ssl/t1_lib.c

   1 /* ssl/t1_lib.c */
   2 /* Copyright (C) 1995-1998 Eric Young (eay@cryptsoft.com)
   3  * All rights reserved.
   4  *
   5  * This package is an SSL implementation written
   6  * by Eric Young (eay@cryptsoft.com).
   7  * The implementation was written so as to conform with Netscapes SSL.
   8  *
   9  * This library is free for commercial and non-commercial use as long as
  10  * the following conditions are aheared to.  The following conditions
  11  * apply to all code found in this distribution, be it the RC4, RSA,
  12  * lhash, DES, etc., code; not just the SSL code.  The SSL documentation
  13  * included with this distribution is covered by the same copyright terms
  14  * except that the holder is Tim Hudson (tjh@cryptsoft.com).
  15  *
  16  * Copyright remains Eric Young's, and as such any Copyright notices in
  17  * the code are not to be removed.
  18  * If this package is used in a product, Eric Young should be given attribution
  19  * as the author of the parts of the library used.
  20  * This can be in the form of a textual message at program startup or
  21  * in documentation (online or textual) provided with the package.
  22  *
  23  * Redistribution and use in source and binary forms, with or without
  24  * modification, are permitted provided that the following conditions
  25  * are met:
  26  * 1. Redistributions of source code must retain the copyright
  27  *    notice, this list of conditions and the following disclaimer.
  28  * 2. Redistributions in binary form must reproduce the above copyright
  29  *    notice, this list of conditions and the following disclaimer in the
  30  *    documentation and/or other materials provided with the distribution.
  31  * 3. All advertising materials mentioning features or use of this software
  32  *    must display the following acknowledgement:
  33  *    "This product includes cryptographic software written by
  34  *     Eric Young (eay@cryptsoft.com)"
  35  *    The word 'cryptographic' can be left out if the rouines from the library
  36  *    being used are not cryptographic related :-).
  37  * 4. If you include any Windows specific code (or a derivative thereof) from
  38  *    the apps directory (application code) you must include an acknowledgement:
  39  *    "This product includes software written by Tim Hudson (tjh@cryptsoft.com)"
  40  *
  41  * THIS SOFTWARE IS PROVIDED BY ERIC YOUNG ``AS IS'' AND
  42  * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
  43  * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
  44  * ARE DISCLAIMED.  IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE
  45  * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
  46  * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
  47  * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
  48  * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
  49  * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
  50  * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
  51  * SUCH DAMAGE.
  52  *
  53  * The licence and distribution terms for any publically available version or
  54  * derivative of this code cannot be changed.  i.e. this code cannot simply be
  55  * copied and put under another distribution licence
  56  * [including the GNU Public Licence.]
  57  */
  58 /* ====================================================================
  59  * Copyright (c) 1998-2007 The OpenSSL Project.  All rights reserved.
  60  *
  61  * Redistribution and use in source and binary forms, with or without
  62  * modification, are permitted provided that the following conditions
  63  * are met:
  64  *
  65  * 1. Redistributions of source code must retain the above copyright
  66  *    notice, this list of conditions and the following disclaimer.
  67  *
  68  * 2. Redistributions in binary form must reproduce the above copyright
  69  *    notice, this list of conditions and the following disclaimer in
  70  *    the documentation and/or other materials provided with the
  71  *    distribution.
  72  *
  73  * 3. All advertising materials mentioning features or use of this
  74  *    software must display the following acknowledgment:
  75  *    "This product includes software developed by the OpenSSL Project
  76  *    for use in the OpenSSL Toolkit. (http://www.openssl.org/)"
  77  *
  78  * 4. The names "OpenSSL Toolkit" and "OpenSSL Project" must not be used to
  79  *    endorse or promote products derived from this software without
  80  *    prior written permission. For written permission, please contact
  81  *    openssl-core@openssl.org.
  82  *
  83  * 5. Products derived from this software may not be called "OpenSSL"
  84  *    nor may "OpenSSL" appear in their names without prior written
  85  *    permission of the OpenSSL Project.
  86  *
  87  * 6. Redistributions of any form whatsoever must retain the following
  88  *    acknowledgment:
  89  *    "This product includes software developed by the OpenSSL Project
  90  *    for use in the OpenSSL Toolkit (http://www.openssl.org/)"
  91  *
  92  * THIS SOFTWARE IS PROVIDED BY THE OpenSSL PROJECT ``AS IS'' AND ANY
  93  * EXPRESSED OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
  94  * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
  95  * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL THE OpenSSL PROJECT OR
  96  * ITS CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
  97  * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
  98  * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
  99  * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
 100  * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT,
 101  * STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
 102  * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED
 103  * OF THE POSSIBILITY OF SUCH DAMAGE.
 104  * ====================================================================
 105  *
 106  * This product includes cryptographic software written by Eric Young
 107  * (eay@cryptsoft.com).  This product includes software written by Tim
 108  * Hudson (tjh@cryptsoft.com).
 109  *
 110  */
 111
 112 #include <stdio.h>
 113 #include <openssl/objects.h>
 114 #include <openssl/evp.h>
 115 #include <openssl/hmac.h>
 116 #include <openssl/ocsp.h>
 117 #include <openssl/rand.h>
 118 #include "ssl_locl.h"
 119
 120 const char tls1_version_str[]="TLSv1" OPENSSL_VERSION_PTEXT;
 121
 122 #ifndef OPENSSL_NO_TLSEXT
 123 static int tls_decrypt_ticket(SSL *s, const unsigned char *tick, int ticklen,
 124                                 const unsigned char *sess_id, int sesslen,
 125                                 SSL_SESSION **psess);
 126 #endif
 127
 128 SSL3_ENC_METHOD TLSv1_enc_data={
 129         tls1_enc,
 130         tls1_mac,
 131         tls1_setup_key_block,
 132         tls1_generate_master_secret,
 133         tls1_change_cipher_state,
 134         tls1_final_finish_mac,
 135         TLS1_FINISH_MAC_LENGTH,
 136         tls1_cert_verify_mac,
 137         TLS_MD_CLIENT_FINISH_CONST,TLS_MD_CLIENT_FINISH_CONST_SIZE,
 138         TLS_MD_SERVER_FINISH_CONST,TLS_MD_SERVER_FINISH_CONST_SIZE,
 139         tls1_alert_code,
 140         tls1_export_keying_material,
 141         };
 142
 143 long tls1_default_timeout(void)
 144         {
 145         /* 2 hours, the 24 hours mentioned in the TLSv1 spec
 146          * is way too long for http, the cache would over fill */
 147         return(60*60*2);
 148         }
 149
 150 int tls1_new(SSL *s)
 151         {
 152         if (!ssl3_new(s)) return(0);
 153         s->method->ssl_clear(s);
 154         return(1);
 155         }
 156
 157 void tls1_free(SSL *s)
 158         {
 159 #ifndef OPENSSL_NO_TLSEXT
 160         if (s->tlsext_session_ticket)
 161                 {
 162                 OPENSSL_free(s->tlsext_session_ticket);
 163                 }
 164 #endif /* OPENSSL_NO_TLSEXT */
 165         ssl3_free(s);
 166         }
 167
 168 void tls1_clear(SSL *s)
 169         {
 170         ssl3_clear(s);
 171         s->version = s->method->version;
 172         }
 173
 174 #ifndef OPENSSL_NO_EC
 175
 176 static int nid_list[] =
 177         {
 178                 NID_sect163k1, /* sect163k1 (1) */
 179                 NID_sect163r1, /* sect163r1 (2) */
 180                 NID_sect163r2, /* sect163r2 (3) */
 181                 NID_sect193r1, /* sect193r1 (4) */
 182                 NID_sect193r2, /* sect193r2 (5) */
 183                 NID_sect233k1, /* sect233k1 (6) */
 184                 NID_sect233r1, /* sect233r1 (7) */
 185                 NID_sect239k1, /* sect239k1 (8) */
 186                 NID_sect283k1, /* sect283k1 (9) */
 187                 NID_sect283r1, /* sect283r1 (10) */
 188                 NID_sect409k1, /* sect409k1 (11) */
 189                 NID_sect409r1, /* sect409r1 (12) */
 190                 NID_sect571k1, /* sect571k1 (13) */
 191                 NID_sect571r1, /* sect571r1 (14) */
 192                 NID_secp160k1, /* secp160k1 (15) */
 193                 NID_secp160r1, /* secp160r1 (16) */
 194                 NID_secp160r2, /* secp160r2 (17) */
 195                 NID_secp192k1, /* secp192k1 (18) */
 196                 NID_X9_62_prime192v1, /* secp192r1 (19) */
 197                 NID_secp224k1, /* secp224k1 (20) */
 198                 NID_secp224r1, /* secp224r1 (21) */
 199                 NID_secp256k1, /* secp256k1 (22) */
 200                 NID_X9_62_prime256v1, /* secp256r1 (23) */
 201                 NID_secp384r1, /* secp384r1 (24) */
 202                 NID_secp521r1  /* secp521r1 (25) */
 203         };
 204
 205 static int pref_list[] =
 206         {
 207                 NID_sect571r1, /* sect571r1 (14) */
 208                 NID_sect571k1, /* sect571k1 (13) */
 209                 NID_secp521r1, /* secp521r1 (25) */
 210                 NID_sect409k1, /* sect409k1 (11) */
 211                 NID_sect409r1, /* sect409r1 (12) */
 212                 NID_secp384r1, /* secp384r1 (24) */
 213                 NID_sect283k1, /* sect283k1 (9) */
 214                 NID_sect283r1, /* sect283r1 (10) */
 215                 NID_secp256k1, /* secp256k1 (22) */
 216                 NID_X9_62_prime256v1, /* secp256r1 (23) */
 217                 NID_sect239k1, /* sect239k1 (8) */
 218                 NID_sect233k1, /* sect233k1 (6) */
 219                 NID_sect233r1, /* sect233r1 (7) */
 220                 NID_secp224k1, /* secp224k1 (20) */
 221                 NID_secp224r1, /* secp224r1 (21) */
 222                 NID_sect193r1, /* sect193r1 (4) */
 223                 NID_sect193r2, /* sect193r2 (5) */
 224                 NID_secp192k1, /* secp192k1 (18) */
 225                 NID_X9_62_prime192v1, /* secp192r1 (19) */
 226                 NID_sect163k1, /* sect163k1 (1) */
 227                 NID_sect163r1, /* sect163r1 (2) */
 228                 NID_sect163r2, /* sect163r2 (3) */
 229                 NID_secp160k1, /* secp160k1 (15) */
 230                 NID_secp160r1, /* secp160r1 (16) */
 231                 NID_secp160r2, /* secp160r2 (17) */
 232         };
 233
 234 int tls1_ec_curve_id2nid(int curve_id)
 235         {
 236         /* ECC curves from draft-ietf-tls-ecc-12.txt (Oct. 17, 2005) */
 237         if ((curve_id < 1) || ((unsigned int)curve_id >
 238                                 sizeof(nid_list)/sizeof(nid_list[0])))
 239                 return 0;
 240         return nid_list[curve_id-1];
 241         }
 242
 243 int tls1_ec_nid2curve_id(int nid)
 244         {
 245         /* ECC curves from draft-ietf-tls-ecc-12.txt (Oct. 17, 2005) */
 246         switch (nid)
 247                 {
 248         case NID_sect163k1: /* sect163k1 (1) */
 249                 return 1;
 250         case NID_sect163r1: /* sect163r1 (2) */
 251                 return 2;
 252         case NID_sect163r2: /* sect163r2 (3) */
 253                 return 3;
 254         case NID_sect193r1: /* sect193r1 (4) */
 255                 return 4;
 256         case NID_sect193r2: /* sect193r2 (5) */
 257                 return 5;
 258         case NID_sect233k1: /* sect233k1 (6) */
 259                 return 6;
 260         case NID_sect233r1: /* sect233r1 (7) */
 261                 return 7;
 262         case NID_sect239k1: /* sect239k1 (8) */
 263                 return 8;
 264         case NID_sect283k1: /* sect283k1 (9) */
 265                 return 9;
 266         case NID_sect283r1: /* sect283r1 (10) */
 267                 return 10;
 268         case NID_sect409k1: /* sect409k1 (11) */
 269                 return 11;
 270         case NID_sect409r1: /* sect409r1 (12) */
 271                 return 12;
 272         case NID_sect571k1: /* sect571k1 (13) */
 273                 return 13;
 274         case NID_sect571r1: /* sect571r1 (14) */
 275                 return 14;
 276         case NID_secp160k1: /* secp160k1 (15) */
 277                 return 15;
 278         case NID_secp160r1: /* secp160r1 (16) */
 279                 return 16;
 280         case NID_secp160r2: /* secp160r2 (17) */
 281                 return 17;
 282         case NID_secp192k1: /* secp192k1 (18) */
 283                 return 18;
 284         case NID_X9_62_prime192v1: /* secp192r1 (19) */
 285                 return 19;
 286         case NID_secp224k1: /* secp224k1 (20) */
 287                 return 20;
 288         case NID_secp224r1: /* secp224r1 (21) */
 289                 return 21;
 290         case NID_secp256k1: /* secp256k1 (22) */
 291                 return 22;
 292         case NID_X9_62_prime256v1: /* secp256r1 (23) */
 293                 return 23;
 294         case NID_secp384r1: /* secp384r1 (24) */
 295                 return 24;
 296         case NID_secp521r1:  /* secp521r1 (25) */
 297                 return 25;
 298         default:
 299                 return 0;
 300                 }
 301         }
 302 #endif /* OPENSSL_NO_EC */
 303
 304 #ifndef OPENSSL_NO_TLSEXT
 305
 306 /* List of supported signature algorithms and hashes. Should make this
 307  * customisable at some point, for now include everything we support.
 308  */
 309
 310 #ifdef OPENSSL_NO_RSA
 311 #define tlsext_sigalg_rsa(md) /* */
 312 #else
 313 #define tlsext_sigalg_rsa(md) md, TLSEXT_signature_rsa,
 314 #endif
 315
 316 #ifdef OPENSSL_NO_DSA
 317 #define tlsext_sigalg_dsa(md) /* */
 318 #else
 319 #define tlsext_sigalg_dsa(md) md, TLSEXT_signature_dsa,
 320 #endif
 321
 322 #ifdef OPENSSL_NO_ECDSA
 323 #define tlsext_sigalg_ecdsa(md) /* */
 324 #else
 325 #define tlsext_sigalg_ecdsa(md) md, TLSEXT_signature_ecdsa,
 326 #endif
 327
 328 #define tlsext_sigalg(md) \
 329                 tlsext_sigalg_rsa(md) \
 330                 tlsext_sigalg_dsa(md) \
 331                 tlsext_sigalg_ecdsa(md)
 332
 333 static unsigned char tls12_sigalgs[] = {
 334 #ifndef OPENSSL_NO_SHA512
 335         tlsext_sigalg(TLSEXT_hash_sha512)
 336         tlsext_sigalg(TLSEXT_hash_sha384)
 337 #endif
 338 #ifndef OPENSSL_NO_SHA256
 339         tlsext_sigalg(TLSEXT_hash_sha256)
 340         tlsext_sigalg(TLSEXT_hash_sha224)
 341 #endif
 342 #ifndef OPENSSL_NO_SHA
 343         tlsext_sigalg(TLSEXT_hash_sha1)
 344 #endif
 345 #ifndef OPENSSL_NO_MD5
 346         tlsext_sigalg_rsa(TLSEXT_hash_md5)
 347 #endif
 348 };
 349
 350 int tls12_get_req_sig_algs(SSL *s, unsigned char *p)
 351         {
 352         size_t slen = sizeof(tls12_sigalgs);
 353 #ifdef OPENSSL_FIPS
 354         /* If FIPS mode don't include MD5 which is last */
 355         if (FIPS_mode())
 356                 slen -= 2;
 357 #endif
 358         if (p)
 359                 memcpy(p, tls12_sigalgs, slen);
 360         return (int)slen;
 361         }
 362
 363 unsigned char *ssl_add_clienthello_tlsext(SSL *s, unsigned char *p, unsigned char *limit)
 364         {
 365         int extdatalen=0;
 366         unsigned char *ret = p;
 367
 368         /* don't add extensions for SSLv3 unless doing secure renegotiation */
 369         if (s->client_version == SSL3_VERSION
 370                                         && !s->s3->send_connection_binding)
 371                 return p;
 372
 373         ret+=2;
 374
 375         if (ret>=limit) return NULL; /* this really never occurs, but ... */
 376
 377         if (s->tlsext_hostname != NULL)
 378                 {
 379                 /* Add TLS extension servername to the Client Hello message */
 380                 unsigned long size_str;
 381                 long lenmax;
 382
 383                 /* check for enough space.
 384                    4 for the servername type and entension length
 385                    2 for servernamelist length
 386                    1 for the hostname type
 387                    2 for hostname length
 388                    + hostname length
 389                 */
 390
 391                 if ((lenmax = limit - ret - 9) < 0
 392                     || (size_str = strlen(s->tlsext_hostname)) > (unsigned long)lenmax)
 393                         return NULL;
 394
 395                 /* extension type and length */
 396                 s2n(TLSEXT_TYPE_server_name,ret);
 397                 s2n(size_str+5,ret);
 398
 399                 /* length of servername list */
 400                 s2n(size_str+3,ret);
 401
 402                 /* hostname type, length and hostname */
 403                 *(ret++) = (unsigned char) TLSEXT_NAMETYPE_host_name;
 404                 s2n(size_str,ret);
 405                 memcpy(ret, s->tlsext_hostname, size_str);
 406                 ret+=size_str;
 407                 }
 408
 409         /* Add RI if renegotiating */
 410         if (s->renegotiate)
 411           {
 412           int el;
 413
 414           if(!ssl_add_clienthello_renegotiate_ext(s, 0, &el, 0))
 415               {
 416               SSLerr(SSL_F_SSL_ADD_CLIENTHELLO_TLSEXT, ERR_R_INTERNAL_ERROR);
 417               return NULL;
 418               }
 419
 420           if((limit - p - 4 - el) < 0) return NULL;
 421
 422           s2n(TLSEXT_TYPE_renegotiate,ret);
 423           s2n(el,ret);
 424
 425           if(!ssl_add_clienthello_renegotiate_ext(s, ret, &el, el))
 426               {
 427               SSLerr(SSL_F_SSL_ADD_CLIENTHELLO_TLSEXT, ERR_R_INTERNAL_ERROR);
 428               return NULL;
 429               }
 430
 431           ret += el;
 432         }
 433
 434 #ifndef OPENSSL_NO_SRP
 435 #define MIN(x,y) (((x)<(y))?(x):(y))
 436         /* we add SRP username the first time only if we have one! */
 437         if (s->srp_ctx.login != NULL)
 438                 {/* Add TLS extension SRP username to the Client Hello message */
 439                 int login_len = MIN(strlen(s->srp_ctx.login) + 1, 255);
 440                 long lenmax;
 441
 442                 if ((lenmax = limit - ret - 5) < 0) return NULL;
 443                 if (login_len > lenmax) return NULL;
 444                 if (login_len > 255)
 445                         {
 446                         SSLerr(SSL_F_SSL_ADD_CLIENTHELLO_TLSEXT, ERR_R_INTERNAL_ERROR);
 447                         return NULL;
 448                         }
 449                 s2n(TLSEXT_TYPE_srp,ret);
 450                 s2n(login_len+1,ret);
 451
 452                 (*ret++) = (unsigned char) MIN(strlen(s->srp_ctx.login), 254);
 453                 memcpy(ret, s->srp_ctx.login, MIN(strlen(s->srp_ctx.login), 254));
 454                 ret+=login_len;
 455                 }
 456 #endif
 457
 458 #ifndef OPENSSL_NO_EC
 459         if (s->tlsext_ecpointformatlist != NULL &&
 460             s->version != DTLS1_VERSION)
 461                 {
 462                 /* Add TLS extension ECPointFormats to the ClientHello message */
 463                 long lenmax;
 464
 465                 if ((lenmax = limit - ret - 5) < 0) return NULL;
 466                 if (s->tlsext_ecpointformatlist_length > (unsigned long)lenmax) return NULL;
 467                 if (s->tlsext_ecpointformatlist_length > 255)
 468                         {
 469                         SSLerr(SSL_F_SSL_ADD_CLIENTHELLO_TLSEXT, ERR_R_INTERNAL_ERROR);
 470                         return NULL;
 471                         }
 472
 473                 s2n(TLSEXT_TYPE_ec_point_formats,ret);
 474                 s2n(s->tlsext_ecpointformatlist_length + 1,ret);
 475                 *(ret++) = (unsigned char) s->tlsext_ecpointformatlist_length;
 476                 memcpy(ret, s->tlsext_ecpointformatlist, s->tlsext_ecpointformatlist_length);
 477                 ret+=s->tlsext_ecpointformatlist_length;
 478                 }
 479         if (s->tlsext_ellipticcurvelist != NULL &&
 480             s->version != DTLS1_VERSION)
 481                 {
 482                 /* Add TLS extension EllipticCurves to the ClientHello message */
 483                 long lenmax;
 484
 485                 if ((lenmax = limit - ret - 6) < 0) return NULL;
 486                 if (s->tlsext_ellipticcurvelist_length > (unsigned long)lenmax) return NULL;
 487                 if (s->tlsext_ellipticcurvelist_length > 65532)
 488                         {
 489                         SSLerr(SSL_F_SSL_ADD_CLIENTHELLO_TLSEXT, ERR_R_INTERNAL_ERROR);
 490                         return NULL;
 491                         }
 492
 493                 s2n(TLSEXT_TYPE_elliptic_curves,ret);
 494                 s2n(s->tlsext_ellipticcurvelist_length + 2, ret);
 495
 496                 /* NB: draft-ietf-tls-ecc-12.txt uses a one-byte prefix for
 497                  * elliptic_curve_list, but the examples use two bytes.
 498                  * http://www1.ietf.org/mail-archive/web/tls/current/msg00538.html
 499                  * resolves this to two bytes.
 500                  */
 501                 s2n(s->tlsext_ellipticcurvelist_length, ret);
 502                 memcpy(ret, s->tlsext_ellipticcurvelist, s->tlsext_ellipticcurvelist_length);
 503                 ret+=s->tlsext_ellipticcurvelist_length;
 504                 }
 505 #endif /* OPENSSL_NO_EC */
 506
 507         if (!(SSL_get_options(s) & SSL_OP_NO_TICKET))
 508                 {
 509                 int ticklen;
 510                 if (!s->new_session && s->session && s->session->tlsext_tick)
 511                         ticklen = s->session->tlsext_ticklen;
 512                 else if (s->session && s->tlsext_session_ticket &&
 513                          s->tlsext_session_ticket->data)
 514                         {
 515                         ticklen = s->tlsext_session_ticket->length;
 516                         s->session->tlsext_tick = OPENSSL_malloc(ticklen);
 517                         if (!s->session->tlsext_tick)
 518                                 return NULL;
 519                         memcpy(s->session->tlsext_tick,
 520                                s->tlsext_session_ticket->data,
 521                                ticklen);
 522                         s->session->tlsext_ticklen = ticklen;
 523                         }
 524                 else
 525                         ticklen = 0;
 526                 if (ticklen == 0 && s->tlsext_session_ticket &&
 527                     s->tlsext_session_ticket->data == NULL)
 528                         goto skip_ext;
 529                 /* Check for enough room 2 for extension type, 2 for len
 530                  * rest for ticket
 531                  */
 532                 if ((long)(limit - ret - 4 - ticklen) < 0) return NULL;
 533                 s2n(TLSEXT_TYPE_session_ticket,ret);
 534                 s2n(ticklen,ret);
 535                 if (ticklen)
 536                         {
 537                         memcpy(ret, s->session->tlsext_tick, ticklen);
 538                         ret += ticklen;
 539                         }
 540                 }
 541                 skip_ext:
 542
 543         if (TLS1_get_version(s) >= TLS1_2_VERSION)
 544                 {
 545                 if ((size_t)(limit - ret) < sizeof(tls12_sigalgs) + 6)
 546                         return NULL;
 547                 s2n(TLSEXT_TYPE_signature_algorithms,ret);
 548                 s2n(sizeof(tls12_sigalgs) + 2, ret);
 549                 s2n(sizeof(tls12_sigalgs), ret);
 550                 memcpy(ret, tls12_sigalgs, sizeof(tls12_sigalgs));
 551                 ret += sizeof(tls12_sigalgs);
 552                 }
 553
 554 #ifdef TLSEXT_TYPE_opaque_prf_input
 555         if (s->s3->client_opaque_prf_input != NULL &&
 556             s->version != DTLS1_VERSION)
 557                 {
 558                 size_t col = s->s3->client_opaque_prf_input_len;
 559
 560                 if ((long)(limit - ret - 6 - col < 0))
 561                         return NULL;
 562                 if (col > 0xFFFD) /* can't happen */
 563                         return NULL;
 564
 565                 s2n(TLSEXT_TYPE_opaque_prf_input, ret);
 566                 s2n(col + 2, ret);
 567                 s2n(col, ret);
 568                 memcpy(ret, s->s3->client_opaque_prf_input, col);
 569                 ret += col;
 570                 }
 571 #endif
 572
 573         if (s->tlsext_status_type == TLSEXT_STATUSTYPE_ocsp &&
 574             s->version != DTLS1_VERSION)
 575                 {
 576                 int i;
 577                 long extlen, idlen, itmp;
 578                 OCSP_RESPID *id;
 579
 580                 idlen = 0;
 581                 for (i = 0; i < sk_OCSP_RESPID_num(s->tlsext_ocsp_ids); i++)
 582                         {
 583                         id = sk_OCSP_RESPID_value(s->tlsext_ocsp_ids, i);
 584                         itmp = i2d_OCSP_RESPID(id, NULL);
 585                         if (itmp <= 0)
 586                                 return NULL;
 587                         idlen += itmp + 2;
 588                         }
 589
 590                 if (s->tlsext_ocsp_exts)
 591                         {
 592                         extlen = i2d_X509_EXTENSIONS(s->tlsext_ocsp_exts, NULL);
 593                         if (extlen < 0)
 594                                 return NULL;
 595                         }
 596                 else
 597                         extlen = 0;
 598
 599                 if ((long)(limit - ret - 7 - extlen - idlen) < 0) return NULL;
 600                 s2n(TLSEXT_TYPE_status_request, ret);
 601                 if (extlen + idlen > 0xFFF0)
 602                         return NULL;
 603                 s2n(extlen + idlen + 5, ret);
 604                 *(ret++) = TLSEXT_STATUSTYPE_ocsp;
 605                 s2n(idlen, ret);
 606                 for (i = 0; i < sk_OCSP_RESPID_num(s->tlsext_ocsp_ids); i++)
 607                         {
 608                         /* save position of id len */
 609                         unsigned char *q = ret;
 610                         id = sk_OCSP_RESPID_value(s->tlsext_ocsp_ids, i);
 611                         /* skip over id len */
 612                         ret += 2;
 613                         itmp = i2d_OCSP_RESPID(id, &ret);
 614                         /* write id len */
 615                         s2n(itmp, q);
 616                         }
 617                 s2n(extlen, ret);
 618                 if (extlen > 0)
 619                         i2d_X509_EXTENSIONS(s->tlsext_ocsp_exts, &ret);
 620                 }
 621
 622 #ifndef OPENSSL_NO_HEARTBEATS
 623         /* Add Heartbeat extension */
 624         s2n(TLSEXT_TYPE_heartbeat,ret);
 625         s2n(1,ret);
 626         /* Set mode:
 627          * 1: peer may send requests
 628          * 2: peer not allowed to send requests
 629          */
 630         if (s->tlsext_heartbeat & SSL_TLSEXT_HB_DONT_RECV_REQUESTS)
 631                 *(ret++) = SSL_TLSEXT_HB_DONT_SEND_REQUESTS;
 632         else
 633                 *(ret++) = SSL_TLSEXT_HB_ENABLED;
 634 #endif
 635
 636 #ifndef OPENSSL_NO_NEXTPROTONEG
 637         if (s->ctx->next_proto_select_cb && !s->s3->tmp.finish_md_len)
 638                 {
 639                 /* The client advertises an emtpy extension to indicate its
 640                  * support for Next Protocol Negotiation */
 641                 if (limit - ret - 4 < 0)
 642                         return NULL;
 643                 s2n(TLSEXT_TYPE_next_proto_neg,ret);
 644                 s2n(0,ret);
 645                 }
 646 #endif
 647
 648         if(SSL_get_srtp_profiles(s))
 649                 {
 650                 int el;
 651
 652                 ssl_add_clienthello_use_srtp_ext(s, 0, &el, 0);
 653
 654                 if((limit - p - 4 - el) < 0) return NULL;
 655
 656                 s2n(TLSEXT_TYPE_use_srtp,ret);
 657                 s2n(el,ret);
 658
 659                 if(ssl_add_clienthello_use_srtp_ext(s, ret, &el, el))
 660                         {
 661                         SSLerr(SSL_F_SSL_ADD_CLIENTHELLO_TLSEXT, ERR_R_INTERNAL_ERROR);
 662                         return NULL;
 663                         }
 664                 ret += el;
 665                 }
 666
 667         if ((extdatalen = ret-p-2)== 0)
 668                 return p;
 669
 670         s2n(extdatalen,p);
 671         return ret;
 672         }
 673
 674 unsigned char *ssl_add_serverhello_tlsext(SSL *s, unsigned char *p, unsigned char *limit)
 675         {
 676         int extdatalen=0;
 677         unsigned char *ret = p;
 678 #ifndef OPENSSL_NO_NEXTPROTONEG
 679         int next_proto_neg_seen;
 680 #endif
 681
 682         /* don't add extensions for SSLv3, unless doing secure renegotiation */
 683         if (s->version == SSL3_VERSION && !s->s3->send_connection_binding)
 684                 return p;
 685
 686         ret+=2;
 687         if (ret>=limit) return NULL; /* this really never occurs, but ... */
 688
 689         if (!s->hit && s->servername_done == 1 && s->session->tlsext_hostname != NULL)
 690                 {
 691                 if ((long)(limit - ret - 4) < 0) return NULL;
 692
 693                 s2n(TLSEXT_TYPE_server_name,ret);
 694                 s2n(0,ret);
 695                 }
 696
 697         if(s->s3->send_connection_binding)
 698         {
 699           int el;
 700
 701           if(!ssl_add_serverhello_renegotiate_ext(s, 0, &el, 0))
 702               {
 703               SSLerr(SSL_F_SSL_ADD_SERVERHELLO_TLSEXT, ERR_R_INTERNAL_ERROR);
 704               return NULL;
 705               }
 706
 707           if((limit - p - 4 - el) < 0) return NULL;
 708
 709           s2n(TLSEXT_TYPE_renegotiate,ret);
 710           s2n(el,ret);
 711
 712           if(!ssl_add_serverhello_renegotiate_ext(s, ret, &el, el))
 713               {
 714               SSLerr(SSL_F_SSL_ADD_SERVERHELLO_TLSEXT, ERR_R_INTERNAL_ERROR);
 715               return NULL;
 716               }
 717
 718           ret += el;
 719         }
 720
 721 #ifndef OPENSSL_NO_EC
 722         if (s->tlsext_ecpointformatlist != NULL &&
 723             s->version != DTLS1_VERSION)
 724                 {
 725                 /* Add TLS extension ECPointFormats to the ServerHello message */
 726                 long lenmax;
 727
 728                 if ((lenmax = limit - ret - 5) < 0) return NULL;
 729                 if (s->tlsext_ecpointformatlist_length > (unsigned long)lenmax) return NULL;
 730                 if (s->tlsext_ecpointformatlist_length > 255)
 731                         {
 732                         SSLerr(SSL_F_SSL_ADD_SERVERHELLO_TLSEXT, ERR_R_INTERNAL_ERROR);
 733                         return NULL;
 734                         }
 735
 736                 s2n(TLSEXT_TYPE_ec_point_formats,ret);
 737                 s2n(s->tlsext_ecpointformatlist_length + 1,ret);
 738                 *(ret++) = (unsigned char) s->tlsext_ecpointformatlist_length;
 739                 memcpy(ret, s->tlsext_ecpointformatlist, s->tlsext_ecpointformatlist_length);
 740                 ret+=s->tlsext_ecpointformatlist_length;
 741
 742                 }
 743         /* Currently the server should not respond with a SupportedCurves extension */
 744 #endif /* OPENSSL_NO_EC */
 745
 746         if (s->tlsext_ticket_expected
 747                 && !(SSL_get_options(s) & SSL_OP_NO_TICKET))
 748                 {
 749                 if ((long)(limit - ret - 4) < 0) return NULL;
 750                 s2n(TLSEXT_TYPE_session_ticket,ret);
 751                 s2n(0,ret);
 752                 }
 753
 754         if (s->tlsext_status_expected)
 755                 {
 756                 if ((long)(limit - ret - 4) < 0) return NULL;
 757                 s2n(TLSEXT_TYPE_status_request,ret);
 758                 s2n(0,ret);
 759                 }
 760
 761 #ifdef TLSEXT_TYPE_opaque_prf_input
 762         if (s->s3->server_opaque_prf_input != NULL &&
 763             s->version != DTLS1_VERSION)
 764                 {
 765                 size_t sol = s->s3->server_opaque_prf_input_len;
 766
 767                 if ((long)(limit - ret - 6 - sol) < 0)
 768                         return NULL;
 769                 if (sol > 0xFFFD) /* can't happen */
 770                         return NULL;
 771
 772                 s2n(TLSEXT_TYPE_opaque_prf_input, ret);
 773                 s2n(sol + 2, ret);
 774                 s2n(sol, ret);
 775                 memcpy(ret, s->s3->server_opaque_prf_input, sol);
 776                 ret += sol;
 777                 }
 778 #endif
 779
 780         if(s->srtp_profile)
 781                 {
 782                 int el;
 783
 784                 ssl_add_serverhello_use_srtp_ext(s, 0, &el, 0);
 785
 786                 if((limit - p - 4 - el) < 0) return NULL;
 787
 788                 s2n(TLSEXT_TYPE_use_srtp,ret);
 789                 s2n(el,ret);
 790
 791                 if(ssl_add_serverhello_use_srtp_ext(s, ret, &el, el))
 792                         {
 793                         SSLerr(SSL_F_SSL_ADD_SERVERHELLO_TLSEXT, ERR_R_INTERNAL_ERROR);
 794                         return NULL;
 795                         }
 796                 ret+=el;
 797                 }
 798
 799         if (((s->s3->tmp.new_cipher->id & 0xFFFF)==0x80 || (s->s3->tmp.new_cipher->id & 0xFFFF)==0x81)
 800                 && (SSL_get_options(s) & SSL_OP_CRYPTOPRO_TLSEXT_BUG))
 801                 { const unsigned char cryptopro_ext[36] = {
 802                         0xfd, 0xe8, /*65000*/
 803                         0x00, 0x20, /*32 bytes length*/
 804                         0x30, 0x1e, 0x30, 0x08, 0x06, 0x06, 0x2a, 0x85,
 805                         0x03,   0x02, 0x02, 0x09, 0x30, 0x08, 0x06, 0x06,
 806                         0x2a, 0x85, 0x03, 0x02, 0x02, 0x16, 0x30, 0x08,
 807                         0x06, 0x06, 0x2a, 0x85, 0x03, 0x02, 0x02, 0x17};
 808                         if (limit-ret<36) return NULL;
 809                         memcpy(ret,cryptopro_ext,36);
 810                         ret+=36;
 811
 812                 }
 813
 814 #ifndef OPENSSL_NO_HEARTBEATS
 815         /* Add Heartbeat extension if we've received one */
 816         if (s->tlsext_heartbeat & SSL_TLSEXT_HB_ENABLED)
 817                 {
 818                 s2n(TLSEXT_TYPE_heartbeat,ret);
 819                 s2n(1,ret);
 820                 /* Set mode:
 821                  * 1: peer may send requests
 822                  * 2: peer not allowed to send requests
 823                  */
 824                 if (s->tlsext_heartbeat & SSL_TLSEXT_HB_DONT_RECV_REQUESTS)
 825                         *(ret++) = SSL_TLSEXT_HB_DONT_SEND_REQUESTS;
 826                 else
 827                         *(ret++) = SSL_TLSEXT_HB_ENABLED;
 828                 }
 829 #endif
 830
 831 #ifndef OPENSSL_NO_NEXTPROTONEG
 832         next_proto_neg_seen = s->s3->next_proto_neg_seen;
 833         s->s3->next_proto_neg_seen = 0;
 834         if (next_proto_neg_seen && s->ctx->next_protos_advertised_cb)
 835                 {
 836                 const unsigned char *npa;
 837                 unsigned int npalen;
 838                 int r;
 839
 840                 r = s->ctx->next_protos_advertised_cb(s, &npa, &npalen, s->ctx->next_protos_advertised_cb_arg);
 841                 if (r == SSL_TLSEXT_ERR_OK)
 842                         {
 843                         if ((long)(limit - ret - 4 - npalen) < 0) return NULL;
 844                         s2n(TLSEXT_TYPE_next_proto_neg,ret);
 845                         s2n(npalen,ret);
 846                         memcpy(ret, npa, npalen);
 847                         ret += npalen;
 848                         s->s3->next_proto_neg_seen = 1;
 849                         }
 850                 }
 851 #endif
 852
 853         if ((extdatalen = ret-p-2)== 0)
 854                 return p;
 855
 856         s2n(extdatalen,p);
 857         return ret;
 858         }
 859
 860 int ssl_parse_clienthello_tlsext(SSL *s, unsigned char **p, unsigned char *d, int n, int *al)
 861         {
 862         unsigned short type;
 863         unsigned short size;
 864         unsigned short len;
 865         unsigned char *data = *p;
 866         int renegotiate_seen = 0;
 867         int sigalg_seen = 0;
 868
 869         s->servername_done = 0;
 870         s->tlsext_status_type = -1;
 871 #ifndef OPENSSL_NO_NEXTPROTONEG
 872         s->s3->next_proto_neg_seen = 0;
 873 #endif
 874
 875 #ifndef OPENSSL_NO_HEARTBEATS
 876         s->tlsext_heartbeat &= ~(SSL_TLSEXT_HB_ENABLED |
 877                                SSL_TLSEXT_HB_DONT_SEND_REQUESTS);
 878 #endif
 879
 880         if (data >= (d+n-2))
 881                 goto ri_check;
 882         n2s(data,len);
 883
 884         if (data > (d+n-len))
 885                 goto ri_check;
 886
 887         while (data <= (d+n-4))
 888                 {
 889                 n2s(data,type);
 890                 n2s(data,size);
 891
 892                 if (data+size > (d+n))
 893                         goto ri_check;
 894 #if 0
 895                 fprintf(stderr,"Received extension type %d size %d\n",type,size);
 896 #endif
 897                 if (s->tlsext_debug_cb)
 898                         s->tlsext_debug_cb(s, 0, type, data, size,
 899                                                 s->tlsext_debug_arg);
 900 /* The servername extension is treated as follows:
 901
 902    - Only the hostname type is supported with a maximum length of 255.
 903    - The servername is rejected if too long or if it contains zeros,
 904      in which case an fatal alert is generated.
 905    - The servername field is maintained together with the session cache.
 906    - When a session is resumed, the servername call back invoked in order
 907      to allow the application to position itself to the right context.
 908    - The servername is acknowledged if it is new for a session or when
 909      it is identical to a previously used for the same session.
 910      Applications can control the behaviour.  They can at any time
 911      set a 'desirable' servername for a new SSL object. This can be the
 912      case for example with HTTPS when a Host: header field is received and
 913      a renegotiation is requested. In this case, a possible servername
 914      presented in the new client hello is only acknowledged if it matches
 915      the value of the Host: field.
 916    - Applications must  use SSL_OP_NO_SESSION_RESUMPTION_ON_RENEGOTIATION
 917      if they provide for changing an explicit servername context for the session,
 918      i.e. when the session has been established with a servername extension.
 919    - On session reconnect, the servername extension may be absent.
 920
 921 */
 922
 923                 if (type == TLSEXT_TYPE_server_name)
 924                         {
 925                         unsigned char *sdata;
 926                         int servname_type;
 927                         int dsize;
 928
 929                         if (size < 2)
 930                                 {
 931                                 *al = SSL_AD_DECODE_ERROR;
 932                                 return 0;
 933                                 }
 934                         n2s(data,dsize);
 935                         size -= 2;
 936                         if (dsize > size  )
 937                                 {
 938                                 *al = SSL_AD_DECODE_ERROR;
 939                                 return 0;
 940                                 }
 941
 942                         sdata = data;
 943                         while (dsize > 3)
 944                                 {
 945                                 servname_type = *(sdata++);
 946                                 n2s(sdata,len);
 947                                 dsize -= 3;
 948
 949                                 if (len > dsize)
 950                                         {
 951                                         *al = SSL_AD_DECODE_ERROR;
 952                                         return 0;
 953                                         }
 954                                 if (s->servername_done == 0)
 955                                 switch (servname_type)
 956                                         {
 957                                 case TLSEXT_NAMETYPE_host_name:
 958                                         if (!s->hit)
 959                                                 {
 960                                                 if(s->session->tlsext_hostname)
 961                                                         {
 962                                                         *al = SSL_AD_DECODE_ERROR;
 963                                                         return 0;
 964                                                         }
 965                                                 if (len > TLSEXT_MAXLEN_host_name)
 966                                                         {
 967                                                         *al = TLS1_AD_UNRECOGNIZED_NAME;
 968                                                         return 0;
 969                                                         }
 970                                                 if ((s->session->tlsext_hostname = OPENSSL_malloc(len+1)) == NULL)
 971                                                         {
 972                                                         *al = TLS1_AD_INTERNAL_ERROR;
 973                                                         return 0;
 974                                                         }
 975                                                 memcpy(s->session->tlsext_hostname, sdata, len);
 976                                                 s->session->tlsext_hostname[len]='\0';
 977                                                 if (strlen(s->session->tlsext_hostname) != len) {
 978                                                         OPENSSL_free(s->session->tlsext_hostname);
 979                                                         s->session->tlsext_hostname = NULL;
 980                                                         *al = TLS1_AD_UNRECOGNIZED_NAME;
 981                                                         return 0;
 982                                                 }
 983                                                 s->servername_done = 1;
 984
 985                                                 }
 986                                         else
 987                                                 s->servername_done = s->session->tlsext_hostname
 988                                                         && strlen(s->session->tlsext_hostname) == len
 989                                                         && strncmp(s->session->tlsext_hostname, (char *)sdata, len) == 0;
 990
 991                                         break;
 992
 993                                 default:
 994                                         break;
 995                                         }
 996
 997                                 dsize -= len;
 998                                 }
 999                         if (dsize != 0)
1000                                 {
1001                                 *al = SSL_AD_DECODE_ERROR;
1002                                 return 0;
1003                                 }
1004
1005                         }
1006 #ifndef OPENSSL_NO_SRP
1007                 else if (type == TLSEXT_TYPE_srp)
1008                         {
1009                         if (size > 0)
1010                                 {
1011                                 len = data[0];
1012                                 if ((s->srp_ctx.login = OPENSSL_malloc(len+1)) == NULL)
1013                                         return -1;
1014                                 memcpy(s->srp_ctx.login, &data[1], len);
1015                                 s->srp_ctx.login[len]='\0';
1016                                 }
1017                         }
1018 #endif
1019
1020 #ifndef OPENSSL_NO_EC
1021                 else if (type == TLSEXT_TYPE_ec_point_formats &&
1022                      s->version != DTLS1_VERSION)
1023                         {
1024                         unsigned char *sdata = data;
1025                         int ecpointformatlist_length = *(sdata++);
1026
1027                         if (ecpointformatlist_length != size - 1)
1028                                 {
1029                                 *al = TLS1_AD_DECODE_ERROR;
1030                                 return 0;
1031                                 }
1032                         if (!s->hit)
1033                                 {
1034                                 if(s->session->tlsext_ecpointformatlist)
1035                                         {
1036                                         OPENSSL_free(s->session->tlsext_ecpointformatlist);
1037                                         s->session->tlsext_ecpointformatlist = NULL;
1038                                         }
1039                                 s->session->tlsext_ecpointformatlist_length = 0;
1040                                 if ((s->session->tlsext_ecpointformatlist = OPENSSL_malloc(ecpointformatlist_length)) == NULL)
1041                                         {
1042                                         *al = TLS1_AD_INTERNAL_ERROR;
1043                                         return 0;
1044                                         }
1045                                 s->session->tlsext_ecpointformatlist_length = ecpointformatlist_length;
1046                                 memcpy(s->session->tlsext_ecpointformatlist, sdata, ecpointformatlist_length);
1047                                 }
1048 #if 0
1049                         fprintf(stderr,"ssl_parse_clienthello_tlsext s->session->tlsext_ecpointformatlist (length=%i) ", s->session->tlsext_ecpointformatlist_length);
1050                         sdata = s->session->tlsext_ecpointformatlist;
1051                         for (i = 0; i < s->session->tlsext_ecpointformatlist_length; i++)
1052                                 fprintf(stderr,"%i ",*(sdata++));
1053                         fprintf(stderr,"\n");
1054 #endif
1055                         }
1056                 else if (type == TLSEXT_TYPE_elliptic_curves &&
1057                      s->version != DTLS1_VERSION)
1058                         {
1059                         unsigned char *sdata = data;
1060                         int ellipticcurvelist_length = (*(sdata++) << 8);
1061                         ellipticcurvelist_length += (*(sdata++));
1062
1063                         if (ellipticcurvelist_length != size - 2)
1064                                 {
1065                                 *al = TLS1_AD_DECODE_ERROR;
1066                                 return 0;
1067                                 }
1068                         if (!s->hit)
1069                                 {
1070                                 if(s->session->tlsext_ellipticcurvelist)
1071                                         {
1072                                         *al = TLS1_AD_DECODE_ERROR;
1073                                         return 0;
1074                                         }
1075                                 s->session->tlsext_ellipticcurvelist_length = 0;
1076                                 if ((s->session->tlsext_ellipticcurvelist = OPENSSL_malloc(ellipticcurvelist_length)) == NULL)
1077                                         {
1078                                         *al = TLS1_AD_INTERNAL_ERROR;
1079                                         return 0;
1080                                         }
1081                                 s->session->tlsext_ellipticcurvelist_length = ellipticcurvelist_length;
1082                                 memcpy(s->session->tlsext_ellipticcurvelist, sdata, ellipticcurvelist_length);
1083                                 }
1084 #if 0
1085                         fprintf(stderr,"ssl_parse_clienthello_tlsext s->session->tlsext_ellipticcurvelist (length=%i) ", s->session->tlsext_ellipticcurvelist_length);
1086                         sdata = s->session->tlsext_ellipticcurvelist;
1087                         for (i = 0; i < s->session->tlsext_ellipticcurvelist_length; i++)
1088                                 fprintf(stderr,"%i ",*(sdata++));
1089                         fprintf(stderr,"\n");
1090 #endif
1091                         }
1092 #endif /* OPENSSL_NO_EC */
1093 #ifdef TLSEXT_TYPE_opaque_prf_input
1094                 else if (type == TLSEXT_TYPE_opaque_prf_input &&
1095                      s->version != DTLS1_VERSION)
1096                         {
1097                         unsigned char *sdata = data;
1098
1099                         if (size < 2)
1100                                 {
1101                                 *al = SSL_AD_DECODE_ERROR;
1102                                 return 0;
1103                                 }
1104                         n2s(sdata, s->s3->client_opaque_prf_input_len);
1105                         if (s->s3->client_opaque_prf_input_len != size - 2)
1106                                 {
1107                                 *al = SSL_AD_DECODE_ERROR;
1108                                 return 0;
1109                                 }
1110
1111                         if (s->s3->client_opaque_prf_input != NULL) /* shouldn't really happen */
1112                                 OPENSSL_free(s->s3->client_opaque_prf_input);
1113                         if (s->s3->client_opaque_prf_input_len == 0)
1114                                 s->s3->client_opaque_prf_input = OPENSSL_malloc(1); /* dummy byte just to get non-NULL */
1115                         else
1116                                 s->s3->client_opaque_prf_input = BUF_memdup(sdata, s->s3->client_opaque_prf_input_len);
1117                         if (s->s3->client_opaque_prf_input == NULL)
1118                                 {
1119                                 *al = TLS1_AD_INTERNAL_ERROR;
1120                                 return 0;
1121                                 }
1122                         }
1123 #endif
1124                 else if (type == TLSEXT_TYPE_session_ticket)
1125                         {
1126                         if (s->tls_session_ticket_ext_cb &&
1127                             !s->tls_session_ticket_ext_cb(s, data, size, s->tls_session_ticket_ext_cb_arg))
1128                                 {
1129                                 *al = TLS1_AD_INTERNAL_ERROR;
1130                                 return 0;
1131                                 }
1132                         }
1133                 else if (type == TLSEXT_TYPE_renegotiate)
1134                         {
1135                         if(!ssl_parse_clienthello_renegotiate_ext(s, data, size, al))
1136                                 return 0;
1137                         renegotiate_seen = 1;
1138                         }
1139                 else if (type == TLSEXT_TYPE_signature_algorithms)
1140                         {
1141                         int dsize;
1142                         if (sigalg_seen || size < 2)
1143                                 {
1144                                 *al = SSL_AD_DECODE_ERROR;
1145                                 return 0;
1146                                 }
1147                         sigalg_seen = 1;
1148                         n2s(data,dsize);
1149                         size -= 2;
1150                         if (dsize != size || dsize & 1)
1151                                 {
1152                                 *al = SSL_AD_DECODE_ERROR;
1153                                 return 0;
1154                                 }
1155                         if (!tls1_process_sigalgs(s, data, dsize))
1156                                 {
1157                                 *al = SSL_AD_DECODE_ERROR;
1158                                 return 0;
1159                                 }
1160                         }
1161                 else if (type == TLSEXT_TYPE_status_request &&
1162                          s->version != DTLS1_VERSION && s->ctx->tlsext_status_cb)
1163                         {
1164
1165                         if (size < 5)
1166                                 {
1167                                 *al = SSL_AD_DECODE_ERROR;
1168                                 return 0;
1169                                 }
1170
1171                         s->tlsext_status_type = *data++;
1172                         size--;
1173                         if (s->tlsext_status_type == TLSEXT_STATUSTYPE_ocsp)
1174                                 {
1175                                 const unsigned char *sdata;
1176                                 int dsize;
1177                                 /* Read in responder_id_list */
1178                                 n2s(data,dsize);
1179                                 size -= 2;
1180                                 if (dsize > size  )
1181                                         {
1182                                         *al = SSL_AD_DECODE_ERROR;
1183                                         return 0;
1184                                         }
1185                                 while (dsize > 0)
1186                                         {
1187                                         OCSP_RESPID *id;
1188                                         int idsize;
1189                                         if (dsize < 4)
1190                                                 {
1191                                                 *al = SSL_AD_DECODE_ERROR;
1192                                                 return 0;
1193                                                 }
1194                                         n2s(data, idsize);
1195                                         dsize -= 2 + idsize;
1196                                         size -= 2 + idsize;
1197                                         if (dsize < 0)
1198                                                 {
1199                                                 *al = SSL_AD_DECODE_ERROR;
1200                                                 return 0;
1201                                                 }
1202                                         sdata = data;
1203                                         data += idsize;
1204                                         id = d2i_OCSP_RESPID(NULL,
1205                                                                 &sdata, idsize);
1206                                         if (!id)
1207                                                 {
1208                                                 *al = SSL_AD_DECODE_ERROR;
1209                                                 return 0;
1210                                                 }
1211                                         if (data != sdata)
1212                                                 {
1213                                                 OCSP_RESPID_free(id);
1214                                                 *al = SSL_AD_DECODE_ERROR;
1215                                                 return 0;
1216                                                 }
1217                                         if (!s->tlsext_ocsp_ids
1218                                                 && !(s->tlsext_ocsp_ids =
1219                                                 sk_OCSP_RESPID_new_null()))
1220                                                 {
1221                                                 OCSP_RESPID_free(id);
1222                                                 *al = SSL_AD_INTERNAL_ERROR;
1223                                                 return 0;
1224                                                 }
1225                                         if (!sk_OCSP_RESPID_push(
1226                                                         s->tlsext_ocsp_ids, id))
1227                                                 {
1228                                                 OCSP_RESPID_free(id);
1229                                                 *al = SSL_AD_INTERNAL_ERROR;
1230                                                 return 0;
1231                                                 }
1232                                         }
1233
1234                                 /* Read in request_extensions */
1235                                 if (size < 2)
1236                                         {
1237                                         *al = SSL_AD_DECODE_ERROR;
1238                                         return 0;
1239                                         }
1240                                 n2s(data,dsize);
1241                                 size -= 2;
1242                                 if (dsize != size)
1243                                         {
1244                                         *al = SSL_AD_DECODE_ERROR;
1245                                         return 0;
1246                                         }
1247                                 sdata = data;
1248                                 if (dsize > 0)
1249                                         {
1250                                         if (s->tlsext_ocsp_exts)
1251                                                 {
1252                                                 sk_X509_EXTENSION_pop_free(s->tlsext_ocsp_exts,
1253                                                                            X509_EXTENSION_free);
1254                                                 }
1255
1256                                         s->tlsext_ocsp_exts =
1257                                                 d2i_X509_EXTENSIONS(NULL,
1258                                                         &sdata, dsize);
1259                                         if (!s->tlsext_ocsp_exts
1260                                                 || (data + dsize != sdata))
1261                                                 {
1262                                                 *al = SSL_AD_DECODE_ERROR;
1263                                                 return 0;
1264                                                 }
1265                                         }
1266                                 }
1267                                 /* We don't know what to do with any other type
1268                                 * so ignore it.
1269                                 */
1270                                 else
1271                                         s->tlsext_status_type = -1;
1272                         }
1273 #ifndef OPENSSL_NO_HEARTBEATS
1274                 else if (type == TLSEXT_TYPE_heartbeat)
1275                         {
1276                         switch(data[0])
1277                                 {
1278                                 case 0x01:      /* Client allows us to send HB requests */
1279                                                         s->tlsext_heartbeat |= SSL_TLSEXT_HB_ENABLED;
1280                                                         break;
1281                                 case 0x02:      /* Client doesn't accept HB requests */
1282                                                         s->tlsext_heartbeat |= SSL_TLSEXT_HB_ENABLED;
1283                                                         s->tlsext_heartbeat |= SSL_TLSEXT_HB_DONT_SEND_REQUESTS;
1284                                                         break;
1285                                 }
1286                         }
1287 #endif
1288 #ifndef OPENSSL_NO_NEXTPROTONEG
1289                 else if (type == TLSEXT_TYPE_next_proto_neg &&
1290                          s->s3->tmp.finish_md_len == 0)
1291                         {
1292                         /* We shouldn't accept this extension on a
1293                          * renegotiation.
1294                          *
1295                          * s->new_session will be set on renegotiation, but we
1296                          * probably shouldn't rely that it couldn't be set on
1297                          * the initial renegotation too in certain cases (when
1298                          * there's some other reason to disallow resuming an
1299                          * earlier session -- the current code won't be doing
1300                          * anything like that, but this might change).
1301
1302                          * A valid sign that there's been a previous handshake
1303                          * in this connection is if s->s3->tmp.finish_md_len >
1304                          * 0.  (We are talking about a check that will happen
1305                          * in the Hello protocol round, well before a new
1306                          * Finished message could have been computed.) */
1307                         s->s3->next_proto_neg_seen = 1;
1308                         }
1309 #endif
1310
1311                 /* session ticket processed earlier */
1312                 else if (type == TLSEXT_TYPE_use_srtp)
1313                         {
1314                         if(ssl_parse_clienthello_use_srtp_ext(s, data, size,
1315                                                               al))
1316                                 return 0;
1317                         }
1318
1319                 data+=size;
1320                 }
1321
1322         *p = data;
1323
1324         ri_check:
1325
1326         /* Need RI if renegotiating */
1327
1328         if (!renegotiate_seen && s->renegotiate &&
1329                 !(s->options & SSL_OP_ALLOW_UNSAFE_LEGACY_RENEGOTIATION))
1330                 {
1331                 *al = SSL_AD_HANDSHAKE_FAILURE;
1332                 SSLerr(SSL_F_SSL_PARSE_CLIENTHELLO_TLSEXT,
1333                                 SSL_R_UNSAFE_LEGACY_RENEGOTIATION_DISABLED);
1334                 return 0;
1335                 }
1336
1337         return 1;
1338         }
1339
1340 #ifndef OPENSSL_NO_NEXTPROTONEG
1341 /* ssl_next_proto_validate validates a Next Protocol Negotiation block. No
1342  * elements of zero length are allowed and the set of elements must exactly fill
1343  * the length of the block. */
1344 static int ssl_next_proto_validate(unsigned char *d, unsigned len)
1345         {
1346         unsigned int off = 0;
1347
1348         while (off < len)
1349                 {
1350                 if (d[off] == 0)
1351                         return 0;
1352                 off += d[off];
1353                 off++;
1354                 }
1355
1356         return off == len;
1357         }
1358 #endif
1359
1360 int ssl_parse_serverhello_tlsext(SSL *s, unsigned char **p, unsigned char *d, int n, int *al)
1361         {
1362         unsigned short length;
1363         unsigned short type;
1364         unsigned short size;
1365         unsigned char *data = *p;
1366         int tlsext_servername = 0;
1367         int renegotiate_seen = 0;
1368
1369 #ifndef OPENSSL_NO_NEXTPROTONEG
1370         s->s3->next_proto_neg_seen = 0;
1371 #endif
1372
1373 #ifndef OPENSSL_NO_HEARTBEATS
1374         s->tlsext_heartbeat &= ~(SSL_TLSEXT_HB_ENABLED |
1375                                SSL_TLSEXT_HB_DONT_SEND_REQUESTS);
1376 #endif
1377
1378         if (data >= (d+n-2))
1379                 goto ri_check;
1380
1381         n2s(data,length);
1382         if (data+length != d+n)
1383                 {
1384                 *al = SSL_AD_DECODE_ERROR;
1385                 return 0;
1386                 }
1387
1388         while(data <= (d+n-4))
1389                 {
1390                 n2s(data,type);
1391                 n2s(data,size);
1392
1393                 if (data+size > (d+n))
1394                         goto ri_check;
1395
1396                 if (s->tlsext_debug_cb)
1397                         s->tlsext_debug_cb(s, 1, type, data, size,
1398                                                 s->tlsext_debug_arg);
1399
1400                 if (type == TLSEXT_TYPE_server_name)
1401                         {
1402                         if (s->tlsext_hostname == NULL || size > 0)
1403                                 {
1404                                 *al = TLS1_AD_UNRECOGNIZED_NAME;
1405                                 return 0;
1406                                 }
1407                         tlsext_servername = 1;
1408                         }
1409
1410 #ifndef OPENSSL_NO_EC
1411                 else if (type == TLSEXT_TYPE_ec_point_formats &&
1412                      s->version != DTLS1_VERSION)
1413                         {
1414                         unsigned char *sdata = data;
1415                         int ecpointformatlist_length = *(sdata++);
1416
1417                         if (ecpointformatlist_length != size - 1)
1418                                 {
1419                                 *al = TLS1_AD_DECODE_ERROR;
1420                                 return 0;
1421                                 }
1422                         s->session->tlsext_ecpointformatlist_length = 0;
1423                         if (s->session->tlsext_ecpointformatlist != NULL) OPENSSL_free(s->session->tlsext_ecpointformatlist);
1424                         if ((s->session->tlsext_ecpointformatlist = OPENSSL_malloc(ecpointformatlist_length)) == NULL)
1425                                 {
1426                                 *al = TLS1_AD_INTERNAL_ERROR;
1427                                 return 0;
1428                                 }
1429                         s->session->tlsext_ecpointformatlist_length = ecpointformatlist_length;
1430                         memcpy(s->session->tlsext_ecpointformatlist, sdata, ecpointformatlist_length);
1431 #if 0
1432                         fprintf(stderr,"ssl_parse_serverhello_tlsext s->session->tlsext_ecpointformatlist ");
1433                         sdata = s->session->tlsext_ecpointformatlist;
1434                         for (i = 0; i < s->session->tlsext_ecpointformatlist_length; i++)
1435                                 fprintf(stderr,"%i ",*(sdata++));
1436                         fprintf(stderr,"\n");
1437 #endif
1438                         }
1439 #endif /* OPENSSL_NO_EC */
1440
1441                 else if (type == TLSEXT_TYPE_session_ticket)
1442                         {
1443                         if (s->tls_session_ticket_ext_cb &&
1444                             !s->tls_session_ticket_ext_cb(s, data, size, s->tls_session_ticket_ext_cb_arg))
1445                                 {
1446                                 *al = TLS1_AD_INTERNAL_ERROR;
1447                                 return 0;
1448                                 }
1449                         if ((SSL_get_options(s) & SSL_OP_NO_TICKET)
1450                                 || (size > 0))
1451                                 {
1452                                 *al = TLS1_AD_UNSUPPORTED_EXTENSION;
1453                                 return 0;
1454                                 }
1455                         s->tlsext_ticket_expected = 1;
1456                         }
1457 #ifdef TLSEXT_TYPE_opaque_prf_input
1458                 else if (type == TLSEXT_TYPE_opaque_prf_input &&
1459                      s->version != DTLS1_VERSION)
1460                         {
1461                         unsigned char *sdata = data;
1462
1463                         if (size < 2)
1464                                 {
1465                                 *al = SSL_AD_DECODE_ERROR;
1466                                 return 0;
1467                                 }
1468                         n2s(sdata, s->s3->server_opaque_prf_input_len);
1469                         if (s->s3->server_opaque_prf_input_len != size - 2)
1470                                 {
1471                                 *al = SSL_AD_DECODE_ERROR;
1472                                 return 0;
1473                                 }
1474
1475                         if (s->s3->server_opaque_prf_input != NULL) /* shouldn't really happen */
1476                                 OPENSSL_free(s->s3->server_opaque_prf_input);
1477                         if (s->s3->server_opaque_prf_input_len == 0)
1478                                 s->s3->server_opaque_prf_input = OPENSSL_malloc(1); /* dummy byte just to get non-NULL */
1479                         else
1480                                 s->s3->server_opaque_prf_input = BUF_memdup(sdata, s->s3->server_opaque_prf_input_len);
1481
1482                         if (s->s3->server_opaque_prf_input == NULL)
1483                                 {
1484                                 *al = TLS1_AD_INTERNAL_ERROR;
1485                                 return 0;
1486                                 }
1487                         }
1488 #endif
1489                 else if (type == TLSEXT_TYPE_status_request &&
1490                          s->version != DTLS1_VERSION)
1491                         {
1492                         /* MUST be empty and only sent if we've requested
1493                          * a status request message.
1494                          */
1495                         if ((s->tlsext_status_type == -1) || (size > 0))
1496                                 {
1497                                 *al = TLS1_AD_UNSUPPORTED_EXTENSION;
1498                                 return 0;
1499                                 }
1500                         /* Set flag to expect CertificateStatus message */
1501                         s->tlsext_status_expected = 1;
1502                         }
1503 #ifndef OPENSSL_NO_NEXTPROTONEG
1504                 else if (type == TLSEXT_TYPE_next_proto_neg &&
1505                          s->s3->tmp.finish_md_len == 0)
1506                         {
1507                         unsigned char *selected;
1508                         unsigned char selected_len;
1509
1510                         /* We must have requested it. */
1511                         if ((s->ctx->next_proto_select_cb == NULL))
1512                                 {
1513                                 *al = TLS1_AD_UNSUPPORTED_EXTENSION;
1514                                 return 0;
1515                                 }
1516                         /* The data must be valid */
1517                         if (!ssl_next_proto_validate(data, size))
1518                                 {
1519                                 *al = TLS1_AD_DECODE_ERROR;
1520                                 return 0;
1521                                 }
1522                         if (s->ctx->next_proto_select_cb(s, &selected, &selected_len, data, size, s->ctx->next_proto_select_cb_arg) != SSL_TLSEXT_ERR_OK)
1523                                 {
1524                                 *al = TLS1_AD_INTERNAL_ERROR;
1525                                 return 0;
1526                                 }
1527                         s->next_proto_negotiated = OPENSSL_malloc(selected_len);
1528                         if (!s->next_proto_negotiated)
1529                                 {
1530                                 *al = TLS1_AD_INTERNAL_ERROR;
1531                                 return 0;
1532                                 }
1533                         memcpy(s->next_proto_negotiated, selected, selected_len);
1534                         s->next_proto_negotiated_len = selected_len;
1535                         s->s3->next_proto_neg_seen = 1;
1536                         }
1537 #endif
1538                 else if (type == TLSEXT_TYPE_renegotiate)
1539                         {
1540                         if(!ssl_parse_serverhello_renegotiate_ext(s, data, size, al))
1541                                 return 0;
1542                         renegotiate_seen = 1;
1543                         }
1544 #ifndef OPENSSL_NO_HEARTBEATS
1545                 else if (type == TLSEXT_TYPE_heartbeat)
1546                         {
1547                         switch(data[0])
1548                                 {
1549                                 case 0x01:      /* Server allows us to send HB requests */
1550                                                         s->tlsext_heartbeat |= SSL_TLSEXT_HB_ENABLED;
1551                                                         break;
1552                                 case 0x02:      /* Server doesn't accept HB requests */
1553                                                         s->tlsext_heartbeat |= SSL_TLSEXT_HB_ENABLED;
1554                                                         s->tlsext_heartbeat |= SSL_TLSEXT_HB_DONT_SEND_REQUESTS;
1555                                                         break;
1556                                 }
1557                         }
1558 #endif
1559                 else if (type == TLSEXT_TYPE_use_srtp)
1560                         {
1561                         if(ssl_parse_serverhello_use_srtp_ext(s, data, size,
1562                                                               al))
1563                                 return 0;
1564                         }
1565
1566                 data+=size;
1567                 }
1568
1569         if (data != d+n)
1570                 {
1571                 *al = SSL_AD_DECODE_ERROR;
1572                 return 0;
1573                 }
1574
1575         if (!s->hit && tlsext_servername == 1)
1576                 {
1577                 if (s->tlsext_hostname)
1578                         {
1579                         if (s->session->tlsext_hostname == NULL)
1580                                 {
1581                                 s->session->tlsext_hostname = BUF_strdup(s->tlsext_hostname);
1582                                 if (!s->session->tlsext_hostname)
1583                                         {
1584                                         *al = SSL_AD_UNRECOGNIZED_NAME;
1585                                         return 0;
1586                                         }
1587                                 }
1588                         else
1589                                 {
1590                                 *al = SSL_AD_DECODE_ERROR;
1591                                 return 0;
1592                                 }
1593                         }
1594                 }
1595
1596         *p = data;
1597
1598         ri_check:
1599
1600         /* Determine if we need to see RI. Strictly speaking if we want to
1601          * avoid an attack we should *always* see RI even on initial server
1602          * hello because the client doesn't see any renegotiation during an
1603          * attack. However this would mean we could not connect to any server
1604          * which doesn't support RI so for the immediate future tolerate RI
1605          * absence on initial connect only.
1606          */
1607         if (!renegotiate_seen
1608                 && !(s->options & SSL_OP_LEGACY_SERVER_CONNECT)
1609                 && !(s->options & SSL_OP_ALLOW_UNSAFE_LEGACY_RENEGOTIATION))
1610                 {
1611                 *al = SSL_AD_HANDSHAKE_FAILURE;
1612                 SSLerr(SSL_F_SSL_PARSE_SERVERHELLO_TLSEXT,
1613                                 SSL_R_UNSAFE_LEGACY_RENEGOTIATION_DISABLED);
1614                 return 0;
1615                 }
1616
1617         return 1;
1618         }
1619
1620
1621 int ssl_prepare_clienthello_tlsext(SSL *s)
1622         {
1623 #ifndef OPENSSL_NO_EC
1624         /* If we are client and using an elliptic curve cryptography cipher suite, send the point formats
1625          * and elliptic curves we support.
1626          */
1627         int using_ecc = 0;
1628         int i;
1629         unsigned char *j;
1630         unsigned long alg_k, alg_a;
1631         STACK_OF(SSL_CIPHER) *cipher_stack = SSL_get_ciphers(s);
1632
1633         for (i = 0; i < sk_SSL_CIPHER_num(cipher_stack); i++)
1634                 {
1635                 SSL_CIPHER *c = sk_SSL_CIPHER_value(cipher_stack, i);
1636
1637                 alg_k = c->algorithm_mkey;
1638                 alg_a = c->algorithm_auth;
1639                 if ((alg_k & (SSL_kEECDH|SSL_kECDHr|SSL_kECDHe) || (alg_a & SSL_aECDSA)))
1640                         {
1641                         using_ecc = 1;
1642                         break;
1643                         }
1644                 }
1645         using_ecc = using_ecc && (s->version >= TLS1_VERSION);
1646         if (using_ecc)
1647                 {
1648                 if (s->tlsext_ecpointformatlist != NULL) OPENSSL_free(s->tlsext_ecpointformatlist);
1649                 if ((s->tlsext_ecpointformatlist = OPENSSL_malloc(3)) == NULL)
1650                         {
1651                         SSLerr(SSL_F_SSL_PREPARE_CLIENTHELLO_TLSEXT,ERR_R_MALLOC_FAILURE);
1652                         return -1;
1653                         }
1654                 s->tlsext_ecpointformatlist_length = 3;
1655                 s->tlsext_ecpointformatlist[0] = TLSEXT_ECPOINTFORMAT_uncompressed;
1656                 s->tlsext_ecpointformatlist[1] = TLSEXT_ECPOINTFORMAT_ansiX962_compressed_prime;
1657                 s->tlsext_ecpointformatlist[2] = TLSEXT_ECPOINTFORMAT_ansiX962_compressed_char2;
1658
1659                 /* we support all named elliptic curves in draft-ietf-tls-ecc-12 */
1660                 if (s->tlsext_ellipticcurvelist != NULL) OPENSSL_free(s->tlsext_ellipticcurvelist);
1661                 s->tlsext_ellipticcurvelist_length = sizeof(pref_list)/sizeof(pref_list[0]) * 2;
1662                 if ((s->tlsext_ellipticcurvelist = OPENSSL_malloc(s->tlsext_ellipticcurvelist_length)) == NULL)
1663                         {
1664                         s->tlsext_ellipticcurvelist_length = 0;
1665                         SSLerr(SSL_F_SSL_PREPARE_CLIENTHELLO_TLSEXT,ERR_R_MALLOC_FAILURE);
1666                         return -1;
1667                         }
1668                 for (i = 0, j = s->tlsext_ellipticcurvelist; (unsigned int)i <
1669                                 sizeof(pref_list)/sizeof(pref_list[0]); i++)
1670                         {
1671                         int id = tls1_ec_nid2curve_id(pref_list[i]);
1672                         s2n(id,j);
1673                         }
1674                 }
1675 #endif /* OPENSSL_NO_EC */
1676
1677 #ifdef TLSEXT_TYPE_opaque_prf_input
1678         {
1679                 int r = 1;
1680
1681                 if (s->ctx->tlsext_opaque_prf_input_callback != 0)
1682                         {
1683                         r = s->ctx->tlsext_opaque_prf_input_callback(s, NULL, 0, s->ctx->tlsext_opaque_prf_input_callback_arg);
1684                         if (!r)
1685                                 return -1;
1686                         }
1687
1688                 if (s->tlsext_opaque_prf_input != NULL)
1689                         {
1690                         if (s->s3->client_opaque_prf_input != NULL) /* shouldn't really happen */
1691                                 OPENSSL_free(s->s3->client_opaque_prf_input);
1692
1693                         if (s->tlsext_opaque_prf_input_len == 0)
1694                                 s->s3->client_opaque_prf_input = OPENSSL_malloc(1); /* dummy byte just to get non-NULL */
1695                         else
1696                                 s->s3->client_opaque_prf_input = BUF_memdup(s->tlsext_opaque_prf_input, s->tlsext_opaque_prf_input_len);
1697                         if (s->s3->client_opaque_prf_input == NULL)
1698                                 {
1699                                 SSLerr(SSL_F_SSL_PREPARE_CLIENTHELLO_TLSEXT,ERR_R_MALLOC_FAILURE);
1700                                 return -1;
1701                                 }
1702                         s->s3->client_opaque_prf_input_len = s->tlsext_opaque_prf_input_len;
1703                         }
1704
1705                 if (r == 2)
1706                         /* at callback's request, insist on receiving an appropriate server opaque PRF input */
1707                         s->s3->server_opaque_prf_input_len = s->tlsext_opaque_prf_input_len;
1708         }
1709 #endif
1710
1711         return 1;
1712         }
1713
1714 int ssl_prepare_serverhello_tlsext(SSL *s)
1715         {
1716 #ifndef OPENSSL_NO_EC
1717         /* If we are server and using an ECC cipher suite, send the point formats we support
1718          * if the client sent us an ECPointsFormat extension.  Note that the server is not
1719          * supposed to send an EllipticCurves extension.
1720          */
1721
1722         unsigned long alg_k = s->s3->tmp.new_cipher->algorithm_mkey;
1723         unsigned long alg_a = s->s3->tmp.new_cipher->algorithm_auth;
1724         int using_ecc = (alg_k & (SSL_kEECDH|SSL_kECDHr|SSL_kECDHe)) || (alg_a & SSL_aECDSA);
1725         using_ecc = using_ecc && (s->session->tlsext_ecpointformatlist != NULL);
1726
1727         if (using_ecc)
1728                 {
1729                 if (s->tlsext_ecpointformatlist != NULL) OPENSSL_free(s->tlsext_ecpointformatlist);
1730                 if ((s->tlsext_ecpointformatlist = OPENSSL_malloc(3)) == NULL)
1731                         {
1732                         SSLerr(SSL_F_SSL_PREPARE_SERVERHELLO_TLSEXT,ERR_R_MALLOC_FAILURE);
1733                         return -1;
1734                         }
1735                 s->tlsext_ecpointformatlist_length = 3;
1736                 s->tlsext_ecpointformatlist[0] = TLSEXT_ECPOINTFORMAT_uncompressed;
1737                 s->tlsext_ecpointformatlist[1] = TLSEXT_ECPOINTFORMAT_ansiX962_compressed_prime;
1738                 s->tlsext_ecpointformatlist[2] = TLSEXT_ECPOINTFORMAT_ansiX962_compressed_char2;
1739                 }
1740 #endif /* OPENSSL_NO_EC */
1741
1742         return 1;
1743         }
1744
1745 int ssl_check_clienthello_tlsext(SSL *s)
1746         {
1747         int ret=SSL_TLSEXT_ERR_NOACK;
1748         int al = SSL_AD_UNRECOGNIZED_NAME;
1749
1750 #ifndef OPENSSL_NO_EC
1751         /* The handling of the ECPointFormats extension is done elsewhere, namely in
1752          * ssl3_choose_cipher in s3_lib.c.
1753          */
1754         /* The handling of the EllipticCurves extension is done elsewhere, namely in
1755          * ssl3_choose_cipher in s3_lib.c.
1756          */
1757 #endif
1758
1759         if (s->ctx != NULL && s->ctx->tlsext_servername_callback != 0)
1760                 ret = s->ctx->tlsext_servername_callback(s, &al, s->ctx->tlsext_servername_arg);
1761         else if (s->initial_ctx != NULL && s->initial_ctx->tlsext_servername_callback != 0)
1762                 ret = s->initial_ctx->tlsext_servername_callback(s, &al, s->initial_ctx->tlsext_servername_arg);
1763
1764         /* If status request then ask callback what to do.
1765          * Note: this must be called after servername callbacks in case
1766          * the certificate has changed.
1767          */
1768         if ((s->tlsext_status_type != -1) && s->ctx && s->ctx->tlsext_status_cb)
1769                 {
1770                 int r;
1771                 r = s->ctx->tlsext_status_cb(s, s->ctx->tlsext_status_arg);
1772                 switch (r)
1773                         {
1774                         /* We don't want to send a status request response */
1775                         case SSL_TLSEXT_ERR_NOACK:
1776                                 s->tlsext_status_expected = 0;
1777                                 break;
1778                         /* status request response should be sent */
1779                         case SSL_TLSEXT_ERR_OK:
1780                                 if (s->tlsext_ocsp_resp)
1781                                         s->tlsext_status_expected = 1;
1782                                 else
1783                                         s->tlsext_status_expected = 0;
1784                                 break;
1785                         /* something bad happened */
1786                         case SSL_TLSEXT_ERR_ALERT_FATAL:
1787                                 ret = SSL_TLSEXT_ERR_ALERT_FATAL;
1788                                 al = SSL_AD_INTERNAL_ERROR;
1789                                 goto err;
1790                         }
1791                 }
1792         else
1793                 s->tlsext_status_expected = 0;
1794
1795 #ifdef TLSEXT_TYPE_opaque_prf_input
1796         {
1797                 /* This sort of belongs into ssl_prepare_serverhello_tlsext(),
1798                  * but we might be sending an alert in response to the client hello,
1799                  * so this has to happen here in ssl_check_clienthello_tlsext(). */
1800
1801                 int r = 1;
1802
1803                 if (s->ctx->tlsext_opaque_prf_input_callback != 0)
1804                         {
1805                         r = s->ctx->tlsext_opaque_prf_input_callback(s, NULL, 0, s->ctx->tlsext_opaque_prf_input_callback_arg);
1806                         if (!r)
1807                                 {
1808                                 ret = SSL_TLSEXT_ERR_ALERT_FATAL;
1809                                 al = SSL_AD_INTERNAL_ERROR;
1810                                 goto err;
1811                                 }
1812                         }
1813
1814                 if (s->s3->server_opaque_prf_input != NULL) /* shouldn't really happen */
1815                         OPENSSL_free(s->s3->server_opaque_prf_input);
1816                 s->s3->server_opaque_prf_input = NULL;
1817
1818                 if (s->tlsext_opaque_prf_input != NULL)
1819                         {
1820                         if (s->s3->client_opaque_prf_input != NULL &&
1821                                 s->s3->client_opaque_prf_input_len == s->tlsext_opaque_prf_input_len)
1822                                 {
1823                                 /* can only use this extension if we have a server opaque PRF input
1824                                  * of the same length as the client opaque PRF input! */
1825
1826                                 if (s->tlsext_opaque_prf_input_len == 0)
1827                                         s->s3->server_opaque_prf_input = OPENSSL_malloc(1); /* dummy byte just to get non-NULL */
1828                                 else
1829                                         s->s3->server_opaque_prf_input = BUF_memdup(s->tlsext_opaque_prf_input, s->tlsext_opaque_prf_input_len);
1830                                 if (s->s3->server_opaque_prf_input == NULL)
1831                                         {
1832                                         ret = SSL_TLSEXT_ERR_ALERT_FATAL;
1833                                         al = SSL_AD_INTERNAL_ERROR;
1834                                         goto err;
1835                                         }
1836                                 s->s3->server_opaque_prf_input_len = s->tlsext_opaque_prf_input_len;
1837                                 }
1838                         }
1839
1840                 if (r == 2 && s->s3->server_opaque_prf_input == NULL)
1841                         {
1842                         /* The callback wants to enforce use of the extension,
1843                          * but we can't do that with the client opaque PRF input;
1844                          * abort the handshake.
1845                          */
1846                         ret = SSL_TLSEXT_ERR_ALERT_FATAL;
1847                         al = SSL_AD_HANDSHAKE_FAILURE;
1848                         }
1849         }
1850
1851 #endif
1852  err:
1853         switch (ret)
1854                 {
1855                 case SSL_TLSEXT_ERR_ALERT_FATAL:
1856                         ssl3_send_alert(s,SSL3_AL_FATAL,al);
1857                         return -1;
1858
1859                 case SSL_TLSEXT_ERR_ALERT_WARNING:
1860                         ssl3_send_alert(s,SSL3_AL_WARNING,al);
1861                         return 1;
1862
1863                 case SSL_TLSEXT_ERR_NOACK:
1864                         s->servername_done=0;
1865                         default:
1866                 return 1;
1867                 }
1868         }
1869
1870 int ssl_check_serverhello_tlsext(SSL *s)
1871         {
1872         int ret=SSL_TLSEXT_ERR_NOACK;
1873         int al = SSL_AD_UNRECOGNIZED_NAME;
1874
1875 #ifndef OPENSSL_NO_EC
1876         /* If we are client and using an elliptic curve cryptography cipher
1877          * suite, then if server returns an EC point formats lists extension
1878          * it must contain uncompressed.
1879          */
1880         unsigned long alg_k = s->s3->tmp.new_cipher->algorithm_mkey;
1881         unsigned long alg_a = s->s3->tmp.new_cipher->algorithm_auth;
1882         if ((s->tlsext_ecpointformatlist != NULL) && (s->tlsext_ecpointformatlist_length > 0) &&
1883             (s->session->tlsext_ecpointformatlist != NULL) && (s->session->tlsext_ecpointformatlist_length > 0) &&
1884             ((alg_k & (SSL_kEECDH|SSL_kECDHr|SSL_kECDHe)) || (alg_a & SSL_aECDSA)))
1885                 {
1886                 /* we are using an ECC cipher */
1887                 size_t i;
1888                 unsigned char *list;
1889                 int found_uncompressed = 0;
1890                 list = s->session->tlsext_ecpointformatlist;
1891                 for (i = 0; i < s->session->tlsext_ecpointformatlist_length; i++)
1892                         {
1893                         if (*(list++) == TLSEXT_ECPOINTFORMAT_uncompressed)
1894                                 {
1895                                 found_uncompressed = 1;
1896                                 break;
1897                                 }
1898                         }
1899                 if (!found_uncompressed)
1900                         {
1901                         SSLerr(SSL_F_SSL_CHECK_SERVERHELLO_TLSEXT,SSL_R_TLS_INVALID_ECPOINTFORMAT_LIST);
1902                         return -1;
1903                         }
1904                 }
1905         ret = SSL_TLSEXT_ERR_OK;
1906 #endif /* OPENSSL_NO_EC */
1907
1908         if (s->ctx != NULL && s->ctx->tlsext_servername_callback != 0)
1909                 ret = s->ctx->tlsext_servername_callback(s, &al, s->ctx->tlsext_servername_arg);
1910         else if (s->initial_ctx != NULL && s->initial_ctx->tlsext_servername_callback != 0)
1911                 ret = s->initial_ctx->tlsext_servername_callback(s, &al, s->initial_ctx->tlsext_servername_arg);
1912
1913 #ifdef TLSEXT_TYPE_opaque_prf_input
1914         if (s->s3->server_opaque_prf_input_len > 0)
1915                 {
1916                 /* This case may indicate that we, as a client, want to insist on using opaque PRF inputs.
1917                  * So first verify that we really have a value from the server too. */
1918
1919                 if (s->s3->server_opaque_prf_input == NULL)
1920                         {
1921                         ret = SSL_TLSEXT_ERR_ALERT_FATAL;
1922                         al = SSL_AD_HANDSHAKE_FAILURE;
1923                         }
1924
1925                 /* Anytime the server *has* sent an opaque PRF input, we need to check
1926                  * that we have a client opaque PRF input of the same size. */
1927                 if (s->s3->client_opaque_prf_input == NULL ||
1928                     s->s3->client_opaque_prf_input_len != s->s3->server_opaque_prf_input_len)
1929                         {
1930                         ret = SSL_TLSEXT_ERR_ALERT_FATAL;
1931                         al = SSL_AD_ILLEGAL_PARAMETER;
1932                         }
1933                 }
1934 #endif
1935
1936         /* If we've requested certificate status and we wont get one
1937          * tell the callback
1938          */
1939         if ((s->tlsext_status_type != -1) && !(s->tlsext_status_expected)
1940                         && s->ctx && s->ctx->tlsext_status_cb)
1941                 {
1942                 int r;
1943                 /* Set resp to NULL, resplen to -1 so callback knows
1944                  * there is no response.
1945                  */
1946                 if (s->tlsext_ocsp_resp)
1947                         {
1948                         OPENSSL_free(s->tlsext_ocsp_resp);
1949                         s->tlsext_ocsp_resp = NULL;
1950                         }
1951                 s->tlsext_ocsp_resplen = -1;
1952                 r = s->ctx->tlsext_status_cb(s, s->ctx->tlsext_status_arg);
1953                 if (r == 0)
1954                         {
1955                         al = SSL_AD_BAD_CERTIFICATE_STATUS_RESPONSE;
1956                         ret = SSL_TLSEXT_ERR_ALERT_FATAL;
1957                         }
1958                 if (r < 0)
1959                         {
1960                         al = SSL_AD_INTERNAL_ERROR;
1961                         ret = SSL_TLSEXT_ERR_ALERT_FATAL;
1962                         }
1963                 }
1964
1965         switch (ret)
1966                 {
1967                 case SSL_TLSEXT_ERR_ALERT_FATAL:
1968                         ssl3_send_alert(s,SSL3_AL_FATAL,al);
1969                         return -1;
1970
1971                 case SSL_TLSEXT_ERR_ALERT_WARNING:
1972                         ssl3_send_alert(s,SSL3_AL_WARNING,al);
1973                         return 1;
1974
1975                 case SSL_TLSEXT_ERR_NOACK:
1976                         s->servername_done=0;
1977                         default:
1978                 return 1;
1979                 }
1980         }
1981
1982 /* Since the server cache lookup is done early on in the processing of the
1983  * ClientHello, and other operations depend on the result, we need to handle
1984  * any TLS session ticket extension at the same time.
1985  *
1986  *   session_id: points at the session ID in the ClientHello. This code will
1987  *       read past the end of this in order to parse out the session ticket
1988  *       extension, if any.
1989  *   len: the length of the session ID.
1990  *   limit: a pointer to the first byte after the ClientHello.
1991  *   ret: (output) on return, if a ticket was decrypted, then this is set to
1992  *       point to the resulting session.
1993  *
1994  * If s->tls_session_secret_cb is set then we are expecting a pre-shared key
1995  * ciphersuite, in which case we have no use for session tickets and one will
1996  * never be decrypted, nor will s->tlsext_ticket_expected be set to 1.
1997  *
1998  * Returns:
1999  *   -1: fatal error, either from parsing or decrypting the ticket.
2000  *    0: no ticket was found (or was ignored, based on settings).
2001  *    1: a zero length extension was found, indicating that the client supports
2002  *       session tickets but doesn't currently have one to offer.
2003  *    2: either s->tls_session_secret_cb was set, or a ticket was offered but
2004  *       couldn't be decrypted because of a non-fatal error.
2005  *    3: a ticket was successfully decrypted and *ret was set.
2006  *
2007  * Side effects:
2008  *   Sets s->tlsext_ticket_expected to 1 if the server will have to issue
2009  *   a new session ticket to the client because the client indicated support
2010  *   (and s->tls_session_secret_cb is NULL) but the client either doesn't have
2011  *   a session ticket or we couldn't use the one it gave us, or if
2012  *   s->ctx->tlsext_ticket_key_cb asked to renew the client's ticket.
2013  *   Otherwise, s->tlsext_ticket_expected is set to 0.
2014  */
2015 int tls1_process_ticket(SSL *s, unsigned char *session_id, int len,
2016                         const unsigned char *limit, SSL_SESSION **ret)
2017         {
2018         /* Point after session ID in client hello */
2019         const unsigned char *p = session_id + len;
2020         unsigned short i;
2021
2022         *ret = NULL;
2023         s->tlsext_ticket_expected = 0;
2024
2025         /* If tickets disabled behave as if no ticket present
2026          * to permit stateful resumption.
2027          */
2028         if (SSL_get_options(s) & SSL_OP_NO_TICKET)
2029                 return 0;
2030         if ((s->version <= SSL3_VERSION) || !limit)
2031                 return 0;
2032         if (p >= limit)
2033                 return -1;
2034         /* Skip past DTLS cookie */
2035         if (s->version == DTLS1_VERSION || s->version == DTLS1_BAD_VER)
2036                 {
2037                 i = *(p++);
2038                 p+= i;
2039                 if (p >= limit)
2040                         return -1;
2041                 }
2042         /* Skip past cipher list */
2043         n2s(p, i);
2044         p+= i;
2045         if (p >= limit)
2046                 return -1;
2047         /* Skip past compression algorithm list */
2048         i = *(p++);
2049         p += i;
2050         if (p > limit)
2051                 return -1;
2052         /* Now at start of extensions */
2053         if ((p + 2) >= limit)
2054                 return 0;
2055         n2s(p, i);
2056         while ((p + 4) <= limit)
2057                 {
2058                 unsigned short type, size;
2059                 n2s(p, type);
2060                 n2s(p, size);
2061                 if (p + size > limit)
2062                         return 0;
2063                 if (type == TLSEXT_TYPE_session_ticket)
2064                         {
2065                         int r;
2066                         if (size == 0)
2067                                 {
2068                                 /* The client will accept a ticket but doesn't
2069                                  * currently have one. */
2070                                 s->tlsext_ticket_expected = 1;
2071                                 return 1;
2072                                 }
2073                         if (s->tls_session_secret_cb)
2074                                 {
2075                                 /* Indicate that the ticket couldn't be
2076                                  * decrypted rather than generating the session
2077                                  * from ticket now, trigger abbreviated
2078                                  * handshake based on external mechanism to
2079                                  * calculate the master secret later. */
2080                                 return 2;
2081                                 }
2082                         r = tls_decrypt_ticket(s, p, size, session_id, len, ret);
2083                         switch (r)
2084                                 {
2085                                 case 2: /* ticket couldn't be decrypted */
2086                                         s->tlsext_ticket_expected = 1;
2087                                         return 2;
2088                                 case 3: /* ticket was decrypted */
2089                                         return r;
2090                                 case 4: /* ticket decrypted but need to renew */
2091                                         s->tlsext_ticket_expected = 1;
2092                                         return 3;
2093                                 default: /* fatal error */
2094                                         return -1;
2095                                 }
2096                         }
2097                 p += size;
2098                 }
2099         return 0;
2100         }
2101
2102 /* tls_decrypt_ticket attempts to decrypt a session ticket.
2103  *
2104  *   etick: points to the body of the session ticket extension.
2105  *   eticklen: the length of the session tickets extenion.
2106  *   sess_id: points at the session ID.
2107  *   sesslen: the length of the session ID.
2108  *   psess: (output) on return, if a ticket was decrypted, then this is set to
2109  *       point to the resulting session.
2110  *
2111  * Returns:
2112  *   -1: fatal error, either from parsing or decrypting the ticket.
2113  *    2: the ticket couldn't be decrypted.
2114  *    3: a ticket was successfully decrypted and *psess was set.
2115  *    4: same as 3, but the ticket needs to be renewed.
2116  */
2117 static int tls_decrypt_ticket(SSL *s, const unsigned char *etick, int eticklen,
2118                                 const unsigned char *sess_id, int sesslen,
2119                                 SSL_SESSION **psess)
2120         {
2121         SSL_SESSION *sess;
2122         unsigned char *sdec;
2123         const unsigned char *p;
2124         int slen, mlen, renew_ticket = 0;
2125         unsigned char tick_hmac[EVP_MAX_MD_SIZE];
2126         HMAC_CTX hctx;
2127         EVP_CIPHER_CTX ctx;
2128         SSL_CTX *tctx = s->initial_ctx;
2129         /* Need at least keyname + iv + some encrypted data */
2130         if (eticklen < 48)
2131                 return 2;
2132         /* Initialize session ticket encryption and HMAC contexts */
2133         HMAC_CTX_init(&hctx);
2134         EVP_CIPHER_CTX_init(&ctx);
2135         if (tctx->tlsext_ticket_key_cb)
2136                 {
2137                 unsigned char *nctick = (unsigned char *)etick;
2138                 int rv = tctx->tlsext_ticket_key_cb(s, nctick, nctick + 16,
2139                                                         &ctx, &hctx, 0);
2140                 if (rv < 0)
2141                         return -1;
2142                 if (rv == 0)
2143                         return 2;
2144                 if (rv == 2)
2145                         renew_ticket = 1;
2146                 }
2147         else
2148                 {
2149                 /* Check key name matches */
2150                 if (memcmp(etick, tctx->tlsext_tick_key_name, 16))
2151                         return 2;
2152                 HMAC_Init_ex(&hctx, tctx->tlsext_tick_hmac_key, 16,
2153                                         tlsext_tick_md(), NULL);
2154                 EVP_DecryptInit_ex(&ctx, EVP_aes_128_cbc(), NULL,
2155                                 tctx->tlsext_tick_aes_key, etick + 16);
2156                 }
2157         /* Attempt to process session ticket, first conduct sanity and
2158          * integrity checks on ticket.
2159          */
2160         mlen = HMAC_size(&hctx);
2161         if (mlen < 0)
2162                 {
2163                 EVP_CIPHER_CTX_cleanup(&ctx);
2164                 return -1;
2165                 }
2166         eticklen -= mlen;
2167         /* Check HMAC of encrypted ticket */
2168         HMAC_Update(&hctx, etick, eticklen);
2169         HMAC_Final(&hctx, tick_hmac, NULL);
2170         HMAC_CTX_cleanup(&hctx);
2171         if (memcmp(tick_hmac, etick + eticklen, mlen))
2172                 return 2;
2173         /* Attempt to decrypt session data */
2174         /* Move p after IV to start of encrypted ticket, update length */
2175         p = etick + 16 + EVP_CIPHER_CTX_iv_length(&ctx);
2176         eticklen -= 16 + EVP_CIPHER_CTX_iv_length(&ctx);
2177         sdec = OPENSSL_malloc(eticklen);
2178         if (!sdec)
2179                 {
2180                 EVP_CIPHER_CTX_cleanup(&ctx);
2181                 return -1;
2182                 }
2183         EVP_DecryptUpdate(&ctx, sdec, &slen, p, eticklen);
2184         if (EVP_DecryptFinal(&ctx, sdec + slen, &mlen) <= 0)
2185                 return 2;
2186         slen += mlen;
2187         EVP_CIPHER_CTX_cleanup(&ctx);
2188         p = sdec;
2189
2190         sess = d2i_SSL_SESSION(NULL, &p, slen);
2191         OPENSSL_free(sdec);
2192         if (sess)
2193                 {
2194                 /* The session ID, if non-empty, is used by some clients to
2195                  * detect that the ticket has been accepted. So we copy it to
2196                  * the session structure. If it is empty set length to zero
2197                  * as required by standard.
2198                  */
2199                 if (sesslen)
2200                         memcpy(sess->session_id, sess_id, sesslen);
2201                 sess->session_id_length = sesslen;
2202                 *psess = sess;
2203                 if (renew_ticket)
2204                         return 4;
2205                 else
2206                         return 3;
2207                 }
2208         ERR_clear_error();
2209         /* For session parse failure, indicate that we need to send a new
2210          * ticket. */
2211         return 2;
2212         }
2213
2214 /* Tables to translate from NIDs to TLS v1.2 ids */
2215
2216 typedef struct
2217         {
2218         int nid;
2219         int id;
2220         } tls12_lookup;
2221
2222 static tls12_lookup tls12_md[] = {
2223 #ifndef OPENSSL_NO_MD5
2224         {NID_md5, TLSEXT_hash_md5},
2225 #endif
2226 #ifndef OPENSSL_NO_SHA
2227         {NID_sha1, TLSEXT_hash_sha1},
2228 #endif
2229 #ifndef OPENSSL_NO_SHA256
2230         {NID_sha224, TLSEXT_hash_sha224},
2231         {NID_sha256, TLSEXT_hash_sha256},
2232 #endif
2233 #ifndef OPENSSL_NO_SHA512
2234         {NID_sha384, TLSEXT_hash_sha384},
2235         {NID_sha512, TLSEXT_hash_sha512}
2236 #endif
2237 };
2238
2239 static tls12_lookup tls12_sig[] = {
2240 #ifndef OPENSSL_NO_RSA
2241         {EVP_PKEY_RSA, TLSEXT_signature_rsa},
2242 #endif
2243 #ifndef OPENSSL_NO_RSA
2244         {EVP_PKEY_DSA, TLSEXT_signature_dsa},
2245 #endif
2246 #ifndef OPENSSL_NO_ECDSA
2247         {EVP_PKEY_EC, TLSEXT_signature_ecdsa}
2248 #endif
2249 };
2250
2251 static int tls12_find_id(int nid, tls12_lookup *table, size_t tlen)
2252         {
2253         size_t i;
2254         for (i = 0; i < tlen; i++)
2255                 {
2256                 if (table[i].nid == nid)
2257                         return table[i].id;
2258                 }
2259         return -1;
2260         }
2261 #if 0
2262 static int tls12_find_nid(int id, tls12_lookup *table, size_t tlen)
2263         {
2264         size_t i;
2265         for (i = 0; i < tlen; i++)
2266                 {
2267                 if (table[i].id == id)
2268                         return table[i].nid;
2269                 }
2270         return -1;
2271         }
2272 #endif
2273
2274 int tls12_get_sigandhash(unsigned char *p, const EVP_PKEY *pk, const EVP_MD *md)
2275         {
2276         int sig_id, md_id;
2277         md_id = tls12_find_id(EVP_MD_type(md), tls12_md,
2278                                 sizeof(tls12_md)/sizeof(tls12_lookup));
2279         if (md_id == -1)
2280                 return 0;
2281         sig_id = tls12_get_sigid(pk);
2282         if (sig_id == -1)
2283                 return 0;
2284         p[0] = (unsigned char)md_id;
2285         p[1] = (unsigned char)sig_id;
2286         return 1;
2287         }
2288
2289 int tls12_get_sigid(const EVP_PKEY *pk)
2290         {
2291         return tls12_find_id(pk->type, tls12_sig,
2292                                 sizeof(tls12_sig)/sizeof(tls12_lookup));
2293         }
2294
2295 const EVP_MD *tls12_get_hash(unsigned char hash_alg)
2296         {
2297         switch(hash_alg)
2298                 {
2299 #ifndef OPENSSL_NO_MD5
2300                 case TLSEXT_hash_md5:
2301 #ifdef OPENSSL_FIPS
2302                 if (FIPS_mode())
2303                         return NULL;
2304 #endif
2305                 return EVP_md5();
2306 #endif
2307 #ifndef OPENSSL_NO_SHA
2308                 case TLSEXT_hash_sha1:
2309                 return EVP_sha1();
2310 #endif
2311 #ifndef OPENSSL_NO_SHA256
2312                 case TLSEXT_hash_sha224:
2313                 return EVP_sha224();
2314
2315                 case TLSEXT_hash_sha256:
2316                 return EVP_sha256();
2317 #endif
2318 #ifndef OPENSSL_NO_SHA512
2319                 case TLSEXT_hash_sha384:
2320                 return EVP_sha384();
2321
2322                 case TLSEXT_hash_sha512:
2323                 return EVP_sha512();
2324 #endif
2325                 default:
2326                 return NULL;
2327
2328                 }
2329         }
2330
2331 /* Set preferred digest for each key type */
2332
2333 int tls1_process_sigalgs(SSL *s, const unsigned char *data, int dsize)
2334         {
2335         int i, idx;
2336         const EVP_MD *md;
2337         CERT *c = s->cert;
2338         /* Extension ignored for TLS versions below 1.2 */
2339         if (TLS1_get_version(s) < TLS1_2_VERSION)
2340                 return 1;
2341         /* Should never happen */
2342         if (!c)
2343                 return 0;
2344
2345         c->pkeys[SSL_PKEY_DSA_SIGN].digest = NULL;
2346         c->pkeys[SSL_PKEY_RSA_SIGN].digest = NULL;
2347         c->pkeys[SSL_PKEY_RSA_ENC].digest = NULL;
2348         c->pkeys[SSL_PKEY_ECC].digest = NULL;
2349
2350         for (i = 0; i < dsize; i += 2)
2351                 {
2352                 unsigned char hash_alg = data[i], sig_alg = data[i+1];
2353
2354                 switch(sig_alg)
2355                         {
2356 #ifndef OPENSSL_NO_RSA
2357                         case TLSEXT_signature_rsa:
2358                         idx = SSL_PKEY_RSA_SIGN;
2359                         break;
2360 #endif
2361 #ifndef OPENSSL_NO_DSA
2362                         case TLSEXT_signature_dsa:
2363                         idx = SSL_PKEY_DSA_SIGN;
2364                         break;
2365 #endif
2366 #ifndef OPENSSL_NO_ECDSA
2367                         case TLSEXT_signature_ecdsa:
2368                         idx = SSL_PKEY_ECC;
2369                         break;
2370 #endif
2371                         default:
2372                         continue;
2373                         }
2374
2375                 if (c->pkeys[idx].digest == NULL)
2376                         {
2377                         md = tls12_get_hash(hash_alg);
2378                         if (md)
2379                                 {
2380                                 c->pkeys[idx].digest = md;
2381                                 if (idx == SSL_PKEY_RSA_SIGN)
2382                                         c->pkeys[SSL_PKEY_RSA_ENC].digest = md;
2383                                 }
2384                         }
2385
2386                 }
2387
2388
2389         /* Set any remaining keys to default values. NOTE: if alg is not
2390          * supported it stays as NULL.
2391          */
2392 #ifndef OPENSSL_NO_DSA
2393         if (!c->pkeys[SSL_PKEY_DSA_SIGN].digest)
2394                 c->pkeys[SSL_PKEY_DSA_SIGN].digest = EVP_dss1();
2395 #endif
2396 #ifndef OPENSSL_NO_RSA
2397         if (!c->pkeys[SSL_PKEY_RSA_SIGN].digest)
2398                 {
2399                 c->pkeys[SSL_PKEY_RSA_SIGN].digest = EVP_sha1();
2400                 c->pkeys[SSL_PKEY_RSA_ENC].digest = EVP_sha1();
2401                 }
2402 #endif
2403 #ifndef OPENSSL_NO_ECDSA
2404         if (!c->pkeys[SSL_PKEY_ECC].digest)
2405                 c->pkeys[SSL_PKEY_ECC].digest = EVP_ecdsa();
2406 #endif
2407         return 1;
2408         }
2409
2410 #endif
2411
2412 #ifndef OPENSSL_NO_HEARTBEATS
2413 int
2414 tls1_process_heartbeat(SSL *s)
2415         {
2416         unsigned char *p = &s->s3->rrec.data[0], *pl;
2417         unsigned short hbtype;
2418         unsigned int payload;
2419         unsigned int padding = 16; /* Use minimum padding */
2420
2421         /* Read type and payload length first */
2422         hbtype = *p++;
2423         n2s(p, payload);
2424         pl = p;
2425
2426         if (s->msg_callback)
2427                 s->msg_callback(0, s->version, TLS1_RT_HEARTBEAT,
2428                         &s->s3->rrec.data[0], s->s3->rrec.length,
2429                         s, s->msg_callback_arg);
2430
2431         if (hbtype == TLS1_HB_REQUEST)
2432                 {
2433                 unsigned char *buffer, *bp;
2434                 int r;
2435
2436                 /* Allocate memory for the response, size is 1 bytes
2437                  * message type, plus 2 bytes payload length, plus
2438                  * payload, plus padding
2439                  */
2440                 buffer = OPENSSL_malloc(1 + 2 + payload + padding);
2441                 bp = buffer;
2442
2443                 /* Enter response type, length and copy payload */
2444                 *bp++ = TLS1_HB_RESPONSE;
2445                 s2n(payload, bp);
2446                 memcpy(bp, pl, payload);
2447
2448                 r = ssl3_write_bytes(s, TLS1_RT_HEARTBEAT, buffer, 3 + payload + padding);
2449
2450                 if (r >= 0 && s->msg_callback)
2451                         s->msg_callback(1, s->version, TLS1_RT_HEARTBEAT,
2452                                 buffer, 3 + payload + padding,
2453                                 s, s->msg_callback_arg);
2454
2455                 OPENSSL_free(buffer);
2456
2457                 if (r < 0)
2458                         return r;
2459                 }
2460         else if (hbtype == TLS1_HB_RESPONSE)
2461                 {
2462                 unsigned int seq;
2463
2464                 /* We only send sequence numbers (2 bytes unsigned int),
2465                  * and 16 random bytes, so we just try to read the
2466                  * sequence number */
2467                 n2s(pl, seq);
2468
2469                 if (payload == 18 && seq == s->tlsext_hb_seq)
2470                         {
2471                         s->tlsext_hb_seq++;
2472                         s->tlsext_hb_pending = 0;
2473                         }
2474                 }
2475
2476         return 0;
2477         }
2478
2479 int
2480 tls1_heartbeat(SSL *s)
2481         {
2482         unsigned char *buf, *p;
2483         int ret;
2484         unsigned int payload = 18; /* Sequence number + random bytes */
2485         unsigned int padding = 16; /* Use minimum padding */
2486
2487         /* Only send if peer supports and accepts HB requests... */
2488         if (!(s->tlsext_heartbeat & SSL_TLSEXT_HB_ENABLED) ||
2489             s->tlsext_heartbeat & SSL_TLSEXT_HB_DONT_SEND_REQUESTS)
2490                 {
2491                 SSLerr(SSL_F_TLS1_HEARTBEAT,SSL_R_TLS_HEARTBEAT_PEER_DOESNT_ACCEPT);
2492                 return -1;
2493                 }
2494
2495         /* ...and there is none in flight yet... */
2496         if (s->tlsext_hb_pending)
2497                 {
2498                 SSLerr(SSL_F_TLS1_HEARTBEAT,SSL_R_TLS_HEARTBEAT_PENDING);
2499                 return -1;
2500                 }
2501
2502         /* ...and no handshake in progress. */
2503         if (SSL_in_init(s) || s->in_handshake)
2504                 {
2505                 SSLerr(SSL_F_TLS1_HEARTBEAT,SSL_R_UNEXPECTED_MESSAGE);
2506                 return -1;
2507                 }
2508
2509         /* Check if padding is too long, payload and padding
2510          * must not exceed 2^14 - 3 = 16381 bytes in total.
2511          */
2512         OPENSSL_assert(payload + padding <= 16381);
2513
2514         /* Create HeartBeat message, we just use a sequence number
2515          * as payload to distuingish different messages and add
2516          * some random stuff.
2517          *  - Message Type, 1 byte
2518          *  - Payload Length, 2 bytes (unsigned int)
2519          *  - Payload, the sequence number (2 bytes uint)
2520          *  - Payload, random bytes (16 bytes uint)
2521          *  - Padding
2522          */
2523         buf = OPENSSL_malloc(1 + 2 + payload + padding);
2524         p = buf;
2525         /* Message Type */
2526         *p++ = TLS1_HB_REQUEST;
2527         /* Payload length (18 bytes here) */
2528         s2n(payload, p);
2529         /* Sequence number */
2530         s2n(s->tlsext_hb_seq, p);
2531         /* 16 random bytes */
2532         RAND_pseudo_bytes(p, 16);
2533         p += 16;
2534         /* Random padding */
2535         RAND_pseudo_bytes(p, padding);
2536
2537         ret = ssl3_write_bytes(s, TLS1_RT_HEARTBEAT, buf, 3 + payload + padding);
2538         if (ret >= 0)
2539                 {
2540                 if (s->msg_callback)
2541                         s->msg_callback(1, s->version, TLS1_RT_HEARTBEAT,
2542                                 buf, 3 + payload + padding,
2543                                 s, s->msg_callback_arg);
2544
2545                 s->tlsext_hb_pending = 1;
2546                 }
2547
2548         OPENSSL_free(buf);
2549
2550         return ret;
2551         }
2552 #endif