ssl/t1_lib.c

   1 /* ssl/t1_lib.c */
   2 /* Copyright (C) 1995-1998 Eric Young (eay@cryptsoft.com)
   3  * All rights reserved.
   4  *
   5  * This package is an SSL implementation written
   6  * by Eric Young (eay@cryptsoft.com).
   7  * The implementation was written so as to conform with Netscapes SSL.
   8  *
   9  * This library is free for commercial and non-commercial use as long as
  10  * the following conditions are aheared to.  The following conditions
  11  * apply to all code found in this distribution, be it the RC4, RSA,
  12  * lhash, DES, etc., code; not just the SSL code.  The SSL documentation
  13  * included with this distribution is covered by the same copyright terms
  14  * except that the holder is Tim Hudson (tjh@cryptsoft.com).
  15  *
  16  * Copyright remains Eric Young's, and as such any Copyright notices in
  17  * the code are not to be removed.
  18  * If this package is used in a product, Eric Young should be given attribution
  19  * as the author of the parts of the library used.
  20  * This can be in the form of a textual message at program startup or
  21  * in documentation (online or textual) provided with the package.
  22  *
  23  * Redistribution and use in source and binary forms, with or without
  24  * modification, are permitted provided that the following conditions
  25  * are met:
  26  * 1. Redistributions of source code must retain the copyright
  27  *    notice, this list of conditions and the following disclaimer.
  28  * 2. Redistributions in binary form must reproduce the above copyright
  29  *    notice, this list of conditions and the following disclaimer in the
  30  *    documentation and/or other materials provided with the distribution.
  31  * 3. All advertising materials mentioning features or use of this software
  32  *    must display the following acknowledgement:
  33  *    "This product includes cryptographic software written by
  34  *     Eric Young (eay@cryptsoft.com)"
  35  *    The word 'cryptographic' can be left out if the rouines from the library
  36  *    being used are not cryptographic related :-).
  37  * 4. If you include any Windows specific code (or a derivative thereof) from
  38  *    the apps directory (application code) you must include an acknowledgement:
  39  *    "This product includes software written by Tim Hudson (tjh@cryptsoft.com)"
  40  *
  41  * THIS SOFTWARE IS PROVIDED BY ERIC YOUNG ``AS IS'' AND
  42  * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
  43  * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
  44  * ARE DISCLAIMED.  IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE
  45  * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
  46  * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
  47  * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
  48  * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
  49  * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
  50  * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
  51  * SUCH DAMAGE.
  52  *
  53  * The licence and distribution terms for any publically available version or
  54  * derivative of this code cannot be changed.  i.e. this code cannot simply be
  55  * copied and put under another distribution licence
  56  * [including the GNU Public Licence.]
  57  */
  58 /* ====================================================================
  59  * Copyright (c) 1998-2007 The OpenSSL Project.  All rights reserved.
  60  *
  61  * Redistribution and use in source and binary forms, with or without
  62  * modification, are permitted provided that the following conditions
  63  * are met:
  64  *
  65  * 1. Redistributions of source code must retain the above copyright
  66  *    notice, this list of conditions and the following disclaimer.
  67  *
  68  * 2. Redistributions in binary form must reproduce the above copyright
  69  *    notice, this list of conditions and the following disclaimer in
  70  *    the documentation and/or other materials provided with the
  71  *    distribution.
  72  *
  73  * 3. All advertising materials mentioning features or use of this
  74  *    software must display the following acknowledgment:
  75  *    "This product includes software developed by the OpenSSL Project
  76  *    for use in the OpenSSL Toolkit. (http://www.openssl.org/)"
  77  *
  78  * 4. The names "OpenSSL Toolkit" and "OpenSSL Project" must not be used to
  79  *    endorse or promote products derived from this software without
  80  *    prior written permission. For written permission, please contact
  81  *    openssl-core@openssl.org.
  82  *
  83  * 5. Products derived from this software may not be called "OpenSSL"
  84  *    nor may "OpenSSL" appear in their names without prior written
  85  *    permission of the OpenSSL Project.
  86  *
  87  * 6. Redistributions of any form whatsoever must retain the following
  88  *    acknowledgment:
  89  *    "This product includes software developed by the OpenSSL Project
  90  *    for use in the OpenSSL Toolkit (http://www.openssl.org/)"
  91  *
  92  * THIS SOFTWARE IS PROVIDED BY THE OpenSSL PROJECT ``AS IS'' AND ANY
  93  * EXPRESSED OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
  94  * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
  95  * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL THE OpenSSL PROJECT OR
  96  * ITS CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
  97  * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
  98  * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
  99  * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
 100  * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT,
 101  * STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
 102  * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED
 103  * OF THE POSSIBILITY OF SUCH DAMAGE.
 104  * ====================================================================
 105  *
 106  * This product includes cryptographic software written by Eric Young
 107  * (eay@cryptsoft.com).  This product includes software written by Tim
 108  * Hudson (tjh@cryptsoft.com).
 109  *
 110  */
 111
 112 #include <stdio.h>
 113 #include <openssl/objects.h>
 114 #include <openssl/evp.h>
 115 #include <openssl/hmac.h>
 116 #include <openssl/ocsp.h>
 117 #include <openssl/rand.h>
 118 #include "ssl_locl.h"
 119
 120 const char tls1_version_str[]="TLSv1" OPENSSL_VERSION_PTEXT;
 121
 122 #ifndef OPENSSL_NO_TLSEXT
 123 static int tls_decrypt_ticket(SSL *s, const unsigned char *tick, int ticklen,
 124                                 const unsigned char *sess_id, int sesslen,
 125                                 SSL_SESSION **psess);
 126 static int ssl_check_clienthello_tlsext(SSL *s);
 127 int ssl_check_serverhello_tlsext(SSL *s);
 128 #endif
 129
 130 SSL3_ENC_METHOD TLSv1_enc_data={
 131         tls1_enc,
 132         tls1_mac,
 133         tls1_setup_key_block,
 134         tls1_generate_master_secret,
 135         tls1_change_cipher_state,
 136         tls1_final_finish_mac,
 137         TLS1_FINISH_MAC_LENGTH,
 138         tls1_cert_verify_mac,
 139         TLS_MD_CLIENT_FINISH_CONST,TLS_MD_CLIENT_FINISH_CONST_SIZE,
 140         TLS_MD_SERVER_FINISH_CONST,TLS_MD_SERVER_FINISH_CONST_SIZE,
 141         tls1_alert_code,
 142         tls1_export_keying_material,
 143         };
 144
 145 long tls1_default_timeout(void)
 146         {
 147         /* 2 hours, the 24 hours mentioned in the TLSv1 spec
 148          * is way too long for http, the cache would over fill */
 149         return(60*60*2);
 150         }
 151
 152 int tls1_new(SSL *s)
 153         {
 154         if (!ssl3_new(s)) return(0);
 155         s->method->ssl_clear(s);
 156         return(1);
 157         }
 158
 159 void tls1_free(SSL *s)
 160         {
 161 #ifndef OPENSSL_NO_TLSEXT
 162         if (s->tlsext_session_ticket)
 163                 {
 164                 OPENSSL_free(s->tlsext_session_ticket);
 165                 }
 166 #endif /* OPENSSL_NO_TLSEXT */
 167         ssl3_free(s);
 168         }
 169
 170 void tls1_clear(SSL *s)
 171         {
 172         ssl3_clear(s);
 173         s->version = s->method->version;
 174         }
 175
 176 #ifndef OPENSSL_NO_EC
 177
 178 static int nid_list[] =
 179         {
 180                 NID_sect163k1, /* sect163k1 (1) */
 181                 NID_sect163r1, /* sect163r1 (2) */
 182                 NID_sect163r2, /* sect163r2 (3) */
 183                 NID_sect193r1, /* sect193r1 (4) */
 184                 NID_sect193r2, /* sect193r2 (5) */
 185                 NID_sect233k1, /* sect233k1 (6) */
 186                 NID_sect233r1, /* sect233r1 (7) */
 187                 NID_sect239k1, /* sect239k1 (8) */
 188                 NID_sect283k1, /* sect283k1 (9) */
 189                 NID_sect283r1, /* sect283r1 (10) */
 190                 NID_sect409k1, /* sect409k1 (11) */
 191                 NID_sect409r1, /* sect409r1 (12) */
 192                 NID_sect571k1, /* sect571k1 (13) */
 193                 NID_sect571r1, /* sect571r1 (14) */
 194                 NID_secp160k1, /* secp160k1 (15) */
 195                 NID_secp160r1, /* secp160r1 (16) */
 196                 NID_secp160r2, /* secp160r2 (17) */
 197                 NID_secp192k1, /* secp192k1 (18) */
 198                 NID_X9_62_prime192v1, /* secp192r1 (19) */
 199                 NID_secp224k1, /* secp224k1 (20) */
 200                 NID_secp224r1, /* secp224r1 (21) */
 201                 NID_secp256k1, /* secp256k1 (22) */
 202                 NID_X9_62_prime256v1, /* secp256r1 (23) */
 203                 NID_secp384r1, /* secp384r1 (24) */
 204                 NID_secp521r1  /* secp521r1 (25) */
 205         };
 206
 207
 208 static const unsigned char ecformats_default[] =
 209         {
 210         TLSEXT_ECPOINTFORMAT_uncompressed,
 211         TLSEXT_ECPOINTFORMAT_ansiX962_compressed_prime,
 212         TLSEXT_ECPOINTFORMAT_ansiX962_compressed_char2
 213         };
 214
 215 static const unsigned char eccurves_default[] =
 216         {
 217                 0,14, /* sect571r1 (14) */
 218                 0,13, /* sect571k1 (13) */
 219                 0,25, /* secp521r1 (25) */
 220                 0,11, /* sect409k1 (11) */
 221                 0,12, /* sect409r1 (12) */
 222                 0,24, /* secp384r1 (24) */
 223                 0,9,  /* sect283k1 (9) */
 224                 0,10, /* sect283r1 (10) */
 225                 0,22, /* secp256k1 (22) */
 226                 0,23, /* secp256r1 (23) */
 227                 0,8,  /* sect239k1 (8) */
 228                 0,6,  /* sect233k1 (6) */
 229                 0,7,  /* sect233r1 (7) */
 230                 0,20, /* secp224k1 (20) */
 231                 0,21, /* secp224r1 (21) */
 232                 0,4,  /* sect193r1 (4) */
 233                 0,5,  /* sect193r2 (5) */
 234                 0,18, /* secp192k1 (18) */
 235                 0,19, /* secp192r1 (19) */
 236                 0,1,  /* sect163k1 (1) */
 237                 0,2,  /* sect163r1 (2) */
 238                 0,3,  /* sect163r2 (3) */
 239                 0,15, /* secp160k1 (15) */
 240                 0,16, /* secp160r1 (16) */
 241                 0,17, /* secp160r2 (17) */
 242         };
 243
 244 int tls1_ec_curve_id2nid(int curve_id)
 245         {
 246         /* ECC curves from draft-ietf-tls-ecc-12.txt (Oct. 17, 2005) */
 247         if ((curve_id < 1) || ((unsigned int)curve_id >
 248                                 sizeof(nid_list)/sizeof(nid_list[0])))
 249                 return 0;
 250         return nid_list[curve_id-1];
 251         }
 252
 253 int tls1_ec_nid2curve_id(int nid)
 254         {
 255         /* ECC curves from draft-ietf-tls-ecc-12.txt (Oct. 17, 2005) */
 256         switch (nid)
 257                 {
 258         case NID_sect163k1: /* sect163k1 (1) */
 259                 return 1;
 260         case NID_sect163r1: /* sect163r1 (2) */
 261                 return 2;
 262         case NID_sect163r2: /* sect163r2 (3) */
 263                 return 3;
 264         case NID_sect193r1: /* sect193r1 (4) */
 265                 return 4;
 266         case NID_sect193r2: /* sect193r2 (5) */
 267                 return 5;
 268         case NID_sect233k1: /* sect233k1 (6) */
 269                 return 6;
 270         case NID_sect233r1: /* sect233r1 (7) */
 271                 return 7;
 272         case NID_sect239k1: /* sect239k1 (8) */
 273                 return 8;
 274         case NID_sect283k1: /* sect283k1 (9) */
 275                 return 9;
 276         case NID_sect283r1: /* sect283r1 (10) */
 277                 return 10;
 278         case NID_sect409k1: /* sect409k1 (11) */
 279                 return 11;
 280         case NID_sect409r1: /* sect409r1 (12) */
 281                 return 12;
 282         case NID_sect571k1: /* sect571k1 (13) */
 283                 return 13;
 284         case NID_sect571r1: /* sect571r1 (14) */
 285                 return 14;
 286         case NID_secp160k1: /* secp160k1 (15) */
 287                 return 15;
 288         case NID_secp160r1: /* secp160r1 (16) */
 289                 return 16;
 290         case NID_secp160r2: /* secp160r2 (17) */
 291                 return 17;
 292         case NID_secp192k1: /* secp192k1 (18) */
 293                 return 18;
 294         case NID_X9_62_prime192v1: /* secp192r1 (19) */
 295                 return 19;
 296         case NID_secp224k1: /* secp224k1 (20) */
 297                 return 20;
 298         case NID_secp224r1: /* secp224r1 (21) */
 299                 return 21;
 300         case NID_secp256k1: /* secp256k1 (22) */
 301                 return 22;
 302         case NID_X9_62_prime256v1: /* secp256r1 (23) */
 303                 return 23;
 304         case NID_secp384r1: /* secp384r1 (24) */
 305                 return 24;
 306         case NID_secp521r1:  /* secp521r1 (25) */
 307                 return 25;
 308         default:
 309                 return 0;
 310                 }
 311         }
 312 /* Get curves list, if "sess" is set return client curves otherwise
 313  * preferred list
 314  */
 315 static void tls1_get_curvelist(SSL *s, int sess,
 316                                         const unsigned char **pcurves,
 317                                         size_t *pcurveslen)
 318         {
 319         if (sess)
 320                 {
 321                 *pcurves = s->session->tlsext_ellipticcurvelist;
 322                 *pcurveslen = s->session->tlsext_ellipticcurvelist_length;
 323                 }
 324         else
 325                 {
 326                 *pcurves = s->tlsext_ellipticcurvelist;
 327                 *pcurveslen = s->tlsext_ellipticcurvelist_length;
 328                 }
 329         /* If not set use default: for now static structure */
 330         if (!*pcurves)
 331                 {
 332                 *pcurves = eccurves_default;
 333                 *pcurveslen = sizeof(eccurves_default);
 334                 }
 335         }
 336
 337 /* Return nth shared curve. If nmatch == -1 return number of
 338  * matches.
 339  */
 340
 341 int tls1_shared_curve(SSL *s, int nmatch)
 342         {
 343         const unsigned char *pref, *supp;
 344         size_t preflen, supplen, i, j;
 345         int k;
 346         /* Can't do anything on client side */
 347         if (s->server == 0)
 348                 return -1;
 349         tls1_get_curvelist(s, !!(s->options & SSL_OP_CIPHER_SERVER_PREFERENCE),
 350                                 &supp, &supplen);
 351         tls1_get_curvelist(s, !(s->options & SSL_OP_CIPHER_SERVER_PREFERENCE),
 352                                 &pref, &preflen);
 353         preflen /= 2;
 354         supplen /= 2;
 355         k = 0;
 356         for (i = 0; i < preflen; i++, pref+=2)
 357                 {
 358                 const unsigned char *tsupp = supp;
 359                 for (j = 0; j < supplen; j++, tsupp+=2)
 360                         {
 361                         if (pref[0] == tsupp[0] && pref[1] == tsupp[1])
 362                                 {
 363                                 if (nmatch == k)
 364                                         {
 365                                         int id = (pref[0] << 8) | pref[1];
 366                                         return tls1_ec_curve_id2nid(id);
 367                                         }
 368                                 k++;
 369                                 }
 370                         }
 371                 }
 372         if (nmatch == -1)
 373                 return k;
 374         return 0;
 375         }
 376
 377 int tls1_set_curves(unsigned char **pext, size_t *pextlen,
 378                         int *curves, size_t ncurves)
 379         {
 380         unsigned char *clist, *p;
 381         size_t i;
 382         /* Bitmap of curves included to detect duplicates: only works
 383          * while curve ids < 32
 384          */
 385         unsigned long dup_list = 0;
 386         clist = OPENSSL_malloc(ncurves * 2);
 387         if (!clist)
 388                 return 0;
 389         for (i = 0, p = clist; i < ncurves; i++)
 390                 {
 391                 unsigned long idmask;
 392                 int id;
 393                 id = tls1_ec_nid2curve_id(curves[i]);
 394                 idmask = 1L << id;
 395                 if (!id || (dup_list & idmask))
 396                         {
 397                         OPENSSL_free(clist);
 398                         return 0;
 399                         }
 400                 dup_list |= idmask;
 401                 s2n(id, p);
 402                 }
 403         if (*pext)
 404                 OPENSSL_free(*pext);
 405         *pext = clist;
 406         *pextlen = ncurves * 2;
 407         return 1;
 408         }
 409
 410 #define MAX_CURVELIST   25
 411
 412 typedef struct
 413         {
 414         size_t nidcnt;
 415         int nid_arr[MAX_CURVELIST];
 416         } nid_cb_st;
 417
 418 static int nid_cb(const char *elem, int len, void *arg)
 419         {
 420         nid_cb_st *narg = arg;
 421         size_t i;
 422         int nid;
 423         char etmp[20];
 424         if (narg->nidcnt == MAX_CURVELIST)
 425                 return 0;
 426         if (len > (int)(sizeof(etmp) - 1))
 427                 return 0;
 428         memcpy(etmp, elem, len);
 429         etmp[len] = 0;
 430         nid = EC_curve_nist2nid(etmp);
 431         if (nid == NID_undef)
 432                 nid = OBJ_sn2nid(etmp);
 433         if (nid == NID_undef)
 434                 nid = OBJ_ln2nid(etmp);
 435         if (nid == NID_undef)
 436                 return 0;
 437         for (i = 0; i < narg->nidcnt; i++)
 438                 if (narg->nid_arr[i] == nid)
 439                         return 0;
 440         narg->nid_arr[narg->nidcnt++] = nid;
 441         return 1;
 442         }
 443 /* Set curves based on a colon separate list */
 444 int tls1_set_curves_list(unsigned char **pext, size_t *pextlen,
 445                                 const char *str)
 446         {
 447         nid_cb_st ncb;
 448         ncb.nidcnt = 0;
 449         if (!CONF_parse_list(str, ':', 1, nid_cb, &ncb))
 450                 return 0;
 451         return tls1_set_curves(pext, pextlen, ncb.nid_arr, ncb.nidcnt);
 452         }
 453 /* For an EC key set TLS id and required compression based on parameters */
 454 static int tls1_set_ec_id(unsigned char *curve_id, unsigned char *comp_id,
 455                                 EC_KEY *ec)
 456         {
 457         int is_prime, id;
 458         const EC_GROUP *grp;
 459         const EC_POINT *pt;
 460         const EC_METHOD *meth;
 461         if (!ec)
 462                 return 0;
 463         /* Determine if it is a prime field */
 464         grp = EC_KEY_get0_group(ec);
 465         pt = EC_KEY_get0_public_key(ec);
 466         if (!grp || !pt)
 467                 return 0;
 468         meth = EC_GROUP_method_of(grp);
 469         if (!meth)
 470                 return 0;
 471         if (EC_METHOD_get_field_type(meth) == NID_X9_62_prime_field)
 472                 is_prime = 1;
 473         else
 474                 is_prime = 0;
 475         /* Determine curve ID */
 476         id = EC_GROUP_get_curve_name(grp);
 477         id = tls1_ec_nid2curve_id(id);
 478         /* If we have an ID set it, otherwise set arbitrary explicit curve */
 479         if (id)
 480                 {
 481                 curve_id[0] = 0;
 482                 curve_id[1] = (unsigned char)id;
 483                 }
 484         else
 485                 {
 486                 curve_id[0] = 0xff;
 487                 if (is_prime)
 488                         curve_id[1] = 0x01;
 489                 else
 490                         curve_id[1] = 0x02;
 491                 }
 492         if (comp_id)
 493                 {
 494                 if (EC_KEY_get_conv_form(ec) == POINT_CONVERSION_COMPRESSED)
 495                         {
 496                         if (is_prime)
 497                                 *comp_id = TLSEXT_ECPOINTFORMAT_ansiX962_compressed_prime;
 498                         else
 499                                 *comp_id = TLSEXT_ECPOINTFORMAT_ansiX962_compressed_char2;
 500                         }
 501                 else
 502                         *comp_id = TLSEXT_ECPOINTFORMAT_uncompressed;
 503                 }
 504         return 1;
 505         }
 506 /* Check an EC key is compatible with extensions */
 507 static int tls1_check_ec_key(SSL *s,
 508                         unsigned char *curve_id, unsigned char *comp_id)
 509         {
 510         const unsigned char *p;
 511         size_t plen, i;
 512         int j;
 513         /* If point formats extension present check it, otherwise everything
 514          * is supported (see RFC4492).
 515          */
 516         if (comp_id && s->session->tlsext_ecpointformatlist)
 517                 {
 518                 p = s->session->tlsext_ecpointformatlist;
 519                 plen = s->session->tlsext_ecpointformatlist_length;
 520                 for (i = 0; i < plen; i++, p++)
 521                         {
 522                         if (*comp_id == *p)
 523                                 break;
 524                         }
 525                 if (i == plen)
 526                         return 0;
 527                 }
 528         /* Check curve is consistent with client and server preferences */
 529         for (j = 0; j <= 1; j++)
 530                 {
 531                 tls1_get_curvelist(s, j, &p, &plen);
 532                 for (i = 0; i < plen; i+=2, p+=2)
 533                         {
 534                         if (p[0] == curve_id[0] && p[1] == curve_id[1])
 535                                 break;
 536                         }
 537                 if (i == plen)
 538                         return 0;
 539                 }
 540         return 1;
 541         }
 542 /* Check EC server key is compatible with client extensions */
 543 int tls1_check_ec_server_key(SSL *s)
 544         {
 545         int rv;
 546         CERT_PKEY *cpk = s->cert->pkeys + SSL_PKEY_ECC;
 547         EVP_PKEY *pkey;
 548         unsigned char comp_id, curve_id[2];
 549         if (!cpk->x509 || !cpk->privatekey)
 550                 return 0;
 551         pkey = X509_get_pubkey(cpk->x509);
 552         if (!pkey)
 553                 return 0;
 554         rv = tls1_set_ec_id(curve_id, &comp_id, pkey->pkey.ec);
 555         EVP_PKEY_free(pkey);
 556         if (!rv)
 557                 return 0;
 558         return tls1_check_ec_key(s, curve_id, &comp_id);
 559         }
 560 /* Check EC temporary key is compatible with client extensions */
 561 int tls1_check_ec_tmp_key(SSL *s)
 562         {
 563         unsigned char curve_id[2];
 564         EC_KEY *ec = s->cert->ecdh_tmp;
 565         if (s->cert->ecdh_tmp_auto)
 566                 {
 567                 /* Need a shared curve */
 568                 if (tls1_shared_curve(s, 0))
 569                         return 1;
 570                 else return 0;
 571                 }
 572         if (!ec)
 573                 {
 574                 if (s->cert->ecdh_tmp_cb)
 575                         return 1;
 576                 else
 577                         return 0;
 578                 }
 579         if (!tls1_set_ec_id(curve_id, NULL, ec))
 580                 return 1;
 581         return tls1_check_ec_key(s, curve_id, NULL);
 582         }
 583
 584 #endif /* OPENSSL_NO_EC */
 585
 586 #ifndef OPENSSL_NO_TLSEXT
 587
 588 /* List of supported signature algorithms and hashes. Should make this
 589  * customisable at some point, for now include everything we support.
 590  */
 591
 592 #ifdef OPENSSL_NO_RSA
 593 #define tlsext_sigalg_rsa(md) /* */
 594 #else
 595 #define tlsext_sigalg_rsa(md) md, TLSEXT_signature_rsa,
 596 #endif
 597
 598 #ifdef OPENSSL_NO_DSA
 599 #define tlsext_sigalg_dsa(md) /* */
 600 #else
 601 #define tlsext_sigalg_dsa(md) md, TLSEXT_signature_dsa,
 602 #endif
 603
 604 #ifdef OPENSSL_NO_ECDSA
 605 #define tlsext_sigalg_ecdsa(md) /* */
 606 #else
 607 #define tlsext_sigalg_ecdsa(md) md, TLSEXT_signature_ecdsa,
 608 #endif
 609
 610 #define tlsext_sigalg(md) \
 611                 tlsext_sigalg_rsa(md) \
 612                 tlsext_sigalg_dsa(md) \
 613                 tlsext_sigalg_ecdsa(md)
 614
 615 static unsigned char tls12_sigalgs[] = {
 616 #ifndef OPENSSL_NO_SHA512
 617         tlsext_sigalg(TLSEXT_hash_sha512)
 618         tlsext_sigalg(TLSEXT_hash_sha384)
 619 #endif
 620 #ifndef OPENSSL_NO_SHA256
 621         tlsext_sigalg(TLSEXT_hash_sha256)
 622         tlsext_sigalg(TLSEXT_hash_sha224)
 623 #endif
 624 #ifndef OPENSSL_NO_SHA
 625         tlsext_sigalg(TLSEXT_hash_sha1)
 626 #endif
 627 #ifndef OPENSSL_NO_MD5
 628         tlsext_sigalg_rsa(TLSEXT_hash_md5)
 629 #endif
 630 };
 631
 632 int tls12_get_req_sig_algs(SSL *s, unsigned char *p)
 633         {
 634         size_t slen = sizeof(tls12_sigalgs);
 635 #ifdef OPENSSL_FIPS
 636         /* If FIPS mode don't include MD5 which is last */
 637         if (FIPS_mode())
 638                 slen -= 2;
 639 #endif
 640         if (p)
 641                 memcpy(p, tls12_sigalgs, slen);
 642         return (int)slen;
 643         }
 644
 645 /* byte_compare is a compare function for qsort(3) that compares bytes. */
 646 static int byte_compare(const void *in_a, const void *in_b)
 647         {
 648         unsigned char a = *((const unsigned char*) in_a);
 649         unsigned char b = *((const unsigned char*) in_b);
 650
 651         if (a > b)
 652                 return 1;
 653         else if (a < b)
 654                 return -1;
 655         return 0;
 656 }
 657
 658 unsigned char *ssl_add_clienthello_tlsext(SSL *s, unsigned char *p, unsigned char *limit)
 659         {
 660         int extdatalen=0;
 661         unsigned char *ret = p;
 662 #ifndef OPENSSL_NO_EC
 663         /* See if we support any ECC ciphersuites */
 664         int using_ecc = 0;
 665         if (s->version != DTLS1_VERSION && s->version >= TLS1_VERSION)
 666                 {
 667                 int i;
 668                 unsigned long alg_k, alg_a;
 669                 STACK_OF(SSL_CIPHER) *cipher_stack = SSL_get_ciphers(s);
 670
 671                 for (i = 0; i < sk_SSL_CIPHER_num(cipher_stack); i++)
 672                         {
 673                         SSL_CIPHER *c = sk_SSL_CIPHER_value(cipher_stack, i);
 674
 675                         alg_k = c->algorithm_mkey;
 676                         alg_a = c->algorithm_auth;
 677                         if ((alg_k & (SSL_kEECDH|SSL_kECDHr|SSL_kECDHe)
 678                                 || (alg_a & SSL_aECDSA)))
 679                                 {
 680                                 using_ecc = 1;
 681                                 break;
 682                                 }
 683                         }
 684                 }
 685 #endif
 686
 687         /* don't add extensions for SSLv3 unless doing secure renegotiation */
 688         if (s->client_version == SSL3_VERSION
 689                                         && !s->s3->send_connection_binding)
 690                 return p;
 691
 692         ret+=2;
 693
 694         if (ret>=limit) return NULL; /* this really never occurs, but ... */
 695
 696         if (s->tlsext_hostname != NULL)
 697                 {
 698                 /* Add TLS extension servername to the Client Hello message */
 699                 unsigned long size_str;
 700                 long lenmax;
 701
 702                 /* check for enough space.
 703                    4 for the servername type and entension length
 704                    2 for servernamelist length
 705                    1 for the hostname type
 706                    2 for hostname length
 707                    + hostname length
 708                 */
 709
 710                 if ((lenmax = limit - ret - 9) < 0
 711                     || (size_str = strlen(s->tlsext_hostname)) > (unsigned long)lenmax)
 712                         return NULL;
 713
 714                 /* extension type and length */
 715                 s2n(TLSEXT_TYPE_server_name,ret);
 716                 s2n(size_str+5,ret);
 717
 718                 /* length of servername list */
 719                 s2n(size_str+3,ret);
 720
 721                 /* hostname type, length and hostname */
 722                 *(ret++) = (unsigned char) TLSEXT_NAMETYPE_host_name;
 723                 s2n(size_str,ret);
 724                 memcpy(ret, s->tlsext_hostname, size_str);
 725                 ret+=size_str;
 726                 }
 727
 728         /* Add RI if renegotiating */
 729         if (s->renegotiate)
 730           {
 731           int el;
 732
 733           if(!ssl_add_clienthello_renegotiate_ext(s, 0, &el, 0))
 734               {
 735               SSLerr(SSL_F_SSL_ADD_CLIENTHELLO_TLSEXT, ERR_R_INTERNAL_ERROR);
 736               return NULL;
 737               }
 738
 739           if((limit - p - 4 - el) < 0) return NULL;
 740
 741           s2n(TLSEXT_TYPE_renegotiate,ret);
 742           s2n(el,ret);
 743
 744           if(!ssl_add_clienthello_renegotiate_ext(s, ret, &el, el))
 745               {
 746               SSLerr(SSL_F_SSL_ADD_CLIENTHELLO_TLSEXT, ERR_R_INTERNAL_ERROR);
 747               return NULL;
 748               }
 749
 750           ret += el;
 751         }
 752
 753 #ifndef OPENSSL_NO_SRP
 754         /* Add SRP username if there is one */
 755         if (s->srp_ctx.login != NULL)
 756                 { /* Add TLS extension SRP username to the Client Hello message */
 757
 758                 int login_len = strlen(s->srp_ctx.login);
 759                 if (login_len > 255 || login_len == 0)
 760                         {
 761                         SSLerr(SSL_F_SSL_ADD_CLIENTHELLO_TLSEXT, ERR_R_INTERNAL_ERROR);
 762                         return NULL;
 763                         }
 764
 765                 /* check for enough space.
 766                    4 for the srp type type and entension length
 767                    1 for the srp user identity
 768                    + srp user identity length
 769                 */
 770                 if ((limit - ret - 5 - login_len) < 0) return NULL;
 771
 772                 /* fill in the extension */
 773                 s2n(TLSEXT_TYPE_srp,ret);
 774                 s2n(login_len+1,ret);
 775                 (*ret++) = (unsigned char) login_len;
 776                 memcpy(ret, s->srp_ctx.login, login_len);
 777                 ret+=login_len;
 778                 }
 779 #endif
 780
 781 #ifndef OPENSSL_NO_EC
 782         if (using_ecc)
 783                 {
 784                 /* Add TLS extension ECPointFormats to the ClientHello message */
 785                 long lenmax;
 786                 const unsigned char *plist;
 787                 size_t plistlen;
 788                 /* If we have a custom point format list use it otherwise
 789                  * use default */
 790                 plist = s->tlsext_ecpointformatlist;
 791                 if (plist)
 792                         plistlen = s->tlsext_ecpointformatlist_length;
 793                 else
 794                         {
 795                         plist = ecformats_default;
 796                         plistlen = sizeof(ecformats_default);
 797                         }
 798
 799                 if ((lenmax = limit - ret - 5) < 0) return NULL;
 800                 if (plistlen > (size_t)lenmax) return NULL;
 801                 if (plistlen > 255)
 802                         {
 803                         SSLerr(SSL_F_SSL_ADD_CLIENTHELLO_TLSEXT, ERR_R_INTERNAL_ERROR);
 804                         return NULL;
 805                         }
 806
 807                 s2n(TLSEXT_TYPE_ec_point_formats,ret);
 808                 s2n(plistlen + 1,ret);
 809                 *(ret++) = (unsigned char)plistlen ;
 810                 memcpy(ret, plist, plistlen);
 811                 ret+=plistlen;
 812
 813                 /* Add TLS extension EllipticCurves to the ClientHello message */
 814                 plist = s->tlsext_ellipticcurvelist;
 815                 tls1_get_curvelist(s, 0, &plist, &plistlen);
 816
 817                 if ((lenmax = limit - ret - 6) < 0) return NULL;
 818                 if (plistlen > (size_t)lenmax) return NULL;
 819                 if (plistlen > 65532)
 820                         {
 821                         SSLerr(SSL_F_SSL_ADD_CLIENTHELLO_TLSEXT, ERR_R_INTERNAL_ERROR);
 822                         return NULL;
 823                         }
 824
 825                 s2n(TLSEXT_TYPE_elliptic_curves,ret);
 826                 s2n(plistlen + 2, ret);
 827
 828                 /* NB: draft-ietf-tls-ecc-12.txt uses a one-byte prefix for
 829                  * elliptic_curve_list, but the examples use two bytes.
 830                  * http://www1.ietf.org/mail-archive/web/tls/current/msg00538.html
 831                  * resolves this to two bytes.
 832                  */
 833                 s2n(plistlen, ret);
 834                 memcpy(ret, plist, plistlen);
 835                 ret+=plistlen;
 836                 }
 837 #endif /* OPENSSL_NO_EC */
 838
 839         if (!(SSL_get_options(s) & SSL_OP_NO_TICKET))
 840                 {
 841                 int ticklen;
 842                 if (!s->new_session && s->session && s->session->tlsext_tick)
 843                         ticklen = s->session->tlsext_ticklen;
 844                 else if (s->session && s->tlsext_session_ticket &&
 845                          s->tlsext_session_ticket->data)
 846                         {
 847                         ticklen = s->tlsext_session_ticket->length;
 848                         s->session->tlsext_tick = OPENSSL_malloc(ticklen);
 849                         if (!s->session->tlsext_tick)
 850                                 return NULL;
 851                         memcpy(s->session->tlsext_tick,
 852                                s->tlsext_session_ticket->data,
 853                                ticklen);
 854                         s->session->tlsext_ticklen = ticklen;
 855                         }
 856                 else
 857                         ticklen = 0;
 858                 if (ticklen == 0 && s->tlsext_session_ticket &&
 859                     s->tlsext_session_ticket->data == NULL)
 860                         goto skip_ext;
 861                 /* Check for enough room 2 for extension type, 2 for len
 862                  * rest for ticket
 863                  */
 864                 if ((long)(limit - ret - 4 - ticklen) < 0) return NULL;
 865                 s2n(TLSEXT_TYPE_session_ticket,ret);
 866                 s2n(ticklen,ret);
 867                 if (ticklen)
 868                         {
 869                         memcpy(ret, s->session->tlsext_tick, ticklen);
 870                         ret += ticklen;
 871                         }
 872                 }
 873                 skip_ext:
 874
 875         if (TLS1_get_client_version(s) >= TLS1_2_VERSION)
 876                 {
 877                 if ((size_t)(limit - ret) < sizeof(tls12_sigalgs) + 6)
 878                         return NULL;
 879                 s2n(TLSEXT_TYPE_signature_algorithms,ret);
 880                 s2n(sizeof(tls12_sigalgs) + 2, ret);
 881                 s2n(sizeof(tls12_sigalgs), ret);
 882                 memcpy(ret, tls12_sigalgs, sizeof(tls12_sigalgs));
 883                 ret += sizeof(tls12_sigalgs);
 884                 }
 885
 886 #ifdef TLSEXT_TYPE_opaque_prf_input
 887         if (s->s3->client_opaque_prf_input != NULL &&
 888             s->version != DTLS1_VERSION)
 889                 {
 890                 size_t col = s->s3->client_opaque_prf_input_len;
 891
 892                 if ((long)(limit - ret - 6 - col < 0))
 893                         return NULL;
 894                 if (col > 0xFFFD) /* can't happen */
 895                         return NULL;
 896
 897                 s2n(TLSEXT_TYPE_opaque_prf_input, ret);
 898                 s2n(col + 2, ret);
 899                 s2n(col, ret);
 900                 memcpy(ret, s->s3->client_opaque_prf_input, col);
 901                 ret += col;
 902                 }
 903 #endif
 904
 905         if (s->tlsext_status_type == TLSEXT_STATUSTYPE_ocsp &&
 906             s->version != DTLS1_VERSION)
 907                 {
 908                 int i;
 909                 long extlen, idlen, itmp;
 910                 OCSP_RESPID *id;
 911
 912                 idlen = 0;
 913                 for (i = 0; i < sk_OCSP_RESPID_num(s->tlsext_ocsp_ids); i++)
 914                         {
 915                         id = sk_OCSP_RESPID_value(s->tlsext_ocsp_ids, i);
 916                         itmp = i2d_OCSP_RESPID(id, NULL);
 917                         if (itmp <= 0)
 918                                 return NULL;
 919                         idlen += itmp + 2;
 920                         }
 921
 922                 if (s->tlsext_ocsp_exts)
 923                         {
 924                         extlen = i2d_X509_EXTENSIONS(s->tlsext_ocsp_exts, NULL);
 925                         if (extlen < 0)
 926                                 return NULL;
 927                         }
 928                 else
 929                         extlen = 0;
 930
 931                 if ((long)(limit - ret - 7 - extlen - idlen) < 0) return NULL;
 932                 s2n(TLSEXT_TYPE_status_request, ret);
 933                 if (extlen + idlen > 0xFFF0)
 934                         return NULL;
 935                 s2n(extlen + idlen + 5, ret);
 936                 *(ret++) = TLSEXT_STATUSTYPE_ocsp;
 937                 s2n(idlen, ret);
 938                 for (i = 0; i < sk_OCSP_RESPID_num(s->tlsext_ocsp_ids); i++)
 939                         {
 940                         /* save position of id len */
 941                         unsigned char *q = ret;
 942                         id = sk_OCSP_RESPID_value(s->tlsext_ocsp_ids, i);
 943                         /* skip over id len */
 944                         ret += 2;
 945                         itmp = i2d_OCSP_RESPID(id, &ret);
 946                         /* write id len */
 947                         s2n(itmp, q);
 948                         }
 949                 s2n(extlen, ret);
 950                 if (extlen > 0)
 951                         i2d_X509_EXTENSIONS(s->tlsext_ocsp_exts, &ret);
 952                 }
 953
 954 #ifndef OPENSSL_NO_HEARTBEATS
 955         /* Add Heartbeat extension */
 956         s2n(TLSEXT_TYPE_heartbeat,ret);
 957         s2n(1,ret);
 958         /* Set mode:
 959          * 1: peer may send requests
 960          * 2: peer not allowed to send requests
 961          */
 962         if (s->tlsext_heartbeat & SSL_TLSEXT_HB_DONT_RECV_REQUESTS)
 963                 *(ret++) = SSL_TLSEXT_HB_DONT_SEND_REQUESTS;
 964         else
 965                 *(ret++) = SSL_TLSEXT_HB_ENABLED;
 966 #endif
 967
 968 #ifndef OPENSSL_NO_NEXTPROTONEG
 969         if (s->ctx->next_proto_select_cb && !s->s3->tmp.finish_md_len)
 970                 {
 971                 /* The client advertises an emtpy extension to indicate its
 972                  * support for Next Protocol Negotiation */
 973                 if (limit - ret - 4 < 0)
 974                         return NULL;
 975                 s2n(TLSEXT_TYPE_next_proto_neg,ret);
 976                 s2n(0,ret);
 977                 }
 978 #endif
 979
 980         if(SSL_get_srtp_profiles(s))
 981                 {
 982                 int el;
 983
 984                 ssl_add_clienthello_use_srtp_ext(s, 0, &el, 0);
 985
 986                 if((limit - p - 4 - el) < 0) return NULL;
 987
 988                 s2n(TLSEXT_TYPE_use_srtp,ret);
 989                 s2n(el,ret);
 990
 991                 if(ssl_add_clienthello_use_srtp_ext(s, ret, &el, el))
 992                         {
 993                         SSLerr(SSL_F_SSL_ADD_CLIENTHELLO_TLSEXT, ERR_R_INTERNAL_ERROR);
 994                         return NULL;
 995                         }
 996                 ret += el;
 997                 }
 998
 999         /* Add TLS extension Server_Authz_DataFormats to the ClientHello */
1000         /* 2 bytes for extension type */
1001         /* 2 bytes for extension length */
1002         /* 1 byte for the list length */
1003         /* 1 byte for the list (we only support audit proofs) */
1004         if (s->ctx->tlsext_authz_server_audit_proof_cb != NULL)
1005                 {
1006                 size_t lenmax;
1007                 const unsigned short ext_len = 2;
1008                 const unsigned char list_len = 1;
1009
1010                 if ((lenmax = limit - ret - 6) < 0) return NULL;
1011
1012                 s2n(TLSEXT_TYPE_server_authz, ret);
1013                 /* Extension length: 2 bytes */
1014                 s2n(ext_len, ret);
1015                 *(ret++) = list_len;
1016                 *(ret++) = TLSEXT_AUTHZDATAFORMAT_audit_proof;
1017                 }
1018
1019         if ((extdatalen = ret-p-2) == 0)
1020                 return p;
1021
1022         s2n(extdatalen,p);
1023         return ret;
1024         }
1025
1026 unsigned char *ssl_add_serverhello_tlsext(SSL *s, unsigned char *p, unsigned char *limit)
1027         {
1028         int extdatalen=0;
1029         unsigned char *ret = p;
1030 #ifndef OPENSSL_NO_NEXTPROTONEG
1031         int next_proto_neg_seen;
1032 #endif
1033
1034         /* don't add extensions for SSLv3, unless doing secure renegotiation */
1035         if (s->version == SSL3_VERSION && !s->s3->send_connection_binding)
1036                 return p;
1037
1038         ret+=2;
1039         if (ret>=limit) return NULL; /* this really never occurs, but ... */
1040
1041         if (!s->hit && s->servername_done == 1 && s->session->tlsext_hostname != NULL)
1042                 {
1043                 if ((long)(limit - ret - 4) < 0) return NULL;
1044
1045                 s2n(TLSEXT_TYPE_server_name,ret);
1046                 s2n(0,ret);
1047                 }
1048
1049         if(s->s3->send_connection_binding)
1050         {
1051           int el;
1052
1053           if(!ssl_add_serverhello_renegotiate_ext(s, 0, &el, 0))
1054               {
1055               SSLerr(SSL_F_SSL_ADD_SERVERHELLO_TLSEXT, ERR_R_INTERNAL_ERROR);
1056               return NULL;
1057               }
1058
1059           if((limit - p - 4 - el) < 0) return NULL;
1060
1061           s2n(TLSEXT_TYPE_renegotiate,ret);
1062           s2n(el,ret);
1063
1064           if(!ssl_add_serverhello_renegotiate_ext(s, ret, &el, el))
1065               {
1066               SSLerr(SSL_F_SSL_ADD_SERVERHELLO_TLSEXT, ERR_R_INTERNAL_ERROR);
1067               return NULL;
1068               }
1069
1070           ret += el;
1071         }
1072
1073 #ifndef OPENSSL_NO_EC
1074         if (s->tlsext_ecpointformatlist != NULL &&
1075             s->version != DTLS1_VERSION)
1076                 {
1077                 /* Add TLS extension ECPointFormats to the ServerHello message */
1078                 long lenmax;
1079
1080                 if ((lenmax = limit - ret - 5) < 0) return NULL;
1081                 if (s->tlsext_ecpointformatlist_length > (unsigned long)lenmax) return NULL;
1082                 if (s->tlsext_ecpointformatlist_length > 255)
1083                         {
1084                         SSLerr(SSL_F_SSL_ADD_SERVERHELLO_TLSEXT, ERR_R_INTERNAL_ERROR);
1085                         return NULL;
1086                         }
1087
1088                 s2n(TLSEXT_TYPE_ec_point_formats,ret);
1089                 s2n(s->tlsext_ecpointformatlist_length + 1,ret);
1090                 *(ret++) = (unsigned char) s->tlsext_ecpointformatlist_length;
1091                 memcpy(ret, s->tlsext_ecpointformatlist, s->tlsext_ecpointformatlist_length);
1092                 ret+=s->tlsext_ecpointformatlist_length;
1093
1094                 }
1095         /* Currently the server should not respond with a SupportedCurves extension */
1096 #endif /* OPENSSL_NO_EC */
1097
1098         if (s->tlsext_ticket_expected
1099                 && !(SSL_get_options(s) & SSL_OP_NO_TICKET))
1100                 {
1101                 if ((long)(limit - ret - 4) < 0) return NULL;
1102                 s2n(TLSEXT_TYPE_session_ticket,ret);
1103                 s2n(0,ret);
1104                 }
1105
1106         if (s->tlsext_status_expected)
1107                 {
1108                 if ((long)(limit - ret - 4) < 0) return NULL;
1109                 s2n(TLSEXT_TYPE_status_request,ret);
1110                 s2n(0,ret);
1111                 }
1112
1113 #ifdef TLSEXT_TYPE_opaque_prf_input
1114         if (s->s3->server_opaque_prf_input != NULL &&
1115             s->version != DTLS1_VERSION)
1116                 {
1117                 size_t sol = s->s3->server_opaque_prf_input_len;
1118
1119                 if ((long)(limit - ret - 6 - sol) < 0)
1120                         return NULL;
1121                 if (sol > 0xFFFD) /* can't happen */
1122                         return NULL;
1123
1124                 s2n(TLSEXT_TYPE_opaque_prf_input, ret);
1125                 s2n(sol + 2, ret);
1126                 s2n(sol, ret);
1127                 memcpy(ret, s->s3->server_opaque_prf_input, sol);
1128                 ret += sol;
1129                 }
1130 #endif
1131
1132         if(s->srtp_profile)
1133                 {
1134                 int el;
1135
1136                 ssl_add_serverhello_use_srtp_ext(s, 0, &el, 0);
1137
1138                 if((limit - p - 4 - el) < 0) return NULL;
1139
1140                 s2n(TLSEXT_TYPE_use_srtp,ret);
1141                 s2n(el,ret);
1142
1143                 if(ssl_add_serverhello_use_srtp_ext(s, ret, &el, el))
1144                         {
1145                         SSLerr(SSL_F_SSL_ADD_SERVERHELLO_TLSEXT, ERR_R_INTERNAL_ERROR);
1146                         return NULL;
1147                         }
1148                 ret+=el;
1149                 }
1150
1151         if (((s->s3->tmp.new_cipher->id & 0xFFFF)==0x80 || (s->s3->tmp.new_cipher->id & 0xFFFF)==0x81)
1152                 && (SSL_get_options(s) & SSL_OP_CRYPTOPRO_TLSEXT_BUG))
1153                 { const unsigned char cryptopro_ext[36] = {
1154                         0xfd, 0xe8, /*65000*/
1155                         0x00, 0x20, /*32 bytes length*/
1156                         0x30, 0x1e, 0x30, 0x08, 0x06, 0x06, 0x2a, 0x85,
1157                         0x03,   0x02, 0x02, 0x09, 0x30, 0x08, 0x06, 0x06,
1158                         0x2a, 0x85, 0x03, 0x02, 0x02, 0x16, 0x30, 0x08,
1159                         0x06, 0x06, 0x2a, 0x85, 0x03, 0x02, 0x02, 0x17};
1160                         if (limit-ret<36) return NULL;
1161                         memcpy(ret,cryptopro_ext,36);
1162                         ret+=36;
1163
1164                 }
1165
1166 #ifndef OPENSSL_NO_HEARTBEATS
1167         /* Add Heartbeat extension if we've received one */
1168         if (s->tlsext_heartbeat & SSL_TLSEXT_HB_ENABLED)
1169                 {
1170                 s2n(TLSEXT_TYPE_heartbeat,ret);
1171                 s2n(1,ret);
1172                 /* Set mode:
1173                  * 1: peer may send requests
1174                  * 2: peer not allowed to send requests
1175                  */
1176                 if (s->tlsext_heartbeat & SSL_TLSEXT_HB_DONT_RECV_REQUESTS)
1177                         *(ret++) = SSL_TLSEXT_HB_DONT_SEND_REQUESTS;
1178                 else
1179                         *(ret++) = SSL_TLSEXT_HB_ENABLED;
1180
1181                 }
1182 #endif
1183
1184 #ifndef OPENSSL_NO_NEXTPROTONEG
1185         next_proto_neg_seen = s->s3->next_proto_neg_seen;
1186         s->s3->next_proto_neg_seen = 0;
1187         if (next_proto_neg_seen && s->ctx->next_protos_advertised_cb)
1188                 {
1189                 const unsigned char *npa;
1190                 unsigned int npalen;
1191                 int r;
1192
1193                 r = s->ctx->next_protos_advertised_cb(s, &npa, &npalen, s->ctx->next_protos_advertised_cb_arg);
1194                 if (r == SSL_TLSEXT_ERR_OK)
1195                         {
1196                         if ((long)(limit - ret - 4 - npalen) < 0) return NULL;
1197                         s2n(TLSEXT_TYPE_next_proto_neg,ret);
1198                         s2n(npalen,ret);
1199                         memcpy(ret, npa, npalen);
1200                         ret += npalen;
1201                         s->s3->next_proto_neg_seen = 1;
1202                         }
1203                 }
1204 #endif
1205
1206         /* If the client supports authz then see whether we have any to offer
1207          * to it. */
1208         if (s->s3->tlsext_authz_client_types_len)
1209                 {
1210                 size_t authz_length;
1211                 /* By now we already know the new cipher, so we can look ahead
1212                  * to see whether the cert we are going to send
1213                  * has any authz data attached to it. */
1214                 const unsigned char* authz = ssl_get_authz_data(s, &authz_length);
1215                 const unsigned char* const orig_authz = authz;
1216                 size_t i;
1217                 unsigned authz_count = 0;
1218
1219                 /* The authz data contains a number of the following structures:
1220                  *      uint8_t authz_type
1221                  *      uint16_t length
1222                  *      uint8_t data[length]
1223                  *
1224                  * First we walk over it to find the number of authz elements. */
1225                 for (i = 0; i < authz_length; i++)
1226                         {
1227                         unsigned short length;
1228                         unsigned char type;
1229
1230                         type = *(authz++);
1231                         if (memchr(s->s3->tlsext_authz_client_types,
1232                                    type,
1233                                    s->s3->tlsext_authz_client_types_len) != NULL)
1234                                 authz_count++;
1235
1236                         n2s(authz, length);
1237                         authz += length;
1238                         i += length;
1239                         }
1240
1241                 if (authz_count)
1242                         {
1243                         /* Add TLS extension server_authz to the ServerHello message
1244                          * 2 bytes for extension type
1245                          * 2 bytes for extension length
1246                          * 1 byte for the list length
1247                          * n bytes for the list */
1248                         const unsigned short ext_len = 1 + authz_count;
1249
1250                         if ((long)(limit - ret - 4 - ext_len) < 0) return NULL;
1251                         s2n(TLSEXT_TYPE_server_authz, ret);
1252                         s2n(ext_len, ret);
1253                         *(ret++) = authz_count;
1254                         s->s3->tlsext_authz_promised_to_client = 1;
1255                         }
1256
1257                 authz = orig_authz;
1258                 for (i = 0; i < authz_length; i++)
1259                         {
1260                         unsigned short length;
1261                         unsigned char type;
1262
1263                         authz_count++;
1264                         type = *(authz++);
1265                         if (memchr(s->s3->tlsext_authz_client_types,
1266                                    type,
1267                                    s->s3->tlsext_authz_client_types_len) != NULL)
1268                                 *(ret++) = type;
1269                         n2s(authz, length);
1270                         authz += length;
1271                         i += length;
1272                         }
1273                 }
1274
1275         if ((extdatalen = ret-p-2)== 0)
1276                 return p;
1277
1278         s2n(extdatalen,p);
1279         return ret;
1280         }
1281
1282 static int ssl_scan_clienthello_tlsext(SSL *s, unsigned char **p, unsigned char *d, int n, int *al)
1283         {
1284         unsigned short type;
1285         unsigned short size;
1286         unsigned short len;
1287         unsigned char *data = *p;
1288         int renegotiate_seen = 0;
1289         int sigalg_seen = 0;
1290
1291         s->servername_done = 0;
1292         s->tlsext_status_type = -1;
1293 #ifndef OPENSSL_NO_NEXTPROTONEG
1294         s->s3->next_proto_neg_seen = 0;
1295 #endif
1296
1297 #ifndef OPENSSL_NO_HEARTBEATS
1298         s->tlsext_heartbeat &= ~(SSL_TLSEXT_HB_ENABLED |
1299                                SSL_TLSEXT_HB_DONT_SEND_REQUESTS);
1300 #endif
1301
1302         if (data >= (d+n-2))
1303                 goto ri_check;
1304         n2s(data,len);
1305
1306         if (data > (d+n-len))
1307                 goto ri_check;
1308
1309         while (data <= (d+n-4))
1310                 {
1311                 n2s(data,type);
1312                 n2s(data,size);
1313
1314                 if (data+size > (d+n))
1315                         goto ri_check;
1316 #if 0
1317                 fprintf(stderr,"Received extension type %d size %d\n",type,size);
1318 #endif
1319                 if (s->tlsext_debug_cb)
1320                         s->tlsext_debug_cb(s, 0, type, data, size,
1321                                                 s->tlsext_debug_arg);
1322 /* The servername extension is treated as follows:
1323
1324    - Only the hostname type is supported with a maximum length of 255.
1325    - The servername is rejected if too long or if it contains zeros,
1326      in which case an fatal alert is generated.
1327    - The servername field is maintained together with the session cache.
1328    - When a session is resumed, the servername call back invoked in order
1329      to allow the application to position itself to the right context.
1330    - The servername is acknowledged if it is new for a session or when
1331      it is identical to a previously used for the same session.
1332      Applications can control the behaviour.  They can at any time
1333      set a 'desirable' servername for a new SSL object. This can be the
1334      case for example with HTTPS when a Host: header field is received and
1335      a renegotiation is requested. In this case, a possible servername
1336      presented in the new client hello is only acknowledged if it matches
1337      the value of the Host: field.
1338    - Applications must  use SSL_OP_NO_SESSION_RESUMPTION_ON_RENEGOTIATION
1339      if they provide for changing an explicit servername context for the session,
1340      i.e. when the session has been established with a servername extension.
1341    - On session reconnect, the servername extension may be absent.
1342
1343 */
1344
1345                 if (type == TLSEXT_TYPE_server_name)
1346                         {
1347                         unsigned char *sdata;
1348                         int servname_type;
1349                         int dsize;
1350
1351                         if (size < 2)
1352                                 {
1353                                 *al = SSL_AD_DECODE_ERROR;
1354                                 return 0;
1355                                 }
1356                         n2s(data,dsize);
1357                         size -= 2;
1358                         if (dsize > size  )
1359                                 {
1360                                 *al = SSL_AD_DECODE_ERROR;
1361                                 return 0;
1362                                 }
1363
1364                         sdata = data;
1365                         while (dsize > 3)
1366                                 {
1367                                 servname_type = *(sdata++);
1368                                 n2s(sdata,len);
1369                                 dsize -= 3;
1370
1371                                 if (len > dsize)
1372                                         {
1373                                         *al = SSL_AD_DECODE_ERROR;
1374                                         return 0;
1375                                         }
1376                                 if (s->servername_done == 0)
1377                                 switch (servname_type)
1378                                         {
1379                                 case TLSEXT_NAMETYPE_host_name:
1380                                         if (!s->hit)
1381                                                 {
1382                                                 if(s->session->tlsext_hostname)
1383                                                         {
1384                                                         *al = SSL_AD_DECODE_ERROR;
1385                                                         return 0;
1386                                                         }
1387                                                 if (len > TLSEXT_MAXLEN_host_name)
1388                                                         {
1389                                                         *al = TLS1_AD_UNRECOGNIZED_NAME;
1390                                                         return 0;
1391                                                         }
1392                                                 if ((s->session->tlsext_hostname = OPENSSL_malloc(len+1)) == NULL)
1393                                                         {
1394                                                         *al = TLS1_AD_INTERNAL_ERROR;
1395                                                         return 0;
1396                                                         }
1397                                                 memcpy(s->session->tlsext_hostname, sdata, len);
1398                                                 s->session->tlsext_hostname[len]='\0';
1399                                                 if (strlen(s->session->tlsext_hostname) != len) {
1400                                                         OPENSSL_free(s->session->tlsext_hostname);
1401                                                         s->session->tlsext_hostname = NULL;
1402                                                         *al = TLS1_AD_UNRECOGNIZED_NAME;
1403                                                         return 0;
1404                                                 }
1405                                                 s->servername_done = 1;
1406
1407                                                 }
1408                                         else
1409                                                 s->servername_done = s->session->tlsext_hostname
1410                                                         && strlen(s->session->tlsext_hostname) == len
1411                                                         && strncmp(s->session->tlsext_hostname, (char *)sdata, len) == 0;
1412
1413                                         break;
1414
1415                                 default:
1416                                         break;
1417                                         }
1418
1419                                 dsize -= len;
1420                                 }
1421                         if (dsize != 0)
1422                                 {
1423                                 *al = SSL_AD_DECODE_ERROR;
1424                                 return 0;
1425                                 }
1426
1427                         }
1428 #ifndef OPENSSL_NO_SRP
1429                 else if (type == TLSEXT_TYPE_srp)
1430                         {
1431                         if (size <= 0 || ((len = data[0])) != (size -1))
1432                                 {
1433                                 *al = SSL_AD_DECODE_ERROR;
1434                                 return 0;
1435                                 }
1436                         if (s->srp_ctx.login != NULL)
1437                                 {
1438                                 *al = SSL_AD_DECODE_ERROR;
1439                                 return 0;
1440                                 }
1441                         if ((s->srp_ctx.login = OPENSSL_malloc(len+1)) == NULL)
1442                                 return -1;
1443                         memcpy(s->srp_ctx.login, &data[1], len);
1444                         s->srp_ctx.login[len]='\0';
1445
1446                         if (strlen(s->srp_ctx.login) != len)
1447                                 {
1448                                 *al = SSL_AD_DECODE_ERROR;
1449                                 return 0;
1450                                 }
1451                         }
1452 #endif
1453
1454 #ifndef OPENSSL_NO_EC
1455                 else if (type == TLSEXT_TYPE_ec_point_formats &&
1456                      s->version != DTLS1_VERSION)
1457                         {
1458                         unsigned char *sdata = data;
1459                         int ecpointformatlist_length = *(sdata++);
1460
1461                         if (ecpointformatlist_length != size - 1)
1462                                 {
1463                                 *al = TLS1_AD_DECODE_ERROR;
1464                                 return 0;
1465                                 }
1466                         if (!s->hit)
1467                                 {
1468                                 if(s->session->tlsext_ecpointformatlist)
1469                                         {
1470                                         OPENSSL_free(s->session->tlsext_ecpointformatlist);
1471                                         s->session->tlsext_ecpointformatlist = NULL;
1472                                         }
1473                                 s->session->tlsext_ecpointformatlist_length = 0;
1474                                 if ((s->session->tlsext_ecpointformatlist = OPENSSL_malloc(ecpointformatlist_length)) == NULL)
1475                                         {
1476                                         *al = TLS1_AD_INTERNAL_ERROR;
1477                                         return 0;
1478                                         }
1479                                 s->session->tlsext_ecpointformatlist_length = ecpointformatlist_length;
1480                                 memcpy(s->session->tlsext_ecpointformatlist, sdata, ecpointformatlist_length);
1481                                 }
1482 #if 0
1483                         fprintf(stderr,"ssl_parse_clienthello_tlsext s->session->tlsext_ecpointformatlist (length=%i) ", s->session->tlsext_ecpointformatlist_length);
1484                         sdata = s->session->tlsext_ecpointformatlist;
1485                         for (i = 0; i < s->session->tlsext_ecpointformatlist_length; i++)
1486                                 fprintf(stderr,"%i ",*(sdata++));
1487                         fprintf(stderr,"\n");
1488 #endif
1489                         }
1490                 else if (type == TLSEXT_TYPE_elliptic_curves &&
1491                      s->version != DTLS1_VERSION)
1492                         {
1493                         unsigned char *sdata = data;
1494                         int ellipticcurvelist_length = (*(sdata++) << 8);
1495                         ellipticcurvelist_length += (*(sdata++));
1496
1497                         if (ellipticcurvelist_length != size - 2)
1498                                 {
1499                                 *al = TLS1_AD_DECODE_ERROR;
1500                                 return 0;
1501                                 }
1502                         if (!s->hit)
1503                                 {
1504                                 if(s->session->tlsext_ellipticcurvelist)
1505                                         {
1506                                         *al = TLS1_AD_DECODE_ERROR;
1507                                         return 0;
1508                                         }
1509                                 s->session->tlsext_ellipticcurvelist_length = 0;
1510                                 if ((s->session->tlsext_ellipticcurvelist = OPENSSL_malloc(ellipticcurvelist_length)) == NULL)
1511                                         {
1512                                         *al = TLS1_AD_INTERNAL_ERROR;
1513                                         return 0;
1514                                         }
1515                                 s->session->tlsext_ellipticcurvelist_length = ellipticcurvelist_length;
1516                                 memcpy(s->session->tlsext_ellipticcurvelist, sdata, ellipticcurvelist_length);
1517                                 }
1518 #if 0
1519                         fprintf(stderr,"ssl_parse_clienthello_tlsext s->session->tlsext_ellipticcurvelist (length=%i) ", s->session->tlsext_ellipticcurvelist_length);
1520                         sdata = s->session->tlsext_ellipticcurvelist;
1521                         for (i = 0; i < s->session->tlsext_ellipticcurvelist_length; i++)
1522                                 fprintf(stderr,"%i ",*(sdata++));
1523                         fprintf(stderr,"\n");
1524 #endif
1525                         }
1526 #endif /* OPENSSL_NO_EC */
1527 #ifdef TLSEXT_TYPE_opaque_prf_input
1528                 else if (type == TLSEXT_TYPE_opaque_prf_input &&
1529                      s->version != DTLS1_VERSION)
1530                         {
1531                         unsigned char *sdata = data;
1532
1533                         if (size < 2)
1534                                 {
1535                                 *al = SSL_AD_DECODE_ERROR;
1536                                 return 0;
1537                                 }
1538                         n2s(sdata, s->s3->client_opaque_prf_input_len);
1539                         if (s->s3->client_opaque_prf_input_len != size - 2)
1540                                 {
1541                                 *al = SSL_AD_DECODE_ERROR;
1542                                 return 0;
1543                                 }
1544
1545                         if (s->s3->client_opaque_prf_input != NULL) /* shouldn't really happen */
1546                                 OPENSSL_free(s->s3->client_opaque_prf_input);
1547                         if (s->s3->client_opaque_prf_input_len == 0)
1548                                 s->s3->client_opaque_prf_input = OPENSSL_malloc(1); /* dummy byte just to get non-NULL */
1549                         else
1550                                 s->s3->client_opaque_prf_input = BUF_memdup(sdata, s->s3->client_opaque_prf_input_len);
1551                         if (s->s3->client_opaque_prf_input == NULL)
1552                                 {
1553                                 *al = TLS1_AD_INTERNAL_ERROR;
1554                                 return 0;
1555                                 }
1556                         }
1557 #endif
1558                 else if (type == TLSEXT_TYPE_session_ticket)
1559                         {
1560                         if (s->tls_session_ticket_ext_cb &&
1561                             !s->tls_session_ticket_ext_cb(s, data, size, s->tls_session_ticket_ext_cb_arg))
1562                                 {
1563                                 *al = TLS1_AD_INTERNAL_ERROR;
1564                                 return 0;
1565                                 }
1566                         }
1567                 else if (type == TLSEXT_TYPE_renegotiate)
1568                         {
1569                         if(!ssl_parse_clienthello_renegotiate_ext(s, data, size, al))
1570                                 return 0;
1571                         renegotiate_seen = 1;
1572                         }
1573                 else if (type == TLSEXT_TYPE_signature_algorithms)
1574                         {
1575                         int dsize;
1576                         if (sigalg_seen || size < 2)
1577                                 {
1578                                 *al = SSL_AD_DECODE_ERROR;
1579                                 return 0;
1580                                 }
1581                         sigalg_seen = 1;
1582                         n2s(data,dsize);
1583                         size -= 2;
1584                         if (dsize != size || dsize & 1)
1585                                 {
1586                                 *al = SSL_AD_DECODE_ERROR;
1587                                 return 0;
1588                                 }
1589                         if (!tls1_process_sigalgs(s, data, dsize))
1590                                 {
1591                                 *al = SSL_AD_DECODE_ERROR;
1592                                 return 0;
1593                                 }
1594                         }
1595                 else if (type == TLSEXT_TYPE_status_request &&
1596                          s->version != DTLS1_VERSION && s->ctx->tlsext_status_cb)
1597                         {
1598
1599                         if (size < 5)
1600                                 {
1601                                 *al = SSL_AD_DECODE_ERROR;
1602                                 return 0;
1603                                 }
1604
1605                         s->tlsext_status_type = *data++;
1606                         size--;
1607                         if (s->tlsext_status_type == TLSEXT_STATUSTYPE_ocsp)
1608                                 {
1609                                 const unsigned char *sdata;
1610                                 int dsize;
1611                                 /* Read in responder_id_list */
1612                                 n2s(data,dsize);
1613                                 size -= 2;
1614                                 if (dsize > size  )
1615                                         {
1616                                         *al = SSL_AD_DECODE_ERROR;
1617                                         return 0;
1618                                         }
1619                                 while (dsize > 0)
1620                                         {
1621                                         OCSP_RESPID *id;
1622                                         int idsize;
1623                                         if (dsize < 4)
1624                                                 {
1625                                                 *al = SSL_AD_DECODE_ERROR;
1626                                                 return 0;
1627                                                 }
1628                                         n2s(data, idsize);
1629                                         dsize -= 2 + idsize;
1630                                         size -= 2 + idsize;
1631                                         if (dsize < 0)
1632                                                 {
1633                                                 *al = SSL_AD_DECODE_ERROR;
1634                                                 return 0;
1635                                                 }
1636                                         sdata = data;
1637                                         data += idsize;
1638                                         id = d2i_OCSP_RESPID(NULL,
1639                                                                 &sdata, idsize);
1640                                         if (!id)
1641                                                 {
1642                                                 *al = SSL_AD_DECODE_ERROR;
1643                                                 return 0;
1644                                                 }
1645                                         if (data != sdata)
1646                                                 {
1647                                                 OCSP_RESPID_free(id);
1648                                                 *al = SSL_AD_DECODE_ERROR;
1649                                                 return 0;
1650                                                 }
1651                                         if (!s->tlsext_ocsp_ids
1652                                                 && !(s->tlsext_ocsp_ids =
1653                                                 sk_OCSP_RESPID_new_null()))
1654                                                 {
1655                                                 OCSP_RESPID_free(id);
1656                                                 *al = SSL_AD_INTERNAL_ERROR;
1657                                                 return 0;
1658                                                 }
1659                                         if (!sk_OCSP_RESPID_push(
1660                                                         s->tlsext_ocsp_ids, id))
1661                                                 {
1662                                                 OCSP_RESPID_free(id);
1663                                                 *al = SSL_AD_INTERNAL_ERROR;
1664                                                 return 0;
1665                                                 }
1666                                         }
1667
1668                                 /* Read in request_extensions */
1669                                 if (size < 2)
1670                                         {
1671                                         *al = SSL_AD_DECODE_ERROR;
1672                                         return 0;
1673                                         }
1674                                 n2s(data,dsize);
1675                                 size -= 2;
1676                                 if (dsize != size)
1677                                         {
1678                                         *al = SSL_AD_DECODE_ERROR;
1679                                         return 0;
1680                                         }
1681                                 sdata = data;
1682                                 if (dsize > 0)
1683                                         {
1684                                         if (s->tlsext_ocsp_exts)
1685                                                 {
1686                                                 sk_X509_EXTENSION_pop_free(s->tlsext_ocsp_exts,
1687                                                                            X509_EXTENSION_free);
1688                                                 }
1689
1690                                         s->tlsext_ocsp_exts =
1691                                                 d2i_X509_EXTENSIONS(NULL,
1692                                                         &sdata, dsize);
1693                                         if (!s->tlsext_ocsp_exts
1694                                                 || (data + dsize != sdata))
1695                                                 {
1696                                                 *al = SSL_AD_DECODE_ERROR;
1697                                                 return 0;
1698                                                 }
1699                                         }
1700                                 }
1701                                 /* We don't know what to do with any other type
1702                                 * so ignore it.
1703                                 */
1704                                 else
1705                                         s->tlsext_status_type = -1;
1706                         }
1707 #ifndef OPENSSL_NO_HEARTBEATS
1708                 else if (type == TLSEXT_TYPE_heartbeat)
1709                         {
1710                         switch(data[0])
1711                                 {
1712                                 case 0x01:      /* Client allows us to send HB requests */
1713                                                         s->tlsext_heartbeat |= SSL_TLSEXT_HB_ENABLED;
1714                                                         break;
1715                                 case 0x02:      /* Client doesn't accept HB requests */
1716                                                         s->tlsext_heartbeat |= SSL_TLSEXT_HB_ENABLED;
1717                                                         s->tlsext_heartbeat |= SSL_TLSEXT_HB_DONT_SEND_REQUESTS;
1718                                                         break;
1719                                 default:        *al = SSL_AD_ILLEGAL_PARAMETER;
1720                                                         return 0;
1721                                 }
1722                         }
1723 #endif
1724 #ifndef OPENSSL_NO_NEXTPROTONEG
1725                 else if (type == TLSEXT_TYPE_next_proto_neg &&
1726                          s->s3->tmp.finish_md_len == 0)
1727                         {
1728                         /* We shouldn't accept this extension on a
1729                          * renegotiation.
1730                          *
1731                          * s->new_session will be set on renegotiation, but we
1732                          * probably shouldn't rely that it couldn't be set on
1733                          * the initial renegotation too in certain cases (when
1734                          * there's some other reason to disallow resuming an
1735                          * earlier session -- the current code won't be doing
1736                          * anything like that, but this might change).
1737
1738                          * A valid sign that there's been a previous handshake
1739                          * in this connection is if s->s3->tmp.finish_md_len >
1740                          * 0.  (We are talking about a check that will happen
1741                          * in the Hello protocol round, well before a new
1742                          * Finished message could have been computed.) */
1743                         s->s3->next_proto_neg_seen = 1;
1744                         }
1745 #endif
1746
1747                 /* session ticket processed earlier */
1748                 else if (type == TLSEXT_TYPE_use_srtp)
1749                         {
1750                         if(ssl_parse_clienthello_use_srtp_ext(s, data, size,
1751                                                               al))
1752                                 return 0;
1753                         }
1754
1755                 else if (type == TLSEXT_TYPE_server_authz)
1756                         {
1757                         unsigned char *sdata = data;
1758                         unsigned char server_authz_dataformatlist_length;
1759
1760                         if (size == 0)
1761                                 {
1762                                 *al = TLS1_AD_DECODE_ERROR;
1763                                 return 0;
1764                                 }
1765
1766                         server_authz_dataformatlist_length = *(sdata++);
1767
1768                         if (server_authz_dataformatlist_length != size - 1)
1769                                 {
1770                                 *al = TLS1_AD_DECODE_ERROR;
1771                                 return 0;
1772                                 }
1773
1774                         /* Successful session resumption uses the same authz
1775                          * information as the original session so we ignore this
1776                          * in the case of a session resumption. */
1777                         if (!s->hit)
1778                                 {
1779                                 size_t i;
1780                                 s->s3->tlsext_authz_client_types =
1781                                         OPENSSL_malloc(server_authz_dataformatlist_length);
1782                                 if (!s->s3->tlsext_authz_client_types)
1783                                         {
1784                                         *al = TLS1_AD_INTERNAL_ERROR;
1785                                         return 0;
1786                                         }
1787
1788                                 s->s3->tlsext_authz_client_types_len =
1789                                         server_authz_dataformatlist_length;
1790                                 memcpy(s->s3->tlsext_authz_client_types,
1791                                        sdata,
1792                                        server_authz_dataformatlist_length);
1793
1794                                 /* Sort the types in order to check for duplicates. */
1795                                 qsort(s->s3->tlsext_authz_client_types,
1796                                       server_authz_dataformatlist_length,
1797                                       1 /* element size */,
1798                                       byte_compare);
1799
1800                                 for (i = 0; i < server_authz_dataformatlist_length; i++)
1801                                         {
1802                                         if (i > 0 &&
1803                                             s->s3->tlsext_authz_client_types[i] ==
1804                                               s->s3->tlsext_authz_client_types[i-1])
1805                                                 {
1806                                                 *al = TLS1_AD_DECODE_ERROR;
1807                                                 return 0;
1808                                                 }
1809                                         }
1810                                 }
1811                         }
1812
1813                 data+=size;
1814                 }
1815
1816         *p = data;
1817
1818         ri_check:
1819
1820         /* Need RI if renegotiating */
1821
1822         if (!renegotiate_seen && s->renegotiate &&
1823                 !(s->options & SSL_OP_ALLOW_UNSAFE_LEGACY_RENEGOTIATION))
1824                 {
1825                 *al = SSL_AD_HANDSHAKE_FAILURE;
1826                 SSLerr(SSL_F_SSL_SCAN_CLIENTHELLO_TLSEXT,
1827                                 SSL_R_UNSAFE_LEGACY_RENEGOTIATION_DISABLED);
1828                 return 0;
1829                 }
1830
1831         return 1;
1832         }
1833
1834 int ssl_parse_clienthello_tlsext(SSL *s, unsigned char **p, unsigned char *d, int n)
1835         {
1836         int al = -1;
1837         if (ssl_scan_clienthello_tlsext(s, p, d, n, &al) <= 0)
1838                 {
1839                 ssl3_send_alert(s,SSL3_AL_FATAL,al);
1840                 return 0;
1841                 }
1842
1843         if (ssl_check_clienthello_tlsext(s) <= 0)
1844                 {
1845                 SSLerr(SSL_F_SSL_PARSE_CLIENTHELLO_TLSEXT,SSL_R_CLIENTHELLO_TLSEXT);
1846                 return 0;
1847                 }
1848         return 1;
1849 }
1850
1851 #ifndef OPENSSL_NO_NEXTPROTONEG
1852 /* ssl_next_proto_validate validates a Next Protocol Negotiation block. No
1853  * elements of zero length are allowed and the set of elements must exactly fill
1854  * the length of the block. */
1855 static char ssl_next_proto_validate(unsigned char *d, unsigned len)
1856         {
1857         unsigned int off = 0;
1858
1859         while (off < len)
1860                 {
1861                 if (d[off] == 0)
1862                         return 0;
1863                 off += d[off];
1864                 off++;
1865                 }
1866
1867         return off == len;
1868         }
1869 #endif
1870
1871 static int ssl_scan_serverhello_tlsext(SSL *s, unsigned char **p, unsigned char *d, int n, int *al)
1872         {
1873         unsigned short length;
1874         unsigned short type;
1875         unsigned short size;
1876         unsigned char *data = *p;
1877         int tlsext_servername = 0;
1878         int renegotiate_seen = 0;
1879
1880 #ifndef OPENSSL_NO_NEXTPROTONEG
1881         s->s3->next_proto_neg_seen = 0;
1882 #endif
1883
1884 #ifndef OPENSSL_NO_HEARTBEATS
1885         s->tlsext_heartbeat &= ~(SSL_TLSEXT_HB_ENABLED |
1886                                SSL_TLSEXT_HB_DONT_SEND_REQUESTS);
1887 #endif
1888
1889         if (data >= (d+n-2))
1890                 goto ri_check;
1891
1892         n2s(data,length);
1893         if (data+length != d+n)
1894                 {
1895                 *al = SSL_AD_DECODE_ERROR;
1896                 return 0;
1897                 }
1898
1899         while(data <= (d+n-4))
1900                 {
1901                 n2s(data,type);
1902                 n2s(data,size);
1903
1904                 if (data+size > (d+n))
1905                         goto ri_check;
1906
1907                 if (s->tlsext_debug_cb)
1908                         s->tlsext_debug_cb(s, 1, type, data, size,
1909                                                 s->tlsext_debug_arg);
1910
1911                 if (type == TLSEXT_TYPE_server_name)
1912                         {
1913                         if (s->tlsext_hostname == NULL || size > 0)
1914                                 {
1915                                 *al = TLS1_AD_UNRECOGNIZED_NAME;
1916                                 return 0;
1917                                 }
1918                         tlsext_servername = 1;
1919                         }
1920
1921 #ifndef OPENSSL_NO_EC
1922                 else if (type == TLSEXT_TYPE_ec_point_formats &&
1923                      s->version != DTLS1_VERSION)
1924                         {
1925                         unsigned char *sdata = data;
1926                         int ecpointformatlist_length = *(sdata++);
1927
1928                         if (ecpointformatlist_length != size - 1)
1929                                 {
1930                                 *al = TLS1_AD_DECODE_ERROR;
1931                                 return 0;
1932                                 }
1933                         s->session->tlsext_ecpointformatlist_length = 0;
1934                         if (s->session->tlsext_ecpointformatlist != NULL) OPENSSL_free(s->session->tlsext_ecpointformatlist);
1935                         if ((s->session->tlsext_ecpointformatlist = OPENSSL_malloc(ecpointformatlist_length)) == NULL)
1936                                 {
1937                                 *al = TLS1_AD_INTERNAL_ERROR;
1938                                 return 0;
1939                                 }
1940                         s->session->tlsext_ecpointformatlist_length = ecpointformatlist_length;
1941                         memcpy(s->session->tlsext_ecpointformatlist, sdata, ecpointformatlist_length);
1942 #if 0
1943                         fprintf(stderr,"ssl_parse_serverhello_tlsext s->session->tlsext_ecpointformatlist ");
1944                         sdata = s->session->tlsext_ecpointformatlist;
1945                         for (i = 0; i < s->session->tlsext_ecpointformatlist_length; i++)
1946                                 fprintf(stderr,"%i ",*(sdata++));
1947                         fprintf(stderr,"\n");
1948 #endif
1949                         }
1950 #endif /* OPENSSL_NO_EC */
1951
1952                 else if (type == TLSEXT_TYPE_session_ticket)
1953                         {
1954                         if (s->tls_session_ticket_ext_cb &&
1955                             !s->tls_session_ticket_ext_cb(s, data, size, s->tls_session_ticket_ext_cb_arg))
1956                                 {
1957                                 *al = TLS1_AD_INTERNAL_ERROR;
1958                                 return 0;
1959                                 }
1960                         if ((SSL_get_options(s) & SSL_OP_NO_TICKET)
1961                                 || (size > 0))
1962                                 {
1963                                 *al = TLS1_AD_UNSUPPORTED_EXTENSION;
1964                                 return 0;
1965                                 }
1966                         s->tlsext_ticket_expected = 1;
1967                         }
1968 #ifdef TLSEXT_TYPE_opaque_prf_input
1969                 else if (type == TLSEXT_TYPE_opaque_prf_input &&
1970                      s->version != DTLS1_VERSION)
1971                         {
1972                         unsigned char *sdata = data;
1973
1974                         if (size < 2)
1975                                 {
1976                                 *al = SSL_AD_DECODE_ERROR;
1977                                 return 0;
1978                                 }
1979                         n2s(sdata, s->s3->server_opaque_prf_input_len);
1980                         if (s->s3->server_opaque_prf_input_len != size - 2)
1981                                 {
1982                                 *al = SSL_AD_DECODE_ERROR;
1983                                 return 0;
1984                                 }
1985
1986                         if (s->s3->server_opaque_prf_input != NULL) /* shouldn't really happen */
1987                                 OPENSSL_free(s->s3->server_opaque_prf_input);
1988                         if (s->s3->server_opaque_prf_input_len == 0)
1989                                 s->s3->server_opaque_prf_input = OPENSSL_malloc(1); /* dummy byte just to get non-NULL */
1990                         else
1991                                 s->s3->server_opaque_prf_input = BUF_memdup(sdata, s->s3->server_opaque_prf_input_len);
1992
1993                         if (s->s3->server_opaque_prf_input == NULL)
1994                                 {
1995                                 *al = TLS1_AD_INTERNAL_ERROR;
1996                                 return 0;
1997                                 }
1998                         }
1999 #endif
2000                 else if (type == TLSEXT_TYPE_status_request &&
2001                          s->version != DTLS1_VERSION)
2002                         {
2003                         /* MUST be empty and only sent if we've requested
2004                          * a status request message.
2005                          */
2006                         if ((s->tlsext_status_type == -1) || (size > 0))
2007                                 {
2008                                 *al = TLS1_AD_UNSUPPORTED_EXTENSION;
2009                                 return 0;
2010                                 }
2011                         /* Set flag to expect CertificateStatus message */
2012                         s->tlsext_status_expected = 1;
2013                         }
2014 #ifndef OPENSSL_NO_NEXTPROTONEG
2015                 else if (type == TLSEXT_TYPE_next_proto_neg &&
2016                          s->s3->tmp.finish_md_len == 0)
2017                         {
2018                         unsigned char *selected;
2019                         unsigned char selected_len;
2020
2021                         /* We must have requested it. */
2022                         if ((s->ctx->next_proto_select_cb == NULL))
2023                                 {
2024                                 *al = TLS1_AD_UNSUPPORTED_EXTENSION;
2025                                 return 0;
2026                                 }
2027                         /* The data must be valid */
2028                         if (!ssl_next_proto_validate(data, size))
2029                                 {
2030                                 *al = TLS1_AD_DECODE_ERROR;
2031                                 return 0;
2032                                 }
2033                         if (s->ctx->next_proto_select_cb(s, &selected, &selected_len, data, size, s->ctx->next_proto_select_cb_arg) != SSL_TLSEXT_ERR_OK)
2034                                 {
2035                                 *al = TLS1_AD_INTERNAL_ERROR;
2036                                 return 0;
2037                                 }
2038                         s->next_proto_negotiated = OPENSSL_malloc(selected_len);
2039                         if (!s->next_proto_negotiated)
2040                                 {
2041                                 *al = TLS1_AD_INTERNAL_ERROR;
2042                                 return 0;
2043                                 }
2044                         memcpy(s->next_proto_negotiated, selected, selected_len);
2045                         s->next_proto_negotiated_len = selected_len;
2046                         s->s3->next_proto_neg_seen = 1;
2047                         }
2048 #endif
2049                 else if (type == TLSEXT_TYPE_renegotiate)
2050                         {
2051                         if(!ssl_parse_serverhello_renegotiate_ext(s, data, size, al))
2052                                 return 0;
2053                         renegotiate_seen = 1;
2054                         }
2055 #ifndef OPENSSL_NO_HEARTBEATS
2056                 else if (type == TLSEXT_TYPE_heartbeat)
2057                         {
2058                         switch(data[0])
2059                                 {
2060                                 case 0x01:      /* Server allows us to send HB requests */
2061                                                         s->tlsext_heartbeat |= SSL_TLSEXT_HB_ENABLED;
2062                                                         break;
2063                                 case 0x02:      /* Server doesn't accept HB requests */
2064                                                         s->tlsext_heartbeat |= SSL_TLSEXT_HB_ENABLED;
2065                                                         s->tlsext_heartbeat |= SSL_TLSEXT_HB_DONT_SEND_REQUESTS;
2066                                                         break;
2067                                 default:        *al = SSL_AD_ILLEGAL_PARAMETER;
2068                                                         return 0;
2069                                 }
2070                         }
2071 #endif
2072                 else if (type == TLSEXT_TYPE_use_srtp)
2073                         {
2074                         if(ssl_parse_serverhello_use_srtp_ext(s, data, size,
2075                                                               al))
2076                                 return 0;
2077                         }
2078
2079                 else if (type == TLSEXT_TYPE_server_authz)
2080                         {
2081                         /* We only support audit proofs. It's an error to send
2082                          * an authz hello extension if the client
2083                          * didn't request a proof. */
2084                         unsigned char *sdata = data;
2085                         unsigned char server_authz_dataformatlist_length;
2086
2087                         if (!s->ctx->tlsext_authz_server_audit_proof_cb)
2088                                 {
2089                                 *al = TLS1_AD_UNSUPPORTED_EXTENSION;
2090                                 return 0;
2091                                 }
2092
2093                         if (!size)
2094                                 {
2095                                 *al = TLS1_AD_DECODE_ERROR;
2096                                 return 0;
2097                                 }
2098
2099                         server_authz_dataformatlist_length = *(sdata++);
2100                         if (server_authz_dataformatlist_length != size - 1)
2101                                 {
2102                                 *al = TLS1_AD_DECODE_ERROR;
2103                                 return 0;
2104                                 }
2105
2106                         /* We only support audit proofs, so a legal ServerHello
2107                          * authz list contains exactly one entry. */
2108                         if (server_authz_dataformatlist_length != 1 ||
2109                                 sdata[0] != TLSEXT_AUTHZDATAFORMAT_audit_proof)
2110                                 {
2111                                 *al = TLS1_AD_UNSUPPORTED_EXTENSION;
2112                                 return 0;
2113                                 }
2114
2115                         s->s3->tlsext_authz_server_promised = 1;
2116                         }
2117
2118                 data += size;
2119                 }
2120
2121         if (data != d+n)
2122                 {
2123                 *al = SSL_AD_DECODE_ERROR;
2124                 return 0;
2125                 }
2126
2127         if (!s->hit && tlsext_servername == 1)
2128                 {
2129                 if (s->tlsext_hostname)
2130                         {
2131                         if (s->session->tlsext_hostname == NULL)
2132                                 {
2133                                 s->session->tlsext_hostname = BUF_strdup(s->tlsext_hostname);
2134                                 if (!s->session->tlsext_hostname)
2135                                         {
2136                                         *al = SSL_AD_UNRECOGNIZED_NAME;
2137                                         return 0;
2138                                         }
2139                                 }
2140                         else
2141                                 {
2142                                 *al = SSL_AD_DECODE_ERROR;
2143                                 return 0;
2144                                 }
2145                         }
2146                 }
2147
2148         *p = data;
2149
2150         ri_check:
2151
2152         /* Determine if we need to see RI. Strictly speaking if we want to
2153          * avoid an attack we should *always* see RI even on initial server
2154          * hello because the client doesn't see any renegotiation during an
2155          * attack. However this would mean we could not connect to any server
2156          * which doesn't support RI so for the immediate future tolerate RI
2157          * absence on initial connect only.
2158          */
2159         if (!renegotiate_seen
2160                 && !(s->options & SSL_OP_LEGACY_SERVER_CONNECT)
2161                 && !(s->options & SSL_OP_ALLOW_UNSAFE_LEGACY_RENEGOTIATION))
2162                 {
2163                 *al = SSL_AD_HANDSHAKE_FAILURE;
2164                 SSLerr(SSL_F_SSL_SCAN_SERVERHELLO_TLSEXT,
2165                                 SSL_R_UNSAFE_LEGACY_RENEGOTIATION_DISABLED);
2166                 return 0;
2167                 }
2168
2169         return 1;
2170         }
2171
2172
2173 int ssl_prepare_clienthello_tlsext(SSL *s)
2174         {
2175
2176 #ifdef TLSEXT_TYPE_opaque_prf_input
2177         {
2178                 int r = 1;
2179
2180                 if (s->ctx->tlsext_opaque_prf_input_callback != 0)
2181                         {
2182                         r = s->ctx->tlsext_opaque_prf_input_callback(s, NULL, 0, s->ctx->tlsext_opaque_prf_input_callback_arg);
2183                         if (!r)
2184                                 return -1;
2185                         }
2186
2187                 if (s->tlsext_opaque_prf_input != NULL)
2188                         {
2189                         if (s->s3->client_opaque_prf_input != NULL) /* shouldn't really happen */
2190                                 OPENSSL_free(s->s3->client_opaque_prf_input);
2191
2192                         if (s->tlsext_opaque_prf_input_len == 0)
2193                                 s->s3->client_opaque_prf_input = OPENSSL_malloc(1); /* dummy byte just to get non-NULL */
2194                         else
2195                                 s->s3->client_opaque_prf_input = BUF_memdup(s->tlsext_opaque_prf_input, s->tlsext_opaque_prf_input_len);
2196                         if (s->s3->client_opaque_prf_input == NULL)
2197                                 {
2198                                 SSLerr(SSL_F_SSL_PREPARE_CLIENTHELLO_TLSEXT,ERR_R_MALLOC_FAILURE);
2199                                 return -1;
2200                                 }
2201                         s->s3->client_opaque_prf_input_len = s->tlsext_opaque_prf_input_len;
2202                         }
2203
2204                 if (r == 2)
2205                         /* at callback's request, insist on receiving an appropriate server opaque PRF input */
2206                         s->s3->server_opaque_prf_input_len = s->tlsext_opaque_prf_input_len;
2207         }
2208 #endif
2209
2210         return 1;
2211         }
2212
2213 int ssl_prepare_serverhello_tlsext(SSL *s)
2214         {
2215 #ifndef OPENSSL_NO_EC
2216         /* If we are server and using an ECC cipher suite, send the point formats we support
2217          * if the client sent us an ECPointsFormat extension.  Note that the server is not
2218          * supposed to send an EllipticCurves extension.
2219          */
2220
2221         unsigned long alg_k = s->s3->tmp.new_cipher->algorithm_mkey;
2222         unsigned long alg_a = s->s3->tmp.new_cipher->algorithm_auth;
2223         int using_ecc = (alg_k & (SSL_kEECDH|SSL_kECDHr|SSL_kECDHe)) || (alg_a & SSL_aECDSA);
2224         using_ecc = using_ecc && (s->session->tlsext_ecpointformatlist != NULL);
2225
2226         if (using_ecc)
2227                 {
2228                 if (s->tlsext_ecpointformatlist != NULL) OPENSSL_free(s->tlsext_ecpointformatlist);
2229                 if ((s->tlsext_ecpointformatlist = OPENSSL_malloc(3)) == NULL)
2230                         {
2231                         SSLerr(SSL_F_SSL_PREPARE_SERVERHELLO_TLSEXT,ERR_R_MALLOC_FAILURE);
2232                         return -1;
2233                         }
2234                 s->tlsext_ecpointformatlist_length = 3;
2235                 s->tlsext_ecpointformatlist[0] = TLSEXT_ECPOINTFORMAT_uncompressed;
2236                 s->tlsext_ecpointformatlist[1] = TLSEXT_ECPOINTFORMAT_ansiX962_compressed_prime;
2237                 s->tlsext_ecpointformatlist[2] = TLSEXT_ECPOINTFORMAT_ansiX962_compressed_char2;
2238                 }
2239 #endif /* OPENSSL_NO_EC */
2240
2241         return 1;
2242         }
2243
2244 static int ssl_check_clienthello_tlsext(SSL *s)
2245         {
2246         int ret=SSL_TLSEXT_ERR_NOACK;
2247         int al = SSL_AD_UNRECOGNIZED_NAME;
2248
2249 #ifndef OPENSSL_NO_EC
2250         /* The handling of the ECPointFormats extension is done elsewhere, namely in
2251          * ssl3_choose_cipher in s3_lib.c.
2252          */
2253         /* The handling of the EllipticCurves extension is done elsewhere, namely in
2254          * ssl3_choose_cipher in s3_lib.c.
2255          */
2256 #endif
2257
2258         if (s->ctx != NULL && s->ctx->tlsext_servername_callback != 0)
2259                 ret = s->ctx->tlsext_servername_callback(s, &al, s->ctx->tlsext_servername_arg);
2260         else if (s->initial_ctx != NULL && s->initial_ctx->tlsext_servername_callback != 0)
2261                 ret = s->initial_ctx->tlsext_servername_callback(s, &al, s->initial_ctx->tlsext_servername_arg);
2262
2263         /* If status request then ask callback what to do.
2264          * Note: this must be called after servername callbacks in case
2265          * the certificate has changed.
2266          */
2267         if ((s->tlsext_status_type != -1) && s->ctx && s->ctx->tlsext_status_cb)
2268                 {
2269                 int r;
2270                 r = s->ctx->tlsext_status_cb(s, s->ctx->tlsext_status_arg);
2271                 switch (r)
2272                         {
2273                         /* We don't want to send a status request response */
2274                         case SSL_TLSEXT_ERR_NOACK:
2275                                 s->tlsext_status_expected = 0;
2276                                 break;
2277                         /* status request response should be sent */
2278                         case SSL_TLSEXT_ERR_OK:
2279                                 if (s->tlsext_ocsp_resp)
2280                                         s->tlsext_status_expected = 1;
2281                                 else
2282                                         s->tlsext_status_expected = 0;
2283                                 break;
2284                         /* something bad happened */
2285                         case SSL_TLSEXT_ERR_ALERT_FATAL:
2286                                 ret = SSL_TLSEXT_ERR_ALERT_FATAL;
2287                                 al = SSL_AD_INTERNAL_ERROR;
2288                                 goto err;
2289                         }
2290                 }
2291         else
2292                 s->tlsext_status_expected = 0;
2293
2294 #ifdef TLSEXT_TYPE_opaque_prf_input
2295         {
2296                 /* This sort of belongs into ssl_prepare_serverhello_tlsext(),
2297                  * but we might be sending an alert in response to the client hello,
2298                  * so this has to happen here in ssl_check_clienthello_tlsext(). */
2299
2300                 int r = 1;
2301
2302                 if (s->ctx->tlsext_opaque_prf_input_callback != 0)
2303                         {
2304                         r = s->ctx->tlsext_opaque_prf_input_callback(s, NULL, 0, s->ctx->tlsext_opaque_prf_input_callback_arg);
2305                         if (!r)
2306                                 {
2307                                 ret = SSL_TLSEXT_ERR_ALERT_FATAL;
2308                                 al = SSL_AD_INTERNAL_ERROR;
2309                                 goto err;
2310                                 }
2311                         }
2312
2313                 if (s->s3->server_opaque_prf_input != NULL) /* shouldn't really happen */
2314                         OPENSSL_free(s->s3->server_opaque_prf_input);
2315                 s->s3->server_opaque_prf_input = NULL;
2316
2317                 if (s->tlsext_opaque_prf_input != NULL)
2318                         {
2319                         if (s->s3->client_opaque_prf_input != NULL &&
2320                                 s->s3->client_opaque_prf_input_len == s->tlsext_opaque_prf_input_len)
2321                                 {
2322                                 /* can only use this extension if we have a server opaque PRF input
2323                                  * of the same length as the client opaque PRF input! */
2324
2325                                 if (s->tlsext_opaque_prf_input_len == 0)
2326                                         s->s3->server_opaque_prf_input = OPENSSL_malloc(1); /* dummy byte just to get non-NULL */
2327                                 else
2328                                         s->s3->server_opaque_prf_input = BUF_memdup(s->tlsext_opaque_prf_input, s->tlsext_opaque_prf_input_len);
2329                                 if (s->s3->server_opaque_prf_input == NULL)
2330                                         {
2331                                         ret = SSL_TLSEXT_ERR_ALERT_FATAL;
2332                                         al = SSL_AD_INTERNAL_ERROR;
2333                                         goto err;
2334                                         }
2335                                 s->s3->server_opaque_prf_input_len = s->tlsext_opaque_prf_input_len;
2336                                 }
2337                         }
2338
2339                 if (r == 2 && s->s3->server_opaque_prf_input == NULL)
2340                         {
2341                         /* The callback wants to enforce use of the extension,
2342                          * but we can't do that with the client opaque PRF input;
2343                          * abort the handshake.
2344                          */
2345                         ret = SSL_TLSEXT_ERR_ALERT_FATAL;
2346                         al = SSL_AD_HANDSHAKE_FAILURE;
2347                         }
2348         }
2349
2350 #endif
2351  err:
2352         switch (ret)
2353                 {
2354                 case SSL_TLSEXT_ERR_ALERT_FATAL:
2355                         ssl3_send_alert(s,SSL3_AL_FATAL,al);
2356                         return -1;
2357
2358                 case SSL_TLSEXT_ERR_ALERT_WARNING:
2359                         ssl3_send_alert(s,SSL3_AL_WARNING,al);
2360                         return 1;
2361
2362                 case SSL_TLSEXT_ERR_NOACK:
2363                         s->servername_done=0;
2364                         default:
2365                 return 1;
2366                 }
2367         }
2368
2369 int ssl_check_serverhello_tlsext(SSL *s)
2370         {
2371         int ret=SSL_TLSEXT_ERR_NOACK;
2372         int al = SSL_AD_UNRECOGNIZED_NAME;
2373
2374 #ifndef OPENSSL_NO_EC
2375         /* If we are client and using an elliptic curve cryptography cipher
2376          * suite, then if server returns an EC point formats lists extension
2377          * it must contain uncompressed.
2378          */
2379         unsigned long alg_k = s->s3->tmp.new_cipher->algorithm_mkey;
2380         unsigned long alg_a = s->s3->tmp.new_cipher->algorithm_auth;
2381         if ((s->tlsext_ecpointformatlist != NULL) && (s->tlsext_ecpointformatlist_length > 0) &&
2382             (s->session->tlsext_ecpointformatlist != NULL) && (s->session->tlsext_ecpointformatlist_length > 0) &&
2383             ((alg_k & (SSL_kEECDH|SSL_kECDHr|SSL_kECDHe)) || (alg_a & SSL_aECDSA)))
2384                 {
2385                 /* we are using an ECC cipher */
2386                 size_t i;
2387                 unsigned char *list;
2388                 int found_uncompressed = 0;
2389                 list = s->session->tlsext_ecpointformatlist;
2390                 for (i = 0; i < s->session->tlsext_ecpointformatlist_length; i++)
2391                         {
2392                         if (*(list++) == TLSEXT_ECPOINTFORMAT_uncompressed)
2393                                 {
2394                                 found_uncompressed = 1;
2395                                 break;
2396                                 }
2397                         }
2398                 if (!found_uncompressed)
2399                         {
2400                         SSLerr(SSL_F_SSL_CHECK_SERVERHELLO_TLSEXT,SSL_R_TLS_INVALID_ECPOINTFORMAT_LIST);
2401                         return -1;
2402                         }
2403                 }
2404         ret = SSL_TLSEXT_ERR_OK;
2405 #endif /* OPENSSL_NO_EC */
2406
2407         if (s->ctx != NULL && s->ctx->tlsext_servername_callback != 0)
2408                 ret = s->ctx->tlsext_servername_callback(s, &al, s->ctx->tlsext_servername_arg);
2409         else if (s->initial_ctx != NULL && s->initial_ctx->tlsext_servername_callback != 0)
2410                 ret = s->initial_ctx->tlsext_servername_callback(s, &al, s->initial_ctx->tlsext_servername_arg);
2411
2412 #ifdef TLSEXT_TYPE_opaque_prf_input
2413         if (s->s3->server_opaque_prf_input_len > 0)
2414                 {
2415                 /* This case may indicate that we, as a client, want to insist on using opaque PRF inputs.
2416                  * So first verify that we really have a value from the server too. */
2417
2418                 if (s->s3->server_opaque_prf_input == NULL)
2419                         {
2420                         ret = SSL_TLSEXT_ERR_ALERT_FATAL;
2421                         al = SSL_AD_HANDSHAKE_FAILURE;
2422                         }
2423
2424                 /* Anytime the server *has* sent an opaque PRF input, we need to check
2425                  * that we have a client opaque PRF input of the same size. */
2426                 if (s->s3->client_opaque_prf_input == NULL ||
2427                     s->s3->client_opaque_prf_input_len != s->s3->server_opaque_prf_input_len)
2428                         {
2429                         ret = SSL_TLSEXT_ERR_ALERT_FATAL;
2430                         al = SSL_AD_ILLEGAL_PARAMETER;
2431                         }
2432                 }
2433 #endif
2434
2435         /* If we've requested certificate status and we wont get one
2436          * tell the callback
2437          */
2438         if ((s->tlsext_status_type != -1) && !(s->tlsext_status_expected)
2439                         && s->ctx && s->ctx->tlsext_status_cb)
2440                 {
2441                 int r;
2442                 /* Set resp to NULL, resplen to -1 so callback knows
2443                  * there is no response.
2444                  */
2445                 if (s->tlsext_ocsp_resp)
2446                         {
2447                         OPENSSL_free(s->tlsext_ocsp_resp);
2448                         s->tlsext_ocsp_resp = NULL;
2449                         }
2450                 s->tlsext_ocsp_resplen = -1;
2451                 r = s->ctx->tlsext_status_cb(s, s->ctx->tlsext_status_arg);
2452                 if (r == 0)
2453                         {
2454                         al = SSL_AD_BAD_CERTIFICATE_STATUS_RESPONSE;
2455                         ret = SSL_TLSEXT_ERR_ALERT_FATAL;
2456                         }
2457                 if (r < 0)
2458                         {
2459                         al = SSL_AD_INTERNAL_ERROR;
2460                         ret = SSL_TLSEXT_ERR_ALERT_FATAL;
2461                         }
2462                 }
2463
2464         switch (ret)
2465                 {
2466                 case SSL_TLSEXT_ERR_ALERT_FATAL:
2467                         ssl3_send_alert(s,SSL3_AL_FATAL,al);
2468                         return -1;
2469
2470                 case SSL_TLSEXT_ERR_ALERT_WARNING:
2471                         ssl3_send_alert(s,SSL3_AL_WARNING,al);
2472                         return 1;
2473
2474                 case SSL_TLSEXT_ERR_NOACK:
2475                         s->servername_done=0;
2476                         default:
2477                 return 1;
2478                 }
2479         }
2480
2481 int ssl_parse_serverhello_tlsext(SSL *s, unsigned char **p, unsigned char *d, int n)
2482         {
2483         int al = -1;
2484         if (s->version < SSL3_VERSION)
2485                 return 1;
2486         if (ssl_scan_serverhello_tlsext(s, p, d, n, &al) <= 0)
2487                 {
2488                 ssl3_send_alert(s,SSL3_AL_FATAL,al);
2489                 return 0;
2490                 }
2491
2492         if (ssl_check_serverhello_tlsext(s) <= 0)
2493                 {
2494                 SSLerr(SSL_F_SSL_PARSE_SERVERHELLO_TLSEXT,SSL_R_SERVERHELLO_TLSEXT);
2495                 return 0;
2496                 }
2497         return 1;
2498 }
2499
2500 /* Since the server cache lookup is done early on in the processing of the
2501  * ClientHello, and other operations depend on the result, we need to handle
2502  * any TLS session ticket extension at the same time.
2503  *
2504  *   session_id: points at the session ID in the ClientHello. This code will
2505  *       read past the end of this in order to parse out the session ticket
2506  *       extension, if any.
2507  *   len: the length of the session ID.
2508  *   limit: a pointer to the first byte after the ClientHello.
2509  *   ret: (output) on return, if a ticket was decrypted, then this is set to
2510  *       point to the resulting session.
2511  *
2512  * If s->tls_session_secret_cb is set then we are expecting a pre-shared key
2513  * ciphersuite, in which case we have no use for session tickets and one will
2514  * never be decrypted, nor will s->tlsext_ticket_expected be set to 1.
2515  *
2516  * Returns:
2517  *   -1: fatal error, either from parsing or decrypting the ticket.
2518  *    0: no ticket was found (or was ignored, based on settings).
2519  *    1: a zero length extension was found, indicating that the client supports
2520  *       session tickets but doesn't currently have one to offer.
2521  *    2: either s->tls_session_secret_cb was set, or a ticket was offered but
2522  *       couldn't be decrypted because of a non-fatal error.
2523  *    3: a ticket was successfully decrypted and *ret was set.
2524  *
2525  * Side effects:
2526  *   Sets s->tlsext_ticket_expected to 1 if the server will have to issue
2527  *   a new session ticket to the client because the client indicated support
2528  *   (and s->tls_session_secret_cb is NULL) but the client either doesn't have
2529  *   a session ticket or we couldn't use the one it gave us, or if
2530  *   s->ctx->tlsext_ticket_key_cb asked to renew the client's ticket.
2531  *   Otherwise, s->tlsext_ticket_expected is set to 0.
2532  */
2533 int tls1_process_ticket(SSL *s, unsigned char *session_id, int len,
2534                         const unsigned char *limit, SSL_SESSION **ret)
2535         {
2536         /* Point after session ID in client hello */
2537         const unsigned char *p = session_id + len;
2538         unsigned short i;
2539
2540         *ret = NULL;
2541         s->tlsext_ticket_expected = 0;
2542
2543         /* If tickets disabled behave as if no ticket present
2544          * to permit stateful resumption.
2545          */
2546         if (SSL_get_options(s) & SSL_OP_NO_TICKET)
2547                 return 0;
2548         if ((s->version <= SSL3_VERSION) || !limit)
2549                 return 0;
2550         if (p >= limit)
2551                 return -1;
2552         /* Skip past DTLS cookie */
2553         if (s->version == DTLS1_VERSION || s->version == DTLS1_BAD_VER)
2554                 {
2555                 i = *(p++);
2556                 p+= i;
2557                 if (p >= limit)
2558                         return -1;
2559                 }
2560         /* Skip past cipher list */
2561         n2s(p, i);
2562         p+= i;
2563         if (p >= limit)
2564                 return -1;
2565         /* Skip past compression algorithm list */
2566         i = *(p++);
2567         p += i;
2568         if (p > limit)
2569                 return -1;
2570         /* Now at start of extensions */
2571         if ((p + 2) >= limit)
2572                 return 0;
2573         n2s(p, i);
2574         while ((p + 4) <= limit)
2575                 {
2576                 unsigned short type, size;
2577                 n2s(p, type);
2578                 n2s(p, size);
2579                 if (p + size > limit)
2580                         return 0;
2581                 if (type == TLSEXT_TYPE_session_ticket)
2582                         {
2583                         int r;
2584                         if (size == 0)
2585                                 {
2586                                 /* The client will accept a ticket but doesn't
2587                                  * currently have one. */
2588                                 s->tlsext_ticket_expected = 1;
2589                                 return 1;
2590                                 }
2591                         if (s->tls_session_secret_cb)
2592                                 {
2593                                 /* Indicate that the ticket couldn't be
2594                                  * decrypted rather than generating the session
2595                                  * from ticket now, trigger abbreviated
2596                                  * handshake based on external mechanism to
2597                                  * calculate the master secret later. */
2598                                 return 2;
2599                                 }
2600                         r = tls_decrypt_ticket(s, p, size, session_id, len, ret);
2601                         switch (r)
2602                                 {
2603                                 case 2: /* ticket couldn't be decrypted */
2604                                         s->tlsext_ticket_expected = 1;
2605                                         return 2;
2606                                 case 3: /* ticket was decrypted */
2607                                         return r;
2608                                 case 4: /* ticket decrypted but need to renew */
2609                                         s->tlsext_ticket_expected = 1;
2610                                         return 3;
2611                                 default: /* fatal error */
2612                                         return -1;
2613                                 }
2614                         }
2615                 p += size;
2616                 }
2617         return 0;
2618         }
2619
2620 /* tls_decrypt_ticket attempts to decrypt a session ticket.
2621  *
2622  *   etick: points to the body of the session ticket extension.
2623  *   eticklen: the length of the session tickets extenion.
2624  *   sess_id: points at the session ID.
2625  *   sesslen: the length of the session ID.
2626  *   psess: (output) on return, if a ticket was decrypted, then this is set to
2627  *       point to the resulting session.
2628  *
2629  * Returns:
2630  *   -1: fatal error, either from parsing or decrypting the ticket.
2631  *    2: the ticket couldn't be decrypted.
2632  *    3: a ticket was successfully decrypted and *psess was set.
2633  *    4: same as 3, but the ticket needs to be renewed.
2634  */
2635 static int tls_decrypt_ticket(SSL *s, const unsigned char *etick, int eticklen,
2636                                 const unsigned char *sess_id, int sesslen,
2637                                 SSL_SESSION **psess)
2638         {
2639         SSL_SESSION *sess;
2640         unsigned char *sdec;
2641         const unsigned char *p;
2642         int slen, mlen, renew_ticket = 0;
2643         unsigned char tick_hmac[EVP_MAX_MD_SIZE];
2644         HMAC_CTX hctx;
2645         EVP_CIPHER_CTX ctx;
2646         SSL_CTX *tctx = s->initial_ctx;
2647         /* Need at least keyname + iv + some encrypted data */
2648         if (eticklen < 48)
2649                 return 2;
2650         /* Initialize session ticket encryption and HMAC contexts */
2651         HMAC_CTX_init(&hctx);
2652         EVP_CIPHER_CTX_init(&ctx);
2653         if (tctx->tlsext_ticket_key_cb)
2654                 {
2655                 unsigned char *nctick = (unsigned char *)etick;
2656                 int rv = tctx->tlsext_ticket_key_cb(s, nctick, nctick + 16,
2657                                                         &ctx, &hctx, 0);
2658                 if (rv < 0)
2659                         return -1;
2660                 if (rv == 0)
2661                         return 2;
2662                 if (rv == 2)
2663                         renew_ticket = 1;
2664                 }
2665         else
2666                 {
2667                 /* Check key name matches */
2668                 if (memcmp(etick, tctx->tlsext_tick_key_name, 16))
2669                         return 2;
2670                 HMAC_Init_ex(&hctx, tctx->tlsext_tick_hmac_key, 16,
2671                                         tlsext_tick_md(), NULL);
2672                 EVP_DecryptInit_ex(&ctx, EVP_aes_128_cbc(), NULL,
2673                                 tctx->tlsext_tick_aes_key, etick + 16);
2674                 }
2675         /* Attempt to process session ticket, first conduct sanity and
2676          * integrity checks on ticket.
2677          */
2678         mlen = HMAC_size(&hctx);
2679         if (mlen < 0)
2680                 {
2681                 EVP_CIPHER_CTX_cleanup(&ctx);
2682                 return -1;
2683                 }
2684         eticklen -= mlen;
2685         /* Check HMAC of encrypted ticket */
2686         HMAC_Update(&hctx, etick, eticklen);
2687         HMAC_Final(&hctx, tick_hmac, NULL);
2688         HMAC_CTX_cleanup(&hctx);
2689         if (memcmp(tick_hmac, etick + eticklen, mlen))
2690                 return 2;
2691         /* Attempt to decrypt session data */
2692         /* Move p after IV to start of encrypted ticket, update length */
2693         p = etick + 16 + EVP_CIPHER_CTX_iv_length(&ctx);
2694         eticklen -= 16 + EVP_CIPHER_CTX_iv_length(&ctx);
2695         sdec = OPENSSL_malloc(eticklen);
2696         if (!sdec)
2697                 {
2698                 EVP_CIPHER_CTX_cleanup(&ctx);
2699                 return -1;
2700                 }
2701         EVP_DecryptUpdate(&ctx, sdec, &slen, p, eticklen);
2702         if (EVP_DecryptFinal(&ctx, sdec + slen, &mlen) <= 0)
2703                 return 2;
2704         slen += mlen;
2705         EVP_CIPHER_CTX_cleanup(&ctx);
2706         p = sdec;
2707
2708         sess = d2i_SSL_SESSION(NULL, &p, slen);
2709         OPENSSL_free(sdec);
2710         if (sess)
2711                 {
2712                 /* The session ID, if non-empty, is used by some clients to
2713                  * detect that the ticket has been accepted. So we copy it to
2714                  * the session structure. If it is empty set length to zero
2715                  * as required by standard.
2716                  */
2717                 if (sesslen)
2718                         memcpy(sess->session_id, sess_id, sesslen);
2719                 sess->session_id_length = sesslen;
2720                 *psess = sess;
2721                 if (renew_ticket)
2722                         return 4;
2723                 else
2724                         return 3;
2725                 }
2726         ERR_clear_error();
2727         /* For session parse failure, indicate that we need to send a new
2728          * ticket. */
2729         return 2;
2730         }
2731
2732 /* Tables to translate from NIDs to TLS v1.2 ids */
2733
2734 typedef struct
2735         {
2736         int nid;
2737         int id;
2738         } tls12_lookup;
2739
2740 static tls12_lookup tls12_md[] = {
2741         {NID_md5, TLSEXT_hash_md5},
2742         {NID_sha1, TLSEXT_hash_sha1},
2743         {NID_sha224, TLSEXT_hash_sha224},
2744         {NID_sha256, TLSEXT_hash_sha256},
2745         {NID_sha384, TLSEXT_hash_sha384},
2746         {NID_sha512, TLSEXT_hash_sha512}
2747 };
2748
2749 static tls12_lookup tls12_sig[] = {
2750         {EVP_PKEY_RSA, TLSEXT_signature_rsa},
2751         {EVP_PKEY_DSA, TLSEXT_signature_dsa},
2752         {EVP_PKEY_EC, TLSEXT_signature_ecdsa}
2753 };
2754
2755 static int tls12_find_id(int nid, tls12_lookup *table, size_t tlen)
2756         {
2757         size_t i;
2758         for (i = 0; i < tlen; i++)
2759                 {
2760                 if (table[i].nid == nid)
2761                         return table[i].id;
2762                 }
2763         return -1;
2764         }
2765
2766 static int tls12_find_nid(int id, tls12_lookup *table, size_t tlen)
2767         {
2768         size_t i;
2769         for (i = 0; i < tlen; i++)
2770                 {
2771                 if ((table[i].id) == id)
2772                         return table[i].nid;
2773                 }
2774         return NID_undef;
2775         }
2776
2777 int tls12_get_sigandhash(unsigned char *p, const EVP_PKEY *pk, const EVP_MD *md)
2778         {
2779         int sig_id, md_id;
2780         if (!md)
2781                 return 0;
2782         md_id = tls12_find_id(EVP_MD_type(md), tls12_md,
2783                                 sizeof(tls12_md)/sizeof(tls12_lookup));
2784         if (md_id == -1)
2785                 return 0;
2786         sig_id = tls12_get_sigid(pk);
2787         if (sig_id == -1)
2788                 return 0;
2789         p[0] = (unsigned char)md_id;
2790         p[1] = (unsigned char)sig_id;
2791         return 1;
2792         }
2793
2794 int tls12_get_sigid(const EVP_PKEY *pk)
2795         {
2796         return tls12_find_id(pk->type, tls12_sig,
2797                                 sizeof(tls12_sig)/sizeof(tls12_lookup));
2798         }
2799
2800 const EVP_MD *tls12_get_hash(unsigned char hash_alg)
2801         {
2802         switch(hash_alg)
2803                 {
2804 #ifndef OPENSSL_NO_MD5
2805                 case TLSEXT_hash_md5:
2806 #ifdef OPENSSL_FIPS
2807                 if (FIPS_mode())
2808                         return NULL;
2809 #endif
2810                 return EVP_md5();
2811 #endif
2812 #ifndef OPENSSL_NO_SHA
2813                 case TLSEXT_hash_sha1:
2814                 return EVP_sha1();
2815 #endif
2816 #ifndef OPENSSL_NO_SHA256
2817                 case TLSEXT_hash_sha224:
2818                 return EVP_sha224();
2819
2820                 case TLSEXT_hash_sha256:
2821                 return EVP_sha256();
2822 #endif
2823 #ifndef OPENSSL_NO_SHA512
2824                 case TLSEXT_hash_sha384:
2825                 return EVP_sha384();
2826
2827                 case TLSEXT_hash_sha512:
2828                 return EVP_sha512();
2829 #endif
2830                 default:
2831                 return NULL;
2832
2833                 }
2834         }
2835
2836 /* Set preferred digest for each key type */
2837
2838 int tls1_process_sigalgs(SSL *s, const unsigned char *data, int dsize)
2839         {
2840         int i, idx;
2841         const EVP_MD *md;
2842         CERT *c = s->cert;
2843         TLS_SIGALGS *sigptr;
2844         /* Extension ignored for TLS versions below 1.2 */
2845         if (TLS1_get_version(s) < TLS1_2_VERSION)
2846                 return 1;
2847         /* Should never happen */
2848         if (!c)
2849                 return 0;
2850
2851         c->pkeys[SSL_PKEY_DSA_SIGN].digest = NULL;
2852         c->pkeys[SSL_PKEY_RSA_SIGN].digest = NULL;
2853         c->pkeys[SSL_PKEY_RSA_ENC].digest = NULL;
2854         c->pkeys[SSL_PKEY_ECC].digest = NULL;
2855
2856         if (c->sigalgs)
2857                 OPENSSL_free(c->sigalgs);
2858         c->sigalgs = OPENSSL_malloc((dsize/2) * sizeof(TLS_SIGALGS));
2859         if (!c->sigalgs)
2860                 return 0;
2861         c->sigalgslen = dsize/2;
2862
2863         for (i = 0, sigptr = c->sigalgs; i < dsize; i += 2, sigptr++)
2864                 {
2865                 sigptr->rhash = data[i];
2866                 sigptr->rsign = data[i + 1];
2867                 sigptr->hash_nid = tls12_find_nid(sigptr->rhash, tls12_md,
2868                                         sizeof(tls12_md)/sizeof(tls12_lookup));
2869                 sigptr->sign_nid = tls12_find_nid(sigptr->rsign, tls12_sig,
2870                                         sizeof(tls12_sig)/sizeof(tls12_lookup));
2871                 if (!OBJ_find_sigid_by_algs(&sigptr->signandhash_nid,
2872                                                 sigptr->hash_nid,
2873                                                 sigptr->sign_nid))
2874                         sigptr->signandhash_nid = NID_undef;
2875                 switch(sigptr->rsign)
2876                         {
2877 #ifndef OPENSSL_NO_RSA
2878                         case TLSEXT_signature_rsa:
2879                         idx = SSL_PKEY_RSA_SIGN;
2880                         break;
2881 #endif
2882 #ifndef OPENSSL_NO_DSA
2883                         case TLSEXT_signature_dsa:
2884                         idx = SSL_PKEY_DSA_SIGN;
2885                         break;
2886 #endif
2887 #ifndef OPENSSL_NO_ECDSA
2888                         case TLSEXT_signature_ecdsa:
2889                         idx = SSL_PKEY_ECC;
2890                         break;
2891 #endif
2892                         default:
2893                         continue;
2894                         }
2895
2896                 if (c->pkeys[idx].digest == NULL)
2897                         {
2898                         md = tls12_get_hash(sigptr->rhash);
2899                         if (md)
2900                                 {
2901                                 c->pkeys[idx].digest = md;
2902                                 if (idx == SSL_PKEY_RSA_SIGN)
2903                                         c->pkeys[SSL_PKEY_RSA_ENC].digest = md;
2904                                 }
2905                         }
2906
2907                 }
2908
2909
2910         /* Set any remaining keys to default values. NOTE: if alg is not
2911          * supported it stays as NULL.
2912          */
2913 #ifndef OPENSSL_NO_DSA
2914         if (!c->pkeys[SSL_PKEY_DSA_SIGN].digest)
2915                 c->pkeys[SSL_PKEY_DSA_SIGN].digest = EVP_dss1();
2916 #endif
2917 #ifndef OPENSSL_NO_RSA
2918         if (!c->pkeys[SSL_PKEY_RSA_SIGN].digest)
2919                 {
2920                 c->pkeys[SSL_PKEY_RSA_SIGN].digest = EVP_sha1();
2921                 c->pkeys[SSL_PKEY_RSA_ENC].digest = EVP_sha1();
2922                 }
2923 #endif
2924 #ifndef OPENSSL_NO_ECDSA
2925         if (!c->pkeys[SSL_PKEY_ECC].digest)
2926                 c->pkeys[SSL_PKEY_ECC].digest = EVP_ecdsa();
2927 #endif
2928         return 1;
2929         }
2930
2931 #endif
2932
2933 int SSL_get_sigalgs(SSL *s, int idx,
2934                         int *psign, int *phash, int *psignandhash,
2935                         unsigned char *rsig, unsigned char *rhash)
2936         {
2937         if (s->cert->sigalgs == NULL)
2938                 return 0;
2939         if (idx >= 0)
2940                 {
2941                 TLS_SIGALGS *psig;
2942                 if (idx >= (int)s->cert->sigalgslen)
2943                         return 0;
2944                 psig = s->cert->sigalgs + idx;
2945                 if (psign)
2946                         *psign = psig->sign_nid;
2947                 if (phash)
2948                         *phash = psig->hash_nid;
2949                 if (psignandhash)
2950                         *psignandhash = psig->signandhash_nid;
2951                 if (rsig)
2952                         *rsig = psig->rsign;
2953                 if (rhash)
2954                         *rhash = psig->rhash;
2955                 }
2956         return s->cert->sigalgslen;
2957         }
2958
2959
2960 #ifndef OPENSSL_NO_HEARTBEATS
2961 int
2962 tls1_process_heartbeat(SSL *s)
2963         {
2964         unsigned char *p = &s->s3->rrec.data[0], *pl;
2965         unsigned short hbtype;
2966         unsigned int payload;
2967         unsigned int padding = 16; /* Use minimum padding */
2968
2969         /* Read type and payload length first */
2970         hbtype = *p++;
2971         n2s(p, payload);
2972         pl = p;
2973
2974         if (s->msg_callback)
2975                 s->msg_callback(0, s->version, TLS1_RT_HEARTBEAT,
2976                         &s->s3->rrec.data[0], s->s3->rrec.length,
2977                         s, s->msg_callback_arg);
2978
2979         if (hbtype == TLS1_HB_REQUEST)
2980                 {
2981                 unsigned char *buffer, *bp;
2982                 int r;
2983
2984                 /* Allocate memory for the response, size is 1 bytes
2985                  * message type, plus 2 bytes payload length, plus
2986                  * payload, plus padding
2987                  */
2988                 buffer = OPENSSL_malloc(1 + 2 + payload + padding);
2989                 bp = buffer;
2990
2991                 /* Enter response type, length and copy payload */
2992                 *bp++ = TLS1_HB_RESPONSE;
2993                 s2n(payload, bp);
2994                 memcpy(bp, pl, payload);
2995                 bp += payload;
2996                 /* Random padding */
2997                 RAND_pseudo_bytes(bp, padding);
2998
2999                 r = ssl3_write_bytes(s, TLS1_RT_HEARTBEAT, buffer, 3 + payload + padding);
3000
3001                 if (r >= 0 && s->msg_callback)
3002                         s->msg_callback(1, s->version, TLS1_RT_HEARTBEAT,
3003                                 buffer, 3 + payload + padding,
3004                                 s, s->msg_callback_arg);
3005
3006                 OPENSSL_free(buffer);
3007
3008                 if (r < 0)
3009                         return r;
3010                 }
3011         else if (hbtype == TLS1_HB_RESPONSE)
3012                 {
3013                 unsigned int seq;
3014
3015                 /* We only send sequence numbers (2 bytes unsigned int),
3016                  * and 16 random bytes, so we just try to read the
3017                  * sequence number */
3018                 n2s(pl, seq);
3019
3020                 if (payload == 18 && seq == s->tlsext_hb_seq)
3021                         {
3022                         s->tlsext_hb_seq++;
3023                         s->tlsext_hb_pending = 0;
3024                         }
3025                 }
3026
3027         return 0;
3028         }
3029
3030 int
3031 tls1_heartbeat(SSL *s)
3032         {
3033         unsigned char *buf, *p;
3034         int ret;
3035         unsigned int payload = 18; /* Sequence number + random bytes */
3036         unsigned int padding = 16; /* Use minimum padding */
3037
3038         /* Only send if peer supports and accepts HB requests... */
3039         if (!(s->tlsext_heartbeat & SSL_TLSEXT_HB_ENABLED) ||
3040             s->tlsext_heartbeat & SSL_TLSEXT_HB_DONT_SEND_REQUESTS)
3041                 {
3042                 SSLerr(SSL_F_TLS1_HEARTBEAT,SSL_R_TLS_HEARTBEAT_PEER_DOESNT_ACCEPT);
3043                 return -1;
3044                 }
3045
3046         /* ...and there is none in flight yet... */
3047         if (s->tlsext_hb_pending)
3048                 {
3049                 SSLerr(SSL_F_TLS1_HEARTBEAT,SSL_R_TLS_HEARTBEAT_PENDING);
3050                 return -1;
3051                 }
3052
3053         /* ...and no handshake in progress. */
3054         if (SSL_in_init(s) || s->in_handshake)
3055                 {
3056                 SSLerr(SSL_F_TLS1_HEARTBEAT,SSL_R_UNEXPECTED_MESSAGE);
3057                 return -1;
3058                 }
3059
3060         /* Check if padding is too long, payload and padding
3061          * must not exceed 2^14 - 3 = 16381 bytes in total.
3062          */
3063         OPENSSL_assert(payload + padding <= 16381);
3064
3065         /* Create HeartBeat message, we just use a sequence number
3066          * as payload to distuingish different messages and add
3067          * some random stuff.
3068          *  - Message Type, 1 byte
3069          *  - Payload Length, 2 bytes (unsigned int)
3070          *  - Payload, the sequence number (2 bytes uint)
3071          *  - Payload, random bytes (16 bytes uint)
3072          *  - Padding
3073          */
3074         buf = OPENSSL_malloc(1 + 2 + payload + padding);
3075         p = buf;
3076         /* Message Type */
3077         *p++ = TLS1_HB_REQUEST;
3078         /* Payload length (18 bytes here) */
3079         s2n(payload, p);
3080         /* Sequence number */
3081         s2n(s->tlsext_hb_seq, p);
3082         /* 16 random bytes */
3083         RAND_pseudo_bytes(p, 16);
3084         p += 16;
3085         /* Random padding */
3086         RAND_pseudo_bytes(p, padding);
3087
3088         ret = ssl3_write_bytes(s, TLS1_RT_HEARTBEAT, buf, 3 + payload + padding);
3089         if (ret >= 0)
3090                 {
3091                 if (s->msg_callback)
3092                         s->msg_callback(1, s->version, TLS1_RT_HEARTBEAT,
3093                                 buf, 3 + payload + padding,
3094                                 s, s->msg_callback_arg);
3095
3096                 s->tlsext_hb_pending = 1;
3097                 }
3098
3099         OPENSSL_free(buf);
3100
3101         return ret;
3102         }
3103 #endif