/*

 * Copyright (C) 2002-2016 Free Software Foundation, Inc.

 * Copyright (C) 2014-2016 Nikos Mavrogiannopoulos

 * Copyright (C) 2015-2018 Red Hat, Inc.

 *

 * Author: Nikos Mavrogiannopoulos

 *

 * This file is part of GnuTLS.

 *

 * The GnuTLS is free software; you can redistribute it and/or

 * modify it under the terms of the GNU Lesser General Public License

 * as published by the Free Software Foundation; either version 2.1 of

 * the License, or (at your option) any later version.

 *

 * This library is distributed in the hope that it will be useful, but

 * WITHOUT ANY WARRANTY; without even the implied warranty of

 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU

 * Lesser General Public License for more details.

 *

 * You should have received a copy of the GNU Lesser General Public License

 * along with this program.  If not, see <https://www.gnu.org/licenses/>

 *

 */

/* Functions to manipulate the session (gnutls_int.h), and some other stuff

 * are included here. The file's name is traditionally gnutls_state even if the

 * state has been renamed to session.

 */

#include "gnutls_int.h"

#include "errors.h"

#include <auth.h>

#include <num.h>

#include <datum.h>

#include <db.h>

#include <record.h>

#include <handshake.h>

#include <dh.h>

#include <buffers.h>

#include <mbuffers.h>

#include <state.h>

#include <constate.h>

#include <auth/cert.h>

#include <auth/anon.h>

#include <auth/psk.h>

#include <algorithms.h>

#include <hello_ext.h>

#include <system.h>

#include <random.h>

#include <fips.h>

#include <intprops.h>

#include <gnutls/dtls.h>

#include "dtls.h"

#include "tls13/session_ticket.h"

#include "ext/cert_types.h"

#include "locks.h"

#include "kx.h"

#ifdef HAVE_VALGRIND_MEMCHECK_H

#include <valgrind/memcheck.h>

#endif

/* to be used by supplemental data support to disable TLS1.3

 * when supplemental data have been globally registered */

unsigned _gnutls_disable_tls13 = 0;

/* These should really be static, but src/tests.c calls them.  Make

   them public functions?  */

void

_gnutls_rsa_pms_set_version(gnutls_session_t session,

			    unsigned char major, unsigned char minor);

/**

 * gnutls_cipher_get:

 * @session: is a #gnutls_session_t type.

 *

 * Get the currently used cipher.

 *

 * Returns: the currently used cipher, a #gnutls_cipher_algorithm_t

 *   type.

 **/

gnutls_cipher_algorithm_t gnutls_cipher_get(gnutls_session_t session)

{

	record_parameters_st *record_params;

	int ret;

	ret =

	    _gnutls_epoch_get(session, EPOCH_READ_CURRENT, &record_params);

	if (ret < 0)

		return gnutls_assert_val(GNUTLS_CIPHER_NULL);

	return record_params->cipher->id;

}

/**

 * gnutls_certificate_type_get:

 * @session: is a #gnutls_session_t type.

 *

 * This function returns the type of the certificate that is negotiated

 * for this side to send to the peer. The certificate type is by default

 * X.509, unless an alternative certificate type is enabled by

 * gnutls_init() and negotiated during the session.

 *

 * Resumed sessions will return the certificate type that was negotiated

 * and used in the original session.

 *

 * As of version 3.6.4 it is recommended to use

 * gnutls_certificate_type_get2() which is more fine-grained.

 *

 * Returns: the currently used #gnutls_certificate_type_t certificate

 *   type as negotiated for 'our' side of the connection.

 **/

gnutls_certificate_type_t

gnutls_certificate_type_get(gnutls_session_t session)

{

	return gnutls_certificate_type_get2(session, GNUTLS_CTYPE_OURS);

}

/**

 * gnutls_certificate_type_get2:

 * @session: is a #gnutls_session_t type.

 * @target: is a #gnutls_ctype_target_t type.

 *

 * This function returns the type of the certificate that a side

 * is negotiated to use.  The certificate type is by default X.509,

 * unless an alternative certificate type is enabled by gnutls_init() and

 * negotiated during the session.

 *

 * The @target parameter specifies whether to request the negotiated

 * certificate type for the client (%GNUTLS_CTYPE_CLIENT),

 * or for the server (%GNUTLS_CTYPE_SERVER). Additionally, in P2P mode

 * connection set up where you don't know in advance who will be client

 * and who will be server you can use the flag (%GNUTLS_CTYPE_OURS) and

 * (%GNUTLS_CTYPE_PEERS) to retrieve the corresponding certificate types.

 *

 * Resumed sessions will return the certificate type that was negotiated

 * and used in the original session. That is, this function can be used

 * to reliably determine the type of the certificate returned by

 * gnutls_certificate_get_peers().

 *

 * Returns: the currently used #gnutls_certificate_type_t certificate

 *   type for the client or the server.

 *

 * Since: 3.6.4

 **/

gnutls_certificate_type_t

gnutls_certificate_type_get2(gnutls_session_t session,

			     gnutls_ctype_target_t target)

{

	/* We want to inline this function so therefore

	 * we've defined it in gnutls_int.h */

	return get_certificate_type(session, target);

}

/**

 * gnutls_kx_get:

 * @session: is a #gnutls_session_t type.

 *

 * Get the currently used key exchange algorithm.

 *

 * This function will return %GNUTLS_KX_ECDHE_RSA, or %GNUTLS_KX_DHE_RSA

 * under TLS 1.3, to indicate an elliptic curve DH key exchange or

 * a finite field one. The precise group used is available

 * by calling gnutls_group_get() instead.

 *

 * Returns: the key exchange algorithm used in the last handshake, a

 *   #gnutls_kx_algorithm_t value.

 **/

gnutls_kx_algorithm_t gnutls_kx_get(gnutls_session_t session)

{

	if (session->security_parameters.cs == 0)

		return 0;

	if (session->security_parameters.cs->kx_algorithm == 0) { /* TLS 1.3 */

		const version_entry_st *ver = get_version(session);

		const gnutls_group_entry_st *group = get_group(session);

		if (ver->tls13_sem) {

			if (session->internals.hsk_flags & HSK_PSK_SELECTED) {

				if (group) {

					if (group->pk == GNUTLS_PK_DH)

						return GNUTLS_KX_DHE_PSK;

					else

						return GNUTLS_KX_ECDHE_PSK;

				} else {

					return GNUTLS_KX_PSK;

				}

			} else if (group) {

				if (group->pk == GNUTLS_PK_DH)

					return GNUTLS_KX_DHE_RSA;

				else

					return GNUTLS_KX_ECDHE_RSA;

			}

		}

	}

	return session->security_parameters.cs->kx_algorithm;

}

/**

 * gnutls_mac_get:

 * @session: is a #gnutls_session_t type.

 *

 * Get the currently used MAC algorithm.

 *

 * Returns: the currently used mac algorithm, a

 *   #gnutls_mac_algorithm_t value.

 **/

gnutls_mac_algorithm_t gnutls_mac_get(gnutls_session_t session)

{

	record_parameters_st *record_params;

	int ret;

	ret =

	    _gnutls_epoch_get(session, EPOCH_READ_CURRENT, &record_params);

	if (ret < 0)

		return gnutls_assert_val(GNUTLS_MAC_NULL);

	return record_params->mac->id;

}

/**

 * gnutls_compression_get:

 * @session: is a #gnutls_session_t type.

 *

 * Get the currently used compression algorithm.

 *

 * Returns: the currently used compression method, a

 *   #gnutls_compression_method_t value.

 **/

gnutls_compression_method_t

gnutls_compression_get(gnutls_session_t session)

{

	return GNUTLS_COMP_NULL;

}

/**

 * gnutls_prf_hash_get:

 * @session: is a #gnutls_session_t type.

 *

 * Get the currently used hash algorithm. In TLS 1.3, the hash

 * algorithm is used for both the key derivation function and

 * handshake message authentication code. In TLS 1.2, it matches the

 * hash algorithm used for PRF.

 *

 * Returns: the currently used hash algorithm, a

 *    #gnutls_digest_algorithm_t value.

 *

 * Since: 3.6.13

 **/

gnutls_digest_algorithm_t

gnutls_prf_hash_get(const gnutls_session_t session)

{

	if (session->security_parameters.prf == NULL)

		return gnutls_assert_val(GNUTLS_DIG_UNKNOWN);

	if (session->security_parameters.prf->id >= GNUTLS_MAC_AEAD)

		return gnutls_assert_val(GNUTLS_DIG_UNKNOWN);

	return (gnutls_digest_algorithm_t)session->security_parameters.prf->id;

}

void reset_binders(gnutls_session_t session)

{

	_gnutls_free_temp_key_datum(&session->key.binders[0].psk);

	_gnutls_free_temp_key_datum(&session->key.binders[1].psk);

	memset(session->key.binders, 0, sizeof(session->key.binders));

}

/* Check whether certificate credentials of type @cert_type are set

 * for the current session.

 */

static bool _gnutls_has_cert_credentials(gnutls_session_t session,

						gnutls_certificate_type_t cert_type)

{

	unsigned i;

	unsigned cert_found = 0;

	gnutls_certificate_credentials_t cred;

	/* First, check for certificate credentials. If we have no certificate

	 * credentials set then we don't support certificates at all.

	 */

	cred = (gnutls_certificate_credentials_t)

			_gnutls_get_cred(session, GNUTLS_CRD_CERTIFICATE);

	if (cred == NULL)

		return false;

	/* There are credentials initialized. Now check whether we can find

	 * pre-set certificates of the required type, but only if we don't

	 * use the callback functions.

	 */

	if (cred->get_cert_callback3 == NULL) {

		for (i = 0; i < cred->ncerts; i++) {

			if (cred->certs[i].cert_list[0].type == cert_type) {

				cert_found = 1;

				break;

			}

		}

		if (cert_found == 0) {

			/* No matching certificate found. */

			return false;

		}

	}

	return true; // OK

}

/* Check if the given certificate type is supported.

 * This means that it is enabled by the priority functions,

 * and in some cases a matching certificate exists. A check for

 * the latter can be toggled via the parameter @check_credentials.

 */

int

_gnutls_session_cert_type_supported(gnutls_session_t session,

				    gnutls_certificate_type_t cert_type,

				    bool check_credentials,

				    gnutls_ctype_target_t target)

{

	unsigned i;

	priority_st* ctype_priorities;

	// Check whether this cert type is enabled by the application

	if (!is_cert_type_enabled(session, cert_type))

		return gnutls_assert_val(GNUTLS_E_UNSUPPORTED_CERTIFICATE_TYPE);

	// Perform a credentials check if requested

	if (check_credentials)	{

		if (!_gnutls_has_cert_credentials(session, cert_type))

			return gnutls_assert_val(GNUTLS_E_UNSUPPORTED_CERTIFICATE_TYPE);

	}

	/* So far so good. We have the required credentials (if needed).

	 * Now check whether we are allowed to use them according to our

	 * priorities.

	 */

	// Which certificate type should we query?

	switch (target) {

		case GNUTLS_CTYPE_CLIENT:

			ctype_priorities =

					&(session->internals.priorities->client_ctype);

			break;

		case GNUTLS_CTYPE_SERVER:

			ctype_priorities =

					&(session->internals.priorities->server_ctype);

			break;

		default:

			return gnutls_assert_val(GNUTLS_E_INVALID_REQUEST);

	}

	// No explicit priorities set, and default ctype is asked

	if (ctype_priorities->num_priorities == 0

	    && cert_type == DEFAULT_CERT_TYPE)

		return 0;

	/* Now lets find out whether our cert type is in our priority

	 * list, i.e. set of allowed cert types.

	 */

	for (i = 0; i < ctype_priorities->num_priorities; i++) {

		if (ctype_priorities->priorities[i] == cert_type)

			return 0;

	}

	return GNUTLS_E_UNSUPPORTED_CERTIFICATE_TYPE;

}

static void deinit_keys(gnutls_session_t session)

{

	const version_entry_st *vers = get_version(session);

	if (vers == NULL)

		return;

	gnutls_pk_params_release(&session->key.kshare.ecdhx_params);

	gnutls_pk_params_release(&session->key.kshare.ecdh_params);

	gnutls_pk_params_release(&session->key.kshare.dh_params);

	if (!vers->tls13_sem && session->key.binders[0].prf == NULL) {

		gnutls_pk_params_release(&session->key.proto.tls12.ecdh.params);

		gnutls_pk_params_release(&session->key.proto.tls12.dh.params);

		zrelease_temp_mpi_key(&session->key.proto.tls12.ecdh.x);

		zrelease_temp_mpi_key(&session->key.proto.tls12.ecdh.y);

		_gnutls_free_temp_key_datum(&session->key.proto.tls12.ecdh.raw);

		zrelease_temp_mpi_key(&session->key.proto.tls12.dh.client_Y);

		/* SRP */

		zrelease_temp_mpi_key(&session->key.proto.tls12.srp.srp_p);

		zrelease_temp_mpi_key(&session->key.proto.tls12.srp.srp_g);

		zrelease_temp_mpi_key(&session->key.proto.tls12.srp.srp_key);

		zrelease_temp_mpi_key(&session->key.proto.tls12.srp.u);

		zrelease_temp_mpi_key(&session->key.proto.tls12.srp.a);

		zrelease_temp_mpi_key(&session->key.proto.tls12.srp.x);

		zrelease_temp_mpi_key(&session->key.proto.tls12.srp.A);

		zrelease_temp_mpi_key(&session->key.proto.tls12.srp.B);

		zrelease_temp_mpi_key(&session->key.proto.tls12.srp.b);

	} else {

		gnutls_memset(session->key.proto.tls13.temp_secret, 0,

			      sizeof(session->key.proto.tls13.temp_secret));

	}

	reset_binders(session);

	_gnutls_free_temp_key_datum(&session->key.key);

}

/* An internal version of _gnutls_handshake_internal_state_clear(),

 * it will not attempt to deallocate, only initialize */

static void handshake_internal_state_clear1(gnutls_session_t session)

{

	/* by default no selected certificate */

	session->internals.adv_version_major = 0;

	session->internals.adv_version_minor = 0;

	session->internals.direction = 0;

	/* use out of band data for the last

	 * handshake messages received.

	 */

	session->internals.last_handshake_in = -1;

	session->internals.last_handshake_out = -1;

	session->internals.resumable = RESUME_TRUE;

	session->internals.handshake_suspicious_loops = 0;

	session->internals.dtls.hsk_read_seq = 0;

	session->internals.dtls.hsk_write_seq = 0;

	session->internals.cand_ec_group = 0;

	session->internals.cand_dh_group = 0;

	session->internals.hrr_cs[0] = CS_INVALID_MAJOR;

	session->internals.hrr_cs[1] = CS_INVALID_MINOR;

}

/* This function will clear all the variables in internals

 * structure within the session, which depend on the current handshake.

 * This is used to allow further handshakes.

 */

void _gnutls_handshake_internal_state_clear(gnutls_session_t session)

{

	handshake_internal_state_clear1(session);

	_gnutls_handshake_hash_buffers_clear(session);

	deinit_keys(session);

	_gnutls_epoch_gc(session);

	session->internals.handshake_abs_timeout.tv_sec = 0;

	session->internals.handshake_abs_timeout.tv_nsec = 0;

	session->internals.handshake_in_progress = 0;

	session->internals.tfo.connect_addrlen = 0;

	session->internals.tfo.connect_only = 0;

	session->internals.early_data_received = 0;

}

/**

 * gnutls_init:

 * @session: is a pointer to a #gnutls_session_t type.

 * @flags: indicate if this session is to be used for server or client.

 *

 * This function initializes the provided session. Every

 * session must be initialized before use, and must be deinitialized

 * after used by calling gnutls_deinit().

 *

 * @flags can be any combination of flags from %gnutls_init_flags_t.

 *

 * Note that since version 3.1.2 this function enables some common

 * TLS extensions such as session tickets and OCSP certificate status

 * request in client side by default. To prevent that use the %GNUTLS_NO_EXTENSIONS

 * flag.

 *

 * Returns: %GNUTLS_E_SUCCESS on success, or an error code.

 **/

int gnutls_init(gnutls_session_t * session, unsigned int flags)

{

	int ret;

	FAIL_IF_LIB_ERROR;

	*session = gnutls_calloc(1, sizeof(struct gnutls_session_int));

	if (*session == NULL)

		return GNUTLS_E_MEMORY_ERROR;

	ret = gnutls_mutex_init(&(*session)->internals.post_negotiation_lock);

	if (ret < 0) {

		gnutls_assert();

		gnutls_free(*session);

		return ret;

	}

	ret = gnutls_mutex_init(&(*session)->internals.epoch_lock);

	if (ret < 0) {

		gnutls_assert();

		gnutls_mutex_deinit(&(*session)->internals.post_negotiation_lock);

		gnutls_free(*session);

		return ret;

	}

	ret = _gnutls_epoch_setup_next(*session, 1, NULL);

	if (ret < 0) {

		gnutls_mutex_deinit(&(*session)->internals.post_negotiation_lock);

		gnutls_mutex_deinit(&(*session)->internals.epoch_lock);

		gnutls_free(*session);

		return gnutls_assert_val(GNUTLS_E_MEMORY_ERROR);

	}

	_gnutls_epoch_bump(*session);

	(*session)->security_parameters.entity =

	    (flags & GNUTLS_SERVER ? GNUTLS_SERVER : GNUTLS_CLIENT);

	/* the default certificate type for TLS */

	(*session)->security_parameters.client_ctype = DEFAULT_CERT_TYPE;

	(*session)->security_parameters.server_ctype = DEFAULT_CERT_TYPE;

	/* Initialize buffers */

	_gnutls_buffer_init(&(*session)->internals.handshake_hash_buffer);

	_gnutls_buffer_init(&(*session)->internals.post_handshake_hash_buffer);

	_gnutls_buffer_init(&(*session)->internals.hb_remote_data);

	_gnutls_buffer_init(&(*session)->internals.hb_local_data);

	_gnutls_buffer_init(&(*session)->internals.record_presend_buffer);

	_gnutls_buffer_init(&(*session)->internals.record_key_update_buffer);

	_gnutls_buffer_init(&(*session)->internals.reauth_buffer);

	_mbuffer_head_init(&(*session)->internals.record_buffer);

	_mbuffer_head_init(&(*session)->internals.record_send_buffer);

	_mbuffer_head_init(&(*session)->internals.record_recv_buffer);

	_mbuffer_head_init(&(*session)->internals.early_data_recv_buffer);

	_gnutls_buffer_init(&(*session)->internals.early_data_presend_buffer);

	_mbuffer_head_init(&(*session)->internals.handshake_send_buffer);

	_gnutls_handshake_recv_buffer_init(*session);

	(*session)->internals.expire_time = DEFAULT_EXPIRE_TIME;

	/* Ticket key rotation - set the default X to 3 times the ticket expire time */

	(*session)->key.totp.last_result = 0;

	gnutls_handshake_set_max_packet_length((*session),

					       MAX_HANDSHAKE_PACKET_SIZE);

	/* set the socket pointers to -1;

	 */

	(*session)->internals.transport_recv_ptr =

	    (gnutls_transport_ptr_t) - 1;

	(*session)->internals.transport_send_ptr =

	    (gnutls_transport_ptr_t) - 1;

	/* set the default maximum record size for TLS

	 */

	(*session)->security_parameters.max_record_recv_size =

	    DEFAULT_MAX_RECORD_SIZE;

	(*session)->security_parameters.max_record_send_size =

	    DEFAULT_MAX_RECORD_SIZE;

	(*session)->security_parameters.max_user_record_recv_size =

	    DEFAULT_MAX_RECORD_SIZE;

	(*session)->security_parameters.max_user_record_send_size =

	    DEFAULT_MAX_RECORD_SIZE;

	/* set the default early data size for TLS

	 */

	if ((*session)->security_parameters.entity == GNUTLS_SERVER) {

		(*session)->security_parameters.max_early_data_size =

			DEFAULT_MAX_EARLY_DATA_SIZE;

	} else {

		(*session)->security_parameters.max_early_data_size =

			UINT32_MAX;

	}

	/* Everything else not initialized here is initialized as NULL

	 * or 0. This is why calloc is used. However, we want to

	 * ensure that certain portions of data are initialized at

	 * runtime before being used. Mark such regions with a

	 * valgrind client request as undefined.

	 */

#ifdef HAVE_VALGRIND_MEMCHECK_H

	if (RUNNING_ON_VALGRIND) {

		if (flags & GNUTLS_CLIENT)

			VALGRIND_MAKE_MEM_UNDEFINED((*session)->security_parameters.client_random,

						    GNUTLS_RANDOM_SIZE);

		if (flags & GNUTLS_SERVER) {

			VALGRIND_MAKE_MEM_UNDEFINED((*session)->security_parameters.server_random,

						    GNUTLS_RANDOM_SIZE);

			VALGRIND_MAKE_MEM_UNDEFINED((*session)->key.session_ticket_key,

						    TICKET_MASTER_KEY_SIZE);

		}

	}

#endif

	handshake_internal_state_clear1(*session);

#ifdef HAVE_WRITEV

#ifdef MSG_NOSIGNAL

	if (flags & GNUTLS_NO_SIGNAL)

		gnutls_transport_set_vec_push_function(*session, system_writev_nosignal);

	else

#endif

		gnutls_transport_set_vec_push_function(*session, system_writev);

#else

	gnutls_transport_set_push_function(*session, system_write);

#endif

	(*session)->internals.pull_timeout_func = gnutls_system_recv_timeout;

	(*session)->internals.pull_func = system_read;

	(*session)->internals.errno_func = system_errno;

	(*session)->internals.saved_username_size = -1;

	/* heartbeat timeouts */

	(*session)->internals.hb_retrans_timeout_ms = 1000;

	(*session)->internals.hb_total_timeout_ms = 60000;

	if (flags & GNUTLS_DATAGRAM) {

		(*session)->internals.dtls.mtu = DTLS_DEFAULT_MTU;

		(*session)->internals.transport = GNUTLS_DGRAM;

		gnutls_dtls_set_timeouts(*session, DTLS_RETRANS_TIMEOUT, 60000);

	} else {

		(*session)->internals.transport = GNUTLS_STREAM;

	}

	/* Enable useful extensions */

	if ((flags & GNUTLS_CLIENT) && !(flags & GNUTLS_NO_EXTENSIONS)) {

#ifdef ENABLE_OCSP

		gnutls_ocsp_status_request_enable_client(*session, NULL, 0,

							 NULL);

#endif

	}

	/* session tickets in server side are enabled by setting a key */

	if (flags & GNUTLS_SERVER)

		flags |= GNUTLS_NO_TICKETS;

	(*session)->internals.flags = flags;

	if (_gnutls_disable_tls13 != 0)

		(*session)->internals.flags |= INT_FLAG_NO_TLS13;

	/* Install the default keylog function */

	gnutls_session_set_keylog_function(*session, _gnutls_nss_keylog_func);

	return 0;

}

/* returns RESUME_FALSE or RESUME_TRUE.

 */

int _gnutls_session_is_resumable(gnutls_session_t session)

{

	return session->internals.resumable;

}

/**

 * gnutls_deinit:

 * @session: is a #gnutls_session_t type.

 *

 * This function clears all buffers associated with the @session.

 * This function will also remove session data from the session

 * database if the session was terminated abnormally.

 **/

void gnutls_deinit(gnutls_session_t session)

{

	unsigned int i;

	if (session == NULL)

		return;

	/* remove auth info firstly */

	_gnutls_free_auth_info(session);

	_gnutls_handshake_internal_state_clear(session);

	_gnutls_handshake_io_buffer_clear(session);

	_gnutls_hello_ext_priv_deinit(session);

	for (i = 0; i < MAX_EPOCH_INDEX; i++)

		if (session->record_parameters[i] != NULL) {

			_gnutls_epoch_free(session,

					   session->record_parameters[i]);

			session->record_parameters[i] = NULL;

		}

	_gnutls_buffer_clear(&session->internals.handshake_hash_buffer);

	_gnutls_buffer_clear(&session->internals.post_handshake_hash_buffer);

	_gnutls_buffer_clear(&session->internals.hb_remote_data);

	_gnutls_buffer_clear(&session->internals.hb_local_data);

	_gnutls_buffer_clear(&session->internals.record_presend_buffer);

	_gnutls_buffer_clear(&session->internals.record_key_update_buffer);

	_gnutls_buffer_clear(&session->internals.reauth_buffer);

	_mbuffer_head_clear(&session->internals.record_buffer);

	_mbuffer_head_clear(&session->internals.record_recv_buffer);

	_mbuffer_head_clear(&session->internals.record_send_buffer);

	_mbuffer_head_clear(&session->internals.early_data_recv_buffer);

	_gnutls_buffer_clear(&session->internals.early_data_presend_buffer);

	_gnutls_free_datum(&session->internals.resumption_data);

	_gnutls_free_datum(&session->internals.dtls.dcookie);

	for (i = 0; i < session->internals.rexts_size; i++)

		gnutls_free(session->internals.rexts[i].name);

	gnutls_free(session->internals.rexts);

	gnutls_free(session->internals.post_handshake_cr_context.data);

	gnutls_free(session->internals.rsup);

	gnutls_credentials_clear(session);

	_gnutls_selected_certs_deinit(session);

	/* destroy any session ticket we may have received */

	_gnutls13_session_ticket_unset(session);

	/* we rely on priorities' internal reference counting */

	gnutls_priority_deinit(session->internals.priorities);

	/* overwrite any temp TLS1.3 keys */

	gnutls_memset(&session->key.proto, 0, sizeof(session->key.proto));

	gnutls_mutex_deinit(&session->internals.post_negotiation_lock);

	gnutls_mutex_deinit(&session->internals.epoch_lock);

	gnutls_free(session);

}

int _gnutls_dh_set_peer_public(gnutls_session_t session, bigint_t public)

{

	dh_info_st *dh;

	int ret;

	switch (gnutls_auth_get_type(session)) {

	case GNUTLS_CRD_ANON:

		{

			anon_auth_info_t info;

			info = _gnutls_get_auth_info(session, GNUTLS_CRD_ANON);

			if (info == NULL)

				return gnutls_assert_val(GNUTLS_E_INTERNAL_ERROR);

			dh = &info->dh;

			break;

		}

	case GNUTLS_CRD_PSK:

		{

			psk_auth_info_t info;

			info = _gnutls_get_auth_info(session, GNUTLS_CRD_PSK);

			if (info == NULL)

				return gnutls_assert_val(GNUTLS_E_INTERNAL_ERROR);

			dh = &info->dh;

			break;

		}

	case GNUTLS_CRD_CERTIFICATE:

		{

			cert_auth_info_t info;

			info = _gnutls_get_auth_info(session, GNUTLS_CRD_CERTIFICATE);

			if (info == NULL)

				return gnutls_assert_val(GNUTLS_E_INTERNAL_ERROR);

			dh = &info->dh;

			break;

		}

	default:

		return gnutls_assert_val(GNUTLS_E_INTERNAL_ERROR);

	}

	if (dh->public_key.data)

		_gnutls_free_datum(&dh->public_key);

	ret = _gnutls_mpi_dprint_lz(public, &dh->public_key);

	if (ret < 0) {

		gnutls_assert();

		return ret;

	}

	return 0;

}

int _gnutls_dh_set_secret_bits(gnutls_session_t session, unsigned bits)

{

	switch (gnutls_auth_get_type(session)) {

	case GNUTLS_CRD_ANON:

		{

			anon_auth_info_t info;

			info = _gnutls_get_auth_info(session, GNUTLS_CRD_ANON);

			if (info == NULL)

				return gnutls_assert_val(GNUTLS_E_INTERNAL_ERROR);

			info->dh.secret_bits = bits;

			break;

		}

	case GNUTLS_CRD_PSK:

		{

			psk_auth_info_t info;

			info = _gnutls_get_auth_info(session, GNUTLS_CRD_PSK);

			if (info == NULL)

				return gnutls_assert_val(GNUTLS_E_INTERNAL_ERROR);

			info->dh.secret_bits = bits;

			break;

		}

	case GNUTLS_CRD_CERTIFICATE:

		{

			cert_auth_info_t info;

			info = _gnutls_get_auth_info(session, GNUTLS_CRD_CERTIFICATE);

			if (info == NULL)

				return gnutls_assert_val(GNUTLS_E_INTERNAL_ERROR);

			info->dh.secret_bits = bits;

			break;

	default:

			return gnutls_assert_val(GNUTLS_E_INTERNAL_ERROR);

		}

	}

	return 0;

}

/* Sets the prime and the generator in the auth info structure.

 */

int

_gnutls_dh_save_group(gnutls_session_t session, bigint_t gen,

		     bigint_t prime)

{

	dh_info_st *dh;

	int ret;

	switch (gnutls_auth_get_type(session)) {

	case GNUTLS_CRD_ANON:

		{

			anon_auth_info_t info;

			info = _gnutls_get_auth_info(session, GNUTLS_CRD_ANON);

			if (info == NULL)

				return gnutls_assert_val(GNUTLS_E_INTERNAL_ERROR);

			dh = &info->dh;

			break;

		}

	case GNUTLS_CRD_PSK:

		{

			psk_auth_info_t info;

			info = _gnutls_get_auth_info(session, GNUTLS_CRD_PSK);

			if (info == NULL)

				return gnutls_assert_val(GNUTLS_E_INTERNAL_ERROR);

			dh = &info->dh;

			break;

		}

	case GNUTLS_CRD_CERTIFICATE:

		{

			cert_auth_info_t info;

			info = _gnutls_get_auth_info(session, GNUTLS_CRD_CERTIFICATE);

			if (info == NULL)

				return gnutls_assert_val(GNUTLS_E_INTERNAL_ERROR);

			dh = &info->dh;

			break;

		}

	default:

		return gnutls_assert_val(GNUTLS_E_INTERNAL_ERROR);

	}

	if (dh->prime.data)

		_gnutls_free_datum(&dh->prime);

	if (dh->generator.data)

		_gnutls_free_datum(&dh->generator);

	/* prime

	 */

	ret = _gnutls_mpi_dprint_lz(prime, &dh->prime);

	if (ret < 0) {

		gnutls_assert();

		return ret;

	}

	/* generator

	 */

	ret = _gnutls_mpi_dprint_lz(gen, &dh->generator);

	if (ret < 0) {

		gnutls_assert();

		_gnutls_free_datum(&dh->prime);

		return ret;