ssl/t1_lib.c

   1 /* ssl/t1_lib.c */
   2 /* Copyright (C) 1995-1998 Eric Young (eay@cryptsoft.com)
   3  * All rights reserved.
   4  *
   5  * This package is an SSL implementation written
   6  * by Eric Young (eay@cryptsoft.com).
   7  * The implementation was written so as to conform with Netscapes SSL.
   8  *
   9  * This library is free for commercial and non-commercial use as long as
  10  * the following conditions are aheared to.  The following conditions
  11  * apply to all code found in this distribution, be it the RC4, RSA,
  12  * lhash, DES, etc., code; not just the SSL code.  The SSL documentation
  13  * included with this distribution is covered by the same copyright terms
  14  * except that the holder is Tim Hudson (tjh@cryptsoft.com).
  15  *
  16  * Copyright remains Eric Young's, and as such any Copyright notices in
  17  * the code are not to be removed.
  18  * If this package is used in a product, Eric Young should be given attribution
  19  * as the author of the parts of the library used.
  20  * This can be in the form of a textual message at program startup or
  21  * in documentation (online or textual) provided with the package.
  22  *
  23  * Redistribution and use in source and binary forms, with or without
  24  * modification, are permitted provided that the following conditions
  25  * are met:
  26  * 1. Redistributions of source code must retain the copyright
  27  *    notice, this list of conditions and the following disclaimer.
  28  * 2. Redistributions in binary form must reproduce the above copyright
  29  *    notice, this list of conditions and the following disclaimer in the
  30  *    documentation and/or other materials provided with the distribution.
  31  * 3. All advertising materials mentioning features or use of this software
  32  *    must display the following acknowledgement:
  33  *    "This product includes cryptographic software written by
  34  *     Eric Young (eay@cryptsoft.com)"
  35  *    The word 'cryptographic' can be left out if the rouines from the library
  36  *    being used are not cryptographic related :-).
  37  * 4. If you include any Windows specific code (or a derivative thereof) from
  38  *    the apps directory (application code) you must include an acknowledgement:
  39  *    "This product includes software written by Tim Hudson (tjh@cryptsoft.com)"
  40  *
  41  * THIS SOFTWARE IS PROVIDED BY ERIC YOUNG ``AS IS'' AND
  42  * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
  43  * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
  44  * ARE DISCLAIMED.  IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE
  45  * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
  46  * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
  47  * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
  48  * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
  49  * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
  50  * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
  51  * SUCH DAMAGE.
  52  *
  53  * The licence and distribution terms for any publically available version or
  54  * derivative of this code cannot be changed.  i.e. this code cannot simply be
  55  * copied and put under another distribution licence
  56  * [including the GNU Public Licence.]
  57  */
  58 /* ====================================================================
  59  * Copyright (c) 1998-2007 The OpenSSL Project.  All rights reserved.
  60  *
  61  * Redistribution and use in source and binary forms, with or without
  62  * modification, are permitted provided that the following conditions
  63  * are met:
  64  *
  65  * 1. Redistributions of source code must retain the above copyright
  66  *    notice, this list of conditions and the following disclaimer.
  67  *
  68  * 2. Redistributions in binary form must reproduce the above copyright
  69  *    notice, this list of conditions and the following disclaimer in
  70  *    the documentation and/or other materials provided with the
  71  *    distribution.
  72  *
  73  * 3. All advertising materials mentioning features or use of this
  74  *    software must display the following acknowledgment:
  75  *    "This product includes software developed by the OpenSSL Project
  76  *    for use in the OpenSSL Toolkit. (http://www.openssl.org/)"
  77  *
  78  * 4. The names "OpenSSL Toolkit" and "OpenSSL Project" must not be used to
  79  *    endorse or promote products derived from this software without
  80  *    prior written permission. For written permission, please contact
  81  *    openssl-core@openssl.org.
  82  *
  83  * 5. Products derived from this software may not be called "OpenSSL"
  84  *    nor may "OpenSSL" appear in their names without prior written
  85  *    permission of the OpenSSL Project.
  86  *
  87  * 6. Redistributions of any form whatsoever must retain the following
  88  *    acknowledgment:
  89  *    "This product includes software developed by the OpenSSL Project
  90  *    for use in the OpenSSL Toolkit (http://www.openssl.org/)"
  91  *
  92  * THIS SOFTWARE IS PROVIDED BY THE OpenSSL PROJECT ``AS IS'' AND ANY
  93  * EXPRESSED OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
  94  * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
  95  * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL THE OpenSSL PROJECT OR
  96  * ITS CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
  97  * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
  98  * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
  99  * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
 100  * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT,
 101  * STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
 102  * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED
 103  * OF THE POSSIBILITY OF SUCH DAMAGE.
 104  * ====================================================================
 105  *
 106  * This product includes cryptographic software written by Eric Young
 107  * (eay@cryptsoft.com).  This product includes software written by Tim
 108  * Hudson (tjh@cryptsoft.com).
 109  *
 110  */
 111
 112 #include <stdio.h>
 113 #include <openssl/objects.h>
 114 #include <openssl/evp.h>
 115 #include <openssl/hmac.h>
 116 #include <openssl/ocsp.h>
 117 #include "ssl_locl.h"
 118
 119 const char tls1_version_str[]="TLSv1" OPENSSL_VERSION_PTEXT;
 120
 121 #ifndef OPENSSL_NO_TLSEXT
 122 static int tls_decrypt_ticket(SSL *s, const unsigned char *tick, int ticklen,
 123                                 const unsigned char *sess_id, int sesslen,
 124                                 SSL_SESSION **psess);
 125 #endif
 126
 127 SSL3_ENC_METHOD TLSv1_enc_data={
 128         tls1_enc,
 129         tls1_mac,
 130         tls1_setup_key_block,
 131         tls1_generate_master_secret,
 132         tls1_change_cipher_state,
 133         tls1_final_finish_mac,
 134         TLS1_FINISH_MAC_LENGTH,
 135         tls1_cert_verify_mac,
 136         TLS_MD_CLIENT_FINISH_CONST,TLS_MD_CLIENT_FINISH_CONST_SIZE,
 137         TLS_MD_SERVER_FINISH_CONST,TLS_MD_SERVER_FINISH_CONST_SIZE,
 138         tls1_alert_code,
 139         };
 140
 141 long tls1_default_timeout(void)
 142         {
 143         /* 2 hours, the 24 hours mentioned in the TLSv1 spec
 144          * is way too long for http, the cache would over fill */
 145         return(60*60*2);
 146         }
 147
 148 int tls1_new(SSL *s)
 149         {
 150         if (!ssl3_new(s)) return(0);
 151         s->method->ssl_clear(s);
 152         return(1);
 153         }
 154
 155 void tls1_free(SSL *s)
 156         {
 157 #ifndef OPENSSL_NO_TLSEXT
 158         if (s->tlsext_session_ticket)
 159                 {
 160                 OPENSSL_free(s->tlsext_session_ticket);
 161                 }
 162 #endif /* OPENSSL_NO_TLSEXT */
 163         ssl3_free(s);
 164         }
 165
 166 void tls1_clear(SSL *s)
 167         {
 168         ssl3_clear(s);
 169         s->version=TLS1_VERSION;
 170         }
 171
 172 #ifndef OPENSSL_NO_EC
 173 static int nid_list[] =
 174         {
 175                 NID_sect163k1, /* sect163k1 (1) */
 176                 NID_sect163r1, /* sect163r1 (2) */
 177                 NID_sect163r2, /* sect163r2 (3) */
 178                 NID_sect193r1, /* sect193r1 (4) */
 179                 NID_sect193r2, /* sect193r2 (5) */
 180                 NID_sect233k1, /* sect233k1 (6) */
 181                 NID_sect233r1, /* sect233r1 (7) */
 182                 NID_sect239k1, /* sect239k1 (8) */
 183                 NID_sect283k1, /* sect283k1 (9) */
 184                 NID_sect283r1, /* sect283r1 (10) */
 185                 NID_sect409k1, /* sect409k1 (11) */
 186                 NID_sect409r1, /* sect409r1 (12) */
 187                 NID_sect571k1, /* sect571k1 (13) */
 188                 NID_sect571r1, /* sect571r1 (14) */
 189                 NID_secp160k1, /* secp160k1 (15) */
 190                 NID_secp160r1, /* secp160r1 (16) */
 191                 NID_secp160r2, /* secp160r2 (17) */
 192                 NID_secp192k1, /* secp192k1 (18) */
 193                 NID_X9_62_prime192v1, /* secp192r1 (19) */
 194                 NID_secp224k1, /* secp224k1 (20) */
 195                 NID_secp224r1, /* secp224r1 (21) */
 196                 NID_secp256k1, /* secp256k1 (22) */
 197                 NID_X9_62_prime256v1, /* secp256r1 (23) */
 198                 NID_secp384r1, /* secp384r1 (24) */
 199                 NID_secp521r1  /* secp521r1 (25) */
 200         };
 201
 202 int tls1_ec_curve_id2nid(int curve_id)
 203         {
 204         /* ECC curves from draft-ietf-tls-ecc-12.txt (Oct. 17, 2005) */
 205         if ((curve_id < 1) || ((unsigned int)curve_id >
 206                                 sizeof(nid_list)/sizeof(nid_list[0])))
 207                 return 0;
 208         return nid_list[curve_id-1];
 209         }
 210
 211 int tls1_ec_nid2curve_id(int nid)
 212         {
 213         /* ECC curves from draft-ietf-tls-ecc-12.txt (Oct. 17, 2005) */
 214         switch (nid)
 215                 {
 216         case NID_sect163k1: /* sect163k1 (1) */
 217                 return 1;
 218         case NID_sect163r1: /* sect163r1 (2) */
 219                 return 2;
 220         case NID_sect163r2: /* sect163r2 (3) */
 221                 return 3;
 222         case NID_sect193r1: /* sect193r1 (4) */
 223                 return 4;
 224         case NID_sect193r2: /* sect193r2 (5) */
 225                 return 5;
 226         case NID_sect233k1: /* sect233k1 (6) */
 227                 return 6;
 228         case NID_sect233r1: /* sect233r1 (7) */
 229                 return 7;
 230         case NID_sect239k1: /* sect239k1 (8) */
 231                 return 8;
 232         case NID_sect283k1: /* sect283k1 (9) */
 233                 return 9;
 234         case NID_sect283r1: /* sect283r1 (10) */
 235                 return 10;
 236         case NID_sect409k1: /* sect409k1 (11) */
 237                 return 11;
 238         case NID_sect409r1: /* sect409r1 (12) */
 239                 return 12;
 240         case NID_sect571k1: /* sect571k1 (13) */
 241                 return 13;
 242         case NID_sect571r1: /* sect571r1 (14) */
 243                 return 14;
 244         case NID_secp160k1: /* secp160k1 (15) */
 245                 return 15;
 246         case NID_secp160r1: /* secp160r1 (16) */
 247                 return 16;
 248         case NID_secp160r2: /* secp160r2 (17) */
 249                 return 17;
 250         case NID_secp192k1: /* secp192k1 (18) */
 251                 return 18;
 252         case NID_X9_62_prime192v1: /* secp192r1 (19) */
 253                 return 19;
 254         case NID_secp224k1: /* secp224k1 (20) */
 255                 return 20;
 256         case NID_secp224r1: /* secp224r1 (21) */
 257                 return 21;
 258         case NID_secp256k1: /* secp256k1 (22) */
 259                 return 22;
 260         case NID_X9_62_prime256v1: /* secp256r1 (23) */
 261                 return 23;
 262         case NID_secp384r1: /* secp384r1 (24) */
 263                 return 24;
 264         case NID_secp521r1:  /* secp521r1 (25) */
 265                 return 25;
 266         default:
 267                 return 0;
 268                 }
 269         }
 270 #endif /* OPENSSL_NO_EC */
 271
 272 #ifndef OPENSSL_NO_TLSEXT
 273 unsigned char *ssl_add_clienthello_tlsext(SSL *s, unsigned char *p, unsigned char *limit)
 274         {
 275         int extdatalen=0;
 276         unsigned char *ret = p;
 277
 278         /* don't add extensions for SSLv3 */
 279         if (s->client_version == SSL3_VERSION)
 280                 return p;
 281
 282         ret+=2;
 283
 284         if (ret>=limit) return NULL; /* this really never occurs, but ... */
 285
 286         if (s->tlsext_hostname != NULL)
 287                 {
 288                 /* Add TLS extension servername to the Client Hello message */
 289                 unsigned long size_str;
 290                 long lenmax;
 291
 292                 /* check for enough space.
 293                    4 for the servername type and entension length
 294                    2 for servernamelist length
 295                    1 for the hostname type
 296                    2 for hostname length
 297                    + hostname length
 298                 */
 299
 300                 if ((lenmax = limit - ret - 9) < 0
 301                     || (size_str = strlen(s->tlsext_hostname)) > (unsigned long)lenmax)
 302                         return NULL;
 303
 304                 /* extension type and length */
 305                 s2n(TLSEXT_TYPE_server_name,ret);
 306                 s2n(size_str+5,ret);
 307
 308                 /* length of servername list */
 309                 s2n(size_str+3,ret);
 310
 311                 /* hostname type, length and hostname */
 312                 *(ret++) = (unsigned char) TLSEXT_NAMETYPE_host_name;
 313                 s2n(size_str,ret);
 314                 memcpy(ret, s->tlsext_hostname, size_str);
 315                 ret+=size_str;
 316                 }
 317
 318         /* Add the renegotiation option: TODOEKR switch */
 319         {
 320           int el;
 321
 322           if(!ssl_add_clienthello_renegotiate_ext(s, 0, &el, 0))
 323               {
 324               SSLerr(SSL_F_SSL_ADD_CLIENTHELLO_TLSEXT, ERR_R_INTERNAL_ERROR);
 325               return NULL;
 326               }
 327
 328           if((limit - p - 4 - el) < 0) return NULL;
 329
 330           s2n(TLSEXT_TYPE_renegotiate,ret);
 331           s2n(el,ret);
 332
 333           if(!ssl_add_clienthello_renegotiate_ext(s, ret, &el, el))
 334               {
 335               SSLerr(SSL_F_SSL_ADD_CLIENTHELLO_TLSEXT, ERR_R_INTERNAL_ERROR);
 336               return NULL;
 337               }
 338
 339           ret += el;
 340         }
 341
 342 #ifndef OPENSSL_NO_EC
 343         if (s->tlsext_ecpointformatlist != NULL)
 344                 {
 345                 /* Add TLS extension ECPointFormats to the ClientHello message */
 346                 long lenmax;
 347
 348                 if ((lenmax = limit - ret - 5) < 0) return NULL;
 349                 if (s->tlsext_ecpointformatlist_length > (unsigned long)lenmax) return NULL;
 350                 if (s->tlsext_ecpointformatlist_length > 255)
 351                         {
 352                         SSLerr(SSL_F_SSL_ADD_CLIENTHELLO_TLSEXT, ERR_R_INTERNAL_ERROR);
 353                         return NULL;
 354                         }
 355
 356                 s2n(TLSEXT_TYPE_ec_point_formats,ret);
 357                 s2n(s->tlsext_ecpointformatlist_length + 1,ret);
 358                 *(ret++) = (unsigned char) s->tlsext_ecpointformatlist_length;
 359                 memcpy(ret, s->tlsext_ecpointformatlist, s->tlsext_ecpointformatlist_length);
 360                 ret+=s->tlsext_ecpointformatlist_length;
 361                 }
 362         if (s->tlsext_ellipticcurvelist != NULL)
 363                 {
 364                 /* Add TLS extension EllipticCurves to the ClientHello message */
 365                 long lenmax;
 366
 367                 if ((lenmax = limit - ret - 6) < 0) return NULL;
 368                 if (s->tlsext_ellipticcurvelist_length > (unsigned long)lenmax) return NULL;
 369                 if (s->tlsext_ellipticcurvelist_length > 65532)
 370                         {
 371                         SSLerr(SSL_F_SSL_ADD_CLIENTHELLO_TLSEXT, ERR_R_INTERNAL_ERROR);
 372                         return NULL;
 373                         }
 374
 375                 s2n(TLSEXT_TYPE_elliptic_curves,ret);
 376                 s2n(s->tlsext_ellipticcurvelist_length + 2, ret);
 377
 378                 /* NB: draft-ietf-tls-ecc-12.txt uses a one-byte prefix for
 379                  * elliptic_curve_list, but the examples use two bytes.
 380                  * http://www1.ietf.org/mail-archive/web/tls/current/msg00538.html
 381                  * resolves this to two bytes.
 382                  */
 383                 s2n(s->tlsext_ellipticcurvelist_length, ret);
 384                 memcpy(ret, s->tlsext_ellipticcurvelist, s->tlsext_ellipticcurvelist_length);
 385                 ret+=s->tlsext_ellipticcurvelist_length;
 386                 }
 387 #endif /* OPENSSL_NO_EC */
 388
 389         if (!(SSL_get_options(s) & SSL_OP_NO_TICKET))
 390                 {
 391                 int ticklen;
 392                 if (!s->new_session && s->session && s->session->tlsext_tick)
 393                         ticklen = s->session->tlsext_ticklen;
 394                 else if (s->session && s->tlsext_session_ticket &&
 395                          s->tlsext_session_ticket->data)
 396                         {
 397                         ticklen = s->tlsext_session_ticket->length;
 398                         s->session->tlsext_tick = OPENSSL_malloc(ticklen);
 399                         if (!s->session->tlsext_tick)
 400                                 return NULL;
 401                         memcpy(s->session->tlsext_tick,
 402                                s->tlsext_session_ticket->data,
 403                                ticklen);
 404                         s->session->tlsext_ticklen = ticklen;
 405                         }
 406                 else
 407                         ticklen = 0;
 408                 if (ticklen == 0 && s->tlsext_session_ticket &&
 409                     s->tlsext_session_ticket->data == NULL)
 410                         goto skip_ext;
 411                 /* Check for enough room 2 for extension type, 2 for len
 412                  * rest for ticket
 413                  */
 414                 if ((long)(limit - ret - 4 - ticklen) < 0) return NULL;
 415                 s2n(TLSEXT_TYPE_session_ticket,ret);
 416                 s2n(ticklen,ret);
 417                 if (ticklen)
 418                         {
 419                         memcpy(ret, s->session->tlsext_tick, ticklen);
 420                         ret += ticklen;
 421                         }
 422                 }
 423                 skip_ext:
 424
 425 #ifdef TLSEXT_TYPE_opaque_prf_input
 426         if (s->s3->client_opaque_prf_input != NULL)
 427                 {
 428                 size_t col = s->s3->client_opaque_prf_input_len;
 429
 430                 if ((long)(limit - ret - 6 - col < 0))
 431                         return NULL;
 432                 if (col > 0xFFFD) /* can't happen */
 433                         return NULL;
 434
 435                 s2n(TLSEXT_TYPE_opaque_prf_input, ret);
 436                 s2n(col + 2, ret);
 437                 s2n(col, ret);
 438                 memcpy(ret, s->s3->client_opaque_prf_input, col);
 439                 ret += col;
 440                 }
 441 #endif
 442
 443         if (s->tlsext_status_type == TLSEXT_STATUSTYPE_ocsp)
 444                 {
 445                 int i;
 446                 long extlen, idlen, itmp;
 447                 OCSP_RESPID *id;
 448
 449                 idlen = 0;
 450                 for (i = 0; i < sk_OCSP_RESPID_num(s->tlsext_ocsp_ids); i++)
 451                         {
 452                         id = sk_OCSP_RESPID_value(s->tlsext_ocsp_ids, i);
 453                         itmp = i2d_OCSP_RESPID(id, NULL);
 454                         if (itmp <= 0)
 455                                 return NULL;
 456                         idlen += itmp + 2;
 457                         }
 458
 459                 if (s->tlsext_ocsp_exts)
 460                         {
 461                         extlen = i2d_X509_EXTENSIONS(s->tlsext_ocsp_exts, NULL);
 462                         if (extlen < 0)
 463                                 return NULL;
 464                         }
 465                 else
 466                         extlen = 0;
 467
 468                 if ((long)(limit - ret - 7 - extlen - idlen) < 0) return NULL;
 469                 s2n(TLSEXT_TYPE_status_request, ret);
 470                 if (extlen + idlen > 0xFFF0)
 471                         return NULL;
 472                 s2n(extlen + idlen + 5, ret);
 473                 *(ret++) = TLSEXT_STATUSTYPE_ocsp;
 474                 s2n(idlen, ret);
 475                 for (i = 0; i < sk_OCSP_RESPID_num(s->tlsext_ocsp_ids); i++)
 476                         {
 477                         /* save position of id len */
 478                         unsigned char *q = ret;
 479                         id = sk_OCSP_RESPID_value(s->tlsext_ocsp_ids, i);
 480                         /* skip over id len */
 481                         ret += 2;
 482                         itmp = i2d_OCSP_RESPID(id, &ret);
 483                         /* write id len */
 484                         s2n(itmp, q);
 485                         }
 486                 s2n(extlen, ret);
 487                 if (extlen > 0)
 488                         i2d_X509_EXTENSIONS(s->tlsext_ocsp_exts, &ret);
 489                 }
 490
 491         if ((extdatalen = ret-p-2)== 0)
 492                 return p;
 493
 494         s2n(extdatalen,p);
 495         return ret;
 496         }
 497
 498 unsigned char *ssl_add_serverhello_tlsext(SSL *s, unsigned char *p, unsigned char *limit)
 499         {
 500         int extdatalen=0;
 501         unsigned char *ret = p;
 502
 503         /* don't add extensions for SSLv3 */
 504         if (s->version == SSL3_VERSION)
 505                 return p;
 506
 507         ret+=2;
 508         if (ret>=limit) return NULL; /* this really never occurs, but ... */
 509
 510         if (!s->hit && s->servername_done == 1 && s->session->tlsext_hostname != NULL)
 511                 {
 512                 if ((long)(limit - ret - 4) < 0) return NULL;
 513
 514                 s2n(TLSEXT_TYPE_server_name,ret);
 515                 s2n(0,ret);
 516                 }
 517
 518         if(s->s3->send_connection_binding)
 519         {
 520           int el;
 521
 522           if(!ssl_add_serverhello_renegotiate_ext(s, 0, &el, 0))
 523               {
 524               SSLerr(SSL_F_SSL_ADD_SERVERHELLO_TLSEXT, ERR_R_INTERNAL_ERROR);
 525               return NULL;
 526               }
 527
 528           if((limit - p - 4 - el) < 0) return NULL;
 529
 530           s2n(TLSEXT_TYPE_renegotiate,ret);
 531           s2n(el,ret);
 532
 533           if(!ssl_add_serverhello_renegotiate_ext(s, ret, &el, el))
 534               {
 535               SSLerr(SSL_F_SSL_ADD_SERVERHELLO_TLSEXT, ERR_R_INTERNAL_ERROR);
 536               return NULL;
 537               }
 538
 539           ret += el;
 540         }
 541
 542 #ifndef OPENSSL_NO_EC
 543         if (s->tlsext_ecpointformatlist != NULL)
 544                 {
 545                 /* Add TLS extension ECPointFormats to the ServerHello message */
 546                 long lenmax;
 547
 548                 if ((lenmax = limit - ret - 5) < 0) return NULL;
 549                 if (s->tlsext_ecpointformatlist_length > (unsigned long)lenmax) return NULL;
 550                 if (s->tlsext_ecpointformatlist_length > 255)
 551                         {
 552                         SSLerr(SSL_F_SSL_ADD_SERVERHELLO_TLSEXT, ERR_R_INTERNAL_ERROR);
 553                         return NULL;
 554                         }
 555
 556                 s2n(TLSEXT_TYPE_ec_point_formats,ret);
 557                 s2n(s->tlsext_ecpointformatlist_length + 1,ret);
 558                 *(ret++) = (unsigned char) s->tlsext_ecpointformatlist_length;
 559                 memcpy(ret, s->tlsext_ecpointformatlist, s->tlsext_ecpointformatlist_length);
 560                 ret+=s->tlsext_ecpointformatlist_length;
 561
 562                 }
 563         /* Currently the server should not respond with a SupportedCurves extension */
 564 #endif /* OPENSSL_NO_EC */
 565
 566         if (s->tlsext_ticket_expected
 567                 && !(SSL_get_options(s) & SSL_OP_NO_TICKET))
 568                 {
 569                 if ((long)(limit - ret - 4) < 0) return NULL;
 570                 s2n(TLSEXT_TYPE_session_ticket,ret);
 571                 s2n(0,ret);
 572                 }
 573
 574         if (s->tlsext_status_expected)
 575                 {
 576                 if ((long)(limit - ret - 4) < 0) return NULL;
 577                 s2n(TLSEXT_TYPE_status_request,ret);
 578                 s2n(0,ret);
 579                 }
 580
 581 #ifdef TLSEXT_TYPE_opaque_prf_input
 582         if (s->s3->server_opaque_prf_input != NULL)
 583                 {
 584                 size_t sol = s->s3->server_opaque_prf_input_len;
 585
 586                 if ((long)(limit - ret - 6 - sol) < 0)
 587                         return NULL;
 588                 if (sol > 0xFFFD) /* can't happen */
 589                         return NULL;
 590
 591                 s2n(TLSEXT_TYPE_opaque_prf_input, ret);
 592                 s2n(sol + 2, ret);
 593                 s2n(sol, ret);
 594                 memcpy(ret, s->s3->server_opaque_prf_input, sol);
 595                 ret += sol;
 596                 }
 597 #endif
 598         if (((s->s3->tmp.new_cipher->id & 0xFFFF)==0x80 || (s->s3->tmp.new_cipher->id & 0xFFFF)==0x81)
 599                 && (SSL_get_options(s) & SSL_OP_CRYPTOPRO_TLSEXT_BUG))
 600                 { const unsigned char cryptopro_ext[36] = {
 601                         0xfd, 0xe8, /*65000*/
 602                         0x00, 0x20, /*32 bytes length*/
 603                         0x30, 0x1e, 0x30, 0x08, 0x06, 0x06, 0x2a, 0x85,
 604                         0x03,   0x02, 0x02, 0x09, 0x30, 0x08, 0x06, 0x06,
 605                         0x2a, 0x85, 0x03, 0x02, 0x02, 0x16, 0x30, 0x08,
 606                         0x06, 0x06, 0x2a, 0x85, 0x03, 0x02, 0x02, 0x17};
 607                         if (limit-ret<36) return NULL;
 608                         memcpy(ret,cryptopro_ext,36);
 609                         ret+=36;
 610
 611                 }
 612
 613         if ((extdatalen = ret-p-2)== 0)
 614                 return p;
 615
 616         s2n(extdatalen,p);
 617         return ret;
 618         }
 619
 620 int ssl_parse_clienthello_tlsext(SSL *s, unsigned char **p, unsigned char *d, int n, int *al)
 621         {
 622         unsigned short type;
 623         unsigned short size;
 624         unsigned short len;
 625         unsigned char *data = *p;
 626         int renegotiate_seen = 0;
 627
 628         s->servername_done = 0;
 629         s->tlsext_status_type = -1;
 630         s->s3->send_connection_binding = 0;
 631
 632         if (data >= (d+n-2))
 633                 {
 634                 if (s->new_session
 635                         && !(s->ctx->options & SSL_OP_ALLOW_UNSAFE_LEGACY_RENEGOTIATION))
 636                         {
 637                         /* We should always see one extension: the renegotiate extension */
 638                         *al = SSL_AD_ILLEGAL_PARAMETER; /* is this the right alert? */
 639                         SSLerr(SSL_F_SSL_PARSE_CLIENTHELLO_TLSEXT, SSL_R_UNSAFE_LEGACY_RENEGOTIATION_DISABLED);
 640                         return 0;
 641                         }
 642                 return 1;
 643                 }
 644         n2s(data,len);
 645
 646         if (data > (d+n-len))
 647                 return 1;
 648
 649         while (data <= (d+n-4))
 650                 {
 651                 n2s(data,type);
 652                 n2s(data,size);
 653
 654                 if (data+size > (d+n))
 655                         return 1;
 656 #if 0
 657                 fprintf(stderr,"Received extension type %d size %d\n",type,size);
 658 #endif
 659                 if (s->tlsext_debug_cb)
 660                         s->tlsext_debug_cb(s, 0, type, data, size,
 661                                                 s->tlsext_debug_arg);
 662 /* The servername extension is treated as follows:
 663
 664    - Only the hostname type is supported with a maximum length of 255.
 665    - The servername is rejected if too long or if it contains zeros,
 666      in which case an fatal alert is generated.
 667    - The servername field is maintained together with the session cache.
 668    - When a session is resumed, the servername call back invoked in order
 669      to allow the application to position itself to the right context.
 670    - The servername is acknowledged if it is new for a session or when
 671      it is identical to a previously used for the same session.
 672      Applications can control the behaviour.  They can at any time
 673      set a 'desirable' servername for a new SSL object. This can be the
 674      case for example with HTTPS when a Host: header field is received and
 675      a renegotiation is requested. In this case, a possible servername
 676      presented in the new client hello is only acknowledged if it matches
 677      the value of the Host: field.
 678    - Applications must  use SSL_OP_NO_SESSION_RESUMPTION_ON_RENEGOTIATION
 679      if they provide for changing an explicit servername context for the session,
 680      i.e. when the session has been established with a servername extension.
 681    - On session reconnect, the servername extension may be absent.
 682
 683 */
 684
 685                 if (type == TLSEXT_TYPE_server_name)
 686                         {
 687                         unsigned char *sdata;
 688                         int servname_type;
 689                         int dsize;
 690
 691                         if (size < 2)
 692                                 {
 693                                 *al = SSL_AD_DECODE_ERROR;
 694                                 return 0;
 695                                 }
 696                         n2s(data,dsize);
 697                         size -= 2;
 698                         if (dsize > size  )
 699                                 {
 700                                 *al = SSL_AD_DECODE_ERROR;
 701                                 return 0;
 702                                 }
 703
 704                         sdata = data;
 705                         while (dsize > 3)
 706                                 {
 707                                 servname_type = *(sdata++);
 708                                 n2s(sdata,len);
 709                                 dsize -= 3;
 710
 711                                 if (len > dsize)
 712                                         {
 713                                         *al = SSL_AD_DECODE_ERROR;
 714                                         return 0;
 715                                         }
 716                                 if (s->servername_done == 0)
 717                                 switch (servname_type)
 718                                         {
 719                                 case TLSEXT_NAMETYPE_host_name:
 720                                         if (s->session->tlsext_hostname == NULL)
 721                                                 {
 722                                                 if (len > TLSEXT_MAXLEN_host_name ||
 723                                                         ((s->session->tlsext_hostname = OPENSSL_malloc(len+1)) == NULL))
 724                                                         {
 725                                                         *al = TLS1_AD_UNRECOGNIZED_NAME;
 726                                                         return 0;
 727                                                         }
 728                                                 memcpy(s->session->tlsext_hostname, sdata, len);
 729                                                 s->session->tlsext_hostname[len]='\0';
 730                                                 if (strlen(s->session->tlsext_hostname) != len) {
 731                                                         OPENSSL_free(s->session->tlsext_hostname);
 732                                                         s->session->tlsext_hostname = NULL;
 733                                                         *al = TLS1_AD_UNRECOGNIZED_NAME;
 734                                                         return 0;
 735                                                 }
 736                                                 s->servername_done = 1;
 737
 738                                                 }
 739                                         else
 740                                                 s->servername_done = strlen(s->session->tlsext_hostname) == len
 741                                                         && strncmp(s->session->tlsext_hostname, (char *)sdata, len) == 0;
 742
 743                                         break;
 744
 745                                 default:
 746                                         break;
 747                                         }
 748
 749                                 dsize -= len;
 750                                 }
 751                         if (dsize != 0)
 752                                 {
 753                                 *al = SSL_AD_DECODE_ERROR;
 754                                 return 0;
 755                                 }
 756
 757                         }
 758
 759 #ifndef OPENSSL_NO_EC
 760                 else if (type == TLSEXT_TYPE_ec_point_formats)
 761                         {
 762                         unsigned char *sdata = data;
 763                         int ecpointformatlist_length = *(sdata++);
 764
 765                         if (ecpointformatlist_length != size - 1)
 766                                 {
 767                                 *al = TLS1_AD_DECODE_ERROR;
 768                                 return 0;
 769                                 }
 770                         s->session->tlsext_ecpointformatlist_length = 0;
 771                         if (s->session->tlsext_ecpointformatlist != NULL) OPENSSL_free(s->session->tlsext_ecpointformatlist);
 772                         if ((s->session->tlsext_ecpointformatlist = OPENSSL_malloc(ecpointformatlist_length)) == NULL)
 773                                 {
 774                                 *al = TLS1_AD_INTERNAL_ERROR;
 775                                 return 0;
 776                                 }
 777                         s->session->tlsext_ecpointformatlist_length = ecpointformatlist_length;
 778                         memcpy(s->session->tlsext_ecpointformatlist, sdata, ecpointformatlist_length);
 779 #if 0
 780                         fprintf(stderr,"ssl_parse_clienthello_tlsext s->session->tlsext_ecpointformatlist (length=%i) ", s->session->tlsext_ecpointformatlist_length);
 781                         sdata = s->session->tlsext_ecpointformatlist;
 782                         for (i = 0; i < s->session->tlsext_ecpointformatlist_length; i++)
 783                                 fprintf(stderr,"%i ",*(sdata++));
 784                         fprintf(stderr,"\n");
 785 #endif
 786                         }
 787                 else if (type == TLSEXT_TYPE_elliptic_curves)
 788                         {
 789                         unsigned char *sdata = data;
 790                         int ellipticcurvelist_length = (*(sdata++) << 8);
 791                         ellipticcurvelist_length += (*(sdata++));
 792
 793                         if (ellipticcurvelist_length != size - 2)
 794                                 {
 795                                 *al = TLS1_AD_DECODE_ERROR;
 796                                 return 0;
 797                                 }
 798                         s->session->tlsext_ellipticcurvelist_length = 0;
 799                         if (s->session->tlsext_ellipticcurvelist != NULL) OPENSSL_free(s->session->tlsext_ellipticcurvelist);
 800                         if ((s->session->tlsext_ellipticcurvelist = OPENSSL_malloc(ellipticcurvelist_length)) == NULL)
 801                                 {
 802                                 *al = TLS1_AD_INTERNAL_ERROR;
 803                                 return 0;
 804                                 }
 805                         s->session->tlsext_ellipticcurvelist_length = ellipticcurvelist_length;
 806                         memcpy(s->session->tlsext_ellipticcurvelist, sdata, ellipticcurvelist_length);
 807 #if 0
 808                         fprintf(stderr,"ssl_parse_clienthello_tlsext s->session->tlsext_ellipticcurvelist (length=%i) ", s->session->tlsext_ellipticcurvelist_length);
 809                         sdata = s->session->tlsext_ellipticcurvelist;
 810                         for (i = 0; i < s->session->tlsext_ellipticcurvelist_length; i++)
 811                                 fprintf(stderr,"%i ",*(sdata++));
 812                         fprintf(stderr,"\n");
 813 #endif
 814                         }
 815 #endif /* OPENSSL_NO_EC */
 816 #ifdef TLSEXT_TYPE_opaque_prf_input
 817                 else if (type == TLSEXT_TYPE_opaque_prf_input)
 818                         {
 819                         unsigned char *sdata = data;
 820
 821                         if (size < 2)
 822                                 {
 823                                 *al = SSL_AD_DECODE_ERROR;
 824                                 return 0;
 825                                 }
 826                         n2s(sdata, s->s3->client_opaque_prf_input_len);
 827                         if (s->s3->client_opaque_prf_input_len != size - 2)
 828                                 {
 829                                 *al = SSL_AD_DECODE_ERROR;
 830                                 return 0;
 831                                 }
 832
 833                         if (s->s3->client_opaque_prf_input != NULL) /* shouldn't really happen */
 834                                 OPENSSL_free(s->s3->client_opaque_prf_input);
 835                         if (s->s3->client_opaque_prf_input_len == 0)
 836                                 s->s3->client_opaque_prf_input = OPENSSL_malloc(1); /* dummy byte just to get non-NULL */
 837                         else
 838                                 s->s3->client_opaque_prf_input = BUF_memdup(sdata, s->s3->client_opaque_prf_input_len);
 839                         if (s->s3->client_opaque_prf_input == NULL)
 840                                 {
 841                                 *al = TLS1_AD_INTERNAL_ERROR;
 842                                 return 0;
 843                                 }
 844                         }
 845 #endif
 846                 else if (type == TLSEXT_TYPE_session_ticket)
 847                         {
 848                         if (s->tls_session_ticket_ext_cb &&
 849                             !s->tls_session_ticket_ext_cb(s, data, size, s->tls_session_ticket_ext_cb_arg))
 850                                 {
 851                                 *al = TLS1_AD_INTERNAL_ERROR;
 852                                 return 0;
 853                                 }
 854                         }
 855                 else if (type == TLSEXT_TYPE_renegotiate)
 856                         {
 857                         if(!ssl_parse_clienthello_renegotiate_ext(s, data, size, al))
 858                                 return 0;
 859                         renegotiate_seen = 1;
 860                         }
 861                 else if (type == TLSEXT_TYPE_status_request
 862                                                 && s->ctx->tlsext_status_cb)
 863                         {
 864
 865                         if (size < 5)
 866                                 {
 867                                 *al = SSL_AD_DECODE_ERROR;
 868                                 return 0;
 869                                 }
 870
 871                         s->tlsext_status_type = *data++;
 872                         size--;
 873                         if (s->tlsext_status_type == TLSEXT_STATUSTYPE_ocsp)
 874                                 {
 875                                 const unsigned char *sdata;
 876                                 int dsize;
 877                                 /* Read in responder_id_list */
 878                                 n2s(data,dsize);
 879                                 size -= 2;
 880                                 if (dsize > size  )
 881                                         {
 882                                         *al = SSL_AD_DECODE_ERROR;
 883                                         return 0;
 884                                         }
 885                                 while (dsize > 0)
 886                                         {
 887                                         OCSP_RESPID *id;
 888                                         int idsize;
 889                                         if (dsize < 4)
 890                                                 {
 891                                                 *al = SSL_AD_DECODE_ERROR;
 892                                                 return 0;
 893                                                 }
 894                                         n2s(data, idsize);
 895                                         dsize -= 2 + idsize;
 896                                         if (dsize < 0)
 897                                                 {
 898                                                 *al = SSL_AD_DECODE_ERROR;
 899                                                 return 0;
 900                                                 }
 901                                         sdata = data;
 902                                         data += idsize;
 903                                         id = d2i_OCSP_RESPID(NULL,
 904                                                                 &sdata, idsize);
 905                                         if (!id)
 906                                                 {
 907                                                 *al = SSL_AD_DECODE_ERROR;
 908                                                 return 0;
 909                                                 }
 910                                         if (data != sdata)
 911                                                 {
 912                                                 OCSP_RESPID_free(id);
 913                                                 *al = SSL_AD_DECODE_ERROR;
 914                                                 return 0;
 915                                                 }
 916                                         if (!s->tlsext_ocsp_ids
 917                                                 && !(s->tlsext_ocsp_ids =
 918                                                 sk_OCSP_RESPID_new_null()))
 919                                                 {
 920                                                 OCSP_RESPID_free(id);
 921                                                 *al = SSL_AD_INTERNAL_ERROR;
 922                                                 return 0;
 923                                                 }
 924                                         if (!sk_OCSP_RESPID_push(
 925                                                         s->tlsext_ocsp_ids, id))
 926                                                 {
 927                                                 OCSP_RESPID_free(id);
 928                                                 *al = SSL_AD_INTERNAL_ERROR;
 929                                                 return 0;
 930                                                 }
 931                                         }
 932
 933                                 /* Read in request_extensions */
 934                                 n2s(data,dsize);
 935                                 size -= 2;
 936                                 if (dsize > size)
 937                                         {
 938                                         *al = SSL_AD_DECODE_ERROR;
 939                                         return 0;
 940                                         }
 941                                 sdata = data;
 942                                 if (dsize > 0)
 943                                         {
 944                                         s->tlsext_ocsp_exts =
 945                                                 d2i_X509_EXTENSIONS(NULL,
 946                                                         &sdata, dsize);
 947                                         if (!s->tlsext_ocsp_exts
 948                                                 || (data + dsize != sdata))
 949                                                 {
 950                                                 *al = SSL_AD_DECODE_ERROR;
 951                                                 return 0;
 952                                                 }
 953                                         }
 954                                 }
 955                                 /* We don't know what to do with any other type
 956                                 * so ignore it.
 957                                 */
 958                                 else
 959                                         s->tlsext_status_type = -1;
 960                         }
 961
 962                 /* session ticket processed earlier */
 963                 data+=size;
 964                 }
 965
 966         if (s->new_session && !renegotiate_seen
 967                 && !(s->ctx->options & SSL_OP_ALLOW_UNSAFE_LEGACY_RENEGOTIATION))
 968                 {
 969                 SSLerr(SSL_F_SSL_PARSE_CLIENTHELLO_TLSEXT, SSL_R_UNSAFE_LEGACY_RENEGOTIATION_DISABLED);
 970                 *al = SSL_AD_ILLEGAL_PARAMETER; /* is this the right alert? */
 971                 return 0;
 972                 }
 973
 974
 975         *p = data;
 976         return 1;
 977         }
 978
 979 int ssl_parse_serverhello_tlsext(SSL *s, unsigned char **p, unsigned char *d, int n, int *al)
 980         {
 981         unsigned short type;
 982         unsigned short size;
 983         unsigned short len;
 984         unsigned char *data = *p;
 985         int tlsext_servername = 0;
 986         int renegotiate_seen = 0;
 987
 988         if (data >= (d+n-2))
 989                 {
 990                 /* Because the client does not see any renegotiation during an
 991                    attack, we must enforce this on all server hellos, even the
 992                    first */
 993                 if (!(s->ctx->options & SSL_OP_ALLOW_UNSAFE_LEGACY_RENEGOTIATION))
 994                         {
 995                         /* We should always see one extension: the renegotiate extension */
 996                         *al = SSL_AD_ILLEGAL_PARAMETER; /* is this the right alert? */
 997                         SSLerr(SSL_F_SSL_PARSE_SERVERHELLO_TLSEXT, SSL_R_UNSAFE_LEGACY_RENEGOTIATION_DISABLED);
 998                         return 0;
 999                         }
1000                 return 1;
1001                 }
1002
1003         n2s(data,len);
1004
1005         while(data <= (d+n-4))
1006                 {
1007                 n2s(data,type);
1008                 n2s(data,size);
1009
1010                 if (data+size > (d+n))
1011                         return 1;
1012
1013                 if (s->tlsext_debug_cb)
1014                         s->tlsext_debug_cb(s, 1, type, data, size,
1015                                                 s->tlsext_debug_arg);
1016
1017                 if (type == TLSEXT_TYPE_server_name)
1018                         {
1019                         if (s->tlsext_hostname == NULL || size > 0)
1020                                 {
1021                                 *al = TLS1_AD_UNRECOGNIZED_NAME;
1022                                 return 0;
1023                                 }
1024                         tlsext_servername = 1;
1025                         }
1026
1027 #ifndef OPENSSL_NO_EC
1028                 else if (type == TLSEXT_TYPE_ec_point_formats)
1029                         {
1030                         unsigned char *sdata = data;
1031                         int ecpointformatlist_length = *(sdata++);
1032
1033                         if (ecpointformatlist_length != size - 1)
1034                                 {
1035                                 *al = TLS1_AD_DECODE_ERROR;
1036                                 return 0;
1037                                 }
1038                         s->session->tlsext_ecpointformatlist_length = 0;
1039                         if (s->session->tlsext_ecpointformatlist != NULL) OPENSSL_free(s->session->tlsext_ecpointformatlist);
1040                         if ((s->session->tlsext_ecpointformatlist = OPENSSL_malloc(ecpointformatlist_length)) == NULL)
1041                                 {
1042                                 *al = TLS1_AD_INTERNAL_ERROR;
1043                                 return 0;
1044                                 }
1045                         s->session->tlsext_ecpointformatlist_length = ecpointformatlist_length;
1046                         memcpy(s->session->tlsext_ecpointformatlist, sdata, ecpointformatlist_length);
1047 #if 0
1048                         fprintf(stderr,"ssl_parse_serverhello_tlsext s->session->tlsext_ecpointformatlist ");
1049                         sdata = s->session->tlsext_ecpointformatlist;
1050                         for (i = 0; i < s->session->tlsext_ecpointformatlist_length; i++)
1051                                 fprintf(stderr,"%i ",*(sdata++));
1052                         fprintf(stderr,"\n");
1053 #endif
1054                         }
1055 #endif /* OPENSSL_NO_EC */
1056
1057                 else if (type == TLSEXT_TYPE_session_ticket)
1058                         {
1059                         if (s->tls_session_ticket_ext_cb &&
1060                             !s->tls_session_ticket_ext_cb(s, data, size, s->tls_session_ticket_ext_cb_arg))
1061                                 {
1062                                 *al = TLS1_AD_INTERNAL_ERROR;
1063                                 return 0;
1064                                 }
1065                         if ((SSL_get_options(s) & SSL_OP_NO_TICKET)
1066                                 || (size > 0))
1067                                 {
1068                                 *al = TLS1_AD_UNSUPPORTED_EXTENSION;
1069                                 return 0;
1070                                 }
1071                         s->tlsext_ticket_expected = 1;
1072                         }
1073 #ifdef TLSEXT_TYPE_opaque_prf_input
1074                 else if (type == TLSEXT_TYPE_opaque_prf_input)
1075                         {
1076                         unsigned char *sdata = data;
1077
1078                         if (size < 2)
1079                                 {
1080                                 *al = SSL_AD_DECODE_ERROR;
1081                                 return 0;
1082                                 }
1083                         n2s(sdata, s->s3->server_opaque_prf_input_len);
1084                         if (s->s3->server_opaque_prf_input_len != size - 2)
1085                                 {
1086                                 *al = SSL_AD_DECODE_ERROR;
1087                                 return 0;
1088                                 }
1089
1090                         if (s->s3->server_opaque_prf_input != NULL) /* shouldn't really happen */
1091                                 OPENSSL_free(s->s3->server_opaque_prf_input);
1092                         if (s->s3->server_opaque_prf_input_len == 0)
1093                                 s->s3->server_opaque_prf_input = OPENSSL_malloc(1); /* dummy byte just to get non-NULL */
1094                         else
1095                                 s->s3->server_opaque_prf_input = BUF_memdup(sdata, s->s3->server_opaque_prf_input_len);
1096
1097                         if (s->s3->server_opaque_prf_input == NULL)
1098                                 {
1099                                 *al = TLS1_AD_INTERNAL_ERROR;
1100                                 return 0;
1101                                 }
1102                         }
1103 #endif
1104                 else if (type == TLSEXT_TYPE_status_request)
1105                         {
1106                         /* MUST be empty and only sent if we've requested
1107                          * a status request message.
1108                          */
1109                         if ((s->tlsext_status_type == -1) || (size > 0))
1110                                 {
1111                                 *al = TLS1_AD_UNSUPPORTED_EXTENSION;
1112                                 return 0;
1113                                 }
1114                         /* Set flag to expect CertificateStatus message */
1115                         s->tlsext_status_expected = 1;
1116                         }
1117                 else if (type == TLSEXT_TYPE_renegotiate)
1118                         {
1119                         if(!ssl_parse_serverhello_renegotiate_ext(s, data, size, al))
1120                                 return 0;
1121                         renegotiate_seen = 1;
1122                         }
1123                 data+=size;
1124                 }
1125
1126         if (data != d+n)
1127                 {
1128                 *al = SSL_AD_DECODE_ERROR;
1129                 return 0;
1130                 }
1131
1132         if (!renegotiate_seen
1133                 && !(s->ctx->options & SSL_OP_ALLOW_UNSAFE_LEGACY_RENEGOTIATION))
1134                 {
1135                 *al = SSL_AD_ILLEGAL_PARAMETER; /* is this the right alert? */
1136                 SSLerr(SSL_F_SSL_PARSE_SERVERHELLO_TLSEXT, SSL_R_UNSAFE_LEGACY_RENEGOTIATION_DISABLED);
1137                 return 0;
1138                 }
1139
1140         if (!s->hit && tlsext_servername == 1)
1141                 {
1142                 if (s->tlsext_hostname)
1143                         {
1144                         if (s->session->tlsext_hostname == NULL)
1145                                 {
1146                                 s->session->tlsext_hostname = BUF_strdup(s->tlsext_hostname);
1147                                 if (!s->session->tlsext_hostname)
1148                                         {
1149                                         *al = SSL_AD_UNRECOGNIZED_NAME;
1150                                         return 0;
1151                                         }
1152                                 }
1153                         else
1154                                 {
1155                                 *al = SSL_AD_DECODE_ERROR;
1156                                 return 0;
1157                                 }
1158                         }
1159                 }
1160
1161         *p = data;
1162         return 1;
1163         }
1164
1165
1166 int ssl_prepare_clienthello_tlsext(SSL *s)
1167         {
1168 #ifndef OPENSSL_NO_EC
1169         /* If we are client and using an elliptic curve cryptography cipher suite, send the point formats
1170          * and elliptic curves we support.
1171          */
1172         int using_ecc = 0;
1173         int i;
1174         unsigned char *j;
1175         unsigned long alg_k, alg_a;
1176         STACK_OF(SSL_CIPHER) *cipher_stack = SSL_get_ciphers(s);
1177
1178         for (i = 0; i < sk_SSL_CIPHER_num(cipher_stack); i++)
1179                 {
1180                 SSL_CIPHER *c = sk_SSL_CIPHER_value(cipher_stack, i);
1181
1182                 alg_k = c->algorithm_mkey;
1183                 alg_a = c->algorithm_auth;
1184                 if ((alg_k & (SSL_kEECDH|SSL_kECDHr|SSL_kECDHe) || (alg_a & SSL_aECDSA)))
1185                         {
1186                         using_ecc = 1;
1187                         break;
1188                         }
1189                 }
1190         using_ecc = using_ecc && (s->version == TLS1_VERSION);
1191         if (using_ecc)
1192                 {
1193                 if (s->tlsext_ecpointformatlist != NULL) OPENSSL_free(s->tlsext_ecpointformatlist);
1194                 if ((s->tlsext_ecpointformatlist = OPENSSL_malloc(3)) == NULL)
1195                         {
1196                         SSLerr(SSL_F_SSL_PREPARE_CLIENTHELLO_TLSEXT,ERR_R_MALLOC_FAILURE);
1197                         return -1;
1198                         }
1199                 s->tlsext_ecpointformatlist_length = 3;
1200                 s->tlsext_ecpointformatlist[0] = TLSEXT_ECPOINTFORMAT_uncompressed;
1201                 s->tlsext_ecpointformatlist[1] = TLSEXT_ECPOINTFORMAT_ansiX962_compressed_prime;
1202                 s->tlsext_ecpointformatlist[2] = TLSEXT_ECPOINTFORMAT_ansiX962_compressed_char2;
1203
1204                 /* we support all named elliptic curves in draft-ietf-tls-ecc-12 */
1205                 if (s->tlsext_ellipticcurvelist != NULL) OPENSSL_free(s->tlsext_ellipticcurvelist);
1206                 s->tlsext_ellipticcurvelist_length = sizeof(nid_list)/sizeof(nid_list[0]) * 2;
1207                 if ((s->tlsext_ellipticcurvelist = OPENSSL_malloc(s->tlsext_ellipticcurvelist_length)) == NULL)
1208                         {
1209                         s->tlsext_ellipticcurvelist_length = 0;
1210                         SSLerr(SSL_F_SSL_PREPARE_CLIENTHELLO_TLSEXT,ERR_R_MALLOC_FAILURE);
1211                         return -1;
1212                         }
1213                 for (i = 1, j = s->tlsext_ellipticcurvelist; (unsigned int)i <=
1214                                 sizeof(nid_list)/sizeof(nid_list[0]); i++)
1215                         s2n(i,j);
1216                 }
1217 #endif /* OPENSSL_NO_EC */
1218
1219 #ifdef TLSEXT_TYPE_opaque_prf_input
1220         {
1221                 int r = 1;
1222
1223                 if (s->ctx->tlsext_opaque_prf_input_callback != 0)
1224                         {
1225                         r = s->ctx->tlsext_opaque_prf_input_callback(s, NULL, 0, s->ctx->tlsext_opaque_prf_input_callback_arg);
1226                         if (!r)
1227                                 return -1;
1228                         }
1229
1230                 if (s->tlsext_opaque_prf_input != NULL)
1231                         {
1232                         if (s->s3->client_opaque_prf_input != NULL) /* shouldn't really happen */
1233                                 OPENSSL_free(s->s3->client_opaque_prf_input);
1234
1235                         if (s->tlsext_opaque_prf_input_len == 0)
1236                                 s->s3->client_opaque_prf_input = OPENSSL_malloc(1); /* dummy byte just to get non-NULL */
1237                         else
1238                                 s->s3->client_opaque_prf_input = BUF_memdup(s->tlsext_opaque_prf_input, s->tlsext_opaque_prf_input_len);
1239                         if (s->s3->client_opaque_prf_input == NULL)
1240                                 {
1241                                 SSLerr(SSL_F_SSL_PREPARE_CLIENTHELLO_TLSEXT,ERR_R_MALLOC_FAILURE);
1242                                 return -1;
1243                                 }
1244                         s->s3->client_opaque_prf_input_len = s->tlsext_opaque_prf_input_len;
1245                         }
1246
1247                 if (r == 2)
1248                         /* at callback's request, insist on receiving an appropriate server opaque PRF input */
1249                         s->s3->server_opaque_prf_input_len = s->tlsext_opaque_prf_input_len;
1250         }
1251 #endif
1252
1253         return 1;
1254         }
1255
1256 int ssl_prepare_serverhello_tlsext(SSL *s)
1257         {
1258 #ifndef OPENSSL_NO_EC
1259         /* If we are server and using an ECC cipher suite, send the point formats we support
1260          * if the client sent us an ECPointsFormat extension.  Note that the server is not
1261          * supposed to send an EllipticCurves extension.
1262          */
1263
1264         unsigned long alg_k = s->s3->tmp.new_cipher->algorithm_mkey;
1265         unsigned long alg_a = s->s3->tmp.new_cipher->algorithm_auth;
1266         int using_ecc = (alg_k & (SSL_kEECDH|SSL_kECDHr|SSL_kECDHe)) || (alg_a & SSL_aECDSA);
1267         using_ecc = using_ecc && (s->session->tlsext_ecpointformatlist != NULL);
1268
1269         if (using_ecc)
1270                 {
1271                 if (s->tlsext_ecpointformatlist != NULL) OPENSSL_free(s->tlsext_ecpointformatlist);
1272                 if ((s->tlsext_ecpointformatlist = OPENSSL_malloc(3)) == NULL)
1273                         {
1274                         SSLerr(SSL_F_SSL_PREPARE_SERVERHELLO_TLSEXT,ERR_R_MALLOC_FAILURE);
1275                         return -1;
1276                         }
1277                 s->tlsext_ecpointformatlist_length = 3;
1278                 s->tlsext_ecpointformatlist[0] = TLSEXT_ECPOINTFORMAT_uncompressed;
1279                 s->tlsext_ecpointformatlist[1] = TLSEXT_ECPOINTFORMAT_ansiX962_compressed_prime;
1280                 s->tlsext_ecpointformatlist[2] = TLSEXT_ECPOINTFORMAT_ansiX962_compressed_char2;
1281                 }
1282 #endif /* OPENSSL_NO_EC */
1283
1284         return 1;
1285         }
1286
1287 int ssl_check_clienthello_tlsext(SSL *s)
1288         {
1289         int ret=SSL_TLSEXT_ERR_NOACK;
1290         int al = SSL_AD_UNRECOGNIZED_NAME;
1291
1292 #ifndef OPENSSL_NO_EC
1293         /* The handling of the ECPointFormats extension is done elsewhere, namely in
1294          * ssl3_choose_cipher in s3_lib.c.
1295          */
1296         /* The handling of the EllipticCurves extension is done elsewhere, namely in
1297          * ssl3_choose_cipher in s3_lib.c.
1298          */
1299 #endif
1300
1301         if (s->ctx != NULL && s->ctx->tlsext_servername_callback != 0)
1302                 ret = s->ctx->tlsext_servername_callback(s, &al, s->ctx->tlsext_servername_arg);
1303         else if (s->initial_ctx != NULL && s->initial_ctx->tlsext_servername_callback != 0)
1304                 ret = s->initial_ctx->tlsext_servername_callback(s, &al, s->initial_ctx->tlsext_servername_arg);
1305
1306         /* If status request then ask callback what to do.
1307          * Note: this must be called after servername callbacks in case
1308          * the certificate has changed.
1309          */
1310         if ((s->tlsext_status_type != -1) && s->ctx && s->ctx->tlsext_status_cb)
1311                 {
1312                 int r;
1313                 r = s->ctx->tlsext_status_cb(s, s->ctx->tlsext_status_arg);
1314                 switch (r)
1315                         {
1316                         /* We don't want to send a status request response */
1317                         case SSL_TLSEXT_ERR_NOACK:
1318                                 s->tlsext_status_expected = 0;
1319                                 break;
1320                         /* status request response should be sent */
1321                         case SSL_TLSEXT_ERR_OK:
1322                                 if (s->tlsext_ocsp_resp)
1323                                         s->tlsext_status_expected = 1;
1324                                 else
1325                                         s->tlsext_status_expected = 0;
1326                                 break;
1327                         /* something bad happened */
1328                         case SSL_TLSEXT_ERR_ALERT_FATAL:
1329                                 ret = SSL_TLSEXT_ERR_ALERT_FATAL;
1330                                 al = SSL_AD_INTERNAL_ERROR;
1331                                 goto err;
1332                         }
1333                 }
1334         else
1335                 s->tlsext_status_expected = 0;
1336
1337 #ifdef TLSEXT_TYPE_opaque_prf_input
1338         {
1339                 /* This sort of belongs into ssl_prepare_serverhello_tlsext(),
1340                  * but we might be sending an alert in response to the client hello,
1341                  * so this has to happen here in ssl_check_clienthello_tlsext(). */
1342
1343                 int r = 1;
1344
1345                 if (s->ctx->tlsext_opaque_prf_input_callback != 0)
1346                         {
1347                         r = s->ctx->tlsext_opaque_prf_input_callback(s, NULL, 0, s->ctx->tlsext_opaque_prf_input_callback_arg);
1348                         if (!r)
1349                                 {
1350                                 ret = SSL_TLSEXT_ERR_ALERT_FATAL;
1351                                 al = SSL_AD_INTERNAL_ERROR;
1352                                 goto err;
1353                                 }
1354                         }
1355
1356                 if (s->s3->server_opaque_prf_input != NULL) /* shouldn't really happen */
1357                         OPENSSL_free(s->s3->server_opaque_prf_input);
1358                 s->s3->server_opaque_prf_input = NULL;
1359
1360                 if (s->tlsext_opaque_prf_input != NULL)
1361                         {
1362                         if (s->s3->client_opaque_prf_input != NULL &&
1363                                 s->s3->client_opaque_prf_input_len == s->tlsext_opaque_prf_input_len)
1364                                 {
1365                                 /* can only use this extension if we have a server opaque PRF input
1366                                  * of the same length as the client opaque PRF input! */
1367
1368                                 if (s->tlsext_opaque_prf_input_len == 0)
1369                                         s->s3->server_opaque_prf_input = OPENSSL_malloc(1); /* dummy byte just to get non-NULL */
1370                                 else
1371                                         s->s3->server_opaque_prf_input = BUF_memdup(s->tlsext_opaque_prf_input, s->tlsext_opaque_prf_input_len);
1372                                 if (s->s3->server_opaque_prf_input == NULL)
1373                                         {
1374                                         ret = SSL_TLSEXT_ERR_ALERT_FATAL;
1375                                         al = SSL_AD_INTERNAL_ERROR;
1376                                         goto err;
1377                                         }
1378                                 s->s3->server_opaque_prf_input_len = s->tlsext_opaque_prf_input_len;
1379                                 }
1380                         }
1381
1382                 if (r == 2 && s->s3->server_opaque_prf_input == NULL)
1383                         {
1384                         /* The callback wants to enforce use of the extension,
1385                          * but we can't do that with the client opaque PRF input;
1386                          * abort the handshake.
1387                          */
1388                         ret = SSL_TLSEXT_ERR_ALERT_FATAL;
1389                         al = SSL_AD_HANDSHAKE_FAILURE;
1390                         }
1391         }
1392
1393 #endif
1394  err:
1395         switch (ret)
1396                 {
1397                 case SSL_TLSEXT_ERR_ALERT_FATAL:
1398                         ssl3_send_alert(s,SSL3_AL_FATAL,al);
1399                         return -1;
1400
1401                 case SSL_TLSEXT_ERR_ALERT_WARNING:
1402                         ssl3_send_alert(s,SSL3_AL_WARNING,al);
1403                         return 1;
1404
1405                 case SSL_TLSEXT_ERR_NOACK:
1406                         s->servername_done=0;
1407                         default:
1408                 return 1;
1409                 }
1410         }
1411
1412 int ssl_check_serverhello_tlsext(SSL *s)
1413         {
1414         int ret=SSL_TLSEXT_ERR_NOACK;
1415         int al = SSL_AD_UNRECOGNIZED_NAME;
1416
1417 #ifndef OPENSSL_NO_EC
1418         /* If we are client and using an elliptic curve cryptography cipher suite, then server
1419          * must return a an EC point formats lists containing uncompressed.
1420          */
1421         unsigned long alg_k = s->s3->tmp.new_cipher->algorithm_mkey;
1422         unsigned long alg_a = s->s3->tmp.new_cipher->algorithm_auth;
1423         if ((s->tlsext_ecpointformatlist != NULL) && (s->tlsext_ecpointformatlist_length > 0) &&
1424             ((alg_k & (SSL_kEECDH|SSL_kECDHr|SSL_kECDHe)) || (alg_a & SSL_aECDSA)))
1425                 {
1426                 /* we are using an ECC cipher */
1427                 size_t i;
1428                 unsigned char *list;
1429                 int found_uncompressed = 0;
1430                 if ((s->session->tlsext_ecpointformatlist == NULL) || (s->session->tlsext_ecpointformatlist_length == 0))
1431                         {
1432                         SSLerr(SSL_F_SSL_CHECK_SERVERHELLO_TLSEXT,SSL_R_TLS_INVALID_ECPOINTFORMAT_LIST);
1433                         return -1;
1434                         }
1435                 list = s->session->tlsext_ecpointformatlist;
1436                 for (i = 0; i < s->session->tlsext_ecpointformatlist_length; i++)
1437                         {
1438                         if (*(list++) == TLSEXT_ECPOINTFORMAT_uncompressed)
1439                                 {
1440                                 found_uncompressed = 1;
1441                                 break;
1442                                 }
1443                         }
1444                 if (!found_uncompressed)
1445                         {
1446                         SSLerr(SSL_F_SSL_CHECK_SERVERHELLO_TLSEXT,SSL_R_TLS_INVALID_ECPOINTFORMAT_LIST);
1447                         return -1;
1448                         }
1449                 }
1450         ret = SSL_TLSEXT_ERR_OK;
1451 #endif /* OPENSSL_NO_EC */
1452
1453         if (s->ctx != NULL && s->ctx->tlsext_servername_callback != 0)
1454                 ret = s->ctx->tlsext_servername_callback(s, &al, s->ctx->tlsext_servername_arg);
1455         else if (s->initial_ctx != NULL && s->initial_ctx->tlsext_servername_callback != 0)
1456                 ret = s->initial_ctx->tlsext_servername_callback(s, &al, s->initial_ctx->tlsext_servername_arg);
1457
1458 #ifdef TLSEXT_TYPE_opaque_prf_input
1459         if (s->s3->server_opaque_prf_input_len > 0)
1460                 {
1461                 /* This case may indicate that we, as a client, want to insist on using opaque PRF inputs.
1462                  * So first verify that we really have a value from the server too. */
1463
1464                 if (s->s3->server_opaque_prf_input == NULL)
1465                         {
1466                         ret = SSL_TLSEXT_ERR_ALERT_FATAL;
1467                         al = SSL_AD_HANDSHAKE_FAILURE;
1468                         }
1469
1470                 /* Anytime the server *has* sent an opaque PRF input, we need to check
1471                  * that we have a client opaque PRF input of the same size. */
1472                 if (s->s3->client_opaque_prf_input == NULL ||
1473                     s->s3->client_opaque_prf_input_len != s->s3->server_opaque_prf_input_len)
1474                         {
1475                         ret = SSL_TLSEXT_ERR_ALERT_FATAL;
1476                         al = SSL_AD_ILLEGAL_PARAMETER;
1477                         }
1478                 }
1479 #endif
1480
1481         /* If we've requested certificate status and we wont get one
1482          * tell the callback
1483          */
1484         if ((s->tlsext_status_type != -1) && !(s->tlsext_status_expected)
1485                         && s->ctx && s->ctx->tlsext_status_cb)
1486                 {
1487                 int r;
1488                 /* Set resp to NULL, resplen to -1 so callback knows
1489                  * there is no response.
1490                  */
1491                 if (s->tlsext_ocsp_resp)
1492                         {
1493                         OPENSSL_free(s->tlsext_ocsp_resp);
1494                         s->tlsext_ocsp_resp = NULL;
1495                         }
1496                 s->tlsext_ocsp_resplen = -1;
1497                 r = s->ctx->tlsext_status_cb(s, s->ctx->tlsext_status_arg);
1498                 if (r == 0)
1499                         {
1500                         al = SSL_AD_BAD_CERTIFICATE_STATUS_RESPONSE;
1501                         ret = SSL_TLSEXT_ERR_ALERT_FATAL;
1502                         }
1503                 if (r < 0)
1504                         {
1505                         al = SSL_AD_INTERNAL_ERROR;
1506                         ret = SSL_TLSEXT_ERR_ALERT_FATAL;
1507                         }
1508                 }
1509
1510         switch (ret)
1511                 {
1512                 case SSL_TLSEXT_ERR_ALERT_FATAL:
1513                         ssl3_send_alert(s,SSL3_AL_FATAL,al);
1514                         return -1;
1515
1516                 case SSL_TLSEXT_ERR_ALERT_WARNING:
1517                         ssl3_send_alert(s,SSL3_AL_WARNING,al);
1518                         return 1;
1519
1520                 case SSL_TLSEXT_ERR_NOACK:
1521                         s->servername_done=0;
1522                         default:
1523                 return 1;
1524                 }
1525         }
1526
1527 /* Since the server cache lookup is done early on in the processing of client
1528  * hello and other operations depend on the result we need to handle any TLS
1529  * session ticket extension at the same time.
1530  */
1531
1532 int tls1_process_ticket(SSL *s, unsigned char *session_id, int len,
1533                                 const unsigned char *limit, SSL_SESSION **ret)
1534         {
1535         /* Point after session ID in client hello */
1536         const unsigned char *p = session_id + len;
1537         unsigned short i;
1538
1539         /* If tickets disabled behave as if no ticket present
1540          * to permit stateful resumption.
1541          */
1542         if (SSL_get_options(s) & SSL_OP_NO_TICKET)
1543                 return 1;
1544
1545         if ((s->version <= SSL3_VERSION) || !limit)
1546                 return 1;
1547         if (p >= limit)
1548                 return -1;
1549         /* Skip past DTLS cookie */
1550         if (s->version == DTLS1_VERSION || s->version == DTLS1_BAD_VER)
1551                 {
1552                 i = *(p++);
1553                 p+= i;
1554                 if (p >= limit)
1555                         return -1;
1556                 }
1557         /* Skip past cipher list */
1558         n2s(p, i);
1559         p+= i;
1560         if (p >= limit)
1561                 return -1;
1562         /* Skip past compression algorithm list */
1563         i = *(p++);
1564         p += i;
1565         if (p > limit)
1566                 return -1;
1567         /* Now at start of extensions */
1568         if ((p + 2) >= limit)
1569                 return 1;
1570         n2s(p, i);
1571         while ((p + 4) <= limit)
1572                 {
1573                 unsigned short type, size;
1574                 n2s(p, type);
1575                 n2s(p, size);
1576                 if (p + size > limit)
1577                         return 1;
1578                 if (type == TLSEXT_TYPE_session_ticket)
1579                         {
1580                         /* If tickets disabled indicate cache miss which will
1581                          * trigger a full handshake
1582                          */
1583                         if (SSL_get_options(s) & SSL_OP_NO_TICKET)
1584                                 return 1;
1585                         /* If zero length note client will accept a ticket
1586                          * and indicate cache miss to trigger full handshake
1587                          */
1588                         if (size == 0)
1589                                 {
1590                                 s->tlsext_ticket_expected = 1;
1591                                 return 0;       /* Cache miss */
1592                                 }
1593                         if (s->tls_session_secret_cb)
1594                                 {
1595                                 /* Indicate cache miss here and instead of
1596                                  * generating the session from ticket now,
1597                                  * trigger abbreviated handshake based on
1598                                  * external mechanism to calculate the master
1599                                  * secret later. */
1600                                 return 0;
1601                                 }
1602                         return tls_decrypt_ticket(s, p, size, session_id, len,
1603                                                                         ret);
1604                         }
1605                 p += size;
1606                 }
1607         return 1;
1608         }
1609
1610 static int tls_decrypt_ticket(SSL *s, const unsigned char *etick, int eticklen,
1611                                 const unsigned char *sess_id, int sesslen,
1612                                 SSL_SESSION **psess)
1613         {
1614         SSL_SESSION *sess;
1615         unsigned char *sdec;
1616         const unsigned char *p;
1617         int slen, mlen, renew_ticket = 0;
1618         unsigned char tick_hmac[EVP_MAX_MD_SIZE];
1619         HMAC_CTX hctx;
1620         EVP_CIPHER_CTX ctx;
1621         SSL_CTX *tctx = s->initial_ctx;
1622         /* Need at least keyname + iv + some encrypted data */
1623         if (eticklen < 48)
1624                 goto tickerr;
1625         /* Initialize session ticket encryption and HMAC contexts */
1626         HMAC_CTX_init(&hctx);
1627         EVP_CIPHER_CTX_init(&ctx);
1628         if (tctx->tlsext_ticket_key_cb)
1629                 {
1630                 unsigned char *nctick = (unsigned char *)etick;
1631                 int rv = tctx->tlsext_ticket_key_cb(s, nctick, nctick + 16,
1632                                                         &ctx, &hctx, 0);
1633                 if (rv < 0)
1634                         return -1;
1635                 if (rv == 0)
1636                         goto tickerr;
1637                 if (rv == 2)
1638                         renew_ticket = 1;
1639                 }
1640         else
1641                 {
1642                 /* Check key name matches */
1643                 if (memcmp(etick, tctx->tlsext_tick_key_name, 16))
1644                         goto tickerr;
1645                 HMAC_Init_ex(&hctx, tctx->tlsext_tick_hmac_key, 16,
1646                                         tlsext_tick_md(), NULL);
1647                 EVP_DecryptInit_ex(&ctx, EVP_aes_128_cbc(), NULL,
1648                                 tctx->tlsext_tick_aes_key, etick + 16);
1649                 }
1650         /* Attempt to process session ticket, first conduct sanity and
1651          * integrity checks on ticket.
1652          */
1653         mlen = HMAC_size(&hctx);
1654         if (mlen < 0)
1655                 {
1656                 EVP_CIPHER_CTX_cleanup(&ctx);
1657                 return -1;
1658                 }
1659         eticklen -= mlen;
1660         /* Check HMAC of encrypted ticket */
1661         HMAC_Update(&hctx, etick, eticklen);
1662         HMAC_Final(&hctx, tick_hmac, NULL);
1663         HMAC_CTX_cleanup(&hctx);
1664         if (memcmp(tick_hmac, etick + eticklen, mlen))
1665                 goto tickerr;
1666         /* Attempt to decrypt session data */
1667         /* Move p after IV to start of encrypted ticket, update length */
1668         p = etick + 16 + EVP_CIPHER_CTX_iv_length(&ctx);
1669         eticklen -= 16 + EVP_CIPHER_CTX_iv_length(&ctx);
1670         sdec = OPENSSL_malloc(eticklen);
1671         if (!sdec)
1672                 {
1673                 EVP_CIPHER_CTX_cleanup(&ctx);
1674                 return -1;
1675                 }
1676         EVP_DecryptUpdate(&ctx, sdec, &slen, p, eticklen);
1677         if (EVP_DecryptFinal(&ctx, sdec + slen, &mlen) <= 0)
1678                 goto tickerr;
1679         slen += mlen;
1680         EVP_CIPHER_CTX_cleanup(&ctx);
1681         p = sdec;
1682
1683         sess = d2i_SSL_SESSION(NULL, &p, slen);
1684         OPENSSL_free(sdec);
1685         if (sess)
1686                 {
1687                 /* The session ID if non-empty is used by some clients to
1688                  * detect that the ticket has been accepted. So we copy it to
1689                  * the session structure. If it is empty set length to zero
1690                  * as required by standard.
1691                  */
1692                 if (sesslen)
1693                         memcpy(sess->session_id, sess_id, sesslen);
1694                 sess->session_id_length = sesslen;
1695                 *psess = sess;
1696                 s->tlsext_ticket_expected = renew_ticket;
1697                 return 1;
1698                 }
1699         /* If session decrypt failure indicate a cache miss and set state to
1700          * send a new ticket
1701          */
1702         tickerr:
1703         s->tlsext_ticket_expected = 1;
1704         return 0;
1705         }
1706
1707 #endif