From 12f58786aa1f5a888bfb505b8d7a3e70e117a52c Mon Sep 17 00:00:00 2001 From: David Benjamin Date: Tue, 28 Aug 2018 17:06:31 -0500 Subject: [PATCH] Some more bools. Change-Id: I60d9e728c1ca5e788ee7df5e874fb6e8ea182fec Reviewed-on: https://boringssl-review.googlesource.com/31524 Commit-Queue: Steven Valdez Reviewed-by: Steven Valdez CQ-Verified: CQ bot account: commit-bot@chromium.org --- ssl/handshake_client.cc | 38 ++++++------- ssl/internal.h | 26 ++++----- ssl/tls13_both.cc | 120 ++++++++++++++++++++-------------------- ssl/tls13_client.cc | 20 +++---- ssl/tls13_server.cc | 2 +- 5 files changed, 103 insertions(+), 103 deletions(-) diff --git a/ssl/handshake_client.cc b/ssl/handshake_client.cc index 9f9e4833..907fcb6f 100644 --- a/ssl/handshake_client.cc +++ b/ssl/handshake_client.cc @@ -212,20 +212,20 @@ static void ssl_get_client_disabled(SSL_HANDSHAKE *hs, uint32_t *out_mask_a, } } -static int ssl_write_client_cipher_list(SSL_HANDSHAKE *hs, CBB *out) { +static bool ssl_write_client_cipher_list(SSL_HANDSHAKE *hs, CBB *out) { SSL *const ssl = hs->ssl; uint32_t mask_a, mask_k; ssl_get_client_disabled(hs, &mask_a, &mask_k); CBB child; if (!CBB_add_u16_length_prefixed(out, &child)) { - return 0; + return false; } // Add a fake cipher suite. See draft-davidben-tls-grease-01. if (ssl->ctx->grease_enabled && !CBB_add_u16(&child, ssl_get_grease_value(hs, ssl_grease_cipher))) { - return 0; + return false; } // Add TLS 1.3 ciphers. Order ChaCha20-Poly1305 relative to AES-GCM based on @@ -233,20 +233,20 @@ static int ssl_write_client_cipher_list(SSL_HANDSHAKE *hs, CBB *out) { if (hs->max_version >= TLS1_3_VERSION) { if (!EVP_has_aes_hardware() && !CBB_add_u16(&child, TLS1_CK_CHACHA20_POLY1305_SHA256 & 0xffff)) { - return 0; + return false; } if (!CBB_add_u16(&child, TLS1_CK_AES_128_GCM_SHA256 & 0xffff) || !CBB_add_u16(&child, TLS1_CK_AES_256_GCM_SHA384 & 0xffff)) { - return 0; + return false; } if (EVP_has_aes_hardware() && !CBB_add_u16(&child, TLS1_CK_CHACHA20_POLY1305_SHA256 & 0xffff)) { - return 0; + return false; } } if (hs->min_version < TLS1_3_VERSION) { - int any_enabled = 0; + bool any_enabled = false; for (const SSL_CIPHER *cipher : SSL_get_ciphers(ssl)) { // Skip disabled ciphers if ((cipher->algorithm_mkey & mask_k) || @@ -257,53 +257,53 @@ static int ssl_write_client_cipher_list(SSL_HANDSHAKE *hs, CBB *out) { SSL_CIPHER_get_max_version(cipher) < hs->min_version) { continue; } - any_enabled = 1; + any_enabled = true; if (!CBB_add_u16(&child, ssl_cipher_get_value(cipher))) { - return 0; + return false; } } // If all ciphers were disabled, return the error to the caller. if (!any_enabled && hs->max_version < TLS1_3_VERSION) { OPENSSL_PUT_ERROR(SSL, SSL_R_NO_CIPHERS_AVAILABLE); - return 0; + return false; } } if (ssl->mode & SSL_MODE_SEND_FALLBACK_SCSV) { if (!CBB_add_u16(&child, SSL3_CK_FALLBACK_SCSV & 0xffff)) { - return 0; + return false; } } return CBB_flush(out); } -int ssl_write_client_hello(SSL_HANDSHAKE *hs) { +bool ssl_write_client_hello(SSL_HANDSHAKE *hs) { SSL *const ssl = hs->ssl; ScopedCBB cbb; CBB body; if (!ssl->method->init_message(ssl, cbb.get(), &body, SSL3_MT_CLIENT_HELLO)) { - return 0; + return false; } CBB child; if (!CBB_add_u16(&body, hs->client_version) || !CBB_add_bytes(&body, ssl->s3->client_random, SSL3_RANDOM_SIZE) || !CBB_add_u8_length_prefixed(&body, &child)) { - return 0; + return false; } // Do not send a session ID on renegotiation. if (!ssl->s3->initial_handshake_complete && !CBB_add_bytes(&child, hs->session_id, hs->session_id_len)) { - return 0; + return false; } if (SSL_is_dtls(ssl)) { if (!CBB_add_u8_length_prefixed(&body, &child) || !CBB_add_bytes(&child, ssl->d1->cookie, ssl->d1->cookie_len)) { - return 0; + return false; } } @@ -313,19 +313,19 @@ int ssl_write_client_hello(SSL_HANDSHAKE *hs) { !CBB_add_u8(&body, 1 /* one compression method */) || !CBB_add_u8(&body, 0 /* null compression */) || !ssl_add_clienthello_tlsext(hs, &body, header_len + CBB_len(&body))) { - return 0; + return false; } Array msg; if (!ssl->method->finish_message(ssl, cbb.get(), &msg)) { - return 0; + return false; } // Now that the length prefixes have been computed, fill in the placeholder // PSK binder. if (hs->needs_psk_binder && !tls13_write_psk_binder(hs, msg.data(), msg.size())) { - return 0; + return false; } return ssl->method->add_message(ssl, std::move(msg)); diff --git a/ssl/internal.h b/ssl/internal.h index 087f5fbd..28778969 100644 --- a/ssl/internal.h +++ b/ssl/internal.h @@ -1616,29 +1616,29 @@ const char *ssl_server_handshake_state(SSL_HANDSHAKE *hs); const char *tls13_client_handshake_state(SSL_HANDSHAKE *hs); const char *tls13_server_handshake_state(SSL_HANDSHAKE *hs); -// tls13_post_handshake processes a post-handshake message. It returns one on -// success and zero on failure. -int tls13_post_handshake(SSL *ssl, const SSLMessage &msg); +// tls13_post_handshake processes a post-handshake message. It returns true on +// success and false on failure. +bool tls13_post_handshake(SSL *ssl, const SSLMessage &msg); -int tls13_process_certificate(SSL_HANDSHAKE *hs, const SSLMessage &msg, - int allow_anonymous); -int tls13_process_certificate_verify(SSL_HANDSHAKE *hs, const SSLMessage &msg); +bool tls13_process_certificate(SSL_HANDSHAKE *hs, const SSLMessage &msg, + bool allow_anonymous); +bool tls13_process_certificate_verify(SSL_HANDSHAKE *hs, const SSLMessage &msg); // tls13_process_finished processes |msg| as a Finished message from the -// peer. If |use_saved_value| is one, the verify_data is compared against +// peer. If |use_saved_value| is true, the verify_data is compared against // |hs->expected_client_finished| rather than computed fresh. -int tls13_process_finished(SSL_HANDSHAKE *hs, const SSLMessage &msg, - int use_saved_value); +bool tls13_process_finished(SSL_HANDSHAKE *hs, const SSLMessage &msg, + bool use_saved_value); -int tls13_add_certificate(SSL_HANDSHAKE *hs); +bool tls13_add_certificate(SSL_HANDSHAKE *hs); // tls13_add_certificate_verify adds a TLS 1.3 CertificateVerify message to the // handshake. If it returns |ssl_private_key_retry|, it should be called again // to retry when the signing operation is completed. enum ssl_private_key_result_t tls13_add_certificate_verify(SSL_HANDSHAKE *hs); -int tls13_add_finished(SSL_HANDSHAKE *hs); -int tls13_process_new_session_ticket(SSL *ssl, const SSLMessage &msg); +bool tls13_add_finished(SSL_HANDSHAKE *hs); +bool tls13_process_new_session_ticket(SSL *ssl, const SSLMessage &msg); bool ssl_ext_key_share_parse_serverhello(SSL_HANDSHAKE *hs, Array *out_secret, @@ -1660,7 +1660,7 @@ bool ssl_ext_pre_shared_key_add_serverhello(SSL_HANDSHAKE *hs, CBB *out); // returns whether it's valid. bool ssl_is_sct_list_valid(const CBS *contents); -int ssl_write_client_hello(SSL_HANDSHAKE *hs); +bool ssl_write_client_hello(SSL_HANDSHAKE *hs); enum ssl_cert_verify_context_t { ssl_cert_verify_server, diff --git a/ssl/tls13_both.cc b/ssl/tls13_both.cc index a1793da0..faaa88d3 100644 --- a/ssl/tls13_both.cc +++ b/ssl/tls13_both.cc @@ -101,8 +101,8 @@ bool tls13_get_cert_verify_signature_input( return true; } -int tls13_process_certificate(SSL_HANDSHAKE *hs, const SSLMessage &msg, - int allow_anonymous) { +bool tls13_process_certificate(SSL_HANDSHAKE *hs, const SSLMessage &msg, + bool allow_anonymous) { SSL *const ssl = hs->ssl; CBS body = msg.body; bssl::UniquePtr decompressed; @@ -118,7 +118,7 @@ int tls13_process_certificate(SSL_HANDSHAKE *hs, const SSLMessage &msg, CBS_len(&body) != 0) { ssl_send_alert(ssl, SSL3_AL_FATAL, SSL_AD_DECODE_ERROR); OPENSSL_PUT_ERROR(SSL, SSL_R_DECODE_ERROR); - return 0; + return false; } if (uncompressed_len > ssl->max_cert_list) { @@ -126,7 +126,7 @@ int tls13_process_certificate(SSL_HANDSHAKE *hs, const SSLMessage &msg, OPENSSL_PUT_ERROR(SSL, SSL_R_UNCOMPRESSED_CERT_TOO_LARGE); ERR_add_error_dataf("requested=%u", static_cast(uncompressed_len)); - return 0; + return false; } ssl_cert_decompression_func_t decompress = nullptr; @@ -141,7 +141,7 @@ int tls13_process_certificate(SSL_HANDSHAKE *hs, const SSLMessage &msg, ssl_send_alert(ssl, SSL3_AL_FATAL, SSL_AD_ILLEGAL_PARAMETER); OPENSSL_PUT_ERROR(SSL, SSL_R_UNKNOWN_CERT_COMPRESSION_ALG); ERR_add_error_dataf("alg=%d", static_cast(alg_id)); - return 0; + return false; } CRYPTO_BUFFER *decompressed_ptr = nullptr; @@ -150,7 +150,7 @@ int tls13_process_certificate(SSL_HANDSHAKE *hs, const SSLMessage &msg, ssl_send_alert(ssl, SSL3_AL_FATAL, SSL_AD_DECODE_ERROR); OPENSSL_PUT_ERROR(SSL, SSL_R_CERT_DECOMPRESSION_FAILED); ERR_add_error_dataf("alg=%d", static_cast(alg_id)); - return 0; + return false; } decompressed.reset(decompressed_ptr); @@ -161,7 +161,7 @@ int tls13_process_certificate(SSL_HANDSHAKE *hs, const SSLMessage &msg, "alg=%d got=%u expected=%u", static_cast(alg_id), static_cast(CRYPTO_BUFFER_len(decompressed_ptr)), static_cast(uncompressed_len)); - return 0; + return false; } CBS_init(&body, CRYPTO_BUFFER_data(decompressed_ptr), @@ -177,14 +177,14 @@ int tls13_process_certificate(SSL_HANDSHAKE *hs, const SSLMessage &msg, CBS_len(&body) != 0) { ssl_send_alert(ssl, SSL3_AL_FATAL, SSL_AD_DECODE_ERROR); OPENSSL_PUT_ERROR(SSL, SSL_R_DECODE_ERROR); - return 0; + return false; } UniquePtr certs(sk_CRYPTO_BUFFER_new_null()); if (!certs) { ssl_send_alert(ssl, SSL3_AL_FATAL, SSL_AD_INTERNAL_ERROR); OPENSSL_PUT_ERROR(SSL, ERR_R_MALLOC_FAILURE); - return 0; + return false; } const bool retain_sha256 = @@ -197,7 +197,7 @@ int tls13_process_certificate(SSL_HANDSHAKE *hs, const SSLMessage &msg, CBS_len(&certificate) == 0) { ssl_send_alert(ssl, SSL3_AL_FATAL, SSL_AD_DECODE_ERROR); OPENSSL_PUT_ERROR(SSL, SSL_R_CERT_LENGTH_MISMATCH); - return 0; + return false; } if (sk_CRYPTO_BUFFER_num(certs.get()) == 0) { @@ -205,13 +205,13 @@ int tls13_process_certificate(SSL_HANDSHAKE *hs, const SSLMessage &msg, if (!pkey) { ssl_send_alert(ssl, SSL3_AL_FATAL, SSL_AD_DECODE_ERROR); OPENSSL_PUT_ERROR(SSL, SSL_R_DECODE_ERROR); - return 0; + return false; } // TLS 1.3 always uses certificate keys for signing thus the correct // keyUsage is enforced. if (!ssl_cert_check_digital_signature_key_usage(&certificate)) { ssl_send_alert(ssl, SSL3_AL_FATAL, SSL_AD_ILLEGAL_PARAMETER); - return 0; + return false; } if (retain_sha256) { @@ -227,7 +227,7 @@ int tls13_process_certificate(SSL_HANDSHAKE *hs, const SSLMessage &msg, !PushToStack(certs.get(), std::move(buf))) { ssl_send_alert(ssl, SSL3_AL_FATAL, SSL_AD_INTERNAL_ERROR); OPENSSL_PUT_ERROR(SSL, ERR_R_MALLOC_FAILURE); - return 0; + return false; } // Parse out the extensions. @@ -243,7 +243,7 @@ int tls13_process_certificate(SSL_HANDSHAKE *hs, const SSLMessage &msg, OPENSSL_ARRAY_SIZE(ext_types), 0 /* reject unknown */)) { ssl_send_alert(ssl, SSL3_AL_FATAL, alert); - return 0; + return false; } // All Certificate extensions are parsed, but only the leaf extensions are @@ -252,7 +252,7 @@ int tls13_process_certificate(SSL_HANDSHAKE *hs, const SSLMessage &msg, if (ssl->server || !hs->config->ocsp_stapling_enabled) { OPENSSL_PUT_ERROR(SSL, SSL_R_UNEXPECTED_EXTENSION); ssl_send_alert(ssl, SSL3_AL_FATAL, SSL_AD_UNSUPPORTED_EXTENSION); - return 0; + return false; } uint8_t status_type; @@ -263,7 +263,7 @@ int tls13_process_certificate(SSL_HANDSHAKE *hs, const SSLMessage &msg, CBS_len(&ocsp_response) == 0 || CBS_len(&status_request) != 0) { ssl_send_alert(ssl, SSL3_AL_FATAL, SSL_AD_DECODE_ERROR); - return 0; + return false; } if (sk_CRYPTO_BUFFER_num(certs.get()) == 1) { @@ -271,7 +271,7 @@ int tls13_process_certificate(SSL_HANDSHAKE *hs, const SSLMessage &msg, CRYPTO_BUFFER_new_from_CBS(&ocsp_response, ssl->ctx->pool)); if (hs->new_session->ocsp_response == nullptr) { ssl_send_alert(ssl, SSL3_AL_FATAL, SSL_AD_INTERNAL_ERROR); - return 0; + return false; } } } @@ -280,13 +280,13 @@ int tls13_process_certificate(SSL_HANDSHAKE *hs, const SSLMessage &msg, if (ssl->server || !hs->config->signed_cert_timestamps_enabled) { OPENSSL_PUT_ERROR(SSL, SSL_R_UNEXPECTED_EXTENSION); ssl_send_alert(ssl, SSL3_AL_FATAL, SSL_AD_UNSUPPORTED_EXTENSION); - return 0; + return false; } if (!ssl_is_sct_list_valid(&sct)) { OPENSSL_PUT_ERROR(SSL, SSL_R_ERROR_PARSING_EXTENSION); ssl_send_alert(ssl, SSL3_AL_FATAL, SSL_AD_DECODE_ERROR); - return 0; + return false; } if (sk_CRYPTO_BUFFER_num(certs.get()) == 1) { @@ -294,7 +294,7 @@ int tls13_process_certificate(SSL_HANDSHAKE *hs, const SSLMessage &msg, CRYPTO_BUFFER_new_from_CBS(&sct, ssl->ctx->pool)); if (hs->new_session->signed_cert_timestamp_list == nullptr) { ssl_send_alert(ssl, SSL3_AL_FATAL, SSL_AD_INTERNAL_ERROR); - return 0; + return false; } } } @@ -312,14 +312,14 @@ int tls13_process_certificate(SSL_HANDSHAKE *hs, const SSLMessage &msg, if (!ssl->ctx->x509_method->session_cache_objects(hs->new_session.get())) { OPENSSL_PUT_ERROR(SSL, SSL_R_DECODE_ERROR); ssl_send_alert(ssl, SSL3_AL_FATAL, SSL_AD_DECODE_ERROR); - return 0; + return false; } if (sk_CRYPTO_BUFFER_num(hs->new_session->certs.get()) == 0) { if (!allow_anonymous) { OPENSSL_PUT_ERROR(SSL, SSL_R_PEER_DID_NOT_RETURN_A_CERTIFICATE); ssl_send_alert(ssl, SSL3_AL_FATAL, SSL_AD_CERTIFICATE_REQUIRED); - return 0; + return false; } // OpenSSL returns X509_V_OK when no certificates are requested. This is @@ -327,18 +327,18 @@ int tls13_process_certificate(SSL_HANDSHAKE *hs, const SSLMessage &msg, hs->new_session->verify_result = X509_V_OK; // No certificate, so nothing more to do. - return 1; + return true; } hs->new_session->peer_sha256_valid = retain_sha256; - return 1; + return true; } -int tls13_process_certificate_verify(SSL_HANDSHAKE *hs, const SSLMessage &msg) { +bool tls13_process_certificate_verify(SSL_HANDSHAKE *hs, const SSLMessage &msg) { SSL *const ssl = hs->ssl; if (hs->peer_pubkey == NULL) { OPENSSL_PUT_ERROR(SSL, ERR_R_INTERNAL_ERROR); - return 0; + return false; } CBS body = msg.body, signature; @@ -348,13 +348,13 @@ int tls13_process_certificate_verify(SSL_HANDSHAKE *hs, const SSLMessage &msg) { CBS_len(&body) != 0) { OPENSSL_PUT_ERROR(SSL, SSL_R_DECODE_ERROR); ssl_send_alert(ssl, SSL3_AL_FATAL, SSL_AD_DECODE_ERROR); - return 0; + return false; } uint8_t alert = SSL_AD_DECODE_ERROR; if (!tls12_check_peer_sigalg(ssl, &alert, signature_algorithm)) { ssl_send_alert(ssl, SSL3_AL_FATAL, alert); - return 0; + return false; } hs->new_session->peer_signature_algorithm = signature_algorithm; @@ -363,7 +363,7 @@ int tls13_process_certificate_verify(SSL_HANDSHAKE *hs, const SSLMessage &msg) { hs, &input, ssl->server ? ssl_cert_verify_client : ssl_cert_verify_server)) { ssl_send_alert(ssl, SSL3_AL_FATAL, SSL_AD_INTERNAL_ERROR); - return 0; + return false; } bool sig_ok = ssl_public_key_verify(ssl, signature, signature_algorithm, @@ -375,14 +375,14 @@ int tls13_process_certificate_verify(SSL_HANDSHAKE *hs, const SSLMessage &msg) { if (!sig_ok) { OPENSSL_PUT_ERROR(SSL, SSL_R_BAD_SIGNATURE); ssl_send_alert(ssl, SSL3_AL_FATAL, SSL_AD_DECRYPT_ERROR); - return 0; + return false; } - return 1; + return true; } -int tls13_process_finished(SSL_HANDSHAKE *hs, const SSLMessage &msg, - int use_saved_value) { +bool tls13_process_finished(SSL_HANDSHAKE *hs, const SSLMessage &msg, + bool use_saved_value) { SSL *const ssl = hs->ssl; uint8_t verify_data_buf[EVP_MAX_MD_SIZE]; const uint8_t *verify_data; @@ -394,25 +394,25 @@ int tls13_process_finished(SSL_HANDSHAKE *hs, const SSLMessage &msg, } else { if (!tls13_finished_mac(hs, verify_data_buf, &verify_data_len, !ssl->server)) { - return 0; + return false; } verify_data = verify_data_buf; } - int finished_ok = CBS_mem_equal(&msg.body, verify_data, verify_data_len); + bool finished_ok = CBS_mem_equal(&msg.body, verify_data, verify_data_len); #if defined(BORINGSSL_UNSAFE_FUZZER_MODE) - finished_ok = 1; + finished_ok = true; #endif if (!finished_ok) { ssl_send_alert(ssl, SSL3_AL_FATAL, SSL_AD_DECRYPT_ERROR); OPENSSL_PUT_ERROR(SSL, SSL_R_DIGEST_CHECK_FAILED); - return 0; + return false; } - return 1; + return true; } -int tls13_add_certificate(SSL_HANDSHAKE *hs) { +bool tls13_add_certificate(SSL_HANDSHAKE *hs) { SSL *const ssl = hs->ssl; CERT *const cert = hs->config->cert.get(); @@ -435,7 +435,7 @@ int tls13_add_certificate(SSL_HANDSHAKE *hs) { !CBB_add_u8(body, 0) || !CBB_add_u24_length_prefixed(body, &certificate_list)) { OPENSSL_PUT_ERROR(SSL, ERR_R_INTERNAL_ERROR); - return 0; + return false; } if (!ssl_has_certificate(hs->config)) { @@ -449,7 +449,7 @@ int tls13_add_certificate(SSL_HANDSHAKE *hs) { CRYPTO_BUFFER_len(leaf_buf)) || !CBB_add_u16_length_prefixed(&certificate_list, &extensions)) { OPENSSL_PUT_ERROR(SSL, ERR_R_INTERNAL_ERROR); - return 0; + return false; } if (hs->scts_requested && cert->signed_cert_timestamp_list != nullptr) { @@ -462,7 +462,7 @@ int tls13_add_certificate(SSL_HANDSHAKE *hs) { CRYPTO_BUFFER_len(cert->signed_cert_timestamp_list.get())) || !CBB_flush(&extensions)) { OPENSSL_PUT_ERROR(SSL, ERR_R_INTERNAL_ERROR); - return 0; + return false; } } @@ -477,7 +477,7 @@ int tls13_add_certificate(SSL_HANDSHAKE *hs) { CRYPTO_BUFFER_len(cert->ocsp_response.get())) || !CBB_flush(&extensions)) { OPENSSL_PUT_ERROR(SSL, ERR_R_INTERNAL_ERROR); - return 0; + return false; } } @@ -489,7 +489,7 @@ int tls13_add_certificate(SSL_HANDSHAKE *hs) { CRYPTO_BUFFER_len(cert_buf)) || !CBB_add_u16(&certificate_list, 0 /* no extensions */)) { OPENSSL_PUT_ERROR(SSL, ERR_R_INTERNAL_ERROR); - return 0; + return false; } } @@ -500,7 +500,7 @@ int tls13_add_certificate(SSL_HANDSHAKE *hs) { Array msg; if (!CBBFinishArray(cbb.get(), &msg)) { OPENSSL_PUT_ERROR(SSL, ERR_R_INTERNAL_ERROR); - return 0; + return false; } const CertCompressionAlg *alg = nullptr; @@ -513,7 +513,7 @@ int tls13_add_certificate(SSL_HANDSHAKE *hs) { if (alg == nullptr || alg->compress == nullptr) { OPENSSL_PUT_ERROR(SSL, ERR_R_INTERNAL_ERROR); - return 0; + return false; } CBB compressed; @@ -526,10 +526,10 @@ int tls13_add_certificate(SSL_HANDSHAKE *hs) { !alg->compress(ssl, &compressed, msg.data(), msg.size()) || !ssl_add_message_cbb(ssl, cbb.get())) { OPENSSL_PUT_ERROR(SSL, ERR_R_INTERNAL_ERROR); - return 0; + return false; } - return 1; + return true; } enum ssl_private_key_result_t tls13_add_certificate_verify(SSL_HANDSHAKE *hs) { @@ -582,7 +582,7 @@ enum ssl_private_key_result_t tls13_add_certificate_verify(SSL_HANDSHAKE *hs) { return ssl_private_key_success; } -int tls13_add_finished(SSL_HANDSHAKE *hs) { +bool tls13_add_finished(SSL_HANDSHAKE *hs) { SSL *const ssl = hs->ssl; size_t verify_data_len; uint8_t verify_data[EVP_MAX_MD_SIZE]; @@ -590,7 +590,7 @@ int tls13_add_finished(SSL_HANDSHAKE *hs) { if (!tls13_finished_mac(hs, verify_data, &verify_data_len, ssl->server)) { ssl_send_alert(ssl, SSL3_AL_FATAL, SSL_AD_INTERNAL_ERROR); OPENSSL_PUT_ERROR(SSL, SSL_R_DIGEST_CHECK_FAILED); - return 0; + return false; } ScopedCBB cbb; @@ -598,13 +598,13 @@ int tls13_add_finished(SSL_HANDSHAKE *hs) { if (!ssl->method->init_message(ssl, cbb.get(), &body, SSL3_MT_FINISHED) || !CBB_add_bytes(&body, verify_data, verify_data_len) || !ssl_add_message_cbb(ssl, cbb.get())) { - return 0; + return false; } - return 1; + return true; } -static int tls13_receive_key_update(SSL *ssl, const SSLMessage &msg) { +static bool tls13_receive_key_update(SSL *ssl, const SSLMessage &msg) { CBS body = msg.body; uint8_t key_update_request; if (!CBS_get_u8(&body, &key_update_request) || @@ -613,11 +613,11 @@ static int tls13_receive_key_update(SSL *ssl, const SSLMessage &msg) { key_update_request != SSL_KEY_UPDATE_REQUESTED)) { OPENSSL_PUT_ERROR(SSL, SSL_R_DECODE_ERROR); ssl_send_alert(ssl, SSL3_AL_FATAL, SSL_AD_DECODE_ERROR); - return 0; + return false; } if (!tls13_rotate_traffic_key(ssl, evp_aead_open)) { - return 0; + return false; } // Acknowledge the KeyUpdate @@ -630,7 +630,7 @@ static int tls13_receive_key_update(SSL *ssl, const SSLMessage &msg) { !CBB_add_u8(&body_cbb, SSL_KEY_UPDATE_NOT_REQUESTED) || !ssl_add_message_cbb(ssl, cbb.get()) || !tls13_rotate_traffic_key(ssl, evp_aead_seal)) { - return 0; + return false; } // Suppress KeyUpdate acknowledgments until this change is written to the @@ -639,16 +639,16 @@ static int tls13_receive_key_update(SSL *ssl, const SSLMessage &msg) { ssl->s3->key_update_pending = true; } - return 1; + return true; } -int tls13_post_handshake(SSL *ssl, const SSLMessage &msg) { +bool tls13_post_handshake(SSL *ssl, const SSLMessage &msg) { if (msg.type == SSL3_MT_KEY_UPDATE) { ssl->s3->key_update_count++; if (ssl->s3->key_update_count > kMaxKeyUpdates) { OPENSSL_PUT_ERROR(SSL, SSL_R_TOO_MANY_KEY_UPDATES); ssl_send_alert(ssl, SSL3_AL_FATAL, SSL_AD_UNEXPECTED_MESSAGE); - return 0; + return false; } return tls13_receive_key_update(ssl, msg); @@ -662,7 +662,7 @@ int tls13_post_handshake(SSL *ssl, const SSLMessage &msg) { ssl_send_alert(ssl, SSL3_AL_FATAL, SSL_AD_UNEXPECTED_MESSAGE); OPENSSL_PUT_ERROR(SSL, SSL_R_UNEXPECTED_MESSAGE); - return 0; + return false; } } // namespace bssl diff --git a/ssl/tls13_client.cc b/ssl/tls13_client.cc index cf204037..c1befbbe 100644 --- a/ssl/tls13_client.cc +++ b/ssl/tls13_client.cc @@ -552,7 +552,7 @@ static enum ssl_hs_wait_t do_read_server_certificate(SSL_HANDSHAKE *hs) { return ssl_hs_error; } - if (!tls13_process_certificate(hs, msg, 0 /* certificate required */) || + if (!tls13_process_certificate(hs, msg, false /* certificate required */) || !ssl_hash_message(hs, msg)) { return ssl_hs_error; } @@ -612,7 +612,7 @@ static enum ssl_hs_wait_t do_read_server_finished(SSL_HANDSHAKE *hs) { return ssl_hs_read_message; } if (!ssl_check_message_type(ssl, msg, SSL3_MT_FINISHED) || - !tls13_process_finished(hs, msg, 0 /* don't use saved value */) || + !tls13_process_finished(hs, msg, false /* don't use saved value */) || !ssl_hash_message(hs, msg) || // Update the secret to the master secret and derive traffic keys. !tls13_advance_key_schedule(hs, kZeroes, hs->hash_len) || @@ -846,18 +846,18 @@ const char *tls13_client_handshake_state(SSL_HANDSHAKE *hs) { return "TLS 1.3 client unknown"; } -int tls13_process_new_session_ticket(SSL *ssl, const SSLMessage &msg) { +bool tls13_process_new_session_ticket(SSL *ssl, const SSLMessage &msg) { if (ssl->s3->write_shutdown != ssl_shutdown_none) { // Ignore tickets on shutdown. Callers tend to indiscriminately call // |SSL_shutdown| before destroying an |SSL|, at which point calling the new // session callback may be confusing. - return 1; + return true; } UniquePtr session = SSL_SESSION_dup( ssl->s3->established_session.get(), SSL_SESSION_INCLUDE_NONAUTH); if (!session) { - return 0; + return false; } ssl_session_rebase_time(ssl, session.get()); @@ -873,7 +873,7 @@ int tls13_process_new_session_ticket(SSL *ssl, const SSLMessage &msg) { CBS_len(&body) != 0) { ssl_send_alert(ssl, SSL3_AL_FATAL, SSL_AD_DECODE_ERROR); OPENSSL_PUT_ERROR(SSL, SSL_R_DECODE_ERROR); - return 0; + return false; } // Cap the renewable lifetime by the server advertised value. This avoids @@ -883,7 +883,7 @@ int tls13_process_new_session_ticket(SSL *ssl, const SSLMessage &msg) { } if (!tls13_derive_session_psk(session.get(), ticket_nonce)) { - return 0; + return false; } // Parse out the extensions. @@ -898,7 +898,7 @@ int tls13_process_new_session_ticket(SSL *ssl, const SSLMessage &msg) { OPENSSL_ARRAY_SIZE(ext_types), 1 /* ignore unknown */)) { ssl_send_alert(ssl, SSL3_AL_FATAL, alert); - return 0; + return false; } if (have_early_data_info && ssl->enable_early_data) { @@ -906,7 +906,7 @@ int tls13_process_new_session_ticket(SSL *ssl, const SSLMessage &msg) { CBS_len(&early_data_info) != 0) { ssl_send_alert(ssl, SSL3_AL_FATAL, SSL_AD_DECODE_ERROR); OPENSSL_PUT_ERROR(SSL, SSL_R_DECODE_ERROR); - return 0; + return false; } } @@ -920,7 +920,7 @@ int tls13_process_new_session_ticket(SSL *ssl, const SSLMessage &msg) { session.release(); } - return 1; + return true; } } // namespace bssl diff --git a/ssl/tls13_server.cc b/ssl/tls13_server.cc index aba7fc0b..bf3e2cfd 100644 --- a/ssl/tls13_server.cc +++ b/ssl/tls13_server.cc @@ -807,7 +807,7 @@ static enum ssl_hs_wait_t do_read_client_certificate(SSL_HANDSHAKE *hs) { return ssl_hs_ok; } - const int allow_anonymous = + const bool allow_anonymous = (hs->config->verify_mode & SSL_VERIFY_FAIL_IF_NO_PEER_CERT) == 0; SSLMessage msg; if (!ssl->method->get_message(ssl, &msg)) {