESSION_cmp shows how
929     * we can "construct" a session to give us the desired check - i.e. to
930     * find if there's a session in the hash table that would conflict with
931     * any new session built out of this id/id_len and the ssl_version in use
932     * by this SSL.
933     */
934    SSL_SESSION r, *p;
935
936    if (id_len > sizeof(r.session_id))
937        return 0;
938
939    r.ssl_version = ssl->version;
940    r.session_id_length = id_len;
941    memcpy(r.session_id, id, id_len);
942
943    CRYPTO_THREAD_read_lock(ssl->session_ctx->lock);
944    p = lh_SSL_SESSION_retrieve(ssl->session_ctx->sessions, &r);
945    CRYPTO_THREAD_unlock(ssl->session_ctx->lock);
946    return (p != NULL);
947}
948
949int SSL_CTX_set_purpose(SSL_CTX *s, int purpose)
950{
951    return X509_VERIFY_PARAM_set_purpose(s->param, purpose);
952}
953
954int SSL_set_purpose(SSL *s, int purpose)
955{
956    return X509_VERIFY_PARAM_set_purpose(s->param, purpose);
957}
958
959int SSL_CTX_set_trust(SSL_CTX *s, int trust)
960{
961    return X509_VERIFY_PARAM_set_trust(s->param, trust);
962}
963
964int SSL_set_trust(SSL *s, int trust)
965{
966    return X509_VERIFY_PARAM_set_trust(s->param, trust);
967}
968
969int SSL_set1_host(SSL *s, const char *hostname)
970{
971    return X509_VERIFY_PARAM_set1_host(s->param, hostname, 0);
972}
973
974int SSL_add1_host(SSL *s, const char *hostname)
975{
976    return X509_VERIFY_PARAM_add1_host(s->param, hostname, 0);
977}
978
979void SSL_set_hostflags(SSL *s, unsigned int flags)
980{
981    X509_VERIFY_PARAM_set_hostflags(s->param, flags);
982}
983
984const char *SSL_get0_peername(SSL *s)
985{
986    return X509_VERIFY_PARAM_get0_peername(s->param);
987}
988
989int SSL_CTX_dane_enable(SSL_CTX *ctx)
990{
991    return dane_ctx_enable(&ctx->dane);
992}
993
994unsigned long SSL_CTX_dane_set_flags(SSL_CTX *ctx, unsigned long flags)
995{
996    unsigned long orig = ctx->dane.flags;
997
998    ctx->dane.flags |= flags;
999    return orig;
1000}
1001
1002unsigned long SSL_CTX_dane_clear_flags(SSL_CTX *ctx, unsigned long flags)
1003{
1004    unsigned long orig = ctx->dane.flags;
1005
1006    ctx->dane.flags &= ~flags;
1007    return orig;
1008}
1009
1010int SSL_dane_enable(SSL *s, const char *basedomain)
1011{
1012    SSL_DANE *dane = &s->dane;
1013
1014    if (s->ctx->dane.mdmax == 0) {
1015        SSLerr(SSL_F_SSL_DANE_ENABLE, SSL_R_CONTEXT_NOT_DANE_ENABLED);
1016        return 0;
1017    }
1018    if (dane->trecs != NULL) {
1019        SSLerr(SSL_F_SSL_DANE_ENABLE, SSL_R_DANE_ALREADY_ENABLED);
1020        return 0;
1021    }
1022
1023    /*
1024     * Default SNI name.  This rejects empty names, while set1_host below
1025     * accepts them and disables host name checks.  To avoid side-effects with
1026     * invalid input, set the SNI name first.
1027     */
1028    if (s->ext.hostname == NULL) {
1029        if (!SSL_set_tlsext_host_name(s, basedomain)) {
1030            SSLerr(SSL_F_SSL_DANE_ENABLE, SSL_R_ERROR_SETTING_TLSA_BASE_DOMAIN);
1031            return -1;
1032        }
1033    }
1034
1035    /* Primary RFC6125 reference identifier */
1036    if (!X509_VERIFY_PARAM_set1_host(s->param, basedomain, 0)) {
1037        SSLerr(SSL_F_SSL_DANE_ENABLE, SSL_R_ERROR_SETTING_TLSA_BASE_DOMAIN);
1038        return -1;
1039    }
1040
1041    dane->mdpth = -1;
1042    dane->pdpth = -1;
1043    dane->dctx = &s->ctx->dane;
1044    dane->trecs = sk_danetls_record_new_null();
1045
1046    if (dane->trecs == NULL) {
1047        SSLerr(SSL_F_SSL_DANE_ENABLE, ERR_R_MALLOC_FAILURE);
1048        return -1;
1049    }
1050    return 1;
1051}
1052
1053unsigned long SSL_dane_set_flags(SSL *ssl, unsigned long flags)
1054{
1055    unsigned long orig = ssl->dane.flags;
1056
1057    ssl->dane.flags |= flags;
1058    return orig;
1059}
1060
1061unsigned long SSL_dane_clear_flags(SSL *ssl, unsigned long flags)
1062{
1063    unsigned long orig = ssl->dane.flags;
1064
1065    ssl->dane.flags &= ~flags;
1066    return orig;
1067}
1068
1069int SSL_get0_dane_authority(SSL *s, X509 **mcert, EVP_PKEY **mspki)
1070{
1071    SSL_DANE *dane = &s->dane;
1072
1073    if (!DANETLS_ENABLED(dane) || s->verify_result != X509_V_OK)
1074        return -1;
1075    if (dane->mtlsa) {
1076        if (mcert)
1077            *mcert = dane->mcert;
1078        if (mspki)
1079            *mspki = (dane->mcert == NULL) ? dane->mtlsa->spki : NULL;
1080    }
1081    return dane->mdpth;
1082}
1083
1084int SSL_get0_dane_tlsa(SSL *s, uint8_t *usage, uint8_t *selector,
1085                       uint8_t *mtype, unsigned const char **data, size_t *dlen)
1086{
1087    SSL_DANE *dane = &s->dane;
1088
1089    if (!DANETLS_ENABLED(dane) || s->verify_result != X509_V_OK)
1090        return -1;
1091    if (dane->mtlsa) {
1092        if (usage)
1093            *usage = dane->mtlsa->usage;
1094        if (selector)
1095            *selector = dane->mtlsa->selector;
1096        if (mtype)
1097            *mtype = dane->mtlsa->mtype;
1098        if (data)
1099            *data = dane->mtlsa->data;
1100        if (dlen)
1101            *dlen = dane->mtlsa->dlen;
1102    }
1103    return dane->mdpth;
1104}
1105
1106SSL_DANE *SSL_get0_dane(SSL *s)
1107{
1108    return &s->dane;
1109}
1110
1111int SSL_dane_tlsa_add(SSL *s, uint8_t usage, uint8_t selector,
1112                      uint8_t mtype, unsigned const char *data, size_t dlen)
1113{
1114    return dane_tlsa_add(&s->dane, usage, selector, mtype, data, dlen);
1115}
1116
1117int SSL_CTX_dane_mtype_set(SSL_CTX *ctx, const EVP_MD *md, uint8_t mtype,
1118                           uint8_t ord)
1119{
1120    return dane_mtype_set(&ctx->dane, md, mtype, ord);
1121}
1122
1123int SSL_CTX_set1_param(SSL_CTX *ctx, X509_VERIFY_PARAM *vpm)
1124{
1125    return X509_VERIFY_PARAM_set1(ctx->param, vpm);
1126}
1127
1128int SSL_set1_param(SSL *ssl, X509_VERIFY_PARAM *vpm)
1129{
1130    return X509_VERIFY_PARAM_set1(ssl->param, vpm);
1131}
1132
1133X509_VERIFY_PARAM *SSL_CTX_get0_param(SSL_CTX *ctx)
1134{
1135    return ctx->param;
1136}
1137
1138X509_VERIFY_PARAM *SSL_get0_param(SSL *ssl)
1139{
1140    return ssl->param;
1141}
1142
1143void SSL_certs_clear(SSL *s)
1144{
1145    ssl_cert_clear_certs(s->cert);
1146}
1147
1148void SSL_free(SSL *s)
1149{
1150    int i;
1151
1152    if (s == NULL)
1153        return;
1154    CRYPTO_DOWN_REF(&s->references, &i, s->lock);
1155    REF_PRINT_COUNT("SSL", s);
1156    if (i > 0)
1157        return;
1158    REF_ASSERT_ISNT(i < 0);
1159
1160    X509_VERIFY_PARAM_free(s->param);
1161    dane_final(&s->dane);
1162    CRYPTO_free_ex_data(CRYPTO_EX_INDEX_SSL, s, &s->ex_data);
1163
1164    RECORD_LAYER_release(&s->rlayer);
1165
1166    /* Ignore return value */
1167    ssl_free_wbio_buffer(s);
1168
1169    BIO_free_all(s->wbio);
1170    s->wbio = NULL;
1171    BIO_free_all(s->rbio);
1172    s->rbio = NULL;
1173
1174    BUF_MEM_free(s->init_buf);
1175
1176    /* add extra stuff */
1177    sk_SSL_CIPHER_free(s->cipher_list);
1178    sk_SSL_CIPHER_free(s->cipher_list_by_id);
1179    sk_SSL_CIPHER_free(s->tls13_ciphersuites);
1180    sk_SSL_CIPHER_free(s->peer_ciphers);
1181
1182    /* Make the next call work :-) */
1183    if (s->session != NULL) {
1184        ssl_clear_bad_session(s);
1185        SSL_SESSION_free(s->session);
1186    }
1187    SSL_SESSION_free(s->psksession);
1188    OPENSSL_free(s->psksession_id);
1189
1190    clear_ciphers(s);
1191
1192    ssl_cert_free(s->cert);
1193    OPENSSL_free(s->shared_sigalgs);
1194    /* Free up if allocated */
1195
1196    OPENSSL_free(s->ext.hostname);
1197    SSL_CTX_free(s->session_ctx);
1198#ifndef OPENSSL_NO_EC
1199    OPENSSL_free(s->ext.ecpointformats);
1200    OPENSSL_free(s->ext.peer_ecpointformats);
1201    OPENSSL_free(s->ext.supportedgroups);
1202    OPENSSL_free(s->ext.peer_supportedgroups);
1203#endif                          /* OPENSSL_NO_EC */
1204    sk_X509_EXTENSION_pop_free(s->ext.ocsp.exts, X509_EXTENSION_free);
1205#ifndef OPENSSL_NO_OCSP
1206    sk_OCSP_RESPID_pop_free(s->ext.ocsp.ids, OCSP_RESPID_free);
1207#endif
1208#ifndef OPENSSL_NO_CT
1209    SCT_LIST_free(s->scts);
1210    OPENSSL_free(s->ext.scts);
1211#endif
1212    OPENSSL_free(s->ext.ocsp.resp);
1213    OPENSSL_free(s->ext.alpn);
1214    OPENSSL_free(s->ext.tls13_cookie);
1215    if (s->clienthello != NULL)
1216        OPENSSL_free(s->clienthello->pre_proc_exts);
1217    OPENSSL_free(s->clienthello);
1218    OPENSSL_free(s->pha_context);
1219    EVP_MD_CTX_free(s->pha_dgst);
1220
1221    sk_X509_NAME_pop_free(s->ca_names, X509_NAME_free);
1222    sk_X509_NAME_pop_free(s->client_ca_names, X509_NAME_free);
1223
1224    sk_X509_pop_free(s->verified_chain, X509_free);
1225
1226    if (s->method != NULL)
1227        s->method->ssl_free(s);
1228
1229    SSL_CTX_free(s->ctx);
1230
1231    ASYNC_WAIT_CTX_free(s->waitctx);
1232
1233#if !defined(OPENSSL_NO_NEXTPROTONEG)
1234    OPENSSL_free(s->ext.npn);
1235#endif
1236
1237#ifndef OPENSSL_NO_SRTP
1238    sk_SRTP_PROTECTION_PROFILE_free(s->srtp_profiles);
1239#endif
1240
1241    CRYPTO_THREAD_lock_free(s->lock);
1242
1243    OPENSSL_free(s);
1244}
1245
1246void SSL_set0_rbio(SSL *s, BIO *rbio)
1247{
1248    BIO_free_all(s->rbio);
1249    s->rbio = rbio;
1250}
1251
1252void SSL_set0_wbio(SSL *s, BIO *wbio)
1253{
1254    /*
1255     * If the output buffering BIO is still in place, remove it
1256     */
1257    if (s->bbio != NULL)
1258        s->wbio = BIO_pop(s->wbio);
1259
1260    BIO_free_all(s->wbio);
1261    s->wbio = wbio;
1262
1263    /* Re-attach |bbio| to the new |wbio|. */
1264    if (s->bbio != NULL)
1265        s->wbio = BIO_push(s->bbio, s->wbio);
1266}
1267
1268void SSL_set_bio(SSL *s, BIO *rbio, BIO *wbio)
1269{
1270    /*
1271     * For historical reasons, this function has many different cases in
1272     * ownership handling.
1273     */
1274
1275    /* If nothing has changed, do nothing */
1276    if (rbio == SSL_get_rbio(s) && wbio == SSL_get_wbio(s))
1277        return;
1278
1279    /*
1280     * If the two arguments are equal then one fewer reference is granted by the
1281     * caller than we want to take
1282     */
1283    if (rbio != NULL && rbio == wbio)
1284        BIO_up_ref(rbio);
1285
1286    /*
1287     * If only the wbio is changed only adopt one reference.
1288     */
1289    if (rbio == SSL_get_rbio(s)) {
1290        SSL_set0_wbio(s, wbio);
1291        return;
1292    }
1293    /*
1294     * There is an asymmetry here for historical reasons. If only the rbio is
1295     * changed AND the rbio and wbio were originally different, then we only
1296     * adopt one reference.
1297     */
1298    if (wbio == SSL_get_wbio(s) && SSL_get_rbio(s) != SSL_get_wbio(s)) {
1299        SSL_set0_rbio(s, rbio);
1300        return;
1301    }
1302
1303    /* Otherwise, adopt both references. */
1304    SSL_set0_rbio(s, rbio);
1305    SSL_set0_wbio(s, wbio);
1306}
1307
1308BIO *SSL_get_rbio(const SSL *s)
1309{
1310    return s->rbio;
1311}
1312
1313BIO *SSL_get_wbio(const SSL *s)
1314{
1315    if (s->bbio != NULL) {
1316        /*
1317         * If |bbio| is active, the true caller-configured BIO is its
1318         * |next_bio|.
1319         */
1320        return BIO_next(s->bbio);
1321    }
1322    return s->wbio;
1323}
1324
1325int SSL_get_fd(const SSL *s)
1326{
1327    return SSL_get_rfd(s);
1328}
1329
1330int SSL_get_rfd(const SSL *s)
1331{
1332    int ret = -1;
1333    BIO *b, *r;
1334
1335    b = SSL_get_rbio(s);
1336    r = BIO_find_type(b, BIO_TYPE_DESCRIPTOR);
1337    if (r != NULL)
1338        BIO_get_fd(r, &ret);
1339    return ret;
1340}
1341
1342int SSL_get_wfd(const SSL *s)
1343{
1344    int ret = -1;
1345    BIO *b, *r;
1346
1347    b = SSL_get_wbio(s);
1348    r = BIO_find_type(b, BIO_TYPE_DESCRIPTOR);
1349    if (r != NULL)
1350        BIO_get_fd(r, &ret);
1351    return ret;
1352}
1353
1354#ifndef OPENSSL_NO_SOCK
1355int SSL_set_fd(SSL *s, int fd)
1356{
1357    int ret = 0;
1358    BIO *bio = NULL;
1359
1360    bio = BIO_new(BIO_s_socket());
1361
1362    if (bio == NULL) {
1363        SSLerr(SSL_F_SSL_SET_FD, ERR_R_BUF_LIB);
1364        goto err;
1365    }
1366    BIO_set_fd(bio, fd, BIO_NOCLOSE);
1367    SSL_set_bio(s, bio, bio);
1368#ifndef OPENSSL_NO_KTLS
1369    /*
1370     * The new socket is created successfully regardless of ktls_enable.
1371     * ktls_enable doesn't change any functionality of the socket, except
1372     * changing the setsockopt to enable the processing of ktls_start.
1373     * Thus, it is not a problem to call it for non-TLS sockets.
1374     */
1375    ktls_enable(fd);
1376#endif /* OPENSSL_NO_KTLS */
1377    ret = 1;
1378 err:
1379    return ret;
1380}
1381
1382int SSL_set_wfd(SSL *s, int fd)
1383{
1384    BIO *rbio = SSL_get_rbio(s);
1385
1386    if (rbio == NULL || BIO_method_type(rbio) != BIO_TYPE_SOCKET
1387        || (int)BIO_get_fd(rbio, NULL) != fd) {
1388        BIO *bio = BIO_new(BIO_s_socket());
1389
1390        if (bio == NULL) {
1391            SSLerr(SSL_F_SSL_SET_WFD, ERR_R_BUF_LIB);
1392            return 0;
1393        }
1394        BIO_set_fd(bio, fd, BIO_NOCLOSE);
1395        SSL_set0_wbio(s, bio);
1396#ifndef OPENSSL_NO_KTLS
1397        /*
1398         * The new socket is created successfully regardless of ktls_enable.
1399         * ktls_enable doesn't change any functionality of the socket, except
1400         * changing the setsockopt to enable the processing of ktls_start.
1401         * Thus, it is not a problem to call it for non-TLS sockets.
1402         */
1403        ktls_enable(fd);
1404#endif /* OPENSSL_NO_KTLS */
1405    } else {
1406        BIO_up_ref(rbio);
1407        SSL_set0_wbio(s, rbio);
1408    }
1409    return 1;
1410}
1411
1412int SSL_set_rfd(SSL *s, int fd)
1413{
1414    BIO *wbio = SSL_get_wbio(s);
1415
1416    if (wbio == NULL || BIO_method_type(wbio) != BIO_TYPE_SOCKET
1417        || ((int)BIO_get_fd(wbio, NULL) != fd)) {
1418        BIO *bio = BIO_new(BIO_s_socket());
1419
1420        if (bio == NULL) {
1421            SSLerr(SSL_F_SSL_SET_RFD, ERR_R_BUF_LIB);
1422            return 0;
1423        }
1424        BIO_set_fd(bio, fd, BIO_NOCLOSE);
1425        SSL_set0_rbio(s, bio);
1426    } else {
1427        BIO_up_ref(wbio);
1428        SSL_set0_rbio(s, wbio);
1429    }
1430
1431    return 1;
1432}
1433#endif
1434
1435/* return length of latest Finished message we sent, copy to 'buf' */
1436size_t SSL_get_finished(const SSL *s, void *buf, size_t count)
1437{
1438    size_t ret = 0;
1439
1440    if (s->s3 != NULL) {
1441        ret = s->s3->tmp.finish_md_len;
1442        if (count > ret)
1443            count = ret;
1444        memcpy(buf, s->s3->tmp.finish_md, count);
1445    }
1446    return ret;
1447}
1448
1449/* return length of latest Finished message we expected, copy to 'buf' */
1450size_t SSL_get_peer_finished(const SSL *s, void *buf, size_t count)
1451{
1452    size_t ret = 0;
1453
1454    if (s->s3 != NULL) {
1455        ret = s->s3->tmp.peer_finish_md_len;
1456        if (count > ret)
1457            count = ret;
1458        memcpy(buf, s->s3->tmp.peer_finish_md, count);
1459    }
1460    return ret;
1461}
1462
1463int SSL_get_verify_mode(const SSL *s)
1464{
1465    return s->verify_mode;
1466}
1467
1468int SSL_get_verify_depth(const SSL *s)
1469{
1470    return X509_VERIFY_PARAM_get_depth(s->param);
1471}
1472
1473int (*SSL_get_verify_callback(const SSL *s)) (int, X509_STORE_CTX *) {
1474    return s->verify_callback;
1475}
1476
1477int SSL_CTX_get_verify_mode(const SSL_CTX *ctx)
1478{
1479    return ctx->verify_mode;
1480}
1481
1482int SSL_CTX_get_verify_depth(const SSL_CTX *ctx)
1483{
1484    return X509_VERIFY_PARAM_get_depth(ctx->param);
1485}
1486
1487int (*SSL_CTX_get_verify_callback(const SSL_CTX *ctx)) (int, X509_STORE_CTX *) {
1488    return ctx->default_verify_callback;
1489}
1490
1491void SSL_set_verify(SSL *s, int mode,
1492                    int (*callback) (int ok, X509_STORE_CTX *ctx))
1493{
1494    s->verify_mode = mode;
1495    if (callback != NULL)
1496        s->verify_callback = callback;
1497}
1498
1499void SSL_set_verify_depth(SSL *s, int depth)
1500{
1501    X509_VERIFY_PARAM_set_depth(s->param, depth);
1502}
1503
1504void SSL_set_read_ahead(SSL *s, int yes)
1505{
1506    RECORD_LAYER_set_read_ahead(&s->rlayer, yes);
1507}
1508
1509int SSL_get_read_ahead(const SSL *s)
1510{
1511    return RECORD_LAYER_get_read_ahead(&s->rlayer);
1512}
1513
1514int SSL_pending(const SSL *s)
1515{
1516    size_t pending = s->method->ssl_pending(s);
1517
1518    /*
1519     * SSL_pending cannot work properly if read-ahead is enabled
1520     * (SSL_[CTX_]ctrl(..., SSL_CTRL_SET_READ_AHEAD, 1, NULL)), and it is
1521     * impossible to fix since SSL_pending cannot report errors that may be
1522     * observed while scanning the new data. (Note that SSL_pending() is
1523     * often used as a boolean value, so we'd better not return -1.)
1524     *
1525     * SSL_pending also cannot work properly if the value >INT_MAX. In that case
1526     * we just return INT_MAX.
1527     */
1528    return pending < INT_MAX ? (int)pending : INT_MAX;
1529}
1530
1531int SSL_has_pending(const SSL *s)
1532{
1533    /*
1534     * Similar to SSL_pending() but returns a 1 to indicate that we have
1535     * unprocessed data available or 0 otherwise (as opposed to the number of
1536     * bytes available). Unlike SSL_pending() this will take into account
1537     * read_ahead data. A 1 return simply indicates that we have unprocessed
1538     * data. That data may not result in any application data, or we may fail
1539     * to parse the records for some reason.
1540     */
1541    if (RECORD_LAYER_processed_read_pending(&s->rlayer))
1542        return 1;
1543
1544    return RECORD_LAYER_read_pending(&s->rlayer);
1545}
1546
1547X509 *SSL_get_peer_certificate(const SSL *s)
1548{
1549    X509 *r;
1550
1551    if ((s == NULL) || (s->session == NULL))
1552        r = NULL;
1553    else
1554        r = s->session->peer;
1555
1556    if (r == NULL)
1557        return r;
1558
1559    X509_up_ref(r);
1560
1561    return r;
1562}
1563
1564STACK_OF(X509) *SSL_get_peer_cert_chain(const SSL *s)
1565{
1566    STACK_OF(X509) *r;
1567
1568    if ((s == NULL) || (s->session == NULL))
1569        r = NULL;
1570    else
1571        r = s->session->peer_chain;
1572
1573    /*
1574     * If we are a client, cert_chain includes the peer's own certificate; if
1575     * we are a server, it does not.
1576     */
1577
1578    return r;
1579}
1580
1581/*
1582 * Now in theory, since the calling process own 't' it should be safe to
1583 * modify.  We need to be able to read f without being hassled
1584 */
1585int SSL_copy_session_id(SSL *t, const SSL *f)
1586{
1587    int i;
1588    /* Do we need to to SSL locking? */
1589    if (!SSL_set_session(t, SSL_get_session(f))) {
1590        return 0;
1591    }
1592
1593    /*
1594     * what if we are setup for one protocol version but want to talk another
1595     */
1596    if (t->method != f->method) {
1597        t->method->ssl_free(t);
1598        t->method = f->method;
1599        if (t->method->ssl_new(t) == 0)
1600            return 0;
1601    }
1602
1603    CRYPTO_UP_REF(&f->cert->references, &i, f->cert->lock);
1604    ssl_cert_free(t->cert);
1605    t->cert = f->cert;
1606    if (!SSL_set_session_id_context(t, f->sid_ctx, (int)f->sid_ctx_length)) {
1607        return 0;
1608    }
1609
1610    return 1;
1611}
1612
1613/* Fix this so it checks all the valid key/cert options */
1614int SSL_CTX_check_private_key(const SSL_CTX *ctx)
1615{
1616    if ((ctx == NULL) || (ctx->cert->key->x509 == NULL)) {
1617        SSLerr(SSL_F_SSL_CTX_CHECK_PRIVATE_KEY, SSL_R_NO_CERTIFICATE_ASSIGNED);
1618        return 0;
1619    }
1620    if (ctx->cert->key->privatekey == NULL) {
1621        SSLerr(SSL_F_SSL_CTX_CHECK_PRIVATE_KEY, SSL_R_NO_PRIVATE_KEY_ASSIGNED);
1622        return 0;
1623    }
1624    return X509_check_private_key
1625            (ctx->cert->key->x509, ctx->cert->key->privatekey);
1626}
1627
1628/* Fix this function so that it takes an optional type parameter */
1629int SSL_check_private_key(const SSL *ssl)
1630{
1631    if (ssl == NULL) {
1632        SSLerr(SSL_F_SSL_CHECK_PRIVATE_KEY, ERR_R_PASSED_NULL_PARAMETER);
1633        return 0;
1634    }
1635    if (ssl->cert->key->x509 == NULL) {
1636        SSLerr(SSL_F_SSL_CHECK_PRIVATE_KEY, SSL_R_NO_CERTIFICATE_ASSIGNED);
1637        return 0;
1638    }
1639    if (ssl->cert->key->privatekey == NULL) {
1640        SSLerr(SSL_F_SSL_CHECK_PRIVATE_KEY, SSL_R_NO_PRIVATE_KEY_ASSIGNED);
1641        return 0;
1642    }
1643    return X509_check_private_key(ssl->cert->key->x509,
1644                                   ssl->cert->key->privatekey);
1645}
1646
1647int SSL_waiting_for_async(SSL *s)
1648{
1649    if (s->job)
1650        return 1;
1651
1652    return 0;
1653}
1654
1655int SSL_get_all_async_fds(SSL *s, OSSL_ASYNC_FD *fds, size_t *numfds)
1656{
1657    ASYNC_WAIT_CTX *ctx = s->waitctx;
1658
1659    if (ctx == NULL)
1660        return 0;
1661    return ASYNC_WAIT_CTX_get_all_fds(ctx, fds, numfds);
1662}
1663
1664int SSL_get_changed_async_fds(SSL *s, OSSL_ASYNC_FD *addfd, size_t *numaddfds,
1665                              OSSL_ASYNC_FD *delfd, size_t *numdelfds)
1666{
1667    ASYNC_WAIT_CTX *ctx = s->waitctx;
1668
1669    if (ctx == NULL)
1670        return 0;
1671    return ASYNC_WAIT_CTX_get_changed_fds(ctx, addfd, numaddfds, delfd,
1672                                          numdelfds);
1673}
1674
1675int SSL_accept(SSL *s)
1676{
1677    if (s->handshake_func == NULL) {
1678        /* Not properly initialized yet */
1679        SSL_set_accept_state(s);
1680    }
1681
1682    return SSL_do_handshake(s);
1683}
1684
1685int SSL_connect(SSL *s)
1686{
1687    if (s->handshake_func == NULL) {
1688        /* Not properly initialized yet */
1689        SSL_set_connect_state(s);
1690    }
1691
1692    return SSL_do_handshake(s);
1693}
1694
1695long SSL_get_default_timeout(const SSL *s)
1696{
1697    return s->method->get_timeout();
1698}
1699
1700static int ssl_start_async_job(SSL *s, struct ssl_async_args *args,
1701                               int (*func) (void *))
1702{
1703    int ret;
1704    if (s->waitctx == NULL) {
1705        s->waitctx = ASYNC_WAIT_CTX_new();
1706        if (s->waitctx == NULL)
1707            return -1;
1708    }
1709    switch (ASYNC_start_job(&s->job, s->waitctx, &ret, func, args,
1710                            sizeof(struct ssl_async_args))) {
1711    case ASYNC_ERR:
1712        s->rwstate = SSL_NOTHING;
1713        SSLerr(SSL_F_SSL_START_ASYNC_JOB, SSL_R_FAILED_TO_INIT_ASYNC);
1714        return -1;
1715    case ASYNC_PAUSE:
1716        s->rwstate = SSL_ASYNC_PAUSED;
1717        return -1;
1718    case ASYNC_NO_JOBS:
1719        s->rwstate = SSL_ASYNC_NO_JOBS;
1720        return -1;
1721    case ASYNC_FINISH:
1722        s->job = NULL;
1723        return ret;
1724    default:
1725        s->rwstate = SSL_NOTHING;
1726        SSLerr(SSL_F_SSL_START_ASYNC_JOB, ERR_R_INTERNAL_ERROR);
1727        /* Shouldn't happen */
1728        return -1;
1729    }
1730}
1731
1732static int ssl_io_intern(void *vargs)
1733{
1734    struct ssl_async_args *args;
1735    SSL *s;
1736    void *buf;
1737    size_t num;
1738
1739    args = (struct ssl_async_args *)vargs;
1740    s = args->s;
1741    buf = args->buf;
1742    num = args->num;
1743    switch (args->type) {
1744    case READFUNC:
1745        return args->f.func_read(s, buf, num, &s->asyncrw);
1746    case WRITEFUNC:
1747        return args->f.func_write(s, buf, num, &s->asyncrw);
1748    case OTHERFUNC:
1749        return args->f.func_other(s);
1750    }
1751    return -1;
1752}
1753
1754int ssl_read_internal(SSL *s, void *buf, size_t num, size_t *readbytes)
1755{
1756    if (s->handshake_func == NULL) {
1757        SSLerr(SSL_F_SSL_READ_INTERNAL, SSL_R_UNINITIALIZED);
1758        return -1;
1759    }
1760
1761    if (s->shutdown & SSL_RECEIVED_SHUTDOWN) {
1762        s->rwstate = SSL_NOTHING;
1763        return 0;
1764    }
1765
1766    if (s->early_data_state == SSL_EARLY_DATA_CONNECT_RETRY
1767                || s->early_data_state == SSL_EARLY_DATA_ACCEPT_RETRY) {
1768        SSLerr(SSL_F_SSL_READ_INTERNAL, ERR_R_SHOULD_NOT_HAVE_BEEN_CALLED);
1769        return 0;
1770    }
1771    /*
1772     * If we are a client and haven't received the ServerHello etc then we
1773     * better do that
1774     */
1775    ossl_statem_check_finish_init(s, 0);
1776
1777    if ((s->mode & SSL_MODE_ASYNC) && ASYNC_get_current_job() == NULL) {
1778        struct ssl_async_args args;
1779        int ret;
1780
1781        args.s = s;
1782        args.buf = buf;
1783        args.num = num;
1784        args.type = READFUNC;
1785        args.f.func_read = s->method->ssl_read;
1786
1787        ret = ssl_start_async_job(s, &args, ssl_io_intern);
1788        *readbytes = s->asyncrw;
1789        return ret;
1790    } else {
1791        return s->method->ssl_read(s, buf, num, readbytes);
1792    }
1793}
1794
1795int SSL_read(SSL *s, void *buf, int num)
1796{
1797    int ret;
1798    size_t readbytes;
1799
1800    if (num < 0) {
1801        SSLerr(SSL_F_SSL_READ, SSL_R_BAD_LENGTH);
1802        return -1;
1803    }
1804
1805    ret = ssl_read_internal(s, buf, (size_t)num, &readbytes);
1806
1807    /*
1808     * The cast is safe here because ret should be <= INT_MAX because num is
1809     * <= INT_MAX
1810     */
1811    if (ret > 0)
1812        ret = (int)readbytes;
1813
1814    return ret;
1815}
1816
1817int SSL_read_ex(SSL *s, void *buf, size_t num, size_t *readbytes)
1818{
1819    int ret = ssl_read_internal(s, buf, num, readbytes);
1820
1821    if (ret < 0)
1822        ret = 0;
1823    return ret;
1824}
1825
1826int SSL_read_early_data(SSL *s, void *buf, size_t num, size_t *readbytes)
1827{
1828    int ret;
1829
1830    if (!s->server) {
1831        SSLerr(SSL_F_SSL_READ_EARLY_DATA, ERR_R_SHOULD_NOT_HAVE_BEEN_CALLED);
1832        return SSL_READ_EARLY_DATA_ERROR;
1833    }
1834
1835    switch (s->early_data_state) {
1836    case SSL_EARLY_DATA_NONE:
1837        if (!SSL_in_before(s)) {
1838            SSLerr(SSL_F_SSL_READ_EARLY_DATA,
1839                   ERR_R_SHOULD_NOT_HAVE_BEEN_CALLED);
1840            return SSL_READ_EARLY_DATA_ERROR;
1841        }
1842        /* fall through */
1843
1844    case SSL_EARLY_DATA_ACCEPT_RETRY:
1845        s->early_data_state = SSL_EARLY_DATA_ACCEPTING;
1846        ret = SSL_accept(s);
1847        if (ret <= 0) {
1848            /* NBIO or error */
1849            s->early_data_state = SSL_EARLY_DATA_ACCEPT_RETRY;
1850            return SSL_READ_EARLY_DATA_ERROR;
1851        }
1852        /* fall through */
1853
1854    case SSL_EARLY_DATA_READ_RETRY:
1855        if (s->ext.early_data == SSL_EARLY_DATA_ACCEPTED) {
1856            s->early_data_state = SSL_EARLY_DATA_READING;
1857            ret = SSL_read_ex(s, buf, num, readbytes);
1858            /*
1859             * State machine will update early_data_state to
1860             * SSL_EARLY_DATA_FINISHED_READING if we get an EndOfEarlyData
1861             * message
1862             */
1863            if (ret > 0 || (ret <= 0 && s->early_data_state
1864                                        != SSL_EARLY_DATA_FINISHED_READING)) {
1865                s->early_data_state = SSL_EARLY_DATA_READ_RETRY;
1866                return ret > 0 ? SSL_READ_EARLY_DATA_SUCCESS
1867                               : SSL_READ_EARLY_DATA_ERROR;
1868            }
1869        } else {
1870            s->early_data_state = SSL_EARLY_DATA_FINISHED_READING;
1871        }
1872        *readbytes = 0;
1873        return SSL_READ_EARLY_DATA_FINISH;
1874
1875    default:
1876        SSLerr(SSL_F_SSL_READ_EARLY_DATA, ERR_R_SHOULD_NOT_HAVE_BEEN_CALLED);
1877        return SSL_READ_EARLY_DATA_ERROR;
1878    }
1879}
1880
1881int SSL_get_early_data_status(const SSL *s)
1882{
1883    return s->ext.early_data;
1884}
1885
1886static int ssl_peek_internal(SSL *s, void *buf, size_t num, size_t *readbytes)
1887{
1888    if (s->handshake_func == NULL) {
1889        SSLerr(SSL_F_SSL_PEEK_INTERNAL, SSL_R_UNINITIALIZED);
1890        return -1;
1891    }
1892
1893    if (s->shutdown & SSL_RECEIVED_SHUTDOWN) {
1894        return 0;
1895    }
1896    if ((s->mode & SSL_MODE_ASYNC) && ASYNC_get_current_job() == NULL) {
1897        struct ssl_async_args args;
1898        int ret;
1899
1900        args.s = s;
1901        args.buf = buf;
1902        args.num = num;
1903        args.type = READFUNC;
1904        args.f.func_read = s->method->ssl_peek;
1905
1906        ret = ssl_start_async_job(s, &args, ssl_io_intern);
1907        *readbytes = s->asyncrw;
1908        return ret;
1909    } else {
1910        return s->method->ssl_peek(s, buf, num, readbytes);
1911    }
1912}
1913
1914int SSL_peek(SSL *s, void *buf, int num)
1915{
1916    int ret;
1917    size_t readbytes;
1918
1919    if (num < 0) {
1920        SSLerr(SSL_F_SSL_PEEK, SSL_R_BAD_LENGTH);
1921        return -1;
1922    }
1923
1924    ret = ssl_peek_internal(s, buf, (size_t)num, &readbytes);
1925
1926    /*
1927     * The cast is safe here because ret should be <= INT_MAX because num is
1928     * <= INT_MAX
1929     */
1930    if (ret > 0)
1931        ret = (int)readbytes;
1932
1933    return ret;
1934}
1935
1936
1937int SSL_peek_ex(SSL *s, void *buf, size_t num, size_t *readbytes)
1938{
1939    int ret = ssl_peek_internal(s, buf, num, readbytes);
1940
1941    if (ret < 0)
1942        ret = 0;
1943    return ret;
1944}
1945
1946int ssl_write_internal(SSL *s, const void *buf, size_t num, size_t *written)
1947{
1948    if (s->handshake_func == NULL) {
1949        SSLerr(SSL_F_SSL_WRITE_INTERNAL, SSL_R_UNINITIALIZED);
1950        return -1;
1951    }
1952
1953    if (s->shutdown & SSL_SENT_SHUTDOWN) {
1954        s->rwstate = SSL_NOTHING;
1955        SSLerr(SSL_F_SSL_WRITE_INTERNAL, SSL_R_PROTOCOL_IS_SHUTDOWN);
1956        return -1;
1957    }
1958
1959    if (s->early_data_state == SSL_EARLY_DATA_CONNECT_RETRY
1960                || s->early_data_state == SSL_EARLY_DATA_ACCEPT_RETRY
1961                || s->early_data_state == SSL_EARLY_DATA_READ_RETRY) {
1962        SSLerr(SSL_F_SSL_WRITE_INTERNAL, ERR_R_SHOULD_NOT_HAVE_BEEN_CALLED);
1963        return 0;
1964    }
1965    /* If we are a client and haven't sent the Finished we better do that */
1966    ossl_statem_check_finish_init(s, 1);
1967
1968    if ((s->mode & SSL_MODE_ASYNC) && ASYNC_get_current_job() == NULL) {
1969        int ret;
1970        struct ssl_async_args args;
1971
1972        args.s = s;
1973        args.buf = (void *)buf;
1974        args.num = num;
1975        args.type = WRITEFUNC;
1976        args.f.func_write = s->method->ssl_write;
1977
1978        ret = ssl_start_async_job(s, &args, ssl_io_intern);
1979        *written = s->asyncrw;
1980        return ret;
1981    } else {
1982        return s->method->ssl_write(s, buf, num, written);
1983    }
1984}
1985
1986ossl_ssize_t SSL_sendfile(SSL *s, int fd, off_t offset, size_t size, int flags)
1987{
1988    ossl_ssize_t ret;
1989
1990    if (s->handshake_func == NULL) {
1991        SSLerr(SSL_F_SSL_SENDFILE, SSL_R_UNINITIALIZED);
1992        return -1;
1993    }
1994
1995    if (s->shutdown & SSL_SENT_SHUTDOWN) {
1996        s->rwstate = SSL_NOTHING;
1997        SSLerr(SSL_F_SSL_SENDFILE, SSL_R_PROTOCOL_IS_SHUTDOWN);
1998        return -1;
1999    }
2000
2001    if (!BIO_get_ktls_send(s->wbio)) {
2002        SSLerr(SSL_F_SSL_SENDFILE, SSL_R_UNINITIALIZED);
2003        return -1;
2004    }
2005
2006    /* If we have an alert to send, lets send it */
2007    if (s->s3->alert_dispatch) {
2008        ret = (ossl_ssize_t)s->method->ssl_dispatch_alert(s);
2009        if (ret <= 0) {
2010            /* SSLfatal() already called if appropriate */
2011            return ret;
2012        }
2013        /* if it went, fall through and send more stuff */
2014    }
2015
2016    s->rwstate = SSL_WRITING;
2017    if (BIO_flush(s->wbio) <= 0) {
2018        if (!BIO_should_retry(s->wbio)) {
2019            s->rwstate = SSL_NOTHING;
2020        } else {
2021#ifdef EAGAIN
2022            set_sys_error(EAGAIN);
2023#endif
2024        }
2025        return -1;
2026    }
2027
2028#ifdef OPENSSL_NO_KTLS
2029    ERR_raise_data(ERR_LIB_SYS, ERR_R_INTERNAL_ERROR, "calling sendfile()");
2030    return -1;
2031#else
2032    ret = ktls_sendfile(SSL_get_wfd(s), fd, offset, size, flags);
2033    if (ret < 0) {
2034#if defined(EAGAIN) && defined(EINTR) && defined(EBUSY)
2035        if ((get_last_sys_error() == EAGAIN) ||
2036            (get_last_sys_error() == EINTR) ||
2037            (get_last_sys_error() == EBUSY))
2038            BIO_set_retry_write(s->wbio);
2039        else
2040#endif
2041            SSLerr(SSL_F_SSL_SENDFILE, SSL_R_UNINITIALIZED);
2042        return ret;
2043    }
2044    s->rwstate = SSL_NOTHING;
2045    return ret;
2046#endif
2047}
2048
2049int SSL_write(SSL *s, const void *buf, int num)
2050{
2051    int ret;
2052    size_t written;
2053
2054    if (num < 0) {
2055        SSLerr(SSL_F_SSL_WRITE, SSL_R_BAD_LENGTH);
2056        return -1;
2057    }
2058
2059    ret = ssl_write_internal(s, buf, (size_t)num, &written);
2060
2061    /*
2062     * The cast is safe here because ret should be <= INT_MAX because num is
2063     * <= INT_MAX
2064     */
2065    if (ret > 0)
2066        ret = (int)written;
2067
2068    return ret;
2069}
2070
2071int SSL_write_ex(SSL *s, const void *buf, size_t num, size_t *written)
2072{
2073    int ret = ssl_write_internal(s, buf, num, written);
2074
2075    if (ret < 0)
2076        ret = 0;
2077    return ret;
2078}
2079
2080int SSL_write_early_data(SSL *s, const void *buf, size_t num, size_t *written)
2081{
2082    int ret, early_data_state;
2083    size_t writtmp;
2084    uint32_t partialwrite;
2085
2086    switch (s->early_data_state) {
2087    case SSL_EARLY_DATA_NONE:
2088        if (s->server
2089                || !SSL_in_before(s)
2090                || ((s->session == NULL || s->session->ext.max_early_data == 0)
2091                     && (s->psk_use_session_cb == NULL))) {
2092            SSLerr(SSL_F_SSL_WRITE_EARLY_DATA,
2093                   ERR_R_SHOULD_NOT_HAVE_BEEN_CALLED);
2094            return 0;
2095        }
2096        /* fall through */
2097
2098    case SSL_EARLY_DATA_CONNECT_RETRY:
2099        s->early_data_state = SSL_EARLY_DATA_CONNECTING;
2100        ret = SSL_connect(s);
2101        if (ret <= 0) {
2102            /* NBIO or error */
2103            s->early_data_state = SSL_EARLY_DATA_CONNECT_RETRY;
2104            return 0;
2105        }
2106        /* fall through */
2107
2108    case SSL_EARLY_DATA_WRITE_RETRY:
2109        s->early_data_state = SSL_EARLY_DATA_WRITING;
2110        /*
2111         * We disable partial write for early data because we don't keep track
2112         * of how many bytes we've written between the SSL_write_ex() call and
2113         * the flush if the flush needs to be retried)
2114         */
2115        partialwrite = s->mode & SSL_MODE_ENABLE_PARTIAL_WRITE;
2116        s->mode &= ~SSL_MODE_ENABLE_PARTIAL_WRITE;
2117        ret = SSL_write_ex(s, buf, num, &writtmp);
2118        s->mode |= partialwrite;
2119        if (!ret) {
2120            s->early_data_state = SSL_EARLY_DATA_WRITE_RETRY;
2121            return ret;
2122        }
2123        s->early_data_state = SSL_EARLY_DATA_WRITE_FLUSH;
2124        /* fall through */
2125
2126    case SSL_EARLY_DATA_WRITE_FLUSH:
2127        /* The buffering BIO is still in place so we need to flush it */
2128        if (statem_flush(s) != 1)
2129            return 0;
2130        *written = num;
2131        s->early_data_state = SSL_EARLY_DATA_WRITE_RETRY;
2132        return 1;
2133
2134    case SSL_EARLY_DATA_FINISHED_READING:
2135    case SSL_EARLY_DATA_READ_RETRY:
2136        early_data_state = s->early_data_state;
2137        /* We are a server writing to an unauthenticated client */
2138        s->early_data_state = SSL_EARLY_DATA_UNAUTH_WRITING;
2139        ret = SSL_write_ex(s, buf, num, written);
2140        /* The buffering BIO is still in place */
2141        if (ret)
2142            (void)BIO_flush(s->wbio);
2143        s->early_data_state = early_data_state;
2144        return ret;
2145
2146    default:
2147        SSLerr(SSL_F_SSL_WRITE_EARLY_DATA, ERR_R_SHOULD_NOT_HAVE_BEEN_CALLED);
2148        return 0;
2149    }
2150}
2151
2152int SSL_shutdown(SSL *s)
2153{
2154    /*
2155     * Note that this function behaves differently from what one might
2156     * expect.  Return values are 0 for no success (yet), 1 for success; but
2157     * calling it once is usually not enough, even if blocking I/O is used
2158     * (see ssl3_shutdown).
2159     */
2160
2161    if (s->handshake_func == NULL) {
2162        SSLerr(SSL_F_SSL_SHUTDOWN, SSL_R_UNINITIALIZED);
2163        return -1;
2164    }
2165
2166    if (!SSL_in_init(s)) {
2167        if ((s->mode & SSL_MODE_ASYNC) && ASYNC_get_current_job() == NULL) {
2168            struct ssl_async_args args;
2169
2170            args.s = s;
2171            args.type = OTHERFUNC;
2172            args.f.func_other = s->method->ssl_shutdown;
2173
2174            return ssl_start_async_job(s, &args, ssl_io_intern);
2175        } else {
2176            return s->method->ssl_shutdown(s);
2177        }
2178    } else {
2179        SSLerr(SSL_F_SSL_SHUTDOWN, SSL_R_SHUTDOWN_WHILE_IN_INIT);
2180        return -1;
2181    }
2182}
2183
2184int SSL_key_update(SSL *s, int updatetype)
2185{
2186    /*
2187     * TODO(TLS1.3): How will applications know whether TLSv1.3 has been
2188     * negotiated, and that it is appropriate to call SSL_key_update() instead
2189     * of SSL_renegotiate().
2190     */
2191    if (!SSL_IS_TLS13(s)) {
2192        SSLerr(SSL_F_SSL_KEY_UPDATE, SSL_R_WRONG_SSL_VERSION);
2193        return 0;
2194    }
2195
2196    if (updatetype != SSL_KEY_UPDATE_NOT_REQUESTED
2197            && updatetype != SSL_KEY_UPDATE_REQUESTED) {
2198        SSLerr(SSL_F_SSL_KEY_UPDATE, SSL_R_INVALID_KEY_UPDATE_TYPE);
2199        return 0;
2200    }
2201
2202    if (!SSL_is_init_finished(s)) {
2203        SSLerr(SSL_F_SSL_KEY_UPDATE, SSL_R_STILL_IN_INIT);
2204        return 0;
2205    }
2206
2207    ossl_statem_set_in_init(s, 1);
2208    s->key_update = updatetype;
2209    return 1;
2210}
2211
2212int SSL_get_key_update_type(const SSL *s)
2213{
2214    return s->key_update;
2215}
2216
2217int SSL_renegotiate(SSL *s)
2218{
2219    if (SSL_IS_TLS13(s)) {
2220        SSLerr(SSL_F_SSL_RENEGOTIATE, SSL_R_WRONG_SSL_VERSION);
2221        return 0;
2222    }
2223
2224    if ((s->options & SSL_OP_NO_RENEGOTIATION)) {
2225        SSLerr(SSL_F_SSL_RENEGOTIATE, SSL_R_NO_RENEGOTIATION);
2226        return 0;
2227    }
2228
2229    s->renegotiate = 1;
2230    s->new_session = 1;
2231
2232    return s->method->ssl_renegotiate(s);
2233}
2234
2235int SSL_renegotiate_abbreviated(SSL *s)
2236{
2237    if (SSL_IS_TLS13(s)) {
2238        SSLerr(SSL_F_SSL_RENEGOTIATE_ABBREVIATED, SSL_R_WRONG_SSL_VERSION);
2239        return 0;
2240    }
2241
2242    if ((s->options & SSL_OP_NO_RENEGOTIATION)) {
2243        SSLerr(SSL_F_SSL_RENEGOTIATE_ABBREVIATED, SSL_R_NO_RENEGOTIATION);
2244        return 0;
2245    }
2246
2247    s->renegotiate = 1;
2248    s->new_session = 0;
2249
2250    return s->method->ssl_renegotiate(s);
2251}
2252
2253int SSL_renegotiate_pending(const SSL *s)
2254{
2255    /*
2256     * becomes true when negotiation is requested; false again once a
2257     * handshake has finished
2258     */
2259    return (s->renegotiate != 0);
2260}
2261
2262long SSL_ctrl(SSL *s, int cmd, long larg, void *parg)
2263{
2264    long l;
2265
2266    switch (cmd) {
2267    case SSL_CTRL_GET_READ_AHEAD:
2268        return RECORD_LAYER_get_read_ahead(&s->rlayer);
2269    case SSL_CTRL_SET_READ_AHEAD:
2270        l = RECORD_LAYER_get_read_ahead(&s->rlayer);
2271        RECORD_LAYER_set_read_ahead(&s->rlayer, larg);
2272        return l;
2273
2274    case SSL_CTRL_SET_MSG_CALLBACK_ARG:
2275        s->msg_callback_arg = parg;
2276        return 1;
2277
2278    case SSL_CTRL_MODE:
2279        return (s->mode |= larg);
2280    case SSL_CTRL_CLEAR_MODE:
2281        return (s->mode &= ~larg);
2282    case SSL_CTRL_GET_MAX_CERT_LIST:
2283        return (long)s->max_cert_list;
2284    case SSL_CTRL_SET_MAX_CERT_LIST:
2285        if (larg < 0)
2286            return 0;
2287        l = (long)s->max_cert_list;
2288        s->max_cert_list = (size_t)larg;
2289        return l;
2290    case SSL_CTRL_SET_MAX_SEND_FRAGMENT:
2291        if (larg < 512 || larg > SSL3_RT_MAX_PLAIN_LENGTH)
2292            return 0;
2293#ifndef OPENSSL_NO_KTLS
2294        if (s->wbio != NULL && BIO_get_ktls_send(s->wbio))
2295            return 0;
2296#endif /* OPENSSL_NO_KTLS */
2297        s->max_send_fragment = larg;
2298        if (s->max_send_fragment < s->split_send_fragment)
2299            s->split_send_fragment = s->max_send_fragment;
2300        return 1;
2301    case SSL_CTRL_SET_SPLIT_SEND_FRAGMENT:
2302        if ((size_t)larg > s->max_send_fragment || larg == 0)
2303            return 0;
2304        s->split_send_fragment = larg;
2305        return 1;
2306    case SSL_CTRL_SET_MAX_PIPELINES:
2307        if (larg < 1 || larg > SSL_MAX_PIPELINES)
2308            return 0;
2309        s->max_pipelines = larg;
2310        if (larg > 1)
2311            RECORD_LAYER_set_read_ahead(&s->rlayer, 1);
2312        return 1;
2313    case SSL_CTRL_GET_RI_SUPPORT:
2314        if (s->s3)
2315            return s->s3->send_connection_binding;
2316        else
2317            return 0;
2318    case SSL_CTRL_CERT_FLAGS:
2319        return (s->cert->cert_flags |= larg);
2320    case SSL_CTRL_CLEAR_CERT_FLAGS:
2321        return (s->cert->cert_flags &= ~larg);
2322
2323    case SSL_CTRL_GET_RAW_CIPHERLIST:
2324        if (parg) {
2325            if (s->s3->tmp.ciphers_raw == NULL)
2326                return 0;
2327            *(unsigned char **)parg = s->s3->tmp.ciphers_raw;
2328            return (int)s->s3->tmp.ciphers_rawlen;
2329        } else {
2330            return TLS_CIPHER_LEN;
2331        }
2332    case SSL_CTRL_GET_EXTMS_SUPPORT:
2333        if (!s->session || SSL_in_init(s) || ossl_statem_get_in_handshake(s))
2334            return -1;
2335        if (s->session->flags & SSL_SESS_FLAG_EXTMS)
2336            return 1;
2337        else
2338            return 0;
2339    case SSL_CTRL_SET_MIN_PROTO_VERSION:
2340        return ssl_check_allowed_versions(larg, s->max_proto_version)
2341               && ssl_set_version_bound(s->ctx->method->version, (int)larg,
2342                                        &s->min_proto_version);
2343    case SSL_CTRL_GET_MIN_PROTO_VERSION:
2344        return s->min_proto_version;
2345    case SSL_CTRL_SET_MAX_PROTO_VERSION:
2346        return ssl_check_allowed_versions(s->min_proto_version, larg)
2347               && ssl_set_version_bound(s->ctx->method->version, (int)larg,
2348                                        &s->max_proto_version);
2349    case SSL_CTRL_GET_MAX_PROTO_VERSION:
2350        return s->max_proto_version;
2351    default:
2352        return s->method->ssl_ctrl(s, cmd, larg, parg);
2353    }
2354}
2355
2356long SSL_callback_ctrl(SSL *s, int cmd, void (*fp) (void))
2357{
2358    switch (cmd) {
2359    case SSL_CTRL_SET_MSG_CALLBACK:
2360        s->msg_callback = (void (*)
2361                           (int write_p, int version, int content_type,
2362                            const void *buf, size_t len, SSL *ssl,
2363                            void *arg))(fp);
2364        return 1;
2365
2366    default:
2367        return s->method->ssl_callback_ctrl(s, cmd, fp);
2368    }
2369}
2370
2371LHASH_OF(SSL_SESSION) *SSL_CTX_sessions(SSL_CTX *ctx)
2372{
2373    return ctx->sessions;
2374}
2375
2376long SSL_CTX_ctrl(SSL_CTX *ctx, int cmd, long larg, void *parg)
2377{
2378    long l;
2379    /* For some cases with ctx == NULL perform syntax checks */
2380    if (ctx == NULL) {
2381        switch (cmd) {
2382#ifndef OPENSSL_NO_EC
2383        case SSL_CTRL_SET_GROUPS_LIST:
2384            return tls1_set_groups_list(NULL, NULL, parg);
2385#endif
2386        case SSL_CTRL_SET_SIGALGS_LIST:
2387        case SSL_CTRL_SET_CLIENT_SIGALGS_LIST:
2388            return tls1_set_sigalgs_list(NULL, parg, 0);
2389        default:
2390            return 0;
2391        }
2392    }
2393
2394    switch (cmd) {
2395    case SSL_CTRL_GET_READ_AHEAD:
2396        return ctx->read_ahead;
2397    case SSL_CTRL_SET_READ_AHEAD:
2398        l = ctx->read_ahead;
2399        ctx->read_ahead = larg;
2400        return l;
2401
2402    case SSL_CTRL_SET_MSG_CALLBACK_ARG:
2403        ctx->msg_callback_arg = parg;
2404        return 1;
2405
2406    case SSL_CTRL_GET_MAX_CERT_LIST:
2407        return (long)ctx->max_cert_list;
2408    case SSL_CTRL_SET_MAX_CERT_LIST:
2409        if (larg < 0)
2410            return 0;
2411        l = (long)ctx->max_cert_list;
2412        ctx->max_cert_list = (size_t)larg;
2413        return l;
2414
2415    case SSL_CTRL_SET_SESS_CACHE_SIZE:
2416        if (larg < 0)
2417            return 0;
2418        l = (long)ctx->session_cache_size;
2419        ctx->session_cache_size = (size_t)larg;
2420        return l;
2421    case SSL_CTRL_GET_SESS_CACHE_SIZE:
2422        return (long)ctx->session_cache_size;
2423    case SSL_CTRL_SET_SESS_CACHE_MODE:
2424        l = ctx->session_cache_mode;
2425        ctx->session_cache_mode = larg;
2426        return l;
2427    case SSL_CTRL_GET_SESS_CACHE_MODE:
2428        return ctx->session_cache_mode;
2429
2430    case SSL_CTRL_SESS_NUMBER:
2431        return lh_SSL_SESSION_num_items(ctx->sessions);
2432    case SSL_CTRL_SESS_CONNECT:
2433        return tsan_load(&ctx->stats.sess_connect);
2434    case SSL_CTRL_SESS_CONNECT_GOOD:
2435        return tsan_load(&ctx->stats.sess_connect_good);
2436    case SSL_CTRL_SESS_CONNECT_RENEGOTIATE:
2437        return tsan_load(&ctx->stats.sess_connect_renegotiate);
2438    case SSL_CTRL_SESS_ACCEPT:
2439        return tsan_load(&ctx->stats.sess_accept);
2440    case SSL_CTRL_SESS_ACCEPT_GOOD:
2441        return tsan_load(&ctx->stats.sess_accept_good);
2442    case SSL_CTRL_SESS_ACCEPT_RENEGOTIATE:
2443        return tsan_load(&ctx->stats.sess_accept_renegotiate);
2444    case SSL_CTRL_SESS_HIT:
2445        return tsan_load(&ctx->stats.sess_hit);
2446    case SSL_CTRL_SESS_CB_HIT:
2447        return tsan_load(&ctx->stats.sess_cb_hit);
2448    case SSL_CTRL_SESS_MISSES:
2449        return tsan_load(&ctx->stats.sess_miss);
2450    case SSL_CTRL_SESS_TIMEOUTS:
2451        return tsan_load(&ctx->stats.sess_timeout);
2452    case SSL_CTRL_SESS_CACHE_FULL:
2453        return tsan_load(&ctx->stats.sess_cache_full);
2454    case SSL_CTRL_MODE:
2455        return (ctx->mode |= larg);
2456    case SSL_CTRL_CLEAR_MODE:
2457        return (ctx->mode &= ~larg);
2458    case SSL_CTRL_SET_MAX_SEND_FRAGMENT:
2459        if (larg < 512 || larg > SSL3_RT_MAX_PLAIN_LENGTH)
2460            return 0;
2461        ctx->max_send_fragment = larg;
2462        if (ctx->max_send_fragment < ctx->split_send_fragment)
2463            ctx->split_send_fragment = ctx->max_send_fragment;
2464        return 1;
2465    case SSL_CTRL_SET_SPLIT_SEND_FRAGMENT:
2466        if ((size_t)larg > ctx->max_send_fragment || larg == 0)
2467            return 0;
2468        ctx->split_send_fragment = larg;
2469        return 1;
2470    case SSL_CTRL_SET_MAX_PIPELINES:
2471        if (larg < 1 || larg > SSL_MAX_PIPELINES)
2472            return 0;
2473        ctx->max_pipelines = larg;
2474        return 1;
2475    case SSL_CTRL_CERT_FLAGS:
2476        return (ctx->cert->cert_flags |= larg);
2477    case SSL_CTRL_CLEAR_CERT_FLAGS:
2478        return (ctx->cert->cert_flags &= ~larg);
2479    case SSL_CTRL_SET_MIN_PROTO_VERSION:
2480        return ssl_check_allowed_versions(larg, ctx->max_proto_version)
2481               && ssl_set_version_bound(ctx->method->version, (int)larg,
2482                                        &ctx->min_proto_version);
2483    case SSL_CTRL_GET_MIN_PROTO_VERSION:
2484        return ctx->min_proto_version;
2485    case SSL_CTRL_SET_MAX_PROTO_VERSION:
2486        return ssl_check_allowed_versions(ctx->min_proto_version, larg)
2487               && ssl_set_version_bound(ctx->method->version, (int)larg,
2488                                        &ctx->max_proto_version);
2489    case SSL_CTRL_GET_MAX_PROTO_VERSION:
2490        return ctx->max_proto_version;
2491    default:
2492        return ctx->method->ssl_ctx_ctrl(ctx, cmd, larg, parg);
2493    }
2494}
2495
2496long SSL_CTX_callback_ctrl(SSL_CTX *ctx, int cmd, void (*fp) (void))
2497{
2498    switch (cmd) {
2499    case SSL_CTRL_SET_MSG_CALLBACK:
2500        ctx->msg_callback = (void (*)
2501                             (int write_p, int version, int content_type,
2502                              const void *buf, size_t len, SSL *ssl,
2503                              void *arg))(fp);
2504        return 1;
2505
2506    default:
2507        return ctx->method->ssl_ctx_callback_ctrl(ctx, cmd, fp);
2508    }
2509}
2510
2511int ssl_cipher_id_cmp(const SSL_CIPHER *a, const SSL_CIPHER *b)
2512{
2513    if (a->id > b->id)
2514        return 1;
2515    if (a->id < b->id)
2516        return -1;
2517    return 0;
2518}
2519
2520int ssl_cipher_ptr_id_cmp(const SSL_CIPHER *const *ap,
2521                          const SSL_CIPHER *const *bp)
2522{
2523    if ((*ap)->id > (*bp)->id)
2524        return 1;
2525    if ((*ap)->id < (*bp)->id)
2526        return -1;
2527    return 0;
2528}
2529
2530/** return a STACK of the ciphers available for the SSL and in order of
2531 * preference */
2532STACK_OF(SSL_CIPHER) *SSL_get_ciphers(const SSL *s)
2533{
2534    if (s != NULL) {
2535        if (s->cipher_list != NULL) {
2536            return s->cipher_list;
2537        } else if ((s->ctx != NULL) && (s->ctx->cipher_list != NULL)) {
2538            return s->ctx->cipher_list;
2539        }
2540    }
2541    return NULL;
2542}
2543
2544STACK_OF(SSL_CIPHER) *SSL_get_client_ciphers(const SSL *s)
2545{
2546    if ((s == NULL) || !s->server)
2547        return NULL;
2548    return s->peer_ciphers;
2549}
2550
2551STACK_OF(SSL_CIPHER) *SSL_get1_supported_ciphers(SSL *s)
2552{
2553    STACK_OF(SSL_CIPHER) *sk = NULL, *ciphers;
2554    int i;
2555
2556    ciphers = SSL_get_ciphers(s);
2557    if (!ciphers)
2558        return NULL;
2559    if (!ssl_set_client_disabled(s))
2560        return NULL;
2561    for (i = 0; i < sk_SSL_CIPHER_num(ciphers); i++) {
2562        const SSL_CIPHER *c = sk_SSL_CIPHER_value(ciphers, i);
2563        if (!ssl_cipher_disabled(s, c, SSL_SECOP_CIPHER_SUPPORTED, 0)) {
2564            if (!sk)
2565                sk = sk_SSL_CIPHER_new_null();
2566            if (!sk)
2567                return NULL;
2568            if (!sk_SSL_CIPHER_push(sk, c)) {
2569                sk_SSL_CIPHER_free(sk);
2570                return NULL;
2571            }
2572        }
2573    }
2574    return sk;
2575}
2576
2577/** return a STACK of the ciphers available for the SSL and in order of
2578 * algorithm id */
2579STACK_OF(SSL_CIPHER) *ssl_get_ciphers_by_id(SSL *s)
2580{
2581    if (s != NULL) {
2582        if (s->cipher_list_by_id != NULL) {
2583            return s->cipher_list_by_id;
2584        } else if ((s->ctx != NULL) && (s->ctx->cipher_list_by_id != NULL)) {
2585            return s->ctx->cipher_list_by_id;
2586        }
2587    }
2588    return NULL;
2589}
2590
2591/** The old interface to get the same thing as SSL_get_ciphers() */
2592const char *SSL_get_cipher_list(const SSL *s, int n)
2593{
2594    const SSL_CIPHER *c;
2595    STACK_OF(SSL_CIPHER) *sk;
2596
2597    if (s == NULL)
2598        return NULL;
2599    sk = SSL_get_ciphers(s);
2600    if ((sk == NULL) || (sk_SSL_CIPHER_num(sk) <= n))
2601        return NULL;
2602    c = sk_SSL_CIPHER_value(sk, n);
2603    if (c == NULL)
2604        return NULL;
2605    return c->name;
2606}
2607
2608/** return a STACK of the ciphers available for the SSL_CTX and in order of
2609 * preference */
2610STACK_OF(SSL_CIPHER) *SSL_CTX_get_ciphers(const SSL_CTX *ctx)
2611{
2612    if (ctx != NULL)
2613        return ctx->cipher_list;
2614    return NULL;
2615}
2616
2617/*
2618 * Distinguish between ciphers controlled by set_ciphersuite() and
2619 * set_cipher_list() when counting.
2620 */
2621static int cipher_list_tls12_num(STACK_OF(SSL_CIPHER) *sk)
2622{
2623    int i, num = 0;
2624    const SSL_CIPHER *c;
2625
2626    if (sk == NULL)
2627        return 0;
2628    for (i = 0; i < sk_SSL_CIPHER_num(sk); ++i) {
2629        c = sk_SSL_CIPHER_value(sk, i);
2630        if (c->min_tls >= TLS1_3_VERSION)
2631            continue;
2632        num++;
2633    }
2634    return num;
2635}
2636
2637/** specify the ciphers to be used by default by the SSL_CTX */
2638int SSL_CTX_set_cipher_list(SSL_CTX *ctx, const char *str)
2639{
2640    STACK_OF(SSL_CIPHER) *sk;
2641
2642    sk = ssl_create_cipher_list(ctx->method, ctx->tls13_ciphersuites,
2643                                &ctx->cipher_list, &ctx->cipher_list_by_id, str,
2644                                ctx->cert);
2645    /*
2646     * ssl_create_cipher_list may return an empty stack if it was unable to
2647     * find a cipher matching the given rule string (for example if the rule
2648     * string specifies a cipher which has been disabled). This is not an
2649     * error as far as ssl_create_cipher_list is concerned, and hence
2650     * ctx->cipher_list and ctx->cipher_list_by_id has been updated.
2651     */
2652    if (sk == NULL)
2653        return 0;
2654    else if (cipher_list_tls12_num(sk) == 0) {
2655        SSLerr(SSL_F_SSL_CTX_SET_CIPHER_LIST, SSL_R_NO_CIPHER_MATCH);
2656        return 0;
2657    }
2658    return 1;
2659}
2660
2661/** specify the ciphers to be used by the SSL */
2662int SSL_set_cipher_list(SSL *s, const char *str)
2663{
2664    STACK_OF(SSL_CIPHER) *sk;
2665
2666    sk = ssl_create_cipher_list(s->ctx->method, s->tls13_ciphersuites,
2667                                &s->cipher_list, &s->cipher_list_by_id, str,
2668                                s->cert);
2669    /* see comment in SSL_CTX_set_cipher_list */
2670    if (sk == NULL)
2671        return 0;
2672    else if (cipher_list_tls12_num(sk) == 0) {
2673        SSLerr(SSL_F_SSL_SET_CIPHER_LIST, SSL_R_NO_CIPHER_MATCH);
2674        return 0;
2675    }
2676    return 1;
2677}
2678
2679char *SSL_get_shared_ciphers(const SSL *s, char *buf, int size)
2680{
2681    char *p;
2682    STACK_OF(SSL_CIPHER) *clntsk, *srvrsk;
2683    const SSL_CIPHER *c;
2684    int i;
2685
2686    if (!s->server
2687            || s->peer_ciphers == NULL
2688            || size < 2)
2689        return NULL;
2690
2691    p = buf;
2692    clntsk = s->peer_ciphers;
2693    srvrsk = SSL_get_ciphers(s);
2694    if (clntsk == NULL || srvrsk == NULL)
2695        return NULL;
2696
2697    if (sk_SSL_CIPHER_num(clntsk) == 0 || sk_SSL_CIPHER_num(srvrsk) == 0)
2698        return NULL;
2699
2700    for (i = 0; i < sk_SSL_CIPHER_num(clntsk); i++) {
2701        int n;
2702
2703        c = sk_SSL_CIPHER_value(clntsk, i);
2704        if (sk_SSL_CIPHER_find(srvrsk, c) < 0)
2705            continue;
2706
2707        n = strlen(c->name);
2708        if (n + 1 > size) {
2709            if (p != buf)
2710                --p;
2711            *p = '\0';
2712            return buf;
2713        }
2714        strcpy(p, c->name);
2715        p += n;
2716        *(p++) = ':';
2717        size -= n + 1;
2718    }
2719    p[-1] = '\0';
2720    return buf;
2721}
2722
2723/**
2724 * Return the requested servername (SNI) value. Note that the behaviour varies
2725 * depending on:
2726 * - whether this is called by the client or the server,
2727 * - if we are before or during/after the handshake,
2728 * - if a resumption or normal handshake is being attempted/has occurred
2729 * - whether we have negotiated TLSv1.2 (or below) or TLSv1.3
2730 *
2731 * Note that only the host_name type is defined (RFC 3546).
2732 */
2733const char *SSL_get_servername(const SSL *s, const int type)
2734{
2735    /*
2736     * If we don't know if we are the client or the server yet then we assume
2737     * client.
2738     */
2739    int server = s->handshake_func == NULL ? 0 : s->server;
2740    if (type != TLSEXT_NAMETYPE_host_name)
2741        return NULL;
2742
2743    if (server) {
2744        /**
2745         * Server side
2746         * In TLSv1.3 on the server SNI is not associated with the session
2747         * but in TLSv1.2 or below it is.
2748         *
2749         * Before the handshake:
2750         *  - return NULL
2751         *
2752         * During/after the handshake (TLSv1.2 or below resumption occurred):
2753         * - If a servername was accepted by the server in the original
2754         *   handshake then it will return that servername, or NULL otherwise.
2755         *
2756         * During/after the handshake (TLSv1.2 or below resumption did not occur):
2757         * - The function will return the servername requested by the client in
2758         *   this handshake or NULL if none was requested.
2759         */
2760         if (s->hit && !SSL_IS_TLS13(s))
2761            return s->session->ext.hostname;
2762    } else {
2763        /**
2764         * Client side
2765         *
2766         * Before the handshake:
2767         *  - If a servername has been set via a call to
2768         *    SSL_set_tlsext_host_name() then it will return that servername
2769         *  - If one has not been set, but a TLSv1.2 resumption is being
2770         *    attempted and the session from the original handshake had a
2771         *    servername accepted by the server then it will return that
2772         *    servername
2773         *  - Otherwise it returns NULL
2774         *
2775         * During/after the handshake (TLSv1.2 or below resumption occurred):
2776         * - If the session from the original handshake had a servername accepted
2777         *   by the server then it will return that servername.
2778         * - Otherwise it returns the servername set via
2779         *   SSL_set_tlsext_host_name() (or NULL if it was not called).
2780         *
2781         * During/after the handshake (TLSv1.2 or below resumption did not occur):
2782         * - It will return the servername set via SSL_set_tlsext_host_name()
2783         *   (or NULL if it was not called).
2784         */
2785        if (SSL_in_before(s)) {
2786            if (s->ext.hostname == NULL
2787                    && s->session != NULL
2788                    && s->session->ssl_version != TLS1_3_VERSION)
2789                return s->session->ext.hostname;
2790        } else {
2791            if (!SSL_IS_TLS13(s) && s->hit && s->session->ext.hostname != NULL)
2792                return s->session->ext.hostname;
2793        }
2794    }
2795
2796    return s->ext.hostname;
2797}
2798
2799int SSL_get_servername_type(const SSL *s)
2800{
2801    if (SSL_get_servername(s, TLSEXT_NAMETYPE_host_name) != NULL)
2802        return TLSEXT_NAMETYPE_host_name;
2803    return -1;
2804}
2805
2806/*
2807 * SSL_select_next_proto implements the standard protocol selection. It is
2808 * expected that this function is called from the callback set by
2809 * SSL_CTX_set_next_proto_select_cb. The protocol data is assumed to be a
2810 * vector of 8-bit, length prefixed byte strings. The length byte itself is
2811 * not included in the length. A byte string of length 0 is invalid. No byte
2812 * string may be truncated. The current, but experimental algorithm for
2813 * selecting the protocol is: 1) If the server doesn't support NPN then this
2814 * is indicated to the callback. In this case, the client application has to
2815 * abort the connection or have a default application level protocol. 2) If
2816 * the server supports NPN, but advertises an empty list then the client
2817 * selects the first protocol in its list, but indicates via the API that this
2818 * fallback case was enacted. 3) Otherwise, the client finds the first
2819 * protocol in the server's list that it supports and selects this protocol.
2820 * This is because it's assumed that the server has better information about
2821 * which protocol a client should use. 4) If the client doesn't support any
2822 * of the server's advertised protocols, then this is treated the same as
2823 * case 2. It returns either OPENSSL_NPN_NEGOTIATED if a common protocol was
2824 * found, or OPENSSL_NPN_NO_OVERLAP if the fallback case was reached.
2825 */
2826int SSL_select_next_proto(unsigned char **out, unsigned char *outlen,
2827                          const unsigned char *server,
2828                          unsigned int server_len,
2829                          const unsigned char *client, unsigned int client_len)
2830{
2831    unsigned int i, j;
2832    const unsigned char *result;
2833    int status = OPENSSL_NPN_UNSUPPORTED;
2834
2835    /*
2836     * For each protocol in server preference order, see if we support it.
2837     */
2838    for (i = 0; i < server_len;) {
2839        for (j = 0; j < client_len;) {
2840            if (server[i] == client[j] &&
2841                memcmp(&server[i + 1], &client[j + 1], server[i]) == 0) {
2842                /* We found a match */
2843                result = &server[i];
2844                status = OPENSSL_NPN_NEGOTIATED;
2845                goto found;
2846            }
2847            j += client[j];
2848            j++;
2849        }
2850        i += server[i];
2851        i++;
2852    }
2853
2854    /* There's no overlap between our protocols and the server's list. */
2855    result = client;
2856    status = OPENSSL_NPN_NO_OVERLAP;
2857
2858 found:
2859    *out = (unsigned char *)result + 1;
2860    *outlen = result[0];
2861    return status;
2862}
2863
2864#ifndef OPENSSL_NO_NEXTPROTONEG
2865/*
2866 * SSL_get0_next_proto_negotiated sets *data and *len to point to the
2867 * client's requested protocol for this connection and returns 0. If the
2868 * client didn't request any protocol, then *data is set to NULL. Note that
2869 * the client can request any protocol it chooses. The value returned from
2870 * this function need not be a member of the list of supported protocols
2871 * provided by the callback.
2872 */
2873void SSL_get0_next_proto_negotiated(const SSL *s, const unsigned char **data,
2874                                    unsigned *len)
2875{
2876    *data = s->ext.npn;
2877    if (!*data) {
2878        *len = 0;
2879    } else {
2880        *len = (unsigned int)s->ext.npn_len;
2881    }
2882}
2883
2884/*
2885 * SSL_CTX_set_npn_advertised_cb sets a callback that is called when
2886 * a TLS server needs a list of supported protocols for Next Protocol
2887 * Negotiation. The returned list must be in wire format.  The list is
2888 * returned by setting |out| to point to it and |outlen| to its length. This
2889 * memory will not be modified, but one should assume that the SSL* keeps a
2890 * reference to it. The callback should return SSL_TLSEXT_ERR_OK if it
2891 * wishes to advertise. Otherwise, no such extension will be included in the
2892 * ServerHello.
2893 */
2894void SSL_CTX_set_npn_advertised_cb(SSL_CTX *ctx,
2895                                   SSL_CTX_npn_advertised_cb_func cb,
2896                                   void *arg)
2897{
2898    ctx->ext.npn_advertised_cb = cb;
2899    ctx->ext.npn_advertised_cb_arg = arg;
2900}
2901
2902/*
2903 * SSL_CTX_set_next_proto_select_cb sets a callback that is called when a
2904 * client needs to select a protocol from the server's provided list. |out|
2905 * must be set to point to the selected protocol (which may be within |in|).
2906 * The length of the protocol name must be written into |outlen|. The
2907 * server's advertised protocols are provided in |in| and |inlen|. The
2908 * callback can assume that |in| is syntactically valid. The client must
2909 * select a protocol. It is fatal to the connection if this callback returns
2910 * a value other than SSL_TLSEXT_ERR_OK.
2911 */
2912void SSL_CTX_set_npn_select_cb(SSL_CTX *ctx,
2913                               SSL_CTX_npn_select_cb_func cb,
2914                               void *arg)
2915{
2916    ctx->ext.npn_select_cb = cb;
2917    ctx->ext.npn_select_cb_arg = arg;
2918}
2919#endif
2920
2921/*
2922 * SSL_CTX_set_alpn_protos sets the ALPN protocol list on |ctx| to |protos|.
2923 * |protos| must be in wire-format (i.e. a series of non-empty, 8-bit
2924 * length-prefixed strings). Returns 0 on success.
2925 */
2926int SSL_CTX_set_alpn_protos(SSL_CTX *ctx, const unsigned char *protos,
2927                            unsigned int protos_len)
2928{
2929    OPENSSL_free(ctx->ext.alpn);
2930    ctx->ext.alpn = OPENSSL_memdup(protos, protos_len);
2931    if (ctx->ext.alpn == NULL) {
2932        ctx->ext.alpn_len = 0;
2933        SSLerr(SSL_F_SSL_CTX_SET_ALPN_PROTOS, ERR_R_MALLOC_FAILURE);
2934        return 1;
2935    }
2936    ctx->ext.alpn_len = protos_len;
2937
2938    return 0;
2939}
2940
2941/*
2942 * SSL_set_alpn_protos sets the ALPN protocol list on |ssl| to |protos|.
2943 * |protos| must be in wire-format (i.e. a series of non-empty, 8-bit
2944 * length-prefixed strings). Returns 0 on success.
2945 */
2946int SSL_set_alpn_protos(SSL *ssl, const unsigned char *protos,
2947                        unsigned int protos_len)
2948{
2949    OPENSSL_free(ssl->ext.alpn);
2950    ssl->ext.alpn = OPENSSL_memdup(protos, protos_len);
2951    if (ssl->ext.alpn == NULL) {
2952        ssl->ext.alpn_len = 0;
2953        SSLerr(SSL_F_SSL_SET_ALPN_PROTOS, ERR_R_MALLOC_FAILURE);
2954        return 1;
2955    }
2956    ssl->ext.alpn_len = protos_len;
2957
2958    return 0;
2959}
2960
2961/*
2962 * SSL_CTX_set_alpn_select_cb sets a callback function on |ctx| that is
2963 * called during ClientHello processing in order to select an ALPN protocol
2964 * from the client's list of offered protocols.
2965 */
2966void SSL_CTX_set_alpn_select_cb(SSL_CTX *ctx,
2967                                SSL_CTX_alpn_select_cb_func cb,
2968                                void *arg)
2969{
2970    ctx->ext.alpn_select_cb = cb;
2971    ctx->ext.alpn_select_cb_arg = arg;
2972}
2973
2974/*
2975 * SSL_get0_alpn_selected gets the selected ALPN protocol (if any) from |ssl|.
2976 * On return it sets |*data| to point to |*len| bytes of protocol name
2977 * (not including the leading length-prefix byte). If the server didn't
2978 * respond with a negotiated protocol then |*len| will be zero.
2979 */
2980void SSL_get0_alpn_selected(const SSL *ssl, const unsigned char **data,
2981                            unsigned int *len)
2982{
2983    *data = NULL;
2984    if (ssl->s3)
2985        *data = ssl->s3->alpn_selected;
2986    if (*data == NULL)
2987        *len = 0;
2988    else
2989        *len = (unsigned int)ssl->s3->alpn_selected_len;
2990}
2991
2992int SSL_export_keying_material(SSL *s, unsigned char *out, size_t olen,
2993                               const char *label, size_t llen,
2994                               const unsigned char *context, size_t contextlen,
2995                               int use_context)
2996{
2997    if (s->session == NULL
2998        || (s->version < TLS1_VERSION && s->version != DTLS1_BAD_VER))
2999        return -1;
3000
3001    return s->method->ssl3_enc->export_keying_material(s, out, olen, label,
3002                                                       llen, context,
3003                                                       contextlen, use_context);
3004}
3005
3006int SSL_export_keying_material_early(SSL *s, unsigned char *out, size_t olen,
3007                                     const char *label, size_t llen,
3008                                     const unsigned char *context,
3009                                     size_t contextlen)
3010{
3011    if (s->version != TLS1_3_VERSION)
3012        return 0;
3013
3014    return tls13_export_keying_material_early(s, out, olen, label, llen,
3015                                              context, contextlen);
3016}
3017
3018static unsigned long ssl_session_hash(const SSL_SESSION *a)
3019{
3020    const unsigned char *session_id = a->session_id;
3021    unsigned long l;
3022    unsigned char tmp_storage[4];
3023
3024    if (a->session_id_length < sizeof(tmp_storage)) {
3025        memset(tmp_storage, 0, sizeof(tmp_storage));
3026        memcpy(tmp_storage, a->session_id, a->session_id_length);
3027        session_id = tmp_storage;
3028    }
3029
3030    l = (unsigned long)
3031        ((unsigned long)session_id[0]) |
3032        ((unsigned long)session_id[1] << 8L) |
3033        ((unsigned long)session_id[2] << 16L) |
3034        ((unsigned long)session_id[3] << 24L);
3035    return l;
3036}
3037
3038/*
3039 * NB: If this function (or indeed the hash function which uses a sort of
3040 * coarser function than this one) is changed, ensure
3041 * SSL_CTX_has_matching_session_id() is checked accordingly. It relies on
3042 * being able to construct an SSL_SESSION that will collide with any existing
3043 * session with a matching session ID.
3044 */
3045static int ssl_session_cmp(const SSL_SESSION *a, const SSL_SESSION *b)
3046{
3047    if (a->ssl_version != b->ssl_version)
3048        return 1;
3049    if (a->session_id_length != b->session_id_length)
3050        return 1;
3051    return memcmp(a->session_id, b->session_id, a->session_id_length);
3052}
3053
3054/*
3055 * These wrapper functions should remain rather than redeclaring
3056 * SSL_SESSION_hash and SSL_SESSION_cmp for void* types and casting each
3057 * variable. The reason is that the functions aren't static, they're exposed
3058 * via ssl.h.
3059 */
3060
3061SSL_CTX *SSL_CTX_new(const SSL_METHOD *meth)
3062{
3063    SSL_CTX *ret = NULL;
3064
3065    if (meth == NULL) {
3066        SSLerr(SSL_F_SSL_CTX_NEW, SSL_R_NULL_SSL_METHOD_PASSED);
3067        return NULL;
3068    }
3069
3070    if (!OPENSSL_init_ssl(OPENSSL_INIT_LOAD_SSL_STRINGS, NULL))
3071        return NULL;
3072
3073    if (SSL_get_ex_data_X509_STORE_CTX_idx() < 0) {
3074        SSLerr(SSL_F_SSL_CTX_NEW, SSL_R_X509_VERIFICATION_SETUP_PROBLEMS);
3075        goto err;
3076    }
3077    ret = OPENSSL_zalloc(sizeof(*ret));
3078    if (ret == NULL)
3079        goto err;
3080
3081    ret->method = meth;
3082    ret->min_proto_version = 0;
3083    ret->max_proto_version = 0;
3084    ret->mode = SSL_MODE_AUTO_RETRY;
3085    ret->session_cache_mode = SSL_SESS_CACHE_SERVER;
3086    ret->session_cache_size = SSL_SESSION_CACHE_MAX_SIZE_DEFAULT;
3087    /* We take the system default. */
3088    ret->session_timeout = meth->get_timeout();
3089    ret->references = 1;
3090    ret->lock = CRYPTO_THREAD_lock_new();
3091    if (ret->lock == NULL) {
3092        SSLerr(SSL_F_SSL_CTX_NEW, ERR_R_MALLOC_FAILURE);
3093        OPENSSL_free(ret);
3094        return NULL;
3095    }
3096    ret->max_cert_list = SSL_MAX_CERT_LIST_DEFAULT;
3097    ret->verify_mode = SSL_VERIFY_NONE;
3098    if ((ret->cert = ssl_cert_new()) == NULL)
3099        goto err;
3100
3101    ret->sessions = lh_SSL_SESSION_new(ssl_session_hash, ssl_session_cmp);
3102    if (ret->sessions == NULL)
3103        goto err;
3104    ret->cert_store = X509_STORE_new();
3105    if (ret->cert_store == NULL)
3106        goto err;
3107#ifndef OPENSSL_NO_CT
3108    ret->ctlog_store = CTLOG_STORE_new();
3109    if (ret->ctlog_store == NULL)
3110        goto err;
3111#endif
3112
3113    if (!SSL_CTX_set_ciphersuites(ret, TLS_DEFAULT_CIPHERSUITES))
3114        goto err;
3115
3116    if (!ssl_create_cipher_list(ret->method,
3117                                ret->tls13_ciphersuites,
3118                                &ret->cipher_list, &ret->cipher_list_by_id,
3119                                SSL_DEFAULT_CIPHER_LIST, ret->cert)
3120        || sk_SSL_CIPHER_num(ret->cipher_list) <= 0) {
3121        SSLerr(SSL_F_SSL_CTX_NEW, SSL_R_LIBRARY_HAS_NO_CIPHERS);
3122        goto err2;
3123    }
3124
3125    ret->param = X509_VERIFY_PARAM_new();
3126    if (ret->param == NULL)
3127        goto err;
3128
3129    if ((ret->md5 = EVP_get_digestbyname("ssl3-md5")) == NULL) {
3130        SSLerr(SSL_F_SSL_CTX_NEW, SSL_R_UNABLE_TO_LOAD_SSL3_MD5_ROUTINES);
3131        goto err2;
3132    }
3133    if ((ret->sha1 = EVP_get_digestbyname("ssl3-sha1")) == NULL) {
3134        SSLerr(SSL_F_SSL_CTX_NEW, SSL_R_UNABLE_TO_LOAD_SSL3_SHA1_ROUTINES);
3135        goto err2;
3136    }
3137
3138    if ((ret->ca_names = sk_X509_NAME_new_null()) == NULL)
3139        goto err;
3140
3141    if ((ret->client_ca_names = sk_X509_NAME_new_null()) == NULL)
3142        goto err;
3143
3144    if (!CRYPTO_new_ex_data(CRYPTO_EX_INDEX_SSL_CTX, ret, &ret->ex_data))
3145        goto err;
3146
3147    if ((ret->ext.secure = OPENSSL_secure_zalloc(sizeof(*ret->ext.secure))) == NULL)
3148        goto err;
3149
3150    /* No compression for DTLS */
3151    if (!(meth->ssl3_enc->enc_flags & SSL_ENC_FLAG_DTLS))
3152        ret->comp_methods = SSL_COMP_get_compression_methods();
3153
3154    ret->max_send_fragment = SSL3_RT_MAX_PLAIN_LENGTH;
3155    ret->split_send_fragment = SSL3_RT_MAX_PLAIN_LENGTH;
3156
3157    /* Setup RFC5077 ticket keys */
3158    if ((RAND_bytes(ret->ext.tick_key_name,
3159                    sizeof(ret->ext.tick_key_name)) <= 0)
3160        || (RAND_priv_bytes(ret->ext.secure->tick_hmac_key,
3161                       sizeof(ret->ext.secure->tick_hmac_key)) <= 0)
3162        || (RAND_priv_bytes(ret->ext.secure->tick_aes_key,
3163                       sizeof(ret->ext.secure->tick_aes_key)) <= 0))
3164        ret->options |= SSL_OP_NO_TICKET;
3165
3166    if (RAND_priv_bytes(ret->ext.cookie_hmac_key,
3167                   sizeof(ret->ext.cookie_hmac_key)) <= 0)
3168        goto err;
3169
3170#ifndef OPENSSL_NO_SRP
3171    if (!SSL_CTX_SRP_CTX_init(ret))
3172        goto err;
3173#endif
3174#ifndef OPENSSL_NO_ENGINE
3175# ifdef OPENSSL_SSL_CLIENT_ENGINE_AUTO
3176#  define eng_strx(x)     #x
3177#  define eng_str(x)      eng_strx(x)
3178    /* Use specific client engine automatically... ignore errors */
3179    {
3180        ENGINE *eng;
3181        eng = ENGINE_by_id(eng_str(OPENSSL_SSL_CLIENT_ENGINE_AUTO));
3182        if (!eng) {
3183            ERR_clear_error();
3184            ENGINE_load_builtin_engines();
3185            eng = ENGINE_by_id(eng_str(OPENSSL_SSL_CLIENT_ENGINE_AUTO));
3186        }
3187        if (!eng || !SSL_CTX_set_client_cert_engine(ret, eng))
3188            ERR_clear_error();
3189    }
3190# endif
3191#endif
3192    /*
3193     * Default is to connect to non-RI servers. When RI is more widely
3194     * deployed might change this.
3195     */
3196    ret->options |= SSL_OP_LEGACY_SERVER_CONNECT;
3197    /*
3198     * Disable compression by default to prevent CRIME. Applications can
3199     * re-enable compression by configuring
3200     * SSL_CTX_clear_options(ctx, SSL_OP_NO_COMPRESSION);
3201     * or by using the SSL_CONF library. Similarly we also enable TLSv1.3
3202     * middlebox compatibility by default. This may be disabled by default in
3203     * a later OpenSSL version.
3204     */
3205    ret->options |= SSL_OP_NO_COMPRESSION | SSL_OP_ENABLE_MIDDLEBOX_COMPAT;
3206
3207    ret->ext.status_type = TLSEXT_STATUSTYPE_nothing;
3208
3209    /*
3210     * We cannot usefully set a default max_early_data here (which gets
3211     * propagated in SSL_new(), for the following reason: setting the
3212     * SSL field causes tls_construct_stoc_early_data() to tell the
3213     * client that early data will be accepted when constructing a TLS 1.3
3214     * session ticket, and the client will accordingly send us early data
3215     * when using that ticket (if the client has early data to send).
3216     * However, in order for the early data to actually be consumed by
3217     * the application, the application must also have calls to
3218     * SSL_read_early_data(); otherwise we'll just skip past the early data
3219     * and ignore it.  So, since the application must add calls to
3220     * SSL_read_early_data(), we also require them to add
3221     * calls to SSL_CTX_set_max_early_data() in order to use early data,
3222     * eliminating the bandwidth-wasting early data in the case described
3223     * above.
3224     */
3225    ret->max_early_data = 0;
3226
3227    /*
3228     * Default recv_max_early_data is a fully loaded single record. Could be
3229     * split across multiple records in practice. We set this differently to
3230     * max_early_data so that, in the default case, we do not advertise any
3231     * support for early_data, but if a client were to send us some (e.g.
3232     * because of an old, stale ticket) then we will tolerate it and skip over
3233     * it.
3234     */
3235    ret->recv_max_early_data = SSL3_RT_MAX_PLAIN_LENGTH;
3236
3237    /* By default we send two session tickets automatically in TLSv1.3 */
3238    ret->num_tickets = 2;
3239
3240    ssl_ctx_system_config(ret);
3241
3242    return ret;
3243 err:
3244    SSLerr(SSL_F_SSL_CTX_NEW, ERR_R_MALLOC_FAILURE);
3245 err2:
3246    SSL_CTX_free(ret);
3247    return NULL;
3248}
3249
3250int SSL_CTX_up_ref(SSL_CTX *ctx)
3251{
3252    int i;
3253
3254    if (CRYPTO_UP_REF(&ctx->references, &i, ctx->lock) <= 0)
3255        return 0;
3256
3257    REF_PRINT_COUNT("SSL_CTX", ctx);
3258    REF_ASSERT_ISNT(i < 2);
3259    return ((i > 1) ? 1 : 0);
3260}
3261
3262void SSL_CTX_free(SSL_CTX *a)
3263{
3264    int i;
3265
3266    if (a == NULL)
3267        return;
3268
3269    CRYPTO_DOWN_REF(&a->references, &i, a->lock);
3270    REF_PRINT_COUNT("SSL_CTX", a);
3271    if (i > 0)
3272        return;
3273    REF_ASSERT_ISNT(i < 0);
3274
3275    X509_VERIFY_PARAM_free(a->param);
3276    dane_ctx_final(&a->dane);
3277
3278    /*
3279     * Free internal session cache. However: the remove_cb() may reference
3280     * the ex_data of SSL_CTX, thus the ex_data store can only be removed
3281     * after the sessions were flushed.
3282     * As the ex_data handling routines might also touch the session cache,
3283     * the most secure solution seems to be: empty (flush) the cache, then
3284     * free ex_data, then finally free the cache.
3285     * (See ticket [openssl.org #212].)
3286     */
3287    if (a->sessions != NULL)
3288        SSL_CTX_flush_sessions(a, 0);
3289
3290    CRYPTO_free_ex_data(CRYPTO_EX_INDEX_SSL_CTX, a, &a->ex_data);
3291    lh_SSL_SESSION_free(a->sessions);
3292    X509_STORE_free(a->cert_store);
3293#ifndef OPENSSL_NO_CT
3294    CTLOG_STORE_free(a->ctlog_store);
3295#endif
3296    sk_SSL_CIPHER_free(a->cipher_list);
3297    sk_SSL_CIPHER_free(a->cipher_list_by_id);
3298    sk_SSL_CIPHER_free(a->tls13_ciphersuites);
3299    ssl_cert_free(a->cert);
3300    sk_X509_NAME_pop_free(a->ca_names, X509_NAME_free);
3301    sk_X509_NAME_pop_free(a->client_ca_names, X509_NAME_free);
3302    sk_X509_pop_free(a->extra_certs, X509_free);
3303    a->comp_methods = NULL;
3304#ifndef OPENSSL_NO_SRTP
3305    sk_SRTP_PROTECTION_PROFILE_free(a->srtp_profiles);
3306#endif
3307#ifndef OPENSSL_NO_SRP
3308    SSL_CTX_SRP_CTX_free(a);
3309#endif
3310#ifndef OPENSSL_NO_ENGINE
3311    ENGINE_finish(a->client_cert_engine);
3312#endif
3313
3314#ifndef OPENSSL_NO_EC
3315    OPENSSL_free(a->ext.ecpointformats);
3316    OPENSSL_free(a->ext.supportedgroups);
3317#endif
3318    OPENSSL_free(a->ext.alpn);
3319    OPENSSL_secure_free(a->ext.secure);
3320
3321    CRYPTO_THREAD_lock_free(a->lock);
3322
3323    OPENSSL_free(a);
3324}
3325
3326void SSL_CTX_set_default_passwd_cb(SSL_CTX *ctx, pem_password_cb *cb)
3327{
3328    ctx->default_passwd_callback = cb;
3329}
3330
3331void SSL_CTX_set_default_passwd_cb_userdata(SSL_CTX *ctx, void *u)
3332{
3333    ctx->default_passwd_callback_userdata = u;
3334}
3335
3336pem_password_cb *SSL_CTX_get_default_passwd_cb(SSL_CTX *ctx)
3337{
3338    return ctx->default_passwd_callback;
3339}
3340
3341void *SSL_CTX_get_default_passwd_cb_userdata(SSL_CTX *ctx)
3342{
3343    return ctx->default_passwd_callback_userdata;
3344}
3345
3346void SSL_set_default_passwd_cb(SSL *s, pem_password_cb *cb)
3347{
3348    s->default_passwd_callback = cb;
3349}
3350
3351void SSL_set_default_passwd_cb_userdata(SSL *s, void *u)
3352{
3353    s->default_passwd_callback_userdata = u;
3354}
3355
3356pem_password_cb *SSL_get_default_passwd_cb(SSL *s)
3357{
3358    return s->default_passwd_callback;
3359}
3360
3361void *SSL_get_default_passwd_cb_userdata(SSL *s)
3362{
3363    return s->default_passwd_callback_userdata;
3364}
3365
3366void SSL_CTX_set_cert_verify_callback(SSL_CTX *ctx,
3367                                      int (*cb) (X509_STORE_CTX *, void *),
3368                                      void *arg)
3369{
3370    ctx->app_verify_callback = cb;
3371    ctx->app_verify_arg = arg;
3372}
3373
3374void SSL_CTX_set_verify(SSL_CTX *ctx, int mode,
3375                        int (*cb) (int, X509_STORE_CTX *))
3376{
3377    ctx->verify_mode = mode;
3378    ctx->default_verify_callback = cb;
3379}
3380
3381void SSL_CTX_set_verify_depth(SSL_CTX *ctx, int depth)
3382{
3383    X509_VERIFY_PARAM_set_depth(ctx->param, depth);
3384}
3385
3386void SSL_CTX_set_cert_cb(SSL_CTX *c, int (*cb) (SSL *ssl, void *arg), void *arg)
3387{
3388    ssl_cert_set_cert_cb(c->cert, cb, arg);
3389}
3390
3391void SSL_set_cert_cb(SSL *s, int (*cb) (SSL *ssl, void *arg), void *arg)
3392{
3393    ssl_cert_set_cert_cb(s->cert, cb, arg);
3394}
3395
3396void ssl_set_masks(SSL *s)
3397{
3398    CERT *c = s->cert;
3399    uint32_t *pvalid = s->s3->tmp.valid_flags;
3400    int rsa_enc, rsa_sign, dh_tmp, dsa_sign;
3401    unsigned long mask_k, mask_a;
3402#ifndef OPENSSL_NO_EC
3403    int have_ecc_cert, ecdsa_ok;
3404#endif
3405    if (c == NULL)
3406        return;
3407
3408#ifndef OPENSSL_NO_DH
3409    dh_tmp = (c->dh_tmp != NULL || c->dh_tmp_cb != NULL || c->dh_tmp_auto);
3410#else
3411    dh_tmp = 0;
3412#endif
3413
3414    rsa_enc = pvalid[SSL_PKEY_RSA] & CERT_PKEY_VALID;
3415    rsa_sign = pvalid[SSL_PKEY_RSA] & CERT_PKEY_VALID;
3416    dsa_sign = pvalid[SSL_PKEY_DSA_SIGN] & CERT_PKEY_VALID;
3417#ifndef OPENSSL_NO_EC
3418    have_ecc_cert = pvalid[SSL_PKEY_ECC] & CERT_PKEY_VALID;
3419#endif
3420    mask_k = 0;
3421    mask_a = 0;
3422
3423#ifdef CIPHER_DEBUG
3424    fprintf(stderr, "dht=%d re=%d rs=%d ds=%d\n",
3425            dh_tmp, rsa_enc, rsa_sign, dsa_sign);
3426#endif
3427
3428#ifndef OPENSSL_NO_GOST
3429    if (ssl_has_cert(s, SSL_PKEY_GOST12_512)) {
3430        mask_k |= SSL_kGOST;
3431        mask_a |= SSL_aGOST12;
3432    }
3433    if (ssl_has_cert(s, SSL_PKEY_GOST12_256)) {
3434        mask_k |= SSL_kGOST;
3435        mask_a |= SSL_aGOST12;
3436    }
3437    if (ssl_has_cert(s, SSL_PKEY_GOST01)) {
3438        mask_k |= SSL_kGOST;
3439        mask_a |= SSL_aGOST01;
3440    }
3441#endif
3442
3443    if (rsa_enc)
3444        mask_k |= SSL_kRSA;
3445
3446    if (dh_tmp)
3447        mask_k |= SSL_kDHE;
3448
3449    /*
3450     * If we only have an RSA-PSS certificate allow RSA authentication
3451     * if TLS 1.2 and peer supports it.
3452     */
3453
3454    if (rsa_enc || rsa_sign || (ssl_has_cert(s, SSL_PKEY_RSA_PSS_SIGN)
3455                && pvalid[SSL_PKEY_RSA_PSS_SIGN] & CERT_PKEY_EXPLICIT_SIGN
3456                && TLS1_get_version(s) == TLS1_2_VERSION))
3457        mask_a |= SSL_aRSA;
3458
3459    if (dsa_sign) {
3460        mask_a |= SSL_aDSS;
3461    }
3462
3463    mask_a |= SSL_aNULL;
3464
3465    /*
3466     * An ECC certificate may be usable for ECDH and/or ECDSA cipher suites
3467     * depending on the key usage extension.
3468     */
3469#ifndef OPENSSL_NO_EC
3470    if (have_ecc_cert) {
3471        uint32_t ex_kusage;
3472        ex_kusage = X509_get_key_usage(c->pkeys[SSL_PKEY_ECC].x509);
3473        ecdsa_ok = ex_kusage & X509v3_KU_DIGITAL_SIGNATURE;
3474        if (!(pvalid[SSL_PKEY_ECC] & CERT_PKEY_SIGN))
3475            ecdsa_ok = 0;
3476        if (ecdsa_ok)
3477            mask_a |= SSL_aECDSA;
3478    }
3479    /* Allow Ed25519 for TLS 1.2 if peer supports it */
3480    if (!(mask_a & SSL_aECDSA) && ssl_has_cert(s, SSL_PKEY_ED25519)
3481            && pvalid[SSL_PKEY_ED25519] & CERT_PKEY_EXPLICIT_SIGN
3482            && TLS1_get_version(s) == TLS1_2_VERSION)
3483            mask_a |= SSL_aECDSA;
3484
3485    /* Allow Ed448 for TLS 1.2 if peer supports it */
3486    if (!(mask_a & SSL_aECDSA) && ssl_has_cert(s, SSL_PKEY_ED448)
3487            && pvalid[SSL_PKEY_ED448] & CERT_PKEY_EXPLICIT_SIGN
3488            && TLS1_get_version(s) == TLS1_2_VERSION)
3489            mask_a |= SSL_aECDSA;
3490#endif
3491
3492#ifndef OPENSSL_NO_EC
3493    mask_k |= SSL_kECDHE;
3494#endif
3495
3496#ifndef OPENSSL_NO_PSK
3497    mask_k |= SSL_kPSK;
3498    mask_a |= SSL_aPSK;
3499    if (mask_k & SSL_kRSA)
3500        mask_k |= SSL_kRSAPSK;
3501    if (mask_k & SSL_kDHE)
3502        mask_k |= SSL_kDHEPSK;
3503    if (mask_k & SSL_kECDHE)
3504        mask_k |= SSL_kECDHEPSK;
3505#endif
3506
3507    s->s3->tmp.mask_k = mask_k;
3508    s->s3->tmp.mask_a = mask_a;
3509}
3510
3511#ifndef OPENSSL_NO_EC
3512
3513int ssl_check_srvr_ecc_cert_and_alg(X509 *x, SSL *s)
3514{
3515    if (s->s3->tmp.new_cipher->algorithm_auth & SSL_aECDSA) {
3516        /* key usage, if present, must allow signing */
3517        if (!(X509_get_key_usage(x) & X509v3_KU_DIGITAL_SIGNATURE)) {
3518            SSLerr(SSL_F_SSL_CHECK_SRVR_ECC_CERT_AND_ALG,
3519                   SSL_R_ECC_CERT_NOT_FOR_SIGNING);
3520            return 0;
3521        }
3522    }
3523    return 1;                   /* all checks are ok */
3524}
3525
3526#endif
3527
3528int ssl_get_server_cert_serverinfo(SSL *s, const unsigned char **serverinfo,
3529                                   size_t *serverinfo_length)
3530{
3531    CERT_PKEY *cpk = s->s3->tmp.cert;
3532    *serverinfo_length = 0;
3533
3534    if (cpk == NULL || cpk->serverinfo == NULL)
3535        return 0;
3536
3537    *serverinfo = cpk->serverinfo;
3538    *serverinfo_length = cpk->serverinfo_length;
3539    return 1;
3540}
3541
3542void ssl_update_cache(SSL *s, int mode)
3543{
3544    int i;
3545
3546    /*
3547     * If the session_id_length is 0, we are not supposed to cache it, and it
3548     * would be rather hard to do anyway :-)
3549     */
3550    if (s->session->session_id_length == 0)
3551        return;
3552
3553    /*
3554     * If sid_ctx_length is 0 there is no specific application context
3555     * associated with this session, so when we try to resume it and
3556     * SSL_VERIFY_PEER is requested to verify the client identity, we have no
3557     * indication that this is actually a session for the proper application
3558     * context, and the *handshake* will fail, not just the resumption attempt.
3559     * Do not cache (on the server) these sessions that are not resumable
3560     * (clients can set SSL_VERIFY_PEER without needing a sid_ctx set).
3561     */
3562    if (s->server && s->session->sid_ctx_length == 0
3563            && (s->verify_mode & SSL_VERIFY_PEER) != 0)
3564        return;
3565
3566    i = s->session_ctx->session_cache_mode;
3567    if ((i & mode) != 0
3568        && (!s->hit || SSL_IS_TLS13(s))) {
3569        /*
3570         * Add the session to the internal cache. In server side TLSv1.3 we
3571         * normally don't do this because by default it's a full stateless ticket
3572         * with only a dummy session id so there is no reason to cache it,
3573         * unless:
3574         * - we are doing early_data, in which case we cache so that we can
3575         *   detect replays
3576         * - the application has set a remove_session_cb so needs to know about
3577         *   session timeout events
3578         * - SSL_OP_NO_TICKET is set in which case it is a stateful ticket
3579         */
3580        if ((i & SSL_SESS_CACHE_NO_INTERNAL_STORE) == 0
3581                && (!SSL_IS_TLS13(s)
3582                    || !s->server
3583                    || (s->max_early_data > 0
3584                        && (s->options & SSL_OP_NO_ANTI_REPLAY) == 0)
3585                    || s->session_ctx->remove_session_cb != NULL
3586                    || (s->options & SSL_OP_NO_TICKET) != 0))
3587            SSL_CTX_add_session(s->session_ctx, s->session);
3588
3589        /*
3590         * Add the session to the external cache. We do this even in server side
3591         * TLSv1.3 without early data because some applications just want to
3592         * know about the creation of a session and aren't doing a full cache.
3593         */
3594        if (s->session_ctx->new_session_cb != NULL) {
3595            SSL_SESSION_up_ref(s->session);
3596            if (!s->session_ctx->new_session_cb(s, s->session))
3597                SSL_SESSION_free(s->session);
3598        }
3599    }
3600
3601    /* auto flush every 255 connections */
3602    if ((!(i & SSL_SESS_CACHE_NO_AUTO_CLEAR)) && ((i & mode) == mode)) {
3603        TSAN_QUALIFIER int *stat;
3604        if (mode & SSL_SESS_CACHE_CLIENT)
3605            stat = &s->session_ctx->stats.sess_connect_good;
3606        else
3607            stat = &s->session_ctx->stats.sess_accept_good;
3608        if ((tsan_load(stat) & 0xff) == 0xff)
3609            SSL_CTX_flush_sessions(s->session_ctx, (unsigned long)time(NULL));
3610    }
3611}
3612
3613const SSL_METHOD *SSL_CTX_get_ssl_method(const SSL_CTX *ctx)
3614{
3615    return ctx->method;
3616}
3617
3618const SSL_METHOD *SSL_get_ssl_method(const SSL *s)
3619{
3620    return s->method;
3621}
3622
3623int SSL_set_ssl_method(SSL *s, const SSL_METHOD *meth)
3624{
3625    int ret = 1;
3626
3627    if (s->method != meth) {
3628        const SSL_METHOD *sm = s->method;
3629        int (*hf) (SSL *) = s->handshake_func;
3630
3631        if (sm->version == meth->version)
3632            s->method = meth;
3633        else {
3634            sm->ssl_free(s);
3635            s->method = meth;
3636            ret = s->method->ssl_new(s);
3637        }
3638
3639        if (hf == sm->ssl_connect)
3640            s->handshake_func = meth->ssl_connect;
3641        else if (hf == sm->ssl_accept)
3642            s->handshake_func = meth->ssl_accept;
3643    }
3644    return ret;
3645}
3646
3647int SSL_get_error(const SSL *s, int i)
3648{
3649    int reason;
3650    unsigned long l;
3651    BIO *bio;
3652
3653    if (i > 0)
3654        return SSL_ERROR_NONE;
3655
3656    /*
3657     * Make things return SSL_ERROR_SYSCALL when doing SSL_do_handshake etc,
3658     * where we do encode the error
3659     */
3660    if ((l = ERR_peek_error()) != 0) {
3661        if (ERR_GET_LIB(l) == ERR_LIB_SYS)
3662            return SSL_ERROR_SYSCALL;
3663        else
3664            return SSL_ERROR_SSL;
3665    }
3666
3667    if (SSL_want_read(s)) {
3668        bio = SSL_get_rbio(s);
3669        if (BIO_should_read(bio))
3670            return SSL_ERROR_WANT_READ;
3671        else if (BIO_should_write(bio))
3672            /*
3673             * This one doesn't make too much sense ... We never try to write
3674             * to the rbio, and an application program where rbio and wbio
3675             * are separate couldn't even know what it should wait for.
3676             * However if we ever set s->rwstate incorrectly (so that we have
3677             * SSL_want_read(s) instead of SSL_want_write(s)) and rbio and
3678             * wbio *are* the same, this test works around that bug; so it
3679             * might be safer to keep it.
3680             */
3681            return SSL_ERROR_WANT_WRITE;
3682        else if (BIO_should_io_special(bio)) {
3683            reason = BIO_get_retry_reason(bio);
3684            if (reason == BIO_RR_CONNECT)
3685                return SSL_ERROR_WANT_CONNECT;
3686            else if (reason == BIO_RR_ACCEPT)
3687                return SSL_ERROR_WANT_ACCEPT;
3688            else
3689                return SSL_ERROR_SYSCALL; /* unknown */
3690        }
3691    }
3692
3693    if (SSL_want_write(s)) {
3694        /* Access wbio directly - in order to use the buffered bio if present */
3695        bio = s->wbio;
3696        if (BIO_should_write(bio))
3697            return SSL_ERROR_WANT_WRITE;
3698        else if (BIO_should_read(bio))
3699            /*
3700             * See above (SSL_want_read(s) with BIO_should_write(bio))
3701             */
3702            return SSL_ERROR_WANT_READ;
3703        else if (BIO_should_io_special(bio)) {
3704            reason = BIO_get_retry_reason(bio);
3705            if (reason == BIO_RR_CONNECT)
3706                return SSL_ERROR_WANT_CONNECT;
3707            else if (reason == BIO_RR_ACCEPT)
3708                return SSL_ERROR_WANT_ACCEPT;
3709            else
3710                return SSL_ERROR_SYSCALL;
3711        }
3712    }
3713    if (SSL_want_x509_lookup(s))
3714        return SSL_ERROR_WANT_X509_LOOKUP;
3715    if (SSL_want_async(s))
3716        return SSL_ERROR_WANT_ASYNC;
3717    if (SSL_want_async_job(s))
3718        return SSL_ERROR_WANT_ASYNC_JOB;
3719    if (SSL_want_client_hello_cb(s))
3720        return SSL_ERROR_WANT_CLIENT_HELLO_CB;
3721
3722    if ((s->shutdown & SSL_RECEIVED_SHUTDOWN) &&
3723        (s->s3->warn_alert == SSL_AD_CLOSE_NOTIFY))
3724        return SSL_ERROR_ZERO_RETURN;
3725
3726    return SSL_ERROR_SYSCALL;
3727}
3728
3729static int ssl_do_handshake_intern(void *vargs)
3730{
3731    struct ssl_async_args *args;
3732    SSL *s;
3733
3734    args = (struct ssl_async_args *)vargs;
3735    s = args->s;
3736
3737    return s->handshake_func(s);
3738}
3739
3740int SSL_do_handshake(SSL *s)
3741{
3742    int ret = 1;
3743
3744    if (s->handshake_func == NULL) {
3745        SSLerr(SSL_F_SSL_DO_HANDSHAKE, SSL_R_CONNECTION_TYPE_NOT_SET);
3746        return -1;
3747    }
3748
3749    ossl_statem_check_finish_init(s, -1);
3750
3751    s->method->ssl_renegotiate_check(s, 0);
3752
3753    if (SSL_in_init(s) || SSL_in_before(s)) {
3754        if ((s->mode & SSL_MODE_ASYNC) && ASYNC_get_current_job() == NULL) {
3755            struct ssl_async_args args;
3756
3757            args.s = s;
3758
3759            ret = ssl_start_async_job(s, &args, ssl_do_handshake_intern);
3760        } else {
3761            ret = s->handshake_func(s);
3762        }
3763    }
3764    return ret;
3765}
3766
3767void SSL_set_accept_state(SSL *s)
3768{
3769    s->server = 1;
3770    s->shutdown = 0;
3771    ossl_statem_clear(s);
3772    s->handshake_func = s->method->ssl_accept;
3773    clear_ciphers(s);
3774}
3775
3776void SSL_set_connect_state(SSL *s)
3777{
3778    s->server = 0;
3779    s->shutdown = 0;
3780    ossl_statem_clear(s);
3781    s->handshake_func = s->method->ssl_connect;
3782    clear_ciphers(s);
3783}
3784
3785int ssl_undefined_function(SSL *s)
3786{
3787    SSLerr(SSL_F_SSL_UNDEFINED_FUNCTION, ERR_R_SHOULD_NOT_HAVE_BEEN_CALLED);
3788    return 0;
3789}
3790
3791int ssl_undefined_void_function(void)
3792{
3793    SSLerr(SSL_F_SSL_UNDEFINED_VOID_FUNCTION,
3794           ERR_R_SHOULD_NOT_HAVE_BEEN_CALLED);
3795    return 0;
3796}
3797
3798int ssl_undefined_const_function(const SSL *s)
3799{
3800    return 0;
3801}
3802
3803const SSL_METHOD *ssl_bad_method(int ver)
3804{
3805    SSLerr(SSL_F_SSL_BAD_METHOD, ERR_R_SHOULD_NOT_HAVE_BEEN_CALLED);
3806    return NULL;
3807}
3808
3809const char *ssl_protocol_to_string(int version)
3810{
3811    switch(version)
3812    {
3813    case TLS1_3_VERSION:
3814        return "TLSv1.3";
3815
3816    case TLS1_2_VERSION:
3817        return "TLSv1.2";
3818
3819    case TLS1_1_VERSION:
3820        return "TLSv1.1";
3821
3822    case TLS1_VERSION:
3823        return "TLSv1";
3824
3825    case SSL3_VERSION:
3826        return "SSLv3";
3827
3828    case DTLS1_BAD_VER:
3829        return "DTLSv0.9";
3830
3831    case DTLS1_VERSION:
3832        return "DTLSv1";
3833
3834    case DTLS1_2_VERSION:
3835        return "DTLSv1.2";
3836
3837    default:
3838        return "unknown";
3839    }
3840}
3841
3842const char *SSL_get_version(const SSL *s)
3843{
3844    return ssl_protocol_to_string(s->version);
3845}
3846
3847static int dup_ca_names(STACK_OF(X509_NAME) **dst, STACK_OF(X509_NAME) *src)
3848{
3849    STACK_OF(X509_NAME) *sk;
3850    X509_NAME *xn;
3851    int i;
3852
3853    if (src == NULL) {
3854        *dst = NULL;
3855        return 1;
3856    }
3857
3858    if ((sk = sk_X509_NAME_new_null()) == NULL)
3859        return 0;
3860    for (i = 0; i < sk_X509_NAME_num(src); i++) {
3861        xn = X509_NAME_dup(sk_X509_NAME_value(src, i));
3862        if (xn == NULL) {
3863            sk_X509_NAME_pop_free(sk, X509_NAME_free);
3864            return 0;
3865        }
3866        if (sk_X509_NAME_insert(sk, xn, i) == 0) {
3867            X509_NAME_free(xn);
3868            sk_X509_NAME_pop_free(sk, X509_NAME_free);
3869            return 0;
3870        }
3871    }
3872    *dst = sk;
3873
3874    return 1;
3875}
3876
3877SSL *SSL_dup(SSL *s)
3878{
3879    SSL *ret;
3880    int i;
3881
3882    /* If we're not quiescent, just up_ref! */
3883    if (!SSL_in_init(s) || !SSL_in_before(s)) {
3884        CRYPTO_UP_REF(&s->references, &i, s->lock);
3885        return s;
3886    }
3887
3888    /*
3889     * Otherwise, copy configuration state, and session if set.
3890     */
3891    if ((ret = SSL_new(SSL_get_SSL_CTX(s))) == NULL)
3892        return NULL;
3893
3894    if (s->session != NULL) {
3895        /*
3896         * Arranges to share the same session via up_ref.  This "copies"
3897         * session-id, SSL_METHOD, sid_ctx, and 'cert'
3898         */
3899        if (!SSL_copy_session_id(ret, s))
3900            goto err;
3901    } else {
3902        /*
3903         * No session has been established yet, so we have to expect that
3904         * s->cert or ret->cert will be changed later -- they should not both
3905         * point to the same object, and thus we can't use
3906         * SSL_copy_session_id.
3907         */
3908        if (!SSL_set_ssl_method(ret, s->method))
3909            goto err;
3910
3911        if (s->cert != NULL) {
3912            ssl_cert_free(ret->cert);
3913            ret->cert = ssl_cert_dup(s->cert);
3914            if (ret->cert == NULL)
3915                goto err;
3916        }
3917
3918        if (!SSL_set_session_id_context(ret, s->sid_ctx,
3919                                        (int)s->sid_ctx_length))
3920            goto err;
3921    }
3922
3923    if (!ssl_dane_dup(ret, s))
3924        goto err;
3925    ret->version = s->version;
3926    ret->options = s->options;
3927    ret->min_proto_version = s->min_proto_version;
3928    ret->max_proto_version = s->max_proto_version;
3929    ret->mode = s->mode;
3930    SSL_set_max_cert_list(ret, SSL_get_max_cert_list(s));
3931    SSL_set_read_ahead(ret, SSL_get_read_ahead(s));
3932    ret->msg_callback = s->msg_callback;
3933    ret->msg_callback_arg = s->msg_callback_arg;
3934    SSL_set_verify(ret, SSL_get_verify_mode(s), SSL_get_verify_callback(s));
3935    SSL_set_verify_depth(ret, SSL_get_verify_depth(s));
3936    ret->generate_session_id = s->generate_session_id;
3937
3938    SSL_set_info_callback(ret, SSL_get_info_callback(s));
3939
3940    /* copy app data, a little dangerous perhaps */
3941    if (!CRYPTO_dup_ex_data(CRYPTO_EX_INDEX_SSL, &ret->ex_data, &s->ex_data))
3942        goto err;
3943
3944    ret->server = s->server;
3945    if (s->handshake_func) {
3946        if (s->server)
3947            SSL_set_accept_state(ret);
3948        else
3949            SSL_set_connect_state(ret);
3950    }
3951    ret->shutdown = s->shutdown;
3952    ret->hit = s->hit;
3953
3954    ret->default_passwd_callback = s->default_passwd_callback;
3955    ret->default_passwd_callback_userdata = s->default_passwd_callback_userdata;
3956
3957    X509_VERIFY_PARAM_inherit(ret->param, s->param);
3958
3959    /* dup the cipher_list and cipher_list_by_id stacks */
3960    if (s->cipher_list != NULL) {
3961        if ((ret->cipher_list = sk_SSL_CIPHER_dup(s->cipher_list)) == NULL)
3962            goto err;
3963    }
3964    if (s->cipher_list_by_id != NULL)
3965        if ((ret->cipher_list_by_id = sk_SSL_CIPHER_dup(s->cipher_list_by_id))
3966            == NULL)
3967            goto err;
3968
3969    /* Dup the client_CA list */
3970    if (!dup_ca_names(&ret->ca_names, s->ca_names)
3971            || !dup_ca_names(&ret->client_ca_names, s->client_ca_names))
3972        goto err;
3973
3974    return ret;
3975
3976 err:
3977    SSL_free(ret);
3978    return NULL;
3979}
3980
3981void ssl_clear_cipher_ctx(SSL *s)
3982{
3983    if (s->enc_read_ctx != NULL) {
3984        EVP_CIPHER_CTX_free(s->enc_read_ctx);
3985        s->enc_read_ctx = NULL;
3986    }
3987    if (s->enc_write_ctx != NULL) {
3988        EVP_CIPHER_CTX_free(s->enc_write_ctx);
3989        s->enc_write_ctx = NULL;
3990    }
3991#ifndef OPENSSL_NO_COMP
3992    COMP_CTX_free(s->expand);
3993    s->expand = NULL;
3994    COMP_CTX_free(s->compress);
3995    s->compress = NULL;
3996#endif
3997}
3998
3999X509 *SSL_get_certificate(const SSL *s)
4000{
4001    if (s->cert != NULL)
4002        return s->cert->key->x509;
4003    else
4004        return NULL;
4005}
4006
4007EVP_PKEY *SSL_get_privatekey(const SSL *s)
4008{
4009    if (s->cert != NULL)
4010        return s->cert->key->privatekey;
4011    else
4012        return NULL;
4013}
4014
4015X509 *SSL_CTX_get0_certificate(const SSL_CTX *ctx)
4016{
4017    if (ctx->cert != NULL)
4018        return ctx->cert->key->x509;
4019    else
4020        return NULL;
4021}
4022
4023EVP_PKEY *SSL_CTX_get0_privatekey(const SSL_CTX *ctx)
4024{
4025    if (ctx->cert != NULL)
4026        return ctx->cert->key->privatekey;
4027    else
4028        return NULL;
4029}
4030
4031const SSL_CIPHER *SSL_get_current_cipher(const SSL *s)
4032{
4033    if ((s->session != NULL) && (s->session->cipher != NULL))
4034        return s->session->cipher;
4035    return NULL;
4036}
4037
4038const SSL_CIPHER *SSL_get_pending_cipher(const SSL *s)
4039{
4040    return s->s3->tmp.new_cipher;
4041}
4042
4043const COMP_METHOD *SSL_get_current_compression(const SSL *s)
4044{
4045#ifndef OPENSSL_NO_COMP
4046    return s->compress ? COMP_CTX_get_method(s->compress) : NULL;
4047#else
4048    return NULL;
4049#endif
4050}
4051
4052const COMP_METHOD *SSL_get_current_expansion(const SSL *s)
4053{
4054#ifndef OPENSSL_NO_COMP
4055    return s->expand ? COMP_CTX_get_method(s->expand) : NULL;
4056#else
4057    return NULL;
4058#endif
4059}
4060
4061int ssl_init_wbio_buffer(SSL *s)
4062{
4063    BIO *bbio;
4064
4065    if (s->bbio != NULL) {
4066        /* Already buffered. */
4067        return 1;
4068    }
4069
4070    bbio = BIO_new(BIO_f_buffer());
4071    if (bbio == NULL || !BIO_set_read_buffer_size(bbio, 1)) {
4072        BIO_free(bbio);
4073        SSLerr(SSL_F_SSL_INIT_WBIO_BUFFER, ERR_R_BUF_LIB);
4074        return 0;
4075    }
4076    s->bbio = bbio;
4077    s->wbio = BIO_push(bbio, s->wbio);
4078
4079    return 1;
4080}
4081
4082int ssl_free_wbio_buffer(SSL *s)
4083{
4084    /* callers ensure s is never null */
4085    if (s->bbio == NULL)
4086        return 1;
4087
4088    s->wbio = BIO_pop(s->wbio);
4089    BIO_free(s->bbio);
4090    s->bbio = NULL;
4091
4092    return 1;
4093}
4094
4095void SSL_CTX_set_quiet_shutdown(SSL_CTX *ctx, int mode)
4096{
4097    ctx->quiet_shutdown = mode;
4098}
4099
4100int SSL_CTX_get_quiet_shutdown(const SSL_CTX *ctx)
4101{
4102    return ctx->quiet_shutdown;
4103}
4104
4105void SSL_set_quiet_shutdown(SSL *s, int mode)
4106{
4107    s->quiet_shutdown = mode;
4108}
4109
4110int SSL_get_quiet_shutdown(const SSL *s)
4111{
4112    return s->quiet_shutdown;
4113}
4114
4115void SSL_set_shutdown(SSL *s, int mode)
4116{
4117    s->shutdown = mode;
4118}
4119
4120int SSL_get_shutdown(const SSL *s)
4121{
4122    return s->shutdown;
4123}
4124
4125int SSL_version(const SSL *s)
4126{
4127    return s->version;
4128}
4129
4130int SSL_client_version(const SSL *s)
4131{
4132    return s->client_version;
4133}
4134
4135SSL_CTX *SSL_get_SSL_CTX(const SSL *ssl)
4136{
4137    return ssl->ctx;
4138}
4139
4140SSL_CTX *SSL_set_SSL_CTX(SSL *ssl, SSL_CTX *ctx)
4141{
4142    CERT *new_cert;
4143    if (ssl->ctx == ctx)
4144        return ssl->ctx;
4145    if (ctx == NULL)
4146        ctx = ssl->session_ctx;
4147    new_cert = ssl_cert_dup(ctx->cert);
4148    if (new_cert == NULL) {
4149        return NULL;
4150    }
4151
4152    if (!custom_exts_copy_flags(&new_cert->custext, &ssl->cert->custext)) {
4153        ssl_cert_free(new_cert);
4154        return NULL;
4155    }
4156
4157    ssl_cert_free(ssl->cert);
4158    ssl->cert = new_cert;
4159
4160    /*
4161     * Program invariant: |sid_ctx| has fixed size (SSL_MAX_SID_CTX_LENGTH),
4162     * so setter APIs must prevent invalid lengths from entering the system.
4163     */
4164    if (!ossl_assert(ssl->sid_ctx_length <= sizeof(ssl->sid_ctx)))
4165        return NULL;
4166
4167    /*
4168     * If the session ID context matches that of the parent SSL_CTX,
4169     * inherit it from the new SSL_CTX as well. If however the context does
4170     * not match (i.e., it was set per-ssl with SSL_set_session_id_context),
4171     * leave it unchanged.
4172     */
4173    if ((ssl->ctx != NULL) &&
4174        (ssl->sid_ctx_length == ssl->ctx->sid_ctx_length) &&
4175        (memcmp(ssl->sid_ctx, ssl->ctx->sid_ctx, ssl->sid_ctx_length) == 0)) {
4176        ssl->sid_ctx_length = ctx->sid_ctx_length;
4177        memcpy(&ssl->sid_ctx, &ctx->sid_ctx, sizeof(ssl->sid_ctx));
4178    }
4179
4180    SSL_CTX_up_ref(ctx);
4181    SSL_CTX_free(ssl->ctx);     /* decrement reference count */
4182    ssl->ctx = ctx;
4183
4184    return ssl->ctx;
4185}
4186
4187int SSL_CTX_set_default_verify_paths(SSL_CTX *ctx)
4188{
4189    return X509_STORE_set_default_paths(ctx->cert_store);
4190}
4191
4192int SSL_CTX_set_default_verify_dir(SSL_CTX *ctx)
4193{
4194    X509_LOOKUP *lookup;
4195
4196    lookup = X509_STORE_add_lookup(ctx->cert_store, X509_LOOKUP_hash_dir());
4197    if (lookup == NULL)
4198        return 0;
4199    X509_LOOKUP_add_dir(lookup, NULL, X509_FILETYPE_DEFAULT);
4200
4201    /* Clear any errors if the default directory does not exist */
4202    ERR_clear_error();
4203
4204    return 1;
4205}
4206
4207int SSL_CTX_set_default_verify_file(SSL_CTX *ctx)
4208{
4209    X509_LOOKUP *lookup;
4210
4211    lookup = X509_STORE_add_lookup(ctx->cert_store, X509_LOOKUP_file());
4212    if (lookup == NULL)
4213        return 0;
4214
4215    X509_LOOKUP_load_file(lookup, NULL, X509_FILETYPE_DEFAULT);
4216
4217    /* Clear any errors if the default file does not exist */
4218    ERR_clear_error();
4219
4220    return 1;
4221}
4222
4223int SSL_CTX_load_verify_locations(SSL_CTX *ctx, const char *CAfile,
4224                                  const char *CApath)
4225{
4226    return X509_STORE_load_locations(ctx->cert_store, CAfile, CApath);
4227}
4228
4229void SSL_set_info_callback(SSL *ssl,
4230                           void (*cb) (const SSL *ssl, int type, int val))
4231{
4232    ssl->info_callback = cb;
4233}
4234
4235/*
4236 * One compiler (Diab DCC) doesn't like argument names in returned function
4237 * pointer.
4238 */
4239void (*SSL_get_info_callback(const SSL *ssl)) (const SSL * /* ssl */ ,
4240                                               int /* type */ ,
4241                                               int /* val */ ) {
4242    return ssl->info_callback;
4243}
4244
4245void SSL_set_verify_result(SSL *ssl, long arg)
4246{
4247    ssl->verify_result = arg;
4248}
4249
4250long SSL_get_verify_result(const SSL *ssl)
4251{
4252    return ssl->verify_result;
4253}
4254
4255size_t SSL_get_client_random(const SSL *ssl, unsigned char *out, size_t outlen)
4256{
4257    if (outlen == 0)
4258        return sizeof(ssl->s3->client_random);
4259    if (outlen > sizeof(ssl->s3->client_random))
4260        outlen = sizeof(ssl->s3->client_random);
4261    memcpy(out, ssl->s3->client_random, outlen);
4262    return outlen;
4263}
4264
4265size_t SSL_get_server_random(const SSL *ssl, unsigned char *out, size_t outlen)
4266{
4267    if (outlen == 0)
4268        return sizeof(ssl->s3->server_random);
4269    if (outlen > sizeof(ssl->s3->server_random))
4270        outlen = sizeof(ssl->s3->server_random);
4271    memcpy(out, ssl->s3->server_random, outlen);
4272    return outlen;
4273}
4274
4275size_t SSL_SESSION_get_master_key(const SSL_SESSION *session,
4276                                  unsigned char *out, size_t outlen)
4277{
4278    if (outlen == 0)
4279        return session->master_key_length;
4280    if (outlen > session->master_key_length)
4281        outlen = session->master_key_length;
4282    memcpy(out, session->master_key, outlen);
4283    return outlen;
4284}
4285
4286int SSL_SESSION_set1_master_key(SSL_SESSION *sess, const unsigned char *in,
4287                                size_t len)
4288{
4289    if (len > sizeof(sess->master_key))
4290        return 0;
4291
4292    memcpy(sess->master_key, in, len);
4293    sess->master_key_length = len;
4294    return 1;
4295}
4296
4297
4298int SSL_set_ex_data(SSL *s, int idx, void *arg)
4299{
4300    return CRYPTO_set_ex_data(&s->ex_data, idx, arg);
4301}
4302
4303void *SSL_get_ex_data(const SSL *s, int idx)
4304{
4305    return CRYPTO_get_ex_data(&s->ex_data, idx);
4306}
4307
4308int SSL_CTX_set_ex_data(SSL_CTX *s, int idx, void *arg)
4309{
4310    return CRYPTO_set_ex_data(&s->ex_data, idx, arg);
4311}
4312
4313void *SSL_CTX_get_ex_data(const SSL_CTX *s, int idx)
4314{
4315    return CRYPTO_get_ex_data(&s->ex_data, idx);
4316}
4317
4318X509_STORE *SSL_CTX_get_cert_store(const SSL_CTX *ctx)
4319{
4320    return ctx->cert_store;
4321}
4322
4323void SSL_CTX_set_cert_store(SSL_CTX *ctx, X509_STORE *store)
4324{
4325    X509_STORE_free(ctx->cert_store);
4326    ctx->cert_store = store;
4327}
4328
4329void SSL_CTX_set1_cert_store(SSL_CTX *ctx, X509_STORE *store)
4330{
4331    if (store != NULL)
4332        X509_STORE_up_ref(store);
4333    SSL_CTX_set_cert_store(ctx, store);
4334}
4335
4336int SSL_want(const SSL *s)
4337{
4338    return s->rwstate;
4339}
4340
4341/**
4342 * \brief Set the callback for generating temporary DH keys.
4343 * \param ctx the SSL context.
4344 * \param dh the callback
4345 */
4346
4347#ifndef OPENSSL_NO_DH
4348void SSL_CTX_set_tmp_dh_callback(SSL_CTX *ctx,
4349                                 DH *(*dh) (SSL *ssl, int is_export,
4350                                            int keylength))
4351{
4352    SSL_CTX_callback_ctrl(ctx, SSL_CTRL_SET_TMP_DH_CB, (void (*)(void))dh);
4353}
4354
4355void SSL_set_tmp_dh_callback(SSL *ssl, DH *(*dh) (SSL *ssl, int is_export,
4356                                                  int keylength))
4357{
4358    SSL_callback_ctrl(ssl, SSL_CTRL_SET_TMP_DH_CB, (void (*)(void))dh);
4359}
4360#endif
4361
4362#ifndef OPENSSL_NO_PSK
4363int SSL_CTX_use_psk_identity_hint(SSL_CTX *ctx, const char *identity_hint)
4364{
4365    if (identity_hint != NULL && strlen(identity_hint) > PSK_MAX_IDENTITY_LEN) {
4366        SSLerr(SSL_F_SSL_CTX_USE_PSK_IDENTITY_HINT, SSL_R_DATA_LENGTH_TOO_LONG);
4367        return 0;
4368    }
4369    OPENSSL_free(ctx->cert->psk_identity_hint);
4370    if (identity_hint != NULL) {
4371        ctx->cert->psk_identity_hint = OPENSSL_strdup(identity_hint);
4372        if (ctx->cert->psk_identity_hint == NULL)
4373            return 0;
4374    } else
4375        ctx->cert->psk_identity_hint = NULL;
4376    return 1;
4377}
4378
4379int SSL_use_psk_identity_hint(SSL *s, const char *identity_hint)
4380{
4381    if (s == NULL)
4382        return 0;
4383
4384    if (identity_hint != NULL && strlen(identity_hint) > PSK_MAX_IDENTITY_LEN) {
4385        SSLerr(SSL_F_SSL_USE_PSK_IDENTITY_HINT, SSL_R_DATA_LENGTH_TOO_LONG);
4386        return 0;
4387    }
4388    OPENSSL_free(s->cert->psk_identity_hint);
4389    if (identity_hint != NULL) {
4390        s->cert->psk_identity_hint = OPENSSL_strdup(identity_hint);
4391        if (s->cert->psk_identity_hint == NULL)
4392            return 0;
4393    } else
4394        s->cert->psk_identity_hint = NULL;
4395    return 1;
4396}
4397
4398const char *SSL_get_psk_identity_hint(const SSL *s)
4399{
4400    if (s == NULL || s->session == NULL)
4401        return NULL;
4402    return s->session->psk_identity_hint;
4403}
4404
4405const char *SSL_get_psk_identity(const SSL *s)
4406{
4407    if (s == NULL || s->session == NULL)
4408        return NULL;
4409    return s->session->psk_identity;
4410}
4411
4412void SSL_set_psk_client_callback(SSL *s, SSL_psk_client_cb_func cb)
4413{
4414    s->psk_client_callback = cb;
4415}
4416
4417void SSL_CTX_set_psk_client_callback(SSL_CTX *ctx, SSL_psk_client_cb_func cb)
4418{
4419    ctx->psk_client_callback = cb;
4420}
4421
4422void SSL_set_psk_server_callback(SSL *s, SSL_psk_server_cb_func cb)
4423{
4424    s->psk_server_callback = cb;
4425}
4426
4427void SSL_CTX_set_psk_server_callback(SSL_CTX *ctx, SSL_psk_server_cb_func cb)
4428{
4429    ctx->psk_server_callback = cb;
4430}
4431#endif
4432
4433void SSL_set_psk_find_session_callback(SSL *s, SSL_psk_find_session_cb_func cb)
4434{
4435    s->psk_find_session_cb = cb;
4436}
4437
4438void SSL_CTX_set_psk_find_session_callback(SSL_CTX *ctx,
4439                                           SSL_psk_find_session_cb_func cb)
4440{
4441    ctx->psk_find_session_cb = cb;
4442}
4443
4444void SSL_set_psk_use_session_callback(SSL *s, SSL_psk_use_session_cb_func cb)
4445{
4446    s->psk_use_session_cb = cb;
4447}
4448
4449void SSL_CTX_set_psk_use_session_callback(SSL_CTX *ctx,
4450                                           SSL_psk_use_session_cb_func cb)
4451{
4452    ctx->psk_use_session_cb = cb;
4453}
4454
4455void SSL_CTX_set_msg_callback(SSL_CTX *ctx,
4456                              void (*cb) (int write_p, int version,
4457                                          int content_type, const void *buf,
4458                                          size_t len, SSL *ssl, void *arg))
4459{
4460    SSL_CTX_callback_ctrl(ctx, SSL_CTRL_SET_MSG_CALLBACK, (void (*)(void))cb);
4461}
4462
4463void SSL_set_msg_callback(SSL *ssl,
4464                          void (*cb) (int write_p, int version,
4465                                      int content_type, const void *buf,
4466                                      size_t len, SSL *ssl, void *arg))
4467{
4468    SSL_callback_ctrl(ssl, SSL_CTRL_SET_MSG_CALLBACK, (void (*)(void))cb);
4469}
4470
4471void SSL_CTX_set_not_resumable_session_callback(SSL_CTX *ctx,
4472                                                int (*cb) (SSL *ssl,
4473                                                           int
4474                                                           is_forward_secure))
4475{
4476    SSL_CTX_callback_ctrl(ctx, SSL_CTRL_SET_NOT_RESUMABLE_SESS_CB,
4477                          (void (*)(void))cb);
4478}
4479
4480void SSL_set_not_resumable_session_callback(SSL *ssl,
4481                                            int (*cb) (SSL *ssl,
4482                                                       int is_forward_secure))
4483{
4484    SSL_callback_ctrl(ssl, SSL_CTRL_SET_NOT_RESUMABLE_SESS_CB,
4485                      (void (*)(void))cb);
4486}
4487
4488void SSL_CTX_set_record_padding_callback(SSL_CTX *ctx,
4489                                         size_t (*cb) (SSL *ssl, int type,
4490                                                       size_t len, void *arg))
4491{
4492    ctx->record_padding_cb = cb;
4493}
4494
4495void SSL_CTX_set_record_padding_callback_arg(SSL_CTX *ctx, void *arg)
4496{
4497    ctx->record_padding_arg = arg;
4498}
4499
4500void *SSL_CTX_get_record_padding_callback_arg(const SSL_CTX *ctx)
4501{
4502    return ctx->record_padding_arg;
4503}
4504
4505int SSL_CTX_set_block_padding(SSL_CTX *ctx, size_t block_size)
4506{
4507    /* block size of 0 or 1 is basically no padding */
4508    if (block_size == 1)
4509        ctx->block_padding = 0;
4510    else if (block_size <= SSL3_RT_MAX_PLAIN_LENGTH)
4511        ctx->block_padding = block_size;
4512    else
4513        return 0;
4514    return 1;
4515}
4516
4517int SSL_set_record_padding_callback(SSL *ssl,
4518                                     size_t (*cb) (SSL *ssl, int type,
4519                                                   size_t len, void *arg))
4520{
4521    BIO *b;
4522
4523    b = SSL_get_wbio(ssl);
4524    if (b == NULL || !BIO_get_ktls_send(b)) {
4525        ssl->record_padding_cb = cb;
4526        return 1;
4527    }
4528    return 0;
4529}
4530
4531void SSL_set_record_padding_callback_arg(SSL *ssl, void *arg)
4532{
4533    ssl->record_padding_arg = arg;
4534}
4535
4536void *SSL_get_record_padding_callback_arg(const SSL *ssl)
4537{
4538    return ssl->record_padding_arg;
4539}
4540
4541int SSL_set_block_padding(SSL *ssl, size_t block_size)
4542{
4543    /* block size of 0 or 1 is basically no padding */
4544    if (block_size == 1)
4545        ssl->block_padding = 0;
4546    else if (block_size <= SSL3_RT_MAX_PLAIN_LENGTH)
4547        ssl->block_padding = block_size;
4548    else
4549        return 0;
4550    return 1;
4551}
4552
4553int SSL_set_num_tickets(SSL *s, size_t num_tickets)
4554{
4555    s->num_tickets = num_tickets;
4556
4557    return 1;
4558}
4559
4560size_t SSL_get_num_tickets(const SSL *s)
4561{
4562    return s->num_tickets;
4563}
4564
4565int SSL_CTX_set_num_tickets(SSL_CTX *ctx, size_t num_tickets)
4566{
4567    ctx->num_tickets = num_tickets;
4568
4569    return 1;
4570}
4571
4572size_t SSL_CTX_get_num_tickets(const SSL_CTX *ctx)
4573{
4574    return ctx->num_tickets;
4575}
4576
4577/*
4578 * Allocates new EVP_MD_CTX and sets pointer to it into given pointer
4579 * variable, freeing EVP_MD_CTX previously stored in that variable, if any.
4580 * If EVP_MD pointer is passed, initializes ctx with this |md|.
4581 * Returns the newly allocated ctx;
4582 */
4583
4584EVP_MD_CTX *ssl_replace_hash(EVP_MD_CTX **hash, const EVP_MD *md)
4585{
4586    ssl_clear_hash_ctx(hash);
4587    *hash = EVP_MD_CTX_new();
4588    if (*hash == NULL || (md && EVP_DigestInit_ex(*hash, md, NULL) <= 0)) {
4589        EVP_MD_CTX_free(*hash);
4590        *hash = NULL;
4591        return NULL;
4592    }
4593    return *hash;
4594}
4595
4596void ssl_clear_hash_ctx(EVP_MD_CTX **hash)
4597{
4598
4599    EVP_MD_CTX_free(*hash);
4600    *hash = NULL;
4601}
4602
4603/* Retrieve handshake hashes */
4604int ssl_handshake_hash(SSL *s, unsigned char *out, size_t outlen,
4605                       size_t *hashlen)
4606{
4607    EVP_MD_CTX *ctx = NULL;
4608    EVP_MD_CTX *hdgst = s->s3->handshake_dgst;
4609    int hashleni = EVP_MD_CTX_size(hdgst);
4610    int ret = 0;
4611
4612    if (hashleni < 0 || (size_t)hashleni > outlen) {
4613        SSLfatal(s, SSL_AD_INTERNAL_ERROR, SSL_F_SSL_HANDSHAKE_HASH,
4614                 ERR_R_INTERNAL_ERROR);
4615        goto err;
4616    }
4617
4618    ctx = EVP_MD_CTX_new();
4619    if (ctx == NULL)
4620        goto err;
4621
4622    if (!EVP_MD_CTX_copy_ex(ctx, hdgst)
4623        || EVP_DigestFinal_ex(ctx, out, NULL) <= 0) {
4624        SSLfatal(s, SSL_AD_INTERNAL_ERROR, SSL_F_SSL_HANDSHAKE_HASH,
4625                 ERR_R_INTERNAL_ERROR);
4626        goto err;
4627    }
4628
4629    *hashlen = hashleni;
4630
4631    ret = 1;
4632 err:
4633    EVP_MD_CTX_free(ctx);
4634    return ret;
4635}
4636
4637int SSL_session_reused(const SSL *s)
4638{
4639    return s->hit;
4640}
4641
4642int SSL_is_server(const SSL *s)
4643{
4644    return s->server;
4645}
4646
4647#if OPENSSL_API_COMPAT < 0x10100000L
4648void SSL_set_debug(SSL *s, int debug)
4649{
4650    /* Old function was do-nothing anyway... */
4651    (void)s;
4652    (void)debug;
4653}
4654#endif
4655
4656void SSL_set_security_level(SSL *s, int level)
4657{
4658    s->cert->sec_level = level;
4659}
4660
4661int SSL_get_security_level(const SSL *s)
4662{
4663    return s->cert->sec_level;
4664}
4665
4666void SSL_set_security_callback(SSL *s,
4667                               int (*cb) (const SSL *s, const SSL_CTX *ctx,
4668                                          int op, int bits, int nid,
4669                                          void *other, void *ex))
4670{
4671    s->cert->sec_cb = cb;
4672}
4673
4674int (*SSL_get_security_callback(const SSL *s)) (const SSL *s,
4675                                                const SSL_CTX *ctx, int op,
4676                                                int bits, int nid, void *other,
4677                                                void *ex) {
4678    return s->cert->sec_cb;
4679}
4680
4681void SSL_set0_security_ex_data(SSL *s, void *ex)
4682{
4683    s->cert->sec_ex = ex;
4684}
4685
4686void *SSL_get0_security_ex_data(const SSL *s)
4687{
4688    return s->cert->sec_ex;
4689}
4690
4691void SSL_CTX_set_security_level(SSL_CTX *ctx, int level)
4692{
4693    ctx->cert->sec_level = level;
4694}
4695
4696int SSL_CTX_get_security_level(const SSL_CTX *ctx)
4697{
4698    return ctx->cert->sec_level;
4699}
4700
4701void SSL_CTX_set_security_callback(SSL_CTX *ctx,
4702                                   int (*cb) (const SSL *s, const SSL_CTX *ctx,
4703                                              int op, int bits, int nid,
4704                                              void *other, void *ex))
4705{
4706    ctx->cert->sec_cb = cb;
4707}
4708
4709int (*SSL_CTX_get_security_callback(const SSL_CTX *ctx)) (const SSL *s,
4710                                                          const SSL_CTX *ctx,
4711                                                          int op, int bits,
4712                                                          int nid,
4713                                                          void *other,
4714                                                          void *ex) {
4715    return ctx->cert->sec_cb;
4716}
4717
4718void SSL_CTX_set0_security_ex_data(SSL_CTX *ctx, void *ex)
4719{
4720    ctx->cert->sec_ex = ex;
4721}
4722
4723void *SSL_CTX_get0_security_ex_data(const SSL_CTX *ctx)
4724{
4725    return ctx->cert->sec_ex;
4726}
4727
4728/*
4729 * Get/Set/Clear options in SSL_CTX or SSL, formerly macros, now functions that
4730 * can return unsigned long, instead of the generic long return value from the
4731 * control interface.
4732 */
4733unsigned long SSL_CTX_get_options(const SSL_CTX *ctx)
4734{
4735    return ctx->options;
4736}
4737
4738unsigned long SSL_get_options(const SSL *s)
4739{
4740    return s->options;
4741}
4742
4743unsigned long SSL_CTX_set_options(SSL_CTX *ctx, unsigned long op)
4744{
4745    return ctx->options |= op;
4746}
4747
4748unsigned long SSL_set_options(SSL *s, unsigned long op)
4749{
4750    return s->options |= op;
4751}
4752
4753unsigned long SSL_CTX_clear_options(SSL_CTX *ctx, unsigned long op)
4754{
4755    return ctx->options &= ~op;
4756}
4757
4758unsigned long SSL_clear_options(SSL *s, unsigned long op)
4759{
4760    return s->options &= ~op;
4761}
4762
4763STACK_OF(X509) *SSL_get0_verified_chain(const SSL *s)
4764{
4765    return s->verified_chain;
4766}
4767
4768IMPLEMENT_OBJ_BSEARCH_GLOBAL_CMP_FN(SSL_CIPHER, SSL_CIPHER, ssl_cipher_id);
4769
4770#ifndef OPENSSL_NO_CT
4771
4772/*
4773 * Moves SCTs from the |src| stack to the |dst| stack.
4774 * The source of each SCT will be set to |origin|.
4775 * If |dst| points to a NULL pointer, a new stack will be created and owned by
4776 * the caller.
4777 * Returns the number of SCTs moved, or a negative integer if an error occurs.
4778 */
4779static int ct_move_scts(STACK_OF(SCT) **dst, STACK_OF(SCT) *src,
4780                        sct_source_t origin)
4781{
4782    int scts_moved = 0;
4783    SCT *sct = NULL;
4784
4785    if (*dst == NULL) {
4786        *dst = sk_SCT_new_null();
4787        if (*dst == NULL) {
4788            SSLerr(SSL_F_CT_MOVE_SCTS, ERR_R_MALLOC_FAILURE);
4789            goto err;
4790        }
4791    }
4792
4793    while ((sct = sk_SCT_pop(src)) != NULL) {
4794        if (SCT_set_source(sct, origin) != 1)
4795            goto err;
4796
4797        if (sk_SCT_push(*dst, sct) <= 0)
4798            goto err;
4799        scts_moved += 1;
4800    }
4801
4802    return scts_moved;
4803 err:
4804    if (sct != NULL)
4805        sk_SCT_push(src, sct);  /* Put the SCT back */
4806    return -1;
4807}
4808
4809/*
4810 * Look for data collected during ServerHello and parse if found.
4811 * Returns the number of SCTs extracted.
4812 */
4813static int ct_extract_tls_extension_scts(SSL *s)
4814{
4815    int scts_extracted = 0;
4816
4817    if (s->ext.scts != NULL) {
4818        const unsigned char *p = s->ext.scts;
4819        STACK_OF(SCT) *scts = o2i_SCT_LIST(NULL, &p, s->ext.scts_len);
4820
4821        scts_extracted = ct_move_scts(&s->scts, scts, SCT_SOURCE_TLS_EXTENSION);
4822
4823        SCT_LIST_free(scts);
4824    }
4825
4826    return scts_extracted;
4827}
4828
4829/*
4830 * Checks for an OCSP response and then attempts to extract any SCTs found if it
4831 * contains an SCT X509 extension. They will be stored in |s->scts|.
4832 * Returns:
4833 * - The number of SCTs extracted, assuming an OCSP response exists.
4834 * - 0 if no OCSP response exists or it contains no SCTs.
4835 * - A negative integer if an error occurs.
4836 */
4837static int ct_extract_ocsp_response_scts(SSL *s)
4838{
4839# ifndef OPENSSL_NO_OCSP
4840    int scts_extracted = 0;
4841    const unsigned char *p;
4842    OCSP_BASICRESP *br = NULL;
4843    OCSP_RESPONSE *rsp = NULL;
4844    STACK_OF(SCT) *scts = NULL;
4845    int i;
4846
4847    if (s->ext.ocsp.resp == NULL || s->ext.ocsp.resp_len == 0)
4848        goto err;
4849
4850    p = s->ext.ocsp.resp;
4851    rsp = d2i_OCSP_RESPONSE(NULL, &p, (int)s->ext.ocsp.resp_len);
4852    if (rsp == NULL)
4853        goto err;
4854
4855    br = OCSP_response_get1_basic(rsp);
4856    if (br == NULL)
4857        goto err;
4858
4859    for (i = 0; i < OCSP_resp_count(br); ++i) {
4860        OCSP_SINGLERESP *single = OCSP_resp_get0(br, i);
4861
4862        if (single == NULL)
4863            continue;
4864
4865        scts =
4866            OCSP_SINGLERESP_get1_ext_d2i(single, NID_ct_cert_scts, NULL, NULL);
4867        scts_extracted =
4868            ct_move_scts(&s->scts, scts, SCT_SOURCE_OCSP_STAPLED_RESPONSE);
4869        if (scts_extracted < 0)
4870            goto err;
4871    }
4872 err:
4873    SCT_LIST_free(scts);
4874    OCSP_BASICRESP_free(br);
4875    OCSP_RESPONSE_free(rsp);
4876    return scts_extracted;
4877# else
4878    /* Behave as if no OCSP response exists */
4879    return 0;
4880# endif
4881}
4882
4883/*
4884 * Attempts to extract SCTs from the peer certificate.
4885 * Return the number of SCTs extracted, or a negative integer if an error
4886 * occurs.
4887 */
4888static int ct_extract_x509v3_extension_scts(SSL *s)
4889{
4890    int scts_extracted = 0;
4891    X509 *cert = s->session != NULL ? s->session->peer : NULL;
4892
4893    if (cert != NULL) {
4894        STACK_OF(SCT) *scts =
4895            X509_get_ext_d2i(cert, NID_ct_precert_scts, NULL, NULL);
4896
4897        scts_extracted =
4898            ct_move_scts(&s->scts, scts, SCT_SOURCE_X509V3_EXTENSION);
4899
4900        SCT_LIST_free(scts);
4901    }
4902
4903    return scts_extracted;
4904}
4905
4906/*
4907 * Attempts to find all received SCTs by checking TLS extensions, the OCSP
4908 * response (if it exists) and X509v3 extensions in the certificate.
4909 * Returns NULL if an error occurs.
4910 */
4911const STACK_OF(SCT) *SSL_get0_peer_scts(SSL *s)
4912{
4913    if (!s->scts_parsed) {
4914        if (ct_extract_tls_extension_scts(s) < 0 ||
4915            ct_extract_ocsp_response_scts(s) < 0 ||
4916            ct_extract_x509v3_extension_scts(s) < 0)
4917            goto err;
4918
4919        s->scts_parsed = 1;
4920    }
4921    return s->scts;
4922 err:
4923    return NULL;
4924}
4925
4926static int ct_permissive(const CT_POLICY_EVAL_CTX * ctx,
4927                         const STACK_OF(SCT) *scts, void *unused_arg)
4928{
4929    return 1;
4930}
4931
4932static int ct_strict(const CT_POLICY_EVAL_CTX * ctx,
4933                     const STACK_OF(SCT) *scts, void *unused_arg)
4934{
4935    int count = scts != NULL ? sk_SCT_num(scts) : 0;
4936    int i;
4937
4938    for (i = 0; i < count; ++i) {
4939        SCT *sct = sk_SCT_value(scts, i);
4940        int status = SCT_get_validation_status(sct);
4941
4942        if (status == SCT_VALIDATION_STATUS_VALID)
4943            return 1;
4944    }
4945    SSLerr(SSL_F_CT_STRICT, SSL_R_NO_VALID_SCTS);
4946    return 0;
4947}
4948
4949int SSL_set_ct_validation_callback(SSL *s, ssl_ct_validation_cb callback,
4950                                   void *arg)
4951{
4952    /*
4953     * Since code exists that uses the custom extension handler for CT, look
4954     * for this and throw an error if they have already registered to use CT.
4955     */
4956    if (callback != NULL && SSL_CTX_has_client_custom_ext(s->ctx,
4957                                                          TLSEXT_TYPE_signed_certificate_timestamp))
4958    {
4959        SSLerr(SSL_F_SSL_SET_CT_VALIDATION_CALLBACK,
4960               SSL_R_CUSTOM_EXT_HANDLER_ALREADY_INSTALLED);
4961        return 0;
4962    }
4963
4964    if (callback != NULL) {
4965        /*
4966         * If we are validating CT, then we MUST accept SCTs served via OCSP
4967         */
4968        if (!SSL_set_tlsext_status_type(s, TLSEXT_STATUSTYPE_ocsp))
4969            return 0;
4970    }
4971
4972    s->ct_validation_callback = callback;
4973    s->ct_validation_callback_arg = arg;
4974
4975    return 1;
4976}
4977
4978int SSL_CTX_set_ct_validation_callback(SSL_CTX *ctx,
4979                                       ssl_ct_validation_cb callback, void *arg)
4980{
4981    /*
4982     * Since code exists that uses the custom extension handler for CT, look for
4983     * this and throw an error if they have already registered to use CT.
4984     */
4985    if (callback != NULL && SSL_CTX_has_client_custom_ext(ctx,
4986                                                          TLSEXT_TYPE_signed_certificate_timestamp))
4987    {
4988        SSLerr(SSL_F_SSL_CTX_SET_CT_VALIDATION_CALLBACK,
4989               SSL_R_CUSTOM_EXT_HANDLER_ALREADY_INSTALLED);
4990        return 0;
4991    }
4992
4993    ctx->ct_validation_callback = callback;
4994    ctx->ct_validation_callback_arg = arg;
4995    return 1;
4996}
4997
4998int SSL_ct_is_enabled(const SSL *s)
4999{
5000    return s->ct_validation_callback != NULL;
5001}
5002
5003int SSL_CTX_ct_is_enabled(const SSL_CTX *ctx)
5004{
5005    return ctx->ct_validation_callback != NULL;
5006}
5007
5008int ssl_validate_ct(SSL *s)
5009{
5010    int ret = 0;
5011    X509 *cert = s->session != NULL ? s->session->peer : NULL;
5012    X509 *issuer;
5013    SSL_DANE *dane = &s->dane;
5014    CT_POLICY_EVAL_CTX *ctx = NULL;
5015    const STACK_OF(SCT) *scts;
5016
5017    /*
5018     * If no callback is set, the peer is anonymous, or its chain is invalid,
5019     * skip SCT validation - just return success.  Applications that continue
5020     * handshakes without certificates, with unverified chains, or pinned leaf
5021     * certificates are outside the scope of the WebPKI and CT.
5022     *
5023     * The above exclusions notwithstanding the vast majority of peers will
5024     * have rather ordinary certificate chains validated by typical
5025     * applications that perform certificate verification and therefore will
5026     * process SCTs when enabled.
5027     */
5028    if (s->ct_validation_callback == NULL || cert == NULL ||
5029        s->verify_result != X509_V_OK ||
5030        s->verified_chain == NULL || sk_X509_num(s->verified_chain) <= 1)
5031        return 1;
5032
5033    /*
5034     * CT not applicable for chains validated via DANE-TA(2) or DANE-EE(3)
5035     * trust-anchors.  See https://tools.ietf.org/html/rfc7671#section-4.2
5036     */
5037    if (DANETLS_ENABLED(dane) && dane->mtlsa != NULL) {
5038        switch (dane->mtlsa->usage) {
5039        case DANETLS_USAGE_DANE_TA:
5040        case DANETLS_USAGE_DANE_EE:
5041            return 1;
5042        }
5043    }
5044
5045    ctx = CT_POLICY_EVAL_CTX_new();
5046    if (ctx == NULL) {
5047        SSLfatal(s, SSL_AD_INTERNAL_ERROR, SSL_F_SSL_VALIDATE_CT,
5048                 ERR_R_MALLOC_FAILURE);
5049        goto end;
5050    }
5051
5052    issuer = sk_X509_value(s->verified_chain, 1);
5053    CT_POLICY_EVAL_CTX_set1_cert(ctx, cert);
5054    CT_POLICY_EVAL_CTX_set1_issuer(ctx, issuer);
5055    CT_POLICY_EVAL_CTX_set_shared_CTLOG_STORE(ctx, s->ctx->ctlog_store);
5056    CT_POLICY_EVAL_CTX_set_time(
5057            ctx, (uint64_t)SSL_SESSION_get_time(SSL_get0_session(s)) * 1000);
5058
5059    scts = SSL_get0_peer_scts(s);
5060
5061    /*
5062     * This function returns success (> 0) only when all the SCTs are valid, 0
5063     * when some are invalid, and < 0 on various internal errors (out of
5064     * memory, etc.).  Having some, or even all, invalid SCTs is not sufficient
5065     * reason to abort the handshake, that decision is up to the callback.
5066     * Therefore, we error out only in the unexpected case that the return
5067     * value is negative.
5068     *
5069     * XXX: One might well argue that the return value of this function is an
5070     * unfortunate design choice.  Its job is only to determine the validation
5071     * status of each of the provided SCTs.  So long as it correctly separates
5072     * the wheat from the chaff it should return success.  Failure in this case
5073     * ought to correspond to an inability to carry out its duties.
5074     */
5075    if (SCT_LIST_validate(scts, ctx) < 0) {
5076        SSLfatal(s, SSL_AD_HANDSHAKE_FAILURE, SSL_F_SSL_VALIDATE_CT,
5077                 SSL_R_SCT_VERIFICATION_FAILED);
5078        goto end;
5079    }
5080
5081    ret = s->ct_validation_callback(ctx, scts, s->ct_validation_callback_arg);
5082    if (ret < 0)
5083        ret = 0;                /* This function returns 0 on failure */
5084    if (!ret)
5085        SSLfatal(s, SSL_AD_HANDSHAKE_FAILURE, SSL_F_SSL_VALIDATE_CT,
5086                 SSL_R_CALLBACK_FAILED);
5087
5088 end:
5089    CT_POLICY_EVAL_CTX_free(ctx);
5090    /*
5091     * With SSL_VERIFY_NONE the session may be cached and re-used despite a
5092     * failure return code here.  Also the application may wish the complete
5093     * the handshake, and then disconnect cleanly at a higher layer, after
5094     * checking the verification status of the completed connection.
5095     *
5096     * We therefore force a certificate verification failure which will be
5097     * visible via SSL_get_verify_result() and cached as part of any resumed
5098     * session.
5099     *
5100     * Note: the permissive callback is for information gathering only, always
5101     * returns success, and does not affect verification status.  Only the
5102     * strict callback or a custom application-specified callback can trigger
5103     * connection failure or record a verification error.
5104     */
5105    if (ret <= 0)
5106        s->verify_result = X509_V_ERR_NO_VALID_SCTS;
5107    return ret;
5108}
5109
5110int SSL_CTX_enable_ct(SSL_CTX *ctx, int validation_mode)
5111{
5112    switch (validation_mode) {
5113    default:
5114        SSLerr(SSL_F_SSL_CTX_ENABLE_CT, SSL_R_INVALID_CT_VALIDATION_TYPE);
5115        return 0;
5116    case SSL_CT_VALIDATION_PERMISSIVE:
5117        return SSL_CTX_set_ct_validation_callback(ctx, ct_permissive, NULL);
5118    case SSL_CT_VALIDATION_STRICT:
5119        return SSL_CTX_set_ct_validation_callback(ctx, ct_strict, NULL);
5120    }
5121}
5122
5123int SSL_enable_ct(SSL *s, int validation_mode)
5124{
5125    switch (validation_mode) {
5126    default:
5127        SSLerr(SSL_F_SSL_ENABLE_CT, SSL_R_INVALID_CT_VALIDATION_TYPE);
5128        return 0;
5129    case SSL_CT_VALIDATION_PERMISSIVE:
5130        return SSL_set_ct_validation_callback(s, ct_permissive, NULL);
5131    case SSL_CT_VALIDATION_STRICT:
5132        return SSL_set_ct_validation_callback(s, ct_strict, NULL);
5133    }
5134}
5135
5136int SSL_CTX_set_default_ctlog_list_file(SSL_CTX *ctx)
5137{
5138    return CTLOG_STORE_load_default_file(ctx->ctlog_store);
5139}
5140
5141int SSL_CTX_set_ctlog_list_file(SSL_CTX *ctx, const char *path)
5142{
5143    return CTLOG_STORE_load_file(ctx->ctlog_store, path);
5144}
5145
5146void SSL_CTX_set0_ctlog_store(SSL_CTX *ctx, CTLOG_STORE * logs)
5147{
5148    CTLOG_STORE_free(ctx->ctlog_store);
5149    ctx->ctlog_store = logs;
5150}
5151
5152const CTLOG_STORE *SSL_CTX_get0_ctlog_store(const SSL_CTX *ctx)
5153{
5154    return ctx->ctlog_store;
5155}
5156
5157#endif  /* OPENSSL_NO_CT */
5158
5159void SSL_CTX_set_client_hello_cb(SSL_CTX *c, SSL_client_hello_cb_fn cb,
5160                                 void *arg)
5161{
5162    c->client_hello_cb = cb;
5163    c->client_hello_cb_arg = arg;
5164}
5165
5166int SSL_client_hello_isv2(SSL *s)
5167{
5168    if (s->clienthello == NULL)
5169        return 0;
5170    return s->clienthello->isv2;
5171}
5172
5173unsigned int SSL_client_hello_get0_legacy_version(SSL *s)
5174{
5175    if (s->clienthello == NULL)
5176        return 0;
5177    return s->clienthello->legacy_version;
5178}
5179
5180size_t SSL_client_hello_get0_random(SSL *s, const unsigned char **out)
5181{
5182    if (s->clienthello == NULL)
5183        return 0;
5184    if (out != NULL)
5185        *out = s->clienthello->random;
5186    return SSL3_RANDOM_SIZE;
5187}
5188
5189size_t SSL_client_hello_get0_session_id(SSL *s, const unsigned char **out)
5190{
5191    if (s->clienthello == NULL)
5192        return 0;
5193    if (out != NULL)
5194        *out = s->clienthello->session_id;
5195    return s->clienthello->session_id_len;
5196}
5197
5198size_t SSL_client_hello_get0_ciphers(SSL *s, const unsigned char **out)
5199{
5200    if (s->clienthello == NULL)
5201        return 0;
5202    if (out != NULL)
5203        *out = PACKET_data(&s->clienthello->ciphersuites);
5204    return PACKET_remaining(&s->clienthello->ciphersuites);
5205}
5206
5207size_t SSL_client_hello_get0_compression_methods(SSL *s, const unsigned char **out)
5208{
5209    if (s->clienthello == NULL)
5210        return 0;
5211    if (out != NULL)
5212        *out = s->clienthello->compressions;
5213    return s->clienthello->compressions_len;
5214}
5215
5216int SSL_client_hello_get1_extensions_present(SSL *s, int **out, size_t *outlen)
5217{
5218    RAW_EXTENSION *ext;
5219    int *present;
5220    size_t num = 0, i;
5221
5222    if (s->clienthello == NULL || out == NULL || outlen == NULL)
5223        return 0;
5224    for (i = 0; i < s->clienthello->pre_proc_exts_len; i++) {
5225        ext = s->clienthello->pre_proc_exts + i;
5226        if (ext->present)
5227            num++;
5228    }
5229    if (num == 0) {
5230        *out = NULL;
5231        *outlen = 0;
5232        return 1;
5233    }
5234    if ((present = OPENSSL_malloc(sizeof(*present) * num)) == NULL) {
5235        SSLerr(SSL_F_SSL_CLIENT_HELLO_GET1_EXTENSIONS_PRESENT,
5236               ERR_R_MALLOC_FAILURE);
5237        return 0;
5238    }
5239    for (i = 0; i < s->clienthello->pre_proc_exts_len; i++) {
5240        ext = s->clienthello->pre_proc_exts + i;
5241        if (ext->present) {
5242            if (ext->received_order >= num)
5243                goto err;
5244            present[ext->received_order] = ext->type;
5245        }
5246    }
5247    *out = present;
5248    *outlen = num;
5249    return 1;
5250 err:
5251    OPENSSL_free(present);
5252    return 0;
5253}
5254
5255int SSL_client_hello_get0_ext(SSL *s, unsigned int type, const unsigned char **out,
5256                       size_t *outlen)
5257{
5258    size_t i;
5259    RAW_EXTENSION *r;
5260
5261    if (s->clienthello == NULL)
5262        return 0;
5263    for (i = 0; i < s->clienthello->pre_proc_exts_len; ++i) {
5264        r = s->clienthello->pre_proc_exts + i;
5265        if (r->present && r->type == type) {
5266            if (out != NULL)
5267                *out = PACKET_data(&r->data);
5268            if (outlen != NULL)
5269                *outlen = PACKET_remaining(&r->data);
5270            return 1;
5271        }
5272    }
5273    return 0;
5274}
5275
5276int SSL_free_buffers(SSL *ssl)
5277{
5278    RECORD_LAYER *rl = &ssl->rlayer;
5279
5280    if (RECORD_LAYER_read_pending(rl) || RECORD_LAYER_write_pending(rl))
5281        return 0;
5282
5283    RECORD_LAYER_release(rl);
5284    return 1;
5285}
5286
5287int SSL_alloc_buffers(SSL *ssl)
5288{
5289    return ssl3_setup_buffers(ssl);
5290}
5291
5292void SSL_CTX_set_keylog_callback(SSL_CTX *ctx, SSL_CTX_keylog_cb_func cb)
5293{
5294    ctx->keylog_callback = cb;
5295}
5296
5297SSL_CTX_keylog_cb_func SSL_CTX_get_keylog_callback(const SSL_CTX *ctx)
5298{
5299    return ctx->keylog_callback;
5300}
5301
5302static int nss_keylog_int(const char *prefix,
5303                          SSL *ssl,
5304                          const uint8_t *parameter_1,
5305                          size_t parameter_1_len,
5306                          const uint8_t *parameter_2,
5307                          size_t parameter_2_len)
5308{
5309    char *out = NULL;
5310    char *cursor = NULL;
5311    size_t out_len = 0;
5312    size_t i;
5313    size_t prefix_len;
5314
5315    if (ssl->ctx->keylog_callback == NULL)
5316        return 1;
5317
5318    /*
5319     * Our output buffer will contain the following strings, rendered with
5320     * space characters in between, terminated by a NULL character: first the
5321     * prefix, then the first parameter, then the second parameter. The
5322     * meaning of each parameter depends on the specific key material being
5323     * logged. Note that the first and second parameters are encoded in
5324     * hexadecimal, so we need a buffer that is twice their lengths.
5325     */
5326    prefix_len = strlen(prefix);
5327    out_len = prefix_len + (2 * parameter_1_len) + (2 * parameter_2_len) + 3;
5328    if ((out = cursor = OPENSSL_malloc(out_len)) == NULL) {
5329        SSLfatal(ssl, SSL_AD_INTERNAL_ERROR, SSL_F_NSS_KEYLOG_INT,
5330                 ERR_R_MALLOC_FAILURE);
5331        return 0;
5332    }
5333
5334    strcpy(cursor, prefix);
5335    cursor += prefix_len;
5336    *cursor++ = ' ';
5337
5338    for (i = 0; i < parameter_1_len; i++) {
5339        sprintf(cursor, "%02x", parameter_1[i]);
5340        cursor += 2;
5341    }
5342    *cursor++ = ' ';
5343
5344    for (i = 0; i < parameter_2_len; i++) {
5345        sprintf(cursor, "%02x", parameter_2[i]);
5346        cursor += 2;
5347    }
5348    *cursor = '\0';
5349
5350    ssl->ctx->keylog_callback(ssl, (const char *)out);
5351    OPENSSL_clear_free(out, out_len);
5352    return 1;
5353
5354}
5355
5356int ssl_log_rsa_client_key_exchange(SSL *ssl,
5357                                    const uint8_t *encrypted_premaster,
5358                                    size_t encrypted_premaster_len,
5359                                    const uint8_t *premaster,
5360                                    size_t premaster_len)
5361{
5362    if (encrypted_premaster_len < 8) {
5363        SSLfatal(ssl, SSL_AD_INTERNAL_ERROR,
5364                 SSL_F_SSL_LOG_RSA_CLIENT_KEY_EXCHANGE, ERR_R_INTERNAL_ERROR);
5365        return 0;
5366    }
5367
5368    /* We only want the first 8 bytes of the encrypted premaster as a tag. */
5369    return nss_keylog_int("RSA",
5370                          ssl,
5371                          encrypted_premaster,
5372                          8,
5373                          premaster,
5374                          premaster_len);
5375}
5376
5377int ssl_log_secret(SSL *ssl,
5378                   const char *label,
5379                   const uint8_t *secret,
5380                   size_t secret_len)
5381{
5382    return nss_keylog_int(label,
5383                          ssl,
5384                          ssl->s3->client_random,
5385                          SSL3_RANDOM_SIZE,
5386                          secret,
5387                          secret_len);
5388}
5389
5390#define SSLV2_CIPHER_LEN    3
5391
5392int ssl_cache_cipherlist(SSL *s, PACKET *cipher_suites, int sslv2format)
5393{
5394    int n;
5395
5396    n = sslv2format ? SSLV2_CIPHER_LEN : TLS_CIPHER_LEN;
5397
5398    if (PACKET_remaining(cipher_suites) == 0) {
5399        SSLfatal(s, SSL_AD_ILLEGAL_PARAMETER, SSL_F_SSL_CACHE_CIPHERLIST,
5400                 SSL_R_NO_CIPHERS_SPECIFIED);
5401        return 0;
5402    }
5403
5404    if (PACKET_remaining(cipher_suites) % n != 0) {
5405        SSLfatal(s, SSL_AD_DECODE_ERROR, SSL_F_SSL_CACHE_CIPHERLIST,
5406                 SSL_R_ERROR_IN_RECEIVED_CIPHER_LIST);
5407        return 0;
5408    }
5409
5410    OPENSSL_free(s->s3->tmp.ciphers_raw);
5411    s->s3->tmp.ciphers_raw = NULL;
5412    s->s3->tmp.ciphers_rawlen = 0;
5413
5414    if (sslv2format) {
5415        size_t numciphers = PACKET_remaining(cipher_suites) / n;
5416        PACKET sslv2ciphers = *cipher_suites;
5417        unsigned int leadbyte;
5418        unsigned char *raw;
5419
5420        /*
5421         * We store the raw ciphers list in SSLv3+ format so we need to do some
5422         * preprocessing to convert the list first. If there are any SSLv2 only
5423         * ciphersuites with a non-zero leading byte then we are going to
5424         * slightly over allocate because we won't store those. But that isn't a
5425         * problem.
5426         */
5427        raw = OPENSSL_malloc(numciphers * TLS_CIPHER_LEN);
5428        s->s3->tmp.ciphers_raw = raw;
5429        if (raw == NULL) {
5430            SSLfatal(s, SSL_AD_INTERNAL_ERROR, SSL_F_SSL_CACHE_CIPHERLIST,
5431                     ERR_R_MALLOC_FAILURE);
5432            return 0;
5433        }
5434        for (s->s3->tmp.ciphers_rawlen = 0;
5435             PACKET_remaining(&sslv2ciphers) > 0;
5436             raw += TLS_CIPHER_LEN) {
5437            if (!PACKET_get_1(&sslv2ciphers, &leadbyte)
5438                    || (leadbyte == 0
5439                        && !PACKET_copy_bytes(&sslv2ciphers, raw,
5440                                              TLS_CIPHER_LEN))
5441                    || (leadbyte != 0
5442                        && !PACKET_forward(&sslv2ciphers, TLS_CIPHER_LEN))) {
5443                SSLfatal(s, SSL_AD_DECODE_ERROR, SSL_F_SSL_CACHE_CIPHERLIST,
5444                         SSL_R_BAD_PACKET);
5445                OPENSSL_free(s->s3->tmp.ciphers_raw);
5446                s->s3->tmp.ciphers_raw = NULL;
5447                s->s3->tmp.ciphers_rawlen = 0;
5448                return 0;
5449            }
5450            if (leadbyte == 0)
5451                s->s3->tmp.ciphers_rawlen += TLS_CIPHER_LEN;
5452        }
5453    } else if (!PACKET_memdup(cipher_suites, &s->s3->tmp.ciphers_raw,
5454                           &s->s3->tmp.ciphers_rawlen)) {
5455        SSLfatal(s, SSL_AD_INTERNAL_ERROR, SSL_F_SSL_CACHE_CIPHERLIST,
5456                 ERR_R_INTERNAL_ERROR);
5457        return 0;
5458    }
5459    return 1;
5460}
5461
5462int SSL_bytes_to_cipher_list(SSL *s, const unsigned char *bytes, size_t len,
5463                             int isv2format, STACK_OF(SSL_CIPHER) **sk,
5464                             STACK_OF(SSL_CIPHER) **scsvs)
5465{
5466    PACKET pkt;
5467
5468    if (!PACKET_buf_init(&pkt, bytes, len))
5469        return 0;
5470    return bytes_to_cipher_list(s, &pkt, sk, scsvs, isv2format, 0);
5471}
5472
5473int bytes_to_cipher_list(SSL *s, PACKET *cipher_suites,
5474                         STACK_OF(SSL_CIPHER) **skp,
5475                         STACK_OF(SSL_CIPHER) **scsvs_out,
5476                         int sslv2format, int fatal)
5477{
5478    const SSL_CIPHER *c;
5479    STACK_OF(SSL_CIPHER) *sk = NULL;
5480    STACK_OF(SSL_CIPHER) *scsvs = NULL;
5481    int n;
5482    /* 3 = SSLV2_CIPHER_LEN > TLS_CIPHER_LEN = 2. */
5483    unsigned char cipher[SSLV2_CIPHER_LEN];
5484
5485    n = sslv2format ? SSLV2_CIPHER_LEN : TLS_CIPHER_LEN;
5486
5487    if (PACKET_remaining(cipher_suites) == 0) {
5488        if (fatal)
5489            SSLfatal(s, SSL_AD_ILLEGAL_PARAMETER, SSL_F_BYTES_TO_CIPHER_LIST,
5490                     SSL_R_NO_CIPHERS_SPECIFIED);
5491        else
5492            SSLerr(SSL_F_BYTES_TO_CIPHER_LIST, SSL_R_NO_CIPHERS_SPECIFIED);
5493        return 0;
5494    }
5495
5496    if (PACKET_remaining(cipher_suites) % n != 0) {
5497        if (fatal)
5498            SSLfatal(s, SSL_AD_DECODE_ERROR, SSL_F_BYTES_TO_CIPHER_LIST,
5499                     SSL_R_ERROR_IN_RECEIVED_CIPHER_LIST);
5500        else
5501            SSLerr(SSL_F_BYTES_TO_CIPHER_LIST,
5502                   SSL_R_ERROR_IN_RECEIVED_CIPHER_LIST);
5503        return 0;
5504    }
5505
5506    sk = sk_SSL_CIPHER_new_null();
5507    scsvs = sk_SSL_CIPHER_new_null();
5508    if (sk == NULL || scsvs == NULL) {
5509        if (fatal)
5510            SSLfatal(s, SSL_AD_INTERNAL_ERROR, SSL_F_BYTES_TO_CIPHER_LIST,
5511                     ERR_R_MALLOC_FAILURE);
5512        else
5513            SSLerr(SSL_F_BYTES_TO_CIPHER_LIST, ERR_R_MALLOC_FAILURE);
5514        goto err;
5515    }
5516
5517    while (PACKET_copy_bytes(cipher_suites, cipher, n)) {
5518        /*
5519         * SSLv3 ciphers wrapped in an SSLv2-compatible ClientHello have the
5520         * first byte set to zero, while true SSLv2 ciphers have a non-zero
5521         * first byte. We don't support any true SSLv2 ciphers, so skip them.
5522         */
5523        if (sslv2format && cipher[0] != '\0')
5524            continue;
5525
5526        /* For SSLv2-compat, ignore leading 0-byte. */
5527        c = ssl_get_cipher_by_char(s, sslv2format ? &cipher[1] : cipher, 1);
5528        if (c != NULL) {
5529            if ((c->valid && !sk_SSL_CIPHER_push(sk, c)) ||
5530                (!c->valid && !sk_SSL_CIPHER_push(scsvs, c))) {
5531                if (fatal)
5532                    SSLfatal(s, SSL_AD_INTERNAL_ERROR,
5533                             SSL_F_BYTES_TO_CIPHER_LIST, ERR_R_MALLOC_FAILURE);
5534                else
5535                    SSLerr(SSL_F_BYTES_TO_CIPHER_LIST, ERR_R_MALLOC_FAILURE);
5536                goto err;
5537            }
5538        }
5539    }
5540    if (PACKET_remaining(cipher_suites) > 0) {
5541        if (fatal)
5542            SSLfatal(s, SSL_AD_DECODE_ERROR, SSL_F_BYTES_TO_CIPHER_LIST,
5543                     SSL_R_BAD_LENGTH);
5544        else
5545            SSLerr(SSL_F_BYTES_TO_CIPHER_LIST, SSL_R_BAD_LENGTH);
5546        goto err;
5547    }
5548
5549    if (skp != NULL)
5550        *skp = sk;
5551    else
5552        sk_SSL_CIPHER_free(sk);
5553    if (scsvs_out != NULL)
5554        *scsvs_out = scsvs;
5555    else
5556        sk_SSL_CIPHER_free(scsvs);
5557    return 1;
5558 err:
5559    sk_SSL_CIPHER_free(sk);
5560    sk_SSL_CIPHER_free(scsvs);
5561    return 0;
5562}
5563
5564int SSL_CTX_set_max_early_data(SSL_CTX *ctx, uint32_t max_early_data)
5565{
5566    ctx->max_early_data = max_early_data;
5567
5568    return 1;
5569}
5570
5571uint32_t SSL_CTX_get_max_early_data(const SSL_CTX *ctx)
5572{
5573    return ctx->max_early_data;
5574}
5575
5576int SSL_set_max_early_data(SSL *s, uint32_t max_early_data)
5577{
5578    s->max_early_data = max_early_data;
5579
5580    return 1;
5581}
5582
5583uint32_t SSL_get_max_early_data(const SSL *s)
5584{
5585    return s->max_early_data;
5586}
5587
5588int SSL_CTX_set_recv_max_early_data(SSL_CTX *ctx, uint32_t recv_max_early_data)
5589{
5590    ctx->recv_max_early_data = recv_max_early_data;
5591
5592    return 1;
5593}
5594
5595uint32_t SSL_CTX_get_recv_max_early_data(const SSL_CTX *ctx)
5596{
5597    return ctx->recv_max_early_data;
5598}
5599
5600int SSL_set_recv_max_early_data(SSL *s, uint32_t recv_max_early_data)
5601{
5602    s->recv_max_early_data = recv_max_early_data;
5603
5604    return 1;
5605}
5606
5607uint32_t SSL_get_recv_max_early_data(const SSL *s)
5608{
5609    return s->recv_max_early_data;
5610}
5611
5612__owur unsigned int ssl_get_max_send_fragment(const SSL *ssl)
5613{
5614    /* Return any active Max Fragment Len extension */
5615    if (ssl->session != NULL && USE_MAX_FRAGMENT_LENGTH_EXT(ssl->session))
5616        return GET_MAX_FRAGMENT_LENGTH(ssl->session);
5617
5618    /* return current SSL connection setting */
5619    return ssl->max_send_fragment;
5620}
5621
5622__owur unsigned int ssl_get_split_send_fragment(const SSL *ssl)
5623{
5624    /* Return a value regarding an active Max Fragment Len extension */
5625    if (ssl->session != NULL && USE_MAX_FRAGMENT_LENGTH_EXT(ssl->session)
5626        && ssl->split_send_fragment > GET_MAX_FRAGMENT_LENGTH(ssl->session))
5627        return GET_MAX_FRAGMENT_LENGTH(ssl->session);
5628
5629    /* else limit |split_send_fragment| to current |max_send_fragment| */
5630    if (ssl->split_send_fragment > ssl->max_send_fragment)
5631        return ssl->max_send_fragment;
5632
5633    /* return current SSL connection setting */
5634    return ssl->split_send_fragment;
5635}
5636
5637int SSL_stateless(SSL *s)
5638{
5639    int ret;
5640
5641    /* Ensure there is no state left over from a previous invocation */
5642    if (!SSL_clear(s))
5643        return 0;
5644
5645    ERR_clear_error();
5646
5647    s->s3->flags |= TLS1_FLAGS_STATELESS;
5648    ret = SSL_accept(s);
5649    s->s3->flags &= ~TLS1_FLAGS_STATELESS;
5650
5651    if (ret > 0 && s->ext.cookieok)
5652        return 1;
5653
5654    if (s->hello_retry_request == SSL_HRR_PENDING && !ossl_statem_in_error(s))
5655        return 0;
5656
5657    return -1;
5658}
5659
5660void SSL_CTX_set_post_handshake_auth(SSL_CTX *ctx, int val)
5661{
5662    ctx->pha_enabled = val;
5663}
5664
5665void SSL_set_post_handshake_auth(SSL *ssl, int val)
5666{
5667    ssl->pha_enabled = val;
5668}
5669
5670int SSL_verify_client_post_handshake(SSL *ssl)
5671{
5672    if (!SSL_IS_TLS13(ssl)) {
5673        SSLerr(SSL_F_SSL_VERIFY_CLIENT_POST_HANDSHAKE, SSL_R_WRONG_SSL_VERSION);
5674        return 0;
5675    }
5676    if (!ssl->server) {
5677        SSLerr(SSL_F_SSL_VERIFY_CLIENT_POST_HANDSHAKE, SSL_R_NOT_SERVER);
5678        return 0;
5679    }
5680
5681    if (!SSL_is_init_finished(ssl)) {
5682        SSLerr(SSL_F_SSL_VERIFY_CLIENT_POST_HANDSHAKE, SSL_R_STILL_IN_INIT);
5683        return 0;
5684    }
5685
5686    switch (ssl->post_handshake_auth) {
5687    case SSL_PHA_NONE:
5688        SSLerr(SSL_F_SSL_VERIFY_CLIENT_POST_HANDSHAKE, SSL_R_EXTENSION_NOT_RECEIVED);
5689        return 0;
5690    default:
5691    case SSL_PHA_EXT_SENT:
5692        SSLerr(SSL_F_SSL_VERIFY_CLIENT_POST_HANDSHAKE, ERR_R_INTERNAL_ERROR);
5693        return 0;
5694    case SSL_PHA_EXT_RECEIVED:
5695        break;
5696    case SSL_PHA_REQUEST_PENDING:
5697        SSLerr(SSL_F_SSL_VERIFY_CLIENT_POST_HANDSHAKE, SSL_R_REQUEST_PENDING);
5698        return 0;
5699    case SSL_PHA_REQUESTED:
5700        SSLerr(SSL_F_SSL_VERIFY_CLIENT_POST_HANDSHAKE, SSL_R_REQUEST_SENT);
5701        return 0;
5702    }
5703
5704    ssl->post_handshake_auth = SSL_PHA_REQUEST_PENDING;
5705
5706    /* checks verify_mode and algorithm_auth */
5707    if (!send_certificate_request(ssl)) {
5708        ssl->post_handshake_auth = SSL_PHA_EXT_RECEIVED; /* restore on error */
5709        SSLerr(SSL_F_SSL_VERIFY_CLIENT_POST_HANDSHAKE, SSL_R_INVALID_CONFIG);
5710        return 0;
5711    }
5712
5713    ossl_statem_set_in_init(ssl, 1);
5714    return 1;
5715}
5716
5717int SSL_CTX_set_session_ticket_cb(SSL_CTX *ctx,
5718                                  SSL_CTX_generate_session_ticket_fn gen_cb,
5719                                  SSL_CTX_decrypt_session_ticket_fn dec_cb,
5720                                  void *arg)
5721{
5722    ctx->generate_ticket_cb = gen_cb;
5723    ctx->decrypt_ticket_cb = dec_cb;
5724    ctx->ticket_cb_data = arg;
5725    return 1;
5726}
5727
5728void SSL_CTX_set_allow_early_data_cb(SSL_CTX *ctx,
5729                                     SSL_allow_early_data_cb_fn cb,
5730                                     void *arg)
5731{
5732    ctx->allow_early_data_cb = cb;
5733    ctx->allow_early_data_cb_data = arg;
5734}
5735
5736void SSL_set_allow_early_data_cb(SSL *s,
5737                                 SSL_allow_early_data_cb_fn cb,
5738                                 void *arg)
5739{
5740    s->allow_early_data_cb = cb;
5741    s->allow_early_data_cb_data = arg;
5742}
5743