summaryrefslogtreecommitdiff
diff options
context:
space:
mode:
Diffstat
-rw-r--r--src/lib/libssl/ssl_tlsext.c174
-rw-r--r--src/lib/libssl/ssl_tlsext.h174
2 files changed, 181 insertions, 167 deletions
diff --git a/src/lib/libssl/ssl_tlsext.c b/src/lib/libssl/ssl_tlsext.c
index 2b91a087af..d291f1d0c4 100644
--- a/src/lib/libssl/ssl_tlsext.c
+++ b/src/lib/libssl/ssl_tlsext.c
@@ -1,4 +1,4 @@
1/* $OpenBSD: ssl_tlsext.c,v 1.76 2020/07/03 04:12:51 tb Exp $ */ 1/* $OpenBSD: ssl_tlsext.c,v 1.77 2020/07/03 04:51:59 tb Exp $ */
2/* 2/*
3 * Copyright (c) 2016, 2017, 2019 Joel Sing <jsing@openbsd.org> 3 * Copyright (c) 2016, 2017, 2019 Joel Sing <jsing@openbsd.org>
4 * Copyright (c) 2017 Doug Hogan <doug@openbsd.org> 4 * Copyright (c) 2017 Doug Hogan <doug@openbsd.org>
@@ -32,7 +32,7 @@
32 */ 32 */
33 33
34int 34int
35tlsext_alpn_client_needs(SSL *s) 35tlsext_alpn_client_needs(SSL *s, uint16_t msg_type)
36{ 36{
37 /* ALPN protos have been specified and this is the initial handshake */ 37 /* ALPN protos have been specified and this is the initial handshake */
38 return s->internal->alpn_client_proto_list != NULL && 38 return s->internal->alpn_client_proto_list != NULL &&
@@ -40,7 +40,7 @@ tlsext_alpn_client_needs(SSL *s)
40} 40}
41 41
42int 42int
43tlsext_alpn_client_build(SSL *s, CBB *cbb) 43tlsext_alpn_client_build(SSL *s, uint16_t msg_type, CBB *cbb)
44{ 44{
45 CBB protolist; 45 CBB protolist;
46 46
@@ -58,7 +58,7 @@ tlsext_alpn_client_build(SSL *s, CBB *cbb)
58} 58}
59 59
60int 60int
61tlsext_alpn_server_parse(SSL *s, CBS *cbs, int *alert) 61tlsext_alpn_server_parse(SSL *s, uint16_t msg_types, CBS *cbs, int *alert)
62{ 62{
63 CBS proto_name_list, alpn; 63 CBS proto_name_list, alpn;
64 const unsigned char *selected; 64 const unsigned char *selected;
@@ -106,13 +106,13 @@ tlsext_alpn_server_parse(SSL *s, CBS *cbs, int *alert)
106} 106}
107 107
108int 108int
109tlsext_alpn_server_needs(SSL *s) 109tlsext_alpn_server_needs(SSL *s, uint16_t msg_type)
110{ 110{
111 return S3I(s)->alpn_selected != NULL; 111 return S3I(s)->alpn_selected != NULL;
112} 112}
113 113
114int 114int
115tlsext_alpn_server_build(SSL *s, CBB *cbb) 115tlsext_alpn_server_build(SSL *s, uint16_t msg_type, CBB *cbb)
116{ 116{
117 CBB list, selected; 117 CBB list, selected;
118 118
@@ -133,7 +133,7 @@ tlsext_alpn_server_build(SSL *s, CBB *cbb)
133} 133}
134 134
135int 135int
136tlsext_alpn_client_parse(SSL *s, CBS *cbs, int *alert) 136tlsext_alpn_client_parse(SSL *s, uint16_t msg_type, CBS *cbs, int *alert)
137{ 137{
138 CBS list, proto; 138 CBS list, proto;
139 139
@@ -170,14 +170,14 @@ tlsext_alpn_client_parse(SSL *s, CBS *cbs, int *alert)
170 * Supported Groups - RFC 7919 section 2 170 * Supported Groups - RFC 7919 section 2
171 */ 171 */
172int 172int
173tlsext_supportedgroups_client_needs(SSL *s) 173tlsext_supportedgroups_client_needs(SSL *s, uint16_t msg_type)
174{ 174{
175 return ssl_has_ecc_ciphers(s) || 175 return ssl_has_ecc_ciphers(s) ||
176 (S3I(s)->hs_tls13.max_version >= TLS1_3_VERSION); 176 (S3I(s)->hs_tls13.max_version >= TLS1_3_VERSION);
177} 177}
178 178
179int 179int
180tlsext_supportedgroups_client_build(SSL *s, CBB *cbb) 180tlsext_supportedgroups_client_build(SSL *s, uint16_t msg_type, CBB *cbb)
181{ 181{
182 const uint16_t *groups; 182 const uint16_t *groups;
183 size_t groups_len; 183 size_t groups_len;
@@ -205,7 +205,8 @@ tlsext_supportedgroups_client_build(SSL *s, CBB *cbb)
205} 205}
206 206
207int 207int
208tlsext_supportedgroups_server_parse(SSL *s, CBS *cbs, int *alert) 208tlsext_supportedgroups_server_parse(SSL *s, uint16_t msg_type, CBS *cbs,
209 int *alert)
209{ 210{
210 CBS grouplist; 211 CBS grouplist;
211 size_t groups_len; 212 size_t groups_len;
@@ -285,19 +286,20 @@ tlsext_supportedgroups_server_parse(SSL *s, CBS *cbs, int *alert)
285 286
286/* This extension is never used by the server. */ 287/* This extension is never used by the server. */
287int 288int
288tlsext_supportedgroups_server_needs(SSL *s) 289tlsext_supportedgroups_server_needs(SSL *s, uint16_t msg_type)
289{ 290{
290 return 0; 291 return 0;
291} 292}
292 293
293int 294int
294tlsext_supportedgroups_server_build(SSL *s, CBB *cbb) 295tlsext_supportedgroups_server_build(SSL *s, uint16_t msg_type, CBB *cbb)
295{ 296{
296 return 0; 297 return 0;
297} 298}
298 299
299int 300int
300tlsext_supportedgroups_client_parse(SSL *s, CBS *cbs, int *alert) 301tlsext_supportedgroups_client_parse(SSL *s, uint16_t msg_type, CBS *cbs,
302 int *alert)
301{ 303{
302 /* 304 /*
303 * Servers should not send this extension per the RFC. 305 * Servers should not send this extension per the RFC.
@@ -321,7 +323,7 @@ tlsext_supportedgroups_client_parse(SSL *s, CBS *cbs, int *alert)
321 * Supported Point Formats Extension - RFC 4492 section 5.1.2 323 * Supported Point Formats Extension - RFC 4492 section 5.1.2
322 */ 324 */
323static int 325static int
324tlsext_ecpf_build(SSL *s, CBB *cbb) 326tlsext_ecpf_build(SSL *s, uint16_t msg_type, CBB *cbb)
325{ 327{
326 CBB ecpf; 328 CBB ecpf;
327 size_t formats_len; 329 size_t formats_len;
@@ -345,7 +347,7 @@ tlsext_ecpf_build(SSL *s, CBB *cbb)
345} 347}
346 348
347static int 349static int
348tlsext_ecpf_parse(SSL *s, CBS *cbs, int *alert) 350tlsext_ecpf_parse(SSL *s, uint16_t msg_type, CBS *cbs, int *alert)
349{ 351{
350 CBS ecpf; 352 CBS ecpf;
351 353
@@ -378,25 +380,25 @@ tlsext_ecpf_parse(SSL *s, CBS *cbs, int *alert)
378} 380}
379 381
380int 382int
381tlsext_ecpf_client_needs(SSL *s) 383tlsext_ecpf_client_needs(SSL *s, uint16_t msg_type)
382{ 384{
383 return ssl_has_ecc_ciphers(s); 385 return ssl_has_ecc_ciphers(s);
384} 386}
385 387
386int 388int
387tlsext_ecpf_client_build(SSL *s, CBB *cbb) 389tlsext_ecpf_client_build(SSL *s, uint16_t msg_type, CBB *cbb)
388{ 390{
389 return tlsext_ecpf_build(s, cbb); 391 return tlsext_ecpf_build(s, msg_type, cbb);
390} 392}
391 393
392int 394int
393tlsext_ecpf_server_parse(SSL *s, CBS *cbs, int *alert) 395tlsext_ecpf_server_parse(SSL *s, uint16_t msg_type, CBS *cbs, int *alert)
394{ 396{
395 return tlsext_ecpf_parse(s, cbs, alert); 397 return tlsext_ecpf_parse(s, msg_type, cbs, alert);
396} 398}
397 399
398int 400int
399tlsext_ecpf_server_needs(SSL *s) 401tlsext_ecpf_server_needs(SSL *s, uint16_t msg_type)
400{ 402{
401 if (s->version == DTLS1_VERSION) 403 if (s->version == DTLS1_VERSION)
402 return 0; 404 return 0;
@@ -405,28 +407,28 @@ tlsext_ecpf_server_needs(SSL *s)
405} 407}
406 408
407int 409int
408tlsext_ecpf_server_build(SSL *s, CBB *cbb) 410tlsext_ecpf_server_build(SSL *s, uint16_t msg_type, CBB *cbb)
409{ 411{
410 return tlsext_ecpf_build(s, cbb); 412 return tlsext_ecpf_build(s, msg_type, cbb);
411} 413}
412 414
413int 415int
414tlsext_ecpf_client_parse(SSL *s, CBS *cbs, int *alert) 416tlsext_ecpf_client_parse(SSL *s, uint16_t msg_type, CBS *cbs, int *alert)
415{ 417{
416 return tlsext_ecpf_parse(s, cbs, alert); 418 return tlsext_ecpf_parse(s, msg_type, cbs, alert);
417} 419}
418 420
419/* 421/*
420 * Renegotiation Indication - RFC 5746. 422 * Renegotiation Indication - RFC 5746.
421 */ 423 */
422int 424int
423tlsext_ri_client_needs(SSL *s) 425tlsext_ri_client_needs(SSL *s, uint16_t msg_type)
424{ 426{
425 return (s->internal->renegotiate); 427 return (s->internal->renegotiate);
426} 428}
427 429
428int 430int
429tlsext_ri_client_build(SSL *s, CBB *cbb) 431tlsext_ri_client_build(SSL *s, uint16_t msg_type, CBB *cbb)
430{ 432{
431 CBB reneg; 433 CBB reneg;
432 434
@@ -442,7 +444,7 @@ tlsext_ri_client_build(SSL *s, CBB *cbb)
442} 444}
443 445
444int 446int
445tlsext_ri_server_parse(SSL *s, CBS *cbs, int *alert) 447tlsext_ri_server_parse(SSL *s, uint16_t msg_type, CBS *cbs, int *alert)
446{ 448{
447 CBS reneg; 449 CBS reneg;
448 450
@@ -470,13 +472,13 @@ tlsext_ri_server_parse(SSL *s, CBS *cbs, int *alert)
470} 472}
471 473
472int 474int
473tlsext_ri_server_needs(SSL *s) 475tlsext_ri_server_needs(SSL *s, uint16_t msg_type)
474{ 476{
475 return (s->version < TLS1_3_VERSION && S3I(s)->send_connection_binding); 477 return (s->version < TLS1_3_VERSION && S3I(s)->send_connection_binding);
476} 478}
477 479
478int 480int
479tlsext_ri_server_build(SSL *s, CBB *cbb) 481tlsext_ri_server_build(SSL *s, uint16_t msg_type, CBB *cbb)
480{ 482{
481 CBB reneg; 483 CBB reneg;
482 484
@@ -495,7 +497,7 @@ tlsext_ri_server_build(SSL *s, CBB *cbb)
495} 497}
496 498
497int 499int
498tlsext_ri_client_parse(SSL *s, CBS *cbs, int *alert) 500tlsext_ri_client_parse(SSL *s, uint16_t msg_type, CBS *cbs, int *alert)
499{ 501{
500 CBS reneg, prev_client, prev_server; 502 CBS reneg, prev_client, prev_server;
501 503
@@ -552,13 +554,13 @@ tlsext_ri_client_parse(SSL *s, CBS *cbs, int *alert)
552 * Signature Algorithms - RFC 5246 section 7.4.1.4.1. 554 * Signature Algorithms - RFC 5246 section 7.4.1.4.1.
553 */ 555 */
554int 556int
555tlsext_sigalgs_client_needs(SSL *s) 557tlsext_sigalgs_client_needs(SSL *s, uint16_t msg_type)
556{ 558{
557 return (TLS1_get_client_version(s) >= TLS1_2_VERSION); 559 return (TLS1_get_client_version(s) >= TLS1_2_VERSION);
558} 560}
559 561
560int 562int
561tlsext_sigalgs_client_build(SSL *s, CBB *cbb) 563tlsext_sigalgs_client_build(SSL *s, uint16_t msg_type, CBB *cbb)
562{ 564{
563 uint16_t *tls_sigalgs = tls12_sigalgs; 565 uint16_t *tls_sigalgs = tls12_sigalgs;
564 size_t tls_sigalgs_len = tls12_sigalgs_len; 566 size_t tls_sigalgs_len = tls12_sigalgs_len;
@@ -583,7 +585,7 @@ tlsext_sigalgs_client_build(SSL *s, CBB *cbb)
583} 585}
584 586
585int 587int
586tlsext_sigalgs_server_parse(SSL *s, CBS *cbs, int *alert) 588tlsext_sigalgs_server_parse(SSL *s, uint16_t msg_type, CBS *cbs, int *alert)
587{ 589{
588 CBS sigalgs; 590 CBS sigalgs;
589 591
@@ -598,13 +600,13 @@ tlsext_sigalgs_server_parse(SSL *s, CBS *cbs, int *alert)
598} 600}
599 601
600int 602int
601tlsext_sigalgs_server_needs(SSL *s) 603tlsext_sigalgs_server_needs(SSL *s, uint16_t msg_type)
602{ 604{
603 return (s->version >= TLS1_3_VERSION); 605 return (s->version >= TLS1_3_VERSION);
604} 606}
605 607
606int 608int
607tlsext_sigalgs_server_build(SSL *s, CBB *cbb) 609tlsext_sigalgs_server_build(SSL *s, uint16_t msg_type, CBB *cbb)
608{ 610{
609 uint16_t *tls_sigalgs = tls12_sigalgs; 611 uint16_t *tls_sigalgs = tls12_sigalgs;
610 size_t tls_sigalgs_len = tls12_sigalgs_len; 612 size_t tls_sigalgs_len = tls12_sigalgs_len;
@@ -628,7 +630,7 @@ tlsext_sigalgs_server_build(SSL *s, CBB *cbb)
628} 630}
629 631
630int 632int
631tlsext_sigalgs_client_parse(SSL *s, CBS *cbs, int *alert) 633tlsext_sigalgs_client_parse(SSL *s, uint16_t msg_type, CBS *cbs, int *alert)
632{ 634{
633 CBS sigalgs; 635 CBS sigalgs;
634 636
@@ -649,13 +651,13 @@ tlsext_sigalgs_client_parse(SSL *s, CBS *cbs, int *alert)
649 * Server Name Indication - RFC 6066, section 3. 651 * Server Name Indication - RFC 6066, section 3.
650 */ 652 */
651int 653int
652tlsext_sni_client_needs(SSL *s) 654tlsext_sni_client_needs(SSL *s, uint16_t msg_type)
653{ 655{
654 return (s->tlsext_hostname != NULL); 656 return (s->tlsext_hostname != NULL);
655} 657}
656 658
657int 659int
658tlsext_sni_client_build(SSL *s, CBB *cbb) 660tlsext_sni_client_build(SSL *s, uint16_t msg_type, CBB *cbb)
659{ 661{
660 CBB server_name_list, host_name; 662 CBB server_name_list, host_name;
661 663
@@ -724,7 +726,7 @@ tlsext_sni_is_valid_hostname(CBS *cbs)
724} 726}
725 727
726int 728int
727tlsext_sni_server_parse(SSL *s, CBS *cbs, int *alert) 729tlsext_sni_server_parse(SSL *s, uint16_t msg_type, CBS *cbs, int *alert)
728{ 730{
729 CBS server_name_list, host_name; 731 CBS server_name_list, host_name;
730 uint8_t name_type; 732 uint8_t name_type;
@@ -796,7 +798,7 @@ tlsext_sni_server_parse(SSL *s, CBS *cbs, int *alert)
796} 798}
797 799
798int 800int
799tlsext_sni_server_needs(SSL *s) 801tlsext_sni_server_needs(SSL *s, uint16_t msg_type)
800{ 802{
801 if (s->internal->hit) 803 if (s->internal->hit)
802 return 0; 804 return 0;
@@ -805,13 +807,13 @@ tlsext_sni_server_needs(SSL *s)
805} 807}
806 808
807int 809int
808tlsext_sni_server_build(SSL *s, CBB *cbb) 810tlsext_sni_server_build(SSL *s, uint16_t msg_type, CBB *cbb)
809{ 811{
810 return 1; 812 return 1;
811} 813}
812 814
813int 815int
814tlsext_sni_client_parse(SSL *s, CBS *cbs, int *alert) 816tlsext_sni_client_parse(SSL *s, uint16_t msg_type, CBS *cbs, int *alert)
815{ 817{
816 if (s->tlsext_hostname == NULL || CBS_len(cbs) != 0) { 818 if (s->tlsext_hostname == NULL || CBS_len(cbs) != 0) {
817 *alert = TLS1_AD_UNRECOGNIZED_NAME; 819 *alert = TLS1_AD_UNRECOGNIZED_NAME;
@@ -849,14 +851,14 @@ tlsext_sni_client_parse(SSL *s, CBS *cbs, int *alert)
849 */ 851 */
850 852
851int 853int
852tlsext_ocsp_client_needs(SSL *s) 854tlsext_ocsp_client_needs(SSL *s, uint16_t msg_type)
853{ 855{
854 return (s->tlsext_status_type == TLSEXT_STATUSTYPE_ocsp && 856 return (s->tlsext_status_type == TLSEXT_STATUSTYPE_ocsp &&
855 s->version != DTLS1_VERSION); 857 s->version != DTLS1_VERSION);
856} 858}
857 859
858int 860int
859tlsext_ocsp_client_build(SSL *s, CBB *cbb) 861tlsext_ocsp_client_build(SSL *s, uint16_t msg_type, CBB *cbb)
860{ 862{
861 CBB respid_list, respid, exts; 863 CBB respid_list, respid, exts;
862 unsigned char *ext_data; 864 unsigned char *ext_data;
@@ -900,7 +902,7 @@ tlsext_ocsp_client_build(SSL *s, CBB *cbb)
900} 902}
901 903
902int 904int
903tlsext_ocsp_server_parse(SSL *s, CBS *cbs, int *alert) 905tlsext_ocsp_server_parse(SSL *s, uint16_t msg_type, CBS *cbs, int *alert)
904{ 906{
905 int alert_desc = SSL_AD_DECODE_ERROR; 907 int alert_desc = SSL_AD_DECODE_ERROR;
906 CBS respid_list, respid, exts; 908 CBS respid_list, respid, exts;
@@ -974,7 +976,7 @@ tlsext_ocsp_server_parse(SSL *s, CBS *cbs, int *alert)
974} 976}
975 977
976int 978int
977tlsext_ocsp_server_needs(SSL *s) 979tlsext_ocsp_server_needs(SSL *s, uint16_t msg_type)
978{ 980{
979 if (s->version >= TLS1_3_VERSION && 981 if (s->version >= TLS1_3_VERSION &&
980 s->tlsext_status_type == TLSEXT_STATUSTYPE_ocsp && 982 s->tlsext_status_type == TLSEXT_STATUSTYPE_ocsp &&
@@ -989,7 +991,7 @@ tlsext_ocsp_server_needs(SSL *s)
989} 991}
990 992
991int 993int
992tlsext_ocsp_server_build(SSL *s, CBB *cbb) 994tlsext_ocsp_server_build(SSL *s, uint16_t msg_type, CBB *cbb)
993{ 995{
994 CBB ocsp_response; 996 CBB ocsp_response;
995 997
@@ -1009,7 +1011,7 @@ tlsext_ocsp_server_build(SSL *s, CBB *cbb)
1009} 1011}
1010 1012
1011int 1013int
1012tlsext_ocsp_client_parse(SSL *s, CBS *cbs, int *alert) 1014tlsext_ocsp_client_parse(SSL *s, uint16_t msg_type, CBS *cbs, int *alert)
1013{ 1015{
1014 CBS response; 1016 CBS response;
1015 uint16_t version = TLS1_get_client_version(s); 1017 uint16_t version = TLS1_get_client_version(s);
@@ -1052,7 +1054,7 @@ tlsext_ocsp_client_parse(SSL *s, CBS *cbs, int *alert)
1052 * SessionTicket extension - RFC 5077 section 3.2 1054 * SessionTicket extension - RFC 5077 section 3.2
1053 */ 1055 */
1054int 1056int
1055tlsext_sessionticket_client_needs(SSL *s) 1057tlsext_sessionticket_client_needs(SSL *s, uint16_t msg_type)
1056{ 1058{
1057 /* 1059 /*
1058 * Send session ticket extension when enabled and not overridden. 1060 * Send session ticket extension when enabled and not overridden.
@@ -1073,7 +1075,7 @@ tlsext_sessionticket_client_needs(SSL *s)
1073} 1075}
1074 1076
1075int 1077int
1076tlsext_sessionticket_client_build(SSL *s, CBB *cbb) 1078tlsext_sessionticket_client_build(SSL *s, uint16_t msg_type, CBB *cbb)
1077{ 1079{
1078 /* 1080 /*
1079 * Signal that we support session tickets by sending an empty 1081 * Signal that we support session tickets by sending an empty
@@ -1116,7 +1118,8 @@ tlsext_sessionticket_client_build(SSL *s, CBB *cbb)
1116} 1118}
1117 1119
1118int 1120int
1119tlsext_sessionticket_server_parse(SSL *s, CBS *cbs, int *alert) 1121tlsext_sessionticket_server_parse(SSL *s, uint16_t msg_type, CBS *cbs,
1122 int *alert)
1120{ 1123{
1121 if (s->internal->tls_session_ticket_ext_cb) { 1124 if (s->internal->tls_session_ticket_ext_cb) {
1122 if (!s->internal->tls_session_ticket_ext_cb(s, CBS_data(cbs), 1125 if (!s->internal->tls_session_ticket_ext_cb(s, CBS_data(cbs),
@@ -1137,21 +1140,22 @@ tlsext_sessionticket_server_parse(SSL *s, CBS *cbs, int *alert)
1137} 1140}
1138 1141
1139int 1142int
1140tlsext_sessionticket_server_needs(SSL *s) 1143tlsext_sessionticket_server_needs(SSL *s, uint16_t msg_type)
1141{ 1144{
1142 return (s->internal->tlsext_ticket_expected && 1145 return (s->internal->tlsext_ticket_expected &&
1143 !(SSL_get_options(s) & SSL_OP_NO_TICKET)); 1146 !(SSL_get_options(s) & SSL_OP_NO_TICKET));
1144} 1147}
1145 1148
1146int 1149int
1147tlsext_sessionticket_server_build(SSL *s, CBB *cbb) 1150tlsext_sessionticket_server_build(SSL *s, uint16_t msg_type, CBB *cbb)
1148{ 1151{
1149 /* Empty ticket */ 1152 /* Empty ticket */
1150 return 1; 1153 return 1;
1151} 1154}
1152 1155
1153int 1156int
1154tlsext_sessionticket_client_parse(SSL *s, CBS *cbs, int *alert) 1157tlsext_sessionticket_client_parse(SSL *s, uint16_t msg_type, CBS *cbs,
1158 int *alert)
1155{ 1159{
1156 if (s->internal->tls_session_ticket_ext_cb) { 1160 if (s->internal->tls_session_ticket_ext_cb) {
1157 if (!s->internal->tls_session_ticket_ext_cb(s, CBS_data(cbs), 1161 if (!s->internal->tls_session_ticket_ext_cb(s, CBS_data(cbs),
@@ -1179,13 +1183,13 @@ tlsext_sessionticket_client_parse(SSL *s, CBS *cbs, int *alert)
1179#ifndef OPENSSL_NO_SRTP 1183#ifndef OPENSSL_NO_SRTP
1180 1184
1181int 1185int
1182tlsext_srtp_client_needs(SSL *s) 1186tlsext_srtp_client_needs(SSL *s, uint16_t msg_type)
1183{ 1187{
1184 return SSL_IS_DTLS(s) && SSL_get_srtp_profiles(s) != NULL; 1188 return SSL_IS_DTLS(s) && SSL_get_srtp_profiles(s) != NULL;
1185} 1189}
1186 1190
1187int 1191int
1188tlsext_srtp_client_build(SSL *s, CBB *cbb) 1192tlsext_srtp_client_build(SSL *s, uint16_t msg_type, CBB *cbb)
1189{ 1193{
1190 CBB profiles, mki; 1194 CBB profiles, mki;
1191 int ct, i; 1195 int ct, i;
@@ -1222,7 +1226,7 @@ tlsext_srtp_client_build(SSL *s, CBB *cbb)
1222} 1226}
1223 1227
1224int 1228int
1225tlsext_srtp_server_parse(SSL *s, CBS *cbs, int *alert) 1229tlsext_srtp_server_parse(SSL *s, uint16_t msg_type, CBS *cbs, int *alert)
1226{ 1230{
1227 SRTP_PROTECTION_PROFILE *cprof, *sprof; 1231 SRTP_PROTECTION_PROFILE *cprof, *sprof;
1228 STACK_OF(SRTP_PROTECTION_PROFILE) *clnt = NULL, *srvr; 1232 STACK_OF(SRTP_PROTECTION_PROFILE) *clnt = NULL, *srvr;
@@ -1302,13 +1306,13 @@ tlsext_srtp_server_parse(SSL *s, CBS *cbs, int *alert)
1302} 1306}
1303 1307
1304int 1308int
1305tlsext_srtp_server_needs(SSL *s) 1309tlsext_srtp_server_needs(SSL *s, uint16_t msg_type)
1306{ 1310{
1307 return SSL_IS_DTLS(s) && SSL_get_selected_srtp_profile(s) != NULL; 1311 return SSL_IS_DTLS(s) && SSL_get_selected_srtp_profile(s) != NULL;
1308} 1312}
1309 1313
1310int 1314int
1311tlsext_srtp_server_build(SSL *s, CBB *cbb) 1315tlsext_srtp_server_build(SSL *s, uint16_t msg_type, CBB *cbb)
1312{ 1316{
1313 SRTP_PROTECTION_PROFILE *profile; 1317 SRTP_PROTECTION_PROFILE *profile;
1314 CBB srtp, mki; 1318 CBB srtp, mki;
@@ -1332,7 +1336,7 @@ tlsext_srtp_server_build(SSL *s, CBB *cbb)
1332} 1336}
1333 1337
1334int 1338int
1335tlsext_srtp_client_parse(SSL *s, CBS *cbs, int *alert) 1339tlsext_srtp_client_parse(SSL *s, uint16_t msg_type, CBS *cbs, int *alert)
1336{ 1340{
1337 STACK_OF(SRTP_PROTECTION_PROFILE) *clnt; 1341 STACK_OF(SRTP_PROTECTION_PROFILE) *clnt;
1338 SRTP_PROTECTION_PROFILE *prof; 1342 SRTP_PROTECTION_PROFILE *prof;
@@ -1386,7 +1390,7 @@ tlsext_srtp_client_parse(SSL *s, CBS *cbs, int *alert)
1386 * TLSv1.3 Key Share - RFC 8446 section 4.2.8. 1390 * TLSv1.3 Key Share - RFC 8446 section 4.2.8.
1387 */ 1391 */
1388int 1392int
1389tlsext_keyshare_client_needs(SSL *s) 1393tlsext_keyshare_client_needs(SSL *s, uint16_t msg_type)
1390{ 1394{
1391 /* XXX once this gets initialized when we get tls13_client.c */ 1395 /* XXX once this gets initialized when we get tls13_client.c */
1392 if (S3I(s)->hs_tls13.max_version == 0) 1396 if (S3I(s)->hs_tls13.max_version == 0)
@@ -1396,7 +1400,7 @@ tlsext_keyshare_client_needs(SSL *s)
1396} 1400}
1397 1401
1398int 1402int
1399tlsext_keyshare_client_build(SSL *s, CBB *cbb) 1403tlsext_keyshare_client_build(SSL *s, uint16_t msg_type, CBB *cbb)
1400{ 1404{
1401 CBB client_shares; 1405 CBB client_shares;
1402 1406
@@ -1414,7 +1418,7 @@ tlsext_keyshare_client_build(SSL *s, CBB *cbb)
1414} 1418}
1415 1419
1416int 1420int
1417tlsext_keyshare_server_parse(SSL *s, CBS *cbs, int *alert) 1421tlsext_keyshare_server_parse(SSL *s, uint16_t msg_type, CBS *cbs, int *alert)
1418{ 1422{
1419 CBS client_shares, key_exchange; 1423 CBS client_shares, key_exchange;
1420 uint16_t group; 1424 uint16_t group;
@@ -1465,7 +1469,7 @@ tlsext_keyshare_server_parse(SSL *s, CBS *cbs, int *alert)
1465} 1469}
1466 1470
1467int 1471int
1468tlsext_keyshare_server_needs(SSL *s) 1472tlsext_keyshare_server_needs(SSL *s, uint16_t msg_type)
1469{ 1473{
1470 if (SSL_IS_DTLS(s) || s->version < TLS1_3_VERSION) 1474 if (SSL_IS_DTLS(s) || s->version < TLS1_3_VERSION)
1471 return 0; 1475 return 0;
@@ -1474,7 +1478,7 @@ tlsext_keyshare_server_needs(SSL *s)
1474} 1478}
1475 1479
1476int 1480int
1477tlsext_keyshare_server_build(SSL *s, CBB *cbb) 1481tlsext_keyshare_server_build(SSL *s, uint16_t msg_type, CBB *cbb)
1478{ 1482{
1479 /* In the case of a HRR, we only send the server selected group. */ 1483 /* In the case of a HRR, we only send the server selected group. */
1480 if (S3I(s)->hs_tls13.hrr) { 1484 if (S3I(s)->hs_tls13.hrr) {
@@ -1493,7 +1497,7 @@ tlsext_keyshare_server_build(SSL *s, CBB *cbb)
1493} 1497}
1494 1498
1495int 1499int
1496tlsext_keyshare_client_parse(SSL *s, CBS *cbs, int *alert) 1500tlsext_keyshare_client_parse(SSL *s, uint16_t msg_type, CBS *cbs, int *alert)
1497{ 1501{
1498 CBS key_exchange; 1502 CBS key_exchange;
1499 uint16_t group; 1503 uint16_t group;
@@ -1530,7 +1534,7 @@ tlsext_keyshare_client_parse(SSL *s, CBS *cbs, int *alert)
1530 * Supported Versions - RFC 8446 section 4.2.1. 1534 * Supported Versions - RFC 8446 section 4.2.1.
1531 */ 1535 */
1532int 1536int
1533tlsext_versions_client_needs(SSL *s) 1537tlsext_versions_client_needs(SSL *s, uint16_t msg_type)
1534{ 1538{
1535 if (SSL_IS_DTLS(s)) 1539 if (SSL_IS_DTLS(s))
1536 return 0; 1540 return 0;
@@ -1538,7 +1542,7 @@ tlsext_versions_client_needs(SSL *s)
1538} 1542}
1539 1543
1540int 1544int
1541tlsext_versions_client_build(SSL *s, CBB *cbb) 1545tlsext_versions_client_build(SSL *s, uint16_t msg_type, CBB *cbb)
1542{ 1546{
1543 uint16_t max, min; 1547 uint16_t max, min;
1544 uint16_t version; 1548 uint16_t version;
@@ -1566,7 +1570,7 @@ tlsext_versions_client_build(SSL *s, CBB *cbb)
1566} 1570}
1567 1571
1568int 1572int
1569tlsext_versions_server_parse(SSL *s, CBS *cbs, int *alert) 1573tlsext_versions_server_parse(SSL *s, uint16_t msg_type, CBS *cbs, int *alert)
1570{ 1574{
1571 CBS versions; 1575 CBS versions;
1572 uint16_t version; 1576 uint16_t version;
@@ -1613,13 +1617,13 @@ tlsext_versions_server_parse(SSL *s, CBS *cbs, int *alert)
1613} 1617}
1614 1618
1615int 1619int
1616tlsext_versions_server_needs(SSL *s) 1620tlsext_versions_server_needs(SSL *s, uint16_t msg_type)
1617{ 1621{
1618 return (!SSL_IS_DTLS(s) && s->version >= TLS1_3_VERSION); 1622 return (!SSL_IS_DTLS(s) && s->version >= TLS1_3_VERSION);
1619} 1623}
1620 1624
1621int 1625int
1622tlsext_versions_server_build(SSL *s, CBB *cbb) 1626tlsext_versions_server_build(SSL *s, uint16_t msg_type, CBB *cbb)
1623{ 1627{
1624 if (!CBB_add_u16(cbb, TLS1_3_VERSION)) 1628 if (!CBB_add_u16(cbb, TLS1_3_VERSION))
1625 return 0; 1629 return 0;
@@ -1629,7 +1633,7 @@ tlsext_versions_server_build(SSL *s, CBB *cbb)
1629} 1633}
1630 1634
1631int 1635int
1632tlsext_versions_client_parse(SSL *s, CBS *cbs, int *alert) 1636tlsext_versions_client_parse(SSL *s, uint16_t msg_type, CBS *cbs, int *alert)
1633{ 1637{
1634 uint16_t selected_version; 1638 uint16_t selected_version;
1635 1639
@@ -1655,7 +1659,7 @@ tlsext_versions_client_parse(SSL *s, CBS *cbs, int *alert)
1655 */ 1659 */
1656 1660
1657int 1661int
1658tlsext_cookie_client_needs(SSL *s) 1662tlsext_cookie_client_needs(SSL *s, uint16_t msg_type)
1659{ 1663{
1660 if (SSL_IS_DTLS(s)) 1664 if (SSL_IS_DTLS(s))
1661 return 0; 1665 return 0;
@@ -1666,7 +1670,7 @@ tlsext_cookie_client_needs(SSL *s)
1666} 1670}
1667 1671
1668int 1672int
1669tlsext_cookie_client_build(SSL *s, CBB *cbb) 1673tlsext_cookie_client_build(SSL *s, uint16_t msg_type, CBB *cbb)
1670{ 1674{
1671 CBB cookie; 1675 CBB cookie;
1672 1676
@@ -1684,7 +1688,7 @@ tlsext_cookie_client_build(SSL *s, CBB *cbb)
1684} 1688}
1685 1689
1686int 1690int
1687tlsext_cookie_server_parse(SSL *s, CBS *cbs, int *alert) 1691tlsext_cookie_server_parse(SSL *s, uint16_t msg_type, CBS *cbs, int *alert)
1688{ 1692{
1689 CBS cookie; 1693 CBS cookie;
1690 1694
@@ -1714,7 +1718,7 @@ tlsext_cookie_server_parse(SSL *s, CBS *cbs, int *alert)
1714} 1718}
1715 1719
1716int 1720int
1717tlsext_cookie_server_needs(SSL *s) 1721tlsext_cookie_server_needs(SSL *s, uint16_t msg_type)
1718{ 1722{
1719 1723
1720 if (SSL_IS_DTLS(s)) 1724 if (SSL_IS_DTLS(s))
@@ -1730,7 +1734,7 @@ tlsext_cookie_server_needs(SSL *s)
1730} 1734}
1731 1735
1732int 1736int
1733tlsext_cookie_server_build(SSL *s, CBB *cbb) 1737tlsext_cookie_server_build(SSL *s, uint16_t msg_type, CBB *cbb)
1734{ 1738{
1735 CBB cookie; 1739 CBB cookie;
1736 1740
@@ -1750,7 +1754,7 @@ tlsext_cookie_server_build(SSL *s, CBB *cbb)
1750} 1754}
1751 1755
1752int 1756int
1753tlsext_cookie_client_parse(SSL *s, CBS *cbs, int *alert) 1757tlsext_cookie_client_parse(SSL *s, uint16_t msg_type, CBS *cbs, int *alert)
1754{ 1758{
1755 CBS cookie; 1759 CBS cookie;
1756 1760
@@ -1780,9 +1784,9 @@ tlsext_cookie_client_parse(SSL *s, CBS *cbs, int *alert)
1780} 1784}
1781 1785
1782struct tls_extension_funcs { 1786struct tls_extension_funcs {
1783 int (*needs)(SSL *s); 1787 int (*needs)(SSL *s, uint16_t msg_type);
1784 int (*build)(SSL *s, CBB *cbb); 1788 int (*build)(SSL *s, uint16_t msg_type, CBB *cbb);
1785 int (*parse)(SSL *s, CBS *cbs, int *alert); 1789 int (*parse)(SSL *s, uint16_t msg_type, CBS *cbs, int *alert);
1786}; 1790};
1787 1791
1788struct tls_extension { 1792struct tls_extension {
@@ -2035,7 +2039,7 @@ tlsext_build(SSL *s, int is_server, uint16_t msg_type, CBB *cbb)
2035 !(tlsext->messages & msg_type)) 2039 !(tlsext->messages & msg_type))
2036 continue; 2040 continue;
2037 2041
2038 if (!ext->needs(s)) 2042 if (!ext->needs(s, msg_type))
2039 continue; 2043 continue;
2040 2044
2041 if (!CBB_add_u16(&extensions, tlsext->type)) 2045 if (!CBB_add_u16(&extensions, tlsext->type))
@@ -2043,7 +2047,7 @@ tlsext_build(SSL *s, int is_server, uint16_t msg_type, CBB *cbb)
2043 if (!CBB_add_u16_length_prefixed(&extensions, &extension_data)) 2047 if (!CBB_add_u16_length_prefixed(&extensions, &extension_data))
2044 return 0; 2048 return 0;
2045 2049
2046 if (!ext->build(s, &extension_data)) 2050 if (!ext->build(s, msg_type, &extension_data))
2047 return 0; 2051 return 0;
2048 2052
2049 extensions_present = 1; 2053 extensions_present = 1;
@@ -2149,7 +2153,7 @@ tlsext_parse(SSL *s, int is_server, uint16_t msg_type, CBS *cbs, int *alert)
2149 S3I(s)->hs.extensions_seen |= (1 << idx); 2153 S3I(s)->hs.extensions_seen |= (1 << idx);
2150 2154
2151 ext = tlsext_funcs(tlsext, is_server); 2155 ext = tlsext_funcs(tlsext, is_server);
2152 if (!ext->parse(s, &extension_data, &alert_desc)) 2156 if (!ext->parse(s, msg_type, &extension_data, &alert_desc))
2153 goto err; 2157 goto err;
2154 2158
2155 if (CBS_len(&extension_data) != 0) 2159 if (CBS_len(&extension_data) != 0)
diff --git a/src/lib/libssl/ssl_tlsext.h b/src/lib/libssl/ssl_tlsext.h
index e2aafa7815..d98b387c5f 100644
--- a/src/lib/libssl/ssl_tlsext.h
+++ b/src/lib/libssl/ssl_tlsext.h
@@ -1,4 +1,4 @@
1/* $OpenBSD: ssl_tlsext.h,v 1.24 2020/07/03 04:12:51 tb Exp $ */ 1/* $OpenBSD: ssl_tlsext.h,v 1.25 2020/07/03 04:51:59 tb Exp $ */
2/* 2/*
3 * Copyright (c) 2016, 2017 Joel Sing <jsing@openbsd.org> 3 * Copyright (c) 2016, 2017 Joel Sing <jsing@openbsd.org>
4 * Copyright (c) 2017 Doug Hogan <doug@openbsd.org> 4 * Copyright (c) 2017 Doug Hogan <doug@openbsd.org>
@@ -31,91 +31,101 @@
31 31
32__BEGIN_HIDDEN_DECLS 32__BEGIN_HIDDEN_DECLS
33 33
34int tlsext_alpn_client_needs(SSL *s); 34int tlsext_alpn_client_needs(SSL *s, uint16_t msg_type);
35int tlsext_alpn_client_build(SSL *s, CBB *cbb); 35int tlsext_alpn_client_build(SSL *s, uint16_t msg_type, CBB *cbb);
36int tlsext_alpn_client_parse(SSL *s, CBS *cbs, int *alert); 36int tlsext_alpn_client_parse(SSL *s, uint16_t msg_type, CBS *cbs, int *alert);
37int tlsext_alpn_server_needs(SSL *s); 37int tlsext_alpn_server_needs(SSL *s, uint16_t msg_type);
38int tlsext_alpn_server_build(SSL *s, CBB *cbb); 38int tlsext_alpn_server_build(SSL *s, uint16_t msg_type, CBB *cbb);
39int tlsext_alpn_server_parse(SSL *s, CBS *cbs, int *alert); 39int tlsext_alpn_server_parse(SSL *s, uint16_t msg_type, CBS *cbs, int *alert);
40 40
41int tlsext_ri_client_needs(SSL *s); 41int tlsext_ri_client_needs(SSL *s, uint16_t msg_type);
42int tlsext_ri_client_build(SSL *s, CBB *cbb); 42int tlsext_ri_client_build(SSL *s, uint16_t msg_type, CBB *cbb);
43int tlsext_ri_client_parse(SSL *s, CBS *cbs, int *alert); 43int tlsext_ri_client_parse(SSL *s, uint16_t msg_type, CBS *cbs, int *alert);
44int tlsext_ri_server_needs(SSL *s); 44int tlsext_ri_server_needs(SSL *s, uint16_t msg_type);
45int tlsext_ri_server_build(SSL *s, CBB *cbb); 45int tlsext_ri_server_build(SSL *s, uint16_t msg_type, CBB *cbb);
46int tlsext_ri_server_parse(SSL *s, CBS *cbs, int *alert); 46int tlsext_ri_server_parse(SSL *s, uint16_t msg_type, CBS *cbs, int *alert);
47 47
48int tlsext_sigalgs_client_needs(SSL *s); 48int tlsext_sigalgs_client_needs(SSL *s, uint16_t msg_type);
49int tlsext_sigalgs_client_build(SSL *s, CBB *cbb); 49int tlsext_sigalgs_client_build(SSL *s, uint16_t msg_type, CBB *cbb);
50int tlsext_sigalgs_client_parse(SSL *s, CBS *cbs, int *alert); 50int tlsext_sigalgs_client_parse(SSL *s, uint16_t msg_type, CBS *cbs,
51int tlsext_sigalgs_server_needs(SSL *s); 51 int *alert);
52int tlsext_sigalgs_server_build(SSL *s, CBB *cbb); 52int tlsext_sigalgs_server_needs(SSL *s, uint16_t msg_type);
53int tlsext_sigalgs_server_parse(SSL *s, CBS *cbs, int *alert); 53int tlsext_sigalgs_server_build(SSL *s, uint16_t msg_type, CBB *cbb);
54 54int tlsext_sigalgs_server_parse(SSL *s, uint16_t msg_type, CBS *cbs,
55int tlsext_sni_client_needs(SSL *s); 55 int *alert);
56int tlsext_sni_client_build(SSL *s, CBB *cbb); 56
57int tlsext_sni_client_parse(SSL *s, CBS *cbs, int *alert); 57int tlsext_sni_client_needs(SSL *s, uint16_t msg_type);
58int tlsext_sni_server_needs(SSL *s); 58int tlsext_sni_client_build(SSL *s, uint16_t msg_type, CBB *cbb);
59int tlsext_sni_server_build(SSL *s, CBB *cbb); 59int tlsext_sni_client_parse(SSL *s, uint16_t msg_type, CBS *cbs, int *alert);
60int tlsext_sni_server_parse(SSL *s, CBS *cbs, int *alert); 60int tlsext_sni_server_needs(SSL *s, uint16_t msg_type);
61int tlsext_sni_server_build(SSL *s, uint16_t msg_type, CBB *cbb);
62int tlsext_sni_server_parse(SSL *s, uint16_t msg_type, CBS *cbs, int *alert);
61int tlsext_sni_is_valid_hostname(CBS *cbs); 63int tlsext_sni_is_valid_hostname(CBS *cbs);
62 64
63int tlsext_supportedgroups_client_needs(SSL *s); 65int tlsext_supportedgroups_client_needs(SSL *s, uint16_t msg_type);
64int tlsext_supportedgroups_client_build(SSL *s, CBB *cbb); 66int tlsext_supportedgroups_client_build(SSL *s, uint16_t msg_type, CBB *cbb);
65int tlsext_supportedgroups_client_parse(SSL *s, CBS *cbs, int *alert); 67int tlsext_supportedgroups_client_parse(SSL *s, uint16_t msg_type, CBS *cbs,
66int tlsext_supportedgroups_server_needs(SSL *s); 68 int *alert);
67int tlsext_supportedgroups_server_build(SSL *s, CBB *cbb); 69int tlsext_supportedgroups_server_needs(SSL *s, uint16_t msg_type);
68int tlsext_supportedgroups_server_parse(SSL *s, CBS *cbs, int *alert); 70int tlsext_supportedgroups_server_build(SSL *s, uint16_t msg_type, CBB *cbb);
69 71int tlsext_supportedgroups_server_parse(SSL *s, uint16_t msg_type, CBS *cbs,
70int tlsext_ecpf_client_needs(SSL *s); 72 int *alert);
71int tlsext_ecpf_client_build(SSL *s, CBB *cbb); 73
72int tlsext_ecpf_client_parse(SSL *s, CBS *cbs, int *alert); 74int tlsext_ecpf_client_needs(SSL *s, uint16_t msg_type);
73int tlsext_ecpf_server_needs(SSL *s); 75int tlsext_ecpf_client_build(SSL *s, uint16_t msg_type, CBB *cbb);
74int tlsext_ecpf_server_build(SSL *s, CBB *cbb); 76int tlsext_ecpf_client_parse(SSL *s, uint16_t msg_type, CBS *cbs, int *alert);
75int tlsext_ecpf_server_parse(SSL *s, CBS *cbs, int *alert); 77int tlsext_ecpf_server_needs(SSL *s, uint16_t msg_type);
76 78int tlsext_ecpf_server_build(SSL *s, uint16_t msg_type, CBB *cbb);
77int tlsext_ocsp_client_needs(SSL *s); 79int tlsext_ecpf_server_parse(SSL *s, uint16_t msg_type, CBS *cbs, int *alert);
78int tlsext_ocsp_client_build(SSL *s, CBB *cbb); 80
79int tlsext_ocsp_client_parse(SSL *s, CBS *cbs, int *alert); 81int tlsext_ocsp_client_needs(SSL *s, uint16_t msg_type);
80int tlsext_ocsp_server_needs(SSL *s); 82int tlsext_ocsp_client_build(SSL *s, uint16_t msg_type, CBB *cbb);
81int tlsext_ocsp_server_build(SSL *s, CBB *cbb); 83int tlsext_ocsp_client_parse(SSL *s, uint16_t msg_type, CBS *cbs, int *alert);
82int tlsext_ocsp_server_parse(SSL *s, CBS *cbs, int *alert); 84int tlsext_ocsp_server_needs(SSL *s, uint16_t msg_type);
83 85int tlsext_ocsp_server_build(SSL *s, uint16_t msg_type, CBB *cbb);
84int tlsext_sessionticket_client_needs(SSL *s); 86int tlsext_ocsp_server_parse(SSL *s, uint16_t msg_type, CBS *cbs, int *alert);
85int tlsext_sessionticket_client_build(SSL *s, CBB *cbb); 87
86int tlsext_sessionticket_client_parse(SSL *s, CBS *cbs, int *alert); 88int tlsext_sessionticket_client_needs(SSL *s, uint16_t msg_type);
87int tlsext_sessionticket_server_needs(SSL *s); 89int tlsext_sessionticket_client_build(SSL *s, uint16_t msg_type, CBB *cbb);
88int tlsext_sessionticket_server_build(SSL *s, CBB *cbb); 90int tlsext_sessionticket_client_parse(SSL *s, uint16_t msg_type, CBS *cbs,
89int tlsext_sessionticket_server_parse(SSL *s, CBS *cbs, int *alert); 91 int *alert);
90 92int tlsext_sessionticket_server_needs(SSL *s, uint16_t msg_type);
91int tlsext_versions_client_needs(SSL *s); 93int tlsext_sessionticket_server_build(SSL *s, uint16_t msg_type, CBB *cbb);
92int tlsext_versions_client_build(SSL *s, CBB *cbb); 94int tlsext_sessionticket_server_parse(SSL *s, uint16_t msg_type, CBS *cbs,
93int tlsext_versions_client_parse(SSL *s, CBS *cbs, int *alert); 95 int *alert);
94int tlsext_versions_server_needs(SSL *s); 96
95int tlsext_versions_server_build(SSL *s, CBB *cbb); 97int tlsext_versions_client_needs(SSL *s, uint16_t msg_type);
96int tlsext_versions_server_parse(SSL *s, CBS *cbs, int *alert); 98int tlsext_versions_client_build(SSL *s, uint16_t msg_type, CBB *cbb);
97 99int tlsext_versions_client_parse(SSL *s, uint16_t msg_type, CBS *cbs,
98int tlsext_keyshare_client_needs(SSL *s); 100 int *alert);
99int tlsext_keyshare_client_build(SSL *s, CBB *cbb); 101int tlsext_versions_server_needs(SSL *s, uint16_t msg_type);
100int tlsext_keyshare_client_parse(SSL *s, CBS *cbs, int *alert); 102int tlsext_versions_server_build(SSL *s, uint16_t msg_type, CBB *cbb);
101int tlsext_keyshare_server_needs(SSL *s); 103int tlsext_versions_server_parse(SSL *s, uint16_t msg_type, CBS *cbs,
102int tlsext_keyshare_server_build(SSL *s, CBB *cbb); 104 int *alert);
103int tlsext_keyshare_server_parse(SSL *s, CBS *cbs, int *alert); 105
104 106int tlsext_keyshare_client_needs(SSL *s, uint16_t msg_type);
105int tlsext_cookie_client_needs(SSL *s); 107int tlsext_keyshare_client_build(SSL *s, uint16_t msg_type, CBB *cbb);
106int tlsext_cookie_client_build(SSL *s, CBB *cbb); 108int tlsext_keyshare_client_parse(SSL *s, uint16_t msg_type, CBS *cbs,
107int tlsext_cookie_client_parse(SSL *s, CBS *cbs, int *alert); 109 int *alert);
108int tlsext_cookie_server_needs(SSL *s); 110int tlsext_keyshare_server_needs(SSL *s, uint16_t msg_type);
109int tlsext_cookie_server_build(SSL *s, CBB *cbb); 111int tlsext_keyshare_server_build(SSL *s, uint16_t msg_type, CBB *cbb);
110int tlsext_cookie_server_parse(SSL *s, CBS *cbs, int *alert); 112int tlsext_keyshare_server_parse(SSL *s, uint16_t msg_type, CBS *cbs,
113 int *alert);
114
115int tlsext_cookie_client_needs(SSL *s, uint16_t msg_type);
116int tlsext_cookie_client_build(SSL *s, uint16_t msg_type, CBB *cbb);
117int tlsext_cookie_client_parse(SSL *s, uint16_t msg_type, CBS *cbs, int *alert);
118int tlsext_cookie_server_needs(SSL *s, uint16_t msg_type);
119int tlsext_cookie_server_build(SSL *s, uint16_t msg_type, CBB *cbb);
120int tlsext_cookie_server_parse(SSL *s, uint16_t msg_type, CBS *cbs, int *alert);
111 121
112#ifndef OPENSSL_NO_SRTP 122#ifndef OPENSSL_NO_SRTP
113int tlsext_srtp_client_needs(SSL *s); 123int tlsext_srtp_client_needs(SSL *s, uint16_t msg_type);
114int tlsext_srtp_client_build(SSL *s, CBB *cbb); 124int tlsext_srtp_client_build(SSL *s, uint16_t msg_type, CBB *cbb);
115int tlsext_srtp_client_parse(SSL *s, CBS *cbs, int *alert); 125int tlsext_srtp_client_parse(SSL *s, uint16_t msg_type, CBS *cbs, int *alert);
116int tlsext_srtp_server_needs(SSL *s); 126int tlsext_srtp_server_needs(SSL *s, uint16_t msg_type);
117int tlsext_srtp_server_build(SSL *s, CBB *cbb); 127int tlsext_srtp_server_build(SSL *s, uint16_t msg_type, CBB *cbb);
118int tlsext_srtp_server_parse(SSL *s, CBS *cbs, int *alert); 128int tlsext_srtp_server_parse(SSL *s, uint16_t msg_type, CBS *cbs, int *alert);
119#endif 129#endif
120 130
121int tlsext_client_build(SSL *s, uint16_t msg_type, CBB *cbb); 131int tlsext_client_build(SSL *s, uint16_t msg_type, CBB *cbb);
generated by cgit v1.2.3-55-g6feb (git 2.39.1) at 2025-03-20 00:41:49 +0000