ssl/ssl_versions.cc - boringssl - Git at Google

 /* Copyright (c) 2017, Google Inc.
  *
  * Permission to use, copy, modify, and/or distribute this software for any
  * purpose with or without fee is hereby granted, provided that the above
  * copyright notice and this permission notice appear in all copies.
  *
  * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
  * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
  * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY
  * SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
  * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION
  * OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN
  * CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE. */

 #include <openssl/ssl.h>

 #include <assert.h>

 #include <openssl/bytestring.h>
 #include <openssl/err.h>

 #include "internal.h"
 #include "../crypto/internal.h"


 namespace bssl {

 bool ssl_protocol_version_from_wire(uint16_t *out, uint16_t version) {
   switch (version) {
     case SSL3_VERSION:
     case TLS1_VERSION:
     case TLS1_1_VERSION:
     case TLS1_2_VERSION:
       *out = version;
       return true;

     case TLS1_3_DRAFT_VERSION:
     case TLS1_3_DRAFT21_VERSION:
     case TLS1_3_DRAFT22_VERSION:
     case TLS1_3_EXPERIMENT_VERSION:
     case TLS1_3_EXPERIMENT2_VERSION:
     case TLS1_3_EXPERIMENT3_VERSION:
       *out = TLS1_3_VERSION;
       return true;

     case DTLS1_VERSION:
       // DTLS 1.0 is analogous to TLS 1.1, not TLS 1.0.
       *out = TLS1_1_VERSION;
       return true;

     case DTLS1_2_VERSION:
       *out = TLS1_2_VERSION;
       return true;

     default:
       return false;
   }
 }

 // The follow arrays are the supported versions for TLS and DTLS, in order of
 // decreasing preference.

 static const uint16_t kTLSVersions[] = {
     TLS1_3_DRAFT22_VERSION,
     TLS1_3_EXPERIMENT3_VERSION,
     TLS1_3_EXPERIMENT2_VERSION,
     TLS1_3_EXPERIMENT_VERSION,
     TLS1_3_DRAFT_VERSION,
     TLS1_3_DRAFT21_VERSION,
     TLS1_2_VERSION,
     TLS1_1_VERSION,
     TLS1_VERSION,
     SSL3_VERSION,
 };

 static const uint16_t kDTLSVersions[] = {
     DTLS1_2_VERSION,
     DTLS1_VERSION,
 };

 static void get_method_versions(const SSL_PROTOCOL_METHOD *method,
                                 const uint16_t **out, size_t *out_num) {
   if (method->is_dtls) {
     *out = kDTLSVersions;
     *out_num = OPENSSL_ARRAY_SIZE(kDTLSVersions);
   } else {
     *out = kTLSVersions;
     *out_num = OPENSSL_ARRAY_SIZE(kTLSVersions);
   }
 }

 static bool method_supports_version(const SSL_PROTOCOL_METHOD *method,
                                     uint16_t version) {
   const uint16_t *versions;
   size_t num_versions;
   get_method_versions(method, &versions, &num_versions);
   for (size_t i = 0; i < num_versions; i++) {
     if (versions[i] == version) {
       return true;
     }
   }
   return false;
 }

 // The following functions map between API versions and wire versions. The
 // public API works on wire versions, except that TLS 1.3 draft versions all
 // appear as TLS 1.3. This will get collapsed back down when TLS 1.3 is
 // finalized.

 static const char *ssl_version_to_string(uint16_t version) {
   switch (version) {
     case TLS1_3_DRAFT_VERSION:
     case TLS1_3_DRAFT21_VERSION:
     case TLS1_3_DRAFT22_VERSION:
     case TLS1_3_EXPERIMENT_VERSION:
     case TLS1_3_EXPERIMENT2_VERSION:
     case TLS1_3_EXPERIMENT3_VERSION:
       return "TLSv1.3";

     case TLS1_2_VERSION:
       return "TLSv1.2";

     case TLS1_1_VERSION:
       return "TLSv1.1";

     case TLS1_VERSION:
       return "TLSv1";

     case SSL3_VERSION:
       return "SSLv3";

     case DTLS1_VERSION:
       return "DTLSv1";

     case DTLS1_2_VERSION:
       return "DTLSv1.2";

     default:
       return "unknown";
   }
 }

 static uint16_t wire_version_to_api(uint16_t version) {
   switch (version) {
     // Report TLS 1.3 draft versions as TLS 1.3 in the public API.
     case TLS1_3_DRAFT_VERSION:
     case TLS1_3_DRAFT21_VERSION:
     case TLS1_3_DRAFT22_VERSION:
     case TLS1_3_EXPERIMENT_VERSION:
     case TLS1_3_EXPERIMENT2_VERSION:
     case TLS1_3_EXPERIMENT3_VERSION:
       return TLS1_3_VERSION;
     default:
       return version;
   }
 }

 // api_version_to_wire maps |version| to some representative wire version. In
 // particular, it picks an arbitrary TLS 1.3 representative. This should only be
 // used in context where that does not matter.
 static bool api_version_to_wire(uint16_t *out, uint16_t version) {
   if (version == TLS1_3_DRAFT_VERSION ||
       version == TLS1_3_DRAFT21_VERSION ||
       version == TLS1_3_DRAFT22_VERSION ||
       version == TLS1_3_EXPERIMENT_VERSION ||
       version == TLS1_3_EXPERIMENT2_VERSION ||
       version == TLS1_3_EXPERIMENT3_VERSION) {
     return false;
   }
   if (version == TLS1_3_VERSION) {
     version = TLS1_3_DRAFT_VERSION;
   }

   // Check it is a real protocol version.
   uint16_t unused;
   if (!ssl_protocol_version_from_wire(&unused, version)) {
     return false;
   }

   *out = version;
   return true;
 }

 static bool set_version_bound(const SSL_PROTOCOL_METHOD *method, uint16_t *out,
                               uint16_t version) {
   if (!api_version_to_wire(&version, version) ||
       !method_supports_version(method, version) ||
       !ssl_protocol_version_from_wire(out, version)) {
     OPENSSL_PUT_ERROR(SSL, SSL_R_UNKNOWN_SSL_VERSION);
     return false;
   }

   return true;
 }

 static bool set_min_version(const SSL_PROTOCOL_METHOD *method, uint16_t *out,
                             uint16_t version) {
   // Zero is interpreted as the default minimum version.
   if (version == 0) {
     // SSL 3.0 is disabled by default and TLS 1.0 does not exist in DTLS.
     *out = method->is_dtls ? TLS1_1_VERSION : TLS1_VERSION;
     return true;
   }

   return set_version_bound(method, out, version);
 }

 static bool set_max_version(const SSL_PROTOCOL_METHOD *method, uint16_t *out,
                             uint16_t version) {
   // Zero is interpreted as the default maximum version.
   if (version == 0) {
     *out = TLS1_2_VERSION;
     return true;
   }

   return set_version_bound(method, out, version);
 }

 const struct {
   uint16_t version;
   uint32_t flag;
 } kProtocolVersions[] = {
     {SSL3_VERSION, SSL_OP_NO_SSLv3},
     {TLS1_VERSION, SSL_OP_NO_TLSv1},
     {TLS1_1_VERSION, SSL_OP_NO_TLSv1_1},
     {TLS1_2_VERSION, SSL_OP_NO_TLSv1_2},
     {TLS1_3_VERSION, SSL_OP_NO_TLSv1_3},
 };

 bool ssl_get_version_range(const SSL *ssl, uint16_t *out_min_version,
                            uint16_t *out_max_version) {
   // For historical reasons, |SSL_OP_NO_DTLSv1| aliases |SSL_OP_NO_TLSv1|, but
   // DTLS 1.0 should be mapped to TLS 1.1.
   uint32_t options = ssl->options;
   if (SSL_is_dtls(ssl)) {
     options &= ~SSL_OP_NO_TLSv1_1;
     if (options & SSL_OP_NO_DTLSv1) {
       options |= SSL_OP_NO_TLSv1_1;
     }
   }

   uint16_t min_version = ssl->conf_min_version;
   uint16_t max_version = ssl->conf_max_version;

   // OpenSSL's API for controlling versions entails blacklisting individual
   // protocols. This has two problems. First, on the client, the protocol can
   // only express a contiguous range of versions. Second, a library consumer
   // trying to set a maximum version cannot disable protocol versions that get
   // added in a future version of the library.
   //
   // To account for both of these, OpenSSL interprets the client-side bitmask
   // as a min/max range by picking the lowest contiguous non-empty range of
   // enabled protocols. Note that this means it is impossible to set a maximum
   // version of the higest supported TLS version in a future-proof way.
   bool any_enabled = false;
   for (size_t i = 0; i < OPENSSL_ARRAY_SIZE(kProtocolVersions); i++) {
     // Only look at the versions already enabled.
     if (min_version > kProtocolVersions[i].version) {
       continue;
     }
     if (max_version < kProtocolVersions[i].version) {
       break;
     }

     if (!(options & kProtocolVersions[i].flag)) {
       // The minimum version is the first enabled version.
       if (!any_enabled) {
         any_enabled = true;
         min_version = kProtocolVersions[i].version;
       }
       continue;
     }

     // If there is a disabled version after the first enabled one, all versions
     // after it are implicitly disabled.
     if (any_enabled) {
       max_version = kProtocolVersions[i-1].version;
       break;
     }
   }

   if (!any_enabled) {
     OPENSSL_PUT_ERROR(SSL, SSL_R_NO_SUPPORTED_VERSIONS_ENABLED);
     return false;
   }

   *out_min_version = min_version;
   *out_max_version = max_version;
   return true;
 }

 static uint16_t ssl_version(const SSL *ssl) {
   // In early data, we report the predicted version.
   if (SSL_in_early_data(ssl) && !ssl->server) {
     return ssl->s3->hs->early_session->ssl_version;
   }
   return ssl->version;
 }

 uint16_t ssl_protocol_version(const SSL *ssl) {
   assert(ssl->s3->have_version);
   uint16_t version;
   if (!ssl_protocol_version_from_wire(&version, ssl->version)) {
     // |ssl->version| will always be set to a valid version.
     assert(0);
     return 0;
   }

   return version;
 }

 bool ssl_supports_version(SSL_HANDSHAKE *hs, uint16_t version) {
   SSL *const ssl = hs->ssl;
   uint16_t protocol_version;
   if (!method_supports_version(ssl->method, version) ||
       !ssl_protocol_version_from_wire(&protocol_version, version) ||
       hs->min_version > protocol_version ||
       protocol_version > hs->max_version) {
     return false;
   }

   // TLS 1.3 variants must additionally match |tls13_variant|.
   if (protocol_version != TLS1_3_VERSION ||
       (ssl->tls13_variant == tls13_experiment &&
        version == TLS1_3_EXPERIMENT_VERSION) ||
       (ssl->tls13_variant == tls13_experiment2 &&
        version == TLS1_3_EXPERIMENT2_VERSION) ||
       (ssl->tls13_variant == tls13_experiment3 &&
        version == TLS1_3_EXPERIMENT3_VERSION) ||
       (ssl->tls13_variant == tls13_draft21 &&
        version == TLS1_3_DRAFT21_VERSION) ||
       (ssl->tls13_variant == tls13_draft22 &&
        version == TLS1_3_DRAFT22_VERSION) ||
       (ssl->tls13_variant == tls13_default &&
        version == TLS1_3_DRAFT_VERSION)) {
     return true;
   }

   // The server, when not configured at |tls13_default|, should additionally
   // enable all variants, except draft-21 which is implemented solely for QUIC
   // interop testing and will not be deployed, and draft-22 which will be
   // enabled once the draft is finalized and ready to be deployed in Chrome.
   // Currently, this is to implement the draft-18 vs. experiments field trials.
   // In the future, this will be to transition cleanly to a final draft-22
   // which hopefully includes the deployability fixes.
   if (ssl->server &&
       ssl->tls13_variant != tls13_default &&
       version != TLS1_3_DRAFT21_VERSION &&
       version != TLS1_3_DRAFT22_VERSION) {
     return true;
   }

   return false;
 }

 bool ssl_add_supported_versions(SSL_HANDSHAKE *hs, CBB *cbb) {
   const uint16_t *versions;
   size_t num_versions;
   get_method_versions(hs->ssl->method, &versions, &num_versions);
   for (size_t i = 0; i < num_versions; i++) {
     if (ssl_supports_version(hs, versions[i]) &&
         !CBB_add_u16(cbb, versions[i])) {
       return false;
     }
   }
   return true;
 }

 bool ssl_negotiate_version(SSL_HANDSHAKE *hs, uint8_t *out_alert,
                            uint16_t *out_version, const CBS *peer_versions) {
   const uint16_t *versions;
   size_t num_versions;
   get_method_versions(hs->ssl->method, &versions, &num_versions);
   for (size_t i = 0; i < num_versions; i++) {
     if (!ssl_supports_version(hs, versions[i])) {
       continue;
     }

     CBS copy = *peer_versions;
     while (CBS_len(&copy) != 0) {
       uint16_t version;
       if (!CBS_get_u16(&copy, &version)) {
         OPENSSL_PUT_ERROR(SSL, SSL_R_DECODE_ERROR);
         *out_alert = SSL_AD_DECODE_ERROR;
         return false;
       }

       if (version == versions[i]) {
         *out_version = version;
         return true;
       }
     }
   }

   OPENSSL_PUT_ERROR(SSL, SSL_R_UNSUPPORTED_PROTOCOL);
   *out_alert = SSL_AD_PROTOCOL_VERSION;
   return false;
 }

 bool ssl_is_draft21(uint16_t version) {
   return version == TLS1_3_DRAFT21_VERSION || version == TLS1_3_DRAFT22_VERSION;
 }

 bool ssl_is_draft22(uint16_t version) {
   return version == TLS1_3_DRAFT22_VERSION;
 }

 bool ssl_is_resumption_experiment(uint16_t version) {
   return version == TLS1_3_EXPERIMENT_VERSION ||
          version == TLS1_3_EXPERIMENT2_VERSION ||
          version == TLS1_3_EXPERIMENT3_VERSION ||
          version == TLS1_3_DRAFT22_VERSION;
 }

 bool ssl_is_resumption_variant(uint16_t max_version,
                                enum tls13_variant_t variant) {
   if (max_version < TLS1_3_VERSION) {
     return false;
   }
   return variant == tls13_experiment || variant == tls13_experiment2 ||
          variant == tls13_experiment3 || variant == tls13_draft22;
 }

 bool ssl_is_resumption_client_ccs_experiment(uint16_t version) {
   return version == TLS1_3_EXPERIMENT_VERSION ||
          version == TLS1_3_EXPERIMENT2_VERSION ||
          version == TLS1_3_DRAFT22_VERSION;
 }

 bool ssl_is_resumption_record_version_experiment(uint16_t version) {
   return version == TLS1_3_EXPERIMENT2_VERSION ||
          version == TLS1_3_EXPERIMENT3_VERSION ||
          version == TLS1_3_DRAFT22_VERSION;
 }

 }  // namespace bssl

 using namespace bssl;

 int SSL_CTX_set_min_proto_version(SSL_CTX *ctx, uint16_t version) {
   return set_min_version(ctx->method, &ctx->conf_min_version, version);
 }

 int SSL_CTX_set_max_proto_version(SSL_CTX *ctx, uint16_t version) {
   return set_max_version(ctx->method, &ctx->conf_max_version, version);
 }

 int SSL_set_min_proto_version(SSL *ssl, uint16_t version) {
   return set_min_version(ssl->method, &ssl->conf_min_version, version);
 }

 int SSL_set_max_proto_version(SSL *ssl, uint16_t version) {
   return set_max_version(ssl->method, &ssl->conf_max_version, version);
 }

 int SSL_version(const SSL *ssl) {
   return wire_version_to_api(ssl_version(ssl));
 }

 const char *SSL_get_version(const SSL *ssl) {
   return ssl_version_to_string(ssl_version(ssl));
 }

 const char *SSL_SESSION_get_version(const SSL_SESSION *session) {
   return ssl_version_to_string(session->ssl_version);
 }

 uint16_t SSL_SESSION_get_protocol_version(const SSL_SESSION *session) {
   return wire_version_to_api(session->ssl_version);
 }

 int SSL_SESSION_set_protocol_version(SSL_SESSION *session, uint16_t version) {
   // This picks a representative TLS 1.3 version, but this API should only be
   // used on unit test sessions anyway.
   return api_version_to_wire(&session->ssl_version, version);
 }
	/* Copyright (c) 2017, Google Inc.
	*
	* Permission to use, copy, modify, and/or distribute this software for any
	* purpose with or without fee is hereby granted, provided that the above
	* copyright notice and this permission notice appear in all copies.
	*
	* THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
	* WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
	* MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY
	* SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
	* WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION
	* OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN
	* CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE. */

	#include <openssl/ssl.h>

	#include <assert.h>

	#include <openssl/bytestring.h>
	#include <openssl/err.h>

	#include "internal.h"
	#include "../crypto/internal.h"


	namespace bssl {

	bool ssl_protocol_version_from_wire(uint16_t *out, uint16_t version) {
	switch (version) {
	case SSL3_VERSION:
	case TLS1_VERSION:
	case TLS1_1_VERSION:
	case TLS1_2_VERSION:
	*out = version;
	return true;

	case TLS1_3_DRAFT_VERSION:
	case TLS1_3_DRAFT21_VERSION:
	case TLS1_3_DRAFT22_VERSION:
	case TLS1_3_EXPERIMENT_VERSION:
	case TLS1_3_EXPERIMENT2_VERSION:
	case TLS1_3_EXPERIMENT3_VERSION:
	*out = TLS1_3_VERSION;
	return true;

	case DTLS1_VERSION:
	// DTLS 1.0 is analogous to TLS 1.1, not TLS 1.0.
	*out = TLS1_1_VERSION;
	return true;

	case DTLS1_2_VERSION:
	*out = TLS1_2_VERSION;
	return true;

	default:
	return false;
	}
	}

	// The follow arrays are the supported versions for TLS and DTLS, in order of
	// decreasing preference.

	static const uint16_t kTLSVersions[] = {
	TLS1_3_DRAFT22_VERSION,
	TLS1_3_EXPERIMENT3_VERSION,
	TLS1_3_EXPERIMENT2_VERSION,
	TLS1_3_EXPERIMENT_VERSION,
	TLS1_3_DRAFT_VERSION,
	TLS1_3_DRAFT21_VERSION,
	TLS1_2_VERSION,
	TLS1_1_VERSION,
	TLS1_VERSION,
	SSL3_VERSION,
	};

	static const uint16_t kDTLSVersions[] = {
	DTLS1_2_VERSION,
	DTLS1_VERSION,
	};

	static void get_method_versions(const SSL_PROTOCOL_METHOD *method,
	const uint16_t *out, size_t out_num) {
	if (method->is_dtls) {
	*out = kDTLSVersions;
	*out_num = OPENSSL_ARRAY_SIZE(kDTLSVersions);
	} else {
	*out = kTLSVersions;
	*out_num = OPENSSL_ARRAY_SIZE(kTLSVersions);
	}
	}

	static bool method_supports_version(const SSL_PROTOCOL_METHOD *method,
	uint16_t version) {
	const uint16_t *versions;
	size_t num_versions;
	get_method_versions(method, &versions, &num_versions);
	for (size_t i = 0; i < num_versions; i++) {
	if (versions[i] == version) {
	return true;
	}
	}
	return false;
	}

	// The following functions map between API versions and wire versions. The
	// public API works on wire versions, except that TLS 1.3 draft versions all
	// appear as TLS 1.3. This will get collapsed back down when TLS 1.3 is
	// finalized.

	static const char *ssl_version_to_string(uint16_t version) {
	switch (version) {
	case TLS1_3_DRAFT_VERSION:
	case TLS1_3_DRAFT21_VERSION:
	case TLS1_3_DRAFT22_VERSION:
	case TLS1_3_EXPERIMENT_VERSION:
	case TLS1_3_EXPERIMENT2_VERSION:
	case TLS1_3_EXPERIMENT3_VERSION:
	return "TLSv1.3";

	case TLS1_2_VERSION:
	return "TLSv1.2";

	case TLS1_1_VERSION:
	return "TLSv1.1";

	case TLS1_VERSION:
	return "TLSv1";

	case SSL3_VERSION:
	return "SSLv3";

	case DTLS1_VERSION:
	return "DTLSv1";

	case DTLS1_2_VERSION:
	return "DTLSv1.2";

	default:
	return "unknown";
	}
	}

	static uint16_t wire_version_to_api(uint16_t version) {
	switch (version) {
	// Report TLS 1.3 draft versions as TLS 1.3 in the public API.
	case TLS1_3_DRAFT_VERSION:
	case TLS1_3_DRAFT21_VERSION:
	case TLS1_3_DRAFT22_VERSION:
	case TLS1_3_EXPERIMENT_VERSION:
	case TLS1_3_EXPERIMENT2_VERSION:
	case TLS1_3_EXPERIMENT3_VERSION:
	return TLS1_3_VERSION;
	default:
	return version;
	}
	}

	// api_version_to_wire maps \|version\| to some representative wire version. In
	// particular, it picks an arbitrary TLS 1.3 representative. This should only be
	// used in context where that does not matter.
	static bool api_version_to_wire(uint16_t *out, uint16_t version) {
	if (version == TLS1_3_DRAFT_VERSION \|\|
	version == TLS1_3_DRAFT21_VERSION \|\|
	version == TLS1_3_DRAFT22_VERSION \|\|
	version == TLS1_3_EXPERIMENT_VERSION \|\|
	version == TLS1_3_EXPERIMENT2_VERSION \|\|
	version == TLS1_3_EXPERIMENT3_VERSION) {
	return false;
	}
	if (version == TLS1_3_VERSION) {
	version = TLS1_3_DRAFT_VERSION;
	}

	// Check it is a real protocol version.
	uint16_t unused;
	if (!ssl_protocol_version_from_wire(&unused, version)) {
	return false;
	}

	*out = version;
	return true;
	}

	static bool set_version_bound(const SSL_PROTOCOL_METHOD method, uint16_t out,
	uint16_t version) {
	if (!api_version_to_wire(&version, version) \|\|
	!method_supports_version(method, version) \|\|
	!ssl_protocol_version_from_wire(out, version)) {
	OPENSSL_PUT_ERROR(SSL, SSL_R_UNKNOWN_SSL_VERSION);
	return false;
	}

	return true;
	}

	static bool set_min_version(const SSL_PROTOCOL_METHOD method, uint16_t out,
	uint16_t version) {
	// Zero is interpreted as the default minimum version.
	if (version == 0) {
	// SSL 3.0 is disabled by default and TLS 1.0 does not exist in DTLS.
	*out = method->is_dtls ? TLS1_1_VERSION : TLS1_VERSION;
	return true;
	}

	return set_version_bound(method, out, version);
	}

	static bool set_max_version(const SSL_PROTOCOL_METHOD method, uint16_t out,
	uint16_t version) {
	// Zero is interpreted as the default maximum version.
	if (version == 0) {
	*out = TLS1_2_VERSION;
	return true;
	}

	return set_version_bound(method, out, version);
	}

	const struct {
	uint16_t version;
	uint32_t flag;
	} kProtocolVersions[] = {
	{SSL3_VERSION, SSL_OP_NO_SSLv3},
	{TLS1_VERSION, SSL_OP_NO_TLSv1},
	{TLS1_1_VERSION, SSL_OP_NO_TLSv1_1},
	{TLS1_2_VERSION, SSL_OP_NO_TLSv1_2},
	{TLS1_3_VERSION, SSL_OP_NO_TLSv1_3},
	};

	bool ssl_get_version_range(const SSL ssl, uint16_t out_min_version,
	uint16_t *out_max_version) {
	// For historical reasons, \|SSL_OP_NO_DTLSv1\| aliases \|SSL_OP_NO_TLSv1\|, but
	// DTLS 1.0 should be mapped to TLS 1.1.
	uint32_t options = ssl->options;
	if (SSL_is_dtls(ssl)) {
	options &= ~SSL_OP_NO_TLSv1_1;
	if (options & SSL_OP_NO_DTLSv1) {
	options \|= SSL_OP_NO_TLSv1_1;
	}
	}

	uint16_t min_version = ssl->conf_min_version;
	uint16_t max_version = ssl->conf_max_version;

	// OpenSSL's API for controlling versions entails blacklisting individual
	// protocols. This has two problems. First, on the client, the protocol can
	// only express a contiguous range of versions. Second, a library consumer
	// trying to set a maximum version cannot disable protocol versions that get
	// added in a future version of the library.
	//
	// To account for both of these, OpenSSL interprets the client-side bitmask
	// as a min/max range by picking the lowest contiguous non-empty range of
	// enabled protocols. Note that this means it is impossible to set a maximum
	// version of the higest supported TLS version in a future-proof way.
	bool any_enabled = false;
	for (size_t i = 0; i < OPENSSL_ARRAY_SIZE(kProtocolVersions); i++) {
	// Only look at the versions already enabled.
	if (min_version > kProtocolVersions[i].version) {
	continue;
	}
	if (max_version < kProtocolVersions[i].version) {
	break;
	}

	if (!(options & kProtocolVersions[i].flag)) {
	// The minimum version is the first enabled version.
	if (!any_enabled) {
	any_enabled = true;
	min_version = kProtocolVersions[i].version;
	}
	continue;
	}

	// If there is a disabled version after the first enabled one, all versions
	// after it are implicitly disabled.
	if (any_enabled) {
	max_version = kProtocolVersions[i-1].version;
	break;
	}
	}

	if (!any_enabled) {
	OPENSSL_PUT_ERROR(SSL, SSL_R_NO_SUPPORTED_VERSIONS_ENABLED);
	return false;
	}

	*out_min_version = min_version;
	*out_max_version = max_version;
	return true;
	}

	static uint16_t ssl_version(const SSL *ssl) {
	// In early data, we report the predicted version.
	if (SSL_in_early_data(ssl) && !ssl->server) {
	return ssl->s3->hs->early_session->ssl_version;
	}
	return ssl->version;
	}

	uint16_t ssl_protocol_version(const SSL *ssl) {
	assert(ssl->s3->have_version);
	uint16_t version;
	if (!ssl_protocol_version_from_wire(&version, ssl->version)) {
	// \|ssl->version\| will always be set to a valid version.
	assert(0);
	return 0;
	}

	return version;
	}

	bool ssl_supports_version(SSL_HANDSHAKE *hs, uint16_t version) {
	SSL *const ssl = hs->ssl;
	uint16_t protocol_version;
	if (!method_supports_version(ssl->method, version) \|\|
	!ssl_protocol_version_from_wire(&protocol_version, version) \|\|
	hs->min_version > protocol_version \|\|
	protocol_version > hs->max_version) {
	return false;
	}

	// TLS 1.3 variants must additionally match \|tls13_variant\|.
	if (protocol_version != TLS1_3_VERSION \|\|
	(ssl->tls13_variant == tls13_experiment &&
	version == TLS1_3_EXPERIMENT_VERSION) \|\|
	(ssl->tls13_variant == tls13_experiment2 &&
	version == TLS1_3_EXPERIMENT2_VERSION) \|\|
	(ssl->tls13_variant == tls13_experiment3 &&
	version == TLS1_3_EXPERIMENT3_VERSION) \|\|
	(ssl->tls13_variant == tls13_draft21 &&
	version == TLS1_3_DRAFT21_VERSION) \|\|
	(ssl->tls13_variant == tls13_draft22 &&
	version == TLS1_3_DRAFT22_VERSION) \|\|
	(ssl->tls13_variant == tls13_default &&
	version == TLS1_3_DRAFT_VERSION)) {
	return true;
	}

	// The server, when not configured at \|tls13_default\|, should additionally
	// enable all variants, except draft-21 which is implemented solely for QUIC
	// interop testing and will not be deployed, and draft-22 which will be
	// enabled once the draft is finalized and ready to be deployed in Chrome.
	// Currently, this is to implement the draft-18 vs. experiments field trials.
	// In the future, this will be to transition cleanly to a final draft-22
	// which hopefully includes the deployability fixes.
	if (ssl->server &&
	ssl->tls13_variant != tls13_default &&
	version != TLS1_3_DRAFT21_VERSION &&
	version != TLS1_3_DRAFT22_VERSION) {
	return true;
	}

	return false;
	}

	bool ssl_add_supported_versions(SSL_HANDSHAKE hs, CBB cbb) {
	const uint16_t *versions;
	size_t num_versions;
	get_method_versions(hs->ssl->method, &versions, &num_versions);
	for (size_t i = 0; i < num_versions; i++) {
	if (ssl_supports_version(hs, versions[i]) &&
	!CBB_add_u16(cbb, versions[i])) {
	return false;
	}
	}
	return true;
	}

	bool ssl_negotiate_version(SSL_HANDSHAKE hs, uint8_t out_alert,
	uint16_t out_version, const CBS peer_versions) {
	const uint16_t *versions;
	size_t num_versions;
	get_method_versions(hs->ssl->method, &versions, &num_versions);
	for (size_t i = 0; i < num_versions; i++) {
	if (!ssl_supports_version(hs, versions[i])) {
	continue;
	}

	CBS copy = *peer_versions;
	while (CBS_len(&copy) != 0) {
	uint16_t version;
	if (!CBS_get_u16(&copy, &version)) {
	OPENSSL_PUT_ERROR(SSL, SSL_R_DECODE_ERROR);
	*out_alert = SSL_AD_DECODE_ERROR;
	return false;
	}

	if (version == versions[i]) {
	*out_version = version;
	return true;
	}
	}
	}

	OPENSSL_PUT_ERROR(SSL, SSL_R_UNSUPPORTED_PROTOCOL);
	*out_alert = SSL_AD_PROTOCOL_VERSION;
	return false;
	}

	bool ssl_is_draft21(uint16_t version) {
	return version == TLS1_3_DRAFT21_VERSION \|\| version == TLS1_3_DRAFT22_VERSION;
	}

	bool ssl_is_draft22(uint16_t version) {
	return version == TLS1_3_DRAFT22_VERSION;
	}

	bool ssl_is_resumption_experiment(uint16_t version) {
	return version == TLS1_3_EXPERIMENT_VERSION \|\|
	version == TLS1_3_EXPERIMENT2_VERSION \|\|
	version == TLS1_3_EXPERIMENT3_VERSION \|\|
	version == TLS1_3_DRAFT22_VERSION;
	}

	bool ssl_is_resumption_variant(uint16_t max_version,
	enum tls13_variant_t variant) {
	if (max_version < TLS1_3_VERSION) {
	return false;
	}
	return variant == tls13_experiment \|\| variant == tls13_experiment2 \|\|
	variant == tls13_experiment3 \|\| variant == tls13_draft22;
	}

	bool ssl_is_resumption_client_ccs_experiment(uint16_t version) {
	return version == TLS1_3_EXPERIMENT_VERSION \|\|
	version == TLS1_3_EXPERIMENT2_VERSION \|\|
	version == TLS1_3_DRAFT22_VERSION;
	}

	bool ssl_is_resumption_record_version_experiment(uint16_t version) {
	return version == TLS1_3_EXPERIMENT2_VERSION \|\|
	version == TLS1_3_EXPERIMENT3_VERSION \|\|
	version == TLS1_3_DRAFT22_VERSION;
	}

	} // namespace bssl

	using namespace bssl;

	int SSL_CTX_set_min_proto_version(SSL_CTX *ctx, uint16_t version) {
	return set_min_version(ctx->method, &ctx->conf_min_version, version);
	}

	int SSL_CTX_set_max_proto_version(SSL_CTX *ctx, uint16_t version) {
	return set_max_version(ctx->method, &ctx->conf_max_version, version);
	}

	int SSL_set_min_proto_version(SSL *ssl, uint16_t version) {
	return set_min_version(ssl->method, &ssl->conf_min_version, version);
	}

	int SSL_set_max_proto_version(SSL *ssl, uint16_t version) {
	return set_max_version(ssl->method, &ssl->conf_max_version, version);
	}

	int SSL_version(const SSL *ssl) {
	return wire_version_to_api(ssl_version(ssl));
	}

	const char SSL_get_version(const SSL ssl) {
	return ssl_version_to_string(ssl_version(ssl));
	}

	const char SSL_SESSION_get_version(const SSL_SESSION session) {
	return ssl_version_to_string(session->ssl_version);
	}

	uint16_t SSL_SESSION_get_protocol_version(const SSL_SESSION *session) {
	return wire_version_to_api(session->ssl_version);
	}

	int SSL_SESSION_set_protocol_version(SSL_SESSION *session, uint16_t version) {
	// This picks a representative TLS 1.3 version, but this API should only be
	// used on unit test sessions anyway.
	return api_version_to_wire(&session->ssl_version, version);
	}