ssl/t1_lib.c

   1 /* ssl/t1_lib.c */
   2 /* Copyright (C) 1995-1998 Eric Young (eay@cryptsoft.com)
   3  * All rights reserved.
   4  *
   5  * This package is an SSL implementation written
   6  * by Eric Young (eay@cryptsoft.com).
   7  * The implementation was written so as to conform with Netscapes SSL.
   8  *
   9  * This library is free for commercial and non-commercial use as long as
  10  * the following conditions are aheared to.  The following conditions
  11  * apply to all code found in this distribution, be it the RC4, RSA,
  12  * lhash, DES, etc., code; not just the SSL code.  The SSL documentation
  13  * included with this distribution is covered by the same copyright terms
  14  * except that the holder is Tim Hudson (tjh@cryptsoft.com).
  15  *
  16  * Copyright remains Eric Young's, and as such any Copyright notices in
  17  * the code are not to be removed.
  18  * If this package is used in a product, Eric Young should be given attribution
  19  * as the author of the parts of the library used.
  20  * This can be in the form of a textual message at program startup or
  21  * in documentation (online or textual) provided with the package.
  22  *
  23  * Redistribution and use in source and binary forms, with or without
  24  * modification, are permitted provided that the following conditions
  25  * are met:
  26  * 1. Redistributions of source code must retain the copyright
  27  *    notice, this list of conditions and the following disclaimer.
  28  * 2. Redistributions in binary form must reproduce the above copyright
  29  *    notice, this list of conditions and the following disclaimer in the
  30  *    documentation and/or other materials provided with the distribution.
  31  * 3. All advertising materials mentioning features or use of this software
  32  *    must display the following acknowledgement:
  33  *    "This product includes cryptographic software written by
  34  *     Eric Young (eay@cryptsoft.com)"
  35  *    The word 'cryptographic' can be left out if the rouines from the library
  36  *    being used are not cryptographic related :-).
  37  * 4. If you include any Windows specific code (or a derivative thereof) from
  38  *    the apps directory (application code) you must include an acknowledgement:
  39  *    "This product includes software written by Tim Hudson (tjh@cryptsoft.com)"
  40  *
  41  * THIS SOFTWARE IS PROVIDED BY ERIC YOUNG ``AS IS'' AND
  42  * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
  43  * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
  44  * ARE DISCLAIMED.  IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE
  45  * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
  46  * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
  47  * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
  48  * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
  49  * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
  50  * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
  51  * SUCH DAMAGE.
  52  *
  53  * The licence and distribution terms for any publically available version or
  54  * derivative of this code cannot be changed.  i.e. this code cannot simply be
  55  * copied and put under another distribution licence
  56  * [including the GNU Public Licence.]
  57  */
  58 /* ====================================================================
  59  * Copyright (c) 1998-2007 The OpenSSL Project.  All rights reserved.
  60  *
  61  * Redistribution and use in source and binary forms, with or without
  62  * modification, are permitted provided that the following conditions
  63  * are met:
  64  *
  65  * 1. Redistributions of source code must retain the above copyright
  66  *    notice, this list of conditions and the following disclaimer.
  67  *
  68  * 2. Redistributions in binary form must reproduce the above copyright
  69  *    notice, this list of conditions and the following disclaimer in
  70  *    the documentation and/or other materials provided with the
  71  *    distribution.
  72  *
  73  * 3. All advertising materials mentioning features or use of this
  74  *    software must display the following acknowledgment:
  75  *    "This product includes software developed by the OpenSSL Project
  76  *    for use in the OpenSSL Toolkit. (http://www.openssl.org/)"
  77  *
  78  * 4. The names "OpenSSL Toolkit" and "OpenSSL Project" must not be used to
  79  *    endorse or promote products derived from this software without
  80  *    prior written permission. For written permission, please contact
  81  *    openssl-core@openssl.org.
  82  *
  83  * 5. Products derived from this software may not be called "OpenSSL"
  84  *    nor may "OpenSSL" appear in their names without prior written
  85  *    permission of the OpenSSL Project.
  86  *
  87  * 6. Redistributions of any form whatsoever must retain the following
  88  *    acknowledgment:
  89  *    "This product includes software developed by the OpenSSL Project
  90  *    for use in the OpenSSL Toolkit (http://www.openssl.org/)"
  91  *
  92  * THIS SOFTWARE IS PROVIDED BY THE OpenSSL PROJECT ``AS IS'' AND ANY
  93  * EXPRESSED OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
  94  * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
  95  * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL THE OpenSSL PROJECT OR
  96  * ITS CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
  97  * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
  98  * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
  99  * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
 100  * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT,
 101  * STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
 102  * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED
 103  * OF THE POSSIBILITY OF SUCH DAMAGE.
 104  * ====================================================================
 105  *
 106  * This product includes cryptographic software written by Eric Young
 107  * (eay@cryptsoft.com).  This product includes software written by Tim
 108  * Hudson (tjh@cryptsoft.com).
 109  *
 110  */
 111
 112 #include <stdio.h>
 113 #include <openssl/objects.h>
 114 #include <openssl/evp.h>
 115 #include <openssl/hmac.h>
 116 #include <openssl/ocsp.h>
 117 #include "ssl_locl.h"
 118
 119 const char tls1_version_str[]="TLSv1" OPENSSL_VERSION_PTEXT;
 120
 121 #ifndef OPENSSL_NO_TLSEXT
 122 static int tls_decrypt_ticket(SSL *s, const unsigned char *tick, int ticklen,
 123                                 const unsigned char *sess_id, int sesslen,
 124                                 SSL_SESSION **psess);
 125 #endif
 126
 127 SSL3_ENC_METHOD TLSv1_enc_data={
 128         tls1_enc,
 129         tls1_mac,
 130         tls1_setup_key_block,
 131         tls1_generate_master_secret,
 132         tls1_change_cipher_state,
 133         tls1_final_finish_mac,
 134         TLS1_FINISH_MAC_LENGTH,
 135         tls1_cert_verify_mac,
 136         TLS_MD_CLIENT_FINISH_CONST,TLS_MD_CLIENT_FINISH_CONST_SIZE,
 137         TLS_MD_SERVER_FINISH_CONST,TLS_MD_SERVER_FINISH_CONST_SIZE,
 138         tls1_alert_code,
 139         };
 140
 141 long tls1_default_timeout(void)
 142         {
 143         /* 2 hours, the 24 hours mentioned in the TLSv1 spec
 144          * is way too long for http, the cache would over fill */
 145         return(60*60*2);
 146         }
 147
 148 int tls1_new(SSL *s)
 149         {
 150         if (!ssl3_new(s)) return(0);
 151         s->method->ssl_clear(s);
 152         return(1);
 153         }
 154
 155 void tls1_free(SSL *s)
 156         {
 157 #ifndef OPENSSL_NO_TLSEXT
 158         if (s->tlsext_session_ticket)
 159                 {
 160                 OPENSSL_free(s->tlsext_session_ticket);
 161                 }
 162 #endif /* OPENSSL_NO_TLSEXT */
 163         ssl3_free(s);
 164         }
 165
 166 void tls1_clear(SSL *s)
 167         {
 168         ssl3_clear(s);
 169         s->version = s->method->version;
 170         }
 171
 172 #ifndef OPENSSL_NO_EC
 173 static int nid_list[] =
 174         {
 175                 NID_sect163k1, /* sect163k1 (1) */
 176                 NID_sect163r1, /* sect163r1 (2) */
 177                 NID_sect163r2, /* sect163r2 (3) */
 178                 NID_sect193r1, /* sect193r1 (4) */
 179                 NID_sect193r2, /* sect193r2 (5) */
 180                 NID_sect233k1, /* sect233k1 (6) */
 181                 NID_sect233r1, /* sect233r1 (7) */
 182                 NID_sect239k1, /* sect239k1 (8) */
 183                 NID_sect283k1, /* sect283k1 (9) */
 184                 NID_sect283r1, /* sect283r1 (10) */
 185                 NID_sect409k1, /* sect409k1 (11) */
 186                 NID_sect409r1, /* sect409r1 (12) */
 187                 NID_sect571k1, /* sect571k1 (13) */
 188                 NID_sect571r1, /* sect571r1 (14) */
 189                 NID_secp160k1, /* secp160k1 (15) */
 190                 NID_secp160r1, /* secp160r1 (16) */
 191                 NID_secp160r2, /* secp160r2 (17) */
 192                 NID_secp192k1, /* secp192k1 (18) */
 193                 NID_X9_62_prime192v1, /* secp192r1 (19) */
 194                 NID_secp224k1, /* secp224k1 (20) */
 195                 NID_secp224r1, /* secp224r1 (21) */
 196                 NID_secp256k1, /* secp256k1 (22) */
 197                 NID_X9_62_prime256v1, /* secp256r1 (23) */
 198                 NID_secp384r1, /* secp384r1 (24) */
 199                 NID_secp521r1  /* secp521r1 (25) */
 200         };
 201
 202 int tls1_ec_curve_id2nid(int curve_id)
 203         {
 204         /* ECC curves from draft-ietf-tls-ecc-12.txt (Oct. 17, 2005) */
 205         if ((curve_id < 1) || ((unsigned int)curve_id >
 206                                 sizeof(nid_list)/sizeof(nid_list[0])))
 207                 return 0;
 208         return nid_list[curve_id-1];
 209         }
 210
 211 int tls1_ec_nid2curve_id(int nid)
 212         {
 213         /* ECC curves from draft-ietf-tls-ecc-12.txt (Oct. 17, 2005) */
 214         switch (nid)
 215                 {
 216         case NID_sect163k1: /* sect163k1 (1) */
 217                 return 1;
 218         case NID_sect163r1: /* sect163r1 (2) */
 219                 return 2;
 220         case NID_sect163r2: /* sect163r2 (3) */
 221                 return 3;
 222         case NID_sect193r1: /* sect193r1 (4) */
 223                 return 4;
 224         case NID_sect193r2: /* sect193r2 (5) */
 225                 return 5;
 226         case NID_sect233k1: /* sect233k1 (6) */
 227                 return 6;
 228         case NID_sect233r1: /* sect233r1 (7) */
 229                 return 7;
 230         case NID_sect239k1: /* sect239k1 (8) */
 231                 return 8;
 232         case NID_sect283k1: /* sect283k1 (9) */
 233                 return 9;
 234         case NID_sect283r1: /* sect283r1 (10) */
 235                 return 10;
 236         case NID_sect409k1: /* sect409k1 (11) */
 237                 return 11;
 238         case NID_sect409r1: /* sect409r1 (12) */
 239                 return 12;
 240         case NID_sect571k1: /* sect571k1 (13) */
 241                 return 13;
 242         case NID_sect571r1: /* sect571r1 (14) */
 243                 return 14;
 244         case NID_secp160k1: /* secp160k1 (15) */
 245                 return 15;
 246         case NID_secp160r1: /* secp160r1 (16) */
 247                 return 16;
 248         case NID_secp160r2: /* secp160r2 (17) */
 249                 return 17;
 250         case NID_secp192k1: /* secp192k1 (18) */
 251                 return 18;
 252         case NID_X9_62_prime192v1: /* secp192r1 (19) */
 253                 return 19;
 254         case NID_secp224k1: /* secp224k1 (20) */
 255                 return 20;
 256         case NID_secp224r1: /* secp224r1 (21) */
 257                 return 21;
 258         case NID_secp256k1: /* secp256k1 (22) */
 259                 return 22;
 260         case NID_X9_62_prime256v1: /* secp256r1 (23) */
 261                 return 23;
 262         case NID_secp384r1: /* secp384r1 (24) */
 263                 return 24;
 264         case NID_secp521r1:  /* secp521r1 (25) */
 265                 return 25;
 266         default:
 267                 return 0;
 268                 }
 269         }
 270 #endif /* OPENSSL_NO_EC */
 271
 272 #ifndef OPENSSL_NO_TLSEXT
 273
 274 int tls12_get_req_sig_algs(SSL *s, unsigned char *p)
 275         {
 276         if (p)
 277                 memcpy(p, tls12_sigalgs, sizeof(tls12_sigalgs));
 278         return (int)sizeof(tls12_sigalgs);
 279         }
 280
 281 unsigned char *ssl_add_clienthello_tlsext(SSL *s, unsigned char *p, unsigned char *limit)
 282         {
 283         int extdatalen=0;
 284         unsigned char *ret = p;
 285
 286         /* don't add extensions for SSLv3 unless doing secure renegotiation */
 287         if (s->client_version == SSL3_VERSION
 288                                         && !s->s3->send_connection_binding)
 289                 return p;
 290
 291         ret+=2;
 292
 293         if (ret>=limit) return NULL; /* this really never occurs, but ... */
 294
 295         if (s->tlsext_hostname != NULL)
 296                 {
 297                 /* Add TLS extension servername to the Client Hello message */
 298                 unsigned long size_str;
 299                 long lenmax;
 300
 301                 /* check for enough space.
 302                    4 for the servername type and entension length
 303                    2 for servernamelist length
 304                    1 for the hostname type
 305                    2 for hostname length
 306                    + hostname length
 307                 */
 308
 309                 if ((lenmax = limit - ret - 9) < 0
 310                     || (size_str = strlen(s->tlsext_hostname)) > (unsigned long)lenmax)
 311                         return NULL;
 312
 313                 /* extension type and length */
 314                 s2n(TLSEXT_TYPE_server_name,ret);
 315                 s2n(size_str+5,ret);
 316
 317                 /* length of servername list */
 318                 s2n(size_str+3,ret);
 319
 320                 /* hostname type, length and hostname */
 321                 *(ret++) = (unsigned char) TLSEXT_NAMETYPE_host_name;
 322                 s2n(size_str,ret);
 323                 memcpy(ret, s->tlsext_hostname, size_str);
 324                 ret+=size_str;
 325                 }
 326
 327         /* Add RI if renegotiating */
 328         if (s->renegotiate)
 329           {
 330           int el;
 331
 332           if(!ssl_add_clienthello_renegotiate_ext(s, 0, &el, 0))
 333               {
 334               SSLerr(SSL_F_SSL_ADD_CLIENTHELLO_TLSEXT, ERR_R_INTERNAL_ERROR);
 335               return NULL;
 336               }
 337
 338           if((limit - p - 4 - el) < 0) return NULL;
 339
 340           s2n(TLSEXT_TYPE_renegotiate,ret);
 341           s2n(el,ret);
 342
 343           if(!ssl_add_clienthello_renegotiate_ext(s, ret, &el, el))
 344               {
 345               SSLerr(SSL_F_SSL_ADD_CLIENTHELLO_TLSEXT, ERR_R_INTERNAL_ERROR);
 346               return NULL;
 347               }
 348
 349           ret += el;
 350         }
 351
 352 #ifndef OPENSSL_NO_SRP
 353 #define MIN(x,y) (((x)<(y))?(x):(y))
 354         /* we add SRP username the first time only if we have one! */
 355         if (s->srp_ctx.login != NULL)
 356                 {/* Add TLS extension SRP username to the Client Hello message */
 357                 int login_len = MIN(strlen(s->srp_ctx.login) + 1, 255);
 358                 long lenmax;
 359
 360                 if ((lenmax = limit - ret - 5) < 0) return NULL;
 361                 if (login_len > lenmax) return NULL;
 362                 if (login_len > 255)
 363                         {
 364                         SSLerr(SSL_F_SSL_ADD_CLIENTHELLO_TLSEXT, ERR_R_INTERNAL_ERROR);
 365                         return NULL;
 366                         }
 367                 s2n(TLSEXT_TYPE_srp,ret);
 368                 s2n(login_len+1,ret);
 369
 370                 (*ret++) = (unsigned char) MIN(strlen(s->srp_ctx.login), 254);
 371                 memcpy(ret, s->srp_ctx.login, MIN(strlen(s->srp_ctx.login), 254));
 372                 ret+=login_len;
 373                 }
 374 #endif
 375
 376 #ifndef OPENSSL_NO_EC
 377         if (s->tlsext_ecpointformatlist != NULL &&
 378             s->version != DTLS1_VERSION)
 379                 {
 380                 /* Add TLS extension ECPointFormats to the ClientHello message */
 381                 long lenmax;
 382
 383                 if ((lenmax = limit - ret - 5) < 0) return NULL;
 384                 if (s->tlsext_ecpointformatlist_length > (unsigned long)lenmax) return NULL;
 385                 if (s->tlsext_ecpointformatlist_length > 255)
 386                         {
 387                         SSLerr(SSL_F_SSL_ADD_CLIENTHELLO_TLSEXT, ERR_R_INTERNAL_ERROR);
 388                         return NULL;
 389                         }
 390
 391                 s2n(TLSEXT_TYPE_ec_point_formats,ret);
 392                 s2n(s->tlsext_ecpointformatlist_length + 1,ret);
 393                 *(ret++) = (unsigned char) s->tlsext_ecpointformatlist_length;
 394                 memcpy(ret, s->tlsext_ecpointformatlist, s->tlsext_ecpointformatlist_length);
 395                 ret+=s->tlsext_ecpointformatlist_length;
 396                 }
 397         if (s->tlsext_ellipticcurvelist != NULL &&
 398             s->version != DTLS1_VERSION)
 399                 {
 400                 /* Add TLS extension EllipticCurves to the ClientHello message */
 401                 long lenmax;
 402
 403                 if ((lenmax = limit - ret - 6) < 0) return NULL;
 404                 if (s->tlsext_ellipticcurvelist_length > (unsigned long)lenmax) return NULL;
 405                 if (s->tlsext_ellipticcurvelist_length > 65532)
 406                         {
 407                         SSLerr(SSL_F_SSL_ADD_CLIENTHELLO_TLSEXT, ERR_R_INTERNAL_ERROR);
 408                         return NULL;
 409                         }
 410
 411                 s2n(TLSEXT_TYPE_elliptic_curves,ret);
 412                 s2n(s->tlsext_ellipticcurvelist_length + 2, ret);
 413
 414                 /* NB: draft-ietf-tls-ecc-12.txt uses a one-byte prefix for
 415                  * elliptic_curve_list, but the examples use two bytes.
 416                  * http://www1.ietf.org/mail-archive/web/tls/current/msg00538.html
 417                  * resolves this to two bytes.
 418                  */
 419                 s2n(s->tlsext_ellipticcurvelist_length, ret);
 420                 memcpy(ret, s->tlsext_ellipticcurvelist, s->tlsext_ellipticcurvelist_length);
 421                 ret+=s->tlsext_ellipticcurvelist_length;
 422                 }
 423 #endif /* OPENSSL_NO_EC */
 424
 425         if (!(SSL_get_options(s) & SSL_OP_NO_TICKET))
 426                 {
 427                 int ticklen;
 428                 if (!s->new_session && s->session && s->session->tlsext_tick)
 429                         ticklen = s->session->tlsext_ticklen;
 430                 else if (s->session && s->tlsext_session_ticket &&
 431                          s->tlsext_session_ticket->data)
 432                         {
 433                         ticklen = s->tlsext_session_ticket->length;
 434                         s->session->tlsext_tick = OPENSSL_malloc(ticklen);
 435                         if (!s->session->tlsext_tick)
 436                                 return NULL;
 437                         memcpy(s->session->tlsext_tick,
 438                                s->tlsext_session_ticket->data,
 439                                ticklen);
 440                         s->session->tlsext_ticklen = ticklen;
 441                         }
 442                 else
 443                         ticklen = 0;
 444                 if (ticklen == 0 && s->tlsext_session_ticket &&
 445                     s->tlsext_session_ticket->data == NULL)
 446                         goto skip_ext;
 447                 /* Check for enough room 2 for extension type, 2 for len
 448                  * rest for ticket
 449                  */
 450                 if ((long)(limit - ret - 4 - ticklen) < 0) return NULL;
 451                 s2n(TLSEXT_TYPE_session_ticket,ret);
 452                 s2n(ticklen,ret);
 453                 if (ticklen)
 454                         {
 455                         memcpy(ret, s->session->tlsext_tick, ticklen);
 456                         ret += ticklen;
 457                         }
 458                 }
 459                 skip_ext:
 460
 461         if (s->version >= TLS1_2_VERSION)
 462                 {
 463                 /* List of supported signature algorithms and hashes.
 464                  * Should make this customisable at some point, for
 465                  * now include everything we support.
 466                  */
 467                 static unsigned char sigalgs[] = {
 468 #ifndef OPENSSL_NO_RSA
 469 # ifndef OPENSSL_NO_SHA512
 470                         TLSEXT_hash_sha512, TLSEXT_signature_rsa,
 471                         TLSEXT_hash_sha384, TLSEXT_signature_rsa,
 472 # endif
 473 # ifndef OPENSSL_NO_SHA256
 474                         TLSEXT_hash_sha256, TLSEXT_signature_rsa,
 475                         TLSEXT_hash_sha224, TLSEXT_signature_rsa,
 476 # endif
 477 # ifndef OPENSSL_NO_SHA
 478                         TLSEXT_hash_sha1, TLSEXT_signature_rsa,
 479 # endif
 480 #endif
 481 #ifndef OPENSSL_NO_ECDSA
 482 # ifndef OPENSSL_NO_SHA512
 483                         TLSEXT_hash_sha512, TLSEXT_signature_ecdsa,
 484                         TLSEXT_hash_sha384, TLSEXT_signature_ecdsa,
 485 # endif
 486 # ifndef OPENSSL_NO_SHA256
 487                         TLSEXT_hash_sha256, TLSEXT_signature_ecdsa,
 488                         TLSEXT_hash_sha224, TLSEXT_signature_ecdsa,
 489 # endif
 490 # ifndef OPENSSL_NO_SHA
 491                         TLSEXT_hash_sha1, TLSEXT_signature_ecdsa,
 492 # endif
 493 #endif
 494 #ifndef OPENSSL_NO_DSA
 495 # ifndef OPENSSL_NO_SHA512
 496                         TLSEXT_hash_sha512, TLSEXT_signature_dsa,
 497                         TLSEXT_hash_sha384, TLSEXT_signature_dsa,
 498 # endif
 499 # ifndef OPENSSL_NO_SHA256
 500                         TLSEXT_hash_sha256, TLSEXT_signature_dsa,
 501                         TLSEXT_hash_sha224, TLSEXT_signature_dsa,
 502 # endif
 503 # ifndef OPENSSL_NO_SHA
 504                         TLSEXT_hash_sha1, TLSEXT_signature_dsa
 505 # endif
 506 #endif
 507                 };
 508                 if ((size_t)(limit - ret) < sizeof(sigalgs) + 6)
 509                         return NULL;
 510                 s2n(TLSEXT_TYPE_signature_algorithms,ret);
 511                 s2n(sizeof(sigalgs) + 2, ret);
 512                 s2n(sizeof(sigalgs), ret);
 513                 memcpy(ret, sigalgs, sizeof(sigalgs));
 514                 ret += sizeof(sigalgs);
 515                 }
 516
 517 #ifdef TLSEXT_TYPE_opaque_prf_input
 518         if (s->s3->client_opaque_prf_input != NULL &&
 519             s->version != DTLS1_VERSION)
 520                 {
 521                 size_t col = s->s3->client_opaque_prf_input_len;
 522
 523                 if ((long)(limit - ret - 6 - col < 0))
 524                         return NULL;
 525                 if (col > 0xFFFD) /* can't happen */
 526                         return NULL;
 527
 528                 s2n(TLSEXT_TYPE_opaque_prf_input, ret);
 529                 s2n(col + 2, ret);
 530                 s2n(col, ret);
 531                 memcpy(ret, s->s3->client_opaque_prf_input, col);
 532                 ret += col;
 533                 }
 534 #endif
 535
 536         if (s->tlsext_status_type == TLSEXT_STATUSTYPE_ocsp &&
 537             s->version != DTLS1_VERSION)
 538                 {
 539                 int i;
 540                 long extlen, idlen, itmp;
 541                 OCSP_RESPID *id;
 542
 543                 idlen = 0;
 544                 for (i = 0; i < sk_OCSP_RESPID_num(s->tlsext_ocsp_ids); i++)
 545                         {
 546                         id = sk_OCSP_RESPID_value(s->tlsext_ocsp_ids, i);
 547                         itmp = i2d_OCSP_RESPID(id, NULL);
 548                         if (itmp <= 0)
 549                                 return NULL;
 550                         idlen += itmp + 2;
 551                         }
 552
 553                 if (s->tlsext_ocsp_exts)
 554                         {
 555                         extlen = i2d_X509_EXTENSIONS(s->tlsext_ocsp_exts, NULL);
 556                         if (extlen < 0)
 557                                 return NULL;
 558                         }
 559                 else
 560                         extlen = 0;
 561
 562                 if ((long)(limit - ret - 7 - extlen - idlen) < 0) return NULL;
 563                 s2n(TLSEXT_TYPE_status_request, ret);
 564                 if (extlen + idlen > 0xFFF0)
 565                         return NULL;
 566                 s2n(extlen + idlen + 5, ret);
 567                 *(ret++) = TLSEXT_STATUSTYPE_ocsp;
 568                 s2n(idlen, ret);
 569                 for (i = 0; i < sk_OCSP_RESPID_num(s->tlsext_ocsp_ids); i++)
 570                         {
 571                         /* save position of id len */
 572                         unsigned char *q = ret;
 573                         id = sk_OCSP_RESPID_value(s->tlsext_ocsp_ids, i);
 574                         /* skip over id len */
 575                         ret += 2;
 576                         itmp = i2d_OCSP_RESPID(id, &ret);
 577                         /* write id len */
 578                         s2n(itmp, q);
 579                         }
 580                 s2n(extlen, ret);
 581                 if (extlen > 0)
 582                         i2d_X509_EXTENSIONS(s->tlsext_ocsp_exts, &ret);
 583                 }
 584
 585         if ((extdatalen = ret-p-2)== 0)
 586                 return p;
 587
 588         s2n(extdatalen,p);
 589         return ret;
 590         }
 591
 592 unsigned char *ssl_add_serverhello_tlsext(SSL *s, unsigned char *p, unsigned char *limit)
 593         {
 594         int extdatalen=0;
 595         unsigned char *ret = p;
 596
 597         /* don't add extensions for SSLv3, unless doing secure renegotiation */
 598         if (s->version == SSL3_VERSION && !s->s3->send_connection_binding)
 599                 return p;
 600
 601         ret+=2;
 602         if (ret>=limit) return NULL; /* this really never occurs, but ... */
 603
 604         if (!s->hit && s->servername_done == 1 && s->session->tlsext_hostname != NULL)
 605                 {
 606                 if ((long)(limit - ret - 4) < 0) return NULL;
 607
 608                 s2n(TLSEXT_TYPE_server_name,ret);
 609                 s2n(0,ret);
 610                 }
 611
 612         if(s->s3->send_connection_binding)
 613         {
 614           int el;
 615
 616           if(!ssl_add_serverhello_renegotiate_ext(s, 0, &el, 0))
 617               {
 618               SSLerr(SSL_F_SSL_ADD_SERVERHELLO_TLSEXT, ERR_R_INTERNAL_ERROR);
 619               return NULL;
 620               }
 621
 622           if((limit - p - 4 - el) < 0) return NULL;
 623
 624           s2n(TLSEXT_TYPE_renegotiate,ret);
 625           s2n(el,ret);
 626
 627           if(!ssl_add_serverhello_renegotiate_ext(s, ret, &el, el))
 628               {
 629               SSLerr(SSL_F_SSL_ADD_SERVERHELLO_TLSEXT, ERR_R_INTERNAL_ERROR);
 630               return NULL;
 631               }
 632
 633           ret += el;
 634         }
 635
 636 #ifndef OPENSSL_NO_EC
 637         if (s->tlsext_ecpointformatlist != NULL &&
 638             s->version != DTLS1_VERSION)
 639                 {
 640                 /* Add TLS extension ECPointFormats to the ServerHello message */
 641                 long lenmax;
 642
 643                 if ((lenmax = limit - ret - 5) < 0) return NULL;
 644                 if (s->tlsext_ecpointformatlist_length > (unsigned long)lenmax) return NULL;
 645                 if (s->tlsext_ecpointformatlist_length > 255)
 646                         {
 647                         SSLerr(SSL_F_SSL_ADD_SERVERHELLO_TLSEXT, ERR_R_INTERNAL_ERROR);
 648                         return NULL;
 649                         }
 650
 651                 s2n(TLSEXT_TYPE_ec_point_formats,ret);
 652                 s2n(s->tlsext_ecpointformatlist_length + 1,ret);
 653                 *(ret++) = (unsigned char) s->tlsext_ecpointformatlist_length;
 654                 memcpy(ret, s->tlsext_ecpointformatlist, s->tlsext_ecpointformatlist_length);
 655                 ret+=s->tlsext_ecpointformatlist_length;
 656
 657                 }
 658         /* Currently the server should not respond with a SupportedCurves extension */
 659 #endif /* OPENSSL_NO_EC */
 660
 661         if (s->tlsext_ticket_expected
 662                 && !(SSL_get_options(s) & SSL_OP_NO_TICKET))
 663                 {
 664                 if ((long)(limit - ret - 4) < 0) return NULL;
 665                 s2n(TLSEXT_TYPE_session_ticket,ret);
 666                 s2n(0,ret);
 667                 }
 668
 669         if (s->tlsext_status_expected)
 670                 {
 671                 if ((long)(limit - ret - 4) < 0) return NULL;
 672                 s2n(TLSEXT_TYPE_status_request,ret);
 673                 s2n(0,ret);
 674                 }
 675
 676 #ifdef TLSEXT_TYPE_opaque_prf_input
 677         if (s->s3->server_opaque_prf_input != NULL &&
 678             s->version != DTLS1_VERSION)
 679                 {
 680                 size_t sol = s->s3->server_opaque_prf_input_len;
 681
 682                 if ((long)(limit - ret - 6 - sol) < 0)
 683                         return NULL;
 684                 if (sol > 0xFFFD) /* can't happen */
 685                         return NULL;
 686
 687                 s2n(TLSEXT_TYPE_opaque_prf_input, ret);
 688                 s2n(sol + 2, ret);
 689                 s2n(sol, ret);
 690                 memcpy(ret, s->s3->server_opaque_prf_input, sol);
 691                 ret += sol;
 692                 }
 693 #endif
 694         if (((s->s3->tmp.new_cipher->id & 0xFFFF)==0x80 || (s->s3->tmp.new_cipher->id & 0xFFFF)==0x81)
 695                 && (SSL_get_options(s) & SSL_OP_CRYPTOPRO_TLSEXT_BUG))
 696                 { const unsigned char cryptopro_ext[36] = {
 697                         0xfd, 0xe8, /*65000*/
 698                         0x00, 0x20, /*32 bytes length*/
 699                         0x30, 0x1e, 0x30, 0x08, 0x06, 0x06, 0x2a, 0x85,
 700                         0x03,   0x02, 0x02, 0x09, 0x30, 0x08, 0x06, 0x06,
 701                         0x2a, 0x85, 0x03, 0x02, 0x02, 0x16, 0x30, 0x08,
 702                         0x06, 0x06, 0x2a, 0x85, 0x03, 0x02, 0x02, 0x17};
 703                         if (limit-ret<36) return NULL;
 704                         memcpy(ret,cryptopro_ext,36);
 705                         ret+=36;
 706
 707                 }
 708
 709         if ((extdatalen = ret-p-2)== 0)
 710                 return p;
 711
 712         s2n(extdatalen,p);
 713         return ret;
 714         }
 715
 716 int ssl_parse_clienthello_tlsext(SSL *s, unsigned char **p, unsigned char *d, int n, int *al)
 717         {
 718         unsigned short type;
 719         unsigned short size;
 720         unsigned short len;
 721         unsigned char *data = *p;
 722         int renegotiate_seen = 0;
 723         int sigalg_seen = 0;
 724
 725         s->servername_done = 0;
 726         s->tlsext_status_type = -1;
 727
 728         if (data >= (d+n-2))
 729                 goto ri_check;
 730         n2s(data,len);
 731
 732         if (data > (d+n-len))
 733                 goto ri_check;
 734
 735         while (data <= (d+n-4))
 736                 {
 737                 n2s(data,type);
 738                 n2s(data,size);
 739
 740                 if (data+size > (d+n))
 741                         goto ri_check;
 742 #if 0
 743                 fprintf(stderr,"Received extension type %d size %d\n",type,size);
 744 #endif
 745                 if (s->tlsext_debug_cb)
 746                         s->tlsext_debug_cb(s, 0, type, data, size,
 747                                                 s->tlsext_debug_arg);
 748 /* The servername extension is treated as follows:
 749
 750    - Only the hostname type is supported with a maximum length of 255.
 751    - The servername is rejected if too long or if it contains zeros,
 752      in which case an fatal alert is generated.
 753    - The servername field is maintained together with the session cache.
 754    - When a session is resumed, the servername call back invoked in order
 755      to allow the application to position itself to the right context.
 756    - The servername is acknowledged if it is new for a session or when
 757      it is identical to a previously used for the same session.
 758      Applications can control the behaviour.  They can at any time
 759      set a 'desirable' servername for a new SSL object. This can be the
 760      case for example with HTTPS when a Host: header field is received and
 761      a renegotiation is requested. In this case, a possible servername
 762      presented in the new client hello is only acknowledged if it matches
 763      the value of the Host: field.
 764    - Applications must  use SSL_OP_NO_SESSION_RESUMPTION_ON_RENEGOTIATION
 765      if they provide for changing an explicit servername context for the session,
 766      i.e. when the session has been established with a servername extension.
 767    - On session reconnect, the servername extension may be absent.
 768
 769 */
 770
 771                 if (type == TLSEXT_TYPE_server_name)
 772                         {
 773                         unsigned char *sdata;
 774                         int servname_type;
 775                         int dsize;
 776
 777                         if (size < 2)
 778                                 {
 779                                 *al = SSL_AD_DECODE_ERROR;
 780                                 return 0;
 781                                 }
 782                         n2s(data,dsize);
 783                         size -= 2;
 784                         if (dsize > size  )
 785                                 {
 786                                 *al = SSL_AD_DECODE_ERROR;
 787                                 return 0;
 788                                 }
 789
 790                         sdata = data;
 791                         while (dsize > 3)
 792                                 {
 793                                 servname_type = *(sdata++);
 794                                 n2s(sdata,len);
 795                                 dsize -= 3;
 796
 797                                 if (len > dsize)
 798                                         {
 799                                         *al = SSL_AD_DECODE_ERROR;
 800                                         return 0;
 801                                         }
 802                                 if (s->servername_done == 0)
 803                                 switch (servname_type)
 804                                         {
 805                                 case TLSEXT_NAMETYPE_host_name:
 806                                         if (!s->hit)
 807                                                 {
 808                                                 if(s->session->tlsext_hostname)
 809                                                         {
 810                                                         *al = SSL_AD_DECODE_ERROR;
 811                                                         return 0;
 812                                                         }
 813                                                 if (len > TLSEXT_MAXLEN_host_name)
 814                                                         {
 815                                                         *al = TLS1_AD_UNRECOGNIZED_NAME;
 816                                                         return 0;
 817                                                         }
 818                                                 if ((s->session->tlsext_hostname = OPENSSL_malloc(len+1)) == NULL)
 819                                                         {
 820                                                         *al = TLS1_AD_INTERNAL_ERROR;
 821                                                         return 0;
 822                                                         }
 823                                                 memcpy(s->session->tlsext_hostname, sdata, len);
 824                                                 s->session->tlsext_hostname[len]='\0';
 825                                                 if (strlen(s->session->tlsext_hostname) != len) {
 826                                                         OPENSSL_free(s->session->tlsext_hostname);
 827                                                         s->session->tlsext_hostname = NULL;
 828                                                         *al = TLS1_AD_UNRECOGNIZED_NAME;
 829                                                         return 0;
 830                                                 }
 831                                                 s->servername_done = 1;
 832
 833                                                 }
 834                                         else
 835                                                 s->servername_done = s->session->tlsext_hostname
 836                                                         && strlen(s->session->tlsext_hostname) == len
 837                                                         && strncmp(s->session->tlsext_hostname, (char *)sdata, len) == 0;
 838
 839                                         break;
 840
 841                                 default:
 842                                         break;
 843                                         }
 844
 845                                 dsize -= len;
 846                                 }
 847                         if (dsize != 0)
 848                                 {
 849                                 *al = SSL_AD_DECODE_ERROR;
 850                                 return 0;
 851                                 }
 852
 853                         }
 854 #ifndef OPENSSL_NO_SRP
 855                 else if (type == TLSEXT_TYPE_srp)
 856                         {
 857                         if (size > 0)
 858                                 {
 859                                 len = data[0];
 860                                 if ((s->srp_ctx.login = OPENSSL_malloc(len+1)) == NULL)
 861                                         return -1;
 862                                 memcpy(s->srp_ctx.login, &data[1], len);
 863                                 s->srp_ctx.login[len]='\0';
 864                                 }
 865                         }
 866 #endif
 867
 868 #ifndef OPENSSL_NO_EC
 869                 else if (type == TLSEXT_TYPE_ec_point_formats &&
 870                      s->version != DTLS1_VERSION)
 871                         {
 872                         unsigned char *sdata = data;
 873                         int ecpointformatlist_length = *(sdata++);
 874
 875                         if (ecpointformatlist_length != size - 1)
 876                                 {
 877                                 *al = TLS1_AD_DECODE_ERROR;
 878                                 return 0;
 879                                 }
 880                         if (!s->hit)
 881                                 {
 882                                 if(s->session->tlsext_ecpointformatlist)
 883                                         {
 884                                         OPENSSL_free(s->session->tlsext_ecpointformatlist);
 885                                         s->session->tlsext_ecpointformatlist = NULL;
 886                                         }
 887                                 s->session->tlsext_ecpointformatlist_length = 0;
 888                                 if ((s->session->tlsext_ecpointformatlist = OPENSSL_malloc(ecpointformatlist_length)) == NULL)
 889                                         {
 890                                         *al = TLS1_AD_INTERNAL_ERROR;
 891                                         return 0;
 892                                         }
 893                                 s->session->tlsext_ecpointformatlist_length = ecpointformatlist_length;
 894                                 memcpy(s->session->tlsext_ecpointformatlist, sdata, ecpointformatlist_length);
 895                                 }
 896 #if 0
 897                         fprintf(stderr,"ssl_parse_clienthello_tlsext s->session->tlsext_ecpointformatlist (length=%i) ", s->session->tlsext_ecpointformatlist_length);
 898                         sdata = s->session->tlsext_ecpointformatlist;
 899                         for (i = 0; i < s->session->tlsext_ecpointformatlist_length; i++)
 900                                 fprintf(stderr,"%i ",*(sdata++));
 901                         fprintf(stderr,"\n");
 902 #endif
 903                         }
 904                 else if (type == TLSEXT_TYPE_elliptic_curves &&
 905                      s->version != DTLS1_VERSION)
 906                         {
 907                         unsigned char *sdata = data;
 908                         int ellipticcurvelist_length = (*(sdata++) << 8);
 909                         ellipticcurvelist_length += (*(sdata++));
 910
 911                         if (ellipticcurvelist_length != size - 2)
 912                                 {
 913                                 *al = TLS1_AD_DECODE_ERROR;
 914                                 return 0;
 915                                 }
 916                         if (!s->hit)
 917                                 {
 918                                 if(s->session->tlsext_ellipticcurvelist)
 919                                         {
 920                                         *al = TLS1_AD_DECODE_ERROR;
 921                                         return 0;
 922                                         }
 923                                 s->session->tlsext_ellipticcurvelist_length = 0;
 924                                 if ((s->session->tlsext_ellipticcurvelist = OPENSSL_malloc(ellipticcurvelist_length)) == NULL)
 925                                         {
 926                                         *al = TLS1_AD_INTERNAL_ERROR;
 927                                         return 0;
 928                                         }
 929                                 s->session->tlsext_ellipticcurvelist_length = ellipticcurvelist_length;
 930                                 memcpy(s->session->tlsext_ellipticcurvelist, sdata, ellipticcurvelist_length);
 931                                 }
 932 #if 0
 933                         fprintf(stderr,"ssl_parse_clienthello_tlsext s->session->tlsext_ellipticcurvelist (length=%i) ", s->session->tlsext_ellipticcurvelist_length);
 934                         sdata = s->session->tlsext_ellipticcurvelist;
 935                         for (i = 0; i < s->session->tlsext_ellipticcurvelist_length; i++)
 936                                 fprintf(stderr,"%i ",*(sdata++));
 937                         fprintf(stderr,"\n");
 938 #endif
 939                         }
 940 #endif /* OPENSSL_NO_EC */
 941 #ifdef TLSEXT_TYPE_opaque_prf_input
 942                 else if (type == TLSEXT_TYPE_opaque_prf_input &&
 943                      s->version != DTLS1_VERSION)
 944                         {
 945                         unsigned char *sdata = data;
 946
 947                         if (size < 2)
 948                                 {
 949                                 *al = SSL_AD_DECODE_ERROR;
 950                                 return 0;
 951                                 }
 952                         n2s(sdata, s->s3->client_opaque_prf_input_len);
 953                         if (s->s3->client_opaque_prf_input_len != size - 2)
 954                                 {
 955                                 *al = SSL_AD_DECODE_ERROR;
 956                                 return 0;
 957                                 }
 958
 959                         if (s->s3->client_opaque_prf_input != NULL) /* shouldn't really happen */
 960                                 OPENSSL_free(s->s3->client_opaque_prf_input);
 961                         if (s->s3->client_opaque_prf_input_len == 0)
 962                                 s->s3->client_opaque_prf_input = OPENSSL_malloc(1); /* dummy byte just to get non-NULL */
 963                         else
 964                                 s->s3->client_opaque_prf_input = BUF_memdup(sdata, s->s3->client_opaque_prf_input_len);
 965                         if (s->s3->client_opaque_prf_input == NULL)
 966                                 {
 967                                 *al = TLS1_AD_INTERNAL_ERROR;
 968                                 return 0;
 969                                 }
 970                         }
 971 #endif
 972                 else if (type == TLSEXT_TYPE_session_ticket)
 973                         {
 974                         if (s->tls_session_ticket_ext_cb &&
 975                             !s->tls_session_ticket_ext_cb(s, data, size, s->tls_session_ticket_ext_cb_arg))
 976                                 {
 977                                 *al = TLS1_AD_INTERNAL_ERROR;
 978                                 return 0;
 979                                 }
 980                         }
 981                 else if (type == TLSEXT_TYPE_renegotiate)
 982                         {
 983                         if(!ssl_parse_clienthello_renegotiate_ext(s, data, size, al))
 984                                 return 0;
 985                         renegotiate_seen = 1;
 986                         }
 987                 else if (type == TLSEXT_TYPE_signature_algorithms)
 988                         {
 989                         int dsize;
 990                         if (sigalg_seen || size < 2)
 991                                 {
 992                                 *al = SSL_AD_DECODE_ERROR;
 993                                 return 0;
 994                                 }
 995                         sigalg_seen = 1;
 996                         n2s(data,dsize);
 997                         size -= 2;
 998                         if (dsize != size || dsize & 1)
 999                                 {
1000                                 *al = SSL_AD_DECODE_ERROR;
1001                                 return 0;
1002                                 }
1003                         if (!tls1_process_sigalgs(s, data, dsize))
1004                                 {
1005                                 *al = SSL_AD_DECODE_ERROR;
1006                                 return 0;
1007                                 }
1008                         }
1009                 else if (type == TLSEXT_TYPE_status_request &&
1010                          s->version != DTLS1_VERSION && s->ctx->tlsext_status_cb)
1011                         {
1012
1013                         if (size < 5)
1014                                 {
1015                                 *al = SSL_AD_DECODE_ERROR;
1016                                 return 0;
1017                                 }
1018
1019                         s->tlsext_status_type = *data++;
1020                         size--;
1021                         if (s->tlsext_status_type == TLSEXT_STATUSTYPE_ocsp)
1022                                 {
1023                                 const unsigned char *sdata;
1024                                 int dsize;
1025                                 /* Read in responder_id_list */
1026                                 n2s(data,dsize);
1027                                 size -= 2;
1028                                 if (dsize > size  )
1029                                         {
1030                                         *al = SSL_AD_DECODE_ERROR;
1031                                         return 0;
1032                                         }
1033                                 while (dsize > 0)
1034                                         {
1035                                         OCSP_RESPID *id;
1036                                         int idsize;
1037                                         if (dsize < 4)
1038                                                 {
1039                                                 *al = SSL_AD_DECODE_ERROR;
1040                                                 return 0;
1041                                                 }
1042                                         n2s(data, idsize);
1043                                         dsize -= 2 + idsize;
1044                                         size -= 2 + idsize;
1045                                         if (dsize < 0)
1046                                                 {
1047                                                 *al = SSL_AD_DECODE_ERROR;
1048                                                 return 0;
1049                                                 }
1050                                         sdata = data;
1051                                         data += idsize;
1052                                         id = d2i_OCSP_RESPID(NULL,
1053                                                                 &sdata, idsize);
1054                                         if (!id)
1055                                                 {
1056                                                 *al = SSL_AD_DECODE_ERROR;
1057                                                 return 0;
1058                                                 }
1059                                         if (data != sdata)
1060                                                 {
1061                                                 OCSP_RESPID_free(id);
1062                                                 *al = SSL_AD_DECODE_ERROR;
1063                                                 return 0;
1064                                                 }
1065                                         if (!s->tlsext_ocsp_ids
1066                                                 && !(s->tlsext_ocsp_ids =
1067                                                 sk_OCSP_RESPID_new_null()))
1068                                                 {
1069                                                 OCSP_RESPID_free(id);
1070                                                 *al = SSL_AD_INTERNAL_ERROR;
1071                                                 return 0;
1072                                                 }
1073                                         if (!sk_OCSP_RESPID_push(
1074                                                         s->tlsext_ocsp_ids, id))
1075                                                 {
1076                                                 OCSP_RESPID_free(id);
1077                                                 *al = SSL_AD_INTERNAL_ERROR;
1078                                                 return 0;
1079                                                 }
1080                                         }
1081
1082                                 /* Read in request_extensions */
1083                                 if (size < 2)
1084                                         {
1085                                         *al = SSL_AD_DECODE_ERROR;
1086                                         return 0;
1087                                         }
1088                                 n2s(data,dsize);
1089                                 size -= 2;
1090                                 if (dsize != size)
1091                                         {
1092                                         *al = SSL_AD_DECODE_ERROR;
1093                                         return 0;
1094                                         }
1095                                 sdata = data;
1096                                 if (dsize > 0)
1097                                         {
1098                                         s->tlsext_ocsp_exts =
1099                                                 d2i_X509_EXTENSIONS(NULL,
1100                                                         &sdata, dsize);
1101                                         if (!s->tlsext_ocsp_exts
1102                                                 || (data + dsize != sdata))
1103                                                 {
1104                                                 *al = SSL_AD_DECODE_ERROR;
1105                                                 return 0;
1106                                                 }
1107                                         }
1108                                 }
1109                                 /* We don't know what to do with any other type
1110                                 * so ignore it.
1111                                 */
1112                                 else
1113                                         s->tlsext_status_type = -1;
1114                         }
1115
1116                 /* session ticket processed earlier */
1117                 data+=size;
1118                 }
1119
1120         *p = data;
1121
1122         ri_check:
1123
1124         /* Need RI if renegotiating */
1125
1126         if (!renegotiate_seen && s->renegotiate &&
1127                 !(s->options & SSL_OP_ALLOW_UNSAFE_LEGACY_RENEGOTIATION))
1128                 {
1129                 *al = SSL_AD_HANDSHAKE_FAILURE;
1130                 SSLerr(SSL_F_SSL_PARSE_CLIENTHELLO_TLSEXT,
1131                                 SSL_R_UNSAFE_LEGACY_RENEGOTIATION_DISABLED);
1132                 return 0;
1133                 }
1134
1135         return 1;
1136         }
1137
1138 int ssl_parse_serverhello_tlsext(SSL *s, unsigned char **p, unsigned char *d, int n, int *al)
1139         {
1140         unsigned short length;
1141         unsigned short type;
1142         unsigned short size;
1143         unsigned char *data = *p;
1144         int tlsext_servername = 0;
1145         int renegotiate_seen = 0;
1146
1147         if (data >= (d+n-2))
1148                 goto ri_check;
1149
1150         n2s(data,length);
1151         if (data+length != d+n)
1152                 {
1153                 *al = SSL_AD_DECODE_ERROR;
1154                 return 0;
1155                 }
1156
1157         while(data <= (d+n-4))
1158                 {
1159                 n2s(data,type);
1160                 n2s(data,size);
1161
1162                 if (data+size > (d+n))
1163                         goto ri_check;
1164
1165                 if (s->tlsext_debug_cb)
1166                         s->tlsext_debug_cb(s, 1, type, data, size,
1167                                                 s->tlsext_debug_arg);
1168
1169                 if (type == TLSEXT_TYPE_server_name)
1170                         {
1171                         if (s->tlsext_hostname == NULL || size > 0)
1172                                 {
1173                                 *al = TLS1_AD_UNRECOGNIZED_NAME;
1174                                 return 0;
1175                                 }
1176                         tlsext_servername = 1;
1177                         }
1178
1179 #ifndef OPENSSL_NO_EC
1180                 else if (type == TLSEXT_TYPE_ec_point_formats &&
1181                      s->version != DTLS1_VERSION)
1182                         {
1183                         unsigned char *sdata = data;
1184                         int ecpointformatlist_length = *(sdata++);
1185
1186                         if (ecpointformatlist_length != size - 1)
1187                                 {
1188                                 *al = TLS1_AD_DECODE_ERROR;
1189                                 return 0;
1190                                 }
1191                         s->session->tlsext_ecpointformatlist_length = 0;
1192                         if (s->session->tlsext_ecpointformatlist != NULL) OPENSSL_free(s->session->tlsext_ecpointformatlist);
1193                         if ((s->session->tlsext_ecpointformatlist = OPENSSL_malloc(ecpointformatlist_length)) == NULL)
1194                                 {
1195                                 *al = TLS1_AD_INTERNAL_ERROR;
1196                                 return 0;
1197                                 }
1198                         s->session->tlsext_ecpointformatlist_length = ecpointformatlist_length;
1199                         memcpy(s->session->tlsext_ecpointformatlist, sdata, ecpointformatlist_length);
1200 #if 0
1201                         fprintf(stderr,"ssl_parse_serverhello_tlsext s->session->tlsext_ecpointformatlist ");
1202                         sdata = s->session->tlsext_ecpointformatlist;
1203                         for (i = 0; i < s->session->tlsext_ecpointformatlist_length; i++)
1204                                 fprintf(stderr,"%i ",*(sdata++));
1205                         fprintf(stderr,"\n");
1206 #endif
1207                         }
1208 #endif /* OPENSSL_NO_EC */
1209
1210                 else if (type == TLSEXT_TYPE_session_ticket)
1211                         {
1212                         if (s->tls_session_ticket_ext_cb &&
1213                             !s->tls_session_ticket_ext_cb(s, data, size, s->tls_session_ticket_ext_cb_arg))
1214                                 {
1215                                 *al = TLS1_AD_INTERNAL_ERROR;
1216                                 return 0;
1217                                 }
1218                         if ((SSL_get_options(s) & SSL_OP_NO_TICKET)
1219                                 || (size > 0))
1220                                 {
1221                                 *al = TLS1_AD_UNSUPPORTED_EXTENSION;
1222                                 return 0;
1223                                 }
1224                         s->tlsext_ticket_expected = 1;
1225                         }
1226 #ifdef TLSEXT_TYPE_opaque_prf_input
1227                 else if (type == TLSEXT_TYPE_opaque_prf_input &&
1228                      s->version != DTLS1_VERSION)
1229                         {
1230                         unsigned char *sdata = data;
1231
1232                         if (size < 2)
1233                                 {
1234                                 *al = SSL_AD_DECODE_ERROR;
1235                                 return 0;
1236                                 }
1237                         n2s(sdata, s->s3->server_opaque_prf_input_len);
1238                         if (s->s3->server_opaque_prf_input_len != size - 2)
1239                                 {
1240                                 *al = SSL_AD_DECODE_ERROR;
1241                                 return 0;
1242                                 }
1243
1244                         if (s->s3->server_opaque_prf_input != NULL) /* shouldn't really happen */
1245                                 OPENSSL_free(s->s3->server_opaque_prf_input);
1246                         if (s->s3->server_opaque_prf_input_len == 0)
1247                                 s->s3->server_opaque_prf_input = OPENSSL_malloc(1); /* dummy byte just to get non-NULL */
1248                         else
1249                                 s->s3->server_opaque_prf_input = BUF_memdup(sdata, s->s3->server_opaque_prf_input_len);
1250
1251                         if (s->s3->server_opaque_prf_input == NULL)
1252                                 {
1253                                 *al = TLS1_AD_INTERNAL_ERROR;
1254                                 return 0;
1255                                 }
1256                         }
1257 #endif
1258                 else if (type == TLSEXT_TYPE_status_request &&
1259                          s->version != DTLS1_VERSION)
1260                         {
1261                         /* MUST be empty and only sent if we've requested
1262                          * a status request message.
1263                          */
1264                         if ((s->tlsext_status_type == -1) || (size > 0))
1265                                 {
1266                                 *al = TLS1_AD_UNSUPPORTED_EXTENSION;
1267                                 return 0;
1268                                 }
1269                         /* Set flag to expect CertificateStatus message */
1270                         s->tlsext_status_expected = 1;
1271                         }
1272                 else if (type == TLSEXT_TYPE_renegotiate)
1273                         {
1274                         if(!ssl_parse_serverhello_renegotiate_ext(s, data, size, al))
1275                                 return 0;
1276                         renegotiate_seen = 1;
1277                         }
1278                 data+=size;
1279                 }
1280
1281         if (data != d+n)
1282                 {
1283                 *al = SSL_AD_DECODE_ERROR;
1284                 return 0;
1285                 }
1286
1287         if (!s->hit && tlsext_servername == 1)
1288                 {
1289                 if (s->tlsext_hostname)
1290                         {
1291                         if (s->session->tlsext_hostname == NULL)
1292                                 {
1293                                 s->session->tlsext_hostname = BUF_strdup(s->tlsext_hostname);
1294                                 if (!s->session->tlsext_hostname)
1295                                         {
1296                                         *al = SSL_AD_UNRECOGNIZED_NAME;
1297                                         return 0;
1298                                         }
1299                                 }
1300                         else
1301                                 {
1302                                 *al = SSL_AD_DECODE_ERROR;
1303                                 return 0;
1304                                 }
1305                         }
1306                 }
1307
1308         *p = data;
1309
1310         ri_check:
1311
1312         /* Determine if we need to see RI. Strictly speaking if we want to
1313          * avoid an attack we should *always* see RI even on initial server
1314          * hello because the client doesn't see any renegotiation during an
1315          * attack. However this would mean we could not connect to any server
1316          * which doesn't support RI so for the immediate future tolerate RI
1317          * absence on initial connect only.
1318          */
1319         if (!renegotiate_seen
1320                 && !(s->options & SSL_OP_LEGACY_SERVER_CONNECT)
1321                 && !(s->options & SSL_OP_ALLOW_UNSAFE_LEGACY_RENEGOTIATION))
1322                 {
1323                 *al = SSL_AD_HANDSHAKE_FAILURE;
1324                 SSLerr(SSL_F_SSL_PARSE_SERVERHELLO_TLSEXT,
1325                                 SSL_R_UNSAFE_LEGACY_RENEGOTIATION_DISABLED);
1326                 return 0;
1327                 }
1328
1329         return 1;
1330         }
1331
1332
1333 int ssl_prepare_clienthello_tlsext(SSL *s)
1334         {
1335 #ifndef OPENSSL_NO_EC
1336         /* If we are client and using an elliptic curve cryptography cipher suite, send the point formats
1337          * and elliptic curves we support.
1338          */
1339         int using_ecc = 0;
1340         int i;
1341         unsigned char *j;
1342         unsigned long alg_k, alg_a;
1343         STACK_OF(SSL_CIPHER) *cipher_stack = SSL_get_ciphers(s);
1344
1345         for (i = 0; i < sk_SSL_CIPHER_num(cipher_stack); i++)
1346                 {
1347                 SSL_CIPHER *c = sk_SSL_CIPHER_value(cipher_stack, i);
1348
1349                 alg_k = c->algorithm_mkey;
1350                 alg_a = c->algorithm_auth;
1351                 if ((alg_k & (SSL_kEECDH|SSL_kECDHr|SSL_kECDHe) || (alg_a & SSL_aECDSA)))
1352                         {
1353                         using_ecc = 1;
1354                         break;
1355                         }
1356                 }
1357         using_ecc = using_ecc && (s->version >= TLS1_VERSION);
1358         if (using_ecc)
1359                 {
1360                 if (s->tlsext_ecpointformatlist != NULL) OPENSSL_free(s->tlsext_ecpointformatlist);
1361                 if ((s->tlsext_ecpointformatlist = OPENSSL_malloc(3)) == NULL)
1362                         {
1363                         SSLerr(SSL_F_SSL_PREPARE_CLIENTHELLO_TLSEXT,ERR_R_MALLOC_FAILURE);
1364                         return -1;
1365                         }
1366                 s->tlsext_ecpointformatlist_length = 3;
1367                 s->tlsext_ecpointformatlist[0] = TLSEXT_ECPOINTFORMAT_uncompressed;
1368                 s->tlsext_ecpointformatlist[1] = TLSEXT_ECPOINTFORMAT_ansiX962_compressed_prime;
1369                 s->tlsext_ecpointformatlist[2] = TLSEXT_ECPOINTFORMAT_ansiX962_compressed_char2;
1370
1371                 /* we support all named elliptic curves in draft-ietf-tls-ecc-12 */
1372                 if (s->tlsext_ellipticcurvelist != NULL) OPENSSL_free(s->tlsext_ellipticcurvelist);
1373                 s->tlsext_ellipticcurvelist_length = sizeof(nid_list)/sizeof(nid_list[0]) * 2;
1374                 if ((s->tlsext_ellipticcurvelist = OPENSSL_malloc(s->tlsext_ellipticcurvelist_length)) == NULL)
1375                         {
1376                         s->tlsext_ellipticcurvelist_length = 0;
1377                         SSLerr(SSL_F_SSL_PREPARE_CLIENTHELLO_TLSEXT,ERR_R_MALLOC_FAILURE);
1378                         return -1;
1379                         }
1380                 for (i = 1, j = s->tlsext_ellipticcurvelist; (unsigned int)i <=
1381                                 sizeof(nid_list)/sizeof(nid_list[0]); i++)
1382                         s2n(i,j);
1383                 }
1384 #endif /* OPENSSL_NO_EC */
1385
1386 #ifdef TLSEXT_TYPE_opaque_prf_input
1387         {
1388                 int r = 1;
1389
1390                 if (s->ctx->tlsext_opaque_prf_input_callback != 0)
1391                         {
1392                         r = s->ctx->tlsext_opaque_prf_input_callback(s, NULL, 0, s->ctx->tlsext_opaque_prf_input_callback_arg);
1393                         if (!r)
1394                                 return -1;
1395                         }
1396
1397                 if (s->tlsext_opaque_prf_input != NULL)
1398                         {
1399                         if (s->s3->client_opaque_prf_input != NULL) /* shouldn't really happen */
1400                                 OPENSSL_free(s->s3->client_opaque_prf_input);
1401
1402                         if (s->tlsext_opaque_prf_input_len == 0)
1403                                 s->s3->client_opaque_prf_input = OPENSSL_malloc(1); /* dummy byte just to get non-NULL */
1404                         else
1405                                 s->s3->client_opaque_prf_input = BUF_memdup(s->tlsext_opaque_prf_input, s->tlsext_opaque_prf_input_len);
1406                         if (s->s3->client_opaque_prf_input == NULL)
1407                                 {
1408                                 SSLerr(SSL_F_SSL_PREPARE_CLIENTHELLO_TLSEXT,ERR_R_MALLOC_FAILURE);
1409                                 return -1;
1410                                 }
1411                         s->s3->client_opaque_prf_input_len = s->tlsext_opaque_prf_input_len;
1412                         }
1413
1414                 if (r == 2)
1415                         /* at callback's request, insist on receiving an appropriate server opaque PRF input */
1416                         s->s3->server_opaque_prf_input_len = s->tlsext_opaque_prf_input_len;
1417         }
1418 #endif
1419
1420         return 1;
1421         }
1422
1423 int ssl_prepare_serverhello_tlsext(SSL *s)
1424         {
1425 #ifndef OPENSSL_NO_EC
1426         /* If we are server and using an ECC cipher suite, send the point formats we support
1427          * if the client sent us an ECPointsFormat extension.  Note that the server is not
1428          * supposed to send an EllipticCurves extension.
1429          */
1430
1431         unsigned long alg_k = s->s3->tmp.new_cipher->algorithm_mkey;
1432         unsigned long alg_a = s->s3->tmp.new_cipher->algorithm_auth;
1433         int using_ecc = (alg_k & (SSL_kEECDH|SSL_kECDHr|SSL_kECDHe)) || (alg_a & SSL_aECDSA);
1434         using_ecc = using_ecc && (s->session->tlsext_ecpointformatlist != NULL);
1435
1436         if (using_ecc)
1437                 {
1438                 if (s->tlsext_ecpointformatlist != NULL) OPENSSL_free(s->tlsext_ecpointformatlist);
1439                 if ((s->tlsext_ecpointformatlist = OPENSSL_malloc(3)) == NULL)
1440                         {
1441                         SSLerr(SSL_F_SSL_PREPARE_SERVERHELLO_TLSEXT,ERR_R_MALLOC_FAILURE);
1442                         return -1;
1443                         }
1444                 s->tlsext_ecpointformatlist_length = 3;
1445                 s->tlsext_ecpointformatlist[0] = TLSEXT_ECPOINTFORMAT_uncompressed;
1446                 s->tlsext_ecpointformatlist[1] = TLSEXT_ECPOINTFORMAT_ansiX962_compressed_prime;
1447                 s->tlsext_ecpointformatlist[2] = TLSEXT_ECPOINTFORMAT_ansiX962_compressed_char2;
1448                 }
1449 #endif /* OPENSSL_NO_EC */
1450
1451         return 1;
1452         }
1453
1454 int ssl_check_clienthello_tlsext(SSL *s)
1455         {
1456         int ret=SSL_TLSEXT_ERR_NOACK;
1457         int al = SSL_AD_UNRECOGNIZED_NAME;
1458
1459 #ifndef OPENSSL_NO_EC
1460         /* The handling of the ECPointFormats extension is done elsewhere, namely in
1461          * ssl3_choose_cipher in s3_lib.c.
1462          */
1463         /* The handling of the EllipticCurves extension is done elsewhere, namely in
1464          * ssl3_choose_cipher in s3_lib.c.
1465          */
1466 #endif
1467
1468         if (s->ctx != NULL && s->ctx->tlsext_servername_callback != 0)
1469                 ret = s->ctx->tlsext_servername_callback(s, &al, s->ctx->tlsext_servername_arg);
1470         else if (s->initial_ctx != NULL && s->initial_ctx->tlsext_servername_callback != 0)
1471                 ret = s->initial_ctx->tlsext_servername_callback(s, &al, s->initial_ctx->tlsext_servername_arg);
1472
1473         /* If status request then ask callback what to do.
1474          * Note: this must be called after servername callbacks in case
1475          * the certificate has changed.
1476          */
1477         if ((s->tlsext_status_type != -1) && s->ctx && s->ctx->tlsext_status_cb)
1478                 {
1479                 int r;
1480                 r = s->ctx->tlsext_status_cb(s, s->ctx->tlsext_status_arg);
1481                 switch (r)
1482                         {
1483                         /* We don't want to send a status request response */
1484                         case SSL_TLSEXT_ERR_NOACK:
1485                                 s->tlsext_status_expected = 0;
1486                                 break;
1487                         /* status request response should be sent */
1488                         case SSL_TLSEXT_ERR_OK:
1489                                 if (s->tlsext_ocsp_resp)
1490                                         s->tlsext_status_expected = 1;
1491                                 else
1492                                         s->tlsext_status_expected = 0;
1493                                 break;
1494                         /* something bad happened */
1495                         case SSL_TLSEXT_ERR_ALERT_FATAL:
1496                                 ret = SSL_TLSEXT_ERR_ALERT_FATAL;
1497                                 al = SSL_AD_INTERNAL_ERROR;
1498                                 goto err;
1499                         }
1500                 }
1501         else
1502                 s->tlsext_status_expected = 0;
1503
1504 #ifdef TLSEXT_TYPE_opaque_prf_input
1505         {
1506                 /* This sort of belongs into ssl_prepare_serverhello_tlsext(),
1507                  * but we might be sending an alert in response to the client hello,
1508                  * so this has to happen here in ssl_check_clienthello_tlsext(). */
1509
1510                 int r = 1;
1511
1512                 if (s->ctx->tlsext_opaque_prf_input_callback != 0)
1513                         {
1514                         r = s->ctx->tlsext_opaque_prf_input_callback(s, NULL, 0, s->ctx->tlsext_opaque_prf_input_callback_arg);
1515                         if (!r)
1516                                 {
1517                                 ret = SSL_TLSEXT_ERR_ALERT_FATAL;
1518                                 al = SSL_AD_INTERNAL_ERROR;
1519                                 goto err;
1520                                 }
1521                         }
1522
1523                 if (s->s3->server_opaque_prf_input != NULL) /* shouldn't really happen */
1524                         OPENSSL_free(s->s3->server_opaque_prf_input);
1525                 s->s3->server_opaque_prf_input = NULL;
1526
1527                 if (s->tlsext_opaque_prf_input != NULL)
1528                         {
1529                         if (s->s3->client_opaque_prf_input != NULL &&
1530                                 s->s3->client_opaque_prf_input_len == s->tlsext_opaque_prf_input_len)
1531                                 {
1532                                 /* can only use this extension if we have a server opaque PRF input
1533                                  * of the same length as the client opaque PRF input! */
1534
1535                                 if (s->tlsext_opaque_prf_input_len == 0)
1536                                         s->s3->server_opaque_prf_input = OPENSSL_malloc(1); /* dummy byte just to get non-NULL */
1537                                 else
1538                                         s->s3->server_opaque_prf_input = BUF_memdup(s->tlsext_opaque_prf_input, s->tlsext_opaque_prf_input_len);
1539                                 if (s->s3->server_opaque_prf_input == NULL)
1540                                         {
1541                                         ret = SSL_TLSEXT_ERR_ALERT_FATAL;
1542                                         al = SSL_AD_INTERNAL_ERROR;
1543                                         goto err;
1544                                         }
1545                                 s->s3->server_opaque_prf_input_len = s->tlsext_opaque_prf_input_len;
1546                                 }
1547                         }
1548
1549                 if (r == 2 && s->s3->server_opaque_prf_input == NULL)
1550                         {
1551                         /* The callback wants to enforce use of the extension,
1552                          * but we can't do that with the client opaque PRF input;
1553                          * abort the handshake.
1554                          */
1555                         ret = SSL_TLSEXT_ERR_ALERT_FATAL;
1556                         al = SSL_AD_HANDSHAKE_FAILURE;
1557                         }
1558         }
1559
1560 #endif
1561  err:
1562         switch (ret)
1563                 {
1564                 case SSL_TLSEXT_ERR_ALERT_FATAL:
1565                         ssl3_send_alert(s,SSL3_AL_FATAL,al);
1566                         return -1;
1567
1568                 case SSL_TLSEXT_ERR_ALERT_WARNING:
1569                         ssl3_send_alert(s,SSL3_AL_WARNING,al);
1570                         return 1;
1571
1572                 case SSL_TLSEXT_ERR_NOACK:
1573                         s->servername_done=0;
1574                         default:
1575                 return 1;
1576                 }
1577         }
1578
1579 int ssl_check_serverhello_tlsext(SSL *s)
1580         {
1581         int ret=SSL_TLSEXT_ERR_NOACK;
1582         int al = SSL_AD_UNRECOGNIZED_NAME;
1583
1584 #ifndef OPENSSL_NO_EC
1585         /* If we are client and using an elliptic curve cryptography cipher
1586          * suite, then if server returns an EC point formats lists extension
1587          * it must contain uncompressed.
1588          */
1589         unsigned long alg_k = s->s3->tmp.new_cipher->algorithm_mkey;
1590         unsigned long alg_a = s->s3->tmp.new_cipher->algorithm_auth;
1591         if ((s->tlsext_ecpointformatlist != NULL) && (s->tlsext_ecpointformatlist_length > 0) &&
1592             (s->session->tlsext_ecpointformatlist != NULL) && (s->session->tlsext_ecpointformatlist_length > 0) &&
1593             ((alg_k & (SSL_kEECDH|SSL_kECDHr|SSL_kECDHe)) || (alg_a & SSL_aECDSA)))
1594                 {
1595                 /* we are using an ECC cipher */
1596                 size_t i;
1597                 unsigned char *list;
1598                 int found_uncompressed = 0;
1599                 list = s->session->tlsext_ecpointformatlist;
1600                 for (i = 0; i < s->session->tlsext_ecpointformatlist_length; i++)
1601                         {
1602                         if (*(list++) == TLSEXT_ECPOINTFORMAT_uncompressed)
1603                                 {
1604                                 found_uncompressed = 1;
1605                                 break;
1606                                 }
1607                         }
1608                 if (!found_uncompressed)
1609                         {
1610                         SSLerr(SSL_F_SSL_CHECK_SERVERHELLO_TLSEXT,SSL_R_TLS_INVALID_ECPOINTFORMAT_LIST);
1611                         return -1;
1612                         }
1613                 }
1614         ret = SSL_TLSEXT_ERR_OK;
1615 #endif /* OPENSSL_NO_EC */
1616
1617         if (s->ctx != NULL && s->ctx->tlsext_servername_callback != 0)
1618                 ret = s->ctx->tlsext_servername_callback(s, &al, s->ctx->tlsext_servername_arg);
1619         else if (s->initial_ctx != NULL && s->initial_ctx->tlsext_servername_callback != 0)
1620                 ret = s->initial_ctx->tlsext_servername_callback(s, &al, s->initial_ctx->tlsext_servername_arg);
1621
1622 #ifdef TLSEXT_TYPE_opaque_prf_input
1623         if (s->s3->server_opaque_prf_input_len > 0)
1624                 {
1625                 /* This case may indicate that we, as a client, want to insist on using opaque PRF inputs.
1626                  * So first verify that we really have a value from the server too. */
1627
1628                 if (s->s3->server_opaque_prf_input == NULL)
1629                         {
1630                         ret = SSL_TLSEXT_ERR_ALERT_FATAL;
1631                         al = SSL_AD_HANDSHAKE_FAILURE;
1632                         }
1633
1634                 /* Anytime the server *has* sent an opaque PRF input, we need to check
1635                  * that we have a client opaque PRF input of the same size. */
1636                 if (s->s3->client_opaque_prf_input == NULL ||
1637                     s->s3->client_opaque_prf_input_len != s->s3->server_opaque_prf_input_len)
1638                         {
1639                         ret = SSL_TLSEXT_ERR_ALERT_FATAL;
1640                         al = SSL_AD_ILLEGAL_PARAMETER;
1641                         }
1642                 }
1643 #endif
1644
1645         /* If we've requested certificate status and we wont get one
1646          * tell the callback
1647          */
1648         if ((s->tlsext_status_type != -1) && !(s->tlsext_status_expected)
1649                         && s->ctx && s->ctx->tlsext_status_cb)
1650                 {
1651                 int r;
1652                 /* Set resp to NULL, resplen to -1 so callback knows
1653                  * there is no response.
1654                  */
1655                 if (s->tlsext_ocsp_resp)
1656                         {
1657                         OPENSSL_free(s->tlsext_ocsp_resp);
1658                         s->tlsext_ocsp_resp = NULL;
1659                         }
1660                 s->tlsext_ocsp_resplen = -1;
1661                 r = s->ctx->tlsext_status_cb(s, s->ctx->tlsext_status_arg);
1662                 if (r == 0)
1663                         {
1664                         al = SSL_AD_BAD_CERTIFICATE_STATUS_RESPONSE;
1665                         ret = SSL_TLSEXT_ERR_ALERT_FATAL;
1666                         }
1667                 if (r < 0)
1668                         {
1669                         al = SSL_AD_INTERNAL_ERROR;
1670                         ret = SSL_TLSEXT_ERR_ALERT_FATAL;
1671                         }
1672                 }
1673
1674         switch (ret)
1675                 {
1676                 case SSL_TLSEXT_ERR_ALERT_FATAL:
1677                         ssl3_send_alert(s,SSL3_AL_FATAL,al);
1678                         return -1;
1679
1680                 case SSL_TLSEXT_ERR_ALERT_WARNING:
1681                         ssl3_send_alert(s,SSL3_AL_WARNING,al);
1682                         return 1;
1683
1684                 case SSL_TLSEXT_ERR_NOACK:
1685                         s->servername_done=0;
1686                         default:
1687                 return 1;
1688                 }
1689         }
1690
1691 /* Since the server cache lookup is done early on in the processing of client
1692  * hello and other operations depend on the result we need to handle any TLS
1693  * session ticket extension at the same time.
1694  */
1695
1696 int tls1_process_ticket(SSL *s, unsigned char *session_id, int len,
1697                                 const unsigned char *limit, SSL_SESSION **ret)
1698         {
1699         /* Point after session ID in client hello */
1700         const unsigned char *p = session_id + len;
1701         unsigned short i;
1702
1703         /* If tickets disabled behave as if no ticket present
1704          * to permit stateful resumption.
1705          */
1706         if (SSL_get_options(s) & SSL_OP_NO_TICKET)
1707                 return 1;
1708
1709         if ((s->version <= SSL3_VERSION) || !limit)
1710                 return 1;
1711         if (p >= limit)
1712                 return -1;
1713         /* Skip past DTLS cookie */
1714         if (s->version == DTLS1_VERSION || s->version == DTLS1_BAD_VER)
1715                 {
1716                 i = *(p++);
1717                 p+= i;
1718                 if (p >= limit)
1719                         return -1;
1720                 }
1721         /* Skip past cipher list */
1722         n2s(p, i);
1723         p+= i;
1724         if (p >= limit)
1725                 return -1;
1726         /* Skip past compression algorithm list */
1727         i = *(p++);
1728         p += i;
1729         if (p > limit)
1730                 return -1;
1731         /* Now at start of extensions */
1732         if ((p + 2) >= limit)
1733                 return 1;
1734         n2s(p, i);
1735         while ((p + 4) <= limit)
1736                 {
1737                 unsigned short type, size;
1738                 n2s(p, type);
1739                 n2s(p, size);
1740                 if (p + size > limit)
1741                         return 1;
1742                 if (type == TLSEXT_TYPE_session_ticket)
1743                         {
1744                         /* If tickets disabled indicate cache miss which will
1745                          * trigger a full handshake
1746                          */
1747                         if (SSL_get_options(s) & SSL_OP_NO_TICKET)
1748                                 return 1;
1749                         /* If zero length note client will accept a ticket
1750                          * and indicate cache miss to trigger full handshake
1751                          */
1752                         if (size == 0)
1753                                 {
1754                                 s->tlsext_ticket_expected = 1;
1755                                 return 0;       /* Cache miss */
1756                                 }
1757                         if (s->tls_session_secret_cb)
1758                                 {
1759                                 /* Indicate cache miss here and instead of
1760                                  * generating the session from ticket now,
1761                                  * trigger abbreviated handshake based on
1762                                  * external mechanism to calculate the master
1763                                  * secret later. */
1764                                 return 0;
1765                                 }
1766                         return tls_decrypt_ticket(s, p, size, session_id, len,
1767                                                                         ret);
1768                         }
1769                 p += size;
1770                 }
1771         return 1;
1772         }
1773
1774 static int tls_decrypt_ticket(SSL *s, const unsigned char *etick, int eticklen,
1775                                 const unsigned char *sess_id, int sesslen,
1776                                 SSL_SESSION **psess)
1777         {
1778         SSL_SESSION *sess;
1779         unsigned char *sdec;
1780         const unsigned char *p;
1781         int slen, mlen, renew_ticket = 0;
1782         unsigned char tick_hmac[EVP_MAX_MD_SIZE];
1783         HMAC_CTX hctx;
1784         EVP_CIPHER_CTX ctx;
1785         SSL_CTX *tctx = s->initial_ctx;
1786         /* Need at least keyname + iv + some encrypted data */
1787         if (eticklen < 48)
1788                 goto tickerr;
1789         /* Initialize session ticket encryption and HMAC contexts */
1790         HMAC_CTX_init(&hctx);
1791         EVP_CIPHER_CTX_init(&ctx);
1792         if (tctx->tlsext_ticket_key_cb)
1793                 {
1794                 unsigned char *nctick = (unsigned char *)etick;
1795                 int rv = tctx->tlsext_ticket_key_cb(s, nctick, nctick + 16,
1796                                                         &ctx, &hctx, 0);
1797                 if (rv < 0)
1798                         return -1;
1799                 if (rv == 0)
1800                         goto tickerr;
1801                 if (rv == 2)
1802                         renew_ticket = 1;
1803                 }
1804         else
1805                 {
1806                 /* Check key name matches */
1807                 if (memcmp(etick, tctx->tlsext_tick_key_name, 16))
1808                         goto tickerr;
1809                 HMAC_Init_ex(&hctx, tctx->tlsext_tick_hmac_key, 16,
1810                                         tlsext_tick_md(), NULL);
1811                 EVP_DecryptInit_ex(&ctx, EVP_aes_128_cbc(), NULL,
1812                                 tctx->tlsext_tick_aes_key, etick + 16);
1813                 }
1814         /* Attempt to process session ticket, first conduct sanity and
1815          * integrity checks on ticket.
1816          */
1817         mlen = HMAC_size(&hctx);
1818         if (mlen < 0)
1819                 {
1820                 EVP_CIPHER_CTX_cleanup(&ctx);
1821                 return -1;
1822                 }
1823         eticklen -= mlen;
1824         /* Check HMAC of encrypted ticket */
1825         HMAC_Update(&hctx, etick, eticklen);
1826         HMAC_Final(&hctx, tick_hmac, NULL);
1827         HMAC_CTX_cleanup(&hctx);
1828         if (memcmp(tick_hmac, etick + eticklen, mlen))
1829                 goto tickerr;
1830         /* Attempt to decrypt session data */
1831         /* Move p after IV to start of encrypted ticket, update length */
1832         p = etick + 16 + EVP_CIPHER_CTX_iv_length(&ctx);
1833         eticklen -= 16 + EVP_CIPHER_CTX_iv_length(&ctx);
1834         sdec = OPENSSL_malloc(eticklen);
1835         if (!sdec)
1836                 {
1837                 EVP_CIPHER_CTX_cleanup(&ctx);
1838                 return -1;
1839                 }
1840         EVP_DecryptUpdate(&ctx, sdec, &slen, p, eticklen);
1841         if (EVP_DecryptFinal(&ctx, sdec + slen, &mlen) <= 0)
1842                 goto tickerr;
1843         slen += mlen;
1844         EVP_CIPHER_CTX_cleanup(&ctx);
1845         p = sdec;
1846
1847         sess = d2i_SSL_SESSION(NULL, &p, slen);
1848         OPENSSL_free(sdec);
1849         if (sess)
1850                 {
1851                 /* The session ID if non-empty is used by some clients to
1852                  * detect that the ticket has been accepted. So we copy it to
1853                  * the session structure. If it is empty set length to zero
1854                  * as required by standard.
1855                  */
1856                 if (sesslen)
1857                         memcpy(sess->session_id, sess_id, sesslen);
1858                 sess->session_id_length = sesslen;
1859                 *psess = sess;
1860                 s->tlsext_ticket_expected = renew_ticket;
1861                 return 1;
1862                 }
1863         /* If session decrypt failure indicate a cache miss and set state to
1864          * send a new ticket
1865          */
1866         tickerr:
1867         s->tlsext_ticket_expected = 1;
1868         return 0;
1869         }
1870
1871 /* Tables to translate from NIDs to TLS v1.2 ids */
1872
1873 typedef struct
1874         {
1875         int nid;
1876         int id;
1877         } tls12_lookup;
1878
1879 static tls12_lookup tls12_md[] = {
1880 #ifndef OPENSSL_NO_MD5
1881         {NID_md5, TLSEXT_hash_md5},
1882 #endif
1883 #ifndef OPENSSL_NO_SHA
1884         {NID_sha1, TLSEXT_hash_sha1},
1885 #endif
1886 #ifndef OPENSSL_NO_SHA256
1887         {NID_sha224, TLSEXT_hash_sha224},
1888         {NID_sha256, TLSEXT_hash_sha256},
1889 #endif
1890 #ifndef OPENSSL_NO_SHA512
1891         {NID_sha384, TLSEXT_hash_sha384},
1892         {NID_sha512, TLSEXT_hash_sha512}
1893 #endif
1894 };
1895
1896 static tls12_lookup tls12_sig[] = {
1897 #ifndef OPENSSL_NO_RSA
1898         {EVP_PKEY_RSA, TLSEXT_signature_rsa},
1899 #endif
1900 #ifndef OPENSSL_NO_RSA
1901         {EVP_PKEY_DSA, TLSEXT_signature_dsa},
1902 #endif
1903 #ifndef OPENSSL_NO_ECDSA
1904         {EVP_PKEY_EC, TLSEXT_signature_ecdsa}
1905 #endif
1906 };
1907
1908 static int tls12_find_id(int nid, tls12_lookup *table, size_t tlen)
1909         {
1910         size_t i;
1911         for (i = 0; i < tlen; i++)
1912                 {
1913                 if (table[i].nid == nid)
1914                         return table[i].id;
1915                 }
1916         return -1;
1917         }
1918 #if 0
1919 static int tls12_find_nid(int id, tls12_lookup *table, size_t tlen)
1920         {
1921         size_t i;
1922         for (i = 0; i < tlen; i++)
1923                 {
1924                 if (table[i].id == id)
1925                         return table[i].nid;
1926                 }
1927         return -1;
1928         }
1929 #endif
1930
1931 int tls12_get_sigandhash(unsigned char *p, const EVP_PKEY *pk, const EVP_MD *md)
1932         {
1933         int sig_id, md_id;
1934         md_id = tls12_find_id(EVP_MD_type(md), tls12_md,
1935                                 sizeof(tls12_md)/sizeof(tls12_lookup));
1936         if (md_id == -1)
1937                 return 0;
1938         sig_id = tls12_get_sigid(pk);
1939         if (sig_id == -1)
1940                 return 0;
1941         p[0] = (unsigned char)md_id;
1942         p[1] = (unsigned char)sig_id;
1943         return 1;
1944         }
1945
1946 int tls12_get_sigid(const EVP_PKEY *pk)
1947         {
1948         return tls12_find_id(pk->type, tls12_sig,
1949                                 sizeof(tls12_sig)/sizeof(tls12_lookup));
1950         }
1951
1952 const EVP_MD *tls12_get_hash(unsigned char hash_alg)
1953         {
1954         switch(hash_alg)
1955                 {
1956 #ifndef OPENSSL_NO_MD5
1957                 case TLSEXT_hash_md5:
1958                 return EVP_md5();
1959 #endif
1960 #ifndef OPENSSL_NO_SHA
1961                 case TLSEXT_hash_sha1:
1962                 return EVP_sha1();
1963 #endif
1964 #ifndef OPENSSL_NO_SHA256
1965                 case TLSEXT_hash_sha224:
1966                 return EVP_sha224();
1967
1968                 case TLSEXT_hash_sha256:
1969                 return EVP_sha256();
1970 #endif
1971 #ifndef OPENSSL_NO_SHA512
1972                 case TLSEXT_hash_sha384:
1973                 return EVP_sha384();
1974
1975                 case TLSEXT_hash_sha512:
1976                 return EVP_sha512();
1977 #endif
1978                 default:
1979                 return NULL;
1980
1981                 }
1982         }
1983
1984 /* Set preferred digest for each key type */
1985
1986 int tls1_process_sigalgs(SSL *s, const unsigned char *data, int dsize)
1987         {
1988         int i, idx;
1989         const EVP_MD *md;
1990         CERT *c = s->cert;
1991         /* Extension ignored for TLS versions below 1.2 */
1992         if (s->version < TLS1_2_VERSION)
1993                 return 1;
1994         /* Should never happen */
1995         if (!c)
1996                 return 0;
1997
1998         c->pkeys[SSL_PKEY_DSA_SIGN].digest = NULL;
1999         c->pkeys[SSL_PKEY_RSA_SIGN].digest = NULL;
2000         c->pkeys[SSL_PKEY_RSA_ENC].digest = NULL;
2001         c->pkeys[SSL_PKEY_ECC].digest = NULL;
2002
2003         for (i = 0; i < dsize; i += 2)
2004                 {
2005                 unsigned char hash_alg = data[i], sig_alg = data[i+1];
2006
2007                 switch(sig_alg)
2008                         {
2009 #ifndef OPENSSL_NO_RSA
2010                         case TLSEXT_signature_rsa:
2011                         idx = SSL_PKEY_RSA_SIGN;
2012                         break;
2013 #endif
2014 #ifndef OPENSSL_NO_DSA
2015                         case TLSEXT_signature_dsa:
2016                         idx = SSL_PKEY_DSA_SIGN;
2017                         break;
2018 #endif
2019 #ifndef OPENSSL_NO_ECDSA
2020                         case TLSEXT_signature_ecdsa:
2021                         idx = SSL_PKEY_ECC;
2022                         break;
2023 #endif
2024                         default:
2025                         continue;
2026                         }
2027
2028                 if (c->pkeys[idx].digest == NULL)
2029                         {
2030                         md = tls12_get_hash(hash_alg);
2031                         if (md)
2032                                 {
2033                                 c->pkeys[idx].digest = md;
2034                                 if (idx == SSL_PKEY_RSA_SIGN)
2035                                         c->pkeys[SSL_PKEY_RSA_ENC].digest = md;
2036                                 }
2037                         }
2038
2039                 }
2040
2041
2042         /* Set any remaining keys to default values. NOTE: if alg is not
2043          * supported it stays as NULL.
2044          */
2045 #ifndef OPENSSL_NO_DSA
2046         if (!c->pkeys[SSL_PKEY_DSA_SIGN].digest)
2047                 c->pkeys[SSL_PKEY_DSA_SIGN].digest = EVP_dss1();
2048 #endif
2049 #ifndef OPENSSL_NO_RSA
2050         if (!c->pkeys[SSL_PKEY_RSA_SIGN].digest)
2051                 {
2052                 c->pkeys[SSL_PKEY_RSA_SIGN].digest = EVP_sha1();
2053                 c->pkeys[SSL_PKEY_RSA_ENC].digest = EVP_sha1();
2054                 }
2055 #endif
2056 #ifndef OPENSSL_NO_ECDSA
2057         if (!c->pkeys[SSL_PKEY_ECC].digest)
2058                 c->pkeys[SSL_PKEY_ECC].digest = EVP_ecdsa();
2059 #endif
2060         return 1;
2061         }
2062
2063 #endif