Lines Matching defs:s
28 static int ssl_undefined_function_1(SSL *ssl, SSL3_RECORD *r, size_t s, int t,
34 static int ssl_undefined_function_2(SSL *ssl, SSL3_RECORD *r, unsigned char *s,
41 unsigned char *s, size_t t, size_t *u)
51 static size_t ssl_undefined_function_5(SSL *ssl, const char *r, size_t s,
62 static int ssl_undefined_function_7(SSL *ssl, unsigned char *r, size_t s,
85 SSL *s;
576 static void clear_ciphers(SSL *s)
579 ssl_clear_cipher_ctx(s);
580 ssl_clear_hash_ctx(&s->read_hash);
581 ssl_clear_hash_ctx(&s->write_hash);
584 int SSL_clear(SSL *s)
586 if (s->method == NULL) {
591 if (ssl_clear_bad_session(s)) {
592 SSL_SESSION_free(s->session);
593 s->session = NULL;
595 SSL_SESSION_free(s->psksession);
596 s->psksession = NULL;
597 OPENSSL_free(s->psksession_id);
598 s->psksession_id = NULL;
599 s->psksession_id_len = 0;
600 s->hello_retry_request = SSL_HRR_NONE;
601 s->sent_tickets = 0;
603 s->error = 0;
604 s->hit = 0;
605 s->shutdown = 0;
607 if (s->renegotiate) {
612 ossl_statem_clear(s);
614 s->version = s->method->version;
615 s->client_version = s->version;
616 s->rwstate = SSL_NOTHING;
618 BUF_MEM_free(s->init_buf);
619 s->init_buf = NULL;
620 clear_ciphers(s);
621 s->first_packet = 0;
623 s->key_update = SSL_KEY_UPDATE_NONE;
625 EVP_MD_CTX_free(s->pha_dgst);
626 s->pha_dgst = NULL;
629 s->dane.mdpth = -1;
630 s->dane.pdpth = -1;
631 X509_free(s->dane.mcert);
632 s->dane.mcert = NULL;
633 s->dane.mtlsa = NULL;
636 X509_VERIFY_PARAM_move_peername(s->param, NULL);
639 OPENSSL_free(s->shared_sigalgs);
640 s->shared_sigalgs = NULL;
641 s->shared_sigalgslen = 0;
647 if (s->method != s->ctx->method) {
648 s->method->ssl_free(s);
649 s->method = s->ctx->method;
650 if (!s->method->ssl_new(s))
653 if (!s->method->ssl_clear(s))
657 RECORD_LAYER_clear(&s->rlayer);
689 SSL *s;
700 s = OPENSSL_zalloc(sizeof(*s));
701 if (s == NULL)
704 s->references = 1;
705 s->lock = CRYPTO_THREAD_lock_new();
706 if (s->lock == NULL) {
707 OPENSSL_free(s);
708 s = NULL;
712 RECORD_LAYER_init(&s->rlayer, s);
714 s->options = ctx->options;
715 s->dane.flags = ctx->dane.flags;
716 s->min_proto_version = ctx->min_proto_version;
717 s->max_proto_version = ctx->max_proto_version;
718 s->mode = ctx->mode;
719 s->max_cert_list = ctx->max_cert_list;
720 s->max_early_data = ctx->max_early_data;
721 s->recv_max_early_data = ctx->recv_max_early_data;
722 s->num_tickets = ctx->num_tickets;
723 s->pha_enabled = ctx->pha_enabled;
726 s->tls13_ciphersuites = sk_SSL_CIPHER_dup(ctx->tls13_ciphersuites);
727 if (s->tls13_ciphersuites == NULL)
736 * used to be known as s->ctx->default_cert). Now we don't look at the
737 * SSL_CTX's CERT after having duplicated it once.
739 s->cert = ssl_cert_dup(ctx->cert);
740 if (s->cert == NULL)
743 RECORD_LAYER_set_read_ahead(&s->rlayer, ctx->read_ahead);
744 s->msg_callback = ctx->msg_callback;
745 s->msg_callback_arg = ctx->msg_callback_arg;
746 s->verify_mode = ctx->verify_mode;
747 s->not_resumable_session_cb = ctx->not_resumable_session_cb;
748 s->record_padding_cb = ctx->record_padding_cb;
749 s->record_padding_arg = ctx->record_padding_arg;
750 s->block_padding = ctx->block_padding;
751 s->sid_ctx_length = ctx->sid_ctx_length;
752 if (!ossl_assert(s->sid_ctx_length <= sizeof(s->sid_ctx)))
754 memcpy(&s->sid_ctx, &ctx->sid_ctx, sizeof(s->sid_ctx));
755 s->verify_callback = ctx->default_verify_callback;
756 s->generate_session_id = ctx->generate_session_id;
758 s->param = X509_VERIFY_PARAM_new();
759 if (s->param == NULL)
761 X509_VERIFY_PARAM_inherit(s->param, ctx->param);
762 s->quiet_shutdown = ctx->quiet_shutdown;
764 s->ext.max_fragment_len_mode = ctx->ext.max_fragment_len_mode;
765 s->max_send_fragment = ctx->max_send_fragment;
766 s->split_send_fragment = ctx->split_send_fragment;
767 s->max_pipelines = ctx->max_pipelines;
768 if (s->max_pipelines > 1)
769 RECORD_LAYER_set_read_ahead(&s->rlayer, 1);
771 SSL_set_default_read_buffer_len(s, ctx->default_read_buf_len);
774 s->ctx = ctx;
775 s->ext.debug_cb = 0;
776 s->ext.debug_arg = NULL;
777 s->ext.ticket_expected = 0;
778 s->ext.status_type = ctx->ext.status_type;
779 s->ext.status_expected = 0;
780 s->ext.ocsp.ids = NULL;
781 s->ext.ocsp.exts = NULL;
782 s->ext.ocsp.resp = NULL;
783 s->ext.ocsp.resp_len = 0;
785 s->session_ctx = ctx;
787 s->ext.ecpointformats =
790 if (!s->ext.ecpointformats) {
791 s->ext.ecpointformats_len = 0;
794 s->ext.ecpointformats_len =
798 s->ext.supportedgroups =
802 if (!s->ext.supportedgroups) {
803 s->ext.supportedgroups_len = 0;
806 s->ext.supportedgroups_len = ctx->ext.supportedgroups_len;
810 s->ext.npn = NULL;
813 if (s->ctx->ext.alpn) {
814 s->ext.alpn = OPENSSL_malloc(s->ctx->ext.alpn_len);
815 if (s->ext.alpn == NULL) {
816 s->ext.alpn_len = 0;
819 memcpy(s->ext.alpn, s->ctx->ext.alpn, s->ctx->ext.alpn_len);
820 s->ext.alpn_len = s->ctx->ext.alpn_len;
823 s->verified_chain = NULL;
824 s->verify_result = X509_V_OK;
826 s->default_passwd_callback = ctx->default_passwd_callback;
827 s->default_passwd_callback_userdata = ctx->default_passwd_callback_userdata;
829 s->method = ctx->method;
831 s->key_update = SSL_KEY_UPDATE_NONE;
833 s->allow_early_data_cb = ctx->allow_early_data_cb;
834 s->allow_early_data_cb_data = ctx->allow_early_data_cb_data;
836 if (!s->method->ssl_new(s))
839 s->server = (ctx->method->ssl_accept == ssl_undefined_function) ? 0 : 1;
841 if (!SSL_clear(s))
844 if (!CRYPTO_new_ex_data(CRYPTO_EX_INDEX_SSL, s, &s->ex_data))
848 s->psk_client_callback = ctx->psk_client_callback;
849 s->psk_server_callback = ctx->psk_server_callback;
851 s->psk_find_session_cb = ctx->psk_find_session_cb;
852 s->psk_use_session_cb = ctx->psk_use_session_cb;
854 s->async_cb = ctx->async_cb;
855 s->async_cb_arg = ctx->async_cb_arg;
857 s->job = NULL;
860 if (!SSL_set_ct_validation_callback(s, ctx->ct_validation_callback,
865 return s;
867 SSL_free(s);
872 int SSL_is_dtls(const SSL *s)
874 return SSL_IS_DTLS(s) ? 1 : 0;
877 int SSL_up_ref(SSL *s)
881 if (CRYPTO_UP_REF(&s->references, &i, s->lock) <= 0)
884 REF_PRINT_COUNT("SSL", s);
939 * find if there's a session in the hash table that would conflict with
959 int SSL_CTX_set_purpose(SSL_CTX *s, int purpose)
961 return X509_VERIFY_PARAM_set_purpose(s->param, purpose);
964 int SSL_set_purpose(SSL *s, int purpose)
966 return X509_VERIFY_PARAM_set_purpose(s->param, purpose);
969 int SSL_CTX_set_trust(SSL_CTX *s, int trust)
971 return X509_VERIFY_PARAM_set_trust(s->param, trust);
974 int SSL_set_trust(SSL *s, int trust)
976 return X509_VERIFY_PARAM_set_trust(s->param, trust);
979 int SSL_set1_host(SSL *s, const char *hostname)
983 if (hostname && X509_VERIFY_PARAM_set1_ip_asc(s->param, hostname) == 1)
986 return X509_VERIFY_PARAM_set1_host(s->param, hostname, 0);
989 int SSL_add1_host(SSL *s, const char *hostname)
1003 old_ip = X509_VERIFY_PARAM_get1_ip_asc(s->param);
1011 return X509_VERIFY_PARAM_set1_ip_asc(s->param, hostname);
1015 return X509_VERIFY_PARAM_add1_host(s->param, hostname, 0);
1018 void SSL_set_hostflags(SSL *s, unsigned int flags)
1020 X509_VERIFY_PARAM_set_hostflags(s->param, flags);
1023 const char *SSL_get0_peername(SSL *s)
1025 return X509_VERIFY_PARAM_get0_peername(s->param);
1049 int SSL_dane_enable(SSL *s, const char *basedomain)
1051 SSL_DANE *dane = &s->dane;
1053 if (s->ctx->dane.mdmax == 0) {
1067 if (s->ext.hostname == NULL) {
1068 if (!SSL_set_tlsext_host_name(s, basedomain)) {
1075 if (!X509_VERIFY_PARAM_set1_host(s->param, basedomain, 0)) {
1082 dane->dctx = &s->ctx->dane;
1108 int SSL_get0_dane_authority(SSL *s, X509 **mcert, EVP_PKEY **mspki)
1110 SSL_DANE *dane = &s->dane;
1112 if (!DANETLS_ENABLED(dane) || s->verify_result != X509_V_OK)
1123 int SSL_get0_dane_tlsa(SSL *s, uint8_t *usage, uint8_t *selector,
1126 SSL_DANE *dane = &s->dane;
1128 if (!DANETLS_ENABLED(dane) || s->verify_result != X509_V_OK)
1145 SSL_DANE *SSL_get0_dane(SSL *s)
1147 return &s->dane;
1150 int SSL_dane_tlsa_add(SSL *s, uint8_t usage, uint8_t selector,
1153 return dane_tlsa_add(&s->dane, usage, selector, mtype, data, dlen);
1182 void SSL_certs_clear(SSL *s)
1184 ssl_cert_clear_certs(s->cert);
1187 void SSL_free(SSL *s)
1191 if (s == NULL)
1193 CRYPTO_DOWN_REF(&s->references, &i, s->lock);
1194 REF_PRINT_COUNT("SSL", s);
1199 X509_VERIFY_PARAM_free(s->param);
1200 dane_final(&s->dane);
1201 CRYPTO_free_ex_data(CRYPTO_EX_INDEX_SSL, s, &s->ex_data);
1203 RECORD_LAYER_release(&s->rlayer);
1206 ssl_free_wbio_buffer(s);
1208 BIO_free_all(s->wbio);
1209 s->wbio = NULL;
1210 BIO_free_all(s->rbio);
1211 s->rbio = NULL;
1213 BUF_MEM_free(s->init_buf);
1216 sk_SSL_CIPHER_free(s->cipher_list);
1217 sk_SSL_CIPHER_free(s->cipher_list_by_id);
1218 sk_SSL_CIPHER_free(s->tls13_ciphersuites);
1219 sk_SSL_CIPHER_free(s->peer_ciphers);
1222 if (s->session != NULL) {
1223 ssl_clear_bad_session(s);
1224 SSL_SESSION_free(s->session);
1226 SSL_SESSION_free(s->psksession);
1227 OPENSSL_free(s->psksession_id);
1229 ssl_cert_free(s->cert);
1230 OPENSSL_free(s->shared_sigalgs);
1233 OPENSSL_free(s->ext.hostname);
1234 SSL_CTX_free(s->session_ctx);
1235 OPENSSL_free(s->ext.ecpointformats);
1236 OPENSSL_free(s->ext.peer_ecpointformats);
1237 OPENSSL_free(s->ext.supportedgroups);
1238 OPENSSL_free(s->ext.peer_supportedgroups);
1239 sk_X509_EXTENSION_pop_free(s->ext.ocsp.exts, X509_EXTENSION_free);
1241 sk_OCSP_RESPID_pop_free(s->ext.ocsp.ids, OCSP_RESPID_free);
1244 SCT_LIST_free(s->scts);
1245 OPENSSL_free(s->ext.scts);
1247 OPENSSL_free(s->ext.ocsp.resp);
1248 OPENSSL_free(s->ext.alpn);
1249 OPENSSL_free(s->ext.tls13_cookie);
1250 if (s->clienthello != NULL)
1251 OPENSSL_free(s->clienthello->pre_proc_exts);
1252 OPENSSL_free(s->clienthello);
1253 OPENSSL_free(s->pha_context);
1254 EVP_MD_CTX_free(s->pha_dgst);
1256 sk_X509_NAME_pop_free(s->ca_names, X509_NAME_free);
1257 sk_X509_NAME_pop_free(s->client_ca_names, X509_NAME_free);
1259 sk_X509_pop_free(s->verified_chain, X509_free);
1261 if (s->method != NULL)
1262 s->method->ssl_free(s);
1265 * Must occur after s->method->ssl_free(). The DTLS sent_messages queue
1268 clear_ciphers(s);
1270 SSL_CTX_free(s->ctx);
1272 ASYNC_WAIT_CTX_free(s->waitctx);
1275 OPENSSL_free(s->ext.npn);
1279 sk_SRTP_PROTECTION_PROFILE_free(s->srtp_profiles);
1282 CRYPTO_THREAD_lock_free(s->lock);
1284 OPENSSL_free(s);
1287 void SSL_set0_rbio(SSL *s, BIO *rbio)
1289 BIO_free_all(s->rbio);
1290 s->rbio = rbio;
1293 void SSL_set0_wbio(SSL *s, BIO *wbio)
1298 if (s->bbio != NULL)
1299 s->wbio = BIO_pop(s->wbio);
1301 BIO_free_all(s->wbio);
1302 s->wbio = wbio;
1305 if (s->bbio != NULL)
1306 s->wbio = BIO_push(s->bbio, s->wbio);
1309 void SSL_set_bio(SSL *s, BIO *rbio, BIO *wbio)
1317 if (rbio == SSL_get_rbio(s) && wbio == SSL_get_wbio(s))
1330 if (rbio == SSL_get_rbio(s)) {
1331 SSL_set0_wbio(s, wbio);
1339 if (wbio == SSL_get_wbio(s) && SSL_get_rbio(s) != SSL_get_wbio(s)) {
1340 SSL_set0_rbio(s, rbio);
1345 SSL_set0_rbio(s, rbio);
1346 SSL_set0_wbio(s, wbio);
1349 BIO *SSL_get_rbio(const SSL *s)
1351 return s->rbio;
1354 BIO *SSL_get_wbio(const SSL *s)
1356 if (s->bbio != NULL) {
1361 return BIO_next(s->bbio);
1363 return s->wbio;
1366 int SSL_get_fd(const SSL *s)
1368 return SSL_get_rfd(s);
1371 int SSL_get_rfd(const SSL *s)
1376 b = SSL_get_rbio(s);
1383 int SSL_get_wfd(const SSL *s)
1388 b = SSL_get_wbio(s);
1396 int SSL_set_fd(SSL *s, int fd)
1408 SSL_set_bio(s, bio, bio);
1423 int SSL_set_wfd(SSL *s, int fd)
1425 BIO *rbio = SSL_get_rbio(s);
1436 SSL_set0_wbio(s, bio);
1448 SSL_set0_wbio(s, rbio);
1453 int SSL_set_rfd(SSL *s, int fd)
1455 BIO *wbio = SSL_get_wbio(s);
1466 SSL_set0_rbio(s, bio);
1469 SSL_set0_rbio(s, wbio);
1477 size_t SSL_get_finished(const SSL *s, void *buf, size_t count)
1481 ret = s->s3.tmp.finish_md_len;
1484 memcpy(buf, s->s3.tmp.finish_md, count);
1489 size_t SSL_get_peer_finished(const SSL *s, void *buf, size_t count)
1493 ret = s->s3.tmp.peer_finish_md_len;
1496 memcpy(buf, s->s3.tmp.peer_finish_md, count);
1500 int SSL_get_verify_mode(const SSL *s)
1502 return s->verify_mode;
1505 int SSL_get_verify_depth(const SSL *s)
1507 return X509_VERIFY_PARAM_get_depth(s->param);
1510 int (*SSL_get_verify_callback(const SSL *s)) (int, X509_STORE_CTX *) {
1511 return s->verify_callback;
1528 void SSL_set_verify(SSL *s, int mode,
1531 s->verify_mode = mode;
1533 s->verify_callback = callback;
1536 void SSL_set_verify_depth(SSL *s, int depth)
1538 X509_VERIFY_PARAM_set_depth(s->param, depth);
1541 void SSL_set_read_ahead(SSL *s, int yes)
1543 RECORD_LAYER_set_read_ahead(&s->rlayer, yes);
1546 int SSL_get_read_ahead(const SSL *s)
1548 return RECORD_LAYER_get_read_ahead(&s->rlayer);
1551 int SSL_pending(const SSL *s)
1553 size_t pending = s->method->ssl_pending(s);
1568 int SSL_has_pending(const SSL *s)
1580 if (SSL_IS_DTLS(s)) {
1584 iter = pqueue_iterator(s->rlayer.d->buffered_app_data.q);
1592 if (RECORD_LAYER_processed_read_pending(&s->rlayer))
1595 return RECORD_LAYER_read_pending(&s->rlayer);
1598 X509 *SSL_get1_peer_certificate(const SSL *s)
1600 X509 *r = SSL_get0_peer_certificate(s);
1608 X509 *SSL_get0_peer_certificate(const SSL *s)
1610 if ((s == NULL) || (s->session == NULL))
1613 return s->session->peer;
1616 STACK_OF(X509) *SSL_get_peer_cert_chain(const SSL *s)
1620 if ((s == NULL) || (s->session == NULL))
1623 r = s->session->peer_chain;
1626 * If we are a client, cert_chain includes the peer's own certificate; if
1699 int SSL_waiting_for_async(SSL *s)
1701 if (s->job)
1707 int SSL_get_all_async_fds(SSL *s, OSSL_ASYNC_FD *fds, size_t *numfds)
1709 ASYNC_WAIT_CTX *ctx = s->waitctx;
1716 int SSL_get_changed_async_fds(SSL *s, OSSL_ASYNC_FD *addfd, size_t *numaddfds,
1719 ASYNC_WAIT_CTX *ctx = s->waitctx;
1739 int SSL_set_async_callback(SSL *s, SSL_async_callback_fn callback)
1741 s->async_cb = callback;
1745 int SSL_set_async_callback_arg(SSL *s, void *arg)
1747 s->async_cb_arg = arg;
1751 int SSL_get_async_status(SSL *s, int *status)
1753 ASYNC_WAIT_CTX *ctx = s->waitctx;
1761 int SSL_accept(SSL *s)
1763 if (s->handshake_func == NULL) {
1765 SSL_set_accept_state(s);
1768 return SSL_do_handshake(s);
1771 int SSL_connect(SSL *s)
1773 if (s->handshake_func == NULL) {
1775 SSL_set_connect_state(s);
1778 return SSL_do_handshake(s);
1781 long SSL_get_default_timeout(const SSL *s)
1783 return s->method->get_timeout();
1788 SSL *s = (SSL *)arg;
1790 return s->async_cb(s, s->async_cb_arg);
1793 static int ssl_start_async_job(SSL *s, struct ssl_async_args *args,
1797 if (s->waitctx == NULL) {
1798 s->waitctx = ASYNC_WAIT_CTX_new();
1799 if (s->waitctx == NULL)
1801 if (s->async_cb != NULL
1803 (s->waitctx, ssl_async_wait_ctx_cb, s))
1807 s->rwstate = SSL_NOTHING;
1808 switch (ASYNC_start_job(&s->job, s->waitctx, &ret, func, args,
1811 s->rwstate = SSL_NOTHING;
1815 s->rwstate = SSL_ASYNC_PAUSED;
1818 s->rwstate = SSL_ASYNC_NO_JOBS;
1821 s->job = NULL;
1824 s->rwstate = SSL_NOTHING;
1834 SSL *s;
1839 s = args->s;
1844 return args->f.func_read(s, buf, num, &s->asyncrw);
1846 return args->f.func_write(s, buf, num, &s->asyncrw);
1848 return args->f.func_other(s);
1853 int ssl_read_internal(SSL *s, void *buf, size_t num, size_t *readbytes)
1855 if (s->handshake_func == NULL) {
1860 if (s->shutdown & SSL_RECEIVED_SHUTDOWN) {
1861 s->rwstate = SSL_NOTHING;
1865 if (s->early_data_state == SSL_EARLY_DATA_CONNECT_RETRY
1866 || s->early_data_state == SSL_EARLY_DATA_ACCEPT_RETRY) {
1874 ossl_statem_check_finish_init(s, 0);
1876 if ((s->mode & SSL_MODE_ASYNC) && ASYNC_get_current_job() == NULL) {
1880 args.s = s;
1884 args.f.func_read = s->method->ssl_read;
1886 ret = ssl_start_async_job(s, &args, ssl_io_intern);
1887 *readbytes = s->asyncrw;
1890 return s->method->ssl_read(s, buf, num, readbytes);
1894 int SSL_read(SSL *s, void *buf, int num)
1904 ret = ssl_read_internal(s, buf, (size_t)num, &readbytes);
1916 int SSL_read_ex(SSL *s, void *buf, size_t num, size_t *readbytes)
1918 int ret = ssl_read_internal(s, buf, num, readbytes);
1925 int SSL_read_early_data(SSL *s, void *buf, size_t num, size_t *readbytes)
1929 if (!s->server) {
1934 switch (s->early_data_state) {
1936 if (!SSL_in_before(s)) {
1943 s->early_data_state = SSL_EARLY_DATA_ACCEPTING;
1944 ret = SSL_accept(s);
1947 s->early_data_state = SSL_EARLY_DATA_ACCEPT_RETRY;
1953 if (s->ext.early_data == SSL_EARLY_DATA_ACCEPTED) {
1954 s->early_data_state = SSL_EARLY_DATA_READING;
1955 ret = SSL_read_ex(s, buf, num, readbytes);
1961 if (ret > 0 || (ret <= 0 && s->early_data_state
1963 s->early_data_state = SSL_EARLY_DATA_READ_RETRY;
1968 s->early_data_state = SSL_EARLY_DATA_FINISHED_READING;
1979 int SSL_get_early_data_status(const SSL *s)
1981 return s->ext.early_data;
1984 static int ssl_peek_internal(SSL *s, void *buf, size_t num, size_t *readbytes)
1986 if (s->handshake_func == NULL) {
1991 if (s->shutdown & SSL_RECEIVED_SHUTDOWN) {
1994 if ((s->mode & SSL_MODE_ASYNC) && ASYNC_get_current_job() == NULL) {
1998 args.s = s;
2002 args.f.func_read = s->method->ssl_peek;
2004 ret = ssl_start_async_job(s, &args, ssl_io_intern);
2005 *readbytes = s->asyncrw;
2008 return s->method->ssl_peek(s, buf, num, readbytes);
2012 int SSL_peek(SSL *s, void *buf, int num)
2022 ret = ssl_peek_internal(s, buf, (size_t)num, &readbytes);
2035 int SSL_peek_ex(SSL *s, void *buf, size_t num, size_t *readbytes)
2037 int ret = ssl_peek_internal(s, buf, num, readbytes);
2044 int ssl_write_internal(SSL *s, const void *buf, size_t num, size_t *written)
2046 if (s->handshake_func == NULL) {
2051 if (s->shutdown & SSL_SENT_SHUTDOWN) {
2052 s->rwstate = SSL_NOTHING;
2057 if (s->early_data_state == SSL_EARLY_DATA_CONNECT_RETRY
2058 || s->early_data_state == SSL_EARLY_DATA_ACCEPT_RETRY
2059 || s->early_data_state == SSL_EARLY_DATA_READ_RETRY) {
2064 ossl_statem_check_finish_init(s, 1);
2066 if ((s->mode & SSL_MODE_ASYNC) && ASYNC_get_current_job() == NULL) {
2070 args.s = s;
2074 args.f.func_write = s->method->ssl_write;
2076 ret = ssl_start_async_job(s, &args, ssl_io_intern);
2077 *written = s->asyncrw;
2080 return s->method->ssl_write(s, buf, num, written);
2084 ossl_ssize_t SSL_sendfile(SSL *s, int fd, off_t offset, size_t size, int flags)
2088 if (s->handshake_func == NULL) {
2093 if (s->shutdown & SSL_SENT_SHUTDOWN) {
2094 s->rwstate = SSL_NOTHING;
2099 if (!BIO_get_ktls_send(s->wbio)) {
2105 if (s->s3.alert_dispatch) {
2106 ret = (ossl_ssize_t)s->method->ssl_dispatch_alert(s);
2114 s->rwstate = SSL_WRITING;
2115 if (BIO_flush(s->wbio) <= 0) {
2116 if (!BIO_should_retry(s->wbio)) {
2117 s->rwstate = SSL_NOTHING;
2131 ret = ktls_sendfile(SSL_get_wfd(s), fd, offset, size, flags);
2137 BIO_set_retry_write(s->wbio);
2143 s->rwstate = SSL_NOTHING;
2148 int SSL_write(SSL *s, const void *buf, int num)
2158 ret = ssl_write_internal(s, buf, (size_t)num, &written);
2170 int SSL_write_ex(SSL *s, const void *buf, size_t num, size_t *written)
2172 int ret = ssl_write_internal(s, buf, num, written);
2179 int SSL_write_early_data(SSL *s, const void *buf, size_t num, size_t *written)
2185 switch (s->early_data_state) {
2187 if (s->server
2188 || !SSL_in_before(s)
2189 || ((s->session == NULL || s->session->ext.max_early_data == 0)
2190 && (s->psk_use_session_cb == NULL))) {
2197 s->early_data_state = SSL_EARLY_DATA_CONNECTING;
2198 ret = SSL_connect(s);
2201 s->early_data_state = SSL_EARLY_DATA_CONNECT_RETRY;
2207 s->early_data_state = SSL_EARLY_DATA_WRITING;
2213 partialwrite = s->mode & SSL_MODE_ENABLE_PARTIAL_WRITE;
2214 s->mode &= ~SSL_MODE_ENABLE_PARTIAL_WRITE;
2215 ret = SSL_write_ex(s, buf, num, &writtmp);
2216 s->mode |= partialwrite;
2218 s->early_data_state = SSL_EARLY_DATA_WRITE_RETRY;
2221 s->early_data_state = SSL_EARLY_DATA_WRITE_FLUSH;
2226 if (statem_flush(s) != 1)
2229 s->early_data_state = SSL_EARLY_DATA_WRITE_RETRY;
2234 early_data_state = s->early_data_state;
2236 s->early_data_state = SSL_EARLY_DATA_UNAUTH_WRITING;
2237 ret = SSL_write_ex(s, buf, num, written);
2240 (void)BIO_flush(s->wbio);
2241 s->early_data_state = early_data_state;
2250 int SSL_shutdown(SSL *s)
2259 if (s->handshake_func == NULL) {
2264 if (!SSL_in_init(s)) {
2265 if ((s->mode & SSL_MODE_ASYNC) && ASYNC_get_current_job() == NULL) {
2269 args.s = s;
2271 args.f.func_other = s->method->ssl_shutdown;
2273 return ssl_start_async_job(s, &args, ssl_io_intern);
2275 return s->method->ssl_shutdown(s);
2283 int SSL_key_update(SSL *s, int updatetype)
2285 if (!SSL_IS_TLS13(s)) {
2296 if (!SSL_is_init_finished(s)) {
2301 if (RECORD_LAYER_write_pending(&s->rlayer)) {
2306 ossl_statem_set_in_init(s, 1);
2307 s->key_update = updatetype;
2311 int SSL_get_key_update_type(const SSL *s)
2313 return s->key_update;
2320 static int can_renegotiate(const SSL *s)
2322 if (SSL_IS_TLS13(s)) {
2327 if ((s->options & SSL_OP_NO_RENEGOTIATION) != 0) {
2335 int SSL_renegotiate(SSL *s)
2337 if (!can_renegotiate(s))
2340 s->renegotiate = 1;
2341 s->new_session = 1;
2342 return s->method->ssl_renegotiate(s);
2345 int SSL_renegotiate_abbreviated(SSL *s)
2347 if (!can_renegotiate(s))
2350 s->renegotiate = 1;
2351 s->new_session = 0;
2352 return s->method->ssl_renegotiate(s);
2355 int SSL_renegotiate_pending(const SSL *s)
2361 return (s->renegotiate != 0);
2364 int SSL_new_session_ticket(SSL *s)
2367 if ((SSL_in_init(s) && s->ext.extra_tickets_expected == 0)
2368 || SSL_IS_FIRST_HANDSHAKE(s) || !s->server
2369 || !SSL_IS_TLS13(s))
2371 s->ext.extra_tickets_expected++;
2372 if (!RECORD_LAYER_write_pending(&s->rlayer) && !SSL_in_init(s))
2373 ossl_statem_set_in_init(s, 1);
2377 long SSL_ctrl(SSL *s, int cmd, long larg, void *parg)
2383 return RECORD_LAYER_get_read_ahead(&s->rlayer);
2385 l = RECORD_LAYER_get_read_ahead(&s->rlayer);
2386 RECORD_LAYER_set_read_ahead(&s->rlayer, larg);
2390 s->msg_callback_arg = parg;
2394 return (s->mode |= larg);
2396 return (s->mode &= ~larg);
2398 return (long)s->max_cert_list;
2402 l = (long)s->max_cert_list;
2403 s->max_cert_list = (size_t)larg;
2409 if (s->wbio != NULL && BIO_get_ktls_send(s->wbio))
2412 s->max_send_fragment = larg;
2413 if (s->max_send_fragment < s->split_send_fragment)
2414 s->split_send_fragment = s->max_send_fragment;
2417 if ((size_t)larg > s->max_send_fragment || larg == 0)
2419 s->split_send_fragment = larg;
2424 s->max_pipelines = larg;
2426 RECORD_LAYER_set_read_ahead(&s->rlayer, 1);
2429 return s->s3.send_connection_binding;
2431 s->rwstate = SSL_RETRY_VERIFY;
2434 return (s->cert->cert_flags |= larg);
2436 return (s->cert->cert_flags &= ~larg);
2440 if (s->s3.tmp.ciphers_raw == NULL)
2442 *(unsigned char **)parg = s->s3.tmp.ciphers_raw;
2443 return (int)s->s3.tmp.ciphers_rawlen;
2448 if (!s->session || SSL_in_init(s) || ossl_statem_get_in_handshake(s))
2450 if (s->session->flags & SSL_SESS_FLAG_EXTMS)
2455 return ssl_check_allowed_versions(larg, s->max_proto_version)
2456 && ssl_set_version_bound(s->ctx->method->version, (int)larg,
2457 &s->min_proto_version);
2459 return s->min_proto_version;
2461 return ssl_check_allowed_versions(s->min_proto_version, larg)
2462 && ssl_set_version_bound(s->ctx->method->version, (int)larg,
2463 &s->max_proto_version);
2465 return s->max_proto_version;
2467 return s->method->ssl_ctrl(s, cmd, larg, parg);
2471 long SSL_callback_ctrl(SSL *s, int cmd, void (*fp) (void))
2475 s->msg_callback = (void (*)
2482 return s->method->ssl_callback_ctrl(s, cmd, fp);
2656 STACK_OF(SSL_CIPHER) *SSL_get_ciphers(const SSL *s)
2658 if (s != NULL) {
2659 if (s->cipher_list != NULL) {
2660 return s->cipher_list;
2661 } else if ((s->ctx != NULL) && (s->ctx->cipher_list != NULL)) {
2662 return s->ctx->cipher_list;
2668 STACK_OF(SSL_CIPHER) *SSL_get_client_ciphers(const SSL *s)
2670 if ((s == NULL) || !s->server)
2672 return s->peer_ciphers;
2675 STACK_OF(SSL_CIPHER) *SSL_get1_supported_ciphers(SSL *s)
2680 ciphers = SSL_get_ciphers(s);
2683 if (!ssl_set_client_disabled(s))
2687 if (!ssl_cipher_disabled(s, c, SSL_SECOP_CIPHER_SUPPORTED, 0)) {
2703 STACK_OF(SSL_CIPHER) *ssl_get_ciphers_by_id(SSL *s)
2705 if (s != NULL) {
2706 if (s->cipher_list_by_id != NULL) {
2707 return s->cipher_list_by_id;
2708 } else if ((s->ctx != NULL) && (s->ctx->cipher_list_by_id != NULL)) {
2709 return s->ctx->cipher_list_by_id;
2716 const char *SSL_get_cipher_list(const SSL *s, int n)
2721 if (s == NULL)
2723 sk = SSL_get_ciphers(s);
2786 int SSL_set_cipher_list(SSL *s, const char *str)
2790 sk = ssl_create_cipher_list(s->ctx, s->tls13_ciphersuites,
2791 &s->cipher_list, &s->cipher_list_by_id, str,
2792 s->cert);
2803 char *SSL_get_shared_ciphers(const SSL *s, char *buf, int size)
2810 if (!s->server
2811 || s->peer_ciphers == NULL
2816 clntsk = s->peer_ciphers;
2817 srvrsk = SSL_get_ciphers(s);
2857 const char *SSL_get_servername(const SSL *s, const int type)
2863 int server = s->handshake_func == NULL ? 0 : s->server;
2884 if (s->hit && !SSL_IS_TLS13(s))
2885 return s->session->ext.hostname;
2909 if (SSL_in_before(s)) {
2910 if (s->ext.hostname == NULL
2911 && s->session != NULL
2912 && s->session->ssl_version != TLS1_3_VERSION)
2913 return s->session->ext.hostname;
2915 if (!SSL_IS_TLS13(s) && s->hit && s->session->ext.hostname != NULL)
2916 return s->session->ext.hostname;
2920 return s->ext.hostname;
2923 int SSL_get_servername_type(const SSL *s)
2925 if (SSL_get_servername(s, TLSEXT_NAMETYPE_host_name) != NULL)
2943 * protocol in the server's list that it supports and selects this protocol.
2944 * This is because it's assumed that the server has better information about
2946 * of the server's advertised protocols, then this is treated the same as
2999 * There's no overlap between our protocols and the server's list. We use
3008 * client's requested protocol for this connection and returns 0. If the
3014 void SSL_get0_next_proto_negotiated(const SSL *s, const unsigned char **data,
3017 *data = s->ext.npn;
3021 *len = (unsigned int)s->ext.npn_len;
3045 * client needs to select a protocol from the server's provided list. |out|
3048 * server's advertised protocols are provided in |in| and |inlen|. The
3142 * from the client's list of offered protocols.
3168 int SSL_export_keying_material(SSL *s, unsigned char *out, size_t olen,
3173 if (s->session == NULL
3174 || (s->version < TLS1_VERSION && s->version != DTLS1_BAD_VER))
3177 return s->method->ssl3_enc->export_keying_material(s, out, olen, label,
3182 int SSL_export_keying_material_early(SSL *s, unsigned char *out, size_t olen,
3187 if (s->version != TLS1_3_VERSION)
3190 return tls13_export_keying_material_early(s, out, olen, label, llen,
3336 * That's fine but will cause errors later if SSLv3 is negotiated
3570 void SSL_set_default_passwd_cb(SSL *s, pem_password_cb *cb)
3572 s->default_passwd_callback = cb;
3575 void SSL_set_default_passwd_cb_userdata(SSL *s, void *u)
3577 s->default_passwd_callback_userdata = u;
3580 pem_password_cb *SSL_get_default_passwd_cb(SSL *s)
3582 return s->default_passwd_callback;
3585 void *SSL_get_default_passwd_cb_userdata(SSL *s)
3587 return s->default_passwd_callback_userdata;
3615 void SSL_set_cert_cb(SSL *s, int (*cb) (SSL *ssl, void *arg), void *arg)
3617 ssl_cert_set_cert_cb(s->cert, cb, arg);
3620 void ssl_set_masks(SSL *s)
3622 CERT *c = s->cert;
3623 uint32_t *pvalid = s->s3.tmp.valid_flags;
3646 if (ssl_has_cert(s, SSL_PKEY_GOST12_512)) {
3650 if (ssl_has_cert(s, SSL_PKEY_GOST12_256)) {
3654 if (ssl_has_cert(s, SSL_PKEY_GOST01)) {
3671 if (rsa_enc || rsa_sign || (ssl_has_cert(s, SSL_PKEY_RSA_PSS_SIGN)
3673 && TLS1_get_version(s) == TLS1_2_VERSION))
3696 if (!(mask_a & SSL_aECDSA) && ssl_has_cert(s, SSL_PKEY_ED25519)
3698 && TLS1_get_version(s) == TLS1_2_VERSION)
3702 if (!(mask_a & SSL_aECDSA) && ssl_has_cert(s, SSL_PKEY_ED448)
3704 && TLS1_get_version(s) == TLS1_2_VERSION)
3720 s->s3.tmp.mask_k = mask_k;
3721 s->s3.tmp.mask_a = mask_a;
3724 int ssl_check_srvr_ecc_cert_and_alg(X509 *x, SSL *s)
3726 if (s->s3.tmp.new_cipher->algorithm_auth & SSL_aECDSA) {
3736 int ssl_get_server_cert_serverinfo(SSL *s, const unsigned char **serverinfo,
3739 CERT_PKEY *cpk = s->s3.tmp.cert;
3750 void ssl_update_cache(SSL *s, int mode)
3759 if (s->session->session_id_length == 0 || s->session->not_resumable)
3771 if (s->server && s->session->sid_ctx_length == 0
3772 && (s->verify_mode & SSL_VERIFY_PEER) != 0)
3775 i = s->session_ctx->session_cache_mode;
3777 && (!s->hit || SSL_IS_TLS13(s))) {
3780 * normally don't do this because by default it's a full stateless ticket
3790 && (!SSL_IS_TLS13(s)
3791 || !s->server
3792 || (s->max_early_data > 0
3793 && (s->options & SSL_OP_NO_ANTI_REPLAY) == 0)
3794 || s->session_ctx->remove_session_cb != NULL
3795 || (s->options & SSL_OP_NO_TICKET) != 0))
3796 SSL_CTX_add_session(s->session_ctx, s->session);
3803 if (s->session_ctx->new_session_cb != NULL) {
3804 SSL_SESSION_up_ref(s->session);
3805 if (!s->session_ctx->new_session_cb(s, s->session))
3806 SSL_SESSION_free(s->session);
3815 stat = &s->session_ctx->stats.sess_connect_good;
3817 stat = &s->session_ctx->stats.sess_accept_good;
3818 if ((ssl_tsan_load(s->session_ctx, stat) & 0xff) == 0xff)
3819 SSL_CTX_flush_sessions(s->session_ctx, (unsigned long)time(NULL));
3828 const SSL_METHOD *SSL_get_ssl_method(const SSL *s)
3830 return s->method;
3833 int SSL_set_ssl_method(SSL *s, const SSL_METHOD *meth)
3837 if (s->method != meth) {
3838 const SSL_METHOD *sm = s->method;
3839 int (*hf) (SSL *) = s->handshake_func;
3842 s->method = meth;
3844 sm->ssl_free(s);
3845 s->method = meth;
3846 ret = s->method->ssl_new(s);
3850 s->handshake_func = meth->ssl_connect;
3852 s->handshake_func = meth->ssl_accept;
3857 int SSL_get_error(const SSL *s, int i)
3877 if (SSL_want_read(s)) {
3878 bio = SSL_get_rbio(s);
3886 * However if we ever set s->rwstate incorrectly (so that we have
3887 * SSL_want_read(s) instead of SSL_want_write(s)) and rbio and
3903 if (SSL_want_write(s)) {
3905 bio = s->wbio;
3910 * See above (SSL_want_read(s) with BIO_should_write(bio))
3923 if (SSL_want_x509_lookup(s))
3925 if (SSL_want_retry_verify(s))
3927 if (SSL_want_async(s))
3929 if (SSL_want_async_job(s))
3931 if (SSL_want_client_hello_cb(s))
3934 if ((s->shutdown & SSL_RECEIVED_SHUTDOWN) &&
3935 (s->s3.warn_alert == SSL_AD_CLOSE_NOTIFY))
3944 SSL *s;
3947 s = args->s;
3949 return s->handshake_func(s);
3952 int SSL_do_handshake(SSL *s)
3956 if (s->handshake_func == NULL) {
3961 ossl_statem_check_finish_init(s, -1);
3963 s->method->ssl_renegotiate_check(s, 0);
3965 if (SSL_in_init(s) || SSL_in_before(s)) {
3966 if ((s->mode & SSL_MODE_ASYNC) && ASYNC_get_current_job() == NULL) {
3970 args.s = s;
3972 ret = ssl_start_async_job(s, &args, ssl_do_handshake_intern);
3974 ret = s->handshake_func(s);
3980 void SSL_set_accept_state(SSL *s)
3982 s->server = 1;
3983 s->shutdown = 0;
3984 ossl_statem_clear(s);
3985 s->handshake_func = s->method->ssl_accept;
3986 clear_ciphers(s);
3989 void SSL_set_connect_state(SSL *s)
3991 s->server = 0;
3992 s->shutdown = 0;
3993 ossl_statem_clear(s);
3994 s->handshake_func = s->method->ssl_connect;
3995 clear_ciphers(s);
3998 int ssl_undefined_function(SSL *s)
4010 int ssl_undefined_const_function(const SSL *s)
4054 const char *SSL_get_version(const SSL *s)
4056 return ssl_protocol_to_string(s->version);
4089 SSL *SSL_dup(SSL *s)
4095 if (!SSL_in_init(s) || !SSL_in_before(s)) {
4096 CRYPTO_UP_REF(&s->references, &i, s->lock);
4097 return s;
4103 if ((ret = SSL_new(SSL_get_SSL_CTX(s))) == NULL)
4106 if (s->session != NULL) {
4111 if (!SSL_copy_session_id(ret, s))
4116 * s->cert or ret->cert will be changed later -- they should not both
4120 if (!SSL_set_ssl_method(ret, s->method))
4123 if (s->cert != NULL) {
4125 ret->cert = ssl_cert_dup(s->cert);
4130 if (!SSL_set_session_id_context(ret, s->sid_ctx,
4131 (int)s->sid_ctx_length))
4135 if (!ssl_dane_dup(ret, s))
4137 ret->version = s->version;
4138 ret->options = s->options;
4139 ret->min_proto_version = s->min_proto_version;
4140 ret->max_proto_version = s->max_proto_version;
4141 ret->mode = s->mode;
4142 SSL_set_max_cert_list(ret, SSL_get_max_cert_list(s));
4143 SSL_set_read_ahead(ret, SSL_get_read_ahead(s));
4144 ret->msg_callback = s->msg_callback;
4145 ret->msg_callback_arg = s->msg_callback_arg;
4146 SSL_set_verify(ret, SSL_get_verify_mode(s), SSL_get_verify_callback(s));
4147 SSL_set_verify_depth(ret, SSL_get_verify_depth(s));
4148 ret->generate_session_id = s->generate_session_id;
4150 SSL_set_info_callback(ret, SSL_get_info_callback(s));
4153 if (!CRYPTO_dup_ex_data(CRYPTO_EX_INDEX_SSL, &ret->ex_data, &s->ex_data))
4156 ret->server = s->server;
4157 if (s->handshake_func) {
4158 if (s->server)
4163 ret->shutdown = s->shutdown;
4164 ret->hit = s->hit;
4166 ret->default_passwd_callback = s->default_passwd_callback;
4167 ret->default_passwd_callback_userdata = s->default_passwd_callback_userdata;
4169 X509_VERIFY_PARAM_inherit(ret->param, s->param);
4172 if (s->cipher_list != NULL) {
4173 if ((ret->cipher_list = sk_SSL_CIPHER_dup(s->cipher_list)) == NULL)
4176 if (s->cipher_list_by_id != NULL)
4177 if ((ret->cipher_list_by_id = sk_SSL_CIPHER_dup(s->cipher_list_by_id))
4182 if (!dup_ca_names(&ret->ca_names, s->ca_names)
4183 || !dup_ca_names(&ret->client_ca_names, s->client_ca_names))
4193 void ssl_clear_cipher_ctx(SSL *s)
4195 if (s->enc_read_ctx != NULL) {
4196 EVP_CIPHER_CTX_free(s->enc_read_ctx);
4197 s->enc_read_ctx = NULL;
4199 if (s->enc_write_ctx != NULL) {
4200 EVP_CIPHER_CTX_free(s->enc_write_ctx);
4201 s->enc_write_ctx = NULL;
4204 COMP_CTX_free(s->expand);
4205 s->expand = NULL;
4206 COMP_CTX_free(s->compress);
4207 s->compress = NULL;
4211 X509 *SSL_get_certificate(const SSL *s)
4213 if (s->cert != NULL)
4214 return s->cert->key->x509;
4219 EVP_PKEY *SSL_get_privatekey(const SSL *s)
4221 if (s->cert != NULL)
4222 return s->cert->key->privatekey;
4243 const SSL_CIPHER *SSL_get_current_cipher(const SSL *s)
4245 if ((s->session != NULL) && (s->session->cipher != NULL))
4246 return s->session->cipher;
4250 const SSL_CIPHER *SSL_get_pending_cipher(const SSL *s)
4252 return s->s3.tmp.new_cipher;
4255 const COMP_METHOD *SSL_get_current_compression(const SSL *s)
4258 return s->compress ? COMP_CTX_get_method(s->compress) : NULL;
4264 const COMP_METHOD *SSL_get_current_expansion(const SSL *s)
4267 return s->expand ? COMP_CTX_get_method(s->expand) : NULL;
4273 int ssl_init_wbio_buffer(SSL *s)
4277 if (s->bbio != NULL) {
4288 s->bbio = bbio;
4289 s->wbio = BIO_push(bbio, s->wbio);
4294 int ssl_free_wbio_buffer(SSL *s)
4296 /* callers ensure s is never null */
4297 if (s->bbio == NULL)
4300 s->wbio = BIO_pop(s->wbio);
4301 BIO_free(s->bbio);
4302 s->bbio = NULL;
4317 void SSL_set_quiet_shutdown(SSL *s, int mode)
4319 s->quiet_shutdown = mode;
4322 int SSL_get_quiet_shutdown(const SSL *s)
4324 return s->quiet_shutdown;
4327 void SSL_set_shutdown(SSL *s, int mode)
4329 s->shutdown = mode;
4332 int SSL_get_shutdown(const SSL *s)
4334 return s->shutdown;
4337 int SSL_version(const SSL *s)
4339 return s->version;
4342 int SSL_client_version(const SSL *s)
4344 return s->client_version;
4558 int SSL_set_ex_data(SSL *s, int idx, void *arg)
4560 return CRYPTO_set_ex_data(&s->ex_data, idx, arg);
4563 void *SSL_get_ex_data(const SSL *s, int idx)
4565 return CRYPTO_get_ex_data(&s->ex_data, idx);
4568 int SSL_CTX_set_ex_data(SSL_CTX *s, int idx, void *arg)
4570 return CRYPTO_set_ex_data(&s->ex_data, idx, arg);
4573 void *SSL_CTX_get_ex_data(const SSL_CTX *s, int idx)
4575 return CRYPTO_get_ex_data(&s->ex_data, idx);
4596 int SSL_want(const SSL *s)
4598 return s->rwstate;
4618 int SSL_use_psk_identity_hint(SSL *s, const char *identity_hint)
4620 if (s == NULL)
4627 OPENSSL_free(s->cert->psk_identity_hint);
4629 s->cert->psk_identity_hint = OPENSSL_strdup(identity_hint);
4630 if (s->cert->psk_identity_hint == NULL)
4633 s->cert->psk_identity_hint = NULL;
4637 const char *SSL_get_psk_identity_hint(const SSL *s)
4639 if (s == NULL || s->session == NULL)
4641 return s->session->psk_identity_hint;
4644 const char *SSL_get_psk_identity(const SSL *s)
4646 if (s == NULL || s->session == NULL)
4648 return s->session->psk_identity;
4651 void SSL_set_psk_client_callback(SSL *s, SSL_psk_client_cb_func cb)
4653 s->psk_client_callback = cb;
4661 void SSL_set_psk_server_callback(SSL *s, SSL_psk_server_cb_func cb)
4663 s->psk_server_callback = cb;
4672 void SSL_set_psk_find_session_callback(SSL *s, SSL_psk_find_session_cb_func cb)
4674 s->psk_find_session_cb = cb;
4683 void SSL_set_psk_use_session_callback(SSL *s, SSL_psk_use_session_cb_func cb)
4685 s->psk_use_session_cb = cb;
4792 int SSL_set_num_tickets(SSL *s, size_t num_tickets)
4794 s->num_tickets = num_tickets;
4799 size_t SSL_get_num_tickets(const SSL *s)
4801 return s->num_tickets;
4843 int ssl_handshake_hash(SSL *s, unsigned char *out, size_t outlen,
4847 EVP_MD_CTX *hdgst = s->s3.handshake_dgst;
4852 SSLfatal(s, SSL_AD_INTERNAL_ERROR, ERR_R_INTERNAL_ERROR);
4858 SSLfatal(s, SSL_AD_INTERNAL_ERROR, ERR_R_INTERNAL_ERROR);
4864 SSLfatal(s, SSL_AD_INTERNAL_ERROR, ERR_R_INTERNAL_ERROR);
4876 int SSL_session_reused(const SSL *s)
4878 return s->hit;
4881 int SSL_is_server(const SSL *s)
4883 return s->server;
4887 void SSL_set_debug(SSL *s, int debug)
4890 (void)s;
4895 void SSL_set_security_level(SSL *s, int level)
4897 s->cert->sec_level = level;
4900 int SSL_get_security_level(const SSL *s)
4902 return s->cert->sec_level;
4905 void SSL_set_security_callback(SSL *s,
4906 int (*cb) (const SSL *s, const SSL_CTX *ctx,
4910 s->cert->sec_cb = cb;
4913 int (*SSL_get_security_callback(const SSL *s)) (const SSL *s,
4917 return s->cert->sec_cb;
4920 void SSL_set0_security_ex_data(SSL *s, void *ex)
4922 s->cert->sec_ex = ex;
4925 void *SSL_get0_security_ex_data(const SSL *s)
4927 return s->cert->sec_ex;
4941 int (*cb) (const SSL *s, const SSL_CTX *ctx,
4948 int (*SSL_CTX_get_security_callback(const SSL_CTX *ctx)) (const SSL *s,
4972 uint64_t SSL_get_options(const SSL *s)
4974 return s->options;
4982 uint64_t SSL_set_options(SSL *s, uint64_t op)
4984 return s->options |= op;
4992 uint64_t SSL_clear_options(SSL *s, uint64_t op)
4994 return s->options &= ~op;
4997 STACK_OF(X509) *SSL_get0_verified_chain(const SSL *s)
4999 return s->verified_chain;
5048 static int ct_extract_tls_extension_scts(SSL *s)
5052 if (s->ext.scts != NULL) {
5053 const unsigned char *p = s->ext.scts;
5054 STACK_OF(SCT) *scts = o2i_SCT_LIST(NULL, &p, s->ext.scts_len);
5056 scts_extracted = ct_move_scts(&s->scts, scts, SCT_SOURCE_TLS_EXTENSION);
5066 * contains an SCT X509 extension. They will be stored in |s->scts|.
5072 static int ct_extract_ocsp_response_scts(SSL *s)
5082 if (s->ext.ocsp.resp == NULL || s->ext.ocsp.resp_len == 0)
5085 p = s->ext.ocsp.resp;
5086 rsp = d2i_OCSP_RESPONSE(NULL, &p, (int)s->ext.ocsp.resp_len);
5103 ct_move_scts(&s->scts, scts, SCT_SOURCE_OCSP_STAPLED_RESPONSE);
5123 static int ct_extract_x509v3_extension_scts(SSL *s)
5126 X509 *cert = s->session != NULL ? s->session->peer : NULL;
5133 ct_move_scts(&s->scts, scts, SCT_SOURCE_X509V3_EXTENSION);
5146 const STACK_OF(SCT) *SSL_get0_peer_scts(SSL *s)
5148 if (!s->scts_parsed) {
5149 if (ct_extract_tls_extension_scts(s) < 0 ||
5150 ct_extract_ocsp_response_scts(s) < 0 ||
5151 ct_extract_x509v3_extension_scts(s) < 0)
5154 s->scts_parsed = 1;
5156 return s->scts;
5184 int SSL_set_ct_validation_callback(SSL *s, ssl_ct_validation_cb callback,
5191 if (callback != NULL && SSL_CTX_has_client_custom_ext(s->ctx,
5202 if (!SSL_set_tlsext_status_type(s, TLSEXT_STATUSTYPE_ocsp))
5206 s->ct_validation_callback = callback;
5207 s->ct_validation_callback_arg = arg;
5231 int SSL_ct_is_enabled(const SSL *s)
5233 return s->ct_validation_callback != NULL;
5241 int ssl_validate_ct(SSL *s)
5244 X509 *cert = s->session != NULL ? s->session->peer : NULL;
5246 SSL_DANE *dane = &s->dane;
5261 if (s->ct_validation_callback == NULL || cert == NULL ||
5262 s->verify_result != X509_V_OK ||
5263 s->verified_chain == NULL || sk_X509_num(s->verified_chain) <= 1)
5278 ctx = CT_POLICY_EVAL_CTX_new_ex(s->ctx->libctx, s->ctx->propq);
5280 SSLfatal(s, SSL_AD_INTERNAL_ERROR, ERR_R_MALLOC_FAILURE);
5284 issuer = sk_X509_value(s->verified_chain, 1);
5287 CT_POLICY_EVAL_CTX_set_shared_CTLOG_STORE(ctx, s->ctx->ctlog_store);
5289 ctx, (uint64_t)SSL_SESSION_get_time(SSL_get0_session(s)) * 1000);
5291 scts = SSL_get0_peer_scts(s);
5308 SSLfatal(s, SSL_AD_HANDSHAKE_FAILURE, SSL_R_SCT_VERIFICATION_FAILED);
5312 ret = s->ct_validation_callback(ctx, scts, s->ct_validation_callback_arg);
5316 SSLfatal(s, SSL_AD_HANDSHAKE_FAILURE, SSL_R_CALLBACK_FAILED);
5336 s->verify_result = X509_V_ERR_NO_VALID_SCTS;
5353 int SSL_enable_ct(SSL *s, int validation_mode)
5360 return SSL_set_ct_validation_callback(s, ct_permissive, NULL);
5362 return SSL_set_ct_validation_callback(s, ct_strict, NULL);
5396 int SSL_client_hello_isv2(SSL *s)
5398 if (s->clienthello == NULL)
5400 return s->clienthello->isv2;
5403 unsigned int SSL_client_hello_get0_legacy_version(SSL *s)
5405 if (s->clienthello == NULL)
5407 return s->clienthello->legacy_version;
5410 size_t SSL_client_hello_get0_random(SSL *s, const unsigned char **out)
5412 if (s->clienthello == NULL)
5415 *out = s->clienthello->random;
5419 size_t SSL_client_hello_get0_session_id(SSL *s, const unsigned char **out)
5421 if (s->clienthello == NULL)
5424 *out = s->clienthello->session_id;
5425 return s->clienthello->session_id_len;
5428 size_t SSL_client_hello_get0_ciphers(SSL *s, const unsigned char **out)
5430 if (s->clienthello == NULL)
5433 *out = PACKET_data(&s->clienthello->ciphersuites);
5434 return PACKET_remaining(&s->clienthello->ciphersuites);
5437 size_t SSL_client_hello_get0_compression_methods(SSL *s, const unsigned char **out)
5439 if (s->clienthello == NULL)
5442 *out = s->clienthello->compressions;
5443 return s->clienthello->compressions_len;
5446 int SSL_client_hello_get1_extensions_present(SSL *s, int **out, size_t *outlen)
5452 if (s->clienthello == NULL || out == NULL || outlen == NULL)
5454 for (i = 0; i < s->clienthello->pre_proc_exts_len; i++) {
5455 ext = s->clienthello->pre_proc_exts + i;
5468 for (i = 0; i < s->clienthello->pre_proc_exts_len; i++) {
5469 ext = s->clienthello->pre_proc_exts + i;
5484 int SSL_client_hello_get0_ext(SSL *s, unsigned int type, const unsigned char **out,
5490 if (s->clienthello == NULL)
5492 for (i = 0; i < s->clienthello->pre_proc_exts_len; ++i) {
5493 r = s->clienthello->pre_proc_exts + i;
5622 int ssl_cache_cipherlist(SSL *s, PACKET *cipher_suites, int sslv2format)
5629 SSLfatal(s, SSL_AD_ILLEGAL_PARAMETER, SSL_R_NO_CIPHERS_SPECIFIED);
5634 SSLfatal(s, SSL_AD_DECODE_ERROR, SSL_R_ERROR_IN_RECEIVED_CIPHER_LIST);
5638 OPENSSL_free(s->s3.tmp.ciphers_raw);
5639 s->s3.tmp.ciphers_raw = NULL;
5640 s->s3.tmp.ciphers_rawlen = 0;
5656 s->s3.tmp.ciphers_raw = raw;
5658 SSLfatal(s, SSL_AD_INTERNAL_ERROR, ERR_R_MALLOC_FAILURE);
5661 for (s->s3.tmp.ciphers_rawlen = 0;
5670 SSLfatal(s, SSL_AD_DECODE_ERROR, SSL_R_BAD_PACKET);
5671 OPENSSL_free(s->s3.tmp.ciphers_raw);
5672 s->s3.tmp.ciphers_raw = NULL;
5673 s->s3.tmp.ciphers_rawlen = 0;
5677 s->s3.tmp.ciphers_rawlen += TLS_CIPHER_LEN;
5679 } else if (!PACKET_memdup(cipher_suites, &s->s3.tmp.ciphers_raw,
5680 &s->s3.tmp.ciphers_rawlen)) {
5681 SSLfatal(s, SSL_AD_INTERNAL_ERROR, ERR_R_INTERNAL_ERROR);
5687 int SSL_bytes_to_cipher_list(SSL *s, const unsigned char *bytes, size_t len,
5695 return bytes_to_cipher_list(s, &pkt, sk, scsvs, isv2format, 0);
5698 int bytes_to_cipher_list(SSL *s, PACKET *cipher_suites,
5714 SSLfatal(s, SSL_AD_ILLEGAL_PARAMETER, SSL_R_NO_CIPHERS_SPECIFIED);
5722 SSLfatal(s, SSL_AD_DECODE_ERROR,
5733 SSLfatal(s, SSL_AD_INTERNAL_ERROR, ERR_R_MALLOC_FAILURE);
5749 c = ssl_get_cipher_by_char(s, sslv2format ? &cipher[1] : cipher, 1);
5754 SSLfatal(s, SSL_AD_INTERNAL_ERROR, ERR_R_MALLOC_FAILURE);
5763 SSLfatal(s, SSL_AD_DECODE_ERROR, SSL_R_BAD_LENGTH);
5796 int SSL_set_max_early_data(SSL *s, uint32_t max_early_data)
5798 s->max_early_data = max_early_data;
5803 uint32_t SSL_get_max_early_data(const SSL *s)
5805 return s->max_early_data;
5820 int SSL_set_recv_max_early_data(SSL *s, uint32_t recv_max_early_data)
5822 s->recv_max_early_data = recv_max_early_data;
5827 uint32_t SSL_get_recv_max_early_data(const SSL *s)
5829 return s->recv_max_early_data;
5857 int SSL_stateless(SSL *s)
5862 if (!SSL_clear(s))
5867 s->s3.flags |= TLS1_FLAGS_STATELESS;
5868 ret = SSL_accept(s);
5869 s->s3.flags &= ~TLS1_FLAGS_STATELESS;
5871 if (ret > 0 && s->ext.cookieok)
5874 if (s->hello_retry_request == SSL_HRR_PENDING && !ossl_statem_in_error(s))
5956 void SSL_set_allow_early_data_cb(SSL *s,
5960 s->allow_early_data_cb = cb;
5961 s->allow_early_data_cb_data = arg;
6056 int SSL_set0_tmp_dh_pkey(SSL *s, EVP_PKEY *dhpkey)
6058 if (!ssl_security(s, SSL_SECOP_TMP_DH,
6063 EVP_PKEY_free(s->cert->dh_tmp);
6064 s->cert->dh_tmp = dhpkey;