ssl/t1_lib.c

   1 /* ssl/t1_lib.c */
   2 /* Copyright (C) 1995-1998 Eric Young (eay@cryptsoft.com)
   3  * All rights reserved.
   4  *
   5  * This package is an SSL implementation written
   6  * by Eric Young (eay@cryptsoft.com).
   7  * The implementation was written so as to conform with Netscapes SSL.
   8  *
   9  * This library is free for commercial and non-commercial use as long as
  10  * the following conditions are aheared to.  The following conditions
  11  * apply to all code found in this distribution, be it the RC4, RSA,
  12  * lhash, DES, etc., code; not just the SSL code.  The SSL documentation
  13  * included with this distribution is covered by the same copyright terms
  14  * except that the holder is Tim Hudson (tjh@cryptsoft.com).
  15  *
  16  * Copyright remains Eric Young's, and as such any Copyright notices in
  17  * the code are not to be removed.
  18  * If this package is used in a product, Eric Young should be given attribution
  19  * as the author of the parts of the library used.
  20  * This can be in the form of a textual message at program startup or
  21  * in documentation (online or textual) provided with the package.
  22  *
  23  * Redistribution and use in source and binary forms, with or without
  24  * modification, are permitted provided that the following conditions
  25  * are met:
  26  * 1. Redistributions of source code must retain the copyright
  27  *    notice, this list of conditions and the following disclaimer.
  28  * 2. Redistributions in binary form must reproduce the above copyright
  29  *    notice, this list of conditions and the following disclaimer in the
  30  *    documentation and/or other materials provided with the distribution.
  31  * 3. All advertising materials mentioning features or use of this software
  32  *    must display the following acknowledgement:
  33  *    "This product includes cryptographic software written by
  34  *     Eric Young (eay@cryptsoft.com)"
  35  *    The word 'cryptographic' can be left out if the rouines from the library
  36  *    being used are not cryptographic related :-).
  37  * 4. If you include any Windows specific code (or a derivative thereof) from
  38  *    the apps directory (application code) you must include an acknowledgement:
  39  *    "This product includes software written by Tim Hudson (tjh@cryptsoft.com)"
  40  *
  41  * THIS SOFTWARE IS PROVIDED BY ERIC YOUNG ``AS IS'' AND
  42  * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
  43  * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
  44  * ARE DISCLAIMED.  IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE
  45  * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
  46  * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
  47  * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
  48  * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
  49  * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
  50  * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
  51  * SUCH DAMAGE.
  52  *
  53  * The licence and distribution terms for any publically available version or
  54  * derivative of this code cannot be changed.  i.e. this code cannot simply be
  55  * copied and put under another distribution licence
  56  * [including the GNU Public Licence.]
  57  */
  58 /* ====================================================================
  59  * Copyright (c) 1998-2007 The OpenSSL Project.  All rights reserved.
  60  *
  61  * Redistribution and use in source and binary forms, with or without
  62  * modification, are permitted provided that the following conditions
  63  * are met:
  64  *
  65  * 1. Redistributions of source code must retain the above copyright
  66  *    notice, this list of conditions and the following disclaimer.
  67  *
  68  * 2. Redistributions in binary form must reproduce the above copyright
  69  *    notice, this list of conditions and the following disclaimer in
  70  *    the documentation and/or other materials provided with the
  71  *    distribution.
  72  *
  73  * 3. All advertising materials mentioning features or use of this
  74  *    software must display the following acknowledgment:
  75  *    "This product includes software developed by the OpenSSL Project
  76  *    for use in the OpenSSL Toolkit. (http://www.openssl.org/)"
  77  *
  78  * 4. The names "OpenSSL Toolkit" and "OpenSSL Project" must not be used to
  79  *    endorse or promote products derived from this software without
  80  *    prior written permission. For written permission, please contact
  81  *    openssl-core@openssl.org.
  82  *
  83  * 5. Products derived from this software may not be called "OpenSSL"
  84  *    nor may "OpenSSL" appear in their names without prior written
  85  *    permission of the OpenSSL Project.
  86  *
  87  * 6. Redistributions of any form whatsoever must retain the following
  88  *    acknowledgment:
  89  *    "This product includes software developed by the OpenSSL Project
  90  *    for use in the OpenSSL Toolkit (http://www.openssl.org/)"
  91  *
  92  * THIS SOFTWARE IS PROVIDED BY THE OpenSSL PROJECT ``AS IS'' AND ANY
  93  * EXPRESSED OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
  94  * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
  95  * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL THE OpenSSL PROJECT OR
  96  * ITS CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
  97  * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
  98  * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
  99  * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
 100  * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT,
 101  * STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
 102  * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED
 103  * OF THE POSSIBILITY OF SUCH DAMAGE.
 104  * ====================================================================
 105  *
 106  * This product includes cryptographic software written by Eric Young
 107  * (eay@cryptsoft.com).  This product includes software written by Tim
 108  * Hudson (tjh@cryptsoft.com).
 109  *
 110  */
 111
 112 #include <stdio.h>
 113 #include <openssl/objects.h>
 114 #include <openssl/evp.h>
 115 #include <openssl/hmac.h>
 116 #include <openssl/ocsp.h>
 117 #include "ssl_locl.h"
 118
 119 const char tls1_version_str[]="TLSv1" OPENSSL_VERSION_PTEXT;
 120
 121 #ifndef OPENSSL_NO_TLSEXT
 122 static int tls_decrypt_ticket(SSL *s, const unsigned char *tick, int ticklen,
 123                                 const unsigned char *sess_id, int sesslen,
 124                                 SSL_SESSION **psess);
 125 #endif
 126
 127 SSL3_ENC_METHOD TLSv1_enc_data={
 128         tls1_enc,
 129         tls1_mac,
 130         tls1_setup_key_block,
 131         tls1_generate_master_secret,
 132         tls1_change_cipher_state,
 133         tls1_final_finish_mac,
 134         TLS1_FINISH_MAC_LENGTH,
 135         tls1_cert_verify_mac,
 136         TLS_MD_CLIENT_FINISH_CONST,TLS_MD_CLIENT_FINISH_CONST_SIZE,
 137         TLS_MD_SERVER_FINISH_CONST,TLS_MD_SERVER_FINISH_CONST_SIZE,
 138         tls1_alert_code,
 139         };
 140
 141 long tls1_default_timeout(void)
 142         {
 143         /* 2 hours, the 24 hours mentioned in the TLSv1 spec
 144          * is way too long for http, the cache would over fill */
 145         return(60*60*2);
 146         }
 147
 148 int tls1_new(SSL *s)
 149         {
 150         if (!ssl3_new(s)) return(0);
 151         s->method->ssl_clear(s);
 152         return(1);
 153         }
 154
 155 void tls1_free(SSL *s)
 156         {
 157         ssl3_free(s);
 158         }
 159
 160 void tls1_clear(SSL *s)
 161         {
 162         ssl3_clear(s);
 163         s->version=TLS1_VERSION;
 164         }
 165
 166 #ifndef OPENSSL_NO_EC
 167 static int nid_list[] =
 168         {
 169                 NID_sect163k1, /* sect163k1 (1) */
 170                 NID_sect163r1, /* sect163r1 (2) */
 171                 NID_sect163r2, /* sect163r2 (3) */
 172                 NID_sect193r1, /* sect193r1 (4) */
 173                 NID_sect193r2, /* sect193r2 (5) */
 174                 NID_sect233k1, /* sect233k1 (6) */
 175                 NID_sect233r1, /* sect233r1 (7) */
 176                 NID_sect239k1, /* sect239k1 (8) */
 177                 NID_sect283k1, /* sect283k1 (9) */
 178                 NID_sect283r1, /* sect283r1 (10) */
 179                 NID_sect409k1, /* sect409k1 (11) */
 180                 NID_sect409r1, /* sect409r1 (12) */
 181                 NID_sect571k1, /* sect571k1 (13) */
 182                 NID_sect571r1, /* sect571r1 (14) */
 183                 NID_secp160k1, /* secp160k1 (15) */
 184                 NID_secp160r1, /* secp160r1 (16) */
 185                 NID_secp160r2, /* secp160r2 (17) */
 186                 NID_secp192k1, /* secp192k1 (18) */
 187                 NID_X9_62_prime192v1, /* secp192r1 (19) */
 188                 NID_secp224k1, /* secp224k1 (20) */
 189                 NID_secp224r1, /* secp224r1 (21) */
 190                 NID_secp256k1, /* secp256k1 (22) */
 191                 NID_X9_62_prime256v1, /* secp256r1 (23) */
 192                 NID_secp384r1, /* secp384r1 (24) */
 193                 NID_secp521r1  /* secp521r1 (25) */
 194         };
 195
 196 int tls1_ec_curve_id2nid(int curve_id)
 197         {
 198         /* ECC curves from draft-ietf-tls-ecc-12.txt (Oct. 17, 2005) */
 199         if ((curve_id < 1) || (curve_id > sizeof(nid_list)/sizeof(nid_list[0]))) return 0;
 200         return nid_list[curve_id-1];
 201         }
 202
 203 int tls1_ec_nid2curve_id(int nid)
 204         {
 205         /* ECC curves from draft-ietf-tls-ecc-12.txt (Oct. 17, 2005) */
 206         switch (nid)
 207                 {
 208         case NID_sect163k1: /* sect163k1 (1) */
 209                 return 1;
 210         case NID_sect163r1: /* sect163r1 (2) */
 211                 return 2;
 212         case NID_sect163r2: /* sect163r2 (3) */
 213                 return 3;
 214         case NID_sect193r1: /* sect193r1 (4) */
 215                 return 4;
 216         case NID_sect193r2: /* sect193r2 (5) */
 217                 return 5;
 218         case NID_sect233k1: /* sect233k1 (6) */
 219                 return 6;
 220         case NID_sect233r1: /* sect233r1 (7) */
 221                 return 7;
 222         case NID_sect239k1: /* sect239k1 (8) */
 223                 return 8;
 224         case NID_sect283k1: /* sect283k1 (9) */
 225                 return 9;
 226         case NID_sect283r1: /* sect283r1 (10) */
 227                 return 10;
 228         case NID_sect409k1: /* sect409k1 (11) */
 229                 return 11;
 230         case NID_sect409r1: /* sect409r1 (12) */
 231                 return 12;
 232         case NID_sect571k1: /* sect571k1 (13) */
 233                 return 13;
 234         case NID_sect571r1: /* sect571r1 (14) */
 235                 return 14;
 236         case NID_secp160k1: /* secp160k1 (15) */
 237                 return 15;
 238         case NID_secp160r1: /* secp160r1 (16) */
 239                 return 16;
 240         case NID_secp160r2: /* secp160r2 (17) */
 241                 return 17;
 242         case NID_secp192k1: /* secp192k1 (18) */
 243                 return 18;
 244         case NID_X9_62_prime192v1: /* secp192r1 (19) */
 245                 return 19;
 246         case NID_secp224k1: /* secp224k1 (20) */
 247                 return 20;
 248         case NID_secp224r1: /* secp224r1 (21) */
 249                 return 21;
 250         case NID_secp256k1: /* secp256k1 (22) */
 251                 return 22;
 252         case NID_X9_62_prime256v1: /* secp256r1 (23) */
 253                 return 23;
 254         case NID_secp384r1: /* secp384r1 (24) */
 255                 return 24;
 256         case NID_secp521r1:  /* secp521r1 (25) */
 257                 return 25;
 258         default:
 259                 return 0;
 260                 }
 261         }
 262 #endif /* OPENSSL_NO_EC */
 263
 264 #ifndef OPENSSL_NO_TLSEXT
 265 unsigned char *ssl_add_clienthello_tlsext(SSL *s, unsigned char *p, unsigned char *limit)
 266         {
 267         int extdatalen=0;
 268         unsigned char *ret = p;
 269
 270         ret+=2;
 271
 272         if (ret>=limit) return NULL; /* this really never occurs, but ... */
 273
 274         if (s->tlsext_hostname != NULL)
 275                 {
 276                 /* Add TLS extension servername to the Client Hello message */
 277                 unsigned long size_str;
 278                 long lenmax;
 279
 280                 /* check for enough space.
 281                    4 for the servername type and entension length
 282                    2 for servernamelist length
 283                    1 for the hostname type
 284                    2 for hostname length
 285                    + hostname length
 286                 */
 287
 288                 if ((lenmax = limit - ret - 9) < 0
 289                     || (size_str = strlen(s->tlsext_hostname)) > (unsigned long)lenmax)
 290                         return NULL;
 291
 292                 /* extension type and length */
 293                 s2n(TLSEXT_TYPE_server_name,ret);
 294                 s2n(size_str+5,ret);
 295
 296                 /* length of servername list */
 297                 s2n(size_str+3,ret);
 298
 299                 /* hostname type, length and hostname */
 300                 *(ret++) = (unsigned char) TLSEXT_NAMETYPE_host_name;
 301                 s2n(size_str,ret);
 302                 memcpy(ret, s->tlsext_hostname, size_str);
 303                 ret+=size_str;
 304                 }
 305
 306 #ifndef OPENSSL_NO_EC
 307         if (s->tlsext_ecpointformatlist != NULL)
 308                 {
 309                 /* Add TLS extension ECPointFormats to the ClientHello message */
 310                 long lenmax;
 311
 312                 if ((lenmax = limit - ret - 5) < 0) return NULL;
 313                 if (s->tlsext_ecpointformatlist_length > (unsigned long)lenmax) return NULL;
 314                 if (s->tlsext_ecpointformatlist_length > 255)
 315                         {
 316                         SSLerr(SSL_F_SSL_ADD_CLIENTHELLO_TLSEXT, ERR_R_INTERNAL_ERROR);
 317                         return NULL;
 318                         }
 319
 320                 s2n(TLSEXT_TYPE_ec_point_formats,ret);
 321                 s2n(s->tlsext_ecpointformatlist_length + 1,ret);
 322                 *(ret++) = (unsigned char) s->tlsext_ecpointformatlist_length;
 323                 memcpy(ret, s->tlsext_ecpointformatlist, s->tlsext_ecpointformatlist_length);
 324                 ret+=s->tlsext_ecpointformatlist_length;
 325                 }
 326         if (s->tlsext_ellipticcurvelist != NULL)
 327                 {
 328                 /* Add TLS extension EllipticCurves to the ClientHello message */
 329                 long lenmax;
 330
 331                 if ((lenmax = limit - ret - 6) < 0) return NULL;
 332                 if (s->tlsext_ellipticcurvelist_length > (unsigned long)lenmax) return NULL;
 333                 if (s->tlsext_ellipticcurvelist_length > 65532)
 334                         {
 335                         SSLerr(SSL_F_SSL_ADD_CLIENTHELLO_TLSEXT, ERR_R_INTERNAL_ERROR);
 336                         return NULL;
 337                         }
 338
 339                 s2n(TLSEXT_TYPE_elliptic_curves,ret);
 340                 s2n(s->tlsext_ellipticcurvelist_length + 2, ret);
 341
 342                 /* NB: draft-ietf-tls-ecc-12.txt uses a one-byte prefix for
 343                  * elliptic_curve_list, but the examples use two bytes.
 344                  * http://www1.ietf.org/mail-archive/web/tls/current/msg00538.html
 345                  * resolves this to two bytes.
 346                  */
 347                 s2n(s->tlsext_ellipticcurvelist_length, ret);
 348                 memcpy(ret, s->tlsext_ellipticcurvelist, s->tlsext_ellipticcurvelist_length);
 349                 ret+=s->tlsext_ellipticcurvelist_length;
 350                 }
 351 #endif /* OPENSSL_NO_EC */
 352
 353         if (!(SSL_get_options(s) & SSL_OP_NO_TICKET))
 354                 {
 355                 int ticklen;
 356                 if (s->session && s->session->tlsext_tick)
 357                         ticklen = s->session->tlsext_ticklen;
 358                 else
 359                         ticklen = 0;
 360                 /* Check for enough room 2 for extension type, 2 for len
 361                  * rest for ticket
 362                  */
 363                 if ((long)(limit - ret - 4 - ticklen) < 0) return NULL;
 364                 s2n(TLSEXT_TYPE_session_ticket,ret);
 365                 s2n(ticklen,ret);
 366                 if (ticklen)
 367                         {
 368                         memcpy(ret, s->session->tlsext_tick, ticklen);
 369                         ret += ticklen;
 370                         }
 371                 }
 372
 373 #ifdef TLSEXT_TYPE_opaque_prf_input
 374         if (s->s3->client_opaque_prf_input != NULL)
 375                 {
 376                 size_t col = s->s3->client_opaque_prf_input_len;
 377
 378                 if ((long)(limit - ret - 6 - col < 0))
 379                         return NULL;
 380                 if (col > 0xFFFD) /* can't happen */
 381                         return NULL;
 382
 383                 s2n(TLSEXT_TYPE_opaque_prf_input, ret);
 384                 s2n(col + 2, ret);
 385                 s2n(col, ret);
 386                 memcpy(ret, s->s3->client_opaque_prf_input, col);
 387                 ret += col;
 388                 }
 389 #endif
 390
 391         if (s->tlsext_status_type == TLSEXT_STATUSTYPE_ocsp)
 392                 {
 393                 int i;
 394                 long extlen, idlen, itmp;
 395                 OCSP_RESPID *id;
 396
 397                 idlen = 0;
 398                 for (i = 0; i < sk_OCSP_RESPID_num(s->tlsext_ocsp_ids); i++)
 399                         {
 400                         id = sk_OCSP_RESPID_value(s->tlsext_ocsp_ids, i);
 401                         itmp = i2d_OCSP_RESPID(id, NULL);
 402                         if (itmp <= 0)
 403                                 return NULL;
 404                         idlen += itmp + 2;
 405                         }
 406
 407                 if (s->tlsext_ocsp_exts)
 408                         {
 409                         extlen = i2d_X509_EXTENSIONS(s->tlsext_ocsp_exts, NULL);
 410                         if (extlen < 0)
 411                                 return NULL;
 412                         }
 413                 else
 414                         extlen = 0;
 415
 416                 if ((long)(limit - ret - 7 - extlen - idlen) < 0) return NULL;
 417                 s2n(TLSEXT_TYPE_status_request, ret);
 418                 if (extlen + idlen > 0xFFF0)
 419                         return NULL;
 420                 s2n(extlen + idlen + 5, ret);
 421                 *(ret++) = TLSEXT_STATUSTYPE_ocsp;
 422                 s2n(idlen, ret);
 423                 for (i = 0; i < sk_OCSP_RESPID_num(s->tlsext_ocsp_ids); i++)
 424                         {
 425                         /* save position of id len */
 426                         unsigned char *q = ret;
 427                         id = sk_OCSP_RESPID_value(s->tlsext_ocsp_ids, i);
 428                         /* skip over id len */
 429                         ret += 2;
 430                         itmp = i2d_OCSP_RESPID(id, &ret);
 431                         /* write id len */
 432                         s2n(itmp, q);
 433                         }
 434                 s2n(extlen, ret);
 435                 if (extlen > 0)
 436                         i2d_X509_EXTENSIONS(s->tlsext_ocsp_exts, &ret);
 437                 }
 438
 439         if ((extdatalen = ret-p-2)== 0)
 440                 return p;
 441
 442         s2n(extdatalen,p);
 443         return ret;
 444         }
 445
 446 unsigned char *ssl_add_serverhello_tlsext(SSL *s, unsigned char *p, unsigned char *limit)
 447         {
 448         int extdatalen=0;
 449         unsigned char *ret = p;
 450
 451         ret+=2;
 452         if (ret>=limit) return NULL; /* this really never occurs, but ... */
 453
 454         if (!s->hit && s->servername_done == 1 && s->session->tlsext_hostname != NULL)
 455                 {
 456                 if ((long)(limit - ret - 4) < 0) return NULL;
 457
 458                 s2n(TLSEXT_TYPE_server_name,ret);
 459                 s2n(0,ret);
 460                 }
 461 #ifndef OPENSSL_NO_EC
 462         if (s->tlsext_ecpointformatlist != NULL)
 463                 {
 464                 /* Add TLS extension ECPointFormats to the ServerHello message */
 465                 long lenmax;
 466
 467                 if ((lenmax = limit - ret - 5) < 0) return NULL;
 468                 if (s->tlsext_ecpointformatlist_length > (unsigned long)lenmax) return NULL;
 469                 if (s->tlsext_ecpointformatlist_length > 255)
 470                         {
 471                         SSLerr(SSL_F_SSL_ADD_SERVERHELLO_TLSEXT, ERR_R_INTERNAL_ERROR);
 472                         return NULL;
 473                         }
 474
 475                 s2n(TLSEXT_TYPE_ec_point_formats,ret);
 476                 s2n(s->tlsext_ecpointformatlist_length + 1,ret);
 477                 *(ret++) = (unsigned char) s->tlsext_ecpointformatlist_length;
 478                 memcpy(ret, s->tlsext_ecpointformatlist, s->tlsext_ecpointformatlist_length);
 479                 ret+=s->tlsext_ecpointformatlist_length;
 480
 481                 }
 482         /* Currently the server should not respond with a SupportedCurves extension */
 483 #endif /* OPENSSL_NO_EC */
 484
 485         if (s->tlsext_ticket_expected
 486                 && !(SSL_get_options(s) & SSL_OP_NO_TICKET))
 487                 {
 488                 if ((long)(limit - ret - 4) < 0) return NULL;
 489                 s2n(TLSEXT_TYPE_session_ticket,ret);
 490                 s2n(0,ret);
 491                 }
 492
 493         if (s->tlsext_status_expected)
 494                 {
 495                 if ((long)(limit - ret - 4) < 0) return NULL;
 496                 s2n(TLSEXT_TYPE_status_request,ret);
 497                 s2n(0,ret);
 498                 }
 499
 500 #ifdef TLSEXT_TYPE_opaque_prf_input
 501         if (s->s3->server_opaque_prf_input != NULL)
 502                 {
 503                 size_t sol = s->s3->server_opaque_prf_input_len;
 504
 505                 if ((long)(limit - ret - 6 - sol) < 0)
 506                         return NULL;
 507                 if (sol > 0xFFFD) /* can't happen */
 508                         return NULL;
 509
 510                 s2n(TLSEXT_TYPE_opaque_prf_input, ret);
 511                 s2n(sol + 2, ret);
 512                 s2n(sol, ret);
 513                 memcpy(ret, s->s3->server_opaque_prf_input, sol);
 514                 ret += sol;
 515                 }
 516 #endif
 517         if (((s->s3->tmp.new_cipher->id & 0xFFFF)==0x80 || (s->s3->tmp.new_cipher->id & 0xFFFF)==0x81)
 518                 && (SSL_get_options(s) & SSL_OP_CRYPTOPRO_TLSEXT_BUG))
 519                 { const unsigned char cryptopro_ext[36] = {
 520                         0xfd, 0xe8, /*65000*/
 521                         0x00, 0x20, /*32 bytes length*/
 522                         0x30, 0x1e, 0x30, 0x08, 0x06, 0x06, 0x2a, 0x85,
 523                         0x03,   0x02, 0x02, 0x09, 0x30, 0x08, 0x06, 0x06,
 524                         0x2a, 0x85, 0x03, 0x02, 0x02, 0x16, 0x30, 0x08,
 525                         0x06, 0x06, 0x2a, 0x85, 0x03, 0x02, 0x02, 0x17};
 526                         if (limit-ret<36) return NULL;
 527                         memcpy(ret,cryptopro_ext,36);
 528                         ret+=36;
 529
 530                 }
 531
 532         if ((extdatalen = ret-p-2)== 0)
 533                 return p;
 534
 535         s2n(extdatalen,p);
 536         return ret;
 537         }
 538
 539 int ssl_parse_clienthello_tlsext(SSL *s, unsigned char **p, unsigned char *d, int n, int *al)
 540         {
 541         unsigned short type;
 542         unsigned short size;
 543         unsigned short len;
 544         unsigned char *data = *p;
 545         s->servername_done = 0;
 546         s->tlsext_status_type = -1;
 547
 548         if (data >= (d+n-2))
 549                 return 1;
 550         n2s(data,len);
 551
 552         if (data > (d+n-len))
 553                 return 1;
 554
 555         while (data <= (d+n-4))
 556                 {
 557                 n2s(data,type);
 558                 n2s(data,size);
 559
 560                 if (data+size > (d+n))
 561                         return 1;
 562                 fprintf(stderr,"Received extension type %d size %d\n",type,size);
 563                 if (s->tlsext_debug_cb)
 564                         s->tlsext_debug_cb(s, 0, type, data, size,
 565                                                 s->tlsext_debug_arg);
 566 /* The servername extension is treated as follows:
 567
 568    - Only the hostname type is supported with a maximum length of 255.
 569    - The servername is rejected if too long or if it contains zeros,
 570      in which case an fatal alert is generated.
 571    - The servername field is maintained together with the session cache.
 572    - When a session is resumed, the servername call back invoked in order
 573      to allow the application to position itself to the right context.
 574    - The servername is acknowledged if it is new for a session or when
 575      it is identical to a previously used for the same session.
 576      Applications can control the behaviour.  They can at any time
 577      set a 'desirable' servername for a new SSL object. This can be the
 578      case for example with HTTPS when a Host: header field is received and
 579      a renegotiation is requested. In this case, a possible servername
 580      presented in the new client hello is only acknowledged if it matches
 581      the value of the Host: field.
 582    - Applications must  use SSL_OP_NO_SESSION_RESUMPTION_ON_RENEGOTIATION
 583      if they provide for changing an explicit servername context for the session,
 584      i.e. when the session has been established with a servername extension.
 585    - On session reconnect, the servername extension may be absent.
 586
 587 */
 588
 589                 if (type == TLSEXT_TYPE_server_name)
 590                         {
 591                         unsigned char *sdata;
 592                         int servname_type;
 593                         int dsize;
 594
 595                         if (size < 2)
 596                                 {
 597                                 *al = SSL_AD_DECODE_ERROR;
 598                                 return 0;
 599                                 }
 600                         n2s(data,dsize);
 601                         size -= 2;
 602                         if (dsize > size  )
 603                                 {
 604                                 *al = SSL_AD_DECODE_ERROR;
 605                                 return 0;
 606                                 }
 607
 608                         sdata = data;
 609                         while (dsize > 3)
 610                                 {
 611                                 servname_type = *(sdata++);
 612                                 n2s(sdata,len);
 613                                 dsize -= 3;
 614
 615                                 if (len > dsize)
 616                                         {
 617                                         *al = SSL_AD_DECODE_ERROR;
 618                                         return 0;
 619                                         }
 620                                 if (s->servername_done == 0)
 621                                 switch (servname_type)
 622                                         {
 623                                 case TLSEXT_NAMETYPE_host_name:
 624                                         if (s->session->tlsext_hostname == NULL)
 625                                                 {
 626                                                 if (len > TLSEXT_MAXLEN_host_name ||
 627                                                         ((s->session->tlsext_hostname = OPENSSL_malloc(len+1)) == NULL))
 628                                                         {
 629                                                         *al = TLS1_AD_UNRECOGNIZED_NAME;
 630                                                         return 0;
 631                                                         }
 632                                                 memcpy(s->session->tlsext_hostname, sdata, len);
 633                                                 s->session->tlsext_hostname[len]='\0';
 634                                                 if (strlen(s->session->tlsext_hostname) != len) {
 635                                                         OPENSSL_free(s->session->tlsext_hostname);
 636                                                         *al = TLS1_AD_UNRECOGNIZED_NAME;
 637                                                         return 0;
 638                                                 }
 639                                                 s->servername_done = 1;
 640
 641                                                 }
 642                                         else
 643                                                 s->servername_done = strlen(s->session->tlsext_hostname) == len
 644                                                         && strncmp(s->session->tlsext_hostname, (char *)sdata, len) == 0;
 645
 646                                         break;
 647
 648                                 default:
 649                                         break;
 650                                         }
 651
 652                                 dsize -= len;
 653                                 }
 654                         if (dsize != 0)
 655                                 {
 656                                 *al = SSL_AD_DECODE_ERROR;
 657                                 return 0;
 658                                 }
 659
 660                         }
 661
 662 #ifndef OPENSSL_NO_EC
 663                 else if (type == TLSEXT_TYPE_ec_point_formats)
 664                         {
 665                         unsigned char *sdata = data;
 666                         int ecpointformatlist_length = *(sdata++);
 667
 668                         if (ecpointformatlist_length != size - 1)
 669                                 {
 670                                 *al = TLS1_AD_DECODE_ERROR;
 671                                 return 0;
 672                                 }
 673                         s->session->tlsext_ecpointformatlist_length = 0;
 674                         if (s->session->tlsext_ecpointformatlist != NULL) OPENSSL_free(s->session->tlsext_ecpointformatlist);
 675                         if ((s->session->tlsext_ecpointformatlist = OPENSSL_malloc(ecpointformatlist_length)) == NULL)
 676                                 {
 677                                 *al = TLS1_AD_INTERNAL_ERROR;
 678                                 return 0;
 679                                 }
 680                         s->session->tlsext_ecpointformatlist_length = ecpointformatlist_length;
 681                         memcpy(s->session->tlsext_ecpointformatlist, sdata, ecpointformatlist_length);
 682 #if 0
 683                         fprintf(stderr,"ssl_parse_clienthello_tlsext s->session->tlsext_ecpointformatlist (length=%i) ", s->session->tlsext_ecpointformatlist_length);
 684                         sdata = s->session->tlsext_ecpointformatlist;
 685                         for (i = 0; i < s->session->tlsext_ecpointformatlist_length; i++)
 686                                 fprintf(stderr,"%i ",*(sdata++));
 687                         fprintf(stderr,"\n");
 688 #endif
 689                         }
 690                 else if (type == TLSEXT_TYPE_elliptic_curves)
 691                         {
 692                         unsigned char *sdata = data;
 693                         int ellipticcurvelist_length = (*(sdata++) << 8);
 694                         ellipticcurvelist_length += (*(sdata++));
 695
 696                         if (ellipticcurvelist_length != size - 2)
 697                                 {
 698                                 *al = TLS1_AD_DECODE_ERROR;
 699                                 return 0;
 700                                 }
 701                         s->session->tlsext_ellipticcurvelist_length = 0;
 702                         if (s->session->tlsext_ellipticcurvelist != NULL) OPENSSL_free(s->session->tlsext_ellipticcurvelist);
 703                         if ((s->session->tlsext_ellipticcurvelist = OPENSSL_malloc(ellipticcurvelist_length)) == NULL)
 704                                 {
 705                                 *al = TLS1_AD_INTERNAL_ERROR;
 706                                 return 0;
 707                                 }
 708                         s->session->tlsext_ellipticcurvelist_length = ellipticcurvelist_length;
 709                         memcpy(s->session->tlsext_ellipticcurvelist, sdata, ellipticcurvelist_length);
 710 #if 0
 711                         fprintf(stderr,"ssl_parse_clienthello_tlsext s->session->tlsext_ellipticcurvelist (length=%i) ", s->session->tlsext_ellipticcurvelist_length);
 712                         sdata = s->session->tlsext_ellipticcurvelist;
 713                         for (i = 0; i < s->session->tlsext_ellipticcurvelist_length; i++)
 714                                 fprintf(stderr,"%i ",*(sdata++));
 715                         fprintf(stderr,"\n");
 716 #endif
 717                         }
 718 #endif /* OPENSSL_NO_EC */
 719 #ifdef TLSEXT_TYPE_opaque_prf_input
 720                 else if (type == TLSEXT_TYPE_opaque_prf_input)
 721                         {
 722                         unsigned char *sdata = data;
 723
 724                         if (size < 2)
 725                                 {
 726                                 *al = SSL_AD_DECODE_ERROR;
 727                                 return 0;
 728                                 }
 729                         n2s(sdata, s->s3->client_opaque_prf_input_len);
 730                         if (s->s3->client_opaque_prf_input_len != size - 2)
 731                                 {
 732                                 *al = SSL_AD_DECODE_ERROR;
 733                                 return 0;
 734                                 }
 735
 736                         if (s->s3->client_opaque_prf_input != NULL) /* shouldn't really happen */
 737                                 OPENSSL_free(s->s3->client_opaque_prf_input);
 738                         if (s->s3->client_opaque_prf_input_len == 0)
 739                                 s->s3->client_opaque_prf_input = OPENSSL_malloc(1); /* dummy byte just to get non-NULL */
 740                         else
 741                                 s->s3->client_opaque_prf_input = BUF_memdup(sdata, s->s3->client_opaque_prf_input_len);
 742                         if (s->s3->client_opaque_prf_input == NULL)
 743                                 {
 744                                 *al = TLS1_AD_INTERNAL_ERROR;
 745                                 return 0;
 746                                 }
 747                         }
 748 #endif
 749                 else if (type == TLSEXT_TYPE_status_request
 750                                                 && s->ctx->tlsext_status_cb)
 751                         {
 752
 753                         if (size < 5)
 754                                 {
 755                                 *al = SSL_AD_DECODE_ERROR;
 756                                 return 0;
 757                                 }
 758
 759                         s->tlsext_status_type = *data++;
 760                         size--;
 761                         if (s->tlsext_status_type == TLSEXT_STATUSTYPE_ocsp)
 762                                 {
 763                                 const unsigned char *sdata;
 764                                 int dsize;
 765                                 /* Read in responder_id_list */
 766                                 n2s(data,dsize);
 767                                 size -= 2;
 768                                 if (dsize > size  )
 769                                         {
 770                                         *al = SSL_AD_DECODE_ERROR;
 771                                         return 0;
 772                                         }
 773                                 while (dsize > 0)
 774                                         {
 775                                         OCSP_RESPID *id;
 776                                         int idsize;
 777                                         if (dsize < 4)
 778                                                 {
 779                                                 *al = SSL_AD_DECODE_ERROR;
 780                                                 return 0;
 781                                                 }
 782                                         n2s(data, idsize);
 783                                         dsize -= 2 + idsize;
 784                                         if (dsize < 0)
 785                                                 {
 786                                                 *al = SSL_AD_DECODE_ERROR;
 787                                                 return 0;
 788                                                 }
 789                                         sdata = data;
 790                                         data += idsize;
 791                                         id = d2i_OCSP_RESPID(NULL,
 792                                                                 &sdata, idsize);
 793                                         if (!id)
 794                                                 {
 795                                                 *al = SSL_AD_DECODE_ERROR;
 796                                                 return 0;
 797                                                 }
 798                                         if (data != sdata)
 799                                                 {
 800                                                 OCSP_RESPID_free(id);
 801                                                 *al = SSL_AD_DECODE_ERROR;
 802                                                 return 0;
 803                                                 }
 804                                         if (!s->tlsext_ocsp_ids
 805                                                 && !(s->tlsext_ocsp_ids =
 806                                                 sk_OCSP_RESPID_new_null()))
 807                                                 {
 808                                                 OCSP_RESPID_free(id);
 809                                                 *al = SSL_AD_INTERNAL_ERROR;
 810                                                 return 0;
 811                                                 }
 812                                         if (!sk_OCSP_RESPID_push(
 813                                                         s->tlsext_ocsp_ids, id))
 814                                                 {
 815                                                 OCSP_RESPID_free(id);
 816                                                 *al = SSL_AD_INTERNAL_ERROR;
 817                                                 return 0;
 818                                                 }
 819                                         }
 820
 821                                 /* Read in request_extensions */
 822                                 n2s(data,dsize);
 823                                 size -= 2;
 824                                 if (dsize > size)
 825                                         {
 826                                         *al = SSL_AD_DECODE_ERROR;
 827                                         return 0;
 828                                         }
 829                                 sdata = data;
 830                                 if (dsize > 0)
 831                                         {
 832                                         s->tlsext_ocsp_exts =
 833                                                 d2i_X509_EXTENSIONS(NULL,
 834                                                         &sdata, dsize);
 835                                         if (!s->tlsext_ocsp_exts
 836                                                 || (data + dsize != sdata))
 837                                                 {
 838                                                 *al = SSL_AD_DECODE_ERROR;
 839                                                 return 0;
 840                                                 }
 841                                         }
 842                                 }
 843                                 /* We don't know what to do with any other type
 844                                 * so ignore it.
 845                                 */
 846                                 else
 847                                         s->tlsext_status_type = -1;
 848                         }
 849
 850                 /* session ticket processed earlier */
 851                 data+=size;
 852                 }
 853
 854         *p = data;
 855         return 1;
 856         }
 857
 858 int ssl_parse_serverhello_tlsext(SSL *s, unsigned char **p, unsigned char *d, int n, int *al)
 859         {
 860         unsigned short type;
 861         unsigned short size;
 862         unsigned short len;
 863         unsigned char *data = *p;
 864
 865         int tlsext_servername = 0;
 866
 867         if (data >= (d+n-2))
 868                 return 1;
 869
 870         n2s(data,len);
 871
 872         while(data <= (d+n-4))
 873                 {
 874                 n2s(data,type);
 875                 n2s(data,size);
 876
 877                 if (data+size > (d+n))
 878                         return 1;
 879
 880                 if (s->tlsext_debug_cb)
 881                         s->tlsext_debug_cb(s, 1, type, data, size,
 882                                                 s->tlsext_debug_arg);
 883
 884                 if (type == TLSEXT_TYPE_server_name)
 885                         {
 886                         if (s->tlsext_hostname == NULL || size > 0)
 887                                 {
 888                                 *al = TLS1_AD_UNRECOGNIZED_NAME;
 889                                 return 0;
 890                                 }
 891                         tlsext_servername = 1;
 892                         }
 893
 894 #ifndef OPENSSL_NO_EC
 895                 else if (type == TLSEXT_TYPE_ec_point_formats)
 896                         {
 897                         unsigned char *sdata = data;
 898                         int ecpointformatlist_length = *(sdata++);
 899
 900                         if (ecpointformatlist_length != size - 1)
 901                                 {
 902                                 *al = TLS1_AD_DECODE_ERROR;
 903                                 return 0;
 904                                 }
 905                         s->session->tlsext_ecpointformatlist_length = 0;
 906                         if (s->session->tlsext_ecpointformatlist != NULL) OPENSSL_free(s->session->tlsext_ecpointformatlist);
 907                         if ((s->session->tlsext_ecpointformatlist = OPENSSL_malloc(ecpointformatlist_length)) == NULL)
 908                                 {
 909                                 *al = TLS1_AD_INTERNAL_ERROR;
 910                                 return 0;
 911                                 }
 912                         s->session->tlsext_ecpointformatlist_length = ecpointformatlist_length;
 913                         memcpy(s->session->tlsext_ecpointformatlist, sdata, ecpointformatlist_length);
 914 #if 0
 915                         fprintf(stderr,"ssl_parse_serverhello_tlsext s->session->tlsext_ecpointformatlist ");
 916                         sdata = s->session->tlsext_ecpointformatlist;
 917                         for (i = 0; i < s->session->tlsext_ecpointformatlist_length; i++)
 918                                 fprintf(stderr,"%i ",*(sdata++));
 919                         fprintf(stderr,"\n");
 920 #endif
 921                         }
 922 #endif /* OPENSSL_NO_EC */
 923
 924                 else if (type == TLSEXT_TYPE_session_ticket)
 925                         {
 926                         if ((SSL_get_options(s) & SSL_OP_NO_TICKET)
 927                                 || (size > 0))
 928                                 {
 929                                 *al = TLS1_AD_UNSUPPORTED_EXTENSION;
 930                                 return 0;
 931                                 }
 932                         s->tlsext_ticket_expected = 1;
 933                         }
 934 #ifdef TLSEXT_TYPE_opaque_prf_input
 935                 else if (type == TLSEXT_TYPE_opaque_prf_input)
 936                         {
 937                         unsigned char *sdata = data;
 938
 939                         if (size < 2)
 940                                 {
 941                                 *al = SSL_AD_DECODE_ERROR;
 942                                 return 0;
 943                                 }
 944                         n2s(sdata, s->s3->server_opaque_prf_input_len);
 945                         if (s->s3->server_opaque_prf_input_len != size - 2)
 946                                 {
 947                                 *al = SSL_AD_DECODE_ERROR;
 948                                 return 0;
 949                                 }
 950
 951                         if (s->s3->server_opaque_prf_input != NULL) /* shouldn't really happen */
 952                                 OPENSSL_free(s->s3->server_opaque_prf_input);
 953                         if (s->s3->server_opaque_prf_input_len == 0)
 954                                 s->s3->server_opaque_prf_input = OPENSSL_malloc(1); /* dummy byte just to get non-NULL */
 955                         else
 956                                 s->s3->server_opaque_prf_input = BUF_memdup(sdata, s->s3->server_opaque_prf_input_len);
 957
 958                         if (s->s3->server_opaque_prf_input == NULL)
 959                                 {
 960                                 *al = TLS1_AD_INTERNAL_ERROR;
 961                                 return 0;
 962                                 }
 963                         }
 964 #endif
 965                 else if (type == TLSEXT_TYPE_status_request)
 966                         {
 967                         /* MUST be empty and only sent if we've requested
 968                          * a status request message.
 969                          */
 970                         if ((s->tlsext_status_type == -1) || (size > 0))
 971                                 {
 972                                 *al = TLS1_AD_UNSUPPORTED_EXTENSION;
 973                                 return 0;
 974                                 }
 975                         /* Set flag to expect CertificateStatus message */
 976                         s->tlsext_status_expected = 1;
 977                         }
 978
 979                 data+=size;
 980                 }
 981
 982         if (data != d+n)
 983                 {
 984                 *al = SSL_AD_DECODE_ERROR;
 985                 return 0;
 986                 }
 987
 988         if (!s->hit && tlsext_servername == 1)
 989                 {
 990                 if (s->tlsext_hostname)
 991                         {
 992                         if (s->session->tlsext_hostname == NULL)
 993                                 {
 994                                 s->session->tlsext_hostname = BUF_strdup(s->tlsext_hostname);
 995                                 if (!s->session->tlsext_hostname)
 996                                         {
 997                                         *al = SSL_AD_UNRECOGNIZED_NAME;
 998                                         return 0;
 999                                         }
1000                                 }
1001                         else
1002                                 {
1003                                 *al = SSL_AD_DECODE_ERROR;
1004                                 return 0;
1005                                 }
1006                         }
1007                 }
1008
1009         *p = data;
1010         return 1;
1011         }
1012
1013
1014 int ssl_prepare_clienthello_tlsext(SSL *s)
1015         {
1016 #ifndef OPENSSL_NO_EC
1017         /* If we are client and using an elliptic curve cryptography cipher suite, send the point formats
1018          * and elliptic curves we support.
1019          */
1020         int using_ecc = 0;
1021         int i;
1022         unsigned char *j;
1023         unsigned long alg_k, alg_a;
1024         STACK_OF(SSL_CIPHER) *cipher_stack = SSL_get_ciphers(s);
1025
1026         for (i = 0; i < sk_SSL_CIPHER_num(cipher_stack); i++)
1027                 {
1028                 SSL_CIPHER *c = sk_SSL_CIPHER_value(cipher_stack, i);
1029
1030                 alg_k = c->algorithm_mkey;
1031                 alg_a = c->algorithm_auth;
1032                 if ((alg_k & (SSL_kEECDH|SSL_kECDHr|SSL_kECDHe) || (alg_a & SSL_aECDSA)))
1033                         {
1034                         using_ecc = 1;
1035                         break;
1036                         }
1037                 }
1038         using_ecc = using_ecc && (s->version == TLS1_VERSION);
1039         if (using_ecc)
1040                 {
1041                 if (s->tlsext_ecpointformatlist != NULL) OPENSSL_free(s->tlsext_ecpointformatlist);
1042                 if ((s->tlsext_ecpointformatlist = OPENSSL_malloc(3)) == NULL)
1043                         {
1044                         SSLerr(SSL_F_SSL_PREPARE_CLIENTHELLO_TLSEXT,ERR_R_MALLOC_FAILURE);
1045                         return -1;
1046                         }
1047                 s->tlsext_ecpointformatlist_length = 3;
1048                 s->tlsext_ecpointformatlist[0] = TLSEXT_ECPOINTFORMAT_uncompressed;
1049                 s->tlsext_ecpointformatlist[1] = TLSEXT_ECPOINTFORMAT_ansiX962_compressed_prime;
1050                 s->tlsext_ecpointformatlist[2] = TLSEXT_ECPOINTFORMAT_ansiX962_compressed_char2;
1051
1052                 /* we support all named elliptic curves in draft-ietf-tls-ecc-12 */
1053                 if (s->tlsext_ellipticcurvelist != NULL) OPENSSL_free(s->tlsext_ellipticcurvelist);
1054                 s->tlsext_ellipticcurvelist_length = sizeof(nid_list)/sizeof(nid_list[0]) * 2;
1055                 if ((s->tlsext_ellipticcurvelist = OPENSSL_malloc(s->tlsext_ellipticcurvelist_length)) == NULL)
1056                         {
1057                         s->tlsext_ellipticcurvelist_length = 0;
1058                         SSLerr(SSL_F_SSL_PREPARE_CLIENTHELLO_TLSEXT,ERR_R_MALLOC_FAILURE);
1059                         return -1;
1060                         }
1061                 for (i = 1, j = s->tlsext_ellipticcurvelist; i <= sizeof(nid_list)/sizeof(nid_list[0]); i++)
1062                         s2n(i,j);
1063                 }
1064 #endif /* OPENSSL_NO_EC */
1065
1066 #ifdef TLSEXT_TYPE_opaque_prf_input
1067         {
1068                 int r = 1;
1069
1070                 if (s->ctx->tlsext_opaque_prf_input_callback != 0)
1071                         {
1072                         r = s->ctx->tlsext_opaque_prf_input_callback(s, NULL, 0, s->ctx->tlsext_opaque_prf_input_callback_arg);
1073                         if (!r)
1074                                 return -1;
1075                         }
1076
1077                 if (s->tlsext_opaque_prf_input != NULL)
1078                         {
1079                         if (s->s3->client_opaque_prf_input != NULL) /* shouldn't really happen */
1080                                 OPENSSL_free(s->s3->client_opaque_prf_input);
1081
1082                         if (s->tlsext_opaque_prf_input_len == 0)
1083                                 s->s3->client_opaque_prf_input = OPENSSL_malloc(1); /* dummy byte just to get non-NULL */
1084                         else
1085                                 s->s3->client_opaque_prf_input = BUF_memdup(s->tlsext_opaque_prf_input, s->tlsext_opaque_prf_input_len);
1086                         if (s->s3->client_opaque_prf_input == NULL)
1087                                 {
1088                                 SSLerr(SSL_F_SSL_PREPARE_CLIENTHELLO_TLSEXT,ERR_R_MALLOC_FAILURE);
1089                                 return -1;
1090                                 }
1091                         s->s3->client_opaque_prf_input_len = s->tlsext_opaque_prf_input_len;
1092                         }
1093
1094                 if (r == 2)
1095                         /* at callback's request, insist on receiving an appropriate server opaque PRF input */
1096                         s->s3->server_opaque_prf_input_len = s->tlsext_opaque_prf_input_len;
1097         }
1098 #endif
1099
1100         return 1;
1101         }
1102
1103 int ssl_prepare_serverhello_tlsext(SSL *s)
1104         {
1105 #ifndef OPENSSL_NO_EC
1106         /* If we are server and using an ECC cipher suite, send the point formats we support
1107          * if the client sent us an ECPointsFormat extension.  Note that the server is not
1108          * supposed to send an EllipticCurves extension.
1109          */
1110
1111         unsigned long alg_k = s->s3->tmp.new_cipher->algorithm_mkey;
1112         unsigned long alg_a = s->s3->tmp.new_cipher->algorithm_auth;
1113         int using_ecc = (alg_k & (SSL_kEECDH|SSL_kECDHr|SSL_kECDHe)) || (alg_a & SSL_aECDSA);
1114         using_ecc = using_ecc && (s->session->tlsext_ecpointformatlist != NULL);
1115
1116         if (using_ecc)
1117                 {
1118                 if (s->tlsext_ecpointformatlist != NULL) OPENSSL_free(s->tlsext_ecpointformatlist);
1119                 if ((s->tlsext_ecpointformatlist = OPENSSL_malloc(3)) == NULL)
1120                         {
1121                         SSLerr(SSL_F_SSL_PREPARE_SERVERHELLO_TLSEXT,ERR_R_MALLOC_FAILURE);
1122                         return -1;
1123                         }
1124                 s->tlsext_ecpointformatlist_length = 3;
1125                 s->tlsext_ecpointformatlist[0] = TLSEXT_ECPOINTFORMAT_uncompressed;
1126                 s->tlsext_ecpointformatlist[1] = TLSEXT_ECPOINTFORMAT_ansiX962_compressed_prime;
1127                 s->tlsext_ecpointformatlist[2] = TLSEXT_ECPOINTFORMAT_ansiX962_compressed_char2;
1128                 }
1129 #endif /* OPENSSL_NO_EC */
1130
1131         return 1;
1132         }
1133
1134 int ssl_check_clienthello_tlsext(SSL *s)
1135         {
1136         int ret=SSL_TLSEXT_ERR_NOACK;
1137         int al = SSL_AD_UNRECOGNIZED_NAME;
1138
1139 #ifndef OPENSSL_NO_EC
1140         /* The handling of the ECPointFormats extension is done elsewhere, namely in
1141          * ssl3_choose_cipher in s3_lib.c.
1142          */
1143         /* The handling of the EllipticCurves extension is done elsewhere, namely in
1144          * ssl3_choose_cipher in s3_lib.c.
1145          */
1146 #endif
1147
1148         if (s->ctx != NULL && s->ctx->tlsext_servername_callback != 0)
1149                 ret = s->ctx->tlsext_servername_callback(s, &al, s->ctx->tlsext_servername_arg);
1150         else if (s->initial_ctx != NULL && s->initial_ctx->tlsext_servername_callback != 0)
1151                 ret = s->initial_ctx->tlsext_servername_callback(s, &al, s->initial_ctx->tlsext_servername_arg);
1152
1153         /* If status request then ask callback what to do.
1154          * Note: this must be called after servername callbacks in case
1155          * the certificate has changed.
1156          */
1157         if ((s->tlsext_status_type != -1) && s->ctx->tlsext_status_cb)
1158                 {
1159                 int r;
1160                 r = s->ctx->tlsext_status_cb(s, s->ctx->tlsext_status_arg);
1161                 switch (r)
1162                         {
1163                         /* We don't want to send a status request response */
1164                         case SSL_TLSEXT_ERR_NOACK:
1165                                 s->tlsext_status_expected = 0;
1166                                 break;
1167                         /* status request response should be sent */
1168                         case SSL_TLSEXT_ERR_OK:
1169                                 if (s->tlsext_ocsp_resp)
1170                                         s->tlsext_status_expected = 1;
1171                                 else
1172                                         s->tlsext_status_expected = 0;
1173                                 break;
1174                         /* something bad happened */
1175                         case SSL_TLSEXT_ERR_ALERT_FATAL:
1176                                 ret = SSL_TLSEXT_ERR_ALERT_FATAL;
1177                                 al = SSL_AD_INTERNAL_ERROR;
1178                                 goto err;
1179                         }
1180                 }
1181         else
1182                 s->tlsext_status_expected = 0;
1183
1184 #ifdef TLSEXT_TYPE_opaque_prf_input
1185         {
1186                 /* This sort of belongs into ssl_prepare_serverhello_tlsext(),
1187                  * but we might be sending an alert in response to the client hello,
1188                  * so this has to happen here in ssl_check_clienthello_tlsext(). */
1189
1190                 int r = 1;
1191
1192                 if (s->ctx->tlsext_opaque_prf_input_callback != 0)
1193                         {
1194                         r = s->ctx->tlsext_opaque_prf_input_callback(s, NULL, 0, s->ctx->tlsext_opaque_prf_input_callback_arg);
1195                         if (!r)
1196                                 {
1197                                 ret = SSL_TLSEXT_ERR_ALERT_FATAL;
1198                                 al = SSL_AD_INTERNAL_ERROR;
1199                                 goto err;
1200                                 }
1201                         }
1202
1203                 if (s->s3->server_opaque_prf_input != NULL) /* shouldn't really happen */
1204                         OPENSSL_free(s->s3->server_opaque_prf_input);
1205                 s->s3->server_opaque_prf_input = NULL;
1206
1207                 if (s->tlsext_opaque_prf_input != NULL)
1208                         {
1209                         if (s->s3->client_opaque_prf_input != NULL &&
1210                                 s->s3->client_opaque_prf_input_len == s->tlsext_opaque_prf_input_len)
1211                                 {
1212                                 /* can only use this extension if we have a server opaque PRF input
1213                                  * of the same length as the client opaque PRF input! */
1214
1215                                 if (s->tlsext_opaque_prf_input_len == 0)
1216                                         s->s3->server_opaque_prf_input = OPENSSL_malloc(1); /* dummy byte just to get non-NULL */
1217                                 else
1218                                         s->s3->server_opaque_prf_input = BUF_memdup(s->tlsext_opaque_prf_input, s->tlsext_opaque_prf_input_len);
1219                                 if (s->s3->server_opaque_prf_input == NULL)
1220                                         {
1221                                         ret = SSL_TLSEXT_ERR_ALERT_FATAL;
1222                                         al = SSL_AD_INTERNAL_ERROR;
1223                                         goto err;
1224                                         }
1225                                 s->s3->server_opaque_prf_input_len = s->tlsext_opaque_prf_input_len;
1226                                 }
1227                         }
1228
1229                 if (r == 2 && s->s3->server_opaque_prf_input == NULL)
1230                         {
1231                         /* The callback wants to enforce use of the extension,
1232                          * but we can't do that with the client opaque PRF input;
1233                          * abort the handshake.
1234                          */
1235                         ret = SSL_TLSEXT_ERR_ALERT_FATAL;
1236                         al = SSL_AD_HANDSHAKE_FAILURE;
1237                         }
1238         }
1239
1240 #endif
1241  err:
1242         switch (ret)
1243                 {
1244                 case SSL_TLSEXT_ERR_ALERT_FATAL:
1245                         ssl3_send_alert(s,SSL3_AL_FATAL,al);
1246                         return -1;
1247
1248                 case SSL_TLSEXT_ERR_ALERT_WARNING:
1249                         ssl3_send_alert(s,SSL3_AL_WARNING,al);
1250                         return 1;
1251
1252                 case SSL_TLSEXT_ERR_NOACK:
1253                         s->servername_done=0;
1254                         default:
1255                 return 1;
1256                 }
1257         }
1258
1259 int ssl_check_serverhello_tlsext(SSL *s)
1260         {
1261         int ret=SSL_TLSEXT_ERR_NOACK;
1262         int al = SSL_AD_UNRECOGNIZED_NAME;
1263
1264 #ifndef OPENSSL_NO_EC
1265         /* If we are client and using an elliptic curve cryptography cipher suite, then server
1266          * must return a an EC point formats lists containing uncompressed.
1267          */
1268         unsigned long alg_k = s->s3->tmp.new_cipher->algorithm_mkey;
1269         unsigned long alg_a = s->s3->tmp.new_cipher->algorithm_auth;
1270         if ((s->tlsext_ecpointformatlist != NULL) && (s->tlsext_ecpointformatlist_length > 0) &&
1271             ((alg_k & (SSL_kEECDH|SSL_kECDHr|SSL_kECDHe)) || (alg_a & SSL_aECDSA)))
1272                 {
1273                 /* we are using an ECC cipher */
1274                 size_t i;
1275                 unsigned char *list;
1276                 int found_uncompressed = 0;
1277                 if ((s->session->tlsext_ecpointformatlist == NULL) || (s->session->tlsext_ecpointformatlist_length == 0))
1278                         {
1279                         SSLerr(SSL_F_SSL_CHECK_SERVERHELLO_TLSEXT,SSL_R_TLS_INVALID_ECPOINTFORMAT_LIST);
1280                         return -1;
1281                         }
1282                 list = s->session->tlsext_ecpointformatlist;
1283                 for (i = 0; i < s->session->tlsext_ecpointformatlist_length; i++)
1284                         {
1285                         if (*(list++) == TLSEXT_ECPOINTFORMAT_uncompressed)
1286                                 {
1287                                 found_uncompressed = 1;
1288                                 break;
1289                                 }
1290                         }
1291                 if (!found_uncompressed)
1292                         {
1293                         SSLerr(SSL_F_SSL_CHECK_SERVERHELLO_TLSEXT,SSL_R_TLS_INVALID_ECPOINTFORMAT_LIST);
1294                         return -1;
1295                         }
1296                 }
1297         ret = SSL_TLSEXT_ERR_OK;
1298 #endif /* OPENSSL_NO_EC */
1299
1300         if (s->ctx != NULL && s->ctx->tlsext_servername_callback != 0)
1301                 ret = s->ctx->tlsext_servername_callback(s, &al, s->ctx->tlsext_servername_arg);
1302         else if (s->initial_ctx != NULL && s->initial_ctx->tlsext_servername_callback != 0)
1303                 ret = s->initial_ctx->tlsext_servername_callback(s, &al, s->initial_ctx->tlsext_servername_arg);
1304
1305 #ifdef TLSEXT_TYPE_opaque_prf_input
1306         if (s->s3->server_opaque_prf_input_len > 0)
1307                 {
1308                 /* This case may indicate that we, as a client, want to insist on using opaque PRF inputs.
1309                  * So first verify that we really have a value from the server too. */
1310
1311                 if (s->s3->server_opaque_prf_input == NULL)
1312                         {
1313                         ret = SSL_TLSEXT_ERR_ALERT_FATAL;
1314                         al = SSL_AD_HANDSHAKE_FAILURE;
1315                         }
1316
1317                 /* Anytime the server *has* sent an opaque PRF input, we need to check
1318                  * that we have a client opaque PRF input of the same size. */
1319                 if (s->s3->client_opaque_prf_input == NULL ||
1320                     s->s3->client_opaque_prf_input_len != s->s3->server_opaque_prf_input_len)
1321                         {
1322                         ret = SSL_TLSEXT_ERR_ALERT_FATAL;
1323                         al = SSL_AD_ILLEGAL_PARAMETER;
1324                         }
1325                 }
1326 #endif
1327
1328         /* If we've requested certificate status and we wont get one
1329          * tell the callback
1330          */
1331         if ((s->tlsext_status_type != -1) && !(s->tlsext_status_expected)
1332                         && s->ctx->tlsext_status_cb)
1333                 {
1334                 int r;
1335                 /* Set resp to NULL, resplen to -1 so callback knows
1336                  * there is no response.
1337                  */
1338                 if (s->tlsext_ocsp_resp)
1339                         {
1340                         OPENSSL_free(s->tlsext_ocsp_resp);
1341                         s->tlsext_ocsp_resp = NULL;
1342                         }
1343                 s->tlsext_ocsp_resplen = -1;
1344                 r = s->ctx->tlsext_status_cb(s, s->ctx->tlsext_status_arg);
1345                 if (r == 0)
1346                         {
1347                         al = SSL_AD_BAD_CERTIFICATE_STATUS_RESPONSE;
1348                         ret = SSL_TLSEXT_ERR_ALERT_FATAL;
1349                         }
1350                 if (r < 0)
1351                         {
1352                         al = SSL_AD_INTERNAL_ERROR;
1353                         ret = SSL_TLSEXT_ERR_ALERT_FATAL;
1354                         }
1355                 }
1356
1357         switch (ret)
1358                 {
1359                 case SSL_TLSEXT_ERR_ALERT_FATAL:
1360                         ssl3_send_alert(s,SSL3_AL_FATAL,al);
1361                         return -1;
1362
1363                 case SSL_TLSEXT_ERR_ALERT_WARNING:
1364                         ssl3_send_alert(s,SSL3_AL_WARNING,al);
1365                         return 1;
1366
1367                 case SSL_TLSEXT_ERR_NOACK:
1368                         s->servername_done=0;
1369                         default:
1370                 return 1;
1371                 }
1372         }
1373
1374 /* Since the server cache lookup is done early on in the processing of client
1375  * hello and other operations depend on the result we need to handle any TLS
1376  * session ticket extension at the same time.
1377  */
1378
1379 int tls1_process_ticket(SSL *s, unsigned char *session_id, int len,
1380                                 const unsigned char *limit, SSL_SESSION **ret)
1381         {
1382         /* Point after session ID in client hello */
1383         const unsigned char *p = session_id + len;
1384         unsigned short i;
1385         if ((s->version <= SSL3_VERSION) || !limit)
1386                 return 1;
1387         if (p >= limit)
1388                 return -1;
1389         /* Skip past cipher list */
1390         n2s(p, i);
1391         p+= i;
1392         if (p >= limit)
1393                 return -1;
1394         /* Skip past compression algorithm list */
1395         i = *(p++);
1396         p += i;
1397         if (p > limit)
1398                 return -1;
1399         /* Now at start of extensions */
1400         if ((p + 2) >= limit)
1401                 return 1;
1402         n2s(p, i);
1403         while ((p + 4) <= limit)
1404                 {
1405                 unsigned short type, size;
1406                 n2s(p, type);
1407                 n2s(p, size);
1408                 if (p + size > limit)
1409                         return 1;
1410                 if (type == TLSEXT_TYPE_session_ticket)
1411                         {
1412                         /* If tickets disabled indicate cache miss which will
1413                          * trigger a full handshake
1414                          */
1415                         if (SSL_get_options(s) & SSL_OP_NO_TICKET)
1416                                 return 0;
1417                         /* If zero length not client will accept a ticket
1418                          * and indicate cache miss to trigger full handshake
1419                          */
1420                         if (size == 0)
1421                                 {
1422                                 s->tlsext_ticket_expected = 1;
1423                                 return 0;       /* Cache miss */
1424                                 }
1425                         return tls_decrypt_ticket(s, p, size, session_id, len,
1426                                                                         ret);
1427                         }
1428                 p += size;
1429                 }
1430         return 1;
1431         }
1432
1433 static int tls_decrypt_ticket(SSL *s, const unsigned char *etick, int eticklen,
1434                                 const unsigned char *sess_id, int sesslen,
1435                                 SSL_SESSION **psess)
1436         {
1437         SSL_SESSION *sess;
1438         unsigned char *sdec;
1439         const unsigned char *p;
1440         int slen, mlen;
1441         unsigned char tick_hmac[EVP_MAX_MD_SIZE];
1442         HMAC_CTX hctx;
1443         EVP_CIPHER_CTX ctx;
1444         /* Attempt to process session ticket, first conduct sanity and
1445          * integrity checks on ticket.
1446          */
1447         mlen = EVP_MD_size(tlsext_tick_md());
1448         eticklen -= mlen;
1449         /* Need at least keyname + iv + some encrypted data */
1450         if (eticklen < 48)
1451                 goto tickerr;
1452         /* Check key name matches */
1453         if (memcmp(etick, s->ctx->tlsext_tick_key_name, 16))
1454                 goto tickerr;
1455         /* Check HMAC of encrypted ticket */
1456         HMAC_CTX_init(&hctx);
1457         HMAC_Init_ex(&hctx, s->ctx->tlsext_tick_hmac_key, 16,
1458                                 tlsext_tick_md(), NULL);
1459         HMAC_Update(&hctx, etick, eticklen);
1460         HMAC_Final(&hctx, tick_hmac, NULL);
1461         HMAC_CTX_cleanup(&hctx);
1462         if (memcmp(tick_hmac, etick + eticklen, mlen))
1463                 goto tickerr;
1464         /* Set p to start of IV */
1465         p = etick + 16;
1466         EVP_CIPHER_CTX_init(&ctx);
1467         /* Attempt to decrypt session data */
1468         EVP_DecryptInit_ex(&ctx, EVP_aes_128_cbc(), NULL,
1469                                         s->ctx->tlsext_tick_aes_key, p);
1470         /* Move p after IV to start of encrypted ticket, update length */
1471         p += 16;
1472         eticklen -= 32;
1473         sdec = OPENSSL_malloc(eticklen);
1474         if (!sdec)
1475                 {
1476                 EVP_CIPHER_CTX_cleanup(&ctx);
1477                 return -1;
1478                 }
1479         EVP_DecryptUpdate(&ctx, sdec, &slen, p, eticklen);
1480         if (EVP_DecryptFinal(&ctx, sdec + slen, &mlen) <= 0)
1481                 goto tickerr;
1482         slen += mlen;
1483         EVP_CIPHER_CTX_cleanup(&ctx);
1484         p = sdec;
1485
1486         sess = d2i_SSL_SESSION(NULL, &p, slen);
1487         OPENSSL_free(sdec);
1488         if (sess)
1489                 {
1490                 /* The session ID if non-empty is used by some clients to
1491                  * detect that the ticket has been accepted. So we copy it to
1492                  * the session structure. If it is empty set length to zero
1493                  * as required by standard.
1494                  */
1495                 if (sesslen)
1496                         memcpy(sess->session_id, sess_id, sesslen);
1497                 sess->session_id_length = sesslen;
1498                 *psess = sess;
1499                 s->tlsext_ticket_expected = 0;
1500                 return 1;
1501                 }
1502         /* If session decrypt failure indicate a cache miss and set state to
1503          * send a new ticket
1504          */
1505         tickerr:
1506         s->tlsext_ticket_expected = 1;
1507         return 0;
1508         }
1509
1510 #endif