ssl_lib.c source code [ClickHouse/contrib/openssl/ssl/ssl_lib.c]

1	/*
2	* Copyright 1995-2018 The OpenSSL Project Authors. All Rights Reserved.
3	* Copyright (c) 2002, Oracle and/or its affiliates. All rights reserved
4	* Copyright 2005 Nokia. All rights reserved.
5	*
6	* Licensed under the Apache License 2.0 (the "License"). You may not use
7	* this file except in compliance with the License. You can obtain a copy
8	* in the file LICENSE in the source distribution or at
9	* https://www.openssl.org/source/license.html
10	*/
11
12	#include <stdio.h>
13	#include "ssl_local.h"
14	#include "e_os.h"
15	#include <openssl/objects.h>
16	#include <openssl/x509v3.h>
17	#include <openssl/rand.h>
18	#include <openssl/rand_drbg.h>
19	#include <openssl/ocsp.h>
20	#include <openssl/dh.h>
21	#include <openssl/engine.h>
22	#include <openssl/async.h>
23	#include <openssl/ct.h>
24	#include <openssl/trace.h>
25	#include "internal/cryptlib.h"
26	#include "internal/refcount.h"
27	#include "internal/ktls.h"
28
29	static int ssl_undefined_function_1(SSL ssl, SSL3_RECORD r, size_t s, int t)
30	{
31	(void)r;
32	(void)s;
33	(void)t;
34	return ssl_undefined_function(ssl);
35	}
36
37	static int ssl_undefined_function_2(SSL ssl, SSL3_RECORD r, unsigned char *s,
38	int t)
39	{
40	(void)r;
41	(void)s;
42	(void)t;
43	return ssl_undefined_function(ssl);
44	}
45
46	static int ssl_undefined_function_3(SSL ssl, unsigned* char *r,
47	unsigned char s, size_t t, size_t u)
48	{
49	(void)r;
50	(void)s;
51	(void)t;
52	(void)u;
53	return ssl_undefined_function(ssl);
54	}
55
56	static int ssl_undefined_function_4(SSL ssl, int* r)
57	{
58	(void)r;
59	return ssl_undefined_function(ssl);
60	}
61
62	static size_t ssl_undefined_function_5(SSL ssl, const* char *r, size_t s,
63	unsigned char *t)
64	{
65	(void)r;
66	(void)s;
67	(void)t;
68	return ssl_undefined_function(ssl);
69	}
70
71	static int ssl_undefined_function_6(int r)
72	{
73	(void)r;
74	return ssl_undefined_function(NULL);
75	}
76
77	static int ssl_undefined_function_7(SSL ssl, unsigned* char *r, size_t s,
78	const char *t, size_t u,
79	const unsigned char v, size_t w, int* x)
80	{
81	(void)r;
82	(void)s;
83	(void)t;
84	(void)u;
85	(void)v;
86	(void)w;
87	(void)x;
88	return ssl_undefined_function(ssl);
89	}
90
91	SSL3_ENC_METHOD ssl3_undef_enc_method = {
92	ssl_undefined_function_1,
93	ssl_undefined_function_2,
94	ssl_undefined_function,
95	ssl_undefined_function_3,
96	ssl_undefined_function_4,
97	ssl_undefined_function_5,
98	NULL, / client_finished_label /
99	`0`, / client_finished_label_len /
100	NULL, / server_finished_label /
101	`0`, / server_finished_label_len /
102	ssl_undefined_function_6,
103	ssl_undefined_function_7,
104	};
105
106	struct ssl_async_args {
107	SSL *s;
108	void *buf;
109	size_t num;
110	enum { READFUNC, WRITEFUNC, OTHERFUNC } type;
111	union {
112	int (func_read) (SSL , void , size_t, size_t );
113	int (func_write) (SSL , const void , size_t, size_t );
114	int (func_other) (SSL );
115	} f;
116	};
117
118	static const struct {
119	uint8_t mtype;
120	uint8_t ord;
121	int nid;
122	} dane_mds[] = {
123	{
124	DANETLS_MATCHING_FULL, `0`, NID_undef
125	},
126	{
127	DANETLS_MATCHING_2256, `1`, NID_sha256
128	},
129	{
130	DANETLS_MATCHING_2512, `2`, NID_sha512
131	},
132	};
133
134	static int dane_ctx_enable(struct dane_ctx_st *dctx)
135	{
136	const EVP_MD **mdevp;
137	uint8_t *mdord;
138	uint8_t mdmax = DANETLS_MATCHING_LAST;
139	int n = ((int)mdmax) + `1`; / int to handle PrivMatch(255) /
140	size_t i;
141
142	if (dctx->mdevp != NULL)
143	return `1`;
144
145	mdevp = OPENSSL_zalloc(n * sizeof(*mdevp));
146	mdord = OPENSSL_zalloc(n * sizeof(*mdord));
147
148	if (mdord == NULL \|\| mdevp == NULL) {
149	OPENSSL_free(mdord);
150	OPENSSL_free(mdevp);
151	SSLerr(SSL_F_DANE_CTX_ENABLE, ERR_R_MALLOC_FAILURE);
152	return `0`;
153	}
154
155	/ Install default entries /
156	for (i = `0`; i < OSSL_NELEM(dane_mds); ++i) {
157	const EVP_MD *md;
158
159	if (dane_mds[i].nid == NID_undef \|\|
160	(md = EVP_get_digestbynid(dane_mds[i].nid)) == NULL)
161	continue;
162	mdevp[dane_mds[i].mtype] = md;
163	mdord[dane_mds[i].mtype] = dane_mds[i].ord;
164	}
165
166	dctx->mdevp = mdevp;
167	dctx->mdord = mdord;
168	dctx->mdmax = mdmax;
169
170	return `1`;
171	}
172
173	static void dane_ctx_final(struct dane_ctx_st *dctx)
174	{
175	OPENSSL_free(dctx->mdevp);
176	dctx->mdevp = NULL;
177
178	OPENSSL_free(dctx->mdord);
179	dctx->mdord = NULL;
180	dctx->mdmax = `0`;
181	}
182
183	static void tlsa_free(danetls_record *t)
184	{
185	if (t == NULL)
186	return;
187	OPENSSL_free(t->data);
188	EVP_PKEY_free(t->spki);
189	OPENSSL_free(t);
190	}
191
192	static void dane_final(SSL_DANE *dane)
193	{
194	sk_danetls_record_pop_free(dane->trecs, tlsa_free);
195	dane->trecs = NULL;
196
197	sk_X509_pop_free(dane->certs, X509_free);
198	dane->certs = NULL;
199
200	X509_free(dane->mcert);
201	dane->mcert = NULL;
202	dane->mtlsa = NULL;
203	dane->mdpth = -`1`;
204	dane->pdpth = -`1`;
205	}
206
207	/*
208	* dane_copy - Copy dane configuration, sans verification state.
209	*/
210	static int ssl_dane_dup(SSL to, SSL from)
211	{
212	int num;
213	int i;
214
215	if (!DANETLS_ENABLED(&from->dane))
216	return `1`;
217
218	num = sk_danetls_record_num(from->dane.trecs);
219	dane_final(&to->dane);
220	to->dane.flags = from->dane.flags;
221	to->dane.dctx = &to->ctx->dane;
222	to->dane.trecs = sk_danetls_record_new_reserve(NULL, num);
223
224	if (to->dane.trecs == NULL) {
225	SSLerr(SSL_F_SSL_DANE_DUP, ERR_R_MALLOC_FAILURE);
226	return `0`;
227	}
228
229	for (i = `0`; i < num; ++i) {
230	danetls_record *t = sk_danetls_record_value(from->dane.trecs, i);
231
232	if (SSL_dane_tlsa_add(to, t->usage, t->selector, t->mtype,
233	t->data, t->dlen) <= `0`)
234	return `0`;
235	}
236	return `1`;
237	}
238
239	static int dane_mtype_set(struct dane_ctx_st *dctx,
240	const EVP_MD *md, uint8_t mtype, uint8_t ord)
241	{
242	int i;
243
244	if (mtype == DANETLS_MATCHING_FULL && md != NULL) {
245	SSLerr(SSL_F_DANE_MTYPE_SET, SSL_R_DANE_CANNOT_OVERRIDE_MTYPE_FULL);
246	return `0`;
247	}
248
249	if (mtype > dctx->mdmax) {
250	const EVP_MD **mdevp;
251	uint8_t *mdord;
252	int n = ((int)mtype) + `1`;
253
254	mdevp = OPENSSL_realloc(dctx->mdevp, n * sizeof(*mdevp));
255	if (mdevp == NULL) {
256	SSLerr(SSL_F_DANE_MTYPE_SET, ERR_R_MALLOC_FAILURE);
257	return -`1`;
258	}
259	dctx->mdevp = mdevp;
260
261	mdord = OPENSSL_realloc(dctx->mdord, n * sizeof(*mdord));
262	if (mdord == NULL) {
263	SSLerr(SSL_F_DANE_MTYPE_SET, ERR_R_MALLOC_FAILURE);
264	return -`1`;
265	}
266	dctx->mdord = mdord;
267
268	/ Zero-fill any gaps /
269	for (i = dctx->mdmax + `1`; i < mtype; ++i) {
270	mdevp[i] = NULL;
271	mdord[i] = `0`;
272	}
273
274	dctx->mdmax = mtype;
275	}
276
277	dctx->mdevp[mtype] = md;
278	/ Coerce ordinal of disabled matching types to 0 /
279	dctx->mdord[mtype] = (md == NULL) ? `0` : ord;
280
281	return `1`;
282	}
283
284	static const EVP_MD tlsa_md_get(SSL_DANE dane, uint8_t mtype)
285	{
286	if (mtype > dane->dctx->mdmax)
287	return NULL;
288	return dane->dctx->mdevp[mtype];
289	}
290
291	static int dane_tlsa_add(SSL_DANE *dane,
292	uint8_t usage,
293	uint8_t selector,
294	uint8_t mtype, unsigned const char *data, size_t dlen)
295	{
296	danetls_record *t;
297	const EVP_MD *md = NULL;
298	int ilen = (int)dlen;
299	int i;
300	int num;
301
302	if (dane->trecs == NULL) {
303	SSLerr(SSL_F_DANE_TLSA_ADD, SSL_R_DANE_NOT_ENABLED);
304	return -`1`;
305	}
306
307	if (ilen < `0` \|\| dlen != (size_t)ilen) {
308	SSLerr(SSL_F_DANE_TLSA_ADD, SSL_R_DANE_TLSA_BAD_DATA_LENGTH);
309	return `0`;
310	}
311
312	if (usage > DANETLS_USAGE_LAST) {
313	SSLerr(SSL_F_DANE_TLSA_ADD, SSL_R_DANE_TLSA_BAD_CERTIFICATE_USAGE);
314	return `0`;
315	}
316
317	if (selector > DANETLS_SELECTOR_LAST) {
318	SSLerr(SSL_F_DANE_TLSA_ADD, SSL_R_DANE_TLSA_BAD_SELECTOR);
319	return `0`;
320	}
321
322	if (mtype != DANETLS_MATCHING_FULL) {
323	md = tlsa_md_get(dane, mtype);
324	if (md == NULL) {
325	SSLerr(SSL_F_DANE_TLSA_ADD, SSL_R_DANE_TLSA_BAD_MATCHING_TYPE);
326	return `0`;
327	}
328	}
329
330	if (md != NULL && dlen != (size_t)EVP_MD_size(md)) {
331	SSLerr(SSL_F_DANE_TLSA_ADD, SSL_R_DANE_TLSA_BAD_DIGEST_LENGTH);
332	return `0`;
333	}
334	if (!data) {
335	SSLerr(SSL_F_DANE_TLSA_ADD, SSL_R_DANE_TLSA_NULL_DATA);
336	return `0`;
337	}
338
339	if ((t = OPENSSL_zalloc(sizeof(*t))) == NULL) {
340	SSLerr(SSL_F_DANE_TLSA_ADD, ERR_R_MALLOC_FAILURE);
341	return -`1`;
342	}
343
344	t->usage = usage;
345	t->selector = selector;
346	t->mtype = mtype;
347	t->data = OPENSSL_malloc(dlen);
348	if (t->data == NULL) {
349	tlsa_free(t);
350	SSLerr(SSL_F_DANE_TLSA_ADD, ERR_R_MALLOC_FAILURE);
351	return -`1`;
352	}
353	memcpy(t->data, data, dlen);
354	t->dlen = dlen;
355
356	/ Validate and cache full certificate or public key /
357	if (mtype == DANETLS_MATCHING_FULL) {
358	const unsigned char *p = data;
359	X509 *cert = NULL;
360	EVP_PKEY *pkey = NULL;
361
362	switch (selector) {
363	case DANETLS_SELECTOR_CERT:
364	if (!d2i_X509(&cert, &p, ilen) \|\| p < data \|\|
365	dlen != (size_t)(p - data)) {
366	tlsa_free(t);
367	SSLerr(SSL_F_DANE_TLSA_ADD, SSL_R_DANE_TLSA_BAD_CERTIFICATE);
368	return `0`;
369	}
370	if (X509_get0_pubkey(cert) == NULL) {
371	tlsa_free(t);
372	SSLerr(SSL_F_DANE_TLSA_ADD, SSL_R_DANE_TLSA_BAD_CERTIFICATE);
373	return `0`;
374	}
375
376	if ((DANETLS_USAGE_BIT(usage) & DANETLS_TA_MASK) == `0`) {
377	X509_free(cert);
378	break;
379	}
380
381	/*
382	* For usage DANE-TA(2), we support authentication via "2 0 0" TLSA
383	* records that contain full certificates of trust-anchors that are
384	* not present in the wire chain. For usage PKIX-TA(0), we augment
385	* the chain with untrusted Full(0) certificates from DNS, in case
386	* they are missing from the chain.
387	*/
388	if ((dane->certs == NULL &&
389	(dane->certs = sk_X509_new_null()) == NULL) \|\|
390	!sk_X509_push(dane->certs, cert)) {
391	SSLerr(SSL_F_DANE_TLSA_ADD, ERR_R_MALLOC_FAILURE);
392	X509_free(cert);
393	tlsa_free(t);
394	return -`1`;
395	}
396	break;
397
398	case DANETLS_SELECTOR_SPKI:
399	if (!d2i_PUBKEY(&pkey, &p, ilen) \|\| p < data \|\|
400	dlen != (size_t)(p - data)) {
401	tlsa_free(t);
402	SSLerr(SSL_F_DANE_TLSA_ADD, SSL_R_DANE_TLSA_BAD_PUBLIC_KEY);
403	return `0`;
404	}
405
406	/*
407	* For usage DANE-TA(2), we support authentication via "2 1 0" TLSA
408	* records that contain full bare keys of trust-anchors that are
409	* not present in the wire chain.
410	*/
411	if (usage == DANETLS_USAGE_DANE_TA)
412	t->spki = pkey;
413	else
414	EVP_PKEY_free(pkey);
415	break;
416	}
417	}
418
419	/-*
420	* Find the right insertion point for the new record.
421	*
422	* See crypto/x509/x509_vfy.c. We sort DANE-EE(3) records first, so that
423	* they can be processed first, as they require no chain building, and no
424	* expiration or hostname checks. Because DANE-EE(3) is numerically
425	* largest, this is accomplished via descending sort by "usage".
426	*
427	* We also sort in descending order by matching ordinal to simplify
428	* the implementation of digest agility in the verification code.
429	*
430	* The choice of order for the selector is not significant, so we
431	* use the same descending order for consistency.
432	*/
433	num = sk_danetls_record_num(dane->trecs);
434	for (i = `0`; i < num; ++i) {
435	danetls_record *rec = sk_danetls_record_value(dane->trecs, i);
436
437	if (rec->usage > usage)
438	continue;
439	if (rec->usage < usage)
440	break;
441	if (rec->selector > selector)
442	continue;
443	if (rec->selector < selector)
444	break;
445	if (dane->dctx->mdord[rec->mtype] > dane->dctx->mdord[mtype])
446	continue;
447	break;
448	}
449
450	if (!sk_danetls_record_insert(dane->trecs, t, i)) {
451	tlsa_free(t);
452	SSLerr(SSL_F_DANE_TLSA_ADD, ERR_R_MALLOC_FAILURE);
453	return -`1`;
454	}
455	dane->umask \|= DANETLS_USAGE_BIT(usage);
456
457	return `1`;
458	}
459
460	/*
461	* Return 0 if there is only one version configured and it was disabled
462	* at configure time. Return 1 otherwise.
463	*/
464	static int ssl_check_allowed_versions(int min_version, int max_version)
465	{
466	int minisdtls = `0`, maxisdtls = `0`;
467
468	/ Figure out if we're doing DTLS versions or TLS versions /
469	if (min_version == DTLS1_BAD_VER
470	\|\| min_version >> `8` == DTLS1_VERSION_MAJOR)
471	minisdtls = `1`;
472	if (max_version == DTLS1_BAD_VER
473	\|\| max_version >> `8` == DTLS1_VERSION_MAJOR)
474	maxisdtls = `1`;
475	/ A wildcard version of 0 could be DTLS or TLS. /
476	if ((minisdtls && !maxisdtls && max_version != `0`)
477	\|\| (maxisdtls && !minisdtls && min_version != `0`)) {
478	/ Mixing DTLS and TLS versions will lead to sadness; deny it. /
479	return `0`;
480	}
481
482	if (minisdtls \|\| maxisdtls) {
483	/ Do DTLS version checks. /
484	if (min_version == `0`)
485	/ Ignore DTLS1_BAD_VER /
486	min_version = DTLS1_VERSION;
487	if (max_version == `0`)
488	max_version = DTLS1_2_VERSION;
489	#ifdef OPENSSL_NO_DTLS1_2
490	if (max_version == DTLS1_2_VERSION)
491	max_version = DTLS1_VERSION;
492	#endif
493	#ifdef OPENSSL_NO_DTLS1
494	if (min_version == DTLS1_VERSION)
495	min_version = DTLS1_2_VERSION;
496	#endif
497	/ Done massaging versions; do the check. /
498	if (`0`
499	#ifdef OPENSSL_NO_DTLS1
500	\|\| (DTLS_VERSION_GE(min_version, DTLS1_VERSION)
501	&& DTLS_VERSION_GE(DTLS1_VERSION, max_version))
502	#endif
503	#ifdef OPENSSL_NO_DTLS1_2
504	\|\| (DTLS_VERSION_GE(min_version, DTLS1_2_VERSION)
505	&& DTLS_VERSION_GE(DTLS1_2_VERSION, max_version))
506	#endif
507	)
508	return `0`;
509	} else {
510	/ Regular TLS version checks. /
511	if (min_version == `0`)
512	min_version = SSL3_VERSION;
513	if (max_version == `0`)
514	max_version = TLS1_3_VERSION;
515	#ifdef OPENSSL_NO_TLS1_3
516	if (max_version == TLS1_3_VERSION)
517	max_version = TLS1_2_VERSION;
518	#endif
519	#ifdef OPENSSL_NO_TLS1_2
520	if (max_version == TLS1_2_VERSION)
521	max_version = TLS1_1_VERSION;
522	#endif
523	#ifdef OPENSSL_NO_TLS1_1
524	if (max_version == TLS1_1_VERSION)
525	max_version = TLS1_VERSION;
526	#endif
527	#ifdef OPENSSL_NO_TLS1
528	if (max_version == TLS1_VERSION)
529	max_version = SSL3_VERSION;
530	#endif
531	#ifdef OPENSSL_NO_SSL3
532	if (min_version == SSL3_VERSION)
533	min_version = TLS1_VERSION;
534	#endif
535	#ifdef OPENSSL_NO_TLS1
536	if (min_version == TLS1_VERSION)
537	min_version = TLS1_1_VERSION;
538	#endif
539	#ifdef OPENSSL_NO_TLS1_1
540	if (min_version == TLS1_1_VERSION)
541	min_version = TLS1_2_VERSION;
542	#endif
543	#ifdef OPENSSL_NO_TLS1_2
544	if (min_version == TLS1_2_VERSION)
545	min_version = TLS1_3_VERSION;
546	#endif
547	/ Done massaging versions; do the check. /
548	if (`0`
549	#ifdef OPENSSL_NO_SSL3
550	\|\| (min_version <= SSL3_VERSION && SSL3_VERSION <= max_version)
551	#endif
552	#ifdef OPENSSL_NO_TLS1
553	\|\| (min_version <= TLS1_VERSION && TLS1_VERSION <= max_version)
554	#endif
555	#ifdef OPENSSL_NO_TLS1_1
556	\|\| (min_version <= TLS1_1_VERSION && TLS1_1_VERSION <= max_version)
557	#endif
558	#ifdef OPENSSL_NO_TLS1_2
559	\|\| (min_version <= TLS1_2_VERSION && TLS1_2_VERSION <= max_version)
560	#endif
561	#ifdef OPENSSL_NO_TLS1_3
562	\|\| (min_version <= TLS1_3_VERSION && TLS1_3_VERSION <= max_version)
563	#endif
564	)
565	return `0`;
566	}
567	return `1`;
568	}
569
570	static void clear_ciphers(SSL *s)
571	{
572	/ clear the current cipher /
573	ssl_clear_cipher_ctx(s);
574	ssl_clear_hash_ctx(&s->read_hash);
575	ssl_clear_hash_ctx(&s->write_hash);
576	}
577
578	int SSL_clear(SSL *s)
579	{
580	if (s->method == NULL) {
581	SSLerr(SSL_F_SSL_CLEAR, SSL_R_NO_METHOD_SPECIFIED);
582	return `0`;
583	}
584
585	if (ssl_clear_bad_session(s)) {
586	SSL_SESSION_free(s->session);
587	s->session = NULL;
588	}
589	SSL_SESSION_free(s->psksession);
590	s->psksession = NULL;
591	OPENSSL_free(s->psksession_id);
592	s->psksession_id = NULL;
593	s->psksession_id_len = `0`;
594	s->hello_retry_request = `0`;
595	s->sent_tickets = `0`;
596
597	s->error = `0`;
598	s->hit = `0`;
599	s->shutdown = `0`;
600
601	if (s->renegotiate) {
602	SSLerr(SSL_F_SSL_CLEAR, ERR_R_INTERNAL_ERROR);
603	return `0`;
604	}
605
606	ossl_statem_clear(s);
607
608	s->version = s->method->version;
609	s->client_version = s->version;
610	s->rwstate = SSL_NOTHING;
611
612	BUF_MEM_free(s->init_buf);
613	s->init_buf = NULL;
614	clear_ciphers(s);
615	s->first_packet = `0`;
616
617	s->key_update = SSL_KEY_UPDATE_NONE;
618
619	EVP_MD_CTX_free(s->pha_dgst);
620	s->pha_dgst = NULL;
621
622	/ Reset DANE verification result state /
623	s->dane.mdpth = -`1`;
624	s->dane.pdpth = -`1`;
625	X509_free(s->dane.mcert);
626	s->dane.mcert = NULL;
627	s->dane.mtlsa = NULL;
628
629	/ Clear the verification result peername /
630	X509_VERIFY_PARAM_move_peername(s->param, NULL);
631
632	/ Clear any shared connection state /
633	OPENSSL_free(s->shared_sigalgs);
634	s->shared_sigalgs = NULL;
635	s->shared_sigalgslen = `0`;
636
637	/*
638	* Check to see if we were changed into a different method, if so, revert
639	* back.
640	*/
641	if (s->method != s->ctx->method) {
642	s->method->ssl_free(s);
643	s->method = s->ctx->method;
644	if (!s->method->ssl_new(s))
645	return `0`;
646	} else {
647	if (!s->method->ssl_clear(s))
648	return `0`;
649	}
650
651	RECORD_LAYER_clear(&s->rlayer);
652
653	return `1`;
654	}
655
656	/* Used to change an SSL_CTXs default SSL method type /
657	int SSL_CTX_set_ssl_version(SSL_CTX ctx, const* SSL_METHOD *meth)
658	{
659	STACK_OF(SSL_CIPHER) *sk;
660
661	ctx->method = meth;
662
663	if (!SSL_CTX_set_ciphersuites(ctx, OSSL_default_ciphersuites())) {
664	SSLerr(SSL_F_SSL_CTX_SET_SSL_VERSION, SSL_R_SSL_LIBRARY_HAS_NO_CIPHERS);
665	return `0`;
666	}
667	sk = ssl_create_cipher_list(ctx->method,
668	ctx->tls13_ciphersuites,
669	&(ctx->cipher_list),
670	&(ctx->cipher_list_by_id),
671	OSSL_default_cipher_list(), ctx->cert);
672	if ((sk == NULL) \|\| (sk_SSL_CIPHER_num(sk) <= `0`)) {
673	SSLerr(SSL_F_SSL_CTX_SET_SSL_VERSION, SSL_R_SSL_LIBRARY_HAS_NO_CIPHERS);
674	return `0`;
675	}
676	return `1`;
677	}
678
679	SSL SSL_new(SSL_CTX ctx)
680	{
681	SSL *s;
682
683	if (ctx == NULL) {
684	SSLerr(SSL_F_SSL_NEW, SSL_R_NULL_SSL_CTX);
685	return NULL;
686	}
687	if (ctx->method == NULL) {
688	SSLerr(SSL_F_SSL_NEW, SSL_R_SSL_CTX_HAS_NO_DEFAULT_SSL_VERSION);
689	return NULL;
690	}
691
692	s = OPENSSL_zalloc(sizeof(*s));
693	if (s == NULL)
694	goto err;
695
696	s->references = `1`;
697	s->lock = CRYPTO_THREAD_lock_new();
698	if (s->lock == NULL) {
699	OPENSSL_free(s);
700	s = NULL;
701	goto err;
702	}
703
704	RECORD_LAYER_init(&s->rlayer, s);
705
706	s->options = ctx->options;
707	s->dane.flags = ctx->dane.flags;
708	s->min_proto_version = ctx->min_proto_version;
709	s->max_proto_version = ctx->max_proto_version;
710	s->mode = ctx->mode;
711	s->max_cert_list = ctx->max_cert_list;
712	s->max_early_data = ctx->max_early_data;
713	s->recv_max_early_data = ctx->recv_max_early_data;
714	s->num_tickets = ctx->num_tickets;
715	s->pha_enabled = ctx->pha_enabled;
716
717	/ Shallow copy of the ciphersuites stack /
718	s->tls13_ciphersuites = sk_SSL_CIPHER_dup(ctx->tls13_ciphersuites);
719	if (s->tls13_ciphersuites == NULL)
720	goto err;
721
722	/*
723	* Earlier library versions used to copy the pointer to the CERT, not
724	* its contents; only when setting new parameters for the per-SSL
725	* copy, ssl_cert_new would be called (and the direct reference to
726	* the per-SSL_CTX settings would be lost, but those still were
727	* indirectly accessed for various purposes, and for that reason they
728	* used to be known as s->ctx->default_cert). Now we don't look at the
729	* SSL_CTX's CERT after having duplicated it once.
730	*/
731	s->cert = ssl_cert_dup(ctx->cert);
732	if (s->cert == NULL)
733	goto err;
734
735	RECORD_LAYER_set_read_ahead(&s->rlayer, ctx->read_ahead);
736	s->msg_callback = ctx->msg_callback;
737	s->msg_callback_arg = ctx->msg_callback_arg;
738	s->verify_mode = ctx->verify_mode;
739	s->not_resumable_session_cb = ctx->not_resumable_session_cb;
740	s->record_padding_cb = ctx->record_padding_cb;
741	s->record_padding_arg = ctx->record_padding_arg;
742	s->block_padding = ctx->block_padding;
743	s->sid_ctx_length = ctx->sid_ctx_length;
744	if (!ossl_assert(s->sid_ctx_length <= sizeof(s->sid_ctx)))
745	goto err;
746	memcpy(&s->sid_ctx, &ctx->sid_ctx, sizeof(s->sid_ctx));
747	s->verify_callback = ctx->default_verify_callback;
748	s->generate_session_id = ctx->generate_session_id;
749
750	s->param = X509_VERIFY_PARAM_new();
751	if (s->param == NULL)
752	goto err;
753	X509_VERIFY_PARAM_inherit(s->param, ctx->param);
754	s->quiet_shutdown = ctx->quiet_shutdown;
755
756	s->ext.max_fragment_len_mode = ctx->ext.max_fragment_len_mode;
757	s->max_send_fragment = ctx->max_send_fragment;
758	s->split_send_fragment = ctx->split_send_fragment;
759	s->max_pipelines = ctx->max_pipelines;
760	if (s->max_pipelines > `1`)
761	RECORD_LAYER_set_read_ahead(&s->rlayer, `1`);
762	if (ctx->default_read_buf_len > `0`)
763	SSL_set_default_read_buffer_len(s, ctx->default_read_buf_len);
764
765	SSL_CTX_up_ref(ctx);
766	s->ctx = ctx;
767	s->ext.debug_cb = `0`;
768	s->ext.debug_arg = NULL;
769	s->ext.ticket_expected = `0`;
770	s->ext.status_type = ctx->ext.status_type;
771	s->ext.status_expected = `0`;
772	s->ext.ocsp.ids = NULL;
773	s->ext.ocsp.exts = NULL;
774	s->ext.ocsp.resp = NULL;
775	s->ext.ocsp.resp_len = `0`;
776	SSL_CTX_up_ref(ctx);
777	s->session_ctx = ctx;
778	#ifndef OPENSSL_NO_EC
779	if (ctx->ext.ecpointformats) {
780	s->ext.ecpointformats =
781	OPENSSL_memdup(ctx->ext.ecpointformats,
782	ctx->ext.ecpointformats_len);
783	if (!s->ext.ecpointformats)
784	goto err;
785	s->ext.ecpointformats_len =
786	ctx->ext.ecpointformats_len;
787	}
788	#endif
789	if (ctx->ext.supportedgroups) {
790	s->ext.supportedgroups =
791	OPENSSL_memdup(ctx->ext.supportedgroups,
792	ctx->ext.supportedgroups_len
793	* sizeof(*ctx->ext.supportedgroups));
794	if (!s->ext.supportedgroups)
795	goto err;
796	s->ext.supportedgroups_len = ctx->ext.supportedgroups_len;
797	}
798
799	#ifndef OPENSSL_NO_NEXTPROTONEG
800	s->ext.npn = NULL;
801	#endif
802
803	if (s->ctx->ext.alpn) {
804	s->ext.alpn = OPENSSL_malloc(s->ctx->ext.alpn_len);
805	if (s->ext.alpn == NULL)
806	goto err;
807	memcpy(s->ext.alpn, s->ctx->ext.alpn, s->ctx->ext.alpn_len);
808	s->ext.alpn_len = s->ctx->ext.alpn_len;
809	}
810
811	s->verified_chain = NULL;
812	s->verify_result = X509_V_OK;
813
814	s->default_passwd_callback = ctx->default_passwd_callback;
815	s->default_passwd_callback_userdata = ctx->default_passwd_callback_userdata;
816
817	s->method = ctx->method;
818
819	s->key_update = SSL_KEY_UPDATE_NONE;
820
821	s->allow_early_data_cb = ctx->allow_early_data_cb;
822	s->allow_early_data_cb_data = ctx->allow_early_data_cb_data;
823
824	if (!s->method->ssl_new(s))
825	goto err;
826
827	s->server = (ctx->method->ssl_accept == ssl_undefined_function) ? `0` : `1`;
828
829	if (!SSL_clear(s))
830	goto err;
831
832	if (!CRYPTO_new_ex_data(CRYPTO_EX_INDEX_SSL, s, &s->ex_data))
833	goto err;
834
835	#ifndef OPENSSL_NO_PSK
836	s->psk_client_callback = ctx->psk_client_callback;
837	s->psk_server_callback = ctx->psk_server_callback;
838	#endif
839	s->psk_find_session_cb = ctx->psk_find_session_cb;
840	s->psk_use_session_cb = ctx->psk_use_session_cb;
841
842	s->async_cb = ctx->async_cb;
843	s->async_cb_arg = ctx->async_cb_arg;
844
845	s->job = NULL;
846
847	#ifndef OPENSSL_NO_CT
848	if (!SSL_set_ct_validation_callback(s, ctx->ct_validation_callback,
849	ctx->ct_validation_callback_arg))
850	goto err;
851	#endif
852
853	return s;
854	err:
855	SSL_free(s);
856	SSLerr(SSL_F_SSL_NEW, ERR_R_MALLOC_FAILURE);
857	return NULL;
858	}
859
860	int SSL_is_dtls(const SSL *s)
861	{
862	return SSL_IS_DTLS(s) ? `1` : `0`;
863	}
864
865	int SSL_up_ref(SSL *s)
866	{
867	int i;
868
869	if (CRYPTO_UP_REF(&s->references, &i, s->lock) <= `0`)
870	return `0`;
871
872	REF_PRINT_COUNT("SSL", s);
873	REF_ASSERT_ISNT(i < `2`);
874	return ((i > `1`) ? `1` : `0`);
875	}
876
877	int SSL_CTX_set_session_id_context(SSL_CTX ctx, const* unsigned char *sid_ctx,
878	unsigned int sid_ctx_len)
879	{
880	if (sid_ctx_len > SSL_MAX_SID_CTX_LENGTH) {
881	SSLerr(SSL_F_SSL_CTX_SET_SESSION_ID_CONTEXT,
882	SSL_R_SSL_SESSION_ID_CONTEXT_TOO_LONG);
883	return `0`;
884	}
885	ctx->sid_ctx_length = sid_ctx_len;
886	memcpy(ctx->sid_ctx, sid_ctx, sid_ctx_len);
887
888	return `1`;
889	}
890
891	int SSL_set_session_id_context(SSL ssl, const* unsigned char *sid_ctx,
892	unsigned int sid_ctx_len)
893	{
894	if (sid_ctx_len > SSL_MAX_SID_CTX_LENGTH) {
895	SSLerr(SSL_F_SSL_SET_SESSION_ID_CONTEXT,
896	SSL_R_SSL_SESSION_ID_CONTEXT_TOO_LONG);
897	return `0`;
898	}
899	ssl->sid_ctx_length = sid_ctx_len;
900	memcpy(ssl->sid_ctx, sid_ctx, sid_ctx_len);
901
902	return `1`;
903	}
904
905	int SSL_CTX_set_generate_session_id(SSL_CTX *ctx, GEN_SESSION_CB cb)
906	{
907	CRYPTO_THREAD_write_lock(ctx->lock);
908	ctx->generate_session_id = cb;
909	CRYPTO_THREAD_unlock(ctx->lock);
910	return `1`;
911	}
912
913	int SSL_set_generate_session_id(SSL *ssl, GEN_SESSION_CB cb)
914	{
915	CRYPTO_THREAD_write_lock(ssl->lock);
916	ssl->generate_session_id = cb;
917	CRYPTO_THREAD_unlock(ssl->lock);
918	return `1`;
919	}
920
921	int SSL_has_matching_session_id(const SSL ssl, const* unsigned char *id,
922	unsigned int id_len)
923	{
924	/*
925	* A quick examination of SSL_SESSION_hash and SSL_SESSION_cmp shows how
926	* we can "construct" a session to give us the desired check - i.e. to
927	* find if there's a session in the hash table that would conflict with
928	* any new session built out of this id/id_len and the ssl_version in use
929	* by this SSL.
930	*/
931	SSL_SESSION r, *p;
932
933	if (id_len > sizeof(r.session_id))
934	return `0`;
935
936	r.ssl_version = ssl->version;
937	r.session_id_length = id_len;
938	memcpy(r.session_id, id, id_len);
939
940	CRYPTO_THREAD_read_lock(ssl->session_ctx->lock);
941	p = lh_SSL_SESSION_retrieve(ssl->session_ctx->sessions, &r);
942	CRYPTO_THREAD_unlock(ssl->session_ctx->lock);
943	return (p != NULL);
944	}
945
946	int SSL_CTX_set_purpose(SSL_CTX s, int* purpose)
947	{
948	return X509_VERIFY_PARAM_set_purpose(s->param, purpose);
949	}
950
951	int SSL_set_purpose(SSL s, int* purpose)
952	{
953	return X509_VERIFY_PARAM_set_purpose(s->param, purpose);
954	}
955
956	int SSL_CTX_set_trust(SSL_CTX s, int* trust)
957	{
958	return X509_VERIFY_PARAM_set_trust(s->param, trust);
959	}
960
961	int SSL_set_trust(SSL s, int* trust)
962	{
963	return X509_VERIFY_PARAM_set_trust(s->param, trust);
964	}
965
966	int SSL_set1_host(SSL s, const* char *hostname)
967	{
968	return X509_VERIFY_PARAM_set1_host(s->param, hostname, `0`);
969	}
970
971	int SSL_add1_host(SSL s, const* char *hostname)
972	{
973	return X509_VERIFY_PARAM_add1_host(s->param, hostname, `0`);
974	}
975
976	void SSL_set_hostflags(SSL s, unsigned* int flags)
977	{
978	X509_VERIFY_PARAM_set_hostflags(s->param, flags);
979	}
980
981	const char SSL_get0_peername(SSL s)
982	{
983	return X509_VERIFY_PARAM_get0_peername(s->param);
984	}
985
986	int SSL_CTX_dane_enable(SSL_CTX *ctx)
987	{
988	return dane_ctx_enable(&ctx->dane);
989	}
990
991	unsigned long SSL_CTX_dane_set_flags(SSL_CTX ctx, unsigned* long flags)
992	{
993	unsigned long orig = ctx->dane.flags;
994
995	ctx->dane.flags \|= flags;
996	return orig;
997	}
998
999	unsigned long SSL_CTX_dane_clear_flags(SSL_CTX ctx, unsigned* long flags)
1000	{
1001	unsigned long orig = ctx->dane.flags;
1002
1003	ctx->dane.flags &= ~flags;
1004	return orig;
1005	}
1006
1007	int SSL_dane_enable(SSL s, const* char *basedomain)
1008	{
1009	SSL_DANE *dane = &s->dane;
1010
1011	if (s->ctx->dane.mdmax == `0`) {
1012	SSLerr(SSL_F_SSL_DANE_ENABLE, SSL_R_CONTEXT_NOT_DANE_ENABLED);
1013	return `0`;
1014	}
1015	if (dane->trecs != NULL) {
1016	SSLerr(SSL_F_SSL_DANE_ENABLE, SSL_R_DANE_ALREADY_ENABLED);
1017	return `0`;
1018	}
1019
1020	/*
1021	* Default SNI name. This rejects empty names, while set1_host below
1022	* accepts them and disables host name checks. To avoid side-effects with
1023	* invalid input, set the SNI name first.
1024	*/
1025	if (s->ext.hostname == NULL) {
1026	if (!SSL_set_tlsext_host_name(s, basedomain)) {
1027	SSLerr(SSL_F_SSL_DANE_ENABLE, SSL_R_ERROR_SETTING_TLSA_BASE_DOMAIN);
1028	return -`1`;
1029	}
1030	}
1031
1032	/ Primary RFC6125 reference identifier /
1033	if (!X509_VERIFY_PARAM_set1_host(s->param, basedomain, `0`)) {
1034	SSLerr(SSL_F_SSL_DANE_ENABLE, SSL_R_ERROR_SETTING_TLSA_BASE_DOMAIN);
1035	return -`1`;
1036	}
1037
1038	dane->mdpth = -`1`;
1039	dane->pdpth = -`1`;
1040	dane->dctx = &s->ctx->dane;
1041	dane->trecs = sk_danetls_record_new_null();
1042
1043	if (dane->trecs == NULL) {
1044	SSLerr(SSL_F_SSL_DANE_ENABLE, ERR_R_MALLOC_FAILURE);
1045	return -`1`;
1046	}
1047	return `1`;
1048	}
1049
1050	unsigned long SSL_dane_set_flags(SSL ssl, unsigned* long flags)
1051	{
1052	unsigned long orig = ssl->dane.flags;
1053
1054	ssl->dane.flags \|= flags;
1055	return orig;
1056	}
1057
1058	unsigned long SSL_dane_clear_flags(SSL ssl, unsigned* long flags)
1059	{
1060	unsigned long orig = ssl->dane.flags;
1061
1062	ssl->dane.flags &= ~flags;
1063	return orig;
1064	}
1065
1066	int SSL_get0_dane_authority(SSL s, X509 mcert, EVP_PKEY *mspki)
1067	{
1068	SSL_DANE *dane = &s->dane;
1069
1070	if (!DANETLS_ENABLED(dane) \|\| s->verify_result != X509_V_OK)
1071	return -`1`;
1072	if (dane->mtlsa) {
1073	if (mcert)
1074	*mcert = dane->mcert;
1075	if (mspki)
1076	*mspki = (dane->mcert == NULL) ? dane->mtlsa->spki : NULL;
1077	}
1078	return dane->mdpth;
1079	}
1080
1081	int SSL_get0_dane_tlsa(SSL s, uint8_t usage, uint8_t *selector,
1082	uint8_t mtype, unsigned* const char *data, size_t dlen)
1083	{
1084	SSL_DANE *dane = &s->dane;
1085
1086	if (!DANETLS_ENABLED(dane) \|\| s->verify_result != X509_V_OK)
1087	return -`1`;
1088	if (dane->mtlsa) {
1089	if (usage)
1090	*usage = dane->mtlsa->usage;
1091	if (selector)
1092	*selector = dane->mtlsa->selector;
1093	if (mtype)
1094	*mtype = dane->mtlsa->mtype;
1095	if (data)
1096	*data = dane->mtlsa->data;
1097	if (dlen)
1098	*dlen = dane->mtlsa->dlen;
1099	}
1100	return dane->mdpth;
1101	}
1102
1103	SSL_DANE SSL_get0_dane(SSL s)
1104	{
1105	return &s->dane;
1106	}
1107
1108	int SSL_dane_tlsa_add(SSL *s, uint8_t usage, uint8_t selector,
1109	uint8_t mtype, unsigned const char *data, size_t dlen)
1110	{
1111	return dane_tlsa_add(&s->dane, usage, selector, mtype, data, dlen);
1112	}
1113
1114	int SSL_CTX_dane_mtype_set(SSL_CTX ctx, const* EVP_MD *md, uint8_t mtype,
1115	uint8_t ord)
1116	{
1117	return dane_mtype_set(&ctx->dane, md, mtype, ord);
1118	}
1119
1120	int SSL_CTX_set1_param(SSL_CTX ctx, X509_VERIFY_PARAM vpm)
1121	{
1122	return X509_VERIFY_PARAM_set1(ctx->param, vpm);
1123	}
1124
1125	int SSL_set1_param(SSL ssl, X509_VERIFY_PARAM vpm)
1126	{
1127	return X509_VERIFY_PARAM_set1(ssl->param, vpm);
1128	}
1129
1130	X509_VERIFY_PARAM SSL_CTX_get0_param(SSL_CTX ctx)
1131	{
1132	return ctx->param;
1133	}
1134
1135	X509_VERIFY_PARAM SSL_get0_param(SSL ssl)
1136	{
1137	return ssl->param;
1138	}
1139
1140	void SSL_certs_clear(SSL *s)
1141	{
1142	ssl_cert_clear_certs(s->cert);
1143	}
1144
1145	void SSL_free(SSL *s)
1146	{
1147	int i;
1148
1149	if (s == NULL)
1150	return;
1151	CRYPTO_DOWN_REF(&s->references, &i, s->lock);
1152	REF_PRINT_COUNT("SSL", s);
1153	if (i > `0`)
1154	return;
1155	REF_ASSERT_ISNT(i < `0`);
1156
1157	X509_VERIFY_PARAM_free(s->param);
1158	dane_final(&s->dane);
1159	CRYPTO_free_ex_data(CRYPTO_EX_INDEX_SSL, s, &s->ex_data);
1160
1161	RECORD_LAYER_release(&s->rlayer);
1162
1163	/ Ignore return value /
1164	ssl_free_wbio_buffer(s);
1165
1166	BIO_free_all(s->wbio);
1167	s->wbio = NULL;
1168	BIO_free_all(s->rbio);
1169	s->rbio = NULL;
1170
1171	BUF_MEM_free(s->init_buf);
1172
1173	/ add extra stuff /
1174	sk_SSL_CIPHER_free(s->cipher_list);
1175	sk_SSL_CIPHER_free(s->cipher_list_by_id);
1176	sk_SSL_CIPHER_free(s->tls13_ciphersuites);
1177	sk_SSL_CIPHER_free(s->peer_ciphers);
1178
1179	/ Make the next call work :-) /
1180	if (s->session != NULL) {
1181	ssl_clear_bad_session(s);
1182	SSL_SESSION_free(s->session);
1183	}
1184	SSL_SESSION_free(s->psksession);
1185	OPENSSL_free(s->psksession_id);
1186
1187	clear_ciphers(s);
1188
1189	ssl_cert_free(s->cert);
1190	OPENSSL_free(s->shared_sigalgs);
1191	/ Free up if allocated /
1192
1193	OPENSSL_free(s->ext.hostname);
1194	SSL_CTX_free(s->session_ctx);
1195	#ifndef OPENSSL_NO_EC
1196	OPENSSL_free(s->ext.ecpointformats);
1197	OPENSSL_free(s->ext.peer_ecpointformats);
1198	#endif /* OPENSSL_NO_EC */
1199	OPENSSL_free(s->ext.supportedgroups);
1200	OPENSSL_free(s->ext.peer_supportedgroups);
1201	sk_X509_EXTENSION_pop_free(s->ext.ocsp.exts, X509_EXTENSION_free);
1202	#ifndef OPENSSL_NO_OCSP
1203	sk_OCSP_RESPID_pop_free(s->ext.ocsp.ids, OCSP_RESPID_free);
1204	#endif
1205	#ifndef OPENSSL_NO_CT
1206	SCT_LIST_free(s->scts);
1207	OPENSSL_free(s->ext.scts);
1208	#endif
1209	OPENSSL_free(s->ext.ocsp.resp);
1210	OPENSSL_free(s->ext.alpn);
1211	OPENSSL_free(s->ext.tls13_cookie);
1212	OPENSSL_free(s->clienthello);
1213	OPENSSL_free(s->pha_context);
1214	EVP_MD_CTX_free(s->pha_dgst);
1215
1216	sk_X509_NAME_pop_free(s->ca_names, X509_NAME_free);
1217	sk_X509_NAME_pop_free(s->client_ca_names, X509_NAME_free);
1218
1219	sk_X509_pop_free(s->verified_chain, X509_free);
1220
1221	if (s->method != NULL)
1222	s->method->ssl_free(s);
1223
1224	SSL_CTX_free(s->ctx);
1225
1226	ASYNC_WAIT_CTX_free(s->waitctx);
1227
1228	#if !defined(OPENSSL_NO_NEXTPROTONEG)
1229	OPENSSL_free(s->ext.npn);
1230	#endif
1231
1232	#ifndef OPENSSL_NO_SRTP
1233	sk_SRTP_PROTECTION_PROFILE_free(s->srtp_profiles);
1234	#endif
1235
1236	CRYPTO_THREAD_lock_free(s->lock);
1237
1238	OPENSSL_free(s);
1239	}
1240
1241	void SSL_set0_rbio(SSL s, BIO rbio)
1242	{
1243	BIO_free_all(s->rbio);
1244	s->rbio = rbio;
1245	}
1246
1247	void SSL_set0_wbio(SSL s, BIO wbio)
1248	{
1249	/*
1250	* If the output buffering BIO is still in place, remove it
1251	*/
1252	if (s->bbio != NULL)
1253	s->wbio = BIO_pop(s->wbio);
1254
1255	BIO_free_all(s->wbio);
1256	s->wbio = wbio;
1257
1258	/ Re-attach \|bbio\| to the new \|wbio\|. /
1259	if (s->bbio != NULL)
1260	s->wbio = BIO_push(s->bbio, s->wbio);
1261	}
1262
1263	void SSL_set_bio(SSL s, BIO rbio, BIO *wbio)
1264	{
1265	/*
1266	* For historical reasons, this function has many different cases in
1267	* ownership handling.
1268	*/
1269
1270	/ If nothing has changed, do nothing /
1271	if (rbio == SSL_get_rbio(s) && wbio == SSL_get_wbio(s))
1272	return;
1273
1274	/*
1275	* If the two arguments are equal then one fewer reference is granted by the
1276	* caller than we want to take
1277	*/
1278	if (rbio != NULL && rbio == wbio)
1279	BIO_up_ref(rbio);
1280
1281	/*
1282	* If only the wbio is changed only adopt one reference.
1283	*/
1284	if (rbio == SSL_get_rbio(s)) {
1285	SSL_set0_wbio(s, wbio);
1286	return;
1287	}
1288	/*
1289	* There is an asymmetry here for historical reasons. If only the rbio is
1290	* changed AND the rbio and wbio were originally different, then we only
1291	* adopt one reference.
1292	*/
1293	if (wbio == SSL_get_wbio(s) && SSL_get_rbio(s) != SSL_get_wbio(s)) {
1294	SSL_set0_rbio(s, rbio);
1295	return;
1296	}
1297
1298	/ Otherwise, adopt both references. /
1299	SSL_set0_rbio(s, rbio);
1300	SSL_set0_wbio(s, wbio);
1301	}
1302
1303	BIO SSL_get_rbio(const* SSL *s)
1304	{
1305	return s->rbio;
1306	}
1307
1308	BIO SSL_get_wbio(const* SSL *s)
1309	{
1310	if (s->bbio != NULL) {
1311	/*
1312	* If \|bbio\| is active, the true caller-configured BIO is its
1313	* \|next_bio\|.
1314	*/
1315	return BIO_next(s->bbio);
1316	}
1317	return s->wbio;
1318	}
1319
1320	int SSL_get_fd(const SSL *s)
1321	{
1322	return SSL_get_rfd(s);
1323	}
1324
1325	int SSL_get_rfd(const SSL *s)
1326	{
1327	int ret = -`1`;
1328	BIO b, r;
1329
1330	b = SSL_get_rbio(s);
1331	r = BIO_find_type(b, BIO_TYPE_DESCRIPTOR);
1332	if (r != NULL)
1333	BIO_get_fd(r, &ret);
1334	return ret;
1335	}
1336
1337	int SSL_get_wfd(const SSL *s)
1338	{
1339	int ret = -`1`;
1340	BIO b, r;
1341
1342	b = SSL_get_wbio(s);
1343	r = BIO_find_type(b, BIO_TYPE_DESCRIPTOR);
1344	if (r != NULL)
1345	BIO_get_fd(r, &ret);
1346	return ret;
1347	}
1348
1349	#ifndef OPENSSL_NO_SOCK
1350	int SSL_set_fd(SSL s, int* fd)
1351	{
1352	int ret = `0`;
1353	BIO *bio = NULL;
1354
1355	bio = BIO_new(BIO_s_socket());
1356
1357	if (bio == NULL) {
1358	SSLerr(SSL_F_SSL_SET_FD, ERR_R_BUF_LIB);
1359	goto err;
1360	}
1361	BIO_set_fd(bio, fd, BIO_NOCLOSE);
1362	SSL_set_bio(s, bio, bio);
1363	#ifndef OPENSSL_NO_KTLS
1364	/*
1365	* The new socket is created successfully regardless of ktls_enable.
1366	* ktls_enable doesn't change any functionality of the socket, except
1367	* changing the setsockopt to enable the processing of ktls_start.
1368	* Thus, it is not a problem to call it for non-TLS sockets.
1369	*/
1370	ktls_enable(fd);
1371	#endif /* OPENSSL_NO_KTLS */
1372	ret = `1`;
1373	err:
1374	return ret;
1375	}
1376
1377	int SSL_set_wfd(SSL s, int* fd)
1378	{
1379	BIO *rbio = SSL_get_rbio(s);
1380
1381	if (rbio == NULL \|\| BIO_method_type(rbio) != BIO_TYPE_SOCKET
1382	\|\| (int)BIO_get_fd(rbio, NULL) != fd) {
1383	BIO *bio = BIO_new(BIO_s_socket());
1384
1385	if (bio == NULL) {
1386	SSLerr(SSL_F_SSL_SET_WFD, ERR_R_BUF_LIB);
1387	return `0`;
1388	}
1389	BIO_set_fd(bio, fd, BIO_NOCLOSE);
1390	SSL_set0_wbio(s, bio);
1391	#ifndef OPENSSL_NO_KTLS
1392	/*
1393	* The new socket is created successfully regardless of ktls_enable.
1394	* ktls_enable doesn't change any functionality of the socket, except
1395	* changing the setsockopt to enable the processing of ktls_start.
1396	* Thus, it is not a problem to call it for non-TLS sockets.
1397	*/
1398	ktls_enable(fd);
1399	#endif /* OPENSSL_NO_KTLS */
1400	} else {
1401	BIO_up_ref(rbio);
1402	SSL_set0_wbio(s, rbio);
1403	}
1404	return `1`;
1405	}
1406
1407	int SSL_set_rfd(SSL s, int* fd)
1408	{
1409	BIO *wbio = SSL_get_wbio(s);
1410
1411	if (wbio == NULL \|\| BIO_method_type(wbio) != BIO_TYPE_SOCKET
1412	\|\| ((int)BIO_get_fd(wbio, NULL) != fd)) {
1413	BIO *bio = BIO_new(BIO_s_socket());
1414
1415	if (bio == NULL) {
1416	SSLerr(SSL_F_SSL_SET_RFD, ERR_R_BUF_LIB);
1417	return `0`;
1418	}
1419	BIO_set_fd(bio, fd, BIO_NOCLOSE);
1420	SSL_set0_rbio(s, bio);
1421	} else {
1422	BIO_up_ref(wbio);
1423	SSL_set0_rbio(s, wbio);
1424	}
1425
1426	return `1`;
1427	}
1428	#endif
1429
1430	/ return length of latest Finished message we sent, copy to 'buf' /
1431	size_t SSL_get_finished(const SSL s, void* *buf, size_t count)
1432	{
1433	size_t ret = `0`;
1434
1435	ret = s->s3.tmp.finish_md_len;
1436	if (count > ret)
1437	count = ret;
1438	memcpy(buf, s->s3.tmp.finish_md, count);
1439	return ret;
1440	}
1441
1442	/ return length of latest Finished message we expected, copy to 'buf' /
1443	size_t SSL_get_peer_finished(const SSL s, void* *buf, size_t count)
1444	{
1445	size_t ret = `0`;
1446
1447	ret = s->s3.tmp.peer_finish_md_len;
1448	if (count > ret)
1449	count = ret;
1450	memcpy(buf, s->s3.tmp.peer_finish_md, count);
1451	return ret;
1452	}
1453
1454	int SSL_get_verify_mode(const SSL *s)
1455	{
1456	return s->verify_mode;
1457	}
1458
1459	int SSL_get_verify_depth(const SSL *s)
1460	{
1461	return X509_VERIFY_PARAM_get_depth(s->param);
1462	}
1463
1464	int (SSL_get_verify_callback(const* SSL s)) (int, X509_STORE_CTX ) {
1465	return s->verify_callback;
1466	}
1467
1468	int SSL_CTX_get_verify_mode(const SSL_CTX *ctx)
1469	{
1470	return ctx->verify_mode;
1471	}
1472
1473	int SSL_CTX_get_verify_depth(const SSL_CTX *ctx)
1474	{
1475	return X509_VERIFY_PARAM_get_depth(ctx->param);
1476	}
1477
1478	int (SSL_CTX_get_verify_callback(const* SSL_CTX ctx)) (int, X509_STORE_CTX ) {
1479	return ctx->default_verify_callback;
1480	}
1481
1482	void SSL_set_verify(SSL s, int* mode,
1483	int (callback) (int* ok, X509_STORE_CTX *ctx))
1484	{
1485	s->verify_mode = mode;
1486	if (callback != NULL)
1487	s->verify_callback = callback;
1488	}
1489
1490	void SSL_set_verify_depth(SSL s, int* depth)
1491	{
1492	X509_VERIFY_PARAM_set_depth(s->param, depth);
1493	}
1494
1495	void SSL_set_read_ahead(SSL s, int* yes)
1496	{
1497	RECORD_LAYER_set_read_ahead(&s->rlayer, yes);
1498	}
1499
1500	int SSL_get_read_ahead(const SSL *s)
1501	{
1502	return RECORD_LAYER_get_read_ahead(&s->rlayer);
1503	}
1504
1505	int SSL_pending(const SSL *s)
1506	{
1507	size_t pending = s->method->ssl_pending(s);
1508
1509	/*
1510	* SSL_pending cannot work properly if read-ahead is enabled
1511	* (SSL_[CTX_]ctrl(..., SSL_CTRL_SET_READ_AHEAD, 1, NULL)), and it is
1512	* impossible to fix since SSL_pending cannot report errors that may be
1513	* observed while scanning the new data. (Note that SSL_pending() is
1514	* often used as a boolean value, so we'd better not return -1.)
1515	*
1516	* SSL_pending also cannot work properly if the value >INT_MAX. In that case
1517	* we just return INT_MAX.
1518	*/
1519	return pending < INT_MAX ? (int)pending : INT_MAX;
1520	}
1521
1522	int SSL_has_pending(const SSL *s)
1523	{
1524	/*
1525	* Similar to SSL_pending() but returns a 1 to indicate that we have
1526	* unprocessed data available or 0 otherwise (as opposed to the number of
1527	* bytes available). Unlike SSL_pending() this will take into account
1528	* read_ahead data. A 1 return simply indicates that we have unprocessed
1529	* data. That data may not result in any application data, or we may fail
1530	* to parse the records for some reason.
1531	*/
1532	if (RECORD_LAYER_processed_read_pending(&s->rlayer))
1533	return `1`;
1534
1535	return RECORD_LAYER_read_pending(&s->rlayer);
1536	}
1537
1538	X509 SSL_get_peer_certificate(const* SSL *s)
1539	{
1540	X509 *r;
1541
1542	if ((s == NULL) \|\| (s->session == NULL))
1543	r = NULL;
1544	else
1545	r = s->session->peer;
1546
1547	if (r == NULL)
1548	return r;
1549
1550	X509_up_ref(r);
1551
1552	return r;
1553	}
1554
1555	STACK_OF(X509) SSL_get_peer_cert_chain(const* SSL *s)
1556	{
1557	STACK_OF(X509) *r;
1558
1559	if ((s == NULL) \|\| (s->session == NULL))
1560	r = NULL;
1561	else
1562	r = s->session->peer_chain;
1563
1564	/*
1565	* If we are a client, cert_chain includes the peer's own certificate; if
1566	* we are a server, it does not.
1567	*/
1568
1569	return r;
1570	}
1571
1572	/*
1573	* Now in theory, since the calling process own 't' it should be safe to
1574	* modify. We need to be able to read f without being hassled
1575	*/
1576	int SSL_copy_session_id(SSL t, const* SSL *f)
1577	{
1578	int i;
1579	/ Do we need to to SSL locking? /
1580	if (!SSL_set_session(t, SSL_get_session(f))) {
1581	return `0`;
1582	}
1583
1584	/*
1585	* what if we are setup for one protocol version but want to talk another
1586	*/
1587	if (t->method != f->method) {
1588	t->method->ssl_free(t);
1589	t->method = f->method;
1590	if (t->method->ssl_new(t) == `0`)
1591	return `0`;
1592	}
1593
1594	CRYPTO_UP_REF(&f->cert->references, &i, f->cert->lock);
1595	ssl_cert_free(t->cert);
1596	t->cert = f->cert;
1597	if (!SSL_set_session_id_context(t, f->sid_ctx, (int)f->sid_ctx_length)) {
1598	return `0`;
1599	}
1600
1601	return `1`;
1602	}
1603
1604	/ Fix this so it checks all the valid key/cert options /
1605	int SSL_CTX_check_private_key(const SSL_CTX *ctx)
1606	{
1607	if ((ctx == NULL) \|\| (ctx->cert->key->x509 == NULL)) {
1608	SSLerr(SSL_F_SSL_CTX_CHECK_PRIVATE_KEY, SSL_R_NO_CERTIFICATE_ASSIGNED);
1609	return `0`;
1610	}
1611	if (ctx->cert->key->privatekey == NULL) {
1612	SSLerr(SSL_F_SSL_CTX_CHECK_PRIVATE_KEY, SSL_R_NO_PRIVATE_KEY_ASSIGNED);
1613	return `0`;
1614	}
1615	return X509_check_private_key
1616	(ctx->cert->key->x509, ctx->cert->key->privatekey);
1617	}
1618
1619	/ Fix this function so that it takes an optional type parameter /
1620	int SSL_check_private_key(const SSL *ssl)
1621	{
1622	if (ssl == NULL) {
1623	SSLerr(SSL_F_SSL_CHECK_PRIVATE_KEY, ERR_R_PASSED_NULL_PARAMETER);
1624	return `0`;
1625	}
1626	if (ssl->cert->key->x509 == NULL) {
1627	SSLerr(SSL_F_SSL_CHECK_PRIVATE_KEY, SSL_R_NO_CERTIFICATE_ASSIGNED);
1628	return `0`;
1629	}
1630	if (ssl->cert->key->privatekey == NULL) {
1631	SSLerr(SSL_F_SSL_CHECK_PRIVATE_KEY, SSL_R_NO_PRIVATE_KEY_ASSIGNED);
1632	return `0`;
1633	}
1634	return X509_check_private_key(ssl->cert->key->x509,
1635	ssl->cert->key->privatekey);
1636	}
1637
1638	int SSL_waiting_for_async(SSL *s)
1639	{
1640	if (s->job)
1641	return `1`;
1642
1643	return `0`;
1644	}
1645
1646	int SSL_get_all_async_fds(SSL s, OSSL_ASYNC_FD fds, size_t *numfds)
1647	{
1648	ASYNC_WAIT_CTX *ctx = s->waitctx;
1649
1650	if (ctx == NULL)
1651	return `0`;
1652	return ASYNC_WAIT_CTX_get_all_fds(ctx, fds, numfds);
1653	}
1654
1655	int SSL_get_changed_async_fds(SSL s, OSSL_ASYNC_FD addfd, size_t *numaddfds,
1656	OSSL_ASYNC_FD delfd, size_t numdelfds)
1657	{
1658	ASYNC_WAIT_CTX *ctx = s->waitctx;
1659
1660	if (ctx == NULL)
1661	return `0`;
1662	return ASYNC_WAIT_CTX_get_changed_fds(ctx, addfd, numaddfds, delfd,
1663	numdelfds);
1664	}
1665
1666	int SSL_CTX_set_async_callback(SSL_CTX *ctx, SSL_async_callback_fn callback)
1667	{
1668	ctx->async_cb = callback;
1669	return `1`;
1670	}
1671
1672	int SSL_CTX_set_async_callback_arg(SSL_CTX ctx, void* *arg)
1673	{
1674	ctx->async_cb_arg = arg;
1675	return `1`;
1676	}
1677
1678	int SSL_set_async_callback(SSL *s, SSL_async_callback_fn callback)
1679	{
1680	s->async_cb = callback;
1681	return `1`;
1682	}
1683
1684	int SSL_set_async_callback_arg(SSL s, void* *arg)
1685	{
1686	s->async_cb_arg = arg;
1687	return `1`;
1688	}
1689
1690	int SSL_get_async_status(SSL s, int* *status)
1691	{
1692	ASYNC_WAIT_CTX *ctx = s->waitctx;
1693
1694	if (ctx == NULL)
1695	return `0`;
1696	*status = ASYNC_WAIT_CTX_get_status(ctx);
1697	return `1`;
1698	}
1699
1700	int SSL_accept(SSL *s)
1701	{
1702	if (s->handshake_func == NULL) {
1703	/ Not properly initialized yet /
1704	SSL_set_accept_state(s);
1705	}
1706
1707	return SSL_do_handshake(s);
1708	}
1709
1710	int SSL_connect(SSL *s)
1711	{
1712	if (s->handshake_func == NULL) {
1713	/ Not properly initialized yet /
1714	SSL_set_connect_state(s);
1715	}
1716
1717	return SSL_do_handshake(s);
1718	}
1719
1720	long SSL_get_default_timeout(const SSL *s)
1721	{
1722	return s->method->get_timeout();
1723	}
1724
1725	static int ssl_async_wait_ctx_cb(void *arg)
1726	{
1727	SSL s = (SSL )arg;
1728
1729	return s->async_cb(s, s->async_cb_arg);
1730	}
1731
1732	static int ssl_start_async_job(SSL s, struct* ssl_async_args *args,
1733	int (func) (void* *))
1734	{
1735	int ret;
1736	if (s->waitctx == NULL) {
1737	s->waitctx = ASYNC_WAIT_CTX_new();
1738	if (s->waitctx == NULL)
1739	return -`1`;
1740	if (s->async_cb != NULL
1741	&& !ASYNC_WAIT_CTX_set_callback
1742	(s->waitctx, ssl_async_wait_ctx_cb, s))
1743	return -`1`;
1744	}
1745	switch (ASYNC_start_job(&s->job, s->waitctx, &ret, func, args,
1746	sizeof(struct ssl_async_args))) {
1747	case ASYNC_ERR:
1748	s->rwstate = SSL_NOTHING;
1749	SSLerr(SSL_F_SSL_START_ASYNC_JOB, SSL_R_FAILED_TO_INIT_ASYNC);
1750	return -`1`;
1751	case ASYNC_PAUSE:
1752	s->rwstate = SSL_ASYNC_PAUSED;
1753	return -`1`;
1754	case ASYNC_NO_JOBS:
1755	s->rwstate = SSL_ASYNC_NO_JOBS;
1756	return -`1`;
1757	case ASYNC_FINISH:
1758	s->job = NULL;
1759	return ret;
1760	default:
1761	s->rwstate = SSL_NOTHING;
1762	SSLerr(SSL_F_SSL_START_ASYNC_JOB, ERR_R_INTERNAL_ERROR);
1763	/ Shouldn't happen /
1764	return -`1`;
1765	}
1766	}
1767
1768	static int ssl_io_intern(void *vargs)
1769	{
1770	struct ssl_async_args *args;
1771	SSL *s;
1772	void *buf;
1773	size_t num;
1774
1775	args = (struct ssl_async_args *)vargs;
1776	s = args->s;
1777	buf = args->buf;
1778	num = args->num;
1779	switch (args->type) {
1780	case READFUNC:
1781	return args->f.func_read(s, buf, num, &s->asyncrw);
1782	case WRITEFUNC:
1783	return args->f.func_write(s, buf, num, &s->asyncrw);
1784	case OTHERFUNC:
1785	return args->f.func_other(s);
1786	}
1787	return -`1`;
1788	}
1789
1790	int ssl_read_internal(SSL s, void* buf, size_t num, size_t readbytes)
1791	{
1792	if (s->handshake_func == NULL) {
1793	SSLerr(SSL_F_SSL_READ_INTERNAL, SSL_R_UNINITIALIZED);
1794	return -`1`;
1795	}
1796
1797	if (s->shutdown & SSL_RECEIVED_SHUTDOWN) {
1798	s->rwstate = SSL_NOTHING;
1799	return `0`;
1800	}
1801
1802	if (s->early_data_state == SSL_EARLY_DATA_CONNECT_RETRY
1803	\|\| s->early_data_state == SSL_EARLY_DATA_ACCEPT_RETRY) {
1804	SSLerr(SSL_F_SSL_READ_INTERNAL, ERR_R_SHOULD_NOT_HAVE_BEEN_CALLED);
1805	return `0`;
1806	}
1807	/*
1808	* If we are a client and haven't received the ServerHello etc then we
1809	* better do that
1810	*/
1811	ossl_statem_check_finish_init(s, `0`);
1812
1813	if ((s->mode & SSL_MODE_ASYNC) && ASYNC_get_current_job() == NULL) {
1814	struct ssl_async_args args;
1815	int ret;
1816
1817	args.s = s;
1818	args.buf = buf;
1819	args.num = num;
1820	args.type = READFUNC;
1821	args.f.func_read = s->method->ssl_read;
1822
1823	ret = ssl_start_async_job(s, &args, ssl_io_intern);
1824	*readbytes = s->asyncrw;
1825	return ret;
1826	} else {
1827	return s->method->ssl_read(s, buf, num, readbytes);
1828	}
1829	}
1830
1831	int SSL_read(SSL s, void* buf, int* num)
1832	{
1833	int ret;
1834	size_t readbytes;
1835
1836	if (num < `0`) {
1837	SSLerr(SSL_F_SSL_READ, SSL_R_BAD_LENGTH);
1838	return -`1`;
1839	}
1840
1841	ret = ssl_read_internal(s, buf, (size_t)num, &readbytes);
1842
1843	/*
1844	* The cast is safe here because ret should be <= INT_MAX because num is
1845	* <= INT_MAX
1846	*/
1847	if (ret > `0`)
1848	ret = (int)readbytes;
1849
1850	return ret;
1851	}
1852
1853	int SSL_read_ex(SSL s, void* buf, size_t num, size_t readbytes)
1854	{
1855	int ret = ssl_read_internal(s, buf, num, readbytes);
1856
1857	if (ret < `0`)
1858	ret = `0`;
1859	return ret;
1860	}
1861
1862	int SSL_read_early_data(SSL s, void* buf, size_t num, size_t readbytes)
1863	{
1864	int ret;
1865
1866	if (!s->server) {
1867	SSLerr(SSL_F_SSL_READ_EARLY_DATA, ERR_R_SHOULD_NOT_HAVE_BEEN_CALLED);
1868	return SSL_READ_EARLY_DATA_ERROR;
1869	}
1870
1871	switch (s->early_data_state) {
1872	case SSL_EARLY_DATA_NONE:
1873	if (!SSL_in_before(s)) {
1874	SSLerr(SSL_F_SSL_READ_EARLY_DATA,
1875	ERR_R_SHOULD_NOT_HAVE_BEEN_CALLED);
1876	return SSL_READ_EARLY_DATA_ERROR;
1877	}
1878	/ fall through /
1879
1880	case SSL_EARLY_DATA_ACCEPT_RETRY:
1881	s->early_data_state = SSL_EARLY_DATA_ACCEPTING;
1882	ret = SSL_accept(s);
1883	if (ret <= `0`) {
1884	/ NBIO or error /
1885	s->early_data_state = SSL_EARLY_DATA_ACCEPT_RETRY;
1886	return SSL_READ_EARLY_DATA_ERROR;
1887	}
1888	/ fall through /
1889
1890	case SSL_EARLY_DATA_READ_RETRY:
1891	if (s->ext.early_data == SSL_EARLY_DATA_ACCEPTED) {
1892	s->early_data_state = SSL_EARLY_DATA_READING;
1893	ret = SSL_read_ex(s, buf, num, readbytes);
1894	/*
1895	* State machine will update early_data_state to
1896	* SSL_EARLY_DATA_FINISHED_READING if we get an EndOfEarlyData
1897	* message
1898	*/
1899	if (ret > `0` \|\| (ret <= `0` && s->early_data_state
1900	!= SSL_EARLY_DATA_FINISHED_READING)) {
1901	s->early_data_state = SSL_EARLY_DATA_READ_RETRY;
1902	return ret > `0` ? SSL_READ_EARLY_DATA_SUCCESS
1903	: SSL_READ_EARLY_DATA_ERROR;
1904	}
1905	} else {
1906	s->early_data_state = SSL_EARLY_DATA_FINISHED_READING;
1907	}
1908	*readbytes = `0`;
1909	return SSL_READ_EARLY_DATA_FINISH;
1910
1911	default:
1912	SSLerr(SSL_F_SSL_READ_EARLY_DATA, ERR_R_SHOULD_NOT_HAVE_BEEN_CALLED);
1913	return SSL_READ_EARLY_DATA_ERROR;
1914	}
1915	}
1916
1917	int SSL_get_early_data_status(const SSL *s)
1918	{
1919	return s->ext.early_data;
1920	}
1921
1922	static int ssl_peek_internal(SSL s, void* buf, size_t num, size_t readbytes)
1923	{
1924	if (s->handshake_func == NULL) {
1925	SSLerr(SSL_F_SSL_PEEK_INTERNAL, SSL_R_UNINITIALIZED);
1926	return -`1`;
1927	}
1928
1929	if (s->shutdown & SSL_RECEIVED_SHUTDOWN) {
1930	return `0`;
1931	}
1932	if ((s->mode & SSL_MODE_ASYNC) && ASYNC_get_current_job() == NULL) {
1933	struct ssl_async_args args;
1934	int ret;
1935
1936	args.s = s;
1937	args.buf = buf;
1938	args.num = num;
1939	args.type = READFUNC;
1940	args.f.func_read = s->method->ssl_peek;
1941
1942	ret = ssl_start_async_job(s, &args, ssl_io_intern);
1943	*readbytes = s->asyncrw;
1944	return ret;
1945	} else {
1946	return s->method->ssl_peek(s, buf, num, readbytes);
1947	}
1948	}
1949
1950	int SSL_peek(SSL s, void* buf, int* num)
1951	{
1952	int ret;
1953	size_t readbytes;
1954
1955	if (num < `0`) {
1956	SSLerr(SSL_F_SSL_PEEK, SSL_R_BAD_LENGTH);
1957	return -`1`;
1958	}
1959
1960	ret = ssl_peek_internal(s, buf, (size_t)num, &readbytes);
1961
1962	/*
1963	* The cast is safe here because ret should be <= INT_MAX because num is
1964	* <= INT_MAX
1965	*/
1966	if (ret > `0`)
1967	ret = (int)readbytes;
1968
1969	return ret;
1970	}
1971
1972
1973	int SSL_peek_ex(SSL s, void* buf, size_t num, size_t readbytes)
1974	{
1975	int ret = ssl_peek_internal(s, buf, num, readbytes);
1976
1977	if (ret < `0`)
1978	ret = `0`;
1979	return ret;
1980	}
1981
1982	int ssl_write_internal(SSL s, const* void buf, size_t num, size_t written)
1983	{
1984	if (s->handshake_func == NULL) {
1985	SSLerr(SSL_F_SSL_WRITE_INTERNAL, SSL_R_UNINITIALIZED);
1986	return -`1`;
1987	}
1988
1989	if (s->shutdown & SSL_SENT_SHUTDOWN) {
1990	s->rwstate = SSL_NOTHING;
1991	SSLerr(SSL_F_SSL_WRITE_INTERNAL, SSL_R_PROTOCOL_IS_SHUTDOWN);
1992	return -`1`;
1993	}
1994
1995	if (s->early_data_state == SSL_EARLY_DATA_CONNECT_RETRY
1996	\|\| s->early_data_state == SSL_EARLY_DATA_ACCEPT_RETRY
1997	\|\| s->early_data_state == SSL_EARLY_DATA_READ_RETRY) {
1998	SSLerr(SSL_F_SSL_WRITE_INTERNAL, ERR_R_SHOULD_NOT_HAVE_BEEN_CALLED);
1999	return `0`;
2000	}
2001	/ If we are a client and haven't sent the Finished we better do that /
2002	ossl_statem_check_finish_init(s, `1`);
2003
2004	if ((s->mode & SSL_MODE_ASYNC) && ASYNC_get_current_job() == NULL) {
2005	int ret;
2006	struct ssl_async_args args;
2007
2008	args.s = s;
2009	args.buf = (void *)buf;
2010	args.num = num;
2011	args.type = WRITEFUNC;
2012	args.f.func_write = s->method->ssl_write;
2013
2014	ret = ssl_start_async_job(s, &args, ssl_io_intern);
2015	*written = s->asyncrw;
2016	return ret;
2017	} else {
2018	return s->method->ssl_write(s, buf, num, written);
2019	}
2020	}
2021
2022	ossl_ssize_t SSL_sendfile(SSL s, int* fd, off_t offset, size_t size, int flags)
2023	{
2024	ossl_ssize_t ret;
2025
2026	if (s->handshake_func == NULL) {
2027	SSLerr(SSL_F_SSL_SENDFILE, SSL_R_UNINITIALIZED);
2028	return -`1`;
2029	}
2030
2031	if (s->shutdown & SSL_SENT_SHUTDOWN) {
2032	s->rwstate = SSL_NOTHING;
2033	SSLerr(SSL_F_SSL_SENDFILE, SSL_R_PROTOCOL_IS_SHUTDOWN);
2034	return -`1`;
2035	}
2036
2037	if (!BIO_get_ktls_send(s->wbio)) {
2038	SSLerr(SSL_F_SSL_SENDFILE, SSL_R_UNINITIALIZED);
2039	return -`1`;
2040	}
2041
2042	/ If we have an alert to send, lets send it /
2043	if (s->s3.alert_dispatch) {
2044	ret = (ossl_ssize_t)s->method->ssl_dispatch_alert(s);
2045	if (ret <= `0`) {
2046	/ SSLfatal() already called if appropriate /
2047	return ret;
2048	}
2049	/ if it went, fall through and send more stuff /
2050	}
2051
2052	s->rwstate = SSL_WRITING;
2053	if (BIO_flush(s->wbio) <= `0`) {
2054	if (!BIO_should_retry(s->wbio)) {
2055	s->rwstate = SSL_NOTHING;
2056	} else {
2057	#ifdef EAGAIN
2058	set_sys_error(EAGAIN);
2059	#endif
2060	}
2061	return -`1`;
2062	}
2063
2064	#ifdef OPENSSL_NO_KTLS
2065	ERR_raise_data(ERR_LIB_SYS, ERR_R_INTERNAL_ERROR, "calling sendfile()");
2066	return -`1`;
2067	#else
2068	ret = ktls_sendfile(SSL_get_wfd(s), fd, offset, size, flags);
2069	if (ret < `0`) {
2070	#if defined(EAGAIN) && defined(EINTR) && defined(EBUSY)
2071	if ((get_last_sys_error() == EAGAIN) \|\|
2072	(get_last_sys_error() == EINTR) \|\|
2073	(get_last_sys_error() == EBUSY))
2074	BIO_set_retry_write(s->wbio);
2075	else
2076	#endif
2077	SSLerr(SSL_F_SSL_SENDFILE, SSL_R_UNINITIALIZED);
2078	return ret;
2079	}
2080	s->rwstate = SSL_NOTHING;
2081	return ret;
2082	#endif
2083	}
2084
2085	int SSL_write(SSL s, const* void buf, int* num)
2086	{
2087	int ret;
2088	size_t written;
2089
2090	if (num < `0`) {
2091	SSLerr(SSL_F_SSL_WRITE, SSL_R_BAD_LENGTH);
2092	return -`1`;
2093	}
2094
2095	ret = ssl_write_internal(s, buf, (size_t)num, &written);
2096
2097	/*
2098	* The cast is safe here because ret should be <= INT_MAX because num is
2099	* <= INT_MAX
2100	*/
2101	if (ret > `0`)
2102	ret = (int)written;
2103
2104	return ret;
2105	}
2106
2107	int SSL_write_ex(SSL s, const* void buf, size_t num, size_t written)
2108	{
2109	int ret = ssl_write_internal(s, buf, num, written);
2110
2111	if (ret < `0`)
2112	ret = `0`;
2113	return ret;
2114	}
2115
2116	int SSL_write_early_data(SSL s, const* void buf, size_t num, size_t written)
2117	{
2118	int ret, early_data_state;
2119	size_t writtmp;
2120	uint32_t partialwrite;
2121
2122	switch (s->early_data_state) {
2123	case SSL_EARLY_DATA_NONE:
2124	if (s->server
2125	\|\| !SSL_in_before(s)
2126	\|\| ((s->session == NULL \|\| s->session->ext.max_early_data == `0`)
2127	&& (s->psk_use_session_cb == NULL))) {
2128	SSLerr(SSL_F_SSL_WRITE_EARLY_DATA,
2129	ERR_R_SHOULD_NOT_HAVE_BEEN_CALLED);
2130	return `0`;
2131	}
2132	/ fall through /
2133
2134	case SSL_EARLY_DATA_CONNECT_RETRY:
2135	s->early_data_state = SSL_EARLY_DATA_CONNECTING;
2136	ret = SSL_connect(s);
2137	if (ret <= `0`) {
2138	/ NBIO or error /
2139	s->early_data_state = SSL_EARLY_DATA_CONNECT_RETRY;
2140	return `0`;
2141	}
2142	/ fall through /
2143
2144	case SSL_EARLY_DATA_WRITE_RETRY:
2145	s->early_data_state = SSL_EARLY_DATA_WRITING;
2146	/*
2147	* We disable partial write for early data because we don't keep track
2148	* of how many bytes we've written between the SSL_write_ex() call and
2149	* the flush if the flush needs to be retried)
2150	*/
2151	partialwrite = s->mode & SSL_MODE_ENABLE_PARTIAL_WRITE;
2152	s->mode &= ~SSL_MODE_ENABLE_PARTIAL_WRITE;
2153	ret = SSL_write_ex(s, buf, num, &writtmp);
2154	s->mode \|= partialwrite;
2155	if (!ret) {
2156	s->early_data_state = SSL_EARLY_DATA_WRITE_RETRY;
2157	return ret;
2158	}
2159	s->early_data_state = SSL_EARLY_DATA_WRITE_FLUSH;
2160	/ fall through /
2161
2162	case SSL_EARLY_DATA_WRITE_FLUSH:
2163	/ The buffering BIO is still in place so we need to flush it /
2164	if (statem_flush(s) != `1`)
2165	return `0`;
2166	*written = num;
2167	s->early_data_state = SSL_EARLY_DATA_WRITE_RETRY;
2168	return `1`;
2169
2170	case SSL_EARLY_DATA_FINISHED_READING:
2171	case SSL_EARLY_DATA_READ_RETRY:
2172	early_data_state = s->early_data_state;
2173	/ We are a server writing to an unauthenticated client /
2174	s->early_data_state = SSL_EARLY_DATA_UNAUTH_WRITING;
2175	ret = SSL_write_ex(s, buf, num, written);
2176	/ The buffering BIO is still in place /
2177	if (ret)
2178	(void)BIO_flush(s->wbio);
2179	s->early_data_state = early_data_state;
2180	return ret;
2181
2182	default:
2183	SSLerr(SSL_F_SSL_WRITE_EARLY_DATA, ERR_R_SHOULD_NOT_HAVE_BEEN_CALLED);
2184	return `0`;
2185	}
2186	}
2187
2188	int SSL_shutdown(SSL *s)
2189	{
2190	/*
2191	* Note that this function behaves differently from what one might
2192	* expect. Return values are 0 for no success (yet), 1 for success; but
2193	* calling it once is usually not enough, even if blocking I/O is used
2194	* (see ssl3_shutdown).
2195	*/
2196
2197	if (s->handshake_func == NULL) {
2198	SSLerr(SSL_F_SSL_SHUTDOWN, SSL_R_UNINITIALIZED);
2199	return -`1`;
2200	}
2201
2202	if (!SSL_in_init(s)) {
2203	if ((s->mode & SSL_MODE_ASYNC) && ASYNC_get_current_job() == NULL) {
2204	struct ssl_async_args args;
2205
2206	args.s = s;
2207	args.type = OTHERFUNC;
2208	args.f.func_other = s->method->ssl_shutdown;
2209
2210	return ssl_start_async_job(s, &args, ssl_io_intern);
2211	} else {
2212	return s->method->ssl_shutdown(s);
2213	}
2214	} else {
2215	SSLerr(SSL_F_SSL_SHUTDOWN, SSL_R_SHUTDOWN_WHILE_IN_INIT);
2216	return -`1`;
2217	}
2218	}
2219
2220	int SSL_key_update(SSL s, int* updatetype)
2221	{
2222	/*
2223	* TODO(TLS1.3): How will applications know whether TLSv1.3 has been
2224	* negotiated, and that it is appropriate to call SSL_key_update() instead
2225	* of SSL_renegotiate().
2226	*/
2227	if (!SSL_IS_TLS13(s)) {
2228	SSLerr(SSL_F_SSL_KEY_UPDATE, SSL_R_WRONG_SSL_VERSION);
2229	return `0`;
2230	}
2231
2232	if (updatetype != SSL_KEY_UPDATE_NOT_REQUESTED
2233	&& updatetype != SSL_KEY_UPDATE_REQUESTED) {
2234	SSLerr(SSL_F_SSL_KEY_UPDATE, SSL_R_INVALID_KEY_UPDATE_TYPE);
2235	return `0`;
2236	}
2237
2238	if (!SSL_is_init_finished(s)) {
2239	SSLerr(SSL_F_SSL_KEY_UPDATE, SSL_R_STILL_IN_INIT);
2240	return `0`;
2241	}
2242
2243	ossl_statem_set_in_init(s, `1`);
2244	s->key_update = updatetype;
2245	return `1`;
2246	}
2247
2248	int SSL_get_key_update_type(const SSL *s)
2249	{
2250	return s->key_update;
2251	}
2252
2253	int SSL_renegotiate(SSL *s)
2254	{
2255	if (SSL_IS_TLS13(s)) {
2256	SSLerr(SSL_F_SSL_RENEGOTIATE, SSL_R_WRONG_SSL_VERSION);
2257	return `0`;
2258	}
2259
2260	if ((s->options & SSL_OP_NO_RENEGOTIATION)) {
2261	SSLerr(SSL_F_SSL_RENEGOTIATE, SSL_R_NO_RENEGOTIATION);
2262	return `0`;
2263	}
2264
2265	s->renegotiate = `1`;
2266	s->new_session = `1`;
2267
2268	return s->method->ssl_renegotiate(s);
2269	}
2270
2271	int SSL_renegotiate_abbreviated(SSL *s)
2272	{
2273	if (SSL_IS_TLS13(s)) {
2274	SSLerr(SSL_F_SSL_RENEGOTIATE_ABBREVIATED, SSL_R_WRONG_SSL_VERSION);
2275	return `0`;
2276	}
2277
2278	if ((s->options & SSL_OP_NO_RENEGOTIATION)) {
2279	SSLerr(SSL_F_SSL_RENEGOTIATE_ABBREVIATED, SSL_R_NO_RENEGOTIATION);
2280	return `0`;
2281	}
2282
2283	s->renegotiate = `1`;
2284	s->new_session = `0`;
2285
2286	return s->method->ssl_renegotiate(s);
2287	}
2288
2289	int SSL_renegotiate_pending(const SSL *s)
2290	{
2291	/*
2292	* becomes true when negotiation is requested; false again once a
2293	* handshake has finished
2294	*/
2295	return (s->renegotiate != `0`);
2296	}
2297
2298	long SSL_ctrl(SSL s, int* cmd, long larg, void *parg)
2299	{
2300	long l;
2301
2302	switch (cmd) {
2303	case SSL_CTRL_GET_READ_AHEAD:
2304	return RECORD_LAYER_get_read_ahead(&s->rlayer);
2305	case SSL_CTRL_SET_READ_AHEAD:
2306	l = RECORD_LAYER_get_read_ahead(&s->rlayer);
2307	RECORD_LAYER_set_read_ahead(&s->rlayer, larg);
2308	return l;
2309
2310	case SSL_CTRL_SET_MSG_CALLBACK_ARG:
2311	s->msg_callback_arg = parg;
2312	return `1`;
2313
2314	case SSL_CTRL_MODE:
2315	return (s->mode \|= larg);
2316	case SSL_CTRL_CLEAR_MODE:
2317	return (s->mode &= ~larg);
2318	case SSL_CTRL_GET_MAX_CERT_LIST:
2319	return (long)s->max_cert_list;
2320	case SSL_CTRL_SET_MAX_CERT_LIST:
2321	if (larg < `0`)
2322	return `0`;
2323	l = (long)s->max_cert_list;
2324	s->max_cert_list = (size_t)larg;
2325	return l;
2326	case SSL_CTRL_SET_MAX_SEND_FRAGMENT:
2327	if (larg < `512` \|\| larg > SSL3_RT_MAX_PLAIN_LENGTH)
2328	return `0`;
2329	#ifndef OPENSSL_NO_KTLS
2330	if (s->wbio != NULL && BIO_get_ktls_send(s->wbio))
2331	return `0`;
2332	#endif /* OPENSSL_NO_KTLS */
2333	s->max_send_fragment = larg;
2334	if (s->max_send_fragment < s->split_send_fragment)
2335	s->split_send_fragment = s->max_send_fragment;
2336	return `1`;
2337	case SSL_CTRL_SET_SPLIT_SEND_FRAGMENT:
2338	if ((size_t)larg > s->max_send_fragment \|\| larg == `0`)
2339	return `0`;
2340	s->split_send_fragment = larg;
2341	return `1`;
2342	case SSL_CTRL_SET_MAX_PIPELINES:
2343	if (larg < `1` \|\| larg > SSL_MAX_PIPELINES)
2344	return `0`;
2345	s->max_pipelines = larg;
2346	if (larg > `1`)
2347	RECORD_LAYER_set_read_ahead(&s->rlayer, `1`);
2348	return `1`;
2349	case SSL_CTRL_GET_RI_SUPPORT:
2350	return s->s3.send_connection_binding;
2351	case SSL_CTRL_CERT_FLAGS:
2352	return (s->cert->cert_flags \|= larg);
2353	case SSL_CTRL_CLEAR_CERT_FLAGS:
2354	return (s->cert->cert_flags &= ~larg);
2355
2356	case SSL_CTRL_GET_RAW_CIPHERLIST:
2357	if (parg) {
2358	if (s->s3.tmp.ciphers_raw == NULL)
2359	return `0`;
2360	(unsigned* char **)parg = s->s3.tmp.ciphers_raw;
2361	return (int)s->s3.tmp.ciphers_rawlen;
2362	} else {
2363	return TLS_CIPHER_LEN;
2364	}
2365	case SSL_CTRL_GET_EXTMS_SUPPORT:
2366	if (!s->session \|\| SSL_in_init(s) \|\| ossl_statem_get_in_handshake(s))
2367	return -`1`;
2368	if (s->session->flags & SSL_SESS_FLAG_EXTMS)
2369	return `1`;
2370	else
2371	return `0`;
2372	case SSL_CTRL_SET_MIN_PROTO_VERSION:
2373	return ssl_check_allowed_versions(larg, s->max_proto_version)
2374	&& ssl_set_version_bound(s->ctx->method->version, (int)larg,
2375	&s->min_proto_version);
2376	case SSL_CTRL_GET_MIN_PROTO_VERSION:
2377	return s->min_proto_version;
2378	case SSL_CTRL_SET_MAX_PROTO_VERSION:
2379	return ssl_check_allowed_versions(s->min_proto_version, larg)
2380	&& ssl_set_version_bound(s->ctx->method->version, (int)larg,
2381	&s->max_proto_version);
2382	case SSL_CTRL_GET_MAX_PROTO_VERSION:
2383	return s->max_proto_version;
2384	default:
2385	return s->method->ssl_ctrl(s, cmd, larg, parg);
2386	}
2387	}
2388
2389	long SSL_callback_ctrl(SSL s, int* cmd, void (fp) (void*))
2390	{
2391	switch (cmd) {
2392	case SSL_CTRL_SET_MSG_CALLBACK:
2393	s->msg_callback = (void (*)
2394	(int write_p, int version, int content_type,
2395	const void buf, size_t len, SSL ssl,
2396	void *arg))(fp);
2397	return `1`;
2398
2399	default:
2400	return s->method->ssl_callback_ctrl(s, cmd, fp);
2401	}
2402	}
2403
2404	LHASH_OF(SSL_SESSION) SSL_CTX_sessions(SSL_CTX ctx)
2405	{
2406	return ctx->sessions;
2407	}
2408
2409	long SSL_CTX_ctrl(SSL_CTX ctx, int* cmd, long larg, void *parg)
2410	{
2411	long l;
2412	/ For some cases with ctx == NULL perform syntax checks /
2413	if (ctx == NULL) {
2414	switch (cmd) {
2415	#ifndef OPENSSL_NO_EC
2416	case SSL_CTRL_SET_GROUPS_LIST:
2417	return tls1_set_groups_list(NULL, NULL, parg);
2418	#endif
2419	case SSL_CTRL_SET_SIGALGS_LIST:
2420	case SSL_CTRL_SET_CLIENT_SIGALGS_LIST:
2421	return tls1_set_sigalgs_list(NULL, parg, `0`);
2422	default:
2423	return `0`;
2424	}
2425	}
2426
2427	switch (cmd) {
2428	case SSL_CTRL_GET_READ_AHEAD:
2429	return ctx->read_ahead;
2430	case SSL_CTRL_SET_READ_AHEAD:
2431	l = ctx->read_ahead;
2432	ctx->read_ahead = larg;
2433	return l;
2434
2435	case SSL_CTRL_SET_MSG_CALLBACK_ARG:
2436	ctx->msg_callback_arg = parg;
2437	return `1`;
2438
2439	case SSL_CTRL_GET_MAX_CERT_LIST:
2440	return (long)ctx->max_cert_list;
2441	case SSL_CTRL_SET_MAX_CERT_LIST:
2442	if (larg < `0`)
2443	return `0`;
2444	l = (long)ctx->max_cert_list;
2445	ctx->max_cert_list = (size_t)larg;
2446	return l;
2447
2448	case SSL_CTRL_SET_SESS_CACHE_SIZE:
2449	if (larg < `0`)
2450	return `0`;
2451	l = (long)ctx->session_cache_size;
2452	ctx->session_cache_size = (size_t)larg;
2453	return l;
2454	case SSL_CTRL_GET_SESS_CACHE_SIZE:
2455	return (long)ctx->session_cache_size;
2456	case SSL_CTRL_SET_SESS_CACHE_MODE:
2457	l = ctx->session_cache_mode;
2458	ctx->session_cache_mode = larg;
2459	return l;
2460	case SSL_CTRL_GET_SESS_CACHE_MODE:
2461	return ctx->session_cache_mode;
2462
2463	case SSL_CTRL_SESS_NUMBER:
2464	return lh_SSL_SESSION_num_items(ctx->sessions);
2465	case SSL_CTRL_SESS_CONNECT:
2466	return tsan_load(&ctx->stats.sess_connect);
2467	case SSL_CTRL_SESS_CONNECT_GOOD:
2468	return tsan_load(&ctx->stats.sess_connect_good);
2469	case SSL_CTRL_SESS_CONNECT_RENEGOTIATE:
2470	return tsan_load(&ctx->stats.sess_connect_renegotiate);
2471	case SSL_CTRL_SESS_ACCEPT:
2472	return tsan_load(&ctx->stats.sess_accept);
2473	case SSL_CTRL_SESS_ACCEPT_GOOD:
2474	return tsan_load(&ctx->stats.sess_accept_good);
2475	case SSL_CTRL_SESS_ACCEPT_RENEGOTIATE:
2476	return tsan_load(&ctx->stats.sess_accept_renegotiate);
2477	case SSL_CTRL_SESS_HIT:
2478	return tsan_load(&ctx->stats.sess_hit);
2479	case SSL_CTRL_SESS_CB_HIT:
2480	return tsan_load(&ctx->stats.sess_cb_hit);
2481	case SSL_CTRL_SESS_MISSES:
2482	return tsan_load(&ctx->stats.sess_miss);
2483	case SSL_CTRL_SESS_TIMEOUTS:
2484	return tsan_load(&ctx->stats.sess_timeout);
2485	case SSL_CTRL_SESS_CACHE_FULL:
2486	return tsan_load(&ctx->stats.sess_cache_full);
2487	case SSL_CTRL_MODE:
2488	return (ctx->mode \|= larg);
2489	case SSL_CTRL_CLEAR_MODE:
2490	return (ctx->mode &= ~larg);
2491	case SSL_CTRL_SET_MAX_SEND_FRAGMENT:
2492	if (larg < `512` \|\| larg > SSL3_RT_MAX_PLAIN_LENGTH)
2493	return `0`;
2494	ctx->max_send_fragment = larg;
2495	if (ctx->max_send_fragment < ctx->split_send_fragment)
2496	ctx->split_send_fragment = ctx->max_send_fragment;
2497	return `1`;
2498	case SSL_CTRL_SET_SPLIT_SEND_FRAGMENT:
2499	if ((size_t)larg > ctx->max_send_fragment \|\| larg == `0`)
2500	return `0`;
2501	ctx->split_send_fragment = larg;
2502	return `1`;
2503	case SSL_CTRL_SET_MAX_PIPELINES:
2504	if (larg < `1` \|\| larg > SSL_MAX_PIPELINES)
2505	return `0`;
2506	ctx->max_pipelines = larg;
2507	return `1`;
2508	case SSL_CTRL_CERT_FLAGS:
2509	return (ctx->cert->cert_flags \|= larg);
2510	case SSL_CTRL_CLEAR_CERT_FLAGS:
2511	return (ctx->cert->cert_flags &= ~larg);
2512	case SSL_CTRL_SET_MIN_PROTO_VERSION:
2513	return ssl_check_allowed_versions(larg, ctx->max_proto_version)
2514	&& ssl_set_version_bound(ctx->method->version, (int)larg,
2515	&ctx->min_proto_version);
2516	case SSL_CTRL_GET_MIN_PROTO_VERSION:
2517	return ctx->min_proto_version;
2518	case SSL_CTRL_SET_MAX_PROTO_VERSION:
2519	return ssl_check_allowed_versions(ctx->min_proto_version, larg)
2520	&& ssl_set_version_bound(ctx->method->version, (int)larg,
2521	&ctx->max_proto_version);
2522	case SSL_CTRL_GET_MAX_PROTO_VERSION:
2523	return ctx->max_proto_version;
2524	default:
2525	return ctx->method->ssl_ctx_ctrl(ctx, cmd, larg, parg);
2526	}
2527	}
2528
2529	long SSL_CTX_callback_ctrl(SSL_CTX ctx, int* cmd, void (fp) (void*))
2530	{
2531	switch (cmd) {
2532	case SSL_CTRL_SET_MSG_CALLBACK:
2533	ctx->msg_callback = (void (*)
2534	(int write_p, int version, int content_type,
2535	const void buf, size_t len, SSL ssl,
2536	void *arg))(fp);
2537	return `1`;
2538
2539	default:
2540	return ctx->method->ssl_ctx_callback_ctrl(ctx, cmd, fp);
2541	}
2542	}
2543
2544	int ssl_cipher_id_cmp(const SSL_CIPHER a, const* SSL_CIPHER *b)
2545	{
2546	if (a->id > b->id)
2547	return `1`;
2548	if (a->id < b->id)
2549	return -`1`;
2550	return `0`;
2551	}
2552
2553	int ssl_cipher_ptr_id_cmp(const SSL_CIPHER *const *ap,
2554	const SSL_CIPHER *const *bp)
2555	{
2556	if ((ap)->id > (bp)->id)
2557	return `1`;
2558	if ((ap)->id < (bp)->id)
2559	return -`1`;
2560	return `0`;
2561	}
2562
2563	/* return a STACK of the ciphers available for the SSL and in order of*
2564	* preference */
2565	STACK_OF(SSL_CIPHER) SSL_get_ciphers(const* SSL *s)
2566	{
2567	if (s != NULL) {
2568	if (s->cipher_list != NULL) {
2569	return s->cipher_list;
2570	} else if ((s->ctx != NULL) && (s->ctx->cipher_list != NULL)) {
2571	return s->ctx->cipher_list;
2572	}
2573	}
2574	return NULL;
2575	}
2576
2577	STACK_OF(SSL_CIPHER) SSL_get_client_ciphers(const* SSL *s)
2578	{
2579	if ((s == NULL) \|\| !s->server)
2580	return NULL;
2581	return s->peer_ciphers;
2582	}
2583
2584	STACK_OF(SSL_CIPHER) SSL_get1_supported_ciphers(SSL s)
2585	{
2586	STACK_OF(SSL_CIPHER) sk = NULL, ciphers;
2587	int i;
2588
2589	ciphers = SSL_get_ciphers(s);
2590	if (!ciphers)
2591	return NULL;
2592	if (!ssl_set_client_disabled(s))
2593	return NULL;
2594	for (i = `0`; i < sk_SSL_CIPHER_num(ciphers); i++) {
2595	const SSL_CIPHER *c = sk_SSL_CIPHER_value(ciphers, i);
2596	if (!ssl_cipher_disabled(s, c, SSL_SECOP_CIPHER_SUPPORTED, `0`)) {
2597	if (!sk)
2598	sk = sk_SSL_CIPHER_new_null();
2599	if (!sk)
2600	return NULL;
2601	if (!sk_SSL_CIPHER_push(sk, c)) {
2602	sk_SSL_CIPHER_free(sk);
2603	return NULL;
2604	}
2605	}
2606	}
2607	return sk;
2608	}
2609
2610	/* return a STACK of the ciphers available for the SSL and in order of*
2611	* algorithm id */
2612	STACK_OF(SSL_CIPHER) ssl_get_ciphers_by_id(SSL s)
2613	{
2614	if (s != NULL) {
2615	if (s->cipher_list_by_id != NULL) {
2616	return s->cipher_list_by_id;
2617	} else if ((s->ctx != NULL) && (s->ctx->cipher_list_by_id != NULL)) {
2618	return s->ctx->cipher_list_by_id;
2619	}
2620	}
2621	return NULL;
2622	}
2623
2624	/* The old interface to get the same thing as SSL_get_ciphers() /
2625	const char SSL_get_cipher_list(const* SSL s, int* n)
2626	{
2627	const SSL_CIPHER *c;
2628	STACK_OF(SSL_CIPHER) *sk;
2629
2630	if (s == NULL)
2631	return NULL;
2632	sk = SSL_get_ciphers(s);
2633	if ((sk == NULL) \|\| (sk_SSL_CIPHER_num(sk) <= n))
2634	return NULL;
2635	c = sk_SSL_CIPHER_value(sk, n);
2636	if (c == NULL)
2637	return NULL;
2638	return c->name;
2639	}
2640
2641	/* return a STACK of the ciphers available for the SSL_CTX and in order of*
2642	* preference */
2643	STACK_OF(SSL_CIPHER) SSL_CTX_get_ciphers(const* SSL_CTX *ctx)
2644	{
2645	if (ctx != NULL)
2646	return ctx->cipher_list;
2647	return NULL;
2648	}
2649
2650	/*
2651	* Distinguish between ciphers controlled by set_ciphersuite() and
2652	* set_cipher_list() when counting.
2653	*/
2654	static int cipher_list_tls12_num(STACK_OF(SSL_CIPHER) *sk)
2655	{
2656	int i, num = `0`;
2657	const SSL_CIPHER *c;
2658
2659	if (sk == NULL)
2660	return `0`;
2661	for (i = `0`; i < sk_SSL_CIPHER_num(sk); ++i) {
2662	c = sk_SSL_CIPHER_value(sk, i);
2663	if (c->min_tls >= TLS1_3_VERSION)
2664	continue;
2665	num++;
2666	}
2667	return num;
2668	}
2669
2670	/* specify the ciphers to be used by default by the SSL_CTX /
2671	int SSL_CTX_set_cipher_list(SSL_CTX ctx, const* char *str)
2672	{
2673	STACK_OF(SSL_CIPHER) *sk;
2674
2675	sk = ssl_create_cipher_list(ctx->method, ctx->tls13_ciphersuites,
2676	&ctx->cipher_list, &ctx->cipher_list_by_id, str,
2677	ctx->cert);
2678	/*
2679	* ssl_create_cipher_list may return an empty stack if it was unable to
2680	* find a cipher matching the given rule string (for example if the rule
2681	* string specifies a cipher which has been disabled). This is not an
2682	* error as far as ssl_create_cipher_list is concerned, and hence
2683	* ctx->cipher_list and ctx->cipher_list_by_id has been updated.
2684	*/
2685	if (sk == NULL)
2686	return `0`;
2687	else if (cipher_list_tls12_num(sk) == `0`) {
2688	SSLerr(SSL_F_SSL_CTX_SET_CIPHER_LIST, SSL_R_NO_CIPHER_MATCH);
2689	return `0`;
2690	}
2691	return `1`;
2692	}
2693
2694	/* specify the ciphers to be used by the SSL /
2695	int SSL_set_cipher_list(SSL s, const* char *str)
2696	{
2697	STACK_OF(SSL_CIPHER) *sk;
2698
2699	sk = ssl_create_cipher_list(s->ctx->method, s->tls13_ciphersuites,
2700	&s->cipher_list, &s->cipher_list_by_id, str,
2701	s->cert);
2702	/ see comment in SSL_CTX_set_cipher_list /
2703	if (sk == NULL)
2704	return `0`;
2705	else if (cipher_list_tls12_num(sk) == `0`) {
2706	SSLerr(SSL_F_SSL_SET_CIPHER_LIST, SSL_R_NO_CIPHER_MATCH);
2707	return `0`;
2708	}
2709	return `1`;
2710	}
2711
2712	char SSL_get_shared_ciphers(const* SSL s, char* buf, int* size)
2713	{
2714	char *p;
2715	STACK_OF(SSL_CIPHER) clntsk, srvrsk;
2716	const SSL_CIPHER *c;
2717	int i;
2718
2719	if (!s->server
2720	\|\| s->peer_ciphers == NULL
2721	\|\| size < `2`)
2722	return NULL;
2723
2724	p = buf;
2725	clntsk = s->peer_ciphers;
2726	srvrsk = SSL_get_ciphers(s);
2727	if (clntsk == NULL \|\| srvrsk == NULL)
2728	return NULL;
2729
2730	if (sk_SSL_CIPHER_num(clntsk) == `0` \|\| sk_SSL_CIPHER_num(srvrsk) == `0`)
2731	return NULL;
2732
2733	for (i = `0`; i < sk_SSL_CIPHER_num(clntsk); i++) {
2734	int n;
2735
2736	c = sk_SSL_CIPHER_value(clntsk, i);
2737	if (sk_SSL_CIPHER_find(srvrsk, c) < `0`)
2738	continue;
2739
2740	n = strlen(c->name);
2741	if (n + `1` > size) {
2742	if (p != buf)
2743	--p;
2744	*p = `'\0'`;
2745	return buf;
2746	}
2747	strcpy(p, c->name);
2748	p += n;
2749	*(p++) = `':'`;
2750	size -= n + `1`;
2751	}
2752	p[-`1`] = `'\0'`;
2753	return buf;
2754	}
2755
2756	/* return a servername extension value if provided in Client Hello, or NULL.*
2757	* So far, only host_name types are defined (RFC 3546).
2758	*/
2759
2760	const char SSL_get_servername(const* SSL s, const* int type)
2761	{
2762	if (type != TLSEXT_NAMETYPE_host_name)
2763	return NULL;
2764
2765	/*
2766	* SNI is not negotiated in pre-TLS-1.3 resumption flows, so fake up an
2767	* SNI value to return if we are resuming/resumed. N.B. that we still
2768	* call the relevant callbacks for such resumption flows, and callbacks
2769	* might error out if there is not a SNI value available.
2770	*/
2771	if (s->hit)
2772	return s->session->ext.hostname;
2773	return s->ext.hostname;
2774	}
2775
2776	int SSL_get_servername_type(const SSL *s)
2777	{
2778	if (s->session
2779	&& (!s->ext.hostname ? s->session->
2780	ext.hostname : s->ext.hostname))
2781	return TLSEXT_NAMETYPE_host_name;
2782	return -`1`;
2783	}
2784
2785	/*
2786	* SSL_select_next_proto implements the standard protocol selection. It is
2787	* expected that this function is called from the callback set by
2788	* SSL_CTX_set_next_proto_select_cb. The protocol data is assumed to be a
2789	* vector of 8-bit, length prefixed byte strings. The length byte itself is
2790	* not included in the length. A byte string of length 0 is invalid. No byte
2791	* string may be truncated. The current, but experimental algorithm for
2792	* selecting the protocol is: 1) If the server doesn't support NPN then this
2793	* is indicated to the callback. In this case, the client application has to
2794	* abort the connection or have a default application level protocol. 2) If
2795	* the server supports NPN, but advertises an empty list then the client
2796	* selects the first protocol in its list, but indicates via the API that this
2797	* fallback case was enacted. 3) Otherwise, the client finds the first
2798	* protocol in the server's list that it supports and selects this protocol.
2799	* This is because it's assumed that the server has better information about
2800	* which protocol a client should use. 4) If the client doesn't support any
2801	* of the server's advertised protocols, then this is treated the same as
2802	* case 2. It returns either OPENSSL_NPN_NEGOTIATED if a common protocol was
2803	* found, or OPENSSL_NPN_NO_OVERLAP if the fallback case was reached.
2804	*/
2805	int SSL_select_next_proto(unsigned char *out, unsigned* char *outlen,
2806	const unsigned char *server,
2807	unsigned int server_len,
2808	const unsigned char client, unsigned* int client_len)
2809	{
2810	unsigned int i, j;
2811	const unsigned char *result;
2812	int status = OPENSSL_NPN_UNSUPPORTED;
2813
2814	/*
2815	* For each protocol in server preference order, see if we support it.
2816	*/
2817	for (i = `0`; i < server_len;) {
2818	for (j = `0`; j < client_len;) {
2819	if (server[i] == client[j] &&
2820	memcmp(&server[i + `1`], &client[j + `1`], server[i]) == `0`) {
2821	/ We found a match /
2822	result = &server[i];
2823	status = OPENSSL_NPN_NEGOTIATED;
2824	goto found;
2825	}
2826	j += client[j];
2827	j++;
2828	}
2829	i += server[i];
2830	i++;
2831	}
2832
2833	/ There's no overlap between our protocols and the server's list. /
2834	result = client;
2835	status = OPENSSL_NPN_NO_OVERLAP;
2836
2837	found:
2838	out = (unsigned* char *)result + `1`;
2839	*outlen = result[`0`];
2840	return status;
2841	}
2842
2843	#ifndef OPENSSL_NO_NEXTPROTONEG
2844	/*
2845	* SSL_get0_next_proto_negotiated sets data and len to point to the
2846	* client's requested protocol for this connection and returns 0. If the
2847	* client didn't request any protocol, then *data is set to NULL. Note that
2848	* the client can request any protocol it chooses. The value returned from
2849	* this function need not be a member of the list of supported protocols
2850	* provided by the callback.
2851	*/
2852	void SSL_get0_next_proto_negotiated(const SSL s, const* unsigned char **data,
2853	unsigned *len)
2854	{
2855	*data = s->ext.npn;
2856	if (*data == NULL) {
2857	*len = `0`;
2858	} else {
2859	len = (unsigned* int)s->ext.npn_len;
2860	}
2861	}
2862
2863	/*
2864	* SSL_CTX_set_npn_advertised_cb sets a callback that is called when
2865	* a TLS server needs a list of supported protocols for Next Protocol
2866	* Negotiation. The returned list must be in wire format. The list is
2867	* returned by setting \|out\| to point to it and \|outlen\| to its length. This
2868	* memory will not be modified, but one should assume that the SSL* keeps a
2869	* reference to it. The callback should return SSL_TLSEXT_ERR_OK if it
2870	* wishes to advertise. Otherwise, no such extension will be included in the
2871	* ServerHello.
2872	*/
2873	void SSL_CTX_set_npn_advertised_cb(SSL_CTX *ctx,
2874	SSL_CTX_npn_advertised_cb_func cb,
2875	void *arg)
2876	{
2877	ctx->ext.npn_advertised_cb = cb;
2878	ctx->ext.npn_advertised_cb_arg = arg;
2879	}
2880
2881	/*
2882	* SSL_CTX_set_next_proto_select_cb sets a callback that is called when a
2883	* client needs to select a protocol from the server's provided list. \|out\|
2884	* must be set to point to the selected protocol (which may be within \|in\|).
2885	* The length of the protocol name must be written into \|outlen\|. The
2886	* server's advertised protocols are provided in \|in\| and \|inlen\|. The
2887	* callback can assume that \|in\| is syntactically valid. The client must
2888	* select a protocol. It is fatal to the connection if this callback returns
2889	* a value other than SSL_TLSEXT_ERR_OK.
2890	*/
2891	void SSL_CTX_set_npn_select_cb(SSL_CTX *ctx,
2892	SSL_CTX_npn_select_cb_func cb,
2893	void *arg)
2894	{
2895	ctx->ext.npn_select_cb = cb;
2896	ctx->ext.npn_select_cb_arg = arg;
2897	}
2898	#endif
2899
2900	/*
2901	* SSL_CTX_set_alpn_protos sets the ALPN protocol list on \|ctx\| to \|protos\|.
2902	* \|protos\| must be in wire-format (i.e. a series of non-empty, 8-bit
2903	* length-prefixed strings). Returns 0 on success.
2904	*/
2905	int SSL_CTX_set_alpn_protos(SSL_CTX ctx, const* unsigned char *protos,
2906	unsigned int protos_len)
2907	{
2908	OPENSSL_free(ctx->ext.alpn);
2909	ctx->ext.alpn = OPENSSL_memdup(protos, protos_len);
2910	if (ctx->ext.alpn == NULL) {
2911	SSLerr(SSL_F_SSL_CTX_SET_ALPN_PROTOS, ERR_R_MALLOC_FAILURE);
2912	return `1`;
2913	}
2914	ctx->ext.alpn_len = protos_len;
2915
2916	return `0`;
2917	}
2918
2919	/*
2920	* SSL_set_alpn_protos sets the ALPN protocol list on \|ssl\| to \|protos\|.
2921	* \|protos\| must be in wire-format (i.e. a series of non-empty, 8-bit
2922	* length-prefixed strings). Returns 0 on success.
2923	*/
2924	int SSL_set_alpn_protos(SSL ssl, const* unsigned char *protos,
2925	unsigned int protos_len)
2926	{
2927	OPENSSL_free(ssl->ext.alpn);
2928	ssl->ext.alpn = OPENSSL_memdup(protos, protos_len);
2929	if (ssl->ext.alpn == NULL) {
2930	SSLerr(SSL_F_SSL_SET_ALPN_PROTOS, ERR_R_MALLOC_FAILURE);
2931	return `1`;
2932	}
2933	ssl->ext.alpn_len = protos_len;
2934
2935	return `0`;
2936	}
2937
2938	/*
2939	* SSL_CTX_set_alpn_select_cb sets a callback function on \|ctx\| that is
2940	* called during ClientHello processing in order to select an ALPN protocol
2941	* from the client's list of offered protocols.
2942	*/
2943	void SSL_CTX_set_alpn_select_cb(SSL_CTX *ctx,
2944	SSL_CTX_alpn_select_cb_func cb,
2945	void *arg)
2946	{
2947	ctx->ext.alpn_select_cb = cb;
2948	ctx->ext.alpn_select_cb_arg = arg;
2949	}
2950
2951	/*
2952	* SSL_get0_alpn_selected gets the selected ALPN protocol (if any) from \|ssl\|.
2953	* On return it sets \|data\| to point to \|len\| bytes of protocol name
2954	* (not including the leading length-prefix byte). If the server didn't
2955	* respond with a negotiated protocol then \|*len\| will be zero.
2956	*/
2957	void SSL_get0_alpn_selected(const SSL ssl, const* unsigned char **data,
2958	unsigned int *len)
2959	{
2960	*data = ssl->s3.alpn_selected;
2961	if (*data == NULL)
2962	*len = `0`;
2963	else
2964	len = (unsigned* int)ssl->s3.alpn_selected_len;
2965	}
2966
2967	int SSL_export_keying_material(SSL s, unsigned* char *out, size_t olen,
2968	const char *label, size_t llen,
2969	const unsigned char *context, size_t contextlen,
2970	int use_context)
2971	{
2972	if (s->version < TLS1_VERSION && s->version != DTLS1_BAD_VER)
2973	return -`1`;
2974
2975	return s->method->ssl3_enc->export_keying_material(s, out, olen, label,
2976	llen, context,
2977	contextlen, use_context);
2978	}
2979
2980	int SSL_export_keying_material_early(SSL s, unsigned* char *out, size_t olen,
2981	const char *label, size_t llen,
2982	const unsigned char *context,
2983	size_t contextlen)
2984	{
2985	if (s->version != TLS1_3_VERSION)
2986	return `0`;
2987
2988	return tls13_export_keying_material_early(s, out, olen, label, llen,
2989	context, contextlen);
2990	}
2991
2992	static unsigned long ssl_session_hash(const SSL_SESSION *a)
2993	{
2994	const unsigned char *session_id = a->session_id;
2995	unsigned long l;
2996	unsigned char tmp_storage[`4`];
2997
2998	if (a->session_id_length < sizeof(tmp_storage)) {
2999	memset(tmp_storage, `0`, sizeof(tmp_storage));
3000	memcpy(tmp_storage, a->session_id, a->session_id_length);
3001	session_id = tmp_storage;
3002	}
3003
3004	l = (unsigned long)
3005	((unsigned long)session_id[`0`]) \|
3006	((unsigned long)session_id[`1`] << `8L`) \|
3007	((unsigned long)session_id[`2`] << `16L`) \|
3008	((unsigned long)session_id[`3`] << `24L`);
3009	return l;
3010	}
3011
3012	/*
3013	* NB: If this function (or indeed the hash function which uses a sort of
3014	* coarser function than this one) is changed, ensure
3015	* SSL_CTX_has_matching_session_id() is checked accordingly. It relies on
3016	* being able to construct an SSL_SESSION that will collide with any existing
3017	* session with a matching session ID.
3018	*/
3019	static int ssl_session_cmp(const SSL_SESSION a, const* SSL_SESSION *b)
3020	{
3021	if (a->ssl_version != b->ssl_version)
3022	return `1`;
3023	if (a->session_id_length != b->session_id_length)
3024	return `1`;
3025	return memcmp(a->session_id, b->session_id, a->session_id_length);
3026	}
3027
3028	/*
3029	* These wrapper functions should remain rather than redeclaring
3030	* SSL_SESSION_hash and SSL_SESSION_cmp for void* types and casting each
3031	* variable. The reason is that the functions aren't static, they're exposed
3032	* via ssl.h.
3033	*/
3034
3035	SSL_CTX SSL_CTX_new(const* SSL_METHOD *meth)
3036	{
3037	SSL_CTX *ret = NULL;
3038
3039	if (meth == NULL) {
3040	SSLerr(SSL_F_SSL_CTX_NEW, SSL_R_NULL_SSL_METHOD_PASSED);
3041	return NULL;
3042	}
3043
3044	if (!OPENSSL_init_ssl(OPENSSL_INIT_LOAD_SSL_STRINGS, NULL))
3045	return NULL;
3046
3047	if (SSL_get_ex_data_X509_STORE_CTX_idx() < `0`) {
3048	SSLerr(SSL_F_SSL_CTX_NEW, SSL_R_X509_VERIFICATION_SETUP_PROBLEMS);
3049	goto err;
3050	}
3051	ret = OPENSSL_zalloc(sizeof(*ret));
3052	if (ret == NULL)
3053	goto err;
3054
3055	ret->method = meth;
3056	ret->min_proto_version = `0`;
3057	ret->max_proto_version = `0`;
3058	ret->mode = SSL_MODE_AUTO_RETRY;
3059	ret->session_cache_mode = SSL_SESS_CACHE_SERVER;
3060	ret->session_cache_size = SSL_SESSION_CACHE_MAX_SIZE_DEFAULT;
3061	/ We take the system default. /
3062	ret->session_timeout = meth->get_timeout();
3063	ret->references = `1`;
3064	ret->lock = CRYPTO_THREAD_lock_new();
3065	if (ret->lock == NULL) {
3066	SSLerr(SSL_F_SSL_CTX_NEW, ERR_R_MALLOC_FAILURE);
3067	OPENSSL_free(ret);
3068	return NULL;
3069	}
3070	ret->max_cert_list = SSL_MAX_CERT_LIST_DEFAULT;
3071	ret->verify_mode = SSL_VERIFY_NONE;
3072	if ((ret->cert = ssl_cert_new()) == NULL)
3073	goto err;
3074
3075	ret->sessions = lh_SSL_SESSION_new(ssl_session_hash, ssl_session_cmp);
3076	if (ret->sessions == NULL)
3077	goto err;
3078	ret->cert_store = X509_STORE_new();
3079	if (ret->cert_store == NULL)
3080	goto err;
3081	#ifndef OPENSSL_NO_CT
3082	ret->ctlog_store = CTLOG_STORE_new();
3083	if (ret->ctlog_store == NULL)
3084	goto err;
3085	#endif
3086
3087	if (!SSL_CTX_set_ciphersuites(ret, OSSL_default_ciphersuites()))
3088	goto err;
3089
3090	if (!ssl_create_cipher_list(ret->method,
3091	ret->tls13_ciphersuites,
3092	&ret->cipher_list, &ret->cipher_list_by_id,
3093	OSSL_default_cipher_list(), ret->cert)
3094	\|\| sk_SSL_CIPHER_num(ret->cipher_list) <= `0`) {
3095	SSLerr(SSL_F_SSL_CTX_NEW, SSL_R_LIBRARY_HAS_NO_CIPHERS);
3096	goto err2;
3097	}
3098
3099	ret->param = X509_VERIFY_PARAM_new();
3100	if (ret->param == NULL)
3101	goto err;
3102
3103	if ((ret->md5 = EVP_get_digestbyname("ssl3-md5")) == NULL) {
3104	SSLerr(SSL_F_SSL_CTX_NEW, SSL_R_UNABLE_TO_LOAD_SSL3_MD5_ROUTINES);
3105	goto err2;
3106	}
3107	if ((ret->sha1 = EVP_get_digestbyname("ssl3-sha1")) == NULL) {
3108	SSLerr(SSL_F_SSL_CTX_NEW, SSL_R_UNABLE_TO_LOAD_SSL3_SHA1_ROUTINES);
3109	goto err2;
3110	}
3111
3112	if ((ret->ca_names = sk_X509_NAME_new_null()) == NULL)
3113	goto err;
3114
3115	if ((ret->client_ca_names = sk_X509_NAME_new_null()) == NULL)
3116	goto err;
3117
3118	if (!CRYPTO_new_ex_data(CRYPTO_EX_INDEX_SSL_CTX, ret, &ret->ex_data))
3119	goto err;
3120
3121	if ((ret->ext.secure = OPENSSL_secure_zalloc(sizeof(*ret->ext.secure))) == NULL)
3122	goto err;
3123
3124	/ No compression for DTLS /
3125	if (!(meth->ssl3_enc->enc_flags & SSL_ENC_FLAG_DTLS))
3126	ret->comp_methods = SSL_COMP_get_compression_methods();
3127
3128	ret->max_send_fragment = SSL3_RT_MAX_PLAIN_LENGTH;
3129	ret->split_send_fragment = SSL3_RT_MAX_PLAIN_LENGTH;
3130
3131	/ Setup RFC5077 ticket keys /
3132	if ((RAND_bytes(ret->ext.tick_key_name,
3133	sizeof(ret->ext.tick_key_name)) <= `0`)
3134	\|\| (RAND_priv_bytes(ret->ext.secure->tick_hmac_key,
3135	sizeof(ret->ext.secure->tick_hmac_key)) <= `0`)
3136	\|\| (RAND_priv_bytes(ret->ext.secure->tick_aes_key,
3137	sizeof(ret->ext.secure->tick_aes_key)) <= `0`))
3138	ret->options \|= SSL_OP_NO_TICKET;
3139
3140	if (RAND_priv_bytes(ret->ext.cookie_hmac_key,
3141	sizeof(ret->ext.cookie_hmac_key)) <= `0`)
3142	goto err;
3143
3144	#ifndef OPENSSL_NO_SRP
3145	if (!SSL_CTX_SRP_CTX_init(ret))
3146	goto err;
3147	#endif
3148	#ifndef OPENSSL_NO_ENGINE
3149	# ifdef OPENSSL_SSL_CLIENT_ENGINE_AUTO
3150	# define eng_strx(x) #x
3151	# define eng_str(x) eng_strx(x)
3152	/ Use specific client engine automatically... ignore errors /
3153	{
3154	ENGINE *eng;
3155	eng = ENGINE_by_id(eng_str(OPENSSL_SSL_CLIENT_ENGINE_AUTO));
3156	if (!eng) {
3157	ERR_clear_error();
3158	ENGINE_load_builtin_engines();
3159	eng = ENGINE_by_id(eng_str(OPENSSL_SSL_CLIENT_ENGINE_AUTO));
3160	}
3161	if (!eng \|\| !SSL_CTX_set_client_cert_engine(ret, eng))
3162	ERR_clear_error();
3163	}
3164	# endif
3165	#endif
3166	/*
3167	* Default is to connect to non-RI servers. When RI is more widely
3168	* deployed might change this.
3169	*/
3170	ret->options \|= SSL_OP_LEGACY_SERVER_CONNECT;
3171	/*
3172	* Disable compression by default to prevent CRIME. Applications can
3173	* re-enable compression by configuring
3174	* SSL_CTX_clear_options(ctx, SSL_OP_NO_COMPRESSION);
3175	* or by using the SSL_CONF library. Similarly we also enable TLSv1.3
3176	* middlebox compatibility by default. This may be disabled by default in
3177	* a later OpenSSL version.
3178	*/
3179	ret->options \|= SSL_OP_NO_COMPRESSION \| SSL_OP_ENABLE_MIDDLEBOX_COMPAT;
3180
3181	ret->ext.status_type = TLSEXT_STATUSTYPE_nothing;
3182
3183	/*
3184	* We cannot usefully set a default max_early_data here (which gets
3185	* propagated in SSL_new(), for the following reason: setting the
3186	* SSL field causes tls_construct_stoc_early_data() to tell the
3187	* client that early data will be accepted when constructing a TLS 1.3
3188	* session ticket, and the client will accordingly send us early data
3189	* when using that ticket (if the client has early data to send).
3190	* However, in order for the early data to actually be consumed by
3191	* the application, the application must also have calls to
3192	* SSL_read_early_data(); otherwise we'll just skip past the early data
3193	* and ignore it. So, since the application must add calls to
3194	* SSL_read_early_data(), we also require them to add
3195	* calls to SSL_CTX_set_max_early_data() in order to use early data,
3196	* eliminating the bandwidth-wasting early data in the case described
3197	* above.
3198	*/
3199	ret->max_early_data = `0`;
3200
3201	/*
3202	* Default recv_max_early_data is a fully loaded single record. Could be
3203	* split across multiple records in practice. We set this differently to
3204	* max_early_data so that, in the default case, we do not advertise any
3205	* support for early_data, but if a client were to send us some (e.g.
3206	* because of an old, stale ticket) then we will tolerate it and skip over
3207	* it.
3208	*/
3209	ret->recv_max_early_data = SSL3_RT_MAX_PLAIN_LENGTH;
3210
3211	/ By default we send two session tickets automatically in TLSv1.3 /
3212	ret->num_tickets = `2`;
3213
3214	ssl_ctx_system_config(ret);
3215
3216	return ret;
3217	err:
3218	SSLerr(SSL_F_SSL_CTX_NEW, ERR_R_MALLOC_FAILURE);
3219	err2:
3220	SSL_CTX_free(ret);
3221	return NULL;
3222	}
3223
3224	int SSL_CTX_up_ref(SSL_CTX *ctx)
3225	{
3226	int i;
3227
3228	if (CRYPTO_UP_REF(&ctx->references, &i, ctx->lock) <= `0`)
3229	return `0`;
3230
3231	REF_PRINT_COUNT("SSL_CTX", ctx);
3232	REF_ASSERT_ISNT(i < `2`);
3233	return ((i > `1`) ? `1` : `0`);
3234	}
3235
3236	void SSL_CTX_free(SSL_CTX *a)
3237	{
3238	int i;
3239
3240	if (a == NULL)
3241	return;
3242
3243	CRYPTO_DOWN_REF(&a->references, &i, a->lock);
3244	REF_PRINT_COUNT("SSL_CTX", a);
3245	if (i > `0`)
3246	return;
3247	REF_ASSERT_ISNT(i < `0`);
3248
3249	X509_VERIFY_PARAM_free(a->param);
3250	dane_ctx_final(&a->dane);
3251
3252	/*
3253	* Free internal session cache. However: the remove_cb() may reference
3254	* the ex_data of SSL_CTX, thus the ex_data store can only be removed
3255	* after the sessions were flushed.
3256	* As the ex_data handling routines might also touch the session cache,
3257	* the most secure solution seems to be: empty (flush) the cache, then
3258	* free ex_data, then finally free the cache.
3259	* (See ticket [openssl.org #212].)
3260	*/
3261	if (a->sessions != NULL)
3262	SSL_CTX_flush_sessions(a, `0`);
3263
3264	CRYPTO_free_ex_data(CRYPTO_EX_INDEX_SSL_CTX, a, &a->ex_data);
3265	lh_SSL_SESSION_free(a->sessions);
3266	X509_STORE_free(a->cert_store);
3267	#ifndef OPENSSL_NO_CT
3268	CTLOG_STORE_free(a->ctlog_store);
3269	#endif
3270	sk_SSL_CIPHER_free(a->cipher_list);
3271	sk_SSL_CIPHER_free(a->cipher_list_by_id);
3272	sk_SSL_CIPHER_free(a->tls13_ciphersuites);
3273	ssl_cert_free(a->cert);
3274	sk_X509_NAME_pop_free(a->ca_names, X509_NAME_free);
3275	sk_X509_NAME_pop_free(a->client_ca_names, X509_NAME_free);
3276	sk_X509_pop_free(a->extra_certs, X509_free);
3277	a->comp_methods = NULL;
3278	#ifndef OPENSSL_NO_SRTP
3279	sk_SRTP_PROTECTION_PROFILE_free(a->srtp_profiles);
3280	#endif
3281	#ifndef OPENSSL_NO_SRP
3282	SSL_CTX_SRP_CTX_free(a);
3283	#endif
3284	#ifndef OPENSSL_NO_ENGINE
3285	ENGINE_finish(a->client_cert_engine);
3286	#endif
3287
3288	#ifndef OPENSSL_NO_EC
3289	OPENSSL_free(a->ext.ecpointformats);
3290	#endif
3291	OPENSSL_free(a->ext.supportedgroups);
3292	OPENSSL_free(a->ext.alpn);
3293	OPENSSL_secure_free(a->ext.secure);
3294
3295	CRYPTO_THREAD_lock_free(a->lock);
3296
3297	OPENSSL_free(a);
3298	}
3299
3300	void SSL_CTX_set_default_passwd_cb(SSL_CTX ctx, pem_password_cb cb)
3301	{
3302	ctx->default_passwd_callback = cb;
3303	}
3304
3305	void SSL_CTX_set_default_passwd_cb_userdata(SSL_CTX ctx, void* *u)
3306	{
3307	ctx->default_passwd_callback_userdata = u;
3308	}
3309
3310	pem_password_cb SSL_CTX_get_default_passwd_cb(SSL_CTX ctx)
3311	{
3312	return ctx->default_passwd_callback;
3313	}
3314
3315	void SSL_CTX_get_default_passwd_cb_userdata(SSL_CTX ctx)
3316	{
3317	return ctx->default_passwd_callback_userdata;
3318	}
3319
3320	void SSL_set_default_passwd_cb(SSL s, pem_password_cb cb)
3321	{
3322	s->default_passwd_callback = cb;
3323	}
3324
3325	void SSL_set_default_passwd_cb_userdata(SSL s, void* *u)
3326	{
3327	s->default_passwd_callback_userdata = u;
3328	}
3329
3330	pem_password_cb SSL_get_default_passwd_cb(SSL s)
3331	{
3332	return s->default_passwd_callback;
3333	}
3334
3335	void SSL_get_default_passwd_cb_userdata(SSL s)
3336	{
3337	return s->default_passwd_callback_userdata;
3338	}
3339
3340	void SSL_CTX_set_cert_verify_callback(SSL_CTX *ctx,
3341	int (cb) (X509_STORE_CTX , void *),
3342	void *arg)
3343	{
3344	ctx->app_verify_callback = cb;
3345	ctx->app_verify_arg = arg;
3346	}
3347
3348	void SSL_CTX_set_verify(SSL_CTX ctx, int* mode,
3349	int (cb) (int, X509_STORE_CTX ))
3350	{
3351	ctx->verify_mode = mode;
3352	ctx->default_verify_callback = cb;
3353	}
3354
3355	void SSL_CTX_set_verify_depth(SSL_CTX ctx, int* depth)
3356	{
3357	X509_VERIFY_PARAM_set_depth(ctx->param, depth);
3358	}
3359
3360	void SSL_CTX_set_cert_cb(SSL_CTX c, int* (cb) (SSL ssl, void arg), void* *arg)
3361	{
3362	ssl_cert_set_cert_cb(c->cert, cb, arg);
3363	}
3364
3365	void SSL_set_cert_cb(SSL s, int* (cb) (SSL ssl, void arg), void* *arg)
3366	{
3367	ssl_cert_set_cert_cb(s->cert, cb, arg);
3368	}
3369
3370	void ssl_set_masks(SSL *s)
3371	{
3372	CERT *c = s->cert;
3373	uint32_t *pvalid = s->s3.tmp.valid_flags;
3374	int rsa_enc, rsa_sign, dh_tmp, dsa_sign;
3375	unsigned long mask_k, mask_a;
3376	#ifndef OPENSSL_NO_EC
3377	int have_ecc_cert, ecdsa_ok;
3378	#endif
3379	if (c == NULL)
3380	return;
3381
3382	#ifndef OPENSSL_NO_DH
3383	dh_tmp = (c->dh_tmp != NULL \|\| c->dh_tmp_cb != NULL \|\| c->dh_tmp_auto);
3384	#else
3385	dh_tmp = `0`;
3386	#endif
3387
3388	rsa_enc = pvalid[SSL_PKEY_RSA] & CERT_PKEY_VALID;
3389	rsa_sign = pvalid[SSL_PKEY_RSA] & CERT_PKEY_VALID;
3390	dsa_sign = pvalid[SSL_PKEY_DSA_SIGN] & CERT_PKEY_VALID;
3391	#ifndef OPENSSL_NO_EC
3392	have_ecc_cert = pvalid[SSL_PKEY_ECC] & CERT_PKEY_VALID;
3393	#endif
3394	mask_k = `0`;
3395	mask_a = `0`;
3396
3397	OSSL_TRACE4(TLS_CIPHER, "dh_tmp=%d rsa_enc=%d rsa_sign=%d dsa_sign=%d\n",
3398	dh_tmp, rsa_enc, rsa_sign, dsa_sign);
3399
3400	#ifndef OPENSSL_NO_GOST
3401	if (ssl_has_cert(s, SSL_PKEY_GOST12_512)) {
3402	mask_k \|= SSL_kGOST;
3403	mask_a \|= SSL_aGOST12;
3404	}
3405	if (ssl_has_cert(s, SSL_PKEY_GOST12_256)) {
3406	mask_k \|= SSL_kGOST;
3407	mask_a \|= SSL_aGOST12;
3408	}
3409	if (ssl_has_cert(s, SSL_PKEY_GOST01)) {
3410	mask_k \|= SSL_kGOST;
3411	mask_a \|= SSL_aGOST01;
3412	}
3413	#endif
3414
3415	if (rsa_enc)
3416	mask_k \|= SSL_kRSA;
3417
3418	if (dh_tmp)
3419	mask_k \|= SSL_kDHE;
3420
3421	/*
3422	* If we only have an RSA-PSS certificate allow RSA authentication
3423	* if TLS 1.2 and peer supports it.
3424	*/
3425
3426	if (rsa_enc \|\| rsa_sign \|\| (ssl_has_cert(s, SSL_PKEY_RSA_PSS_SIGN)
3427	&& pvalid[SSL_PKEY_RSA_PSS_SIGN] & CERT_PKEY_EXPLICIT_SIGN
3428	&& TLS1_get_version(s) == TLS1_2_VERSION))
3429	mask_a \|= SSL_aRSA;
3430
3431	if (dsa_sign) {
3432	mask_a \|= SSL_aDSS;
3433	}
3434
3435	mask_a \|= SSL_aNULL;
3436
3437	/*
3438	* An ECC certificate may be usable for ECDH and/or ECDSA cipher suites
3439	* depending on the key usage extension.
3440	*/
3441	#ifndef OPENSSL_NO_EC
3442	if (have_ecc_cert) {
3443	uint32_t ex_kusage;
3444	ex_kusage = X509_get_key_usage(c->pkeys[SSL_PKEY_ECC].x509);
3445	ecdsa_ok = ex_kusage & X509v3_KU_DIGITAL_SIGNATURE;
3446	if (!(pvalid[SSL_PKEY_ECC] & CERT_PKEY_SIGN))
3447	ecdsa_ok = `0`;
3448	if (ecdsa_ok)
3449	mask_a \|= SSL_aECDSA;
3450	}
3451	/ Allow Ed25519 for TLS 1.2 if peer supports it /
3452	if (!(mask_a & SSL_aECDSA) && ssl_has_cert(s, SSL_PKEY_ED25519)
3453	&& pvalid[SSL_PKEY_ED25519] & CERT_PKEY_EXPLICIT_SIGN
3454	&& TLS1_get_version(s) == TLS1_2_VERSION)
3455	mask_a \|= SSL_aECDSA;
3456
3457	/ Allow Ed448 for TLS 1.2 if peer supports it /
3458	if (!(mask_a & SSL_aECDSA) && ssl_has_cert(s, SSL_PKEY_ED448)
3459	&& pvalid[SSL_PKEY_ED448] & CERT_PKEY_EXPLICIT_SIGN
3460	&& TLS1_get_version(s) == TLS1_2_VERSION)
3461	mask_a \|= SSL_aECDSA;
3462	#endif
3463
3464	#ifndef OPENSSL_NO_EC
3465	mask_k \|= SSL_kECDHE;
3466	#endif
3467
3468	#ifndef OPENSSL_NO_PSK
3469	mask_k \|= SSL_kPSK;
3470	mask_a \|= SSL_aPSK;
3471	if (mask_k & SSL_kRSA)
3472	mask_k \|= SSL_kRSAPSK;
3473	if (mask_k & SSL_kDHE)
3474	mask_k \|= SSL_kDHEPSK;
3475	if (mask_k & SSL_kECDHE)
3476	mask_k \|= SSL_kECDHEPSK;
3477	#endif
3478
3479	s->s3.tmp.mask_k = mask_k;
3480	s->s3.tmp.mask_a = mask_a;
3481	}
3482
3483	#ifndef OPENSSL_NO_EC
3484
3485	int ssl_check_srvr_ecc_cert_and_alg(X509 x, SSL s)
3486	{
3487	if (s->s3.tmp.new_cipher->algorithm_auth & SSL_aECDSA) {
3488	/ key usage, if present, must allow signing /
3489	if (!(X509_get_key_usage(x) & X509v3_KU_DIGITAL_SIGNATURE)) {
3490	SSLerr(SSL_F_SSL_CHECK_SRVR_ECC_CERT_AND_ALG,
3491	SSL_R_ECC_CERT_NOT_FOR_SIGNING);
3492	return `0`;
3493	}
3494	}
3495	return `1`; / all checks are ok /
3496	}
3497
3498	#endif
3499
3500	int ssl_get_server_cert_serverinfo(SSL s, const* unsigned char **serverinfo,
3501	size_t *serverinfo_length)
3502	{
3503	CERT_PKEY *cpk = s->s3.tmp.cert;
3504	*serverinfo_length = `0`;
3505
3506	if (cpk == NULL \|\| cpk->serverinfo == NULL)
3507	return `0`;
3508
3509	*serverinfo = cpk->serverinfo;
3510	*serverinfo_length = cpk->serverinfo_length;
3511	return `1`;
3512	}
3513
3514	void ssl_update_cache(SSL s, int* mode)
3515	{
3516	int i;
3517
3518	/*
3519	* If the session_id_length is 0, we are not supposed to cache it, and it
3520	* would be rather hard to do anyway :-)
3521	*/
3522	if (s->session->session_id_length == `0`)
3523	return;
3524
3525	/*
3526	* If sid_ctx_length is 0 there is no specific application context
3527	* associated with this session, so when we try to resume it and
3528	* SSL_VERIFY_PEER is requested to verify the client identity, we have no
3529	* indication that this is actually a session for the proper application
3530	* context, and the handshake will fail, not just the resumption attempt.
3531	* Do not cache (on the server) these sessions that are not resumable
3532	* (clients can set SSL_VERIFY_PEER without needing a sid_ctx set).
3533	*/
3534	if (s->server && s->session->sid_ctx_length == `0`
3535	&& (s->verify_mode & SSL_VERIFY_PEER) != `0`)
3536	return;
3537
3538	i = s->session_ctx->session_cache_mode;
3539	if ((i & mode) != `0`
3540	&& (!s->hit \|\| SSL_IS_TLS13(s))) {
3541	/*
3542	* Add the session to the internal cache. In server side TLSv1.3 we
3543	* normally don't do this because by default it's a full stateless ticket
3544	* with only a dummy session id so there is no reason to cache it,
3545	* unless:
3546	* - we are doing early_data, in which case we cache so that we can
3547	* detect replays
3548	* - the application has set a remove_session_cb so needs to know about
3549	* session timeout events
3550	* - SSL_OP_NO_TICKET is set in which case it is a stateful ticket
3551	*/
3552	if ((i & SSL_SESS_CACHE_NO_INTERNAL_STORE) == `0`
3553	&& (!SSL_IS_TLS13(s)
3554	\|\| !s->server
3555	\|\| (s->max_early_data > `0`
3556	&& (s->options & SSL_OP_NO_ANTI_REPLAY) == `0`)
3557	\|\| s->session_ctx->remove_session_cb != NULL
3558	\|\| (s->options & SSL_OP_NO_TICKET) != `0`))
3559	SSL_CTX_add_session(s->session_ctx, s->session);
3560
3561	/*
3562	* Add the session to the external cache. We do this even in server side
3563	* TLSv1.3 without early data because some applications just want to
3564	* know about the creation of a session and aren't doing a full cache.
3565	*/
3566	if (s->session_ctx->new_session_cb != NULL) {
3567	SSL_SESSION_up_ref(s->session);
3568	if (!s->session_ctx->new_session_cb(s, s->session))
3569	SSL_SESSION_free(s->session);
3570	}
3571	}
3572
3573	/ auto flush every 255 connections /
3574	if ((!(i & SSL_SESS_CACHE_NO_AUTO_CLEAR)) && ((i & mode) == mode)) {
3575	TSAN_QUALIFIER int *stat;
3576	if (mode & SSL_SESS_CACHE_CLIENT)
3577	stat = &s->session_ctx->stats.sess_connect_good;
3578	else
3579	stat = &s->session_ctx->stats.sess_accept_good;
3580	if ((tsan_load(stat) & `0xff`) == `0xff`)
3581	SSL_CTX_flush_sessions(s->session_ctx, (unsigned long)time(NULL));
3582	}
3583	}
3584
3585	const SSL_METHOD SSL_CTX_get_ssl_method(const* SSL_CTX *ctx)
3586	{
3587	return ctx->method;
3588	}
3589
3590	const SSL_METHOD SSL_get_ssl_method(const* SSL *s)
3591	{
3592	return s->method;
3593	}
3594
3595	int SSL_set_ssl_method(SSL s, const* SSL_METHOD *meth)
3596	{
3597	int ret = `1`;
3598
3599	if (s->method != meth) {
3600	const SSL_METHOD *sm = s->method;
3601	int (hf) (SSL ) = s->handshake_func;
3602
3603	if (sm->version == meth->version)
3604	s->method = meth;
3605	else {
3606	sm->ssl_free(s);
3607	s->method = meth;
3608	ret = s->method->ssl_new(s);
3609	}
3610
3611	if (hf == sm->ssl_connect)
3612	s->handshake_func = meth->ssl_connect;
3613	else if (hf == sm->ssl_accept)
3614	s->handshake_func = meth->ssl_accept;
3615	}
3616	return ret;
3617	}
3618
3619	int SSL_get_error(const SSL s, int* i)
3620	{
3621	int reason;
3622	unsigned long l;
3623	BIO *bio;
3624
3625	if (i > `0`)
3626	return SSL_ERROR_NONE;
3627
3628	/*
3629	* Make things return SSL_ERROR_SYSCALL when doing SSL_do_handshake etc,
3630	* where we do encode the error
3631	*/
3632	if ((l = ERR_peek_error()) != `0`) {
3633	if (ERR_GET_LIB(l) == ERR_LIB_SYS)
3634	return SSL_ERROR_SYSCALL;
3635	else
3636	return SSL_ERROR_SSL;
3637	}
3638
3639	if (SSL_want_read(s)) {
3640	bio = SSL_get_rbio(s);
3641	if (BIO_should_read(bio))
3642	return SSL_ERROR_WANT_READ;
3643	else if (BIO_should_write(bio))
3644	/*
3645	* This one doesn't make too much sense ... We never try to write
3646	* to the rbio, and an application program where rbio and wbio
3647	* are separate couldn't even know what it should wait for.
3648	* However if we ever set s->rwstate incorrectly (so that we have
3649	* SSL_want_read(s) instead of SSL_want_write(s)) and rbio and
3650	* wbio are the same, this test works around that bug; so it
3651	* might be safer to keep it.
3652	*/
3653	return SSL_ERROR_WANT_WRITE;
3654	else if (BIO_should_io_special(bio)) {
3655	reason = BIO_get_retry_reason(bio);
3656	if (reason == BIO_RR_CONNECT)
3657	return SSL_ERROR_WANT_CONNECT;
3658	else if (reason == BIO_RR_ACCEPT)
3659	return SSL_ERROR_WANT_ACCEPT;
3660	else
3661	return SSL_ERROR_SYSCALL; / unknown /
3662	}
3663	}
3664
3665	if (SSL_want_write(s)) {
3666	/ Access wbio directly - in order to use the buffered bio if present /
3667	bio = s->wbio;
3668	if (BIO_should_write(bio))
3669	return SSL_ERROR_WANT_WRITE;
3670	else if (BIO_should_read(bio))
3671	/*
3672	* See above (SSL_want_read(s) with BIO_should_write(bio))
3673	*/
3674	return SSL_ERROR_WANT_READ;
3675	else if (BIO_should_io_special(bio)) {
3676	reason = BIO_get_retry_reason(bio);
3677	if (reason == BIO_RR_CONNECT)
3678	return SSL_ERROR_WANT_CONNECT;
3679	else if (reason == BIO_RR_ACCEPT)
3680	return SSL_ERROR_WANT_ACCEPT;
3681	else
3682	return SSL_ERROR_SYSCALL;
3683	}
3684	}
3685	if (SSL_want_x509_lookup(s))
3686	return SSL_ERROR_WANT_X509_LOOKUP;
3687	if (SSL_want_async(s))
3688	return SSL_ERROR_WANT_ASYNC;
3689	if (SSL_want_async_job(s))
3690	return SSL_ERROR_WANT_ASYNC_JOB;
3691	if (SSL_want_client_hello_cb(s))
3692	return SSL_ERROR_WANT_CLIENT_HELLO_CB;
3693
3694	if ((s->shutdown & SSL_RECEIVED_SHUTDOWN) &&
3695	(s->s3.warn_alert == SSL_AD_CLOSE_NOTIFY))
3696	return SSL_ERROR_ZERO_RETURN;
3697
3698	return SSL_ERROR_SYSCALL;
3699	}
3700
3701	static int ssl_do_handshake_intern(void *vargs)
3702	{
3703	struct ssl_async_args *args;
3704	SSL *s;
3705
3706	args = (struct ssl_async_args *)vargs;
3707	s = args->s;
3708
3709	return s->handshake_func(s);
3710	}
3711
3712	int SSL_do_handshake(SSL *s)
3713	{
3714	int ret = `1`;
3715
3716	if (s->handshake_func == NULL) {
3717	SSLerr(SSL_F_SSL_DO_HANDSHAKE, SSL_R_CONNECTION_TYPE_NOT_SET);
3718	return -`1`;
3719	}
3720
3721	ossl_statem_check_finish_init(s, -`1`);
3722
3723	s->method->ssl_renegotiate_check(s, `0`);
3724
3725	if (SSL_in_init(s) \|\| SSL_in_before(s)) {
3726	if ((s->mode & SSL_MODE_ASYNC) && ASYNC_get_current_job() == NULL) {
3727	struct ssl_async_args args;
3728
3729	args.s = s;
3730
3731	ret = ssl_start_async_job(s, &args, ssl_do_handshake_intern);
3732	} else {
3733	ret = s->handshake_func(s);
3734	}
3735	}
3736	return ret;
3737	}
3738
3739	void SSL_set_accept_state(SSL *s)
3740	{
3741	s->server = `1`;
3742	s->shutdown = `0`;
3743	ossl_statem_clear(s);
3744	s->handshake_func = s->method->ssl_accept;
3745	clear_ciphers(s);
3746	}
3747
3748	void SSL_set_connect_state(SSL *s)
3749	{
3750	s->server = `0`;
3751	s->shutdown = `0`;
3752	ossl_statem_clear(s);
3753	s->handshake_func = s->method->ssl_connect;
3754	clear_ciphers(s);
3755	}
3756
3757	int ssl_undefined_function(SSL *s)
3758	{
3759	SSLerr(SSL_F_SSL_UNDEFINED_FUNCTION, ERR_R_SHOULD_NOT_HAVE_BEEN_CALLED);
3760	return `0`;
3761	}
3762
3763	int ssl_undefined_void_function(void)
3764	{
3765	SSLerr(SSL_F_SSL_UNDEFINED_VOID_FUNCTION,
3766	ERR_R_SHOULD_NOT_HAVE_BEEN_CALLED);
3767	return `0`;
3768	}
3769
3770	int ssl_undefined_const_function(const SSL *s)
3771	{
3772	return `0`;
3773	}
3774
3775	const SSL_METHOD ssl_bad_method(int* ver)
3776	{
3777	SSLerr(SSL_F_SSL_BAD_METHOD, ERR_R_SHOULD_NOT_HAVE_BEEN_CALLED);
3778	return NULL;
3779	}
3780
3781	const char ssl_protocol_to_string(int* version)
3782	{
3783	switch(version)
3784	{
3785	case TLS1_3_VERSION:
3786	return "TLSv1.3";
3787
3788	case TLS1_2_VERSION:
3789	return "TLSv1.2";
3790
3791	case TLS1_1_VERSION:
3792	return "TLSv1.1";
3793
3794	case TLS1_VERSION:
3795	return "TLSv1";
3796
3797	case SSL3_VERSION:
3798	return "SSLv3";
3799
3800	case DTLS1_BAD_VER:
3801	return "DTLSv0.9";
3802
3803	case DTLS1_VERSION:
3804	return "DTLSv1";
3805
3806	case DTLS1_2_VERSION:
3807	return "DTLSv1.2";
3808
3809	default:
3810	return "unknown";
3811	}
3812	}
3813
3814	const char SSL_get_version(const* SSL *s)
3815	{
3816	return ssl_protocol_to_string(s->version);
3817	}
3818
3819	static int dup_ca_names(STACK_OF(X509_NAME) *dst, STACK_OF(X509_NAME) src)
3820	{
3821	STACK_OF(X509_NAME) *sk;
3822	X509_NAME *xn;
3823	int i;
3824
3825	if (src == NULL) {
3826	*dst = NULL;
3827	return `1`;
3828	}
3829
3830	if ((sk = sk_X509_NAME_new_null()) == NULL)
3831	return `0`;
3832	for (i = `0`; i < sk_X509_NAME_num(src); i++) {
3833	xn = X509_NAME_dup(sk_X509_NAME_value(src, i));
3834	if (xn == NULL) {
3835	sk_X509_NAME_pop_free(sk, X509_NAME_free);
3836	return `0`;
3837	}
3838	if (sk_X509_NAME_insert(sk, xn, i) == `0`) {
3839	X509_NAME_free(xn);
3840	sk_X509_NAME_pop_free(sk, X509_NAME_free);
3841	return `0`;
3842	}
3843	}
3844	*dst = sk;
3845
3846	return `1`;
3847	}
3848
3849	SSL SSL_dup(SSL s)
3850	{
3851	SSL *ret;
3852	int i;
3853
3854	/ If we're not quiescent, just up_ref! /
3855	if (!SSL_in_init(s) \|\| !SSL_in_before(s)) {
3856	CRYPTO_UP_REF(&s->references, &i, s->lock);
3857	return s;
3858	}
3859
3860	/*
3861	* Otherwise, copy configuration state, and session if set.
3862	*/
3863	if ((ret = SSL_new(SSL_get_SSL_CTX(s))) == NULL)
3864	return NULL;
3865
3866	if (s->session != NULL) {
3867	/*
3868	* Arranges to share the same session via up_ref. This "copies"
3869	* session-id, SSL_METHOD, sid_ctx, and 'cert'
3870	*/
3871	if (!SSL_copy_session_id(ret, s))
3872	goto err;
3873	} else {
3874	/*
3875	* No session has been established yet, so we have to expect that
3876	* s->cert or ret->cert will be changed later -- they should not both
3877	* point to the same object, and thus we can't use
3878	* SSL_copy_session_id.
3879	*/
3880	if (!SSL_set_ssl_method(ret, s->method))
3881	goto err;
3882
3883	if (s->cert != NULL) {
3884	ssl_cert_free(ret->cert);
3885	ret->cert = ssl_cert_dup(s->cert);
3886	if (ret->cert == NULL)
3887	goto err;
3888	}
3889
3890	if (!SSL_set_session_id_context(ret, s->sid_ctx,
3891	(int)s->sid_ctx_length))
3892	goto err;
3893	}
3894
3895	if (!ssl_dane_dup(ret, s))
3896	goto err;
3897	ret->version = s->version;
3898	ret->options = s->options;
3899	ret->mode = s->mode;
3900	SSL_set_max_cert_list(ret, SSL_get_max_cert_list(s));
3901	SSL_set_read_ahead(ret, SSL_get_read_ahead(s));
3902	ret->msg_callback = s->msg_callback;
3903	ret->msg_callback_arg = s->msg_callback_arg;
3904	SSL_set_verify(ret, SSL_get_verify_mode(s), SSL_get_verify_callback(s));
3905	SSL_set_verify_depth(ret, SSL_get_verify_depth(s));
3906	ret->generate_session_id = s->generate_session_id;
3907
3908	SSL_set_info_callback(ret, SSL_get_info_callback(s));
3909
3910	/ copy app data, a little dangerous perhaps /
3911	if (!CRYPTO_dup_ex_data(CRYPTO_EX_INDEX_SSL, &ret->ex_data, &s->ex_data))
3912	goto err;
3913
3914	/ setup rbio, and wbio /
3915	if (s->rbio != NULL) {
3916	if (!BIO_dup_state(s->rbio, (char *)&ret->rbio))
3917	goto err;
3918	}
3919	if (s->wbio != NULL) {
3920	if (s->wbio != s->rbio) {
3921	if (!BIO_dup_state(s->wbio, (char *)&ret->wbio))
3922	goto err;
3923	} else {
3924	BIO_up_ref(ret->rbio);
3925	ret->wbio = ret->rbio;
3926	}
3927	}
3928
3929	ret->server = s->server;
3930	if (s->handshake_func) {
3931	if (s->server)
3932	SSL_set_accept_state(ret);
3933	else
3934	SSL_set_connect_state(ret);
3935	}
3936	ret->shutdown = s->shutdown;
3937	ret->hit = s->hit;
3938
3939	ret->default_passwd_callback = s->default_passwd_callback;
3940	ret->default_passwd_callback_userdata = s->default_passwd_callback_userdata;
3941
3942	X509_VERIFY_PARAM_inherit(ret->param, s->param);
3943
3944	/ dup the cipher_list and cipher_list_by_id stacks /
3945	if (s->cipher_list != NULL) {
3946	if ((ret->cipher_list = sk_SSL_CIPHER_dup(s->cipher_list)) == NULL)
3947	goto err;
3948	}
3949	if (s->cipher_list_by_id != NULL)
3950	if ((ret->cipher_list_by_id = sk_SSL_CIPHER_dup(s->cipher_list_by_id))
3951	== NULL)
3952	goto err;
3953
3954	/ Dup the client_CA list /
3955	if (!dup_ca_names(&ret->ca_names, s->ca_names)
3956	\|\| !dup_ca_names(&ret->client_ca_names, s->client_ca_names))
3957	goto err;
3958
3959	return ret;
3960
3961	err:
3962	SSL_free(ret);
3963	return NULL;
3964	}
3965
3966	void ssl_clear_cipher_ctx(SSL *s)
3967	{
3968	if (s->enc_read_ctx != NULL) {
3969	EVP_CIPHER_CTX_free(s->enc_read_ctx);
3970	s->enc_read_ctx = NULL;
3971	}
3972	if (s->enc_write_ctx != NULL) {
3973	EVP_CIPHER_CTX_free(s->enc_write_ctx);
3974	s->enc_write_ctx = NULL;
3975	}
3976	#ifndef OPENSSL_NO_COMP
3977	COMP_CTX_free(s->expand);
3978	s->expand = NULL;
3979	COMP_CTX_free(s->compress);
3980	s->compress = NULL;
3981	#endif
3982	}
3983
3984	X509 SSL_get_certificate(const* SSL *s)
3985	{
3986	if (s->cert != NULL)
3987	return s->cert->key->x509;
3988	else
3989	return NULL;
3990	}
3991
3992	EVP_PKEY SSL_get_privatekey(const* SSL *s)
3993	{
3994	if (s->cert != NULL)
3995	return s->cert->key->privatekey;
3996	else
3997	return NULL;
3998	}
3999
4000	X509 SSL_CTX_get0_certificate(const* SSL_CTX *ctx)
4001	{
4002	if (ctx->cert != NULL)
4003	return ctx->cert->key->x509;
4004	else
4005	return NULL;
4006	}
4007
4008	EVP_PKEY SSL_CTX_get0_privatekey(const* SSL_CTX *ctx)
4009	{
4010	if (ctx->cert != NULL)
4011	return ctx->cert->key->privatekey;
4012	else
4013	return NULL;
4014	}
4015
4016	const SSL_CIPHER SSL_get_current_cipher(const* SSL *s)
4017	{
4018	if ((s->session != NULL) && (s->session->cipher != NULL))
4019	return s->session->cipher;
4020	return NULL;
4021	}
4022
4023	const SSL_CIPHER SSL_get_pending_cipher(const* SSL *s)
4024	{
4025	return s->s3.tmp.new_cipher;
4026	}
4027
4028	const COMP_METHOD SSL_get_current_compression(const* SSL *s)
4029	{
4030	#ifndef OPENSSL_NO_COMP
4031	return s->compress ? COMP_CTX_get_method(s->compress) : NULL;
4032	#else
4033	return NULL;
4034	#endif
4035	}
4036
4037	const COMP_METHOD SSL_get_current_expansion(const* SSL *s)
4038	{
4039	#ifndef OPENSSL_NO_COMP
4040	return s->expand ? COMP_CTX_get_method(s->expand) : NULL;
4041	#else
4042	return NULL;
4043	#endif
4044	}
4045
4046	int ssl_init_wbio_buffer(SSL *s)
4047	{
4048	BIO *bbio;
4049
4050	if (s->bbio != NULL) {
4051	/ Already buffered. /
4052	return `1`;
4053	}
4054
4055	bbio = BIO_new(BIO_f_buffer());
4056	if (bbio == NULL \|\| !BIO_set_read_buffer_size(bbio, `1`)) {
4057	BIO_free(bbio);
4058	SSLerr(SSL_F_SSL_INIT_WBIO_BUFFER, ERR_R_BUF_LIB);
4059	return `0`;
4060	}
4061	s->bbio = bbio;
4062	s->wbio = BIO_push(bbio, s->wbio);
4063
4064	return `1`;
4065	}
4066
4067	int ssl_free_wbio_buffer(SSL *s)
4068	{
4069	/ callers ensure s is never null /
4070	if (s->bbio == NULL)
4071	return `1`;
4072
4073	s->wbio = BIO_pop(s->wbio);
4074	BIO_free(s->bbio);
4075	s->bbio = NULL;
4076
4077	return `1`;
4078	}
4079
4080	void SSL_CTX_set_quiet_shutdown(SSL_CTX ctx, int* mode)
4081	{
4082	ctx->quiet_shutdown = mode;
4083	}
4084
4085	int SSL_CTX_get_quiet_shutdown(const SSL_CTX *ctx)
4086	{
4087	return ctx->quiet_shutdown;
4088	}
4089
4090	void SSL_set_quiet_shutdown(SSL s, int* mode)
4091	{
4092	s->quiet_shutdown = mode;
4093	}
4094
4095	int SSL_get_quiet_shutdown(const SSL *s)
4096	{
4097	return s->quiet_shutdown;
4098	}
4099
4100	void SSL_set_shutdown(SSL s, int* mode)
4101	{
4102	s->shutdown = mode;
4103	}
4104
4105	int SSL_get_shutdown(const SSL *s)
4106	{
4107	return s->shutdown;
4108	}
4109
4110	int SSL_version(const SSL *s)
4111	{
4112	return s->version;
4113	}
4114
4115	int SSL_client_version(const SSL *s)
4116	{
4117	return s->client_version;
4118	}
4119
4120	SSL_CTX SSL_get_SSL_CTX(const* SSL *ssl)
4121	{
4122	return ssl->ctx;
4123	}
4124
4125	SSL_CTX SSL_set_SSL_CTX(SSL ssl, SSL_CTX *ctx)
4126	{
4127	CERT *new_cert;
4128	if (ssl->ctx == ctx)
4129	return ssl->ctx;
4130	if (ctx == NULL)
4131	ctx = ssl->session_ctx;
4132	new_cert = ssl_cert_dup(ctx->cert);
4133	if (new_cert == NULL) {
4134	return NULL;
4135	}
4136
4137	if (!custom_exts_copy_flags(&new_cert->custext, &ssl->cert->custext)) {
4138	ssl_cert_free(new_cert);
4139	return NULL;
4140	}
4141
4142	ssl_cert_free(ssl->cert);
4143	ssl->cert = new_cert;
4144
4145	/*
4146	* Program invariant: \|sid_ctx\| has fixed size (SSL_MAX_SID_CTX_LENGTH),
4147	* so setter APIs must prevent invalid lengths from entering the system.
4148	*/
4149	if (!ossl_assert(ssl->sid_ctx_length <= sizeof(ssl->sid_ctx)))
4150	return NULL;
4151
4152	/*
4153	* If the session ID context matches that of the parent SSL_CTX,
4154	* inherit it from the new SSL_CTX as well. If however the context does
4155	* not match (i.e., it was set per-ssl with SSL_set_session_id_context),
4156	* leave it unchanged.
4157	*/
4158	if ((ssl->ctx != NULL) &&
4159	(ssl->sid_ctx_length == ssl->ctx->sid_ctx_length) &&
4160	(memcmp(ssl->sid_ctx, ssl->ctx->sid_ctx, ssl->sid_ctx_length) == `0`)) {
4161	ssl->sid_ctx_length = ctx->sid_ctx_length;
4162	memcpy(&ssl->sid_ctx, &ctx->sid_ctx, sizeof(ssl->sid_ctx));
4163	}
4164
4165	SSL_CTX_up_ref(ctx);
4166	SSL_CTX_free(ssl->ctx); / decrement reference count /
4167	ssl->ctx = ctx;
4168
4169	return ssl->ctx;
4170	}
4171
4172	int SSL_CTX_set_default_verify_paths(SSL_CTX *ctx)
4173	{
4174	return X509_STORE_set_default_paths(ctx->cert_store);
4175	}
4176
4177	int SSL_CTX_set_default_verify_dir(SSL_CTX *ctx)
4178	{
4179	X509_LOOKUP *lookup;
4180
4181	lookup = X509_STORE_add_lookup(ctx->cert_store, X509_LOOKUP_hash_dir());
4182	if (lookup == NULL)
4183	return `0`;
4184
4185	/ We ignore errors, in case the directory doesn't exist /
4186	ERR_set_mark();
4187
4188	X509_LOOKUP_add_dir(lookup, NULL, X509_FILETYPE_DEFAULT);
4189
4190	ERR_pop_to_mark();
4191
4192	return `1`;
4193	}
4194
4195	int SSL_CTX_set_default_verify_file(SSL_CTX *ctx)
4196	{
4197	X509_LOOKUP *lookup;
4198
4199	lookup = X509_STORE_add_lookup(ctx->cert_store, X509_LOOKUP_file());
4200	if (lookup == NULL)
4201	return `0`;
4202
4203	/ We ignore errors, in case the directory doesn't exist /
4204	ERR_set_mark();
4205
4206	X509_LOOKUP_load_file(lookup, NULL, X509_FILETYPE_DEFAULT);
4207
4208	ERR_pop_to_mark();
4209
4210	return `1`;
4211	}
4212
4213	int SSL_CTX_set_default_verify_store(SSL_CTX *ctx)
4214	{
4215	X509_LOOKUP *lookup;
4216
4217	lookup = X509_STORE_add_lookup(ctx->cert_store, X509_LOOKUP_store());
4218	if (lookup == NULL)
4219	return `0`;
4220
4221	/ We ignore errors, in case the directory doesn't exist /
4222	ERR_set_mark();
4223
4224	X509_LOOKUP_add_store(lookup, NULL);
4225
4226	ERR_pop_to_mark();
4227
4228	return `1`;
4229	}
4230
4231	int SSL_CTX_load_verify_file(SSL_CTX ctx, const* char *CAfile)
4232	{
4233	return X509_STORE_load_file(ctx->cert_store, CAfile);
4234	}
4235
4236	int SSL_CTX_load_verify_dir(SSL_CTX ctx, const* char *CApath)
4237	{
4238	return X509_STORE_load_path(ctx->cert_store, CApath);
4239	}
4240
4241	int SSL_CTX_load_verify_store(SSL_CTX ctx, const* char *CAstore)
4242	{
4243	return X509_STORE_load_store(ctx->cert_store, CAstore);
4244	}
4245
4246	#ifndef OPENSSL_NO_DEPRECATED_3_0
4247	int SSL_CTX_load_verify_locations(SSL_CTX ctx, const* char *CAfile,
4248	const char *CApath)
4249	{
4250	if (CAfile == NULL && CApath == NULL)
4251	return `0`;
4252	if (CAfile != NULL && !SSL_CTX_load_verify_file(ctx, CAfile))
4253	return `0`;
4254	if (CApath != NULL && !SSL_CTX_load_verify_dir(ctx, CApath))
4255	return `0`;
4256	return `1`;
4257	}
4258	#endif
4259
4260	void SSL_set_info_callback(SSL *ssl,
4261	void (cb) (const* SSL ssl, int* type, int val))
4262	{
4263	ssl->info_callback = cb;
4264	}
4265
4266	/*
4267	* One compiler (Diab DCC) doesn't like argument names in returned function
4268	* pointer.
4269	*/
4270	void (SSL_get_info_callback(const* SSL ssl)) (const* SSL * / ssl / ,
4271	int / type / ,
4272	int / val / ) {
4273	return ssl->info_callback;
4274	}
4275
4276	void SSL_set_verify_result(SSL ssl, long* arg)
4277	{
4278	ssl->verify_result = arg;
4279	}
4280
4281	long SSL_get_verify_result(const SSL *ssl)
4282	{
4283	return ssl->verify_result;
4284	}
4285
4286	size_t SSL_get_client_random(const SSL ssl, unsigned* char *out, size_t outlen)
4287	{
4288	if (outlen == `0`)
4289	return sizeof(ssl->s3.client_random);
4290	if (outlen > sizeof(ssl->s3.client_random))
4291	outlen = sizeof(ssl->s3.client_random);
4292	memcpy(out, ssl->s3.client_random, outlen);
4293	return outlen;
4294	}
4295
4296	size_t SSL_get_server_random(const SSL ssl, unsigned* char *out, size_t outlen)
4297	{
4298	if (outlen == `0`)
4299	return sizeof(ssl->s3.server_random);
4300	if (outlen > sizeof(ssl->s3.server_random))
4301	outlen = sizeof(ssl->s3.server_random);
4302	memcpy(out, ssl->s3.server_random, outlen);
4303	return outlen;
4304	}
4305
4306	size_t SSL_SESSION_get_master_key(const SSL_SESSION *session,
4307	unsigned char *out, size_t outlen)
4308	{
4309	if (outlen == `0`)
4310	return session->master_key_length;
4311	if (outlen > session->master_key_length)
4312	outlen = session->master_key_length;
4313	memcpy(out, session->master_key, outlen);
4314	return outlen;
4315	}
4316
4317	int SSL_SESSION_set1_master_key(SSL_SESSION sess, const* unsigned char *in,
4318	size_t len)
4319	{
4320	if (len > sizeof(sess->master_key))
4321	return `0`;
4322
4323	memcpy(sess->master_key, in, len);
4324	sess->master_key_length = len;
4325	return `1`;
4326	}
4327
4328
4329	int SSL_set_ex_data(SSL s, int* idx, void *arg)
4330	{
4331	return CRYPTO_set_ex_data(&s->ex_data, idx, arg);
4332	}
4333
4334	void SSL_get_ex_data(const* SSL s, int* idx)
4335	{
4336	return CRYPTO_get_ex_data(&s->ex_data, idx);
4337	}
4338
4339	int SSL_CTX_set_ex_data(SSL_CTX s, int* idx, void *arg)
4340	{
4341	return CRYPTO_set_ex_data(&s->ex_data, idx, arg);
4342	}
4343
4344	void SSL_CTX_get_ex_data(const* SSL_CTX s, int* idx)
4345	{
4346	return CRYPTO_get_ex_data(&s->ex_data, idx);
4347	}
4348
4349	X509_STORE SSL_CTX_get_cert_store(const* SSL_CTX *ctx)
4350	{
4351	return ctx->cert_store;
4352	}
4353
4354	void SSL_CTX_set_cert_store(SSL_CTX ctx, X509_STORE store)
4355	{
4356	X509_STORE_free(ctx->cert_store);
4357	ctx->cert_store = store;
4358	}
4359
4360	void SSL_CTX_set1_cert_store(SSL_CTX ctx, X509_STORE store)
4361	{
4362	if (store != NULL)
4363	X509_STORE_up_ref(store);
4364	SSL_CTX_set_cert_store(ctx, store);
4365	}
4366
4367	int SSL_want(const SSL *s)
4368	{
4369	return s->rwstate;
4370	}
4371
4372	/**
4373	* \brief Set the callback for generating temporary DH keys.
4374	* \param ctx the SSL context.
4375	* \param dh the callback
4376	*/
4377
4378	#ifndef OPENSSL_NO_DH
4379	void SSL_CTX_set_tmp_dh_callback(SSL_CTX *ctx,
4380	DH (dh) (SSL ssl, int* is_export,
4381	int keylength))
4382	{
4383	SSL_CTX_callback_ctrl(ctx, SSL_CTRL_SET_TMP_DH_CB, (void ()(void*))dh);
4384	}
4385
4386	void SSL_set_tmp_dh_callback(SSL ssl, DH (dh) (SSL ssl, int is_export,
4387	int keylength))
4388	{
4389	SSL_callback_ctrl(ssl, SSL_CTRL_SET_TMP_DH_CB, (void ()(void*))dh);
4390	}
4391	#endif
4392
4393	#ifndef OPENSSL_NO_PSK
4394	int SSL_CTX_use_psk_identity_hint(SSL_CTX ctx, const* char *identity_hint)
4395	{
4396	if (identity_hint != NULL && strlen(identity_hint) > PSK_MAX_IDENTITY_LEN) {
4397	SSLerr(SSL_F_SSL_CTX_USE_PSK_IDENTITY_HINT, SSL_R_DATA_LENGTH_TOO_LONG);
4398	return `0`;
4399	}
4400	OPENSSL_free(ctx->cert->psk_identity_hint);
4401	if (identity_hint != NULL) {
4402	ctx->cert->psk_identity_hint = OPENSSL_strdup(identity_hint);
4403	if (ctx->cert->psk_identity_hint == NULL)
4404	return `0`;
4405	} else
4406	ctx->cert->psk_identity_hint = NULL;
4407	return `1`;
4408	}
4409
4410	int SSL_use_psk_identity_hint(SSL s, const* char *identity_hint)
4411	{
4412	if (s == NULL)
4413	return `0`;
4414
4415	if (identity_hint != NULL && strlen(identity_hint) > PSK_MAX_IDENTITY_LEN) {
4416	SSLerr(SSL_F_SSL_USE_PSK_IDENTITY_HINT, SSL_R_DATA_LENGTH_TOO_LONG);
4417	return `0`;
4418	}
4419	OPENSSL_free(s->cert->psk_identity_hint);
4420	if (identity_hint != NULL) {
4421	s->cert->psk_identity_hint = OPENSSL_strdup(identity_hint);
4422	if (s->cert->psk_identity_hint == NULL)
4423	return `0`;
4424	} else
4425	s->cert->psk_identity_hint = NULL;
4426	return `1`;
4427	}
4428
4429	const char SSL_get_psk_identity_hint(const* SSL *s)
4430	{
4431	if (s == NULL \|\| s->session == NULL)
4432	return NULL;
4433	return s->session->psk_identity_hint;
4434	}
4435
4436	const char SSL_get_psk_identity(const* SSL *s)
4437	{
4438	if (s == NULL \|\| s->session == NULL)
4439	return NULL;
4440	return s->session->psk_identity;
4441	}
4442
4443	void SSL_set_psk_client_callback(SSL *s, SSL_psk_client_cb_func cb)
4444	{
4445	s->psk_client_callback = cb;
4446	}
4447
4448	void SSL_CTX_set_psk_client_callback(SSL_CTX *ctx, SSL_psk_client_cb_func cb)
4449	{
4450	ctx->psk_client_callback = cb;
4451	}
4452
4453	void SSL_set_psk_server_callback(SSL *s, SSL_psk_server_cb_func cb)
4454	{
4455	s->psk_server_callback = cb;
4456	}
4457
4458	void SSL_CTX_set_psk_server_callback(SSL_CTX *ctx, SSL_psk_server_cb_func cb)
4459	{
4460	ctx->psk_server_callback = cb;
4461	}
4462	#endif
4463
4464	void SSL_set_psk_find_session_callback(SSL *s, SSL_psk_find_session_cb_func cb)
4465	{
4466	s->psk_find_session_cb = cb;
4467	}
4468
4469	void SSL_CTX_set_psk_find_session_callback(SSL_CTX *ctx,
4470	SSL_psk_find_session_cb_func cb)
4471	{
4472	ctx->psk_find_session_cb = cb;
4473	}
4474
4475	void SSL_set_psk_use_session_callback(SSL *s, SSL_psk_use_session_cb_func cb)
4476	{
4477	s->psk_use_session_cb = cb;
4478	}
4479
4480	void SSL_CTX_set_psk_use_session_callback(SSL_CTX *ctx,
4481	SSL_psk_use_session_cb_func cb)
4482	{
4483	ctx->psk_use_session_cb = cb;
4484	}
4485
4486	void SSL_CTX_set_msg_callback(SSL_CTX *ctx,
4487	void (cb) (int* write_p, int version,
4488	int content_type, const void *buf,
4489	size_t len, SSL ssl, void* *arg))
4490	{
4491	SSL_CTX_callback_ctrl(ctx, SSL_CTRL_SET_MSG_CALLBACK, (void ()(void*))cb);
4492	}
4493
4494	void SSL_set_msg_callback(SSL *ssl,
4495	void (cb) (int* write_p, int version,
4496	int content_type, const void *buf,
4497	size_t len, SSL ssl, void* *arg))
4498	{
4499	SSL_callback_ctrl(ssl, SSL_CTRL_SET_MSG_CALLBACK, (void ()(void*))cb);
4500	}
4501
4502	void SSL_CTX_set_not_resumable_session_callback(SSL_CTX *ctx,
4503	int (cb) (SSL ssl,
4504	int
4505	is_forward_secure))
4506	{
4507	SSL_CTX_callback_ctrl(ctx, SSL_CTRL_SET_NOT_RESUMABLE_SESS_CB,
4508	(void ()(void*))cb);
4509	}
4510
4511	void SSL_set_not_resumable_session_callback(SSL *ssl,
4512	int (cb) (SSL ssl,
4513	int is_forward_secure))
4514	{
4515	SSL_callback_ctrl(ssl, SSL_CTRL_SET_NOT_RESUMABLE_SESS_CB,
4516	(void ()(void*))cb);
4517	}
4518
4519	void SSL_CTX_set_record_padding_callback(SSL_CTX *ctx,
4520	size_t (cb) (SSL ssl, int type,
4521	size_t len, void *arg))
4522	{
4523	ctx->record_padding_cb = cb;
4524	}
4525
4526	void SSL_CTX_set_record_padding_callback_arg(SSL_CTX ctx, void* *arg)
4527	{
4528	ctx->record_padding_arg = arg;
4529	}
4530
4531	void SSL_CTX_get_record_padding_callback_arg(const* SSL_CTX *ctx)
4532	{
4533	return ctx->record_padding_arg;
4534	}
4535
4536	int SSL_CTX_set_block_padding(SSL_CTX *ctx, size_t block_size)
4537	{
4538	/ block size of 0 or 1 is basically no padding /
4539	if (block_size == `1`)
4540	ctx->block_padding = `0`;
4541	else if (block_size <= SSL3_RT_MAX_PLAIN_LENGTH)
4542	ctx->block_padding = block_size;
4543	else
4544	return `0`;
4545	return `1`;
4546	}
4547
4548	void SSL_set_record_padding_callback(SSL *ssl,
4549	size_t (cb) (SSL ssl, int type,
4550	size_t len, void *arg))
4551	{
4552	ssl->record_padding_cb = cb;
4553	}
4554
4555	void SSL_set_record_padding_callback_arg(SSL ssl, void* *arg)
4556	{
4557	ssl->record_padding_arg = arg;
4558	}
4559
4560	void SSL_get_record_padding_callback_arg(const* SSL *ssl)
4561	{
4562	return ssl->record_padding_arg;
4563	}
4564
4565	int SSL_set_block_padding(SSL *ssl, size_t block_size)
4566	{
4567	/ block size of 0 or 1 is basically no padding /
4568	if (block_size == `1`)
4569	ssl->block_padding = `0`;
4570	else if (block_size <= SSL3_RT_MAX_PLAIN_LENGTH)
4571	ssl->block_padding = block_size;
4572	else
4573	return `0`;
4574	return `1`;
4575	}
4576
4577	int SSL_set_num_tickets(SSL *s, size_t num_tickets)
4578	{
4579	s->num_tickets = num_tickets;
4580
4581	return `1`;
4582	}
4583
4584	size_t SSL_get_num_tickets(const SSL *s)
4585	{
4586	return s->num_tickets;
4587	}
4588
4589	int SSL_CTX_set_num_tickets(SSL_CTX *ctx, size_t num_tickets)
4590	{
4591	ctx->num_tickets = num_tickets;
4592
4593	return `1`;
4594	}
4595
4596	size_t SSL_CTX_get_num_tickets(const SSL_CTX *ctx)
4597	{
4598	return ctx->num_tickets;
4599	}
4600
4601	/*
4602	* Allocates new EVP_MD_CTX and sets pointer to it into given pointer
4603	* variable, freeing EVP_MD_CTX previously stored in that variable, if any.
4604	* If EVP_MD pointer is passed, initializes ctx with this \|md\|.
4605	* Returns the newly allocated ctx;
4606	*/
4607
4608	EVP_MD_CTX ssl_replace_hash(EVP_MD_CTX hash, const* EVP_MD *md)
4609	{
4610	ssl_clear_hash_ctx(hash);
4611	*hash = EVP_MD_CTX_new();
4612	if (hash == NULL \|\| (md && EVP_DigestInit_ex(hash, md, NULL) <= `0`)) {
4613	EVP_MD_CTX_free(*hash);
4614	*hash = NULL;
4615	return NULL;
4616	}
4617	return *hash;
4618	}
4619
4620	void ssl_clear_hash_ctx(EVP_MD_CTX **hash)
4621	{
4622
4623	EVP_MD_CTX_free(*hash);
4624	*hash = NULL;
4625	}
4626
4627	/ Retrieve handshake hashes /
4628	int ssl_handshake_hash(SSL s, unsigned* char *out, size_t outlen,
4629	size_t *hashlen)
4630	{
4631	EVP_MD_CTX *ctx = NULL;
4632	EVP_MD_CTX *hdgst = s->s3.handshake_dgst;
4633	int hashleni = EVP_MD_CTX_size(hdgst);
4634	int ret = `0`;
4635
4636	if (hashleni < `0` \|\| (size_t)hashleni > outlen) {
4637	SSLfatal(s, SSL_AD_INTERNAL_ERROR, SSL_F_SSL_HANDSHAKE_HASH,
4638	ERR_R_INTERNAL_ERROR);
4639	goto err;
4640	}
4641
4642	ctx = EVP_MD_CTX_new();
4643	if (ctx == NULL)
4644	goto err;
4645
4646	if (!EVP_MD_CTX_copy_ex(ctx, hdgst)
4647	\|\| EVP_DigestFinal_ex(ctx, out, NULL) <= `0`) {
4648	SSLfatal(s, SSL_AD_INTERNAL_ERROR, SSL_F_SSL_HANDSHAKE_HASH,
4649	ERR_R_INTERNAL_ERROR);
4650	goto err;
4651	}
4652
4653	*hashlen = hashleni;
4654
4655	ret = `1`;
4656	err:
4657	EVP_MD_CTX_free(ctx);
4658	return ret;
4659	}
4660
4661	int SSL_session_reused(const SSL *s)
4662	{
4663	return s->hit;
4664	}
4665
4666	int SSL_is_server(const SSL *s)
4667	{
4668	return s->server;
4669	}
4670
4671	#ifndef OPENSSL_NO_DEPRECATED_1_1_0
4672	void SSL_set_debug(SSL s, int* debug)
4673	{
4674	/ Old function was do-nothing anyway... /
4675	(void)s;
4676	(void)debug;
4677	}
4678	#endif
4679
4680	void SSL_set_security_level(SSL s, int* level)
4681	{
4682	s->cert->sec_level = level;
4683	}
4684
4685	int SSL_get_security_level(const SSL *s)
4686	{
4687	return s->cert->sec_level;
4688	}
4689
4690	void SSL_set_security_callback(SSL *s,
4691	int (cb) (const* SSL s, const* SSL_CTX *ctx,
4692	int op, int bits, int nid,
4693	void other, void* *ex))
4694	{
4695	s->cert->sec_cb = cb;
4696	}
4697
4698	int (SSL_get_security_callback(const* SSL s)) (const* SSL *s,
4699	const SSL_CTX ctx, int* op,
4700	int bits, int nid, void *other,
4701	void *ex) {
4702	return s->cert->sec_cb;
4703	}
4704
4705	void SSL_set0_security_ex_data(SSL s, void* *ex)
4706	{
4707	s->cert->sec_ex = ex;
4708	}
4709
4710	void SSL_get0_security_ex_data(const* SSL *s)
4711	{
4712	return s->cert->sec_ex;
4713	}
4714
4715	void SSL_CTX_set_security_level(SSL_CTX ctx, int* level)
4716	{
4717	ctx->cert->sec_level = level;
4718	}
4719
4720	int SSL_CTX_get_security_level(const SSL_CTX *ctx)
4721	{
4722	return ctx->cert->sec_level;
4723	}
4724
4725	void SSL_CTX_set_security_callback(SSL_CTX *ctx,
4726	int (cb) (const* SSL s, const* SSL_CTX *ctx,
4727	int op, int bits, int nid,
4728	void other, void* *ex))
4729	{
4730	ctx->cert->sec_cb = cb;
4731	}
4732
4733	int (SSL_CTX_get_security_callback(const* SSL_CTX ctx)) (const* SSL *s,
4734	const SSL_CTX *ctx,
4735	int op, int bits,
4736	int nid,
4737	void *other,
4738	void *ex) {
4739	return ctx->cert->sec_cb;
4740	}
4741
4742	void SSL_CTX_set0_security_ex_data(SSL_CTX ctx, void* *ex)
4743	{
4744	ctx->cert->sec_ex = ex;
4745	}
4746
4747	void SSL_CTX_get0_security_ex_data(const* SSL_CTX *ctx)
4748	{
4749	return ctx->cert->sec_ex;
4750	}
4751
4752	/*
4753	* Get/Set/Clear options in SSL_CTX or SSL, formerly macros, now functions that
4754	* can return unsigned long, instead of the generic long return value from the
4755	* control interface.
4756	*/
4757	unsigned long SSL_CTX_get_options(const SSL_CTX *ctx)
4758	{
4759	return ctx->options;
4760	}
4761
4762	unsigned long SSL_get_options(const SSL *s)
4763	{
4764	return s->options;
4765	}
4766
4767	unsigned long SSL_CTX_set_options(SSL_CTX ctx, unsigned* long op)
4768	{
4769	return ctx->options \|= op;
4770	}
4771
4772	unsigned long SSL_set_options(SSL s, unsigned* long op)
4773	{
4774	return s->options \|= op;
4775	}
4776
4777	unsigned long SSL_CTX_clear_options(SSL_CTX ctx, unsigned* long op)
4778	{
4779	return ctx->options &= ~op;
4780	}
4781
4782	unsigned long SSL_clear_options(SSL s, unsigned* long op)
4783	{
4784	return s->options &= ~op;
4785	}
4786
4787	STACK_OF(X509) SSL_get0_verified_chain(const* SSL *s)
4788	{
4789	return s->verified_chain;
4790	}
4791
4792	IMPLEMENT_OBJ_BSEARCH_GLOBAL_CMP_FN(SSL_CIPHER, SSL_CIPHER, ssl_cipher_id);
4793
4794	#ifndef OPENSSL_NO_CT
4795
4796	/*
4797	* Moves SCTs from the \|src\| stack to the \|dst\| stack.
4798	* The source of each SCT will be set to \|origin\|.
4799	* If \|dst\| points to a NULL pointer, a new stack will be created and owned by
4800	* the caller.
4801	* Returns the number of SCTs moved, or a negative integer if an error occurs.
4802	*/
4803	static int ct_move_scts(STACK_OF(SCT) *dst, STACK_OF(SCT) src,
4804	sct_source_t origin)
4805	{
4806	int scts_moved = `0`;
4807	SCT *sct = NULL;
4808
4809	if (*dst == NULL) {
4810	*dst = sk_SCT_new_null();
4811	if (*dst == NULL) {
4812	SSLerr(SSL_F_CT_MOVE_SCTS, ERR_R_MALLOC_FAILURE);
4813	goto err;
4814	}
4815	}
4816
4817	while ((sct = sk_SCT_pop(src)) != NULL) {
4818	if (SCT_set_source(sct, origin) != `1`)
4819	goto err;
4820
4821	if (sk_SCT_push(*dst, sct) <= `0`)
4822	goto err;
4823	scts_moved += `1`;
4824	}
4825
4826	return scts_moved;
4827	err:
4828	if (sct != NULL)
4829	sk_SCT_push(src, sct); / Put the SCT back /
4830	return -`1`;
4831	}
4832
4833	/*
4834	* Look for data collected during ServerHello and parse if found.
4835	* Returns the number of SCTs extracted.
4836	*/
4837	static int ct_extract_tls_extension_scts(SSL *s)
4838	{
4839	int scts_extracted = `0`;
4840
4841	if (s->ext.scts != NULL) {
4842	const unsigned char *p = s->ext.scts;
4843	STACK_OF(SCT) *scts = o2i_SCT_LIST(NULL, &p, s->ext.scts_len);
4844
4845	scts_extracted = ct_move_scts(&s->scts, scts, SCT_SOURCE_TLS_EXTENSION);
4846
4847	SCT_LIST_free(scts);
4848	}
4849
4850	return scts_extracted;
4851	}
4852
4853	/*
4854	* Checks for an OCSP response and then attempts to extract any SCTs found if it
4855	* contains an SCT X509 extension. They will be stored in \|s->scts\|.
4856	* Returns:
4857	* - The number of SCTs extracted, assuming an OCSP response exists.
4858	* - 0 if no OCSP response exists or it contains no SCTs.
4859	* - A negative integer if an error occurs.
4860	*/
4861	static int ct_extract_ocsp_response_scts(SSL *s)
4862	{
4863	# ifndef OPENSSL_NO_OCSP
4864	int scts_extracted = `0`;
4865	const unsigned char *p;
4866	OCSP_BASICRESP *br = NULL;
4867	OCSP_RESPONSE *rsp = NULL;
4868	STACK_OF(SCT) *scts = NULL;
4869	int i;
4870
4871	if (s->ext.ocsp.resp == NULL \|\| s->ext.ocsp.resp_len == `0`)
4872	goto err;
4873
4874	p = s->ext.ocsp.resp;
4875	rsp = d2i_OCSP_RESPONSE(NULL, &p, (int)s->ext.ocsp.resp_len);
4876	if (rsp == NULL)
4877	goto err;
4878
4879	br = OCSP_response_get1_basic(rsp);
4880	if (br == NULL)
4881	goto err;
4882
4883	for (i = `0`; i < OCSP_resp_count(br); ++i) {
4884	OCSP_SINGLERESP *single = OCSP_resp_get0(br, i);
4885
4886	if (single == NULL)
4887	continue;
4888
4889	scts =
4890	OCSP_SINGLERESP_get1_ext_d2i(single, NID_ct_cert_scts, NULL, NULL);
4891	scts_extracted =
4892	ct_move_scts(&s->scts, scts, SCT_SOURCE_OCSP_STAPLED_RESPONSE);
4893	if (scts_extracted < `0`)
4894	goto err;
4895	}
4896	err:
4897	SCT_LIST_free(scts);
4898	OCSP_BASICRESP_free(br);
4899	OCSP_RESPONSE_free(rsp);
4900	return scts_extracted;
4901	# else
4902	/ Behave as if no OCSP response exists /
4903	return `0`;
4904	# endif
4905	}
4906
4907	/*
4908	* Attempts to extract SCTs from the peer certificate.
4909	* Return the number of SCTs extracted, or a negative integer if an error
4910	* occurs.
4911	*/
4912	static int ct_extract_x509v3_extension_scts(SSL *s)
4913	{
4914	int scts_extracted = `0`;
4915	X509 *cert = s->session != NULL ? s->session->peer : NULL;
4916
4917	if (cert != NULL) {
4918	STACK_OF(SCT) *scts =
4919	X509_get_ext_d2i(cert, NID_ct_precert_scts, NULL, NULL);
4920
4921	scts_extracted =
4922	ct_move_scts(&s->scts, scts, SCT_SOURCE_X509V3_EXTENSION);
4923
4924	SCT_LIST_free(scts);
4925	}
4926
4927	return scts_extracted;
4928	}
4929
4930	/*
4931	* Attempts to find all received SCTs by checking TLS extensions, the OCSP
4932	* response (if it exists) and X509v3 extensions in the certificate.
4933	* Returns NULL if an error occurs.
4934	*/
4935	const STACK_OF(SCT) SSL_get0_peer_scts(SSL s)
4936	{
4937	if (!s->scts_parsed) {
4938	if (ct_extract_tls_extension_scts(s) < `0` \|\|
4939	ct_extract_ocsp_response_scts(s) < `0` \|\|
4940	ct_extract_x509v3_extension_scts(s) < `0`)
4941	goto err;
4942
4943	s->scts_parsed = `1`;
4944	}
4945	return s->scts;
4946	err:
4947	return NULL;
4948	}
4949
4950	static int ct_permissive(const CT_POLICY_EVAL_CTX * ctx,
4951	const STACK_OF(SCT) scts, void* *unused_arg)
4952	{
4953	return `1`;
4954	}
4955
4956	static int ct_strict(const CT_POLICY_EVAL_CTX * ctx,
4957	const STACK_OF(SCT) scts, void* *unused_arg)
4958	{
4959	int count = scts != NULL ? sk_SCT_num(scts) : `0`;
4960	int i;
4961
4962	for (i = `0`; i < count; ++i) {
4963	SCT *sct = sk_SCT_value(scts, i);
4964	int status = SCT_get_validation_status(sct);
4965
4966	if (status == SCT_VALIDATION_STATUS_VALID)
4967	return `1`;
4968	}
4969	SSLerr(SSL_F_CT_STRICT, SSL_R_NO_VALID_SCTS);
4970	return `0`;
4971	}
4972
4973	int SSL_set_ct_validation_callback(SSL *s, ssl_ct_validation_cb callback,
4974	void *arg)
4975	{
4976	/*
4977	* Since code exists that uses the custom extension handler for CT, look
4978	* for this and throw an error if they have already registered to use CT.
4979	*/
4980	if (callback != NULL && SSL_CTX_has_client_custom_ext(s->ctx,
4981	TLSEXT_TYPE_signed_certificate_timestamp))
4982	{
4983	SSLerr(SSL_F_SSL_SET_CT_VALIDATION_CALLBACK,
4984	SSL_R_CUSTOM_EXT_HANDLER_ALREADY_INSTALLED);
4985	return `0`;
4986	}
4987
4988	if (callback != NULL) {
4989	/*
4990	* If we are validating CT, then we MUST accept SCTs served via OCSP
4991	*/
4992	if (!SSL_set_tlsext_status_type(s, TLSEXT_STATUSTYPE_ocsp))
4993	return `0`;
4994	}
4995
4996	s->ct_validation_callback = callback;
4997	s->ct_validation_callback_arg = arg;
4998
4999	return `1`;
5000	}
5001
5002	int SSL_CTX_set_ct_validation_callback(SSL_CTX *ctx,
5003	ssl_ct_validation_cb callback, void *arg)
5004	{
5005	/*
5006	* Since code exists that uses the custom extension handler for CT, look for
5007	* this and throw an error if they have already registered to use CT.
5008	*/
5009	if (callback != NULL && SSL_CTX_has_client_custom_ext(ctx,
5010	TLSEXT_TYPE_signed_certificate_timestamp))
5011	{
5012	SSLerr(SSL_F_SSL_CTX_SET_CT_VALIDATION_CALLBACK,
5013	SSL_R_CUSTOM_EXT_HANDLER_ALREADY_INSTALLED);
5014	return `0`;
5015	}
5016
5017	ctx->ct_validation_callback = callback;
5018	ctx->ct_validation_callback_arg = arg;
5019	return `1`;
5020	}
5021
5022	int SSL_ct_is_enabled(const SSL *s)
5023	{
5024	return s->ct_validation_callback != NULL;
5025	}
5026
5027	int SSL_CTX_ct_is_enabled(const SSL_CTX *ctx)
5028	{
5029	return ctx->ct_validation_callback != NULL;
5030	}
5031
5032	int ssl_validate_ct(SSL *s)
5033	{
5034	int ret = `0`;
5035	X509 *cert = s->session != NULL ? s->session->peer : NULL;
5036	X509 *issuer;
5037	SSL_DANE *dane = &s->dane;
5038	CT_POLICY_EVAL_CTX *ctx = NULL;
5039	const STACK_OF(SCT) *scts;
5040
5041	/*
5042	* If no callback is set, the peer is anonymous, or its chain is invalid,
5043	* skip SCT validation - just return success. Applications that continue
5044	* handshakes without certificates, with unverified chains, or pinned leaf
5045	* certificates are outside the scope of the WebPKI and CT.
5046	*
5047	* The above exclusions notwithstanding the vast majority of peers will
5048	* have rather ordinary certificate chains validated by typical
5049	* applications that perform certificate verification and therefore will
5050	* process SCTs when enabled.
5051	*/
5052	if (s->ct_validation_callback == NULL \|\| cert == NULL \|\|
5053	s->verify_result != X509_V_OK \|\|
5054	s->verified_chain == NULL \|\| sk_X509_num(s->verified_chain) <= `1`)
5055	return `1`;
5056
5057	/*
5058	* CT not applicable for chains validated via DANE-TA(2) or DANE-EE(3)
5059	* trust-anchors. See https://tools.ietf.org/html/rfc7671#section-4.2
5060	*/
5061	if (DANETLS_ENABLED(dane) && dane->mtlsa != NULL) {
5062	switch (dane->mtlsa->usage) {
5063	case DANETLS_USAGE_DANE_TA:
5064	case DANETLS_USAGE_DANE_EE:
5065	return `1`;
5066	}
5067	}
5068
5069	ctx = CT_POLICY_EVAL_CTX_new();
5070	if (ctx == NULL) {
5071	SSLfatal(s, SSL_AD_INTERNAL_ERROR, SSL_F_SSL_VALIDATE_CT,
5072	ERR_R_MALLOC_FAILURE);
5073	goto end;
5074	}
5075
5076	issuer = sk_X509_value(s->verified_chain, `1`);
5077	CT_POLICY_EVAL_CTX_set1_cert(ctx, cert);
5078	CT_POLICY_EVAL_CTX_set1_issuer(ctx, issuer);
5079	CT_POLICY_EVAL_CTX_set_shared_CTLOG_STORE(ctx, s->ctx->ctlog_store);
5080	CT_POLICY_EVAL_CTX_set_time(
5081	ctx, (uint64_t)SSL_SESSION_get_time(SSL_get0_session(s)) * `1000`);
5082
5083	scts = SSL_get0_peer_scts(s);
5084
5085	/*
5086	* This function returns success (> 0) only when all the SCTs are valid, 0
5087	* when some are invalid, and < 0 on various internal errors (out of
5088	* memory, etc.). Having some, or even all, invalid SCTs is not sufficient
5089	* reason to abort the handshake, that decision is up to the callback.
5090	* Therefore, we error out only in the unexpected case that the return
5091	* value is negative.
5092	*
5093	* XXX: One might well argue that the return value of this function is an
5094	* unfortunate design choice. Its job is only to determine the validation
5095	* status of each of the provided SCTs. So long as it correctly separates
5096	* the wheat from the chaff it should return success. Failure in this case
5097	* ought to correspond to an inability to carry out its duties.
5098	*/
5099	if (SCT_LIST_validate(scts, ctx) < `0`) {
5100	SSLfatal(s, SSL_AD_HANDSHAKE_FAILURE, SSL_F_SSL_VALIDATE_CT,
5101	SSL_R_SCT_VERIFICATION_FAILED);
5102	goto end;
5103	}
5104
5105	ret = s->ct_validation_callback(ctx, scts, s->ct_validation_callback_arg);
5106	if (ret < `0`)
5107	ret = `0`; / This function returns 0 on failure /
5108	if (!ret)
5109	SSLfatal(s, SSL_AD_HANDSHAKE_FAILURE, SSL_F_SSL_VALIDATE_CT,
5110	SSL_R_CALLBACK_FAILED);
5111
5112	end:
5113	CT_POLICY_EVAL_CTX_free(ctx);
5114	/*
5115	* With SSL_VERIFY_NONE the session may be cached and re-used despite a
5116	* failure return code here. Also the application may wish the complete
5117	* the handshake, and then disconnect cleanly at a higher layer, after
5118	* checking the verification status of the completed connection.
5119	*
5120	* We therefore force a certificate verification failure which will be
5121	* visible via SSL_get_verify_result() and cached as part of any resumed
5122	* session.
5123	*
5124	* Note: the permissive callback is for information gathering only, always
5125	* returns success, and does not affect verification status. Only the
5126	* strict callback or a custom application-specified callback can trigger
5127	* connection failure or record a verification error.
5128	*/
5129	if (ret <= `0`)
5130	s->verify_result = X509_V_ERR_NO_VALID_SCTS;
5131	return ret;
5132	}
5133
5134	int SSL_CTX_enable_ct(SSL_CTX ctx, int* validation_mode)
5135	{
5136	switch (validation_mode) {
5137	default:
5138	SSLerr(SSL_F_SSL_CTX_ENABLE_CT, SSL_R_INVALID_CT_VALIDATION_TYPE);
5139	return `0`;
5140	case SSL_CT_VALIDATION_PERMISSIVE:
5141	return SSL_CTX_set_ct_validation_callback(ctx, ct_permissive, NULL);
5142	case SSL_CT_VALIDATION_STRICT:
5143	return SSL_CTX_set_ct_validation_callback(ctx, ct_strict, NULL);
5144	}
5145	}
5146
5147	int SSL_enable_ct(SSL s, int* validation_mode)
5148	{
5149	switch (validation_mode) {
5150	default:
5151	SSLerr(SSL_F_SSL_ENABLE_CT, SSL_R_INVALID_CT_VALIDATION_TYPE);
5152	return `0`;
5153	case SSL_CT_VALIDATION_PERMISSIVE:
5154	return SSL_set_ct_validation_callback(s, ct_permissive, NULL);
5155	case SSL_CT_VALIDATION_STRICT:
5156	return SSL_set_ct_validation_callback(s, ct_strict, NULL);
5157	}
5158	}
5159
5160	int SSL_CTX_set_default_ctlog_list_file(SSL_CTX *ctx)
5161	{
5162	return CTLOG_STORE_load_default_file(ctx->ctlog_store);
5163	}
5164
5165	int SSL_CTX_set_ctlog_list_file(SSL_CTX ctx, const* char *path)
5166	{
5167	return CTLOG_STORE_load_file(ctx->ctlog_store, path);
5168	}
5169
5170	void SSL_CTX_set0_ctlog_store(SSL_CTX ctx, CTLOG_STORE logs)
5171	{
5172	CTLOG_STORE_free(ctx->ctlog_store);
5173	ctx->ctlog_store = logs;
5174	}
5175
5176	const CTLOG_STORE SSL_CTX_get0_ctlog_store(const* SSL_CTX *ctx)
5177	{
5178	return ctx->ctlog_store;
5179	}
5180
5181	#endif /* OPENSSL_NO_CT */
5182
5183	void SSL_CTX_set_client_hello_cb(SSL_CTX *c, SSL_client_hello_cb_fn cb,
5184	void *arg)
5185	{
5186	c->client_hello_cb = cb;
5187	c->client_hello_cb_arg = arg;
5188	}
5189
5190	int SSL_client_hello_isv2(SSL *s)
5191	{
5192	if (s->clienthello == NULL)
5193	return `0`;
5194	return s->clienthello->isv2;
5195	}
5196
5197	unsigned int SSL_client_hello_get0_legacy_version(SSL *s)
5198	{
5199	if (s->clienthello == NULL)
5200	return `0`;
5201	return s->clienthello->legacy_version;
5202	}
5203
5204	size_t SSL_client_hello_get0_random(SSL s, const* unsigned char **out)
5205	{
5206	if (s->clienthello == NULL)
5207	return `0`;
5208	if (out != NULL)
5209	*out = s->clienthello->random;
5210	return SSL3_RANDOM_SIZE;
5211	}
5212
5213	size_t SSL_client_hello_get0_session_id(SSL s, const* unsigned char **out)
5214	{
5215	if (s->clienthello == NULL)
5216	return `0`;
5217	if (out != NULL)
5218	*out = s->clienthello->session_id;
5219	return s->clienthello->session_id_len;
5220	}
5221
5222	size_t SSL_client_hello_get0_ciphers(SSL s, const* unsigned char **out)
5223	{
5224	if (s->clienthello == NULL)
5225	return `0`;
5226	if (out != NULL)
5227	*out = PACKET_data(&s->clienthello->ciphersuites);
5228	return PACKET_remaining(&s->clienthello->ciphersuites);
5229	}
5230
5231	size_t SSL_client_hello_get0_compression_methods(SSL s, const* unsigned char **out)
5232	{
5233	if (s->clienthello == NULL)
5234	return `0`;
5235	if (out != NULL)
5236	*out = s->clienthello->compressions;
5237	return s->clienthello->compressions_len;
5238	}
5239
5240	int SSL_client_hello_get1_extensions_present(SSL s, int* *out, size_t outlen)
5241	{
5242	RAW_EXTENSION *ext;
5243	int *present;
5244	size_t num = `0`, i;
5245
5246	if (s->clienthello == NULL \|\| out == NULL \|\| outlen == NULL)
5247	return `0`;
5248	for (i = `0`; i < s->clienthello->pre_proc_exts_len; i++) {
5249	ext = s->clienthello->pre_proc_exts + i;
5250	if (ext->present)
5251	num++;
5252	}
5253	if (num == `0`) {
5254	*out = NULL;
5255	*outlen = `0`;
5256	return `1`;
5257	}
5258	if ((present = OPENSSL_malloc(sizeof(present) num)) == NULL) {
5259	SSLerr(SSL_F_SSL_CLIENT_HELLO_GET1_EXTENSIONS_PRESENT,
5260	ERR_R_MALLOC_FAILURE);
5261	return `0`;
5262	}
5263	for (i = `0`; i < s->clienthello->pre_proc_exts_len; i++) {
5264	ext = s->clienthello->pre_proc_exts + i;
5265	if (ext->present) {
5266	if (ext->received_order >= num)
5267	goto err;
5268	present[ext->received_order] = ext->type;
5269	}
5270	}
5271	*out = present;
5272	*outlen = num;
5273	return `1`;
5274	err:
5275	OPENSSL_free(present);
5276	return `0`;
5277	}
5278
5279	int SSL_client_hello_get0_ext(SSL s, unsigned* int type, const unsigned char **out,
5280	size_t *outlen)
5281	{
5282	size_t i;
5283	RAW_EXTENSION *r;
5284
5285	if (s->clienthello == NULL)
5286	return `0`;
5287	for (i = `0`; i < s->clienthello->pre_proc_exts_len; ++i) {
5288	r = s->clienthello->pre_proc_exts + i;
5289	if (r->present && r->type == type) {
5290	if (out != NULL)
5291	*out = PACKET_data(&r->data);
5292	if (outlen != NULL)
5293	*outlen = PACKET_remaining(&r->data);
5294	return `1`;
5295	}
5296	}
5297	return `0`;
5298	}
5299
5300	int SSL_free_buffers(SSL *ssl)
5301	{
5302	RECORD_LAYER *rl = &ssl->rlayer;
5303
5304	if (RECORD_LAYER_read_pending(rl) \|\| RECORD_LAYER_write_pending(rl))
5305	return `0`;
5306
5307	RECORD_LAYER_release(rl);
5308	return `1`;
5309	}
5310
5311	int SSL_alloc_buffers(SSL *ssl)
5312	{
5313	return ssl3_setup_buffers(ssl);
5314	}
5315
5316	void SSL_CTX_set_keylog_callback(SSL_CTX *ctx, SSL_CTX_keylog_cb_func cb)
5317	{
5318	ctx->keylog_callback = cb;
5319	}
5320
5321	SSL_CTX_keylog_cb_func SSL_CTX_get_keylog_callback(const SSL_CTX *ctx)
5322	{
5323	return ctx->keylog_callback;
5324	}
5325
5326	static int nss_keylog_int(const char *prefix,
5327	SSL *ssl,
5328	const uint8_t *parameter_1,
5329	size_t parameter_1_len,
5330	const uint8_t *parameter_2,
5331	size_t parameter_2_len)
5332	{
5333	char *out = NULL;
5334	char *cursor = NULL;
5335	size_t out_len = `0`;
5336	size_t i;
5337	size_t prefix_len;
5338
5339	if (ssl->ctx->keylog_callback == NULL)
5340	return `1`;
5341
5342	/*
5343	* Our output buffer will contain the following strings, rendered with
5344	* space characters in between, terminated by a NULL character: first the
5345	* prefix, then the first parameter, then the second parameter. The
5346	* meaning of each parameter depends on the specific key material being
5347	* logged. Note that the first and second parameters are encoded in
5348	* hexadecimal, so we need a buffer that is twice their lengths.
5349	*/
5350	prefix_len = strlen(prefix);
5351	out_len = prefix_len + (`2` * parameter_1_len) + (`2` * parameter_2_len) + `3`;
5352	if ((out = cursor = OPENSSL_malloc(out_len)) == NULL) {
5353	SSLfatal(ssl, SSL_AD_INTERNAL_ERROR, SSL_F_NSS_KEYLOG_INT,
5354	ERR_R_MALLOC_FAILURE);
5355	return `0`;
5356	}
5357
5358	strcpy(cursor, prefix);
5359	cursor += prefix_len;
5360	*cursor++ = `' '`;
5361
5362	for (i = `0`; i < parameter_1_len; i++) {
5363	sprintf(cursor, "%02x", parameter_1[i]);
5364	cursor += `2`;
5365	}
5366	*cursor++ = `' '`;
5367
5368	for (i = `0`; i < parameter_2_len; i++) {
5369	sprintf(cursor, "%02x", parameter_2[i]);
5370	cursor += `2`;
5371	}
5372	*cursor = `'\0'`;
5373
5374	ssl->ctx->keylog_callback(ssl, (const char *)out);
5375	OPENSSL_clear_free(out, out_len);
5376	return `1`;
5377
5378	}
5379
5380	int ssl_log_rsa_client_key_exchange(SSL *ssl,
5381	const uint8_t *encrypted_premaster,
5382	size_t encrypted_premaster_len,
5383	const uint8_t *premaster,
5384	size_t premaster_len)
5385	{
5386	if (encrypted_premaster_len < `8`) {
5387	SSLfatal(ssl, SSL_AD_INTERNAL_ERROR,
5388	SSL_F_SSL_LOG_RSA_CLIENT_KEY_EXCHANGE, ERR_R_INTERNAL_ERROR);
5389	return `0`;
5390	}
5391
5392	/ We only want the first 8 bytes of the encrypted premaster as a tag. /
5393	return nss_keylog_int("RSA",
5394	ssl,
5395	encrypted_premaster,
5396	`8`,
5397	premaster,
5398	premaster_len);
5399	}
5400
5401	int ssl_log_secret(SSL *ssl,
5402	const char *label,
5403	const uint8_t *secret,
5404	size_t secret_len)
5405	{
5406	return nss_keylog_int(label,
5407	ssl,
5408	ssl->s3.client_random,
5409	SSL3_RANDOM_SIZE,
5410	secret,
5411	secret_len);
5412	}
5413
5414	#define SSLV2_CIPHER_LEN 3
5415
5416	int ssl_cache_cipherlist(SSL s, PACKET cipher_suites, int sslv2format)
5417	{
5418	int n;
5419
5420	n = sslv2format ? SSLV2_CIPHER_LEN : TLS_CIPHER_LEN;
5421
5422	if (PACKET_remaining(cipher_suites) == `0`) {
5423	SSLfatal(s, SSL_AD_ILLEGAL_PARAMETER, SSL_F_SSL_CACHE_CIPHERLIST,
5424	SSL_R_NO_CIPHERS_SPECIFIED);
5425	return `0`;
5426	}
5427
5428	if (PACKET_remaining(cipher_suites) % n != `0`) {
5429	SSLfatal(s, SSL_AD_DECODE_ERROR, SSL_F_SSL_CACHE_CIPHERLIST,
5430	SSL_R_ERROR_IN_RECEIVED_CIPHER_LIST);
5431	return `0`;
5432	}
5433
5434	OPENSSL_free(s->s3.tmp.ciphers_raw);
5435	s->s3.tmp.ciphers_raw = NULL;
5436	s->s3.tmp.ciphers_rawlen = `0`;
5437
5438	if (sslv2format) {
5439	size_t numciphers = PACKET_remaining(cipher_suites) / n;
5440	PACKET sslv2ciphers = *cipher_suites;
5441	unsigned int leadbyte;
5442	unsigned char *raw;
5443
5444	/*
5445	* We store the raw ciphers list in SSLv3+ format so we need to do some
5446	* preprocessing to convert the list first. If there are any SSLv2 only
5447	* ciphersuites with a non-zero leading byte then we are going to
5448	* slightly over allocate because we won't store those. But that isn't a
5449	* problem.
5450	*/
5451	raw = OPENSSL_malloc(numciphers * TLS_CIPHER_LEN);
5452	s->s3.tmp.ciphers_raw = raw;
5453	if (raw == NULL) {
5454	SSLfatal(s, SSL_AD_INTERNAL_ERROR, SSL_F_SSL_CACHE_CIPHERLIST,
5455	ERR_R_MALLOC_FAILURE);
5456	return `0`;
5457	}
5458	for (s->s3.tmp.ciphers_rawlen = `0`;
5459	PACKET_remaining(&sslv2ciphers) > `0`;
5460	raw += TLS_CIPHER_LEN) {
5461	if (!PACKET_get_1(&sslv2ciphers, &leadbyte)
5462	\|\| (leadbyte == `0`
5463	&& !PACKET_copy_bytes(&sslv2ciphers, raw,
5464	TLS_CIPHER_LEN))
5465	\|\| (leadbyte != `0`
5466	&& !PACKET_forward(&sslv2ciphers, TLS_CIPHER_LEN))) {
5467	SSLfatal(s, SSL_AD_DECODE_ERROR, SSL_F_SSL_CACHE_CIPHERLIST,
5468	SSL_R_BAD_PACKET);
5469	OPENSSL_free(s->s3.tmp.ciphers_raw);
5470	s->s3.tmp.ciphers_raw = NULL;
5471	s->s3.tmp.ciphers_rawlen = `0`;
5472	return `0`;
5473	}
5474	if (leadbyte == `0`)
5475	s->s3.tmp.ciphers_rawlen += TLS_CIPHER_LEN;
5476	}
5477	} else if (!PACKET_memdup(cipher_suites, &s->s3.tmp.ciphers_raw,
5478	&s->s3.tmp.ciphers_rawlen)) {
5479	SSLfatal(s, SSL_AD_INTERNAL_ERROR, SSL_F_SSL_CACHE_CIPHERLIST,
5480	ERR_R_INTERNAL_ERROR);
5481	return `0`;
5482	}
5483	return `1`;
5484	}
5485
5486	int SSL_bytes_to_cipher_list(SSL s, const* unsigned char *bytes, size_t len,
5487	int isv2format, STACK_OF(SSL_CIPHER) **sk,
5488	STACK_OF(SSL_CIPHER) **scsvs)
5489	{
5490	PACKET pkt;
5491
5492	if (!PACKET_buf_init(&pkt, bytes, len))
5493	return `0`;
5494	return bytes_to_cipher_list(s, &pkt, sk, scsvs, isv2format, `0`);
5495	}
5496
5497	int bytes_to_cipher_list(SSL s, PACKET cipher_suites,
5498	STACK_OF(SSL_CIPHER) **skp,
5499	STACK_OF(SSL_CIPHER) **scsvs_out,
5500	int sslv2format, int fatal)
5501	{
5502	const SSL_CIPHER *c;
5503	STACK_OF(SSL_CIPHER) *sk = NULL;
5504	STACK_OF(SSL_CIPHER) *scsvs = NULL;
5505	int n;
5506	/ 3 = SSLV2_CIPHER_LEN > TLS_CIPHER_LEN = 2. /
5507	unsigned char cipher[SSLV2_CIPHER_LEN];
5508
5509	n = sslv2format ? SSLV2_CIPHER_LEN : TLS_CIPHER_LEN;
5510
5511	if (PACKET_remaining(cipher_suites) == `0`) {
5512	if (fatal)
5513	SSLfatal(s, SSL_AD_ILLEGAL_PARAMETER, SSL_F_BYTES_TO_CIPHER_LIST,
5514	SSL_R_NO_CIPHERS_SPECIFIED);
5515	else
5516	SSLerr(SSL_F_BYTES_TO_CIPHER_LIST, SSL_R_NO_CIPHERS_SPECIFIED);
5517	return `0`;
5518	}
5519
5520	if (PACKET_remaining(cipher_suites) % n != `0`) {
5521	if (fatal)
5522	SSLfatal(s, SSL_AD_DECODE_ERROR, SSL_F_BYTES_TO_CIPHER_LIST,
5523	SSL_R_ERROR_IN_RECEIVED_CIPHER_LIST);
5524	else
5525	SSLerr(SSL_F_BYTES_TO_CIPHER_LIST,
5526	SSL_R_ERROR_IN_RECEIVED_CIPHER_LIST);
5527	return `0`;
5528	}
5529
5530	sk = sk_SSL_CIPHER_new_null();
5531	scsvs = sk_SSL_CIPHER_new_null();
5532	if (sk == NULL \|\| scsvs == NULL) {
5533	if (fatal)
5534	SSLfatal(s, SSL_AD_INTERNAL_ERROR, SSL_F_BYTES_TO_CIPHER_LIST,
5535	ERR_R_MALLOC_FAILURE);
5536	else
5537	SSLerr(SSL_F_BYTES_TO_CIPHER_LIST, ERR_R_MALLOC_FAILURE);
5538	goto err;
5539	}
5540
5541	while (PACKET_copy_bytes(cipher_suites, cipher, n)) {
5542	/*
5543	* SSLv3 ciphers wrapped in an SSLv2-compatible ClientHello have the
5544	* first byte set to zero, while true SSLv2 ciphers have a non-zero
5545	* first byte. We don't support any true SSLv2 ciphers, so skip them.
5546	*/
5547	if (sslv2format && cipher[`0`] != `'\0'`)
5548	continue;
5549
5550	/ For SSLv2-compat, ignore leading 0-byte. /
5551	c = ssl_get_cipher_by_char(s, sslv2format ? &cipher[`1`] : cipher, `1`);
5552	if (c != NULL) {
5553	if ((c->valid && !sk_SSL_CIPHER_push(sk, c)) \|\|
5554	(!c->valid && !sk_SSL_CIPHER_push(scsvs, c))) {
5555	if (fatal)
5556	SSLfatal(s, SSL_AD_INTERNAL_ERROR,
5557	SSL_F_BYTES_TO_CIPHER_LIST, ERR_R_MALLOC_FAILURE);
5558	else
5559	SSLerr(SSL_F_BYTES_TO_CIPHER_LIST, ERR_R_MALLOC_FAILURE);
5560	goto err;
5561	}
5562	}
5563	}
5564	if (PACKET_remaining(cipher_suites) > `0`) {
5565	if (fatal)
5566	SSLfatal(s, SSL_AD_DECODE_ERROR, SSL_F_BYTES_TO_CIPHER_LIST,
5567	SSL_R_BAD_LENGTH);
5568	else
5569	SSLerr(SSL_F_BYTES_TO_CIPHER_LIST, SSL_R_BAD_LENGTH);
5570	goto err;
5571	}
5572
5573	if (skp != NULL)
5574	*skp = sk;
5575	else
5576	sk_SSL_CIPHER_free(sk);
5577	if (scsvs_out != NULL)
5578	*scsvs_out = scsvs;
5579	else
5580	sk_SSL_CIPHER_free(scsvs);
5581	return `1`;
5582	err:
5583	sk_SSL_CIPHER_free(sk);
5584	sk_SSL_CIPHER_free(scsvs);
5585	return `0`;
5586	}
5587
5588	int SSL_CTX_set_max_early_data(SSL_CTX *ctx, uint32_t max_early_data)
5589	{
5590	ctx->max_early_data = max_early_data;
5591
5592	return `1`;
5593	}
5594
5595	uint32_t SSL_CTX_get_max_early_data(const SSL_CTX *ctx)
5596	{
5597	return ctx->max_early_data;
5598	}
5599
5600	int SSL_set_max_early_data(SSL *s, uint32_t max_early_data)
5601	{
5602	s->max_early_data = max_early_data;
5603
5604	return `1`;
5605	}
5606
5607	uint32_t SSL_get_max_early_data(const SSL *s)
5608	{
5609	return s->max_early_data;
5610	}
5611
5612	int SSL_CTX_set_recv_max_early_data(SSL_CTX *ctx, uint32_t recv_max_early_data)
5613	{
5614	ctx->recv_max_early_data = recv_max_early_data;
5615
5616	return `1`;
5617	}
5618
5619	uint32_t SSL_CTX_get_recv_max_early_data(const SSL_CTX *ctx)
5620	{
5621	return ctx->recv_max_early_data;
5622	}
5623
5624	int SSL_set_recv_max_early_data(SSL *s, uint32_t recv_max_early_data)
5625	{
5626	s->recv_max_early_data = recv_max_early_data;
5627
5628	return `1`;
5629	}
5630
5631	uint32_t SSL_get_recv_max_early_data(const SSL *s)
5632	{
5633	return s->recv_max_early_data;
5634	}
5635
5636	__owur unsigned int ssl_get_max_send_fragment(const SSL *ssl)
5637	{
5638	/ Return any active Max Fragment Len extension /
5639	if (ssl->session != NULL && USE_MAX_FRAGMENT_LENGTH_EXT(ssl->session))
5640	return GET_MAX_FRAGMENT_LENGTH(ssl->session);
5641
5642	/ return current SSL connection setting /
5643	return ssl->max_send_fragment;
5644	}
5645
5646	__owur unsigned int ssl_get_split_send_fragment(const SSL *ssl)
5647	{
5648	/ Return a value regarding an active Max Fragment Len extension /
5649	if (ssl->session != NULL && USE_MAX_FRAGMENT_LENGTH_EXT(ssl->session)
5650	&& ssl->split_send_fragment > GET_MAX_FRAGMENT_LENGTH(ssl->session))
5651	return GET_MAX_FRAGMENT_LENGTH(ssl->session);
5652
5653	/ else limit \|split_send_fragment\| to current \|max_send_fragment\| /
5654	if (ssl->split_send_fragment > ssl->max_send_fragment)
5655	return ssl->max_send_fragment;
5656
5657	/ return current SSL connection setting /
5658	return ssl->split_send_fragment;
5659	}
5660
5661	int SSL_stateless(SSL *s)
5662	{
5663	int ret;
5664
5665	/ Ensure there is no state left over from a previous invocation /
5666	if (!SSL_clear(s))
5667	return `0`;
5668
5669	ERR_clear_error();
5670
5671	s->s3.flags \|= TLS1_FLAGS_STATELESS;
5672	ret = SSL_accept(s);
5673	s->s3.flags &= ~TLS1_FLAGS_STATELESS;
5674
5675	if (ret > `0` && s->ext.cookieok)
5676	return `1`;
5677
5678	if (s->hello_retry_request == SSL_HRR_PENDING && !ossl_statem_in_error(s))
5679	return `0`;
5680
5681	return -`1`;
5682	}
5683
5684	void SSL_CTX_set_post_handshake_auth(SSL_CTX ctx, int* val)
5685	{
5686	ctx->pha_enabled = val;
5687	}
5688
5689	void SSL_set_post_handshake_auth(SSL ssl, int* val)
5690	{
5691	ssl->pha_enabled = val;
5692	}
5693
5694	int SSL_verify_client_post_handshake(SSL *ssl)
5695	{
5696	if (!SSL_IS_TLS13(ssl)) {
5697	SSLerr(SSL_F_SSL_VERIFY_CLIENT_POST_HANDSHAKE, SSL_R_WRONG_SSL_VERSION);
5698	return `0`;
5699	}
5700	if (!ssl->server) {
5701	SSLerr(SSL_F_SSL_VERIFY_CLIENT_POST_HANDSHAKE, SSL_R_NOT_SERVER);
5702	return `0`;
5703	}
5704
5705	if (!SSL_is_init_finished(ssl)) {
5706	SSLerr(SSL_F_SSL_VERIFY_CLIENT_POST_HANDSHAKE, SSL_R_STILL_IN_INIT);
5707	return `0`;
5708	}
5709
5710	switch (ssl->post_handshake_auth) {
5711	case SSL_PHA_NONE:
5712	SSLerr(SSL_F_SSL_VERIFY_CLIENT_POST_HANDSHAKE, SSL_R_EXTENSION_NOT_RECEIVED);
5713	return `0`;
5714	default:
5715	case SSL_PHA_EXT_SENT:
5716	SSLerr(SSL_F_SSL_VERIFY_CLIENT_POST_HANDSHAKE, ERR_R_INTERNAL_ERROR);
5717	return `0`;
5718	case SSL_PHA_EXT_RECEIVED:
5719	break;
5720	case SSL_PHA_REQUEST_PENDING:
5721	SSLerr(SSL_F_SSL_VERIFY_CLIENT_POST_HANDSHAKE, SSL_R_REQUEST_PENDING);
5722	return `0`;
5723	case SSL_PHA_REQUESTED:
5724	SSLerr(SSL_F_SSL_VERIFY_CLIENT_POST_HANDSHAKE, SSL_R_REQUEST_SENT);
5725	return `0`;
5726	}
5727
5728	ssl->post_handshake_auth = SSL_PHA_REQUEST_PENDING;
5729
5730	/ checks verify_mode and algorithm_auth /
5731	if (!send_certificate_request(ssl)) {
5732	ssl->post_handshake_auth = SSL_PHA_EXT_RECEIVED; / restore on error /
5733	SSLerr(SSL_F_SSL_VERIFY_CLIENT_POST_HANDSHAKE, SSL_R_INVALID_CONFIG);
5734	return `0`;
5735	}
5736
5737	ossl_statem_set_in_init(ssl, `1`);
5738	return `1`;
5739	}
5740
5741	int SSL_CTX_set_session_ticket_cb(SSL_CTX *ctx,
5742	SSL_CTX_generate_session_ticket_fn gen_cb,
5743	SSL_CTX_decrypt_session_ticket_fn dec_cb,
5744	void *arg)
5745	{
5746	ctx->generate_ticket_cb = gen_cb;
5747	ctx->decrypt_ticket_cb = dec_cb;
5748	ctx->ticket_cb_data = arg;
5749	return `1`;
5750	}
5751
5752	void SSL_CTX_set_allow_early_data_cb(SSL_CTX *ctx,
5753	SSL_allow_early_data_cb_fn cb,
5754	void *arg)
5755	{
5756	ctx->allow_early_data_cb = cb;
5757	ctx->allow_early_data_cb_data = arg;
5758	}
5759
5760	void SSL_set_allow_early_data_cb(SSL *s,
5761	SSL_allow_early_data_cb_fn cb,
5762	void *arg)
5763	{
5764	s->allow_early_data_cb = cb;
5765	s->allow_early_data_cb_data = arg;
5766	}
5767

Browse the source code of ClickHouse/contrib/openssl/ssl/ssl_lib.c