ssl/t1_lib.c

   1 /* ssl/t1_lib.c */
   2 /* Copyright (C) 1995-1998 Eric Young (eay@cryptsoft.com)
   3  * All rights reserved.
   4  *
   5  * This package is an SSL implementation written
   6  * by Eric Young (eay@cryptsoft.com).
   7  * The implementation was written so as to conform with Netscapes SSL.
   8  *
   9  * This library is free for commercial and non-commercial use as long as
  10  * the following conditions are aheared to.  The following conditions
  11  * apply to all code found in this distribution, be it the RC4, RSA,
  12  * lhash, DES, etc., code; not just the SSL code.  The SSL documentation
  13  * included with this distribution is covered by the same copyright terms
  14  * except that the holder is Tim Hudson (tjh@cryptsoft.com).
  15  *
  16  * Copyright remains Eric Young's, and as such any Copyright notices in
  17  * the code are not to be removed.
  18  * If this package is used in a product, Eric Young should be given attribution
  19  * as the author of the parts of the library used.
  20  * This can be in the form of a textual message at program startup or
  21  * in documentation (online or textual) provided with the package.
  22  *
  23  * Redistribution and use in source and binary forms, with or without
  24  * modification, are permitted provided that the following conditions
  25  * are met:
  26  * 1. Redistributions of source code must retain the copyright
  27  *    notice, this list of conditions and the following disclaimer.
  28  * 2. Redistributions in binary form must reproduce the above copyright
  29  *    notice, this list of conditions and the following disclaimer in the
  30  *    documentation and/or other materials provided with the distribution.
  31  * 3. All advertising materials mentioning features or use of this software
  32  *    must display the following acknowledgement:
  33  *    "This product includes cryptographic software written by
  34  *     Eric Young (eay@cryptsoft.com)"
  35  *    The word 'cryptographic' can be left out if the rouines from the library
  36  *    being used are not cryptographic related :-).
  37  * 4. If you include any Windows specific code (or a derivative thereof) from
  38  *    the apps directory (application code) you must include an acknowledgement:
  39  *    "This product includes software written by Tim Hudson (tjh@cryptsoft.com)"
  40  *
  41  * THIS SOFTWARE IS PROVIDED BY ERIC YOUNG ``AS IS'' AND
  42  * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
  43  * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
  44  * ARE DISCLAIMED.  IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE
  45  * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
  46  * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
  47  * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
  48  * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
  49  * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
  50  * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
  51  * SUCH DAMAGE.
  52  *
  53  * The licence and distribution terms for any publically available version or
  54  * derivative of this code cannot be changed.  i.e. this code cannot simply be
  55  * copied and put under another distribution licence
  56  * [including the GNU Public Licence.]
  57  */
  58 /* ====================================================================
  59  * Copyright (c) 1998-2007 The OpenSSL Project.  All rights reserved.
  60  *
  61  * Redistribution and use in source and binary forms, with or without
  62  * modification, are permitted provided that the following conditions
  63  * are met:
  64  *
  65  * 1. Redistributions of source code must retain the above copyright
  66  *    notice, this list of conditions and the following disclaimer.
  67  *
  68  * 2. Redistributions in binary form must reproduce the above copyright
  69  *    notice, this list of conditions and the following disclaimer in
  70  *    the documentation and/or other materials provided with the
  71  *    distribution.
  72  *
  73  * 3. All advertising materials mentioning features or use of this
  74  *    software must display the following acknowledgment:
  75  *    "This product includes software developed by the OpenSSL Project
  76  *    for use in the OpenSSL Toolkit. (http://www.openssl.org/)"
  77  *
  78  * 4. The names "OpenSSL Toolkit" and "OpenSSL Project" must not be used to
  79  *    endorse or promote products derived from this software without
  80  *    prior written permission. For written permission, please contact
  81  *    openssl-core@openssl.org.
  82  *
  83  * 5. Products derived from this software may not be called "OpenSSL"
  84  *    nor may "OpenSSL" appear in their names without prior written
  85  *    permission of the OpenSSL Project.
  86  *
  87  * 6. Redistributions of any form whatsoever must retain the following
  88  *    acknowledgment:
  89  *    "This product includes software developed by the OpenSSL Project
  90  *    for use in the OpenSSL Toolkit (http://www.openssl.org/)"
  91  *
  92  * THIS SOFTWARE IS PROVIDED BY THE OpenSSL PROJECT ``AS IS'' AND ANY
  93  * EXPRESSED OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
  94  * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
  95  * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL THE OpenSSL PROJECT OR
  96  * ITS CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
  97  * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
  98  * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
  99  * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
 100  * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT,
 101  * STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
 102  * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED
 103  * OF THE POSSIBILITY OF SUCH DAMAGE.
 104  * ====================================================================
 105  *
 106  * This product includes cryptographic software written by Eric Young
 107  * (eay@cryptsoft.com).  This product includes software written by Tim
 108  * Hudson (tjh@cryptsoft.com).
 109  *
 110  */
 111
 112 #include <stdio.h>
 113 #include <openssl/objects.h>
 114 #include <openssl/evp.h>
 115 #include <openssl/hmac.h>
 116 #include <openssl/ocsp.h>
 117 #include <openssl/rand.h>
 118 #include "ssl_locl.h"
 119
 120 const char tls1_version_str[]="TLSv1" OPENSSL_VERSION_PTEXT;
 121
 122 #ifndef OPENSSL_NO_TLSEXT
 123 static int tls_decrypt_ticket(SSL *s, const unsigned char *tick, int ticklen,
 124                                 const unsigned char *sess_id, int sesslen,
 125                                 SSL_SESSION **psess);
 126 static int ssl_check_clienthello_tlsext(SSL *s);
 127 int ssl_check_serverhello_tlsext(SSL *s);
 128 #endif
 129
 130 SSL3_ENC_METHOD TLSv1_enc_data={
 131         tls1_enc,
 132         tls1_mac,
 133         tls1_setup_key_block,
 134         tls1_generate_master_secret,
 135         tls1_change_cipher_state,
 136         tls1_final_finish_mac,
 137         TLS1_FINISH_MAC_LENGTH,
 138         tls1_cert_verify_mac,
 139         TLS_MD_CLIENT_FINISH_CONST,TLS_MD_CLIENT_FINISH_CONST_SIZE,
 140         TLS_MD_SERVER_FINISH_CONST,TLS_MD_SERVER_FINISH_CONST_SIZE,
 141         tls1_alert_code,
 142         tls1_export_keying_material,
 143         };
 144
 145 long tls1_default_timeout(void)
 146         {
 147         /* 2 hours, the 24 hours mentioned in the TLSv1 spec
 148          * is way too long for http, the cache would over fill */
 149         return(60*60*2);
 150         }
 151
 152 int tls1_new(SSL *s)
 153         {
 154         if (!ssl3_new(s)) return(0);
 155         s->method->ssl_clear(s);
 156         return(1);
 157         }
 158
 159 void tls1_free(SSL *s)
 160         {
 161 #ifndef OPENSSL_NO_TLSEXT
 162         if (s->tlsext_session_ticket)
 163                 {
 164                 OPENSSL_free(s->tlsext_session_ticket);
 165                 }
 166 #endif /* OPENSSL_NO_TLSEXT */
 167         ssl3_free(s);
 168         }
 169
 170 void tls1_clear(SSL *s)
 171         {
 172         ssl3_clear(s);
 173         s->version = s->method->version;
 174         }
 175
 176 #ifndef OPENSSL_NO_EC
 177
 178 static int nid_list[] =
 179         {
 180                 NID_sect163k1, /* sect163k1 (1) */
 181                 NID_sect163r1, /* sect163r1 (2) */
 182                 NID_sect163r2, /* sect163r2 (3) */
 183                 NID_sect193r1, /* sect193r1 (4) */
 184                 NID_sect193r2, /* sect193r2 (5) */
 185                 NID_sect233k1, /* sect233k1 (6) */
 186                 NID_sect233r1, /* sect233r1 (7) */
 187                 NID_sect239k1, /* sect239k1 (8) */
 188                 NID_sect283k1, /* sect283k1 (9) */
 189                 NID_sect283r1, /* sect283r1 (10) */
 190                 NID_sect409k1, /* sect409k1 (11) */
 191                 NID_sect409r1, /* sect409r1 (12) */
 192                 NID_sect571k1, /* sect571k1 (13) */
 193                 NID_sect571r1, /* sect571r1 (14) */
 194                 NID_secp160k1, /* secp160k1 (15) */
 195                 NID_secp160r1, /* secp160r1 (16) */
 196                 NID_secp160r2, /* secp160r2 (17) */
 197                 NID_secp192k1, /* secp192k1 (18) */
 198                 NID_X9_62_prime192v1, /* secp192r1 (19) */
 199                 NID_secp224k1, /* secp224k1 (20) */
 200                 NID_secp224r1, /* secp224r1 (21) */
 201                 NID_secp256k1, /* secp256k1 (22) */
 202                 NID_X9_62_prime256v1, /* secp256r1 (23) */
 203                 NID_secp384r1, /* secp384r1 (24) */
 204                 NID_secp521r1  /* secp521r1 (25) */
 205         };
 206
 207
 208 static const unsigned char ecformats_default[] =
 209         {
 210         TLSEXT_ECPOINTFORMAT_uncompressed,
 211         TLSEXT_ECPOINTFORMAT_ansiX962_compressed_prime,
 212         TLSEXT_ECPOINTFORMAT_ansiX962_compressed_char2
 213         };
 214
 215 static const unsigned char eccurves_default[] =
 216         {
 217                 0,14, /* sect571r1 (14) */
 218                 0,13, /* sect571k1 (13) */
 219                 0,25, /* secp521r1 (25) */
 220                 0,11, /* sect409k1 (11) */
 221                 0,12, /* sect409r1 (12) */
 222                 0,24, /* secp384r1 (24) */
 223                 0,9,  /* sect283k1 (9) */
 224                 0,10, /* sect283r1 (10) */
 225                 0,22, /* secp256k1 (22) */
 226                 0,23, /* secp256r1 (23) */
 227                 0,8,  /* sect239k1 (8) */
 228                 0,6,  /* sect233k1 (6) */
 229                 0,7,  /* sect233r1 (7) */
 230                 0,20, /* secp224k1 (20) */
 231                 0,21, /* secp224r1 (21) */
 232                 0,4,  /* sect193r1 (4) */
 233                 0,5,  /* sect193r2 (5) */
 234                 0,18, /* secp192k1 (18) */
 235                 0,19, /* secp192r1 (19) */
 236                 0,1,  /* sect163k1 (1) */
 237                 0,2,  /* sect163r1 (2) */
 238                 0,3,  /* sect163r2 (3) */
 239                 0,15, /* secp160k1 (15) */
 240                 0,16, /* secp160r1 (16) */
 241                 0,17, /* secp160r2 (17) */
 242         };
 243
 244 int tls1_ec_curve_id2nid(int curve_id)
 245         {
 246         /* ECC curves from draft-ietf-tls-ecc-12.txt (Oct. 17, 2005) */
 247         if ((curve_id < 1) || ((unsigned int)curve_id >
 248                                 sizeof(nid_list)/sizeof(nid_list[0])))
 249                 return 0;
 250         return nid_list[curve_id-1];
 251         }
 252
 253 int tls1_ec_nid2curve_id(int nid)
 254         {
 255         /* ECC curves from draft-ietf-tls-ecc-12.txt (Oct. 17, 2005) */
 256         switch (nid)
 257                 {
 258         case NID_sect163k1: /* sect163k1 (1) */
 259                 return 1;
 260         case NID_sect163r1: /* sect163r1 (2) */
 261                 return 2;
 262         case NID_sect163r2: /* sect163r2 (3) */
 263                 return 3;
 264         case NID_sect193r1: /* sect193r1 (4) */
 265                 return 4;
 266         case NID_sect193r2: /* sect193r2 (5) */
 267                 return 5;
 268         case NID_sect233k1: /* sect233k1 (6) */
 269                 return 6;
 270         case NID_sect233r1: /* sect233r1 (7) */
 271                 return 7;
 272         case NID_sect239k1: /* sect239k1 (8) */
 273                 return 8;
 274         case NID_sect283k1: /* sect283k1 (9) */
 275                 return 9;
 276         case NID_sect283r1: /* sect283r1 (10) */
 277                 return 10;
 278         case NID_sect409k1: /* sect409k1 (11) */
 279                 return 11;
 280         case NID_sect409r1: /* sect409r1 (12) */
 281                 return 12;
 282         case NID_sect571k1: /* sect571k1 (13) */
 283                 return 13;
 284         case NID_sect571r1: /* sect571r1 (14) */
 285                 return 14;
 286         case NID_secp160k1: /* secp160k1 (15) */
 287                 return 15;
 288         case NID_secp160r1: /* secp160r1 (16) */
 289                 return 16;
 290         case NID_secp160r2: /* secp160r2 (17) */
 291                 return 17;
 292         case NID_secp192k1: /* secp192k1 (18) */
 293                 return 18;
 294         case NID_X9_62_prime192v1: /* secp192r1 (19) */
 295                 return 19;
 296         case NID_secp224k1: /* secp224k1 (20) */
 297                 return 20;
 298         case NID_secp224r1: /* secp224r1 (21) */
 299                 return 21;
 300         case NID_secp256k1: /* secp256k1 (22) */
 301                 return 22;
 302         case NID_X9_62_prime256v1: /* secp256r1 (23) */
 303                 return 23;
 304         case NID_secp384r1: /* secp384r1 (24) */
 305                 return 24;
 306         case NID_secp521r1:  /* secp521r1 (25) */
 307                 return 25;
 308         default:
 309                 return 0;
 310                 }
 311         }
 312 /* Get curves list, if "sess" is set return client curves otherwise
 313  * preferred list
 314  */
 315 static void tls1_get_curvelist(SSL *s, int sess,
 316                                         const unsigned char **pcurves,
 317                                         size_t *pcurveslen)
 318         {
 319         if (sess)
 320                 {
 321                 *pcurves = s->session->tlsext_ellipticcurvelist;
 322                 *pcurveslen = s->session->tlsext_ellipticcurvelist_length;
 323                 }
 324         else
 325                 {
 326                 *pcurves = s->tlsext_ellipticcurvelist;
 327                 *pcurveslen = s->tlsext_ellipticcurvelist_length;
 328                 }
 329         /* If not set use default: for now static structure */
 330         if (!*pcurves)
 331                 {
 332                 *pcurves = eccurves_default;
 333                 *pcurveslen = sizeof(eccurves_default);
 334                 }
 335         }
 336
 337 /* Return nth shared curve. If nmatch == -1 return number of
 338  * matches.
 339  */
 340
 341 int tls1_shared_curve(SSL *s, int nmatch)
 342         {
 343         const unsigned char *pref, *supp;
 344         size_t preflen, supplen, i, j;
 345         int k;
 346         /* Can't do anything on client side */
 347         if (s->server == 0)
 348                 return -1;
 349         tls1_get_curvelist(s, !!(s->options & SSL_OP_CIPHER_SERVER_PREFERENCE),
 350                                 &supp, &supplen);
 351         tls1_get_curvelist(s, !(s->options & SSL_OP_CIPHER_SERVER_PREFERENCE),
 352                                 &pref, &preflen);
 353         preflen /= 2;
 354         supplen /= 2;
 355         k = 0;
 356         for (i = 0; i < preflen; i++, pref+=2)
 357                 {
 358                 const unsigned char *tsupp = supp;
 359                 for (j = 0; j < supplen; j++, tsupp+=2)
 360                         {
 361                         if (pref[0] == tsupp[0] && pref[1] == tsupp[1])
 362                                 {
 363                                 if (nmatch == k)
 364                                         {
 365                                         int id = (pref[0] << 8) | pref[1];
 366                                         return tls1_ec_curve_id2nid(id);
 367                                         }
 368                                 k++;
 369                                 }
 370                         }
 371                 }
 372         if (nmatch == -1)
 373                 return k;
 374         return 0;
 375         }
 376
 377 int tls1_set_curves(unsigned char **pext, size_t *pextlen,
 378                         int *curves, size_t ncurves)
 379         {
 380         unsigned char *clist, *p;
 381         size_t i;
 382         /* Bitmap of curves included to detect duplicates: only works
 383          * while curve ids < 32
 384          */
 385         unsigned long dup_list = 0;
 386         clist = OPENSSL_malloc(ncurves * 2);
 387         if (!clist)
 388                 return 0;
 389         for (i = 0, p = clist; i < ncurves; i++)
 390                 {
 391                 unsigned long idmask;
 392                 int id;
 393                 id = tls1_ec_nid2curve_id(curves[i]);
 394                 idmask = 1L << id;
 395                 if (!id || (dup_list & idmask))
 396                         {
 397                         OPENSSL_free(clist);
 398                         return 0;
 399                         }
 400                 dup_list |= idmask;
 401                 s2n(id, p);
 402                 }
 403         if (*pext)
 404                 OPENSSL_free(*pext);
 405         *pext = clist;
 406         *pextlen = ncurves * 2;
 407         return 1;
 408         }
 409
 410 #define MAX_CURVELIST   25
 411
 412 typedef struct
 413         {
 414         size_t nidcnt;
 415         int nid_arr[MAX_CURVELIST];
 416         } nid_cb_st;
 417
 418 static int nid_cb(const char *elem, int len, void *arg)
 419         {
 420         nid_cb_st *narg = arg;
 421         size_t i;
 422         int nid;
 423         char etmp[20];
 424         if (narg->nidcnt == MAX_CURVELIST)
 425                 return 0;
 426         if (len > (int)(sizeof(etmp) - 1))
 427                 return 0;
 428         memcpy(etmp, elem, len);
 429         etmp[len] = 0;
 430         nid = EC_curve_nist2nid(etmp);
 431         if (nid == NID_undef)
 432                 nid = OBJ_sn2nid(etmp);
 433         if (nid == NID_undef)
 434                 nid = OBJ_ln2nid(etmp);
 435         if (nid == NID_undef)
 436                 return 0;
 437         for (i = 0; i < narg->nidcnt; i++)
 438                 if (narg->nid_arr[i] == nid)
 439                         return 0;
 440         narg->nid_arr[narg->nidcnt++] = nid;
 441         return 1;
 442         }
 443 /* Set curves based on a colon separate list */
 444 int tls1_set_curves_list(unsigned char **pext, size_t *pextlen,
 445                                 const char *str)
 446         {
 447         nid_cb_st ncb;
 448         ncb.nidcnt = 0;
 449         if (!CONF_parse_list(str, ':', 1, nid_cb, &ncb))
 450                 return 0;
 451         return tls1_set_curves(pext, pextlen, ncb.nid_arr, ncb.nidcnt);
 452         }
 453 /* For an EC key set TLS id and required compression based on parameters */
 454 static int tls1_set_ec_id(unsigned char *curve_id, unsigned char *comp_id,
 455                                 EC_KEY *ec)
 456         {
 457         int is_prime, id;
 458         const EC_GROUP *grp;
 459         const EC_POINT *pt;
 460         const EC_METHOD *meth;
 461         if (!ec)
 462                 return 0;
 463         /* Determine if it is a prime field */
 464         grp = EC_KEY_get0_group(ec);
 465         pt = EC_KEY_get0_public_key(ec);
 466         if (!grp || !pt)
 467                 return 0;
 468         meth = EC_GROUP_method_of(grp);
 469         if (!meth)
 470                 return 0;
 471         if (EC_METHOD_get_field_type(meth) == NID_X9_62_prime_field)
 472                 is_prime = 1;
 473         else
 474                 is_prime = 0;
 475         /* Determine curve ID */
 476         id = EC_GROUP_get_curve_name(grp);
 477         id = tls1_ec_nid2curve_id(id);
 478         /* If we have an ID set it, otherwise set arbitrary explicit curve */
 479         if (id)
 480                 {
 481                 curve_id[0] = 0;
 482                 curve_id[1] = (unsigned char)id;
 483                 }
 484         else
 485                 {
 486                 curve_id[0] = 0xff;
 487                 if (is_prime)
 488                         curve_id[1] = 0x01;
 489                 else
 490                         curve_id[1] = 0x02;
 491                 }
 492         if (comp_id)
 493                 {
 494                 if (EC_KEY_get_conv_form(ec) == POINT_CONVERSION_COMPRESSED)
 495                         {
 496                         if (is_prime)
 497                                 *comp_id = TLSEXT_ECPOINTFORMAT_ansiX962_compressed_prime;
 498                         else
 499                                 *comp_id = TLSEXT_ECPOINTFORMAT_ansiX962_compressed_char2;
 500                         }
 501                 else
 502                         *comp_id = TLSEXT_ECPOINTFORMAT_uncompressed;
 503                 }
 504         return 1;
 505         }
 506 /* Check an EC key is compatible with extensions */
 507 static int tls1_check_ec_key(SSL *s,
 508                         unsigned char *curve_id, unsigned char *comp_id)
 509         {
 510         const unsigned char *p;
 511         size_t plen, i;
 512         int j;
 513         /* If point formats extension present check it, otherwise everything
 514          * is supported (see RFC4492).
 515          */
 516         if (comp_id && s->session->tlsext_ecpointformatlist)
 517                 {
 518                 p = s->session->tlsext_ecpointformatlist;
 519                 plen = s->session->tlsext_ecpointformatlist_length;
 520                 for (i = 0; i < plen; i++, p++)
 521                         {
 522                         if (*comp_id == *p)
 523                                 break;
 524                         }
 525                 if (i == plen)
 526                         return 0;
 527                 }
 528         /* Check curve is consistent with client and server preferences */
 529         for (j = 0; j <= 1; j++)
 530                 {
 531                 tls1_get_curvelist(s, j, &p, &plen);
 532                 for (i = 0; i < plen; i+=2, p+=2)
 533                         {
 534                         if (p[0] == curve_id[0] && p[1] == curve_id[1])
 535                                 break;
 536                         }
 537                 if (i == plen)
 538                         return 0;
 539                 }
 540         return 1;
 541         }
 542 /* Check EC server key is compatible with client extensions */
 543 int tls1_check_ec_server_key(SSL *s)
 544         {
 545         int rv;
 546         CERT_PKEY *cpk = s->cert->pkeys + SSL_PKEY_ECC;
 547         EVP_PKEY *pkey;
 548         unsigned char comp_id, curve_id[2];
 549         if (!cpk->x509 || !cpk->privatekey)
 550                 return 0;
 551         pkey = X509_get_pubkey(cpk->x509);
 552         if (!pkey)
 553                 return 0;
 554         rv = tls1_set_ec_id(curve_id, &comp_id, pkey->pkey.ec);
 555         EVP_PKEY_free(pkey);
 556         if (!rv)
 557                 return 0;
 558         return tls1_check_ec_key(s, curve_id, &comp_id);
 559         }
 560 /* Check EC temporary key is compatible with client extensions */
 561 int tls1_check_ec_tmp_key(SSL *s)
 562         {
 563         unsigned char curve_id[2];
 564         EC_KEY *ec = s->cert->ecdh_tmp;
 565         if (s->cert->ecdh_tmp_auto)
 566                 {
 567                 /* Need a shared curve */
 568                 if (tls1_shared_curve(s, 0))
 569                         return 1;
 570                 else return 0;
 571                 }
 572         if (!ec)
 573                 {
 574                 if (s->cert->ecdh_tmp_cb)
 575                         return 1;
 576                 else
 577                         return 0;
 578                 }
 579         if (!tls1_set_ec_id(curve_id, NULL, ec))
 580                 return 1;
 581         return tls1_check_ec_key(s, curve_id, NULL);
 582         }
 583
 584 #endif /* OPENSSL_NO_EC */
 585
 586 #ifndef OPENSSL_NO_TLSEXT
 587
 588 /* List of supported signature algorithms and hashes. Should make this
 589  * customisable at some point, for now include everything we support.
 590  */
 591
 592 #ifdef OPENSSL_NO_RSA
 593 #define tlsext_sigalg_rsa(md) /* */
 594 #else
 595 #define tlsext_sigalg_rsa(md) md, TLSEXT_signature_rsa,
 596 #endif
 597
 598 #ifdef OPENSSL_NO_DSA
 599 #define tlsext_sigalg_dsa(md) /* */
 600 #else
 601 #define tlsext_sigalg_dsa(md) md, TLSEXT_signature_dsa,
 602 #endif
 603
 604 #ifdef OPENSSL_NO_ECDSA
 605 #define tlsext_sigalg_ecdsa(md) /* */
 606 #else
 607 #define tlsext_sigalg_ecdsa(md) md, TLSEXT_signature_ecdsa,
 608 #endif
 609
 610 #define tlsext_sigalg(md) \
 611                 tlsext_sigalg_rsa(md) \
 612                 tlsext_sigalg_dsa(md) \
 613                 tlsext_sigalg_ecdsa(md)
 614
 615 static unsigned char tls12_sigalgs[] = {
 616 #ifndef OPENSSL_NO_SHA512
 617         tlsext_sigalg(TLSEXT_hash_sha512)
 618         tlsext_sigalg(TLSEXT_hash_sha384)
 619 #endif
 620 #ifndef OPENSSL_NO_SHA256
 621         tlsext_sigalg(TLSEXT_hash_sha256)
 622         tlsext_sigalg(TLSEXT_hash_sha224)
 623 #endif
 624 #ifndef OPENSSL_NO_SHA
 625         tlsext_sigalg(TLSEXT_hash_sha1)
 626 #endif
 627 #ifndef OPENSSL_NO_MD5
 628         tlsext_sigalg_rsa(TLSEXT_hash_md5)
 629 #endif
 630 };
 631
 632 size_t tls12_get_sig_algs(SSL *s, unsigned char *p)
 633         {
 634         TLS_SIGALGS *sptr = s->cert->conf_sigalgs;
 635         size_t slen;
 636
 637         /* Use custom signature algorithms if any are set */
 638
 639         if (sptr)
 640                 {
 641                 slen = s->cert->conf_sigalgslen;
 642                 if (p)
 643                         {
 644                         size_t i;
 645                         for (i = 0; i < slen; i++, sptr++)
 646                                 {
 647                                 *p++ = sptr->rhash;
 648                                 *p++ = sptr->rsign;
 649                                 }
 650                         }
 651                 return slen * 2;
 652                 }
 653
 654         slen = sizeof(tls12_sigalgs);
 655 #ifdef OPENSSL_FIPS
 656         /* If FIPS mode don't include MD5 which is last */
 657         if (FIPS_mode())
 658                 slen -= 2;
 659 #endif
 660         if (p)
 661                 memcpy(p, tls12_sigalgs, slen);
 662         return slen;
 663         }
 664
 665 /* byte_compare is a compare function for qsort(3) that compares bytes. */
 666 static int byte_compare(const void *in_a, const void *in_b)
 667         {
 668         unsigned char a = *((const unsigned char*) in_a);
 669         unsigned char b = *((const unsigned char*) in_b);
 670
 671         if (a > b)
 672                 return 1;
 673         else if (a < b)
 674                 return -1;
 675         return 0;
 676 }
 677
 678 unsigned char *ssl_add_clienthello_tlsext(SSL *s, unsigned char *p, unsigned char *limit)
 679         {
 680         int extdatalen=0;
 681         unsigned char *ret = p;
 682 #ifndef OPENSSL_NO_EC
 683         /* See if we support any ECC ciphersuites */
 684         int using_ecc = 0;
 685         if (s->version != DTLS1_VERSION && s->version >= TLS1_VERSION)
 686                 {
 687                 int i;
 688                 unsigned long alg_k, alg_a;
 689                 STACK_OF(SSL_CIPHER) *cipher_stack = SSL_get_ciphers(s);
 690
 691                 for (i = 0; i < sk_SSL_CIPHER_num(cipher_stack); i++)
 692                         {
 693                         SSL_CIPHER *c = sk_SSL_CIPHER_value(cipher_stack, i);
 694
 695                         alg_k = c->algorithm_mkey;
 696                         alg_a = c->algorithm_auth;
 697                         if ((alg_k & (SSL_kEECDH|SSL_kECDHr|SSL_kECDHe)
 698                                 || (alg_a & SSL_aECDSA)))
 699                                 {
 700                                 using_ecc = 1;
 701                                 break;
 702                                 }
 703                         }
 704                 }
 705 #endif
 706
 707         /* don't add extensions for SSLv3 unless doing secure renegotiation */
 708         if (s->client_version == SSL3_VERSION
 709                                         && !s->s3->send_connection_binding)
 710                 return p;
 711
 712         ret+=2;
 713
 714         if (ret>=limit) return NULL; /* this really never occurs, but ... */
 715
 716         if (s->tlsext_hostname != NULL)
 717                 {
 718                 /* Add TLS extension servername to the Client Hello message */
 719                 unsigned long size_str;
 720                 long lenmax;
 721
 722                 /* check for enough space.
 723                    4 for the servername type and entension length
 724                    2 for servernamelist length
 725                    1 for the hostname type
 726                    2 for hostname length
 727                    + hostname length
 728                 */
 729
 730                 if ((lenmax = limit - ret - 9) < 0
 731                     || (size_str = strlen(s->tlsext_hostname)) > (unsigned long)lenmax)
 732                         return NULL;
 733
 734                 /* extension type and length */
 735                 s2n(TLSEXT_TYPE_server_name,ret);
 736                 s2n(size_str+5,ret);
 737
 738                 /* length of servername list */
 739                 s2n(size_str+3,ret);
 740
 741                 /* hostname type, length and hostname */
 742                 *(ret++) = (unsigned char) TLSEXT_NAMETYPE_host_name;
 743                 s2n(size_str,ret);
 744                 memcpy(ret, s->tlsext_hostname, size_str);
 745                 ret+=size_str;
 746                 }
 747
 748         /* Add RI if renegotiating */
 749         if (s->renegotiate)
 750           {
 751           int el;
 752
 753           if(!ssl_add_clienthello_renegotiate_ext(s, 0, &el, 0))
 754               {
 755               SSLerr(SSL_F_SSL_ADD_CLIENTHELLO_TLSEXT, ERR_R_INTERNAL_ERROR);
 756               return NULL;
 757               }
 758
 759           if((limit - p - 4 - el) < 0) return NULL;
 760
 761           s2n(TLSEXT_TYPE_renegotiate,ret);
 762           s2n(el,ret);
 763
 764           if(!ssl_add_clienthello_renegotiate_ext(s, ret, &el, el))
 765               {
 766               SSLerr(SSL_F_SSL_ADD_CLIENTHELLO_TLSEXT, ERR_R_INTERNAL_ERROR);
 767               return NULL;
 768               }
 769
 770           ret += el;
 771         }
 772
 773 #ifndef OPENSSL_NO_SRP
 774         /* Add SRP username if there is one */
 775         if (s->srp_ctx.login != NULL)
 776                 { /* Add TLS extension SRP username to the Client Hello message */
 777
 778                 int login_len = strlen(s->srp_ctx.login);
 779                 if (login_len > 255 || login_len == 0)
 780                         {
 781                         SSLerr(SSL_F_SSL_ADD_CLIENTHELLO_TLSEXT, ERR_R_INTERNAL_ERROR);
 782                         return NULL;
 783                         }
 784
 785                 /* check for enough space.
 786                    4 for the srp type type and entension length
 787                    1 for the srp user identity
 788                    + srp user identity length
 789                 */
 790                 if ((limit - ret - 5 - login_len) < 0) return NULL;
 791
 792                 /* fill in the extension */
 793                 s2n(TLSEXT_TYPE_srp,ret);
 794                 s2n(login_len+1,ret);
 795                 (*ret++) = (unsigned char) login_len;
 796                 memcpy(ret, s->srp_ctx.login, login_len);
 797                 ret+=login_len;
 798                 }
 799 #endif
 800
 801 #ifndef OPENSSL_NO_EC
 802         if (using_ecc)
 803                 {
 804                 /* Add TLS extension ECPointFormats to the ClientHello message */
 805                 long lenmax;
 806                 const unsigned char *plist;
 807                 size_t plistlen;
 808                 /* If we have a custom point format list use it otherwise
 809                  * use default */
 810                 plist = s->tlsext_ecpointformatlist;
 811                 if (plist)
 812                         plistlen = s->tlsext_ecpointformatlist_length;
 813                 else
 814                         {
 815                         plist = ecformats_default;
 816                         plistlen = sizeof(ecformats_default);
 817                         }
 818
 819                 if ((lenmax = limit - ret - 5) < 0) return NULL;
 820                 if (plistlen > (size_t)lenmax) return NULL;
 821                 if (plistlen > 255)
 822                         {
 823                         SSLerr(SSL_F_SSL_ADD_CLIENTHELLO_TLSEXT, ERR_R_INTERNAL_ERROR);
 824                         return NULL;
 825                         }
 826
 827                 s2n(TLSEXT_TYPE_ec_point_formats,ret);
 828                 s2n(plistlen + 1,ret);
 829                 *(ret++) = (unsigned char)plistlen ;
 830                 memcpy(ret, plist, plistlen);
 831                 ret+=plistlen;
 832
 833                 /* Add TLS extension EllipticCurves to the ClientHello message */
 834                 plist = s->tlsext_ellipticcurvelist;
 835                 tls1_get_curvelist(s, 0, &plist, &plistlen);
 836
 837                 if ((lenmax = limit - ret - 6) < 0) return NULL;
 838                 if (plistlen > (size_t)lenmax) return NULL;
 839                 if (plistlen > 65532)
 840                         {
 841                         SSLerr(SSL_F_SSL_ADD_CLIENTHELLO_TLSEXT, ERR_R_INTERNAL_ERROR);
 842                         return NULL;
 843                         }
 844
 845                 s2n(TLSEXT_TYPE_elliptic_curves,ret);
 846                 s2n(plistlen + 2, ret);
 847
 848                 /* NB: draft-ietf-tls-ecc-12.txt uses a one-byte prefix for
 849                  * elliptic_curve_list, but the examples use two bytes.
 850                  * http://www1.ietf.org/mail-archive/web/tls/current/msg00538.html
 851                  * resolves this to two bytes.
 852                  */
 853                 s2n(plistlen, ret);
 854                 memcpy(ret, plist, plistlen);
 855                 ret+=plistlen;
 856                 }
 857 #endif /* OPENSSL_NO_EC */
 858
 859         if (!(SSL_get_options(s) & SSL_OP_NO_TICKET))
 860                 {
 861                 int ticklen;
 862                 if (!s->new_session && s->session && s->session->tlsext_tick)
 863                         ticklen = s->session->tlsext_ticklen;
 864                 else if (s->session && s->tlsext_session_ticket &&
 865                          s->tlsext_session_ticket->data)
 866                         {
 867                         ticklen = s->tlsext_session_ticket->length;
 868                         s->session->tlsext_tick = OPENSSL_malloc(ticklen);
 869                         if (!s->session->tlsext_tick)
 870                                 return NULL;
 871                         memcpy(s->session->tlsext_tick,
 872                                s->tlsext_session_ticket->data,
 873                                ticklen);
 874                         s->session->tlsext_ticklen = ticklen;
 875                         }
 876                 else
 877                         ticklen = 0;
 878                 if (ticklen == 0 && s->tlsext_session_ticket &&
 879                     s->tlsext_session_ticket->data == NULL)
 880                         goto skip_ext;
 881                 /* Check for enough room 2 for extension type, 2 for len
 882                  * rest for ticket
 883                  */
 884                 if ((long)(limit - ret - 4 - ticklen) < 0) return NULL;
 885                 s2n(TLSEXT_TYPE_session_ticket,ret);
 886                 s2n(ticklen,ret);
 887                 if (ticklen)
 888                         {
 889                         memcpy(ret, s->session->tlsext_tick, ticklen);
 890                         ret += ticklen;
 891                         }
 892                 }
 893                 skip_ext:
 894
 895         if (TLS1_get_client_version(s) >= TLS1_2_VERSION)
 896                 {
 897                 size_t salglen;
 898                 salglen = tls12_get_sig_algs(s, NULL);
 899                 if ((size_t)(limit - ret) < salglen + 6)
 900                         return NULL;
 901                 s2n(TLSEXT_TYPE_signature_algorithms,ret);
 902                 s2n(salglen + 2, ret);
 903                 s2n(salglen, ret);
 904                 tls12_get_sig_algs(s, ret);
 905                 ret += salglen;
 906                 }
 907
 908 #ifdef TLSEXT_TYPE_opaque_prf_input
 909         if (s->s3->client_opaque_prf_input != NULL &&
 910             s->version != DTLS1_VERSION)
 911                 {
 912                 size_t col = s->s3->client_opaque_prf_input_len;
 913
 914                 if ((long)(limit - ret - 6 - col < 0))
 915                         return NULL;
 916                 if (col > 0xFFFD) /* can't happen */
 917                         return NULL;
 918
 919                 s2n(TLSEXT_TYPE_opaque_prf_input, ret);
 920                 s2n(col + 2, ret);
 921                 s2n(col, ret);
 922                 memcpy(ret, s->s3->client_opaque_prf_input, col);
 923                 ret += col;
 924                 }
 925 #endif
 926
 927         if (s->tlsext_status_type == TLSEXT_STATUSTYPE_ocsp &&
 928             s->version != DTLS1_VERSION)
 929                 {
 930                 int i;
 931                 long extlen, idlen, itmp;
 932                 OCSP_RESPID *id;
 933
 934                 idlen = 0;
 935                 for (i = 0; i < sk_OCSP_RESPID_num(s->tlsext_ocsp_ids); i++)
 936                         {
 937                         id = sk_OCSP_RESPID_value(s->tlsext_ocsp_ids, i);
 938                         itmp = i2d_OCSP_RESPID(id, NULL);
 939                         if (itmp <= 0)
 940                                 return NULL;
 941                         idlen += itmp + 2;
 942                         }
 943
 944                 if (s->tlsext_ocsp_exts)
 945                         {
 946                         extlen = i2d_X509_EXTENSIONS(s->tlsext_ocsp_exts, NULL);
 947                         if (extlen < 0)
 948                                 return NULL;
 949                         }
 950                 else
 951                         extlen = 0;
 952
 953                 if ((long)(limit - ret - 7 - extlen - idlen) < 0) return NULL;
 954                 s2n(TLSEXT_TYPE_status_request, ret);
 955                 if (extlen + idlen > 0xFFF0)
 956                         return NULL;
 957                 s2n(extlen + idlen + 5, ret);
 958                 *(ret++) = TLSEXT_STATUSTYPE_ocsp;
 959                 s2n(idlen, ret);
 960                 for (i = 0; i < sk_OCSP_RESPID_num(s->tlsext_ocsp_ids); i++)
 961                         {
 962                         /* save position of id len */
 963                         unsigned char *q = ret;
 964                         id = sk_OCSP_RESPID_value(s->tlsext_ocsp_ids, i);
 965                         /* skip over id len */
 966                         ret += 2;
 967                         itmp = i2d_OCSP_RESPID(id, &ret);
 968                         /* write id len */
 969                         s2n(itmp, q);
 970                         }
 971                 s2n(extlen, ret);
 972                 if (extlen > 0)
 973                         i2d_X509_EXTENSIONS(s->tlsext_ocsp_exts, &ret);
 974                 }
 975
 976 #ifndef OPENSSL_NO_HEARTBEATS
 977         /* Add Heartbeat extension */
 978         s2n(TLSEXT_TYPE_heartbeat,ret);
 979         s2n(1,ret);
 980         /* Set mode:
 981          * 1: peer may send requests
 982          * 2: peer not allowed to send requests
 983          */
 984         if (s->tlsext_heartbeat & SSL_TLSEXT_HB_DONT_RECV_REQUESTS)
 985                 *(ret++) = SSL_TLSEXT_HB_DONT_SEND_REQUESTS;
 986         else
 987                 *(ret++) = SSL_TLSEXT_HB_ENABLED;
 988 #endif
 989
 990 #ifndef OPENSSL_NO_NEXTPROTONEG
 991         if (s->ctx->next_proto_select_cb && !s->s3->tmp.finish_md_len)
 992                 {
 993                 /* The client advertises an emtpy extension to indicate its
 994                  * support for Next Protocol Negotiation */
 995                 if (limit - ret - 4 < 0)
 996                         return NULL;
 997                 s2n(TLSEXT_TYPE_next_proto_neg,ret);
 998                 s2n(0,ret);
 999                 }
1000 #endif
1001
1002         if(SSL_get_srtp_profiles(s))
1003                 {
1004                 int el;
1005
1006                 ssl_add_clienthello_use_srtp_ext(s, 0, &el, 0);
1007
1008                 if((limit - p - 4 - el) < 0) return NULL;
1009
1010                 s2n(TLSEXT_TYPE_use_srtp,ret);
1011                 s2n(el,ret);
1012
1013                 if(ssl_add_clienthello_use_srtp_ext(s, ret, &el, el))
1014                         {
1015                         SSLerr(SSL_F_SSL_ADD_CLIENTHELLO_TLSEXT, ERR_R_INTERNAL_ERROR);
1016                         return NULL;
1017                         }
1018                 ret += el;
1019                 }
1020
1021         /* Add TLS extension Server_Authz_DataFormats to the ClientHello */
1022         /* 2 bytes for extension type */
1023         /* 2 bytes for extension length */
1024         /* 1 byte for the list length */
1025         /* 1 byte for the list (we only support audit proofs) */
1026         if (s->ctx->tlsext_authz_server_audit_proof_cb != NULL)
1027                 {
1028                 size_t lenmax;
1029                 const unsigned short ext_len = 2;
1030                 const unsigned char list_len = 1;
1031
1032                 if ((lenmax = limit - ret - 6) < 0) return NULL;
1033
1034                 s2n(TLSEXT_TYPE_server_authz, ret);
1035                 /* Extension length: 2 bytes */
1036                 s2n(ext_len, ret);
1037                 *(ret++) = list_len;
1038                 *(ret++) = TLSEXT_AUTHZDATAFORMAT_audit_proof;
1039                 }
1040
1041         if ((extdatalen = ret-p-2) == 0)
1042                 return p;
1043
1044         s2n(extdatalen,p);
1045         return ret;
1046         }
1047
1048 unsigned char *ssl_add_serverhello_tlsext(SSL *s, unsigned char *p, unsigned char *limit)
1049         {
1050         int extdatalen=0;
1051         unsigned char *ret = p;
1052 #ifndef OPENSSL_NO_NEXTPROTONEG
1053         int next_proto_neg_seen;
1054 #endif
1055
1056         /* don't add extensions for SSLv3, unless doing secure renegotiation */
1057         if (s->version == SSL3_VERSION && !s->s3->send_connection_binding)
1058                 return p;
1059
1060         ret+=2;
1061         if (ret>=limit) return NULL; /* this really never occurs, but ... */
1062
1063         if (!s->hit && s->servername_done == 1 && s->session->tlsext_hostname != NULL)
1064                 {
1065                 if ((long)(limit - ret - 4) < 0) return NULL;
1066
1067                 s2n(TLSEXT_TYPE_server_name,ret);
1068                 s2n(0,ret);
1069                 }
1070
1071         if(s->s3->send_connection_binding)
1072         {
1073           int el;
1074
1075           if(!ssl_add_serverhello_renegotiate_ext(s, 0, &el, 0))
1076               {
1077               SSLerr(SSL_F_SSL_ADD_SERVERHELLO_TLSEXT, ERR_R_INTERNAL_ERROR);
1078               return NULL;
1079               }
1080
1081           if((limit - p - 4 - el) < 0) return NULL;
1082
1083           s2n(TLSEXT_TYPE_renegotiate,ret);
1084           s2n(el,ret);
1085
1086           if(!ssl_add_serverhello_renegotiate_ext(s, ret, &el, el))
1087               {
1088               SSLerr(SSL_F_SSL_ADD_SERVERHELLO_TLSEXT, ERR_R_INTERNAL_ERROR);
1089               return NULL;
1090               }
1091
1092           ret += el;
1093         }
1094
1095 #ifndef OPENSSL_NO_EC
1096         if (s->tlsext_ecpointformatlist != NULL &&
1097             s->version != DTLS1_VERSION)
1098                 {
1099                 /* Add TLS extension ECPointFormats to the ServerHello message */
1100                 long lenmax;
1101
1102                 if ((lenmax = limit - ret - 5) < 0) return NULL;
1103                 if (s->tlsext_ecpointformatlist_length > (unsigned long)lenmax) return NULL;
1104                 if (s->tlsext_ecpointformatlist_length > 255)
1105                         {
1106                         SSLerr(SSL_F_SSL_ADD_SERVERHELLO_TLSEXT, ERR_R_INTERNAL_ERROR);
1107                         return NULL;
1108                         }
1109
1110                 s2n(TLSEXT_TYPE_ec_point_formats,ret);
1111                 s2n(s->tlsext_ecpointformatlist_length + 1,ret);
1112                 *(ret++) = (unsigned char) s->tlsext_ecpointformatlist_length;
1113                 memcpy(ret, s->tlsext_ecpointformatlist, s->tlsext_ecpointformatlist_length);
1114                 ret+=s->tlsext_ecpointformatlist_length;
1115
1116                 }
1117         /* Currently the server should not respond with a SupportedCurves extension */
1118 #endif /* OPENSSL_NO_EC */
1119
1120         if (s->tlsext_ticket_expected
1121                 && !(SSL_get_options(s) & SSL_OP_NO_TICKET))
1122                 {
1123                 if ((long)(limit - ret - 4) < 0) return NULL;
1124                 s2n(TLSEXT_TYPE_session_ticket,ret);
1125                 s2n(0,ret);
1126                 }
1127
1128         if (s->tlsext_status_expected)
1129                 {
1130                 if ((long)(limit - ret - 4) < 0) return NULL;
1131                 s2n(TLSEXT_TYPE_status_request,ret);
1132                 s2n(0,ret);
1133                 }
1134
1135 #ifdef TLSEXT_TYPE_opaque_prf_input
1136         if (s->s3->server_opaque_prf_input != NULL &&
1137             s->version != DTLS1_VERSION)
1138                 {
1139                 size_t sol = s->s3->server_opaque_prf_input_len;
1140
1141                 if ((long)(limit - ret - 6 - sol) < 0)
1142                         return NULL;
1143                 if (sol > 0xFFFD) /* can't happen */
1144                         return NULL;
1145
1146                 s2n(TLSEXT_TYPE_opaque_prf_input, ret);
1147                 s2n(sol + 2, ret);
1148                 s2n(sol, ret);
1149                 memcpy(ret, s->s3->server_opaque_prf_input, sol);
1150                 ret += sol;
1151                 }
1152 #endif
1153
1154         if(s->srtp_profile)
1155                 {
1156                 int el;
1157
1158                 ssl_add_serverhello_use_srtp_ext(s, 0, &el, 0);
1159
1160                 if((limit - p - 4 - el) < 0) return NULL;
1161
1162                 s2n(TLSEXT_TYPE_use_srtp,ret);
1163                 s2n(el,ret);
1164
1165                 if(ssl_add_serverhello_use_srtp_ext(s, ret, &el, el))
1166                         {
1167                         SSLerr(SSL_F_SSL_ADD_SERVERHELLO_TLSEXT, ERR_R_INTERNAL_ERROR);
1168                         return NULL;
1169                         }
1170                 ret+=el;
1171                 }
1172
1173         if (((s->s3->tmp.new_cipher->id & 0xFFFF)==0x80 || (s->s3->tmp.new_cipher->id & 0xFFFF)==0x81)
1174                 && (SSL_get_options(s) & SSL_OP_CRYPTOPRO_TLSEXT_BUG))
1175                 { const unsigned char cryptopro_ext[36] = {
1176                         0xfd, 0xe8, /*65000*/
1177                         0x00, 0x20, /*32 bytes length*/
1178                         0x30, 0x1e, 0x30, 0x08, 0x06, 0x06, 0x2a, 0x85,
1179                         0x03,   0x02, 0x02, 0x09, 0x30, 0x08, 0x06, 0x06,
1180                         0x2a, 0x85, 0x03, 0x02, 0x02, 0x16, 0x30, 0x08,
1181                         0x06, 0x06, 0x2a, 0x85, 0x03, 0x02, 0x02, 0x17};
1182                         if (limit-ret<36) return NULL;
1183                         memcpy(ret,cryptopro_ext,36);
1184                         ret+=36;
1185
1186                 }
1187
1188 #ifndef OPENSSL_NO_HEARTBEATS
1189         /* Add Heartbeat extension if we've received one */
1190         if (s->tlsext_heartbeat & SSL_TLSEXT_HB_ENABLED)
1191                 {
1192                 s2n(TLSEXT_TYPE_heartbeat,ret);
1193                 s2n(1,ret);
1194                 /* Set mode:
1195                  * 1: peer may send requests
1196                  * 2: peer not allowed to send requests
1197                  */
1198                 if (s->tlsext_heartbeat & SSL_TLSEXT_HB_DONT_RECV_REQUESTS)
1199                         *(ret++) = SSL_TLSEXT_HB_DONT_SEND_REQUESTS;
1200                 else
1201                         *(ret++) = SSL_TLSEXT_HB_ENABLED;
1202
1203                 }
1204 #endif
1205
1206 #ifndef OPENSSL_NO_NEXTPROTONEG
1207         next_proto_neg_seen = s->s3->next_proto_neg_seen;
1208         s->s3->next_proto_neg_seen = 0;
1209         if (next_proto_neg_seen && s->ctx->next_protos_advertised_cb)
1210                 {
1211                 const unsigned char *npa;
1212                 unsigned int npalen;
1213                 int r;
1214
1215                 r = s->ctx->next_protos_advertised_cb(s, &npa, &npalen, s->ctx->next_protos_advertised_cb_arg);
1216                 if (r == SSL_TLSEXT_ERR_OK)
1217                         {
1218                         if ((long)(limit - ret - 4 - npalen) < 0) return NULL;
1219                         s2n(TLSEXT_TYPE_next_proto_neg,ret);
1220                         s2n(npalen,ret);
1221                         memcpy(ret, npa, npalen);
1222                         ret += npalen;
1223                         s->s3->next_proto_neg_seen = 1;
1224                         }
1225                 }
1226 #endif
1227
1228         /* If the client supports authz then see whether we have any to offer
1229          * to it. */
1230         if (s->s3->tlsext_authz_client_types_len)
1231                 {
1232                 size_t authz_length;
1233                 /* By now we already know the new cipher, so we can look ahead
1234                  * to see whether the cert we are going to send
1235                  * has any authz data attached to it. */
1236                 const unsigned char* authz = ssl_get_authz_data(s, &authz_length);
1237                 const unsigned char* const orig_authz = authz;
1238                 size_t i;
1239                 unsigned authz_count = 0;
1240
1241                 /* The authz data contains a number of the following structures:
1242                  *      uint8_t authz_type
1243                  *      uint16_t length
1244                  *      uint8_t data[length]
1245                  *
1246                  * First we walk over it to find the number of authz elements. */
1247                 for (i = 0; i < authz_length; i++)
1248                         {
1249                         unsigned short length;
1250                         unsigned char type;
1251
1252                         type = *(authz++);
1253                         if (memchr(s->s3->tlsext_authz_client_types,
1254                                    type,
1255                                    s->s3->tlsext_authz_client_types_len) != NULL)
1256                                 authz_count++;
1257
1258                         n2s(authz, length);
1259                         /* n2s increments authz by 2 */
1260                         i += 2;
1261                         authz += length;
1262                         i += length;
1263                         }
1264
1265                 if (authz_count)
1266                         {
1267                         /* Add TLS extension server_authz to the ServerHello message
1268                          * 2 bytes for extension type
1269                          * 2 bytes for extension length
1270                          * 1 byte for the list length
1271                          * n bytes for the list */
1272                         const unsigned short ext_len = 1 + authz_count;
1273
1274                         if ((long)(limit - ret - 4 - ext_len) < 0) return NULL;
1275                         s2n(TLSEXT_TYPE_server_authz, ret);
1276                         s2n(ext_len, ret);
1277                         *(ret++) = authz_count;
1278                         s->s3->tlsext_authz_promised_to_client = 1;
1279                         }
1280
1281                 authz = orig_authz;
1282                 for (i = 0; i < authz_length; i++)
1283                         {
1284                         unsigned short length;
1285                         unsigned char type;
1286
1287                         authz_count++;
1288                         type = *(authz++);
1289                         if (memchr(s->s3->tlsext_authz_client_types,
1290                                    type,
1291                                    s->s3->tlsext_authz_client_types_len) != NULL)
1292                                 *(ret++) = type;
1293                         n2s(authz, length);
1294                         /* n2s increments authz by 2 */
1295                         i += 2;
1296                         authz += length;
1297                         i += length;
1298                         }
1299                 }
1300
1301         if ((extdatalen = ret-p-2)== 0)
1302                 return p;
1303
1304         s2n(extdatalen,p);
1305         return ret;
1306         }
1307
1308 static int ssl_scan_clienthello_tlsext(SSL *s, unsigned char **p, unsigned char *d, int n, int *al)
1309         {
1310         unsigned short type;
1311         unsigned short size;
1312         unsigned short len;
1313         unsigned char *data = *p;
1314         int renegotiate_seen = 0;
1315         int sigalg_seen = 0;
1316
1317         s->servername_done = 0;
1318         s->tlsext_status_type = -1;
1319 #ifndef OPENSSL_NO_NEXTPROTONEG
1320         s->s3->next_proto_neg_seen = 0;
1321 #endif
1322
1323 #ifndef OPENSSL_NO_HEARTBEATS
1324         s->tlsext_heartbeat &= ~(SSL_TLSEXT_HB_ENABLED |
1325                                SSL_TLSEXT_HB_DONT_SEND_REQUESTS);
1326 #endif
1327
1328         if (data >= (d+n-2))
1329                 goto ri_check;
1330         n2s(data,len);
1331
1332         if (data > (d+n-len))
1333                 goto ri_check;
1334
1335         while (data <= (d+n-4))
1336                 {
1337                 n2s(data,type);
1338                 n2s(data,size);
1339
1340                 if (data+size > (d+n))
1341                         goto ri_check;
1342 #if 0
1343                 fprintf(stderr,"Received extension type %d size %d\n",type,size);
1344 #endif
1345                 if (s->tlsext_debug_cb)
1346                         s->tlsext_debug_cb(s, 0, type, data, size,
1347                                                 s->tlsext_debug_arg);
1348 /* The servername extension is treated as follows:
1349
1350    - Only the hostname type is supported with a maximum length of 255.
1351    - The servername is rejected if too long or if it contains zeros,
1352      in which case an fatal alert is generated.
1353    - The servername field is maintained together with the session cache.
1354    - When a session is resumed, the servername call back invoked in order
1355      to allow the application to position itself to the right context.
1356    - The servername is acknowledged if it is new for a session or when
1357      it is identical to a previously used for the same session.
1358      Applications can control the behaviour.  They can at any time
1359      set a 'desirable' servername for a new SSL object. This can be the
1360      case for example with HTTPS when a Host: header field is received and
1361      a renegotiation is requested. In this case, a possible servername
1362      presented in the new client hello is only acknowledged if it matches
1363      the value of the Host: field.
1364    - Applications must  use SSL_OP_NO_SESSION_RESUMPTION_ON_RENEGOTIATION
1365      if they provide for changing an explicit servername context for the session,
1366      i.e. when the session has been established with a servername extension.
1367    - On session reconnect, the servername extension may be absent.
1368
1369 */
1370
1371                 if (type == TLSEXT_TYPE_server_name)
1372                         {
1373                         unsigned char *sdata;
1374                         int servname_type;
1375                         int dsize;
1376
1377                         if (size < 2)
1378                                 {
1379                                 *al = SSL_AD_DECODE_ERROR;
1380                                 return 0;
1381                                 }
1382                         n2s(data,dsize);
1383                         size -= 2;
1384                         if (dsize > size  )
1385                                 {
1386                                 *al = SSL_AD_DECODE_ERROR;
1387                                 return 0;
1388                                 }
1389
1390                         sdata = data;
1391                         while (dsize > 3)
1392                                 {
1393                                 servname_type = *(sdata++);
1394                                 n2s(sdata,len);
1395                                 dsize -= 3;
1396
1397                                 if (len > dsize)
1398                                         {
1399                                         *al = SSL_AD_DECODE_ERROR;
1400                                         return 0;
1401                                         }
1402                                 if (s->servername_done == 0)
1403                                 switch (servname_type)
1404                                         {
1405                                 case TLSEXT_NAMETYPE_host_name:
1406                                         if (!s->hit)
1407                                                 {
1408                                                 if(s->session->tlsext_hostname)
1409                                                         {
1410                                                         *al = SSL_AD_DECODE_ERROR;
1411                                                         return 0;
1412                                                         }
1413                                                 if (len > TLSEXT_MAXLEN_host_name)
1414                                                         {
1415                                                         *al = TLS1_AD_UNRECOGNIZED_NAME;
1416                                                         return 0;
1417                                                         }
1418                                                 if ((s->session->tlsext_hostname = OPENSSL_malloc(len+1)) == NULL)
1419                                                         {
1420                                                         *al = TLS1_AD_INTERNAL_ERROR;
1421                                                         return 0;
1422                                                         }
1423                                                 memcpy(s->session->tlsext_hostname, sdata, len);
1424                                                 s->session->tlsext_hostname[len]='\0';
1425                                                 if (strlen(s->session->tlsext_hostname) != len) {
1426                                                         OPENSSL_free(s->session->tlsext_hostname);
1427                                                         s->session->tlsext_hostname = NULL;
1428                                                         *al = TLS1_AD_UNRECOGNIZED_NAME;
1429                                                         return 0;
1430                                                 }
1431                                                 s->servername_done = 1;
1432
1433                                                 }
1434                                         else
1435                                                 s->servername_done = s->session->tlsext_hostname
1436                                                         && strlen(s->session->tlsext_hostname) == len
1437                                                         && strncmp(s->session->tlsext_hostname, (char *)sdata, len) == 0;
1438
1439                                         break;
1440
1441                                 default:
1442                                         break;
1443                                         }
1444
1445                                 dsize -= len;
1446                                 }
1447                         if (dsize != 0)
1448                                 {
1449                                 *al = SSL_AD_DECODE_ERROR;
1450                                 return 0;
1451                                 }
1452
1453                         }
1454 #ifndef OPENSSL_NO_SRP
1455                 else if (type == TLSEXT_TYPE_srp)
1456                         {
1457                         if (size <= 0 || ((len = data[0])) != (size -1))
1458                                 {
1459                                 *al = SSL_AD_DECODE_ERROR;
1460                                 return 0;
1461                                 }
1462                         if (s->srp_ctx.login != NULL)
1463                                 {
1464                                 *al = SSL_AD_DECODE_ERROR;
1465                                 return 0;
1466                                 }
1467                         if ((s->srp_ctx.login = OPENSSL_malloc(len+1)) == NULL)
1468                                 return -1;
1469                         memcpy(s->srp_ctx.login, &data[1], len);
1470                         s->srp_ctx.login[len]='\0';
1471
1472                         if (strlen(s->srp_ctx.login) != len)
1473                                 {
1474                                 *al = SSL_AD_DECODE_ERROR;
1475                                 return 0;
1476                                 }
1477                         }
1478 #endif
1479
1480 #ifndef OPENSSL_NO_EC
1481                 else if (type == TLSEXT_TYPE_ec_point_formats &&
1482                      s->version != DTLS1_VERSION)
1483                         {
1484                         unsigned char *sdata = data;
1485                         int ecpointformatlist_length = *(sdata++);
1486
1487                         if (ecpointformatlist_length != size - 1)
1488                                 {
1489                                 *al = TLS1_AD_DECODE_ERROR;
1490                                 return 0;
1491                                 }
1492                         if (!s->hit)
1493                                 {
1494                                 if(s->session->tlsext_ecpointformatlist)
1495                                         {
1496                                         OPENSSL_free(s->session->tlsext_ecpointformatlist);
1497                                         s->session->tlsext_ecpointformatlist = NULL;
1498                                         }
1499                                 s->session->tlsext_ecpointformatlist_length = 0;
1500                                 if ((s->session->tlsext_ecpointformatlist = OPENSSL_malloc(ecpointformatlist_length)) == NULL)
1501                                         {
1502                                         *al = TLS1_AD_INTERNAL_ERROR;
1503                                         return 0;
1504                                         }
1505                                 s->session->tlsext_ecpointformatlist_length = ecpointformatlist_length;
1506                                 memcpy(s->session->tlsext_ecpointformatlist, sdata, ecpointformatlist_length);
1507                                 }
1508 #if 0
1509                         fprintf(stderr,"ssl_parse_clienthello_tlsext s->session->tlsext_ecpointformatlist (length=%i) ", s->session->tlsext_ecpointformatlist_length);
1510                         sdata = s->session->tlsext_ecpointformatlist;
1511                         for (i = 0; i < s->session->tlsext_ecpointformatlist_length; i++)
1512                                 fprintf(stderr,"%i ",*(sdata++));
1513                         fprintf(stderr,"\n");
1514 #endif
1515                         }
1516                 else if (type == TLSEXT_TYPE_elliptic_curves &&
1517                      s->version != DTLS1_VERSION)
1518                         {
1519                         unsigned char *sdata = data;
1520                         int ellipticcurvelist_length = (*(sdata++) << 8);
1521                         ellipticcurvelist_length += (*(sdata++));
1522
1523                         if (ellipticcurvelist_length != size - 2)
1524                                 {
1525                                 *al = TLS1_AD_DECODE_ERROR;
1526                                 return 0;
1527                                 }
1528                         if (!s->hit)
1529                                 {
1530                                 if(s->session->tlsext_ellipticcurvelist)
1531                                         {
1532                                         *al = TLS1_AD_DECODE_ERROR;
1533                                         return 0;
1534                                         }
1535                                 s->session->tlsext_ellipticcurvelist_length = 0;
1536                                 if ((s->session->tlsext_ellipticcurvelist = OPENSSL_malloc(ellipticcurvelist_length)) == NULL)
1537                                         {
1538                                         *al = TLS1_AD_INTERNAL_ERROR;
1539                                         return 0;
1540                                         }
1541                                 s->session->tlsext_ellipticcurvelist_length = ellipticcurvelist_length;
1542                                 memcpy(s->session->tlsext_ellipticcurvelist, sdata, ellipticcurvelist_length);
1543                                 }
1544 #if 0
1545                         fprintf(stderr,"ssl_parse_clienthello_tlsext s->session->tlsext_ellipticcurvelist (length=%i) ", s->session->tlsext_ellipticcurvelist_length);
1546                         sdata = s->session->tlsext_ellipticcurvelist;
1547                         for (i = 0; i < s->session->tlsext_ellipticcurvelist_length; i++)
1548                                 fprintf(stderr,"%i ",*(sdata++));
1549                         fprintf(stderr,"\n");
1550 #endif
1551                         }
1552 #endif /* OPENSSL_NO_EC */
1553 #ifdef TLSEXT_TYPE_opaque_prf_input
1554                 else if (type == TLSEXT_TYPE_opaque_prf_input &&
1555                      s->version != DTLS1_VERSION)
1556                         {
1557                         unsigned char *sdata = data;
1558
1559                         if (size < 2)
1560                                 {
1561                                 *al = SSL_AD_DECODE_ERROR;
1562                                 return 0;
1563                                 }
1564                         n2s(sdata, s->s3->client_opaque_prf_input_len);
1565                         if (s->s3->client_opaque_prf_input_len != size - 2)
1566                                 {
1567                                 *al = SSL_AD_DECODE_ERROR;
1568                                 return 0;
1569                                 }
1570
1571                         if (s->s3->client_opaque_prf_input != NULL) /* shouldn't really happen */
1572                                 OPENSSL_free(s->s3->client_opaque_prf_input);
1573                         if (s->s3->client_opaque_prf_input_len == 0)
1574                                 s->s3->client_opaque_prf_input = OPENSSL_malloc(1); /* dummy byte just to get non-NULL */
1575                         else
1576                                 s->s3->client_opaque_prf_input = BUF_memdup(sdata, s->s3->client_opaque_prf_input_len);
1577                         if (s->s3->client_opaque_prf_input == NULL)
1578                                 {
1579                                 *al = TLS1_AD_INTERNAL_ERROR;
1580                                 return 0;
1581                                 }
1582                         }
1583 #endif
1584                 else if (type == TLSEXT_TYPE_session_ticket)
1585                         {
1586                         if (s->tls_session_ticket_ext_cb &&
1587                             !s->tls_session_ticket_ext_cb(s, data, size, s->tls_session_ticket_ext_cb_arg))
1588                                 {
1589                                 *al = TLS1_AD_INTERNAL_ERROR;
1590                                 return 0;
1591                                 }
1592                         }
1593                 else if (type == TLSEXT_TYPE_renegotiate)
1594                         {
1595                         if(!ssl_parse_clienthello_renegotiate_ext(s, data, size, al))
1596                                 return 0;
1597                         renegotiate_seen = 1;
1598                         }
1599                 else if (type == TLSEXT_TYPE_signature_algorithms)
1600                         {
1601                         int dsize;
1602                         if (sigalg_seen || size < 2)
1603                                 {
1604                                 *al = SSL_AD_DECODE_ERROR;
1605                                 return 0;
1606                                 }
1607                         sigalg_seen = 1;
1608                         n2s(data,dsize);
1609                         size -= 2;
1610                         if (dsize != size || dsize & 1)
1611                                 {
1612                                 *al = SSL_AD_DECODE_ERROR;
1613                                 return 0;
1614                                 }
1615                         if (!tls1_process_sigalgs(s, data, dsize))
1616                                 {
1617                                 *al = SSL_AD_DECODE_ERROR;
1618                                 return 0;
1619                                 }
1620                         }
1621                 else if (type == TLSEXT_TYPE_status_request &&
1622                          s->version != DTLS1_VERSION && s->ctx->tlsext_status_cb)
1623                         {
1624
1625                         if (size < 5)
1626                                 {
1627                                 *al = SSL_AD_DECODE_ERROR;
1628                                 return 0;
1629                                 }
1630
1631                         s->tlsext_status_type = *data++;
1632                         size--;
1633                         if (s->tlsext_status_type == TLSEXT_STATUSTYPE_ocsp)
1634                                 {
1635                                 const unsigned char *sdata;
1636                                 int dsize;
1637                                 /* Read in responder_id_list */
1638                                 n2s(data,dsize);
1639                                 size -= 2;
1640                                 if (dsize > size  )
1641                                         {
1642                                         *al = SSL_AD_DECODE_ERROR;
1643                                         return 0;
1644                                         }
1645                                 while (dsize > 0)
1646                                         {
1647                                         OCSP_RESPID *id;
1648                                         int idsize;
1649                                         if (dsize < 4)
1650                                                 {
1651                                                 *al = SSL_AD_DECODE_ERROR;
1652                                                 return 0;
1653                                                 }
1654                                         n2s(data, idsize);
1655                                         dsize -= 2 + idsize;
1656                                         size -= 2 + idsize;
1657                                         if (dsize < 0)
1658                                                 {
1659                                                 *al = SSL_AD_DECODE_ERROR;
1660                                                 return 0;
1661                                                 }
1662                                         sdata = data;
1663                                         data += idsize;
1664                                         id = d2i_OCSP_RESPID(NULL,
1665                                                                 &sdata, idsize);
1666                                         if (!id)
1667                                                 {
1668                                                 *al = SSL_AD_DECODE_ERROR;
1669                                                 return 0;
1670                                                 }
1671                                         if (data != sdata)
1672                                                 {
1673                                                 OCSP_RESPID_free(id);
1674                                                 *al = SSL_AD_DECODE_ERROR;
1675                                                 return 0;
1676                                                 }
1677                                         if (!s->tlsext_ocsp_ids
1678                                                 && !(s->tlsext_ocsp_ids =
1679                                                 sk_OCSP_RESPID_new_null()))
1680                                                 {
1681                                                 OCSP_RESPID_free(id);
1682                                                 *al = SSL_AD_INTERNAL_ERROR;
1683                                                 return 0;
1684                                                 }
1685                                         if (!sk_OCSP_RESPID_push(
1686                                                         s->tlsext_ocsp_ids, id))
1687                                                 {
1688                                                 OCSP_RESPID_free(id);
1689                                                 *al = SSL_AD_INTERNAL_ERROR;
1690                                                 return 0;
1691                                                 }
1692                                         }
1693
1694                                 /* Read in request_extensions */
1695                                 if (size < 2)
1696                                         {
1697                                         *al = SSL_AD_DECODE_ERROR;
1698                                         return 0;
1699                                         }
1700                                 n2s(data,dsize);
1701                                 size -= 2;
1702                                 if (dsize != size)
1703                                         {
1704                                         *al = SSL_AD_DECODE_ERROR;
1705                                         return 0;
1706                                         }
1707                                 sdata = data;
1708                                 if (dsize > 0)
1709                                         {
1710                                         if (s->tlsext_ocsp_exts)
1711                                                 {
1712                                                 sk_X509_EXTENSION_pop_free(s->tlsext_ocsp_exts,
1713                                                                            X509_EXTENSION_free);
1714                                                 }
1715
1716                                         s->tlsext_ocsp_exts =
1717                                                 d2i_X509_EXTENSIONS(NULL,
1718                                                         &sdata, dsize);
1719                                         if (!s->tlsext_ocsp_exts
1720                                                 || (data + dsize != sdata))
1721                                                 {
1722                                                 *al = SSL_AD_DECODE_ERROR;
1723                                                 return 0;
1724                                                 }
1725                                         }
1726                                 }
1727                                 /* We don't know what to do with any other type
1728                                 * so ignore it.
1729                                 */
1730                                 else
1731                                         s->tlsext_status_type = -1;
1732                         }
1733 #ifndef OPENSSL_NO_HEARTBEATS
1734                 else if (type == TLSEXT_TYPE_heartbeat)
1735                         {
1736                         switch(data[0])
1737                                 {
1738                                 case 0x01:      /* Client allows us to send HB requests */
1739                                                         s->tlsext_heartbeat |= SSL_TLSEXT_HB_ENABLED;
1740                                                         break;
1741                                 case 0x02:      /* Client doesn't accept HB requests */
1742                                                         s->tlsext_heartbeat |= SSL_TLSEXT_HB_ENABLED;
1743                                                         s->tlsext_heartbeat |= SSL_TLSEXT_HB_DONT_SEND_REQUESTS;
1744                                                         break;
1745                                 default:        *al = SSL_AD_ILLEGAL_PARAMETER;
1746                                                         return 0;
1747                                 }
1748                         }
1749 #endif
1750 #ifndef OPENSSL_NO_NEXTPROTONEG
1751                 else if (type == TLSEXT_TYPE_next_proto_neg &&
1752                          s->s3->tmp.finish_md_len == 0)
1753                         {
1754                         /* We shouldn't accept this extension on a
1755                          * renegotiation.
1756                          *
1757                          * s->new_session will be set on renegotiation, but we
1758                          * probably shouldn't rely that it couldn't be set on
1759                          * the initial renegotation too in certain cases (when
1760                          * there's some other reason to disallow resuming an
1761                          * earlier session -- the current code won't be doing
1762                          * anything like that, but this might change).
1763
1764                          * A valid sign that there's been a previous handshake
1765                          * in this connection is if s->s3->tmp.finish_md_len >
1766                          * 0.  (We are talking about a check that will happen
1767                          * in the Hello protocol round, well before a new
1768                          * Finished message could have been computed.) */
1769                         s->s3->next_proto_neg_seen = 1;
1770                         }
1771 #endif
1772
1773                 /* session ticket processed earlier */
1774                 else if (type == TLSEXT_TYPE_use_srtp)
1775                         {
1776                         if(ssl_parse_clienthello_use_srtp_ext(s, data, size,
1777                                                               al))
1778                                 return 0;
1779                         }
1780
1781                 else if (type == TLSEXT_TYPE_server_authz)
1782                         {
1783                         unsigned char *sdata = data;
1784                         unsigned char server_authz_dataformatlist_length;
1785
1786                         if (size == 0)
1787                                 {
1788                                 *al = TLS1_AD_DECODE_ERROR;
1789                                 return 0;
1790                                 }
1791
1792                         server_authz_dataformatlist_length = *(sdata++);
1793
1794                         if (server_authz_dataformatlist_length != size - 1)
1795                                 {
1796                                 *al = TLS1_AD_DECODE_ERROR;
1797                                 return 0;
1798                                 }
1799
1800                         /* Successful session resumption uses the same authz
1801                          * information as the original session so we ignore this
1802                          * in the case of a session resumption. */
1803                         if (!s->hit)
1804                                 {
1805                                 size_t i;
1806                                 if (s->s3->tlsext_authz_client_types != NULL)
1807                                         OPENSSL_free(s->s3->tlsext_authz_client_types);
1808                                 s->s3->tlsext_authz_client_types =
1809                                         OPENSSL_malloc(server_authz_dataformatlist_length);
1810                                 if (!s->s3->tlsext_authz_client_types)
1811                                         {
1812                                         *al = TLS1_AD_INTERNAL_ERROR;
1813                                         return 0;
1814                                         }
1815
1816                                 s->s3->tlsext_authz_client_types_len =
1817                                         server_authz_dataformatlist_length;
1818                                 memcpy(s->s3->tlsext_authz_client_types,
1819                                        sdata,
1820                                        server_authz_dataformatlist_length);
1821
1822                                 /* Sort the types in order to check for duplicates. */
1823                                 qsort(s->s3->tlsext_authz_client_types,
1824                                       server_authz_dataformatlist_length,
1825                                       1 /* element size */,
1826                                       byte_compare);
1827
1828                                 for (i = 0; i < server_authz_dataformatlist_length; i++)
1829                                         {
1830                                         if (i > 0 &&
1831                                             s->s3->tlsext_authz_client_types[i] ==
1832                                               s->s3->tlsext_authz_client_types[i-1])
1833                                                 {
1834                                                 *al = TLS1_AD_DECODE_ERROR;
1835                                                 return 0;
1836                                                 }
1837                                         }
1838                                 }
1839                         }
1840
1841                 data+=size;
1842                 }
1843
1844         *p = data;
1845
1846         ri_check:
1847
1848         /* Need RI if renegotiating */
1849
1850         if (!renegotiate_seen && s->renegotiate &&
1851                 !(s->options & SSL_OP_ALLOW_UNSAFE_LEGACY_RENEGOTIATION))
1852                 {
1853                 *al = SSL_AD_HANDSHAKE_FAILURE;
1854                 SSLerr(SSL_F_SSL_SCAN_CLIENTHELLO_TLSEXT,
1855                                 SSL_R_UNSAFE_LEGACY_RENEGOTIATION_DISABLED);
1856                 return 0;
1857                 }
1858
1859         return 1;
1860         }
1861
1862 int ssl_parse_clienthello_tlsext(SSL *s, unsigned char **p, unsigned char *d, int n)
1863         {
1864         int al = -1;
1865         if (ssl_scan_clienthello_tlsext(s, p, d, n, &al) <= 0)
1866                 {
1867                 ssl3_send_alert(s,SSL3_AL_FATAL,al);
1868                 return 0;
1869                 }
1870
1871         if (ssl_check_clienthello_tlsext(s) <= 0)
1872                 {
1873                 SSLerr(SSL_F_SSL_PARSE_CLIENTHELLO_TLSEXT,SSL_R_CLIENTHELLO_TLSEXT);
1874                 return 0;
1875                 }
1876         return 1;
1877 }
1878
1879 #ifndef OPENSSL_NO_NEXTPROTONEG
1880 /* ssl_next_proto_validate validates a Next Protocol Negotiation block. No
1881  * elements of zero length are allowed and the set of elements must exactly fill
1882  * the length of the block. */
1883 static char ssl_next_proto_validate(unsigned char *d, unsigned len)
1884         {
1885         unsigned int off = 0;
1886
1887         while (off < len)
1888                 {
1889                 if (d[off] == 0)
1890                         return 0;
1891                 off += d[off];
1892                 off++;
1893                 }
1894
1895         return off == len;
1896         }
1897 #endif
1898
1899 static int ssl_scan_serverhello_tlsext(SSL *s, unsigned char **p, unsigned char *d, int n, int *al)
1900         {
1901         unsigned short length;
1902         unsigned short type;
1903         unsigned short size;
1904         unsigned char *data = *p;
1905         int tlsext_servername = 0;
1906         int renegotiate_seen = 0;
1907
1908 #ifndef OPENSSL_NO_NEXTPROTONEG
1909         s->s3->next_proto_neg_seen = 0;
1910 #endif
1911
1912 #ifndef OPENSSL_NO_HEARTBEATS
1913         s->tlsext_heartbeat &= ~(SSL_TLSEXT_HB_ENABLED |
1914                                SSL_TLSEXT_HB_DONT_SEND_REQUESTS);
1915 #endif
1916
1917         if (data >= (d+n-2))
1918                 goto ri_check;
1919
1920         n2s(data,length);
1921         if (data+length != d+n)
1922                 {
1923                 *al = SSL_AD_DECODE_ERROR;
1924                 return 0;
1925                 }
1926
1927         while(data <= (d+n-4))
1928                 {
1929                 n2s(data,type);
1930                 n2s(data,size);
1931
1932                 if (data+size > (d+n))
1933                         goto ri_check;
1934
1935                 if (s->tlsext_debug_cb)
1936                         s->tlsext_debug_cb(s, 1, type, data, size,
1937                                                 s->tlsext_debug_arg);
1938
1939                 if (type == TLSEXT_TYPE_server_name)
1940                         {
1941                         if (s->tlsext_hostname == NULL || size > 0)
1942                                 {
1943                                 *al = TLS1_AD_UNRECOGNIZED_NAME;
1944                                 return 0;
1945                                 }
1946                         tlsext_servername = 1;
1947                         }
1948
1949 #ifndef OPENSSL_NO_EC
1950                 else if (type == TLSEXT_TYPE_ec_point_formats &&
1951                      s->version != DTLS1_VERSION)
1952                         {
1953                         unsigned char *sdata = data;
1954                         int ecpointformatlist_length = *(sdata++);
1955
1956                         if (ecpointformatlist_length != size - 1)
1957                                 {
1958                                 *al = TLS1_AD_DECODE_ERROR;
1959                                 return 0;
1960                                 }
1961                         s->session->tlsext_ecpointformatlist_length = 0;
1962                         if (s->session->tlsext_ecpointformatlist != NULL) OPENSSL_free(s->session->tlsext_ecpointformatlist);
1963                         if ((s->session->tlsext_ecpointformatlist = OPENSSL_malloc(ecpointformatlist_length)) == NULL)
1964                                 {
1965                                 *al = TLS1_AD_INTERNAL_ERROR;
1966                                 return 0;
1967                                 }
1968                         s->session->tlsext_ecpointformatlist_length = ecpointformatlist_length;
1969                         memcpy(s->session->tlsext_ecpointformatlist, sdata, ecpointformatlist_length);
1970 #if 0
1971                         fprintf(stderr,"ssl_parse_serverhello_tlsext s->session->tlsext_ecpointformatlist ");
1972                         sdata = s->session->tlsext_ecpointformatlist;
1973                         for (i = 0; i < s->session->tlsext_ecpointformatlist_length; i++)
1974                                 fprintf(stderr,"%i ",*(sdata++));
1975                         fprintf(stderr,"\n");
1976 #endif
1977                         }
1978 #endif /* OPENSSL_NO_EC */
1979
1980                 else if (type == TLSEXT_TYPE_session_ticket)
1981                         {
1982                         if (s->tls_session_ticket_ext_cb &&
1983                             !s->tls_session_ticket_ext_cb(s, data, size, s->tls_session_ticket_ext_cb_arg))
1984                                 {
1985                                 *al = TLS1_AD_INTERNAL_ERROR;
1986                                 return 0;
1987                                 }
1988                         if ((SSL_get_options(s) & SSL_OP_NO_TICKET)
1989                                 || (size > 0))
1990                                 {
1991                                 *al = TLS1_AD_UNSUPPORTED_EXTENSION;
1992                                 return 0;
1993                                 }
1994                         s->tlsext_ticket_expected = 1;
1995                         }
1996 #ifdef TLSEXT_TYPE_opaque_prf_input
1997                 else if (type == TLSEXT_TYPE_opaque_prf_input &&
1998                      s->version != DTLS1_VERSION)
1999                         {
2000                         unsigned char *sdata = data;
2001
2002                         if (size < 2)
2003                                 {
2004                                 *al = SSL_AD_DECODE_ERROR;
2005                                 return 0;
2006                                 }
2007                         n2s(sdata, s->s3->server_opaque_prf_input_len);
2008                         if (s->s3->server_opaque_prf_input_len != size - 2)
2009                                 {
2010                                 *al = SSL_AD_DECODE_ERROR;
2011                                 return 0;
2012                                 }
2013
2014                         if (s->s3->server_opaque_prf_input != NULL) /* shouldn't really happen */
2015                                 OPENSSL_free(s->s3->server_opaque_prf_input);
2016                         if (s->s3->server_opaque_prf_input_len == 0)
2017                                 s->s3->server_opaque_prf_input = OPENSSL_malloc(1); /* dummy byte just to get non-NULL */
2018                         else
2019                                 s->s3->server_opaque_prf_input = BUF_memdup(sdata, s->s3->server_opaque_prf_input_len);
2020
2021                         if (s->s3->server_opaque_prf_input == NULL)
2022                                 {
2023                                 *al = TLS1_AD_INTERNAL_ERROR;
2024                                 return 0;
2025                                 }
2026                         }
2027 #endif
2028                 else if (type == TLSEXT_TYPE_status_request &&
2029                          s->version != DTLS1_VERSION)
2030                         {
2031                         /* MUST be empty and only sent if we've requested
2032                          * a status request message.
2033                          */
2034                         if ((s->tlsext_status_type == -1) || (size > 0))
2035                                 {
2036                                 *al = TLS1_AD_UNSUPPORTED_EXTENSION;
2037                                 return 0;
2038                                 }
2039                         /* Set flag to expect CertificateStatus message */
2040                         s->tlsext_status_expected = 1;
2041                         }
2042 #ifndef OPENSSL_NO_NEXTPROTONEG
2043                 else if (type == TLSEXT_TYPE_next_proto_neg &&
2044                          s->s3->tmp.finish_md_len == 0)
2045                         {
2046                         unsigned char *selected;
2047                         unsigned char selected_len;
2048
2049                         /* We must have requested it. */
2050                         if ((s->ctx->next_proto_select_cb == NULL))
2051                                 {
2052                                 *al = TLS1_AD_UNSUPPORTED_EXTENSION;
2053                                 return 0;
2054                                 }
2055                         /* The data must be valid */
2056                         if (!ssl_next_proto_validate(data, size))
2057                                 {
2058                                 *al = TLS1_AD_DECODE_ERROR;
2059                                 return 0;
2060                                 }
2061                         if (s->ctx->next_proto_select_cb(s, &selected, &selected_len, data, size, s->ctx->next_proto_select_cb_arg) != SSL_TLSEXT_ERR_OK)
2062                                 {
2063                                 *al = TLS1_AD_INTERNAL_ERROR;
2064                                 return 0;
2065                                 }
2066                         s->next_proto_negotiated = OPENSSL_malloc(selected_len);
2067                         if (!s->next_proto_negotiated)
2068                                 {
2069                                 *al = TLS1_AD_INTERNAL_ERROR;
2070                                 return 0;
2071                                 }
2072                         memcpy(s->next_proto_negotiated, selected, selected_len);
2073                         s->next_proto_negotiated_len = selected_len;
2074                         s->s3->next_proto_neg_seen = 1;
2075                         }
2076 #endif
2077                 else if (type == TLSEXT_TYPE_renegotiate)
2078                         {
2079                         if(!ssl_parse_serverhello_renegotiate_ext(s, data, size, al))
2080                                 return 0;
2081                         renegotiate_seen = 1;
2082                         }
2083 #ifndef OPENSSL_NO_HEARTBEATS
2084                 else if (type == TLSEXT_TYPE_heartbeat)
2085                         {
2086                         switch(data[0])
2087                                 {
2088                                 case 0x01:      /* Server allows us to send HB requests */
2089                                                         s->tlsext_heartbeat |= SSL_TLSEXT_HB_ENABLED;
2090                                                         break;
2091                                 case 0x02:      /* Server doesn't accept HB requests */
2092                                                         s->tlsext_heartbeat |= SSL_TLSEXT_HB_ENABLED;
2093                                                         s->tlsext_heartbeat |= SSL_TLSEXT_HB_DONT_SEND_REQUESTS;
2094                                                         break;
2095                                 default:        *al = SSL_AD_ILLEGAL_PARAMETER;
2096                                                         return 0;
2097                                 }
2098                         }
2099 #endif
2100                 else if (type == TLSEXT_TYPE_use_srtp)
2101                         {
2102                         if(ssl_parse_serverhello_use_srtp_ext(s, data, size,
2103                                                               al))
2104                                 return 0;
2105                         }
2106
2107                 else if (type == TLSEXT_TYPE_server_authz)
2108                         {
2109                         /* We only support audit proofs. It's an error to send
2110                          * an authz hello extension if the client
2111                          * didn't request a proof. */
2112                         unsigned char *sdata = data;
2113                         unsigned char server_authz_dataformatlist_length;
2114
2115                         if (!s->ctx->tlsext_authz_server_audit_proof_cb)
2116                                 {
2117                                 *al = TLS1_AD_UNSUPPORTED_EXTENSION;
2118                                 return 0;
2119                                 }
2120
2121                         if (!size)
2122                                 {
2123                                 *al = TLS1_AD_DECODE_ERROR;
2124                                 return 0;
2125                                 }
2126
2127                         server_authz_dataformatlist_length = *(sdata++);
2128                         if (server_authz_dataformatlist_length != size - 1)
2129                                 {
2130                                 *al = TLS1_AD_DECODE_ERROR;
2131                                 return 0;
2132                                 }
2133
2134                         /* We only support audit proofs, so a legal ServerHello
2135                          * authz list contains exactly one entry. */
2136                         if (server_authz_dataformatlist_length != 1 ||
2137                                 sdata[0] != TLSEXT_AUTHZDATAFORMAT_audit_proof)
2138                                 {
2139                                 *al = TLS1_AD_UNSUPPORTED_EXTENSION;
2140                                 return 0;
2141                                 }
2142
2143                         s->s3->tlsext_authz_server_promised = 1;
2144                         }
2145
2146                 data += size;
2147                 }
2148
2149         if (data != d+n)
2150                 {
2151                 *al = SSL_AD_DECODE_ERROR;
2152                 return 0;
2153                 }
2154
2155         if (!s->hit && tlsext_servername == 1)
2156                 {
2157                 if (s->tlsext_hostname)
2158                         {
2159                         if (s->session->tlsext_hostname == NULL)
2160                                 {
2161                                 s->session->tlsext_hostname = BUF_strdup(s->tlsext_hostname);
2162                                 if (!s->session->tlsext_hostname)
2163                                         {
2164                                         *al = SSL_AD_UNRECOGNIZED_NAME;
2165                                         return 0;
2166                                         }
2167                                 }
2168                         else
2169                                 {
2170                                 *al = SSL_AD_DECODE_ERROR;
2171                                 return 0;
2172                                 }
2173                         }
2174                 }
2175
2176         *p = data;
2177
2178         ri_check:
2179
2180         /* Determine if we need to see RI. Strictly speaking if we want to
2181          * avoid an attack we should *always* see RI even on initial server
2182          * hello because the client doesn't see any renegotiation during an
2183          * attack. However this would mean we could not connect to any server
2184          * which doesn't support RI so for the immediate future tolerate RI
2185          * absence on initial connect only.
2186          */
2187         if (!renegotiate_seen
2188                 && !(s->options & SSL_OP_LEGACY_SERVER_CONNECT)
2189                 && !(s->options & SSL_OP_ALLOW_UNSAFE_LEGACY_RENEGOTIATION))
2190                 {
2191                 *al = SSL_AD_HANDSHAKE_FAILURE;
2192                 SSLerr(SSL_F_SSL_SCAN_SERVERHELLO_TLSEXT,
2193                                 SSL_R_UNSAFE_LEGACY_RENEGOTIATION_DISABLED);
2194                 return 0;
2195                 }
2196
2197         return 1;
2198         }
2199
2200
2201 int ssl_prepare_clienthello_tlsext(SSL *s)
2202         {
2203
2204 #ifdef TLSEXT_TYPE_opaque_prf_input
2205         {
2206                 int r = 1;
2207
2208                 if (s->ctx->tlsext_opaque_prf_input_callback != 0)
2209                         {
2210                         r = s->ctx->tlsext_opaque_prf_input_callback(s, NULL, 0, s->ctx->tlsext_opaque_prf_input_callback_arg);
2211                         if (!r)
2212                                 return -1;
2213                         }
2214
2215                 if (s->tlsext_opaque_prf_input != NULL)
2216                         {
2217                         if (s->s3->client_opaque_prf_input != NULL) /* shouldn't really happen */
2218                                 OPENSSL_free(s->s3->client_opaque_prf_input);
2219
2220                         if (s->tlsext_opaque_prf_input_len == 0)
2221                                 s->s3->client_opaque_prf_input = OPENSSL_malloc(1); /* dummy byte just to get non-NULL */
2222                         else
2223                                 s->s3->client_opaque_prf_input = BUF_memdup(s->tlsext_opaque_prf_input, s->tlsext_opaque_prf_input_len);
2224                         if (s->s3->client_opaque_prf_input == NULL)
2225                                 {
2226                                 SSLerr(SSL_F_SSL_PREPARE_CLIENTHELLO_TLSEXT,ERR_R_MALLOC_FAILURE);
2227                                 return -1;
2228                                 }
2229                         s->s3->client_opaque_prf_input_len = s->tlsext_opaque_prf_input_len;
2230                         }
2231
2232                 if (r == 2)
2233                         /* at callback's request, insist on receiving an appropriate server opaque PRF input */
2234                         s->s3->server_opaque_prf_input_len = s->tlsext_opaque_prf_input_len;
2235         }
2236 #endif
2237
2238         return 1;
2239         }
2240
2241 int ssl_prepare_serverhello_tlsext(SSL *s)
2242         {
2243 #ifndef OPENSSL_NO_EC
2244         /* If we are server and using an ECC cipher suite, send the point formats we support
2245          * if the client sent us an ECPointsFormat extension.  Note that the server is not
2246          * supposed to send an EllipticCurves extension.
2247          */
2248
2249         unsigned long alg_k = s->s3->tmp.new_cipher->algorithm_mkey;
2250         unsigned long alg_a = s->s3->tmp.new_cipher->algorithm_auth;
2251         int using_ecc = (alg_k & (SSL_kEECDH|SSL_kECDHr|SSL_kECDHe)) || (alg_a & SSL_aECDSA);
2252         using_ecc = using_ecc && (s->session->tlsext_ecpointformatlist != NULL);
2253
2254         if (using_ecc)
2255                 {
2256                 if (s->tlsext_ecpointformatlist != NULL) OPENSSL_free(s->tlsext_ecpointformatlist);
2257                 if ((s->tlsext_ecpointformatlist = OPENSSL_malloc(3)) == NULL)
2258                         {
2259                         SSLerr(SSL_F_SSL_PREPARE_SERVERHELLO_TLSEXT,ERR_R_MALLOC_FAILURE);
2260                         return -1;
2261                         }
2262                 s->tlsext_ecpointformatlist_length = 3;
2263                 s->tlsext_ecpointformatlist[0] = TLSEXT_ECPOINTFORMAT_uncompressed;
2264                 s->tlsext_ecpointformatlist[1] = TLSEXT_ECPOINTFORMAT_ansiX962_compressed_prime;
2265                 s->tlsext_ecpointformatlist[2] = TLSEXT_ECPOINTFORMAT_ansiX962_compressed_char2;
2266                 }
2267 #endif /* OPENSSL_NO_EC */
2268
2269         return 1;
2270         }
2271
2272 static int ssl_check_clienthello_tlsext(SSL *s)
2273         {
2274         int ret=SSL_TLSEXT_ERR_NOACK;
2275         int al = SSL_AD_UNRECOGNIZED_NAME;
2276
2277 #ifndef OPENSSL_NO_EC
2278         /* The handling of the ECPointFormats extension is done elsewhere, namely in
2279          * ssl3_choose_cipher in s3_lib.c.
2280          */
2281         /* The handling of the EllipticCurves extension is done elsewhere, namely in
2282          * ssl3_choose_cipher in s3_lib.c.
2283          */
2284 #endif
2285
2286         if (s->ctx != NULL && s->ctx->tlsext_servername_callback != 0)
2287                 ret = s->ctx->tlsext_servername_callback(s, &al, s->ctx->tlsext_servername_arg);
2288         else if (s->initial_ctx != NULL && s->initial_ctx->tlsext_servername_callback != 0)
2289                 ret = s->initial_ctx->tlsext_servername_callback(s, &al, s->initial_ctx->tlsext_servername_arg);
2290
2291         /* If status request then ask callback what to do.
2292          * Note: this must be called after servername callbacks in case
2293          * the certificate has changed.
2294          */
2295         if ((s->tlsext_status_type != -1) && s->ctx && s->ctx->tlsext_status_cb)
2296                 {
2297                 int r;
2298                 r = s->ctx->tlsext_status_cb(s, s->ctx->tlsext_status_arg);
2299                 switch (r)
2300                         {
2301                         /* We don't want to send a status request response */
2302                         case SSL_TLSEXT_ERR_NOACK:
2303                                 s->tlsext_status_expected = 0;
2304                                 break;
2305                         /* status request response should be sent */
2306                         case SSL_TLSEXT_ERR_OK:
2307                                 if (s->tlsext_ocsp_resp)
2308                                         s->tlsext_status_expected = 1;
2309                                 else
2310                                         s->tlsext_status_expected = 0;
2311                                 break;
2312                         /* something bad happened */
2313                         case SSL_TLSEXT_ERR_ALERT_FATAL:
2314                                 ret = SSL_TLSEXT_ERR_ALERT_FATAL;
2315                                 al = SSL_AD_INTERNAL_ERROR;
2316                                 goto err;
2317                         }
2318                 }
2319         else
2320                 s->tlsext_status_expected = 0;
2321
2322 #ifdef TLSEXT_TYPE_opaque_prf_input
2323         {
2324                 /* This sort of belongs into ssl_prepare_serverhello_tlsext(),
2325                  * but we might be sending an alert in response to the client hello,
2326                  * so this has to happen here in ssl_check_clienthello_tlsext(). */
2327
2328                 int r = 1;
2329
2330                 if (s->ctx->tlsext_opaque_prf_input_callback != 0)
2331                         {
2332                         r = s->ctx->tlsext_opaque_prf_input_callback(s, NULL, 0, s->ctx->tlsext_opaque_prf_input_callback_arg);
2333                         if (!r)
2334                                 {
2335                                 ret = SSL_TLSEXT_ERR_ALERT_FATAL;
2336                                 al = SSL_AD_INTERNAL_ERROR;
2337                                 goto err;
2338                                 }
2339                         }
2340
2341                 if (s->s3->server_opaque_prf_input != NULL) /* shouldn't really happen */
2342                         OPENSSL_free(s->s3->server_opaque_prf_input);
2343                 s->s3->server_opaque_prf_input = NULL;
2344
2345                 if (s->tlsext_opaque_prf_input != NULL)
2346                         {
2347                         if (s->s3->client_opaque_prf_input != NULL &&
2348                                 s->s3->client_opaque_prf_input_len == s->tlsext_opaque_prf_input_len)
2349                                 {
2350                                 /* can only use this extension if we have a server opaque PRF input
2351                                  * of the same length as the client opaque PRF input! */
2352
2353                                 if (s->tlsext_opaque_prf_input_len == 0)
2354                                         s->s3->server_opaque_prf_input = OPENSSL_malloc(1); /* dummy byte just to get non-NULL */
2355                                 else
2356                                         s->s3->server_opaque_prf_input = BUF_memdup(s->tlsext_opaque_prf_input, s->tlsext_opaque_prf_input_len);
2357                                 if (s->s3->server_opaque_prf_input == NULL)
2358                                         {
2359                                         ret = SSL_TLSEXT_ERR_ALERT_FATAL;
2360                                         al = SSL_AD_INTERNAL_ERROR;
2361                                         goto err;
2362                                         }
2363                                 s->s3->server_opaque_prf_input_len = s->tlsext_opaque_prf_input_len;
2364                                 }
2365                         }
2366
2367                 if (r == 2 && s->s3->server_opaque_prf_input == NULL)
2368                         {
2369                         /* The callback wants to enforce use of the extension,
2370                          * but we can't do that with the client opaque PRF input;
2371                          * abort the handshake.
2372                          */
2373                         ret = SSL_TLSEXT_ERR_ALERT_FATAL;
2374                         al = SSL_AD_HANDSHAKE_FAILURE;
2375                         }
2376         }
2377
2378 #endif
2379  err:
2380         switch (ret)
2381                 {
2382                 case SSL_TLSEXT_ERR_ALERT_FATAL:
2383                         ssl3_send_alert(s,SSL3_AL_FATAL,al);
2384                         return -1;
2385
2386                 case SSL_TLSEXT_ERR_ALERT_WARNING:
2387                         ssl3_send_alert(s,SSL3_AL_WARNING,al);
2388                         return 1;
2389
2390                 case SSL_TLSEXT_ERR_NOACK:
2391                         s->servername_done=0;
2392                         default:
2393                 return 1;
2394                 }
2395         }
2396
2397 int ssl_check_serverhello_tlsext(SSL *s)
2398         {
2399         int ret=SSL_TLSEXT_ERR_NOACK;
2400         int al = SSL_AD_UNRECOGNIZED_NAME;
2401
2402 #ifndef OPENSSL_NO_EC
2403         /* If we are client and using an elliptic curve cryptography cipher
2404          * suite, then if server returns an EC point formats lists extension
2405          * it must contain uncompressed.
2406          */
2407         unsigned long alg_k = s->s3->tmp.new_cipher->algorithm_mkey;
2408         unsigned long alg_a = s->s3->tmp.new_cipher->algorithm_auth;
2409         if ((s->tlsext_ecpointformatlist != NULL) && (s->tlsext_ecpointformatlist_length > 0) &&
2410             (s->session->tlsext_ecpointformatlist != NULL) && (s->session->tlsext_ecpointformatlist_length > 0) &&
2411             ((alg_k & (SSL_kEECDH|SSL_kECDHr|SSL_kECDHe)) || (alg_a & SSL_aECDSA)))
2412                 {
2413                 /* we are using an ECC cipher */
2414                 size_t i;
2415                 unsigned char *list;
2416                 int found_uncompressed = 0;
2417                 list = s->session->tlsext_ecpointformatlist;
2418                 for (i = 0; i < s->session->tlsext_ecpointformatlist_length; i++)
2419                         {
2420                         if (*(list++) == TLSEXT_ECPOINTFORMAT_uncompressed)
2421                                 {
2422                                 found_uncompressed = 1;
2423                                 break;
2424                                 }
2425                         }
2426                 if (!found_uncompressed)
2427                         {
2428                         SSLerr(SSL_F_SSL_CHECK_SERVERHELLO_TLSEXT,SSL_R_TLS_INVALID_ECPOINTFORMAT_LIST);
2429                         return -1;
2430                         }
2431                 }
2432         ret = SSL_TLSEXT_ERR_OK;
2433 #endif /* OPENSSL_NO_EC */
2434
2435         if (s->ctx != NULL && s->ctx->tlsext_servername_callback != 0)
2436                 ret = s->ctx->tlsext_servername_callback(s, &al, s->ctx->tlsext_servername_arg);
2437         else if (s->initial_ctx != NULL && s->initial_ctx->tlsext_servername_callback != 0)
2438                 ret = s->initial_ctx->tlsext_servername_callback(s, &al, s->initial_ctx->tlsext_servername_arg);
2439
2440 #ifdef TLSEXT_TYPE_opaque_prf_input
2441         if (s->s3->server_opaque_prf_input_len > 0)
2442                 {
2443                 /* This case may indicate that we, as a client, want to insist on using opaque PRF inputs.
2444                  * So first verify that we really have a value from the server too. */
2445
2446                 if (s->s3->server_opaque_prf_input == NULL)
2447                         {
2448                         ret = SSL_TLSEXT_ERR_ALERT_FATAL;
2449                         al = SSL_AD_HANDSHAKE_FAILURE;
2450                         }
2451
2452                 /* Anytime the server *has* sent an opaque PRF input, we need to check
2453                  * that we have a client opaque PRF input of the same size. */
2454                 if (s->s3->client_opaque_prf_input == NULL ||
2455                     s->s3->client_opaque_prf_input_len != s->s3->server_opaque_prf_input_len)
2456                         {
2457                         ret = SSL_TLSEXT_ERR_ALERT_FATAL;
2458                         al = SSL_AD_ILLEGAL_PARAMETER;
2459                         }
2460                 }
2461 #endif
2462
2463         /* If we've requested certificate status and we wont get one
2464          * tell the callback
2465          */
2466         if ((s->tlsext_status_type != -1) && !(s->tlsext_status_expected)
2467                         && s->ctx && s->ctx->tlsext_status_cb)
2468                 {
2469                 int r;
2470                 /* Set resp to NULL, resplen to -1 so callback knows
2471                  * there is no response.
2472                  */
2473                 if (s->tlsext_ocsp_resp)
2474                         {
2475                         OPENSSL_free(s->tlsext_ocsp_resp);
2476                         s->tlsext_ocsp_resp = NULL;
2477                         }
2478                 s->tlsext_ocsp_resplen = -1;
2479                 r = s->ctx->tlsext_status_cb(s, s->ctx->tlsext_status_arg);
2480                 if (r == 0)
2481                         {
2482                         al = SSL_AD_BAD_CERTIFICATE_STATUS_RESPONSE;
2483                         ret = SSL_TLSEXT_ERR_ALERT_FATAL;
2484                         }
2485                 if (r < 0)
2486                         {
2487                         al = SSL_AD_INTERNAL_ERROR;
2488                         ret = SSL_TLSEXT_ERR_ALERT_FATAL;
2489                         }
2490                 }
2491
2492         switch (ret)
2493                 {
2494                 case SSL_TLSEXT_ERR_ALERT_FATAL:
2495                         ssl3_send_alert(s,SSL3_AL_FATAL,al);
2496                         return -1;
2497
2498                 case SSL_TLSEXT_ERR_ALERT_WARNING:
2499                         ssl3_send_alert(s,SSL3_AL_WARNING,al);
2500                         return 1;
2501
2502                 case SSL_TLSEXT_ERR_NOACK:
2503                         s->servername_done=0;
2504                         default:
2505                 return 1;
2506                 }
2507         }
2508
2509 int ssl_parse_serverhello_tlsext(SSL *s, unsigned char **p, unsigned char *d, int n)
2510         {
2511         int al = -1;
2512         if (s->version < SSL3_VERSION)
2513                 return 1;
2514         if (ssl_scan_serverhello_tlsext(s, p, d, n, &al) <= 0)
2515                 {
2516                 ssl3_send_alert(s,SSL3_AL_FATAL,al);
2517                 return 0;
2518                 }
2519
2520         if (ssl_check_serverhello_tlsext(s) <= 0)
2521                 {
2522                 SSLerr(SSL_F_SSL_PARSE_SERVERHELLO_TLSEXT,SSL_R_SERVERHELLO_TLSEXT);
2523                 return 0;
2524                 }
2525         return 1;
2526 }
2527
2528 /* Since the server cache lookup is done early on in the processing of the
2529  * ClientHello, and other operations depend on the result, we need to handle
2530  * any TLS session ticket extension at the same time.
2531  *
2532  *   session_id: points at the session ID in the ClientHello. This code will
2533  *       read past the end of this in order to parse out the session ticket
2534  *       extension, if any.
2535  *   len: the length of the session ID.
2536  *   limit: a pointer to the first byte after the ClientHello.
2537  *   ret: (output) on return, if a ticket was decrypted, then this is set to
2538  *       point to the resulting session.
2539  *
2540  * If s->tls_session_secret_cb is set then we are expecting a pre-shared key
2541  * ciphersuite, in which case we have no use for session tickets and one will
2542  * never be decrypted, nor will s->tlsext_ticket_expected be set to 1.
2543  *
2544  * Returns:
2545  *   -1: fatal error, either from parsing or decrypting the ticket.
2546  *    0: no ticket was found (or was ignored, based on settings).
2547  *    1: a zero length extension was found, indicating that the client supports
2548  *       session tickets but doesn't currently have one to offer.
2549  *    2: either s->tls_session_secret_cb was set, or a ticket was offered but
2550  *       couldn't be decrypted because of a non-fatal error.
2551  *    3: a ticket was successfully decrypted and *ret was set.
2552  *
2553  * Side effects:
2554  *   Sets s->tlsext_ticket_expected to 1 if the server will have to issue
2555  *   a new session ticket to the client because the client indicated support
2556  *   (and s->tls_session_secret_cb is NULL) but the client either doesn't have
2557  *   a session ticket or we couldn't use the one it gave us, or if
2558  *   s->ctx->tlsext_ticket_key_cb asked to renew the client's ticket.
2559  *   Otherwise, s->tlsext_ticket_expected is set to 0.
2560  */
2561 int tls1_process_ticket(SSL *s, unsigned char *session_id, int len,
2562                         const unsigned char *limit, SSL_SESSION **ret)
2563         {
2564         /* Point after session ID in client hello */
2565         const unsigned char *p = session_id + len;
2566         unsigned short i;
2567
2568         *ret = NULL;
2569         s->tlsext_ticket_expected = 0;
2570
2571         /* If tickets disabled behave as if no ticket present
2572          * to permit stateful resumption.
2573          */
2574         if (SSL_get_options(s) & SSL_OP_NO_TICKET)
2575                 return 0;
2576         if ((s->version <= SSL3_VERSION) || !limit)
2577                 return 0;
2578         if (p >= limit)
2579                 return -1;
2580         /* Skip past DTLS cookie */
2581         if (s->version == DTLS1_VERSION || s->version == DTLS1_BAD_VER)
2582                 {
2583                 i = *(p++);
2584                 p+= i;
2585                 if (p >= limit)
2586                         return -1;
2587                 }
2588         /* Skip past cipher list */
2589         n2s(p, i);
2590         p+= i;
2591         if (p >= limit)
2592                 return -1;
2593         /* Skip past compression algorithm list */
2594         i = *(p++);
2595         p += i;
2596         if (p > limit)
2597                 return -1;
2598         /* Now at start of extensions */
2599         if ((p + 2) >= limit)
2600                 return 0;
2601         n2s(p, i);
2602         while ((p + 4) <= limit)
2603                 {
2604                 unsigned short type, size;
2605                 n2s(p, type);
2606                 n2s(p, size);
2607                 if (p + size > limit)
2608                         return 0;
2609                 if (type == TLSEXT_TYPE_session_ticket)
2610                         {
2611                         int r;
2612                         if (size == 0)
2613                                 {
2614                                 /* The client will accept a ticket but doesn't
2615                                  * currently have one. */
2616                                 s->tlsext_ticket_expected = 1;
2617                                 return 1;
2618                                 }
2619                         if (s->tls_session_secret_cb)
2620                                 {
2621                                 /* Indicate that the ticket couldn't be
2622                                  * decrypted rather than generating the session
2623                                  * from ticket now, trigger abbreviated
2624                                  * handshake based on external mechanism to
2625                                  * calculate the master secret later. */
2626                                 return 2;
2627                                 }
2628                         r = tls_decrypt_ticket(s, p, size, session_id, len, ret);
2629                         switch (r)
2630                                 {
2631                                 case 2: /* ticket couldn't be decrypted */
2632                                         s->tlsext_ticket_expected = 1;
2633                                         return 2;
2634                                 case 3: /* ticket was decrypted */
2635                                         return r;
2636                                 case 4: /* ticket decrypted but need to renew */
2637                                         s->tlsext_ticket_expected = 1;
2638                                         return 3;
2639                                 default: /* fatal error */
2640                                         return -1;
2641                                 }
2642                         }
2643                 p += size;
2644                 }
2645         return 0;
2646         }
2647
2648 /* tls_decrypt_ticket attempts to decrypt a session ticket.
2649  *
2650  *   etick: points to the body of the session ticket extension.
2651  *   eticklen: the length of the session tickets extenion.
2652  *   sess_id: points at the session ID.
2653  *   sesslen: the length of the session ID.
2654  *   psess: (output) on return, if a ticket was decrypted, then this is set to
2655  *       point to the resulting session.
2656  *
2657  * Returns:
2658  *   -1: fatal error, either from parsing or decrypting the ticket.
2659  *    2: the ticket couldn't be decrypted.
2660  *    3: a ticket was successfully decrypted and *psess was set.
2661  *    4: same as 3, but the ticket needs to be renewed.
2662  */
2663 static int tls_decrypt_ticket(SSL *s, const unsigned char *etick, int eticklen,
2664                                 const unsigned char *sess_id, int sesslen,
2665                                 SSL_SESSION **psess)
2666         {
2667         SSL_SESSION *sess;
2668         unsigned char *sdec;
2669         const unsigned char *p;
2670         int slen, mlen, renew_ticket = 0;
2671         unsigned char tick_hmac[EVP_MAX_MD_SIZE];
2672         HMAC_CTX hctx;
2673         EVP_CIPHER_CTX ctx;
2674         SSL_CTX *tctx = s->initial_ctx;
2675         /* Need at least keyname + iv + some encrypted data */
2676         if (eticklen < 48)
2677                 return 2;
2678         /* Initialize session ticket encryption and HMAC contexts */
2679         HMAC_CTX_init(&hctx);
2680         EVP_CIPHER_CTX_init(&ctx);
2681         if (tctx->tlsext_ticket_key_cb)
2682                 {
2683                 unsigned char *nctick = (unsigned char *)etick;
2684                 int rv = tctx->tlsext_ticket_key_cb(s, nctick, nctick + 16,
2685                                                         &ctx, &hctx, 0);
2686                 if (rv < 0)
2687                         return -1;
2688                 if (rv == 0)
2689                         return 2;
2690                 if (rv == 2)
2691                         renew_ticket = 1;
2692                 }
2693         else
2694                 {
2695                 /* Check key name matches */
2696                 if (memcmp(etick, tctx->tlsext_tick_key_name, 16))
2697                         return 2;
2698                 HMAC_Init_ex(&hctx, tctx->tlsext_tick_hmac_key, 16,
2699                                         tlsext_tick_md(), NULL);
2700                 EVP_DecryptInit_ex(&ctx, EVP_aes_128_cbc(), NULL,
2701                                 tctx->tlsext_tick_aes_key, etick + 16);
2702                 }
2703         /* Attempt to process session ticket, first conduct sanity and
2704          * integrity checks on ticket.
2705          */
2706         mlen = HMAC_size(&hctx);
2707         if (mlen < 0)
2708                 {
2709                 EVP_CIPHER_CTX_cleanup(&ctx);
2710                 return -1;
2711                 }
2712         eticklen -= mlen;
2713         /* Check HMAC of encrypted ticket */
2714         HMAC_Update(&hctx, etick, eticklen);
2715         HMAC_Final(&hctx, tick_hmac, NULL);
2716         HMAC_CTX_cleanup(&hctx);
2717         if (memcmp(tick_hmac, etick + eticklen, mlen))
2718                 return 2;
2719         /* Attempt to decrypt session data */
2720         /* Move p after IV to start of encrypted ticket, update length */
2721         p = etick + 16 + EVP_CIPHER_CTX_iv_length(&ctx);
2722         eticklen -= 16 + EVP_CIPHER_CTX_iv_length(&ctx);
2723         sdec = OPENSSL_malloc(eticklen);
2724         if (!sdec)
2725                 {
2726                 EVP_CIPHER_CTX_cleanup(&ctx);
2727                 return -1;
2728                 }
2729         EVP_DecryptUpdate(&ctx, sdec, &slen, p, eticklen);
2730         if (EVP_DecryptFinal(&ctx, sdec + slen, &mlen) <= 0)
2731                 return 2;
2732         slen += mlen;
2733         EVP_CIPHER_CTX_cleanup(&ctx);
2734         p = sdec;
2735
2736         sess = d2i_SSL_SESSION(NULL, &p, slen);
2737         OPENSSL_free(sdec);
2738         if (sess)
2739                 {
2740                 /* The session ID, if non-empty, is used by some clients to
2741                  * detect that the ticket has been accepted. So we copy it to
2742                  * the session structure. If it is empty set length to zero
2743                  * as required by standard.
2744                  */
2745                 if (sesslen)
2746                         memcpy(sess->session_id, sess_id, sesslen);
2747                 sess->session_id_length = sesslen;
2748                 *psess = sess;
2749                 if (renew_ticket)
2750                         return 4;
2751                 else
2752                         return 3;
2753                 }
2754         ERR_clear_error();
2755         /* For session parse failure, indicate that we need to send a new
2756          * ticket. */
2757         return 2;
2758         }
2759
2760 /* Tables to translate from NIDs to TLS v1.2 ids */
2761
2762 typedef struct
2763         {
2764         int nid;
2765         int id;
2766         } tls12_lookup;
2767
2768 static tls12_lookup tls12_md[] = {
2769         {NID_md5, TLSEXT_hash_md5},
2770         {NID_sha1, TLSEXT_hash_sha1},
2771         {NID_sha224, TLSEXT_hash_sha224},
2772         {NID_sha256, TLSEXT_hash_sha256},
2773         {NID_sha384, TLSEXT_hash_sha384},
2774         {NID_sha512, TLSEXT_hash_sha512}
2775 };
2776
2777 static tls12_lookup tls12_sig[] = {
2778         {EVP_PKEY_RSA, TLSEXT_signature_rsa},
2779         {EVP_PKEY_DSA, TLSEXT_signature_dsa},
2780         {EVP_PKEY_EC, TLSEXT_signature_ecdsa}
2781 };
2782
2783 static int tls12_find_id(int nid, tls12_lookup *table, size_t tlen)
2784         {
2785         size_t i;
2786         for (i = 0; i < tlen; i++)
2787                 {
2788                 if (table[i].nid == nid)
2789                         return table[i].id;
2790                 }
2791         return -1;
2792         }
2793
2794 static int tls12_find_nid(int id, tls12_lookup *table, size_t tlen)
2795         {
2796         size_t i;
2797         for (i = 0; i < tlen; i++)
2798                 {
2799                 if ((table[i].id) == id)
2800                         return table[i].nid;
2801                 }
2802         return NID_undef;
2803         }
2804
2805 int tls12_get_sigandhash(unsigned char *p, const EVP_PKEY *pk, const EVP_MD *md)
2806         {
2807         int sig_id, md_id;
2808         if (!md)
2809                 return 0;
2810         md_id = tls12_find_id(EVP_MD_type(md), tls12_md,
2811                                 sizeof(tls12_md)/sizeof(tls12_lookup));
2812         if (md_id == -1)
2813                 return 0;
2814         sig_id = tls12_get_sigid(pk);
2815         if (sig_id == -1)
2816                 return 0;
2817         p[0] = (unsigned char)md_id;
2818         p[1] = (unsigned char)sig_id;
2819         return 1;
2820         }
2821
2822 int tls12_get_sigid(const EVP_PKEY *pk)
2823         {
2824         return tls12_find_id(pk->type, tls12_sig,
2825                                 sizeof(tls12_sig)/sizeof(tls12_lookup));
2826         }
2827
2828 const EVP_MD *tls12_get_hash(unsigned char hash_alg)
2829         {
2830         switch(hash_alg)
2831                 {
2832 #ifndef OPENSSL_NO_MD5
2833                 case TLSEXT_hash_md5:
2834 #ifdef OPENSSL_FIPS
2835                 if (FIPS_mode())
2836                         return NULL;
2837 #endif
2838                 return EVP_md5();
2839 #endif
2840 #ifndef OPENSSL_NO_SHA
2841                 case TLSEXT_hash_sha1:
2842                 return EVP_sha1();
2843 #endif
2844 #ifndef OPENSSL_NO_SHA256
2845                 case TLSEXT_hash_sha224:
2846                 return EVP_sha224();
2847
2848                 case TLSEXT_hash_sha256:
2849                 return EVP_sha256();
2850 #endif
2851 #ifndef OPENSSL_NO_SHA512
2852                 case TLSEXT_hash_sha384:
2853                 return EVP_sha384();
2854
2855                 case TLSEXT_hash_sha512:
2856                 return EVP_sha512();
2857 #endif
2858                 default:
2859                 return NULL;
2860
2861                 }
2862         }
2863
2864 /* Set preferred digest for each key type */
2865
2866 int tls1_process_sigalgs(SSL *s, const unsigned char *data, int dsize)
2867         {
2868         int i, idx;
2869         const EVP_MD *md;
2870         CERT *c = s->cert;
2871         TLS_SIGALGS *sigptr;
2872         /* Extension ignored for TLS versions below 1.2 */
2873         if (TLS1_get_version(s) < TLS1_2_VERSION)
2874                 return 1;
2875         /* Should never happen */
2876         if (!c)
2877                 return 0;
2878
2879         c->pkeys[SSL_PKEY_DSA_SIGN].digest = NULL;
2880         c->pkeys[SSL_PKEY_RSA_SIGN].digest = NULL;
2881         c->pkeys[SSL_PKEY_RSA_ENC].digest = NULL;
2882         c->pkeys[SSL_PKEY_ECC].digest = NULL;
2883
2884         if (c->peer_sigalgs)
2885                 OPENSSL_free(c->peer_sigalgs);
2886         c->peer_sigalgs = OPENSSL_malloc((dsize/2) * sizeof(TLS_SIGALGS));
2887         if (!c->peer_sigalgs)
2888                 return 0;
2889         c->peer_sigalgslen = dsize/2;
2890
2891         for (i = 0, sigptr = c->peer_sigalgs; i < dsize; i += 2, sigptr++)
2892                 {
2893                 sigptr->rhash = data[i];
2894                 sigptr->rsign = data[i + 1];
2895                 sigptr->hash_nid = tls12_find_nid(sigptr->rhash, tls12_md,
2896                                         sizeof(tls12_md)/sizeof(tls12_lookup));
2897                 sigptr->sign_nid = tls12_find_nid(sigptr->rsign, tls12_sig,
2898                                         sizeof(tls12_sig)/sizeof(tls12_lookup));
2899                 if (!OBJ_find_sigid_by_algs(&sigptr->signandhash_nid,
2900                                                 sigptr->hash_nid,
2901                                                 sigptr->sign_nid))
2902                         sigptr->signandhash_nid = NID_undef;
2903                 switch(sigptr->rsign)
2904                         {
2905 #ifndef OPENSSL_NO_RSA
2906                         case TLSEXT_signature_rsa:
2907                         idx = SSL_PKEY_RSA_SIGN;
2908                         break;
2909 #endif
2910 #ifndef OPENSSL_NO_DSA
2911                         case TLSEXT_signature_dsa:
2912                         idx = SSL_PKEY_DSA_SIGN;
2913                         break;
2914 #endif
2915 #ifndef OPENSSL_NO_ECDSA
2916                         case TLSEXT_signature_ecdsa:
2917                         idx = SSL_PKEY_ECC;
2918                         break;
2919 #endif
2920                         default:
2921                         continue;
2922                         }
2923
2924                 if (c->pkeys[idx].digest == NULL)
2925                         {
2926                         md = tls12_get_hash(sigptr->rhash);
2927                         if (md)
2928                                 {
2929                                 c->pkeys[idx].digest = md;
2930                                 if (idx == SSL_PKEY_RSA_SIGN)
2931                                         c->pkeys[SSL_PKEY_RSA_ENC].digest = md;
2932                                 }
2933                         }
2934
2935                 }
2936
2937
2938         /* Set any remaining keys to default values. NOTE: if alg is not
2939          * supported it stays as NULL.
2940          */
2941 #ifndef OPENSSL_NO_DSA
2942         if (!c->pkeys[SSL_PKEY_DSA_SIGN].digest)
2943                 c->pkeys[SSL_PKEY_DSA_SIGN].digest = EVP_dss1();
2944 #endif
2945 #ifndef OPENSSL_NO_RSA
2946         if (!c->pkeys[SSL_PKEY_RSA_SIGN].digest)
2947                 {
2948                 c->pkeys[SSL_PKEY_RSA_SIGN].digest = EVP_sha1();
2949                 c->pkeys[SSL_PKEY_RSA_ENC].digest = EVP_sha1();
2950                 }
2951 #endif
2952 #ifndef OPENSSL_NO_ECDSA
2953         if (!c->pkeys[SSL_PKEY_ECC].digest)
2954                 c->pkeys[SSL_PKEY_ECC].digest = EVP_ecdsa();
2955 #endif
2956         return 1;
2957         }
2958
2959 #endif
2960
2961 int SSL_get_sigalgs(SSL *s, int idx,
2962                         int *psign, int *phash, int *psignandhash,
2963                         unsigned char *rsig, unsigned char *rhash)
2964         {
2965         if (s->cert->peer_sigalgs == NULL)
2966                 return 0;
2967         if (idx >= 0)
2968                 {
2969                 TLS_SIGALGS *psig;
2970                 if (idx >= (int)s->cert->peer_sigalgslen)
2971                         return 0;
2972                 psig = s->cert->peer_sigalgs + idx;
2973                 if (psign)
2974                         *psign = psig->sign_nid;
2975                 if (phash)
2976                         *phash = psig->hash_nid;
2977                 if (psignandhash)
2978                         *psignandhash = psig->signandhash_nid;
2979                 if (rsig)
2980                         *rsig = psig->rsign;
2981                 if (rhash)
2982                         *rhash = psig->rhash;
2983                 }
2984         return s->cert->peer_sigalgslen;
2985         }
2986
2987
2988 #ifndef OPENSSL_NO_HEARTBEATS
2989 int
2990 tls1_process_heartbeat(SSL *s)
2991         {
2992         unsigned char *p = &s->s3->rrec.data[0], *pl;
2993         unsigned short hbtype;
2994         unsigned int payload;
2995         unsigned int padding = 16; /* Use minimum padding */
2996
2997         /* Read type and payload length first */
2998         hbtype = *p++;
2999         n2s(p, payload);
3000         pl = p;
3001
3002         if (s->msg_callback)
3003                 s->msg_callback(0, s->version, TLS1_RT_HEARTBEAT,
3004                         &s->s3->rrec.data[0], s->s3->rrec.length,
3005                         s, s->msg_callback_arg);
3006
3007         if (hbtype == TLS1_HB_REQUEST)
3008                 {
3009                 unsigned char *buffer, *bp;
3010                 int r;
3011
3012                 /* Allocate memory for the response, size is 1 bytes
3013                  * message type, plus 2 bytes payload length, plus
3014                  * payload, plus padding
3015                  */
3016                 buffer = OPENSSL_malloc(1 + 2 + payload + padding);
3017                 bp = buffer;
3018
3019                 /* Enter response type, length and copy payload */
3020                 *bp++ = TLS1_HB_RESPONSE;
3021                 s2n(payload, bp);
3022                 memcpy(bp, pl, payload);
3023                 bp += payload;
3024                 /* Random padding */
3025                 RAND_pseudo_bytes(bp, padding);
3026
3027                 r = ssl3_write_bytes(s, TLS1_RT_HEARTBEAT, buffer, 3 + payload + padding);
3028
3029                 if (r >= 0 && s->msg_callback)
3030                         s->msg_callback(1, s->version, TLS1_RT_HEARTBEAT,
3031                                 buffer, 3 + payload + padding,
3032                                 s, s->msg_callback_arg);
3033
3034                 OPENSSL_free(buffer);
3035
3036                 if (r < 0)
3037                         return r;
3038                 }
3039         else if (hbtype == TLS1_HB_RESPONSE)
3040                 {
3041                 unsigned int seq;
3042
3043                 /* We only send sequence numbers (2 bytes unsigned int),
3044                  * and 16 random bytes, so we just try to read the
3045                  * sequence number */
3046                 n2s(pl, seq);
3047
3048                 if (payload == 18 && seq == s->tlsext_hb_seq)
3049                         {
3050                         s->tlsext_hb_seq++;
3051                         s->tlsext_hb_pending = 0;
3052                         }
3053                 }
3054
3055         return 0;
3056         }
3057
3058 int
3059 tls1_heartbeat(SSL *s)
3060         {
3061         unsigned char *buf, *p;
3062         int ret;
3063         unsigned int payload = 18; /* Sequence number + random bytes */
3064         unsigned int padding = 16; /* Use minimum padding */
3065
3066         /* Only send if peer supports and accepts HB requests... */
3067         if (!(s->tlsext_heartbeat & SSL_TLSEXT_HB_ENABLED) ||
3068             s->tlsext_heartbeat & SSL_TLSEXT_HB_DONT_SEND_REQUESTS)
3069                 {
3070                 SSLerr(SSL_F_TLS1_HEARTBEAT,SSL_R_TLS_HEARTBEAT_PEER_DOESNT_ACCEPT);
3071                 return -1;
3072                 }
3073
3074         /* ...and there is none in flight yet... */
3075         if (s->tlsext_hb_pending)
3076                 {
3077                 SSLerr(SSL_F_TLS1_HEARTBEAT,SSL_R_TLS_HEARTBEAT_PENDING);
3078                 return -1;
3079                 }
3080
3081         /* ...and no handshake in progress. */
3082         if (SSL_in_init(s) || s->in_handshake)
3083                 {
3084                 SSLerr(SSL_F_TLS1_HEARTBEAT,SSL_R_UNEXPECTED_MESSAGE);
3085                 return -1;
3086                 }
3087
3088         /* Check if padding is too long, payload and padding
3089          * must not exceed 2^14 - 3 = 16381 bytes in total.
3090          */
3091         OPENSSL_assert(payload + padding <= 16381);
3092
3093         /* Create HeartBeat message, we just use a sequence number
3094          * as payload to distuingish different messages and add
3095          * some random stuff.
3096          *  - Message Type, 1 byte
3097          *  - Payload Length, 2 bytes (unsigned int)
3098          *  - Payload, the sequence number (2 bytes uint)
3099          *  - Payload, random bytes (16 bytes uint)
3100          *  - Padding
3101          */
3102         buf = OPENSSL_malloc(1 + 2 + payload + padding);
3103         p = buf;
3104         /* Message Type */
3105         *p++ = TLS1_HB_REQUEST;
3106         /* Payload length (18 bytes here) */
3107         s2n(payload, p);
3108         /* Sequence number */
3109         s2n(s->tlsext_hb_seq, p);
3110         /* 16 random bytes */
3111         RAND_pseudo_bytes(p, 16);
3112         p += 16;
3113         /* Random padding */
3114         RAND_pseudo_bytes(p, padding);
3115
3116         ret = ssl3_write_bytes(s, TLS1_RT_HEARTBEAT, buf, 3 + payload + padding);
3117         if (ret >= 0)
3118                 {
3119                 if (s->msg_callback)
3120                         s->msg_callback(1, s->version, TLS1_RT_HEARTBEAT,
3121                                 buf, 3 + payload + padding,
3122                                 s, s->msg_callback_arg);
3123
3124                 s->tlsext_hb_pending = 1;
3125                 }
3126
3127         OPENSSL_free(buf);
3128
3129         return ret;
3130         }
3131 #endif
3132
3133 #define MAX_SIGALGLEN   (TLSEXT_hash_num * TLSEXT_signature_num *2)
3134
3135 typedef struct
3136         {
3137         size_t sigalgcnt;
3138         int sigalgs[MAX_SIGALGLEN];
3139         } sig_cb_st;
3140
3141 static int sig_cb(const char *elem, int len, void *arg)
3142         {
3143         sig_cb_st *sarg = arg;
3144         size_t i;
3145         char etmp[20], *p;
3146         int sig_alg, hash_alg;
3147         if (sarg->sigalgcnt == MAX_SIGALGLEN)
3148                 return 0;
3149         if (len > (int)(sizeof(etmp) - 1))
3150                 return 0;
3151         memcpy(etmp, elem, len);
3152         etmp[len] = 0;
3153         p = strchr(etmp, '+');
3154         if (!p)
3155                 return 0;
3156         *p = 0;
3157         p++;
3158         if (!*p)
3159                 return 0;
3160
3161         if (!strcmp(etmp, "RSA"))
3162                 sig_alg = EVP_PKEY_RSA;
3163         else if (!strcmp(etmp, "DSA"))
3164                 sig_alg = EVP_PKEY_DSA;
3165         else if (!strcmp(etmp, "ECDSA"))
3166                 sig_alg = EVP_PKEY_EC;
3167         else return 0;
3168
3169         hash_alg = OBJ_sn2nid(p);
3170         if (hash_alg == NID_undef)
3171                 hash_alg = OBJ_ln2nid(p);
3172         if (hash_alg == NID_undef)
3173                 return 0;
3174
3175         for (i = 0; i < sarg->sigalgcnt; i+=2)
3176                 {
3177                 if (sarg->sigalgs[i] == sig_alg
3178                         && sarg->sigalgs[i + 1] == hash_alg)
3179                         return 0;
3180                 }
3181         sarg->sigalgs[sarg->sigalgcnt++] = hash_alg;
3182         sarg->sigalgs[sarg->sigalgcnt++] = sig_alg;
3183         return 1;
3184         }
3185
3186 /* Set suppored signature algorithms based on a colon separated list
3187  * of the form sig+hash e.g. RSA+SHA512:DSA+SHA512 */
3188 int tls1_set_sigalgs_list(CERT *c, const char *str)
3189         {
3190         sig_cb_st sig;
3191         sig.sigalgcnt = 0;
3192         if (!CONF_parse_list(str, ':', 1, sig_cb, &sig))
3193                 return 0;
3194         return tls1_set_sigalgs(c, sig.sigalgs, sig.sigalgcnt);
3195         }
3196
3197 int tls1_set_sigalgs(CERT *c, const int *salg, size_t salglen)
3198         {
3199         TLS_SIGALGS *sigalgs, *sptr;
3200         int rhash, rsign;
3201         size_t i;
3202         if (salglen & 1)
3203                 return 0;
3204         salglen /= 2;
3205         sigalgs = OPENSSL_malloc(sizeof(TLS_SIGALGS) * salglen);
3206         if (sigalgs == NULL)
3207                 return 0;
3208         for (i = 0, sptr = sigalgs; i < salglen; i++, sptr++)
3209                 {
3210                 sptr->hash_nid = *salg++;
3211                 sptr->sign_nid = *salg++;
3212                 rhash = tls12_find_id(sptr->hash_nid, tls12_md,
3213                                         sizeof(tls12_md)/sizeof(tls12_lookup));
3214                 rsign = tls12_find_id(sptr->sign_nid, tls12_sig,
3215                                 sizeof(tls12_sig)/sizeof(tls12_lookup));
3216
3217                 if (rhash == -1 || rsign == -1)
3218                         goto err;
3219
3220                 if (!OBJ_find_sigid_by_algs(&sptr->signandhash_nid,
3221                                                 sptr->hash_nid,
3222                                                 sptr->sign_nid))
3223                         sptr->signandhash_nid = NID_undef;
3224                 sptr->rhash = rhash;
3225                 sptr->rsign = rsign;
3226                 }
3227
3228         if (c->conf_sigalgs)
3229                 OPENSSL_free(c->conf_sigalgs);
3230
3231         c->conf_sigalgs = sigalgs;
3232         c->conf_sigalgslen = salglen;
3233         return 1;
3234
3235         err:
3236         OPENSSL_free(sigalgs);
3237         return 0;
3238         }