grpc 1.26.0 → 1.30.0

Sign up to get free protection for your applications and to get access to all the features.

Potentially problematic release.


This version of grpc might be problematic. Click here for more details.

Files changed (1240) hide show
  1. checksums.yaml +4 -4
  2. data/Makefile +7860 -11139
  3. data/etc/roots.pem +44 -0
  4. data/include/grpc/grpc.h +2 -2
  5. data/include/grpc/grpc_security.h +59 -24
  6. data/include/grpc/grpc_security_constants.h +28 -0
  7. data/include/grpc/impl/codegen/grpc_types.h +38 -21
  8. data/include/grpc/impl/codegen/port_platform.h +14 -3
  9. data/include/grpc/impl/codegen/sync.h +5 -3
  10. data/include/grpc/impl/codegen/sync_abseil.h +36 -0
  11. data/include/grpc/module.modulemap +25 -37
  12. data/include/grpc/support/sync_abseil.h +26 -0
  13. data/src/core/ext/filters/client_channel/backend_metric.cc +7 -4
  14. data/src/core/ext/filters/client_channel/client_channel.cc +273 -264
  15. data/src/core/ext/filters/client_channel/client_channel_channelz.cc +31 -47
  16. data/src/core/ext/filters/client_channel/client_channel_channelz.h +1 -3
  17. data/src/core/ext/filters/client_channel/client_channel_plugin.cc +3 -2
  18. data/src/core/ext/filters/client_channel/health/health_check_client.cc +7 -22
  19. data/src/core/ext/filters/client_channel/health/health_check_client.h +3 -3
  20. data/src/core/ext/filters/client_channel/http_connect_handshaker.cc +1 -1
  21. data/src/core/ext/filters/client_channel/http_proxy.cc +25 -15
  22. data/src/core/ext/filters/client_channel/lb_policy.cc +20 -18
  23. data/src/core/ext/filters/client_channel/lb_policy.h +42 -33
  24. data/src/core/ext/filters/client_channel/lb_policy/address_filtering.cc +83 -0
  25. data/src/core/ext/filters/client_channel/lb_policy/address_filtering.h +99 -0
  26. data/src/core/ext/filters/client_channel/lb_policy/child_policy_handler.cc +297 -0
  27. data/src/core/ext/filters/client_channel/lb_policy/child_policy_handler.h +83 -0
  28. data/src/core/ext/filters/client_channel/lb_policy/grpclb/grpclb.cc +423 -627
  29. data/src/core/ext/filters/client_channel/lb_policy/grpclb/grpclb_balancer_addresses.cc +89 -0
  30. data/src/core/ext/filters/client_channel/lb_policy/grpclb/grpclb_balancer_addresses.h +40 -0
  31. data/src/core/ext/filters/client_channel/lb_policy/grpclb/grpclb_channel_secure.cc +11 -9
  32. data/src/core/ext/filters/client_channel/lb_policy/grpclb/grpclb_client_stats.h +3 -2
  33. data/src/core/ext/filters/client_channel/lb_policy/grpclb/load_balancer_api.cc +88 -121
  34. data/src/core/ext/filters/client_channel/lb_policy/grpclb/load_balancer_api.h +28 -57
  35. data/src/core/ext/filters/client_channel/lb_policy/pick_first/pick_first.cc +18 -21
  36. data/src/core/ext/filters/client_channel/lb_policy/priority/priority.cc +871 -0
  37. data/src/core/ext/filters/client_channel/lb_policy/round_robin/round_robin.cc +10 -14
  38. data/src/core/ext/filters/client_channel/lb_policy/subchannel_list.h +5 -11
  39. data/src/core/ext/filters/client_channel/lb_policy/weighted_target/weighted_target.cc +734 -0
  40. data/src/core/ext/filters/client_channel/lb_policy/xds/cds.cc +150 -101
  41. data/src/core/ext/filters/client_channel/lb_policy/xds/eds.cc +938 -0
  42. data/src/core/ext/filters/client_channel/lb_policy/xds/lrs.cc +528 -0
  43. data/src/core/ext/filters/client_channel/lb_policy/xds/xds.h +1 -2
  44. data/src/core/ext/filters/client_channel/lb_policy/xds/xds_routing.cc +834 -0
  45. data/src/core/ext/filters/client_channel/lb_policy_factory.h +3 -3
  46. data/src/core/ext/filters/client_channel/lb_policy_registry.cc +49 -77
  47. data/src/core/ext/filters/client_channel/lb_policy_registry.h +1 -1
  48. data/src/core/ext/filters/client_channel/local_subchannel_pool.h +2 -1
  49. data/src/core/ext/filters/client_channel/parse_address.cc +22 -21
  50. data/src/core/ext/filters/client_channel/resolver.cc +5 -8
  51. data/src/core/ext/filters/client_channel/resolver.h +12 -14
  52. data/src/core/ext/filters/client_channel/resolver/dns/c_ares/dns_resolver_ares.cc +129 -128
  53. data/src/core/ext/filters/client_channel/resolver/dns/c_ares/grpc_ares_ev_driver.cc +35 -35
  54. data/src/core/ext/filters/client_channel/resolver/dns/c_ares/grpc_ares_ev_driver.h +8 -7
  55. data/src/core/ext/filters/client_channel/resolver/dns/c_ares/grpc_ares_ev_driver_libuv.cc +17 -21
  56. data/src/core/ext/filters/client_channel/resolver/dns/c_ares/grpc_ares_ev_driver_posix.cc +5 -5
  57. data/src/core/ext/filters/client_channel/resolver/dns/c_ares/grpc_ares_ev_driver_windows.cc +72 -117
  58. data/src/core/ext/filters/client_channel/resolver/dns/c_ares/grpc_ares_wrapper.cc +186 -135
  59. data/src/core/ext/filters/client_channel/resolver/dns/c_ares/grpc_ares_wrapper.h +5 -3
  60. data/src/core/ext/filters/client_channel/resolver/dns/c_ares/grpc_ares_wrapper_fallback.cc +7 -4
  61. data/src/core/ext/filters/client_channel/resolver/dns/native/dns_resolver.cc +42 -45
  62. data/src/core/ext/filters/client_channel/resolver/fake/fake_resolver.cc +94 -103
  63. data/src/core/ext/filters/client_channel/resolver/fake/fake_resolver.h +0 -4
  64. data/src/core/ext/filters/client_channel/resolver/sockaddr/sockaddr_resolver.cc +5 -5
  65. data/src/core/ext/filters/client_channel/resolver/xds/xds_resolver.cc +61 -10
  66. data/src/core/ext/filters/client_channel/resolver_factory.h +2 -2
  67. data/src/core/ext/filters/client_channel/resolver_registry.cc +6 -3
  68. data/src/core/ext/filters/client_channel/resolver_registry.h +8 -8
  69. data/src/core/ext/filters/client_channel/resolver_result_parsing.cc +242 -300
  70. data/src/core/ext/filters/client_channel/resolver_result_parsing.h +21 -18
  71. data/src/core/ext/filters/client_channel/resolving_lb_policy.cc +56 -206
  72. data/src/core/ext/filters/client_channel/resolving_lb_policy.h +11 -14
  73. data/src/core/ext/filters/client_channel/server_address.cc +6 -9
  74. data/src/core/ext/filters/client_channel/server_address.h +6 -12
  75. data/src/core/ext/filters/client_channel/service_config.cc +144 -253
  76. data/src/core/ext/filters/client_channel/service_config.h +32 -109
  77. data/src/core/ext/filters/client_channel/service_config_call_data.h +68 -0
  78. data/src/core/ext/filters/client_channel/service_config_parser.cc +87 -0
  79. data/src/core/ext/filters/client_channel/service_config_parser.h +89 -0
  80. data/src/core/ext/filters/client_channel/subchannel.cc +54 -24
  81. data/src/core/ext/filters/client_channel/subchannel.h +35 -11
  82. data/src/core/ext/filters/client_channel/xds/xds_api.cc +1556 -232
  83. data/src/core/ext/filters/client_channel/xds/xds_api.h +213 -114
  84. data/src/core/ext/filters/client_channel/xds/xds_bootstrap.cc +237 -345
  85. data/src/core/ext/filters/client_channel/xds/xds_bootstrap.h +34 -46
  86. data/src/core/ext/filters/client_channel/xds/xds_channel.h +3 -1
  87. data/src/core/ext/filters/client_channel/xds/xds_channel_secure.cc +18 -11
  88. data/src/core/ext/filters/client_channel/xds/xds_client.cc +1326 -399
  89. data/src/core/ext/filters/client_channel/xds/xds_client.h +124 -41
  90. data/src/core/ext/filters/client_channel/xds/xds_client_stats.cc +59 -138
  91. data/src/core/ext/filters/client_channel/xds/xds_client_stats.h +133 -154
  92. data/src/core/ext/filters/http/client/http_client_filter.cc +23 -28
  93. data/src/core/ext/filters/http/client_authority_filter.cc +4 -4
  94. data/src/core/ext/filters/http/http_filters_plugin.cc +27 -12
  95. data/src/core/ext/filters/http/message_compress/message_compress_filter.cc +258 -221
  96. data/src/core/ext/filters/http/message_compress/message_decompress_filter.cc +358 -0
  97. data/src/core/ext/filters/http/message_compress/message_decompress_filter.h +29 -0
  98. data/src/core/ext/filters/message_size/message_size_filter.cc +38 -44
  99. data/src/core/ext/filters/message_size/message_size_filter.h +5 -5
  100. data/src/core/ext/transport/chttp2/server/chttp2_server.cc +7 -10
  101. data/src/core/ext/transport/chttp2/transport/bin_encoder.cc +4 -6
  102. data/src/core/ext/transport/chttp2/transport/chttp2_transport.cc +28 -29
  103. data/src/core/ext/transport/chttp2/transport/chttp2_transport.h +1 -0
  104. data/src/core/ext/transport/chttp2/transport/flow_control.cc +3 -3
  105. data/src/core/ext/transport/chttp2/transport/frame_goaway.h +2 -3
  106. data/src/core/ext/transport/chttp2/transport/frame_ping.h +2 -3
  107. data/src/core/ext/transport/chttp2/transport/frame_rst_stream.h +2 -3
  108. data/src/core/ext/transport/chttp2/transport/frame_settings.h +2 -3
  109. data/src/core/ext/transport/chttp2/transport/frame_window_update.h +2 -3
  110. data/src/core/ext/transport/chttp2/transport/hpack_encoder.cc +29 -16
  111. data/src/core/ext/transport/chttp2/transport/hpack_encoder.h +2 -3
  112. data/src/core/ext/transport/chttp2/transport/hpack_parser.h +2 -3
  113. data/src/core/ext/transport/chttp2/transport/hpack_table.h +2 -2
  114. data/src/core/ext/transport/chttp2/transport/http2_settings.h +4 -5
  115. data/src/core/ext/transport/chttp2/transport/huffsyms.h +2 -3
  116. data/src/core/ext/transport/chttp2/transport/internal.h +14 -21
  117. data/src/core/ext/transport/chttp2/transport/stream_map.h +2 -3
  118. data/src/core/ext/transport/chttp2/transport/writing.cc +16 -9
  119. data/src/core/ext/transport/inproc/inproc_transport.cc +41 -42
  120. data/src/core/ext/upb-generated/envoy/annotations/deprecation.upb.c +17 -0
  121. data/src/core/ext/upb-generated/envoy/annotations/deprecation.upb.h +30 -0
  122. data/src/core/ext/upb-generated/envoy/annotations/resource.upb.c +27 -0
  123. data/src/core/ext/upb-generated/envoy/annotations/resource.upb.h +54 -0
  124. data/src/core/ext/upb-generated/envoy/api/v2/auth/cert.upb.c +5 -205
  125. data/src/core/ext/upb-generated/envoy/api/v2/auth/cert.upb.h +5 -788
  126. data/src/core/ext/upb-generated/envoy/api/v2/auth/common.upb.c +114 -0
  127. data/src/core/ext/upb-generated/envoy/api/v2/auth/common.upb.h +418 -0
  128. data/src/core/ext/upb-generated/envoy/api/v2/auth/secret.upb.c +72 -0
  129. data/src/core/ext/upb-generated/envoy/api/v2/auth/secret.upb.h +197 -0
  130. data/src/core/ext/upb-generated/envoy/api/v2/auth/tls.upb.c +105 -0
  131. data/src/core/ext/upb-generated/envoy/api/v2/auth/tls.upb.h +378 -0
  132. data/src/core/ext/upb-generated/envoy/api/v2/cds.upb.c +5 -362
  133. data/src/core/ext/upb-generated/envoy/api/v2/cds.upb.h +14 -1337
  134. data/src/core/ext/upb-generated/envoy/api/v2/cluster.upb.c +403 -0
  135. data/src/core/ext/upb-generated/envoy/api/v2/cluster.upb.h +1447 -0
  136. data/src/core/ext/upb-generated/envoy/api/v2/cluster/circuit_breaker.upb.c +30 -8
  137. data/src/core/ext/upb-generated/envoy/api/v2/cluster/circuit_breaker.upb.h +60 -0
  138. data/src/core/ext/upb-generated/envoy/api/v2/cluster/filter.upb.c +2 -0
  139. data/src/core/ext/upb-generated/envoy/api/v2/cluster/outlier_detection.upb.c +2 -0
  140. data/src/core/ext/upb-generated/envoy/api/v2/core/address.upb.c +7 -4
  141. data/src/core/ext/upb-generated/envoy/api/v2/core/address.upb.h +6 -2
  142. data/src/core/ext/upb-generated/envoy/api/v2/core/backoff.upb.c +35 -0
  143. data/src/core/ext/upb-generated/envoy/api/v2/core/backoff.upb.h +78 -0
  144. data/src/core/ext/upb-generated/envoy/api/v2/core/base.upb.c +87 -23
  145. data/src/core/ext/upb-generated/envoy/api/v2/core/base.upb.h +262 -62
  146. data/src/core/ext/upb-generated/envoy/api/v2/core/config_source.upb.c +20 -15
  147. data/src/core/ext/upb-generated/envoy/api/v2/core/config_source.upb.h +46 -32
  148. data/src/core/ext/upb-generated/envoy/api/v2/core/event_service_config.upb.c +34 -0
  149. data/src/core/ext/upb-generated/envoy/api/v2/core/event_service_config.upb.h +72 -0
  150. data/src/core/ext/upb-generated/envoy/api/v2/core/grpc_service.upb.c +27 -4
  151. data/src/core/ext/upb-generated/envoy/api/v2/core/grpc_service.upb.h +70 -0
  152. data/src/core/ext/upb-generated/envoy/api/v2/core/health_check.upb.c +46 -25
  153. data/src/core/ext/upb-generated/envoy/api/v2/core/health_check.upb.h +98 -25
  154. data/src/core/ext/upb-generated/envoy/api/v2/core/http_uri.upb.c +2 -0
  155. data/src/core/ext/upb-generated/envoy/api/v2/core/protocol.upb.c +77 -21
  156. data/src/core/ext/upb-generated/envoy/api/v2/core/protocol.upb.h +201 -4
  157. data/src/core/ext/upb-generated/envoy/api/v2/core/socket_option.upb.c +34 -0
  158. data/src/core/ext/upb-generated/envoy/api/v2/core/socket_option.upb.h +89 -0
  159. data/src/core/ext/upb-generated/envoy/api/v2/discovery.upb.c +2 -0
  160. data/src/core/ext/upb-generated/envoy/api/v2/eds.upb.c +8 -68
  161. data/src/core/ext/upb-generated/envoy/api/v2/eds.upb.h +14 -201
  162. data/src/core/ext/upb-generated/envoy/api/v2/endpoint.upb.c +92 -0
  163. data/src/core/ext/upb-generated/envoy/api/v2/endpoint.upb.h +240 -0
  164. data/src/core/ext/upb-generated/envoy/api/v2/endpoint/endpoint.upb.c +2 -71
  165. data/src/core/ext/upb-generated/envoy/api/v2/endpoint/endpoint.upb.h +3 -228
  166. data/src/core/ext/upb-generated/envoy/api/v2/endpoint/endpoint_components.upb.c +91 -0
  167. data/src/core/ext/upb-generated/envoy/api/v2/endpoint/endpoint_components.upb.h +266 -0
  168. data/src/core/ext/upb-generated/envoy/api/v2/endpoint/load_report.upb.c +2 -0
  169. data/src/core/ext/upb-generated/envoy/api/v2/lds.upb.c +31 -0
  170. data/src/core/ext/upb-generated/envoy/api/v2/lds.upb.h +53 -0
  171. data/src/core/ext/upb-generated/envoy/api/v2/listener.upb.c +109 -0
  172. data/src/core/ext/upb-generated/envoy/api/v2/listener.upb.h +399 -0
  173. data/src/core/ext/upb-generated/envoy/api/v2/listener/listener.upb.c +18 -0
  174. data/src/core/ext/upb-generated/envoy/api/v2/listener/listener.upb.h +33 -0
  175. data/src/core/ext/upb-generated/envoy/api/v2/listener/listener_components.upb.c +145 -0
  176. data/src/core/ext/upb-generated/envoy/api/v2/listener/listener_components.upb.h +527 -0
  177. data/src/core/ext/upb-generated/envoy/api/v2/listener/udp_listener_config.upb.c +43 -0
  178. data/src/core/ext/upb-generated/envoy/api/v2/listener/udp_listener_config.upb.h +112 -0
  179. data/src/core/ext/upb-generated/envoy/api/v2/rds.upb.c +30 -0
  180. data/src/core/ext/upb-generated/envoy/api/v2/rds.upb.h +53 -0
  181. data/src/core/ext/upb-generated/envoy/api/v2/route.upb.c +63 -0
  182. data/src/core/ext/upb-generated/envoy/api/v2/route.upb.h +199 -0
  183. data/src/core/ext/upb-generated/envoy/api/v2/route/route.upb.c +18 -0
  184. data/src/core/ext/upb-generated/envoy/api/v2/route/route.upb.h +33 -0
  185. data/src/core/ext/upb-generated/envoy/api/v2/route/route_components.upb.c +815 -0
  186. data/src/core/ext/upb-generated/envoy/api/v2/route/route_components.upb.h +3032 -0
  187. data/src/core/ext/upb-generated/envoy/api/v2/scoped_route.upb.c +59 -0
  188. data/src/core/ext/upb-generated/envoy/api/v2/scoped_route.upb.h +134 -0
  189. data/src/core/ext/upb-generated/envoy/api/v2/srds.upb.c +28 -0
  190. data/src/core/ext/upb-generated/envoy/api/v2/srds.upb.h +53 -0
  191. data/src/core/ext/upb-generated/envoy/config/filter/accesslog/v2/accesslog.upb.c +228 -0
  192. data/src/core/ext/upb-generated/envoy/config/filter/accesslog/v2/accesslog.upb.h +725 -0
  193. data/src/core/ext/upb-generated/envoy/config/filter/network/http_connection_manager/v2/http_connection_manager.upb.c +316 -0
  194. data/src/core/ext/upb-generated/envoy/config/filter/network/http_connection_manager/v2/http_connection_manager.upb.h +1132 -0
  195. data/src/core/ext/upb-generated/envoy/config/listener/v2/api_listener.upb.c +33 -0
  196. data/src/core/ext/upb-generated/envoy/config/listener/v2/api_listener.upb.h +65 -0
  197. data/src/core/ext/upb-generated/envoy/config/trace/v2/http_tracer.upb.c +51 -0
  198. data/src/core/ext/upb-generated/envoy/config/trace/v2/http_tracer.upb.h +125 -0
  199. data/src/core/ext/upb-generated/envoy/service/discovery/v2/ads.upb.c +1 -0
  200. data/src/core/ext/upb-generated/envoy/service/load_stats/v2/lrs.upb.c +4 -2
  201. data/src/core/ext/upb-generated/envoy/service/load_stats/v2/lrs.upb.h +4 -0
  202. data/src/core/ext/upb-generated/envoy/type/http.upb.c +1 -0
  203. data/src/core/ext/upb-generated/envoy/type/matcher/regex.upb.c +63 -0
  204. data/src/core/ext/upb-generated/envoy/type/matcher/regex.upb.h +144 -0
  205. data/src/core/ext/upb-generated/envoy/type/matcher/string.upb.c +53 -0
  206. data/src/core/ext/upb-generated/envoy/type/matcher/string.upb.h +133 -0
  207. data/src/core/ext/upb-generated/envoy/type/metadata/v2/metadata.upb.c +88 -0
  208. data/src/core/ext/upb-generated/envoy/type/metadata/v2/metadata.upb.h +258 -0
  209. data/src/core/ext/upb-generated/envoy/type/percent.upb.c +1 -0
  210. data/src/core/ext/upb-generated/envoy/type/range.upb.c +12 -0
  211. data/src/core/ext/upb-generated/envoy/type/range.upb.h +27 -0
  212. data/src/core/ext/upb-generated/envoy/type/semantic_version.upb.c +29 -0
  213. data/src/core/ext/upb-generated/envoy/type/semantic_version.upb.h +62 -0
  214. data/src/core/ext/upb-generated/envoy/type/tracing/v2/custom_tag.upb.c +89 -0
  215. data/src/core/ext/upb-generated/envoy/type/tracing/v2/custom_tag.upb.h +249 -0
  216. data/src/core/ext/upb-generated/google/protobuf/descriptor.upb.c +9 -8
  217. data/src/core/ext/upb-generated/google/protobuf/descriptor.upb.h +30 -24
  218. data/src/core/ext/upb-generated/src/proto/grpc/gcp/handshaker.upb.c +30 -27
  219. data/src/core/ext/upb-generated/src/proto/grpc/gcp/handshaker.upb.h +64 -52
  220. data/src/core/ext/upb-generated/src/proto/grpc/lb/v1/load_balancer.upb.c +13 -5
  221. data/src/core/ext/upb-generated/src/proto/grpc/lb/v1/load_balancer.upb.h +34 -0
  222. data/src/core/ext/upb-generated/udpa/annotations/migrate.upb.c +48 -0
  223. data/src/core/ext/upb-generated/udpa/annotations/migrate.upb.h +104 -0
  224. data/src/core/ext/upb-generated/udpa/annotations/sensitive.upb.c +17 -0
  225. data/src/core/ext/upb-generated/udpa/annotations/sensitive.upb.h +30 -0
  226. data/src/core/ext/upb-generated/udpa/annotations/status.upb.c +28 -0
  227. data/src/core/ext/upb-generated/udpa/annotations/status.upb.h +65 -0
  228. data/src/core/ext/upb-generated/validate/validate.upb.c +44 -39
  229. data/src/core/ext/upb-generated/validate/validate.upb.h +155 -119
  230. data/src/core/lib/channel/channel_args.cc +15 -14
  231. data/src/core/lib/channel/channel_args.h +3 -1
  232. data/src/core/lib/channel/channel_stack.h +20 -13
  233. data/src/core/lib/channel/channel_trace.cc +32 -41
  234. data/src/core/lib/channel/channel_trace.h +3 -3
  235. data/src/core/lib/channel/channelz.cc +163 -254
  236. data/src/core/lib/channel/channelz.h +20 -12
  237. data/src/core/lib/channel/channelz_registry.cc +52 -77
  238. data/src/core/lib/channel/channelz_registry.h +4 -4
  239. data/src/core/lib/channel/connected_channel.cc +7 -5
  240. data/src/core/lib/channel/context.h +1 -1
  241. data/src/core/lib/channel/handshaker.cc +11 -13
  242. data/src/core/lib/channel/handshaker.h +4 -2
  243. data/src/core/lib/channel/handshaker_registry.cc +5 -17
  244. data/src/core/lib/channel/status_util.cc +2 -3
  245. data/src/core/lib/compression/message_compress.cc +5 -1
  246. data/src/core/lib/debug/stats.cc +21 -27
  247. data/src/core/lib/debug/stats.h +3 -1
  248. data/src/core/lib/gpr/spinlock.h +2 -3
  249. data/src/core/lib/gpr/string.cc +2 -26
  250. data/src/core/lib/gpr/string.h +0 -16
  251. data/src/core/lib/gpr/sync_abseil.cc +116 -0
  252. data/src/core/lib/gpr/sync_posix.cc +8 -5
  253. data/src/core/lib/gpr/sync_windows.cc +4 -2
  254. data/src/core/lib/gpr/time.cc +4 -0
  255. data/src/core/lib/gpr/time_posix.cc +1 -1
  256. data/src/core/lib/gpr/time_precise.cc +1 -1
  257. data/src/core/lib/gprpp/atomic.h +6 -6
  258. data/src/core/lib/gprpp/fork.cc +1 -1
  259. data/src/core/lib/gprpp/host_port.cc +30 -36
  260. data/src/core/lib/gprpp/host_port.h +14 -17
  261. data/src/core/lib/gprpp/map.h +5 -11
  262. data/src/core/lib/gprpp/memory.h +2 -6
  263. data/src/core/lib/gprpp/ref_counted_ptr.h +5 -0
  264. data/src/core/lib/gprpp/sync.h +9 -0
  265. data/src/core/lib/http/format_request.cc +46 -65
  266. data/src/core/lib/http/httpcli.cc +2 -3
  267. data/src/core/lib/http/httpcli.h +2 -3
  268. data/src/core/lib/http/httpcli_security_connector.cc +5 -5
  269. data/src/core/lib/http/parser.h +2 -3
  270. data/src/core/lib/iomgr/buffer_list.cc +36 -35
  271. data/src/core/lib/iomgr/buffer_list.h +22 -21
  272. data/src/core/lib/iomgr/call_combiner.h +3 -2
  273. data/src/core/lib/iomgr/cfstream_handle.cc +3 -2
  274. data/src/core/lib/iomgr/closure.h +2 -3
  275. data/src/core/lib/iomgr/dualstack_socket_posix.cc +47 -0
  276. data/src/core/lib/iomgr/endpoint_cfstream.cc +2 -3
  277. data/src/core/lib/iomgr/endpoint_pair.h +2 -3
  278. data/src/core/lib/iomgr/error.cc +6 -9
  279. data/src/core/lib/iomgr/error.h +4 -5
  280. data/src/core/lib/iomgr/ev_apple.cc +356 -0
  281. data/src/core/lib/iomgr/ev_apple.h +43 -0
  282. data/src/core/lib/iomgr/ev_epoll1_linux.cc +20 -23
  283. data/src/core/lib/iomgr/ev_epollex_linux.cc +14 -7
  284. data/src/core/lib/iomgr/ev_poll_posix.cc +3 -3
  285. data/src/core/lib/iomgr/ev_posix.cc +2 -3
  286. data/src/core/lib/iomgr/exec_ctx.h +14 -2
  287. data/src/core/lib/iomgr/executor.cc +1 -1
  288. data/src/core/lib/iomgr/fork_posix.cc +4 -0
  289. data/src/core/lib/iomgr/iomgr_posix_cfstream.cc +84 -20
  290. data/src/core/lib/iomgr/load_file.cc +1 -0
  291. data/src/core/lib/iomgr/poller/eventmanager_libuv.cc +87 -0
  292. data/src/core/lib/iomgr/poller/eventmanager_libuv.h +88 -0
  293. data/src/core/lib/iomgr/pollset_set_custom.cc +10 -10
  294. data/src/core/lib/iomgr/pollset_uv.h +32 -0
  295. data/src/core/lib/iomgr/port.h +1 -0
  296. data/src/core/lib/iomgr/python_util.h +46 -0
  297. data/src/core/lib/iomgr/resolve_address.h +4 -6
  298. data/src/core/lib/iomgr/resolve_address_custom.cc +29 -39
  299. data/src/core/lib/iomgr/resolve_address_custom.h +4 -2
  300. data/src/core/lib/iomgr/resolve_address_posix.cc +10 -11
  301. data/src/core/lib/iomgr/resolve_address_windows.cc +8 -17
  302. data/src/core/lib/iomgr/resource_quota.cc +4 -6
  303. data/src/core/lib/iomgr/sockaddr_utils.cc +23 -29
  304. data/src/core/lib/iomgr/sockaddr_utils.h +9 -14
  305. data/src/core/lib/iomgr/socket_factory_posix.h +2 -3
  306. data/src/core/lib/iomgr/socket_mutator.h +2 -3
  307. data/src/core/lib/iomgr/socket_utils_common_posix.cc +21 -26
  308. data/src/core/lib/iomgr/socket_utils_posix.h +15 -0
  309. data/src/core/lib/iomgr/tcp_client_cfstream.cc +5 -7
  310. data/src/core/lib/iomgr/tcp_client_posix.cc +25 -22
  311. data/src/core/lib/iomgr/tcp_client_posix.h +6 -6
  312. data/src/core/lib/iomgr/tcp_client_windows.cc +2 -3
  313. data/src/core/lib/iomgr/tcp_custom.cc +2 -3
  314. data/src/core/lib/iomgr/tcp_custom.h +3 -0
  315. data/src/core/lib/iomgr/tcp_posix.cc +608 -56
  316. data/src/core/lib/iomgr/tcp_server_custom.cc +20 -11
  317. data/src/core/lib/iomgr/tcp_server_posix.cc +5 -4
  318. data/src/core/lib/iomgr/tcp_server_utils_posix_common.cc +13 -4
  319. data/src/core/lib/iomgr/tcp_server_utils_posix_ifaddrs.cc +8 -11
  320. data/src/core/lib/iomgr/tcp_uv.cc +3 -2
  321. data/src/core/lib/iomgr/time_averaged_stats.h +2 -3
  322. data/src/core/lib/iomgr/timer_generic.cc +2 -3
  323. data/src/core/lib/iomgr/timer_generic.h +39 -0
  324. data/src/core/lib/iomgr/timer_heap.h +2 -3
  325. data/src/core/lib/iomgr/udp_server.cc +9 -14
  326. data/src/core/lib/iomgr/work_serializer.cc +155 -0
  327. data/src/core/lib/iomgr/work_serializer.h +65 -0
  328. data/src/core/lib/json/json.h +209 -68
  329. data/src/core/lib/json/json_reader.cc +511 -319
  330. data/src/core/lib/json/json_writer.cc +202 -110
  331. data/src/core/lib/security/credentials/alts/check_gcp_environment.cc +1 -1
  332. data/src/core/lib/security/credentials/composite/composite_credentials.cc +19 -0
  333. data/src/core/lib/security/credentials/composite/composite_credentials.h +11 -4
  334. data/src/core/lib/security/credentials/credentials.cc +0 -84
  335. data/src/core/lib/security/credentials/credentials.h +18 -60
  336. data/src/core/lib/security/credentials/fake/fake_credentials.h +6 -1
  337. data/src/core/lib/security/credentials/google_default/google_default_credentials.cc +9 -12
  338. data/src/core/lib/security/credentials/iam/iam_credentials.cc +8 -6
  339. data/src/core/lib/security/credentials/iam/iam_credentials.h +4 -0
  340. data/src/core/lib/security/credentials/jwt/json_token.cc +26 -56
  341. data/src/core/lib/security/credentials/jwt/json_token.h +4 -6
  342. data/src/core/lib/security/credentials/jwt/jwt_credentials.cc +8 -18
  343. data/src/core/lib/security/credentials/jwt/jwt_credentials.h +12 -0
  344. data/src/core/lib/security/credentials/jwt/jwt_verifier.cc +151 -168
  345. data/src/core/lib/security/credentials/jwt/jwt_verifier.h +4 -6
  346. data/src/core/lib/security/credentials/oauth2/oauth2_credentials.cc +92 -61
  347. data/src/core/lib/security/credentials/oauth2/oauth2_credentials.h +10 -4
  348. data/src/core/lib/security/credentials/plugin/plugin_credentials.cc +19 -4
  349. data/src/core/lib/security/credentials/plugin/plugin_credentials.h +4 -1
  350. data/src/core/lib/security/credentials/tls/grpc_tls_credentials_options.cc +43 -13
  351. data/src/core/lib/security/credentials/tls/grpc_tls_credentials_options.h +47 -11
  352. data/src/core/lib/security/credentials/tls/tls_credentials.cc +128 -0
  353. data/src/core/lib/security/credentials/tls/tls_credentials.h +62 -0
  354. data/src/core/lib/security/security_connector/alts/alts_security_connector.cc +34 -6
  355. data/src/core/lib/security/security_connector/fake/fake_security_connector.cc +29 -9
  356. data/src/core/lib/security/security_connector/load_system_roots_fallback.cc +2 -2
  357. data/src/core/lib/security/security_connector/load_system_roots_linux.cc +5 -4
  358. data/src/core/lib/security/security_connector/local/local_security_connector.cc +32 -7
  359. data/src/core/lib/security/security_connector/security_connector.h +1 -1
  360. data/src/core/lib/security/security_connector/ssl/ssl_security_connector.cc +20 -37
  361. data/src/core/lib/security/security_connector/ssl/ssl_security_connector.h +4 -6
  362. data/src/core/lib/security/security_connector/ssl_utils.cc +107 -16
  363. data/src/core/lib/security/security_connector/ssl_utils.h +24 -11
  364. data/src/core/lib/security/security_connector/tls/tls_security_connector.cc +603 -0
  365. data/src/core/lib/security/security_connector/tls/tls_security_connector.h +183 -0
  366. data/src/core/lib/security/transport/client_auth_filter.cc +34 -2
  367. data/src/core/lib/security/transport/security_handshaker.cc +2 -2
  368. data/src/core/lib/security/util/json_util.cc +22 -15
  369. data/src/core/lib/security/util/json_util.h +2 -2
  370. data/src/core/lib/slice/slice_intern.cc +2 -3
  371. data/src/core/lib/slice/slice_internal.h +14 -0
  372. data/src/core/lib/slice/slice_utils.h +9 -0
  373. data/src/core/lib/surface/byte_buffer_reader.cc +2 -47
  374. data/src/core/lib/surface/call.cc +2 -3
  375. data/src/core/lib/surface/call_log_batch.cc +50 -58
  376. data/src/core/lib/surface/channel.cc +53 -31
  377. data/src/core/lib/surface/channel.h +35 -4
  378. data/src/core/lib/surface/channel_ping.cc +2 -3
  379. data/src/core/lib/surface/completion_queue.cc +55 -34
  380. data/src/core/lib/surface/event_string.cc +18 -25
  381. data/src/core/lib/surface/event_string.h +3 -1
  382. data/src/core/lib/surface/init_secure.cc +1 -4
  383. data/src/core/lib/surface/server.cc +570 -369
  384. data/src/core/lib/surface/server.h +32 -0
  385. data/src/core/lib/surface/version.cc +2 -2
  386. data/src/core/lib/transport/byte_stream.h +7 -2
  387. data/src/core/lib/transport/connectivity_state.cc +7 -6
  388. data/src/core/lib/transport/connectivity_state.h +5 -3
  389. data/src/core/lib/transport/metadata.cc +3 -3
  390. data/src/core/lib/transport/metadata_batch.h +2 -3
  391. data/src/core/lib/transport/static_metadata.h +1 -1
  392. data/src/core/lib/transport/status_conversion.cc +6 -14
  393. data/src/core/lib/transport/transport.cc +2 -3
  394. data/src/core/lib/transport/transport.h +3 -2
  395. data/src/core/lib/transport/transport_op_string.cc +61 -102
  396. data/src/core/lib/uri/uri_parser.h +2 -3
  397. data/src/core/plugin_registry/grpc_plugin_registry.cc +20 -4
  398. data/src/core/tsi/alts/crypt/aes_gcm.cc +0 -2
  399. data/src/core/tsi/alts/handshaker/alts_handshaker_client.cc +9 -2
  400. data/src/core/tsi/alts/handshaker/alts_handshaker_client.h +8 -4
  401. data/src/core/tsi/alts/handshaker/alts_tsi_handshaker.cc +44 -4
  402. data/src/core/tsi/alts/handshaker/alts_tsi_handshaker.h +10 -2
  403. data/src/core/tsi/alts/zero_copy_frame_protector/alts_grpc_record_protocol_common.h +2 -3
  404. data/src/core/tsi/alts/zero_copy_frame_protector/alts_zero_copy_grpc_protector.cc +3 -3
  405. data/src/core/tsi/fake_transport_security.cc +17 -18
  406. data/src/core/tsi/fake_transport_security.h +2 -0
  407. data/src/core/tsi/ssl/session_cache/ssl_session.h +0 -2
  408. data/src/core/tsi/ssl/session_cache/ssl_session_boringssl.cc +1 -1
  409. data/src/core/tsi/ssl/session_cache/ssl_session_cache.h +0 -2
  410. data/src/core/tsi/ssl/session_cache/ssl_session_openssl.cc +1 -1
  411. data/src/core/tsi/ssl_transport_security.cc +197 -47
  412. data/src/core/tsi/ssl_transport_security.h +23 -9
  413. data/src/core/tsi/ssl_types.h +0 -2
  414. data/src/core/tsi/transport_security.cc +13 -0
  415. data/src/core/tsi/transport_security.h +6 -9
  416. data/src/core/tsi/transport_security_grpc.cc +2 -2
  417. data/src/core/tsi/transport_security_grpc.h +4 -5
  418. data/src/core/tsi/transport_security_interface.h +15 -3
  419. data/src/ruby/bin/math_pb.rb +5 -5
  420. data/src/ruby/ext/grpc/rb_call.c +9 -1
  421. data/src/ruby/ext/grpc/rb_call_credentials.c +4 -1
  422. data/src/ruby/ext/grpc/rb_grpc_imports.generated.c +2 -0
  423. data/src/ruby/ext/grpc/rb_grpc_imports.generated.h +4 -1
  424. data/src/ruby/lib/grpc/errors.rb +103 -42
  425. data/src/ruby/lib/grpc/generic/active_call.rb +2 -3
  426. data/src/ruby/lib/grpc/generic/interceptors.rb +4 -4
  427. data/src/ruby/lib/grpc/generic/rpc_server.rb +9 -10
  428. data/src/ruby/lib/grpc/generic/service.rb +5 -4
  429. data/src/ruby/lib/grpc/structs.rb +1 -1
  430. data/src/ruby/lib/grpc/version.rb +1 -1
  431. data/src/ruby/pb/generate_proto_ruby.sh +5 -3
  432. data/src/ruby/pb/grpc/health/v1/health_pb.rb +3 -3
  433. data/src/ruby/pb/src/proto/grpc/testing/empty_pb.rb +1 -1
  434. data/src/ruby/pb/src/proto/grpc/testing/messages_pb.rb +34 -13
  435. data/src/ruby/pb/src/proto/grpc/testing/test_services_pb.rb +16 -0
  436. data/src/ruby/spec/debug_message_spec.rb +134 -0
  437. data/src/ruby/spec/generic/service_spec.rb +2 -0
  438. data/src/ruby/spec/pb/codegen/grpc/testing/package_options_ruby_style.proto +5 -0
  439. data/src/ruby/spec/pb/codegen/package_option_spec.rb +2 -0
  440. data/src/ruby/spec/testdata/ca.pem +18 -13
  441. data/src/ruby/spec/testdata/client.key +26 -14
  442. data/src/ruby/spec/testdata/client.pem +18 -12
  443. data/src/ruby/spec/testdata/server1.key +26 -14
  444. data/src/ruby/spec/testdata/server1.pem +20 -14
  445. data/third_party/abseil-cpp/absl/algorithm/algorithm.h +159 -0
  446. data/third_party/abseil-cpp/absl/base/attributes.h +621 -0
  447. data/third_party/abseil-cpp/absl/base/call_once.h +226 -0
  448. data/third_party/abseil-cpp/absl/base/casts.h +184 -0
  449. data/third_party/abseil-cpp/absl/base/config.h +671 -0
  450. data/third_party/abseil-cpp/absl/base/const_init.h +76 -0
  451. data/third_party/abseil-cpp/absl/base/dynamic_annotations.cc +129 -0
  452. data/third_party/abseil-cpp/absl/base/dynamic_annotations.h +389 -0
  453. data/third_party/abseil-cpp/absl/base/internal/atomic_hook.h +200 -0
  454. data/third_party/abseil-cpp/absl/base/internal/bits.h +218 -0
  455. data/third_party/abseil-cpp/absl/base/internal/cycleclock.cc +107 -0
  456. data/third_party/abseil-cpp/absl/base/internal/cycleclock.h +94 -0
  457. data/third_party/abseil-cpp/absl/base/internal/endian.h +266 -0
  458. data/third_party/abseil-cpp/absl/base/internal/errno_saver.h +43 -0
  459. data/third_party/abseil-cpp/absl/base/internal/hide_ptr.h +51 -0
  460. data/third_party/abseil-cpp/absl/base/internal/identity.h +37 -0
  461. data/third_party/abseil-cpp/absl/base/internal/inline_variable.h +107 -0
  462. data/third_party/abseil-cpp/absl/base/internal/invoke.h +187 -0
  463. data/third_party/abseil-cpp/absl/base/internal/low_level_scheduling.h +107 -0
  464. data/third_party/abseil-cpp/absl/base/internal/per_thread_tls.h +52 -0
  465. data/third_party/abseil-cpp/absl/base/internal/raw_logging.cc +240 -0
  466. data/third_party/abseil-cpp/absl/base/internal/raw_logging.h +183 -0
  467. data/third_party/abseil-cpp/absl/base/internal/scheduling_mode.h +58 -0
  468. data/third_party/abseil-cpp/absl/base/internal/spinlock.cc +233 -0
  469. data/third_party/abseil-cpp/absl/base/internal/spinlock.h +243 -0
  470. data/third_party/abseil-cpp/absl/base/internal/spinlock_akaros.inc +35 -0
  471. data/third_party/abseil-cpp/absl/base/internal/spinlock_linux.inc +66 -0
  472. data/third_party/abseil-cpp/absl/base/internal/spinlock_posix.inc +46 -0
  473. data/third_party/abseil-cpp/absl/base/internal/spinlock_wait.cc +81 -0
  474. data/third_party/abseil-cpp/absl/base/internal/spinlock_wait.h +93 -0
  475. data/third_party/abseil-cpp/absl/base/internal/spinlock_win32.inc +37 -0
  476. data/third_party/abseil-cpp/absl/base/internal/sysinfo.cc +416 -0
  477. data/third_party/abseil-cpp/absl/base/internal/sysinfo.h +66 -0
  478. data/third_party/abseil-cpp/absl/base/internal/thread_annotations.h +271 -0
  479. data/third_party/abseil-cpp/absl/base/internal/thread_identity.cc +152 -0
  480. data/third_party/abseil-cpp/absl/base/internal/thread_identity.h +259 -0
  481. data/third_party/abseil-cpp/absl/base/internal/throw_delegate.cc +108 -0
  482. data/third_party/abseil-cpp/absl/base/internal/throw_delegate.h +75 -0
  483. data/third_party/abseil-cpp/absl/base/internal/tsan_mutex_interface.h +66 -0
  484. data/third_party/abseil-cpp/absl/base/internal/unaligned_access.h +158 -0
  485. data/third_party/abseil-cpp/absl/base/internal/unscaledcycleclock.cc +140 -0
  486. data/third_party/abseil-cpp/absl/base/internal/unscaledcycleclock.h +124 -0
  487. data/third_party/abseil-cpp/absl/base/log_severity.cc +27 -0
  488. data/third_party/abseil-cpp/absl/base/log_severity.h +121 -0
  489. data/third_party/abseil-cpp/absl/base/macros.h +220 -0
  490. data/third_party/abseil-cpp/absl/base/optimization.h +181 -0
  491. data/third_party/abseil-cpp/absl/base/options.h +211 -0
  492. data/third_party/abseil-cpp/absl/base/policy_checks.h +111 -0
  493. data/third_party/abseil-cpp/absl/base/port.h +26 -0
  494. data/third_party/abseil-cpp/absl/base/thread_annotations.h +280 -0
  495. data/third_party/abseil-cpp/absl/container/inlined_vector.h +848 -0
  496. data/third_party/abseil-cpp/absl/container/internal/compressed_tuple.h +265 -0
  497. data/third_party/abseil-cpp/absl/container/internal/inlined_vector.h +892 -0
  498. data/third_party/abseil-cpp/absl/memory/memory.h +695 -0
  499. data/third_party/abseil-cpp/absl/meta/type_traits.h +759 -0
  500. data/third_party/abseil-cpp/absl/numeric/int128.cc +404 -0
  501. data/third_party/abseil-cpp/absl/numeric/int128.h +1091 -0
  502. data/third_party/abseil-cpp/absl/numeric/int128_have_intrinsic.inc +302 -0
  503. data/third_party/abseil-cpp/absl/numeric/int128_no_intrinsic.inc +308 -0
  504. data/third_party/abseil-cpp/absl/strings/ascii.cc +200 -0
  505. data/third_party/abseil-cpp/absl/strings/ascii.h +242 -0
  506. data/third_party/abseil-cpp/absl/strings/charconv.cc +984 -0
  507. data/third_party/abseil-cpp/absl/strings/charconv.h +119 -0
  508. data/third_party/abseil-cpp/absl/strings/escaping.cc +949 -0
  509. data/third_party/abseil-cpp/absl/strings/escaping.h +164 -0
  510. data/third_party/abseil-cpp/absl/strings/internal/char_map.h +156 -0
  511. data/third_party/abseil-cpp/absl/strings/internal/charconv_bigint.cc +359 -0
  512. data/third_party/abseil-cpp/absl/strings/internal/charconv_bigint.h +423 -0
  513. data/third_party/abseil-cpp/absl/strings/internal/charconv_parse.cc +504 -0
  514. data/third_party/abseil-cpp/absl/strings/internal/charconv_parse.h +99 -0
  515. data/third_party/abseil-cpp/absl/strings/internal/escaping.cc +180 -0
  516. data/third_party/abseil-cpp/absl/strings/internal/escaping.h +58 -0
  517. data/third_party/abseil-cpp/absl/strings/internal/memutil.cc +112 -0
  518. data/third_party/abseil-cpp/absl/strings/internal/memutil.h +148 -0
  519. data/third_party/abseil-cpp/absl/strings/internal/ostringstream.cc +36 -0
  520. data/third_party/abseil-cpp/absl/strings/internal/ostringstream.h +89 -0
  521. data/third_party/abseil-cpp/absl/strings/internal/resize_uninitialized.h +73 -0
  522. data/third_party/abseil-cpp/absl/strings/internal/stl_type_traits.h +248 -0
  523. data/third_party/abseil-cpp/absl/strings/internal/str_format/arg.cc +388 -0
  524. data/third_party/abseil-cpp/absl/strings/internal/str_format/arg.h +432 -0
  525. data/third_party/abseil-cpp/absl/strings/internal/str_format/bind.cc +245 -0
  526. data/third_party/abseil-cpp/absl/strings/internal/str_format/bind.h +209 -0
  527. data/third_party/abseil-cpp/absl/strings/internal/str_format/checker.h +326 -0
  528. data/third_party/abseil-cpp/absl/strings/internal/str_format/extension.cc +51 -0
  529. data/third_party/abseil-cpp/absl/strings/internal/str_format/extension.h +415 -0
  530. data/third_party/abseil-cpp/absl/strings/internal/str_format/float_conversion.cc +493 -0
  531. data/third_party/abseil-cpp/absl/strings/internal/str_format/float_conversion.h +23 -0
  532. data/third_party/abseil-cpp/absl/strings/internal/str_format/output.cc +72 -0
  533. data/third_party/abseil-cpp/absl/strings/internal/str_format/output.h +104 -0
  534. data/third_party/abseil-cpp/absl/strings/internal/str_format/parser.cc +334 -0
  535. data/third_party/abseil-cpp/absl/strings/internal/str_format/parser.h +333 -0
  536. data/third_party/abseil-cpp/absl/strings/internal/str_join_internal.h +314 -0
  537. data/third_party/abseil-cpp/absl/strings/internal/str_split_internal.h +455 -0
  538. data/third_party/abseil-cpp/absl/strings/internal/utf8.cc +53 -0
  539. data/third_party/abseil-cpp/absl/strings/internal/utf8.h +50 -0
  540. data/third_party/abseil-cpp/absl/strings/match.cc +40 -0
  541. data/third_party/abseil-cpp/absl/strings/match.h +90 -0
  542. data/third_party/abseil-cpp/absl/strings/numbers.cc +965 -0
  543. data/third_party/abseil-cpp/absl/strings/numbers.h +266 -0
  544. data/third_party/abseil-cpp/absl/strings/str_cat.cc +246 -0
  545. data/third_party/abseil-cpp/absl/strings/str_cat.h +408 -0
  546. data/third_party/abseil-cpp/absl/strings/str_format.h +537 -0
  547. data/third_party/abseil-cpp/absl/strings/str_join.h +293 -0
  548. data/third_party/abseil-cpp/absl/strings/str_replace.cc +82 -0
  549. data/third_party/abseil-cpp/absl/strings/str_replace.h +219 -0
  550. data/third_party/abseil-cpp/absl/strings/str_split.cc +139 -0
  551. data/third_party/abseil-cpp/absl/strings/str_split.h +513 -0
  552. data/third_party/abseil-cpp/absl/strings/string_view.cc +235 -0
  553. data/third_party/abseil-cpp/absl/strings/string_view.h +622 -0
  554. data/third_party/abseil-cpp/absl/strings/strip.h +91 -0
  555. data/third_party/abseil-cpp/absl/strings/substitute.cc +171 -0
  556. data/third_party/abseil-cpp/absl/strings/substitute.h +693 -0
  557. data/third_party/abseil-cpp/absl/time/civil_time.cc +175 -0
  558. data/third_party/abseil-cpp/absl/time/civil_time.h +538 -0
  559. data/third_party/abseil-cpp/absl/time/clock.cc +569 -0
  560. data/third_party/abseil-cpp/absl/time/clock.h +74 -0
  561. data/third_party/abseil-cpp/absl/time/duration.cc +922 -0
  562. data/third_party/abseil-cpp/absl/time/format.cc +153 -0
  563. data/third_party/abseil-cpp/absl/time/internal/cctz/include/cctz/civil_time.h +332 -0
  564. data/third_party/abseil-cpp/absl/time/internal/cctz/include/cctz/civil_time_detail.h +622 -0
  565. data/third_party/abseil-cpp/absl/time/internal/cctz/include/cctz/time_zone.h +384 -0
  566. data/third_party/abseil-cpp/absl/time/internal/cctz/include/cctz/zone_info_source.h +102 -0
  567. data/third_party/abseil-cpp/absl/time/internal/cctz/src/civil_time_detail.cc +94 -0
  568. data/third_party/abseil-cpp/absl/time/internal/cctz/src/time_zone_fixed.cc +140 -0
  569. data/third_party/abseil-cpp/absl/time/internal/cctz/src/time_zone_fixed.h +52 -0
  570. data/third_party/abseil-cpp/absl/time/internal/cctz/src/time_zone_format.cc +922 -0
  571. data/third_party/abseil-cpp/absl/time/internal/cctz/src/time_zone_if.cc +45 -0
  572. data/third_party/abseil-cpp/absl/time/internal/cctz/src/time_zone_if.h +76 -0
  573. data/third_party/abseil-cpp/absl/time/internal/cctz/src/time_zone_impl.cc +121 -0
  574. data/third_party/abseil-cpp/absl/time/internal/cctz/src/time_zone_impl.h +93 -0
  575. data/third_party/abseil-cpp/absl/time/internal/cctz/src/time_zone_info.cc +958 -0
  576. data/third_party/abseil-cpp/absl/time/internal/cctz/src/time_zone_info.h +138 -0
  577. data/third_party/abseil-cpp/absl/time/internal/cctz/src/time_zone_libc.cc +308 -0
  578. data/third_party/abseil-cpp/absl/time/internal/cctz/src/time_zone_libc.h +55 -0
  579. data/third_party/abseil-cpp/absl/time/internal/cctz/src/time_zone_lookup.cc +187 -0
  580. data/third_party/abseil-cpp/absl/time/internal/cctz/src/time_zone_posix.cc +159 -0
  581. data/third_party/abseil-cpp/absl/time/internal/cctz/src/time_zone_posix.h +132 -0
  582. data/third_party/abseil-cpp/absl/time/internal/cctz/src/tzfile.h +122 -0
  583. data/third_party/abseil-cpp/absl/time/internal/cctz/src/zone_info_source.cc +115 -0
  584. data/third_party/abseil-cpp/absl/time/internal/get_current_time_chrono.inc +31 -0
  585. data/third_party/abseil-cpp/absl/time/internal/get_current_time_posix.inc +24 -0
  586. data/third_party/abseil-cpp/absl/time/time.cc +499 -0
  587. data/third_party/abseil-cpp/absl/time/time.h +1584 -0
  588. data/third_party/abseil-cpp/absl/types/bad_optional_access.cc +48 -0
  589. data/third_party/abseil-cpp/absl/types/bad_optional_access.h +78 -0
  590. data/third_party/abseil-cpp/absl/types/internal/optional.h +396 -0
  591. data/third_party/abseil-cpp/absl/types/internal/span.h +128 -0
  592. data/third_party/abseil-cpp/absl/types/optional.h +776 -0
  593. data/third_party/abseil-cpp/absl/types/span.h +713 -0
  594. data/third_party/abseil-cpp/absl/utility/utility.h +350 -0
  595. data/third_party/boringssl-with-bazel/err_data.c +1439 -0
  596. data/third_party/{boringssl → boringssl-with-bazel/src}/crypto/asn1/a_bitstr.c +0 -0
  597. data/third_party/{boringssl → boringssl-with-bazel/src}/crypto/asn1/a_bool.c +0 -0
  598. data/third_party/{boringssl → boringssl-with-bazel/src}/crypto/asn1/a_d2i_fp.c +0 -0
  599. data/third_party/{boringssl → boringssl-with-bazel/src}/crypto/asn1/a_dup.c +0 -0
  600. data/third_party/{boringssl → boringssl-with-bazel/src}/crypto/asn1/a_enum.c +0 -0
  601. data/third_party/{boringssl → boringssl-with-bazel/src}/crypto/asn1/a_gentm.c +0 -0
  602. data/third_party/{boringssl → boringssl-with-bazel/src}/crypto/asn1/a_i2d_fp.c +0 -0
  603. data/third_party/{boringssl → boringssl-with-bazel/src}/crypto/asn1/a_int.c +0 -0
  604. data/third_party/{boringssl → boringssl-with-bazel/src}/crypto/asn1/a_mbstr.c +0 -0
  605. data/third_party/{boringssl → boringssl-with-bazel/src}/crypto/asn1/a_object.c +0 -0
  606. data/third_party/{boringssl → boringssl-with-bazel/src}/crypto/asn1/a_octet.c +0 -0
  607. data/third_party/{boringssl → boringssl-with-bazel/src}/crypto/asn1/a_print.c +0 -0
  608. data/third_party/{boringssl → boringssl-with-bazel/src}/crypto/asn1/a_strnid.c +0 -0
  609. data/third_party/boringssl-with-bazel/src/crypto/asn1/a_time.c +212 -0
  610. data/third_party/{boringssl → boringssl-with-bazel/src}/crypto/asn1/a_type.c +0 -0
  611. data/third_party/{boringssl → boringssl-with-bazel/src}/crypto/asn1/a_utctm.c +0 -0
  612. data/third_party/{boringssl → boringssl-with-bazel/src}/crypto/asn1/a_utf8.c +0 -0
  613. data/third_party/{boringssl → boringssl-with-bazel/src}/crypto/asn1/asn1_lib.c +0 -0
  614. data/third_party/{boringssl → boringssl-with-bazel/src}/crypto/asn1/asn1_locl.h +0 -0
  615. data/third_party/{boringssl → boringssl-with-bazel/src}/crypto/asn1/asn1_par.c +0 -0
  616. data/third_party/{boringssl → boringssl-with-bazel/src}/crypto/asn1/asn_pack.c +0 -0
  617. data/third_party/{boringssl → boringssl-with-bazel/src}/crypto/asn1/f_enum.c +0 -0
  618. data/third_party/{boringssl → boringssl-with-bazel/src}/crypto/asn1/f_int.c +0 -0
  619. data/third_party/{boringssl → boringssl-with-bazel/src}/crypto/asn1/f_string.c +0 -0
  620. data/third_party/{boringssl → boringssl-with-bazel/src}/crypto/asn1/tasn_dec.c +0 -0
  621. data/third_party/{boringssl → boringssl-with-bazel/src}/crypto/asn1/tasn_enc.c +0 -0
  622. data/third_party/{boringssl → boringssl-with-bazel/src}/crypto/asn1/tasn_fre.c +0 -0
  623. data/third_party/{boringssl → boringssl-with-bazel/src}/crypto/asn1/tasn_new.c +0 -0
  624. data/third_party/{boringssl → boringssl-with-bazel/src}/crypto/asn1/tasn_typ.c +0 -0
  625. data/third_party/{boringssl → boringssl-with-bazel/src}/crypto/asn1/tasn_utl.c +0 -0
  626. data/third_party/{boringssl → boringssl-with-bazel/src}/crypto/asn1/time_support.c +0 -0
  627. data/third_party/{boringssl → boringssl-with-bazel/src}/crypto/base64/base64.c +0 -0
  628. data/third_party/{boringssl → boringssl-with-bazel/src}/crypto/bio/bio.c +0 -0
  629. data/third_party/{boringssl → boringssl-with-bazel/src}/crypto/bio/bio_mem.c +0 -0
  630. data/third_party/boringssl-with-bazel/src/crypto/bio/connect.c +545 -0
  631. data/third_party/boringssl-with-bazel/src/crypto/bio/fd.c +279 -0
  632. data/third_party/boringssl-with-bazel/src/crypto/bio/file.c +317 -0
  633. data/third_party/{boringssl → boringssl-with-bazel/src}/crypto/bio/hexdump.c +0 -0
  634. data/third_party/{boringssl → boringssl-with-bazel/src}/crypto/bio/internal.h +0 -0
  635. data/third_party/boringssl-with-bazel/src/crypto/bio/pair.c +488 -0
  636. data/third_party/{boringssl → boringssl-with-bazel/src}/crypto/bio/printf.c +0 -0
  637. data/third_party/{boringssl → boringssl-with-bazel/src}/crypto/bio/socket.c +0 -0
  638. data/third_party/{boringssl → boringssl-with-bazel/src}/crypto/bio/socket_helper.c +0 -0
  639. data/third_party/{boringssl → boringssl-with-bazel/src}/crypto/bn_extra/bn_asn1.c +0 -0
  640. data/third_party/{boringssl → boringssl-with-bazel/src}/crypto/bn_extra/convert.c +0 -0
  641. data/third_party/boringssl-with-bazel/src/crypto/buf/buf.c +172 -0
  642. data/third_party/{boringssl → boringssl-with-bazel/src}/crypto/bytestring/asn1_compat.c +0 -0
  643. data/third_party/{boringssl → boringssl-with-bazel/src}/crypto/bytestring/ber.c +0 -0
  644. data/third_party/boringssl-with-bazel/src/crypto/bytestring/cbb.c +719 -0
  645. data/third_party/boringssl-with-bazel/src/crypto/bytestring/cbs.c +688 -0
  646. data/third_party/{boringssl → boringssl-with-bazel/src}/crypto/bytestring/internal.h +0 -0
  647. data/third_party/{boringssl → boringssl-with-bazel/src}/crypto/bytestring/unicode.c +0 -0
  648. data/third_party/{boringssl → boringssl-with-bazel/src}/crypto/chacha/chacha.c +0 -0
  649. data/third_party/{boringssl → boringssl-with-bazel/src}/crypto/chacha/internal.h +0 -0
  650. data/third_party/{boringssl → boringssl-with-bazel/src}/crypto/cipher_extra/cipher_extra.c +0 -0
  651. data/third_party/boringssl-with-bazel/src/crypto/cipher_extra/derive_key.c +152 -0
  652. data/third_party/{boringssl → boringssl-with-bazel/src}/crypto/cipher_extra/e_aesccm.c +0 -0
  653. data/third_party/{boringssl → boringssl-with-bazel/src}/crypto/cipher_extra/e_aesctrhmac.c +0 -0
  654. data/third_party/boringssl-with-bazel/src/crypto/cipher_extra/e_aesgcmsiv.c +891 -0
  655. data/third_party/{boringssl → boringssl-with-bazel/src}/crypto/cipher_extra/e_chacha20poly1305.c +0 -0
  656. data/third_party/{boringssl → boringssl-with-bazel/src}/crypto/cipher_extra/e_null.c +0 -0
  657. data/third_party/{boringssl → boringssl-with-bazel/src}/crypto/cipher_extra/e_rc2.c +0 -0
  658. data/third_party/{boringssl → boringssl-with-bazel/src}/crypto/cipher_extra/e_rc4.c +0 -0
  659. data/third_party/{boringssl → boringssl-with-bazel/src}/crypto/cipher_extra/e_tls.c +0 -0
  660. data/third_party/{boringssl → boringssl-with-bazel/src}/crypto/cipher_extra/internal.h +0 -0
  661. data/third_party/{boringssl → boringssl-with-bazel/src}/crypto/cipher_extra/tls_cbc.c +0 -0
  662. data/third_party/{boringssl → boringssl-with-bazel/src}/crypto/cmac/cmac.c +0 -0
  663. data/third_party/{boringssl → boringssl-with-bazel/src}/crypto/conf/conf.c +0 -0
  664. data/third_party/{boringssl → boringssl-with-bazel/src}/crypto/conf/conf_def.h +0 -0
  665. data/third_party/{boringssl → boringssl-with-bazel/src}/crypto/conf/internal.h +0 -0
  666. data/third_party/{boringssl → boringssl-with-bazel/src}/crypto/cpu-aarch64-fuchsia.c +0 -0
  667. data/third_party/{boringssl → boringssl-with-bazel/src}/crypto/cpu-aarch64-linux.c +0 -0
  668. data/third_party/boringssl-with-bazel/src/crypto/cpu-arm-linux.c +220 -0
  669. data/third_party/{boringssl → boringssl-with-bazel/src}/crypto/cpu-arm-linux.h +0 -0
  670. data/third_party/{boringssl → boringssl-with-bazel/src}/crypto/cpu-arm.c +0 -0
  671. data/third_party/boringssl-with-bazel/src/crypto/cpu-intel.c +291 -0
  672. data/third_party/{boringssl → boringssl-with-bazel/src}/crypto/cpu-ppc64le.c +0 -0
  673. data/third_party/boringssl-with-bazel/src/crypto/crypto.c +226 -0
  674. data/third_party/boringssl-with-bazel/src/crypto/curve25519/curve25519.c +2159 -0
  675. data/third_party/boringssl-with-bazel/src/crypto/curve25519/curve25519_tables.h +7872 -0
  676. data/third_party/boringssl-with-bazel/src/crypto/curve25519/internal.h +146 -0
  677. data/third_party/boringssl-with-bazel/src/crypto/curve25519/spake25519.c +539 -0
  678. data/third_party/boringssl-with-bazel/src/crypto/dh/check.c +217 -0
  679. data/third_party/boringssl-with-bazel/src/crypto/dh/dh.c +533 -0
  680. data/third_party/{boringssl → boringssl-with-bazel/src}/crypto/dh/dh_asn1.c +0 -0
  681. data/third_party/{boringssl → boringssl-with-bazel/src}/crypto/dh/params.c +0 -0
  682. data/third_party/{boringssl → boringssl-with-bazel/src}/crypto/digest_extra/digest_extra.c +0 -0
  683. data/third_party/boringssl-with-bazel/src/crypto/dsa/dsa.c +980 -0
  684. data/third_party/{boringssl → boringssl-with-bazel/src}/crypto/dsa/dsa_asn1.c +0 -0
  685. data/third_party/{boringssl → boringssl-with-bazel/src}/crypto/ec_extra/ec_asn1.c +0 -0
  686. data/third_party/boringssl-with-bazel/src/crypto/ec_extra/ec_derive.c +95 -0
  687. data/third_party/boringssl-with-bazel/src/crypto/ec_extra/hash_to_curve.c +425 -0
  688. data/third_party/boringssl-with-bazel/src/crypto/ec_extra/internal.h +78 -0
  689. data/third_party/boringssl-with-bazel/src/crypto/ecdh_extra/ecdh_extra.c +124 -0
  690. data/third_party/{boringssl → boringssl-with-bazel/src}/crypto/ecdsa_extra/ecdsa_asn1.c +0 -0
  691. data/third_party/{boringssl → boringssl-with-bazel/src}/crypto/engine/engine.c +0 -0
  692. data/third_party/boringssl-with-bazel/src/crypto/err/err.c +850 -0
  693. data/third_party/{boringssl → boringssl-with-bazel/src}/crypto/err/internal.h +0 -0
  694. data/third_party/{boringssl → boringssl-with-bazel/src}/crypto/evp/digestsign.c +0 -0
  695. data/third_party/{boringssl → boringssl-with-bazel/src}/crypto/evp/evp.c +0 -0
  696. data/third_party/{boringssl → boringssl-with-bazel/src}/crypto/evp/evp_asn1.c +0 -0
  697. data/third_party/{boringssl → boringssl-with-bazel/src}/crypto/evp/evp_ctx.c +0 -0
  698. data/third_party/{boringssl → boringssl-with-bazel/src}/crypto/evp/internal.h +0 -0
  699. data/third_party/{boringssl → boringssl-with-bazel/src}/crypto/evp/p_dsa_asn1.c +0 -0
  700. data/third_party/boringssl-with-bazel/src/crypto/evp/p_ec.c +286 -0
  701. data/third_party/{boringssl → boringssl-with-bazel/src}/crypto/evp/p_ec_asn1.c +0 -0
  702. data/third_party/{boringssl → boringssl-with-bazel/src}/crypto/evp/p_ed25519.c +0 -0
  703. data/third_party/{boringssl → boringssl-with-bazel/src}/crypto/evp/p_ed25519_asn1.c +0 -0
  704. data/third_party/boringssl-with-bazel/src/crypto/evp/p_rsa.c +648 -0
  705. data/third_party/{boringssl → boringssl-with-bazel/src}/crypto/evp/p_rsa_asn1.c +0 -0
  706. data/third_party/{boringssl → boringssl-with-bazel/src}/crypto/evp/p_x25519.c +0 -0
  707. data/third_party/boringssl-with-bazel/src/crypto/evp/p_x25519_asn1.c +248 -0
  708. data/third_party/{boringssl → boringssl-with-bazel/src}/crypto/evp/pbkdf.c +0 -0
  709. data/third_party/{boringssl → boringssl-with-bazel/src}/crypto/evp/print.c +0 -0
  710. data/third_party/{boringssl → boringssl-with-bazel/src}/crypto/evp/scrypt.c +0 -0
  711. data/third_party/{boringssl → boringssl-with-bazel/src}/crypto/evp/sign.c +0 -0
  712. data/third_party/{boringssl → boringssl-with-bazel/src}/crypto/ex_data.c +0 -0
  713. data/third_party/boringssl-with-bazel/src/crypto/fipsmodule/aes/aes.c +108 -0
  714. data/third_party/boringssl-with-bazel/src/crypto/fipsmodule/aes/aes_nohw.c +1282 -0
  715. data/third_party/boringssl-with-bazel/src/crypto/fipsmodule/aes/internal.h +238 -0
  716. data/third_party/{boringssl → boringssl-with-bazel/src}/crypto/fipsmodule/aes/key_wrap.c +0 -0
  717. data/third_party/boringssl-with-bazel/src/crypto/fipsmodule/aes/mode_wrappers.c +106 -0
  718. data/third_party/boringssl-with-bazel/src/crypto/fipsmodule/bcm.c +263 -0
  719. data/third_party/{boringssl → boringssl-with-bazel/src}/crypto/fipsmodule/bn/add.c +0 -0
  720. data/third_party/{boringssl → boringssl-with-bazel/src}/crypto/fipsmodule/bn/asm/x86_64-gcc.c +0 -0
  721. data/third_party/{boringssl → boringssl-with-bazel/src}/crypto/fipsmodule/bn/bn.c +0 -0
  722. data/third_party/{boringssl → boringssl-with-bazel/src}/crypto/fipsmodule/bn/bytes.c +0 -0
  723. data/third_party/{boringssl → boringssl-with-bazel/src}/crypto/fipsmodule/bn/cmp.c +0 -0
  724. data/third_party/{boringssl → boringssl-with-bazel/src}/crypto/fipsmodule/bn/ctx.c +0 -0
  725. data/third_party/{boringssl → boringssl-with-bazel/src}/crypto/fipsmodule/bn/div.c +0 -0
  726. data/third_party/{boringssl → boringssl-with-bazel/src}/crypto/fipsmodule/bn/div_extra.c +0 -0
  727. data/third_party/boringssl-with-bazel/src/crypto/fipsmodule/bn/exponentiation.c +1288 -0
  728. data/third_party/{boringssl → boringssl-with-bazel/src}/crypto/fipsmodule/bn/gcd.c +0 -0
  729. data/third_party/{boringssl → boringssl-with-bazel/src}/crypto/fipsmodule/bn/gcd_extra.c +0 -0
  730. data/third_party/{boringssl → boringssl-with-bazel/src}/crypto/fipsmodule/bn/generic.c +0 -0
  731. data/third_party/boringssl-with-bazel/src/crypto/fipsmodule/bn/internal.h +694 -0
  732. data/third_party/{boringssl → boringssl-with-bazel/src}/crypto/fipsmodule/bn/jacobi.c +0 -0
  733. data/third_party/boringssl-with-bazel/src/crypto/fipsmodule/bn/montgomery.c +502 -0
  734. data/third_party/{boringssl → boringssl-with-bazel/src}/crypto/fipsmodule/bn/montgomery_inv.c +0 -0
  735. data/third_party/boringssl-with-bazel/src/crypto/fipsmodule/bn/mul.c +749 -0
  736. data/third_party/boringssl-with-bazel/src/crypto/fipsmodule/bn/prime.c +1068 -0
  737. data/third_party/{boringssl → boringssl-with-bazel/src}/crypto/fipsmodule/bn/random.c +0 -0
  738. data/third_party/{boringssl → boringssl-with-bazel/src}/crypto/fipsmodule/bn/rsaz_exp.c +0 -0
  739. data/third_party/{boringssl → boringssl-with-bazel/src}/crypto/fipsmodule/bn/rsaz_exp.h +0 -0
  740. data/third_party/{boringssl → boringssl-with-bazel/src}/crypto/fipsmodule/bn/shift.c +0 -0
  741. data/third_party/{boringssl → boringssl-with-bazel/src}/crypto/fipsmodule/bn/sqrt.c +0 -0
  742. data/third_party/{boringssl → boringssl-with-bazel/src}/crypto/fipsmodule/cipher/aead.c +0 -0
  743. data/third_party/{boringssl → boringssl-with-bazel/src}/crypto/fipsmodule/cipher/cipher.c +0 -0
  744. data/third_party/boringssl-with-bazel/src/crypto/fipsmodule/cipher/e_aes.c +1302 -0
  745. data/third_party/{boringssl → boringssl-with-bazel/src}/crypto/fipsmodule/cipher/e_des.c +0 -0
  746. data/third_party/{boringssl → boringssl-with-bazel/src}/crypto/fipsmodule/cipher/internal.h +0 -0
  747. data/third_party/{boringssl → boringssl-with-bazel/src}/crypto/fipsmodule/delocate.h +0 -0
  748. data/third_party/{boringssl → boringssl-with-bazel/src}/crypto/fipsmodule/des/des.c +0 -0
  749. data/third_party/{boringssl → boringssl-with-bazel/src}/crypto/fipsmodule/des/internal.h +0 -0
  750. data/third_party/{boringssl → boringssl-with-bazel/src}/crypto/fipsmodule/digest/digest.c +0 -0
  751. data/third_party/boringssl-with-bazel/src/crypto/fipsmodule/digest/digests.c +296 -0
  752. data/third_party/{boringssl → boringssl-with-bazel/src}/crypto/fipsmodule/digest/internal.h +0 -0
  753. data/third_party/{boringssl → boringssl-with-bazel/src}/crypto/fipsmodule/digest/md32_common.h +0 -0
  754. data/third_party/boringssl-with-bazel/src/crypto/fipsmodule/ec/ec.c +1252 -0
  755. data/third_party/boringssl-with-bazel/src/crypto/fipsmodule/ec/ec_key.c +465 -0
  756. data/third_party/boringssl-with-bazel/src/crypto/fipsmodule/ec/ec_montgomery.c +524 -0
  757. data/third_party/boringssl-with-bazel/src/crypto/fipsmodule/ec/felem.c +100 -0
  758. data/third_party/boringssl-with-bazel/src/crypto/fipsmodule/ec/internal.h +775 -0
  759. data/third_party/boringssl-with-bazel/src/crypto/fipsmodule/ec/oct.c +328 -0
  760. data/third_party/boringssl-with-bazel/src/crypto/fipsmodule/ec/p224-64.c +1178 -0
  761. data/third_party/boringssl-with-bazel/src/crypto/fipsmodule/ec/p256-x86_64-table.h +9497 -0
  762. data/third_party/boringssl-with-bazel/src/crypto/fipsmodule/ec/p256-x86_64.c +632 -0
  763. data/third_party/{boringssl → boringssl-with-bazel/src}/crypto/fipsmodule/ec/p256-x86_64.h +0 -0
  764. data/third_party/boringssl-with-bazel/src/crypto/fipsmodule/ec/p256.c +736 -0
  765. data/third_party/boringssl-with-bazel/src/crypto/fipsmodule/ec/p256_table.h +297 -0
  766. data/third_party/boringssl-with-bazel/src/crypto/fipsmodule/ec/scalar.c +175 -0
  767. data/third_party/boringssl-with-bazel/src/crypto/fipsmodule/ec/simple.c +357 -0
  768. data/third_party/boringssl-with-bazel/src/crypto/fipsmodule/ec/simple_mul.c +270 -0
  769. data/third_party/{boringssl → boringssl-with-bazel/src}/crypto/fipsmodule/ec/util.c +0 -0
  770. data/third_party/boringssl-with-bazel/src/crypto/fipsmodule/ec/wnaf.c +270 -0
  771. data/third_party/boringssl-with-bazel/src/crypto/fipsmodule/ecdh/ecdh.c +122 -0
  772. data/third_party/boringssl-with-bazel/src/crypto/fipsmodule/ecdsa/ecdsa.c +328 -0
  773. data/third_party/{boringssl → boringssl-with-bazel/src}/crypto/fipsmodule/fips_shared_support.c +0 -0
  774. data/third_party/{boringssl → boringssl-with-bazel/src}/crypto/fipsmodule/hmac/hmac.c +0 -0
  775. data/third_party/{boringssl → boringssl-with-bazel/src}/crypto/fipsmodule/is_fips.c +0 -0
  776. data/third_party/{boringssl → boringssl-with-bazel/src}/crypto/fipsmodule/md4/md4.c +0 -0
  777. data/third_party/{boringssl → boringssl-with-bazel/src}/crypto/fipsmodule/md5/internal.h +0 -0
  778. data/third_party/{boringssl → boringssl-with-bazel/src}/crypto/fipsmodule/md5/md5.c +0 -0
  779. data/third_party/{boringssl → boringssl-with-bazel/src}/crypto/fipsmodule/modes/cbc.c +0 -0
  780. data/third_party/{boringssl → boringssl-with-bazel/src}/crypto/fipsmodule/modes/cfb.c +0 -0
  781. data/third_party/{boringssl → boringssl-with-bazel/src}/crypto/fipsmodule/modes/ctr.c +0 -0
  782. data/third_party/boringssl-with-bazel/src/crypto/fipsmodule/modes/gcm.c +729 -0
  783. data/third_party/boringssl-with-bazel/src/crypto/fipsmodule/modes/gcm_nohw.c +304 -0
  784. data/third_party/boringssl-with-bazel/src/crypto/fipsmodule/modes/internal.h +441 -0
  785. data/third_party/{boringssl → boringssl-with-bazel/src}/crypto/fipsmodule/modes/ofb.c +0 -0
  786. data/third_party/{boringssl → boringssl-with-bazel/src}/crypto/fipsmodule/modes/polyval.c +0 -0
  787. data/third_party/{boringssl → boringssl-with-bazel/src}/crypto/fipsmodule/rand/ctrdrbg.c +0 -0
  788. data/third_party/boringssl-with-bazel/src/crypto/fipsmodule/rand/fork_detect.c +137 -0
  789. data/third_party/boringssl-with-bazel/src/crypto/fipsmodule/rand/fork_detect.h +49 -0
  790. data/third_party/boringssl-with-bazel/src/crypto/fipsmodule/rand/getrandom_fillin.h +64 -0
  791. data/third_party/boringssl-with-bazel/src/crypto/fipsmodule/rand/internal.h +163 -0
  792. data/third_party/boringssl-with-bazel/src/crypto/fipsmodule/rand/rand.c +378 -0
  793. data/third_party/boringssl-with-bazel/src/crypto/fipsmodule/rand/urandom.c +391 -0
  794. data/third_party/boringssl-with-bazel/src/crypto/fipsmodule/rsa/blinding.c +243 -0
  795. data/third_party/boringssl-with-bazel/src/crypto/fipsmodule/rsa/internal.h +127 -0
  796. data/third_party/{boringssl → boringssl-with-bazel/src}/crypto/fipsmodule/rsa/padding.c +0 -0
  797. data/third_party/boringssl-with-bazel/src/crypto/fipsmodule/rsa/rsa.c +898 -0
  798. data/third_party/boringssl-with-bazel/src/crypto/fipsmodule/rsa/rsa_impl.c +1358 -0
  799. data/third_party/{boringssl → boringssl-with-bazel/src}/crypto/fipsmodule/self_check/self_check.c +0 -0
  800. data/third_party/{boringssl → boringssl-with-bazel/src}/crypto/fipsmodule/sha/internal.h +0 -0
  801. data/third_party/{boringssl → boringssl-with-bazel/src}/crypto/fipsmodule/sha/sha1-altivec.c +0 -0
  802. data/third_party/{boringssl → boringssl-with-bazel/src}/crypto/fipsmodule/sha/sha1.c +0 -0
  803. data/third_party/{boringssl → boringssl-with-bazel/src}/crypto/fipsmodule/sha/sha256.c +0 -0
  804. data/third_party/boringssl-with-bazel/src/crypto/fipsmodule/sha/sha512.c +544 -0
  805. data/third_party/{boringssl → boringssl-with-bazel/src}/crypto/fipsmodule/tls/internal.h +0 -0
  806. data/third_party/{boringssl → boringssl-with-bazel/src}/crypto/fipsmodule/tls/kdf.c +0 -0
  807. data/third_party/{boringssl → boringssl-with-bazel/src}/crypto/hkdf/hkdf.c +0 -0
  808. data/third_party/boringssl-with-bazel/src/crypto/hrss/hrss.c +2100 -0
  809. data/third_party/boringssl-with-bazel/src/crypto/hrss/internal.h +61 -0
  810. data/third_party/boringssl-with-bazel/src/crypto/internal.h +834 -0
  811. data/third_party/{boringssl → boringssl-with-bazel/src}/crypto/lhash/lhash.c +0 -0
  812. data/third_party/boringssl-with-bazel/src/crypto/mem.c +359 -0
  813. data/third_party/boringssl-with-bazel/src/crypto/obj/obj.c +549 -0
  814. data/third_party/boringssl-with-bazel/src/crypto/obj/obj_dat.h +11585 -0
  815. data/third_party/{boringssl → boringssl-with-bazel/src}/crypto/obj/obj_xref.c +0 -0
  816. data/third_party/{boringssl → boringssl-with-bazel/src}/crypto/pem/pem_all.c +0 -0
  817. data/third_party/boringssl-with-bazel/src/crypto/pem/pem_info.c +360 -0
  818. data/third_party/boringssl-with-bazel/src/crypto/pem/pem_lib.c +777 -0
  819. data/third_party/boringssl-with-bazel/src/crypto/pem/pem_oth.c +87 -0
  820. data/third_party/boringssl-with-bazel/src/crypto/pem/pem_pk8.c +257 -0
  821. data/third_party/boringssl-with-bazel/src/crypto/pem/pem_pkey.c +218 -0
  822. data/third_party/{boringssl → boringssl-with-bazel/src}/crypto/pem/pem_x509.c +0 -0
  823. data/third_party/{boringssl → boringssl-with-bazel/src}/crypto/pem/pem_xaux.c +0 -0
  824. data/third_party/{boringssl → boringssl-with-bazel/src}/crypto/pkcs7/internal.h +0 -0
  825. data/third_party/{boringssl → boringssl-with-bazel/src}/crypto/pkcs7/pkcs7.c +0 -0
  826. data/third_party/boringssl-with-bazel/src/crypto/pkcs7/pkcs7_x509.c +385 -0
  827. data/third_party/{boringssl → boringssl-with-bazel/src}/crypto/pkcs8/internal.h +0 -0
  828. data/third_party/{boringssl → boringssl-with-bazel/src}/crypto/pkcs8/p5_pbev2.c +0 -0
  829. data/third_party/{boringssl → boringssl-with-bazel/src}/crypto/pkcs8/pkcs8.c +0 -0
  830. data/third_party/{boringssl → boringssl-with-bazel/src}/crypto/pkcs8/pkcs8_x509.c +0 -0
  831. data/third_party/{boringssl → boringssl-with-bazel/src}/crypto/poly1305/internal.h +0 -0
  832. data/third_party/boringssl-with-bazel/src/crypto/poly1305/poly1305.c +318 -0
  833. data/third_party/boringssl-with-bazel/src/crypto/poly1305/poly1305_arm.c +305 -0
  834. data/third_party/boringssl-with-bazel/src/crypto/poly1305/poly1305_vec.c +856 -0
  835. data/third_party/{boringssl → boringssl-with-bazel/src}/crypto/pool/internal.h +0 -0
  836. data/third_party/boringssl-with-bazel/src/crypto/pool/pool.c +220 -0
  837. data/third_party/boringssl-with-bazel/src/crypto/rand_extra/deterministic.c +52 -0
  838. data/third_party/{boringssl → boringssl-with-bazel/src}/crypto/rand_extra/forkunsafe.c +0 -0
  839. data/third_party/{boringssl → boringssl-with-bazel/src}/crypto/rand_extra/fuchsia.c +0 -0
  840. data/third_party/{boringssl → boringssl-with-bazel/src}/crypto/rand_extra/rand_extra.c +0 -0
  841. data/third_party/boringssl-with-bazel/src/crypto/rand_extra/windows.c +69 -0
  842. data/third_party/{boringssl → boringssl-with-bazel/src}/crypto/rc4/rc4.c +0 -0
  843. data/third_party/{boringssl → boringssl-with-bazel/src}/crypto/refcount_c11.c +0 -0
  844. data/third_party/{boringssl → boringssl-with-bazel/src}/crypto/refcount_lock.c +0 -0
  845. data/third_party/{boringssl → boringssl-with-bazel/src}/crypto/rsa_extra/rsa_asn1.c +0 -0
  846. data/third_party/{boringssl → boringssl-with-bazel/src}/crypto/rsa_extra/rsa_print.c +0 -0
  847. data/third_party/boringssl-with-bazel/src/crypto/siphash/siphash.c +82 -0
  848. data/third_party/{boringssl → boringssl-with-bazel/src}/crypto/stack/stack.c +0 -0
  849. data/third_party/{boringssl → boringssl-with-bazel/src}/crypto/thread.c +0 -0
  850. data/third_party/{boringssl → boringssl-with-bazel/src}/crypto/thread_none.c +0 -0
  851. data/third_party/boringssl-with-bazel/src/crypto/thread_pthread.c +210 -0
  852. data/third_party/boringssl-with-bazel/src/crypto/thread_win.c +260 -0
  853. data/third_party/boringssl-with-bazel/src/crypto/trust_token/internal.h +278 -0
  854. data/third_party/boringssl-with-bazel/src/crypto/trust_token/pmbtoken.c +1474 -0
  855. data/third_party/boringssl-with-bazel/src/crypto/trust_token/trust_token.c +720 -0
  856. data/third_party/{boringssl → boringssl-with-bazel/src}/crypto/x509/a_digest.c +0 -0
  857. data/third_party/{boringssl → boringssl-with-bazel/src}/crypto/x509/a_sign.c +0 -0
  858. data/third_party/{boringssl → boringssl-with-bazel/src}/crypto/x509/a_strex.c +0 -0
  859. data/third_party/boringssl-with-bazel/src/crypto/x509/a_verify.c +114 -0
  860. data/third_party/{boringssl → boringssl-with-bazel/src}/crypto/x509/algorithm.c +0 -0
  861. data/third_party/{boringssl → boringssl-with-bazel/src}/crypto/x509/asn1_gen.c +0 -0
  862. data/third_party/boringssl-with-bazel/src/crypto/x509/by_dir.c +458 -0
  863. data/third_party/boringssl-with-bazel/src/crypto/x509/by_file.c +275 -0
  864. data/third_party/{boringssl → boringssl-with-bazel/src}/crypto/x509/charmap.h +0 -0
  865. data/third_party/{boringssl → boringssl-with-bazel/src}/crypto/x509/i2d_pr.c +0 -0
  866. data/third_party/{boringssl → boringssl-with-bazel/src}/crypto/x509/internal.h +0 -0
  867. data/third_party/{boringssl → boringssl-with-bazel/src}/crypto/x509/rsa_pss.c +0 -0
  868. data/third_party/{boringssl → boringssl-with-bazel/src}/crypto/x509/t_crl.c +0 -0
  869. data/third_party/{boringssl → boringssl-with-bazel/src}/crypto/x509/t_req.c +0 -0
  870. data/third_party/{boringssl → boringssl-with-bazel/src}/crypto/x509/t_x509.c +0 -0
  871. data/third_party/{boringssl → boringssl-with-bazel/src}/crypto/x509/t_x509a.c +0 -0
  872. data/third_party/{boringssl → boringssl-with-bazel/src}/crypto/x509/vpm_int.h +0 -0
  873. data/third_party/{boringssl → boringssl-with-bazel/src}/crypto/x509/x509.c +0 -0
  874. data/third_party/{boringssl → boringssl-with-bazel/src}/crypto/x509/x509_att.c +0 -0
  875. data/third_party/boringssl-with-bazel/src/crypto/x509/x509_cmp.c +476 -0
  876. data/third_party/{boringssl → boringssl-with-bazel/src}/crypto/x509/x509_d2.c +0 -0
  877. data/third_party/{boringssl → boringssl-with-bazel/src}/crypto/x509/x509_def.c +0 -0
  878. data/third_party/{boringssl → boringssl-with-bazel/src}/crypto/x509/x509_ext.c +0 -0
  879. data/third_party/{boringssl → boringssl-with-bazel/src}/crypto/x509/x509_lu.c +0 -0
  880. data/third_party/boringssl-with-bazel/src/crypto/x509/x509_obj.c +198 -0
  881. data/third_party/boringssl-with-bazel/src/crypto/x509/x509_r2x.c +116 -0
  882. data/third_party/boringssl-with-bazel/src/crypto/x509/x509_req.c +341 -0
  883. data/third_party/boringssl-with-bazel/src/crypto/x509/x509_set.c +185 -0
  884. data/third_party/boringssl-with-bazel/src/crypto/x509/x509_trs.c +326 -0
  885. data/third_party/{boringssl → boringssl-with-bazel/src}/crypto/x509/x509_txt.c +0 -0
  886. data/third_party/{boringssl → boringssl-with-bazel/src}/crypto/x509/x509_v3.c +0 -0
  887. data/third_party/boringssl-with-bazel/src/crypto/x509/x509_vfy.c +2487 -0
  888. data/third_party/boringssl-with-bazel/src/crypto/x509/x509_vpm.c +671 -0
  889. data/third_party/{boringssl → boringssl-with-bazel/src}/crypto/x509/x509cset.c +0 -0
  890. data/third_party/boringssl-with-bazel/src/crypto/x509/x509name.c +389 -0
  891. data/third_party/{boringssl → boringssl-with-bazel/src}/crypto/x509/x509rset.c +0 -0
  892. data/third_party/{boringssl → boringssl-with-bazel/src}/crypto/x509/x509spki.c +0 -0
  893. data/third_party/{boringssl → boringssl-with-bazel/src}/crypto/x509/x_algor.c +0 -0
  894. data/third_party/boringssl-with-bazel/src/crypto/x509/x_all.c +399 -0
  895. data/third_party/{boringssl → boringssl-with-bazel/src}/crypto/x509/x_attrib.c +0 -0
  896. data/third_party/{boringssl → boringssl-with-bazel/src}/crypto/x509/x_crl.c +0 -0
  897. data/third_party/{boringssl → boringssl-with-bazel/src}/crypto/x509/x_exten.c +0 -0
  898. data/third_party/{boringssl → boringssl-with-bazel/src}/crypto/x509/x_info.c +0 -0
  899. data/third_party/{boringssl → boringssl-with-bazel/src}/crypto/x509/x_name.c +0 -0
  900. data/third_party/{boringssl → boringssl-with-bazel/src}/crypto/x509/x_pkey.c +0 -0
  901. data/third_party/{boringssl → boringssl-with-bazel/src}/crypto/x509/x_pubkey.c +0 -0
  902. data/third_party/{boringssl → boringssl-with-bazel/src}/crypto/x509/x_req.c +0 -0
  903. data/third_party/{boringssl → boringssl-with-bazel/src}/crypto/x509/x_sig.c +0 -0
  904. data/third_party/{boringssl → boringssl-with-bazel/src}/crypto/x509/x_spki.c +0 -0
  905. data/third_party/{boringssl → boringssl-with-bazel/src}/crypto/x509/x_val.c +0 -0
  906. data/third_party/{boringssl → boringssl-with-bazel/src}/crypto/x509/x_x509.c +0 -0
  907. data/third_party/{boringssl → boringssl-with-bazel/src}/crypto/x509/x_x509a.c +0 -0
  908. data/third_party/{boringssl → boringssl-with-bazel/src}/crypto/x509v3/ext_dat.h +0 -0
  909. data/third_party/{boringssl → boringssl-with-bazel/src}/crypto/x509v3/internal.h +0 -0
  910. data/third_party/{boringssl → boringssl-with-bazel/src}/crypto/x509v3/pcy_cache.c +0 -0
  911. data/third_party/{boringssl → boringssl-with-bazel/src}/crypto/x509v3/pcy_data.c +0 -0
  912. data/third_party/{boringssl → boringssl-with-bazel/src}/crypto/x509v3/pcy_int.h +0 -0
  913. data/third_party/{boringssl → boringssl-with-bazel/src}/crypto/x509v3/pcy_lib.c +0 -0
  914. data/third_party/{boringssl → boringssl-with-bazel/src}/crypto/x509v3/pcy_map.c +0 -0
  915. data/third_party/{boringssl → boringssl-with-bazel/src}/crypto/x509v3/pcy_node.c +0 -0
  916. data/third_party/{boringssl → boringssl-with-bazel/src}/crypto/x509v3/pcy_tree.c +0 -0
  917. data/third_party/{boringssl → boringssl-with-bazel/src}/crypto/x509v3/v3_akey.c +0 -0
  918. data/third_party/{boringssl → boringssl-with-bazel/src}/crypto/x509v3/v3_akeya.c +0 -0
  919. data/third_party/boringssl-with-bazel/src/crypto/x509v3/v3_alt.c +629 -0
  920. data/third_party/{boringssl → boringssl-with-bazel/src}/crypto/x509v3/v3_bcons.c +0 -0
  921. data/third_party/{boringssl → boringssl-with-bazel/src}/crypto/x509v3/v3_bitst.c +0 -0
  922. data/third_party/{boringssl → boringssl-with-bazel/src}/crypto/x509v3/v3_conf.c +0 -0
  923. data/third_party/{boringssl → boringssl-with-bazel/src}/crypto/x509v3/v3_cpols.c +0 -0
  924. data/third_party/{boringssl → boringssl-with-bazel/src}/crypto/x509v3/v3_crld.c +0 -0
  925. data/third_party/boringssl-with-bazel/src/crypto/x509v3/v3_enum.c +100 -0
  926. data/third_party/{boringssl → boringssl-with-bazel/src}/crypto/x509v3/v3_extku.c +0 -0
  927. data/third_party/{boringssl → boringssl-with-bazel/src}/crypto/x509v3/v3_genn.c +0 -0
  928. data/third_party/{boringssl → boringssl-with-bazel/src}/crypto/x509v3/v3_ia5.c +0 -0
  929. data/third_party/boringssl-with-bazel/src/crypto/x509v3/v3_info.c +218 -0
  930. data/third_party/{boringssl → boringssl-with-bazel/src}/crypto/x509v3/v3_int.c +0 -0
  931. data/third_party/{boringssl → boringssl-with-bazel/src}/crypto/x509v3/v3_lib.c +0 -0
  932. data/third_party/{boringssl → boringssl-with-bazel/src}/crypto/x509v3/v3_ncons.c +0 -0
  933. data/third_party/{boringssl → boringssl-with-bazel/src}/crypto/x509v3/v3_ocsp.c +0 -0
  934. data/third_party/{boringssl → boringssl-with-bazel/src}/crypto/x509v3/v3_pci.c +0 -0
  935. data/third_party/{boringssl → boringssl-with-bazel/src}/crypto/x509v3/v3_pcia.c +0 -0
  936. data/third_party/{boringssl → boringssl-with-bazel/src}/crypto/x509v3/v3_pcons.c +0 -0
  937. data/third_party/{boringssl → boringssl-with-bazel/src}/crypto/x509v3/v3_pku.c +0 -0
  938. data/third_party/{boringssl → boringssl-with-bazel/src}/crypto/x509v3/v3_pmaps.c +0 -0
  939. data/third_party/{boringssl → boringssl-with-bazel/src}/crypto/x509v3/v3_prn.c +0 -0
  940. data/third_party/boringssl-with-bazel/src/crypto/x509v3/v3_purp.c +843 -0
  941. data/third_party/{boringssl → boringssl-with-bazel/src}/crypto/x509v3/v3_skey.c +0 -0
  942. data/third_party/{boringssl → boringssl-with-bazel/src}/crypto/x509v3/v3_sxnet.c +0 -0
  943. data/third_party/boringssl-with-bazel/src/crypto/x509v3/v3_utl.c +1395 -0
  944. data/third_party/{boringssl → boringssl-with-bazel/src}/include/openssl/aead.h +0 -0
  945. data/third_party/{boringssl → boringssl-with-bazel/src}/include/openssl/aes.h +0 -0
  946. data/third_party/{boringssl → boringssl-with-bazel/src}/include/openssl/arm_arch.h +0 -0
  947. data/third_party/{boringssl → boringssl-with-bazel/src}/include/openssl/asn1.h +0 -0
  948. data/third_party/{boringssl → boringssl-with-bazel/src}/include/openssl/asn1_mac.h +0 -0
  949. data/third_party/{boringssl → boringssl-with-bazel/src}/include/openssl/asn1t.h +0 -0
  950. data/third_party/boringssl-with-bazel/src/include/openssl/base.h +575 -0
  951. data/third_party/{boringssl → boringssl-with-bazel/src}/include/openssl/base64.h +0 -0
  952. data/third_party/{boringssl → boringssl-with-bazel/src}/include/openssl/bio.h +0 -0
  953. data/third_party/{boringssl → boringssl-with-bazel/src}/include/openssl/blowfish.h +0 -0
  954. data/third_party/boringssl-with-bazel/src/include/openssl/bn.h +1057 -0
  955. data/third_party/boringssl-with-bazel/src/include/openssl/buf.h +137 -0
  956. data/third_party/{boringssl → boringssl-with-bazel/src}/include/openssl/buffer.h +0 -0
  957. data/third_party/boringssl-with-bazel/src/include/openssl/bytestring.h +561 -0
  958. data/third_party/{boringssl → boringssl-with-bazel/src}/include/openssl/cast.h +0 -0
  959. data/third_party/{boringssl → boringssl-with-bazel/src}/include/openssl/chacha.h +0 -0
  960. data/third_party/{boringssl → boringssl-with-bazel/src}/include/openssl/cipher.h +0 -0
  961. data/third_party/{boringssl → boringssl-with-bazel/src}/include/openssl/cmac.h +0 -0
  962. data/third_party/{boringssl → boringssl-with-bazel/src}/include/openssl/conf.h +0 -0
  963. data/third_party/{boringssl → boringssl-with-bazel/src}/include/openssl/cpu.h +0 -0
  964. data/third_party/boringssl-with-bazel/src/include/openssl/crypto.h +149 -0
  965. data/third_party/{boringssl → boringssl-with-bazel/src}/include/openssl/curve25519.h +0 -0
  966. data/third_party/{boringssl → boringssl-with-bazel/src}/include/openssl/des.h +0 -0
  967. data/third_party/boringssl-with-bazel/src/include/openssl/dh.h +319 -0
  968. data/third_party/boringssl-with-bazel/src/include/openssl/digest.h +331 -0
  969. data/third_party/boringssl-with-bazel/src/include/openssl/dsa.h +457 -0
  970. data/third_party/{boringssl → boringssl-with-bazel/src}/include/openssl/dtls1.h +0 -0
  971. data/third_party/{boringssl → boringssl-with-bazel/src}/include/openssl/e_os2.h +0 -0
  972. data/third_party/boringssl-with-bazel/src/include/openssl/ec.h +424 -0
  973. data/third_party/boringssl-with-bazel/src/include/openssl/ec_key.h +372 -0
  974. data/third_party/{boringssl → boringssl-with-bazel/src}/include/openssl/ecdh.h +0 -0
  975. data/third_party/boringssl-with-bazel/src/include/openssl/ecdsa.h +205 -0
  976. data/third_party/{boringssl → boringssl-with-bazel/src}/include/openssl/engine.h +0 -0
  977. data/third_party/boringssl-with-bazel/src/include/openssl/err.h +465 -0
  978. data/third_party/boringssl-with-bazel/src/include/openssl/evp.h +1050 -0
  979. data/third_party/{boringssl → boringssl-with-bazel/src}/include/openssl/ex_data.h +0 -0
  980. data/third_party/{boringssl → boringssl-with-bazel/src}/include/openssl/hkdf.h +0 -0
  981. data/third_party/{boringssl → boringssl-with-bazel/src}/include/openssl/hmac.h +0 -0
  982. data/third_party/{boringssl → boringssl-with-bazel/src}/include/openssl/hrss.h +0 -0
  983. data/third_party/{boringssl → boringssl-with-bazel/src}/include/openssl/is_boringssl.h +0 -0
  984. data/third_party/{boringssl → boringssl-with-bazel/src}/include/openssl/lhash.h +0 -0
  985. data/third_party/{boringssl → boringssl-with-bazel/src}/include/openssl/md4.h +0 -0
  986. data/third_party/{boringssl → boringssl-with-bazel/src}/include/openssl/md5.h +0 -0
  987. data/third_party/boringssl-with-bazel/src/include/openssl/mem.h +175 -0
  988. data/third_party/boringssl-with-bazel/src/include/openssl/nid.h +4259 -0
  989. data/third_party/{boringssl → boringssl-with-bazel/src}/include/openssl/obj.h +0 -0
  990. data/third_party/{boringssl → boringssl-with-bazel/src}/include/openssl/obj_mac.h +0 -0
  991. data/third_party/{boringssl → boringssl-with-bazel/src}/include/openssl/objects.h +0 -0
  992. data/third_party/{boringssl → boringssl-with-bazel/src}/include/openssl/opensslconf.h +0 -0
  993. data/third_party/{boringssl → boringssl-with-bazel/src}/include/openssl/opensslv.h +0 -0
  994. data/third_party/{boringssl → boringssl-with-bazel/src}/include/openssl/ossl_typ.h +0 -0
  995. data/third_party/{boringssl → boringssl-with-bazel/src}/include/openssl/pem.h +0 -0
  996. data/third_party/{boringssl → boringssl-with-bazel/src}/include/openssl/pkcs12.h +0 -0
  997. data/third_party/{boringssl → boringssl-with-bazel/src}/include/openssl/pkcs7.h +0 -0
  998. data/third_party/{boringssl → boringssl-with-bazel/src}/include/openssl/pkcs8.h +0 -0
  999. data/third_party/boringssl-with-bazel/src/include/openssl/poly1305.h +49 -0
  1000. data/third_party/{boringssl → boringssl-with-bazel/src}/include/openssl/pool.h +0 -0
  1001. data/third_party/boringssl-with-bazel/src/include/openssl/rand.h +111 -0
  1002. data/third_party/{boringssl → boringssl-with-bazel/src}/include/openssl/rc4.h +0 -0
  1003. data/third_party/{boringssl → boringssl-with-bazel/src}/include/openssl/ripemd.h +0 -0
  1004. data/third_party/boringssl-with-bazel/src/include/openssl/rsa.h +818 -0
  1005. data/third_party/{boringssl → boringssl-with-bazel/src}/include/openssl/safestack.h +0 -0
  1006. data/third_party/boringssl-with-bazel/src/include/openssl/sha.h +294 -0
  1007. data/third_party/{boringssl → boringssl-with-bazel/src}/include/openssl/siphash.h +0 -0
  1008. data/third_party/{boringssl → boringssl-with-bazel/src}/include/openssl/span.h +0 -0
  1009. data/third_party/{boringssl → boringssl-with-bazel/src}/include/openssl/srtp.h +0 -0
  1010. data/third_party/boringssl-with-bazel/src/include/openssl/ssl.h +5198 -0
  1011. data/third_party/{boringssl → boringssl-with-bazel/src}/include/openssl/ssl3.h +0 -0
  1012. data/third_party/{boringssl → boringssl-with-bazel/src}/include/openssl/stack.h +0 -0
  1013. data/third_party/{boringssl → boringssl-with-bazel/src}/include/openssl/thread.h +0 -0
  1014. data/third_party/boringssl-with-bazel/src/include/openssl/tls1.h +632 -0
  1015. data/third_party/boringssl-with-bazel/src/include/openssl/trust_token.h +291 -0
  1016. data/third_party/{boringssl → boringssl-with-bazel/src}/include/openssl/type_check.h +0 -0
  1017. data/third_party/boringssl-with-bazel/src/include/openssl/x509.h +1207 -0
  1018. data/third_party/boringssl-with-bazel/src/include/openssl/x509_vfy.h +681 -0
  1019. data/third_party/{boringssl → boringssl-with-bazel/src}/include/openssl/x509v3.h +0 -0
  1020. data/third_party/{boringssl → boringssl-with-bazel/src}/ssl/bio_ssl.cc +0 -0
  1021. data/third_party/boringssl-with-bazel/src/ssl/d1_both.cc +837 -0
  1022. data/third_party/boringssl-with-bazel/src/ssl/d1_lib.cc +268 -0
  1023. data/third_party/boringssl-with-bazel/src/ssl/d1_pkt.cc +273 -0
  1024. data/third_party/{boringssl → boringssl-with-bazel/src}/ssl/d1_srtp.cc +0 -0
  1025. data/third_party/boringssl-with-bazel/src/ssl/dtls_method.cc +200 -0
  1026. data/third_party/{boringssl → boringssl-with-bazel/src}/ssl/dtls_record.cc +0 -0
  1027. data/third_party/boringssl-with-bazel/src/ssl/handoff.cc +675 -0
  1028. data/third_party/boringssl-with-bazel/src/ssl/handshake.cc +703 -0
  1029. data/third_party/boringssl-with-bazel/src/ssl/handshake_client.cc +1890 -0
  1030. data/third_party/boringssl-with-bazel/src/ssl/handshake_server.cc +1805 -0
  1031. data/third_party/boringssl-with-bazel/src/ssl/internal.h +3572 -0
  1032. data/third_party/boringssl-with-bazel/src/ssl/s3_both.cc +724 -0
  1033. data/third_party/boringssl-with-bazel/src/ssl/s3_lib.cc +221 -0
  1034. data/third_party/boringssl-with-bazel/src/ssl/s3_pkt.cc +458 -0
  1035. data/third_party/{boringssl → boringssl-with-bazel/src}/ssl/ssl_aead_ctx.cc +0 -0
  1036. data/third_party/boringssl-with-bazel/src/ssl/ssl_asn1.cc +856 -0
  1037. data/third_party/boringssl-with-bazel/src/ssl/ssl_buffer.cc +306 -0
  1038. data/third_party/boringssl-with-bazel/src/ssl/ssl_cert.cc +1019 -0
  1039. data/third_party/boringssl-with-bazel/src/ssl/ssl_cipher.cc +1718 -0
  1040. data/third_party/{boringssl → boringssl-with-bazel/src}/ssl/ssl_file.cc +0 -0
  1041. data/third_party/{boringssl → boringssl-with-bazel/src}/ssl/ssl_key_share.cc +0 -0
  1042. data/third_party/boringssl-with-bazel/src/ssl/ssl_lib.cc +3015 -0
  1043. data/third_party/boringssl-with-bazel/src/ssl/ssl_privkey.cc +835 -0
  1044. data/third_party/boringssl-with-bazel/src/ssl/ssl_session.cc +1333 -0
  1045. data/third_party/boringssl-with-bazel/src/ssl/ssl_stat.cc +230 -0
  1046. data/third_party/{boringssl → boringssl-with-bazel/src}/ssl/ssl_transcript.cc +0 -0
  1047. data/third_party/boringssl-with-bazel/src/ssl/ssl_versions.cc +394 -0
  1048. data/third_party/{boringssl → boringssl-with-bazel/src}/ssl/ssl_x509.cc +0 -0
  1049. data/third_party/boringssl-with-bazel/src/ssl/t1_enc.cc +365 -0
  1050. data/third_party/boringssl-with-bazel/src/ssl/t1_lib.cc +3870 -0
  1051. data/third_party/boringssl-with-bazel/src/ssl/tls13_both.cc +689 -0
  1052. data/third_party/boringssl-with-bazel/src/ssl/tls13_client.cc +1017 -0
  1053. data/third_party/boringssl-with-bazel/src/ssl/tls13_enc.cc +513 -0
  1054. data/third_party/boringssl-with-bazel/src/ssl/tls13_server.cc +1096 -0
  1055. data/third_party/boringssl-with-bazel/src/ssl/tls_method.cc +317 -0
  1056. data/third_party/boringssl-with-bazel/src/ssl/tls_record.cc +703 -0
  1057. data/third_party/boringssl-with-bazel/src/third_party/fiat/curve25519_32.h +981 -0
  1058. data/third_party/boringssl-with-bazel/src/third_party/fiat/curve25519_64.h +619 -0
  1059. data/third_party/boringssl-with-bazel/src/third_party/fiat/p256_32.h +3147 -0
  1060. data/third_party/boringssl-with-bazel/src/third_party/fiat/p256_64.h +1226 -0
  1061. data/third_party/upb/upb/decode.c +4 -0
  1062. data/third_party/upb/upb/port.c +0 -1
  1063. data/third_party/upb/upb/port_def.inc +1 -3
  1064. data/third_party/upb/upb/table.c +2 -1
  1065. metadata +758 -509
  1066. data/src/boringssl/err_data.c +0 -1407
  1067. data/src/core/ext/filters/client_channel/lb_policy/xds/xds.cc +0 -1898
  1068. data/src/core/lib/gprpp/inlined_vector.h +0 -246
  1069. data/src/core/lib/gprpp/optional.h +0 -48
  1070. data/src/core/lib/gprpp/string_view.h +0 -165
  1071. data/src/core/lib/iomgr/logical_thread.cc +0 -103
  1072. data/src/core/lib/iomgr/logical_thread.h +0 -52
  1073. data/src/core/lib/json/json.cc +0 -94
  1074. data/src/core/lib/json/json_common.h +0 -34
  1075. data/src/core/lib/json/json_reader.h +0 -146
  1076. data/src/core/lib/json/json_string.cc +0 -367
  1077. data/src/core/lib/json/json_writer.h +0 -84
  1078. data/src/core/lib/security/credentials/tls/spiffe_credentials.cc +0 -129
  1079. data/src/core/lib/security/credentials/tls/spiffe_credentials.h +0 -62
  1080. data/src/core/lib/security/security_connector/tls/spiffe_security_connector.cc +0 -541
  1081. data/src/core/lib/security/security_connector/tls/spiffe_security_connector.h +0 -158
  1082. data/src/core/tsi/grpc_shadow_boringssl.h +0 -3297
  1083. data/third_party/boringssl/crypto/asn1/a_time.c +0 -213
  1084. data/third_party/boringssl/crypto/bio/connect.c +0 -546
  1085. data/third_party/boringssl/crypto/bio/fd.c +0 -280
  1086. data/third_party/boringssl/crypto/bio/file.c +0 -318
  1087. data/third_party/boringssl/crypto/bio/pair.c +0 -489
  1088. data/third_party/boringssl/crypto/buf/buf.c +0 -231
  1089. data/third_party/boringssl/crypto/bytestring/cbb.c +0 -680
  1090. data/third_party/boringssl/crypto/bytestring/cbs.c +0 -631
  1091. data/third_party/boringssl/crypto/cipher_extra/derive_key.c +0 -152
  1092. data/third_party/boringssl/crypto/cipher_extra/e_aesgcmsiv.c +0 -883
  1093. data/third_party/boringssl/crypto/cpu-arm-linux.c +0 -219
  1094. data/third_party/boringssl/crypto/cpu-intel.c +0 -282
  1095. data/third_party/boringssl/crypto/crypto.c +0 -215
  1096. data/third_party/boringssl/crypto/curve25519/spake25519.c +0 -539
  1097. data/third_party/boringssl/crypto/dh/check.c +0 -217
  1098. data/third_party/boringssl/crypto/dh/dh.c +0 -519
  1099. data/third_party/boringssl/crypto/dsa/dsa.c +0 -970
  1100. data/third_party/boringssl/crypto/ec_extra/ec_derive.c +0 -96
  1101. data/third_party/boringssl/crypto/ecdh_extra/ecdh_extra.c +0 -124
  1102. data/third_party/boringssl/crypto/err/err.c +0 -849
  1103. data/third_party/boringssl/crypto/evp/p_ec.c +0 -287
  1104. data/third_party/boringssl/crypto/evp/p_rsa.c +0 -636
  1105. data/third_party/boringssl/crypto/evp/p_x25519_asn1.c +0 -249
  1106. data/third_party/boringssl/crypto/fipsmodule/aes/aes.c +0 -860
  1107. data/third_party/boringssl/crypto/fipsmodule/aes/internal.h +0 -240
  1108. data/third_party/boringssl/crypto/fipsmodule/aes/mode_wrappers.c +0 -108
  1109. data/third_party/boringssl/crypto/fipsmodule/bcm.c +0 -260
  1110. data/third_party/boringssl/crypto/fipsmodule/bn/exponentiation.c +0 -1288
  1111. data/third_party/boringssl/crypto/fipsmodule/bn/internal.h +0 -691
  1112. data/third_party/boringssl/crypto/fipsmodule/bn/montgomery.c +0 -502
  1113. data/third_party/boringssl/crypto/fipsmodule/bn/mul.c +0 -873
  1114. data/third_party/boringssl/crypto/fipsmodule/bn/prime.c +0 -1069
  1115. data/third_party/boringssl/crypto/fipsmodule/cipher/e_aes.c +0 -1304
  1116. data/third_party/boringssl/crypto/fipsmodule/digest/digests.c +0 -280
  1117. data/third_party/boringssl/crypto/fipsmodule/ec/ec.c +0 -1080
  1118. data/third_party/boringssl/crypto/fipsmodule/ec/ec_key.c +0 -479
  1119. data/third_party/boringssl/crypto/fipsmodule/ec/ec_montgomery.c +0 -483
  1120. data/third_party/boringssl/crypto/fipsmodule/ec/felem.c +0 -82
  1121. data/third_party/boringssl/crypto/fipsmodule/ec/internal.h +0 -503
  1122. data/third_party/boringssl/crypto/fipsmodule/ec/oct.c +0 -336
  1123. data/third_party/boringssl/crypto/fipsmodule/ec/p224-64.c +0 -1187
  1124. data/third_party/boringssl/crypto/fipsmodule/ec/p256-x86_64-table.h +0 -9501
  1125. data/third_party/boringssl/crypto/fipsmodule/ec/p256-x86_64.c +0 -651
  1126. data/third_party/boringssl/crypto/fipsmodule/ec/scalar.c +0 -96
  1127. data/third_party/boringssl/crypto/fipsmodule/ec/simple.c +0 -380
  1128. data/third_party/boringssl/crypto/fipsmodule/ec/simple_mul.c +0 -84
  1129. data/third_party/boringssl/crypto/fipsmodule/ec/wnaf.c +0 -227
  1130. data/third_party/boringssl/crypto/fipsmodule/ecdh/ecdh.c +0 -122
  1131. data/third_party/boringssl/crypto/fipsmodule/ecdsa/ecdsa.c +0 -313
  1132. data/third_party/boringssl/crypto/fipsmodule/modes/gcm.c +0 -877
  1133. data/third_party/boringssl/crypto/fipsmodule/modes/internal.h +0 -451
  1134. data/third_party/boringssl/crypto/fipsmodule/rand/internal.h +0 -127
  1135. data/third_party/boringssl/crypto/fipsmodule/rand/rand.c +0 -363
  1136. data/third_party/boringssl/crypto/fipsmodule/rand/urandom.c +0 -481
  1137. data/third_party/boringssl/crypto/fipsmodule/rsa/blinding.c +0 -239
  1138. data/third_party/boringssl/crypto/fipsmodule/rsa/internal.h +0 -126
  1139. data/third_party/boringssl/crypto/fipsmodule/rsa/rsa.c +0 -879
  1140. data/third_party/boringssl/crypto/fipsmodule/rsa/rsa_impl.c +0 -1335
  1141. data/third_party/boringssl/crypto/fipsmodule/sha/sha512.c +0 -535
  1142. data/third_party/boringssl/crypto/hrss/hrss.c +0 -2201
  1143. data/third_party/boringssl/crypto/hrss/internal.h +0 -62
  1144. data/third_party/boringssl/crypto/internal.h +0 -814
  1145. data/third_party/boringssl/crypto/mem.c +0 -272
  1146. data/third_party/boringssl/crypto/obj/obj.c +0 -554
  1147. data/third_party/boringssl/crypto/obj/obj_dat.h +0 -11550
  1148. data/third_party/boringssl/crypto/pem/pem_info.c +0 -361
  1149. data/third_party/boringssl/crypto/pem/pem_lib.c +0 -777
  1150. data/third_party/boringssl/crypto/pem/pem_oth.c +0 -88
  1151. data/third_party/boringssl/crypto/pem/pem_pk8.c +0 -258
  1152. data/third_party/boringssl/crypto/pem/pem_pkey.c +0 -219
  1153. data/third_party/boringssl/crypto/pkcs7/pkcs7_x509.c +0 -385
  1154. data/third_party/boringssl/crypto/poly1305/poly1305.c +0 -318
  1155. data/third_party/boringssl/crypto/poly1305/poly1305_arm.c +0 -304
  1156. data/third_party/boringssl/crypto/poly1305/poly1305_vec.c +0 -839
  1157. data/third_party/boringssl/crypto/pool/pool.c +0 -221
  1158. data/third_party/boringssl/crypto/rand_extra/deterministic.c +0 -56
  1159. data/third_party/boringssl/crypto/rand_extra/windows.c +0 -53
  1160. data/third_party/boringssl/crypto/siphash/siphash.c +0 -80
  1161. data/third_party/boringssl/crypto/thread_pthread.c +0 -206
  1162. data/third_party/boringssl/crypto/thread_win.c +0 -256
  1163. data/third_party/boringssl/crypto/x509/a_verify.c +0 -115
  1164. data/third_party/boringssl/crypto/x509/by_dir.c +0 -458
  1165. data/third_party/boringssl/crypto/x509/by_file.c +0 -276
  1166. data/third_party/boringssl/crypto/x509/x509_cmp.c +0 -477
  1167. data/third_party/boringssl/crypto/x509/x509_obj.c +0 -198
  1168. data/third_party/boringssl/crypto/x509/x509_r2x.c +0 -117
  1169. data/third_party/boringssl/crypto/x509/x509_req.c +0 -342
  1170. data/third_party/boringssl/crypto/x509/x509_set.c +0 -169
  1171. data/third_party/boringssl/crypto/x509/x509_trs.c +0 -327
  1172. data/third_party/boringssl/crypto/x509/x509_vfy.c +0 -2483
  1173. data/third_party/boringssl/crypto/x509/x509_vpm.c +0 -672
  1174. data/third_party/boringssl/crypto/x509/x509name.c +0 -388
  1175. data/third_party/boringssl/crypto/x509/x_all.c +0 -400
  1176. data/third_party/boringssl/crypto/x509v3/v3_alt.c +0 -629
  1177. data/third_party/boringssl/crypto/x509v3/v3_enum.c +0 -100
  1178. data/third_party/boringssl/crypto/x509v3/v3_info.c +0 -219
  1179. data/third_party/boringssl/crypto/x509v3/v3_purp.c +0 -844
  1180. data/third_party/boringssl/crypto/x509v3/v3_utl.c +0 -1396
  1181. data/third_party/boringssl/include/openssl/base.h +0 -571
  1182. data/third_party/boringssl/include/openssl/bn.h +0 -1045
  1183. data/third_party/boringssl/include/openssl/buf.h +0 -137
  1184. data/third_party/boringssl/include/openssl/bytestring.h +0 -527
  1185. data/third_party/boringssl/include/openssl/crypto.h +0 -144
  1186. data/third_party/boringssl/include/openssl/dh.h +0 -299
  1187. data/third_party/boringssl/include/openssl/digest.h +0 -330
  1188. data/third_party/boringssl/include/openssl/dsa.h +0 -441
  1189. data/third_party/boringssl/include/openssl/ec.h +0 -417
  1190. data/third_party/boringssl/include/openssl/ec_key.h +0 -370
  1191. data/third_party/boringssl/include/openssl/ecdsa.h +0 -199
  1192. data/third_party/boringssl/include/openssl/err.h +0 -461
  1193. data/third_party/boringssl/include/openssl/evp.h +0 -1030
  1194. data/third_party/boringssl/include/openssl/mem.h +0 -160
  1195. data/third_party/boringssl/include/openssl/nid.h +0 -4245
  1196. data/third_party/boringssl/include/openssl/poly1305.h +0 -51
  1197. data/third_party/boringssl/include/openssl/rand.h +0 -125
  1198. data/third_party/boringssl/include/openssl/rsa.h +0 -787
  1199. data/third_party/boringssl/include/openssl/sha.h +0 -268
  1200. data/third_party/boringssl/include/openssl/ssl.h +0 -5113
  1201. data/third_party/boringssl/include/openssl/tls1.h +0 -634
  1202. data/third_party/boringssl/include/openssl/x509.h +0 -1205
  1203. data/third_party/boringssl/include/openssl/x509_vfy.h +0 -680
  1204. data/third_party/boringssl/ssl/d1_both.cc +0 -842
  1205. data/third_party/boringssl/ssl/d1_lib.cc +0 -268
  1206. data/third_party/boringssl/ssl/d1_pkt.cc +0 -274
  1207. data/third_party/boringssl/ssl/dtls_method.cc +0 -192
  1208. data/third_party/boringssl/ssl/handoff.cc +0 -489
  1209. data/third_party/boringssl/ssl/handshake.cc +0 -691
  1210. data/third_party/boringssl/ssl/handshake_client.cc +0 -1871
  1211. data/third_party/boringssl/ssl/handshake_server.cc +0 -1801
  1212. data/third_party/boringssl/ssl/internal.h +0 -3549
  1213. data/third_party/boringssl/ssl/s3_both.cc +0 -724
  1214. data/third_party/boringssl/ssl/s3_lib.cc +0 -222
  1215. data/third_party/boringssl/ssl/s3_pkt.cc +0 -459
  1216. data/third_party/boringssl/ssl/ssl_asn1.cc +0 -828
  1217. data/third_party/boringssl/ssl/ssl_buffer.cc +0 -287
  1218. data/third_party/boringssl/ssl/ssl_cert.cc +0 -1016
  1219. data/third_party/boringssl/ssl/ssl_cipher.cc +0 -1719
  1220. data/third_party/boringssl/ssl/ssl_lib.cc +0 -3011
  1221. data/third_party/boringssl/ssl/ssl_privkey.cc +0 -824
  1222. data/third_party/boringssl/ssl/ssl_session.cc +0 -1273
  1223. data/third_party/boringssl/ssl/ssl_stat.cc +0 -224
  1224. data/third_party/boringssl/ssl/ssl_versions.cc +0 -394
  1225. data/third_party/boringssl/ssl/t1_enc.cc +0 -361
  1226. data/third_party/boringssl/ssl/t1_lib.cc +0 -4036
  1227. data/third_party/boringssl/ssl/tls13_both.cc +0 -689
  1228. data/third_party/boringssl/ssl/tls13_client.cc +0 -947
  1229. data/third_party/boringssl/ssl/tls13_enc.cc +0 -561
  1230. data/third_party/boringssl/ssl/tls13_server.cc +0 -1089
  1231. data/third_party/boringssl/ssl/tls_method.cc +0 -279
  1232. data/third_party/boringssl/ssl/tls_record.cc +0 -698
  1233. data/third_party/boringssl/third_party/fiat/curve25519.c +0 -2167
  1234. data/third_party/boringssl/third_party/fiat/curve25519_32.h +0 -911
  1235. data/third_party/boringssl/third_party/fiat/curve25519_64.h +0 -559
  1236. data/third_party/boringssl/third_party/fiat/curve25519_tables.h +0 -7880
  1237. data/third_party/boringssl/third_party/fiat/internal.h +0 -154
  1238. data/third_party/boringssl/third_party/fiat/p256.c +0 -1063
  1239. data/third_party/boringssl/third_party/fiat/p256_32.h +0 -3226
  1240. data/third_party/boringssl/third_party/fiat/p256_64.h +0 -1217
@@ -0,0 +1,365 @@
1
+ /* Copyright (C) 1995-1998 Eric Young (eay@cryptsoft.com)
2
+ * All rights reserved.
3
+ *
4
+ * This package is an SSL implementation written
5
+ * by Eric Young (eay@cryptsoft.com).
6
+ * The implementation was written so as to conform with Netscapes SSL.
7
+ *
8
+ * This library is free for commercial and non-commercial use as long as
9
+ * the following conditions are aheared to. The following conditions
10
+ * apply to all code found in this distribution, be it the RC4, RSA,
11
+ * lhash, DES, etc., code; not just the SSL code. The SSL documentation
12
+ * included with this distribution is covered by the same copyright terms
13
+ * except that the holder is Tim Hudson (tjh@cryptsoft.com).
14
+ *
15
+ * Copyright remains Eric Young's, and as such any Copyright notices in
16
+ * the code are not to be removed.
17
+ * If this package is used in a product, Eric Young should be given attribution
18
+ * as the author of the parts of the library used.
19
+ * This can be in the form of a textual message at program startup or
20
+ * in documentation (online or textual) provided with the package.
21
+ *
22
+ * Redistribution and use in source and binary forms, with or without
23
+ * modification, are permitted provided that the following conditions
24
+ * are met:
25
+ * 1. Redistributions of source code must retain the copyright
26
+ * notice, this list of conditions and the following disclaimer.
27
+ * 2. Redistributions in binary form must reproduce the above copyright
28
+ * notice, this list of conditions and the following disclaimer in the
29
+ * documentation and/or other materials provided with the distribution.
30
+ * 3. All advertising materials mentioning features or use of this software
31
+ * must display the following acknowledgement:
32
+ * "This product includes cryptographic software written by
33
+ * Eric Young (eay@cryptsoft.com)"
34
+ * The word 'cryptographic' can be left out if the rouines from the library
35
+ * being used are not cryptographic related :-).
36
+ * 4. If you include any Windows specific code (or a derivative thereof) from
37
+ * the apps directory (application code) you must include an acknowledgement:
38
+ * "This product includes software written by Tim Hudson (tjh@cryptsoft.com)"
39
+ *
40
+ * THIS SOFTWARE IS PROVIDED BY ERIC YOUNG ``AS IS'' AND
41
+ * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
42
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
43
+ * ARE DISCLAIMED. IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE
44
+ * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
45
+ * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
46
+ * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
47
+ * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
48
+ * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
49
+ * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
50
+ * SUCH DAMAGE.
51
+ *
52
+ * The licence and distribution terms for any publically available version or
53
+ * derivative of this code cannot be changed. i.e. this code cannot simply be
54
+ * copied and put under another distribution licence
55
+ * [including the GNU Public Licence.]
56
+ */
57
+ /* ====================================================================
58
+ * Copyright (c) 1998-2007 The OpenSSL Project. All rights reserved.
59
+ *
60
+ * Redistribution and use in source and binary forms, with or without
61
+ * modification, are permitted provided that the following conditions
62
+ * are met:
63
+ *
64
+ * 1. Redistributions of source code must retain the above copyright
65
+ * notice, this list of conditions and the following disclaimer.
66
+ *
67
+ * 2. Redistributions in binary form must reproduce the above copyright
68
+ * notice, this list of conditions and the following disclaimer in
69
+ * the documentation and/or other materials provided with the
70
+ * distribution.
71
+ *
72
+ * 3. All advertising materials mentioning features or use of this
73
+ * software must display the following acknowledgment:
74
+ * "This product includes software developed by the OpenSSL Project
75
+ * for use in the OpenSSL Toolkit. (http://www.openssl.org/)"
76
+ *
77
+ * 4. The names "OpenSSL Toolkit" and "OpenSSL Project" must not be used to
78
+ * endorse or promote products derived from this software without
79
+ * prior written permission. For written permission, please contact
80
+ * openssl-core@openssl.org.
81
+ *
82
+ * 5. Products derived from this software may not be called "OpenSSL"
83
+ * nor may "OpenSSL" appear in their names without prior written
84
+ * permission of the OpenSSL Project.
85
+ *
86
+ * 6. Redistributions of any form whatsoever must retain the following
87
+ * acknowledgment:
88
+ * "This product includes software developed by the OpenSSL Project
89
+ * for use in the OpenSSL Toolkit (http://www.openssl.org/)"
90
+ *
91
+ * THIS SOFTWARE IS PROVIDED BY THE OpenSSL PROJECT ``AS IS'' AND ANY
92
+ * EXPRESSED OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
93
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
94
+ * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE OpenSSL PROJECT OR
95
+ * ITS CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
96
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
97
+ * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
98
+ * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
99
+ * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT,
100
+ * STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
101
+ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED
102
+ * OF THE POSSIBILITY OF SUCH DAMAGE.
103
+ * ====================================================================
104
+ *
105
+ * This product includes cryptographic software written by Eric Young
106
+ * (eay@cryptsoft.com). This product includes software written by Tim
107
+ * Hudson (tjh@cryptsoft.com).
108
+ *
109
+ */
110
+ /* ====================================================================
111
+ * Copyright 2005 Nokia. All rights reserved.
112
+ *
113
+ * The portions of the attached software ("Contribution") is developed by
114
+ * Nokia Corporation and is licensed pursuant to the OpenSSL open source
115
+ * license.
116
+ *
117
+ * The Contribution, originally written by Mika Kousa and Pasi Eronen of
118
+ * Nokia Corporation, consists of the "PSK" (Pre-Shared Key) ciphersuites
119
+ * support (see RFC 4279) to OpenSSL.
120
+ *
121
+ * No patent licenses or other rights except those expressly stated in
122
+ * the OpenSSL open source license shall be deemed granted or received
123
+ * expressly, by implication, estoppel, or otherwise.
124
+ *
125
+ * No assurances are provided by Nokia that the Contribution does not
126
+ * infringe the patent or other intellectual property rights of any third
127
+ * party or that the license provides you with all the necessary rights
128
+ * to make use of the Contribution.
129
+ *
130
+ * THE SOFTWARE IS PROVIDED "AS IS" WITHOUT WARRANTY OF ANY KIND. IN
131
+ * ADDITION TO THE DISCLAIMERS INCLUDED IN THE LICENSE, NOKIA
132
+ * SPECIFICALLY DISCLAIMS ANY LIABILITY FOR CLAIMS BROUGHT BY YOU OR ANY
133
+ * OTHER ENTITY BASED ON INFRINGEMENT OF INTELLECTUAL PROPERTY RIGHTS OR
134
+ * OTHERWISE. */
135
+
136
+ #include <openssl/ssl.h>
137
+
138
+ #include <assert.h>
139
+ #include <string.h>
140
+
141
+ #include <utility>
142
+
143
+ #include <openssl/err.h>
144
+ #include <openssl/evp.h>
145
+ #include <openssl/hmac.h>
146
+ #include <openssl/md5.h>
147
+ #include <openssl/mem.h>
148
+ #include <openssl/nid.h>
149
+ #include <openssl/rand.h>
150
+
151
+ #include "../crypto/fipsmodule/tls/internal.h"
152
+ #include "../crypto/internal.h"
153
+ #include "internal.h"
154
+
155
+
156
+ BSSL_NAMESPACE_BEGIN
157
+
158
+ bool tls1_prf(const EVP_MD *digest, Span<uint8_t> out,
159
+ Span<const uint8_t> secret, Span<const char> label,
160
+ Span<const uint8_t> seed1, Span<const uint8_t> seed2) {
161
+ return 1 == CRYPTO_tls1_prf(digest, out.data(), out.size(), secret.data(),
162
+ secret.size(), label.data(), label.size(),
163
+ seed1.data(), seed1.size(), seed2.data(),
164
+ seed2.size());
165
+ }
166
+
167
+ static bool get_key_block_lengths(const SSL *ssl, size_t *out_mac_secret_len,
168
+ size_t *out_key_len, size_t *out_iv_len,
169
+ const SSL_CIPHER *cipher) {
170
+ const EVP_AEAD *aead = NULL;
171
+ if (!ssl_cipher_get_evp_aead(&aead, out_mac_secret_len, out_iv_len, cipher,
172
+ ssl_protocol_version(ssl), SSL_is_dtls(ssl))) {
173
+ OPENSSL_PUT_ERROR(SSL, SSL_R_CIPHER_OR_HASH_UNAVAILABLE);
174
+ return false;
175
+ }
176
+
177
+ *out_key_len = EVP_AEAD_key_length(aead);
178
+ if (*out_mac_secret_len > 0) {
179
+ // For "stateful" AEADs (i.e. compatibility with pre-AEAD cipher suites) the
180
+ // key length reported by |EVP_AEAD_key_length| will include the MAC key
181
+ // bytes and initial implicit IV.
182
+ if (*out_key_len < *out_mac_secret_len + *out_iv_len) {
183
+ OPENSSL_PUT_ERROR(SSL, ERR_R_INTERNAL_ERROR);
184
+ return false;
185
+ }
186
+ *out_key_len -= *out_mac_secret_len + *out_iv_len;
187
+ }
188
+
189
+ return true;
190
+ }
191
+
192
+ int tls1_configure_aead(SSL *ssl, evp_aead_direction_t direction,
193
+ Array<uint8_t> *key_block_cache,
194
+ const SSL_CIPHER *cipher,
195
+ Span<const uint8_t> iv_override) {
196
+ size_t mac_secret_len, key_len, iv_len;
197
+ if (!get_key_block_lengths(ssl, &mac_secret_len, &key_len, &iv_len, cipher)) {
198
+ return 0;
199
+ }
200
+
201
+ // Ensure that |key_block_cache| is set up.
202
+ const size_t key_block_size = 2 * (mac_secret_len + key_len + iv_len);
203
+ if (key_block_cache->empty()) {
204
+ if (!key_block_cache->Init(key_block_size) ||
205
+ !SSL_generate_key_block(ssl, key_block_cache->data(), key_block_size)) {
206
+ return 0;
207
+ }
208
+ }
209
+ assert(key_block_cache->size() == key_block_size);
210
+
211
+ Span<const uint8_t> key_block = *key_block_cache;
212
+ Span<const uint8_t> mac_secret, key, iv;
213
+ if (direction == (ssl->server ? evp_aead_open : evp_aead_seal)) {
214
+ // Use the client write (server read) keys.
215
+ mac_secret = key_block.subspan(0, mac_secret_len);
216
+ key = key_block.subspan(2 * mac_secret_len, key_len);
217
+ iv = key_block.subspan(2 * mac_secret_len + 2 * key_len, iv_len);
218
+ } else {
219
+ // Use the server write (client read) keys.
220
+ mac_secret = key_block.subspan(mac_secret_len, mac_secret_len);
221
+ key = key_block.subspan(2 * mac_secret_len + key_len, key_len);
222
+ iv = key_block.subspan(2 * mac_secret_len + 2 * key_len + iv_len, iv_len);
223
+ }
224
+
225
+ if (!iv_override.empty()) {
226
+ if (iv_override.size() != iv_len) {
227
+ return 0;
228
+ }
229
+ iv = iv_override;
230
+ }
231
+
232
+ UniquePtr<SSLAEADContext> aead_ctx = SSLAEADContext::Create(
233
+ direction, ssl->version, SSL_is_dtls(ssl), cipher, key, mac_secret, iv);
234
+ if (!aead_ctx) {
235
+ return 0;
236
+ }
237
+
238
+ if (direction == evp_aead_open) {
239
+ return ssl->method->set_read_state(ssl, ssl_encryption_application,
240
+ std::move(aead_ctx),
241
+ /*secret_for_quic=*/{});
242
+ }
243
+
244
+ return ssl->method->set_write_state(ssl, ssl_encryption_application,
245
+ std::move(aead_ctx),
246
+ /*secret_for_quic=*/{});
247
+ }
248
+
249
+ int tls1_change_cipher_state(SSL_HANDSHAKE *hs,
250
+ evp_aead_direction_t direction) {
251
+ return tls1_configure_aead(hs->ssl, direction, &hs->key_block,
252
+ hs->new_cipher, {});
253
+ }
254
+
255
+ int tls1_generate_master_secret(SSL_HANDSHAKE *hs, uint8_t *out,
256
+ Span<const uint8_t> premaster) {
257
+ static const char kMasterSecretLabel[] = "master secret";
258
+ static const char kExtendedMasterSecretLabel[] = "extended master secret";
259
+
260
+ const SSL *ssl = hs->ssl;
261
+ auto out_span = MakeSpan(out, SSL3_MASTER_SECRET_SIZE);
262
+ if (hs->extended_master_secret) {
263
+ auto label = MakeConstSpan(kExtendedMasterSecretLabel,
264
+ sizeof(kExtendedMasterSecretLabel) - 1);
265
+ uint8_t digests[EVP_MAX_MD_SIZE];
266
+ size_t digests_len;
267
+ if (!hs->transcript.GetHash(digests, &digests_len) ||
268
+ !tls1_prf(hs->transcript.Digest(), out_span, premaster, label,
269
+ MakeConstSpan(digests, digests_len), {})) {
270
+ return 0;
271
+ }
272
+ } else {
273
+ auto label =
274
+ MakeConstSpan(kMasterSecretLabel, sizeof(kMasterSecretLabel) - 1);
275
+ if (!tls1_prf(hs->transcript.Digest(), out_span, premaster, label,
276
+ ssl->s3->client_random, ssl->s3->server_random)) {
277
+ return 0;
278
+ }
279
+ }
280
+
281
+ return SSL3_MASTER_SECRET_SIZE;
282
+ }
283
+
284
+ BSSL_NAMESPACE_END
285
+
286
+ using namespace bssl;
287
+
288
+ size_t SSL_get_key_block_len(const SSL *ssl) {
289
+ size_t mac_secret_len, key_len, fixed_iv_len;
290
+ if (!get_key_block_lengths(ssl, &mac_secret_len, &key_len, &fixed_iv_len,
291
+ SSL_get_current_cipher(ssl))) {
292
+ ERR_clear_error();
293
+ return 0;
294
+ }
295
+
296
+ return 2 * (mac_secret_len + key_len + fixed_iv_len);
297
+ }
298
+
299
+ int SSL_generate_key_block(const SSL *ssl, uint8_t *out, size_t out_len) {
300
+ const SSL_SESSION *session = SSL_get_session(ssl);
301
+ auto out_span = MakeSpan(out, out_len);
302
+ auto master_key =
303
+ MakeConstSpan(session->master_key, session->master_key_length);
304
+ static const char kLabel[] = "key expansion";
305
+ auto label = MakeConstSpan(kLabel, sizeof(kLabel) - 1);
306
+
307
+ const EVP_MD *digest = ssl_session_get_digest(session);
308
+ return tls1_prf(digest, out_span, master_key, label, ssl->s3->server_random,
309
+ ssl->s3->client_random);
310
+ }
311
+
312
+ int SSL_export_keying_material(SSL *ssl, uint8_t *out, size_t out_len,
313
+ const char *label, size_t label_len,
314
+ const uint8_t *context, size_t context_len,
315
+ int use_context) {
316
+ // Exporters may be used in False Start and server 0-RTT, where the handshake
317
+ // has progressed enough. Otherwise, they may not be used during a handshake.
318
+ if (SSL_in_init(ssl) &&
319
+ !SSL_in_false_start(ssl) &&
320
+ !(SSL_is_server(ssl) && SSL_in_early_data(ssl))) {
321
+ OPENSSL_PUT_ERROR(SSL, SSL_R_HANDSHAKE_NOT_COMPLETE);
322
+ return 0;
323
+ }
324
+
325
+ if (ssl_protocol_version(ssl) >= TLS1_3_VERSION) {
326
+ if (!use_context) {
327
+ context = nullptr;
328
+ context_len = 0;
329
+ }
330
+ return tls13_export_keying_material(
331
+ ssl, MakeSpan(out, out_len),
332
+ MakeConstSpan(ssl->s3->exporter_secret, ssl->s3->exporter_secret_len),
333
+ MakeConstSpan(label, label_len), MakeConstSpan(context, context_len));
334
+ }
335
+
336
+ size_t seed_len = 2 * SSL3_RANDOM_SIZE;
337
+ if (use_context) {
338
+ if (context_len >= 1u << 16) {
339
+ OPENSSL_PUT_ERROR(SSL, ERR_R_OVERFLOW);
340
+ return 0;
341
+ }
342
+ seed_len += 2 + context_len;
343
+ }
344
+ Array<uint8_t> seed;
345
+ if (!seed.Init(seed_len)) {
346
+ OPENSSL_PUT_ERROR(SSL, ERR_R_MALLOC_FAILURE);
347
+ return 0;
348
+ }
349
+
350
+ OPENSSL_memcpy(seed.data(), ssl->s3->client_random, SSL3_RANDOM_SIZE);
351
+ OPENSSL_memcpy(seed.data() + SSL3_RANDOM_SIZE, ssl->s3->server_random,
352
+ SSL3_RANDOM_SIZE);
353
+ if (use_context) {
354
+ seed[2 * SSL3_RANDOM_SIZE] = static_cast<uint8_t>(context_len >> 8);
355
+ seed[2 * SSL3_RANDOM_SIZE + 1] = static_cast<uint8_t>(context_len);
356
+ OPENSSL_memcpy(seed.data() + 2 * SSL3_RANDOM_SIZE + 2, context, context_len);
357
+ }
358
+
359
+ const SSL_SESSION *session = SSL_get_session(ssl);
360
+ const EVP_MD *digest = ssl_session_get_digest(session);
361
+ return tls1_prf(
362
+ digest, MakeSpan(out, out_len),
363
+ MakeConstSpan(session->master_key, session->master_key_length),
364
+ MakeConstSpan(label, label_len), seed, {});
365
+ }
@@ -0,0 +1,3870 @@
1
+ /* Copyright (C) 1995-1998 Eric Young (eay@cryptsoft.com)
2
+ * All rights reserved.
3
+ *
4
+ * This package is an SSL implementation written
5
+ * by Eric Young (eay@cryptsoft.com).
6
+ * The implementation was written so as to conform with Netscapes SSL.
7
+ *
8
+ * This library is free for commercial and non-commercial use as long as
9
+ * the following conditions are aheared to. The following conditions
10
+ * apply to all code found in this distribution, be it the RC4, RSA,
11
+ * lhash, DES, etc., code; not just the SSL code. The SSL documentation
12
+ * included with this distribution is covered by the same copyright terms
13
+ * except that the holder is Tim Hudson (tjh@cryptsoft.com).
14
+ *
15
+ * Copyright remains Eric Young's, and as such any Copyright notices in
16
+ * the code are not to be removed.
17
+ * If this package is used in a product, Eric Young should be given attribution
18
+ * as the author of the parts of the library used.
19
+ * This can be in the form of a textual message at program startup or
20
+ * in documentation (online or textual) provided with the package.
21
+ *
22
+ * Redistribution and use in source and binary forms, with or without
23
+ * modification, are permitted provided that the following conditions
24
+ * are met:
25
+ * 1. Redistributions of source code must retain the copyright
26
+ * notice, this list of conditions and the following disclaimer.
27
+ * 2. Redistributions in binary form must reproduce the above copyright
28
+ * notice, this list of conditions and the following disclaimer in the
29
+ * documentation and/or other materials provided with the distribution.
30
+ * 3. All advertising materials mentioning features or use of this software
31
+ * must display the following acknowledgement:
32
+ * "This product includes cryptographic software written by
33
+ * Eric Young (eay@cryptsoft.com)"
34
+ * The word 'cryptographic' can be left out if the rouines from the library
35
+ * being used are not cryptographic related :-).
36
+ * 4. If you include any Windows specific code (or a derivative thereof) from
37
+ * the apps directory (application code) you must include an acknowledgement:
38
+ * "This product includes software written by Tim Hudson (tjh@cryptsoft.com)"
39
+ *
40
+ * THIS SOFTWARE IS PROVIDED BY ERIC YOUNG ``AS IS'' AND
41
+ * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
42
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
43
+ * ARE DISCLAIMED. IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE
44
+ * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
45
+ * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
46
+ * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
47
+ * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
48
+ * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
49
+ * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
50
+ * SUCH DAMAGE.
51
+ *
52
+ * The licence and distribution terms for any publically available version or
53
+ * derivative of this code cannot be changed. i.e. this code cannot simply be
54
+ * copied and put under another distribution licence
55
+ * [including the GNU Public Licence.]
56
+ */
57
+ /* ====================================================================
58
+ * Copyright (c) 1998-2007 The OpenSSL Project. All rights reserved.
59
+ *
60
+ * Redistribution and use in source and binary forms, with or without
61
+ * modification, are permitted provided that the following conditions
62
+ * are met:
63
+ *
64
+ * 1. Redistributions of source code must retain the above copyright
65
+ * notice, this list of conditions and the following disclaimer.
66
+ *
67
+ * 2. Redistributions in binary form must reproduce the above copyright
68
+ * notice, this list of conditions and the following disclaimer in
69
+ * the documentation and/or other materials provided with the
70
+ * distribution.
71
+ *
72
+ * 3. All advertising materials mentioning features or use of this
73
+ * software must display the following acknowledgment:
74
+ * "This product includes software developed by the OpenSSL Project
75
+ * for use in the OpenSSL Toolkit. (http://www.openssl.org/)"
76
+ *
77
+ * 4. The names "OpenSSL Toolkit" and "OpenSSL Project" must not be used to
78
+ * endorse or promote products derived from this software without
79
+ * prior written permission. For written permission, please contact
80
+ * openssl-core@openssl.org.
81
+ *
82
+ * 5. Products derived from this software may not be called "OpenSSL"
83
+ * nor may "OpenSSL" appear in their names without prior written
84
+ * permission of the OpenSSL Project.
85
+ *
86
+ * 6. Redistributions of any form whatsoever must retain the following
87
+ * acknowledgment:
88
+ * "This product includes software developed by the OpenSSL Project
89
+ * for use in the OpenSSL Toolkit (http://www.openssl.org/)"
90
+ *
91
+ * THIS SOFTWARE IS PROVIDED BY THE OpenSSL PROJECT ``AS IS'' AND ANY
92
+ * EXPRESSED OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
93
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
94
+ * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE OpenSSL PROJECT OR
95
+ * ITS CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
96
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
97
+ * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
98
+ * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
99
+ * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT,
100
+ * STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
101
+ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED
102
+ * OF THE POSSIBILITY OF SUCH DAMAGE.
103
+ * ====================================================================
104
+ *
105
+ * This product includes cryptographic software written by Eric Young
106
+ * (eay@cryptsoft.com). This product includes software written by Tim
107
+ * Hudson (tjh@cryptsoft.com). */
108
+
109
+ #include <openssl/ssl.h>
110
+
111
+ #include <assert.h>
112
+ #include <limits.h>
113
+ #include <stdlib.h>
114
+ #include <string.h>
115
+
116
+ #include <utility>
117
+
118
+ #include <openssl/bytestring.h>
119
+ #include <openssl/chacha.h>
120
+ #include <openssl/digest.h>
121
+ #include <openssl/err.h>
122
+ #include <openssl/evp.h>
123
+ #include <openssl/hmac.h>
124
+ #include <openssl/mem.h>
125
+ #include <openssl/nid.h>
126
+ #include <openssl/rand.h>
127
+
128
+ #include "internal.h"
129
+ #include "../crypto/internal.h"
130
+
131
+
132
+ BSSL_NAMESPACE_BEGIN
133
+
134
+ static bool ssl_check_clienthello_tlsext(SSL_HANDSHAKE *hs);
135
+
136
+ static int compare_uint16_t(const void *p1, const void *p2) {
137
+ uint16_t u1 = *((const uint16_t *)p1);
138
+ uint16_t u2 = *((const uint16_t *)p2);
139
+ if (u1 < u2) {
140
+ return -1;
141
+ } else if (u1 > u2) {
142
+ return 1;
143
+ } else {
144
+ return 0;
145
+ }
146
+ }
147
+
148
+ // Per http://tools.ietf.org/html/rfc5246#section-7.4.1.4, there may not be
149
+ // more than one extension of the same type in a ClientHello or ServerHello.
150
+ // This function does an initial scan over the extensions block to filter those
151
+ // out.
152
+ static bool tls1_check_duplicate_extensions(const CBS *cbs) {
153
+ // First pass: count the extensions.
154
+ size_t num_extensions = 0;
155
+ CBS extensions = *cbs;
156
+ while (CBS_len(&extensions) > 0) {
157
+ uint16_t type;
158
+ CBS extension;
159
+
160
+ if (!CBS_get_u16(&extensions, &type) ||
161
+ !CBS_get_u16_length_prefixed(&extensions, &extension)) {
162
+ return false;
163
+ }
164
+
165
+ num_extensions++;
166
+ }
167
+
168
+ if (num_extensions == 0) {
169
+ return true;
170
+ }
171
+
172
+ Array<uint16_t> extension_types;
173
+ if (!extension_types.Init(num_extensions)) {
174
+ return false;
175
+ }
176
+
177
+ // Second pass: gather the extension types.
178
+ extensions = *cbs;
179
+ for (size_t i = 0; i < extension_types.size(); i++) {
180
+ CBS extension;
181
+
182
+ if (!CBS_get_u16(&extensions, &extension_types[i]) ||
183
+ !CBS_get_u16_length_prefixed(&extensions, &extension)) {
184
+ // This should not happen.
185
+ return false;
186
+ }
187
+ }
188
+ assert(CBS_len(&extensions) == 0);
189
+
190
+ // Sort the extensions and make sure there are no duplicates.
191
+ qsort(extension_types.data(), extension_types.size(), sizeof(uint16_t),
192
+ compare_uint16_t);
193
+ for (size_t i = 1; i < num_extensions; i++) {
194
+ if (extension_types[i - 1] == extension_types[i]) {
195
+ return false;
196
+ }
197
+ }
198
+
199
+ return true;
200
+ }
201
+
202
+ static bool is_post_quantum_group(uint16_t id) {
203
+ return id == SSL_CURVE_CECPQ2;
204
+ }
205
+
206
+ bool ssl_client_hello_init(const SSL *ssl, SSL_CLIENT_HELLO *out,
207
+ const SSLMessage &msg) {
208
+ OPENSSL_memset(out, 0, sizeof(*out));
209
+ out->ssl = const_cast<SSL *>(ssl);
210
+ out->client_hello = CBS_data(&msg.body);
211
+ out->client_hello_len = CBS_len(&msg.body);
212
+
213
+ CBS client_hello, random, session_id;
214
+ CBS_init(&client_hello, out->client_hello, out->client_hello_len);
215
+ if (!CBS_get_u16(&client_hello, &out->version) ||
216
+ !CBS_get_bytes(&client_hello, &random, SSL3_RANDOM_SIZE) ||
217
+ !CBS_get_u8_length_prefixed(&client_hello, &session_id) ||
218
+ CBS_len(&session_id) > SSL_MAX_SSL_SESSION_ID_LENGTH) {
219
+ return false;
220
+ }
221
+
222
+ out->random = CBS_data(&random);
223
+ out->random_len = CBS_len(&random);
224
+ out->session_id = CBS_data(&session_id);
225
+ out->session_id_len = CBS_len(&session_id);
226
+
227
+ // Skip past DTLS cookie
228
+ if (SSL_is_dtls(out->ssl)) {
229
+ CBS cookie;
230
+ if (!CBS_get_u8_length_prefixed(&client_hello, &cookie) ||
231
+ CBS_len(&cookie) > DTLS1_COOKIE_LENGTH) {
232
+ return false;
233
+ }
234
+ }
235
+
236
+ CBS cipher_suites, compression_methods;
237
+ if (!CBS_get_u16_length_prefixed(&client_hello, &cipher_suites) ||
238
+ CBS_len(&cipher_suites) < 2 || (CBS_len(&cipher_suites) & 1) != 0 ||
239
+ !CBS_get_u8_length_prefixed(&client_hello, &compression_methods) ||
240
+ CBS_len(&compression_methods) < 1) {
241
+ return false;
242
+ }
243
+
244
+ out->cipher_suites = CBS_data(&cipher_suites);
245
+ out->cipher_suites_len = CBS_len(&cipher_suites);
246
+ out->compression_methods = CBS_data(&compression_methods);
247
+ out->compression_methods_len = CBS_len(&compression_methods);
248
+
249
+ // If the ClientHello ends here then it's valid, but doesn't have any
250
+ // extensions.
251
+ if (CBS_len(&client_hello) == 0) {
252
+ out->extensions = NULL;
253
+ out->extensions_len = 0;
254
+ return true;
255
+ }
256
+
257
+ // Extract extensions and check it is valid.
258
+ CBS extensions;
259
+ if (!CBS_get_u16_length_prefixed(&client_hello, &extensions) ||
260
+ !tls1_check_duplicate_extensions(&extensions) ||
261
+ CBS_len(&client_hello) != 0) {
262
+ return false;
263
+ }
264
+
265
+ out->extensions = CBS_data(&extensions);
266
+ out->extensions_len = CBS_len(&extensions);
267
+
268
+ return true;
269
+ }
270
+
271
+ bool ssl_client_hello_get_extension(const SSL_CLIENT_HELLO *client_hello,
272
+ CBS *out, uint16_t extension_type) {
273
+ CBS extensions;
274
+ CBS_init(&extensions, client_hello->extensions, client_hello->extensions_len);
275
+ while (CBS_len(&extensions) != 0) {
276
+ // Decode the next extension.
277
+ uint16_t type;
278
+ CBS extension;
279
+ if (!CBS_get_u16(&extensions, &type) ||
280
+ !CBS_get_u16_length_prefixed(&extensions, &extension)) {
281
+ return false;
282
+ }
283
+
284
+ if (type == extension_type) {
285
+ *out = extension;
286
+ return true;
287
+ }
288
+ }
289
+
290
+ return false;
291
+ }
292
+
293
+ static const uint16_t kDefaultGroups[] = {
294
+ SSL_CURVE_X25519,
295
+ SSL_CURVE_SECP256R1,
296
+ SSL_CURVE_SECP384R1,
297
+ };
298
+
299
+ Span<const uint16_t> tls1_get_grouplist(const SSL_HANDSHAKE *hs) {
300
+ if (!hs->config->supported_group_list.empty()) {
301
+ return hs->config->supported_group_list;
302
+ }
303
+ return Span<const uint16_t>(kDefaultGroups);
304
+ }
305
+
306
+ bool tls1_get_shared_group(SSL_HANDSHAKE *hs, uint16_t *out_group_id) {
307
+ SSL *const ssl = hs->ssl;
308
+ assert(ssl->server);
309
+
310
+ // Clients are not required to send a supported_groups extension. In this
311
+ // case, the server is free to pick any group it likes. See RFC 4492,
312
+ // section 4, paragraph 3.
313
+ //
314
+ // However, in the interests of compatibility, we will skip ECDH if the
315
+ // client didn't send an extension because we can't be sure that they'll
316
+ // support our favoured group. Thus we do not special-case an emtpy
317
+ // |peer_supported_group_list|.
318
+
319
+ Span<const uint16_t> groups = tls1_get_grouplist(hs);
320
+ Span<const uint16_t> pref, supp;
321
+ if (ssl->options & SSL_OP_CIPHER_SERVER_PREFERENCE) {
322
+ pref = groups;
323
+ supp = hs->peer_supported_group_list;
324
+ } else {
325
+ pref = hs->peer_supported_group_list;
326
+ supp = groups;
327
+ }
328
+
329
+ for (uint16_t pref_group : pref) {
330
+ for (uint16_t supp_group : supp) {
331
+ if (pref_group == supp_group &&
332
+ // CECPQ2(b) doesn't fit in the u8-length-prefixed ECPoint field in
333
+ // TLS 1.2 and below.
334
+ (ssl_protocol_version(ssl) >= TLS1_3_VERSION ||
335
+ !is_post_quantum_group(pref_group))) {
336
+ *out_group_id = pref_group;
337
+ return true;
338
+ }
339
+ }
340
+ }
341
+
342
+ return false;
343
+ }
344
+
345
+ bool tls1_set_curves(Array<uint16_t> *out_group_ids, Span<const int> curves) {
346
+ Array<uint16_t> group_ids;
347
+ if (!group_ids.Init(curves.size())) {
348
+ return false;
349
+ }
350
+
351
+ for (size_t i = 0; i < curves.size(); i++) {
352
+ if (!ssl_nid_to_group_id(&group_ids[i], curves[i])) {
353
+ return false;
354
+ }
355
+ }
356
+
357
+ *out_group_ids = std::move(group_ids);
358
+ return true;
359
+ }
360
+
361
+ bool tls1_set_curves_list(Array<uint16_t> *out_group_ids, const char *curves) {
362
+ // Count the number of curves in the list.
363
+ size_t count = 0;
364
+ const char *ptr = curves, *col;
365
+ do {
366
+ col = strchr(ptr, ':');
367
+ count++;
368
+ if (col) {
369
+ ptr = col + 1;
370
+ }
371
+ } while (col);
372
+
373
+ Array<uint16_t> group_ids;
374
+ if (!group_ids.Init(count)) {
375
+ return false;
376
+ }
377
+
378
+ size_t i = 0;
379
+ ptr = curves;
380
+ do {
381
+ col = strchr(ptr, ':');
382
+ if (!ssl_name_to_group_id(&group_ids[i++], ptr,
383
+ col ? (size_t)(col - ptr) : strlen(ptr))) {
384
+ return false;
385
+ }
386
+ if (col) {
387
+ ptr = col + 1;
388
+ }
389
+ } while (col);
390
+
391
+ assert(i == count);
392
+ *out_group_ids = std::move(group_ids);
393
+ return true;
394
+ }
395
+
396
+ bool tls1_check_group_id(const SSL_HANDSHAKE *hs, uint16_t group_id) {
397
+ if (is_post_quantum_group(group_id) &&
398
+ ssl_protocol_version(hs->ssl) < TLS1_3_VERSION) {
399
+ // CECPQ2(b) requires TLS 1.3.
400
+ return false;
401
+ }
402
+
403
+ for (uint16_t supported : tls1_get_grouplist(hs)) {
404
+ if (supported == group_id) {
405
+ return true;
406
+ }
407
+ }
408
+
409
+ return false;
410
+ }
411
+
412
+ // kVerifySignatureAlgorithms is the default list of accepted signature
413
+ // algorithms for verifying.
414
+ static const uint16_t kVerifySignatureAlgorithms[] = {
415
+ // List our preferred algorithms first.
416
+ SSL_SIGN_ECDSA_SECP256R1_SHA256,
417
+ SSL_SIGN_RSA_PSS_RSAE_SHA256,
418
+ SSL_SIGN_RSA_PKCS1_SHA256,
419
+
420
+ // Larger hashes are acceptable.
421
+ SSL_SIGN_ECDSA_SECP384R1_SHA384,
422
+ SSL_SIGN_RSA_PSS_RSAE_SHA384,
423
+ SSL_SIGN_RSA_PKCS1_SHA384,
424
+
425
+ SSL_SIGN_RSA_PSS_RSAE_SHA512,
426
+ SSL_SIGN_RSA_PKCS1_SHA512,
427
+
428
+ // For now, SHA-1 is still accepted but least preferable.
429
+ SSL_SIGN_RSA_PKCS1_SHA1,
430
+ };
431
+
432
+ // kSignSignatureAlgorithms is the default list of supported signature
433
+ // algorithms for signing.
434
+ static const uint16_t kSignSignatureAlgorithms[] = {
435
+ // List our preferred algorithms first.
436
+ SSL_SIGN_ED25519,
437
+ SSL_SIGN_ECDSA_SECP256R1_SHA256,
438
+ SSL_SIGN_RSA_PSS_RSAE_SHA256,
439
+ SSL_SIGN_RSA_PKCS1_SHA256,
440
+
441
+ // If needed, sign larger hashes.
442
+ //
443
+ // TODO(davidben): Determine which of these may be pruned.
444
+ SSL_SIGN_ECDSA_SECP384R1_SHA384,
445
+ SSL_SIGN_RSA_PSS_RSAE_SHA384,
446
+ SSL_SIGN_RSA_PKCS1_SHA384,
447
+
448
+ SSL_SIGN_ECDSA_SECP521R1_SHA512,
449
+ SSL_SIGN_RSA_PSS_RSAE_SHA512,
450
+ SSL_SIGN_RSA_PKCS1_SHA512,
451
+
452
+ // If the peer supports nothing else, sign with SHA-1.
453
+ SSL_SIGN_ECDSA_SHA1,
454
+ SSL_SIGN_RSA_PKCS1_SHA1,
455
+ };
456
+
457
+ static Span<const uint16_t> tls12_get_verify_sigalgs(const SSL_HANDSHAKE *hs) {
458
+ if (hs->config->verify_sigalgs.empty()) {
459
+ return Span<const uint16_t>(kVerifySignatureAlgorithms);
460
+ }
461
+ return hs->config->verify_sigalgs;
462
+ }
463
+
464
+ bool tls12_add_verify_sigalgs(const SSL_HANDSHAKE *hs, CBB *out) {
465
+ for (uint16_t sigalg : tls12_get_verify_sigalgs(hs)) {
466
+ if (!CBB_add_u16(out, sigalg)) {
467
+ return false;
468
+ }
469
+ }
470
+ return true;
471
+ }
472
+
473
+ bool tls12_check_peer_sigalg(const SSL_HANDSHAKE *hs, uint8_t *out_alert,
474
+ uint16_t sigalg) {
475
+ for (uint16_t verify_sigalg : tls12_get_verify_sigalgs(hs)) {
476
+ if (verify_sigalg == sigalg) {
477
+ return true;
478
+ }
479
+ }
480
+
481
+ OPENSSL_PUT_ERROR(SSL, SSL_R_WRONG_SIGNATURE_TYPE);
482
+ *out_alert = SSL_AD_ILLEGAL_PARAMETER;
483
+ return false;
484
+ }
485
+
486
+ // tls_extension represents a TLS extension that is handled internally. The
487
+ // |init| function is called for each handshake, before any other functions of
488
+ // the extension. Then the add and parse callbacks are called as needed.
489
+ //
490
+ // The parse callbacks receive a |CBS| that contains the contents of the
491
+ // extension (i.e. not including the type and length bytes). If an extension is
492
+ // not received then the parse callbacks will be called with a NULL CBS so that
493
+ // they can do any processing needed to handle the absence of an extension.
494
+ //
495
+ // The add callbacks receive a |CBB| to which the extension can be appended but
496
+ // the function is responsible for appending the type and length bytes too.
497
+ //
498
+ // All callbacks return true for success and false for error. If a parse
499
+ // function returns zero then a fatal alert with value |*out_alert| will be
500
+ // sent. If |*out_alert| isn't set, then a |decode_error| alert will be sent.
501
+ struct tls_extension {
502
+ uint16_t value;
503
+ void (*init)(SSL_HANDSHAKE *hs);
504
+
505
+ bool (*add_clienthello)(SSL_HANDSHAKE *hs, CBB *out);
506
+ bool (*parse_serverhello)(SSL_HANDSHAKE *hs, uint8_t *out_alert,
507
+ CBS *contents);
508
+
509
+ bool (*parse_clienthello)(SSL_HANDSHAKE *hs, uint8_t *out_alert,
510
+ CBS *contents);
511
+ bool (*add_serverhello)(SSL_HANDSHAKE *hs, CBB *out);
512
+ };
513
+
514
+ static bool forbid_parse_serverhello(SSL_HANDSHAKE *hs, uint8_t *out_alert,
515
+ CBS *contents) {
516
+ if (contents != NULL) {
517
+ // Servers MUST NOT send this extension.
518
+ *out_alert = SSL_AD_UNSUPPORTED_EXTENSION;
519
+ OPENSSL_PUT_ERROR(SSL, SSL_R_UNEXPECTED_EXTENSION);
520
+ return false;
521
+ }
522
+
523
+ return true;
524
+ }
525
+
526
+ static bool ignore_parse_clienthello(SSL_HANDSHAKE *hs, uint8_t *out_alert,
527
+ CBS *contents) {
528
+ // This extension from the client is handled elsewhere.
529
+ return true;
530
+ }
531
+
532
+ static bool dont_add_serverhello(SSL_HANDSHAKE *hs, CBB *out) {
533
+ return true;
534
+ }
535
+
536
+ // Server name indication (SNI).
537
+ //
538
+ // https://tools.ietf.org/html/rfc6066#section-3.
539
+
540
+ static bool ext_sni_add_clienthello(SSL_HANDSHAKE *hs, CBB *out) {
541
+ SSL *const ssl = hs->ssl;
542
+ if (ssl->hostname == nullptr) {
543
+ return true;
544
+ }
545
+
546
+ CBB contents, server_name_list, name;
547
+ if (!CBB_add_u16(out, TLSEXT_TYPE_server_name) ||
548
+ !CBB_add_u16_length_prefixed(out, &contents) ||
549
+ !CBB_add_u16_length_prefixed(&contents, &server_name_list) ||
550
+ !CBB_add_u8(&server_name_list, TLSEXT_NAMETYPE_host_name) ||
551
+ !CBB_add_u16_length_prefixed(&server_name_list, &name) ||
552
+ !CBB_add_bytes(&name, (const uint8_t *)ssl->hostname.get(),
553
+ strlen(ssl->hostname.get())) ||
554
+ !CBB_flush(out)) {
555
+ return false;
556
+ }
557
+
558
+ return true;
559
+ }
560
+
561
+ static bool ext_sni_parse_serverhello(SSL_HANDSHAKE *hs, uint8_t *out_alert,
562
+ CBS *contents) {
563
+ // The server may acknowledge SNI with an empty extension. We check the syntax
564
+ // but otherwise ignore this signal.
565
+ return contents == NULL || CBS_len(contents) == 0;
566
+ }
567
+
568
+ static bool ext_sni_parse_clienthello(SSL_HANDSHAKE *hs, uint8_t *out_alert,
569
+ CBS *contents) {
570
+ // SNI has already been parsed earlier in the handshake. See |extract_sni|.
571
+ return true;
572
+ }
573
+
574
+ static bool ext_sni_add_serverhello(SSL_HANDSHAKE *hs, CBB *out) {
575
+ if (hs->ssl->s3->session_reused ||
576
+ !hs->should_ack_sni) {
577
+ return true;
578
+ }
579
+
580
+ if (!CBB_add_u16(out, TLSEXT_TYPE_server_name) ||
581
+ !CBB_add_u16(out, 0 /* length */)) {
582
+ return false;
583
+ }
584
+
585
+ return true;
586
+ }
587
+
588
+
589
+ // Renegotiation indication.
590
+ //
591
+ // https://tools.ietf.org/html/rfc5746
592
+
593
+ static bool ext_ri_add_clienthello(SSL_HANDSHAKE *hs, CBB *out) {
594
+ SSL *const ssl = hs->ssl;
595
+ // Renegotiation indication is not necessary in TLS 1.3.
596
+ if (hs->min_version >= TLS1_3_VERSION) {
597
+ return true;
598
+ }
599
+
600
+ assert(ssl->s3->initial_handshake_complete ==
601
+ (ssl->s3->previous_client_finished_len != 0));
602
+
603
+ CBB contents, prev_finished;
604
+ if (!CBB_add_u16(out, TLSEXT_TYPE_renegotiate) ||
605
+ !CBB_add_u16_length_prefixed(out, &contents) ||
606
+ !CBB_add_u8_length_prefixed(&contents, &prev_finished) ||
607
+ !CBB_add_bytes(&prev_finished, ssl->s3->previous_client_finished,
608
+ ssl->s3->previous_client_finished_len) ||
609
+ !CBB_flush(out)) {
610
+ return false;
611
+ }
612
+
613
+ return true;
614
+ }
615
+
616
+ static bool ext_ri_parse_serverhello(SSL_HANDSHAKE *hs, uint8_t *out_alert,
617
+ CBS *contents) {
618
+ SSL *const ssl = hs->ssl;
619
+ if (contents != NULL && ssl_protocol_version(ssl) >= TLS1_3_VERSION) {
620
+ *out_alert = SSL_AD_ILLEGAL_PARAMETER;
621
+ return false;
622
+ }
623
+
624
+ // Servers may not switch between omitting the extension and supporting it.
625
+ // See RFC 5746, sections 3.5 and 4.2.
626
+ if (ssl->s3->initial_handshake_complete &&
627
+ (contents != NULL) != ssl->s3->send_connection_binding) {
628
+ *out_alert = SSL_AD_HANDSHAKE_FAILURE;
629
+ OPENSSL_PUT_ERROR(SSL, SSL_R_RENEGOTIATION_MISMATCH);
630
+ return false;
631
+ }
632
+
633
+ if (contents == NULL) {
634
+ // Strictly speaking, if we want to avoid an attack we should *always* see
635
+ // RI even on initial ServerHello because the client doesn't see any
636
+ // renegotiation during an attack. However this would mean we could not
637
+ // connect to any server which doesn't support RI.
638
+ //
639
+ // OpenSSL has |SSL_OP_LEGACY_SERVER_CONNECT| to control this, but in
640
+ // practical terms every client sets it so it's just assumed here.
641
+ return true;
642
+ }
643
+
644
+ const size_t expected_len = ssl->s3->previous_client_finished_len +
645
+ ssl->s3->previous_server_finished_len;
646
+
647
+ // Check for logic errors
648
+ assert(!expected_len || ssl->s3->previous_client_finished_len);
649
+ assert(!expected_len || ssl->s3->previous_server_finished_len);
650
+ assert(ssl->s3->initial_handshake_complete ==
651
+ (ssl->s3->previous_client_finished_len != 0));
652
+ assert(ssl->s3->initial_handshake_complete ==
653
+ (ssl->s3->previous_server_finished_len != 0));
654
+
655
+ // Parse out the extension contents.
656
+ CBS renegotiated_connection;
657
+ if (!CBS_get_u8_length_prefixed(contents, &renegotiated_connection) ||
658
+ CBS_len(contents) != 0) {
659
+ OPENSSL_PUT_ERROR(SSL, SSL_R_RENEGOTIATION_ENCODING_ERR);
660
+ *out_alert = SSL_AD_ILLEGAL_PARAMETER;
661
+ return false;
662
+ }
663
+
664
+ // Check that the extension matches.
665
+ if (CBS_len(&renegotiated_connection) != expected_len) {
666
+ OPENSSL_PUT_ERROR(SSL, SSL_R_RENEGOTIATION_MISMATCH);
667
+ *out_alert = SSL_AD_HANDSHAKE_FAILURE;
668
+ return false;
669
+ }
670
+
671
+ const uint8_t *d = CBS_data(&renegotiated_connection);
672
+ bool ok = CRYPTO_memcmp(d, ssl->s3->previous_client_finished,
673
+ ssl->s3->previous_client_finished_len) == 0;
674
+ #if defined(BORINGSSL_UNSAFE_FUZZER_MODE)
675
+ ok = true;
676
+ #endif
677
+ if (!ok) {
678
+ OPENSSL_PUT_ERROR(SSL, SSL_R_RENEGOTIATION_MISMATCH);
679
+ *out_alert = SSL_AD_HANDSHAKE_FAILURE;
680
+ return false;
681
+ }
682
+ d += ssl->s3->previous_client_finished_len;
683
+
684
+ ok = CRYPTO_memcmp(d, ssl->s3->previous_server_finished,
685
+ ssl->s3->previous_server_finished_len) == 0;
686
+ #if defined(BORINGSSL_UNSAFE_FUZZER_MODE)
687
+ ok = true;
688
+ #endif
689
+ if (!ok) {
690
+ OPENSSL_PUT_ERROR(SSL, SSL_R_RENEGOTIATION_MISMATCH);
691
+ *out_alert = SSL_AD_HANDSHAKE_FAILURE;
692
+ return false;
693
+ }
694
+ ssl->s3->send_connection_binding = true;
695
+
696
+ return true;
697
+ }
698
+
699
+ static bool ext_ri_parse_clienthello(SSL_HANDSHAKE *hs, uint8_t *out_alert,
700
+ CBS *contents) {
701
+ SSL *const ssl = hs->ssl;
702
+ // Renegotiation isn't supported as a server so this function should never be
703
+ // called after the initial handshake.
704
+ assert(!ssl->s3->initial_handshake_complete);
705
+
706
+ if (ssl_protocol_version(ssl) >= TLS1_3_VERSION) {
707
+ return true;
708
+ }
709
+
710
+ if (contents == NULL) {
711
+ return true;
712
+ }
713
+
714
+ CBS renegotiated_connection;
715
+ if (!CBS_get_u8_length_prefixed(contents, &renegotiated_connection) ||
716
+ CBS_len(contents) != 0) {
717
+ OPENSSL_PUT_ERROR(SSL, SSL_R_RENEGOTIATION_ENCODING_ERR);
718
+ return false;
719
+ }
720
+
721
+ // Check that the extension matches. We do not support renegotiation as a
722
+ // server, so this must be empty.
723
+ if (CBS_len(&renegotiated_connection) != 0) {
724
+ OPENSSL_PUT_ERROR(SSL, SSL_R_RENEGOTIATION_MISMATCH);
725
+ *out_alert = SSL_AD_HANDSHAKE_FAILURE;
726
+ return false;
727
+ }
728
+
729
+ ssl->s3->send_connection_binding = true;
730
+
731
+ return true;
732
+ }
733
+
734
+ static bool ext_ri_add_serverhello(SSL_HANDSHAKE *hs, CBB *out) {
735
+ SSL *const ssl = hs->ssl;
736
+ // Renegotiation isn't supported as a server so this function should never be
737
+ // called after the initial handshake.
738
+ assert(!ssl->s3->initial_handshake_complete);
739
+
740
+ if (ssl_protocol_version(ssl) >= TLS1_3_VERSION) {
741
+ return true;
742
+ }
743
+
744
+ if (!CBB_add_u16(out, TLSEXT_TYPE_renegotiate) ||
745
+ !CBB_add_u16(out, 1 /* length */) ||
746
+ !CBB_add_u8(out, 0 /* empty renegotiation info */)) {
747
+ return false;
748
+ }
749
+
750
+ return true;
751
+ }
752
+
753
+
754
+ // Extended Master Secret.
755
+ //
756
+ // https://tools.ietf.org/html/rfc7627
757
+
758
+ static bool ext_ems_add_clienthello(SSL_HANDSHAKE *hs, CBB *out) {
759
+ // Extended master secret is not necessary in TLS 1.3.
760
+ if (hs->min_version >= TLS1_3_VERSION) {
761
+ return true;
762
+ }
763
+
764
+ if (!CBB_add_u16(out, TLSEXT_TYPE_extended_master_secret) ||
765
+ !CBB_add_u16(out, 0 /* length */)) {
766
+ return false;
767
+ }
768
+
769
+ return true;
770
+ }
771
+
772
+ static bool ext_ems_parse_serverhello(SSL_HANDSHAKE *hs, uint8_t *out_alert,
773
+ CBS *contents) {
774
+ SSL *const ssl = hs->ssl;
775
+
776
+ if (contents != NULL) {
777
+ if (ssl_protocol_version(ssl) >= TLS1_3_VERSION ||
778
+ CBS_len(contents) != 0) {
779
+ return false;
780
+ }
781
+
782
+ hs->extended_master_secret = true;
783
+ }
784
+
785
+ // Whether EMS is negotiated may not change on renegotiation.
786
+ if (ssl->s3->established_session != nullptr &&
787
+ hs->extended_master_secret !=
788
+ !!ssl->s3->established_session->extended_master_secret) {
789
+ OPENSSL_PUT_ERROR(SSL, SSL_R_RENEGOTIATION_EMS_MISMATCH);
790
+ *out_alert = SSL_AD_ILLEGAL_PARAMETER;
791
+ return false;
792
+ }
793
+
794
+ return true;
795
+ }
796
+
797
+ static bool ext_ems_parse_clienthello(SSL_HANDSHAKE *hs, uint8_t *out_alert,
798
+ CBS *contents) {
799
+ if (ssl_protocol_version(hs->ssl) >= TLS1_3_VERSION) {
800
+ return true;
801
+ }
802
+
803
+ if (contents == NULL) {
804
+ return true;
805
+ }
806
+
807
+ if (CBS_len(contents) != 0) {
808
+ return false;
809
+ }
810
+
811
+ hs->extended_master_secret = true;
812
+ return true;
813
+ }
814
+
815
+ static bool ext_ems_add_serverhello(SSL_HANDSHAKE *hs, CBB *out) {
816
+ if (!hs->extended_master_secret) {
817
+ return true;
818
+ }
819
+
820
+ if (!CBB_add_u16(out, TLSEXT_TYPE_extended_master_secret) ||
821
+ !CBB_add_u16(out, 0 /* length */)) {
822
+ return false;
823
+ }
824
+
825
+ return true;
826
+ }
827
+
828
+
829
+ // Session tickets.
830
+ //
831
+ // https://tools.ietf.org/html/rfc5077
832
+
833
+ static bool ext_ticket_add_clienthello(SSL_HANDSHAKE *hs, CBB *out) {
834
+ SSL *const ssl = hs->ssl;
835
+ // TLS 1.3 uses a different ticket extension.
836
+ if (hs->min_version >= TLS1_3_VERSION ||
837
+ SSL_get_options(ssl) & SSL_OP_NO_TICKET) {
838
+ return true;
839
+ }
840
+
841
+ Span<const uint8_t> ticket;
842
+
843
+ // Renegotiation does not participate in session resumption. However, still
844
+ // advertise the extension to avoid potentially breaking servers which carry
845
+ // over the state from the previous handshake, such as OpenSSL servers
846
+ // without upstream's 3c3f0259238594d77264a78944d409f2127642c4.
847
+ if (!ssl->s3->initial_handshake_complete &&
848
+ ssl->session != nullptr &&
849
+ !ssl->session->ticket.empty() &&
850
+ // Don't send TLS 1.3 session tickets in the ticket extension.
851
+ ssl_session_protocol_version(ssl->session.get()) < TLS1_3_VERSION) {
852
+ ticket = ssl->session->ticket;
853
+ }
854
+
855
+ CBB ticket_cbb;
856
+ if (!CBB_add_u16(out, TLSEXT_TYPE_session_ticket) ||
857
+ !CBB_add_u16_length_prefixed(out, &ticket_cbb) ||
858
+ !CBB_add_bytes(&ticket_cbb, ticket.data(), ticket.size()) ||
859
+ !CBB_flush(out)) {
860
+ return false;
861
+ }
862
+
863
+ return true;
864
+ }
865
+
866
+ static bool ext_ticket_parse_serverhello(SSL_HANDSHAKE *hs, uint8_t *out_alert,
867
+ CBS *contents) {
868
+ SSL *const ssl = hs->ssl;
869
+ if (contents == NULL) {
870
+ return true;
871
+ }
872
+
873
+ if (ssl_protocol_version(ssl) >= TLS1_3_VERSION) {
874
+ return false;
875
+ }
876
+
877
+ // If |SSL_OP_NO_TICKET| is set then no extension will have been sent and
878
+ // this function should never be called, even if the server tries to send the
879
+ // extension.
880
+ assert((SSL_get_options(ssl) & SSL_OP_NO_TICKET) == 0);
881
+
882
+ if (CBS_len(contents) != 0) {
883
+ return false;
884
+ }
885
+
886
+ hs->ticket_expected = true;
887
+ return true;
888
+ }
889
+
890
+ static bool ext_ticket_add_serverhello(SSL_HANDSHAKE *hs, CBB *out) {
891
+ if (!hs->ticket_expected) {
892
+ return true;
893
+ }
894
+
895
+ // If |SSL_OP_NO_TICKET| is set, |ticket_expected| should never be true.
896
+ assert((SSL_get_options(hs->ssl) & SSL_OP_NO_TICKET) == 0);
897
+
898
+ if (!CBB_add_u16(out, TLSEXT_TYPE_session_ticket) ||
899
+ !CBB_add_u16(out, 0 /* length */)) {
900
+ return false;
901
+ }
902
+
903
+ return true;
904
+ }
905
+
906
+
907
+ // Signature Algorithms.
908
+ //
909
+ // https://tools.ietf.org/html/rfc5246#section-7.4.1.4.1
910
+
911
+ static bool ext_sigalgs_add_clienthello(SSL_HANDSHAKE *hs, CBB *out) {
912
+ if (hs->max_version < TLS1_2_VERSION) {
913
+ return true;
914
+ }
915
+
916
+ CBB contents, sigalgs_cbb;
917
+ if (!CBB_add_u16(out, TLSEXT_TYPE_signature_algorithms) ||
918
+ !CBB_add_u16_length_prefixed(out, &contents) ||
919
+ !CBB_add_u16_length_prefixed(&contents, &sigalgs_cbb) ||
920
+ !tls12_add_verify_sigalgs(hs, &sigalgs_cbb) ||
921
+ !CBB_flush(out)) {
922
+ return false;
923
+ }
924
+
925
+ return true;
926
+ }
927
+
928
+ static bool ext_sigalgs_parse_clienthello(SSL_HANDSHAKE *hs, uint8_t *out_alert,
929
+ CBS *contents) {
930
+ hs->peer_sigalgs.Reset();
931
+ if (contents == NULL) {
932
+ return true;
933
+ }
934
+
935
+ CBS supported_signature_algorithms;
936
+ if (!CBS_get_u16_length_prefixed(contents, &supported_signature_algorithms) ||
937
+ CBS_len(contents) != 0 ||
938
+ !tls1_parse_peer_sigalgs(hs, &supported_signature_algorithms)) {
939
+ return false;
940
+ }
941
+
942
+ return true;
943
+ }
944
+
945
+
946
+ // OCSP Stapling.
947
+ //
948
+ // https://tools.ietf.org/html/rfc6066#section-8
949
+
950
+ static bool ext_ocsp_add_clienthello(SSL_HANDSHAKE *hs, CBB *out) {
951
+ if (!hs->config->ocsp_stapling_enabled) {
952
+ return true;
953
+ }
954
+
955
+ CBB contents;
956
+ if (!CBB_add_u16(out, TLSEXT_TYPE_status_request) ||
957
+ !CBB_add_u16_length_prefixed(out, &contents) ||
958
+ !CBB_add_u8(&contents, TLSEXT_STATUSTYPE_ocsp) ||
959
+ !CBB_add_u16(&contents, 0 /* empty responder ID list */) ||
960
+ !CBB_add_u16(&contents, 0 /* empty request extensions */) ||
961
+ !CBB_flush(out)) {
962
+ return false;
963
+ }
964
+
965
+ return true;
966
+ }
967
+
968
+ static bool ext_ocsp_parse_serverhello(SSL_HANDSHAKE *hs, uint8_t *out_alert,
969
+ CBS *contents) {
970
+ SSL *const ssl = hs->ssl;
971
+ if (contents == NULL) {
972
+ return true;
973
+ }
974
+
975
+ // TLS 1.3 OCSP responses are included in the Certificate extensions.
976
+ if (ssl_protocol_version(ssl) >= TLS1_3_VERSION) {
977
+ return false;
978
+ }
979
+
980
+ // OCSP stapling is forbidden on non-certificate ciphers.
981
+ if (CBS_len(contents) != 0 ||
982
+ !ssl_cipher_uses_certificate_auth(hs->new_cipher)) {
983
+ return false;
984
+ }
985
+
986
+ // Note this does not check for resumption in TLS 1.2. Sending
987
+ // status_request here does not make sense, but OpenSSL does so and the
988
+ // specification does not say anything. Tolerate it but ignore it.
989
+
990
+ hs->certificate_status_expected = true;
991
+ return true;
992
+ }
993
+
994
+ static bool ext_ocsp_parse_clienthello(SSL_HANDSHAKE *hs, uint8_t *out_alert,
995
+ CBS *contents) {
996
+ if (contents == NULL) {
997
+ return true;
998
+ }
999
+
1000
+ uint8_t status_type;
1001
+ if (!CBS_get_u8(contents, &status_type)) {
1002
+ return false;
1003
+ }
1004
+
1005
+ // We cannot decide whether OCSP stapling will occur yet because the correct
1006
+ // SSL_CTX might not have been selected.
1007
+ hs->ocsp_stapling_requested = status_type == TLSEXT_STATUSTYPE_ocsp;
1008
+
1009
+ return true;
1010
+ }
1011
+
1012
+ static bool ext_ocsp_add_serverhello(SSL_HANDSHAKE *hs, CBB *out) {
1013
+ SSL *const ssl = hs->ssl;
1014
+ if (ssl_protocol_version(ssl) >= TLS1_3_VERSION ||
1015
+ !hs->ocsp_stapling_requested || hs->config->cert->ocsp_response == NULL ||
1016
+ ssl->s3->session_reused ||
1017
+ !ssl_cipher_uses_certificate_auth(hs->new_cipher)) {
1018
+ return true;
1019
+ }
1020
+
1021
+ hs->certificate_status_expected = true;
1022
+
1023
+ return CBB_add_u16(out, TLSEXT_TYPE_status_request) &&
1024
+ CBB_add_u16(out, 0 /* length */);
1025
+ }
1026
+
1027
+
1028
+ // Next protocol negotiation.
1029
+ //
1030
+ // https://htmlpreview.github.io/?https://github.com/agl/technotes/blob/master/nextprotoneg.html
1031
+
1032
+ static bool ext_npn_add_clienthello(SSL_HANDSHAKE *hs, CBB *out) {
1033
+ SSL *const ssl = hs->ssl;
1034
+ if (ssl->s3->initial_handshake_complete ||
1035
+ ssl->ctx->next_proto_select_cb == NULL ||
1036
+ SSL_is_dtls(ssl)) {
1037
+ return true;
1038
+ }
1039
+
1040
+ if (!CBB_add_u16(out, TLSEXT_TYPE_next_proto_neg) ||
1041
+ !CBB_add_u16(out, 0 /* length */)) {
1042
+ return false;
1043
+ }
1044
+
1045
+ return true;
1046
+ }
1047
+
1048
+ static bool ext_npn_parse_serverhello(SSL_HANDSHAKE *hs, uint8_t *out_alert,
1049
+ CBS *contents) {
1050
+ SSL *const ssl = hs->ssl;
1051
+ if (contents == NULL) {
1052
+ return true;
1053
+ }
1054
+
1055
+ if (ssl_protocol_version(ssl) >= TLS1_3_VERSION) {
1056
+ return false;
1057
+ }
1058
+
1059
+ // If any of these are false then we should never have sent the NPN
1060
+ // extension in the ClientHello and thus this function should never have been
1061
+ // called.
1062
+ assert(!ssl->s3->initial_handshake_complete);
1063
+ assert(!SSL_is_dtls(ssl));
1064
+ assert(ssl->ctx->next_proto_select_cb != NULL);
1065
+
1066
+ if (!ssl->s3->alpn_selected.empty()) {
1067
+ // NPN and ALPN may not be negotiated in the same connection.
1068
+ *out_alert = SSL_AD_ILLEGAL_PARAMETER;
1069
+ OPENSSL_PUT_ERROR(SSL, SSL_R_NEGOTIATED_BOTH_NPN_AND_ALPN);
1070
+ return false;
1071
+ }
1072
+
1073
+ const uint8_t *const orig_contents = CBS_data(contents);
1074
+ const size_t orig_len = CBS_len(contents);
1075
+
1076
+ while (CBS_len(contents) != 0) {
1077
+ CBS proto;
1078
+ if (!CBS_get_u8_length_prefixed(contents, &proto) ||
1079
+ CBS_len(&proto) == 0) {
1080
+ return false;
1081
+ }
1082
+ }
1083
+
1084
+ uint8_t *selected;
1085
+ uint8_t selected_len;
1086
+ if (ssl->ctx->next_proto_select_cb(
1087
+ ssl, &selected, &selected_len, orig_contents, orig_len,
1088
+ ssl->ctx->next_proto_select_cb_arg) != SSL_TLSEXT_ERR_OK ||
1089
+ !ssl->s3->next_proto_negotiated.CopyFrom(
1090
+ MakeConstSpan(selected, selected_len))) {
1091
+ *out_alert = SSL_AD_INTERNAL_ERROR;
1092
+ return false;
1093
+ }
1094
+
1095
+ hs->next_proto_neg_seen = true;
1096
+ return true;
1097
+ }
1098
+
1099
+ static bool ext_npn_parse_clienthello(SSL_HANDSHAKE *hs, uint8_t *out_alert,
1100
+ CBS *contents) {
1101
+ SSL *const ssl = hs->ssl;
1102
+ if (ssl_protocol_version(ssl) >= TLS1_3_VERSION) {
1103
+ return true;
1104
+ }
1105
+
1106
+ if (contents != NULL && CBS_len(contents) != 0) {
1107
+ return false;
1108
+ }
1109
+
1110
+ if (contents == NULL ||
1111
+ ssl->s3->initial_handshake_complete ||
1112
+ ssl->ctx->next_protos_advertised_cb == NULL ||
1113
+ SSL_is_dtls(ssl)) {
1114
+ return true;
1115
+ }
1116
+
1117
+ hs->next_proto_neg_seen = true;
1118
+ return true;
1119
+ }
1120
+
1121
+ static bool ext_npn_add_serverhello(SSL_HANDSHAKE *hs, CBB *out) {
1122
+ SSL *const ssl = hs->ssl;
1123
+ // |next_proto_neg_seen| might have been cleared when an ALPN extension was
1124
+ // parsed.
1125
+ if (!hs->next_proto_neg_seen) {
1126
+ return true;
1127
+ }
1128
+
1129
+ const uint8_t *npa;
1130
+ unsigned npa_len;
1131
+
1132
+ if (ssl->ctx->next_protos_advertised_cb(
1133
+ ssl, &npa, &npa_len, ssl->ctx->next_protos_advertised_cb_arg) !=
1134
+ SSL_TLSEXT_ERR_OK) {
1135
+ hs->next_proto_neg_seen = false;
1136
+ return true;
1137
+ }
1138
+
1139
+ CBB contents;
1140
+ if (!CBB_add_u16(out, TLSEXT_TYPE_next_proto_neg) ||
1141
+ !CBB_add_u16_length_prefixed(out, &contents) ||
1142
+ !CBB_add_bytes(&contents, npa, npa_len) ||
1143
+ !CBB_flush(out)) {
1144
+ return false;
1145
+ }
1146
+
1147
+ return true;
1148
+ }
1149
+
1150
+
1151
+ // Signed certificate timestamps.
1152
+ //
1153
+ // https://tools.ietf.org/html/rfc6962#section-3.3.1
1154
+
1155
+ static bool ext_sct_add_clienthello(SSL_HANDSHAKE *hs, CBB *out) {
1156
+ if (!hs->config->signed_cert_timestamps_enabled) {
1157
+ return true;
1158
+ }
1159
+
1160
+ if (!CBB_add_u16(out, TLSEXT_TYPE_certificate_timestamp) ||
1161
+ !CBB_add_u16(out, 0 /* length */)) {
1162
+ return false;
1163
+ }
1164
+
1165
+ return true;
1166
+ }
1167
+
1168
+ static bool ext_sct_parse_serverhello(SSL_HANDSHAKE *hs, uint8_t *out_alert,
1169
+ CBS *contents) {
1170
+ SSL *const ssl = hs->ssl;
1171
+ if (contents == NULL) {
1172
+ return true;
1173
+ }
1174
+
1175
+ // TLS 1.3 SCTs are included in the Certificate extensions.
1176
+ if (ssl_protocol_version(ssl) >= TLS1_3_VERSION) {
1177
+ *out_alert = SSL_AD_DECODE_ERROR;
1178
+ return false;
1179
+ }
1180
+
1181
+ // If this is false then we should never have sent the SCT extension in the
1182
+ // ClientHello and thus this function should never have been called.
1183
+ assert(hs->config->signed_cert_timestamps_enabled);
1184
+
1185
+ if (!ssl_is_sct_list_valid(contents)) {
1186
+ *out_alert = SSL_AD_DECODE_ERROR;
1187
+ return false;
1188
+ }
1189
+
1190
+ // Session resumption uses the original session information. The extension
1191
+ // should not be sent on resumption, but RFC 6962 did not make it a
1192
+ // requirement, so tolerate this.
1193
+ //
1194
+ // TODO(davidben): Enforce this anyway.
1195
+ if (!ssl->s3->session_reused) {
1196
+ hs->new_session->signed_cert_timestamp_list.reset(
1197
+ CRYPTO_BUFFER_new_from_CBS(contents, ssl->ctx->pool));
1198
+ if (hs->new_session->signed_cert_timestamp_list == nullptr) {
1199
+ *out_alert = SSL_AD_INTERNAL_ERROR;
1200
+ return false;
1201
+ }
1202
+ }
1203
+
1204
+ return true;
1205
+ }
1206
+
1207
+ static bool ext_sct_parse_clienthello(SSL_HANDSHAKE *hs, uint8_t *out_alert,
1208
+ CBS *contents) {
1209
+ if (contents == NULL) {
1210
+ return true;
1211
+ }
1212
+
1213
+ if (CBS_len(contents) != 0) {
1214
+ return false;
1215
+ }
1216
+
1217
+ hs->scts_requested = true;
1218
+ return true;
1219
+ }
1220
+
1221
+ static bool ext_sct_add_serverhello(SSL_HANDSHAKE *hs, CBB *out) {
1222
+ SSL *const ssl = hs->ssl;
1223
+ // The extension shouldn't be sent when resuming sessions.
1224
+ if (ssl_protocol_version(ssl) >= TLS1_3_VERSION || ssl->s3->session_reused ||
1225
+ hs->config->cert->signed_cert_timestamp_list == NULL) {
1226
+ return true;
1227
+ }
1228
+
1229
+ CBB contents;
1230
+ return CBB_add_u16(out, TLSEXT_TYPE_certificate_timestamp) &&
1231
+ CBB_add_u16_length_prefixed(out, &contents) &&
1232
+ CBB_add_bytes(
1233
+ &contents,
1234
+ CRYPTO_BUFFER_data(
1235
+ hs->config->cert->signed_cert_timestamp_list.get()),
1236
+ CRYPTO_BUFFER_len(
1237
+ hs->config->cert->signed_cert_timestamp_list.get())) &&
1238
+ CBB_flush(out);
1239
+ }
1240
+
1241
+
1242
+ // Application-level Protocol Negotiation.
1243
+ //
1244
+ // https://tools.ietf.org/html/rfc7301
1245
+
1246
+ static bool ext_alpn_add_clienthello(SSL_HANDSHAKE *hs, CBB *out) {
1247
+ SSL *const ssl = hs->ssl;
1248
+ if (hs->config->alpn_client_proto_list.empty() ||
1249
+ ssl->s3->initial_handshake_complete) {
1250
+ return true;
1251
+ }
1252
+
1253
+ CBB contents, proto_list;
1254
+ if (!CBB_add_u16(out, TLSEXT_TYPE_application_layer_protocol_negotiation) ||
1255
+ !CBB_add_u16_length_prefixed(out, &contents) ||
1256
+ !CBB_add_u16_length_prefixed(&contents, &proto_list) ||
1257
+ !CBB_add_bytes(&proto_list, hs->config->alpn_client_proto_list.data(),
1258
+ hs->config->alpn_client_proto_list.size()) ||
1259
+ !CBB_flush(out)) {
1260
+ return false;
1261
+ }
1262
+
1263
+ return true;
1264
+ }
1265
+
1266
+ static bool ext_alpn_parse_serverhello(SSL_HANDSHAKE *hs, uint8_t *out_alert,
1267
+ CBS *contents) {
1268
+ SSL *const ssl = hs->ssl;
1269
+ if (contents == NULL) {
1270
+ return true;
1271
+ }
1272
+
1273
+ assert(!ssl->s3->initial_handshake_complete);
1274
+ assert(!hs->config->alpn_client_proto_list.empty());
1275
+
1276
+ if (hs->next_proto_neg_seen) {
1277
+ // NPN and ALPN may not be negotiated in the same connection.
1278
+ *out_alert = SSL_AD_ILLEGAL_PARAMETER;
1279
+ OPENSSL_PUT_ERROR(SSL, SSL_R_NEGOTIATED_BOTH_NPN_AND_ALPN);
1280
+ return false;
1281
+ }
1282
+
1283
+ // The extension data consists of a ProtocolNameList which must have
1284
+ // exactly one ProtocolName. Each of these is length-prefixed.
1285
+ CBS protocol_name_list, protocol_name;
1286
+ if (!CBS_get_u16_length_prefixed(contents, &protocol_name_list) ||
1287
+ CBS_len(contents) != 0 ||
1288
+ !CBS_get_u8_length_prefixed(&protocol_name_list, &protocol_name) ||
1289
+ // Empty protocol names are forbidden.
1290
+ CBS_len(&protocol_name) == 0 ||
1291
+ CBS_len(&protocol_name_list) != 0) {
1292
+ return false;
1293
+ }
1294
+
1295
+ if (!ssl_is_alpn_protocol_allowed(hs, protocol_name)) {
1296
+ OPENSSL_PUT_ERROR(SSL, SSL_R_INVALID_ALPN_PROTOCOL);
1297
+ *out_alert = SSL_AD_ILLEGAL_PARAMETER;
1298
+ return false;
1299
+ }
1300
+
1301
+ if (!ssl->s3->alpn_selected.CopyFrom(protocol_name)) {
1302
+ *out_alert = SSL_AD_INTERNAL_ERROR;
1303
+ return false;
1304
+ }
1305
+
1306
+ return true;
1307
+ }
1308
+
1309
+ bool ssl_is_alpn_protocol_allowed(const SSL_HANDSHAKE *hs,
1310
+ Span<const uint8_t> protocol) {
1311
+ if (hs->config->alpn_client_proto_list.empty()) {
1312
+ return false;
1313
+ }
1314
+
1315
+ if (hs->ssl->ctx->allow_unknown_alpn_protos) {
1316
+ return true;
1317
+ }
1318
+
1319
+ // Check that the protocol name is one of the ones we advertised.
1320
+ CBS client_protocol_name_list =
1321
+ MakeConstSpan(hs->config->alpn_client_proto_list),
1322
+ client_protocol_name;
1323
+ while (CBS_len(&client_protocol_name_list) > 0) {
1324
+ if (!CBS_get_u8_length_prefixed(&client_protocol_name_list,
1325
+ &client_protocol_name)) {
1326
+ return false;
1327
+ }
1328
+
1329
+ if (client_protocol_name == protocol) {
1330
+ return true;
1331
+ }
1332
+ }
1333
+
1334
+ return false;
1335
+ }
1336
+
1337
+ bool ssl_negotiate_alpn(SSL_HANDSHAKE *hs, uint8_t *out_alert,
1338
+ const SSL_CLIENT_HELLO *client_hello) {
1339
+ SSL *const ssl = hs->ssl;
1340
+ CBS contents;
1341
+ if (ssl->ctx->alpn_select_cb == NULL ||
1342
+ !ssl_client_hello_get_extension(
1343
+ client_hello, &contents,
1344
+ TLSEXT_TYPE_application_layer_protocol_negotiation)) {
1345
+ // Ignore ALPN if not configured or no extension was supplied.
1346
+ return true;
1347
+ }
1348
+
1349
+ // ALPN takes precedence over NPN.
1350
+ hs->next_proto_neg_seen = false;
1351
+
1352
+ CBS protocol_name_list;
1353
+ if (!CBS_get_u16_length_prefixed(&contents, &protocol_name_list) ||
1354
+ CBS_len(&contents) != 0 ||
1355
+ CBS_len(&protocol_name_list) < 2) {
1356
+ OPENSSL_PUT_ERROR(SSL, SSL_R_PARSE_TLSEXT);
1357
+ *out_alert = SSL_AD_DECODE_ERROR;
1358
+ return false;
1359
+ }
1360
+
1361
+ // Validate the protocol list.
1362
+ CBS protocol_name_list_copy = protocol_name_list;
1363
+ while (CBS_len(&protocol_name_list_copy) > 0) {
1364
+ CBS protocol_name;
1365
+
1366
+ if (!CBS_get_u8_length_prefixed(&protocol_name_list_copy, &protocol_name) ||
1367
+ // Empty protocol names are forbidden.
1368
+ CBS_len(&protocol_name) == 0) {
1369
+ OPENSSL_PUT_ERROR(SSL, SSL_R_PARSE_TLSEXT);
1370
+ *out_alert = SSL_AD_DECODE_ERROR;
1371
+ return false;
1372
+ }
1373
+ }
1374
+
1375
+ const uint8_t *selected;
1376
+ uint8_t selected_len;
1377
+ if (ssl->ctx->alpn_select_cb(
1378
+ ssl, &selected, &selected_len, CBS_data(&protocol_name_list),
1379
+ CBS_len(&protocol_name_list),
1380
+ ssl->ctx->alpn_select_cb_arg) == SSL_TLSEXT_ERR_OK) {
1381
+ if (selected_len == 0) {
1382
+ OPENSSL_PUT_ERROR(SSL, SSL_R_INVALID_ALPN_PROTOCOL);
1383
+ *out_alert = SSL_AD_INTERNAL_ERROR;
1384
+ return false;
1385
+ }
1386
+ if (!ssl->s3->alpn_selected.CopyFrom(
1387
+ MakeConstSpan(selected, selected_len))) {
1388
+ *out_alert = SSL_AD_INTERNAL_ERROR;
1389
+ return false;
1390
+ }
1391
+ }
1392
+
1393
+ return true;
1394
+ }
1395
+
1396
+ static bool ext_alpn_add_serverhello(SSL_HANDSHAKE *hs, CBB *out) {
1397
+ SSL *const ssl = hs->ssl;
1398
+ if (ssl->s3->alpn_selected.empty()) {
1399
+ return true;
1400
+ }
1401
+
1402
+ CBB contents, proto_list, proto;
1403
+ if (!CBB_add_u16(out, TLSEXT_TYPE_application_layer_protocol_negotiation) ||
1404
+ !CBB_add_u16_length_prefixed(out, &contents) ||
1405
+ !CBB_add_u16_length_prefixed(&contents, &proto_list) ||
1406
+ !CBB_add_u8_length_prefixed(&proto_list, &proto) ||
1407
+ !CBB_add_bytes(&proto, ssl->s3->alpn_selected.data(),
1408
+ ssl->s3->alpn_selected.size()) ||
1409
+ !CBB_flush(out)) {
1410
+ return false;
1411
+ }
1412
+
1413
+ return true;
1414
+ }
1415
+
1416
+
1417
+ // Channel ID.
1418
+ //
1419
+ // https://tools.ietf.org/html/draft-balfanz-tls-channelid-01
1420
+
1421
+ static void ext_channel_id_init(SSL_HANDSHAKE *hs) {
1422
+ hs->ssl->s3->channel_id_valid = false;
1423
+ }
1424
+
1425
+ static bool ext_channel_id_add_clienthello(SSL_HANDSHAKE *hs, CBB *out) {
1426
+ SSL *const ssl = hs->ssl;
1427
+ if (!hs->config->channel_id_enabled || SSL_is_dtls(ssl)) {
1428
+ return true;
1429
+ }
1430
+
1431
+ if (!CBB_add_u16(out, TLSEXT_TYPE_channel_id) ||
1432
+ !CBB_add_u16(out, 0 /* length */)) {
1433
+ return false;
1434
+ }
1435
+
1436
+ return true;
1437
+ }
1438
+
1439
+ static bool ext_channel_id_parse_serverhello(SSL_HANDSHAKE *hs,
1440
+ uint8_t *out_alert,
1441
+ CBS *contents) {
1442
+ SSL *const ssl = hs->ssl;
1443
+ if (contents == NULL) {
1444
+ return true;
1445
+ }
1446
+
1447
+ assert(!SSL_is_dtls(ssl));
1448
+ assert(hs->config->channel_id_enabled);
1449
+
1450
+ if (CBS_len(contents) != 0) {
1451
+ return false;
1452
+ }
1453
+
1454
+ ssl->s3->channel_id_valid = true;
1455
+ return true;
1456
+ }
1457
+
1458
+ static bool ext_channel_id_parse_clienthello(SSL_HANDSHAKE *hs,
1459
+ uint8_t *out_alert,
1460
+ CBS *contents) {
1461
+ SSL *const ssl = hs->ssl;
1462
+ if (contents == NULL || !hs->config->channel_id_enabled || SSL_is_dtls(ssl)) {
1463
+ return true;
1464
+ }
1465
+
1466
+ if (CBS_len(contents) != 0) {
1467
+ return false;
1468
+ }
1469
+
1470
+ ssl->s3->channel_id_valid = true;
1471
+ return true;
1472
+ }
1473
+
1474
+ static bool ext_channel_id_add_serverhello(SSL_HANDSHAKE *hs, CBB *out) {
1475
+ SSL *const ssl = hs->ssl;
1476
+ if (!ssl->s3->channel_id_valid) {
1477
+ return true;
1478
+ }
1479
+
1480
+ if (!CBB_add_u16(out, TLSEXT_TYPE_channel_id) ||
1481
+ !CBB_add_u16(out, 0 /* length */)) {
1482
+ return false;
1483
+ }
1484
+
1485
+ return true;
1486
+ }
1487
+
1488
+
1489
+ // Secure Real-time Transport Protocol (SRTP) extension.
1490
+ //
1491
+ // https://tools.ietf.org/html/rfc5764
1492
+
1493
+
1494
+ static void ext_srtp_init(SSL_HANDSHAKE *hs) {
1495
+ hs->ssl->s3->srtp_profile = NULL;
1496
+ }
1497
+
1498
+ static bool ext_srtp_add_clienthello(SSL_HANDSHAKE *hs, CBB *out) {
1499
+ SSL *const ssl = hs->ssl;
1500
+ STACK_OF(SRTP_PROTECTION_PROFILE) *profiles = SSL_get_srtp_profiles(ssl);
1501
+ if (profiles == NULL ||
1502
+ sk_SRTP_PROTECTION_PROFILE_num(profiles) == 0) {
1503
+ return true;
1504
+ }
1505
+
1506
+ CBB contents, profile_ids;
1507
+ if (!CBB_add_u16(out, TLSEXT_TYPE_srtp) ||
1508
+ !CBB_add_u16_length_prefixed(out, &contents) ||
1509
+ !CBB_add_u16_length_prefixed(&contents, &profile_ids)) {
1510
+ return false;
1511
+ }
1512
+
1513
+ for (const SRTP_PROTECTION_PROFILE *profile : profiles) {
1514
+ if (!CBB_add_u16(&profile_ids, profile->id)) {
1515
+ return false;
1516
+ }
1517
+ }
1518
+
1519
+ if (!CBB_add_u8(&contents, 0 /* empty use_mki value */) ||
1520
+ !CBB_flush(out)) {
1521
+ return false;
1522
+ }
1523
+
1524
+ return true;
1525
+ }
1526
+
1527
+ static bool ext_srtp_parse_serverhello(SSL_HANDSHAKE *hs, uint8_t *out_alert,
1528
+ CBS *contents) {
1529
+ SSL *const ssl = hs->ssl;
1530
+ if (contents == NULL) {
1531
+ return true;
1532
+ }
1533
+
1534
+ // The extension consists of a u16-prefixed profile ID list containing a
1535
+ // single uint16_t profile ID, then followed by a u8-prefixed srtp_mki field.
1536
+ //
1537
+ // See https://tools.ietf.org/html/rfc5764#section-4.1.1
1538
+ CBS profile_ids, srtp_mki;
1539
+ uint16_t profile_id;
1540
+ if (!CBS_get_u16_length_prefixed(contents, &profile_ids) ||
1541
+ !CBS_get_u16(&profile_ids, &profile_id) ||
1542
+ CBS_len(&profile_ids) != 0 ||
1543
+ !CBS_get_u8_length_prefixed(contents, &srtp_mki) ||
1544
+ CBS_len(contents) != 0) {
1545
+ OPENSSL_PUT_ERROR(SSL, SSL_R_BAD_SRTP_PROTECTION_PROFILE_LIST);
1546
+ return false;
1547
+ }
1548
+
1549
+ if (CBS_len(&srtp_mki) != 0) {
1550
+ // Must be no MKI, since we never offer one.
1551
+ OPENSSL_PUT_ERROR(SSL, SSL_R_BAD_SRTP_MKI_VALUE);
1552
+ *out_alert = SSL_AD_ILLEGAL_PARAMETER;
1553
+ return false;
1554
+ }
1555
+
1556
+ STACK_OF(SRTP_PROTECTION_PROFILE) *profiles = SSL_get_srtp_profiles(ssl);
1557
+
1558
+ // Check to see if the server gave us something we support (and presumably
1559
+ // offered).
1560
+ for (const SRTP_PROTECTION_PROFILE *profile : profiles) {
1561
+ if (profile->id == profile_id) {
1562
+ ssl->s3->srtp_profile = profile;
1563
+ return true;
1564
+ }
1565
+ }
1566
+
1567
+ OPENSSL_PUT_ERROR(SSL, SSL_R_BAD_SRTP_PROTECTION_PROFILE_LIST);
1568
+ *out_alert = SSL_AD_ILLEGAL_PARAMETER;
1569
+ return false;
1570
+ }
1571
+
1572
+ static bool ext_srtp_parse_clienthello(SSL_HANDSHAKE *hs, uint8_t *out_alert,
1573
+ CBS *contents) {
1574
+ SSL *const ssl = hs->ssl;
1575
+ if (contents == NULL) {
1576
+ return true;
1577
+ }
1578
+
1579
+ CBS profile_ids, srtp_mki;
1580
+ if (!CBS_get_u16_length_prefixed(contents, &profile_ids) ||
1581
+ CBS_len(&profile_ids) < 2 ||
1582
+ !CBS_get_u8_length_prefixed(contents, &srtp_mki) ||
1583
+ CBS_len(contents) != 0) {
1584
+ OPENSSL_PUT_ERROR(SSL, SSL_R_BAD_SRTP_PROTECTION_PROFILE_LIST);
1585
+ return false;
1586
+ }
1587
+ // Discard the MKI value for now.
1588
+
1589
+ const STACK_OF(SRTP_PROTECTION_PROFILE) *server_profiles =
1590
+ SSL_get_srtp_profiles(ssl);
1591
+
1592
+ // Pick the server's most preferred profile.
1593
+ for (const SRTP_PROTECTION_PROFILE *server_profile : server_profiles) {
1594
+ CBS profile_ids_tmp;
1595
+ CBS_init(&profile_ids_tmp, CBS_data(&profile_ids), CBS_len(&profile_ids));
1596
+
1597
+ while (CBS_len(&profile_ids_tmp) > 0) {
1598
+ uint16_t profile_id;
1599
+ if (!CBS_get_u16(&profile_ids_tmp, &profile_id)) {
1600
+ return false;
1601
+ }
1602
+
1603
+ if (server_profile->id == profile_id) {
1604
+ ssl->s3->srtp_profile = server_profile;
1605
+ return true;
1606
+ }
1607
+ }
1608
+ }
1609
+
1610
+ return true;
1611
+ }
1612
+
1613
+ static bool ext_srtp_add_serverhello(SSL_HANDSHAKE *hs, CBB *out) {
1614
+ SSL *const ssl = hs->ssl;
1615
+ if (ssl->s3->srtp_profile == NULL) {
1616
+ return true;
1617
+ }
1618
+
1619
+ CBB contents, profile_ids;
1620
+ if (!CBB_add_u16(out, TLSEXT_TYPE_srtp) ||
1621
+ !CBB_add_u16_length_prefixed(out, &contents) ||
1622
+ !CBB_add_u16_length_prefixed(&contents, &profile_ids) ||
1623
+ !CBB_add_u16(&profile_ids, ssl->s3->srtp_profile->id) ||
1624
+ !CBB_add_u8(&contents, 0 /* empty MKI */) ||
1625
+ !CBB_flush(out)) {
1626
+ return false;
1627
+ }
1628
+
1629
+ return true;
1630
+ }
1631
+
1632
+
1633
+ // EC point formats.
1634
+ //
1635
+ // https://tools.ietf.org/html/rfc4492#section-5.1.2
1636
+
1637
+ static bool ext_ec_point_add_extension(SSL_HANDSHAKE *hs, CBB *out) {
1638
+ CBB contents, formats;
1639
+ if (!CBB_add_u16(out, TLSEXT_TYPE_ec_point_formats) ||
1640
+ !CBB_add_u16_length_prefixed(out, &contents) ||
1641
+ !CBB_add_u8_length_prefixed(&contents, &formats) ||
1642
+ !CBB_add_u8(&formats, TLSEXT_ECPOINTFORMAT_uncompressed) ||
1643
+ !CBB_flush(out)) {
1644
+ return false;
1645
+ }
1646
+
1647
+ return true;
1648
+ }
1649
+
1650
+ static bool ext_ec_point_add_clienthello(SSL_HANDSHAKE *hs, CBB *out) {
1651
+ // The point format extension is unnecessary in TLS 1.3.
1652
+ if (hs->min_version >= TLS1_3_VERSION) {
1653
+ return true;
1654
+ }
1655
+
1656
+ return ext_ec_point_add_extension(hs, out);
1657
+ }
1658
+
1659
+ static bool ext_ec_point_parse_serverhello(SSL_HANDSHAKE *hs, uint8_t *out_alert,
1660
+ CBS *contents) {
1661
+ if (contents == NULL) {
1662
+ return true;
1663
+ }
1664
+
1665
+ if (ssl_protocol_version(hs->ssl) >= TLS1_3_VERSION) {
1666
+ return false;
1667
+ }
1668
+
1669
+ CBS ec_point_format_list;
1670
+ if (!CBS_get_u8_length_prefixed(contents, &ec_point_format_list) ||
1671
+ CBS_len(contents) != 0) {
1672
+ return false;
1673
+ }
1674
+
1675
+ // Per RFC 4492, section 5.1.2, implementations MUST support the uncompressed
1676
+ // point format.
1677
+ if (OPENSSL_memchr(CBS_data(&ec_point_format_list),
1678
+ TLSEXT_ECPOINTFORMAT_uncompressed,
1679
+ CBS_len(&ec_point_format_list)) == NULL) {
1680
+ *out_alert = SSL_AD_ILLEGAL_PARAMETER;
1681
+ return false;
1682
+ }
1683
+
1684
+ return true;
1685
+ }
1686
+
1687
+ static bool ext_ec_point_parse_clienthello(SSL_HANDSHAKE *hs, uint8_t *out_alert,
1688
+ CBS *contents) {
1689
+ if (ssl_protocol_version(hs->ssl) >= TLS1_3_VERSION) {
1690
+ return true;
1691
+ }
1692
+
1693
+ return ext_ec_point_parse_serverhello(hs, out_alert, contents);
1694
+ }
1695
+
1696
+ static bool ext_ec_point_add_serverhello(SSL_HANDSHAKE *hs, CBB *out) {
1697
+ SSL *const ssl = hs->ssl;
1698
+ if (ssl_protocol_version(ssl) >= TLS1_3_VERSION) {
1699
+ return true;
1700
+ }
1701
+
1702
+ const uint32_t alg_k = hs->new_cipher->algorithm_mkey;
1703
+ const uint32_t alg_a = hs->new_cipher->algorithm_auth;
1704
+ const bool using_ecc = (alg_k & SSL_kECDHE) || (alg_a & SSL_aECDSA);
1705
+
1706
+ if (!using_ecc) {
1707
+ return true;
1708
+ }
1709
+
1710
+ return ext_ec_point_add_extension(hs, out);
1711
+ }
1712
+
1713
+
1714
+ // Pre Shared Key
1715
+ //
1716
+ // https://tools.ietf.org/html/rfc8446#section-4.2.11
1717
+
1718
+ static size_t ext_pre_shared_key_clienthello_length(SSL_HANDSHAKE *hs) {
1719
+ SSL *const ssl = hs->ssl;
1720
+ if (hs->max_version < TLS1_3_VERSION || ssl->session == nullptr ||
1721
+ ssl_session_protocol_version(ssl->session.get()) < TLS1_3_VERSION) {
1722
+ return 0;
1723
+ }
1724
+
1725
+ size_t binder_len = EVP_MD_size(ssl_session_get_digest(ssl->session.get()));
1726
+ return 15 + ssl->session->ticket.size() + binder_len;
1727
+ }
1728
+
1729
+ static bool ext_pre_shared_key_add_clienthello(SSL_HANDSHAKE *hs, CBB *out) {
1730
+ SSL *const ssl = hs->ssl;
1731
+ hs->needs_psk_binder = false;
1732
+ if (hs->max_version < TLS1_3_VERSION || ssl->session == nullptr ||
1733
+ ssl_session_protocol_version(ssl->session.get()) < TLS1_3_VERSION) {
1734
+ return true;
1735
+ }
1736
+
1737
+ // Per RFC 8446 section 4.1.4, skip offering the session if the selected
1738
+ // cipher in HelloRetryRequest does not match. This avoids performing the
1739
+ // transcript hash transformation for multiple hashes.
1740
+ if (ssl->s3 && ssl->s3->used_hello_retry_request &&
1741
+ ssl->session->cipher->algorithm_prf != hs->new_cipher->algorithm_prf) {
1742
+ return true;
1743
+ }
1744
+
1745
+ struct OPENSSL_timeval now;
1746
+ ssl_get_current_time(ssl, &now);
1747
+ uint32_t ticket_age = 1000 * (now.tv_sec - ssl->session->time);
1748
+ uint32_t obfuscated_ticket_age = ticket_age + ssl->session->ticket_age_add;
1749
+
1750
+ // Fill in a placeholder zero binder of the appropriate length. It will be
1751
+ // computed and filled in later after length prefixes are computed.
1752
+ uint8_t zero_binder[EVP_MAX_MD_SIZE] = {0};
1753
+ size_t binder_len = EVP_MD_size(ssl_session_get_digest(ssl->session.get()));
1754
+
1755
+ CBB contents, identity, ticket, binders, binder;
1756
+ if (!CBB_add_u16(out, TLSEXT_TYPE_pre_shared_key) ||
1757
+ !CBB_add_u16_length_prefixed(out, &contents) ||
1758
+ !CBB_add_u16_length_prefixed(&contents, &identity) ||
1759
+ !CBB_add_u16_length_prefixed(&identity, &ticket) ||
1760
+ !CBB_add_bytes(&ticket, ssl->session->ticket.data(),
1761
+ ssl->session->ticket.size()) ||
1762
+ !CBB_add_u32(&identity, obfuscated_ticket_age) ||
1763
+ !CBB_add_u16_length_prefixed(&contents, &binders) ||
1764
+ !CBB_add_u8_length_prefixed(&binders, &binder) ||
1765
+ !CBB_add_bytes(&binder, zero_binder, binder_len)) {
1766
+ return false;
1767
+ }
1768
+
1769
+ hs->needs_psk_binder = true;
1770
+ return CBB_flush(out);
1771
+ }
1772
+
1773
+ bool ssl_ext_pre_shared_key_parse_serverhello(SSL_HANDSHAKE *hs,
1774
+ uint8_t *out_alert,
1775
+ CBS *contents) {
1776
+ uint16_t psk_id;
1777
+ if (!CBS_get_u16(contents, &psk_id) ||
1778
+ CBS_len(contents) != 0) {
1779
+ OPENSSL_PUT_ERROR(SSL, SSL_R_DECODE_ERROR);
1780
+ *out_alert = SSL_AD_DECODE_ERROR;
1781
+ return false;
1782
+ }
1783
+
1784
+ // We only advertise one PSK identity, so the only legal index is zero.
1785
+ if (psk_id != 0) {
1786
+ OPENSSL_PUT_ERROR(SSL, SSL_R_PSK_IDENTITY_NOT_FOUND);
1787
+ *out_alert = SSL_AD_UNKNOWN_PSK_IDENTITY;
1788
+ return false;
1789
+ }
1790
+
1791
+ return true;
1792
+ }
1793
+
1794
+ bool ssl_ext_pre_shared_key_parse_clienthello(
1795
+ SSL_HANDSHAKE *hs, CBS *out_ticket, CBS *out_binders,
1796
+ uint32_t *out_obfuscated_ticket_age, uint8_t *out_alert,
1797
+ const SSL_CLIENT_HELLO *client_hello, CBS *contents) {
1798
+ // Verify that the pre_shared_key extension is the last extension in
1799
+ // ClientHello.
1800
+ if (CBS_data(contents) + CBS_len(contents) !=
1801
+ client_hello->extensions + client_hello->extensions_len) {
1802
+ OPENSSL_PUT_ERROR(SSL, SSL_R_PRE_SHARED_KEY_MUST_BE_LAST);
1803
+ *out_alert = SSL_AD_ILLEGAL_PARAMETER;
1804
+ return false;
1805
+ }
1806
+
1807
+ // We only process the first PSK identity since we don't support pure PSK.
1808
+ CBS identities, binders;
1809
+ if (!CBS_get_u16_length_prefixed(contents, &identities) ||
1810
+ !CBS_get_u16_length_prefixed(&identities, out_ticket) ||
1811
+ !CBS_get_u32(&identities, out_obfuscated_ticket_age) ||
1812
+ !CBS_get_u16_length_prefixed(contents, &binders) ||
1813
+ CBS_len(&binders) == 0 ||
1814
+ CBS_len(contents) != 0) {
1815
+ OPENSSL_PUT_ERROR(SSL, SSL_R_DECODE_ERROR);
1816
+ *out_alert = SSL_AD_DECODE_ERROR;
1817
+ return false;
1818
+ }
1819
+
1820
+ *out_binders = binders;
1821
+
1822
+ // Check the syntax of the remaining identities, but do not process them.
1823
+ size_t num_identities = 1;
1824
+ while (CBS_len(&identities) != 0) {
1825
+ CBS unused_ticket;
1826
+ uint32_t unused_obfuscated_ticket_age;
1827
+ if (!CBS_get_u16_length_prefixed(&identities, &unused_ticket) ||
1828
+ !CBS_get_u32(&identities, &unused_obfuscated_ticket_age)) {
1829
+ OPENSSL_PUT_ERROR(SSL, SSL_R_DECODE_ERROR);
1830
+ *out_alert = SSL_AD_DECODE_ERROR;
1831
+ return false;
1832
+ }
1833
+
1834
+ num_identities++;
1835
+ }
1836
+
1837
+ // Check the syntax of the binders. The value will be checked later if
1838
+ // resuming.
1839
+ size_t num_binders = 0;
1840
+ while (CBS_len(&binders) != 0) {
1841
+ CBS binder;
1842
+ if (!CBS_get_u8_length_prefixed(&binders, &binder)) {
1843
+ OPENSSL_PUT_ERROR(SSL, SSL_R_DECODE_ERROR);
1844
+ *out_alert = SSL_AD_DECODE_ERROR;
1845
+ return false;
1846
+ }
1847
+
1848
+ num_binders++;
1849
+ }
1850
+
1851
+ if (num_identities != num_binders) {
1852
+ OPENSSL_PUT_ERROR(SSL, SSL_R_PSK_IDENTITY_BINDER_COUNT_MISMATCH);
1853
+ *out_alert = SSL_AD_ILLEGAL_PARAMETER;
1854
+ return false;
1855
+ }
1856
+
1857
+ return true;
1858
+ }
1859
+
1860
+ bool ssl_ext_pre_shared_key_add_serverhello(SSL_HANDSHAKE *hs, CBB *out) {
1861
+ if (!hs->ssl->s3->session_reused) {
1862
+ return true;
1863
+ }
1864
+
1865
+ CBB contents;
1866
+ if (!CBB_add_u16(out, TLSEXT_TYPE_pre_shared_key) ||
1867
+ !CBB_add_u16_length_prefixed(out, &contents) ||
1868
+ // We only consider the first identity for resumption
1869
+ !CBB_add_u16(&contents, 0) ||
1870
+ !CBB_flush(out)) {
1871
+ return false;
1872
+ }
1873
+
1874
+ return true;
1875
+ }
1876
+
1877
+
1878
+ // Pre-Shared Key Exchange Modes
1879
+ //
1880
+ // https://tools.ietf.org/html/rfc8446#section-4.2.9
1881
+
1882
+ static bool ext_psk_key_exchange_modes_add_clienthello(SSL_HANDSHAKE *hs,
1883
+ CBB *out) {
1884
+ if (hs->max_version < TLS1_3_VERSION) {
1885
+ return true;
1886
+ }
1887
+
1888
+ CBB contents, ke_modes;
1889
+ if (!CBB_add_u16(out, TLSEXT_TYPE_psk_key_exchange_modes) ||
1890
+ !CBB_add_u16_length_prefixed(out, &contents) ||
1891
+ !CBB_add_u8_length_prefixed(&contents, &ke_modes) ||
1892
+ !CBB_add_u8(&ke_modes, SSL_PSK_DHE_KE)) {
1893
+ return false;
1894
+ }
1895
+
1896
+ return CBB_flush(out);
1897
+ }
1898
+
1899
+ static bool ext_psk_key_exchange_modes_parse_clienthello(SSL_HANDSHAKE *hs,
1900
+ uint8_t *out_alert,
1901
+ CBS *contents) {
1902
+ if (contents == NULL) {
1903
+ return true;
1904
+ }
1905
+
1906
+ CBS ke_modes;
1907
+ if (!CBS_get_u8_length_prefixed(contents, &ke_modes) ||
1908
+ CBS_len(&ke_modes) == 0 ||
1909
+ CBS_len(contents) != 0) {
1910
+ *out_alert = SSL_AD_DECODE_ERROR;
1911
+ return false;
1912
+ }
1913
+
1914
+ // We only support tickets with PSK_DHE_KE.
1915
+ hs->accept_psk_mode = OPENSSL_memchr(CBS_data(&ke_modes), SSL_PSK_DHE_KE,
1916
+ CBS_len(&ke_modes)) != NULL;
1917
+
1918
+ return true;
1919
+ }
1920
+
1921
+
1922
+ // Early Data Indication
1923
+ //
1924
+ // https://tools.ietf.org/html/rfc8446#section-4.2.10
1925
+
1926
+ static bool ext_early_data_add_clienthello(SSL_HANDSHAKE *hs, CBB *out) {
1927
+ SSL *const ssl = hs->ssl;
1928
+ // The second ClientHello never offers early data, and we must have already
1929
+ // filled in |early_data_reason| by this point.
1930
+ if (ssl->s3->used_hello_retry_request) {
1931
+ assert(ssl->s3->early_data_reason != ssl_early_data_unknown);
1932
+ return true;
1933
+ }
1934
+
1935
+ if (!ssl->enable_early_data) {
1936
+ ssl->s3->early_data_reason = ssl_early_data_disabled;
1937
+ return true;
1938
+ }
1939
+
1940
+ if (hs->max_version < TLS1_3_VERSION) {
1941
+ // We discard inapplicable sessions, so this is redundant with the session
1942
+ // checks below, but we check give a more useful reason.
1943
+ ssl->s3->early_data_reason = ssl_early_data_protocol_version;
1944
+ return true;
1945
+ }
1946
+
1947
+ if (ssl->session == nullptr) {
1948
+ ssl->s3->early_data_reason = ssl_early_data_no_session_offered;
1949
+ return true;
1950
+ }
1951
+
1952
+ if (ssl_session_protocol_version(ssl->session.get()) < TLS1_3_VERSION ||
1953
+ ssl->session->ticket_max_early_data == 0) {
1954
+ ssl->s3->early_data_reason = ssl_early_data_unsupported_for_session;
1955
+ return true;
1956
+ }
1957
+
1958
+ // In case ALPN preferences changed since this session was established, avoid
1959
+ // reporting a confusing value in |SSL_get0_alpn_selected| and sending early
1960
+ // data we know will be rejected.
1961
+ if (!ssl->session->early_alpn.empty() &&
1962
+ !ssl_is_alpn_protocol_allowed(hs, ssl->session->early_alpn)) {
1963
+ ssl->s3->early_data_reason = ssl_early_data_alpn_mismatch;
1964
+ return true;
1965
+ }
1966
+
1967
+ // |early_data_reason| will be filled in later when the server responds.
1968
+ hs->early_data_offered = true;
1969
+
1970
+ if (!CBB_add_u16(out, TLSEXT_TYPE_early_data) ||
1971
+ !CBB_add_u16(out, 0) ||
1972
+ !CBB_flush(out)) {
1973
+ return false;
1974
+ }
1975
+
1976
+ return true;
1977
+ }
1978
+
1979
+ static bool ext_early_data_parse_serverhello(SSL_HANDSHAKE *hs,
1980
+ uint8_t *out_alert,
1981
+ CBS *contents) {
1982
+ SSL *const ssl = hs->ssl;
1983
+ if (contents == NULL) {
1984
+ if (hs->early_data_offered && !ssl->s3->used_hello_retry_request) {
1985
+ ssl->s3->early_data_reason = ssl->s3->session_reused
1986
+ ? ssl_early_data_peer_declined
1987
+ : ssl_early_data_session_not_resumed;
1988
+ } else {
1989
+ // We already filled in |early_data_reason| when declining to offer 0-RTT
1990
+ // or handling the implicit HelloRetryRequest reject.
1991
+ assert(ssl->s3->early_data_reason != ssl_early_data_unknown);
1992
+ }
1993
+ return true;
1994
+ }
1995
+
1996
+ // If we received an HRR, the second ClientHello never offers early data, so
1997
+ // the extensions logic will automatically reject early data extensions as
1998
+ // unsolicited. This covered by the ServerAcceptsEarlyDataOnHRR test.
1999
+ assert(!ssl->s3->used_hello_retry_request);
2000
+
2001
+ if (CBS_len(contents) != 0) {
2002
+ *out_alert = SSL_AD_DECODE_ERROR;
2003
+ return false;
2004
+ }
2005
+
2006
+ if (!ssl->s3->session_reused) {
2007
+ *out_alert = SSL_AD_UNSUPPORTED_EXTENSION;
2008
+ OPENSSL_PUT_ERROR(SSL, SSL_R_UNEXPECTED_EXTENSION);
2009
+ return false;
2010
+ }
2011
+
2012
+ ssl->s3->early_data_reason = ssl_early_data_accepted;
2013
+ ssl->s3->early_data_accepted = true;
2014
+ return true;
2015
+ }
2016
+
2017
+ static bool ext_early_data_parse_clienthello(SSL_HANDSHAKE *hs,
2018
+ uint8_t *out_alert, CBS *contents) {
2019
+ SSL *const ssl = hs->ssl;
2020
+ if (contents == NULL ||
2021
+ ssl_protocol_version(ssl) < TLS1_3_VERSION) {
2022
+ return true;
2023
+ }
2024
+
2025
+ if (CBS_len(contents) != 0) {
2026
+ *out_alert = SSL_AD_DECODE_ERROR;
2027
+ return false;
2028
+ }
2029
+
2030
+ hs->early_data_offered = true;
2031
+ return true;
2032
+ }
2033
+
2034
+ static bool ext_early_data_add_serverhello(SSL_HANDSHAKE *hs, CBB *out) {
2035
+ if (!hs->ssl->s3->early_data_accepted) {
2036
+ return true;
2037
+ }
2038
+
2039
+ if (!CBB_add_u16(out, TLSEXT_TYPE_early_data) ||
2040
+ !CBB_add_u16(out, 0) ||
2041
+ !CBB_flush(out)) {
2042
+ return false;
2043
+ }
2044
+
2045
+ return true;
2046
+ }
2047
+
2048
+
2049
+ // Key Share
2050
+ //
2051
+ // https://tools.ietf.org/html/rfc8446#section-4.2.8
2052
+
2053
+ static bool ext_key_share_add_clienthello(SSL_HANDSHAKE *hs, CBB *out) {
2054
+ SSL *const ssl = hs->ssl;
2055
+ if (hs->max_version < TLS1_3_VERSION) {
2056
+ return true;
2057
+ }
2058
+
2059
+ CBB contents, kse_bytes;
2060
+ if (!CBB_add_u16(out, TLSEXT_TYPE_key_share) ||
2061
+ !CBB_add_u16_length_prefixed(out, &contents) ||
2062
+ !CBB_add_u16_length_prefixed(&contents, &kse_bytes)) {
2063
+ return false;
2064
+ }
2065
+
2066
+ uint16_t group_id = hs->retry_group;
2067
+ uint16_t second_group_id = 0;
2068
+ if (ssl->s3 && ssl->s3->used_hello_retry_request) {
2069
+ // We received a HelloRetryRequest without a new curve, so there is no new
2070
+ // share to append. Leave |hs->key_share| as-is.
2071
+ if (group_id == 0 &&
2072
+ !CBB_add_bytes(&kse_bytes, hs->key_share_bytes.data(),
2073
+ hs->key_share_bytes.size())) {
2074
+ return false;
2075
+ }
2076
+ hs->key_share_bytes.Reset();
2077
+ if (group_id == 0) {
2078
+ return CBB_flush(out);
2079
+ }
2080
+ } else {
2081
+ // Add a fake group. See draft-davidben-tls-grease-01.
2082
+ if (ssl->ctx->grease_enabled &&
2083
+ (!CBB_add_u16(&kse_bytes,
2084
+ ssl_get_grease_value(hs, ssl_grease_group)) ||
2085
+ !CBB_add_u16(&kse_bytes, 1 /* length */) ||
2086
+ !CBB_add_u8(&kse_bytes, 0 /* one byte key share */))) {
2087
+ return false;
2088
+ }
2089
+
2090
+ // Predict the most preferred group.
2091
+ Span<const uint16_t> groups = tls1_get_grouplist(hs);
2092
+ if (groups.empty()) {
2093
+ OPENSSL_PUT_ERROR(SSL, SSL_R_NO_GROUPS_SPECIFIED);
2094
+ return false;
2095
+ }
2096
+
2097
+ group_id = groups[0];
2098
+
2099
+ if (is_post_quantum_group(group_id) && groups.size() >= 2) {
2100
+ // CECPQ2(b) is not sent as the only initial key share. We'll include the
2101
+ // 2nd preference group too to avoid round-trips.
2102
+ second_group_id = groups[1];
2103
+ assert(second_group_id != group_id);
2104
+ }
2105
+ }
2106
+
2107
+ CBB key_exchange;
2108
+ hs->key_shares[0] = SSLKeyShare::Create(group_id);
2109
+ if (!hs->key_shares[0] ||
2110
+ !CBB_add_u16(&kse_bytes, group_id) ||
2111
+ !CBB_add_u16_length_prefixed(&kse_bytes, &key_exchange) ||
2112
+ !hs->key_shares[0]->Offer(&key_exchange) ||
2113
+ !CBB_flush(&kse_bytes)) {
2114
+ return false;
2115
+ }
2116
+
2117
+ if (second_group_id != 0) {
2118
+ hs->key_shares[1] = SSLKeyShare::Create(second_group_id);
2119
+ if (!hs->key_shares[1] ||
2120
+ !CBB_add_u16(&kse_bytes, second_group_id) ||
2121
+ !CBB_add_u16_length_prefixed(&kse_bytes, &key_exchange) ||
2122
+ !hs->key_shares[1]->Offer(&key_exchange) ||
2123
+ !CBB_flush(&kse_bytes)) {
2124
+ return false;
2125
+ }
2126
+ }
2127
+
2128
+ // Save the contents of the extension to repeat it in the second
2129
+ // ClientHello.
2130
+ if (ssl->s3 && !ssl->s3->used_hello_retry_request &&
2131
+ !hs->key_share_bytes.CopyFrom(
2132
+ MakeConstSpan(CBB_data(&kse_bytes), CBB_len(&kse_bytes)))) {
2133
+ return false;
2134
+ }
2135
+
2136
+ return CBB_flush(out);
2137
+ }
2138
+
2139
+ bool ssl_ext_key_share_parse_serverhello(SSL_HANDSHAKE *hs,
2140
+ Array<uint8_t> *out_secret,
2141
+ uint8_t *out_alert, CBS *contents) {
2142
+ CBS peer_key;
2143
+ uint16_t group_id;
2144
+ if (!CBS_get_u16(contents, &group_id) ||
2145
+ !CBS_get_u16_length_prefixed(contents, &peer_key) ||
2146
+ CBS_len(contents) != 0) {
2147
+ OPENSSL_PUT_ERROR(SSL, SSL_R_DECODE_ERROR);
2148
+ *out_alert = SSL_AD_DECODE_ERROR;
2149
+ return false;
2150
+ }
2151
+
2152
+ SSLKeyShare *key_share = hs->key_shares[0].get();
2153
+ if (key_share->GroupID() != group_id) {
2154
+ if (!hs->key_shares[1] || hs->key_shares[1]->GroupID() != group_id) {
2155
+ *out_alert = SSL_AD_ILLEGAL_PARAMETER;
2156
+ OPENSSL_PUT_ERROR(SSL, SSL_R_WRONG_CURVE);
2157
+ return false;
2158
+ }
2159
+ key_share = hs->key_shares[1].get();
2160
+ }
2161
+
2162
+ if (!key_share->Finish(out_secret, out_alert, peer_key)) {
2163
+ *out_alert = SSL_AD_INTERNAL_ERROR;
2164
+ return false;
2165
+ }
2166
+
2167
+ hs->new_session->group_id = group_id;
2168
+ hs->key_shares[0].reset();
2169
+ hs->key_shares[1].reset();
2170
+ return true;
2171
+ }
2172
+
2173
+ bool ssl_ext_key_share_parse_clienthello(SSL_HANDSHAKE *hs, bool *out_found,
2174
+ Array<uint8_t> *out_secret,
2175
+ uint8_t *out_alert, CBS *contents) {
2176
+ uint16_t group_id;
2177
+ CBS key_shares;
2178
+ if (!tls1_get_shared_group(hs, &group_id)) {
2179
+ OPENSSL_PUT_ERROR(SSL, SSL_R_NO_SHARED_GROUP);
2180
+ *out_alert = SSL_AD_HANDSHAKE_FAILURE;
2181
+ return false;
2182
+ }
2183
+
2184
+ if (!CBS_get_u16_length_prefixed(contents, &key_shares) ||
2185
+ CBS_len(contents) != 0) {
2186
+ OPENSSL_PUT_ERROR(SSL, SSL_R_DECODE_ERROR);
2187
+ return false;
2188
+ }
2189
+
2190
+ // Find the corresponding key share.
2191
+ CBS peer_key;
2192
+ CBS_init(&peer_key, NULL, 0);
2193
+ while (CBS_len(&key_shares) > 0) {
2194
+ uint16_t id;
2195
+ CBS peer_key_tmp;
2196
+ if (!CBS_get_u16(&key_shares, &id) ||
2197
+ !CBS_get_u16_length_prefixed(&key_shares, &peer_key_tmp) ||
2198
+ CBS_len(&peer_key_tmp) == 0) {
2199
+ OPENSSL_PUT_ERROR(SSL, SSL_R_DECODE_ERROR);
2200
+ return false;
2201
+ }
2202
+
2203
+ if (id == group_id) {
2204
+ if (CBS_len(&peer_key) != 0) {
2205
+ OPENSSL_PUT_ERROR(SSL, SSL_R_DUPLICATE_KEY_SHARE);
2206
+ *out_alert = SSL_AD_ILLEGAL_PARAMETER;
2207
+ return false;
2208
+ }
2209
+
2210
+ peer_key = peer_key_tmp;
2211
+ // Continue parsing the structure to keep peers honest.
2212
+ }
2213
+ }
2214
+
2215
+ if (CBS_len(&peer_key) == 0) {
2216
+ *out_found = false;
2217
+ out_secret->Reset();
2218
+ return true;
2219
+ }
2220
+
2221
+ // Compute the DH secret.
2222
+ Array<uint8_t> secret;
2223
+ ScopedCBB public_key;
2224
+ UniquePtr<SSLKeyShare> key_share = SSLKeyShare::Create(group_id);
2225
+ if (!key_share ||
2226
+ !CBB_init(public_key.get(), 32) ||
2227
+ !key_share->Accept(public_key.get(), &secret, out_alert, peer_key) ||
2228
+ !CBBFinishArray(public_key.get(), &hs->ecdh_public_key)) {
2229
+ *out_alert = SSL_AD_ILLEGAL_PARAMETER;
2230
+ return false;
2231
+ }
2232
+
2233
+ *out_secret = std::move(secret);
2234
+ *out_found = true;
2235
+ return true;
2236
+ }
2237
+
2238
+ bool ssl_ext_key_share_add_serverhello(SSL_HANDSHAKE *hs, CBB *out) {
2239
+ uint16_t group_id;
2240
+ CBB kse_bytes, public_key;
2241
+ if (!tls1_get_shared_group(hs, &group_id) ||
2242
+ !CBB_add_u16(out, TLSEXT_TYPE_key_share) ||
2243
+ !CBB_add_u16_length_prefixed(out, &kse_bytes) ||
2244
+ !CBB_add_u16(&kse_bytes, group_id) ||
2245
+ !CBB_add_u16_length_prefixed(&kse_bytes, &public_key) ||
2246
+ !CBB_add_bytes(&public_key, hs->ecdh_public_key.data(),
2247
+ hs->ecdh_public_key.size()) ||
2248
+ !CBB_flush(out)) {
2249
+ return false;
2250
+ }
2251
+
2252
+ hs->ecdh_public_key.Reset();
2253
+
2254
+ hs->new_session->group_id = group_id;
2255
+ return true;
2256
+ }
2257
+
2258
+
2259
+ // Supported Versions
2260
+ //
2261
+ // https://tools.ietf.org/html/rfc8446#section-4.2.1
2262
+
2263
+ static bool ext_supported_versions_add_clienthello(SSL_HANDSHAKE *hs, CBB *out) {
2264
+ SSL *const ssl = hs->ssl;
2265
+ if (hs->max_version <= TLS1_2_VERSION) {
2266
+ return true;
2267
+ }
2268
+
2269
+ CBB contents, versions;
2270
+ if (!CBB_add_u16(out, TLSEXT_TYPE_supported_versions) ||
2271
+ !CBB_add_u16_length_prefixed(out, &contents) ||
2272
+ !CBB_add_u8_length_prefixed(&contents, &versions)) {
2273
+ return false;
2274
+ }
2275
+
2276
+ // Add a fake version. See draft-davidben-tls-grease-01.
2277
+ if (ssl->ctx->grease_enabled &&
2278
+ !CBB_add_u16(&versions, ssl_get_grease_value(hs, ssl_grease_version))) {
2279
+ return false;
2280
+ }
2281
+
2282
+ if (!ssl_add_supported_versions(hs, &versions) ||
2283
+ !CBB_flush(out)) {
2284
+ return false;
2285
+ }
2286
+
2287
+ return true;
2288
+ }
2289
+
2290
+
2291
+ // Cookie
2292
+ //
2293
+ // https://tools.ietf.org/html/rfc8446#section-4.2.2
2294
+
2295
+ static bool ext_cookie_add_clienthello(SSL_HANDSHAKE *hs, CBB *out) {
2296
+ if (hs->cookie.empty()) {
2297
+ return true;
2298
+ }
2299
+
2300
+ CBB contents, cookie;
2301
+ if (!CBB_add_u16(out, TLSEXT_TYPE_cookie) ||
2302
+ !CBB_add_u16_length_prefixed(out, &contents) ||
2303
+ !CBB_add_u16_length_prefixed(&contents, &cookie) ||
2304
+ !CBB_add_bytes(&cookie, hs->cookie.data(), hs->cookie.size()) ||
2305
+ !CBB_flush(out)) {
2306
+ return false;
2307
+ }
2308
+
2309
+ // The cookie is no longer needed in memory.
2310
+ hs->cookie.Reset();
2311
+ return true;
2312
+ }
2313
+
2314
+
2315
+ // Supported Groups
2316
+ //
2317
+ // https://tools.ietf.org/html/rfc4492#section-5.1.1
2318
+ // https://tools.ietf.org/html/rfc8446#section-4.2.7
2319
+
2320
+ static bool ext_supported_groups_add_clienthello(SSL_HANDSHAKE *hs, CBB *out) {
2321
+ SSL *const ssl = hs->ssl;
2322
+ CBB contents, groups_bytes;
2323
+ if (!CBB_add_u16(out, TLSEXT_TYPE_supported_groups) ||
2324
+ !CBB_add_u16_length_prefixed(out, &contents) ||
2325
+ !CBB_add_u16_length_prefixed(&contents, &groups_bytes)) {
2326
+ return false;
2327
+ }
2328
+
2329
+ // Add a fake group. See draft-davidben-tls-grease-01.
2330
+ if (ssl->ctx->grease_enabled &&
2331
+ !CBB_add_u16(&groups_bytes,
2332
+ ssl_get_grease_value(hs, ssl_grease_group))) {
2333
+ return false;
2334
+ }
2335
+
2336
+ for (uint16_t group : tls1_get_grouplist(hs)) {
2337
+ if (is_post_quantum_group(group) &&
2338
+ hs->max_version < TLS1_3_VERSION) {
2339
+ continue;
2340
+ }
2341
+ if (!CBB_add_u16(&groups_bytes, group)) {
2342
+ return false;
2343
+ }
2344
+ }
2345
+
2346
+ return CBB_flush(out);
2347
+ }
2348
+
2349
+ static bool ext_supported_groups_parse_serverhello(SSL_HANDSHAKE *hs,
2350
+ uint8_t *out_alert,
2351
+ CBS *contents) {
2352
+ // This extension is not expected to be echoed by servers in TLS 1.2, but some
2353
+ // BigIP servers send it nonetheless, so do not enforce this.
2354
+ return true;
2355
+ }
2356
+
2357
+ static bool parse_u16_array(const CBS *cbs, Array<uint16_t> *out) {
2358
+ CBS copy = *cbs;
2359
+ if ((CBS_len(&copy) & 1) != 0) {
2360
+ OPENSSL_PUT_ERROR(SSL, SSL_R_DECODE_ERROR);
2361
+ return false;
2362
+ }
2363
+
2364
+ Array<uint16_t> ret;
2365
+ if (!ret.Init(CBS_len(&copy) / 2)) {
2366
+ return false;
2367
+ }
2368
+ for (size_t i = 0; i < ret.size(); i++) {
2369
+ if (!CBS_get_u16(&copy, &ret[i])) {
2370
+ OPENSSL_PUT_ERROR(SSL, ERR_R_INTERNAL_ERROR);
2371
+ return false;
2372
+ }
2373
+ }
2374
+
2375
+ assert(CBS_len(&copy) == 0);
2376
+ *out = std::move(ret);
2377
+ return 1;
2378
+ }
2379
+
2380
+ static bool ext_supported_groups_parse_clienthello(SSL_HANDSHAKE *hs,
2381
+ uint8_t *out_alert,
2382
+ CBS *contents) {
2383
+ if (contents == NULL) {
2384
+ return true;
2385
+ }
2386
+
2387
+ CBS supported_group_list;
2388
+ if (!CBS_get_u16_length_prefixed(contents, &supported_group_list) ||
2389
+ CBS_len(&supported_group_list) == 0 ||
2390
+ CBS_len(contents) != 0 ||
2391
+ !parse_u16_array(&supported_group_list, &hs->peer_supported_group_list)) {
2392
+ return false;
2393
+ }
2394
+
2395
+ return true;
2396
+ }
2397
+
2398
+ // Token Binding
2399
+ //
2400
+ // https://tools.ietf.org/html/draft-ietf-tokbind-negotiation-10
2401
+
2402
+ // The Token Binding version number currently matches the draft number of
2403
+ // draft-ietf-tokbind-protocol, and when published as an RFC it will be 0x0100.
2404
+ // Since there are no wire changes to the protocol from draft 13 through the
2405
+ // current draft (16), this implementation supports all versions in that range.
2406
+ static uint16_t kTokenBindingMaxVersion = 16;
2407
+ static uint16_t kTokenBindingMinVersion = 13;
2408
+
2409
+ static bool ext_token_binding_add_clienthello(SSL_HANDSHAKE *hs, CBB *out) {
2410
+ SSL *const ssl = hs->ssl;
2411
+ if (hs->config->token_binding_params.empty() || SSL_is_dtls(ssl)) {
2412
+ return true;
2413
+ }
2414
+
2415
+ CBB contents, params;
2416
+ if (!CBB_add_u16(out, TLSEXT_TYPE_token_binding) ||
2417
+ !CBB_add_u16_length_prefixed(out, &contents) ||
2418
+ !CBB_add_u16(&contents, kTokenBindingMaxVersion) ||
2419
+ !CBB_add_u8_length_prefixed(&contents, &params) ||
2420
+ !CBB_add_bytes(&params, hs->config->token_binding_params.data(),
2421
+ hs->config->token_binding_params.size()) ||
2422
+ !CBB_flush(out)) {
2423
+ return false;
2424
+ }
2425
+
2426
+ return true;
2427
+ }
2428
+
2429
+ static bool ext_token_binding_parse_serverhello(SSL_HANDSHAKE *hs,
2430
+ uint8_t *out_alert,
2431
+ CBS *contents) {
2432
+ SSL *const ssl = hs->ssl;
2433
+ if (contents == nullptr) {
2434
+ return true;
2435
+ }
2436
+
2437
+ CBS params_list;
2438
+ uint16_t version;
2439
+ uint8_t param;
2440
+ if (!CBS_get_u16(contents, &version) ||
2441
+ !CBS_get_u8_length_prefixed(contents, &params_list) ||
2442
+ !CBS_get_u8(&params_list, &param) ||
2443
+ CBS_len(&params_list) > 0 ||
2444
+ CBS_len(contents) > 0) {
2445
+ *out_alert = SSL_AD_DECODE_ERROR;
2446
+ return false;
2447
+ }
2448
+
2449
+ // The server-negotiated version must be less than or equal to our version.
2450
+ if (version > kTokenBindingMaxVersion) {
2451
+ *out_alert = SSL_AD_ILLEGAL_PARAMETER;
2452
+ return false;
2453
+ }
2454
+
2455
+ // If the server-selected version is less than what we support, then Token
2456
+ // Binding wasn't negotiated (but the extension was parsed successfully).
2457
+ if (version < kTokenBindingMinVersion) {
2458
+ return true;
2459
+ }
2460
+
2461
+ for (uint8_t config_param : hs->config->token_binding_params) {
2462
+ if (param == config_param) {
2463
+ ssl->s3->negotiated_token_binding_param = param;
2464
+ ssl->s3->token_binding_negotiated = true;
2465
+ return true;
2466
+ }
2467
+ }
2468
+
2469
+ *out_alert = SSL_AD_ILLEGAL_PARAMETER;
2470
+ return false;
2471
+ }
2472
+
2473
+ // select_tb_param looks for the first token binding param in
2474
+ // |hs->ssl->token_binding_params| that is also in |params| and puts it in
2475
+ // |hs->ssl->negotiated_token_binding_param|. It returns true if a token binding
2476
+ // param is found, and false otherwise.
2477
+ static bool select_tb_param(SSL_HANDSHAKE *hs,
2478
+ Span<const uint8_t> peer_params) {
2479
+ for (uint8_t tb_param : hs->config->token_binding_params) {
2480
+ for (uint8_t peer_param : peer_params) {
2481
+ if (tb_param == peer_param) {
2482
+ hs->ssl->s3->negotiated_token_binding_param = tb_param;
2483
+ return true;
2484
+ }
2485
+ }
2486
+ }
2487
+ return false;
2488
+ }
2489
+
2490
+ static bool ext_token_binding_parse_clienthello(SSL_HANDSHAKE *hs,
2491
+ uint8_t *out_alert,
2492
+ CBS *contents) {
2493
+ SSL *const ssl = hs->ssl;
2494
+ if (contents == nullptr || hs->config->token_binding_params.empty()) {
2495
+ return true;
2496
+ }
2497
+
2498
+ CBS params;
2499
+ uint16_t version;
2500
+ if (!CBS_get_u16(contents, &version) ||
2501
+ !CBS_get_u8_length_prefixed(contents, &params) ||
2502
+ CBS_len(&params) == 0 ||
2503
+ CBS_len(contents) > 0) {
2504
+ *out_alert = SSL_AD_DECODE_ERROR;
2505
+ return false;
2506
+ }
2507
+
2508
+ // If the client-selected version is less than what we support, then Token
2509
+ // Binding wasn't negotiated (but the extension was parsed successfully).
2510
+ if (version < kTokenBindingMinVersion) {
2511
+ return true;
2512
+ }
2513
+
2514
+ // If the client-selected version is higher than we support, use our max
2515
+ // version. Otherwise, use the client's version.
2516
+ hs->negotiated_token_binding_version =
2517
+ std::min(version, kTokenBindingMaxVersion);
2518
+ if (!select_tb_param(hs, params)) {
2519
+ return true;
2520
+ }
2521
+
2522
+ ssl->s3->token_binding_negotiated = true;
2523
+ return true;
2524
+ }
2525
+
2526
+ static bool ext_token_binding_add_serverhello(SSL_HANDSHAKE *hs, CBB *out) {
2527
+ SSL *const ssl = hs->ssl;
2528
+
2529
+ if (!ssl->s3->token_binding_negotiated) {
2530
+ return true;
2531
+ }
2532
+
2533
+ CBB contents, params;
2534
+ if (!CBB_add_u16(out, TLSEXT_TYPE_token_binding) ||
2535
+ !CBB_add_u16_length_prefixed(out, &contents) ||
2536
+ !CBB_add_u16(&contents, hs->negotiated_token_binding_version) ||
2537
+ !CBB_add_u8_length_prefixed(&contents, &params) ||
2538
+ !CBB_add_u8(&params, ssl->s3->negotiated_token_binding_param) ||
2539
+ !CBB_flush(out)) {
2540
+ return false;
2541
+ }
2542
+
2543
+ return true;
2544
+ }
2545
+
2546
+ // QUIC Transport Parameters
2547
+
2548
+ static bool ext_quic_transport_params_add_clienthello(SSL_HANDSHAKE *hs,
2549
+ CBB *out) {
2550
+ if (hs->config->quic_transport_params.empty() && !hs->ssl->quic_method) {
2551
+ return true;
2552
+ }
2553
+ if (hs->config->quic_transport_params.empty() || !hs->ssl->quic_method) {
2554
+ // QUIC Transport Parameters must be sent over QUIC, and they must not be
2555
+ // sent over non-QUIC transports. If transport params are set, then
2556
+ // SSL(_CTX)_set_quic_method must also be called.
2557
+ OPENSSL_PUT_ERROR(SSL, SSL_R_QUIC_TRANSPORT_PARAMETERS_MISCONFIGURED);
2558
+ return false;
2559
+ }
2560
+ assert(hs->min_version > TLS1_2_VERSION);
2561
+
2562
+ CBB contents;
2563
+ if (!CBB_add_u16(out, TLSEXT_TYPE_quic_transport_parameters) ||
2564
+ !CBB_add_u16_length_prefixed(out, &contents) ||
2565
+ !CBB_add_bytes(&contents, hs->config->quic_transport_params.data(),
2566
+ hs->config->quic_transport_params.size()) ||
2567
+ !CBB_flush(out)) {
2568
+ return false;
2569
+ }
2570
+ return true;
2571
+ }
2572
+
2573
+ static bool ext_quic_transport_params_parse_serverhello(SSL_HANDSHAKE *hs,
2574
+ uint8_t *out_alert,
2575
+ CBS *contents) {
2576
+ SSL *const ssl = hs->ssl;
2577
+ if (contents == nullptr) {
2578
+ if (!ssl->quic_method) {
2579
+ return true;
2580
+ }
2581
+ assert(ssl->quic_method);
2582
+ *out_alert = SSL_AD_MISSING_EXTENSION;
2583
+ return false;
2584
+ }
2585
+ if (!ssl->quic_method) {
2586
+ *out_alert = SSL_AD_UNSUPPORTED_EXTENSION;
2587
+ return false;
2588
+ }
2589
+ // QUIC requires TLS 1.3.
2590
+ assert(ssl_protocol_version(ssl) == TLS1_3_VERSION);
2591
+
2592
+ return ssl->s3->peer_quic_transport_params.CopyFrom(*contents);
2593
+ }
2594
+
2595
+ static bool ext_quic_transport_params_parse_clienthello(SSL_HANDSHAKE *hs,
2596
+ uint8_t *out_alert,
2597
+ CBS *contents) {
2598
+ SSL *const ssl = hs->ssl;
2599
+ if (!contents) {
2600
+ if (!ssl->quic_method) {
2601
+ if (hs->config->quic_transport_params.empty()) {
2602
+ return true;
2603
+ }
2604
+ // QUIC transport parameters must not be set if |ssl| is not configured
2605
+ // for QUIC.
2606
+ OPENSSL_PUT_ERROR(SSL, SSL_R_QUIC_TRANSPORT_PARAMETERS_MISCONFIGURED);
2607
+ *out_alert = SSL_AD_INTERNAL_ERROR;
2608
+ }
2609
+ *out_alert = SSL_AD_MISSING_EXTENSION;
2610
+ return false;
2611
+ }
2612
+ if (!ssl->quic_method) {
2613
+ *out_alert = SSL_AD_UNSUPPORTED_EXTENSION;
2614
+ return false;
2615
+ }
2616
+ assert(ssl_protocol_version(ssl) == TLS1_3_VERSION);
2617
+ return ssl->s3->peer_quic_transport_params.CopyFrom(*contents);
2618
+ }
2619
+
2620
+ static bool ext_quic_transport_params_add_serverhello(SSL_HANDSHAKE *hs,
2621
+ CBB *out) {
2622
+ assert(hs->ssl->quic_method != nullptr);
2623
+ if (hs->config->quic_transport_params.empty()) {
2624
+ // Transport parameters must be set when using QUIC.
2625
+ OPENSSL_PUT_ERROR(SSL, SSL_R_QUIC_TRANSPORT_PARAMETERS_MISCONFIGURED);
2626
+ return false;
2627
+ }
2628
+
2629
+ CBB contents;
2630
+ if (!CBB_add_u16(out, TLSEXT_TYPE_quic_transport_parameters) ||
2631
+ !CBB_add_u16_length_prefixed(out, &contents) ||
2632
+ !CBB_add_bytes(&contents, hs->config->quic_transport_params.data(),
2633
+ hs->config->quic_transport_params.size()) ||
2634
+ !CBB_flush(out)) {
2635
+ return false;
2636
+ }
2637
+
2638
+ return true;
2639
+ }
2640
+
2641
+ // Delegated credentials.
2642
+ //
2643
+ // https://tools.ietf.org/html/draft-ietf-tls-subcerts
2644
+
2645
+ static bool ext_delegated_credential_add_clienthello(SSL_HANDSHAKE *hs,
2646
+ CBB *out) {
2647
+ return true;
2648
+ }
2649
+
2650
+ static bool ext_delegated_credential_parse_clienthello(SSL_HANDSHAKE *hs,
2651
+ uint8_t *out_alert,
2652
+ CBS *contents) {
2653
+ assert(TLSEXT_TYPE_delegated_credential == 0xff02);
2654
+ // TODO: Check that the extension is empty.
2655
+ //
2656
+ // As of draft-03, the client sends an empty extension in order indicate
2657
+ // support for delegated credentials. This could change, however, since the
2658
+ // spec is not yet finalized. This assertion is here to remind us to enforce
2659
+ // this check once the extension ID is assigned.
2660
+
2661
+ if (contents == nullptr || ssl_protocol_version(hs->ssl) < TLS1_3_VERSION) {
2662
+ // Don't use delegated credentials unless we're negotiating TLS 1.3 or
2663
+ // higher.
2664
+ return true;
2665
+ }
2666
+
2667
+ hs->delegated_credential_requested = true;
2668
+ return true;
2669
+ }
2670
+
2671
+ // Certificate compression
2672
+
2673
+ static bool cert_compression_add_clienthello(SSL_HANDSHAKE *hs, CBB *out) {
2674
+ bool first = true;
2675
+ CBB contents, algs;
2676
+
2677
+ for (const auto &alg : hs->ssl->ctx->cert_compression_algs) {
2678
+ if (alg.decompress == nullptr) {
2679
+ continue;
2680
+ }
2681
+
2682
+ if (first && (!CBB_add_u16(out, TLSEXT_TYPE_cert_compression) ||
2683
+ !CBB_add_u16_length_prefixed(out, &contents) ||
2684
+ !CBB_add_u8_length_prefixed(&contents, &algs))) {
2685
+ return false;
2686
+ }
2687
+ first = false;
2688
+ if (!CBB_add_u16(&algs, alg.alg_id)) {
2689
+ return false;
2690
+ }
2691
+ }
2692
+
2693
+ return first || CBB_flush(out);
2694
+ }
2695
+
2696
+ static bool cert_compression_parse_serverhello(SSL_HANDSHAKE *hs,
2697
+ uint8_t *out_alert,
2698
+ CBS *contents) {
2699
+ if (contents == nullptr) {
2700
+ return true;
2701
+ }
2702
+
2703
+ // The server may not echo this extension. Any server to client negotiation is
2704
+ // advertised in the CertificateRequest message.
2705
+ return false;
2706
+ }
2707
+
2708
+ static bool cert_compression_parse_clienthello(SSL_HANDSHAKE *hs,
2709
+ uint8_t *out_alert,
2710
+ CBS *contents) {
2711
+ if (contents == nullptr) {
2712
+ return true;
2713
+ }
2714
+
2715
+ const SSL_CTX *ctx = hs->ssl->ctx.get();
2716
+ const size_t num_algs = ctx->cert_compression_algs.size();
2717
+
2718
+ CBS alg_ids;
2719
+ if (!CBS_get_u8_length_prefixed(contents, &alg_ids) ||
2720
+ CBS_len(contents) != 0 ||
2721
+ CBS_len(&alg_ids) == 0 ||
2722
+ CBS_len(&alg_ids) % 2 == 1) {
2723
+ return false;
2724
+ }
2725
+
2726
+ const size_t num_given_alg_ids = CBS_len(&alg_ids) / 2;
2727
+ Array<uint16_t> given_alg_ids;
2728
+ if (!given_alg_ids.Init(num_given_alg_ids)) {
2729
+ return false;
2730
+ }
2731
+
2732
+ size_t best_index = num_algs;
2733
+ size_t given_alg_idx = 0;
2734
+
2735
+ while (CBS_len(&alg_ids) > 0) {
2736
+ uint16_t alg_id;
2737
+ if (!CBS_get_u16(&alg_ids, &alg_id)) {
2738
+ return false;
2739
+ }
2740
+
2741
+ given_alg_ids[given_alg_idx++] = alg_id;
2742
+
2743
+ for (size_t i = 0; i < num_algs; i++) {
2744
+ const auto &alg = ctx->cert_compression_algs[i];
2745
+ if (alg.alg_id == alg_id && alg.compress != nullptr) {
2746
+ if (i < best_index) {
2747
+ best_index = i;
2748
+ }
2749
+ break;
2750
+ }
2751
+ }
2752
+ }
2753
+
2754
+ qsort(given_alg_ids.data(), given_alg_ids.size(), sizeof(uint16_t),
2755
+ compare_uint16_t);
2756
+ for (size_t i = 1; i < num_given_alg_ids; i++) {
2757
+ if (given_alg_ids[i - 1] == given_alg_ids[i]) {
2758
+ return false;
2759
+ }
2760
+ }
2761
+
2762
+ if (best_index < num_algs &&
2763
+ ssl_protocol_version(hs->ssl) >= TLS1_3_VERSION) {
2764
+ hs->cert_compression_negotiated = true;
2765
+ hs->cert_compression_alg_id = ctx->cert_compression_algs[best_index].alg_id;
2766
+ }
2767
+
2768
+ return true;
2769
+ }
2770
+
2771
+ static bool cert_compression_add_serverhello(SSL_HANDSHAKE *hs, CBB *out) {
2772
+ return true;
2773
+ }
2774
+
2775
+
2776
+ // kExtensions contains all the supported extensions.
2777
+ static const struct tls_extension kExtensions[] = {
2778
+ {
2779
+ TLSEXT_TYPE_server_name,
2780
+ NULL,
2781
+ ext_sni_add_clienthello,
2782
+ ext_sni_parse_serverhello,
2783
+ ext_sni_parse_clienthello,
2784
+ ext_sni_add_serverhello,
2785
+ },
2786
+ {
2787
+ TLSEXT_TYPE_extended_master_secret,
2788
+ NULL,
2789
+ ext_ems_add_clienthello,
2790
+ ext_ems_parse_serverhello,
2791
+ ext_ems_parse_clienthello,
2792
+ ext_ems_add_serverhello,
2793
+ },
2794
+ {
2795
+ TLSEXT_TYPE_renegotiate,
2796
+ NULL,
2797
+ ext_ri_add_clienthello,
2798
+ ext_ri_parse_serverhello,
2799
+ ext_ri_parse_clienthello,
2800
+ ext_ri_add_serverhello,
2801
+ },
2802
+ {
2803
+ TLSEXT_TYPE_supported_groups,
2804
+ NULL,
2805
+ ext_supported_groups_add_clienthello,
2806
+ ext_supported_groups_parse_serverhello,
2807
+ ext_supported_groups_parse_clienthello,
2808
+ dont_add_serverhello,
2809
+ },
2810
+ {
2811
+ TLSEXT_TYPE_ec_point_formats,
2812
+ NULL,
2813
+ ext_ec_point_add_clienthello,
2814
+ ext_ec_point_parse_serverhello,
2815
+ ext_ec_point_parse_clienthello,
2816
+ ext_ec_point_add_serverhello,
2817
+ },
2818
+ {
2819
+ TLSEXT_TYPE_session_ticket,
2820
+ NULL,
2821
+ ext_ticket_add_clienthello,
2822
+ ext_ticket_parse_serverhello,
2823
+ // Ticket extension client parsing is handled in ssl_session.c
2824
+ ignore_parse_clienthello,
2825
+ ext_ticket_add_serverhello,
2826
+ },
2827
+ {
2828
+ TLSEXT_TYPE_application_layer_protocol_negotiation,
2829
+ NULL,
2830
+ ext_alpn_add_clienthello,
2831
+ ext_alpn_parse_serverhello,
2832
+ // ALPN is negotiated late in |ssl_negotiate_alpn|.
2833
+ ignore_parse_clienthello,
2834
+ ext_alpn_add_serverhello,
2835
+ },
2836
+ {
2837
+ TLSEXT_TYPE_status_request,
2838
+ NULL,
2839
+ ext_ocsp_add_clienthello,
2840
+ ext_ocsp_parse_serverhello,
2841
+ ext_ocsp_parse_clienthello,
2842
+ ext_ocsp_add_serverhello,
2843
+ },
2844
+ {
2845
+ TLSEXT_TYPE_signature_algorithms,
2846
+ NULL,
2847
+ ext_sigalgs_add_clienthello,
2848
+ forbid_parse_serverhello,
2849
+ ext_sigalgs_parse_clienthello,
2850
+ dont_add_serverhello,
2851
+ },
2852
+ {
2853
+ TLSEXT_TYPE_next_proto_neg,
2854
+ NULL,
2855
+ ext_npn_add_clienthello,
2856
+ ext_npn_parse_serverhello,
2857
+ ext_npn_parse_clienthello,
2858
+ ext_npn_add_serverhello,
2859
+ },
2860
+ {
2861
+ TLSEXT_TYPE_certificate_timestamp,
2862
+ NULL,
2863
+ ext_sct_add_clienthello,
2864
+ ext_sct_parse_serverhello,
2865
+ ext_sct_parse_clienthello,
2866
+ ext_sct_add_serverhello,
2867
+ },
2868
+ {
2869
+ TLSEXT_TYPE_channel_id,
2870
+ ext_channel_id_init,
2871
+ ext_channel_id_add_clienthello,
2872
+ ext_channel_id_parse_serverhello,
2873
+ ext_channel_id_parse_clienthello,
2874
+ ext_channel_id_add_serverhello,
2875
+ },
2876
+ {
2877
+ TLSEXT_TYPE_srtp,
2878
+ ext_srtp_init,
2879
+ ext_srtp_add_clienthello,
2880
+ ext_srtp_parse_serverhello,
2881
+ ext_srtp_parse_clienthello,
2882
+ ext_srtp_add_serverhello,
2883
+ },
2884
+ {
2885
+ TLSEXT_TYPE_key_share,
2886
+ NULL,
2887
+ ext_key_share_add_clienthello,
2888
+ forbid_parse_serverhello,
2889
+ ignore_parse_clienthello,
2890
+ dont_add_serverhello,
2891
+ },
2892
+ {
2893
+ TLSEXT_TYPE_psk_key_exchange_modes,
2894
+ NULL,
2895
+ ext_psk_key_exchange_modes_add_clienthello,
2896
+ forbid_parse_serverhello,
2897
+ ext_psk_key_exchange_modes_parse_clienthello,
2898
+ dont_add_serverhello,
2899
+ },
2900
+ {
2901
+ TLSEXT_TYPE_early_data,
2902
+ NULL,
2903
+ ext_early_data_add_clienthello,
2904
+ ext_early_data_parse_serverhello,
2905
+ ext_early_data_parse_clienthello,
2906
+ ext_early_data_add_serverhello,
2907
+ },
2908
+ {
2909
+ TLSEXT_TYPE_supported_versions,
2910
+ NULL,
2911
+ ext_supported_versions_add_clienthello,
2912
+ forbid_parse_serverhello,
2913
+ ignore_parse_clienthello,
2914
+ dont_add_serverhello,
2915
+ },
2916
+ {
2917
+ TLSEXT_TYPE_cookie,
2918
+ NULL,
2919
+ ext_cookie_add_clienthello,
2920
+ forbid_parse_serverhello,
2921
+ ignore_parse_clienthello,
2922
+ dont_add_serverhello,
2923
+ },
2924
+ {
2925
+ TLSEXT_TYPE_quic_transport_parameters,
2926
+ NULL,
2927
+ ext_quic_transport_params_add_clienthello,
2928
+ ext_quic_transport_params_parse_serverhello,
2929
+ ext_quic_transport_params_parse_clienthello,
2930
+ ext_quic_transport_params_add_serverhello,
2931
+ },
2932
+ {
2933
+ TLSEXT_TYPE_token_binding,
2934
+ NULL,
2935
+ ext_token_binding_add_clienthello,
2936
+ ext_token_binding_parse_serverhello,
2937
+ ext_token_binding_parse_clienthello,
2938
+ ext_token_binding_add_serverhello,
2939
+ },
2940
+ {
2941
+ TLSEXT_TYPE_cert_compression,
2942
+ NULL,
2943
+ cert_compression_add_clienthello,
2944
+ cert_compression_parse_serverhello,
2945
+ cert_compression_parse_clienthello,
2946
+ cert_compression_add_serverhello,
2947
+ },
2948
+ {
2949
+ TLSEXT_TYPE_delegated_credential,
2950
+ NULL,
2951
+ ext_delegated_credential_add_clienthello,
2952
+ forbid_parse_serverhello,
2953
+ ext_delegated_credential_parse_clienthello,
2954
+ dont_add_serverhello,
2955
+ },
2956
+ };
2957
+
2958
+ #define kNumExtensions (sizeof(kExtensions) / sizeof(struct tls_extension))
2959
+
2960
+ static_assert(kNumExtensions <=
2961
+ sizeof(((SSL_HANDSHAKE *)NULL)->extensions.sent) * 8,
2962
+ "too many extensions for sent bitset");
2963
+ static_assert(kNumExtensions <=
2964
+ sizeof(((SSL_HANDSHAKE *)NULL)->extensions.received) * 8,
2965
+ "too many extensions for received bitset");
2966
+
2967
+ static const struct tls_extension *tls_extension_find(uint32_t *out_index,
2968
+ uint16_t value) {
2969
+ unsigned i;
2970
+ for (i = 0; i < kNumExtensions; i++) {
2971
+ if (kExtensions[i].value == value) {
2972
+ *out_index = i;
2973
+ return &kExtensions[i];
2974
+ }
2975
+ }
2976
+
2977
+ return NULL;
2978
+ }
2979
+
2980
+ bool ssl_add_clienthello_tlsext(SSL_HANDSHAKE *hs, CBB *out,
2981
+ size_t header_len) {
2982
+ SSL *const ssl = hs->ssl;
2983
+ CBB extensions;
2984
+ if (!CBB_add_u16_length_prefixed(out, &extensions)) {
2985
+ OPENSSL_PUT_ERROR(SSL, ERR_R_INTERNAL_ERROR);
2986
+ return false;
2987
+ }
2988
+
2989
+ // Note we may send multiple ClientHellos for DTLS HelloVerifyRequest and TLS
2990
+ // 1.3 HelloRetryRequest. For the latter, the extensions may change, so it is
2991
+ // important to reset this value.
2992
+ hs->extensions.sent = 0;
2993
+
2994
+ for (size_t i = 0; i < kNumExtensions; i++) {
2995
+ if (kExtensions[i].init != NULL) {
2996
+ kExtensions[i].init(hs);
2997
+ }
2998
+ }
2999
+
3000
+ uint16_t grease_ext1 = 0;
3001
+ if (ssl->ctx->grease_enabled) {
3002
+ // Add a fake empty extension. See draft-davidben-tls-grease-01.
3003
+ grease_ext1 = ssl_get_grease_value(hs, ssl_grease_extension1);
3004
+ if (!CBB_add_u16(&extensions, grease_ext1) ||
3005
+ !CBB_add_u16(&extensions, 0 /* zero length */)) {
3006
+ OPENSSL_PUT_ERROR(SSL, ERR_R_INTERNAL_ERROR);
3007
+ return false;
3008
+ }
3009
+ }
3010
+
3011
+ bool last_was_empty = false;
3012
+ for (size_t i = 0; i < kNumExtensions; i++) {
3013
+ const size_t len_before = CBB_len(&extensions);
3014
+ if (!kExtensions[i].add_clienthello(hs, &extensions)) {
3015
+ OPENSSL_PUT_ERROR(SSL, SSL_R_ERROR_ADDING_EXTENSION);
3016
+ ERR_add_error_dataf("extension %u", (unsigned)kExtensions[i].value);
3017
+ return false;
3018
+ }
3019
+
3020
+ const size_t bytes_written = CBB_len(&extensions) - len_before;
3021
+ if (bytes_written != 0) {
3022
+ hs->extensions.sent |= (1u << i);
3023
+ }
3024
+ // If the difference in lengths is only four bytes then the extension had
3025
+ // an empty body.
3026
+ last_was_empty = (bytes_written == 4);
3027
+ }
3028
+
3029
+ if (ssl->ctx->grease_enabled) {
3030
+ // Add a fake non-empty extension. See draft-davidben-tls-grease-01.
3031
+ uint16_t grease_ext2 = ssl_get_grease_value(hs, ssl_grease_extension2);
3032
+
3033
+ // The two fake extensions must not have the same value. GREASE values are
3034
+ // of the form 0x1a1a, 0x2a2a, 0x3a3a, etc., so XOR to generate a different
3035
+ // one.
3036
+ if (grease_ext1 == grease_ext2) {
3037
+ grease_ext2 ^= 0x1010;
3038
+ }
3039
+
3040
+ if (!CBB_add_u16(&extensions, grease_ext2) ||
3041
+ !CBB_add_u16(&extensions, 1 /* one byte length */) ||
3042
+ !CBB_add_u8(&extensions, 0 /* single zero byte as contents */)) {
3043
+ OPENSSL_PUT_ERROR(SSL, ERR_R_INTERNAL_ERROR);
3044
+ return false;
3045
+ }
3046
+
3047
+ last_was_empty = false;
3048
+ }
3049
+
3050
+ if (!SSL_is_dtls(ssl)) {
3051
+ size_t psk_extension_len = ext_pre_shared_key_clienthello_length(hs);
3052
+ header_len += 2 + CBB_len(&extensions) + psk_extension_len;
3053
+ size_t padding_len = 0;
3054
+
3055
+ // The final extension must be non-empty. WebSphere Application
3056
+ // Server 7.0 is intolerant to the last extension being zero-length. See
3057
+ // https://crbug.com/363583.
3058
+ if (last_was_empty && psk_extension_len == 0) {
3059
+ padding_len = 1;
3060
+ // The addition of the padding extension may push us into the F5 bug.
3061
+ header_len += 4 + padding_len;
3062
+ }
3063
+
3064
+ // Add padding to workaround bugs in F5 terminators. See RFC 7685.
3065
+ //
3066
+ // NB: because this code works out the length of all existing extensions
3067
+ // it MUST always appear last (save for any PSK extension).
3068
+ if (header_len > 0xff && header_len < 0x200) {
3069
+ // If our calculations already included a padding extension, remove that
3070
+ // factor because we're about to change its length.
3071
+ if (padding_len != 0) {
3072
+ header_len -= 4 + padding_len;
3073
+ }
3074
+ padding_len = 0x200 - header_len;
3075
+ // Extensions take at least four bytes to encode. Always include at least
3076
+ // one byte of data if including the extension. WebSphere Application
3077
+ // Server 7.0 is intolerant to the last extension being zero-length. See
3078
+ // https://crbug.com/363583.
3079
+ if (padding_len >= 4 + 1) {
3080
+ padding_len -= 4;
3081
+ } else {
3082
+ padding_len = 1;
3083
+ }
3084
+ }
3085
+
3086
+ if (padding_len != 0) {
3087
+ uint8_t *padding_bytes;
3088
+ if (!CBB_add_u16(&extensions, TLSEXT_TYPE_padding) ||
3089
+ !CBB_add_u16(&extensions, padding_len) ||
3090
+ !CBB_add_space(&extensions, &padding_bytes, padding_len)) {
3091
+ OPENSSL_PUT_ERROR(SSL, ERR_R_INTERNAL_ERROR);
3092
+ return false;
3093
+ }
3094
+
3095
+ OPENSSL_memset(padding_bytes, 0, padding_len);
3096
+ }
3097
+ }
3098
+
3099
+ // The PSK extension must be last, including after the padding.
3100
+ if (!ext_pre_shared_key_add_clienthello(hs, &extensions)) {
3101
+ OPENSSL_PUT_ERROR(SSL, ERR_R_INTERNAL_ERROR);
3102
+ return false;
3103
+ }
3104
+
3105
+ // Discard empty extensions blocks.
3106
+ if (CBB_len(&extensions) == 0) {
3107
+ CBB_discard_child(out);
3108
+ }
3109
+
3110
+ return CBB_flush(out);
3111
+ }
3112
+
3113
+ bool ssl_add_serverhello_tlsext(SSL_HANDSHAKE *hs, CBB *out) {
3114
+ SSL *const ssl = hs->ssl;
3115
+ CBB extensions;
3116
+ if (!CBB_add_u16_length_prefixed(out, &extensions)) {
3117
+ goto err;
3118
+ }
3119
+
3120
+ for (unsigned i = 0; i < kNumExtensions; i++) {
3121
+ if (!(hs->extensions.received & (1u << i))) {
3122
+ // Don't send extensions that were not received.
3123
+ continue;
3124
+ }
3125
+
3126
+ if (!kExtensions[i].add_serverhello(hs, &extensions)) {
3127
+ OPENSSL_PUT_ERROR(SSL, SSL_R_ERROR_ADDING_EXTENSION);
3128
+ ERR_add_error_dataf("extension %u", (unsigned)kExtensions[i].value);
3129
+ goto err;
3130
+ }
3131
+ }
3132
+
3133
+ // Discard empty extensions blocks before TLS 1.3.
3134
+ if (ssl_protocol_version(ssl) < TLS1_3_VERSION &&
3135
+ CBB_len(&extensions) == 0) {
3136
+ CBB_discard_child(out);
3137
+ }
3138
+
3139
+ return CBB_flush(out);
3140
+
3141
+ err:
3142
+ OPENSSL_PUT_ERROR(SSL, ERR_R_INTERNAL_ERROR);
3143
+ return false;
3144
+ }
3145
+
3146
+ static bool ssl_scan_clienthello_tlsext(SSL_HANDSHAKE *hs,
3147
+ const SSL_CLIENT_HELLO *client_hello,
3148
+ int *out_alert) {
3149
+ for (size_t i = 0; i < kNumExtensions; i++) {
3150
+ if (kExtensions[i].init != NULL) {
3151
+ kExtensions[i].init(hs);
3152
+ }
3153
+ }
3154
+
3155
+ hs->extensions.received = 0;
3156
+ CBS extensions;
3157
+ CBS_init(&extensions, client_hello->extensions, client_hello->extensions_len);
3158
+ while (CBS_len(&extensions) != 0) {
3159
+ uint16_t type;
3160
+ CBS extension;
3161
+
3162
+ // Decode the next extension.
3163
+ if (!CBS_get_u16(&extensions, &type) ||
3164
+ !CBS_get_u16_length_prefixed(&extensions, &extension)) {
3165
+ *out_alert = SSL_AD_DECODE_ERROR;
3166
+ return false;
3167
+ }
3168
+
3169
+ unsigned ext_index;
3170
+ const struct tls_extension *const ext =
3171
+ tls_extension_find(&ext_index, type);
3172
+ if (ext == NULL) {
3173
+ continue;
3174
+ }
3175
+
3176
+ hs->extensions.received |= (1u << ext_index);
3177
+ uint8_t alert = SSL_AD_DECODE_ERROR;
3178
+ if (!ext->parse_clienthello(hs, &alert, &extension)) {
3179
+ *out_alert = alert;
3180
+ OPENSSL_PUT_ERROR(SSL, SSL_R_ERROR_PARSING_EXTENSION);
3181
+ ERR_add_error_dataf("extension %u", (unsigned)type);
3182
+ return false;
3183
+ }
3184
+ }
3185
+
3186
+ for (size_t i = 0; i < kNumExtensions; i++) {
3187
+ if (hs->extensions.received & (1u << i)) {
3188
+ continue;
3189
+ }
3190
+
3191
+ CBS *contents = NULL, fake_contents;
3192
+ static const uint8_t kFakeRenegotiateExtension[] = {0};
3193
+ if (kExtensions[i].value == TLSEXT_TYPE_renegotiate &&
3194
+ ssl_client_cipher_list_contains_cipher(client_hello,
3195
+ SSL3_CK_SCSV & 0xffff)) {
3196
+ // The renegotiation SCSV was received so pretend that we received a
3197
+ // renegotiation extension.
3198
+ CBS_init(&fake_contents, kFakeRenegotiateExtension,
3199
+ sizeof(kFakeRenegotiateExtension));
3200
+ contents = &fake_contents;
3201
+ hs->extensions.received |= (1u << i);
3202
+ }
3203
+
3204
+ // Extension wasn't observed so call the callback with a NULL
3205
+ // parameter.
3206
+ uint8_t alert = SSL_AD_DECODE_ERROR;
3207
+ if (!kExtensions[i].parse_clienthello(hs, &alert, contents)) {
3208
+ OPENSSL_PUT_ERROR(SSL, SSL_R_MISSING_EXTENSION);
3209
+ ERR_add_error_dataf("extension %u", (unsigned)kExtensions[i].value);
3210
+ *out_alert = alert;
3211
+ return false;
3212
+ }
3213
+ }
3214
+
3215
+ return true;
3216
+ }
3217
+
3218
+ bool ssl_parse_clienthello_tlsext(SSL_HANDSHAKE *hs,
3219
+ const SSL_CLIENT_HELLO *client_hello) {
3220
+ SSL *const ssl = hs->ssl;
3221
+ int alert = SSL_AD_DECODE_ERROR;
3222
+ if (!ssl_scan_clienthello_tlsext(hs, client_hello, &alert)) {
3223
+ ssl_send_alert(ssl, SSL3_AL_FATAL, alert);
3224
+ return false;
3225
+ }
3226
+
3227
+ if (!ssl_check_clienthello_tlsext(hs)) {
3228
+ OPENSSL_PUT_ERROR(SSL, SSL_R_CLIENTHELLO_TLSEXT);
3229
+ return false;
3230
+ }
3231
+
3232
+ return true;
3233
+ }
3234
+
3235
+ static bool ssl_scan_serverhello_tlsext(SSL_HANDSHAKE *hs, CBS *cbs,
3236
+ int *out_alert) {
3237
+ SSL *const ssl = hs->ssl;
3238
+ // Before TLS 1.3, ServerHello extensions blocks may be omitted if empty.
3239
+ if (CBS_len(cbs) == 0 && ssl_protocol_version(ssl) < TLS1_3_VERSION) {
3240
+ return true;
3241
+ }
3242
+
3243
+ // Decode the extensions block and check it is valid.
3244
+ CBS extensions;
3245
+ if (!CBS_get_u16_length_prefixed(cbs, &extensions) ||
3246
+ !tls1_check_duplicate_extensions(&extensions)) {
3247
+ *out_alert = SSL_AD_DECODE_ERROR;
3248
+ return false;
3249
+ }
3250
+
3251
+ uint32_t received = 0;
3252
+ while (CBS_len(&extensions) != 0) {
3253
+ uint16_t type;
3254
+ CBS extension;
3255
+
3256
+ // Decode the next extension.
3257
+ if (!CBS_get_u16(&extensions, &type) ||
3258
+ !CBS_get_u16_length_prefixed(&extensions, &extension)) {
3259
+ *out_alert = SSL_AD_DECODE_ERROR;
3260
+ return false;
3261
+ }
3262
+
3263
+ unsigned ext_index;
3264
+ const struct tls_extension *const ext =
3265
+ tls_extension_find(&ext_index, type);
3266
+
3267
+ if (ext == NULL) {
3268
+ OPENSSL_PUT_ERROR(SSL, SSL_R_UNEXPECTED_EXTENSION);
3269
+ ERR_add_error_dataf("extension %u", (unsigned)type);
3270
+ *out_alert = SSL_AD_UNSUPPORTED_EXTENSION;
3271
+ return false;
3272
+ }
3273
+
3274
+ static_assert(kNumExtensions <= sizeof(hs->extensions.sent) * 8,
3275
+ "too many bits");
3276
+
3277
+ if (!(hs->extensions.sent & (1u << ext_index))) {
3278
+ // If the extension was never sent then it is illegal.
3279
+ OPENSSL_PUT_ERROR(SSL, SSL_R_UNEXPECTED_EXTENSION);
3280
+ ERR_add_error_dataf("extension :%u", (unsigned)type);
3281
+ *out_alert = SSL_AD_UNSUPPORTED_EXTENSION;
3282
+ return false;
3283
+ }
3284
+
3285
+ received |= (1u << ext_index);
3286
+
3287
+ uint8_t alert = SSL_AD_DECODE_ERROR;
3288
+ if (!ext->parse_serverhello(hs, &alert, &extension)) {
3289
+ OPENSSL_PUT_ERROR(SSL, SSL_R_ERROR_PARSING_EXTENSION);
3290
+ ERR_add_error_dataf("extension %u", (unsigned)type);
3291
+ *out_alert = alert;
3292
+ return false;
3293
+ }
3294
+ }
3295
+
3296
+ for (size_t i = 0; i < kNumExtensions; i++) {
3297
+ if (!(received & (1u << i))) {
3298
+ // Extension wasn't observed so call the callback with a NULL
3299
+ // parameter.
3300
+ uint8_t alert = SSL_AD_DECODE_ERROR;
3301
+ if (!kExtensions[i].parse_serverhello(hs, &alert, NULL)) {
3302
+ OPENSSL_PUT_ERROR(SSL, SSL_R_MISSING_EXTENSION);
3303
+ ERR_add_error_dataf("extension %u", (unsigned)kExtensions[i].value);
3304
+ *out_alert = alert;
3305
+ return false;
3306
+ }
3307
+ }
3308
+ }
3309
+
3310
+ return true;
3311
+ }
3312
+
3313
+ static bool ssl_check_clienthello_tlsext(SSL_HANDSHAKE *hs) {
3314
+ SSL *const ssl = hs->ssl;
3315
+
3316
+ if (ssl->s3->token_binding_negotiated &&
3317
+ !(SSL_get_secure_renegotiation_support(ssl) &&
3318
+ SSL_get_extms_support(ssl))) {
3319
+ OPENSSL_PUT_ERROR(SSL, SSL_R_NEGOTIATED_TB_WITHOUT_EMS_OR_RI);
3320
+ ssl_send_alert(ssl, SSL3_AL_FATAL, SSL_AD_UNSUPPORTED_EXTENSION);
3321
+ return false;
3322
+ }
3323
+
3324
+ int ret = SSL_TLSEXT_ERR_NOACK;
3325
+ int al = SSL_AD_UNRECOGNIZED_NAME;
3326
+
3327
+ if (ssl->ctx->servername_callback != 0) {
3328
+ ret = ssl->ctx->servername_callback(ssl, &al, ssl->ctx->servername_arg);
3329
+ } else if (ssl->session_ctx->servername_callback != 0) {
3330
+ ret = ssl->session_ctx->servername_callback(
3331
+ ssl, &al, ssl->session_ctx->servername_arg);
3332
+ }
3333
+
3334
+ switch (ret) {
3335
+ case SSL_TLSEXT_ERR_ALERT_FATAL:
3336
+ ssl_send_alert(ssl, SSL3_AL_FATAL, al);
3337
+ return false;
3338
+
3339
+ case SSL_TLSEXT_ERR_NOACK:
3340
+ hs->should_ack_sni = false;
3341
+ return true;
3342
+
3343
+ default:
3344
+ return true;
3345
+ }
3346
+ }
3347
+
3348
+ bool ssl_parse_serverhello_tlsext(SSL_HANDSHAKE *hs, CBS *cbs) {
3349
+ SSL *const ssl = hs->ssl;
3350
+ int alert = SSL_AD_DECODE_ERROR;
3351
+ if (!ssl_scan_serverhello_tlsext(hs, cbs, &alert)) {
3352
+ ssl_send_alert(ssl, SSL3_AL_FATAL, alert);
3353
+ return false;
3354
+ }
3355
+
3356
+ return true;
3357
+ }
3358
+
3359
+ static enum ssl_ticket_aead_result_t decrypt_ticket_with_cipher_ctx(
3360
+ Array<uint8_t> *out, EVP_CIPHER_CTX *cipher_ctx, HMAC_CTX *hmac_ctx,
3361
+ Span<const uint8_t> ticket) {
3362
+ size_t iv_len = EVP_CIPHER_CTX_iv_length(cipher_ctx);
3363
+
3364
+ // Check the MAC at the end of the ticket.
3365
+ uint8_t mac[EVP_MAX_MD_SIZE];
3366
+ size_t mac_len = HMAC_size(hmac_ctx);
3367
+ if (ticket.size() < SSL_TICKET_KEY_NAME_LEN + iv_len + 1 + mac_len) {
3368
+ // The ticket must be large enough for key name, IV, data, and MAC.
3369
+ return ssl_ticket_aead_ignore_ticket;
3370
+ }
3371
+ // Split the ticket into the ticket and the MAC.
3372
+ auto ticket_mac = ticket.subspan(ticket.size() - mac_len);
3373
+ ticket = ticket.subspan(0, ticket.size() - mac_len);
3374
+ HMAC_Update(hmac_ctx, ticket.data(), ticket.size());
3375
+ HMAC_Final(hmac_ctx, mac, NULL);
3376
+ assert(mac_len == ticket_mac.size());
3377
+ bool mac_ok = CRYPTO_memcmp(mac, ticket_mac.data(), mac_len) == 0;
3378
+ #if defined(BORINGSSL_UNSAFE_FUZZER_MODE)
3379
+ mac_ok = true;
3380
+ #endif
3381
+ if (!mac_ok) {
3382
+ return ssl_ticket_aead_ignore_ticket;
3383
+ }
3384
+
3385
+ // Decrypt the session data.
3386
+ auto ciphertext = ticket.subspan(SSL_TICKET_KEY_NAME_LEN + iv_len);
3387
+ Array<uint8_t> plaintext;
3388
+ #if defined(BORINGSSL_UNSAFE_FUZZER_MODE)
3389
+ if (!plaintext.CopyFrom(ciphertext)) {
3390
+ return ssl_ticket_aead_error;
3391
+ }
3392
+ #else
3393
+ if (ciphertext.size() >= INT_MAX) {
3394
+ return ssl_ticket_aead_ignore_ticket;
3395
+ }
3396
+ if (!plaintext.Init(ciphertext.size())) {
3397
+ return ssl_ticket_aead_error;
3398
+ }
3399
+ int len1, len2;
3400
+ if (!EVP_DecryptUpdate(cipher_ctx, plaintext.data(), &len1, ciphertext.data(),
3401
+ (int)ciphertext.size()) ||
3402
+ !EVP_DecryptFinal_ex(cipher_ctx, plaintext.data() + len1, &len2)) {
3403
+ ERR_clear_error();
3404
+ return ssl_ticket_aead_ignore_ticket;
3405
+ }
3406
+ plaintext.Shrink(static_cast<size_t>(len1) + len2);
3407
+ #endif
3408
+
3409
+ *out = std::move(plaintext);
3410
+ return ssl_ticket_aead_success;
3411
+ }
3412
+
3413
+ static enum ssl_ticket_aead_result_t ssl_decrypt_ticket_with_cb(
3414
+ SSL_HANDSHAKE *hs, Array<uint8_t> *out, bool *out_renew_ticket,
3415
+ Span<const uint8_t> ticket) {
3416
+ assert(ticket.size() >= SSL_TICKET_KEY_NAME_LEN + EVP_MAX_IV_LENGTH);
3417
+ ScopedEVP_CIPHER_CTX cipher_ctx;
3418
+ ScopedHMAC_CTX hmac_ctx;
3419
+ auto name = ticket.subspan(0, SSL_TICKET_KEY_NAME_LEN);
3420
+ // The actual IV is shorter, but the length is determined by the callback's
3421
+ // chosen cipher. Instead we pass in |EVP_MAX_IV_LENGTH| worth of IV to ensure
3422
+ // the callback has enough.
3423
+ auto iv = ticket.subspan(SSL_TICKET_KEY_NAME_LEN, EVP_MAX_IV_LENGTH);
3424
+ int cb_ret = hs->ssl->session_ctx->ticket_key_cb(
3425
+ hs->ssl, const_cast<uint8_t *>(name.data()),
3426
+ const_cast<uint8_t *>(iv.data()), cipher_ctx.get(), hmac_ctx.get(),
3427
+ 0 /* decrypt */);
3428
+ if (cb_ret < 0) {
3429
+ return ssl_ticket_aead_error;
3430
+ } else if (cb_ret == 0) {
3431
+ return ssl_ticket_aead_ignore_ticket;
3432
+ } else if (cb_ret == 2) {
3433
+ *out_renew_ticket = true;
3434
+ } else {
3435
+ assert(cb_ret == 1);
3436
+ }
3437
+ return decrypt_ticket_with_cipher_ctx(out, cipher_ctx.get(), hmac_ctx.get(),
3438
+ ticket);
3439
+ }
3440
+
3441
+ static enum ssl_ticket_aead_result_t ssl_decrypt_ticket_with_ticket_keys(
3442
+ SSL_HANDSHAKE *hs, Array<uint8_t> *out, Span<const uint8_t> ticket) {
3443
+ assert(ticket.size() >= SSL_TICKET_KEY_NAME_LEN + EVP_MAX_IV_LENGTH);
3444
+ SSL_CTX *ctx = hs->ssl->session_ctx.get();
3445
+
3446
+ // Rotate the ticket key if necessary.
3447
+ if (!ssl_ctx_rotate_ticket_encryption_key(ctx)) {
3448
+ return ssl_ticket_aead_error;
3449
+ }
3450
+
3451
+ const EVP_CIPHER *cipher = EVP_aes_128_cbc();
3452
+ auto name = ticket.subspan(0, SSL_TICKET_KEY_NAME_LEN);
3453
+ auto iv =
3454
+ ticket.subspan(SSL_TICKET_KEY_NAME_LEN, EVP_CIPHER_iv_length(cipher));
3455
+
3456
+ // Pick the matching ticket key and decrypt.
3457
+ ScopedEVP_CIPHER_CTX cipher_ctx;
3458
+ ScopedHMAC_CTX hmac_ctx;
3459
+ {
3460
+ MutexReadLock lock(&ctx->lock);
3461
+ const TicketKey *key;
3462
+ if (ctx->ticket_key_current && name == ctx->ticket_key_current->name) {
3463
+ key = ctx->ticket_key_current.get();
3464
+ } else if (ctx->ticket_key_prev && name == ctx->ticket_key_prev->name) {
3465
+ key = ctx->ticket_key_prev.get();
3466
+ } else {
3467
+ return ssl_ticket_aead_ignore_ticket;
3468
+ }
3469
+ if (!HMAC_Init_ex(hmac_ctx.get(), key->hmac_key, sizeof(key->hmac_key),
3470
+ tlsext_tick_md(), NULL) ||
3471
+ !EVP_DecryptInit_ex(cipher_ctx.get(), cipher, NULL,
3472
+ key->aes_key, iv.data())) {
3473
+ return ssl_ticket_aead_error;
3474
+ }
3475
+ }
3476
+ return decrypt_ticket_with_cipher_ctx(out, cipher_ctx.get(), hmac_ctx.get(),
3477
+ ticket);
3478
+ }
3479
+
3480
+ static enum ssl_ticket_aead_result_t ssl_decrypt_ticket_with_method(
3481
+ SSL_HANDSHAKE *hs, Array<uint8_t> *out, bool *out_renew_ticket,
3482
+ Span<const uint8_t> ticket) {
3483
+ Array<uint8_t> plaintext;
3484
+ if (!plaintext.Init(ticket.size())) {
3485
+ OPENSSL_PUT_ERROR(SSL, ERR_R_MALLOC_FAILURE);
3486
+ return ssl_ticket_aead_error;
3487
+ }
3488
+
3489
+ size_t plaintext_len;
3490
+ const enum ssl_ticket_aead_result_t result =
3491
+ hs->ssl->session_ctx->ticket_aead_method->open(
3492
+ hs->ssl, plaintext.data(), &plaintext_len, ticket.size(),
3493
+ ticket.data(), ticket.size());
3494
+ if (result != ssl_ticket_aead_success) {
3495
+ return result;
3496
+ }
3497
+
3498
+ plaintext.Shrink(plaintext_len);
3499
+ *out = std::move(plaintext);
3500
+ return ssl_ticket_aead_success;
3501
+ }
3502
+
3503
+ enum ssl_ticket_aead_result_t ssl_process_ticket(
3504
+ SSL_HANDSHAKE *hs, UniquePtr<SSL_SESSION> *out_session,
3505
+ bool *out_renew_ticket, Span<const uint8_t> ticket,
3506
+ Span<const uint8_t> session_id) {
3507
+ *out_renew_ticket = false;
3508
+ out_session->reset();
3509
+
3510
+ if ((SSL_get_options(hs->ssl) & SSL_OP_NO_TICKET) ||
3511
+ session_id.size() > SSL_MAX_SSL_SESSION_ID_LENGTH) {
3512
+ return ssl_ticket_aead_ignore_ticket;
3513
+ }
3514
+
3515
+ Array<uint8_t> plaintext;
3516
+ enum ssl_ticket_aead_result_t result;
3517
+ if (hs->ssl->session_ctx->ticket_aead_method != NULL) {
3518
+ result = ssl_decrypt_ticket_with_method(hs, &plaintext, out_renew_ticket,
3519
+ ticket);
3520
+ } else {
3521
+ // Ensure there is room for the key name and the largest IV |ticket_key_cb|
3522
+ // may try to consume. The real limit may be lower, but the maximum IV
3523
+ // length should be well under the minimum size for the session material and
3524
+ // HMAC.
3525
+ if (ticket.size() < SSL_TICKET_KEY_NAME_LEN + EVP_MAX_IV_LENGTH) {
3526
+ return ssl_ticket_aead_ignore_ticket;
3527
+ }
3528
+ if (hs->ssl->session_ctx->ticket_key_cb != NULL) {
3529
+ result =
3530
+ ssl_decrypt_ticket_with_cb(hs, &plaintext, out_renew_ticket, ticket);
3531
+ } else {
3532
+ result = ssl_decrypt_ticket_with_ticket_keys(hs, &plaintext, ticket);
3533
+ }
3534
+ }
3535
+
3536
+ if (result != ssl_ticket_aead_success) {
3537
+ return result;
3538
+ }
3539
+
3540
+ // Decode the session.
3541
+ UniquePtr<SSL_SESSION> session(SSL_SESSION_from_bytes(
3542
+ plaintext.data(), plaintext.size(), hs->ssl->ctx.get()));
3543
+ if (!session) {
3544
+ ERR_clear_error(); // Don't leave an error on the queue.
3545
+ return ssl_ticket_aead_ignore_ticket;
3546
+ }
3547
+
3548
+ // Copy the client's session ID into the new session, to denote the ticket has
3549
+ // been accepted.
3550
+ OPENSSL_memcpy(session->session_id, session_id.data(), session_id.size());
3551
+ session->session_id_length = session_id.size();
3552
+
3553
+ *out_session = std::move(session);
3554
+ return ssl_ticket_aead_success;
3555
+ }
3556
+
3557
+ bool tls1_parse_peer_sigalgs(SSL_HANDSHAKE *hs, const CBS *in_sigalgs) {
3558
+ // Extension ignored for inappropriate versions
3559
+ if (ssl_protocol_version(hs->ssl) < TLS1_2_VERSION) {
3560
+ return true;
3561
+ }
3562
+
3563
+ // In all contexts, the signature algorithms list may not be empty. (It may be
3564
+ // omitted by clients in TLS 1.2, but then the entire extension is omitted.)
3565
+ return CBS_len(in_sigalgs) != 0 &&
3566
+ parse_u16_array(in_sigalgs, &hs->peer_sigalgs);
3567
+ }
3568
+
3569
+ bool tls1_get_legacy_signature_algorithm(uint16_t *out, const EVP_PKEY *pkey) {
3570
+ switch (EVP_PKEY_id(pkey)) {
3571
+ case EVP_PKEY_RSA:
3572
+ *out = SSL_SIGN_RSA_PKCS1_MD5_SHA1;
3573
+ return true;
3574
+ case EVP_PKEY_EC:
3575
+ *out = SSL_SIGN_ECDSA_SHA1;
3576
+ return true;
3577
+ default:
3578
+ return false;
3579
+ }
3580
+ }
3581
+
3582
+ bool tls1_choose_signature_algorithm(SSL_HANDSHAKE *hs, uint16_t *out) {
3583
+ SSL *const ssl = hs->ssl;
3584
+ CERT *cert = hs->config->cert.get();
3585
+ DC *dc = cert->dc.get();
3586
+
3587
+ // Before TLS 1.2, the signature algorithm isn't negotiated as part of the
3588
+ // handshake.
3589
+ if (ssl_protocol_version(ssl) < TLS1_2_VERSION) {
3590
+ if (!tls1_get_legacy_signature_algorithm(out, hs->local_pubkey.get())) {
3591
+ OPENSSL_PUT_ERROR(SSL, SSL_R_NO_COMMON_SIGNATURE_ALGORITHMS);
3592
+ return false;
3593
+ }
3594
+ return true;
3595
+ }
3596
+
3597
+ Span<const uint16_t> sigalgs = kSignSignatureAlgorithms;
3598
+ if (ssl_signing_with_dc(hs)) {
3599
+ sigalgs = MakeConstSpan(&dc->expected_cert_verify_algorithm, 1);
3600
+ } else if (!cert->sigalgs.empty()) {
3601
+ sigalgs = cert->sigalgs;
3602
+ }
3603
+
3604
+ Span<const uint16_t> peer_sigalgs = tls1_get_peer_verify_algorithms(hs);
3605
+
3606
+ for (uint16_t sigalg : sigalgs) {
3607
+ // SSL_SIGN_RSA_PKCS1_MD5_SHA1 is an internal value and should never be
3608
+ // negotiated.
3609
+ if (sigalg == SSL_SIGN_RSA_PKCS1_MD5_SHA1 ||
3610
+ !ssl_private_key_supports_signature_algorithm(hs, sigalg)) {
3611
+ continue;
3612
+ }
3613
+
3614
+ for (uint16_t peer_sigalg : peer_sigalgs) {
3615
+ if (sigalg == peer_sigalg) {
3616
+ *out = sigalg;
3617
+ return true;
3618
+ }
3619
+ }
3620
+ }
3621
+
3622
+ OPENSSL_PUT_ERROR(SSL, SSL_R_NO_COMMON_SIGNATURE_ALGORITHMS);
3623
+ return false;
3624
+ }
3625
+
3626
+ Span<const uint16_t> tls1_get_peer_verify_algorithms(const SSL_HANDSHAKE *hs) {
3627
+ Span<const uint16_t> peer_sigalgs = hs->peer_sigalgs;
3628
+ if (peer_sigalgs.empty() && ssl_protocol_version(hs->ssl) < TLS1_3_VERSION) {
3629
+ // If the client didn't specify any signature_algorithms extension then
3630
+ // we can assume that it supports SHA1. See
3631
+ // http://tools.ietf.org/html/rfc5246#section-7.4.1.4.1
3632
+ static const uint16_t kDefaultPeerAlgorithms[] = {SSL_SIGN_RSA_PKCS1_SHA1,
3633
+ SSL_SIGN_ECDSA_SHA1};
3634
+ peer_sigalgs = kDefaultPeerAlgorithms;
3635
+ }
3636
+ return peer_sigalgs;
3637
+ }
3638
+
3639
+ bool tls1_verify_channel_id(SSL_HANDSHAKE *hs, const SSLMessage &msg) {
3640
+ SSL *const ssl = hs->ssl;
3641
+ // A Channel ID handshake message is structured to contain multiple
3642
+ // extensions, but the only one that can be present is Channel ID.
3643
+ uint16_t extension_type;
3644
+ CBS channel_id = msg.body, extension;
3645
+ if (!CBS_get_u16(&channel_id, &extension_type) ||
3646
+ !CBS_get_u16_length_prefixed(&channel_id, &extension) ||
3647
+ CBS_len(&channel_id) != 0 ||
3648
+ extension_type != TLSEXT_TYPE_channel_id ||
3649
+ CBS_len(&extension) != TLSEXT_CHANNEL_ID_SIZE) {
3650
+ OPENSSL_PUT_ERROR(SSL, SSL_R_DECODE_ERROR);
3651
+ ssl_send_alert(ssl, SSL3_AL_FATAL, SSL_AD_DECODE_ERROR);
3652
+ return false;
3653
+ }
3654
+
3655
+ UniquePtr<EC_GROUP> p256(EC_GROUP_new_by_curve_name(NID_X9_62_prime256v1));
3656
+ if (!p256) {
3657
+ OPENSSL_PUT_ERROR(SSL, SSL_R_NO_P256_SUPPORT);
3658
+ return false;
3659
+ }
3660
+
3661
+ UniquePtr<ECDSA_SIG> sig(ECDSA_SIG_new());
3662
+ UniquePtr<BIGNUM> x(BN_new()), y(BN_new());
3663
+ if (!sig || !x || !y) {
3664
+ return false;
3665
+ }
3666
+
3667
+ const uint8_t *p = CBS_data(&extension);
3668
+ if (BN_bin2bn(p + 0, 32, x.get()) == NULL ||
3669
+ BN_bin2bn(p + 32, 32, y.get()) == NULL ||
3670
+ BN_bin2bn(p + 64, 32, sig->r) == NULL ||
3671
+ BN_bin2bn(p + 96, 32, sig->s) == NULL) {
3672
+ return false;
3673
+ }
3674
+
3675
+ UniquePtr<EC_KEY> key(EC_KEY_new());
3676
+ UniquePtr<EC_POINT> point(EC_POINT_new(p256.get()));
3677
+ if (!key || !point ||
3678
+ !EC_POINT_set_affine_coordinates_GFp(p256.get(), point.get(), x.get(),
3679
+ y.get(), nullptr) ||
3680
+ !EC_KEY_set_group(key.get(), p256.get()) ||
3681
+ !EC_KEY_set_public_key(key.get(), point.get())) {
3682
+ return false;
3683
+ }
3684
+
3685
+ uint8_t digest[EVP_MAX_MD_SIZE];
3686
+ size_t digest_len;
3687
+ if (!tls1_channel_id_hash(hs, digest, &digest_len)) {
3688
+ return false;
3689
+ }
3690
+
3691
+ bool sig_ok = ECDSA_do_verify(digest, digest_len, sig.get(), key.get());
3692
+ #if defined(BORINGSSL_UNSAFE_FUZZER_MODE)
3693
+ sig_ok = true;
3694
+ ERR_clear_error();
3695
+ #endif
3696
+ if (!sig_ok) {
3697
+ OPENSSL_PUT_ERROR(SSL, SSL_R_CHANNEL_ID_SIGNATURE_INVALID);
3698
+ ssl_send_alert(ssl, SSL3_AL_FATAL, SSL_AD_DECRYPT_ERROR);
3699
+ ssl->s3->channel_id_valid = false;
3700
+ return false;
3701
+ }
3702
+
3703
+ OPENSSL_memcpy(ssl->s3->channel_id, p, 64);
3704
+ return true;
3705
+ }
3706
+
3707
+ bool tls1_write_channel_id(SSL_HANDSHAKE *hs, CBB *cbb) {
3708
+ uint8_t digest[EVP_MAX_MD_SIZE];
3709
+ size_t digest_len;
3710
+ if (!tls1_channel_id_hash(hs, digest, &digest_len)) {
3711
+ return false;
3712
+ }
3713
+
3714
+ EC_KEY *ec_key = EVP_PKEY_get0_EC_KEY(hs->config->channel_id_private.get());
3715
+ if (ec_key == nullptr) {
3716
+ OPENSSL_PUT_ERROR(SSL, ERR_R_INTERNAL_ERROR);
3717
+ return false;
3718
+ }
3719
+
3720
+ UniquePtr<BIGNUM> x(BN_new()), y(BN_new());
3721
+ if (!x || !y ||
3722
+ !EC_POINT_get_affine_coordinates_GFp(EC_KEY_get0_group(ec_key),
3723
+ EC_KEY_get0_public_key(ec_key),
3724
+ x.get(), y.get(), nullptr)) {
3725
+ return false;
3726
+ }
3727
+
3728
+ UniquePtr<ECDSA_SIG> sig(ECDSA_do_sign(digest, digest_len, ec_key));
3729
+ if (!sig) {
3730
+ return false;
3731
+ }
3732
+
3733
+ CBB child;
3734
+ if (!CBB_add_u16(cbb, TLSEXT_TYPE_channel_id) ||
3735
+ !CBB_add_u16_length_prefixed(cbb, &child) ||
3736
+ !BN_bn2cbb_padded(&child, 32, x.get()) ||
3737
+ !BN_bn2cbb_padded(&child, 32, y.get()) ||
3738
+ !BN_bn2cbb_padded(&child, 32, sig->r) ||
3739
+ !BN_bn2cbb_padded(&child, 32, sig->s) ||
3740
+ !CBB_flush(cbb)) {
3741
+ return false;
3742
+ }
3743
+
3744
+ return true;
3745
+ }
3746
+
3747
+ bool tls1_channel_id_hash(SSL_HANDSHAKE *hs, uint8_t *out, size_t *out_len) {
3748
+ SSL *const ssl = hs->ssl;
3749
+ if (ssl_protocol_version(ssl) >= TLS1_3_VERSION) {
3750
+ Array<uint8_t> msg;
3751
+ if (!tls13_get_cert_verify_signature_input(hs, &msg,
3752
+ ssl_cert_verify_channel_id)) {
3753
+ return false;
3754
+ }
3755
+ SHA256(msg.data(), msg.size(), out);
3756
+ *out_len = SHA256_DIGEST_LENGTH;
3757
+ return true;
3758
+ }
3759
+
3760
+ SHA256_CTX ctx;
3761
+
3762
+ SHA256_Init(&ctx);
3763
+ static const char kClientIDMagic[] = "TLS Channel ID signature";
3764
+ SHA256_Update(&ctx, kClientIDMagic, sizeof(kClientIDMagic));
3765
+
3766
+ if (ssl->session != NULL) {
3767
+ static const char kResumptionMagic[] = "Resumption";
3768
+ SHA256_Update(&ctx, kResumptionMagic, sizeof(kResumptionMagic));
3769
+ if (ssl->session->original_handshake_hash_len == 0) {
3770
+ OPENSSL_PUT_ERROR(SSL, ERR_R_INTERNAL_ERROR);
3771
+ return false;
3772
+ }
3773
+ SHA256_Update(&ctx, ssl->session->original_handshake_hash,
3774
+ ssl->session->original_handshake_hash_len);
3775
+ }
3776
+
3777
+ uint8_t hs_hash[EVP_MAX_MD_SIZE];
3778
+ size_t hs_hash_len;
3779
+ if (!hs->transcript.GetHash(hs_hash, &hs_hash_len)) {
3780
+ return false;
3781
+ }
3782
+ SHA256_Update(&ctx, hs_hash, (size_t)hs_hash_len);
3783
+ SHA256_Final(out, &ctx);
3784
+ *out_len = SHA256_DIGEST_LENGTH;
3785
+ return true;
3786
+ }
3787
+
3788
+ bool tls1_record_handshake_hashes_for_channel_id(SSL_HANDSHAKE *hs) {
3789
+ SSL *const ssl = hs->ssl;
3790
+ // This function should never be called for a resumed session because the
3791
+ // handshake hashes that we wish to record are for the original, full
3792
+ // handshake.
3793
+ if (ssl->session != NULL) {
3794
+ return false;
3795
+ }
3796
+
3797
+ static_assert(
3798
+ sizeof(hs->new_session->original_handshake_hash) == EVP_MAX_MD_SIZE,
3799
+ "original_handshake_hash is too small");
3800
+
3801
+ size_t digest_len;
3802
+ if (!hs->transcript.GetHash(hs->new_session->original_handshake_hash,
3803
+ &digest_len)) {
3804
+ return false;
3805
+ }
3806
+
3807
+ static_assert(EVP_MAX_MD_SIZE <= 0xff,
3808
+ "EVP_MAX_MD_SIZE does not fit in uint8_t");
3809
+ hs->new_session->original_handshake_hash_len = (uint8_t)digest_len;
3810
+
3811
+ return true;
3812
+ }
3813
+
3814
+ bool ssl_do_channel_id_callback(SSL_HANDSHAKE *hs) {
3815
+ if (hs->config->channel_id_private != NULL ||
3816
+ hs->ssl->ctx->channel_id_cb == NULL) {
3817
+ return true;
3818
+ }
3819
+
3820
+ EVP_PKEY *key = NULL;
3821
+ hs->ssl->ctx->channel_id_cb(hs->ssl, &key);
3822
+ if (key == NULL) {
3823
+ // The caller should try again later.
3824
+ return true;
3825
+ }
3826
+
3827
+ UniquePtr<EVP_PKEY> free_key(key);
3828
+ return SSL_set1_tls_channel_id(hs->ssl, key);
3829
+ }
3830
+
3831
+ bool ssl_is_sct_list_valid(const CBS *contents) {
3832
+ // Shallow parse the SCT list for sanity. By the RFC
3833
+ // (https://tools.ietf.org/html/rfc6962#section-3.3) neither the list nor any
3834
+ // of the SCTs may be empty.
3835
+ CBS copy = *contents;
3836
+ CBS sct_list;
3837
+ if (!CBS_get_u16_length_prefixed(&copy, &sct_list) ||
3838
+ CBS_len(&copy) != 0 ||
3839
+ CBS_len(&sct_list) == 0) {
3840
+ return false;
3841
+ }
3842
+
3843
+ while (CBS_len(&sct_list) > 0) {
3844
+ CBS sct;
3845
+ if (!CBS_get_u16_length_prefixed(&sct_list, &sct) ||
3846
+ CBS_len(&sct) == 0) {
3847
+ return false;
3848
+ }
3849
+ }
3850
+
3851
+ return true;
3852
+ }
3853
+
3854
+ BSSL_NAMESPACE_END
3855
+
3856
+ using namespace bssl;
3857
+
3858
+ int SSL_early_callback_ctx_extension_get(const SSL_CLIENT_HELLO *client_hello,
3859
+ uint16_t extension_type,
3860
+ const uint8_t **out_data,
3861
+ size_t *out_len) {
3862
+ CBS cbs;
3863
+ if (!ssl_client_hello_get_extension(client_hello, &cbs, extension_type)) {
3864
+ return 0;
3865
+ }
3866
+
3867
+ *out_data = CBS_data(&cbs);
3868
+ *out_len = CBS_len(&cbs);
3869
+ return 1;
3870
+ }