2 * Copyright 2016 The OpenSSL Project Authors. All Rights Reserved.
4 * Licensed under the OpenSSL license (the "License"). You may not use
5 * this file except in compliance with the License. You can obtain a copy
6 * in the file LICENSE in the source distribution or at
7 * https://www.openssl.org/source/license.html
11 #include "../ssl_locl.h"
12 #include "statem_locl.h"
15 /* The ID for the extension */
17 int (*server_parse)(SSL *s, PACKET *pkt, int *al);
18 int (*client_parse)(SSL *s, PACKET *pkt, int *al);
19 int (*server_construct)(SSL *s, WPACKET *pkt, int *al);
20 int (*client_construct)(SSL *s, WPACKET *pkt, int *al);
22 } EXTENSION_DEFINITION;
25 * TODO(TLS1.3): Temporarily modified the definitions below to put all TLS1.3
26 * extensions in the ServerHello for now. That needs to be put back to correct
27 * setting once encrypted extensions is working properly.
29 static const EXTENSION_DEFINITION ext_defs[] = {
31 TLSEXT_TYPE_renegotiate,
32 tls_parse_clienthello_renegotiate,
34 tls_construct_server_renegotiate,
36 EXT_CLIENT_HELLO | EXT_TLS1_2_SERVER_HELLO | EXT_SSL3_ALLOWED
37 | EXT_TLS1_2_AND_BELOW_ONLY
40 TLSEXT_TYPE_server_name,
41 tls_parse_clienthello_server_name,
43 tls_construct_server_server_name,
45 EXT_CLIENT_HELLO | EXT_TLS1_2_SERVER_HELLO
46 | /*EXT_TLS1_3_ENCRYPTED_EXTENSIONS*/EXT_TLS1_3_SERVER_HELLO
48 #ifndef OPENSSL_NO_SRP
51 tls_parse_clienthello_srp,
55 EXT_CLIENT_HELLO | EXT_TLS1_2_SERVER_HELLO | EXT_TLS1_2_AND_BELOW_ONLY
60 TLSEXT_TYPE_ec_point_formats,
61 tls_parse_clienthello_ec_pt_formats,
63 tls_construct_server_ec_pt_formats,
65 EXT_CLIENT_HELLO | EXT_TLS1_2_AND_BELOW_ONLY
68 TLSEXT_TYPE_supported_groups,
69 tls_parse_clienthello_supported_groups,
71 NULL /* TODO(TLS1.3): Need to add this */,
74 | /*EXT_TLS1_3_ENCRYPTED_EXTENSIONS*/EXT_TLS1_3_SERVER_HELLO
78 TLSEXT_TYPE_session_ticket,
79 tls_parse_clienthello_session_ticket,
81 tls_construct_server_session_ticket,
83 EXT_CLIENT_HELLO | EXT_TLS1_2_SERVER_HELLO | EXT_TLS1_2_AND_BELOW_ONLY
86 TLSEXT_TYPE_signature_algorithms,
87 tls_parse_clienthello_sig_algs,
94 TLSEXT_TYPE_status_request,
95 tls_parse_clienthello_status_request,
97 tls_construct_server_status_request,
99 EXT_CLIENT_HELLO | EXT_TLS1_2_SERVER_HELLO
100 | /*EXT_TLS1_3_CERTIFICATE*/EXT_TLS1_3_SERVER_HELLO
102 #ifndef OPENSSL_NO_NEXTPROTONEG
104 TLSEXT_TYPE_next_proto_neg,
105 tls_parse_clienthello_npn,
107 tls_construct_server_next_proto_neg,
109 EXT_CLIENT_HELLO | EXT_TLS1_2_SERVER_HELLO | EXT_TLS1_2_AND_BELOW_ONLY
113 TLSEXT_TYPE_application_layer_protocol_negotiation,
114 tls_parse_clienthello_alpn,
116 tls_construct_server_alpn,
118 EXT_CLIENT_HELLO | EXT_TLS1_2_SERVER_HELLO
119 | /*EXT_TLS1_3_ENCRYPTED_EXTENSIONS*/EXT_TLS1_3_SERVER_HELLO
121 #ifndef OPENSSL_NO_SRTP
123 TLSEXT_TYPE_use_srtp,
124 tls_parse_clienthello_use_srtp,
126 tls_construct_server_use_srtp,
128 EXT_CLIENT_HELLO | EXT_TLS1_2_SERVER_HELLO
129 | EXT_TLS1_3_ENCRYPTED_EXTENSIONS | EXT_DTLS_ONLY
133 TLSEXT_TYPE_encrypt_then_mac,
134 tls_parse_clienthello_etm,
136 tls_construct_server_etm,
138 EXT_CLIENT_HELLO | EXT_TLS1_2_SERVER_HELLO | EXT_TLS1_2_AND_BELOW_ONLY
141 TLSEXT_TYPE_signed_certificate_timestamp,
143 * No server side support for this, but can be provided by a custom
144 * extension. This is an exception to the rule that custom extensions
145 * cannot override built in ones.
151 EXT_CLIENT_HELLO | EXT_TLS1_2_SERVER_HELLO
152 | /*EXT_TLS1_3_CERTIFICATE*/EXT_TLS1_3_SERVER_HELLO
155 TLSEXT_TYPE_extended_master_secret,
156 tls_parse_clienthello_ems,
158 tls_construct_server_ems,
160 EXT_CLIENT_HELLO | EXT_TLS1_2_SERVER_HELLO | EXT_TLS1_2_AND_BELOW_ONLY
163 TLSEXT_TYPE_supported_versions,
164 /* Processed inline as part of version selection */
169 EXT_CLIENT_HELLO | EXT_TLS_IMPLEMENTATION_ONLY
173 /* We send this, but don't read it */
181 TLSEXT_TYPE_key_share,
182 tls_parse_clienthello_key_share,
184 tls_construct_server_key_share,
186 EXT_CLIENT_HELLO | EXT_TLS1_3_SERVER_HELLO
187 | EXT_TLS1_3_HELLO_RETRY_REQUEST | EXT_TLS_IMPLEMENTATION_ONLY
192 * Special unsolicited ServerHello extension only used when
193 * SSL_OP_CRYPTOPRO_TLSEXT_BUG is set
195 TLSEXT_TYPE_cryptopro_bug,
198 tls_construct_server_cryptopro_bug,
200 EXT_TLS1_2_SERVER_HELLO | EXT_TLS1_2_AND_BELOW_ONLY
205 * Comparison function used in a call to qsort (see tls_collect_extensions()
207 * The two arguments |p1| and |p2| are expected to be pointers to RAW_EXTENSIONs
210 * 1 if the type for p1 is greater than p2
211 * 0 if the type for p1 and p2 are the same
212 * -1 if the type for p1 is less than p2
214 static int compare_extensions(const void *p1, const void *p2)
216 const RAW_EXTENSION *e1 = (const RAW_EXTENSION *)p1;
217 const RAW_EXTENSION *e2 = (const RAW_EXTENSION *)p2;
219 if (e1->type < e2->type)
221 else if (e1->type > e2->type)
228 * Verify whether we are allowed to use the extension |type| in the current
229 * |context|. Returns 1 to indicate the extension is allowed or unknown or 0 to
230 * indicate the extension is not allowed.
232 static int verify_extension(SSL *s, unsigned int context, unsigned int type)
236 for (i = 0; i < OSSL_NELEM(ext_defs); i++) {
237 if (type == ext_defs[i].type) {
238 /* Check we're allowed to use this extension in this context */
239 if ((context & ext_defs[i].context) == 0)
242 if (SSL_IS_DTLS(s)) {
243 if ((ext_defs[i].context & EXT_TLS_ONLY) != 0)
245 } else if ((ext_defs[i].context & EXT_DTLS_ONLY) != 0) {
253 /* Unknown extension. We allow it */
258 * Finds an extension definition for the give extension |type|.
259 * Returns 1 if found and stores the definition in |*def|, or returns 0
262 static int find_extension_definition(SSL *s, unsigned int type,
263 const EXTENSION_DEFINITION **def)
267 for (i = 0; i < OSSL_NELEM(ext_defs); i++) {
268 if (type == ext_defs[i].type) {
274 /* Unknown extension */
279 * Gather a list of all the extensions from the data in |packet]. |context|
280 * tells us which message this extension is for. The raw extension data is
281 * stored in |*res| with the number of found extensions in |*numfound|. In the
282 * event of an error the alert type to use is stored in |*ad|. We don't actually
283 * process the content of the extensions yet, except to check their types.
285 * Per http://tools.ietf.org/html/rfc5246#section-7.4.1.4, there may not be
286 * more than one extension of the same type in a ClientHello or ServerHello.
287 * This function returns 1 if all extensions are unique and we have parsed their
288 * types, and 0 if the extensions contain duplicates, could not be successfully
289 * parsed, or an internal error occurred.
292 * TODO(TLS1.3): Refactor ServerHello extension parsing to use this and then
293 * remove tls1_check_duplicate_extensions()
295 int tls_collect_extensions(SSL *s, PACKET *packet, unsigned int context,
296 RAW_EXTENSION **res, size_t *numfound, int *ad)
298 PACKET extensions = *packet;
299 size_t num_extensions = 0, i = 0;
300 RAW_EXTENSION *raw_extensions = NULL;
302 /* First pass: count the extensions. */
303 while (PACKET_remaining(&extensions) > 0) {
307 if (!PACKET_get_net_2(&extensions, &type) ||
308 !PACKET_get_length_prefixed_2(&extensions, &extension)) {
309 SSLerr(SSL_F_TLS_COLLECT_EXTENSIONS, SSL_R_BAD_EXTENSION);
310 *ad = SSL_AD_DECODE_ERROR;
313 /* Verify this extension is allowed */
314 if (!verify_extension(s, context, type)) {
315 SSLerr(SSL_F_TLS_COLLECT_EXTENSIONS, SSL_R_BAD_EXTENSION);
316 *ad = SSL_AD_ILLEGAL_PARAMETER;
322 if (num_extensions > 0) {
323 raw_extensions = OPENSSL_zalloc(sizeof(*raw_extensions)
325 if (raw_extensions == NULL) {
326 *ad = SSL_AD_INTERNAL_ERROR;
327 SSLerr(SSL_F_TLS_COLLECT_EXTENSIONS, ERR_R_MALLOC_FAILURE);
331 /* Second pass: collect the extensions. */
332 for (i = 0; i < num_extensions; i++) {
333 if (!PACKET_get_net_2(packet, &raw_extensions[i].type) ||
334 !PACKET_get_length_prefixed_2(packet,
335 &raw_extensions[i].data)) {
336 /* This should not happen. */
337 *ad = SSL_AD_INTERNAL_ERROR;
338 SSLerr(SSL_F_TLS_COLLECT_EXTENSIONS, ERR_R_INTERNAL_ERROR);
343 if (PACKET_remaining(packet) != 0) {
344 *ad = SSL_AD_DECODE_ERROR;
345 SSLerr(SSL_F_TLS_COLLECT_EXTENSIONS, SSL_R_LENGTH_MISMATCH);
348 /* Sort the extensions and make sure there are no duplicates. */
349 qsort(raw_extensions, num_extensions, sizeof(*raw_extensions),
351 for (i = 1; i < num_extensions; i++) {
352 if (raw_extensions[i - 1].type == raw_extensions[i].type) {
353 *ad = SSL_AD_DECODE_ERROR;
359 *res = raw_extensions;
360 *numfound = num_extensions;
364 OPENSSL_free(raw_extensions);
368 int tls_parse_all_extensions(SSL *s, int context, RAW_EXTENSION *exts,
369 size_t numexts, int *al)
373 for (loop = 0; loop < numexts; loop++) {
374 RAW_EXTENSION *currext = &exts[loop];
375 const EXTENSION_DEFINITION *extdef = NULL;
376 int (*parser)(SSL *s, PACKET *pkt, int *al) = NULL;
378 if (s->tlsext_debug_cb)
379 s->tlsext_debug_cb(s, 0, currext->type,
380 PACKET_data(&currext->data),
381 PACKET_remaining(&currext->data),
382 s->tlsext_debug_arg);
384 /* Skip if we've already parsed this extension */
391 if (find_extension_definition(s, currext->type, &extdef)) {
392 parser = s->server ? extdef->server_parse : extdef->client_parse;
394 /* Check if extension is defined for our protocol. If not, skip */
396 && (extdef->context & EXT_TLS_IMPLEMENTATION_ONLY) != 0)
397 || (s->version == SSL3_VERSION
398 && (extdef->context & EXT_SSL3_ALLOWED) == 0)
400 && (extdef->context & EXT_TLS1_2_AND_BELOW_ONLY) != 0)
402 && (extdef->context & EXT_TLS1_3_ONLY) != 0))
406 if (parser == NULL) {
408 * Could be a custom extension. We only allow this if it is a non
409 * resumed session on the server side.
411 * TODO(TLS1.3): We only allow old style <=TLS1.2 custom extensions.
412 * We're going to need a new mechanism for TLS1.3 to specify which
413 * messages to add the custom extensions to.
415 if ((!s->hit || !s->server)
417 & (EXT_CLIENT_HELLO | EXT_TLS1_2_SERVER_HELLO)) != 0
418 && custom_ext_parse(s, s->server, currext->type,
419 PACKET_data(&currext->data),
420 PACKET_remaining(&currext->data),
427 if (!parser(s, &currext->data, al))
435 * Find a specific extension by |type| in the list |exts| containing |numexts|
436 * extensions, and the parse it immediately. Returns 1 on success, or 0 on
437 * failure. If a failure has occurred then |*al| will also be set to the alert
440 int tls_parse_extension(SSL *s, int type, int context, RAW_EXTENSION *exts,
441 size_t numexts, int *al)
443 RAW_EXTENSION *ext = tls_get_extension_by_type(exts, numexts, type);
448 return tls_parse_all_extensions(s, context, ext, 1, al);
451 int tls_construct_extensions(SSL *s, WPACKET *pkt, unsigned int context,
458 * Normally if something goes wrong during construction its an internal
459 * error. We can always override this later.
461 *al = SSL_AD_INTERNAL_ERROR;
463 if (!WPACKET_start_sub_packet_u16(pkt)
465 * If extensions are of zero length then we don't even add the
466 * extensions length bytes to a ClientHello/ServerHello in SSLv3
468 || ((context & (EXT_CLIENT_HELLO | EXT_TLS1_2_SERVER_HELLO)) != 0
469 && s->version == SSL3_VERSION
470 && !WPACKET_set_flags(pkt,
471 WPACKET_FLAGS_ABANDON_ON_ZERO_LENGTH))) {
472 SSLerr(SSL_F_TLS_CONSTRUCT_EXTENSIONS, ERR_R_INTERNAL_ERROR);
476 for (loop = 0; loop < OSSL_NELEM(ext_defs); loop++) {
477 int (*construct)(SSL *s, WPACKET *pkt, int *al);
479 /* Skip if not relevant for our context */
480 if ((ext_defs[loop].context & context) == 0)
483 construct = s->server ? ext_defs[loop].server_construct
484 : ext_defs[loop].client_construct;
486 /* Check if this extension is defined for our protocol. If not, skip */
488 && (ext_defs[loop].context & EXT_TLS_IMPLEMENTATION_ONLY)
490 || (s->version == SSL3_VERSION
491 && (ext_defs[loop].context & EXT_SSL3_ALLOWED) == 0)
493 && (ext_defs[loop].context & EXT_TLS1_2_AND_BELOW_ONLY)
496 && (ext_defs[loop].context & EXT_TLS1_3_ONLY) != 0
497 && (context & EXT_CLIENT_HELLO) == 0)
498 || construct == NULL)
501 if (!construct(s, pkt, al))
505 /* Add custom extensions */
506 if ((context & EXT_CLIENT_HELLO) != 0) {
507 custom_ext_init(&s->cert->cli_ext);
509 } else if ((context & EXT_TLS1_2_SERVER_HELLO) != 0) {
511 * We already initialised the custom extensions during ClientHello
514 * TODO(TLS1.3): We're going to need a new custom extension mechanism
515 * for TLS1.3, so that custom extensions can specify which of the
516 * multiple message they wish to add themselves to.
521 if (addcustom && !custom_ext_add(s, s->server, pkt, al)) {
522 SSLerr(SSL_F_TLS_CONSTRUCT_EXTENSIONS, ERR_R_INTERNAL_ERROR);
526 if (!WPACKET_close(pkt)) {
527 SSLerr(SSL_F_TLS_CONSTRUCT_EXTENSIONS, ERR_R_INTERNAL_ERROR);