ssl/statem/extensions_clnt.c

   1 /*
   2  * Copyright 2016 The OpenSSL Project Authors. All Rights Reserved.
   3  *
   4  * Licensed under the OpenSSL license (the "License").  You may not use
   5  * this file except in compliance with the License.  You can obtain a copy
   6  * in the file LICENSE in the source distribution or at
   7  * https://www.openssl.org/source/license.html
   8  */
   9
  10 #include <assert.h>
  11 #include "../ssl_locl.h"
  12 #include "statem_locl.h"
  13
  14 /*
  15  * Parse the server's renegotiation binding and abort if it's not right
  16  */
  17 int tls_parse_server_renegotiate(SSL *s, PACKET *pkt, int *al)
  18 {
  19     size_t expected_len = s->s3->previous_client_finished_len
  20         + s->s3->previous_server_finished_len;
  21     size_t ilen;
  22     const unsigned char *data;
  23
  24     /* Check for logic errors */
  25     assert(expected_len == 0 || s->s3->previous_client_finished_len != 0);
  26     assert(expected_len == 0 || s->s3->previous_server_finished_len != 0);
  27
  28     /* Parse the length byte */
  29     if (!PACKET_get_1_len(pkt, &ilen)) {
  30         SSLerr(SSL_F_TLS_PARSE_SERVER_RENEGOTIATE,
  31                SSL_R_RENEGOTIATION_ENCODING_ERR);
  32         *al = SSL_AD_ILLEGAL_PARAMETER;
  33         return 0;
  34     }
  35
  36     /* Consistency check */
  37     if (PACKET_remaining(pkt) != ilen) {
  38         SSLerr(SSL_F_TLS_PARSE_SERVER_RENEGOTIATE,
  39                SSL_R_RENEGOTIATION_ENCODING_ERR);
  40         *al = SSL_AD_ILLEGAL_PARAMETER;
  41         return 0;
  42     }
  43
  44     /* Check that the extension matches */
  45     if (ilen != expected_len) {
  46         SSLerr(SSL_F_TLS_PARSE_SERVER_RENEGOTIATE,
  47                SSL_R_RENEGOTIATION_MISMATCH);
  48         *al = SSL_AD_HANDSHAKE_FAILURE;
  49         return 0;
  50     }
  51
  52     if (!PACKET_get_bytes(pkt, &data, s->s3->previous_client_finished_len)
  53         || memcmp(data, s->s3->previous_client_finished,
  54                   s->s3->previous_client_finished_len) != 0) {
  55         SSLerr(SSL_F_TLS_PARSE_SERVER_RENEGOTIATE,
  56                SSL_R_RENEGOTIATION_MISMATCH);
  57         *al = SSL_AD_HANDSHAKE_FAILURE;
  58         return 0;
  59     }
  60
  61     if (!PACKET_get_bytes(pkt, &data, s->s3->previous_server_finished_len)
  62         || memcmp(data, s->s3->previous_server_finished,
  63                   s->s3->previous_server_finished_len) != 0) {
  64         SSLerr(SSL_F_TLS_PARSE_SERVER_RENEGOTIATE,
  65                SSL_R_RENEGOTIATION_MISMATCH);
  66         *al = SSL_AD_ILLEGAL_PARAMETER;
  67         return 0;
  68     }
  69     s->s3->send_connection_binding = 1;
  70
  71     return 1;
  72 }
  73
  74 int tls_parse_server_server_name(SSL *s, PACKET *pkt, int *al)
  75 {
  76     if (s->tlsext_hostname == NULL || PACKET_remaining(pkt) > 0) {
  77         *al = SSL_AD_UNRECOGNIZED_NAME;
  78         return 0;
  79     }
  80
  81     if (!s->hit) {
  82         if (s->session->tlsext_hostname != NULL) {
  83             *al = SSL_AD_INTERNAL_ERROR;
  84             return 0;
  85         }
  86         s->session->tlsext_hostname = OPENSSL_strdup(s->tlsext_hostname);
  87         if (s->session->tlsext_hostname == NULL) {
  88             *al = SSL_AD_INTERNAL_ERROR;
  89             return 0;
  90         }
  91     }
  92
  93     return 1;
  94 }
  95
  96 #ifndef OPENSSL_NO_EC
  97 int tls_parse_server_ec_pt_formats(SSL *s, PACKET *pkt, int *al)
  98 {
  99     unsigned int ecpointformatlist_length;
 100     PACKET ecptformatlist;
 101
 102     if (!PACKET_as_length_prefixed_1(pkt, &ecptformatlist)) {
 103         *al = SSL_AD_DECODE_ERROR;
 104         return 0;
 105     }
 106     if (!s->hit) {
 107         ecpointformatlist_length = PACKET_remaining(&ecptformatlist);
 108         s->session->tlsext_ecpointformatlist_length = 0;
 109
 110         OPENSSL_free(s->session->tlsext_ecpointformatlist);
 111         s->session->tlsext_ecpointformatlist =
 112              OPENSSL_malloc(ecpointformatlist_length);
 113         if (s->session->tlsext_ecpointformatlist == NULL) {
 114             *al = SSL_AD_INTERNAL_ERROR;
 115             return 0;
 116         }
 117
 118         s->session->tlsext_ecpointformatlist_length = ecpointformatlist_length;
 119
 120         if (!PACKET_copy_bytes(&ecptformatlist,
 121                                s->session->tlsext_ecpointformatlist,
 122                                ecpointformatlist_length)) {
 123             *al = SSL_AD_INTERNAL_ERROR;
 124             return 0;
 125         }
 126     }
 127
 128     return 1;
 129 }
 130 #endif
 131
 132 int tls_parse_server_session_ticket(SSL *s, PACKET *pkt, int *al)
 133 {
 134     if (s->tls_session_ticket_ext_cb &&
 135         !s->tls_session_ticket_ext_cb(s, PACKET_data(pkt),
 136                                       PACKET_remaining(pkt),
 137                                       s->tls_session_ticket_ext_cb_arg)) {
 138         *al = SSL_AD_INTERNAL_ERROR;
 139         return 0;
 140     }
 141     if (!tls_use_ticket(s) || PACKET_remaining(pkt) > 0) {
 142         *al = SSL_AD_UNSUPPORTED_EXTENSION;
 143         return 0;
 144     }
 145     s->tlsext_ticket_expected = 1;
 146
 147     return 1;
 148 }
 149
 150 int tls_parse_server_status_request(SSL *s, PACKET *pkt, int *al)
 151 {
 152     /*
 153      * MUST be empty and only sent if we've requested a status
 154      * request message.
 155      */
 156     if (s->tlsext_status_type == -1 || PACKET_remaining(pkt) > 0) {
 157         *al = SSL_AD_UNSUPPORTED_EXTENSION;
 158         return 0;
 159     }
 160     /* Set flag to expect CertificateStatus message */
 161     s->tlsext_status_expected = 1;
 162
 163     return 1;
 164 }
 165
 166
 167 #ifndef OPENSSL_NO_CT
 168 int tls_parse_server_sct(SSL *s, PACKET *pkt, int *al)
 169 {
 170     /*
 171      * Only take it if we asked for it - i.e if there is no CT validation
 172      * callback set, then a custom extension MAY be processing it, so we
 173      * need to let control continue to flow to that.
 174      */
 175     if (s->ct_validation_callback != NULL) {
 176         size_t size = PACKET_remaining(pkt);
 177
 178         /* Simply copy it off for later processing */
 179         if (s->tlsext_scts != NULL) {
 180             OPENSSL_free(s->tlsext_scts);
 181             s->tlsext_scts = NULL;
 182         }
 183         s->tlsext_scts_len = size;
 184         if (size > 0) {
 185             s->tlsext_scts = OPENSSL_malloc(size);
 186             if (s->tlsext_scts == NULL
 187                     || !PACKET_copy_bytes(pkt, s->tlsext_scts, size)) {
 188                 *al = SSL_AD_INTERNAL_ERROR;
 189                 return 0;
 190             }
 191         }
 192     } else {
 193         if (custom_ext_parse(s, 0, TLSEXT_TYPE_signed_certificate_timestamp,
 194                              PACKET_data(pkt), PACKET_remaining(pkt), al) <= 0)
 195             return 0;
 196     }
 197
 198     return 1;
 199 }
 200 #endif
 201
 202
 203 #ifndef OPENSSL_NO_NEXTPROTONEG
 204 /*
 205  * ssl_next_proto_validate validates a Next Protocol Negotiation block. No
 206  * elements of zero length are allowed and the set of elements must exactly
 207  * fill the length of the block. Returns 1 on success or 0 on failure.
 208  */
 209 static int ssl_next_proto_validate(PACKET *pkt)
 210 {
 211     PACKET tmp_protocol;
 212
 213     while (PACKET_remaining(pkt)) {
 214         if (!PACKET_get_length_prefixed_1(pkt, &tmp_protocol)
 215             || PACKET_remaining(&tmp_protocol) == 0)
 216             return 0;
 217     }
 218
 219     return 1;
 220 }
 221
 222 int tls_parse_server_npn(SSL *s, PACKET *pkt, int *al)
 223 {
 224     unsigned char *selected;
 225     unsigned char selected_len;
 226     PACKET tmppkt;
 227
 228     if (s->s3->tmp.finish_md_len != 0)
 229         return 1;
 230
 231     /* We must have requested it. */
 232     if (s->ctx->next_proto_select_cb == NULL) {
 233         *al = SSL_AD_UNSUPPORTED_EXTENSION;
 234         return 0;
 235     }
 236     /* The data must be valid */
 237     tmppkt = *pkt;
 238     if (!ssl_next_proto_validate(&tmppkt)) {
 239         *al = SSL_AD_DECODE_ERROR;
 240         return 0;
 241     }
 242     if (s->ctx->next_proto_select_cb(s, &selected, &selected_len,
 243                                      PACKET_data(pkt),
 244                                      PACKET_remaining(pkt),
 245                                      s->ctx->next_proto_select_cb_arg) !=
 246              SSL_TLSEXT_ERR_OK) {
 247         *al = SSL_AD_INTERNAL_ERROR;
 248         return 0;
 249     }
 250     /*
 251      * Could be non-NULL if server has sent multiple NPN extensions in
 252      * a single Serverhello
 253      */
 254     OPENSSL_free(s->next_proto_negotiated);
 255     s->next_proto_negotiated = OPENSSL_malloc(selected_len);
 256     if (s->next_proto_negotiated == NULL) {
 257         *al = SSL_AD_INTERNAL_ERROR;
 258         return 0;
 259     }
 260
 261     memcpy(s->next_proto_negotiated, selected, selected_len);
 262     s->next_proto_negotiated_len = selected_len;
 263     s->s3->next_proto_neg_seen = 1;
 264
 265     return 1;
 266 }
 267 #endif
 268
 269 int tls_parse_server_alpn(SSL *s, PACKET *pkt, int *al)
 270 {
 271     size_t len;
 272
 273     /* We must have requested it. */
 274     if (!s->s3->alpn_sent) {
 275         *al = SSL_AD_UNSUPPORTED_EXTENSION;
 276         return 0;
 277     }
 278     /*-
 279      * The extension data consists of:
 280      *   uint16 list_length
 281      *   uint8 proto_length;
 282      *   uint8 proto[proto_length];
 283      */
 284     if (!PACKET_get_net_2_len(pkt, &len)
 285         || PACKET_remaining(pkt) != len || !PACKET_get_1_len(pkt, &len)
 286         || PACKET_remaining(pkt) != len) {
 287         *al = SSL_AD_DECODE_ERROR;
 288         return 0;
 289     }
 290     OPENSSL_free(s->s3->alpn_selected);
 291     s->s3->alpn_selected = OPENSSL_malloc(len);
 292     if (s->s3->alpn_selected == NULL) {
 293         *al = SSL_AD_INTERNAL_ERROR;
 294         return 0;
 295     }
 296     if (!PACKET_copy_bytes(pkt, s->s3->alpn_selected, len)) {
 297         *al = SSL_AD_DECODE_ERROR;
 298         return 0;
 299     }
 300     s->s3->alpn_selected_len = len;
 301
 302     return 1;
 303 }
 304
 305 #ifndef OPENSSL_NO_SRTP
 306 int tls_parse_server_use_srtp(SSL *s, PACKET *pkt, int *al)
 307 {
 308     unsigned int id, ct, mki;
 309     int i;
 310     STACK_OF(SRTP_PROTECTION_PROFILE) *clnt;
 311     SRTP_PROTECTION_PROFILE *prof;
 312
 313     if (!PACKET_get_net_2(pkt, &ct)
 314         || ct != 2 || !PACKET_get_net_2(pkt, &id)
 315         || !PACKET_get_1(pkt, &mki)
 316         || PACKET_remaining(pkt) != 0) {
 317         SSLerr(SSL_F_TLS_PARSE_SERVER_USE_SRTP,
 318                SSL_R_BAD_SRTP_PROTECTION_PROFILE_LIST);
 319         *al = SSL_AD_DECODE_ERROR;
 320         return 0;
 321     }
 322
 323     if (mki != 0) {
 324         /* Must be no MKI, since we never offer one */
 325         SSLerr(SSL_F_TLS_PARSE_SERVER_USE_SRTP, SSL_R_BAD_SRTP_MKI_VALUE);
 326         *al = SSL_AD_ILLEGAL_PARAMETER;
 327         return 0;
 328     }
 329
 330     clnt = SSL_get_srtp_profiles(s);
 331
 332     /* Throw an error if the server gave us an unsolicited extension */
 333     if (clnt == NULL) {
 334         SSLerr(SSL_F_TLS_PARSE_SERVER_USE_SRTP, SSL_R_NO_SRTP_PROFILES);
 335         *al = SSL_AD_DECODE_ERROR;
 336         return 0;
 337     }
 338
 339     /*
 340      * Check to see if the server gave us something we support (and
 341      * presumably offered)
 342      */
 343     for (i = 0; i < sk_SRTP_PROTECTION_PROFILE_num(clnt); i++) {
 344         prof = sk_SRTP_PROTECTION_PROFILE_value(clnt, i);
 345
 346         if (prof->id == id) {
 347             s->srtp_profile = prof;
 348             *al = 0;
 349             return 1;
 350         }
 351     }
 352
 353     SSLerr(SSL_F_TLS_PARSE_SERVER_USE_SRTP,
 354            SSL_R_BAD_SRTP_PROTECTION_PROFILE_LIST);
 355     *al = SSL_AD_DECODE_ERROR;
 356     return 0;
 357 }
 358 #endif
 359
 360 int tls_parse_server_etm(SSL *s, PACKET *pkt, int *al)
 361 {
 362     /* Ignore if inappropriate ciphersuite */
 363     if (!(s->options & SSL_OP_NO_ENCRYPT_THEN_MAC)
 364             && s->s3->tmp.new_cipher->algorithm_mac != SSL_AEAD
 365             && s->s3->tmp.new_cipher->algorithm_enc != SSL_RC4)
 366         s->s3->flags |= TLS1_FLAGS_ENCRYPT_THEN_MAC;
 367
 368     return 1;
 369 }
 370
 371 int tls_parse_server_ems(SSL *s, PACKET *pkt, int *al)
 372 {
 373     s->s3->flags |= TLS1_FLAGS_RECEIVED_EXTMS;
 374     if (!s->hit)
 375         s->session->flags |= SSL_SESS_FLAG_EXTMS;
 376
 377     return 1;
 378 }
 379
 380 int tls_parse_server_key_share(SSL *s, PACKET *pkt, int *al)
 381 {
 382     unsigned int group_id;
 383     PACKET encoded_pt;
 384     EVP_PKEY *ckey = s->s3->tmp.pkey, *skey = NULL;
 385
 386     /* Sanity check */
 387     if (ckey == NULL) {
 388         *al = SSL_AD_INTERNAL_ERROR;
 389         SSLerr(SSL_F_TLS_PARSE_SERVER_KEY_SHARE, ERR_R_INTERNAL_ERROR);
 390         return 0;
 391     }
 392
 393     if (!PACKET_get_net_2(pkt, &group_id)) {
 394         *al = SSL_AD_HANDSHAKE_FAILURE;
 395         SSLerr(SSL_F_TLS_PARSE_SERVER_KEY_SHARE, SSL_R_LENGTH_MISMATCH);
 396         return 0;
 397     }
 398
 399     if (group_id != s->s3->group_id) {
 400         /*
 401          * This isn't for the group that we sent in the original
 402          * key_share!
 403          */
 404         *al = SSL_AD_HANDSHAKE_FAILURE;
 405         SSLerr(SSL_F_TLS_PARSE_SERVER_KEY_SHARE, SSL_R_BAD_KEY_SHARE);
 406         return 0;
 407     }
 408
 409     if (!PACKET_as_length_prefixed_2(pkt, &encoded_pt)
 410             || PACKET_remaining(&encoded_pt) == 0) {
 411         *al = SSL_AD_DECODE_ERROR;
 412         SSLerr(SSL_F_TLS_PARSE_SERVER_KEY_SHARE, SSL_R_LENGTH_MISMATCH);
 413         return 0;
 414     }
 415
 416     skey = ssl_generate_pkey(ckey);
 417     if (skey == NULL) {
 418         *al = SSL_AD_INTERNAL_ERROR;
 419         SSLerr(SSL_F_TLS_PARSE_SERVER_KEY_SHARE, ERR_R_MALLOC_FAILURE);
 420         return 0;
 421     }
 422     if (!EVP_PKEY_set1_tls_encodedpoint(skey, PACKET_data(&encoded_pt),
 423                                         PACKET_remaining(&encoded_pt))) {
 424         *al = SSL_AD_DECODE_ERROR;
 425         SSLerr(SSL_F_TLS_PARSE_SERVER_KEY_SHARE, SSL_R_BAD_ECPOINT);
 426         return 0;
 427     }
 428
 429     if (ssl_derive(s, ckey, skey, 1) == 0) {
 430         *al = SSL_AD_INTERNAL_ERROR;
 431         SSLerr(SSL_F_TLS_PARSE_SERVER_KEY_SHARE, ERR_R_INTERNAL_ERROR);
 432         EVP_PKEY_free(skey);
 433         return 0;
 434     }
 435     EVP_PKEY_free(skey);
 436
 437     return 1;
 438 }
 439
 440 static int ssl_scan_serverhello_tlsext(SSL *s, PACKET *pkt, int *al)
 441 {
 442     size_t num_extensions = 0;
 443     RAW_EXTENSION *extensions = NULL;
 444     PACKET extpkt;
 445
 446 #ifndef OPENSSL_NO_NEXTPROTONEG
 447     s->s3->next_proto_neg_seen = 0;
 448 #endif
 449     s->tlsext_ticket_expected = 0;
 450
 451     OPENSSL_free(s->s3->alpn_selected);
 452     s->s3->alpn_selected = NULL;
 453
 454     s->s3->flags &= ~TLS1_FLAGS_ENCRYPT_THEN_MAC;
 455
 456     s->s3->flags &= ~TLS1_FLAGS_RECEIVED_EXTMS;
 457
 458     if (!PACKET_as_length_prefixed_2(pkt, &extpkt)) {
 459         /* Extensions block may be completely absent in SSLv3 */
 460         if (s->version != SSL3_VERSION || PACKET_remaining(pkt) != 0) {
 461             *al = SSL_AD_DECODE_ERROR;
 462             SSLerr(SSL_F_SSL_SCAN_SERVERHELLO_TLSEXT, SSL_R_BAD_LENGTH);
 463             return 0;
 464         }
 465         PACKET_null_init(&extpkt);
 466     }
 467
 468     /*
 469      * TODO(TLS1.3): We give multiple contexts for now until we're ready to
 470      * give something more specific
 471      */
 472
 473     if (!tls_collect_extensions(s, &extpkt, EXT_TLS1_2_SERVER_HELLO
 474                                             | EXT_TLS1_3_SERVER_HELLO
 475                                             | EXT_TLS1_3_ENCRYPTED_EXTENSIONS
 476                                             | EXT_TLS1_3_CERTIFICATE,
 477                                 &extensions, &num_extensions, al))
 478         return 0;
 479
 480     /*
 481      * Determine if we need to see RI. Strictly speaking if we want to avoid
 482      * an attack we should *always* see RI even on initial server hello
 483      * because the client doesn't see any renegotiation during an attack.
 484      * However this would mean we could not connect to any server which
 485      * doesn't support RI so for the immediate future tolerate RI absence
 486      */
 487     if (!(s->options & SSL_OP_LEGACY_SERVER_CONNECT)
 488             && !(s->options & SSL_OP_ALLOW_UNSAFE_LEGACY_RENEGOTIATION)
 489             && tls_get_extension_by_type(extensions, num_extensions,
 490                                          TLSEXT_TYPE_renegotiate) == NULL) {
 491         *al = SSL_AD_HANDSHAKE_FAILURE;
 492         SSLerr(SSL_F_SSL_SCAN_SERVERHELLO_TLSEXT,
 493                SSL_R_UNSAFE_LEGACY_RENEGOTIATION_DISABLED);
 494         return 0;
 495     }
 496
 497     if (!tls_parse_all_extensions(s, EXT_TLS1_2_SERVER_HELLO
 498                                      | EXT_TLS1_3_SERVER_HELLO
 499                                      | EXT_TLS1_3_ENCRYPTED_EXTENSIONS
 500                                      | EXT_TLS1_3_CERTIFICATE,
 501                                   extensions, num_extensions, al))
 502         return 0;
 503
 504     if (s->hit) {
 505         /*
 506          * Check extended master secret extension is consistent with
 507          * original session.
 508          */
 509         if (!(s->s3->flags & TLS1_FLAGS_RECEIVED_EXTMS) !=
 510             !(s->session->flags & SSL_SESS_FLAG_EXTMS)) {
 511             *al = SSL_AD_HANDSHAKE_FAILURE;
 512             SSLerr(SSL_F_SSL_SCAN_SERVERHELLO_TLSEXT, SSL_R_INCONSISTENT_EXTMS);
 513             return 0;
 514         }
 515     }
 516
 517     return 1;
 518 }
 519
 520 static int ssl_check_serverhello_tlsext(SSL *s)
 521 {
 522     int ret = SSL_TLSEXT_ERR_NOACK;
 523     int al = SSL_AD_UNRECOGNIZED_NAME;
 524
 525 #ifndef OPENSSL_NO_EC
 526     /*
 527      * If we are client and using an elliptic curve cryptography cipher
 528      * suite, then if server returns an EC point formats lists extension it
 529      * must contain uncompressed.
 530      */
 531     unsigned long alg_k = s->s3->tmp.new_cipher->algorithm_mkey;
 532     unsigned long alg_a = s->s3->tmp.new_cipher->algorithm_auth;
 533     if ((s->tlsext_ecpointformatlist != NULL)
 534         && (s->tlsext_ecpointformatlist_length > 0)
 535         && (s->session->tlsext_ecpointformatlist != NULL)
 536         && (s->session->tlsext_ecpointformatlist_length > 0)
 537         && ((alg_k & SSL_kECDHE) || (alg_a & SSL_aECDSA))) {
 538         /* we are using an ECC cipher */
 539         size_t i;
 540         unsigned char *list;
 541         int found_uncompressed = 0;
 542         list = s->session->tlsext_ecpointformatlist;
 543         for (i = 0; i < s->session->tlsext_ecpointformatlist_length; i++) {
 544             if (*(list++) == TLSEXT_ECPOINTFORMAT_uncompressed) {
 545                 found_uncompressed = 1;
 546                 break;
 547             }
 548         }
 549         if (!found_uncompressed) {
 550             SSLerr(SSL_F_SSL_CHECK_SERVERHELLO_TLSEXT,
 551                    SSL_R_TLS_INVALID_ECPOINTFORMAT_LIST);
 552             return -1;
 553         }
 554     }
 555     ret = SSL_TLSEXT_ERR_OK;
 556 #endif                          /* OPENSSL_NO_EC */
 557
 558     if (s->ctx != NULL && s->ctx->tlsext_servername_callback != 0)
 559         ret =
 560             s->ctx->tlsext_servername_callback(s, &al,
 561                                                s->ctx->tlsext_servername_arg);
 562     else if (s->initial_ctx != NULL
 563              && s->initial_ctx->tlsext_servername_callback != 0)
 564         ret =
 565             s->initial_ctx->tlsext_servername_callback(s, &al,
 566                                                        s->
 567                                                        initial_ctx->tlsext_servername_arg);
 568
 569     /*
 570      * Ensure we get sensible values passed to tlsext_status_cb in the event
 571      * that we don't receive a status message
 572      */
 573     OPENSSL_free(s->tlsext_ocsp_resp);
 574     s->tlsext_ocsp_resp = NULL;
 575     s->tlsext_ocsp_resplen = 0;
 576
 577     switch (ret) {
 578     case SSL_TLSEXT_ERR_ALERT_FATAL:
 579         ssl3_send_alert(s, SSL3_AL_FATAL, al);
 580         return -1;
 581
 582     case SSL_TLSEXT_ERR_ALERT_WARNING:
 583         ssl3_send_alert(s, SSL3_AL_WARNING, al);
 584         return 1;
 585
 586     case SSL_TLSEXT_ERR_NOACK:
 587         s->servername_done = 0;
 588     default:
 589         return 1;
 590     }
 591 }
 592
 593 int ssl_parse_serverhello_tlsext(SSL *s, PACKET *pkt)
 594 {
 595     int al = -1;
 596     if (s->version < SSL3_VERSION)
 597         return 1;
 598     if (ssl_scan_serverhello_tlsext(s, pkt, &al) <= 0) {
 599         ssl3_send_alert(s, SSL3_AL_FATAL, al);
 600         return 0;
 601     }
 602
 603     if (ssl_check_serverhello_tlsext(s) <= 0) {
 604         SSLerr(SSL_F_SSL_PARSE_SERVERHELLO_TLSEXT, SSL_R_SERVERHELLO_TLSEXT);
 605         return 0;
 606     }
 607     return 1;
 608 }