1 /* Copyright (c) 2018, Google Inc.
2 *
3 * Permission to use, copy, modify, and/or distribute this software for any
4 * purpose with or without fee is hereby granted, provided that the above
5 * copyright notice and this permission notice appear in all copies.
6 *
7 * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
8 * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
9 * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY
10 * SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
11 * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION
12 * OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN
13 * CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE. */
14
15 #include <openssl/ssl.h>
16
17 #include <openssl/bytestring.h>
18 #include <openssl/err.h>
19
20 #include "../crypto/internal.h"
21 #include "internal.h"
22
23
24 BSSL_NAMESPACE_BEGIN
25
26 constexpr int kHandoffVersion = 0;
27 constexpr int kHandbackVersion = 0;
28
29 static const CBS_ASN1_TAG kHandoffTagALPS = CBS_ASN1_CONTEXT_SPECIFIC | 0;
30
31 // early_data_t represents the state of early data in a more compact way than
32 // the 3 bits used by the implementation.
33 enum early_data_t {
34 early_data_not_offered = 0,
35 early_data_accepted = 1,
36 early_data_rejected_hrr = 2,
37 early_data_skipped = 3,
38
39 early_data_max_value = early_data_skipped,
40 };
41
42 // serialize_features adds a description of features supported by this binary to
43 // |out|. Returns true on success and false on error.
serialize_features(CBB * out)44 static bool serialize_features(CBB *out) {
45 CBB ciphers;
46 if (!CBB_add_asn1(out, &ciphers, CBS_ASN1_OCTETSTRING)) {
47 return false;
48 }
49 Span<const SSL_CIPHER> all_ciphers = AllCiphers();
50 for (const SSL_CIPHER &cipher : all_ciphers) {
51 if (!CBB_add_u16(&ciphers, static_cast<uint16_t>(cipher.id))) {
52 return false;
53 }
54 }
55 CBB groups;
56 if (!CBB_add_asn1(out, &groups, CBS_ASN1_OCTETSTRING)) {
57 return false;
58 }
59 for (const NamedGroup &g : NamedGroups()) {
60 if (!CBB_add_u16(&groups, g.group_id)) {
61 return false;
62 }
63 }
64 // ALPS is a draft protocol and may change over time. The handoff structure
65 // contains a [0] IMPLICIT OCTET STRING OPTIONAL, containing a list of u16
66 // ALPS versions that the binary supports. For now we name them by codepoint.
67 // Once ALPS is finalized and past the support horizon, this field can be
68 // removed.
69 CBB alps;
70 if (!CBB_add_asn1(out, &alps, kHandoffTagALPS) ||
71 !CBB_add_u16(&alps, TLSEXT_TYPE_application_settings_old) ||
72 !CBB_add_u16(&alps, TLSEXT_TYPE_application_settings)) {
73 return false;
74 }
75 return CBB_flush(out);
76 }
77
SSL_serialize_handoff(const SSL * ssl,CBB * out,SSL_CLIENT_HELLO * out_hello)78 bool SSL_serialize_handoff(const SSL *ssl, CBB *out,
79 SSL_CLIENT_HELLO *out_hello) {
80 const SSL3_STATE *const s3 = ssl->s3;
81 if (!ssl->server || //
82 s3->hs == nullptr || //
83 s3->rwstate != SSL_ERROR_HANDOFF) {
84 return false;
85 }
86
87 CBB seq;
88 SSLMessage msg;
89 Span<const uint8_t> transcript = s3->hs->transcript.buffer();
90
91 if (!CBB_add_asn1(out, &seq, CBS_ASN1_SEQUENCE) ||
92 !CBB_add_asn1_uint64(&seq, kHandoffVersion) ||
93 !CBB_add_asn1_octet_string(&seq, transcript.data(), transcript.size()) ||
94 !CBB_add_asn1_octet_string(&seq,
95 reinterpret_cast<uint8_t *>(s3->hs_buf->data),
96 s3->hs_buf->length) ||
97 !serialize_features(&seq) || !CBB_flush(out) ||
98 !ssl->method->get_message(ssl, &msg) ||
99 !ssl_client_hello_init(ssl, out_hello, msg.body)) {
100 return false;
101 }
102
103 return true;
104 }
105
SSL_decline_handoff(SSL * ssl)106 bool SSL_decline_handoff(SSL *ssl) {
107 const SSL3_STATE *const s3 = ssl->s3;
108 if (!ssl->server || s3->hs == nullptr || s3->rwstate != SSL_ERROR_HANDOFF) {
109 return false;
110 }
111
112 s3->hs->config->handoff = false;
113 return true;
114 }
115
116 // apply_remote_features reads a list of supported features from |in| and
117 // (possibly) reconfigures |ssl| to disallow the negotation of features whose
118 // support has not been indicated. (This prevents the the handshake from
119 // committing to features that are not supported on the handoff/handback side.)
apply_remote_features(SSL * ssl,CBS * in)120 static bool apply_remote_features(SSL *ssl, CBS *in) {
121 CBS ciphers;
122 if (!CBS_get_asn1(in, &ciphers, CBS_ASN1_OCTETSTRING)) {
123 return false;
124 }
125 bssl::UniquePtr<STACK_OF(SSL_CIPHER)> supported(sk_SSL_CIPHER_new_null());
126 if (!supported) {
127 return false;
128 }
129 while (CBS_len(&ciphers)) {
130 uint16_t id;
131 if (!CBS_get_u16(&ciphers, &id)) {
132 return false;
133 }
134 const SSL_CIPHER *cipher = SSL_get_cipher_by_value(id);
135 if (!cipher) {
136 continue;
137 }
138 if (!sk_SSL_CIPHER_push(supported.get(), cipher)) {
139 return false;
140 }
141 }
142 STACK_OF(SSL_CIPHER) *configured =
143 ssl->config->cipher_list ? ssl->config->cipher_list->ciphers.get()
144 : ssl->ctx->cipher_list->ciphers.get();
145 bssl::UniquePtr<STACK_OF(SSL_CIPHER)> unsupported(sk_SSL_CIPHER_new_null());
146 if (!unsupported) {
147 return false;
148 }
149 for (const SSL_CIPHER *configured_cipher : configured) {
150 if (sk_SSL_CIPHER_find(supported.get(), nullptr, configured_cipher)) {
151 continue;
152 }
153 if (!sk_SSL_CIPHER_push(unsupported.get(), configured_cipher)) {
154 return false;
155 }
156 }
157 if (sk_SSL_CIPHER_num(unsupported.get()) && !ssl->config->cipher_list) {
158 ssl->config->cipher_list = bssl::MakeUnique<SSLCipherPreferenceList>();
159 if (!ssl->config->cipher_list ||
160 !ssl->config->cipher_list->Init(*ssl->ctx->cipher_list)) {
161 return false;
162 }
163 }
164 for (const SSL_CIPHER *unsupported_cipher : unsupported.get()) {
165 ssl->config->cipher_list->Remove(unsupported_cipher);
166 }
167 if (sk_SSL_CIPHER_num(SSL_get_ciphers(ssl)) == 0) {
168 return false;
169 }
170
171 CBS groups;
172 if (!CBS_get_asn1(in, &groups, CBS_ASN1_OCTETSTRING)) {
173 return false;
174 }
175 Array<uint16_t> supported_groups;
176 if (!supported_groups.InitForOverwrite(CBS_len(&groups) / 2)) {
177 return false;
178 }
179 size_t idx = 0;
180 while (CBS_len(&groups)) {
181 uint16_t group;
182 if (!CBS_get_u16(&groups, &group)) {
183 return false;
184 }
185 supported_groups[idx++] = group;
186 }
187 Span<const uint16_t> configured_groups =
188 tls1_get_grouplist(ssl->s3->hs.get());
189 Array<uint16_t> new_configured_groups;
190 if (!new_configured_groups.InitForOverwrite(configured_groups.size())) {
191 return false;
192 }
193 idx = 0;
194 for (uint16_t configured_group : configured_groups) {
195 bool ok = false;
196 for (uint16_t supported_group : supported_groups) {
197 if (supported_group == configured_group) {
198 ok = true;
199 break;
200 }
201 }
202 if (ok) {
203 new_configured_groups[idx++] = configured_group;
204 }
205 }
206 if (idx == 0) {
207 return false;
208 }
209 new_configured_groups.Shrink(idx);
210 ssl->config->supported_group_list = std::move(new_configured_groups);
211
212 CBS alps;
213 CBS_init(&alps, nullptr, 0);
214 if (!CBS_get_optional_asn1(in, &alps, /*out_present=*/nullptr,
215 kHandoffTagALPS)) {
216 return false;
217 }
218 bool supports_alps = false;
219 while (CBS_len(&alps) != 0) {
220 uint16_t id;
221 if (!CBS_get_u16(&alps, &id)) {
222 return false;
223 }
224 // For now, we support two ALPS codepoints, so we need to extract both
225 // codepoints, and then filter what the handshaker might try to send.
226 if ((id == TLSEXT_TYPE_application_settings &&
227 ssl->config->alps_use_new_codepoint) ||
228 (id == TLSEXT_TYPE_application_settings_old &&
229 !ssl->config->alps_use_new_codepoint)) {
230 supports_alps = true;
231 break;
232 }
233 }
234 if (!supports_alps) {
235 ssl->config->alps_configs.clear();
236 }
237
238 return true;
239 }
240
241 // uses_disallowed_feature returns true iff |ssl| enables a feature that
242 // disqualifies it for split handshakes.
uses_disallowed_feature(const SSL * ssl)243 static bool uses_disallowed_feature(const SSL *ssl) {
244 return ssl->method->is_dtls || !ssl->config->cert->credentials.empty() ||
245 ssl->config->quic_transport_params.size() > 0 || ssl->ctx->ech_keys;
246 }
247
SSL_apply_handoff(SSL * ssl,Span<const uint8_t> handoff)248 bool SSL_apply_handoff(SSL *ssl, Span<const uint8_t> handoff) {
249 if (uses_disallowed_feature(ssl)) {
250 return false;
251 }
252
253 CBS seq, handoff_cbs(handoff);
254 uint64_t handoff_version;
255 if (!CBS_get_asn1(&handoff_cbs, &seq, CBS_ASN1_SEQUENCE) ||
256 !CBS_get_asn1_uint64(&seq, &handoff_version) ||
257 handoff_version != kHandoffVersion) {
258 return false;
259 }
260
261 CBS transcript, hs_buf;
262 if (!CBS_get_asn1(&seq, &transcript, CBS_ASN1_OCTETSTRING) ||
263 !CBS_get_asn1(&seq, &hs_buf, CBS_ASN1_OCTETSTRING) ||
264 !apply_remote_features(ssl, &seq)) {
265 return false;
266 }
267
268 SSL_set_accept_state(ssl);
269
270 SSL3_STATE *const s3 = ssl->s3;
271 s3->v2_hello_done = true;
272 s3->has_message = true;
273
274 s3->hs_buf.reset(BUF_MEM_new());
275 if (!s3->hs_buf ||
276 !BUF_MEM_append(s3->hs_buf.get(), CBS_data(&hs_buf), CBS_len(&hs_buf))) {
277 return false;
278 }
279
280 if (CBS_len(&transcript) != 0) {
281 s3->hs->transcript.Update(transcript);
282 s3->is_v2_hello = true;
283 }
284 s3->hs->handback = true;
285
286 return true;
287 }
288
SSL_serialize_handback(const SSL * ssl,CBB * out)289 bool SSL_serialize_handback(const SSL *ssl, CBB *out) {
290 if (!ssl->server || uses_disallowed_feature(ssl)) {
291 return false;
292 }
293 const SSL3_STATE *const s3 = ssl->s3;
294 SSL_HANDSHAKE *const hs = s3->hs.get();
295 handback_t type;
296 switch (hs->state) {
297 case state12_read_change_cipher_spec:
298 type = handback_after_session_resumption;
299 break;
300 case state12_read_client_certificate:
301 type = handback_after_ecdhe;
302 break;
303 case state12_finish_server_handshake:
304 type = handback_after_handshake;
305 break;
306 case state12_tls13:
307 if (hs->tls13_state != state13_send_half_rtt_ticket) {
308 return false;
309 }
310 type = handback_tls13;
311 break;
312 default:
313 return false;
314 }
315
316 size_t hostname_len = 0;
317 if (s3->hostname) {
318 hostname_len = strlen(s3->hostname.get());
319 }
320
321 Span<const uint8_t> transcript;
322 if (type != handback_after_handshake) {
323 transcript = s3->hs->transcript.buffer();
324 }
325 size_t write_iv_len = 0;
326 const uint8_t *write_iv = nullptr;
327 if ((type == handback_after_session_resumption ||
328 type == handback_after_handshake) &&
329 ssl->s3->version == TLS1_VERSION &&
330 SSL_CIPHER_is_block_cipher(s3->aead_write_ctx->cipher()) &&
331 !s3->aead_write_ctx->GetIV(&write_iv, &write_iv_len)) {
332 return false;
333 }
334 size_t read_iv_len = 0;
335 const uint8_t *read_iv = nullptr;
336 if (type == handback_after_handshake && //
337 ssl->s3->version == TLS1_VERSION && //
338 SSL_CIPHER_is_block_cipher(s3->aead_read_ctx->cipher()) && //
339 !s3->aead_read_ctx->GetIV(&read_iv, &read_iv_len)) {
340 return false;
341 }
342
343 // TODO(mab): make sure everything is serialized.
344 CBB seq, key_share;
345 const SSL_SESSION *session;
346 if (type == handback_tls13) {
347 session = hs->new_session.get();
348 } else {
349 session = s3->session_reused ? ssl->session.get() : hs->new_session.get();
350 }
351 uint8_t read_sequence[8], write_sequence[8];
352 CRYPTO_store_u64_be(read_sequence, s3->read_sequence);
353 CRYPTO_store_u64_be(write_sequence, s3->write_sequence);
354 static const uint8_t kUnusedChannelID[64] = {0};
355 if (!CBB_add_asn1(out, &seq, CBS_ASN1_SEQUENCE) ||
356 !CBB_add_asn1_uint64(&seq, kHandbackVersion) ||
357 !CBB_add_asn1_uint64(&seq, type) ||
358 !CBB_add_asn1_octet_string(&seq, read_sequence, sizeof(read_sequence)) ||
359 !CBB_add_asn1_octet_string(&seq, write_sequence,
360 sizeof(write_sequence)) ||
361 !CBB_add_asn1_octet_string(&seq, s3->server_random,
362 sizeof(s3->server_random)) ||
363 !CBB_add_asn1_octet_string(&seq, s3->client_random,
364 sizeof(s3->client_random)) ||
365 !CBB_add_asn1_octet_string(&seq, read_iv, read_iv_len) ||
366 !CBB_add_asn1_octet_string(&seq, write_iv, write_iv_len) ||
367 !CBB_add_asn1_bool(&seq, s3->session_reused) ||
368 !CBB_add_asn1_bool(&seq, hs->channel_id_negotiated) ||
369 !ssl_session_serialize(session, &seq) ||
370 !CBB_add_asn1_octet_string(&seq, s3->next_proto_negotiated.data(),
371 s3->next_proto_negotiated.size()) ||
372 !CBB_add_asn1_octet_string(&seq, s3->alpn_selected.data(),
373 s3->alpn_selected.size()) ||
374 !CBB_add_asn1_octet_string(
375 &seq, reinterpret_cast<uint8_t *>(s3->hostname.get()),
376 hostname_len) ||
377 !CBB_add_asn1_octet_string(&seq, kUnusedChannelID,
378 sizeof(kUnusedChannelID)) ||
379 // These two fields were historically |token_binding_negotiated| and
380 // |negotiated_token_binding_param|.
381 !CBB_add_asn1_bool(&seq, 0) || //
382 !CBB_add_asn1_uint64(&seq, 0) ||
383 !CBB_add_asn1_bool(&seq, s3->hs->next_proto_neg_seen) ||
384 !CBB_add_asn1_bool(&seq, s3->hs->cert_request) ||
385 !CBB_add_asn1_bool(&seq, s3->hs->extended_master_secret) ||
386 !CBB_add_asn1_bool(&seq, s3->hs->ticket_expected) ||
387 !CBB_add_asn1_uint64(&seq, SSL_CIPHER_get_id(s3->hs->new_cipher)) ||
388 !CBB_add_asn1_octet_string(&seq, transcript.data(), transcript.size()) ||
389 !CBB_add_asn1(&seq, &key_share, CBS_ASN1_SEQUENCE)) {
390 return false;
391 }
392 if (type == handback_after_ecdhe) {
393 CBB private_key;
394 if (!CBB_add_asn1_uint64(&key_share, s3->hs->key_shares[0]->GroupID()) ||
395 !CBB_add_asn1(&key_share, &private_key, CBS_ASN1_OCTETSTRING) ||
396 !s3->hs->key_shares[0]->SerializePrivateKey(&private_key) ||
397 !CBB_flush(&key_share)) {
398 return false;
399 }
400 }
401 if (type == handback_tls13) {
402 early_data_t early_data;
403 // Check early data invariants.
404 if (ssl->enable_early_data ==
405 (s3->early_data_reason == ssl_early_data_disabled)) {
406 return false;
407 }
408 if (hs->early_data_offered) {
409 if (s3->early_data_accepted && !s3->skip_early_data) {
410 early_data = early_data_accepted;
411 } else if (!s3->early_data_accepted && !s3->skip_early_data) {
412 early_data = early_data_rejected_hrr;
413 } else if (!s3->early_data_accepted && s3->skip_early_data) {
414 early_data = early_data_skipped;
415 } else {
416 return false;
417 }
418 } else if (!s3->early_data_accepted && !s3->skip_early_data) {
419 early_data = early_data_not_offered;
420 } else {
421 return false;
422 }
423 if (!CBB_add_asn1_octet_string(&seq, hs->client_traffic_secret_0.data(),
424 hs->client_traffic_secret_0.size()) ||
425 !CBB_add_asn1_octet_string(&seq, hs->server_traffic_secret_0.data(),
426 hs->server_traffic_secret_0.size()) ||
427 !CBB_add_asn1_octet_string(&seq, hs->client_handshake_secret.data(),
428 hs->client_handshake_secret.size()) ||
429 !CBB_add_asn1_octet_string(&seq, hs->server_handshake_secret.data(),
430 hs->server_handshake_secret.size()) ||
431 !CBB_add_asn1_octet_string(&seq, hs->secret.data(),
432 hs->secret.size()) ||
433 !CBB_add_asn1_octet_string(&seq, s3->exporter_secret.data(),
434 s3->exporter_secret.size()) ||
435 !CBB_add_asn1_bool(&seq, s3->used_hello_retry_request) ||
436 !CBB_add_asn1_bool(&seq, hs->accept_psk_mode) ||
437 !CBB_add_asn1_int64(&seq, s3->ticket_age_skew) ||
438 !CBB_add_asn1_uint64(&seq, s3->early_data_reason) ||
439 !CBB_add_asn1_uint64(&seq, early_data)) {
440 return false;
441 }
442 if (early_data == early_data_accepted &&
443 !CBB_add_asn1_octet_string(&seq, hs->early_traffic_secret.data(),
444 hs->early_traffic_secret.size())) {
445 return false;
446 }
447
448 if (session->has_application_settings) {
449 uint16_t alps_codepoint = TLSEXT_TYPE_application_settings_old;
450 if (hs->config->alps_use_new_codepoint) {
451 alps_codepoint = TLSEXT_TYPE_application_settings;
452 }
453 if (!CBB_add_asn1_uint64(&seq, alps_codepoint)) {
454 return false;
455 }
456 }
457 }
458 return CBB_flush(out);
459 }
460
CopyExact(Span<uint8_t> out,const CBS * in)461 static bool CopyExact(Span<uint8_t> out, const CBS *in) {
462 if (CBS_len(in) != out.size()) {
463 return false;
464 }
465 OPENSSL_memcpy(out.data(), CBS_data(in), out.size());
466 return true;
467 }
468
SSL_apply_handback(SSL * ssl,Span<const uint8_t> handback)469 bool SSL_apply_handback(SSL *ssl, Span<const uint8_t> handback) {
470 if (ssl->do_handshake != nullptr || //
471 ssl->method->is_dtls) {
472 return false;
473 }
474
475 SSL3_STATE *const s3 = ssl->s3;
476 uint64_t handback_version, unused_token_binding_param, cipher, type_u64,
477 alps_codepoint;
478
479 CBS seq, read_seq, write_seq, server_rand, client_rand, read_iv, write_iv,
480 next_proto, alpn, hostname, unused_channel_id, transcript, key_share;
481 int session_reused, channel_id_negotiated, cert_request,
482 extended_master_secret, ticket_expected, unused_token_binding,
483 next_proto_neg_seen;
484 SSL_SESSION *session = nullptr;
485
486 CBS handback_cbs(handback);
487 if (!CBS_get_asn1(&handback_cbs, &seq, CBS_ASN1_SEQUENCE) || //
488 !CBS_get_asn1_uint64(&seq, &handback_version) || //
489 handback_version != kHandbackVersion || //
490 !CBS_get_asn1_uint64(&seq, &type_u64) || //
491 type_u64 > handback_max_value) {
492 return false;
493 }
494
495 handback_t type = static_cast<handback_t>(type_u64);
496 if (!CBS_get_asn1(&seq, &read_seq, CBS_ASN1_OCTETSTRING) ||
497 CBS_len(&read_seq) != sizeof(s3->read_sequence) ||
498 !CBS_get_asn1(&seq, &write_seq, CBS_ASN1_OCTETSTRING) ||
499 CBS_len(&write_seq) != sizeof(s3->write_sequence) ||
500 !CBS_get_asn1(&seq, &server_rand, CBS_ASN1_OCTETSTRING) ||
501 CBS_len(&server_rand) != sizeof(s3->server_random) ||
502 !CBS_copy_bytes(&server_rand, s3->server_random,
503 sizeof(s3->server_random)) ||
504 !CBS_get_asn1(&seq, &client_rand, CBS_ASN1_OCTETSTRING) ||
505 CBS_len(&client_rand) != sizeof(s3->client_random) ||
506 !CBS_copy_bytes(&client_rand, s3->client_random,
507 sizeof(s3->client_random)) ||
508 !CBS_get_asn1(&seq, &read_iv, CBS_ASN1_OCTETSTRING) ||
509 !CBS_get_asn1(&seq, &write_iv, CBS_ASN1_OCTETSTRING) ||
510 !CBS_get_asn1_bool(&seq, &session_reused) ||
511 !CBS_get_asn1_bool(&seq, &channel_id_negotiated)) {
512 return false;
513 }
514
515 s3->hs = ssl_handshake_new(ssl);
516 if (!s3->hs) {
517 return false;
518 }
519 SSL_HANDSHAKE *const hs = s3->hs.get();
520 if (!session_reused || type == handback_tls13) {
521 hs->new_session =
522 SSL_SESSION_parse(&seq, ssl->ctx->x509_method, ssl->ctx->pool);
523 session = hs->new_session.get();
524 } else {
525 ssl->session =
526 SSL_SESSION_parse(&seq, ssl->ctx->x509_method, ssl->ctx->pool);
527 session = ssl->session.get();
528 }
529
530 if (!session || !CBS_get_asn1(&seq, &next_proto, CBS_ASN1_OCTETSTRING) ||
531 !CBS_get_asn1(&seq, &alpn, CBS_ASN1_OCTETSTRING) ||
532 !CBS_get_asn1(&seq, &hostname, CBS_ASN1_OCTETSTRING) ||
533 !CBS_get_asn1(&seq, &unused_channel_id, CBS_ASN1_OCTETSTRING) ||
534 !CBS_get_asn1_bool(&seq, &unused_token_binding) ||
535 !CBS_get_asn1_uint64(&seq, &unused_token_binding_param) ||
536 !CBS_get_asn1_bool(&seq, &next_proto_neg_seen) ||
537 !CBS_get_asn1_bool(&seq, &cert_request) ||
538 !CBS_get_asn1_bool(&seq, &extended_master_secret) ||
539 !CBS_get_asn1_bool(&seq, &ticket_expected) ||
540 !CBS_get_asn1_uint64(&seq, &cipher)) {
541 return false;
542 }
543 if ((hs->new_cipher =
544 SSL_get_cipher_by_value(static_cast<uint16_t>(cipher))) == nullptr) {
545 return false;
546 }
547 if (!CBS_get_asn1(&seq, &transcript, CBS_ASN1_OCTETSTRING) ||
548 !CBS_get_asn1(&seq, &key_share, CBS_ASN1_SEQUENCE)) {
549 return false;
550 }
551 CBS client_handshake_secret, server_handshake_secret, client_traffic_secret_0,
552 server_traffic_secret_0, secret, exporter_secret, early_traffic_secret;
553 if (type == handback_tls13) {
554 int used_hello_retry_request, accept_psk_mode;
555 uint64_t early_data, early_data_reason;
556 int64_t ticket_age_skew;
557 if (!CBS_get_asn1(&seq, &client_traffic_secret_0, CBS_ASN1_OCTETSTRING) ||
558 !CBS_get_asn1(&seq, &server_traffic_secret_0, CBS_ASN1_OCTETSTRING) ||
559 !CBS_get_asn1(&seq, &client_handshake_secret, CBS_ASN1_OCTETSTRING) ||
560 !CBS_get_asn1(&seq, &server_handshake_secret, CBS_ASN1_OCTETSTRING) ||
561 !CBS_get_asn1(&seq, &secret, CBS_ASN1_OCTETSTRING) ||
562 !CBS_get_asn1(&seq, &exporter_secret, CBS_ASN1_OCTETSTRING) ||
563 !CBS_get_asn1_bool(&seq, &used_hello_retry_request) ||
564 !CBS_get_asn1_bool(&seq, &accept_psk_mode) ||
565 !CBS_get_asn1_int64(&seq, &ticket_age_skew) ||
566 !CBS_get_asn1_uint64(&seq, &early_data_reason) ||
567 early_data_reason > ssl_early_data_reason_max_value ||
568 !CBS_get_asn1_uint64(&seq, &early_data) ||
569 early_data > early_data_max_value) {
570 return false;
571 }
572 early_data_t early_data_type = static_cast<early_data_t>(early_data);
573 if (early_data_type == early_data_accepted &&
574 !CBS_get_asn1(&seq, &early_traffic_secret, CBS_ASN1_OCTETSTRING)) {
575 return false;
576 }
577
578 if (session->has_application_settings) {
579 // Making it optional to keep compatibility with older handshakers.
580 // Older handshakers won't send the field.
581 if (CBS_len(&seq) == 0) {
582 hs->config->alps_use_new_codepoint = false;
583 } else {
584 if (!CBS_get_asn1_uint64(&seq, &alps_codepoint)) {
585 return false;
586 }
587
588 if (alps_codepoint == TLSEXT_TYPE_application_settings) {
589 hs->config->alps_use_new_codepoint = true;
590 } else if (alps_codepoint == TLSEXT_TYPE_application_settings_old) {
591 hs->config->alps_use_new_codepoint = false;
592 } else {
593 OPENSSL_PUT_ERROR(SSL, SSL_R_INVALID_ALPS_CODEPOINT);
594 return false;
595 }
596 }
597 }
598
599 if (ticket_age_skew > std::numeric_limits<int32_t>::max() ||
600 ticket_age_skew < std::numeric_limits<int32_t>::min()) {
601 return false;
602 }
603 s3->ticket_age_skew = static_cast<int32_t>(ticket_age_skew);
604 s3->used_hello_retry_request = used_hello_retry_request;
605 hs->accept_psk_mode = accept_psk_mode;
606
607 s3->early_data_reason =
608 static_cast<ssl_early_data_reason_t>(early_data_reason);
609 ssl->enable_early_data = s3->early_data_reason != ssl_early_data_disabled;
610 s3->skip_early_data = false;
611 s3->early_data_accepted = false;
612 hs->early_data_offered = false;
613 switch (early_data_type) {
614 case early_data_not_offered:
615 break;
616 case early_data_accepted:
617 s3->early_data_accepted = true;
618 hs->early_data_offered = true;
619 hs->can_early_write = true;
620 hs->can_early_read = true;
621 hs->in_early_data = true;
622 break;
623 case early_data_rejected_hrr:
624 hs->early_data_offered = true;
625 break;
626 case early_data_skipped:
627 s3->skip_early_data = true;
628 hs->early_data_offered = true;
629 break;
630 default:
631 return false;
632 }
633 } else {
634 s3->early_data_reason = ssl_early_data_protocol_version;
635 }
636
637 ssl->s3->version = session->ssl_version;
638 if (!ssl_method_supports_version(ssl->method, ssl->s3->version) ||
639 session->cipher != hs->new_cipher ||
640 ssl_protocol_version(ssl) < SSL_CIPHER_get_min_version(session->cipher) ||
641 SSL_CIPHER_get_max_version(session->cipher) < ssl_protocol_version(ssl)) {
642 return false;
643 }
644 ssl->do_handshake = ssl_server_handshake;
645 ssl->server = true;
646 switch (type) {
647 case handback_after_session_resumption:
648 hs->state = state12_read_change_cipher_spec;
649 if (!session_reused) {
650 return false;
651 }
652 break;
653 case handback_after_ecdhe:
654 hs->state = state12_read_client_certificate;
655 if (session_reused) {
656 return false;
657 }
658 break;
659 case handback_after_handshake:
660 hs->state = state12_finish_server_handshake;
661 break;
662 case handback_tls13:
663 hs->state = state12_tls13;
664 hs->tls13_state = state13_send_half_rtt_ticket;
665 break;
666 default:
667 return false;
668 }
669 s3->session_reused = session_reused;
670 hs->channel_id_negotiated = channel_id_negotiated;
671 s3->next_proto_negotiated.CopyFrom(next_proto);
672 s3->alpn_selected.CopyFrom(alpn);
673
674 const size_t hostname_len = CBS_len(&hostname);
675 if (hostname_len == 0) {
676 s3->hostname.reset();
677 } else {
678 char *hostname_str = nullptr;
679 if (!CBS_strdup(&hostname, &hostname_str)) {
680 return false;
681 }
682 s3->hostname.reset(hostname_str);
683 }
684
685 hs->next_proto_neg_seen = next_proto_neg_seen;
686 hs->wait = ssl_hs_flush;
687 hs->extended_master_secret = extended_master_secret;
688 hs->ticket_expected = ticket_expected;
689 hs->cert_request = cert_request;
690
691 if (type != handback_after_handshake &&
692 (!hs->transcript.Init() ||
693 !hs->transcript.InitHash(ssl_protocol_version(ssl), hs->new_cipher) ||
694 !hs->transcript.Update(transcript))) {
695 return false;
696 }
697 if (type == handback_tls13) {
698 if (!hs->client_traffic_secret_0.TryCopyFrom(client_traffic_secret_0) ||
699 !hs->server_traffic_secret_0.TryCopyFrom(server_traffic_secret_0) ||
700 !hs->client_handshake_secret.TryCopyFrom(client_handshake_secret) ||
701 !hs->server_handshake_secret.TryCopyFrom(server_handshake_secret) ||
702 !hs->secret.TryCopyFrom(secret) ||
703 !s3->exporter_secret.TryCopyFrom(exporter_secret)) {
704 return false;
705 }
706
707 if (s3->early_data_accepted &&
708 !hs->early_traffic_secret.TryCopyFrom(early_traffic_secret)) {
709 return false;
710 }
711 }
712 Array<uint8_t> key_block;
713 switch (type) {
714 case handback_after_session_resumption:
715 // The write keys are installed after server Finished, but the client
716 // keys must wait for ChangeCipherSpec.
717 if (!tls1_configure_aead(ssl, evp_aead_seal, &key_block, session,
718 write_iv)) {
719 return false;
720 }
721 break;
722 case handback_after_ecdhe:
723 // The premaster secret is not yet computed, so install no keys.
724 break;
725 case handback_after_handshake:
726 // The handshake is complete, so both keys are installed.
727 if (!tls1_configure_aead(ssl, evp_aead_seal, &key_block, session,
728 write_iv) ||
729 !tls1_configure_aead(ssl, evp_aead_open, &key_block, session,
730 read_iv)) {
731 return false;
732 }
733 break;
734 case handback_tls13:
735 // After server Finished, the application write keys are installed, but
736 // none of the read keys. The read keys are installed in the state machine
737 // immediately after processing handback.
738 if (!tls13_set_traffic_key(ssl, ssl_encryption_application, evp_aead_seal,
739 hs->new_session.get(),
740 hs->server_traffic_secret_0)) {
741 return false;
742 }
743 break;
744 }
745 uint8_t read_sequence[8], write_sequence[8];
746 if (!CopyExact(read_sequence, &read_seq) ||
747 !CopyExact(write_sequence, &write_seq)) {
748 return false;
749 }
750 s3->read_sequence = CRYPTO_load_u64_be(read_sequence);
751 s3->write_sequence = CRYPTO_load_u64_be(write_sequence);
752 if (type == handback_after_ecdhe) {
753 uint64_t group_id;
754 CBS private_key;
755 if (!CBS_get_asn1_uint64(&key_share, &group_id) || //
756 group_id > 0xffff ||
757 !CBS_get_asn1(&key_share, &private_key, CBS_ASN1_OCTETSTRING)) {
758 return false;
759 }
760 hs->key_shares[0] = SSLKeyShare::Create(group_id);
761 if (!hs->key_shares[0] ||
762 !hs->key_shares[0]->DeserializePrivateKey(&private_key)) {
763 return false;
764 }
765 }
766 return true; // Trailing data allowed for extensibility.
767 }
768
769 BSSL_NAMESPACE_END
770
771 using namespace bssl;
772
SSL_serialize_capabilities(const SSL * ssl,CBB * out)773 int SSL_serialize_capabilities(const SSL *ssl, CBB *out) {
774 CBB seq;
775 if (!CBB_add_asn1(out, &seq, CBS_ASN1_SEQUENCE) ||
776 !serialize_features(&seq) || //
777 !CBB_flush(out)) {
778 return 0;
779 }
780
781 return 1;
782 }
783
SSL_request_handshake_hints(SSL * ssl,const uint8_t * client_hello,size_t client_hello_len,const uint8_t * capabilities,size_t capabilities_len)784 int SSL_request_handshake_hints(SSL *ssl, const uint8_t *client_hello,
785 size_t client_hello_len,
786 const uint8_t *capabilities,
787 size_t capabilities_len) {
788 if (SSL_is_dtls(ssl)) {
789 OPENSSL_PUT_ERROR(SSL, ERR_R_SHOULD_NOT_HAVE_BEEN_CALLED);
790 return 0;
791 }
792
793 CBS cbs, seq;
794 CBS_init(&cbs, capabilities, capabilities_len);
795 UniquePtr<SSL_HANDSHAKE_HINTS> hints = MakeUnique<SSL_HANDSHAKE_HINTS>();
796 if (hints == nullptr || //
797 !CBS_get_asn1(&cbs, &seq, CBS_ASN1_SEQUENCE) || //
798 !apply_remote_features(ssl, &seq)) {
799 return 0;
800 }
801
802 SSL3_STATE *const s3 = ssl->s3;
803 s3->v2_hello_done = true;
804 s3->has_message = true;
805
806 Array<uint8_t> client_hello_msg;
807 ScopedCBB client_hello_cbb;
808 CBB client_hello_body;
809 if (!ssl->method->init_message(ssl, client_hello_cbb.get(),
810 &client_hello_body, SSL3_MT_CLIENT_HELLO) ||
811 !CBB_add_bytes(&client_hello_body, client_hello, client_hello_len) ||
812 !ssl->method->finish_message(ssl, client_hello_cbb.get(),
813 &client_hello_msg)) {
814 return 0;
815 }
816
817 s3->hs_buf.reset(BUF_MEM_new());
818 if (!s3->hs_buf || !BUF_MEM_append(s3->hs_buf.get(), client_hello_msg.data(),
819 client_hello_msg.size())) {
820 return 0;
821 }
822
823 s3->hs->hints_requested = true;
824 s3->hs->hints = std::move(hints);
825 return 1;
826 }
827
828 // |SSL_HANDSHAKE_HINTS| is serialized as the following ASN.1 structure. We use
829 // implicit tagging to make it a little more compact.
830 //
831 // HandshakeHints ::= SEQUENCE {
832 // serverRandomTLS13 [0] IMPLICIT OCTET STRING OPTIONAL,
833 // keyShareHint [1] IMPLICIT KeyShareHint OPTIONAL,
834 // signatureHint [2] IMPLICIT SignatureHint OPTIONAL,
835 // -- At most one of decryptedPSKHint or ignorePSKHint may be present. It
836 // -- corresponds to the first entry in pre_shared_keys. TLS 1.2 session
837 // -- tickets use a separate hint, to ensure the caller does not apply the
838 // -- hint to the wrong field.
839 // decryptedPSKHint [3] IMPLICIT OCTET STRING OPTIONAL,
840 // ignorePSKHint [4] IMPLICIT NULL OPTIONAL,
841 // compressCertificateHint [5] IMPLICIT CompressCertificateHint OPTIONAL,
842 // -- TLS 1.2 and 1.3 use different server random hints because one contains
843 // -- a timestamp while the other doesn't. If the hint was generated
844 // -- assuming TLS 1.3 but we actually negotiate TLS 1.2, mixing the two
845 // -- will break this.
846 // serverRandomTLS12 [6] IMPLICIT OCTET STRING OPTIONAL,
847 // ecdheHint [7] IMPLICIT ECDHEHint OPTIONAL
848 // -- At most one of decryptedTicketHint or ignoreTicketHint may be present.
849 // -- renewTicketHint requires decryptedTicketHint.
850 // decryptedTicketHint [8] IMPLICIT OCTET STRING OPTIONAL,
851 // renewTicketHint [9] IMPLICIT NULL OPTIONAL,
852 // ignoreTicketHint [10] IMPLICIT NULL OPTIONAL,
853 // }
854 //
855 // KeyShareHint ::= SEQUENCE {
856 // groupId INTEGER,
857 // ciphertext OCTET STRING,
858 // secret OCTET STRING,
859 // }
860 //
861 // SignatureHint ::= SEQUENCE {
862 // algorithm INTEGER,
863 // input OCTET STRING,
864 // subjectPublicKeyInfo OCTET STRING,
865 // signature OCTET STRING,
866 // }
867 //
868 // CompressCertificateHint ::= SEQUENCE {
869 // algorithm INTEGER,
870 // input OCTET STRING,
871 // compressed OCTET STRING,
872 // }
873 //
874 // ECDHEHint ::= SEQUENCE {
875 // groupId INTEGER,
876 // publicKey OCTET STRING,
877 // privateKey OCTET STRING,
878 // }
879
880 // HandshakeHints tags.
881 static const CBS_ASN1_TAG kServerRandomTLS13Tag = CBS_ASN1_CONTEXT_SPECIFIC | 0;
882 static const CBS_ASN1_TAG kKeyShareHintTag =
883 CBS_ASN1_CONSTRUCTED | CBS_ASN1_CONTEXT_SPECIFIC | 1;
884 static const CBS_ASN1_TAG kSignatureHintTag =
885 CBS_ASN1_CONSTRUCTED | CBS_ASN1_CONTEXT_SPECIFIC | 2;
886 static const CBS_ASN1_TAG kDecryptedPSKTag = CBS_ASN1_CONTEXT_SPECIFIC | 3;
887 static const CBS_ASN1_TAG kIgnorePSKTag = CBS_ASN1_CONTEXT_SPECIFIC | 4;
888 static const CBS_ASN1_TAG kCompressCertificateTag =
889 CBS_ASN1_CONTEXT_SPECIFIC | 5;
890 static const CBS_ASN1_TAG kServerRandomTLS12Tag = CBS_ASN1_CONTEXT_SPECIFIC | 6;
891 static const CBS_ASN1_TAG kECDHEHintTag = CBS_ASN1_CONSTRUCTED | 7;
892 static const CBS_ASN1_TAG kDecryptedTicketTag = CBS_ASN1_CONTEXT_SPECIFIC | 8;
893 static const CBS_ASN1_TAG kRenewTicketTag = CBS_ASN1_CONTEXT_SPECIFIC | 9;
894 static const CBS_ASN1_TAG kIgnoreTicketTag = CBS_ASN1_CONTEXT_SPECIFIC | 10;
895
SSL_serialize_handshake_hints(const SSL * ssl,CBB * out)896 int SSL_serialize_handshake_hints(const SSL *ssl, CBB *out) {
897 const SSL_HANDSHAKE *hs = ssl->s3->hs.get();
898 if (!ssl->server || !hs->hints_requested) {
899 OPENSSL_PUT_ERROR(SSL, ERR_R_SHOULD_NOT_HAVE_BEEN_CALLED);
900 return 0;
901 }
902
903 const SSL_HANDSHAKE_HINTS *hints = hs->hints.get();
904 CBB seq, child;
905 if (!CBB_add_asn1(out, &seq, CBS_ASN1_SEQUENCE)) {
906 return 0;
907 }
908
909 if (!hints->server_random_tls13.empty()) {
910 if (!CBB_add_asn1(&seq, &child, kServerRandomTLS13Tag) ||
911 !CBB_add_bytes(&child, hints->server_random_tls13.data(),
912 hints->server_random_tls13.size())) {
913 return 0;
914 }
915 }
916
917 if (hints->key_share_group_id != 0 && !hints->key_share_ciphertext.empty() &&
918 !hints->key_share_secret.empty()) {
919 if (!CBB_add_asn1(&seq, &child, kKeyShareHintTag) ||
920 !CBB_add_asn1_uint64(&child, hints->key_share_group_id) ||
921 !CBB_add_asn1_octet_string(&child, hints->key_share_ciphertext.data(),
922 hints->key_share_ciphertext.size()) ||
923 !CBB_add_asn1_octet_string(&child, hints->key_share_secret.data(),
924 hints->key_share_secret.size())) {
925 return 0;
926 }
927 }
928
929 if (hints->signature_algorithm != 0 && !hints->signature_input.empty() &&
930 !hints->signature.empty()) {
931 if (!CBB_add_asn1(&seq, &child, kSignatureHintTag) ||
932 !CBB_add_asn1_uint64(&child, hints->signature_algorithm) ||
933 !CBB_add_asn1_octet_string(&child, hints->signature_input.data(),
934 hints->signature_input.size()) ||
935 !CBB_add_asn1_octet_string(&child, hints->signature_spki.data(),
936 hints->signature_spki.size()) ||
937 !CBB_add_asn1_octet_string(&child, hints->signature.data(),
938 hints->signature.size())) {
939 return 0;
940 }
941 }
942
943 if (!hints->decrypted_psk.empty()) {
944 if (!CBB_add_asn1(&seq, &child, kDecryptedPSKTag) ||
945 !CBB_add_bytes(&child, hints->decrypted_psk.data(),
946 hints->decrypted_psk.size())) {
947 return 0;
948 }
949 }
950
951 if (hints->ignore_psk && //
952 !CBB_add_asn1(&seq, &child, kIgnorePSKTag)) {
953 return 0;
954 }
955
956 if (hints->cert_compression_alg_id != 0 &&
957 !hints->cert_compression_input.empty() &&
958 !hints->cert_compression_output.empty()) {
959 if (!CBB_add_asn1(&seq, &child, kCompressCertificateTag) ||
960 !CBB_add_asn1_uint64(&child, hints->cert_compression_alg_id) ||
961 !CBB_add_asn1_octet_string(&child, hints->cert_compression_input.data(),
962 hints->cert_compression_input.size()) ||
963 !CBB_add_asn1_octet_string(&child,
964 hints->cert_compression_output.data(),
965 hints->cert_compression_output.size())) {
966 return 0;
967 }
968 }
969
970 if (!hints->server_random_tls12.empty()) {
971 if (!CBB_add_asn1(&seq, &child, kServerRandomTLS12Tag) ||
972 !CBB_add_bytes(&child, hints->server_random_tls12.data(),
973 hints->server_random_tls12.size())) {
974 return 0;
975 }
976 }
977
978 if (hints->ecdhe_group_id != 0 && !hints->ecdhe_public_key.empty() &&
979 !hints->ecdhe_private_key.empty()) {
980 if (!CBB_add_asn1(&seq, &child, kECDHEHintTag) ||
981 !CBB_add_asn1_uint64(&child, hints->ecdhe_group_id) ||
982 !CBB_add_asn1_octet_string(&child, hints->ecdhe_public_key.data(),
983 hints->ecdhe_public_key.size()) ||
984 !CBB_add_asn1_octet_string(&child, hints->ecdhe_private_key.data(),
985 hints->ecdhe_private_key.size())) {
986 return 0;
987 }
988 }
989
990
991 if (!hints->decrypted_ticket.empty()) {
992 if (!CBB_add_asn1(&seq, &child, kDecryptedTicketTag) ||
993 !CBB_add_bytes(&child, hints->decrypted_ticket.data(),
994 hints->decrypted_ticket.size())) {
995 return 0;
996 }
997 }
998
999 if (hints->renew_ticket && //
1000 !CBB_add_asn1(&seq, &child, kRenewTicketTag)) {
1001 return 0;
1002 }
1003
1004 if (hints->ignore_ticket && //
1005 !CBB_add_asn1(&seq, &child, kIgnoreTicketTag)) {
1006 return 0;
1007 }
1008
1009 return CBB_flush(out);
1010 }
1011
get_optional_implicit_null(CBS * cbs,bool * out_present,CBS_ASN1_TAG tag)1012 static bool get_optional_implicit_null(CBS *cbs, bool *out_present,
1013 CBS_ASN1_TAG tag) {
1014 CBS value;
1015 int present;
1016 if (!CBS_get_optional_asn1(cbs, &value, &present, tag) ||
1017 (present && CBS_len(&value) != 0)) {
1018 return false;
1019 }
1020 *out_present = present;
1021 return true;
1022 }
1023
SSL_set_handshake_hints(SSL * ssl,const uint8_t * hints,size_t hints_len)1024 int SSL_set_handshake_hints(SSL *ssl, const uint8_t *hints, size_t hints_len) {
1025 if (SSL_is_dtls(ssl)) {
1026 OPENSSL_PUT_ERROR(SSL, ERR_R_SHOULD_NOT_HAVE_BEEN_CALLED);
1027 return 0;
1028 }
1029
1030 UniquePtr<SSL_HANDSHAKE_HINTS> hints_obj = MakeUnique<SSL_HANDSHAKE_HINTS>();
1031 if (hints_obj == nullptr) {
1032 return 0;
1033 }
1034
1035 CBS cbs, seq, server_random_tls13, key_share, signature_hint, psk,
1036 cert_compression, server_random_tls12, ecdhe, ticket;
1037 int has_server_random_tls13, has_key_share, has_signature_hint, has_psk,
1038 has_cert_compression, has_server_random_tls12, has_ecdhe, has_ticket;
1039 CBS_init(&cbs, hints, hints_len);
1040 if (!CBS_get_asn1(&cbs, &seq, CBS_ASN1_SEQUENCE) ||
1041 !CBS_get_optional_asn1(&seq, &server_random_tls13,
1042 &has_server_random_tls13, kServerRandomTLS13Tag) ||
1043 !CBS_get_optional_asn1(&seq, &key_share, &has_key_share,
1044 kKeyShareHintTag) ||
1045 !CBS_get_optional_asn1(&seq, &signature_hint, &has_signature_hint,
1046 kSignatureHintTag) ||
1047 !CBS_get_optional_asn1(&seq, &psk, &has_psk, kDecryptedPSKTag) ||
1048 !get_optional_implicit_null(&seq, &hints_obj->ignore_psk,
1049 kIgnorePSKTag) ||
1050 !CBS_get_optional_asn1(&seq, &cert_compression, &has_cert_compression,
1051 kCompressCertificateTag) ||
1052 !CBS_get_optional_asn1(&seq, &server_random_tls12,
1053 &has_server_random_tls12, kServerRandomTLS12Tag) ||
1054 !CBS_get_optional_asn1(&seq, &ecdhe, &has_ecdhe, kECDHEHintTag) ||
1055 !CBS_get_optional_asn1(&seq, &ticket, &has_ticket, kDecryptedTicketTag) ||
1056 !get_optional_implicit_null(&seq, &hints_obj->renew_ticket,
1057 kRenewTicketTag) ||
1058 !get_optional_implicit_null(&seq, &hints_obj->ignore_ticket,
1059 kIgnoreTicketTag)) {
1060 OPENSSL_PUT_ERROR(SSL, SSL_R_COULD_NOT_PARSE_HINTS);
1061 return 0;
1062 }
1063
1064 if (has_server_random_tls13 &&
1065 !hints_obj->server_random_tls13.CopyFrom(server_random_tls13)) {
1066 return 0;
1067 }
1068
1069 if (has_key_share) {
1070 uint64_t group_id;
1071 CBS ciphertext, secret;
1072 if (!CBS_get_asn1_uint64(&key_share, &group_id) || //
1073 group_id == 0 || group_id > 0xffff ||
1074 !CBS_get_asn1(&key_share, &ciphertext, CBS_ASN1_OCTETSTRING) ||
1075 !hints_obj->key_share_ciphertext.CopyFrom(ciphertext) ||
1076 !CBS_get_asn1(&key_share, &secret, CBS_ASN1_OCTETSTRING) ||
1077 !hints_obj->key_share_secret.CopyFrom(secret)) {
1078 OPENSSL_PUT_ERROR(SSL, SSL_R_COULD_NOT_PARSE_HINTS);
1079 return 0;
1080 }
1081 hints_obj->key_share_group_id = static_cast<uint16_t>(group_id);
1082 }
1083
1084 if (has_signature_hint) {
1085 uint64_t sig_alg;
1086 CBS input, spki, signature;
1087 if (!CBS_get_asn1_uint64(&signature_hint, &sig_alg) || //
1088 sig_alg == 0 || sig_alg > 0xffff ||
1089 !CBS_get_asn1(&signature_hint, &input, CBS_ASN1_OCTETSTRING) ||
1090 !hints_obj->signature_input.CopyFrom(input) ||
1091 !CBS_get_asn1(&signature_hint, &spki, CBS_ASN1_OCTETSTRING) ||
1092 !hints_obj->signature_spki.CopyFrom(spki) ||
1093 !CBS_get_asn1(&signature_hint, &signature, CBS_ASN1_OCTETSTRING) ||
1094 !hints_obj->signature.CopyFrom(signature)) {
1095 OPENSSL_PUT_ERROR(SSL, SSL_R_COULD_NOT_PARSE_HINTS);
1096 return 0;
1097 }
1098 hints_obj->signature_algorithm = static_cast<uint16_t>(sig_alg);
1099 }
1100
1101 if (has_psk && !hints_obj->decrypted_psk.CopyFrom(psk)) {
1102 return 0;
1103 }
1104 if (has_psk && hints_obj->ignore_psk) {
1105 OPENSSL_PUT_ERROR(SSL, SSL_R_COULD_NOT_PARSE_HINTS);
1106 return 0;
1107 }
1108
1109 if (has_cert_compression) {
1110 uint64_t alg;
1111 CBS input, output;
1112 if (!CBS_get_asn1_uint64(&cert_compression, &alg) || //
1113 alg == 0 || alg > 0xffff ||
1114 !CBS_get_asn1(&cert_compression, &input, CBS_ASN1_OCTETSTRING) ||
1115 !hints_obj->cert_compression_input.CopyFrom(input) ||
1116 !CBS_get_asn1(&cert_compression, &output, CBS_ASN1_OCTETSTRING) ||
1117 !hints_obj->cert_compression_output.CopyFrom(output)) {
1118 OPENSSL_PUT_ERROR(SSL, SSL_R_COULD_NOT_PARSE_HINTS);
1119 return 0;
1120 }
1121 hints_obj->cert_compression_alg_id = static_cast<uint16_t>(alg);
1122 }
1123
1124 if (has_server_random_tls12 &&
1125 !hints_obj->server_random_tls12.CopyFrom(server_random_tls12)) {
1126 return 0;
1127 }
1128
1129 if (has_ecdhe) {
1130 uint64_t group_id;
1131 CBS public_key, private_key;
1132 if (!CBS_get_asn1_uint64(&ecdhe, &group_id) || //
1133 group_id == 0 || group_id > 0xffff ||
1134 !CBS_get_asn1(&ecdhe, &public_key, CBS_ASN1_OCTETSTRING) ||
1135 !hints_obj->ecdhe_public_key.CopyFrom(public_key) ||
1136 !CBS_get_asn1(&ecdhe, &private_key, CBS_ASN1_OCTETSTRING) ||
1137 !hints_obj->ecdhe_private_key.CopyFrom(private_key)) {
1138 OPENSSL_PUT_ERROR(SSL, SSL_R_COULD_NOT_PARSE_HINTS);
1139 return 0;
1140 }
1141 hints_obj->ecdhe_group_id = static_cast<uint16_t>(group_id);
1142 }
1143
1144 if (has_ticket && !hints_obj->decrypted_ticket.CopyFrom(ticket)) {
1145 return 0;
1146 }
1147 if (has_ticket && hints_obj->ignore_ticket) {
1148 OPENSSL_PUT_ERROR(SSL, SSL_R_COULD_NOT_PARSE_HINTS);
1149 return 0;
1150 }
1151 if (!has_ticket && hints_obj->renew_ticket) {
1152 OPENSSL_PUT_ERROR(SSL, SSL_R_COULD_NOT_PARSE_HINTS);
1153 return 0;
1154 }
1155
1156 ssl->s3->hs->hints = std::move(hints_obj);
1157 return 1;
1158 }
1159