ssl/t1_lib.c

   1 /* ssl/t1_lib.c */
   2 /* Copyright (C) 1995-1998 Eric Young (eay@cryptsoft.com)
   3  * All rights reserved.
   4  *
   5  * This package is an SSL implementation written
   6  * by Eric Young (eay@cryptsoft.com).
   7  * The implementation was written so as to conform with Netscapes SSL.
   8  *
   9  * This library is free for commercial and non-commercial use as long as
  10  * the following conditions are aheared to.  The following conditions
  11  * apply to all code found in this distribution, be it the RC4, RSA,
  12  * lhash, DES, etc., code; not just the SSL code.  The SSL documentation
  13  * included with this distribution is covered by the same copyright terms
  14  * except that the holder is Tim Hudson (tjh@cryptsoft.com).
  15  *
  16  * Copyright remains Eric Young's, and as such any Copyright notices in
  17  * the code are not to be removed.
  18  * If this package is used in a product, Eric Young should be given attribution
  19  * as the author of the parts of the library used.
  20  * This can be in the form of a textual message at program startup or
  21  * in documentation (online or textual) provided with the package.
  22  *
  23  * Redistribution and use in source and binary forms, with or without
  24  * modification, are permitted provided that the following conditions
  25  * are met:
  26  * 1. Redistributions of source code must retain the copyright
  27  *    notice, this list of conditions and the following disclaimer.
  28  * 2. Redistributions in binary form must reproduce the above copyright
  29  *    notice, this list of conditions and the following disclaimer in the
  30  *    documentation and/or other materials provided with the distribution.
  31  * 3. All advertising materials mentioning features or use of this software
  32  *    must display the following acknowledgement:
  33  *    "This product includes cryptographic software written by
  34  *     Eric Young (eay@cryptsoft.com)"
  35  *    The word 'cryptographic' can be left out if the rouines from the library
  36  *    being used are not cryptographic related :-).
  37  * 4. If you include any Windows specific code (or a derivative thereof) from
  38  *    the apps directory (application code) you must include an acknowledgement:
  39  *    "This product includes software written by Tim Hudson (tjh@cryptsoft.com)"
  40  *
  41  * THIS SOFTWARE IS PROVIDED BY ERIC YOUNG ``AS IS'' AND
  42  * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
  43  * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
  44  * ARE DISCLAIMED.  IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE
  45  * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
  46  * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
  47  * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
  48  * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
  49  * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
  50  * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
  51  * SUCH DAMAGE.
  52  *
  53  * The licence and distribution terms for any publically available version or
  54  * derivative of this code cannot be changed.  i.e. this code cannot simply be
  55  * copied and put under another distribution licence
  56  * [including the GNU Public Licence.]
  57  */
  58 /* ====================================================================
  59  * Copyright (c) 1998-2007 The OpenSSL Project.  All rights reserved.
  60  *
  61  * Redistribution and use in source and binary forms, with or without
  62  * modification, are permitted provided that the following conditions
  63  * are met:
  64  *
  65  * 1. Redistributions of source code must retain the above copyright
  66  *    notice, this list of conditions and the following disclaimer.
  67  *
  68  * 2. Redistributions in binary form must reproduce the above copyright
  69  *    notice, this list of conditions and the following disclaimer in
  70  *    the documentation and/or other materials provided with the
  71  *    distribution.
  72  *
  73  * 3. All advertising materials mentioning features or use of this
  74  *    software must display the following acknowledgment:
  75  *    "This product includes software developed by the OpenSSL Project
  76  *    for use in the OpenSSL Toolkit. (http://www.openssl.org/)"
  77  *
  78  * 4. The names "OpenSSL Toolkit" and "OpenSSL Project" must not be used to
  79  *    endorse or promote products derived from this software without
  80  *    prior written permission. For written permission, please contact
  81  *    openssl-core@openssl.org.
  82  *
  83  * 5. Products derived from this software may not be called "OpenSSL"
  84  *    nor may "OpenSSL" appear in their names without prior written
  85  *    permission of the OpenSSL Project.
  86  *
  87  * 6. Redistributions of any form whatsoever must retain the following
  88  *    acknowledgment:
  89  *    "This product includes software developed by the OpenSSL Project
  90  *    for use in the OpenSSL Toolkit (http://www.openssl.org/)"
  91  *
  92  * THIS SOFTWARE IS PROVIDED BY THE OpenSSL PROJECT ``AS IS'' AND ANY
  93  * EXPRESSED OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
  94  * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
  95  * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL THE OpenSSL PROJECT OR
  96  * ITS CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
  97  * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
  98  * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
  99  * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
 100  * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT,
 101  * STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
 102  * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED
 103  * OF THE POSSIBILITY OF SUCH DAMAGE.
 104  * ====================================================================
 105  *
 106  * This product includes cryptographic software written by Eric Young
 107  * (eay@cryptsoft.com).  This product includes software written by Tim
 108  * Hudson (tjh@cryptsoft.com).
 109  *
 110  */
 111
 112 #include <stdio.h>
 113 #include <openssl/objects.h>
 114 #include <openssl/evp.h>
 115 #include <openssl/hmac.h>
 116 #include <openssl/ocsp.h>
 117 #include "ssl_locl.h"
 118
 119 const char tls1_version_str[]="TLSv1" OPENSSL_VERSION_PTEXT;
 120
 121 #ifndef OPENSSL_NO_TLSEXT
 122 static int tls_decrypt_ticket(SSL *s, const unsigned char *tick, int ticklen,
 123                                 const unsigned char *sess_id, int sesslen,
 124                                 SSL_SESSION **psess);
 125 #endif
 126
 127 SSL3_ENC_METHOD TLSv1_enc_data={
 128         tls1_enc,
 129         tls1_mac,
 130         tls1_setup_key_block,
 131         tls1_generate_master_secret,
 132         tls1_change_cipher_state,
 133         tls1_final_finish_mac,
 134         TLS1_FINISH_MAC_LENGTH,
 135         tls1_cert_verify_mac,
 136         TLS_MD_CLIENT_FINISH_CONST,TLS_MD_CLIENT_FINISH_CONST_SIZE,
 137         TLS_MD_SERVER_FINISH_CONST,TLS_MD_SERVER_FINISH_CONST_SIZE,
 138         tls1_alert_code,
 139         };
 140
 141 long tls1_default_timeout(void)
 142         {
 143         /* 2 hours, the 24 hours mentioned in the TLSv1 spec
 144          * is way too long for http, the cache would over fill */
 145         return(60*60*2);
 146         }
 147
 148 int tls1_new(SSL *s)
 149         {
 150         if (!ssl3_new(s)) return(0);
 151         s->method->ssl_clear(s);
 152         return(1);
 153         }
 154
 155 void tls1_free(SSL *s)
 156         {
 157 #ifndef OPENSSL_NO_TLSEXT
 158         if (s->tlsext_session_ticket)
 159                 {
 160                 OPENSSL_free(s->tlsext_session_ticket);
 161                 }
 162 #endif /* OPENSSL_NO_TLSEXT */
 163         ssl3_free(s);
 164         }
 165
 166 void tls1_clear(SSL *s)
 167         {
 168         ssl3_clear(s);
 169         s->version = s->method->version;
 170         }
 171
 172 #ifndef OPENSSL_NO_EC
 173 static int nid_list[] =
 174         {
 175                 NID_sect163k1, /* sect163k1 (1) */
 176                 NID_sect163r1, /* sect163r1 (2) */
 177                 NID_sect163r2, /* sect163r2 (3) */
 178                 NID_sect193r1, /* sect193r1 (4) */
 179                 NID_sect193r2, /* sect193r2 (5) */
 180                 NID_sect233k1, /* sect233k1 (6) */
 181                 NID_sect233r1, /* sect233r1 (7) */
 182                 NID_sect239k1, /* sect239k1 (8) */
 183                 NID_sect283k1, /* sect283k1 (9) */
 184                 NID_sect283r1, /* sect283r1 (10) */
 185                 NID_sect409k1, /* sect409k1 (11) */
 186                 NID_sect409r1, /* sect409r1 (12) */
 187                 NID_sect571k1, /* sect571k1 (13) */
 188                 NID_sect571r1, /* sect571r1 (14) */
 189                 NID_secp160k1, /* secp160k1 (15) */
 190                 NID_secp160r1, /* secp160r1 (16) */
 191                 NID_secp160r2, /* secp160r2 (17) */
 192                 NID_secp192k1, /* secp192k1 (18) */
 193                 NID_X9_62_prime192v1, /* secp192r1 (19) */
 194                 NID_secp224k1, /* secp224k1 (20) */
 195                 NID_secp224r1, /* secp224r1 (21) */
 196                 NID_secp256k1, /* secp256k1 (22) */
 197                 NID_X9_62_prime256v1, /* secp256r1 (23) */
 198                 NID_secp384r1, /* secp384r1 (24) */
 199                 NID_secp521r1  /* secp521r1 (25) */
 200         };
 201
 202 int tls1_ec_curve_id2nid(int curve_id)
 203         {
 204         /* ECC curves from draft-ietf-tls-ecc-12.txt (Oct. 17, 2005) */
 205         if ((curve_id < 1) || ((unsigned int)curve_id >
 206                                 sizeof(nid_list)/sizeof(nid_list[0])))
 207                 return 0;
 208         return nid_list[curve_id-1];
 209         }
 210
 211 int tls1_ec_nid2curve_id(int nid)
 212         {
 213         /* ECC curves from draft-ietf-tls-ecc-12.txt (Oct. 17, 2005) */
 214         switch (nid)
 215                 {
 216         case NID_sect163k1: /* sect163k1 (1) */
 217                 return 1;
 218         case NID_sect163r1: /* sect163r1 (2) */
 219                 return 2;
 220         case NID_sect163r2: /* sect163r2 (3) */
 221                 return 3;
 222         case NID_sect193r1: /* sect193r1 (4) */
 223                 return 4;
 224         case NID_sect193r2: /* sect193r2 (5) */
 225                 return 5;
 226         case NID_sect233k1: /* sect233k1 (6) */
 227                 return 6;
 228         case NID_sect233r1: /* sect233r1 (7) */
 229                 return 7;
 230         case NID_sect239k1: /* sect239k1 (8) */
 231                 return 8;
 232         case NID_sect283k1: /* sect283k1 (9) */
 233                 return 9;
 234         case NID_sect283r1: /* sect283r1 (10) */
 235                 return 10;
 236         case NID_sect409k1: /* sect409k1 (11) */
 237                 return 11;
 238         case NID_sect409r1: /* sect409r1 (12) */
 239                 return 12;
 240         case NID_sect571k1: /* sect571k1 (13) */
 241                 return 13;
 242         case NID_sect571r1: /* sect571r1 (14) */
 243                 return 14;
 244         case NID_secp160k1: /* secp160k1 (15) */
 245                 return 15;
 246         case NID_secp160r1: /* secp160r1 (16) */
 247                 return 16;
 248         case NID_secp160r2: /* secp160r2 (17) */
 249                 return 17;
 250         case NID_secp192k1: /* secp192k1 (18) */
 251                 return 18;
 252         case NID_X9_62_prime192v1: /* secp192r1 (19) */
 253                 return 19;
 254         case NID_secp224k1: /* secp224k1 (20) */
 255                 return 20;
 256         case NID_secp224r1: /* secp224r1 (21) */
 257                 return 21;
 258         case NID_secp256k1: /* secp256k1 (22) */
 259                 return 22;
 260         case NID_X9_62_prime256v1: /* secp256r1 (23) */
 261                 return 23;
 262         case NID_secp384r1: /* secp384r1 (24) */
 263                 return 24;
 264         case NID_secp521r1:  /* secp521r1 (25) */
 265                 return 25;
 266         default:
 267                 return 0;
 268                 }
 269         }
 270 #endif /* OPENSSL_NO_EC */
 271
 272 #ifndef OPENSSL_NO_TLSEXT
 273
 274 /* List of supported signature algorithms and hashes. Should make this
 275  * customisable at some point, for now include everything we support.
 276  */
 277
 278 #ifdef OPENSSL_NO_RSA
 279 #define tlsext_sigalg_rsa(md) /* */
 280 #else
 281 #define tlsext_sigalg_rsa(md) md, TLSEXT_signature_rsa,
 282 #endif
 283
 284 #ifdef OPENSSL_NO_DSA
 285 #define tlsext_sigalg_dsa(md) /* */
 286 #else
 287 #define tlsext_sigalg_dsa(md) md, TLSEXT_signature_dsa,
 288 #endif
 289
 290 #ifdef OPENSSL_NO_ECDSA
 291 #define tlsext_sigalg_ecdsa(md) /* */
 292 #else
 293 #define tlsext_sigalg_ecdsa(md) md, TLSEXT_signature_dsa,
 294 #endif
 295
 296 #define tlsext_sigalg(md) \
 297                 tlsext_sigalg_rsa(md) \
 298                 tlsext_sigalg_dsa(md) \
 299                 tlsext_sigalg_ecdsa(md)
 300
 301 static unsigned char tls12_sigalgs[] = {
 302 #ifndef OPENSSL_NO_SHA512
 303         tlsext_sigalg(TLSEXT_hash_sha512)
 304         tlsext_sigalg(TLSEXT_hash_sha384)
 305 #endif
 306 #ifndef OPENSSL_NO_SHA256
 307         tlsext_sigalg(TLSEXT_hash_sha256)
 308         tlsext_sigalg(TLSEXT_hash_sha224)
 309 #endif
 310 #ifndef OPENSSL_NO_SHA
 311         tlsext_sigalg(TLSEXT_hash_sha1)
 312 #endif
 313 #ifndef OPENSSL_NO_MD5
 314         tlsext_sigalg_rsa(TLSEXT_hash_md5)
 315 #endif
 316 };
 317
 318
 319
 320 unsigned char *ssl_add_clienthello_tlsext(SSL *s, unsigned char *p, unsigned char *limit)
 321         {
 322         int extdatalen=0;
 323         unsigned char *ret = p;
 324
 325         /* don't add extensions for SSLv3 unless doing secure renegotiation */
 326         if (s->client_version == SSL3_VERSION
 327                                         && !s->s3->send_connection_binding)
 328                 return p;
 329
 330         ret+=2;
 331
 332         if (ret>=limit) return NULL; /* this really never occurs, but ... */
 333
 334         if (s->tlsext_hostname != NULL)
 335                 {
 336                 /* Add TLS extension servername to the Client Hello message */
 337                 unsigned long size_str;
 338                 long lenmax;
 339
 340                 /* check for enough space.
 341                    4 for the servername type and entension length
 342                    2 for servernamelist length
 343                    1 for the hostname type
 344                    2 for hostname length
 345                    + hostname length
 346                 */
 347
 348                 if ((lenmax = limit - ret - 9) < 0
 349                     || (size_str = strlen(s->tlsext_hostname)) > (unsigned long)lenmax)
 350                         return NULL;
 351
 352                 /* extension type and length */
 353                 s2n(TLSEXT_TYPE_server_name,ret);
 354                 s2n(size_str+5,ret);
 355
 356                 /* length of servername list */
 357                 s2n(size_str+3,ret);
 358
 359                 /* hostname type, length and hostname */
 360                 *(ret++) = (unsigned char) TLSEXT_NAMETYPE_host_name;
 361                 s2n(size_str,ret);
 362                 memcpy(ret, s->tlsext_hostname, size_str);
 363                 ret+=size_str;
 364                 }
 365
 366         /* Add RI if renegotiating */
 367         if (s->renegotiate)
 368           {
 369           int el;
 370
 371           if(!ssl_add_clienthello_renegotiate_ext(s, 0, &el, 0))
 372               {
 373               SSLerr(SSL_F_SSL_ADD_CLIENTHELLO_TLSEXT, ERR_R_INTERNAL_ERROR);
 374               return NULL;
 375               }
 376
 377           if((limit - p - 4 - el) < 0) return NULL;
 378
 379           s2n(TLSEXT_TYPE_renegotiate,ret);
 380           s2n(el,ret);
 381
 382           if(!ssl_add_clienthello_renegotiate_ext(s, ret, &el, el))
 383               {
 384               SSLerr(SSL_F_SSL_ADD_CLIENTHELLO_TLSEXT, ERR_R_INTERNAL_ERROR);
 385               return NULL;
 386               }
 387
 388           ret += el;
 389         }
 390
 391 #ifndef OPENSSL_NO_SRP
 392 #define MIN(x,y) (((x)<(y))?(x):(y))
 393         /* we add SRP username the first time only if we have one! */
 394         if (s->srp_ctx.login != NULL)
 395                 {/* Add TLS extension SRP username to the Client Hello message */
 396                 int login_len = MIN(strlen(s->srp_ctx.login) + 1, 255);
 397                 long lenmax;
 398
 399                 if ((lenmax = limit - ret - 5) < 0) return NULL;
 400                 if (login_len > lenmax) return NULL;
 401                 if (login_len > 255)
 402                         {
 403                         SSLerr(SSL_F_SSL_ADD_CLIENTHELLO_TLSEXT, ERR_R_INTERNAL_ERROR);
 404                         return NULL;
 405                         }
 406                 s2n(TLSEXT_TYPE_srp,ret);
 407                 s2n(login_len+1,ret);
 408
 409                 (*ret++) = (unsigned char) MIN(strlen(s->srp_ctx.login), 254);
 410                 memcpy(ret, s->srp_ctx.login, MIN(strlen(s->srp_ctx.login), 254));
 411                 ret+=login_len;
 412                 }
 413 #endif
 414
 415 #ifndef OPENSSL_NO_EC
 416         if (s->tlsext_ecpointformatlist != NULL &&
 417             s->version != DTLS1_VERSION)
 418                 {
 419                 /* Add TLS extension ECPointFormats to the ClientHello message */
 420                 long lenmax;
 421
 422                 if ((lenmax = limit - ret - 5) < 0) return NULL;
 423                 if (s->tlsext_ecpointformatlist_length > (unsigned long)lenmax) return NULL;
 424                 if (s->tlsext_ecpointformatlist_length > 255)
 425                         {
 426                         SSLerr(SSL_F_SSL_ADD_CLIENTHELLO_TLSEXT, ERR_R_INTERNAL_ERROR);
 427                         return NULL;
 428                         }
 429
 430                 s2n(TLSEXT_TYPE_ec_point_formats,ret);
 431                 s2n(s->tlsext_ecpointformatlist_length + 1,ret);
 432                 *(ret++) = (unsigned char) s->tlsext_ecpointformatlist_length;
 433                 memcpy(ret, s->tlsext_ecpointformatlist, s->tlsext_ecpointformatlist_length);
 434                 ret+=s->tlsext_ecpointformatlist_length;
 435                 }
 436         if (s->tlsext_ellipticcurvelist != NULL &&
 437             s->version != DTLS1_VERSION)
 438                 {
 439                 /* Add TLS extension EllipticCurves to the ClientHello message */
 440                 long lenmax;
 441
 442                 if ((lenmax = limit - ret - 6) < 0) return NULL;
 443                 if (s->tlsext_ellipticcurvelist_length > (unsigned long)lenmax) return NULL;
 444                 if (s->tlsext_ellipticcurvelist_length > 65532)
 445                         {
 446                         SSLerr(SSL_F_SSL_ADD_CLIENTHELLO_TLSEXT, ERR_R_INTERNAL_ERROR);
 447                         return NULL;
 448                         }
 449
 450                 s2n(TLSEXT_TYPE_elliptic_curves,ret);
 451                 s2n(s->tlsext_ellipticcurvelist_length + 2, ret);
 452
 453                 /* NB: draft-ietf-tls-ecc-12.txt uses a one-byte prefix for
 454                  * elliptic_curve_list, but the examples use two bytes.
 455                  * http://www1.ietf.org/mail-archive/web/tls/current/msg00538.html
 456                  * resolves this to two bytes.
 457                  */
 458                 s2n(s->tlsext_ellipticcurvelist_length, ret);
 459                 memcpy(ret, s->tlsext_ellipticcurvelist, s->tlsext_ellipticcurvelist_length);
 460                 ret+=s->tlsext_ellipticcurvelist_length;
 461                 }
 462 #endif /* OPENSSL_NO_EC */
 463
 464         if (!(SSL_get_options(s) & SSL_OP_NO_TICKET))
 465                 {
 466                 int ticklen;
 467                 if (!s->new_session && s->session && s->session->tlsext_tick)
 468                         ticklen = s->session->tlsext_ticklen;
 469                 else if (s->session && s->tlsext_session_ticket &&
 470                          s->tlsext_session_ticket->data)
 471                         {
 472                         ticklen = s->tlsext_session_ticket->length;
 473                         s->session->tlsext_tick = OPENSSL_malloc(ticklen);
 474                         if (!s->session->tlsext_tick)
 475                                 return NULL;
 476                         memcpy(s->session->tlsext_tick,
 477                                s->tlsext_session_ticket->data,
 478                                ticklen);
 479                         s->session->tlsext_ticklen = ticklen;
 480                         }
 481                 else
 482                         ticklen = 0;
 483                 if (ticklen == 0 && s->tlsext_session_ticket &&
 484                     s->tlsext_session_ticket->data == NULL)
 485                         goto skip_ext;
 486                 /* Check for enough room 2 for extension type, 2 for len
 487                  * rest for ticket
 488                  */
 489                 if ((long)(limit - ret - 4 - ticklen) < 0) return NULL;
 490                 s2n(TLSEXT_TYPE_session_ticket,ret);
 491                 s2n(ticklen,ret);
 492                 if (ticklen)
 493                         {
 494                         memcpy(ret, s->session->tlsext_tick, ticklen);
 495                         ret += ticklen;
 496                         }
 497                 }
 498                 skip_ext:
 499
 500         if (s->version >= TLS1_2_VERSION)
 501                 {
 502                 if ((size_t)(limit - ret) < sizeof(tls12_sigalgs) + 6)
 503                         return NULL;
 504                 s2n(TLSEXT_TYPE_signature_algorithms,ret);
 505                 s2n(sizeof(tls12_sigalgs) + 2, ret);
 506                 s2n(sizeof(tls12_sigalgs), ret);
 507                 memcpy(ret, tls12_sigalgs, sizeof(tls12_sigalgs));
 508                 ret += sizeof(tls12_sigalgs);
 509                 }
 510
 511 #ifdef TLSEXT_TYPE_opaque_prf_input
 512         if (s->s3->client_opaque_prf_input != NULL &&
 513             s->version != DTLS1_VERSION)
 514                 {
 515                 size_t col = s->s3->client_opaque_prf_input_len;
 516
 517                 if ((long)(limit - ret - 6 - col < 0))
 518                         return NULL;
 519                 if (col > 0xFFFD) /* can't happen */
 520                         return NULL;
 521
 522                 s2n(TLSEXT_TYPE_opaque_prf_input, ret);
 523                 s2n(col + 2, ret);
 524                 s2n(col, ret);
 525                 memcpy(ret, s->s3->client_opaque_prf_input, col);
 526                 ret += col;
 527                 }
 528 #endif
 529
 530         if (s->tlsext_status_type == TLSEXT_STATUSTYPE_ocsp &&
 531             s->version != DTLS1_VERSION)
 532                 {
 533                 int i;
 534                 long extlen, idlen, itmp;
 535                 OCSP_RESPID *id;
 536
 537                 idlen = 0;
 538                 for (i = 0; i < sk_OCSP_RESPID_num(s->tlsext_ocsp_ids); i++)
 539                         {
 540                         id = sk_OCSP_RESPID_value(s->tlsext_ocsp_ids, i);
 541                         itmp = i2d_OCSP_RESPID(id, NULL);
 542                         if (itmp <= 0)
 543                                 return NULL;
 544                         idlen += itmp + 2;
 545                         }
 546
 547                 if (s->tlsext_ocsp_exts)
 548                         {
 549                         extlen = i2d_X509_EXTENSIONS(s->tlsext_ocsp_exts, NULL);
 550                         if (extlen < 0)
 551                                 return NULL;
 552                         }
 553                 else
 554                         extlen = 0;
 555
 556                 if ((long)(limit - ret - 7 - extlen - idlen) < 0) return NULL;
 557                 s2n(TLSEXT_TYPE_status_request, ret);
 558                 if (extlen + idlen > 0xFFF0)
 559                         return NULL;
 560                 s2n(extlen + idlen + 5, ret);
 561                 *(ret++) = TLSEXT_STATUSTYPE_ocsp;
 562                 s2n(idlen, ret);
 563                 for (i = 0; i < sk_OCSP_RESPID_num(s->tlsext_ocsp_ids); i++)
 564                         {
 565                         /* save position of id len */
 566                         unsigned char *q = ret;
 567                         id = sk_OCSP_RESPID_value(s->tlsext_ocsp_ids, i);
 568                         /* skip over id len */
 569                         ret += 2;
 570                         itmp = i2d_OCSP_RESPID(id, &ret);
 571                         /* write id len */
 572                         s2n(itmp, q);
 573                         }
 574                 s2n(extlen, ret);
 575                 if (extlen > 0)
 576                         i2d_X509_EXTENSIONS(s->tlsext_ocsp_exts, &ret);
 577                 }
 578
 579 #ifndef OPENSSL_NO_NEXTPROTONEG
 580         if (s->ctx->next_proto_select_cb && !s->s3->tmp.finish_md_len)
 581                 {
 582                 /* The client advertises an emtpy extension to indicate its
 583                  * support for Next Protocol Negotiation */
 584                 if (limit - ret - 4 < 0)
 585                         return NULL;
 586                 s2n(TLSEXT_TYPE_next_proto_neg,ret);
 587                 s2n(0,ret);
 588                 }
 589 #endif
 590
 591         if ((extdatalen = ret-p-2)== 0)
 592                 return p;
 593
 594         s2n(extdatalen,p);
 595         return ret;
 596         }
 597
 598 unsigned char *ssl_add_serverhello_tlsext(SSL *s, unsigned char *p, unsigned char *limit)
 599         {
 600         int extdatalen=0;
 601         unsigned char *ret = p;
 602 #ifndef OPENSSL_NO_NEXTPROTONEG
 603         int next_proto_neg_seen;
 604 #endif
 605
 606         /* don't add extensions for SSLv3, unless doing secure renegotiation */
 607         if (s->version == SSL3_VERSION && !s->s3->send_connection_binding)
 608                 return p;
 609
 610         ret+=2;
 611         if (ret>=limit) return NULL; /* this really never occurs, but ... */
 612
 613         if (!s->hit && s->servername_done == 1 && s->session->tlsext_hostname != NULL)
 614                 {
 615                 if ((long)(limit - ret - 4) < 0) return NULL;
 616
 617                 s2n(TLSEXT_TYPE_server_name,ret);
 618                 s2n(0,ret);
 619                 }
 620
 621         if(s->s3->send_connection_binding)
 622         {
 623           int el;
 624
 625           if(!ssl_add_serverhello_renegotiate_ext(s, 0, &el, 0))
 626               {
 627               SSLerr(SSL_F_SSL_ADD_SERVERHELLO_TLSEXT, ERR_R_INTERNAL_ERROR);
 628               return NULL;
 629               }
 630
 631           if((limit - p - 4 - el) < 0) return NULL;
 632
 633           s2n(TLSEXT_TYPE_renegotiate,ret);
 634           s2n(el,ret);
 635
 636           if(!ssl_add_serverhello_renegotiate_ext(s, ret, &el, el))
 637               {
 638               SSLerr(SSL_F_SSL_ADD_SERVERHELLO_TLSEXT, ERR_R_INTERNAL_ERROR);
 639               return NULL;
 640               }
 641
 642           ret += el;
 643         }
 644
 645 #ifndef OPENSSL_NO_EC
 646         if (s->tlsext_ecpointformatlist != NULL &&
 647             s->version != DTLS1_VERSION)
 648                 {
 649                 /* Add TLS extension ECPointFormats to the ServerHello message */
 650                 long lenmax;
 651
 652                 if ((lenmax = limit - ret - 5) < 0) return NULL;
 653                 if (s->tlsext_ecpointformatlist_length > (unsigned long)lenmax) return NULL;
 654                 if (s->tlsext_ecpointformatlist_length > 255)
 655                         {
 656                         SSLerr(SSL_F_SSL_ADD_SERVERHELLO_TLSEXT, ERR_R_INTERNAL_ERROR);
 657                         return NULL;
 658                         }
 659
 660                 s2n(TLSEXT_TYPE_ec_point_formats,ret);
 661                 s2n(s->tlsext_ecpointformatlist_length + 1,ret);
 662                 *(ret++) = (unsigned char) s->tlsext_ecpointformatlist_length;
 663                 memcpy(ret, s->tlsext_ecpointformatlist, s->tlsext_ecpointformatlist_length);
 664                 ret+=s->tlsext_ecpointformatlist_length;
 665
 666                 }
 667         /* Currently the server should not respond with a SupportedCurves extension */
 668 #endif /* OPENSSL_NO_EC */
 669
 670         if (s->tlsext_ticket_expected
 671                 && !(SSL_get_options(s) & SSL_OP_NO_TICKET))
 672                 {
 673                 if ((long)(limit - ret - 4) < 0) return NULL;
 674                 s2n(TLSEXT_TYPE_session_ticket,ret);
 675                 s2n(0,ret);
 676                 }
 677
 678         if (s->tlsext_status_expected)
 679                 {
 680                 if ((long)(limit - ret - 4) < 0) return NULL;
 681                 s2n(TLSEXT_TYPE_status_request,ret);
 682                 s2n(0,ret);
 683                 }
 684
 685 #ifdef TLSEXT_TYPE_opaque_prf_input
 686         if (s->s3->server_opaque_prf_input != NULL &&
 687             s->version != DTLS1_VERSION)
 688                 {
 689                 size_t sol = s->s3->server_opaque_prf_input_len;
 690
 691                 if ((long)(limit - ret - 6 - sol) < 0)
 692                         return NULL;
 693                 if (sol > 0xFFFD) /* can't happen */
 694                         return NULL;
 695
 696                 s2n(TLSEXT_TYPE_opaque_prf_input, ret);
 697                 s2n(sol + 2, ret);
 698                 s2n(sol, ret);
 699                 memcpy(ret, s->s3->server_opaque_prf_input, sol);
 700                 ret += sol;
 701                 }
 702 #endif
 703         if (((s->s3->tmp.new_cipher->id & 0xFFFF)==0x80 || (s->s3->tmp.new_cipher->id & 0xFFFF)==0x81)
 704                 && (SSL_get_options(s) & SSL_OP_CRYPTOPRO_TLSEXT_BUG))
 705                 { const unsigned char cryptopro_ext[36] = {
 706                         0xfd, 0xe8, /*65000*/
 707                         0x00, 0x20, /*32 bytes length*/
 708                         0x30, 0x1e, 0x30, 0x08, 0x06, 0x06, 0x2a, 0x85,
 709                         0x03,   0x02, 0x02, 0x09, 0x30, 0x08, 0x06, 0x06,
 710                         0x2a, 0x85, 0x03, 0x02, 0x02, 0x16, 0x30, 0x08,
 711                         0x06, 0x06, 0x2a, 0x85, 0x03, 0x02, 0x02, 0x17};
 712                         if (limit-ret<36) return NULL;
 713                         memcpy(ret,cryptopro_ext,36);
 714                         ret+=36;
 715
 716                 }
 717
 718 #ifndef OPENSSL_NO_NEXTPROTONEG
 719         next_proto_neg_seen = s->s3->next_proto_neg_seen;
 720         s->s3->next_proto_neg_seen = 0;
 721         if (next_proto_neg_seen && s->ctx->next_protos_advertised_cb)
 722                 {
 723                 const unsigned char *npa;
 724                 unsigned int npalen;
 725                 int r;
 726
 727                 r = s->ctx->next_protos_advertised_cb(s, &npa, &npalen, s->ctx->next_protos_advertised_cb_arg);
 728                 if (r == SSL_TLSEXT_ERR_OK)
 729                         {
 730                         if ((long)(limit - ret - 4 - npalen) < 0) return NULL;
 731                         s2n(TLSEXT_TYPE_next_proto_neg,ret);
 732                         s2n(npalen,ret);
 733                         memcpy(ret, npa, npalen);
 734                         ret += npalen;
 735                         s->s3->next_proto_neg_seen = 1;
 736                         }
 737                 }
 738 #endif
 739
 740         if ((extdatalen = ret-p-2)== 0)
 741                 return p;
 742
 743         s2n(extdatalen,p);
 744         return ret;
 745         }
 746
 747 int ssl_parse_clienthello_tlsext(SSL *s, unsigned char **p, unsigned char *d, int n, int *al)
 748         {
 749         unsigned short type;
 750         unsigned short size;
 751         unsigned short len;
 752         unsigned char *data = *p;
 753         int renegotiate_seen = 0;
 754         int sigalg_seen = 0;
 755
 756         s->servername_done = 0;
 757         s->tlsext_status_type = -1;
 758
 759         if (data >= (d+n-2))
 760                 goto ri_check;
 761         n2s(data,len);
 762
 763         if (data > (d+n-len))
 764                 goto ri_check;
 765
 766         while (data <= (d+n-4))
 767                 {
 768                 n2s(data,type);
 769                 n2s(data,size);
 770
 771                 if (data+size > (d+n))
 772                         goto ri_check;
 773 #if 0
 774                 fprintf(stderr,"Received extension type %d size %d\n",type,size);
 775 #endif
 776                 if (s->tlsext_debug_cb)
 777                         s->tlsext_debug_cb(s, 0, type, data, size,
 778                                                 s->tlsext_debug_arg);
 779 /* The servername extension is treated as follows:
 780
 781    - Only the hostname type is supported with a maximum length of 255.
 782    - The servername is rejected if too long or if it contains zeros,
 783      in which case an fatal alert is generated.
 784    - The servername field is maintained together with the session cache.
 785    - When a session is resumed, the servername call back invoked in order
 786      to allow the application to position itself to the right context.
 787    - The servername is acknowledged if it is new for a session or when
 788      it is identical to a previously used for the same session.
 789      Applications can control the behaviour.  They can at any time
 790      set a 'desirable' servername for a new SSL object. This can be the
 791      case for example with HTTPS when a Host: header field is received and
 792      a renegotiation is requested. In this case, a possible servername
 793      presented in the new client hello is only acknowledged if it matches
 794      the value of the Host: field.
 795    - Applications must  use SSL_OP_NO_SESSION_RESUMPTION_ON_RENEGOTIATION
 796      if they provide for changing an explicit servername context for the session,
 797      i.e. when the session has been established with a servername extension.
 798    - On session reconnect, the servername extension may be absent.
 799
 800 */
 801
 802                 if (type == TLSEXT_TYPE_server_name)
 803                         {
 804                         unsigned char *sdata;
 805                         int servname_type;
 806                         int dsize;
 807
 808                         if (size < 2)
 809                                 {
 810                                 *al = SSL_AD_DECODE_ERROR;
 811                                 return 0;
 812                                 }
 813                         n2s(data,dsize);
 814                         size -= 2;
 815                         if (dsize > size  )
 816                                 {
 817                                 *al = SSL_AD_DECODE_ERROR;
 818                                 return 0;
 819                                 }
 820
 821                         sdata = data;
 822                         while (dsize > 3)
 823                                 {
 824                                 servname_type = *(sdata++);
 825                                 n2s(sdata,len);
 826                                 dsize -= 3;
 827
 828                                 if (len > dsize)
 829                                         {
 830                                         *al = SSL_AD_DECODE_ERROR;
 831                                         return 0;
 832                                         }
 833                                 if (s->servername_done == 0)
 834                                 switch (servname_type)
 835                                         {
 836                                 case TLSEXT_NAMETYPE_host_name:
 837                                         if (!s->hit)
 838                                                 {
 839                                                 if(s->session->tlsext_hostname)
 840                                                         {
 841                                                         *al = SSL_AD_DECODE_ERROR;
 842                                                         return 0;
 843                                                         }
 844                                                 if (len > TLSEXT_MAXLEN_host_name)
 845                                                         {
 846                                                         *al = TLS1_AD_UNRECOGNIZED_NAME;
 847                                                         return 0;
 848                                                         }
 849                                                 if ((s->session->tlsext_hostname = OPENSSL_malloc(len+1)) == NULL)
 850                                                         {
 851                                                         *al = TLS1_AD_INTERNAL_ERROR;
 852                                                         return 0;
 853                                                         }
 854                                                 memcpy(s->session->tlsext_hostname, sdata, len);
 855                                                 s->session->tlsext_hostname[len]='\0';
 856                                                 if (strlen(s->session->tlsext_hostname) != len) {
 857                                                         OPENSSL_free(s->session->tlsext_hostname);
 858                                                         s->session->tlsext_hostname = NULL;
 859                                                         *al = TLS1_AD_UNRECOGNIZED_NAME;
 860                                                         return 0;
 861                                                 }
 862                                                 s->servername_done = 1;
 863
 864                                                 }
 865                                         else
 866                                                 s->servername_done = s->session->tlsext_hostname
 867                                                         && strlen(s->session->tlsext_hostname) == len
 868                                                         && strncmp(s->session->tlsext_hostname, (char *)sdata, len) == 0;
 869
 870                                         break;
 871
 872                                 default:
 873                                         break;
 874                                         }
 875
 876                                 dsize -= len;
 877                                 }
 878                         if (dsize != 0)
 879                                 {
 880                                 *al = SSL_AD_DECODE_ERROR;
 881                                 return 0;
 882                                 }
 883
 884                         }
 885 #ifndef OPENSSL_NO_SRP
 886                 else if (type == TLSEXT_TYPE_srp)
 887                         {
 888                         if (size > 0)
 889                                 {
 890                                 len = data[0];
 891                                 if ((s->srp_ctx.login = OPENSSL_malloc(len+1)) == NULL)
 892                                         return -1;
 893                                 memcpy(s->srp_ctx.login, &data[1], len);
 894                                 s->srp_ctx.login[len]='\0';
 895                                 }
 896                         }
 897 #endif
 898
 899 #ifndef OPENSSL_NO_EC
 900                 else if (type == TLSEXT_TYPE_ec_point_formats &&
 901                      s->version != DTLS1_VERSION)
 902                         {
 903                         unsigned char *sdata = data;
 904                         int ecpointformatlist_length = *(sdata++);
 905
 906                         if (ecpointformatlist_length != size - 1)
 907                                 {
 908                                 *al = TLS1_AD_DECODE_ERROR;
 909                                 return 0;
 910                                 }
 911                         if (!s->hit)
 912                                 {
 913                                 if(s->session->tlsext_ecpointformatlist)
 914                                         {
 915                                         OPENSSL_free(s->session->tlsext_ecpointformatlist);
 916                                         s->session->tlsext_ecpointformatlist = NULL;
 917                                         }
 918                                 s->session->tlsext_ecpointformatlist_length = 0;
 919                                 if ((s->session->tlsext_ecpointformatlist = OPENSSL_malloc(ecpointformatlist_length)) == NULL)
 920                                         {
 921                                         *al = TLS1_AD_INTERNAL_ERROR;
 922                                         return 0;
 923                                         }
 924                                 s->session->tlsext_ecpointformatlist_length = ecpointformatlist_length;
 925                                 memcpy(s->session->tlsext_ecpointformatlist, sdata, ecpointformatlist_length);
 926                                 }
 927 #if 0
 928                         fprintf(stderr,"ssl_parse_clienthello_tlsext s->session->tlsext_ecpointformatlist (length=%i) ", s->session->tlsext_ecpointformatlist_length);
 929                         sdata = s->session->tlsext_ecpointformatlist;
 930                         for (i = 0; i < s->session->tlsext_ecpointformatlist_length; i++)
 931                                 fprintf(stderr,"%i ",*(sdata++));
 932                         fprintf(stderr,"\n");
 933 #endif
 934                         }
 935                 else if (type == TLSEXT_TYPE_elliptic_curves &&
 936                      s->version != DTLS1_VERSION)
 937                         {
 938                         unsigned char *sdata = data;
 939                         int ellipticcurvelist_length = (*(sdata++) << 8);
 940                         ellipticcurvelist_length += (*(sdata++));
 941
 942                         if (ellipticcurvelist_length != size - 2)
 943                                 {
 944                                 *al = TLS1_AD_DECODE_ERROR;
 945                                 return 0;
 946                                 }
 947                         if (!s->hit)
 948                                 {
 949                                 if(s->session->tlsext_ellipticcurvelist)
 950                                         {
 951                                         *al = TLS1_AD_DECODE_ERROR;
 952                                         return 0;
 953                                         }
 954                                 s->session->tlsext_ellipticcurvelist_length = 0;
 955                                 if ((s->session->tlsext_ellipticcurvelist = OPENSSL_malloc(ellipticcurvelist_length)) == NULL)
 956                                         {
 957                                         *al = TLS1_AD_INTERNAL_ERROR;
 958                                         return 0;
 959                                         }
 960                                 s->session->tlsext_ellipticcurvelist_length = ellipticcurvelist_length;
 961                                 memcpy(s->session->tlsext_ellipticcurvelist, sdata, ellipticcurvelist_length);
 962                                 }
 963 #if 0
 964                         fprintf(stderr,"ssl_parse_clienthello_tlsext s->session->tlsext_ellipticcurvelist (length=%i) ", s->session->tlsext_ellipticcurvelist_length);
 965                         sdata = s->session->tlsext_ellipticcurvelist;
 966                         for (i = 0; i < s->session->tlsext_ellipticcurvelist_length; i++)
 967                                 fprintf(stderr,"%i ",*(sdata++));
 968                         fprintf(stderr,"\n");
 969 #endif
 970                         }
 971 #endif /* OPENSSL_NO_EC */
 972 #ifdef TLSEXT_TYPE_opaque_prf_input
 973                 else if (type == TLSEXT_TYPE_opaque_prf_input &&
 974                      s->version != DTLS1_VERSION)
 975                         {
 976                         unsigned char *sdata = data;
 977
 978                         if (size < 2)
 979                                 {
 980                                 *al = SSL_AD_DECODE_ERROR;
 981                                 return 0;
 982                                 }
 983                         n2s(sdata, s->s3->client_opaque_prf_input_len);
 984                         if (s->s3->client_opaque_prf_input_len != size - 2)
 985                                 {
 986                                 *al = SSL_AD_DECODE_ERROR;
 987                                 return 0;
 988                                 }
 989
 990                         if (s->s3->client_opaque_prf_input != NULL) /* shouldn't really happen */
 991                                 OPENSSL_free(s->s3->client_opaque_prf_input);
 992                         if (s->s3->client_opaque_prf_input_len == 0)
 993                                 s->s3->client_opaque_prf_input = OPENSSL_malloc(1); /* dummy byte just to get non-NULL */
 994                         else
 995                                 s->s3->client_opaque_prf_input = BUF_memdup(sdata, s->s3->client_opaque_prf_input_len);
 996                         if (s->s3->client_opaque_prf_input == NULL)
 997                                 {
 998                                 *al = TLS1_AD_INTERNAL_ERROR;
 999                                 return 0;
1000                                 }
1001                         }
1002 #endif
1003                 else if (type == TLSEXT_TYPE_session_ticket)
1004                         {
1005                         if (s->tls_session_ticket_ext_cb &&
1006                             !s->tls_session_ticket_ext_cb(s, data, size, s->tls_session_ticket_ext_cb_arg))
1007                                 {
1008                                 *al = TLS1_AD_INTERNAL_ERROR;
1009                                 return 0;
1010                                 }
1011                         }
1012                 else if (type == TLSEXT_TYPE_renegotiate)
1013                         {
1014                         if(!ssl_parse_clienthello_renegotiate_ext(s, data, size, al))
1015                                 return 0;
1016                         renegotiate_seen = 1;
1017                         }
1018                 else if (type == TLSEXT_TYPE_signature_algorithms)
1019                         {
1020                         int dsize;
1021                         if (sigalg_seen || size < 2)
1022                                 {
1023                                 *al = SSL_AD_DECODE_ERROR;
1024                                 return 0;
1025                                 }
1026                         sigalg_seen = 1;
1027                         n2s(data,dsize);
1028                         size -= 2;
1029                         if (dsize != size || dsize & 1)
1030                                 {
1031                                 *al = SSL_AD_DECODE_ERROR;
1032                                 return 0;
1033                                 }
1034                         if (!tls1_process_sigalgs(s, data, dsize))
1035                                 {
1036                                 *al = SSL_AD_DECODE_ERROR;
1037                                 return 0;
1038                                 }
1039                         }
1040                 else if (type == TLSEXT_TYPE_status_request &&
1041                          s->version != DTLS1_VERSION && s->ctx->tlsext_status_cb)
1042                         {
1043
1044                         if (size < 5)
1045                                 {
1046                                 *al = SSL_AD_DECODE_ERROR;
1047                                 return 0;
1048                                 }
1049
1050                         s->tlsext_status_type = *data++;
1051                         size--;
1052                         if (s->tlsext_status_type == TLSEXT_STATUSTYPE_ocsp)
1053                                 {
1054                                 const unsigned char *sdata;
1055                                 int dsize;
1056                                 /* Read in responder_id_list */
1057                                 n2s(data,dsize);
1058                                 size -= 2;
1059                                 if (dsize > size  )
1060                                         {
1061                                         *al = SSL_AD_DECODE_ERROR;
1062                                         return 0;
1063                                         }
1064                                 while (dsize > 0)
1065                                         {
1066                                         OCSP_RESPID *id;
1067                                         int idsize;
1068                                         if (dsize < 4)
1069                                                 {
1070                                                 *al = SSL_AD_DECODE_ERROR;
1071                                                 return 0;
1072                                                 }
1073                                         n2s(data, idsize);
1074                                         dsize -= 2 + idsize;
1075                                         size -= 2 + idsize;
1076                                         if (dsize < 0)
1077                                                 {
1078                                                 *al = SSL_AD_DECODE_ERROR;
1079                                                 return 0;
1080                                                 }
1081                                         sdata = data;
1082                                         data += idsize;
1083                                         id = d2i_OCSP_RESPID(NULL,
1084                                                                 &sdata, idsize);
1085                                         if (!id)
1086                                                 {
1087                                                 *al = SSL_AD_DECODE_ERROR;
1088                                                 return 0;
1089                                                 }
1090                                         if (data != sdata)
1091                                                 {
1092                                                 OCSP_RESPID_free(id);
1093                                                 *al = SSL_AD_DECODE_ERROR;
1094                                                 return 0;
1095                                                 }
1096                                         if (!s->tlsext_ocsp_ids
1097                                                 && !(s->tlsext_ocsp_ids =
1098                                                 sk_OCSP_RESPID_new_null()))
1099                                                 {
1100                                                 OCSP_RESPID_free(id);
1101                                                 *al = SSL_AD_INTERNAL_ERROR;
1102                                                 return 0;
1103                                                 }
1104                                         if (!sk_OCSP_RESPID_push(
1105                                                         s->tlsext_ocsp_ids, id))
1106                                                 {
1107                                                 OCSP_RESPID_free(id);
1108                                                 *al = SSL_AD_INTERNAL_ERROR;
1109                                                 return 0;
1110                                                 }
1111                                         }
1112
1113                                 /* Read in request_extensions */
1114                                 if (size < 2)
1115                                         {
1116                                         *al = SSL_AD_DECODE_ERROR;
1117                                         return 0;
1118                                         }
1119                                 n2s(data,dsize);
1120                                 size -= 2;
1121                                 if (dsize != size)
1122                                         {
1123                                         *al = SSL_AD_DECODE_ERROR;
1124                                         return 0;
1125                                         }
1126                                 sdata = data;
1127                                 if (dsize > 0)
1128                                         {
1129                                         s->tlsext_ocsp_exts =
1130                                                 d2i_X509_EXTENSIONS(NULL,
1131                                                         &sdata, dsize);
1132                                         if (!s->tlsext_ocsp_exts
1133                                                 || (data + dsize != sdata))
1134                                                 {
1135                                                 *al = SSL_AD_DECODE_ERROR;
1136                                                 return 0;
1137                                                 }
1138                                         }
1139                                 }
1140                                 /* We don't know what to do with any other type
1141                                 * so ignore it.
1142                                 */
1143                                 else
1144                                         s->tlsext_status_type = -1;
1145                         }
1146 #ifndef OPENSSL_NO_NEXTPROTONEG
1147                 else if (type == TLSEXT_TYPE_next_proto_neg &&
1148                          s->s3->tmp.finish_md_len == 0)
1149                         {
1150                         /* We shouldn't accept this extension on a
1151                          * renegotiation.
1152                          *
1153                          * s->new_session will be set on renegotiation, but we
1154                          * probably shouldn't rely that it couldn't be set on
1155                          * the initial renegotation too in certain cases (when
1156                          * there's some other reason to disallow resuming an
1157                          * earlier session -- the current code won't be doing
1158                          * anything like that, but this might change).
1159
1160                          * A valid sign that there's been a previous handshake
1161                          * in this connection is if s->s3->tmp.finish_md_len >
1162                          * 0.  (We are talking about a check that will happen
1163                          * in the Hello protocol round, well before a new
1164                          * Finished message could have been computed.) */
1165                         s->s3->next_proto_neg_seen = 1;
1166                         }
1167 #endif
1168
1169                 /* session ticket processed earlier */
1170                 data+=size;
1171                 }
1172
1173         *p = data;
1174
1175         ri_check:
1176
1177         /* Need RI if renegotiating */
1178
1179         if (!renegotiate_seen && s->renegotiate &&
1180                 !(s->options & SSL_OP_ALLOW_UNSAFE_LEGACY_RENEGOTIATION))
1181                 {
1182                 *al = SSL_AD_HANDSHAKE_FAILURE;
1183                 SSLerr(SSL_F_SSL_PARSE_CLIENTHELLO_TLSEXT,
1184                                 SSL_R_UNSAFE_LEGACY_RENEGOTIATION_DISABLED);
1185                 return 0;
1186                 }
1187
1188         return 1;
1189         }
1190
1191 #ifndef OPENSSL_NO_NEXTPROTONEG
1192 /* ssl_next_proto_validate validates a Next Protocol Negotiation block. No
1193  * elements of zero length are allowed and the set of elements must exactly fill
1194  * the length of the block. */
1195 static int ssl_next_proto_validate(unsigned char *d, unsigned len)
1196         {
1197         unsigned int off = 0;
1198
1199         while (off < len)
1200                 {
1201                 if (d[off] == 0)
1202                         return 0;
1203                 off += d[off];
1204                 off++;
1205                 }
1206
1207         return off == len;
1208         }
1209 #endif
1210
1211 int ssl_parse_serverhello_tlsext(SSL *s, unsigned char **p, unsigned char *d, int n, int *al)
1212         {
1213         unsigned short length;
1214         unsigned short type;
1215         unsigned short size;
1216         unsigned char *data = *p;
1217         int tlsext_servername = 0;
1218         int renegotiate_seen = 0;
1219
1220         if (data >= (d+n-2))
1221                 goto ri_check;
1222
1223         n2s(data,length);
1224         if (data+length != d+n)
1225                 {
1226                 *al = SSL_AD_DECODE_ERROR;
1227                 return 0;
1228                 }
1229
1230         while(data <= (d+n-4))
1231                 {
1232                 n2s(data,type);
1233                 n2s(data,size);
1234
1235                 if (data+size > (d+n))
1236                         goto ri_check;
1237
1238                 if (s->tlsext_debug_cb)
1239                         s->tlsext_debug_cb(s, 1, type, data, size,
1240                                                 s->tlsext_debug_arg);
1241
1242                 if (type == TLSEXT_TYPE_server_name)
1243                         {
1244                         if (s->tlsext_hostname == NULL || size > 0)
1245                                 {
1246                                 *al = TLS1_AD_UNRECOGNIZED_NAME;
1247                                 return 0;
1248                                 }
1249                         tlsext_servername = 1;
1250                         }
1251
1252 #ifndef OPENSSL_NO_EC
1253                 else if (type == TLSEXT_TYPE_ec_point_formats &&
1254                      s->version != DTLS1_VERSION)
1255                         {
1256                         unsigned char *sdata = data;
1257                         int ecpointformatlist_length = *(sdata++);
1258
1259                         if (ecpointformatlist_length != size - 1)
1260                                 {
1261                                 *al = TLS1_AD_DECODE_ERROR;
1262                                 return 0;
1263                                 }
1264                         s->session->tlsext_ecpointformatlist_length = 0;
1265                         if (s->session->tlsext_ecpointformatlist != NULL) OPENSSL_free(s->session->tlsext_ecpointformatlist);
1266                         if ((s->session->tlsext_ecpointformatlist = OPENSSL_malloc(ecpointformatlist_length)) == NULL)
1267                                 {
1268                                 *al = TLS1_AD_INTERNAL_ERROR;
1269                                 return 0;
1270                                 }
1271                         s->session->tlsext_ecpointformatlist_length = ecpointformatlist_length;
1272                         memcpy(s->session->tlsext_ecpointformatlist, sdata, ecpointformatlist_length);
1273 #if 0
1274                         fprintf(stderr,"ssl_parse_serverhello_tlsext s->session->tlsext_ecpointformatlist ");
1275                         sdata = s->session->tlsext_ecpointformatlist;
1276                         for (i = 0; i < s->session->tlsext_ecpointformatlist_length; i++)
1277                                 fprintf(stderr,"%i ",*(sdata++));
1278                         fprintf(stderr,"\n");
1279 #endif
1280                         }
1281 #endif /* OPENSSL_NO_EC */
1282
1283                 else if (type == TLSEXT_TYPE_session_ticket)
1284                         {
1285                         if (s->tls_session_ticket_ext_cb &&
1286                             !s->tls_session_ticket_ext_cb(s, data, size, s->tls_session_ticket_ext_cb_arg))
1287                                 {
1288                                 *al = TLS1_AD_INTERNAL_ERROR;
1289                                 return 0;
1290                                 }
1291                         if ((SSL_get_options(s) & SSL_OP_NO_TICKET)
1292                                 || (size > 0))
1293                                 {
1294                                 *al = TLS1_AD_UNSUPPORTED_EXTENSION;
1295                                 return 0;
1296                                 }
1297                         s->tlsext_ticket_expected = 1;
1298                         }
1299 #ifdef TLSEXT_TYPE_opaque_prf_input
1300                 else if (type == TLSEXT_TYPE_opaque_prf_input &&
1301                      s->version != DTLS1_VERSION)
1302                         {
1303                         unsigned char *sdata = data;
1304
1305                         if (size < 2)
1306                                 {
1307                                 *al = SSL_AD_DECODE_ERROR;
1308                                 return 0;
1309                                 }
1310                         n2s(sdata, s->s3->server_opaque_prf_input_len);
1311                         if (s->s3->server_opaque_prf_input_len != size - 2)
1312                                 {
1313                                 *al = SSL_AD_DECODE_ERROR;
1314                                 return 0;
1315                                 }
1316
1317                         if (s->s3->server_opaque_prf_input != NULL) /* shouldn't really happen */
1318                                 OPENSSL_free(s->s3->server_opaque_prf_input);
1319                         if (s->s3->server_opaque_prf_input_len == 0)
1320                                 s->s3->server_opaque_prf_input = OPENSSL_malloc(1); /* dummy byte just to get non-NULL */
1321                         else
1322                                 s->s3->server_opaque_prf_input = BUF_memdup(sdata, s->s3->server_opaque_prf_input_len);
1323
1324                         if (s->s3->server_opaque_prf_input == NULL)
1325                                 {
1326                                 *al = TLS1_AD_INTERNAL_ERROR;
1327                                 return 0;
1328                                 }
1329                         }
1330 #endif
1331                 else if (type == TLSEXT_TYPE_status_request &&
1332                          s->version != DTLS1_VERSION)
1333                         {
1334                         /* MUST be empty and only sent if we've requested
1335                          * a status request message.
1336                          */
1337                         if ((s->tlsext_status_type == -1) || (size > 0))
1338                                 {
1339                                 *al = TLS1_AD_UNSUPPORTED_EXTENSION;
1340                                 return 0;
1341                                 }
1342                         /* Set flag to expect CertificateStatus message */
1343                         s->tlsext_status_expected = 1;
1344                         }
1345 #ifndef OPENSSL_NO_NEXTPROTONEG
1346                 else if (type == TLSEXT_TYPE_next_proto_neg)
1347                         {
1348                         unsigned char *selected;
1349                         unsigned char selected_len;
1350
1351                         /* We must have requested it. */
1352                         if ((s->ctx->next_proto_select_cb == NULL))
1353                                 {
1354                                 *al = TLS1_AD_UNSUPPORTED_EXTENSION;
1355                                 return 0;
1356                                 }
1357                         /* The data must be valid */
1358                         if (!ssl_next_proto_validate(data, size))
1359                                 {
1360                                 *al = TLS1_AD_DECODE_ERROR;
1361                                 return 0;
1362                                 }
1363                         if (s->ctx->next_proto_select_cb(s, &selected, &selected_len, data, size, s->ctx->next_proto_select_cb_arg) != SSL_TLSEXT_ERR_OK)
1364                                 {
1365                                 *al = TLS1_AD_INTERNAL_ERROR;
1366                                 return 0;
1367                                 }
1368                         s->next_proto_negotiated = OPENSSL_malloc(selected_len);
1369                         if (!s->next_proto_negotiated)
1370                                 {
1371                                 *al = TLS1_AD_INTERNAL_ERROR;
1372                                 return 0;
1373                                 }
1374                         memcpy(s->next_proto_negotiated, selected, selected_len);
1375                         s->next_proto_negotiated_len = selected_len;
1376                         }
1377 #endif
1378                 else if (type == TLSEXT_TYPE_renegotiate)
1379                         {
1380                         if(!ssl_parse_serverhello_renegotiate_ext(s, data, size, al))
1381                                 return 0;
1382                         renegotiate_seen = 1;
1383                         }
1384                 data+=size;
1385                 }
1386
1387         if (data != d+n)
1388                 {
1389                 *al = SSL_AD_DECODE_ERROR;
1390                 return 0;
1391                 }
1392
1393         if (!s->hit && tlsext_servername == 1)
1394                 {
1395                 if (s->tlsext_hostname)
1396                         {
1397                         if (s->session->tlsext_hostname == NULL)
1398                                 {
1399                                 s->session->tlsext_hostname = BUF_strdup(s->tlsext_hostname);
1400                                 if (!s->session->tlsext_hostname)
1401                                         {
1402                                         *al = SSL_AD_UNRECOGNIZED_NAME;
1403                                         return 0;
1404                                         }
1405                                 }
1406                         else
1407                                 {
1408                                 *al = SSL_AD_DECODE_ERROR;
1409                                 return 0;
1410                                 }
1411                         }
1412                 }
1413
1414         *p = data;
1415
1416         ri_check:
1417
1418         /* Determine if we need to see RI. Strictly speaking if we want to
1419          * avoid an attack we should *always* see RI even on initial server
1420          * hello because the client doesn't see any renegotiation during an
1421          * attack. However this would mean we could not connect to any server
1422          * which doesn't support RI so for the immediate future tolerate RI
1423          * absence on initial connect only.
1424          */
1425         if (!renegotiate_seen
1426                 && !(s->options & SSL_OP_LEGACY_SERVER_CONNECT)
1427                 && !(s->options & SSL_OP_ALLOW_UNSAFE_LEGACY_RENEGOTIATION))
1428                 {
1429                 *al = SSL_AD_HANDSHAKE_FAILURE;
1430                 SSLerr(SSL_F_SSL_PARSE_SERVERHELLO_TLSEXT,
1431                                 SSL_R_UNSAFE_LEGACY_RENEGOTIATION_DISABLED);
1432                 return 0;
1433                 }
1434
1435         return 1;
1436         }
1437
1438
1439 int ssl_prepare_clienthello_tlsext(SSL *s)
1440         {
1441 #ifndef OPENSSL_NO_EC
1442         /* If we are client and using an elliptic curve cryptography cipher suite, send the point formats
1443          * and elliptic curves we support.
1444          */
1445         int using_ecc = 0;
1446         int i;
1447         unsigned char *j;
1448         unsigned long alg_k, alg_a;
1449         STACK_OF(SSL_CIPHER) *cipher_stack = SSL_get_ciphers(s);
1450
1451         for (i = 0; i < sk_SSL_CIPHER_num(cipher_stack); i++)
1452                 {
1453                 SSL_CIPHER *c = sk_SSL_CIPHER_value(cipher_stack, i);
1454
1455                 alg_k = c->algorithm_mkey;
1456                 alg_a = c->algorithm_auth;
1457                 if ((alg_k & (SSL_kEECDH|SSL_kECDHr|SSL_kECDHe) || (alg_a & SSL_aECDSA)))
1458                         {
1459                         using_ecc = 1;
1460                         break;
1461                         }
1462                 }
1463         using_ecc = using_ecc && (s->version >= TLS1_VERSION);
1464         if (using_ecc)
1465                 {
1466                 if (s->tlsext_ecpointformatlist != NULL) OPENSSL_free(s->tlsext_ecpointformatlist);
1467                 if ((s->tlsext_ecpointformatlist = OPENSSL_malloc(3)) == NULL)
1468                         {
1469                         SSLerr(SSL_F_SSL_PREPARE_CLIENTHELLO_TLSEXT,ERR_R_MALLOC_FAILURE);
1470                         return -1;
1471                         }
1472                 s->tlsext_ecpointformatlist_length = 3;
1473                 s->tlsext_ecpointformatlist[0] = TLSEXT_ECPOINTFORMAT_uncompressed;
1474                 s->tlsext_ecpointformatlist[1] = TLSEXT_ECPOINTFORMAT_ansiX962_compressed_prime;
1475                 s->tlsext_ecpointformatlist[2] = TLSEXT_ECPOINTFORMAT_ansiX962_compressed_char2;
1476
1477                 /* we support all named elliptic curves in draft-ietf-tls-ecc-12 */
1478                 if (s->tlsext_ellipticcurvelist != NULL) OPENSSL_free(s->tlsext_ellipticcurvelist);
1479                 s->tlsext_ellipticcurvelist_length = sizeof(nid_list)/sizeof(nid_list[0]) * 2;
1480                 if ((s->tlsext_ellipticcurvelist = OPENSSL_malloc(s->tlsext_ellipticcurvelist_length)) == NULL)
1481                         {
1482                         s->tlsext_ellipticcurvelist_length = 0;
1483                         SSLerr(SSL_F_SSL_PREPARE_CLIENTHELLO_TLSEXT,ERR_R_MALLOC_FAILURE);
1484                         return -1;
1485                         }
1486                 for (i = 1, j = s->tlsext_ellipticcurvelist; (unsigned int)i <=
1487                                 sizeof(nid_list)/sizeof(nid_list[0]); i++)
1488                         s2n(i,j);
1489                 }
1490 #endif /* OPENSSL_NO_EC */
1491
1492 #ifdef TLSEXT_TYPE_opaque_prf_input
1493         {
1494                 int r = 1;
1495
1496                 if (s->ctx->tlsext_opaque_prf_input_callback != 0)
1497                         {
1498                         r = s->ctx->tlsext_opaque_prf_input_callback(s, NULL, 0, s->ctx->tlsext_opaque_prf_input_callback_arg);
1499                         if (!r)
1500                                 return -1;
1501                         }
1502
1503                 if (s->tlsext_opaque_prf_input != NULL)
1504                         {
1505                         if (s->s3->client_opaque_prf_input != NULL) /* shouldn't really happen */
1506                                 OPENSSL_free(s->s3->client_opaque_prf_input);
1507
1508                         if (s->tlsext_opaque_prf_input_len == 0)
1509                                 s->s3->client_opaque_prf_input = OPENSSL_malloc(1); /* dummy byte just to get non-NULL */
1510                         else
1511                                 s->s3->client_opaque_prf_input = BUF_memdup(s->tlsext_opaque_prf_input, s->tlsext_opaque_prf_input_len);
1512                         if (s->s3->client_opaque_prf_input == NULL)
1513                                 {
1514                                 SSLerr(SSL_F_SSL_PREPARE_CLIENTHELLO_TLSEXT,ERR_R_MALLOC_FAILURE);
1515                                 return -1;
1516                                 }
1517                         s->s3->client_opaque_prf_input_len = s->tlsext_opaque_prf_input_len;
1518                         }
1519
1520                 if (r == 2)
1521                         /* at callback's request, insist on receiving an appropriate server opaque PRF input */
1522                         s->s3->server_opaque_prf_input_len = s->tlsext_opaque_prf_input_len;
1523         }
1524 #endif
1525
1526         return 1;
1527         }
1528
1529 int ssl_prepare_serverhello_tlsext(SSL *s)
1530         {
1531 #ifndef OPENSSL_NO_EC
1532         /* If we are server and using an ECC cipher suite, send the point formats we support
1533          * if the client sent us an ECPointsFormat extension.  Note that the server is not
1534          * supposed to send an EllipticCurves extension.
1535          */
1536
1537         unsigned long alg_k = s->s3->tmp.new_cipher->algorithm_mkey;
1538         unsigned long alg_a = s->s3->tmp.new_cipher->algorithm_auth;
1539         int using_ecc = (alg_k & (SSL_kEECDH|SSL_kECDHr|SSL_kECDHe)) || (alg_a & SSL_aECDSA);
1540         using_ecc = using_ecc && (s->session->tlsext_ecpointformatlist != NULL);
1541
1542         if (using_ecc)
1543                 {
1544                 if (s->tlsext_ecpointformatlist != NULL) OPENSSL_free(s->tlsext_ecpointformatlist);
1545                 if ((s->tlsext_ecpointformatlist = OPENSSL_malloc(3)) == NULL)
1546                         {
1547                         SSLerr(SSL_F_SSL_PREPARE_SERVERHELLO_TLSEXT,ERR_R_MALLOC_FAILURE);
1548                         return -1;
1549                         }
1550                 s->tlsext_ecpointformatlist_length = 3;
1551                 s->tlsext_ecpointformatlist[0] = TLSEXT_ECPOINTFORMAT_uncompressed;
1552                 s->tlsext_ecpointformatlist[1] = TLSEXT_ECPOINTFORMAT_ansiX962_compressed_prime;
1553                 s->tlsext_ecpointformatlist[2] = TLSEXT_ECPOINTFORMAT_ansiX962_compressed_char2;
1554                 }
1555 #endif /* OPENSSL_NO_EC */
1556
1557         return 1;
1558         }
1559
1560 int ssl_check_clienthello_tlsext(SSL *s)
1561         {
1562         int ret=SSL_TLSEXT_ERR_NOACK;
1563         int al = SSL_AD_UNRECOGNIZED_NAME;
1564
1565 #ifndef OPENSSL_NO_EC
1566         /* The handling of the ECPointFormats extension is done elsewhere, namely in
1567          * ssl3_choose_cipher in s3_lib.c.
1568          */
1569         /* The handling of the EllipticCurves extension is done elsewhere, namely in
1570          * ssl3_choose_cipher in s3_lib.c.
1571          */
1572 #endif
1573
1574         if (s->ctx != NULL && s->ctx->tlsext_servername_callback != 0)
1575                 ret = s->ctx->tlsext_servername_callback(s, &al, s->ctx->tlsext_servername_arg);
1576         else if (s->initial_ctx != NULL && s->initial_ctx->tlsext_servername_callback != 0)
1577                 ret = s->initial_ctx->tlsext_servername_callback(s, &al, s->initial_ctx->tlsext_servername_arg);
1578
1579         /* If status request then ask callback what to do.
1580          * Note: this must be called after servername callbacks in case
1581          * the certificate has changed.
1582          */
1583         if ((s->tlsext_status_type != -1) && s->ctx && s->ctx->tlsext_status_cb)
1584                 {
1585                 int r;
1586                 r = s->ctx->tlsext_status_cb(s, s->ctx->tlsext_status_arg);
1587                 switch (r)
1588                         {
1589                         /* We don't want to send a status request response */
1590                         case SSL_TLSEXT_ERR_NOACK:
1591                                 s->tlsext_status_expected = 0;
1592                                 break;
1593                         /* status request response should be sent */
1594                         case SSL_TLSEXT_ERR_OK:
1595                                 if (s->tlsext_ocsp_resp)
1596                                         s->tlsext_status_expected = 1;
1597                                 else
1598                                         s->tlsext_status_expected = 0;
1599                                 break;
1600                         /* something bad happened */
1601                         case SSL_TLSEXT_ERR_ALERT_FATAL:
1602                                 ret = SSL_TLSEXT_ERR_ALERT_FATAL;
1603                                 al = SSL_AD_INTERNAL_ERROR;
1604                                 goto err;
1605                         }
1606                 }
1607         else
1608                 s->tlsext_status_expected = 0;
1609
1610 #ifdef TLSEXT_TYPE_opaque_prf_input
1611         {
1612                 /* This sort of belongs into ssl_prepare_serverhello_tlsext(),
1613                  * but we might be sending an alert in response to the client hello,
1614                  * so this has to happen here in ssl_check_clienthello_tlsext(). */
1615
1616                 int r = 1;
1617
1618                 if (s->ctx->tlsext_opaque_prf_input_callback != 0)
1619                         {
1620                         r = s->ctx->tlsext_opaque_prf_input_callback(s, NULL, 0, s->ctx->tlsext_opaque_prf_input_callback_arg);
1621                         if (!r)
1622                                 {
1623                                 ret = SSL_TLSEXT_ERR_ALERT_FATAL;
1624                                 al = SSL_AD_INTERNAL_ERROR;
1625                                 goto err;
1626                                 }
1627                         }
1628
1629                 if (s->s3->server_opaque_prf_input != NULL) /* shouldn't really happen */
1630                         OPENSSL_free(s->s3->server_opaque_prf_input);
1631                 s->s3->server_opaque_prf_input = NULL;
1632
1633                 if (s->tlsext_opaque_prf_input != NULL)
1634                         {
1635                         if (s->s3->client_opaque_prf_input != NULL &&
1636                                 s->s3->client_opaque_prf_input_len == s->tlsext_opaque_prf_input_len)
1637                                 {
1638                                 /* can only use this extension if we have a server opaque PRF input
1639                                  * of the same length as the client opaque PRF input! */
1640
1641                                 if (s->tlsext_opaque_prf_input_len == 0)
1642                                         s->s3->server_opaque_prf_input = OPENSSL_malloc(1); /* dummy byte just to get non-NULL */
1643                                 else
1644                                         s->s3->server_opaque_prf_input = BUF_memdup(s->tlsext_opaque_prf_input, s->tlsext_opaque_prf_input_len);
1645                                 if (s->s3->server_opaque_prf_input == NULL)
1646                                         {
1647                                         ret = SSL_TLSEXT_ERR_ALERT_FATAL;
1648                                         al = SSL_AD_INTERNAL_ERROR;
1649                                         goto err;
1650                                         }
1651                                 s->s3->server_opaque_prf_input_len = s->tlsext_opaque_prf_input_len;
1652                                 }
1653                         }
1654
1655                 if (r == 2 && s->s3->server_opaque_prf_input == NULL)
1656                         {
1657                         /* The callback wants to enforce use of the extension,
1658                          * but we can't do that with the client opaque PRF input;
1659                          * abort the handshake.
1660                          */
1661                         ret = SSL_TLSEXT_ERR_ALERT_FATAL;
1662                         al = SSL_AD_HANDSHAKE_FAILURE;
1663                         }
1664         }
1665
1666 #endif
1667  err:
1668         switch (ret)
1669                 {
1670                 case SSL_TLSEXT_ERR_ALERT_FATAL:
1671                         ssl3_send_alert(s,SSL3_AL_FATAL,al);
1672                         return -1;
1673
1674                 case SSL_TLSEXT_ERR_ALERT_WARNING:
1675                         ssl3_send_alert(s,SSL3_AL_WARNING,al);
1676                         return 1;
1677
1678                 case SSL_TLSEXT_ERR_NOACK:
1679                         s->servername_done=0;
1680                         default:
1681                 return 1;
1682                 }
1683         }
1684
1685 int ssl_check_serverhello_tlsext(SSL *s)
1686         {
1687         int ret=SSL_TLSEXT_ERR_NOACK;
1688         int al = SSL_AD_UNRECOGNIZED_NAME;
1689
1690 #ifndef OPENSSL_NO_EC
1691         /* If we are client and using an elliptic curve cryptography cipher
1692          * suite, then if server returns an EC point formats lists extension
1693          * it must contain uncompressed.
1694          */
1695         unsigned long alg_k = s->s3->tmp.new_cipher->algorithm_mkey;
1696         unsigned long alg_a = s->s3->tmp.new_cipher->algorithm_auth;
1697         if ((s->tlsext_ecpointformatlist != NULL) && (s->tlsext_ecpointformatlist_length > 0) &&
1698             (s->session->tlsext_ecpointformatlist != NULL) && (s->session->tlsext_ecpointformatlist_length > 0) &&
1699             ((alg_k & (SSL_kEECDH|SSL_kECDHr|SSL_kECDHe)) || (alg_a & SSL_aECDSA)))
1700                 {
1701                 /* we are using an ECC cipher */
1702                 size_t i;
1703                 unsigned char *list;
1704                 int found_uncompressed = 0;
1705                 list = s->session->tlsext_ecpointformatlist;
1706                 for (i = 0; i < s->session->tlsext_ecpointformatlist_length; i++)
1707                         {
1708                         if (*(list++) == TLSEXT_ECPOINTFORMAT_uncompressed)
1709                                 {
1710                                 found_uncompressed = 1;
1711                                 break;
1712                                 }
1713                         }
1714                 if (!found_uncompressed)
1715                         {
1716                         SSLerr(SSL_F_SSL_CHECK_SERVERHELLO_TLSEXT,SSL_R_TLS_INVALID_ECPOINTFORMAT_LIST);
1717                         return -1;
1718                         }
1719                 }
1720         ret = SSL_TLSEXT_ERR_OK;
1721 #endif /* OPENSSL_NO_EC */
1722
1723         if (s->ctx != NULL && s->ctx->tlsext_servername_callback != 0)
1724                 ret = s->ctx->tlsext_servername_callback(s, &al, s->ctx->tlsext_servername_arg);
1725         else if (s->initial_ctx != NULL && s->initial_ctx->tlsext_servername_callback != 0)
1726                 ret = s->initial_ctx->tlsext_servername_callback(s, &al, s->initial_ctx->tlsext_servername_arg);
1727
1728 #ifdef TLSEXT_TYPE_opaque_prf_input
1729         if (s->s3->server_opaque_prf_input_len > 0)
1730                 {
1731                 /* This case may indicate that we, as a client, want to insist on using opaque PRF inputs.
1732                  * So first verify that we really have a value from the server too. */
1733
1734                 if (s->s3->server_opaque_prf_input == NULL)
1735                         {
1736                         ret = SSL_TLSEXT_ERR_ALERT_FATAL;
1737                         al = SSL_AD_HANDSHAKE_FAILURE;
1738                         }
1739
1740                 /* Anytime the server *has* sent an opaque PRF input, we need to check
1741                  * that we have a client opaque PRF input of the same size. */
1742                 if (s->s3->client_opaque_prf_input == NULL ||
1743                     s->s3->client_opaque_prf_input_len != s->s3->server_opaque_prf_input_len)
1744                         {
1745                         ret = SSL_TLSEXT_ERR_ALERT_FATAL;
1746                         al = SSL_AD_ILLEGAL_PARAMETER;
1747                         }
1748                 }
1749 #endif
1750
1751         /* If we've requested certificate status and we wont get one
1752          * tell the callback
1753          */
1754         if ((s->tlsext_status_type != -1) && !(s->tlsext_status_expected)
1755                         && s->ctx && s->ctx->tlsext_status_cb)
1756                 {
1757                 int r;
1758                 /* Set resp to NULL, resplen to -1 so callback knows
1759                  * there is no response.
1760                  */
1761                 if (s->tlsext_ocsp_resp)
1762                         {
1763                         OPENSSL_free(s->tlsext_ocsp_resp);
1764                         s->tlsext_ocsp_resp = NULL;
1765                         }
1766                 s->tlsext_ocsp_resplen = -1;
1767                 r = s->ctx->tlsext_status_cb(s, s->ctx->tlsext_status_arg);
1768                 if (r == 0)
1769                         {
1770                         al = SSL_AD_BAD_CERTIFICATE_STATUS_RESPONSE;
1771                         ret = SSL_TLSEXT_ERR_ALERT_FATAL;
1772                         }
1773                 if (r < 0)
1774                         {
1775                         al = SSL_AD_INTERNAL_ERROR;
1776                         ret = SSL_TLSEXT_ERR_ALERT_FATAL;
1777                         }
1778                 }
1779
1780         switch (ret)
1781                 {
1782                 case SSL_TLSEXT_ERR_ALERT_FATAL:
1783                         ssl3_send_alert(s,SSL3_AL_FATAL,al);
1784                         return -1;
1785
1786                 case SSL_TLSEXT_ERR_ALERT_WARNING:
1787                         ssl3_send_alert(s,SSL3_AL_WARNING,al);
1788                         return 1;
1789
1790                 case SSL_TLSEXT_ERR_NOACK:
1791                         s->servername_done=0;
1792                         default:
1793                 return 1;
1794                 }
1795         }
1796
1797 /* Since the server cache lookup is done early on in the processing of client
1798  * hello and other operations depend on the result we need to handle any TLS
1799  * session ticket extension at the same time.
1800  */
1801
1802 int tls1_process_ticket(SSL *s, unsigned char *session_id, int len,
1803                                 const unsigned char *limit, SSL_SESSION **ret)
1804         {
1805         /* Point after session ID in client hello */
1806         const unsigned char *p = session_id + len;
1807         unsigned short i;
1808
1809         /* If tickets disabled behave as if no ticket present
1810          * to permit stateful resumption.
1811          */
1812         if (SSL_get_options(s) & SSL_OP_NO_TICKET)
1813                 return 1;
1814
1815         if ((s->version <= SSL3_VERSION) || !limit)
1816                 return 1;
1817         if (p >= limit)
1818                 return -1;
1819         /* Skip past DTLS cookie */
1820         if (s->version == DTLS1_VERSION || s->version == DTLS1_BAD_VER)
1821                 {
1822                 i = *(p++);
1823                 p+= i;
1824                 if (p >= limit)
1825                         return -1;
1826                 }
1827         /* Skip past cipher list */
1828         n2s(p, i);
1829         p+= i;
1830         if (p >= limit)
1831                 return -1;
1832         /* Skip past compression algorithm list */
1833         i = *(p++);
1834         p += i;
1835         if (p > limit)
1836                 return -1;
1837         /* Now at start of extensions */
1838         if ((p + 2) >= limit)
1839                 return 1;
1840         n2s(p, i);
1841         while ((p + 4) <= limit)
1842                 {
1843                 unsigned short type, size;
1844                 n2s(p, type);
1845                 n2s(p, size);
1846                 if (p + size > limit)
1847                         return 1;
1848                 if (type == TLSEXT_TYPE_session_ticket)
1849                         {
1850                         /* If tickets disabled indicate cache miss which will
1851                          * trigger a full handshake
1852                          */
1853                         if (SSL_get_options(s) & SSL_OP_NO_TICKET)
1854                                 return 1;
1855                         /* If zero length note client will accept a ticket
1856                          * and indicate cache miss to trigger full handshake
1857                          */
1858                         if (size == 0)
1859                                 {
1860                                 s->tlsext_ticket_expected = 1;
1861                                 return 0;       /* Cache miss */
1862                                 }
1863                         if (s->tls_session_secret_cb)
1864                                 {
1865                                 /* Indicate cache miss here and instead of
1866                                  * generating the session from ticket now,
1867                                  * trigger abbreviated handshake based on
1868                                  * external mechanism to calculate the master
1869                                  * secret later. */
1870                                 return 0;
1871                                 }
1872                         return tls_decrypt_ticket(s, p, size, session_id, len,
1873                                                                         ret);
1874                         }
1875                 p += size;
1876                 }
1877         return 1;
1878         }
1879
1880 static int tls_decrypt_ticket(SSL *s, const unsigned char *etick, int eticklen,
1881                                 const unsigned char *sess_id, int sesslen,
1882                                 SSL_SESSION **psess)
1883         {
1884         SSL_SESSION *sess;
1885         unsigned char *sdec;
1886         const unsigned char *p;
1887         int slen, mlen, renew_ticket = 0;
1888         unsigned char tick_hmac[EVP_MAX_MD_SIZE];
1889         HMAC_CTX hctx;
1890         EVP_CIPHER_CTX ctx;
1891         SSL_CTX *tctx = s->initial_ctx;
1892         /* Need at least keyname + iv + some encrypted data */
1893         if (eticklen < 48)
1894                 goto tickerr;
1895         /* Initialize session ticket encryption and HMAC contexts */
1896         HMAC_CTX_init(&hctx);
1897         EVP_CIPHER_CTX_init(&ctx);
1898         if (tctx->tlsext_ticket_key_cb)
1899                 {
1900                 unsigned char *nctick = (unsigned char *)etick;
1901                 int rv = tctx->tlsext_ticket_key_cb(s, nctick, nctick + 16,
1902                                                         &ctx, &hctx, 0);
1903                 if (rv < 0)
1904                         return -1;
1905                 if (rv == 0)
1906                         goto tickerr;
1907                 if (rv == 2)
1908                         renew_ticket = 1;
1909                 }
1910         else
1911                 {
1912                 /* Check key name matches */
1913                 if (memcmp(etick, tctx->tlsext_tick_key_name, 16))
1914                         goto tickerr;
1915                 HMAC_Init_ex(&hctx, tctx->tlsext_tick_hmac_key, 16,
1916                                         tlsext_tick_md(), NULL);
1917                 EVP_DecryptInit_ex(&ctx, EVP_aes_128_cbc(), NULL,
1918                                 tctx->tlsext_tick_aes_key, etick + 16);
1919                 }
1920         /* Attempt to process session ticket, first conduct sanity and
1921          * integrity checks on ticket.
1922          */
1923         mlen = HMAC_size(&hctx);
1924         if (mlen < 0)
1925                 {
1926                 EVP_CIPHER_CTX_cleanup(&ctx);
1927                 return -1;
1928                 }
1929         eticklen -= mlen;
1930         /* Check HMAC of encrypted ticket */
1931         HMAC_Update(&hctx, etick, eticklen);
1932         HMAC_Final(&hctx, tick_hmac, NULL);
1933         HMAC_CTX_cleanup(&hctx);
1934         if (memcmp(tick_hmac, etick + eticklen, mlen))
1935                 goto tickerr;
1936         /* Attempt to decrypt session data */
1937         /* Move p after IV to start of encrypted ticket, update length */
1938         p = etick + 16 + EVP_CIPHER_CTX_iv_length(&ctx);
1939         eticklen -= 16 + EVP_CIPHER_CTX_iv_length(&ctx);
1940         sdec = OPENSSL_malloc(eticklen);
1941         if (!sdec)
1942                 {
1943                 EVP_CIPHER_CTX_cleanup(&ctx);
1944                 return -1;
1945                 }
1946         EVP_DecryptUpdate(&ctx, sdec, &slen, p, eticklen);
1947         if (EVP_DecryptFinal(&ctx, sdec + slen, &mlen) <= 0)
1948                 goto tickerr;
1949         slen += mlen;
1950         EVP_CIPHER_CTX_cleanup(&ctx);
1951         p = sdec;
1952
1953         sess = d2i_SSL_SESSION(NULL, &p, slen);
1954         OPENSSL_free(sdec);
1955         if (sess)
1956                 {
1957                 /* The session ID if non-empty is used by some clients to
1958                  * detect that the ticket has been accepted. So we copy it to
1959                  * the session structure. If it is empty set length to zero
1960                  * as required by standard.
1961                  */
1962                 if (sesslen)
1963                         memcpy(sess->session_id, sess_id, sesslen);
1964                 sess->session_id_length = sesslen;
1965                 *psess = sess;
1966                 s->tlsext_ticket_expected = renew_ticket;
1967                 return 1;
1968                 }
1969         /* If session decrypt failure indicate a cache miss and set state to
1970          * send a new ticket
1971          */
1972         tickerr:
1973         s->tlsext_ticket_expected = 1;
1974         return 0;
1975         }
1976
1977 /* Tables to translate from NIDs to TLS v1.2 ids */
1978
1979 typedef struct
1980         {
1981         int nid;
1982         int id;
1983         } tls12_lookup;
1984
1985 static tls12_lookup tls12_md[] = {
1986 #ifndef OPENSSL_NO_MD5
1987         {NID_md5, TLSEXT_hash_md5},
1988 #endif
1989 #ifndef OPENSSL_NO_SHA
1990         {NID_sha1, TLSEXT_hash_sha1},
1991 #endif
1992 #ifndef OPENSSL_NO_SHA256
1993         {NID_sha224, TLSEXT_hash_sha224},
1994         {NID_sha256, TLSEXT_hash_sha256},
1995 #endif
1996 #ifndef OPENSSL_NO_SHA512
1997         {NID_sha384, TLSEXT_hash_sha384},
1998         {NID_sha512, TLSEXT_hash_sha512}
1999 #endif
2000 };
2001
2002 static tls12_lookup tls12_sig[] = {
2003 #ifndef OPENSSL_NO_RSA
2004         {EVP_PKEY_RSA, TLSEXT_signature_rsa},
2005 #endif
2006 #ifndef OPENSSL_NO_RSA
2007         {EVP_PKEY_DSA, TLSEXT_signature_dsa},
2008 #endif
2009 #ifndef OPENSSL_NO_ECDSA
2010         {EVP_PKEY_EC, TLSEXT_signature_ecdsa}
2011 #endif
2012 };
2013
2014 static int tls12_find_id(int nid, tls12_lookup *table, size_t tlen)
2015         {
2016         size_t i;
2017         for (i = 0; i < tlen; i++)
2018                 {
2019                 if (table[i].nid == nid)
2020                         return table[i].id;
2021                 }
2022         return -1;
2023         }
2024 #if 0
2025 static int tls12_find_nid(int id, tls12_lookup *table, size_t tlen)
2026         {
2027         size_t i;
2028         for (i = 0; i < tlen; i++)
2029                 {
2030                 if (table[i].id == id)
2031                         return table[i].nid;
2032                 }
2033         return -1;
2034         }
2035 #endif
2036
2037 int tls12_get_sigandhash(unsigned char *p, const EVP_PKEY *pk, const EVP_MD *md)
2038         {
2039         int sig_id, md_id;
2040         md_id = tls12_find_id(EVP_MD_type(md), tls12_md,
2041                                 sizeof(tls12_md)/sizeof(tls12_lookup));
2042         if (md_id == -1)
2043                 return 0;
2044         sig_id = tls12_get_sigid(pk);
2045         if (sig_id == -1)
2046                 return 0;
2047         p[0] = (unsigned char)md_id;
2048         p[1] = (unsigned char)sig_id;
2049         return 1;
2050         }
2051
2052 int tls12_get_sigid(const EVP_PKEY *pk)
2053         {
2054         return tls12_find_id(pk->type, tls12_sig,
2055                                 sizeof(tls12_sig)/sizeof(tls12_lookup));
2056         }
2057
2058 const EVP_MD *tls12_get_hash(unsigned char hash_alg)
2059         {
2060         switch(hash_alg)
2061                 {
2062 #ifndef OPENSSL_NO_MD5
2063                 case TLSEXT_hash_md5:
2064                 return EVP_md5();
2065 #endif
2066 #ifndef OPENSSL_NO_SHA
2067                 case TLSEXT_hash_sha1:
2068                 return EVP_sha1();
2069 #endif
2070 #ifndef OPENSSL_NO_SHA256
2071                 case TLSEXT_hash_sha224:
2072                 return EVP_sha224();
2073
2074                 case TLSEXT_hash_sha256:
2075                 return EVP_sha256();
2076 #endif
2077 #ifndef OPENSSL_NO_SHA512
2078                 case TLSEXT_hash_sha384:
2079                 return EVP_sha384();
2080
2081                 case TLSEXT_hash_sha512:
2082                 return EVP_sha512();
2083 #endif
2084                 default:
2085                 return NULL;
2086
2087                 }
2088         }
2089
2090 /* Set preferred digest for each key type */
2091
2092 int tls1_process_sigalgs(SSL *s, const unsigned char *data, int dsize)
2093         {
2094         int i, idx;
2095         const EVP_MD *md;
2096         CERT *c = s->cert;
2097         /* Extension ignored for TLS versions below 1.2 */
2098         if (s->version < TLS1_2_VERSION)
2099                 return 1;
2100         /* Should never happen */
2101         if (!c)
2102                 return 0;
2103
2104         c->pkeys[SSL_PKEY_DSA_SIGN].digest = NULL;
2105         c->pkeys[SSL_PKEY_RSA_SIGN].digest = NULL;
2106         c->pkeys[SSL_PKEY_RSA_ENC].digest = NULL;
2107         c->pkeys[SSL_PKEY_ECC].digest = NULL;
2108
2109         for (i = 0; i < dsize; i += 2)
2110                 {
2111                 unsigned char hash_alg = data[i], sig_alg = data[i+1];
2112
2113                 switch(sig_alg)
2114                         {
2115 #ifndef OPENSSL_NO_RSA
2116                         case TLSEXT_signature_rsa:
2117                         idx = SSL_PKEY_RSA_SIGN;
2118                         break;
2119 #endif
2120 #ifndef OPENSSL_NO_DSA
2121                         case TLSEXT_signature_dsa:
2122                         idx = SSL_PKEY_DSA_SIGN;
2123                         break;
2124 #endif
2125 #ifndef OPENSSL_NO_ECDSA
2126                         case TLSEXT_signature_ecdsa:
2127                         idx = SSL_PKEY_ECC;
2128                         break;
2129 #endif
2130                         default:
2131                         continue;
2132                         }
2133
2134                 if (c->pkeys[idx].digest == NULL)
2135                         {
2136                         md = tls12_get_hash(hash_alg);
2137                         if (md)
2138                                 {
2139                                 c->pkeys[idx].digest = md;
2140                                 if (idx == SSL_PKEY_RSA_SIGN)
2141                                         c->pkeys[SSL_PKEY_RSA_ENC].digest = md;
2142                                 }
2143                         }
2144
2145                 }
2146
2147
2148         /* Set any remaining keys to default values. NOTE: if alg is not
2149          * supported it stays as NULL.
2150          */
2151 #ifndef OPENSSL_NO_DSA
2152         if (!c->pkeys[SSL_PKEY_DSA_SIGN].digest)
2153                 c->pkeys[SSL_PKEY_DSA_SIGN].digest = EVP_dss1();
2154 #endif
2155 #ifndef OPENSSL_NO_RSA
2156         if (!c->pkeys[SSL_PKEY_RSA_SIGN].digest)
2157                 {
2158                 c->pkeys[SSL_PKEY_RSA_SIGN].digest = EVP_sha1();
2159                 c->pkeys[SSL_PKEY_RSA_ENC].digest = EVP_sha1();
2160                 }
2161 #endif
2162 #ifndef OPENSSL_NO_ECDSA
2163         if (!c->pkeys[SSL_PKEY_ECC].digest)
2164                 c->pkeys[SSL_PKEY_ECC].digest = EVP_ecdsa();
2165 #endif
2166         return 1;
2167         }
2168
2169 #endif