summaryrefslogtreecommitdiff
path: root/src
diff options
context:
space:
mode:
Diffstat (limited to 'src')
-rw-r--r--src/lib/libssl/ssl_clnt.c6
-rw-r--r--src/lib/libssl/ssl_srvr.c6
-rw-r--r--src/lib/libssl/ssl_tlsext.c295
-rw-r--r--src/lib/libssl/ssl_tlsext.h141
4 files changed, 228 insertions, 220 deletions
diff --git a/src/lib/libssl/ssl_clnt.c b/src/lib/libssl/ssl_clnt.c
index 60983fc6fd..acc48389c0 100644
--- a/src/lib/libssl/ssl_clnt.c
+++ b/src/lib/libssl/ssl_clnt.c
@@ -1,4 +1,4 @@
1/* $OpenBSD: ssl_clnt.c,v 1.51 2018/11/29 06:21:09 tb Exp $ */ 1/* $OpenBSD: ssl_clnt.c,v 1.52 2019/01/18 00:54:42 jsing Exp $ */
2/* Copyright (C) 1995-1998 Eric Young (eay@cryptsoft.com) 2/* Copyright (C) 1995-1998 Eric Young (eay@cryptsoft.com)
3 * All rights reserved. 3 * All rights reserved.
4 * 4 *
@@ -775,7 +775,7 @@ ssl3_send_client_hello(SSL *s)
775 goto err; 775 goto err;
776 776
777 /* TLS extensions */ 777 /* TLS extensions */
778 if (!tlsext_clienthello_build(s, &client_hello)) { 778 if (!tlsext_client_build(s, &client_hello, SSL_TLSEXT_MSG_CH)) {
779 SSLerror(s, ERR_R_INTERNAL_ERROR); 779 SSLerror(s, ERR_R_INTERNAL_ERROR);
780 goto err; 780 goto err;
781 } 781 }
@@ -999,7 +999,7 @@ ssl3_get_server_hello(SSL *s)
999 goto f_err; 999 goto f_err;
1000 } 1000 }
1001 1001
1002 if (!tlsext_serverhello_parse(s, &cbs, &al)) { 1002 if (!tlsext_client_parse(s, &cbs, &al, SSL_TLSEXT_MSG_SH)) {
1003 SSLerror(s, SSL_R_PARSE_TLSEXT); 1003 SSLerror(s, SSL_R_PARSE_TLSEXT);
1004 goto f_err; 1004 goto f_err;
1005 } 1005 }
diff --git a/src/lib/libssl/ssl_srvr.c b/src/lib/libssl/ssl_srvr.c
index 80199d3f2e..afc7c94de8 100644
--- a/src/lib/libssl/ssl_srvr.c
+++ b/src/lib/libssl/ssl_srvr.c
@@ -1,4 +1,4 @@
1/* $OpenBSD: ssl_srvr.c,v 1.62 2018/12/07 07:22:09 tb Exp $ */ 1/* $OpenBSD: ssl_srvr.c,v 1.63 2019/01/18 00:54:42 jsing Exp $ */
2/* Copyright (C) 1995-1998 Eric Young (eay@cryptsoft.com) 2/* Copyright (C) 1995-1998 Eric Young (eay@cryptsoft.com)
3 * All rights reserved. 3 * All rights reserved.
4 * 4 *
@@ -1019,7 +1019,7 @@ ssl3_get_client_hello(SSL *s)
1019 goto f_err; 1019 goto f_err;
1020 } 1020 }
1021 1021
1022 if (!tlsext_clienthello_parse(s, &cbs, &al)) { 1022 if (!tlsext_server_parse(s, &cbs, &al, SSL_TLSEXT_MSG_CH)) {
1023 SSLerror(s, SSL_R_PARSE_TLSEXT); 1023 SSLerror(s, SSL_R_PARSE_TLSEXT);
1024 goto f_err; 1024 goto f_err;
1025 } 1025 }
@@ -1206,7 +1206,7 @@ ssl3_send_server_hello(SSL *s)
1206 goto err; 1206 goto err;
1207 1207
1208 /* TLS extensions */ 1208 /* TLS extensions */
1209 if (!tlsext_serverhello_build(s, &server_hello)) { 1209 if (!tlsext_server_build(s, &server_hello, SSL_TLSEXT_MSG_SH)) {
1210 SSLerror(s, ERR_R_INTERNAL_ERROR); 1210 SSLerror(s, ERR_R_INTERNAL_ERROR);
1211 goto err; 1211 goto err;
1212 } 1212 }
diff --git a/src/lib/libssl/ssl_tlsext.c b/src/lib/libssl/ssl_tlsext.c
index 755bbff795..b8f4414365 100644
--- a/src/lib/libssl/ssl_tlsext.c
+++ b/src/lib/libssl/ssl_tlsext.c
@@ -1,4 +1,4 @@
1/* $OpenBSD: ssl_tlsext.c,v 1.26 2018/11/09 05:02:53 beck Exp $ */ 1/* $OpenBSD: ssl_tlsext.c,v 1.27 2019/01/18 00:54:42 jsing Exp $ */
2/* 2/*
3 * Copyright (c) 2016, 2017 Joel Sing <jsing@openbsd.org> 3 * Copyright (c) 2016, 2017 Joel Sing <jsing@openbsd.org>
4 * Copyright (c) 2017 Doug Hogan <doug@openbsd.org> 4 * Copyright (c) 2017 Doug Hogan <doug@openbsd.org>
@@ -21,15 +21,15 @@
21#include "ssl_locl.h" 21#include "ssl_locl.h"
22 22
23#include "bytestring.h" 23#include "bytestring.h"
24#include "ssl_tlsext.h"
25#include "ssl_sigalgs.h" 24#include "ssl_sigalgs.h"
25#include "ssl_tlsext.h"
26 26
27/* 27/*
28 * Supported Application-Layer Protocol Negotiation - RFC 7301 28 * Supported Application-Layer Protocol Negotiation - RFC 7301
29 */ 29 */
30 30
31int 31int
32tlsext_alpn_clienthello_needs(SSL *s) 32tlsext_alpn_client_needs(SSL *s)
33{ 33{
34 /* ALPN protos have been specified and this is the initial handshake */ 34 /* ALPN protos have been specified and this is the initial handshake */
35 return s->internal->alpn_client_proto_list != NULL && 35 return s->internal->alpn_client_proto_list != NULL &&
@@ -37,7 +37,7 @@ tlsext_alpn_clienthello_needs(SSL *s)
37} 37}
38 38
39int 39int
40tlsext_alpn_clienthello_build(SSL *s, CBB *cbb) 40tlsext_alpn_client_build(SSL *s, CBB *cbb)
41{ 41{
42 CBB protolist; 42 CBB protolist;
43 43
@@ -55,7 +55,7 @@ tlsext_alpn_clienthello_build(SSL *s, CBB *cbb)
55} 55}
56 56
57int 57int
58tlsext_alpn_clienthello_parse(SSL *s, CBS *cbs, int *alert) 58tlsext_alpn_server_parse(SSL *s, CBS *cbs, int *alert)
59{ 59{
60 CBS proto_name_list, alpn; 60 CBS proto_name_list, alpn;
61 const unsigned char *selected; 61 const unsigned char *selected;
@@ -103,13 +103,13 @@ tlsext_alpn_clienthello_parse(SSL *s, CBS *cbs, int *alert)
103} 103}
104 104
105int 105int
106tlsext_alpn_serverhello_needs(SSL *s) 106tlsext_alpn_server_needs(SSL *s)
107{ 107{
108 return S3I(s)->alpn_selected != NULL; 108 return S3I(s)->alpn_selected != NULL;
109} 109}
110 110
111int 111int
112tlsext_alpn_serverhello_build(SSL *s, CBB *cbb) 112tlsext_alpn_server_build(SSL *s, CBB *cbb)
113{ 113{
114 CBB list, selected; 114 CBB list, selected;
115 115
@@ -130,7 +130,7 @@ tlsext_alpn_serverhello_build(SSL *s, CBB *cbb)
130} 130}
131 131
132int 132int
133tlsext_alpn_serverhello_parse(SSL *s, CBS *cbs, int *alert) 133tlsext_alpn_client_parse(SSL *s, CBS *cbs, int *alert)
134{ 134{
135 CBS list, proto; 135 CBS list, proto;
136 136
@@ -167,13 +167,13 @@ tlsext_alpn_serverhello_parse(SSL *s, CBS *cbs, int *alert)
167 * Supported Groups - RFC 7919 section 2 167 * Supported Groups - RFC 7919 section 2
168 */ 168 */
169int 169int
170tlsext_supportedgroups_clienthello_needs(SSL *s) 170tlsext_supportedgroups_client_needs(SSL *s)
171{ 171{
172 return ssl_has_ecc_ciphers(s); 172 return ssl_has_ecc_ciphers(s);
173} 173}
174 174
175int 175int
176tlsext_supportedgroups_clienthello_build(SSL *s, CBB *cbb) 176tlsext_supportedgroups_client_build(SSL *s, CBB *cbb)
177{ 177{
178 const uint16_t *groups; 178 const uint16_t *groups;
179 size_t groups_len; 179 size_t groups_len;
@@ -201,7 +201,7 @@ tlsext_supportedgroups_clienthello_build(SSL *s, CBB *cbb)
201} 201}
202 202
203int 203int
204tlsext_supportedgroups_clienthello_parse(SSL *s, CBS *cbs, int *alert) 204tlsext_supportedgroups_server_parse(SSL *s, CBS *cbs, int *alert)
205{ 205{
206 CBS grouplist; 206 CBS grouplist;
207 size_t groups_len; 207 size_t groups_len;
@@ -254,19 +254,19 @@ tlsext_supportedgroups_clienthello_parse(SSL *s, CBS *cbs, int *alert)
254 254
255/* This extension is never used by the server. */ 255/* This extension is never used by the server. */
256int 256int
257tlsext_supportedgroups_serverhello_needs(SSL *s) 257tlsext_supportedgroups_server_needs(SSL *s)
258{ 258{
259 return 0; 259 return 0;
260} 260}
261 261
262int 262int
263tlsext_supportedgroups_serverhello_build(SSL *s, CBB *cbb) 263tlsext_supportedgroups_server_build(SSL *s, CBB *cbb)
264{ 264{
265 return 0; 265 return 0;
266} 266}
267 267
268int 268int
269tlsext_supportedgroups_serverhello_parse(SSL *s, CBS *cbs, int *alert) 269tlsext_supportedgroups_client_parse(SSL *s, CBS *cbs, int *alert)
270{ 270{
271 /* 271 /*
272 * Servers should not send this extension per the RFC. 272 * Servers should not send this extension per the RFC.
@@ -347,25 +347,25 @@ tlsext_ecpf_parse(SSL *s, CBS *cbs, int *alert)
347} 347}
348 348
349int 349int
350tlsext_ecpf_clienthello_needs(SSL *s) 350tlsext_ecpf_client_needs(SSL *s)
351{ 351{
352 return ssl_has_ecc_ciphers(s); 352 return ssl_has_ecc_ciphers(s);
353} 353}
354 354
355int 355int
356tlsext_ecpf_clienthello_build(SSL *s, CBB *cbb) 356tlsext_ecpf_client_build(SSL *s, CBB *cbb)
357{ 357{
358 return tlsext_ecpf_build(s, cbb); 358 return tlsext_ecpf_build(s, cbb);
359} 359}
360 360
361int 361int
362tlsext_ecpf_clienthello_parse(SSL *s, CBS *cbs, int *alert) 362tlsext_ecpf_server_parse(SSL *s, CBS *cbs, int *alert)
363{ 363{
364 return tlsext_ecpf_parse(s, cbs, alert); 364 return tlsext_ecpf_parse(s, cbs, alert);
365} 365}
366 366
367int 367int
368tlsext_ecpf_serverhello_needs(SSL *s) 368tlsext_ecpf_server_needs(SSL *s)
369{ 369{
370 if (s->version == DTLS1_VERSION) 370 if (s->version == DTLS1_VERSION)
371 return 0; 371 return 0;
@@ -374,13 +374,13 @@ tlsext_ecpf_serverhello_needs(SSL *s)
374} 374}
375 375
376int 376int
377tlsext_ecpf_serverhello_build(SSL *s, CBB *cbb) 377tlsext_ecpf_server_build(SSL *s, CBB *cbb)
378{ 378{
379 return tlsext_ecpf_build(s, cbb); 379 return tlsext_ecpf_build(s, cbb);
380} 380}
381 381
382int 382int
383tlsext_ecpf_serverhello_parse(SSL *s, CBS *cbs, int *alert) 383tlsext_ecpf_client_parse(SSL *s, CBS *cbs, int *alert)
384{ 384{
385 return tlsext_ecpf_parse(s, cbs, alert); 385 return tlsext_ecpf_parse(s, cbs, alert);
386} 386}
@@ -389,13 +389,13 @@ tlsext_ecpf_serverhello_parse(SSL *s, CBS *cbs, int *alert)
389 * Renegotiation Indication - RFC 5746. 389 * Renegotiation Indication - RFC 5746.
390 */ 390 */
391int 391int
392tlsext_ri_clienthello_needs(SSL *s) 392tlsext_ri_client_needs(SSL *s)
393{ 393{
394 return (s->internal->renegotiate); 394 return (s->internal->renegotiate);
395} 395}
396 396
397int 397int
398tlsext_ri_clienthello_build(SSL *s, CBB *cbb) 398tlsext_ri_client_build(SSL *s, CBB *cbb)
399{ 399{
400 CBB reneg; 400 CBB reneg;
401 401
@@ -411,7 +411,7 @@ tlsext_ri_clienthello_build(SSL *s, CBB *cbb)
411} 411}
412 412
413int 413int
414tlsext_ri_clienthello_parse(SSL *s, CBS *cbs, int *alert) 414tlsext_ri_server_parse(SSL *s, CBS *cbs, int *alert)
415{ 415{
416 CBS reneg; 416 CBS reneg;
417 417
@@ -439,13 +439,13 @@ tlsext_ri_clienthello_parse(SSL *s, CBS *cbs, int *alert)
439} 439}
440 440
441int 441int
442tlsext_ri_serverhello_needs(SSL *s) 442tlsext_ri_server_needs(SSL *s)
443{ 443{
444 return (S3I(s)->send_connection_binding); 444 return (S3I(s)->send_connection_binding);
445} 445}
446 446
447int 447int
448tlsext_ri_serverhello_build(SSL *s, CBB *cbb) 448tlsext_ri_server_build(SSL *s, CBB *cbb)
449{ 449{
450 CBB reneg; 450 CBB reneg;
451 451
@@ -464,7 +464,7 @@ tlsext_ri_serverhello_build(SSL *s, CBB *cbb)
464} 464}
465 465
466int 466int
467tlsext_ri_serverhello_parse(SSL *s, CBS *cbs, int *alert) 467tlsext_ri_client_parse(SSL *s, CBS *cbs, int *alert)
468{ 468{
469 CBS reneg, prev_client, prev_server; 469 CBS reneg, prev_client, prev_server;
470 470
@@ -521,13 +521,13 @@ tlsext_ri_serverhello_parse(SSL *s, CBS *cbs, int *alert)
521 * Signature Algorithms - RFC 5246 section 7.4.1.4.1. 521 * Signature Algorithms - RFC 5246 section 7.4.1.4.1.
522 */ 522 */
523int 523int
524tlsext_sigalgs_clienthello_needs(SSL *s) 524tlsext_sigalgs_client_needs(SSL *s)
525{ 525{
526 return (TLS1_get_client_version(s) >= TLS1_2_VERSION); 526 return (TLS1_get_client_version(s) >= TLS1_2_VERSION);
527} 527}
528 528
529int 529int
530tlsext_sigalgs_clienthello_build(SSL *s, CBB *cbb) 530tlsext_sigalgs_client_build(SSL *s, CBB *cbb)
531{ 531{
532 CBB sigalgs; 532 CBB sigalgs;
533 533
@@ -544,7 +544,7 @@ tlsext_sigalgs_clienthello_build(SSL *s, CBB *cbb)
544} 544}
545 545
546int 546int
547tlsext_sigalgs_clienthello_parse(SSL *s, CBS *cbs, int *alert) 547tlsext_sigalgs_server_parse(SSL *s, CBS *cbs, int *alert)
548{ 548{
549 CBS sigalgs; 549 CBS sigalgs;
550 550
@@ -555,19 +555,19 @@ tlsext_sigalgs_clienthello_parse(SSL *s, CBS *cbs, int *alert)
555} 555}
556 556
557int 557int
558tlsext_sigalgs_serverhello_needs(SSL *s) 558tlsext_sigalgs_server_needs(SSL *s)
559{ 559{
560 return 0; 560 return 0;
561} 561}
562 562
563int 563int
564tlsext_sigalgs_serverhello_build(SSL *s, CBB *cbb) 564tlsext_sigalgs_server_build(SSL *s, CBB *cbb)
565{ 565{
566 return 0; 566 return 0;
567} 567}
568 568
569int 569int
570tlsext_sigalgs_serverhello_parse(SSL *s, CBS *cbs, int *alert) 570tlsext_sigalgs_client_parse(SSL *s, CBS *cbs, int *alert)
571{ 571{
572 /* As per the RFC, servers must not send this extension. */ 572 /* As per the RFC, servers must not send this extension. */
573 return 0; 573 return 0;
@@ -577,13 +577,13 @@ tlsext_sigalgs_serverhello_parse(SSL *s, CBS *cbs, int *alert)
577 * Server Name Indication - RFC 6066, section 3. 577 * Server Name Indication - RFC 6066, section 3.
578 */ 578 */
579int 579int
580tlsext_sni_clienthello_needs(SSL *s) 580tlsext_sni_client_needs(SSL *s)
581{ 581{
582 return (s->tlsext_hostname != NULL); 582 return (s->tlsext_hostname != NULL);
583} 583}
584 584
585int 585int
586tlsext_sni_clienthello_build(SSL *s, CBB *cbb) 586tlsext_sni_client_build(SSL *s, CBB *cbb)
587{ 587{
588 CBB server_name_list, host_name; 588 CBB server_name_list, host_name;
589 589
@@ -603,7 +603,7 @@ tlsext_sni_clienthello_build(SSL *s, CBB *cbb)
603} 603}
604 604
605int 605int
606tlsext_sni_clienthello_parse(SSL *s, CBS *cbs, int *alert) 606tlsext_sni_server_parse(SSL *s, CBS *cbs, int *alert)
607{ 607{
608 CBS server_name_list, host_name; 608 CBS server_name_list, host_name;
609 uint8_t name_type; 609 uint8_t name_type;
@@ -661,19 +661,19 @@ tlsext_sni_clienthello_parse(SSL *s, CBS *cbs, int *alert)
661} 661}
662 662
663int 663int
664tlsext_sni_serverhello_needs(SSL *s) 664tlsext_sni_server_needs(SSL *s)
665{ 665{
666 return (s->session->tlsext_hostname != NULL); 666 return (s->session->tlsext_hostname != NULL);
667} 667}
668 668
669int 669int
670tlsext_sni_serverhello_build(SSL *s, CBB *cbb) 670tlsext_sni_server_build(SSL *s, CBB *cbb)
671{ 671{
672 return 1; 672 return 1;
673} 673}
674 674
675int 675int
676tlsext_sni_serverhello_parse(SSL *s, CBS *cbs, int *alert) 676tlsext_sni_client_parse(SSL *s, CBS *cbs, int *alert)
677{ 677{
678 if (s->tlsext_hostname == NULL || CBS_len(cbs) != 0) { 678 if (s->tlsext_hostname == NULL || CBS_len(cbs) != 0) {
679 *alert = TLS1_AD_UNRECOGNIZED_NAME; 679 *alert = TLS1_AD_UNRECOGNIZED_NAME;
@@ -711,14 +711,14 @@ tlsext_sni_serverhello_parse(SSL *s, CBS *cbs, int *alert)
711 */ 711 */
712 712
713int 713int
714tlsext_ocsp_clienthello_needs(SSL *s) 714tlsext_ocsp_client_needs(SSL *s)
715{ 715{
716 return (s->tlsext_status_type == TLSEXT_STATUSTYPE_ocsp && 716 return (s->tlsext_status_type == TLSEXT_STATUSTYPE_ocsp &&
717 s->version != DTLS1_VERSION); 717 s->version != DTLS1_VERSION);
718} 718}
719 719
720int 720int
721tlsext_ocsp_clienthello_build(SSL *s, CBB *cbb) 721tlsext_ocsp_client_build(SSL *s, CBB *cbb)
722{ 722{
723 CBB respid_list, respid, exts; 723 CBB respid_list, respid, exts;
724 unsigned char *ext_data; 724 unsigned char *ext_data;
@@ -762,7 +762,7 @@ tlsext_ocsp_clienthello_build(SSL *s, CBB *cbb)
762} 762}
763 763
764int 764int
765tlsext_ocsp_clienthello_parse(SSL *s, CBS *cbs, int *alert) 765tlsext_ocsp_server_parse(SSL *s, CBS *cbs, int *alert)
766{ 766{
767 int failure = SSL_AD_DECODE_ERROR; 767 int failure = SSL_AD_DECODE_ERROR;
768 CBS respid_list, respid, exts; 768 CBS respid_list, respid, exts;
@@ -836,19 +836,19 @@ tlsext_ocsp_clienthello_parse(SSL *s, CBS *cbs, int *alert)
836} 836}
837 837
838int 838int
839tlsext_ocsp_serverhello_needs(SSL *s) 839tlsext_ocsp_server_needs(SSL *s)
840{ 840{
841 return s->internal->tlsext_status_expected; 841 return s->internal->tlsext_status_expected;
842} 842}
843 843
844int 844int
845tlsext_ocsp_serverhello_build(SSL *s, CBB *cbb) 845tlsext_ocsp_server_build(SSL *s, CBB *cbb)
846{ 846{
847 return 1; 847 return 1;
848} 848}
849 849
850int 850int
851tlsext_ocsp_serverhello_parse(SSL *s, CBS *cbs, int *alert) 851tlsext_ocsp_client_parse(SSL *s, CBS *cbs, int *alert)
852{ 852{
853 if (s->tlsext_status_type == -1) { 853 if (s->tlsext_status_type == -1) {
854 *alert = TLS1_AD_UNSUPPORTED_EXTENSION; 854 *alert = TLS1_AD_UNSUPPORTED_EXTENSION;
@@ -863,7 +863,7 @@ tlsext_ocsp_serverhello_parse(SSL *s, CBS *cbs, int *alert)
863 * SessionTicket extension - RFC 5077 section 3.2 863 * SessionTicket extension - RFC 5077 section 3.2
864 */ 864 */
865int 865int
866tlsext_sessionticket_clienthello_needs(SSL *s) 866tlsext_sessionticket_client_needs(SSL *s)
867{ 867{
868 /* 868 /*
869 * Send session ticket extension when enabled and not overridden. 869 * Send session ticket extension when enabled and not overridden.
@@ -884,7 +884,7 @@ tlsext_sessionticket_clienthello_needs(SSL *s)
884} 884}
885 885
886int 886int
887tlsext_sessionticket_clienthello_build(SSL *s, CBB *cbb) 887tlsext_sessionticket_client_build(SSL *s, CBB *cbb)
888{ 888{
889 /* 889 /*
890 * Signal that we support session tickets by sending an empty 890 * Signal that we support session tickets by sending an empty
@@ -927,7 +927,7 @@ tlsext_sessionticket_clienthello_build(SSL *s, CBB *cbb)
927} 927}
928 928
929int 929int
930tlsext_sessionticket_clienthello_parse(SSL *s, CBS *cbs, int *alert) 930tlsext_sessionticket_server_parse(SSL *s, CBS *cbs, int *alert)
931{ 931{
932 if (s->internal->tls_session_ticket_ext_cb) { 932 if (s->internal->tls_session_ticket_ext_cb) {
933 if (!s->internal->tls_session_ticket_ext_cb(s, CBS_data(cbs), 933 if (!s->internal->tls_session_ticket_ext_cb(s, CBS_data(cbs),
@@ -948,22 +948,21 @@ tlsext_sessionticket_clienthello_parse(SSL *s, CBS *cbs, int *alert)
948} 948}
949 949
950int 950int
951tlsext_sessionticket_serverhello_needs(SSL *s) 951tlsext_sessionticket_server_needs(SSL *s)
952{ 952{
953 return (s->internal->tlsext_ticket_expected && 953 return (s->internal->tlsext_ticket_expected &&
954 !(SSL_get_options(s) & SSL_OP_NO_TICKET)); 954 !(SSL_get_options(s) & SSL_OP_NO_TICKET));
955} 955}
956 956
957int 957int
958tlsext_sessionticket_serverhello_build(SSL *s, CBB *cbb) 958tlsext_sessionticket_server_build(SSL *s, CBB *cbb)
959{ 959{
960 /* Empty ticket */ 960 /* Empty ticket */
961
962 return 1; 961 return 1;
963} 962}
964 963
965int 964int
966tlsext_sessionticket_serverhello_parse(SSL *s, CBS *cbs, int *alert) 965tlsext_sessionticket_client_parse(SSL *s, CBS *cbs, int *alert)
967{ 966{
968 if (s->internal->tls_session_ticket_ext_cb) { 967 if (s->internal->tls_session_ticket_ext_cb) {
969 if (!s->internal->tls_session_ticket_ext_cb(s, CBS_data(cbs), 968 if (!s->internal->tls_session_ticket_ext_cb(s, CBS_data(cbs),
@@ -991,13 +990,13 @@ tlsext_sessionticket_serverhello_parse(SSL *s, CBS *cbs, int *alert)
991#ifndef OPENSSL_NO_SRTP 990#ifndef OPENSSL_NO_SRTP
992 991
993int 992int
994tlsext_srtp_clienthello_needs(SSL *s) 993tlsext_srtp_client_needs(SSL *s)
995{ 994{
996 return SSL_IS_DTLS(s) && SSL_get_srtp_profiles(s) != NULL; 995 return SSL_IS_DTLS(s) && SSL_get_srtp_profiles(s) != NULL;
997} 996}
998 997
999int 998int
1000tlsext_srtp_clienthello_build(SSL *s, CBB *cbb) 999tlsext_srtp_client_build(SSL *s, CBB *cbb)
1001{ 1000{
1002 CBB profiles, mki; 1001 CBB profiles, mki;
1003 int ct, i; 1002 int ct, i;
@@ -1034,7 +1033,7 @@ tlsext_srtp_clienthello_build(SSL *s, CBB *cbb)
1034} 1033}
1035 1034
1036int 1035int
1037tlsext_srtp_clienthello_parse(SSL *s, CBS *cbs, int *alert) 1036tlsext_srtp_server_parse(SSL *s, CBS *cbs, int *alert)
1038{ 1037{
1039 SRTP_PROTECTION_PROFILE *cprof, *sprof; 1038 SRTP_PROTECTION_PROFILE *cprof, *sprof;
1040 STACK_OF(SRTP_PROTECTION_PROFILE) *clnt = NULL, *srvr; 1039 STACK_OF(SRTP_PROTECTION_PROFILE) *clnt = NULL, *srvr;
@@ -1114,13 +1113,13 @@ tlsext_srtp_clienthello_parse(SSL *s, CBS *cbs, int *alert)
1114} 1113}
1115 1114
1116int 1115int
1117tlsext_srtp_serverhello_needs(SSL *s) 1116tlsext_srtp_server_needs(SSL *s)
1118{ 1117{
1119 return SSL_IS_DTLS(s) && SSL_get_selected_srtp_profile(s) != NULL; 1118 return SSL_IS_DTLS(s) && SSL_get_selected_srtp_profile(s) != NULL;
1120} 1119}
1121 1120
1122int 1121int
1123tlsext_srtp_serverhello_build(SSL *s, CBB *cbb) 1122tlsext_srtp_server_build(SSL *s, CBB *cbb)
1124{ 1123{
1125 SRTP_PROTECTION_PROFILE *profile; 1124 SRTP_PROTECTION_PROFILE *profile;
1126 CBB srtp, mki; 1125 CBB srtp, mki;
@@ -1144,7 +1143,7 @@ tlsext_srtp_serverhello_build(SSL *s, CBB *cbb)
1144} 1143}
1145 1144
1146int 1145int
1147tlsext_srtp_serverhello_parse(SSL *s, CBS *cbs, int *alert) 1146tlsext_srtp_client_parse(SSL *s, CBS *cbs, int *alert)
1148{ 1147{
1149 STACK_OF(SRTP_PROTECTION_PROFILE) *clnt; 1148 STACK_OF(SRTP_PROTECTION_PROFILE) *clnt;
1150 SRTP_PROTECTION_PROFILE *prof; 1149 SRTP_PROTECTION_PROFILE *prof;
@@ -1202,127 +1201,127 @@ struct tls_extension_funcs {
1202 1201
1203struct tls_extension { 1202struct tls_extension {
1204 uint16_t type; 1203 uint16_t type;
1205 struct tls_extension_funcs clienthello; 1204 struct tls_extension_funcs client;
1206 struct tls_extension_funcs serverhello; 1205 struct tls_extension_funcs server;
1207}; 1206};
1208 1207
1209static struct tls_extension tls_extensions[] = { 1208static struct tls_extension tls_extensions[] = {
1210 { 1209 {
1211 .type = TLSEXT_TYPE_server_name, 1210 .type = TLSEXT_TYPE_server_name,
1212 .clienthello = { 1211 .client = {
1213 .needs = tlsext_sni_clienthello_needs, 1212 .needs = tlsext_sni_client_needs,
1214 .build = tlsext_sni_clienthello_build, 1213 .build = tlsext_sni_client_build,
1215 .parse = tlsext_sni_clienthello_parse, 1214 .parse = tlsext_sni_server_parse,
1216 }, 1215 },
1217 .serverhello = { 1216 .server = {
1218 .needs = tlsext_sni_serverhello_needs, 1217 .needs = tlsext_sni_server_needs,
1219 .build = tlsext_sni_serverhello_build, 1218 .build = tlsext_sni_server_build,
1220 .parse = tlsext_sni_serverhello_parse, 1219 .parse = tlsext_sni_client_parse,
1221 }, 1220 },
1222 }, 1221 },
1223 { 1222 {
1224 .type = TLSEXT_TYPE_renegotiate, 1223 .type = TLSEXT_TYPE_renegotiate,
1225 .clienthello = { 1224 .client = {
1226 .needs = tlsext_ri_clienthello_needs, 1225 .needs = tlsext_ri_client_needs,
1227 .build = tlsext_ri_clienthello_build, 1226 .build = tlsext_ri_client_build,
1228 .parse = tlsext_ri_clienthello_parse, 1227 .parse = tlsext_ri_server_parse,
1229 }, 1228 },
1230 .serverhello = { 1229 .server = {
1231 .needs = tlsext_ri_serverhello_needs, 1230 .needs = tlsext_ri_server_needs,
1232 .build = tlsext_ri_serverhello_build, 1231 .build = tlsext_ri_server_build,
1233 .parse = tlsext_ri_serverhello_parse, 1232 .parse = tlsext_ri_client_parse,
1234 }, 1233 },
1235 }, 1234 },
1236 { 1235 {
1237 .type = TLSEXT_TYPE_status_request, 1236 .type = TLSEXT_TYPE_status_request,
1238 .clienthello = { 1237 .client = {
1239 .needs = tlsext_ocsp_clienthello_needs, 1238 .needs = tlsext_ocsp_client_needs,
1240 .build = tlsext_ocsp_clienthello_build, 1239 .build = tlsext_ocsp_client_build,
1241 .parse = tlsext_ocsp_clienthello_parse, 1240 .parse = tlsext_ocsp_server_parse,
1242 }, 1241 },
1243 .serverhello = { 1242 .server = {
1244 .needs = tlsext_ocsp_serverhello_needs, 1243 .needs = tlsext_ocsp_server_needs,
1245 .build = tlsext_ocsp_serverhello_build, 1244 .build = tlsext_ocsp_server_build,
1246 .parse = tlsext_ocsp_serverhello_parse, 1245 .parse = tlsext_ocsp_client_parse,
1247 }, 1246 },
1248 }, 1247 },
1249 { 1248 {
1250 .type = TLSEXT_TYPE_ec_point_formats, 1249 .type = TLSEXT_TYPE_ec_point_formats,
1251 .clienthello = { 1250 .client = {
1252 .needs = tlsext_ecpf_clienthello_needs, 1251 .needs = tlsext_ecpf_client_needs,
1253 .build = tlsext_ecpf_clienthello_build, 1252 .build = tlsext_ecpf_client_build,
1254 .parse = tlsext_ecpf_clienthello_parse, 1253 .parse = tlsext_ecpf_server_parse,
1255 }, 1254 },
1256 .serverhello = { 1255 .server = {
1257 .needs = tlsext_ecpf_serverhello_needs, 1256 .needs = tlsext_ecpf_server_needs,
1258 .build = tlsext_ecpf_serverhello_build, 1257 .build = tlsext_ecpf_server_build,
1259 .parse = tlsext_ecpf_serverhello_parse, 1258 .parse = tlsext_ecpf_client_parse,
1260 }, 1259 },
1261 }, 1260 },
1262 { 1261 {
1263 .type = TLSEXT_TYPE_supported_groups, 1262 .type = TLSEXT_TYPE_supported_groups,
1264 .clienthello = { 1263 .client = {
1265 .needs = tlsext_supportedgroups_clienthello_needs, 1264 .needs = tlsext_supportedgroups_client_needs,
1266 .build = tlsext_supportedgroups_clienthello_build, 1265 .build = tlsext_supportedgroups_client_build,
1267 .parse = tlsext_supportedgroups_clienthello_parse, 1266 .parse = tlsext_supportedgroups_server_parse,
1268 }, 1267 },
1269 .serverhello = { 1268 .server = {
1270 .needs = tlsext_supportedgroups_serverhello_needs, 1269 .needs = tlsext_supportedgroups_server_needs,
1271 .build = tlsext_supportedgroups_serverhello_build, 1270 .build = tlsext_supportedgroups_server_build,
1272 .parse = tlsext_supportedgroups_serverhello_parse, 1271 .parse = tlsext_supportedgroups_client_parse,
1273 }, 1272 },
1274 }, 1273 },
1275 { 1274 {
1276 .type = TLSEXT_TYPE_session_ticket, 1275 .type = TLSEXT_TYPE_session_ticket,
1277 .clienthello = { 1276 .client = {
1278 .needs = tlsext_sessionticket_clienthello_needs, 1277 .needs = tlsext_sessionticket_client_needs,
1279 .build = tlsext_sessionticket_clienthello_build, 1278 .build = tlsext_sessionticket_client_build,
1280 .parse = tlsext_sessionticket_clienthello_parse, 1279 .parse = tlsext_sessionticket_server_parse,
1281 }, 1280 },
1282 .serverhello = { 1281 .server = {
1283 .needs = tlsext_sessionticket_serverhello_needs, 1282 .needs = tlsext_sessionticket_server_needs,
1284 .build = tlsext_sessionticket_serverhello_build, 1283 .build = tlsext_sessionticket_server_build,
1285 .parse = tlsext_sessionticket_serverhello_parse, 1284 .parse = tlsext_sessionticket_client_parse,
1286 }, 1285 },
1287 }, 1286 },
1288 { 1287 {
1289 .type = TLSEXT_TYPE_signature_algorithms, 1288 .type = TLSEXT_TYPE_signature_algorithms,
1290 .clienthello = { 1289 .client = {
1291 .needs = tlsext_sigalgs_clienthello_needs, 1290 .needs = tlsext_sigalgs_client_needs,
1292 .build = tlsext_sigalgs_clienthello_build, 1291 .build = tlsext_sigalgs_client_build,
1293 .parse = tlsext_sigalgs_clienthello_parse, 1292 .parse = tlsext_sigalgs_server_parse,
1294 }, 1293 },
1295 .serverhello = { 1294 .server = {
1296 .needs = tlsext_sigalgs_serverhello_needs, 1295 .needs = tlsext_sigalgs_server_needs,
1297 .build = tlsext_sigalgs_serverhello_build, 1296 .build = tlsext_sigalgs_server_build,
1298 .parse = tlsext_sigalgs_serverhello_parse, 1297 .parse = tlsext_sigalgs_client_parse,
1299 }, 1298 },
1300 }, 1299 },
1301 { 1300 {
1302 .type = TLSEXT_TYPE_application_layer_protocol_negotiation, 1301 .type = TLSEXT_TYPE_application_layer_protocol_negotiation,
1303 .clienthello = { 1302 .client = {
1304 .needs = tlsext_alpn_clienthello_needs, 1303 .needs = tlsext_alpn_client_needs,
1305 .build = tlsext_alpn_clienthello_build, 1304 .build = tlsext_alpn_client_build,
1306 .parse = tlsext_alpn_clienthello_parse, 1305 .parse = tlsext_alpn_server_parse,
1307 }, 1306 },
1308 .serverhello = { 1307 .server = {
1309 .needs = tlsext_alpn_serverhello_needs, 1308 .needs = tlsext_alpn_server_needs,
1310 .build = tlsext_alpn_serverhello_build, 1309 .build = tlsext_alpn_server_build,
1311 .parse = tlsext_alpn_serverhello_parse, 1310 .parse = tlsext_alpn_client_parse,
1312 }, 1311 },
1313 }, 1312 },
1314#ifndef OPENSSL_NO_SRTP 1313#ifndef OPENSSL_NO_SRTP
1315 { 1314 {
1316 .type = TLSEXT_TYPE_use_srtp, 1315 .type = TLSEXT_TYPE_use_srtp,
1317 .clienthello = { 1316 .client = {
1318 .needs = tlsext_srtp_clienthello_needs, 1317 .needs = tlsext_srtp_client_needs,
1319 .build = tlsext_srtp_clienthello_build, 1318 .build = tlsext_srtp_client_build,
1320 .parse = tlsext_srtp_clienthello_parse, 1319 .parse = tlsext_srtp_server_parse,
1321 }, 1320 },
1322 .serverhello = { 1321 .server = {
1323 .needs = tlsext_srtp_serverhello_needs, 1322 .needs = tlsext_srtp_server_needs,
1324 .build = tlsext_srtp_serverhello_build, 1323 .build = tlsext_srtp_server_build,
1325 .parse = tlsext_srtp_serverhello_parse, 1324 .parse = tlsext_srtp_client_parse,
1326 }, 1325 },
1327 } 1326 }
1328#endif /* OPENSSL_NO_SRTP */ 1327#endif /* OPENSSL_NO_SRTP */
@@ -1349,16 +1348,16 @@ tls_extension_find(uint16_t type, size_t *tls_extensions_idx)
1349} 1348}
1350 1349
1351static struct tls_extension_funcs * 1350static struct tls_extension_funcs *
1352tlsext_funcs(struct tls_extension *tlsext, int is_serverhello) 1351tlsext_funcs(struct tls_extension *tlsext, int is_server)
1353{ 1352{
1354 if (is_serverhello) 1353 if (is_server)
1355 return &tlsext->serverhello; 1354 return &tlsext->server;
1356 1355
1357 return &tlsext->clienthello; 1356 return &tlsext->client;
1358} 1357}
1359 1358
1360static int 1359static int
1361tlsext_build(SSL *s, CBB *cbb, int is_serverhello) 1360tlsext_build(SSL *s, CBB *cbb, int is_server)
1362{ 1361{
1363 struct tls_extension_funcs *ext; 1362 struct tls_extension_funcs *ext;
1364 struct tls_extension *tlsext; 1363 struct tls_extension *tlsext;
@@ -1371,7 +1370,7 @@ tlsext_build(SSL *s, CBB *cbb, int is_serverhello)
1371 1370
1372 for (i = 0; i < N_TLS_EXTENSIONS; i++) { 1371 for (i = 0; i < N_TLS_EXTENSIONS; i++) {
1373 tlsext = &tls_extensions[i]; 1372 tlsext = &tls_extensions[i];
1374 ext = tlsext_funcs(tlsext, is_serverhello); 1373 ext = tlsext_funcs(tlsext, is_server);
1375 1374
1376 if (!ext->needs(s)) 1375 if (!ext->needs(s))
1377 continue; 1376 continue;
@@ -1397,7 +1396,7 @@ tlsext_build(SSL *s, CBB *cbb, int is_serverhello)
1397} 1396}
1398 1397
1399static int 1398static int
1400tlsext_parse(SSL *s, CBS *cbs, int *alert, int is_serverhello) 1399tlsext_parse(SSL *s, CBS *cbs, int *alert, int is_server)
1401{ 1400{
1402 struct tls_extension_funcs *ext; 1401 struct tls_extension_funcs *ext;
1403 struct tls_extension *tlsext; 1402 struct tls_extension *tlsext;
@@ -1422,7 +1421,7 @@ tlsext_parse(SSL *s, CBS *cbs, int *alert, int is_serverhello)
1422 return 0; 1421 return 0;
1423 1422
1424 if (s->internal->tlsext_debug_cb != NULL) 1423 if (s->internal->tlsext_debug_cb != NULL)
1425 s->internal->tlsext_debug_cb(s, is_serverhello, type, 1424 s->internal->tlsext_debug_cb(s, is_server, type,
1426 (unsigned char *)CBS_data(&extension_data), 1425 (unsigned char *)CBS_data(&extension_data),
1427 CBS_len(&extension_data), 1426 CBS_len(&extension_data),
1428 s->internal->tlsext_debug_arg); 1427 s->internal->tlsext_debug_arg);
@@ -1436,7 +1435,7 @@ tlsext_parse(SSL *s, CBS *cbs, int *alert, int is_serverhello)
1436 return 0; 1435 return 0;
1437 extensions_seen |= (1 << idx); 1436 extensions_seen |= (1 << idx);
1438 1437
1439 ext = tlsext_funcs(tlsext, is_serverhello); 1438 ext = tlsext_funcs(tlsext, is_server);
1440 if (!ext->parse(s, &extension_data, alert)) 1439 if (!ext->parse(s, &extension_data, alert))
1441 return 0; 1440 return 0;
1442 1441
@@ -1448,7 +1447,7 @@ tlsext_parse(SSL *s, CBS *cbs, int *alert, int is_serverhello)
1448} 1447}
1449 1448
1450static void 1449static void
1451tlsext_clienthello_reset_state(SSL *s) 1450tlsext_client_reset_state(SSL *s)
1452{ 1451{
1453 s->internal->servername_done = 0; 1452 s->internal->servername_done = 0;
1454 s->tlsext_status_type = -1; 1453 s->tlsext_status_type = -1;
@@ -1459,22 +1458,22 @@ tlsext_clienthello_reset_state(SSL *s)
1459} 1458}
1460 1459
1461int 1460int
1462tlsext_clienthello_build(SSL *s, CBB *cbb) 1461tlsext_client_build(SSL *s, CBB *cbb, uint16_t msg_type)
1463{ 1462{
1464 return tlsext_build(s, cbb, 0); 1463 return tlsext_build(s, cbb, 0);
1465} 1464}
1466 1465
1467int 1466int
1468tlsext_clienthello_parse(SSL *s, CBS *cbs, int *alert) 1467tlsext_server_parse(SSL *s, CBS *cbs, int *alert, uint16_t msg_type)
1469{ 1468{
1470 /* XXX - this possibly should be done by the caller... */ 1469 /* XXX - this possibly should be done by the caller... */
1471 tlsext_clienthello_reset_state(s); 1470 tlsext_client_reset_state(s);
1472 1471
1473 return tlsext_parse(s, cbs, alert, 0); 1472 return tlsext_parse(s, cbs, alert, 0);
1474} 1473}
1475 1474
1476static void 1475static void
1477tlsext_serverhello_reset_state(SSL *s) 1476tlsext_server_reset_state(SSL *s)
1478{ 1477{
1479 S3I(s)->renegotiate_seen = 0; 1478 S3I(s)->renegotiate_seen = 0;
1480 free(S3I(s)->alpn_selected); 1479 free(S3I(s)->alpn_selected);
@@ -1482,16 +1481,16 @@ tlsext_serverhello_reset_state(SSL *s)
1482} 1481}
1483 1482
1484int 1483int
1485tlsext_serverhello_build(SSL *s, CBB *cbb) 1484tlsext_server_build(SSL *s, CBB *cbb, uint16_t msg_type)
1486{ 1485{
1487 return tlsext_build(s, cbb, 1); 1486 return tlsext_build(s, cbb, 1);
1488} 1487}
1489 1488
1490int 1489int
1491tlsext_serverhello_parse(SSL *s, CBS *cbs, int *alert) 1490tlsext_client_parse(SSL *s, CBS *cbs, int *alert, uint16_t msg_type)
1492{ 1491{
1493 /* XXX - this possibly should be done by the caller... */ 1492 /* XXX - this possibly should be done by the caller... */
1494 tlsext_serverhello_reset_state(s); 1493 tlsext_server_reset_state(s);
1495 1494
1496 return tlsext_parse(s, cbs, alert, 1); 1495 return tlsext_parse(s, cbs, alert, 1);
1497} 1496}
diff --git a/src/lib/libssl/ssl_tlsext.h b/src/lib/libssl/ssl_tlsext.h
index b6108ea45a..e5c1628c98 100644
--- a/src/lib/libssl/ssl_tlsext.h
+++ b/src/lib/libssl/ssl_tlsext.h
@@ -1,4 +1,4 @@
1/* $OpenBSD: ssl_tlsext.h,v 1.14 2018/11/09 03:17:24 jsing Exp $ */ 1/* $OpenBSD: ssl_tlsext.h,v 1.15 2019/01/18 00:54:42 jsing Exp $ */
2/* 2/*
3 * Copyright (c) 2016, 2017 Joel Sing <jsing@openbsd.org> 3 * Copyright (c) 2016, 2017 Joel Sing <jsing@openbsd.org>
4 * Copyright (c) 2017 Doug Hogan <doug@openbsd.org> 4 * Copyright (c) 2017 Doug Hogan <doug@openbsd.org>
@@ -19,78 +19,87 @@
19#ifndef HEADER_SSL_TLSEXT_H 19#ifndef HEADER_SSL_TLSEXT_H
20#define HEADER_SSL_TLSEXT_H 20#define HEADER_SSL_TLSEXT_H
21 21
22/* TLSv1.3 - RFC 8446 Section 4.2. */
23#define SSL_TLSEXT_MSG_CH 0x0001 /* ClientHello */
24#define SSL_TLSEXT_MSG_SH 0x0002 /* ServerHello */
25#define SSL_TLSEXT_MSG_EE 0x0004 /* EncryptedExtension */
26#define SSL_TLSEXT_MSG_CT 0x0008 /* Certificate */
27#define SSL_TLSEXT_MSG_CR 0x0010 /* CertificateRequest */
28#define SSL_TLSEXT_MSG_NST 0x0020 /* NewSessionTicket */
29#define SSL_TLSEXT_MSG_HRR 0x0030 /* HelloRetryRequest */
30
22__BEGIN_HIDDEN_DECLS 31__BEGIN_HIDDEN_DECLS
23 32
24int tlsext_alpn_clienthello_needs(SSL *s); 33int tlsext_alpn_client_needs(SSL *s);
25int tlsext_alpn_clienthello_build(SSL *s, CBB *cbb); 34int tlsext_alpn_client_build(SSL *s, CBB *cbb);
26int tlsext_alpn_clienthello_parse(SSL *s, CBS *cbs, int *alert); 35int tlsext_alpn_client_parse(SSL *s, CBS *cbs, int *alert);
27int tlsext_alpn_serverhello_needs(SSL *s); 36int tlsext_alpn_server_needs(SSL *s);
28int tlsext_alpn_serverhello_build(SSL *s, CBB *cbb); 37int tlsext_alpn_server_build(SSL *s, CBB *cbb);
29int tlsext_alpn_serverhello_parse(SSL *s, CBS *cbs, int *alert); 38int tlsext_alpn_server_parse(SSL *s, CBS *cbs, int *alert);
30 39
31int tlsext_ri_clienthello_needs(SSL *s); 40int tlsext_ri_client_needs(SSL *s);
32int tlsext_ri_clienthello_build(SSL *s, CBB *cbb); 41int tlsext_ri_client_build(SSL *s, CBB *cbb);
33int tlsext_ri_clienthello_parse(SSL *s, CBS *cbs, int *alert); 42int tlsext_ri_client_parse(SSL *s, CBS *cbs, int *alert);
34int tlsext_ri_serverhello_needs(SSL *s); 43int tlsext_ri_server_needs(SSL *s);
35int tlsext_ri_serverhello_build(SSL *s, CBB *cbb); 44int tlsext_ri_server_build(SSL *s, CBB *cbb);
36int tlsext_ri_serverhello_parse(SSL *s, CBS *cbs, int *alert); 45int tlsext_ri_server_parse(SSL *s, CBS *cbs, int *alert);
37 46
38int tlsext_sigalgs_clienthello_needs(SSL *s); 47int tlsext_sigalgs_client_needs(SSL *s);
39int tlsext_sigalgs_clienthello_build(SSL *s, CBB *cbb); 48int tlsext_sigalgs_client_build(SSL *s, CBB *cbb);
40int tlsext_sigalgs_clienthello_parse(SSL *s, CBS *cbs, int *alert); 49int tlsext_sigalgs_client_parse(SSL *s, CBS *cbs, int *alert);
41int tlsext_sigalgs_serverhello_needs(SSL *s); 50int tlsext_sigalgs_server_needs(SSL *s);
42int tlsext_sigalgs_serverhello_build(SSL *s, CBB *cbb); 51int tlsext_sigalgs_server_build(SSL *s, CBB *cbb);
43int tlsext_sigalgs_serverhello_parse(SSL *s, CBS *cbs, int *alert); 52int tlsext_sigalgs_server_parse(SSL *s, CBS *cbs, int *alert);
44 53
45int tlsext_sni_clienthello_needs(SSL *s); 54int tlsext_sni_client_needs(SSL *s);
46int tlsext_sni_clienthello_build(SSL *s, CBB *cbb); 55int tlsext_sni_client_build(SSL *s, CBB *cbb);
47int tlsext_sni_clienthello_parse(SSL *s, CBS *cbs, int *alert); 56int tlsext_sni_client_parse(SSL *s, CBS *cbs, int *alert);
48int tlsext_sni_serverhello_needs(SSL *s); 57int tlsext_sni_server_needs(SSL *s);
49int tlsext_sni_serverhello_build(SSL *s, CBB *cbb); 58int tlsext_sni_server_build(SSL *s, CBB *cbb);
50int tlsext_sni_serverhello_parse(SSL *s, CBS *cbs, int *alert); 59int tlsext_sni_server_parse(SSL *s, CBS *cbs, int *alert);
51 60
52int tlsext_supportedgroups_clienthello_needs(SSL *s); 61int tlsext_supportedgroups_client_needs(SSL *s);
53int tlsext_supportedgroups_clienthello_build(SSL *s, CBB *cbb); 62int tlsext_supportedgroups_client_build(SSL *s, CBB *cbb);
54int tlsext_supportedgroups_clienthello_parse(SSL *s, CBS *cbs, int *alert); 63int tlsext_supportedgroups_client_parse(SSL *s, CBS *cbs, int *alert);
55int tlsext_supportedgroups_serverhello_needs(SSL *s); 64int tlsext_supportedgroups_server_needs(SSL *s);
56int tlsext_supportedgroups_serverhello_build(SSL *s, CBB *cbb); 65int tlsext_supportedgroups_server_build(SSL *s, CBB *cbb);
57int tlsext_supportedgroups_serverhello_parse(SSL *s, CBS *cbs, int *alert); 66int tlsext_supportedgroups_server_parse(SSL *s, CBS *cbs, int *alert);
58 67
59int tlsext_ecpf_clienthello_needs(SSL *s); 68int tlsext_ecpf_client_needs(SSL *s);
60int tlsext_ecpf_clienthello_build(SSL *s, CBB *cbb); 69int tlsext_ecpf_client_build(SSL *s, CBB *cbb);
61int tlsext_ecpf_clienthello_parse(SSL *s, CBS *cbs, int *alert); 70int tlsext_ecpf_client_parse(SSL *s, CBS *cbs, int *alert);
62int tlsext_ecpf_serverhello_needs(SSL *s); 71int tlsext_ecpf_server_needs(SSL *s);
63int tlsext_ecpf_serverhello_build(SSL *s, CBB *cbb); 72int tlsext_ecpf_server_build(SSL *s, CBB *cbb);
64int tlsext_ecpf_serverhello_parse(SSL *s, CBS *cbs, int *alert); 73int tlsext_ecpf_server_parse(SSL *s, CBS *cbs, int *alert);
65 74
66int tlsext_ocsp_clienthello_needs(SSL *s); 75int tlsext_ocsp_client_needs(SSL *s);
67int tlsext_ocsp_clienthello_build(SSL *s, CBB *cbb); 76int tlsext_ocsp_client_build(SSL *s, CBB *cbb);
68int tlsext_ocsp_clienthello_parse(SSL *s, CBS *cbs, int *alert); 77int tlsext_ocsp_client_parse(SSL *s, CBS *cbs, int *alert);
69int tlsext_ocsp_serverhello_needs(SSL *s); 78int tlsext_ocsp_server_needs(SSL *s);
70int tlsext_ocsp_serverhello_build(SSL *s, CBB *cbb); 79int tlsext_ocsp_server_build(SSL *s, CBB *cbb);
71int tlsext_ocsp_serverhello_parse(SSL *s, CBS *cbs, int *alert); 80int tlsext_ocsp_server_parse(SSL *s, CBS *cbs, int *alert);
72 81
73int tlsext_sessionticket_clienthello_needs(SSL *s); 82int tlsext_sessionticket_client_needs(SSL *s);
74int tlsext_sessionticket_clienthello_build(SSL *s, CBB *cbb); 83int tlsext_sessionticket_client_build(SSL *s, CBB *cbb);
75int tlsext_sessionticket_clienthello_parse(SSL *s, CBS *cbs, int *alert); 84int tlsext_sessionticket_client_parse(SSL *s, CBS *cbs, int *alert);
76int tlsext_sessionticket_serverhello_needs(SSL *s); 85int tlsext_sessionticket_server_needs(SSL *s);
77int tlsext_sessionticket_serverhello_build(SSL *s, CBB *cbb); 86int tlsext_sessionticket_server_build(SSL *s, CBB *cbb);
78int tlsext_sessionticket_serverhello_parse(SSL *s, CBS *cbs, int *alert); 87int tlsext_sessionticket_server_parse(SSL *s, CBS *cbs, int *alert);
79 88
80#ifndef OPENSSL_NO_SRTP 89#ifndef OPENSSL_NO_SRTP
81int tlsext_srtp_clienthello_needs(SSL *s); 90int tlsext_srtp_client_needs(SSL *s);
82int tlsext_srtp_clienthello_build(SSL *s, CBB *cbb); 91int tlsext_srtp_client_build(SSL *s, CBB *cbb);
83int tlsext_srtp_clienthello_parse(SSL *s, CBS *cbs, int *alert); 92int tlsext_srtp_client_parse(SSL *s, CBS *cbs, int *alert);
84int tlsext_srtp_serverhello_needs(SSL *s); 93int tlsext_srtp_server_needs(SSL *s);
85int tlsext_srtp_serverhello_build(SSL *s, CBB *cbb); 94int tlsext_srtp_server_build(SSL *s, CBB *cbb);
86int tlsext_srtp_serverhello_parse(SSL *s, CBS *cbs, int *alert); 95int tlsext_srtp_server_parse(SSL *s, CBS *cbs, int *alert);
87#endif 96#endif
88 97
89int tlsext_clienthello_build(SSL *s, CBB *cbb); 98int tlsext_client_build(SSL *s, CBB *cbb, uint16_t msg_type);
90int tlsext_clienthello_parse(SSL *s, CBS *cbs, int *alert); 99int tlsext_client_parse(SSL *s, CBS *cbs, int *alert, uint16_t msg_type);
91 100
92int tlsext_serverhello_build(SSL *s, CBB *cbb); 101int tlsext_server_build(SSL *s, CBB *cbb, uint16_t msg_type);
93int tlsext_serverhello_parse(SSL *s, CBS *cbs, int *alert); 102int tlsext_server_parse(SSL *s, CBS *cbs, int *alert, uint16_t msg_type);
94 103
95__END_HIDDEN_DECLS 104__END_HIDDEN_DECLS
96 105
generated by cgit v1.2.3-55-g6feb (git 2.39.1) at 2025-03-21 19:47:17 +0000