ssl/t1_lib.c

   1 /* ssl/t1_lib.c */
   2 /* Copyright (C) 1995-1998 Eric Young (eay@cryptsoft.com)
   3  * All rights reserved.
   4  *
   5  * This package is an SSL implementation written
   6  * by Eric Young (eay@cryptsoft.com).
   7  * The implementation was written so as to conform with Netscapes SSL.
   8  *
   9  * This library is free for commercial and non-commercial use as long as
  10  * the following conditions are aheared to.  The following conditions
  11  * apply to all code found in this distribution, be it the RC4, RSA,
  12  * lhash, DES, etc., code; not just the SSL code.  The SSL documentation
  13  * included with this distribution is covered by the same copyright terms
  14  * except that the holder is Tim Hudson (tjh@cryptsoft.com).
  15  *
  16  * Copyright remains Eric Young's, and as such any Copyright notices in
  17  * the code are not to be removed.
  18  * If this package is used in a product, Eric Young should be given attribution
  19  * as the author of the parts of the library used.
  20  * This can be in the form of a textual message at program startup or
  21  * in documentation (online or textual) provided with the package.
  22  *
  23  * Redistribution and use in source and binary forms, with or without
  24  * modification, are permitted provided that the following conditions
  25  * are met:
  26  * 1. Redistributions of source code must retain the copyright
  27  *    notice, this list of conditions and the following disclaimer.
  28  * 2. Redistributions in binary form must reproduce the above copyright
  29  *    notice, this list of conditions and the following disclaimer in the
  30  *    documentation and/or other materials provided with the distribution.
  31  * 3. All advertising materials mentioning features or use of this software
  32  *    must display the following acknowledgement:
  33  *    "This product includes cryptographic software written by
  34  *     Eric Young (eay@cryptsoft.com)"
  35  *    The word 'cryptographic' can be left out if the rouines from the library
  36  *    being used are not cryptographic related :-).
  37  * 4. If you include any Windows specific code (or a derivative thereof) from
  38  *    the apps directory (application code) you must include an acknowledgement:
  39  *    "This product includes software written by Tim Hudson (tjh@cryptsoft.com)"
  40  *
  41  * THIS SOFTWARE IS PROVIDED BY ERIC YOUNG ``AS IS'' AND
  42  * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
  43  * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
  44  * ARE DISCLAIMED.  IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE
  45  * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
  46  * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
  47  * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
  48  * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
  49  * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
  50  * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
  51  * SUCH DAMAGE.
  52  *
  53  * The licence and distribution terms for any publically available version or
  54  * derivative of this code cannot be changed.  i.e. this code cannot simply be
  55  * copied and put under another distribution licence
  56  * [including the GNU Public Licence.]
  57  */
  58
  59 #include <stdio.h>
  60 #include <openssl/objects.h>
  61 #include <openssl/evp.h>
  62 #include <openssl/hmac.h>
  63 #include <openssl/ocsp.h>
  64 #include "ssl_locl.h"
  65
  66 const char tls1_version_str[]="TLSv1" OPENSSL_VERSION_PTEXT;
  67
  68 #ifndef OPENSSL_NO_TLSEXT
  69 static int tls_decrypt_ticket(SSL *s, const unsigned char *tick, int ticklen,
  70                                 const unsigned char *sess_id, int sesslen,
  71                                 SSL_SESSION **psess);
  72 #endif
  73
  74 SSL3_ENC_METHOD TLSv1_enc_data={
  75         tls1_enc,
  76         tls1_mac,
  77         tls1_setup_key_block,
  78         tls1_generate_master_secret,
  79         tls1_change_cipher_state,
  80         tls1_final_finish_mac,
  81         TLS1_FINISH_MAC_LENGTH,
  82         tls1_cert_verify_mac,
  83         TLS_MD_CLIENT_FINISH_CONST,TLS_MD_CLIENT_FINISH_CONST_SIZE,
  84         TLS_MD_SERVER_FINISH_CONST,TLS_MD_SERVER_FINISH_CONST_SIZE,
  85         tls1_alert_code,
  86         };
  87
  88 long tls1_default_timeout(void)
  89         {
  90         /* 2 hours, the 24 hours mentioned in the TLSv1 spec
  91          * is way too long for http, the cache would over fill */
  92         return(60*60*2);
  93         }
  94
  95 IMPLEMENT_tls1_meth_func(tlsv1_base_method,
  96                         ssl_undefined_function,
  97                         ssl_undefined_function,
  98                         ssl_bad_method)
  99
 100 int tls1_new(SSL *s)
 101         {
 102         if (!ssl3_new(s)) return(0);
 103         s->method->ssl_clear(s);
 104         return(1);
 105         }
 106
 107 void tls1_free(SSL *s)
 108         {
 109         ssl3_free(s);
 110         }
 111
 112 void tls1_clear(SSL *s)
 113         {
 114         ssl3_clear(s);
 115         s->version=TLS1_VERSION;
 116         }
 117
 118 #if 0
 119 long tls1_ctrl(SSL *s, int cmd, long larg, char *parg)
 120         {
 121         return(0);
 122         }
 123
 124 long tls1_callback_ctrl(SSL *s, int cmd, void *(*fp)())
 125         {
 126         return(0);
 127         }
 128 #endif
 129
 130 #ifndef OPENSSL_NO_TLSEXT
 131 unsigned char *ssl_add_clienthello_tlsext(SSL *s, unsigned char *p, unsigned char *limit)
 132         {
 133         int extdatalen=0;
 134         unsigned char *ret = p;
 135
 136         /* don't add extensions for SSLv3 */
 137         if (s->client_version == SSL3_VERSION)
 138                 return p;
 139
 140         ret+=2;
 141
 142         if (ret>=limit) return NULL; /* this really never occurs, but ... */
 143
 144         if (s->tlsext_hostname != NULL)
 145                 {
 146                 /* Add TLS extension servername to the Client Hello message */
 147                 unsigned long size_str;
 148                 long lenmax;
 149
 150                 /* check for enough space.
 151                    4 for the servername type and entension length
 152                    2 for servernamelist length
 153                    1 for the hostname type
 154                    2 for hostname length
 155                    + hostname length
 156                 */
 157
 158                 if ((lenmax = limit - ret - 9) < 0
 159                 || (size_str = strlen(s->tlsext_hostname)) > (unsigned long)lenmax)
 160                         return NULL;
 161
 162                 /* extension type and length */
 163                 s2n(TLSEXT_TYPE_server_name,ret);
 164                 s2n(size_str+5,ret);
 165
 166                 /* length of servername list */
 167                 s2n(size_str+3,ret);
 168
 169                 /* hostname type, length and hostname */
 170                 *(ret++) = (unsigned char) TLSEXT_NAMETYPE_host_name;
 171                 s2n(size_str,ret);
 172                 memcpy(ret, s->tlsext_hostname, size_str);
 173                 ret+=size_str;
 174
 175                 }
 176
 177         /* Add the renegotiation option: TODOEKR switch */
 178         {
 179           int el;
 180
 181           if(!ssl_add_clienthello_renegotiate_ext(s, 0, &el, 0))
 182               {
 183               SSLerr(SSL_F_SSL_ADD_CLIENTHELLO_TLSEXT, ERR_R_INTERNAL_ERROR);
 184               return NULL;
 185               }
 186
 187           if((limit - p - 4 - el) < 0) return NULL;
 188
 189           s2n(TLSEXT_TYPE_renegotiate,ret);
 190           s2n(el,ret);
 191
 192           if(!ssl_add_clienthello_renegotiate_ext(s, ret, &el, el))
 193               {
 194               SSLerr(SSL_F_SSL_ADD_CLIENTHELLO_TLSEXT, ERR_R_INTERNAL_ERROR);
 195               return NULL;
 196               }
 197
 198           ret += el;
 199         }
 200
 201
 202         if (!(SSL_get_options(s) & SSL_OP_NO_TICKET))
 203                 {
 204                 int ticklen;
 205                 if (!s->new_session && s->session && s->session->tlsext_tick)
 206                         ticklen = s->session->tlsext_ticklen;
 207                 else
 208                         ticklen = 0;
 209                 /* Check for enough room 2 for extension type, 2 for len
 210                  * rest for ticket
 211                  */
 212                 if (limit - ret - 4 - ticklen < 0)
 213                         return NULL;
 214                 s2n(TLSEXT_TYPE_session_ticket,ret);
 215                 s2n(ticklen,ret);
 216                 if (ticklen)
 217                         {
 218                         memcpy(ret, s->session->tlsext_tick, ticklen);
 219                         ret += ticklen;
 220                         }
 221                 }
 222
 223         if (s->tlsext_status_type == TLSEXT_STATUSTYPE_ocsp)
 224                 {
 225                 int i;
 226                 long extlen, idlen, itmp;
 227                 OCSP_RESPID *id;
 228
 229                 idlen = 0;
 230                 for (i = 0; i < sk_OCSP_RESPID_num(s->tlsext_ocsp_ids); i++)
 231                         {
 232                         id = sk_OCSP_RESPID_value(s->tlsext_ocsp_ids, i);
 233                         itmp = i2d_OCSP_RESPID(id, NULL);
 234                         if (itmp <= 0)
 235                                 return NULL;
 236                         idlen += itmp + 2;
 237                         }
 238
 239                 if (s->tlsext_ocsp_exts)
 240                         {
 241                         extlen = i2d_X509_EXTENSIONS(s->tlsext_ocsp_exts, NULL);
 242                         if (extlen < 0)
 243                                 return NULL;
 244                         }
 245                 else
 246                         extlen = 0;
 247
 248                 if ((long)(limit - ret - 7 - extlen - idlen) < 0) return NULL;
 249                 s2n(TLSEXT_TYPE_status_request, ret);
 250                 if (extlen + idlen > 0xFFF0)
 251                         return NULL;
 252                 s2n(extlen + idlen + 5, ret);
 253                 *(ret++) = TLSEXT_STATUSTYPE_ocsp;
 254                 s2n(idlen, ret);
 255                 for (i = 0; i < sk_OCSP_RESPID_num(s->tlsext_ocsp_ids); i++)
 256                         {
 257                         /* save position of id len */
 258                         unsigned char *q = ret;
 259                         id = sk_OCSP_RESPID_value(s->tlsext_ocsp_ids, i);
 260                         /* skip over id len */
 261                         ret += 2;
 262                         itmp = i2d_OCSP_RESPID(id, &ret);
 263                         /* write id len */
 264                         s2n(itmp, q);
 265                         }
 266                 s2n(extlen, ret);
 267                 if (extlen > 0)
 268                         i2d_X509_EXTENSIONS(s->tlsext_ocsp_exts, &ret);
 269                 }
 270
 271         if ((extdatalen = ret-p-2)== 0)
 272                 return p;
 273
 274         s2n(extdatalen,p);
 275         return ret;
 276         }
 277
 278 unsigned char *ssl_add_serverhello_tlsext(SSL *s, unsigned char *p, unsigned char *limit)
 279         {
 280         int extdatalen=0;
 281         unsigned char *ret = p;
 282
 283         /* don't add extensions for SSLv3 */
 284         if (s->version == SSL3_VERSION)
 285                 return p;
 286
 287         ret+=2;
 288         if (ret>=limit) return NULL; /* this really never occurs, but ... */
 289
 290         if (!s->hit && s->servername_done == 1 && s->session->tlsext_hostname != NULL)
 291                 {
 292                 if (limit - ret - 4 < 0) return NULL;
 293
 294                 s2n(TLSEXT_TYPE_server_name,ret);
 295                 s2n(0,ret);
 296                 }
 297
 298         if(s->s3->send_connection_binding)
 299         {
 300           int el;
 301
 302           if(!ssl_add_serverhello_renegotiate_ext(s, 0, &el, 0))
 303               {
 304               SSLerr(SSL_F_SSL_ADD_SERVERHELLO_TLSEXT, ERR_R_INTERNAL_ERROR);
 305               return NULL;
 306               }
 307
 308           if((limit - p - 4 - el) < 0) return NULL;
 309
 310           s2n(TLSEXT_TYPE_renegotiate,ret);
 311           s2n(el,ret);
 312
 313           if(!ssl_add_serverhello_renegotiate_ext(s, ret, &el, el))
 314               {
 315               SSLerr(SSL_F_SSL_ADD_SERVERHELLO_TLSEXT, ERR_R_INTERNAL_ERROR);
 316               return NULL;
 317               }
 318
 319           ret += el;
 320         }
 321
 322         if (s->tlsext_ticket_expected
 323                 && !(SSL_get_options(s) & SSL_OP_NO_TICKET))
 324                 {
 325                 if (limit - ret - 4 < 0) return NULL;
 326                 s2n(TLSEXT_TYPE_session_ticket,ret);
 327                 s2n(0,ret);
 328                 }
 329
 330         if (s->tlsext_status_expected)
 331                 {
 332                 if ((long)(limit - ret - 4) < 0) return NULL;
 333                 s2n(TLSEXT_TYPE_status_request,ret);
 334                 s2n(0,ret);
 335                 }
 336
 337         if ((extdatalen = ret-p-2)== 0)
 338                 return p;
 339
 340         s2n(extdatalen,p);
 341         return ret;
 342         }
 343
 344 int ssl_parse_clienthello_tlsext(SSL *s, unsigned char **p, unsigned char *d, int n, int *al)
 345         {
 346         unsigned short type;
 347         unsigned short size;
 348         unsigned short len;
 349         unsigned char *data = *p;
 350         int renegotiate_seen = 0;
 351
 352         s->servername_done = 0;
 353         s->tlsext_status_type = -1;
 354         s->s3->send_connection_binding = 0;
 355
 356         if (data >= (d+n-2))
 357                 {
 358                 if (s->new_session
 359                         && !(s->ctx->options & SSL_OP_ALLOW_UNSAFE_LEGACY_RENEGOTIATION))
 360                         {
 361                         /* We should always see one extension: the renegotiate extension */
 362                         SSLerr(SSL_F_SSL_PARSE_CLIENTHELLO_TLSEXT, SSL_R_UNSAFE_LEGACY_RENEGOTIATION_DISABLED);
 363                         *al = SSL_AD_ILLEGAL_PARAMETER; /* is this the right alert? */
 364                         return 0;
 365                         }
 366                 return 1;
 367                 }
 368         n2s(data,len);
 369
 370         if (data > (d+n-len))
 371                 return 1;
 372
 373         while (data <= (d+n-4))
 374                 {
 375                 n2s(data,type);
 376                 n2s(data,size);
 377
 378                 if (data+size > (d+n))
 379                         return 1;
 380
 381                 if (s->tlsext_debug_cb)
 382                         s->tlsext_debug_cb(s, 0, type, data, size,
 383                                                 s->tlsext_debug_arg);
 384 /* The servername extension is treated as follows:
 385
 386    - Only the hostname type is supported with a maximum length of 255.
 387    - The servername is rejected if too long or if it contains zeros,
 388      in which case an fatal alert is generated.
 389    - The servername field is maintained together with the session cache.
 390    - When a session is resumed, the servername call back invoked in order
 391      to allow the application to position itself to the right context.
 392    - The servername is acknowledged if it is new for a session or when
 393      it is identical to a previously used for the same session.
 394      Applications can control the behaviour.  They can at any time
 395      set a 'desirable' servername for a new SSL object. This can be the
 396      case for example with HTTPS when a Host: header field is received and
 397      a renegotiation is requested. In this case, a possible servername
 398      presented in the new client hello is only acknowledged if it matches
 399      the value of the Host: field.
 400    - Applications must  use SSL_OP_NO_SESSION_RESUMPTION_ON_RENEGOTIATION
 401      if they provide for changing an explicit servername context for the session,
 402      i.e. when the session has been established with a servername extension.
 403    - On session reconnect, the servername extension may be absent.
 404
 405 */
 406
 407                 if (type == TLSEXT_TYPE_server_name)
 408                         {
 409                         unsigned char *sdata;
 410                         int servname_type;
 411                         int dsize;
 412
 413                         if (size < 2)
 414                                 {
 415                                 *al = SSL_AD_DECODE_ERROR;
 416                                 return 0;
 417                                 }
 418                         n2s(data,dsize);
 419                         size -= 2;
 420                         if (dsize > size  )
 421                                 {
 422                                 *al = SSL_AD_DECODE_ERROR;
 423                                 return 0;
 424                                 }
 425
 426                         sdata = data;
 427                         while (dsize > 3)
 428                                 {
 429                                 servname_type = *(sdata++);
 430                                 n2s(sdata,len);
 431                                 dsize -= 3;
 432
 433                                 if (len > dsize)
 434                                         {
 435                                         *al = SSL_AD_DECODE_ERROR;
 436                                         return 0;
 437                                         }
 438                                 if (s->servername_done == 0)
 439                                 switch (servname_type)
 440                                         {
 441                                 case TLSEXT_NAMETYPE_host_name:
 442                                         if (s->session->tlsext_hostname == NULL)
 443                                                 {
 444                                                 if (len > TLSEXT_MAXLEN_host_name ||
 445                                                         ((s->session->tlsext_hostname = OPENSSL_malloc(len+1)) == NULL))
 446                                                         {
 447                                                         *al = TLS1_AD_UNRECOGNIZED_NAME;
 448                                                         return 0;
 449                                                         }
 450                                                 memcpy(s->session->tlsext_hostname, sdata, len);
 451                                                 s->session->tlsext_hostname[len]='\0';
 452                                                 if (strlen(s->session->tlsext_hostname) != len) {
 453                                                         OPENSSL_free(s->session->tlsext_hostname);
 454                                                         s->session->tlsext_hostname = NULL;
 455                                                         *al = TLS1_AD_UNRECOGNIZED_NAME;
 456                                                         return 0;
 457                                                 }
 458                                                 s->servername_done = 1;
 459
 460                                                 }
 461                                         else
 462                                                 s->servername_done = strlen(s->session->tlsext_hostname) == len
 463                                                         && strncmp(s->session->tlsext_hostname, (char *)sdata, len) == 0;
 464
 465                                         break;
 466
 467                                 default:
 468                                         break;
 469                                         }
 470
 471                                 dsize -= len;
 472                                 }
 473                         if (dsize != 0)
 474                                 {
 475                                 *al = SSL_AD_DECODE_ERROR;
 476                                 return 0;
 477                                 }
 478
 479                         }
 480                 else if (type == TLSEXT_TYPE_renegotiate)
 481                         {
 482                         if(!ssl_parse_clienthello_renegotiate_ext(s, data, size, al))
 483                                 return 0;
 484                         renegotiate_seen = 1;
 485                         }
 486                 else if (type == TLSEXT_TYPE_status_request
 487                                                 && s->ctx->tlsext_status_cb)
 488                         {
 489
 490                         if (size < 5)
 491                                 {
 492                                 *al = SSL_AD_DECODE_ERROR;
 493                                 return 0;
 494                                 }
 495
 496                         s->tlsext_status_type = *data++;
 497                         size--;
 498                         if (s->tlsext_status_type == TLSEXT_STATUSTYPE_ocsp)
 499                                 {
 500                                 const unsigned char *sdata;
 501                                 int dsize;
 502                                 /* Read in responder_id_list */
 503                                 n2s(data,dsize);
 504                                 size -= 2;
 505                                 if (dsize > size  )
 506                                         {
 507                                         *al = SSL_AD_DECODE_ERROR;
 508                                         return 0;
 509                                         }
 510                                 while (dsize > 0)
 511                                         {
 512                                         OCSP_RESPID *id;
 513                                         int idsize;
 514                                         if (dsize < 4)
 515                                                 {
 516                                                 *al = SSL_AD_DECODE_ERROR;
 517                                                 return 0;
 518                                                 }
 519                                         n2s(data, idsize);
 520                                         dsize -= 2 + idsize;
 521                                         if (dsize < 0)
 522                                                 {
 523                                                 *al = SSL_AD_DECODE_ERROR;
 524                                                 return 0;
 525                                                 }
 526                                         sdata = data;
 527                                         data += idsize;
 528                                         id = d2i_OCSP_RESPID(NULL,
 529                                                                 &sdata, idsize);
 530                                         if (!id)
 531                                                 {
 532                                                 *al = SSL_AD_DECODE_ERROR;
 533                                                 return 0;
 534                                                 }
 535                                         if (data != sdata)
 536                                                 {
 537                                                 OCSP_RESPID_free(id);
 538                                                 *al = SSL_AD_DECODE_ERROR;
 539                                                 return 0;
 540                                                 }
 541                                         if (!s->tlsext_ocsp_ids
 542                                                 && !(s->tlsext_ocsp_ids =
 543                                                 sk_OCSP_RESPID_new_null()))
 544                                                 {
 545                                                 OCSP_RESPID_free(id);
 546                                                 *al = SSL_AD_INTERNAL_ERROR;
 547                                                 return 0;
 548                                                 }
 549                                         if (!sk_OCSP_RESPID_push(
 550                                                         s->tlsext_ocsp_ids, id))
 551                                                 {
 552                                                 OCSP_RESPID_free(id);
 553                                                 *al = SSL_AD_INTERNAL_ERROR;
 554                                                 return 0;
 555                                                 }
 556                                         }
 557
 558                                 /* Read in request_extensions */
 559                                 n2s(data,dsize);
 560                                 size -= 2;
 561                                 if (dsize > size)
 562                                         {
 563                                         *al = SSL_AD_DECODE_ERROR;
 564                                         return 0;
 565                                         }
 566                                 sdata = data;
 567                                 if (dsize > 0)
 568                                         {
 569                                         s->tlsext_ocsp_exts =
 570                                                 d2i_X509_EXTENSIONS(NULL,
 571                                                         &sdata, dsize);
 572                                         if (!s->tlsext_ocsp_exts
 573                                                 || (data + dsize != sdata))
 574                                                 {
 575                                                 *al = SSL_AD_DECODE_ERROR;
 576                                                 return 0;
 577                                                 }
 578                                         }
 579                                 }
 580                                 /* We don't know what to do with any other type
 581                                 * so ignore it.
 582                                 */
 583                                 else
 584                                         s->tlsext_status_type = -1;
 585                         }
 586
 587                 /* session ticket processed earlier */
 588
 589                 data+=size;
 590                 }
 591
 592         if (s->new_session && !renegotiate_seen
 593                 && !(s->ctx->options & SSL_OP_ALLOW_UNSAFE_LEGACY_RENEGOTIATION))
 594                 {
 595                 *al = SSL_AD_ILLEGAL_PARAMETER; /* is this the right alert? */
 596                 SSLerr(SSL_F_SSL_PARSE_CLIENTHELLO_TLSEXT, SSL_R_UNSAFE_LEGACY_RENEGOTIATION_DISABLED);
 597                 return 0;
 598                 }
 599
 600         *p = data;
 601         return 1;
 602         }
 603
 604 int ssl_parse_serverhello_tlsext(SSL *s, unsigned char **p, unsigned char *d, int n, int *al)
 605         {
 606         unsigned short type;
 607         unsigned short size;
 608         unsigned short len;
 609         unsigned char *data = *p;
 610         int tlsext_servername = 0;
 611         int renegotiate_seen = 0;
 612
 613         if (data >= (d+n-2))
 614                 {
 615                 /* Because the client does not see any renegotiation during an
 616                    attack, we must enforce this on all server hellos, even the
 617                    first */
 618                 if (!(s->ctx->options & SSL_OP_ALLOW_UNSAFE_LEGACY_RENEGOTIATION))
 619                         {
 620                         /* We should always see one extension: the renegotiate extension */
 621                         *al = SSL_AD_ILLEGAL_PARAMETER; /* is this the right alert? */
 622                         SSLerr(SSL_F_SSL_PARSE_SERVERHELLO_TLSEXT, SSL_R_UNSAFE_LEGACY_RENEGOTIATION_DISABLED);
 623                         return 0;
 624                         }
 625                 return 1;
 626                 }
 627
 628         n2s(data,len);
 629
 630         while(data <= (d+n-4))
 631                 {
 632                 n2s(data,type);
 633                 n2s(data,size);
 634
 635                 if (data+size > (d+n))
 636                         return 1;
 637
 638                 if (s->tlsext_debug_cb)
 639                         s->tlsext_debug_cb(s, 1, type, data, size,
 640                                                 s->tlsext_debug_arg);
 641
 642                 if (type == TLSEXT_TYPE_server_name)
 643                         {
 644                         if (s->tlsext_hostname == NULL || size > 0)
 645                                 {
 646                                 *al = TLS1_AD_UNRECOGNIZED_NAME;
 647                                 return 0;
 648                                 }
 649                         tlsext_servername = 1;
 650                         }
 651                 else if (type == TLSEXT_TYPE_session_ticket)
 652                         {
 653                         if ((SSL_get_options(s) & SSL_OP_NO_TICKET)
 654                                 || (size > 0))
 655                                 {
 656                                 *al = TLS1_AD_UNSUPPORTED_EXTENSION;
 657                                 return 0;
 658                                 }
 659                         s->tlsext_ticket_expected = 1;
 660                         }
 661                 else if (type == TLSEXT_TYPE_status_request)
 662                         {
 663                         /* MUST be empty and only sent if we've requested
 664                          * a status request message.
 665                          */
 666                         if ((s->tlsext_status_type == -1) || (size > 0))
 667                                 {
 668                                 *al = TLS1_AD_UNSUPPORTED_EXTENSION;
 669                                 return 0;
 670                                 }
 671                         /* Set flag to expect CertificateStatus message */
 672                         s->tlsext_status_expected = 1;
 673                         }
 674                 else if (type == TLSEXT_TYPE_renegotiate)
 675                         {
 676                         if(!ssl_parse_serverhello_renegotiate_ext(s, data, size, al))
 677                                 return 0;
 678                         renegotiate_seen = 1;
 679                         }
 680                 data+=size;
 681                 }
 682
 683         if (data != d+n)
 684                 {
 685                 *al = SSL_AD_DECODE_ERROR;
 686                 return 0;
 687                 }
 688
 689         if (!renegotiate_seen
 690                 && !(s->ctx->options & SSL_OP_ALLOW_UNSAFE_LEGACY_RENEGOTIATION))
 691                 {
 692                 *al = SSL_AD_ILLEGAL_PARAMETER; /* is this the right alert? */
 693                 SSLerr(SSL_F_SSL_PARSE_SERVERHELLO_TLSEXT, SSL_R_UNSAFE_LEGACY_RENEGOTIATION_DISABLED);
 694                 return 0;
 695                 }
 696
 697         if (!s->hit && tlsext_servername == 1)
 698                 {
 699                 if (s->tlsext_hostname)
 700                         {
 701                         if (s->session->tlsext_hostname == NULL)
 702                                 {
 703                                 s->session->tlsext_hostname = BUF_strdup(s->tlsext_hostname);
 704                                 if (!s->session->tlsext_hostname)
 705                                         {
 706                                         *al = SSL_AD_UNRECOGNIZED_NAME;
 707                                         return 0;
 708                                         }
 709                                 }
 710                         else
 711                                 {
 712                                 *al = SSL_AD_DECODE_ERROR;
 713                                 return 0;
 714                                 }
 715                         }
 716                 }
 717
 718         *p = data;
 719         return 1;
 720         }
 721
 722 int ssl_check_clienthello_tlsext(SSL *s)
 723         {
 724         int ret=SSL_TLSEXT_ERR_NOACK;
 725         int al = SSL_AD_UNRECOGNIZED_NAME;
 726
 727         if (s->ctx != NULL && s->ctx->tlsext_servername_callback != 0)
 728                 ret = s->ctx->tlsext_servername_callback(s, &al, s->ctx->tlsext_servername_arg);
 729         else if (s->initial_ctx != NULL && s->initial_ctx->tlsext_servername_callback != 0)
 730                 ret = s->initial_ctx->tlsext_servername_callback(s, &al, s->initial_ctx->tlsext_servername_arg);
 731
 732         /* If status request then ask callback what to do.
 733          * Note: this must be called after servername callbacks in case
 734          * the certificate has changed.
 735          */
 736         if ((s->tlsext_status_type != -1) && s->ctx->tlsext_status_cb)
 737                 {
 738                 int r;
 739                 r = s->ctx->tlsext_status_cb(s, s->ctx->tlsext_status_arg);
 740                 switch (r)
 741                         {
 742                         /* We don't want to send a status request response */
 743                         case SSL_TLSEXT_ERR_NOACK:
 744                                 s->tlsext_status_expected = 0;
 745                                 break;
 746                         /* status request response should be sent */
 747                         case SSL_TLSEXT_ERR_OK:
 748                                 if (s->tlsext_ocsp_resp)
 749                                         s->tlsext_status_expected = 1;
 750                                 else
 751                                         s->tlsext_status_expected = 0;
 752                                 break;
 753                         /* something bad happened */
 754                         case SSL_TLSEXT_ERR_ALERT_FATAL:
 755                                 ret = SSL_TLSEXT_ERR_ALERT_FATAL;
 756                                 al = SSL_AD_INTERNAL_ERROR;
 757                                 goto err;
 758                         }
 759                 }
 760         else
 761                 s->tlsext_status_expected = 0;
 762         err:
 763         switch (ret)
 764                 {
 765                 case SSL_TLSEXT_ERR_ALERT_FATAL:
 766                         ssl3_send_alert(s,SSL3_AL_FATAL,al);
 767                         return -1;
 768
 769                 case SSL_TLSEXT_ERR_ALERT_WARNING:
 770                         ssl3_send_alert(s,SSL3_AL_WARNING,al);
 771                         return 1;
 772
 773                 case SSL_TLSEXT_ERR_NOACK:
 774                         s->servername_done=0;
 775                         default:
 776                 return 1;
 777                 }
 778         }
 779
 780 int ssl_check_serverhello_tlsext(SSL *s)
 781         {
 782         int ret=SSL_TLSEXT_ERR_NOACK;
 783         int al = SSL_AD_UNRECOGNIZED_NAME;
 784
 785         if (s->ctx != NULL && s->ctx->tlsext_servername_callback != 0)
 786                 ret = s->ctx->tlsext_servername_callback(s, &al, s->ctx->tlsext_servername_arg);
 787         else if (s->initial_ctx != NULL && s->initial_ctx->tlsext_servername_callback != 0)
 788                 ret = s->initial_ctx->tlsext_servername_callback(s, &al, s->initial_ctx->tlsext_servername_arg);
 789
 790         /* If we've requested certificate status and we wont get one
 791          * tell the callback
 792          */
 793         if ((s->tlsext_status_type != -1) && !(s->tlsext_status_expected)
 794                         && s->ctx->tlsext_status_cb)
 795                 {
 796                 int r;
 797                 /* Set resp to NULL, resplen to -1 so callback knows
 798                  * there is no response.
 799                  */
 800                 if (s->tlsext_ocsp_resp)
 801                         {
 802                         OPENSSL_free(s->tlsext_ocsp_resp);
 803                         s->tlsext_ocsp_resp = NULL;
 804                         }
 805                 s->tlsext_ocsp_resplen = -1;
 806                 r = s->ctx->tlsext_status_cb(s, s->ctx->tlsext_status_arg);
 807                 if (r == 0)
 808                         {
 809                         al = SSL_AD_BAD_CERTIFICATE_STATUS_RESPONSE;
 810                         ret = SSL_TLSEXT_ERR_ALERT_FATAL;
 811                         }
 812                 if (r < 0)
 813                         {
 814                         al = SSL_AD_INTERNAL_ERROR;
 815                         ret = SSL_TLSEXT_ERR_ALERT_FATAL;
 816                         }
 817                 }
 818
 819         switch (ret)
 820                 {
 821                 case SSL_TLSEXT_ERR_ALERT_FATAL:
 822                         ssl3_send_alert(s,SSL3_AL_FATAL,al);
 823                         return -1;
 824
 825                 case SSL_TLSEXT_ERR_ALERT_WARNING:
 826                         ssl3_send_alert(s,SSL3_AL_WARNING,al);
 827                         return 1;
 828
 829                 case SSL_TLSEXT_ERR_NOACK:
 830                         s->servername_done=0;
 831                         default:
 832                 return 1;
 833                 }
 834         }
 835
 836 /* Since the server cache lookup is done early on in the processing of client
 837  * hello and other operations depend on the result we need to handle any TLS
 838  * session ticket extension at the same time.
 839  */
 840
 841 int tls1_process_ticket(SSL *s, unsigned char *session_id, int len,
 842                                 const unsigned char *limit, SSL_SESSION **ret)
 843         {
 844         /* Point after session ID in client hello */
 845         const unsigned char *p = session_id + len;
 846         unsigned short i;
 847
 848         /* If tickets disabled behave as if no ticket present
 849          * to permit stateful resumption.
 850          */
 851         if (SSL_get_options(s) & SSL_OP_NO_TICKET)
 852                 return 1;
 853
 854         if ((s->version <= SSL3_VERSION) || !limit)
 855                 return 1;
 856         if (p >= limit)
 857                 return -1;
 858         /* Skip past DTLS cookie */
 859         if (s->version == DTLS1_VERSION || s->version == DTLS1_BAD_VER)
 860                 {
 861                 i = *(p++);
 862                 p+= i;
 863                 if (p >= limit)
 864                         return -1;
 865                 }
 866         /* Skip past cipher list */
 867         n2s(p, i);
 868         p+= i;
 869         if (p >= limit)
 870                 return -1;
 871         /* Skip past compression algorithm list */
 872         i = *(p++);
 873         p += i;
 874         if (p > limit)
 875                 return -1;
 876         /* Now at start of extensions */
 877         if ((p + 2) >= limit)
 878                 return 1;
 879         n2s(p, i);
 880         while ((p + 4) <= limit)
 881                 {
 882                 unsigned short type, size;
 883                 n2s(p, type);
 884                 n2s(p, size);
 885                 if (p + size > limit)
 886                         return 1;
 887                 if (type == TLSEXT_TYPE_session_ticket)
 888                         {
 889                         /* If zero length note client will accept a ticket
 890                          * and indicate cache miss to trigger full handshake
 891                          */
 892                         if (size == 0)
 893                                 {
 894                                 s->tlsext_ticket_expected = 1;
 895                                 return 0;       /* Cache miss */
 896                                 }
 897                         return tls_decrypt_ticket(s, p, size, session_id, len,
 898                                                                         ret);
 899                         }
 900                 p += size;
 901                 }
 902         return 1;
 903         }
 904
 905 static int tls_decrypt_ticket(SSL *s, const unsigned char *etick, int eticklen,
 906                                 const unsigned char *sess_id, int sesslen,
 907                                 SSL_SESSION **psess)
 908         {
 909         SSL_SESSION *sess;
 910         unsigned char *sdec;
 911         const unsigned char *p;
 912         int slen, mlen, renew_ticket = 0;
 913         unsigned char tick_hmac[EVP_MAX_MD_SIZE];
 914         HMAC_CTX hctx;
 915         EVP_CIPHER_CTX ctx;
 916         SSL_CTX *tctx = s->initial_ctx;
 917         /* Need at least keyname + iv + some encrypted data */
 918         if (eticklen < 48)
 919                 goto tickerr;
 920         /* Initialize session ticket encryption and HMAC contexts */
 921         HMAC_CTX_init(&hctx);
 922         EVP_CIPHER_CTX_init(&ctx);
 923         if (tctx->tlsext_ticket_key_cb)
 924                 {
 925                 unsigned char *nctick = (unsigned char *)etick;
 926                 int rv = tctx->tlsext_ticket_key_cb(s, nctick, nctick + 16,
 927                                                         &ctx, &hctx, 0);
 928                 if (rv < 0)
 929                         return -1;
 930                 if (rv == 0)
 931                         goto tickerr;
 932                 if (rv == 2)
 933                         renew_ticket = 1;
 934                 }
 935         else
 936                 {
 937                 /* Check key name matches */
 938                 if (memcmp(etick, tctx->tlsext_tick_key_name, 16))
 939                         goto tickerr;
 940                 HMAC_Init_ex(&hctx, tctx->tlsext_tick_hmac_key, 16,
 941                                         tlsext_tick_md(), NULL);
 942                 EVP_DecryptInit_ex(&ctx, EVP_aes_128_cbc(), NULL,
 943                                 tctx->tlsext_tick_aes_key, etick + 16);
 944                 }
 945         /* Attempt to process session ticket, first conduct sanity and
 946          * integrity checks on ticket.
 947          */
 948         mlen = HMAC_size(&hctx);
 949         eticklen -= mlen;
 950         /* Check HMAC of encrypted ticket */
 951         HMAC_Update(&hctx, etick, eticklen);
 952         HMAC_Final(&hctx, tick_hmac, NULL);
 953         HMAC_CTX_cleanup(&hctx);
 954         if (memcmp(tick_hmac, etick + eticklen, mlen))
 955                 goto tickerr;
 956         /* Attempt to decrypt session data */
 957         /* Move p after IV to start of encrypted ticket, update length */
 958         p = etick + 16 + EVP_CIPHER_CTX_iv_length(&ctx);
 959         eticklen -= 16 + EVP_CIPHER_CTX_iv_length(&ctx);
 960         sdec = OPENSSL_malloc(eticklen);
 961         if (!sdec)
 962                 {
 963                 EVP_CIPHER_CTX_cleanup(&ctx);
 964                 return -1;
 965                 }
 966         EVP_DecryptUpdate(&ctx, sdec, &slen, p, eticklen);
 967         if (EVP_DecryptFinal(&ctx, sdec + slen, &mlen) <= 0)
 968                 goto tickerr;
 969         slen += mlen;
 970         EVP_CIPHER_CTX_cleanup(&ctx);
 971         p = sdec;
 972
 973         sess = d2i_SSL_SESSION(NULL, &p, slen);
 974         OPENSSL_free(sdec);
 975         if (sess)
 976                 {
 977                 /* The session ID if non-empty is used by some clients to
 978                  * detect that the ticket has been accepted. So we copy it to
 979                  * the session structure. If it is empty set length to zero
 980                  * as required by standard.
 981                  */
 982                 if (sesslen)
 983                         memcpy(sess->session_id, sess_id, sesslen);
 984                 sess->session_id_length = sesslen;
 985                 *psess = sess;
 986                 s->tlsext_ticket_expected = renew_ticket;
 987                 return 1;
 988                 }
 989         /* If session decrypt failure indicate a cache miss and set state to
 990          * send a new ticket
 991          */
 992         tickerr:
 993         s->tlsext_ticket_expected = 1;
 994         return 0;
 995         }
 996
 997 #endif