ssl/t1_lib.c

   1 /* ssl/t1_lib.c */
   2 /* Copyright (C) 1995-1998 Eric Young (eay@cryptsoft.com)
   3  * All rights reserved.
   4  *
   5  * This package is an SSL implementation written
   6  * by Eric Young (eay@cryptsoft.com).
   7  * The implementation was written so as to conform with Netscapes SSL.
   8  *
   9  * This library is free for commercial and non-commercial use as long as
  10  * the following conditions are aheared to.  The following conditions
  11  * apply to all code found in this distribution, be it the RC4, RSA,
  12  * lhash, DES, etc., code; not just the SSL code.  The SSL documentation
  13  * included with this distribution is covered by the same copyright terms
  14  * except that the holder is Tim Hudson (tjh@cryptsoft.com).
  15  *
  16  * Copyright remains Eric Young's, and as such any Copyright notices in
  17  * the code are not to be removed.
  18  * If this package is used in a product, Eric Young should be given attribution
  19  * as the author of the parts of the library used.
  20  * This can be in the form of a textual message at program startup or
  21  * in documentation (online or textual) provided with the package.
  22  *
  23  * Redistribution and use in source and binary forms, with or without
  24  * modification, are permitted provided that the following conditions
  25  * are met:
  26  * 1. Redistributions of source code must retain the copyright
  27  *    notice, this list of conditions and the following disclaimer.
  28  * 2. Redistributions in binary form must reproduce the above copyright
  29  *    notice, this list of conditions and the following disclaimer in the
  30  *    documentation and/or other materials provided with the distribution.
  31  * 3. All advertising materials mentioning features or use of this software
  32  *    must display the following acknowledgement:
  33  *    "This product includes cryptographic software written by
  34  *     Eric Young (eay@cryptsoft.com)"
  35  *    The word 'cryptographic' can be left out if the rouines from the library
  36  *    being used are not cryptographic related :-).
  37  * 4. If you include any Windows specific code (or a derivative thereof) from
  38  *    the apps directory (application code) you must include an acknowledgement:
  39  *    "This product includes software written by Tim Hudson (tjh@cryptsoft.com)"
  40  *
  41  * THIS SOFTWARE IS PROVIDED BY ERIC YOUNG ``AS IS'' AND
  42  * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
  43  * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
  44  * ARE DISCLAIMED.  IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE
  45  * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
  46  * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
  47  * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
  48  * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
  49  * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
  50  * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
  51  * SUCH DAMAGE.
  52  *
  53  * The licence and distribution terms for any publically available version or
  54  * derivative of this code cannot be changed.  i.e. this code cannot simply be
  55  * copied and put under another distribution licence
  56  * [including the GNU Public Licence.]
  57  */
  58 /* ====================================================================
  59  * Copyright (c) 1998-2007 The OpenSSL Project.  All rights reserved.
  60  *
  61  * Redistribution and use in source and binary forms, with or without
  62  * modification, are permitted provided that the following conditions
  63  * are met:
  64  *
  65  * 1. Redistributions of source code must retain the above copyright
  66  *    notice, this list of conditions and the following disclaimer.
  67  *
  68  * 2. Redistributions in binary form must reproduce the above copyright
  69  *    notice, this list of conditions and the following disclaimer in
  70  *    the documentation and/or other materials provided with the
  71  *    distribution.
  72  *
  73  * 3. All advertising materials mentioning features or use of this
  74  *    software must display the following acknowledgment:
  75  *    "This product includes software developed by the OpenSSL Project
  76  *    for use in the OpenSSL Toolkit. (http://www.openssl.org/)"
  77  *
  78  * 4. The names "OpenSSL Toolkit" and "OpenSSL Project" must not be used to
  79  *    endorse or promote products derived from this software without
  80  *    prior written permission. For written permission, please contact
  81  *    openssl-core@openssl.org.
  82  *
  83  * 5. Products derived from this software may not be called "OpenSSL"
  84  *    nor may "OpenSSL" appear in their names without prior written
  85  *    permission of the OpenSSL Project.
  86  *
  87  * 6. Redistributions of any form whatsoever must retain the following
  88  *    acknowledgment:
  89  *    "This product includes software developed by the OpenSSL Project
  90  *    for use in the OpenSSL Toolkit (http://www.openssl.org/)"
  91  *
  92  * THIS SOFTWARE IS PROVIDED BY THE OpenSSL PROJECT ``AS IS'' AND ANY
  93  * EXPRESSED OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
  94  * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
  95  * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL THE OpenSSL PROJECT OR
  96  * ITS CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
  97  * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
  98  * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
  99  * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
 100  * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT,
 101  * STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
 102  * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED
 103  * OF THE POSSIBILITY OF SUCH DAMAGE.
 104  * ====================================================================
 105  *
 106  * This product includes cryptographic software written by Eric Young
 107  * (eay@cryptsoft.com).  This product includes software written by Tim
 108  * Hudson (tjh@cryptsoft.com).
 109  *
 110  */
 111
 112 #include <stdio.h>
 113 #include <openssl/objects.h>
 114 #include <openssl/evp.h>
 115 #include <openssl/hmac.h>
 116 #include <openssl/ocsp.h>
 117 #include "ssl_locl.h"
 118
 119 const char tls1_version_str[]="TLSv1" OPENSSL_VERSION_PTEXT;
 120
 121 #ifndef OPENSSL_NO_TLSEXT
 122 static int tls_decrypt_ticket(SSL *s, const unsigned char *tick, int ticklen,
 123                                 const unsigned char *sess_id, int sesslen,
 124                                 SSL_SESSION **psess);
 125 #endif
 126
 127 SSL3_ENC_METHOD TLSv1_enc_data={
 128         tls1_enc,
 129         tls1_mac,
 130         tls1_setup_key_block,
 131         tls1_generate_master_secret,
 132         tls1_change_cipher_state,
 133         tls1_final_finish_mac,
 134         TLS1_FINISH_MAC_LENGTH,
 135         tls1_cert_verify_mac,
 136         TLS_MD_CLIENT_FINISH_CONST,TLS_MD_CLIENT_FINISH_CONST_SIZE,
 137         TLS_MD_SERVER_FINISH_CONST,TLS_MD_SERVER_FINISH_CONST_SIZE,
 138         tls1_alert_code,
 139         };
 140
 141 long tls1_default_timeout(void)
 142         {
 143         /* 2 hours, the 24 hours mentioned in the TLSv1 spec
 144          * is way too long for http, the cache would over fill */
 145         return(60*60*2);
 146         }
 147
 148 int tls1_new(SSL *s)
 149         {
 150         if (!ssl3_new(s)) return(0);
 151         s->method->ssl_clear(s);
 152         return(1);
 153         }
 154
 155 void tls1_free(SSL *s)
 156         {
 157 #ifndef OPENSSL_NO_TLSEXT
 158         if (s->tlsext_session_ticket)
 159                 {
 160                 OPENSSL_free(s->tlsext_session_ticket);
 161                 }
 162 #endif /* OPENSSL_NO_TLSEXT */
 163         ssl3_free(s);
 164         }
 165
 166 void tls1_clear(SSL *s)
 167         {
 168         ssl3_clear(s);
 169         s->version = s->method->version;
 170         }
 171
 172 #ifndef OPENSSL_NO_EC
 173 static int nid_list[] =
 174         {
 175                 NID_sect163k1, /* sect163k1 (1) */
 176                 NID_sect163r1, /* sect163r1 (2) */
 177                 NID_sect163r2, /* sect163r2 (3) */
 178                 NID_sect193r1, /* sect193r1 (4) */
 179                 NID_sect193r2, /* sect193r2 (5) */
 180                 NID_sect233k1, /* sect233k1 (6) */
 181                 NID_sect233r1, /* sect233r1 (7) */
 182                 NID_sect239k1, /* sect239k1 (8) */
 183                 NID_sect283k1, /* sect283k1 (9) */
 184                 NID_sect283r1, /* sect283r1 (10) */
 185                 NID_sect409k1, /* sect409k1 (11) */
 186                 NID_sect409r1, /* sect409r1 (12) */
 187                 NID_sect571k1, /* sect571k1 (13) */
 188                 NID_sect571r1, /* sect571r1 (14) */
 189                 NID_secp160k1, /* secp160k1 (15) */
 190                 NID_secp160r1, /* secp160r1 (16) */
 191                 NID_secp160r2, /* secp160r2 (17) */
 192                 NID_secp192k1, /* secp192k1 (18) */
 193                 NID_X9_62_prime192v1, /* secp192r1 (19) */
 194                 NID_secp224k1, /* secp224k1 (20) */
 195                 NID_secp224r1, /* secp224r1 (21) */
 196                 NID_secp256k1, /* secp256k1 (22) */
 197                 NID_X9_62_prime256v1, /* secp256r1 (23) */
 198                 NID_secp384r1, /* secp384r1 (24) */
 199                 NID_secp521r1  /* secp521r1 (25) */
 200         };
 201
 202 int tls1_ec_curve_id2nid(int curve_id)
 203         {
 204         /* ECC curves from draft-ietf-tls-ecc-12.txt (Oct. 17, 2005) */
 205         if ((curve_id < 1) || ((unsigned int)curve_id >
 206                                 sizeof(nid_list)/sizeof(nid_list[0])))
 207                 return 0;
 208         return nid_list[curve_id-1];
 209         }
 210
 211 int tls1_ec_nid2curve_id(int nid)
 212         {
 213         /* ECC curves from draft-ietf-tls-ecc-12.txt (Oct. 17, 2005) */
 214         switch (nid)
 215                 {
 216         case NID_sect163k1: /* sect163k1 (1) */
 217                 return 1;
 218         case NID_sect163r1: /* sect163r1 (2) */
 219                 return 2;
 220         case NID_sect163r2: /* sect163r2 (3) */
 221                 return 3;
 222         case NID_sect193r1: /* sect193r1 (4) */
 223                 return 4;
 224         case NID_sect193r2: /* sect193r2 (5) */
 225                 return 5;
 226         case NID_sect233k1: /* sect233k1 (6) */
 227                 return 6;
 228         case NID_sect233r1: /* sect233r1 (7) */
 229                 return 7;
 230         case NID_sect239k1: /* sect239k1 (8) */
 231                 return 8;
 232         case NID_sect283k1: /* sect283k1 (9) */
 233                 return 9;
 234         case NID_sect283r1: /* sect283r1 (10) */
 235                 return 10;
 236         case NID_sect409k1: /* sect409k1 (11) */
 237                 return 11;
 238         case NID_sect409r1: /* sect409r1 (12) */
 239                 return 12;
 240         case NID_sect571k1: /* sect571k1 (13) */
 241                 return 13;
 242         case NID_sect571r1: /* sect571r1 (14) */
 243                 return 14;
 244         case NID_secp160k1: /* secp160k1 (15) */
 245                 return 15;
 246         case NID_secp160r1: /* secp160r1 (16) */
 247                 return 16;
 248         case NID_secp160r2: /* secp160r2 (17) */
 249                 return 17;
 250         case NID_secp192k1: /* secp192k1 (18) */
 251                 return 18;
 252         case NID_X9_62_prime192v1: /* secp192r1 (19) */
 253                 return 19;
 254         case NID_secp224k1: /* secp224k1 (20) */
 255                 return 20;
 256         case NID_secp224r1: /* secp224r1 (21) */
 257                 return 21;
 258         case NID_secp256k1: /* secp256k1 (22) */
 259                 return 22;
 260         case NID_X9_62_prime256v1: /* secp256r1 (23) */
 261                 return 23;
 262         case NID_secp384r1: /* secp384r1 (24) */
 263                 return 24;
 264         case NID_secp521r1:  /* secp521r1 (25) */
 265                 return 25;
 266         default:
 267                 return 0;
 268                 }
 269         }
 270 #endif /* OPENSSL_NO_EC */
 271
 272 #ifndef OPENSSL_NO_TLSEXT
 273 unsigned char *ssl_add_clienthello_tlsext(SSL *s, unsigned char *p, unsigned char *limit)
 274         {
 275         int extdatalen=0;
 276         unsigned char *ret = p;
 277
 278         /* don't add extensions for SSLv3 unless doing secure renegotiation */
 279         if (s->client_version == SSL3_VERSION
 280                                         && !s->s3->send_connection_binding)
 281                 return p;
 282
 283         ret+=2;
 284
 285         if (ret>=limit) return NULL; /* this really never occurs, but ... */
 286
 287         if (s->tlsext_hostname != NULL)
 288                 {
 289                 /* Add TLS extension servername to the Client Hello message */
 290                 unsigned long size_str;
 291                 long lenmax;
 292
 293                 /* check for enough space.
 294                    4 for the servername type and entension length
 295                    2 for servernamelist length
 296                    1 for the hostname type
 297                    2 for hostname length
 298                    + hostname length
 299                 */
 300
 301                 if ((lenmax = limit - ret - 9) < 0
 302                     || (size_str = strlen(s->tlsext_hostname)) > (unsigned long)lenmax)
 303                         return NULL;
 304
 305                 /* extension type and length */
 306                 s2n(TLSEXT_TYPE_server_name,ret);
 307                 s2n(size_str+5,ret);
 308
 309                 /* length of servername list */
 310                 s2n(size_str+3,ret);
 311
 312                 /* hostname type, length and hostname */
 313                 *(ret++) = (unsigned char) TLSEXT_NAMETYPE_host_name;
 314                 s2n(size_str,ret);
 315                 memcpy(ret, s->tlsext_hostname, size_str);
 316                 ret+=size_str;
 317                 }
 318
 319         /* Add RI if renegotiating */
 320         if (s->renegotiate)
 321           {
 322           int el;
 323
 324           if(!ssl_add_clienthello_renegotiate_ext(s, 0, &el, 0))
 325               {
 326               SSLerr(SSL_F_SSL_ADD_CLIENTHELLO_TLSEXT, ERR_R_INTERNAL_ERROR);
 327               return NULL;
 328               }
 329
 330           if((limit - p - 4 - el) < 0) return NULL;
 331
 332           s2n(TLSEXT_TYPE_renegotiate,ret);
 333           s2n(el,ret);
 334
 335           if(!ssl_add_clienthello_renegotiate_ext(s, ret, &el, el))
 336               {
 337               SSLerr(SSL_F_SSL_ADD_CLIENTHELLO_TLSEXT, ERR_R_INTERNAL_ERROR);
 338               return NULL;
 339               }
 340
 341           ret += el;
 342         }
 343
 344 #ifndef OPENSSL_NO_SRP
 345 #define MIN(x,y) (((x)<(y))?(x):(y))
 346         /* we add SRP username the first time only if we have one! */
 347         if (s->srp_ctx.login != NULL)
 348                 {/* Add TLS extension SRP username to the Client Hello message */
 349                 int login_len = MIN(strlen(s->srp_ctx.login) + 1, 255);
 350                 long lenmax;
 351
 352                 if ((lenmax = limit - ret - 5) < 0) return NULL;
 353                 if (login_len > lenmax) return NULL;
 354                 if (login_len > 255)
 355                         {
 356                         SSLerr(SSL_F_SSL_ADD_CLIENTHELLO_TLSEXT, ERR_R_INTERNAL_ERROR);
 357                         return NULL;
 358                         }
 359                 s2n(TLSEXT_TYPE_srp,ret);
 360                 s2n(login_len+1,ret);
 361
 362                 (*ret++) = (unsigned char) MIN(strlen(s->srp_ctx.login), 254);
 363                 memcpy(ret, s->srp_ctx.login, MIN(strlen(s->srp_ctx.login), 254));
 364                 ret+=login_len;
 365                 }
 366 #endif
 367
 368 #ifndef OPENSSL_NO_EC
 369         if (s->tlsext_ecpointformatlist != NULL &&
 370             s->version != DTLS1_VERSION)
 371                 {
 372                 /* Add TLS extension ECPointFormats to the ClientHello message */
 373                 long lenmax;
 374
 375                 if ((lenmax = limit - ret - 5) < 0) return NULL;
 376                 if (s->tlsext_ecpointformatlist_length > (unsigned long)lenmax) return NULL;
 377                 if (s->tlsext_ecpointformatlist_length > 255)
 378                         {
 379                         SSLerr(SSL_F_SSL_ADD_CLIENTHELLO_TLSEXT, ERR_R_INTERNAL_ERROR);
 380                         return NULL;
 381                         }
 382
 383                 s2n(TLSEXT_TYPE_ec_point_formats,ret);
 384                 s2n(s->tlsext_ecpointformatlist_length + 1,ret);
 385                 *(ret++) = (unsigned char) s->tlsext_ecpointformatlist_length;
 386                 memcpy(ret, s->tlsext_ecpointformatlist, s->tlsext_ecpointformatlist_length);
 387                 ret+=s->tlsext_ecpointformatlist_length;
 388                 }
 389         if (s->tlsext_ellipticcurvelist != NULL &&
 390             s->version != DTLS1_VERSION)
 391                 {
 392                 /* Add TLS extension EllipticCurves to the ClientHello message */
 393                 long lenmax;
 394
 395                 if ((lenmax = limit - ret - 6) < 0) return NULL;
 396                 if (s->tlsext_ellipticcurvelist_length > (unsigned long)lenmax) return NULL;
 397                 if (s->tlsext_ellipticcurvelist_length > 65532)
 398                         {
 399                         SSLerr(SSL_F_SSL_ADD_CLIENTHELLO_TLSEXT, ERR_R_INTERNAL_ERROR);
 400                         return NULL;
 401                         }
 402
 403                 s2n(TLSEXT_TYPE_elliptic_curves,ret);
 404                 s2n(s->tlsext_ellipticcurvelist_length + 2, ret);
 405
 406                 /* NB: draft-ietf-tls-ecc-12.txt uses a one-byte prefix for
 407                  * elliptic_curve_list, but the examples use two bytes.
 408                  * http://www1.ietf.org/mail-archive/web/tls/current/msg00538.html
 409                  * resolves this to two bytes.
 410                  */
 411                 s2n(s->tlsext_ellipticcurvelist_length, ret);
 412                 memcpy(ret, s->tlsext_ellipticcurvelist, s->tlsext_ellipticcurvelist_length);
 413                 ret+=s->tlsext_ellipticcurvelist_length;
 414                 }
 415 #endif /* OPENSSL_NO_EC */
 416
 417         if (!(SSL_get_options(s) & SSL_OP_NO_TICKET))
 418                 {
 419                 int ticklen;
 420                 if (!s->new_session && s->session && s->session->tlsext_tick)
 421                         ticklen = s->session->tlsext_ticklen;
 422                 else if (s->session && s->tlsext_session_ticket &&
 423                          s->tlsext_session_ticket->data)
 424                         {
 425                         ticklen = s->tlsext_session_ticket->length;
 426                         s->session->tlsext_tick = OPENSSL_malloc(ticklen);
 427                         if (!s->session->tlsext_tick)
 428                                 return NULL;
 429                         memcpy(s->session->tlsext_tick,
 430                                s->tlsext_session_ticket->data,
 431                                ticklen);
 432                         s->session->tlsext_ticklen = ticklen;
 433                         }
 434                 else
 435                         ticklen = 0;
 436                 if (ticklen == 0 && s->tlsext_session_ticket &&
 437                     s->tlsext_session_ticket->data == NULL)
 438                         goto skip_ext;
 439                 /* Check for enough room 2 for extension type, 2 for len
 440                  * rest for ticket
 441                  */
 442                 if ((long)(limit - ret - 4 - ticklen) < 0) return NULL;
 443                 s2n(TLSEXT_TYPE_session_ticket,ret);
 444                 s2n(ticklen,ret);
 445                 if (ticklen)
 446                         {
 447                         memcpy(ret, s->session->tlsext_tick, ticklen);
 448                         ret += ticklen;
 449                         }
 450                 }
 451                 skip_ext:
 452
 453         if (s->version >= TLS1_2_VERSION)
 454                 {
 455                 /* List of supported signature algorithms and hashes.
 456                  * Should make this customisable at some point, for
 457                  * now include everything we support.
 458                  */
 459                 static unsigned char sigalgs[] = {
 460 #ifndef OPENSSL_NO_RSA
 461 # ifndef OPENSSL_NO_SHA512
 462                         TLSEXT_hash_sha512, TLSEXT_signature_rsa,
 463                         TLSEXT_hash_sha384, TLSEXT_signature_rsa,
 464 # endif
 465 # ifndef OPENSSL_NO_SHA256
 466                         TLSEXT_hash_sha256, TLSEXT_signature_rsa,
 467                         TLSEXT_hash_sha224, TLSEXT_signature_rsa,
 468 # endif
 469 # ifndef OPENSSL_NO_SHA
 470                         TLSEXT_hash_sha1, TLSEXT_signature_rsa,
 471 # endif
 472 #endif
 473 #ifndef OPENSSL_NO_ECDSA
 474 # ifndef OPENSSL_NO_SHA512
 475                         TLSEXT_hash_sha512, TLSEXT_signature_ecdsa,
 476                         TLSEXT_hash_sha384, TLSEXT_signature_ecdsa,
 477 # endif
 478 # ifndef OPENSSL_NO_SHA256
 479                         TLSEXT_hash_sha256, TLSEXT_signature_ecdsa,
 480                         TLSEXT_hash_sha224, TLSEXT_signature_ecdsa,
 481 # endif
 482 # ifndef OPENSSL_NO_SHA
 483                         TLSEXT_hash_sha1, TLSEXT_signature_ecdsa,
 484 # endif
 485 #endif
 486 #ifndef OPENSSL_NO_DSA
 487 # ifndef OPENSSL_NO_SHA512
 488                         TLSEXT_hash_sha512, TLSEXT_signature_dsa,
 489                         TLSEXT_hash_sha384, TLSEXT_signature_dsa,
 490 # endif
 491 # ifndef OPENSSL_NO_SHA256
 492                         TLSEXT_hash_sha256, TLSEXT_signature_dsa,
 493                         TLSEXT_hash_sha224, TLSEXT_signature_dsa,
 494 # endif
 495 # ifndef OPENSSL_NO_SHA
 496                         TLSEXT_hash_sha1, TLSEXT_signature_dsa
 497 # endif
 498 #endif
 499                 };
 500                 if ((size_t)(limit - ret) < sizeof(sigalgs) + 6)
 501                         return NULL;
 502                 s2n(TLSEXT_TYPE_signature_algorithms,ret);
 503                 s2n(sizeof(sigalgs) + 2, ret);
 504                 s2n(sizeof(sigalgs), ret);
 505                 memcpy(ret, sigalgs, sizeof(sigalgs));
 506                 ret += sizeof(sigalgs);
 507                 }
 508
 509 #ifdef TLSEXT_TYPE_opaque_prf_input
 510         if (s->s3->client_opaque_prf_input != NULL &&
 511             s->version != DTLS1_VERSION)
 512                 {
 513                 size_t col = s->s3->client_opaque_prf_input_len;
 514
 515                 if ((long)(limit - ret - 6 - col < 0))
 516                         return NULL;
 517                 if (col > 0xFFFD) /* can't happen */
 518                         return NULL;
 519
 520                 s2n(TLSEXT_TYPE_opaque_prf_input, ret);
 521                 s2n(col + 2, ret);
 522                 s2n(col, ret);
 523                 memcpy(ret, s->s3->client_opaque_prf_input, col);
 524                 ret += col;
 525                 }
 526 #endif
 527
 528         if (s->tlsext_status_type == TLSEXT_STATUSTYPE_ocsp &&
 529             s->version != DTLS1_VERSION)
 530                 {
 531                 int i;
 532                 long extlen, idlen, itmp;
 533                 OCSP_RESPID *id;
 534
 535                 idlen = 0;
 536                 for (i = 0; i < sk_OCSP_RESPID_num(s->tlsext_ocsp_ids); i++)
 537                         {
 538                         id = sk_OCSP_RESPID_value(s->tlsext_ocsp_ids, i);
 539                         itmp = i2d_OCSP_RESPID(id, NULL);
 540                         if (itmp <= 0)
 541                                 return NULL;
 542                         idlen += itmp + 2;
 543                         }
 544
 545                 if (s->tlsext_ocsp_exts)
 546                         {
 547                         extlen = i2d_X509_EXTENSIONS(s->tlsext_ocsp_exts, NULL);
 548                         if (extlen < 0)
 549                                 return NULL;
 550                         }
 551                 else
 552                         extlen = 0;
 553
 554                 if ((long)(limit - ret - 7 - extlen - idlen) < 0) return NULL;
 555                 s2n(TLSEXT_TYPE_status_request, ret);
 556                 if (extlen + idlen > 0xFFF0)
 557                         return NULL;
 558                 s2n(extlen + idlen + 5, ret);
 559                 *(ret++) = TLSEXT_STATUSTYPE_ocsp;
 560                 s2n(idlen, ret);
 561                 for (i = 0; i < sk_OCSP_RESPID_num(s->tlsext_ocsp_ids); i++)
 562                         {
 563                         /* save position of id len */
 564                         unsigned char *q = ret;
 565                         id = sk_OCSP_RESPID_value(s->tlsext_ocsp_ids, i);
 566                         /* skip over id len */
 567                         ret += 2;
 568                         itmp = i2d_OCSP_RESPID(id, &ret);
 569                         /* write id len */
 570                         s2n(itmp, q);
 571                         }
 572                 s2n(extlen, ret);
 573                 if (extlen > 0)
 574                         i2d_X509_EXTENSIONS(s->tlsext_ocsp_exts, &ret);
 575                 }
 576
 577         if ((extdatalen = ret-p-2)== 0)
 578                 return p;
 579
 580         s2n(extdatalen,p);
 581         return ret;
 582         }
 583
 584 unsigned char *ssl_add_serverhello_tlsext(SSL *s, unsigned char *p, unsigned char *limit)
 585         {
 586         int extdatalen=0;
 587         unsigned char *ret = p;
 588
 589         /* don't add extensions for SSLv3, unless doing secure renegotiation */
 590         if (s->version == SSL3_VERSION && !s->s3->send_connection_binding)
 591                 return p;
 592
 593         ret+=2;
 594         if (ret>=limit) return NULL; /* this really never occurs, but ... */
 595
 596         if (!s->hit && s->servername_done == 1 && s->session->tlsext_hostname != NULL)
 597                 {
 598                 if ((long)(limit - ret - 4) < 0) return NULL;
 599
 600                 s2n(TLSEXT_TYPE_server_name,ret);
 601                 s2n(0,ret);
 602                 }
 603
 604         if(s->s3->send_connection_binding)
 605         {
 606           int el;
 607
 608           if(!ssl_add_serverhello_renegotiate_ext(s, 0, &el, 0))
 609               {
 610               SSLerr(SSL_F_SSL_ADD_SERVERHELLO_TLSEXT, ERR_R_INTERNAL_ERROR);
 611               return NULL;
 612               }
 613
 614           if((limit - p - 4 - el) < 0) return NULL;
 615
 616           s2n(TLSEXT_TYPE_renegotiate,ret);
 617           s2n(el,ret);
 618
 619           if(!ssl_add_serverhello_renegotiate_ext(s, ret, &el, el))
 620               {
 621               SSLerr(SSL_F_SSL_ADD_SERVERHELLO_TLSEXT, ERR_R_INTERNAL_ERROR);
 622               return NULL;
 623               }
 624
 625           ret += el;
 626         }
 627
 628 #ifndef OPENSSL_NO_EC
 629         if (s->tlsext_ecpointformatlist != NULL &&
 630             s->version != DTLS1_VERSION)
 631                 {
 632                 /* Add TLS extension ECPointFormats to the ServerHello message */
 633                 long lenmax;
 634
 635                 if ((lenmax = limit - ret - 5) < 0) return NULL;
 636                 if (s->tlsext_ecpointformatlist_length > (unsigned long)lenmax) return NULL;
 637                 if (s->tlsext_ecpointformatlist_length > 255)
 638                         {
 639                         SSLerr(SSL_F_SSL_ADD_SERVERHELLO_TLSEXT, ERR_R_INTERNAL_ERROR);
 640                         return NULL;
 641                         }
 642
 643                 s2n(TLSEXT_TYPE_ec_point_formats,ret);
 644                 s2n(s->tlsext_ecpointformatlist_length + 1,ret);
 645                 *(ret++) = (unsigned char) s->tlsext_ecpointformatlist_length;
 646                 memcpy(ret, s->tlsext_ecpointformatlist, s->tlsext_ecpointformatlist_length);
 647                 ret+=s->tlsext_ecpointformatlist_length;
 648
 649                 }
 650         /* Currently the server should not respond with a SupportedCurves extension */
 651 #endif /* OPENSSL_NO_EC */
 652
 653         if (s->tlsext_ticket_expected
 654                 && !(SSL_get_options(s) & SSL_OP_NO_TICKET))
 655                 {
 656                 if ((long)(limit - ret - 4) < 0) return NULL;
 657                 s2n(TLSEXT_TYPE_session_ticket,ret);
 658                 s2n(0,ret);
 659                 }
 660
 661         if (s->tlsext_status_expected)
 662                 {
 663                 if ((long)(limit - ret - 4) < 0) return NULL;
 664                 s2n(TLSEXT_TYPE_status_request,ret);
 665                 s2n(0,ret);
 666                 }
 667
 668 #ifdef TLSEXT_TYPE_opaque_prf_input
 669         if (s->s3->server_opaque_prf_input != NULL &&
 670             s->version != DTLS1_VERSION)
 671                 {
 672                 size_t sol = s->s3->server_opaque_prf_input_len;
 673
 674                 if ((long)(limit - ret - 6 - sol) < 0)
 675                         return NULL;
 676                 if (sol > 0xFFFD) /* can't happen */
 677                         return NULL;
 678
 679                 s2n(TLSEXT_TYPE_opaque_prf_input, ret);
 680                 s2n(sol + 2, ret);
 681                 s2n(sol, ret);
 682                 memcpy(ret, s->s3->server_opaque_prf_input, sol);
 683                 ret += sol;
 684                 }
 685 #endif
 686         if (((s->s3->tmp.new_cipher->id & 0xFFFF)==0x80 || (s->s3->tmp.new_cipher->id & 0xFFFF)==0x81)
 687                 && (SSL_get_options(s) & SSL_OP_CRYPTOPRO_TLSEXT_BUG))
 688                 { const unsigned char cryptopro_ext[36] = {
 689                         0xfd, 0xe8, /*65000*/
 690                         0x00, 0x20, /*32 bytes length*/
 691                         0x30, 0x1e, 0x30, 0x08, 0x06, 0x06, 0x2a, 0x85,
 692                         0x03,   0x02, 0x02, 0x09, 0x30, 0x08, 0x06, 0x06,
 693                         0x2a, 0x85, 0x03, 0x02, 0x02, 0x16, 0x30, 0x08,
 694                         0x06, 0x06, 0x2a, 0x85, 0x03, 0x02, 0x02, 0x17};
 695                         if (limit-ret<36) return NULL;
 696                         memcpy(ret,cryptopro_ext,36);
 697                         ret+=36;
 698
 699                 }
 700
 701         if ((extdatalen = ret-p-2)== 0)
 702                 return p;
 703
 704         s2n(extdatalen,p);
 705         return ret;
 706         }
 707
 708 int ssl_parse_clienthello_tlsext(SSL *s, unsigned char **p, unsigned char *d, int n, int *al)
 709         {
 710         unsigned short type;
 711         unsigned short size;
 712         unsigned short len;
 713         unsigned char *data = *p;
 714         int renegotiate_seen = 0;
 715         int sigalg_seen = 0;
 716
 717         s->servername_done = 0;
 718         s->tlsext_status_type = -1;
 719
 720         if (data >= (d+n-2))
 721                 goto ri_check;
 722         n2s(data,len);
 723
 724         if (data > (d+n-len))
 725                 goto ri_check;
 726
 727         while (data <= (d+n-4))
 728                 {
 729                 n2s(data,type);
 730                 n2s(data,size);
 731
 732                 if (data+size > (d+n))
 733                         goto ri_check;
 734 #if 0
 735                 fprintf(stderr,"Received extension type %d size %d\n",type,size);
 736 #endif
 737                 if (s->tlsext_debug_cb)
 738                         s->tlsext_debug_cb(s, 0, type, data, size,
 739                                                 s->tlsext_debug_arg);
 740 /* The servername extension is treated as follows:
 741
 742    - Only the hostname type is supported with a maximum length of 255.
 743    - The servername is rejected if too long or if it contains zeros,
 744      in which case an fatal alert is generated.
 745    - The servername field is maintained together with the session cache.
 746    - When a session is resumed, the servername call back invoked in order
 747      to allow the application to position itself to the right context.
 748    - The servername is acknowledged if it is new for a session or when
 749      it is identical to a previously used for the same session.
 750      Applications can control the behaviour.  They can at any time
 751      set a 'desirable' servername for a new SSL object. This can be the
 752      case for example with HTTPS when a Host: header field is received and
 753      a renegotiation is requested. In this case, a possible servername
 754      presented in the new client hello is only acknowledged if it matches
 755      the value of the Host: field.
 756    - Applications must  use SSL_OP_NO_SESSION_RESUMPTION_ON_RENEGOTIATION
 757      if they provide for changing an explicit servername context for the session,
 758      i.e. when the session has been established with a servername extension.
 759    - On session reconnect, the servername extension may be absent.
 760
 761 */
 762
 763                 if (type == TLSEXT_TYPE_server_name)
 764                         {
 765                         unsigned char *sdata;
 766                         int servname_type;
 767                         int dsize;
 768
 769                         if (size < 2)
 770                                 {
 771                                 *al = SSL_AD_DECODE_ERROR;
 772                                 return 0;
 773                                 }
 774                         n2s(data,dsize);
 775                         size -= 2;
 776                         if (dsize > size  )
 777                                 {
 778                                 *al = SSL_AD_DECODE_ERROR;
 779                                 return 0;
 780                                 }
 781
 782                         sdata = data;
 783                         while (dsize > 3)
 784                                 {
 785                                 servname_type = *(sdata++);
 786                                 n2s(sdata,len);
 787                                 dsize -= 3;
 788
 789                                 if (len > dsize)
 790                                         {
 791                                         *al = SSL_AD_DECODE_ERROR;
 792                                         return 0;
 793                                         }
 794                                 if (s->servername_done == 0)
 795                                 switch (servname_type)
 796                                         {
 797                                 case TLSEXT_NAMETYPE_host_name:
 798                                         if (!s->hit)
 799                                                 {
 800                                                 if(s->session->tlsext_hostname)
 801                                                         {
 802                                                         *al = SSL_AD_DECODE_ERROR;
 803                                                         return 0;
 804                                                         }
 805                                                 if (len > TLSEXT_MAXLEN_host_name)
 806                                                         {
 807                                                         *al = TLS1_AD_UNRECOGNIZED_NAME;
 808                                                         return 0;
 809                                                         }
 810                                                 if ((s->session->tlsext_hostname = OPENSSL_malloc(len+1)) == NULL)
 811                                                         {
 812                                                         *al = TLS1_AD_INTERNAL_ERROR;
 813                                                         return 0;
 814                                                         }
 815                                                 memcpy(s->session->tlsext_hostname, sdata, len);
 816                                                 s->session->tlsext_hostname[len]='\0';
 817                                                 if (strlen(s->session->tlsext_hostname) != len) {
 818                                                         OPENSSL_free(s->session->tlsext_hostname);
 819                                                         s->session->tlsext_hostname = NULL;
 820                                                         *al = TLS1_AD_UNRECOGNIZED_NAME;
 821                                                         return 0;
 822                                                 }
 823                                                 s->servername_done = 1;
 824
 825                                                 }
 826                                         else
 827                                                 s->servername_done = s->session->tlsext_hostname
 828                                                         && strlen(s->session->tlsext_hostname) == len
 829                                                         && strncmp(s->session->tlsext_hostname, (char *)sdata, len) == 0;
 830
 831                                         break;
 832
 833                                 default:
 834                                         break;
 835                                         }
 836
 837                                 dsize -= len;
 838                                 }
 839                         if (dsize != 0)
 840                                 {
 841                                 *al = SSL_AD_DECODE_ERROR;
 842                                 return 0;
 843                                 }
 844
 845                         }
 846 #ifndef OPENSSL_NO_SRP
 847                 else if (type == TLSEXT_TYPE_srp)
 848                         {
 849                         if (size > 0)
 850                                 {
 851                                 len = data[0];
 852                                 if ((s->srp_ctx.login = OPENSSL_malloc(len+1)) == NULL)
 853                                         return -1;
 854                                 memcpy(s->srp_ctx.login, &data[1], len);
 855                                 s->srp_ctx.login[len]='\0';
 856                                 }
 857                         }
 858 #endif
 859
 860 #ifndef OPENSSL_NO_EC
 861                 else if (type == TLSEXT_TYPE_ec_point_formats &&
 862                      s->version != DTLS1_VERSION)
 863                         {
 864                         unsigned char *sdata = data;
 865                         int ecpointformatlist_length = *(sdata++);
 866
 867                         if (ecpointformatlist_length != size - 1)
 868                                 {
 869                                 *al = TLS1_AD_DECODE_ERROR;
 870                                 return 0;
 871                                 }
 872                         if (!s->hit)
 873                                 {
 874                                 if(s->session->tlsext_ecpointformatlist)
 875                                         {
 876                                         OPENSSL_free(s->session->tlsext_ecpointformatlist);
 877                                         s->session->tlsext_ecpointformatlist = NULL;
 878                                         }
 879                                 s->session->tlsext_ecpointformatlist_length = 0;
 880                                 if ((s->session->tlsext_ecpointformatlist = OPENSSL_malloc(ecpointformatlist_length)) == NULL)
 881                                         {
 882                                         *al = TLS1_AD_INTERNAL_ERROR;
 883                                         return 0;
 884                                         }
 885                                 s->session->tlsext_ecpointformatlist_length = ecpointformatlist_length;
 886                                 memcpy(s->session->tlsext_ecpointformatlist, sdata, ecpointformatlist_length);
 887                                 }
 888 #if 0
 889                         fprintf(stderr,"ssl_parse_clienthello_tlsext s->session->tlsext_ecpointformatlist (length=%i) ", s->session->tlsext_ecpointformatlist_length);
 890                         sdata = s->session->tlsext_ecpointformatlist;
 891                         for (i = 0; i < s->session->tlsext_ecpointformatlist_length; i++)
 892                                 fprintf(stderr,"%i ",*(sdata++));
 893                         fprintf(stderr,"\n");
 894 #endif
 895                         }
 896                 else if (type == TLSEXT_TYPE_elliptic_curves &&
 897                      s->version != DTLS1_VERSION)
 898                         {
 899                         unsigned char *sdata = data;
 900                         int ellipticcurvelist_length = (*(sdata++) << 8);
 901                         ellipticcurvelist_length += (*(sdata++));
 902
 903                         if (ellipticcurvelist_length != size - 2)
 904                                 {
 905                                 *al = TLS1_AD_DECODE_ERROR;
 906                                 return 0;
 907                                 }
 908                         if (!s->hit)
 909                                 {
 910                                 if(s->session->tlsext_ellipticcurvelist)
 911                                         {
 912                                         *al = TLS1_AD_DECODE_ERROR;
 913                                         return 0;
 914                                         }
 915                                 s->session->tlsext_ellipticcurvelist_length = 0;
 916                                 if ((s->session->tlsext_ellipticcurvelist = OPENSSL_malloc(ellipticcurvelist_length)) == NULL)
 917                                         {
 918                                         *al = TLS1_AD_INTERNAL_ERROR;
 919                                         return 0;
 920                                         }
 921                                 s->session->tlsext_ellipticcurvelist_length = ellipticcurvelist_length;
 922                                 memcpy(s->session->tlsext_ellipticcurvelist, sdata, ellipticcurvelist_length);
 923                                 }
 924 #if 0
 925                         fprintf(stderr,"ssl_parse_clienthello_tlsext s->session->tlsext_ellipticcurvelist (length=%i) ", s->session->tlsext_ellipticcurvelist_length);
 926                         sdata = s->session->tlsext_ellipticcurvelist;
 927                         for (i = 0; i < s->session->tlsext_ellipticcurvelist_length; i++)
 928                                 fprintf(stderr,"%i ",*(sdata++));
 929                         fprintf(stderr,"\n");
 930 #endif
 931                         }
 932 #endif /* OPENSSL_NO_EC */
 933 #ifdef TLSEXT_TYPE_opaque_prf_input
 934                 else if (type == TLSEXT_TYPE_opaque_prf_input &&
 935                      s->version != DTLS1_VERSION)
 936                         {
 937                         unsigned char *sdata = data;
 938
 939                         if (size < 2)
 940                                 {
 941                                 *al = SSL_AD_DECODE_ERROR;
 942                                 return 0;
 943                                 }
 944                         n2s(sdata, s->s3->client_opaque_prf_input_len);
 945                         if (s->s3->client_opaque_prf_input_len != size - 2)
 946                                 {
 947                                 *al = SSL_AD_DECODE_ERROR;
 948                                 return 0;
 949                                 }
 950
 951                         if (s->s3->client_opaque_prf_input != NULL) /* shouldn't really happen */
 952                                 OPENSSL_free(s->s3->client_opaque_prf_input);
 953                         if (s->s3->client_opaque_prf_input_len == 0)
 954                                 s->s3->client_opaque_prf_input = OPENSSL_malloc(1); /* dummy byte just to get non-NULL */
 955                         else
 956                                 s->s3->client_opaque_prf_input = BUF_memdup(sdata, s->s3->client_opaque_prf_input_len);
 957                         if (s->s3->client_opaque_prf_input == NULL)
 958                                 {
 959                                 *al = TLS1_AD_INTERNAL_ERROR;
 960                                 return 0;
 961                                 }
 962                         }
 963 #endif
 964                 else if (type == TLSEXT_TYPE_session_ticket)
 965                         {
 966                         if (s->tls_session_ticket_ext_cb &&
 967                             !s->tls_session_ticket_ext_cb(s, data, size, s->tls_session_ticket_ext_cb_arg))
 968                                 {
 969                                 *al = TLS1_AD_INTERNAL_ERROR;
 970                                 return 0;
 971                                 }
 972                         }
 973                 else if (type == TLSEXT_TYPE_renegotiate)
 974                         {
 975                         if(!ssl_parse_clienthello_renegotiate_ext(s, data, size, al))
 976                                 return 0;
 977                         renegotiate_seen = 1;
 978                         }
 979                 else if (type == TLSEXT_TYPE_signature_algorithms)
 980                         {
 981                         int dsize;
 982                         if (sigalg_seen || size < 2)
 983                                 {
 984                                 *al = SSL_AD_DECODE_ERROR;
 985                                 return 0;
 986                                 }
 987                         sigalg_seen = 1;
 988                         n2s(data,dsize);
 989                         size -= 2;
 990                         if (dsize != size || dsize & 1)
 991                                 {
 992                                 *al = SSL_AD_DECODE_ERROR;
 993                                 return 0;
 994                                 }
 995                         if (!tls1_process_sigalgs(s, data, dsize))
 996                                 {
 997                                 *al = SSL_AD_DECODE_ERROR;
 998                                 return 0;
 999                                 }
1000                         }
1001                 else if (type == TLSEXT_TYPE_status_request &&
1002                          s->version != DTLS1_VERSION && s->ctx->tlsext_status_cb)
1003                         {
1004
1005                         if (size < 5)
1006                                 {
1007                                 *al = SSL_AD_DECODE_ERROR;
1008                                 return 0;
1009                                 }
1010
1011                         s->tlsext_status_type = *data++;
1012                         size--;
1013                         if (s->tlsext_status_type == TLSEXT_STATUSTYPE_ocsp)
1014                                 {
1015                                 const unsigned char *sdata;
1016                                 int dsize;
1017                                 /* Read in responder_id_list */
1018                                 n2s(data,dsize);
1019                                 size -= 2;
1020                                 if (dsize > size  )
1021                                         {
1022                                         *al = SSL_AD_DECODE_ERROR;
1023                                         return 0;
1024                                         }
1025                                 while (dsize > 0)
1026                                         {
1027                                         OCSP_RESPID *id;
1028                                         int idsize;
1029                                         if (dsize < 4)
1030                                                 {
1031                                                 *al = SSL_AD_DECODE_ERROR;
1032                                                 return 0;
1033                                                 }
1034                                         n2s(data, idsize);
1035                                         dsize -= 2 + idsize;
1036                                         size -= 2 + idsize;
1037                                         if (dsize < 0)
1038                                                 {
1039                                                 *al = SSL_AD_DECODE_ERROR;
1040                                                 return 0;
1041                                                 }
1042                                         sdata = data;
1043                                         data += idsize;
1044                                         id = d2i_OCSP_RESPID(NULL,
1045                                                                 &sdata, idsize);
1046                                         if (!id)
1047                                                 {
1048                                                 *al = SSL_AD_DECODE_ERROR;
1049                                                 return 0;
1050                                                 }
1051                                         if (data != sdata)
1052                                                 {
1053                                                 OCSP_RESPID_free(id);
1054                                                 *al = SSL_AD_DECODE_ERROR;
1055                                                 return 0;
1056                                                 }
1057                                         if (!s->tlsext_ocsp_ids
1058                                                 && !(s->tlsext_ocsp_ids =
1059                                                 sk_OCSP_RESPID_new_null()))
1060                                                 {
1061                                                 OCSP_RESPID_free(id);
1062                                                 *al = SSL_AD_INTERNAL_ERROR;
1063                                                 return 0;
1064                                                 }
1065                                         if (!sk_OCSP_RESPID_push(
1066                                                         s->tlsext_ocsp_ids, id))
1067                                                 {
1068                                                 OCSP_RESPID_free(id);
1069                                                 *al = SSL_AD_INTERNAL_ERROR;
1070                                                 return 0;
1071                                                 }
1072                                         }
1073
1074                                 /* Read in request_extensions */
1075                                 if (size < 2)
1076                                         {
1077                                         *al = SSL_AD_DECODE_ERROR;
1078                                         return 0;
1079                                         }
1080                                 n2s(data,dsize);
1081                                 size -= 2;
1082                                 if (dsize != size)
1083                                         {
1084                                         *al = SSL_AD_DECODE_ERROR;
1085                                         return 0;
1086                                         }
1087                                 sdata = data;
1088                                 if (dsize > 0)
1089                                         {
1090                                         s->tlsext_ocsp_exts =
1091                                                 d2i_X509_EXTENSIONS(NULL,
1092                                                         &sdata, dsize);
1093                                         if (!s->tlsext_ocsp_exts
1094                                                 || (data + dsize != sdata))
1095                                                 {
1096                                                 *al = SSL_AD_DECODE_ERROR;
1097                                                 return 0;
1098                                                 }
1099                                         }
1100                                 }
1101                                 /* We don't know what to do with any other type
1102                                 * so ignore it.
1103                                 */
1104                                 else
1105                                         s->tlsext_status_type = -1;
1106                         }
1107
1108                 /* session ticket processed earlier */
1109                 data+=size;
1110                 }
1111
1112         *p = data;
1113
1114         ri_check:
1115
1116         /* Need RI if renegotiating */
1117
1118         if (!renegotiate_seen && s->renegotiate &&
1119                 !(s->options & SSL_OP_ALLOW_UNSAFE_LEGACY_RENEGOTIATION))
1120                 {
1121                 *al = SSL_AD_HANDSHAKE_FAILURE;
1122                 SSLerr(SSL_F_SSL_PARSE_CLIENTHELLO_TLSEXT,
1123                                 SSL_R_UNSAFE_LEGACY_RENEGOTIATION_DISABLED);
1124                 return 0;
1125                 }
1126
1127         return 1;
1128         }
1129
1130 int ssl_parse_serverhello_tlsext(SSL *s, unsigned char **p, unsigned char *d, int n, int *al)
1131         {
1132         unsigned short length;
1133         unsigned short type;
1134         unsigned short size;
1135         unsigned char *data = *p;
1136         int tlsext_servername = 0;
1137         int renegotiate_seen = 0;
1138
1139         if (data >= (d+n-2))
1140                 goto ri_check;
1141
1142         n2s(data,length);
1143         if (data+length != d+n)
1144                 {
1145                 *al = SSL_AD_DECODE_ERROR;
1146                 return 0;
1147                 }
1148
1149         while(data <= (d+n-4))
1150                 {
1151                 n2s(data,type);
1152                 n2s(data,size);
1153
1154                 if (data+size > (d+n))
1155                         goto ri_check;
1156
1157                 if (s->tlsext_debug_cb)
1158                         s->tlsext_debug_cb(s, 1, type, data, size,
1159                                                 s->tlsext_debug_arg);
1160
1161                 if (type == TLSEXT_TYPE_server_name)
1162                         {
1163                         if (s->tlsext_hostname == NULL || size > 0)
1164                                 {
1165                                 *al = TLS1_AD_UNRECOGNIZED_NAME;
1166                                 return 0;
1167                                 }
1168                         tlsext_servername = 1;
1169                         }
1170
1171 #ifndef OPENSSL_NO_EC
1172                 else if (type == TLSEXT_TYPE_ec_point_formats &&
1173                      s->version != DTLS1_VERSION)
1174                         {
1175                         unsigned char *sdata = data;
1176                         int ecpointformatlist_length = *(sdata++);
1177
1178                         if (ecpointformatlist_length != size - 1)
1179                                 {
1180                                 *al = TLS1_AD_DECODE_ERROR;
1181                                 return 0;
1182                                 }
1183                         s->session->tlsext_ecpointformatlist_length = 0;
1184                         if (s->session->tlsext_ecpointformatlist != NULL) OPENSSL_free(s->session->tlsext_ecpointformatlist);
1185                         if ((s->session->tlsext_ecpointformatlist = OPENSSL_malloc(ecpointformatlist_length)) == NULL)
1186                                 {
1187                                 *al = TLS1_AD_INTERNAL_ERROR;
1188                                 return 0;
1189                                 }
1190                         s->session->tlsext_ecpointformatlist_length = ecpointformatlist_length;
1191                         memcpy(s->session->tlsext_ecpointformatlist, sdata, ecpointformatlist_length);
1192 #if 0
1193                         fprintf(stderr,"ssl_parse_serverhello_tlsext s->session->tlsext_ecpointformatlist ");
1194                         sdata = s->session->tlsext_ecpointformatlist;
1195                         for (i = 0; i < s->session->tlsext_ecpointformatlist_length; i++)
1196                                 fprintf(stderr,"%i ",*(sdata++));
1197                         fprintf(stderr,"\n");
1198 #endif
1199                         }
1200 #endif /* OPENSSL_NO_EC */
1201
1202                 else if (type == TLSEXT_TYPE_session_ticket)
1203                         {
1204                         if (s->tls_session_ticket_ext_cb &&
1205                             !s->tls_session_ticket_ext_cb(s, data, size, s->tls_session_ticket_ext_cb_arg))
1206                                 {
1207                                 *al = TLS1_AD_INTERNAL_ERROR;
1208                                 return 0;
1209                                 }
1210                         if ((SSL_get_options(s) & SSL_OP_NO_TICKET)
1211                                 || (size > 0))
1212                                 {
1213                                 *al = TLS1_AD_UNSUPPORTED_EXTENSION;
1214                                 return 0;
1215                                 }
1216                         s->tlsext_ticket_expected = 1;
1217                         }
1218 #ifdef TLSEXT_TYPE_opaque_prf_input
1219                 else if (type == TLSEXT_TYPE_opaque_prf_input &&
1220                      s->version != DTLS1_VERSION)
1221                         {
1222                         unsigned char *sdata = data;
1223
1224                         if (size < 2)
1225                                 {
1226                                 *al = SSL_AD_DECODE_ERROR;
1227                                 return 0;
1228                                 }
1229                         n2s(sdata, s->s3->server_opaque_prf_input_len);
1230                         if (s->s3->server_opaque_prf_input_len != size - 2)
1231                                 {
1232                                 *al = SSL_AD_DECODE_ERROR;
1233                                 return 0;
1234                                 }
1235
1236                         if (s->s3->server_opaque_prf_input != NULL) /* shouldn't really happen */
1237                                 OPENSSL_free(s->s3->server_opaque_prf_input);
1238                         if (s->s3->server_opaque_prf_input_len == 0)
1239                                 s->s3->server_opaque_prf_input = OPENSSL_malloc(1); /* dummy byte just to get non-NULL */
1240                         else
1241                                 s->s3->server_opaque_prf_input = BUF_memdup(sdata, s->s3->server_opaque_prf_input_len);
1242
1243                         if (s->s3->server_opaque_prf_input == NULL)
1244                                 {
1245                                 *al = TLS1_AD_INTERNAL_ERROR;
1246                                 return 0;
1247                                 }
1248                         }
1249 #endif
1250                 else if (type == TLSEXT_TYPE_status_request &&
1251                          s->version != DTLS1_VERSION)
1252                         {
1253                         /* MUST be empty and only sent if we've requested
1254                          * a status request message.
1255                          */
1256                         if ((s->tlsext_status_type == -1) || (size > 0))
1257                                 {
1258                                 *al = TLS1_AD_UNSUPPORTED_EXTENSION;
1259                                 return 0;
1260                                 }
1261                         /* Set flag to expect CertificateStatus message */
1262                         s->tlsext_status_expected = 1;
1263                         }
1264                 else if (type == TLSEXT_TYPE_renegotiate)
1265                         {
1266                         if(!ssl_parse_serverhello_renegotiate_ext(s, data, size, al))
1267                                 return 0;
1268                         renegotiate_seen = 1;
1269                         }
1270                 data+=size;
1271                 }
1272
1273         if (data != d+n)
1274                 {
1275                 *al = SSL_AD_DECODE_ERROR;
1276                 return 0;
1277                 }
1278
1279         if (!s->hit && tlsext_servername == 1)
1280                 {
1281                 if (s->tlsext_hostname)
1282                         {
1283                         if (s->session->tlsext_hostname == NULL)
1284                                 {
1285                                 s->session->tlsext_hostname = BUF_strdup(s->tlsext_hostname);
1286                                 if (!s->session->tlsext_hostname)
1287                                         {
1288                                         *al = SSL_AD_UNRECOGNIZED_NAME;
1289                                         return 0;
1290                                         }
1291                                 }
1292                         else
1293                                 {
1294                                 *al = SSL_AD_DECODE_ERROR;
1295                                 return 0;
1296                                 }
1297                         }
1298                 }
1299
1300         *p = data;
1301
1302         ri_check:
1303
1304         /* Determine if we need to see RI. Strictly speaking if we want to
1305          * avoid an attack we should *always* see RI even on initial server
1306          * hello because the client doesn't see any renegotiation during an
1307          * attack. However this would mean we could not connect to any server
1308          * which doesn't support RI so for the immediate future tolerate RI
1309          * absence on initial connect only.
1310          */
1311         if (!renegotiate_seen
1312                 && !(s->options & SSL_OP_LEGACY_SERVER_CONNECT)
1313                 && !(s->options & SSL_OP_ALLOW_UNSAFE_LEGACY_RENEGOTIATION))
1314                 {
1315                 *al = SSL_AD_HANDSHAKE_FAILURE;
1316                 SSLerr(SSL_F_SSL_PARSE_SERVERHELLO_TLSEXT,
1317                                 SSL_R_UNSAFE_LEGACY_RENEGOTIATION_DISABLED);
1318                 return 0;
1319                 }
1320
1321         return 1;
1322         }
1323
1324
1325 int ssl_prepare_clienthello_tlsext(SSL *s)
1326         {
1327 #ifndef OPENSSL_NO_EC
1328         /* If we are client and using an elliptic curve cryptography cipher suite, send the point formats
1329          * and elliptic curves we support.
1330          */
1331         int using_ecc = 0;
1332         int i;
1333         unsigned char *j;
1334         unsigned long alg_k, alg_a;
1335         STACK_OF(SSL_CIPHER) *cipher_stack = SSL_get_ciphers(s);
1336
1337         for (i = 0; i < sk_SSL_CIPHER_num(cipher_stack); i++)
1338                 {
1339                 SSL_CIPHER *c = sk_SSL_CIPHER_value(cipher_stack, i);
1340
1341                 alg_k = c->algorithm_mkey;
1342                 alg_a = c->algorithm_auth;
1343                 if ((alg_k & (SSL_kEECDH|SSL_kECDHr|SSL_kECDHe) || (alg_a & SSL_aECDSA)))
1344                         {
1345                         using_ecc = 1;
1346                         break;
1347                         }
1348                 }
1349         using_ecc = using_ecc && (s->version >= TLS1_VERSION);
1350         if (using_ecc)
1351                 {
1352                 if (s->tlsext_ecpointformatlist != NULL) OPENSSL_free(s->tlsext_ecpointformatlist);
1353                 if ((s->tlsext_ecpointformatlist = OPENSSL_malloc(3)) == NULL)
1354                         {
1355                         SSLerr(SSL_F_SSL_PREPARE_CLIENTHELLO_TLSEXT,ERR_R_MALLOC_FAILURE);
1356                         return -1;
1357                         }
1358                 s->tlsext_ecpointformatlist_length = 3;
1359                 s->tlsext_ecpointformatlist[0] = TLSEXT_ECPOINTFORMAT_uncompressed;
1360                 s->tlsext_ecpointformatlist[1] = TLSEXT_ECPOINTFORMAT_ansiX962_compressed_prime;
1361                 s->tlsext_ecpointformatlist[2] = TLSEXT_ECPOINTFORMAT_ansiX962_compressed_char2;
1362
1363                 /* we support all named elliptic curves in draft-ietf-tls-ecc-12 */
1364                 if (s->tlsext_ellipticcurvelist != NULL) OPENSSL_free(s->tlsext_ellipticcurvelist);
1365                 s->tlsext_ellipticcurvelist_length = sizeof(nid_list)/sizeof(nid_list[0]) * 2;
1366                 if ((s->tlsext_ellipticcurvelist = OPENSSL_malloc(s->tlsext_ellipticcurvelist_length)) == NULL)
1367                         {
1368                         s->tlsext_ellipticcurvelist_length = 0;
1369                         SSLerr(SSL_F_SSL_PREPARE_CLIENTHELLO_TLSEXT,ERR_R_MALLOC_FAILURE);
1370                         return -1;
1371                         }
1372                 for (i = 1, j = s->tlsext_ellipticcurvelist; (unsigned int)i <=
1373                                 sizeof(nid_list)/sizeof(nid_list[0]); i++)
1374                         s2n(i,j);
1375                 }
1376 #endif /* OPENSSL_NO_EC */
1377
1378 #ifdef TLSEXT_TYPE_opaque_prf_input
1379         {
1380                 int r = 1;
1381
1382                 if (s->ctx->tlsext_opaque_prf_input_callback != 0)
1383                         {
1384                         r = s->ctx->tlsext_opaque_prf_input_callback(s, NULL, 0, s->ctx->tlsext_opaque_prf_input_callback_arg);
1385                         if (!r)
1386                                 return -1;
1387                         }
1388
1389                 if (s->tlsext_opaque_prf_input != NULL)
1390                         {
1391                         if (s->s3->client_opaque_prf_input != NULL) /* shouldn't really happen */
1392                                 OPENSSL_free(s->s3->client_opaque_prf_input);
1393
1394                         if (s->tlsext_opaque_prf_input_len == 0)
1395                                 s->s3->client_opaque_prf_input = OPENSSL_malloc(1); /* dummy byte just to get non-NULL */
1396                         else
1397                                 s->s3->client_opaque_prf_input = BUF_memdup(s->tlsext_opaque_prf_input, s->tlsext_opaque_prf_input_len);
1398                         if (s->s3->client_opaque_prf_input == NULL)
1399                                 {
1400                                 SSLerr(SSL_F_SSL_PREPARE_CLIENTHELLO_TLSEXT,ERR_R_MALLOC_FAILURE);
1401                                 return -1;
1402                                 }
1403                         s->s3->client_opaque_prf_input_len = s->tlsext_opaque_prf_input_len;
1404                         }
1405
1406                 if (r == 2)
1407                         /* at callback's request, insist on receiving an appropriate server opaque PRF input */
1408                         s->s3->server_opaque_prf_input_len = s->tlsext_opaque_prf_input_len;
1409         }
1410 #endif
1411
1412         return 1;
1413         }
1414
1415 int ssl_prepare_serverhello_tlsext(SSL *s)
1416         {
1417 #ifndef OPENSSL_NO_EC
1418         /* If we are server and using an ECC cipher suite, send the point formats we support
1419          * if the client sent us an ECPointsFormat extension.  Note that the server is not
1420          * supposed to send an EllipticCurves extension.
1421          */
1422
1423         unsigned long alg_k = s->s3->tmp.new_cipher->algorithm_mkey;
1424         unsigned long alg_a = s->s3->tmp.new_cipher->algorithm_auth;
1425         int using_ecc = (alg_k & (SSL_kEECDH|SSL_kECDHr|SSL_kECDHe)) || (alg_a & SSL_aECDSA);
1426         using_ecc = using_ecc && (s->session->tlsext_ecpointformatlist != NULL);
1427
1428         if (using_ecc)
1429                 {
1430                 if (s->tlsext_ecpointformatlist != NULL) OPENSSL_free(s->tlsext_ecpointformatlist);
1431                 if ((s->tlsext_ecpointformatlist = OPENSSL_malloc(3)) == NULL)
1432                         {
1433                         SSLerr(SSL_F_SSL_PREPARE_SERVERHELLO_TLSEXT,ERR_R_MALLOC_FAILURE);
1434                         return -1;
1435                         }
1436                 s->tlsext_ecpointformatlist_length = 3;
1437                 s->tlsext_ecpointformatlist[0] = TLSEXT_ECPOINTFORMAT_uncompressed;
1438                 s->tlsext_ecpointformatlist[1] = TLSEXT_ECPOINTFORMAT_ansiX962_compressed_prime;
1439                 s->tlsext_ecpointformatlist[2] = TLSEXT_ECPOINTFORMAT_ansiX962_compressed_char2;
1440                 }
1441 #endif /* OPENSSL_NO_EC */
1442
1443         return 1;
1444         }
1445
1446 int ssl_check_clienthello_tlsext(SSL *s)
1447         {
1448         int ret=SSL_TLSEXT_ERR_NOACK;
1449         int al = SSL_AD_UNRECOGNIZED_NAME;
1450
1451 #ifndef OPENSSL_NO_EC
1452         /* The handling of the ECPointFormats extension is done elsewhere, namely in
1453          * ssl3_choose_cipher in s3_lib.c.
1454          */
1455         /* The handling of the EllipticCurves extension is done elsewhere, namely in
1456          * ssl3_choose_cipher in s3_lib.c.
1457          */
1458 #endif
1459
1460         if (s->ctx != NULL && s->ctx->tlsext_servername_callback != 0)
1461                 ret = s->ctx->tlsext_servername_callback(s, &al, s->ctx->tlsext_servername_arg);
1462         else if (s->initial_ctx != NULL && s->initial_ctx->tlsext_servername_callback != 0)
1463                 ret = s->initial_ctx->tlsext_servername_callback(s, &al, s->initial_ctx->tlsext_servername_arg);
1464
1465         /* If status request then ask callback what to do.
1466          * Note: this must be called after servername callbacks in case
1467          * the certificate has changed.
1468          */
1469         if ((s->tlsext_status_type != -1) && s->ctx && s->ctx->tlsext_status_cb)
1470                 {
1471                 int r;
1472                 r = s->ctx->tlsext_status_cb(s, s->ctx->tlsext_status_arg);
1473                 switch (r)
1474                         {
1475                         /* We don't want to send a status request response */
1476                         case SSL_TLSEXT_ERR_NOACK:
1477                                 s->tlsext_status_expected = 0;
1478                                 break;
1479                         /* status request response should be sent */
1480                         case SSL_TLSEXT_ERR_OK:
1481                                 if (s->tlsext_ocsp_resp)
1482                                         s->tlsext_status_expected = 1;
1483                                 else
1484                                         s->tlsext_status_expected = 0;
1485                                 break;
1486                         /* something bad happened */
1487                         case SSL_TLSEXT_ERR_ALERT_FATAL:
1488                                 ret = SSL_TLSEXT_ERR_ALERT_FATAL;
1489                                 al = SSL_AD_INTERNAL_ERROR;
1490                                 goto err;
1491                         }
1492                 }
1493         else
1494                 s->tlsext_status_expected = 0;
1495
1496 #ifdef TLSEXT_TYPE_opaque_prf_input
1497         {
1498                 /* This sort of belongs into ssl_prepare_serverhello_tlsext(),
1499                  * but we might be sending an alert in response to the client hello,
1500                  * so this has to happen here in ssl_check_clienthello_tlsext(). */
1501
1502                 int r = 1;
1503
1504                 if (s->ctx->tlsext_opaque_prf_input_callback != 0)
1505                         {
1506                         r = s->ctx->tlsext_opaque_prf_input_callback(s, NULL, 0, s->ctx->tlsext_opaque_prf_input_callback_arg);
1507                         if (!r)
1508                                 {
1509                                 ret = SSL_TLSEXT_ERR_ALERT_FATAL;
1510                                 al = SSL_AD_INTERNAL_ERROR;
1511                                 goto err;
1512                                 }
1513                         }
1514
1515                 if (s->s3->server_opaque_prf_input != NULL) /* shouldn't really happen */
1516                         OPENSSL_free(s->s3->server_opaque_prf_input);
1517                 s->s3->server_opaque_prf_input = NULL;
1518
1519                 if (s->tlsext_opaque_prf_input != NULL)
1520                         {
1521                         if (s->s3->client_opaque_prf_input != NULL &&
1522                                 s->s3->client_opaque_prf_input_len == s->tlsext_opaque_prf_input_len)
1523                                 {
1524                                 /* can only use this extension if we have a server opaque PRF input
1525                                  * of the same length as the client opaque PRF input! */
1526
1527                                 if (s->tlsext_opaque_prf_input_len == 0)
1528                                         s->s3->server_opaque_prf_input = OPENSSL_malloc(1); /* dummy byte just to get non-NULL */
1529                                 else
1530                                         s->s3->server_opaque_prf_input = BUF_memdup(s->tlsext_opaque_prf_input, s->tlsext_opaque_prf_input_len);
1531                                 if (s->s3->server_opaque_prf_input == NULL)
1532                                         {
1533                                         ret = SSL_TLSEXT_ERR_ALERT_FATAL;
1534                                         al = SSL_AD_INTERNAL_ERROR;
1535                                         goto err;
1536                                         }
1537                                 s->s3->server_opaque_prf_input_len = s->tlsext_opaque_prf_input_len;
1538                                 }
1539                         }
1540
1541                 if (r == 2 && s->s3->server_opaque_prf_input == NULL)
1542                         {
1543                         /* The callback wants to enforce use of the extension,
1544                          * but we can't do that with the client opaque PRF input;
1545                          * abort the handshake.
1546                          */
1547                         ret = SSL_TLSEXT_ERR_ALERT_FATAL;
1548                         al = SSL_AD_HANDSHAKE_FAILURE;
1549                         }
1550         }
1551
1552 #endif
1553  err:
1554         switch (ret)
1555                 {
1556                 case SSL_TLSEXT_ERR_ALERT_FATAL:
1557                         ssl3_send_alert(s,SSL3_AL_FATAL,al);
1558                         return -1;
1559
1560                 case SSL_TLSEXT_ERR_ALERT_WARNING:
1561                         ssl3_send_alert(s,SSL3_AL_WARNING,al);
1562                         return 1;
1563
1564                 case SSL_TLSEXT_ERR_NOACK:
1565                         s->servername_done=0;
1566                         default:
1567                 return 1;
1568                 }
1569         }
1570
1571 int ssl_check_serverhello_tlsext(SSL *s)
1572         {
1573         int ret=SSL_TLSEXT_ERR_NOACK;
1574         int al = SSL_AD_UNRECOGNIZED_NAME;
1575
1576 #ifndef OPENSSL_NO_EC
1577         /* If we are client and using an elliptic curve cryptography cipher
1578          * suite, then if server returns an EC point formats lists extension
1579          * it must contain uncompressed.
1580          */
1581         unsigned long alg_k = s->s3->tmp.new_cipher->algorithm_mkey;
1582         unsigned long alg_a = s->s3->tmp.new_cipher->algorithm_auth;
1583         if ((s->tlsext_ecpointformatlist != NULL) && (s->tlsext_ecpointformatlist_length > 0) &&
1584             (s->session->tlsext_ecpointformatlist != NULL) && (s->session->tlsext_ecpointformatlist_length > 0) &&
1585             ((alg_k & (SSL_kEECDH|SSL_kECDHr|SSL_kECDHe)) || (alg_a & SSL_aECDSA)))
1586                 {
1587                 /* we are using an ECC cipher */
1588                 size_t i;
1589                 unsigned char *list;
1590                 int found_uncompressed = 0;
1591                 list = s->session->tlsext_ecpointformatlist;
1592                 for (i = 0; i < s->session->tlsext_ecpointformatlist_length; i++)
1593                         {
1594                         if (*(list++) == TLSEXT_ECPOINTFORMAT_uncompressed)
1595                                 {
1596                                 found_uncompressed = 1;
1597                                 break;
1598                                 }
1599                         }
1600                 if (!found_uncompressed)
1601                         {
1602                         SSLerr(SSL_F_SSL_CHECK_SERVERHELLO_TLSEXT,SSL_R_TLS_INVALID_ECPOINTFORMAT_LIST);
1603                         return -1;
1604                         }
1605                 }
1606         ret = SSL_TLSEXT_ERR_OK;
1607 #endif /* OPENSSL_NO_EC */
1608
1609         if (s->ctx != NULL && s->ctx->tlsext_servername_callback != 0)
1610                 ret = s->ctx->tlsext_servername_callback(s, &al, s->ctx->tlsext_servername_arg);
1611         else if (s->initial_ctx != NULL && s->initial_ctx->tlsext_servername_callback != 0)
1612                 ret = s->initial_ctx->tlsext_servername_callback(s, &al, s->initial_ctx->tlsext_servername_arg);
1613
1614 #ifdef TLSEXT_TYPE_opaque_prf_input
1615         if (s->s3->server_opaque_prf_input_len > 0)
1616                 {
1617                 /* This case may indicate that we, as a client, want to insist on using opaque PRF inputs.
1618                  * So first verify that we really have a value from the server too. */
1619
1620                 if (s->s3->server_opaque_prf_input == NULL)
1621                         {
1622                         ret = SSL_TLSEXT_ERR_ALERT_FATAL;
1623                         al = SSL_AD_HANDSHAKE_FAILURE;
1624                         }
1625
1626                 /* Anytime the server *has* sent an opaque PRF input, we need to check
1627                  * that we have a client opaque PRF input of the same size. */
1628                 if (s->s3->client_opaque_prf_input == NULL ||
1629                     s->s3->client_opaque_prf_input_len != s->s3->server_opaque_prf_input_len)
1630                         {
1631                         ret = SSL_TLSEXT_ERR_ALERT_FATAL;
1632                         al = SSL_AD_ILLEGAL_PARAMETER;
1633                         }
1634                 }
1635 #endif
1636
1637         /* If we've requested certificate status and we wont get one
1638          * tell the callback
1639          */
1640         if ((s->tlsext_status_type != -1) && !(s->tlsext_status_expected)
1641                         && s->ctx && s->ctx->tlsext_status_cb)
1642                 {
1643                 int r;
1644                 /* Set resp to NULL, resplen to -1 so callback knows
1645                  * there is no response.
1646                  */
1647                 if (s->tlsext_ocsp_resp)
1648                         {
1649                         OPENSSL_free(s->tlsext_ocsp_resp);
1650                         s->tlsext_ocsp_resp = NULL;
1651                         }
1652                 s->tlsext_ocsp_resplen = -1;
1653                 r = s->ctx->tlsext_status_cb(s, s->ctx->tlsext_status_arg);
1654                 if (r == 0)
1655                         {
1656                         al = SSL_AD_BAD_CERTIFICATE_STATUS_RESPONSE;
1657                         ret = SSL_TLSEXT_ERR_ALERT_FATAL;
1658                         }
1659                 if (r < 0)
1660                         {
1661                         al = SSL_AD_INTERNAL_ERROR;
1662                         ret = SSL_TLSEXT_ERR_ALERT_FATAL;
1663                         }
1664                 }
1665
1666         switch (ret)
1667                 {
1668                 case SSL_TLSEXT_ERR_ALERT_FATAL:
1669                         ssl3_send_alert(s,SSL3_AL_FATAL,al);
1670                         return -1;
1671
1672                 case SSL_TLSEXT_ERR_ALERT_WARNING:
1673                         ssl3_send_alert(s,SSL3_AL_WARNING,al);
1674                         return 1;
1675
1676                 case SSL_TLSEXT_ERR_NOACK:
1677                         s->servername_done=0;
1678                         default:
1679                 return 1;
1680                 }
1681         }
1682
1683 /* Since the server cache lookup is done early on in the processing of client
1684  * hello and other operations depend on the result we need to handle any TLS
1685  * session ticket extension at the same time.
1686  */
1687
1688 int tls1_process_ticket(SSL *s, unsigned char *session_id, int len,
1689                                 const unsigned char *limit, SSL_SESSION **ret)
1690         {
1691         /* Point after session ID in client hello */
1692         const unsigned char *p = session_id + len;
1693         unsigned short i;
1694
1695         /* If tickets disabled behave as if no ticket present
1696          * to permit stateful resumption.
1697          */
1698         if (SSL_get_options(s) & SSL_OP_NO_TICKET)
1699                 return 1;
1700
1701         if ((s->version <= SSL3_VERSION) || !limit)
1702                 return 1;
1703         if (p >= limit)
1704                 return -1;
1705         /* Skip past DTLS cookie */
1706         if (s->version == DTLS1_VERSION || s->version == DTLS1_BAD_VER)
1707                 {
1708                 i = *(p++);
1709                 p+= i;
1710                 if (p >= limit)
1711                         return -1;
1712                 }
1713         /* Skip past cipher list */
1714         n2s(p, i);
1715         p+= i;
1716         if (p >= limit)
1717                 return -1;
1718         /* Skip past compression algorithm list */
1719         i = *(p++);
1720         p += i;
1721         if (p > limit)
1722                 return -1;
1723         /* Now at start of extensions */
1724         if ((p + 2) >= limit)
1725                 return 1;
1726         n2s(p, i);
1727         while ((p + 4) <= limit)
1728                 {
1729                 unsigned short type, size;
1730                 n2s(p, type);
1731                 n2s(p, size);
1732                 if (p + size > limit)
1733                         return 1;
1734                 if (type == TLSEXT_TYPE_session_ticket)
1735                         {
1736                         /* If tickets disabled indicate cache miss which will
1737                          * trigger a full handshake
1738                          */
1739                         if (SSL_get_options(s) & SSL_OP_NO_TICKET)
1740                                 return 1;
1741                         /* If zero length note client will accept a ticket
1742                          * and indicate cache miss to trigger full handshake
1743                          */
1744                         if (size == 0)
1745                                 {
1746                                 s->tlsext_ticket_expected = 1;
1747                                 return 0;       /* Cache miss */
1748                                 }
1749                         if (s->tls_session_secret_cb)
1750                                 {
1751                                 /* Indicate cache miss here and instead of
1752                                  * generating the session from ticket now,
1753                                  * trigger abbreviated handshake based on
1754                                  * external mechanism to calculate the master
1755                                  * secret later. */
1756                                 return 0;
1757                                 }
1758                         return tls_decrypt_ticket(s, p, size, session_id, len,
1759                                                                         ret);
1760                         }
1761                 p += size;
1762                 }
1763         return 1;
1764         }
1765
1766 static int tls_decrypt_ticket(SSL *s, const unsigned char *etick, int eticklen,
1767                                 const unsigned char *sess_id, int sesslen,
1768                                 SSL_SESSION **psess)
1769         {
1770         SSL_SESSION *sess;
1771         unsigned char *sdec;
1772         const unsigned char *p;
1773         int slen, mlen, renew_ticket = 0;
1774         unsigned char tick_hmac[EVP_MAX_MD_SIZE];
1775         HMAC_CTX hctx;
1776         EVP_CIPHER_CTX ctx;
1777         SSL_CTX *tctx = s->initial_ctx;
1778         /* Need at least keyname + iv + some encrypted data */
1779         if (eticklen < 48)
1780                 goto tickerr;
1781         /* Initialize session ticket encryption and HMAC contexts */
1782         HMAC_CTX_init(&hctx);
1783         EVP_CIPHER_CTX_init(&ctx);
1784         if (tctx->tlsext_ticket_key_cb)
1785                 {
1786                 unsigned char *nctick = (unsigned char *)etick;
1787                 int rv = tctx->tlsext_ticket_key_cb(s, nctick, nctick + 16,
1788                                                         &ctx, &hctx, 0);
1789                 if (rv < 0)
1790                         return -1;
1791                 if (rv == 0)
1792                         goto tickerr;
1793                 if (rv == 2)
1794                         renew_ticket = 1;
1795                 }
1796         else
1797                 {
1798                 /* Check key name matches */
1799                 if (memcmp(etick, tctx->tlsext_tick_key_name, 16))
1800                         goto tickerr;
1801                 HMAC_Init_ex(&hctx, tctx->tlsext_tick_hmac_key, 16,
1802                                         tlsext_tick_md(), NULL);
1803                 EVP_DecryptInit_ex(&ctx, EVP_aes_128_cbc(), NULL,
1804                                 tctx->tlsext_tick_aes_key, etick + 16);
1805                 }
1806         /* Attempt to process session ticket, first conduct sanity and
1807          * integrity checks on ticket.
1808          */
1809         mlen = HMAC_size(&hctx);
1810         if (mlen < 0)
1811                 {
1812                 EVP_CIPHER_CTX_cleanup(&ctx);
1813                 return -1;
1814                 }
1815         eticklen -= mlen;
1816         /* Check HMAC of encrypted ticket */
1817         HMAC_Update(&hctx, etick, eticklen);
1818         HMAC_Final(&hctx, tick_hmac, NULL);
1819         HMAC_CTX_cleanup(&hctx);
1820         if (memcmp(tick_hmac, etick + eticklen, mlen))
1821                 goto tickerr;
1822         /* Attempt to decrypt session data */
1823         /* Move p after IV to start of encrypted ticket, update length */
1824         p = etick + 16 + EVP_CIPHER_CTX_iv_length(&ctx);
1825         eticklen -= 16 + EVP_CIPHER_CTX_iv_length(&ctx);
1826         sdec = OPENSSL_malloc(eticklen);
1827         if (!sdec)
1828                 {
1829                 EVP_CIPHER_CTX_cleanup(&ctx);
1830                 return -1;
1831                 }
1832         EVP_DecryptUpdate(&ctx, sdec, &slen, p, eticklen);
1833         if (EVP_DecryptFinal(&ctx, sdec + slen, &mlen) <= 0)
1834                 goto tickerr;
1835         slen += mlen;
1836         EVP_CIPHER_CTX_cleanup(&ctx);
1837         p = sdec;
1838
1839         sess = d2i_SSL_SESSION(NULL, &p, slen);
1840         OPENSSL_free(sdec);
1841         if (sess)
1842                 {
1843                 /* The session ID if non-empty is used by some clients to
1844                  * detect that the ticket has been accepted. So we copy it to
1845                  * the session structure. If it is empty set length to zero
1846                  * as required by standard.
1847                  */
1848                 if (sesslen)
1849                         memcpy(sess->session_id, sess_id, sesslen);
1850                 sess->session_id_length = sesslen;
1851                 *psess = sess;
1852                 s->tlsext_ticket_expected = renew_ticket;
1853                 return 1;
1854                 }
1855         /* If session decrypt failure indicate a cache miss and set state to
1856          * send a new ticket
1857          */
1858         tickerr:
1859         s->tlsext_ticket_expected = 1;
1860         return 0;
1861         }
1862
1863 /* Tables to translate from NIDs to TLS v1.2 ids */
1864
1865 typedef struct
1866         {
1867         int nid;
1868         int id;
1869         } tls12_lookup;
1870
1871 static tls12_lookup tls12_md[] = {
1872 #ifndef OPENSSL_NO_MD5
1873         {NID_md5, TLSEXT_hash_md5},
1874 #endif
1875 #ifndef OPENSSL_NO_SHA
1876         {NID_sha1, TLSEXT_hash_sha1},
1877 #endif
1878 #ifndef OPENSSL_NO_SHA256
1879         {NID_sha224, TLSEXT_hash_sha224},
1880         {NID_sha256, TLSEXT_hash_sha256},
1881 #endif
1882 #ifndef OPENSSL_NO_SHA512
1883         {NID_sha384, TLSEXT_hash_sha384},
1884         {NID_sha512, TLSEXT_hash_sha512}
1885 #endif
1886 };
1887
1888 static tls12_lookup tls12_sig[] = {
1889 #ifndef OPENSSL_NO_RSA
1890         {EVP_PKEY_RSA, TLSEXT_signature_rsa},
1891 #endif
1892 #ifndef OPENSSL_NO_RSA
1893         {EVP_PKEY_DSA, TLSEXT_signature_dsa},
1894 #endif
1895 #ifndef OPENSSL_NO_ECDSA
1896         {EVP_PKEY_EC, TLSEXT_signature_ecdsa}
1897 #endif
1898 };
1899
1900 static int tls12_find_id(int nid, tls12_lookup *table, size_t tlen)
1901         {
1902         size_t i;
1903         for (i = 0; i < tlen; i++)
1904                 {
1905                 if (table[i].nid == nid)
1906                         return table[i].id;
1907                 }
1908         return -1;
1909         }
1910 #if 0
1911 static int tls12_find_nid(int id, tls12_lookup *table, size_t tlen)
1912         {
1913         size_t i;
1914         for (i = 0; i < tlen; i++)
1915                 {
1916                 if (table[i].id == id)
1917                         return table[i].nid;
1918                 }
1919         return -1;
1920         }
1921 #endif
1922
1923 int tls12_get_sigandhash(unsigned char *p, const EVP_PKEY *pk, const EVP_MD *md)
1924         {
1925         int sig_id, md_id;
1926         md_id = tls12_find_id(EVP_MD_type(md), tls12_md,
1927                                 sizeof(tls12_md)/sizeof(tls12_lookup));
1928         if (md_id == -1)
1929                 return 0;
1930         sig_id = tls12_get_sigid(pk);
1931         if (sig_id == -1)
1932                 return 0;
1933         p[0] = (unsigned char)md_id;
1934         p[1] = (unsigned char)sig_id;
1935         return 1;
1936         }
1937
1938 int tls12_get_sigid(const EVP_PKEY *pk)
1939         {
1940         return tls12_find_id(pk->type, tls12_sig,
1941                                 sizeof(tls12_sig)/sizeof(tls12_lookup));
1942         }
1943
1944 const EVP_MD *tls12_get_hash(unsigned char hash_alg)
1945         {
1946         switch(hash_alg)
1947                 {
1948 #ifndef OPENSSL_NO_MD5
1949                 case TLSEXT_hash_md5:
1950                 return EVP_md5();
1951 #endif
1952 #ifndef OPENSSL_NO_SHA
1953                 case TLSEXT_hash_sha1:
1954                 return EVP_sha1();
1955 #endif
1956 #ifndef OPENSSL_NO_SHA256
1957                 case TLSEXT_hash_sha224:
1958                 return EVP_sha224();
1959
1960                 case TLSEXT_hash_sha256:
1961                 return EVP_sha256();
1962 #endif
1963 #ifndef OPENSSL_NO_SHA512
1964                 case TLSEXT_hash_sha384:
1965                 return EVP_sha384();
1966
1967                 case TLSEXT_hash_sha512:
1968                 return EVP_sha512();
1969 #endif
1970                 default:
1971                 return NULL;
1972
1973                 }
1974         }
1975
1976 /* Set preferred digest for each key type */
1977
1978 int tls1_process_sigalgs(SSL *s, const unsigned char *data, int dsize)
1979         {
1980         int i, idx;
1981         const EVP_MD *md;
1982         CERT *c = s->cert;
1983         /* Extension ignored for TLS versions below 1.2 */
1984         if (s->version < TLS1_2_VERSION)
1985                 return 1;
1986         /* Should never happen */
1987         if (!c)
1988                 return 0;
1989
1990         c->pkeys[SSL_PKEY_DSA_SIGN].digest = NULL;
1991         c->pkeys[SSL_PKEY_RSA_SIGN].digest = NULL;
1992         c->pkeys[SSL_PKEY_RSA_ENC].digest = NULL;
1993         c->pkeys[SSL_PKEY_ECC].digest = NULL;
1994
1995         for (i = 0; i < dsize; i += 2)
1996                 {
1997                 unsigned char hash_alg = data[i], sig_alg = data[i+1];
1998
1999                 switch(sig_alg)
2000                         {
2001 #ifndef OPENSSL_NO_RSA
2002                         case TLSEXT_signature_rsa:
2003                         idx = SSL_PKEY_RSA_SIGN;
2004                         break;
2005 #endif
2006 #ifndef OPENSSL_NO_DSA
2007                         case TLSEXT_signature_dsa:
2008                         idx = SSL_PKEY_DSA_SIGN;
2009                         break;
2010 #endif
2011 #ifndef OPENSSL_NO_ECDSA
2012                         case TLSEXT_signature_ecdsa:
2013                         idx = SSL_PKEY_ECC;
2014                         break;
2015 #endif
2016                         default:
2017                         continue;
2018                         }
2019
2020                 if (c->pkeys[idx].digest == NULL)
2021                         {
2022                         md = tls12_get_hash(hash_alg);
2023                         if (md)
2024                                 {
2025                                 c->pkeys[idx].digest = md;
2026                                 if (idx == SSL_PKEY_RSA_SIGN)
2027                                         c->pkeys[SSL_PKEY_RSA_ENC].digest = md;
2028                                 }
2029                         }
2030
2031                 }
2032
2033
2034         /* Set any remaining keys to default values. NOTE: if alg is not
2035          * supported it stays as NULL.
2036          */
2037 #ifndef OPENSSL_NO_DSA
2038         if (!c->pkeys[SSL_PKEY_DSA_SIGN].digest)
2039                 c->pkeys[SSL_PKEY_DSA_SIGN].digest = EVP_dss1();
2040 #endif
2041 #ifndef OPENSSL_NO_RSA
2042         if (!c->pkeys[SSL_PKEY_RSA_SIGN].digest)
2043                 {
2044                 c->pkeys[SSL_PKEY_RSA_SIGN].digest = EVP_sha1();
2045                 c->pkeys[SSL_PKEY_RSA_ENC].digest = EVP_sha1();
2046                 }
2047 #endif
2048 #ifndef OPENSSL_NO_ECDSA
2049         if (!c->pkeys[SSL_PKEY_ECC].digest)
2050                 c->pkeys[SSL_PKEY_ECC].digest = EVP_ecdsa();
2051 #endif
2052         return 1;
2053         }
2054
2055 #endif