summaryrefslogtreecommitdiff
path: root/src
diff options
context:
space:
mode:
authortb <>2022-08-05 08:51:35 +0000
committertb <>2022-08-05 08:51:35 +0000
commit065c3b8f4dbd70a085d42a0b39436d95e698dbac (patch)
treeb114fff49ba0537a287b1737bab9640f1a88b650 /src
parent5460dd8831b5e0bf962e45c715a3fe564a3f0c3a (diff)
downloadopenbsd-065c3b8f4dbd70a085d42a0b39436d95e698dbac.tar.gz
openbsd-065c3b8f4dbd70a085d42a0b39436d95e698dbac.tar.bz2
openbsd-065c3b8f4dbd70a085d42a0b39436d95e698dbac.zip
Remove most of the indirection introduced in previous and instead fetch
the appropriate tls_extension_funcs pointers for client and server from libssl and reach into them directly. ok jsing
Diffstat (limited to 'src')
-rw-r--r--src/regress/lib/libssl/tlsext/tlsexttest.c739
1 files changed, 339 insertions, 400 deletions
diff --git a/src/regress/lib/libssl/tlsext/tlsexttest.c b/src/regress/lib/libssl/tlsext/tlsexttest.c
index 3e90eab384..e441aeb8f6 100644
--- a/src/regress/lib/libssl/tlsext/tlsexttest.c
+++ b/src/regress/lib/libssl/tlsext/tlsexttest.c
@@ -1,4 +1,4 @@
1/* $OpenBSD: tlsexttest.c,v 1.67 2022/08/04 09:28:31 tb Exp $ */ 1/* $OpenBSD: tlsexttest.c,v 1.68 2022/08/05 08:51:35 tb Exp $ */
2/* 2/*
3 * Copyright (c) 2017 Joel Sing <jsing@openbsd.org> 3 * Copyright (c) 2017 Joel Sing <jsing@openbsd.org>
4 * Copyright (c) 2017 Doug Hogan <doug@openbsd.org> 4 * Copyright (c) 2017 Doug Hogan <doug@openbsd.org>
@@ -37,100 +37,23 @@ const struct tls_extension *tls_extension_find(uint16_t, size_t *);
37const struct tls_extension_funcs *tlsext_funcs(const struct tls_extension *, 37const struct tls_extension_funcs *tlsext_funcs(const struct tls_extension *,
38 int); 38 int);
39 39
40static const struct tls_extension_funcs * 40static int
41tls_extension_funcs(int type, int is_server) 41tls_extension_funcs(int type, const struct tls_extension_funcs **client_funcs,
42 const struct tls_extension_funcs **server_funcs)
42{ 43{
43 const struct tls_extension *ext; 44 const struct tls_extension *ext;
44 size_t idx; 45 size_t idx;
45 46
46 if ((ext = tls_extension_find(type, &idx)) == NULL) 47 if ((ext = tls_extension_find(type, &idx)) == NULL)
47 return NULL;
48
49 return tlsext_funcs(ext, is_server);
50}
51
52static const struct tls_extension_funcs *
53tls_extension_client_funcs(int type)
54{
55 int is_server = 0;
56
57 return tls_extension_funcs(type, is_server);
58}
59
60static const struct tls_extension_funcs *
61tls_extension_server_funcs(int type)
62{
63 int is_server = 1;
64
65 return tls_extension_funcs(type, is_server);
66}
67
68static int
69tls_extension_client_needs(int type, SSL *s, uint16_t msg_type)
70{
71 const struct tls_extension_funcs *funcs;
72
73 if ((funcs = tls_extension_client_funcs(type)) == NULL)
74 return 0;
75
76 return funcs->needs(s, msg_type);
77}
78
79static int
80tls_extension_client_build(int type, SSL *s, uint16_t msg_type, CBB *cbb)
81{
82 const struct tls_extension_funcs *funcs;
83
84 if ((funcs = tls_extension_client_funcs(type)) == NULL)
85 return 0; 48 return 0;
86 49
87 return funcs->build(s, msg_type, cbb); 50 if ((*client_funcs = tlsext_funcs(ext, 0)) == NULL)
88}
89
90static int
91tls_extension_client_parse(int type, SSL *s, uint16_t msg_type, CBS *cbs,
92 int *alert)
93{
94 const struct tls_extension_funcs *funcs;
95
96 if ((funcs = tls_extension_client_funcs(type)) == NULL)
97 return 0; 51 return 0;
98 52
99 return funcs->parse(s, msg_type, cbs, alert); 53 if ((*server_funcs = tlsext_funcs(ext, 1)) == NULL)
100}
101
102static int
103tls_extension_server_needs(int type, SSL *s, uint16_t msg_type)
104{
105 const struct tls_extension_funcs *funcs;
106
107 if ((funcs = tls_extension_server_funcs(type)) == NULL)
108 return 0; 54 return 0;
109 55
110 return funcs->needs(s, msg_type); 56 return 1;
111}
112
113static int
114tls_extension_server_build(int type, SSL *s, uint16_t msg_type, CBB *cbb)
115{
116 const struct tls_extension_funcs *funcs;
117
118 if ((funcs = tls_extension_server_funcs(type)) == NULL)
119 return 0;
120
121 return funcs->build(s, msg_type, cbb);
122}
123
124static int
125tls_extension_server_parse(int type, SSL *s, uint16_t msg_type, CBS *cbs,
126 int *alert)
127{
128 const struct tls_extension_funcs *funcs;
129
130 if ((funcs = tls_extension_server_funcs(type)) == NULL)
131 return 0;
132
133 return funcs->parse(s, msg_type, cbs, alert);
134} 57}
135 58
136static void 59static void
@@ -235,6 +158,8 @@ test_tlsext_alpn_client(void)
235{ 158{
236 SSL_CTX *ssl_ctx = NULL; 159 SSL_CTX *ssl_ctx = NULL;
237 SSL *ssl = NULL; 160 SSL *ssl = NULL;
161 const struct tls_extension_funcs *client_funcs;
162 const struct tls_extension_funcs *server_funcs;
238 uint8_t *data = NULL; 163 uint8_t *data = NULL;
239 CBB cbb; 164 CBB cbb;
240 CBS cbs; 165 CBS cbs;
@@ -250,9 +175,11 @@ test_tlsext_alpn_client(void)
250 if ((ssl = SSL_new(ssl_ctx)) == NULL) 175 if ((ssl = SSL_new(ssl_ctx)) == NULL)
251 errx(1, "failed to create SSL"); 176 errx(1, "failed to create SSL");
252 177
178 if (!tls_extension_funcs(TLSEXT_TYPE_alpn, &client_funcs, &server_funcs))
179 errx(1, "failed to fetch ALPN funcs");
180
253 /* By default, we don't need this */ 181 /* By default, we don't need this */
254 if (tls_extension_client_needs(TLSEXT_TYPE_alpn, ssl, 182 if (client_funcs->needs(ssl, SSL_TLSEXT_MSG_CH)) {
255 SSL_TLSEXT_MSG_CH)) {
256 FAIL("client should not need ALPN by default\n"); 183 FAIL("client should not need ALPN by default\n");
257 goto err; 184 goto err;
258 } 185 }
@@ -269,16 +196,14 @@ test_tlsext_alpn_client(void)
269 FAIL("should be able to set ALPN to http/1.1\n"); 196 FAIL("should be able to set ALPN to http/1.1\n");
270 goto err; 197 goto err;
271 } 198 }
272 if (!tls_extension_client_needs(TLSEXT_TYPE_alpn, ssl, 199 if (!client_funcs->needs(ssl, SSL_TLSEXT_MSG_CH)) {
273 SSL_TLSEXT_MSG_CH)) {
274 FAIL("client should need ALPN by default\n"); 200 FAIL("client should need ALPN by default\n");
275 goto err; 201 goto err;
276 } 202 }
277 203
278 /* Make sure we can build the client with a single proto. */ 204 /* Make sure we can build the client with a single proto. */
279 205
280 if (!tls_extension_client_build(TLSEXT_TYPE_alpn, ssl, 206 if (!client_funcs->build(ssl, SSL_TLSEXT_MSG_CH, &cbb)) {
281 SSL_TLSEXT_MSG_CH, &cbb)) {
282 FAIL("client failed to build ALPN\n"); 207 FAIL("client failed to build ALPN\n");
283 goto err; 208 goto err;
284 } 209 }
@@ -309,8 +234,7 @@ test_tlsext_alpn_client(void)
309 234
310 CBS_init(&cbs, tlsext_alpn_single_proto, 235 CBS_init(&cbs, tlsext_alpn_single_proto,
311 sizeof(tlsext_alpn_single_proto)); 236 sizeof(tlsext_alpn_single_proto));
312 if (!tls_extension_server_parse(TLSEXT_TYPE_alpn, ssl, 237 if (!server_funcs->parse(ssl, SSL_TLSEXT_MSG_CH, &cbs, &alert)) {
313 SSL_TLSEXT_MSG_CH, &cbs, &alert)) {
314 FAIL("failed to parse ALPN\n"); 238 FAIL("failed to parse ALPN\n");
315 goto err; 239 goto err;
316 } 240 }
@@ -346,14 +270,12 @@ test_tlsext_alpn_client(void)
346 FAIL("should be able to set ALPN to http/1.1\n"); 270 FAIL("should be able to set ALPN to http/1.1\n");
347 goto err; 271 goto err;
348 } 272 }
349 if (!tls_extension_client_needs(TLSEXT_TYPE_alpn, ssl, 273 if (!client_funcs->needs(ssl, SSL_TLSEXT_MSG_CH)) {
350 SSL_TLSEXT_MSG_CH)) {
351 FAIL("client should need ALPN by now\n"); 274 FAIL("client should need ALPN by now\n");
352 goto err; 275 goto err;
353 } 276 }
354 277
355 if (!tls_extension_client_build(TLSEXT_TYPE_alpn, ssl, 278 if (!client_funcs->build(ssl, SSL_TLSEXT_MSG_CH, &cbb)) {
356 SSL_TLSEXT_MSG_CH, &cbb)) {
357 FAIL("client failed to build ALPN\n"); 279 FAIL("client failed to build ALPN\n");
358 goto err; 280 goto err;
359 } 281 }
@@ -379,8 +301,7 @@ test_tlsext_alpn_client(void)
379 301
380 CBS_init(&cbs, tlsext_alpn_multiple_protos, 302 CBS_init(&cbs, tlsext_alpn_multiple_protos,
381 sizeof(tlsext_alpn_multiple_protos)); 303 sizeof(tlsext_alpn_multiple_protos));
382 if (!tls_extension_server_parse(TLSEXT_TYPE_alpn, ssl, 304 if (!server_funcs->parse(ssl, SSL_TLSEXT_MSG_CH, &cbs, &alert)) {
383 SSL_TLSEXT_MSG_CH, &cbs, &alert)) {
384 FAIL("failed to parse ALPN\n"); 305 FAIL("failed to parse ALPN\n");
385 goto err; 306 goto err;
386 } 307 }
@@ -415,8 +336,7 @@ test_tlsext_alpn_client(void)
415 ssl->internal->alpn_client_proto_list = NULL; 336 ssl->internal->alpn_client_proto_list = NULL;
416 ssl->internal->alpn_client_proto_list_len = 0; 337 ssl->internal->alpn_client_proto_list_len = 0;
417 338
418 if (tls_extension_client_needs(TLSEXT_TYPE_alpn, ssl, 339 if (client_funcs->needs(ssl, SSL_TLSEXT_MSG_CH)) {
419 SSL_TLSEXT_MSG_CH)) {
420 FAIL("client should need ALPN by default\n"); 340 FAIL("client should need ALPN by default\n");
421 goto err; 341 goto err;
422 } 342 }
@@ -437,6 +357,8 @@ test_tlsext_alpn_server(void)
437{ 357{
438 SSL_CTX *ssl_ctx = NULL; 358 SSL_CTX *ssl_ctx = NULL;
439 SSL *ssl = NULL; 359 SSL *ssl = NULL;
360 const struct tls_extension_funcs *client_funcs;
361 const struct tls_extension_funcs *server_funcs;
440 uint8_t *data = NULL; 362 uint8_t *data = NULL;
441 CBB cbb; 363 CBB cbb;
442 CBS cbs; 364 CBS cbs;
@@ -452,9 +374,11 @@ test_tlsext_alpn_server(void)
452 if ((ssl = SSL_new(ssl_ctx)) == NULL) 374 if ((ssl = SSL_new(ssl_ctx)) == NULL)
453 errx(1, "failed to create SSL"); 375 errx(1, "failed to create SSL");
454 376
377 if (!tls_extension_funcs(TLSEXT_TYPE_alpn, &client_funcs, &server_funcs))
378 errx(1, "failed to fetch ALPN funcs");
379
455 /* By default, ALPN isn't needed. */ 380 /* By default, ALPN isn't needed. */
456 if (tls_extension_server_needs(TLSEXT_TYPE_alpn, ssl, 381 if (server_funcs->needs(ssl, SSL_TLSEXT_MSG_SH)) {
457 SSL_TLSEXT_MSG_SH)) {
458 FAIL("server should not need ALPN by default\n"); 382 FAIL("server should not need ALPN by default\n");
459 goto err; 383 goto err;
460 } 384 }
@@ -472,16 +396,14 @@ test_tlsext_alpn_server(void)
472 sizeof(tlsext_alpn_single_proto_name)); 396 sizeof(tlsext_alpn_single_proto_name));
473 ssl->s3->alpn_selected_len = sizeof(tlsext_alpn_single_proto_name); 397 ssl->s3->alpn_selected_len = sizeof(tlsext_alpn_single_proto_name);
474 398
475 if (!tls_extension_server_needs(TLSEXT_TYPE_alpn, ssl, 399 if (!server_funcs->needs(ssl, SSL_TLSEXT_MSG_SH)) {
476 SSL_TLSEXT_MSG_SH)) {
477 FAIL("server should need ALPN after a protocol is selected\n"); 400 FAIL("server should need ALPN after a protocol is selected\n");
478 goto err; 401 goto err;
479 } 402 }
480 403
481 /* Make sure we can build a server with one protocol */ 404 /* Make sure we can build a server with one protocol */
482 405
483 if (!tls_extension_server_build(TLSEXT_TYPE_alpn, ssl, 406 if (!server_funcs->build(ssl, SSL_TLSEXT_MSG_SH, &cbb)) {
484 SSL_TLSEXT_MSG_SH, &cbb)) {
485 FAIL("server should be able to build a response\n"); 407 FAIL("server should be able to build a response\n");
486 goto err; 408 goto err;
487 } 409 }
@@ -514,8 +436,7 @@ test_tlsext_alpn_server(void)
514 sizeof(tlsext_alpn_single_proto)); 436 sizeof(tlsext_alpn_single_proto));
515 437
516 /* Shouldn't be able to parse without requesting */ 438 /* Shouldn't be able to parse without requesting */
517 if (tls_extension_client_parse(TLSEXT_TYPE_alpn, ssl, SSL_TLSEXT_MSG_SH, 439 if (client_funcs->parse(ssl, SSL_TLSEXT_MSG_SH, &cbs, &alert)) {
518 &cbs, &alert)) {
519 FAIL("Should only parse server if we requested it\n"); 440 FAIL("Should only parse server if we requested it\n");
520 goto err; 441 goto err;
521 } 442 }
@@ -526,8 +447,7 @@ test_tlsext_alpn_server(void)
526 FAIL("should be able to set ALPN to http/1.1\n"); 447 FAIL("should be able to set ALPN to http/1.1\n");
527 goto err; 448 goto err;
528 } 449 }
529 if (!tls_extension_server_parse(TLSEXT_TYPE_alpn, ssl, 450 if (!server_funcs->parse(ssl, SSL_TLSEXT_MSG_SH, &cbs, &alert)) {
530 SSL_TLSEXT_MSG_SH, &cbs, &alert)) {
531 FAIL("Should be able to parse server when we request it\n"); 451 FAIL("Should be able to parse server when we request it\n");
532 goto err; 452 goto err;
533 } 453 }
@@ -570,8 +490,7 @@ test_tlsext_alpn_server(void)
570 ssl->s3->alpn_selected = NULL; 490 ssl->s3->alpn_selected = NULL;
571 ssl->s3->alpn_selected_len = 0; 491 ssl->s3->alpn_selected_len = 0;
572 492
573 if (tls_extension_server_needs(TLSEXT_TYPE_alpn, ssl, 493 if (server_funcs->needs(ssl, SSL_TLSEXT_MSG_SH)) {
574 SSL_TLSEXT_MSG_SH)) {
575 FAIL("server should need ALPN by default\n"); 494 FAIL("server should need ALPN by default\n");
576 goto err; 495 goto err;
577 } 496 }
@@ -627,6 +546,8 @@ test_tlsext_supportedgroups_client(void)
627 unsigned char *data = NULL; 546 unsigned char *data = NULL;
628 SSL_CTX *ssl_ctx = NULL; 547 SSL_CTX *ssl_ctx = NULL;
629 SSL *ssl = NULL; 548 SSL *ssl = NULL;
549 const struct tls_extension_funcs *client_funcs;
550 const struct tls_extension_funcs *server_funcs;
630 size_t dlen; 551 size_t dlen;
631 int failure, alert; 552 int failure, alert;
632 CBB cbb; 553 CBB cbb;
@@ -642,11 +563,14 @@ test_tlsext_supportedgroups_client(void)
642 if ((ssl = SSL_new(ssl_ctx)) == NULL) 563 if ((ssl = SSL_new(ssl_ctx)) == NULL)
643 errx(1, "failed to create SSL"); 564 errx(1, "failed to create SSL");
644 565
566 if (!tls_extension_funcs(TLSEXT_TYPE_supported_groups, &client_funcs,
567 &server_funcs))
568 errx(1, "failed to fetch supported groups funcs");
569
645 /* 570 /*
646 * Default ciphers include EC so we need it by default. 571 * Default ciphers include EC so we need it by default.
647 */ 572 */
648 if (!tls_extension_client_needs(TLSEXT_TYPE_supported_groups, ssl, 573 if (!client_funcs->needs(ssl, SSL_TLSEXT_MSG_CH)) {
649 SSL_TLSEXT_MSG_CH)) {
650 FAIL("client should need Ellipticcurves for default " 574 FAIL("client should need Ellipticcurves for default "
651 "ciphers\n"); 575 "ciphers\n");
652 goto err; 576 goto err;
@@ -659,8 +583,7 @@ test_tlsext_supportedgroups_client(void)
659 FAIL("client should be able to set cipher list\n"); 583 FAIL("client should be able to set cipher list\n");
660 goto err; 584 goto err;
661 } 585 }
662 if (tls_extension_client_needs(TLSEXT_TYPE_supported_groups, ssl, 586 if (client_funcs->needs(ssl, SSL_TLSEXT_MSG_CH)) {
663 SSL_TLSEXT_MSG_CH)) {
664 FAIL("client should not need Ellipticcurves\n"); 587 FAIL("client should not need Ellipticcurves\n");
665 goto err; 588 goto err;
666 } 589 }
@@ -672,8 +595,7 @@ test_tlsext_supportedgroups_client(void)
672 FAIL("client should be able to set cipher list\n"); 595 FAIL("client should be able to set cipher list\n");
673 goto err; 596 goto err;
674 } 597 }
675 if (!tls_extension_client_needs(TLSEXT_TYPE_supported_groups, ssl, 598 if (!client_funcs->needs(ssl, SSL_TLSEXT_MSG_CH)) {
676 SSL_TLSEXT_MSG_CH)) {
677 FAIL("client should need Ellipticcurves\n"); 599 FAIL("client should need Ellipticcurves\n");
678 goto err; 600 goto err;
679 } 601 }
@@ -694,14 +616,12 @@ test_tlsext_supportedgroups_client(void)
694 goto err; 616 goto err;
695 ssl->session->tlsext_supportedgroups_length = 1; 617 ssl->session->tlsext_supportedgroups_length = 1;
696 618
697 if (!tls_extension_client_needs(TLSEXT_TYPE_supported_groups, ssl, 619 if (!client_funcs->needs(ssl, SSL_TLSEXT_MSG_CH)) {
698 SSL_TLSEXT_MSG_CH)) {
699 FAIL("client should need Ellipticcurves\n"); 620 FAIL("client should need Ellipticcurves\n");
700 goto err; 621 goto err;
701 } 622 }
702 623
703 if (!tls_extension_client_build(TLSEXT_TYPE_supported_groups, ssl, 624 if (!client_funcs->build(ssl, SSL_TLSEXT_MSG_CH, &cbb)) {
704 SSL_TLSEXT_MSG_CH, &cbb)) {
705 FAIL("client failed to build Ellipticcurves\n"); 625 FAIL("client failed to build Ellipticcurves\n");
706 goto err; 626 goto err;
707 } 627 }
@@ -739,8 +659,7 @@ test_tlsext_supportedgroups_client(void)
739 659
740 CBS_init(&cbs, tlsext_supportedgroups_client_secp384r1, 660 CBS_init(&cbs, tlsext_supportedgroups_client_secp384r1,
741 sizeof(tlsext_supportedgroups_client_secp384r1)); 661 sizeof(tlsext_supportedgroups_client_secp384r1));
742 if (!tls_extension_server_parse(TLSEXT_TYPE_supported_groups, ssl, 662 if (!server_funcs->parse(ssl, SSL_TLSEXT_MSG_CH, &cbs, &alert)) {
743 SSL_TLSEXT_MSG_CH, &cbs, &alert)) {
744 FAIL("failed to parse client Ellipticcurves\n"); 663 FAIL("failed to parse client Ellipticcurves\n");
745 goto err; 664 goto err;
746 } 665 }
@@ -790,14 +709,12 @@ test_tlsext_supportedgroups_client(void)
790 goto err; 709 goto err;
791 ssl->internal->tlsext_supportedgroups_length = 2; 710 ssl->internal->tlsext_supportedgroups_length = 2;
792 711
793 if (!tls_extension_client_needs(TLSEXT_TYPE_supported_groups, ssl, 712 if (!client_funcs->needs(ssl, SSL_TLSEXT_MSG_CH)) {
794 SSL_TLSEXT_MSG_CH)) {
795 FAIL("client should need Ellipticcurves\n"); 713 FAIL("client should need Ellipticcurves\n");
796 goto err; 714 goto err;
797 } 715 }
798 716
799 if (!tls_extension_client_build(TLSEXT_TYPE_supported_groups, ssl, 717 if (!client_funcs->build(ssl, SSL_TLSEXT_MSG_CH, &cbb)) {
800 SSL_TLSEXT_MSG_CH, &cbb)) {
801 FAIL("client failed to build Ellipticcurves\n"); 718 FAIL("client failed to build Ellipticcurves\n");
802 goto err; 719 goto err;
803 } 720 }
@@ -846,8 +763,7 @@ test_tlsext_supportedgroups_client(void)
846 763
847 CBS_init(&cbs, tlsext_supportedgroups_client_nistp192and224, 764 CBS_init(&cbs, tlsext_supportedgroups_client_nistp192and224,
848 sizeof(tlsext_supportedgroups_client_nistp192and224)); 765 sizeof(tlsext_supportedgroups_client_nistp192and224));
849 if (!tls_extension_server_parse(TLSEXT_TYPE_supported_groups, ssl, 766 if (!server_funcs->parse(ssl, SSL_TLSEXT_MSG_CH, &cbs, &alert)) {
850 SSL_TLSEXT_MSG_CH, &cbs, &alert)) {
851 FAIL("failed to parse client Ellipticcurves\n"); 767 FAIL("failed to parse client Ellipticcurves\n");
852 goto err; 768 goto err;
853 } 769 }
@@ -891,6 +807,8 @@ test_tlsext_supportedgroups_server(void)
891{ 807{
892 SSL_CTX *ssl_ctx = NULL; 808 SSL_CTX *ssl_ctx = NULL;
893 SSL *ssl = NULL; 809 SSL *ssl = NULL;
810 const struct tls_extension_funcs *client_funcs;
811 const struct tls_extension_funcs *server_funcs;
894 int failure; 812 int failure;
895 813
896 failure = 1; 814 failure = 1;
@@ -900,8 +818,11 @@ test_tlsext_supportedgroups_server(void)
900 if ((ssl = SSL_new(ssl_ctx)) == NULL) 818 if ((ssl = SSL_new(ssl_ctx)) == NULL)
901 errx(1, "failed to create SSL"); 819 errx(1, "failed to create SSL");
902 820
903 if (tls_extension_server_needs(TLSEXT_TYPE_supported_groups, ssl, 821 if (!tls_extension_funcs(TLSEXT_TYPE_supported_groups, &client_funcs,
904 SSL_TLSEXT_MSG_SH)) { 822 &server_funcs))
823 errx(1, "failed to fetch supported groups funcs");
824
825 if (server_funcs->needs(ssl, SSL_TLSEXT_MSG_SH)) {
905 FAIL("server should not need elliptic_curves\n"); 826 FAIL("server should not need elliptic_curves\n");
906 goto err; 827 goto err;
907 } 828 }
@@ -909,8 +830,7 @@ test_tlsext_supportedgroups_server(void)
909 if ((ssl->session = SSL_SESSION_new()) == NULL) 830 if ((ssl->session = SSL_SESSION_new()) == NULL)
910 errx(1, "failed to create session"); 831 errx(1, "failed to create session");
911 832
912 if (tls_extension_server_needs(TLSEXT_TYPE_supported_groups, ssl, 833 if (server_funcs->needs(ssl, SSL_TLSEXT_MSG_SH)) {
913 SSL_TLSEXT_MSG_SH)) {
914 FAIL("server should not need elliptic_curves\n"); 834 FAIL("server should not need elliptic_curves\n");
915 goto err; 835 goto err;
916 } 836 }
@@ -963,6 +883,8 @@ test_tlsext_ecpf_client(void)
963 uint8_t *data = NULL; 883 uint8_t *data = NULL;
964 SSL_CTX *ssl_ctx = NULL; 884 SSL_CTX *ssl_ctx = NULL;
965 SSL *ssl = NULL; 885 SSL *ssl = NULL;
886 const struct tls_extension_funcs *client_funcs;
887 const struct tls_extension_funcs *server_funcs;
966 size_t dlen; 888 size_t dlen;
967 int failure, alert; 889 int failure, alert;
968 CBB cbb; 890 CBB cbb;
@@ -977,11 +899,14 @@ test_tlsext_ecpf_client(void)
977 if ((ssl = SSL_new(ssl_ctx)) == NULL) 899 if ((ssl = SSL_new(ssl_ctx)) == NULL)
978 errx(1, "failed to create SSL"); 900 errx(1, "failed to create SSL");
979 901
902 if (!tls_extension_funcs(TLSEXT_TYPE_ec_point_formats, &client_funcs,
903 &server_funcs))
904 errx(1, "failed to fetch ecpf funcs");
905
980 /* 906 /*
981 * Default ciphers include EC so we need it by default. 907 * Default ciphers include EC so we need it by default.
982 */ 908 */
983 if (!tls_extension_client_needs(TLSEXT_TYPE_ec_point_formats, ssl, 909 if (!client_funcs->needs(ssl, SSL_TLSEXT_MSG_CH)) {
984 SSL_TLSEXT_MSG_CH)) {
985 FAIL("client should need ECPointFormats for default " 910 FAIL("client should need ECPointFormats for default "
986 "ciphers\n"); 911 "ciphers\n");
987 goto err; 912 goto err;
@@ -994,8 +919,7 @@ test_tlsext_ecpf_client(void)
994 FAIL("client should be able to set cipher list\n"); 919 FAIL("client should be able to set cipher list\n");
995 goto err; 920 goto err;
996 } 921 }
997 if (tls_extension_client_needs(TLSEXT_TYPE_ec_point_formats, ssl, 922 if (client_funcs->needs(ssl, SSL_TLSEXT_MSG_CH)) {
998 SSL_TLSEXT_MSG_CH)) {
999 FAIL("client should not need ECPointFormats\n"); 923 FAIL("client should not need ECPointFormats\n");
1000 goto err; 924 goto err;
1001 } 925 }
@@ -1007,8 +931,7 @@ test_tlsext_ecpf_client(void)
1007 FAIL("client should be able to set cipher list\n"); 931 FAIL("client should be able to set cipher list\n");
1008 goto err; 932 goto err;
1009 } 933 }
1010 if (!tls_extension_client_needs(TLSEXT_TYPE_ec_point_formats, ssl, 934 if (!client_funcs->needs(ssl, SSL_TLSEXT_MSG_CH)) {
1011 SSL_TLSEXT_MSG_CH)) {
1012 FAIL("client should need ECPointFormats\n"); 935 FAIL("client should need ECPointFormats\n");
1013 goto err; 936 goto err;
1014 } 937 }
@@ -1019,8 +942,7 @@ test_tlsext_ecpf_client(void)
1019 if ((ssl->session = SSL_SESSION_new()) == NULL) 942 if ((ssl->session = SSL_SESSION_new()) == NULL)
1020 errx(1, "failed to create session"); 943 errx(1, "failed to create session");
1021 944
1022 if (!tls_extension_client_build(TLSEXT_TYPE_ec_point_formats, ssl, 945 if (!client_funcs->build(ssl, SSL_TLSEXT_MSG_CH, &cbb)) {
1023 SSL_TLSEXT_MSG_CH, &cbb)) {
1024 FAIL("client failed to build ECPointFormats\n"); 946 FAIL("client failed to build ECPointFormats\n");
1025 goto err; 947 goto err;
1026 } 948 }
@@ -1058,8 +980,7 @@ test_tlsext_ecpf_client(void)
1058 980
1059 CBS_init(&cbs, tlsext_ecpf_hello_uncompressed, 981 CBS_init(&cbs, tlsext_ecpf_hello_uncompressed,
1060 sizeof(tlsext_ecpf_hello_uncompressed)); 982 sizeof(tlsext_ecpf_hello_uncompressed));
1061 if (!tls_extension_server_parse(TLSEXT_TYPE_ec_point_formats, ssl, 983 if (!server_funcs->parse(ssl, SSL_TLSEXT_MSG_CH, &cbs, &alert)) {
1062 SSL_TLSEXT_MSG_CH, &cbs, &alert)) {
1063 FAIL("failed to parse client ECPointFormats\n"); 984 FAIL("failed to parse client ECPointFormats\n");
1064 goto err; 985 goto err;
1065 } 986 }
@@ -1103,15 +1024,13 @@ test_tlsext_ecpf_client(void)
1103 ssl->internal->tlsext_ecpointformatlist[2] = TLSEXT_ECPOINTFORMAT_ansiX962_compressed_char2; 1024 ssl->internal->tlsext_ecpointformatlist[2] = TLSEXT_ECPOINTFORMAT_ansiX962_compressed_char2;
1104 ssl->internal->tlsext_ecpointformatlist_length = 3; 1025 ssl->internal->tlsext_ecpointformatlist_length = 3;
1105 1026
1106 if (!tls_extension_client_needs(TLSEXT_TYPE_ec_point_formats, ssl, 1027 if (!client_funcs->needs(ssl, SSL_TLSEXT_MSG_CH)) {
1107 SSL_TLSEXT_MSG_CH)) {
1108 FAIL("client should need ECPointFormats with a custom " 1028 FAIL("client should need ECPointFormats with a custom "
1109 "format\n"); 1029 "format\n");
1110 goto err; 1030 goto err;
1111 } 1031 }
1112 1032
1113 if (!tls_extension_client_build(TLSEXT_TYPE_ec_point_formats, ssl, 1033 if (!client_funcs->build(ssl, SSL_TLSEXT_MSG_CH, &cbb)) {
1114 SSL_TLSEXT_MSG_CH, &cbb)) {
1115 FAIL("client failed to build ECPointFormats\n"); 1034 FAIL("client failed to build ECPointFormats\n");
1116 goto err; 1035 goto err;
1117 } 1036 }
@@ -1154,8 +1073,7 @@ test_tlsext_ecpf_client(void)
1154 1073
1155 CBS_init(&cbs, tlsext_ecpf_hello_prefer_order, 1074 CBS_init(&cbs, tlsext_ecpf_hello_prefer_order,
1156 sizeof(tlsext_ecpf_hello_prefer_order)); 1075 sizeof(tlsext_ecpf_hello_prefer_order));
1157 if (!tls_extension_server_parse(TLSEXT_TYPE_ec_point_formats, ssl, 1076 if (!server_funcs->parse(ssl, SSL_TLSEXT_MSG_CH, &cbs, &alert)) {
1158 SSL_TLSEXT_MSG_CH, &cbs, &alert)) {
1159 FAIL("failed to parse client ECPointFormats\n"); 1077 FAIL("failed to parse client ECPointFormats\n");
1160 goto err; 1078 goto err;
1161 } 1079 }
@@ -1196,6 +1114,8 @@ test_tlsext_ecpf_server(void)
1196 uint8_t *data = NULL; 1114 uint8_t *data = NULL;
1197 SSL_CTX *ssl_ctx = NULL; 1115 SSL_CTX *ssl_ctx = NULL;
1198 SSL *ssl = NULL; 1116 SSL *ssl = NULL;
1117 const struct tls_extension_funcs *client_funcs;
1118 const struct tls_extension_funcs *server_funcs;
1199 size_t dlen; 1119 size_t dlen;
1200 int failure, alert; 1120 int failure, alert;
1201 CBB cbb; 1121 CBB cbb;
@@ -1210,6 +1130,10 @@ test_tlsext_ecpf_server(void)
1210 if ((ssl = SSL_new(ssl_ctx)) == NULL) 1130 if ((ssl = SSL_new(ssl_ctx)) == NULL)
1211 errx(1, "failed to create SSL"); 1131 errx(1, "failed to create SSL");
1212 1132
1133 if (!tls_extension_funcs(TLSEXT_TYPE_ec_point_formats, &client_funcs,
1134 &server_funcs))
1135 errx(1, "failed to fetch ecpf funcs");
1136
1213 if ((ssl->session = SSL_SESSION_new()) == NULL) 1137 if ((ssl->session = SSL_SESSION_new()) == NULL)
1214 errx(1, "failed to create session"); 1138 errx(1, "failed to create session");
1215 1139
@@ -1228,7 +1152,7 @@ test_tlsext_ecpf_server(void)
1228 ssl->session->tlsext_ecpointformatlist[0] = TLSEXT_ECPOINTFORMAT_ansiX962_compressed_prime; 1152 ssl->session->tlsext_ecpointformatlist[0] = TLSEXT_ECPOINTFORMAT_ansiX962_compressed_prime;
1229 ssl->session->tlsext_ecpointformatlist_length = 1; 1153 ssl->session->tlsext_ecpointformatlist_length = 1;
1230 1154
1231 if (!tls_extension_server_needs(TLSEXT_TYPE_ec_point_formats, ssl, SSL_TLSEXT_MSG_SH)) { 1155 if (!server_funcs->needs(ssl, SSL_TLSEXT_MSG_SH)) {
1232 FAIL("server should need ECPointFormats now\n"); 1156 FAIL("server should need ECPointFormats now\n");
1233 goto err; 1157 goto err;
1234 } 1158 }
@@ -1237,8 +1161,7 @@ test_tlsext_ecpf_server(void)
1237 * The server will ignore the session list and use either a custom 1161 * The server will ignore the session list and use either a custom
1238 * list or the default (uncompressed). 1162 * list or the default (uncompressed).
1239 */ 1163 */
1240 if (!tls_extension_server_build(TLSEXT_TYPE_ec_point_formats, ssl, 1164 if (!server_funcs->build(ssl, SSL_TLSEXT_MSG_SH, &cbb)) {
1241 SSL_TLSEXT_MSG_SH, &cbb)) {
1242 FAIL("server failed to build ECPointFormats\n"); 1165 FAIL("server failed to build ECPointFormats\n");
1243 goto err; 1166 goto err;
1244 } 1167 }
@@ -1276,8 +1199,7 @@ test_tlsext_ecpf_server(void)
1276 1199
1277 CBS_init(&cbs, tlsext_ecpf_hello_prime, 1200 CBS_init(&cbs, tlsext_ecpf_hello_prime,
1278 sizeof(tlsext_ecpf_hello_prime)); 1201 sizeof(tlsext_ecpf_hello_prime));
1279 if (tls_extension_client_parse(TLSEXT_TYPE_ec_point_formats, ssl, 1202 if (client_funcs->parse(ssl, SSL_TLSEXT_MSG_SH, &cbs, &alert)) {
1280 SSL_TLSEXT_MSG_SH, &cbs, &alert)) {
1281 FAIL("must include uncompressed in server ECPointFormats\n"); 1203 FAIL("must include uncompressed in server ECPointFormats\n");
1282 goto err; 1204 goto err;
1283 } 1205 }
@@ -1317,13 +1239,12 @@ test_tlsext_ecpf_server(void)
1317 ssl->internal->tlsext_ecpointformatlist[2] = TLSEXT_ECPOINTFORMAT_ansiX962_compressed_char2; 1239 ssl->internal->tlsext_ecpointformatlist[2] = TLSEXT_ECPOINTFORMAT_ansiX962_compressed_char2;
1318 ssl->internal->tlsext_ecpointformatlist_length = 3; 1240 ssl->internal->tlsext_ecpointformatlist_length = 3;
1319 1241
1320 if (!tls_extension_server_needs(TLSEXT_TYPE_ec_point_formats, ssl, SSL_TLSEXT_MSG_SH)) { 1242 if (!server_funcs->needs(ssl, SSL_TLSEXT_MSG_SH)) {
1321 FAIL("server should need ECPointFormats\n"); 1243 FAIL("server should need ECPointFormats\n");
1322 goto err; 1244 goto err;
1323 } 1245 }
1324 1246
1325 if (!tls_extension_server_build(TLSEXT_TYPE_ec_point_formats, ssl, 1247 if (!server_funcs->build(ssl, SSL_TLSEXT_MSG_SH, &cbb)) {
1326 SSL_TLSEXT_MSG_SH, &cbb)) {
1327 FAIL("server failed to build ECPointFormats\n"); 1248 FAIL("server failed to build ECPointFormats\n");
1328 goto err; 1249 goto err;
1329 } 1250 }
@@ -1366,8 +1287,7 @@ test_tlsext_ecpf_server(void)
1366 1287
1367 CBS_init(&cbs, tlsext_ecpf_hello_prefer_order, 1288 CBS_init(&cbs, tlsext_ecpf_hello_prefer_order,
1368 sizeof(tlsext_ecpf_hello_prefer_order)); 1289 sizeof(tlsext_ecpf_hello_prefer_order));
1369 if (!tls_extension_client_parse(TLSEXT_TYPE_ec_point_formats, ssl, 1290 if (!client_funcs->parse(ssl, SSL_TLSEXT_MSG_SH, &cbs, &alert)) {
1370 SSL_TLSEXT_MSG_SH, &cbs, &alert)) {
1371 FAIL("failed to parse server ECPointFormats\n"); 1291 FAIL("failed to parse server ECPointFormats\n");
1372 goto err; 1292 goto err;
1373 } 1293 }
@@ -1435,6 +1355,8 @@ test_tlsext_ri_client(void)
1435 unsigned char *data = NULL; 1355 unsigned char *data = NULL;
1436 SSL_CTX *ssl_ctx = NULL; 1356 SSL_CTX *ssl_ctx = NULL;
1437 SSL *ssl = NULL; 1357 SSL *ssl = NULL;
1358 const struct tls_extension_funcs *client_funcs;
1359 const struct tls_extension_funcs *server_funcs;
1438 int failure; 1360 int failure;
1439 size_t dlen; 1361 size_t dlen;
1440 int alert; 1362 int alert;
@@ -1450,8 +1372,11 @@ test_tlsext_ri_client(void)
1450 if ((ssl = SSL_new(ssl_ctx)) == NULL) 1372 if ((ssl = SSL_new(ssl_ctx)) == NULL)
1451 errx(1, "failed to create SSL"); 1373 errx(1, "failed to create SSL");
1452 1374
1453 if (tls_extension_client_needs(TLSEXT_TYPE_renegotiate, ssl, 1375 if (!tls_extension_funcs(TLSEXT_TYPE_renegotiate, &client_funcs,
1454 SSL_TLSEXT_MSG_CH)) { 1376 &server_funcs))
1377 errx(1, "failed to fetch ri funcs");
1378
1379 if (client_funcs->needs(ssl, SSL_TLSEXT_MSG_CH)) {
1455 FAIL("client should not need RI\n"); 1380 FAIL("client should not need RI\n");
1456 goto err; 1381 goto err;
1457 } 1382 }
@@ -1461,8 +1386,7 @@ test_tlsext_ri_client(void)
1461 goto err; 1386 goto err;
1462 } 1387 }
1463 1388
1464 if (!tls_extension_client_needs(TLSEXT_TYPE_renegotiate, ssl, 1389 if (!client_funcs->needs(ssl, SSL_TLSEXT_MSG_CH)) {
1465 SSL_TLSEXT_MSG_CH)) {
1466 FAIL("client should need RI\n"); 1390 FAIL("client should need RI\n");
1467 goto err; 1391 goto err;
1468 } 1392 }
@@ -1473,8 +1397,7 @@ test_tlsext_ri_client(void)
1473 1397
1474 ssl->s3->renegotiate_seen = 0; 1398 ssl->s3->renegotiate_seen = 0;
1475 1399
1476 if (!tls_extension_client_build(TLSEXT_TYPE_renegotiate, ssl, 1400 if (!client_funcs->build(ssl, SSL_TLSEXT_MSG_CH, &cbb)) {
1477 SSL_TLSEXT_MSG_CH, &cbb)) {
1478 FAIL("client failed to build RI\n"); 1401 FAIL("client failed to build RI\n");
1479 goto err; 1402 goto err;
1480 } 1403 }
@@ -1498,8 +1421,7 @@ test_tlsext_ri_client(void)
1498 } 1421 }
1499 1422
1500 CBS_init(&cbs, tlsext_ri_client, sizeof(tlsext_ri_client)); 1423 CBS_init(&cbs, tlsext_ri_client, sizeof(tlsext_ri_client));
1501 if (!tls_extension_server_parse(TLSEXT_TYPE_renegotiate, ssl, 1424 if (!server_funcs->parse(ssl, SSL_TLSEXT_MSG_CH, &cbs, &alert)) {
1502 SSL_TLSEXT_MSG_CH, &cbs, &alert)) {
1503 FAIL("failed to parse client RI\n"); 1425 FAIL("failed to parse client RI\n");
1504 goto err; 1426 goto err;
1505 } 1427 }
@@ -1523,8 +1445,7 @@ test_tlsext_ri_client(void)
1523 ssl->s3->renegotiate_seen = 0; 1445 ssl->s3->renegotiate_seen = 0;
1524 1446
1525 CBS_init(&cbs, tlsext_ri_client, sizeof(tlsext_ri_client)); 1447 CBS_init(&cbs, tlsext_ri_client, sizeof(tlsext_ri_client));
1526 if (tls_extension_server_parse(TLSEXT_TYPE_renegotiate, ssl, 1448 if (server_funcs->parse(ssl, SSL_TLSEXT_MSG_CH, &cbs, &alert)) {
1527 SSL_TLSEXT_MSG_CH, &cbs, &alert)) {
1528 FAIL("parsed invalid client RI\n"); 1449 FAIL("parsed invalid client RI\n");
1529 failure = 1; 1450 failure = 1;
1530 goto err; 1451 goto err;
@@ -1552,6 +1473,8 @@ test_tlsext_ri_server(void)
1552 unsigned char *data = NULL; 1473 unsigned char *data = NULL;
1553 SSL_CTX *ssl_ctx = NULL; 1474 SSL_CTX *ssl_ctx = NULL;
1554 SSL *ssl = NULL; 1475 SSL *ssl = NULL;
1476 const struct tls_extension_funcs *client_funcs;
1477 const struct tls_extension_funcs *server_funcs;
1555 int failure; 1478 int failure;
1556 size_t dlen; 1479 size_t dlen;
1557 int alert; 1480 int alert;
@@ -1567,17 +1490,19 @@ test_tlsext_ri_server(void)
1567 if ((ssl = SSL_new(ssl_ctx)) == NULL) 1490 if ((ssl = SSL_new(ssl_ctx)) == NULL)
1568 errx(1, "failed to create SSL"); 1491 errx(1, "failed to create SSL");
1569 1492
1493 if (!tls_extension_funcs(TLSEXT_TYPE_renegotiate, &client_funcs,
1494 &server_funcs))
1495 errx(1, "failed to fetch ri funcs");
1496
1570 ssl->version = TLS1_2_VERSION; 1497 ssl->version = TLS1_2_VERSION;
1571 if (tls_extension_server_needs(TLSEXT_TYPE_renegotiate, ssl, 1498 if (server_funcs->needs(ssl, SSL_TLSEXT_MSG_SH)) {
1572 SSL_TLSEXT_MSG_SH)) {
1573 FAIL("server should not need RI\n"); 1499 FAIL("server should not need RI\n");
1574 goto err; 1500 goto err;
1575 } 1501 }
1576 1502
1577 ssl->s3->send_connection_binding = 1; 1503 ssl->s3->send_connection_binding = 1;
1578 1504
1579 if (!tls_extension_server_needs(TLSEXT_TYPE_renegotiate, ssl, 1505 if (!server_funcs->needs(ssl, SSL_TLSEXT_MSG_SH)) {
1580 SSL_TLSEXT_MSG_SH)) {
1581 FAIL("server should need RI\n"); 1506 FAIL("server should need RI\n");
1582 goto err; 1507 goto err;
1583 } 1508 }
@@ -1592,8 +1517,7 @@ test_tlsext_ri_server(void)
1592 1517
1593 ssl->s3->renegotiate_seen = 0; 1518 ssl->s3->renegotiate_seen = 0;
1594 1519
1595 if (!tls_extension_server_build(TLSEXT_TYPE_renegotiate, ssl, 1520 if (!server_funcs->build(ssl, SSL_TLSEXT_MSG_SH, &cbb)) {
1596 SSL_TLSEXT_MSG_SH, &cbb)) {
1597 FAIL("server failed to build RI\n"); 1521 FAIL("server failed to build RI\n");
1598 goto err; 1522 goto err;
1599 } 1523 }
@@ -1617,8 +1541,7 @@ test_tlsext_ri_server(void)
1617 } 1541 }
1618 1542
1619 CBS_init(&cbs, tlsext_ri_server, sizeof(tlsext_ri_server)); 1543 CBS_init(&cbs, tlsext_ri_server, sizeof(tlsext_ri_server));
1620 if (!tls_extension_client_parse(TLSEXT_TYPE_renegotiate, ssl, 1544 if (!client_funcs->parse(ssl, SSL_TLSEXT_MSG_SH, &cbs, &alert)) {
1621 SSL_TLSEXT_MSG_SH, &cbs, &alert)) {
1622 FAIL("failed to parse server RI\n"); 1545 FAIL("failed to parse server RI\n");
1623 goto err; 1546 goto err;
1624 } 1547 }
@@ -1644,8 +1567,7 @@ test_tlsext_ri_server(void)
1644 ssl->s3->renegotiate_seen = 0; 1567 ssl->s3->renegotiate_seen = 0;
1645 1568
1646 CBS_init(&cbs, tlsext_ri_server, sizeof(tlsext_ri_server)); 1569 CBS_init(&cbs, tlsext_ri_server, sizeof(tlsext_ri_server));
1647 if (tls_extension_client_parse(TLSEXT_TYPE_renegotiate, ssl, 1570 if (client_funcs->parse(ssl, SSL_TLSEXT_MSG_SH, &cbs, &alert)) {
1648 SSL_TLSEXT_MSG_SH, &cbs, &alert)) {
1649 FAIL("parsed invalid server RI\n"); 1571 FAIL("parsed invalid server RI\n");
1650 goto err; 1572 goto err;
1651 } 1573 }
@@ -1682,6 +1604,8 @@ test_tlsext_sigalgs_client(void)
1682 unsigned char *data = NULL; 1604 unsigned char *data = NULL;
1683 SSL_CTX *ssl_ctx = NULL; 1605 SSL_CTX *ssl_ctx = NULL;
1684 SSL *ssl = NULL; 1606 SSL *ssl = NULL;
1607 const struct tls_extension_funcs *client_funcs;
1608 const struct tls_extension_funcs *server_funcs;
1685 int failure = 0; 1609 int failure = 0;
1686 size_t dlen; 1610 size_t dlen;
1687 int alert; 1611 int alert;
@@ -1695,10 +1619,13 @@ test_tlsext_sigalgs_client(void)
1695 if ((ssl = SSL_new(ssl_ctx)) == NULL) 1619 if ((ssl = SSL_new(ssl_ctx)) == NULL)
1696 errx(1, "failed to create SSL"); 1620 errx(1, "failed to create SSL");
1697 1621
1622 if (!tls_extension_funcs(TLSEXT_TYPE_signature_algorithms,
1623 &client_funcs, &server_funcs))
1624 errx(1, "failed to fetch sigalgs funcs");
1625
1698 ssl->s3->hs.our_max_tls_version = TLS1_1_VERSION; 1626 ssl->s3->hs.our_max_tls_version = TLS1_1_VERSION;
1699 1627
1700 if (tls_extension_client_needs(TLSEXT_TYPE_signature_algorithms, ssl, 1628 if (client_funcs->needs(ssl, SSL_TLSEXT_MSG_CH)) {
1701 SSL_TLSEXT_MSG_CH)) {
1702 fprintf(stderr, "FAIL: client should not need sigalgs\n"); 1629 fprintf(stderr, "FAIL: client should not need sigalgs\n");
1703 failure = 1; 1630 failure = 1;
1704 goto done; 1631 goto done;
@@ -1706,15 +1633,13 @@ test_tlsext_sigalgs_client(void)
1706 1633
1707 ssl->s3->hs.our_max_tls_version = TLS1_2_VERSION; 1634 ssl->s3->hs.our_max_tls_version = TLS1_2_VERSION;
1708 1635
1709 if (!tls_extension_client_needs(TLSEXT_TYPE_signature_algorithms, ssl, 1636 if (!client_funcs->needs(ssl, SSL_TLSEXT_MSG_CH)) {
1710 SSL_TLSEXT_MSG_CH)) {
1711 fprintf(stderr, "FAIL: client should need sigalgsn"); 1637 fprintf(stderr, "FAIL: client should need sigalgsn");
1712 failure = 1; 1638 failure = 1;
1713 goto done; 1639 goto done;
1714 } 1640 }
1715 1641
1716 if (!tls_extension_client_build(TLSEXT_TYPE_signature_algorithms, ssl, 1642 if (!client_funcs->build(ssl, SSL_TLSEXT_MSG_CH, &cbb)) {
1717 SSL_TLSEXT_MSG_CH, &cbb)) {
1718 fprintf(stderr, "FAIL: client failed to build sigalgsn"); 1643 fprintf(stderr, "FAIL: client failed to build sigalgsn");
1719 failure = 1; 1644 failure = 1;
1720 goto done; 1645 goto done;
@@ -1741,8 +1666,7 @@ test_tlsext_sigalgs_client(void)
1741 } 1666 }
1742 1667
1743 CBS_init(&cbs, tlsext_sigalgs_client, sizeof(tlsext_sigalgs_client)); 1668 CBS_init(&cbs, tlsext_sigalgs_client, sizeof(tlsext_sigalgs_client));
1744 if (!tls_extension_server_parse(TLSEXT_TYPE_signature_algorithms, ssl, 1669 if (!server_funcs->parse(ssl, SSL_TLSEXT_MSG_CH, &cbs, &alert)) {
1745 SSL_TLSEXT_MSG_CH, &cbs, &alert)) {
1746 fprintf(stderr, "FAIL: failed to parse client SNI\n"); 1670 fprintf(stderr, "FAIL: failed to parse client SNI\n");
1747 failure = 1; 1671 failure = 1;
1748 goto done; 1672 goto done;
@@ -1768,6 +1692,8 @@ test_tlsext_sigalgs_server(void)
1768 unsigned char *data = NULL; 1692 unsigned char *data = NULL;
1769 SSL_CTX *ssl_ctx = NULL; 1693 SSL_CTX *ssl_ctx = NULL;
1770 SSL *ssl = NULL; 1694 SSL *ssl = NULL;
1695 const struct tls_extension_funcs *client_funcs;
1696 const struct tls_extension_funcs *server_funcs;
1771 int failure = 0; 1697 int failure = 0;
1772 size_t dlen; 1698 size_t dlen;
1773 int alert; 1699 int alert;
@@ -1781,13 +1707,17 @@ test_tlsext_sigalgs_server(void)
1781 if ((ssl = SSL_new(ssl_ctx)) == NULL) 1707 if ((ssl = SSL_new(ssl_ctx)) == NULL)
1782 errx(1, "failed to create SSL"); 1708 errx(1, "failed to create SSL");
1783 1709
1784 if (tls_extension_server_needs(sigalgs, ssl, SSL_TLSEXT_MSG_SH)) { 1710 if (!tls_extension_funcs(TLSEXT_TYPE_server_name, &client_funcs,
1711 &server_funcs))
1712 errx(1, "failed to fetch sigalgs funcs");
1713
1714 if (server_funcs->needs(ssl, SSL_TLSEXT_MSG_SH)) {
1785 fprintf(stderr, "FAIL: server should not need sigalgs\n"); 1715 fprintf(stderr, "FAIL: server should not need sigalgs\n");
1786 failure = 1; 1716 failure = 1;
1787 goto done; 1717 goto done;
1788 } 1718 }
1789 1719
1790 if (tls_extension_server_build(sigalgs, ssl, SSL_TLSEXT_MSG_SH, &cbb)) { 1720 if (server_funcs->build(ssl, SSL_TLSEXT_MSG_SH, &cbb)) {
1791 fprintf(stderr, "FAIL: server should not build sigalgs\n"); 1721 fprintf(stderr, "FAIL: server should not build sigalgs\n");
1792 failure = 1; 1722 failure = 1;
1793 goto done; 1723 goto done;
@@ -1797,8 +1727,7 @@ test_tlsext_sigalgs_server(void)
1797 errx(1, "failed to finish CBB"); 1727 errx(1, "failed to finish CBB");
1798 1728
1799 CBS_init(&cbs, tlsext_sigalgs_client, sizeof(tlsext_sigalgs_client)); 1729 CBS_init(&cbs, tlsext_sigalgs_client, sizeof(tlsext_sigalgs_client));
1800 if (tls_extension_client_parse(sigalgs, ssl, SSL_TLSEXT_MSG_SH, &cbs, 1730 if (client_funcs->parse(ssl, SSL_TLSEXT_MSG_SH, &cbs, &alert)) {
1801 &alert)) {
1802 fprintf(stderr, "FAIL: server should not parse sigalgs\n"); 1731 fprintf(stderr, "FAIL: server should not parse sigalgs\n");
1803 failure = 1; 1732 failure = 1;
1804 goto done; 1733 goto done;
@@ -1835,6 +1764,8 @@ test_tlsext_sni_client(void)
1835 unsigned char *data = NULL; 1764 unsigned char *data = NULL;
1836 SSL_CTX *ssl_ctx = NULL; 1765 SSL_CTX *ssl_ctx = NULL;
1837 SSL *ssl = NULL; 1766 SSL *ssl = NULL;
1767 const struct tls_extension_funcs *client_funcs;
1768 const struct tls_extension_funcs *server_funcs;
1838 int failure; 1769 int failure;
1839 size_t dlen; 1770 size_t dlen;
1840 int alert; 1771 int alert;
@@ -1849,10 +1780,13 @@ test_tlsext_sni_client(void)
1849 if ((ssl = SSL_new(ssl_ctx)) == NULL) 1780 if ((ssl = SSL_new(ssl_ctx)) == NULL)
1850 errx(1, "failed to create SSL"); 1781 errx(1, "failed to create SSL");
1851 1782
1783 if (!tls_extension_funcs(TLSEXT_TYPE_server_name, &client_funcs,
1784 &server_funcs))
1785 errx(1, "failed to fetch sni funcs");
1786
1852 CBB_init(&cbb, 0); 1787 CBB_init(&cbb, 0);
1853 1788
1854 if (tls_extension_client_needs(TLSEXT_TYPE_server_name, ssl, 1789 if (client_funcs->needs(ssl, SSL_TLSEXT_MSG_CH)) {
1855 SSL_TLSEXT_MSG_CH)) {
1856 FAIL("client should not need SNI\n"); 1790 FAIL("client should not need SNI\n");
1857 goto err; 1791 goto err;
1858 } 1792 }
@@ -1862,14 +1796,12 @@ test_tlsext_sni_client(void)
1862 goto err; 1796 goto err;
1863 } 1797 }
1864 1798
1865 if (!tls_extension_client_needs(TLSEXT_TYPE_server_name, ssl, 1799 if (!client_funcs->needs(ssl, SSL_TLSEXT_MSG_CH)) {
1866 SSL_TLSEXT_MSG_CH)) {
1867 FAIL("client should need SNI\n"); 1800 FAIL("client should need SNI\n");
1868 goto err; 1801 goto err;
1869 } 1802 }
1870 1803
1871 if (!tls_extension_client_build(TLSEXT_TYPE_server_name, ssl, 1804 if (!client_funcs->build(ssl, SSL_TLSEXT_MSG_CH, &cbb)) {
1872 SSL_TLSEXT_MSG_CH, &cbb)) {
1873 FAIL("client failed to build SNI\n"); 1805 FAIL("client failed to build SNI\n");
1874 goto err; 1806 goto err;
1875 } 1807 }
@@ -1903,8 +1835,7 @@ test_tlsext_sni_client(void)
1903 goto err; 1835 goto err;
1904 } 1836 }
1905 1837
1906 if (tls_extension_client_needs(TLSEXT_TYPE_server_name, ssl, 1838 if (client_funcs->needs(ssl, SSL_TLSEXT_MSG_CH)) {
1907 SSL_TLSEXT_MSG_CH)) {
1908 FAIL("client should not need SNI\n"); 1839 FAIL("client should not need SNI\n");
1909 goto err; 1840 goto err;
1910 } 1841 }
@@ -1917,8 +1848,7 @@ test_tlsext_sni_client(void)
1917 ssl->internal->hit = 0; 1848 ssl->internal->hit = 0;
1918 1849
1919 CBS_init(&cbs, tlsext_sni_client, sizeof(tlsext_sni_client)); 1850 CBS_init(&cbs, tlsext_sni_client, sizeof(tlsext_sni_client));
1920 if (!tls_extension_server_parse(TLSEXT_TYPE_server_name, ssl, 1851 if (!server_funcs->parse(ssl, SSL_TLSEXT_MSG_CH, &cbs, &alert)) {
1921 SSL_TLSEXT_MSG_CH, &cbs, &alert)) {
1922 FAIL("failed to parse client SNI\n"); 1852 FAIL("failed to parse client SNI\n");
1923 goto err; 1853 goto err;
1924 } 1854 }
@@ -1950,8 +1880,7 @@ test_tlsext_sni_client(void)
1950 } 1880 }
1951 1881
1952 CBS_init(&cbs, tlsext_sni_client, sizeof(tlsext_sni_client)); 1882 CBS_init(&cbs, tlsext_sni_client, sizeof(tlsext_sni_client));
1953 if (tls_extension_server_parse(TLSEXT_TYPE_server_name, ssl, 1883 if (server_funcs->parse(ssl, SSL_TLSEXT_MSG_CH, &cbs, &alert)) {
1954 SSL_TLSEXT_MSG_CH, &cbs, &alert)) {
1955 FAIL("parsed client with mismatched SNI\n"); 1884 FAIL("parsed client with mismatched SNI\n");
1956 goto err; 1885 goto err;
1957 } 1886 }
@@ -1973,6 +1902,8 @@ test_tlsext_sni_server(void)
1973 unsigned char *data = NULL; 1902 unsigned char *data = NULL;
1974 SSL_CTX *ssl_ctx = NULL; 1903 SSL_CTX *ssl_ctx = NULL;
1975 SSL *ssl = NULL; 1904 SSL *ssl = NULL;
1905 const struct tls_extension_funcs *client_funcs;
1906 const struct tls_extension_funcs *server_funcs;
1976 int failure; 1907 int failure;
1977 size_t dlen; 1908 size_t dlen;
1978 int alert; 1909 int alert;
@@ -1988,11 +1919,14 @@ test_tlsext_sni_server(void)
1988 if ((ssl = SSL_new(ssl_ctx)) == NULL) 1919 if ((ssl = SSL_new(ssl_ctx)) == NULL)
1989 errx(1, "failed to create SSL"); 1920 errx(1, "failed to create SSL");
1990 1921
1922 if (!tls_extension_funcs(TLSEXT_TYPE_server_name, &client_funcs,
1923 &server_funcs))
1924 errx(1, "failed to fetch sni funcs");
1925
1991 if ((ssl->session = SSL_SESSION_new()) == NULL) 1926 if ((ssl->session = SSL_SESSION_new()) == NULL)
1992 errx(1, "failed to create session"); 1927 errx(1, "failed to create session");
1993 1928
1994 if (tls_extension_server_needs(TLSEXT_TYPE_server_name, ssl, 1929 if (server_funcs->needs(ssl, SSL_TLSEXT_MSG_SH)) {
1995 SSL_TLSEXT_MSG_SH)) {
1996 FAIL("server should not need SNI\n"); 1930 FAIL("server should not need SNI\n");
1997 goto err; 1931 goto err;
1998 } 1932 }
@@ -2006,14 +1940,12 @@ test_tlsext_sni_server(void)
2006 NULL) 1940 NULL)
2007 errx(1, "failed to strdup tlsext_hostname"); 1941 errx(1, "failed to strdup tlsext_hostname");
2008 1942
2009 if (!tls_extension_server_needs(TLSEXT_TYPE_server_name, ssl, 1943 if (!server_funcs->needs(ssl, SSL_TLSEXT_MSG_SH)) {
2010 SSL_TLSEXT_MSG_SH)) {
2011 FAIL("server should need SNI\n"); 1944 FAIL("server should need SNI\n");
2012 goto err; 1945 goto err;
2013 } 1946 }
2014 1947
2015 if (!tls_extension_server_build(TLSEXT_TYPE_server_name, ssl, 1948 if (!server_funcs->build(ssl, SSL_TLSEXT_MSG_SH, &cbb)) {
2016 SSL_TLSEXT_MSG_SH, &cbb)) {
2017 FAIL("server failed to build SNI\n"); 1949 FAIL("server failed to build SNI\n");
2018 goto err; 1950 goto err;
2019 } 1951 }
@@ -2040,8 +1972,7 @@ test_tlsext_sni_server(void)
2040 ssl->session->tlsext_hostname = NULL; 1972 ssl->session->tlsext_hostname = NULL;
2041 1973
2042 CBS_init(&cbs, tlsext_sni_server, sizeof(tlsext_sni_server)); 1974 CBS_init(&cbs, tlsext_sni_server, sizeof(tlsext_sni_server));
2043 if (!tls_extension_client_parse(TLSEXT_TYPE_server_name, ssl, 1975 if (!client_funcs->parse(ssl, SSL_TLSEXT_MSG_SH, &cbs, &alert)) {
2044 SSL_TLSEXT_MSG_SH, &cbs, &alert)) {
2045 FAIL("failed to parse server SNI\n"); 1976 FAIL("failed to parse server SNI\n");
2046 goto err; 1977 goto err;
2047 } 1978 }
@@ -2092,6 +2023,8 @@ test_tlsext_quic_transport_parameters_client(void)
2092 unsigned char *data = NULL; 2023 unsigned char *data = NULL;
2093 SSL_CTX *ssl_ctx = NULL; 2024 SSL_CTX *ssl_ctx = NULL;
2094 SSL *ssl = NULL; 2025 SSL *ssl = NULL;
2026 const struct tls_extension_funcs *client_funcs;
2027 const struct tls_extension_funcs *server_funcs;
2095 int failure; 2028 int failure;
2096 size_t dlen; 2029 size_t dlen;
2097 CBB cbb; 2030 CBB cbb;
@@ -2107,10 +2040,13 @@ test_tlsext_quic_transport_parameters_client(void)
2107 if ((ssl = SSL_new(ssl_ctx)) == NULL) 2040 if ((ssl = SSL_new(ssl_ctx)) == NULL)
2108 errx(1, "failed to create SSL"); 2041 errx(1, "failed to create SSL");
2109 2042
2043 if (!tls_extension_funcs(TLSEXT_TYPE_quic_transport_parameters,
2044 &client_funcs, &server_funcs))
2045 errx(1, "failed to fetch quic transport parameter funcs");
2046
2110 CBB_init(&cbb, 0); 2047 CBB_init(&cbb, 0);
2111 2048
2112 if (tls_extension_client_needs(TLSEXT_TYPE_quic_transport_parameters, 2049 if (client_funcs->needs(ssl, SSL_TLSEXT_MSG_CH)) {
2113 ssl, SSL_TLSEXT_MSG_CH)) {
2114 FAIL("client should not need QUIC\n"); 2050 FAIL("client should not need QUIC\n");
2115 goto err; 2051 goto err;
2116 } 2052 }
@@ -2121,8 +2057,7 @@ test_tlsext_quic_transport_parameters_client(void)
2121 goto err; 2057 goto err;
2122 } 2058 }
2123 2059
2124 if (tls_extension_client_needs(TLSEXT_TYPE_quic_transport_parameters, 2060 if (client_funcs->needs(ssl, SSL_TLSEXT_MSG_CH)) {
2125 ssl, SSL_TLSEXT_MSG_CH)) {
2126 FAIL("client should not need QUIC\n"); 2061 FAIL("client should not need QUIC\n");
2127 goto err; 2062 goto err;
2128 } 2063 }
@@ -2130,22 +2065,19 @@ test_tlsext_quic_transport_parameters_client(void)
2130 ssl->s3->hs.our_max_tls_version = TLS1_3_VERSION; 2065 ssl->s3->hs.our_max_tls_version = TLS1_3_VERSION;
2131 ssl->s3->hs.negotiated_tls_version = TLS1_3_VERSION; 2066 ssl->s3->hs.negotiated_tls_version = TLS1_3_VERSION;
2132 2067
2133 if (tls_extension_client_needs(TLSEXT_TYPE_quic_transport_parameters, 2068 if (client_funcs->needs(ssl, SSL_TLSEXT_MSG_CH)) {
2134 ssl, SSL_TLSEXT_MSG_CH)) {
2135 FAIL("client should not need QUIC\n"); 2069 FAIL("client should not need QUIC\n");
2136 goto err; 2070 goto err;
2137 } 2071 }
2138 2072
2139 ssl->quic_method = ssl->method; /* XXX */ 2073 ssl->quic_method = ssl->method; /* XXX */
2140 2074
2141 if (!tls_extension_client_needs(TLSEXT_TYPE_quic_transport_parameters, 2075 if (!client_funcs->needs(ssl, SSL_TLSEXT_MSG_CH)) {
2142 ssl, SSL_TLSEXT_MSG_CH)) {
2143 FAIL("client should need QUIC\n"); 2076 FAIL("client should need QUIC\n");
2144 goto err; 2077 goto err;
2145 } 2078 }
2146 2079
2147 if (!tls_extension_client_build(TLSEXT_TYPE_quic_transport_parameters, 2080 if (!client_funcs->build(ssl, SSL_TLSEXT_MSG_CH, &cbb)) {
2148 ssl, SSL_TLSEXT_MSG_CH, &cbb)) {
2149 FAIL("client failed to build QUIC\n"); 2081 FAIL("client failed to build QUIC\n");
2150 goto err; 2082 goto err;
2151 } 2083 }
@@ -2175,8 +2107,7 @@ test_tlsext_quic_transport_parameters_client(void)
2175 CBS_init(&cbs, tlsext_quic_transport_data, 2107 CBS_init(&cbs, tlsext_quic_transport_data,
2176 sizeof(tlsext_quic_transport_data)); 2108 sizeof(tlsext_quic_transport_data));
2177 2109
2178 if (!tls_extension_server_parse(TLSEXT_TYPE_quic_transport_parameters, 2110 if (!server_funcs->parse(ssl, SSL_TLSEXT_MSG_SH, &cbs, &alert)) {
2179 ssl, SSL_TLSEXT_MSG_SH, &cbs, &alert)) {
2180 FAIL("server_parse of QUIC from server failed\n"); 2111 FAIL("server_parse of QUIC from server failed\n");
2181 goto err; 2112 goto err;
2182 } 2113 }
@@ -2222,6 +2153,8 @@ test_tlsext_quic_transport_parameters_server(void)
2222 unsigned char *data = NULL; 2153 unsigned char *data = NULL;
2223 SSL_CTX *ssl_ctx = NULL; 2154 SSL_CTX *ssl_ctx = NULL;
2224 SSL *ssl = NULL; 2155 SSL *ssl = NULL;
2156 const struct tls_extension_funcs *client_funcs;
2157 const struct tls_extension_funcs *server_funcs;
2225 int failure; 2158 int failure;
2226 size_t dlen; 2159 size_t dlen;
2227 int alert; 2160 int alert;
@@ -2239,8 +2172,11 @@ test_tlsext_quic_transport_parameters_server(void)
2239 if ((ssl = SSL_new(ssl_ctx)) == NULL) 2172 if ((ssl = SSL_new(ssl_ctx)) == NULL)
2240 errx(1, "failed to create SSL"); 2173 errx(1, "failed to create SSL");
2241 2174
2242 if (tls_extension_server_needs(TLSEXT_TYPE_quic_transport_parameters, 2175 if (!tls_extension_funcs(TLSEXT_TYPE_quic_transport_parameters,
2243 ssl, SSL_TLSEXT_MSG_SH)) { 2176 &client_funcs, &server_funcs))
2177 errx(1, "failed to fetch quic transport parameter funcs");
2178
2179 if (server_funcs->needs(ssl, SSL_TLSEXT_MSG_SH)) {
2244 FAIL("server should not need QUIC\n"); 2180 FAIL("server should not need QUIC\n");
2245 goto err; 2181 goto err;
2246 } 2182 }
@@ -2251,22 +2187,19 @@ test_tlsext_quic_transport_parameters_server(void)
2251 goto err; 2187 goto err;
2252 } 2188 }
2253 2189
2254 if (tls_extension_server_needs(TLSEXT_TYPE_quic_transport_parameters, 2190 if (server_funcs->needs(ssl, SSL_TLSEXT_MSG_EE)) {
2255 ssl, SSL_TLSEXT_MSG_EE)) {
2256 FAIL("server should not need QUIC\n"); 2191 FAIL("server should not need QUIC\n");
2257 goto err; 2192 goto err;
2258 } 2193 }
2259 2194
2260 ssl->quic_method = ssl->method; /* XXX */ 2195 ssl->quic_method = ssl->method; /* XXX */
2261 2196
2262 if (!tls_extension_server_needs(TLSEXT_TYPE_quic_transport_parameters, 2197 if (!server_funcs->needs(ssl, SSL_TLSEXT_MSG_EE)) {
2263 ssl, SSL_TLSEXT_MSG_EE)) {
2264 FAIL("server should need QUIC\n"); 2198 FAIL("server should need QUIC\n");
2265 goto err; 2199 goto err;
2266 } 2200 }
2267 2201
2268 if (!tls_extension_server_build(TLSEXT_TYPE_quic_transport_parameters, 2202 if (!server_funcs->build(ssl, SSL_TLSEXT_MSG_EE, &cbb)) {
2269 ssl, SSL_TLSEXT_MSG_EE, &cbb)) {
2270 FAIL("server failed to build QUIC\n"); 2203 FAIL("server failed to build QUIC\n");
2271 goto err; 2204 goto err;
2272 } 2205 }
@@ -2295,16 +2228,14 @@ test_tlsext_quic_transport_parameters_server(void)
2295 2228
2296 ssl->quic_method = NULL; 2229 ssl->quic_method = NULL;
2297 2230
2298 if (tls_extension_client_parse(TLSEXT_TYPE_quic_transport_parameters, 2231 if (client_funcs->parse(ssl, SSL_TLSEXT_MSG_EE, &cbs, &alert)) {
2299 ssl, SSL_TLSEXT_MSG_EE, &cbs, &alert)) {
2300 FAIL("QUIC parse should have failed!\n"); 2232 FAIL("QUIC parse should have failed!\n");
2301 goto err; 2233 goto err;
2302 } 2234 }
2303 2235
2304 ssl->quic_method = ssl->method; /* XXX */ 2236 ssl->quic_method = ssl->method; /* XXX */
2305 2237
2306 if (!tls_extension_client_parse(TLSEXT_TYPE_quic_transport_parameters, 2238 if (!client_funcs->parse(ssl, SSL_TLSEXT_MSG_SH, &cbs, &alert)) {
2307 ssl, SSL_TLSEXT_MSG_SH, &cbs, &alert)) {
2308 FAIL("client_parse of QUIC from server failed\n"); 2239 FAIL("client_parse of QUIC from server failed\n");
2309 goto err; 2240 goto err;
2310 } 2241 }
@@ -2353,6 +2284,8 @@ test_tlsext_ocsp_client(void)
2353 unsigned char *data = NULL; 2284 unsigned char *data = NULL;
2354 SSL_CTX *ssl_ctx = NULL; 2285 SSL_CTX *ssl_ctx = NULL;
2355 SSL *ssl = NULL; 2286 SSL *ssl = NULL;
2287 const struct tls_extension_funcs *client_funcs;
2288 const struct tls_extension_funcs *server_funcs;
2356 size_t dlen; 2289 size_t dlen;
2357 int failure; 2290 int failure;
2358 int alert; 2291 int alert;
@@ -2368,20 +2301,21 @@ test_tlsext_ocsp_client(void)
2368 if ((ssl = SSL_new(ssl_ctx)) == NULL) 2301 if ((ssl = SSL_new(ssl_ctx)) == NULL)
2369 errx(1, "failed to create SSL"); 2302 errx(1, "failed to create SSL");
2370 2303
2371 if (tls_extension_client_needs(TLSEXT_TYPE_status_request, ssl, 2304 if (!tls_extension_funcs(TLSEXT_TYPE_status_request, &client_funcs,
2372 SSL_TLSEXT_MSG_CH)) { 2305 &server_funcs))
2306 errx(1, "failed to fetch ocsp funcs");
2307
2308 if (client_funcs->needs(ssl, SSL_TLSEXT_MSG_CH)) {
2373 FAIL("client should not need TLSEXT_TYPE_status_request\n"); 2309 FAIL("client should not need TLSEXT_TYPE_status_request\n");
2374 goto err; 2310 goto err;
2375 } 2311 }
2376 SSL_set_tlsext_status_type(ssl, TLSEXT_STATUSTYPE_ocsp); 2312 SSL_set_tlsext_status_type(ssl, TLSEXT_STATUSTYPE_ocsp);
2377 2313
2378 if (!tls_extension_client_needs(TLSEXT_TYPE_status_request, ssl, 2314 if (!client_funcs->needs(ssl, SSL_TLSEXT_MSG_CH)) {
2379 SSL_TLSEXT_MSG_CH)) {
2380 FAIL("client should need TLSEXT_TYPE_status_request\n"); 2315 FAIL("client should need TLSEXT_TYPE_status_request\n");
2381 goto err; 2316 goto err;
2382 } 2317 }
2383 if (!tls_extension_client_build(TLSEXT_TYPE_status_request, ssl, 2318 if (!client_funcs->build(ssl, SSL_TLSEXT_MSG_CH, &cbb)) {
2384 SSL_TLSEXT_MSG_CH, &cbb)) {
2385 FAIL("client failed to build SNI\n"); 2319 FAIL("client failed to build SNI\n");
2386 goto err; 2320 goto err;
2387 } 2321 }
@@ -2405,8 +2339,7 @@ test_tlsext_ocsp_client(void)
2405 } 2339 }
2406 CBS_init(&cbs, tls_ocsp_client_default, 2340 CBS_init(&cbs, tls_ocsp_client_default,
2407 sizeof(tls_ocsp_client_default)); 2341 sizeof(tls_ocsp_client_default));
2408 if (!tls_extension_server_parse(TLSEXT_TYPE_status_request, ssl, 2342 if (!server_funcs->parse(ssl, SSL_TLSEXT_MSG_CH, &cbs, &alert)) {
2409 SSL_TLSEXT_MSG_CH, &cbs, &alert)) {
2410 FAIL("failed to parse TLSEXT_TYPE_status_request client\n"); 2343 FAIL("failed to parse TLSEXT_TYPE_status_request client\n");
2411 goto err; 2344 goto err;
2412 } 2345 }
@@ -2432,6 +2365,8 @@ test_tlsext_ocsp_server(void)
2432 unsigned char *data = NULL; 2365 unsigned char *data = NULL;
2433 SSL_CTX *ssl_ctx = NULL; 2366 SSL_CTX *ssl_ctx = NULL;
2434 SSL *ssl = NULL; 2367 SSL *ssl = NULL;
2368 const struct tls_extension_funcs *client_funcs;
2369 const struct tls_extension_funcs *server_funcs;
2435 size_t dlen; 2370 size_t dlen;
2436 int failure; 2371 int failure;
2437 CBB cbb; 2372 CBB cbb;
@@ -2445,21 +2380,22 @@ test_tlsext_ocsp_server(void)
2445 if ((ssl = SSL_new(ssl_ctx)) == NULL) 2380 if ((ssl = SSL_new(ssl_ctx)) == NULL)
2446 errx(1, "failed to create SSL"); 2381 errx(1, "failed to create SSL");
2447 2382
2448 if (tls_extension_server_needs(TLSEXT_TYPE_status_request, ssl, 2383 if (!tls_extension_funcs(TLSEXT_TYPE_status_request, &client_funcs,
2449 SSL_TLSEXT_MSG_SH)) { 2384 &server_funcs))
2385 errx(1, "failed to fetch ocsp funcs");
2386
2387 if (server_funcs->needs(ssl, SSL_TLSEXT_MSG_SH)) {
2450 FAIL("server should not need TLSEXT_TYPE_status_request\n"); 2388 FAIL("server should not need TLSEXT_TYPE_status_request\n");
2451 goto err; 2389 goto err;
2452 } 2390 }
2453 2391
2454 ssl->internal->tlsext_status_expected = 1; 2392 ssl->internal->tlsext_status_expected = 1;
2455 2393
2456 if (!tls_extension_server_needs(TLSEXT_TYPE_status_request, ssl, 2394 if (!server_funcs->needs(ssl, SSL_TLSEXT_MSG_SH)) {
2457 SSL_TLSEXT_MSG_SH)) {
2458 FAIL("server should need TLSEXT_TYPE_status_request\n"); 2395 FAIL("server should need TLSEXT_TYPE_status_request\n");
2459 goto err; 2396 goto err;
2460 } 2397 }
2461 if (!tls_extension_server_build(TLSEXT_TYPE_status_request, ssl, 2398 if (!server_funcs->build(ssl, SSL_TLSEXT_MSG_SH, &cbb)) {
2462 SSL_TLSEXT_MSG_SH, &cbb)) {
2463 FAIL("server failed to build TLSEXT_TYPE_status_request\n"); 2399 FAIL("server failed to build TLSEXT_TYPE_status_request\n");
2464 goto err; 2400 goto err;
2465 } 2401 }
@@ -2494,6 +2430,8 @@ test_tlsext_sessionticket_client(void)
2494 unsigned char *data = NULL; 2430 unsigned char *data = NULL;
2495 SSL_CTX *ssl_ctx = NULL; 2431 SSL_CTX *ssl_ctx = NULL;
2496 SSL *ssl = NULL; 2432 SSL *ssl = NULL;
2433 const struct tls_extension_funcs *client_funcs;
2434 const struct tls_extension_funcs *server_funcs;
2497 int failure; 2435 int failure;
2498 CBB cbb; 2436 CBB cbb;
2499 size_t dlen; 2437 size_t dlen;
@@ -2514,9 +2452,12 @@ test_tlsext_sessionticket_client(void)
2514 if ((ssl = SSL_new(ssl_ctx)) == NULL) 2452 if ((ssl = SSL_new(ssl_ctx)) == NULL)
2515 errx(1, "failed to create SSL"); 2453 errx(1, "failed to create SSL");
2516 2454
2455 if (!tls_extension_funcs(TLSEXT_TYPE_session_ticket, &client_funcs,
2456 &server_funcs))
2457 errx(1, "failed to fetch session ticket funcs");
2458
2517 /* Should need a ticket by default. */ 2459 /* Should need a ticket by default. */
2518 if (!tls_extension_client_needs(TLSEXT_TYPE_session_ticket, ssl, 2460 if (!client_funcs->needs(ssl, SSL_TLSEXT_MSG_CH)) {
2519 SSL_TLSEXT_MSG_CH)) {
2520 FAIL("client should need Sessionticket for default " 2461 FAIL("client should need Sessionticket for default "
2521 "ciphers\n"); 2462 "ciphers\n");
2522 goto err; 2463 goto err;
@@ -2527,8 +2468,7 @@ test_tlsext_sessionticket_client(void)
2527 FAIL("Cannot disable tickets in the TLS connection\n"); 2468 FAIL("Cannot disable tickets in the TLS connection\n");
2528 goto err; 2469 goto err;
2529 } 2470 }
2530 if (tls_extension_client_needs(TLSEXT_TYPE_session_ticket, ssl, 2471 if (client_funcs->needs(ssl, SSL_TLSEXT_MSG_CH)) {
2531 SSL_TLSEXT_MSG_CH)) {
2532 FAIL("client should not need SessionTicket if it was disabled\n"); 2472 FAIL("client should not need SessionTicket if it was disabled\n");
2533 goto err; 2473 goto err;
2534 } 2474 }
@@ -2538,15 +2478,13 @@ test_tlsext_sessionticket_client(void)
2538 FAIL("Cannot re-enable tickets in the TLS connection\n"); 2478 FAIL("Cannot re-enable tickets in the TLS connection\n");
2539 goto err; 2479 goto err;
2540 } 2480 }
2541 if (!tls_extension_client_needs(TLSEXT_TYPE_session_ticket, ssl, 2481 if (!client_funcs->needs(ssl, SSL_TLSEXT_MSG_CH)) {
2542 SSL_TLSEXT_MSG_CH)) {
2543 FAIL("client should need SessionTicket if it was disabled\n"); 2482 FAIL("client should need SessionTicket if it was disabled\n");
2544 goto err; 2483 goto err;
2545 } 2484 }
2546 2485
2547 /* Since we don't have a session, we should build an empty ticket. */ 2486 /* Since we don't have a session, we should build an empty ticket. */
2548 if (!tls_extension_client_build(TLSEXT_TYPE_session_ticket, ssl, 2487 if (!client_funcs->build(ssl, SSL_TLSEXT_MSG_CH, &cbb)) {
2549 SSL_TLSEXT_MSG_CH, &cbb)) {
2550 FAIL("Cannot build a ticket\n"); 2488 FAIL("Cannot build a ticket\n");
2551 goto err; 2489 goto err;
2552 } 2490 }
@@ -2567,13 +2505,11 @@ test_tlsext_sessionticket_client(void)
2567 /* With a new session (but no ticket), we should still have 0 length */ 2505 /* With a new session (but no ticket), we should still have 0 length */
2568 if ((ssl->session = SSL_SESSION_new()) == NULL) 2506 if ((ssl->session = SSL_SESSION_new()) == NULL)
2569 errx(1, "failed to create session"); 2507 errx(1, "failed to create session");
2570 if (!tls_extension_client_needs(TLSEXT_TYPE_session_ticket, ssl, 2508 if (!client_funcs->needs(ssl, SSL_TLSEXT_MSG_CH)) {
2571 SSL_TLSEXT_MSG_CH)) {
2572 FAIL("Should still want a session ticket with a new session\n"); 2509 FAIL("Should still want a session ticket with a new session\n");
2573 goto err; 2510 goto err;
2574 } 2511 }
2575 if (!tls_extension_client_build(TLSEXT_TYPE_session_ticket, ssl, 2512 if (!client_funcs->build(ssl, SSL_TLSEXT_MSG_CH, &cbb)) {
2576 SSL_TLSEXT_MSG_CH, &cbb)) {
2577 FAIL("Cannot build a ticket\n"); 2513 FAIL("Cannot build a ticket\n");
2578 goto err; 2514 goto err;
2579 } 2515 }
@@ -2603,13 +2539,11 @@ test_tlsext_sessionticket_client(void)
2603 memcpy(ssl->session->tlsext_tick, dummy, sizeof(dummy)); 2539 memcpy(ssl->session->tlsext_tick, dummy, sizeof(dummy));
2604 ssl->session->tlsext_ticklen = sizeof(dummy); 2540 ssl->session->tlsext_ticklen = sizeof(dummy);
2605 2541
2606 if (!tls_extension_client_needs(TLSEXT_TYPE_session_ticket, ssl, 2542 if (!client_funcs->needs(ssl, SSL_TLSEXT_MSG_CH)) {
2607 SSL_TLSEXT_MSG_CH)) {
2608 FAIL("Should still want a session ticket with a new session\n"); 2543 FAIL("Should still want a session ticket with a new session\n");
2609 goto err; 2544 goto err;
2610 } 2545 }
2611 if (!tls_extension_client_build(TLSEXT_TYPE_session_ticket, ssl, 2546 if (!client_funcs->build(ssl, SSL_TLSEXT_MSG_CH, &cbb)) {
2612 SSL_TLSEXT_MSG_CH, &cbb)) {
2613 FAIL("Cannot build a ticket\n"); 2547 FAIL("Cannot build a ticket\n");
2614 goto err; 2548 goto err;
2615 } 2549 }
@@ -2645,8 +2579,7 @@ test_tlsext_sessionticket_client(void)
2645 goto err; 2579 goto err;
2646 } 2580 }
2647 /* Should not need a ticket in this case */ 2581 /* Should not need a ticket in this case */
2648 if (tls_extension_client_needs(TLSEXT_TYPE_session_ticket, ssl, 2582 if (client_funcs->needs(ssl, SSL_TLSEXT_MSG_CH)) {
2649 SSL_TLSEXT_MSG_CH)) {
2650 FAIL("Should not want to use session tickets with a NULL custom\n"); 2583 FAIL("Should not want to use session tickets with a NULL custom\n");
2651 goto err; 2584 goto err;
2652 } 2585 }
@@ -2658,8 +2591,7 @@ test_tlsext_sessionticket_client(void)
2658 free(ssl->internal->tlsext_session_ticket); 2591 free(ssl->internal->tlsext_session_ticket);
2659 ssl->internal->tlsext_session_ticket = NULL; 2592 ssl->internal->tlsext_session_ticket = NULL;
2660 2593
2661 if (!tls_extension_client_needs(TLSEXT_TYPE_session_ticket, ssl, 2594 if (!client_funcs->needs(ssl, SSL_TLSEXT_MSG_CH)) {
2662 SSL_TLSEXT_MSG_CH)) {
2663 FAIL("Should need a session ticket again when the custom one is removed\n"); 2595 FAIL("Should need a session ticket again when the custom one is removed\n");
2664 goto err; 2596 goto err;
2665 } 2597 }
@@ -2670,13 +2602,11 @@ test_tlsext_sessionticket_client(void)
2670 FAIL("Should be able to set a custom ticket\n"); 2602 FAIL("Should be able to set a custom ticket\n");
2671 goto err; 2603 goto err;
2672 } 2604 }
2673 if (!tls_extension_client_needs(TLSEXT_TYPE_session_ticket, ssl, 2605 if (!client_funcs->needs(ssl, SSL_TLSEXT_MSG_CH)) {
2674 SSL_TLSEXT_MSG_CH)) {
2675 FAIL("Should need a session ticket again when the custom one is not empty\n"); 2606 FAIL("Should need a session ticket again when the custom one is not empty\n");
2676 goto err; 2607 goto err;
2677 } 2608 }
2678 if (!tls_extension_client_build(TLSEXT_TYPE_session_ticket, ssl, 2609 if (!client_funcs->build(ssl, SSL_TLSEXT_MSG_CH, &cbb)) {
2679 SSL_TLSEXT_MSG_CH, &cbb)) {
2680 FAIL("Cannot build a ticket with a max length random payload\n"); 2610 FAIL("Cannot build a ticket with a max length random payload\n");
2681 goto err; 2611 goto err;
2682 } 2612 }
@@ -2715,6 +2645,8 @@ test_tlsext_sessionticket_server(void)
2715{ 2645{
2716 SSL_CTX *ssl_ctx = NULL; 2646 SSL_CTX *ssl_ctx = NULL;
2717 SSL *ssl = NULL; 2647 SSL *ssl = NULL;
2648 const struct tls_extension_funcs *client_funcs;
2649 const struct tls_extension_funcs *server_funcs;
2718 int failure; 2650 int failure;
2719 uint8_t *data = NULL; 2651 uint8_t *data = NULL;
2720 size_t dlen; 2652 size_t dlen;
@@ -2729,12 +2661,15 @@ test_tlsext_sessionticket_server(void)
2729 if ((ssl = SSL_new(ssl_ctx)) == NULL) 2661 if ((ssl = SSL_new(ssl_ctx)) == NULL)
2730 errx(1, "failed to create SSL"); 2662 errx(1, "failed to create SSL");
2731 2663
2664 if (!tls_extension_funcs(TLSEXT_TYPE_session_ticket, &client_funcs,
2665 &server_funcs))
2666 errx(1, "failed to fetch session ticket funcs");
2667
2732 /* 2668 /*
2733 * By default, should not need a session ticket since the ticket 2669 * By default, should not need a session ticket since the ticket
2734 * is not yet expected. 2670 * is not yet expected.
2735 */ 2671 */
2736 if (tls_extension_server_needs(TLSEXT_TYPE_session_ticket, ssl, 2672 if (server_funcs->needs(ssl, SSL_TLSEXT_MSG_SH)) {
2737 SSL_TLSEXT_MSG_SH)) {
2738 FAIL("server should not need SessionTicket by default\n"); 2673 FAIL("server should not need SessionTicket by default\n");
2739 goto err; 2674 goto err;
2740 } 2675 }
@@ -2744,8 +2679,7 @@ test_tlsext_sessionticket_server(void)
2744 FAIL("Cannot disable tickets in the TLS connection\n"); 2679 FAIL("Cannot disable tickets in the TLS connection\n");
2745 goto err; 2680 goto err;
2746 } 2681 }
2747 if (tls_extension_server_needs(TLSEXT_TYPE_session_ticket, ssl, 2682 if (server_funcs->needs(ssl, SSL_TLSEXT_MSG_SH)) {
2748 SSL_TLSEXT_MSG_SH)) {
2749 FAIL("server should not need SessionTicket if it was disabled\n"); 2683 FAIL("server should not need SessionTicket if it was disabled\n");
2750 goto err; 2684 goto err;
2751 } 2685 }
@@ -2755,23 +2689,20 @@ test_tlsext_sessionticket_server(void)
2755 FAIL("Cannot re-enable tickets in the TLS connection\n"); 2689 FAIL("Cannot re-enable tickets in the TLS connection\n");
2756 goto err; 2690 goto err;
2757 } 2691 }
2758 if (tls_extension_server_needs(TLSEXT_TYPE_session_ticket, ssl, 2692 if (server_funcs->needs(ssl, SSL_TLSEXT_MSG_SH)) {
2759 SSL_TLSEXT_MSG_SH)) {
2760 FAIL("server should not need SessionTicket yet\n"); 2693 FAIL("server should not need SessionTicket yet\n");
2761 goto err; 2694 goto err;
2762 } 2695 }
2763 2696
2764 /* Set expected to require it. */ 2697 /* Set expected to require it. */
2765 ssl->internal->tlsext_ticket_expected = 1; 2698 ssl->internal->tlsext_ticket_expected = 1;
2766 if (!tls_extension_server_needs(TLSEXT_TYPE_session_ticket, ssl, 2699 if (!server_funcs->needs(ssl, SSL_TLSEXT_MSG_SH)) {
2767 SSL_TLSEXT_MSG_SH)) {
2768 FAIL("server should now be required for SessionTicket\n"); 2700 FAIL("server should now be required for SessionTicket\n");
2769 goto err; 2701 goto err;
2770 } 2702 }
2771 2703
2772 /* server hello's session ticket should always be 0 length payload. */ 2704 /* server hello's session ticket should always be 0 length payload. */
2773 if (!tls_extension_server_build(TLSEXT_TYPE_session_ticket, ssl, 2705 if (!server_funcs->build(ssl, SSL_TLSEXT_MSG_SH, &cbb)) {
2774 SSL_TLSEXT_MSG_SH, &cbb)) {
2775 FAIL("Cannot build a ticket with a max length random payload\n"); 2706 FAIL("Cannot build a ticket with a max length random payload\n");
2776 goto err; 2707 goto err;
2777 } 2708 }
@@ -2851,6 +2782,8 @@ test_tlsext_srtp_client(void)
2851 SRTP_PROTECTION_PROFILE *prof; 2782 SRTP_PROTECTION_PROFILE *prof;
2852 SSL_CTX *ssl_ctx = NULL; 2783 SSL_CTX *ssl_ctx = NULL;
2853 SSL *ssl = NULL; 2784 SSL *ssl = NULL;
2785 const struct tls_extension_funcs *client_funcs;
2786 const struct tls_extension_funcs *server_funcs;
2854 uint8_t *data = NULL; 2787 uint8_t *data = NULL;
2855 CBB cbb; 2788 CBB cbb;
2856 CBS cbs; 2789 CBS cbs;
@@ -2867,9 +2800,12 @@ test_tlsext_srtp_client(void)
2867 if ((ssl = SSL_new(ssl_ctx)) == NULL) 2800 if ((ssl = SSL_new(ssl_ctx)) == NULL)
2868 errx(1, "failed to create SSL"); 2801 errx(1, "failed to create SSL");
2869 2802
2803 if (!tls_extension_funcs(TLSEXT_TYPE_use_srtp, &client_funcs,
2804 &server_funcs))
2805 errx(1, "failed to fetch srtp funcs");
2806
2870 /* By default, we don't need this */ 2807 /* By default, we don't need this */
2871 if (tls_extension_client_needs(TLSEXT_TYPE_use_srtp, ssl, 2808 if (client_funcs->needs(ssl, SSL_TLSEXT_MSG_CH)) {
2872 SSL_TLSEXT_MSG_CH)) {
2873 FAIL("client should not need SRTP by default\n"); 2809 FAIL("client should not need SRTP by default\n");
2874 goto err; 2810 goto err;
2875 } 2811 }
@@ -2878,16 +2814,14 @@ test_tlsext_srtp_client(void)
2878 FAIL("should be able to set a single SRTP\n"); 2814 FAIL("should be able to set a single SRTP\n");
2879 goto err; 2815 goto err;
2880 } 2816 }
2881 if (!tls_extension_client_needs(TLSEXT_TYPE_use_srtp, ssl, 2817 if (!client_funcs->needs(ssl, SSL_TLSEXT_MSG_CH)) {
2882 SSL_TLSEXT_MSG_CH)) {
2883 FAIL("client should need SRTP\n"); 2818 FAIL("client should need SRTP\n");
2884 goto err; 2819 goto err;
2885 } 2820 }
2886 2821
2887 /* Make sure we can build the client with a single profile. */ 2822 /* Make sure we can build the client with a single profile. */
2888 2823
2889 if (!tls_extension_client_build(TLSEXT_TYPE_use_srtp, ssl, 2824 if (!client_funcs->build(ssl, SSL_TLSEXT_MSG_CH, &cbb)) {
2890 SSL_TLSEXT_MSG_CH, &cbb)) {
2891 FAIL("client failed to build SRTP\n"); 2825 FAIL("client failed to build SRTP\n");
2892 goto err; 2826 goto err;
2893 } 2827 }
@@ -2922,8 +2856,7 @@ test_tlsext_srtp_client(void)
2922 } 2856 }
2923 2857
2924 CBS_init(&cbs, tlsext_srtp_single, sizeof(tlsext_srtp_single)); 2858 CBS_init(&cbs, tlsext_srtp_single, sizeof(tlsext_srtp_single));
2925 if (!tls_extension_server_parse(TLSEXT_TYPE_use_srtp, ssl, 2859 if (!server_funcs->parse(ssl, SSL_TLSEXT_MSG_CH, &cbs, &alert)) {
2926 SSL_TLSEXT_MSG_CH, &cbs, &alert)) {
2927 FAIL("failed to parse SRTP\n"); 2860 FAIL("failed to parse SRTP\n");
2928 goto err; 2861 goto err;
2929 } 2862 }
@@ -2941,8 +2874,7 @@ test_tlsext_srtp_client(void)
2941 goto err; 2874 goto err;
2942 } 2875 }
2943 2876
2944 if (!tls_extension_server_needs(TLSEXT_TYPE_use_srtp, ssl, 2877 if (!server_funcs->needs(ssl, SSL_TLSEXT_MSG_CH)) {
2945 SSL_TLSEXT_MSG_CH)) {
2946 FAIL("should send server extension when profile selected\n"); 2878 FAIL("should send server extension when profile selected\n");
2947 goto err; 2879 goto err;
2948 } 2880 }
@@ -2953,14 +2885,12 @@ test_tlsext_srtp_client(void)
2953 FAIL("should be able to set SRTP to multiple profiles\n"); 2885 FAIL("should be able to set SRTP to multiple profiles\n");
2954 goto err; 2886 goto err;
2955 } 2887 }
2956 if (!tls_extension_client_needs(TLSEXT_TYPE_use_srtp, ssl, 2888 if (!client_funcs->needs(ssl, SSL_TLSEXT_MSG_CH)) {
2957 SSL_TLSEXT_MSG_CH)) {
2958 FAIL("client should need SRTP by now\n"); 2889 FAIL("client should need SRTP by now\n");
2959 goto err; 2890 goto err;
2960 } 2891 }
2961 2892
2962 if (!tls_extension_client_build(TLSEXT_TYPE_use_srtp, ssl, 2893 if (!client_funcs->build(ssl, SSL_TLSEXT_MSG_CH, &cbb)) {
2963 SSL_TLSEXT_MSG_CH, &cbb)) {
2964 FAIL("client failed to build SRTP\n"); 2894 FAIL("client failed to build SRTP\n");
2965 goto err; 2895 goto err;
2966 } 2896 }
@@ -2993,8 +2923,7 @@ test_tlsext_srtp_client(void)
2993 2923
2994 CBS_init(&cbs, tlsext_srtp_multiple, 2924 CBS_init(&cbs, tlsext_srtp_multiple,
2995 sizeof(tlsext_srtp_multiple)); 2925 sizeof(tlsext_srtp_multiple));
2996 if (!tls_extension_server_parse(TLSEXT_TYPE_use_srtp, ssl, 2926 if (!server_funcs->parse(ssl, SSL_TLSEXT_MSG_CH, &cbs, &alert)) {
2997 SSL_TLSEXT_MSG_CH, &cbs, &alert)) {
2998 FAIL("failed to parse SRTP\n"); 2927 FAIL("failed to parse SRTP\n");
2999 goto err; 2928 goto err;
3000 } 2929 }
@@ -3012,8 +2941,7 @@ test_tlsext_srtp_client(void)
3012 goto err; 2941 goto err;
3013 } 2942 }
3014 2943
3015 if (!tls_extension_server_needs(TLSEXT_TYPE_use_srtp, ssl, 2944 if (!server_funcs->needs(ssl, SSL_TLSEXT_MSG_CH)) {
3016 SSL_TLSEXT_MSG_CH)) {
3017 FAIL("should send server extension when profile selected\n"); 2945 FAIL("should send server extension when profile selected\n");
3018 goto err; 2946 goto err;
3019 } 2947 }
@@ -3026,8 +2954,7 @@ test_tlsext_srtp_client(void)
3026 2954
3027 CBS_init(&cbs, tlsext_srtp_multiple_one_valid, 2955 CBS_init(&cbs, tlsext_srtp_multiple_one_valid,
3028 sizeof(tlsext_srtp_multiple_one_valid)); 2956 sizeof(tlsext_srtp_multiple_one_valid));
3029 if (!tls_extension_server_parse(TLSEXT_TYPE_use_srtp, ssl, 2957 if (!server_funcs->parse(ssl, SSL_TLSEXT_MSG_CH, &cbs, &alert)) {
3030 SSL_TLSEXT_MSG_CH, &cbs, &alert)) {
3031 FAIL("failed to parse SRTP\n"); 2958 FAIL("failed to parse SRTP\n");
3032 goto err; 2959 goto err;
3033 } 2960 }
@@ -3045,8 +2972,7 @@ test_tlsext_srtp_client(void)
3045 goto err; 2972 goto err;
3046 } 2973 }
3047 2974
3048 if (!tls_extension_server_needs(TLSEXT_TYPE_use_srtp, ssl, 2975 if (!server_funcs->needs(ssl, SSL_TLSEXT_MSG_CH)) {
3049 SSL_TLSEXT_MSG_CH)) {
3050 FAIL("should send server extension when profile selected\n"); 2976 FAIL("should send server extension when profile selected\n");
3051 goto err; 2977 goto err;
3052 } 2978 }
@@ -3057,8 +2983,7 @@ test_tlsext_srtp_client(void)
3057 2983
3058 CBS_init(&cbs, tlsext_srtp_multiple_invalid, 2984 CBS_init(&cbs, tlsext_srtp_multiple_invalid,
3059 sizeof(tlsext_srtp_multiple_invalid)); 2985 sizeof(tlsext_srtp_multiple_invalid));
3060 if (!tls_extension_server_parse(TLSEXT_TYPE_use_srtp, ssl, 2986 if (!server_funcs->parse(ssl, SSL_TLSEXT_MSG_CH, &cbs, &alert)) {
3061 SSL_TLSEXT_MSG_CH, &cbs, &alert)) {
3062 FAIL("should be able to fall back to negotiated\n"); 2987 FAIL("should be able to fall back to negotiated\n");
3063 goto err; 2988 goto err;
3064 } 2989 }
@@ -3072,8 +2997,7 @@ test_tlsext_srtp_client(void)
3072 FAIL("should not have selected a profile when none found\n"); 2997 FAIL("should not have selected a profile when none found\n");
3073 goto err; 2998 goto err;
3074 } 2999 }
3075 if (tls_extension_server_needs(TLSEXT_TYPE_use_srtp, ssl, 3000 if (server_funcs->needs(ssl, SSL_TLSEXT_MSG_CH)) {
3076 SSL_TLSEXT_MSG_CH)) {
3077 FAIL("should not send server tlsext when no profile found\n"); 3001 FAIL("should not send server tlsext when no profile found\n");
3078 goto err; 3002 goto err;
3079 } 3003 }
@@ -3095,6 +3019,8 @@ test_tlsext_srtp_server(void)
3095 const SRTP_PROTECTION_PROFILE *prof; 3019 const SRTP_PROTECTION_PROFILE *prof;
3096 SSL_CTX *ssl_ctx = NULL; 3020 SSL_CTX *ssl_ctx = NULL;
3097 SSL *ssl = NULL; 3021 SSL *ssl = NULL;
3022 const struct tls_extension_funcs *client_funcs;
3023 const struct tls_extension_funcs *server_funcs;
3098 uint8_t *data = NULL; 3024 uint8_t *data = NULL;
3099 CBB cbb; 3025 CBB cbb;
3100 CBS cbs; 3026 CBS cbs;
@@ -3111,9 +3037,12 @@ test_tlsext_srtp_server(void)
3111 if ((ssl = SSL_new(ssl_ctx)) == NULL) 3037 if ((ssl = SSL_new(ssl_ctx)) == NULL)
3112 errx(1, "failed to create SSL"); 3038 errx(1, "failed to create SSL");
3113 3039
3040 if (!tls_extension_funcs(TLSEXT_TYPE_use_srtp, &client_funcs,
3041 &server_funcs))
3042 errx(1, "failed to fetch srtp funcs");
3043
3114 /* By default, we don't need this */ 3044 /* By default, we don't need this */
3115 if (tls_extension_server_needs(TLSEXT_TYPE_use_srtp, ssl, 3045 if (server_funcs->needs(ssl, SSL_TLSEXT_MSG_SH)) {
3116 SSL_TLSEXT_MSG_SH)) {
3117 FAIL("server should not need SRTP by default\n"); 3046 FAIL("server should not need SRTP by default\n");
3118 goto err; 3047 goto err;
3119 } 3048 }
@@ -3124,16 +3053,14 @@ test_tlsext_srtp_server(void)
3124 goto err; 3053 goto err;
3125 } 3054 }
3126 ssl->internal->srtp_profile = prof; 3055 ssl->internal->srtp_profile = prof;
3127 if (!tls_extension_server_needs(TLSEXT_TYPE_use_srtp, ssl, 3056 if (!server_funcs->needs(ssl, SSL_TLSEXT_MSG_SH)) {
3128 SSL_TLSEXT_MSG_SH)) {
3129 FAIL("server should need SRTP by now\n"); 3057 FAIL("server should need SRTP by now\n");
3130 goto err; 3058 goto err;
3131 } 3059 }
3132 3060
3133 /* Make sure we can build the server with a single profile. */ 3061 /* Make sure we can build the server with a single profile. */
3134 3062
3135 if (!tls_extension_server_build(TLSEXT_TYPE_use_srtp, ssl, 3063 if (!server_funcs->build(ssl, SSL_TLSEXT_MSG_SH, &cbb)) {
3136 SSL_TLSEXT_MSG_SH, &cbb)) {
3137 FAIL("server failed to build SRTP\n"); 3064 FAIL("server failed to build SRTP\n");
3138 goto err; 3065 goto err;
3139 } 3066 }
@@ -3175,8 +3102,7 @@ test_tlsext_srtp_server(void)
3175 } 3102 }
3176 3103
3177 CBS_init(&cbs, tlsext_srtp_single, sizeof(tlsext_srtp_single)); 3104 CBS_init(&cbs, tlsext_srtp_single, sizeof(tlsext_srtp_single));
3178 if (!tls_extension_client_parse(TLSEXT_TYPE_use_srtp, ssl, 3105 if (!client_funcs->parse(ssl, SSL_TLSEXT_MSG_SH, &cbs, &alert)) {
3179 SSL_TLSEXT_MSG_SH, &cbs, &alert)) {
3180 FAIL("failed to parse SRTP\n"); 3106 FAIL("failed to parse SRTP\n");
3181 goto err; 3107 goto err;
3182 } 3108 }
@@ -3199,8 +3125,7 @@ test_tlsext_srtp_server(void)
3199 3125
3200 CBS_init(&cbs, tlsext_srtp_multiple, 3126 CBS_init(&cbs, tlsext_srtp_multiple,
3201 sizeof(tlsext_srtp_multiple)); 3127 sizeof(tlsext_srtp_multiple));
3202 if (tls_extension_client_parse(TLSEXT_TYPE_use_srtp, ssl, 3128 if (client_funcs->parse(ssl, SSL_TLSEXT_MSG_SH, &cbs, &alert)) {
3203 SSL_TLSEXT_MSG_SH, &cbs, &alert)) {
3204 FAIL("should not find multiple entries from the server\n"); 3129 FAIL("should not find multiple entries from the server\n");
3205 goto err; 3130 goto err;
3206 } 3131 }
@@ -3210,8 +3135,7 @@ test_tlsext_srtp_server(void)
3210 3135
3211 CBS_init(&cbs, tlsext_srtp_single_invalid, 3136 CBS_init(&cbs, tlsext_srtp_single_invalid,
3212 sizeof(tlsext_srtp_single_invalid)); 3137 sizeof(tlsext_srtp_single_invalid));
3213 if (tls_extension_client_parse(TLSEXT_TYPE_use_srtp, ssl, 3138 if (client_funcs->parse(ssl, SSL_TLSEXT_MSG_SH, &cbs, &alert)) {
3214 SSL_TLSEXT_MSG_SH, &cbs, &alert)) {
3215 FAIL("should not be able to parse this\n"); 3139 FAIL("should not be able to parse this\n");
3216 goto err; 3140 goto err;
3217 } 3141 }
@@ -3246,6 +3170,8 @@ test_tlsext_clienthello_build(void)
3246 unsigned char *data = NULL; 3170 unsigned char *data = NULL;
3247 SSL_CTX *ssl_ctx = NULL; 3171 SSL_CTX *ssl_ctx = NULL;
3248 SSL *ssl = NULL; 3172 SSL *ssl = NULL;
3173 const struct tls_extension_funcs *client_funcs;
3174 const struct tls_extension_funcs *server_funcs;
3249 size_t dlen; 3175 size_t dlen;
3250 int failure; 3176 int failure;
3251 CBB cbb; 3177 CBB cbb;
@@ -3265,6 +3191,10 @@ test_tlsext_clienthello_build(void)
3265 goto err; 3191 goto err;
3266 } 3192 }
3267 3193
3194 if (!tls_extension_funcs(TLSEXT_TYPE_supported_versions, &client_funcs,
3195 &server_funcs))
3196 errx(1, "failed to fetch supported versions funcs");
3197
3268 ssl->s3->hs.our_min_tls_version = TLS1_VERSION; 3198 ssl->s3->hs.our_min_tls_version = TLS1_VERSION;
3269 ssl->s3->hs.our_max_tls_version = TLS1_2_VERSION; 3199 ssl->s3->hs.our_max_tls_version = TLS1_2_VERSION;
3270 3200
@@ -3479,6 +3409,8 @@ test_tlsext_versions_client(void)
3479 unsigned char *data = NULL; 3409 unsigned char *data = NULL;
3480 SSL_CTX *ssl_ctx = NULL; 3410 SSL_CTX *ssl_ctx = NULL;
3481 SSL *ssl = NULL; 3411 SSL *ssl = NULL;
3412 const struct tls_extension_funcs *client_funcs;
3413 const struct tls_extension_funcs *server_funcs;
3482 int failure = 0; 3414 int failure = 0;
3483 size_t dlen; 3415 size_t dlen;
3484 int alert; 3416 int alert;
@@ -3492,10 +3424,13 @@ test_tlsext_versions_client(void)
3492 if ((ssl = SSL_new(ssl_ctx)) == NULL) 3424 if ((ssl = SSL_new(ssl_ctx)) == NULL)
3493 errx(1, "failed to create SSL"); 3425 errx(1, "failed to create SSL");
3494 3426
3427 if (!tls_extension_funcs(TLSEXT_TYPE_supported_versions, &client_funcs,
3428 &server_funcs))
3429 errx(1, "failed to fetch supported versions funcs");
3430
3495 ssl->s3->hs.our_max_tls_version = TLS1_1_VERSION; 3431 ssl->s3->hs.our_max_tls_version = TLS1_1_VERSION;
3496 3432
3497 if (tls_extension_client_needs(TLSEXT_TYPE_supported_versions, ssl, 3433 if (client_funcs->needs(ssl, SSL_TLSEXT_MSG_CH)) {
3498 SSL_TLSEXT_MSG_CH)) {
3499 FAIL("client should not need versions\n"); 3434 FAIL("client should not need versions\n");
3500 failure = 1; 3435 failure = 1;
3501 goto done; 3436 goto done;
@@ -3503,8 +3438,7 @@ test_tlsext_versions_client(void)
3503 3438
3504 ssl->s3->hs.our_max_tls_version = TLS1_2_VERSION; 3439 ssl->s3->hs.our_max_tls_version = TLS1_2_VERSION;
3505 3440
3506 if (tls_extension_client_needs(TLSEXT_TYPE_supported_versions, ssl, 3441 if (client_funcs->needs(ssl, SSL_TLSEXT_MSG_CH)) {
3507 SSL_TLSEXT_MSG_CH)) {
3508 FAIL("client should not need versions\n"); 3442 FAIL("client should not need versions\n");
3509 failure = 1; 3443 failure = 1;
3510 goto done; 3444 goto done;
@@ -3512,8 +3446,7 @@ test_tlsext_versions_client(void)
3512 3446
3513 ssl->s3->hs.our_max_tls_version = TLS1_3_VERSION; 3447 ssl->s3->hs.our_max_tls_version = TLS1_3_VERSION;
3514 3448
3515 if (!tls_extension_client_needs(TLSEXT_TYPE_supported_versions, ssl, 3449 if (!client_funcs->needs(ssl, SSL_TLSEXT_MSG_CH)) {
3516 SSL_TLSEXT_MSG_CH)) {
3517 FAIL("client should need versions\n"); 3450 FAIL("client should need versions\n");
3518 failure = 1; 3451 failure = 1;
3519 goto done; 3452 goto done;
@@ -3522,8 +3455,7 @@ test_tlsext_versions_client(void)
3522 ssl->s3->hs.our_min_tls_version = TLS1_VERSION; 3455 ssl->s3->hs.our_min_tls_version = TLS1_VERSION;
3523 ssl->s3->hs.our_max_tls_version = TLS1_3_VERSION; 3456 ssl->s3->hs.our_max_tls_version = TLS1_3_VERSION;
3524 3457
3525 if (!tls_extension_client_build(TLSEXT_TYPE_supported_versions, ssl, 3458 if (!client_funcs->build(ssl, SSL_TLSEXT_MSG_CH, &cbb)) {
3526 SSL_TLSEXT_MSG_CH, &cbb)) {
3527 FAIL("client should have built versions\n"); 3459 FAIL("client should have built versions\n");
3528 failure = 1; 3460 failure = 1;
3529 goto done; 3461 goto done;
@@ -3543,8 +3475,7 @@ test_tlsext_versions_client(void)
3543 } 3475 }
3544 3476
3545 CBS_init(&cbs, data, dlen); 3477 CBS_init(&cbs, data, dlen);
3546 if (!tls_extension_server_parse(TLSEXT_TYPE_supported_versions, ssl, 3478 if (!server_funcs->parse(ssl, SSL_TLSEXT_MSG_CH, &cbs, &alert)) {
3547 SSL_TLSEXT_MSG_CH, &cbs, &alert)) {
3548 FAIL("failed to parse client versions\n"); 3479 FAIL("failed to parse client versions\n");
3549 failure = 1; 3480 failure = 1;
3550 goto done; 3481 goto done;
@@ -3569,6 +3500,8 @@ test_tlsext_versions_server(void)
3569 unsigned char *data = NULL; 3500 unsigned char *data = NULL;
3570 SSL_CTX *ssl_ctx = NULL; 3501 SSL_CTX *ssl_ctx = NULL;
3571 SSL *ssl = NULL; 3502 SSL *ssl = NULL;
3503 const struct tls_extension_funcs *client_funcs;
3504 const struct tls_extension_funcs *server_funcs;
3572 int failure = 0; 3505 int failure = 0;
3573 size_t dlen; 3506 size_t dlen;
3574 int alert; 3507 int alert;
@@ -3582,10 +3515,13 @@ test_tlsext_versions_server(void)
3582 if ((ssl = SSL_new(ssl_ctx)) == NULL) 3515 if ((ssl = SSL_new(ssl_ctx)) == NULL)
3583 errx(1, "failed to create SSL"); 3516 errx(1, "failed to create SSL");
3584 3517
3518 if (!tls_extension_funcs(TLSEXT_TYPE_supported_versions, &client_funcs,
3519 &server_funcs))
3520 errx(1, "failed to fetch supported versions funcs");
3521
3585 ssl->s3->hs.negotiated_tls_version = TLS1_2_VERSION; 3522 ssl->s3->hs.negotiated_tls_version = TLS1_2_VERSION;
3586 3523
3587 if (tls_extension_server_needs(TLSEXT_TYPE_supported_versions, ssl, 3524 if (server_funcs->needs(ssl, SSL_TLSEXT_MSG_SH)) {
3588 SSL_TLSEXT_MSG_SH)) {
3589 FAIL("server should not need versions\n"); 3525 FAIL("server should not need versions\n");
3590 failure = 1; 3526 failure = 1;
3591 goto done; 3527 goto done;
@@ -3593,15 +3529,13 @@ test_tlsext_versions_server(void)
3593 3529
3594 ssl->s3->hs.negotiated_tls_version = TLS1_3_VERSION; 3530 ssl->s3->hs.negotiated_tls_version = TLS1_3_VERSION;
3595 3531
3596 if (!tls_extension_server_needs(TLSEXT_TYPE_supported_versions, ssl, 3532 if (!server_funcs->needs(ssl, SSL_TLSEXT_MSG_SH)) {
3597 SSL_TLSEXT_MSG_SH)) {
3598 FAIL("server should need versions\n"); 3533 FAIL("server should need versions\n");
3599 failure = 1; 3534 failure = 1;
3600 goto done; 3535 goto done;
3601 } 3536 }
3602 3537
3603 if (!tls_extension_server_build(TLSEXT_TYPE_supported_versions, ssl, 3538 if (!server_funcs->build(ssl, SSL_TLSEXT_MSG_SH, &cbb)) {
3604 SSL_TLSEXT_MSG_SH, &cbb)) {
3605 FAIL("server should have built versions\n"); 3539 FAIL("server should have built versions\n");
3606 failure = 1; 3540 failure = 1;
3607 goto done; 3541 goto done;
@@ -3621,8 +3555,7 @@ test_tlsext_versions_server(void)
3621 } 3555 }
3622 3556
3623 CBS_init(&cbs, data, dlen); 3557 CBS_init(&cbs, data, dlen);
3624 if (!tls_extension_client_parse(TLSEXT_TYPE_supported_versions, ssl, 3558 if (!client_funcs->parse(ssl, SSL_TLSEXT_MSG_SH, &cbs, &alert)) {
3625 SSL_TLSEXT_MSG_SH, &cbs, &alert)) {
3626 FAIL("failed to parse client versions\n"); 3559 FAIL("failed to parse client versions\n");
3627 failure = 1; 3560 failure = 1;
3628 goto done; 3561 goto done;
@@ -3663,6 +3596,8 @@ test_tlsext_keyshare_client(void)
3663 unsigned char *data = NULL; 3596 unsigned char *data = NULL;
3664 SSL_CTX *ssl_ctx = NULL; 3597 SSL_CTX *ssl_ctx = NULL;
3665 SSL *ssl = NULL; 3598 SSL *ssl = NULL;
3599 const struct tls_extension_funcs *client_funcs;
3600 const struct tls_extension_funcs *server_funcs;
3666 int failure = 0; 3601 int failure = 0;
3667 size_t dlen; 3602 size_t dlen;
3668 int alert; 3603 int alert;
@@ -3676,6 +3611,10 @@ test_tlsext_keyshare_client(void)
3676 if ((ssl = SSL_new(ssl_ctx)) == NULL) 3611 if ((ssl = SSL_new(ssl_ctx)) == NULL)
3677 errx(1, "failed to create SSL"); 3612 errx(1, "failed to create SSL");
3678 3613
3614 if (!tls_extension_funcs(TLSEXT_TYPE_key_share, &client_funcs,
3615 &server_funcs))
3616 errx(1, "failed to fetch keyshare funcs");
3617
3679 if ((ssl->s3->hs.key_share = 3618 if ((ssl->s3->hs.key_share =
3680 tls_key_share_new_nid(NID_X25519)) == NULL) 3619 tls_key_share_new_nid(NID_X25519)) == NULL)
3681 errx(1, "failed to create key share"); 3620 errx(1, "failed to create key share");
@@ -3683,24 +3622,21 @@ test_tlsext_keyshare_client(void)
3683 errx(1, "failed to generate key share"); 3622 errx(1, "failed to generate key share");
3684 3623
3685 ssl->s3->hs.our_max_tls_version = TLS1_2_VERSION; 3624 ssl->s3->hs.our_max_tls_version = TLS1_2_VERSION;
3686 if (tls_extension_client_needs(TLSEXT_TYPE_key_share, ssl, 3625 if (client_funcs->needs(ssl, SSL_TLSEXT_MSG_CH)) {
3687 SSL_TLSEXT_MSG_CH)) {
3688 FAIL("client should not need keyshare\n"); 3626 FAIL("client should not need keyshare\n");
3689 failure = 1; 3627 failure = 1;
3690 goto done; 3628 goto done;
3691 } 3629 }
3692 3630
3693 ssl->s3->hs.our_max_tls_version = TLS1_3_VERSION; 3631 ssl->s3->hs.our_max_tls_version = TLS1_3_VERSION;
3694 if (!tls_extension_client_needs(TLSEXT_TYPE_key_share, ssl, 3632 if (!client_funcs->needs(ssl, SSL_TLSEXT_MSG_CH)) {
3695 SSL_TLSEXT_MSG_CH)) {
3696 FAIL("client should need keyshare\n"); 3633 FAIL("client should need keyshare\n");
3697 failure = 1; 3634 failure = 1;
3698 goto done; 3635 goto done;
3699 } 3636 }
3700 3637
3701 ssl->s3->hs.our_max_tls_version = TLS1_3_VERSION; 3638 ssl->s3->hs.our_max_tls_version = TLS1_3_VERSION;
3702 if (!tls_extension_client_build(TLSEXT_TYPE_key_share, ssl, 3639 if (!client_funcs->build(ssl, SSL_TLSEXT_MSG_CH, &cbb)) {
3703 SSL_TLSEXT_MSG_CH, &cbb)) {
3704 FAIL("client should have built keyshare\n"); 3640 FAIL("client should have built keyshare\n");
3705 failure = 1; 3641 failure = 1;
3706 goto done; 3642 goto done;
@@ -3722,8 +3658,7 @@ test_tlsext_keyshare_client(void)
3722 (ssl)->version = TLS1_3_VERSION; 3658 (ssl)->version = TLS1_3_VERSION;
3723 CBS_init(&cbs, data, dlen); 3659 CBS_init(&cbs, data, dlen);
3724 3660
3725 if (!tls_extension_server_parse(TLSEXT_TYPE_key_share, ssl, 3661 if (!server_funcs->parse(ssl, SSL_TLSEXT_MSG_CH, &cbs, &alert)) {
3726 SSL_TLSEXT_MSG_CH, &cbs, &alert)) {
3727 FAIL("failed to parse client keyshare\n"); 3662 FAIL("failed to parse client keyshare\n");
3728 failure = 1; 3663 failure = 1;
3729 goto done; 3664 goto done;
@@ -3751,6 +3686,8 @@ test_tlsext_keyshare_server(void)
3751 unsigned char *data = NULL; 3686 unsigned char *data = NULL;
3752 SSL_CTX *ssl_ctx = NULL; 3687 SSL_CTX *ssl_ctx = NULL;
3753 SSL *ssl = NULL; 3688 SSL *ssl = NULL;
3689 const struct tls_extension_funcs *client_funcs;
3690 const struct tls_extension_funcs *server_funcs;
3754 int decode_error; 3691 int decode_error;
3755 int failure = 1; 3692 int failure = 1;
3756 size_t dlen, idx; 3693 size_t dlen, idx;
@@ -3769,18 +3706,20 @@ test_tlsext_keyshare_server(void)
3769 if ((ssl = SSL_new(ssl_ctx)) == NULL) 3706 if ((ssl = SSL_new(ssl_ctx)) == NULL)
3770 errx(1, "failed to create SSL"); 3707 errx(1, "failed to create SSL");
3771 3708
3709 if (!tls_extension_funcs(TLSEXT_TYPE_key_share, &client_funcs,
3710 &server_funcs))
3711 errx(1, "failed to fetch keyshare funcs");
3712
3772 CBB_init(&cbb, 0); 3713 CBB_init(&cbb, 0);
3773 3714
3774 ssl->s3->hs.negotiated_tls_version = TLS1_2_VERSION; 3715 ssl->s3->hs.negotiated_tls_version = TLS1_2_VERSION;
3775 if (tls_extension_server_needs(TLSEXT_TYPE_key_share, ssl, 3716 if (server_funcs->needs(ssl, SSL_TLSEXT_MSG_SH)) {
3776 SSL_TLSEXT_MSG_SH)) {
3777 FAIL("server should not need keyshare\n"); 3717 FAIL("server should not need keyshare\n");
3778 goto done; 3718 goto done;
3779 } 3719 }
3780 3720
3781 ssl->s3->hs.negotiated_tls_version = TLS1_3_VERSION; 3721 ssl->s3->hs.negotiated_tls_version = TLS1_3_VERSION;
3782 if (tls_extension_server_needs(TLSEXT_TYPE_key_share, ssl, 3722 if (server_funcs->needs(ssl, SSL_TLSEXT_MSG_SH)) {
3783 SSL_TLSEXT_MSG_SH)) {
3784 FAIL("client should not need keyshare\n"); 3723 FAIL("client should not need keyshare\n");
3785 goto done; 3724 goto done;
3786 } 3725 }
@@ -3791,14 +3730,12 @@ test_tlsext_keyshare_server(void)
3791 } 3730 }
3792 ssl->s3->hs.extensions_seen |= (1 << idx); 3731 ssl->s3->hs.extensions_seen |= (1 << idx);
3793 3732
3794 if (!tls_extension_server_needs(TLSEXT_TYPE_key_share, ssl, 3733 if (!server_funcs->needs(ssl, SSL_TLSEXT_MSG_SH)) {
3795 SSL_TLSEXT_MSG_SH)) {
3796 FAIL("server should need keyshare\n"); 3734 FAIL("server should need keyshare\n");
3797 goto done; 3735 goto done;
3798 } 3736 }
3799 3737
3800 if (tls_extension_server_build(TLSEXT_TYPE_key_share, ssl, 3738 if (server_funcs->build(ssl, SSL_TLSEXT_MSG_SH, &cbb)) {
3801 SSL_TLSEXT_MSG_SH, &cbb)) {
3802 FAIL("server should not have built a keyshare response\n"); 3739 FAIL("server should not have built a keyshare response\n");
3803 goto done; 3740 goto done;
3804 } 3741 }
@@ -3822,8 +3759,7 @@ test_tlsext_keyshare_server(void)
3822 goto done; 3759 goto done;
3823 } 3760 }
3824 3761
3825 if (!tls_extension_server_build(TLSEXT_TYPE_key_share, ssl, 3762 if (!server_funcs->build(ssl, SSL_TLSEXT_MSG_SH, &cbb)) {
3826 SSL_TLSEXT_MSG_SH, &cbb)) {
3827 FAIL("server should be able to build a keyshare response\n"); 3763 FAIL("server should be able to build a keyshare response\n");
3828 goto done; 3764 goto done;
3829 } 3765 }
@@ -3853,8 +3789,7 @@ test_tlsext_keyshare_server(void)
3853 3789
3854 CBS_init(&cbs, data, dlen); 3790 CBS_init(&cbs, data, dlen);
3855 3791
3856 if (!tls_extension_client_parse(TLSEXT_TYPE_key_share, ssl, 3792 if (!client_funcs->parse(ssl, SSL_TLSEXT_MSG_SH, &cbs, &alert)) {
3857 SSL_TLSEXT_MSG_SH, &cbs, &alert)) {
3858 FAIL("failed to parse server keyshare\n"); 3793 FAIL("failed to parse server keyshare\n");
3859 goto done; 3794 goto done;
3860 } 3795 }
@@ -3889,6 +3824,8 @@ test_tlsext_cookie_client(void)
3889 unsigned char *data = NULL; 3824 unsigned char *data = NULL;
3890 SSL_CTX *ssl_ctx = NULL; 3825 SSL_CTX *ssl_ctx = NULL;
3891 SSL *ssl = NULL; 3826 SSL *ssl = NULL;
3827 const struct tls_extension_funcs *client_funcs;
3828 const struct tls_extension_funcs *server_funcs;
3892 int failure = 0; 3829 int failure = 0;
3893 size_t dlen; 3830 size_t dlen;
3894 int alert; 3831 int alert;
@@ -3902,9 +3839,12 @@ test_tlsext_cookie_client(void)
3902 if ((ssl = SSL_new(ssl_ctx)) == NULL) 3839 if ((ssl = SSL_new(ssl_ctx)) == NULL)
3903 errx(1, "failed to create SSL"); 3840 errx(1, "failed to create SSL");
3904 3841
3842 if (!tls_extension_funcs(TLSEXT_TYPE_cookie, &client_funcs,
3843 &server_funcs))
3844 errx(1, "failed to fetch cookie funcs");
3845
3905 ssl->s3->hs.our_max_tls_version = TLS1_2_VERSION; 3846 ssl->s3->hs.our_max_tls_version = TLS1_2_VERSION;
3906 if (tls_extension_client_needs(TLSEXT_TYPE_cookie, ssl, 3847 if (client_funcs->needs(ssl, SSL_TLSEXT_MSG_CH)) {
3907 SSL_TLSEXT_MSG_CH)) {
3908 FAIL("client should not need cookie\n"); 3848 FAIL("client should not need cookie\n");
3909 failure = 1; 3849 failure = 1;
3910 goto done; 3850 goto done;
@@ -3912,8 +3852,7 @@ test_tlsext_cookie_client(void)
3912 3852
3913 3853
3914 ssl->s3->hs.our_max_tls_version = TLS1_3_VERSION; 3854 ssl->s3->hs.our_max_tls_version = TLS1_3_VERSION;
3915 if (tls_extension_client_needs(TLSEXT_TYPE_cookie, ssl, 3855 if (client_funcs->needs(ssl, SSL_TLSEXT_MSG_CH)) {
3916 SSL_TLSEXT_MSG_CH)) {
3917 FAIL("client should not need cookie\n"); 3856 FAIL("client should not need cookie\n");
3918 failure = 1; 3857 failure = 1;
3919 goto done; 3858 goto done;
@@ -3923,15 +3862,13 @@ test_tlsext_cookie_client(void)
3923 ssl->s3->hs.tls13.cookie = strdup(cookie); 3862 ssl->s3->hs.tls13.cookie = strdup(cookie);
3924 ssl->s3->hs.tls13.cookie_len = strlen(cookie); 3863 ssl->s3->hs.tls13.cookie_len = strlen(cookie);
3925 3864
3926 if (!tls_extension_client_needs(TLSEXT_TYPE_cookie, ssl, 3865 if (!client_funcs->needs(ssl, SSL_TLSEXT_MSG_CH)) {
3927 SSL_TLSEXT_MSG_CH)) {
3928 FAIL("client should need cookie\n"); 3866 FAIL("client should need cookie\n");
3929 failure = 1; 3867 failure = 1;
3930 goto done; 3868 goto done;
3931 } 3869 }
3932 3870
3933 if (!tls_extension_client_build(TLSEXT_TYPE_cookie, ssl, 3871 if (!client_funcs->build(ssl, SSL_TLSEXT_MSG_CH, &cbb)) {
3934 SSL_TLSEXT_MSG_CH, &cbb)) {
3935 FAIL("client should have built a cookie response\n"); 3872 FAIL("client should have built a cookie response\n");
3936 failure = 1; 3873 failure = 1;
3937 goto done; 3874 goto done;
@@ -3954,8 +3891,7 @@ test_tlsext_cookie_client(void)
3954 CBS_init(&cbs, data, dlen); 3891 CBS_init(&cbs, data, dlen);
3955 3892
3956 /* Checks cookie against what's in the hs.tls13 */ 3893 /* Checks cookie against what's in the hs.tls13 */
3957 if (!tls_extension_server_parse(TLSEXT_TYPE_cookie, ssl, 3894 if (!server_funcs->parse(ssl, SSL_TLSEXT_MSG_CH, &cbs, &alert)) {
3958 SSL_TLSEXT_MSG_CH, &cbs, &alert)) {
3959 FAIL("failed to parse client cookie\n"); 3895 FAIL("failed to parse client cookie\n");
3960 failure = 1; 3896 failure = 1;
3961 goto done; 3897 goto done;
@@ -3982,6 +3918,8 @@ test_tlsext_cookie_server(void)
3982 unsigned char *data = NULL; 3918 unsigned char *data = NULL;
3983 SSL_CTX *ssl_ctx = NULL; 3919 SSL_CTX *ssl_ctx = NULL;
3984 SSL *ssl = NULL; 3920 SSL *ssl = NULL;
3921 const struct tls_extension_funcs *client_funcs;
3922 const struct tls_extension_funcs *server_funcs;
3985 int failure = 0; 3923 int failure = 0;
3986 size_t dlen; 3924 size_t dlen;
3987 int alert; 3925 int alert;
@@ -3995,17 +3933,19 @@ test_tlsext_cookie_server(void)
3995 if ((ssl = SSL_new(ssl_ctx)) == NULL) 3933 if ((ssl = SSL_new(ssl_ctx)) == NULL)
3996 errx(1, "failed to create SSL"); 3934 errx(1, "failed to create SSL");
3997 3935
3936 if (!tls_extension_funcs(TLSEXT_TYPE_cookie, &client_funcs,
3937 &server_funcs))
3938 errx(1, "failed to fetch cookie funcs");
3939
3998 ssl->s3->hs.our_max_tls_version = TLS1_2_VERSION; 3940 ssl->s3->hs.our_max_tls_version = TLS1_2_VERSION;
3999 if (tls_extension_server_needs(TLSEXT_TYPE_cookie, ssl, 3941 if (server_funcs->needs(ssl, SSL_TLSEXT_MSG_SH)) {
4000 SSL_TLSEXT_MSG_SH)) {
4001 FAIL("server should not need cookie\n"); 3942 FAIL("server should not need cookie\n");
4002 failure = 1; 3943 failure = 1;
4003 goto done; 3944 goto done;
4004 } 3945 }
4005 3946
4006 ssl->s3->hs.our_max_tls_version = TLS1_3_VERSION; 3947 ssl->s3->hs.our_max_tls_version = TLS1_3_VERSION;
4007 if (tls_extension_server_needs(TLSEXT_TYPE_cookie, ssl, 3948 if (server_funcs->needs(ssl, SSL_TLSEXT_MSG_SH)) {
4008 SSL_TLSEXT_MSG_SH)) {
4009 FAIL("server should not need cookie\n"); 3949 FAIL("server should not need cookie\n");
4010 failure = 1; 3950 failure = 1;
4011 goto done; 3951 goto done;
@@ -4015,15 +3955,13 @@ test_tlsext_cookie_server(void)
4015 ssl->s3->hs.tls13.cookie = strdup(cookie); 3955 ssl->s3->hs.tls13.cookie = strdup(cookie);
4016 ssl->s3->hs.tls13.cookie_len = strlen(cookie); 3956 ssl->s3->hs.tls13.cookie_len = strlen(cookie);
4017 3957
4018 if (!tls_extension_server_needs(TLSEXT_TYPE_cookie, ssl, 3958 if (!server_funcs->needs(ssl, SSL_TLSEXT_MSG_HRR)) {
4019 SSL_TLSEXT_MSG_HRR)) {
4020 FAIL("server should need cookie\n"); 3959 FAIL("server should need cookie\n");
4021 failure = 1; 3960 failure = 1;
4022 goto done; 3961 goto done;
4023 } 3962 }
4024 3963
4025 if (!tls_extension_server_build(TLSEXT_TYPE_cookie, ssl, 3964 if (!server_funcs->build(ssl, SSL_TLSEXT_MSG_HRR, &cbb)) {
4026 SSL_TLSEXT_MSG_HRR, &cbb)) {
4027 FAIL("server should have built a cookie response\n"); 3965 FAIL("server should have built a cookie response\n");
4028 failure = 1; 3966 failure = 1;
4029 goto done; 3967 goto done;
@@ -4045,8 +3983,7 @@ test_tlsext_cookie_server(void)
4045 3983
4046 CBS_init(&cbs, data, dlen); 3984 CBS_init(&cbs, data, dlen);
4047 3985
4048 if (tls_extension_client_parse(TLSEXT_TYPE_cookie, ssl, 3986 if (client_funcs->parse(ssl, SSL_TLSEXT_MSG_SH, &cbs, &alert)) {
4049 SSL_TLSEXT_MSG_SH, &cbs, &alert)) {
4050 FAIL("client should not have parsed server cookie\n"); 3987 FAIL("client should not have parsed server cookie\n");
4051 failure = 1; 3988 failure = 1;
4052 goto done; 3989 goto done;
@@ -4056,8 +3993,7 @@ test_tlsext_cookie_server(void)
4056 ssl->s3->hs.tls13.cookie = NULL; 3993 ssl->s3->hs.tls13.cookie = NULL;
4057 ssl->s3->hs.tls13.cookie_len = 0; 3994 ssl->s3->hs.tls13.cookie_len = 0;
4058 3995
4059 if (!tls_extension_client_parse(TLSEXT_TYPE_cookie, ssl, 3996 if (!client_funcs->parse(ssl, SSL_TLSEXT_MSG_SH, &cbs, &alert)) {
4060 SSL_TLSEXT_MSG_SH, &cbs, &alert)) {
4061 FAIL("failed to parse server cookie\n"); 3997 FAIL("failed to parse server cookie\n");
4062 failure = 1; 3998 failure = 1;
4063 goto done; 3999 goto done;
@@ -4102,6 +4038,8 @@ test_tlsext_psk_modes_client(void)
4102{ 4038{
4103 SSL_CTX *ssl_ctx = NULL; 4039 SSL_CTX *ssl_ctx = NULL;
4104 SSL *ssl = NULL; 4040 SSL *ssl = NULL;
4041 const struct tls_extension_funcs *client_funcs;
4042 const struct tls_extension_funcs *server_funcs;
4105 int failure; 4043 int failure;
4106 uint8_t *data = NULL; 4044 uint8_t *data = NULL;
4107 size_t dlen; 4045 size_t dlen;
@@ -4118,9 +4056,12 @@ test_tlsext_psk_modes_client(void)
4118 if ((ssl = SSL_new(ssl_ctx)) == NULL) 4056 if ((ssl = SSL_new(ssl_ctx)) == NULL)
4119 errx(1, "failed to create SSL"); 4057 errx(1, "failed to create SSL");
4120 4058
4059 if (!tls_extension_funcs(TLSEXT_TYPE_psk_kex_modes, &client_funcs,
4060 &server_funcs))
4061 errx(1, "failed to fetch psk funcs");
4062
4121 /* Disabled by default. */ 4063 /* Disabled by default. */
4122 if (tls_extension_client_needs(TLSEXT_TYPE_psk_kex_modes, ssl, 4064 if (client_funcs->needs(ssl, SSL_TLSEXT_MSG_CH)) {
4123 SSL_TLSEXT_MSG_CH)) {
4124 FAIL("client should not need psk kex modes by default\n"); 4065 FAIL("client should not need psk kex modes by default\n");
4125 goto err; 4066 goto err;
4126 } 4067 }
@@ -4133,8 +4074,7 @@ test_tlsext_psk_modes_client(void)
4133 ssl->s3->hs.tls13.use_psk_dhe_ke = 1; 4074 ssl->s3->hs.tls13.use_psk_dhe_ke = 1;
4134 ssl->s3->hs.our_max_tls_version = TLS1_2_VERSION; 4075 ssl->s3->hs.our_max_tls_version = TLS1_2_VERSION;
4135 4076
4136 if (tls_extension_client_needs(TLSEXT_TYPE_psk_kex_modes, ssl, 4077 if (client_funcs->needs(ssl, SSL_TLSEXT_MSG_CH)) {
4137 SSL_TLSEXT_MSG_CH)) {
4138 FAIL("client should not need psk kex modes with TLSv1.2\n"); 4078 FAIL("client should not need psk kex modes with TLSv1.2\n");
4139 goto err; 4079 goto err;
4140 } 4080 }
@@ -4142,8 +4082,7 @@ test_tlsext_psk_modes_client(void)
4142 ssl->s3->hs.tls13.use_psk_dhe_ke = 0; 4082 ssl->s3->hs.tls13.use_psk_dhe_ke = 0;
4143 ssl->s3->hs.our_max_tls_version = TLS1_3_VERSION; 4083 ssl->s3->hs.our_max_tls_version = TLS1_3_VERSION;
4144 4084
4145 if (tls_extension_client_needs(TLSEXT_TYPE_psk_kex_modes, ssl, 4085 if (client_funcs->needs(ssl, SSL_TLSEXT_MSG_CH)) {
4146 SSL_TLSEXT_MSG_CH)) {
4147 FAIL("client should not need psk kex modes without " 4086 FAIL("client should not need psk kex modes without "
4148 "use_psk_dhe_ke\n"); 4087 "use_psk_dhe_ke\n");
4149 goto err; 4088 goto err;
@@ -4152,16 +4091,14 @@ test_tlsext_psk_modes_client(void)
4152 ssl->s3->hs.tls13.use_psk_dhe_ke = 1; 4091 ssl->s3->hs.tls13.use_psk_dhe_ke = 1;
4153 ssl->s3->hs.our_max_tls_version = TLS1_3_VERSION; 4092 ssl->s3->hs.our_max_tls_version = TLS1_3_VERSION;
4154 4093
4155 if (!tls_extension_client_needs(TLSEXT_TYPE_psk_kex_modes, ssl, 4094 if (!client_funcs->needs(ssl, SSL_TLSEXT_MSG_CH)) {
4156 SSL_TLSEXT_MSG_CH)) {
4157 FAIL("client should need psk kex modes with TLSv1.3\n"); 4095 FAIL("client should need psk kex modes with TLSv1.3\n");
4158 goto err; 4096 goto err;
4159 } 4097 }
4160 4098
4161 /* Make sure we can build psk modes with DHE key establishment. */ 4099 /* Make sure we can build psk modes with DHE key establishment. */
4162 4100
4163 if (!tls_extension_client_build(TLSEXT_TYPE_psk_kex_modes, ssl, 4101 if (!client_funcs->build(ssl, SSL_TLSEXT_MSG_CH, &cbb)) {
4164 SSL_TLSEXT_MSG_CH, &cbb)) {
4165 FAIL("client failed to build psk kex modes\n"); 4102 FAIL("client failed to build psk kex modes\n");
4166 goto err; 4103 goto err;
4167 } 4104 }
@@ -4197,8 +4134,7 @@ test_tlsext_psk_modes_client(void)
4197 4134
4198 CBS_init(&cbs, tlsext_default_psk_modes, 4135 CBS_init(&cbs, tlsext_default_psk_modes,
4199 sizeof(tlsext_default_psk_modes)); 4136 sizeof(tlsext_default_psk_modes));
4200 if (!tls_extension_server_parse(TLSEXT_TYPE_psk_kex_modes, ssl, 4137 if (!server_funcs->parse(ssl, SSL_TLSEXT_MSG_CH, &cbs, &alert)) {
4201 SSL_TLSEXT_MSG_CH, &cbs, &alert)) {
4202 FAIL("failed to parse psk kex modes\n"); 4138 FAIL("failed to parse psk kex modes\n");
4203 goto err; 4139 goto err;
4204 } 4140 }
@@ -4220,8 +4156,7 @@ test_tlsext_psk_modes_client(void)
4220 ssl->s3->hs.tls13.use_psk_dhe_ke = 0; 4156 ssl->s3->hs.tls13.use_psk_dhe_ke = 0;
4221 4157
4222 CBS_init(&cbs, tlsext_psk_only_mode, sizeof(tlsext_psk_only_mode)); 4158 CBS_init(&cbs, tlsext_psk_only_mode, sizeof(tlsext_psk_only_mode));
4223 if (!tls_extension_server_parse(TLSEXT_TYPE_psk_kex_modes, ssl, 4159 if (!server_funcs->parse(ssl, SSL_TLSEXT_MSG_CH, &cbs, &alert)) {
4224 SSL_TLSEXT_MSG_CH, &cbs, &alert)) {
4225 FAIL("failed to parse psk kex modes\n"); 4160 FAIL("failed to parse psk kex modes\n");
4226 goto err; 4161 goto err;
4227 } 4162 }
@@ -4243,8 +4178,7 @@ test_tlsext_psk_modes_client(void)
4243 ssl->s3->hs.tls13.use_psk_dhe_ke = 0; 4178 ssl->s3->hs.tls13.use_psk_dhe_ke = 0;
4244 4179
4245 CBS_init(&cbs, tlsext_psk_both_modes, sizeof(tlsext_psk_both_modes)); 4180 CBS_init(&cbs, tlsext_psk_both_modes, sizeof(tlsext_psk_both_modes));
4246 if (!tls_extension_server_parse(TLSEXT_TYPE_psk_kex_modes, ssl, 4181 if (!server_funcs->parse(ssl, SSL_TLSEXT_MSG_CH, &cbs, &alert)) {
4247 SSL_TLSEXT_MSG_CH, &cbs, &alert)) {
4248 FAIL("failed to parse psk kex modes\n"); 4182 FAIL("failed to parse psk kex modes\n");
4249 goto err; 4183 goto err;
4250 } 4184 }
@@ -4273,6 +4207,8 @@ test_tlsext_psk_modes_server(void)
4273{ 4207{
4274 SSL_CTX *ssl_ctx = NULL; 4208 SSL_CTX *ssl_ctx = NULL;
4275 SSL *ssl = NULL; 4209 SSL *ssl = NULL;
4210 const struct tls_extension_funcs *client_funcs;
4211 const struct tls_extension_funcs *server_funcs;
4276 int failure; 4212 int failure;
4277 4213
4278 failure = 1; 4214 failure = 1;
@@ -4282,8 +4218,11 @@ test_tlsext_psk_modes_server(void)
4282 if ((ssl = SSL_new(ssl_ctx)) == NULL) 4218 if ((ssl = SSL_new(ssl_ctx)) == NULL)
4283 errx(1, "failed to create SSL"); 4219 errx(1, "failed to create SSL");
4284 4220
4285 if (tls_extension_server_needs(TLSEXT_TYPE_psk_kex_modes, ssl, 4221 if (!tls_extension_funcs(TLSEXT_TYPE_psk_kex_modes, &client_funcs,
4286 SSL_TLSEXT_MSG_SH)) { 4222 &server_funcs))
4223 errx(1, "failed to fetch psk funcs");
4224
4225 if (server_funcs->needs(ssl, SSL_TLSEXT_MSG_SH)) {
4287 FAIL("server should not need psk kex modes\n"); 4226 FAIL("server should not need psk kex modes\n");
4288 goto err; 4227 goto err;
4289 } 4228 }
generated by cgit v1.2.3-55-g6feb (git 2.39.1) at 2025-03-20 22:59:51 +0000