/*

 * Copyright 2016-2019 The OpenSSL Project Authors. All Rights Reserved.

 *

 * Licensed under the OpenSSL license (the "License").  You may not use

 * this file except in compliance with the License.  You can obtain a copy

 * in the file LICENSE in the source distribution or at

 * https://www.openssl.org/source/license.html

 */

#include <openssl/ocsp.h>

#include "../ssl_local.h"

#include "internal/cryptlib.h"

#include "statem_local.h"

EXT_RETURN tls_construct_ctos_renegotiate(SSL *s, WPACKET *pkt,

                                          unsigned int context, X509 *x,

                                          size_t chainidx)

{

    /* Add RI if renegotiating */

    if (!s->renegotiate)

        return EXT_RETURN_NOT_SENT;

    if (!WPACKET_put_bytes_u16(pkt, TLSEXT_TYPE_renegotiate)

            || !WPACKET_start_sub_packet_u16(pkt)

            || !WPACKET_sub_memcpy_u8(pkt, s->s3->previous_client_finished,

                               s->s3->previous_client_finished_len)

            || !WPACKET_close(pkt)) {

        SSLfatal(s, SSL_AD_INTERNAL_ERROR, SSL_F_TLS_CONSTRUCT_CTOS_RENEGOTIATE,

                 ERR_R_INTERNAL_ERROR);

        return EXT_RETURN_FAIL;

    }

    return EXT_RETURN_SENT;

}

EXT_RETURN tls_construct_ctos_server_name(SSL *s, WPACKET *pkt,

                                          unsigned int context, X509 *x,

                                          size_t chainidx)

{

    if (s->ext.hostname == NULL)

        return EXT_RETURN_NOT_SENT;

    /* Add TLS extension servername to the Client Hello message */

    if (!WPACKET_put_bytes_u16(pkt, TLSEXT_TYPE_server_name)

               /* Sub-packet for server_name extension */

            || !WPACKET_start_sub_packet_u16(pkt)

               /* Sub-packet for servername list (always 1 hostname)*/

            || !WPACKET_start_sub_packet_u16(pkt)

            || !WPACKET_put_bytes_u8(pkt, TLSEXT_NAMETYPE_host_name)

            || !WPACKET_sub_memcpy_u16(pkt, s->ext.hostname,

                                       strlen(s->ext.hostname))

            || !WPACKET_close(pkt)

            || !WPACKET_close(pkt)) {

        SSLfatal(s, SSL_AD_INTERNAL_ERROR, SSL_F_TLS_CONSTRUCT_CTOS_SERVER_NAME,

                 ERR_R_INTERNAL_ERROR);

        return EXT_RETURN_FAIL;

    }

    return EXT_RETURN_SENT;

}

/* Push a Max Fragment Len extension into ClientHello */

EXT_RETURN tls_construct_ctos_maxfragmentlen(SSL *s, WPACKET *pkt,

                                             unsigned int context, X509 *x,

                                             size_t chainidx)

{

    if (s->ext.max_fragment_len_mode == TLSEXT_max_fragment_length_DISABLED)

        return EXT_RETURN_NOT_SENT;

    /* Add Max Fragment Length extension if client enabled it. */

    /*-

     * 4 bytes for this extension type and extension length

     * 1 byte for the Max Fragment Length code value.

     */

    if (!WPACKET_put_bytes_u16(pkt, TLSEXT_TYPE_max_fragment_length)

            /* Sub-packet for Max Fragment Length extension (1 byte) */

            || !WPACKET_start_sub_packet_u16(pkt)

            || !WPACKET_put_bytes_u8(pkt, s->ext.max_fragment_len_mode)

            || !WPACKET_close(pkt)) {

        SSLfatal(s, SSL_AD_INTERNAL_ERROR,

                 SSL_F_TLS_CONSTRUCT_CTOS_MAXFRAGMENTLEN, ERR_R_INTERNAL_ERROR);

        return EXT_RETURN_FAIL;

    }

    return EXT_RETURN_SENT;

}

#ifndef OPENSSL_NO_SRP

EXT_RETURN tls_construct_ctos_srp(SSL *s, WPACKET *pkt, unsigned int context,

                                  X509 *x, size_t chainidx)

{

    /* Add SRP username if there is one */

    if (s->srp_ctx.login == NULL)

        return EXT_RETURN_NOT_SENT;

    if (!WPACKET_put_bytes_u16(pkt, TLSEXT_TYPE_srp)

               /* Sub-packet for SRP extension */

            || !WPACKET_start_sub_packet_u16(pkt)

            || !WPACKET_start_sub_packet_u8(pkt)

               /* login must not be zero...internal error if so */

            || !WPACKET_set_flags(pkt, WPACKET_FLAGS_NON_ZERO_LENGTH)

            || !WPACKET_memcpy(pkt, s->srp_ctx.login,

                               strlen(s->srp_ctx.login))

            || !WPACKET_close(pkt)

            || !WPACKET_close(pkt)) {

        SSLfatal(s, SSL_AD_INTERNAL_ERROR, SSL_F_TLS_CONSTRUCT_CTOS_SRP,

                 ERR_R_INTERNAL_ERROR);

        return EXT_RETURN_FAIL;

    }

    return EXT_RETURN_SENT;

}

#endif

#ifndef OPENSSL_NO_EC

static int use_ecc(SSL *s)

{

    int i, end, ret = 0;

    unsigned long alg_k, alg_a;

    STACK_OF(SSL_CIPHER) *cipher_stack = NULL;

    /* See if we support any ECC ciphersuites */

    if (s->version == SSL3_VERSION)

        return 0;

    cipher_stack = SSL_get1_supported_ciphers(s);

    end = sk_SSL_CIPHER_num(cipher_stack);

    for (i = 0; i < end; i++) {

        const SSL_CIPHER *c = sk_SSL_CIPHER_value(cipher_stack, i);

        alg_k = c->algorithm_mkey;

        alg_a = c->algorithm_auth;

        if ((alg_k & (SSL_kECDHE | SSL_kECDHEPSK))

                || (alg_a & SSL_aECDSA)

                || c->min_tls >= TLS1_3_VERSION) {

            ret = 1;

            break;

        }

    }

    sk_SSL_CIPHER_free(cipher_stack);

    return ret;

}

EXT_RETURN tls_construct_ctos_ec_pt_formats(SSL *s, WPACKET *pkt,

                                            unsigned int context, X509 *x,

                                            size_t chainidx)

{

    const unsigned char *pformats;

    size_t num_formats;

    if (!use_ecc(s))

        return EXT_RETURN_NOT_SENT;

    /* Add TLS extension ECPointFormats to the ClientHello message */

    tls1_get_formatlist(s, &pformats, &num_formats);

    if (!WPACKET_put_bytes_u16(pkt, TLSEXT_TYPE_ec_point_formats)

               /* Sub-packet for formats extension */

            || !WPACKET_start_sub_packet_u16(pkt)

            || !WPACKET_sub_memcpy_u8(pkt, pformats, num_formats)

            || !WPACKET_close(pkt)) {

        SSLfatal(s, SSL_AD_INTERNAL_ERROR,

                 SSL_F_TLS_CONSTRUCT_CTOS_EC_PT_FORMATS, ERR_R_INTERNAL_ERROR);

        return EXT_RETURN_FAIL;

    }

    return EXT_RETURN_SENT;

}

EXT_RETURN tls_construct_ctos_supported_groups(SSL *s, WPACKET *pkt,

                                               unsigned int context, X509 *x,

                                               size_t chainidx)

{

    const uint16_t *pgroups = NULL;

    size_t num_groups = 0, i;

    if (!use_ecc(s))

        return EXT_RETURN_NOT_SENT;

    /*

     * Add TLS extension supported_groups to the ClientHello message

     */

    /* TODO(TLS1.3): Add support for DHE groups */

    tls1_get_supported_groups(s, &pgroups, &num_groups);

    if (!WPACKET_put_bytes_u16(pkt, TLSEXT_TYPE_supported_groups)

               /* Sub-packet for supported_groups extension */

            || !WPACKET_start_sub_packet_u16(pkt)

            || !WPACKET_start_sub_packet_u16(pkt)) {

        SSLfatal(s, SSL_AD_INTERNAL_ERROR,

                 SSL_F_TLS_CONSTRUCT_CTOS_SUPPORTED_GROUPS,

                 ERR_R_INTERNAL_ERROR);

        return EXT_RETURN_FAIL;

    }

    /* Copy curve ID if supported */

    for (i = 0; i < num_groups; i++) {

        uint16_t ctmp = pgroups[i];

        if (tls_curve_allowed(s, ctmp, SSL_SECOP_CURVE_SUPPORTED)) {

            if (!WPACKET_put_bytes_u16(pkt, ctmp)) {

                    SSLfatal(s, SSL_AD_INTERNAL_ERROR,

                             SSL_F_TLS_CONSTRUCT_CTOS_SUPPORTED_GROUPS,

                             ERR_R_INTERNAL_ERROR);

                    return EXT_RETURN_FAIL;

                }

        }

    }

    if (!WPACKET_close(pkt) || !WPACKET_close(pkt)) {

        SSLfatal(s, SSL_AD_INTERNAL_ERROR,

                 SSL_F_TLS_CONSTRUCT_CTOS_SUPPORTED_GROUPS,

                 ERR_R_INTERNAL_ERROR);

        return EXT_RETURN_FAIL;

    }

    return EXT_RETURN_SENT;

}

#endif

EXT_RETURN tls_construct_ctos_session_ticket(SSL *s, WPACKET *pkt,

                                             unsigned int context, X509 *x,

                                             size_t chainidx)

{

    size_t ticklen;

    if (!tls_use_ticket(s))

        return EXT_RETURN_NOT_SENT;

    if (!s->new_session && s->session != NULL

            && s->session->ext.tick != NULL

            && s->session->ssl_version != TLS1_3_VERSION) {

        ticklen = s->session->ext.ticklen;

    } else if (s->session && s->ext.session_ticket != NULL

               && s->ext.session_ticket->data != NULL) {

        ticklen = s->ext.session_ticket->length;

        s->session->ext.tick = OPENSSL_malloc(ticklen);

        if (s->session->ext.tick == NULL) {

            SSLfatal(s, SSL_AD_INTERNAL_ERROR,

                     SSL_F_TLS_CONSTRUCT_CTOS_SESSION_TICKET,

                     ERR_R_INTERNAL_ERROR);

            return EXT_RETURN_FAIL;

        }

        memcpy(s->session->ext.tick,

               s->ext.session_ticket->data, ticklen);

        s->session->ext.ticklen = ticklen;

    } else {

        ticklen = 0;

    }

    if (ticklen == 0 && s->ext.session_ticket != NULL &&

            s->ext.session_ticket->data == NULL)

        return EXT_RETURN_NOT_SENT;

    if (!WPACKET_put_bytes_u16(pkt, TLSEXT_TYPE_session_ticket)

            || !WPACKET_sub_memcpy_u16(pkt, s->session->ext.tick, ticklen)) {

        SSLfatal(s, SSL_AD_INTERNAL_ERROR,

                 SSL_F_TLS_CONSTRUCT_CTOS_SESSION_TICKET, ERR_R_INTERNAL_ERROR);

        return EXT_RETURN_FAIL;

    }

    return EXT_RETURN_SENT;

}

EXT_RETURN tls_construct_ctos_sig_algs(SSL *s, WPACKET *pkt,

                                       unsigned int context, X509 *x,

                                       size_t chainidx)

{

    size_t salglen;

    const uint16_t *salg;

    if (!SSL_CLIENT_USE_SIGALGS(s))

        return EXT_RETURN_NOT_SENT;

    salglen = tls12_get_psigalgs(s, 1, &salg);

    if (!WPACKET_put_bytes_u16(pkt, TLSEXT_TYPE_signature_algorithms)

               /* Sub-packet for sig-algs extension */

            || !WPACKET_start_sub_packet_u16(pkt)

               /* Sub-packet for the actual list */

            || !WPACKET_start_sub_packet_u16(pkt)

            || !tls12_copy_sigalgs(s, pkt, salg, salglen)

            || !WPACKET_close(pkt)

            || !WPACKET_close(pkt)) {

        SSLfatal(s, SSL_AD_INTERNAL_ERROR, SSL_F_TLS_CONSTRUCT_CTOS_SIG_ALGS,

                 ERR_R_INTERNAL_ERROR);

        return EXT_RETURN_FAIL;

    }

    return EXT_RETURN_SENT;

}

#ifndef OPENSSL_NO_OCSP

EXT_RETURN tls_construct_ctos_status_request(SSL *s, WPACKET *pkt,

                                             unsigned int context, X509 *x,

                                             size_t chainidx)

{

    int i;

    /* This extension isn't defined for client Certificates */

    if (x != NULL)

        return EXT_RETURN_NOT_SENT;

    if (s->ext.status_type != TLSEXT_STATUSTYPE_ocsp)

        return EXT_RETURN_NOT_SENT;

    if (!WPACKET_put_bytes_u16(pkt, TLSEXT_TYPE_status_request)

               /* Sub-packet for status request extension */

            || !WPACKET_start_sub_packet_u16(pkt)

            || !WPACKET_put_bytes_u8(pkt, TLSEXT_STATUSTYPE_ocsp)

               /* Sub-packet for the ids */

            || !WPACKET_start_sub_packet_u16(pkt)) {

        SSLfatal(s, SSL_AD_INTERNAL_ERROR,

                 SSL_F_TLS_CONSTRUCT_CTOS_STATUS_REQUEST, ERR_R_INTERNAL_ERROR);

        return EXT_RETURN_FAIL;

    }

    for (i = 0; i < sk_OCSP_RESPID_num(s->ext.ocsp.ids); i++) {

        unsigned char *idbytes;

        OCSP_RESPID *id = sk_OCSP_RESPID_value(s->ext.ocsp.ids, i);

        int idlen = i2d_OCSP_RESPID(id, NULL);

        if (idlen <= 0

                   /* Sub-packet for an individual id */

                || !WPACKET_sub_allocate_bytes_u16(pkt, idlen, &idbytes)

                || i2d_OCSP_RESPID(id, &idbytes) != idlen) {

            SSLfatal(s, SSL_AD_INTERNAL_ERROR,

                     SSL_F_TLS_CONSTRUCT_CTOS_STATUS_REQUEST,

                     ERR_R_INTERNAL_ERROR);

            return EXT_RETURN_FAIL;

        }

    }

    if (!WPACKET_close(pkt)

            || !WPACKET_start_sub_packet_u16(pkt)) {

        SSLfatal(s, SSL_AD_INTERNAL_ERROR,

                 SSL_F_TLS_CONSTRUCT_CTOS_STATUS_REQUEST, ERR_R_INTERNAL_ERROR);

        return EXT_RETURN_FAIL;

    }

    if (s->ext.ocsp.exts) {

        unsigned char *extbytes;

        int extlen = i2d_X509_EXTENSIONS(s->ext.ocsp.exts, NULL);

        if (extlen < 0) {

            SSLfatal(s, SSL_AD_INTERNAL_ERROR,

                     SSL_F_TLS_CONSTRUCT_CTOS_STATUS_REQUEST,

                     ERR_R_INTERNAL_ERROR);

            return EXT_RETURN_FAIL;

        }

        if (!WPACKET_allocate_bytes(pkt, extlen, &extbytes)

                || i2d_X509_EXTENSIONS(s->ext.ocsp.exts, &extbytes)

                   != extlen) {

            SSLfatal(s, SSL_AD_INTERNAL_ERROR,

                     SSL_F_TLS_CONSTRUCT_CTOS_STATUS_REQUEST,

                     ERR_R_INTERNAL_ERROR);

            return EXT_RETURN_FAIL;

       }

    }

    if (!WPACKET_close(pkt) || !WPACKET_close(pkt)) {

        SSLfatal(s, SSL_AD_INTERNAL_ERROR,

                 SSL_F_TLS_CONSTRUCT_CTOS_STATUS_REQUEST, ERR_R_INTERNAL_ERROR);

        return EXT_RETURN_FAIL;

    }

    return EXT_RETURN_SENT;

}

#endif

#ifndef OPENSSL_NO_NEXTPROTONEG

EXT_RETURN tls_construct_ctos_npn(SSL *s, WPACKET *pkt, unsigned int context,

                                  X509 *x, size_t chainidx)

{

    if (s->ctx->ext.npn_select_cb == NULL || !SSL_IS_FIRST_HANDSHAKE(s))

        return EXT_RETURN_NOT_SENT;

    /*

     * The client advertises an empty extension to indicate its support

     * for Next Protocol Negotiation

     */

    if (!WPACKET_put_bytes_u16(pkt, TLSEXT_TYPE_next_proto_neg)

            || !WPACKET_put_bytes_u16(pkt, 0)) {

        SSLfatal(s, SSL_AD_INTERNAL_ERROR, SSL_F_TLS_CONSTRUCT_CTOS_NPN,

                 ERR_R_INTERNAL_ERROR);

        return EXT_RETURN_FAIL;

    }

    return EXT_RETURN_SENT;

}

#endif

EXT_RETURN tls_construct_ctos_alpn(SSL *s, WPACKET *pkt, unsigned int context,

                                   X509 *x, size_t chainidx)

{

    s->s3->alpn_sent = 0;

    if (s->ext.alpn == NULL || !SSL_IS_FIRST_HANDSHAKE(s))

        return EXT_RETURN_NOT_SENT;

    if (!WPACKET_put_bytes_u16(pkt,

                TLSEXT_TYPE_application_layer_protocol_negotiation)

               /* Sub-packet ALPN extension */

            || !WPACKET_start_sub_packet_u16(pkt)

            || !WPACKET_sub_memcpy_u16(pkt, s->ext.alpn, s->ext.alpn_len)

            || !WPACKET_close(pkt)) {

        SSLfatal(s, SSL_AD_INTERNAL_ERROR, SSL_F_TLS_CONSTRUCT_CTOS_ALPN,

                 ERR_R_INTERNAL_ERROR);

        return EXT_RETURN_FAIL;

    }

    s->s3->alpn_sent = 1;

    return EXT_RETURN_SENT;

}

#ifndef OPENSSL_NO_SRTP

EXT_RETURN tls_construct_ctos_use_srtp(SSL *s, WPACKET *pkt,

                                       unsigned int context, X509 *x,

                                       size_t chainidx)

{

    STACK_OF(SRTP_PROTECTION_PROFILE) *clnt = SSL_get_srtp_profiles(s);

    int i, end;

    if (clnt == NULL)

        return EXT_RETURN_NOT_SENT;

    if (!WPACKET_put_bytes_u16(pkt, TLSEXT_TYPE_use_srtp)

               /* Sub-packet for SRTP extension */

            || !WPACKET_start_sub_packet_u16(pkt)

               /* Sub-packet for the protection profile list */

            || !WPACKET_start_sub_packet_u16(pkt)) {

        SSLfatal(s, SSL_AD_INTERNAL_ERROR, SSL_F_TLS_CONSTRUCT_CTOS_USE_SRTP,

                 ERR_R_INTERNAL_ERROR);

        return EXT_RETURN_FAIL;

    }

    end = sk_SRTP_PROTECTION_PROFILE_num(clnt);

    for (i = 0; i < end; i++) {

        const SRTP_PROTECTION_PROFILE *prof =

            sk_SRTP_PROTECTION_PROFILE_value(clnt, i);

        if (prof == NULL || !WPACKET_put_bytes_u16(pkt, prof->id)) {

            SSLfatal(s, SSL_AD_INTERNAL_ERROR,

                     SSL_F_TLS_CONSTRUCT_CTOS_USE_SRTP, ERR_R_INTERNAL_ERROR);

            return EXT_RETURN_FAIL;

        }

    }

    if (!WPACKET_close(pkt)

               /* Add an empty use_mki value */

            || !WPACKET_put_bytes_u8(pkt, 0)

            || !WPACKET_close(pkt)) {

        SSLfatal(s, SSL_AD_INTERNAL_ERROR, SSL_F_TLS_CONSTRUCT_CTOS_USE_SRTP,

                 ERR_R_INTERNAL_ERROR);

        return EXT_RETURN_FAIL;

    }

    return EXT_RETURN_SENT;

}

#endif

EXT_RETURN tls_construct_ctos_etm(SSL *s, WPACKET *pkt, unsigned int context,

                                  X509 *x, size_t chainidx)

{

    if (s->options & SSL_OP_NO_ENCRYPT_THEN_MAC)

        return EXT_RETURN_NOT_SENT;

    if (!WPACKET_put_bytes_u16(pkt, TLSEXT_TYPE_encrypt_then_mac)

            || !WPACKET_put_bytes_u16(pkt, 0)) {

        SSLfatal(s, SSL_AD_INTERNAL_ERROR, SSL_F_TLS_CONSTRUCT_CTOS_ETM,

                 ERR_R_INTERNAL_ERROR);

        return EXT_RETURN_FAIL;

    }

    return EXT_RETURN_SENT;

}

#ifndef OPENSSL_NO_CT

EXT_RETURN tls_construct_ctos_sct(SSL *s, WPACKET *pkt, unsigned int context,

                                  X509 *x, size_t chainidx)

{

    if (s->ct_validation_callback == NULL)

        return EXT_RETURN_NOT_SENT;

    /* Not defined for client Certificates */

    if (x != NULL)

        return EXT_RETURN_NOT_SENT;

    if (!WPACKET_put_bytes_u16(pkt, TLSEXT_TYPE_signed_certificate_timestamp)

            || !WPACKET_put_bytes_u16(pkt, 0)) {

        SSLfatal(s, SSL_AD_INTERNAL_ERROR, SSL_F_TLS_CONSTRUCT_CTOS_SCT,

                 ERR_R_INTERNAL_ERROR);

        return EXT_RETURN_FAIL;

    }

    return EXT_RETURN_SENT;

}

#endif

EXT_RETURN tls_construct_ctos_ems(SSL *s, WPACKET *pkt, unsigned int context,

                                  X509 *x, size_t chainidx)

{

    if (!WPACKET_put_bytes_u16(pkt, TLSEXT_TYPE_extended_master_secret)

            || !WPACKET_put_bytes_u16(pkt, 0)) {

        SSLfatal(s, SSL_AD_INTERNAL_ERROR, SSL_F_TLS_CONSTRUCT_CTOS_EMS,

                 ERR_R_INTERNAL_ERROR);

        return EXT_RETURN_FAIL;

    }

    return EXT_RETURN_SENT;

}

EXT_RETURN tls_construct_ctos_supported_versions(SSL *s, WPACKET *pkt,

                                                 unsigned int context, X509 *x,

                                                 size_t chainidx)

{

    int currv, min_version, max_version, reason;

    reason = ssl_get_min_max_version(s, &min_version, &max_version, NULL);

    if (reason != 0) {

        SSLfatal(s, SSL_AD_INTERNAL_ERROR,

                 SSL_F_TLS_CONSTRUCT_CTOS_SUPPORTED_VERSIONS, reason);

        return EXT_RETURN_FAIL;

    }

    /*

     * Don't include this if we can't negotiate TLSv1.3. We can do a straight

     * comparison here because we will never be called in DTLS.

     */

    if (max_version < TLS1_3_VERSION)

        return EXT_RETURN_NOT_SENT;

    if (!WPACKET_put_bytes_u16(pkt, TLSEXT_TYPE_supported_versions)

            || !WPACKET_start_sub_packet_u16(pkt)

            || !WPACKET_start_sub_packet_u8(pkt)) {

        SSLfatal(s, SSL_AD_INTERNAL_ERROR,

                 SSL_F_TLS_CONSTRUCT_CTOS_SUPPORTED_VERSIONS,

                 ERR_R_INTERNAL_ERROR);

        return EXT_RETURN_FAIL;

    }

    for (currv = max_version; currv >= min_version; currv--) {

        if (!WPACKET_put_bytes_u16(pkt, currv)) {

            SSLfatal(s, SSL_AD_INTERNAL_ERROR,

                     SSL_F_TLS_CONSTRUCT_CTOS_SUPPORTED_VERSIONS,

                     ERR_R_INTERNAL_ERROR);

            return EXT_RETURN_FAIL;

        }

    }

    if (!WPACKET_close(pkt) || !WPACKET_close(pkt)) {

        SSLfatal(s, SSL_AD_INTERNAL_ERROR,

                 SSL_F_TLS_CONSTRUCT_CTOS_SUPPORTED_VERSIONS,

                 ERR_R_INTERNAL_ERROR);

        return EXT_RETURN_FAIL;

    }

    return EXT_RETURN_SENT;

}

/*

 * Construct a psk_kex_modes extension.

 */

EXT_RETURN tls_construct_ctos_psk_kex_modes(SSL *s, WPACKET *pkt,

                                            unsigned int context, X509 *x,

                                            size_t chainidx)

{

#ifndef OPENSSL_NO_TLS1_3

    int nodhe = s->options & SSL_OP_ALLOW_NO_DHE_KEX;

    if (!WPACKET_put_bytes_u16(pkt, TLSEXT_TYPE_psk_kex_modes)

            || !WPACKET_start_sub_packet_u16(pkt)

            || !WPACKET_start_sub_packet_u8(pkt)

            || !WPACKET_put_bytes_u8(pkt, TLSEXT_KEX_MODE_KE_DHE)

            || (nodhe && !WPACKET_put_bytes_u8(pkt, TLSEXT_KEX_MODE_KE))

            || !WPACKET_close(pkt)

            || !WPACKET_close(pkt)) {

        SSLfatal(s, SSL_AD_INTERNAL_ERROR,

                 SSL_F_TLS_CONSTRUCT_CTOS_PSK_KEX_MODES, ERR_R_INTERNAL_ERROR);

        return EXT_RETURN_FAIL;

    }

    s->ext.psk_kex_mode = TLSEXT_KEX_MODE_FLAG_KE_DHE;

    if (nodhe)

        s->ext.psk_kex_mode |= TLSEXT_KEX_MODE_FLAG_KE;

#endif

    return EXT_RETURN_SENT;

}

#ifndef OPENSSL_NO_TLS1_3

static int add_key_share(SSL *s, WPACKET *pkt, unsigned int curve_id)

{

    unsigned char *encoded_point = NULL;

    EVP_PKEY *key_share_key = NULL;

    size_t encodedlen;

    if (s->s3->tmp.pkey != NULL) {

        if (!ossl_assert(s->hello_retry_request == SSL_HRR_PENDING)) {

            SSLfatal(s, SSL_AD_INTERNAL_ERROR, SSL_F_ADD_KEY_SHARE,

                     ERR_R_INTERNAL_ERROR);

            return 0;

        }

        /*

         * Could happen if we got an HRR that wasn't requesting a new key_share

         */

        key_share_key = s->s3->tmp.pkey;

    } else {

        key_share_key = ssl_generate_pkey_group(s, curve_id);

        if (key_share_key == NULL) {

            /* SSLfatal() already called */

            return 0;

        }

    }

    /* Encode the public key. */

    encodedlen = EVP_PKEY_get1_tls_encodedpoint(key_share_key,

                                                &encoded_point);

    if (encodedlen == 0) {

        SSLfatal(s, SSL_AD_INTERNAL_ERROR, SSL_F_ADD_KEY_SHARE, ERR_R_EC_LIB);

        goto err;

    }

    /* Create KeyShareEntry */

    if (!WPACKET_put_bytes_u16(pkt, curve_id)

            || !WPACKET_sub_memcpy_u16(pkt, encoded_point, encodedlen)) {

        SSLfatal(s, SSL_AD_INTERNAL_ERROR, SSL_F_ADD_KEY_SHARE,

                 ERR_R_INTERNAL_ERROR);

        goto err;

    }

    /*

     * TODO(TLS1.3): When changing to send more than one key_share we're

     * going to need to be able to save more than one EVP_PKEY. For now

     * we reuse the existing tmp.pkey

     */

    s->s3->tmp.pkey = key_share_key;

    s->s3->group_id = curve_id;

    OPENSSL_free(encoded_point);

    return 1;

 err:

    if (s->s3->tmp.pkey == NULL)

        EVP_PKEY_free(key_share_key);

    OPENSSL_free(encoded_point);

    return 0;

}

#endif

EXT_RETURN tls_construct_ctos_key_share(SSL *s, WPACKET *pkt,

                                        unsigned int context, X509 *x,

                                        size_t chainidx)

{

#ifndef OPENSSL_NO_TLS1_3

    size_t i, num_groups = 0;

    const uint16_t *pgroups = NULL;

    uint16_t curve_id = 0;

    /* key_share extension */

    if (!WPACKET_put_bytes_u16(pkt, TLSEXT_TYPE_key_share)

               /* Extension data sub-packet */

            || !WPACKET_start_sub_packet_u16(pkt)

               /* KeyShare list sub-packet */

            || !WPACKET_start_sub_packet_u16(pkt)) {

        SSLfatal(s, SSL_AD_INTERNAL_ERROR, SSL_F_TLS_CONSTRUCT_CTOS_KEY_SHARE,

                 ERR_R_INTERNAL_ERROR);

        return EXT_RETURN_FAIL;

    }

    tls1_get_supported_groups(s, &pgroups, &num_groups);

    /*

     * TODO(TLS1.3): Make the number of key_shares sent configurable. For

     * now, just send one

     */

    if (s->s3->group_id != 0) {

        curve_id = s->s3->group_id;

    } else {

        for (i = 0; i < num_groups; i++) {

            if (!tls_curve_allowed(s, pgroups[i], SSL_SECOP_CURVE_SUPPORTED))

                continue;

            curve_id = pgroups[i];

            break;

        }

    }

    if (curve_id == 0) {

        SSLfatal(s, SSL_AD_INTERNAL_ERROR, SSL_F_TLS_CONSTRUCT_CTOS_KEY_SHARE,

                 SSL_R_NO_SUITABLE_KEY_SHARE);

        return EXT_RETURN_FAIL;

    }

    if (!add_key_share(s, pkt, curve_id)) {

        /* SSLfatal() already called */

        return EXT_RETURN_FAIL;

    }

    if (!WPACKET_close(pkt) || !WPACKET_close(pkt)) {

        SSLfatal(s, SSL_AD_INTERNAL_ERROR, SSL_F_TLS_CONSTRUCT_CTOS_KEY_SHARE,

                 ERR_R_INTERNAL_ERROR);

        return EXT_RETURN_FAIL;

    }

    return EXT_RETURN_SENT;

#else

    return EXT_RETURN_NOT_SENT;

#endif

}

EXT_RETURN tls_construct_ctos_cookie(SSL *s, WPACKET *pkt, unsigned int context,

                                     X509 *x, size_t chainidx)

{

    EXT_RETURN ret = EXT_RETURN_FAIL;

    /* Should only be set if we've had an HRR */

    if (s->ext.tls13_cookie_len == 0)

        return EXT_RETURN_NOT_SENT;

    if (!WPACKET_put_bytes_u16(pkt, TLSEXT_TYPE_cookie)

               /* Extension data sub-packet */

            || !WPACKET_start_sub_packet_u16(pkt)

            || !WPACKET_sub_memcpy_u16(pkt, s->ext.tls13_cookie,

                                       s->ext.tls13_cookie_len)

            || !WPACKET_close(pkt)) {

        SSLfatal(s, SSL_AD_INTERNAL_ERROR, SSL_F_TLS_CONSTRUCT_CTOS_COOKIE,

                 ERR_R_INTERNAL_ERROR);

        goto end;

    }

    ret = EXT_RETURN_SENT;

 end:

    OPENSSL_free(s->ext.tls13_cookie);

    s->ext.tls13_cookie = NULL;

    s->ext.tls13_cookie_len = 0;

    return ret;

}

EXT_RETURN tls_construct_ctos_early_data(SSL *s, WPACKET *pkt,

                                         unsigned int context, X509 *x,

                                         size_t chainidx)

{

#ifndef OPENSSL_NO_PSK

    char identity[PSK_MAX_IDENTITY_LEN + 1];

#endif  /* OPENSSL_NO_PSK */

    const unsigned char *id = NULL;

    size_t idlen = 0;

    SSL_SESSION *psksess = NULL;

    SSL_SESSION *edsess = NULL;

    const EVP_MD *handmd = NULL;

    if (s->hello_retry_request == SSL_HRR_PENDING)

        handmd = ssl_handshake_md(s);

    if (s->psk_use_session_cb != NULL

            && (!s->psk_use_session_cb(s, handmd, &id, &idlen, &psksess)

                || (psksess != NULL

                    && psksess->ssl_version != TLS1_3_VERSION))) {

        SSL_SESSION_free(psksess);

        SSLfatal(s, SSL_AD_INTERNAL_ERROR, SSL_F_TLS_CONSTRUCT_CTOS_EARLY_DATA,

                 SSL_R_BAD_PSK);

        return EXT_RETURN_FAIL;

    }

#ifndef OPENSSL_NO_PSK

    if (psksess == NULL && s->psk_client_callback != NULL) {

        unsigned char psk[PSK_MAX_PSK_LEN];

        size_t psklen = 0;

        memset(identity, 0, sizeof(identity));

        psklen = s->psk_client_callback(s, NULL, identity, sizeof(identity) - 1,

                                        psk, sizeof(psk));

        if (psklen > PSK_MAX_PSK_LEN) {

            SSLfatal(s, SSL_AD_HANDSHAKE_FAILURE,

                     SSL_F_TLS_CONSTRUCT_CTOS_EARLY_DATA, ERR_R_INTERNAL_ERROR);

            return EXT_RETURN_FAIL;

        } else if (psklen > 0) {

            const unsigned char tls13_aes128gcmsha256_id[] = { 0x13, 0x01 };

            const SSL_CIPHER *cipher;

            idlen = strlen(identity);

            if (idlen > PSK_MAX_IDENTITY_LEN) {

                SSLfatal(s, SSL_AD_INTERNAL_ERROR,

                         SSL_F_TLS_CONSTRUCT_CTOS_EARLY_DATA,

                         ERR_R_INTERNAL_ERROR);

                return EXT_RETURN_FAIL;

            }

            id = (unsigned char *)identity;

            /*

             * We found a PSK using an old style callback. We don't know

             * the digest so we default to SHA256 as per the TLSv1.3 spec

             */

            cipher = SSL_CIPHER_find(s, tls13_aes128gcmsha256_id);

            if (cipher == NULL) {

                SSLfatal(s, SSL_AD_INTERNAL_ERROR,

                         SSL_F_TLS_CONSTRUCT_CTOS_EARLY_DATA,

                         ERR_R_INTERNAL_ERROR);

                return EXT_RETURN_FAIL;

            }

            psksess = SSL_SESSION_new();

            if (psksess == NULL

                    || !SSL_SESSION_set1_master_key(psksess, psk, psklen)

                    || !SSL_SESSION_set_cipher(psksess, cipher)

                    || !SSL_SESSION_set_protocol_version(psksess, TLS1_3_VERSION)) {

                SSLfatal(s, SSL_AD_INTERNAL_ERROR,

                         SSL_F_TLS_CONSTRUCT_CTOS_EARLY_DATA,

                         ERR_R_INTERNAL_ERROR);

                OPENSSL_cleanse(psk, psklen);

                return EXT_RETURN_FAIL;

            }

            OPENSSL_cleanse(psk, psklen);

        }

    }

#endif  /* OPENSSL_NO_PSK */

    SSL_SESSION_free(s->psksession);

    s->psksession = psksess;

    if (psksess != NULL) {

        OPENSSL_free(s->psksession_id);

        s->psksession_id = OPENSSL_memdup(id, idlen);

        if (s->psksession_id == NULL) {

            SSLfatal(s, SSL_AD_INTERNAL_ERROR,

                     SSL_F_TLS_CONSTRUCT_CTOS_EARLY_DATA, ERR_R_INTERNAL_ERROR);

            return EXT_RETURN_FAIL;

        }

        s->psksession_id_len = idlen;

    }

    if (s->early_data_state != SSL_EARLY_DATA_CONNECTING

            || (s->session->ext.max_early_data == 0

                && (psksess == NULL || psksess->ext.max_early_data == 0))) {

        s->max_early_data = 0;

        return EXT_RETURN_NOT_SENT;

    }

    edsess = s->session->ext.max_early_data != 0 ? s->session : psksess;

    s->max_early_data = edsess->ext.max_early_data;

    if (edsess->ext.hostname != NULL) {

        if (s->ext.hostname == NULL

                || (s->ext.hostname != NULL

                    && strcmp(s->ext.hostname, edsess->ext.hostname) != 0)) {

            SSLfatal(s, SSL_AD_INTERNAL_ERROR,

                     SSL_F_TLS_CONSTRUCT_CTOS_EARLY_DATA,

                     SSL_R_INCONSISTENT_EARLY_DATA_SNI);

            return EXT_RETURN_FAIL;

        }

    }

    if ((s->ext.alpn == NULL && edsess->ext.alpn_selected != NULL)) {

        SSLfatal(s, SSL_AD_INTERNAL_ERROR, SSL_F_TLS_CONSTRUCT_CTOS_EARLY_DATA,

                 SSL_R_INCONSISTENT_EARLY_DATA_ALPN);

        return EXT_RETURN_FAIL;

    }

    /*

     * Verify that we are offering an ALPN protocol consistent with the early

     * data.

     */

    if (edsess->ext.alpn_selected != NULL) {

        PACKET prots, alpnpkt;

        int found = 0;

        if (!PACKET_buf_init(&prots, s->ext.alpn, s->ext.alpn_len)) {

            SSLfatal(s, SSL_AD_INTERNAL_ERROR,

                     SSL_F_TLS_CONSTRUCT_CTOS_EARLY_DATA, ERR_R_INTERNAL_ERROR);

            return EXT_RETURN_FAIL;

        }

        while (PACKET_get_length_prefixed_1(&prots, &alpnpkt)) {

            if (PACKET_equal(&alpnpkt, edsess->ext.alpn_selected,

                             edsess->ext.alpn_selected_len)) {

                found = 1;

                break;

            }

        }

        if (!found) {

            SSLfatal(s, SSL_AD_INTERNAL_ERROR,

                     SSL_F_TLS_CONSTRUCT_CTOS_EARLY_DATA,

                     SSL_R_INCONSISTENT_EARLY_DATA_ALPN);

            return EXT_RETURN_FAIL;

        }

    }

    if (!WPACKET_put_bytes_u16(pkt, TLSEXT_TYPE_early_data)