summaryrefslogtreecommitdiff
path: root/src/lib/libssl/t1_lib.c
diff options
context:
space:
mode:
authorbeck <>2017-08-12 23:39:24 +0000
committerbeck <>2017-08-12 23:39:24 +0000
commitab1df86cb18a998514b14cc0f6538d76eec73884 (patch)
tree40af0a8b49ae13870bfa61315a2cd560fabe481c /src/lib/libssl/t1_lib.c
parenta6e24060b68da4965823f1fafe89dd446c9fa398 (diff)
downloadopenbsd-ab1df86cb18a998514b14cc0f6538d76eec73884.tar.gz
openbsd-ab1df86cb18a998514b14cc0f6538d76eec73884.tar.bz2
openbsd-ab1df86cb18a998514b14cc0f6538d76eec73884.zip
Rewrite the TLS status request extension to use the new TLS extension framework.
ok jsing@
Diffstat (limited to '')
-rw-r--r--src/lib/libssl/t1_lib.c176
1 files changed, 3 insertions, 173 deletions
diff --git a/src/lib/libssl/t1_lib.c b/src/lib/libssl/t1_lib.c
index e27a7d1a59..405f08ed33 100644
--- a/src/lib/libssl/t1_lib.c
+++ b/src/lib/libssl/t1_lib.c
@@ -1,4 +1,4 @@
1/* $OpenBSD: t1_lib.c,v 1.130 2017/08/12 21:47:59 jsing Exp $ */ 1/* $OpenBSD: t1_lib.c,v 1.131 2017/08/12 23:38:12 beck Exp $ */
2/* Copyright (C) 1995-1998 Eric Young (eay@cryptsoft.com) 2/* Copyright (C) 1995-1998 Eric Young (eay@cryptsoft.com)
3 * All rights reserved. 3 * All rights reserved.
4 * 4 *
@@ -687,51 +687,6 @@ ssl_add_clienthello_tlsext(SSL *s, unsigned char *p, unsigned char *limit)
687 return NULL; 687 return NULL;
688 ret += len; 688 ret += len;
689 689
690 if (s->tlsext_status_type == TLSEXT_STATUSTYPE_ocsp &&
691 s->version != DTLS1_VERSION) {
692 int i;
693 long extlen, idlen, itmp;
694 OCSP_RESPID *id;
695
696 idlen = 0;
697 for (i = 0; i < sk_OCSP_RESPID_num(s->internal->tlsext_ocsp_ids); i++) {
698 id = sk_OCSP_RESPID_value(s->internal->tlsext_ocsp_ids, i);
699 itmp = i2d_OCSP_RESPID(id, NULL);
700 if (itmp <= 0)
701 return NULL;
702 idlen += itmp + 2;
703 }
704
705 if (s->internal->tlsext_ocsp_exts) {
706 extlen = i2d_X509_EXTENSIONS(s->internal->tlsext_ocsp_exts, NULL);
707 if (extlen < 0)
708 return NULL;
709 } else
710 extlen = 0;
711
712 if ((size_t)(limit - ret) < 7 + extlen + idlen)
713 return NULL;
714 s2n(TLSEXT_TYPE_status_request, ret);
715 if (extlen + idlen > 0xFFF0)
716 return NULL;
717 s2n(extlen + idlen + 5, ret);
718 *(ret++) = TLSEXT_STATUSTYPE_ocsp;
719 s2n(idlen, ret);
720 for (i = 0; i < sk_OCSP_RESPID_num(s->internal->tlsext_ocsp_ids); i++) {
721 /* save position of id len */
722 unsigned char *q = ret;
723 id = sk_OCSP_RESPID_value(s->internal->tlsext_ocsp_ids, i);
724 /* skip over id len */
725 ret += 2;
726 itmp = i2d_OCSP_RESPID(id, &ret);
727 /* write id len */
728 s2n(itmp, q);
729 }
730 s2n(extlen, ret);
731 if (extlen > 0)
732 i2d_X509_EXTENSIONS(s->internal->tlsext_ocsp_exts, &ret);
733 }
734
735 if (s->internal->alpn_client_proto_list != NULL && 690 if (s->internal->alpn_client_proto_list != NULL &&
736 S3I(s)->tmp.finish_md_len == 0) { 691 S3I(s)->tmp.finish_md_len == 0) {
737 if ((size_t)(limit - ret) < 692 if ((size_t)(limit - ret) <
@@ -837,14 +792,6 @@ ssl_add_serverhello_tlsext(SSL *s, unsigned char *p, unsigned char *limit)
837 * extension. 792 * extension.
838 */ 793 */
839 794
840 if (s->internal->tlsext_status_expected) {
841 if ((size_t)(limit - ret) < 4)
842 return NULL;
843
844 s2n(TLSEXT_TYPE_status_request, ret);
845 s2n(0, ret);
846 }
847
848#ifndef OPENSSL_NO_SRTP 795#ifndef OPENSSL_NO_SRTP
849 if (SSL_IS_DTLS(s) && s->internal->srtp_profile) { 796 if (SSL_IS_DTLS(s) && s->internal->srtp_profile) {
850 int el; 797 int el;
@@ -1011,111 +958,7 @@ ssl_parse_clienthello_tlsext(SSL *s, unsigned char **p, unsigned char *d,
1011 if (!tlsext_clienthello_parse_one(s, &cbs, type, al)) 958 if (!tlsext_clienthello_parse_one(s, &cbs, type, al))
1012 return 0; 959 return 0;
1013 960
1014 if (type == TLSEXT_TYPE_status_request && 961 if (type ==
1015 s->version != DTLS1_VERSION) {
1016
1017 if (size < 5) {
1018 *al = SSL_AD_DECODE_ERROR;
1019 return 0;
1020 }
1021
1022 s->tlsext_status_type = *data++;
1023 size--;
1024 if (s->tlsext_status_type == TLSEXT_STATUSTYPE_ocsp) {
1025 const unsigned char *sdata;
1026 int dsize;
1027 /* Read in responder_id_list */
1028 n2s(data, dsize);
1029 size -= 2;
1030 if (dsize > size) {
1031 *al = SSL_AD_DECODE_ERROR;
1032 return 0;
1033 }
1034
1035 /*
1036 * We remove any OCSP_RESPIDs from a
1037 * previous handshake to prevent
1038 * unbounded memory growth.
1039 */
1040 sk_OCSP_RESPID_pop_free(s->internal->tlsext_ocsp_ids,
1041 OCSP_RESPID_free);
1042 s->internal->tlsext_ocsp_ids = NULL;
1043 if (dsize > 0) {
1044 s->internal->tlsext_ocsp_ids =
1045 sk_OCSP_RESPID_new_null();
1046 if (s->internal->tlsext_ocsp_ids == NULL) {
1047 *al = SSL_AD_INTERNAL_ERROR;
1048 return 0;
1049 }
1050 }
1051
1052 while (dsize > 0) {
1053 OCSP_RESPID *id;
1054 int idsize;
1055 if (dsize < 4) {
1056 *al = SSL_AD_DECODE_ERROR;
1057 return 0;
1058 }
1059 n2s(data, idsize);
1060 dsize -= 2 + idsize;
1061 size -= 2 + idsize;
1062 if (dsize < 0) {
1063 *al = SSL_AD_DECODE_ERROR;
1064 return 0;
1065 }
1066 sdata = data;
1067 data += idsize;
1068 id = d2i_OCSP_RESPID(NULL,
1069 &sdata, idsize);
1070 if (!id) {
1071 *al = SSL_AD_DECODE_ERROR;
1072 return 0;
1073 }
1074 if (data != sdata) {
1075 OCSP_RESPID_free(id);
1076 *al = SSL_AD_DECODE_ERROR;
1077 return 0;
1078 }
1079 if (!sk_OCSP_RESPID_push(
1080 s->internal->tlsext_ocsp_ids, id)) {
1081 OCSP_RESPID_free(id);
1082 *al = SSL_AD_INTERNAL_ERROR;
1083 return 0;
1084 }
1085 }
1086
1087 /* Read in request_extensions */
1088 if (size < 2) {
1089 *al = SSL_AD_DECODE_ERROR;
1090 return 0;
1091 }
1092 n2s(data, dsize);
1093 size -= 2;
1094 if (dsize != size) {
1095 *al = SSL_AD_DECODE_ERROR;
1096 return 0;
1097 }
1098 sdata = data;
1099 if (dsize > 0) {
1100 sk_X509_EXTENSION_pop_free(s->internal->tlsext_ocsp_exts,
1101 X509_EXTENSION_free);
1102
1103 s->internal->tlsext_ocsp_exts =
1104 d2i_X509_EXTENSIONS(NULL,
1105 &sdata, dsize);
1106 if (!s->internal->tlsext_ocsp_exts ||
1107 (data + dsize != sdata)) {
1108 *al = SSL_AD_DECODE_ERROR;
1109 return 0;
1110 }
1111 }
1112 } else {
1113 /* We don't know what to do with any other type
1114 * so ignore it.
1115 */
1116 s->tlsext_status_type = -1;
1117 }
1118 } else if (type ==
1119 TLSEXT_TYPE_application_layer_protocol_negotiation && 962 TLSEXT_TYPE_application_layer_protocol_negotiation &&
1120 s->ctx->internal->alpn_select_cb != NULL && 963 s->ctx->internal->alpn_select_cb != NULL &&
1121 S3I(s)->tmp.finish_md_len == 0) { 964 S3I(s)->tmp.finish_md_len == 0) {
@@ -1123,7 +966,6 @@ ssl_parse_clienthello_tlsext(SSL *s, unsigned char **p, unsigned char *d,
1123 size, al) != 1) 966 size, al) != 1)
1124 return (0); 967 return (0);
1125 } 968 }
1126
1127 /* session ticket processed earlier */ 969 /* session ticket processed earlier */
1128#ifndef OPENSSL_NO_SRTP 970#ifndef OPENSSL_NO_SRTP
1129 else if (SSL_IS_DTLS(s) && type == TLSEXT_TYPE_use_srtp) { 971 else if (SSL_IS_DTLS(s) && type == TLSEXT_TYPE_use_srtp) {
@@ -1197,19 +1039,7 @@ ssl_parse_serverhello_tlsext(SSL *s, unsigned char **p, size_t n, int *al)
1197 if (!tlsext_serverhello_parse_one(s, &cbs, type, al)) 1039 if (!tlsext_serverhello_parse_one(s, &cbs, type, al))
1198 return 0; 1040 return 0;
1199 1041
1200 if (type == TLSEXT_TYPE_status_request && 1042 if (type == TLSEXT_TYPE_application_layer_protocol_negotiation) {
1201 s->version != DTLS1_VERSION) {
1202 /* MUST be empty and only sent if we've requested
1203 * a status request message.
1204 */
1205 if ((s->tlsext_status_type == -1) || (size > 0)) {
1206 *al = TLS1_AD_UNSUPPORTED_EXTENSION;
1207 return 0;
1208 }
1209 /* Set flag to expect CertificateStatus message */
1210 s->internal->tlsext_status_expected = 1;
1211 } else if (type ==
1212 TLSEXT_TYPE_application_layer_protocol_negotiation) {
1213 unsigned int len; 1043 unsigned int len;
1214 1044
1215 /* We must have requested it. */ 1045 /* We must have requested it. */
generated by cgit v1.2.3-55-g6feb (git 2.39.1) at 2025-10-30 09:09:40 +0000