ssl/t1_lib.c

   1 /* ssl/t1_lib.c */
   2 /* Copyright (C) 1995-1998 Eric Young (eay@cryptsoft.com)
   3  * All rights reserved.
   4  *
   5  * This package is an SSL implementation written
   6  * by Eric Young (eay@cryptsoft.com).
   7  * The implementation was written so as to conform with Netscapes SSL.
   8  *
   9  * This library is free for commercial and non-commercial use as long as
  10  * the following conditions are aheared to.  The following conditions
  11  * apply to all code found in this distribution, be it the RC4, RSA,
  12  * lhash, DES, etc., code; not just the SSL code.  The SSL documentation
  13  * included with this distribution is covered by the same copyright terms
  14  * except that the holder is Tim Hudson (tjh@cryptsoft.com).
  15  *
  16  * Copyright remains Eric Young's, and as such any Copyright notices in
  17  * the code are not to be removed.
  18  * If this package is used in a product, Eric Young should be given attribution
  19  * as the author of the parts of the library used.
  20  * This can be in the form of a textual message at program startup or
  21  * in documentation (online or textual) provided with the package.
  22  *
  23  * Redistribution and use in source and binary forms, with or without
  24  * modification, are permitted provided that the following conditions
  25  * are met:
  26  * 1. Redistributions of source code must retain the copyright
  27  *    notice, this list of conditions and the following disclaimer.
  28  * 2. Redistributions in binary form must reproduce the above copyright
  29  *    notice, this list of conditions and the following disclaimer in the
  30  *    documentation and/or other materials provided with the distribution.
  31  * 3. All advertising materials mentioning features or use of this software
  32  *    must display the following acknowledgement:
  33  *    "This product includes cryptographic software written by
  34  *     Eric Young (eay@cryptsoft.com)"
  35  *    The word 'cryptographic' can be left out if the rouines from the library
  36  *    being used are not cryptographic related :-).
  37  * 4. If you include any Windows specific code (or a derivative thereof) from
  38  *    the apps directory (application code) you must include an acknowledgement:
  39  *    "This product includes software written by Tim Hudson (tjh@cryptsoft.com)"
  40  *
  41  * THIS SOFTWARE IS PROVIDED BY ERIC YOUNG ``AS IS'' AND
  42  * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
  43  * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
  44  * ARE DISCLAIMED.  IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE
  45  * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
  46  * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
  47  * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
  48  * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
  49  * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
  50  * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
  51  * SUCH DAMAGE.
  52  *
  53  * The licence and distribution terms for any publically available version or
  54  * derivative of this code cannot be changed.  i.e. this code cannot simply be
  55  * copied and put under another distribution licence
  56  * [including the GNU Public Licence.]
  57  */
  58 /* ====================================================================
  59  * Copyright (c) 1998-2007 The OpenSSL Project.  All rights reserved.
  60  *
  61  * Redistribution and use in source and binary forms, with or without
  62  * modification, are permitted provided that the following conditions
  63  * are met:
  64  *
  65  * 1. Redistributions of source code must retain the above copyright
  66  *    notice, this list of conditions and the following disclaimer.
  67  *
  68  * 2. Redistributions in binary form must reproduce the above copyright
  69  *    notice, this list of conditions and the following disclaimer in
  70  *    the documentation and/or other materials provided with the
  71  *    distribution.
  72  *
  73  * 3. All advertising materials mentioning features or use of this
  74  *    software must display the following acknowledgment:
  75  *    "This product includes software developed by the OpenSSL Project
  76  *    for use in the OpenSSL Toolkit. (http://www.openssl.org/)"
  77  *
  78  * 4. The names "OpenSSL Toolkit" and "OpenSSL Project" must not be used to
  79  *    endorse or promote products derived from this software without
  80  *    prior written permission. For written permission, please contact
  81  *    openssl-core@openssl.org.
  82  *
  83  * 5. Products derived from this software may not be called "OpenSSL"
  84  *    nor may "OpenSSL" appear in their names without prior written
  85  *    permission of the OpenSSL Project.
  86  *
  87  * 6. Redistributions of any form whatsoever must retain the following
  88  *    acknowledgment:
  89  *    "This product includes software developed by the OpenSSL Project
  90  *    for use in the OpenSSL Toolkit (http://www.openssl.org/)"
  91  *
  92  * THIS SOFTWARE IS PROVIDED BY THE OpenSSL PROJECT ``AS IS'' AND ANY
  93  * EXPRESSED OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
  94  * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
  95  * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL THE OpenSSL PROJECT OR
  96  * ITS CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
  97  * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
  98  * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
  99  * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
 100  * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT,
 101  * STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
 102  * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED
 103  * OF THE POSSIBILITY OF SUCH DAMAGE.
 104  * ====================================================================
 105  *
 106  * This product includes cryptographic software written by Eric Young
 107  * (eay@cryptsoft.com).  This product includes software written by Tim
 108  * Hudson (tjh@cryptsoft.com).
 109  *
 110  */
 111
 112 #include <stdio.h>
 113 #include <openssl/objects.h>
 114 #include <openssl/evp.h>
 115 #include <openssl/hmac.h>
 116 #include <openssl/ocsp.h>
 117 #include <openssl/rand.h>
 118 #include "ssl_locl.h"
 119
 120 const char tls1_version_str[]="TLSv1" OPENSSL_VERSION_PTEXT;
 121
 122 #ifndef OPENSSL_NO_TLSEXT
 123 static int tls_decrypt_ticket(SSL *s, const unsigned char *tick, int ticklen,
 124                                 const unsigned char *sess_id, int sesslen,
 125                                 SSL_SESSION **psess);
 126 #endif
 127
 128 SSL3_ENC_METHOD TLSv1_enc_data={
 129         tls1_enc,
 130         tls1_mac,
 131         tls1_setup_key_block,
 132         tls1_generate_master_secret,
 133         tls1_change_cipher_state,
 134         tls1_final_finish_mac,
 135         TLS1_FINISH_MAC_LENGTH,
 136         tls1_cert_verify_mac,
 137         TLS_MD_CLIENT_FINISH_CONST,TLS_MD_CLIENT_FINISH_CONST_SIZE,
 138         TLS_MD_SERVER_FINISH_CONST,TLS_MD_SERVER_FINISH_CONST_SIZE,
 139         tls1_alert_code,
 140         tls1_export_keying_material,
 141         };
 142
 143 long tls1_default_timeout(void)
 144         {
 145         /* 2 hours, the 24 hours mentioned in the TLSv1 spec
 146          * is way too long for http, the cache would over fill */
 147         return(60*60*2);
 148         }
 149
 150 int tls1_new(SSL *s)
 151         {
 152         if (!ssl3_new(s)) return(0);
 153         s->method->ssl_clear(s);
 154         return(1);
 155         }
 156
 157 void tls1_free(SSL *s)
 158         {
 159 #ifndef OPENSSL_NO_TLSEXT
 160         if (s->tlsext_session_ticket)
 161                 {
 162                 OPENSSL_free(s->tlsext_session_ticket);
 163                 }
 164 #endif /* OPENSSL_NO_TLSEXT */
 165         ssl3_free(s);
 166         }
 167
 168 void tls1_clear(SSL *s)
 169         {
 170         ssl3_clear(s);
 171         s->version = s->method->version;
 172         }
 173
 174 #ifndef OPENSSL_NO_EC
 175
 176 static int nid_list[] =
 177         {
 178                 NID_sect163k1, /* sect163k1 (1) */
 179                 NID_sect163r1, /* sect163r1 (2) */
 180                 NID_sect163r2, /* sect163r2 (3) */
 181                 NID_sect193r1, /* sect193r1 (4) */
 182                 NID_sect193r2, /* sect193r2 (5) */
 183                 NID_sect233k1, /* sect233k1 (6) */
 184                 NID_sect233r1, /* sect233r1 (7) */
 185                 NID_sect239k1, /* sect239k1 (8) */
 186                 NID_sect283k1, /* sect283k1 (9) */
 187                 NID_sect283r1, /* sect283r1 (10) */
 188                 NID_sect409k1, /* sect409k1 (11) */
 189                 NID_sect409r1, /* sect409r1 (12) */
 190                 NID_sect571k1, /* sect571k1 (13) */
 191                 NID_sect571r1, /* sect571r1 (14) */
 192                 NID_secp160k1, /* secp160k1 (15) */
 193                 NID_secp160r1, /* secp160r1 (16) */
 194                 NID_secp160r2, /* secp160r2 (17) */
 195                 NID_secp192k1, /* secp192k1 (18) */
 196                 NID_X9_62_prime192v1, /* secp192r1 (19) */
 197                 NID_secp224k1, /* secp224k1 (20) */
 198                 NID_secp224r1, /* secp224r1 (21) */
 199                 NID_secp256k1, /* secp256k1 (22) */
 200                 NID_X9_62_prime256v1, /* secp256r1 (23) */
 201                 NID_secp384r1, /* secp384r1 (24) */
 202                 NID_secp521r1  /* secp521r1 (25) */
 203         };
 204
 205 static int pref_list[] =
 206         {
 207 #ifndef OPENSSL_NO_EC2M
 208                 NID_sect571r1, /* sect571r1 (14) */
 209                 NID_sect571k1, /* sect571k1 (13) */
 210 #endif
 211                 NID_secp521r1, /* secp521r1 (25) */
 212 #ifndef OPENSSL_NO_EC2M
 213                 NID_sect409k1, /* sect409k1 (11) */
 214                 NID_sect409r1, /* sect409r1 (12) */
 215 #endif
 216                 NID_secp384r1, /* secp384r1 (24) */
 217 #ifndef OPENSSL_NO_EC2M
 218                 NID_sect283k1, /* sect283k1 (9) */
 219                 NID_sect283r1, /* sect283r1 (10) */
 220 #endif
 221                 NID_secp256k1, /* secp256k1 (22) */
 222                 NID_X9_62_prime256v1, /* secp256r1 (23) */
 223 #ifndef OPENSSL_NO_EC2M
 224                 NID_sect239k1, /* sect239k1 (8) */
 225                 NID_sect233k1, /* sect233k1 (6) */
 226                 NID_sect233r1, /* sect233r1 (7) */
 227 #endif
 228                 NID_secp224k1, /* secp224k1 (20) */
 229                 NID_secp224r1, /* secp224r1 (21) */
 230 #ifndef OPENSSL_NO_EC2M
 231                 NID_sect193r1, /* sect193r1 (4) */
 232                 NID_sect193r2, /* sect193r2 (5) */
 233 #endif
 234                 NID_secp192k1, /* secp192k1 (18) */
 235                 NID_X9_62_prime192v1, /* secp192r1 (19) */
 236 #ifndef OPENSSL_NO_EC2M
 237                 NID_sect163k1, /* sect163k1 (1) */
 238                 NID_sect163r1, /* sect163r1 (2) */
 239                 NID_sect163r2, /* sect163r2 (3) */
 240 #endif
 241                 NID_secp160k1, /* secp160k1 (15) */
 242                 NID_secp160r1, /* secp160r1 (16) */
 243                 NID_secp160r2, /* secp160r2 (17) */
 244         };
 245
 246 int tls1_ec_curve_id2nid(int curve_id)
 247         {
 248         /* ECC curves from RFC 4492 */
 249         if ((curve_id < 1) || ((unsigned int)curve_id >
 250                                 sizeof(nid_list)/sizeof(nid_list[0])))
 251                 return 0;
 252         return nid_list[curve_id-1];
 253         }
 254
 255 int tls1_ec_nid2curve_id(int nid)
 256         {
 257         /* ECC curves from RFC 4492 */
 258         switch (nid)
 259                 {
 260         case NID_sect163k1: /* sect163k1 (1) */
 261                 return 1;
 262         case NID_sect163r1: /* sect163r1 (2) */
 263                 return 2;
 264         case NID_sect163r2: /* sect163r2 (3) */
 265                 return 3;
 266         case NID_sect193r1: /* sect193r1 (4) */
 267                 return 4;
 268         case NID_sect193r2: /* sect193r2 (5) */
 269                 return 5;
 270         case NID_sect233k1: /* sect233k1 (6) */
 271                 return 6;
 272         case NID_sect233r1: /* sect233r1 (7) */
 273                 return 7;
 274         case NID_sect239k1: /* sect239k1 (8) */
 275                 return 8;
 276         case NID_sect283k1: /* sect283k1 (9) */
 277                 return 9;
 278         case NID_sect283r1: /* sect283r1 (10) */
 279                 return 10;
 280         case NID_sect409k1: /* sect409k1 (11) */
 281                 return 11;
 282         case NID_sect409r1: /* sect409r1 (12) */
 283                 return 12;
 284         case NID_sect571k1: /* sect571k1 (13) */
 285                 return 13;
 286         case NID_sect571r1: /* sect571r1 (14) */
 287                 return 14;
 288         case NID_secp160k1: /* secp160k1 (15) */
 289                 return 15;
 290         case NID_secp160r1: /* secp160r1 (16) */
 291                 return 16;
 292         case NID_secp160r2: /* secp160r2 (17) */
 293                 return 17;
 294         case NID_secp192k1: /* secp192k1 (18) */
 295                 return 18;
 296         case NID_X9_62_prime192v1: /* secp192r1 (19) */
 297                 return 19;
 298         case NID_secp224k1: /* secp224k1 (20) */
 299                 return 20;
 300         case NID_secp224r1: /* secp224r1 (21) */
 301                 return 21;
 302         case NID_secp256k1: /* secp256k1 (22) */
 303                 return 22;
 304         case NID_X9_62_prime256v1: /* secp256r1 (23) */
 305                 return 23;
 306         case NID_secp384r1: /* secp384r1 (24) */
 307                 return 24;
 308         case NID_secp521r1:  /* secp521r1 (25) */
 309                 return 25;
 310         default:
 311                 return 0;
 312                 }
 313         }
 314 #endif /* OPENSSL_NO_EC */
 315
 316 #ifndef OPENSSL_NO_TLSEXT
 317
 318 /* List of supported signature algorithms and hashes. Should make this
 319  * customisable at some point, for now include everything we support.
 320  */
 321
 322 #ifdef OPENSSL_NO_RSA
 323 #define tlsext_sigalg_rsa(md) /* */
 324 #else
 325 #define tlsext_sigalg_rsa(md) md, TLSEXT_signature_rsa,
 326 #endif
 327
 328 #ifdef OPENSSL_NO_DSA
 329 #define tlsext_sigalg_dsa(md) /* */
 330 #else
 331 #define tlsext_sigalg_dsa(md) md, TLSEXT_signature_dsa,
 332 #endif
 333
 334 #ifdef OPENSSL_NO_ECDSA
 335 #define tlsext_sigalg_ecdsa(md) /* */
 336 #else
 337 #define tlsext_sigalg_ecdsa(md) md, TLSEXT_signature_ecdsa,
 338 #endif
 339
 340 #define tlsext_sigalg(md) \
 341                 tlsext_sigalg_rsa(md) \
 342                 tlsext_sigalg_dsa(md) \
 343                 tlsext_sigalg_ecdsa(md)
 344
 345 static unsigned char tls12_sigalgs[] = {
 346 #ifndef OPENSSL_NO_SHA512
 347         tlsext_sigalg(TLSEXT_hash_sha512)
 348         tlsext_sigalg(TLSEXT_hash_sha384)
 349 #endif
 350 #ifndef OPENSSL_NO_SHA256
 351         tlsext_sigalg(TLSEXT_hash_sha256)
 352         tlsext_sigalg(TLSEXT_hash_sha224)
 353 #endif
 354 #ifndef OPENSSL_NO_SHA
 355         tlsext_sigalg(TLSEXT_hash_sha1)
 356 #endif
 357 };
 358
 359 int tls12_get_req_sig_algs(SSL *s, unsigned char *p)
 360         {
 361         size_t slen = sizeof(tls12_sigalgs);
 362         if (p)
 363                 memcpy(p, tls12_sigalgs, slen);
 364         return (int)slen;
 365         }
 366
 367 unsigned char *ssl_add_clienthello_tlsext(SSL *s, unsigned char *buf, unsigned char *limit)
 368         {
 369         int extdatalen=0;
 370         unsigned char *orig = buf;
 371         unsigned char *ret = buf;
 372
 373         /* don't add extensions for SSLv3 unless doing secure renegotiation */
 374         if (s->client_version == SSL3_VERSION
 375                                         && !s->s3->send_connection_binding)
 376                 return orig;
 377
 378         ret+=2;
 379
 380         if (ret>=limit) return NULL; /* this really never occurs, but ... */
 381
 382         if (s->tlsext_hostname != NULL)
 383                 {
 384                 /* Add TLS extension servername to the Client Hello message */
 385                 unsigned long size_str;
 386                 long lenmax;
 387
 388                 /*-
 389                  * check for enough space.
 390                  * 4 for the servername type and entension length
 391                  * 2 for servernamelist length
 392                  * 1 for the hostname type
 393                  * 2 for hostname length
 394                  * + hostname length
 395                  */
 396
 397                 if ((lenmax = limit - ret - 9) < 0
 398                     || (size_str = strlen(s->tlsext_hostname)) > (unsigned long)lenmax)
 399                         return NULL;
 400
 401                 /* extension type and length */
 402                 s2n(TLSEXT_TYPE_server_name,ret);
 403                 s2n(size_str+5,ret);
 404
 405                 /* length of servername list */
 406                 s2n(size_str+3,ret);
 407
 408                 /* hostname type, length and hostname */
 409                 *(ret++) = (unsigned char) TLSEXT_NAMETYPE_host_name;
 410                 s2n(size_str,ret);
 411                 memcpy(ret, s->tlsext_hostname, size_str);
 412                 ret+=size_str;
 413                 }
 414
 415         /* Add RI if renegotiating */
 416         if (s->renegotiate)
 417           {
 418           int el;
 419
 420           if(!ssl_add_clienthello_renegotiate_ext(s, 0, &el, 0))
 421               {
 422               SSLerr(SSL_F_SSL_ADD_CLIENTHELLO_TLSEXT, ERR_R_INTERNAL_ERROR);
 423               return NULL;
 424               }
 425
 426           if((limit - ret - 4 - el) < 0) return NULL;
 427
 428           s2n(TLSEXT_TYPE_renegotiate,ret);
 429           s2n(el,ret);
 430
 431           if(!ssl_add_clienthello_renegotiate_ext(s, ret, &el, el))
 432               {
 433               SSLerr(SSL_F_SSL_ADD_CLIENTHELLO_TLSEXT, ERR_R_INTERNAL_ERROR);
 434               return NULL;
 435               }
 436
 437           ret += el;
 438         }
 439
 440 #ifndef OPENSSL_NO_SRP
 441         /* Add SRP username if there is one */
 442         if (s->srp_ctx.login != NULL)
 443                 { /* Add TLS extension SRP username to the Client Hello message */
 444
 445                 int login_len = strlen(s->srp_ctx.login);
 446                 if (login_len > 255 || login_len == 0)
 447                         {
 448                         SSLerr(SSL_F_SSL_ADD_CLIENTHELLO_TLSEXT, ERR_R_INTERNAL_ERROR);
 449                         return NULL;
 450                         }
 451
 452                 /*-
 453                  * check for enough space.
 454                  * 4 for the srp type type and entension length
 455                  * 1 for the srp user identity
 456                  * + srp user identity length
 457                  */
 458                 if ((limit - ret - 5 - login_len) < 0) return NULL;
 459
 460                 /* fill in the extension */
 461                 s2n(TLSEXT_TYPE_srp,ret);
 462                 s2n(login_len+1,ret);
 463                 (*ret++) = (unsigned char) login_len;
 464                 memcpy(ret, s->srp_ctx.login, login_len);
 465                 ret+=login_len;
 466                 }
 467 #endif
 468
 469 #ifndef OPENSSL_NO_EC
 470         if (s->tlsext_ecpointformatlist != NULL)
 471                 {
 472                 /* Add TLS extension ECPointFormats to the ClientHello message */
 473                 long lenmax;
 474
 475                 if ((lenmax = limit - ret - 5) < 0) return NULL;
 476                 if (s->tlsext_ecpointformatlist_length > (unsigned long)lenmax) return NULL;
 477                 if (s->tlsext_ecpointformatlist_length > 255)
 478                         {
 479                         SSLerr(SSL_F_SSL_ADD_CLIENTHELLO_TLSEXT, ERR_R_INTERNAL_ERROR);
 480                         return NULL;
 481                         }
 482
 483                 s2n(TLSEXT_TYPE_ec_point_formats,ret);
 484                 s2n(s->tlsext_ecpointformatlist_length + 1,ret);
 485                 *(ret++) = (unsigned char) s->tlsext_ecpointformatlist_length;
 486                 memcpy(ret, s->tlsext_ecpointformatlist, s->tlsext_ecpointformatlist_length);
 487                 ret+=s->tlsext_ecpointformatlist_length;
 488                 }
 489         if (s->tlsext_ellipticcurvelist != NULL)
 490                 {
 491                 /* Add TLS extension EllipticCurves to the ClientHello message */
 492                 long lenmax;
 493
 494                 if ((lenmax = limit - ret - 6) < 0) return NULL;
 495                 if (s->tlsext_ellipticcurvelist_length > (unsigned long)lenmax) return NULL;
 496                 if (s->tlsext_ellipticcurvelist_length > 65532)
 497                         {
 498                         SSLerr(SSL_F_SSL_ADD_CLIENTHELLO_TLSEXT, ERR_R_INTERNAL_ERROR);
 499                         return NULL;
 500                         }
 501
 502                 s2n(TLSEXT_TYPE_elliptic_curves,ret);
 503                 s2n(s->tlsext_ellipticcurvelist_length + 2, ret);
 504
 505                 s2n(s->tlsext_ellipticcurvelist_length, ret);
 506                 memcpy(ret, s->tlsext_ellipticcurvelist, s->tlsext_ellipticcurvelist_length);
 507                 ret+=s->tlsext_ellipticcurvelist_length;
 508                 }
 509 #endif /* OPENSSL_NO_EC */
 510
 511         if (!(SSL_get_options(s) & SSL_OP_NO_TICKET))
 512                 {
 513                 int ticklen;
 514                 if (!s->new_session && s->session && s->session->tlsext_tick)
 515                         ticklen = s->session->tlsext_ticklen;
 516                 else if (s->session && s->tlsext_session_ticket &&
 517                          s->tlsext_session_ticket->data)
 518                         {
 519                         ticklen = s->tlsext_session_ticket->length;
 520                         s->session->tlsext_tick = OPENSSL_malloc(ticklen);
 521                         if (!s->session->tlsext_tick)
 522                                 return NULL;
 523                         memcpy(s->session->tlsext_tick,
 524                                s->tlsext_session_ticket->data,
 525                                ticklen);
 526                         s->session->tlsext_ticklen = ticklen;
 527                         }
 528                 else
 529                         ticklen = 0;
 530                 if (ticklen == 0 && s->tlsext_session_ticket &&
 531                     s->tlsext_session_ticket->data == NULL)
 532                         goto skip_ext;
 533                 /* Check for enough room 2 for extension type, 2 for len
 534                  * rest for ticket
 535                  */
 536                 if ((long)(limit - ret - 4 - ticklen) < 0) return NULL;
 537                 s2n(TLSEXT_TYPE_session_ticket,ret);
 538                 s2n(ticklen,ret);
 539                 if (ticklen)
 540                         {
 541                         memcpy(ret, s->session->tlsext_tick, ticklen);
 542                         ret += ticklen;
 543                         }
 544                 }
 545                 skip_ext:
 546
 547         if (TLS1_get_client_version(s) >= TLS1_2_VERSION)
 548                 {
 549                 if ((size_t)(limit - ret) < sizeof(tls12_sigalgs) + 6)
 550                         return NULL;
 551                 s2n(TLSEXT_TYPE_signature_algorithms,ret);
 552                 s2n(sizeof(tls12_sigalgs) + 2, ret);
 553                 s2n(sizeof(tls12_sigalgs), ret);
 554                 memcpy(ret, tls12_sigalgs, sizeof(tls12_sigalgs));
 555                 ret += sizeof(tls12_sigalgs);
 556                 }
 557
 558 #ifdef TLSEXT_TYPE_opaque_prf_input
 559         if (s->s3->client_opaque_prf_input != NULL &&
 560             s->version != DTLS1_VERSION)
 561                 {
 562                 size_t col = s->s3->client_opaque_prf_input_len;
 563
 564                 if ((long)(limit - ret - 6 - col < 0))
 565                         return NULL;
 566                 if (col > 0xFFFD) /* can't happen */
 567                         return NULL;
 568
 569                 s2n(TLSEXT_TYPE_opaque_prf_input, ret);
 570                 s2n(col + 2, ret);
 571                 s2n(col, ret);
 572                 memcpy(ret, s->s3->client_opaque_prf_input, col);
 573                 ret += col;
 574                 }
 575 #endif
 576
 577         if (s->tlsext_status_type == TLSEXT_STATUSTYPE_ocsp &&
 578             s->version != DTLS1_VERSION)
 579                 {
 580                 int i;
 581                 long extlen, idlen, itmp;
 582                 OCSP_RESPID *id;
 583
 584                 idlen = 0;
 585                 for (i = 0; i < sk_OCSP_RESPID_num(s->tlsext_ocsp_ids); i++)
 586                         {
 587                         id = sk_OCSP_RESPID_value(s->tlsext_ocsp_ids, i);
 588                         itmp = i2d_OCSP_RESPID(id, NULL);
 589                         if (itmp <= 0)
 590                                 return NULL;
 591                         idlen += itmp + 2;
 592                         }
 593
 594                 if (s->tlsext_ocsp_exts)
 595                         {
 596                         extlen = i2d_X509_EXTENSIONS(s->tlsext_ocsp_exts, NULL);
 597                         if (extlen < 0)
 598                                 return NULL;
 599                         }
 600                 else
 601                         extlen = 0;
 602
 603                 if ((long)(limit - ret - 7 - extlen - idlen) < 0) return NULL;
 604                 s2n(TLSEXT_TYPE_status_request, ret);
 605                 if (extlen + idlen > 0xFFF0)
 606                         return NULL;
 607                 s2n(extlen + idlen + 5, ret);
 608                 *(ret++) = TLSEXT_STATUSTYPE_ocsp;
 609                 s2n(idlen, ret);
 610                 for (i = 0; i < sk_OCSP_RESPID_num(s->tlsext_ocsp_ids); i++)
 611                         {
 612                         /* save position of id len */
 613                         unsigned char *q = ret;
 614                         id = sk_OCSP_RESPID_value(s->tlsext_ocsp_ids, i);
 615                         /* skip over id len */
 616                         ret += 2;
 617                         itmp = i2d_OCSP_RESPID(id, &ret);
 618                         /* write id len */
 619                         s2n(itmp, q);
 620                         }
 621                 s2n(extlen, ret);
 622                 if (extlen > 0)
 623                         i2d_X509_EXTENSIONS(s->tlsext_ocsp_exts, &ret);
 624                 }
 625
 626 #ifndef OPENSSL_NO_HEARTBEATS
 627         /* Add Heartbeat extension */
 628         if ((limit - ret - 4 - 1) < 0)
 629                 return NULL;
 630         s2n(TLSEXT_TYPE_heartbeat,ret);
 631         s2n(1,ret);
 632         /*-
 633          * Set mode:
 634          * 1: peer may send requests
 635          * 2: peer not allowed to send requests
 636          */
 637         if (s->tlsext_heartbeat & SSL_TLSEXT_HB_DONT_RECV_REQUESTS)
 638                 *(ret++) = SSL_TLSEXT_HB_DONT_SEND_REQUESTS;
 639         else
 640                 *(ret++) = SSL_TLSEXT_HB_ENABLED;
 641 #endif
 642
 643 #ifndef OPENSSL_NO_NEXTPROTONEG
 644         if (s->ctx->next_proto_select_cb && !s->s3->tmp.finish_md_len)
 645                 {
 646                 /* The client advertises an emtpy extension to indicate its
 647                  * support for Next Protocol Negotiation */
 648                 if (limit - ret - 4 < 0)
 649                         return NULL;
 650                 s2n(TLSEXT_TYPE_next_proto_neg,ret);
 651                 s2n(0,ret);
 652                 }
 653 #endif
 654
 655 #ifndef OPENSSL_NO_SRTP
 656         if(SSL_IS_DTLS(s) && SSL_get_srtp_profiles(s))
 657                 {
 658                 int el;
 659
 660                 ssl_add_clienthello_use_srtp_ext(s, 0, &el, 0);
 661
 662                 if((limit - ret - 4 - el) < 0) return NULL;
 663
 664                 s2n(TLSEXT_TYPE_use_srtp,ret);
 665                 s2n(el,ret);
 666
 667                 if(ssl_add_clienthello_use_srtp_ext(s, ret, &el, el))
 668                         {
 669                         SSLerr(SSL_F_SSL_ADD_CLIENTHELLO_TLSEXT, ERR_R_INTERNAL_ERROR);
 670                         return NULL;
 671                         }
 672                 ret += el;
 673                 }
 674 #endif
 675         /* Add padding to workaround bugs in F5 terminators.
 676          * See https://tools.ietf.org/html/draft-agl-tls-padding-03
 677          *
 678          * NB: because this code works out the length of all existing
 679          * extensions it MUST always appear last.
 680          */
 681         if (s->options & SSL_OP_TLSEXT_PADDING)
 682                 {
 683                 int hlen = ret - (unsigned char *)s->init_buf->data;
 684                 /* The code in s23_clnt.c to build ClientHello messages
 685                  * includes the 5-byte record header in the buffer, while
 686                  * the code in s3_clnt.c does not.
 687                  */
 688                 if (s->state == SSL23_ST_CW_CLNT_HELLO_A)
 689                         hlen -= 5;
 690                 if (hlen > 0xff && hlen < 0x200)
 691                         {
 692                         hlen = 0x200 - hlen;
 693                         if (hlen >= 4)
 694                                 hlen -= 4;
 695                         else
 696                                 hlen = 0;
 697
 698                         s2n(TLSEXT_TYPE_padding, ret);
 699                         s2n(hlen, ret);
 700                         memset(ret, 0, hlen);
 701                         ret += hlen;
 702                         }
 703                 }
 704
 705         if ((extdatalen = ret-orig-2)== 0)
 706                 return orig;
 707
 708         s2n(extdatalen, orig);
 709         return ret;
 710         }
 711
 712 unsigned char *ssl_add_serverhello_tlsext(SSL *s, unsigned char *buf, unsigned char *limit)
 713         {
 714         int extdatalen=0;
 715         unsigned char *orig = buf;
 716         unsigned char *ret = buf;
 717 #ifndef OPENSSL_NO_NEXTPROTONEG
 718         int next_proto_neg_seen;
 719 #endif
 720
 721         /* don't add extensions for SSLv3, unless doing secure renegotiation */
 722         if (s->version == SSL3_VERSION && !s->s3->send_connection_binding)
 723                 return orig;
 724
 725         ret+=2;
 726         if (ret>=limit) return NULL; /* this really never occurs, but ... */
 727
 728         if (!s->hit && s->servername_done == 1 && s->session->tlsext_hostname != NULL)
 729                 {
 730                 if ((long)(limit - ret - 4) < 0) return NULL;
 731
 732                 s2n(TLSEXT_TYPE_server_name,ret);
 733                 s2n(0,ret);
 734                 }
 735
 736         if(s->s3->send_connection_binding)
 737         {
 738           int el;
 739
 740           if(!ssl_add_serverhello_renegotiate_ext(s, 0, &el, 0))
 741               {
 742               SSLerr(SSL_F_SSL_ADD_SERVERHELLO_TLSEXT, ERR_R_INTERNAL_ERROR);
 743               return NULL;
 744               }
 745
 746           if((limit - ret - 4 - el) < 0) return NULL;
 747
 748           s2n(TLSEXT_TYPE_renegotiate,ret);
 749           s2n(el,ret);
 750
 751           if(!ssl_add_serverhello_renegotiate_ext(s, ret, &el, el))
 752               {
 753               SSLerr(SSL_F_SSL_ADD_SERVERHELLO_TLSEXT, ERR_R_INTERNAL_ERROR);
 754               return NULL;
 755               }
 756
 757           ret += el;
 758         }
 759
 760 #ifndef OPENSSL_NO_EC
 761         if (s->tlsext_ecpointformatlist != NULL)
 762                 {
 763                 /* Add TLS extension ECPointFormats to the ServerHello message */
 764                 long lenmax;
 765
 766                 if ((lenmax = limit - ret - 5) < 0) return NULL;
 767                 if (s->tlsext_ecpointformatlist_length > (unsigned long)lenmax) return NULL;
 768                 if (s->tlsext_ecpointformatlist_length > 255)
 769                         {
 770                         SSLerr(SSL_F_SSL_ADD_SERVERHELLO_TLSEXT, ERR_R_INTERNAL_ERROR);
 771                         return NULL;
 772                         }
 773
 774                 s2n(TLSEXT_TYPE_ec_point_formats,ret);
 775                 s2n(s->tlsext_ecpointformatlist_length + 1,ret);
 776                 *(ret++) = (unsigned char) s->tlsext_ecpointformatlist_length;
 777                 memcpy(ret, s->tlsext_ecpointformatlist, s->tlsext_ecpointformatlist_length);
 778                 ret+=s->tlsext_ecpointformatlist_length;
 779
 780                 }
 781         /* Currently the server should not respond with a SupportedCurves extension */
 782 #endif /* OPENSSL_NO_EC */
 783
 784         if (s->tlsext_ticket_expected
 785                 && !(SSL_get_options(s) & SSL_OP_NO_TICKET))
 786                 {
 787                 if ((long)(limit - ret - 4) < 0) return NULL;
 788                 s2n(TLSEXT_TYPE_session_ticket,ret);
 789                 s2n(0,ret);
 790                 }
 791
 792         if (s->tlsext_status_expected)
 793                 {
 794                 if ((long)(limit - ret - 4) < 0) return NULL;
 795                 s2n(TLSEXT_TYPE_status_request,ret);
 796                 s2n(0,ret);
 797                 }
 798
 799 #ifdef TLSEXT_TYPE_opaque_prf_input
 800         if (s->s3->server_opaque_prf_input != NULL &&
 801             s->version != DTLS1_VERSION)
 802                 {
 803                 size_t sol = s->s3->server_opaque_prf_input_len;
 804
 805                 if ((long)(limit - ret - 6 - sol) < 0)
 806                         return NULL;
 807                 if (sol > 0xFFFD) /* can't happen */
 808                         return NULL;
 809
 810                 s2n(TLSEXT_TYPE_opaque_prf_input, ret);
 811                 s2n(sol + 2, ret);
 812                 s2n(sol, ret);
 813                 memcpy(ret, s->s3->server_opaque_prf_input, sol);
 814                 ret += sol;
 815                 }
 816 #endif
 817
 818 #ifndef OPENSSL_NO_SRTP
 819         if(SSL_IS_DTLS(s) && s->srtp_profile)
 820                 {
 821                 int el;
 822
 823                 ssl_add_serverhello_use_srtp_ext(s, 0, &el, 0);
 824
 825                 if((limit - ret - 4 - el) < 0) return NULL;
 826
 827                 s2n(TLSEXT_TYPE_use_srtp,ret);
 828                 s2n(el,ret);
 829
 830                 if(ssl_add_serverhello_use_srtp_ext(s, ret, &el, el))
 831                         {
 832                         SSLerr(SSL_F_SSL_ADD_SERVERHELLO_TLSEXT, ERR_R_INTERNAL_ERROR);
 833                         return NULL;
 834                         }
 835                 ret+=el;
 836                 }
 837 #endif
 838
 839         if (((s->s3->tmp.new_cipher->id & 0xFFFF)==0x80 || (s->s3->tmp.new_cipher->id & 0xFFFF)==0x81)
 840                 && (SSL_get_options(s) & SSL_OP_CRYPTOPRO_TLSEXT_BUG))
 841                 { const unsigned char cryptopro_ext[36] = {
 842                         0xfd, 0xe8, /*65000*/
 843                         0x00, 0x20, /*32 bytes length*/
 844                         0x30, 0x1e, 0x30, 0x08, 0x06, 0x06, 0x2a, 0x85,
 845                         0x03,   0x02, 0x02, 0x09, 0x30, 0x08, 0x06, 0x06,
 846                         0x2a, 0x85, 0x03, 0x02, 0x02, 0x16, 0x30, 0x08,
 847                         0x06, 0x06, 0x2a, 0x85, 0x03, 0x02, 0x02, 0x17};
 848                         if (limit-ret<36) return NULL;
 849                         memcpy(ret,cryptopro_ext,36);
 850                         ret+=36;
 851
 852                 }
 853
 854 #ifndef OPENSSL_NO_HEARTBEATS
 855         /* Add Heartbeat extension if we've received one */
 856         if (s->tlsext_heartbeat & SSL_TLSEXT_HB_ENABLED)
 857                 {
 858                 if ((limit - ret - 4 - 1) < 0)
 859                         return NULL;
 860                 s2n(TLSEXT_TYPE_heartbeat,ret);
 861                 s2n(1,ret);
 862                 /*-
 863                  * Set mode:
 864                  * 1: peer may send requests
 865                  * 2: peer not allowed to send requests
 866                  */
 867                 if (s->tlsext_heartbeat & SSL_TLSEXT_HB_DONT_RECV_REQUESTS)
 868                         *(ret++) = SSL_TLSEXT_HB_DONT_SEND_REQUESTS;
 869                 else
 870                         *(ret++) = SSL_TLSEXT_HB_ENABLED;
 871
 872                 }
 873 #endif
 874
 875 #ifndef OPENSSL_NO_NEXTPROTONEG
 876         next_proto_neg_seen = s->s3->next_proto_neg_seen;
 877         s->s3->next_proto_neg_seen = 0;
 878         if (next_proto_neg_seen && s->ctx->next_protos_advertised_cb)
 879                 {
 880                 const unsigned char *npa;
 881                 unsigned int npalen;
 882                 int r;
 883
 884                 r = s->ctx->next_protos_advertised_cb(s, &npa, &npalen, s->ctx->next_protos_advertised_cb_arg);
 885                 if (r == SSL_TLSEXT_ERR_OK)
 886                         {
 887                         if ((long)(limit - ret - 4 - npalen) < 0) return NULL;
 888                         s2n(TLSEXT_TYPE_next_proto_neg,ret);
 889                         s2n(npalen,ret);
 890                         memcpy(ret, npa, npalen);
 891                         ret += npalen;
 892                         s->s3->next_proto_neg_seen = 1;
 893                         }
 894                 }
 895 #endif
 896
 897         if ((extdatalen = ret-orig-2)== 0)
 898                 return orig;
 899
 900         s2n(extdatalen, orig);
 901         return ret;
 902         }
 903
 904 #ifndef OPENSSL_NO_EC
 905 /*-
 906  * ssl_check_for_safari attempts to fingerprint Safari using OS X
 907  * SecureTransport using the TLS extension block in |d|, of length |n|.
 908  * Safari, since 10.6, sends exactly these extensions, in this order:
 909  *   SNI,
 910  *   elliptic_curves
 911  *   ec_point_formats
 912  *
 913  * We wish to fingerprint Safari because they broke ECDHE-ECDSA support in 10.8,
 914  * but they advertise support. So enabling ECDHE-ECDSA ciphers breaks them.
 915  * Sadly we cannot differentiate 10.6, 10.7 and 10.8.4 (which work), from
 916  * 10.8..10.8.3 (which don't work).
 917  */
 918 static void ssl_check_for_safari(SSL *s, const unsigned char *data, const unsigned char *d, int n) {
 919         unsigned short type, size;
 920         static const unsigned char kSafariExtensionsBlock[] = {
 921                 0x00, 0x0a,  /* elliptic_curves extension */
 922                 0x00, 0x08,  /* 8 bytes */
 923                 0x00, 0x06,  /* 6 bytes of curve ids */
 924                 0x00, 0x17,  /* P-256 */
 925                 0x00, 0x18,  /* P-384 */
 926                 0x00, 0x19,  /* P-521 */
 927
 928                 0x00, 0x0b,  /* ec_point_formats */
 929                 0x00, 0x02,  /* 2 bytes */
 930                 0x01,        /* 1 point format */
 931                 0x00,        /* uncompressed */
 932         };
 933
 934         /* The following is only present in TLS 1.2 */
 935         static const unsigned char kSafariTLS12ExtensionsBlock[] = {
 936                 0x00, 0x0d,  /* signature_algorithms */
 937                 0x00, 0x0c,  /* 12 bytes */
 938                 0x00, 0x0a,  /* 10 bytes */
 939                 0x05, 0x01,  /* SHA-384/RSA */
 940                 0x04, 0x01,  /* SHA-256/RSA */
 941                 0x02, 0x01,  /* SHA-1/RSA */
 942                 0x04, 0x03,  /* SHA-256/ECDSA */
 943                 0x02, 0x03,  /* SHA-1/ECDSA */
 944         };
 945
 946         if (data >= (d+n-2))
 947                 return;
 948         data += 2;
 949
 950         if (data > (d+n-4))
 951                 return;
 952         n2s(data,type);
 953         n2s(data,size);
 954
 955         if (type != TLSEXT_TYPE_server_name)
 956                 return;
 957
 958         if (data+size > d+n)
 959                 return;
 960         data += size;
 961
 962         if (TLS1_get_client_version(s) >= TLS1_2_VERSION)
 963                 {
 964                 const size_t len1 = sizeof(kSafariExtensionsBlock);
 965                 const size_t len2 = sizeof(kSafariTLS12ExtensionsBlock);
 966
 967                 if (data + len1 + len2 != d+n)
 968                         return;
 969                 if (memcmp(data, kSafariExtensionsBlock, len1) != 0)
 970                         return;
 971                 if (memcmp(data + len1, kSafariTLS12ExtensionsBlock, len2) != 0)
 972                         return;
 973                 }
 974         else
 975                 {
 976                 const size_t len = sizeof(kSafariExtensionsBlock);
 977
 978                 if (data + len != d+n)
 979                         return;
 980                 if (memcmp(data, kSafariExtensionsBlock, len) != 0)
 981                         return;
 982                 }
 983
 984         s->s3->is_probably_safari = 1;
 985 }
 986 #endif /* !OPENSSL_NO_EC */
 987
 988 int ssl_parse_clienthello_tlsext(SSL *s, unsigned char **p, unsigned char *d, int n, int *al)
 989         {
 990         unsigned short type;
 991         unsigned short size;
 992         unsigned short len;
 993         unsigned char *data = *p;
 994         int renegotiate_seen = 0;
 995         int sigalg_seen = 0;
 996
 997         s->servername_done = 0;
 998         s->tlsext_status_type = -1;
 999 #ifndef OPENSSL_NO_NEXTPROTONEG
1000         s->s3->next_proto_neg_seen = 0;
1001 #endif
1002
1003 #ifndef OPENSSL_NO_HEARTBEATS
1004         s->tlsext_heartbeat &= ~(SSL_TLSEXT_HB_ENABLED |
1005                                SSL_TLSEXT_HB_DONT_SEND_REQUESTS);
1006 #endif
1007
1008 #ifndef OPENSSL_NO_EC
1009         if (s->options & SSL_OP_SAFARI_ECDHE_ECDSA_BUG)
1010                 ssl_check_for_safari(s, data, d, n);
1011 #endif /* !OPENSSL_NO_EC */
1012
1013 #ifndef OPENSSL_NO_SRP
1014         if (s->srp_ctx.login != NULL)
1015                 {
1016                 OPENSSL_free(s->srp_ctx.login);
1017                 s->srp_ctx.login = NULL;
1018                 }
1019 #endif
1020
1021         s->srtp_profile = NULL;
1022
1023         if (data >= (d+n-2))
1024                 goto ri_check;
1025         n2s(data,len);
1026
1027         if (data > (d+n-len))
1028                 goto ri_check;
1029
1030         while (data <= (d+n-4))
1031                 {
1032                 n2s(data,type);
1033                 n2s(data,size);
1034
1035                 if (data+size > (d+n))
1036                         goto ri_check;
1037 #if 0
1038                 fprintf(stderr,"Received extension type %d size %d\n",type,size);
1039 #endif
1040                 if (s->tlsext_debug_cb)
1041                         s->tlsext_debug_cb(s, 0, type, data, size,
1042                                                 s->tlsext_debug_arg);
1043 /*-
1044  * The servername extension is treated as follows:
1045  *
1046  * - Only the hostname type is supported with a maximum length of 255.
1047  * - The servername is rejected if too long or if it contains zeros,
1048  *   in which case an fatal alert is generated.
1049  * - The servername field is maintained together with the session cache.
1050  * - When a session is resumed, the servername call back invoked in order
1051  *   to allow the application to position itself to the right context.
1052  * - The servername is acknowledged if it is new for a session or when
1053  *   it is identical to a previously used for the same session.
1054  *   Applications can control the behaviour.  They can at any time
1055  *   set a 'desirable' servername for a new SSL object. This can be the
1056  *   case for example with HTTPS when a Host: header field is received and
1057  *   a renegotiation is requested. In this case, a possible servername
1058  *   presented in the new client hello is only acknowledged if it matches
1059  *   the value of the Host: field.
1060  * - Applications must  use SSL_OP_NO_SESSION_RESUMPTION_ON_RENEGOTIATION
1061  *   if they provide for changing an explicit servername context for the
1062  *   session, i.e. when the session has been established with a servername
1063  *   extension.
1064  * - On session reconnect, the servername extension may be absent.
1065  *
1066  */
1067
1068                 if (type == TLSEXT_TYPE_server_name)
1069                         {
1070                         unsigned char *sdata;
1071                         int servname_type;
1072                         int dsize;
1073
1074                         if (size < 2)
1075                                 {
1076                                 *al = SSL_AD_DECODE_ERROR;
1077                                 return 0;
1078                                 }
1079                         n2s(data,dsize);
1080                         size -= 2;
1081                         if (dsize > size  )
1082                                 {
1083                                 *al = SSL_AD_DECODE_ERROR;
1084                                 return 0;
1085                                 }
1086
1087                         sdata = data;
1088                         while (dsize > 3)
1089                                 {
1090                                 servname_type = *(sdata++);
1091                                 n2s(sdata,len);
1092                                 dsize -= 3;
1093
1094                                 if (len > dsize)
1095                                         {
1096                                         *al = SSL_AD_DECODE_ERROR;
1097                                         return 0;
1098                                         }
1099                                 if (s->servername_done == 0)
1100                                 switch (servname_type)
1101                                         {
1102                                 case TLSEXT_NAMETYPE_host_name:
1103                                         if (!s->hit)
1104                                                 {
1105                                                 if(s->session->tlsext_hostname)
1106                                                         {
1107                                                         *al = SSL_AD_DECODE_ERROR;
1108                                                         return 0;
1109                                                         }
1110                                                 if (len > TLSEXT_MAXLEN_host_name)
1111                                                         {
1112                                                         *al = TLS1_AD_UNRECOGNIZED_NAME;
1113                                                         return 0;
1114                                                         }
1115                                                 if ((s->session->tlsext_hostname = OPENSSL_malloc(len+1)) == NULL)
1116                                                         {
1117                                                         *al = TLS1_AD_INTERNAL_ERROR;
1118                                                         return 0;
1119                                                         }
1120                                                 memcpy(s->session->tlsext_hostname, sdata, len);
1121                                                 s->session->tlsext_hostname[len]='\0';
1122                                                 if (strlen(s->session->tlsext_hostname) != len) {
1123                                                         OPENSSL_free(s->session->tlsext_hostname);
1124                                                         s->session->tlsext_hostname = NULL;
1125                                                         *al = TLS1_AD_UNRECOGNIZED_NAME;
1126                                                         return 0;
1127                                                 }
1128                                                 s->servername_done = 1;
1129
1130                                                 }
1131                                         else
1132                                                 s->servername_done = s->session->tlsext_hostname
1133                                                         && strlen(s->session->tlsext_hostname) == len
1134                                                         && strncmp(s->session->tlsext_hostname, (char *)sdata, len) == 0;
1135
1136                                         break;
1137
1138                                 default:
1139                                         break;
1140                                         }
1141
1142                                 dsize -= len;
1143                                 }
1144                         if (dsize != 0)
1145                                 {
1146                                 *al = SSL_AD_DECODE_ERROR;
1147                                 return 0;
1148                                 }
1149
1150                         }
1151 #ifndef OPENSSL_NO_SRP
1152                 else if (type == TLSEXT_TYPE_srp)
1153                         {
1154                         if (size <= 0 || ((len = data[0])) != (size -1))
1155                                 {
1156                                 *al = SSL_AD_DECODE_ERROR;
1157                                 return 0;
1158                                 }
1159                         if (s->srp_ctx.login != NULL)
1160                                 {
1161                                 *al = SSL_AD_DECODE_ERROR;
1162                                 return 0;
1163                                 }
1164                         if ((s->srp_ctx.login = OPENSSL_malloc(len+1)) == NULL)
1165                                 return -1;
1166                         memcpy(s->srp_ctx.login, &data[1], len);
1167                         s->srp_ctx.login[len]='\0';
1168
1169                         if (strlen(s->srp_ctx.login) != len)
1170                                 {
1171                                 *al = SSL_AD_DECODE_ERROR;
1172                                 return 0;
1173                                 }
1174                         }
1175 #endif
1176
1177 #ifndef OPENSSL_NO_EC
1178                 else if (type == TLSEXT_TYPE_ec_point_formats)
1179                         {
1180                         unsigned char *sdata = data;
1181                         int ecpointformatlist_length = *(sdata++);
1182
1183                         if (ecpointformatlist_length != size - 1)
1184                                 {
1185                                 *al = TLS1_AD_DECODE_ERROR;
1186                                 return 0;
1187                                 }
1188                         if (!s->hit)
1189                                 {
1190                                 if(s->session->tlsext_ecpointformatlist)
1191                                         {
1192                                         OPENSSL_free(s->session->tlsext_ecpointformatlist);
1193                                         s->session->tlsext_ecpointformatlist = NULL;
1194                                         }
1195                                 s->session->tlsext_ecpointformatlist_length = 0;
1196                                 if ((s->session->tlsext_ecpointformatlist = OPENSSL_malloc(ecpointformatlist_length)) == NULL)
1197                                         {
1198                                         *al = TLS1_AD_INTERNAL_ERROR;
1199                                         return 0;
1200                                         }
1201                                 s->session->tlsext_ecpointformatlist_length = ecpointformatlist_length;
1202                                 memcpy(s->session->tlsext_ecpointformatlist, sdata, ecpointformatlist_length);
1203                                 }
1204 #if 0
1205                         fprintf(stderr,"ssl_parse_clienthello_tlsext s->session->tlsext_ecpointformatlist (length=%i) ", s->session->tlsext_ecpointformatlist_length);
1206                         sdata = s->session->tlsext_ecpointformatlist;
1207                         for (i = 0; i < s->session->tlsext_ecpointformatlist_length; i++)
1208                                 fprintf(stderr,"%i ",*(sdata++));
1209                         fprintf(stderr,"\n");
1210 #endif
1211                         }
1212                 else if (type == TLSEXT_TYPE_elliptic_curves)
1213                         {
1214                         unsigned char *sdata = data;
1215                         int ellipticcurvelist_length = (*(sdata++) << 8);
1216                         ellipticcurvelist_length += (*(sdata++));
1217
1218                         if (ellipticcurvelist_length != size - 2 ||
1219                                 ellipticcurvelist_length < 1 ||
1220                                 /* Each NamedCurve is 2 bytes. */
1221                                 ellipticcurvelist_length & 1)
1222                                 {
1223                                 *al = TLS1_AD_DECODE_ERROR;
1224                                 return 0;
1225                                 }
1226                         if (!s->hit)
1227                                 {
1228                                 if(s->session->tlsext_ellipticcurvelist)
1229                                         {
1230                                         *al = TLS1_AD_DECODE_ERROR;
1231                                         return 0;
1232                                         }
1233                                 s->session->tlsext_ellipticcurvelist_length = 0;
1234                                 if ((s->session->tlsext_ellipticcurvelist = OPENSSL_malloc(ellipticcurvelist_length)) == NULL)
1235                                         {
1236                                         *al = TLS1_AD_INTERNAL_ERROR;
1237                                         return 0;
1238                                         }
1239                                 s->session->tlsext_ellipticcurvelist_length = ellipticcurvelist_length;
1240                                 memcpy(s->session->tlsext_ellipticcurvelist, sdata, ellipticcurvelist_length);
1241                                 }
1242 #if 0
1243                         fprintf(stderr,"ssl_parse_clienthello_tlsext s->session->tlsext_ellipticcurvelist (length=%i) ", s->session->tlsext_ellipticcurvelist_length);
1244                         sdata = s->session->tlsext_ellipticcurvelist;
1245                         for (i = 0; i < s->session->tlsext_ellipticcurvelist_length; i++)
1246                                 fprintf(stderr,"%i ",*(sdata++));
1247                         fprintf(stderr,"\n");
1248 #endif
1249                         }
1250 #endif /* OPENSSL_NO_EC */
1251 #ifdef TLSEXT_TYPE_opaque_prf_input
1252                 else if (type == TLSEXT_TYPE_opaque_prf_input &&
1253                      s->version != DTLS1_VERSION)
1254                         {
1255                         unsigned char *sdata = data;
1256
1257                         if (size < 2)
1258                                 {
1259                                 *al = SSL_AD_DECODE_ERROR;
1260                                 return 0;
1261                                 }
1262                         n2s(sdata, s->s3->client_opaque_prf_input_len);
1263                         if (s->s3->client_opaque_prf_input_len != size - 2)
1264                                 {
1265                                 *al = SSL_AD_DECODE_ERROR;
1266                                 return 0;
1267                                 }
1268
1269                         if (s->s3->client_opaque_prf_input != NULL) /* shouldn't really happen */
1270                                 OPENSSL_free(s->s3->client_opaque_prf_input);
1271
1272                         /* dummy byte just to get non-NULL */
1273                         if (s->s3->client_opaque_prf_input_len == 0)
1274                                 s->s3->client_opaque_prf_input = OPENSSL_malloc(1);
1275                         else
1276                                 s->s3->client_opaque_prf_input = BUF_memdup(sdata, s->s3->client_opaque_prf_input_len);
1277                         if (s->s3->client_opaque_prf_input == NULL)
1278                                 {
1279                                 *al = TLS1_AD_INTERNAL_ERROR;
1280                                 return 0;
1281                                 }
1282                         }
1283 #endif
1284                 else if (type == TLSEXT_TYPE_session_ticket)
1285                         {
1286                         if (s->tls_session_ticket_ext_cb &&
1287                             !s->tls_session_ticket_ext_cb(s, data, size, s->tls_session_ticket_ext_cb_arg))
1288                                 {
1289                                 *al = TLS1_AD_INTERNAL_ERROR;
1290                                 return 0;
1291                                 }
1292                         }
1293                 else if (type == TLSEXT_TYPE_renegotiate)
1294                         {
1295                         if(!ssl_parse_clienthello_renegotiate_ext(s, data, size, al))
1296                                 return 0;
1297                         renegotiate_seen = 1;
1298                         }
1299                 else if (type == TLSEXT_TYPE_signature_algorithms)
1300                         {
1301                         int dsize;
1302                         if (sigalg_seen || size < 2)
1303                                 {
1304                                 *al = SSL_AD_DECODE_ERROR;
1305                                 return 0;
1306                                 }
1307                         sigalg_seen = 1;
1308                         n2s(data,dsize);
1309                         size -= 2;
1310                         if (dsize != size || dsize & 1)
1311                                 {
1312                                 *al = SSL_AD_DECODE_ERROR;
1313                                 return 0;
1314                                 }
1315                         if (!tls1_process_sigalgs(s, data, dsize))
1316                                 {
1317                                 *al = SSL_AD_DECODE_ERROR;
1318                                 return 0;
1319                                 }
1320                         }
1321                 else if (type == TLSEXT_TYPE_status_request &&
1322                          s->version != DTLS1_VERSION)
1323                         {
1324
1325                         if (size < 5)
1326                                 {
1327                                 *al = SSL_AD_DECODE_ERROR;
1328                                 return 0;
1329                                 }
1330
1331                         s->tlsext_status_type = *data++;
1332                         size--;
1333                         if (s->tlsext_status_type == TLSEXT_STATUSTYPE_ocsp)
1334                                 {
1335                                 const unsigned char *sdata;
1336                                 int dsize;
1337                                 /* Read in responder_id_list */
1338                                 n2s(data,dsize);
1339                                 size -= 2;
1340                                 if (dsize > size  )
1341                                         {
1342                                         *al = SSL_AD_DECODE_ERROR;
1343                                         return 0;
1344                                         }
1345                                 while (dsize > 0)
1346                                         {
1347                                         OCSP_RESPID *id;
1348                                         int idsize;
1349                                         if (dsize < 4)
1350                                                 {
1351                                                 *al = SSL_AD_DECODE_ERROR;
1352                                                 return 0;
1353                                                 }
1354                                         n2s(data, idsize);
1355                                         dsize -= 2 + idsize;
1356                                         size -= 2 + idsize;
1357                                         if (dsize < 0)
1358                                                 {
1359                                                 *al = SSL_AD_DECODE_ERROR;
1360                                                 return 0;
1361                                                 }
1362                                         sdata = data;
1363                                         data += idsize;
1364                                         id = d2i_OCSP_RESPID(NULL,
1365                                                                 &sdata, idsize);
1366                                         if (!id)
1367                                                 {
1368                                                 *al = SSL_AD_DECODE_ERROR;
1369                                                 return 0;
1370                                                 }
1371                                         if (data != sdata)
1372                                                 {
1373                                                 OCSP_RESPID_free(id);
1374                                                 *al = SSL_AD_DECODE_ERROR;
1375                                                 return 0;
1376                                                 }
1377                                         if (!s->tlsext_ocsp_ids
1378                                                 && !(s->tlsext_ocsp_ids =
1379                                                 sk_OCSP_RESPID_new_null()))
1380                                                 {
1381                                                 OCSP_RESPID_free(id);
1382                                                 *al = SSL_AD_INTERNAL_ERROR;
1383                                                 return 0;
1384                                                 }
1385                                         if (!sk_OCSP_RESPID_push(
1386                                                         s->tlsext_ocsp_ids, id))
1387                                                 {
1388                                                 OCSP_RESPID_free(id);
1389                                                 *al = SSL_AD_INTERNAL_ERROR;
1390                                                 return 0;
1391                                                 }
1392                                         }
1393
1394                                 /* Read in request_extensions */
1395                                 if (size < 2)
1396                                         {
1397                                         *al = SSL_AD_DECODE_ERROR;
1398                                         return 0;
1399                                         }
1400                                 n2s(data,dsize);
1401                                 size -= 2;
1402                                 if (dsize != size)
1403                                         {
1404                                         *al = SSL_AD_DECODE_ERROR;
1405                                         return 0;
1406                                         }
1407                                 sdata = data;
1408                                 if (dsize > 0)
1409                                         {
1410                                         if (s->tlsext_ocsp_exts)
1411                                                 {
1412                                                 sk_X509_EXTENSION_pop_free(s->tlsext_ocsp_exts,
1413                                                                            X509_EXTENSION_free);
1414                                                 }
1415
1416                                         s->tlsext_ocsp_exts =
1417                                                 d2i_X509_EXTENSIONS(NULL,
1418                                                         &sdata, dsize);
1419                                         if (!s->tlsext_ocsp_exts
1420                                                 || (data + dsize != sdata))
1421                                                 {
1422                                                 *al = SSL_AD_DECODE_ERROR;
1423                                                 return 0;
1424                                                 }
1425                                         }
1426                                 }
1427                                 /* We don't know what to do with any other type
1428                                 * so ignore it.
1429                                 */
1430                                 else
1431                                         s->tlsext_status_type = -1;
1432                         }
1433 #ifndef OPENSSL_NO_HEARTBEATS
1434                 else if (type == TLSEXT_TYPE_heartbeat)
1435                         {
1436                         switch(data[0])
1437                                 {
1438                                 case 0x01:      /* Client allows us to send HB requests */
1439                                                         s->tlsext_heartbeat |= SSL_TLSEXT_HB_ENABLED;
1440                                                         break;
1441                                 case 0x02:      /* Client doesn't accept HB requests */
1442                                                         s->tlsext_heartbeat |= SSL_TLSEXT_HB_ENABLED;
1443                                                         s->tlsext_heartbeat |= SSL_TLSEXT_HB_DONT_SEND_REQUESTS;
1444                                                         break;
1445                                 default:        *al = SSL_AD_ILLEGAL_PARAMETER;
1446                                                         return 0;
1447                                 }
1448                         }
1449 #endif
1450 #ifndef OPENSSL_NO_NEXTPROTONEG
1451                 else if (type == TLSEXT_TYPE_next_proto_neg &&
1452                          s->s3->tmp.finish_md_len == 0)
1453                         {
1454                         /*-
1455                          * We shouldn't accept this extension on a
1456                          * renegotiation.
1457                          *
1458                          * s->new_session will be set on renegotiation, but we
1459                          * probably shouldn't rely that it couldn't be set on
1460                          * the initial renegotation too in certain cases (when
1461                          * there's some other reason to disallow resuming an
1462                          * earlier session -- the current code won't be doing
1463                          * anything like that, but this might change).
1464                          *
1465                          * A valid sign that there's been a previous handshake
1466                          * in this connection is if s->s3->tmp.finish_md_len >
1467                          * 0.  (We are talking about a check that will happen
1468                          * in the Hello protocol round, well before a new
1469                          * Finished message could have been computed.)
1470                          */
1471                         s->s3->next_proto_neg_seen = 1;
1472                         }
1473 #endif
1474
1475                 /* session ticket processed earlier */
1476 #ifndef OPENSSL_NO_SRTP
1477                 else if (SSL_IS_DTLS(s) && SSL_get_srtp_profiles(s)
1478                          && type == TLSEXT_TYPE_use_srtp)
1479                         {
1480                         if(ssl_parse_clienthello_use_srtp_ext(s, data, size,
1481                                                               al))
1482                                 return 0;
1483                         }
1484 #endif
1485
1486                 data+=size;
1487                 }
1488
1489         *p = data;
1490
1491         ri_check:
1492
1493         /* Need RI if renegotiating */
1494
1495         if (!renegotiate_seen && s->renegotiate &&
1496                 !(s->options & SSL_OP_ALLOW_UNSAFE_LEGACY_RENEGOTIATION))
1497                 {
1498                 *al = SSL_AD_HANDSHAKE_FAILURE;
1499                 SSLerr(SSL_F_SSL_PARSE_CLIENTHELLO_TLSEXT,
1500                                 SSL_R_UNSAFE_LEGACY_RENEGOTIATION_DISABLED);
1501                 return 0;
1502                 }
1503
1504         return 1;
1505         }
1506
1507 #ifndef OPENSSL_NO_NEXTPROTONEG
1508 /* ssl_next_proto_validate validates a Next Protocol Negotiation block. No
1509  * elements of zero length are allowed and the set of elements must exactly fill
1510  * the length of the block. */
1511 static char ssl_next_proto_validate(unsigned char *d, unsigned len)
1512         {
1513         unsigned int off = 0;
1514
1515         while (off < len)
1516                 {
1517                 if (d[off] == 0)
1518                         return 0;
1519                 off += d[off];
1520                 off++;
1521                 }
1522
1523         return off == len;
1524         }
1525 #endif
1526
1527 int ssl_parse_serverhello_tlsext(SSL *s, unsigned char **p, unsigned char *d, int n, int *al)
1528         {
1529         unsigned short length;
1530         unsigned short type;
1531         unsigned short size;
1532         unsigned char *data = *p;
1533         int tlsext_servername = 0;
1534         int renegotiate_seen = 0;
1535
1536 #ifndef OPENSSL_NO_NEXTPROTONEG
1537         s->s3->next_proto_neg_seen = 0;
1538 #endif
1539         s->tlsext_ticket_expected = 0;
1540
1541 #ifndef OPENSSL_NO_HEARTBEATS
1542         s->tlsext_heartbeat &= ~(SSL_TLSEXT_HB_ENABLED |
1543                                SSL_TLSEXT_HB_DONT_SEND_REQUESTS);
1544 #endif
1545
1546         if (data >= (d+n-2))
1547                 goto ri_check;
1548
1549         n2s(data,length);
1550         if (data+length != d+n)
1551                 {
1552                 *al = SSL_AD_DECODE_ERROR;
1553                 return 0;
1554                 }
1555
1556         while(data <= (d+n-4))
1557                 {
1558                 n2s(data,type);
1559                 n2s(data,size);
1560
1561                 if (data+size > (d+n))
1562                         goto ri_check;
1563
1564                 if (s->tlsext_debug_cb)
1565                         s->tlsext_debug_cb(s, 1, type, data, size,
1566                                                 s->tlsext_debug_arg);
1567
1568                 if (type == TLSEXT_TYPE_server_name)
1569                         {
1570                         if (s->tlsext_hostname == NULL || size > 0)
1571                                 {
1572                                 *al = TLS1_AD_UNRECOGNIZED_NAME;
1573                                 return 0;
1574                                 }
1575                         tlsext_servername = 1;
1576                         }
1577
1578 #ifndef OPENSSL_NO_EC
1579                 else if (type == TLSEXT_TYPE_ec_point_formats)
1580                         {
1581                         unsigned char *sdata = data;
1582                         int ecpointformatlist_length = *(sdata++);
1583
1584                         if (ecpointformatlist_length != size - 1 ||
1585                                 ecpointformatlist_length < 1)
1586                                 {
1587                                 *al = TLS1_AD_DECODE_ERROR;
1588                                 return 0;
1589                                 }
1590                         if (!s->hit)
1591                                 {
1592                                 s->session->tlsext_ecpointformatlist_length = 0;
1593                                 if (s->session->tlsext_ecpointformatlist != NULL) OPENSSL_free(s->session->tlsext_ecpointformatlist);
1594                                 if ((s->session->tlsext_ecpointformatlist = OPENSSL_malloc(ecpointformatlist_length)) == NULL)
1595                                         {
1596                                         *al = TLS1_AD_INTERNAL_ERROR;
1597                                         return 0;
1598                                         }
1599                                 s->session->tlsext_ecpointformatlist_length = ecpointformatlist_length;
1600                                 memcpy(s->session->tlsext_ecpointformatlist, sdata, ecpointformatlist_length);
1601                                 }
1602 #if 0
1603                         fprintf(stderr,"ssl_parse_serverhello_tlsext s->session->tlsext_ecpointformatlist ");
1604                         sdata = s->session->tlsext_ecpointformatlist;
1605                         for (i = 0; i < s->session->tlsext_ecpointformatlist_length; i++)
1606                                 fprintf(stderr,"%i ",*(sdata++));
1607                         fprintf(stderr,"\n");
1608 #endif
1609                         }
1610 #endif /* OPENSSL_NO_EC */
1611
1612                 else if (type == TLSEXT_TYPE_session_ticket)
1613                         {
1614                         if (s->tls_session_ticket_ext_cb &&
1615                             !s->tls_session_ticket_ext_cb(s, data, size, s->tls_session_ticket_ext_cb_arg))
1616                                 {
1617                                 *al = TLS1_AD_INTERNAL_ERROR;
1618                                 return 0;
1619                                 }
1620                         if ((SSL_get_options(s) & SSL_OP_NO_TICKET)
1621                                 || (size > 0))
1622                                 {
1623                                 *al = TLS1_AD_UNSUPPORTED_EXTENSION;
1624                                 return 0;
1625                                 }
1626                         s->tlsext_ticket_expected = 1;
1627                         }
1628 #ifdef TLSEXT_TYPE_opaque_prf_input
1629                 else if (type == TLSEXT_TYPE_opaque_prf_input &&
1630                      s->version != DTLS1_VERSION)
1631                         {
1632                         unsigned char *sdata = data;
1633
1634                         if (size < 2)
1635                                 {
1636                                 *al = SSL_AD_DECODE_ERROR;
1637                                 return 0;
1638                                 }
1639                         n2s(sdata, s->s3->server_opaque_prf_input_len);
1640                         if (s->s3->server_opaque_prf_input_len != size - 2)
1641                                 {
1642                                 *al = SSL_AD_DECODE_ERROR;
1643                                 return 0;
1644                                 }
1645
1646                         if (s->s3->server_opaque_prf_input != NULL) /* shouldn't really happen */
1647                                 OPENSSL_free(s->s3->server_opaque_prf_input);
1648                         if (s->s3->server_opaque_prf_input_len == 0)
1649                                 s->s3->server_opaque_prf_input = OPENSSL_malloc(1); /* dummy byte just to get non-NULL */
1650                         else
1651                                 s->s3->server_opaque_prf_input = BUF_memdup(sdata, s->s3->server_opaque_prf_input_len);
1652
1653                         if (s->s3->server_opaque_prf_input == NULL)
1654                                 {
1655                                 *al = TLS1_AD_INTERNAL_ERROR;
1656                                 return 0;
1657                                 }
1658                         }
1659 #endif
1660                 else if (type == TLSEXT_TYPE_status_request &&
1661                          s->version != DTLS1_VERSION)
1662                         {
1663                         /* MUST be empty and only sent if we've requested
1664                          * a status request message.
1665                          */
1666                         if ((s->tlsext_status_type == -1) || (size > 0))
1667                                 {
1668                                 *al = TLS1_AD_UNSUPPORTED_EXTENSION;
1669                                 return 0;
1670                                 }
1671                         /* Set flag to expect CertificateStatus message */
1672                         s->tlsext_status_expected = 1;
1673                         }
1674 #ifndef OPENSSL_NO_NEXTPROTONEG
1675                 else if (type == TLSEXT_TYPE_next_proto_neg &&
1676                          s->s3->tmp.finish_md_len == 0)
1677                         {
1678                         unsigned char *selected;
1679                         unsigned char selected_len;
1680
1681                         /* We must have requested it. */
1682                         if (s->ctx->next_proto_select_cb == NULL)
1683                                 {
1684                                 *al = TLS1_AD_UNSUPPORTED_EXTENSION;
1685                                 return 0;
1686                                 }
1687                         /* The data must be valid */
1688                         if (!ssl_next_proto_validate(data, size))
1689                                 {
1690                                 *al = TLS1_AD_DECODE_ERROR;
1691                                 return 0;
1692                                 }
1693                         if (s->ctx->next_proto_select_cb(s, &selected, &selected_len, data, size, s->ctx->next_proto_select_cb_arg) != SSL_TLSEXT_ERR_OK)
1694                                 {
1695                                 *al = TLS1_AD_INTERNAL_ERROR;
1696                                 return 0;
1697                                 }
1698                         s->next_proto_negotiated = OPENSSL_malloc(selected_len);
1699                         if (!s->next_proto_negotiated)
1700                                 {
1701                                 *al = TLS1_AD_INTERNAL_ERROR;
1702                                 return 0;
1703                                 }
1704                         memcpy(s->next_proto_negotiated, selected, selected_len);
1705                         s->next_proto_negotiated_len = selected_len;
1706                         s->s3->next_proto_neg_seen = 1;
1707                         }
1708 #endif
1709                 else if (type == TLSEXT_TYPE_renegotiate)
1710                         {
1711                         if(!ssl_parse_serverhello_renegotiate_ext(s, data, size, al))
1712                                 return 0;
1713                         renegotiate_seen = 1;
1714                         }
1715 #ifndef OPENSSL_NO_HEARTBEATS
1716                 else if (type == TLSEXT_TYPE_heartbeat)
1717                         {
1718                         switch(data[0])
1719                                 {
1720                                 case 0x01:      /* Server allows us to send HB requests */
1721                                                         s->tlsext_heartbeat |= SSL_TLSEXT_HB_ENABLED;
1722                                                         break;
1723                                 case 0x02:      /* Server doesn't accept HB requests */
1724                                                         s->tlsext_heartbeat |= SSL_TLSEXT_HB_ENABLED;
1725                                                         s->tlsext_heartbeat |= SSL_TLSEXT_HB_DONT_SEND_REQUESTS;
1726                                                         break;
1727                                 default:        *al = SSL_AD_ILLEGAL_PARAMETER;
1728                                                         return 0;
1729                                 }
1730                         }
1731 #endif
1732 #ifndef OPENSSL_NO_SRTP
1733                 else if (SSL_IS_DTLS(s) && type == TLSEXT_TYPE_use_srtp)
1734                         {
1735                         if(ssl_parse_serverhello_use_srtp_ext(s, data, size,
1736                                                               al))
1737                                 return 0;
1738                         }
1739 #endif
1740
1741                 data+=size;
1742                 }
1743
1744         if (data != d+n)
1745                 {
1746                 *al = SSL_AD_DECODE_ERROR;
1747                 return 0;
1748                 }
1749
1750         if (!s->hit && tlsext_servername == 1)
1751                 {
1752                 if (s->tlsext_hostname)
1753                         {
1754                         if (s->session->tlsext_hostname == NULL)
1755                                 {
1756                                 s->session->tlsext_hostname = BUF_strdup(s->tlsext_hostname);
1757                                 if (!s->session->tlsext_hostname)
1758                                         {
1759                                         *al = SSL_AD_UNRECOGNIZED_NAME;
1760                                         return 0;
1761                                         }
1762                                 }
1763                         else
1764                                 {
1765                                 *al = SSL_AD_DECODE_ERROR;
1766                                 return 0;
1767                                 }
1768                         }
1769                 }
1770
1771         *p = data;
1772
1773         ri_check:
1774
1775         /* Determine if we need to see RI. Strictly speaking if we want to
1776          * avoid an attack we should *always* see RI even on initial server
1777          * hello because the client doesn't see any renegotiation during an
1778          * attack. However this would mean we could not connect to any server
1779          * which doesn't support RI so for the immediate future tolerate RI
1780          * absence on initial connect only.
1781          */
1782         if (!renegotiate_seen
1783                 && !(s->options & SSL_OP_LEGACY_SERVER_CONNECT)
1784                 && !(s->options & SSL_OP_ALLOW_UNSAFE_LEGACY_RENEGOTIATION))
1785                 {
1786                 *al = SSL_AD_HANDSHAKE_FAILURE;
1787                 SSLerr(SSL_F_SSL_PARSE_SERVERHELLO_TLSEXT,
1788                                 SSL_R_UNSAFE_LEGACY_RENEGOTIATION_DISABLED);
1789                 return 0;
1790                 }
1791
1792         return 1;
1793         }
1794
1795
1796 int ssl_prepare_clienthello_tlsext(SSL *s)
1797         {
1798 #ifndef OPENSSL_NO_EC
1799         /* If we are client and using an elliptic curve cryptography cipher suite, send the point formats
1800          * and elliptic curves we support.
1801          */
1802         int using_ecc = 0;
1803         int i;
1804         unsigned char *j;
1805         unsigned long alg_k, alg_a;
1806         STACK_OF(SSL_CIPHER) *cipher_stack = SSL_get_ciphers(s);
1807
1808         for (i = 0; i < sk_SSL_CIPHER_num(cipher_stack); i++)
1809                 {
1810                 SSL_CIPHER *c = sk_SSL_CIPHER_value(cipher_stack, i);
1811
1812                 alg_k = c->algorithm_mkey;
1813                 alg_a = c->algorithm_auth;
1814                 if ((alg_k & (SSL_kEECDH|SSL_kECDHr|SSL_kECDHe) || (alg_a & SSL_aECDSA)))
1815                         {
1816                         using_ecc = 1;
1817                         break;
1818                         }
1819                 }
1820         using_ecc = using_ecc && (s->version >= TLS1_VERSION);
1821         if (using_ecc)
1822                 {
1823                 if (s->tlsext_ecpointformatlist != NULL) OPENSSL_free(s->tlsext_ecpointformatlist);
1824                 if ((s->tlsext_ecpointformatlist = OPENSSL_malloc(3)) == NULL)
1825                         {
1826                         SSLerr(SSL_F_SSL_PREPARE_CLIENTHELLO_TLSEXT,ERR_R_MALLOC_FAILURE);
1827                         return -1;
1828                         }
1829                 s->tlsext_ecpointformatlist_length = 3;
1830                 s->tlsext_ecpointformatlist[0] = TLSEXT_ECPOINTFORMAT_uncompressed;
1831                 s->tlsext_ecpointformatlist[1] = TLSEXT_ECPOINTFORMAT_ansiX962_compressed_prime;
1832                 s->tlsext_ecpointformatlist[2] = TLSEXT_ECPOINTFORMAT_ansiX962_compressed_char2;
1833
1834                 /* we support all named elliptic curves in RFC 4492 */
1835                 if (s->tlsext_ellipticcurvelist != NULL) OPENSSL_free(s->tlsext_ellipticcurvelist);
1836                 s->tlsext_ellipticcurvelist_length = sizeof(pref_list)/sizeof(pref_list[0]) * 2;
1837                 if ((s->tlsext_ellipticcurvelist = OPENSSL_malloc(s->tlsext_ellipticcurvelist_length)) == NULL)
1838                         {
1839                         s->tlsext_ellipticcurvelist_length = 0;
1840                         SSLerr(SSL_F_SSL_PREPARE_CLIENTHELLO_TLSEXT,ERR_R_MALLOC_FAILURE);
1841                         return -1;
1842                         }
1843                 for (i = 0, j = s->tlsext_ellipticcurvelist; (unsigned int)i <
1844                                 sizeof(pref_list)/sizeof(pref_list[0]); i++)
1845                         {
1846                         int id = tls1_ec_nid2curve_id(pref_list[i]);
1847                         s2n(id,j);
1848                         }
1849                 }
1850 #endif /* OPENSSL_NO_EC */
1851
1852 #ifdef TLSEXT_TYPE_opaque_prf_input
1853         {
1854                 int r = 1;
1855
1856                 if (s->ctx->tlsext_opaque_prf_input_callback != 0)
1857                         {
1858                         r = s->ctx->tlsext_opaque_prf_input_callback(s, NULL, 0, s->ctx->tlsext_opaque_prf_input_callback_arg);
1859                         if (!r)
1860                                 return -1;
1861                         }
1862
1863                 if (s->tlsext_opaque_prf_input != NULL)
1864                         {
1865                         if (s->s3->client_opaque_prf_input != NULL) /* shouldn't really happen */
1866                                 OPENSSL_free(s->s3->client_opaque_prf_input);
1867
1868                         if (s->tlsext_opaque_prf_input_len == 0)
1869                                 s->s3->client_opaque_prf_input = OPENSSL_malloc(1); /* dummy byte just to get non-NULL */
1870                         else
1871                                 s->s3->client_opaque_prf_input = BUF_memdup(s->tlsext_opaque_prf_input, s->tlsext_opaque_prf_input_len);
1872                         if (s->s3->client_opaque_prf_input == NULL)
1873                                 {
1874                                 SSLerr(SSL_F_SSL_PREPARE_CLIENTHELLO_TLSEXT,ERR_R_MALLOC_FAILURE);
1875                                 return -1;
1876                                 }
1877                         s->s3->client_opaque_prf_input_len = s->tlsext_opaque_prf_input_len;
1878                         }
1879
1880                 if (r == 2)
1881                         /* at callback's request, insist on receiving an appropriate server opaque PRF input */
1882                         s->s3->server_opaque_prf_input_len = s->tlsext_opaque_prf_input_len;
1883         }
1884 #endif
1885
1886         return 1;
1887         }
1888
1889 int ssl_prepare_serverhello_tlsext(SSL *s)
1890         {
1891 #ifndef OPENSSL_NO_EC
1892         /* If we are server and using an ECC cipher suite, send the point formats we support
1893          * if the client sent us an ECPointsFormat extension.  Note that the server is not
1894          * supposed to send an EllipticCurves extension.
1895          */
1896
1897         unsigned long alg_k = s->s3->tmp.new_cipher->algorithm_mkey;
1898         unsigned long alg_a = s->s3->tmp.new_cipher->algorithm_auth;
1899         int using_ecc = (alg_k & (SSL_kEECDH|SSL_kECDHr|SSL_kECDHe)) || (alg_a & SSL_aECDSA);
1900         using_ecc = using_ecc && (s->session->tlsext_ecpointformatlist != NULL);
1901
1902         if (using_ecc)
1903                 {
1904                 if (s->tlsext_ecpointformatlist != NULL) OPENSSL_free(s->tlsext_ecpointformatlist);
1905                 if ((s->tlsext_ecpointformatlist = OPENSSL_malloc(3)) == NULL)
1906                         {
1907                         SSLerr(SSL_F_SSL_PREPARE_SERVERHELLO_TLSEXT,ERR_R_MALLOC_FAILURE);
1908                         return -1;
1909                         }
1910                 s->tlsext_ecpointformatlist_length = 3;
1911                 s->tlsext_ecpointformatlist[0] = TLSEXT_ECPOINTFORMAT_uncompressed;
1912                 s->tlsext_ecpointformatlist[1] = TLSEXT_ECPOINTFORMAT_ansiX962_compressed_prime;
1913                 s->tlsext_ecpointformatlist[2] = TLSEXT_ECPOINTFORMAT_ansiX962_compressed_char2;
1914                 }
1915 #endif /* OPENSSL_NO_EC */
1916
1917         return 1;
1918         }
1919
1920 int ssl_check_clienthello_tlsext_early(SSL *s)
1921         {
1922         int ret=SSL_TLSEXT_ERR_NOACK;
1923         int al = SSL_AD_UNRECOGNIZED_NAME;
1924
1925 #ifndef OPENSSL_NO_EC
1926         /* The handling of the ECPointFormats extension is done elsewhere, namely in
1927          * ssl3_choose_cipher in s3_lib.c.
1928          */
1929         /* The handling of the EllipticCurves extension is done elsewhere, namely in
1930          * ssl3_choose_cipher in s3_lib.c.
1931          */
1932 #endif
1933
1934         if (s->ctx != NULL && s->ctx->tlsext_servername_callback != 0)
1935                 ret = s->ctx->tlsext_servername_callback(s, &al, s->ctx->tlsext_servername_arg);
1936         else if (s->initial_ctx != NULL && s->initial_ctx->tlsext_servername_callback != 0)
1937                 ret = s->initial_ctx->tlsext_servername_callback(s, &al, s->initial_ctx->tlsext_servername_arg);
1938
1939 #ifdef TLSEXT_TYPE_opaque_prf_input
1940         {
1941                 /* This sort of belongs into ssl_prepare_serverhello_tlsext(),
1942                  * but we might be sending an alert in response to the client hello,
1943                  * so this has to happen here in
1944                  * ssl_check_clienthello_tlsext_early(). */
1945
1946                 int r = 1;
1947
1948                 if (s->ctx->tlsext_opaque_prf_input_callback != 0)
1949                         {
1950                         r = s->ctx->tlsext_opaque_prf_input_callback(s, NULL, 0, s->ctx->tlsext_opaque_prf_input_callback_arg);
1951                         if (!r)
1952                                 {
1953                                 ret = SSL_TLSEXT_ERR_ALERT_FATAL;
1954                                 al = SSL_AD_INTERNAL_ERROR;
1955                                 goto err;
1956                                 }
1957                         }
1958
1959                 if (s->s3->server_opaque_prf_input != NULL) /* shouldn't really happen */
1960                         OPENSSL_free(s->s3->server_opaque_prf_input);
1961                 s->s3->server_opaque_prf_input = NULL;
1962
1963                 if (s->tlsext_opaque_prf_input != NULL)
1964                         {
1965                         if (s->s3->client_opaque_prf_input != NULL &&
1966                                 s->s3->client_opaque_prf_input_len == s->tlsext_opaque_prf_input_len)
1967                                 {
1968                                 /* can only use this extension if we have a server opaque PRF input
1969                                  * of the same length as the client opaque PRF input! */
1970
1971                                 if (s->tlsext_opaque_prf_input_len == 0)
1972                                         s->s3->server_opaque_prf_input = OPENSSL_malloc(1); /* dummy byte just to get non-NULL */
1973                                 else
1974                                         s->s3->server_opaque_prf_input = BUF_memdup(s->tlsext_opaque_prf_input, s->tlsext_opaque_prf_input_len);
1975                                 if (s->s3->server_opaque_prf_input == NULL)
1976                                         {
1977                                         ret = SSL_TLSEXT_ERR_ALERT_FATAL;
1978                                         al = SSL_AD_INTERNAL_ERROR;
1979                                         goto err;
1980                                         }
1981                                 s->s3->server_opaque_prf_input_len = s->tlsext_opaque_prf_input_len;
1982                                 }
1983                         }
1984
1985                 if (r == 2 && s->s3->server_opaque_prf_input == NULL)
1986                         {
1987                         /* The callback wants to enforce use of the extension,
1988                          * but we can't do that with the client opaque PRF input;
1989                          * abort the handshake.
1990                          */
1991                         ret = SSL_TLSEXT_ERR_ALERT_FATAL;
1992                         al = SSL_AD_HANDSHAKE_FAILURE;
1993                         }
1994         }
1995
1996  err:
1997 #endif
1998         switch (ret)
1999                 {
2000                 case SSL_TLSEXT_ERR_ALERT_FATAL:
2001                         ssl3_send_alert(s,SSL3_AL_FATAL,al);
2002                         return -1;
2003
2004                 case SSL_TLSEXT_ERR_ALERT_WARNING:
2005                         ssl3_send_alert(s,SSL3_AL_WARNING,al);
2006                         return 1;
2007
2008                 case SSL_TLSEXT_ERR_NOACK:
2009                         s->servername_done=0;
2010                         default:
2011                 return 1;
2012                 }
2013         }
2014
2015 int ssl_check_clienthello_tlsext_late(SSL *s)
2016         {
2017         int ret = SSL_TLSEXT_ERR_OK;
2018         int al;
2019
2020         /* If status request then ask callback what to do.
2021          * Note: this must be called after servername callbacks in case
2022          * the certificate has changed, and must be called after the cipher
2023          * has been chosen because this may influence which certificate is sent
2024          */
2025         if ((s->tlsext_status_type != -1) && s->ctx && s->ctx->tlsext_status_cb)
2026                 {
2027                 int r;
2028                 CERT_PKEY *certpkey;
2029                 certpkey = ssl_get_server_send_pkey(s);
2030                 /* If no certificate can't return certificate status */
2031                 if (certpkey == NULL)
2032                         {
2033                         s->tlsext_status_expected = 0;
2034                         return 1;
2035                         }
2036                 /* Set current certificate to one we will use so
2037                  * SSL_get_certificate et al can pick it up.
2038                  */
2039                 s->cert->key = certpkey;
2040                 r = s->ctx->tlsext_status_cb(s, s->ctx->tlsext_status_arg);
2041                 switch (r)
2042                         {
2043                         /* We don't want to send a status request response */
2044                         case SSL_TLSEXT_ERR_NOACK:
2045                                 s->tlsext_status_expected = 0;
2046                                 break;
2047                         /* status request response should be sent */
2048                         case SSL_TLSEXT_ERR_OK:
2049                                 if (s->tlsext_ocsp_resp)
2050                                         s->tlsext_status_expected = 1;
2051                                 else
2052                                         s->tlsext_status_expected = 0;
2053                                 break;
2054                         /* something bad happened */
2055                         case SSL_TLSEXT_ERR_ALERT_FATAL:
2056                                 ret = SSL_TLSEXT_ERR_ALERT_FATAL;
2057                                 al = SSL_AD_INTERNAL_ERROR;
2058                                 goto err;
2059                         }
2060                 }
2061         else
2062                 s->tlsext_status_expected = 0;
2063
2064  err:
2065         switch (ret)
2066                 {
2067                 case SSL_TLSEXT_ERR_ALERT_FATAL:
2068                         ssl3_send_alert(s,SSL3_AL_FATAL,al);
2069                         return -1;
2070
2071                 case SSL_TLSEXT_ERR_ALERT_WARNING:
2072                         ssl3_send_alert(s,SSL3_AL_WARNING,al);
2073                         return 1;
2074
2075                 default:
2076                         return 1;
2077                 }
2078         }
2079
2080 int ssl_check_serverhello_tlsext(SSL *s)
2081         {
2082         int ret=SSL_TLSEXT_ERR_NOACK;
2083         int al = SSL_AD_UNRECOGNIZED_NAME;
2084
2085 #ifndef OPENSSL_NO_EC
2086         /* If we are client and using an elliptic curve cryptography cipher
2087          * suite, then if server returns an EC point formats lists extension
2088          * it must contain uncompressed.
2089          */
2090         unsigned long alg_k = s->s3->tmp.new_cipher->algorithm_mkey;
2091         unsigned long alg_a = s->s3->tmp.new_cipher->algorithm_auth;
2092         if ((s->tlsext_ecpointformatlist != NULL) && (s->tlsext_ecpointformatlist_length > 0) &&
2093             (s->session->tlsext_ecpointformatlist != NULL) && (s->session->tlsext_ecpointformatlist_length > 0) &&
2094             ((alg_k & (SSL_kEECDH|SSL_kECDHr|SSL_kECDHe)) || (alg_a & SSL_aECDSA)))
2095                 {
2096                 /* we are using an ECC cipher */
2097                 size_t i;
2098                 unsigned char *list;
2099                 int found_uncompressed = 0;
2100                 list = s->session->tlsext_ecpointformatlist;
2101                 for (i = 0; i < s->session->tlsext_ecpointformatlist_length; i++)
2102                         {
2103                         if (*(list++) == TLSEXT_ECPOINTFORMAT_uncompressed)
2104                                 {
2105                                 found_uncompressed = 1;
2106                                 break;
2107                                 }
2108                         }
2109                 if (!found_uncompressed)
2110                         {
2111                         SSLerr(SSL_F_SSL_CHECK_SERVERHELLO_TLSEXT,SSL_R_TLS_INVALID_ECPOINTFORMAT_LIST);
2112                         return -1;
2113                         }
2114                 }
2115         ret = SSL_TLSEXT_ERR_OK;
2116 #endif /* OPENSSL_NO_EC */
2117
2118         if (s->ctx != NULL && s->ctx->tlsext_servername_callback != 0)
2119                 ret = s->ctx->tlsext_servername_callback(s, &al, s->ctx->tlsext_servername_arg);
2120         else if (s->initial_ctx != NULL && s->initial_ctx->tlsext_servername_callback != 0)
2121                 ret = s->initial_ctx->tlsext_servername_callback(s, &al, s->initial_ctx->tlsext_servername_arg);
2122
2123 #ifdef TLSEXT_TYPE_opaque_prf_input
2124         if (s->s3->server_opaque_prf_input_len > 0)
2125                 {
2126                 /* This case may indicate that we, as a client, want to insist on using opaque PRF inputs.
2127                  * So first verify that we really have a value from the server too. */
2128
2129                 if (s->s3->server_opaque_prf_input == NULL)
2130                         {
2131                         ret = SSL_TLSEXT_ERR_ALERT_FATAL;
2132                         al = SSL_AD_HANDSHAKE_FAILURE;
2133                         }
2134
2135                 /* Anytime the server *has* sent an opaque PRF input, we need to check
2136                  * that we have a client opaque PRF input of the same size. */
2137                 if (s->s3->client_opaque_prf_input == NULL ||
2138                     s->s3->client_opaque_prf_input_len != s->s3->server_opaque_prf_input_len)
2139                         {
2140                         ret = SSL_TLSEXT_ERR_ALERT_FATAL;
2141                         al = SSL_AD_ILLEGAL_PARAMETER;
2142                         }
2143                 }
2144 #endif
2145
2146         /* If we've requested certificate status and we wont get one
2147          * tell the callback
2148          */
2149         if ((s->tlsext_status_type != -1) && !(s->tlsext_status_expected)
2150                         && s->ctx && s->ctx->tlsext_status_cb)
2151                 {
2152                 int r;
2153                 /* Set resp to NULL, resplen to -1 so callback knows
2154                  * there is no response.
2155                  */
2156                 if (s->tlsext_ocsp_resp)
2157                         {
2158                         OPENSSL_free(s->tlsext_ocsp_resp);
2159                         s->tlsext_ocsp_resp = NULL;
2160                         }
2161                 s->tlsext_ocsp_resplen = -1;
2162                 r = s->ctx->tlsext_status_cb(s, s->ctx->tlsext_status_arg);
2163                 if (r == 0)
2164                         {
2165                         al = SSL_AD_BAD_CERTIFICATE_STATUS_RESPONSE;
2166                         ret = SSL_TLSEXT_ERR_ALERT_FATAL;
2167                         }
2168                 if (r < 0)
2169                         {
2170                         al = SSL_AD_INTERNAL_ERROR;
2171                         ret = SSL_TLSEXT_ERR_ALERT_FATAL;
2172                         }
2173                 }
2174
2175         switch (ret)
2176                 {
2177                 case SSL_TLSEXT_ERR_ALERT_FATAL:
2178                         ssl3_send_alert(s,SSL3_AL_FATAL,al);
2179                         return -1;
2180
2181                 case SSL_TLSEXT_ERR_ALERT_WARNING:
2182                         ssl3_send_alert(s,SSL3_AL_WARNING,al);
2183                         return 1;
2184
2185                 case SSL_TLSEXT_ERR_NOACK:
2186                         s->servername_done=0;
2187                         default:
2188                 return 1;
2189                 }
2190         }
2191
2192 /*-
2193  * Since the server cache lookup is done early on in the processing of the
2194  * ClientHello, and other operations depend on the result, we need to handle
2195  * any TLS session ticket extension at the same time.
2196  *
2197  *   session_id: points at the session ID in the ClientHello. This code will
2198  *       read past the end of this in order to parse out the session ticket
2199  *       extension, if any.
2200  *   len: the length of the session ID.
2201  *   limit: a pointer to the first byte after the ClientHello.
2202  *   ret: (output) on return, if a ticket was decrypted, then this is set to
2203  *       point to the resulting session.
2204  *
2205  * If s->tls_session_secret_cb is set then we are expecting a pre-shared key
2206  * ciphersuite, in which case we have no use for session tickets and one will
2207  * never be decrypted, nor will s->tlsext_ticket_expected be set to 1.
2208  *
2209  * Returns:
2210  *   -1: fatal error, either from parsing or decrypting the ticket.
2211  *    0: no ticket was found (or was ignored, based on settings).
2212  *    1: a zero length extension was found, indicating that the client supports
2213  *       session tickets but doesn't currently have one to offer.
2214  *    2: either s->tls_session_secret_cb was set, or a ticket was offered but
2215  *       couldn't be decrypted because of a non-fatal error.
2216  *    3: a ticket was successfully decrypted and *ret was set.
2217  *
2218  * Side effects:
2219  *   Sets s->tlsext_ticket_expected to 1 if the server will have to issue
2220  *   a new session ticket to the client because the client indicated support
2221  *   (and s->tls_session_secret_cb is NULL) but the client either doesn't have
2222  *   a session ticket or we couldn't use the one it gave us, or if
2223  *   s->ctx->tlsext_ticket_key_cb asked to renew the client's ticket.
2224  *   Otherwise, s->tlsext_ticket_expected is set to 0.
2225  */
2226 int tls1_process_ticket(SSL *s, unsigned char *session_id, int len,
2227                         const unsigned char *limit, SSL_SESSION **ret)
2228         {
2229         /* Point after session ID in client hello */
2230         const unsigned char *p = session_id + len;
2231         unsigned short i;
2232
2233         *ret = NULL;
2234         s->tlsext_ticket_expected = 0;
2235
2236         /* If tickets disabled behave as if no ticket present
2237          * to permit stateful resumption.
2238          */
2239         if (SSL_get_options(s) & SSL_OP_NO_TICKET)
2240                 return 0;
2241         if ((s->version <= SSL3_VERSION) || !limit)
2242                 return 0;
2243         if (p >= limit)
2244                 return -1;
2245         /* Skip past DTLS cookie */
2246         if (s->version == DTLS1_VERSION || s->version == DTLS1_BAD_VER)
2247                 {
2248                 i = *(p++);
2249                 p+= i;
2250                 if (p >= limit)
2251                         return -1;
2252                 }
2253         /* Skip past cipher list */
2254         n2s(p, i);
2255         p+= i;
2256         if (p >= limit)
2257                 return -1;
2258         /* Skip past compression algorithm list */
2259         i = *(p++);
2260         p += i;
2261         if (p > limit)
2262                 return -1;
2263         /* Now at start of extensions */
2264         if ((p + 2) >= limit)
2265                 return 0;
2266         n2s(p, i);
2267         while ((p + 4) <= limit)
2268                 {
2269                 unsigned short type, size;
2270                 n2s(p, type);
2271                 n2s(p, size);
2272                 if (p + size > limit)
2273                         return 0;
2274                 if (type == TLSEXT_TYPE_session_ticket)
2275                         {
2276                         int r;
2277                         if (size == 0)
2278                                 {
2279                                 /* The client will accept a ticket but doesn't
2280                                  * currently have one. */
2281                                 s->tlsext_ticket_expected = 1;
2282                                 return 1;
2283                                 }
2284                         if (s->tls_session_secret_cb)
2285                                 {
2286                                 /* Indicate that the ticket couldn't be
2287                                  * decrypted rather than generating the session
2288                                  * from ticket now, trigger abbreviated
2289                                  * handshake based on external mechanism to
2290                                  * calculate the master secret later. */
2291                                 return 2;
2292                                 }
2293                         r = tls_decrypt_ticket(s, p, size, session_id, len, ret);
2294                         switch (r)
2295                                 {
2296                                 case 2: /* ticket couldn't be decrypted */
2297                                         s->tlsext_ticket_expected = 1;
2298                                         return 2;
2299                                 case 3: /* ticket was decrypted */
2300                                         return r;
2301                                 case 4: /* ticket decrypted but need to renew */
2302                                         s->tlsext_ticket_expected = 1;
2303                                         return 3;
2304                                 default: /* fatal error */
2305                                         return -1;
2306                                 }
2307                         }
2308                 p += size;
2309                 }
2310         return 0;
2311         }
2312
2313 /*-
2314  * tls_decrypt_ticket attempts to decrypt a session ticket.
2315  *
2316  *   etick: points to the body of the session ticket extension.
2317  *   eticklen: the length of the session tickets extenion.
2318  *   sess_id: points at the session ID.
2319  *   sesslen: the length of the session ID.
2320  *   psess: (output) on return, if a ticket was decrypted, then this is set to
2321  *       point to the resulting session.
2322  *
2323  * Returns:
2324  *   -1: fatal error, either from parsing or decrypting the ticket.
2325  *    2: the ticket couldn't be decrypted.
2326  *    3: a ticket was successfully decrypted and *psess was set.
2327  *    4: same as 3, but the ticket needs to be renewed.
2328  */
2329 static int tls_decrypt_ticket(SSL *s, const unsigned char *etick, int eticklen,
2330                                 const unsigned char *sess_id, int sesslen,
2331                                 SSL_SESSION **psess)
2332         {
2333         SSL_SESSION *sess;
2334         unsigned char *sdec;
2335         const unsigned char *p;
2336         int slen, mlen, renew_ticket = 0;
2337         unsigned char tick_hmac[EVP_MAX_MD_SIZE];
2338         HMAC_CTX hctx;
2339         EVP_CIPHER_CTX ctx;
2340         SSL_CTX *tctx = s->initial_ctx;
2341         /* Need at least keyname + iv + some encrypted data */
2342         if (eticklen < 48)
2343                 return 2;
2344         /* Initialize session ticket encryption and HMAC contexts */
2345         HMAC_CTX_init(&hctx);
2346         EVP_CIPHER_CTX_init(&ctx);
2347         if (tctx->tlsext_ticket_key_cb)
2348                 {
2349                 unsigned char *nctick = (unsigned char *)etick;
2350                 int rv = tctx->tlsext_ticket_key_cb(s, nctick, nctick + 16,
2351                                                         &ctx, &hctx, 0);
2352                 if (rv < 0)
2353                         return -1;
2354                 if (rv == 0)
2355                         return 2;
2356                 if (rv == 2)
2357                         renew_ticket = 1;
2358                 }
2359         else
2360                 {
2361                 /* Check key name matches */
2362                 if (memcmp(etick, tctx->tlsext_tick_key_name, 16))
2363                         return 2;
2364                 HMAC_Init_ex(&hctx, tctx->tlsext_tick_hmac_key, 16,
2365                                         tlsext_tick_md(), NULL);
2366                 EVP_DecryptInit_ex(&ctx, EVP_aes_128_cbc(), NULL,
2367                                 tctx->tlsext_tick_aes_key, etick + 16);
2368                 }
2369         /* Attempt to process session ticket, first conduct sanity and
2370          * integrity checks on ticket.
2371          */
2372         mlen = HMAC_size(&hctx);
2373         if (mlen < 0)
2374                 {
2375                 EVP_CIPHER_CTX_cleanup(&ctx);
2376                 return -1;
2377                 }
2378         eticklen -= mlen;
2379         /* Check HMAC of encrypted ticket */
2380         HMAC_Update(&hctx, etick, eticklen);
2381         HMAC_Final(&hctx, tick_hmac, NULL);
2382         HMAC_CTX_cleanup(&hctx);
2383         if (CRYPTO_memcmp(tick_hmac, etick + eticklen, mlen))
2384                 {
2385                 EVP_CIPHER_CTX_cleanup(&ctx);
2386                 return 2;
2387                 }
2388         /* Attempt to decrypt session data */
2389         /* Move p after IV to start of encrypted ticket, update length */
2390         p = etick + 16 + EVP_CIPHER_CTX_iv_length(&ctx);
2391         eticklen -= 16 + EVP_CIPHER_CTX_iv_length(&ctx);
2392         sdec = OPENSSL_malloc(eticklen);
2393         if (!sdec)
2394                 {
2395                 EVP_CIPHER_CTX_cleanup(&ctx);
2396                 return -1;
2397                 }
2398         EVP_DecryptUpdate(&ctx, sdec, &slen, p, eticklen);
2399         if (EVP_DecryptFinal(&ctx, sdec + slen, &mlen) <= 0)
2400                 {
2401                 EVP_CIPHER_CTX_cleanup(&ctx);
2402                 OPENSSL_free(sdec);
2403                 return 2;
2404                 }
2405         slen += mlen;
2406         EVP_CIPHER_CTX_cleanup(&ctx);
2407         p = sdec;
2408
2409         sess = d2i_SSL_SESSION(NULL, &p, slen);
2410         OPENSSL_free(sdec);
2411         if (sess)
2412                 {
2413                 /* The session ID, if non-empty, is used by some clients to
2414                  * detect that the ticket has been accepted. So we copy it to
2415                  * the session structure. If it is empty set length to zero
2416                  * as required by standard.
2417                  */
2418                 if (sesslen)
2419                         memcpy(sess->session_id, sess_id, sesslen);
2420                 sess->session_id_length = sesslen;
2421                 *psess = sess;
2422                 if (renew_ticket)
2423                         return 4;
2424                 else
2425                         return 3;
2426                 }
2427         ERR_clear_error();
2428         /* For session parse failure, indicate that we need to send a new
2429          * ticket. */
2430         return 2;
2431         }
2432
2433 /* Tables to translate from NIDs to TLS v1.2 ids */
2434
2435 typedef struct
2436         {
2437         int nid;
2438         int id;
2439         } tls12_lookup;
2440
2441 static tls12_lookup tls12_md[] = {
2442 #ifndef OPENSSL_NO_MD5
2443         {NID_md5, TLSEXT_hash_md5},
2444 #endif
2445 #ifndef OPENSSL_NO_SHA
2446         {NID_sha1, TLSEXT_hash_sha1},
2447 #endif
2448 #ifndef OPENSSL_NO_SHA256
2449         {NID_sha224, TLSEXT_hash_sha224},
2450         {NID_sha256, TLSEXT_hash_sha256},
2451 #endif
2452 #ifndef OPENSSL_NO_SHA512
2453         {NID_sha384, TLSEXT_hash_sha384},
2454         {NID_sha512, TLSEXT_hash_sha512}
2455 #endif
2456 };
2457
2458 static tls12_lookup tls12_sig[] = {
2459 #ifndef OPENSSL_NO_RSA
2460         {EVP_PKEY_RSA, TLSEXT_signature_rsa},
2461 #endif
2462 #ifndef OPENSSL_NO_DSA
2463         {EVP_PKEY_DSA, TLSEXT_signature_dsa},
2464 #endif
2465 #ifndef OPENSSL_NO_ECDSA
2466         {EVP_PKEY_EC, TLSEXT_signature_ecdsa}
2467 #endif
2468 };
2469
2470 static int tls12_find_id(int nid, tls12_lookup *table, size_t tlen)
2471         {
2472         size_t i;
2473         for (i = 0; i < tlen; i++)
2474                 {
2475                 if (table[i].nid == nid)
2476                         return table[i].id;
2477                 }
2478         return -1;
2479         }
2480 #if 0
2481 static int tls12_find_nid(int id, tls12_lookup *table, size_t tlen)
2482         {
2483         size_t i;
2484         for (i = 0; i < tlen; i++)
2485                 {
2486                 if (table[i].id == id)
2487                         return table[i].nid;
2488                 }
2489         return -1;
2490         }
2491 #endif
2492
2493 int tls12_get_sigandhash(unsigned char *p, const EVP_PKEY *pk, const EVP_MD *md)
2494         {
2495         int sig_id, md_id;
2496         if (!md)
2497                 return 0;
2498         md_id = tls12_find_id(EVP_MD_type(md), tls12_md,
2499                                 sizeof(tls12_md)/sizeof(tls12_lookup));
2500         if (md_id == -1)
2501                 return 0;
2502         sig_id = tls12_get_sigid(pk);
2503         if (sig_id == -1)
2504                 return 0;
2505         p[0] = (unsigned char)md_id;
2506         p[1] = (unsigned char)sig_id;
2507         return 1;
2508         }
2509
2510 int tls12_get_sigid(const EVP_PKEY *pk)
2511         {
2512         return tls12_find_id(pk->type, tls12_sig,
2513                                 sizeof(tls12_sig)/sizeof(tls12_lookup));
2514         }
2515
2516 const EVP_MD *tls12_get_hash(unsigned char hash_alg)
2517         {
2518         switch(hash_alg)
2519                 {
2520 #ifndef OPENSSL_NO_SHA
2521                 case TLSEXT_hash_sha1:
2522                 return EVP_sha1();
2523 #endif
2524 #ifndef OPENSSL_NO_SHA256
2525                 case TLSEXT_hash_sha224:
2526                 return EVP_sha224();
2527
2528                 case TLSEXT_hash_sha256:
2529                 return EVP_sha256();
2530 #endif
2531 #ifndef OPENSSL_NO_SHA512
2532                 case TLSEXT_hash_sha384:
2533                 return EVP_sha384();
2534
2535                 case TLSEXT_hash_sha512:
2536                 return EVP_sha512();
2537 #endif
2538                 default:
2539                 return NULL;
2540
2541                 }
2542         }
2543
2544 /* Set preferred digest for each key type */
2545
2546 int tls1_process_sigalgs(SSL *s, const unsigned char *data, int dsize)
2547         {
2548         int i, idx;
2549         const EVP_MD *md;
2550         CERT *c = s->cert;
2551         /* Extension ignored for TLS versions below 1.2 */
2552         if (TLS1_get_version(s) < TLS1_2_VERSION)
2553                 return 1;
2554         /* Should never happen */
2555         if (!c)
2556                 return 0;
2557
2558         c->pkeys[SSL_PKEY_DSA_SIGN].digest = NULL;
2559         c->pkeys[SSL_PKEY_RSA_SIGN].digest = NULL;
2560         c->pkeys[SSL_PKEY_RSA_ENC].digest = NULL;
2561         c->pkeys[SSL_PKEY_ECC].digest = NULL;
2562
2563         for (i = 0; i < dsize; i += 2)
2564                 {
2565                 unsigned char hash_alg = data[i], sig_alg = data[i+1];
2566
2567                 switch(sig_alg)
2568                         {
2569 #ifndef OPENSSL_NO_RSA
2570                         case TLSEXT_signature_rsa:
2571                         idx = SSL_PKEY_RSA_SIGN;
2572                         break;
2573 #endif
2574 #ifndef OPENSSL_NO_DSA
2575                         case TLSEXT_signature_dsa:
2576                         idx = SSL_PKEY_DSA_SIGN;
2577                         break;
2578 #endif
2579 #ifndef OPENSSL_NO_ECDSA
2580                         case TLSEXT_signature_ecdsa:
2581                         idx = SSL_PKEY_ECC;
2582                         break;
2583 #endif
2584                         default:
2585                         continue;
2586                         }
2587
2588                 if (c->pkeys[idx].digest == NULL)
2589                         {
2590                         md = tls12_get_hash(hash_alg);
2591                         if (md)
2592                                 {
2593                                 c->pkeys[idx].digest = md;
2594                                 if (idx == SSL_PKEY_RSA_SIGN)
2595                                         c->pkeys[SSL_PKEY_RSA_ENC].digest = md;
2596                                 }
2597                         }
2598
2599                 }
2600
2601
2602         /* Set any remaining keys to default values. NOTE: if alg is not
2603          * supported it stays as NULL.
2604          */
2605 #ifndef OPENSSL_NO_DSA
2606         if (!c->pkeys[SSL_PKEY_DSA_SIGN].digest)
2607                 c->pkeys[SSL_PKEY_DSA_SIGN].digest = EVP_sha1();
2608 #endif
2609 #ifndef OPENSSL_NO_RSA
2610         if (!c->pkeys[SSL_PKEY_RSA_SIGN].digest)
2611                 {
2612                 c->pkeys[SSL_PKEY_RSA_SIGN].digest = EVP_sha1();
2613                 c->pkeys[SSL_PKEY_RSA_ENC].digest = EVP_sha1();
2614                 }
2615 #endif
2616 #ifndef OPENSSL_NO_ECDSA
2617         if (!c->pkeys[SSL_PKEY_ECC].digest)
2618                 c->pkeys[SSL_PKEY_ECC].digest = EVP_sha1();
2619 #endif
2620         return 1;
2621         }
2622
2623 #endif
2624
2625 #ifndef OPENSSL_NO_HEARTBEATS
2626 int
2627 tls1_process_heartbeat(SSL *s)
2628         {
2629         unsigned char *p = &s->s3->rrec.data[0], *pl;
2630         unsigned short hbtype;
2631         unsigned int payload;
2632         unsigned int padding = 16; /* Use minimum padding */
2633
2634         if (s->msg_callback)
2635                 s->msg_callback(0, s->version, TLS1_RT_HEARTBEAT,
2636                         &s->s3->rrec.data[0], s->s3->rrec.length,
2637                         s, s->msg_callback_arg);
2638
2639         /* Read type and payload length first */
2640         if (1 + 2 + 16 > s->s3->rrec.length)
2641                 return 0; /* silently discard */
2642         hbtype = *p++;
2643         n2s(p, payload);
2644         if (1 + 2 + payload + 16 > s->s3->rrec.length)
2645                 return 0; /* silently discard per RFC 6520 sec. 4 */
2646         pl = p;
2647
2648         if (hbtype == TLS1_HB_REQUEST)
2649                 {
2650                 unsigned char *buffer, *bp;
2651                 int r;
2652
2653                 /* Allocate memory for the response, size is 1 bytes
2654                  * message type, plus 2 bytes payload length, plus
2655                  * payload, plus padding
2656                  */
2657                 buffer = OPENSSL_malloc(1 + 2 + payload + padding);
2658                 bp = buffer;
2659
2660                 /* Enter response type, length and copy payload */
2661                 *bp++ = TLS1_HB_RESPONSE;
2662                 s2n(payload, bp);
2663                 memcpy(bp, pl, payload);
2664                 bp += payload;
2665                 /* Random padding */
2666                 RAND_pseudo_bytes(bp, padding);
2667
2668                 r = ssl3_write_bytes(s, TLS1_RT_HEARTBEAT, buffer, 3 + payload + padding);
2669
2670                 if (r >= 0 && s->msg_callback)
2671                         s->msg_callback(1, s->version, TLS1_RT_HEARTBEAT,
2672                                 buffer, 3 + payload + padding,
2673                                 s, s->msg_callback_arg);
2674
2675                 OPENSSL_free(buffer);
2676
2677                 if (r < 0)
2678                         return r;
2679                 }
2680         else if (hbtype == TLS1_HB_RESPONSE)
2681                 {
2682                 unsigned int seq;
2683
2684                 /* We only send sequence numbers (2 bytes unsigned int),
2685                  * and 16 random bytes, so we just try to read the
2686                  * sequence number */
2687                 n2s(pl, seq);
2688
2689                 if (payload == 18 && seq == s->tlsext_hb_seq)
2690                         {
2691                         s->tlsext_hb_seq++;
2692                         s->tlsext_hb_pending = 0;
2693                         }
2694                 }
2695
2696         return 0;
2697         }
2698
2699 int
2700 tls1_heartbeat(SSL *s)
2701         {
2702         unsigned char *buf, *p;
2703         int ret;
2704         unsigned int payload = 18; /* Sequence number + random bytes */
2705         unsigned int padding = 16; /* Use minimum padding */
2706
2707         /* Only send if peer supports and accepts HB requests... */
2708         if (!(s->tlsext_heartbeat & SSL_TLSEXT_HB_ENABLED) ||
2709             s->tlsext_heartbeat & SSL_TLSEXT_HB_DONT_SEND_REQUESTS)
2710                 {
2711                 SSLerr(SSL_F_TLS1_HEARTBEAT,SSL_R_TLS_HEARTBEAT_PEER_DOESNT_ACCEPT);
2712                 return -1;
2713                 }
2714
2715         /* ...and there is none in flight yet... */
2716         if (s->tlsext_hb_pending)
2717                 {
2718                 SSLerr(SSL_F_TLS1_HEARTBEAT,SSL_R_TLS_HEARTBEAT_PENDING);
2719                 return -1;
2720                 }
2721
2722         /* ...and no handshake in progress. */
2723         if (SSL_in_init(s) || s->in_handshake)
2724                 {
2725                 SSLerr(SSL_F_TLS1_HEARTBEAT,SSL_R_UNEXPECTED_MESSAGE);
2726                 return -1;
2727                 }
2728
2729         /* Check if padding is too long, payload and padding
2730          * must not exceed 2^14 - 3 = 16381 bytes in total.
2731          */
2732         OPENSSL_assert(payload + padding <= 16381);
2733
2734         /*-
2735          * Create HeartBeat message, we just use a sequence number
2736          * as payload to distuingish different messages and add
2737          * some random stuff.
2738          *  - Message Type, 1 byte
2739          *  - Payload Length, 2 bytes (unsigned int)
2740          *  - Payload, the sequence number (2 bytes uint)
2741          *  - Payload, random bytes (16 bytes uint)
2742          *  - Padding
2743          */
2744         buf = OPENSSL_malloc(1 + 2 + payload + padding);
2745         p = buf;
2746         /* Message Type */
2747         *p++ = TLS1_HB_REQUEST;
2748         /* Payload length (18 bytes here) */
2749         s2n(payload, p);
2750         /* Sequence number */
2751         s2n(s->tlsext_hb_seq, p);
2752         /* 16 random bytes */
2753         RAND_pseudo_bytes(p, 16);
2754         p += 16;
2755         /* Random padding */
2756         RAND_pseudo_bytes(p, padding);
2757
2758         ret = ssl3_write_bytes(s, TLS1_RT_HEARTBEAT, buf, 3 + payload + padding);
2759         if (ret >= 0)
2760                 {
2761                 if (s->msg_callback)
2762                         s->msg_callback(1, s->version, TLS1_RT_HEARTBEAT,
2763                                 buf, 3 + payload + padding,
2764                                 s, s->msg_callback_arg);
2765
2766                 s->tlsext_hb_pending = 1;
2767                 }
2768
2769         OPENSSL_free(buf);
2770
2771         return ret;
2772         }
2773 #endif