ssl/t1_lib.c

   1 /* ssl/t1_lib.c */
   2 /* Copyright (C) 1995-1998 Eric Young (eay@cryptsoft.com)
   3  * All rights reserved.
   4  *
   5  * This package is an SSL implementation written
   6  * by Eric Young (eay@cryptsoft.com).
   7  * The implementation was written so as to conform with Netscapes SSL.
   8  *
   9  * This library is free for commercial and non-commercial use as long as
  10  * the following conditions are aheared to.  The following conditions
  11  * apply to all code found in this distribution, be it the RC4, RSA,
  12  * lhash, DES, etc., code; not just the SSL code.  The SSL documentation
  13  * included with this distribution is covered by the same copyright terms
  14  * except that the holder is Tim Hudson (tjh@cryptsoft.com).
  15  *
  16  * Copyright remains Eric Young's, and as such any Copyright notices in
  17  * the code are not to be removed.
  18  * If this package is used in a product, Eric Young should be given attribution
  19  * as the author of the parts of the library used.
  20  * This can be in the form of a textual message at program startup or
  21  * in documentation (online or textual) provided with the package.
  22  *
  23  * Redistribution and use in source and binary forms, with or without
  24  * modification, are permitted provided that the following conditions
  25  * are met:
  26  * 1. Redistributions of source code must retain the copyright
  27  *    notice, this list of conditions and the following disclaimer.
  28  * 2. Redistributions in binary form must reproduce the above copyright
  29  *    notice, this list of conditions and the following disclaimer in the
  30  *    documentation and/or other materials provided with the distribution.
  31  * 3. All advertising materials mentioning features or use of this software
  32  *    must display the following acknowledgement:
  33  *    "This product includes cryptographic software written by
  34  *     Eric Young (eay@cryptsoft.com)"
  35  *    The word 'cryptographic' can be left out if the rouines from the library
  36  *    being used are not cryptographic related :-).
  37  * 4. If you include any Windows specific code (or a derivative thereof) from
  38  *    the apps directory (application code) you must include an acknowledgement:
  39  *    "This product includes software written by Tim Hudson (tjh@cryptsoft.com)"
  40  *
  41  * THIS SOFTWARE IS PROVIDED BY ERIC YOUNG ``AS IS'' AND
  42  * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
  43  * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
  44  * ARE DISCLAIMED.  IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE
  45  * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
  46  * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
  47  * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
  48  * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
  49  * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
  50  * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
  51  * SUCH DAMAGE.
  52  *
  53  * The licence and distribution terms for any publically available version or
  54  * derivative of this code cannot be changed.  i.e. this code cannot simply be
  55  * copied and put under another distribution licence
  56  * [including the GNU Public Licence.]
  57  */
  58 /* ====================================================================
  59  * Copyright (c) 1998-2007 The OpenSSL Project.  All rights reserved.
  60  *
  61  * Redistribution and use in source and binary forms, with or without
  62  * modification, are permitted provided that the following conditions
  63  * are met:
  64  *
  65  * 1. Redistributions of source code must retain the above copyright
  66  *    notice, this list of conditions and the following disclaimer.
  67  *
  68  * 2. Redistributions in binary form must reproduce the above copyright
  69  *    notice, this list of conditions and the following disclaimer in
  70  *    the documentation and/or other materials provided with the
  71  *    distribution.
  72  *
  73  * 3. All advertising materials mentioning features or use of this
  74  *    software must display the following acknowledgment:
  75  *    "This product includes software developed by the OpenSSL Project
  76  *    for use in the OpenSSL Toolkit. (http://www.openssl.org/)"
  77  *
  78  * 4. The names "OpenSSL Toolkit" and "OpenSSL Project" must not be used to
  79  *    endorse or promote products derived from this software without
  80  *    prior written permission. For written permission, please contact
  81  *    openssl-core@openssl.org.
  82  *
  83  * 5. Products derived from this software may not be called "OpenSSL"
  84  *    nor may "OpenSSL" appear in their names without prior written
  85  *    permission of the OpenSSL Project.
  86  *
  87  * 6. Redistributions of any form whatsoever must retain the following
  88  *    acknowledgment:
  89  *    "This product includes software developed by the OpenSSL Project
  90  *    for use in the OpenSSL Toolkit (http://www.openssl.org/)"
  91  *
  92  * THIS SOFTWARE IS PROVIDED BY THE OpenSSL PROJECT ``AS IS'' AND ANY
  93  * EXPRESSED OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
  94  * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
  95  * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL THE OpenSSL PROJECT OR
  96  * ITS CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
  97  * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
  98  * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
  99  * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
 100  * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT,
 101  * STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
 102  * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED
 103  * OF THE POSSIBILITY OF SUCH DAMAGE.
 104  * ====================================================================
 105  *
 106  * This product includes cryptographic software written by Eric Young
 107  * (eay@cryptsoft.com).  This product includes software written by Tim
 108  * Hudson (tjh@cryptsoft.com).
 109  *
 110  */
 111
 112 #include <stdio.h>
 113 #include <openssl/objects.h>
 114 #include <openssl/evp.h>
 115 #include <openssl/hmac.h>
 116 #include <openssl/ocsp.h>
 117 #include <openssl/rand.h>
 118 #include "ssl_locl.h"
 119
 120 const char tls1_version_str[]="TLSv1" OPENSSL_VERSION_PTEXT;
 121
 122 #ifndef OPENSSL_NO_TLSEXT
 123 static int tls_decrypt_ticket(SSL *s, const unsigned char *tick, int ticklen,
 124                                 const unsigned char *sess_id, int sesslen,
 125                                 SSL_SESSION **psess);
 126 #endif
 127
 128 SSL3_ENC_METHOD TLSv1_enc_data={
 129         tls1_enc,
 130         tls1_mac,
 131         tls1_setup_key_block,
 132         tls1_generate_master_secret,
 133         tls1_change_cipher_state,
 134         tls1_final_finish_mac,
 135         TLS1_FINISH_MAC_LENGTH,
 136         tls1_cert_verify_mac,
 137         TLS_MD_CLIENT_FINISH_CONST,TLS_MD_CLIENT_FINISH_CONST_SIZE,
 138         TLS_MD_SERVER_FINISH_CONST,TLS_MD_SERVER_FINISH_CONST_SIZE,
 139         tls1_alert_code,
 140         tls1_export_keying_material,
 141         };
 142
 143 long tls1_default_timeout(void)
 144         {
 145         /* 2 hours, the 24 hours mentioned in the TLSv1 spec
 146          * is way too long for http, the cache would over fill */
 147         return(60*60*2);
 148         }
 149
 150 int tls1_new(SSL *s)
 151         {
 152         if (!ssl3_new(s)) return(0);
 153         s->method->ssl_clear(s);
 154         return(1);
 155         }
 156
 157 void tls1_free(SSL *s)
 158         {
 159 #ifndef OPENSSL_NO_TLSEXT
 160         if (s->tlsext_session_ticket)
 161                 {
 162                 OPENSSL_free(s->tlsext_session_ticket);
 163                 }
 164 #endif /* OPENSSL_NO_TLSEXT */
 165         ssl3_free(s);
 166         }
 167
 168 void tls1_clear(SSL *s)
 169         {
 170         ssl3_clear(s);
 171         s->version = s->method->version;
 172         }
 173
 174 #ifndef OPENSSL_NO_EC
 175
 176 static int nid_list[] =
 177         {
 178                 NID_sect163k1, /* sect163k1 (1) */
 179                 NID_sect163r1, /* sect163r1 (2) */
 180                 NID_sect163r2, /* sect163r2 (3) */
 181                 NID_sect193r1, /* sect193r1 (4) */
 182                 NID_sect193r2, /* sect193r2 (5) */
 183                 NID_sect233k1, /* sect233k1 (6) */
 184                 NID_sect233r1, /* sect233r1 (7) */
 185                 NID_sect239k1, /* sect239k1 (8) */
 186                 NID_sect283k1, /* sect283k1 (9) */
 187                 NID_sect283r1, /* sect283r1 (10) */
 188                 NID_sect409k1, /* sect409k1 (11) */
 189                 NID_sect409r1, /* sect409r1 (12) */
 190                 NID_sect571k1, /* sect571k1 (13) */
 191                 NID_sect571r1, /* sect571r1 (14) */
 192                 NID_secp160k1, /* secp160k1 (15) */
 193                 NID_secp160r1, /* secp160r1 (16) */
 194                 NID_secp160r2, /* secp160r2 (17) */
 195                 NID_secp192k1, /* secp192k1 (18) */
 196                 NID_X9_62_prime192v1, /* secp192r1 (19) */
 197                 NID_secp224k1, /* secp224k1 (20) */
 198                 NID_secp224r1, /* secp224r1 (21) */
 199                 NID_secp256k1, /* secp256k1 (22) */
 200                 NID_X9_62_prime256v1, /* secp256r1 (23) */
 201                 NID_secp384r1, /* secp384r1 (24) */
 202                 NID_secp521r1  /* secp521r1 (25) */
 203         };
 204
 205 static int pref_list[] =
 206         {
 207                 NID_sect571r1, /* sect571r1 (14) */
 208                 NID_sect571k1, /* sect571k1 (13) */
 209                 NID_secp521r1, /* secp521r1 (25) */
 210                 NID_sect409k1, /* sect409k1 (11) */
 211                 NID_sect409r1, /* sect409r1 (12) */
 212                 NID_secp384r1, /* secp384r1 (24) */
 213                 NID_sect283k1, /* sect283k1 (9) */
 214                 NID_sect283r1, /* sect283r1 (10) */
 215                 NID_secp256k1, /* secp256k1 (22) */
 216                 NID_X9_62_prime256v1, /* secp256r1 (23) */
 217                 NID_sect239k1, /* sect239k1 (8) */
 218                 NID_sect233k1, /* sect233k1 (6) */
 219                 NID_sect233r1, /* sect233r1 (7) */
 220                 NID_secp224k1, /* secp224k1 (20) */
 221                 NID_secp224r1, /* secp224r1 (21) */
 222                 NID_sect193r1, /* sect193r1 (4) */
 223                 NID_sect193r2, /* sect193r2 (5) */
 224                 NID_secp192k1, /* secp192k1 (18) */
 225                 NID_X9_62_prime192v1, /* secp192r1 (19) */
 226                 NID_sect163k1, /* sect163k1 (1) */
 227                 NID_sect163r1, /* sect163r1 (2) */
 228                 NID_sect163r2, /* sect163r2 (3) */
 229                 NID_secp160k1, /* secp160k1 (15) */
 230                 NID_secp160r1, /* secp160r1 (16) */
 231                 NID_secp160r2, /* secp160r2 (17) */
 232         };
 233
 234 int tls1_ec_curve_id2nid(int curve_id)
 235         {
 236         /* ECC curves from draft-ietf-tls-ecc-12.txt (Oct. 17, 2005) */
 237         if ((curve_id < 1) || ((unsigned int)curve_id >
 238                                 sizeof(nid_list)/sizeof(nid_list[0])))
 239                 return 0;
 240         return nid_list[curve_id-1];
 241         }
 242
 243 int tls1_ec_nid2curve_id(int nid)
 244         {
 245         /* ECC curves from draft-ietf-tls-ecc-12.txt (Oct. 17, 2005) */
 246         switch (nid)
 247                 {
 248         case NID_sect163k1: /* sect163k1 (1) */
 249                 return 1;
 250         case NID_sect163r1: /* sect163r1 (2) */
 251                 return 2;
 252         case NID_sect163r2: /* sect163r2 (3) */
 253                 return 3;
 254         case NID_sect193r1: /* sect193r1 (4) */
 255                 return 4;
 256         case NID_sect193r2: /* sect193r2 (5) */
 257                 return 5;
 258         case NID_sect233k1: /* sect233k1 (6) */
 259                 return 6;
 260         case NID_sect233r1: /* sect233r1 (7) */
 261                 return 7;
 262         case NID_sect239k1: /* sect239k1 (8) */
 263                 return 8;
 264         case NID_sect283k1: /* sect283k1 (9) */
 265                 return 9;
 266         case NID_sect283r1: /* sect283r1 (10) */
 267                 return 10;
 268         case NID_sect409k1: /* sect409k1 (11) */
 269                 return 11;
 270         case NID_sect409r1: /* sect409r1 (12) */
 271                 return 12;
 272         case NID_sect571k1: /* sect571k1 (13) */
 273                 return 13;
 274         case NID_sect571r1: /* sect571r1 (14) */
 275                 return 14;
 276         case NID_secp160k1: /* secp160k1 (15) */
 277                 return 15;
 278         case NID_secp160r1: /* secp160r1 (16) */
 279                 return 16;
 280         case NID_secp160r2: /* secp160r2 (17) */
 281                 return 17;
 282         case NID_secp192k1: /* secp192k1 (18) */
 283                 return 18;
 284         case NID_X9_62_prime192v1: /* secp192r1 (19) */
 285                 return 19;
 286         case NID_secp224k1: /* secp224k1 (20) */
 287                 return 20;
 288         case NID_secp224r1: /* secp224r1 (21) */
 289                 return 21;
 290         case NID_secp256k1: /* secp256k1 (22) */
 291                 return 22;
 292         case NID_X9_62_prime256v1: /* secp256r1 (23) */
 293                 return 23;
 294         case NID_secp384r1: /* secp384r1 (24) */
 295                 return 24;
 296         case NID_secp521r1:  /* secp521r1 (25) */
 297                 return 25;
 298         default:
 299                 return 0;
 300                 }
 301         }
 302 #endif /* OPENSSL_NO_EC */
 303
 304 #ifndef OPENSSL_NO_TLSEXT
 305
 306 /* List of supported signature algorithms and hashes. Should make this
 307  * customisable at some point, for now include everything we support.
 308  */
 309
 310 #ifdef OPENSSL_NO_RSA
 311 #define tlsext_sigalg_rsa(md) /* */
 312 #else
 313 #define tlsext_sigalg_rsa(md) md, TLSEXT_signature_rsa,
 314 #endif
 315
 316 #ifdef OPENSSL_NO_DSA
 317 #define tlsext_sigalg_dsa(md) /* */
 318 #else
 319 #define tlsext_sigalg_dsa(md) md, TLSEXT_signature_dsa,
 320 #endif
 321
 322 #ifdef OPENSSL_NO_ECDSA
 323 #define tlsext_sigalg_ecdsa(md) /* */
 324 #else
 325 #define tlsext_sigalg_ecdsa(md) md, TLSEXT_signature_ecdsa,
 326 #endif
 327
 328 #define tlsext_sigalg(md) \
 329                 tlsext_sigalg_rsa(md) \
 330                 tlsext_sigalg_dsa(md) \
 331                 tlsext_sigalg_ecdsa(md)
 332
 333 static unsigned char tls12_sigalgs[] = {
 334 #ifndef OPENSSL_NO_SHA512
 335         tlsext_sigalg(TLSEXT_hash_sha512)
 336         tlsext_sigalg(TLSEXT_hash_sha384)
 337 #endif
 338 #ifndef OPENSSL_NO_SHA256
 339         tlsext_sigalg(TLSEXT_hash_sha256)
 340         tlsext_sigalg(TLSEXT_hash_sha224)
 341 #endif
 342 #ifndef OPENSSL_NO_SHA
 343         tlsext_sigalg(TLSEXT_hash_sha1)
 344 #endif
 345 #ifndef OPENSSL_NO_MD5
 346         tlsext_sigalg_rsa(TLSEXT_hash_md5)
 347 #endif
 348 };
 349
 350 int tls12_get_req_sig_algs(SSL *s, unsigned char *p)
 351         {
 352         size_t slen = sizeof(tls12_sigalgs);
 353 #ifdef OPENSSL_FIPS
 354         /* If FIPS mode don't include MD5 which is last */
 355         if (FIPS_mode())
 356                 slen -= 2;
 357 #endif
 358         if (p)
 359                 memcpy(p, tls12_sigalgs, slen);
 360         return (int)slen;
 361         }
 362
 363 unsigned char *ssl_add_clienthello_tlsext(SSL *s, unsigned char *p, unsigned char *limit)
 364         {
 365         int extdatalen=0;
 366         unsigned char *ret = p;
 367
 368         /* don't add extensions for SSLv3 unless doing secure renegotiation */
 369         if (s->client_version == SSL3_VERSION
 370                                         && !s->s3->send_connection_binding)
 371                 return p;
 372
 373         ret+=2;
 374
 375         if (ret>=limit) return NULL; /* this really never occurs, but ... */
 376
 377         if (s->tlsext_hostname != NULL)
 378                 {
 379                 /* Add TLS extension servername to the Client Hello message */
 380                 unsigned long size_str;
 381                 long lenmax;
 382
 383                 /* check for enough space.
 384                    4 for the servername type and entension length
 385                    2 for servernamelist length
 386                    1 for the hostname type
 387                    2 for hostname length
 388                    + hostname length
 389                 */
 390
 391                 if ((lenmax = limit - ret - 9) < 0
 392                     || (size_str = strlen(s->tlsext_hostname)) > (unsigned long)lenmax)
 393                         return NULL;
 394
 395                 /* extension type and length */
 396                 s2n(TLSEXT_TYPE_server_name,ret);
 397                 s2n(size_str+5,ret);
 398
 399                 /* length of servername list */
 400                 s2n(size_str+3,ret);
 401
 402                 /* hostname type, length and hostname */
 403                 *(ret++) = (unsigned char) TLSEXT_NAMETYPE_host_name;
 404                 s2n(size_str,ret);
 405                 memcpy(ret, s->tlsext_hostname, size_str);
 406                 ret+=size_str;
 407                 }
 408
 409         /* Add RI if renegotiating */
 410         if (s->renegotiate)
 411           {
 412           int el;
 413
 414           if(!ssl_add_clienthello_renegotiate_ext(s, 0, &el, 0))
 415               {
 416               SSLerr(SSL_F_SSL_ADD_CLIENTHELLO_TLSEXT, ERR_R_INTERNAL_ERROR);
 417               return NULL;
 418               }
 419
 420           if((limit - p - 4 - el) < 0) return NULL;
 421
 422           s2n(TLSEXT_TYPE_renegotiate,ret);
 423           s2n(el,ret);
 424
 425           if(!ssl_add_clienthello_renegotiate_ext(s, ret, &el, el))
 426               {
 427               SSLerr(SSL_F_SSL_ADD_CLIENTHELLO_TLSEXT, ERR_R_INTERNAL_ERROR);
 428               return NULL;
 429               }
 430
 431           ret += el;
 432         }
 433
 434 #ifndef OPENSSL_NO_SRP
 435 #define MIN(x,y) (((x)<(y))?(x):(y))
 436         /* we add SRP username the first time only if we have one! */
 437         if (s->srp_ctx.login != NULL)
 438                 {/* Add TLS extension SRP username to the Client Hello message */
 439                 int login_len = MIN(strlen(s->srp_ctx.login) + 1, 255);
 440                 long lenmax;
 441
 442                 if ((lenmax = limit - ret - 5) < 0) return NULL;
 443                 if (login_len > lenmax) return NULL;
 444                 if (login_len > 255)
 445                         {
 446                         SSLerr(SSL_F_SSL_ADD_CLIENTHELLO_TLSEXT, ERR_R_INTERNAL_ERROR);
 447                         return NULL;
 448                         }
 449                 s2n(TLSEXT_TYPE_srp,ret);
 450                 s2n(login_len+1,ret);
 451
 452                 (*ret++) = (unsigned char) MIN(strlen(s->srp_ctx.login), 254);
 453                 memcpy(ret, s->srp_ctx.login, MIN(strlen(s->srp_ctx.login), 254));
 454                 ret+=login_len;
 455                 }
 456 #endif
 457
 458 #ifndef OPENSSL_NO_EC
 459         if (s->tlsext_ecpointformatlist != NULL &&
 460             s->version != DTLS1_VERSION)
 461                 {
 462                 /* Add TLS extension ECPointFormats to the ClientHello message */
 463                 long lenmax;
 464
 465                 if ((lenmax = limit - ret - 5) < 0) return NULL;
 466                 if (s->tlsext_ecpointformatlist_length > (unsigned long)lenmax) return NULL;
 467                 if (s->tlsext_ecpointformatlist_length > 255)
 468                         {
 469                         SSLerr(SSL_F_SSL_ADD_CLIENTHELLO_TLSEXT, ERR_R_INTERNAL_ERROR);
 470                         return NULL;
 471                         }
 472
 473                 s2n(TLSEXT_TYPE_ec_point_formats,ret);
 474                 s2n(s->tlsext_ecpointformatlist_length + 1,ret);
 475                 *(ret++) = (unsigned char) s->tlsext_ecpointformatlist_length;
 476                 memcpy(ret, s->tlsext_ecpointformatlist, s->tlsext_ecpointformatlist_length);
 477                 ret+=s->tlsext_ecpointformatlist_length;
 478                 }
 479         if (s->tlsext_ellipticcurvelist != NULL &&
 480             s->version != DTLS1_VERSION)
 481                 {
 482                 /* Add TLS extension EllipticCurves to the ClientHello message */
 483                 long lenmax;
 484
 485                 if ((lenmax = limit - ret - 6) < 0) return NULL;
 486                 if (s->tlsext_ellipticcurvelist_length > (unsigned long)lenmax) return NULL;
 487                 if (s->tlsext_ellipticcurvelist_length > 65532)
 488                         {
 489                         SSLerr(SSL_F_SSL_ADD_CLIENTHELLO_TLSEXT, ERR_R_INTERNAL_ERROR);
 490                         return NULL;
 491                         }
 492
 493                 s2n(TLSEXT_TYPE_elliptic_curves,ret);
 494                 s2n(s->tlsext_ellipticcurvelist_length + 2, ret);
 495
 496                 /* NB: draft-ietf-tls-ecc-12.txt uses a one-byte prefix for
 497                  * elliptic_curve_list, but the examples use two bytes.
 498                  * http://www1.ietf.org/mail-archive/web/tls/current/msg00538.html
 499                  * resolves this to two bytes.
 500                  */
 501                 s2n(s->tlsext_ellipticcurvelist_length, ret);
 502                 memcpy(ret, s->tlsext_ellipticcurvelist, s->tlsext_ellipticcurvelist_length);
 503                 ret+=s->tlsext_ellipticcurvelist_length;
 504                 }
 505 #endif /* OPENSSL_NO_EC */
 506
 507         if (!(SSL_get_options(s) & SSL_OP_NO_TICKET))
 508                 {
 509                 int ticklen;
 510                 if (!s->new_session && s->session && s->session->tlsext_tick)
 511                         ticklen = s->session->tlsext_ticklen;
 512                 else if (s->session && s->tlsext_session_ticket &&
 513                          s->tlsext_session_ticket->data)
 514                         {
 515                         ticklen = s->tlsext_session_ticket->length;
 516                         s->session->tlsext_tick = OPENSSL_malloc(ticklen);
 517                         if (!s->session->tlsext_tick)
 518                                 return NULL;
 519                         memcpy(s->session->tlsext_tick,
 520                                s->tlsext_session_ticket->data,
 521                                ticklen);
 522                         s->session->tlsext_ticklen = ticklen;
 523                         }
 524                 else
 525                         ticklen = 0;
 526                 if (ticklen == 0 && s->tlsext_session_ticket &&
 527                     s->tlsext_session_ticket->data == NULL)
 528                         goto skip_ext;
 529                 /* Check for enough room 2 for extension type, 2 for len
 530                  * rest for ticket
 531                  */
 532                 if ((long)(limit - ret - 4 - ticklen) < 0) return NULL;
 533                 s2n(TLSEXT_TYPE_session_ticket,ret);
 534                 s2n(ticklen,ret);
 535                 if (ticklen)
 536                         {
 537                         memcpy(ret, s->session->tlsext_tick, ticklen);
 538                         ret += ticklen;
 539                         }
 540                 }
 541                 skip_ext:
 542
 543         if (TLS1_get_version(s) >= TLS1_2_VERSION)
 544                 {
 545                 if ((size_t)(limit - ret) < sizeof(tls12_sigalgs) + 6)
 546                         return NULL;
 547                 s2n(TLSEXT_TYPE_signature_algorithms,ret);
 548                 s2n(sizeof(tls12_sigalgs) + 2, ret);
 549                 s2n(sizeof(tls12_sigalgs), ret);
 550                 memcpy(ret, tls12_sigalgs, sizeof(tls12_sigalgs));
 551                 ret += sizeof(tls12_sigalgs);
 552                 }
 553
 554 #ifdef TLSEXT_TYPE_opaque_prf_input
 555         if (s->s3->client_opaque_prf_input != NULL &&
 556             s->version != DTLS1_VERSION)
 557                 {
 558                 size_t col = s->s3->client_opaque_prf_input_len;
 559
 560                 if ((long)(limit - ret - 6 - col < 0))
 561                         return NULL;
 562                 if (col > 0xFFFD) /* can't happen */
 563                         return NULL;
 564
 565                 s2n(TLSEXT_TYPE_opaque_prf_input, ret);
 566                 s2n(col + 2, ret);
 567                 s2n(col, ret);
 568                 memcpy(ret, s->s3->client_opaque_prf_input, col);
 569                 ret += col;
 570                 }
 571 #endif
 572
 573         if (s->tlsext_status_type == TLSEXT_STATUSTYPE_ocsp &&
 574             s->version != DTLS1_VERSION)
 575                 {
 576                 int i;
 577                 long extlen, idlen, itmp;
 578                 OCSP_RESPID *id;
 579
 580                 idlen = 0;
 581                 for (i = 0; i < sk_OCSP_RESPID_num(s->tlsext_ocsp_ids); i++)
 582                         {
 583                         id = sk_OCSP_RESPID_value(s->tlsext_ocsp_ids, i);
 584                         itmp = i2d_OCSP_RESPID(id, NULL);
 585                         if (itmp <= 0)
 586                                 return NULL;
 587                         idlen += itmp + 2;
 588                         }
 589
 590                 if (s->tlsext_ocsp_exts)
 591                         {
 592                         extlen = i2d_X509_EXTENSIONS(s->tlsext_ocsp_exts, NULL);
 593                         if (extlen < 0)
 594                                 return NULL;
 595                         }
 596                 else
 597                         extlen = 0;
 598
 599                 if ((long)(limit - ret - 7 - extlen - idlen) < 0) return NULL;
 600                 s2n(TLSEXT_TYPE_status_request, ret);
 601                 if (extlen + idlen > 0xFFF0)
 602                         return NULL;
 603                 s2n(extlen + idlen + 5, ret);
 604                 *(ret++) = TLSEXT_STATUSTYPE_ocsp;
 605                 s2n(idlen, ret);
 606                 for (i = 0; i < sk_OCSP_RESPID_num(s->tlsext_ocsp_ids); i++)
 607                         {
 608                         /* save position of id len */
 609                         unsigned char *q = ret;
 610                         id = sk_OCSP_RESPID_value(s->tlsext_ocsp_ids, i);
 611                         /* skip over id len */
 612                         ret += 2;
 613                         itmp = i2d_OCSP_RESPID(id, &ret);
 614                         /* write id len */
 615                         s2n(itmp, q);
 616                         }
 617                 s2n(extlen, ret);
 618                 if (extlen > 0)
 619                         i2d_X509_EXTENSIONS(s->tlsext_ocsp_exts, &ret);
 620                 }
 621
 622 #ifndef OPENSSL_NO_HEARTBEATS
 623         /* Add Heartbeat extension */
 624         s2n(TLSEXT_TYPE_heartbeat,ret);
 625         s2n(1,ret);
 626         /* Set mode:
 627          * 1: peer may send requests
 628          * 2: peer not allowed to send requests
 629          */
 630         if (s->tlsext_heartbeat & SSL_TLSEXT_HB_DONT_RECV_REQUESTS)
 631                 *(ret++) = SSL_TLSEXT_HB_DONT_SEND_REQUESTS;
 632         else
 633                 *(ret++) = SSL_TLSEXT_HB_ENABLED;
 634 #endif
 635
 636 #ifndef OPENSSL_NO_NEXTPROTONEG
 637         if (s->ctx->next_proto_select_cb && !s->s3->tmp.finish_md_len)
 638                 {
 639                 /* The client advertises an emtpy extension to indicate its
 640                  * support for Next Protocol Negotiation */
 641                 if (limit - ret - 4 < 0)
 642                         return NULL;
 643                 s2n(TLSEXT_TYPE_next_proto_neg,ret);
 644                 s2n(0,ret);
 645                 }
 646 #endif
 647
 648         if(SSL_get_srtp_profiles(s))
 649                 {
 650                 int el;
 651
 652                 ssl_add_clienthello_use_srtp_ext(s, 0, &el, 0);
 653
 654                 if((limit - p - 4 - el) < 0) return NULL;
 655
 656                 s2n(TLSEXT_TYPE_use_srtp,ret);
 657                 s2n(el,ret);
 658
 659                 if(ssl_add_clienthello_use_srtp_ext(s, ret, &el, el))
 660                         {
 661                         SSLerr(SSL_F_SSL_ADD_CLIENTHELLO_TLSEXT, ERR_R_INTERNAL_ERROR);
 662                         return NULL;
 663                         }
 664                 ret += el;
 665                 }
 666
 667         if ((extdatalen = ret-p-2)== 0)
 668                 return p;
 669
 670         s2n(extdatalen,p);
 671         return ret;
 672         }
 673
 674 unsigned char *ssl_add_serverhello_tlsext(SSL *s, unsigned char *p, unsigned char *limit)
 675         {
 676         int extdatalen=0;
 677         unsigned char *ret = p;
 678 #ifndef OPENSSL_NO_NEXTPROTONEG
 679         int next_proto_neg_seen;
 680 #endif
 681
 682         /* don't add extensions for SSLv3, unless doing secure renegotiation */
 683         if (s->version == SSL3_VERSION && !s->s3->send_connection_binding)
 684                 return p;
 685
 686         ret+=2;
 687         if (ret>=limit) return NULL; /* this really never occurs, but ... */
 688
 689         if (!s->hit && s->servername_done == 1 && s->session->tlsext_hostname != NULL)
 690                 {
 691                 if ((long)(limit - ret - 4) < 0) return NULL;
 692
 693                 s2n(TLSEXT_TYPE_server_name,ret);
 694                 s2n(0,ret);
 695                 }
 696
 697         if(s->s3->send_connection_binding)
 698         {
 699           int el;
 700
 701           if(!ssl_add_serverhello_renegotiate_ext(s, 0, &el, 0))
 702               {
 703               SSLerr(SSL_F_SSL_ADD_SERVERHELLO_TLSEXT, ERR_R_INTERNAL_ERROR);
 704               return NULL;
 705               }
 706
 707           if((limit - p - 4 - el) < 0) return NULL;
 708
 709           s2n(TLSEXT_TYPE_renegotiate,ret);
 710           s2n(el,ret);
 711
 712           if(!ssl_add_serverhello_renegotiate_ext(s, ret, &el, el))
 713               {
 714               SSLerr(SSL_F_SSL_ADD_SERVERHELLO_TLSEXT, ERR_R_INTERNAL_ERROR);
 715               return NULL;
 716               }
 717
 718           ret += el;
 719         }
 720
 721 #ifndef OPENSSL_NO_EC
 722         if (s->tlsext_ecpointformatlist != NULL &&
 723             s->version != DTLS1_VERSION)
 724                 {
 725                 /* Add TLS extension ECPointFormats to the ServerHello message */
 726                 long lenmax;
 727
 728                 if ((lenmax = limit - ret - 5) < 0) return NULL;
 729                 if (s->tlsext_ecpointformatlist_length > (unsigned long)lenmax) return NULL;
 730                 if (s->tlsext_ecpointformatlist_length > 255)
 731                         {
 732                         SSLerr(SSL_F_SSL_ADD_SERVERHELLO_TLSEXT, ERR_R_INTERNAL_ERROR);
 733                         return NULL;
 734                         }
 735
 736                 s2n(TLSEXT_TYPE_ec_point_formats,ret);
 737                 s2n(s->tlsext_ecpointformatlist_length + 1,ret);
 738                 *(ret++) = (unsigned char) s->tlsext_ecpointformatlist_length;
 739                 memcpy(ret, s->tlsext_ecpointformatlist, s->tlsext_ecpointformatlist_length);
 740                 ret+=s->tlsext_ecpointformatlist_length;
 741
 742                 }
 743         /* Currently the server should not respond with a SupportedCurves extension */
 744 #endif /* OPENSSL_NO_EC */
 745
 746         if (s->tlsext_ticket_expected
 747                 && !(SSL_get_options(s) & SSL_OP_NO_TICKET))
 748                 {
 749                 if ((long)(limit - ret - 4) < 0) return NULL;
 750                 s2n(TLSEXT_TYPE_session_ticket,ret);
 751                 s2n(0,ret);
 752                 }
 753
 754         if (s->tlsext_status_expected)
 755                 {
 756                 if ((long)(limit - ret - 4) < 0) return NULL;
 757                 s2n(TLSEXT_TYPE_status_request,ret);
 758                 s2n(0,ret);
 759                 }
 760
 761 #ifdef TLSEXT_TYPE_opaque_prf_input
 762         if (s->s3->server_opaque_prf_input != NULL &&
 763             s->version != DTLS1_VERSION)
 764                 {
 765                 size_t sol = s->s3->server_opaque_prf_input_len;
 766
 767                 if ((long)(limit - ret - 6 - sol) < 0)
 768                         return NULL;
 769                 if (sol > 0xFFFD) /* can't happen */
 770                         return NULL;
 771
 772                 s2n(TLSEXT_TYPE_opaque_prf_input, ret);
 773                 s2n(sol + 2, ret);
 774                 s2n(sol, ret);
 775                 memcpy(ret, s->s3->server_opaque_prf_input, sol);
 776                 ret += sol;
 777                 }
 778 #endif
 779
 780         if(s->srtp_profile)
 781                 {
 782                 int el;
 783
 784                 ssl_add_serverhello_use_srtp_ext(s, 0, &el, 0);
 785
 786                 if((limit - p - 4 - el) < 0) return NULL;
 787
 788                 s2n(TLSEXT_TYPE_use_srtp,ret);
 789                 s2n(el,ret);
 790
 791                 if(ssl_add_serverhello_use_srtp_ext(s, ret, &el, el))
 792                         {
 793                         SSLerr(SSL_F_SSL_ADD_SERVERHELLO_TLSEXT, ERR_R_INTERNAL_ERROR);
 794                         return NULL;
 795                         }
 796                 ret+=el;
 797                 }
 798
 799         if (((s->s3->tmp.new_cipher->id & 0xFFFF)==0x80 || (s->s3->tmp.new_cipher->id & 0xFFFF)==0x81)
 800                 && (SSL_get_options(s) & SSL_OP_CRYPTOPRO_TLSEXT_BUG))
 801                 { const unsigned char cryptopro_ext[36] = {
 802                         0xfd, 0xe8, /*65000*/
 803                         0x00, 0x20, /*32 bytes length*/
 804                         0x30, 0x1e, 0x30, 0x08, 0x06, 0x06, 0x2a, 0x85,
 805                         0x03,   0x02, 0x02, 0x09, 0x30, 0x08, 0x06, 0x06,
 806                         0x2a, 0x85, 0x03, 0x02, 0x02, 0x16, 0x30, 0x08,
 807                         0x06, 0x06, 0x2a, 0x85, 0x03, 0x02, 0x02, 0x17};
 808                         if (limit-ret<36) return NULL;
 809                         memcpy(ret,cryptopro_ext,36);
 810                         ret+=36;
 811
 812                 }
 813
 814 #ifndef OPENSSL_NO_HEARTBEATS
 815         /* Add Heartbeat extension */
 816         s2n(TLSEXT_TYPE_heartbeat,ret);
 817         s2n(1,ret);
 818         /* Set mode:
 819          * 1: peer may send requests
 820          * 2: peer not allowed to send requests
 821          */
 822         if (s->tlsext_heartbeat & SSL_TLSEXT_HB_DONT_RECV_REQUESTS)
 823                 *(ret++) = SSL_TLSEXT_HB_DONT_SEND_REQUESTS;
 824         else
 825                 *(ret++) = SSL_TLSEXT_HB_ENABLED;
 826 #endif
 827
 828 #ifndef OPENSSL_NO_NEXTPROTONEG
 829         next_proto_neg_seen = s->s3->next_proto_neg_seen;
 830         s->s3->next_proto_neg_seen = 0;
 831         if (next_proto_neg_seen && s->ctx->next_protos_advertised_cb)
 832                 {
 833                 const unsigned char *npa;
 834                 unsigned int npalen;
 835                 int r;
 836
 837                 r = s->ctx->next_protos_advertised_cb(s, &npa, &npalen, s->ctx->next_protos_advertised_cb_arg);
 838                 if (r == SSL_TLSEXT_ERR_OK)
 839                         {
 840                         if ((long)(limit - ret - 4 - npalen) < 0) return NULL;
 841                         s2n(TLSEXT_TYPE_next_proto_neg,ret);
 842                         s2n(npalen,ret);
 843                         memcpy(ret, npa, npalen);
 844                         ret += npalen;
 845                         s->s3->next_proto_neg_seen = 1;
 846                         }
 847                 }
 848 #endif
 849
 850         if ((extdatalen = ret-p-2)== 0)
 851                 return p;
 852
 853         s2n(extdatalen,p);
 854         return ret;
 855         }
 856
 857 int ssl_parse_clienthello_tlsext(SSL *s, unsigned char **p, unsigned char *d, int n, int *al)
 858         {
 859         unsigned short type;
 860         unsigned short size;
 861         unsigned short len;
 862         unsigned char *data = *p;
 863         int renegotiate_seen = 0;
 864         int sigalg_seen = 0;
 865
 866         s->servername_done = 0;
 867         s->tlsext_status_type = -1;
 868 #ifndef OPENSSL_NO_NEXTPROTONEG
 869         s->s3->next_proto_neg_seen = 0;
 870 #endif
 871
 872 #ifndef OPENSSL_NO_HEARTBEATS
 873         s->tlsext_heartbeat &= ~(SSL_TLSEXT_HB_ENABLED |
 874                                SSL_TLSEXT_HB_DONT_SEND_REQUESTS);
 875 #endif
 876
 877         if (data >= (d+n-2))
 878                 goto ri_check;
 879         n2s(data,len);
 880
 881         if (data > (d+n-len))
 882                 goto ri_check;
 883
 884         while (data <= (d+n-4))
 885                 {
 886                 n2s(data,type);
 887                 n2s(data,size);
 888
 889                 if (data+size > (d+n))
 890                         goto ri_check;
 891 #if 0
 892                 fprintf(stderr,"Received extension type %d size %d\n",type,size);
 893 #endif
 894                 if (s->tlsext_debug_cb)
 895                         s->tlsext_debug_cb(s, 0, type, data, size,
 896                                                 s->tlsext_debug_arg);
 897 /* The servername extension is treated as follows:
 898
 899    - Only the hostname type is supported with a maximum length of 255.
 900    - The servername is rejected if too long or if it contains zeros,
 901      in which case an fatal alert is generated.
 902    - The servername field is maintained together with the session cache.
 903    - When a session is resumed, the servername call back invoked in order
 904      to allow the application to position itself to the right context.
 905    - The servername is acknowledged if it is new for a session or when
 906      it is identical to a previously used for the same session.
 907      Applications can control the behaviour.  They can at any time
 908      set a 'desirable' servername for a new SSL object. This can be the
 909      case for example with HTTPS when a Host: header field is received and
 910      a renegotiation is requested. In this case, a possible servername
 911      presented in the new client hello is only acknowledged if it matches
 912      the value of the Host: field.
 913    - Applications must  use SSL_OP_NO_SESSION_RESUMPTION_ON_RENEGOTIATION
 914      if they provide for changing an explicit servername context for the session,
 915      i.e. when the session has been established with a servername extension.
 916    - On session reconnect, the servername extension may be absent.
 917
 918 */
 919
 920                 if (type == TLSEXT_TYPE_server_name)
 921                         {
 922                         unsigned char *sdata;
 923                         int servname_type;
 924                         int dsize;
 925
 926                         if (size < 2)
 927                                 {
 928                                 *al = SSL_AD_DECODE_ERROR;
 929                                 return 0;
 930                                 }
 931                         n2s(data,dsize);
 932                         size -= 2;
 933                         if (dsize > size  )
 934                                 {
 935                                 *al = SSL_AD_DECODE_ERROR;
 936                                 return 0;
 937                                 }
 938
 939                         sdata = data;
 940                         while (dsize > 3)
 941                                 {
 942                                 servname_type = *(sdata++);
 943                                 n2s(sdata,len);
 944                                 dsize -= 3;
 945
 946                                 if (len > dsize)
 947                                         {
 948                                         *al = SSL_AD_DECODE_ERROR;
 949                                         return 0;
 950                                         }
 951                                 if (s->servername_done == 0)
 952                                 switch (servname_type)
 953                                         {
 954                                 case TLSEXT_NAMETYPE_host_name:
 955                                         if (!s->hit)
 956                                                 {
 957                                                 if(s->session->tlsext_hostname)
 958                                                         {
 959                                                         *al = SSL_AD_DECODE_ERROR;
 960                                                         return 0;
 961                                                         }
 962                                                 if (len > TLSEXT_MAXLEN_host_name)
 963                                                         {
 964                                                         *al = TLS1_AD_UNRECOGNIZED_NAME;
 965                                                         return 0;
 966                                                         }
 967                                                 if ((s->session->tlsext_hostname = OPENSSL_malloc(len+1)) == NULL)
 968                                                         {
 969                                                         *al = TLS1_AD_INTERNAL_ERROR;
 970                                                         return 0;
 971                                                         }
 972                                                 memcpy(s->session->tlsext_hostname, sdata, len);
 973                                                 s->session->tlsext_hostname[len]='\0';
 974                                                 if (strlen(s->session->tlsext_hostname) != len) {
 975                                                         OPENSSL_free(s->session->tlsext_hostname);
 976                                                         s->session->tlsext_hostname = NULL;
 977                                                         *al = TLS1_AD_UNRECOGNIZED_NAME;
 978                                                         return 0;
 979                                                 }
 980                                                 s->servername_done = 1;
 981
 982                                                 }
 983                                         else
 984                                                 s->servername_done = s->session->tlsext_hostname
 985                                                         && strlen(s->session->tlsext_hostname) == len
 986                                                         && strncmp(s->session->tlsext_hostname, (char *)sdata, len) == 0;
 987
 988                                         break;
 989
 990                                 default:
 991                                         break;
 992                                         }
 993
 994                                 dsize -= len;
 995                                 }
 996                         if (dsize != 0)
 997                                 {
 998                                 *al = SSL_AD_DECODE_ERROR;
 999                                 return 0;
1000                                 }
1001
1002                         }
1003 #ifndef OPENSSL_NO_SRP
1004                 else if (type == TLSEXT_TYPE_srp)
1005                         {
1006                         if (size > 0)
1007                                 {
1008                                 len = data[0];
1009                                 if ((s->srp_ctx.login = OPENSSL_malloc(len+1)) == NULL)
1010                                         return -1;
1011                                 memcpy(s->srp_ctx.login, &data[1], len);
1012                                 s->srp_ctx.login[len]='\0';
1013                                 }
1014                         }
1015 #endif
1016
1017 #ifndef OPENSSL_NO_EC
1018                 else if (type == TLSEXT_TYPE_ec_point_formats &&
1019                      s->version != DTLS1_VERSION)
1020                         {
1021                         unsigned char *sdata = data;
1022                         int ecpointformatlist_length = *(sdata++);
1023
1024                         if (ecpointformatlist_length != size - 1)
1025                                 {
1026                                 *al = TLS1_AD_DECODE_ERROR;
1027                                 return 0;
1028                                 }
1029                         if (!s->hit)
1030                                 {
1031                                 if(s->session->tlsext_ecpointformatlist)
1032                                         {
1033                                         OPENSSL_free(s->session->tlsext_ecpointformatlist);
1034                                         s->session->tlsext_ecpointformatlist = NULL;
1035                                         }
1036                                 s->session->tlsext_ecpointformatlist_length = 0;
1037                                 if ((s->session->tlsext_ecpointformatlist = OPENSSL_malloc(ecpointformatlist_length)) == NULL)
1038                                         {
1039                                         *al = TLS1_AD_INTERNAL_ERROR;
1040                                         return 0;
1041                                         }
1042                                 s->session->tlsext_ecpointformatlist_length = ecpointformatlist_length;
1043                                 memcpy(s->session->tlsext_ecpointformatlist, sdata, ecpointformatlist_length);
1044                                 }
1045 #if 0
1046                         fprintf(stderr,"ssl_parse_clienthello_tlsext s->session->tlsext_ecpointformatlist (length=%i) ", s->session->tlsext_ecpointformatlist_length);
1047                         sdata = s->session->tlsext_ecpointformatlist;
1048                         for (i = 0; i < s->session->tlsext_ecpointformatlist_length; i++)
1049                                 fprintf(stderr,"%i ",*(sdata++));
1050                         fprintf(stderr,"\n");
1051 #endif
1052                         }
1053                 else if (type == TLSEXT_TYPE_elliptic_curves &&
1054                      s->version != DTLS1_VERSION)
1055                         {
1056                         unsigned char *sdata = data;
1057                         int ellipticcurvelist_length = (*(sdata++) << 8);
1058                         ellipticcurvelist_length += (*(sdata++));
1059
1060                         if (ellipticcurvelist_length != size - 2)
1061                                 {
1062                                 *al = TLS1_AD_DECODE_ERROR;
1063                                 return 0;
1064                                 }
1065                         if (!s->hit)
1066                                 {
1067                                 if(s->session->tlsext_ellipticcurvelist)
1068                                         {
1069                                         *al = TLS1_AD_DECODE_ERROR;
1070                                         return 0;
1071                                         }
1072                                 s->session->tlsext_ellipticcurvelist_length = 0;
1073                                 if ((s->session->tlsext_ellipticcurvelist = OPENSSL_malloc(ellipticcurvelist_length)) == NULL)
1074                                         {
1075                                         *al = TLS1_AD_INTERNAL_ERROR;
1076                                         return 0;
1077                                         }
1078                                 s->session->tlsext_ellipticcurvelist_length = ellipticcurvelist_length;
1079                                 memcpy(s->session->tlsext_ellipticcurvelist, sdata, ellipticcurvelist_length);
1080                                 }
1081 #if 0
1082                         fprintf(stderr,"ssl_parse_clienthello_tlsext s->session->tlsext_ellipticcurvelist (length=%i) ", s->session->tlsext_ellipticcurvelist_length);
1083                         sdata = s->session->tlsext_ellipticcurvelist;
1084                         for (i = 0; i < s->session->tlsext_ellipticcurvelist_length; i++)
1085                                 fprintf(stderr,"%i ",*(sdata++));
1086                         fprintf(stderr,"\n");
1087 #endif
1088                         }
1089 #endif /* OPENSSL_NO_EC */
1090 #ifdef TLSEXT_TYPE_opaque_prf_input
1091                 else if (type == TLSEXT_TYPE_opaque_prf_input &&
1092                      s->version != DTLS1_VERSION)
1093                         {
1094                         unsigned char *sdata = data;
1095
1096                         if (size < 2)
1097                                 {
1098                                 *al = SSL_AD_DECODE_ERROR;
1099                                 return 0;
1100                                 }
1101                         n2s(sdata, s->s3->client_opaque_prf_input_len);
1102                         if (s->s3->client_opaque_prf_input_len != size - 2)
1103                                 {
1104                                 *al = SSL_AD_DECODE_ERROR;
1105                                 return 0;
1106                                 }
1107
1108                         if (s->s3->client_opaque_prf_input != NULL) /* shouldn't really happen */
1109                                 OPENSSL_free(s->s3->client_opaque_prf_input);
1110                         if (s->s3->client_opaque_prf_input_len == 0)
1111                                 s->s3->client_opaque_prf_input = OPENSSL_malloc(1); /* dummy byte just to get non-NULL */
1112                         else
1113                                 s->s3->client_opaque_prf_input = BUF_memdup(sdata, s->s3->client_opaque_prf_input_len);
1114                         if (s->s3->client_opaque_prf_input == NULL)
1115                                 {
1116                                 *al = TLS1_AD_INTERNAL_ERROR;
1117                                 return 0;
1118                                 }
1119                         }
1120 #endif
1121                 else if (type == TLSEXT_TYPE_session_ticket)
1122                         {
1123                         if (s->tls_session_ticket_ext_cb &&
1124                             !s->tls_session_ticket_ext_cb(s, data, size, s->tls_session_ticket_ext_cb_arg))
1125                                 {
1126                                 *al = TLS1_AD_INTERNAL_ERROR;
1127                                 return 0;
1128                                 }
1129                         }
1130                 else if (type == TLSEXT_TYPE_renegotiate)
1131                         {
1132                         if(!ssl_parse_clienthello_renegotiate_ext(s, data, size, al))
1133                                 return 0;
1134                         renegotiate_seen = 1;
1135                         }
1136                 else if (type == TLSEXT_TYPE_signature_algorithms)
1137                         {
1138                         int dsize;
1139                         if (sigalg_seen || size < 2)
1140                                 {
1141                                 *al = SSL_AD_DECODE_ERROR;
1142                                 return 0;
1143                                 }
1144                         sigalg_seen = 1;
1145                         n2s(data,dsize);
1146                         size -= 2;
1147                         if (dsize != size || dsize & 1)
1148                                 {
1149                                 *al = SSL_AD_DECODE_ERROR;
1150                                 return 0;
1151                                 }
1152                         if (!tls1_process_sigalgs(s, data, dsize))
1153                                 {
1154                                 *al = SSL_AD_DECODE_ERROR;
1155                                 return 0;
1156                                 }
1157                         }
1158                 else if (type == TLSEXT_TYPE_status_request &&
1159                          s->version != DTLS1_VERSION && s->ctx->tlsext_status_cb)
1160                         {
1161
1162                         if (size < 5)
1163                                 {
1164                                 *al = SSL_AD_DECODE_ERROR;
1165                                 return 0;
1166                                 }
1167
1168                         s->tlsext_status_type = *data++;
1169                         size--;
1170                         if (s->tlsext_status_type == TLSEXT_STATUSTYPE_ocsp)
1171                                 {
1172                                 const unsigned char *sdata;
1173                                 int dsize;
1174                                 /* Read in responder_id_list */
1175                                 n2s(data,dsize);
1176                                 size -= 2;
1177                                 if (dsize > size  )
1178                                         {
1179                                         *al = SSL_AD_DECODE_ERROR;
1180                                         return 0;
1181                                         }
1182                                 while (dsize > 0)
1183                                         {
1184                                         OCSP_RESPID *id;
1185                                         int idsize;
1186                                         if (dsize < 4)
1187                                                 {
1188                                                 *al = SSL_AD_DECODE_ERROR;
1189                                                 return 0;
1190                                                 }
1191                                         n2s(data, idsize);
1192                                         dsize -= 2 + idsize;
1193                                         size -= 2 + idsize;
1194                                         if (dsize < 0)
1195                                                 {
1196                                                 *al = SSL_AD_DECODE_ERROR;
1197                                                 return 0;
1198                                                 }
1199                                         sdata = data;
1200                                         data += idsize;
1201                                         id = d2i_OCSP_RESPID(NULL,
1202                                                                 &sdata, idsize);
1203                                         if (!id)
1204                                                 {
1205                                                 *al = SSL_AD_DECODE_ERROR;
1206                                                 return 0;
1207                                                 }
1208                                         if (data != sdata)
1209                                                 {
1210                                                 OCSP_RESPID_free(id);
1211                                                 *al = SSL_AD_DECODE_ERROR;
1212                                                 return 0;
1213                                                 }
1214                                         if (!s->tlsext_ocsp_ids
1215                                                 && !(s->tlsext_ocsp_ids =
1216                                                 sk_OCSP_RESPID_new_null()))
1217                                                 {
1218                                                 OCSP_RESPID_free(id);
1219                                                 *al = SSL_AD_INTERNAL_ERROR;
1220                                                 return 0;
1221                                                 }
1222                                         if (!sk_OCSP_RESPID_push(
1223                                                         s->tlsext_ocsp_ids, id))
1224                                                 {
1225                                                 OCSP_RESPID_free(id);
1226                                                 *al = SSL_AD_INTERNAL_ERROR;
1227                                                 return 0;
1228                                                 }
1229                                         }
1230
1231                                 /* Read in request_extensions */
1232                                 if (size < 2)
1233                                         {
1234                                         *al = SSL_AD_DECODE_ERROR;
1235                                         return 0;
1236                                         }
1237                                 n2s(data,dsize);
1238                                 size -= 2;
1239                                 if (dsize != size)
1240                                         {
1241                                         *al = SSL_AD_DECODE_ERROR;
1242                                         return 0;
1243                                         }
1244                                 sdata = data;
1245                                 if (dsize > 0)
1246                                         {
1247                                         s->tlsext_ocsp_exts =
1248                                                 d2i_X509_EXTENSIONS(NULL,
1249                                                         &sdata, dsize);
1250                                         if (!s->tlsext_ocsp_exts
1251                                                 || (data + dsize != sdata))
1252                                                 {
1253                                                 *al = SSL_AD_DECODE_ERROR;
1254                                                 return 0;
1255                                                 }
1256                                         }
1257                                 }
1258                                 /* We don't know what to do with any other type
1259                                 * so ignore it.
1260                                 */
1261                                 else
1262                                         s->tlsext_status_type = -1;
1263                         }
1264 #ifndef OPENSSL_NO_HEARTBEATS
1265                 else if (type == TLSEXT_TYPE_heartbeat)
1266                         {
1267                         switch(data[0])
1268                                 {
1269                                 case 0x01:      /* Client allows us to send HB requests */
1270                                                         s->tlsext_heartbeat |= SSL_TLSEXT_HB_ENABLED;
1271                                                         break;
1272                                 case 0x02:      /* Client doesn't accept HB requests */
1273                                                         s->tlsext_heartbeat |= SSL_TLSEXT_HB_ENABLED;
1274                                                         s->tlsext_heartbeat |= SSL_TLSEXT_HB_DONT_SEND_REQUESTS;
1275                                                         break;
1276                                 }
1277                         }
1278 #endif
1279 #ifndef OPENSSL_NO_NEXTPROTONEG
1280                 else if (type == TLSEXT_TYPE_next_proto_neg &&
1281                          s->s3->tmp.finish_md_len == 0)
1282                         {
1283                         /* We shouldn't accept this extension on a
1284                          * renegotiation.
1285                          *
1286                          * s->new_session will be set on renegotiation, but we
1287                          * probably shouldn't rely that it couldn't be set on
1288                          * the initial renegotation too in certain cases (when
1289                          * there's some other reason to disallow resuming an
1290                          * earlier session -- the current code won't be doing
1291                          * anything like that, but this might change).
1292
1293                          * A valid sign that there's been a previous handshake
1294                          * in this connection is if s->s3->tmp.finish_md_len >
1295                          * 0.  (We are talking about a check that will happen
1296                          * in the Hello protocol round, well before a new
1297                          * Finished message could have been computed.) */
1298                         s->s3->next_proto_neg_seen = 1;
1299                         }
1300 #endif
1301
1302                 /* session ticket processed earlier */
1303                 else if (type == TLSEXT_TYPE_use_srtp)
1304                         {
1305                         if(ssl_parse_clienthello_use_srtp_ext(s, data, size,
1306                                                               al))
1307                                 return 0;
1308                         }
1309
1310                 data+=size;
1311                 }
1312
1313         *p = data;
1314
1315         ri_check:
1316
1317         /* Need RI if renegotiating */
1318
1319         if (!renegotiate_seen && s->renegotiate &&
1320                 !(s->options & SSL_OP_ALLOW_UNSAFE_LEGACY_RENEGOTIATION))
1321                 {
1322                 *al = SSL_AD_HANDSHAKE_FAILURE;
1323                 SSLerr(SSL_F_SSL_PARSE_CLIENTHELLO_TLSEXT,
1324                                 SSL_R_UNSAFE_LEGACY_RENEGOTIATION_DISABLED);
1325                 return 0;
1326                 }
1327
1328         return 1;
1329         }
1330
1331 #ifndef OPENSSL_NO_NEXTPROTONEG
1332 /* ssl_next_proto_validate validates a Next Protocol Negotiation block. No
1333  * elements of zero length are allowed and the set of elements must exactly fill
1334  * the length of the block. */
1335 static char ssl_next_proto_validate(unsigned char *d, unsigned len)
1336         {
1337         unsigned int off = 0;
1338
1339         while (off < len)
1340                 {
1341                 if (d[off] == 0)
1342                         return 0;
1343                 off += d[off];
1344                 off++;
1345                 }
1346
1347         return off == len;
1348         }
1349 #endif
1350
1351 int ssl_parse_serverhello_tlsext(SSL *s, unsigned char **p, unsigned char *d, int n, int *al)
1352         {
1353         unsigned short length;
1354         unsigned short type;
1355         unsigned short size;
1356         unsigned char *data = *p;
1357         int tlsext_servername = 0;
1358         int renegotiate_seen = 0;
1359
1360 #ifndef OPENSSL_NO_NEXTPROTONEG
1361         s->s3->next_proto_neg_seen = 0;
1362 #endif
1363
1364 #ifndef OPENSSL_NO_HEARTBEATS
1365         s->tlsext_heartbeat &= ~(SSL_TLSEXT_HB_ENABLED |
1366                                SSL_TLSEXT_HB_DONT_SEND_REQUESTS);
1367 #endif
1368
1369         if (data >= (d+n-2))
1370                 goto ri_check;
1371
1372         n2s(data,length);
1373         if (data+length != d+n)
1374                 {
1375                 *al = SSL_AD_DECODE_ERROR;
1376                 return 0;
1377                 }
1378
1379         while(data <= (d+n-4))
1380                 {
1381                 n2s(data,type);
1382                 n2s(data,size);
1383
1384                 if (data+size > (d+n))
1385                         goto ri_check;
1386
1387                 if (s->tlsext_debug_cb)
1388                         s->tlsext_debug_cb(s, 1, type, data, size,
1389                                                 s->tlsext_debug_arg);
1390
1391                 if (type == TLSEXT_TYPE_server_name)
1392                         {
1393                         if (s->tlsext_hostname == NULL || size > 0)
1394                                 {
1395                                 *al = TLS1_AD_UNRECOGNIZED_NAME;
1396                                 return 0;
1397                                 }
1398                         tlsext_servername = 1;
1399                         }
1400
1401 #ifndef OPENSSL_NO_EC
1402                 else if (type == TLSEXT_TYPE_ec_point_formats &&
1403                      s->version != DTLS1_VERSION)
1404                         {
1405                         unsigned char *sdata = data;
1406                         int ecpointformatlist_length = *(sdata++);
1407
1408                         if (ecpointformatlist_length != size - 1)
1409                                 {
1410                                 *al = TLS1_AD_DECODE_ERROR;
1411                                 return 0;
1412                                 }
1413                         s->session->tlsext_ecpointformatlist_length = 0;
1414                         if (s->session->tlsext_ecpointformatlist != NULL) OPENSSL_free(s->session->tlsext_ecpointformatlist);
1415                         if ((s->session->tlsext_ecpointformatlist = OPENSSL_malloc(ecpointformatlist_length)) == NULL)
1416                                 {
1417                                 *al = TLS1_AD_INTERNAL_ERROR;
1418                                 return 0;
1419                                 }
1420                         s->session->tlsext_ecpointformatlist_length = ecpointformatlist_length;
1421                         memcpy(s->session->tlsext_ecpointformatlist, sdata, ecpointformatlist_length);
1422 #if 0
1423                         fprintf(stderr,"ssl_parse_serverhello_tlsext s->session->tlsext_ecpointformatlist ");
1424                         sdata = s->session->tlsext_ecpointformatlist;
1425                         for (i = 0; i < s->session->tlsext_ecpointformatlist_length; i++)
1426                                 fprintf(stderr,"%i ",*(sdata++));
1427                         fprintf(stderr,"\n");
1428 #endif
1429                         }
1430 #endif /* OPENSSL_NO_EC */
1431
1432                 else if (type == TLSEXT_TYPE_session_ticket)
1433                         {
1434                         if (s->tls_session_ticket_ext_cb &&
1435                             !s->tls_session_ticket_ext_cb(s, data, size, s->tls_session_ticket_ext_cb_arg))
1436                                 {
1437                                 *al = TLS1_AD_INTERNAL_ERROR;
1438                                 return 0;
1439                                 }
1440                         if ((SSL_get_options(s) & SSL_OP_NO_TICKET)
1441                                 || (size > 0))
1442                                 {
1443                                 *al = TLS1_AD_UNSUPPORTED_EXTENSION;
1444                                 return 0;
1445                                 }
1446                         s->tlsext_ticket_expected = 1;
1447                         }
1448 #ifdef TLSEXT_TYPE_opaque_prf_input
1449                 else if (type == TLSEXT_TYPE_opaque_prf_input &&
1450                      s->version != DTLS1_VERSION)
1451                         {
1452                         unsigned char *sdata = data;
1453
1454                         if (size < 2)
1455                                 {
1456                                 *al = SSL_AD_DECODE_ERROR;
1457                                 return 0;
1458                                 }
1459                         n2s(sdata, s->s3->server_opaque_prf_input_len);
1460                         if (s->s3->server_opaque_prf_input_len != size - 2)
1461                                 {
1462                                 *al = SSL_AD_DECODE_ERROR;
1463                                 return 0;
1464                                 }
1465
1466                         if (s->s3->server_opaque_prf_input != NULL) /* shouldn't really happen */
1467                                 OPENSSL_free(s->s3->server_opaque_prf_input);
1468                         if (s->s3->server_opaque_prf_input_len == 0)
1469                                 s->s3->server_opaque_prf_input = OPENSSL_malloc(1); /* dummy byte just to get non-NULL */
1470                         else
1471                                 s->s3->server_opaque_prf_input = BUF_memdup(sdata, s->s3->server_opaque_prf_input_len);
1472
1473                         if (s->s3->server_opaque_prf_input == NULL)
1474                                 {
1475                                 *al = TLS1_AD_INTERNAL_ERROR;
1476                                 return 0;
1477                                 }
1478                         }
1479 #endif
1480                 else if (type == TLSEXT_TYPE_status_request &&
1481                          s->version != DTLS1_VERSION)
1482                         {
1483                         /* MUST be empty and only sent if we've requested
1484                          * a status request message.
1485                          */
1486                         if ((s->tlsext_status_type == -1) || (size > 0))
1487                                 {
1488                                 *al = TLS1_AD_UNSUPPORTED_EXTENSION;
1489                                 return 0;
1490                                 }
1491                         /* Set flag to expect CertificateStatus message */
1492                         s->tlsext_status_expected = 1;
1493                         }
1494 #ifndef OPENSSL_NO_NEXTPROTONEG
1495                 else if (type == TLSEXT_TYPE_next_proto_neg &&
1496                          s->s3->tmp.finish_md_len == 0)
1497                         {
1498                         unsigned char *selected;
1499                         unsigned char selected_len;
1500
1501                         /* We must have requested it. */
1502                         if ((s->ctx->next_proto_select_cb == NULL))
1503                                 {
1504                                 *al = TLS1_AD_UNSUPPORTED_EXTENSION;
1505                                 return 0;
1506                                 }
1507                         /* The data must be valid */
1508                         if (!ssl_next_proto_validate(data, size))
1509                                 {
1510                                 *al = TLS1_AD_DECODE_ERROR;
1511                                 return 0;
1512                                 }
1513                         if (s->ctx->next_proto_select_cb(s, &selected, &selected_len, data, size, s->ctx->next_proto_select_cb_arg) != SSL_TLSEXT_ERR_OK)
1514                                 {
1515                                 *al = TLS1_AD_INTERNAL_ERROR;
1516                                 return 0;
1517                                 }
1518                         s->next_proto_negotiated = OPENSSL_malloc(selected_len);
1519                         if (!s->next_proto_negotiated)
1520                                 {
1521                                 *al = TLS1_AD_INTERNAL_ERROR;
1522                                 return 0;
1523                                 }
1524                         memcpy(s->next_proto_negotiated, selected, selected_len);
1525                         s->next_proto_negotiated_len = selected_len;
1526                         s->s3->next_proto_neg_seen = 1;
1527                         }
1528 #endif
1529                 else if (type == TLSEXT_TYPE_renegotiate)
1530                         {
1531                         if(!ssl_parse_serverhello_renegotiate_ext(s, data, size, al))
1532                                 return 0;
1533                         renegotiate_seen = 1;
1534                         }
1535 #ifndef OPENSSL_NO_HEARTBEATS
1536                 else if (type == TLSEXT_TYPE_heartbeat)
1537                         {
1538                         switch(data[0])
1539                                 {
1540                                 case 0x01:      /* Server allows us to send HB requests */
1541                                                         s->tlsext_heartbeat |= SSL_TLSEXT_HB_ENABLED;
1542                                                         break;
1543                                 case 0x02:      /* Server doesn't accept HB requests */
1544                                                         s->tlsext_heartbeat |= SSL_TLSEXT_HB_ENABLED;
1545                                                         s->tlsext_heartbeat |= SSL_TLSEXT_HB_DONT_SEND_REQUESTS;
1546                                                         break;
1547                                 }
1548                         }
1549 #endif
1550                 else if (type == TLSEXT_TYPE_use_srtp)
1551                         {
1552                         if(ssl_parse_serverhello_use_srtp_ext(s, data, size,
1553                                                               al))
1554                                 return 0;
1555                         }
1556
1557                 data+=size;
1558                 }
1559
1560         if (data != d+n)
1561                 {
1562                 *al = SSL_AD_DECODE_ERROR;
1563                 return 0;
1564                 }
1565
1566         if (!s->hit && tlsext_servername == 1)
1567                 {
1568                 if (s->tlsext_hostname)
1569                         {
1570                         if (s->session->tlsext_hostname == NULL)
1571                                 {
1572                                 s->session->tlsext_hostname = BUF_strdup(s->tlsext_hostname);
1573                                 if (!s->session->tlsext_hostname)
1574                                         {
1575                                         *al = SSL_AD_UNRECOGNIZED_NAME;
1576                                         return 0;
1577                                         }
1578                                 }
1579                         else
1580                                 {
1581                                 *al = SSL_AD_DECODE_ERROR;
1582                                 return 0;
1583                                 }
1584                         }
1585                 }
1586
1587         *p = data;
1588
1589         ri_check:
1590
1591         /* Determine if we need to see RI. Strictly speaking if we want to
1592          * avoid an attack we should *always* see RI even on initial server
1593          * hello because the client doesn't see any renegotiation during an
1594          * attack. However this would mean we could not connect to any server
1595          * which doesn't support RI so for the immediate future tolerate RI
1596          * absence on initial connect only.
1597          */
1598         if (!renegotiate_seen
1599                 && !(s->options & SSL_OP_LEGACY_SERVER_CONNECT)
1600                 && !(s->options & SSL_OP_ALLOW_UNSAFE_LEGACY_RENEGOTIATION))
1601                 {
1602                 *al = SSL_AD_HANDSHAKE_FAILURE;
1603                 SSLerr(SSL_F_SSL_PARSE_SERVERHELLO_TLSEXT,
1604                                 SSL_R_UNSAFE_LEGACY_RENEGOTIATION_DISABLED);
1605                 return 0;
1606                 }
1607
1608         return 1;
1609         }
1610
1611
1612 int ssl_prepare_clienthello_tlsext(SSL *s)
1613         {
1614 #ifndef OPENSSL_NO_EC
1615         /* If we are client and using an elliptic curve cryptography cipher suite, send the point formats
1616          * and elliptic curves we support.
1617          */
1618         int using_ecc = 0;
1619         int i;
1620         unsigned char *j;
1621         unsigned long alg_k, alg_a;
1622         STACK_OF(SSL_CIPHER) *cipher_stack = SSL_get_ciphers(s);
1623
1624         for (i = 0; i < sk_SSL_CIPHER_num(cipher_stack); i++)
1625                 {
1626                 SSL_CIPHER *c = sk_SSL_CIPHER_value(cipher_stack, i);
1627
1628                 alg_k = c->algorithm_mkey;
1629                 alg_a = c->algorithm_auth;
1630                 if ((alg_k & (SSL_kEECDH|SSL_kECDHr|SSL_kECDHe) || (alg_a & SSL_aECDSA)))
1631                         {
1632                         using_ecc = 1;
1633                         break;
1634                         }
1635                 }
1636         using_ecc = using_ecc && (s->version >= TLS1_VERSION);
1637         if (using_ecc)
1638                 {
1639                 if (s->tlsext_ecpointformatlist != NULL) OPENSSL_free(s->tlsext_ecpointformatlist);
1640                 if ((s->tlsext_ecpointformatlist = OPENSSL_malloc(3)) == NULL)
1641                         {
1642                         SSLerr(SSL_F_SSL_PREPARE_CLIENTHELLO_TLSEXT,ERR_R_MALLOC_FAILURE);
1643                         return -1;
1644                         }
1645                 s->tlsext_ecpointformatlist_length = 3;
1646                 s->tlsext_ecpointformatlist[0] = TLSEXT_ECPOINTFORMAT_uncompressed;
1647                 s->tlsext_ecpointformatlist[1] = TLSEXT_ECPOINTFORMAT_ansiX962_compressed_prime;
1648                 s->tlsext_ecpointformatlist[2] = TLSEXT_ECPOINTFORMAT_ansiX962_compressed_char2;
1649
1650                 /* we support all named elliptic curves in draft-ietf-tls-ecc-12 */
1651                 if (s->tlsext_ellipticcurvelist != NULL) OPENSSL_free(s->tlsext_ellipticcurvelist);
1652                 s->tlsext_ellipticcurvelist_length = sizeof(pref_list)/sizeof(pref_list[0]) * 2;
1653                 if ((s->tlsext_ellipticcurvelist = OPENSSL_malloc(s->tlsext_ellipticcurvelist_length)) == NULL)
1654                         {
1655                         s->tlsext_ellipticcurvelist_length = 0;
1656                         SSLerr(SSL_F_SSL_PREPARE_CLIENTHELLO_TLSEXT,ERR_R_MALLOC_FAILURE);
1657                         return -1;
1658                         }
1659                 for (i = 0, j = s->tlsext_ellipticcurvelist; (unsigned int)i <
1660                                 sizeof(pref_list)/sizeof(pref_list[0]); i++)
1661                         {
1662                         int id = tls1_ec_nid2curve_id(pref_list[i]);
1663                         s2n(id,j);
1664                         }
1665                 }
1666 #endif /* OPENSSL_NO_EC */
1667
1668 #ifdef TLSEXT_TYPE_opaque_prf_input
1669         {
1670                 int r = 1;
1671
1672                 if (s->ctx->tlsext_opaque_prf_input_callback != 0)
1673                         {
1674                         r = s->ctx->tlsext_opaque_prf_input_callback(s, NULL, 0, s->ctx->tlsext_opaque_prf_input_callback_arg);
1675                         if (!r)
1676                                 return -1;
1677                         }
1678
1679                 if (s->tlsext_opaque_prf_input != NULL)
1680                         {
1681                         if (s->s3->client_opaque_prf_input != NULL) /* shouldn't really happen */
1682                                 OPENSSL_free(s->s3->client_opaque_prf_input);
1683
1684                         if (s->tlsext_opaque_prf_input_len == 0)
1685                                 s->s3->client_opaque_prf_input = OPENSSL_malloc(1); /* dummy byte just to get non-NULL */
1686                         else
1687                                 s->s3->client_opaque_prf_input = BUF_memdup(s->tlsext_opaque_prf_input, s->tlsext_opaque_prf_input_len);
1688                         if (s->s3->client_opaque_prf_input == NULL)
1689                                 {
1690                                 SSLerr(SSL_F_SSL_PREPARE_CLIENTHELLO_TLSEXT,ERR_R_MALLOC_FAILURE);
1691                                 return -1;
1692                                 }
1693                         s->s3->client_opaque_prf_input_len = s->tlsext_opaque_prf_input_len;
1694                         }
1695
1696                 if (r == 2)
1697                         /* at callback's request, insist on receiving an appropriate server opaque PRF input */
1698                         s->s3->server_opaque_prf_input_len = s->tlsext_opaque_prf_input_len;
1699         }
1700 #endif
1701
1702         return 1;
1703         }
1704
1705 int ssl_prepare_serverhello_tlsext(SSL *s)
1706         {
1707 #ifndef OPENSSL_NO_EC
1708         /* If we are server and using an ECC cipher suite, send the point formats we support
1709          * if the client sent us an ECPointsFormat extension.  Note that the server is not
1710          * supposed to send an EllipticCurves extension.
1711          */
1712
1713         unsigned long alg_k = s->s3->tmp.new_cipher->algorithm_mkey;
1714         unsigned long alg_a = s->s3->tmp.new_cipher->algorithm_auth;
1715         int using_ecc = (alg_k & (SSL_kEECDH|SSL_kECDHr|SSL_kECDHe)) || (alg_a & SSL_aECDSA);
1716         using_ecc = using_ecc && (s->session->tlsext_ecpointformatlist != NULL);
1717
1718         if (using_ecc)
1719                 {
1720                 if (s->tlsext_ecpointformatlist != NULL) OPENSSL_free(s->tlsext_ecpointformatlist);
1721                 if ((s->tlsext_ecpointformatlist = OPENSSL_malloc(3)) == NULL)
1722                         {
1723                         SSLerr(SSL_F_SSL_PREPARE_SERVERHELLO_TLSEXT,ERR_R_MALLOC_FAILURE);
1724                         return -1;
1725                         }
1726                 s->tlsext_ecpointformatlist_length = 3;
1727                 s->tlsext_ecpointformatlist[0] = TLSEXT_ECPOINTFORMAT_uncompressed;
1728                 s->tlsext_ecpointformatlist[1] = TLSEXT_ECPOINTFORMAT_ansiX962_compressed_prime;
1729                 s->tlsext_ecpointformatlist[2] = TLSEXT_ECPOINTFORMAT_ansiX962_compressed_char2;
1730                 }
1731 #endif /* OPENSSL_NO_EC */
1732
1733         return 1;
1734         }
1735
1736 int ssl_check_clienthello_tlsext(SSL *s)
1737         {
1738         int ret=SSL_TLSEXT_ERR_NOACK;
1739         int al = SSL_AD_UNRECOGNIZED_NAME;
1740
1741 #ifndef OPENSSL_NO_EC
1742         /* The handling of the ECPointFormats extension is done elsewhere, namely in
1743          * ssl3_choose_cipher in s3_lib.c.
1744          */
1745         /* The handling of the EllipticCurves extension is done elsewhere, namely in
1746          * ssl3_choose_cipher in s3_lib.c.
1747          */
1748 #endif
1749
1750         if (s->ctx != NULL && s->ctx->tlsext_servername_callback != 0)
1751                 ret = s->ctx->tlsext_servername_callback(s, &al, s->ctx->tlsext_servername_arg);
1752         else if (s->initial_ctx != NULL && s->initial_ctx->tlsext_servername_callback != 0)
1753                 ret = s->initial_ctx->tlsext_servername_callback(s, &al, s->initial_ctx->tlsext_servername_arg);
1754
1755         /* If status request then ask callback what to do.
1756          * Note: this must be called after servername callbacks in case
1757          * the certificate has changed.
1758          */
1759         if ((s->tlsext_status_type != -1) && s->ctx && s->ctx->tlsext_status_cb)
1760                 {
1761                 int r;
1762                 r = s->ctx->tlsext_status_cb(s, s->ctx->tlsext_status_arg);
1763                 switch (r)
1764                         {
1765                         /* We don't want to send a status request response */
1766                         case SSL_TLSEXT_ERR_NOACK:
1767                                 s->tlsext_status_expected = 0;
1768                                 break;
1769                         /* status request response should be sent */
1770                         case SSL_TLSEXT_ERR_OK:
1771                                 if (s->tlsext_ocsp_resp)
1772                                         s->tlsext_status_expected = 1;
1773                                 else
1774                                         s->tlsext_status_expected = 0;
1775                                 break;
1776                         /* something bad happened */
1777                         case SSL_TLSEXT_ERR_ALERT_FATAL:
1778                                 ret = SSL_TLSEXT_ERR_ALERT_FATAL;
1779                                 al = SSL_AD_INTERNAL_ERROR;
1780                                 goto err;
1781                         }
1782                 }
1783         else
1784                 s->tlsext_status_expected = 0;
1785
1786 #ifdef TLSEXT_TYPE_opaque_prf_input
1787         {
1788                 /* This sort of belongs into ssl_prepare_serverhello_tlsext(),
1789                  * but we might be sending an alert in response to the client hello,
1790                  * so this has to happen here in ssl_check_clienthello_tlsext(). */
1791
1792                 int r = 1;
1793
1794                 if (s->ctx->tlsext_opaque_prf_input_callback != 0)
1795                         {
1796                         r = s->ctx->tlsext_opaque_prf_input_callback(s, NULL, 0, s->ctx->tlsext_opaque_prf_input_callback_arg);
1797                         if (!r)
1798                                 {
1799                                 ret = SSL_TLSEXT_ERR_ALERT_FATAL;
1800                                 al = SSL_AD_INTERNAL_ERROR;
1801                                 goto err;
1802                                 }
1803                         }
1804
1805                 if (s->s3->server_opaque_prf_input != NULL) /* shouldn't really happen */
1806                         OPENSSL_free(s->s3->server_opaque_prf_input);
1807                 s->s3->server_opaque_prf_input = NULL;
1808
1809                 if (s->tlsext_opaque_prf_input != NULL)
1810                         {
1811                         if (s->s3->client_opaque_prf_input != NULL &&
1812                                 s->s3->client_opaque_prf_input_len == s->tlsext_opaque_prf_input_len)
1813                                 {
1814                                 /* can only use this extension if we have a server opaque PRF input
1815                                  * of the same length as the client opaque PRF input! */
1816
1817                                 if (s->tlsext_opaque_prf_input_len == 0)
1818                                         s->s3->server_opaque_prf_input = OPENSSL_malloc(1); /* dummy byte just to get non-NULL */
1819                                 else
1820                                         s->s3->server_opaque_prf_input = BUF_memdup(s->tlsext_opaque_prf_input, s->tlsext_opaque_prf_input_len);
1821                                 if (s->s3->server_opaque_prf_input == NULL)
1822                                         {
1823                                         ret = SSL_TLSEXT_ERR_ALERT_FATAL;
1824                                         al = SSL_AD_INTERNAL_ERROR;
1825                                         goto err;
1826                                         }
1827                                 s->s3->server_opaque_prf_input_len = s->tlsext_opaque_prf_input_len;
1828                                 }
1829                         }
1830
1831                 if (r == 2 && s->s3->server_opaque_prf_input == NULL)
1832                         {
1833                         /* The callback wants to enforce use of the extension,
1834                          * but we can't do that with the client opaque PRF input;
1835                          * abort the handshake.
1836                          */
1837                         ret = SSL_TLSEXT_ERR_ALERT_FATAL;
1838                         al = SSL_AD_HANDSHAKE_FAILURE;
1839                         }
1840         }
1841
1842 #endif
1843  err:
1844         switch (ret)
1845                 {
1846                 case SSL_TLSEXT_ERR_ALERT_FATAL:
1847                         ssl3_send_alert(s,SSL3_AL_FATAL,al);
1848                         return -1;
1849
1850                 case SSL_TLSEXT_ERR_ALERT_WARNING:
1851                         ssl3_send_alert(s,SSL3_AL_WARNING,al);
1852                         return 1;
1853
1854                 case SSL_TLSEXT_ERR_NOACK:
1855                         s->servername_done=0;
1856                         default:
1857                 return 1;
1858                 }
1859         }
1860
1861 int ssl_check_serverhello_tlsext(SSL *s)
1862         {
1863         int ret=SSL_TLSEXT_ERR_NOACK;
1864         int al = SSL_AD_UNRECOGNIZED_NAME;
1865
1866 #ifndef OPENSSL_NO_EC
1867         /* If we are client and using an elliptic curve cryptography cipher
1868          * suite, then if server returns an EC point formats lists extension
1869          * it must contain uncompressed.
1870          */
1871         unsigned long alg_k = s->s3->tmp.new_cipher->algorithm_mkey;
1872         unsigned long alg_a = s->s3->tmp.new_cipher->algorithm_auth;
1873         if ((s->tlsext_ecpointformatlist != NULL) && (s->tlsext_ecpointformatlist_length > 0) &&
1874             (s->session->tlsext_ecpointformatlist != NULL) && (s->session->tlsext_ecpointformatlist_length > 0) &&
1875             ((alg_k & (SSL_kEECDH|SSL_kECDHr|SSL_kECDHe)) || (alg_a & SSL_aECDSA)))
1876                 {
1877                 /* we are using an ECC cipher */
1878                 size_t i;
1879                 unsigned char *list;
1880                 int found_uncompressed = 0;
1881                 list = s->session->tlsext_ecpointformatlist;
1882                 for (i = 0; i < s->session->tlsext_ecpointformatlist_length; i++)
1883                         {
1884                         if (*(list++) == TLSEXT_ECPOINTFORMAT_uncompressed)
1885                                 {
1886                                 found_uncompressed = 1;
1887                                 break;
1888                                 }
1889                         }
1890                 if (!found_uncompressed)
1891                         {
1892                         SSLerr(SSL_F_SSL_CHECK_SERVERHELLO_TLSEXT,SSL_R_TLS_INVALID_ECPOINTFORMAT_LIST);
1893                         return -1;
1894                         }
1895                 }
1896         ret = SSL_TLSEXT_ERR_OK;
1897 #endif /* OPENSSL_NO_EC */
1898
1899         if (s->ctx != NULL && s->ctx->tlsext_servername_callback != 0)
1900                 ret = s->ctx->tlsext_servername_callback(s, &al, s->ctx->tlsext_servername_arg);
1901         else if (s->initial_ctx != NULL && s->initial_ctx->tlsext_servername_callback != 0)
1902                 ret = s->initial_ctx->tlsext_servername_callback(s, &al, s->initial_ctx->tlsext_servername_arg);
1903
1904 #ifdef TLSEXT_TYPE_opaque_prf_input
1905         if (s->s3->server_opaque_prf_input_len > 0)
1906                 {
1907                 /* This case may indicate that we, as a client, want to insist on using opaque PRF inputs.
1908                  * So first verify that we really have a value from the server too. */
1909
1910                 if (s->s3->server_opaque_prf_input == NULL)
1911                         {
1912                         ret = SSL_TLSEXT_ERR_ALERT_FATAL;
1913                         al = SSL_AD_HANDSHAKE_FAILURE;
1914                         }
1915
1916                 /* Anytime the server *has* sent an opaque PRF input, we need to check
1917                  * that we have a client opaque PRF input of the same size. */
1918                 if (s->s3->client_opaque_prf_input == NULL ||
1919                     s->s3->client_opaque_prf_input_len != s->s3->server_opaque_prf_input_len)
1920                         {
1921                         ret = SSL_TLSEXT_ERR_ALERT_FATAL;
1922                         al = SSL_AD_ILLEGAL_PARAMETER;
1923                         }
1924                 }
1925 #endif
1926
1927         /* If we've requested certificate status and we wont get one
1928          * tell the callback
1929          */
1930         if ((s->tlsext_status_type != -1) && !(s->tlsext_status_expected)
1931                         && s->ctx && s->ctx->tlsext_status_cb)
1932                 {
1933                 int r;
1934                 /* Set resp to NULL, resplen to -1 so callback knows
1935                  * there is no response.
1936                  */
1937                 if (s->tlsext_ocsp_resp)
1938                         {
1939                         OPENSSL_free(s->tlsext_ocsp_resp);
1940                         s->tlsext_ocsp_resp = NULL;
1941                         }
1942                 s->tlsext_ocsp_resplen = -1;
1943                 r = s->ctx->tlsext_status_cb(s, s->ctx->tlsext_status_arg);
1944                 if (r == 0)
1945                         {
1946                         al = SSL_AD_BAD_CERTIFICATE_STATUS_RESPONSE;
1947                         ret = SSL_TLSEXT_ERR_ALERT_FATAL;
1948                         }
1949                 if (r < 0)
1950                         {
1951                         al = SSL_AD_INTERNAL_ERROR;
1952                         ret = SSL_TLSEXT_ERR_ALERT_FATAL;
1953                         }
1954                 }
1955
1956         switch (ret)
1957                 {
1958                 case SSL_TLSEXT_ERR_ALERT_FATAL:
1959                         ssl3_send_alert(s,SSL3_AL_FATAL,al);
1960                         return -1;
1961
1962                 case SSL_TLSEXT_ERR_ALERT_WARNING:
1963                         ssl3_send_alert(s,SSL3_AL_WARNING,al);
1964                         return 1;
1965
1966                 case SSL_TLSEXT_ERR_NOACK:
1967                         s->servername_done=0;
1968                         default:
1969                 return 1;
1970                 }
1971         }
1972
1973 /* Since the server cache lookup is done early on in the processing of the
1974  * ClientHello, and other operations depend on the result, we need to handle
1975  * any TLS session ticket extension at the same time.
1976  *
1977  *   session_id: points at the session ID in the ClientHello. This code will
1978  *       read past the end of this in order to parse out the session ticket
1979  *       extension, if any.
1980  *   len: the length of the session ID.
1981  *   limit: a pointer to the first byte after the ClientHello.
1982  *   ret: (output) on return, if a ticket was decrypted, then this is set to
1983  *       point to the resulting session.
1984  *
1985  * If s->tls_session_secret_cb is set then we are expecting a pre-shared key
1986  * ciphersuite, in which case we have no use for session tickets and one will
1987  * never be decrypted, nor will s->tlsext_ticket_expected be set to 1.
1988  *
1989  * Returns:
1990  *   -1: fatal error, either from parsing or decrypting the ticket.
1991  *    0: no ticket was found (or was ignored, based on settings).
1992  *    1: a zero length extension was found, indicating that the client supports
1993  *       session tickets but doesn't currently have one to offer.
1994  *    2: either s->tls_session_secret_cb was set, or a ticket was offered but
1995  *       couldn't be decrypted because of a non-fatal error.
1996  *    3: a ticket was successfully decrypted and *ret was set.
1997  *
1998  * Side effects:
1999  *   Sets s->tlsext_ticket_expected to 1 if the server will have to issue
2000  *   a new session ticket to the client because the client indicated support
2001  *   (and s->tls_session_secret_cb is NULL) but the client either doesn't have
2002  *   a session ticket or we couldn't use the one it gave us, or if
2003  *   s->ctx->tlsext_ticket_key_cb asked to renew the client's ticket.
2004  *   Otherwise, s->tlsext_ticket_expected is set to 0.
2005  */
2006 int tls1_process_ticket(SSL *s, unsigned char *session_id, int len,
2007                         const unsigned char *limit, SSL_SESSION **ret)
2008         {
2009         /* Point after session ID in client hello */
2010         const unsigned char *p = session_id + len;
2011         unsigned short i;
2012
2013         *ret = NULL;
2014         s->tlsext_ticket_expected = 0;
2015
2016         /* If tickets disabled behave as if no ticket present
2017          * to permit stateful resumption.
2018          */
2019         if (SSL_get_options(s) & SSL_OP_NO_TICKET)
2020                 return 0;
2021         if ((s->version <= SSL3_VERSION) || !limit)
2022                 return 0;
2023         if (p >= limit)
2024                 return -1;
2025         /* Skip past DTLS cookie */
2026         if (s->version == DTLS1_VERSION || s->version == DTLS1_BAD_VER)
2027                 {
2028                 i = *(p++);
2029                 p+= i;
2030                 if (p >= limit)
2031                         return -1;
2032                 }
2033         /* Skip past cipher list */
2034         n2s(p, i);
2035         p+= i;
2036         if (p >= limit)
2037                 return -1;
2038         /* Skip past compression algorithm list */
2039         i = *(p++);
2040         p += i;
2041         if (p > limit)
2042                 return -1;
2043         /* Now at start of extensions */
2044         if ((p + 2) >= limit)
2045                 return 0;
2046         n2s(p, i);
2047         while ((p + 4) <= limit)
2048                 {
2049                 unsigned short type, size;
2050                 n2s(p, type);
2051                 n2s(p, size);
2052                 if (p + size > limit)
2053                         return 0;
2054                 if (type == TLSEXT_TYPE_session_ticket)
2055                         {
2056                         int r;
2057                         if (size == 0)
2058                                 {
2059                                 /* The client will accept a ticket but doesn't
2060                                  * currently have one. */
2061                                 s->tlsext_ticket_expected = 1;
2062                                 return 1;
2063                                 }
2064                         if (s->tls_session_secret_cb)
2065                                 {
2066                                 /* Indicate that the ticket couldn't be
2067                                  * decrypted rather than generating the session
2068                                  * from ticket now, trigger abbreviated
2069                                  * handshake based on external mechanism to
2070                                  * calculate the master secret later. */
2071                                 return 2;
2072                                 }
2073                         r = tls_decrypt_ticket(s, p, size, session_id, len, ret);
2074                         switch (r)
2075                                 {
2076                                 case 2: /* ticket couldn't be decrypted */
2077                                         s->tlsext_ticket_expected = 1;
2078                                         return 2;
2079                                 case 3: /* ticket was decrypted */
2080                                         return r;
2081                                 case 4: /* ticket decrypted but need to renew */
2082                                         s->tlsext_ticket_expected = 1;
2083                                         return 3;
2084                                 default: /* fatal error */
2085                                         return -1;
2086                                 }
2087                         }
2088                 p += size;
2089                 }
2090         return 0;
2091         }
2092
2093 /* tls_decrypt_ticket attempts to decrypt a session ticket.
2094  *
2095  *   etick: points to the body of the session ticket extension.
2096  *   eticklen: the length of the session tickets extenion.
2097  *   sess_id: points at the session ID.
2098  *   sesslen: the length of the session ID.
2099  *   psess: (output) on return, if a ticket was decrypted, then this is set to
2100  *       point to the resulting session.
2101  *
2102  * Returns:
2103  *   -1: fatal error, either from parsing or decrypting the ticket.
2104  *    2: the ticket couldn't be decrypted.
2105  *    3: a ticket was successfully decrypted and *psess was set.
2106  *    4: same as 3, but the ticket needs to be renewed.
2107  */
2108 static int tls_decrypt_ticket(SSL *s, const unsigned char *etick, int eticklen,
2109                                 const unsigned char *sess_id, int sesslen,
2110                                 SSL_SESSION **psess)
2111         {
2112         SSL_SESSION *sess;
2113         unsigned char *sdec;
2114         const unsigned char *p;
2115         int slen, mlen, renew_ticket = 0;
2116         unsigned char tick_hmac[EVP_MAX_MD_SIZE];
2117         HMAC_CTX hctx;
2118         EVP_CIPHER_CTX ctx;
2119         SSL_CTX *tctx = s->initial_ctx;
2120         /* Need at least keyname + iv + some encrypted data */
2121         if (eticklen < 48)
2122                 return 2;
2123         /* Initialize session ticket encryption and HMAC contexts */
2124         HMAC_CTX_init(&hctx);
2125         EVP_CIPHER_CTX_init(&ctx);
2126         if (tctx->tlsext_ticket_key_cb)
2127                 {
2128                 unsigned char *nctick = (unsigned char *)etick;
2129                 int rv = tctx->tlsext_ticket_key_cb(s, nctick, nctick + 16,
2130                                                         &ctx, &hctx, 0);
2131                 if (rv < 0)
2132                         return -1;
2133                 if (rv == 0)
2134                         return 2;
2135                 if (rv == 2)
2136                         renew_ticket = 1;
2137                 }
2138         else
2139                 {
2140                 /* Check key name matches */
2141                 if (memcmp(etick, tctx->tlsext_tick_key_name, 16))
2142                         return 2;
2143                 HMAC_Init_ex(&hctx, tctx->tlsext_tick_hmac_key, 16,
2144                                         tlsext_tick_md(), NULL);
2145                 EVP_DecryptInit_ex(&ctx, EVP_aes_128_cbc(), NULL,
2146                                 tctx->tlsext_tick_aes_key, etick + 16);
2147                 }
2148         /* Attempt to process session ticket, first conduct sanity and
2149          * integrity checks on ticket.
2150          */
2151         mlen = HMAC_size(&hctx);
2152         if (mlen < 0)
2153                 {
2154                 EVP_CIPHER_CTX_cleanup(&ctx);
2155                 return -1;
2156                 }
2157         eticklen -= mlen;
2158         /* Check HMAC of encrypted ticket */
2159         HMAC_Update(&hctx, etick, eticklen);
2160         HMAC_Final(&hctx, tick_hmac, NULL);
2161         HMAC_CTX_cleanup(&hctx);
2162         if (memcmp(tick_hmac, etick + eticklen, mlen))
2163                 return 2;
2164         /* Attempt to decrypt session data */
2165         /* Move p after IV to start of encrypted ticket, update length */
2166         p = etick + 16 + EVP_CIPHER_CTX_iv_length(&ctx);
2167         eticklen -= 16 + EVP_CIPHER_CTX_iv_length(&ctx);
2168         sdec = OPENSSL_malloc(eticklen);
2169         if (!sdec)
2170                 {
2171                 EVP_CIPHER_CTX_cleanup(&ctx);
2172                 return -1;
2173                 }
2174         EVP_DecryptUpdate(&ctx, sdec, &slen, p, eticklen);
2175         if (EVP_DecryptFinal(&ctx, sdec + slen, &mlen) <= 0)
2176                 return 2;
2177         slen += mlen;
2178         EVP_CIPHER_CTX_cleanup(&ctx);
2179         p = sdec;
2180
2181         sess = d2i_SSL_SESSION(NULL, &p, slen);
2182         OPENSSL_free(sdec);
2183         if (sess)
2184                 {
2185                 /* The session ID, if non-empty, is used by some clients to
2186                  * detect that the ticket has been accepted. So we copy it to
2187                  * the session structure. If it is empty set length to zero
2188                  * as required by standard.
2189                  */
2190                 if (sesslen)
2191                         memcpy(sess->session_id, sess_id, sesslen);
2192                 sess->session_id_length = sesslen;
2193                 *psess = sess;
2194                 if (renew_ticket)
2195                         return 4;
2196                 else
2197                         return 3;
2198                 }
2199         ERR_clear_error();
2200         /* For session parse failure, indicate that we need to send a new
2201          * ticket. */
2202         return 2;
2203         }
2204
2205 /* Tables to translate from NIDs to TLS v1.2 ids */
2206
2207 typedef struct
2208         {
2209         int nid;
2210         int id;
2211         } tls12_lookup;
2212
2213 static tls12_lookup tls12_md[] = {
2214 #ifndef OPENSSL_NO_MD5
2215         {NID_md5, TLSEXT_hash_md5},
2216 #endif
2217 #ifndef OPENSSL_NO_SHA
2218         {NID_sha1, TLSEXT_hash_sha1},
2219 #endif
2220 #ifndef OPENSSL_NO_SHA256
2221         {NID_sha224, TLSEXT_hash_sha224},
2222         {NID_sha256, TLSEXT_hash_sha256},
2223 #endif
2224 #ifndef OPENSSL_NO_SHA512
2225         {NID_sha384, TLSEXT_hash_sha384},
2226         {NID_sha512, TLSEXT_hash_sha512}
2227 #endif
2228 };
2229
2230 static tls12_lookup tls12_sig[] = {
2231 #ifndef OPENSSL_NO_RSA
2232         {EVP_PKEY_RSA, TLSEXT_signature_rsa},
2233 #endif
2234 #ifndef OPENSSL_NO_RSA
2235         {EVP_PKEY_DSA, TLSEXT_signature_dsa},
2236 #endif
2237 #ifndef OPENSSL_NO_ECDSA
2238         {EVP_PKEY_EC, TLSEXT_signature_ecdsa}
2239 #endif
2240 };
2241
2242 static int tls12_find_id(int nid, tls12_lookup *table, size_t tlen)
2243         {
2244         size_t i;
2245         for (i = 0; i < tlen; i++)
2246                 {
2247                 if (table[i].nid == nid)
2248                         return table[i].id;
2249                 }
2250         return -1;
2251         }
2252 #if 0
2253 static int tls12_find_nid(int id, tls12_lookup *table, size_t tlen)
2254         {
2255         size_t i;
2256         for (i = 0; i < tlen; i++)
2257                 {
2258                 if (table[i].id == id)
2259                         return table[i].nid;
2260                 }
2261         return -1;
2262         }
2263 #endif
2264
2265 int tls12_get_sigandhash(unsigned char *p, const EVP_PKEY *pk, const EVP_MD *md)
2266         {
2267         int sig_id, md_id;
2268         md_id = tls12_find_id(EVP_MD_type(md), tls12_md,
2269                                 sizeof(tls12_md)/sizeof(tls12_lookup));
2270         if (md_id == -1)
2271                 return 0;
2272         sig_id = tls12_get_sigid(pk);
2273         if (sig_id == -1)
2274                 return 0;
2275         p[0] = (unsigned char)md_id;
2276         p[1] = (unsigned char)sig_id;
2277         return 1;
2278         }
2279
2280 int tls12_get_sigid(const EVP_PKEY *pk)
2281         {
2282         return tls12_find_id(pk->type, tls12_sig,
2283                                 sizeof(tls12_sig)/sizeof(tls12_lookup));
2284         }
2285
2286 const EVP_MD *tls12_get_hash(unsigned char hash_alg)
2287         {
2288         switch(hash_alg)
2289                 {
2290 #ifndef OPENSSL_NO_MD5
2291                 case TLSEXT_hash_md5:
2292 #ifdef OPENSSL_FIPS
2293                 if (FIPS_mode())
2294                         return NULL;
2295 #endif
2296                 return EVP_md5();
2297 #endif
2298 #ifndef OPENSSL_NO_SHA
2299                 case TLSEXT_hash_sha1:
2300                 return EVP_sha1();
2301 #endif
2302 #ifndef OPENSSL_NO_SHA256
2303                 case TLSEXT_hash_sha224:
2304                 return EVP_sha224();
2305
2306                 case TLSEXT_hash_sha256:
2307                 return EVP_sha256();
2308 #endif
2309 #ifndef OPENSSL_NO_SHA512
2310                 case TLSEXT_hash_sha384:
2311                 return EVP_sha384();
2312
2313                 case TLSEXT_hash_sha512:
2314                 return EVP_sha512();
2315 #endif
2316                 default:
2317                 return NULL;
2318
2319                 }
2320         }
2321
2322 /* Set preferred digest for each key type */
2323
2324 int tls1_process_sigalgs(SSL *s, const unsigned char *data, int dsize)
2325         {
2326         int i, idx;
2327         const EVP_MD *md;
2328         CERT *c = s->cert;
2329         /* Extension ignored for TLS versions below 1.2 */
2330         if (TLS1_get_version(s) < TLS1_2_VERSION)
2331                 return 1;
2332         /* Should never happen */
2333         if (!c)
2334                 return 0;
2335
2336         c->pkeys[SSL_PKEY_DSA_SIGN].digest = NULL;
2337         c->pkeys[SSL_PKEY_RSA_SIGN].digest = NULL;
2338         c->pkeys[SSL_PKEY_RSA_ENC].digest = NULL;
2339         c->pkeys[SSL_PKEY_ECC].digest = NULL;
2340
2341         for (i = 0; i < dsize; i += 2)
2342                 {
2343                 unsigned char hash_alg = data[i], sig_alg = data[i+1];
2344
2345                 switch(sig_alg)
2346                         {
2347 #ifndef OPENSSL_NO_RSA
2348                         case TLSEXT_signature_rsa:
2349                         idx = SSL_PKEY_RSA_SIGN;
2350                         break;
2351 #endif
2352 #ifndef OPENSSL_NO_DSA
2353                         case TLSEXT_signature_dsa:
2354                         idx = SSL_PKEY_DSA_SIGN;
2355                         break;
2356 #endif
2357 #ifndef OPENSSL_NO_ECDSA
2358                         case TLSEXT_signature_ecdsa:
2359                         idx = SSL_PKEY_ECC;
2360                         break;
2361 #endif
2362                         default:
2363                         continue;
2364                         }
2365
2366                 if (c->pkeys[idx].digest == NULL)
2367                         {
2368                         md = tls12_get_hash(hash_alg);
2369                         if (md)
2370                                 {
2371                                 c->pkeys[idx].digest = md;
2372                                 if (idx == SSL_PKEY_RSA_SIGN)
2373                                         c->pkeys[SSL_PKEY_RSA_ENC].digest = md;
2374                                 }
2375                         }
2376
2377                 }
2378
2379
2380         /* Set any remaining keys to default values. NOTE: if alg is not
2381          * supported it stays as NULL.
2382          */
2383 #ifndef OPENSSL_NO_DSA
2384         if (!c->pkeys[SSL_PKEY_DSA_SIGN].digest)
2385                 c->pkeys[SSL_PKEY_DSA_SIGN].digest = EVP_dss1();
2386 #endif
2387 #ifndef OPENSSL_NO_RSA
2388         if (!c->pkeys[SSL_PKEY_RSA_SIGN].digest)
2389                 {
2390                 c->pkeys[SSL_PKEY_RSA_SIGN].digest = EVP_sha1();
2391                 c->pkeys[SSL_PKEY_RSA_ENC].digest = EVP_sha1();
2392                 }
2393 #endif
2394 #ifndef OPENSSL_NO_ECDSA
2395         if (!c->pkeys[SSL_PKEY_ECC].digest)
2396                 c->pkeys[SSL_PKEY_ECC].digest = EVP_ecdsa();
2397 #endif
2398         return 1;
2399         }
2400
2401 #endif
2402
2403 #ifndef OPENSSL_NO_HEARTBEATS
2404 int
2405 tls1_process_heartbeat(SSL *s)
2406         {
2407         unsigned char *p = &s->s3->rrec.data[0], *pl;
2408         unsigned short hbtype;
2409         unsigned int payload;
2410         unsigned int padding = 16; /* Use minimum padding */
2411
2412         /* Read type and payload length first */
2413         hbtype = *p++;
2414         n2s(p, payload);
2415         pl = p;
2416
2417         if (s->msg_callback)
2418                 s->msg_callback(0, s->version, TLS1_RT_HEARTBEAT,
2419                         &s->s3->rrec.data[0], s->s3->rrec.length,
2420                         s, s->msg_callback_arg);
2421
2422         if (hbtype == TLS1_HB_REQUEST)
2423                 {
2424                 unsigned char *buffer, *bp;
2425                 int r;
2426
2427                 /* Allocate memory for the response, size is 1 bytes
2428                  * message type, plus 2 bytes payload length, plus
2429                  * payload, plus padding
2430                  */
2431                 buffer = OPENSSL_malloc(1 + 2 + payload + padding);
2432                 bp = buffer;
2433
2434                 /* Enter response type, length and copy payload */
2435                 *bp++ = TLS1_HB_RESPONSE;
2436                 s2n(payload, bp);
2437                 memcpy(bp, pl, payload);
2438
2439                 r = ssl3_write_bytes(s, TLS1_RT_HEARTBEAT, buffer, 3 + payload + padding);
2440
2441                 if (r >= 0 && s->msg_callback)
2442                         s->msg_callback(1, s->version, TLS1_RT_HEARTBEAT,
2443                                 buffer, 3 + payload + padding,
2444                                 s, s->msg_callback_arg);
2445
2446                 OPENSSL_free(buffer);
2447
2448                 if (r < 0)
2449                         return r;
2450                 }
2451         else if (hbtype == TLS1_HB_RESPONSE)
2452                 {
2453                 unsigned int seq;
2454
2455                 /* We only send sequence numbers (2 bytes unsigned int),
2456                  * and 16 random bytes, so we just try to read the
2457                  * sequence number */
2458                 n2s(pl, seq);
2459
2460                 if (payload == 18 && seq == s->tlsext_hb_seq)
2461                         {
2462                         s->tlsext_hb_seq++;
2463                         s->tlsext_hb_pending = 0;
2464                         }
2465                 }
2466
2467         return 0;
2468         }
2469
2470 int
2471 tls1_heartbeat(SSL *s)
2472         {
2473         unsigned char *buf, *p;
2474         int ret;
2475         unsigned int payload = 18; /* Sequence number + random bytes */
2476         unsigned int padding = 16; /* Use minimum padding */
2477
2478         /* Only send if peer supports and accepts HB requests... */
2479         if (!(s->tlsext_heartbeat & SSL_TLSEXT_HB_ENABLED) ||
2480             s->tlsext_heartbeat & SSL_TLSEXT_HB_DONT_SEND_REQUESTS)
2481                 {
2482                 SSLerr(SSL_F_TLS1_HEARTBEAT,SSL_R_TLS_HEARTBEAT_PEER_DOESNT_ACCEPT);
2483                 return -1;
2484                 }
2485
2486         /* ...and there is none in flight yet... */
2487         if (s->tlsext_hb_pending)
2488                 {
2489                 SSLerr(SSL_F_TLS1_HEARTBEAT,SSL_R_TLS_HEARTBEAT_PENDING);
2490                 return -1;
2491                 }
2492
2493         /* ...and no handshake in progress. */
2494         if (SSL_in_init(s) || s->in_handshake)
2495                 {
2496                 SSLerr(SSL_F_TLS1_HEARTBEAT,SSL_R_UNEXPECTED_MESSAGE);
2497                 return -1;
2498                 }
2499
2500         /* Check if padding is too long, payload and padding
2501          * must not exceed 2^14 - 3 = 16381 bytes in total.
2502          */
2503         OPENSSL_assert(payload + padding <= 16381);
2504
2505         /* Create HeartBeat message, we just use a sequence number
2506          * as payload to distuingish different messages and add
2507          * some random stuff.
2508          *  - Message Type, 1 byte
2509          *  - Payload Length, 2 bytes (unsigned int)
2510          *  - Payload, the sequence number (2 bytes uint)
2511          *  - Payload, random bytes (16 bytes uint)
2512          *  - Padding
2513          */
2514         buf = OPENSSL_malloc(1 + 2 + payload + padding);
2515         p = buf;
2516         /* Message Type */
2517         *p++ = TLS1_HB_REQUEST;
2518         /* Payload length (18 bytes here) */
2519         s2n(payload, p);
2520         /* Sequence number */
2521         s2n(s->tlsext_hb_seq, p);
2522         /* 16 random bytes */
2523         RAND_pseudo_bytes(p, 16);
2524         p += 16;
2525         /* Random padding */
2526         RAND_pseudo_bytes(p, padding);
2527
2528         ret = ssl3_write_bytes(s, TLS1_RT_HEARTBEAT, buf, 3 + payload + padding);
2529         if (ret >= 0)
2530                 {
2531                 if (s->msg_callback)
2532                         s->msg_callback(1, s->version, TLS1_RT_HEARTBEAT,
2533                                 buf, 3 + payload + padding,
2534                                 s, s->msg_callback_arg);
2535
2536                 s->tlsext_hb_pending = 1;
2537                 }
2538
2539         OPENSSL_free(buf);
2540
2541         return ret;
2542         }
2543 #endif