ssl/t1_lib.c

   1 /* ssl/t1_lib.c */
   2 /* Copyright (C) 1995-1998 Eric Young (eay@cryptsoft.com)
   3  * All rights reserved.
   4  *
   5  * This package is an SSL implementation written
   6  * by Eric Young (eay@cryptsoft.com).
   7  * The implementation was written so as to conform with Netscapes SSL.
   8  *
   9  * This library is free for commercial and non-commercial use as long as
  10  * the following conditions are aheared to.  The following conditions
  11  * apply to all code found in this distribution, be it the RC4, RSA,
  12  * lhash, DES, etc., code; not just the SSL code.  The SSL documentation
  13  * included with this distribution is covered by the same copyright terms
  14  * except that the holder is Tim Hudson (tjh@cryptsoft.com).
  15  *
  16  * Copyright remains Eric Young's, and as such any Copyright notices in
  17  * the code are not to be removed.
  18  * If this package is used in a product, Eric Young should be given attribution
  19  * as the author of the parts of the library used.
  20  * This can be in the form of a textual message at program startup or
  21  * in documentation (online or textual) provided with the package.
  22  *
  23  * Redistribution and use in source and binary forms, with or without
  24  * modification, are permitted provided that the following conditions
  25  * are met:
  26  * 1. Redistributions of source code must retain the copyright
  27  *    notice, this list of conditions and the following disclaimer.
  28  * 2. Redistributions in binary form must reproduce the above copyright
  29  *    notice, this list of conditions and the following disclaimer in the
  30  *    documentation and/or other materials provided with the distribution.
  31  * 3. All advertising materials mentioning features or use of this software
  32  *    must display the following acknowledgement:
  33  *    "This product includes cryptographic software written by
  34  *     Eric Young (eay@cryptsoft.com)"
  35  *    The word 'cryptographic' can be left out if the rouines from the library
  36  *    being used are not cryptographic related :-).
  37  * 4. If you include any Windows specific code (or a derivative thereof) from
  38  *    the apps directory (application code) you must include an acknowledgement:
  39  *    "This product includes software written by Tim Hudson (tjh@cryptsoft.com)"
  40  *
  41  * THIS SOFTWARE IS PROVIDED BY ERIC YOUNG ``AS IS'' AND
  42  * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
  43  * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
  44  * ARE DISCLAIMED.  IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE
  45  * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
  46  * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
  47  * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
  48  * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
  49  * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
  50  * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
  51  * SUCH DAMAGE.
  52  *
  53  * The licence and distribution terms for any publically available version or
  54  * derivative of this code cannot be changed.  i.e. this code cannot simply be
  55  * copied and put under another distribution licence
  56  * [including the GNU Public Licence.]
  57  */
  58 /* ====================================================================
  59  * Copyright (c) 1998-2007 The OpenSSL Project.  All rights reserved.
  60  *
  61  * Redistribution and use in source and binary forms, with or without
  62  * modification, are permitted provided that the following conditions
  63  * are met:
  64  *
  65  * 1. Redistributions of source code must retain the above copyright
  66  *    notice, this list of conditions and the following disclaimer.
  67  *
  68  * 2. Redistributions in binary form must reproduce the above copyright
  69  *    notice, this list of conditions and the following disclaimer in
  70  *    the documentation and/or other materials provided with the
  71  *    distribution.
  72  *
  73  * 3. All advertising materials mentioning features or use of this
  74  *    software must display the following acknowledgment:
  75  *    "This product includes software developed by the OpenSSL Project
  76  *    for use in the OpenSSL Toolkit. (http://www.openssl.org/)"
  77  *
  78  * 4. The names "OpenSSL Toolkit" and "OpenSSL Project" must not be used to
  79  *    endorse or promote products derived from this software without
  80  *    prior written permission. For written permission, please contact
  81  *    openssl-core@openssl.org.
  82  *
  83  * 5. Products derived from this software may not be called "OpenSSL"
  84  *    nor may "OpenSSL" appear in their names without prior written
  85  *    permission of the OpenSSL Project.
  86  *
  87  * 6. Redistributions of any form whatsoever must retain the following
  88  *    acknowledgment:
  89  *    "This product includes software developed by the OpenSSL Project
  90  *    for use in the OpenSSL Toolkit (http://www.openssl.org/)"
  91  *
  92  * THIS SOFTWARE IS PROVIDED BY THE OpenSSL PROJECT ``AS IS'' AND ANY
  93  * EXPRESSED OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
  94  * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
  95  * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL THE OpenSSL PROJECT OR
  96  * ITS CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
  97  * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
  98  * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
  99  * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
 100  * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT,
 101  * STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
 102  * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED
 103  * OF THE POSSIBILITY OF SUCH DAMAGE.
 104  * ====================================================================
 105  *
 106  * This product includes cryptographic software written by Eric Young
 107  * (eay@cryptsoft.com).  This product includes software written by Tim
 108  * Hudson (tjh@cryptsoft.com).
 109  *
 110  */
 111
 112 #include <stdio.h>
 113 #include <openssl/objects.h>
 114 #include <openssl/evp.h>
 115 #include <openssl/hmac.h>
 116 #include <openssl/ocsp.h>
 117 #include "ssl_locl.h"
 118
 119 const char tls1_version_str[]="TLSv1" OPENSSL_VERSION_PTEXT;
 120
 121 #ifndef OPENSSL_NO_TLSEXT
 122 static int tls_decrypt_ticket(SSL *s, const unsigned char *tick, int ticklen,
 123                                 const unsigned char *sess_id, int sesslen,
 124                                 SSL_SESSION **psess);
 125 #endif
 126
 127 SSL3_ENC_METHOD TLSv1_enc_data={
 128         tls1_enc,
 129         tls1_mac,
 130         tls1_setup_key_block,
 131         tls1_generate_master_secret,
 132         tls1_change_cipher_state,
 133         tls1_final_finish_mac,
 134         TLS1_FINISH_MAC_LENGTH,
 135         tls1_cert_verify_mac,
 136         TLS_MD_CLIENT_FINISH_CONST,TLS_MD_CLIENT_FINISH_CONST_SIZE,
 137         TLS_MD_SERVER_FINISH_CONST,TLS_MD_SERVER_FINISH_CONST_SIZE,
 138         tls1_alert_code,
 139         };
 140
 141 long tls1_default_timeout(void)
 142         {
 143         /* 2 hours, the 24 hours mentioned in the TLSv1 spec
 144          * is way too long for http, the cache would over fill */
 145         return(60*60*2);
 146         }
 147
 148 int tls1_new(SSL *s)
 149         {
 150         if (!ssl3_new(s)) return(0);
 151         s->method->ssl_clear(s);
 152         return(1);
 153         }
 154
 155 void tls1_free(SSL *s)
 156         {
 157 #ifndef OPENSSL_NO_TLSEXT
 158         if (s->tlsext_session_ticket)
 159                 {
 160                 OPENSSL_free(s->tlsext_session_ticket);
 161                 }
 162 #endif /* OPENSSL_NO_TLSEXT */
 163         ssl3_free(s);
 164         }
 165
 166 void tls1_clear(SSL *s)
 167         {
 168         ssl3_clear(s);
 169         s->version = s->method->version;
 170         }
 171
 172 #ifndef OPENSSL_NO_EC
 173 static int nid_list[] =
 174         {
 175                 NID_sect163k1, /* sect163k1 (1) */
 176                 NID_sect163r1, /* sect163r1 (2) */
 177                 NID_sect163r2, /* sect163r2 (3) */
 178                 NID_sect193r1, /* sect193r1 (4) */
 179                 NID_sect193r2, /* sect193r2 (5) */
 180                 NID_sect233k1, /* sect233k1 (6) */
 181                 NID_sect233r1, /* sect233r1 (7) */
 182                 NID_sect239k1, /* sect239k1 (8) */
 183                 NID_sect283k1, /* sect283k1 (9) */
 184                 NID_sect283r1, /* sect283r1 (10) */
 185                 NID_sect409k1, /* sect409k1 (11) */
 186                 NID_sect409r1, /* sect409r1 (12) */
 187                 NID_sect571k1, /* sect571k1 (13) */
 188                 NID_sect571r1, /* sect571r1 (14) */
 189                 NID_secp160k1, /* secp160k1 (15) */
 190                 NID_secp160r1, /* secp160r1 (16) */
 191                 NID_secp160r2, /* secp160r2 (17) */
 192                 NID_secp192k1, /* secp192k1 (18) */
 193                 NID_X9_62_prime192v1, /* secp192r1 (19) */
 194                 NID_secp224k1, /* secp224k1 (20) */
 195                 NID_secp224r1, /* secp224r1 (21) */
 196                 NID_secp256k1, /* secp256k1 (22) */
 197                 NID_X9_62_prime256v1, /* secp256r1 (23) */
 198                 NID_secp384r1, /* secp384r1 (24) */
 199                 NID_secp521r1  /* secp521r1 (25) */
 200         };
 201
 202 int tls1_ec_curve_id2nid(int curve_id)
 203         {
 204         /* ECC curves from draft-ietf-tls-ecc-12.txt (Oct. 17, 2005) */
 205         if ((curve_id < 1) || ((unsigned int)curve_id >
 206                                 sizeof(nid_list)/sizeof(nid_list[0])))
 207                 return 0;
 208         return nid_list[curve_id-1];
 209         }
 210
 211 int tls1_ec_nid2curve_id(int nid)
 212         {
 213         /* ECC curves from draft-ietf-tls-ecc-12.txt (Oct. 17, 2005) */
 214         switch (nid)
 215                 {
 216         case NID_sect163k1: /* sect163k1 (1) */
 217                 return 1;
 218         case NID_sect163r1: /* sect163r1 (2) */
 219                 return 2;
 220         case NID_sect163r2: /* sect163r2 (3) */
 221                 return 3;
 222         case NID_sect193r1: /* sect193r1 (4) */
 223                 return 4;
 224         case NID_sect193r2: /* sect193r2 (5) */
 225                 return 5;
 226         case NID_sect233k1: /* sect233k1 (6) */
 227                 return 6;
 228         case NID_sect233r1: /* sect233r1 (7) */
 229                 return 7;
 230         case NID_sect239k1: /* sect239k1 (8) */
 231                 return 8;
 232         case NID_sect283k1: /* sect283k1 (9) */
 233                 return 9;
 234         case NID_sect283r1: /* sect283r1 (10) */
 235                 return 10;
 236         case NID_sect409k1: /* sect409k1 (11) */
 237                 return 11;
 238         case NID_sect409r1: /* sect409r1 (12) */
 239                 return 12;
 240         case NID_sect571k1: /* sect571k1 (13) */
 241                 return 13;
 242         case NID_sect571r1: /* sect571r1 (14) */
 243                 return 14;
 244         case NID_secp160k1: /* secp160k1 (15) */
 245                 return 15;
 246         case NID_secp160r1: /* secp160r1 (16) */
 247                 return 16;
 248         case NID_secp160r2: /* secp160r2 (17) */
 249                 return 17;
 250         case NID_secp192k1: /* secp192k1 (18) */
 251                 return 18;
 252         case NID_X9_62_prime192v1: /* secp192r1 (19) */
 253                 return 19;
 254         case NID_secp224k1: /* secp224k1 (20) */
 255                 return 20;
 256         case NID_secp224r1: /* secp224r1 (21) */
 257                 return 21;
 258         case NID_secp256k1: /* secp256k1 (22) */
 259                 return 22;
 260         case NID_X9_62_prime256v1: /* secp256r1 (23) */
 261                 return 23;
 262         case NID_secp384r1: /* secp384r1 (24) */
 263                 return 24;
 264         case NID_secp521r1:  /* secp521r1 (25) */
 265                 return 25;
 266         default:
 267                 return 0;
 268                 }
 269         }
 270 #endif /* OPENSSL_NO_EC */
 271
 272 #ifndef OPENSSL_NO_TLSEXT
 273 unsigned char *ssl_add_clienthello_tlsext(SSL *s, unsigned char *p, unsigned char *limit)
 274         {
 275         int extdatalen=0;
 276         unsigned char *ret = p;
 277
 278         /* don't add extensions for SSLv3 unless doing secure renegotiation */
 279         if (s->client_version == SSL3_VERSION
 280                                         && !s->s3->send_connection_binding)
 281                 return p;
 282
 283         ret+=2;
 284
 285         if (ret>=limit) return NULL; /* this really never occurs, but ... */
 286
 287         if (s->tlsext_hostname != NULL)
 288                 {
 289                 /* Add TLS extension servername to the Client Hello message */
 290                 unsigned long size_str;
 291                 long lenmax;
 292
 293                 /* check for enough space.
 294                    4 for the servername type and entension length
 295                    2 for servernamelist length
 296                    1 for the hostname type
 297                    2 for hostname length
 298                    + hostname length
 299                 */
 300
 301                 if ((lenmax = limit - ret - 9) < 0
 302                     || (size_str = strlen(s->tlsext_hostname)) > (unsigned long)lenmax)
 303                         return NULL;
 304
 305                 /* extension type and length */
 306                 s2n(TLSEXT_TYPE_server_name,ret);
 307                 s2n(size_str+5,ret);
 308
 309                 /* length of servername list */
 310                 s2n(size_str+3,ret);
 311
 312                 /* hostname type, length and hostname */
 313                 *(ret++) = (unsigned char) TLSEXT_NAMETYPE_host_name;
 314                 s2n(size_str,ret);
 315                 memcpy(ret, s->tlsext_hostname, size_str);
 316                 ret+=size_str;
 317                 }
 318
 319         /* Add RI if renegotiating */
 320         if (s->renegotiate)
 321           {
 322           int el;
 323
 324           if(!ssl_add_clienthello_renegotiate_ext(s, 0, &el, 0))
 325               {
 326               SSLerr(SSL_F_SSL_ADD_CLIENTHELLO_TLSEXT, ERR_R_INTERNAL_ERROR);
 327               return NULL;
 328               }
 329
 330           if((limit - p - 4 - el) < 0) return NULL;
 331
 332           s2n(TLSEXT_TYPE_renegotiate,ret);
 333           s2n(el,ret);
 334
 335           if(!ssl_add_clienthello_renegotiate_ext(s, ret, &el, el))
 336               {
 337               SSLerr(SSL_F_SSL_ADD_CLIENTHELLO_TLSEXT, ERR_R_INTERNAL_ERROR);
 338               return NULL;
 339               }
 340
 341           ret += el;
 342         }
 343
 344 #ifndef OPENSSL_NO_SRP
 345 #define MIN(x,y) (((x)<(y))?(x):(y))
 346         /* we add SRP username the first time only if we have one! */
 347         if (s->srp_ctx.login != NULL)
 348                 {/* Add TLS extension SRP username to the Client Hello message */
 349                 int login_len = MIN(strlen(s->srp_ctx.login) + 1, 255);
 350                 long lenmax;
 351
 352                 if ((lenmax = limit - ret - 5) < 0) return NULL;
 353                 if (login_len > lenmax) return NULL;
 354                 if (login_len > 255)
 355                         {
 356                         SSLerr(SSL_F_SSL_ADD_CLIENTHELLO_TLSEXT, ERR_R_INTERNAL_ERROR);
 357                         return NULL;
 358                         }
 359                 s2n(TLSEXT_TYPE_srp,ret);
 360                 s2n(login_len+1,ret);
 361
 362                 (*ret++) = (unsigned char) MIN(strlen(s->srp_ctx.login), 254);
 363                 memcpy(ret, s->srp_ctx.login, MIN(strlen(s->srp_ctx.login), 254));
 364                 ret+=login_len;
 365                 }
 366 #endif
 367
 368 #ifndef OPENSSL_NO_EC
 369         if (s->tlsext_ecpointformatlist != NULL &&
 370             s->version != DTLS1_VERSION)
 371                 {
 372                 /* Add TLS extension ECPointFormats to the ClientHello message */
 373                 long lenmax;
 374
 375                 if ((lenmax = limit - ret - 5) < 0) return NULL;
 376                 if (s->tlsext_ecpointformatlist_length > (unsigned long)lenmax) return NULL;
 377                 if (s->tlsext_ecpointformatlist_length > 255)
 378                         {
 379                         SSLerr(SSL_F_SSL_ADD_CLIENTHELLO_TLSEXT, ERR_R_INTERNAL_ERROR);
 380                         return NULL;
 381                         }
 382
 383                 s2n(TLSEXT_TYPE_ec_point_formats,ret);
 384                 s2n(s->tlsext_ecpointformatlist_length + 1,ret);
 385                 *(ret++) = (unsigned char) s->tlsext_ecpointformatlist_length;
 386                 memcpy(ret, s->tlsext_ecpointformatlist, s->tlsext_ecpointformatlist_length);
 387                 ret+=s->tlsext_ecpointformatlist_length;
 388                 }
 389         if (s->tlsext_ellipticcurvelist != NULL &&
 390             s->version != DTLS1_VERSION)
 391                 {
 392                 /* Add TLS extension EllipticCurves to the ClientHello message */
 393                 long lenmax;
 394
 395                 if ((lenmax = limit - ret - 6) < 0) return NULL;
 396                 if (s->tlsext_ellipticcurvelist_length > (unsigned long)lenmax) return NULL;
 397                 if (s->tlsext_ellipticcurvelist_length > 65532)
 398                         {
 399                         SSLerr(SSL_F_SSL_ADD_CLIENTHELLO_TLSEXT, ERR_R_INTERNAL_ERROR);
 400                         return NULL;
 401                         }
 402
 403                 s2n(TLSEXT_TYPE_elliptic_curves,ret);
 404                 s2n(s->tlsext_ellipticcurvelist_length + 2, ret);
 405
 406                 /* NB: draft-ietf-tls-ecc-12.txt uses a one-byte prefix for
 407                  * elliptic_curve_list, but the examples use two bytes.
 408                  * http://www1.ietf.org/mail-archive/web/tls/current/msg00538.html
 409                  * resolves this to two bytes.
 410                  */
 411                 s2n(s->tlsext_ellipticcurvelist_length, ret);
 412                 memcpy(ret, s->tlsext_ellipticcurvelist, s->tlsext_ellipticcurvelist_length);
 413                 ret+=s->tlsext_ellipticcurvelist_length;
 414                 }
 415 #endif /* OPENSSL_NO_EC */
 416
 417         if (!(SSL_get_options(s) & SSL_OP_NO_TICKET))
 418                 {
 419                 int ticklen;
 420                 if (!s->new_session && s->session && s->session->tlsext_tick)
 421                         ticklen = s->session->tlsext_ticklen;
 422                 else if (s->session && s->tlsext_session_ticket &&
 423                          s->tlsext_session_ticket->data)
 424                         {
 425                         ticklen = s->tlsext_session_ticket->length;
 426                         s->session->tlsext_tick = OPENSSL_malloc(ticklen);
 427                         if (!s->session->tlsext_tick)
 428                                 return NULL;
 429                         memcpy(s->session->tlsext_tick,
 430                                s->tlsext_session_ticket->data,
 431                                ticklen);
 432                         s->session->tlsext_ticklen = ticklen;
 433                         }
 434                 else
 435                         ticklen = 0;
 436                 if (ticklen == 0 && s->tlsext_session_ticket &&
 437                     s->tlsext_session_ticket->data == NULL)
 438                         goto skip_ext;
 439                 /* Check for enough room 2 for extension type, 2 for len
 440                  * rest for ticket
 441                  */
 442                 if ((long)(limit - ret - 4 - ticklen) < 0) return NULL;
 443                 s2n(TLSEXT_TYPE_session_ticket,ret);
 444                 s2n(ticklen,ret);
 445                 if (ticklen)
 446                         {
 447                         memcpy(ret, s->session->tlsext_tick, ticklen);
 448                         ret += ticklen;
 449                         }
 450                 }
 451                 skip_ext:
 452
 453 #ifdef TLSEXT_TYPE_opaque_prf_input
 454         if (s->s3->client_opaque_prf_input != NULL &&
 455             s->version != DTLS1_VERSION)
 456                 {
 457                 size_t col = s->s3->client_opaque_prf_input_len;
 458
 459                 if ((long)(limit - ret - 6 - col < 0))
 460                         return NULL;
 461                 if (col > 0xFFFD) /* can't happen */
 462                         return NULL;
 463
 464                 s2n(TLSEXT_TYPE_opaque_prf_input, ret);
 465                 s2n(col + 2, ret);
 466                 s2n(col, ret);
 467                 memcpy(ret, s->s3->client_opaque_prf_input, col);
 468                 ret += col;
 469                 }
 470 #endif
 471
 472         if (s->tlsext_status_type == TLSEXT_STATUSTYPE_ocsp &&
 473             s->version != DTLS1_VERSION)
 474                 {
 475                 int i;
 476                 long extlen, idlen, itmp;
 477                 OCSP_RESPID *id;
 478
 479                 idlen = 0;
 480                 for (i = 0; i < sk_OCSP_RESPID_num(s->tlsext_ocsp_ids); i++)
 481                         {
 482                         id = sk_OCSP_RESPID_value(s->tlsext_ocsp_ids, i);
 483                         itmp = i2d_OCSP_RESPID(id, NULL);
 484                         if (itmp <= 0)
 485                                 return NULL;
 486                         idlen += itmp + 2;
 487                         }
 488
 489                 if (s->tlsext_ocsp_exts)
 490                         {
 491                         extlen = i2d_X509_EXTENSIONS(s->tlsext_ocsp_exts, NULL);
 492                         if (extlen < 0)
 493                                 return NULL;
 494                         }
 495                 else
 496                         extlen = 0;
 497
 498                 if ((long)(limit - ret - 7 - extlen - idlen) < 0) return NULL;
 499                 s2n(TLSEXT_TYPE_status_request, ret);
 500                 if (extlen + idlen > 0xFFF0)
 501                         return NULL;
 502                 s2n(extlen + idlen + 5, ret);
 503                 *(ret++) = TLSEXT_STATUSTYPE_ocsp;
 504                 s2n(idlen, ret);
 505                 for (i = 0; i < sk_OCSP_RESPID_num(s->tlsext_ocsp_ids); i++)
 506                         {
 507                         /* save position of id len */
 508                         unsigned char *q = ret;
 509                         id = sk_OCSP_RESPID_value(s->tlsext_ocsp_ids, i);
 510                         /* skip over id len */
 511                         ret += 2;
 512                         itmp = i2d_OCSP_RESPID(id, &ret);
 513                         /* write id len */
 514                         s2n(itmp, q);
 515                         }
 516                 s2n(extlen, ret);
 517                 if (extlen > 0)
 518                         i2d_X509_EXTENSIONS(s->tlsext_ocsp_exts, &ret);
 519                 }
 520
 521         if ((extdatalen = ret-p-2)== 0)
 522                 return p;
 523
 524         s2n(extdatalen,p);
 525         return ret;
 526         }
 527
 528 unsigned char *ssl_add_serverhello_tlsext(SSL *s, unsigned char *p, unsigned char *limit)
 529         {
 530         int extdatalen=0;
 531         unsigned char *ret = p;
 532
 533         /* don't add extensions for SSLv3, unless doing secure renegotiation */
 534         if (s->version == SSL3_VERSION && !s->s3->send_connection_binding)
 535                 return p;
 536
 537         ret+=2;
 538         if (ret>=limit) return NULL; /* this really never occurs, but ... */
 539
 540         if (!s->hit && s->servername_done == 1 && s->session->tlsext_hostname != NULL)
 541                 {
 542                 if ((long)(limit - ret - 4) < 0) return NULL;
 543
 544                 s2n(TLSEXT_TYPE_server_name,ret);
 545                 s2n(0,ret);
 546                 }
 547
 548         if(s->s3->send_connection_binding)
 549         {
 550           int el;
 551
 552           if(!ssl_add_serverhello_renegotiate_ext(s, 0, &el, 0))
 553               {
 554               SSLerr(SSL_F_SSL_ADD_SERVERHELLO_TLSEXT, ERR_R_INTERNAL_ERROR);
 555               return NULL;
 556               }
 557
 558           if((limit - p - 4 - el) < 0) return NULL;
 559
 560           s2n(TLSEXT_TYPE_renegotiate,ret);
 561           s2n(el,ret);
 562
 563           if(!ssl_add_serverhello_renegotiate_ext(s, ret, &el, el))
 564               {
 565               SSLerr(SSL_F_SSL_ADD_SERVERHELLO_TLSEXT, ERR_R_INTERNAL_ERROR);
 566               return NULL;
 567               }
 568
 569           ret += el;
 570         }
 571
 572 #ifndef OPENSSL_NO_EC
 573         if (s->tlsext_ecpointformatlist != NULL &&
 574             s->version != DTLS1_VERSION)
 575                 {
 576                 /* Add TLS extension ECPointFormats to the ServerHello message */
 577                 long lenmax;
 578
 579                 if ((lenmax = limit - ret - 5) < 0) return NULL;
 580                 if (s->tlsext_ecpointformatlist_length > (unsigned long)lenmax) return NULL;
 581                 if (s->tlsext_ecpointformatlist_length > 255)
 582                         {
 583                         SSLerr(SSL_F_SSL_ADD_SERVERHELLO_TLSEXT, ERR_R_INTERNAL_ERROR);
 584                         return NULL;
 585                         }
 586
 587                 s2n(TLSEXT_TYPE_ec_point_formats,ret);
 588                 s2n(s->tlsext_ecpointformatlist_length + 1,ret);
 589                 *(ret++) = (unsigned char) s->tlsext_ecpointformatlist_length;
 590                 memcpy(ret, s->tlsext_ecpointformatlist, s->tlsext_ecpointformatlist_length);
 591                 ret+=s->tlsext_ecpointformatlist_length;
 592
 593                 }
 594         /* Currently the server should not respond with a SupportedCurves extension */
 595 #endif /* OPENSSL_NO_EC */
 596
 597         if (s->tlsext_ticket_expected
 598                 && !(SSL_get_options(s) & SSL_OP_NO_TICKET))
 599                 {
 600                 if ((long)(limit - ret - 4) < 0) return NULL;
 601                 s2n(TLSEXT_TYPE_session_ticket,ret);
 602                 s2n(0,ret);
 603                 }
 604
 605         if (s->tlsext_status_expected)
 606                 {
 607                 if ((long)(limit - ret - 4) < 0) return NULL;
 608                 s2n(TLSEXT_TYPE_status_request,ret);
 609                 s2n(0,ret);
 610                 }
 611
 612 #ifdef TLSEXT_TYPE_opaque_prf_input
 613         if (s->s3->server_opaque_prf_input != NULL &&
 614             s->version != DTLS1_VERSION)
 615                 {
 616                 size_t sol = s->s3->server_opaque_prf_input_len;
 617
 618                 if ((long)(limit - ret - 6 - sol) < 0)
 619                         return NULL;
 620                 if (sol > 0xFFFD) /* can't happen */
 621                         return NULL;
 622
 623                 s2n(TLSEXT_TYPE_opaque_prf_input, ret);
 624                 s2n(sol + 2, ret);
 625                 s2n(sol, ret);
 626                 memcpy(ret, s->s3->server_opaque_prf_input, sol);
 627                 ret += sol;
 628                 }
 629 #endif
 630         if (((s->s3->tmp.new_cipher->id & 0xFFFF)==0x80 || (s->s3->tmp.new_cipher->id & 0xFFFF)==0x81)
 631                 && (SSL_get_options(s) & SSL_OP_CRYPTOPRO_TLSEXT_BUG))
 632                 { const unsigned char cryptopro_ext[36] = {
 633                         0xfd, 0xe8, /*65000*/
 634                         0x00, 0x20, /*32 bytes length*/
 635                         0x30, 0x1e, 0x30, 0x08, 0x06, 0x06, 0x2a, 0x85,
 636                         0x03,   0x02, 0x02, 0x09, 0x30, 0x08, 0x06, 0x06,
 637                         0x2a, 0x85, 0x03, 0x02, 0x02, 0x16, 0x30, 0x08,
 638                         0x06, 0x06, 0x2a, 0x85, 0x03, 0x02, 0x02, 0x17};
 639                         if (limit-ret<36) return NULL;
 640                         memcpy(ret,cryptopro_ext,36);
 641                         ret+=36;
 642
 643                 }
 644
 645         if ((extdatalen = ret-p-2)== 0)
 646                 return p;
 647
 648         s2n(extdatalen,p);
 649         return ret;
 650         }
 651
 652 int ssl_parse_clienthello_tlsext(SSL *s, unsigned char **p, unsigned char *d, int n, int *al)
 653         {
 654         unsigned short type;
 655         unsigned short size;
 656         unsigned short len;
 657         unsigned char *data = *p;
 658         int renegotiate_seen = 0;
 659
 660         s->servername_done = 0;
 661         s->tlsext_status_type = -1;
 662
 663         if (data >= (d+n-2))
 664                 goto ri_check;
 665         n2s(data,len);
 666
 667         if (data > (d+n-len))
 668                 goto ri_check;
 669
 670         while (data <= (d+n-4))
 671                 {
 672                 n2s(data,type);
 673                 n2s(data,size);
 674
 675                 if (data+size > (d+n))
 676                         goto ri_check;
 677 #if 0
 678                 fprintf(stderr,"Received extension type %d size %d\n",type,size);
 679 #endif
 680                 if (s->tlsext_debug_cb)
 681                         s->tlsext_debug_cb(s, 0, type, data, size,
 682                                                 s->tlsext_debug_arg);
 683 /* The servername extension is treated as follows:
 684
 685    - Only the hostname type is supported with a maximum length of 255.
 686    - The servername is rejected if too long or if it contains zeros,
 687      in which case an fatal alert is generated.
 688    - The servername field is maintained together with the session cache.
 689    - When a session is resumed, the servername call back invoked in order
 690      to allow the application to position itself to the right context.
 691    - The servername is acknowledged if it is new for a session or when
 692      it is identical to a previously used for the same session.
 693      Applications can control the behaviour.  They can at any time
 694      set a 'desirable' servername for a new SSL object. This can be the
 695      case for example with HTTPS when a Host: header field is received and
 696      a renegotiation is requested. In this case, a possible servername
 697      presented in the new client hello is only acknowledged if it matches
 698      the value of the Host: field.
 699    - Applications must  use SSL_OP_NO_SESSION_RESUMPTION_ON_RENEGOTIATION
 700      if they provide for changing an explicit servername context for the session,
 701      i.e. when the session has been established with a servername extension.
 702    - On session reconnect, the servername extension may be absent.
 703
 704 */
 705
 706                 if (type == TLSEXT_TYPE_server_name)
 707                         {
 708                         unsigned char *sdata;
 709                         int servname_type;
 710                         int dsize;
 711
 712                         if (size < 2)
 713                                 {
 714                                 *al = SSL_AD_DECODE_ERROR;
 715                                 return 0;
 716                                 }
 717                         n2s(data,dsize);
 718                         size -= 2;
 719                         if (dsize > size  )
 720                                 {
 721                                 *al = SSL_AD_DECODE_ERROR;
 722                                 return 0;
 723                                 }
 724
 725                         sdata = data;
 726                         while (dsize > 3)
 727                                 {
 728                                 servname_type = *(sdata++);
 729                                 n2s(sdata,len);
 730                                 dsize -= 3;
 731
 732                                 if (len > dsize)
 733                                         {
 734                                         *al = SSL_AD_DECODE_ERROR;
 735                                         return 0;
 736                                         }
 737                                 if (s->servername_done == 0)
 738                                 switch (servname_type)
 739                                         {
 740                                 case TLSEXT_NAMETYPE_host_name:
 741                                         if (!s->hit)
 742                                                 {
 743                                                 if(s->session->tlsext_hostname)
 744                                                         {
 745                                                         *al = SSL_AD_DECODE_ERROR;
 746                                                         return 0;
 747                                                         }
 748                                                 if (len > TLSEXT_MAXLEN_host_name)
 749                                                         {
 750                                                         *al = TLS1_AD_UNRECOGNIZED_NAME;
 751                                                         return 0;
 752                                                         }
 753                                                 if ((s->session->tlsext_hostname = OPENSSL_malloc(len+1)) == NULL)
 754                                                         {
 755                                                         *al = TLS1_AD_INTERNAL_ERROR;
 756                                                         return 0;
 757                                                         }
 758                                                 memcpy(s->session->tlsext_hostname, sdata, len);
 759                                                 s->session->tlsext_hostname[len]='\0';
 760                                                 if (strlen(s->session->tlsext_hostname) != len) {
 761                                                         OPENSSL_free(s->session->tlsext_hostname);
 762                                                         s->session->tlsext_hostname = NULL;
 763                                                         *al = TLS1_AD_UNRECOGNIZED_NAME;
 764                                                         return 0;
 765                                                 }
 766                                                 s->servername_done = 1;
 767
 768                                                 }
 769                                         else
 770                                                 s->servername_done = s->session->tlsext_hostname
 771                                                         && strlen(s->session->tlsext_hostname) == len
 772                                                         && strncmp(s->session->tlsext_hostname, (char *)sdata, len) == 0;
 773
 774                                         break;
 775
 776                                 default:
 777                                         break;
 778                                         }
 779
 780                                 dsize -= len;
 781                                 }
 782                         if (dsize != 0)
 783                                 {
 784                                 *al = SSL_AD_DECODE_ERROR;
 785                                 return 0;
 786                                 }
 787
 788                         }
 789 #ifndef OPENSSL_NO_SRP
 790                 else if (type == TLSEXT_TYPE_srp)
 791                         {
 792                         if (size > 0)
 793                                 {
 794                                 len = data[0];
 795                                 if ((s->srp_ctx.login = OPENSSL_malloc(len+1)) == NULL)
 796                                         return -1;
 797                                 memcpy(s->srp_ctx.login, &data[1], len);
 798                                 s->srp_ctx.login[len]='\0';
 799                                 }
 800                         }
 801 #endif
 802
 803 #ifndef OPENSSL_NO_EC
 804                 else if (type == TLSEXT_TYPE_ec_point_formats &&
 805                      s->version != DTLS1_VERSION)
 806                         {
 807                         unsigned char *sdata = data;
 808                         int ecpointformatlist_length = *(sdata++);
 809
 810                         if (ecpointformatlist_length != size - 1)
 811                                 {
 812                                 *al = TLS1_AD_DECODE_ERROR;
 813                                 return 0;
 814                                 }
 815                         if (!s->hit)
 816                                 {
 817                                 if(s->session->tlsext_ecpointformatlist)
 818                                         {
 819                                         OPENSSL_free(s->session->tlsext_ecpointformatlist);
 820                                         s->session->tlsext_ecpointformatlist = NULL;
 821                                         }
 822                                 s->session->tlsext_ecpointformatlist_length = 0;
 823                                 if ((s->session->tlsext_ecpointformatlist = OPENSSL_malloc(ecpointformatlist_length)) == NULL)
 824                                         {
 825                                         *al = TLS1_AD_INTERNAL_ERROR;
 826                                         return 0;
 827                                         }
 828                                 s->session->tlsext_ecpointformatlist_length = ecpointformatlist_length;
 829                                 memcpy(s->session->tlsext_ecpointformatlist, sdata, ecpointformatlist_length);
 830                                 }
 831 #if 0
 832                         fprintf(stderr,"ssl_parse_clienthello_tlsext s->session->tlsext_ecpointformatlist (length=%i) ", s->session->tlsext_ecpointformatlist_length);
 833                         sdata = s->session->tlsext_ecpointformatlist;
 834                         for (i = 0; i < s->session->tlsext_ecpointformatlist_length; i++)
 835                                 fprintf(stderr,"%i ",*(sdata++));
 836                         fprintf(stderr,"\n");
 837 #endif
 838                         }
 839                 else if (type == TLSEXT_TYPE_elliptic_curves &&
 840                      s->version != DTLS1_VERSION)
 841                         {
 842                         unsigned char *sdata = data;
 843                         int ellipticcurvelist_length = (*(sdata++) << 8);
 844                         ellipticcurvelist_length += (*(sdata++));
 845
 846                         if (ellipticcurvelist_length != size - 2)
 847                                 {
 848                                 *al = TLS1_AD_DECODE_ERROR;
 849                                 return 0;
 850                                 }
 851                         if (!s->hit)
 852                                 {
 853                                 if(s->session->tlsext_ellipticcurvelist)
 854                                         {
 855                                         *al = TLS1_AD_DECODE_ERROR;
 856                                         return 0;
 857                                         }
 858                                 s->session->tlsext_ellipticcurvelist_length = 0;
 859                                 if ((s->session->tlsext_ellipticcurvelist = OPENSSL_malloc(ellipticcurvelist_length)) == NULL)
 860                                         {
 861                                         *al = TLS1_AD_INTERNAL_ERROR;
 862                                         return 0;
 863                                         }
 864                                 s->session->tlsext_ellipticcurvelist_length = ellipticcurvelist_length;
 865                                 memcpy(s->session->tlsext_ellipticcurvelist, sdata, ellipticcurvelist_length);
 866                                 }
 867 #if 0
 868                         fprintf(stderr,"ssl_parse_clienthello_tlsext s->session->tlsext_ellipticcurvelist (length=%i) ", s->session->tlsext_ellipticcurvelist_length);
 869                         sdata = s->session->tlsext_ellipticcurvelist;
 870                         for (i = 0; i < s->session->tlsext_ellipticcurvelist_length; i++)
 871                                 fprintf(stderr,"%i ",*(sdata++));
 872                         fprintf(stderr,"\n");
 873 #endif
 874                         }
 875 #endif /* OPENSSL_NO_EC */
 876 #ifdef TLSEXT_TYPE_opaque_prf_input
 877                 else if (type == TLSEXT_TYPE_opaque_prf_input &&
 878                      s->version != DTLS1_VERSION)
 879                         {
 880                         unsigned char *sdata = data;
 881
 882                         if (size < 2)
 883                                 {
 884                                 *al = SSL_AD_DECODE_ERROR;
 885                                 return 0;
 886                                 }
 887                         n2s(sdata, s->s3->client_opaque_prf_input_len);
 888                         if (s->s3->client_opaque_prf_input_len != size - 2)
 889                                 {
 890                                 *al = SSL_AD_DECODE_ERROR;
 891                                 return 0;
 892                                 }
 893
 894                         if (s->s3->client_opaque_prf_input != NULL) /* shouldn't really happen */
 895                                 OPENSSL_free(s->s3->client_opaque_prf_input);
 896                         if (s->s3->client_opaque_prf_input_len == 0)
 897                                 s->s3->client_opaque_prf_input = OPENSSL_malloc(1); /* dummy byte just to get non-NULL */
 898                         else
 899                                 s->s3->client_opaque_prf_input = BUF_memdup(sdata, s->s3->client_opaque_prf_input_len);
 900                         if (s->s3->client_opaque_prf_input == NULL)
 901                                 {
 902                                 *al = TLS1_AD_INTERNAL_ERROR;
 903                                 return 0;
 904                                 }
 905                         }
 906 #endif
 907                 else if (type == TLSEXT_TYPE_session_ticket)
 908                         {
 909                         if (s->tls_session_ticket_ext_cb &&
 910                             !s->tls_session_ticket_ext_cb(s, data, size, s->tls_session_ticket_ext_cb_arg))
 911                                 {
 912                                 *al = TLS1_AD_INTERNAL_ERROR;
 913                                 return 0;
 914                                 }
 915                         }
 916                 else if (type == TLSEXT_TYPE_renegotiate)
 917                         {
 918                         if(!ssl_parse_clienthello_renegotiate_ext(s, data, size, al))
 919                                 return 0;
 920                         renegotiate_seen = 1;
 921                         }
 922                 else if (type == TLSEXT_TYPE_status_request &&
 923                          s->version != DTLS1_VERSION && s->ctx->tlsext_status_cb)
 924                         {
 925
 926                         if (size < 5)
 927                                 {
 928                                 *al = SSL_AD_DECODE_ERROR;
 929                                 return 0;
 930                                 }
 931
 932                         s->tlsext_status_type = *data++;
 933                         size--;
 934                         if (s->tlsext_status_type == TLSEXT_STATUSTYPE_ocsp)
 935                                 {
 936                                 const unsigned char *sdata;
 937                                 int dsize;
 938                                 /* Read in responder_id_list */
 939                                 n2s(data,dsize);
 940                                 size -= 2;
 941                                 if (dsize > size  )
 942                                         {
 943                                         *al = SSL_AD_DECODE_ERROR;
 944                                         return 0;
 945                                         }
 946                                 while (dsize > 0)
 947                                         {
 948                                         OCSP_RESPID *id;
 949                                         int idsize;
 950                                         if (dsize < 4)
 951                                                 {
 952                                                 *al = SSL_AD_DECODE_ERROR;
 953                                                 return 0;
 954                                                 }
 955                                         n2s(data, idsize);
 956                                         dsize -= 2 + idsize;
 957                                         size -= 2 + idsize;
 958                                         if (dsize < 0)
 959                                                 {
 960                                                 *al = SSL_AD_DECODE_ERROR;
 961                                                 return 0;
 962                                                 }
 963                                         sdata = data;
 964                                         data += idsize;
 965                                         id = d2i_OCSP_RESPID(NULL,
 966                                                                 &sdata, idsize);
 967                                         if (!id)
 968                                                 {
 969                                                 *al = SSL_AD_DECODE_ERROR;
 970                                                 return 0;
 971                                                 }
 972                                         if (data != sdata)
 973                                                 {
 974                                                 OCSP_RESPID_free(id);
 975                                                 *al = SSL_AD_DECODE_ERROR;
 976                                                 return 0;
 977                                                 }
 978                                         if (!s->tlsext_ocsp_ids
 979                                                 && !(s->tlsext_ocsp_ids =
 980                                                 sk_OCSP_RESPID_new_null()))
 981                                                 {
 982                                                 OCSP_RESPID_free(id);
 983                                                 *al = SSL_AD_INTERNAL_ERROR;
 984                                                 return 0;
 985                                                 }
 986                                         if (!sk_OCSP_RESPID_push(
 987                                                         s->tlsext_ocsp_ids, id))
 988                                                 {
 989                                                 OCSP_RESPID_free(id);
 990                                                 *al = SSL_AD_INTERNAL_ERROR;
 991                                                 return 0;
 992                                                 }
 993                                         }
 994
 995                                 /* Read in request_extensions */
 996                                 if (size < 2)
 997                                         {
 998                                         *al = SSL_AD_DECODE_ERROR;
 999                                         return 0;
1000                                         }
1001                                 n2s(data,dsize);
1002                                 size -= 2;
1003                                 if (dsize != size)
1004                                         {
1005                                         *al = SSL_AD_DECODE_ERROR;
1006                                         return 0;
1007                                         }
1008                                 sdata = data;
1009                                 if (dsize > 0)
1010                                         {
1011                                         s->tlsext_ocsp_exts =
1012                                                 d2i_X509_EXTENSIONS(NULL,
1013                                                         &sdata, dsize);
1014                                         if (!s->tlsext_ocsp_exts
1015                                                 || (data + dsize != sdata))
1016                                                 {
1017                                                 *al = SSL_AD_DECODE_ERROR;
1018                                                 return 0;
1019                                                 }
1020                                         }
1021                                 }
1022                                 /* We don't know what to do with any other type
1023                                 * so ignore it.
1024                                 */
1025                                 else
1026                                         s->tlsext_status_type = -1;
1027                         }
1028
1029                 /* session ticket processed earlier */
1030                 data+=size;
1031                 }
1032
1033         *p = data;
1034
1035         ri_check:
1036
1037         /* Need RI if renegotiating */
1038
1039         if (!renegotiate_seen && s->renegotiate &&
1040                 !(s->options & SSL_OP_ALLOW_UNSAFE_LEGACY_RENEGOTIATION))
1041                 {
1042                 *al = SSL_AD_HANDSHAKE_FAILURE;
1043                 SSLerr(SSL_F_SSL_PARSE_CLIENTHELLO_TLSEXT,
1044                                 SSL_R_UNSAFE_LEGACY_RENEGOTIATION_DISABLED);
1045                 return 0;
1046                 }
1047
1048         return 1;
1049         }
1050
1051 int ssl_parse_serverhello_tlsext(SSL *s, unsigned char **p, unsigned char *d, int n, int *al)
1052         {
1053         unsigned short length;
1054         unsigned short type;
1055         unsigned short size;
1056         unsigned char *data = *p;
1057         int tlsext_servername = 0;
1058         int renegotiate_seen = 0;
1059
1060         if (data >= (d+n-2))
1061                 goto ri_check;
1062
1063         n2s(data,length);
1064         if (data+length != d+n)
1065                 {
1066                 *al = SSL_AD_DECODE_ERROR;
1067                 return 0;
1068                 }
1069
1070         while(data <= (d+n-4))
1071                 {
1072                 n2s(data,type);
1073                 n2s(data,size);
1074
1075                 if (data+size > (d+n))
1076                         goto ri_check;
1077
1078                 if (s->tlsext_debug_cb)
1079                         s->tlsext_debug_cb(s, 1, type, data, size,
1080                                                 s->tlsext_debug_arg);
1081
1082                 if (type == TLSEXT_TYPE_server_name)
1083                         {
1084                         if (s->tlsext_hostname == NULL || size > 0)
1085                                 {
1086                                 *al = TLS1_AD_UNRECOGNIZED_NAME;
1087                                 return 0;
1088                                 }
1089                         tlsext_servername = 1;
1090                         }
1091
1092 #ifndef OPENSSL_NO_EC
1093                 else if (type == TLSEXT_TYPE_ec_point_formats &&
1094                      s->version != DTLS1_VERSION)
1095                         {
1096                         unsigned char *sdata = data;
1097                         int ecpointformatlist_length = *(sdata++);
1098
1099                         if (ecpointformatlist_length != size - 1)
1100                                 {
1101                                 *al = TLS1_AD_DECODE_ERROR;
1102                                 return 0;
1103                                 }
1104                         s->session->tlsext_ecpointformatlist_length = 0;
1105                         if (s->session->tlsext_ecpointformatlist != NULL) OPENSSL_free(s->session->tlsext_ecpointformatlist);
1106                         if ((s->session->tlsext_ecpointformatlist = OPENSSL_malloc(ecpointformatlist_length)) == NULL)
1107                                 {
1108                                 *al = TLS1_AD_INTERNAL_ERROR;
1109                                 return 0;
1110                                 }
1111                         s->session->tlsext_ecpointformatlist_length = ecpointformatlist_length;
1112                         memcpy(s->session->tlsext_ecpointformatlist, sdata, ecpointformatlist_length);
1113 #if 0
1114                         fprintf(stderr,"ssl_parse_serverhello_tlsext s->session->tlsext_ecpointformatlist ");
1115                         sdata = s->session->tlsext_ecpointformatlist;
1116                         for (i = 0; i < s->session->tlsext_ecpointformatlist_length; i++)
1117                                 fprintf(stderr,"%i ",*(sdata++));
1118                         fprintf(stderr,"\n");
1119 #endif
1120                         }
1121 #endif /* OPENSSL_NO_EC */
1122
1123                 else if (type == TLSEXT_TYPE_session_ticket)
1124                         {
1125                         if (s->tls_session_ticket_ext_cb &&
1126                             !s->tls_session_ticket_ext_cb(s, data, size, s->tls_session_ticket_ext_cb_arg))
1127                                 {
1128                                 *al = TLS1_AD_INTERNAL_ERROR;
1129                                 return 0;
1130                                 }
1131                         if ((SSL_get_options(s) & SSL_OP_NO_TICKET)
1132                                 || (size > 0))
1133                                 {
1134                                 *al = TLS1_AD_UNSUPPORTED_EXTENSION;
1135                                 return 0;
1136                                 }
1137                         s->tlsext_ticket_expected = 1;
1138                         }
1139 #ifdef TLSEXT_TYPE_opaque_prf_input
1140                 else if (type == TLSEXT_TYPE_opaque_prf_input &&
1141                      s->version != DTLS1_VERSION)
1142                         {
1143                         unsigned char *sdata = data;
1144
1145                         if (size < 2)
1146                                 {
1147                                 *al = SSL_AD_DECODE_ERROR;
1148                                 return 0;
1149                                 }
1150                         n2s(sdata, s->s3->server_opaque_prf_input_len);
1151                         if (s->s3->server_opaque_prf_input_len != size - 2)
1152                                 {
1153                                 *al = SSL_AD_DECODE_ERROR;
1154                                 return 0;
1155                                 }
1156
1157                         if (s->s3->server_opaque_prf_input != NULL) /* shouldn't really happen */
1158                                 OPENSSL_free(s->s3->server_opaque_prf_input);
1159                         if (s->s3->server_opaque_prf_input_len == 0)
1160                                 s->s3->server_opaque_prf_input = OPENSSL_malloc(1); /* dummy byte just to get non-NULL */
1161                         else
1162                                 s->s3->server_opaque_prf_input = BUF_memdup(sdata, s->s3->server_opaque_prf_input_len);
1163
1164                         if (s->s3->server_opaque_prf_input == NULL)
1165                                 {
1166                                 *al = TLS1_AD_INTERNAL_ERROR;
1167                                 return 0;
1168                                 }
1169                         }
1170 #endif
1171                 else if (type == TLSEXT_TYPE_status_request &&
1172                          s->version != DTLS1_VERSION)
1173                         {
1174                         /* MUST be empty and only sent if we've requested
1175                          * a status request message.
1176                          */
1177                         if ((s->tlsext_status_type == -1) || (size > 0))
1178                                 {
1179                                 *al = TLS1_AD_UNSUPPORTED_EXTENSION;
1180                                 return 0;
1181                                 }
1182                         /* Set flag to expect CertificateStatus message */
1183                         s->tlsext_status_expected = 1;
1184                         }
1185                 else if (type == TLSEXT_TYPE_renegotiate)
1186                         {
1187                         if(!ssl_parse_serverhello_renegotiate_ext(s, data, size, al))
1188                                 return 0;
1189                         renegotiate_seen = 1;
1190                         }
1191                 data+=size;
1192                 }
1193
1194         if (data != d+n)
1195                 {
1196                 *al = SSL_AD_DECODE_ERROR;
1197                 return 0;
1198                 }
1199
1200         if (!s->hit && tlsext_servername == 1)
1201                 {
1202                 if (s->tlsext_hostname)
1203                         {
1204                         if (s->session->tlsext_hostname == NULL)
1205                                 {
1206                                 s->session->tlsext_hostname = BUF_strdup(s->tlsext_hostname);
1207                                 if (!s->session->tlsext_hostname)
1208                                         {
1209                                         *al = SSL_AD_UNRECOGNIZED_NAME;
1210                                         return 0;
1211                                         }
1212                                 }
1213                         else
1214                                 {
1215                                 *al = SSL_AD_DECODE_ERROR;
1216                                 return 0;
1217                                 }
1218                         }
1219                 }
1220
1221         *p = data;
1222
1223         ri_check:
1224
1225         /* Determine if we need to see RI. Strictly speaking if we want to
1226          * avoid an attack we should *always* see RI even on initial server
1227          * hello because the client doesn't see any renegotiation during an
1228          * attack. However this would mean we could not connect to any server
1229          * which doesn't support RI so for the immediate future tolerate RI
1230          * absence on initial connect only.
1231          */
1232         if (!renegotiate_seen
1233                 && !(s->options & SSL_OP_LEGACY_SERVER_CONNECT)
1234                 && !(s->options & SSL_OP_ALLOW_UNSAFE_LEGACY_RENEGOTIATION))
1235                 {
1236                 *al = SSL_AD_HANDSHAKE_FAILURE;
1237                 SSLerr(SSL_F_SSL_PARSE_SERVERHELLO_TLSEXT,
1238                                 SSL_R_UNSAFE_LEGACY_RENEGOTIATION_DISABLED);
1239                 return 0;
1240                 }
1241
1242         return 1;
1243         }
1244
1245
1246 int ssl_prepare_clienthello_tlsext(SSL *s)
1247         {
1248 #ifndef OPENSSL_NO_EC
1249         /* If we are client and using an elliptic curve cryptography cipher suite, send the point formats
1250          * and elliptic curves we support.
1251          */
1252         int using_ecc = 0;
1253         int i;
1254         unsigned char *j;
1255         unsigned long alg_k, alg_a;
1256         STACK_OF(SSL_CIPHER) *cipher_stack = SSL_get_ciphers(s);
1257
1258         for (i = 0; i < sk_SSL_CIPHER_num(cipher_stack); i++)
1259                 {
1260                 SSL_CIPHER *c = sk_SSL_CIPHER_value(cipher_stack, i);
1261
1262                 alg_k = c->algorithm_mkey;
1263                 alg_a = c->algorithm_auth;
1264                 if ((alg_k & (SSL_kEECDH|SSL_kECDHr|SSL_kECDHe) || (alg_a & SSL_aECDSA)))
1265                         {
1266                         using_ecc = 1;
1267                         break;
1268                         }
1269                 }
1270         using_ecc = using_ecc && (s->version >= TLS1_VERSION);
1271         if (using_ecc)
1272                 {
1273                 if (s->tlsext_ecpointformatlist != NULL) OPENSSL_free(s->tlsext_ecpointformatlist);
1274                 if ((s->tlsext_ecpointformatlist = OPENSSL_malloc(3)) == NULL)
1275                         {
1276                         SSLerr(SSL_F_SSL_PREPARE_CLIENTHELLO_TLSEXT,ERR_R_MALLOC_FAILURE);
1277                         return -1;
1278                         }
1279                 s->tlsext_ecpointformatlist_length = 3;
1280                 s->tlsext_ecpointformatlist[0] = TLSEXT_ECPOINTFORMAT_uncompressed;
1281                 s->tlsext_ecpointformatlist[1] = TLSEXT_ECPOINTFORMAT_ansiX962_compressed_prime;
1282                 s->tlsext_ecpointformatlist[2] = TLSEXT_ECPOINTFORMAT_ansiX962_compressed_char2;
1283
1284                 /* we support all named elliptic curves in draft-ietf-tls-ecc-12 */
1285                 if (s->tlsext_ellipticcurvelist != NULL) OPENSSL_free(s->tlsext_ellipticcurvelist);
1286                 s->tlsext_ellipticcurvelist_length = sizeof(nid_list)/sizeof(nid_list[0]) * 2;
1287                 if ((s->tlsext_ellipticcurvelist = OPENSSL_malloc(s->tlsext_ellipticcurvelist_length)) == NULL)
1288                         {
1289                         s->tlsext_ellipticcurvelist_length = 0;
1290                         SSLerr(SSL_F_SSL_PREPARE_CLIENTHELLO_TLSEXT,ERR_R_MALLOC_FAILURE);
1291                         return -1;
1292                         }
1293                 for (i = 1, j = s->tlsext_ellipticcurvelist; (unsigned int)i <=
1294                                 sizeof(nid_list)/sizeof(nid_list[0]); i++)
1295                         s2n(i,j);
1296                 }
1297 #endif /* OPENSSL_NO_EC */
1298
1299 #ifdef TLSEXT_TYPE_opaque_prf_input
1300         {
1301                 int r = 1;
1302
1303                 if (s->ctx->tlsext_opaque_prf_input_callback != 0)
1304                         {
1305                         r = s->ctx->tlsext_opaque_prf_input_callback(s, NULL, 0, s->ctx->tlsext_opaque_prf_input_callback_arg);
1306                         if (!r)
1307                                 return -1;
1308                         }
1309
1310                 if (s->tlsext_opaque_prf_input != NULL)
1311                         {
1312                         if (s->s3->client_opaque_prf_input != NULL) /* shouldn't really happen */
1313                                 OPENSSL_free(s->s3->client_opaque_prf_input);
1314
1315                         if (s->tlsext_opaque_prf_input_len == 0)
1316                                 s->s3->client_opaque_prf_input = OPENSSL_malloc(1); /* dummy byte just to get non-NULL */
1317                         else
1318                                 s->s3->client_opaque_prf_input = BUF_memdup(s->tlsext_opaque_prf_input, s->tlsext_opaque_prf_input_len);
1319                         if (s->s3->client_opaque_prf_input == NULL)
1320                                 {
1321                                 SSLerr(SSL_F_SSL_PREPARE_CLIENTHELLO_TLSEXT,ERR_R_MALLOC_FAILURE);
1322                                 return -1;
1323                                 }
1324                         s->s3->client_opaque_prf_input_len = s->tlsext_opaque_prf_input_len;
1325                         }
1326
1327                 if (r == 2)
1328                         /* at callback's request, insist on receiving an appropriate server opaque PRF input */
1329                         s->s3->server_opaque_prf_input_len = s->tlsext_opaque_prf_input_len;
1330         }
1331 #endif
1332
1333         return 1;
1334         }
1335
1336 int ssl_prepare_serverhello_tlsext(SSL *s)
1337         {
1338 #ifndef OPENSSL_NO_EC
1339         /* If we are server and using an ECC cipher suite, send the point formats we support
1340          * if the client sent us an ECPointsFormat extension.  Note that the server is not
1341          * supposed to send an EllipticCurves extension.
1342          */
1343
1344         unsigned long alg_k = s->s3->tmp.new_cipher->algorithm_mkey;
1345         unsigned long alg_a = s->s3->tmp.new_cipher->algorithm_auth;
1346         int using_ecc = (alg_k & (SSL_kEECDH|SSL_kECDHr|SSL_kECDHe)) || (alg_a & SSL_aECDSA);
1347         using_ecc = using_ecc && (s->session->tlsext_ecpointformatlist != NULL);
1348
1349         if (using_ecc)
1350                 {
1351                 if (s->tlsext_ecpointformatlist != NULL) OPENSSL_free(s->tlsext_ecpointformatlist);
1352                 if ((s->tlsext_ecpointformatlist = OPENSSL_malloc(3)) == NULL)
1353                         {
1354                         SSLerr(SSL_F_SSL_PREPARE_SERVERHELLO_TLSEXT,ERR_R_MALLOC_FAILURE);
1355                         return -1;
1356                         }
1357                 s->tlsext_ecpointformatlist_length = 3;
1358                 s->tlsext_ecpointformatlist[0] = TLSEXT_ECPOINTFORMAT_uncompressed;
1359                 s->tlsext_ecpointformatlist[1] = TLSEXT_ECPOINTFORMAT_ansiX962_compressed_prime;
1360                 s->tlsext_ecpointformatlist[2] = TLSEXT_ECPOINTFORMAT_ansiX962_compressed_char2;
1361                 }
1362 #endif /* OPENSSL_NO_EC */
1363
1364         return 1;
1365         }
1366
1367 int ssl_check_clienthello_tlsext(SSL *s)
1368         {
1369         int ret=SSL_TLSEXT_ERR_NOACK;
1370         int al = SSL_AD_UNRECOGNIZED_NAME;
1371
1372 #ifndef OPENSSL_NO_EC
1373         /* The handling of the ECPointFormats extension is done elsewhere, namely in
1374          * ssl3_choose_cipher in s3_lib.c.
1375          */
1376         /* The handling of the EllipticCurves extension is done elsewhere, namely in
1377          * ssl3_choose_cipher in s3_lib.c.
1378          */
1379 #endif
1380
1381         if (s->ctx != NULL && s->ctx->tlsext_servername_callback != 0)
1382                 ret = s->ctx->tlsext_servername_callback(s, &al, s->ctx->tlsext_servername_arg);
1383         else if (s->initial_ctx != NULL && s->initial_ctx->tlsext_servername_callback != 0)
1384                 ret = s->initial_ctx->tlsext_servername_callback(s, &al, s->initial_ctx->tlsext_servername_arg);
1385
1386         /* If status request then ask callback what to do.
1387          * Note: this must be called after servername callbacks in case
1388          * the certificate has changed.
1389          */
1390         if ((s->tlsext_status_type != -1) && s->ctx && s->ctx->tlsext_status_cb)
1391                 {
1392                 int r;
1393                 r = s->ctx->tlsext_status_cb(s, s->ctx->tlsext_status_arg);
1394                 switch (r)
1395                         {
1396                         /* We don't want to send a status request response */
1397                         case SSL_TLSEXT_ERR_NOACK:
1398                                 s->tlsext_status_expected = 0;
1399                                 break;
1400                         /* status request response should be sent */
1401                         case SSL_TLSEXT_ERR_OK:
1402                                 if (s->tlsext_ocsp_resp)
1403                                         s->tlsext_status_expected = 1;
1404                                 else
1405                                         s->tlsext_status_expected = 0;
1406                                 break;
1407                         /* something bad happened */
1408                         case SSL_TLSEXT_ERR_ALERT_FATAL:
1409                                 ret = SSL_TLSEXT_ERR_ALERT_FATAL;
1410                                 al = SSL_AD_INTERNAL_ERROR;
1411                                 goto err;
1412                         }
1413                 }
1414         else
1415                 s->tlsext_status_expected = 0;
1416
1417 #ifdef TLSEXT_TYPE_opaque_prf_input
1418         {
1419                 /* This sort of belongs into ssl_prepare_serverhello_tlsext(),
1420                  * but we might be sending an alert in response to the client hello,
1421                  * so this has to happen here in ssl_check_clienthello_tlsext(). */
1422
1423                 int r = 1;
1424
1425                 if (s->ctx->tlsext_opaque_prf_input_callback != 0)
1426                         {
1427                         r = s->ctx->tlsext_opaque_prf_input_callback(s, NULL, 0, s->ctx->tlsext_opaque_prf_input_callback_arg);
1428                         if (!r)
1429                                 {
1430                                 ret = SSL_TLSEXT_ERR_ALERT_FATAL;
1431                                 al = SSL_AD_INTERNAL_ERROR;
1432                                 goto err;
1433                                 }
1434                         }
1435
1436                 if (s->s3->server_opaque_prf_input != NULL) /* shouldn't really happen */
1437                         OPENSSL_free(s->s3->server_opaque_prf_input);
1438                 s->s3->server_opaque_prf_input = NULL;
1439
1440                 if (s->tlsext_opaque_prf_input != NULL)
1441                         {
1442                         if (s->s3->client_opaque_prf_input != NULL &&
1443                                 s->s3->client_opaque_prf_input_len == s->tlsext_opaque_prf_input_len)
1444                                 {
1445                                 /* can only use this extension if we have a server opaque PRF input
1446                                  * of the same length as the client opaque PRF input! */
1447
1448                                 if (s->tlsext_opaque_prf_input_len == 0)
1449                                         s->s3->server_opaque_prf_input = OPENSSL_malloc(1); /* dummy byte just to get non-NULL */
1450                                 else
1451                                         s->s3->server_opaque_prf_input = BUF_memdup(s->tlsext_opaque_prf_input, s->tlsext_opaque_prf_input_len);
1452                                 if (s->s3->server_opaque_prf_input == NULL)
1453                                         {
1454                                         ret = SSL_TLSEXT_ERR_ALERT_FATAL;
1455                                         al = SSL_AD_INTERNAL_ERROR;
1456                                         goto err;
1457                                         }
1458                                 s->s3->server_opaque_prf_input_len = s->tlsext_opaque_prf_input_len;
1459                                 }
1460                         }
1461
1462                 if (r == 2 && s->s3->server_opaque_prf_input == NULL)
1463                         {
1464                         /* The callback wants to enforce use of the extension,
1465                          * but we can't do that with the client opaque PRF input;
1466                          * abort the handshake.
1467                          */
1468                         ret = SSL_TLSEXT_ERR_ALERT_FATAL;
1469                         al = SSL_AD_HANDSHAKE_FAILURE;
1470                         }
1471         }
1472
1473 #endif
1474  err:
1475         switch (ret)
1476                 {
1477                 case SSL_TLSEXT_ERR_ALERT_FATAL:
1478                         ssl3_send_alert(s,SSL3_AL_FATAL,al);
1479                         return -1;
1480
1481                 case SSL_TLSEXT_ERR_ALERT_WARNING:
1482                         ssl3_send_alert(s,SSL3_AL_WARNING,al);
1483                         return 1;
1484
1485                 case SSL_TLSEXT_ERR_NOACK:
1486                         s->servername_done=0;
1487                         default:
1488                 return 1;
1489                 }
1490         }
1491
1492 int ssl_check_serverhello_tlsext(SSL *s)
1493         {
1494         int ret=SSL_TLSEXT_ERR_NOACK;
1495         int al = SSL_AD_UNRECOGNIZED_NAME;
1496
1497 #ifndef OPENSSL_NO_EC
1498         /* If we are client and using an elliptic curve cryptography cipher
1499          * suite, then if server returns an EC point formats lists extension
1500          * it must contain uncompressed.
1501          */
1502         unsigned long alg_k = s->s3->tmp.new_cipher->algorithm_mkey;
1503         unsigned long alg_a = s->s3->tmp.new_cipher->algorithm_auth;
1504         if ((s->tlsext_ecpointformatlist != NULL) && (s->tlsext_ecpointformatlist_length > 0) &&
1505             (s->session->tlsext_ecpointformatlist != NULL) && (s->session->tlsext_ecpointformatlist_length > 0) &&
1506             ((alg_k & (SSL_kEECDH|SSL_kECDHr|SSL_kECDHe)) || (alg_a & SSL_aECDSA)))
1507                 {
1508                 /* we are using an ECC cipher */
1509                 size_t i;
1510                 unsigned char *list;
1511                 int found_uncompressed = 0;
1512                 list = s->session->tlsext_ecpointformatlist;
1513                 for (i = 0; i < s->session->tlsext_ecpointformatlist_length; i++)
1514                         {
1515                         if (*(list++) == TLSEXT_ECPOINTFORMAT_uncompressed)
1516                                 {
1517                                 found_uncompressed = 1;
1518                                 break;
1519                                 }
1520                         }
1521                 if (!found_uncompressed)
1522                         {
1523                         SSLerr(SSL_F_SSL_CHECK_SERVERHELLO_TLSEXT,SSL_R_TLS_INVALID_ECPOINTFORMAT_LIST);
1524                         return -1;
1525                         }
1526                 }
1527         ret = SSL_TLSEXT_ERR_OK;
1528 #endif /* OPENSSL_NO_EC */
1529
1530         if (s->ctx != NULL && s->ctx->tlsext_servername_callback != 0)
1531                 ret = s->ctx->tlsext_servername_callback(s, &al, s->ctx->tlsext_servername_arg);
1532         else if (s->initial_ctx != NULL && s->initial_ctx->tlsext_servername_callback != 0)
1533                 ret = s->initial_ctx->tlsext_servername_callback(s, &al, s->initial_ctx->tlsext_servername_arg);
1534
1535 #ifdef TLSEXT_TYPE_opaque_prf_input
1536         if (s->s3->server_opaque_prf_input_len > 0)
1537                 {
1538                 /* This case may indicate that we, as a client, want to insist on using opaque PRF inputs.
1539                  * So first verify that we really have a value from the server too. */
1540
1541                 if (s->s3->server_opaque_prf_input == NULL)
1542                         {
1543                         ret = SSL_TLSEXT_ERR_ALERT_FATAL;
1544                         al = SSL_AD_HANDSHAKE_FAILURE;
1545                         }
1546
1547                 /* Anytime the server *has* sent an opaque PRF input, we need to check
1548                  * that we have a client opaque PRF input of the same size. */
1549                 if (s->s3->client_opaque_prf_input == NULL ||
1550                     s->s3->client_opaque_prf_input_len != s->s3->server_opaque_prf_input_len)
1551                         {
1552                         ret = SSL_TLSEXT_ERR_ALERT_FATAL;
1553                         al = SSL_AD_ILLEGAL_PARAMETER;
1554                         }
1555                 }
1556 #endif
1557
1558         /* If we've requested certificate status and we wont get one
1559          * tell the callback
1560          */
1561         if ((s->tlsext_status_type != -1) && !(s->tlsext_status_expected)
1562                         && s->ctx && s->ctx->tlsext_status_cb)
1563                 {
1564                 int r;
1565                 /* Set resp to NULL, resplen to -1 so callback knows
1566                  * there is no response.
1567                  */
1568                 if (s->tlsext_ocsp_resp)
1569                         {
1570                         OPENSSL_free(s->tlsext_ocsp_resp);
1571                         s->tlsext_ocsp_resp = NULL;
1572                         }
1573                 s->tlsext_ocsp_resplen = -1;
1574                 r = s->ctx->tlsext_status_cb(s, s->ctx->tlsext_status_arg);
1575                 if (r == 0)
1576                         {
1577                         al = SSL_AD_BAD_CERTIFICATE_STATUS_RESPONSE;
1578                         ret = SSL_TLSEXT_ERR_ALERT_FATAL;
1579                         }
1580                 if (r < 0)
1581                         {
1582                         al = SSL_AD_INTERNAL_ERROR;
1583                         ret = SSL_TLSEXT_ERR_ALERT_FATAL;
1584                         }
1585                 }
1586
1587         switch (ret)
1588                 {
1589                 case SSL_TLSEXT_ERR_ALERT_FATAL:
1590                         ssl3_send_alert(s,SSL3_AL_FATAL,al);
1591                         return -1;
1592
1593                 case SSL_TLSEXT_ERR_ALERT_WARNING:
1594                         ssl3_send_alert(s,SSL3_AL_WARNING,al);
1595                         return 1;
1596
1597                 case SSL_TLSEXT_ERR_NOACK:
1598                         s->servername_done=0;
1599                         default:
1600                 return 1;
1601                 }
1602         }
1603
1604 /* Since the server cache lookup is done early on in the processing of client
1605  * hello and other operations depend on the result we need to handle any TLS
1606  * session ticket extension at the same time.
1607  */
1608
1609 int tls1_process_ticket(SSL *s, unsigned char *session_id, int len,
1610                                 const unsigned char *limit, SSL_SESSION **ret)
1611         {
1612         /* Point after session ID in client hello */
1613         const unsigned char *p = session_id + len;
1614         unsigned short i;
1615
1616         /* If tickets disabled behave as if no ticket present
1617          * to permit stateful resumption.
1618          */
1619         if (SSL_get_options(s) & SSL_OP_NO_TICKET)
1620                 return 1;
1621
1622         if ((s->version <= SSL3_VERSION) || !limit)
1623                 return 1;
1624         if (p >= limit)
1625                 return -1;
1626         /* Skip past DTLS cookie */
1627         if (s->version == DTLS1_VERSION || s->version == DTLS1_BAD_VER)
1628                 {
1629                 i = *(p++);
1630                 p+= i;
1631                 if (p >= limit)
1632                         return -1;
1633                 }
1634         /* Skip past cipher list */
1635         n2s(p, i);
1636         p+= i;
1637         if (p >= limit)
1638                 return -1;
1639         /* Skip past compression algorithm list */
1640         i = *(p++);
1641         p += i;
1642         if (p > limit)
1643                 return -1;
1644         /* Now at start of extensions */
1645         if ((p + 2) >= limit)
1646                 return 1;
1647         n2s(p, i);
1648         while ((p + 4) <= limit)
1649                 {
1650                 unsigned short type, size;
1651                 n2s(p, type);
1652                 n2s(p, size);
1653                 if (p + size > limit)
1654                         return 1;
1655                 if (type == TLSEXT_TYPE_session_ticket)
1656                         {
1657                         /* If tickets disabled indicate cache miss which will
1658                          * trigger a full handshake
1659                          */
1660                         if (SSL_get_options(s) & SSL_OP_NO_TICKET)
1661                                 return 1;
1662                         /* If zero length note client will accept a ticket
1663                          * and indicate cache miss to trigger full handshake
1664                          */
1665                         if (size == 0)
1666                                 {
1667                                 s->tlsext_ticket_expected = 1;
1668                                 return 0;       /* Cache miss */
1669                                 }
1670                         if (s->tls_session_secret_cb)
1671                                 {
1672                                 /* Indicate cache miss here and instead of
1673                                  * generating the session from ticket now,
1674                                  * trigger abbreviated handshake based on
1675                                  * external mechanism to calculate the master
1676                                  * secret later. */
1677                                 return 0;
1678                                 }
1679                         return tls_decrypt_ticket(s, p, size, session_id, len,
1680                                                                         ret);
1681                         }
1682                 p += size;
1683                 }
1684         return 1;
1685         }
1686
1687 static int tls_decrypt_ticket(SSL *s, const unsigned char *etick, int eticklen,
1688                                 const unsigned char *sess_id, int sesslen,
1689                                 SSL_SESSION **psess)
1690         {
1691         SSL_SESSION *sess;
1692         unsigned char *sdec;
1693         const unsigned char *p;
1694         int slen, mlen, renew_ticket = 0;
1695         unsigned char tick_hmac[EVP_MAX_MD_SIZE];
1696         HMAC_CTX hctx;
1697         EVP_CIPHER_CTX ctx;
1698         SSL_CTX *tctx = s->initial_ctx;
1699         /* Need at least keyname + iv + some encrypted data */
1700         if (eticklen < 48)
1701                 goto tickerr;
1702         /* Initialize session ticket encryption and HMAC contexts */
1703         HMAC_CTX_init(&hctx);
1704         EVP_CIPHER_CTX_init(&ctx);
1705         if (tctx->tlsext_ticket_key_cb)
1706                 {
1707                 unsigned char *nctick = (unsigned char *)etick;
1708                 int rv = tctx->tlsext_ticket_key_cb(s, nctick, nctick + 16,
1709                                                         &ctx, &hctx, 0);
1710                 if (rv < 0)
1711                         return -1;
1712                 if (rv == 0)
1713                         goto tickerr;
1714                 if (rv == 2)
1715                         renew_ticket = 1;
1716                 }
1717         else
1718                 {
1719                 /* Check key name matches */
1720                 if (memcmp(etick, tctx->tlsext_tick_key_name, 16))
1721                         goto tickerr;
1722                 HMAC_Init_ex(&hctx, tctx->tlsext_tick_hmac_key, 16,
1723                                         tlsext_tick_md(), NULL);
1724                 EVP_DecryptInit_ex(&ctx, EVP_aes_128_cbc(), NULL,
1725                                 tctx->tlsext_tick_aes_key, etick + 16);
1726                 }
1727         /* Attempt to process session ticket, first conduct sanity and
1728          * integrity checks on ticket.
1729          */
1730         mlen = HMAC_size(&hctx);
1731         if (mlen < 0)
1732                 {
1733                 EVP_CIPHER_CTX_cleanup(&ctx);
1734                 return -1;
1735                 }
1736         eticklen -= mlen;
1737         /* Check HMAC of encrypted ticket */
1738         HMAC_Update(&hctx, etick, eticklen);
1739         HMAC_Final(&hctx, tick_hmac, NULL);
1740         HMAC_CTX_cleanup(&hctx);
1741         if (memcmp(tick_hmac, etick + eticklen, mlen))
1742                 goto tickerr;
1743         /* Attempt to decrypt session data */
1744         /* Move p after IV to start of encrypted ticket, update length */
1745         p = etick + 16 + EVP_CIPHER_CTX_iv_length(&ctx);
1746         eticklen -= 16 + EVP_CIPHER_CTX_iv_length(&ctx);
1747         sdec = OPENSSL_malloc(eticklen);
1748         if (!sdec)
1749                 {
1750                 EVP_CIPHER_CTX_cleanup(&ctx);
1751                 return -1;
1752                 }
1753         EVP_DecryptUpdate(&ctx, sdec, &slen, p, eticklen);
1754         if (EVP_DecryptFinal(&ctx, sdec + slen, &mlen) <= 0)
1755                 goto tickerr;
1756         slen += mlen;
1757         EVP_CIPHER_CTX_cleanup(&ctx);
1758         p = sdec;
1759
1760         sess = d2i_SSL_SESSION(NULL, &p, slen);
1761         OPENSSL_free(sdec);
1762         if (sess)
1763                 {
1764                 /* The session ID if non-empty is used by some clients to
1765                  * detect that the ticket has been accepted. So we copy it to
1766                  * the session structure. If it is empty set length to zero
1767                  * as required by standard.
1768                  */
1769                 if (sesslen)
1770                         memcpy(sess->session_id, sess_id, sesslen);
1771                 sess->session_id_length = sesslen;
1772                 *psess = sess;
1773                 s->tlsext_ticket_expected = renew_ticket;
1774                 return 1;
1775                 }
1776         /* If session decrypt failure indicate a cache miss and set state to
1777          * send a new ticket
1778          */
1779         tickerr:
1780         s->tlsext_ticket_expected = 1;
1781         return 0;
1782         }
1783
1784 #endif