openssl.openssl-3.2.patch

diff --git a/include/openssl/ssl.h.in b/include/openssl/ssl.h.in
index 9f91039f8a..81b9c51892 100644
--- a/include/openssl/ssl.h.in
+++ b/include/openssl/ssl.h.in
@@ -1894,6 +1894,7 @@ size_t SSL_client_hello_get0_ciphers(SSL *s, const unsigned char **out);
 size_t SSL_client_hello_get0_compression_methods(SSL *s,
                                                  const unsigned char **out);
 int SSL_client_hello_get1_extensions_present(SSL *s, int **out, size_t *outlen);
+size_t SSL_client_hello_get_ja3_data(SSL *s, unsigned char *data);
 int SSL_client_hello_get_extension_order(SSL *s, uint16_t *exts,
                                          size_t *num_exts);
 int SSL_client_hello_get0_ext(SSL *s, unsigned int type,
diff --git a/include/openssl/tls1.h b/include/openssl/tls1.h
index 5329338efa..9755b5f44c 100644
--- a/include/openssl/tls1.h
+++ b/include/openssl/tls1.h
@@ -142,6 +142,13 @@ extern "C" {
 /* ExtensionType value from RFC7627 */
 # define TLSEXT_TYPE_extended_master_secret      23
 
+/* ExtensionType value from RFC6961 */
+# define TLSEXT_TYPE_status_request_v2           17
+/* ExtensionType value from RFC8449 */
+# define TLSEXT_TYPE_record_size_limit           28
+/* ExtensionType value from RFC7639 */
+# define TLSEXT_TYPE_application_settings        17513
+
 /* ExtensionType value from RFC8879 */
 # define TLSEXT_TYPE_compress_certificate        27
 
diff --git a/ssl/ssl_lib.c b/ssl/ssl_lib.c
index a6695ca4a0..4af995af35 100644
--- a/ssl/ssl_lib.c
+++ b/ssl/ssl_lib.c
@@ -6595,6 +6595,98 @@ int SSL_client_hello_get1_extensions_present(SSL *s, int **out, size_t *outlen)
     return 0;
 }
 
+size_t SSL_client_hello_get_ja3_data(SSL *s, unsigned char *data)
+{
+    RAW_EXTENSION *ext;
+    PACKET *groups = NULL, *formats = NULL;
+    size_t num = 0, i;
+    unsigned char *ptr = data;
+    const SSL_CONNECTION *sc = SSL_CONNECTION_FROM_SSL(s);
+
+    if (sc == NULL)
+        return 0;
+
+    if (sc->clienthello == NULL)
+        return 0;
+
+    if (data == NULL) {
+        num = 8 + PACKET_remaining(&sc->clienthello->ciphersuites);
+        for (i = 0; i < sc->clienthello->pre_proc_exts_len; i++) {
+            ext = sc->clienthello->pre_proc_exts + i;
+            if (ext->present) {
+                if (ext->type== TLSEXT_TYPE_supported_groups)
+                    groups = &ext->data;
+                if (ext->type== TLSEXT_TYPE_ec_point_formats)
+                    formats = &ext->data;
+                num += 2;
+            }
+        }
+        if (groups) {
+            num += PACKET_remaining(groups);
+        }
+        if (formats) {
+            num += PACKET_remaining(formats);
+        }
+        return num;
+    }
+
+    /* version */
+    *(uint16_t*)ptr = (uint16_t)sc->clienthello->legacy_version;
+    ptr += 2;
+
+    /* ciphers */
+    if (num = PACKET_remaining(&sc->clienthello->ciphersuites)) {
+        *(uint16_t*)ptr = (uint16_t)num;
+        ptr += 2;
+        memcpy(ptr, PACKET_data(&sc->clienthello->ciphersuites), num);
+        ptr += num;
+    }
+
+    /* extensions */
+    num = 0;
+    for (i = 0; i < sc->clienthello->pre_proc_exts_len; i++) {
+        ext = sc->clienthello->pre_proc_exts + i;
+        if (ext->present)
+            num++;
+    }
+    *(uint16_t*)ptr = (uint16_t)num*2;
+    ptr += 2;
+    for (i = 0; i < sc->clienthello->pre_proc_exts_len; i++) {
+        ext = sc->clienthello->pre_proc_exts + i;
+        if (ext->present) {
+            if (ext->received_order >= num)
+                break;
+            if (ext->type== TLSEXT_TYPE_supported_groups)
+                groups = &ext->data;
+            if (ext->type== TLSEXT_TYPE_ec_point_formats)
+                formats = &ext->data;
+            ((uint16_t*)(ptr))[ext->received_order] = (uint16_t)ext->type;
+        }
+    }
+    ptr += num*2;
+
+    /* groups */
+    if (groups && (num = PACKET_remaining(groups))) {
+        memcpy(ptr, PACKET_data(groups), num);
+        *(uint16_t*)ptr = (uint16_t)num;
+        ptr += num;
+    } else {
+        *(uint16_t*)ptr = 0;
+        ptr += 2;
+    }
+
+    /* formats */
+    if (formats && (num = PACKET_remaining(formats))) {
+        memcpy(ptr, PACKET_data(formats), num);
+        *ptr = (uint8_t)num;
+        ptr += num;
+    } else {
+        *ptr++ = 0;
+    }
+
+    return ptr - data;
+}
+
 int SSL_client_hello_get_extension_order(SSL *s, uint16_t *exts, size_t *num_exts)
 {
     RAW_EXTENSION *ext;
diff --git a/ssl/ssl_local.h b/ssl/ssl_local.h
index 5f19e679fc..a5241e163d 100644
--- a/ssl/ssl_local.h
+++ b/ssl/ssl_local.h
@@ -708,6 +708,9 @@ typedef enum tlsext_index_en {
     TLSEXT_IDX_compress_certificate,
     TLSEXT_IDX_early_data,
     TLSEXT_IDX_certificate_authorities,
+    TLSEXT_IDX_status_request_v2,
+    TLSEXT_IDX_record_size_limit,
+    TLSEXT_IDX_application_settings,
     TLSEXT_IDX_padding,
     TLSEXT_IDX_psk,
     /* Dummy index - must always be the last entry */
diff --git a/ssl/statem/extensions.c b/ssl/statem/extensions.c
index c35c2ccd33..55c04a9937 100644
--- a/ssl/statem/extensions.c
+++ b/ssl/statem/extensions.c
@@ -411,6 +411,30 @@ static const EXTENSION_DEFINITION ext_defs[] = {
         tls_construct_certificate_authorities,
         tls_construct_certificate_authorities, NULL,
     },
+    {
+        TLSEXT_TYPE_status_request_v2,
+        SSL_EXT_CLIENT_HELLO,
+        NULL,
+        NULL, NULL,
+        NULL,
+        NULL, NULL,
+    },
+    {
+        TLSEXT_TYPE_record_size_limit,
+        SSL_EXT_CLIENT_HELLO,
+        NULL,
+        NULL, NULL,
+        NULL,
+        NULL, NULL,
+    },
+    {
+        TLSEXT_TYPE_application_settings,
+        SSL_EXT_CLIENT_HELLO,
+        NULL,
+        NULL, NULL,
+        NULL,
+        NULL, NULL,
+    },
     {
         /* Must be immediately before pre_shared_key */
         TLSEXT_TYPE_padding,