githubmirror/gnutls

lib/state.c
1 863 строки55 KB
Daiki Ueno
key_share: support X25519Kyber768Draft00
21 июл 2024, 02:30
21 июл 2024, 02:301bc78c3
/*
 * Copyright (C) 2002-2016 Free Software Foundation, Inc.
 * Copyright (C) 2014-2016 Nikos Mavrogiannopoulos
 * Copyright (C) 2015-2018 Red Hat, Inc.
 *
 * Author: Nikos Mavrogiannopoulos
 *
 * This file is part of GnuTLS.
 *
 * The GnuTLS is free software; you can redistribute it and/or
 * modify it under the terms of the GNU Lesser General Public License
 * as published by the Free Software Foundation; either version 2.1 of
 * the License, or (at your option) any later version.
 *
 * This library is distributed in the hope that it will be useful, but
 * WITHOUT ANY WARRANTY; without even the implied warranty of
 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
 * Lesser General Public License for more details.
 *
 * You should have received a copy of the GNU Lesser General Public License
 * along with this program.  If not, see <https://www.gnu.org/licenses/>
 *
 */

/* Functions to manipulate the session (gnutls_int.h), and some other stuff
 * are included here. The file's name is traditionally gnutls_state even if the
 * state has been renamed to session.
 */

#include "gnutls_int.h"
#include "errors.h"
#include "auth.h"
#include "num.h"
#include "datum.h"
#include "db.h"
#include "record.h"
#include "handshake.h"
#include "dh.h"
#include "buffers.h"
#include "mbuffers.h"
#include "state.h"
#include "constate.h"
#include "auth/cert.h"
#include "auth/anon.h"
#include "auth/psk.h"
#include "algorithms.h"
#include "hello_ext.h"
#include "system.h"
#include "random.h"
#include "fips.h"
#include <intprops.h>
#include <gnutls/dtls.h>
#include "dtls.h"
#include "tls13/session_ticket.h"
#include "ext/cert_types.h"
#include "locks.h"
#include "kx.h"

/* to be used by supplemental data support to disable TLS1.3
 * when supplemental data have been globally registered */
unsigned _gnutls_disable_tls13 = 0;

/* These should really be static, but src/tests.c calls them.  Make
   them public functions?  */
void _gnutls_rsa_pms_set_version(gnutls_session_t session, unsigned char major,
				 unsigned char minor);

/**
 * gnutls_cipher_get:
 * @session: is a #gnutls_session_t type.
 *
 * Get the currently used cipher.
 *
 * Returns: the currently used cipher, a #gnutls_cipher_algorithm_t
 *   type.
 **/
gnutls_cipher_algorithm_t gnutls_cipher_get(gnutls_session_t session)
{
	record_parameters_st *record_params;
	int ret;

	ret = _gnutls_epoch_get(session, EPOCH_READ_CURRENT, &record_params);
	if (ret < 0)
		return gnutls_assert_val(GNUTLS_CIPHER_NULL);

	return record_params->cipher->id;
}

/**
 * gnutls_early_cipher_get:
 * @session: is a #gnutls_session_t type.
 *
 * Get the cipher algorithm used for encrypting early data.
 *
 * Returns: the cipher used for early data, a
 *   #gnutls_cipher_algorithm_t type.
 *
 * Since: 3.7.2
 **/
gnutls_cipher_algorithm_t gnutls_early_cipher_get(gnutls_session_t session)
{
	const cipher_entry_st *ce;

	if (!(session->internals.hsk_flags & HSK_EARLY_DATA_IN_FLIGHT)) {
		return gnutls_assert_val(GNUTLS_CIPHER_UNKNOWN);
	}

	if (unlikely(session->internals.resumed_security_parameters.cs ==
		     NULL)) {
		return gnutls_assert_val(GNUTLS_CIPHER_UNKNOWN);
	}

	ce = cipher_to_entry(session->internals.resumed_security_parameters.cs
				     ->block_algorithm);
	if (unlikely(ce == NULL)) {
		return gnutls_assert_val(GNUTLS_CIPHER_UNKNOWN);
	}

	return ce->id;
}

/**
 * gnutls_certificate_type_get:
 * @session: is a #gnutls_session_t type.
 *
 * This function returns the type of the certificate that is negotiated
 * for this side to send to the peer. The certificate type is by default
 * X.509, unless an alternative certificate type is enabled by
 * gnutls_init() and negotiated during the session.
 *
 * Resumed sessions will return the certificate type that was negotiated
 * and used in the original session.
 *
 * As of version 3.6.4 it is recommended to use
 * gnutls_certificate_type_get2() which is more fine-grained.
 *
 * Returns: the currently used #gnutls_certificate_type_t certificate
 *   type as negotiated for 'our' side of the connection.
 **/
gnutls_certificate_type_t gnutls_certificate_type_get(gnutls_session_t session)
{
	return gnutls_certificate_type_get2(session, GNUTLS_CTYPE_OURS);
}

/**
 * gnutls_certificate_type_get2:
 * @session: is a #gnutls_session_t type.
 * @target: is a #gnutls_ctype_target_t type.
 *
 * This function returns the type of the certificate that a side
 * is negotiated to use.  The certificate type is by default X.509,
 * unless an alternative certificate type is enabled by gnutls_init() and
 * negotiated during the session.
 *
 * The @target parameter specifies whether to request the negotiated
 * certificate type for the client (%GNUTLS_CTYPE_CLIENT),
 * or for the server (%GNUTLS_CTYPE_SERVER). Additionally, in P2P mode
 * connection set up where you don't know in advance who will be client
 * and who will be server you can use the flag (%GNUTLS_CTYPE_OURS) and
 * (%GNUTLS_CTYPE_PEERS) to retrieve the corresponding certificate types.
 *
 * Resumed sessions will return the certificate type that was negotiated
 * and used in the original session. That is, this function can be used
 * to reliably determine the type of the certificate returned by
 * gnutls_certificate_get_peers().
 *
 * Returns: the currently used #gnutls_certificate_type_t certificate
 *   type for the client or the server.
 *
 * Since: 3.6.4
 **/
gnutls_certificate_type_t
gnutls_certificate_type_get2(gnutls_session_t session,
			     gnutls_ctype_target_t target)
{
	/* We want to inline this function so therefore
	 * we've defined it in gnutls_int.h */
	return get_certificate_type(session, target);
}

/**
 * gnutls_kx_get:
 * @session: is a #gnutls_session_t type.
 *
 * Get the currently used key exchange algorithm.
 *
 * This function will return %GNUTLS_KX_ECDHE_RSA, or %GNUTLS_KX_DHE_RSA
 * under TLS 1.3, to indicate an elliptic curve DH key exchange or
 * a finite field one. The precise group used is available
 * by calling gnutls_group_get() instead.
 *
 * Returns: the key exchange algorithm used in the last handshake, a
 *   #gnutls_kx_algorithm_t value.
 **/
gnutls_kx_algorithm_t gnutls_kx_get(gnutls_session_t session)
{
	if (session->security_parameters.cs == 0)
		return 0;

	if (session->security_parameters.cs->kx_algorithm == 0) { /* TLS 1.3 */
		const version_entry_st *ver = get_version(session);
		const gnutls_group_entry_st *group = get_group(session);

		if (ver->tls13_sem) {
			if (session->internals.hsk_flags & HSK_PSK_SELECTED) {
				if (group) {
					if (group->pk == GNUTLS_PK_DH)
						return GNUTLS_KX_DHE_PSK;
					else
						return GNUTLS_KX_ECDHE_PSK;
				} else {
					return GNUTLS_KX_PSK;
				}
			} else if (group) {
				if (group->pk == GNUTLS_PK_DH)
					return GNUTLS_KX_DHE_RSA;
				else
					return GNUTLS_KX_ECDHE_RSA;
			}
		}
	}

	return session->security_parameters.cs->kx_algorithm;
}

/**
 * gnutls_mac_get:
 * @session: is a #gnutls_session_t type.
 *
 * Get the currently used MAC algorithm.
 *
 * Returns: the currently used mac algorithm, a
 *   #gnutls_mac_algorithm_t value.
 **/
gnutls_mac_algorithm_t gnutls_mac_get(gnutls_session_t session)
{
	record_parameters_st *record_params;
	int ret;

	ret = _gnutls_epoch_get(session, EPOCH_READ_CURRENT, &record_params);
	if (ret < 0)
		return gnutls_assert_val(GNUTLS_MAC_NULL);

	return record_params->mac->id;
}

/**
 * gnutls_compression_get:
 * @session: is a #gnutls_session_t type.
 *
 * Get the currently used compression algorithm.
 *
 * Returns: the currently used compression method, a
 *   #gnutls_compression_method_t value.
 **/
gnutls_compression_method_t gnutls_compression_get(gnutls_session_t session)
{
	return GNUTLS_COMP_NULL;
}

/**
 * gnutls_prf_hash_get:
 * @session: is a #gnutls_session_t type.
 *
 * Get the currently used hash algorithm. In TLS 1.3, the hash
 * algorithm is used for both the key derivation function and
 * handshake message authentication code. In TLS 1.2, it matches the
 * hash algorithm used for PRF.
 *
 * Returns: the currently used hash algorithm, a
 *    #gnutls_digest_algorithm_t value.
 *
 * Since: 3.6.13
 **/
gnutls_digest_algorithm_t gnutls_prf_hash_get(const gnutls_session_t session)
{
	if (session->security_parameters.prf == NULL)
		return gnutls_assert_val(GNUTLS_DIG_UNKNOWN);

	if (session->security_parameters.prf->id >= GNUTLS_MAC_AEAD)
		return gnutls_assert_val(GNUTLS_DIG_UNKNOWN);

	return (gnutls_digest_algorithm_t)session->security_parameters.prf->id;
}

/**
 * gnutls_early_prf_hash_get:
 * @session: is a #gnutls_session_t type.
 *
 * Get the hash algorithm used as a PRF to derive keys for encrypting
 * early data in TLS 1.3.
 *
 * Returns: the hash algorithm used for early data, a
 *    #gnutls_digest_algorithm_t value.
 *
 * Since: 3.7.2
 **/
gnutls_digest_algorithm_t
gnutls_early_prf_hash_get(const gnutls_session_t session)
{
	if (!(session->internals.hsk_flags & HSK_EARLY_DATA_IN_FLIGHT)) {
		return gnutls_assert_val(GNUTLS_DIG_UNKNOWN);
	}

	if (unlikely(session->internals.resumed_security_parameters.prf ==
		     NULL)) {
		return gnutls_assert_val(GNUTLS_DIG_UNKNOWN);
	}

	if (unlikely(session->internals.resumed_security_parameters.prf->id >=
		     GNUTLS_MAC_AEAD)) {
		return gnutls_assert_val(GNUTLS_DIG_UNKNOWN);
	}

	return (gnutls_digest_algorithm_t)
		session->internals.resumed_security_parameters.prf->id;
}

/**
 * gnutls_ciphersuite_get:
 * @session: is a #gnutls_session_t type.
 *
 * Get the canonical name of negotiated TLS ciphersuite.  The names
 * returned by this function match the IANA registry, with one
 * exception:
 *
 *   TLS_DHE_DSS_RC4_128_SHA { 0x00, 0x66 }
 *
 * which is reserved for compatibility.
 *
 * To get a detailed description of the current ciphersuite, it is
 * recommended to use gnutls_session_get_desc().
 *
 * Returns: a string that contains the canonical name of a TLS ciphersuite,
 *     or %NULL if the handshake is not completed.
 *
 * Since: 3.7.4
 **/
const char *gnutls_ciphersuite_get(gnutls_session_t session)
{
	if (unlikely(session->internals.handshake_in_progress)) {
		return NULL;
	}
	return session->security_parameters.cs->canonical_name;
}

void reset_binders(gnutls_session_t session)
{
	_gnutls_free_temp_key_datum(&session->key.binders[0].psk);
	_gnutls_free_temp_key_datum(&session->key.binders[1].psk);
	memset(session->key.binders, 0, sizeof(session->key.binders));
}

/* Check whether certificate credentials of type @cert_type are set
 * for the current session.
 */
static bool _gnutls_has_cert_credentials(gnutls_session_t session,
					 gnutls_certificate_type_t cert_type)
{
	unsigned i;
	unsigned cert_found = 0;
	gnutls_certificate_credentials_t cred;

	/* First, check for certificate credentials. If we have no certificate
	 * credentials set then we don't support certificates at all.
	 */
	cred = (gnutls_certificate_credentials_t)_gnutls_get_cred(
		session, GNUTLS_CRD_CERTIFICATE);

	if (cred == NULL)
		return false;

	/* There are credentials initialized. Now check whether we can find
	 * pre-set certificates of the required type, but only if we don't
	 * use the callback functions.
	 */
	if (cred->get_cert_callback3 == NULL) {
		for (i = 0; i < cred->ncerts; i++) {
			if (cred->certs[i].cert_list[0].type == cert_type) {
				cert_found = 1;
				break;
			}
		}

		if (cert_found == 0) {
			/* No matching certificate found. */
			return false;
		}
	}

	return true; // OK
}

/* Check if the given certificate type is supported.
 * This means that it is enabled by the priority functions,
 * and in some cases a matching certificate exists. A check for
 * the latter can be toggled via the parameter @check_credentials.
 */
bool _gnutls_session_is_cert_type_supported(gnutls_session_t session,
					    gnutls_certificate_type_t cert_type,
					    bool check_credentials,
					    gnutls_ctype_target_t target)
{
	unsigned i;
	priority_st *ctype_priorities;

	// Check whether this cert type is enabled by the application
	if (!is_cert_type_enabled(session, cert_type))
		return gnutls_assert_val(GNUTLS_E_UNSUPPORTED_CERTIFICATE_TYPE);

	// Perform a credentials check if requested
	if (check_credentials) {
		if (!_gnutls_has_cert_credentials(session, cert_type))
			return gnutls_assert_val(
				GNUTLS_E_UNSUPPORTED_CERTIFICATE_TYPE);
	}

	/* So far so good. We have the required credentials (if needed).
	 * Now check whether we are allowed to use them according to our
	 * priorities.
	 */
	// Which certificate type should we query?
	switch (target) {
	case GNUTLS_CTYPE_CLIENT:
		ctype_priorities =
			&(session->internals.priorities->client_ctype);
		break;
	case GNUTLS_CTYPE_SERVER:
		ctype_priorities =
			&(session->internals.priorities->server_ctype);
		break;
	default:
		return gnutls_assert_val(GNUTLS_E_INVALID_REQUEST);
	}

	// No explicit priorities set, and default ctype is asked
	if (ctype_priorities->num_priorities == 0 &&
	    cert_type == DEFAULT_CERT_TYPE)
		return 0;

	/* Now lets find out whether our cert type is in our priority
	 * list, i.e. set of allowed cert types.
	 */
	for (i = 0; i < ctype_priorities->num_priorities; i++) {
		if (ctype_priorities->priorities[i] == cert_type)
			return 0;
	}

	return GNUTLS_E_UNSUPPORTED_CERTIFICATE_TYPE;
}

static void deinit_keys(gnutls_session_t session)
{
	const version_entry_st *vers = get_version(session);

	if (vers == NULL)
		return;

	gnutls_pk_params_release(&session->key.kshare.ecdhx_params);
	gnutls_pk_params_release(&session->key.kshare.ecdh_params);
	gnutls_pk_params_release(&session->key.kshare.dh_params);
	gnutls_pk_params_release(&session->key.kshare.kem_params);

	if (!vers->tls13_sem && session->key.binders[0].prf == NULL) {
		gnutls_pk_params_release(&session->key.proto.tls12.ecdh.params);
		gnutls_pk_params_release(&session->key.proto.tls12.dh.params);
		zrelease_temp_mpi_key(&session->key.proto.tls12.ecdh.x);
		zrelease_temp_mpi_key(&session->key.proto.tls12.ecdh.y);
		_gnutls_free_temp_key_datum(&session->key.proto.tls12.ecdh.raw);

		zrelease_temp_mpi_key(&session->key.proto.tls12.dh.client_Y);

		/* SRP */
		zrelease_temp_mpi_key(&session->key.proto.tls12.srp.srp_p);
		zrelease_temp_mpi_key(&session->key.proto.tls12.srp.srp_g);
		zrelease_temp_mpi_key(&session->key.proto.tls12.srp.srp_key);

		zrelease_temp_mpi_key(&session->key.proto.tls12.srp.u);
		zrelease_temp_mpi_key(&session->key.proto.tls12.srp.a);
		zrelease_temp_mpi_key(&session->key.proto.tls12.srp.x);
		zrelease_temp_mpi_key(&session->key.proto.tls12.srp.A);
		zrelease_temp_mpi_key(&session->key.proto.tls12.srp.B);
		zrelease_temp_mpi_key(&session->key.proto.tls12.srp.b);
	} else {
		gnutls_memset(session->key.proto.tls13.temp_secret, 0,
			      sizeof(session->key.proto.tls13.temp_secret));
	}

	reset_binders(session);
	_gnutls_free_temp_key_datum(&session->key.key);
}

/* An internal version of _gnutls_handshake_internal_state_clear(),
 * it will not attempt to deallocate, only initialize */
static void handshake_internal_state_clear1(gnutls_session_t session)
{
	/* by default no selected certificate */
	session->internals.adv_version_major = 0;
	session->internals.adv_version_minor = 0;
	session->internals.direction = 0;

	/* use out of band data for the last
	 * handshake messages received.
	 */
	session->internals.last_handshake_in = -1;
	session->internals.last_handshake_out = -1;

	session->internals.resumable = true;

	session->internals.handshake_suspicious_loops = 0;
	session->internals.dtls.hsk_read_seq = 0;
	session->internals.dtls.hsk_write_seq = 0;

	session->internals.cand_ec_group = 0;
	session->internals.cand_dh_group = 0;

	session->internals.hrr_cs[0] = CS_INVALID_MAJOR;
	session->internals.hrr_cs[1] = CS_INVALID_MINOR;
}

/* This function will clear all the variables in internals
 * structure within the session, which depend on the current handshake.
 * This is used to allow further handshakes.
 */
void _gnutls_handshake_internal_state_clear(gnutls_session_t session)
{
	handshake_internal_state_clear1(session);

	_gnutls_handshake_hash_buffers_clear(session);
	deinit_keys(session);

	_gnutls_epoch_gc(session);

	session->internals.handshake_abs_timeout.tv_sec = 0;
	session->internals.handshake_abs_timeout.tv_nsec = 0;
	session->internals.handshake_in_progress = 0;

	session->internals.tfo.connect_addrlen = 0;
	session->internals.tfo.connect_only = 0;
	session->internals.early_data_received = 0;
	session->internals.session_ticket_renew = 0;
}

/**
 * gnutls_init:
 * @session: is a pointer to a #gnutls_session_t type.
 * @flags: indicate if this session is to be used for server or client.
 *
 * This function initializes the provided session. Every session must
 * be initialized before use, and after successful initialization and
 * use must be deinitialized by calling gnutls_deinit().
 *
 * @flags can be any combination of flags from %gnutls_init_flags_t.
 *
 * Note that since version 3.1.2 this function enables some common
 * TLS extensions such as session tickets and OCSP certificate status
 * request in client side by default. To prevent that use the %GNUTLS_NO_DEFAULT_EXTENSIONS
 * flag.
 *
 * Note that it is never mandatory to use gnutls_deinit() after this
 * function fails.  Since gnutls 3.8.0, it is safe to unconditionally
 * use gnutls_deinit() even after failure regardless of whether the
 * memory was initialized prior to gnutls_init(); however, clients
 * wanting to be portable to older versions of the library should
 * either skip deinitialization on failure, or pre-initialize the
 * memory passed in to gnutls_init() to all zeroes via memset() or
 * similar.
 *
 * Returns: %GNUTLS_E_SUCCESS on success, or an error code.
 **/
int gnutls_init(gnutls_session_t *session, unsigned int flags)
{
	int ret;

	*session = NULL;
	FAIL_IF_LIB_ERROR;

	*session = gnutls_calloc(1, sizeof(struct gnutls_session_int));
	if (*session == NULL)
		return GNUTLS_E_MEMORY_ERROR;

	ret = gnutls_mutex_init(&(*session)->internals.post_negotiation_lock);
	if (ret < 0) {
		gnutls_assert();
		gnutls_free(*session);
		return ret;
	}

	ret = gnutls_mutex_init(&(*session)->internals.epoch_lock);
	if (ret < 0) {
		gnutls_assert();
		gnutls_mutex_deinit(
			&(*session)->internals.post_negotiation_lock);
		gnutls_free(*session);
		return ret;
	}

	ret = _gnutls_epoch_setup_next(*session, 1, NULL);
	if (ret < 0) {
		gnutls_mutex_deinit(
			&(*session)->internals.post_negotiation_lock);
		gnutls_mutex_deinit(&(*session)->internals.epoch_lock);
		gnutls_free(*session);
		return gnutls_assert_val(GNUTLS_E_MEMORY_ERROR);
	}
	_gnutls_epoch_bump(*session);

	(*session)->security_parameters.entity =
		(flags & GNUTLS_SERVER ? GNUTLS_SERVER : GNUTLS_CLIENT);

	/* the default certificate type for TLS */
	(*session)->security_parameters.client_ctype = DEFAULT_CERT_TYPE;
	(*session)->security_parameters.server_ctype = DEFAULT_CERT_TYPE;

	/* Initialize buffers */
	_gnutls_buffer_init(&(*session)->internals.handshake_hash_buffer);
	_gnutls_buffer_init(&(*session)->internals.post_handshake_hash_buffer);
	_gnutls_buffer_init(&(*session)->internals.hb_remote_data);
	_gnutls_buffer_init(&(*session)->internals.hb_local_data);
	_gnutls_buffer_init(&(*session)->internals.record_presend_buffer);
	_gnutls_buffer_init(&(*session)->internals.record_key_update_buffer);
	_gnutls_buffer_init(&(*session)->internals.reauth_buffer);

	_mbuffer_head_init(&(*session)->internals.record_buffer);
	_mbuffer_head_init(&(*session)->internals.record_send_buffer);
	_mbuffer_head_init(&(*session)->internals.record_recv_buffer);
	_mbuffer_head_init(&(*session)->internals.early_data_recv_buffer);
	_gnutls_buffer_init(&(*session)->internals.early_data_presend_buffer);

	_mbuffer_head_init(&(*session)->internals.handshake_send_buffer);
	_gnutls_handshake_recv_buffer_init(*session);

	(*session)->internals.expire_time = DEFAULT_EXPIRE_TIME;

	/* Ticket key rotation - set the default X to 3 times the ticket expire time */
	(*session)->key.totp.last_result = 0;

	gnutls_handshake_set_max_packet_length((*session),
					       MAX_HANDSHAKE_PACKET_SIZE);

	/* set the socket pointers to -1;
	 */
	(*session)->internals.transport_recv_ptr = (gnutls_transport_ptr_t)-1;
	(*session)->internals.transport_send_ptr = (gnutls_transport_ptr_t)-1;

	/* set the default maximum record size for TLS
	 */
	(*session)->security_parameters.max_record_recv_size =
		DEFAULT_MAX_RECORD_SIZE;
	(*session)->security_parameters.max_record_send_size =
		DEFAULT_MAX_RECORD_SIZE;
	(*session)->security_parameters.max_user_record_recv_size =
		DEFAULT_MAX_RECORD_SIZE;
	(*session)->security_parameters.max_user_record_send_size =
		DEFAULT_MAX_RECORD_SIZE;

	/* set the default early data size for TLS
	 */
	if ((*session)->security_parameters.entity == GNUTLS_SERVER) {
		(*session)->security_parameters.max_early_data_size =
			DEFAULT_MAX_EARLY_DATA_SIZE;
	} else {
		(*session)->security_parameters.max_early_data_size =
			UINT32_MAX;
	}

	/* Everything else not initialized here is initialized as NULL
	 * or 0. This is why calloc is used. However, we want to
	 * ensure that certain portions of data are initialized at
	 * runtime before being used. Mark such regions with a
	 * valgrind client request as undefined.
	 */
	_gnutls_memory_mark_undefined(
		(*session)->security_parameters.master_secret,
		GNUTLS_MASTER_SIZE);
	_gnutls_memory_mark_undefined(
		(*session)->security_parameters.client_random,
		GNUTLS_RANDOM_SIZE);
	_gnutls_memory_mark_undefined(
		(*session)->security_parameters.server_random,
		GNUTLS_RANDOM_SIZE);
	_gnutls_memory_mark_undefined((*session)->key.session_ticket_key,
				      TICKET_MASTER_KEY_SIZE);
	_gnutls_memory_mark_undefined((*session)->key.previous_ticket_key,
				      TICKET_MASTER_KEY_SIZE);
	_gnutls_memory_mark_undefined((*session)->key.initial_stek,
				      TICKET_MASTER_KEY_SIZE);

	handshake_internal_state_clear1(*session);

#ifdef MSG_NOSIGNAL
	if (flags & GNUTLS_NO_SIGNAL)
		gnutls_transport_set_vec_push_function(*session,
						       system_writev_nosignal);
	else
#endif
		gnutls_transport_set_vec_push_function(*session, system_writev);
	(*session)->internals.pull_timeout_func = gnutls_system_recv_timeout;
	(*session)->internals.pull_func = system_read;
	(*session)->internals.errno_func = system_errno;

	(*session)->internals.saved_username = NULL;
	(*session)->internals.saved_username_size = -1;

	/* heartbeat timeouts */
	(*session)->internals.hb_retrans_timeout_ms = 1000;
	(*session)->internals.hb_total_timeout_ms = 60000;

	if (flags & GNUTLS_DATAGRAM) {
		(*session)->internals.dtls.mtu = DTLS_DEFAULT_MTU;
		(*session)->internals.transport = GNUTLS_DGRAM;

		gnutls_dtls_set_timeouts(*session, DTLS_RETRANS_TIMEOUT, 60000);
	} else {
		(*session)->internals.transport = GNUTLS_STREAM;
	}

	/* Enable useful extensions */
	if ((flags & GNUTLS_CLIENT) &&
	    !(flags & GNUTLS_NO_DEFAULT_EXTENSIONS)) {
#ifdef ENABLE_OCSP
		if (!(flags & GNUTLS_NO_STATUS_REQUEST))
			gnutls_ocsp_status_request_enable_client(*session, NULL,
								 0, NULL);
#endif
	}

	/* session tickets in server side are enabled by setting a key */
	if (flags & GNUTLS_SERVER)
		flags |= GNUTLS_NO_TICKETS;

	(*session)->internals.flags = flags;

	if (_gnutls_disable_tls13 != 0)
		(*session)->internals.flags |= INT_FLAG_NO_TLS13;

	/* Install the default keylog function */
	gnutls_session_set_keylog_function(*session, _gnutls_nss_keylog_func);

	return 0;
}

/**
 * gnutls_deinit:
 * @session: is a #gnutls_session_t type.
 *
 * This function clears all buffers associated with the @session.
 * This function will also remove session data from the session
 * database if the session was terminated abnormally.
 **/
void gnutls_deinit(gnutls_session_t session)
{
	unsigned int i;

	if (session == NULL)
		return;

	/* remove auth info firstly */
	_gnutls_free_auth_info(session);

	_gnutls_handshake_internal_state_clear(session);
	_gnutls_handshake_io_buffer_clear(session);
	_gnutls_hello_ext_priv_deinit(session);

	for (i = 0; i < MAX_EPOCH_INDEX; i++)
		if (session->record_parameters[i] != NULL) {
			_gnutls_epoch_free(session,
					   session->record_parameters[i]);
			session->record_parameters[i] = NULL;
		}

	_gnutls_buffer_clear(&session->internals.handshake_hash_buffer);
	_gnutls_buffer_clear(&session->internals.post_handshake_hash_buffer);
	_gnutls_buffer_clear(&session->internals.hb_remote_data);
	_gnutls_buffer_clear(&session->internals.hb_local_data);
	_gnutls_buffer_clear(&session->internals.record_presend_buffer);
	_gnutls_buffer_clear(&session->internals.record_key_update_buffer);
	_gnutls_buffer_clear(&session->internals.reauth_buffer);

	_mbuffer_head_clear(&session->internals.record_buffer);
	_mbuffer_head_clear(&session->internals.record_recv_buffer);
	_mbuffer_head_clear(&session->internals.record_send_buffer);

	_mbuffer_head_clear(&session->internals.early_data_recv_buffer);
	_gnutls_buffer_clear(&session->internals.early_data_presend_buffer);

	_gnutls_free_datum(&session->internals.resumption_data);
	_gnutls_free_datum(&session->internals.dtls.dcookie);

	for (i = 0; i < session->internals.rexts_size; i++)
		gnutls_free(session->internals.rexts[i].name);
	gnutls_free(session->internals.rexts);
	gnutls_free(session->internals.post_handshake_cr_context.data);

	gnutls_free(session->internals.saved_username);
	gnutls_free(session->internals.rsup);

	gnutls_credentials_clear(session);
	_gnutls_selected_certs_deinit(session);

	/* destroy any session ticket we may have received */
	tls13_ticket_deinit(&session->internals.tls13_ticket);

	/* we rely on priorities' internal reference counting */
	gnutls_priority_deinit(session->internals.priorities);

	/* overwrite any temp TLS1.3 keys */
	gnutls_memset(&session->key.proto, 0, sizeof(session->key.proto));

	/* clear session ticket keys */
	_gnutls_memory_mark_defined(session->key.session_ticket_key,
				    TICKET_MASTER_KEY_SIZE);
	gnutls_memset(&session->key.session_ticket_key, 0,
		      TICKET_MASTER_KEY_SIZE);
	_gnutls_memory_mark_undefined(session->key.session_ticket_key,
				      TICKET_MASTER_KEY_SIZE);

	_gnutls_memory_mark_defined(session->key.previous_ticket_key,
				    TICKET_MASTER_KEY_SIZE);
	gnutls_memset(&session->key.previous_ticket_key, 0,
		      TICKET_MASTER_KEY_SIZE);
	_gnutls_memory_mark_undefined(session->key.previous_ticket_key,
				      TICKET_MASTER_KEY_SIZE);

	_gnutls_memory_mark_defined(session->key.initial_stek,
				    TICKET_MASTER_KEY_SIZE);
	gnutls_memset(&session->key.initial_stek, 0, TICKET_MASTER_KEY_SIZE);
	_gnutls_memory_mark_undefined(session->key.initial_stek,
				      TICKET_MASTER_KEY_SIZE);

	gnutls_mutex_deinit(&session->internals.post_negotiation_lock);
	gnutls_mutex_deinit(&session->internals.epoch_lock);

	gnutls_free(session);
}

int _gnutls_dh_set_peer_public(gnutls_session_t session, bigint_t public)
{
	dh_info_st *dh;
	int ret;

	switch (gnutls_auth_get_type(session)) {
	case GNUTLS_CRD_ANON: {
		anon_auth_info_t info;
		info = _gnutls_get_auth_info(session, GNUTLS_CRD_ANON);
		if (info == NULL)
			return gnutls_assert_val(GNUTLS_E_INTERNAL_ERROR);

		dh = &info->dh;
		break;
	}
	case GNUTLS_CRD_PSK: {
		psk_auth_info_t info;
		info = _gnutls_get_auth_info(session, GNUTLS_CRD_PSK);
		if (info == NULL)
			return gnutls_assert_val(GNUTLS_E_INTERNAL_ERROR);

		dh = &info->dh;
		break;
	}
	case GNUTLS_CRD_CERTIFICATE: {
		cert_auth_info_t info;

		info = _gnutls_get_auth_info(session, GNUTLS_CRD_CERTIFICATE);
		if (info == NULL)
			return gnutls_assert_val(GNUTLS_E_INTERNAL_ERROR);

		dh = &info->dh;
		break;
	}
	default:
		return gnutls_assert_val(GNUTLS_E_INTERNAL_ERROR);
	}

	if (dh->public_key.data)
		_gnutls_free_datum(&dh->public_key);

	ret = _gnutls_mpi_dprint_lz(public, &dh->public_key);
	if (ret < 0) {
		gnutls_assert();
		return ret;
	}

	return 0;
}

int _gnutls_dh_set_secret_bits(gnutls_session_t session, unsigned bits)
{
	switch (gnutls_auth_get_type(session)) {
	case GNUTLS_CRD_ANON: {
		anon_auth_info_t info;
		info = _gnutls_get_auth_info(session, GNUTLS_CRD_ANON);
		if (info == NULL)
			return gnutls_assert_val(GNUTLS_E_INTERNAL_ERROR);
		info->dh.secret_bits = bits;
		break;
	}
	case GNUTLS_CRD_PSK: {
		psk_auth_info_t info;
		info = _gnutls_get_auth_info(session, GNUTLS_CRD_PSK);
		if (info == NULL)
			return gnutls_assert_val(GNUTLS_E_INTERNAL_ERROR);
		info->dh.secret_bits = bits;
		break;
	}
	case GNUTLS_CRD_CERTIFICATE: {
		cert_auth_info_t info;

		info = _gnutls_get_auth_info(session, GNUTLS_CRD_CERTIFICATE);
		if (info == NULL)
			return gnutls_assert_val(GNUTLS_E_INTERNAL_ERROR);

		info->dh.secret_bits = bits;
		break;
	default:
		return gnutls_assert_val(GNUTLS_E_INTERNAL_ERROR);
	}
	}

	return 0;
}

/* Sets the prime and the generator in the auth info structure.
 */
int _gnutls_dh_save_group(gnutls_session_t session, bigint_t gen,
			  bigint_t prime)
{
	dh_info_st *dh;
	int ret;

	switch (gnutls_auth_get_type(session)) {
	case GNUTLS_CRD_ANON: {
		anon_auth_info_t info;
		info = _gnutls_get_auth_info(session, GNUTLS_CRD_ANON);
		if (info == NULL)
			return gnutls_assert_val(GNUTLS_E_INTERNAL_ERROR);

		dh = &info->dh;
		break;
	}
	case GNUTLS_CRD_PSK: {
		psk_auth_info_t info;
		info = _gnutls_get_auth_info(session, GNUTLS_CRD_PSK);
		if (info == NULL)
			return gnutls_assert_val(GNUTLS_E_INTERNAL_ERROR);

		dh = &info->dh;
		break;
	}
	case GNUTLS_CRD_CERTIFICATE: {
		cert_auth_info_t info;

		info = _gnutls_get_auth_info(session, GNUTLS_CRD_CERTIFICATE);
		if (info == NULL)
			return gnutls_assert_val(GNUTLS_E_INTERNAL_ERROR);

		dh = &info->dh;
		break;
	}
	default:
		return gnutls_assert_val(GNUTLS_E_INTERNAL_ERROR);
	}

	if (dh->prime.data)
		_gnutls_free_datum(&dh->prime);

	if (dh->generator.data)
		_gnutls_free_datum(&dh->generator);

	/* prime
	 */
	ret = _gnutls_mpi_dprint_lz(prime, &dh->prime);
	if (ret < 0) {
		gnutls_assert();
		return ret;
	}

	/* generator
	 */
	ret = _gnutls_mpi_dprint_lz(gen, &dh->generator);
	if (ret < 0) {
		gnutls_assert();
		_gnutls_free_datum(&dh->prime);
		return ret;
	}

	return 0;
}

/**
 * gnutls_certificate_send_x509_rdn_sequence:
 * @session: a #gnutls_session_t type.
 * @status: is 0 or 1
 *
 * If status is non zero, this function will order gnutls not to send
 * the rdnSequence in the certificate request message. That is the
 * server will not advertise its trusted CAs to the peer. If status
 * is zero then the default behaviour will take effect, which is to
 * advertise the server's trusted CAs.
 *
 * This function has no effect in clients, and in authentication
 * methods other than certificate with X.509 certificates.
 **/
void gnutls_certificate_send_x509_rdn_sequence(gnutls_session_t session,
					       int status)
{
	session->internals.ignore_rdn_sequence = status;
}

/*-
 * _gnutls_record_set_default_version - Used to set the default version for the first record packet
 * @session: is a #gnutls_session_t type.
 * @major: is a tls major version
 * @minor: is a tls minor version
 *
 * This function sets the default version that we will use in the first
 * record packet (client hello). This function is only useful to people
 * that know TLS internals and want to debug other implementations.
 -*/
void _gnutls_record_set_default_version(gnutls_session_t session,
					unsigned char major,
					unsigned char minor)
{
	session->internals.default_record_version[0] = major;
	session->internals.default_record_version[1] = minor;
}

/*-
 * _gnutls_hello_set_default_version - Used to set the default version for the first record packet
 * @session: is a #gnutls_session_t type.
 * @major: is a tls major version
 * @minor: is a tls minor version
 *
 * This function sets the default version that we will use in the first
 * record packet (client hello). This function is only useful to people
 * that know TLS internals and want to debug other implementations.
 -*/
void _gnutls_hello_set_default_version(gnutls_session_t session,
				       unsigned char major, unsigned char minor)
{
	session->internals.default_hello_version[0] = major;
	session->internals.default_hello_version[1] = minor;
}

/**
 * gnutls_handshake_set_private_extensions:
 * @session: is a #gnutls_session_t type.
 * @allow: is an integer (0 or 1)
 *
 * This function will enable or disable the use of private cipher
 * suites (the ones that start with 0xFF).  By default or if @allow
 * is 0 then these cipher suites will not be advertised nor used.
 *
 * Currently GnuTLS does not include such cipher-suites or
 * compression algorithms.
 *
 * Enabling the private ciphersuites when talking to other than
 * gnutls servers and clients may cause interoperability problems.
 **/
void gnutls_handshake_set_private_extensions(gnutls_session_t session,
					     int allow)
{
	/* we have no private extensions */
	return;
}

/**
 * gnutls_session_is_resumed:
 * @session: is a #gnutls_session_t type.
 *
 * Checks whether session is resumed or not. This is functional
 * for both server and client side.
 *
 * Returns: non zero if this session is resumed, or a zero if this is
 *   a new session.
 **/
int gnutls_session_is_resumed(gnutls_session_t session)
{
	if (session->security_parameters.entity == GNUTLS_CLIENT) {
		const version_entry_st *ver = get_version(session);
		if (ver && ver->tls13_sem) {
			return session->internals.resumed;
		}

		if (session->security_parameters.session_id_size > 0 &&
		    session->security_parameters.session_id_size ==
			    session->internals.resumed_security_parameters
				    .session_id_size &&
		    memcmp(session->security_parameters.session_id,
			   session->internals.resumed_security_parameters
				   .session_id,
			   session->security_parameters.session_id_size) == 0)
			return 1;
	} else {
		if (session->internals.resumed)
			return 1;
	}

	return 0;
}

/**
 * gnutls_session_resumption_requested:
 * @session: is a #gnutls_session_t type.
 *
 * Check whether the client has asked for session resumption.
 * This function is valid only on server side.
 *
 * Returns: non zero if session resumption was asked, or a zero if not.
 **/
int gnutls_session_resumption_requested(gnutls_session_t session)
{
	if (session->security_parameters.entity == GNUTLS_CLIENT) {
		return 0;
	} else {
		return session->internals.resumption_requested;
	}
}

/*-
 * _gnutls_session_is_psk - Used to check whether this session uses PSK kx
 * @session: is a #gnutls_session_t type.
 *
 * This function will return non zero if this session uses a PSK key
 * exchange algorithm.
 -*/
int _gnutls_session_is_psk(gnutls_session_t session)
{
	gnutls_kx_algorithm_t kx;

	kx = session->security_parameters.cs->kx_algorithm;
	if (kx == GNUTLS_KX_PSK || kx == GNUTLS_KX_DHE_PSK ||
	    kx == GNUTLS_KX_RSA_PSK)
		return 1;

	return 0;
}

/*-
 * _gnutls_session_is_ecc - Used to check whether this session uses ECC kx
 * @session: is a #gnutls_session_t type.
 *
 * This function will return non zero if this session uses an elliptic
 * curves key exchange exchange algorithm.
 -*/
int _gnutls_session_is_ecc(gnutls_session_t session)
{
	gnutls_kx_algorithm_t kx;

	/* We get the key exchange algorithm through the ciphersuite because
	 * the negotiated key exchange might not have been set yet.
	 */
	kx = session->security_parameters.cs->kx_algorithm;

	return _gnutls_kx_is_ecc(kx);
}

/**
 * gnutls_session_get_ptr:
 * @session: is a #gnutls_session_t type.
 *
 * Get user pointer for session.  Useful in callbacks.  This is the
 *   pointer set with gnutls_session_set_ptr().
 *
 * Returns: the user given pointer from the session structure, or
 *   %NULL if it was never set.
 **/
void *gnutls_session_get_ptr(gnutls_session_t session)
{
	return session->internals.user_ptr;
}

/**
 * gnutls_session_set_ptr:
 * @session: is a #gnutls_session_t type.
 * @ptr: is the user pointer
 *
 * This function will set (associate) the user given pointer @ptr to
 * the session structure.  This pointer can be accessed with
 * gnutls_session_get_ptr().
 **/
void gnutls_session_set_ptr(gnutls_session_t session, void *ptr)
{
	session->internals.user_ptr = ptr;
}

/**
 * gnutls_session_set_verify_function:
 * @session: is a #gnutls_session_t type.
 * @func: is the callback function
 *
 * This function sets a callback to be called when peer's certificate
 * has been received in order to verify it on receipt rather than
 * doing after the handshake is completed. This overrides any callback
 * set using gnutls_certificate_set_verify_function().
 *
 * The callback's function prototype is:
 * int (*callback)(gnutls_session_t);
 *
 * If the callback function is provided then gnutls will call it, in the
 * handshake, just after the certificate message has been received.
 * To verify or obtain the certificate the gnutls_certificate_verify_peers2(),
 * gnutls_certificate_type_get(), gnutls_certificate_get_peers() functions
 * can be used.
 *
 * The callback function should return 0 for the handshake to continue
 * or non-zero to terminate.
 *
 * Since: 3.4.6
 **/
void gnutls_session_set_verify_function(
	gnutls_session_t session, gnutls_certificate_verify_function *func)
{
	session->internals.verify_callback = func;
}

/**
 * gnutls_record_get_direction:
 * @session: is a #gnutls_session_t type.
 *
 * This function is useful to determine whether a GnuTLS function was interrupted
 * while sending or receiving, so that select() or poll() may be called appropriately.
 *
 * It provides information about the internals of the record
 * protocol and is only useful if a prior gnutls function call,
 * e.g.  gnutls_handshake(), was interrupted and returned
 * %GNUTLS_E_INTERRUPTED or %GNUTLS_E_AGAIN. After such an interrupt
 * applications may call select() or poll() before restoring the
 * interrupted GnuTLS function.
 *
 * This function's output is unreliable if you are using the same
 * @session in different threads for sending and receiving.
 *
 * Returns: 0 if interrupted while trying to read data, or 1 while trying to write data.
 **/
int gnutls_record_get_direction(gnutls_session_t session)
{
	return session->internals.direction;
}

/*-
 * _gnutls_rsa_pms_set_version - Sets a version to be used at the RSA PMS
 * @session: is a #gnutls_session_t type.
 * @major: is the major version to use
 * @minor: is the minor version to use
 *
 * This function will set the given version number to be used at the
 * RSA PMS secret. This is only useful to clients, which want to
 * test server's capabilities.
 -*/
void _gnutls_rsa_pms_set_version(gnutls_session_t session, unsigned char major,
				 unsigned char minor)
{
	session->internals.rsa_pms_version[0] = major;
	session->internals.rsa_pms_version[1] = minor;
}

void _gnutls_session_client_cert_type_set(gnutls_session_t session,
					  gnutls_certificate_type_t ct)
{
	_gnutls_handshake_log(
		"HSK[%p]: Selected client certificate type %s (%d)\n", session,
		gnutls_certificate_type_get_name(ct), ct);
	session->security_parameters.client_ctype = ct;
}

void _gnutls_session_server_cert_type_set(gnutls_session_t session,
					  gnutls_certificate_type_t ct)
{
	_gnutls_handshake_log(
		"HSK[%p]: Selected server certificate type %s (%d)\n", session,
		gnutls_certificate_type_get_name(ct), ct);
	session->security_parameters.server_ctype = ct;
}

/**
 * gnutls_handshake_set_post_client_hello_function:
 * @session: is a #gnutls_session_t type.
 * @func: is the function to be called
 *
 * This function will set a callback to be called after the client
 * hello has been received (callback valid in server side only). This
 * allows the server to adjust settings based on received extensions.
 *
 * Those settings could be ciphersuites, requesting certificate, or
 * anything else except for version negotiation (this is done before
 * the hello message is parsed).
 *
 * This callback must return 0 on success or a gnutls error code to
 * terminate the handshake.
 *
 * Since GnuTLS 3.3.5 the callback is
 * allowed to return %GNUTLS_E_AGAIN or %GNUTLS_E_INTERRUPTED to
 * put the handshake on hold. In that case gnutls_handshake()
 * will return %GNUTLS_E_INTERRUPTED and can be resumed when needed.
 *
 * Warning: You should not use this function to terminate the
 * handshake based on client input unless you know what you are
 * doing. Before the handshake is finished there is no way to know if
 * there is a man-in-the-middle attack being performed.
 **/
void gnutls_handshake_set_post_client_hello_function(
	gnutls_session_t session, gnutls_handshake_simple_hook_func func)
{
	session->internals.user_hello_func = func;
}

/**
 * gnutls_session_enable_compatibility_mode:
 * @session: is a #gnutls_session_t type.
 *
 * This function can be used to disable certain (security) features in
 * TLS in order to maintain maximum compatibility with buggy
 * clients. Because several trade-offs with security are enabled,
 * if required they will be reported through the audit subsystem.
 *
 * Normally only servers that require maximum compatibility with
 * everything out there, need to call this function.
 *
 * Note that this function must be called after any call to gnutls_priority
 * functions.
 *
 * Since: 2.1.4
 **/
void gnutls_session_enable_compatibility_mode(gnutls_session_t session)
{
	ENABLE_COMPAT(&session->internals);
}

/**
 * gnutls_session_channel_binding:
 * @session: is a #gnutls_session_t type.
 * @cbtype: an #gnutls_channel_binding_t enumeration type
 * @cb: output buffer array with data
 *
 * Extract given channel binding data of the @cbtype (e.g.,
 * %GNUTLS_CB_TLS_UNIQUE) type.
 *
 * Returns: %GNUTLS_E_SUCCESS on success,
 * %GNUTLS_E_UNIMPLEMENTED_FEATURE if the @cbtype is unsupported,
 * %GNUTLS_E_CHANNEL_BINDING_NOT_AVAILABLE if the data is not
 * currently available, or an error code.
 *
 * Since: 2.12.0
 **/
int gnutls_session_channel_binding(gnutls_session_t session,
				   gnutls_channel_binding_t cbtype,
				   gnutls_datum_t *cb)
{
	if (!session->internals.initial_negotiation_completed)
		return GNUTLS_E_CHANNEL_BINDING_NOT_AVAILABLE;

	if (cbtype == GNUTLS_CB_TLS_UNIQUE) {
		const version_entry_st *ver = get_version(session);
		if (unlikely(ver == NULL || ver->tls13_sem))
			return GNUTLS_E_CHANNEL_BINDING_NOT_AVAILABLE;

		cb->size = session->internals.cb_tls_unique_len;
		cb->data = gnutls_malloc(cb->size);
		if (cb->data == NULL)
			return GNUTLS_E_MEMORY_ERROR;

		memcpy(cb->data, session->internals.cb_tls_unique, cb->size);

		return 0;
	}

	if (cbtype == GNUTLS_CB_TLS_SERVER_END_POINT) {
		const gnutls_datum_t *ders;
		unsigned int num_certs = 1;
		int ret;
		size_t rlen;
		gnutls_x509_crt_t cert;
		gnutls_digest_algorithm_t algo;

		/* Only X509 certificates are supported for this binding type */
		ret = gnutls_certificate_type_get(session);
		if (ret != GNUTLS_CRT_X509)
			return GNUTLS_E_UNIMPLEMENTED_FEATURE;

		if (session->security_parameters.entity == GNUTLS_CLIENT)
			ders = gnutls_certificate_get_peers(session,
							    &num_certs);
		else
			ders = gnutls_certificate_get_ours(session);

		/* Previous check indicated we have x509 but you never know */
		if (!ders || num_certs == 0)
			return GNUTLS_E_UNIMPLEMENTED_FEATURE;

		ret = gnutls_x509_crt_list_import(&cert, &num_certs, ders,
						  GNUTLS_X509_FMT_DER, 0);
		/* Again, this is not supposed to happen (normally) */
		if (ret < 0 || num_certs == 0)
			return GNUTLS_E_CHANNEL_BINDING_NOT_AVAILABLE;

		/* Obtain signature algorithm used by certificate */
		ret = gnutls_x509_crt_get_signature_algorithm(cert);
		if (ret < 0 || ret == GNUTLS_SIGN_UNKNOWN)
			return GNUTLS_E_UNIMPLEMENTED_FEATURE;

		/* obtain hash function from signature and normalize it */
		algo = gnutls_sign_get_hash_algorithm(ret);
		switch (algo) {
		case GNUTLS_DIG_MD5:
		case GNUTLS_DIG_SHA1:
			algo = GNUTLS_DIG_SHA256;
			break;
		case GNUTLS_DIG_UNKNOWN:
		case GNUTLS_DIG_NULL:
		case GNUTLS_DIG_MD5_SHA1:
			/* double hashing not supported either */
			gnutls_x509_crt_deinit(cert);
			return GNUTLS_E_UNIMPLEMENTED_FEATURE;
		default:
			break;
		}

		/* preallocate 512 bits buffer as maximum supported digest */
		rlen = MAX_HASH_SIZE;
		cb->data = gnutls_malloc(rlen);
		if (cb->data == NULL) {
			gnutls_x509_crt_deinit(cert);
			return GNUTLS_E_MEMORY_ERROR;
		}

		ret = gnutls_x509_crt_get_fingerprint(cert, algo, cb->data,
						      &rlen);
		if (ret == GNUTLS_E_SHORT_MEMORY_BUFFER) {
			cb->data = gnutls_realloc_fast(cb->data, cb->size);
			if (cb->data == NULL) {
				gnutls_x509_crt_deinit(cert);
				return GNUTLS_E_MEMORY_ERROR;
			}
			ret = gnutls_x509_crt_get_fingerprint(cert, algo,
							      cb->data, &rlen);
		}
		cb->size = rlen;
		gnutls_x509_crt_deinit(cert);
		return ret;
	}

	if (cbtype == GNUTLS_CB_TLS_EXPORTER) {
#define RFC5705_LABEL_DATA "EXPORTER-Channel-Binding"
#define RFC5705_LABEL_LEN 24
#define EXPORTER_CTX_DATA ""
#define EXPORTER_CTX_LEN 0

		const version_entry_st *ver = get_version(session);
		if (unlikely(ver == NULL)) {
			return GNUTLS_E_CHANNEL_BINDING_NOT_AVAILABLE;
		}

		/* "tls-exporter" channel binding is defined only when
		 * the TLS handshake results in unique master secrets,
		 * i.e., either TLS 1.3, or TLS 1.2 with extended
		 * master secret negotiated.
		 */
		if (!ver->tls13_sem &&
		    gnutls_session_ext_master_secret_status(session) == 0) {
			return GNUTLS_E_CHANNEL_BINDING_NOT_AVAILABLE;
		}

		cb->size = 32;
		cb->data = gnutls_malloc(cb->size);
		if (cb->data == NULL)
			return GNUTLS_E_MEMORY_ERROR;

		return gnutls_prf_rfc5705(session, RFC5705_LABEL_LEN,
					  RFC5705_LABEL_DATA, EXPORTER_CTX_LEN,
					  EXPORTER_CTX_DATA, cb->size,
					  (char *)cb->data);
	}

	return GNUTLS_E_UNIMPLEMENTED_FEATURE;
}

/**
 * gnutls_ecc_curve_get:
 * @session: is a #gnutls_session_t type.
 *
 * Returns the currently used elliptic curve for key exchange. Only valid
 * when using an elliptic curve ciphersuite.
 *
 * Returns: the currently used curve, a #gnutls_ecc_curve_t
 *   type.
 *
 * Since: 3.0
 **/
gnutls_ecc_curve_t gnutls_ecc_curve_get(gnutls_session_t session)
{
	const gnutls_group_entry_st *e;

	e = get_group(session);
	if (e == NULL || e->curve == 0)
		return 0;
	return e->curve;
}

/**
 * gnutls_group_get:
 * @session: is a #gnutls_session_t type.
 *
 * Returns the currently used group for key exchange. Only valid
 * when using an elliptic curve or DH ciphersuite.
 *
 * Returns: the currently used group, a #gnutls_group_t
 *   type.
 *
 * Since: 3.6.0
 **/
gnutls_group_t gnutls_group_get(gnutls_session_t session)
{
	const gnutls_group_entry_st *e;

	e = get_group(session);
	if (e == NULL)
		return 0;
	return e->id;
}

/**
 * gnutls_protocol_get_version:
 * @session: is a #gnutls_session_t type.
 *
 * Get TLS version, a #gnutls_protocol_t value.
 *
 * Returns: The version of the currently used protocol.
 **/
gnutls_protocol_t gnutls_protocol_get_version(gnutls_session_t session)
{
	return get_num_version(session);
}

/**
 * gnutls_session_get_random:
 * @session: is a #gnutls_session_t type.
 * @client: the client part of the random
 * @server: the server part of the random
 *
 * This function returns pointers to the client and server
 * random fields used in the TLS handshake. The pointers are
 * not to be modified or deallocated.
 *
 * If a client random value has not yet been established, the output
 * will be garbage.
 *
 * Since: 3.0
 **/
void gnutls_session_get_random(gnutls_session_t session, gnutls_datum_t *client,
			       gnutls_datum_t *server)
{
	if (client) {
		client->data = session->security_parameters.client_random;
		client->size =
			sizeof(session->security_parameters.client_random);
	}

	if (server) {
		server->data = session->security_parameters.server_random;
		server->size =
			sizeof(session->security_parameters.server_random);
	}
}

/**
 * gnutls_session_get_master_secret:
 * @session: is a #gnutls_session_t type.
 * @secret: the session's master secret
 *
 * This function returns pointers to the master secret
 * used in the TLS session. The pointers are not to be modified or deallocated.
 *
 * This function is only applicable under TLS 1.2 or earlier versions.
 *
 * Since: 3.5.0
 **/
void gnutls_session_get_master_secret(gnutls_session_t session,
				      gnutls_datum_t *secret)
{
	secret->data = session->security_parameters.master_secret;
	secret->size = sizeof(session->security_parameters.master_secret);
}

unsigned int timespec_sub_ms(struct timespec *a, struct timespec *b)
{
	time_t dsecs;

	dsecs = a->tv_sec - b->tv_sec;
	if (!INT_MULTIPLY_OVERFLOW(dsecs, 1000)) {
		return (dsecs * 1000 +
			(a->tv_nsec - b->tv_nsec) / (1000 * 1000));
	} else {
		return UINT_MAX;
	}
}

/**
 * gnutls_handshake_set_random:
 * @session: is a #gnutls_session_t type.
 * @random: a random value of 32-bytes
 *
 * This function will explicitly set the server or client hello 
 * random value in the subsequent TLS handshake. The random value 
 * should be a 32-byte value.
 *
 * Note that this function should not normally be used as gnutls
 * will select automatically a random value for the handshake.
 *
 * This function should not be used when resuming a session.
 *
 * Returns: %GNUTLS_E_SUCCESS on success, or an error code.
 *
 * Since 3.1.9
 **/
int gnutls_handshake_set_random(gnutls_session_t session,
				const gnutls_datum_t *random)
{
	if (random->size != GNUTLS_RANDOM_SIZE)
		return GNUTLS_E_INVALID_REQUEST;

	session->internals.sc_random_set = 1;
	if (session->security_parameters.entity == GNUTLS_CLIENT)
		memcpy(session->internals.resumed_security_parameters
			       .client_random,
		       random->data, random->size);
	else
		memcpy(session->internals.resumed_security_parameters
			       .server_random,
		       random->data, random->size);

	return 0;
}

/**
 * gnutls_handshake_set_hook_function:
 * @session: is a #gnutls_session_t type
 * @htype: the %gnutls_handshake_description_t of the message to hook at
 * @when: %GNUTLS_HOOK_* depending on when the hook function should be called
 * @func: is the function to be called
 *
 * This function will set a callback to be called after or before the specified
 * handshake message has been received or generated. This is a
 * generalization of gnutls_handshake_set_post_client_hello_function().
 *
 * To call the hook function prior to the message being generated or processed
 * use %GNUTLS_HOOK_PRE as @when parameter, %GNUTLS_HOOK_POST to call
 * after, and %GNUTLS_HOOK_BOTH for both cases.
 *
 * This callback must return 0 on success or a gnutls error code to
 * terminate the handshake.
 *
 * To hook at all handshake messages use an @htype of %GNUTLS_HANDSHAKE_ANY.
 *
 * Warning: You should not use this function to terminate the
 * handshake based on client input unless you know what you are
 * doing. Before the handshake is finished there is no way to know if
 * there is a man-in-the-middle attack being performed.
 **/
void gnutls_handshake_set_hook_function(gnutls_session_t session,
					unsigned int htype, int when,
					gnutls_handshake_hook_func func)
{
	session->internals.h_hook = func;
	session->internals.h_type = htype;
	session->internals.h_post = when;
}

/**
 * gnutls_handshake_set_read_function:
 * @session: is #gnutls_session_t type
 * @func: is the function to be called
 *
 * This function will set a callback to be called when a handshake
 * message is being sent.
 *
 * Since: 3.7.0
 */
void gnutls_handshake_set_read_function(gnutls_session_t session,
					gnutls_handshake_read_func func)
{
	session->internals.h_read_func = func;
}

/**
 * gnutls_alert_set_read_function:
 * @session: is #gnutls_session_t type
 * @func: is the function to be called
 *
 * This function will set a callback to be called when an alert
 * message is being sent.
 *
 * Since: 3.7.0
 */
void gnutls_alert_set_read_function(gnutls_session_t session,
				    gnutls_alert_read_func func)
{
	session->internals.alert_read_func = func;
}

/**
 * gnutls_record_get_state:
 * @session: is a #gnutls_session_t type
 * @read: if non-zero the read parameters are returned, otherwise the write
 * @mac_key: the key used for MAC (if a MAC is used)
 * @IV: the initialization vector or nonce used
 * @cipher_key: the cipher key
 * @seq_number: A 64-bit sequence number
 *
 * This function will return the parameters of the current record state.
 * These are only useful to be provided to an external off-loading device
 * or subsystem. The returned values should be considered constant
 * and valid for the lifetime of the session.
 *
 * In that case, to sync the state back you must call gnutls_record_set_state().
 *
 * Returns: %GNUTLS_E_SUCCESS on success, or an error code.
 *
 * Since 3.4.0
 **/
int gnutls_record_get_state(gnutls_session_t session, unsigned read,
			    gnutls_datum_t *mac_key, gnutls_datum_t *IV,
			    gnutls_datum_t *cipher_key,
			    unsigned char seq_number[8])
{
	record_parameters_st *record_params;
	record_state_st *record_state;
	unsigned int epoch;
	int ret;

	if (read)
		epoch = EPOCH_READ_CURRENT;
	else
		epoch = EPOCH_WRITE_CURRENT;

	ret = _gnutls_epoch_get(session, epoch, &record_params);
	if (ret < 0)
		return gnutls_assert_val(ret);

	if (!record_params->initialized)
		return gnutls_assert_val(GNUTLS_E_INVALID_REQUEST);

	if (read)
		record_state = &record_params->read;
	else
		record_state = &record_params->write;

	if (mac_key) {
		mac_key->data = record_state->mac_key;
		mac_key->size = record_state->mac_key_size;
	}

	if (IV) {
		IV->data = record_state->iv;
		IV->size = record_state->iv_size;
	}

	if (cipher_key) {
		cipher_key->data = record_state->key;
		cipher_key->size = record_state->key_size;
	}

	if (seq_number)
		_gnutls_write_uint64(record_state->sequence_number, seq_number);
	return 0;
}

/**
 * gnutls_record_set_state:
 * @session: is a #gnutls_session_t type
 * @read: if non-zero the read parameters are returned, otherwise the write
 * @seq_number: A 64-bit sequence number
 *
 * This function will set the sequence number in the current record state.
 * This function is useful if sending and receiving are offloaded from
 * gnutls. That is, if gnutls_record_get_state() was used.
 *
 * Returns: %GNUTLS_E_SUCCESS on success, or an error code.
 *
 * Since 3.4.0
 **/
int gnutls_record_set_state(gnutls_session_t session, unsigned read,
			    const unsigned char seq_number[8])
{
	record_parameters_st *record_params;
	record_state_st *record_state;
	int epoch, ret;

	if (read)
		epoch = EPOCH_READ_CURRENT;
	else
		epoch = EPOCH_WRITE_CURRENT;

	ret = _gnutls_epoch_get(session, epoch, &record_params);
	if (ret < 0)
		return gnutls_assert_val(ret);

	if (!record_params->initialized)
		return gnutls_assert_val(GNUTLS_E_INVALID_REQUEST);

	if (read)
		record_state = &record_params->read;
	else
		record_state = &record_params->write;

	record_state->sequence_number = _gnutls_read_uint64(seq_number);

	if (IS_DTLS(session)) {
		_dtls_reset_window(record_params);
	}

	return 0;
}

/**
 * gnutls_session_get_flags:
 * @session: is a #gnutls_session_t type.
 *
 * This function will return a series (ORed) of flags, applicable
 * for the current session.
 *
 * This replaces individual informational functions such as
 * gnutls_safe_renegotiation_status(), gnutls_session_ext_master_secret_status(),
 * etc.
 *
 * Returns: An ORed sequence of flags (see %gnutls_session_flags_t)
 *
 * Since: 3.5.0
 **/
unsigned gnutls_session_get_flags(gnutls_session_t session)
{
	unsigned flags = 0;

	if (gnutls_safe_renegotiation_status(session))
		flags |= GNUTLS_SFLAGS_SAFE_RENEGOTIATION;
	if (gnutls_session_ext_master_secret_status(session))
		flags |= GNUTLS_SFLAGS_EXT_MASTER_SECRET;
	if (gnutls_session_etm_status(session))
		flags |= GNUTLS_SFLAGS_ETM;
	if (gnutls_heartbeat_allowed(session, GNUTLS_HB_LOCAL_ALLOWED_TO_SEND))
		flags |= GNUTLS_SFLAGS_HB_LOCAL_SEND;
	if (gnutls_heartbeat_allowed(session, GNUTLS_HB_PEER_ALLOWED_TO_SEND))
		flags |= GNUTLS_SFLAGS_HB_PEER_SEND;
	if (session->internals.hsk_flags & HSK_FALSE_START_USED)
		flags |= GNUTLS_SFLAGS_FALSE_START;
	if ((session->internals.hsk_flags & HSK_EARLY_START_USED) &&
	    (session->internals.flags & GNUTLS_ENABLE_EARLY_START))
		flags |= GNUTLS_SFLAGS_EARLY_START;
	if (session->internals.hsk_flags & HSK_USED_FFDHE)
		flags |= GNUTLS_SFLAGS_RFC7919;
	if (session->internals.hsk_flags & HSK_TICKET_RECEIVED)
		flags |= GNUTLS_SFLAGS_SESSION_TICKET;
	if (session->security_parameters.post_handshake_auth)
		flags |= GNUTLS_SFLAGS_POST_HANDSHAKE_AUTH;
	if (session->internals.hsk_flags & HSK_EARLY_DATA_ACCEPTED)
		flags |= GNUTLS_SFLAGS_EARLY_DATA;
	if (session->internals.hsk_flags & HSK_OCSP_REQUESTED)
		flags |= GNUTLS_SFLAGS_CLI_REQUESTED_OCSP;
	if (session->internals.hsk_flags & HSK_CLIENT_OCSP_REQUESTED)
		flags |= GNUTLS_SFLAGS_SERV_REQUESTED_OCSP;

	return flags;
}