| // Copyright 2018 The BoringSSL Authors |
| // |
| // Licensed under the Apache License, Version 2.0 (the "License"); |
| // you may not use this file except in compliance with the License. |
| // You may obtain a copy of the License at |
| // |
| // https://www.apache.org/licenses/LICENSE-2.0 |
| // |
| // Unless required by applicable law or agreed to in writing, software |
| // distributed under the License is distributed on an "AS IS" BASIS, |
| // WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. |
| // See the License for the specific language governing permissions and |
| // limitations under the License. |
| |
| #include <openssl/ssl.h> |
| |
| #include <openssl/bytestring.h> |
| #include <openssl/err.h> |
| |
| #include <algorithm> |
| #include <optional> |
| |
| #include "../crypto/internal.h" |
| #include "internal.h" |
| |
| |
| BSSL_NAMESPACE_BEGIN |
| |
| static const CBS_ASN1_TAG kFeatureTagALPS = CBS_ASN1_CONTEXT_SPECIFIC | 0; |
| |
| // early_data_t represents the state of early data in a more compact way than |
| // the 3 bits used by the implementation. |
| enum early_data_t { |
| early_data_not_offered = 0, |
| early_data_accepted = 1, |
| early_data_rejected_hrr = 2, |
| early_data_skipped = 3, |
| |
| early_data_max_value = early_data_skipped, |
| }; |
| |
| // serialize_features adds a description of features supported by this binary to |
| // `out`. Returns true on success and false on error. |
| static bool serialize_features(CBB *out) { |
| CBB ciphers; |
| if (!CBB_add_asn1(out, &ciphers, CBS_ASN1_OCTETSTRING)) { |
| return false; |
| } |
| Span<const SSL_CIPHER> all_ciphers = AllCiphers(); |
| for (const SSL_CIPHER &cipher : all_ciphers) { |
| if (!CBB_add_u16(&ciphers, cipher.protocol_id)) { |
| return false; |
| } |
| } |
| CBB groups; |
| if (!CBB_add_asn1(out, &groups, CBS_ASN1_OCTETSTRING)) { |
| return false; |
| } |
| for (const NamedGroup &g : NamedGroups()) { |
| if (!CBB_add_u16(&groups, g.group_id)) { |
| return false; |
| } |
| } |
| // ALPS is a draft protocol and may change over time. The features structure |
| // contains a [0] IMPLICIT OCTET STRING OPTIONAL, containing a list of u16 |
| // ALPS versions that the binary supports. For now we name them by codepoint. |
| // Once ALPS is finalized and past the support horizon, this field can be |
| // removed. |
| CBB alps; |
| if (!CBB_add_asn1(out, &alps, kFeatureTagALPS) || |
| !CBB_add_u16(&alps, TLSEXT_TYPE_application_settings_old) || |
| !CBB_add_u16(&alps, TLSEXT_TYPE_application_settings)) { |
| return false; |
| } |
| return CBB_flush(out); |
| } |
| |
| // apply_remote_features reads a list of supported features from `in` and |
| // (possibly) reconfigures `ssl` to disallow the negotiation of features whose |
| // support has not been indicated. (This prevents the hints from being generated |
| // based on features that are not supported on the actual server.) |
| static bool apply_remote_features(SSLImpl *ssl, CBS *in) { |
| CBS ciphers; |
| if (!CBS_get_asn1(in, &ciphers, CBS_ASN1_OCTETSTRING)) { |
| return false; |
| } |
| bssl::UniquePtr<STACK_OF(SSL_CIPHER)> supported(sk_SSL_CIPHER_new_null()); |
| if (!supported) { |
| return false; |
| } |
| while (CBS_len(&ciphers)) { |
| uint16_t id; |
| if (!CBS_get_u16(&ciphers, &id)) { |
| return false; |
| } |
| const SSL_CIPHER *cipher = SSL_get_cipher_by_value(id); |
| if (!cipher) { |
| continue; |
| } |
| if (!sk_SSL_CIPHER_push(supported.get(), cipher)) { |
| return false; |
| } |
| } |
| const STACK_OF(SSL_CIPHER) *configured = |
| ssl->config->cipher_list ? ssl->config->cipher_list->ciphers() |
| : ssl->ctx->cipher_list->ciphers(); |
| bssl::UniquePtr<STACK_OF(SSL_CIPHER)> unsupported(sk_SSL_CIPHER_new_null()); |
| if (!unsupported) { |
| return false; |
| } |
| for (const SSL_CIPHER *configured_cipher : configured) { |
| if (sk_SSL_CIPHER_find(supported.get(), nullptr, configured_cipher)) { |
| continue; |
| } |
| if (!sk_SSL_CIPHER_push(unsupported.get(), configured_cipher)) { |
| return false; |
| } |
| } |
| if (sk_SSL_CIPHER_num(unsupported.get()) && !ssl->config->cipher_list) { |
| ssl->config->cipher_list = bssl::MakeUnique<SSLCipherPreferenceList>(); |
| if (!ssl->config->cipher_list || |
| !ssl->config->cipher_list->CopyFrom(*ssl->ctx->cipher_list)) { |
| return false; |
| } |
| } |
| for (const SSL_CIPHER *unsupported_cipher : unsupported.get()) { |
| ssl->config->cipher_list->Remove(unsupported_cipher); |
| } |
| if (sk_SSL_CIPHER_num(SSL_get_ciphers(ssl)) == 0) { |
| return false; |
| } |
| |
| CBS groups; |
| if (!CBS_get_asn1(in, &groups, CBS_ASN1_OCTETSTRING)) { |
| return false; |
| } |
| Array<uint16_t> supported_groups; |
| if (!supported_groups.InitForOverwrite(CBS_len(&groups) / 2)) { |
| return false; |
| } |
| size_t idx = 0; |
| while (CBS_len(&groups)) { |
| uint16_t group; |
| if (!CBS_get_u16(&groups, &group)) { |
| return false; |
| } |
| supported_groups[idx++] = group; |
| } |
| Span<const uint16_t> configured_groups = |
| ssl->s3->hs->config->supported_group_list; |
| Span<const uint32_t> configured_groups_flags = |
| ssl->s3->hs->config->supported_group_list_flags; |
| Array<uint16_t> new_configured_groups; |
| // Temporary scratch space to keep track of consecutive runs of groups of |
| // equal preference, so they can be relabeled after filtering for groups |
| // present in the remote features and copying to the new configuration. |
| Array<size_t> new_groups_preference_ranks; |
| Array<uint32_t> new_groups_flags; |
| if (!new_configured_groups.InitForOverwrite(configured_groups.size()) || |
| !new_groups_preference_ranks.Init(configured_groups.size()) || |
| !new_groups_flags.Init(configured_groups.size())) { |
| return false; |
| } |
| // Populate temporary array containing "preference rank" of each group. |
| for (size_t i = 1; i < configured_groups.size(); ++i) { |
| new_groups_preference_ranks[i] = new_groups_preference_ranks[i - 1]; |
| if ((configured_groups_flags[i - 1] & |
| SSL_GROUP_FLAG_EQUAL_PREFERENCE_WITH_NEXT) == 0) { |
| ++new_groups_preference_ranks[i]; |
| } |
| } |
| idx = 0; |
| std::optional<size_t> last_rank; |
| for (size_t i = 0u; i < configured_groups.size(); ++i) { |
| uint16_t configured_group = configured_groups[i]; |
| if (std::find(supported_groups.begin(), supported_groups.end(), |
| configured_group) == supported_groups.end()) { |
| continue; |
| } |
| new_configured_groups[idx] = configured_group; |
| // Set the "equal preference with next" flag on the previous group, if |
| // appropriate. |
| if (last_rank.has_value() && new_groups_preference_ranks[i] == *last_rank) { |
| new_groups_flags[idx - 1] |= SSL_GROUP_FLAG_EQUAL_PREFERENCE_WITH_NEXT; |
| } |
| last_rank = new_groups_preference_ranks[i]; |
| ++idx; |
| } |
| if (idx == 0) { |
| return false; |
| } |
| new_configured_groups.Shrink(idx); |
| new_groups_flags.Shrink(idx); |
| ssl->config->supported_group_list = std::move(new_configured_groups); |
| ssl->config->supported_group_list_flags = std::move(new_groups_flags); |
| |
| CBS alps; |
| CBS_init(&alps, nullptr, 0); |
| if (!CBS_get_optional_asn1(in, &alps, /*out_present=*/nullptr, |
| kFeatureTagALPS)) { |
| return false; |
| } |
| bool supports_alps = false; |
| while (CBS_len(&alps) != 0) { |
| uint16_t id; |
| if (!CBS_get_u16(&alps, &id)) { |
| return false; |
| } |
| // For now, we support two ALPS codepoints, so we need to extract both |
| // codepoints, and then filter what the handshaker might try to send. |
| if ((id == TLSEXT_TYPE_application_settings && |
| ssl->config->alps_use_new_codepoint) || |
| (id == TLSEXT_TYPE_application_settings_old && |
| !ssl->config->alps_use_new_codepoint)) { |
| supports_alps = true; |
| break; |
| } |
| } |
| if (!supports_alps) { |
| ssl->config->alps_configs.clear(); |
| } |
| |
| return true; |
| } |
| |
| BSSL_NAMESPACE_END |
| |
| using namespace bssl; |
| |
| int SSL_serialize_capabilities(const SSL *ssl, CBB *out) { |
| CBB seq; |
| if (!CBB_add_asn1(out, &seq, CBS_ASN1_SEQUENCE) || |
| !serialize_features(&seq) || // |
| !CBB_flush(out)) { |
| return 0; |
| } |
| |
| return 1; |
| } |
| |
| int SSL_request_handshake_hints(SSL *ssl, const uint8_t *client_hello, |
| size_t client_hello_len, |
| const uint8_t *capabilities, |
| size_t capabilities_len) { |
| auto *ssl_impl = FromOpaque(ssl); |
| if (SSL_is_dtls(ssl_impl) || ssl_impl->s3->hs == nullptr) { |
| OPENSSL_PUT_ERROR(SSL, ERR_R_SHOULD_NOT_HAVE_BEEN_CALLED); |
| return 0; |
| } |
| |
| CBS cbs, seq; |
| CBS_init(&cbs, capabilities, capabilities_len); |
| UniquePtr<SSL_HANDSHAKE_HINTS> pending_hints = |
| MakeUnique<SSL_HANDSHAKE_HINTS>(); |
| if (pending_hints == nullptr || |
| !CBS_get_asn1(&cbs, &seq, CBS_ASN1_SEQUENCE) || |
| !apply_remote_features(ssl_impl, &seq)) { |
| return 0; |
| } |
| |
| SSL3_STATE *const s3 = ssl_impl->s3; |
| s3->v2_hello_done = true; |
| s3->has_message = true; |
| |
| Array<uint8_t> client_hello_msg; |
| ScopedCBB client_hello_cbb; |
| CBB client_hello_body; |
| if (!ssl_impl->method->init_message(ssl_impl, client_hello_cbb.get(), |
| &client_hello_body, |
| SSL3_MT_CLIENT_HELLO) || |
| !CBB_add_bytes(&client_hello_body, client_hello, client_hello_len) || |
| !ssl_impl->method->finish_message(ssl_impl, client_hello_cbb.get(), |
| &client_hello_msg)) { |
| return 0; |
| } |
| |
| s3->hs_buf.reset(BUF_MEM_new()); |
| if (!s3->hs_buf || !BUF_MEM_append(s3->hs_buf.get(), client_hello_msg.data(), |
| client_hello_msg.size())) { |
| return 0; |
| } |
| |
| s3->hs->pending_hints = std::move(pending_hints); |
| return 1; |
| } |
| |
| // `SSL_HANDSHAKE_HINTS` is serialized as the following ASN.1 structure. We use |
| // implicit tagging to make it a little more compact. |
| // |
| // HandshakeHints ::= SEQUENCE { |
| // serverRandomTLS13 [0] IMPLICIT OCTET STRING OPTIONAL, |
| // keyShareHint [1] IMPLICIT KeyShareHint OPTIONAL, |
| // signatureHint [2] IMPLICIT SignatureHint OPTIONAL, |
| // -- At most one of decryptedPSKHint or ignorePSKHint may be present. It |
| // -- corresponds to the first entry in pre_shared_keys. TLS 1.2 session |
| // -- tickets use a separate hint, to ensure the caller does not apply the |
| // -- hint to the wrong field. |
| // decryptedPSKHint [3] IMPLICIT OCTET STRING OPTIONAL, |
| // ignorePSKHint [4] IMPLICIT NULL OPTIONAL, |
| // -- Due to a historical typo, compressCertificateHint's tag is primitive |
| // -- instead of constructed. |
| // compressCertificateHint [5 PRIMITIVE] IMPLICIT CompressCertificateHint |
| // OPTIONAL, |
| // -- TLS 1.2 and 1.3 use different server random hints because one contains |
| // -- a timestamp while the other doesn't. If the hint was generated |
| // -- assuming TLS 1.3 but we actually negotiate TLS 1.2, mixing the two |
| // -- will break this. |
| // serverRandomTLS12 [6] IMPLICIT OCTET STRING OPTIONAL, |
| // -- Due to a historical typo, ecdheHint tag has universal class instead of |
| // -- context-specific. |
| // ecdheHint [UNIVERSAL 7] IMPLICIT ECDHEHint OPTIONAL |
| // -- At most one of decryptedTicketHint or ignoreTicketHint may be present. |
| // -- renewTicketHint requires decryptedTicketHint. |
| // decryptedTicketHint [8] IMPLICIT OCTET STRING OPTIONAL, |
| // renewTicketHint [9] IMPLICIT NULL OPTIONAL, |
| // ignoreTicketHint [10] IMPLICIT NULL OPTIONAL, |
| // -- Unlike a usual ASN.1 structure, trailing data is ignored. |
| // } |
| // |
| // KeyShareHint ::= SEQUENCE { |
| // groupId INTEGER, |
| // ciphertext OCTET STRING, |
| // secret OCTET STRING, |
| // } |
| // |
| // SignatureHint ::= SEQUENCE { |
| // algorithm INTEGER, |
| // input OCTET STRING, |
| // subjectPublicKeyInfo OCTET STRING, |
| // signature OCTET STRING, |
| // } |
| // |
| // CompressCertificateHint ::= SEQUENCE { |
| // algorithm INTEGER, |
| // input OCTET STRING, |
| // compressed OCTET STRING, |
| // } |
| // |
| // ECDHEHint ::= SEQUENCE { |
| // groupId INTEGER, |
| // publicKey OCTET STRING, |
| // privateKey OCTET STRING, |
| // } |
| |
| // HandshakeHints tags. |
| static const CBS_ASN1_TAG kServerRandomTLS13Tag = CBS_ASN1_CONTEXT_SPECIFIC | 0; |
| static const CBS_ASN1_TAG kKeyShareHintTag = |
| CBS_ASN1_CONSTRUCTED | CBS_ASN1_CONTEXT_SPECIFIC | 1; |
| static const CBS_ASN1_TAG kSignatureHintTag = |
| CBS_ASN1_CONSTRUCTED | CBS_ASN1_CONTEXT_SPECIFIC | 2; |
| static const CBS_ASN1_TAG kDecryptedPSKTag = CBS_ASN1_CONTEXT_SPECIFIC | 3; |
| static const CBS_ASN1_TAG kIgnorePSKTag = CBS_ASN1_CONTEXT_SPECIFIC | 4; |
| static const CBS_ASN1_TAG kCompressCertificateTag = |
| CBS_ASN1_CONTEXT_SPECIFIC | 5; |
| static const CBS_ASN1_TAG kServerRandomTLS12Tag = CBS_ASN1_CONTEXT_SPECIFIC | 6; |
| static const CBS_ASN1_TAG kECDHEHintTag = CBS_ASN1_CONSTRUCTED | 7; |
| static const CBS_ASN1_TAG kDecryptedTicketTag = CBS_ASN1_CONTEXT_SPECIFIC | 8; |
| static const CBS_ASN1_TAG kRenewTicketTag = CBS_ASN1_CONTEXT_SPECIFIC | 9; |
| static const CBS_ASN1_TAG kIgnoreTicketTag = CBS_ASN1_CONTEXT_SPECIFIC | 10; |
| |
| int SSL_serialize_handshake_hints(const SSL *ssl, CBB *out) { |
| const auto *ssl_impl = FromOpaque(ssl); |
| const SSL_HANDSHAKE *hs = ssl_impl->s3->hs.get(); |
| if (!ssl_impl->server || hs == nullptr || hs->pending_hints == nullptr) { |
| OPENSSL_PUT_ERROR(SSL, ERR_R_SHOULD_NOT_HAVE_BEEN_CALLED); |
| return 0; |
| } |
| |
| const SSL_HANDSHAKE_HINTS *const hints = hs->pending_hints.get(); |
| CBB seq, child; |
| if (!CBB_add_asn1(out, &seq, CBS_ASN1_SEQUENCE)) { |
| return 0; |
| } |
| |
| if (!hints->server_random_tls13.empty()) { |
| if (!CBB_add_asn1_element(&seq, kServerRandomTLS13Tag, |
| hints->server_random_tls13.data(), |
| hints->server_random_tls13.size())) { |
| return 0; |
| } |
| } |
| |
| if (hints->key_share_group_id != 0 && !hints->key_share_ciphertext.empty() && |
| !hints->key_share_secret.empty()) { |
| if (!CBB_add_asn1(&seq, &child, kKeyShareHintTag) || |
| !CBB_add_asn1_uint64(&child, hints->key_share_group_id) || |
| !CBB_add_asn1_octet_string(&child, hints->key_share_ciphertext.data(), |
| hints->key_share_ciphertext.size()) || |
| !CBB_add_asn1_octet_string(&child, hints->key_share_secret.data(), |
| hints->key_share_secret.size())) { |
| return 0; |
| } |
| } |
| |
| if (hints->signature_algorithm != 0 && !hints->signature_input.empty() && |
| !hints->signature.empty()) { |
| if (!CBB_add_asn1(&seq, &child, kSignatureHintTag) || |
| !CBB_add_asn1_uint64(&child, hints->signature_algorithm) || |
| !CBB_add_asn1_octet_string(&child, hints->signature_input.data(), |
| hints->signature_input.size()) || |
| !CBB_add_asn1_octet_string(&child, hints->signature_spki.data(), |
| hints->signature_spki.size()) || |
| !CBB_add_asn1_octet_string(&child, hints->signature.data(), |
| hints->signature.size())) { |
| return 0; |
| } |
| } |
| |
| if (!hints->decrypted_psk.empty()) { |
| if (!CBB_add_asn1_element(&seq, kDecryptedPSKTag, |
| hints->decrypted_psk.data(), |
| hints->decrypted_psk.size())) { |
| return 0; |
| } |
| } |
| |
| if (hints->ignore_psk && // |
| !CBB_add_asn1(&seq, &child, kIgnorePSKTag)) { |
| return 0; |
| } |
| |
| if (hints->cert_compression_alg_id != 0 && |
| !hints->cert_compression_input.empty() && |
| !hints->cert_compression_output.empty()) { |
| if (!CBB_add_asn1(&seq, &child, kCompressCertificateTag) || |
| !CBB_add_asn1_uint64(&child, hints->cert_compression_alg_id) || |
| !CBB_add_asn1_octet_string(&child, hints->cert_compression_input.data(), |
| hints->cert_compression_input.size()) || |
| !CBB_add_asn1_octet_string(&child, |
| hints->cert_compression_output.data(), |
| hints->cert_compression_output.size())) { |
| return 0; |
| } |
| } |
| |
| if (!hints->server_random_tls12.empty()) { |
| if (!CBB_add_asn1_element(&seq, kServerRandomTLS12Tag, |
| hints->server_random_tls12.data(), |
| hints->server_random_tls12.size())) { |
| return 0; |
| } |
| } |
| |
| if (hints->ecdhe_group_id != 0 && !hints->ecdhe_public_key.empty() && |
| !hints->ecdhe_private_key.empty()) { |
| if (!CBB_add_asn1(&seq, &child, kECDHEHintTag) || |
| !CBB_add_asn1_uint64(&child, hints->ecdhe_group_id) || |
| !CBB_add_asn1_octet_string(&child, hints->ecdhe_public_key.data(), |
| hints->ecdhe_public_key.size()) || |
| !CBB_add_asn1_octet_string(&child, hints->ecdhe_private_key.data(), |
| hints->ecdhe_private_key.size())) { |
| return 0; |
| } |
| } |
| |
| |
| if (!hints->decrypted_ticket.empty()) { |
| if (!CBB_add_asn1_element(&seq, kDecryptedTicketTag, |
| hints->decrypted_ticket.data(), |
| hints->decrypted_ticket.size())) { |
| return 0; |
| } |
| } |
| |
| if (hints->renew_ticket && // |
| !CBB_add_asn1(&seq, &child, kRenewTicketTag)) { |
| return 0; |
| } |
| |
| if (hints->ignore_ticket && // |
| !CBB_add_asn1(&seq, &child, kIgnoreTicketTag)) { |
| return 0; |
| } |
| |
| return CBB_flush(out); |
| } |
| |
| static bool get_optional_implicit_null(CBS *cbs, bool *out_present, |
| CBS_ASN1_TAG tag) { |
| CBS value; |
| int present; |
| if (!CBS_get_optional_asn1(cbs, &value, &present, tag) || |
| (present && CBS_len(&value) != 0)) { |
| return false; |
| } |
| *out_present = present; |
| return true; |
| } |
| |
| int SSL_set_handshake_hints(SSL *ssl, const uint8_t *hints, size_t hints_len) { |
| auto *ssl_impl = FromOpaque(ssl); |
| if (SSL_is_dtls(ssl_impl) || ssl_impl->s3->hs == nullptr) { |
| OPENSSL_PUT_ERROR(SSL, ERR_R_SHOULD_NOT_HAVE_BEEN_CALLED); |
| return 0; |
| } |
| |
| UniquePtr<SSL_HANDSHAKE_HINTS> hints_obj = MakeUnique<SSL_HANDSHAKE_HINTS>(); |
| if (hints_obj == nullptr) { |
| return 0; |
| } |
| |
| CBS cbs, seq, server_random_tls13, key_share, signature_hint, psk, |
| cert_compression, server_random_tls12, ecdhe, ticket; |
| int has_server_random_tls13, has_key_share, has_signature_hint, has_psk, |
| has_cert_compression, has_server_random_tls12, has_ecdhe, has_ticket; |
| CBS_init(&cbs, hints, hints_len); |
| if (!CBS_get_asn1(&cbs, &seq, CBS_ASN1_SEQUENCE) || |
| !CBS_get_optional_asn1(&seq, &server_random_tls13, |
| &has_server_random_tls13, kServerRandomTLS13Tag) || |
| !CBS_get_optional_asn1(&seq, &key_share, &has_key_share, |
| kKeyShareHintTag) || |
| !CBS_get_optional_asn1(&seq, &signature_hint, &has_signature_hint, |
| kSignatureHintTag) || |
| !CBS_get_optional_asn1(&seq, &psk, &has_psk, kDecryptedPSKTag) || |
| !get_optional_implicit_null(&seq, &hints_obj->ignore_psk, |
| kIgnorePSKTag) || |
| !CBS_get_optional_asn1(&seq, &cert_compression, &has_cert_compression, |
| kCompressCertificateTag) || |
| !CBS_get_optional_asn1(&seq, &server_random_tls12, |
| &has_server_random_tls12, kServerRandomTLS12Tag) || |
| !CBS_get_optional_asn1(&seq, &ecdhe, &has_ecdhe, kECDHEHintTag) || |
| !CBS_get_optional_asn1(&seq, &ticket, &has_ticket, kDecryptedTicketTag) || |
| !get_optional_implicit_null(&seq, &hints_obj->renew_ticket, |
| kRenewTicketTag) || |
| !get_optional_implicit_null(&seq, &hints_obj->ignore_ticket, |
| kIgnoreTicketTag)) { |
| OPENSSL_PUT_ERROR(SSL, SSL_R_COULD_NOT_PARSE_HINTS); |
| return 0; |
| } |
| |
| if (has_server_random_tls13 && |
| !hints_obj->server_random_tls13.CopyFrom(server_random_tls13)) { |
| return 0; |
| } |
| |
| if (has_key_share) { |
| uint64_t group_id; |
| CBS ciphertext, secret; |
| if (!CBS_get_asn1_uint64(&key_share, &group_id) || // |
| group_id == 0 || group_id > 0xffff || |
| !CBS_get_asn1(&key_share, &ciphertext, CBS_ASN1_OCTETSTRING) || |
| !hints_obj->key_share_ciphertext.CopyFrom(ciphertext) || |
| !CBS_get_asn1(&key_share, &secret, CBS_ASN1_OCTETSTRING) || |
| !hints_obj->key_share_secret.CopyFrom(secret)) { |
| OPENSSL_PUT_ERROR(SSL, SSL_R_COULD_NOT_PARSE_HINTS); |
| return 0; |
| } |
| hints_obj->key_share_group_id = static_cast<uint16_t>(group_id); |
| } |
| |
| if (has_signature_hint) { |
| uint64_t sig_alg; |
| CBS input, spki, signature; |
| if (!CBS_get_asn1_uint64(&signature_hint, &sig_alg) || // |
| sig_alg == 0 || sig_alg > 0xffff || |
| !CBS_get_asn1(&signature_hint, &input, CBS_ASN1_OCTETSTRING) || |
| !hints_obj->signature_input.CopyFrom(input) || |
| !CBS_get_asn1(&signature_hint, &spki, CBS_ASN1_OCTETSTRING) || |
| !hints_obj->signature_spki.CopyFrom(spki) || |
| !CBS_get_asn1(&signature_hint, &signature, CBS_ASN1_OCTETSTRING) || |
| !hints_obj->signature.CopyFrom(signature)) { |
| OPENSSL_PUT_ERROR(SSL, SSL_R_COULD_NOT_PARSE_HINTS); |
| return 0; |
| } |
| hints_obj->signature_algorithm = static_cast<uint16_t>(sig_alg); |
| } |
| |
| if (has_psk && !hints_obj->decrypted_psk.CopyFrom(psk)) { |
| return 0; |
| } |
| if (has_psk && hints_obj->ignore_psk) { |
| OPENSSL_PUT_ERROR(SSL, SSL_R_COULD_NOT_PARSE_HINTS); |
| return 0; |
| } |
| |
| if (has_cert_compression) { |
| uint64_t alg; |
| CBS input, output; |
| if (!CBS_get_asn1_uint64(&cert_compression, &alg) || // |
| alg == 0 || alg > 0xffff || |
| !CBS_get_asn1(&cert_compression, &input, CBS_ASN1_OCTETSTRING) || |
| !hints_obj->cert_compression_input.CopyFrom(input) || |
| !CBS_get_asn1(&cert_compression, &output, CBS_ASN1_OCTETSTRING) || |
| !hints_obj->cert_compression_output.CopyFrom(output)) { |
| OPENSSL_PUT_ERROR(SSL, SSL_R_COULD_NOT_PARSE_HINTS); |
| return 0; |
| } |
| hints_obj->cert_compression_alg_id = static_cast<uint16_t>(alg); |
| } |
| |
| if (has_server_random_tls12 && |
| !hints_obj->server_random_tls12.CopyFrom(server_random_tls12)) { |
| return 0; |
| } |
| |
| if (has_ecdhe) { |
| uint64_t group_id; |
| CBS public_key, private_key; |
| if (!CBS_get_asn1_uint64(&ecdhe, &group_id) || // |
| group_id == 0 || group_id > 0xffff || |
| !CBS_get_asn1(&ecdhe, &public_key, CBS_ASN1_OCTETSTRING) || |
| !hints_obj->ecdhe_public_key.CopyFrom(public_key) || |
| !CBS_get_asn1(&ecdhe, &private_key, CBS_ASN1_OCTETSTRING) || |
| !hints_obj->ecdhe_private_key.CopyFrom(private_key)) { |
| OPENSSL_PUT_ERROR(SSL, SSL_R_COULD_NOT_PARSE_HINTS); |
| return 0; |
| } |
| hints_obj->ecdhe_group_id = static_cast<uint16_t>(group_id); |
| } |
| |
| if (has_ticket && !hints_obj->decrypted_ticket.CopyFrom(ticket)) { |
| return 0; |
| } |
| if (has_ticket && hints_obj->ignore_ticket) { |
| OPENSSL_PUT_ERROR(SSL, SSL_R_COULD_NOT_PARSE_HINTS); |
| return 0; |
| } |
| if (!has_ticket && hints_obj->renew_ticket) { |
| OPENSSL_PUT_ERROR(SSL, SSL_R_COULD_NOT_PARSE_HINTS); |
| return 0; |
| } |
| |
| ssl_impl->s3->hs->provided_hints = std::move(hints_obj); |
| return 1; |
| } |
