grpc 1.9.1 → 1.10.0.pre1

Sign up to get free protection for your applications and to get access to all the features.

Potentially problematic release.


This version of grpc might be problematic. Click here for more details.

Files changed (637) hide show
  1. checksums.yaml +4 -4
  2. data/Makefile +2654 -953
  3. data/etc/roots.pem +282 -683
  4. data/include/grpc/compression.h +9 -26
  5. data/include/grpc/grpc.h +10 -24
  6. data/include/grpc/grpc_security.h +7 -1
  7. data/include/grpc/impl/codegen/compression_types.h +5 -62
  8. data/include/grpc/impl/codegen/grpc_types.h +10 -6
  9. data/include/grpc/module.modulemap +1 -10
  10. data/include/grpc/support/alloc.h +3 -2
  11. data/include/grpc/support/log.h +1 -2
  12. data/{src/core/lib/gpr/thd_internal.h → include/grpc/support/thd_id.h} +23 -9
  13. data/src/boringssl/err_data.c +550 -496
  14. data/src/core/ext/census/grpc_context.cc +2 -1
  15. data/src/core/ext/filters/client_channel/backup_poller.cc +5 -4
  16. data/src/core/ext/filters/client_channel/channel_connectivity.cc +7 -7
  17. data/src/core/ext/filters/client_channel/client_channel.cc +162 -172
  18. data/src/core/ext/filters/client_channel/client_channel_factory.cc +4 -2
  19. data/src/core/ext/filters/client_channel/client_channel_plugin.cc +10 -10
  20. data/src/core/ext/filters/client_channel/http_connect_handshaker.cc +18 -14
  21. data/src/core/ext/filters/client_channel/http_proxy.cc +3 -1
  22. data/src/core/ext/filters/client_channel/lb_policy.cc +21 -105
  23. data/src/core/ext/filters/client_channel/lb_policy.h +166 -170
  24. data/src/core/ext/filters/client_channel/lb_policy/grpclb/client_load_reporting_filter.cc +41 -36
  25. data/src/core/ext/filters/client_channel/lb_policy/grpclb/grpclb.cc +1452 -1459
  26. data/src/core/ext/filters/client_channel/lb_policy/grpclb/grpclb_channel.h +1 -1
  27. data/src/core/ext/filters/client_channel/lb_policy/grpclb/grpclb_channel_secure.cc +3 -2
  28. data/src/core/ext/filters/client_channel/lb_policy/grpclb/grpclb_client_stats.cc +7 -8
  29. data/src/core/ext/filters/client_channel/lb_policy/grpclb/load_balancer_api.cc +27 -27
  30. data/src/core/ext/filters/client_channel/lb_policy/pick_first/pick_first.cc +279 -304
  31. data/src/core/ext/filters/client_channel/lb_policy/round_robin/round_robin.cc +358 -330
  32. data/src/core/ext/filters/client_channel/lb_policy/subchannel_list.cc +30 -41
  33. data/src/core/ext/filters/client_channel/lb_policy/subchannel_list.h +7 -14
  34. data/src/core/ext/filters/client_channel/lb_policy_factory.cc +8 -21
  35. data/src/core/ext/filters/client_channel/lb_policy_factory.h +23 -27
  36. data/src/core/ext/filters/client_channel/lb_policy_registry.cc +58 -33
  37. data/src/core/ext/filters/client_channel/lb_policy_registry.h +25 -12
  38. data/src/core/ext/filters/client_channel/parse_address.cc +10 -8
  39. data/src/core/ext/filters/client_channel/proxy_mapper_registry.cc +2 -2
  40. data/src/core/ext/filters/client_channel/resolver.cc +6 -52
  41. data/src/core/ext/filters/client_channel/resolver.h +98 -55
  42. data/src/core/ext/filters/client_channel/resolver/dns/c_ares/dns_resolver_ares.cc +266 -237
  43. data/src/core/ext/filters/client_channel/resolver/dns/c_ares/grpc_ares_ev_driver_posix.cc +5 -5
  44. data/src/core/ext/filters/client_channel/resolver/dns/c_ares/grpc_ares_wrapper.cc +31 -27
  45. data/src/core/ext/filters/client_channel/resolver/dns/native/dns_resolver.cc +244 -207
  46. data/src/core/ext/filters/client_channel/resolver/fake/fake_resolver.cc +161 -148
  47. data/src/core/ext/filters/client_channel/resolver/fake/fake_resolver.h +47 -31
  48. data/src/core/ext/filters/client_channel/resolver/sockaddr/sockaddr_resolver.cc +126 -126
  49. data/src/core/ext/filters/client_channel/resolver_factory.h +33 -32
  50. data/src/core/ext/filters/client_channel/resolver_registry.cc +110 -90
  51. data/src/core/ext/filters/client_channel/resolver_registry.h +49 -36
  52. data/src/core/ext/filters/client_channel/retry_throttle.cc +29 -22
  53. data/src/core/ext/filters/client_channel/subchannel.cc +173 -173
  54. data/src/core/ext/filters/client_channel/subchannel.h +38 -45
  55. data/src/core/ext/filters/client_channel/subchannel_index.cc +44 -40
  56. data/src/core/ext/filters/client_channel/uri_parser.cc +3 -3
  57. data/src/core/ext/filters/deadline/deadline_filter.cc +27 -18
  58. data/src/core/ext/filters/http/client/http_client_filter.cc +26 -23
  59. data/src/core/ext/filters/http/http_filters_plugin.cc +3 -2
  60. data/src/core/ext/filters/http/message_compress/message_compress_filter.cc +78 -110
  61. data/src/core/ext/filters/http/server/http_server_filter.cc +29 -26
  62. data/src/core/ext/filters/load_reporting/server_load_reporting_filter.cc +9 -11
  63. data/src/core/ext/filters/load_reporting/server_load_reporting_plugin.cc +2 -1
  64. data/src/core/ext/filters/max_age/max_age_filter.cc +14 -14
  65. data/src/core/ext/filters/message_size/message_size_filter.cc +20 -18
  66. data/src/core/ext/filters/workarounds/workaround_cronet_compression_filter.cc +4 -4
  67. data/src/core/ext/filters/workarounds/workaround_utils.cc +4 -4
  68. data/src/core/ext/transport/chttp2/alpn/alpn.cc +2 -1
  69. data/src/core/ext/transport/chttp2/client/chttp2_connector.cc +10 -10
  70. data/src/core/ext/transport/chttp2/client/insecure/channel_create.cc +4 -4
  71. data/src/core/ext/transport/chttp2/client/secure/secure_channel_create.cc +11 -12
  72. data/src/core/ext/transport/chttp2/server/chttp2_server.cc +16 -13
  73. data/src/core/ext/transport/chttp2/transport/bin_decoder.cc +36 -9
  74. data/src/core/ext/transport/chttp2/transport/bin_decoder.h +3 -0
  75. data/src/core/ext/transport/chttp2/transport/bin_encoder.cc +17 -14
  76. data/src/core/ext/transport/chttp2/transport/chttp2_transport.cc +139 -145
  77. data/src/core/ext/transport/chttp2/transport/flow_control.cc +16 -14
  78. data/src/core/ext/transport/chttp2/transport/flow_control.h +8 -7
  79. data/src/core/ext/transport/chttp2/transport/frame_data.cc +35 -33
  80. data/src/core/ext/transport/chttp2/transport/frame_goaway.cc +27 -25
  81. data/src/core/ext/transport/chttp2/transport/frame_ping.cc +12 -12
  82. data/src/core/ext/transport/chttp2/transport/frame_rst_stream.cc +16 -15
  83. data/src/core/ext/transport/chttp2/transport/frame_settings.cc +19 -19
  84. data/src/core/ext/transport/chttp2/transport/frame_window_update.cc +11 -11
  85. data/src/core/ext/transport/chttp2/transport/hpack_encoder.cc +23 -22
  86. data/src/core/ext/transport/chttp2/transport/hpack_parser.cc +35 -35
  87. data/src/core/ext/transport/chttp2/transport/hpack_table.cc +10 -7
  88. data/src/core/ext/transport/chttp2/transport/http2_settings.cc +2 -2
  89. data/src/core/ext/transport/chttp2/transport/incoming_metadata.cc +2 -2
  90. data/src/core/ext/transport/chttp2/transport/internal.h +1 -1
  91. data/src/core/ext/transport/chttp2/transport/parsing.cc +35 -39
  92. data/src/core/ext/transport/chttp2/transport/stream_map.cc +8 -7
  93. data/src/core/ext/transport/chttp2/transport/varint.cc +5 -5
  94. data/src/core/ext/transport/chttp2/transport/writing.cc +18 -18
  95. data/src/core/ext/transport/inproc/inproc_transport.cc +43 -23
  96. data/src/core/lib/{gpr → avl}/avl.cc +61 -57
  97. data/{include/grpc/support → src/core/lib/avl}/avl.h +25 -35
  98. data/src/core/lib/backoff/backoff.cc +6 -5
  99. data/src/core/lib/channel/channel_args.cc +23 -109
  100. data/src/core/lib/channel/channel_args.h +5 -31
  101. data/src/core/lib/channel/channel_stack.cc +11 -8
  102. data/src/core/lib/channel/channel_stack_builder.cc +10 -7
  103. data/src/core/lib/channel/connected_channel.cc +18 -17
  104. data/src/core/lib/channel/handshaker.cc +8 -8
  105. data/src/core/lib/channel/handshaker_registry.cc +3 -2
  106. data/src/core/lib/compression/algorithm_metadata.h +13 -6
  107. data/src/core/lib/compression/compression.cc +72 -183
  108. data/src/core/lib/compression/compression_internal.cc +274 -0
  109. data/src/core/lib/compression/compression_internal.h +86 -0
  110. data/src/core/lib/compression/message_compress.cc +15 -15
  111. data/src/core/lib/compression/message_compress.h +4 -3
  112. data/src/core/lib/compression/stream_compression_gzip.cc +8 -8
  113. data/src/core/lib/compression/stream_compression_identity.cc +1 -1
  114. data/src/core/lib/debug/stats.cc +10 -8
  115. data/src/core/lib/debug/stats_data.cc +2 -1
  116. data/src/core/lib/debug/trace.cc +3 -3
  117. data/src/core/lib/gpr/alloc.cc +7 -11
  118. data/src/core/lib/gpr/arena.cc +34 -12
  119. data/src/core/lib/gpr/atm.cc +2 -1
  120. data/src/core/lib/gpr/cpu_linux.cc +3 -3
  121. data/src/core/lib/gpr/cpu_posix.cc +2 -1
  122. data/src/core/lib/gpr/env.h +1 -1
  123. data/src/core/lib/gpr/env_linux.cc +1 -1
  124. data/src/core/lib/gpr/env_windows.cc +4 -4
  125. data/src/core/lib/gpr/fork.cc +16 -2
  126. data/src/core/lib/gpr/host_port.cc +5 -4
  127. data/{include/grpc/support → src/core/lib/gpr}/host_port.h +5 -13
  128. data/src/core/lib/gpr/log.cc +5 -4
  129. data/src/core/lib/gpr/log_linux.cc +1 -1
  130. data/src/core/lib/gpr/mpscq.cc +1 -0
  131. data/src/core/lib/gpr/murmur_hash.cc +4 -4
  132. data/src/core/lib/gpr/string.cc +19 -16
  133. data/src/core/lib/gpr/string_posix.cc +3 -3
  134. data/src/core/lib/gpr/sync_posix.cc +5 -9
  135. data/src/core/lib/gpr/thd.cc +3 -3
  136. data/{include/grpc/support → src/core/lib/gpr}/thd.h +20 -28
  137. data/src/core/lib/gpr/thd_posix.cc +6 -4
  138. data/src/core/lib/gpr/thd_windows.cc +3 -1
  139. data/src/core/lib/gpr/time.cc +6 -4
  140. data/src/core/lib/gpr/time_posix.cc +2 -2
  141. data/{include/grpc/support → src/core/lib/gpr}/tls.h +6 -6
  142. data/{include/grpc/support → src/core/lib/gpr}/tls_gcc.h +3 -3
  143. data/{include/grpc/support → src/core/lib/gpr}/tls_msvc.h +3 -3
  144. data/src/core/lib/gpr/tls_pthread.cc +1 -1
  145. data/{include/grpc/support → src/core/lib/gpr}/tls_pthread.h +3 -3
  146. data/{include/grpc/support → src/core/lib/gpr}/useful.h +3 -3
  147. data/src/core/lib/{gpr++ → gprpp}/abstract.h +3 -3
  148. data/src/core/lib/{gpr++ → gprpp}/atomic.h +5 -5
  149. data/src/core/lib/{gpr++ → gprpp}/atomic_with_atm.h +3 -3
  150. data/src/core/lib/{gpr++ → gprpp}/atomic_with_std.h +3 -3
  151. data/src/core/lib/{gpr++ → gprpp}/debug_location.h +3 -3
  152. data/src/core/lib/{gpr++ → gprpp}/inlined_vector.h +44 -22
  153. data/src/core/lib/{gpr++ → gprpp}/manual_constructor.h +2 -2
  154. data/src/core/lib/{gpr++ → gprpp}/memory.h +14 -5
  155. data/src/core/lib/{gpr++ → gprpp}/orphanable.h +39 -14
  156. data/src/core/lib/{gpr++ → gprpp}/ref_counted.h +42 -10
  157. data/src/core/lib/{gpr++ → gprpp}/ref_counted_ptr.h +18 -8
  158. data/src/core/lib/http/format_request.cc +3 -3
  159. data/src/core/lib/http/httpcli.cc +6 -7
  160. data/src/core/lib/http/httpcli_security_connector.cc +10 -10
  161. data/src/core/lib/http/parser.cc +16 -12
  162. data/src/core/lib/iomgr/call_combiner.cc +12 -13
  163. data/src/core/lib/iomgr/closure.h +4 -6
  164. data/src/core/lib/iomgr/combiner.cc +10 -21
  165. data/src/core/lib/iomgr/error.cc +50 -55
  166. data/src/core/lib/iomgr/ev_epoll1_linux.cc +41 -52
  167. data/src/core/lib/iomgr/ev_epollex_linux.cc +80 -28
  168. data/src/core/lib/iomgr/ev_epollsig_linux.cc +23 -30
  169. data/src/core/lib/iomgr/ev_poll_posix.cc +52 -46
  170. data/src/core/lib/iomgr/ev_posix.cc +47 -6
  171. data/src/core/lib/iomgr/exec_ctx.cc +10 -10
  172. data/src/core/lib/iomgr/exec_ctx.h +1 -1
  173. data/src/core/lib/iomgr/executor.cc +16 -13
  174. data/src/core/lib/iomgr/fork_posix.cc +1 -3
  175. data/src/core/lib/iomgr/gethostname_host_name_max.cc +1 -1
  176. data/src/core/lib/iomgr/iocp_windows.cc +1 -2
  177. data/src/core/lib/iomgr/iomgr.cc +2 -2
  178. data/src/core/lib/iomgr/iomgr_uv.cc +2 -0
  179. data/src/core/lib/iomgr/iomgr_uv.h +1 -1
  180. data/src/core/lib/iomgr/is_epollexclusive_available.cc +5 -4
  181. data/src/core/lib/iomgr/load_file.cc +3 -3
  182. data/src/core/lib/iomgr/pollset_windows.cc +1 -1
  183. data/src/core/lib/iomgr/resolve_address_posix.cc +10 -9
  184. data/src/core/lib/iomgr/resolve_address_uv.cc +2 -2
  185. data/src/core/lib/iomgr/resolve_address_windows.cc +3 -2
  186. data/src/core/lib/iomgr/resource_quota.cc +36 -34
  187. data/src/core/lib/iomgr/sockaddr_utils.cc +39 -23
  188. data/src/core/lib/iomgr/socket_factory_posix.cc +5 -5
  189. data/src/core/lib/iomgr/socket_mutator.cc +7 -7
  190. data/src/core/lib/iomgr/socket_utils_common_posix.cc +7 -4
  191. data/src/core/lib/iomgr/socket_utils_linux.cc +3 -2
  192. data/src/core/lib/iomgr/tcp_client_posix.cc +7 -6
  193. data/src/core/lib/iomgr/tcp_client_windows.cc +0 -1
  194. data/src/core/lib/iomgr/tcp_posix.cc +47 -55
  195. data/src/core/lib/iomgr/tcp_server_posix.cc +12 -10
  196. data/src/core/lib/iomgr/tcp_server_utils_posix_common.cc +7 -5
  197. data/src/core/lib/iomgr/tcp_server_utils_posix_ifaddrs.cc +4 -3
  198. data/src/core/lib/iomgr/tcp_windows.cc +1 -1
  199. data/src/core/lib/iomgr/timer_generic.cc +16 -14
  200. data/src/core/lib/iomgr/timer_heap.cc +8 -7
  201. data/src/core/lib/iomgr/timer_manager.cc +4 -3
  202. data/src/core/lib/iomgr/udp_server.cc +24 -16
  203. data/src/core/lib/iomgr/unix_sockets_posix.cc +15 -10
  204. data/src/core/lib/iomgr/wakeup_fd_cv.cc +6 -5
  205. data/src/core/lib/iomgr/wakeup_fd_eventfd.cc +1 -2
  206. data/src/core/lib/json/json.cc +1 -1
  207. data/src/core/lib/json/json_reader.cc +8 -6
  208. data/src/core/lib/json/json_string.cc +19 -18
  209. data/src/core/lib/json/json_writer.cc +10 -8
  210. data/src/core/lib/profiling/basic_timers.cc +1 -1
  211. data/src/core/lib/profiling/timers.h +3 -20
  212. data/src/core/lib/security/context/security_context.cc +16 -14
  213. data/src/core/lib/security/credentials/composite/composite_credentials.cc +17 -14
  214. data/src/core/lib/security/credentials/credentials.cc +9 -8
  215. data/src/core/lib/security/credentials/credentials.h +1 -1
  216. data/src/core/lib/security/credentials/credentials_metadata.cc +2 -2
  217. data/src/core/lib/security/credentials/fake/fake_credentials.cc +12 -13
  218. data/src/core/lib/security/credentials/google_default/google_default_credentials.cc +7 -4
  219. data/src/core/lib/security/credentials/iam/iam_credentials.cc +5 -3
  220. data/src/core/lib/security/credentials/jwt/json_token.cc +4 -3
  221. data/src/core/lib/security/credentials/jwt/jwt_credentials.cc +7 -7
  222. data/src/core/lib/security/credentials/jwt/jwt_verifier.cc +21 -18
  223. data/src/core/lib/security/credentials/oauth2/oauth2_credentials.cc +23 -18
  224. data/src/core/lib/security/credentials/plugin/plugin_credentials.cc +11 -7
  225. data/src/core/lib/security/credentials/ssl/ssl_credentials.cc +22 -21
  226. data/src/core/lib/security/{transport → security_connector}/security_connector.cc +46 -43
  227. data/src/core/lib/security/{transport → security_connector}/security_connector.h +3 -3
  228. data/src/core/lib/security/transport/client_auth_filter.cc +32 -34
  229. data/src/core/lib/security/transport/lb_targets_info.cc +7 -5
  230. data/src/core/lib/security/transport/secure_endpoint.cc +21 -21
  231. data/src/core/lib/security/transport/security_handshaker.cc +19 -18
  232. data/src/core/lib/security/transport/security_handshaker.h +1 -1
  233. data/src/core/lib/security/transport/server_auth_filter.cc +21 -21
  234. data/src/core/lib/slice/b64.cc +19 -16
  235. data/src/core/lib/slice/percent_encoding.cc +5 -5
  236. data/src/core/lib/slice/slice.cc +35 -33
  237. data/src/core/lib/slice/slice_buffer.cc +16 -14
  238. data/src/core/lib/slice/slice_hash_table.cc +3 -2
  239. data/src/core/lib/slice/slice_intern.cc +21 -25
  240. data/src/core/lib/slice/slice_string_helpers.cc +45 -9
  241. data/src/core/lib/slice/slice_string_helpers.h +6 -0
  242. data/src/core/lib/surface/byte_buffer.cc +2 -2
  243. data/src/core/lib/surface/byte_buffer_reader.cc +6 -3
  244. data/src/core/lib/surface/call.cc +171 -260
  245. data/src/core/lib/surface/call_test_only.h +1 -13
  246. data/src/core/lib/surface/channel.cc +20 -43
  247. data/src/core/lib/surface/channel_init.cc +7 -7
  248. data/src/core/lib/surface/channel_ping.cc +2 -2
  249. data/src/core/lib/surface/completion_queue.cc +69 -75
  250. data/src/core/lib/surface/init.cc +4 -5
  251. data/src/core/lib/surface/init_secure.cc +1 -1
  252. data/src/core/lib/surface/lame_client.cc +1 -1
  253. data/src/core/lib/surface/server.cc +64 -59
  254. data/src/core/lib/surface/version.cc +2 -2
  255. data/src/core/lib/transport/bdp_estimator.cc +6 -5
  256. data/src/core/lib/transport/byte_stream.cc +23 -14
  257. data/src/core/lib/transport/byte_stream.h +1 -1
  258. data/src/core/lib/transport/connectivity_state.cc +9 -13
  259. data/src/core/lib/transport/error_utils.cc +10 -7
  260. data/src/core/lib/transport/metadata.cc +27 -26
  261. data/src/core/lib/transport/metadata.h +1 -1
  262. data/src/core/lib/transport/pid_controller.cc +2 -1
  263. data/src/core/lib/transport/service_config.cc +5 -5
  264. data/src/core/lib/transport/static_metadata.cc +225 -222
  265. data/src/core/lib/transport/static_metadata.h +77 -76
  266. data/src/core/lib/transport/timeout_encoding.cc +3 -2
  267. data/src/core/lib/transport/transport.cc +6 -5
  268. data/src/core/lib/transport/transport_op_string.cc +0 -1
  269. data/src/core/plugin_registry/grpc_plugin_registry.cc +4 -4
  270. data/src/core/tsi/alts_transport_security.cc +61 -0
  271. data/src/core/tsi/{gts_transport_security.h → alts_transport_security.h} +16 -8
  272. data/src/core/tsi/fake_transport_security.cc +59 -43
  273. data/src/core/tsi/ssl_transport_security.cc +122 -107
  274. data/src/core/tsi/transport_security.cc +3 -3
  275. data/src/core/tsi/transport_security_adapter.cc +16 -10
  276. data/src/ruby/bin/apis/pubsub_demo.rb +1 -1
  277. data/src/ruby/ext/grpc/rb_channel.c +3 -4
  278. data/src/ruby/ext/grpc/rb_compression_options.c +13 -3
  279. data/src/ruby/ext/grpc/rb_grpc_imports.generated.c +4 -76
  280. data/src/ruby/ext/grpc/rb_grpc_imports.generated.h +8 -120
  281. data/src/ruby/ext/grpc/rb_server.c +52 -28
  282. data/src/ruby/lib/grpc/generic/rpc_server.rb +7 -4
  283. data/src/ruby/lib/grpc/version.rb +1 -1
  284. data/src/ruby/pb/test/client.rb +1 -1
  285. data/src/ruby/pb/test/server.rb +1 -1
  286. data/src/ruby/spec/client_server_spec.rb +4 -2
  287. data/src/ruby/spec/generic/active_call_spec.rb +2 -1
  288. data/src/ruby/spec/generic/client_stub_spec.rb +32 -8
  289. data/src/ruby/spec/server_spec.rb +26 -7
  290. data/third_party/boringssl/crypto/asn1/a_bitstr.c +7 -2
  291. data/third_party/boringssl/crypto/asn1/a_d2i_fp.c +15 -0
  292. data/third_party/boringssl/crypto/asn1/a_gentm.c +1 -1
  293. data/third_party/boringssl/crypto/asn1/a_print.c +0 -28
  294. data/third_party/boringssl/crypto/asn1/a_strnid.c +3 -0
  295. data/third_party/boringssl/crypto/asn1/a_time.c +17 -9
  296. data/third_party/boringssl/crypto/asn1/a_utctm.c +1 -1
  297. data/third_party/boringssl/crypto/asn1/asn1_lib.c +5 -49
  298. data/third_party/boringssl/crypto/asn1/asn1_locl.h +1 -1
  299. data/third_party/boringssl/crypto/asn1/tasn_dec.c +9 -9
  300. data/third_party/boringssl/crypto/asn1/tasn_enc.c +0 -6
  301. data/third_party/boringssl/crypto/asn1/time_support.c +5 -5
  302. data/third_party/boringssl/crypto/base64/base64.c +65 -43
  303. data/third_party/boringssl/crypto/bio/bio.c +134 -110
  304. data/third_party/boringssl/crypto/bio/bio_mem.c +9 -9
  305. data/third_party/boringssl/crypto/bio/connect.c +17 -17
  306. data/third_party/boringssl/crypto/bio/fd.c +2 -1
  307. data/third_party/boringssl/crypto/bio/file.c +14 -14
  308. data/third_party/boringssl/crypto/bio/hexdump.c +15 -16
  309. data/third_party/boringssl/crypto/bio/internal.h +14 -14
  310. data/third_party/boringssl/crypto/bio/pair.c +45 -45
  311. data/third_party/boringssl/crypto/bio/printf.c +6 -10
  312. data/third_party/boringssl/crypto/{bn → bn_extra}/bn_asn1.c +9 -9
  313. data/third_party/boringssl/crypto/{bn → bn_extra}/convert.c +18 -223
  314. data/third_party/boringssl/crypto/buf/buf.c +20 -44
  315. data/third_party/boringssl/crypto/bytestring/ber.c +35 -35
  316. data/third_party/boringssl/crypto/bytestring/cbb.c +24 -24
  317. data/third_party/boringssl/crypto/bytestring/cbs.c +33 -37
  318. data/third_party/boringssl/crypto/bytestring/internal.h +38 -38
  319. data/third_party/boringssl/crypto/chacha/chacha.c +7 -7
  320. data/third_party/boringssl/crypto/{asn1/t_bitst.c → cipher_extra/cipher_extra.c} +49 -38
  321. data/third_party/boringssl/crypto/{cipher → cipher_extra}/derive_key.c +0 -2
  322. data/third_party/boringssl/crypto/cipher_extra/e_aesctrhmac.c +281 -0
  323. data/third_party/boringssl/crypto/cipher_extra/e_aesgcmsiv.c +867 -0
  324. data/third_party/boringssl/crypto/cipher_extra/e_chacha20poly1305.c +326 -0
  325. data/third_party/boringssl/crypto/{cipher → cipher_extra}/e_null.c +0 -1
  326. data/third_party/boringssl/crypto/{cipher → cipher_extra}/e_rc2.c +22 -10
  327. data/third_party/boringssl/crypto/{cipher → cipher_extra}/e_rc4.c +0 -0
  328. data/third_party/boringssl/crypto/{cipher → cipher_extra}/e_ssl3.c +120 -64
  329. data/third_party/boringssl/crypto/{cipher → cipher_extra}/e_tls.c +220 -141
  330. data/third_party/boringssl/crypto/{asn1/x_bignum.c → cipher_extra/internal.h} +61 -86
  331. data/third_party/boringssl/crypto/cipher_extra/tls_cbc.c +482 -0
  332. data/third_party/boringssl/crypto/cmac/cmac.c +20 -20
  333. data/third_party/boringssl/crypto/conf/conf.c +32 -20
  334. data/third_party/boringssl/crypto/conf/internal.h +3 -3
  335. data/third_party/boringssl/crypto/cpu-aarch64-linux.c +5 -5
  336. data/third_party/boringssl/crypto/cpu-arm-linux.c +44 -41
  337. data/third_party/boringssl/crypto/cpu-intel.c +68 -43
  338. data/third_party/boringssl/crypto/cpu-ppc64le.c +5 -7
  339. data/third_party/boringssl/crypto/crypto.c +54 -32
  340. data/third_party/boringssl/crypto/curve25519/curve25519.c +269 -269
  341. data/third_party/boringssl/crypto/curve25519/internal.h +28 -8
  342. data/third_party/boringssl/crypto/curve25519/spake25519.c +180 -106
  343. data/third_party/boringssl/crypto/curve25519/x25519-x86_64.c +9 -9
  344. data/third_party/boringssl/crypto/dh/check.c +33 -34
  345. data/third_party/boringssl/crypto/dh/dh.c +72 -36
  346. data/third_party/boringssl/crypto/dh/dh_asn1.c +1 -1
  347. data/third_party/boringssl/crypto/dh/params.c +1 -161
  348. data/third_party/boringssl/crypto/digest_extra/digest_extra.c +240 -0
  349. data/third_party/boringssl/crypto/dsa/dsa.c +127 -87
  350. data/third_party/boringssl/crypto/dsa/dsa_asn1.c +1 -1
  351. data/third_party/boringssl/crypto/{ec → ec_extra}/ec_asn1.c +83 -70
  352. data/third_party/boringssl/crypto/ecdh/ecdh.c +1 -1
  353. data/third_party/boringssl/crypto/{ecdsa → ecdsa_extra}/ecdsa_asn1.c +86 -31
  354. data/third_party/boringssl/crypto/engine/engine.c +6 -6
  355. data/third_party/boringssl/crypto/err/err.c +197 -106
  356. data/third_party/boringssl/crypto/err/internal.h +58 -0
  357. data/third_party/boringssl/crypto/evp/digestsign.c +86 -14
  358. data/third_party/boringssl/crypto/evp/evp.c +6 -11
  359. data/third_party/boringssl/crypto/evp/evp_asn1.c +17 -17
  360. data/third_party/boringssl/crypto/evp/evp_ctx.c +15 -11
  361. data/third_party/boringssl/crypto/evp/internal.h +66 -51
  362. data/third_party/boringssl/crypto/evp/p_dsa_asn1.c +11 -11
  363. data/third_party/boringssl/crypto/evp/p_ec.c +10 -8
  364. data/third_party/boringssl/crypto/evp/p_ec_asn1.c +11 -12
  365. data/third_party/boringssl/crypto/evp/p_ed25519.c +71 -0
  366. data/third_party/boringssl/crypto/evp/p_ed25519_asn1.c +190 -0
  367. data/third_party/boringssl/crypto/evp/p_rsa.c +50 -95
  368. data/third_party/boringssl/crypto/evp/p_rsa_asn1.c +28 -18
  369. data/third_party/boringssl/crypto/evp/pbkdf.c +49 -56
  370. data/third_party/boringssl/crypto/evp/print.c +5 -36
  371. data/third_party/boringssl/crypto/evp/scrypt.c +209 -0
  372. data/third_party/boringssl/crypto/ex_data.c +15 -45
  373. data/third_party/boringssl/crypto/fipsmodule/aes/internal.h +100 -0
  374. data/third_party/boringssl/crypto/fipsmodule/bcm.c +679 -0
  375. data/third_party/boringssl/crypto/{bn → fipsmodule/bn}/internal.h +40 -27
  376. data/third_party/boringssl/crypto/{bn → fipsmodule/bn}/rsaz_exp.h +0 -0
  377. data/third_party/boringssl/crypto/{cipher → fipsmodule/cipher}/internal.h +34 -67
  378. data/third_party/boringssl/crypto/fipsmodule/delocate.h +88 -0
  379. data/third_party/boringssl/crypto/{des → fipsmodule/des}/internal.h +18 -4
  380. data/third_party/boringssl/crypto/{digest → fipsmodule/digest}/internal.h +18 -18
  381. data/third_party/boringssl/crypto/{digest → fipsmodule/digest}/md32_common.h +58 -64
  382. data/third_party/boringssl/crypto/{ec → fipsmodule/ec}/internal.h +58 -52
  383. data/third_party/boringssl/crypto/{ec → fipsmodule/ec}/p256-x86_64-table.h +11 -11
  384. data/third_party/boringssl/crypto/{ec → fipsmodule/ec}/p256-x86_64.h +32 -32
  385. data/third_party/boringssl/crypto/{rand/internal.h → fipsmodule/is_fips.c} +10 -15
  386. data/third_party/boringssl/crypto/{modes → fipsmodule/modes}/internal.h +112 -119
  387. data/third_party/boringssl/crypto/fipsmodule/rand/internal.h +92 -0
  388. data/third_party/boringssl/crypto/{rsa → fipsmodule/rsa}/internal.h +36 -49
  389. data/third_party/boringssl/crypto/hkdf/hkdf.c +6 -6
  390. data/third_party/boringssl/crypto/internal.h +301 -233
  391. data/third_party/boringssl/crypto/lhash/lhash.c +26 -45
  392. data/third_party/boringssl/crypto/mem.c +76 -33
  393. data/third_party/boringssl/crypto/obj/obj.c +44 -28
  394. data/third_party/boringssl/crypto/obj/obj_dat.h +102 -34
  395. data/third_party/boringssl/crypto/obj/obj_xref.c +6 -6
  396. data/third_party/boringssl/crypto/pem/pem_info.c +3 -5
  397. data/third_party/boringssl/crypto/pem/pem_lib.c +1 -6
  398. data/third_party/boringssl/crypto/pem/pem_pk8.c +1 -0
  399. data/third_party/boringssl/crypto/pem/pem_pkey.c +1 -1
  400. data/third_party/boringssl/crypto/pem/pem_xaux.c +0 -2
  401. data/third_party/boringssl/crypto/pkcs7/internal.h +49 -0
  402. data/third_party/boringssl/crypto/pkcs7/pkcs7.c +166 -0
  403. data/third_party/boringssl/crypto/{x509/pkcs7.c → pkcs7/pkcs7_x509.c} +27 -147
  404. data/third_party/boringssl/crypto/pkcs8/internal.h +34 -16
  405. data/third_party/boringssl/crypto/pkcs8/p5_pbev2.c +120 -39
  406. data/third_party/boringssl/crypto/pkcs8/pkcs8.c +144 -857
  407. data/third_party/boringssl/crypto/pkcs8/pkcs8_x509.c +789 -0
  408. data/third_party/boringssl/crypto/poly1305/internal.h +4 -3
  409. data/third_party/boringssl/crypto/poly1305/poly1305.c +14 -14
  410. data/third_party/boringssl/crypto/poly1305/poly1305_arm.c +11 -11
  411. data/third_party/boringssl/crypto/poly1305/poly1305_vec.c +41 -41
  412. data/third_party/boringssl/crypto/pool/internal.h +2 -2
  413. data/third_party/boringssl/crypto/pool/pool.c +15 -15
  414. data/third_party/boringssl/crypto/{rand → rand_extra}/deterministic.c +7 -7
  415. data/third_party/boringssl/crypto/rand_extra/forkunsafe.c +46 -0
  416. data/third_party/boringssl/crypto/{rand → rand_extra}/fuchsia.c +7 -7
  417. data/third_party/boringssl/crypto/rand_extra/rand_extra.c +70 -0
  418. data/third_party/boringssl/crypto/{rand → rand_extra}/windows.c +5 -5
  419. data/third_party/boringssl/crypto/refcount_c11.c +2 -2
  420. data/third_party/boringssl/crypto/refcount_lock.c +1 -1
  421. data/third_party/boringssl/crypto/{rsa → rsa_extra}/rsa_asn1.c +12 -120
  422. data/third_party/boringssl/crypto/stack/stack.c +13 -13
  423. data/third_party/boringssl/crypto/thread_none.c +1 -1
  424. data/third_party/boringssl/crypto/thread_pthread.c +1 -1
  425. data/third_party/boringssl/crypto/thread_win.c +40 -40
  426. data/third_party/boringssl/crypto/x509/a_sign.c +5 -12
  427. data/third_party/boringssl/crypto/x509/a_verify.c +6 -18
  428. data/third_party/boringssl/crypto/x509/algorithm.c +22 -6
  429. data/third_party/boringssl/crypto/x509/asn1_gen.c +30 -7
  430. data/third_party/boringssl/crypto/x509/by_dir.c +2 -2
  431. data/third_party/boringssl/crypto/x509/by_file.c +2 -2
  432. data/third_party/boringssl/crypto/x509/rsa_pss.c +5 -5
  433. data/third_party/boringssl/crypto/x509/t_x509.c +2 -1
  434. data/third_party/boringssl/crypto/x509/x509_def.c +5 -0
  435. data/third_party/boringssl/crypto/x509/x509_lu.c +35 -4
  436. data/third_party/boringssl/crypto/x509/x509_set.c +10 -0
  437. data/third_party/boringssl/crypto/x509/x509_vfy.c +20 -17
  438. data/third_party/boringssl/crypto/x509/x_name.c +13 -16
  439. data/third_party/boringssl/crypto/x509/x_x509.c +3 -3
  440. data/third_party/boringssl/crypto/x509/x_x509a.c +0 -7
  441. data/third_party/boringssl/crypto/x509v3/ext_dat.h +8 -0
  442. data/third_party/boringssl/crypto/x509v3/pcy_int.h +2 -2
  443. data/third_party/boringssl/crypto/x509v3/pcy_lib.c +0 -9
  444. data/third_party/boringssl/crypto/x509v3/pcy_node.c +1 -1
  445. data/third_party/boringssl/crypto/x509v3/pcy_tree.c +25 -15
  446. data/third_party/boringssl/crypto/x509v3/v3_alt.c +21 -11
  447. data/third_party/boringssl/crypto/x509v3/v3_cpols.c +9 -3
  448. data/third_party/boringssl/crypto/x509v3/v3_info.c +22 -14
  449. data/third_party/boringssl/crypto/x509v3/v3_ncons.c +27 -11
  450. data/third_party/boringssl/crypto/x509v3/v3_pci.c +0 -33
  451. data/third_party/boringssl/crypto/x509v3/v3_utl.c +4 -4
  452. data/third_party/boringssl/include/openssl/aead.h +280 -191
  453. data/third_party/boringssl/include/openssl/aes.h +50 -50
  454. data/third_party/boringssl/include/openssl/arm_arch.h +12 -12
  455. data/third_party/boringssl/include/openssl/asn1.h +14 -77
  456. data/third_party/boringssl/include/openssl/asn1t.h +11 -15
  457. data/third_party/boringssl/include/openssl/base.h +78 -51
  458. data/third_party/boringssl/include/openssl/base64.h +68 -68
  459. data/third_party/boringssl/include/openssl/bio.h +472 -406
  460. data/third_party/boringssl/include/openssl/blowfish.h +1 -1
  461. data/third_party/boringssl/include/openssl/bn.h +454 -435
  462. data/third_party/boringssl/include/openssl/buf.h +27 -27
  463. data/third_party/boringssl/include/openssl/bytestring.h +282 -267
  464. data/third_party/boringssl/include/openssl/cast.h +2 -2
  465. data/third_party/boringssl/include/openssl/chacha.h +5 -5
  466. data/third_party/boringssl/include/openssl/cipher.h +209 -200
  467. data/third_party/boringssl/include/openssl/cmac.h +27 -27
  468. data/third_party/boringssl/include/openssl/conf.h +49 -46
  469. data/third_party/boringssl/include/openssl/cpu.h +60 -45
  470. data/third_party/boringssl/include/openssl/crypto.h +59 -35
  471. data/third_party/boringssl/include/openssl/curve25519.h +97 -92
  472. data/third_party/boringssl/include/openssl/des.h +25 -25
  473. data/third_party/boringssl/include/openssl/dh.h +98 -97
  474. data/third_party/boringssl/include/openssl/digest.h +143 -114
  475. data/third_party/boringssl/include/openssl/dsa.h +217 -202
  476. data/third_party/boringssl/include/openssl/ec.h +132 -131
  477. data/third_party/boringssl/include/openssl/ec_key.h +132 -128
  478. data/third_party/boringssl/include/openssl/ecdh.h +9 -9
  479. data/third_party/boringssl/include/openssl/ecdsa.h +66 -66
  480. data/third_party/boringssl/include/openssl/engine.h +38 -38
  481. data/third_party/boringssl/include/openssl/err.h +189 -219
  482. data/third_party/boringssl/include/openssl/evp.h +473 -397
  483. data/third_party/boringssl/include/openssl/ex_data.h +46 -56
  484. data/third_party/boringssl/include/openssl/hkdf.h +17 -17
  485. data/third_party/boringssl/include/openssl/hmac.h +55 -43
  486. data/third_party/boringssl/include/openssl/is_boringssl.h +16 -0
  487. data/third_party/boringssl/include/openssl/lhash.h +67 -67
  488. data/third_party/boringssl/include/openssl/lhash_macros.h +4 -4
  489. data/third_party/boringssl/include/openssl/md4.h +14 -14
  490. data/third_party/boringssl/include/openssl/md5.h +14 -14
  491. data/third_party/boringssl/include/openssl/mem.h +39 -33
  492. data/third_party/boringssl/include/openssl/nid.h +43 -0
  493. data/third_party/boringssl/include/openssl/obj.h +93 -87
  494. data/third_party/boringssl/include/openssl/opensslconf.h +8 -1
  495. data/third_party/boringssl/include/openssl/pem.h +2 -122
  496. data/third_party/boringssl/include/openssl/pkcs7.h +68 -2
  497. data/third_party/boringssl/include/openssl/pkcs8.h +81 -66
  498. data/third_party/boringssl/include/openssl/poly1305.h +11 -11
  499. data/third_party/boringssl/include/openssl/pool.h +29 -25
  500. data/third_party/boringssl/include/openssl/rand.h +48 -45
  501. data/third_party/boringssl/include/openssl/rc4.h +9 -9
  502. data/third_party/boringssl/include/openssl/ripemd.h +13 -13
  503. data/third_party/boringssl/include/openssl/rsa.h +371 -340
  504. data/third_party/boringssl/include/openssl/sha.h +71 -71
  505. data/third_party/boringssl/include/openssl/span.h +191 -0
  506. data/third_party/boringssl/include/openssl/ssl.h +2639 -2519
  507. data/third_party/boringssl/include/openssl/ssl3.h +39 -122
  508. data/third_party/boringssl/include/openssl/stack.h +355 -164
  509. data/third_party/boringssl/include/openssl/thread.h +43 -43
  510. data/third_party/boringssl/include/openssl/tls1.h +60 -63
  511. data/third_party/boringssl/include/openssl/type_check.h +10 -14
  512. data/third_party/boringssl/include/openssl/x509.h +41 -116
  513. data/third_party/boringssl/include/openssl/x509_vfy.h +17 -25
  514. data/third_party/boringssl/include/openssl/x509v3.h +27 -21
  515. data/third_party/boringssl/ssl/{bio_ssl.c → bio_ssl.cc} +9 -5
  516. data/third_party/boringssl/ssl/{custom_extensions.c → custom_extensions.cc} +19 -12
  517. data/third_party/boringssl/ssl/{d1_both.c → d1_both.cc} +224 -193
  518. data/third_party/boringssl/ssl/{d1_lib.c → d1_lib.cc} +86 -79
  519. data/third_party/boringssl/ssl/{d1_pkt.c → d1_pkt.cc} +55 -87
  520. data/third_party/boringssl/ssl/{d1_srtp.c → d1_srtp.cc} +12 -16
  521. data/third_party/boringssl/ssl/{dtls_method.c → dtls_method.cc} +33 -50
  522. data/third_party/boringssl/ssl/{dtls_record.c → dtls_record.cc} +76 -64
  523. data/third_party/boringssl/ssl/handshake.cc +547 -0
  524. data/third_party/boringssl/ssl/handshake_client.cc +1828 -0
  525. data/third_party/boringssl/ssl/handshake_server.cc +1672 -0
  526. data/third_party/boringssl/ssl/internal.h +2027 -1280
  527. data/third_party/boringssl/ssl/s3_both.cc +603 -0
  528. data/third_party/boringssl/ssl/{s3_lib.c → s3_lib.cc} +22 -10
  529. data/third_party/boringssl/ssl/{s3_pkt.c → s3_pkt.cc} +171 -75
  530. data/third_party/boringssl/ssl/ssl_aead_ctx.cc +415 -0
  531. data/third_party/boringssl/ssl/{ssl_asn1.c → ssl_asn1.cc} +257 -261
  532. data/third_party/boringssl/ssl/{ssl_buffer.c → ssl_buffer.cc} +81 -97
  533. data/third_party/boringssl/ssl/{ssl_cert.c → ssl_cert.cc} +304 -414
  534. data/third_party/boringssl/ssl/{ssl_cipher.c → ssl_cipher.cc} +427 -505
  535. data/third_party/boringssl/ssl/{ssl_file.c → ssl_file.cc} +24 -16
  536. data/third_party/boringssl/ssl/ssl_key_share.cc +245 -0
  537. data/third_party/boringssl/ssl/{ssl_lib.c → ssl_lib.cc} +665 -828
  538. data/third_party/boringssl/ssl/ssl_privkey.cc +518 -0
  539. data/third_party/boringssl/ssl/{ssl_session.c → ssl_session.cc} +596 -471
  540. data/third_party/boringssl/ssl/{ssl_stat.c → ssl_stat.cc} +5 -224
  541. data/third_party/boringssl/ssl/{ssl_transcript.c → ssl_transcript.cc} +117 -140
  542. data/third_party/boringssl/ssl/ssl_versions.cc +439 -0
  543. data/third_party/boringssl/ssl/{ssl_x509.c → ssl_x509.cc} +751 -267
  544. data/third_party/boringssl/ssl/{t1_enc.c → t1_enc.cc} +120 -161
  545. data/third_party/boringssl/ssl/{t1_lib.c → t1_lib.cc} +859 -966
  546. data/third_party/boringssl/ssl/{tls13_both.c → tls13_both.cc} +202 -284
  547. data/third_party/boringssl/ssl/tls13_client.cc +842 -0
  548. data/third_party/boringssl/ssl/{tls13_enc.c → tls13_enc.cc} +108 -90
  549. data/third_party/boringssl/ssl/tls13_server.cc +967 -0
  550. data/third_party/boringssl/ssl/{tls_method.c → tls_method.cc} +94 -73
  551. data/third_party/boringssl/ssl/tls_record.cc +675 -0
  552. metadata +117 -168
  553. data/include/grpc/support/cmdline.h +0 -88
  554. data/include/grpc/support/subprocess.h +0 -44
  555. data/src/core/ext/filters/client_channel/lb_policy/grpclb/grpclb.h +0 -29
  556. data/src/core/ext/filters/client_channel/resolver_factory.cc +0 -40
  557. data/src/core/lib/gpr/cmdline.cc +0 -330
  558. data/src/core/lib/gpr/subprocess_posix.cc +0 -99
  559. data/src/core/lib/gpr/subprocess_windows.cc +0 -126
  560. data/src/core/lib/surface/alarm.cc +0 -137
  561. data/src/core/lib/surface/alarm_internal.h +0 -40
  562. data/src/core/tsi/gts_transport_security.cc +0 -40
  563. data/third_party/boringssl/crypto/aes/aes.c +0 -1142
  564. data/third_party/boringssl/crypto/aes/internal.h +0 -87
  565. data/third_party/boringssl/crypto/aes/key_wrap.c +0 -138
  566. data/third_party/boringssl/crypto/aes/mode_wrappers.c +0 -112
  567. data/third_party/boringssl/crypto/asn1/x_long.c +0 -200
  568. data/third_party/boringssl/crypto/bn/add.c +0 -377
  569. data/third_party/boringssl/crypto/bn/asm/x86_64-gcc.c +0 -532
  570. data/third_party/boringssl/crypto/bn/bn.c +0 -365
  571. data/third_party/boringssl/crypto/bn/cmp.c +0 -239
  572. data/third_party/boringssl/crypto/bn/ctx.c +0 -313
  573. data/third_party/boringssl/crypto/bn/div.c +0 -728
  574. data/third_party/boringssl/crypto/bn/exponentiation.c +0 -1240
  575. data/third_party/boringssl/crypto/bn/gcd.c +0 -635
  576. data/third_party/boringssl/crypto/bn/generic.c +0 -707
  577. data/third_party/boringssl/crypto/bn/kronecker.c +0 -176
  578. data/third_party/boringssl/crypto/bn/montgomery.c +0 -409
  579. data/third_party/boringssl/crypto/bn/montgomery_inv.c +0 -207
  580. data/third_party/boringssl/crypto/bn/mul.c +0 -871
  581. data/third_party/boringssl/crypto/bn/prime.c +0 -861
  582. data/third_party/boringssl/crypto/bn/random.c +0 -343
  583. data/third_party/boringssl/crypto/bn/rsaz_exp.c +0 -254
  584. data/third_party/boringssl/crypto/bn/shift.c +0 -307
  585. data/third_party/boringssl/crypto/bn/sqrt.c +0 -506
  586. data/third_party/boringssl/crypto/cipher/aead.c +0 -156
  587. data/third_party/boringssl/crypto/cipher/cipher.c +0 -657
  588. data/third_party/boringssl/crypto/cipher/e_aes.c +0 -1771
  589. data/third_party/boringssl/crypto/cipher/e_chacha20poly1305.c +0 -276
  590. data/third_party/boringssl/crypto/cipher/e_des.c +0 -205
  591. data/third_party/boringssl/crypto/cipher/tls_cbc.c +0 -482
  592. data/third_party/boringssl/crypto/des/des.c +0 -771
  593. data/third_party/boringssl/crypto/digest/digest.c +0 -251
  594. data/third_party/boringssl/crypto/digest/digests.c +0 -358
  595. data/third_party/boringssl/crypto/ec/ec.c +0 -847
  596. data/third_party/boringssl/crypto/ec/ec_key.c +0 -479
  597. data/third_party/boringssl/crypto/ec/ec_montgomery.c +0 -303
  598. data/third_party/boringssl/crypto/ec/oct.c +0 -416
  599. data/third_party/boringssl/crypto/ec/p224-64.c +0 -1143
  600. data/third_party/boringssl/crypto/ec/p256-64.c +0 -1701
  601. data/third_party/boringssl/crypto/ec/p256-x86_64.c +0 -561
  602. data/third_party/boringssl/crypto/ec/simple.c +0 -1118
  603. data/third_party/boringssl/crypto/ec/util-64.c +0 -109
  604. data/third_party/boringssl/crypto/ec/wnaf.c +0 -458
  605. data/third_party/boringssl/crypto/ecdsa/ecdsa.c +0 -479
  606. data/third_party/boringssl/crypto/hmac/hmac.c +0 -215
  607. data/third_party/boringssl/crypto/md4/md4.c +0 -236
  608. data/third_party/boringssl/crypto/md5/md5.c +0 -285
  609. data/third_party/boringssl/crypto/modes/cbc.c +0 -212
  610. data/third_party/boringssl/crypto/modes/cfb.c +0 -230
  611. data/third_party/boringssl/crypto/modes/ctr.c +0 -219
  612. data/third_party/boringssl/crypto/modes/gcm.c +0 -1071
  613. data/third_party/boringssl/crypto/modes/ofb.c +0 -95
  614. data/third_party/boringssl/crypto/modes/polyval.c +0 -94
  615. data/third_party/boringssl/crypto/pkcs8/p8_pkey.c +0 -85
  616. data/third_party/boringssl/crypto/rand/rand.c +0 -244
  617. data/third_party/boringssl/crypto/rand/urandom.c +0 -335
  618. data/third_party/boringssl/crypto/rsa/blinding.c +0 -265
  619. data/third_party/boringssl/crypto/rsa/padding.c +0 -708
  620. data/third_party/boringssl/crypto/rsa/rsa.c +0 -830
  621. data/third_party/boringssl/crypto/rsa/rsa_impl.c +0 -1100
  622. data/third_party/boringssl/crypto/sha/sha1-altivec.c +0 -346
  623. data/third_party/boringssl/crypto/sha/sha1.c +0 -355
  624. data/third_party/boringssl/crypto/sha/sha256.c +0 -329
  625. data/third_party/boringssl/crypto/sha/sha512.c +0 -609
  626. data/third_party/boringssl/crypto/x509/x509type.c +0 -126
  627. data/third_party/boringssl/include/openssl/stack_macros.h +0 -3987
  628. data/third_party/boringssl/ssl/handshake_client.c +0 -1883
  629. data/third_party/boringssl/ssl/handshake_server.c +0 -1950
  630. data/third_party/boringssl/ssl/s3_both.c +0 -895
  631. data/third_party/boringssl/ssl/ssl_aead_ctx.c +0 -335
  632. data/third_party/boringssl/ssl/ssl_ecdh.c +0 -465
  633. data/third_party/boringssl/ssl/ssl_privkey.c +0 -683
  634. data/third_party/boringssl/ssl/ssl_privkey_cc.cc +0 -76
  635. data/third_party/boringssl/ssl/tls13_client.c +0 -712
  636. data/third_party/boringssl/ssl/tls13_server.c +0 -680
  637. data/third_party/boringssl/ssl/tls_record.c +0 -556
@@ -0,0 +1,1672 @@
1
+ /* Copyright (C) 1995-1998 Eric Young (eay@cryptsoft.com)
2
+ * All rights reserved.
3
+ *
4
+ * This package is an SSL implementation written
5
+ * by Eric Young (eay@cryptsoft.com).
6
+ * The implementation was written so as to conform with Netscapes SSL.
7
+ *
8
+ * This library is free for commercial and non-commercial use as long as
9
+ * the following conditions are aheared to. The following conditions
10
+ * apply to all code found in this distribution, be it the RC4, RSA,
11
+ * lhash, DES, etc., code; not just the SSL code. The SSL documentation
12
+ * included with this distribution is covered by the same copyright terms
13
+ * except that the holder is Tim Hudson (tjh@cryptsoft.com).
14
+ *
15
+ * Copyright remains Eric Young's, and as such any Copyright notices in
16
+ * the code are not to be removed.
17
+ * If this package is used in a product, Eric Young should be given attribution
18
+ * as the author of the parts of the library used.
19
+ * This can be in the form of a textual message at program startup or
20
+ * in documentation (online or textual) provided with the package.
21
+ *
22
+ * Redistribution and use in source and binary forms, with or without
23
+ * modification, are permitted provided that the following conditions
24
+ * are met:
25
+ * 1. Redistributions of source code must retain the copyright
26
+ * notice, this list of conditions and the following disclaimer.
27
+ * 2. Redistributions in binary form must reproduce the above copyright
28
+ * notice, this list of conditions and the following disclaimer in the
29
+ * documentation and/or other materials provided with the distribution.
30
+ * 3. All advertising materials mentioning features or use of this software
31
+ * must display the following acknowledgement:
32
+ * "This product includes cryptographic software written by
33
+ * Eric Young (eay@cryptsoft.com)"
34
+ * The word 'cryptographic' can be left out if the rouines from the library
35
+ * being used are not cryptographic related :-).
36
+ * 4. If you include any Windows specific code (or a derivative thereof) from
37
+ * the apps directory (application code) you must include an acknowledgement:
38
+ * "This product includes software written by Tim Hudson (tjh@cryptsoft.com)"
39
+ *
40
+ * THIS SOFTWARE IS PROVIDED BY ERIC YOUNG ``AS IS'' AND
41
+ * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
42
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
43
+ * ARE DISCLAIMED. IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE
44
+ * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
45
+ * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
46
+ * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
47
+ * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
48
+ * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
49
+ * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
50
+ * SUCH DAMAGE.
51
+ *
52
+ * The licence and distribution terms for any publically available version or
53
+ * derivative of this code cannot be changed. i.e. this code cannot simply be
54
+ * copied and put under another distribution licence
55
+ * [including the GNU Public Licence.]
56
+ */
57
+ /* ====================================================================
58
+ * Copyright (c) 1998-2007 The OpenSSL Project. All rights reserved.
59
+ *
60
+ * Redistribution and use in source and binary forms, with or without
61
+ * modification, are permitted provided that the following conditions
62
+ * are met:
63
+ *
64
+ * 1. Redistributions of source code must retain the above copyright
65
+ * notice, this list of conditions and the following disclaimer.
66
+ *
67
+ * 2. Redistributions in binary form must reproduce the above copyright
68
+ * notice, this list of conditions and the following disclaimer in
69
+ * the documentation and/or other materials provided with the
70
+ * distribution.
71
+ *
72
+ * 3. All advertising materials mentioning features or use of this
73
+ * software must display the following acknowledgment:
74
+ * "This product includes software developed by the OpenSSL Project
75
+ * for use in the OpenSSL Toolkit. (http://www.openssl.org/)"
76
+ *
77
+ * 4. The names "OpenSSL Toolkit" and "OpenSSL Project" must not be used to
78
+ * endorse or promote products derived from this software without
79
+ * prior written permission. For written permission, please contact
80
+ * openssl-core@openssl.org.
81
+ *
82
+ * 5. Products derived from this software may not be called "OpenSSL"
83
+ * nor may "OpenSSL" appear in their names without prior written
84
+ * permission of the OpenSSL Project.
85
+ *
86
+ * 6. Redistributions of any form whatsoever must retain the following
87
+ * acknowledgment:
88
+ * "This product includes software developed by the OpenSSL Project
89
+ * for use in the OpenSSL Toolkit (http://www.openssl.org/)"
90
+ *
91
+ * THIS SOFTWARE IS PROVIDED BY THE OpenSSL PROJECT ``AS IS'' AND ANY
92
+ * EXPRESSED OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
93
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
94
+ * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE OpenSSL PROJECT OR
95
+ * ITS CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
96
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
97
+ * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
98
+ * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
99
+ * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT,
100
+ * STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
101
+ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED
102
+ * OF THE POSSIBILITY OF SUCH DAMAGE.
103
+ * ====================================================================
104
+ *
105
+ * This product includes cryptographic software written by Eric Young
106
+ * (eay@cryptsoft.com). This product includes software written by Tim
107
+ * Hudson (tjh@cryptsoft.com).
108
+ *
109
+ */
110
+ /* ====================================================================
111
+ * Copyright 2002 Sun Microsystems, Inc. ALL RIGHTS RESERVED.
112
+ *
113
+ * Portions of the attached software ("Contribution") are developed by
114
+ * SUN MICROSYSTEMS, INC., and are contributed to the OpenSSL project.
115
+ *
116
+ * The Contribution is licensed pursuant to the OpenSSL open source
117
+ * license provided above.
118
+ *
119
+ * ECC cipher suite support in OpenSSL originally written by
120
+ * Vipul Gupta and Sumit Gupta of Sun Microsystems Laboratories.
121
+ *
122
+ */
123
+ /* ====================================================================
124
+ * Copyright 2005 Nokia. All rights reserved.
125
+ *
126
+ * The portions of the attached software ("Contribution") is developed by
127
+ * Nokia Corporation and is licensed pursuant to the OpenSSL open source
128
+ * license.
129
+ *
130
+ * The Contribution, originally written by Mika Kousa and Pasi Eronen of
131
+ * Nokia Corporation, consists of the "PSK" (Pre-Shared Key) ciphersuites
132
+ * support (see RFC 4279) to OpenSSL.
133
+ *
134
+ * No patent licenses or other rights except those expressly stated in
135
+ * the OpenSSL open source license shall be deemed granted or received
136
+ * expressly, by implication, estoppel, or otherwise.
137
+ *
138
+ * No assurances are provided by Nokia that the Contribution does not
139
+ * infringe the patent or other intellectual property rights of any third
140
+ * party or that the license provides you with all the necessary rights
141
+ * to make use of the Contribution.
142
+ *
143
+ * THE SOFTWARE IS PROVIDED "AS IS" WITHOUT WARRANTY OF ANY KIND. IN
144
+ * ADDITION TO THE DISCLAIMERS INCLUDED IN THE LICENSE, NOKIA
145
+ * SPECIFICALLY DISCLAIMS ANY LIABILITY FOR CLAIMS BROUGHT BY YOU OR ANY
146
+ * OTHER ENTITY BASED ON INFRINGEMENT OF INTELLECTUAL PROPERTY RIGHTS OR
147
+ * OTHERWISE. */
148
+
149
+ #include <openssl/ssl.h>
150
+
151
+ #include <assert.h>
152
+ #include <string.h>
153
+
154
+ #include <openssl/bn.h>
155
+ #include <openssl/buf.h>
156
+ #include <openssl/bytestring.h>
157
+ #include <openssl/cipher.h>
158
+ #include <openssl/ec.h>
159
+ #include <openssl/ecdsa.h>
160
+ #include <openssl/err.h>
161
+ #include <openssl/evp.h>
162
+ #include <openssl/hmac.h>
163
+ #include <openssl/md5.h>
164
+ #include <openssl/mem.h>
165
+ #include <openssl/nid.h>
166
+ #include <openssl/rand.h>
167
+ #include <openssl/x509.h>
168
+
169
+ #include "internal.h"
170
+ #include "../crypto/internal.h"
171
+
172
+
173
+ namespace bssl {
174
+
175
+ enum ssl_server_hs_state_t {
176
+ state_start_accept = 0,
177
+ state_read_client_hello,
178
+ state_select_certificate,
179
+ state_tls13,
180
+ state_select_parameters,
181
+ state_send_server_hello,
182
+ state_send_server_certificate,
183
+ state_send_server_key_exchange,
184
+ state_send_server_hello_done,
185
+ state_read_client_certificate,
186
+ state_verify_client_certificate,
187
+ state_read_client_key_exchange,
188
+ state_read_client_certificate_verify,
189
+ state_read_change_cipher_spec,
190
+ state_process_change_cipher_spec,
191
+ state_read_next_proto,
192
+ state_read_channel_id,
193
+ state_read_client_finished,
194
+ state_send_server_finished,
195
+ state_finish_server_handshake,
196
+ state_done,
197
+ };
198
+
199
+ int ssl_client_cipher_list_contains_cipher(const SSL_CLIENT_HELLO *client_hello,
200
+ uint16_t id) {
201
+ CBS cipher_suites;
202
+ CBS_init(&cipher_suites, client_hello->cipher_suites,
203
+ client_hello->cipher_suites_len);
204
+
205
+ while (CBS_len(&cipher_suites) > 0) {
206
+ uint16_t got_id;
207
+ if (!CBS_get_u16(&cipher_suites, &got_id)) {
208
+ return 0;
209
+ }
210
+
211
+ if (got_id == id) {
212
+ return 1;
213
+ }
214
+ }
215
+
216
+ return 0;
217
+ }
218
+
219
+ static int negotiate_version(SSL_HANDSHAKE *hs, uint8_t *out_alert,
220
+ const SSL_CLIENT_HELLO *client_hello) {
221
+ SSL *const ssl = hs->ssl;
222
+ assert(!ssl->s3->have_version);
223
+ CBS supported_versions, versions;
224
+ if (ssl_client_hello_get_extension(client_hello, &supported_versions,
225
+ TLSEXT_TYPE_supported_versions)) {
226
+ if (!CBS_get_u8_length_prefixed(&supported_versions, &versions) ||
227
+ CBS_len(&supported_versions) != 0 ||
228
+ CBS_len(&versions) == 0) {
229
+ OPENSSL_PUT_ERROR(SSL, SSL_R_DECODE_ERROR);
230
+ *out_alert = SSL_AD_DECODE_ERROR;
231
+ return 0;
232
+ }
233
+ } else {
234
+ // Convert the ClientHello version to an equivalent supported_versions
235
+ // extension.
236
+ static const uint8_t kTLSVersions[] = {
237
+ 0x03, 0x03, // TLS 1.2
238
+ 0x03, 0x02, // TLS 1.1
239
+ 0x03, 0x01, // TLS 1
240
+ 0x03, 0x00, // SSL 3
241
+ };
242
+
243
+ static const uint8_t kDTLSVersions[] = {
244
+ 0xfe, 0xfd, // DTLS 1.2
245
+ 0xfe, 0xff, // DTLS 1.0
246
+ };
247
+
248
+ size_t versions_len = 0;
249
+ if (SSL_is_dtls(ssl)) {
250
+ if (client_hello->version <= DTLS1_2_VERSION) {
251
+ versions_len = 4;
252
+ } else if (client_hello->version <= DTLS1_VERSION) {
253
+ versions_len = 2;
254
+ }
255
+ CBS_init(&versions, kDTLSVersions + sizeof(kDTLSVersions) - versions_len,
256
+ versions_len);
257
+ } else {
258
+ if (client_hello->version >= TLS1_2_VERSION) {
259
+ versions_len = 8;
260
+ } else if (client_hello->version >= TLS1_1_VERSION) {
261
+ versions_len = 6;
262
+ } else if (client_hello->version >= TLS1_VERSION) {
263
+ versions_len = 4;
264
+ } else if (client_hello->version >= SSL3_VERSION) {
265
+ versions_len = 2;
266
+ }
267
+ CBS_init(&versions, kTLSVersions + sizeof(kTLSVersions) - versions_len,
268
+ versions_len);
269
+ }
270
+ }
271
+
272
+ if (!ssl_negotiate_version(hs, out_alert, &ssl->version, &versions)) {
273
+ return 0;
274
+ }
275
+
276
+ // At this point, the connection's version is known and |ssl->version| is
277
+ // fixed. Begin enforcing the record-layer version.
278
+ ssl->s3->have_version = true;
279
+ ssl->s3->aead_write_ctx->SetVersionIfNullCipher(ssl->version);
280
+
281
+ // Handle FALLBACK_SCSV.
282
+ if (ssl_client_cipher_list_contains_cipher(client_hello,
283
+ SSL3_CK_FALLBACK_SCSV & 0xffff) &&
284
+ ssl3_protocol_version(ssl) < hs->max_version) {
285
+ OPENSSL_PUT_ERROR(SSL, SSL_R_INAPPROPRIATE_FALLBACK);
286
+ *out_alert = SSL3_AD_INAPPROPRIATE_FALLBACK;
287
+ return 0;
288
+ }
289
+
290
+ return 1;
291
+ }
292
+
293
+ static UniquePtr<STACK_OF(SSL_CIPHER)> ssl_parse_client_cipher_list(
294
+ const SSL_CLIENT_HELLO *client_hello) {
295
+ CBS cipher_suites;
296
+ CBS_init(&cipher_suites, client_hello->cipher_suites,
297
+ client_hello->cipher_suites_len);
298
+
299
+ UniquePtr<STACK_OF(SSL_CIPHER)> sk(sk_SSL_CIPHER_new_null());
300
+ if (!sk) {
301
+ OPENSSL_PUT_ERROR(SSL, ERR_R_MALLOC_FAILURE);
302
+ return nullptr;
303
+ }
304
+
305
+ while (CBS_len(&cipher_suites) > 0) {
306
+ uint16_t cipher_suite;
307
+
308
+ if (!CBS_get_u16(&cipher_suites, &cipher_suite)) {
309
+ OPENSSL_PUT_ERROR(SSL, SSL_R_ERROR_IN_RECEIVED_CIPHER_LIST);
310
+ return nullptr;
311
+ }
312
+
313
+ const SSL_CIPHER *c = SSL_get_cipher_by_value(cipher_suite);
314
+ if (c != NULL && !sk_SSL_CIPHER_push(sk.get(), c)) {
315
+ OPENSSL_PUT_ERROR(SSL, ERR_R_MALLOC_FAILURE);
316
+ return nullptr;
317
+ }
318
+ }
319
+
320
+ return sk;
321
+ }
322
+
323
+ // ssl_get_compatible_server_ciphers determines the key exchange and
324
+ // authentication cipher suite masks compatible with the server configuration
325
+ // and current ClientHello parameters of |hs|. It sets |*out_mask_k| to the key
326
+ // exchange mask and |*out_mask_a| to the authentication mask.
327
+ static void ssl_get_compatible_server_ciphers(SSL_HANDSHAKE *hs,
328
+ uint32_t *out_mask_k,
329
+ uint32_t *out_mask_a) {
330
+ SSL *const ssl = hs->ssl;
331
+ uint32_t mask_k = 0;
332
+ uint32_t mask_a = 0;
333
+
334
+ if (ssl_has_certificate(ssl)) {
335
+ mask_a |= ssl_cipher_auth_mask_for_key(hs->local_pubkey.get());
336
+ if (EVP_PKEY_id(hs->local_pubkey.get()) == EVP_PKEY_RSA) {
337
+ mask_k |= SSL_kRSA;
338
+ }
339
+ }
340
+
341
+ // Check for a shared group to consider ECDHE ciphers.
342
+ uint16_t unused;
343
+ if (tls1_get_shared_group(hs, &unused)) {
344
+ mask_k |= SSL_kECDHE;
345
+ }
346
+
347
+ // PSK requires a server callback.
348
+ if (ssl->psk_server_callback != NULL) {
349
+ mask_k |= SSL_kPSK;
350
+ mask_a |= SSL_aPSK;
351
+ }
352
+
353
+ *out_mask_k = mask_k;
354
+ *out_mask_a = mask_a;
355
+ }
356
+
357
+ static const SSL_CIPHER *ssl3_choose_cipher(
358
+ SSL_HANDSHAKE *hs, const SSL_CLIENT_HELLO *client_hello,
359
+ const struct ssl_cipher_preference_list_st *server_pref) {
360
+ SSL *const ssl = hs->ssl;
361
+ STACK_OF(SSL_CIPHER) *prio, *allow;
362
+ // in_group_flags will either be NULL, or will point to an array of bytes
363
+ // which indicate equal-preference groups in the |prio| stack. See the
364
+ // comment about |in_group_flags| in the |ssl_cipher_preference_list_st|
365
+ // struct.
366
+ const uint8_t *in_group_flags;
367
+ // group_min contains the minimal index so far found in a group, or -1 if no
368
+ // such value exists yet.
369
+ int group_min = -1;
370
+
371
+ UniquePtr<STACK_OF(SSL_CIPHER)> client_pref =
372
+ ssl_parse_client_cipher_list(client_hello);
373
+ if (!client_pref) {
374
+ return nullptr;
375
+ }
376
+
377
+ if (ssl->options & SSL_OP_CIPHER_SERVER_PREFERENCE) {
378
+ prio = server_pref->ciphers;
379
+ in_group_flags = server_pref->in_group_flags;
380
+ allow = client_pref.get();
381
+ } else {
382
+ prio = client_pref.get();
383
+ in_group_flags = NULL;
384
+ allow = server_pref->ciphers;
385
+ }
386
+
387
+ uint32_t mask_k, mask_a;
388
+ ssl_get_compatible_server_ciphers(hs, &mask_k, &mask_a);
389
+
390
+ for (size_t i = 0; i < sk_SSL_CIPHER_num(prio); i++) {
391
+ const SSL_CIPHER *c = sk_SSL_CIPHER_value(prio, i);
392
+
393
+ size_t cipher_index;
394
+ if (// Check if the cipher is supported for the current version.
395
+ SSL_CIPHER_get_min_version(c) <= ssl3_protocol_version(ssl) &&
396
+ ssl3_protocol_version(ssl) <= SSL_CIPHER_get_max_version(c) &&
397
+ // Check the cipher is supported for the server configuration.
398
+ (c->algorithm_mkey & mask_k) &&
399
+ (c->algorithm_auth & mask_a) &&
400
+ // Check the cipher is in the |allow| list.
401
+ sk_SSL_CIPHER_find(allow, &cipher_index, c)) {
402
+ if (in_group_flags != NULL && in_group_flags[i] == 1) {
403
+ // This element of |prio| is in a group. Update the minimum index found
404
+ // so far and continue looking.
405
+ if (group_min == -1 || (size_t)group_min > cipher_index) {
406
+ group_min = cipher_index;
407
+ }
408
+ } else {
409
+ if (group_min != -1 && (size_t)group_min < cipher_index) {
410
+ cipher_index = group_min;
411
+ }
412
+ return sk_SSL_CIPHER_value(allow, cipher_index);
413
+ }
414
+ }
415
+
416
+ if (in_group_flags != NULL && in_group_flags[i] == 0 && group_min != -1) {
417
+ // We are about to leave a group, but we found a match in it, so that's
418
+ // our answer.
419
+ return sk_SSL_CIPHER_value(allow, group_min);
420
+ }
421
+ }
422
+
423
+ return nullptr;
424
+ }
425
+
426
+ static enum ssl_hs_wait_t do_start_accept(SSL_HANDSHAKE *hs) {
427
+ ssl_do_info_callback(hs->ssl, SSL_CB_HANDSHAKE_START, 1);
428
+ hs->state = state_read_client_hello;
429
+ return ssl_hs_ok;
430
+ }
431
+
432
+ static enum ssl_hs_wait_t do_read_client_hello(SSL_HANDSHAKE *hs) {
433
+ SSL *const ssl = hs->ssl;
434
+
435
+ SSLMessage msg;
436
+ if (!ssl->method->get_message(ssl, &msg)) {
437
+ return ssl_hs_read_message;
438
+ }
439
+
440
+ if (!ssl_check_message_type(ssl, msg, SSL3_MT_CLIENT_HELLO)) {
441
+ return ssl_hs_error;
442
+ }
443
+
444
+ SSL_CLIENT_HELLO client_hello;
445
+ if (!ssl_client_hello_init(ssl, &client_hello, msg)) {
446
+ OPENSSL_PUT_ERROR(SSL, SSL_R_DECODE_ERROR);
447
+ ssl3_send_alert(ssl, SSL3_AL_FATAL, SSL_AD_DECODE_ERROR);
448
+ return ssl_hs_error;
449
+ }
450
+
451
+ // Run the early callback.
452
+ if (ssl->ctx->select_certificate_cb != NULL) {
453
+ switch (ssl->ctx->select_certificate_cb(&client_hello)) {
454
+ case ssl_select_cert_retry:
455
+ return ssl_hs_certificate_selection_pending;
456
+
457
+ case ssl_select_cert_error:
458
+ // Connection rejected.
459
+ OPENSSL_PUT_ERROR(SSL, SSL_R_CONNECTION_REJECTED);
460
+ ssl3_send_alert(ssl, SSL3_AL_FATAL, SSL_AD_HANDSHAKE_FAILURE);
461
+ return ssl_hs_error;
462
+
463
+ default:
464
+ /* fallthrough */;
465
+ }
466
+ }
467
+
468
+ // Freeze the version range after the early callback.
469
+ if (!ssl_get_version_range(ssl, &hs->min_version, &hs->max_version)) {
470
+ return ssl_hs_error;
471
+ }
472
+
473
+ uint8_t alert = SSL_AD_DECODE_ERROR;
474
+ if (!negotiate_version(hs, &alert, &client_hello)) {
475
+ ssl3_send_alert(ssl, SSL3_AL_FATAL, alert);
476
+ return ssl_hs_error;
477
+ }
478
+
479
+ hs->client_version = client_hello.version;
480
+ if (client_hello.random_len != SSL3_RANDOM_SIZE) {
481
+ OPENSSL_PUT_ERROR(SSL, ERR_R_INTERNAL_ERROR);
482
+ return ssl_hs_error;
483
+ }
484
+ OPENSSL_memcpy(ssl->s3->client_random, client_hello.random,
485
+ client_hello.random_len);
486
+
487
+ // Only null compression is supported. TLS 1.3 further requires the peer
488
+ // advertise no other compression.
489
+ if (OPENSSL_memchr(client_hello.compression_methods, 0,
490
+ client_hello.compression_methods_len) == NULL ||
491
+ (ssl3_protocol_version(ssl) >= TLS1_3_VERSION &&
492
+ client_hello.compression_methods_len != 1)) {
493
+ OPENSSL_PUT_ERROR(SSL, SSL_R_INVALID_COMPRESSION_LIST);
494
+ ssl3_send_alert(ssl, SSL3_AL_FATAL, SSL_AD_ILLEGAL_PARAMETER);
495
+ return ssl_hs_error;
496
+ }
497
+
498
+ // TLS extensions.
499
+ if (!ssl_parse_clienthello_tlsext(hs, &client_hello)) {
500
+ OPENSSL_PUT_ERROR(SSL, SSL_R_PARSE_TLSEXT);
501
+ return ssl_hs_error;
502
+ }
503
+
504
+ hs->state = state_select_certificate;
505
+ return ssl_hs_ok;
506
+ }
507
+
508
+ static enum ssl_hs_wait_t do_select_certificate(SSL_HANDSHAKE *hs) {
509
+ SSL *const ssl = hs->ssl;
510
+
511
+ SSLMessage msg;
512
+ if (!ssl->method->get_message(ssl, &msg)) {
513
+ return ssl_hs_read_message;
514
+ }
515
+
516
+ // Call |cert_cb| to update server certificates if required.
517
+ if (ssl->cert->cert_cb != NULL) {
518
+ int rv = ssl->cert->cert_cb(ssl, ssl->cert->cert_cb_arg);
519
+ if (rv == 0) {
520
+ OPENSSL_PUT_ERROR(SSL, SSL_R_CERT_CB_ERROR);
521
+ ssl3_send_alert(ssl, SSL3_AL_FATAL, SSL_AD_INTERNAL_ERROR);
522
+ return ssl_hs_error;
523
+ }
524
+ if (rv < 0) {
525
+ return ssl_hs_x509_lookup;
526
+ }
527
+ }
528
+
529
+ if (!ssl_on_certificate_selected(hs)) {
530
+ return ssl_hs_error;
531
+ }
532
+
533
+ if (ssl3_protocol_version(ssl) >= TLS1_3_VERSION) {
534
+ // Jump to the TLS 1.3 state machine.
535
+ hs->state = state_tls13;
536
+ return ssl_hs_ok;
537
+ }
538
+
539
+ SSL_CLIENT_HELLO client_hello;
540
+ if (!ssl_client_hello_init(ssl, &client_hello, msg)) {
541
+ return ssl_hs_error;
542
+ }
543
+
544
+ // Negotiate the cipher suite. This must be done after |cert_cb| so the
545
+ // certificate is finalized.
546
+ hs->new_cipher =
547
+ ssl3_choose_cipher(hs, &client_hello, ssl_get_cipher_preferences(ssl));
548
+ if (hs->new_cipher == NULL) {
549
+ OPENSSL_PUT_ERROR(SSL, SSL_R_NO_SHARED_CIPHER);
550
+ ssl3_send_alert(ssl, SSL3_AL_FATAL, SSL_AD_HANDSHAKE_FAILURE);
551
+ return ssl_hs_error;
552
+ }
553
+
554
+ hs->state = state_select_parameters;
555
+ return ssl_hs_ok;
556
+ }
557
+
558
+ static enum ssl_hs_wait_t do_tls13(SSL_HANDSHAKE *hs) {
559
+ enum ssl_hs_wait_t wait = tls13_server_handshake(hs);
560
+ if (wait == ssl_hs_ok) {
561
+ hs->state = state_finish_server_handshake;
562
+ return ssl_hs_ok;
563
+ }
564
+
565
+ return wait;
566
+ }
567
+
568
+ static enum ssl_hs_wait_t do_select_parameters(SSL_HANDSHAKE *hs) {
569
+ SSL *const ssl = hs->ssl;
570
+
571
+ SSLMessage msg;
572
+ if (!ssl->method->get_message(ssl, &msg)) {
573
+ return ssl_hs_read_message;
574
+ }
575
+
576
+ SSL_CLIENT_HELLO client_hello;
577
+ if (!ssl_client_hello_init(ssl, &client_hello, msg)) {
578
+ return ssl_hs_error;
579
+ }
580
+
581
+ // Determine whether we are doing session resumption.
582
+ UniquePtr<SSL_SESSION> session;
583
+ bool tickets_supported = false, renew_ticket = false;
584
+ enum ssl_hs_wait_t wait = ssl_get_prev_session(
585
+ ssl, &session, &tickets_supported, &renew_ticket, &client_hello);
586
+ if (wait != ssl_hs_ok) {
587
+ return wait;
588
+ }
589
+
590
+ if (session) {
591
+ if (session->extended_master_secret && !hs->extended_master_secret) {
592
+ // A ClientHello without EMS that attempts to resume a session with EMS
593
+ // is fatal to the connection.
594
+ OPENSSL_PUT_ERROR(SSL, SSL_R_RESUMED_EMS_SESSION_WITHOUT_EMS_EXTENSION);
595
+ ssl3_send_alert(ssl, SSL3_AL_FATAL, SSL_AD_HANDSHAKE_FAILURE);
596
+ return ssl_hs_error;
597
+ }
598
+
599
+ if (!ssl_session_is_resumable(hs, session.get()) ||
600
+ // If the client offers the EMS extension, but the previous session
601
+ // didn't use it, then negotiate a new session.
602
+ hs->extended_master_secret != session->extended_master_secret) {
603
+ session.reset();
604
+ }
605
+ }
606
+
607
+ if (session) {
608
+ // Use the old session.
609
+ hs->ticket_expected = renew_ticket;
610
+ ssl->session = session.release();
611
+ ssl->s3->session_reused = true;
612
+ } else {
613
+ hs->ticket_expected = tickets_supported;
614
+ ssl_set_session(ssl, NULL);
615
+ if (!ssl_get_new_session(hs, 1 /* server */)) {
616
+ return ssl_hs_error;
617
+ }
618
+
619
+ // Clear the session ID if we want the session to be single-use.
620
+ if (!(ssl->ctx->session_cache_mode & SSL_SESS_CACHE_SERVER)) {
621
+ hs->new_session->session_id_length = 0;
622
+ }
623
+ }
624
+
625
+ if (ssl->ctx->dos_protection_cb != NULL &&
626
+ ssl->ctx->dos_protection_cb(&client_hello) == 0) {
627
+ // Connection rejected for DOS reasons.
628
+ OPENSSL_PUT_ERROR(SSL, SSL_R_CONNECTION_REJECTED);
629
+ ssl3_send_alert(ssl, SSL3_AL_FATAL, SSL_AD_INTERNAL_ERROR);
630
+ return ssl_hs_error;
631
+ }
632
+
633
+ if (ssl->session == NULL) {
634
+ hs->new_session->cipher = hs->new_cipher;
635
+
636
+ // Determine whether to request a client certificate.
637
+ hs->cert_request = !!(ssl->verify_mode & SSL_VERIFY_PEER);
638
+ // Only request a certificate if Channel ID isn't negotiated.
639
+ if ((ssl->verify_mode & SSL_VERIFY_PEER_IF_NO_OBC) &&
640
+ ssl->s3->tlsext_channel_id_valid) {
641
+ hs->cert_request = false;
642
+ }
643
+ // CertificateRequest may only be sent in certificate-based ciphers.
644
+ if (!ssl_cipher_uses_certificate_auth(hs->new_cipher)) {
645
+ hs->cert_request = false;
646
+ }
647
+
648
+ if (!hs->cert_request) {
649
+ // OpenSSL returns X509_V_OK when no certificates are requested. This is
650
+ // classed by them as a bug, but it's assumed by at least NGINX.
651
+ hs->new_session->verify_result = X509_V_OK;
652
+ }
653
+ }
654
+
655
+ // HTTP/2 negotiation depends on the cipher suite, so ALPN negotiation was
656
+ // deferred. Complete it now.
657
+ uint8_t alert = SSL_AD_DECODE_ERROR;
658
+ if (!ssl_negotiate_alpn(hs, &alert, &client_hello)) {
659
+ ssl3_send_alert(ssl, SSL3_AL_FATAL, alert);
660
+ return ssl_hs_error;
661
+ }
662
+
663
+ // Now that all parameters are known, initialize the handshake hash and hash
664
+ // the ClientHello.
665
+ if (!hs->transcript.InitHash(ssl3_protocol_version(ssl), hs->new_cipher) ||
666
+ !ssl_hash_message(hs, msg)) {
667
+ ssl3_send_alert(ssl, SSL3_AL_FATAL, SSL_AD_INTERNAL_ERROR);
668
+ return ssl_hs_error;
669
+ }
670
+
671
+ // Release the handshake buffer if client authentication isn't required.
672
+ if (!hs->cert_request) {
673
+ hs->transcript.FreeBuffer();
674
+ }
675
+
676
+ ssl->method->next_message(ssl);
677
+
678
+ hs->state = state_send_server_hello;
679
+ return ssl_hs_ok;
680
+ }
681
+
682
+ static enum ssl_hs_wait_t do_send_server_hello(SSL_HANDSHAKE *hs) {
683
+ SSL *const ssl = hs->ssl;
684
+
685
+ // We only accept ChannelIDs on connections with ECDHE in order to avoid a
686
+ // known attack while we fix ChannelID itself.
687
+ if (ssl->s3->tlsext_channel_id_valid &&
688
+ (hs->new_cipher->algorithm_mkey & SSL_kECDHE) == 0) {
689
+ ssl->s3->tlsext_channel_id_valid = false;
690
+ }
691
+
692
+ // If this is a resumption and the original handshake didn't support
693
+ // ChannelID then we didn't record the original handshake hashes in the
694
+ // session and so cannot resume with ChannelIDs.
695
+ if (ssl->session != NULL &&
696
+ ssl->session->original_handshake_hash_len == 0) {
697
+ ssl->s3->tlsext_channel_id_valid = false;
698
+ }
699
+
700
+ struct OPENSSL_timeval now;
701
+ ssl_get_current_time(ssl, &now);
702
+ ssl->s3->server_random[0] = now.tv_sec >> 24;
703
+ ssl->s3->server_random[1] = now.tv_sec >> 16;
704
+ ssl->s3->server_random[2] = now.tv_sec >> 8;
705
+ ssl->s3->server_random[3] = now.tv_sec;
706
+ if (!RAND_bytes(ssl->s3->server_random + 4, SSL3_RANDOM_SIZE - 4)) {
707
+ return ssl_hs_error;
708
+ }
709
+
710
+ // TODO(davidben): Implement the TLS 1.1 and 1.2 downgrade sentinels once TLS
711
+ // 1.3 is finalized and we are not implementing a draft version.
712
+
713
+ const SSL_SESSION *session = hs->new_session.get();
714
+ if (ssl->session != NULL) {
715
+ session = ssl->session;
716
+ }
717
+
718
+ ScopedCBB cbb;
719
+ CBB body, session_id;
720
+ if (!ssl->method->init_message(ssl, cbb.get(), &body, SSL3_MT_SERVER_HELLO) ||
721
+ !CBB_add_u16(&body, ssl->version) ||
722
+ !CBB_add_bytes(&body, ssl->s3->server_random, SSL3_RANDOM_SIZE) ||
723
+ !CBB_add_u8_length_prefixed(&body, &session_id) ||
724
+ !CBB_add_bytes(&session_id, session->session_id,
725
+ session->session_id_length) ||
726
+ !CBB_add_u16(&body, ssl_cipher_get_value(hs->new_cipher)) ||
727
+ !CBB_add_u8(&body, 0 /* no compression */) ||
728
+ !ssl_add_serverhello_tlsext(hs, &body) ||
729
+ !ssl_add_message_cbb(ssl, cbb.get())) {
730
+ OPENSSL_PUT_ERROR(SSL, ERR_R_INTERNAL_ERROR);
731
+ return ssl_hs_error;
732
+ }
733
+
734
+ if (ssl->session != NULL) {
735
+ hs->state = state_send_server_finished;
736
+ } else {
737
+ hs->state = state_send_server_certificate;
738
+ }
739
+ return ssl_hs_ok;
740
+ }
741
+
742
+ static enum ssl_hs_wait_t do_send_server_certificate(SSL_HANDSHAKE *hs) {
743
+ SSL *const ssl = hs->ssl;
744
+ ScopedCBB cbb;
745
+
746
+ if (ssl_cipher_uses_certificate_auth(hs->new_cipher)) {
747
+ if (!ssl_has_certificate(ssl)) {
748
+ OPENSSL_PUT_ERROR(SSL, SSL_R_NO_CERTIFICATE_SET);
749
+ return ssl_hs_error;
750
+ }
751
+
752
+ if (!ssl3_output_cert_chain(ssl)) {
753
+ return ssl_hs_error;
754
+ }
755
+
756
+ if (hs->certificate_status_expected) {
757
+ CBB body, ocsp_response;
758
+ if (!ssl->method->init_message(ssl, cbb.get(), &body,
759
+ SSL3_MT_CERTIFICATE_STATUS) ||
760
+ !CBB_add_u8(&body, TLSEXT_STATUSTYPE_ocsp) ||
761
+ !CBB_add_u24_length_prefixed(&body, &ocsp_response) ||
762
+ !CBB_add_bytes(&ocsp_response,
763
+ CRYPTO_BUFFER_data(ssl->cert->ocsp_response),
764
+ CRYPTO_BUFFER_len(ssl->cert->ocsp_response)) ||
765
+ !ssl_add_message_cbb(ssl, cbb.get())) {
766
+ OPENSSL_PUT_ERROR(SSL, ERR_R_INTERNAL_ERROR);
767
+ return ssl_hs_error;
768
+ }
769
+ }
770
+ }
771
+
772
+ // Assemble ServerKeyExchange parameters if needed.
773
+ uint32_t alg_k = hs->new_cipher->algorithm_mkey;
774
+ uint32_t alg_a = hs->new_cipher->algorithm_auth;
775
+ if (ssl_cipher_requires_server_key_exchange(hs->new_cipher) ||
776
+ ((alg_a & SSL_aPSK) && ssl->psk_identity_hint)) {
777
+
778
+ // Pre-allocate enough room to comfortably fit an ECDHE public key. Prepend
779
+ // the client and server randoms for the signing transcript.
780
+ CBB child;
781
+ if (!CBB_init(cbb.get(), SSL3_RANDOM_SIZE * 2 + 128) ||
782
+ !CBB_add_bytes(cbb.get(), ssl->s3->client_random, SSL3_RANDOM_SIZE) ||
783
+ !CBB_add_bytes(cbb.get(), ssl->s3->server_random, SSL3_RANDOM_SIZE)) {
784
+ return ssl_hs_error;
785
+ }
786
+
787
+ // PSK ciphers begin with an identity hint.
788
+ if (alg_a & SSL_aPSK) {
789
+ size_t len =
790
+ (ssl->psk_identity_hint == NULL) ? 0 : strlen(ssl->psk_identity_hint);
791
+ if (!CBB_add_u16_length_prefixed(cbb.get(), &child) ||
792
+ !CBB_add_bytes(&child, (const uint8_t *)ssl->psk_identity_hint,
793
+ len)) {
794
+ return ssl_hs_error;
795
+ }
796
+ }
797
+
798
+ if (alg_k & SSL_kECDHE) {
799
+ // Determine the group to use.
800
+ uint16_t group_id;
801
+ if (!tls1_get_shared_group(hs, &group_id)) {
802
+ OPENSSL_PUT_ERROR(SSL, ERR_R_INTERNAL_ERROR);
803
+ ssl3_send_alert(ssl, SSL3_AL_FATAL, SSL_AD_HANDSHAKE_FAILURE);
804
+ return ssl_hs_error;
805
+ }
806
+ hs->new_session->group_id = group_id;
807
+
808
+ // Set up ECDH, generate a key, and emit the public half.
809
+ hs->key_share = SSLKeyShare::Create(group_id);
810
+ if (!hs->key_share ||
811
+ !CBB_add_u8(cbb.get(), NAMED_CURVE_TYPE) ||
812
+ !CBB_add_u16(cbb.get(), group_id) ||
813
+ !CBB_add_u8_length_prefixed(cbb.get(), &child) ||
814
+ !hs->key_share->Offer(&child)) {
815
+ return ssl_hs_error;
816
+ }
817
+ } else {
818
+ assert(alg_k & SSL_kPSK);
819
+ }
820
+
821
+ if (!CBBFinishArray(cbb.get(), &hs->server_params)) {
822
+ return ssl_hs_error;
823
+ }
824
+ }
825
+
826
+ hs->state = state_send_server_key_exchange;
827
+ return ssl_hs_ok;
828
+ }
829
+
830
+ static enum ssl_hs_wait_t do_send_server_key_exchange(SSL_HANDSHAKE *hs) {
831
+ SSL *const ssl = hs->ssl;
832
+
833
+ if (hs->server_params.size() == 0) {
834
+ hs->state = state_send_server_hello_done;
835
+ return ssl_hs_ok;
836
+ }
837
+
838
+ ScopedCBB cbb;
839
+ CBB body, child;
840
+ if (!ssl->method->init_message(ssl, cbb.get(), &body,
841
+ SSL3_MT_SERVER_KEY_EXCHANGE) ||
842
+ // |hs->server_params| contains a prefix for signing.
843
+ hs->server_params.size() < 2 * SSL3_RANDOM_SIZE ||
844
+ !CBB_add_bytes(&body, hs->server_params.data() + 2 * SSL3_RANDOM_SIZE,
845
+ hs->server_params.size() - 2 * SSL3_RANDOM_SIZE)) {
846
+ return ssl_hs_error;
847
+ }
848
+
849
+ // Add a signature.
850
+ if (ssl_cipher_uses_certificate_auth(hs->new_cipher)) {
851
+ if (!ssl_has_private_key(ssl)) {
852
+ ssl3_send_alert(ssl, SSL3_AL_FATAL, SSL_AD_INTERNAL_ERROR);
853
+ return ssl_hs_error;
854
+ }
855
+
856
+ // Determine the signature algorithm.
857
+ uint16_t signature_algorithm;
858
+ if (!tls1_choose_signature_algorithm(hs, &signature_algorithm)) {
859
+ return ssl_hs_error;
860
+ }
861
+ if (ssl3_protocol_version(ssl) >= TLS1_2_VERSION) {
862
+ if (!CBB_add_u16(&body, signature_algorithm)) {
863
+ OPENSSL_PUT_ERROR(SSL, ERR_R_INTERNAL_ERROR);
864
+ ssl3_send_alert(ssl, SSL3_AL_FATAL, SSL_AD_INTERNAL_ERROR);
865
+ return ssl_hs_error;
866
+ }
867
+ }
868
+
869
+ // Add space for the signature.
870
+ const size_t max_sig_len = EVP_PKEY_size(hs->local_pubkey.get());
871
+ uint8_t *ptr;
872
+ if (!CBB_add_u16_length_prefixed(&body, &child) ||
873
+ !CBB_reserve(&child, &ptr, max_sig_len)) {
874
+ return ssl_hs_error;
875
+ }
876
+
877
+ size_t sig_len;
878
+ switch (ssl_private_key_sign(hs, ptr, &sig_len, max_sig_len,
879
+ signature_algorithm, hs->server_params.data(),
880
+ hs->server_params.size())) {
881
+ case ssl_private_key_success:
882
+ if (!CBB_did_write(&child, sig_len)) {
883
+ return ssl_hs_error;
884
+ }
885
+ break;
886
+ case ssl_private_key_failure:
887
+ return ssl_hs_error;
888
+ case ssl_private_key_retry:
889
+ return ssl_hs_private_key_operation;
890
+ }
891
+ }
892
+
893
+ if (!ssl_add_message_cbb(ssl, cbb.get())) {
894
+ return ssl_hs_error;
895
+ }
896
+
897
+ hs->server_params.Reset();
898
+
899
+ hs->state = state_send_server_hello_done;
900
+ return ssl_hs_ok;
901
+ }
902
+
903
+ static enum ssl_hs_wait_t do_send_server_hello_done(SSL_HANDSHAKE *hs) {
904
+ SSL *const ssl = hs->ssl;
905
+
906
+ ScopedCBB cbb;
907
+ CBB body;
908
+
909
+ if (hs->cert_request) {
910
+ CBB cert_types, sigalgs_cbb;
911
+ if (!ssl->method->init_message(ssl, cbb.get(), &body,
912
+ SSL3_MT_CERTIFICATE_REQUEST) ||
913
+ !CBB_add_u8_length_prefixed(&body, &cert_types) ||
914
+ !CBB_add_u8(&cert_types, SSL3_CT_RSA_SIGN) ||
915
+ (ssl3_protocol_version(ssl) >= TLS1_VERSION &&
916
+ !CBB_add_u8(&cert_types, TLS_CT_ECDSA_SIGN)) ||
917
+ (ssl3_protocol_version(ssl) >= TLS1_2_VERSION &&
918
+ (!CBB_add_u16_length_prefixed(&body, &sigalgs_cbb) ||
919
+ !tls12_add_verify_sigalgs(ssl, &sigalgs_cbb))) ||
920
+ !ssl_add_client_CA_list(ssl, &body) ||
921
+ !ssl_add_message_cbb(ssl, cbb.get())) {
922
+ OPENSSL_PUT_ERROR(SSL, ERR_R_INTERNAL_ERROR);
923
+ return ssl_hs_error;
924
+ }
925
+ }
926
+
927
+ if (!ssl->method->init_message(ssl, cbb.get(), &body,
928
+ SSL3_MT_SERVER_HELLO_DONE) ||
929
+ !ssl_add_message_cbb(ssl, cbb.get())) {
930
+ OPENSSL_PUT_ERROR(SSL, ERR_R_INTERNAL_ERROR);
931
+ return ssl_hs_error;
932
+ }
933
+
934
+ hs->state = state_read_client_certificate;
935
+ return ssl_hs_flush;
936
+ }
937
+
938
+ static enum ssl_hs_wait_t do_read_client_certificate(SSL_HANDSHAKE *hs) {
939
+ SSL *const ssl = hs->ssl;
940
+
941
+ if (!hs->cert_request) {
942
+ hs->state = state_verify_client_certificate;
943
+ return ssl_hs_ok;
944
+ }
945
+
946
+ SSLMessage msg;
947
+ if (!ssl->method->get_message(ssl, &msg)) {
948
+ return ssl_hs_read_message;
949
+ }
950
+
951
+ if (msg.type != SSL3_MT_CERTIFICATE) {
952
+ if (ssl->version == SSL3_VERSION &&
953
+ msg.type == SSL3_MT_CLIENT_KEY_EXCHANGE) {
954
+ // In SSL 3.0, the Certificate message is omitted to signal no
955
+ // certificate.
956
+ if (ssl->verify_mode & SSL_VERIFY_FAIL_IF_NO_PEER_CERT) {
957
+ OPENSSL_PUT_ERROR(SSL, SSL_R_PEER_DID_NOT_RETURN_A_CERTIFICATE);
958
+ ssl3_send_alert(ssl, SSL3_AL_FATAL, SSL_AD_HANDSHAKE_FAILURE);
959
+ return ssl_hs_error;
960
+ }
961
+
962
+ // OpenSSL returns X509_V_OK when no certificates are received. This is
963
+ // classed by them as a bug, but it's assumed by at least NGINX.
964
+ hs->new_session->verify_result = X509_V_OK;
965
+ hs->state = state_verify_client_certificate;
966
+ return ssl_hs_ok;
967
+ }
968
+
969
+ OPENSSL_PUT_ERROR(SSL, SSL_R_UNEXPECTED_MESSAGE);
970
+ ssl3_send_alert(ssl, SSL3_AL_FATAL, SSL_AD_UNEXPECTED_MESSAGE);
971
+ return ssl_hs_error;
972
+ }
973
+
974
+ if (!ssl_hash_message(hs, msg)) {
975
+ return ssl_hs_error;
976
+ }
977
+
978
+ CBS certificate_msg = msg.body;
979
+ uint8_t alert = SSL_AD_DECODE_ERROR;
980
+ UniquePtr<STACK_OF(CRYPTO_BUFFER)> chain;
981
+ if (!ssl_parse_cert_chain(&alert, &chain, &hs->peer_pubkey,
982
+ ssl->retain_only_sha256_of_client_certs
983
+ ? hs->new_session->peer_sha256
984
+ : NULL,
985
+ &certificate_msg, ssl->ctx->pool)) {
986
+ ssl3_send_alert(ssl, SSL3_AL_FATAL, alert);
987
+ return ssl_hs_error;
988
+ }
989
+ sk_CRYPTO_BUFFER_pop_free(hs->new_session->certs, CRYPTO_BUFFER_free);
990
+ hs->new_session->certs = chain.release();
991
+
992
+ if (CBS_len(&certificate_msg) != 0 ||
993
+ !ssl->ctx->x509_method->session_cache_objects(hs->new_session.get())) {
994
+ OPENSSL_PUT_ERROR(SSL, SSL_R_DECODE_ERROR);
995
+ ssl3_send_alert(ssl, SSL3_AL_FATAL, SSL_AD_DECODE_ERROR);
996
+ return ssl_hs_error;
997
+ }
998
+
999
+ if (sk_CRYPTO_BUFFER_num(hs->new_session->certs) == 0) {
1000
+ // No client certificate so the handshake buffer may be discarded.
1001
+ hs->transcript.FreeBuffer();
1002
+
1003
+ // In SSL 3.0, sending no certificate is signaled by omitting the
1004
+ // Certificate message.
1005
+ if (ssl->version == SSL3_VERSION) {
1006
+ OPENSSL_PUT_ERROR(SSL, SSL_R_NO_CERTIFICATES_RETURNED);
1007
+ ssl3_send_alert(ssl, SSL3_AL_FATAL, SSL_AD_HANDSHAKE_FAILURE);
1008
+ return ssl_hs_error;
1009
+ }
1010
+
1011
+ if (ssl->verify_mode & SSL_VERIFY_FAIL_IF_NO_PEER_CERT) {
1012
+ // Fail for TLS only if we required a certificate
1013
+ OPENSSL_PUT_ERROR(SSL, SSL_R_PEER_DID_NOT_RETURN_A_CERTIFICATE);
1014
+ ssl3_send_alert(ssl, SSL3_AL_FATAL, SSL_AD_HANDSHAKE_FAILURE);
1015
+ return ssl_hs_error;
1016
+ }
1017
+
1018
+ // OpenSSL returns X509_V_OK when no certificates are received. This is
1019
+ // classed by them as a bug, but it's assumed by at least NGINX.
1020
+ hs->new_session->verify_result = X509_V_OK;
1021
+ } else if (ssl->retain_only_sha256_of_client_certs) {
1022
+ // The hash will have been filled in.
1023
+ hs->new_session->peer_sha256_valid = 1;
1024
+ }
1025
+
1026
+ ssl->method->next_message(ssl);
1027
+ hs->state = state_verify_client_certificate;
1028
+ return ssl_hs_ok;
1029
+ }
1030
+
1031
+ static enum ssl_hs_wait_t do_verify_client_certificate(SSL_HANDSHAKE *hs) {
1032
+ if (sk_CRYPTO_BUFFER_num(hs->new_session->certs) > 0) {
1033
+ switch (ssl_verify_peer_cert(hs)) {
1034
+ case ssl_verify_ok:
1035
+ break;
1036
+ case ssl_verify_invalid:
1037
+ return ssl_hs_error;
1038
+ case ssl_verify_retry:
1039
+ return ssl_hs_certificate_verify;
1040
+ }
1041
+ }
1042
+
1043
+ hs->state = state_read_client_key_exchange;
1044
+ return ssl_hs_ok;
1045
+ }
1046
+
1047
+ static enum ssl_hs_wait_t do_read_client_key_exchange(SSL_HANDSHAKE *hs) {
1048
+ SSL *const ssl = hs->ssl;
1049
+ SSLMessage msg;
1050
+ if (!ssl->method->get_message(ssl, &msg)) {
1051
+ return ssl_hs_read_message;
1052
+ }
1053
+
1054
+ if (!ssl_check_message_type(ssl, msg, SSL3_MT_CLIENT_KEY_EXCHANGE)) {
1055
+ return ssl_hs_error;
1056
+ }
1057
+
1058
+ CBS client_key_exchange = msg.body;
1059
+ uint32_t alg_k = hs->new_cipher->algorithm_mkey;
1060
+ uint32_t alg_a = hs->new_cipher->algorithm_auth;
1061
+
1062
+ // If using a PSK key exchange, parse the PSK identity.
1063
+ if (alg_a & SSL_aPSK) {
1064
+ CBS psk_identity;
1065
+
1066
+ // If using PSK, the ClientKeyExchange contains a psk_identity. If PSK,
1067
+ // then this is the only field in the message.
1068
+ if (!CBS_get_u16_length_prefixed(&client_key_exchange, &psk_identity) ||
1069
+ ((alg_k & SSL_kPSK) && CBS_len(&client_key_exchange) != 0)) {
1070
+ OPENSSL_PUT_ERROR(SSL, SSL_R_DECODE_ERROR);
1071
+ ssl3_send_alert(ssl, SSL3_AL_FATAL, SSL_AD_DECODE_ERROR);
1072
+ return ssl_hs_error;
1073
+ }
1074
+
1075
+ if (CBS_len(&psk_identity) > PSK_MAX_IDENTITY_LEN ||
1076
+ CBS_contains_zero_byte(&psk_identity)) {
1077
+ OPENSSL_PUT_ERROR(SSL, SSL_R_DATA_LENGTH_TOO_LONG);
1078
+ ssl3_send_alert(ssl, SSL3_AL_FATAL, SSL_AD_ILLEGAL_PARAMETER);
1079
+ return ssl_hs_error;
1080
+ }
1081
+
1082
+ if (!CBS_strdup(&psk_identity, &hs->new_session->psk_identity)) {
1083
+ OPENSSL_PUT_ERROR(SSL, ERR_R_MALLOC_FAILURE);
1084
+ ssl3_send_alert(ssl, SSL3_AL_FATAL, SSL_AD_INTERNAL_ERROR);
1085
+ return ssl_hs_error;
1086
+ }
1087
+ }
1088
+
1089
+ // Depending on the key exchange method, compute |premaster_secret|.
1090
+ Array<uint8_t> premaster_secret;
1091
+ if (alg_k & SSL_kRSA) {
1092
+ CBS encrypted_premaster_secret;
1093
+ if (ssl->version > SSL3_VERSION) {
1094
+ if (!CBS_get_u16_length_prefixed(&client_key_exchange,
1095
+ &encrypted_premaster_secret) ||
1096
+ CBS_len(&client_key_exchange) != 0) {
1097
+ OPENSSL_PUT_ERROR(SSL, SSL_R_DECODE_ERROR);
1098
+ ssl3_send_alert(ssl, SSL3_AL_FATAL, SSL_AD_DECODE_ERROR);
1099
+ return ssl_hs_error;
1100
+ }
1101
+ } else {
1102
+ encrypted_premaster_secret = client_key_exchange;
1103
+ }
1104
+
1105
+ // Allocate a buffer large enough for an RSA decryption.
1106
+ Array<uint8_t> decrypt_buf;
1107
+ if (!decrypt_buf.Init(EVP_PKEY_size(hs->local_pubkey.get()))) {
1108
+ return ssl_hs_error;
1109
+ }
1110
+
1111
+ // Decrypt with no padding. PKCS#1 padding will be removed as part of the
1112
+ // timing-sensitive code below.
1113
+ size_t decrypt_len;
1114
+ switch (ssl_private_key_decrypt(hs, decrypt_buf.data(), &decrypt_len,
1115
+ decrypt_buf.size(),
1116
+ CBS_data(&encrypted_premaster_secret),
1117
+ CBS_len(&encrypted_premaster_secret))) {
1118
+ case ssl_private_key_success:
1119
+ break;
1120
+ case ssl_private_key_failure:
1121
+ return ssl_hs_error;
1122
+ case ssl_private_key_retry:
1123
+ return ssl_hs_private_key_operation;
1124
+ }
1125
+
1126
+ if (decrypt_len != decrypt_buf.size()) {
1127
+ OPENSSL_PUT_ERROR(SSL, SSL_R_DECRYPTION_FAILED);
1128
+ ssl3_send_alert(ssl, SSL3_AL_FATAL, SSL_AD_DECRYPT_ERROR);
1129
+ return ssl_hs_error;
1130
+ }
1131
+
1132
+ // Prepare a random premaster, to be used on invalid padding. See RFC 5246,
1133
+ // section 7.4.7.1.
1134
+ if (!premaster_secret.Init(SSL_MAX_MASTER_KEY_LENGTH) ||
1135
+ !RAND_bytes(premaster_secret.data(), premaster_secret.size())) {
1136
+ return ssl_hs_error;
1137
+ }
1138
+
1139
+ // The smallest padded premaster is 11 bytes of overhead. Small keys are
1140
+ // publicly invalid.
1141
+ if (decrypt_len < 11 + premaster_secret.size()) {
1142
+ OPENSSL_PUT_ERROR(SSL, SSL_R_DECRYPTION_FAILED);
1143
+ ssl3_send_alert(ssl, SSL3_AL_FATAL, SSL_AD_DECRYPT_ERROR);
1144
+ return ssl_hs_error;
1145
+ }
1146
+
1147
+ // Check the padding. See RFC 3447, section 7.2.2.
1148
+ size_t padding_len = decrypt_len - premaster_secret.size();
1149
+ uint8_t good = constant_time_eq_int_8(decrypt_buf[0], 0) &
1150
+ constant_time_eq_int_8(decrypt_buf[1], 2);
1151
+ for (size_t i = 2; i < padding_len - 1; i++) {
1152
+ good &= ~constant_time_is_zero_8(decrypt_buf[i]);
1153
+ }
1154
+ good &= constant_time_is_zero_8(decrypt_buf[padding_len - 1]);
1155
+
1156
+ // The premaster secret must begin with |client_version|. This too must be
1157
+ // checked in constant time (http://eprint.iacr.org/2003/052/).
1158
+ good &= constant_time_eq_8(decrypt_buf[padding_len],
1159
+ (unsigned)(hs->client_version >> 8));
1160
+ good &= constant_time_eq_8(decrypt_buf[padding_len + 1],
1161
+ (unsigned)(hs->client_version & 0xff));
1162
+
1163
+ // Select, in constant time, either the decrypted premaster or the random
1164
+ // premaster based on |good|.
1165
+ for (size_t i = 0; i < premaster_secret.size(); i++) {
1166
+ premaster_secret[i] = constant_time_select_8(
1167
+ good, decrypt_buf[padding_len + i], premaster_secret[i]);
1168
+ }
1169
+ } else if (alg_k & SSL_kECDHE) {
1170
+ // Parse the ClientKeyExchange.
1171
+ CBS peer_key;
1172
+ if (!CBS_get_u8_length_prefixed(&client_key_exchange, &peer_key) ||
1173
+ CBS_len(&client_key_exchange) != 0) {
1174
+ OPENSSL_PUT_ERROR(SSL, SSL_R_DECODE_ERROR);
1175
+ ssl3_send_alert(ssl, SSL3_AL_FATAL, SSL_AD_DECODE_ERROR);
1176
+ return ssl_hs_error;
1177
+ }
1178
+
1179
+ // Compute the premaster.
1180
+ uint8_t alert = SSL_AD_DECODE_ERROR;
1181
+ if (!hs->key_share->Finish(&premaster_secret, &alert, peer_key)) {
1182
+ ssl3_send_alert(ssl, SSL3_AL_FATAL, alert);
1183
+ return ssl_hs_error;
1184
+ }
1185
+
1186
+ // The key exchange state may now be discarded.
1187
+ hs->key_share.reset();
1188
+ } else if (!(alg_k & SSL_kPSK)) {
1189
+ OPENSSL_PUT_ERROR(SSL, ERR_R_INTERNAL_ERROR);
1190
+ ssl3_send_alert(ssl, SSL3_AL_FATAL, SSL_AD_HANDSHAKE_FAILURE);
1191
+ return ssl_hs_error;
1192
+ }
1193
+
1194
+ // For a PSK cipher suite, the actual pre-master secret is combined with the
1195
+ // pre-shared key.
1196
+ if (alg_a & SSL_aPSK) {
1197
+ if (ssl->psk_server_callback == NULL) {
1198
+ OPENSSL_PUT_ERROR(SSL, ERR_R_INTERNAL_ERROR);
1199
+ ssl3_send_alert(ssl, SSL3_AL_FATAL, SSL_AD_INTERNAL_ERROR);
1200
+ return ssl_hs_error;
1201
+ }
1202
+
1203
+ // Look up the key for the identity.
1204
+ uint8_t psk[PSK_MAX_PSK_LEN];
1205
+ unsigned psk_len = ssl->psk_server_callback(
1206
+ ssl, hs->new_session->psk_identity, psk, sizeof(psk));
1207
+ if (psk_len > PSK_MAX_PSK_LEN) {
1208
+ OPENSSL_PUT_ERROR(SSL, ERR_R_INTERNAL_ERROR);
1209
+ ssl3_send_alert(ssl, SSL3_AL_FATAL, SSL_AD_INTERNAL_ERROR);
1210
+ return ssl_hs_error;
1211
+ } else if (psk_len == 0) {
1212
+ // PSK related to the given identity not found.
1213
+ OPENSSL_PUT_ERROR(SSL, SSL_R_PSK_IDENTITY_NOT_FOUND);
1214
+ ssl3_send_alert(ssl, SSL3_AL_FATAL, SSL_AD_UNKNOWN_PSK_IDENTITY);
1215
+ return ssl_hs_error;
1216
+ }
1217
+
1218
+ if (alg_k & SSL_kPSK) {
1219
+ // In plain PSK, other_secret is a block of 0s with the same length as the
1220
+ // pre-shared key.
1221
+ if (!premaster_secret.Init(psk_len)) {
1222
+ return ssl_hs_error;
1223
+ }
1224
+ OPENSSL_memset(premaster_secret.data(), 0, premaster_secret.size());
1225
+ }
1226
+
1227
+ ScopedCBB new_premaster;
1228
+ CBB child;
1229
+ uint8_t *new_data;
1230
+ size_t new_len;
1231
+ if (!CBB_init(new_premaster.get(),
1232
+ 2 + psk_len + 2 + premaster_secret.size()) ||
1233
+ !CBB_add_u16_length_prefixed(new_premaster.get(), &child) ||
1234
+ !CBB_add_bytes(&child, premaster_secret.data(),
1235
+ premaster_secret.size()) ||
1236
+ !CBB_add_u16_length_prefixed(new_premaster.get(), &child) ||
1237
+ !CBB_add_bytes(&child, psk, psk_len) ||
1238
+ !CBB_finish(new_premaster.get(), &new_data, &new_len)) {
1239
+ OPENSSL_PUT_ERROR(SSL, ERR_R_MALLOC_FAILURE);
1240
+ return ssl_hs_error;
1241
+ }
1242
+
1243
+ premaster_secret.Reset(new_data, new_len);
1244
+ }
1245
+
1246
+ if (!ssl_hash_message(hs, msg)) {
1247
+ return ssl_hs_error;
1248
+ }
1249
+
1250
+ // Compute the master secret.
1251
+ hs->new_session->master_key_length = tls1_generate_master_secret(
1252
+ hs, hs->new_session->master_key, premaster_secret.data(),
1253
+ premaster_secret.size());
1254
+ if (hs->new_session->master_key_length == 0) {
1255
+ return ssl_hs_error;
1256
+ }
1257
+ hs->new_session->extended_master_secret = hs->extended_master_secret;
1258
+
1259
+ ssl->method->next_message(ssl);
1260
+ hs->state = state_read_client_certificate_verify;
1261
+ return ssl_hs_ok;
1262
+ }
1263
+
1264
+ static enum ssl_hs_wait_t do_read_client_certificate_verify(SSL_HANDSHAKE *hs) {
1265
+ SSL *const ssl = hs->ssl;
1266
+
1267
+ // Only RSA and ECDSA client certificates are supported, so a
1268
+ // CertificateVerify is required if and only if there's a client certificate.
1269
+ if (!hs->peer_pubkey) {
1270
+ hs->transcript.FreeBuffer();
1271
+ hs->state = state_read_change_cipher_spec;
1272
+ return ssl_hs_ok;
1273
+ }
1274
+
1275
+ SSLMessage msg;
1276
+ if (!ssl->method->get_message(ssl, &msg)) {
1277
+ return ssl_hs_read_message;
1278
+ }
1279
+
1280
+ if (!ssl_check_message_type(ssl, msg, SSL3_MT_CERTIFICATE_VERIFY)) {
1281
+ return ssl_hs_error;
1282
+ }
1283
+
1284
+ CBS certificate_verify = msg.body, signature;
1285
+
1286
+ // Determine the signature algorithm.
1287
+ uint16_t signature_algorithm = 0;
1288
+ if (ssl3_protocol_version(ssl) >= TLS1_2_VERSION) {
1289
+ if (!CBS_get_u16(&certificate_verify, &signature_algorithm)) {
1290
+ OPENSSL_PUT_ERROR(SSL, SSL_R_DECODE_ERROR);
1291
+ ssl3_send_alert(ssl, SSL3_AL_FATAL, SSL_AD_DECODE_ERROR);
1292
+ return ssl_hs_error;
1293
+ }
1294
+ uint8_t alert = SSL_AD_DECODE_ERROR;
1295
+ if (!tls12_check_peer_sigalg(ssl, &alert, signature_algorithm)) {
1296
+ ssl3_send_alert(ssl, SSL3_AL_FATAL, alert);
1297
+ return ssl_hs_error;
1298
+ }
1299
+ hs->new_session->peer_signature_algorithm = signature_algorithm;
1300
+ } else if (!tls1_get_legacy_signature_algorithm(&signature_algorithm,
1301
+ hs->peer_pubkey.get())) {
1302
+ OPENSSL_PUT_ERROR(SSL, SSL_R_PEER_ERROR_UNSUPPORTED_CERTIFICATE_TYPE);
1303
+ ssl3_send_alert(ssl, SSL3_AL_FATAL, SSL_AD_UNSUPPORTED_CERTIFICATE);
1304
+ return ssl_hs_error;
1305
+ }
1306
+
1307
+ // Parse and verify the signature.
1308
+ if (!CBS_get_u16_length_prefixed(&certificate_verify, &signature) ||
1309
+ CBS_len(&certificate_verify) != 0) {
1310
+ OPENSSL_PUT_ERROR(SSL, SSL_R_DECODE_ERROR);
1311
+ ssl3_send_alert(ssl, SSL3_AL_FATAL, SSL_AD_DECODE_ERROR);
1312
+ return ssl_hs_error;
1313
+ }
1314
+
1315
+ int sig_ok;
1316
+ // The SSL3 construction for CertificateVerify does not decompose into a
1317
+ // single final digest and signature, and must be special-cased.
1318
+ if (ssl3_protocol_version(ssl) == SSL3_VERSION) {
1319
+ uint8_t digest[EVP_MAX_MD_SIZE];
1320
+ size_t digest_len;
1321
+ if (!hs->transcript.GetSSL3CertVerifyHash(
1322
+ digest, &digest_len, hs->new_session.get(), signature_algorithm)) {
1323
+ return ssl_hs_error;
1324
+ }
1325
+
1326
+ UniquePtr<EVP_PKEY_CTX> pctx(
1327
+ EVP_PKEY_CTX_new(hs->peer_pubkey.get(), nullptr));
1328
+ sig_ok = pctx &&
1329
+ EVP_PKEY_verify_init(pctx.get()) &&
1330
+ EVP_PKEY_verify(pctx.get(), CBS_data(&signature),
1331
+ CBS_len(&signature), digest, digest_len);
1332
+ } else {
1333
+ sig_ok = ssl_public_key_verify(
1334
+ ssl, CBS_data(&signature), CBS_len(&signature), signature_algorithm,
1335
+ hs->peer_pubkey.get(), hs->transcript.buffer_data(),
1336
+ hs->transcript.buffer_len());
1337
+ }
1338
+
1339
+ #if defined(BORINGSSL_UNSAFE_FUZZER_MODE)
1340
+ sig_ok = 1;
1341
+ ERR_clear_error();
1342
+ #endif
1343
+ if (!sig_ok) {
1344
+ OPENSSL_PUT_ERROR(SSL, SSL_R_BAD_SIGNATURE);
1345
+ ssl3_send_alert(ssl, SSL3_AL_FATAL, SSL_AD_DECRYPT_ERROR);
1346
+ return ssl_hs_error;
1347
+ }
1348
+
1349
+ // The handshake buffer is no longer necessary, and we may hash the current
1350
+ // message.
1351
+ hs->transcript.FreeBuffer();
1352
+ if (!ssl_hash_message(hs, msg)) {
1353
+ return ssl_hs_error;
1354
+ }
1355
+
1356
+ ssl->method->next_message(ssl);
1357
+ hs->state = state_read_change_cipher_spec;
1358
+ return ssl_hs_ok;
1359
+ }
1360
+
1361
+ static enum ssl_hs_wait_t do_read_change_cipher_spec(SSL_HANDSHAKE *hs) {
1362
+ hs->state = state_process_change_cipher_spec;
1363
+ return ssl_hs_read_change_cipher_spec;
1364
+ }
1365
+
1366
+ static enum ssl_hs_wait_t do_process_change_cipher_spec(SSL_HANDSHAKE *hs) {
1367
+ if (!tls1_change_cipher_state(hs, evp_aead_open)) {
1368
+ return ssl_hs_error;
1369
+ }
1370
+
1371
+ hs->state = state_read_next_proto;
1372
+ return ssl_hs_ok;
1373
+ }
1374
+
1375
+ static enum ssl_hs_wait_t do_read_next_proto(SSL_HANDSHAKE *hs) {
1376
+ SSL *const ssl = hs->ssl;
1377
+
1378
+ if (!hs->next_proto_neg_seen) {
1379
+ hs->state = state_read_channel_id;
1380
+ return ssl_hs_ok;
1381
+ }
1382
+
1383
+ SSLMessage msg;
1384
+ if (!ssl->method->get_message(ssl, &msg)) {
1385
+ return ssl_hs_read_message;
1386
+ }
1387
+
1388
+ if (!ssl_check_message_type(ssl, msg, SSL3_MT_NEXT_PROTO) ||
1389
+ !ssl_hash_message(hs, msg)) {
1390
+ return ssl_hs_error;
1391
+ }
1392
+
1393
+ CBS next_protocol = msg.body, selected_protocol, padding;
1394
+ if (!CBS_get_u8_length_prefixed(&next_protocol, &selected_protocol) ||
1395
+ !CBS_get_u8_length_prefixed(&next_protocol, &padding) ||
1396
+ CBS_len(&next_protocol) != 0) {
1397
+ OPENSSL_PUT_ERROR(SSL, SSL_R_DECODE_ERROR);
1398
+ ssl3_send_alert(ssl, SSL3_AL_FATAL, SSL_AD_DECODE_ERROR);
1399
+ return ssl_hs_error;
1400
+ }
1401
+
1402
+ if (!CBS_stow(&selected_protocol, &ssl->s3->next_proto_negotiated,
1403
+ &ssl->s3->next_proto_negotiated_len)) {
1404
+ return ssl_hs_error;
1405
+ }
1406
+
1407
+ ssl->method->next_message(ssl);
1408
+ hs->state = state_read_channel_id;
1409
+ return ssl_hs_ok;
1410
+ }
1411
+
1412
+ static enum ssl_hs_wait_t do_read_channel_id(SSL_HANDSHAKE *hs) {
1413
+ SSL *const ssl = hs->ssl;
1414
+
1415
+ if (!ssl->s3->tlsext_channel_id_valid) {
1416
+ hs->state = state_read_client_finished;
1417
+ return ssl_hs_ok;
1418
+ }
1419
+
1420
+ SSLMessage msg;
1421
+ if (!ssl->method->get_message(ssl, &msg)) {
1422
+ return ssl_hs_read_message;
1423
+ }
1424
+
1425
+ if (!ssl_check_message_type(ssl, msg, SSL3_MT_CHANNEL_ID) ||
1426
+ !tls1_verify_channel_id(hs, msg) ||
1427
+ !ssl_hash_message(hs, msg)) {
1428
+ return ssl_hs_error;
1429
+ }
1430
+
1431
+ ssl->method->next_message(ssl);
1432
+ hs->state = state_read_client_finished;
1433
+ return ssl_hs_ok;
1434
+ }
1435
+
1436
+ static enum ssl_hs_wait_t do_read_client_finished(SSL_HANDSHAKE *hs) {
1437
+ SSL *const ssl = hs->ssl;
1438
+ enum ssl_hs_wait_t wait = ssl_get_finished(hs);
1439
+ if (wait != ssl_hs_ok) {
1440
+ return wait;
1441
+ }
1442
+
1443
+ if (ssl->session != NULL) {
1444
+ hs->state = state_finish_server_handshake;
1445
+ } else {
1446
+ hs->state = state_send_server_finished;
1447
+ }
1448
+
1449
+ // If this is a full handshake with ChannelID then record the handshake
1450
+ // hashes in |hs->new_session| in case we need them to verify a
1451
+ // ChannelID signature on a resumption of this session in the future.
1452
+ if (ssl->session == NULL && ssl->s3->tlsext_channel_id_valid &&
1453
+ !tls1_record_handshake_hashes_for_channel_id(hs)) {
1454
+ return ssl_hs_error;
1455
+ }
1456
+
1457
+ return ssl_hs_ok;
1458
+ }
1459
+
1460
+ static enum ssl_hs_wait_t do_send_server_finished(SSL_HANDSHAKE *hs) {
1461
+ SSL *const ssl = hs->ssl;
1462
+
1463
+ if (hs->ticket_expected) {
1464
+ const SSL_SESSION *session;
1465
+ UniquePtr<SSL_SESSION> session_copy;
1466
+ if (ssl->session == NULL) {
1467
+ // Fix the timeout to measure from the ticket issuance time.
1468
+ ssl_session_rebase_time(ssl, hs->new_session.get());
1469
+ session = hs->new_session.get();
1470
+ } else {
1471
+ // We are renewing an existing session. Duplicate the session to adjust
1472
+ // the timeout.
1473
+ session_copy = SSL_SESSION_dup(ssl->session, SSL_SESSION_INCLUDE_NONAUTH);
1474
+ if (!session_copy) {
1475
+ return ssl_hs_error;
1476
+ }
1477
+
1478
+ ssl_session_rebase_time(ssl, session_copy.get());
1479
+ session = session_copy.get();
1480
+ }
1481
+
1482
+ ScopedCBB cbb;
1483
+ CBB body, ticket;
1484
+ if (!ssl->method->init_message(ssl, cbb.get(), &body,
1485
+ SSL3_MT_NEW_SESSION_TICKET) ||
1486
+ !CBB_add_u32(&body, session->timeout) ||
1487
+ !CBB_add_u16_length_prefixed(&body, &ticket) ||
1488
+ !ssl_encrypt_ticket(ssl, &ticket, session) ||
1489
+ !ssl_add_message_cbb(ssl, cbb.get())) {
1490
+ return ssl_hs_error;
1491
+ }
1492
+ }
1493
+
1494
+ if (!ssl->method->add_change_cipher_spec(ssl) ||
1495
+ !tls1_change_cipher_state(hs, evp_aead_seal) ||
1496
+ !ssl3_send_finished(hs)) {
1497
+ return ssl_hs_error;
1498
+ }
1499
+
1500
+ if (ssl->session != NULL) {
1501
+ hs->state = state_read_change_cipher_spec;
1502
+ } else {
1503
+ hs->state = state_finish_server_handshake;
1504
+ }
1505
+ return ssl_hs_flush;
1506
+ }
1507
+
1508
+ static enum ssl_hs_wait_t do_finish_server_handshake(SSL_HANDSHAKE *hs) {
1509
+ SSL *const ssl = hs->ssl;
1510
+
1511
+ ssl->method->on_handshake_complete(ssl);
1512
+
1513
+ // If we aren't retaining peer certificates then we can discard it now.
1514
+ if (hs->new_session != NULL && ssl->retain_only_sha256_of_client_certs) {
1515
+ sk_CRYPTO_BUFFER_pop_free(hs->new_session->certs, CRYPTO_BUFFER_free);
1516
+ hs->new_session->certs = NULL;
1517
+ ssl->ctx->x509_method->session_clear(hs->new_session.get());
1518
+ }
1519
+
1520
+ SSL_SESSION_free(ssl->s3->established_session);
1521
+ if (ssl->session != NULL) {
1522
+ SSL_SESSION_up_ref(ssl->session);
1523
+ ssl->s3->established_session = ssl->session;
1524
+ } else {
1525
+ ssl->s3->established_session = hs->new_session.release();
1526
+ ssl->s3->established_session->not_resumable = 0;
1527
+ }
1528
+
1529
+ hs->handshake_finalized = true;
1530
+ ssl->s3->initial_handshake_complete = true;
1531
+ ssl_update_cache(hs, SSL_SESS_CACHE_SERVER);
1532
+
1533
+ hs->state = state_done;
1534
+ return ssl_hs_ok;
1535
+ }
1536
+
1537
+ enum ssl_hs_wait_t ssl_server_handshake(SSL_HANDSHAKE *hs) {
1538
+ while (hs->state != state_done) {
1539
+ enum ssl_hs_wait_t ret = ssl_hs_error;
1540
+ enum ssl_server_hs_state_t state =
1541
+ static_cast<enum ssl_server_hs_state_t>(hs->state);
1542
+ switch (state) {
1543
+ case state_start_accept:
1544
+ ret = do_start_accept(hs);
1545
+ break;
1546
+ case state_read_client_hello:
1547
+ ret = do_read_client_hello(hs);
1548
+ break;
1549
+ case state_select_certificate:
1550
+ ret = do_select_certificate(hs);
1551
+ break;
1552
+ case state_tls13:
1553
+ ret = do_tls13(hs);
1554
+ break;
1555
+ case state_select_parameters:
1556
+ ret = do_select_parameters(hs);
1557
+ break;
1558
+ case state_send_server_hello:
1559
+ ret = do_send_server_hello(hs);
1560
+ break;
1561
+ case state_send_server_certificate:
1562
+ ret = do_send_server_certificate(hs);
1563
+ break;
1564
+ case state_send_server_key_exchange:
1565
+ ret = do_send_server_key_exchange(hs);
1566
+ break;
1567
+ case state_send_server_hello_done:
1568
+ ret = do_send_server_hello_done(hs);
1569
+ break;
1570
+ case state_read_client_certificate:
1571
+ ret = do_read_client_certificate(hs);
1572
+ break;
1573
+ case state_verify_client_certificate:
1574
+ ret = do_verify_client_certificate(hs);
1575
+ break;
1576
+ case state_read_client_key_exchange:
1577
+ ret = do_read_client_key_exchange(hs);
1578
+ break;
1579
+ case state_read_client_certificate_verify:
1580
+ ret = do_read_client_certificate_verify(hs);
1581
+ break;
1582
+ case state_read_change_cipher_spec:
1583
+ ret = do_read_change_cipher_spec(hs);
1584
+ break;
1585
+ case state_process_change_cipher_spec:
1586
+ ret = do_process_change_cipher_spec(hs);
1587
+ break;
1588
+ case state_read_next_proto:
1589
+ ret = do_read_next_proto(hs);
1590
+ break;
1591
+ case state_read_channel_id:
1592
+ ret = do_read_channel_id(hs);
1593
+ break;
1594
+ case state_read_client_finished:
1595
+ ret = do_read_client_finished(hs);
1596
+ break;
1597
+ case state_send_server_finished:
1598
+ ret = do_send_server_finished(hs);
1599
+ break;
1600
+ case state_finish_server_handshake:
1601
+ ret = do_finish_server_handshake(hs);
1602
+ break;
1603
+ case state_done:
1604
+ ret = ssl_hs_ok;
1605
+ break;
1606
+ }
1607
+
1608
+ if (hs->state != state) {
1609
+ ssl_do_info_callback(hs->ssl, SSL_CB_ACCEPT_LOOP, 1);
1610
+ }
1611
+
1612
+ if (ret != ssl_hs_ok) {
1613
+ return ret;
1614
+ }
1615
+ }
1616
+
1617
+ ssl_do_info_callback(hs->ssl, SSL_CB_HANDSHAKE_DONE, 1);
1618
+ return ssl_hs_ok;
1619
+ }
1620
+
1621
+ const char *ssl_server_handshake_state(SSL_HANDSHAKE *hs) {
1622
+ enum ssl_server_hs_state_t state =
1623
+ static_cast<enum ssl_server_hs_state_t>(hs->state);
1624
+ switch (state) {
1625
+ case state_start_accept:
1626
+ return "TLS server start_accept";
1627
+ case state_read_client_hello:
1628
+ return "TLS server read_client_hello";
1629
+ case state_select_certificate:
1630
+ return "TLS server select_certificate";
1631
+ case state_tls13:
1632
+ return tls13_server_handshake_state(hs);
1633
+ case state_select_parameters:
1634
+ return "TLS server select_parameters";
1635
+ case state_send_server_hello:
1636
+ return "TLS server send_server_hello";
1637
+ case state_send_server_certificate:
1638
+ return "TLS server send_server_certificate";
1639
+ case state_send_server_key_exchange:
1640
+ return "TLS server send_server_key_exchange";
1641
+ case state_send_server_hello_done:
1642
+ return "TLS server send_server_hello_done";
1643
+ case state_read_client_certificate:
1644
+ return "TLS server read_client_certificate";
1645
+ case state_verify_client_certificate:
1646
+ return "TLS server verify_client_certificate";
1647
+ case state_read_client_key_exchange:
1648
+ return "TLS server read_client_key_exchange";
1649
+ case state_read_client_certificate_verify:
1650
+ return "TLS server read_client_certificate_verify";
1651
+ case state_read_change_cipher_spec:
1652
+ return "TLS server read_change_cipher_spec";
1653
+ case state_process_change_cipher_spec:
1654
+ return "TLS server process_change_cipher_spec";
1655
+ case state_read_next_proto:
1656
+ return "TLS server read_next_proto";
1657
+ case state_read_channel_id:
1658
+ return "TLS server read_channel_id";
1659
+ case state_read_client_finished:
1660
+ return "TLS server read_client_finished";
1661
+ case state_send_server_finished:
1662
+ return "TLS server send_server_finished";
1663
+ case state_finish_server_handshake:
1664
+ return "TLS server finish_server_handshake";
1665
+ case state_done:
1666
+ return "TLS server done";
1667
+ }
1668
+
1669
+ return "TLS server unknown";
1670
+ }
1671
+
1672
+ }