/src/boringssl/ssl/ssl_versions.cc

Source
// Copyright 2017 The BoringSSL Authors
//
// Licensed under the Apache License, Version 2.0 (the "License");
// you may not use this file except in compliance with the License.
// You may obtain a copy of the License at
//
//     https://www.apache.org/licenses/LICENSE-2.0
//
// Unless required by applicable law or agreed to in writing, software
// distributed under the License is distributed on an "AS IS" BASIS,
// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
// See the License for the specific language governing permissions and
// limitations under the License.

#include <openssl/ssl.h>

#include <assert.h>

#include <iterator>

#include <openssl/bytestring.h>
#include <openssl/err.h>
#include <openssl/span.h>

#include "internal.h"


BSSL_NAMESPACE_BEGIN

bool ssl_protocol_version_from_wire(uint16_t *out, uint16_t version) {
  switch (version) {
    case TLS1_VERSION:
    case TLS1_1_VERSION:
    case TLS1_2_VERSION:
    case TLS1_3_VERSION:
      *out = version;
      return true;

    case DTLS1_VERSION:
      // DTLS 1.0 is analogous to TLS 1.1, not TLS 1.0.
      *out = TLS1_1_VERSION;
      return true;

    case DTLS1_2_VERSION:
      *out = TLS1_2_VERSION;
      return true;

    case DTLS1_3_VERSION:
      *out = TLS1_3_VERSION;
      return true;

    default:
      return false;
  }
}

// The follow arrays are the supported versions for TLS and DTLS, in order of
// decreasing preference.

static const uint16_t kTLSVersions[] = {
    TLS1_3_VERSION,
    TLS1_2_VERSION,
    TLS1_1_VERSION,
    TLS1_VERSION,
};

static const uint16_t kDTLSVersions[] = {
    DTLS1_3_VERSION,
    DTLS1_2_VERSION,
    DTLS1_VERSION,
};

static Span<const uint16_t> get_method_versions(
    const SSL_PROTOCOL_METHOD *method) {
  return method->is_dtls ? Span<const uint16_t>(kDTLSVersions)
                         : Span<const uint16_t>(kTLSVersions);
}

bool ssl_method_supports_version(const SSL_PROTOCOL_METHOD *method,
                                 uint16_t version) {
  for (uint16_t supported : get_method_versions(method)) {
    if (supported == version) {
      return true;
    }
  }
  return false;
}

// The following functions map between API versions and wire versions. The
// public API works on wire versions.

static const char *const kUnknownVersion = "unknown";

struct VersionInfo {
  uint16_t version;
  const char *name;
};

static const VersionInfo kVersionNames[] = {
    {TLS1_3_VERSION, "TLSv1.3"},   {TLS1_2_VERSION, "TLSv1.2"},
    {TLS1_1_VERSION, "TLSv1.1"},   {TLS1_VERSION, "TLSv1"},
    {DTLS1_VERSION, "DTLSv1"},     {DTLS1_2_VERSION, "DTLSv1.2"},
    {DTLS1_3_VERSION, "DTLSv1.3"},
};

static const char *ssl_version_to_string(uint16_t version) {
  for (const auto &v : kVersionNames) {
    if (v.version == version) {
      return v.name;
    }
  }
  return kUnknownVersion;
}

static uint16_t wire_version_to_api(uint16_t version) { return version; }

// api_version_to_wire maps |version| to some representative wire version.
static bool api_version_to_wire(uint16_t *out, uint16_t version) {
  // Check it is a real protocol version.
  uint16_t unused;
  if (!ssl_protocol_version_from_wire(&unused, version)) {
    return false;
  }

  *out = version;
  return true;
}

static bool set_version_bound(const SSL_PROTOCOL_METHOD *method, uint16_t *out,
                              uint16_t version) {
  if (!api_version_to_wire(&version, version) ||
      !ssl_method_supports_version(method, version)) {
    OPENSSL_PUT_ERROR(SSL, SSL_R_UNKNOWN_SSL_VERSION);
    return false;
  }

  *out = version;
  return true;
}

static bool set_min_version(const SSL_PROTOCOL_METHOD *method, uint16_t *out,
                            uint16_t version) {
  // Zero is interpreted as the default minimum version.
  if (version == 0) {
    *out = method->is_dtls ? DTLS1_2_VERSION : TLS1_2_VERSION;
    return true;
  }

  return set_version_bound(method, out, version);
}

static bool set_max_version(const SSL_PROTOCOL_METHOD *method, uint16_t *out,
                            uint16_t version) {
  // Zero is interpreted as the default maximum version.
  if (version == 0) {
    *out = method->is_dtls ? DTLS1_3_VERSION : TLS1_3_VERSION;
    return true;
  }

  return set_version_bound(method, out, version);
}

const struct {
  uint16_t version;
  uint32_t flag;
} kProtocolVersions[] = {
    {TLS1_VERSION, SSL_OP_NO_TLSv1},
    {TLS1_1_VERSION, SSL_OP_NO_TLSv1_1},
    {TLS1_2_VERSION, SSL_OP_NO_TLSv1_2},
    {TLS1_3_VERSION, SSL_OP_NO_TLSv1_3},
};

bool ssl_get_version_range(const SSL_HANDSHAKE *hs, uint16_t *out_min_version,
                           uint16_t *out_max_version) {
  // For historical reasons, |SSL_OP_NO_DTLSv1| aliases |SSL_OP_NO_TLSv1|, but
  // DTLS 1.0 should be mapped to TLS 1.1.
  uint32_t options = hs->ssl->options;
  if (SSL_is_dtls(hs->ssl)) {
    options &= ~SSL_OP_NO_TLSv1_1;
    if (options & SSL_OP_NO_DTLSv1) {
      options |= SSL_OP_NO_TLSv1_1;
    }
  }

  uint16_t min_version, max_version;
  if (!ssl_protocol_version_from_wire(&min_version,
                                      hs->config->conf_min_version) ||
      !ssl_protocol_version_from_wire(&max_version,
                                      hs->config->conf_max_version)) {
    OPENSSL_PUT_ERROR(SSL, ERR_R_INTERNAL_ERROR);
    return false;
  }

  // QUIC requires TLS 1.3.
  if (SSL_is_quic(hs->ssl) && min_version < TLS1_3_VERSION) {
    min_version = TLS1_3_VERSION;
  }

  // The |SSL_OP_NO_*| flags disable individual protocols. This has two
  // problems. First, prior to TLS 1.3, the protocol can only express a
  // contiguous range of versions. Second, a library consumer trying to set a
  // maximum version cannot disable protocol versions that get added in a future
  // version of the library.
  //
  // To account for both of these, OpenSSL interprets the client-side bitmask
  // as a min/max range by picking the lowest contiguous non-empty range of
  // enabled protocols. Note that this means it is impossible to set a maximum
  // version of the highest supported TLS version in a future-proof way.
  bool any_enabled = false;
  for (size_t i = 0; i < std::size(kProtocolVersions); i++) {
    // Only look at the versions already enabled.
    if (min_version > kProtocolVersions[i].version) {
      continue;
    }
    if (max_version < kProtocolVersions[i].version) {
      break;
    }

    if (!(options & kProtocolVersions[i].flag)) {
      // The minimum version is the first enabled version.
      if (!any_enabled) {
        any_enabled = true;
        min_version = kProtocolVersions[i].version;
      }
      continue;
    }

    // If there is a disabled version after the first enabled one, all versions
    // after it are implicitly disabled.
    if (any_enabled) {
      max_version = kProtocolVersions[i - 1].version;
      break;
    }
  }

  if (!any_enabled) {
    OPENSSL_PUT_ERROR(SSL, SSL_R_NO_SUPPORTED_VERSIONS_ENABLED);
    return false;
  }

  *out_min_version = min_version;
  *out_max_version = max_version;
  return true;
}

static uint16_t ssl_version(const SSL *ssl) {
  // In early data, we report the predicted version. Note it is possible that we
  // have a predicted version and a *different* true version. This means 0-RTT
  // has been rejected, but until the reject has reported to the application and
  // applied with |SSL_reset_early_data_reject|, we continue reporting a
  // self-consistent connection.
  if (SSL_in_early_data(ssl) && !ssl->server) {
    return ssl->s3->hs->early_session->ssl_version;
  }
  if (ssl->s3->version != 0) {
    return ssl->s3->version;
  }
  // The TLS versions has not yet been negotiated. Historically, we would return
  // (D)TLS 1.2, so preserve that behavior.
  return SSL_is_dtls(ssl) ? DTLS1_2_VERSION : TLS1_2_VERSION;
}

bool ssl_has_final_version(const SSL *ssl) {
  return ssl->s3->version != 0 &&
         (ssl->s3->hs == nullptr || !ssl->s3->hs->is_early_version);
}

uint16_t ssl_protocol_version(const SSL *ssl) {
  assert(ssl->s3->version != 0);
  uint16_t version;
  if (!ssl_protocol_version_from_wire(&version, ssl->s3->version)) {
    // |ssl->s3->version| will always be set to a valid version.
    assert(0);
    return 0;
  }

  return version;
}

bool ssl_supports_version(const SSL_HANDSHAKE *hs, uint16_t version) {
  const SSL *const ssl = hs->ssl;
  uint16_t protocol_version;
  if (!ssl_method_supports_version(ssl->method, version) ||
      !ssl_protocol_version_from_wire(&protocol_version, version) ||
      hs->min_version > protocol_version ||
      protocol_version > hs->max_version) {
    return false;
  }

  return true;
}

bool ssl_add_supported_versions(const SSL_HANDSHAKE *hs, CBB *cbb,
                                uint16_t extra_min_version) {
  for (uint16_t version : get_method_versions(hs->ssl->method)) {
    uint16_t protocol_version;
    if (ssl_supports_version(hs, version) &&
        ssl_protocol_version_from_wire(&protocol_version, version) &&
        protocol_version >= extra_min_version &&  //
        !CBB_add_u16(cbb, version)) {
      return false;
    }
  }
  return true;
}

bool ssl_negotiate_version(SSL_HANDSHAKE *hs, uint8_t *out_alert,
                           uint16_t *out_version, const CBS *peer_versions) {
  for (uint16_t version : get_method_versions(hs->ssl->method)) {
    if (!ssl_supports_version(hs, version)) {
      continue;
    }

    // JDK 11, prior to 11.0.2, has a buggy TLS 1.3 implementation which fails
    // to send SNI when offering 1.3 sessions. Disable TLS 1.3 for such
    // clients. We apply this logic here rather than |ssl_supports_version| so
    // the downgrade signal continues to query the true capabilities. (The
    // workaround is a limitation of the peer's capabilities rather than our
    // own.)
    //
    // See https://bugs.openjdk.java.net/browse/JDK-8211806.
    if (version == TLS1_3_VERSION && hs->apply_jdk11_workaround) {
      continue;
    }

    CBS copy = *peer_versions;
    while (CBS_len(&copy) != 0) {
      uint16_t peer_version;
      if (!CBS_get_u16(&copy, &peer_version)) {
        OPENSSL_PUT_ERROR(SSL, SSL_R_DECODE_ERROR);
        *out_alert = SSL_AD_DECODE_ERROR;
        return false;
      }

      if (peer_version == version) {
        *out_version = version;
        return true;
      }
    }
  }

  OPENSSL_PUT_ERROR(SSL, SSL_R_UNSUPPORTED_PROTOCOL);
  *out_alert = SSL_AD_PROTOCOL_VERSION;
  return false;
}

BSSL_NAMESPACE_END

using namespace bssl;

int SSL_CTX_set_min_proto_version(SSL_CTX *ctx, uint16_t version) {
  return set_min_version(ctx->method, &ctx->conf_min_version, version);
}

int SSL_CTX_set_max_proto_version(SSL_CTX *ctx, uint16_t version) {
  return set_max_version(ctx->method, &ctx->conf_max_version, version);
}

uint16_t SSL_CTX_get_min_proto_version(const SSL_CTX *ctx) {
  return ctx->conf_min_version;
}

uint16_t SSL_CTX_get_max_proto_version(const SSL_CTX *ctx) {
  return ctx->conf_max_version;
}

int SSL_set_min_proto_version(SSL *ssl, uint16_t version) {
  if (!ssl->config) {
    return 0;
  }
  return set_min_version(ssl->method, &ssl->config->conf_min_version, version);
}

int SSL_set_max_proto_version(SSL *ssl, uint16_t version) {
  if (!ssl->config) {
    return 0;
  }
  return set_max_version(ssl->method, &ssl->config->conf_max_version, version);
}

uint16_t SSL_get_min_proto_version(const SSL *ssl) {
  if (!ssl->config) {
    assert(ssl->config);
    return 0;
  }
  return ssl->config->conf_min_version;
}

uint16_t SSL_get_max_proto_version(const SSL *ssl) {
  if (!ssl->config) {
    assert(ssl->config);
    return 0;
  }
  return ssl->config->conf_max_version;
}

int SSL_version(const SSL *ssl) {
  return wire_version_to_api(ssl_version(ssl));
}

const char *SSL_get_version(const SSL *ssl) {
  return ssl_version_to_string(ssl_version(ssl));
}

size_t SSL_get_all_version_names(const char **out, size_t max_out) {
  return GetAllNames(out, max_out, Span(&kUnknownVersion, 1),
                     &VersionInfo::name, Span(kVersionNames));
}

const char *SSL_SESSION_get_version(const SSL_SESSION *session) {
  return ssl_version_to_string(session->ssl_version);
}

uint16_t SSL_SESSION_get_protocol_version(const SSL_SESSION *session) {
  return wire_version_to_api(session->ssl_version);
}

int SSL_SESSION_set_protocol_version(SSL_SESSION *session, uint16_t version) {
  // This picks a representative TLS 1.3 version, but this API should only be
  // used on unit test sessions anyway.
  return api_version_to_wire(&session->ssl_version, version);
}

int SSL_CTX_set_record_protocol_version(SSL_CTX *ctx, int version) {
  return version == 0;
}

Coverage Report

Created: 2026-04-15 06:25

Line	Count	Source
1		// Copyright 2017 The BoringSSL Authors
2		//
3		// Licensed under the Apache License, Version 2.0 (the "License");
4		// you may not use this file except in compliance with the License.
5		// You may obtain a copy of the License at
6		//
7		// https://www.apache.org/licenses/LICENSE-2.0
8		//
9		// Unless required by applicable law or agreed to in writing, software
10		// distributed under the License is distributed on an "AS IS" BASIS,
11		// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
12		// See the License for the specific language governing permissions and
13		// limitations under the License.
14
15		#include <openssl/ssl.h>
16
17		#include <assert.h>
18
19		#include <iterator>
20
21		#include <openssl/bytestring.h>
22		#include <openssl/err.h>
23		#include <openssl/span.h>
24
25		#include "internal.h"
26
27
28		BSSL_NAMESPACE_BEGIN
29
30	5.52M	bool ssl_protocol_version_from_wire(uint16_t *out, uint16_t version) {
31	5.52M	switch (version) {
32	284k	case TLS1_VERSION:
33	430k	case TLS1_1_VERSION:
34	3.69M	case TLS1_2_VERSION:
35	4.15M	case TLS1_3_VERSION:
36	4.15M	*out = version;
37	4.15M	return true;
38
39	96.9k	case DTLS1_VERSION:
40		// DTLS 1.0 is analogous to TLS 1.1, not TLS 1.0.
41	96.9k	*out = TLS1_1_VERSION;
42	96.9k	return true;
43
44	237k	case DTLS1_2_VERSION:
45	237k	*out = TLS1_2_VERSION;
46	237k	return true;
47
48	1.01M	case DTLS1_3_VERSION:
49	1.01M	*out = TLS1_3_VERSION;
50	1.01M	return true;
51
52	20.8k	default:
53	20.8k	return false;
54	5.52M	}
55	5.52M	}
56
57		// The follow arrays are the supported versions for TLS and DTLS, in order of
58		// decreasing preference.
59
60		static const uint16_t kTLSVersions[] = {
61		TLS1_3_VERSION,
62		TLS1_2_VERSION,
63		TLS1_1_VERSION,
64		TLS1_VERSION,
65		};
66
67		static const uint16_t kDTLSVersions[] = {
68		DTLS1_3_VERSION,
69		DTLS1_2_VERSION,
70		DTLS1_VERSION,
71		};
72
73		static Span<const uint16_t> get_method_versions(
74	341k	const SSL_PROTOCOL_METHOD *method) {
75	341k	return method->is_dtls ? Span<const uint16_t>(kDTLSVersions)
76	341k	: Span<const uint16_t>(kTLSVersions);
77	341k	}
78
79		bool ssl_method_supports_version(const SSL_PROTOCOL_METHOD *method,
80	277k	uint16_t version) {
81	640k	for (uint16_t supported : get_method_versions(method)) {
82	640k	if (supported == version) {
83	275k	return true;
84	275k	}
85	640k	}
86	1.82k	return false;
87	277k	}
88
89		// The following functions map between API versions and wire versions. The
90		// public API works on wire versions.
91
92		static const char *const kUnknownVersion = "unknown";
93
94		struct VersionInfo {
95		uint16_t version;
96		const char *name;
97		};
98
99		static const VersionInfo kVersionNames[] = {
100		{TLS1_3_VERSION, "TLSv1.3"}, {TLS1_2_VERSION, "TLSv1.2"},
101		{TLS1_1_VERSION, "TLSv1.1"}, {TLS1_VERSION, "TLSv1"},
102		{DTLS1_VERSION, "DTLSv1"}, {DTLS1_2_VERSION, "DTLSv1.2"},
103		{DTLS1_3_VERSION, "DTLSv1.3"},
104		};
105
106	0	static const char *ssl_version_to_string(uint16_t version) {
107	0	for (const auto &v : kVersionNames) {
108	0	if (v.version == version) {
109	0	return v.name;
110	0	}
111	0	}
112	0	return kUnknownVersion;
113	0	}
114
115	0	static uint16_t wire_version_to_api(uint16_t version) { return version; }
116
117		// api_version_to_wire maps \|version\| to some representative wire version.
118	28.7k	static bool api_version_to_wire(uint16_t *out, uint16_t version) {
119		// Check it is a real protocol version.
120	28.7k	uint16_t unused;
121	28.7k	if (!ssl_protocol_version_from_wire(&unused, version)) {
122	20.4k	return false;
123	20.4k	}
124
125	8.30k	*out = version;
126	8.30k	return true;
127	28.7k	}
128
129		static bool set_version_bound(const SSL_PROTOCOL_METHOD method, uint16_t out,
130	28.7k	uint16_t version) {
131	28.7k	if (!api_version_to_wire(&version, version) \|\|
132	22.2k	!ssl_method_supports_version(method, version)) {
133	22.2k	OPENSSL_PUT_ERROR(SSL, SSL_R_UNKNOWN_SSL_VERSION);
134	22.2k	return false;
135	22.2k	}
136
137	6.56k	*out = version;
138	6.56k	return true;
139	28.7k	}
140
141		static bool set_min_version(const SSL_PROTOCOL_METHOD method, uint16_t out,
142	25.7k	uint16_t version) {
143		// Zero is interpreted as the default minimum version.
144	25.7k	if (version == 0) {
145	6.70k	*out = method->is_dtls ? DTLS1_2_VERSION : TLS1_2_VERSION;
146	6.70k	return true;
147	6.70k	}
148
149	18.9k	return set_version_bound(method, out, version);
150	25.7k	}
151
152		static bool set_max_version(const SSL_PROTOCOL_METHOD method, uint16_t out,
153	17.6k	uint16_t version) {
154		// Zero is interpreted as the default maximum version.
155	17.6k	if (version == 0) {
156	7.89k	*out = method->is_dtls ? DTLS1_3_VERSION : TLS1_3_VERSION;
157	7.89k	return true;
158	7.89k	}
159
160	9.78k	return set_version_bound(method, out, version);
161	17.6k	}
162
163		const struct {
164		uint16_t version;
165		uint32_t flag;
166		} kProtocolVersions[] = {
167		{TLS1_VERSION, SSL_OP_NO_TLSv1},
168		{TLS1_1_VERSION, SSL_OP_NO_TLSv1_1},
169		{TLS1_2_VERSION, SSL_OP_NO_TLSv1_2},
170		{TLS1_3_VERSION, SSL_OP_NO_TLSv1_3},
171		};
172
173		bool ssl_get_version_range(const SSL_HANDSHAKE hs, uint16_t out_min_version,
174	62.4k	uint16_t *out_max_version) {
175		// For historical reasons, \|SSL_OP_NO_DTLSv1\| aliases \|SSL_OP_NO_TLSv1\|, but
176		// DTLS 1.0 should be mapped to TLS 1.1.
177	62.4k	uint32_t options = hs->ssl->options;
178	62.4k	if (SSL_is_dtls(hs->ssl)) {
179	10.3k	options &= ~SSL_OP_NO_TLSv1_1;
180	10.3k	if (options & SSL_OP_NO_DTLSv1) {
181	0	options \|= SSL_OP_NO_TLSv1_1;
182	0	}
183	10.3k	}
184
185	62.4k	uint16_t min_version, max_version;
186	62.4k	if (!ssl_protocol_version_from_wire(&min_version,
187	62.4k	hs->config->conf_min_version) \|\|
188	62.4k	!ssl_protocol_version_from_wire(&max_version,
189	62.4k	hs->config->conf_max_version)) {
190	0	OPENSSL_PUT_ERROR(SSL, ERR_R_INTERNAL_ERROR);
191	0	return false;
192	0	}
193
194		// QUIC requires TLS 1.3.
195	62.4k	if (SSL_is_quic(hs->ssl) && min_version < TLS1_3_VERSION) {
196	0	min_version = TLS1_3_VERSION;
197	0	}
198
199		// The \|SSL_OP_NO_*\| flags disable individual protocols. This has two
200		// problems. First, prior to TLS 1.3, the protocol can only express a
201		// contiguous range of versions. Second, a library consumer trying to set a
202		// maximum version cannot disable protocol versions that get added in a future
203		// version of the library.
204		//
205		// To account for both of these, OpenSSL interprets the client-side bitmask
206		// as a min/max range by picking the lowest contiguous non-empty range of
207		// enabled protocols. Note that this means it is impossible to set a maximum
208		// version of the highest supported TLS version in a future-proof way.
209	62.4k	bool any_enabled = false;
210	312k	for (size_t i = 0; i < std::size(kProtocolVersions); i++) {
211		// Only look at the versions already enabled.
212	249k	if (min_version > kProtocolVersions[i].version) {
213	10.3k	continue;
214	10.3k	}
215	239k	if (max_version < kProtocolVersions[i].version) {
216	0	break;
217	0	}
218
219	239k	if (!(options & kProtocolVersions[i].flag)) {
220		// The minimum version is the first enabled version.
221	239k	if (!any_enabled) {
222	62.4k	any_enabled = true;
223	62.4k	min_version = kProtocolVersions[i].version;
224	62.4k	}
225	239k	continue;
226	239k	}
227
228		// If there is a disabled version after the first enabled one, all versions
229		// after it are implicitly disabled.
230	0	if (any_enabled) {
231	0	max_version = kProtocolVersions[i - 1].version;
232	0	break;
233	0	}
234	0	}
235
236	62.4k	if (!any_enabled) {
237	0	OPENSSL_PUT_ERROR(SSL, SSL_R_NO_SUPPORTED_VERSIONS_ENABLED);
238	0	return false;
239	0	}
240
241	62.4k	*out_min_version = min_version;
242	62.4k	*out_max_version = max_version;
243	62.4k	return true;
244	62.4k	}
245
246	0	static uint16_t ssl_version(const SSL *ssl) {
247		// In early data, we report the predicted version. Note it is possible that we
248		// have a predicted version and a different true version. This means 0-RTT
249		// has been rejected, but until the reject has reported to the application and
250		// applied with \|SSL_reset_early_data_reject\|, we continue reporting a
251		// self-consistent connection.
252	0	if (SSL_in_early_data(ssl) && !ssl->server) {
253	0	return ssl->s3->hs->early_session->ssl_version;
254	0	}
255	0	if (ssl->s3->version != 0) {
256	0	return ssl->s3->version;
257	0	}
258		// The TLS versions has not yet been negotiated. Historically, we would return
259		// (D)TLS 1.2, so preserve that behavior.
260	0	return SSL_is_dtls(ssl) ? DTLS1_2_VERSION : TLS1_2_VERSION;
261	0	}
262
263	764k	bool ssl_has_final_version(const SSL *ssl) {
264	764k	return ssl->s3->version != 0 &&
265	623k	(ssl->s3->hs == nullptr \|\| !ssl->s3->hs->is_early_version);
266	764k	}
267
268	4.45M	uint16_t ssl_protocol_version(const SSL *ssl) {
269	4.45M	assert(ssl->s3->version != 0);
270	4.45M	uint16_t version;
271	4.45M	if (!ssl_protocol_version_from_wire(&version, ssl->s3->version)) {
272		// \|ssl->s3->version\| will always be set to a valid version.
273	0	assert(0);
274	0	return 0;
275	0	}
276
277	4.45M	return version;
278	4.45M	}
279
280	269k	bool ssl_supports_version(const SSL_HANDSHAKE *hs, uint16_t version) {
281	269k	const SSL *const ssl = hs->ssl;
282	269k	uint16_t protocol_version;
283	269k	if (!ssl_method_supports_version(ssl->method, version) \|\|
284	269k	!ssl_protocol_version_from_wire(&protocol_version, version) \|\|
285	269k	hs->min_version > protocol_version \|\|
286	269k	protocol_version > hs->max_version) {
287	86	return false;
288	86	}
289
290	269k	return true;
291	269k	}
292
293		bool ssl_add_supported_versions(const SSL_HANDSHAKE hs, CBB cbb,
294	50.1k	uint16_t extra_min_version) {
295	193k	for (uint16_t version : get_method_versions(hs->ssl->method)) {
296	193k	uint16_t protocol_version;
297	193k	if (ssl_supports_version(hs, version) &&
298	193k	ssl_protocol_version_from_wire(&protocol_version, version) &&
299	193k	protocol_version >= extra_min_version && //
300	193k	!CBB_add_u16(cbb, version)) {
301	0	return false;
302	0	}
303	193k	}
304	50.1k	return true;
305	50.1k	}
306
307		bool ssl_negotiate_version(SSL_HANDSHAKE hs, uint8_t out_alert,
308	14.1k	uint16_t out_version, const CBS peer_versions) {
309	28.2k	for (uint16_t version : get_method_versions(hs->ssl->method)) {
310	28.2k	if (!ssl_supports_version(hs, version)) {
311	0	continue;
312	0	}
313
314		// JDK 11, prior to 11.0.2, has a buggy TLS 1.3 implementation which fails
315		// to send SNI when offering 1.3 sessions. Disable TLS 1.3 for such
316		// clients. We apply this logic here rather than \|ssl_supports_version\| so
317		// the downgrade signal continues to query the true capabilities. (The
318		// workaround is a limitation of the peer's capabilities rather than our
319		// own.)
320		//
321		// See https://bugs.openjdk.java.net/browse/JDK-8211806.
322	28.2k	if (version == TLS1_3_VERSION && hs->apply_jdk11_workaround) {
323	0	continue;
324	0	}
325
326	28.2k	CBS copy = *peer_versions;
327	56.5k	while (CBS_len(&copy) != 0) {
328	42.3k	uint16_t peer_version;
329	42.3k	if (!CBS_get_u16(&copy, &peer_version)) {
330	3	OPENSSL_PUT_ERROR(SSL, SSL_R_DECODE_ERROR);
331	3	*out_alert = SSL_AD_DECODE_ERROR;
332	3	return false;
333	3	}
334
335	42.3k	if (peer_version == version) {
336	14.0k	*out_version = version;
337	14.0k	return true;
338	14.0k	}
339	42.3k	}
340	28.2k	}
341
342	58	OPENSSL_PUT_ERROR(SSL, SSL_R_UNSUPPORTED_PROTOCOL);
343	58	*out_alert = SSL_AD_PROTOCOL_VERSION;
344	58	return false;
345	14.1k	}
346
347		BSSL_NAMESPACE_END
348
349		using namespace bssl;
350
351	25.7k	int SSL_CTX_set_min_proto_version(SSL_CTX *ctx, uint16_t version) {
352	25.7k	return set_min_version(ctx->method, &ctx->conf_min_version, version);
353	25.7k	}
354
355	17.6k	int SSL_CTX_set_max_proto_version(SSL_CTX *ctx, uint16_t version) {
356	17.6k	return set_max_version(ctx->method, &ctx->conf_max_version, version);
357	17.6k	}
358
359	0	uint16_t SSL_CTX_get_min_proto_version(const SSL_CTX *ctx) {
360	0	return ctx->conf_min_version;
361	0	}
362
363	0	uint16_t SSL_CTX_get_max_proto_version(const SSL_CTX *ctx) {
364	0	return ctx->conf_max_version;
365	0	}
366
367	0	int SSL_set_min_proto_version(SSL *ssl, uint16_t version) {
368	0	if (!ssl->config) {
369	0	return 0;
370	0	}
371	0	return set_min_version(ssl->method, &ssl->config->conf_min_version, version);
372	0	}
373
374	0	int SSL_set_max_proto_version(SSL *ssl, uint16_t version) {
375	0	if (!ssl->config) {
376	0	return 0;
377	0	}
378	0	return set_max_version(ssl->method, &ssl->config->conf_max_version, version);
379	0	}
380
381	0	uint16_t SSL_get_min_proto_version(const SSL *ssl) {
382	0	if (!ssl->config) {
383	0	assert(ssl->config);
384	0	return 0;
385	0	}
386	0	return ssl->config->conf_min_version;
387	0	}
388
389	0	uint16_t SSL_get_max_proto_version(const SSL *ssl) {
390	0	if (!ssl->config) {
391	0	assert(ssl->config);
392	0	return 0;
393	0	}
394	0	return ssl->config->conf_max_version;
395	0	}
396
397	0	int SSL_version(const SSL *ssl) {
398	0	return wire_version_to_api(ssl_version(ssl));
399	0	}
400
401	0	const char SSL_get_version(const SSL ssl) {
402	0	return ssl_version_to_string(ssl_version(ssl));
403	0	}
404
405	0	size_t SSL_get_all_version_names(const char **out, size_t max_out) {
406	0	return GetAllNames(out, max_out, Span(&kUnknownVersion, 1),
407	0	&VersionInfo::name, Span(kVersionNames));
408	0	}
409
410	0	const char SSL_SESSION_get_version(const SSL_SESSION session) {
411	0	return ssl_version_to_string(session->ssl_version);
412	0	}
413
414	0	uint16_t SSL_SESSION_get_protocol_version(const SSL_SESSION *session) {
415	0	return wire_version_to_api(session->ssl_version);
416	0	}
417
418	0	int SSL_SESSION_set_protocol_version(SSL_SESSION *session, uint16_t version) {
419		// This picks a representative TLS 1.3 version, but this API should only be
420		// used on unit test sessions anyway.
421	0	return api_version_to_wire(&session->ssl_version, version);
422	0	}
423
424	0	int SSL_CTX_set_record_protocol_version(SSL_CTX *ctx, int version) {
425	0	return version == 0;
426	0	}