diff options
| author | Dr. Stephen Henson <steve@openssl.org> | 2014-08-12 14:25:49 +0100 |
|---|---|---|
| committer | Dr. Stephen Henson <steve@openssl.org> | 2014-08-28 18:09:39 +0100 |
| commit | 9346c75cb8bea75d3410be65f5b625289f375b2d (patch) | |
| tree | 699dd1acc44dbd9dfa6acd236efca619f944ef3a /ssl/ssl_locl.h | |
| parent | 0a4fe37fc6248e5efadcda34015eff122e01b1db (diff) | |
Add custom extension sanity checks.
Reject attempts to use extensions handled internally.
Add flags to each extension structure to indicate if an extension
has been sent or received. Enforce RFC5246 compliance by rejecting
duplicate extensions and unsolicited extensions and only send a
server extension if we have sent the corresponding client extension.
Reviewed-by: Emilia Käsper <emilia@openssl.org>
(cherry picked from commit 28ea0a0c6a5e4e217c405340fa22a8503c7a17db)
Diffstat (limited to 'ssl/ssl_locl.h')
| -rw-r--r-- | ssl/ssl_locl.h | 17 |
1 files changed, 17 insertions, 0 deletions
diff --git a/ssl/ssl_locl.h b/ssl/ssl_locl.h index f9a67b3832..af08597474 100644 --- a/ssl/ssl_locl.h +++ b/ssl/ssl_locl.h @@ -528,11 +528,26 @@ typedef struct cert_pkey_st typedef struct { unsigned short ext_type; + /* Per-connection flags relating to this extension type: not used + * if part of an SSL_CTX structure. + */ + unsigned short ext_flags; custom_ext_add_cb add_cb; custom_ext_parse_cb parse_cb; void *arg; } custom_ext_method; +/* ext_flags values */ + +/* Indicates an extension has been received. + * Used to check for unsolicited or duplicate extensions. + */ +#define SSL_EXT_FLAG_RECEIVED 0x1 +/* Indicates an extension has been sent: used to + * enable sending of corresponding ServerHello extension. + */ +#define SSL_EXT_FLAG_SENT 0x2 + typedef struct { custom_ext_method *meths; size_t meths_count; @@ -1380,6 +1395,8 @@ int srp_verify_server_param(SSL *s, int *al); /* t1_ext.c */ +void custom_ext_init(custom_ext_methods *meths); + int custom_ext_parse(SSL *s, int server, unsigned short ext_type, const unsigned char *ext_data, |