7 files changed, 209 insertions, 7 deletions

diff --git a/src/lib/libssl/s3_lib.c b/src/lib/libssl/s3_lib.c
index 66d0eba9a0..12eb9f4af4 100644
--- a/src/lib/libssl/s3_lib.c
+++ b/src/lib/libssl/s3_lib.c
@@ -1,4 +1,4 @@
-/* $OpenBSD: s3_lib.c,v 1.230 2022/06/29 08:37:18 tb Exp $ */
+/* $OpenBSD: s3_lib.c,v 1.231 2022/06/29 17:39:20 beck Exp $ */
 /* Copyright (C) 1995-1998 Eric Young (eay@cryptsoft.com)
  * All rights reserved.
  *
@@ -1575,6 +1575,9 @@ ssl3_free(SSL *s)
 
         free(s->s3->alpn_selected);
 
+        freezero(s->s3->peer_quic_transport_params,
+            s->s3->peer_quic_transport_params_len);
+
         freezero(s->s3, sizeof(*s->s3));
 
         s->s3 = NULL;
@@ -1619,6 +1622,11 @@ ssl3_clear(SSL *s)
         s->s3->alpn_selected = NULL;
         s->s3->alpn_selected_len = 0;
 
+        freezero(s->s3->peer_quic_transport_params,
+            s->s3->peer_quic_transport_params_len);
+        s->s3->peer_quic_transport_params = NULL;
+        s->s3->peer_quic_transport_params_len = 0;
+
         memset(s->s3, 0, sizeof(*s->s3));
 
         s->s3->rbuf.buf = rp;
diff --git a/src/lib/libssl/ssl.h b/src/lib/libssl/ssl.h
index aed3fea1d0..c733992848 100644
--- a/src/lib/libssl/ssl.h
+++ b/src/lib/libssl/ssl.h
@@ -1,4 +1,4 @@
-/* $OpenBSD: ssl.h,v 1.217 2022/06/28 20:57:33 tb Exp $ */
+/* $OpenBSD: ssl.h,v 1.218 2022/06/29 17:39:20 beck Exp $ */
 /* Copyright (C) 1995-1998 Eric Young (eay@cryptsoft.com)
  * All rights reserved.
  *
@@ -1578,6 +1578,30 @@ void SSL_CTX_set_security_level(SSL_CTX *ctx, int level);
 int SSL_CTX_get_security_level(const SSL_CTX *ctx);
 #endif /* LIBRESSL_INTERNAL */
 
+#ifdef LIBRESSL_INTERNAL
+/*
+ * SSL_set_quic_transport_params configures |ssl| to send |params| (of length
+ * |params_len|) in the quic_transport_parameters extension in either the
+ * ClientHello or EncryptedExtensions handshake message. This extension will
+ * only be sent if the TLS version is at least 1.3, and for a server, only if
+ * the client sent the extension. The buffer pointed to by |params| only need be
+ * valid for the duration of the call to this function. This function returns 1
+ *on success and 0 on failure.
+ */
+int SSL_set_quic_transport_params(SSL *ssl, const uint8_t *params,
+    size_t params_len);
+
+/*
+ * SSL_get_peer_quic_transport_params provides the caller with the value of the
+ * quic_transport_parameters extension sent by the peer. A pointer to the buffer
+ * containing the TransportParameters will be put in |*out_params|, and its
+ * length in |*params_len|. This buffer will be valid for the lifetime of the
+ * |SSL|. If no params were received from the peer, |*out_params_len| will be 0.
+ */
+void SSL_get_peer_quic_transport_params(const SSL *ssl,
+    const uint8_t **out_params, size_t *out_params_len);
+#endif
+
 /* BEGIN ERROR CODES */
 /* The following lines are auto generated by the script mkerr.pl. Any changes
  * made after this point may be overwritten when the script is next run.
diff --git a/src/lib/libssl/ssl_lib.c b/src/lib/libssl/ssl_lib.c
index be01f771e0..b959d3428f 100644
--- a/src/lib/libssl/ssl_lib.c
+++ b/src/lib/libssl/ssl_lib.c
@@ -1,4 +1,4 @@
-/* $OpenBSD: ssl_lib.c,v 1.292 2022/06/29 08:39:08 tb Exp $ */
+/* $OpenBSD: ssl_lib.c,v 1.293 2022/06/29 17:39:20 beck Exp $ */
 /* Copyright (C) 1995-1998 Eric Young (eay@cryptsoft.com)
  * All rights reserved.
  *
@@ -573,6 +573,8 @@ SSL_free(SSL *s)
 
         free(s->internal->alpn_client_proto_list);
 
+        free(s->internal->quic_transport_params);
+
 #ifndef OPENSSL_NO_SRTP
         sk_SRTP_PROTECTION_PROFILE_free(s->internal->srtp_profiles);
 #endif
@@ -3312,3 +3314,29 @@ OBJ_bsearch_ssl_cipher_id(SSL_CIPHER *key, SSL_CIPHER const *base, int num)
         return (SSL_CIPHER *)OBJ_bsearch_(key, base, num, sizeof(SSL_CIPHER),
             ssl_cipher_id_cmp_BSEARCH_CMP_FN);
 }
+
+int
+SSL_set_quic_transport_params(SSL *ssl, const uint8_t *params,
+    size_t params_len)
+{
+        freezero(ssl->internal->quic_transport_params,
+            ssl->internal->quic_transport_params_len);
+        ssl->internal->quic_transport_params = NULL;
+        ssl->internal->quic_transport_params_len = 0;
+
+        if ((ssl->internal->quic_transport_params = malloc(params_len)) == NULL)
+                return 0;
+
+        memcpy(ssl->internal->quic_transport_params, params, params_len);
+        ssl->internal->quic_transport_params_len = params_len;
+
+        return 1;
+}
+
+void
+SSL_get_peer_quic_transport_params(const SSL *ssl, const uint8_t **out_params,
+    size_t *out_params_len)
+{
+        *out_params = ssl->s3->peer_quic_transport_params;
+        *out_params_len = ssl->s3->peer_quic_transport_params_len;
+}
diff --git a/src/lib/libssl/ssl_locl.h b/src/lib/libssl/ssl_locl.h
index da21758815..102f7deaf5 100644
--- a/src/lib/libssl/ssl_locl.h
+++ b/src/lib/libssl/ssl_locl.h
@@ -1,4 +1,4 @@
-/* $OpenBSD: ssl_locl.h,v 1.401 2022/06/29 12:03:38 tb Exp $ */
+/* $OpenBSD: ssl_locl.h,v 1.402 2022/06/29 17:39:20 beck Exp $ */
 /* Copyright (C) 1995-1998 Eric Young (eay@cryptsoft.com)
  * All rights reserved.
  *
@@ -932,6 +932,10 @@ typedef struct ssl_internal_st {
         unsigned char *alpn_client_proto_list;
         unsigned int alpn_client_proto_list_len;
 
+        /* QUIC transport params we will send */
+        uint8_t *quic_transport_params;
+        size_t quic_transport_params_len;
+
         /* XXX Callbacks */
 
         /* true when we are actually in SSL_accept() or SSL_connect() */
@@ -1218,6 +1222,10 @@ typedef struct ssl3_state_st {
          */
         unsigned char *alpn_selected;
         size_t alpn_selected_len;
+
+        /* Contains the QUIC transport params received from our peer. */
+        uint8_t *peer_quic_transport_params;
+        size_t peer_quic_transport_params_len;
 } SSL3_STATE;
 
 /*
diff --git a/src/lib/libssl/ssl_tlsext.c b/src/lib/libssl/ssl_tlsext.c
index 8faf90fde0..fc6c11daa6 100644
--- a/src/lib/libssl/ssl_tlsext.c
+++ b/src/lib/libssl/ssl_tlsext.c
@@ -1,4 +1,4 @@
-/* $OpenBSD: ssl_tlsext.c,v 1.114 2022/06/29 07:53:58 tb Exp $ */
+/* $OpenBSD: ssl_tlsext.c,v 1.115 2022/06/29 17:39:20 beck Exp $ */
 /*
  * Copyright (c) 2016, 2017, 2019 Joel Sing <jsing@openbsd.org>
  * Copyright (c) 2017 Doug Hogan <doug@openbsd.org>
@@ -1943,6 +1943,112 @@ tlsext_psk_server_parse(SSL *s, uint16_t msg_type, CBS *cbs, int *alert)
         return CBS_skip(cbs, CBS_len(cbs));
 }
 
+/*
+ * QUIC transport parameters extension.
+ */
+
+int
+tlsext_quic_transport_parameters_client_needs(SSL *s, uint16_t msg_type)
+{
+        return (s->internal->quic_transport_params_len > 0 &&
+            s->s3->hs.our_max_tls_version >= TLS1_3_VERSION);
+}
+
+int
+tlsext_quic_transport_parameters_client_build(SSL *s, uint16_t msg_type,
+    CBB *cbb)
+{
+        CBB contents;
+
+        if (!CBB_add_u16_length_prefixed(cbb, &contents))
+                return 0;
+
+        if (!CBB_add_bytes(&contents, s->internal->quic_transport_params,
+            s->internal->quic_transport_params_len))
+                return 0;
+
+        if (!CBB_flush(cbb))
+                return 0;
+
+        return 1;
+}
+
+int
+tlsext_quic_transport_parameters_client_parse(SSL *s, uint16_t msg_type,
+    CBS *cbs, int *alert)
+{
+        CBS transport_data;
+
+        /* QUIC requires TLS 1.3. */
+        if (ssl_effective_tls_version(s) < TLS1_3_VERSION) {
+                *alert = SSL_AD_UNSUPPORTED_EXTENSION;
+                return 0;
+        }
+
+        if (!CBS_get_u16_length_prefixed(cbs, &transport_data))
+                return 0;
+
+        if (!CBS_stow(&transport_data, &s->s3->peer_quic_transport_params,
+            &s->s3->peer_quic_transport_params_len))
+                return 0;
+
+        return 1;
+}
+
+int
+tlsext_quic_transport_parameters_server_needs(SSL *s, uint16_t msg_type)
+{
+        return s->internal->quic_transport_params_len > 0;
+}
+
+int
+tlsext_quic_transport_parameters_server_build(SSL *s, uint16_t msg_type,
+    CBB *cbb)
+{
+        CBB contents;
+
+        if (!CBB_add_u16_length_prefixed(cbb, &contents))
+                return 0;
+
+        if (!CBB_add_bytes(&contents, s->internal->quic_transport_params,
+            s->internal->quic_transport_params_len))
+                return 0;
+
+        if (!CBB_flush(cbb))
+                return 0;
+
+        return 1;
+}
+
+int
+tlsext_quic_transport_parameters_server_parse(SSL *s, uint16_t msg_type,
+    CBS *cbs, int *alert)
+{
+        CBS transport_data;
+
+        /*
+         * Ignore this extension if we don't have configured quic transport data
+         * or if we are not TLS 1.3.
+         */
+        if (s->internal->quic_transport_params_len == 0 ||
+            ssl_effective_tls_version(s) < TLS1_3_VERSION) {
+                if (!CBS_skip(cbs, CBS_len(cbs))) {
+                        *alert = SSL_AD_INTERNAL_ERROR;
+                        return 0;
+                }
+                return 1;
+        }
+
+        if (!CBS_get_u16_length_prefixed(cbs, &transport_data))
+                return 0;
+
+        if (!CBS_stow(&transport_data, &s->s3->peer_quic_transport_params,
+            &s->s3->peer_quic_transport_params_len))
+                return 0;
+
+        return 1;
+}
+
 struct tls_extension_funcs {
         int (*needs)(SSL *s, uint16_t msg_type);
         int (*build)(SSL *s, uint16_t msg_type, CBB *cbb);
@@ -2132,6 +2238,20 @@ static const struct tls_extension tls_extensions[] = {
         },
 #endif /* OPENSSL_NO_SRTP */
         {
+                .type = TLSEXT_TYPE_quic_transport_parameters,
+                .messages = SSL_TLSEXT_MSG_CH | SSL_TLSEXT_MSG_SH,
+                .client = {
+                        .needs = tlsext_quic_transport_parameters_client_needs,
+                        .build = tlsext_quic_transport_parameters_client_build,
+                        .parse = tlsext_quic_transport_parameters_client_parse,
+                },
+                .server = {
+                        .needs = tlsext_quic_transport_parameters_server_needs,
+                        .build = tlsext_quic_transport_parameters_server_build,
+                        .parse = tlsext_quic_transport_parameters_server_parse,
+                },
+        },
+        {
                 .type = TLSEXT_TYPE_psk_key_exchange_modes,
                 .messages = SSL_TLSEXT_MSG_CH,
                 .client = {
diff --git a/src/lib/libssl/ssl_tlsext.h b/src/lib/libssl/ssl_tlsext.h
index 3439255fd6..268b274948 100644
--- a/src/lib/libssl/ssl_tlsext.h
+++ b/src/lib/libssl/ssl_tlsext.h
@@ -1,4 +1,4 @@
-/* $OpenBSD: ssl_tlsext.h,v 1.29 2022/06/03 13:31:49 tb Exp $ */
+/* $OpenBSD: ssl_tlsext.h,v 1.30 2022/06/29 17:39:20 beck Exp $ */
 /*
  * Copyright (c) 2016, 2017 Joel Sing <jsing@openbsd.org>
  * Copyright (c) 2017 Doug Hogan <doug@openbsd.org>
@@ -144,6 +144,17 @@ int tlsext_srtp_server_build(SSL *s, uint16_t msg_type, CBB *cbb);
 int tlsext_srtp_server_parse(SSL *s, uint16_t msg_type, CBS *cbs, int *alert);
 #endif
 
+int tlsext_quic_transport_parameters_client_needs(SSL *s, uint16_t msg_type);
+int tlsext_quic_transport_parameters_client_build(SSL *s, uint16_t msg_type,
+    CBB *cbb);
+int tlsext_quic_transport_parameters_client_parse(SSL *s, uint16_t msg_type,
+    CBS *cbs, int *alert);
+int tlsext_quic_transport_parameters_server_needs(SSL *s, uint16_t msg_type);
+int tlsext_quic_transport_parameters_server_build(SSL *s, uint16_t msg_type,
+    CBB *cbb);
+int tlsext_quic_transport_parameters_server_parse(SSL *s, uint16_t msg_type,
+    CBS *cbs, int *alert);
+
 int tlsext_client_build(SSL *s, uint16_t msg_type, CBB *cbb);
 int tlsext_client_parse(SSL *s, uint16_t msg_type, CBS *cbs, int *alert);
 
diff --git a/src/lib/libssl/tls1.h b/src/lib/libssl/tls1.h
index aa05f37cc8..2f6e2e3bd0 100644
--- a/src/lib/libssl/tls1.h
+++ b/src/lib/libssl/tls1.h
@@ -1,4 +1,4 @@
-/* $OpenBSD: tls1.h,v 1.52 2022/06/28 20:36:55 tb Exp $ */
+/* $OpenBSD: tls1.h,v 1.53 2022/06/29 17:39:20 beck Exp $ */
 /* Copyright (C) 1995-1998 Eric Young (eay@cryptsoft.com)
  * All rights reserved.
  *
@@ -259,6 +259,9 @@ extern "C" {
 /* ExtensionType value from RFC 7685. */
 #define TLSEXT_TYPE_padding     21
 
+/* ExtensionType value from draft-ietf-quic-tls */
+#define TLSEXT_TYPE_quic_transport_parameters 26
+
 /* ExtensionType value from RFC 4507. */
 #define TLSEXT_TYPE_session_ticket              35