ssl/t1_lib.c

   1 /* ssl/t1_lib.c */
   2 /* Copyright (C) 1995-1998 Eric Young (eay@cryptsoft.com)
   3  * All rights reserved.
   4  *
   5  * This package is an SSL implementation written
   6  * by Eric Young (eay@cryptsoft.com).
   7  * The implementation was written so as to conform with Netscapes SSL.
   8  *
   9  * This library is free for commercial and non-commercial use as long as
  10  * the following conditions are aheared to.  The following conditions
  11  * apply to all code found in this distribution, be it the RC4, RSA,
  12  * lhash, DES, etc., code; not just the SSL code.  The SSL documentation
  13  * included with this distribution is covered by the same copyright terms
  14  * except that the holder is Tim Hudson (tjh@cryptsoft.com).
  15  *
  16  * Copyright remains Eric Young's, and as such any Copyright notices in
  17  * the code are not to be removed.
  18  * If this package is used in a product, Eric Young should be given attribution
  19  * as the author of the parts of the library used.
  20  * This can be in the form of a textual message at program startup or
  21  * in documentation (online or textual) provided with the package.
  22  *
  23  * Redistribution and use in source and binary forms, with or without
  24  * modification, are permitted provided that the following conditions
  25  * are met:
  26  * 1. Redistributions of source code must retain the copyright
  27  *    notice, this list of conditions and the following disclaimer.
  28  * 2. Redistributions in binary form must reproduce the above copyright
  29  *    notice, this list of conditions and the following disclaimer in the
  30  *    documentation and/or other materials provided with the distribution.
  31  * 3. All advertising materials mentioning features or use of this software
  32  *    must display the following acknowledgement:
  33  *    "This product includes cryptographic software written by
  34  *     Eric Young (eay@cryptsoft.com)"
  35  *    The word 'cryptographic' can be left out if the rouines from the library
  36  *    being used are not cryptographic related :-).
  37  * 4. If you include any Windows specific code (or a derivative thereof) from
  38  *    the apps directory (application code) you must include an acknowledgement:
  39  *    "This product includes software written by Tim Hudson (tjh@cryptsoft.com)"
  40  *
  41  * THIS SOFTWARE IS PROVIDED BY ERIC YOUNG ``AS IS'' AND
  42  * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
  43  * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
  44  * ARE DISCLAIMED.  IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE
  45  * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
  46  * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
  47  * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
  48  * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
  49  * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
  50  * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
  51  * SUCH DAMAGE.
  52  *
  53  * The licence and distribution terms for any publically available version or
  54  * derivative of this code cannot be changed.  i.e. this code cannot simply be
  55  * copied and put under another distribution licence
  56  * [including the GNU Public Licence.]
  57  */
  58 /* ====================================================================
  59  * Copyright (c) 1998-2007 The OpenSSL Project.  All rights reserved.
  60  *
  61  * Redistribution and use in source and binary forms, with or without
  62  * modification, are permitted provided that the following conditions
  63  * are met:
  64  *
  65  * 1. Redistributions of source code must retain the above copyright
  66  *    notice, this list of conditions and the following disclaimer.
  67  *
  68  * 2. Redistributions in binary form must reproduce the above copyright
  69  *    notice, this list of conditions and the following disclaimer in
  70  *    the documentation and/or other materials provided with the
  71  *    distribution.
  72  *
  73  * 3. All advertising materials mentioning features or use of this
  74  *    software must display the following acknowledgment:
  75  *    "This product includes software developed by the OpenSSL Project
  76  *    for use in the OpenSSL Toolkit. (http://www.openssl.org/)"
  77  *
  78  * 4. The names "OpenSSL Toolkit" and "OpenSSL Project" must not be used to
  79  *    endorse or promote products derived from this software without
  80  *    prior written permission. For written permission, please contact
  81  *    openssl-core@openssl.org.
  82  *
  83  * 5. Products derived from this software may not be called "OpenSSL"
  84  *    nor may "OpenSSL" appear in their names without prior written
  85  *    permission of the OpenSSL Project.
  86  *
  87  * 6. Redistributions of any form whatsoever must retain the following
  88  *    acknowledgment:
  89  *    "This product includes software developed by the OpenSSL Project
  90  *    for use in the OpenSSL Toolkit (http://www.openssl.org/)"
  91  *
  92  * THIS SOFTWARE IS PROVIDED BY THE OpenSSL PROJECT ``AS IS'' AND ANY
  93  * EXPRESSED OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
  94  * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
  95  * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL THE OpenSSL PROJECT OR
  96  * ITS CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
  97  * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
  98  * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
  99  * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
 100  * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT,
 101  * STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
 102  * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED
 103  * OF THE POSSIBILITY OF SUCH DAMAGE.
 104  * ====================================================================
 105  *
 106  * This product includes cryptographic software written by Eric Young
 107  * (eay@cryptsoft.com).  This product includes software written by Tim
 108  * Hudson (tjh@cryptsoft.com).
 109  *
 110  */
 111
 112 #include <stdio.h>
 113 #include <openssl/objects.h>
 114 #include <openssl/evp.h>
 115 #include <openssl/hmac.h>
 116 #include <openssl/ocsp.h>
 117 #include "ssl_locl.h"
 118
 119 const char tls1_version_str[]="TLSv1" OPENSSL_VERSION_PTEXT;
 120
 121 #ifndef OPENSSL_NO_TLSEXT
 122 static int tls_decrypt_ticket(SSL *s, const unsigned char *tick, int ticklen,
 123                                 const unsigned char *sess_id, int sesslen,
 124                                 SSL_SESSION **psess);
 125 static int tls1_process_sigalgs(SSL *s, const unsigned char *data, int dsize);
 126 #endif
 127
 128 SSL3_ENC_METHOD TLSv1_enc_data={
 129         tls1_enc,
 130         tls1_mac,
 131         tls1_setup_key_block,
 132         tls1_generate_master_secret,
 133         tls1_change_cipher_state,
 134         tls1_final_finish_mac,
 135         TLS1_FINISH_MAC_LENGTH,
 136         tls1_cert_verify_mac,
 137         TLS_MD_CLIENT_FINISH_CONST,TLS_MD_CLIENT_FINISH_CONST_SIZE,
 138         TLS_MD_SERVER_FINISH_CONST,TLS_MD_SERVER_FINISH_CONST_SIZE,
 139         tls1_alert_code,
 140         };
 141
 142 long tls1_default_timeout(void)
 143         {
 144         /* 2 hours, the 24 hours mentioned in the TLSv1 spec
 145          * is way too long for http, the cache would over fill */
 146         return(60*60*2);
 147         }
 148
 149 int tls1_new(SSL *s)
 150         {
 151         if (!ssl3_new(s)) return(0);
 152         s->method->ssl_clear(s);
 153         return(1);
 154         }
 155
 156 void tls1_free(SSL *s)
 157         {
 158 #ifndef OPENSSL_NO_TLSEXT
 159         if (s->tlsext_session_ticket)
 160                 {
 161                 OPENSSL_free(s->tlsext_session_ticket);
 162                 }
 163 #endif /* OPENSSL_NO_TLSEXT */
 164         ssl3_free(s);
 165         }
 166
 167 void tls1_clear(SSL *s)
 168         {
 169         ssl3_clear(s);
 170         s->version = s->method->version;
 171         }
 172
 173 #ifndef OPENSSL_NO_EC
 174 static int nid_list[] =
 175         {
 176                 NID_sect163k1, /* sect163k1 (1) */
 177                 NID_sect163r1, /* sect163r1 (2) */
 178                 NID_sect163r2, /* sect163r2 (3) */
 179                 NID_sect193r1, /* sect193r1 (4) */
 180                 NID_sect193r2, /* sect193r2 (5) */
 181                 NID_sect233k1, /* sect233k1 (6) */
 182                 NID_sect233r1, /* sect233r1 (7) */
 183                 NID_sect239k1, /* sect239k1 (8) */
 184                 NID_sect283k1, /* sect283k1 (9) */
 185                 NID_sect283r1, /* sect283r1 (10) */
 186                 NID_sect409k1, /* sect409k1 (11) */
 187                 NID_sect409r1, /* sect409r1 (12) */
 188                 NID_sect571k1, /* sect571k1 (13) */
 189                 NID_sect571r1, /* sect571r1 (14) */
 190                 NID_secp160k1, /* secp160k1 (15) */
 191                 NID_secp160r1, /* secp160r1 (16) */
 192                 NID_secp160r2, /* secp160r2 (17) */
 193                 NID_secp192k1, /* secp192k1 (18) */
 194                 NID_X9_62_prime192v1, /* secp192r1 (19) */
 195                 NID_secp224k1, /* secp224k1 (20) */
 196                 NID_secp224r1, /* secp224r1 (21) */
 197                 NID_secp256k1, /* secp256k1 (22) */
 198                 NID_X9_62_prime256v1, /* secp256r1 (23) */
 199                 NID_secp384r1, /* secp384r1 (24) */
 200                 NID_secp521r1  /* secp521r1 (25) */
 201         };
 202
 203 int tls1_ec_curve_id2nid(int curve_id)
 204         {
 205         /* ECC curves from draft-ietf-tls-ecc-12.txt (Oct. 17, 2005) */
 206         if ((curve_id < 1) || ((unsigned int)curve_id >
 207                                 sizeof(nid_list)/sizeof(nid_list[0])))
 208                 return 0;
 209         return nid_list[curve_id-1];
 210         }
 211
 212 int tls1_ec_nid2curve_id(int nid)
 213         {
 214         /* ECC curves from draft-ietf-tls-ecc-12.txt (Oct. 17, 2005) */
 215         switch (nid)
 216                 {
 217         case NID_sect163k1: /* sect163k1 (1) */
 218                 return 1;
 219         case NID_sect163r1: /* sect163r1 (2) */
 220                 return 2;
 221         case NID_sect163r2: /* sect163r2 (3) */
 222                 return 3;
 223         case NID_sect193r1: /* sect193r1 (4) */
 224                 return 4;
 225         case NID_sect193r2: /* sect193r2 (5) */
 226                 return 5;
 227         case NID_sect233k1: /* sect233k1 (6) */
 228                 return 6;
 229         case NID_sect233r1: /* sect233r1 (7) */
 230                 return 7;
 231         case NID_sect239k1: /* sect239k1 (8) */
 232                 return 8;
 233         case NID_sect283k1: /* sect283k1 (9) */
 234                 return 9;
 235         case NID_sect283r1: /* sect283r1 (10) */
 236                 return 10;
 237         case NID_sect409k1: /* sect409k1 (11) */
 238                 return 11;
 239         case NID_sect409r1: /* sect409r1 (12) */
 240                 return 12;
 241         case NID_sect571k1: /* sect571k1 (13) */
 242                 return 13;
 243         case NID_sect571r1: /* sect571r1 (14) */
 244                 return 14;
 245         case NID_secp160k1: /* secp160k1 (15) */
 246                 return 15;
 247         case NID_secp160r1: /* secp160r1 (16) */
 248                 return 16;
 249         case NID_secp160r2: /* secp160r2 (17) */
 250                 return 17;
 251         case NID_secp192k1: /* secp192k1 (18) */
 252                 return 18;
 253         case NID_X9_62_prime192v1: /* secp192r1 (19) */
 254                 return 19;
 255         case NID_secp224k1: /* secp224k1 (20) */
 256                 return 20;
 257         case NID_secp224r1: /* secp224r1 (21) */
 258                 return 21;
 259         case NID_secp256k1: /* secp256k1 (22) */
 260                 return 22;
 261         case NID_X9_62_prime256v1: /* secp256r1 (23) */
 262                 return 23;
 263         case NID_secp384r1: /* secp384r1 (24) */
 264                 return 24;
 265         case NID_secp521r1:  /* secp521r1 (25) */
 266                 return 25;
 267         default:
 268                 return 0;
 269                 }
 270         }
 271 #endif /* OPENSSL_NO_EC */
 272
 273 #ifndef OPENSSL_NO_TLSEXT
 274 unsigned char *ssl_add_clienthello_tlsext(SSL *s, unsigned char *p, unsigned char *limit)
 275         {
 276         int extdatalen=0;
 277         unsigned char *ret = p;
 278
 279         /* don't add extensions for SSLv3 unless doing secure renegotiation */
 280         if (s->client_version == SSL3_VERSION
 281                                         && !s->s3->send_connection_binding)
 282                 return p;
 283
 284         ret+=2;
 285
 286         if (ret>=limit) return NULL; /* this really never occurs, but ... */
 287
 288         if (s->tlsext_hostname != NULL)
 289                 {
 290                 /* Add TLS extension servername to the Client Hello message */
 291                 unsigned long size_str;
 292                 long lenmax;
 293
 294                 /* check for enough space.
 295                    4 for the servername type and entension length
 296                    2 for servernamelist length
 297                    1 for the hostname type
 298                    2 for hostname length
 299                    + hostname length
 300                 */
 301
 302                 if ((lenmax = limit - ret - 9) < 0
 303                     || (size_str = strlen(s->tlsext_hostname)) > (unsigned long)lenmax)
 304                         return NULL;
 305
 306                 /* extension type and length */
 307                 s2n(TLSEXT_TYPE_server_name,ret);
 308                 s2n(size_str+5,ret);
 309
 310                 /* length of servername list */
 311                 s2n(size_str+3,ret);
 312
 313                 /* hostname type, length and hostname */
 314                 *(ret++) = (unsigned char) TLSEXT_NAMETYPE_host_name;
 315                 s2n(size_str,ret);
 316                 memcpy(ret, s->tlsext_hostname, size_str);
 317                 ret+=size_str;
 318                 }
 319
 320         /* Add RI if renegotiating */
 321         if (s->renegotiate)
 322           {
 323           int el;
 324
 325           if(!ssl_add_clienthello_renegotiate_ext(s, 0, &el, 0))
 326               {
 327               SSLerr(SSL_F_SSL_ADD_CLIENTHELLO_TLSEXT, ERR_R_INTERNAL_ERROR);
 328               return NULL;
 329               }
 330
 331           if((limit - p - 4 - el) < 0) return NULL;
 332
 333           s2n(TLSEXT_TYPE_renegotiate,ret);
 334           s2n(el,ret);
 335
 336           if(!ssl_add_clienthello_renegotiate_ext(s, ret, &el, el))
 337               {
 338               SSLerr(SSL_F_SSL_ADD_CLIENTHELLO_TLSEXT, ERR_R_INTERNAL_ERROR);
 339               return NULL;
 340               }
 341
 342           ret += el;
 343         }
 344
 345 #ifndef OPENSSL_NO_SRP
 346 #define MIN(x,y) (((x)<(y))?(x):(y))
 347         /* we add SRP username the first time only if we have one! */
 348         if (s->srp_ctx.login != NULL)
 349                 {/* Add TLS extension SRP username to the Client Hello message */
 350                 int login_len = MIN(strlen(s->srp_ctx.login) + 1, 255);
 351                 long lenmax;
 352
 353                 if ((lenmax = limit - ret - 5) < 0) return NULL;
 354                 if (login_len > lenmax) return NULL;
 355                 if (login_len > 255)
 356                         {
 357                         SSLerr(SSL_F_SSL_ADD_CLIENTHELLO_TLSEXT, ERR_R_INTERNAL_ERROR);
 358                         return NULL;
 359                         }
 360                 s2n(TLSEXT_TYPE_srp,ret);
 361                 s2n(login_len+1,ret);
 362
 363                 (*ret++) = (unsigned char) MIN(strlen(s->srp_ctx.login), 254);
 364                 memcpy(ret, s->srp_ctx.login, MIN(strlen(s->srp_ctx.login), 254));
 365                 ret+=login_len;
 366                 }
 367 #endif
 368
 369 #ifndef OPENSSL_NO_EC
 370         if (s->tlsext_ecpointformatlist != NULL &&
 371             s->version != DTLS1_VERSION)
 372                 {
 373                 /* Add TLS extension ECPointFormats to the ClientHello message */
 374                 long lenmax;
 375
 376                 if ((lenmax = limit - ret - 5) < 0) return NULL;
 377                 if (s->tlsext_ecpointformatlist_length > (unsigned long)lenmax) return NULL;
 378                 if (s->tlsext_ecpointformatlist_length > 255)
 379                         {
 380                         SSLerr(SSL_F_SSL_ADD_CLIENTHELLO_TLSEXT, ERR_R_INTERNAL_ERROR);
 381                         return NULL;
 382                         }
 383
 384                 s2n(TLSEXT_TYPE_ec_point_formats,ret);
 385                 s2n(s->tlsext_ecpointformatlist_length + 1,ret);
 386                 *(ret++) = (unsigned char) s->tlsext_ecpointformatlist_length;
 387                 memcpy(ret, s->tlsext_ecpointformatlist, s->tlsext_ecpointformatlist_length);
 388                 ret+=s->tlsext_ecpointformatlist_length;
 389                 }
 390         if (s->tlsext_ellipticcurvelist != NULL &&
 391             s->version != DTLS1_VERSION)
 392                 {
 393                 /* Add TLS extension EllipticCurves to the ClientHello message */
 394                 long lenmax;
 395
 396                 if ((lenmax = limit - ret - 6) < 0) return NULL;
 397                 if (s->tlsext_ellipticcurvelist_length > (unsigned long)lenmax) return NULL;
 398                 if (s->tlsext_ellipticcurvelist_length > 65532)
 399                         {
 400                         SSLerr(SSL_F_SSL_ADD_CLIENTHELLO_TLSEXT, ERR_R_INTERNAL_ERROR);
 401                         return NULL;
 402                         }
 403
 404                 s2n(TLSEXT_TYPE_elliptic_curves,ret);
 405                 s2n(s->tlsext_ellipticcurvelist_length + 2, ret);
 406
 407                 /* NB: draft-ietf-tls-ecc-12.txt uses a one-byte prefix for
 408                  * elliptic_curve_list, but the examples use two bytes.
 409                  * http://www1.ietf.org/mail-archive/web/tls/current/msg00538.html
 410                  * resolves this to two bytes.
 411                  */
 412                 s2n(s->tlsext_ellipticcurvelist_length, ret);
 413                 memcpy(ret, s->tlsext_ellipticcurvelist, s->tlsext_ellipticcurvelist_length);
 414                 ret+=s->tlsext_ellipticcurvelist_length;
 415                 }
 416 #endif /* OPENSSL_NO_EC */
 417
 418         if (!(SSL_get_options(s) & SSL_OP_NO_TICKET))
 419                 {
 420                 int ticklen;
 421                 if (!s->new_session && s->session && s->session->tlsext_tick)
 422                         ticklen = s->session->tlsext_ticklen;
 423                 else if (s->session && s->tlsext_session_ticket &&
 424                          s->tlsext_session_ticket->data)
 425                         {
 426                         ticklen = s->tlsext_session_ticket->length;
 427                         s->session->tlsext_tick = OPENSSL_malloc(ticklen);
 428                         if (!s->session->tlsext_tick)
 429                                 return NULL;
 430                         memcpy(s->session->tlsext_tick,
 431                                s->tlsext_session_ticket->data,
 432                                ticklen);
 433                         s->session->tlsext_ticklen = ticklen;
 434                         }
 435                 else
 436                         ticklen = 0;
 437                 if (ticklen == 0 && s->tlsext_session_ticket &&
 438                     s->tlsext_session_ticket->data == NULL)
 439                         goto skip_ext;
 440                 /* Check for enough room 2 for extension type, 2 for len
 441                  * rest for ticket
 442                  */
 443                 if ((long)(limit - ret - 4 - ticklen) < 0) return NULL;
 444                 s2n(TLSEXT_TYPE_session_ticket,ret);
 445                 s2n(ticklen,ret);
 446                 if (ticklen)
 447                         {
 448                         memcpy(ret, s->session->tlsext_tick, ticklen);
 449                         ret += ticklen;
 450                         }
 451                 }
 452                 skip_ext:
 453
 454         if (s->version >= TLS1_2_VERSION)
 455                 {
 456                 /* List of supported signature algorithms and hashes.
 457                  * Should make this customisable at some point, for
 458                  * now include everything we support.
 459                  */
 460                 static unsigned char sigalgs[] = {
 461 #ifndef OPENSSL_NO_RSA
 462 # ifndef OPENSSL_NO_SHA512
 463                         TLSEXT_hash_sha512, TLSEXT_signature_rsa,
 464                         TLSEXT_hash_sha384, TLSEXT_signature_rsa,
 465 # endif
 466 # ifndef OPENSSL_NO_SHA256
 467                         TLSEXT_hash_sha256, TLSEXT_signature_rsa,
 468                         TLSEXT_hash_sha224, TLSEXT_signature_rsa,
 469 # endif
 470 # ifndef OPENSSL_NO_SHA
 471                         TLSEXT_hash_sha1, TLSEXT_signature_rsa,
 472 # endif
 473 #endif
 474 #ifndef OPENSSL_NO_ECDSA
 475 # ifndef OPENSSL_NO_SHA512
 476                         TLSEXT_hash_sha512, TLSEXT_signature_ecdsa,
 477                         TLSEXT_hash_sha384, TLSEXT_signature_ecdsa,
 478 # endif
 479 # ifndef OPENSSL_NO_SHA256
 480                         TLSEXT_hash_sha256, TLSEXT_signature_ecdsa,
 481                         TLSEXT_hash_sha224, TLSEXT_signature_ecdsa,
 482 # endif
 483 # ifndef OPENSSL_NO_SHA
 484                         TLSEXT_hash_sha1, TLSEXT_signature_ecdsa,
 485 # endif
 486 #endif
 487 #ifndef OPENSSL_NO_DSA
 488 # ifndef OPENSSL_NO_SHA512
 489                         TLSEXT_hash_sha512, TLSEXT_signature_dsa,
 490                         TLSEXT_hash_sha384, TLSEXT_signature_dsa,
 491 # endif
 492 # ifndef OPENSSL_NO_SHA256
 493                         TLSEXT_hash_sha256, TLSEXT_signature_dsa,
 494                         TLSEXT_hash_sha224, TLSEXT_signature_dsa,
 495 # endif
 496 # ifndef OPENSSL_NO_SHA
 497                         TLSEXT_hash_sha1, TLSEXT_signature_dsa
 498 # endif
 499 #endif
 500                 };
 501                 if ((size_t)(limit - ret) < sizeof(sigalgs) + 6)
 502                         return NULL;
 503                 s2n(TLSEXT_TYPE_signature_algorithms,ret);
 504                 s2n(sizeof(sigalgs) + 2, ret);
 505                 s2n(sizeof(sigalgs), ret);
 506                 memcpy(ret, sigalgs, sizeof(sigalgs));
 507                 ret += sizeof(sigalgs);
 508                 }
 509
 510 #ifdef TLSEXT_TYPE_opaque_prf_input
 511         if (s->s3->client_opaque_prf_input != NULL &&
 512             s->version != DTLS1_VERSION)
 513                 {
 514                 size_t col = s->s3->client_opaque_prf_input_len;
 515
 516                 if ((long)(limit - ret - 6 - col < 0))
 517                         return NULL;
 518                 if (col > 0xFFFD) /* can't happen */
 519                         return NULL;
 520
 521                 s2n(TLSEXT_TYPE_opaque_prf_input, ret);
 522                 s2n(col + 2, ret);
 523                 s2n(col, ret);
 524                 memcpy(ret, s->s3->client_opaque_prf_input, col);
 525                 ret += col;
 526                 }
 527 #endif
 528
 529         if (s->tlsext_status_type == TLSEXT_STATUSTYPE_ocsp &&
 530             s->version != DTLS1_VERSION)
 531                 {
 532                 int i;
 533                 long extlen, idlen, itmp;
 534                 OCSP_RESPID *id;
 535
 536                 idlen = 0;
 537                 for (i = 0; i < sk_OCSP_RESPID_num(s->tlsext_ocsp_ids); i++)
 538                         {
 539                         id = sk_OCSP_RESPID_value(s->tlsext_ocsp_ids, i);
 540                         itmp = i2d_OCSP_RESPID(id, NULL);
 541                         if (itmp <= 0)
 542                                 return NULL;
 543                         idlen += itmp + 2;
 544                         }
 545
 546                 if (s->tlsext_ocsp_exts)
 547                         {
 548                         extlen = i2d_X509_EXTENSIONS(s->tlsext_ocsp_exts, NULL);
 549                         if (extlen < 0)
 550                                 return NULL;
 551                         }
 552                 else
 553                         extlen = 0;
 554
 555                 if ((long)(limit - ret - 7 - extlen - idlen) < 0) return NULL;
 556                 s2n(TLSEXT_TYPE_status_request, ret);
 557                 if (extlen + idlen > 0xFFF0)
 558                         return NULL;
 559                 s2n(extlen + idlen + 5, ret);
 560                 *(ret++) = TLSEXT_STATUSTYPE_ocsp;
 561                 s2n(idlen, ret);
 562                 for (i = 0; i < sk_OCSP_RESPID_num(s->tlsext_ocsp_ids); i++)
 563                         {
 564                         /* save position of id len */
 565                         unsigned char *q = ret;
 566                         id = sk_OCSP_RESPID_value(s->tlsext_ocsp_ids, i);
 567                         /* skip over id len */
 568                         ret += 2;
 569                         itmp = i2d_OCSP_RESPID(id, &ret);
 570                         /* write id len */
 571                         s2n(itmp, q);
 572                         }
 573                 s2n(extlen, ret);
 574                 if (extlen > 0)
 575                         i2d_X509_EXTENSIONS(s->tlsext_ocsp_exts, &ret);
 576                 }
 577
 578 #ifndef OPENSSL_NO_NEXTPROTONEG
 579         if (s->ctx->next_proto_select_cb && !s->s3->tmp.finish_md_len)
 580                 {
 581                 /* The client advertises an emtpy extension to indicate its
 582                  * support for Next Protocol Negotiation */
 583                 if (limit - ret - 4 < 0)
 584                         return NULL;
 585                 s2n(TLSEXT_TYPE_next_proto_neg,ret);
 586                 s2n(0,ret);
 587                 }
 588 #endif
 589
 590         if ((extdatalen = ret-p-2)== 0)
 591                 return p;
 592
 593         s2n(extdatalen,p);
 594         return ret;
 595         }
 596
 597 unsigned char *ssl_add_serverhello_tlsext(SSL *s, unsigned char *p, unsigned char *limit)
 598         {
 599         int extdatalen=0;
 600         unsigned char *ret = p;
 601 #ifndef OPENSSL_NO_NEXTPROTONEG
 602         int next_proto_neg_seen;
 603 #endif
 604
 605         /* don't add extensions for SSLv3, unless doing secure renegotiation */
 606         if (s->version == SSL3_VERSION && !s->s3->send_connection_binding)
 607                 return p;
 608
 609         ret+=2;
 610         if (ret>=limit) return NULL; /* this really never occurs, but ... */
 611
 612         if (!s->hit && s->servername_done == 1 && s->session->tlsext_hostname != NULL)
 613                 {
 614                 if ((long)(limit - ret - 4) < 0) return NULL;
 615
 616                 s2n(TLSEXT_TYPE_server_name,ret);
 617                 s2n(0,ret);
 618                 }
 619
 620         if(s->s3->send_connection_binding)
 621         {
 622           int el;
 623
 624           if(!ssl_add_serverhello_renegotiate_ext(s, 0, &el, 0))
 625               {
 626               SSLerr(SSL_F_SSL_ADD_SERVERHELLO_TLSEXT, ERR_R_INTERNAL_ERROR);
 627               return NULL;
 628               }
 629
 630           if((limit - p - 4 - el) < 0) return NULL;
 631
 632           s2n(TLSEXT_TYPE_renegotiate,ret);
 633           s2n(el,ret);
 634
 635           if(!ssl_add_serverhello_renegotiate_ext(s, ret, &el, el))
 636               {
 637               SSLerr(SSL_F_SSL_ADD_SERVERHELLO_TLSEXT, ERR_R_INTERNAL_ERROR);
 638               return NULL;
 639               }
 640
 641           ret += el;
 642         }
 643
 644 #ifndef OPENSSL_NO_EC
 645         if (s->tlsext_ecpointformatlist != NULL &&
 646             s->version != DTLS1_VERSION)
 647                 {
 648                 /* Add TLS extension ECPointFormats to the ServerHello message */
 649                 long lenmax;
 650
 651                 if ((lenmax = limit - ret - 5) < 0) return NULL;
 652                 if (s->tlsext_ecpointformatlist_length > (unsigned long)lenmax) return NULL;
 653                 if (s->tlsext_ecpointformatlist_length > 255)
 654                         {
 655                         SSLerr(SSL_F_SSL_ADD_SERVERHELLO_TLSEXT, ERR_R_INTERNAL_ERROR);
 656                         return NULL;
 657                         }
 658
 659                 s2n(TLSEXT_TYPE_ec_point_formats,ret);
 660                 s2n(s->tlsext_ecpointformatlist_length + 1,ret);
 661                 *(ret++) = (unsigned char) s->tlsext_ecpointformatlist_length;
 662                 memcpy(ret, s->tlsext_ecpointformatlist, s->tlsext_ecpointformatlist_length);
 663                 ret+=s->tlsext_ecpointformatlist_length;
 664
 665                 }
 666         /* Currently the server should not respond with a SupportedCurves extension */
 667 #endif /* OPENSSL_NO_EC */
 668
 669         if (s->tlsext_ticket_expected
 670                 && !(SSL_get_options(s) & SSL_OP_NO_TICKET))
 671                 {
 672                 if ((long)(limit - ret - 4) < 0) return NULL;
 673                 s2n(TLSEXT_TYPE_session_ticket,ret);
 674                 s2n(0,ret);
 675                 }
 676
 677         if (s->tlsext_status_expected)
 678                 {
 679                 if ((long)(limit - ret - 4) < 0) return NULL;
 680                 s2n(TLSEXT_TYPE_status_request,ret);
 681                 s2n(0,ret);
 682                 }
 683
 684 #ifdef TLSEXT_TYPE_opaque_prf_input
 685         if (s->s3->server_opaque_prf_input != NULL &&
 686             s->version != DTLS1_VERSION)
 687                 {
 688                 size_t sol = s->s3->server_opaque_prf_input_len;
 689
 690                 if ((long)(limit - ret - 6 - sol) < 0)
 691                         return NULL;
 692                 if (sol > 0xFFFD) /* can't happen */
 693                         return NULL;
 694
 695                 s2n(TLSEXT_TYPE_opaque_prf_input, ret);
 696                 s2n(sol + 2, ret);
 697                 s2n(sol, ret);
 698                 memcpy(ret, s->s3->server_opaque_prf_input, sol);
 699                 ret += sol;
 700                 }
 701 #endif
 702         if (((s->s3->tmp.new_cipher->id & 0xFFFF)==0x80 || (s->s3->tmp.new_cipher->id & 0xFFFF)==0x81)
 703                 && (SSL_get_options(s) & SSL_OP_CRYPTOPRO_TLSEXT_BUG))
 704                 { const unsigned char cryptopro_ext[36] = {
 705                         0xfd, 0xe8, /*65000*/
 706                         0x00, 0x20, /*32 bytes length*/
 707                         0x30, 0x1e, 0x30, 0x08, 0x06, 0x06, 0x2a, 0x85,
 708                         0x03,   0x02, 0x02, 0x09, 0x30, 0x08, 0x06, 0x06,
 709                         0x2a, 0x85, 0x03, 0x02, 0x02, 0x16, 0x30, 0x08,
 710                         0x06, 0x06, 0x2a, 0x85, 0x03, 0x02, 0x02, 0x17};
 711                         if (limit-ret<36) return NULL;
 712                         memcpy(ret,cryptopro_ext,36);
 713                         ret+=36;
 714
 715                 }
 716
 717 #ifndef OPENSSL_NO_NEXTPROTONEG
 718         next_proto_neg_seen = s->s3->next_proto_neg_seen;
 719         s->s3->next_proto_neg_seen = 0;
 720         if (next_proto_neg_seen && s->ctx->next_protos_advertised_cb)
 721                 {
 722                 const unsigned char *npa;
 723                 unsigned int npalen;
 724                 int r;
 725
 726                 r = s->ctx->next_protos_advertised_cb(s, &npa, &npalen, s->ctx->next_protos_advertised_cb_arg);
 727                 if (r == SSL_TLSEXT_ERR_OK)
 728                         {
 729                         if ((long)(limit - ret - 4 - npalen) < 0) return NULL;
 730                         s2n(TLSEXT_TYPE_next_proto_neg,ret);
 731                         s2n(npalen,ret);
 732                         memcpy(ret, npa, npalen);
 733                         ret += npalen;
 734                         s->s3->next_proto_neg_seen = 1;
 735                         }
 736                 }
 737 #endif
 738
 739         if ((extdatalen = ret-p-2)== 0)
 740                 return p;
 741
 742         s2n(extdatalen,p);
 743         return ret;
 744         }
 745
 746 int ssl_parse_clienthello_tlsext(SSL *s, unsigned char **p, unsigned char *d, int n, int *al)
 747         {
 748         unsigned short type;
 749         unsigned short size;
 750         unsigned short len;
 751         unsigned char *data = *p;
 752         int renegotiate_seen = 0;
 753         int sigalg_seen = 0;
 754
 755         s->servername_done = 0;
 756         s->tlsext_status_type = -1;
 757
 758         if (data >= (d+n-2))
 759                 goto ri_check;
 760         n2s(data,len);
 761
 762         if (data > (d+n-len))
 763                 goto ri_check;
 764
 765         while (data <= (d+n-4))
 766                 {
 767                 n2s(data,type);
 768                 n2s(data,size);
 769
 770                 if (data+size > (d+n))
 771                         goto ri_check;
 772 #if 0
 773                 fprintf(stderr,"Received extension type %d size %d\n",type,size);
 774 #endif
 775                 if (s->tlsext_debug_cb)
 776                         s->tlsext_debug_cb(s, 0, type, data, size,
 777                                                 s->tlsext_debug_arg);
 778 /* The servername extension is treated as follows:
 779
 780    - Only the hostname type is supported with a maximum length of 255.
 781    - The servername is rejected if too long or if it contains zeros,
 782      in which case an fatal alert is generated.
 783    - The servername field is maintained together with the session cache.
 784    - When a session is resumed, the servername call back invoked in order
 785      to allow the application to position itself to the right context.
 786    - The servername is acknowledged if it is new for a session or when
 787      it is identical to a previously used for the same session.
 788      Applications can control the behaviour.  They can at any time
 789      set a 'desirable' servername for a new SSL object. This can be the
 790      case for example with HTTPS when a Host: header field is received and
 791      a renegotiation is requested. In this case, a possible servername
 792      presented in the new client hello is only acknowledged if it matches
 793      the value of the Host: field.
 794    - Applications must  use SSL_OP_NO_SESSION_RESUMPTION_ON_RENEGOTIATION
 795      if they provide for changing an explicit servername context for the session,
 796      i.e. when the session has been established with a servername extension.
 797    - On session reconnect, the servername extension may be absent.
 798
 799 */
 800
 801                 if (type == TLSEXT_TYPE_server_name)
 802                         {
 803                         unsigned char *sdata;
 804                         int servname_type;
 805                         int dsize;
 806
 807                         if (size < 2)
 808                                 {
 809                                 *al = SSL_AD_DECODE_ERROR;
 810                                 return 0;
 811                                 }
 812                         n2s(data,dsize);
 813                         size -= 2;
 814                         if (dsize > size  )
 815                                 {
 816                                 *al = SSL_AD_DECODE_ERROR;
 817                                 return 0;
 818                                 }
 819
 820                         sdata = data;
 821                         while (dsize > 3)
 822                                 {
 823                                 servname_type = *(sdata++);
 824                                 n2s(sdata,len);
 825                                 dsize -= 3;
 826
 827                                 if (len > dsize)
 828                                         {
 829                                         *al = SSL_AD_DECODE_ERROR;
 830                                         return 0;
 831                                         }
 832                                 if (s->servername_done == 0)
 833                                 switch (servname_type)
 834                                         {
 835                                 case TLSEXT_NAMETYPE_host_name:
 836                                         if (!s->hit)
 837                                                 {
 838                                                 if(s->session->tlsext_hostname)
 839                                                         {
 840                                                         *al = SSL_AD_DECODE_ERROR;
 841                                                         return 0;
 842                                                         }
 843                                                 if (len > TLSEXT_MAXLEN_host_name)
 844                                                         {
 845                                                         *al = TLS1_AD_UNRECOGNIZED_NAME;
 846                                                         return 0;
 847                                                         }
 848                                                 if ((s->session->tlsext_hostname = OPENSSL_malloc(len+1)) == NULL)
 849                                                         {
 850                                                         *al = TLS1_AD_INTERNAL_ERROR;
 851                                                         return 0;
 852                                                         }
 853                                                 memcpy(s->session->tlsext_hostname, sdata, len);
 854                                                 s->session->tlsext_hostname[len]='\0';
 855                                                 if (strlen(s->session->tlsext_hostname) != len) {
 856                                                         OPENSSL_free(s->session->tlsext_hostname);
 857                                                         s->session->tlsext_hostname = NULL;
 858                                                         *al = TLS1_AD_UNRECOGNIZED_NAME;
 859                                                         return 0;
 860                                                 }
 861                                                 s->servername_done = 1;
 862
 863                                                 }
 864                                         else
 865                                                 s->servername_done = s->session->tlsext_hostname
 866                                                         && strlen(s->session->tlsext_hostname) == len
 867                                                         && strncmp(s->session->tlsext_hostname, (char *)sdata, len) == 0;
 868
 869                                         break;
 870
 871                                 default:
 872                                         break;
 873                                         }
 874
 875                                 dsize -= len;
 876                                 }
 877                         if (dsize != 0)
 878                                 {
 879                                 *al = SSL_AD_DECODE_ERROR;
 880                                 return 0;
 881                                 }
 882
 883                         }
 884 #ifndef OPENSSL_NO_SRP
 885                 else if (type == TLSEXT_TYPE_srp)
 886                         {
 887                         if (size > 0)
 888                                 {
 889                                 len = data[0];
 890                                 if ((s->srp_ctx.login = OPENSSL_malloc(len+1)) == NULL)
 891                                         return -1;
 892                                 memcpy(s->srp_ctx.login, &data[1], len);
 893                                 s->srp_ctx.login[len]='\0';
 894                                 }
 895                         }
 896 #endif
 897
 898 #ifndef OPENSSL_NO_EC
 899                 else if (type == TLSEXT_TYPE_ec_point_formats &&
 900                      s->version != DTLS1_VERSION)
 901                         {
 902                         unsigned char *sdata = data;
 903                         int ecpointformatlist_length = *(sdata++);
 904
 905                         if (ecpointformatlist_length != size - 1)
 906                                 {
 907                                 *al = TLS1_AD_DECODE_ERROR;
 908                                 return 0;
 909                                 }
 910                         if (!s->hit)
 911                                 {
 912                                 if(s->session->tlsext_ecpointformatlist)
 913                                         {
 914                                         OPENSSL_free(s->session->tlsext_ecpointformatlist);
 915                                         s->session->tlsext_ecpointformatlist = NULL;
 916                                         }
 917                                 s->session->tlsext_ecpointformatlist_length = 0;
 918                                 if ((s->session->tlsext_ecpointformatlist = OPENSSL_malloc(ecpointformatlist_length)) == NULL)
 919                                         {
 920                                         *al = TLS1_AD_INTERNAL_ERROR;
 921                                         return 0;
 922                                         }
 923                                 s->session->tlsext_ecpointformatlist_length = ecpointformatlist_length;
 924                                 memcpy(s->session->tlsext_ecpointformatlist, sdata, ecpointformatlist_length);
 925                                 }
 926 #if 0
 927                         fprintf(stderr,"ssl_parse_clienthello_tlsext s->session->tlsext_ecpointformatlist (length=%i) ", s->session->tlsext_ecpointformatlist_length);
 928                         sdata = s->session->tlsext_ecpointformatlist;
 929                         for (i = 0; i < s->session->tlsext_ecpointformatlist_length; i++)
 930                                 fprintf(stderr,"%i ",*(sdata++));
 931                         fprintf(stderr,"\n");
 932 #endif
 933                         }
 934                 else if (type == TLSEXT_TYPE_elliptic_curves &&
 935                      s->version != DTLS1_VERSION)
 936                         {
 937                         unsigned char *sdata = data;
 938                         int ellipticcurvelist_length = (*(sdata++) << 8);
 939                         ellipticcurvelist_length += (*(sdata++));
 940
 941                         if (ellipticcurvelist_length != size - 2)
 942                                 {
 943                                 *al = TLS1_AD_DECODE_ERROR;
 944                                 return 0;
 945                                 }
 946                         if (!s->hit)
 947                                 {
 948                                 if(s->session->tlsext_ellipticcurvelist)
 949                                         {
 950                                         *al = TLS1_AD_DECODE_ERROR;
 951                                         return 0;
 952                                         }
 953                                 s->session->tlsext_ellipticcurvelist_length = 0;
 954                                 if ((s->session->tlsext_ellipticcurvelist = OPENSSL_malloc(ellipticcurvelist_length)) == NULL)
 955                                         {
 956                                         *al = TLS1_AD_INTERNAL_ERROR;
 957                                         return 0;
 958                                         }
 959                                 s->session->tlsext_ellipticcurvelist_length = ellipticcurvelist_length;
 960                                 memcpy(s->session->tlsext_ellipticcurvelist, sdata, ellipticcurvelist_length);
 961                                 }
 962 #if 0
 963                         fprintf(stderr,"ssl_parse_clienthello_tlsext s->session->tlsext_ellipticcurvelist (length=%i) ", s->session->tlsext_ellipticcurvelist_length);
 964                         sdata = s->session->tlsext_ellipticcurvelist;
 965                         for (i = 0; i < s->session->tlsext_ellipticcurvelist_length; i++)
 966                                 fprintf(stderr,"%i ",*(sdata++));
 967                         fprintf(stderr,"\n");
 968 #endif
 969                         }
 970 #endif /* OPENSSL_NO_EC */
 971 #ifdef TLSEXT_TYPE_opaque_prf_input
 972                 else if (type == TLSEXT_TYPE_opaque_prf_input &&
 973                      s->version != DTLS1_VERSION)
 974                         {
 975                         unsigned char *sdata = data;
 976
 977                         if (size < 2)
 978                                 {
 979                                 *al = SSL_AD_DECODE_ERROR;
 980                                 return 0;
 981                                 }
 982                         n2s(sdata, s->s3->client_opaque_prf_input_len);
 983                         if (s->s3->client_opaque_prf_input_len != size - 2)
 984                                 {
 985                                 *al = SSL_AD_DECODE_ERROR;
 986                                 return 0;
 987                                 }
 988
 989                         if (s->s3->client_opaque_prf_input != NULL) /* shouldn't really happen */
 990                                 OPENSSL_free(s->s3->client_opaque_prf_input);
 991                         if (s->s3->client_opaque_prf_input_len == 0)
 992                                 s->s3->client_opaque_prf_input = OPENSSL_malloc(1); /* dummy byte just to get non-NULL */
 993                         else
 994                                 s->s3->client_opaque_prf_input = BUF_memdup(sdata, s->s3->client_opaque_prf_input_len);
 995                         if (s->s3->client_opaque_prf_input == NULL)
 996                                 {
 997                                 *al = TLS1_AD_INTERNAL_ERROR;
 998                                 return 0;
 999                                 }
1000                         }
1001 #endif
1002                 else if (type == TLSEXT_TYPE_session_ticket)
1003                         {
1004                         if (s->tls_session_ticket_ext_cb &&
1005                             !s->tls_session_ticket_ext_cb(s, data, size, s->tls_session_ticket_ext_cb_arg))
1006                                 {
1007                                 *al = TLS1_AD_INTERNAL_ERROR;
1008                                 return 0;
1009                                 }
1010                         }
1011                 else if (type == TLSEXT_TYPE_renegotiate)
1012                         {
1013                         if(!ssl_parse_clienthello_renegotiate_ext(s, data, size, al))
1014                                 return 0;
1015                         renegotiate_seen = 1;
1016                         }
1017                 else if (type == TLSEXT_TYPE_signature_algorithms)
1018                         {
1019                         int dsize;
1020                         if (sigalg_seen || size < 2)
1021                                 {
1022                                 *al = SSL_AD_DECODE_ERROR;
1023                                 return 0;
1024                                 }
1025                         sigalg_seen = 1;
1026                         n2s(data,dsize);
1027                         size -= 2;
1028                         if (dsize != size || dsize & 1)
1029                                 {
1030                                 *al = SSL_AD_DECODE_ERROR;
1031                                 return 0;
1032                                 }
1033                         if (!tls1_process_sigalgs(s, data, dsize))
1034                                 {
1035                                 *al = SSL_AD_DECODE_ERROR;
1036                                 return 0;
1037                                 }
1038                         }
1039                 else if (type == TLSEXT_TYPE_status_request &&
1040                          s->version != DTLS1_VERSION && s->ctx->tlsext_status_cb)
1041                         {
1042
1043                         if (size < 5)
1044                                 {
1045                                 *al = SSL_AD_DECODE_ERROR;
1046                                 return 0;
1047                                 }
1048
1049                         s->tlsext_status_type = *data++;
1050                         size--;
1051                         if (s->tlsext_status_type == TLSEXT_STATUSTYPE_ocsp)
1052                                 {
1053                                 const unsigned char *sdata;
1054                                 int dsize;
1055                                 /* Read in responder_id_list */
1056                                 n2s(data,dsize);
1057                                 size -= 2;
1058                                 if (dsize > size  )
1059                                         {
1060                                         *al = SSL_AD_DECODE_ERROR;
1061                                         return 0;
1062                                         }
1063                                 while (dsize > 0)
1064                                         {
1065                                         OCSP_RESPID *id;
1066                                         int idsize;
1067                                         if (dsize < 4)
1068                                                 {
1069                                                 *al = SSL_AD_DECODE_ERROR;
1070                                                 return 0;
1071                                                 }
1072                                         n2s(data, idsize);
1073                                         dsize -= 2 + idsize;
1074                                         size -= 2 + idsize;
1075                                         if (dsize < 0)
1076                                                 {
1077                                                 *al = SSL_AD_DECODE_ERROR;
1078                                                 return 0;
1079                                                 }
1080                                         sdata = data;
1081                                         data += idsize;
1082                                         id = d2i_OCSP_RESPID(NULL,
1083                                                                 &sdata, idsize);
1084                                         if (!id)
1085                                                 {
1086                                                 *al = SSL_AD_DECODE_ERROR;
1087                                                 return 0;
1088                                                 }
1089                                         if (data != sdata)
1090                                                 {
1091                                                 OCSP_RESPID_free(id);
1092                                                 *al = SSL_AD_DECODE_ERROR;
1093                                                 return 0;
1094                                                 }
1095                                         if (!s->tlsext_ocsp_ids
1096                                                 && !(s->tlsext_ocsp_ids =
1097                                                 sk_OCSP_RESPID_new_null()))
1098                                                 {
1099                                                 OCSP_RESPID_free(id);
1100                                                 *al = SSL_AD_INTERNAL_ERROR;
1101                                                 return 0;
1102                                                 }
1103                                         if (!sk_OCSP_RESPID_push(
1104                                                         s->tlsext_ocsp_ids, id))
1105                                                 {
1106                                                 OCSP_RESPID_free(id);
1107                                                 *al = SSL_AD_INTERNAL_ERROR;
1108                                                 return 0;
1109                                                 }
1110                                         }
1111
1112                                 /* Read in request_extensions */
1113                                 if (size < 2)
1114                                         {
1115                                         *al = SSL_AD_DECODE_ERROR;
1116                                         return 0;
1117                                         }
1118                                 n2s(data,dsize);
1119                                 size -= 2;
1120                                 if (dsize != size)
1121                                         {
1122                                         *al = SSL_AD_DECODE_ERROR;
1123                                         return 0;
1124                                         }
1125                                 sdata = data;
1126                                 if (dsize > 0)
1127                                         {
1128                                         s->tlsext_ocsp_exts =
1129                                                 d2i_X509_EXTENSIONS(NULL,
1130                                                         &sdata, dsize);
1131                                         if (!s->tlsext_ocsp_exts
1132                                                 || (data + dsize != sdata))
1133                                                 {
1134                                                 *al = SSL_AD_DECODE_ERROR;
1135                                                 return 0;
1136                                                 }
1137                                         }
1138                                 }
1139                                 /* We don't know what to do with any other type
1140                                 * so ignore it.
1141                                 */
1142                                 else
1143                                         s->tlsext_status_type = -1;
1144                         }
1145 #ifndef OPENSSL_NO_NEXTPROTONEG
1146                 else if (type == TLSEXT_TYPE_next_proto_neg &&
1147                          s->s3->tmp.finish_md_len == 0)
1148                         {
1149                         /* We shouldn't accept this extension on a
1150                          * renegotiation.
1151                          *
1152                          * s->new_session will be set on renegotiation, but we
1153                          * probably shouldn't rely that it couldn't be set on
1154                          * the initial renegotation too in certain cases (when
1155                          * there's some other reason to disallow resuming an
1156                          * earlier session -- the current code won't be doing
1157                          * anything like that, but this might change).
1158
1159                          * A valid sign that there's been a previous handshake
1160                          * in this connection is if s->s3->tmp.finish_md_len >
1161                          * 0.  (We are talking about a check that will happen
1162                          * in the Hello protocol round, well before a new
1163                          * Finished message could have been computed.) */
1164                         s->s3->next_proto_neg_seen = 1;
1165                         }
1166 #endif
1167
1168                 /* session ticket processed earlier */
1169                 data+=size;
1170                 }
1171
1172         *p = data;
1173
1174         ri_check:
1175
1176         /* Need RI if renegotiating */
1177
1178         if (!renegotiate_seen && s->renegotiate &&
1179                 !(s->options & SSL_OP_ALLOW_UNSAFE_LEGACY_RENEGOTIATION))
1180                 {
1181                 *al = SSL_AD_HANDSHAKE_FAILURE;
1182                 SSLerr(SSL_F_SSL_PARSE_CLIENTHELLO_TLSEXT,
1183                                 SSL_R_UNSAFE_LEGACY_RENEGOTIATION_DISABLED);
1184                 return 0;
1185                 }
1186
1187         return 1;
1188         }
1189
1190 #ifndef OPENSSL_NO_NEXTPROTONEG
1191 /* ssl_next_proto_validate validates a Next Protocol Negotiation block. No
1192  * elements of zero length are allowed and the set of elements must exactly fill
1193  * the length of the block. */
1194 static int ssl_next_proto_validate(unsigned char *d, unsigned len)
1195         {
1196         unsigned int off = 0;
1197
1198         while (off < len)
1199                 {
1200                 if (d[off] == 0)
1201                         return 0;
1202                 off += d[off];
1203                 off++;
1204                 }
1205
1206         return off == len;
1207         }
1208 #endif
1209
1210 int ssl_parse_serverhello_tlsext(SSL *s, unsigned char **p, unsigned char *d, int n, int *al)
1211         {
1212         unsigned short length;
1213         unsigned short type;
1214         unsigned short size;
1215         unsigned char *data = *p;
1216         int tlsext_servername = 0;
1217         int renegotiate_seen = 0;
1218
1219         if (data >= (d+n-2))
1220                 goto ri_check;
1221
1222         n2s(data,length);
1223         if (data+length != d+n)
1224                 {
1225                 *al = SSL_AD_DECODE_ERROR;
1226                 return 0;
1227                 }
1228
1229         while(data <= (d+n-4))
1230                 {
1231                 n2s(data,type);
1232                 n2s(data,size);
1233
1234                 if (data+size > (d+n))
1235                         goto ri_check;
1236
1237                 if (s->tlsext_debug_cb)
1238                         s->tlsext_debug_cb(s, 1, type, data, size,
1239                                                 s->tlsext_debug_arg);
1240
1241                 if (type == TLSEXT_TYPE_server_name)
1242                         {
1243                         if (s->tlsext_hostname == NULL || size > 0)
1244                                 {
1245                                 *al = TLS1_AD_UNRECOGNIZED_NAME;
1246                                 return 0;
1247                                 }
1248                         tlsext_servername = 1;
1249                         }
1250
1251 #ifndef OPENSSL_NO_EC
1252                 else if (type == TLSEXT_TYPE_ec_point_formats &&
1253                      s->version != DTLS1_VERSION)
1254                         {
1255                         unsigned char *sdata = data;
1256                         int ecpointformatlist_length = *(sdata++);
1257
1258                         if (ecpointformatlist_length != size - 1)
1259                                 {
1260                                 *al = TLS1_AD_DECODE_ERROR;
1261                                 return 0;
1262                                 }
1263                         s->session->tlsext_ecpointformatlist_length = 0;
1264                         if (s->session->tlsext_ecpointformatlist != NULL) OPENSSL_free(s->session->tlsext_ecpointformatlist);
1265                         if ((s->session->tlsext_ecpointformatlist = OPENSSL_malloc(ecpointformatlist_length)) == NULL)
1266                                 {
1267                                 *al = TLS1_AD_INTERNAL_ERROR;
1268                                 return 0;
1269                                 }
1270                         s->session->tlsext_ecpointformatlist_length = ecpointformatlist_length;
1271                         memcpy(s->session->tlsext_ecpointformatlist, sdata, ecpointformatlist_length);
1272 #if 0
1273                         fprintf(stderr,"ssl_parse_serverhello_tlsext s->session->tlsext_ecpointformatlist ");
1274                         sdata = s->session->tlsext_ecpointformatlist;
1275                         for (i = 0; i < s->session->tlsext_ecpointformatlist_length; i++)
1276                                 fprintf(stderr,"%i ",*(sdata++));
1277                         fprintf(stderr,"\n");
1278 #endif
1279                         }
1280 #endif /* OPENSSL_NO_EC */
1281
1282                 else if (type == TLSEXT_TYPE_session_ticket)
1283                         {
1284                         if (s->tls_session_ticket_ext_cb &&
1285                             !s->tls_session_ticket_ext_cb(s, data, size, s->tls_session_ticket_ext_cb_arg))
1286                                 {
1287                                 *al = TLS1_AD_INTERNAL_ERROR;
1288                                 return 0;
1289                                 }
1290                         if ((SSL_get_options(s) & SSL_OP_NO_TICKET)
1291                                 || (size > 0))
1292                                 {
1293                                 *al = TLS1_AD_UNSUPPORTED_EXTENSION;
1294                                 return 0;
1295                                 }
1296                         s->tlsext_ticket_expected = 1;
1297                         }
1298 #ifdef TLSEXT_TYPE_opaque_prf_input
1299                 else if (type == TLSEXT_TYPE_opaque_prf_input &&
1300                      s->version != DTLS1_VERSION)
1301                         {
1302                         unsigned char *sdata = data;
1303
1304                         if (size < 2)
1305                                 {
1306                                 *al = SSL_AD_DECODE_ERROR;
1307                                 return 0;
1308                                 }
1309                         n2s(sdata, s->s3->server_opaque_prf_input_len);
1310                         if (s->s3->server_opaque_prf_input_len != size - 2)
1311                                 {
1312                                 *al = SSL_AD_DECODE_ERROR;
1313                                 return 0;
1314                                 }
1315
1316                         if (s->s3->server_opaque_prf_input != NULL) /* shouldn't really happen */
1317                                 OPENSSL_free(s->s3->server_opaque_prf_input);
1318                         if (s->s3->server_opaque_prf_input_len == 0)
1319                                 s->s3->server_opaque_prf_input = OPENSSL_malloc(1); /* dummy byte just to get non-NULL */
1320                         else
1321                                 s->s3->server_opaque_prf_input = BUF_memdup(sdata, s->s3->server_opaque_prf_input_len);
1322
1323                         if (s->s3->server_opaque_prf_input == NULL)
1324                                 {
1325                                 *al = TLS1_AD_INTERNAL_ERROR;
1326                                 return 0;
1327                                 }
1328                         }
1329 #endif
1330                 else if (type == TLSEXT_TYPE_status_request &&
1331                          s->version != DTLS1_VERSION)
1332                         {
1333                         /* MUST be empty and only sent if we've requested
1334                          * a status request message.
1335                          */
1336                         if ((s->tlsext_status_type == -1) || (size > 0))
1337                                 {
1338                                 *al = TLS1_AD_UNSUPPORTED_EXTENSION;
1339                                 return 0;
1340                                 }
1341                         /* Set flag to expect CertificateStatus message */
1342                         s->tlsext_status_expected = 1;
1343                         }
1344 #ifndef OPENSSL_NO_NEXTPROTONEG
1345                 else if (type == TLSEXT_TYPE_next_proto_neg)
1346                         {
1347                         unsigned char *selected;
1348                         unsigned char selected_len;
1349
1350                         /* We must have requested it. */
1351                         if ((s->ctx->next_proto_select_cb == NULL))
1352                                 {
1353                                 *al = TLS1_AD_UNSUPPORTED_EXTENSION;
1354                                 return 0;
1355                                 }
1356                         /* The data must be valid */
1357                         if (!ssl_next_proto_validate(data, size))
1358                                 {
1359                                 *al = TLS1_AD_DECODE_ERROR;
1360                                 return 0;
1361                                 }
1362                         if (s->ctx->next_proto_select_cb(s, &selected, &selected_len, data, size, s->ctx->next_proto_select_cb_arg) != SSL_TLSEXT_ERR_OK)
1363                                 {
1364                                 *al = TLS1_AD_INTERNAL_ERROR;
1365                                 return 0;
1366                                 }
1367                         s->next_proto_negotiated = OPENSSL_malloc(selected_len);
1368                         if (!s->next_proto_negotiated)
1369                                 {
1370                                 *al = TLS1_AD_INTERNAL_ERROR;
1371                                 return 0;
1372                                 }
1373                         memcpy(s->next_proto_negotiated, selected, selected_len);
1374                         s->next_proto_negotiated_len = selected_len;
1375                         }
1376 #endif
1377                 else if (type == TLSEXT_TYPE_renegotiate)
1378                         {
1379                         if(!ssl_parse_serverhello_renegotiate_ext(s, data, size, al))
1380                                 return 0;
1381                         renegotiate_seen = 1;
1382                         }
1383                 data+=size;
1384                 }
1385
1386         if (data != d+n)
1387                 {
1388                 *al = SSL_AD_DECODE_ERROR;
1389                 return 0;
1390                 }
1391
1392         if (!s->hit && tlsext_servername == 1)
1393                 {
1394                 if (s->tlsext_hostname)
1395                         {
1396                         if (s->session->tlsext_hostname == NULL)
1397                                 {
1398                                 s->session->tlsext_hostname = BUF_strdup(s->tlsext_hostname);
1399                                 if (!s->session->tlsext_hostname)
1400                                         {
1401                                         *al = SSL_AD_UNRECOGNIZED_NAME;
1402                                         return 0;
1403                                         }
1404                                 }
1405                         else
1406                                 {
1407                                 *al = SSL_AD_DECODE_ERROR;
1408                                 return 0;
1409                                 }
1410                         }
1411                 }
1412
1413         *p = data;
1414
1415         ri_check:
1416
1417         /* Determine if we need to see RI. Strictly speaking if we want to
1418          * avoid an attack we should *always* see RI even on initial server
1419          * hello because the client doesn't see any renegotiation during an
1420          * attack. However this would mean we could not connect to any server
1421          * which doesn't support RI so for the immediate future tolerate RI
1422          * absence on initial connect only.
1423          */
1424         if (!renegotiate_seen
1425                 && !(s->options & SSL_OP_LEGACY_SERVER_CONNECT)
1426                 && !(s->options & SSL_OP_ALLOW_UNSAFE_LEGACY_RENEGOTIATION))
1427                 {
1428                 *al = SSL_AD_HANDSHAKE_FAILURE;
1429                 SSLerr(SSL_F_SSL_PARSE_SERVERHELLO_TLSEXT,
1430                                 SSL_R_UNSAFE_LEGACY_RENEGOTIATION_DISABLED);
1431                 return 0;
1432                 }
1433
1434         return 1;
1435         }
1436
1437
1438 int ssl_prepare_clienthello_tlsext(SSL *s)
1439         {
1440 #ifndef OPENSSL_NO_EC
1441         /* If we are client and using an elliptic curve cryptography cipher suite, send the point formats
1442          * and elliptic curves we support.
1443          */
1444         int using_ecc = 0;
1445         int i;
1446         unsigned char *j;
1447         unsigned long alg_k, alg_a;
1448         STACK_OF(SSL_CIPHER) *cipher_stack = SSL_get_ciphers(s);
1449
1450         for (i = 0; i < sk_SSL_CIPHER_num(cipher_stack); i++)
1451                 {
1452                 SSL_CIPHER *c = sk_SSL_CIPHER_value(cipher_stack, i);
1453
1454                 alg_k = c->algorithm_mkey;
1455                 alg_a = c->algorithm_auth;
1456                 if ((alg_k & (SSL_kEECDH|SSL_kECDHr|SSL_kECDHe) || (alg_a & SSL_aECDSA)))
1457                         {
1458                         using_ecc = 1;
1459                         break;
1460                         }
1461                 }
1462         using_ecc = using_ecc && (s->version >= TLS1_VERSION);
1463         if (using_ecc)
1464                 {
1465                 if (s->tlsext_ecpointformatlist != NULL) OPENSSL_free(s->tlsext_ecpointformatlist);
1466                 if ((s->tlsext_ecpointformatlist = OPENSSL_malloc(3)) == NULL)
1467                         {
1468                         SSLerr(SSL_F_SSL_PREPARE_CLIENTHELLO_TLSEXT,ERR_R_MALLOC_FAILURE);
1469                         return -1;
1470                         }
1471                 s->tlsext_ecpointformatlist_length = 3;
1472                 s->tlsext_ecpointformatlist[0] = TLSEXT_ECPOINTFORMAT_uncompressed;
1473                 s->tlsext_ecpointformatlist[1] = TLSEXT_ECPOINTFORMAT_ansiX962_compressed_prime;
1474                 s->tlsext_ecpointformatlist[2] = TLSEXT_ECPOINTFORMAT_ansiX962_compressed_char2;
1475
1476                 /* we support all named elliptic curves in draft-ietf-tls-ecc-12 */
1477                 if (s->tlsext_ellipticcurvelist != NULL) OPENSSL_free(s->tlsext_ellipticcurvelist);
1478                 s->tlsext_ellipticcurvelist_length = sizeof(nid_list)/sizeof(nid_list[0]) * 2;
1479                 if ((s->tlsext_ellipticcurvelist = OPENSSL_malloc(s->tlsext_ellipticcurvelist_length)) == NULL)
1480                         {
1481                         s->tlsext_ellipticcurvelist_length = 0;
1482                         SSLerr(SSL_F_SSL_PREPARE_CLIENTHELLO_TLSEXT,ERR_R_MALLOC_FAILURE);
1483                         return -1;
1484                         }
1485                 for (i = 1, j = s->tlsext_ellipticcurvelist; (unsigned int)i <=
1486                                 sizeof(nid_list)/sizeof(nid_list[0]); i++)
1487                         s2n(i,j);
1488                 }
1489 #endif /* OPENSSL_NO_EC */
1490
1491 #ifdef TLSEXT_TYPE_opaque_prf_input
1492         {
1493                 int r = 1;
1494
1495                 if (s->ctx->tlsext_opaque_prf_input_callback != 0)
1496                         {
1497                         r = s->ctx->tlsext_opaque_prf_input_callback(s, NULL, 0, s->ctx->tlsext_opaque_prf_input_callback_arg);
1498                         if (!r)
1499                                 return -1;
1500                         }
1501
1502                 if (s->tlsext_opaque_prf_input != NULL)
1503                         {
1504                         if (s->s3->client_opaque_prf_input != NULL) /* shouldn't really happen */
1505                                 OPENSSL_free(s->s3->client_opaque_prf_input);
1506
1507                         if (s->tlsext_opaque_prf_input_len == 0)
1508                                 s->s3->client_opaque_prf_input = OPENSSL_malloc(1); /* dummy byte just to get non-NULL */
1509                         else
1510                                 s->s3->client_opaque_prf_input = BUF_memdup(s->tlsext_opaque_prf_input, s->tlsext_opaque_prf_input_len);
1511                         if (s->s3->client_opaque_prf_input == NULL)
1512                                 {
1513                                 SSLerr(SSL_F_SSL_PREPARE_CLIENTHELLO_TLSEXT,ERR_R_MALLOC_FAILURE);
1514                                 return -1;
1515                                 }
1516                         s->s3->client_opaque_prf_input_len = s->tlsext_opaque_prf_input_len;
1517                         }
1518
1519                 if (r == 2)
1520                         /* at callback's request, insist on receiving an appropriate server opaque PRF input */
1521                         s->s3->server_opaque_prf_input_len = s->tlsext_opaque_prf_input_len;
1522         }
1523 #endif
1524
1525         return 1;
1526         }
1527
1528 int ssl_prepare_serverhello_tlsext(SSL *s)
1529         {
1530 #ifndef OPENSSL_NO_EC
1531         /* If we are server and using an ECC cipher suite, send the point formats we support
1532          * if the client sent us an ECPointsFormat extension.  Note that the server is not
1533          * supposed to send an EllipticCurves extension.
1534          */
1535
1536         unsigned long alg_k = s->s3->tmp.new_cipher->algorithm_mkey;
1537         unsigned long alg_a = s->s3->tmp.new_cipher->algorithm_auth;
1538         int using_ecc = (alg_k & (SSL_kEECDH|SSL_kECDHr|SSL_kECDHe)) || (alg_a & SSL_aECDSA);
1539         using_ecc = using_ecc && (s->session->tlsext_ecpointformatlist != NULL);
1540
1541         if (using_ecc)
1542                 {
1543                 if (s->tlsext_ecpointformatlist != NULL) OPENSSL_free(s->tlsext_ecpointformatlist);
1544                 if ((s->tlsext_ecpointformatlist = OPENSSL_malloc(3)) == NULL)
1545                         {
1546                         SSLerr(SSL_F_SSL_PREPARE_SERVERHELLO_TLSEXT,ERR_R_MALLOC_FAILURE);
1547                         return -1;
1548                         }
1549                 s->tlsext_ecpointformatlist_length = 3;
1550                 s->tlsext_ecpointformatlist[0] = TLSEXT_ECPOINTFORMAT_uncompressed;
1551                 s->tlsext_ecpointformatlist[1] = TLSEXT_ECPOINTFORMAT_ansiX962_compressed_prime;
1552                 s->tlsext_ecpointformatlist[2] = TLSEXT_ECPOINTFORMAT_ansiX962_compressed_char2;
1553                 }
1554 #endif /* OPENSSL_NO_EC */
1555
1556         return 1;
1557         }
1558
1559 int ssl_check_clienthello_tlsext(SSL *s)
1560         {
1561         int ret=SSL_TLSEXT_ERR_NOACK;
1562         int al = SSL_AD_UNRECOGNIZED_NAME;
1563
1564 #ifndef OPENSSL_NO_EC
1565         /* The handling of the ECPointFormats extension is done elsewhere, namely in
1566          * ssl3_choose_cipher in s3_lib.c.
1567          */
1568         /* The handling of the EllipticCurves extension is done elsewhere, namely in
1569          * ssl3_choose_cipher in s3_lib.c.
1570          */
1571 #endif
1572
1573         if (s->ctx != NULL && s->ctx->tlsext_servername_callback != 0)
1574                 ret = s->ctx->tlsext_servername_callback(s, &al, s->ctx->tlsext_servername_arg);
1575         else if (s->initial_ctx != NULL && s->initial_ctx->tlsext_servername_callback != 0)
1576                 ret = s->initial_ctx->tlsext_servername_callback(s, &al, s->initial_ctx->tlsext_servername_arg);
1577
1578         /* If status request then ask callback what to do.
1579          * Note: this must be called after servername callbacks in case
1580          * the certificate has changed.
1581          */
1582         if ((s->tlsext_status_type != -1) && s->ctx && s->ctx->tlsext_status_cb)
1583                 {
1584                 int r;
1585                 r = s->ctx->tlsext_status_cb(s, s->ctx->tlsext_status_arg);
1586                 switch (r)
1587                         {
1588                         /* We don't want to send a status request response */
1589                         case SSL_TLSEXT_ERR_NOACK:
1590                                 s->tlsext_status_expected = 0;
1591                                 break;
1592                         /* status request response should be sent */
1593                         case SSL_TLSEXT_ERR_OK:
1594                                 if (s->tlsext_ocsp_resp)
1595                                         s->tlsext_status_expected = 1;
1596                                 else
1597                                         s->tlsext_status_expected = 0;
1598                                 break;
1599                         /* something bad happened */
1600                         case SSL_TLSEXT_ERR_ALERT_FATAL:
1601                                 ret = SSL_TLSEXT_ERR_ALERT_FATAL;
1602                                 al = SSL_AD_INTERNAL_ERROR;
1603                                 goto err;
1604                         }
1605                 }
1606         else
1607                 s->tlsext_status_expected = 0;
1608
1609 #ifdef TLSEXT_TYPE_opaque_prf_input
1610         {
1611                 /* This sort of belongs into ssl_prepare_serverhello_tlsext(),
1612                  * but we might be sending an alert in response to the client hello,
1613                  * so this has to happen here in ssl_check_clienthello_tlsext(). */
1614
1615                 int r = 1;
1616
1617                 if (s->ctx->tlsext_opaque_prf_input_callback != 0)
1618                         {
1619                         r = s->ctx->tlsext_opaque_prf_input_callback(s, NULL, 0, s->ctx->tlsext_opaque_prf_input_callback_arg);
1620                         if (!r)
1621                                 {
1622                                 ret = SSL_TLSEXT_ERR_ALERT_FATAL;
1623                                 al = SSL_AD_INTERNAL_ERROR;
1624                                 goto err;
1625                                 }
1626                         }
1627
1628                 if (s->s3->server_opaque_prf_input != NULL) /* shouldn't really happen */
1629                         OPENSSL_free(s->s3->server_opaque_prf_input);
1630                 s->s3->server_opaque_prf_input = NULL;
1631
1632                 if (s->tlsext_opaque_prf_input != NULL)
1633                         {
1634                         if (s->s3->client_opaque_prf_input != NULL &&
1635                                 s->s3->client_opaque_prf_input_len == s->tlsext_opaque_prf_input_len)
1636                                 {
1637                                 /* can only use this extension if we have a server opaque PRF input
1638                                  * of the same length as the client opaque PRF input! */
1639
1640                                 if (s->tlsext_opaque_prf_input_len == 0)
1641                                         s->s3->server_opaque_prf_input = OPENSSL_malloc(1); /* dummy byte just to get non-NULL */
1642                                 else
1643                                         s->s3->server_opaque_prf_input = BUF_memdup(s->tlsext_opaque_prf_input, s->tlsext_opaque_prf_input_len);
1644                                 if (s->s3->server_opaque_prf_input == NULL)
1645                                         {
1646                                         ret = SSL_TLSEXT_ERR_ALERT_FATAL;
1647                                         al = SSL_AD_INTERNAL_ERROR;
1648                                         goto err;
1649                                         }
1650                                 s->s3->server_opaque_prf_input_len = s->tlsext_opaque_prf_input_len;
1651                                 }
1652                         }
1653
1654                 if (r == 2 && s->s3->server_opaque_prf_input == NULL)
1655                         {
1656                         /* The callback wants to enforce use of the extension,
1657                          * but we can't do that with the client opaque PRF input;
1658                          * abort the handshake.
1659                          */
1660                         ret = SSL_TLSEXT_ERR_ALERT_FATAL;
1661                         al = SSL_AD_HANDSHAKE_FAILURE;
1662                         }
1663         }
1664
1665 #endif
1666  err:
1667         switch (ret)
1668                 {
1669                 case SSL_TLSEXT_ERR_ALERT_FATAL:
1670                         ssl3_send_alert(s,SSL3_AL_FATAL,al);
1671                         return -1;
1672
1673                 case SSL_TLSEXT_ERR_ALERT_WARNING:
1674                         ssl3_send_alert(s,SSL3_AL_WARNING,al);
1675                         return 1;
1676
1677                 case SSL_TLSEXT_ERR_NOACK:
1678                         s->servername_done=0;
1679                         default:
1680                 return 1;
1681                 }
1682         }
1683
1684 int ssl_check_serverhello_tlsext(SSL *s)
1685         {
1686         int ret=SSL_TLSEXT_ERR_NOACK;
1687         int al = SSL_AD_UNRECOGNIZED_NAME;
1688
1689 #ifndef OPENSSL_NO_EC
1690         /* If we are client and using an elliptic curve cryptography cipher
1691          * suite, then if server returns an EC point formats lists extension
1692          * it must contain uncompressed.
1693          */
1694         unsigned long alg_k = s->s3->tmp.new_cipher->algorithm_mkey;
1695         unsigned long alg_a = s->s3->tmp.new_cipher->algorithm_auth;
1696         if ((s->tlsext_ecpointformatlist != NULL) && (s->tlsext_ecpointformatlist_length > 0) &&
1697             (s->session->tlsext_ecpointformatlist != NULL) && (s->session->tlsext_ecpointformatlist_length > 0) &&
1698             ((alg_k & (SSL_kEECDH|SSL_kECDHr|SSL_kECDHe)) || (alg_a & SSL_aECDSA)))
1699                 {
1700                 /* we are using an ECC cipher */
1701                 size_t i;
1702                 unsigned char *list;
1703                 int found_uncompressed = 0;
1704                 list = s->session->tlsext_ecpointformatlist;
1705                 for (i = 0; i < s->session->tlsext_ecpointformatlist_length; i++)
1706                         {
1707                         if (*(list++) == TLSEXT_ECPOINTFORMAT_uncompressed)
1708                                 {
1709                                 found_uncompressed = 1;
1710                                 break;
1711                                 }
1712                         }
1713                 if (!found_uncompressed)
1714                         {
1715                         SSLerr(SSL_F_SSL_CHECK_SERVERHELLO_TLSEXT,SSL_R_TLS_INVALID_ECPOINTFORMAT_LIST);
1716                         return -1;
1717                         }
1718                 }
1719         ret = SSL_TLSEXT_ERR_OK;
1720 #endif /* OPENSSL_NO_EC */
1721
1722         if (s->ctx != NULL && s->ctx->tlsext_servername_callback != 0)
1723                 ret = s->ctx->tlsext_servername_callback(s, &al, s->ctx->tlsext_servername_arg);
1724         else if (s->initial_ctx != NULL && s->initial_ctx->tlsext_servername_callback != 0)
1725                 ret = s->initial_ctx->tlsext_servername_callback(s, &al, s->initial_ctx->tlsext_servername_arg);
1726
1727 #ifdef TLSEXT_TYPE_opaque_prf_input
1728         if (s->s3->server_opaque_prf_input_len > 0)
1729                 {
1730                 /* This case may indicate that we, as a client, want to insist on using opaque PRF inputs.
1731                  * So first verify that we really have a value from the server too. */
1732
1733                 if (s->s3->server_opaque_prf_input == NULL)
1734                         {
1735                         ret = SSL_TLSEXT_ERR_ALERT_FATAL;
1736                         al = SSL_AD_HANDSHAKE_FAILURE;
1737                         }
1738
1739                 /* Anytime the server *has* sent an opaque PRF input, we need to check
1740                  * that we have a client opaque PRF input of the same size. */
1741                 if (s->s3->client_opaque_prf_input == NULL ||
1742                     s->s3->client_opaque_prf_input_len != s->s3->server_opaque_prf_input_len)
1743                         {
1744                         ret = SSL_TLSEXT_ERR_ALERT_FATAL;
1745                         al = SSL_AD_ILLEGAL_PARAMETER;
1746                         }
1747                 }
1748 #endif
1749
1750         /* If we've requested certificate status and we wont get one
1751          * tell the callback
1752          */
1753         if ((s->tlsext_status_type != -1) && !(s->tlsext_status_expected)
1754                         && s->ctx && s->ctx->tlsext_status_cb)
1755                 {
1756                 int r;
1757                 /* Set resp to NULL, resplen to -1 so callback knows
1758                  * there is no response.
1759                  */
1760                 if (s->tlsext_ocsp_resp)
1761                         {
1762                         OPENSSL_free(s->tlsext_ocsp_resp);
1763                         s->tlsext_ocsp_resp = NULL;
1764                         }
1765                 s->tlsext_ocsp_resplen = -1;
1766                 r = s->ctx->tlsext_status_cb(s, s->ctx->tlsext_status_arg);
1767                 if (r == 0)
1768                         {
1769                         al = SSL_AD_BAD_CERTIFICATE_STATUS_RESPONSE;
1770                         ret = SSL_TLSEXT_ERR_ALERT_FATAL;
1771                         }
1772                 if (r < 0)
1773                         {
1774                         al = SSL_AD_INTERNAL_ERROR;
1775                         ret = SSL_TLSEXT_ERR_ALERT_FATAL;
1776                         }
1777                 }
1778
1779         switch (ret)
1780                 {
1781                 case SSL_TLSEXT_ERR_ALERT_FATAL:
1782                         ssl3_send_alert(s,SSL3_AL_FATAL,al);
1783                         return -1;
1784
1785                 case SSL_TLSEXT_ERR_ALERT_WARNING:
1786                         ssl3_send_alert(s,SSL3_AL_WARNING,al);
1787                         return 1;
1788
1789                 case SSL_TLSEXT_ERR_NOACK:
1790                         s->servername_done=0;
1791                         default:
1792                 return 1;
1793                 }
1794         }
1795
1796 /* Since the server cache lookup is done early on in the processing of client
1797  * hello and other operations depend on the result we need to handle any TLS
1798  * session ticket extension at the same time.
1799  */
1800
1801 int tls1_process_ticket(SSL *s, unsigned char *session_id, int len,
1802                                 const unsigned char *limit, SSL_SESSION **ret)
1803         {
1804         /* Point after session ID in client hello */
1805         const unsigned char *p = session_id + len;
1806         unsigned short i;
1807
1808         /* If tickets disabled behave as if no ticket present
1809          * to permit stateful resumption.
1810          */
1811         if (SSL_get_options(s) & SSL_OP_NO_TICKET)
1812                 return 1;
1813
1814         if ((s->version <= SSL3_VERSION) || !limit)
1815                 return 1;
1816         if (p >= limit)
1817                 return -1;
1818         /* Skip past DTLS cookie */
1819         if (s->version == DTLS1_VERSION || s->version == DTLS1_BAD_VER)
1820                 {
1821                 i = *(p++);
1822                 p+= i;
1823                 if (p >= limit)
1824                         return -1;
1825                 }
1826         /* Skip past cipher list */
1827         n2s(p, i);
1828         p+= i;
1829         if (p >= limit)
1830                 return -1;
1831         /* Skip past compression algorithm list */
1832         i = *(p++);
1833         p += i;
1834         if (p > limit)
1835                 return -1;
1836         /* Now at start of extensions */
1837         if ((p + 2) >= limit)
1838                 return 1;
1839         n2s(p, i);
1840         while ((p + 4) <= limit)
1841                 {
1842                 unsigned short type, size;
1843                 n2s(p, type);
1844                 n2s(p, size);
1845                 if (p + size > limit)
1846                         return 1;
1847                 if (type == TLSEXT_TYPE_session_ticket)
1848                         {
1849                         /* If tickets disabled indicate cache miss which will
1850                          * trigger a full handshake
1851                          */
1852                         if (SSL_get_options(s) & SSL_OP_NO_TICKET)
1853                                 return 1;
1854                         /* If zero length note client will accept a ticket
1855                          * and indicate cache miss to trigger full handshake
1856                          */
1857                         if (size == 0)
1858                                 {
1859                                 s->tlsext_ticket_expected = 1;
1860                                 return 0;       /* Cache miss */
1861                                 }
1862                         if (s->tls_session_secret_cb)
1863                                 {
1864                                 /* Indicate cache miss here and instead of
1865                                  * generating the session from ticket now,
1866                                  * trigger abbreviated handshake based on
1867                                  * external mechanism to calculate the master
1868                                  * secret later. */
1869                                 return 0;
1870                                 }
1871                         return tls_decrypt_ticket(s, p, size, session_id, len,
1872                                                                         ret);
1873                         }
1874                 p += size;
1875                 }
1876         return 1;
1877         }
1878
1879 static int tls_decrypt_ticket(SSL *s, const unsigned char *etick, int eticklen,
1880                                 const unsigned char *sess_id, int sesslen,
1881                                 SSL_SESSION **psess)
1882         {
1883         SSL_SESSION *sess;
1884         unsigned char *sdec;
1885         const unsigned char *p;
1886         int slen, mlen, renew_ticket = 0;
1887         unsigned char tick_hmac[EVP_MAX_MD_SIZE];
1888         HMAC_CTX hctx;
1889         EVP_CIPHER_CTX ctx;
1890         SSL_CTX *tctx = s->initial_ctx;
1891         /* Need at least keyname + iv + some encrypted data */
1892         if (eticklen < 48)
1893                 goto tickerr;
1894         /* Initialize session ticket encryption and HMAC contexts */
1895         HMAC_CTX_init(&hctx);
1896         EVP_CIPHER_CTX_init(&ctx);
1897         if (tctx->tlsext_ticket_key_cb)
1898                 {
1899                 unsigned char *nctick = (unsigned char *)etick;
1900                 int rv = tctx->tlsext_ticket_key_cb(s, nctick, nctick + 16,
1901                                                         &ctx, &hctx, 0);
1902                 if (rv < 0)
1903                         return -1;
1904                 if (rv == 0)
1905                         goto tickerr;
1906                 if (rv == 2)
1907                         renew_ticket = 1;
1908                 }
1909         else
1910                 {
1911                 /* Check key name matches */
1912                 if (memcmp(etick, tctx->tlsext_tick_key_name, 16))
1913                         goto tickerr;
1914                 HMAC_Init_ex(&hctx, tctx->tlsext_tick_hmac_key, 16,
1915                                         tlsext_tick_md(), NULL);
1916                 EVP_DecryptInit_ex(&ctx, EVP_aes_128_cbc(), NULL,
1917                                 tctx->tlsext_tick_aes_key, etick + 16);
1918                 }
1919         /* Attempt to process session ticket, first conduct sanity and
1920          * integrity checks on ticket.
1921          */
1922         mlen = HMAC_size(&hctx);
1923         if (mlen < 0)
1924                 {
1925                 EVP_CIPHER_CTX_cleanup(&ctx);
1926                 return -1;
1927                 }
1928         eticklen -= mlen;
1929         /* Check HMAC of encrypted ticket */
1930         HMAC_Update(&hctx, etick, eticklen);
1931         HMAC_Final(&hctx, tick_hmac, NULL);
1932         HMAC_CTX_cleanup(&hctx);
1933         if (memcmp(tick_hmac, etick + eticklen, mlen))
1934                 goto tickerr;
1935         /* Attempt to decrypt session data */
1936         /* Move p after IV to start of encrypted ticket, update length */
1937         p = etick + 16 + EVP_CIPHER_CTX_iv_length(&ctx);
1938         eticklen -= 16 + EVP_CIPHER_CTX_iv_length(&ctx);
1939         sdec = OPENSSL_malloc(eticklen);
1940         if (!sdec)
1941                 {
1942                 EVP_CIPHER_CTX_cleanup(&ctx);
1943                 return -1;
1944                 }
1945         EVP_DecryptUpdate(&ctx, sdec, &slen, p, eticklen);
1946         if (EVP_DecryptFinal(&ctx, sdec + slen, &mlen) <= 0)
1947                 goto tickerr;
1948         slen += mlen;
1949         EVP_CIPHER_CTX_cleanup(&ctx);
1950         p = sdec;
1951
1952         sess = d2i_SSL_SESSION(NULL, &p, slen);
1953         OPENSSL_free(sdec);
1954         if (sess)
1955                 {
1956                 /* The session ID if non-empty is used by some clients to
1957                  * detect that the ticket has been accepted. So we copy it to
1958                  * the session structure. If it is empty set length to zero
1959                  * as required by standard.
1960                  */
1961                 if (sesslen)
1962                         memcpy(sess->session_id, sess_id, sesslen);
1963                 sess->session_id_length = sesslen;
1964                 *psess = sess;
1965                 s->tlsext_ticket_expected = renew_ticket;
1966                 return 1;
1967                 }
1968         /* If session decrypt failure indicate a cache miss and set state to
1969          * send a new ticket
1970          */
1971         tickerr:
1972         s->tlsext_ticket_expected = 1;
1973         return 0;
1974         }
1975
1976 /* Tables to translate from NIDs to TLS v1.2 ids */
1977
1978 typedef struct
1979         {
1980         int nid;
1981         int id;
1982         } tls12_lookup;
1983
1984 static tls12_lookup tls12_md[] = {
1985 #ifndef OPENSSL_NO_MD5
1986         {NID_md5, TLSEXT_hash_md5},
1987 #endif
1988 #ifndef OPENSSL_NO_SHA
1989         {NID_sha1, TLSEXT_hash_sha1},
1990 #endif
1991 #ifndef OPENSSL_NO_SHA256
1992         {NID_sha224, TLSEXT_hash_sha224},
1993         {NID_sha256, TLSEXT_hash_sha256},
1994 #endif
1995 #ifndef OPENSSL_NO_SHA512
1996         {NID_sha384, TLSEXT_hash_sha384},
1997         {NID_sha512, TLSEXT_hash_sha512}
1998 #endif
1999 };
2000
2001 static tls12_lookup tls12_sig[] = {
2002 #ifndef OPENSSL_NO_RSA
2003         {EVP_PKEY_RSA, TLSEXT_signature_rsa},
2004 #endif
2005 #ifndef OPENSSL_NO_RSA
2006         {EVP_PKEY_DSA, TLSEXT_signature_dsa},
2007 #endif
2008 #ifndef OPENSSL_NO_ECDSA
2009         {EVP_PKEY_EC, TLSEXT_signature_ecdsa}
2010 #endif
2011 };
2012
2013 static int tls12_find_id(int nid, tls12_lookup *table, size_t tlen)
2014         {
2015         size_t i;
2016         for (i = 0; i < tlen; i++)
2017                 {
2018                 if (table[i].nid == nid)
2019                         return table[i].id;
2020                 }
2021         return -1;
2022         }
2023 #if 0
2024 static int tls12_find_nid(int id, tls12_lookup *table, size_t tlen)
2025         {
2026         size_t i;
2027         for (i = 0; i < tlen; i++)
2028                 {
2029                 if (table[i].id == id)
2030                         return table[i].nid;
2031                 }
2032         return -1;
2033         }
2034 #endif
2035
2036 int tls12_get_sigandhash(unsigned char *p, const EVP_PKEY *pk, const EVP_MD *md)
2037         {
2038         int sig_id, md_id;
2039         md_id = tls12_find_id(EVP_MD_type(md), tls12_md,
2040                                 sizeof(tls12_md)/sizeof(tls12_lookup));
2041         if (md_id == -1)
2042                 return 0;
2043         sig_id = tls12_get_sigid(pk);
2044         if (sig_id == -1)
2045                 return 0;
2046         p[0] = (unsigned char)md_id;
2047         p[1] = (unsigned char)sig_id;
2048         return 1;
2049         }
2050
2051 int tls12_get_sigid(const EVP_PKEY *pk)
2052         {
2053         return tls12_find_id(pk->type, tls12_sig,
2054                                 sizeof(tls12_sig)/sizeof(tls12_lookup));
2055         }
2056
2057 const EVP_MD *tls12_get_hash(unsigned char hash_alg)
2058         {
2059         switch(hash_alg)
2060                 {
2061 #ifndef OPENSSL_NO_MD5
2062                 case TLSEXT_hash_md5:
2063                 return EVP_md5();
2064 #endif
2065 #ifndef OPENSSL_NO_SHA
2066                 case TLSEXT_hash_sha1:
2067                 return EVP_sha1();
2068 #endif
2069 #ifndef OPENSSL_NO_SHA256
2070                 case TLSEXT_hash_sha224:
2071                 return EVP_sha224();
2072
2073                 case TLSEXT_hash_sha256:
2074                 return EVP_sha256();
2075 #endif
2076 #ifndef OPENSSL_NO_SHA512
2077                 case TLSEXT_hash_sha384:
2078                 return EVP_sha384();
2079
2080                 case TLSEXT_hash_sha512:
2081                 return EVP_sha512();
2082 #endif
2083                 default:
2084                 return NULL;
2085
2086                 }
2087         }
2088
2089 /* Set preferred digest for each key type */
2090
2091 static int tls1_process_sigalgs(SSL *s, const unsigned char *data, int dsize)
2092         {
2093         int i, idx;
2094         const EVP_MD *md;
2095         CERT *c = s->cert;
2096         /* Extension ignored for TLS versions below 1.2 */
2097         if (s->version < TLS1_2_VERSION)
2098                 return 1;
2099
2100         c->pkeys[SSL_PKEY_DSA_SIGN].digest = NULL;
2101         c->pkeys[SSL_PKEY_RSA_SIGN].digest = NULL;
2102         c->pkeys[SSL_PKEY_RSA_ENC].digest = NULL;
2103         c->pkeys[SSL_PKEY_ECC].digest = NULL;
2104
2105         for (i = 0; i < dsize; i += 2)
2106                 {
2107                 unsigned char hash_alg = data[i], sig_alg = data[i+1];
2108
2109                 switch(sig_alg)
2110                         {
2111 #ifndef OPENSSL_NO_RSA
2112                         case TLSEXT_signature_rsa:
2113                         idx = SSL_PKEY_RSA_SIGN;
2114                         break;
2115 #endif
2116 #ifndef OPENSSL_NO_DSA
2117                         case TLSEXT_signature_dsa:
2118                         idx = SSL_PKEY_DSA_SIGN;
2119                         break;
2120 #endif
2121 #ifndef OPENSSL_NO_ECDSA
2122                         case TLSEXT_signature_ecdsa:
2123                         idx = SSL_PKEY_ECC;
2124                         break;
2125 #endif
2126                         default:
2127                         continue;
2128                         }
2129
2130                 if (c->pkeys[idx].digest == NULL)
2131                         {
2132                         md = tls12_get_hash(hash_alg);
2133                         if (md)
2134                                 {
2135                                 c->pkeys[idx].digest = md;
2136                                 if (idx == SSL_PKEY_RSA_SIGN)
2137                                         c->pkeys[SSL_PKEY_RSA_ENC].digest = md;
2138                                 }
2139                         }
2140
2141                 }
2142
2143         /* Set any remaining keys to default values. NOTE: if alg is not
2144          * supported it stays as NULL.
2145          */
2146 #ifndef OPENSSL_NO_DSA
2147         if (!c->pkeys[SSL_PKEY_DSA_SIGN].digest)
2148                 c->pkeys[SSL_PKEY_DSA_SIGN].digest = EVP_dss1();
2149 #endif
2150 #ifndef OPENSSL_NO_RSA
2151         if (!c->pkeys[SSL_PKEY_RSA_SIGN].digest)
2152                 {
2153                 c->pkeys[SSL_PKEY_RSA_SIGN].digest = EVP_sha1();
2154                 c->pkeys[SSL_PKEY_RSA_ENC].digest = EVP_sha1();
2155                 }
2156 #endif
2157 #ifndef OPENSSL_NO_ECDSA
2158         if (!c->pkeys[SSL_PKEY_ECC].digest)
2159                 c->pkeys[SSL_PKEY_ECC].digest = EVP_ecdsa();
2160 #endif
2161         return 1;
2162         }
2163
2164 #endif