ssl/t1_lib.c

   1 /* ssl/t1_lib.c */
   2 /* Copyright (C) 1995-1998 Eric Young (eay@cryptsoft.com)
   3  * All rights reserved.
   4  *
   5  * This package is an SSL implementation written
   6  * by Eric Young (eay@cryptsoft.com).
   7  * The implementation was written so as to conform with Netscapes SSL.
   8  *
   9  * This library is free for commercial and non-commercial use as long as
  10  * the following conditions are aheared to.  The following conditions
  11  * apply to all code found in this distribution, be it the RC4, RSA,
  12  * lhash, DES, etc., code; not just the SSL code.  The SSL documentation
  13  * included with this distribution is covered by the same copyright terms
  14  * except that the holder is Tim Hudson (tjh@cryptsoft.com).
  15  *
  16  * Copyright remains Eric Young's, and as such any Copyright notices in
  17  * the code are not to be removed.
  18  * If this package is used in a product, Eric Young should be given attribution
  19  * as the author of the parts of the library used.
  20  * This can be in the form of a textual message at program startup or
  21  * in documentation (online or textual) provided with the package.
  22  *
  23  * Redistribution and use in source and binary forms, with or without
  24  * modification, are permitted provided that the following conditions
  25  * are met:
  26  * 1. Redistributions of source code must retain the copyright
  27  *    notice, this list of conditions and the following disclaimer.
  28  * 2. Redistributions in binary form must reproduce the above copyright
  29  *    notice, this list of conditions and the following disclaimer in the
  30  *    documentation and/or other materials provided with the distribution.
  31  * 3. All advertising materials mentioning features or use of this software
  32  *    must display the following acknowledgement:
  33  *    "This product includes cryptographic software written by
  34  *     Eric Young (eay@cryptsoft.com)"
  35  *    The word 'cryptographic' can be left out if the rouines from the library
  36  *    being used are not cryptographic related :-).
  37  * 4. If you include any Windows specific code (or a derivative thereof) from
  38  *    the apps directory (application code) you must include an acknowledgement:
  39  *    "This product includes software written by Tim Hudson (tjh@cryptsoft.com)"
  40  *
  41  * THIS SOFTWARE IS PROVIDED BY ERIC YOUNG ``AS IS'' AND
  42  * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
  43  * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
  44  * ARE DISCLAIMED.  IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE
  45  * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
  46  * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
  47  * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
  48  * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
  49  * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
  50  * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
  51  * SUCH DAMAGE.
  52  *
  53  * The licence and distribution terms for any publically available version or
  54  * derivative of this code cannot be changed.  i.e. this code cannot simply be
  55  * copied and put under another distribution licence
  56  * [including the GNU Public Licence.]
  57  */
  58 /* ====================================================================
  59  * Copyright (c) 1998-2007 The OpenSSL Project.  All rights reserved.
  60  *
  61  * Redistribution and use in source and binary forms, with or without
  62  * modification, are permitted provided that the following conditions
  63  * are met:
  64  *
  65  * 1. Redistributions of source code must retain the above copyright
  66  *    notice, this list of conditions and the following disclaimer.
  67  *
  68  * 2. Redistributions in binary form must reproduce the above copyright
  69  *    notice, this list of conditions and the following disclaimer in
  70  *    the documentation and/or other materials provided with the
  71  *    distribution.
  72  *
  73  * 3. All advertising materials mentioning features or use of this
  74  *    software must display the following acknowledgment:
  75  *    "This product includes software developed by the OpenSSL Project
  76  *    for use in the OpenSSL Toolkit. (http://www.openssl.org/)"
  77  *
  78  * 4. The names "OpenSSL Toolkit" and "OpenSSL Project" must not be used to
  79  *    endorse or promote products derived from this software without
  80  *    prior written permission. For written permission, please contact
  81  *    openssl-core@openssl.org.
  82  *
  83  * 5. Products derived from this software may not be called "OpenSSL"
  84  *    nor may "OpenSSL" appear in their names without prior written
  85  *    permission of the OpenSSL Project.
  86  *
  87  * 6. Redistributions of any form whatsoever must retain the following
  88  *    acknowledgment:
  89  *    "This product includes software developed by the OpenSSL Project
  90  *    for use in the OpenSSL Toolkit (http://www.openssl.org/)"
  91  *
  92  * THIS SOFTWARE IS PROVIDED BY THE OpenSSL PROJECT ``AS IS'' AND ANY
  93  * EXPRESSED OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
  94  * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
  95  * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL THE OpenSSL PROJECT OR
  96  * ITS CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
  97  * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
  98  * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
  99  * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
 100  * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT,
 101  * STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
 102  * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED
 103  * OF THE POSSIBILITY OF SUCH DAMAGE.
 104  * ====================================================================
 105  *
 106  * This product includes cryptographic software written by Eric Young
 107  * (eay@cryptsoft.com).  This product includes software written by Tim
 108  * Hudson (tjh@cryptsoft.com).
 109  *
 110  */
 111
 112 #include <stdio.h>
 113 #include <openssl/objects.h>
 114 #include <openssl/evp.h>
 115 #include <openssl/hmac.h>
 116 #ifdef OPENSSL_NO_EC2M
 117 #include <openssl/ec.h>
 118 #endif
 119 #include <openssl/ocsp.h>
 120 #include <openssl/rand.h>
 121 #include "ssl_locl.h"
 122
 123 const char tls1_version_str[]="TLSv1" OPENSSL_VERSION_PTEXT;
 124
 125 #ifndef OPENSSL_NO_TLSEXT
 126 static int tls_decrypt_ticket(SSL *s, const unsigned char *tick, int ticklen,
 127                                 const unsigned char *sess_id, int sesslen,
 128                                 SSL_SESSION **psess);
 129 static int ssl_check_clienthello_tlsext_early(SSL *s);
 130 int ssl_check_serverhello_tlsext(SSL *s);
 131 #endif
 132
 133 SSL3_ENC_METHOD TLSv1_enc_data={
 134         tls1_enc,
 135         tls1_mac,
 136         tls1_setup_key_block,
 137         tls1_generate_master_secret,
 138         tls1_change_cipher_state,
 139         tls1_final_finish_mac,
 140         TLS1_FINISH_MAC_LENGTH,
 141         tls1_cert_verify_mac,
 142         TLS_MD_CLIENT_FINISH_CONST,TLS_MD_CLIENT_FINISH_CONST_SIZE,
 143         TLS_MD_SERVER_FINISH_CONST,TLS_MD_SERVER_FINISH_CONST_SIZE,
 144         tls1_alert_code,
 145         tls1_export_keying_material,
 146         0,
 147         SSL3_HM_HEADER_LENGTH,
 148         ssl3_set_handshake_header,
 149         ssl3_handshake_write
 150         };
 151
 152 SSL3_ENC_METHOD TLSv1_1_enc_data={
 153         tls1_enc,
 154         tls1_mac,
 155         tls1_setup_key_block,
 156         tls1_generate_master_secret,
 157         tls1_change_cipher_state,
 158         tls1_final_finish_mac,
 159         TLS1_FINISH_MAC_LENGTH,
 160         tls1_cert_verify_mac,
 161         TLS_MD_CLIENT_FINISH_CONST,TLS_MD_CLIENT_FINISH_CONST_SIZE,
 162         TLS_MD_SERVER_FINISH_CONST,TLS_MD_SERVER_FINISH_CONST_SIZE,
 163         tls1_alert_code,
 164         tls1_export_keying_material,
 165         SSL_ENC_FLAG_EXPLICIT_IV,
 166         SSL3_HM_HEADER_LENGTH,
 167         ssl3_set_handshake_header,
 168         ssl3_handshake_write
 169         };
 170
 171 SSL3_ENC_METHOD TLSv1_2_enc_data={
 172         tls1_enc,
 173         tls1_mac,
 174         tls1_setup_key_block,
 175         tls1_generate_master_secret,
 176         tls1_change_cipher_state,
 177         tls1_final_finish_mac,
 178         TLS1_FINISH_MAC_LENGTH,
 179         tls1_cert_verify_mac,
 180         TLS_MD_CLIENT_FINISH_CONST,TLS_MD_CLIENT_FINISH_CONST_SIZE,
 181         TLS_MD_SERVER_FINISH_CONST,TLS_MD_SERVER_FINISH_CONST_SIZE,
 182         tls1_alert_code,
 183         tls1_export_keying_material,
 184         SSL_ENC_FLAG_EXPLICIT_IV|SSL_ENC_FLAG_SIGALGS|SSL_ENC_FLAG_SHA256_PRF
 185                 |SSL_ENC_FLAG_TLS1_2_CIPHERS,
 186         SSL3_HM_HEADER_LENGTH,
 187         ssl3_set_handshake_header,
 188         ssl3_handshake_write
 189         };
 190
 191 long tls1_default_timeout(void)
 192         {
 193         /* 2 hours, the 24 hours mentioned in the TLSv1 spec
 194          * is way too long for http, the cache would over fill */
 195         return(60*60*2);
 196         }
 197
 198 int tls1_new(SSL *s)
 199         {
 200         if (!ssl3_new(s)) return(0);
 201         s->method->ssl_clear(s);
 202         return(1);
 203         }
 204
 205 void tls1_free(SSL *s)
 206         {
 207 #ifndef OPENSSL_NO_TLSEXT
 208         if (s->tlsext_session_ticket)
 209                 {
 210                 OPENSSL_free(s->tlsext_session_ticket);
 211                 }
 212 #endif /* OPENSSL_NO_TLSEXT */
 213         ssl3_free(s);
 214         }
 215
 216 void tls1_clear(SSL *s)
 217         {
 218         ssl3_clear(s);
 219         s->version = s->method->version;
 220         }
 221
 222 #ifndef OPENSSL_NO_EC
 223
 224 static int nid_list[] =
 225         {
 226                 NID_sect163k1, /* sect163k1 (1) */
 227                 NID_sect163r1, /* sect163r1 (2) */
 228                 NID_sect163r2, /* sect163r2 (3) */
 229                 NID_sect193r1, /* sect193r1 (4) */
 230                 NID_sect193r2, /* sect193r2 (5) */
 231                 NID_sect233k1, /* sect233k1 (6) */
 232                 NID_sect233r1, /* sect233r1 (7) */
 233                 NID_sect239k1, /* sect239k1 (8) */
 234                 NID_sect283k1, /* sect283k1 (9) */
 235                 NID_sect283r1, /* sect283r1 (10) */
 236                 NID_sect409k1, /* sect409k1 (11) */
 237                 NID_sect409r1, /* sect409r1 (12) */
 238                 NID_sect571k1, /* sect571k1 (13) */
 239                 NID_sect571r1, /* sect571r1 (14) */
 240                 NID_secp160k1, /* secp160k1 (15) */
 241                 NID_secp160r1, /* secp160r1 (16) */
 242                 NID_secp160r2, /* secp160r2 (17) */
 243                 NID_secp192k1, /* secp192k1 (18) */
 244                 NID_X9_62_prime192v1, /* secp192r1 (19) */
 245                 NID_secp224k1, /* secp224k1 (20) */
 246                 NID_secp224r1, /* secp224r1 (21) */
 247                 NID_secp256k1, /* secp256k1 (22) */
 248                 NID_X9_62_prime256v1, /* secp256r1 (23) */
 249                 NID_secp384r1, /* secp384r1 (24) */
 250                 NID_secp521r1,  /* secp521r1 (25) */
 251                 NID_brainpoolP256r1,  /* brainpoolP256r1 (26) */
 252                 NID_brainpoolP384r1,  /* brainpoolP384r1 (27) */
 253                 NID_brainpoolP512r1  /* brainpool512r1 (28) */
 254         };
 255
 256
 257 static const unsigned char ecformats_default[] =
 258         {
 259         TLSEXT_ECPOINTFORMAT_uncompressed,
 260         TLSEXT_ECPOINTFORMAT_ansiX962_compressed_prime,
 261         TLSEXT_ECPOINTFORMAT_ansiX962_compressed_char2
 262         };
 263
 264 static const unsigned char eccurves_default[] =
 265         {
 266 #ifndef OPENSSL_NO_EC2M
 267                 0,14, /* sect571r1 (14) */
 268                 0,13, /* sect571k1 (13) */
 269 #endif
 270                 0,25, /* secp521r1 (25) */
 271                 0,28, /* brainpool512r1 (28) */
 272 #ifndef OPENSSL_NO_EC2M
 273                 0,11, /* sect409k1 (11) */
 274                 0,12, /* sect409r1 (12) */
 275 #endif
 276                 0,27, /* brainpoolP384r1 (27) */
 277                 0,24, /* secp384r1 (24) */
 278 #ifndef OPENSSL_NO_EC2M
 279                 0,9,  /* sect283k1 (9) */
 280                 0,10, /* sect283r1 (10) */
 281 #endif
 282                 0,26, /* brainpoolP256r1 (26) */
 283                 0,22, /* secp256k1 (22) */
 284                 0,23, /* secp256r1 (23) */
 285 #ifndef OPENSSL_NO_EC2M
 286                 0,8,  /* sect239k1 (8) */
 287                 0,6,  /* sect233k1 (6) */
 288                 0,7,  /* sect233r1 (7) */
 289 #endif
 290                 0,20, /* secp224k1 (20) */
 291                 0,21, /* secp224r1 (21) */
 292 #ifndef OPENSSL_NO_EC2M
 293                 0,4,  /* sect193r1 (4) */
 294                 0,5,  /* sect193r2 (5) */
 295 #endif
 296                 0,18, /* secp192k1 (18) */
 297                 0,19, /* secp192r1 (19) */
 298 #ifndef OPENSSL_NO_EC2M
 299                 0,1,  /* sect163k1 (1) */
 300                 0,2,  /* sect163r1 (2) */
 301                 0,3,  /* sect163r2 (3) */
 302 #endif
 303                 0,15, /* secp160k1 (15) */
 304                 0,16, /* secp160r1 (16) */
 305                 0,17, /* secp160r2 (17) */
 306         };
 307
 308 static const unsigned char suiteb_curves[] =
 309         {
 310                 0, TLSEXT_curve_P_256,
 311                 0, TLSEXT_curve_P_384
 312         };
 313
 314 #ifdef OPENSSL_FIPS
 315 /* Brainpool not allowed in FIPS mode */
 316 static const unsigned char fips_curves_default[] =
 317         {
 318 #ifndef OPENSSL_NO_EC2M
 319                 0,14, /* sect571r1 (14) */
 320                 0,13, /* sect571k1 (13) */
 321 #endif
 322                 0,25, /* secp521r1 (25) */
 323 #ifndef OPENSSL_NO_EC2M
 324                 0,11, /* sect409k1 (11) */
 325                 0,12, /* sect409r1 (12) */
 326 #endif
 327                 0,24, /* secp384r1 (24) */
 328 #ifndef OPENSSL_NO_EC2M
 329                 0,9,  /* sect283k1 (9) */
 330                 0,10, /* sect283r1 (10) */
 331 #endif
 332                 0,22, /* secp256k1 (22) */
 333                 0,23, /* secp256r1 (23) */
 334 #ifndef OPENSSL_NO_EC2M
 335                 0,8,  /* sect239k1 (8) */
 336                 0,6,  /* sect233k1 (6) */
 337                 0,7,  /* sect233r1 (7) */
 338 #endif
 339                 0,20, /* secp224k1 (20) */
 340                 0,21, /* secp224r1 (21) */
 341 #ifndef OPENSSL_NO_EC2M
 342                 0,4,  /* sect193r1 (4) */
 343                 0,5,  /* sect193r2 (5) */
 344 #endif
 345                 0,18, /* secp192k1 (18) */
 346                 0,19, /* secp192r1 (19) */
 347 #ifndef OPENSSL_NO_EC2M
 348                 0,1,  /* sect163k1 (1) */
 349                 0,2,  /* sect163r1 (2) */
 350                 0,3,  /* sect163r2 (3) */
 351 #endif
 352                 0,15, /* secp160k1 (15) */
 353                 0,16, /* secp160r1 (16) */
 354                 0,17, /* secp160r2 (17) */
 355         };
 356 #endif
 357
 358 int tls1_ec_curve_id2nid(int curve_id)
 359         {
 360         /* ECC curves from RFC 4492 and RFC 7027 */
 361         if ((curve_id < 1) || ((unsigned int)curve_id >
 362                                 sizeof(nid_list)/sizeof(nid_list[0])))
 363                 return 0;
 364         return nid_list[curve_id-1];
 365         }
 366
 367 int tls1_ec_nid2curve_id(int nid)
 368         {
 369         /* ECC curves from RFC 4492 and RFC 7027 */
 370         switch (nid)
 371                 {
 372         case NID_sect163k1: /* sect163k1 (1) */
 373                 return 1;
 374         case NID_sect163r1: /* sect163r1 (2) */
 375                 return 2;
 376         case NID_sect163r2: /* sect163r2 (3) */
 377                 return 3;
 378         case NID_sect193r1: /* sect193r1 (4) */
 379                 return 4;
 380         case NID_sect193r2: /* sect193r2 (5) */
 381                 return 5;
 382         case NID_sect233k1: /* sect233k1 (6) */
 383                 return 6;
 384         case NID_sect233r1: /* sect233r1 (7) */
 385                 return 7;
 386         case NID_sect239k1: /* sect239k1 (8) */
 387                 return 8;
 388         case NID_sect283k1: /* sect283k1 (9) */
 389                 return 9;
 390         case NID_sect283r1: /* sect283r1 (10) */
 391                 return 10;
 392         case NID_sect409k1: /* sect409k1 (11) */
 393                 return 11;
 394         case NID_sect409r1: /* sect409r1 (12) */
 395                 return 12;
 396         case NID_sect571k1: /* sect571k1 (13) */
 397                 return 13;
 398         case NID_sect571r1: /* sect571r1 (14) */
 399                 return 14;
 400         case NID_secp160k1: /* secp160k1 (15) */
 401                 return 15;
 402         case NID_secp160r1: /* secp160r1 (16) */
 403                 return 16;
 404         case NID_secp160r2: /* secp160r2 (17) */
 405                 return 17;
 406         case NID_secp192k1: /* secp192k1 (18) */
 407                 return 18;
 408         case NID_X9_62_prime192v1: /* secp192r1 (19) */
 409                 return 19;
 410         case NID_secp224k1: /* secp224k1 (20) */
 411                 return 20;
 412         case NID_secp224r1: /* secp224r1 (21) */
 413                 return 21;
 414         case NID_secp256k1: /* secp256k1 (22) */
 415                 return 22;
 416         case NID_X9_62_prime256v1: /* secp256r1 (23) */
 417                 return 23;
 418         case NID_secp384r1: /* secp384r1 (24) */
 419                 return 24;
 420         case NID_secp521r1:  /* secp521r1 (25) */
 421                 return 25;
 422         case NID_brainpoolP256r1:  /* brainpoolP256r1 (26) */
 423                 return 26;
 424         case NID_brainpoolP384r1:  /* brainpoolP384r1 (27) */
 425                 return 27;
 426         case NID_brainpoolP512r1:  /* brainpool512r1 (28) */
 427                 return 28;
 428         default:
 429                 return 0;
 430                 }
 431         }
 432 /*
 433  * Get curves list, if "sess" is set return client curves otherwise
 434  * preferred list.
 435  * Sets |num_curves| to the number of curves in the list, i.e.,
 436  * the length of |pcurves| is 2 * num_curves.
 437  * Returns 1 on success and 0 if the client curves list has invalid format.
 438  * The latter indicates an internal error: we should not be accepting such
 439  * lists in the first place.
 440  * TODO(emilia): we should really be storing the curves list in explicitly
 441  * parsed form instead. (However, this would affect binary compatibility
 442  * so cannot happen in the 1.0.x series.)
 443  */
 444 static int tls1_get_curvelist(SSL *s, int sess,
 445                                         const unsigned char **pcurves,
 446                                         size_t *num_curves)
 447         {
 448         size_t pcurveslen = 0;
 449         if (sess)
 450                 {
 451                 *pcurves = s->session->tlsext_ellipticcurvelist;
 452                 pcurveslen = s->session->tlsext_ellipticcurvelist_length;
 453                 }
 454         else
 455                 {
 456                 /* For Suite B mode only include P-256, P-384 */
 457                 switch (tls1_suiteb(s))
 458                         {
 459                 case SSL_CERT_FLAG_SUITEB_128_LOS:
 460                         *pcurves = suiteb_curves;
 461                         pcurveslen = sizeof(suiteb_curves);
 462                         break;
 463
 464                 case SSL_CERT_FLAG_SUITEB_128_LOS_ONLY:
 465                         *pcurves = suiteb_curves;
 466                         pcurveslen = 2;
 467                         break;
 468
 469                 case SSL_CERT_FLAG_SUITEB_192_LOS:
 470                         *pcurves = suiteb_curves + 2;
 471                         pcurveslen = 2;
 472                         break;
 473                 default:
 474                         *pcurves = s->tlsext_ellipticcurvelist;
 475                         pcurveslen = s->tlsext_ellipticcurvelist_length;
 476                         }
 477                 if (!*pcurves)
 478                         {
 479 #ifdef OPENSSL_FIPS
 480                         if (FIPS_mode())
 481                                 {
 482                                 *pcurves = fips_curves_default;
 483                                 *pcurveslen = sizeof(fips_curves_default);
 484                                 }
 485                         else
 486 #endif
 487                                 {
 488                                 *pcurves = eccurves_default;
 489                                 pcurveslen = sizeof(eccurves_default);
 490                                 }
 491                         }
 492                 }
 493         /* We do not allow odd length arrays to enter the system. */
 494         if (pcurveslen & 1)
 495                 {
 496                 SSLerr(SSL_F_TLS1_GET_CURVELIST, ERR_R_INTERNAL_ERROR);
 497                 *num_curves = 0;
 498                 return 0;
 499                 }
 500         else
 501                 {
 502                 *num_curves = pcurveslen / 2;
 503                 return 1;
 504                 }
 505         }
 506 /* Check a curve is one of our preferences */
 507 int tls1_check_curve(SSL *s, const unsigned char *p, size_t len)
 508         {
 509         const unsigned char *curves;
 510         size_t num_curves, i;
 511         unsigned int suiteb_flags = tls1_suiteb(s);
 512         if (len != 3 || p[0] != NAMED_CURVE_TYPE)
 513                 return 0;
 514         /* Check curve matches Suite B preferences */
 515         if (suiteb_flags)
 516                 {
 517                 unsigned long cid = s->s3->tmp.new_cipher->id;
 518                 if (p[1])
 519                         return 0;
 520                 if (cid == TLS1_CK_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256)
 521                         {
 522                         if (p[2] != TLSEXT_curve_P_256)
 523                                 return 0;
 524                         }
 525                 else if (cid == TLS1_CK_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384)
 526                         {
 527                         if (p[2] != TLSEXT_curve_P_384)
 528                                 return 0;
 529                         }
 530                 else    /* Should never happen */
 531                         return 0;
 532                 }
 533         if (!tls1_get_curvelist(s, 0, &curves, &num_curves))
 534                 return 0;
 535         for (i = 0; i < num_curves; i++, curves += 2)
 536                 {
 537                 if (p[1] == curves[0] && p[2] == curves[1])
 538                         return 1;
 539                 }
 540         return 0;
 541         }
 542
 543 /*-
 544  * Return |nmatch|th shared curve or NID_undef if there is no match.
 545  * For nmatch == -1, return number of  matches
 546  * For nmatch == -2, return the NID of the curve to use for
 547  * an EC tmp key, or NID_undef if there is no match.
 548  */
 549 int tls1_shared_curve(SSL *s, int nmatch)
 550         {
 551         const unsigned char *pref, *supp;
 552         size_t num_pref, num_supp, i, j;
 553         int k;
 554         /* Can't do anything on client side */
 555         if (s->server == 0)
 556                 return -1;
 557         if (nmatch == -2)
 558                 {
 559                 if (tls1_suiteb(s))
 560                         {
 561                         /* For Suite B ciphersuite determines curve: we
 562                          * already know these are acceptable due to previous
 563                          * checks.
 564                          */
 565                         unsigned long cid = s->s3->tmp.new_cipher->id;
 566                         if (cid == TLS1_CK_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256)
 567                                 return NID_X9_62_prime256v1; /* P-256 */
 568                         if (cid == TLS1_CK_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384)
 569                                 return NID_secp384r1; /* P-384 */
 570                         /* Should never happen */
 571                         return NID_undef;
 572                         }
 573                 /* If not Suite B just return first preference shared curve */
 574                 nmatch = 0;
 575                 }
 576         /*
 577          * Avoid truncation. tls1_get_curvelist takes an int
 578          * but s->options is a long...
 579          */
 580         if (!tls1_get_curvelist(s, (s->options & SSL_OP_CIPHER_SERVER_PREFERENCE) != 0,
 581                         &supp, &num_supp))
 582                 /* In practice, NID_undef == 0 but let's be precise. */
 583                 return nmatch == -1 ? 0 : NID_undef;
 584         if(!tls1_get_curvelist(s, !(s->options & SSL_OP_CIPHER_SERVER_PREFERENCE),
 585                         &pref, &num_pref))
 586                 return nmatch == -1 ? 0 : NID_undef;
 587         k = 0;
 588         for (i = 0; i < num_pref; i++, pref+=2)
 589                 {
 590                 const unsigned char *tsupp = supp;
 591                 for (j = 0; j < num_supp; j++, tsupp+=2)
 592                         {
 593                         if (pref[0] == tsupp[0] && pref[1] == tsupp[1])
 594                                 {
 595                                 if (nmatch == k)
 596                                         {
 597                                         int id = (pref[0] << 8) | pref[1];
 598                                         return tls1_ec_curve_id2nid(id);
 599                                         }
 600                                 k++;
 601                                 }
 602                         }
 603                 }
 604         if (nmatch == -1)
 605                 return k;
 606         /* Out of range (nmatch > k). */
 607         return NID_undef;
 608         }
 609
 610 int tls1_set_curves(unsigned char **pext, size_t *pextlen,
 611                         int *curves, size_t ncurves)
 612         {
 613         unsigned char *clist, *p;
 614         size_t i;
 615         /* Bitmap of curves included to detect duplicates: only works
 616          * while curve ids < 32
 617          */
 618         unsigned long dup_list = 0;
 619 #ifdef OPENSSL_NO_EC2M
 620         EC_GROUP *curve;
 621 #endif
 622
 623         clist = OPENSSL_malloc(ncurves * 2);
 624         if (!clist)
 625                 return 0;
 626         for (i = 0, p = clist; i < ncurves; i++)
 627                 {
 628                 unsigned long idmask;
 629                 int id;
 630                 id = tls1_ec_nid2curve_id(curves[i]);
 631 #ifdef OPENSSL_FIPS
 632                 /* NB: 25 is last curve ID supported by FIPS module */
 633                 if (FIPS_mode() && id > 25)
 634                         {
 635                         OPENSSL_free(clist);
 636                         return 0;
 637                         }
 638 #endif
 639 #ifdef OPENSSL_NO_EC2M
 640                 curve = EC_GROUP_new_by_curve_name(curves[i]);
 641                 if(!curve ||
 642                         EC_METHOD_get_field_type(EC_GROUP_method_of(curve))
 643                                 == NID_X9_62_characteristic_two_field)
 644                         {
 645                                 if(curve) EC_GROUP_free(curve);
 646                                 OPENSSL_free(clist);
 647                                 return 0;
 648                         }
 649                 else
 650                         EC_GROUP_free(curve);
 651 #endif
 652                 idmask = 1L << id;
 653                 if (!id || (dup_list & idmask))
 654                         {
 655                         OPENSSL_free(clist);
 656                         return 0;
 657                         }
 658                 dup_list |= idmask;
 659                 s2n(id, p);
 660                 }
 661         if (*pext)
 662                 OPENSSL_free(*pext);
 663         *pext = clist;
 664         *pextlen = ncurves * 2;
 665         return 1;
 666         }
 667
 668 #define MAX_CURVELIST   28
 669
 670 typedef struct
 671         {
 672         size_t nidcnt;
 673         int nid_arr[MAX_CURVELIST];
 674         } nid_cb_st;
 675
 676 static int nid_cb(const char *elem, int len, void *arg)
 677         {
 678         nid_cb_st *narg = arg;
 679         size_t i;
 680         int nid;
 681         char etmp[20];
 682         if (narg->nidcnt == MAX_CURVELIST)
 683                 return 0;
 684         if (len > (int)(sizeof(etmp) - 1))
 685                 return 0;
 686         memcpy(etmp, elem, len);
 687         etmp[len] = 0;
 688         nid = EC_curve_nist2nid(etmp);
 689         if (nid == NID_undef)
 690                 nid = OBJ_sn2nid(etmp);
 691         if (nid == NID_undef)
 692                 nid = OBJ_ln2nid(etmp);
 693         if (nid == NID_undef)
 694                 return 0;
 695         for (i = 0; i < narg->nidcnt; i++)
 696                 if (narg->nid_arr[i] == nid)
 697                         return 0;
 698         narg->nid_arr[narg->nidcnt++] = nid;
 699         return 1;
 700         }
 701 /* Set curves based on a colon separate list */
 702 int tls1_set_curves_list(unsigned char **pext, size_t *pextlen,
 703                                 const char *str)
 704         {
 705         nid_cb_st ncb;
 706         ncb.nidcnt = 0;
 707         if (!CONF_parse_list(str, ':', 1, nid_cb, &ncb))
 708                 return 0;
 709         if (pext == NULL)
 710                 return 1;
 711         return tls1_set_curves(pext, pextlen, ncb.nid_arr, ncb.nidcnt);
 712         }
 713 /* For an EC key set TLS id and required compression based on parameters */
 714 static int tls1_set_ec_id(unsigned char *curve_id, unsigned char *comp_id,
 715                                 EC_KEY *ec)
 716         {
 717         int is_prime, id;
 718         const EC_GROUP *grp;
 719         const EC_METHOD *meth;
 720         if (!ec)
 721                 return 0;
 722         /* Determine if it is a prime field */
 723         grp = EC_KEY_get0_group(ec);
 724         if (!grp)
 725                 return 0;
 726         meth = EC_GROUP_method_of(grp);
 727         if (!meth)
 728                 return 0;
 729         if (EC_METHOD_get_field_type(meth) == NID_X9_62_prime_field)
 730                 is_prime = 1;
 731         else
 732                 is_prime = 0;
 733         /* Determine curve ID */
 734         id = EC_GROUP_get_curve_name(grp);
 735         id = tls1_ec_nid2curve_id(id);
 736         /* If we have an ID set it, otherwise set arbitrary explicit curve */
 737         if (id)
 738                 {
 739                 curve_id[0] = 0;
 740                 curve_id[1] = (unsigned char)id;
 741                 }
 742         else
 743                 {
 744                 curve_id[0] = 0xff;
 745                 if (is_prime)
 746                         curve_id[1] = 0x01;
 747                 else
 748                         curve_id[1] = 0x02;
 749                 }
 750         if (comp_id)
 751                 {
 752                 if (EC_KEY_get0_public_key(ec) == NULL)
 753                         return 0;
 754                 if (EC_KEY_get_conv_form(ec) == POINT_CONVERSION_COMPRESSED)
 755                         {
 756                         if (is_prime)
 757                                 *comp_id = TLSEXT_ECPOINTFORMAT_ansiX962_compressed_prime;
 758                         else
 759                                 *comp_id = TLSEXT_ECPOINTFORMAT_ansiX962_compressed_char2;
 760                         }
 761                 else
 762                         *comp_id = TLSEXT_ECPOINTFORMAT_uncompressed;
 763                 }
 764         return 1;
 765         }
 766 /* Check an EC key is compatible with extensions */
 767 static int tls1_check_ec_key(SSL *s,
 768                         unsigned char *curve_id, unsigned char *comp_id)
 769         {
 770         const unsigned char *pformats, *pcurves;
 771         size_t num_formats, num_curves, i;
 772         int j;
 773         /* If point formats extension present check it, otherwise everything
 774          * is supported (see RFC4492).
 775          */
 776         if (comp_id && s->session->tlsext_ecpointformatlist)
 777                 {
 778                 pformats = s->session->tlsext_ecpointformatlist;
 779                 num_formats = s->session->tlsext_ecpointformatlist_length;
 780                 for (i = 0; i < num_formats; i++, pformats++)
 781                         {
 782                         if (*comp_id == *pformats)
 783                                 break;
 784                         }
 785                 if (i == num_formats)
 786                         return 0;
 787                 }
 788         if (!curve_id)
 789                 return 1;
 790         /* Check curve is consistent with client and server preferences */
 791         for (j = 0; j <= 1; j++)
 792                 {
 793                 if (!tls1_get_curvelist(s, j, &pcurves, &num_curves))
 794                         return 0;
 795                 for (i = 0; i < num_curves; i++, pcurves += 2)
 796                         {
 797                         if (pcurves[0] == curve_id[0] &&
 798                             pcurves[1] == curve_id[1])
 799                                 break;
 800                         }
 801                 if (i == num_curves)
 802                         return 0;
 803                 /* For clients can only check sent curve list */
 804                 if (!s->server)
 805                         return 1;
 806                 }
 807         return 1;
 808         }
 809
 810 static void tls1_get_formatlist(SSL *s, const unsigned char **pformats,
 811                                         size_t *num_formats)
 812         {
 813         /* If we have a custom point format list use it otherwise
 814          * use default */
 815         if (s->tlsext_ecpointformatlist)
 816                 {
 817                 *pformats = s->tlsext_ecpointformatlist;
 818                 *num_formats = s->tlsext_ecpointformatlist_length;
 819                 }
 820         else
 821                 {
 822                 *pformats = ecformats_default;
 823                 /* For Suite B we don't support char2 fields */
 824                 if (tls1_suiteb(s))
 825                         *num_formats = sizeof(ecformats_default) - 1;
 826                 else
 827                         *num_formats = sizeof(ecformats_default);
 828                 }
 829         }
 830
 831 /* Check cert parameters compatible with extensions: currently just checks
 832  * EC certificates have compatible curves and compression.
 833  */
 834 static int tls1_check_cert_param(SSL *s, X509 *x, int set_ee_md)
 835         {
 836         unsigned char comp_id, curve_id[2];
 837         EVP_PKEY *pkey;
 838         int rv;
 839         pkey = X509_get_pubkey(x);
 840         if (!pkey)
 841                 return 0;
 842         /* If not EC nothing to do */
 843         if (pkey->type != EVP_PKEY_EC)
 844                 {
 845                 EVP_PKEY_free(pkey);
 846                 return 1;
 847                 }
 848         rv = tls1_set_ec_id(curve_id, &comp_id, pkey->pkey.ec);
 849         EVP_PKEY_free(pkey);
 850         if (!rv)
 851                 return 0;
 852         /* Can't check curve_id for client certs as we don't have a
 853          * supported curves extension.
 854          */
 855         rv = tls1_check_ec_key(s, s->server ? curve_id : NULL, &comp_id);
 856         if (!rv)
 857                 return 0;
 858         /* Special case for suite B. We *MUST* sign using SHA256+P-256 or
 859          * SHA384+P-384, adjust digest if necessary.
 860          */
 861         if (set_ee_md && tls1_suiteb(s))
 862                 {
 863                 int check_md;
 864                 size_t i;
 865                 CERT *c = s->cert;
 866                 if (curve_id[0])
 867                         return 0;
 868                 /* Check to see we have necessary signing algorithm */
 869                 if (curve_id[1] == TLSEXT_curve_P_256)
 870                         check_md = NID_ecdsa_with_SHA256;
 871                 else if (curve_id[1] == TLSEXT_curve_P_384)
 872                         check_md = NID_ecdsa_with_SHA384;
 873                 else
 874                         return 0; /* Should never happen */
 875                 for (i = 0; i < c->shared_sigalgslen; i++)
 876                         if (check_md == c->shared_sigalgs[i].signandhash_nid)
 877                                 break;
 878                 if (i == c->shared_sigalgslen)
 879                         return 0;
 880                 if (set_ee_md == 2)
 881                         {
 882                         if (check_md == NID_ecdsa_with_SHA256)
 883                                 c->pkeys[SSL_PKEY_ECC].digest = EVP_sha256();
 884                         else
 885                                 c->pkeys[SSL_PKEY_ECC].digest = EVP_sha384();
 886                         }
 887                 }
 888         return rv;
 889         }
 890 #ifndef OPENSSL_NO_ECDH
 891 /* Check EC temporary key is compatible with client extensions */
 892 int tls1_check_ec_tmp_key(SSL *s, unsigned long cid)
 893         {
 894         unsigned char curve_id[2];
 895         EC_KEY *ec = s->cert->ecdh_tmp;
 896 #ifdef OPENSSL_SSL_DEBUG_BROKEN_PROTOCOL
 897         /* Allow any curve: not just those peer supports */
 898         if (s->cert->cert_flags & SSL_CERT_FLAG_BROKEN_PROTOCOL)
 899                 return 1;
 900 #endif
 901         /* If Suite B, AES128 MUST use P-256 and AES256 MUST use P-384,
 902          * no other curves permitted.
 903          */
 904         if (tls1_suiteb(s))
 905                 {
 906                 /* Curve to check determined by ciphersuite */
 907                 if (cid == TLS1_CK_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256)
 908                         curve_id[1] = TLSEXT_curve_P_256;
 909                 else if (cid == TLS1_CK_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384)
 910                         curve_id[1] = TLSEXT_curve_P_384;
 911                 else
 912                         return 0;
 913                 curve_id[0] = 0;
 914                 /* Check this curve is acceptable */
 915                 if (!tls1_check_ec_key(s, curve_id, NULL))
 916                         return 0;
 917                 /* If auto or setting curve from callback assume OK */
 918                 if (s->cert->ecdh_tmp_auto || s->cert->ecdh_tmp_cb)
 919                         return 1;
 920                 /* Otherwise check curve is acceptable */
 921                 else
 922                         {
 923                         unsigned char curve_tmp[2];
 924                         if (!ec)
 925                                 return 0;
 926                         if (!tls1_set_ec_id(curve_tmp, NULL, ec))
 927                                 return 0;
 928                         if (!curve_tmp[0] || curve_tmp[1] == curve_id[1])
 929                                 return 1;
 930                         return 0;
 931                         }
 932
 933                 }
 934         if (s->cert->ecdh_tmp_auto)
 935                 {
 936                 /* Need a shared curve */
 937                 if (tls1_shared_curve(s, 0))
 938                         return 1;
 939                 else return 0;
 940                 }
 941         if (!ec)
 942                 {
 943                 if (s->cert->ecdh_tmp_cb)
 944                         return 1;
 945                 else
 946                         return 0;
 947                 }
 948         if (!tls1_set_ec_id(curve_id, NULL, ec))
 949                 return 0;
 950 /* Set this to allow use of invalid curves for testing */
 951 #if 0
 952         return 1;
 953 #else
 954         return tls1_check_ec_key(s, curve_id, NULL);
 955 #endif
 956         }
 957 #endif /* OPENSSL_NO_ECDH */
 958
 959 #else
 960
 961 static int tls1_check_cert_param(SSL *s, X509 *x, int set_ee_md)
 962         {
 963         return 1;
 964         }
 965
 966 #endif /* OPENSSL_NO_EC */
 967
 968 #ifndef OPENSSL_NO_TLSEXT
 969
 970 /* List of supported signature algorithms and hashes. Should make this
 971  * customisable at some point, for now include everything we support.
 972  */
 973
 974 #ifdef OPENSSL_NO_RSA
 975 #define tlsext_sigalg_rsa(md) /* */
 976 #else
 977 #define tlsext_sigalg_rsa(md) md, TLSEXT_signature_rsa,
 978 #endif
 979
 980 #ifdef OPENSSL_NO_DSA
 981 #define tlsext_sigalg_dsa(md) /* */
 982 #else
 983 #define tlsext_sigalg_dsa(md) md, TLSEXT_signature_dsa,
 984 #endif
 985
 986 #ifdef OPENSSL_NO_ECDSA
 987 #define tlsext_sigalg_ecdsa(md) /* */
 988 #else
 989 #define tlsext_sigalg_ecdsa(md) md, TLSEXT_signature_ecdsa,
 990 #endif
 991
 992 #define tlsext_sigalg(md) \
 993                 tlsext_sigalg_rsa(md) \
 994                 tlsext_sigalg_dsa(md) \
 995                 tlsext_sigalg_ecdsa(md)
 996
 997 static unsigned char tls12_sigalgs[] = {
 998 #ifndef OPENSSL_NO_SHA512
 999         tlsext_sigalg(TLSEXT_hash_sha512)
1000         tlsext_sigalg(TLSEXT_hash_sha384)
1001 #endif
1002 #ifndef OPENSSL_NO_SHA256
1003         tlsext_sigalg(TLSEXT_hash_sha256)
1004         tlsext_sigalg(TLSEXT_hash_sha224)
1005 #endif
1006 #ifndef OPENSSL_NO_SHA
1007         tlsext_sigalg(TLSEXT_hash_sha1)
1008 #endif
1009 };
1010 #ifndef OPENSSL_NO_ECDSA
1011 static unsigned char suiteb_sigalgs[] = {
1012         tlsext_sigalg_ecdsa(TLSEXT_hash_sha256)
1013         tlsext_sigalg_ecdsa(TLSEXT_hash_sha384)
1014 };
1015 #endif
1016 size_t tls12_get_psigalgs(SSL *s, const unsigned char **psigs)
1017         {
1018         /* If Suite B mode use Suite B sigalgs only, ignore any other
1019          * preferences.
1020          */
1021 #ifndef OPENSSL_NO_EC
1022         switch (tls1_suiteb(s))
1023                 {
1024         case SSL_CERT_FLAG_SUITEB_128_LOS:
1025                 *psigs = suiteb_sigalgs;
1026                 return sizeof(suiteb_sigalgs);
1027
1028         case SSL_CERT_FLAG_SUITEB_128_LOS_ONLY:
1029                 *psigs = suiteb_sigalgs;
1030                 return 2;
1031
1032         case SSL_CERT_FLAG_SUITEB_192_LOS:
1033                 *psigs = suiteb_sigalgs + 2;
1034                 return 2;
1035                 }
1036 #endif
1037         /* If server use client authentication sigalgs if not NULL */
1038         if (s->server && s->cert->client_sigalgs)
1039                 {
1040                 *psigs = s->cert->client_sigalgs;
1041                 return s->cert->client_sigalgslen;
1042                 }
1043         else if (s->cert->conf_sigalgs)
1044                 {
1045                 *psigs = s->cert->conf_sigalgs;
1046                 return s->cert->conf_sigalgslen;
1047                 }
1048         else
1049                 {
1050                 *psigs = tls12_sigalgs;
1051                 return sizeof(tls12_sigalgs);
1052                 }
1053         }
1054 /* Check signature algorithm is consistent with sent supported signature
1055  * algorithms and if so return relevant digest.
1056  */
1057 int tls12_check_peer_sigalg(const EVP_MD **pmd, SSL *s,
1058                                 const unsigned char *sig, EVP_PKEY *pkey)
1059         {
1060         const unsigned char *sent_sigs;
1061         size_t sent_sigslen, i;
1062         int sigalg = tls12_get_sigid(pkey);
1063         /* Should never happen */
1064         if (sigalg == -1)
1065                 return -1;
1066         /* Check key type is consistent with signature */
1067         if (sigalg != (int)sig[1])
1068                 {
1069                 SSLerr(SSL_F_TLS12_CHECK_PEER_SIGALG,SSL_R_WRONG_SIGNATURE_TYPE);
1070                 return 0;
1071                 }
1072 #ifndef OPENSSL_NO_EC
1073         if (pkey->type == EVP_PKEY_EC)
1074                 {
1075                 unsigned char curve_id[2], comp_id;
1076                 /* Check compression and curve matches extensions */
1077                 if (!tls1_set_ec_id(curve_id, &comp_id, pkey->pkey.ec))
1078                         return 0;
1079                 if (!s->server && !tls1_check_ec_key(s, curve_id, &comp_id))
1080                         {
1081                         SSLerr(SSL_F_TLS12_CHECK_PEER_SIGALG,SSL_R_WRONG_CURVE);
1082                         return 0;
1083                         }
1084                 /* If Suite B only P-384+SHA384 or P-256+SHA-256 allowed */
1085                 if (tls1_suiteb(s))
1086                         {
1087                         if (curve_id[0])
1088                                 return 0;
1089                         if (curve_id[1] == TLSEXT_curve_P_256)
1090                                 {
1091                                 if (sig[0] != TLSEXT_hash_sha256)
1092                                         {
1093                                         SSLerr(SSL_F_TLS12_CHECK_PEER_SIGALG,
1094                                                 SSL_R_ILLEGAL_SUITEB_DIGEST);
1095                                         return 0;
1096                                         }
1097                                 }
1098                         else if (curve_id[1] == TLSEXT_curve_P_384)
1099                                 {
1100                                 if (sig[0] != TLSEXT_hash_sha384)
1101                                         {
1102                                         SSLerr(SSL_F_TLS12_CHECK_PEER_SIGALG,
1103                                                 SSL_R_ILLEGAL_SUITEB_DIGEST);
1104                                         return 0;
1105                                         }
1106                                 }
1107                         else
1108                                 return 0;
1109                         }
1110                 }
1111         else if (tls1_suiteb(s))
1112                 return 0;
1113 #endif
1114
1115         /* Check signature matches a type we sent */
1116         sent_sigslen = tls12_get_psigalgs(s, &sent_sigs);
1117         for (i = 0; i < sent_sigslen; i+=2, sent_sigs+=2)
1118                 {
1119                 if (sig[0] == sent_sigs[0] && sig[1] == sent_sigs[1])
1120                         break;
1121                 }
1122         /* Allow fallback to SHA1 if not strict mode */
1123         if (i == sent_sigslen && (sig[0] != TLSEXT_hash_sha1 || s->cert->cert_flags & SSL_CERT_FLAGS_CHECK_TLS_STRICT))
1124                 {
1125                 SSLerr(SSL_F_TLS12_CHECK_PEER_SIGALG,SSL_R_WRONG_SIGNATURE_TYPE);
1126                 return 0;
1127                 }
1128         *pmd = tls12_get_hash(sig[0]);
1129         if (*pmd == NULL)
1130                 {
1131                 SSLerr(SSL_F_TLS12_CHECK_PEER_SIGALG,SSL_R_UNKNOWN_DIGEST);
1132                 return 0;
1133                 }
1134         /* Store the digest used so applications can retrieve it if they
1135          * wish.
1136          */
1137         if (s->session && s->session->sess_cert)
1138                 s->session->sess_cert->peer_key->digest = *pmd;
1139         return 1;
1140         }
1141 /* Get a mask of disabled algorithms: an algorithm is disabled
1142  * if it isn't supported or doesn't appear in supported signature
1143  * algorithms. Unlike ssl_cipher_get_disabled this applies to a specific
1144  * session and not global settings.
1145  *
1146  */
1147 void ssl_set_client_disabled(SSL *s)
1148         {
1149         CERT *c = s->cert;
1150         const unsigned char *sigalgs;
1151         size_t i, sigalgslen;
1152         int have_rsa = 0, have_dsa = 0, have_ecdsa = 0;
1153         c->mask_a = 0;
1154         c->mask_k = 0;
1155         /* Don't allow TLS 1.2 only ciphers if we don't suppport them */
1156         if (!SSL_CLIENT_USE_TLS1_2_CIPHERS(s))
1157                 c->mask_ssl = SSL_TLSV1_2;
1158         else
1159                 c->mask_ssl = 0;
1160         /* Now go through all signature algorithms seeing if we support
1161          * any for RSA, DSA, ECDSA. Do this for all versions not just
1162          * TLS 1.2.
1163          */
1164         sigalgslen = tls12_get_psigalgs(s, &sigalgs);
1165         for (i = 0; i < sigalgslen; i += 2, sigalgs += 2)
1166                 {
1167                 switch(sigalgs[1])
1168                         {
1169 #ifndef OPENSSL_NO_RSA
1170                 case TLSEXT_signature_rsa:
1171                         have_rsa = 1;
1172                         break;
1173 #endif
1174 #ifndef OPENSSL_NO_DSA
1175                 case TLSEXT_signature_dsa:
1176                         have_dsa = 1;
1177                         break;
1178 #endif
1179 #ifndef OPENSSL_NO_ECDSA
1180                 case TLSEXT_signature_ecdsa:
1181                         have_ecdsa = 1;
1182                         break;
1183 #endif
1184                         }
1185                 }
1186         /* Disable auth and static DH if we don't include any appropriate
1187          * signature algorithms.
1188          */
1189         if (!have_rsa)
1190                 {
1191                 c->mask_a |= SSL_aRSA;
1192                 c->mask_k |= SSL_kDHr|SSL_kECDHr;
1193                 }
1194         if (!have_dsa)
1195                 {
1196                 c->mask_a |= SSL_aDSS;
1197                 c->mask_k |= SSL_kDHd;
1198                 }
1199         if (!have_ecdsa)
1200                 {
1201                 c->mask_a |= SSL_aECDSA;
1202                 c->mask_k |= SSL_kECDHe;
1203                 }
1204 #ifndef OPENSSL_NO_KRB5
1205         if (!kssl_tgt_is_available(s->kssl_ctx))
1206                 {
1207                 c->mask_a |= SSL_aKRB5;
1208                 c->mask_k |= SSL_kKRB5;
1209                 }
1210 #endif
1211 #ifndef OPENSSL_NO_PSK
1212         /* with PSK there must be client callback set */
1213         if (!s->psk_client_callback)
1214                 {
1215                 c->mask_a |= SSL_aPSK;
1216                 c->mask_k |= SSL_kPSK;
1217                 }
1218 #endif /* OPENSSL_NO_PSK */
1219 #ifndef OPENSSL_NO_SRP
1220         if (!(s->srp_ctx.srp_Mask & SSL_kSRP))
1221                 {
1222                 c->mask_a |= SSL_aSRP;
1223                 c->mask_k |= SSL_kSRP;
1224                 }
1225 #endif
1226         c->valid = 1;
1227         }
1228
1229 unsigned char *ssl_add_clienthello_tlsext(SSL *s, unsigned char *buf, unsigned char *limit, int *al)
1230         {
1231         int extdatalen=0;
1232         unsigned char *orig = buf;
1233         unsigned char *ret = buf;
1234 #ifndef OPENSSL_NO_EC
1235         /* See if we support any ECC ciphersuites */
1236         int using_ecc = 0;
1237         if (s->version >= TLS1_VERSION || SSL_IS_DTLS(s))
1238                 {
1239                 int i;
1240                 unsigned long alg_k, alg_a;
1241                 STACK_OF(SSL_CIPHER) *cipher_stack = SSL_get_ciphers(s);
1242
1243                 for (i = 0; i < sk_SSL_CIPHER_num(cipher_stack); i++)
1244                         {
1245                         SSL_CIPHER *c = sk_SSL_CIPHER_value(cipher_stack, i);
1246
1247                         alg_k = c->algorithm_mkey;
1248                         alg_a = c->algorithm_auth;
1249                         if ((alg_k & (SSL_kEECDH|SSL_kECDHr|SSL_kECDHe)
1250                                 || (alg_a & SSL_aECDSA)))
1251                                 {
1252                                 using_ecc = 1;
1253                                 break;
1254                                 }
1255                         }
1256                 }
1257 #endif
1258
1259         /* don't add extensions for SSLv3 unless doing secure renegotiation */
1260         if (s->client_version == SSL3_VERSION
1261                                         && !s->s3->send_connection_binding)
1262                 return orig;
1263
1264         ret+=2;
1265
1266         if (ret>=limit) return NULL; /* this really never occurs, but ... */
1267
1268         if (s->tlsext_hostname != NULL)
1269                 {
1270                 /* Add TLS extension servername to the Client Hello message */
1271                 unsigned long size_str;
1272                 long lenmax;
1273
1274                 /*-
1275                  * check for enough space.
1276                  * 4 for the servername type and entension length
1277                  * 2 for servernamelist length
1278                  * 1 for the hostname type
1279                  * 2 for hostname length
1280                  * + hostname length
1281                  */
1282
1283                 if ((lenmax = limit - ret - 9) < 0
1284                     || (size_str = strlen(s->tlsext_hostname)) > (unsigned long)lenmax)
1285                         return NULL;
1286
1287                 /* extension type and length */
1288                 s2n(TLSEXT_TYPE_server_name,ret);
1289                 s2n(size_str+5,ret);
1290
1291                 /* length of servername list */
1292                 s2n(size_str+3,ret);
1293
1294                 /* hostname type, length and hostname */
1295                 *(ret++) = (unsigned char) TLSEXT_NAMETYPE_host_name;
1296                 s2n(size_str,ret);
1297                 memcpy(ret, s->tlsext_hostname, size_str);
1298                 ret+=size_str;
1299                 }
1300
1301         /* Add RI if renegotiating */
1302         if (s->renegotiate)
1303           {
1304           int el;
1305
1306           if(!ssl_add_clienthello_renegotiate_ext(s, 0, &el, 0))
1307               {
1308               SSLerr(SSL_F_SSL_ADD_CLIENTHELLO_TLSEXT, ERR_R_INTERNAL_ERROR);
1309               return NULL;
1310               }
1311
1312           if((limit - ret - 4 - el) < 0) return NULL;
1313
1314           s2n(TLSEXT_TYPE_renegotiate,ret);
1315           s2n(el,ret);
1316
1317           if(!ssl_add_clienthello_renegotiate_ext(s, ret, &el, el))
1318               {
1319               SSLerr(SSL_F_SSL_ADD_CLIENTHELLO_TLSEXT, ERR_R_INTERNAL_ERROR);
1320               return NULL;
1321               }
1322
1323           ret += el;
1324         }
1325
1326 #ifndef OPENSSL_NO_SRP
1327         /* Add SRP username if there is one */
1328         if (s->srp_ctx.login != NULL)
1329                 { /* Add TLS extension SRP username to the Client Hello message */
1330
1331                 int login_len = strlen(s->srp_ctx.login);
1332                 if (login_len > 255 || login_len == 0)
1333                         {
1334                         SSLerr(SSL_F_SSL_ADD_CLIENTHELLO_TLSEXT, ERR_R_INTERNAL_ERROR);
1335                         return NULL;
1336                         }
1337
1338                 /*-
1339                  * check for enough space.
1340                  * 4 for the srp type type and entension length
1341                  * 1 for the srp user identity
1342                  * + srp user identity length
1343                  */
1344                 if ((limit - ret - 5 - login_len) < 0) return NULL;
1345
1346                 /* fill in the extension */
1347                 s2n(TLSEXT_TYPE_srp,ret);
1348                 s2n(login_len+1,ret);
1349                 (*ret++) = (unsigned char) login_len;
1350                 memcpy(ret, s->srp_ctx.login, login_len);
1351                 ret+=login_len;
1352                 }
1353 #endif
1354
1355 #ifndef OPENSSL_NO_EC
1356         if (using_ecc)
1357                 {
1358                 /* Add TLS extension ECPointFormats to the ClientHello message */
1359                 long lenmax;
1360                 const unsigned char *pcurves, *pformats;
1361                 size_t num_curves, num_formats, curves_list_len;
1362
1363                 tls1_get_formatlist(s, &pformats, &num_formats);
1364
1365                 if ((lenmax = limit - ret - 5) < 0) return NULL;
1366                 if (num_formats > (size_t)lenmax) return NULL;
1367                 if (num_formats > 255)
1368                         {
1369                         SSLerr(SSL_F_SSL_ADD_CLIENTHELLO_TLSEXT, ERR_R_INTERNAL_ERROR);
1370                         return NULL;
1371                         }
1372
1373                 s2n(TLSEXT_TYPE_ec_point_formats,ret);
1374                 /* The point format list has 1-byte length. */
1375                 s2n(num_formats + 1,ret);
1376                 *(ret++) = (unsigned char)num_formats ;
1377                 memcpy(ret, pformats, num_formats);
1378                 ret+=num_formats;
1379
1380                 /* Add TLS extension EllipticCurves to the ClientHello message */
1381                 pcurves = s->tlsext_ellipticcurvelist;
1382                 if (!tls1_get_curvelist(s, 0, &pcurves, &num_curves))
1383                         return NULL;
1384
1385                 if ((lenmax = limit - ret - 6) < 0) return NULL;
1386                 if (num_curves > (size_t)lenmax / 2) return NULL;
1387                 if (num_curves > 65532 / 2)
1388                         {
1389                         SSLerr(SSL_F_SSL_ADD_CLIENTHELLO_TLSEXT, ERR_R_INTERNAL_ERROR);
1390                         return NULL;
1391                         }
1392                 curves_list_len = 2*num_curves;
1393                 s2n(TLSEXT_TYPE_elliptic_curves,ret);
1394                 s2n(curves_list_len + 2, ret);
1395                 s2n(curves_list_len, ret);
1396                 memcpy(ret, pcurves, curves_list_len);
1397                 ret+=curves_list_len;
1398                 }
1399 #endif /* OPENSSL_NO_EC */
1400
1401         if (!(SSL_get_options(s) & SSL_OP_NO_TICKET))
1402                 {
1403                 int ticklen;
1404                 if (!s->new_session && s->session && s->session->tlsext_tick)
1405                         ticklen = s->session->tlsext_ticklen;
1406                 else if (s->session && s->tlsext_session_ticket &&
1407                          s->tlsext_session_ticket->data)
1408                         {
1409                         ticklen = s->tlsext_session_ticket->length;
1410                         s->session->tlsext_tick = OPENSSL_malloc(ticklen);
1411                         if (!s->session->tlsext_tick)
1412                                 return NULL;
1413                         memcpy(s->session->tlsext_tick,
1414                                s->tlsext_session_ticket->data,
1415                                ticklen);
1416                         s->session->tlsext_ticklen = ticklen;
1417                         }
1418                 else
1419                         ticklen = 0;
1420                 if (ticklen == 0 && s->tlsext_session_ticket &&
1421                     s->tlsext_session_ticket->data == NULL)
1422                         goto skip_ext;
1423                 /* Check for enough room 2 for extension type, 2 for len
1424                  * rest for ticket
1425                  */
1426                 if ((long)(limit - ret - 4 - ticklen) < 0) return NULL;
1427                 s2n(TLSEXT_TYPE_session_ticket,ret);
1428                 s2n(ticklen,ret);
1429                 if (ticklen)
1430                         {
1431                         memcpy(ret, s->session->tlsext_tick, ticklen);
1432                         ret += ticklen;
1433                         }
1434                 }
1435                 skip_ext:
1436
1437         if (SSL_USE_SIGALGS(s))
1438                 {
1439                 size_t salglen;
1440                 const unsigned char *salg;
1441                 salglen = tls12_get_psigalgs(s, &salg);
1442                 if ((size_t)(limit - ret) < salglen + 6)
1443                         return NULL;
1444                 s2n(TLSEXT_TYPE_signature_algorithms,ret);
1445                 s2n(salglen + 2, ret);
1446                 s2n(salglen, ret);
1447                 memcpy(ret, salg, salglen);
1448                 ret += salglen;
1449                 }
1450
1451 #ifdef TLSEXT_TYPE_opaque_prf_input
1452         if (s->s3->client_opaque_prf_input != NULL)
1453                 {
1454                 size_t col = s->s3->client_opaque_prf_input_len;
1455
1456                 if ((long)(limit - ret - 6 - col < 0))
1457                         return NULL;
1458                 if (col > 0xFFFD) /* can't happen */
1459                         return NULL;
1460
1461                 s2n(TLSEXT_TYPE_opaque_prf_input, ret);
1462                 s2n(col + 2, ret);
1463                 s2n(col, ret);
1464                 memcpy(ret, s->s3->client_opaque_prf_input, col);
1465                 ret += col;
1466                 }
1467 #endif
1468
1469         if (s->tlsext_status_type == TLSEXT_STATUSTYPE_ocsp)
1470                 {
1471                 int i;
1472                 long extlen, idlen, itmp;
1473                 OCSP_RESPID *id;
1474
1475                 idlen = 0;
1476                 for (i = 0; i < sk_OCSP_RESPID_num(s->tlsext_ocsp_ids); i++)
1477                         {
1478                         id = sk_OCSP_RESPID_value(s->tlsext_ocsp_ids, i);
1479                         itmp = i2d_OCSP_RESPID(id, NULL);
1480                         if (itmp <= 0)
1481                                 return NULL;
1482                         idlen += itmp + 2;
1483                         }
1484
1485                 if (s->tlsext_ocsp_exts)
1486                         {
1487                         extlen = i2d_X509_EXTENSIONS(s->tlsext_ocsp_exts, NULL);
1488                         if (extlen < 0)
1489                                 return NULL;
1490                         }
1491                 else
1492                         extlen = 0;
1493
1494                 if ((long)(limit - ret - 7 - extlen - idlen) < 0) return NULL;
1495                 s2n(TLSEXT_TYPE_status_request, ret);
1496                 if (extlen + idlen > 0xFFF0)
1497                         return NULL;
1498                 s2n(extlen + idlen + 5, ret);
1499                 *(ret++) = TLSEXT_STATUSTYPE_ocsp;
1500                 s2n(idlen, ret);
1501                 for (i = 0; i < sk_OCSP_RESPID_num(s->tlsext_ocsp_ids); i++)
1502                         {
1503                         /* save position of id len */
1504                         unsigned char *q = ret;
1505                         id = sk_OCSP_RESPID_value(s->tlsext_ocsp_ids, i);
1506                         /* skip over id len */
1507                         ret += 2;
1508                         itmp = i2d_OCSP_RESPID(id, &ret);
1509                         /* write id len */
1510                         s2n(itmp, q);
1511                         }
1512                 s2n(extlen, ret);
1513                 if (extlen > 0)
1514                         i2d_X509_EXTENSIONS(s->tlsext_ocsp_exts, &ret);
1515                 }
1516
1517 #ifndef OPENSSL_NO_HEARTBEATS
1518         /* Add Heartbeat extension */
1519         if ((limit - ret - 4 - 1) < 0)
1520                 return NULL;
1521         s2n(TLSEXT_TYPE_heartbeat,ret);
1522         s2n(1,ret);
1523         /*-
1524          * Set mode:
1525          * 1: peer may send requests
1526          * 2: peer not allowed to send requests
1527          */
1528         if (s->tlsext_heartbeat & SSL_TLSEXT_HB_DONT_RECV_REQUESTS)
1529                 *(ret++) = SSL_TLSEXT_HB_DONT_SEND_REQUESTS;
1530         else
1531                 *(ret++) = SSL_TLSEXT_HB_ENABLED;
1532 #endif
1533
1534 #ifndef OPENSSL_NO_NEXTPROTONEG
1535         if (s->ctx->next_proto_select_cb && !s->s3->tmp.finish_md_len)
1536                 {
1537                 /* The client advertises an emtpy extension to indicate its
1538                  * support for Next Protocol Negotiation */
1539                 if (limit - ret - 4 < 0)
1540                         return NULL;
1541                 s2n(TLSEXT_TYPE_next_proto_neg,ret);
1542                 s2n(0,ret);
1543                 }
1544 #endif
1545
1546         if (s->alpn_client_proto_list && !s->s3->tmp.finish_md_len)
1547                 {
1548                 if ((size_t)(limit - ret) < 6 + s->alpn_client_proto_list_len)
1549                         return NULL;
1550                 s2n(TLSEXT_TYPE_application_layer_protocol_negotiation,ret);
1551                 s2n(2 + s->alpn_client_proto_list_len,ret);
1552                 s2n(s->alpn_client_proto_list_len,ret);
1553                 memcpy(ret, s->alpn_client_proto_list,
1554                        s->alpn_client_proto_list_len);
1555                 ret += s->alpn_client_proto_list_len;
1556                 }
1557
1558 #ifndef OPENSSL_NO_SRTP
1559         if(SSL_IS_DTLS(s) && SSL_get_srtp_profiles(s))
1560                 {
1561                 int el;
1562
1563                 ssl_add_clienthello_use_srtp_ext(s, 0, &el, 0);
1564
1565                 if((limit - ret - 4 - el) < 0) return NULL;
1566
1567                 s2n(TLSEXT_TYPE_use_srtp,ret);
1568                 s2n(el,ret);
1569
1570                 if(ssl_add_clienthello_use_srtp_ext(s, ret, &el, el))
1571                         {
1572                         SSLerr(SSL_F_SSL_ADD_CLIENTHELLO_TLSEXT, ERR_R_INTERNAL_ERROR);
1573                         return NULL;
1574                         }
1575                 ret += el;
1576                 }
1577 #endif
1578         custom_ext_init(&s->cert->cli_ext);
1579         /* Add custom TLS Extensions to ClientHello */
1580         if (!custom_ext_add(s, 0, &ret, limit, al))
1581                 return NULL;
1582
1583         /* Add padding to workaround bugs in F5 terminators.
1584          * See https://tools.ietf.org/html/draft-agl-tls-padding-03
1585          *
1586          * NB: because this code works out the length of all existing
1587          * extensions it MUST always appear last.
1588          */
1589         if (s->options & SSL_OP_TLSEXT_PADDING)
1590                 {
1591                 int hlen = ret - (unsigned char *)s->init_buf->data;
1592                 /* The code in s23_clnt.c to build ClientHello messages
1593                  * includes the 5-byte record header in the buffer, while
1594                  * the code in s3_clnt.c does not.
1595                  */
1596                 if (s->state == SSL23_ST_CW_CLNT_HELLO_A)
1597                         hlen -= 5;
1598                 if (hlen > 0xff && hlen < 0x200)
1599                         {
1600                         hlen = 0x200 - hlen;
1601                         if (hlen >= 4)
1602                                 hlen -= 4;
1603                         else
1604                                 hlen = 0;
1605
1606                         s2n(TLSEXT_TYPE_padding, ret);
1607                         s2n(hlen, ret);
1608                         memset(ret, 0, hlen);
1609                         ret += hlen;
1610                         }
1611                 }
1612
1613         if ((extdatalen = ret-orig-2)== 0)
1614                 return orig;
1615
1616         s2n(extdatalen, orig);
1617         return ret;
1618         }
1619
1620 unsigned char *ssl_add_serverhello_tlsext(SSL *s, unsigned char *buf, unsigned char *limit, int *al)
1621         {
1622         int extdatalen=0;
1623         unsigned char *orig = buf;
1624         unsigned char *ret = buf;
1625 #ifndef OPENSSL_NO_NEXTPROTONEG
1626         int next_proto_neg_seen;
1627 #endif
1628 #ifndef OPENSSL_NO_EC
1629         unsigned long alg_k = s->s3->tmp.new_cipher->algorithm_mkey;
1630         unsigned long alg_a = s->s3->tmp.new_cipher->algorithm_auth;
1631         int using_ecc = (alg_k & (SSL_kEECDH|SSL_kECDHr|SSL_kECDHe)) || (alg_a & SSL_aECDSA);
1632         using_ecc = using_ecc && (s->session->tlsext_ecpointformatlist != NULL);
1633 #endif
1634         /* don't add extensions for SSLv3, unless doing secure renegotiation */
1635         if (s->version == SSL3_VERSION && !s->s3->send_connection_binding)
1636                 return orig;
1637
1638         ret+=2;
1639         if (ret>=limit) return NULL; /* this really never occurs, but ... */
1640
1641         if (!s->hit && s->servername_done == 1 && s->session->tlsext_hostname != NULL)
1642                 {
1643                 if ((long)(limit - ret - 4) < 0) return NULL;
1644
1645                 s2n(TLSEXT_TYPE_server_name,ret);
1646                 s2n(0,ret);
1647                 }
1648
1649         if(s->s3->send_connection_binding)
1650         {
1651           int el;
1652
1653           if(!ssl_add_serverhello_renegotiate_ext(s, 0, &el, 0))
1654               {
1655               SSLerr(SSL_F_SSL_ADD_SERVERHELLO_TLSEXT, ERR_R_INTERNAL_ERROR);
1656               return NULL;
1657               }
1658
1659           if((limit - ret - 4 - el) < 0) return NULL;
1660
1661           s2n(TLSEXT_TYPE_renegotiate,ret);
1662           s2n(el,ret);
1663
1664           if(!ssl_add_serverhello_renegotiate_ext(s, ret, &el, el))
1665               {
1666               SSLerr(SSL_F_SSL_ADD_SERVERHELLO_TLSEXT, ERR_R_INTERNAL_ERROR);
1667               return NULL;
1668               }
1669
1670           ret += el;
1671         }
1672
1673 #ifndef OPENSSL_NO_EC
1674         if (using_ecc)
1675                 {
1676                 const unsigned char *plist;
1677                 size_t plistlen;
1678                 /* Add TLS extension ECPointFormats to the ServerHello message */
1679                 long lenmax;
1680
1681                 tls1_get_formatlist(s, &plist, &plistlen);
1682
1683                 if ((lenmax = limit - ret - 5) < 0) return NULL;
1684                 if (plistlen > (size_t)lenmax) return NULL;
1685                 if (plistlen > 255)
1686                         {
1687                         SSLerr(SSL_F_SSL_ADD_SERVERHELLO_TLSEXT, ERR_R_INTERNAL_ERROR);
1688                         return NULL;
1689                         }
1690
1691                 s2n(TLSEXT_TYPE_ec_point_formats,ret);
1692                 s2n(plistlen + 1,ret);
1693                 *(ret++) = (unsigned char) plistlen;
1694                 memcpy(ret, plist, plistlen);
1695                 ret+=plistlen;
1696
1697                 }
1698         /* Currently the server should not respond with a SupportedCurves extension */
1699 #endif /* OPENSSL_NO_EC */
1700
1701         if (s->tlsext_ticket_expected
1702                 && !(SSL_get_options(s) & SSL_OP_NO_TICKET))
1703                 {
1704                 if ((long)(limit - ret - 4) < 0) return NULL;
1705                 s2n(TLSEXT_TYPE_session_ticket,ret);
1706                 s2n(0,ret);
1707                 }
1708
1709         if (s->tlsext_status_expected)
1710                 {
1711                 if ((long)(limit - ret - 4) < 0) return NULL;
1712                 s2n(TLSEXT_TYPE_status_request,ret);
1713                 s2n(0,ret);
1714                 }
1715
1716 #ifdef TLSEXT_TYPE_opaque_prf_input
1717         if (s->s3->server_opaque_prf_input != NULL)
1718                 {
1719                 size_t sol = s->s3->server_opaque_prf_input_len;
1720
1721                 if ((long)(limit - ret - 6 - sol) < 0)
1722                         return NULL;
1723                 if (sol > 0xFFFD) /* can't happen */
1724                         return NULL;
1725
1726                 s2n(TLSEXT_TYPE_opaque_prf_input, ret);
1727                 s2n(sol + 2, ret);
1728                 s2n(sol, ret);
1729                 memcpy(ret, s->s3->server_opaque_prf_input, sol);
1730                 ret += sol;
1731                 }
1732 #endif
1733
1734 #ifndef OPENSSL_NO_SRTP
1735         if(SSL_IS_DTLS(s) && s->srtp_profile)
1736                 {
1737                 int el;
1738
1739                 ssl_add_serverhello_use_srtp_ext(s, 0, &el, 0);
1740
1741                 if((limit - ret - 4 - el) < 0) return NULL;
1742
1743                 s2n(TLSEXT_TYPE_use_srtp,ret);
1744                 s2n(el,ret);
1745
1746                 if(ssl_add_serverhello_use_srtp_ext(s, ret, &el, el))
1747                         {
1748                         SSLerr(SSL_F_SSL_ADD_SERVERHELLO_TLSEXT, ERR_R_INTERNAL_ERROR);
1749                         return NULL;
1750                         }
1751                 ret+=el;
1752                 }
1753 #endif
1754
1755         if (((s->s3->tmp.new_cipher->id & 0xFFFF)==0x80 || (s->s3->tmp.new_cipher->id & 0xFFFF)==0x81)
1756                 && (SSL_get_options(s) & SSL_OP_CRYPTOPRO_TLSEXT_BUG))
1757                 { const unsigned char cryptopro_ext[36] = {
1758                         0xfd, 0xe8, /*65000*/
1759                         0x00, 0x20, /*32 bytes length*/
1760                         0x30, 0x1e, 0x30, 0x08, 0x06, 0x06, 0x2a, 0x85,
1761                         0x03,   0x02, 0x02, 0x09, 0x30, 0x08, 0x06, 0x06,
1762                         0x2a, 0x85, 0x03, 0x02, 0x02, 0x16, 0x30, 0x08,
1763                         0x06, 0x06, 0x2a, 0x85, 0x03, 0x02, 0x02, 0x17};
1764                         if (limit-ret<36) return NULL;
1765                         memcpy(ret,cryptopro_ext,36);
1766                         ret+=36;
1767
1768                 }
1769
1770 #ifndef OPENSSL_NO_HEARTBEATS
1771         /* Add Heartbeat extension if we've received one */
1772         if (s->tlsext_heartbeat & SSL_TLSEXT_HB_ENABLED)
1773                 {
1774                 if ((limit - ret - 4 - 1) < 0)
1775                         return NULL;
1776                 s2n(TLSEXT_TYPE_heartbeat,ret);
1777                 s2n(1,ret);
1778                 /*-
1779                  * Set mode:
1780                  * 1: peer may send requests
1781                  * 2: peer not allowed to send requests
1782                  */
1783                 if (s->tlsext_heartbeat & SSL_TLSEXT_HB_DONT_RECV_REQUESTS)
1784                         *(ret++) = SSL_TLSEXT_HB_DONT_SEND_REQUESTS;
1785                 else
1786                         *(ret++) = SSL_TLSEXT_HB_ENABLED;
1787
1788                 }
1789 #endif
1790
1791 #ifndef OPENSSL_NO_NEXTPROTONEG
1792         next_proto_neg_seen = s->s3->next_proto_neg_seen;
1793         s->s3->next_proto_neg_seen = 0;
1794         if (next_proto_neg_seen && s->ctx->next_protos_advertised_cb)
1795                 {
1796                 const unsigned char *npa;
1797                 unsigned int npalen;
1798                 int r;
1799
1800                 r = s->ctx->next_protos_advertised_cb(s, &npa, &npalen, s->ctx->next_protos_advertised_cb_arg);
1801                 if (r == SSL_TLSEXT_ERR_OK)
1802                         {
1803                         if ((long)(limit - ret - 4 - npalen) < 0) return NULL;
1804                         s2n(TLSEXT_TYPE_next_proto_neg,ret);
1805                         s2n(npalen,ret);
1806                         memcpy(ret, npa, npalen);
1807                         ret += npalen;
1808                         s->s3->next_proto_neg_seen = 1;
1809                         }
1810                 }
1811 #endif
1812         if (!custom_ext_add(s, 1, &ret, limit, al))
1813                 return NULL;
1814
1815         if (s->s3->alpn_selected)
1816                 {
1817                 const unsigned char *selected = s->s3->alpn_selected;
1818                 unsigned len = s->s3->alpn_selected_len;
1819
1820                 if ((long)(limit - ret - 4 - 2 - 1 - len) < 0)
1821                         return NULL;
1822                 s2n(TLSEXT_TYPE_application_layer_protocol_negotiation,ret);
1823                 s2n(3 + len,ret);
1824                 s2n(1 + len,ret);
1825                 *ret++ = len;
1826                 memcpy(ret, selected, len);
1827                 ret += len;
1828                 }
1829
1830         if ((extdatalen = ret-orig-2)== 0)
1831                 return orig;
1832
1833         s2n(extdatalen, orig);
1834         return ret;
1835         }
1836
1837 #ifndef OPENSSL_NO_EC
1838 /*-
1839  * ssl_check_for_safari attempts to fingerprint Safari using OS X
1840  * SecureTransport using the TLS extension block in |d|, of length |n|.
1841  * Safari, since 10.6, sends exactly these extensions, in this order:
1842  *   SNI,
1843  *   elliptic_curves
1844  *   ec_point_formats
1845  *
1846  * We wish to fingerprint Safari because they broke ECDHE-ECDSA support in 10.8,
1847  * but they advertise support. So enabling ECDHE-ECDSA ciphers breaks them.
1848  * Sadly we cannot differentiate 10.6, 10.7 and 10.8.4 (which work), from
1849  * 10.8..10.8.3 (which don't work).
1850  */
1851 static void ssl_check_for_safari(SSL *s, const unsigned char *data, const unsigned char *d, int n) {
1852         unsigned short type, size;
1853         static const unsigned char kSafariExtensionsBlock[] = {
1854                 0x00, 0x0a,  /* elliptic_curves extension */
1855                 0x00, 0x08,  /* 8 bytes */
1856                 0x00, 0x06,  /* 6 bytes of curve ids */
1857                 0x00, 0x17,  /* P-256 */
1858                 0x00, 0x18,  /* P-384 */
1859                 0x00, 0x19,  /* P-521 */
1860
1861                 0x00, 0x0b,  /* ec_point_formats */
1862                 0x00, 0x02,  /* 2 bytes */
1863                 0x01,        /* 1 point format */
1864                 0x00,        /* uncompressed */
1865         };
1866
1867         /* The following is only present in TLS 1.2 */
1868         static const unsigned char kSafariTLS12ExtensionsBlock[] = {
1869                 0x00, 0x0d,  /* signature_algorithms */
1870                 0x00, 0x0c,  /* 12 bytes */
1871                 0x00, 0x0a,  /* 10 bytes */
1872                 0x05, 0x01,  /* SHA-384/RSA */
1873                 0x04, 0x01,  /* SHA-256/RSA */
1874                 0x02, 0x01,  /* SHA-1/RSA */
1875                 0x04, 0x03,  /* SHA-256/ECDSA */
1876                 0x02, 0x03,  /* SHA-1/ECDSA */
1877         };
1878
1879         if (data >= (d+n-2))
1880                 return;
1881         data += 2;
1882
1883         if (data > (d+n-4))
1884                 return;
1885         n2s(data,type);
1886         n2s(data,size);
1887
1888         if (type != TLSEXT_TYPE_server_name)
1889                 return;
1890
1891         if (data+size > d+n)
1892                 return;
1893         data += size;
1894
1895         if (TLS1_get_client_version(s) >= TLS1_2_VERSION)
1896                 {
1897                 const size_t len1 = sizeof(kSafariExtensionsBlock);
1898                 const size_t len2 = sizeof(kSafariTLS12ExtensionsBlock);
1899
1900                 if (data + len1 + len2 != d+n)
1901                         return;
1902                 if (memcmp(data, kSafariExtensionsBlock, len1) != 0)
1903                         return;
1904                 if (memcmp(data + len1, kSafariTLS12ExtensionsBlock, len2) != 0)
1905                         return;
1906                 }
1907         else
1908                 {
1909                 const size_t len = sizeof(kSafariExtensionsBlock);
1910
1911                 if (data + len != d+n)
1912                         return;
1913                 if (memcmp(data, kSafariExtensionsBlock, len) != 0)
1914                         return;
1915                 }
1916
1917         s->s3->is_probably_safari = 1;
1918 }
1919 #endif /* !OPENSSL_NO_EC */
1920
1921 /* tls1_alpn_handle_client_hello is called to process the ALPN extension in a
1922  * ClientHello.
1923  *   data: the contents of the extension, not including the type and length.
1924  *   data_len: the number of bytes in |data|
1925  *   al: a pointer to the alert value to send in the event of a non-zero
1926  *       return.
1927  *
1928  *   returns: 0 on success. */
1929 static int tls1_alpn_handle_client_hello(SSL *s, const unsigned char *data,
1930                                          unsigned data_len, int *al)
1931         {
1932         unsigned i;
1933         unsigned proto_len;
1934         const unsigned char *selected;
1935         unsigned char selected_len;
1936         int r;
1937
1938         if (s->ctx->alpn_select_cb == NULL)
1939                 return 0;
1940
1941         if (data_len < 2)
1942                 goto parse_error;
1943
1944         /* data should contain a uint16 length followed by a series of 8-bit,
1945          * length-prefixed strings. */
1946         i = ((unsigned) data[0]) << 8 |
1947             ((unsigned) data[1]);
1948         data_len -= 2;
1949         data += 2;
1950         if (data_len != i)
1951                 goto parse_error;
1952
1953         if (data_len < 2)
1954                 goto parse_error;
1955
1956         for (i = 0; i < data_len;)
1957                 {
1958                 proto_len = data[i];
1959                 i++;
1960
1961                 if (proto_len == 0)
1962                         goto parse_error;
1963
1964                 if (i + proto_len < i || i + proto_len > data_len)
1965                         goto parse_error;
1966
1967                 i += proto_len;
1968                 }
1969
1970         r = s->ctx->alpn_select_cb(s, &selected, &selected_len, data, data_len,
1971                                    s->ctx->alpn_select_cb_arg);
1972         if (r == SSL_TLSEXT_ERR_OK) {
1973                 if (s->s3->alpn_selected)
1974                         OPENSSL_free(s->s3->alpn_selected);
1975                 s->s3->alpn_selected = OPENSSL_malloc(selected_len);
1976                 if (!s->s3->alpn_selected)
1977                         {
1978                         *al = SSL_AD_INTERNAL_ERROR;
1979                         return -1;
1980                         }
1981                 memcpy(s->s3->alpn_selected, selected, selected_len);
1982                 s->s3->alpn_selected_len = selected_len;
1983         }
1984         return 0;
1985
1986 parse_error:
1987         *al = SSL_AD_DECODE_ERROR;
1988         return -1;
1989         }
1990
1991 static int ssl_scan_clienthello_tlsext(SSL *s, unsigned char **p, unsigned char *d, int n, int *al)
1992         {
1993         unsigned short type;
1994         unsigned short size;
1995         unsigned short len;
1996         unsigned char *data = *p;
1997         int renegotiate_seen = 0;
1998
1999         s->servername_done = 0;
2000         s->tlsext_status_type = -1;
2001 #ifndef OPENSSL_NO_NEXTPROTONEG
2002         s->s3->next_proto_neg_seen = 0;
2003 #endif
2004
2005         if (s->s3->alpn_selected)
2006                 {
2007                 OPENSSL_free(s->s3->alpn_selected);
2008                 s->s3->alpn_selected = NULL;
2009                 }
2010
2011 #ifndef OPENSSL_NO_HEARTBEATS
2012         s->tlsext_heartbeat &= ~(SSL_TLSEXT_HB_ENABLED |
2013                                SSL_TLSEXT_HB_DONT_SEND_REQUESTS);
2014 #endif
2015
2016 #ifndef OPENSSL_NO_EC
2017         if (s->options & SSL_OP_SAFARI_ECDHE_ECDSA_BUG)
2018                 ssl_check_for_safari(s, data, d, n);
2019 #endif /* !OPENSSL_NO_EC */
2020
2021         /* Clear any signature algorithms extension received */
2022         if (s->cert->peer_sigalgs)
2023                 {
2024                 OPENSSL_free(s->cert->peer_sigalgs);
2025                 s->cert->peer_sigalgs = NULL;
2026                 }
2027
2028 #ifndef OPENSSL_NO_SRP
2029         if (s->srp_ctx.login != NULL)
2030                 {
2031                 OPENSSL_free(s->srp_ctx.login);
2032                 s->srp_ctx.login = NULL;
2033                 }
2034 #endif
2035
2036         s->srtp_profile = NULL;
2037
2038         if (data >= (d+n-2))
2039                 goto ri_check;
2040         n2s(data,len);
2041
2042         if (data > (d+n-len))
2043                 goto ri_check;
2044
2045         while (data <= (d+n-4))
2046                 {
2047                 n2s(data,type);
2048                 n2s(data,size);
2049
2050                 if (data+size > (d+n))
2051                         goto ri_check;
2052 #if 0
2053                 fprintf(stderr,"Received extension type %d size %d\n",type,size);
2054 #endif
2055                 if (s->tlsext_debug_cb)
2056                         s->tlsext_debug_cb(s, 0, type, data, size,
2057                                                 s->tlsext_debug_arg);
2058 /*-
2059  * The servername extension is treated as follows:
2060  *
2061  * - Only the hostname type is supported with a maximum length of 255.
2062  * - The servername is rejected if too long or if it contains zeros,
2063  *   in which case an fatal alert is generated.
2064  * - The servername field is maintained together with the session cache.
2065  * - When a session is resumed, the servername call back invoked in order
2066  *   to allow the application to position itself to the right context.
2067  * - The servername is acknowledged if it is new for a session or when
2068  *   it is identical to a previously used for the same session.
2069  *   Applications can control the behaviour.  They can at any time
2070  *   set a 'desirable' servername for a new SSL object. This can be the
2071  *   case for example with HTTPS when a Host: header field is received and
2072  *   a renegotiation is requested. In this case, a possible servername
2073  *   presented in the new client hello is only acknowledged if it matches
2074  *   the value of the Host: field.
2075  * - Applications must  use SSL_OP_NO_SESSION_RESUMPTION_ON_RENEGOTIATION
2076  *   if they provide for changing an explicit servername context for the
2077  *   session, i.e. when the session has been established with a servername
2078  *   extension.
2079  * - On session reconnect, the servername extension may be absent.
2080  *
2081  */
2082
2083                 if (type == TLSEXT_TYPE_server_name)
2084                         {
2085                         unsigned char *sdata;
2086                         int servname_type;
2087                         int dsize;
2088
2089                         if (size < 2)
2090                                 {
2091                                 *al = SSL_AD_DECODE_ERROR;
2092                                 return 0;
2093                                 }
2094                         n2s(data,dsize);
2095                         size -= 2;
2096                         if (dsize > size  )
2097                                 {
2098                                 *al = SSL_AD_DECODE_ERROR;
2099                                 return 0;
2100                                 }
2101
2102                         sdata = data;
2103                         while (dsize > 3)
2104                                 {
2105                                 servname_type = *(sdata++);
2106                                 n2s(sdata,len);
2107                                 dsize -= 3;
2108
2109                                 if (len > dsize)
2110                                         {
2111                                         *al = SSL_AD_DECODE_ERROR;
2112                                         return 0;
2113                                         }
2114                                 if (s->servername_done == 0)
2115                                 switch (servname_type)
2116                                         {
2117                                 case TLSEXT_NAMETYPE_host_name:
2118                                         if (!s->hit)
2119                                                 {
2120                                                 if(s->session->tlsext_hostname)
2121                                                         {
2122                                                         *al = SSL_AD_DECODE_ERROR;
2123                                                         return 0;
2124                                                         }
2125                                                 if (len > TLSEXT_MAXLEN_host_name)
2126                                                         {
2127                                                         *al = TLS1_AD_UNRECOGNIZED_NAME;
2128                                                         return 0;
2129                                                         }
2130                                                 if ((s->session->tlsext_hostname = OPENSSL_malloc(len+1)) == NULL)
2131                                                         {
2132                                                         *al = TLS1_AD_INTERNAL_ERROR;
2133                                                         return 0;
2134                                                         }
2135                                                 memcpy(s->session->tlsext_hostname, sdata, len);
2136                                                 s->session->tlsext_hostname[len]='\0';
2137                                                 if (strlen(s->session->tlsext_hostname) != len) {
2138                                                         OPENSSL_free(s->session->tlsext_hostname);
2139                                                         s->session->tlsext_hostname = NULL;
2140                                                         *al = TLS1_AD_UNRECOGNIZED_NAME;
2141                                                         return 0;
2142                                                 }
2143                                                 s->servername_done = 1;
2144
2145                                                 }
2146                                         else
2147                                                 s->servername_done = s->session->tlsext_hostname
2148                                                         && strlen(s->session->tlsext_hostname) == len
2149                                                         && strncmp(s->session->tlsext_hostname, (char *)sdata, len) == 0;
2150
2151                                         break;
2152
2153                                 default:
2154                                         break;
2155                                         }
2156
2157                                 dsize -= len;
2158                                 }
2159                         if (dsize != 0)
2160                                 {
2161                                 *al = SSL_AD_DECODE_ERROR;
2162                                 return 0;
2163                                 }
2164
2165                         }
2166 #ifndef OPENSSL_NO_SRP
2167                 else if (type == TLSEXT_TYPE_srp)
2168                         {
2169                         if (size <= 0 || ((len = data[0])) != (size -1))
2170                                 {
2171                                 *al = SSL_AD_DECODE_ERROR;
2172                                 return 0;
2173                                 }
2174                         if (s->srp_ctx.login != NULL)
2175                                 {
2176                                 *al = SSL_AD_DECODE_ERROR;
2177                                 return 0;
2178                                 }
2179                         if ((s->srp_ctx.login = OPENSSL_malloc(len+1)) == NULL)
2180                                 return -1;
2181                         memcpy(s->srp_ctx.login, &data[1], len);
2182                         s->srp_ctx.login[len]='\0';
2183
2184                         if (strlen(s->srp_ctx.login) != len)
2185                                 {
2186                                 *al = SSL_AD_DECODE_ERROR;
2187                                 return 0;
2188                                 }
2189                         }
2190 #endif
2191
2192 #ifndef OPENSSL_NO_EC
2193                 else if (type == TLSEXT_TYPE_ec_point_formats)
2194                         {
2195                         unsigned char *sdata = data;
2196                         int ecpointformatlist_length = *(sdata++);
2197
2198                         if (ecpointformatlist_length != size - 1 ||
2199                                 ecpointformatlist_length < 1)
2200                                 {
2201                                 *al = TLS1_AD_DECODE_ERROR;
2202                                 return 0;
2203                                 }
2204                         if (!s->hit)
2205                                 {
2206                                 if(s->session->tlsext_ecpointformatlist)
2207                                         {
2208                                         OPENSSL_free(s->session->tlsext_ecpointformatlist);
2209                                         s->session->tlsext_ecpointformatlist = NULL;
2210                                         }
2211                                 s->session->tlsext_ecpointformatlist_length = 0;
2212                                 if ((s->session->tlsext_ecpointformatlist = OPENSSL_malloc(ecpointformatlist_length)) == NULL)
2213                                         {
2214                                         *al = TLS1_AD_INTERNAL_ERROR;
2215                                         return 0;
2216                                         }
2217                                 s->session->tlsext_ecpointformatlist_length = ecpointformatlist_length;
2218                                 memcpy(s->session->tlsext_ecpointformatlist, sdata, ecpointformatlist_length);
2219                                 }
2220 #if 0
2221                         fprintf(stderr,"ssl_parse_clienthello_tlsext s->session->tlsext_ecpointformatlist (length=%i) ", s->session->tlsext_ecpointformatlist_length);
2222                         sdata = s->session->tlsext_ecpointformatlist;
2223                         for (i = 0; i < s->session->tlsext_ecpointformatlist_length; i++)
2224                                 fprintf(stderr,"%i ",*(sdata++));
2225                         fprintf(stderr,"\n");
2226 #endif
2227                         }
2228                 else if (type == TLSEXT_TYPE_elliptic_curves)
2229                         {
2230                         unsigned char *sdata = data;
2231                         int ellipticcurvelist_length = (*(sdata++) << 8);
2232                         ellipticcurvelist_length += (*(sdata++));
2233
2234                         if (ellipticcurvelist_length != size - 2 ||
2235                                 ellipticcurvelist_length < 1 ||
2236                                 /* Each NamedCurve is 2 bytes. */
2237                                 ellipticcurvelist_length & 1)
2238                                 {
2239                                 *al = TLS1_AD_DECODE_ERROR;
2240                                 return 0;
2241                                 }
2242                         if (!s->hit)
2243                                 {
2244                                 if(s->session->tlsext_ellipticcurvelist)
2245                                         {
2246                                         *al = TLS1_AD_DECODE_ERROR;
2247                                         return 0;
2248                                         }
2249                                 s->session->tlsext_ellipticcurvelist_length = 0;
2250                                 if ((s->session->tlsext_ellipticcurvelist = OPENSSL_malloc(ellipticcurvelist_length)) == NULL)
2251                                         {
2252                                         *al = TLS1_AD_INTERNAL_ERROR;
2253                                         return 0;
2254                                         }
2255                                 s->session->tlsext_ellipticcurvelist_length = ellipticcurvelist_length;
2256                                 memcpy(s->session->tlsext_ellipticcurvelist, sdata, ellipticcurvelist_length);
2257                                 }
2258 #if 0
2259                         fprintf(stderr,"ssl_parse_clienthello_tlsext s->session->tlsext_ellipticcurvelist (length=%i) ", s->session->tlsext_ellipticcurvelist_length);
2260                         sdata = s->session->tlsext_ellipticcurvelist;
2261                         for (i = 0; i < s->session->tlsext_ellipticcurvelist_length; i++)
2262                                 fprintf(stderr,"%i ",*(sdata++));
2263                         fprintf(stderr,"\n");
2264 #endif
2265                         }
2266 #endif /* OPENSSL_NO_EC */
2267 #ifdef TLSEXT_TYPE_opaque_prf_input
2268                 else if (type == TLSEXT_TYPE_opaque_prf_input)
2269                         {
2270                         unsigned char *sdata = data;
2271
2272                         if (size < 2)
2273                                 {
2274                                 *al = SSL_AD_DECODE_ERROR;
2275                                 return 0;
2276                                 }
2277                         n2s(sdata, s->s3->client_opaque_prf_input_len);
2278                         if (s->s3->client_opaque_prf_input_len != size - 2)
2279                                 {
2280                                 *al = SSL_AD_DECODE_ERROR;
2281                                 return 0;
2282                                 }
2283
2284                         if (s->s3->client_opaque_prf_input != NULL) /* shouldn't really happen */
2285                                 OPENSSL_free(s->s3->client_opaque_prf_input);
2286
2287                         /* dummy byte just to get non-NULL */
2288                         if (s->s3->client_opaque_prf_input_len == 0)
2289                                 s->s3->client_opaque_prf_input = OPENSSL_malloc(1);
2290                         else
2291                                 s->s3->client_opaque_prf_input = BUF_memdup(sdata, s->s3->client_opaque_prf_input_len);
2292                         if (s->s3->client_opaque_prf_input == NULL)
2293                                 {
2294                                 *al = TLS1_AD_INTERNAL_ERROR;
2295                                 return 0;
2296                                 }
2297                         }
2298 #endif
2299                 else if (type == TLSEXT_TYPE_session_ticket)
2300                         {
2301                         if (s->tls_session_ticket_ext_cb &&
2302                             !s->tls_session_ticket_ext_cb(s, data, size, s->tls_session_ticket_ext_cb_arg))
2303                                 {
2304                                 *al = TLS1_AD_INTERNAL_ERROR;
2305                                 return 0;
2306                                 }
2307                         }
2308                 else if (type == TLSEXT_TYPE_renegotiate)
2309                         {
2310                         if(!ssl_parse_clienthello_renegotiate_ext(s, data, size, al))
2311                                 return 0;
2312                         renegotiate_seen = 1;
2313                         }
2314                 else if (type == TLSEXT_TYPE_signature_algorithms)
2315                         {
2316                         int dsize;
2317                         if (s->cert->peer_sigalgs || size < 2)
2318                                 {
2319                                 *al = SSL_AD_DECODE_ERROR;
2320                                 return 0;
2321                                 }
2322                         n2s(data,dsize);
2323                         size -= 2;
2324                         if (dsize != size || dsize & 1 || !dsize)
2325                                 {
2326                                 *al = SSL_AD_DECODE_ERROR;
2327                                 return 0;
2328                                 }
2329                         if (!tls1_save_sigalgs(s, data, dsize))
2330                                 {
2331                                 *al = SSL_AD_DECODE_ERROR;
2332                                 return 0;
2333                                 }
2334                         }
2335                 else if (type == TLSEXT_TYPE_status_request)
2336                         {
2337
2338                         if (size < 5)
2339                                 {
2340                                 *al = SSL_AD_DECODE_ERROR;
2341                                 return 0;
2342                                 }
2343
2344                         s->tlsext_status_type = *data++;
2345                         size--;
2346                         if (s->tlsext_status_type == TLSEXT_STATUSTYPE_ocsp)
2347                                 {
2348                                 const unsigned char *sdata;
2349                                 int dsize;
2350                                 /* Read in responder_id_list */
2351                                 n2s(data,dsize);
2352                                 size -= 2;
2353                                 if (dsize > size  )
2354                                         {
2355                                         *al = SSL_AD_DECODE_ERROR;
2356                                         return 0;
2357                                         }
2358                                 while (dsize > 0)
2359                                         {
2360                                         OCSP_RESPID *id;
2361                                         int idsize;
2362                                         if (dsize < 4)
2363                                                 {
2364                                                 *al = SSL_AD_DECODE_ERROR;
2365                                                 return 0;
2366                                                 }
2367                                         n2s(data, idsize);
2368                                         dsize -= 2 + idsize;
2369                                         size -= 2 + idsize;
2370                                         if (dsize < 0)
2371                                                 {
2372                                                 *al = SSL_AD_DECODE_ERROR;
2373                                                 return 0;
2374                                                 }
2375                                         sdata = data;
2376                                         data += idsize;
2377                                         id = d2i_OCSP_RESPID(NULL,
2378                                                                 &sdata, idsize);
2379                                         if (!id)
2380                                                 {
2381                                                 *al = SSL_AD_DECODE_ERROR;
2382                                                 return 0;
2383                                                 }
2384                                         if (data != sdata)
2385                                                 {
2386                                                 OCSP_RESPID_free(id);
2387                                                 *al = SSL_AD_DECODE_ERROR;
2388                                                 return 0;
2389                                                 }
2390                                         if (!s->tlsext_ocsp_ids
2391                                                 && !(s->tlsext_ocsp_ids =
2392                                                 sk_OCSP_RESPID_new_null()))
2393                                                 {
2394                                                 OCSP_RESPID_free(id);
2395                                                 *al = SSL_AD_INTERNAL_ERROR;
2396                                                 return 0;
2397                                                 }
2398                                         if (!sk_OCSP_RESPID_push(
2399                                                         s->tlsext_ocsp_ids, id))
2400                                                 {
2401                                                 OCSP_RESPID_free(id);
2402                                                 *al = SSL_AD_INTERNAL_ERROR;
2403                                                 return 0;
2404                                                 }
2405                                         }
2406
2407                                 /* Read in request_extensions */
2408                                 if (size < 2)
2409                                         {
2410                                         *al = SSL_AD_DECODE_ERROR;
2411                                         return 0;
2412                                         }
2413                                 n2s(data,dsize);
2414                                 size -= 2;
2415                                 if (dsize != size)
2416                                         {
2417                                         *al = SSL_AD_DECODE_ERROR;
2418                                         return 0;
2419                                         }
2420                                 sdata = data;
2421                                 if (dsize > 0)
2422                                         {
2423                                         if (s->tlsext_ocsp_exts)
2424                                                 {
2425                                                 sk_X509_EXTENSION_pop_free(s->tlsext_ocsp_exts,
2426                                                                            X509_EXTENSION_free);
2427                                                 }
2428
2429                                         s->tlsext_ocsp_exts =
2430                                                 d2i_X509_EXTENSIONS(NULL,
2431                                                         &sdata, dsize);
2432                                         if (!s->tlsext_ocsp_exts
2433                                                 || (data + dsize != sdata))
2434                                                 {
2435                                                 *al = SSL_AD_DECODE_ERROR;
2436                                                 return 0;
2437                                                 }
2438                                         }
2439                                 }
2440                                 /* We don't know what to do with any other type
2441                                 * so ignore it.
2442                                 */
2443                                 else
2444                                         s->tlsext_status_type = -1;
2445                         }
2446 #ifndef OPENSSL_NO_HEARTBEATS
2447                 else if (type == TLSEXT_TYPE_heartbeat)
2448                         {
2449                         switch(data[0])
2450                                 {
2451                                 case 0x01:      /* Client allows us to send HB requests */
2452                                                         s->tlsext_heartbeat |= SSL_TLSEXT_HB_ENABLED;
2453                                                         break;
2454                                 case 0x02:      /* Client doesn't accept HB requests */
2455                                                         s->tlsext_heartbeat |= SSL_TLSEXT_HB_ENABLED;
2456                                                         s->tlsext_heartbeat |= SSL_TLSEXT_HB_DONT_SEND_REQUESTS;
2457                                                         break;
2458                                 default:        *al = SSL_AD_ILLEGAL_PARAMETER;
2459                                                         return 0;
2460                                 }
2461                         }
2462 #endif
2463 #ifndef OPENSSL_NO_NEXTPROTONEG
2464                 else if (type == TLSEXT_TYPE_next_proto_neg &&
2465                          s->s3->tmp.finish_md_len == 0 &&
2466                          s->s3->alpn_selected == NULL)
2467                         {
2468                         /*-
2469                          * We shouldn't accept this extension on a
2470                          * renegotiation.
2471                          *
2472                          * s->new_session will be set on renegotiation, but we
2473                          * probably shouldn't rely that it couldn't be set on
2474                          * the initial renegotation too in certain cases (when
2475                          * there's some other reason to disallow resuming an
2476                          * earlier session -- the current code won't be doing
2477                          * anything like that, but this might change).
2478                          *
2479                          * A valid sign that there's been a previous handshake
2480                          * in this connection is if s->s3->tmp.finish_md_len >
2481                          * 0.  (We are talking about a check that will happen
2482                          * in the Hello protocol round, well before a new
2483                          * Finished message could have been computed.)
2484                          */
2485                         s->s3->next_proto_neg_seen = 1;
2486                         }
2487 #endif
2488
2489                 else if (type == TLSEXT_TYPE_application_layer_protocol_negotiation &&
2490                          s->ctx->alpn_select_cb &&
2491                          s->s3->tmp.finish_md_len == 0)
2492                         {
2493                         if (tls1_alpn_handle_client_hello(s, data, size, al) != 0)
2494                                 return 0;
2495 #ifndef OPENSSL_NO_NEXTPROTONEG
2496                         /* ALPN takes precedence over NPN. */
2497                         s->s3->next_proto_neg_seen = 0;
2498 #endif
2499                         }
2500
2501                 /* session ticket processed earlier */
2502 #ifndef OPENSSL_NO_SRTP
2503                 else if (SSL_IS_DTLS(s) && SSL_get_srtp_profiles(s)
2504                                 && type == TLSEXT_TYPE_use_srtp)
2505                         {
2506                         if(ssl_parse_clienthello_use_srtp_ext(s, data, size,
2507                                                               al))
2508                                 return 0;
2509                         }
2510 #endif
2511
2512                 data+=size;
2513                 }
2514
2515         *p = data;
2516
2517         ri_check:
2518
2519         /* Need RI if renegotiating */
2520
2521         if (!renegotiate_seen && s->renegotiate &&
2522                 !(s->options & SSL_OP_ALLOW_UNSAFE_LEGACY_RENEGOTIATION))
2523                 {
2524                 *al = SSL_AD_HANDSHAKE_FAILURE;
2525                 SSLerr(SSL_F_SSL_SCAN_CLIENTHELLO_TLSEXT,
2526                                 SSL_R_UNSAFE_LEGACY_RENEGOTIATION_DISABLED);
2527                 return 0;
2528                 }
2529
2530         return 1;
2531         }
2532
2533 /*
2534  * Parse any custom extensions found.  "data" is the start of the extension data
2535  * and "limit" is the end of the record. TODO: add strict syntax checking.
2536  */
2537
2538 static int ssl_scan_clienthello_custom_tlsext(SSL *s, const unsigned char *data, const unsigned char *limit, int *al)
2539         {
2540         unsigned short type, size, len;
2541         /* If resumed session or no custom extensions nothing to do */
2542         if (s->hit || s->cert->srv_ext.meths_count == 0)
2543                 return 1;
2544
2545         if (data >= limit - 2)
2546                 return 1;
2547         n2s(data, len);
2548
2549         if (data > limit - len)
2550                 return 1;
2551
2552         while (data <= limit - 4)
2553                 {
2554                 n2s(data, type);
2555                 n2s(data, size);
2556
2557                 if (data+size > limit)
2558                         return 1;
2559                 if (custom_ext_parse(s, 1 /* server */, type, data, size, al) <= 0)
2560                         return 0;
2561
2562                 data+=size;
2563                 }
2564
2565         return 1;
2566         }
2567
2568 int ssl_parse_clienthello_tlsext(SSL *s, unsigned char **p, unsigned char *d, int n)
2569         {
2570         int al = -1;
2571         unsigned char *ptmp = *p;
2572         /*
2573          * Internally supported extensions are parsed first so SNI can be handled
2574          * before custom extensions. An application processing SNI will typically
2575          * switch the parent context using SSL_set_SSL_CTX and custom extensions
2576          * need to be handled by the new SSL_CTX structure.
2577          */
2578         if (ssl_scan_clienthello_tlsext(s, p, d, n, &al) <= 0)
2579                 {
2580                 ssl3_send_alert(s,SSL3_AL_FATAL,al);
2581                 return 0;
2582                 }
2583
2584         if (ssl_check_clienthello_tlsext_early(s) <= 0)
2585                 {
2586                 SSLerr(SSL_F_SSL_PARSE_CLIENTHELLO_TLSEXT,SSL_R_CLIENTHELLO_TLSEXT);
2587                 return 0;
2588                 }
2589
2590         custom_ext_init(&s->cert->srv_ext);
2591         if (ssl_scan_clienthello_custom_tlsext(s, ptmp, d + n, &al) <= 0)
2592                 {
2593                 ssl3_send_alert(s,SSL3_AL_FATAL,al);
2594                 return 0;
2595                 }
2596
2597         return 1;
2598 }
2599
2600 #ifndef OPENSSL_NO_NEXTPROTONEG
2601 /* ssl_next_proto_validate validates a Next Protocol Negotiation block. No
2602  * elements of zero length are allowed and the set of elements must exactly fill
2603  * the length of the block. */
2604 static char ssl_next_proto_validate(unsigned char *d, unsigned len)
2605         {
2606         unsigned int off = 0;
2607
2608         while (off < len)
2609                 {
2610                 if (d[off] == 0)
2611                         return 0;
2612                 off += d[off];
2613                 off++;
2614                 }
2615
2616         return off == len;
2617         }
2618 #endif
2619
2620 static int ssl_scan_serverhello_tlsext(SSL *s, unsigned char **p, unsigned char *d, int n, int *al)
2621         {
2622         unsigned short length;
2623         unsigned short type;
2624         unsigned short size;
2625         unsigned char *data = *p;
2626         int tlsext_servername = 0;
2627         int renegotiate_seen = 0;
2628
2629 #ifndef OPENSSL_NO_NEXTPROTONEG
2630         s->s3->next_proto_neg_seen = 0;
2631 #endif
2632         s->tlsext_ticket_expected = 0;
2633
2634         if (s->s3->alpn_selected)
2635                 {
2636                 OPENSSL_free(s->s3->alpn_selected);
2637                 s->s3->alpn_selected = NULL;
2638                 }
2639
2640 #ifndef OPENSSL_NO_HEARTBEATS
2641         s->tlsext_heartbeat &= ~(SSL_TLSEXT_HB_ENABLED |
2642                                SSL_TLSEXT_HB_DONT_SEND_REQUESTS);
2643 #endif
2644
2645         if (data >= (d+n-2))
2646                 goto ri_check;
2647
2648         n2s(data,length);
2649         if (data+length != d+n)
2650                 {
2651                 *al = SSL_AD_DECODE_ERROR;
2652                 return 0;
2653                 }
2654
2655         while(data <= (d+n-4))
2656                 {
2657                 n2s(data,type);
2658                 n2s(data,size);
2659
2660                 if (data+size > (d+n))
2661                         goto ri_check;
2662
2663                 if (s->tlsext_debug_cb)
2664                         s->tlsext_debug_cb(s, 1, type, data, size,
2665                                                 s->tlsext_debug_arg);
2666
2667                 if (type == TLSEXT_TYPE_server_name)
2668                         {
2669                         if (s->tlsext_hostname == NULL || size > 0)
2670                                 {
2671                                 *al = TLS1_AD_UNRECOGNIZED_NAME;
2672                                 return 0;
2673                                 }
2674                         tlsext_servername = 1;
2675                         }
2676
2677 #ifndef OPENSSL_NO_EC
2678                 else if (type == TLSEXT_TYPE_ec_point_formats)
2679                         {
2680                         unsigned char *sdata = data;
2681                         int ecpointformatlist_length = *(sdata++);
2682
2683                         if (ecpointformatlist_length != size - 1)
2684                                 {
2685                                 *al = TLS1_AD_DECODE_ERROR;
2686                                 return 0;
2687                                 }
2688                         if (!s->hit)
2689                                 {
2690                                 s->session->tlsext_ecpointformatlist_length = 0;
2691                                 if (s->session->tlsext_ecpointformatlist != NULL) OPENSSL_free(s->session->tlsext_ecpointformatlist);
2692                                 if ((s->session->tlsext_ecpointformatlist = OPENSSL_malloc(ecpointformatlist_length)) == NULL)
2693                                         {
2694                                         *al = TLS1_AD_INTERNAL_ERROR;
2695                                         return 0;
2696                                         }
2697                                 s->session->tlsext_ecpointformatlist_length = ecpointformatlist_length;
2698                                 memcpy(s->session->tlsext_ecpointformatlist, sdata, ecpointformatlist_length);
2699                                 }
2700 #if 0
2701                         fprintf(stderr,"ssl_parse_serverhello_tlsext s->session->tlsext_ecpointformatlist ");
2702                         sdata = s->session->tlsext_ecpointformatlist;
2703                         for (i = 0; i < s->session->tlsext_ecpointformatlist_length; i++)
2704                                 fprintf(stderr,"%i ",*(sdata++));
2705                         fprintf(stderr,"\n");
2706 #endif
2707                         }
2708 #endif /* OPENSSL_NO_EC */
2709
2710                 else if (type == TLSEXT_TYPE_session_ticket)
2711                         {
2712                         if (s->tls_session_ticket_ext_cb &&
2713                             !s->tls_session_ticket_ext_cb(s, data, size, s->tls_session_ticket_ext_cb_arg))
2714                                 {
2715                                 *al = TLS1_AD_INTERNAL_ERROR;
2716                                 return 0;
2717                                 }
2718                         if ((SSL_get_options(s) & SSL_OP_NO_TICKET)
2719                                 || (size > 0))
2720                                 {
2721                                 *al = TLS1_AD_UNSUPPORTED_EXTENSION;
2722                                 return 0;
2723                                 }
2724                         s->tlsext_ticket_expected = 1;
2725                         }
2726 #ifdef TLSEXT_TYPE_opaque_prf_input
2727                 else if (type == TLSEXT_TYPE_opaque_prf_input)
2728                         {
2729                         unsigned char *sdata = data;
2730
2731                         if (size < 2)
2732                                 {
2733                                 *al = SSL_AD_DECODE_ERROR;
2734                                 return 0;
2735                                 }
2736                         n2s(sdata, s->s3->server_opaque_prf_input_len);
2737                         if (s->s3->server_opaque_prf_input_len != size - 2)
2738                                 {
2739                                 *al = SSL_AD_DECODE_ERROR;
2740                                 return 0;
2741                                 }
2742
2743                         if (s->s3->server_opaque_prf_input != NULL) /* shouldn't really happen */
2744                                 OPENSSL_free(s->s3->server_opaque_prf_input);
2745                         if (s->s3->server_opaque_prf_input_len == 0)
2746                                 s->s3->server_opaque_prf_input = OPENSSL_malloc(1); /* dummy byte just to get non-NULL */
2747                         else
2748                                 s->s3->server_opaque_prf_input = BUF_memdup(sdata, s->s3->server_opaque_prf_input_len);
2749
2750                         if (s->s3->server_opaque_prf_input == NULL)
2751                                 {
2752                                 *al = TLS1_AD_INTERNAL_ERROR;
2753                                 return 0;
2754                                 }
2755                         }
2756 #endif
2757                 else if (type == TLSEXT_TYPE_status_request)
2758                         {
2759                         /* MUST be empty and only sent if we've requested
2760                          * a status request message.
2761                          */
2762                         if ((s->tlsext_status_type == -1) || (size > 0))
2763                                 {
2764                                 *al = TLS1_AD_UNSUPPORTED_EXTENSION;
2765                                 return 0;
2766                                 }
2767                         /* Set flag to expect CertificateStatus message */
2768                         s->tlsext_status_expected = 1;
2769                         }
2770 #ifndef OPENSSL_NO_NEXTPROTONEG
2771                 else if (type == TLSEXT_TYPE_next_proto_neg &&
2772                          s->s3->tmp.finish_md_len == 0)
2773                         {
2774                         unsigned char *selected;
2775                         unsigned char selected_len;
2776
2777                         /* We must have requested it. */
2778                         if (s->ctx->next_proto_select_cb == NULL)
2779                                 {
2780                                 *al = TLS1_AD_UNSUPPORTED_EXTENSION;
2781                                 return 0;
2782                                 }
2783                         /* The data must be valid */
2784                         if (!ssl_next_proto_validate(data, size))
2785                                 {
2786                                 *al = TLS1_AD_DECODE_ERROR;
2787                                 return 0;
2788                                 }
2789                         if (s->ctx->next_proto_select_cb(s, &selected, &selected_len, data, size, s->ctx->next_proto_select_cb_arg) != SSL_TLSEXT_ERR_OK)
2790                                 {
2791                                 *al = TLS1_AD_INTERNAL_ERROR;
2792                                 return 0;
2793                                 }
2794                         s->next_proto_negotiated = OPENSSL_malloc(selected_len);
2795                         if (!s->next_proto_negotiated)
2796                                 {
2797                                 *al = TLS1_AD_INTERNAL_ERROR;
2798                                 return 0;
2799                                 }
2800                         memcpy(s->next_proto_negotiated, selected, selected_len);
2801                         s->next_proto_negotiated_len = selected_len;
2802                         s->s3->next_proto_neg_seen = 1;
2803                         }
2804 #endif
2805
2806                 else if (type == TLSEXT_TYPE_application_layer_protocol_negotiation)
2807                         {
2808                         unsigned len;
2809
2810                         /* We must have requested it. */
2811                         if (s->alpn_client_proto_list == NULL)
2812                                 {
2813                                 *al = TLS1_AD_UNSUPPORTED_EXTENSION;
2814                                 return 0;
2815                                 }
2816                         if (size < 4)
2817                                 {
2818                                 *al = TLS1_AD_DECODE_ERROR;
2819                                 return 0;
2820                                 }
2821                         /*-
2822                          * The extension data consists of:
2823                          *   uint16 list_length
2824                          *   uint8 proto_length;
2825                          *   uint8 proto[proto_length];
2826                          */
2827                         len = data[0];
2828                         len <<= 8;
2829                         len |= data[1];
2830                         if (len != (unsigned) size - 2)
2831                                 {
2832                                 *al = TLS1_AD_DECODE_ERROR;
2833                                 return 0;
2834                                 }
2835                         len = data[2];
2836                         if (len != (unsigned) size - 3)
2837                                 {
2838                                 *al = TLS1_AD_DECODE_ERROR;
2839                                 return 0;
2840                                 }
2841                         if (s->s3->alpn_selected)
2842                                 OPENSSL_free(s->s3->alpn_selected);
2843                         s->s3->alpn_selected = OPENSSL_malloc(len);
2844                         if (!s->s3->alpn_selected)
2845                                 {
2846                                 *al = TLS1_AD_INTERNAL_ERROR;
2847                                 return 0;
2848                                 }
2849                         memcpy(s->s3->alpn_selected, data + 3, len);
2850                         s->s3->alpn_selected_len = len;
2851                         }
2852
2853                 else if (type == TLSEXT_TYPE_renegotiate)
2854                         {
2855                         if(!ssl_parse_serverhello_renegotiate_ext(s, data, size, al))
2856                                 return 0;
2857                         renegotiate_seen = 1;
2858                         }
2859 #ifndef OPENSSL_NO_HEARTBEATS
2860                 else if (type == TLSEXT_TYPE_heartbeat)
2861                         {
2862                         switch(data[0])
2863                                 {
2864                                 case 0x01:      /* Server allows us to send HB requests */
2865                                                         s->tlsext_heartbeat |= SSL_TLSEXT_HB_ENABLED;
2866                                                         break;
2867                                 case 0x02:      /* Server doesn't accept HB requests */
2868                                                         s->tlsext_heartbeat |= SSL_TLSEXT_HB_ENABLED;
2869                                                         s->tlsext_heartbeat |= SSL_TLSEXT_HB_DONT_SEND_REQUESTS;
2870                                                         break;
2871                                 default:        *al = SSL_AD_ILLEGAL_PARAMETER;
2872                                                         return 0;
2873                                 }
2874                         }
2875 #endif
2876 #ifndef OPENSSL_NO_SRTP
2877                 else if (SSL_IS_DTLS(s) && type == TLSEXT_TYPE_use_srtp)
2878                         {
2879                         if(ssl_parse_serverhello_use_srtp_ext(s, data, size,
2880                                                               al))
2881                                 return 0;
2882                         }
2883 #endif
2884                 /* If this extension type was not otherwise handled, but
2885                  * matches a custom_cli_ext_record, then send it to the c
2886                  * callback */
2887                 else if (custom_ext_parse(s, 0, type, data, size, al) <= 0)
2888                                 return 0;
2889
2890                 data += size;
2891                 }
2892
2893         if (data != d+n)
2894                 {
2895                 *al = SSL_AD_DECODE_ERROR;
2896                 return 0;
2897                 }
2898
2899         if (!s->hit && tlsext_servername == 1)
2900                 {
2901                 if (s->tlsext_hostname)
2902                         {
2903                         if (s->session->tlsext_hostname == NULL)
2904                                 {
2905                                 s->session->tlsext_hostname = BUF_strdup(s->tlsext_hostname);
2906                                 if (!s->session->tlsext_hostname)
2907                                         {
2908                                         *al = SSL_AD_UNRECOGNIZED_NAME;
2909                                         return 0;
2910                                         }
2911                                 }
2912                         else
2913                                 {
2914                                 *al = SSL_AD_DECODE_ERROR;
2915                                 return 0;
2916                                 }
2917                         }
2918                 }
2919
2920         *p = data;
2921
2922         ri_check:
2923
2924         /* Determine if we need to see RI. Strictly speaking if we want to
2925          * avoid an attack we should *always* see RI even on initial server
2926          * hello because the client doesn't see any renegotiation during an
2927          * attack. However this would mean we could not connect to any server
2928          * which doesn't support RI so for the immediate future tolerate RI
2929          * absence on initial connect only.
2930          */
2931         if (!renegotiate_seen
2932                 && !(s->options & SSL_OP_LEGACY_SERVER_CONNECT)
2933                 && !(s->options & SSL_OP_ALLOW_UNSAFE_LEGACY_RENEGOTIATION))
2934                 {
2935                 *al = SSL_AD_HANDSHAKE_FAILURE;
2936                 SSLerr(SSL_F_SSL_SCAN_SERVERHELLO_TLSEXT,
2937                                 SSL_R_UNSAFE_LEGACY_RENEGOTIATION_DISABLED);
2938                 return 0;
2939                 }
2940
2941         return 1;
2942         }
2943
2944
2945 int ssl_prepare_clienthello_tlsext(SSL *s)
2946         {
2947
2948 #ifdef TLSEXT_TYPE_opaque_prf_input
2949         {
2950                 int r = 1;
2951
2952                 if (s->ctx->tlsext_opaque_prf_input_callback != 0)
2953                         {
2954                         r = s->ctx->tlsext_opaque_prf_input_callback(s, NULL, 0, s->ctx->tlsext_opaque_prf_input_callback_arg);
2955                         if (!r)
2956                                 return -1;
2957                         }
2958
2959                 if (s->tlsext_opaque_prf_input != NULL)
2960                         {
2961                         if (s->s3->client_opaque_prf_input != NULL) /* shouldn't really happen */
2962                                 OPENSSL_free(s->s3->client_opaque_prf_input);
2963
2964                         if (s->tlsext_opaque_prf_input_len == 0)
2965                                 s->s3->client_opaque_prf_input = OPENSSL_malloc(1); /* dummy byte just to get non-NULL */
2966                         else
2967                                 s->s3->client_opaque_prf_input = BUF_memdup(s->tlsext_opaque_prf_input, s->tlsext_opaque_prf_input_len);
2968                         if (s->s3->client_opaque_prf_input == NULL)
2969                                 {
2970                                 SSLerr(SSL_F_SSL_PREPARE_CLIENTHELLO_TLSEXT,ERR_R_MALLOC_FAILURE);
2971                                 return -1;
2972                                 }
2973                         s->s3->client_opaque_prf_input_len = s->tlsext_opaque_prf_input_len;
2974                         }
2975
2976                 if (r == 2)
2977                         /* at callback's request, insist on receiving an appropriate server opaque PRF input */
2978                         s->s3->server_opaque_prf_input_len = s->tlsext_opaque_prf_input_len;
2979         }
2980 #endif
2981
2982         return 1;
2983         }
2984
2985 int ssl_prepare_serverhello_tlsext(SSL *s)
2986         {
2987         return 1;
2988         }
2989
2990 static int ssl_check_clienthello_tlsext_early(SSL *s)
2991         {
2992         int ret=SSL_TLSEXT_ERR_NOACK;
2993         int al = SSL_AD_UNRECOGNIZED_NAME;
2994
2995 #ifndef OPENSSL_NO_EC
2996         /* The handling of the ECPointFormats extension is done elsewhere, namely in
2997          * ssl3_choose_cipher in s3_lib.c.
2998          */
2999         /* The handling of the EllipticCurves extension is done elsewhere, namely in
3000          * ssl3_choose_cipher in s3_lib.c.
3001          */
3002 #endif
3003
3004         if (s->ctx != NULL && s->ctx->tlsext_servername_callback != 0)
3005                 ret = s->ctx->tlsext_servername_callback(s, &al, s->ctx->tlsext_servername_arg);
3006         else if (s->initial_ctx != NULL && s->initial_ctx->tlsext_servername_callback != 0)
3007                 ret = s->initial_ctx->tlsext_servername_callback(s, &al, s->initial_ctx->tlsext_servername_arg);
3008
3009 #ifdef TLSEXT_TYPE_opaque_prf_input
3010         {
3011                 /* This sort of belongs into ssl_prepare_serverhello_tlsext(),
3012                  * but we might be sending an alert in response to the client hello,
3013                  * so this has to happen here in
3014                  * ssl_check_clienthello_tlsext_early(). */
3015
3016                 int r = 1;
3017
3018                 if (s->ctx->tlsext_opaque_prf_input_callback != 0)
3019                         {
3020                         r = s->ctx->tlsext_opaque_prf_input_callback(s, NULL, 0, s->ctx->tlsext_opaque_prf_input_callback_arg);
3021                         if (!r)
3022                                 {
3023                                 ret = SSL_TLSEXT_ERR_ALERT_FATAL;
3024                                 al = SSL_AD_INTERNAL_ERROR;
3025                                 goto err;
3026                                 }
3027                         }
3028
3029                 if (s->s3->server_opaque_prf_input != NULL) /* shouldn't really happen */
3030                         OPENSSL_free(s->s3->server_opaque_prf_input);
3031                 s->s3->server_opaque_prf_input = NULL;
3032
3033                 if (s->tlsext_opaque_prf_input != NULL)
3034                         {
3035                         if (s->s3->client_opaque_prf_input != NULL &&
3036                                 s->s3->client_opaque_prf_input_len == s->tlsext_opaque_prf_input_len)
3037                                 {
3038                                 /* can only use this extension if we have a server opaque PRF input
3039                                  * of the same length as the client opaque PRF input! */
3040
3041                                 if (s->tlsext_opaque_prf_input_len == 0)
3042                                         s->s3->server_opaque_prf_input = OPENSSL_malloc(1); /* dummy byte just to get non-NULL */
3043                                 else
3044                                         s->s3->server_opaque_prf_input = BUF_memdup(s->tlsext_opaque_prf_input, s->tlsext_opaque_prf_input_len);
3045                                 if (s->s3->server_opaque_prf_input == NULL)
3046                                         {
3047                                         ret = SSL_TLSEXT_ERR_ALERT_FATAL;
3048                                         al = SSL_AD_INTERNAL_ERROR;
3049                                         goto err;
3050                                         }
3051                                 s->s3->server_opaque_prf_input_len = s->tlsext_opaque_prf_input_len;
3052                                 }
3053                         }
3054
3055                 if (r == 2 && s->s3->server_opaque_prf_input == NULL)
3056                         {
3057                         /* The callback wants to enforce use of the extension,
3058                          * but we can't do that with the client opaque PRF input;
3059                          * abort the handshake.
3060                          */
3061                         ret = SSL_TLSEXT_ERR_ALERT_FATAL;
3062                         al = SSL_AD_HANDSHAKE_FAILURE;
3063                         }
3064         }
3065
3066  err:
3067 #endif
3068         switch (ret)
3069                 {
3070                 case SSL_TLSEXT_ERR_ALERT_FATAL:
3071                         ssl3_send_alert(s,SSL3_AL_FATAL,al);
3072                         return -1;
3073
3074                 case SSL_TLSEXT_ERR_ALERT_WARNING:
3075                         ssl3_send_alert(s,SSL3_AL_WARNING,al);
3076                         return 1;
3077
3078                 case SSL_TLSEXT_ERR_NOACK:
3079                         s->servername_done=0;
3080                         default:
3081                 return 1;
3082                 }
3083         }
3084
3085 int tls1_set_server_sigalgs(SSL *s)
3086         {
3087         int al;
3088         size_t i;
3089         /* Clear any shared sigtnature algorithms */
3090         if (s->cert->shared_sigalgs)
3091                 {
3092                 OPENSSL_free(s->cert->shared_sigalgs);
3093                 s->cert->shared_sigalgs = NULL;
3094                 }
3095         /* Clear certificate digests and validity flags */
3096         for (i = 0; i < SSL_PKEY_NUM; i++)
3097                 {
3098                 s->cert->pkeys[i].digest = NULL;
3099                 s->cert->pkeys[i].valid_flags = 0;
3100                 }
3101
3102         /* If sigalgs received process it. */
3103         if (s->cert->peer_sigalgs)
3104                 {
3105                 if (!tls1_process_sigalgs(s))
3106                         {
3107                         SSLerr(SSL_F_TLS1_SET_SERVER_SIGALGS,
3108                                         ERR_R_MALLOC_FAILURE);
3109                         al = SSL_AD_INTERNAL_ERROR;
3110                         goto err;
3111                         }
3112                 /* Fatal error is no shared signature algorithms */
3113                 if (!s->cert->shared_sigalgs)
3114                         {
3115                         SSLerr(SSL_F_TLS1_SET_SERVER_SIGALGS,
3116                                         SSL_R_NO_SHARED_SIGATURE_ALGORITHMS);
3117                         al = SSL_AD_ILLEGAL_PARAMETER;
3118                         goto err;
3119                         }
3120                 }
3121         else
3122                 ssl_cert_set_default_md(s->cert);
3123         return 1;
3124         err:
3125         ssl3_send_alert(s, SSL3_AL_FATAL, al);
3126         return 0;
3127         }
3128
3129 int ssl_check_clienthello_tlsext_late(SSL *s)
3130         {
3131         int ret = SSL_TLSEXT_ERR_OK;
3132         int al;
3133
3134         /* If status request then ask callback what to do.
3135          * Note: this must be called after servername callbacks in case
3136          * the certificate has changed, and must be called after the cipher
3137          * has been chosen because this may influence which certificate is sent
3138          */
3139         if ((s->tlsext_status_type != -1) && s->ctx && s->ctx->tlsext_status_cb)
3140                 {
3141                 int r;
3142                 CERT_PKEY *certpkey;
3143                 certpkey = ssl_get_server_send_pkey(s);
3144                 /* If no certificate can't return certificate status */
3145                 if (certpkey == NULL)
3146                         {
3147                         s->tlsext_status_expected = 0;
3148                         return 1;
3149                         }
3150                 /* Set current certificate to one we will use so
3151                  * SSL_get_certificate et al can pick it up.
3152                  */
3153                 s->cert->key = certpkey;
3154                 r = s->ctx->tlsext_status_cb(s, s->ctx->tlsext_status_arg);
3155                 switch (r)
3156                         {
3157                         /* We don't want to send a status request response */
3158                         case SSL_TLSEXT_ERR_NOACK:
3159                                 s->tlsext_status_expected = 0;
3160                                 break;
3161                         /* status request response should be sent */
3162                         case SSL_TLSEXT_ERR_OK:
3163                                 if (s->tlsext_ocsp_resp)
3164                                         s->tlsext_status_expected = 1;
3165                                 else
3166                                         s->tlsext_status_expected = 0;
3167                                 break;
3168                         /* something bad happened */
3169                         case SSL_TLSEXT_ERR_ALERT_FATAL:
3170                                 ret = SSL_TLSEXT_ERR_ALERT_FATAL;
3171                                 al = SSL_AD_INTERNAL_ERROR;
3172                                 goto err;
3173                         }
3174                 }
3175         else
3176                 s->tlsext_status_expected = 0;
3177
3178  err:
3179         switch (ret)
3180                 {
3181                 case SSL_TLSEXT_ERR_ALERT_FATAL:
3182                         ssl3_send_alert(s, SSL3_AL_FATAL, al);
3183                         return -1;
3184
3185                 case SSL_TLSEXT_ERR_ALERT_WARNING:
3186                         ssl3_send_alert(s, SSL3_AL_WARNING, al);
3187                         return 1;
3188
3189                 default:
3190                         return 1;
3191                 }
3192         }
3193
3194 int ssl_check_serverhello_tlsext(SSL *s)
3195         {
3196         int ret=SSL_TLSEXT_ERR_NOACK;
3197         int al = SSL_AD_UNRECOGNIZED_NAME;
3198
3199 #ifndef OPENSSL_NO_EC
3200         /* If we are client and using an elliptic curve cryptography cipher
3201          * suite, then if server returns an EC point formats lists extension
3202          * it must contain uncompressed.
3203          */
3204         unsigned long alg_k = s->s3->tmp.new_cipher->algorithm_mkey;
3205         unsigned long alg_a = s->s3->tmp.new_cipher->algorithm_auth;
3206         if ((s->tlsext_ecpointformatlist != NULL) && (s->tlsext_ecpointformatlist_length > 0) &&
3207             (s->session->tlsext_ecpointformatlist != NULL) && (s->session->tlsext_ecpointformatlist_length > 0) &&
3208             ((alg_k & (SSL_kEECDH|SSL_kECDHr|SSL_kECDHe)) || (alg_a & SSL_aECDSA)))
3209                 {
3210                 /* we are using an ECC cipher */
3211                 size_t i;
3212                 unsigned char *list;
3213                 int found_uncompressed = 0;
3214                 list = s->session->tlsext_ecpointformatlist;
3215                 for (i = 0; i < s->session->tlsext_ecpointformatlist_length; i++)
3216                         {
3217                         if (*(list++) == TLSEXT_ECPOINTFORMAT_uncompressed)
3218                                 {
3219                                 found_uncompressed = 1;
3220                                 break;
3221                                 }
3222                         }
3223                 if (!found_uncompressed)
3224                         {
3225                         SSLerr(SSL_F_SSL_CHECK_SERVERHELLO_TLSEXT,SSL_R_TLS_INVALID_ECPOINTFORMAT_LIST);
3226                         return -1;
3227                         }
3228                 }
3229         ret = SSL_TLSEXT_ERR_OK;
3230 #endif /* OPENSSL_NO_EC */
3231
3232         if (s->ctx != NULL && s->ctx->tlsext_servername_callback != 0)
3233                 ret = s->ctx->tlsext_servername_callback(s, &al, s->ctx->tlsext_servername_arg);
3234         else if (s->initial_ctx != NULL && s->initial_ctx->tlsext_servername_callback != 0)
3235                 ret = s->initial_ctx->tlsext_servername_callback(s, &al, s->initial_ctx->tlsext_servername_arg);
3236
3237 #ifdef TLSEXT_TYPE_opaque_prf_input
3238         if (s->s3->server_opaque_prf_input_len > 0)
3239                 {
3240                 /* This case may indicate that we, as a client, want to insist on using opaque PRF inputs.
3241                  * So first verify that we really have a value from the server too. */
3242
3243                 if (s->s3->server_opaque_prf_input == NULL)
3244                         {
3245                         ret = SSL_TLSEXT_ERR_ALERT_FATAL;
3246                         al = SSL_AD_HANDSHAKE_FAILURE;
3247                         }
3248
3249                 /* Anytime the server *has* sent an opaque PRF input, we need to check
3250                  * that we have a client opaque PRF input of the same size. */
3251                 if (s->s3->client_opaque_prf_input == NULL ||
3252                     s->s3->client_opaque_prf_input_len != s->s3->server_opaque_prf_input_len)
3253                         {
3254                         ret = SSL_TLSEXT_ERR_ALERT_FATAL;
3255                         al = SSL_AD_ILLEGAL_PARAMETER;
3256                         }
3257                 }
3258 #endif
3259
3260         /* If we've requested certificate status and we wont get one
3261          * tell the callback
3262          */
3263         if ((s->tlsext_status_type != -1) && !(s->tlsext_status_expected)
3264                         && s->ctx && s->ctx->tlsext_status_cb)
3265                 {
3266                 int r;
3267                 /* Set resp to NULL, resplen to -1 so callback knows
3268                  * there is no response.
3269                  */
3270                 if (s->tlsext_ocsp_resp)
3271                         {
3272                         OPENSSL_free(s->tlsext_ocsp_resp);
3273                         s->tlsext_ocsp_resp = NULL;
3274                         }
3275                 s->tlsext_ocsp_resplen = -1;
3276                 r = s->ctx->tlsext_status_cb(s, s->ctx->tlsext_status_arg);
3277                 if (r == 0)
3278                         {
3279                         al = SSL_AD_BAD_CERTIFICATE_STATUS_RESPONSE;
3280                         ret = SSL_TLSEXT_ERR_ALERT_FATAL;
3281                         }
3282                 if (r < 0)
3283                         {
3284                         al = SSL_AD_INTERNAL_ERROR;
3285                         ret = SSL_TLSEXT_ERR_ALERT_FATAL;
3286                         }
3287                 }
3288
3289         switch (ret)
3290                 {
3291                 case SSL_TLSEXT_ERR_ALERT_FATAL:
3292                         ssl3_send_alert(s,SSL3_AL_FATAL,al);
3293                         return -1;
3294
3295                 case SSL_TLSEXT_ERR_ALERT_WARNING:
3296                         ssl3_send_alert(s,SSL3_AL_WARNING,al);
3297                         return 1;
3298
3299                 case SSL_TLSEXT_ERR_NOACK:
3300                         s->servername_done=0;
3301                         default:
3302                 return 1;
3303                 }
3304         }
3305
3306 int ssl_parse_serverhello_tlsext(SSL *s, unsigned char **p, unsigned char *d, int n)
3307         {
3308         int al = -1;
3309         if (s->version < SSL3_VERSION)
3310                 return 1;
3311         if (ssl_scan_serverhello_tlsext(s, p, d, n, &al) <= 0)
3312                 {
3313                 ssl3_send_alert(s,SSL3_AL_FATAL,al);
3314                 return 0;
3315                 }
3316
3317         if (ssl_check_serverhello_tlsext(s) <= 0)
3318                 {
3319                 SSLerr(SSL_F_SSL_PARSE_SERVERHELLO_TLSEXT,SSL_R_SERVERHELLO_TLSEXT);
3320                 return 0;
3321                 }
3322         return 1;
3323 }
3324
3325 /*-
3326  * Since the server cache lookup is done early on in the processing of the
3327  * ClientHello, and other operations depend on the result, we need to handle
3328  * any TLS session ticket extension at the same time.
3329  *
3330  *   session_id: points at the session ID in the ClientHello. This code will
3331  *       read past the end of this in order to parse out the session ticket
3332  *       extension, if any.
3333  *   len: the length of the session ID.
3334  *   limit: a pointer to the first byte after the ClientHello.
3335  *   ret: (output) on return, if a ticket was decrypted, then this is set to
3336  *       point to the resulting session.
3337  *
3338  * If s->tls_session_secret_cb is set then we are expecting a pre-shared key
3339  * ciphersuite, in which case we have no use for session tickets and one will
3340  * never be decrypted, nor will s->tlsext_ticket_expected be set to 1.
3341  *
3342  * Returns:
3343  *   -1: fatal error, either from parsing or decrypting the ticket.
3344  *    0: no ticket was found (or was ignored, based on settings).
3345  *    1: a zero length extension was found, indicating that the client supports
3346  *       session tickets but doesn't currently have one to offer.
3347  *    2: either s->tls_session_secret_cb was set, or a ticket was offered but
3348  *       couldn't be decrypted because of a non-fatal error.
3349  *    3: a ticket was successfully decrypted and *ret was set.
3350  *
3351  * Side effects:
3352  *   Sets s->tlsext_ticket_expected to 1 if the server will have to issue
3353  *   a new session ticket to the client because the client indicated support
3354  *   (and s->tls_session_secret_cb is NULL) but the client either doesn't have
3355  *   a session ticket or we couldn't use the one it gave us, or if
3356  *   s->ctx->tlsext_ticket_key_cb asked to renew the client's ticket.
3357  *   Otherwise, s->tlsext_ticket_expected is set to 0.
3358  */
3359 int tls1_process_ticket(SSL *s, unsigned char *session_id, int len,
3360                         const unsigned char *limit, SSL_SESSION **ret)
3361         {
3362         /* Point after session ID in client hello */
3363         const unsigned char *p = session_id + len;
3364         unsigned short i;
3365
3366         *ret = NULL;
3367         s->tlsext_ticket_expected = 0;
3368
3369         /* If tickets disabled behave as if no ticket present
3370          * to permit stateful resumption.
3371          */
3372         if (SSL_get_options(s) & SSL_OP_NO_TICKET)
3373                 return 0;
3374         if ((s->version <= SSL3_VERSION) || !limit)
3375                 return 0;
3376         if (p >= limit)
3377                 return -1;
3378         /* Skip past DTLS cookie */
3379         if (SSL_IS_DTLS(s))
3380                 {
3381                 i = *(p++);
3382                 p+= i;
3383                 if (p >= limit)
3384                         return -1;
3385                 }
3386         /* Skip past cipher list */
3387         n2s(p, i);
3388         p+= i;
3389         if (p >= limit)
3390                 return -1;
3391         /* Skip past compression algorithm list */
3392         i = *(p++);
3393         p += i;
3394         if (p > limit)
3395                 return -1;
3396         /* Now at start of extensions */
3397         if ((p + 2) >= limit)
3398                 return 0;
3399         n2s(p, i);
3400         while ((p + 4) <= limit)
3401                 {
3402                 unsigned short type, size;
3403                 n2s(p, type);
3404                 n2s(p, size);
3405                 if (p + size > limit)
3406                         return 0;
3407                 if (type == TLSEXT_TYPE_session_ticket)
3408                         {
3409                         int r;
3410                         if (size == 0)
3411                                 {
3412                                 /* The client will accept a ticket but doesn't
3413                                  * currently have one. */
3414                                 s->tlsext_ticket_expected = 1;
3415                                 return 1;
3416                                 }
3417                         if (s->tls_session_secret_cb)
3418                                 {
3419                                 /* Indicate that the ticket couldn't be
3420                                  * decrypted rather than generating the session
3421                                  * from ticket now, trigger abbreviated
3422                                  * handshake based on external mechanism to
3423                                  * calculate the master secret later. */
3424                                 return 2;
3425                                 }
3426                         r = tls_decrypt_ticket(s, p, size, session_id, len, ret);
3427                         switch (r)
3428                                 {
3429                                 case 2: /* ticket couldn't be decrypted */
3430                                         s->tlsext_ticket_expected = 1;
3431                                         return 2;
3432                                 case 3: /* ticket was decrypted */
3433                                         return r;
3434                                 case 4: /* ticket decrypted but need to renew */
3435                                         s->tlsext_ticket_expected = 1;
3436                                         return 3;
3437                                 default: /* fatal error */
3438                                         return -1;
3439                                 }
3440                         }
3441                 p += size;
3442                 }
3443         return 0;
3444         }
3445
3446 /*-
3447  * tls_decrypt_ticket attempts to decrypt a session ticket.
3448  *
3449  *   etick: points to the body of the session ticket extension.
3450  *   eticklen: the length of the session tickets extenion.
3451  *   sess_id: points at the session ID.
3452  *   sesslen: the length of the session ID.
3453  *   psess: (output) on return, if a ticket was decrypted, then this is set to
3454  *       point to the resulting session.
3455  *
3456  * Returns:
3457  *   -1: fatal error, either from parsing or decrypting the ticket.
3458  *    2: the ticket couldn't be decrypted.
3459  *    3: a ticket was successfully decrypted and *psess was set.
3460  *    4: same as 3, but the ticket needs to be renewed.
3461  */
3462 static int tls_decrypt_ticket(SSL *s, const unsigned char *etick, int eticklen,
3463                                 const unsigned char *sess_id, int sesslen,
3464                                 SSL_SESSION **psess)
3465         {
3466         SSL_SESSION *sess;
3467         unsigned char *sdec;
3468         const unsigned char *p;
3469         int slen, mlen, renew_ticket = 0;
3470         unsigned char tick_hmac[EVP_MAX_MD_SIZE];
3471         HMAC_CTX hctx;
3472         EVP_CIPHER_CTX ctx;
3473         SSL_CTX *tctx = s->initial_ctx;
3474         /* Need at least keyname + iv + some encrypted data */
3475         if (eticklen < 48)
3476                 return 2;
3477         /* Initialize session ticket encryption and HMAC contexts */
3478         HMAC_CTX_init(&hctx);
3479         EVP_CIPHER_CTX_init(&ctx);
3480         if (tctx->tlsext_ticket_key_cb)
3481                 {
3482                 unsigned char *nctick = (unsigned char *)etick;
3483                 int rv = tctx->tlsext_ticket_key_cb(s, nctick, nctick + 16,
3484                                                         &ctx, &hctx, 0);
3485                 if (rv < 0)
3486                         return -1;
3487                 if (rv == 0)
3488                         return 2;
3489                 if (rv == 2)
3490                         renew_ticket = 1;
3491                 }
3492         else
3493                 {
3494                 /* Check key name matches */
3495                 if (memcmp(etick, tctx->tlsext_tick_key_name, 16))
3496                         return 2;
3497                 HMAC_Init_ex(&hctx, tctx->tlsext_tick_hmac_key, 16,
3498                                         tlsext_tick_md(), NULL);
3499                 EVP_DecryptInit_ex(&ctx, EVP_aes_128_cbc(), NULL,
3500                                 tctx->tlsext_tick_aes_key, etick + 16);
3501                 }
3502         /* Attempt to process session ticket, first conduct sanity and
3503          * integrity checks on ticket.
3504          */
3505         mlen = HMAC_size(&hctx);
3506         if (mlen < 0)
3507                 {
3508                 EVP_CIPHER_CTX_cleanup(&ctx);
3509                 return -1;
3510                 }
3511         eticklen -= mlen;
3512         /* Check HMAC of encrypted ticket */
3513         HMAC_Update(&hctx, etick, eticklen);
3514         HMAC_Final(&hctx, tick_hmac, NULL);
3515         HMAC_CTX_cleanup(&hctx);
3516         if (CRYPTO_memcmp(tick_hmac, etick + eticklen, mlen))
3517                 {
3518                 EVP_CIPHER_CTX_cleanup(&ctx);
3519                 return 2;
3520                 }
3521         /* Attempt to decrypt session data */
3522         /* Move p after IV to start of encrypted ticket, update length */
3523         p = etick + 16 + EVP_CIPHER_CTX_iv_length(&ctx);
3524         eticklen -= 16 + EVP_CIPHER_CTX_iv_length(&ctx);
3525         sdec = OPENSSL_malloc(eticklen);
3526         if (!sdec)
3527                 {
3528                 EVP_CIPHER_CTX_cleanup(&ctx);
3529                 return -1;
3530                 }
3531         EVP_DecryptUpdate(&ctx, sdec, &slen, p, eticklen);
3532         if (EVP_DecryptFinal(&ctx, sdec + slen, &mlen) <= 0)
3533                 {
3534                 EVP_CIPHER_CTX_cleanup(&ctx);
3535                 OPENSSL_free(sdec);
3536                 return 2;
3537                 }
3538         slen += mlen;
3539         EVP_CIPHER_CTX_cleanup(&ctx);
3540         p = sdec;
3541
3542         sess = d2i_SSL_SESSION(NULL, &p, slen);
3543         OPENSSL_free(sdec);
3544         if (sess)
3545                 {
3546                 /* The session ID, if non-empty, is used by some clients to
3547                  * detect that the ticket has been accepted. So we copy it to
3548                  * the session structure. If it is empty set length to zero
3549                  * as required by standard.
3550                  */
3551                 if (sesslen)
3552                         memcpy(sess->session_id, sess_id, sesslen);
3553                 sess->session_id_length = sesslen;
3554                 *psess = sess;
3555                 if (renew_ticket)
3556                         return 4;
3557                 else
3558                         return 3;
3559                 }
3560         ERR_clear_error();
3561         /* For session parse failure, indicate that we need to send a new
3562          * ticket. */
3563         return 2;
3564         }
3565
3566 /* Tables to translate from NIDs to TLS v1.2 ids */
3567
3568 typedef struct
3569         {
3570         int nid;
3571         int id;
3572         } tls12_lookup;
3573
3574 static tls12_lookup tls12_md[] = {
3575         {NID_md5, TLSEXT_hash_md5},
3576         {NID_sha1, TLSEXT_hash_sha1},
3577         {NID_sha224, TLSEXT_hash_sha224},
3578         {NID_sha256, TLSEXT_hash_sha256},
3579         {NID_sha384, TLSEXT_hash_sha384},
3580         {NID_sha512, TLSEXT_hash_sha512}
3581 };
3582
3583 static tls12_lookup tls12_sig[] = {
3584         {EVP_PKEY_RSA, TLSEXT_signature_rsa},
3585         {EVP_PKEY_DSA, TLSEXT_signature_dsa},
3586         {EVP_PKEY_EC, TLSEXT_signature_ecdsa}
3587 };
3588
3589 static int tls12_find_id(int nid, tls12_lookup *table, size_t tlen)
3590         {
3591         size_t i;
3592         for (i = 0; i < tlen; i++)
3593                 {
3594                 if (table[i].nid == nid)
3595                         return table[i].id;
3596                 }
3597         return -1;
3598         }
3599
3600 static int tls12_find_nid(int id, tls12_lookup *table, size_t tlen)
3601         {
3602         size_t i;
3603         for (i = 0; i < tlen; i++)
3604                 {
3605                 if ((table[i].id) == id)
3606                         return table[i].nid;
3607                 }
3608         return NID_undef;
3609         }
3610
3611 int tls12_get_sigandhash(unsigned char *p, const EVP_PKEY *pk, const EVP_MD *md)
3612         {
3613         int sig_id, md_id;
3614         if (!md)
3615                 return 0;
3616         md_id = tls12_find_id(EVP_MD_type(md), tls12_md,
3617                                 sizeof(tls12_md)/sizeof(tls12_lookup));
3618         if (md_id == -1)
3619                 return 0;
3620         sig_id = tls12_get_sigid(pk);
3621         if (sig_id == -1)
3622                 return 0;
3623         p[0] = (unsigned char)md_id;
3624         p[1] = (unsigned char)sig_id;
3625         return 1;
3626         }
3627
3628 int tls12_get_sigid(const EVP_PKEY *pk)
3629         {
3630         return tls12_find_id(pk->type, tls12_sig,
3631                                 sizeof(tls12_sig)/sizeof(tls12_lookup));
3632         }
3633
3634 const EVP_MD *tls12_get_hash(unsigned char hash_alg)
3635         {
3636         switch(hash_alg)
3637                 {
3638 #ifndef OPENSSL_NO_MD5
3639                 case TLSEXT_hash_md5:
3640 #ifdef OPENSSL_FIPS
3641                 if (FIPS_mode())
3642                         return NULL;
3643 #endif
3644                 return EVP_md5();
3645 #endif
3646 #ifndef OPENSSL_NO_SHA
3647                 case TLSEXT_hash_sha1:
3648                 return EVP_sha1();
3649 #endif
3650 #ifndef OPENSSL_NO_SHA256
3651                 case TLSEXT_hash_sha224:
3652                 return EVP_sha224();
3653
3654                 case TLSEXT_hash_sha256:
3655                 return EVP_sha256();
3656 #endif
3657 #ifndef OPENSSL_NO_SHA512
3658                 case TLSEXT_hash_sha384:
3659                 return EVP_sha384();
3660
3661                 case TLSEXT_hash_sha512:
3662                 return EVP_sha512();
3663 #endif
3664                 default:
3665                 return NULL;
3666
3667                 }
3668         }
3669
3670 static int tls12_get_pkey_idx(unsigned char sig_alg)
3671         {
3672         switch(sig_alg)
3673                 {
3674 #ifndef OPENSSL_NO_RSA
3675         case TLSEXT_signature_rsa:
3676                 return SSL_PKEY_RSA_SIGN;
3677 #endif
3678 #ifndef OPENSSL_NO_DSA
3679         case TLSEXT_signature_dsa:
3680                 return SSL_PKEY_DSA_SIGN;
3681 #endif
3682 #ifndef OPENSSL_NO_ECDSA
3683         case TLSEXT_signature_ecdsa:
3684                 return SSL_PKEY_ECC;
3685 #endif
3686                 }
3687         return -1;
3688         }
3689
3690 /* Convert TLS 1.2 signature algorithm extension values into NIDs */
3691 static void tls1_lookup_sigalg(int *phash_nid, int *psign_nid,
3692                         int *psignhash_nid, const unsigned char *data)
3693         {
3694         int sign_nid = 0, hash_nid = 0;
3695         if (!phash_nid && !psign_nid && !psignhash_nid)
3696                 return;
3697         if (phash_nid || psignhash_nid)
3698                 {
3699                 hash_nid = tls12_find_nid(data[0], tls12_md,
3700                                         sizeof(tls12_md)/sizeof(tls12_lookup));
3701                 if (phash_nid)
3702                         *phash_nid = hash_nid;
3703                 }
3704         if (psign_nid || psignhash_nid)
3705                 {
3706                 sign_nid = tls12_find_nid(data[1], tls12_sig,
3707                                         sizeof(tls12_sig)/sizeof(tls12_lookup));
3708                 if (psign_nid)
3709                         *psign_nid = sign_nid;
3710                 }
3711         if (psignhash_nid)
3712                 {
3713                 if (sign_nid && hash_nid)
3714                         OBJ_find_sigid_by_algs(psignhash_nid,
3715                                                         hash_nid, sign_nid);
3716                 else
3717                         *psignhash_nid = NID_undef;
3718                 }
3719         }
3720 /* Given preference and allowed sigalgs set shared sigalgs */
3721 static int tls12_do_shared_sigalgs(TLS_SIGALGS *shsig,
3722                                 const unsigned char *pref, size_t preflen,
3723                                 const unsigned char *allow, size_t allowlen)
3724         {
3725         const unsigned char *ptmp, *atmp;
3726         size_t i, j, nmatch = 0;
3727         for (i = 0, ptmp = pref; i < preflen; i+=2, ptmp+=2)
3728                 {
3729                 /* Skip disabled hashes or signature algorithms */
3730                 if (tls12_get_hash(ptmp[0]) == NULL)
3731                         continue;
3732                 if (tls12_get_pkey_idx(ptmp[1]) == -1)
3733                         continue;
3734                 for (j = 0, atmp = allow; j < allowlen; j+=2, atmp+=2)
3735                         {
3736                         if (ptmp[0] == atmp[0] && ptmp[1] == atmp[1])
3737                                 {
3738                                 nmatch++;
3739                                 if (shsig)
3740                                         {
3741                                         shsig->rhash = ptmp[0];
3742                                         shsig->rsign = ptmp[1];
3743                                         tls1_lookup_sigalg(&shsig->hash_nid,
3744                                                 &shsig->sign_nid,
3745                                                 &shsig->signandhash_nid,
3746                                                 ptmp);
3747                                         shsig++;
3748                                         }
3749                                 break;
3750                                 }
3751                         }
3752                 }
3753         return nmatch;
3754         }
3755
3756 /* Set shared signature algorithms for SSL structures */
3757 static int tls1_set_shared_sigalgs(SSL *s)
3758         {
3759         const unsigned char *pref, *allow, *conf;
3760         size_t preflen, allowlen, conflen;
3761         size_t nmatch;
3762         TLS_SIGALGS *salgs = NULL;
3763         CERT *c = s->cert;
3764         unsigned int is_suiteb = tls1_suiteb(s);
3765         if (c->shared_sigalgs)
3766                 {
3767                 OPENSSL_free(c->shared_sigalgs);
3768                 c->shared_sigalgs = NULL;
3769                 }
3770         /* If client use client signature algorithms if not NULL */
3771         if (!s->server && c->client_sigalgs && !is_suiteb)
3772                 {
3773                 conf = c->client_sigalgs;
3774                 conflen = c->client_sigalgslen;
3775                 }
3776         else if (c->conf_sigalgs && !is_suiteb)
3777                 {
3778                 conf = c->conf_sigalgs;
3779                 conflen = c->conf_sigalgslen;
3780                 }
3781         else
3782                 conflen = tls12_get_psigalgs(s, &conf);
3783         if(s->options & SSL_OP_CIPHER_SERVER_PREFERENCE || is_suiteb)
3784                 {
3785                 pref = conf;
3786                 preflen = conflen;
3787                 allow = c->peer_sigalgs;
3788                 allowlen = c->peer_sigalgslen;
3789                 }
3790         else
3791                 {
3792                 allow = conf;
3793                 allowlen = conflen;
3794                 pref = c->peer_sigalgs;
3795                 preflen = c->peer_sigalgslen;
3796                 }
3797         nmatch = tls12_do_shared_sigalgs(NULL, pref, preflen, allow, allowlen);
3798         if (!nmatch)
3799                 return 1;
3800         salgs = OPENSSL_malloc(nmatch * sizeof(TLS_SIGALGS));
3801         if (!salgs)
3802                 return 0;
3803         nmatch = tls12_do_shared_sigalgs(salgs, pref, preflen, allow, allowlen);
3804         c->shared_sigalgs = salgs;
3805         c->shared_sigalgslen = nmatch;
3806         return 1;
3807         }
3808
3809
3810 /* Set preferred digest for each key type */
3811
3812 int tls1_save_sigalgs(SSL *s, const unsigned char *data, int dsize)
3813         {
3814         CERT *c = s->cert;
3815         /* Extension ignored for inappropriate versions */
3816         if (!SSL_USE_SIGALGS(s))
3817                 return 1;
3818         /* Should never happen */
3819         if (!c)
3820                 return 0;
3821
3822         if (c->peer_sigalgs)
3823                 OPENSSL_free(c->peer_sigalgs);
3824         c->peer_sigalgs = OPENSSL_malloc(dsize);
3825         if (!c->peer_sigalgs)
3826                 return 0;
3827         c->peer_sigalgslen = dsize;
3828         memcpy(c->peer_sigalgs, data, dsize);
3829         return 1;
3830         }
3831
3832 int tls1_process_sigalgs(SSL *s)
3833         {
3834         int idx;
3835         size_t i;
3836         const EVP_MD *md;
3837         CERT *c = s->cert;
3838         TLS_SIGALGS *sigptr;
3839         if (!tls1_set_shared_sigalgs(s))
3840                 return 0;
3841
3842 #ifdef OPENSSL_SSL_DEBUG_BROKEN_PROTOCOL
3843         if (s->cert->cert_flags & SSL_CERT_FLAG_BROKEN_PROTOCOL)
3844                 {
3845                 /* Use first set signature preference to force message
3846                  * digest, ignoring any peer preferences.
3847                  */
3848                 const unsigned char *sigs = NULL;
3849                 if (s->server)
3850                         sigs = c->conf_sigalgs;
3851                 else
3852                         sigs = c->client_sigalgs;
3853                 if (sigs)
3854                         {
3855                         idx = tls12_get_pkey_idx(sigs[1]);
3856                         md = tls12_get_hash(sigs[0]);
3857                         c->pkeys[idx].digest = md;
3858                         c->pkeys[idx].valid_flags = CERT_PKEY_EXPLICIT_SIGN;
3859                         if (idx == SSL_PKEY_RSA_SIGN)
3860                                 {
3861                                 c->pkeys[SSL_PKEY_RSA_ENC].valid_flags = CERT_PKEY_EXPLICIT_SIGN;
3862                                 c->pkeys[SSL_PKEY_RSA_ENC].digest = md;
3863                                 }
3864                         }
3865                 }
3866 #endif
3867
3868         for (i = 0, sigptr = c->shared_sigalgs;
3869                         i < c->shared_sigalgslen; i++, sigptr++)
3870                 {
3871                 idx = tls12_get_pkey_idx(sigptr->rsign);
3872                 if (idx > 0 && c->pkeys[idx].digest == NULL)
3873                         {
3874                         md = tls12_get_hash(sigptr->rhash);
3875                         c->pkeys[idx].digest = md;
3876                         c->pkeys[idx].valid_flags = CERT_PKEY_EXPLICIT_SIGN;
3877                         if (idx == SSL_PKEY_RSA_SIGN)
3878                                 {
3879                                 c->pkeys[SSL_PKEY_RSA_ENC].valid_flags = CERT_PKEY_EXPLICIT_SIGN;
3880                                 c->pkeys[SSL_PKEY_RSA_ENC].digest = md;
3881                                 }
3882                         }
3883
3884                 }
3885         /* In strict mode leave unset digests as NULL to indicate we can't
3886          * use the certificate for signing.
3887          */
3888         if (!(s->cert->cert_flags & SSL_CERT_FLAGS_CHECK_TLS_STRICT))
3889                 {
3890                 /* Set any remaining keys to default values. NOTE: if alg is
3891                  * not supported it stays as NULL.
3892                  */
3893 #ifndef OPENSSL_NO_DSA
3894                 if (!c->pkeys[SSL_PKEY_DSA_SIGN].digest)
3895                         c->pkeys[SSL_PKEY_DSA_SIGN].digest = EVP_sha1();
3896 #endif
3897 #ifndef OPENSSL_NO_RSA
3898                 if (!c->pkeys[SSL_PKEY_RSA_SIGN].digest)
3899                         {
3900                         c->pkeys[SSL_PKEY_RSA_SIGN].digest = EVP_sha1();
3901                         c->pkeys[SSL_PKEY_RSA_ENC].digest = EVP_sha1();
3902                         }
3903 #endif
3904 #ifndef OPENSSL_NO_ECDSA
3905                 if (!c->pkeys[SSL_PKEY_ECC].digest)
3906                         c->pkeys[SSL_PKEY_ECC].digest = EVP_sha1();
3907 #endif
3908                 }
3909         return 1;
3910         }
3911
3912
3913 int SSL_get_sigalgs(SSL *s, int idx,
3914                         int *psign, int *phash, int *psignhash,
3915                         unsigned char *rsig, unsigned char *rhash)
3916         {
3917         const unsigned char *psig = s->cert->peer_sigalgs;
3918         if (psig == NULL)
3919                 return 0;
3920         if (idx >= 0)
3921                 {
3922                 idx <<= 1;
3923                 if (idx >= (int)s->cert->peer_sigalgslen)
3924                         return 0;
3925                 psig += idx;
3926                 if (rhash)
3927                         *rhash = psig[0];
3928                 if (rsig)
3929                         *rsig = psig[1];
3930                 tls1_lookup_sigalg(phash, psign, psignhash, psig);
3931                 }
3932         return s->cert->peer_sigalgslen / 2;
3933         }
3934
3935 int SSL_get_shared_sigalgs(SSL *s, int idx,
3936                         int *psign, int *phash, int *psignhash,
3937                         unsigned char *rsig, unsigned char *rhash)
3938         {
3939         TLS_SIGALGS *shsigalgs = s->cert->shared_sigalgs;
3940         if (!shsigalgs || idx >= (int)s->cert->shared_sigalgslen)
3941                 return 0;
3942         shsigalgs += idx;
3943         if (phash)
3944                 *phash = shsigalgs->hash_nid;
3945         if (psign)
3946                 *psign = shsigalgs->sign_nid;
3947         if (psignhash)
3948                 *psignhash = shsigalgs->signandhash_nid;
3949         if (rsig)
3950                 *rsig = shsigalgs->rsign;
3951         if (rhash)
3952                 *rhash = shsigalgs->rhash;
3953         return s->cert->shared_sigalgslen;
3954         }
3955
3956
3957 #ifndef OPENSSL_NO_HEARTBEATS
3958 int
3959 tls1_process_heartbeat(SSL *s)
3960         {
3961         unsigned char *p = &s->s3->rrec.data[0], *pl;
3962         unsigned short hbtype;
3963         unsigned int payload;
3964         unsigned int padding = 16; /* Use minimum padding */
3965
3966         if (s->msg_callback)
3967                 s->msg_callback(0, s->version, TLS1_RT_HEARTBEAT,
3968                         &s->s3->rrec.data[0], s->s3->rrec.length,
3969                         s, s->msg_callback_arg);
3970
3971         /* Read type and payload length first */
3972         if (1 + 2 + 16 > s->s3->rrec.length)
3973                 return 0; /* silently discard */
3974         hbtype = *p++;
3975         n2s(p, payload);
3976         if (1 + 2 + payload + 16 > s->s3->rrec.length)
3977                 return 0; /* silently discard per RFC 6520 sec. 4 */
3978         pl = p;
3979
3980         if (hbtype == TLS1_HB_REQUEST)
3981                 {
3982                 unsigned char *buffer, *bp;
3983                 int r;
3984
3985                 /* Allocate memory for the response, size is 1 bytes
3986                  * message type, plus 2 bytes payload length, plus
3987                  * payload, plus padding
3988                  */
3989                 buffer = OPENSSL_malloc(1 + 2 + payload + padding);
3990                 bp = buffer;
3991
3992                 /* Enter response type, length and copy payload */
3993                 *bp++ = TLS1_HB_RESPONSE;
3994                 s2n(payload, bp);
3995                 memcpy(bp, pl, payload);
3996                 bp += payload;
3997                 /* Random padding */
3998                 RAND_pseudo_bytes(bp, padding);
3999
4000                 r = ssl3_write_bytes(s, TLS1_RT_HEARTBEAT, buffer, 3 + payload + padding);
4001
4002                 if (r >= 0 && s->msg_callback)
4003                         s->msg_callback(1, s->version, TLS1_RT_HEARTBEAT,
4004                                 buffer, 3 + payload + padding,
4005                                 s, s->msg_callback_arg);
4006
4007                 OPENSSL_free(buffer);
4008
4009                 if (r < 0)
4010                         return r;
4011                 }
4012         else if (hbtype == TLS1_HB_RESPONSE)
4013                 {
4014                 unsigned int seq;
4015
4016                 /* We only send sequence numbers (2 bytes unsigned int),
4017                  * and 16 random bytes, so we just try to read the
4018                  * sequence number */
4019                 n2s(pl, seq);
4020
4021                 if (payload == 18 && seq == s->tlsext_hb_seq)
4022                         {
4023                         s->tlsext_hb_seq++;
4024                         s->tlsext_hb_pending = 0;
4025                         }
4026                 }
4027
4028         return 0;
4029         }
4030
4031 int
4032 tls1_heartbeat(SSL *s)
4033         {
4034         unsigned char *buf, *p;
4035         int ret;
4036         unsigned int payload = 18; /* Sequence number + random bytes */
4037         unsigned int padding = 16; /* Use minimum padding */
4038
4039         /* Only send if peer supports and accepts HB requests... */
4040         if (!(s->tlsext_heartbeat & SSL_TLSEXT_HB_ENABLED) ||
4041             s->tlsext_heartbeat & SSL_TLSEXT_HB_DONT_SEND_REQUESTS)
4042                 {
4043                 SSLerr(SSL_F_TLS1_HEARTBEAT,SSL_R_TLS_HEARTBEAT_PEER_DOESNT_ACCEPT);
4044                 return -1;
4045                 }
4046
4047         /* ...and there is none in flight yet... */
4048         if (s->tlsext_hb_pending)
4049                 {
4050                 SSLerr(SSL_F_TLS1_HEARTBEAT,SSL_R_TLS_HEARTBEAT_PENDING);
4051                 return -1;
4052                 }
4053
4054         /* ...and no handshake in progress. */
4055         if (SSL_in_init(s) || s->in_handshake)
4056                 {
4057                 SSLerr(SSL_F_TLS1_HEARTBEAT,SSL_R_UNEXPECTED_MESSAGE);
4058                 return -1;
4059                 }
4060
4061         /* Check if padding is too long, payload and padding
4062          * must not exceed 2^14 - 3 = 16381 bytes in total.
4063          */
4064         OPENSSL_assert(payload + padding <= 16381);
4065
4066         /*-
4067          * Create HeartBeat message, we just use a sequence number
4068          * as payload to distuingish different messages and add
4069          * some random stuff.
4070          *  - Message Type, 1 byte
4071          *  - Payload Length, 2 bytes (unsigned int)
4072          *  - Payload, the sequence number (2 bytes uint)
4073          *  - Payload, random bytes (16 bytes uint)
4074          *  - Padding
4075          */
4076         buf = OPENSSL_malloc(1 + 2 + payload + padding);
4077         p = buf;
4078         /* Message Type */
4079         *p++ = TLS1_HB_REQUEST;
4080         /* Payload length (18 bytes here) */
4081         s2n(payload, p);
4082         /* Sequence number */
4083         s2n(s->tlsext_hb_seq, p);
4084         /* 16 random bytes */
4085         RAND_pseudo_bytes(p, 16);
4086         p += 16;
4087         /* Random padding */
4088         RAND_pseudo_bytes(p, padding);
4089
4090         ret = ssl3_write_bytes(s, TLS1_RT_HEARTBEAT, buf, 3 + payload + padding);
4091         if (ret >= 0)
4092                 {
4093                 if (s->msg_callback)
4094                         s->msg_callback(1, s->version, TLS1_RT_HEARTBEAT,
4095                                 buf, 3 + payload + padding,
4096                                 s, s->msg_callback_arg);
4097
4098                 s->tlsext_hb_pending = 1;
4099                 }
4100
4101         OPENSSL_free(buf);
4102
4103         return ret;
4104         }
4105 #endif
4106
4107 #define MAX_SIGALGLEN   (TLSEXT_hash_num * TLSEXT_signature_num * 2)
4108
4109 typedef struct
4110         {
4111         size_t sigalgcnt;
4112         int sigalgs[MAX_SIGALGLEN];
4113         } sig_cb_st;
4114
4115 static int sig_cb(const char *elem, int len, void *arg)
4116         {
4117         sig_cb_st *sarg = arg;
4118         size_t i;
4119         char etmp[20], *p;
4120         int sig_alg, hash_alg;
4121         if (sarg->sigalgcnt == MAX_SIGALGLEN)
4122                 return 0;
4123         if (len > (int)(sizeof(etmp) - 1))
4124                 return 0;
4125         memcpy(etmp, elem, len);
4126         etmp[len] = 0;
4127         p = strchr(etmp, '+');
4128         if (!p)
4129                 return 0;
4130         *p = 0;
4131         p++;
4132         if (!*p)
4133                 return 0;
4134
4135         if (!strcmp(etmp, "RSA"))
4136                 sig_alg = EVP_PKEY_RSA;
4137         else if (!strcmp(etmp, "DSA"))
4138                 sig_alg = EVP_PKEY_DSA;
4139         else if (!strcmp(etmp, "ECDSA"))
4140                 sig_alg = EVP_PKEY_EC;
4141         else return 0;
4142
4143         hash_alg = OBJ_sn2nid(p);
4144         if (hash_alg == NID_undef)
4145                 hash_alg = OBJ_ln2nid(p);
4146         if (hash_alg == NID_undef)
4147                 return 0;
4148
4149         for (i = 0; i < sarg->sigalgcnt; i+=2)
4150                 {
4151                 if (sarg->sigalgs[i] == sig_alg
4152                         && sarg->sigalgs[i + 1] == hash_alg)
4153                         return 0;
4154                 }
4155         sarg->sigalgs[sarg->sigalgcnt++] = hash_alg;
4156         sarg->sigalgs[sarg->sigalgcnt++] = sig_alg;
4157         return 1;
4158         }
4159
4160 /* Set suppored signature algorithms based on a colon separated list
4161  * of the form sig+hash e.g. RSA+SHA512:DSA+SHA512 */
4162 int tls1_set_sigalgs_list(CERT *c, const char *str, int client)
4163         {
4164         sig_cb_st sig;
4165         sig.sigalgcnt = 0;
4166         if (!CONF_parse_list(str, ':', 1, sig_cb, &sig))
4167                 return 0;
4168         if (c == NULL)
4169                 return 1;
4170         return tls1_set_sigalgs(c, sig.sigalgs, sig.sigalgcnt, client);
4171         }
4172
4173 int tls1_set_sigalgs(CERT *c, const int *psig_nids, size_t salglen, int client)
4174         {
4175         unsigned char *sigalgs, *sptr;
4176         int rhash, rsign;
4177         size_t i;
4178         if (salglen & 1)
4179                 return 0;
4180         sigalgs = OPENSSL_malloc(salglen);
4181         if (sigalgs == NULL)
4182                 return 0;
4183         for (i = 0, sptr = sigalgs; i < salglen; i+=2)
4184                 {
4185                 rhash = tls12_find_id(*psig_nids++, tls12_md,
4186                                         sizeof(tls12_md)/sizeof(tls12_lookup));
4187                 rsign = tls12_find_id(*psig_nids++, tls12_sig,
4188                                 sizeof(tls12_sig)/sizeof(tls12_lookup));
4189
4190                 if (rhash == -1 || rsign == -1)
4191                         goto err;
4192                 *sptr++ = rhash;
4193                 *sptr++ = rsign;
4194                 }
4195
4196         if (client)
4197                 {
4198                 if (c->client_sigalgs)
4199                         OPENSSL_free(c->client_sigalgs);
4200                 c->client_sigalgs = sigalgs;
4201                 c->client_sigalgslen = salglen;
4202                 }
4203         else
4204                 {
4205                 if (c->conf_sigalgs)
4206                         OPENSSL_free(c->conf_sigalgs);
4207                 c->conf_sigalgs = sigalgs;
4208                 c->conf_sigalgslen = salglen;
4209                 }
4210
4211         return 1;
4212
4213         err:
4214         OPENSSL_free(sigalgs);
4215         return 0;
4216         }
4217
4218 static int tls1_check_sig_alg(CERT *c, X509 *x, int default_nid)
4219         {
4220         int sig_nid;
4221         size_t i;
4222         if (default_nid == -1)
4223                 return 1;
4224         sig_nid = X509_get_signature_nid(x);
4225         if (default_nid)
4226                 return sig_nid == default_nid ? 1 : 0;
4227         for (i = 0; i < c->shared_sigalgslen; i++)
4228                 if (sig_nid == c->shared_sigalgs[i].signandhash_nid)
4229                         return 1;
4230         return 0;
4231         }
4232 /* Check to see if a certificate issuer name matches list of CA names */
4233 static int ssl_check_ca_name(STACK_OF(X509_NAME) *names, X509 *x)
4234         {
4235         X509_NAME *nm;
4236         int i;
4237         nm = X509_get_issuer_name(x);
4238         for (i = 0; i < sk_X509_NAME_num(names); i++)
4239                 {
4240                 if(!X509_NAME_cmp(nm, sk_X509_NAME_value(names, i)))
4241                         return 1;
4242                 }
4243         return 0;
4244         }
4245
4246 /* Check certificate chain is consistent with TLS extensions and is
4247  * usable by server. This servers two purposes: it allows users to
4248  * check chains before passing them to the server and it allows the
4249  * server to check chains before attempting to use them.
4250  */
4251
4252 /* Flags which need to be set for a certificate when stict mode not set */
4253
4254 #define CERT_PKEY_VALID_FLAGS \
4255         (CERT_PKEY_EE_SIGNATURE|CERT_PKEY_EE_PARAM)
4256 /* Strict mode flags */
4257 #define CERT_PKEY_STRICT_FLAGS \
4258          (CERT_PKEY_VALID_FLAGS|CERT_PKEY_CA_SIGNATURE|CERT_PKEY_CA_PARAM \
4259          | CERT_PKEY_ISSUER_NAME|CERT_PKEY_CERT_TYPE)
4260
4261 int tls1_check_chain(SSL *s, X509 *x, EVP_PKEY *pk, STACK_OF(X509) *chain,
4262                                                                         int idx)
4263         {
4264         int i;
4265         int rv = 0;
4266         int check_flags = 0, strict_mode;
4267         CERT_PKEY *cpk = NULL;
4268         CERT *c = s->cert;
4269         unsigned int suiteb_flags = tls1_suiteb(s);
4270         /* idx == -1 means checking server chains */
4271         if (idx != -1)
4272                 {
4273                 /* idx == -2 means checking client certificate chains */
4274                 if (idx == -2)
4275                         {
4276                         cpk = c->key;
4277                         idx = cpk - c->pkeys;
4278                         }
4279                 else
4280                         cpk = c->pkeys + idx;
4281                 x = cpk->x509;
4282                 pk = cpk->privatekey;
4283                 chain = cpk->chain;
4284                 strict_mode = c->cert_flags & SSL_CERT_FLAGS_CHECK_TLS_STRICT;
4285                 /* If no cert or key, forget it */
4286                 if (!x || !pk)
4287                         goto end;
4288 #ifdef OPENSSL_SSL_DEBUG_BROKEN_PROTOCOL
4289                 /* Allow any certificate to pass test */
4290                 if (s->cert->cert_flags & SSL_CERT_FLAG_BROKEN_PROTOCOL)
4291                         {
4292                         rv = CERT_PKEY_STRICT_FLAGS|CERT_PKEY_EXPLICIT_SIGN|CERT_PKEY_VALID|CERT_PKEY_SIGN;
4293                         cpk->valid_flags = rv;
4294                         return rv;
4295                         }
4296 #endif
4297                 }
4298         else
4299                 {
4300                 if (!x || !pk)
4301                         goto end;
4302                 idx = ssl_cert_type(x, pk);
4303                 if (idx == -1)
4304                         goto end;
4305                 cpk = c->pkeys + idx;
4306                 if (c->cert_flags & SSL_CERT_FLAGS_CHECK_TLS_STRICT)
4307                         check_flags = CERT_PKEY_STRICT_FLAGS;
4308                 else
4309                         check_flags = CERT_PKEY_VALID_FLAGS;
4310                 strict_mode = 1;
4311                 }
4312
4313         if (suiteb_flags)
4314                 {
4315                 int ok;
4316                 if (check_flags)
4317                         check_flags |= CERT_PKEY_SUITEB;
4318                 ok = X509_chain_check_suiteb(NULL, x, chain, suiteb_flags);
4319                 if (ok == X509_V_OK)
4320                         rv |= CERT_PKEY_SUITEB;
4321                 else if (!check_flags)
4322                         goto end;
4323                 }
4324
4325         /* Check all signature algorithms are consistent with
4326          * signature algorithms extension if TLS 1.2 or later
4327          * and strict mode.
4328          */
4329         if (TLS1_get_version(s) >= TLS1_2_VERSION && strict_mode)
4330                 {
4331                 int default_nid;
4332                 unsigned char rsign = 0;
4333                 if (c->peer_sigalgs)
4334                         default_nid = 0;
4335                 /* If no sigalgs extension use defaults from RFC5246 */
4336                 else
4337                         {
4338                         switch(idx)
4339                                 {
4340                         case SSL_PKEY_RSA_ENC:
4341                         case SSL_PKEY_RSA_SIGN:
4342                         case SSL_PKEY_DH_RSA:
4343                                 rsign = TLSEXT_signature_rsa;
4344                                 default_nid = NID_sha1WithRSAEncryption;
4345                                 break;
4346
4347                         case SSL_PKEY_DSA_SIGN:
4348                         case SSL_PKEY_DH_DSA:
4349                                 rsign = TLSEXT_signature_dsa;
4350                                 default_nid = NID_dsaWithSHA1;
4351                                 break;
4352
4353                         case SSL_PKEY_ECC:
4354                                 rsign = TLSEXT_signature_ecdsa;
4355                                 default_nid = NID_ecdsa_with_SHA1;
4356                                 break;
4357
4358                         default:
4359                                 default_nid = -1;
4360                                 break;
4361                                 }
4362                         }
4363                 /* If peer sent no signature algorithms extension and we
4364                  * have set preferred signature algorithms check we support
4365                  * sha1.
4366                  */
4367                 if (default_nid > 0 && c->conf_sigalgs)
4368                         {
4369                         size_t j;
4370                         const unsigned char *p = c->conf_sigalgs;
4371                         for (j = 0; j < c->conf_sigalgslen; j += 2, p += 2)
4372                                 {
4373                                 if (p[0] == TLSEXT_hash_sha1 && p[1] == rsign)
4374                                         break;
4375                                 }
4376                         if (j == c->conf_sigalgslen)
4377                                 {
4378                                 if (check_flags)
4379                                         goto skip_sigs;
4380                                 else
4381                                         goto end;
4382                                 }
4383                         }
4384                 /* Check signature algorithm of each cert in chain */
4385                 if (!tls1_check_sig_alg(c, x, default_nid))
4386                         {
4387                         if (!check_flags) goto end;
4388                         }
4389                 else
4390                         rv |= CERT_PKEY_EE_SIGNATURE;
4391                 rv |= CERT_PKEY_CA_SIGNATURE;
4392                 for (i = 0; i < sk_X509_num(chain); i++)
4393                         {
4394                         if (!tls1_check_sig_alg(c, sk_X509_value(chain, i),
4395                                                         default_nid))
4396                                 {
4397                                 if (check_flags)
4398                                         {
4399                                         rv &= ~CERT_PKEY_CA_SIGNATURE;
4400                                         break;
4401                                         }
4402                                 else
4403                                         goto end;
4404                                 }
4405                         }
4406                 }
4407         /* Else not TLS 1.2, so mark EE and CA signing algorithms OK */
4408         else if(check_flags)
4409                 rv |= CERT_PKEY_EE_SIGNATURE|CERT_PKEY_CA_SIGNATURE;
4410         skip_sigs:
4411         /* Check cert parameters are consistent */
4412         if (tls1_check_cert_param(s, x, check_flags ? 1 : 2))
4413                 rv |= CERT_PKEY_EE_PARAM;
4414         else if (!check_flags)
4415                 goto end;
4416         if (!s->server)
4417                 rv |= CERT_PKEY_CA_PARAM;
4418         /* In strict mode check rest of chain too */
4419         else if (strict_mode)
4420                 {
4421                 rv |= CERT_PKEY_CA_PARAM;
4422                 for (i = 0; i < sk_X509_num(chain); i++)
4423                         {
4424                         X509 *ca = sk_X509_value(chain, i);
4425                         if (!tls1_check_cert_param(s, ca, 0))
4426                                 {
4427                                 if (check_flags)
4428                                         {
4429                                         rv &= ~CERT_PKEY_CA_PARAM;
4430                                         break;
4431                                         }
4432                                 else
4433                                         goto end;
4434                                 }
4435                         }
4436                 }
4437         if (!s->server && strict_mode)
4438                 {
4439                 STACK_OF(X509_NAME) *ca_dn;
4440                 int check_type = 0;
4441                 switch (pk->type)
4442                         {
4443                 case EVP_PKEY_RSA:
4444                         check_type = TLS_CT_RSA_SIGN;
4445                         break;
4446                 case EVP_PKEY_DSA:
4447                         check_type = TLS_CT_DSS_SIGN;
4448                         break;
4449                 case EVP_PKEY_EC:
4450                         check_type = TLS_CT_ECDSA_SIGN;
4451                         break;
4452                 case EVP_PKEY_DH:
4453                 case EVP_PKEY_DHX:
4454                                 {
4455                                 int cert_type = X509_certificate_type(x, pk);
4456                                 if (cert_type & EVP_PKS_RSA)
4457                                         check_type = TLS_CT_RSA_FIXED_DH;
4458                                 if (cert_type & EVP_PKS_DSA)
4459                                         check_type = TLS_CT_DSS_FIXED_DH;
4460                                 }
4461                         }
4462                 if (check_type)
4463                         {
4464                         const unsigned char *ctypes;
4465                         int ctypelen;
4466                         if (c->ctypes)
4467                                 {
4468                                 ctypes = c->ctypes;
4469                                 ctypelen = (int)c->ctype_num;
4470                                 }
4471                         else
4472                                 {
4473                                 ctypes = (unsigned char *)s->s3->tmp.ctype;
4474                                 ctypelen = s->s3->tmp.ctype_num;
4475                                 }
4476                         for (i = 0; i < ctypelen; i++)
4477                                 {
4478                                 if (ctypes[i] == check_type)
4479                                         {
4480                                         rv |= CERT_PKEY_CERT_TYPE;
4481                                         break;
4482                                         }
4483                                 }
4484                         if (!(rv & CERT_PKEY_CERT_TYPE) && !check_flags)
4485                                 goto end;
4486                         }
4487                 else
4488                         rv |= CERT_PKEY_CERT_TYPE;
4489
4490
4491                 ca_dn = s->s3->tmp.ca_names;
4492
4493                 if (!sk_X509_NAME_num(ca_dn))
4494                         rv |= CERT_PKEY_ISSUER_NAME;
4495
4496                 if (!(rv & CERT_PKEY_ISSUER_NAME))
4497                         {
4498                         if (ssl_check_ca_name(ca_dn, x))
4499                                 rv |= CERT_PKEY_ISSUER_NAME;
4500                         }
4501                 if (!(rv & CERT_PKEY_ISSUER_NAME))
4502                         {
4503                         for (i = 0; i < sk_X509_num(chain); i++)
4504                                 {
4505                                 X509 *xtmp = sk_X509_value(chain, i);
4506                                 if (ssl_check_ca_name(ca_dn, xtmp))
4507                                         {
4508                                         rv |= CERT_PKEY_ISSUER_NAME;
4509                                         break;
4510                                         }
4511                                 }
4512                         }
4513                 if (!check_flags && !(rv & CERT_PKEY_ISSUER_NAME))
4514                         goto end;
4515                 }
4516         else
4517                 rv |= CERT_PKEY_ISSUER_NAME|CERT_PKEY_CERT_TYPE;
4518
4519         if (!check_flags || (rv & check_flags) == check_flags)
4520                 rv |= CERT_PKEY_VALID;
4521
4522         end:
4523
4524         if (TLS1_get_version(s) >= TLS1_2_VERSION)
4525                 {
4526                 if (cpk->valid_flags & CERT_PKEY_EXPLICIT_SIGN)
4527                         rv |= CERT_PKEY_EXPLICIT_SIGN|CERT_PKEY_SIGN;
4528                 else if (cpk->digest)
4529                         rv |= CERT_PKEY_SIGN;
4530                 }
4531         else
4532                 rv |= CERT_PKEY_SIGN|CERT_PKEY_EXPLICIT_SIGN;
4533
4534         /* When checking a CERT_PKEY structure all flags are irrelevant
4535          * if the chain is invalid.
4536          */
4537         if (!check_flags)
4538                 {
4539                 if (rv & CERT_PKEY_VALID)
4540                         cpk->valid_flags = rv;
4541                 else
4542                         {
4543                         /* Preserve explicit sign flag, clear rest */
4544                         cpk->valid_flags &= CERT_PKEY_EXPLICIT_SIGN;
4545                         return 0;
4546                         }
4547                 }
4548         return rv;
4549         }
4550
4551 /* Set validity of certificates in an SSL structure */
4552 void tls1_set_cert_validity(SSL *s)
4553         {
4554         tls1_check_chain(s, NULL, NULL, NULL, SSL_PKEY_RSA_ENC);
4555         tls1_check_chain(s, NULL, NULL, NULL, SSL_PKEY_RSA_SIGN);
4556         tls1_check_chain(s, NULL, NULL, NULL, SSL_PKEY_DSA_SIGN);
4557         tls1_check_chain(s, NULL, NULL, NULL, SSL_PKEY_DH_RSA);
4558         tls1_check_chain(s, NULL, NULL, NULL, SSL_PKEY_DH_DSA);
4559         tls1_check_chain(s, NULL, NULL, NULL, SSL_PKEY_ECC);
4560         }
4561 /* User level utiity function to check a chain is suitable */
4562 int SSL_check_chain(SSL *s, X509 *x, EVP_PKEY *pk, STACK_OF(X509) *chain)
4563         {
4564         return tls1_check_chain(s, x, pk, chain, -1);
4565         }
4566
4567 #endif