/*

 * Copyright 2016-2026 The OpenSSL Project Authors. All Rights Reserved.

 *

 * Licensed under the Apache License 2.0 (the "License").  You may not use

 * this file except in compliance with the License.  You can obtain a copy

 * in the file LICENSE in the source distribution or at

 * https://www.openssl.org/source/license.html

 */

#if defined(__TANDEM) && defined(_SPT_MODEL_)

#include <spthread.h>

#include <spt_extensions.h> /* timeval */

#endif

#include <string.h>

#include "internal/nelem.h"

#include "internal/cryptlib.h"

#include "internal/ssl_unwrap.h"

#include "../ssl_local.h"

#include "statem_local.h"

#include <openssl/ocsp.h>

#include <openssl/core_names.h>

/*

 * values for ext_defs ech_handling field

 * exceptionally, we don't conditionally compile that field to avoid a pile of

 * ifndefs all over the ext_defs values

 */

#define OSSL_ECH_HANDLING_CALL_BOTH 1 /* call constructor both times */

#define OSSL_ECH_HANDLING_COMPRESS 2 /* compress outer value into inner */

#define OSSL_ECH_HANDLING_DUPLICATE 3 /* same value in inner and outer */

/*

 * DUPLICATE isn't really useful other than to show we can,

 * and for debugging/tests/coverage so may disappear. Changes mostly

 * won't affect the outer CH size, due to padding, but might for some

 * larger extensions.

 *

 * Note there is a co-dependency with test/recipes/75-test_quicapi.t:

 * If you change an |ech_handling| value, that may well affect the order

 * of extensions in a ClientHello, which is reflected in the test data

 * in test/recipes/75-test_quicapi_data/\*.txt files. To fix, you need

 * to look in test-runs/test_quicapi for the "new" files and then edit

 * (replacing actual octets with "?" in relevant places), and copy the

 * result back over to test/recipes/75-test_quicapi_data/. The reason

 * this happens is the ECH COMPRESS'd extensions need to be contiguous

 * in the ClientHello, so changes to/from COMPRESS affect extension

 * order, in inner and outer CH. There doesn't seem to be an easy,

 * generic, way to reconcile these compile-time changes with having

 * fixed value test files. Likely the best option is to decide on the

 * disposition of ECH COMPRESS or not and consider that an at least

 * medium-term thing. (But still allow other builds to vary at

 * compile time if they need something different.)

 */

#ifndef OPENSSL_NO_ECH

static int init_ech(SSL_CONNECTION *s, unsigned int context);

static int final_ech(SSL_CONNECTION *s, unsigned int context, int sent);

#endif /* OPENSSL_NO_ECH */

static int final_renegotiate(SSL_CONNECTION *s, unsigned int context, int sent);

static int init_server_name(SSL_CONNECTION *s, unsigned int context);

static int final_server_name(SSL_CONNECTION *s, unsigned int context, int sent);

static int init_session_ticket(SSL_CONNECTION *s, unsigned int context);

#ifndef OPENSSL_NO_OCSP

static int init_status_request(SSL_CONNECTION *s, unsigned int context);

#endif

#ifndef OPENSSL_NO_NEXTPROTONEG

static int init_npn(SSL_CONNECTION *s, unsigned int context);

#endif

static int init_alpn(SSL_CONNECTION *s, unsigned int context);

static int final_alpn(SSL_CONNECTION *s, unsigned int context, int sent);

static int init_sig_algs_cert(SSL_CONNECTION *s, unsigned int context);

static int init_sig_algs(SSL_CONNECTION *s, unsigned int context);

static int init_server_cert_type(SSL_CONNECTION *sc, unsigned int context);

static int init_client_cert_type(SSL_CONNECTION *sc, unsigned int context);

static int init_certificate_authorities(SSL_CONNECTION *s,

    unsigned int context);

static EXT_RETURN tls_construct_certificate_authorities(SSL_CONNECTION *s,

    WPACKET *pkt,

    unsigned int context,

    X509 *x,

    size_t chainidx);

static int tls_parse_certificate_authorities(SSL_CONNECTION *s, PACKET *pkt,

    unsigned int context, X509 *x,

    size_t chainidx);

#ifndef OPENSSL_NO_SRP

static int init_srp(SSL_CONNECTION *s, unsigned int context);

#endif

static int init_ec_point_formats(SSL_CONNECTION *s, unsigned int context);

static int init_etm(SSL_CONNECTION *s, unsigned int context);

static int init_ems(SSL_CONNECTION *s, unsigned int context);

static int final_ems(SSL_CONNECTION *s, unsigned int context, int sent);

static int init_psk_kex_modes(SSL_CONNECTION *s, unsigned int context);

static int final_key_share(SSL_CONNECTION *s, unsigned int context, int sent);

#ifndef OPENSSL_NO_SRTP

static int init_srtp(SSL_CONNECTION *s, unsigned int context);

#endif

static int final_sig_algs(SSL_CONNECTION *s, unsigned int context, int sent);

static int final_supported_versions(SSL_CONNECTION *s, unsigned int context,

    int sent);

static int final_early_data(SSL_CONNECTION *s, unsigned int context, int sent);

static int final_maxfragmentlen(SSL_CONNECTION *s, unsigned int context,

    int sent);

static int init_post_handshake_auth(SSL_CONNECTION *s, unsigned int context);

static int final_psk(SSL_CONNECTION *s, unsigned int context, int sent);

static int tls_init_compress_certificate(SSL_CONNECTION *sc, unsigned int context);

static EXT_RETURN tls_construct_compress_certificate(SSL_CONNECTION *sc, WPACKET *pkt,

    unsigned int context,

    X509 *x, size_t chainidx);

static int tls_parse_compress_certificate(SSL_CONNECTION *sc, PACKET *pkt,

    unsigned int context,

    X509 *x, size_t chainidx);

static int tls_parse_ec_pt_formats(SSL_CONNECTION *s, PACKET *pkt,

    unsigned int context,

    X509 *x, size_t chainidx);

/* Structure to define a built-in extension */

typedef struct extensions_definition_st {

    /* The defined type for the extension */

    unsigned int type;

    /*

     * The context that this extension applies to, e.g. what messages and

     * protocol versions

     */

    unsigned int context;

    /*

     * exceptionally, we don't conditionally compile this field to avoid a

     * pile of ifndefs all over the ext_defs values

     */

    int ech_handling; /* how to handle ECH for this extension type */

    /*

     * Initialise extension before parsing. Always called for relevant contexts

     * even if extension not present

     */

    int (*init)(SSL_CONNECTION *s, unsigned int context);

    /* Parse extension sent from client to server */

    int (*parse_ctos)(SSL_CONNECTION *s, PACKET *pkt, unsigned int context,

        X509 *x, size_t chainidx);

    /* Parse extension send from server to client */

    int (*parse_stoc)(SSL_CONNECTION *s, PACKET *pkt, unsigned int context,

        X509 *x, size_t chainidx);

    /* Construct extension sent from server to client */

    EXT_RETURN (*construct_stoc)(SSL_CONNECTION *s, WPACKET *pkt,

        unsigned int context,

        X509 *x, size_t chainidx);

    /* Construct extension sent from client to server */

    EXT_RETURN (*construct_ctos)(SSL_CONNECTION *s, WPACKET *pkt,

        unsigned int context,

        X509 *x, size_t chainidx);

    /*

     * Finalise extension after parsing. Always called where an extensions was

     * initialised even if the extension was not present. |sent| is set to 1 if

     * the extension was seen, or 0 otherwise.

     */

    int (*final)(SSL_CONNECTION *s, unsigned int context, int sent);

} EXTENSION_DEFINITION;

/*

 * Definitions of all built-in extensions. NOTE: Changes in the number or order

 * of these extensions should be mirrored with equivalent changes to the

 * indexes ( TLSEXT_IDX_* ) defined in ssl_local.h.

 * Extensions should be added to test/ext_internal_test.c as well, as that

 * tests the ordering of the extensions.

 *

 * Each extension has an initialiser, a client and

 * server side parser and a finaliser. The initialiser is called (if the

 * extension is relevant to the given context) even if we did not see the

 * extension in the message that we received. The parser functions are only

 * called if we see the extension in the message. The finalisers are always

 * called if the initialiser was called.

 * There are also server and client side constructor functions which are always

 * called during message construction if the extension is relevant for the

 * given context.

 * The initialisation, parsing, finalisation and construction functions are

 * always called in the order defined in this list. Some extensions may depend

 * on others having been processed first, so the order of this list is

 * significant.

 * The extension context is defined by a series of flags which specify which

 * messages the extension is relevant to. These flags also specify whether the

 * extension is relevant to a particular protocol or protocol version.

 *

 * NOTE: WebSphere Application Server 7+ cannot handle empty extensions at

 * the end, keep these extensions before signature_algorithm.

 */

#define INVALID_EXTENSION { TLSEXT_TYPE_invalid, 0, 0, NULL, NULL, NULL, NULL, NULL, NULL }

static const EXTENSION_DEFINITION ext_defs[] = {

    { TLSEXT_TYPE_renegotiate,

        SSL_EXT_CLIENT_HELLO | SSL_EXT_TLS1_2_SERVER_HELLO

            | SSL_EXT_TLS1_2_AND_BELOW_ONLY,

        OSSL_ECH_HANDLING_COMPRESS,

        NULL, tls_parse_ctos_renegotiate, tls_parse_stoc_renegotiate,

        tls_construct_stoc_renegotiate, tls_construct_ctos_renegotiate,

        final_renegotiate },

    { TLSEXT_TYPE_server_name,

        SSL_EXT_CLIENT_HELLO | SSL_EXT_TLS1_2_SERVER_HELLO

            | SSL_EXT_TLS1_3_ENCRYPTED_EXTENSIONS,

        OSSL_ECH_HANDLING_CALL_BOTH,

        init_server_name,

        tls_parse_ctos_server_name, tls_parse_stoc_server_name,

        tls_construct_stoc_server_name, tls_construct_ctos_server_name,

        final_server_name },

    { TLSEXT_TYPE_max_fragment_length,

        SSL_EXT_CLIENT_HELLO | SSL_EXT_TLS1_2_SERVER_HELLO

            | SSL_EXT_TLS1_3_ENCRYPTED_EXTENSIONS,

        OSSL_ECH_HANDLING_COMPRESS,

        NULL, tls_parse_ctos_maxfragmentlen, tls_parse_stoc_maxfragmentlen,

        tls_construct_stoc_maxfragmentlen, tls_construct_ctos_maxfragmentlen,

        final_maxfragmentlen },

#ifndef OPENSSL_NO_SRP

    { TLSEXT_TYPE_srp,

        SSL_EXT_CLIENT_HELLO | SSL_EXT_TLS1_2_AND_BELOW_ONLY,

        OSSL_ECH_HANDLING_COMPRESS,

        init_srp, tls_parse_ctos_srp, NULL, NULL, tls_construct_ctos_srp, NULL },

#else

    INVALID_EXTENSION,

#endif

    { TLSEXT_TYPE_ec_point_formats,

        SSL_EXT_CLIENT_HELLO | SSL_EXT_TLS1_2_SERVER_HELLO

            | SSL_EXT_TLS1_2_AND_BELOW_ONLY,

        OSSL_ECH_HANDLING_COMPRESS,

        init_ec_point_formats, tls_parse_ec_pt_formats, tls_parse_ec_pt_formats,

        tls_construct_stoc_ec_pt_formats, tls_construct_ctos_ec_pt_formats,

        NULL },

    { /*

       * "supported_groups" is spread across several specifications.

       * It was originally specified as "elliptic_curves" in RFC 4492,

       * and broadened to include named FFDH groups by RFC 7919.

       * Both RFCs 4492 and 7919 do not include a provision for the server

       * to indicate to the client the complete list of groups supported

       * by the server, with the server instead just indicating the

       * selected group for this connection in the ServerKeyExchange

       * message.  TLS 1.3 adds a scheme for the server to indicate

       * to the client its list of supported groups in the

       * EncryptedExtensions message, but none of the relevant

       * specifications permit sending supported_groups in the ServerHello.

       * Nonetheless (possibly due to the close proximity to the

       * "ec_point_formats" extension, which is allowed in the ServerHello),

       * there are several servers that send this extension in the

       * ServerHello anyway.  Up to and including the 1.1.0 release,

       * we did not check for the presence of nonpermitted extensions,

       * so to avoid a regression, we must permit this extension in the

       * TLS 1.2 ServerHello as well.

       *

       * Note that there is no tls_parse_stoc_supported_groups function,

       * so we do not perform any additional parsing, validation, or

       * processing on the server's group list -- this is just a minimal

       * change to preserve compatibility with these misbehaving servers.

       */

        TLSEXT_TYPE_supported_groups,

        SSL_EXT_CLIENT_HELLO | SSL_EXT_TLS1_3_ENCRYPTED_EXTENSIONS

            | SSL_EXT_TLS1_2_SERVER_HELLO,

        OSSL_ECH_HANDLING_COMPRESS,

        NULL, tls_parse_ctos_supported_groups, NULL,

        tls_construct_stoc_supported_groups,

        tls_construct_ctos_supported_groups, NULL },

    { TLSEXT_TYPE_session_ticket,

        SSL_EXT_CLIENT_HELLO | SSL_EXT_TLS1_2_SERVER_HELLO

            | SSL_EXT_TLS1_2_AND_BELOW_ONLY,

        OSSL_ECH_HANDLING_COMPRESS,

        init_session_ticket, tls_parse_ctos_session_ticket,

        tls_parse_stoc_session_ticket, tls_construct_stoc_session_ticket,

        tls_construct_ctos_session_ticket, NULL },

#ifndef OPENSSL_NO_OCSP

    { TLSEXT_TYPE_status_request,

        SSL_EXT_CLIENT_HELLO | SSL_EXT_TLS1_2_SERVER_HELLO

            | SSL_EXT_TLS1_3_CERTIFICATE | SSL_EXT_TLS1_3_CERTIFICATE_REQUEST,

        OSSL_ECH_HANDLING_COMPRESS,

        init_status_request, tls_parse_ctos_status_request,

        tls_parse_stoc_status_request, tls_construct_stoc_status_request,

        tls_construct_ctos_status_request, NULL },

#else

    INVALID_EXTENSION,

#endif

#ifndef OPENSSL_NO_NEXTPROTONEG

    { TLSEXT_TYPE_next_proto_neg,

        SSL_EXT_CLIENT_HELLO | SSL_EXT_TLS1_2_SERVER_HELLO

            | SSL_EXT_TLS1_2_AND_BELOW_ONLY,

        OSSL_ECH_HANDLING_COMPRESS,

        init_npn, tls_parse_ctos_npn, tls_parse_stoc_npn,

        tls_construct_stoc_next_proto_neg, tls_construct_ctos_npn, NULL },

#else

    INVALID_EXTENSION,

#endif

    { /*

       * Must appear in this list after server_name so that finalisation

       * happens after server_name callbacks

       */

        TLSEXT_TYPE_application_layer_protocol_negotiation,

        SSL_EXT_CLIENT_HELLO | SSL_EXT_TLS1_2_SERVER_HELLO

            | SSL_EXT_TLS1_3_ENCRYPTED_EXTENSIONS,

        OSSL_ECH_HANDLING_CALL_BOTH,

        init_alpn, tls_parse_ctos_alpn, tls_parse_stoc_alpn,

        tls_construct_stoc_alpn, tls_construct_ctos_alpn, final_alpn },

#ifndef OPENSSL_NO_SRTP

    { TLSEXT_TYPE_use_srtp,

        SSL_EXT_CLIENT_HELLO | SSL_EXT_TLS1_2_SERVER_HELLO

            | SSL_EXT_TLS1_3_ENCRYPTED_EXTENSIONS | SSL_EXT_DTLS_ONLY,

        OSSL_ECH_HANDLING_COMPRESS,

        init_srtp, tls_parse_ctos_use_srtp, tls_parse_stoc_use_srtp,

        tls_construct_stoc_use_srtp, tls_construct_ctos_use_srtp, NULL },

#else

    INVALID_EXTENSION,

#endif

    { TLSEXT_TYPE_encrypt_then_mac,

        SSL_EXT_CLIENT_HELLO | SSL_EXT_TLS1_2_SERVER_HELLO

            | SSL_EXT_TLS1_2_AND_BELOW_ONLY,

        /*

         * If you want to demonstrate/exercise duplicate, then

         * this does that and has no effect on sizes, but it

         * will break the quicapi test (see above). Probably

         * best done in local tests and not committed to any

         * upstream.

         * OSSL_ECH_HANDLING_DUPLICATE,

         */

        OSSL_ECH_HANDLING_COMPRESS,

        init_etm, tls_parse_ctos_etm, tls_parse_stoc_etm,

        tls_construct_stoc_etm, tls_construct_ctos_etm, NULL },

#ifndef OPENSSL_NO_CT

    { TLSEXT_TYPE_signed_certificate_timestamp,

        SSL_EXT_CLIENT_HELLO | SSL_EXT_TLS1_2_SERVER_HELLO

            | SSL_EXT_TLS1_3_CERTIFICATE | SSL_EXT_TLS1_3_CERTIFICATE_REQUEST,

        OSSL_ECH_HANDLING_COMPRESS,

        NULL,

        /*

         * No server side support for this, but can be provided by a custom

         * extension. This is an exception to the rule that custom extensions

         * cannot override built in ones.

         */

        NULL, tls_parse_stoc_sct, NULL, tls_construct_ctos_sct, NULL },

#else

    INVALID_EXTENSION,

#endif

    { TLSEXT_TYPE_extended_master_secret,

        SSL_EXT_CLIENT_HELLO | SSL_EXT_TLS1_2_SERVER_HELLO

            | SSL_EXT_TLS1_2_AND_BELOW_ONLY,

        OSSL_ECH_HANDLING_COMPRESS,

        init_ems, tls_parse_ctos_ems, tls_parse_stoc_ems,

        tls_construct_stoc_ems, tls_construct_ctos_ems, final_ems },

    { TLSEXT_TYPE_signature_algorithms_cert,

        SSL_EXT_CLIENT_HELLO | SSL_EXT_TLS1_3_CERTIFICATE_REQUEST,

        OSSL_ECH_HANDLING_COMPRESS,

        init_sig_algs_cert, tls_parse_ctos_sig_algs_cert,

        tls_parse_ctos_sig_algs_cert,

        /* We do not generate signature_algorithms_cert at present. */

        NULL, NULL, NULL },

    {

        TLSEXT_TYPE_post_handshake_auth,

        SSL_EXT_CLIENT_HELLO | SSL_EXT_TLS1_3_ONLY,

        OSSL_ECH_HANDLING_COMPRESS,

        init_post_handshake_auth,

        tls_parse_ctos_post_handshake_auth,

        NULL,

        NULL,

        tls_construct_ctos_post_handshake_auth,

        NULL,

    },

    { TLSEXT_TYPE_client_cert_type,

        SSL_EXT_CLIENT_HELLO | SSL_EXT_TLS1_3_ENCRYPTED_EXTENSIONS

            | SSL_EXT_TLS1_2_SERVER_HELLO,

        OSSL_ECH_HANDLING_CALL_BOTH,

        init_client_cert_type,

        tls_parse_ctos_client_cert_type, tls_parse_stoc_client_cert_type,

        tls_construct_stoc_client_cert_type, tls_construct_ctos_client_cert_type,

        NULL },

    { TLSEXT_TYPE_server_cert_type,

        SSL_EXT_CLIENT_HELLO | SSL_EXT_TLS1_3_ENCRYPTED_EXTENSIONS

            | SSL_EXT_TLS1_2_SERVER_HELLO,

        OSSL_ECH_HANDLING_CALL_BOTH,

        init_server_cert_type,

        tls_parse_ctos_server_cert_type, tls_parse_stoc_server_cert_type,

        tls_construct_stoc_server_cert_type, tls_construct_ctos_server_cert_type,

        NULL },

    { TLSEXT_TYPE_signature_algorithms,

        SSL_EXT_CLIENT_HELLO | SSL_EXT_TLS1_3_CERTIFICATE_REQUEST,

        OSSL_ECH_HANDLING_COMPRESS,

        init_sig_algs, tls_parse_ctos_sig_algs,

        tls_parse_ctos_sig_algs, tls_construct_ctos_sig_algs,

        tls_construct_ctos_sig_algs, final_sig_algs },

    { TLSEXT_TYPE_supported_versions,

        SSL_EXT_CLIENT_HELLO | SSL_EXT_TLS1_3_SERVER_HELLO

            | SSL_EXT_TLS1_3_HELLO_RETRY_REQUEST | SSL_EXT_TLS_IMPLEMENTATION_ONLY,

        OSSL_ECH_HANDLING_COMPRESS,

        NULL,

        /* Processed inline as part of version selection */

        NULL, tls_parse_stoc_supported_versions,

        tls_construct_stoc_supported_versions,

        tls_construct_ctos_supported_versions, final_supported_versions },

    { TLSEXT_TYPE_psk_kex_modes,

        SSL_EXT_CLIENT_HELLO | SSL_EXT_TLS_IMPLEMENTATION_ONLY

            | SSL_EXT_TLS1_3_ONLY,

        OSSL_ECH_HANDLING_COMPRESS,

        init_psk_kex_modes, tls_parse_ctos_psk_kex_modes, NULL, NULL,

        tls_construct_ctos_psk_kex_modes, NULL },

    { /*

       * Must be in this list after supported_groups. We need that to have

       * been parsed before we do this one.

       */

        TLSEXT_TYPE_key_share,

        SSL_EXT_CLIENT_HELLO | SSL_EXT_TLS1_3_SERVER_HELLO

            | SSL_EXT_TLS1_3_HELLO_RETRY_REQUEST | SSL_EXT_TLS_IMPLEMENTATION_ONLY

            | SSL_EXT_TLS1_3_ONLY,

        OSSL_ECH_HANDLING_COMPRESS,

        NULL, tls_parse_ctos_key_share, tls_parse_stoc_key_share,

        tls_construct_stoc_key_share, tls_construct_ctos_key_share,

        final_key_share },

    { /* Must be after key_share */

        TLSEXT_TYPE_cookie,

        SSL_EXT_CLIENT_HELLO | SSL_EXT_TLS1_3_HELLO_RETRY_REQUEST

            | SSL_EXT_TLS_IMPLEMENTATION_ONLY | SSL_EXT_TLS1_3_ONLY,

        OSSL_ECH_HANDLING_COMPRESS,

        NULL, tls_parse_ctos_cookie, tls_parse_stoc_cookie,

        tls_construct_stoc_cookie, tls_construct_ctos_cookie, NULL },

    { /*

       * Special unsolicited ServerHello extension only used when

       * SSL_OP_CRYPTOPRO_TLSEXT_BUG is set. We allow it in a ClientHello but

       * ignore it.

       */

        TLSEXT_TYPE_cryptopro_bug,

        SSL_EXT_CLIENT_HELLO | SSL_EXT_TLS1_2_SERVER_HELLO

            | SSL_EXT_TLS1_2_AND_BELOW_ONLY,

        OSSL_ECH_HANDLING_COMPRESS,

        NULL, NULL, NULL, tls_construct_stoc_cryptopro_bug, NULL, NULL },

    { TLSEXT_TYPE_compress_certificate,

        SSL_EXT_CLIENT_HELLO | SSL_EXT_TLS1_3_CERTIFICATE_REQUEST

            | SSL_EXT_TLS_IMPLEMENTATION_ONLY | SSL_EXT_TLS1_3_ONLY,

        OSSL_ECH_HANDLING_COMPRESS,

        tls_init_compress_certificate,

        tls_parse_compress_certificate, tls_parse_compress_certificate,

        tls_construct_compress_certificate, tls_construct_compress_certificate,

        NULL },

    { TLSEXT_TYPE_early_data,

        SSL_EXT_CLIENT_HELLO | SSL_EXT_TLS1_3_ENCRYPTED_EXTENSIONS

            | SSL_EXT_TLS1_3_NEW_SESSION_TICKET | SSL_EXT_TLS1_3_ONLY,

        OSSL_ECH_HANDLING_CALL_BOTH,

        NULL, tls_parse_ctos_early_data, tls_parse_stoc_early_data,

        tls_construct_stoc_early_data, tls_construct_ctos_early_data,

        final_early_data },

    {

        TLSEXT_TYPE_certificate_authorities,

        SSL_EXT_CLIENT_HELLO | SSL_EXT_TLS1_3_CERTIFICATE_REQUEST

            | SSL_EXT_TLS1_3_ONLY,

        OSSL_ECH_HANDLING_COMPRESS,

        init_certificate_authorities,

        tls_parse_certificate_authorities,

        tls_parse_certificate_authorities,

        tls_construct_certificate_authorities,

        tls_construct_certificate_authorities,

        NULL,

    },

#ifndef OPENSSL_NO_ECH

    { TLSEXT_TYPE_ech,

        SSL_EXT_CLIENT_HELLO | SSL_EXT_TLS1_3_ONLY | SSL_EXT_TLS1_3_ENCRYPTED_EXTENSIONS | SSL_EXT_TLS1_3_HELLO_RETRY_REQUEST,

        OSSL_ECH_HANDLING_CALL_BOTH,

        init_ech,

        tls_parse_ctos_ech, tls_parse_stoc_ech,

        tls_construct_stoc_ech, tls_construct_ctos_ech,

        final_ech },

    { TLSEXT_TYPE_outer_extensions,

        SSL_EXT_CLIENT_HELLO | SSL_EXT_TLS1_3_ONLY,

        OSSL_ECH_HANDLING_CALL_BOTH,

        NULL,

        NULL, NULL,

        NULL, NULL,

        NULL },

#else /* OPENSSL_NO_ECH */

    INVALID_EXTENSION,

    INVALID_EXTENSION,

#endif /* END_OPENSSL_NO_ECH */

    { /* RFC 8701 GREASE extension 1 - type is dynamic */

        TLSEXT_TYPE_grease1,

        SSL_EXT_CLIENT_HELLO,

        0,

        NULL,

        NULL, NULL, NULL, tls_construct_ctos_grease1, NULL },

    { /* RFC 8701 GREASE extension 2 - type is dynamic */

        TLSEXT_TYPE_grease2,

        SSL_EXT_CLIENT_HELLO,

        0,

        NULL,

        NULL, NULL, NULL, tls_construct_ctos_grease2, NULL },

    { /* Must be immediately before pre_shared_key */

        TLSEXT_TYPE_padding,

        SSL_EXT_CLIENT_HELLO,

        OSSL_ECH_HANDLING_CALL_BOTH,

        NULL,

        /* We send this, but don't read it */

        NULL, NULL, NULL, tls_construct_ctos_padding, NULL },

    { /* Required by the TLSv1.3 spec to always be the last extension */

        TLSEXT_TYPE_psk,

        SSL_EXT_CLIENT_HELLO | SSL_EXT_TLS1_3_SERVER_HELLO

            | SSL_EXT_TLS_IMPLEMENTATION_ONLY | SSL_EXT_TLS1_3_ONLY,

        OSSL_ECH_HANDLING_CALL_BOTH,

        NULL, tls_parse_ctos_psk, tls_parse_stoc_psk, tls_construct_stoc_psk,

        tls_construct_ctos_psk, final_psk }

};

#ifndef OPENSSL_NO_ECH

/*

 * Copy an inner extension value to outer.

 * inner CH must have been pre-decoded into s->clienthello->pre_proc_exts

 * already.

 */

int ossl_ech_copy_inner2outer(SSL_CONNECTION *s, uint16_t ext_type,

    int ind, WPACKET *pkt)

{

    RAW_EXTENSION *myext = NULL, *raws = NULL;

    if (s == NULL || s->clienthello == NULL)

        return OSSL_ECH_SAME_EXT_ERR;

    raws = s->clienthello->pre_proc_exts;

    if (raws == NULL)

        return OSSL_ECH_SAME_EXT_ERR;

    myext = &raws[ind];

    OSSL_TRACE_BEGIN(TLS)

    {

        BIO_printf(trc_out, "inner2outer: Copying ext type %d to outer\n",

            ext_type);

    }

    OSSL_TRACE_END(TLS);

    /*

     * copy inner value to outer

     */

    if (PACKET_data(&myext->data) != NULL

        && PACKET_remaining(&myext->data) > 0) {

        if (!WPACKET_put_bytes_u16(pkt, ext_type)

            || !WPACKET_sub_memcpy_u16(pkt, PACKET_data(&myext->data),

                PACKET_remaining(&myext->data)))

            return OSSL_ECH_SAME_EXT_ERR;

    } else {

        /* empty extension */

        if (!WPACKET_put_bytes_u16(pkt, ext_type)

            || !WPACKET_put_bytes_u16(pkt, 0))

            return OSSL_ECH_SAME_EXT_ERR;

    }

    return 1;

}

/*

 * DUPEMALL is useful for testing - this turns off compression and

 * causes two calls to each extension constructor, which'd be the same

 * as making all entries in ext_tab use the CALL_BOTH value

 */

#undef DUPEMALL

/*

 * Check if we're using the same/different key shares

 * return 1 if same key share in inner and outer, 0 otherwise

 */

int ossl_ech_same_key_share(void)

{

#ifdef DUPEMALL

    return 0;

#endif

    return ext_defs[TLSEXT_IDX_key_share].ech_handling

        != OSSL_ECH_HANDLING_CALL_BOTH;

}

/*

 * say if extension at index |ind| in ext_defs is to be ECH compressed

 * return 1 if this one is to be compressed, 0 if not, -1 for error

 */

int ossl_ech_2bcompressed(size_t ind)

{

    const size_t nexts = OSSL_NELEM(ext_defs);

#ifdef DUPEMALL

    return 0;

#endif

    if (ind >= nexts)

        return -1;

    return ext_defs[ind].ech_handling == OSSL_ECH_HANDLING_COMPRESS;

}

/* as needed, repeat extension from inner in outer handling compression */

int ossl_ech_same_ext(SSL_CONNECTION *s, WPACKET *pkt)

{

    unsigned int type = 0;

    int tind = 0, nexts = OSSL_NELEM(ext_defs);

#ifdef DUPEMALL

    return OSSL_ECH_SAME_EXT_CONTINUE;

#endif

    if (s == NULL || s->ext.ech.es == NULL)

        return OSSL_ECH_SAME_EXT_CONTINUE; /* nothing to do */

    /*

     * We store/access the index of the extension handler in

     * s->ext.ech.ext_ind, as we'd otherwise not know it here.

     * Be nice were there a better way to handle that.

     */

    tind = s->ext.ech.ext_ind;

    /* If this index'd extension won't be compressed, we're done */

    if (tind < 0 || tind >= nexts)

        return OSSL_ECH_SAME_EXT_ERR;

    type = ext_defs[tind].type;

    if (s->ext.ech.ch_depth == 1) {

        /* inner CH - just note compression as configured */

        if (ext_defs[tind].ech_handling != OSSL_ECH_HANDLING_COMPRESS)

            return OSSL_ECH_SAME_EXT_CONTINUE;

        /* mark this one to be "compressed" */

        if (s->ext.ech.n_outer_only >= OSSL_ECH_OUTERS_MAX)

            return OSSL_ECH_SAME_EXT_ERR;

        s->ext.ech.outer_only[s->ext.ech.n_outer_only] = type;

        s->ext.ech.n_outer_only++;

        OSSL_TRACE_BEGIN(TLS)

        {

            BIO_printf(trc_out, "ech_same_ext: Marking (type %u, ind %d "

                                "tot-comp %d) for compression\n",

                type, tind,

                (int)s->ext.ech.n_outer_only);

        }

        OSSL_TRACE_END(TLS);

        return OSSL_ECH_SAME_EXT_CONTINUE;

    } else {

        /* Copy value from inner to outer, or indicate a new value needed */

        if (s->clienthello == NULL || pkt == NULL)

            return OSSL_ECH_SAME_EXT_ERR;

        if (ext_defs[tind].ech_handling == OSSL_ECH_HANDLING_CALL_BOTH)

            return OSSL_ECH_SAME_EXT_CONTINUE;

        else

            return ossl_ech_copy_inner2outer(s, type, tind, pkt);

    }

    /* just in case - shouldn't happen */

    return OSSL_ECH_SAME_EXT_ERR;

}

#endif

/* Returns a TLSEXT_TYPE for the given index */

unsigned int ossl_get_extension_type(size_t idx)

{

    size_t num_exts = OSSL_NELEM(ext_defs);

    if (idx >= num_exts)

        return TLSEXT_TYPE_out_of_range;

    return ext_defs[idx].type;

}

/* Check whether an extension's context matches the current context */

static int validate_context(SSL_CONNECTION *s, unsigned int extctx,

    unsigned int thisctx)

{

    /* Check we're allowed to use this extension in this context */

    if ((thisctx & extctx) == 0)

        return 0;

    if (SSL_CONNECTION_IS_DTLS(s)) {

        if ((extctx & SSL_EXT_TLS_ONLY) != 0)

            return 0;

    } else if ((extctx & SSL_EXT_DTLS_ONLY) != 0) {

        return 0;

    }

    return 1;

}

int tls_validate_all_contexts(SSL_CONNECTION *s, unsigned int thisctx,

    RAW_EXTENSION *exts)

{

    size_t i, num_exts, builtin_num = OSSL_NELEM(ext_defs), offset;

    RAW_EXTENSION *thisext;

    unsigned int context;

    ENDPOINT role = ENDPOINT_BOTH;

    if ((thisctx & SSL_EXT_CLIENT_HELLO) != 0)

        role = ENDPOINT_SERVER;

    else if ((thisctx & SSL_EXT_TLS1_2_SERVER_HELLO) != 0)

        role = ENDPOINT_CLIENT;

    /* Calculate the number of extensions in the extensions list */

    num_exts = builtin_num + s->cert->custext.meths_count;

    for (thisext = exts, i = 0; i < num_exts; i++, thisext++) {

        if (!thisext->present)

            continue;

        if (i < builtin_num) {

            context = ext_defs[i].context;

        } else {

            custom_ext_method *meth = NULL;

            meth = custom_ext_find(&s->cert->custext, role, thisext->type,

                &offset);

            if (!ossl_assert(meth != NULL))

                return 0;

            context = meth->context;

        }

        if (!validate_context(s, context, thisctx))

            return 0;

    }

    return 1;

}

/*

 * Verify whether we are allowed to use the extension |type| in the current

 * |context|. Returns 1 to indicate the extension is allowed or unknown or 0 to

 * indicate the extension is not allowed. If returning 1 then |*found| is set to

 * the definition for the extension we found.

 */

static int verify_extension(SSL_CONNECTION *s, unsigned int context,

    unsigned int type, custom_ext_methods *meths,

    RAW_EXTENSION *rawexlist, RAW_EXTENSION **found)

{

    size_t i;

    size_t builtin_num = OSSL_NELEM(ext_defs);

    const EXTENSION_DEFINITION *thisext;

    for (i = 0, thisext = ext_defs; i < builtin_num; i++, thisext++) {

        if (type == thisext->type) {

            if (!validate_context(s, thisext->context, context))

                return 0;

            *found = &rawexlist[i];

            return 1;

        }

    }

    /* Check the custom extensions */

    if (meths != NULL) {

        size_t offset = 0;

        ENDPOINT role = ENDPOINT_BOTH;

        custom_ext_method *meth = NULL;

        if ((context & SSL_EXT_CLIENT_HELLO) != 0) {

#ifndef OPENSSL_NO_ECH

            if (s->ext.ech.attempted == 1 && s->ext.ech.ch_depth == 1)

                role = ENDPOINT_CLIENT;

            else

                role = ENDPOINT_SERVER;

#else

            role = ENDPOINT_SERVER;

#endif

        } else if ((context & SSL_EXT_TLS1_2_SERVER_HELLO) != 0)

            role = ENDPOINT_CLIENT;

        meth = custom_ext_find(meths, role, type, &offset);

        if (meth != NULL) {

            if (!validate_context(s, meth->context, context))

                return 0;

            *found = &rawexlist[offset + builtin_num];

            return 1;

        }

    }

    /* Unknown extension. We allow it */

    *found = NULL;

    return 1;

}

/*

 * Parse an ec_point_formats extension off the wire (one function for

 * both sides).  The peer's list is retained verbatim for

 * SSL_get0_ec_point_formats() and for the RFC 4492/8422 section 5.1.2

 * 'uncompressed must be present' check.

 *

 * The check is gated on the negotiated ciphersuite -- a TLS 1.3

 * handshake or a non-ECC TLS 1.2 ciphersuite makes the extension moot

 * and any missing 'uncompressed' codepoint is ignored.  On the client

 * the chosen ciphersuite is already locked in by the time we parse

 * ServerHello, so the check happens inline here.  On the server it's

 * deferred to tls_construct_stoc_ec_pt_formats(), the first point at

 * which s->s3.tmp.new_cipher is set for TLS 1.2.

 */

static int tls_parse_ec_pt_formats(SSL_CONNECTION *s, PACKET *pkt,

    unsigned int context, X509 *x, size_t chainidx)

{

    PACKET list;

    if (!PACKET_as_length_prefixed_1(pkt, &list)

        || PACKET_remaining(&list) == 0) {

        SSLfatal(s, SSL_AD_DECODE_ERROR, SSL_R_BAD_EXTENSION);

        return 0;

    }

    if (!s->hit

        && !PACKET_memdup(&list, &s->ext.peer_ecpointformats,

            &s->ext.peer_ecpointformats_len)) {

        SSLfatal(s, SSL_AD_INTERNAL_ERROR, ERR_R_INTERNAL_ERROR);

        return 0;

    }

    if (!s->server) {

        unsigned long alg_k = s->s3.tmp.new_cipher->algorithm_mkey;

        unsigned long alg_a = s->s3.tmp.new_cipher->algorithm_auth;

        if (((alg_k & SSL_kECDHE) || (alg_a & SSL_aECDSA))

            && memchr(PACKET_data(&list),

                   TLSEXT_ECPOINTFORMAT_uncompressed,

                   PACKET_remaining(&list))

                == NULL) {

            SSLfatal(s, SSL_AD_ILLEGAL_PARAMETER,

                SSL_R_TLS_INVALID_ECPOINTFORMAT_LIST);

            return 0;

        }

    }

    return 1;

}

/*

 * Verify that all extensions in |packet| are known built-in or custom

 * extension types. This is used for TLS 1.3 server extension responses where

 * unknown extensions are not ignored.

 */

int tls_validate_no_unknown_extensions(SSL_CONNECTION *s, PACKET *packet,

    unsigned int context)

{

    PACKET extensions = *packet;

    custom_ext_methods *exts = &s->cert->custext;

    ENDPOINT role = ENDPOINT_BOTH;

    if ((context & SSL_EXT_CLIENT_HELLO) != 0) {

#ifndef OPENSSL_NO_ECH

        if (s->ext.ech.attempted == 1 && s->ext.ech.ch_depth == 1)

            role = ENDPOINT_CLIENT;

        else

            role = ENDPOINT_SERVER;

#else

        role = ENDPOINT_SERVER;

#endif

    } else if ((context & SSL_EXT_TLS1_2_SERVER_HELLO) != 0) {

        role = ENDPOINT_CLIENT;

    }

    while (PACKET_remaining(&extensions) > 0) {

        unsigned int type;

        size_t i;

        PACKET extension;

        const EXTENSION_DEFINITION *thisext;

        if (!PACKET_get_net_2(&extensions, &type)

            || !PACKET_get_length_prefixed_2(&extensions, &extension)) {

            SSLfatal(s, SSL_AD_DECODE_ERROR, SSL_R_BAD_EXTENSION);

            return 0;

        }

        for (i = 0, thisext = ext_defs; i < OSSL_NELEM(ext_defs);

            i++, thisext++) {

            if (type == thisext->type)

                break;

        }

        if (i < OSSL_NELEM(ext_defs))

            continue;

        if (exts != NULL && custom_ext_find(exts, role, type, NULL) != NULL)

            continue;

        SSLfatal(s, SSL_AD_UNSUPPORTED_EXTENSION,

            SSL_R_UNSOLICITED_EXTENSION);

        return 0;

    }

    return 1;

}

/*

 * Check whether the context defined for an extension |extctx| means whether

 * the extension is relevant for the current context |thisctx| or not. Returns

 * 1 if the extension is relevant for this context, and 0 otherwise

 */

int extension_is_relevant(SSL_CONNECTION *s, unsigned int extctx,

    unsigned int thisctx)

{

    int is_tls13;

    /*

     * For HRR we haven't selected the version yet but we know it will be

     * TLSv1.3

     */

    if ((thisctx & SSL_EXT_TLS1_3_HELLO_RETRY_REQUEST) != 0)

        is_tls13 = 1;

    else

        is_tls13 = SSL_CONNECTION_IS_TLS13(s);

    if ((SSL_CONNECTION_IS_DTLS(s)

            && (extctx & SSL_EXT_TLS_IMPLEMENTATION_ONLY) != 0)

        /*

         * Note that SSL_IS_TLS13() means "TLS 1.3 has been negotiated",

         * which is never true when generating the ClientHello.

         * However, version negotiation *has* occurred by the time the

         * ClientHello extensions are being parsed.

         * Be careful to allow TLS 1.3-only extensions when generating

         * the ClientHello.

         */

        || (is_tls13 && (extctx & SSL_EXT_TLS1_2_AND_BELOW_ONLY) != 0)

        || (!is_tls13 && (extctx & SSL_EXT_TLS1_3_ONLY) != 0

            && (thisctx & SSL_EXT_CLIENT_HELLO) == 0)

        || (s->server && !is_tls13 && (extctx & SSL_EXT_TLS1_3_ONLY) != 0)

        || (s->hit && (extctx & SSL_EXT_IGNORE_ON_RESUMPTION) != 0))

        return 0;

    return 1;

}

/*

 * Gather a list of all the extensions from the data in |packet]. |context|

 * tells us which message this extension is for. The raw extension data is

 * stored in |*res| on success. We don't actually process the content of the

 * extensions yet, except to check their types. This function also runs the

 * initialiser functions for all known extensions if |init| is nonzero (whether

 * we have collected them or not). If successful the caller is responsible for

 * freeing the contents of |*res|.

 *

 * Per http://tools.ietf.org/html/rfc5246#section-7.4.1.4, there may not be

 * more than one extension of the same type in a ClientHello or ServerHello.

 * This function returns 1 if all extensions are unique and we have parsed their

 * types, and 0 if the extensions contain duplicates, could not be successfully

 * found, or an internal error occurred. We only check duplicates for

 * extensions that we know about. We ignore others.

 */

int tls_collect_extensions(SSL_CONNECTION *s, PACKET *packet,

    unsigned int context,

    RAW_EXTENSION **res, size_t *len, int init)

{

    PACKET extensions = *packet;

    size_t i = 0;

    size_t num_exts;

    custom_ext_methods *exts = &s->cert->custext;

    RAW_EXTENSION *raw_extensions = NULL;

    const EXTENSION_DEFINITION *thisexd;

    *res = NULL;

    /*

     * Initialise server side custom extensions. Client side is done during

     * construction of extensions for the ClientHello.

     */

#ifndef OPENSSL_NO_ECH

    if ((context & SSL_EXT_CLIENT_HELLO) != 0 && s->ext.ech.attempted == 0)

        custom_ext_init(&s->cert->custext);

#else

    if ((context & SSL_EXT_CLIENT_HELLO) != 0)

        custom_ext_init(&s->cert->custext);

#endif

    num_exts = OSSL_NELEM(ext_defs) + (exts != NULL ? exts->meths_count : 0);

    raw_extensions = OPENSSL_calloc(num_exts, sizeof(*raw_extensions));

    if (raw_extensions == NULL) {

        SSLfatal(s, SSL_AD_INTERNAL_ERROR, ERR_R_CRYPTO_LIB);

        return 0;

    }

    i = 0;

    while (PACKET_remaining(&extensions) > 0) {

        unsigned int type, idx;

        PACKET extension;

        RAW_EXTENSION *thisex;

        if (!PACKET_get_net_2(&extensions, &type) || !PACKET_get_length_prefixed_2(&extensions, &extension)) {

            SSLfatal(s, SSL_AD_DECODE_ERROR, SSL_R_BAD_EXTENSION);

            goto err;

        }

        /*

         * Verify this extension is allowed. We only check duplicates for

         * extensions that we recognise. We also have a special case for the

         * PSK extension, which must be the last one in the ClientHello.

         */

        if (!verify_extension(s, context, type, exts, raw_extensions, &thisex)

            || (thisex != NULL && thisex->present == 1)

            || (type == TLSEXT_TYPE_psk

                && (context & SSL_EXT_CLIENT_HELLO) != 0

                && PACKET_remaining(&extensions) != 0)) {

            SSLfatal(s, SSL_AD_ILLEGAL_PARAMETER, SSL_R_BAD_EXTENSION);

            goto err;

        }

        /* The server must tolerate the unknown extension and complete. */

        if (thisex == NULL)

            continue;

        idx = (unsigned int)(thisex - raw_extensions);

        /*-

         * Check that we requested this extension (if appropriate). Requests can

         * be sent in the ClientHello and CertificateRequest. Unsolicited

         * extensions can be sent in the NewSessionTicket. We only do this for

         * the built-in extensions. Custom extensions have a different but

         * similar check elsewhere.

         * Special cases:

         * - The HRR cookie extension is unsolicited

         * - The renegotiate extension is unsolicited (the client signals

         *   support via an SCSV)

         * - The signed_certificate_timestamp extension can be provided by a

         * custom extension or by the built-in version. We let the extension

         * itself handle unsolicited response checks.

         */

        if (idx < OSSL_NELEM(ext_defs)

            && (context & (SSL_EXT_CLIENT_HELLO | SSL_EXT_TLS1_3_CERTIFICATE_REQUEST | SSL_EXT_TLS1_3_NEW_SESSION_TICKET)) == 0

            && type != TLSEXT_TYPE_cookie

            && type != TLSEXT_TYPE_renegotiate

            && type != TLSEXT_TYPE_signed_certificate_timestamp

            && (s->ext.extflags[idx] & SSL_EXT_FLAG_SENT) == 0