ssl/t1_lib.c

   1 /* ssl/t1_lib.c */
   2 /* Copyright (C) 1995-1998 Eric Young (eay@cryptsoft.com)
   3  * All rights reserved.
   4  *
   5  * This package is an SSL implementation written
   6  * by Eric Young (eay@cryptsoft.com).
   7  * The implementation was written so as to conform with Netscapes SSL.
   8  *
   9  * This library is free for commercial and non-commercial use as long as
  10  * the following conditions are aheared to.  The following conditions
  11  * apply to all code found in this distribution, be it the RC4, RSA,
  12  * lhash, DES, etc., code; not just the SSL code.  The SSL documentation
  13  * included with this distribution is covered by the same copyright terms
  14  * except that the holder is Tim Hudson (tjh@cryptsoft.com).
  15  *
  16  * Copyright remains Eric Young's, and as such any Copyright notices in
  17  * the code are not to be removed.
  18  * If this package is used in a product, Eric Young should be given attribution
  19  * as the author of the parts of the library used.
  20  * This can be in the form of a textual message at program startup or
  21  * in documentation (online or textual) provided with the package.
  22  *
  23  * Redistribution and use in source and binary forms, with or without
  24  * modification, are permitted provided that the following conditions
  25  * are met:
  26  * 1. Redistributions of source code must retain the copyright
  27  *    notice, this list of conditions and the following disclaimer.
  28  * 2. Redistributions in binary form must reproduce the above copyright
  29  *    notice, this list of conditions and the following disclaimer in the
  30  *    documentation and/or other materials provided with the distribution.
  31  * 3. All advertising materials mentioning features or use of this software
  32  *    must display the following acknowledgement:
  33  *    "This product includes cryptographic software written by
  34  *     Eric Young (eay@cryptsoft.com)"
  35  *    The word 'cryptographic' can be left out if the rouines from the library
  36  *    being used are not cryptographic related :-).
  37  * 4. If you include any Windows specific code (or a derivative thereof) from
  38  *    the apps directory (application code) you must include an acknowledgement:
  39  *    "This product includes software written by Tim Hudson (tjh@cryptsoft.com)"
  40  *
  41  * THIS SOFTWARE IS PROVIDED BY ERIC YOUNG ``AS IS'' AND
  42  * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
  43  * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
  44  * ARE DISCLAIMED.  IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE
  45  * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
  46  * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
  47  * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
  48  * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
  49  * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
  50  * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
  51  * SUCH DAMAGE.
  52  *
  53  * The licence and distribution terms for any publically available version or
  54  * derivative of this code cannot be changed.  i.e. this code cannot simply be
  55  * copied and put under another distribution licence
  56  * [including the GNU Public Licence.]
  57  */
  58 /* ====================================================================
  59  * Copyright (c) 1998-2007 The OpenSSL Project.  All rights reserved.
  60  *
  61  * Redistribution and use in source and binary forms, with or without
  62  * modification, are permitted provided that the following conditions
  63  * are met:
  64  *
  65  * 1. Redistributions of source code must retain the above copyright
  66  *    notice, this list of conditions and the following disclaimer.
  67  *
  68  * 2. Redistributions in binary form must reproduce the above copyright
  69  *    notice, this list of conditions and the following disclaimer in
  70  *    the documentation and/or other materials provided with the
  71  *    distribution.
  72  *
  73  * 3. All advertising materials mentioning features or use of this
  74  *    software must display the following acknowledgment:
  75  *    "This product includes software developed by the OpenSSL Project
  76  *    for use in the OpenSSL Toolkit. (http://www.openssl.org/)"
  77  *
  78  * 4. The names "OpenSSL Toolkit" and "OpenSSL Project" must not be used to
  79  *    endorse or promote products derived from this software without
  80  *    prior written permission. For written permission, please contact
  81  *    openssl-core@openssl.org.
  82  *
  83  * 5. Products derived from this software may not be called "OpenSSL"
  84  *    nor may "OpenSSL" appear in their names without prior written
  85  *    permission of the OpenSSL Project.
  86  *
  87  * 6. Redistributions of any form whatsoever must retain the following
  88  *    acknowledgment:
  89  *    "This product includes software developed by the OpenSSL Project
  90  *    for use in the OpenSSL Toolkit (http://www.openssl.org/)"
  91  *
  92  * THIS SOFTWARE IS PROVIDED BY THE OpenSSL PROJECT ``AS IS'' AND ANY
  93  * EXPRESSED OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
  94  * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
  95  * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL THE OpenSSL PROJECT OR
  96  * ITS CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
  97  * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
  98  * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
  99  * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
 100  * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT,
 101  * STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
 102  * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED
 103  * OF THE POSSIBILITY OF SUCH DAMAGE.
 104  * ====================================================================
 105  *
 106  * This product includes cryptographic software written by Eric Young
 107  * (eay@cryptsoft.com).  This product includes software written by Tim
 108  * Hudson (tjh@cryptsoft.com).
 109  *
 110  */
 111
 112 #include <stdio.h>
 113 #include <openssl/objects.h>
 114 #include <openssl/evp.h>
 115 #include <openssl/hmac.h>
 116 #include <openssl/ocsp.h>
 117 #include "ssl_locl.h"
 118
 119 const char tls1_version_str[]="TLSv1" OPENSSL_VERSION_PTEXT;
 120
 121 #ifndef OPENSSL_NO_TLSEXT
 122 static int tls_decrypt_ticket(SSL *s, const unsigned char *tick, int ticklen,
 123                                 const unsigned char *sess_id, int sesslen,
 124                                 SSL_SESSION **psess);
 125 #endif
 126
 127 SSL3_ENC_METHOD TLSv1_enc_data={
 128         tls1_enc,
 129         tls1_mac,
 130         tls1_setup_key_block,
 131         tls1_generate_master_secret,
 132         tls1_change_cipher_state,
 133         tls1_final_finish_mac,
 134         TLS1_FINISH_MAC_LENGTH,
 135         tls1_cert_verify_mac,
 136         TLS_MD_CLIENT_FINISH_CONST,TLS_MD_CLIENT_FINISH_CONST_SIZE,
 137         TLS_MD_SERVER_FINISH_CONST,TLS_MD_SERVER_FINISH_CONST_SIZE,
 138         tls1_alert_code,
 139         };
 140
 141 long tls1_default_timeout(void)
 142         {
 143         /* 2 hours, the 24 hours mentioned in the TLSv1 spec
 144          * is way too long for http, the cache would over fill */
 145         return(60*60*2);
 146         }
 147
 148 int tls1_new(SSL *s)
 149         {
 150         if (!ssl3_new(s)) return(0);
 151         s->method->ssl_clear(s);
 152         return(1);
 153         }
 154
 155 void tls1_free(SSL *s)
 156         {
 157 #ifndef OPENSSL_NO_TLSEXT
 158         if (s->tlsext_session_ticket)
 159                 {
 160                 OPENSSL_free(s->tlsext_session_ticket);
 161                 }
 162 #endif /* OPENSSL_NO_TLSEXT */
 163         ssl3_free(s);
 164         }
 165
 166 void tls1_clear(SSL *s)
 167         {
 168         ssl3_clear(s);
 169         s->version=TLS1_VERSION;
 170         }
 171
 172 #ifndef OPENSSL_NO_EC
 173 static int nid_list[] =
 174         {
 175                 NID_sect163k1, /* sect163k1 (1) */
 176                 NID_sect163r1, /* sect163r1 (2) */
 177                 NID_sect163r2, /* sect163r2 (3) */
 178                 NID_sect193r1, /* sect193r1 (4) */
 179                 NID_sect193r2, /* sect193r2 (5) */
 180                 NID_sect233k1, /* sect233k1 (6) */
 181                 NID_sect233r1, /* sect233r1 (7) */
 182                 NID_sect239k1, /* sect239k1 (8) */
 183                 NID_sect283k1, /* sect283k1 (9) */
 184                 NID_sect283r1, /* sect283r1 (10) */
 185                 NID_sect409k1, /* sect409k1 (11) */
 186                 NID_sect409r1, /* sect409r1 (12) */
 187                 NID_sect571k1, /* sect571k1 (13) */
 188                 NID_sect571r1, /* sect571r1 (14) */
 189                 NID_secp160k1, /* secp160k1 (15) */
 190                 NID_secp160r1, /* secp160r1 (16) */
 191                 NID_secp160r2, /* secp160r2 (17) */
 192                 NID_secp192k1, /* secp192k1 (18) */
 193                 NID_X9_62_prime192v1, /* secp192r1 (19) */
 194                 NID_secp224k1, /* secp224k1 (20) */
 195                 NID_secp224r1, /* secp224r1 (21) */
 196                 NID_secp256k1, /* secp256k1 (22) */
 197                 NID_X9_62_prime256v1, /* secp256r1 (23) */
 198                 NID_secp384r1, /* secp384r1 (24) */
 199                 NID_secp521r1  /* secp521r1 (25) */
 200         };
 201
 202 int tls1_ec_curve_id2nid(int curve_id)
 203         {
 204         /* ECC curves from draft-ietf-tls-ecc-12.txt (Oct. 17, 2005) */
 205         if ((curve_id < 1) || ((unsigned int)curve_id >
 206                                 sizeof(nid_list)/sizeof(nid_list[0])))
 207                 return 0;
 208         return nid_list[curve_id-1];
 209         }
 210
 211 int tls1_ec_nid2curve_id(int nid)
 212         {
 213         /* ECC curves from draft-ietf-tls-ecc-12.txt (Oct. 17, 2005) */
 214         switch (nid)
 215                 {
 216         case NID_sect163k1: /* sect163k1 (1) */
 217                 return 1;
 218         case NID_sect163r1: /* sect163r1 (2) */
 219                 return 2;
 220         case NID_sect163r2: /* sect163r2 (3) */
 221                 return 3;
 222         case NID_sect193r1: /* sect193r1 (4) */
 223                 return 4;
 224         case NID_sect193r2: /* sect193r2 (5) */
 225                 return 5;
 226         case NID_sect233k1: /* sect233k1 (6) */
 227                 return 6;
 228         case NID_sect233r1: /* sect233r1 (7) */
 229                 return 7;
 230         case NID_sect239k1: /* sect239k1 (8) */
 231                 return 8;
 232         case NID_sect283k1: /* sect283k1 (9) */
 233                 return 9;
 234         case NID_sect283r1: /* sect283r1 (10) */
 235                 return 10;
 236         case NID_sect409k1: /* sect409k1 (11) */
 237                 return 11;
 238         case NID_sect409r1: /* sect409r1 (12) */
 239                 return 12;
 240         case NID_sect571k1: /* sect571k1 (13) */
 241                 return 13;
 242         case NID_sect571r1: /* sect571r1 (14) */
 243                 return 14;
 244         case NID_secp160k1: /* secp160k1 (15) */
 245                 return 15;
 246         case NID_secp160r1: /* secp160r1 (16) */
 247                 return 16;
 248         case NID_secp160r2: /* secp160r2 (17) */
 249                 return 17;
 250         case NID_secp192k1: /* secp192k1 (18) */
 251                 return 18;
 252         case NID_X9_62_prime192v1: /* secp192r1 (19) */
 253                 return 19;
 254         case NID_secp224k1: /* secp224k1 (20) */
 255                 return 20;
 256         case NID_secp224r1: /* secp224r1 (21) */
 257                 return 21;
 258         case NID_secp256k1: /* secp256k1 (22) */
 259                 return 22;
 260         case NID_X9_62_prime256v1: /* secp256r1 (23) */
 261                 return 23;
 262         case NID_secp384r1: /* secp384r1 (24) */
 263                 return 24;
 264         case NID_secp521r1:  /* secp521r1 (25) */
 265                 return 25;
 266         default:
 267                 return 0;
 268                 }
 269         }
 270 #endif /* OPENSSL_NO_EC */
 271
 272 #ifndef OPENSSL_NO_TLSEXT
 273 unsigned char *ssl_add_clienthello_tlsext(SSL *s, unsigned char *p, unsigned char *limit)
 274         {
 275         int extdatalen=0;
 276         unsigned char *ret = p;
 277
 278         /* don't add extensions for SSLv3 unless doing secure renegotiation */
 279         if (s->client_version == SSL3_VERSION
 280                                         && !s->s3->send_connection_binding)
 281                 return p;
 282
 283         ret+=2;
 284
 285         if (ret>=limit) return NULL; /* this really never occurs, but ... */
 286
 287         if (s->tlsext_hostname != NULL)
 288                 {
 289                 /* Add TLS extension servername to the Client Hello message */
 290                 unsigned long size_str;
 291                 long lenmax;
 292
 293                 /*-
 294                  * check for enough space.
 295                  * 4 for the servername type and entension length
 296                  * 2 for servernamelist length
 297                  * 1 for the hostname type
 298                  * 2 for hostname length
 299                  * + hostname length
 300                  */
 301
 302                 if ((lenmax = limit - ret - 9) < 0
 303                     || (size_str = strlen(s->tlsext_hostname)) > (unsigned long)lenmax)
 304                         return NULL;
 305
 306                 /* extension type and length */
 307                 s2n(TLSEXT_TYPE_server_name,ret);
 308                 s2n(size_str+5,ret);
 309
 310                 /* length of servername list */
 311                 s2n(size_str+3,ret);
 312
 313                 /* hostname type, length and hostname */
 314                 *(ret++) = (unsigned char) TLSEXT_NAMETYPE_host_name;
 315                 s2n(size_str,ret);
 316                 memcpy(ret, s->tlsext_hostname, size_str);
 317                 ret+=size_str;
 318                 }
 319
 320         /* Add RI if renegotiating */
 321         if (s->new_session)
 322           {
 323           int el;
 324
 325           if(!ssl_add_clienthello_renegotiate_ext(s, 0, &el, 0))
 326               {
 327               SSLerr(SSL_F_SSL_ADD_CLIENTHELLO_TLSEXT, ERR_R_INTERNAL_ERROR);
 328               return NULL;
 329               }
 330
 331           if((limit - p - 4 - el) < 0) return NULL;
 332
 333           s2n(TLSEXT_TYPE_renegotiate,ret);
 334           s2n(el,ret);
 335
 336           if(!ssl_add_clienthello_renegotiate_ext(s, ret, &el, el))
 337               {
 338               SSLerr(SSL_F_SSL_ADD_CLIENTHELLO_TLSEXT, ERR_R_INTERNAL_ERROR);
 339               return NULL;
 340               }
 341
 342           ret += el;
 343         }
 344
 345 #ifndef OPENSSL_NO_EC
 346         if (s->tlsext_ecpointformatlist != NULL)
 347                 {
 348                 /* Add TLS extension ECPointFormats to the ClientHello message */
 349                 long lenmax;
 350
 351                 if ((lenmax = limit - ret - 5) < 0) return NULL;
 352                 if (s->tlsext_ecpointformatlist_length > (unsigned long)lenmax) return NULL;
 353                 if (s->tlsext_ecpointformatlist_length > 255)
 354                         {
 355                         SSLerr(SSL_F_SSL_ADD_CLIENTHELLO_TLSEXT, ERR_R_INTERNAL_ERROR);
 356                         return NULL;
 357                         }
 358
 359                 s2n(TLSEXT_TYPE_ec_point_formats,ret);
 360                 s2n(s->tlsext_ecpointformatlist_length + 1,ret);
 361                 *(ret++) = (unsigned char) s->tlsext_ecpointformatlist_length;
 362                 memcpy(ret, s->tlsext_ecpointformatlist, s->tlsext_ecpointformatlist_length);
 363                 ret+=s->tlsext_ecpointformatlist_length;
 364                 }
 365         if (s->tlsext_ellipticcurvelist != NULL)
 366                 {
 367                 /* Add TLS extension EllipticCurves to the ClientHello message */
 368                 long lenmax;
 369
 370                 if ((lenmax = limit - ret - 6) < 0) return NULL;
 371                 if (s->tlsext_ellipticcurvelist_length > (unsigned long)lenmax) return NULL;
 372                 if (s->tlsext_ellipticcurvelist_length > 65532)
 373                         {
 374                         SSLerr(SSL_F_SSL_ADD_CLIENTHELLO_TLSEXT, ERR_R_INTERNAL_ERROR);
 375                         return NULL;
 376                         }
 377
 378                 s2n(TLSEXT_TYPE_elliptic_curves,ret);
 379                 s2n(s->tlsext_ellipticcurvelist_length + 2, ret);
 380
 381                 /* NB: draft-ietf-tls-ecc-12.txt uses a one-byte prefix for
 382                  * elliptic_curve_list, but the examples use two bytes.
 383                  * http://www1.ietf.org/mail-archive/web/tls/current/msg00538.html
 384                  * resolves this to two bytes.
 385                  */
 386                 s2n(s->tlsext_ellipticcurvelist_length, ret);
 387                 memcpy(ret, s->tlsext_ellipticcurvelist, s->tlsext_ellipticcurvelist_length);
 388                 ret+=s->tlsext_ellipticcurvelist_length;
 389                 }
 390 #endif /* OPENSSL_NO_EC */
 391
 392         if (!(SSL_get_options(s) & SSL_OP_NO_TICKET))
 393                 {
 394                 int ticklen;
 395                 if (!s->new_session && s->session && s->session->tlsext_tick)
 396                         ticklen = s->session->tlsext_ticklen;
 397                 else if (s->session && s->tlsext_session_ticket &&
 398                          s->tlsext_session_ticket->data)
 399                         {
 400                         ticklen = s->tlsext_session_ticket->length;
 401                         s->session->tlsext_tick = OPENSSL_malloc(ticklen);
 402                         if (!s->session->tlsext_tick)
 403                                 return NULL;
 404                         memcpy(s->session->tlsext_tick,
 405                                s->tlsext_session_ticket->data,
 406                                ticklen);
 407                         s->session->tlsext_ticklen = ticklen;
 408                         }
 409                 else
 410                         ticklen = 0;
 411                 if (ticklen == 0 && s->tlsext_session_ticket &&
 412                     s->tlsext_session_ticket->data == NULL)
 413                         goto skip_ext;
 414                 /* Check for enough room 2 for extension type, 2 for len
 415                  * rest for ticket
 416                  */
 417                 if ((long)(limit - ret - 4 - ticklen) < 0) return NULL;
 418                 s2n(TLSEXT_TYPE_session_ticket,ret);
 419                 s2n(ticklen,ret);
 420                 if (ticklen)
 421                         {
 422                         memcpy(ret, s->session->tlsext_tick, ticklen);
 423                         ret += ticklen;
 424                         }
 425                 }
 426                 skip_ext:
 427
 428 #ifdef TLSEXT_TYPE_opaque_prf_input
 429         if (s->s3->client_opaque_prf_input != NULL &&
 430             s->version != DTLS1_VERSION)
 431                 {
 432                 size_t col = s->s3->client_opaque_prf_input_len;
 433
 434                 if ((long)(limit - ret - 6 - col < 0))
 435                         return NULL;
 436                 if (col > 0xFFFD) /* can't happen */
 437                         return NULL;
 438
 439                 s2n(TLSEXT_TYPE_opaque_prf_input, ret);
 440                 s2n(col + 2, ret);
 441                 s2n(col, ret);
 442                 memcpy(ret, s->s3->client_opaque_prf_input, col);
 443                 ret += col;
 444                 }
 445 #endif
 446
 447         if (s->tlsext_status_type == TLSEXT_STATUSTYPE_ocsp &&
 448             s->version != DTLS1_VERSION)
 449                 {
 450                 int i;
 451                 long extlen, idlen, itmp;
 452                 OCSP_RESPID *id;
 453
 454                 idlen = 0;
 455                 for (i = 0; i < sk_OCSP_RESPID_num(s->tlsext_ocsp_ids); i++)
 456                         {
 457                         id = sk_OCSP_RESPID_value(s->tlsext_ocsp_ids, i);
 458                         itmp = i2d_OCSP_RESPID(id, NULL);
 459                         if (itmp <= 0)
 460                                 return NULL;
 461                         idlen += itmp + 2;
 462                         }
 463
 464                 if (s->tlsext_ocsp_exts)
 465                         {
 466                         extlen = i2d_X509_EXTENSIONS(s->tlsext_ocsp_exts, NULL);
 467                         if (extlen < 0)
 468                                 return NULL;
 469                         }
 470                 else
 471                         extlen = 0;
 472
 473                 if ((long)(limit - ret - 7 - extlen - idlen) < 0) return NULL;
 474                 s2n(TLSEXT_TYPE_status_request, ret);
 475                 if (extlen + idlen > 0xFFF0)
 476                         return NULL;
 477                 s2n(extlen + idlen + 5, ret);
 478                 *(ret++) = TLSEXT_STATUSTYPE_ocsp;
 479                 s2n(idlen, ret);
 480                 for (i = 0; i < sk_OCSP_RESPID_num(s->tlsext_ocsp_ids); i++)
 481                         {
 482                         /* save position of id len */
 483                         unsigned char *q = ret;
 484                         id = sk_OCSP_RESPID_value(s->tlsext_ocsp_ids, i);
 485                         /* skip over id len */
 486                         ret += 2;
 487                         itmp = i2d_OCSP_RESPID(id, &ret);
 488                         /* write id len */
 489                         s2n(itmp, q);
 490                         }
 491                 s2n(extlen, ret);
 492                 if (extlen > 0)
 493                         i2d_X509_EXTENSIONS(s->tlsext_ocsp_exts, &ret);
 494                 }
 495
 496         if ((extdatalen = ret-p-2)== 0)
 497                 return p;
 498
 499         s2n(extdatalen,p);
 500         return ret;
 501         }
 502
 503 unsigned char *ssl_add_serverhello_tlsext(SSL *s, unsigned char *p, unsigned char *limit)
 504         {
 505         int extdatalen=0;
 506         unsigned char *ret = p;
 507
 508         /* don't add extensions for SSLv3, unless doing secure renegotiation */
 509         if (s->version == SSL3_VERSION && !s->s3->send_connection_binding)
 510                 return p;
 511
 512         ret+=2;
 513         if (ret>=limit) return NULL; /* this really never occurs, but ... */
 514
 515         if (!s->hit && s->servername_done == 1 && s->session->tlsext_hostname != NULL)
 516                 {
 517                 if ((long)(limit - ret - 4) < 0) return NULL;
 518
 519                 s2n(TLSEXT_TYPE_server_name,ret);
 520                 s2n(0,ret);
 521                 }
 522
 523         if(s->s3->send_connection_binding)
 524         {
 525           int el;
 526
 527           if(!ssl_add_serverhello_renegotiate_ext(s, 0, &el, 0))
 528               {
 529               SSLerr(SSL_F_SSL_ADD_SERVERHELLO_TLSEXT, ERR_R_INTERNAL_ERROR);
 530               return NULL;
 531               }
 532
 533           if((limit - p - 4 - el) < 0) return NULL;
 534
 535           s2n(TLSEXT_TYPE_renegotiate,ret);
 536           s2n(el,ret);
 537
 538           if(!ssl_add_serverhello_renegotiate_ext(s, ret, &el, el))
 539               {
 540               SSLerr(SSL_F_SSL_ADD_SERVERHELLO_TLSEXT, ERR_R_INTERNAL_ERROR);
 541               return NULL;
 542               }
 543
 544           ret += el;
 545         }
 546
 547 #ifndef OPENSSL_NO_EC
 548         if (s->tlsext_ecpointformatlist != NULL)
 549                 {
 550                 /* Add TLS extension ECPointFormats to the ServerHello message */
 551                 long lenmax;
 552
 553                 if ((lenmax = limit - ret - 5) < 0) return NULL;
 554                 if (s->tlsext_ecpointformatlist_length > (unsigned long)lenmax) return NULL;
 555                 if (s->tlsext_ecpointformatlist_length > 255)
 556                         {
 557                         SSLerr(SSL_F_SSL_ADD_SERVERHELLO_TLSEXT, ERR_R_INTERNAL_ERROR);
 558                         return NULL;
 559                         }
 560
 561                 s2n(TLSEXT_TYPE_ec_point_formats,ret);
 562                 s2n(s->tlsext_ecpointformatlist_length + 1,ret);
 563                 *(ret++) = (unsigned char) s->tlsext_ecpointformatlist_length;
 564                 memcpy(ret, s->tlsext_ecpointformatlist, s->tlsext_ecpointformatlist_length);
 565                 ret+=s->tlsext_ecpointformatlist_length;
 566
 567                 }
 568         /* Currently the server should not respond with a SupportedCurves extension */
 569 #endif /* OPENSSL_NO_EC */
 570
 571         if (s->tlsext_ticket_expected
 572                 && !(SSL_get_options(s) & SSL_OP_NO_TICKET))
 573                 {
 574                 if ((long)(limit - ret - 4) < 0) return NULL;
 575                 s2n(TLSEXT_TYPE_session_ticket,ret);
 576                 s2n(0,ret);
 577                 }
 578
 579         if (s->tlsext_status_expected)
 580                 {
 581                 if ((long)(limit - ret - 4) < 0) return NULL;
 582                 s2n(TLSEXT_TYPE_status_request,ret);
 583                 s2n(0,ret);
 584                 }
 585
 586 #ifdef TLSEXT_TYPE_opaque_prf_input
 587         if (s->s3->server_opaque_prf_input != NULL &&
 588             s->version != DTLS1_VERSION)
 589                 {
 590                 size_t sol = s->s3->server_opaque_prf_input_len;
 591
 592                 if ((long)(limit - ret - 6 - sol) < 0)
 593                         return NULL;
 594                 if (sol > 0xFFFD) /* can't happen */
 595                         return NULL;
 596
 597                 s2n(TLSEXT_TYPE_opaque_prf_input, ret);
 598                 s2n(sol + 2, ret);
 599                 s2n(sol, ret);
 600                 memcpy(ret, s->s3->server_opaque_prf_input, sol);
 601                 ret += sol;
 602                 }
 603 #endif
 604         if (((s->s3->tmp.new_cipher->id & 0xFFFF)==0x80 || (s->s3->tmp.new_cipher->id & 0xFFFF)==0x81)
 605                 && (SSL_get_options(s) & SSL_OP_CRYPTOPRO_TLSEXT_BUG))
 606                 { const unsigned char cryptopro_ext[36] = {
 607                         0xfd, 0xe8, /*65000*/
 608                         0x00, 0x20, /*32 bytes length*/
 609                         0x30, 0x1e, 0x30, 0x08, 0x06, 0x06, 0x2a, 0x85,
 610                         0x03,   0x02, 0x02, 0x09, 0x30, 0x08, 0x06, 0x06,
 611                         0x2a, 0x85, 0x03, 0x02, 0x02, 0x16, 0x30, 0x08,
 612                         0x06, 0x06, 0x2a, 0x85, 0x03, 0x02, 0x02, 0x17};
 613                         if (limit-ret<36) return NULL;
 614                         memcpy(ret,cryptopro_ext,36);
 615                         ret+=36;
 616
 617                 }
 618
 619         if ((extdatalen = ret-p-2)== 0)
 620                 return p;
 621
 622         s2n(extdatalen,p);
 623         return ret;
 624         }
 625
 626 #ifndef OPENSSL_NO_EC
 627 /*-
 628  * ssl_check_for_safari attempts to fingerprint Safari using OS X
 629  * SecureTransport using the TLS extension block in |d|, of length |n|.
 630  * Safari, since 10.6, sends exactly these extensions, in this order:
 631  *   SNI,
 632  *   elliptic_curves
 633  *   ec_point_formats
 634  *
 635  * We wish to fingerprint Safari because they broke ECDHE-ECDSA support in 10.8,
 636  * but they advertise support. So enabling ECDHE-ECDSA ciphers breaks them.
 637  * Sadly we cannot differentiate 10.6, 10.7 and 10.8.4 (which work), from
 638  * 10.8..10.8.3 (which don't work).
 639  */
 640 static void ssl_check_for_safari(SSL *s, const unsigned char *data, const unsigned char *d, int n) {
 641         unsigned short type, size;
 642         static const unsigned char kSafariExtensionsBlock[] = {
 643                 0x00, 0x0a,  /* elliptic_curves extension */
 644                 0x00, 0x08,  /* 8 bytes */
 645                 0x00, 0x06,  /* 6 bytes of curve ids */
 646                 0x00, 0x17,  /* P-256 */
 647                 0x00, 0x18,  /* P-384 */
 648                 0x00, 0x19,  /* P-521 */
 649
 650                 0x00, 0x0b,  /* ec_point_formats */
 651                 0x00, 0x02,  /* 2 bytes */
 652                 0x01,        /* 1 point format */
 653                 0x00,        /* uncompressed */
 654         };
 655
 656         /* The following is only present in TLS 1.2 */
 657         static const unsigned char kSafariTLS12ExtensionsBlock[] = {
 658                 0x00, 0x0d,  /* signature_algorithms */
 659                 0x00, 0x0c,  /* 12 bytes */
 660                 0x00, 0x0a,  /* 10 bytes */
 661                 0x05, 0x01,  /* SHA-384/RSA */
 662                 0x04, 0x01,  /* SHA-256/RSA */
 663                 0x02, 0x01,  /* SHA-1/RSA */
 664                 0x04, 0x03,  /* SHA-256/ECDSA */
 665                 0x02, 0x03,  /* SHA-1/ECDSA */
 666         };
 667
 668         if (data >= (d+n-2))
 669                 return;
 670         data += 2;
 671
 672         if (data > (d+n-4))
 673                 return;
 674         n2s(data,type);
 675         n2s(data,size);
 676
 677         if (type != TLSEXT_TYPE_server_name)
 678                 return;
 679
 680         if (data+size > d+n)
 681                 return;
 682         data += size;
 683
 684         if (TLS1_get_client_version(s) >= TLS1_2_VERSION)
 685                 {
 686                 const size_t len1 = sizeof(kSafariExtensionsBlock);
 687                 const size_t len2 = sizeof(kSafariTLS12ExtensionsBlock);
 688
 689                 if (data + len1 + len2 != d+n)
 690                         return;
 691                 if (memcmp(data, kSafariExtensionsBlock, len1) != 0)
 692                         return;
 693                 if (memcmp(data + len1, kSafariTLS12ExtensionsBlock, len2) != 0)
 694                         return;
 695                 }
 696         else
 697                 {
 698                 const size_t len = sizeof(kSafariExtensionsBlock);
 699
 700                 if (data + len != d+n)
 701                         return;
 702                 if (memcmp(data, kSafariExtensionsBlock, len) != 0)
 703                         return;
 704                 }
 705
 706         s->s3->is_probably_safari = 1;
 707 }
 708 #endif /* !OPENSSL_NO_EC */
 709
 710 int ssl_parse_clienthello_tlsext(SSL *s, unsigned char **p, unsigned char *d, int n, int *al)
 711         {
 712         unsigned short type;
 713         unsigned short size;
 714         unsigned short len;
 715         unsigned char *data = *p;
 716         int renegotiate_seen = 0;
 717
 718         s->servername_done = 0;
 719         s->tlsext_status_type = -1;
 720
 721 #ifndef OPENSSL_NO_EC
 722         if (s->options & SSL_OP_SAFARI_ECDHE_ECDSA_BUG)
 723                 ssl_check_for_safari(s, data, d, n);
 724 #endif /* !OPENSSL_NO_EC */
 725
 726         if (data >= (d+n-2))
 727                 goto ri_check;
 728         n2s(data,len);
 729
 730         if (data > (d+n-len))
 731                 goto ri_check;
 732
 733         while (data <= (d+n-4))
 734                 {
 735                 n2s(data,type);
 736                 n2s(data,size);
 737
 738                 if (data+size > (d+n))
 739                         goto ri_check;
 740 #if 0
 741                 fprintf(stderr,"Received extension type %d size %d\n",type,size);
 742 #endif
 743                 if (s->tlsext_debug_cb)
 744                         s->tlsext_debug_cb(s, 0, type, data, size,
 745                                                 s->tlsext_debug_arg);
 746 /*-
 747  * The servername extension is treated as follows:
 748  *
 749  * - Only the hostname type is supported with a maximum length of 255.
 750  * - The servername is rejected if too long or if it contains zeros,
 751  *   in which case an fatal alert is generated.
 752  * - The servername field is maintained together with the session cache.
 753  * - When a session is resumed, the servername call back invoked in order
 754  *   to allow the application to position itself to the right context.
 755  * - The servername is acknowledged if it is new for a session or when
 756  *   it is identical to a previously used for the same session.
 757  *   Applications can control the behaviour.  They can at any time
 758  *   set a 'desirable' servername for a new SSL object. This can be the
 759  *   case for example with HTTPS when a Host: header field is received and
 760  *   a renegotiation is requested. In this case, a possible servername
 761  *   presented in the new client hello is only acknowledged if it matches
 762  *   the value of the Host: field.
 763  * - Applications must  use SSL_OP_NO_SESSION_RESUMPTION_ON_RENEGOTIATION
 764  *   if they provide for changing an explicit servername context for the
 765  *   session, i.e. when the session has been established with a servername
 766  *   extension.
 767  * - On session reconnect, the servername extension may be absent.
 768  *
 769  */
 770
 771                 if (type == TLSEXT_TYPE_server_name)
 772                         {
 773                         unsigned char *sdata;
 774                         int servname_type;
 775                         int dsize;
 776
 777                         if (size < 2)
 778                                 {
 779                                 *al = SSL_AD_DECODE_ERROR;
 780                                 return 0;
 781                                 }
 782                         n2s(data,dsize);
 783                         size -= 2;
 784                         if (dsize > size  )
 785                                 {
 786                                 *al = SSL_AD_DECODE_ERROR;
 787                                 return 0;
 788                                 }
 789
 790                         sdata = data;
 791                         while (dsize > 3)
 792                                 {
 793                                 servname_type = *(sdata++);
 794                                 n2s(sdata,len);
 795                                 dsize -= 3;
 796
 797                                 if (len > dsize)
 798                                         {
 799                                         *al = SSL_AD_DECODE_ERROR;
 800                                         return 0;
 801                                         }
 802                                 if (s->servername_done == 0)
 803                                 switch (servname_type)
 804                                         {
 805                                 case TLSEXT_NAMETYPE_host_name:
 806                                         if (!s->hit)
 807                                                 {
 808                                                 if(s->session->tlsext_hostname)
 809                                                         {
 810                                                         *al = SSL_AD_DECODE_ERROR;
 811                                                         return 0;
 812                                                         }
 813                                                 if (len > TLSEXT_MAXLEN_host_name)
 814                                                         {
 815                                                         *al = TLS1_AD_UNRECOGNIZED_NAME;
 816                                                         return 0;
 817                                                         }
 818                                                 if ((s->session->tlsext_hostname = OPENSSL_malloc(len+1)) == NULL)
 819                                                         {
 820                                                         *al = TLS1_AD_INTERNAL_ERROR;
 821                                                         return 0;
 822                                                         }
 823                                                 memcpy(s->session->tlsext_hostname, sdata, len);
 824                                                 s->session->tlsext_hostname[len]='\0';
 825                                                 if (strlen(s->session->tlsext_hostname) != len) {
 826                                                         OPENSSL_free(s->session->tlsext_hostname);
 827                                                         s->session->tlsext_hostname = NULL;
 828                                                         *al = TLS1_AD_UNRECOGNIZED_NAME;
 829                                                         return 0;
 830                                                 }
 831                                                 s->servername_done = 1;
 832
 833                                                 }
 834                                         else
 835                                                 s->servername_done = s->session->tlsext_hostname
 836                                                         && strlen(s->session->tlsext_hostname) == len
 837                                                         && strncmp(s->session->tlsext_hostname, (char *)sdata, len) == 0;
 838
 839                                         break;
 840
 841                                 default:
 842                                         break;
 843                                         }
 844
 845                                 dsize -= len;
 846                                 }
 847                         if (dsize != 0)
 848                                 {
 849                                 *al = SSL_AD_DECODE_ERROR;
 850                                 return 0;
 851                                 }
 852
 853                         }
 854
 855 #ifndef OPENSSL_NO_EC
 856                 else if (type == TLSEXT_TYPE_ec_point_formats)
 857                         {
 858                         unsigned char *sdata = data;
 859                         int ecpointformatlist_length = *(sdata++);
 860
 861                         if (ecpointformatlist_length != size - 1)
 862                                 {
 863                                 *al = TLS1_AD_DECODE_ERROR;
 864                                 return 0;
 865                                 }
 866                         if (!s->hit)
 867                                 {
 868                                 if(s->session->tlsext_ecpointformatlist)
 869                                         {
 870                                         OPENSSL_free(s->session->tlsext_ecpointformatlist);
 871                                         s->session->tlsext_ecpointformatlist = NULL;
 872                                         }
 873                                 s->session->tlsext_ecpointformatlist_length = 0;
 874                                 if ((s->session->tlsext_ecpointformatlist = OPENSSL_malloc(ecpointformatlist_length)) == NULL)
 875                                         {
 876                                         *al = TLS1_AD_INTERNAL_ERROR;
 877                                         return 0;
 878                                         }
 879                                 s->session->tlsext_ecpointformatlist_length = ecpointformatlist_length;
 880                                 memcpy(s->session->tlsext_ecpointformatlist, sdata, ecpointformatlist_length);
 881                                 }
 882 #if 0
 883                         fprintf(stderr,"ssl_parse_clienthello_tlsext s->session->tlsext_ecpointformatlist (length=%i) ", s->session->tlsext_ecpointformatlist_length);
 884                         sdata = s->session->tlsext_ecpointformatlist;
 885                         for (i = 0; i < s->session->tlsext_ecpointformatlist_length; i++)
 886                                 fprintf(stderr,"%i ",*(sdata++));
 887                         fprintf(stderr,"\n");
 888 #endif
 889                         }
 890                 else if (type == TLSEXT_TYPE_elliptic_curves)
 891                         {
 892                         unsigned char *sdata = data;
 893                         int ellipticcurvelist_length = (*(sdata++) << 8);
 894                         ellipticcurvelist_length += (*(sdata++));
 895
 896                         if (ellipticcurvelist_length != size - 2 ||
 897                                 ellipticcurvelist_length < 1)
 898                                 {
 899                                 *al = TLS1_AD_DECODE_ERROR;
 900                                 return 0;
 901                                 }
 902                         if (!s->hit)
 903                                 {
 904                                 if(s->session->tlsext_ellipticcurvelist)
 905                                         {
 906                                         *al = TLS1_AD_DECODE_ERROR;
 907                                         return 0;
 908                                         }
 909                                 s->session->tlsext_ellipticcurvelist_length = 0;
 910                                 if ((s->session->tlsext_ellipticcurvelist = OPENSSL_malloc(ellipticcurvelist_length)) == NULL)
 911                                         {
 912                                         *al = TLS1_AD_INTERNAL_ERROR;
 913                                         return 0;
 914                                         }
 915                                 s->session->tlsext_ellipticcurvelist_length = ellipticcurvelist_length;
 916                                 memcpy(s->session->tlsext_ellipticcurvelist, sdata, ellipticcurvelist_length);
 917                                 }
 918 #if 0
 919                         fprintf(stderr,"ssl_parse_clienthello_tlsext s->session->tlsext_ellipticcurvelist (length=%i) ", s->session->tlsext_ellipticcurvelist_length);
 920                         sdata = s->session->tlsext_ellipticcurvelist;
 921                         for (i = 0; i < s->session->tlsext_ellipticcurvelist_length; i++)
 922                                 fprintf(stderr,"%i ",*(sdata++));
 923                         fprintf(stderr,"\n");
 924 #endif
 925                         }
 926 #endif /* OPENSSL_NO_EC */
 927 #ifdef TLSEXT_TYPE_opaque_prf_input
 928                 else if (type == TLSEXT_TYPE_opaque_prf_input &&
 929                      s->version != DTLS1_VERSION)
 930                         {
 931                         unsigned char *sdata = data;
 932
 933                         if (size < 2)
 934                                 {
 935                                 *al = SSL_AD_DECODE_ERROR;
 936                                 return 0;
 937                                 }
 938                         n2s(sdata, s->s3->client_opaque_prf_input_len);
 939                         if (s->s3->client_opaque_prf_input_len != size - 2)
 940                                 {
 941                                 *al = SSL_AD_DECODE_ERROR;
 942                                 return 0;
 943                                 }
 944
 945                         if (s->s3->client_opaque_prf_input != NULL) /* shouldn't really happen */
 946                                 OPENSSL_free(s->s3->client_opaque_prf_input);
 947                         if (s->s3->client_opaque_prf_input_len == 0)
 948                                 s->s3->client_opaque_prf_input = OPENSSL_malloc(1); /* dummy byte just to get non-NULL */
 949                         else
 950                                 s->s3->client_opaque_prf_input = BUF_memdup(sdata, s->s3->client_opaque_prf_input_len);
 951                         if (s->s3->client_opaque_prf_input == NULL)
 952                                 {
 953                                 *al = TLS1_AD_INTERNAL_ERROR;
 954                                 return 0;
 955                                 }
 956                         }
 957 #endif
 958                 else if (type == TLSEXT_TYPE_session_ticket)
 959                         {
 960                         if (s->tls_session_ticket_ext_cb &&
 961                             !s->tls_session_ticket_ext_cb(s, data, size, s->tls_session_ticket_ext_cb_arg))
 962                                 {
 963                                 *al = TLS1_AD_INTERNAL_ERROR;
 964                                 return 0;
 965                                 }
 966                         }
 967                 else if (type == TLSEXT_TYPE_renegotiate)
 968                         {
 969                         if(!ssl_parse_clienthello_renegotiate_ext(s, data, size, al))
 970                                 return 0;
 971                         renegotiate_seen = 1;
 972                         }
 973                 else if (type == TLSEXT_TYPE_status_request &&
 974                          s->version != DTLS1_VERSION)
 975                         {
 976
 977                         if (size < 5)
 978                                 {
 979                                 *al = SSL_AD_DECODE_ERROR;
 980                                 return 0;
 981                                 }
 982
 983                         s->tlsext_status_type = *data++;
 984                         size--;
 985                         if (s->tlsext_status_type == TLSEXT_STATUSTYPE_ocsp)
 986                                 {
 987                                 const unsigned char *sdata;
 988                                 int dsize;
 989                                 /* Read in responder_id_list */
 990                                 n2s(data,dsize);
 991                                 size -= 2;
 992                                 if (dsize > size  )
 993                                         {
 994                                         *al = SSL_AD_DECODE_ERROR;
 995                                         return 0;
 996                                         }
 997                                 while (dsize > 0)
 998                                         {
 999                                         OCSP_RESPID *id;
1000                                         int idsize;
1001                                         if (dsize < 4)
1002                                                 {
1003                                                 *al = SSL_AD_DECODE_ERROR;
1004                                                 return 0;
1005                                                 }
1006                                         n2s(data, idsize);
1007                                         dsize -= 2 + idsize;
1008                                         size -= 2 + idsize;
1009                                         if (dsize < 0)
1010                                                 {
1011                                                 *al = SSL_AD_DECODE_ERROR;
1012                                                 return 0;
1013                                                 }
1014                                         sdata = data;
1015                                         data += idsize;
1016                                         id = d2i_OCSP_RESPID(NULL,
1017                                                                 &sdata, idsize);
1018                                         if (!id)
1019                                                 {
1020                                                 *al = SSL_AD_DECODE_ERROR;
1021                                                 return 0;
1022                                                 }
1023                                         if (data != sdata)
1024                                                 {
1025                                                 OCSP_RESPID_free(id);
1026                                                 *al = SSL_AD_DECODE_ERROR;
1027                                                 return 0;
1028                                                 }
1029                                         if (!s->tlsext_ocsp_ids
1030                                                 && !(s->tlsext_ocsp_ids =
1031                                                 sk_OCSP_RESPID_new_null()))
1032                                                 {
1033                                                 OCSP_RESPID_free(id);
1034                                                 *al = SSL_AD_INTERNAL_ERROR;
1035                                                 return 0;
1036                                                 }
1037                                         if (!sk_OCSP_RESPID_push(
1038                                                         s->tlsext_ocsp_ids, id))
1039                                                 {
1040                                                 OCSP_RESPID_free(id);
1041                                                 *al = SSL_AD_INTERNAL_ERROR;
1042                                                 return 0;
1043                                                 }
1044                                         }
1045
1046                                 /* Read in request_extensions */
1047                                 if (size < 2)
1048                                         {
1049                                         *al = SSL_AD_DECODE_ERROR;
1050                                         return 0;
1051                                         }
1052                                 n2s(data,dsize);
1053                                 size -= 2;
1054                                 if (dsize != size)
1055                                         {
1056                                         *al = SSL_AD_DECODE_ERROR;
1057                                         return 0;
1058                                         }
1059                                 sdata = data;
1060                                 if (dsize > 0)
1061                                         {
1062                                         if (s->tlsext_ocsp_exts)
1063                                                 {
1064                                                 sk_X509_EXTENSION_pop_free(s->tlsext_ocsp_exts,
1065                                                                            X509_EXTENSION_free);
1066                                                 }
1067
1068                                         s->tlsext_ocsp_exts =
1069                                                 d2i_X509_EXTENSIONS(NULL,
1070                                                         &sdata, dsize);
1071                                         if (!s->tlsext_ocsp_exts
1072                                                 || (data + dsize != sdata))
1073                                                 {
1074                                                 *al = SSL_AD_DECODE_ERROR;
1075                                                 return 0;
1076                                                 }
1077                                         }
1078                                 }
1079                                 /* We don't know what to do with any other type
1080                                 * so ignore it.
1081                                 */
1082                                 else
1083                                         s->tlsext_status_type = -1;
1084                         }
1085
1086                 /* session ticket processed earlier */
1087                 data+=size;
1088                 }
1089
1090         *p = data;
1091
1092         ri_check:
1093
1094         /* Need RI if renegotiating */
1095
1096         if (!renegotiate_seen && s->new_session &&
1097                 !(s->options & SSL_OP_ALLOW_UNSAFE_LEGACY_RENEGOTIATION))
1098                 {
1099                 *al = SSL_AD_HANDSHAKE_FAILURE;
1100                 SSLerr(SSL_F_SSL_PARSE_CLIENTHELLO_TLSEXT,
1101                                 SSL_R_UNSAFE_LEGACY_RENEGOTIATION_DISABLED);
1102                 return 0;
1103                 }
1104
1105         return 1;
1106         }
1107
1108 int ssl_parse_serverhello_tlsext(SSL *s, unsigned char **p, unsigned char *d, int n, int *al)
1109         {
1110         unsigned short length;
1111         unsigned short type;
1112         unsigned short size;
1113         unsigned char *data = *p;
1114         int tlsext_servername = 0;
1115         int renegotiate_seen = 0;
1116
1117         if (data >= (d+n-2))
1118                 goto ri_check;
1119
1120         n2s(data,length);
1121         if (data+length != d+n)
1122                 {
1123                 *al = SSL_AD_DECODE_ERROR;
1124                 return 0;
1125                 }
1126
1127         while(data <= (d+n-4))
1128                 {
1129                 n2s(data,type);
1130                 n2s(data,size);
1131
1132                 if (data+size > (d+n))
1133                         goto ri_check;
1134
1135                 if (s->tlsext_debug_cb)
1136                         s->tlsext_debug_cb(s, 1, type, data, size,
1137                                                 s->tlsext_debug_arg);
1138
1139                 if (type == TLSEXT_TYPE_server_name)
1140                         {
1141                         if (s->tlsext_hostname == NULL || size > 0)
1142                                 {
1143                                 *al = TLS1_AD_UNRECOGNIZED_NAME;
1144                                 return 0;
1145                                 }
1146                         tlsext_servername = 1;
1147                         }
1148
1149 #ifndef OPENSSL_NO_EC
1150                 else if (type == TLSEXT_TYPE_ec_point_formats)
1151                         {
1152                         unsigned char *sdata = data;
1153                         int ecpointformatlist_length = *(sdata++);
1154
1155                         if (ecpointformatlist_length != size - 1 ||
1156                                 ecpointformatlist_length < 1)
1157                                 {
1158                                 *al = TLS1_AD_DECODE_ERROR;
1159                                 return 0;
1160                                 }
1161                         if (!s->hit)
1162                                 {
1163                                 s->session->tlsext_ecpointformatlist_length = 0;
1164                                 if (s->session->tlsext_ecpointformatlist != NULL) OPENSSL_free(s->session->tlsext_ecpointformatlist);
1165                                 if ((s->session->tlsext_ecpointformatlist = OPENSSL_malloc(ecpointformatlist_length)) == NULL)
1166                                         {
1167                                         *al = TLS1_AD_INTERNAL_ERROR;
1168                                         return 0;
1169                                         }
1170                                 s->session->tlsext_ecpointformatlist_length = ecpointformatlist_length;
1171                                 memcpy(s->session->tlsext_ecpointformatlist, sdata, ecpointformatlist_length);
1172                                 }
1173 #if 0
1174                         fprintf(stderr,"ssl_parse_serverhello_tlsext s->session->tlsext_ecpointformatlist ");
1175                         sdata = s->session->tlsext_ecpointformatlist;
1176                         for (i = 0; i < s->session->tlsext_ecpointformatlist_length; i++)
1177                                 fprintf(stderr,"%i ",*(sdata++));
1178                         fprintf(stderr,"\n");
1179 #endif
1180                         }
1181 #endif /* OPENSSL_NO_EC */
1182
1183                 else if (type == TLSEXT_TYPE_session_ticket)
1184                         {
1185                         if (s->tls_session_ticket_ext_cb &&
1186                             !s->tls_session_ticket_ext_cb(s, data, size, s->tls_session_ticket_ext_cb_arg))
1187                                 {
1188                                 *al = TLS1_AD_INTERNAL_ERROR;
1189                                 return 0;
1190                                 }
1191                         if ((SSL_get_options(s) & SSL_OP_NO_TICKET)
1192                                 || (size > 0))
1193                                 {
1194                                 *al = TLS1_AD_UNSUPPORTED_EXTENSION;
1195                                 return 0;
1196                                 }
1197                         s->tlsext_ticket_expected = 1;
1198                         }
1199 #ifdef TLSEXT_TYPE_opaque_prf_input
1200                 else if (type == TLSEXT_TYPE_opaque_prf_input &&
1201                      s->version != DTLS1_VERSION)
1202                         {
1203                         unsigned char *sdata = data;
1204
1205                         if (size < 2)
1206                                 {
1207                                 *al = SSL_AD_DECODE_ERROR;
1208                                 return 0;
1209                                 }
1210                         n2s(sdata, s->s3->server_opaque_prf_input_len);
1211                         if (s->s3->server_opaque_prf_input_len != size - 2)
1212                                 {
1213                                 *al = SSL_AD_DECODE_ERROR;
1214                                 return 0;
1215                                 }
1216
1217                         if (s->s3->server_opaque_prf_input != NULL) /* shouldn't really happen */
1218                                 OPENSSL_free(s->s3->server_opaque_prf_input);
1219                         if (s->s3->server_opaque_prf_input_len == 0)
1220                                 s->s3->server_opaque_prf_input = OPENSSL_malloc(1); /* dummy byte just to get non-NULL */
1221                         else
1222                                 s->s3->server_opaque_prf_input = BUF_memdup(sdata, s->s3->server_opaque_prf_input_len);
1223
1224                         if (s->s3->server_opaque_prf_input == NULL)
1225                                 {
1226                                 *al = TLS1_AD_INTERNAL_ERROR;
1227                                 return 0;
1228                                 }
1229                         }
1230 #endif
1231                 else if (type == TLSEXT_TYPE_status_request &&
1232                          s->version != DTLS1_VERSION)
1233                         {
1234                         /* MUST be empty and only sent if we've requested
1235                          * a status request message.
1236                          */
1237                         if ((s->tlsext_status_type == -1) || (size > 0))
1238                                 {
1239                                 *al = TLS1_AD_UNSUPPORTED_EXTENSION;
1240                                 return 0;
1241                                 }
1242                         /* Set flag to expect CertificateStatus message */
1243                         s->tlsext_status_expected = 1;
1244                         }
1245                 else if (type == TLSEXT_TYPE_renegotiate)
1246                         {
1247                         if(!ssl_parse_serverhello_renegotiate_ext(s, data, size, al))
1248                                 return 0;
1249                         renegotiate_seen = 1;
1250                         }
1251                 data+=size;
1252                 }
1253
1254         if (data != d+n)
1255                 {
1256                 *al = SSL_AD_DECODE_ERROR;
1257                 return 0;
1258                 }
1259
1260         if (!s->hit && tlsext_servername == 1)
1261                 {
1262                 if (s->tlsext_hostname)
1263                         {
1264                         if (s->session->tlsext_hostname == NULL)
1265                                 {
1266                                 s->session->tlsext_hostname = BUF_strdup(s->tlsext_hostname);
1267                                 if (!s->session->tlsext_hostname)
1268                                         {
1269                                         *al = SSL_AD_UNRECOGNIZED_NAME;
1270                                         return 0;
1271                                         }
1272                                 }
1273                         else
1274                                 {
1275                                 *al = SSL_AD_DECODE_ERROR;
1276                                 return 0;
1277                                 }
1278                         }
1279                 }
1280
1281         *p = data;
1282
1283         ri_check:
1284
1285         /* Determine if we need to see RI. Strictly speaking if we want to
1286          * avoid an attack we should *always* see RI even on initial server
1287          * hello because the client doesn't see any renegotiation during an
1288          * attack. However this would mean we could not connect to any server
1289          * which doesn't support RI so for the immediate future tolerate RI
1290          * absence on initial connect only.
1291          */
1292         if (!renegotiate_seen
1293                 && !(s->options & SSL_OP_LEGACY_SERVER_CONNECT)
1294                 && !(s->options & SSL_OP_ALLOW_UNSAFE_LEGACY_RENEGOTIATION))
1295                 {
1296                 *al = SSL_AD_HANDSHAKE_FAILURE;
1297                 SSLerr(SSL_F_SSL_PARSE_SERVERHELLO_TLSEXT,
1298                                 SSL_R_UNSAFE_LEGACY_RENEGOTIATION_DISABLED);
1299                 return 0;
1300                 }
1301
1302         return 1;
1303         }
1304
1305
1306 int ssl_prepare_clienthello_tlsext(SSL *s)
1307         {
1308 #ifndef OPENSSL_NO_EC
1309         /* If we are client and using an elliptic curve cryptography cipher suite, send the point formats
1310          * and elliptic curves we support.
1311          */
1312         int using_ecc = 0;
1313         int i;
1314         unsigned char *j;
1315         unsigned long alg_k, alg_a;
1316         STACK_OF(SSL_CIPHER) *cipher_stack = SSL_get_ciphers(s);
1317
1318         for (i = 0; i < sk_SSL_CIPHER_num(cipher_stack); i++)
1319                 {
1320                 SSL_CIPHER *c = sk_SSL_CIPHER_value(cipher_stack, i);
1321
1322                 alg_k = c->algorithm_mkey;
1323                 alg_a = c->algorithm_auth;
1324                 if ((alg_k & (SSL_kEECDH|SSL_kECDHr|SSL_kECDHe) || (alg_a & SSL_aECDSA)))
1325                         {
1326                         using_ecc = 1;
1327                         break;
1328                         }
1329                 }
1330         using_ecc = using_ecc && (s->version == TLS1_VERSION);
1331         if (using_ecc)
1332                 {
1333                 if (s->tlsext_ecpointformatlist != NULL) OPENSSL_free(s->tlsext_ecpointformatlist);
1334                 if ((s->tlsext_ecpointformatlist = OPENSSL_malloc(3)) == NULL)
1335                         {
1336                         SSLerr(SSL_F_SSL_PREPARE_CLIENTHELLO_TLSEXT,ERR_R_MALLOC_FAILURE);
1337                         return -1;
1338                         }
1339                 s->tlsext_ecpointformatlist_length = 3;
1340                 s->tlsext_ecpointformatlist[0] = TLSEXT_ECPOINTFORMAT_uncompressed;
1341                 s->tlsext_ecpointformatlist[1] = TLSEXT_ECPOINTFORMAT_ansiX962_compressed_prime;
1342                 s->tlsext_ecpointformatlist[2] = TLSEXT_ECPOINTFORMAT_ansiX962_compressed_char2;
1343
1344                 /* we support all named elliptic curves in draft-ietf-tls-ecc-12 */
1345                 if (s->tlsext_ellipticcurvelist != NULL) OPENSSL_free(s->tlsext_ellipticcurvelist);
1346                 s->tlsext_ellipticcurvelist_length = sizeof(nid_list)/sizeof(nid_list[0]) * 2;
1347                 if ((s->tlsext_ellipticcurvelist = OPENSSL_malloc(s->tlsext_ellipticcurvelist_length)) == NULL)
1348                         {
1349                         s->tlsext_ellipticcurvelist_length = 0;
1350                         SSLerr(SSL_F_SSL_PREPARE_CLIENTHELLO_TLSEXT,ERR_R_MALLOC_FAILURE);
1351                         return -1;
1352                         }
1353                 for (i = 1, j = s->tlsext_ellipticcurvelist; (unsigned int)i <=
1354                                 sizeof(nid_list)/sizeof(nid_list[0]); i++)
1355                         s2n(i,j);
1356                 }
1357 #endif /* OPENSSL_NO_EC */
1358
1359 #ifdef TLSEXT_TYPE_opaque_prf_input
1360         {
1361                 int r = 1;
1362
1363                 if (s->ctx->tlsext_opaque_prf_input_callback != 0)
1364                         {
1365                         r = s->ctx->tlsext_opaque_prf_input_callback(s, NULL, 0, s->ctx->tlsext_opaque_prf_input_callback_arg);
1366                         if (!r)
1367                                 return -1;
1368                         }
1369
1370                 if (s->tlsext_opaque_prf_input != NULL)
1371                         {
1372                         if (s->s3->client_opaque_prf_input != NULL) /* shouldn't really happen */
1373                                 OPENSSL_free(s->s3->client_opaque_prf_input);
1374
1375                         if (s->tlsext_opaque_prf_input_len == 0)
1376                                 s->s3->client_opaque_prf_input = OPENSSL_malloc(1); /* dummy byte just to get non-NULL */
1377                         else
1378                                 s->s3->client_opaque_prf_input = BUF_memdup(s->tlsext_opaque_prf_input, s->tlsext_opaque_prf_input_len);
1379                         if (s->s3->client_opaque_prf_input == NULL)
1380                                 {
1381                                 SSLerr(SSL_F_SSL_PREPARE_CLIENTHELLO_TLSEXT,ERR_R_MALLOC_FAILURE);
1382                                 return -1;
1383                                 }
1384                         s->s3->client_opaque_prf_input_len = s->tlsext_opaque_prf_input_len;
1385                         }
1386
1387                 if (r == 2)
1388                         /* at callback's request, insist on receiving an appropriate server opaque PRF input */
1389                         s->s3->server_opaque_prf_input_len = s->tlsext_opaque_prf_input_len;
1390         }
1391 #endif
1392
1393         return 1;
1394         }
1395
1396 int ssl_prepare_serverhello_tlsext(SSL *s)
1397         {
1398 #ifndef OPENSSL_NO_EC
1399         /* If we are server and using an ECC cipher suite, send the point formats we support
1400          * if the client sent us an ECPointsFormat extension.  Note that the server is not
1401          * supposed to send an EllipticCurves extension.
1402          */
1403
1404         unsigned long alg_k = s->s3->tmp.new_cipher->algorithm_mkey;
1405         unsigned long alg_a = s->s3->tmp.new_cipher->algorithm_auth;
1406         int using_ecc = (alg_k & (SSL_kEECDH|SSL_kECDHr|SSL_kECDHe)) || (alg_a & SSL_aECDSA);
1407         using_ecc = using_ecc && (s->session->tlsext_ecpointformatlist != NULL);
1408
1409         if (using_ecc)
1410                 {
1411                 if (s->tlsext_ecpointformatlist != NULL) OPENSSL_free(s->tlsext_ecpointformatlist);
1412                 if ((s->tlsext_ecpointformatlist = OPENSSL_malloc(3)) == NULL)
1413                         {
1414                         SSLerr(SSL_F_SSL_PREPARE_SERVERHELLO_TLSEXT,ERR_R_MALLOC_FAILURE);
1415                         return -1;
1416                         }
1417                 s->tlsext_ecpointformatlist_length = 3;
1418                 s->tlsext_ecpointformatlist[0] = TLSEXT_ECPOINTFORMAT_uncompressed;
1419                 s->tlsext_ecpointformatlist[1] = TLSEXT_ECPOINTFORMAT_ansiX962_compressed_prime;
1420                 s->tlsext_ecpointformatlist[2] = TLSEXT_ECPOINTFORMAT_ansiX962_compressed_char2;
1421                 }
1422 #endif /* OPENSSL_NO_EC */
1423
1424         return 1;
1425         }
1426
1427 int ssl_check_clienthello_tlsext_early(SSL *s)
1428         {
1429         int ret=SSL_TLSEXT_ERR_NOACK;
1430         int al = SSL_AD_UNRECOGNIZED_NAME;
1431
1432 #ifndef OPENSSL_NO_EC
1433         /* The handling of the ECPointFormats extension is done elsewhere, namely in
1434          * ssl3_choose_cipher in s3_lib.c.
1435          */
1436         /* The handling of the EllipticCurves extension is done elsewhere, namely in
1437          * ssl3_choose_cipher in s3_lib.c.
1438          */
1439 #endif
1440
1441         if (s->ctx != NULL && s->ctx->tlsext_servername_callback != 0)
1442                 ret = s->ctx->tlsext_servername_callback(s, &al, s->ctx->tlsext_servername_arg);
1443         else if (s->initial_ctx != NULL && s->initial_ctx->tlsext_servername_callback != 0)
1444                 ret = s->initial_ctx->tlsext_servername_callback(s, &al, s->initial_ctx->tlsext_servername_arg);
1445
1446 #ifdef TLSEXT_TYPE_opaque_prf_input
1447         {
1448                 /* This sort of belongs into ssl_prepare_serverhello_tlsext(),
1449                  * but we might be sending an alert in response to the client hello,
1450                  * so this has to happen here in
1451                  * ssl_check_clienthello_tlsext_early(). */
1452
1453                 int r = 1;
1454
1455                 if (s->ctx->tlsext_opaque_prf_input_callback != 0)
1456                         {
1457                         r = s->ctx->tlsext_opaque_prf_input_callback(s, NULL, 0, s->ctx->tlsext_opaque_prf_input_callback_arg);
1458                         if (!r)
1459                                 {
1460                                 ret = SSL_TLSEXT_ERR_ALERT_FATAL;
1461                                 al = SSL_AD_INTERNAL_ERROR;
1462                                 goto err;
1463                                 }
1464                         }
1465
1466                 if (s->s3->server_opaque_prf_input != NULL) /* shouldn't really happen */
1467                         OPENSSL_free(s->s3->server_opaque_prf_input);
1468                 s->s3->server_opaque_prf_input = NULL;
1469
1470                 if (s->tlsext_opaque_prf_input != NULL)
1471                         {
1472                         if (s->s3->client_opaque_prf_input != NULL &&
1473                                 s->s3->client_opaque_prf_input_len == s->tlsext_opaque_prf_input_len)
1474                                 {
1475                                 /* can only use this extension if we have a server opaque PRF input
1476                                  * of the same length as the client opaque PRF input! */
1477
1478                                 if (s->tlsext_opaque_prf_input_len == 0)
1479                                         s->s3->server_opaque_prf_input = OPENSSL_malloc(1); /* dummy byte just to get non-NULL */
1480                                 else
1481                                         s->s3->server_opaque_prf_input = BUF_memdup(s->tlsext_opaque_prf_input, s->tlsext_opaque_prf_input_len);
1482                                 if (s->s3->server_opaque_prf_input == NULL)
1483                                         {
1484                                         ret = SSL_TLSEXT_ERR_ALERT_FATAL;
1485                                         al = SSL_AD_INTERNAL_ERROR;
1486                                         goto err;
1487                                         }
1488                                 s->s3->server_opaque_prf_input_len = s->tlsext_opaque_prf_input_len;
1489                                 }
1490                         }
1491
1492                 if (r == 2 && s->s3->server_opaque_prf_input == NULL)
1493                         {
1494                         /* The callback wants to enforce use of the extension,
1495                          * but we can't do that with the client opaque PRF input;
1496                          * abort the handshake.
1497                          */
1498                         ret = SSL_TLSEXT_ERR_ALERT_FATAL;
1499                         al = SSL_AD_HANDSHAKE_FAILURE;
1500                         }
1501         }
1502
1503  err:
1504 #endif
1505         switch (ret)
1506                 {
1507                 case SSL_TLSEXT_ERR_ALERT_FATAL:
1508                         ssl3_send_alert(s,SSL3_AL_FATAL,al);
1509                         return -1;
1510
1511                 case SSL_TLSEXT_ERR_ALERT_WARNING:
1512                         ssl3_send_alert(s,SSL3_AL_WARNING,al);
1513                         return 1;
1514
1515                 case SSL_TLSEXT_ERR_NOACK:
1516                         s->servername_done=0;
1517                         default:
1518                 return 1;
1519                 }
1520         }
1521
1522 int ssl_check_clienthello_tlsext_late(SSL *s)
1523         {
1524         int ret = SSL_TLSEXT_ERR_OK;
1525         int al;
1526
1527         /* If status request then ask callback what to do.
1528          * Note: this must be called after servername callbacks in case
1529          * the certificate has changed, and must be called after the cipher
1530          * has been chosen because this may influence which certificate is sent
1531          */
1532         if (s->tlsext_status_type != -1 && s->ctx && s->ctx->tlsext_status_cb)
1533                 {
1534                 int r;
1535                 CERT_PKEY *certpkey;
1536                 certpkey = ssl_get_server_send_pkey(s);
1537                 /* If no certificate can't return certificate status */
1538                 if (certpkey == NULL)
1539                         {
1540                         s->tlsext_status_expected = 0;
1541                         return 1;
1542                         }
1543                 /* Set current certificate to one we will use so
1544                  * SSL_get_certificate et al can pick it up.
1545                  */
1546                 s->cert->key = certpkey;
1547                 r = s->ctx->tlsext_status_cb(s, s->ctx->tlsext_status_arg);
1548                 switch (r)
1549                         {
1550                         /* We don't want to send a status request response */
1551                         case SSL_TLSEXT_ERR_NOACK:
1552                                 s->tlsext_status_expected = 0;
1553                                 break;
1554                         /* status request response should be sent */
1555                         case SSL_TLSEXT_ERR_OK:
1556                                 if (s->tlsext_ocsp_resp)
1557                                         s->tlsext_status_expected = 1;
1558                                 else
1559                                         s->tlsext_status_expected = 0;
1560                                 break;
1561                         /* something bad happened */
1562                         case SSL_TLSEXT_ERR_ALERT_FATAL:
1563                                 ret = SSL_TLSEXT_ERR_ALERT_FATAL;
1564                                 al = SSL_AD_INTERNAL_ERROR;
1565                                 goto err;
1566                         }
1567                 }
1568         else
1569                 s->tlsext_status_expected = 0;
1570
1571  err:
1572         switch (ret)
1573                 {
1574                 case SSL_TLSEXT_ERR_ALERT_FATAL:
1575                         ssl3_send_alert(s, SSL3_AL_FATAL, al);
1576                         return -1;
1577
1578                 case SSL_TLSEXT_ERR_ALERT_WARNING:
1579                         ssl3_send_alert(s, SSL3_AL_WARNING, al);
1580                         return 1;
1581
1582                 default:
1583                         return 1;
1584                 }
1585         }
1586
1587 int ssl_check_serverhello_tlsext(SSL *s)
1588         {
1589         int ret=SSL_TLSEXT_ERR_NOACK;
1590         int al = SSL_AD_UNRECOGNIZED_NAME;
1591
1592 #ifndef OPENSSL_NO_EC
1593         /* If we are client and using an elliptic curve cryptography cipher
1594          * suite, then if server returns an EC point formats lists extension
1595          * it must contain uncompressed.
1596          */
1597         unsigned long alg_k = s->s3->tmp.new_cipher->algorithm_mkey;
1598         unsigned long alg_a = s->s3->tmp.new_cipher->algorithm_auth;
1599         if ((s->tlsext_ecpointformatlist != NULL) && (s->tlsext_ecpointformatlist_length > 0) &&
1600             (s->session->tlsext_ecpointformatlist != NULL) && (s->session->tlsext_ecpointformatlist_length > 0) &&
1601             ((alg_k & (SSL_kEECDH|SSL_kECDHr|SSL_kECDHe)) || (alg_a & SSL_aECDSA)))
1602                 {
1603                 /* we are using an ECC cipher */
1604                 size_t i;
1605                 unsigned char *list;
1606                 int found_uncompressed = 0;
1607                 list = s->session->tlsext_ecpointformatlist;
1608                 for (i = 0; i < s->session->tlsext_ecpointformatlist_length; i++)
1609                         {
1610                         if (*(list++) == TLSEXT_ECPOINTFORMAT_uncompressed)
1611                                 {
1612                                 found_uncompressed = 1;
1613                                 break;
1614                                 }
1615                         }
1616                 if (!found_uncompressed)
1617                         {
1618                         SSLerr(SSL_F_SSL_CHECK_SERVERHELLO_TLSEXT,SSL_R_TLS_INVALID_ECPOINTFORMAT_LIST);
1619                         return -1;
1620                         }
1621                 }
1622         ret = SSL_TLSEXT_ERR_OK;
1623 #endif /* OPENSSL_NO_EC */
1624
1625         if (s->ctx != NULL && s->ctx->tlsext_servername_callback != 0)
1626                 ret = s->ctx->tlsext_servername_callback(s, &al, s->ctx->tlsext_servername_arg);
1627         else if (s->initial_ctx != NULL && s->initial_ctx->tlsext_servername_callback != 0)
1628                 ret = s->initial_ctx->tlsext_servername_callback(s, &al, s->initial_ctx->tlsext_servername_arg);
1629
1630 #ifdef TLSEXT_TYPE_opaque_prf_input
1631         if (s->s3->server_opaque_prf_input_len > 0)
1632                 {
1633                 /* This case may indicate that we, as a client, want to insist on using opaque PRF inputs.
1634                  * So first verify that we really have a value from the server too. */
1635
1636                 if (s->s3->server_opaque_prf_input == NULL)
1637                         {
1638                         ret = SSL_TLSEXT_ERR_ALERT_FATAL;
1639                         al = SSL_AD_HANDSHAKE_FAILURE;
1640                         }
1641
1642                 /* Anytime the server *has* sent an opaque PRF input, we need to check
1643                  * that we have a client opaque PRF input of the same size. */
1644                 if (s->s3->client_opaque_prf_input == NULL ||
1645                     s->s3->client_opaque_prf_input_len != s->s3->server_opaque_prf_input_len)
1646                         {
1647                         ret = SSL_TLSEXT_ERR_ALERT_FATAL;
1648                         al = SSL_AD_ILLEGAL_PARAMETER;
1649                         }
1650                 }
1651 #endif
1652
1653         /* If we've requested certificate status and we wont get one
1654          * tell the callback
1655          */
1656         if ((s->tlsext_status_type != -1) && !(s->tlsext_status_expected)
1657                         && s->ctx && s->ctx->tlsext_status_cb)
1658                 {
1659                 int r;
1660                 /* Set resp to NULL, resplen to -1 so callback knows
1661                  * there is no response.
1662                  */
1663                 if (s->tlsext_ocsp_resp)
1664                         {
1665                         OPENSSL_free(s->tlsext_ocsp_resp);
1666                         s->tlsext_ocsp_resp = NULL;
1667                         }
1668                 s->tlsext_ocsp_resplen = -1;
1669                 r = s->ctx->tlsext_status_cb(s, s->ctx->tlsext_status_arg);
1670                 if (r == 0)
1671                         {
1672                         al = SSL_AD_BAD_CERTIFICATE_STATUS_RESPONSE;
1673                         ret = SSL_TLSEXT_ERR_ALERT_FATAL;
1674                         }
1675                 if (r < 0)
1676                         {
1677                         al = SSL_AD_INTERNAL_ERROR;
1678                         ret = SSL_TLSEXT_ERR_ALERT_FATAL;
1679                         }
1680                 }
1681
1682         switch (ret)
1683                 {
1684                 case SSL_TLSEXT_ERR_ALERT_FATAL:
1685                         ssl3_send_alert(s,SSL3_AL_FATAL,al);
1686                         return -1;
1687
1688                 case SSL_TLSEXT_ERR_ALERT_WARNING:
1689                         ssl3_send_alert(s,SSL3_AL_WARNING,al);
1690                         return 1;
1691
1692                 case SSL_TLSEXT_ERR_NOACK:
1693                         s->servername_done=0;
1694                         default:
1695                 return 1;
1696                 }
1697         }
1698
1699 /* Since the server cache lookup is done early on in the processing of client
1700  * hello and other operations depend on the result we need to handle any TLS
1701  * session ticket extension at the same time.
1702  */
1703
1704 int tls1_process_ticket(SSL *s, unsigned char *session_id, int len,
1705                                 const unsigned char *limit, SSL_SESSION **ret)
1706         {
1707         /* Point after session ID in client hello */
1708         const unsigned char *p = session_id + len;
1709         unsigned short i;
1710
1711         /* If tickets disabled behave as if no ticket present
1712          * to permit stateful resumption.
1713          */
1714         if (SSL_get_options(s) & SSL_OP_NO_TICKET)
1715                 return 1;
1716
1717         if ((s->version <= SSL3_VERSION) || !limit)
1718                 return 1;
1719         if (p >= limit)
1720                 return -1;
1721         /* Skip past DTLS cookie */
1722         if (s->version == DTLS1_VERSION || s->version == DTLS1_BAD_VER)
1723                 {
1724                 i = *(p++);
1725                 p+= i;
1726                 if (p >= limit)
1727                         return -1;
1728                 }
1729         /* Skip past cipher list */
1730         n2s(p, i);
1731         p+= i;
1732         if (p >= limit)
1733                 return -1;
1734         /* Skip past compression algorithm list */
1735         i = *(p++);
1736         p += i;
1737         if (p > limit)
1738                 return -1;
1739         /* Now at start of extensions */
1740         if ((p + 2) >= limit)
1741                 return 1;
1742         n2s(p, i);
1743         while ((p + 4) <= limit)
1744                 {
1745                 unsigned short type, size;
1746                 n2s(p, type);
1747                 n2s(p, size);
1748                 if (p + size > limit)
1749                         return 1;
1750                 if (type == TLSEXT_TYPE_session_ticket)
1751                         {
1752                         /* If tickets disabled indicate cache miss which will
1753                          * trigger a full handshake
1754                          */
1755                         if (SSL_get_options(s) & SSL_OP_NO_TICKET)
1756                                 return 1;
1757                         /* If zero length note client will accept a ticket
1758                          * and indicate cache miss to trigger full handshake
1759                          */
1760                         if (size == 0)
1761                                 {
1762                                 s->tlsext_ticket_expected = 1;
1763                                 return 0;       /* Cache miss */
1764                                 }
1765                         if (s->tls_session_secret_cb)
1766                                 {
1767                                 /* Indicate cache miss here and instead of
1768                                  * generating the session from ticket now,
1769                                  * trigger abbreviated handshake based on
1770                                  * external mechanism to calculate the master
1771                                  * secret later. */
1772                                 return 0;
1773                                 }
1774                         return tls_decrypt_ticket(s, p, size, session_id, len,
1775                                                                         ret);
1776                         }
1777                 p += size;
1778                 }
1779         return 1;
1780         }
1781
1782 static int tls_decrypt_ticket(SSL *s, const unsigned char *etick, int eticklen,
1783                                 const unsigned char *sess_id, int sesslen,
1784                                 SSL_SESSION **psess)
1785         {
1786         SSL_SESSION *sess;
1787         unsigned char *sdec;
1788         const unsigned char *p;
1789         int slen, mlen, renew_ticket = 0;
1790         unsigned char tick_hmac[EVP_MAX_MD_SIZE];
1791         HMAC_CTX hctx;
1792         EVP_CIPHER_CTX ctx;
1793         SSL_CTX *tctx = s->initial_ctx;
1794         /* Need at least keyname + iv + some encrypted data */
1795         if (eticklen < 48)
1796                 goto tickerr;
1797         /* Initialize session ticket encryption and HMAC contexts */
1798         HMAC_CTX_init(&hctx);
1799         EVP_CIPHER_CTX_init(&ctx);
1800         if (tctx->tlsext_ticket_key_cb)
1801                 {
1802                 unsigned char *nctick = (unsigned char *)etick;
1803                 int rv = tctx->tlsext_ticket_key_cb(s, nctick, nctick + 16,
1804                                                         &ctx, &hctx, 0);
1805                 if (rv < 0)
1806                         return -1;
1807                 if (rv == 0)
1808                         goto tickerr;
1809                 if (rv == 2)
1810                         renew_ticket = 1;
1811                 }
1812         else
1813                 {
1814                 /* Check key name matches */
1815                 if (memcmp(etick, tctx->tlsext_tick_key_name, 16))
1816                         goto tickerr;
1817                 HMAC_Init_ex(&hctx, tctx->tlsext_tick_hmac_key, 16,
1818                                         tlsext_tick_md(), NULL);
1819                 EVP_DecryptInit_ex(&ctx, EVP_aes_128_cbc(), NULL,
1820                                 tctx->tlsext_tick_aes_key, etick + 16);
1821                 }
1822         /* Attempt to process session ticket, first conduct sanity and
1823          * integrity checks on ticket.
1824          */
1825         mlen = HMAC_size(&hctx);
1826         if (mlen < 0)
1827                 {
1828                 EVP_CIPHER_CTX_cleanup(&ctx);
1829                 return -1;
1830                 }
1831         eticklen -= mlen;
1832         /* Check HMAC of encrypted ticket */
1833         HMAC_Update(&hctx, etick, eticklen);
1834         HMAC_Final(&hctx, tick_hmac, NULL);
1835         HMAC_CTX_cleanup(&hctx);
1836         if (CRYPTO_memcmp(tick_hmac, etick + eticklen, mlen))
1837                 {
1838                 EVP_CIPHER_CTX_cleanup(&ctx);
1839                 goto tickerr;
1840                 }
1841         /* Attempt to decrypt session data */
1842         /* Move p after IV to start of encrypted ticket, update length */
1843         p = etick + 16 + EVP_CIPHER_CTX_iv_length(&ctx);
1844         eticklen -= 16 + EVP_CIPHER_CTX_iv_length(&ctx);
1845         sdec = OPENSSL_malloc(eticklen);
1846         if (!sdec)
1847                 {
1848                 EVP_CIPHER_CTX_cleanup(&ctx);
1849                 return -1;
1850                 }
1851         EVP_DecryptUpdate(&ctx, sdec, &slen, p, eticklen);
1852         if (EVP_DecryptFinal(&ctx, sdec + slen, &mlen) <= 0)
1853                 {
1854                 EVP_CIPHER_CTX_cleanup(&ctx);
1855                 OPENSSL_free(sdec);
1856                 goto tickerr;
1857                 }
1858         slen += mlen;
1859         EVP_CIPHER_CTX_cleanup(&ctx);
1860         p = sdec;
1861
1862         sess = d2i_SSL_SESSION(NULL, &p, slen);
1863         OPENSSL_free(sdec);
1864         if (sess)
1865                 {
1866                 /* The session ID if non-empty is used by some clients to
1867                  * detect that the ticket has been accepted. So we copy it to
1868                  * the session structure. If it is empty set length to zero
1869                  * as required by standard.
1870                  */
1871                 if (sesslen)
1872                         memcpy(sess->session_id, sess_id, sesslen);
1873                 sess->session_id_length = sesslen;
1874                 *psess = sess;
1875                 s->tlsext_ticket_expected = renew_ticket;
1876                 return 1;
1877                 }
1878         /* If session decrypt failure indicate a cache miss and set state to
1879          * send a new ticket
1880          */
1881         tickerr:
1882         s->tlsext_ticket_expected = 1;
1883         return 0;
1884         }
1885
1886 #endif