ssl/t1_lib.c

   1 /* ssl/t1_lib.c */
   2 /* Copyright (C) 1995-1998 Eric Young (eay@cryptsoft.com)
   3  * All rights reserved.
   4  *
   5  * This package is an SSL implementation written
   6  * by Eric Young (eay@cryptsoft.com).
   7  * The implementation was written so as to conform with Netscapes SSL.
   8  *
   9  * This library is free for commercial and non-commercial use as long as
  10  * the following conditions are aheared to.  The following conditions
  11  * apply to all code found in this distribution, be it the RC4, RSA,
  12  * lhash, DES, etc., code; not just the SSL code.  The SSL documentation
  13  * included with this distribution is covered by the same copyright terms
  14  * except that the holder is Tim Hudson (tjh@cryptsoft.com).
  15  *
  16  * Copyright remains Eric Young's, and as such any Copyright notices in
  17  * the code are not to be removed.
  18  * If this package is used in a product, Eric Young should be given attribution
  19  * as the author of the parts of the library used.
  20  * This can be in the form of a textual message at program startup or
  21  * in documentation (online or textual) provided with the package.
  22  *
  23  * Redistribution and use in source and binary forms, with or without
  24  * modification, are permitted provided that the following conditions
  25  * are met:
  26  * 1. Redistributions of source code must retain the copyright
  27  *    notice, this list of conditions and the following disclaimer.
  28  * 2. Redistributions in binary form must reproduce the above copyright
  29  *    notice, this list of conditions and the following disclaimer in the
  30  *    documentation and/or other materials provided with the distribution.
  31  * 3. All advertising materials mentioning features or use of this software
  32  *    must display the following acknowledgement:
  33  *    "This product includes cryptographic software written by
  34  *     Eric Young (eay@cryptsoft.com)"
  35  *    The word 'cryptographic' can be left out if the rouines from the library
  36  *    being used are not cryptographic related :-).
  37  * 4. If you include any Windows specific code (or a derivative thereof) from
  38  *    the apps directory (application code) you must include an acknowledgement:
  39  *    "This product includes software written by Tim Hudson (tjh@cryptsoft.com)"
  40  *
  41  * THIS SOFTWARE IS PROVIDED BY ERIC YOUNG ``AS IS'' AND
  42  * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
  43  * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
  44  * ARE DISCLAIMED.  IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE
  45  * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
  46  * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
  47  * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
  48  * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
  49  * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
  50  * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
  51  * SUCH DAMAGE.
  52  *
  53  * The licence and distribution terms for any publically available version or
  54  * derivative of this code cannot be changed.  i.e. this code cannot simply be
  55  * copied and put under another distribution licence
  56  * [including the GNU Public Licence.]
  57  */
  58 /* ====================================================================
  59  * Copyright (c) 1998-2007 The OpenSSL Project.  All rights reserved.
  60  *
  61  * Redistribution and use in source and binary forms, with or without
  62  * modification, are permitted provided that the following conditions
  63  * are met:
  64  *
  65  * 1. Redistributions of source code must retain the above copyright
  66  *    notice, this list of conditions and the following disclaimer.
  67  *
  68  * 2. Redistributions in binary form must reproduce the above copyright
  69  *    notice, this list of conditions and the following disclaimer in
  70  *    the documentation and/or other materials provided with the
  71  *    distribution.
  72  *
  73  * 3. All advertising materials mentioning features or use of this
  74  *    software must display the following acknowledgment:
  75  *    "This product includes software developed by the OpenSSL Project
  76  *    for use in the OpenSSL Toolkit. (http://www.openssl.org/)"
  77  *
  78  * 4. The names "OpenSSL Toolkit" and "OpenSSL Project" must not be used to
  79  *    endorse or promote products derived from this software without
  80  *    prior written permission. For written permission, please contact
  81  *    openssl-core@openssl.org.
  82  *
  83  * 5. Products derived from this software may not be called "OpenSSL"
  84  *    nor may "OpenSSL" appear in their names without prior written
  85  *    permission of the OpenSSL Project.
  86  *
  87  * 6. Redistributions of any form whatsoever must retain the following
  88  *    acknowledgment:
  89  *    "This product includes software developed by the OpenSSL Project
  90  *    for use in the OpenSSL Toolkit (http://www.openssl.org/)"
  91  *
  92  * THIS SOFTWARE IS PROVIDED BY THE OpenSSL PROJECT ``AS IS'' AND ANY
  93  * EXPRESSED OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
  94  * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
  95  * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL THE OpenSSL PROJECT OR
  96  * ITS CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
  97  * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
  98  * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
  99  * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
 100  * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT,
 101  * STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
 102  * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED
 103  * OF THE POSSIBILITY OF SUCH DAMAGE.
 104  * ====================================================================
 105  *
 106  * This product includes cryptographic software written by Eric Young
 107  * (eay@cryptsoft.com).  This product includes software written by Tim
 108  * Hudson (tjh@cryptsoft.com).
 109  *
 110  */
 111
 112 #include <stdio.h>
 113 #include <openssl/objects.h>
 114 #include <openssl/evp.h>
 115 #include <openssl/hmac.h>
 116 #include <openssl/ocsp.h>
 117 #include <openssl/rand.h>
 118 #include "ssl_locl.h"
 119
 120 const char tls1_version_str[]="TLSv1" OPENSSL_VERSION_PTEXT;
 121
 122 #ifndef OPENSSL_NO_TLSEXT
 123 static int tls_decrypt_ticket(SSL *s, const unsigned char *tick, int ticklen,
 124                                 const unsigned char *sess_id, int sesslen,
 125                                 SSL_SESSION **psess);
 126 #endif
 127
 128 SSL3_ENC_METHOD TLSv1_enc_data={
 129         tls1_enc,
 130         tls1_mac,
 131         tls1_setup_key_block,
 132         tls1_generate_master_secret,
 133         tls1_change_cipher_state,
 134         tls1_final_finish_mac,
 135         TLS1_FINISH_MAC_LENGTH,
 136         tls1_cert_verify_mac,
 137         TLS_MD_CLIENT_FINISH_CONST,TLS_MD_CLIENT_FINISH_CONST_SIZE,
 138         TLS_MD_SERVER_FINISH_CONST,TLS_MD_SERVER_FINISH_CONST_SIZE,
 139         tls1_alert_code,
 140         tls1_export_keying_material,
 141         };
 142
 143 long tls1_default_timeout(void)
 144         {
 145         /* 2 hours, the 24 hours mentioned in the TLSv1 spec
 146          * is way too long for http, the cache would over fill */
 147         return(60*60*2);
 148         }
 149
 150 int tls1_new(SSL *s)
 151         {
 152         if (!ssl3_new(s)) return(0);
 153         s->method->ssl_clear(s);
 154         return(1);
 155         }
 156
 157 void tls1_free(SSL *s)
 158         {
 159 #ifndef OPENSSL_NO_TLSEXT
 160         if (s->tlsext_session_ticket)
 161                 {
 162                 OPENSSL_free(s->tlsext_session_ticket);
 163                 }
 164 #endif /* OPENSSL_NO_TLSEXT */
 165         ssl3_free(s);
 166         }
 167
 168 void tls1_clear(SSL *s)
 169         {
 170         ssl3_clear(s);
 171         s->version = s->method->version;
 172         }
 173
 174 #ifndef OPENSSL_NO_EC
 175
 176 static int nid_list[] =
 177         {
 178                 NID_sect163k1, /* sect163k1 (1) */
 179                 NID_sect163r1, /* sect163r1 (2) */
 180                 NID_sect163r2, /* sect163r2 (3) */
 181                 NID_sect193r1, /* sect193r1 (4) */
 182                 NID_sect193r2, /* sect193r2 (5) */
 183                 NID_sect233k1, /* sect233k1 (6) */
 184                 NID_sect233r1, /* sect233r1 (7) */
 185                 NID_sect239k1, /* sect239k1 (8) */
 186                 NID_sect283k1, /* sect283k1 (9) */
 187                 NID_sect283r1, /* sect283r1 (10) */
 188                 NID_sect409k1, /* sect409k1 (11) */
 189                 NID_sect409r1, /* sect409r1 (12) */
 190                 NID_sect571k1, /* sect571k1 (13) */
 191                 NID_sect571r1, /* sect571r1 (14) */
 192                 NID_secp160k1, /* secp160k1 (15) */
 193                 NID_secp160r1, /* secp160r1 (16) */
 194                 NID_secp160r2, /* secp160r2 (17) */
 195                 NID_secp192k1, /* secp192k1 (18) */
 196                 NID_X9_62_prime192v1, /* secp192r1 (19) */
 197                 NID_secp224k1, /* secp224k1 (20) */
 198                 NID_secp224r1, /* secp224r1 (21) */
 199                 NID_secp256k1, /* secp256k1 (22) */
 200                 NID_X9_62_prime256v1, /* secp256r1 (23) */
 201                 NID_secp384r1, /* secp384r1 (24) */
 202                 NID_secp521r1  /* secp521r1 (25) */
 203         };
 204
 205
 206 static const unsigned char ecformats_default[] =
 207         {
 208         TLSEXT_ECPOINTFORMAT_uncompressed,
 209         TLSEXT_ECPOINTFORMAT_ansiX962_compressed_prime,
 210         TLSEXT_ECPOINTFORMAT_ansiX962_compressed_char2
 211         };
 212
 213 static const unsigned char eccurves_default[] =
 214         {
 215                 0,14, /* sect571r1 (14) */
 216                 0,13, /* sect571k1 (13) */
 217                 0,25, /* secp521r1 (25) */
 218                 0,11, /* sect409k1 (11) */
 219                 0,12, /* sect409r1 (12) */
 220                 0,24, /* secp384r1 (24) */
 221                 0,9,  /* sect283k1 (9) */
 222                 0,10, /* sect283r1 (10) */
 223                 0,22, /* secp256k1 (22) */
 224                 0,23, /* secp256r1 (23) */
 225                 0,8,  /* sect239k1 (8) */
 226                 0,6,  /* sect233k1 (6) */
 227                 0,7,  /* sect233r1 (7) */
 228                 0,20, /* secp224k1 (20) */
 229                 0,21, /* secp224r1 (21) */
 230                 0,4,  /* sect193r1 (4) */
 231                 0,5,  /* sect193r2 (5) */
 232                 0,18, /* secp192k1 (18) */
 233                 0,19, /* secp192r1 (19) */
 234                 0,1,  /* sect163k1 (1) */
 235                 0,2,  /* sect163r1 (2) */
 236                 0,3,  /* sect163r2 (3) */
 237                 0,15, /* secp160k1 (15) */
 238                 0,16, /* secp160r1 (16) */
 239                 0,17, /* secp160r2 (17) */
 240         };
 241
 242 int tls1_ec_curve_id2nid(int curve_id)
 243         {
 244         /* ECC curves from draft-ietf-tls-ecc-12.txt (Oct. 17, 2005) */
 245         if ((curve_id < 1) || ((unsigned int)curve_id >
 246                                 sizeof(nid_list)/sizeof(nid_list[0])))
 247                 return 0;
 248         return nid_list[curve_id-1];
 249         }
 250
 251 int tls1_ec_nid2curve_id(int nid)
 252         {
 253         /* ECC curves from draft-ietf-tls-ecc-12.txt (Oct. 17, 2005) */
 254         switch (nid)
 255                 {
 256         case NID_sect163k1: /* sect163k1 (1) */
 257                 return 1;
 258         case NID_sect163r1: /* sect163r1 (2) */
 259                 return 2;
 260         case NID_sect163r2: /* sect163r2 (3) */
 261                 return 3;
 262         case NID_sect193r1: /* sect193r1 (4) */
 263                 return 4;
 264         case NID_sect193r2: /* sect193r2 (5) */
 265                 return 5;
 266         case NID_sect233k1: /* sect233k1 (6) */
 267                 return 6;
 268         case NID_sect233r1: /* sect233r1 (7) */
 269                 return 7;
 270         case NID_sect239k1: /* sect239k1 (8) */
 271                 return 8;
 272         case NID_sect283k1: /* sect283k1 (9) */
 273                 return 9;
 274         case NID_sect283r1: /* sect283r1 (10) */
 275                 return 10;
 276         case NID_sect409k1: /* sect409k1 (11) */
 277                 return 11;
 278         case NID_sect409r1: /* sect409r1 (12) */
 279                 return 12;
 280         case NID_sect571k1: /* sect571k1 (13) */
 281                 return 13;
 282         case NID_sect571r1: /* sect571r1 (14) */
 283                 return 14;
 284         case NID_secp160k1: /* secp160k1 (15) */
 285                 return 15;
 286         case NID_secp160r1: /* secp160r1 (16) */
 287                 return 16;
 288         case NID_secp160r2: /* secp160r2 (17) */
 289                 return 17;
 290         case NID_secp192k1: /* secp192k1 (18) */
 291                 return 18;
 292         case NID_X9_62_prime192v1: /* secp192r1 (19) */
 293                 return 19;
 294         case NID_secp224k1: /* secp224k1 (20) */
 295                 return 20;
 296         case NID_secp224r1: /* secp224r1 (21) */
 297                 return 21;
 298         case NID_secp256k1: /* secp256k1 (22) */
 299                 return 22;
 300         case NID_X9_62_prime256v1: /* secp256r1 (23) */
 301                 return 23;
 302         case NID_secp384r1: /* secp384r1 (24) */
 303                 return 24;
 304         case NID_secp521r1:  /* secp521r1 (25) */
 305                 return 25;
 306         default:
 307                 return 0;
 308                 }
 309         }
 310
 311 /* Return any common values from two lists. One list is used as a
 312  * preference list where we return the most preferred match.
 313  */
 314 int tls1_shared_list(SSL *s,
 315                         const unsigned char *l1, size_t l1len,
 316                         const unsigned char *l2, size_t l2len,
 317                         int nmatch)
 318         {
 319         const unsigned char *pref, *supp;
 320         size_t preflen, supplen, i, j;
 321         int k;
 322         l1len /= 2;
 323         l2len /= 2;
 324         if (s->options & SSL_OP_CIPHER_SERVER_PREFERENCE)
 325                 {
 326                 pref = l1;
 327                 preflen = l1len;
 328                 supp = l2;
 329                 supplen = l2len;
 330                 }
 331         else
 332                 {
 333                 supp = l1;
 334                 supplen = l1len;
 335                 pref = l2;
 336                 preflen = l2len;
 337                 }
 338         k = 0;
 339         for (i = 0; i < preflen; i++, pref+=2)
 340                 {
 341                 const unsigned char *tsupp = supp;
 342                 for (j = 0; j < supplen; j++, tsupp+=2)
 343                         {
 344                         if (pref[0] == tsupp[0] && pref[1] == tsupp[1])
 345                                 {
 346                                 if (nmatch == k)
 347                                         return (pref[0] << 8) | pref[1];
 348                                 k++;
 349                                 }
 350                         }
 351                 }
 352         if (nmatch == -1 && k > 0)
 353                 return k;
 354         return -1;
 355         }
 356
 357 int tls1_shared_curve(SSL *s, int nmatch)
 358         {
 359         const unsigned char *l1, *l2;
 360         size_t l1len, l2len;
 361         int id;
 362         /* Can't do anything on client side */
 363         if (s->server == 0)
 364                 return -1;
 365         /* Use our preferred curve list, if not set use default */
 366         if (s->tlsext_ellipticcurvelist)
 367                 {
 368                 l1 = s->tlsext_ellipticcurvelist;
 369                 l1len = s->tlsext_ellipticcurvelist_length;
 370                 }
 371         else
 372                 {
 373                 l1 = eccurves_default;
 374                 l1len = sizeof(eccurves_default);
 375                 }
 376         /* Use peer preferred curve list, if not set use default */
 377         if(s->session->tlsext_ellipticcurvelist)
 378                 {
 379                 l2 = s->session->tlsext_ellipticcurvelist;
 380                 l2len =s->session->tlsext_ellipticcurvelist_length;
 381                 }
 382         else
 383                 {
 384                 l2 = eccurves_default;
 385                 l2len = sizeof(eccurves_default);
 386                 }
 387         id = tls1_shared_list(s, l1, l1len, l2, l2len, nmatch);
 388         if (nmatch == -1)
 389                 return id;
 390         return tls1_ec_curve_id2nid(id);
 391         }
 392
 393 int tls1_set_curves(unsigned char **pext, size_t *pextlen,
 394                         int *curves, size_t ncurves)
 395         {
 396         unsigned char *clist, *p;
 397         size_t i;
 398         /* Bitmap of curves included to detect duplicates: only works
 399          * while curve ids < 32
 400          */
 401         unsigned long dup_list = 0;
 402         clist = OPENSSL_malloc(ncurves * 2);
 403         if (!clist)
 404                 return 0;
 405         for (i = 0, p = clist; i < ncurves; i++)
 406                 {
 407                 unsigned long idmask;
 408                 int id;
 409                 id = tls1_ec_nid2curve_id(curves[i]);
 410                 idmask = 1L << id;
 411                 if (!id || (dup_list & idmask))
 412                         {
 413                         OPENSSL_free(clist);
 414                         return 0;
 415                         }
 416                 dup_list |= idmask;
 417                 s2n(id, p);
 418                 }
 419         if (*pext)
 420                 OPENSSL_free(*pext);
 421         *pext = clist;
 422         *pextlen = ncurves * 2;
 423         return 1;
 424         }
 425
 426 #define MAX_CURVELIST   25
 427
 428 typedef struct
 429         {
 430         size_t nidcnt;
 431         int nid_arr[MAX_CURVELIST];
 432         } nid_cb_st;
 433
 434 static int nid_cb(const char *elem, int len, void *arg)
 435         {
 436         nid_cb_st *narg = arg;
 437         size_t i;
 438         int nid;
 439         char etmp[20];
 440         if (narg->nidcnt == MAX_CURVELIST)
 441                 return 0;
 442         if (len > (int)(sizeof(etmp) - 1))
 443                 return 0;
 444         memcpy(etmp, elem, len);
 445         etmp[len] = 0;
 446         nid = EC_curve_nist2nid(etmp);
 447         if (nid == NID_undef)
 448                 nid = OBJ_sn2nid(etmp);
 449         if (nid == NID_undef)
 450                 nid = OBJ_ln2nid(etmp);
 451         if (nid == NID_undef)
 452                 return 0;
 453         for (i = 0; i < narg->nidcnt; i++)
 454                 if (narg->nid_arr[i] == nid)
 455                         return 0;
 456         narg->nid_arr[narg->nidcnt++] = nid;
 457         return 1;
 458         }
 459 /* Set curves based on a colon separate list */
 460 int tls1_set_curves_list(unsigned char **pext, size_t *pextlen,
 461                                 const char *str)
 462         {
 463         nid_cb_st ncb;
 464         ncb.nidcnt = 0;
 465         if (!CONF_parse_list(str, ':', 1, nid_cb, &ncb))
 466                 return 0;
 467         return tls1_set_curves(pext, pextlen, ncb.nid_arr, ncb.nidcnt);
 468         }
 469
 470 #endif /* OPENSSL_NO_EC */
 471
 472 #ifndef OPENSSL_NO_TLSEXT
 473
 474 /* List of supported signature algorithms and hashes. Should make this
 475  * customisable at some point, for now include everything we support.
 476  */
 477
 478 #ifdef OPENSSL_NO_RSA
 479 #define tlsext_sigalg_rsa(md) /* */
 480 #else
 481 #define tlsext_sigalg_rsa(md) md, TLSEXT_signature_rsa,
 482 #endif
 483
 484 #ifdef OPENSSL_NO_DSA
 485 #define tlsext_sigalg_dsa(md) /* */
 486 #else
 487 #define tlsext_sigalg_dsa(md) md, TLSEXT_signature_dsa,
 488 #endif
 489
 490 #ifdef OPENSSL_NO_ECDSA
 491 #define tlsext_sigalg_ecdsa(md) /* */
 492 #else
 493 #define tlsext_sigalg_ecdsa(md) md, TLSEXT_signature_ecdsa,
 494 #endif
 495
 496 #define tlsext_sigalg(md) \
 497                 tlsext_sigalg_rsa(md) \
 498                 tlsext_sigalg_dsa(md) \
 499                 tlsext_sigalg_ecdsa(md)
 500
 501 static unsigned char tls12_sigalgs[] = {
 502 #ifndef OPENSSL_NO_SHA512
 503         tlsext_sigalg(TLSEXT_hash_sha512)
 504         tlsext_sigalg(TLSEXT_hash_sha384)
 505 #endif
 506 #ifndef OPENSSL_NO_SHA256
 507         tlsext_sigalg(TLSEXT_hash_sha256)
 508         tlsext_sigalg(TLSEXT_hash_sha224)
 509 #endif
 510 #ifndef OPENSSL_NO_SHA
 511         tlsext_sigalg(TLSEXT_hash_sha1)
 512 #endif
 513 #ifndef OPENSSL_NO_MD5
 514         tlsext_sigalg_rsa(TLSEXT_hash_md5)
 515 #endif
 516 };
 517
 518 int tls12_get_req_sig_algs(SSL *s, unsigned char *p)
 519         {
 520         size_t slen = sizeof(tls12_sigalgs);
 521 #ifdef OPENSSL_FIPS
 522         /* If FIPS mode don't include MD5 which is last */
 523         if (FIPS_mode())
 524                 slen -= 2;
 525 #endif
 526         if (p)
 527                 memcpy(p, tls12_sigalgs, slen);
 528         return (int)slen;
 529         }
 530
 531 unsigned char *ssl_add_clienthello_tlsext(SSL *s, unsigned char *p, unsigned char *limit)
 532         {
 533         int extdatalen=0;
 534         unsigned char *ret = p;
 535 #ifndef OPENSSL_NO_EC
 536         /* See if we support any ECC ciphersuites */
 537         int using_ecc = 0;
 538         if (s->version != DTLS1_VERSION && s->version >= TLS1_VERSION)
 539                 {
 540                 int i;
 541                 unsigned long alg_k, alg_a;
 542                 STACK_OF(SSL_CIPHER) *cipher_stack = SSL_get_ciphers(s);
 543
 544                 for (i = 0; i < sk_SSL_CIPHER_num(cipher_stack); i++)
 545                         {
 546                         SSL_CIPHER *c = sk_SSL_CIPHER_value(cipher_stack, i);
 547
 548                         alg_k = c->algorithm_mkey;
 549                         alg_a = c->algorithm_auth;
 550                         if ((alg_k & (SSL_kEECDH|SSL_kECDHr|SSL_kECDHe)
 551                                 || (alg_a & SSL_aECDSA)))
 552                                 {
 553                                 using_ecc = 1;
 554                                 break;
 555                                 }
 556                         }
 557                 }
 558 #endif
 559
 560         /* don't add extensions for SSLv3 unless doing secure renegotiation */
 561         if (s->client_version == SSL3_VERSION
 562                                         && !s->s3->send_connection_binding)
 563                 return p;
 564
 565         ret+=2;
 566
 567         if (ret>=limit) return NULL; /* this really never occurs, but ... */
 568
 569         if (s->tlsext_hostname != NULL)
 570                 {
 571                 /* Add TLS extension servername to the Client Hello message */
 572                 unsigned long size_str;
 573                 long lenmax;
 574
 575                 /* check for enough space.
 576                    4 for the servername type and entension length
 577                    2 for servernamelist length
 578                    1 for the hostname type
 579                    2 for hostname length
 580                    + hostname length
 581                 */
 582
 583                 if ((lenmax = limit - ret - 9) < 0
 584                     || (size_str = strlen(s->tlsext_hostname)) > (unsigned long)lenmax)
 585                         return NULL;
 586
 587                 /* extension type and length */
 588                 s2n(TLSEXT_TYPE_server_name,ret);
 589                 s2n(size_str+5,ret);
 590
 591                 /* length of servername list */
 592                 s2n(size_str+3,ret);
 593
 594                 /* hostname type, length and hostname */
 595                 *(ret++) = (unsigned char) TLSEXT_NAMETYPE_host_name;
 596                 s2n(size_str,ret);
 597                 memcpy(ret, s->tlsext_hostname, size_str);
 598                 ret+=size_str;
 599                 }
 600
 601         /* Add RI if renegotiating */
 602         if (s->renegotiate)
 603           {
 604           int el;
 605
 606           if(!ssl_add_clienthello_renegotiate_ext(s, 0, &el, 0))
 607               {
 608               SSLerr(SSL_F_SSL_ADD_CLIENTHELLO_TLSEXT, ERR_R_INTERNAL_ERROR);
 609               return NULL;
 610               }
 611
 612           if((limit - p - 4 - el) < 0) return NULL;
 613
 614           s2n(TLSEXT_TYPE_renegotiate,ret);
 615           s2n(el,ret);
 616
 617           if(!ssl_add_clienthello_renegotiate_ext(s, ret, &el, el))
 618               {
 619               SSLerr(SSL_F_SSL_ADD_CLIENTHELLO_TLSEXT, ERR_R_INTERNAL_ERROR);
 620               return NULL;
 621               }
 622
 623           ret += el;
 624         }
 625
 626 #ifndef OPENSSL_NO_SRP
 627         /* Add SRP username if there is one */
 628         if (s->srp_ctx.login != NULL)
 629                 { /* Add TLS extension SRP username to the Client Hello message */
 630
 631                 int login_len = strlen(s->srp_ctx.login);
 632                 if (login_len > 255 || login_len == 0)
 633                         {
 634                         SSLerr(SSL_F_SSL_ADD_CLIENTHELLO_TLSEXT, ERR_R_INTERNAL_ERROR);
 635                         return NULL;
 636                         }
 637
 638                 /* check for enough space.
 639                    4 for the srp type type and entension length
 640                    1 for the srp user identity
 641                    + srp user identity length
 642                 */
 643                 if ((limit - ret - 5 - login_len) < 0) return NULL;
 644
 645                 /* fill in the extension */
 646                 s2n(TLSEXT_TYPE_srp,ret);
 647                 s2n(login_len+1,ret);
 648                 (*ret++) = (unsigned char) login_len;
 649                 memcpy(ret, s->srp_ctx.login, login_len);
 650                 ret+=login_len;
 651                 }
 652 #endif
 653
 654 #ifndef OPENSSL_NO_EC
 655         if (using_ecc)
 656                 {
 657                 /* Add TLS extension ECPointFormats to the ClientHello message */
 658                 long lenmax;
 659                 const unsigned char *plist;
 660                 size_t plistlen;
 661                 /* If we have a custom point format list use it otherwise
 662                  * use default */
 663                 plist = s->tlsext_ecpointformatlist;
 664                 if (plist)
 665                         plistlen = s->tlsext_ecpointformatlist_length;
 666                 else
 667                         {
 668                         plist = ecformats_default;
 669                         plistlen = sizeof(ecformats_default);
 670                         }
 671
 672                 if ((lenmax = limit - ret - 5) < 0) return NULL;
 673                 if (plistlen > (size_t)lenmax) return NULL;
 674                 if (plistlen > 255)
 675                         {
 676                         SSLerr(SSL_F_SSL_ADD_CLIENTHELLO_TLSEXT, ERR_R_INTERNAL_ERROR);
 677                         return NULL;
 678                         }
 679
 680                 s2n(TLSEXT_TYPE_ec_point_formats,ret);
 681                 s2n(plistlen + 1,ret);
 682                 *(ret++) = (unsigned char)plistlen ;
 683                 memcpy(ret, plist, plistlen);
 684                 ret+=plistlen;
 685
 686                 /* Add TLS extension EllipticCurves to the ClientHello message */
 687                 plist = s->tlsext_ellipticcurvelist;
 688                 /* If we have a custom curve list use it otherwise
 689                  * use default */
 690                 if (plist)
 691                         plistlen = s->tlsext_ellipticcurvelist_length;
 692                 else
 693                         {
 694                         plist = eccurves_default;
 695                         plistlen = sizeof(eccurves_default);
 696                         }
 697
 698                 if ((lenmax = limit - ret - 6) < 0) return NULL;
 699                 if (plistlen > (size_t)lenmax) return NULL;
 700                 if (plistlen > 65532)
 701                         {
 702                         SSLerr(SSL_F_SSL_ADD_CLIENTHELLO_TLSEXT, ERR_R_INTERNAL_ERROR);
 703                         return NULL;
 704                         }
 705
 706                 s2n(TLSEXT_TYPE_elliptic_curves,ret);
 707                 s2n(plistlen + 2, ret);
 708
 709                 /* NB: draft-ietf-tls-ecc-12.txt uses a one-byte prefix for
 710                  * elliptic_curve_list, but the examples use two bytes.
 711                  * http://www1.ietf.org/mail-archive/web/tls/current/msg00538.html
 712                  * resolves this to two bytes.
 713                  */
 714                 s2n(plistlen, ret);
 715                 memcpy(ret, plist, plistlen);
 716                 ret+=plistlen;
 717                 }
 718 #endif /* OPENSSL_NO_EC */
 719
 720         if (!(SSL_get_options(s) & SSL_OP_NO_TICKET))
 721                 {
 722                 int ticklen;
 723                 if (!s->new_session && s->session && s->session->tlsext_tick)
 724                         ticklen = s->session->tlsext_ticklen;
 725                 else if (s->session && s->tlsext_session_ticket &&
 726                          s->tlsext_session_ticket->data)
 727                         {
 728                         ticklen = s->tlsext_session_ticket->length;
 729                         s->session->tlsext_tick = OPENSSL_malloc(ticklen);
 730                         if (!s->session->tlsext_tick)
 731                                 return NULL;
 732                         memcpy(s->session->tlsext_tick,
 733                                s->tlsext_session_ticket->data,
 734                                ticklen);
 735                         s->session->tlsext_ticklen = ticklen;
 736                         }
 737                 else
 738                         ticklen = 0;
 739                 if (ticklen == 0 && s->tlsext_session_ticket &&
 740                     s->tlsext_session_ticket->data == NULL)
 741                         goto skip_ext;
 742                 /* Check for enough room 2 for extension type, 2 for len
 743                  * rest for ticket
 744                  */
 745                 if ((long)(limit - ret - 4 - ticklen) < 0) return NULL;
 746                 s2n(TLSEXT_TYPE_session_ticket,ret);
 747                 s2n(ticklen,ret);
 748                 if (ticklen)
 749                         {
 750                         memcpy(ret, s->session->tlsext_tick, ticklen);
 751                         ret += ticklen;
 752                         }
 753                 }
 754                 skip_ext:
 755
 756         if (TLS1_get_client_version(s) >= TLS1_2_VERSION)
 757                 {
 758                 if ((size_t)(limit - ret) < sizeof(tls12_sigalgs) + 6)
 759                         return NULL;
 760                 s2n(TLSEXT_TYPE_signature_algorithms,ret);
 761                 s2n(sizeof(tls12_sigalgs) + 2, ret);
 762                 s2n(sizeof(tls12_sigalgs), ret);
 763                 memcpy(ret, tls12_sigalgs, sizeof(tls12_sigalgs));
 764                 ret += sizeof(tls12_sigalgs);
 765                 }
 766
 767 #ifdef TLSEXT_TYPE_opaque_prf_input
 768         if (s->s3->client_opaque_prf_input != NULL &&
 769             s->version != DTLS1_VERSION)
 770                 {
 771                 size_t col = s->s3->client_opaque_prf_input_len;
 772
 773                 if ((long)(limit - ret - 6 - col < 0))
 774                         return NULL;
 775                 if (col > 0xFFFD) /* can't happen */
 776                         return NULL;
 777
 778                 s2n(TLSEXT_TYPE_opaque_prf_input, ret);
 779                 s2n(col + 2, ret);
 780                 s2n(col, ret);
 781                 memcpy(ret, s->s3->client_opaque_prf_input, col);
 782                 ret += col;
 783                 }
 784 #endif
 785
 786         if (s->tlsext_status_type == TLSEXT_STATUSTYPE_ocsp &&
 787             s->version != DTLS1_VERSION)
 788                 {
 789                 int i;
 790                 long extlen, idlen, itmp;
 791                 OCSP_RESPID *id;
 792
 793                 idlen = 0;
 794                 for (i = 0; i < sk_OCSP_RESPID_num(s->tlsext_ocsp_ids); i++)
 795                         {
 796                         id = sk_OCSP_RESPID_value(s->tlsext_ocsp_ids, i);
 797                         itmp = i2d_OCSP_RESPID(id, NULL);
 798                         if (itmp <= 0)
 799                                 return NULL;
 800                         idlen += itmp + 2;
 801                         }
 802
 803                 if (s->tlsext_ocsp_exts)
 804                         {
 805                         extlen = i2d_X509_EXTENSIONS(s->tlsext_ocsp_exts, NULL);
 806                         if (extlen < 0)
 807                                 return NULL;
 808                         }
 809                 else
 810                         extlen = 0;
 811
 812                 if ((long)(limit - ret - 7 - extlen - idlen) < 0) return NULL;
 813                 s2n(TLSEXT_TYPE_status_request, ret);
 814                 if (extlen + idlen > 0xFFF0)
 815                         return NULL;
 816                 s2n(extlen + idlen + 5, ret);
 817                 *(ret++) = TLSEXT_STATUSTYPE_ocsp;
 818                 s2n(idlen, ret);
 819                 for (i = 0; i < sk_OCSP_RESPID_num(s->tlsext_ocsp_ids); i++)
 820                         {
 821                         /* save position of id len */
 822                         unsigned char *q = ret;
 823                         id = sk_OCSP_RESPID_value(s->tlsext_ocsp_ids, i);
 824                         /* skip over id len */
 825                         ret += 2;
 826                         itmp = i2d_OCSP_RESPID(id, &ret);
 827                         /* write id len */
 828                         s2n(itmp, q);
 829                         }
 830                 s2n(extlen, ret);
 831                 if (extlen > 0)
 832                         i2d_X509_EXTENSIONS(s->tlsext_ocsp_exts, &ret);
 833                 }
 834
 835 #ifndef OPENSSL_NO_HEARTBEATS
 836         /* Add Heartbeat extension */
 837         s2n(TLSEXT_TYPE_heartbeat,ret);
 838         s2n(1,ret);
 839         /* Set mode:
 840          * 1: peer may send requests
 841          * 2: peer not allowed to send requests
 842          */
 843         if (s->tlsext_heartbeat & SSL_TLSEXT_HB_DONT_RECV_REQUESTS)
 844                 *(ret++) = SSL_TLSEXT_HB_DONT_SEND_REQUESTS;
 845         else
 846                 *(ret++) = SSL_TLSEXT_HB_ENABLED;
 847 #endif
 848
 849 #ifndef OPENSSL_NO_NEXTPROTONEG
 850         if (s->ctx->next_proto_select_cb && !s->s3->tmp.finish_md_len)
 851                 {
 852                 /* The client advertises an emtpy extension to indicate its
 853                  * support for Next Protocol Negotiation */
 854                 if (limit - ret - 4 < 0)
 855                         return NULL;
 856                 s2n(TLSEXT_TYPE_next_proto_neg,ret);
 857                 s2n(0,ret);
 858                 }
 859 #endif
 860
 861         if(SSL_get_srtp_profiles(s))
 862                 {
 863                 int el;
 864
 865                 ssl_add_clienthello_use_srtp_ext(s, 0, &el, 0);
 866
 867                 if((limit - p - 4 - el) < 0) return NULL;
 868
 869                 s2n(TLSEXT_TYPE_use_srtp,ret);
 870                 s2n(el,ret);
 871
 872                 if(ssl_add_clienthello_use_srtp_ext(s, ret, &el, el))
 873                         {
 874                         SSLerr(SSL_F_SSL_ADD_CLIENTHELLO_TLSEXT, ERR_R_INTERNAL_ERROR);
 875                         return NULL;
 876                         }
 877                 ret += el;
 878                 }
 879
 880         if ((extdatalen = ret-p-2)== 0)
 881                 return p;
 882
 883         s2n(extdatalen,p);
 884         return ret;
 885         }
 886
 887 unsigned char *ssl_add_serverhello_tlsext(SSL *s, unsigned char *p, unsigned char *limit)
 888         {
 889         int extdatalen=0;
 890         unsigned char *ret = p;
 891 #ifndef OPENSSL_NO_NEXTPROTONEG
 892         int next_proto_neg_seen;
 893 #endif
 894
 895         /* don't add extensions for SSLv3, unless doing secure renegotiation */
 896         if (s->version == SSL3_VERSION && !s->s3->send_connection_binding)
 897                 return p;
 898
 899         ret+=2;
 900         if (ret>=limit) return NULL; /* this really never occurs, but ... */
 901
 902         if (!s->hit && s->servername_done == 1 && s->session->tlsext_hostname != NULL)
 903                 {
 904                 if ((long)(limit - ret - 4) < 0) return NULL;
 905
 906                 s2n(TLSEXT_TYPE_server_name,ret);
 907                 s2n(0,ret);
 908                 }
 909
 910         if(s->s3->send_connection_binding)
 911         {
 912           int el;
 913
 914           if(!ssl_add_serverhello_renegotiate_ext(s, 0, &el, 0))
 915               {
 916               SSLerr(SSL_F_SSL_ADD_SERVERHELLO_TLSEXT, ERR_R_INTERNAL_ERROR);
 917               return NULL;
 918               }
 919
 920           if((limit - p - 4 - el) < 0) return NULL;
 921
 922           s2n(TLSEXT_TYPE_renegotiate,ret);
 923           s2n(el,ret);
 924
 925           if(!ssl_add_serverhello_renegotiate_ext(s, ret, &el, el))
 926               {
 927               SSLerr(SSL_F_SSL_ADD_SERVERHELLO_TLSEXT, ERR_R_INTERNAL_ERROR);
 928               return NULL;
 929               }
 930
 931           ret += el;
 932         }
 933
 934 #ifndef OPENSSL_NO_EC
 935         if (s->tlsext_ecpointformatlist != NULL &&
 936             s->version != DTLS1_VERSION)
 937                 {
 938                 /* Add TLS extension ECPointFormats to the ServerHello message */
 939                 long lenmax;
 940
 941                 if ((lenmax = limit - ret - 5) < 0) return NULL;
 942                 if (s->tlsext_ecpointformatlist_length > (unsigned long)lenmax) return NULL;
 943                 if (s->tlsext_ecpointformatlist_length > 255)
 944                         {
 945                         SSLerr(SSL_F_SSL_ADD_SERVERHELLO_TLSEXT, ERR_R_INTERNAL_ERROR);
 946                         return NULL;
 947                         }
 948
 949                 s2n(TLSEXT_TYPE_ec_point_formats,ret);
 950                 s2n(s->tlsext_ecpointformatlist_length + 1,ret);
 951                 *(ret++) = (unsigned char) s->tlsext_ecpointformatlist_length;
 952                 memcpy(ret, s->tlsext_ecpointformatlist, s->tlsext_ecpointformatlist_length);
 953                 ret+=s->tlsext_ecpointformatlist_length;
 954
 955                 }
 956         /* Currently the server should not respond with a SupportedCurves extension */
 957 #endif /* OPENSSL_NO_EC */
 958
 959         if (s->tlsext_ticket_expected
 960                 && !(SSL_get_options(s) & SSL_OP_NO_TICKET))
 961                 {
 962                 if ((long)(limit - ret - 4) < 0) return NULL;
 963                 s2n(TLSEXT_TYPE_session_ticket,ret);
 964                 s2n(0,ret);
 965                 }
 966
 967         if (s->tlsext_status_expected)
 968                 {
 969                 if ((long)(limit - ret - 4) < 0) return NULL;
 970                 s2n(TLSEXT_TYPE_status_request,ret);
 971                 s2n(0,ret);
 972                 }
 973
 974 #ifdef TLSEXT_TYPE_opaque_prf_input
 975         if (s->s3->server_opaque_prf_input != NULL &&
 976             s->version != DTLS1_VERSION)
 977                 {
 978                 size_t sol = s->s3->server_opaque_prf_input_len;
 979
 980                 if ((long)(limit - ret - 6 - sol) < 0)
 981                         return NULL;
 982                 if (sol > 0xFFFD) /* can't happen */
 983                         return NULL;
 984
 985                 s2n(TLSEXT_TYPE_opaque_prf_input, ret);
 986                 s2n(sol + 2, ret);
 987                 s2n(sol, ret);
 988                 memcpy(ret, s->s3->server_opaque_prf_input, sol);
 989                 ret += sol;
 990                 }
 991 #endif
 992
 993         if(s->srtp_profile)
 994                 {
 995                 int el;
 996
 997                 ssl_add_serverhello_use_srtp_ext(s, 0, &el, 0);
 998
 999                 if((limit - p - 4 - el) < 0) return NULL;
1000
1001                 s2n(TLSEXT_TYPE_use_srtp,ret);
1002                 s2n(el,ret);
1003
1004                 if(ssl_add_serverhello_use_srtp_ext(s, ret, &el, el))
1005                         {
1006                         SSLerr(SSL_F_SSL_ADD_SERVERHELLO_TLSEXT, ERR_R_INTERNAL_ERROR);
1007                         return NULL;
1008                         }
1009                 ret+=el;
1010                 }
1011
1012         if (((s->s3->tmp.new_cipher->id & 0xFFFF)==0x80 || (s->s3->tmp.new_cipher->id & 0xFFFF)==0x81)
1013                 && (SSL_get_options(s) & SSL_OP_CRYPTOPRO_TLSEXT_BUG))
1014                 { const unsigned char cryptopro_ext[36] = {
1015                         0xfd, 0xe8, /*65000*/
1016                         0x00, 0x20, /*32 bytes length*/
1017                         0x30, 0x1e, 0x30, 0x08, 0x06, 0x06, 0x2a, 0x85,
1018                         0x03,   0x02, 0x02, 0x09, 0x30, 0x08, 0x06, 0x06,
1019                         0x2a, 0x85, 0x03, 0x02, 0x02, 0x16, 0x30, 0x08,
1020                         0x06, 0x06, 0x2a, 0x85, 0x03, 0x02, 0x02, 0x17};
1021                         if (limit-ret<36) return NULL;
1022                         memcpy(ret,cryptopro_ext,36);
1023                         ret+=36;
1024
1025                 }
1026
1027 #ifndef OPENSSL_NO_HEARTBEATS
1028         /* Add Heartbeat extension if we've received one */
1029         if (s->tlsext_heartbeat & SSL_TLSEXT_HB_ENABLED)
1030                 {
1031                 s2n(TLSEXT_TYPE_heartbeat,ret);
1032                 s2n(1,ret);
1033                 /* Set mode:
1034                  * 1: peer may send requests
1035                  * 2: peer not allowed to send requests
1036                  */
1037                 if (s->tlsext_heartbeat & SSL_TLSEXT_HB_DONT_RECV_REQUESTS)
1038                         *(ret++) = SSL_TLSEXT_HB_DONT_SEND_REQUESTS;
1039                 else
1040                         *(ret++) = SSL_TLSEXT_HB_ENABLED;
1041
1042                 }
1043 #endif
1044
1045 #ifndef OPENSSL_NO_NEXTPROTONEG
1046         next_proto_neg_seen = s->s3->next_proto_neg_seen;
1047         s->s3->next_proto_neg_seen = 0;
1048         if (next_proto_neg_seen && s->ctx->next_protos_advertised_cb)
1049                 {
1050                 const unsigned char *npa;
1051                 unsigned int npalen;
1052                 int r;
1053
1054                 r = s->ctx->next_protos_advertised_cb(s, &npa, &npalen, s->ctx->next_protos_advertised_cb_arg);
1055                 if (r == SSL_TLSEXT_ERR_OK)
1056                         {
1057                         if ((long)(limit - ret - 4 - npalen) < 0) return NULL;
1058                         s2n(TLSEXT_TYPE_next_proto_neg,ret);
1059                         s2n(npalen,ret);
1060                         memcpy(ret, npa, npalen);
1061                         ret += npalen;
1062                         s->s3->next_proto_neg_seen = 1;
1063                         }
1064                 }
1065 #endif
1066
1067         if ((extdatalen = ret-p-2)== 0)
1068                 return p;
1069
1070         s2n(extdatalen,p);
1071         return ret;
1072         }
1073
1074 int ssl_parse_clienthello_tlsext(SSL *s, unsigned char **p, unsigned char *d, int n, int *al)
1075         {
1076         unsigned short type;
1077         unsigned short size;
1078         unsigned short len;
1079         unsigned char *data = *p;
1080         int renegotiate_seen = 0;
1081         int sigalg_seen = 0;
1082
1083         s->servername_done = 0;
1084         s->tlsext_status_type = -1;
1085 #ifndef OPENSSL_NO_NEXTPROTONEG
1086         s->s3->next_proto_neg_seen = 0;
1087 #endif
1088
1089 #ifndef OPENSSL_NO_HEARTBEATS
1090         s->tlsext_heartbeat &= ~(SSL_TLSEXT_HB_ENABLED |
1091                                SSL_TLSEXT_HB_DONT_SEND_REQUESTS);
1092 #endif
1093
1094         if (data >= (d+n-2))
1095                 goto ri_check;
1096         n2s(data,len);
1097
1098         if (data > (d+n-len))
1099                 goto ri_check;
1100
1101         while (data <= (d+n-4))
1102                 {
1103                 n2s(data,type);
1104                 n2s(data,size);
1105
1106                 if (data+size > (d+n))
1107                         goto ri_check;
1108 #if 0
1109                 fprintf(stderr,"Received extension type %d size %d\n",type,size);
1110 #endif
1111                 if (s->tlsext_debug_cb)
1112                         s->tlsext_debug_cb(s, 0, type, data, size,
1113                                                 s->tlsext_debug_arg);
1114 /* The servername extension is treated as follows:
1115
1116    - Only the hostname type is supported with a maximum length of 255.
1117    - The servername is rejected if too long or if it contains zeros,
1118      in which case an fatal alert is generated.
1119    - The servername field is maintained together with the session cache.
1120    - When a session is resumed, the servername call back invoked in order
1121      to allow the application to position itself to the right context.
1122    - The servername is acknowledged if it is new for a session or when
1123      it is identical to a previously used for the same session.
1124      Applications can control the behaviour.  They can at any time
1125      set a 'desirable' servername for a new SSL object. This can be the
1126      case for example with HTTPS when a Host: header field is received and
1127      a renegotiation is requested. In this case, a possible servername
1128      presented in the new client hello is only acknowledged if it matches
1129      the value of the Host: field.
1130    - Applications must  use SSL_OP_NO_SESSION_RESUMPTION_ON_RENEGOTIATION
1131      if they provide for changing an explicit servername context for the session,
1132      i.e. when the session has been established with a servername extension.
1133    - On session reconnect, the servername extension may be absent.
1134
1135 */
1136
1137                 if (type == TLSEXT_TYPE_server_name)
1138                         {
1139                         unsigned char *sdata;
1140                         int servname_type;
1141                         int dsize;
1142
1143                         if (size < 2)
1144                                 {
1145                                 *al = SSL_AD_DECODE_ERROR;
1146                                 return 0;
1147                                 }
1148                         n2s(data,dsize);
1149                         size -= 2;
1150                         if (dsize > size  )
1151                                 {
1152                                 *al = SSL_AD_DECODE_ERROR;
1153                                 return 0;
1154                                 }
1155
1156                         sdata = data;
1157                         while (dsize > 3)
1158                                 {
1159                                 servname_type = *(sdata++);
1160                                 n2s(sdata,len);
1161                                 dsize -= 3;
1162
1163                                 if (len > dsize)
1164                                         {
1165                                         *al = SSL_AD_DECODE_ERROR;
1166                                         return 0;
1167                                         }
1168                                 if (s->servername_done == 0)
1169                                 switch (servname_type)
1170                                         {
1171                                 case TLSEXT_NAMETYPE_host_name:
1172                                         if (!s->hit)
1173                                                 {
1174                                                 if(s->session->tlsext_hostname)
1175                                                         {
1176                                                         *al = SSL_AD_DECODE_ERROR;
1177                                                         return 0;
1178                                                         }
1179                                                 if (len > TLSEXT_MAXLEN_host_name)
1180                                                         {
1181                                                         *al = TLS1_AD_UNRECOGNIZED_NAME;
1182                                                         return 0;
1183                                                         }
1184                                                 if ((s->session->tlsext_hostname = OPENSSL_malloc(len+1)) == NULL)
1185                                                         {
1186                                                         *al = TLS1_AD_INTERNAL_ERROR;
1187                                                         return 0;
1188                                                         }
1189                                                 memcpy(s->session->tlsext_hostname, sdata, len);
1190                                                 s->session->tlsext_hostname[len]='\0';
1191                                                 if (strlen(s->session->tlsext_hostname) != len) {
1192                                                         OPENSSL_free(s->session->tlsext_hostname);
1193                                                         s->session->tlsext_hostname = NULL;
1194                                                         *al = TLS1_AD_UNRECOGNIZED_NAME;
1195                                                         return 0;
1196                                                 }
1197                                                 s->servername_done = 1;
1198
1199                                                 }
1200                                         else
1201                                                 s->servername_done = s->session->tlsext_hostname
1202                                                         && strlen(s->session->tlsext_hostname) == len
1203                                                         && strncmp(s->session->tlsext_hostname, (char *)sdata, len) == 0;
1204
1205                                         break;
1206
1207                                 default:
1208                                         break;
1209                                         }
1210
1211                                 dsize -= len;
1212                                 }
1213                         if (dsize != 0)
1214                                 {
1215                                 *al = SSL_AD_DECODE_ERROR;
1216                                 return 0;
1217                                 }
1218
1219                         }
1220 #ifndef OPENSSL_NO_SRP
1221                 else if (type == TLSEXT_TYPE_srp)
1222                         {
1223                         if (size <= 0 || ((len = data[0])) != (size -1))
1224                                 {
1225                                 *al = SSL_AD_DECODE_ERROR;
1226                                 return 0;
1227                                 }
1228                         if (s->srp_ctx.login != NULL)
1229                                 {
1230                                 *al = SSL_AD_DECODE_ERROR;
1231                                 return 0;
1232                                 }
1233                         if ((s->srp_ctx.login = OPENSSL_malloc(len+1)) == NULL)
1234                                 return -1;
1235                         memcpy(s->srp_ctx.login, &data[1], len);
1236                         s->srp_ctx.login[len]='\0';
1237
1238                         if (strlen(s->srp_ctx.login) != len)
1239                                 {
1240                                 *al = SSL_AD_DECODE_ERROR;
1241                                 return 0;
1242                                 }
1243                         }
1244 #endif
1245
1246 #ifndef OPENSSL_NO_EC
1247                 else if (type == TLSEXT_TYPE_ec_point_formats &&
1248                      s->version != DTLS1_VERSION)
1249                         {
1250                         unsigned char *sdata = data;
1251                         int ecpointformatlist_length = *(sdata++);
1252
1253                         if (ecpointformatlist_length != size - 1)
1254                                 {
1255                                 *al = TLS1_AD_DECODE_ERROR;
1256                                 return 0;
1257                                 }
1258                         if (!s->hit)
1259                                 {
1260                                 if(s->session->tlsext_ecpointformatlist)
1261                                         {
1262                                         OPENSSL_free(s->session->tlsext_ecpointformatlist);
1263                                         s->session->tlsext_ecpointformatlist = NULL;
1264                                         }
1265                                 s->session->tlsext_ecpointformatlist_length = 0;
1266                                 if ((s->session->tlsext_ecpointformatlist = OPENSSL_malloc(ecpointformatlist_length)) == NULL)
1267                                         {
1268                                         *al = TLS1_AD_INTERNAL_ERROR;
1269                                         return 0;
1270                                         }
1271                                 s->session->tlsext_ecpointformatlist_length = ecpointformatlist_length;
1272                                 memcpy(s->session->tlsext_ecpointformatlist, sdata, ecpointformatlist_length);
1273                                 }
1274 #if 0
1275                         fprintf(stderr,"ssl_parse_clienthello_tlsext s->session->tlsext_ecpointformatlist (length=%i) ", s->session->tlsext_ecpointformatlist_length);
1276                         sdata = s->session->tlsext_ecpointformatlist;
1277                         for (i = 0; i < s->session->tlsext_ecpointformatlist_length; i++)
1278                                 fprintf(stderr,"%i ",*(sdata++));
1279                         fprintf(stderr,"\n");
1280 #endif
1281                         }
1282                 else if (type == TLSEXT_TYPE_elliptic_curves &&
1283                      s->version != DTLS1_VERSION)
1284                         {
1285                         unsigned char *sdata = data;
1286                         int ellipticcurvelist_length = (*(sdata++) << 8);
1287                         ellipticcurvelist_length += (*(sdata++));
1288
1289                         if (ellipticcurvelist_length != size - 2)
1290                                 {
1291                                 *al = TLS1_AD_DECODE_ERROR;
1292                                 return 0;
1293                                 }
1294                         if (!s->hit)
1295                                 {
1296                                 if(s->session->tlsext_ellipticcurvelist)
1297                                         {
1298                                         *al = TLS1_AD_DECODE_ERROR;
1299                                         return 0;
1300                                         }
1301                                 s->session->tlsext_ellipticcurvelist_length = 0;
1302                                 if ((s->session->tlsext_ellipticcurvelist = OPENSSL_malloc(ellipticcurvelist_length)) == NULL)
1303                                         {
1304                                         *al = TLS1_AD_INTERNAL_ERROR;
1305                                         return 0;
1306                                         }
1307                                 s->session->tlsext_ellipticcurvelist_length = ellipticcurvelist_length;
1308                                 memcpy(s->session->tlsext_ellipticcurvelist, sdata, ellipticcurvelist_length);
1309                                 }
1310 #if 0
1311                         fprintf(stderr,"ssl_parse_clienthello_tlsext s->session->tlsext_ellipticcurvelist (length=%i) ", s->session->tlsext_ellipticcurvelist_length);
1312                         sdata = s->session->tlsext_ellipticcurvelist;
1313                         for (i = 0; i < s->session->tlsext_ellipticcurvelist_length; i++)
1314                                 fprintf(stderr,"%i ",*(sdata++));
1315                         fprintf(stderr,"\n");
1316 #endif
1317                         }
1318 #endif /* OPENSSL_NO_EC */
1319 #ifdef TLSEXT_TYPE_opaque_prf_input
1320                 else if (type == TLSEXT_TYPE_opaque_prf_input &&
1321                      s->version != DTLS1_VERSION)
1322                         {
1323                         unsigned char *sdata = data;
1324
1325                         if (size < 2)
1326                                 {
1327                                 *al = SSL_AD_DECODE_ERROR;
1328                                 return 0;
1329                                 }
1330                         n2s(sdata, s->s3->client_opaque_prf_input_len);
1331                         if (s->s3->client_opaque_prf_input_len != size - 2)
1332                                 {
1333                                 *al = SSL_AD_DECODE_ERROR;
1334                                 return 0;
1335                                 }
1336
1337                         if (s->s3->client_opaque_prf_input != NULL) /* shouldn't really happen */
1338                                 OPENSSL_free(s->s3->client_opaque_prf_input);
1339                         if (s->s3->client_opaque_prf_input_len == 0)
1340                                 s->s3->client_opaque_prf_input = OPENSSL_malloc(1); /* dummy byte just to get non-NULL */
1341                         else
1342                                 s->s3->client_opaque_prf_input = BUF_memdup(sdata, s->s3->client_opaque_prf_input_len);
1343                         if (s->s3->client_opaque_prf_input == NULL)
1344                                 {
1345                                 *al = TLS1_AD_INTERNAL_ERROR;
1346                                 return 0;
1347                                 }
1348                         }
1349 #endif
1350                 else if (type == TLSEXT_TYPE_session_ticket)
1351                         {
1352                         if (s->tls_session_ticket_ext_cb &&
1353                             !s->tls_session_ticket_ext_cb(s, data, size, s->tls_session_ticket_ext_cb_arg))
1354                                 {
1355                                 *al = TLS1_AD_INTERNAL_ERROR;
1356                                 return 0;
1357                                 }
1358                         }
1359                 else if (type == TLSEXT_TYPE_renegotiate)
1360                         {
1361                         if(!ssl_parse_clienthello_renegotiate_ext(s, data, size, al))
1362                                 return 0;
1363                         renegotiate_seen = 1;
1364                         }
1365                 else if (type == TLSEXT_TYPE_signature_algorithms)
1366                         {
1367                         int dsize;
1368                         if (sigalg_seen || size < 2)
1369                                 {
1370                                 *al = SSL_AD_DECODE_ERROR;
1371                                 return 0;
1372                                 }
1373                         sigalg_seen = 1;
1374                         n2s(data,dsize);
1375                         size -= 2;
1376                         if (dsize != size || dsize & 1)
1377                                 {
1378                                 *al = SSL_AD_DECODE_ERROR;
1379                                 return 0;
1380                                 }
1381                         if (!tls1_process_sigalgs(s, data, dsize))
1382                                 {
1383                                 *al = SSL_AD_DECODE_ERROR;
1384                                 return 0;
1385                                 }
1386                         }
1387                 else if (type == TLSEXT_TYPE_status_request &&
1388                          s->version != DTLS1_VERSION && s->ctx->tlsext_status_cb)
1389                         {
1390
1391                         if (size < 5)
1392                                 {
1393                                 *al = SSL_AD_DECODE_ERROR;
1394                                 return 0;
1395                                 }
1396
1397                         s->tlsext_status_type = *data++;
1398                         size--;
1399                         if (s->tlsext_status_type == TLSEXT_STATUSTYPE_ocsp)
1400                                 {
1401                                 const unsigned char *sdata;
1402                                 int dsize;
1403                                 /* Read in responder_id_list */
1404                                 n2s(data,dsize);
1405                                 size -= 2;
1406                                 if (dsize > size  )
1407                                         {
1408                                         *al = SSL_AD_DECODE_ERROR;
1409                                         return 0;
1410                                         }
1411                                 while (dsize > 0)
1412                                         {
1413                                         OCSP_RESPID *id;
1414                                         int idsize;
1415                                         if (dsize < 4)
1416                                                 {
1417                                                 *al = SSL_AD_DECODE_ERROR;
1418                                                 return 0;
1419                                                 }
1420                                         n2s(data, idsize);
1421                                         dsize -= 2 + idsize;
1422                                         size -= 2 + idsize;
1423                                         if (dsize < 0)
1424                                                 {
1425                                                 *al = SSL_AD_DECODE_ERROR;
1426                                                 return 0;
1427                                                 }
1428                                         sdata = data;
1429                                         data += idsize;
1430                                         id = d2i_OCSP_RESPID(NULL,
1431                                                                 &sdata, idsize);
1432                                         if (!id)
1433                                                 {
1434                                                 *al = SSL_AD_DECODE_ERROR;
1435                                                 return 0;
1436                                                 }
1437                                         if (data != sdata)
1438                                                 {
1439                                                 OCSP_RESPID_free(id);
1440                                                 *al = SSL_AD_DECODE_ERROR;
1441                                                 return 0;
1442                                                 }
1443                                         if (!s->tlsext_ocsp_ids
1444                                                 && !(s->tlsext_ocsp_ids =
1445                                                 sk_OCSP_RESPID_new_null()))
1446                                                 {
1447                                                 OCSP_RESPID_free(id);
1448                                                 *al = SSL_AD_INTERNAL_ERROR;
1449                                                 return 0;
1450                                                 }
1451                                         if (!sk_OCSP_RESPID_push(
1452                                                         s->tlsext_ocsp_ids, id))
1453                                                 {
1454                                                 OCSP_RESPID_free(id);
1455                                                 *al = SSL_AD_INTERNAL_ERROR;
1456                                                 return 0;
1457                                                 }
1458                                         }
1459
1460                                 /* Read in request_extensions */
1461                                 if (size < 2)
1462                                         {
1463                                         *al = SSL_AD_DECODE_ERROR;
1464                                         return 0;
1465                                         }
1466                                 n2s(data,dsize);
1467                                 size -= 2;
1468                                 if (dsize != size)
1469                                         {
1470                                         *al = SSL_AD_DECODE_ERROR;
1471                                         return 0;
1472                                         }
1473                                 sdata = data;
1474                                 if (dsize > 0)
1475                                         {
1476                                         if (s->tlsext_ocsp_exts)
1477                                                 {
1478                                                 sk_X509_EXTENSION_pop_free(s->tlsext_ocsp_exts,
1479                                                                            X509_EXTENSION_free);
1480                                                 }
1481
1482                                         s->tlsext_ocsp_exts =
1483                                                 d2i_X509_EXTENSIONS(NULL,
1484                                                         &sdata, dsize);
1485                                         if (!s->tlsext_ocsp_exts
1486                                                 || (data + dsize != sdata))
1487                                                 {
1488                                                 *al = SSL_AD_DECODE_ERROR;
1489                                                 return 0;
1490                                                 }
1491                                         }
1492                                 }
1493                                 /* We don't know what to do with any other type
1494                                 * so ignore it.
1495                                 */
1496                                 else
1497                                         s->tlsext_status_type = -1;
1498                         }
1499 #ifndef OPENSSL_NO_HEARTBEATS
1500                 else if (type == TLSEXT_TYPE_heartbeat)
1501                         {
1502                         switch(data[0])
1503                                 {
1504                                 case 0x01:      /* Client allows us to send HB requests */
1505                                                         s->tlsext_heartbeat |= SSL_TLSEXT_HB_ENABLED;
1506                                                         break;
1507                                 case 0x02:      /* Client doesn't accept HB requests */
1508                                                         s->tlsext_heartbeat |= SSL_TLSEXT_HB_ENABLED;
1509                                                         s->tlsext_heartbeat |= SSL_TLSEXT_HB_DONT_SEND_REQUESTS;
1510                                                         break;
1511                                 default:        *al = SSL_AD_ILLEGAL_PARAMETER;
1512                                                         return 0;
1513                                 }
1514                         }
1515 #endif
1516 #ifndef OPENSSL_NO_NEXTPROTONEG
1517                 else if (type == TLSEXT_TYPE_next_proto_neg &&
1518                          s->s3->tmp.finish_md_len == 0)
1519                         {
1520                         /* We shouldn't accept this extension on a
1521                          * renegotiation.
1522                          *
1523                          * s->new_session will be set on renegotiation, but we
1524                          * probably shouldn't rely that it couldn't be set on
1525                          * the initial renegotation too in certain cases (when
1526                          * there's some other reason to disallow resuming an
1527                          * earlier session -- the current code won't be doing
1528                          * anything like that, but this might change).
1529
1530                          * A valid sign that there's been a previous handshake
1531                          * in this connection is if s->s3->tmp.finish_md_len >
1532                          * 0.  (We are talking about a check that will happen
1533                          * in the Hello protocol round, well before a new
1534                          * Finished message could have been computed.) */
1535                         s->s3->next_proto_neg_seen = 1;
1536                         }
1537 #endif
1538
1539                 /* session ticket processed earlier */
1540                 else if (type == TLSEXT_TYPE_use_srtp)
1541                         {
1542                         if(ssl_parse_clienthello_use_srtp_ext(s, data, size,
1543                                                               al))
1544                                 return 0;
1545                         }
1546
1547                 data+=size;
1548                 }
1549
1550         *p = data;
1551
1552         ri_check:
1553
1554         /* Need RI if renegotiating */
1555
1556         if (!renegotiate_seen && s->renegotiate &&
1557                 !(s->options & SSL_OP_ALLOW_UNSAFE_LEGACY_RENEGOTIATION))
1558                 {
1559                 *al = SSL_AD_HANDSHAKE_FAILURE;
1560                 SSLerr(SSL_F_SSL_PARSE_CLIENTHELLO_TLSEXT,
1561                                 SSL_R_UNSAFE_LEGACY_RENEGOTIATION_DISABLED);
1562                 return 0;
1563                 }
1564
1565         return 1;
1566         }
1567
1568 #ifndef OPENSSL_NO_NEXTPROTONEG
1569 /* ssl_next_proto_validate validates a Next Protocol Negotiation block. No
1570  * elements of zero length are allowed and the set of elements must exactly fill
1571  * the length of the block. */
1572 static int ssl_next_proto_validate(unsigned char *d, unsigned len)
1573         {
1574         unsigned int off = 0;
1575
1576         while (off < len)
1577                 {
1578                 if (d[off] == 0)
1579                         return 0;
1580                 off += d[off];
1581                 off++;
1582                 }
1583
1584         return off == len;
1585         }
1586 #endif
1587
1588 int ssl_parse_serverhello_tlsext(SSL *s, unsigned char **p, unsigned char *d, int n, int *al)
1589         {
1590         unsigned short length;
1591         unsigned short type;
1592         unsigned short size;
1593         unsigned char *data = *p;
1594         int tlsext_servername = 0;
1595         int renegotiate_seen = 0;
1596
1597 #ifndef OPENSSL_NO_NEXTPROTONEG
1598         s->s3->next_proto_neg_seen = 0;
1599 #endif
1600
1601 #ifndef OPENSSL_NO_HEARTBEATS
1602         s->tlsext_heartbeat &= ~(SSL_TLSEXT_HB_ENABLED |
1603                                SSL_TLSEXT_HB_DONT_SEND_REQUESTS);
1604 #endif
1605
1606         if (data >= (d+n-2))
1607                 goto ri_check;
1608
1609         n2s(data,length);
1610         if (data+length != d+n)
1611                 {
1612                 *al = SSL_AD_DECODE_ERROR;
1613                 return 0;
1614                 }
1615
1616         while(data <= (d+n-4))
1617                 {
1618                 n2s(data,type);
1619                 n2s(data,size);
1620
1621                 if (data+size > (d+n))
1622                         goto ri_check;
1623
1624                 if (s->tlsext_debug_cb)
1625                         s->tlsext_debug_cb(s, 1, type, data, size,
1626                                                 s->tlsext_debug_arg);
1627
1628                 if (type == TLSEXT_TYPE_server_name)
1629                         {
1630                         if (s->tlsext_hostname == NULL || size > 0)
1631                                 {
1632                                 *al = TLS1_AD_UNRECOGNIZED_NAME;
1633                                 return 0;
1634                                 }
1635                         tlsext_servername = 1;
1636                         }
1637
1638 #ifndef OPENSSL_NO_EC
1639                 else if (type == TLSEXT_TYPE_ec_point_formats &&
1640                      s->version != DTLS1_VERSION)
1641                         {
1642                         unsigned char *sdata = data;
1643                         int ecpointformatlist_length = *(sdata++);
1644
1645                         if (ecpointformatlist_length != size - 1)
1646                                 {
1647                                 *al = TLS1_AD_DECODE_ERROR;
1648                                 return 0;
1649                                 }
1650                         s->session->tlsext_ecpointformatlist_length = 0;
1651                         if (s->session->tlsext_ecpointformatlist != NULL) OPENSSL_free(s->session->tlsext_ecpointformatlist);
1652                         if ((s->session->tlsext_ecpointformatlist = OPENSSL_malloc(ecpointformatlist_length)) == NULL)
1653                                 {
1654                                 *al = TLS1_AD_INTERNAL_ERROR;
1655                                 return 0;
1656                                 }
1657                         s->session->tlsext_ecpointformatlist_length = ecpointformatlist_length;
1658                         memcpy(s->session->tlsext_ecpointformatlist, sdata, ecpointformatlist_length);
1659 #if 0
1660                         fprintf(stderr,"ssl_parse_serverhello_tlsext s->session->tlsext_ecpointformatlist ");
1661                         sdata = s->session->tlsext_ecpointformatlist;
1662                         for (i = 0; i < s->session->tlsext_ecpointformatlist_length; i++)
1663                                 fprintf(stderr,"%i ",*(sdata++));
1664                         fprintf(stderr,"\n");
1665 #endif
1666                         }
1667 #endif /* OPENSSL_NO_EC */
1668
1669                 else if (type == TLSEXT_TYPE_session_ticket)
1670                         {
1671                         if (s->tls_session_ticket_ext_cb &&
1672                             !s->tls_session_ticket_ext_cb(s, data, size, s->tls_session_ticket_ext_cb_arg))
1673                                 {
1674                                 *al = TLS1_AD_INTERNAL_ERROR;
1675                                 return 0;
1676                                 }
1677                         if ((SSL_get_options(s) & SSL_OP_NO_TICKET)
1678                                 || (size > 0))
1679                                 {
1680                                 *al = TLS1_AD_UNSUPPORTED_EXTENSION;
1681                                 return 0;
1682                                 }
1683                         s->tlsext_ticket_expected = 1;
1684                         }
1685 #ifdef TLSEXT_TYPE_opaque_prf_input
1686                 else if (type == TLSEXT_TYPE_opaque_prf_input &&
1687                      s->version != DTLS1_VERSION)
1688                         {
1689                         unsigned char *sdata = data;
1690
1691                         if (size < 2)
1692                                 {
1693                                 *al = SSL_AD_DECODE_ERROR;
1694                                 return 0;
1695                                 }
1696                         n2s(sdata, s->s3->server_opaque_prf_input_len);
1697                         if (s->s3->server_opaque_prf_input_len != size - 2)
1698                                 {
1699                                 *al = SSL_AD_DECODE_ERROR;
1700                                 return 0;
1701                                 }
1702
1703                         if (s->s3->server_opaque_prf_input != NULL) /* shouldn't really happen */
1704                                 OPENSSL_free(s->s3->server_opaque_prf_input);
1705                         if (s->s3->server_opaque_prf_input_len == 0)
1706                                 s->s3->server_opaque_prf_input = OPENSSL_malloc(1); /* dummy byte just to get non-NULL */
1707                         else
1708                                 s->s3->server_opaque_prf_input = BUF_memdup(sdata, s->s3->server_opaque_prf_input_len);
1709
1710                         if (s->s3->server_opaque_prf_input == NULL)
1711                                 {
1712                                 *al = TLS1_AD_INTERNAL_ERROR;
1713                                 return 0;
1714                                 }
1715                         }
1716 #endif
1717                 else if (type == TLSEXT_TYPE_status_request &&
1718                          s->version != DTLS1_VERSION)
1719                         {
1720                         /* MUST be empty and only sent if we've requested
1721                          * a status request message.
1722                          */
1723                         if ((s->tlsext_status_type == -1) || (size > 0))
1724                                 {
1725                                 *al = TLS1_AD_UNSUPPORTED_EXTENSION;
1726                                 return 0;
1727                                 }
1728                         /* Set flag to expect CertificateStatus message */
1729                         s->tlsext_status_expected = 1;
1730                         }
1731 #ifndef OPENSSL_NO_NEXTPROTONEG
1732                 else if (type == TLSEXT_TYPE_next_proto_neg &&
1733                          s->s3->tmp.finish_md_len == 0)
1734                         {
1735                         unsigned char *selected;
1736                         unsigned char selected_len;
1737
1738                         /* We must have requested it. */
1739                         if ((s->ctx->next_proto_select_cb == NULL))
1740                                 {
1741                                 *al = TLS1_AD_UNSUPPORTED_EXTENSION;
1742                                 return 0;
1743                                 }
1744                         /* The data must be valid */
1745                         if (!ssl_next_proto_validate(data, size))
1746                                 {
1747                                 *al = TLS1_AD_DECODE_ERROR;
1748                                 return 0;
1749                                 }
1750                         if (s->ctx->next_proto_select_cb(s, &selected, &selected_len, data, size, s->ctx->next_proto_select_cb_arg) != SSL_TLSEXT_ERR_OK)
1751                                 {
1752                                 *al = TLS1_AD_INTERNAL_ERROR;
1753                                 return 0;
1754                                 }
1755                         s->next_proto_negotiated = OPENSSL_malloc(selected_len);
1756                         if (!s->next_proto_negotiated)
1757                                 {
1758                                 *al = TLS1_AD_INTERNAL_ERROR;
1759                                 return 0;
1760                                 }
1761                         memcpy(s->next_proto_negotiated, selected, selected_len);
1762                         s->next_proto_negotiated_len = selected_len;
1763                         s->s3->next_proto_neg_seen = 1;
1764                         }
1765 #endif
1766                 else if (type == TLSEXT_TYPE_renegotiate)
1767                         {
1768                         if(!ssl_parse_serverhello_renegotiate_ext(s, data, size, al))
1769                                 return 0;
1770                         renegotiate_seen = 1;
1771                         }
1772 #ifndef OPENSSL_NO_HEARTBEATS
1773                 else if (type == TLSEXT_TYPE_heartbeat)
1774                         {
1775                         switch(data[0])
1776                                 {
1777                                 case 0x01:      /* Server allows us to send HB requests */
1778                                                         s->tlsext_heartbeat |= SSL_TLSEXT_HB_ENABLED;
1779                                                         break;
1780                                 case 0x02:      /* Server doesn't accept HB requests */
1781                                                         s->tlsext_heartbeat |= SSL_TLSEXT_HB_ENABLED;
1782                                                         s->tlsext_heartbeat |= SSL_TLSEXT_HB_DONT_SEND_REQUESTS;
1783                                                         break;
1784                                 default:        *al = SSL_AD_ILLEGAL_PARAMETER;
1785                                                         return 0;
1786                                 }
1787                         }
1788 #endif
1789                 else if (type == TLSEXT_TYPE_use_srtp)
1790                         {
1791                         if(ssl_parse_serverhello_use_srtp_ext(s, data, size,
1792                                                               al))
1793                                 return 0;
1794                         }
1795
1796                 data+=size;
1797                 }
1798
1799         if (data != d+n)
1800                 {
1801                 *al = SSL_AD_DECODE_ERROR;
1802                 return 0;
1803                 }
1804
1805         if (!s->hit && tlsext_servername == 1)
1806                 {
1807                 if (s->tlsext_hostname)
1808                         {
1809                         if (s->session->tlsext_hostname == NULL)
1810                                 {
1811                                 s->session->tlsext_hostname = BUF_strdup(s->tlsext_hostname);
1812                                 if (!s->session->tlsext_hostname)
1813                                         {
1814                                         *al = SSL_AD_UNRECOGNIZED_NAME;
1815                                         return 0;
1816                                         }
1817                                 }
1818                         else
1819                                 {
1820                                 *al = SSL_AD_DECODE_ERROR;
1821                                 return 0;
1822                                 }
1823                         }
1824                 }
1825
1826         *p = data;
1827
1828         ri_check:
1829
1830         /* Determine if we need to see RI. Strictly speaking if we want to
1831          * avoid an attack we should *always* see RI even on initial server
1832          * hello because the client doesn't see any renegotiation during an
1833          * attack. However this would mean we could not connect to any server
1834          * which doesn't support RI so for the immediate future tolerate RI
1835          * absence on initial connect only.
1836          */
1837         if (!renegotiate_seen
1838                 && !(s->options & SSL_OP_LEGACY_SERVER_CONNECT)
1839                 && !(s->options & SSL_OP_ALLOW_UNSAFE_LEGACY_RENEGOTIATION))
1840                 {
1841                 *al = SSL_AD_HANDSHAKE_FAILURE;
1842                 SSLerr(SSL_F_SSL_PARSE_SERVERHELLO_TLSEXT,
1843                                 SSL_R_UNSAFE_LEGACY_RENEGOTIATION_DISABLED);
1844                 return 0;
1845                 }
1846
1847         return 1;
1848         }
1849
1850
1851 int ssl_prepare_clienthello_tlsext(SSL *s)
1852         {
1853
1854 #ifdef TLSEXT_TYPE_opaque_prf_input
1855         {
1856                 int r = 1;
1857
1858                 if (s->ctx->tlsext_opaque_prf_input_callback != 0)
1859                         {
1860                         r = s->ctx->tlsext_opaque_prf_input_callback(s, NULL, 0, s->ctx->tlsext_opaque_prf_input_callback_arg);
1861                         if (!r)
1862                                 return -1;
1863                         }
1864
1865                 if (s->tlsext_opaque_prf_input != NULL)
1866                         {
1867                         if (s->s3->client_opaque_prf_input != NULL) /* shouldn't really happen */
1868                                 OPENSSL_free(s->s3->client_opaque_prf_input);
1869
1870                         if (s->tlsext_opaque_prf_input_len == 0)
1871                                 s->s3->client_opaque_prf_input = OPENSSL_malloc(1); /* dummy byte just to get non-NULL */
1872                         else
1873                                 s->s3->client_opaque_prf_input = BUF_memdup(s->tlsext_opaque_prf_input, s->tlsext_opaque_prf_input_len);
1874                         if (s->s3->client_opaque_prf_input == NULL)
1875                                 {
1876                                 SSLerr(SSL_F_SSL_PREPARE_CLIENTHELLO_TLSEXT,ERR_R_MALLOC_FAILURE);
1877                                 return -1;
1878                                 }
1879                         s->s3->client_opaque_prf_input_len = s->tlsext_opaque_prf_input_len;
1880                         }
1881
1882                 if (r == 2)
1883                         /* at callback's request, insist on receiving an appropriate server opaque PRF input */
1884                         s->s3->server_opaque_prf_input_len = s->tlsext_opaque_prf_input_len;
1885         }
1886 #endif
1887
1888         return 1;
1889         }
1890
1891 int ssl_prepare_serverhello_tlsext(SSL *s)
1892         {
1893 #ifndef OPENSSL_NO_EC
1894         /* If we are server and using an ECC cipher suite, send the point formats we support
1895          * if the client sent us an ECPointsFormat extension.  Note that the server is not
1896          * supposed to send an EllipticCurves extension.
1897          */
1898
1899         unsigned long alg_k = s->s3->tmp.new_cipher->algorithm_mkey;
1900         unsigned long alg_a = s->s3->tmp.new_cipher->algorithm_auth;
1901         int using_ecc = (alg_k & (SSL_kEECDH|SSL_kECDHr|SSL_kECDHe)) || (alg_a & SSL_aECDSA);
1902         using_ecc = using_ecc && (s->session->tlsext_ecpointformatlist != NULL);
1903
1904         if (using_ecc)
1905                 {
1906                 if (s->tlsext_ecpointformatlist != NULL) OPENSSL_free(s->tlsext_ecpointformatlist);
1907                 if ((s->tlsext_ecpointformatlist = OPENSSL_malloc(3)) == NULL)
1908                         {
1909                         SSLerr(SSL_F_SSL_PREPARE_SERVERHELLO_TLSEXT,ERR_R_MALLOC_FAILURE);
1910                         return -1;
1911                         }
1912                 s->tlsext_ecpointformatlist_length = 3;
1913                 s->tlsext_ecpointformatlist[0] = TLSEXT_ECPOINTFORMAT_uncompressed;
1914                 s->tlsext_ecpointformatlist[1] = TLSEXT_ECPOINTFORMAT_ansiX962_compressed_prime;
1915                 s->tlsext_ecpointformatlist[2] = TLSEXT_ECPOINTFORMAT_ansiX962_compressed_char2;
1916                 }
1917 #endif /* OPENSSL_NO_EC */
1918
1919         return 1;
1920         }
1921
1922 int ssl_check_clienthello_tlsext(SSL *s)
1923         {
1924         int ret=SSL_TLSEXT_ERR_NOACK;
1925         int al = SSL_AD_UNRECOGNIZED_NAME;
1926
1927 #ifndef OPENSSL_NO_EC
1928         /* The handling of the ECPointFormats extension is done elsewhere, namely in
1929          * ssl3_choose_cipher in s3_lib.c.
1930          */
1931         /* The handling of the EllipticCurves extension is done elsewhere, namely in
1932          * ssl3_choose_cipher in s3_lib.c.
1933          */
1934 #endif
1935
1936         if (s->ctx != NULL && s->ctx->tlsext_servername_callback != 0)
1937                 ret = s->ctx->tlsext_servername_callback(s, &al, s->ctx->tlsext_servername_arg);
1938         else if (s->initial_ctx != NULL && s->initial_ctx->tlsext_servername_callback != 0)
1939                 ret = s->initial_ctx->tlsext_servername_callback(s, &al, s->initial_ctx->tlsext_servername_arg);
1940
1941         /* If status request then ask callback what to do.
1942          * Note: this must be called after servername callbacks in case
1943          * the certificate has changed.
1944          */
1945         if ((s->tlsext_status_type != -1) && s->ctx && s->ctx->tlsext_status_cb)
1946                 {
1947                 int r;
1948                 r = s->ctx->tlsext_status_cb(s, s->ctx->tlsext_status_arg);
1949                 switch (r)
1950                         {
1951                         /* We don't want to send a status request response */
1952                         case SSL_TLSEXT_ERR_NOACK:
1953                                 s->tlsext_status_expected = 0;
1954                                 break;
1955                         /* status request response should be sent */
1956                         case SSL_TLSEXT_ERR_OK:
1957                                 if (s->tlsext_ocsp_resp)
1958                                         s->tlsext_status_expected = 1;
1959                                 else
1960                                         s->tlsext_status_expected = 0;
1961                                 break;
1962                         /* something bad happened */
1963                         case SSL_TLSEXT_ERR_ALERT_FATAL:
1964                                 ret = SSL_TLSEXT_ERR_ALERT_FATAL;
1965                                 al = SSL_AD_INTERNAL_ERROR;
1966                                 goto err;
1967                         }
1968                 }
1969         else
1970                 s->tlsext_status_expected = 0;
1971
1972 #ifdef TLSEXT_TYPE_opaque_prf_input
1973         {
1974                 /* This sort of belongs into ssl_prepare_serverhello_tlsext(),
1975                  * but we might be sending an alert in response to the client hello,
1976                  * so this has to happen here in ssl_check_clienthello_tlsext(). */
1977
1978                 int r = 1;
1979
1980                 if (s->ctx->tlsext_opaque_prf_input_callback != 0)
1981                         {
1982                         r = s->ctx->tlsext_opaque_prf_input_callback(s, NULL, 0, s->ctx->tlsext_opaque_prf_input_callback_arg);
1983                         if (!r)
1984                                 {
1985                                 ret = SSL_TLSEXT_ERR_ALERT_FATAL;
1986                                 al = SSL_AD_INTERNAL_ERROR;
1987                                 goto err;
1988                                 }
1989                         }
1990
1991                 if (s->s3->server_opaque_prf_input != NULL) /* shouldn't really happen */
1992                         OPENSSL_free(s->s3->server_opaque_prf_input);
1993                 s->s3->server_opaque_prf_input = NULL;
1994
1995                 if (s->tlsext_opaque_prf_input != NULL)
1996                         {
1997                         if (s->s3->client_opaque_prf_input != NULL &&
1998                                 s->s3->client_opaque_prf_input_len == s->tlsext_opaque_prf_input_len)
1999                                 {
2000                                 /* can only use this extension if we have a server opaque PRF input
2001                                  * of the same length as the client opaque PRF input! */
2002
2003                                 if (s->tlsext_opaque_prf_input_len == 0)
2004                                         s->s3->server_opaque_prf_input = OPENSSL_malloc(1); /* dummy byte just to get non-NULL */
2005                                 else
2006                                         s->s3->server_opaque_prf_input = BUF_memdup(s->tlsext_opaque_prf_input, s->tlsext_opaque_prf_input_len);
2007                                 if (s->s3->server_opaque_prf_input == NULL)
2008                                         {
2009                                         ret = SSL_TLSEXT_ERR_ALERT_FATAL;
2010                                         al = SSL_AD_INTERNAL_ERROR;
2011                                         goto err;
2012                                         }
2013                                 s->s3->server_opaque_prf_input_len = s->tlsext_opaque_prf_input_len;
2014                                 }
2015                         }
2016
2017                 if (r == 2 && s->s3->server_opaque_prf_input == NULL)
2018                         {
2019                         /* The callback wants to enforce use of the extension,
2020                          * but we can't do that with the client opaque PRF input;
2021                          * abort the handshake.
2022                          */
2023                         ret = SSL_TLSEXT_ERR_ALERT_FATAL;
2024                         al = SSL_AD_HANDSHAKE_FAILURE;
2025                         }
2026         }
2027
2028 #endif
2029  err:
2030         switch (ret)
2031                 {
2032                 case SSL_TLSEXT_ERR_ALERT_FATAL:
2033                         ssl3_send_alert(s,SSL3_AL_FATAL,al);
2034                         return -1;
2035
2036                 case SSL_TLSEXT_ERR_ALERT_WARNING:
2037                         ssl3_send_alert(s,SSL3_AL_WARNING,al);
2038                         return 1;
2039
2040                 case SSL_TLSEXT_ERR_NOACK:
2041                         s->servername_done=0;
2042                         default:
2043                 return 1;
2044                 }
2045         }
2046
2047 int ssl_check_serverhello_tlsext(SSL *s)
2048         {
2049         int ret=SSL_TLSEXT_ERR_NOACK;
2050         int al = SSL_AD_UNRECOGNIZED_NAME;
2051
2052 #ifndef OPENSSL_NO_EC
2053         /* If we are client and using an elliptic curve cryptography cipher
2054          * suite, then if server returns an EC point formats lists extension
2055          * it must contain uncompressed.
2056          */
2057         unsigned long alg_k = s->s3->tmp.new_cipher->algorithm_mkey;
2058         unsigned long alg_a = s->s3->tmp.new_cipher->algorithm_auth;
2059         if ((s->tlsext_ecpointformatlist != NULL) && (s->tlsext_ecpointformatlist_length > 0) &&
2060             (s->session->tlsext_ecpointformatlist != NULL) && (s->session->tlsext_ecpointformatlist_length > 0) &&
2061             ((alg_k & (SSL_kEECDH|SSL_kECDHr|SSL_kECDHe)) || (alg_a & SSL_aECDSA)))
2062                 {
2063                 /* we are using an ECC cipher */
2064                 size_t i;
2065                 unsigned char *list;
2066                 int found_uncompressed = 0;
2067                 list = s->session->tlsext_ecpointformatlist;
2068                 for (i = 0; i < s->session->tlsext_ecpointformatlist_length; i++)
2069                         {
2070                         if (*(list++) == TLSEXT_ECPOINTFORMAT_uncompressed)
2071                                 {
2072                                 found_uncompressed = 1;
2073                                 break;
2074                                 }
2075                         }
2076                 if (!found_uncompressed)
2077                         {
2078                         SSLerr(SSL_F_SSL_CHECK_SERVERHELLO_TLSEXT,SSL_R_TLS_INVALID_ECPOINTFORMAT_LIST);
2079                         return -1;
2080                         }
2081                 }
2082         ret = SSL_TLSEXT_ERR_OK;
2083 #endif /* OPENSSL_NO_EC */
2084
2085         if (s->ctx != NULL && s->ctx->tlsext_servername_callback != 0)
2086                 ret = s->ctx->tlsext_servername_callback(s, &al, s->ctx->tlsext_servername_arg);
2087         else if (s->initial_ctx != NULL && s->initial_ctx->tlsext_servername_callback != 0)
2088                 ret = s->initial_ctx->tlsext_servername_callback(s, &al, s->initial_ctx->tlsext_servername_arg);
2089
2090 #ifdef TLSEXT_TYPE_opaque_prf_input
2091         if (s->s3->server_opaque_prf_input_len > 0)
2092                 {
2093                 /* This case may indicate that we, as a client, want to insist on using opaque PRF inputs.
2094                  * So first verify that we really have a value from the server too. */
2095
2096                 if (s->s3->server_opaque_prf_input == NULL)
2097                         {
2098                         ret = SSL_TLSEXT_ERR_ALERT_FATAL;
2099                         al = SSL_AD_HANDSHAKE_FAILURE;
2100                         }
2101
2102                 /* Anytime the server *has* sent an opaque PRF input, we need to check
2103                  * that we have a client opaque PRF input of the same size. */
2104                 if (s->s3->client_opaque_prf_input == NULL ||
2105                     s->s3->client_opaque_prf_input_len != s->s3->server_opaque_prf_input_len)
2106                         {
2107                         ret = SSL_TLSEXT_ERR_ALERT_FATAL;
2108                         al = SSL_AD_ILLEGAL_PARAMETER;
2109                         }
2110                 }
2111 #endif
2112
2113         /* If we've requested certificate status and we wont get one
2114          * tell the callback
2115          */
2116         if ((s->tlsext_status_type != -1) && !(s->tlsext_status_expected)
2117                         && s->ctx && s->ctx->tlsext_status_cb)
2118                 {
2119                 int r;
2120                 /* Set resp to NULL, resplen to -1 so callback knows
2121                  * there is no response.
2122                  */
2123                 if (s->tlsext_ocsp_resp)
2124                         {
2125                         OPENSSL_free(s->tlsext_ocsp_resp);
2126                         s->tlsext_ocsp_resp = NULL;
2127                         }
2128                 s->tlsext_ocsp_resplen = -1;
2129                 r = s->ctx->tlsext_status_cb(s, s->ctx->tlsext_status_arg);
2130                 if (r == 0)
2131                         {
2132                         al = SSL_AD_BAD_CERTIFICATE_STATUS_RESPONSE;
2133                         ret = SSL_TLSEXT_ERR_ALERT_FATAL;
2134                         }
2135                 if (r < 0)
2136                         {
2137                         al = SSL_AD_INTERNAL_ERROR;
2138                         ret = SSL_TLSEXT_ERR_ALERT_FATAL;
2139                         }
2140                 }
2141
2142         switch (ret)
2143                 {
2144                 case SSL_TLSEXT_ERR_ALERT_FATAL:
2145                         ssl3_send_alert(s,SSL3_AL_FATAL,al);
2146                         return -1;
2147
2148                 case SSL_TLSEXT_ERR_ALERT_WARNING:
2149                         ssl3_send_alert(s,SSL3_AL_WARNING,al);
2150                         return 1;
2151
2152                 case SSL_TLSEXT_ERR_NOACK:
2153                         s->servername_done=0;
2154                         default:
2155                 return 1;
2156                 }
2157         }
2158
2159 /* Since the server cache lookup is done early on in the processing of the
2160  * ClientHello, and other operations depend on the result, we need to handle
2161  * any TLS session ticket extension at the same time.
2162  *
2163  *   session_id: points at the session ID in the ClientHello. This code will
2164  *       read past the end of this in order to parse out the session ticket
2165  *       extension, if any.
2166  *   len: the length of the session ID.
2167  *   limit: a pointer to the first byte after the ClientHello.
2168  *   ret: (output) on return, if a ticket was decrypted, then this is set to
2169  *       point to the resulting session.
2170  *
2171  * If s->tls_session_secret_cb is set then we are expecting a pre-shared key
2172  * ciphersuite, in which case we have no use for session tickets and one will
2173  * never be decrypted, nor will s->tlsext_ticket_expected be set to 1.
2174  *
2175  * Returns:
2176  *   -1: fatal error, either from parsing or decrypting the ticket.
2177  *    0: no ticket was found (or was ignored, based on settings).
2178  *    1: a zero length extension was found, indicating that the client supports
2179  *       session tickets but doesn't currently have one to offer.
2180  *    2: either s->tls_session_secret_cb was set, or a ticket was offered but
2181  *       couldn't be decrypted because of a non-fatal error.
2182  *    3: a ticket was successfully decrypted and *ret was set.
2183  *
2184  * Side effects:
2185  *   Sets s->tlsext_ticket_expected to 1 if the server will have to issue
2186  *   a new session ticket to the client because the client indicated support
2187  *   (and s->tls_session_secret_cb is NULL) but the client either doesn't have
2188  *   a session ticket or we couldn't use the one it gave us, or if
2189  *   s->ctx->tlsext_ticket_key_cb asked to renew the client's ticket.
2190  *   Otherwise, s->tlsext_ticket_expected is set to 0.
2191  */
2192 int tls1_process_ticket(SSL *s, unsigned char *session_id, int len,
2193                         const unsigned char *limit, SSL_SESSION **ret)
2194         {
2195         /* Point after session ID in client hello */
2196         const unsigned char *p = session_id + len;
2197         unsigned short i;
2198
2199         *ret = NULL;
2200         s->tlsext_ticket_expected = 0;
2201
2202         /* If tickets disabled behave as if no ticket present
2203          * to permit stateful resumption.
2204          */
2205         if (SSL_get_options(s) & SSL_OP_NO_TICKET)
2206                 return 0;
2207         if ((s->version <= SSL3_VERSION) || !limit)
2208                 return 0;
2209         if (p >= limit)
2210                 return -1;
2211         /* Skip past DTLS cookie */
2212         if (s->version == DTLS1_VERSION || s->version == DTLS1_BAD_VER)
2213                 {
2214                 i = *(p++);
2215                 p+= i;
2216                 if (p >= limit)
2217                         return -1;
2218                 }
2219         /* Skip past cipher list */
2220         n2s(p, i);
2221         p+= i;
2222         if (p >= limit)
2223                 return -1;
2224         /* Skip past compression algorithm list */
2225         i = *(p++);
2226         p += i;
2227         if (p > limit)
2228                 return -1;
2229         /* Now at start of extensions */
2230         if ((p + 2) >= limit)
2231                 return 0;
2232         n2s(p, i);
2233         while ((p + 4) <= limit)
2234                 {
2235                 unsigned short type, size;
2236                 n2s(p, type);
2237                 n2s(p, size);
2238                 if (p + size > limit)
2239                         return 0;
2240                 if (type == TLSEXT_TYPE_session_ticket)
2241                         {
2242                         int r;
2243                         if (size == 0)
2244                                 {
2245                                 /* The client will accept a ticket but doesn't
2246                                  * currently have one. */
2247                                 s->tlsext_ticket_expected = 1;
2248                                 return 1;
2249                                 }
2250                         if (s->tls_session_secret_cb)
2251                                 {
2252                                 /* Indicate that the ticket couldn't be
2253                                  * decrypted rather than generating the session
2254                                  * from ticket now, trigger abbreviated
2255                                  * handshake based on external mechanism to
2256                                  * calculate the master secret later. */
2257                                 return 2;
2258                                 }
2259                         r = tls_decrypt_ticket(s, p, size, session_id, len, ret);
2260                         switch (r)
2261                                 {
2262                                 case 2: /* ticket couldn't be decrypted */
2263                                         s->tlsext_ticket_expected = 1;
2264                                         return 2;
2265                                 case 3: /* ticket was decrypted */
2266                                         return r;
2267                                 case 4: /* ticket decrypted but need to renew */
2268                                         s->tlsext_ticket_expected = 1;
2269                                         return 3;
2270                                 default: /* fatal error */
2271                                         return -1;
2272                                 }
2273                         }
2274                 p += size;
2275                 }
2276         return 0;
2277         }
2278
2279 /* tls_decrypt_ticket attempts to decrypt a session ticket.
2280  *
2281  *   etick: points to the body of the session ticket extension.
2282  *   eticklen: the length of the session tickets extenion.
2283  *   sess_id: points at the session ID.
2284  *   sesslen: the length of the session ID.
2285  *   psess: (output) on return, if a ticket was decrypted, then this is set to
2286  *       point to the resulting session.
2287  *
2288  * Returns:
2289  *   -1: fatal error, either from parsing or decrypting the ticket.
2290  *    2: the ticket couldn't be decrypted.
2291  *    3: a ticket was successfully decrypted and *psess was set.
2292  *    4: same as 3, but the ticket needs to be renewed.
2293  */
2294 static int tls_decrypt_ticket(SSL *s, const unsigned char *etick, int eticklen,
2295                                 const unsigned char *sess_id, int sesslen,
2296                                 SSL_SESSION **psess)
2297         {
2298         SSL_SESSION *sess;
2299         unsigned char *sdec;
2300         const unsigned char *p;
2301         int slen, mlen, renew_ticket = 0;
2302         unsigned char tick_hmac[EVP_MAX_MD_SIZE];
2303         HMAC_CTX hctx;
2304         EVP_CIPHER_CTX ctx;
2305         SSL_CTX *tctx = s->initial_ctx;
2306         /* Need at least keyname + iv + some encrypted data */
2307         if (eticklen < 48)
2308                 return 2;
2309         /* Initialize session ticket encryption and HMAC contexts */
2310         HMAC_CTX_init(&hctx);
2311         EVP_CIPHER_CTX_init(&ctx);
2312         if (tctx->tlsext_ticket_key_cb)
2313                 {
2314                 unsigned char *nctick = (unsigned char *)etick;
2315                 int rv = tctx->tlsext_ticket_key_cb(s, nctick, nctick + 16,
2316                                                         &ctx, &hctx, 0);
2317                 if (rv < 0)
2318                         return -1;
2319                 if (rv == 0)
2320                         return 2;
2321                 if (rv == 2)
2322                         renew_ticket = 1;
2323                 }
2324         else
2325                 {
2326                 /* Check key name matches */
2327                 if (memcmp(etick, tctx->tlsext_tick_key_name, 16))
2328                         return 2;
2329                 HMAC_Init_ex(&hctx, tctx->tlsext_tick_hmac_key, 16,
2330                                         tlsext_tick_md(), NULL);
2331                 EVP_DecryptInit_ex(&ctx, EVP_aes_128_cbc(), NULL,
2332                                 tctx->tlsext_tick_aes_key, etick + 16);
2333                 }
2334         /* Attempt to process session ticket, first conduct sanity and
2335          * integrity checks on ticket.
2336          */
2337         mlen = HMAC_size(&hctx);
2338         if (mlen < 0)
2339                 {
2340                 EVP_CIPHER_CTX_cleanup(&ctx);
2341                 return -1;
2342                 }
2343         eticklen -= mlen;
2344         /* Check HMAC of encrypted ticket */
2345         HMAC_Update(&hctx, etick, eticklen);
2346         HMAC_Final(&hctx, tick_hmac, NULL);
2347         HMAC_CTX_cleanup(&hctx);
2348         if (memcmp(tick_hmac, etick + eticklen, mlen))
2349                 return 2;
2350         /* Attempt to decrypt session data */
2351         /* Move p after IV to start of encrypted ticket, update length */
2352         p = etick + 16 + EVP_CIPHER_CTX_iv_length(&ctx);
2353         eticklen -= 16 + EVP_CIPHER_CTX_iv_length(&ctx);
2354         sdec = OPENSSL_malloc(eticklen);
2355         if (!sdec)
2356                 {
2357                 EVP_CIPHER_CTX_cleanup(&ctx);
2358                 return -1;
2359                 }
2360         EVP_DecryptUpdate(&ctx, sdec, &slen, p, eticklen);
2361         if (EVP_DecryptFinal(&ctx, sdec + slen, &mlen) <= 0)
2362                 return 2;
2363         slen += mlen;
2364         EVP_CIPHER_CTX_cleanup(&ctx);
2365         p = sdec;
2366
2367         sess = d2i_SSL_SESSION(NULL, &p, slen);
2368         OPENSSL_free(sdec);
2369         if (sess)
2370                 {
2371                 /* The session ID, if non-empty, is used by some clients to
2372                  * detect that the ticket has been accepted. So we copy it to
2373                  * the session structure. If it is empty set length to zero
2374                  * as required by standard.
2375                  */
2376                 if (sesslen)
2377                         memcpy(sess->session_id, sess_id, sesslen);
2378                 sess->session_id_length = sesslen;
2379                 *psess = sess;
2380                 if (renew_ticket)
2381                         return 4;
2382                 else
2383                         return 3;
2384                 }
2385         ERR_clear_error();
2386         /* For session parse failure, indicate that we need to send a new
2387          * ticket. */
2388         return 2;
2389         }
2390
2391 /* Tables to translate from NIDs to TLS v1.2 ids */
2392
2393 typedef struct
2394         {
2395         int nid;
2396         int id;
2397         } tls12_lookup;
2398
2399 static tls12_lookup tls12_md[] = {
2400         {NID_md5, TLSEXT_hash_md5},
2401         {NID_sha1, TLSEXT_hash_sha1},
2402         {NID_sha224, TLSEXT_hash_sha224},
2403         {NID_sha256, TLSEXT_hash_sha256},
2404         {NID_sha384, TLSEXT_hash_sha384},
2405         {NID_sha512, TLSEXT_hash_sha512}
2406 };
2407
2408 static tls12_lookup tls12_sig[] = {
2409         {EVP_PKEY_RSA, TLSEXT_signature_rsa},
2410         {EVP_PKEY_DSA, TLSEXT_signature_dsa},
2411         {EVP_PKEY_EC, TLSEXT_signature_ecdsa}
2412 };
2413
2414 static int tls12_find_id(int nid, tls12_lookup *table, size_t tlen)
2415         {
2416         size_t i;
2417         for (i = 0; i < tlen; i++)
2418                 {
2419                 if (table[i].nid == nid)
2420                         return table[i].id;
2421                 }
2422         return -1;
2423         }
2424
2425 static int tls12_find_nid(int id, tls12_lookup *table, size_t tlen)
2426         {
2427         size_t i;
2428         for (i = 0; i < tlen; i++)
2429                 {
2430                 if ((table[i].id) == id)
2431                         return table[i].nid;
2432                 }
2433         return NID_undef;
2434         }
2435
2436 int tls12_get_sigandhash(unsigned char *p, const EVP_PKEY *pk, const EVP_MD *md)
2437         {
2438         int sig_id, md_id;
2439         if (!md)
2440                 return 0;
2441         md_id = tls12_find_id(EVP_MD_type(md), tls12_md,
2442                                 sizeof(tls12_md)/sizeof(tls12_lookup));
2443         if (md_id == -1)
2444                 return 0;
2445         sig_id = tls12_get_sigid(pk);
2446         if (sig_id == -1)
2447                 return 0;
2448         p[0] = (unsigned char)md_id;
2449         p[1] = (unsigned char)sig_id;
2450         return 1;
2451         }
2452
2453 int tls12_get_sigid(const EVP_PKEY *pk)
2454         {
2455         return tls12_find_id(pk->type, tls12_sig,
2456                                 sizeof(tls12_sig)/sizeof(tls12_lookup));
2457         }
2458
2459 const EVP_MD *tls12_get_hash(unsigned char hash_alg)
2460         {
2461         switch(hash_alg)
2462                 {
2463 #ifndef OPENSSL_NO_MD5
2464                 case TLSEXT_hash_md5:
2465 #ifdef OPENSSL_FIPS
2466                 if (FIPS_mode())
2467                         return NULL;
2468 #endif
2469                 return EVP_md5();
2470 #endif
2471 #ifndef OPENSSL_NO_SHA
2472                 case TLSEXT_hash_sha1:
2473                 return EVP_sha1();
2474 #endif
2475 #ifndef OPENSSL_NO_SHA256
2476                 case TLSEXT_hash_sha224:
2477                 return EVP_sha224();
2478
2479                 case TLSEXT_hash_sha256:
2480                 return EVP_sha256();
2481 #endif
2482 #ifndef OPENSSL_NO_SHA512
2483                 case TLSEXT_hash_sha384:
2484                 return EVP_sha384();
2485
2486                 case TLSEXT_hash_sha512:
2487                 return EVP_sha512();
2488 #endif
2489                 default:
2490                 return NULL;
2491
2492                 }
2493         }
2494
2495 /* Set preferred digest for each key type */
2496
2497 int tls1_process_sigalgs(SSL *s, const unsigned char *data, int dsize)
2498         {
2499         int i, idx;
2500         const EVP_MD *md;
2501         CERT *c = s->cert;
2502         TLS_SIGALGS *sigptr;
2503         /* Extension ignored for TLS versions below 1.2 */
2504         if (TLS1_get_version(s) < TLS1_2_VERSION)
2505                 return 1;
2506         /* Should never happen */
2507         if (!c)
2508                 return 0;
2509
2510         c->pkeys[SSL_PKEY_DSA_SIGN].digest = NULL;
2511         c->pkeys[SSL_PKEY_RSA_SIGN].digest = NULL;
2512         c->pkeys[SSL_PKEY_RSA_ENC].digest = NULL;
2513         c->pkeys[SSL_PKEY_ECC].digest = NULL;
2514
2515         if (c->sigalgs)
2516                 OPENSSL_free(c->sigalgs);
2517         c->sigalgs = OPENSSL_malloc((dsize/2) * sizeof(TLS_SIGALGS));
2518         if (!c->sigalgs)
2519                 return 0;
2520         c->sigalgslen = dsize/2;
2521
2522         for (i = 0, sigptr = c->sigalgs; i < dsize; i += 2, sigptr++)
2523                 {
2524                 sigptr->rhash = data[i];
2525                 sigptr->rsign = data[i + 1];
2526                 sigptr->hash_nid = tls12_find_nid(sigptr->rhash, tls12_md,
2527                                         sizeof(tls12_md)/sizeof(tls12_lookup));
2528                 sigptr->sign_nid = tls12_find_nid(sigptr->rsign, tls12_sig,
2529                                         sizeof(tls12_sig)/sizeof(tls12_lookup));
2530                 if (!OBJ_find_sigid_by_algs(&sigptr->signandhash_nid,
2531                                                 sigptr->hash_nid,
2532                                                 sigptr->sign_nid))
2533                         sigptr->signandhash_nid = NID_undef;
2534                 switch(sigptr->rsign)
2535                         {
2536 #ifndef OPENSSL_NO_RSA
2537                         case TLSEXT_signature_rsa:
2538                         idx = SSL_PKEY_RSA_SIGN;
2539                         break;
2540 #endif
2541 #ifndef OPENSSL_NO_DSA
2542                         case TLSEXT_signature_dsa:
2543                         idx = SSL_PKEY_DSA_SIGN;
2544                         break;
2545 #endif
2546 #ifndef OPENSSL_NO_ECDSA
2547                         case TLSEXT_signature_ecdsa:
2548                         idx = SSL_PKEY_ECC;
2549                         break;
2550 #endif
2551                         default:
2552                         continue;
2553                         }
2554
2555                 if (c->pkeys[idx].digest == NULL)
2556                         {
2557                         md = tls12_get_hash(sigptr->rhash);
2558                         if (md)
2559                                 {
2560                                 c->pkeys[idx].digest = md;
2561                                 if (idx == SSL_PKEY_RSA_SIGN)
2562                                         c->pkeys[SSL_PKEY_RSA_ENC].digest = md;
2563                                 }
2564                         }
2565
2566                 }
2567
2568
2569         /* Set any remaining keys to default values. NOTE: if alg is not
2570          * supported it stays as NULL.
2571          */
2572 #ifndef OPENSSL_NO_DSA
2573         if (!c->pkeys[SSL_PKEY_DSA_SIGN].digest)
2574                 c->pkeys[SSL_PKEY_DSA_SIGN].digest = EVP_dss1();
2575 #endif
2576 #ifndef OPENSSL_NO_RSA
2577         if (!c->pkeys[SSL_PKEY_RSA_SIGN].digest)
2578                 {
2579                 c->pkeys[SSL_PKEY_RSA_SIGN].digest = EVP_sha1();
2580                 c->pkeys[SSL_PKEY_RSA_ENC].digest = EVP_sha1();
2581                 }
2582 #endif
2583 #ifndef OPENSSL_NO_ECDSA
2584         if (!c->pkeys[SSL_PKEY_ECC].digest)
2585                 c->pkeys[SSL_PKEY_ECC].digest = EVP_ecdsa();
2586 #endif
2587         return 1;
2588         }
2589
2590 #endif
2591
2592 int SSL_get_sigalgs(SSL *s, int idx,
2593                         int *psign, int *phash, int *psignandhash,
2594                         unsigned char *rsig, unsigned char *rhash)
2595         {
2596         if (s->cert->sigalgs == NULL)
2597                 return 0;
2598         if (idx >= 0)
2599                 {
2600                 TLS_SIGALGS *psig;
2601                 if (idx >= (int)s->cert->sigalgslen)
2602                         return 0;
2603                 psig = s->cert->sigalgs + idx;
2604                 if (psign)
2605                         *psign = psig->sign_nid;
2606                 if (phash)
2607                         *phash = psig->hash_nid;
2608                 if (psignandhash)
2609                         *psignandhash = psig->signandhash_nid;
2610                 if (rsig)
2611                         *rsig = psig->rsign;
2612                 if (rhash)
2613                         *rhash = psig->rhash;
2614                 }
2615         return s->cert->sigalgslen;
2616         }
2617
2618
2619 #ifndef OPENSSL_NO_HEARTBEATS
2620 int
2621 tls1_process_heartbeat(SSL *s)
2622         {
2623         unsigned char *p = &s->s3->rrec.data[0], *pl;
2624         unsigned short hbtype;
2625         unsigned int payload;
2626         unsigned int padding = 16; /* Use minimum padding */
2627
2628         /* Read type and payload length first */
2629         hbtype = *p++;
2630         n2s(p, payload);
2631         pl = p;
2632
2633         if (s->msg_callback)
2634                 s->msg_callback(0, s->version, TLS1_RT_HEARTBEAT,
2635                         &s->s3->rrec.data[0], s->s3->rrec.length,
2636                         s, s->msg_callback_arg);
2637
2638         if (hbtype == TLS1_HB_REQUEST)
2639                 {
2640                 unsigned char *buffer, *bp;
2641                 int r;
2642
2643                 /* Allocate memory for the response, size is 1 bytes
2644                  * message type, plus 2 bytes payload length, plus
2645                  * payload, plus padding
2646                  */
2647                 buffer = OPENSSL_malloc(1 + 2 + payload + padding);
2648                 bp = buffer;
2649
2650                 /* Enter response type, length and copy payload */
2651                 *bp++ = TLS1_HB_RESPONSE;
2652                 s2n(payload, bp);
2653                 memcpy(bp, pl, payload);
2654                 bp += payload;
2655                 /* Random padding */
2656                 RAND_pseudo_bytes(bp, padding);
2657
2658                 r = ssl3_write_bytes(s, TLS1_RT_HEARTBEAT, buffer, 3 + payload + padding);
2659
2660                 if (r >= 0 && s->msg_callback)
2661                         s->msg_callback(1, s->version, TLS1_RT_HEARTBEAT,
2662                                 buffer, 3 + payload + padding,
2663                                 s, s->msg_callback_arg);
2664
2665                 OPENSSL_free(buffer);
2666
2667                 if (r < 0)
2668                         return r;
2669                 }
2670         else if (hbtype == TLS1_HB_RESPONSE)
2671                 {
2672                 unsigned int seq;
2673
2674                 /* We only send sequence numbers (2 bytes unsigned int),
2675                  * and 16 random bytes, so we just try to read the
2676                  * sequence number */
2677                 n2s(pl, seq);
2678
2679                 if (payload == 18 && seq == s->tlsext_hb_seq)
2680                         {
2681                         s->tlsext_hb_seq++;
2682                         s->tlsext_hb_pending = 0;
2683                         }
2684                 }
2685
2686         return 0;
2687         }
2688
2689 int
2690 tls1_heartbeat(SSL *s)
2691         {
2692         unsigned char *buf, *p;
2693         int ret;
2694         unsigned int payload = 18; /* Sequence number + random bytes */
2695         unsigned int padding = 16; /* Use minimum padding */
2696
2697         /* Only send if peer supports and accepts HB requests... */
2698         if (!(s->tlsext_heartbeat & SSL_TLSEXT_HB_ENABLED) ||
2699             s->tlsext_heartbeat & SSL_TLSEXT_HB_DONT_SEND_REQUESTS)
2700                 {
2701                 SSLerr(SSL_F_TLS1_HEARTBEAT,SSL_R_TLS_HEARTBEAT_PEER_DOESNT_ACCEPT);
2702                 return -1;
2703                 }
2704
2705         /* ...and there is none in flight yet... */
2706         if (s->tlsext_hb_pending)
2707                 {
2708                 SSLerr(SSL_F_TLS1_HEARTBEAT,SSL_R_TLS_HEARTBEAT_PENDING);
2709                 return -1;
2710                 }
2711
2712         /* ...and no handshake in progress. */
2713         if (SSL_in_init(s) || s->in_handshake)
2714                 {
2715                 SSLerr(SSL_F_TLS1_HEARTBEAT,SSL_R_UNEXPECTED_MESSAGE);
2716                 return -1;
2717                 }
2718
2719         /* Check if padding is too long, payload and padding
2720          * must not exceed 2^14 - 3 = 16381 bytes in total.
2721          */
2722         OPENSSL_assert(payload + padding <= 16381);
2723
2724         /* Create HeartBeat message, we just use a sequence number
2725          * as payload to distuingish different messages and add
2726          * some random stuff.
2727          *  - Message Type, 1 byte
2728          *  - Payload Length, 2 bytes (unsigned int)
2729          *  - Payload, the sequence number (2 bytes uint)
2730          *  - Payload, random bytes (16 bytes uint)
2731          *  - Padding
2732          */
2733         buf = OPENSSL_malloc(1 + 2 + payload + padding);
2734         p = buf;
2735         /* Message Type */
2736         *p++ = TLS1_HB_REQUEST;
2737         /* Payload length (18 bytes here) */
2738         s2n(payload, p);
2739         /* Sequence number */
2740         s2n(s->tlsext_hb_seq, p);
2741         /* 16 random bytes */
2742         RAND_pseudo_bytes(p, 16);
2743         p += 16;
2744         /* Random padding */
2745         RAND_pseudo_bytes(p, padding);
2746
2747         ret = ssl3_write_bytes(s, TLS1_RT_HEARTBEAT, buf, 3 + payload + padding);
2748         if (ret >= 0)
2749                 {
2750                 if (s->msg_callback)
2751                         s->msg_callback(1, s->version, TLS1_RT_HEARTBEAT,
2752                                 buf, 3 + payload + padding,
2753                                 s, s->msg_callback_arg);
2754
2755                 s->tlsext_hb_pending = 1;
2756                 }
2757
2758         OPENSSL_free(buf);
2759
2760         return ret;
2761         }
2762 #endif