ssl/t1_lib.c

   1 /* ssl/t1_lib.c */
   2 /* Copyright (C) 1995-1998 Eric Young (eay@cryptsoft.com)
   3  * All rights reserved.
   4  *
   5  * This package is an SSL implementation written
   6  * by Eric Young (eay@cryptsoft.com).
   7  * The implementation was written so as to conform with Netscapes SSL.
   8  *
   9  * This library is free for commercial and non-commercial use as long as
  10  * the following conditions are aheared to.  The following conditions
  11  * apply to all code found in this distribution, be it the RC4, RSA,
  12  * lhash, DES, etc., code; not just the SSL code.  The SSL documentation
  13  * included with this distribution is covered by the same copyright terms
  14  * except that the holder is Tim Hudson (tjh@cryptsoft.com).
  15  *
  16  * Copyright remains Eric Young's, and as such any Copyright notices in
  17  * the code are not to be removed.
  18  * If this package is used in a product, Eric Young should be given attribution
  19  * as the author of the parts of the library used.
  20  * This can be in the form of a textual message at program startup or
  21  * in documentation (online or textual) provided with the package.
  22  *
  23  * Redistribution and use in source and binary forms, with or without
  24  * modification, are permitted provided that the following conditions
  25  * are met:
  26  * 1. Redistributions of source code must retain the copyright
  27  *    notice, this list of conditions and the following disclaimer.
  28  * 2. Redistributions in binary form must reproduce the above copyright
  29  *    notice, this list of conditions and the following disclaimer in the
  30  *    documentation and/or other materials provided with the distribution.
  31  * 3. All advertising materials mentioning features or use of this software
  32  *    must display the following acknowledgement:
  33  *    "This product includes cryptographic software written by
  34  *     Eric Young (eay@cryptsoft.com)"
  35  *    The word 'cryptographic' can be left out if the rouines from the library
  36  *    being used are not cryptographic related :-).
  37  * 4. If you include any Windows specific code (or a derivative thereof) from
  38  *    the apps directory (application code) you must include an acknowledgement:
  39  *    "This product includes software written by Tim Hudson (tjh@cryptsoft.com)"
  40  *
  41  * THIS SOFTWARE IS PROVIDED BY ERIC YOUNG ``AS IS'' AND
  42  * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
  43  * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
  44  * ARE DISCLAIMED.  IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE
  45  * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
  46  * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
  47  * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
  48  * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
  49  * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
  50  * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
  51  * SUCH DAMAGE.
  52  *
  53  * The licence and distribution terms for any publically available version or
  54  * derivative of this code cannot be changed.  i.e. this code cannot simply be
  55  * copied and put under another distribution licence
  56  * [including the GNU Public Licence.]
  57  */
  58 /* ====================================================================
  59  * Copyright (c) 1998-2007 The OpenSSL Project.  All rights reserved.
  60  *
  61  * Redistribution and use in source and binary forms, with or without
  62  * modification, are permitted provided that the following conditions
  63  * are met:
  64  *
  65  * 1. Redistributions of source code must retain the above copyright
  66  *    notice, this list of conditions and the following disclaimer.
  67  *
  68  * 2. Redistributions in binary form must reproduce the above copyright
  69  *    notice, this list of conditions and the following disclaimer in
  70  *    the documentation and/or other materials provided with the
  71  *    distribution.
  72  *
  73  * 3. All advertising materials mentioning features or use of this
  74  *    software must display the following acknowledgment:
  75  *    "This product includes software developed by the OpenSSL Project
  76  *    for use in the OpenSSL Toolkit. (http://www.openssl.org/)"
  77  *
  78  * 4. The names "OpenSSL Toolkit" and "OpenSSL Project" must not be used to
  79  *    endorse or promote products derived from this software without
  80  *    prior written permission. For written permission, please contact
  81  *    openssl-core@openssl.org.
  82  *
  83  * 5. Products derived from this software may not be called "OpenSSL"
  84  *    nor may "OpenSSL" appear in their names without prior written
  85  *    permission of the OpenSSL Project.
  86  *
  87  * 6. Redistributions of any form whatsoever must retain the following
  88  *    acknowledgment:
  89  *    "This product includes software developed by the OpenSSL Project
  90  *    for use in the OpenSSL Toolkit (http://www.openssl.org/)"
  91  *
  92  * THIS SOFTWARE IS PROVIDED BY THE OpenSSL PROJECT ``AS IS'' AND ANY
  93  * EXPRESSED OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
  94  * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
  95  * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL THE OpenSSL PROJECT OR
  96  * ITS CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
  97  * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
  98  * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
  99  * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
 100  * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT,
 101  * STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
 102  * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED
 103  * OF THE POSSIBILITY OF SUCH DAMAGE.
 104  * ====================================================================
 105  *
 106  * This product includes cryptographic software written by Eric Young
 107  * (eay@cryptsoft.com).  This product includes software written by Tim
 108  * Hudson (tjh@cryptsoft.com).
 109  *
 110  */
 111
 112 #include <stdio.h>
 113 #include <openssl/objects.h>
 114 #include <openssl/evp.h>
 115 #include <openssl/hmac.h>
 116 #include <openssl/ocsp.h>
 117 #include <openssl/rand.h>
 118 #include "ssl_locl.h"
 119
 120 const char tls1_version_str[]="TLSv1" OPENSSL_VERSION_PTEXT;
 121
 122 #ifndef OPENSSL_NO_TLSEXT
 123 static int tls_decrypt_ticket(SSL *s, const unsigned char *tick, int ticklen,
 124                                 const unsigned char *sess_id, int sesslen,
 125                                 SSL_SESSION **psess);
 126 static int ssl_check_clienthello_tlsext(SSL *s);
 127 int ssl_check_serverhello_tlsext(SSL *s);
 128 #endif
 129
 130 SSL3_ENC_METHOD TLSv1_enc_data={
 131         tls1_enc,
 132         tls1_mac,
 133         tls1_setup_key_block,
 134         tls1_generate_master_secret,
 135         tls1_change_cipher_state,
 136         tls1_final_finish_mac,
 137         TLS1_FINISH_MAC_LENGTH,
 138         tls1_cert_verify_mac,
 139         TLS_MD_CLIENT_FINISH_CONST,TLS_MD_CLIENT_FINISH_CONST_SIZE,
 140         TLS_MD_SERVER_FINISH_CONST,TLS_MD_SERVER_FINISH_CONST_SIZE,
 141         tls1_alert_code,
 142         tls1_export_keying_material,
 143         };
 144
 145 long tls1_default_timeout(void)
 146         {
 147         /* 2 hours, the 24 hours mentioned in the TLSv1 spec
 148          * is way too long for http, the cache would over fill */
 149         return(60*60*2);
 150         }
 151
 152 int tls1_new(SSL *s)
 153         {
 154         if (!ssl3_new(s)) return(0);
 155         s->method->ssl_clear(s);
 156         return(1);
 157         }
 158
 159 void tls1_free(SSL *s)
 160         {
 161 #ifndef OPENSSL_NO_TLSEXT
 162         if (s->tlsext_session_ticket)
 163                 {
 164                 OPENSSL_free(s->tlsext_session_ticket);
 165                 }
 166 #endif /* OPENSSL_NO_TLSEXT */
 167         ssl3_free(s);
 168         }
 169
 170 void tls1_clear(SSL *s)
 171         {
 172         ssl3_clear(s);
 173         s->version = s->method->version;
 174         }
 175
 176 #ifndef OPENSSL_NO_EC
 177
 178 static int nid_list[] =
 179         {
 180                 NID_sect163k1, /* sect163k1 (1) */
 181                 NID_sect163r1, /* sect163r1 (2) */
 182                 NID_sect163r2, /* sect163r2 (3) */
 183                 NID_sect193r1, /* sect193r1 (4) */
 184                 NID_sect193r2, /* sect193r2 (5) */
 185                 NID_sect233k1, /* sect233k1 (6) */
 186                 NID_sect233r1, /* sect233r1 (7) */
 187                 NID_sect239k1, /* sect239k1 (8) */
 188                 NID_sect283k1, /* sect283k1 (9) */
 189                 NID_sect283r1, /* sect283r1 (10) */
 190                 NID_sect409k1, /* sect409k1 (11) */
 191                 NID_sect409r1, /* sect409r1 (12) */
 192                 NID_sect571k1, /* sect571k1 (13) */
 193                 NID_sect571r1, /* sect571r1 (14) */
 194                 NID_secp160k1, /* secp160k1 (15) */
 195                 NID_secp160r1, /* secp160r1 (16) */
 196                 NID_secp160r2, /* secp160r2 (17) */
 197                 NID_secp192k1, /* secp192k1 (18) */
 198                 NID_X9_62_prime192v1, /* secp192r1 (19) */
 199                 NID_secp224k1, /* secp224k1 (20) */
 200                 NID_secp224r1, /* secp224r1 (21) */
 201                 NID_secp256k1, /* secp256k1 (22) */
 202                 NID_X9_62_prime256v1, /* secp256r1 (23) */
 203                 NID_secp384r1, /* secp384r1 (24) */
 204                 NID_secp521r1  /* secp521r1 (25) */
 205         };
 206
 207
 208 static const unsigned char ecformats_default[] =
 209         {
 210         TLSEXT_ECPOINTFORMAT_uncompressed,
 211         TLSEXT_ECPOINTFORMAT_ansiX962_compressed_prime,
 212         TLSEXT_ECPOINTFORMAT_ansiX962_compressed_char2
 213         };
 214
 215 static const unsigned char eccurves_default[] =
 216         {
 217                 0,14, /* sect571r1 (14) */
 218                 0,13, /* sect571k1 (13) */
 219                 0,25, /* secp521r1 (25) */
 220                 0,11, /* sect409k1 (11) */
 221                 0,12, /* sect409r1 (12) */
 222                 0,24, /* secp384r1 (24) */
 223                 0,9,  /* sect283k1 (9) */
 224                 0,10, /* sect283r1 (10) */
 225                 0,22, /* secp256k1 (22) */
 226                 0,23, /* secp256r1 (23) */
 227                 0,8,  /* sect239k1 (8) */
 228                 0,6,  /* sect233k1 (6) */
 229                 0,7,  /* sect233r1 (7) */
 230                 0,20, /* secp224k1 (20) */
 231                 0,21, /* secp224r1 (21) */
 232                 0,4,  /* sect193r1 (4) */
 233                 0,5,  /* sect193r2 (5) */
 234                 0,18, /* secp192k1 (18) */
 235                 0,19, /* secp192r1 (19) */
 236                 0,1,  /* sect163k1 (1) */
 237                 0,2,  /* sect163r1 (2) */
 238                 0,3,  /* sect163r2 (3) */
 239                 0,15, /* secp160k1 (15) */
 240                 0,16, /* secp160r1 (16) */
 241                 0,17, /* secp160r2 (17) */
 242         };
 243
 244 int tls1_ec_curve_id2nid(int curve_id)
 245         {
 246         /* ECC curves from draft-ietf-tls-ecc-12.txt (Oct. 17, 2005) */
 247         if ((curve_id < 1) || ((unsigned int)curve_id >
 248                                 sizeof(nid_list)/sizeof(nid_list[0])))
 249                 return 0;
 250         return nid_list[curve_id-1];
 251         }
 252
 253 int tls1_ec_nid2curve_id(int nid)
 254         {
 255         /* ECC curves from draft-ietf-tls-ecc-12.txt (Oct. 17, 2005) */
 256         switch (nid)
 257                 {
 258         case NID_sect163k1: /* sect163k1 (1) */
 259                 return 1;
 260         case NID_sect163r1: /* sect163r1 (2) */
 261                 return 2;
 262         case NID_sect163r2: /* sect163r2 (3) */
 263                 return 3;
 264         case NID_sect193r1: /* sect193r1 (4) */
 265                 return 4;
 266         case NID_sect193r2: /* sect193r2 (5) */
 267                 return 5;
 268         case NID_sect233k1: /* sect233k1 (6) */
 269                 return 6;
 270         case NID_sect233r1: /* sect233r1 (7) */
 271                 return 7;
 272         case NID_sect239k1: /* sect239k1 (8) */
 273                 return 8;
 274         case NID_sect283k1: /* sect283k1 (9) */
 275                 return 9;
 276         case NID_sect283r1: /* sect283r1 (10) */
 277                 return 10;
 278         case NID_sect409k1: /* sect409k1 (11) */
 279                 return 11;
 280         case NID_sect409r1: /* sect409r1 (12) */
 281                 return 12;
 282         case NID_sect571k1: /* sect571k1 (13) */
 283                 return 13;
 284         case NID_sect571r1: /* sect571r1 (14) */
 285                 return 14;
 286         case NID_secp160k1: /* secp160k1 (15) */
 287                 return 15;
 288         case NID_secp160r1: /* secp160r1 (16) */
 289                 return 16;
 290         case NID_secp160r2: /* secp160r2 (17) */
 291                 return 17;
 292         case NID_secp192k1: /* secp192k1 (18) */
 293                 return 18;
 294         case NID_X9_62_prime192v1: /* secp192r1 (19) */
 295                 return 19;
 296         case NID_secp224k1: /* secp224k1 (20) */
 297                 return 20;
 298         case NID_secp224r1: /* secp224r1 (21) */
 299                 return 21;
 300         case NID_secp256k1: /* secp256k1 (22) */
 301                 return 22;
 302         case NID_X9_62_prime256v1: /* secp256r1 (23) */
 303                 return 23;
 304         case NID_secp384r1: /* secp384r1 (24) */
 305                 return 24;
 306         case NID_secp521r1:  /* secp521r1 (25) */
 307                 return 25;
 308         default:
 309                 return 0;
 310                 }
 311         }
 312 /* Get curves list, if "sess" is set return client curves otherwise
 313  * preferred list
 314  */
 315 static void tls1_get_curvelist(SSL *s, int sess,
 316                                         const unsigned char **pcurves,
 317                                         size_t *pcurveslen)
 318         {
 319         if (sess)
 320                 {
 321                 *pcurves = s->session->tlsext_ellipticcurvelist;
 322                 *pcurveslen = s->session->tlsext_ellipticcurvelist_length;
 323                 }
 324         else
 325                 {
 326                 *pcurves = s->tlsext_ellipticcurvelist;
 327                 *pcurveslen = s->tlsext_ellipticcurvelist_length;
 328                 }
 329         /* If not set use default: for now static structure */
 330         if (!*pcurves)
 331                 {
 332                 *pcurves = eccurves_default;
 333                 *pcurveslen = sizeof(eccurves_default);
 334                 }
 335         }
 336
 337 /* Return nth shared curve. If nmatch == -1 return number of
 338  * matches.
 339  */
 340
 341 int tls1_shared_curve(SSL *s, int nmatch)
 342         {
 343         const unsigned char *pref, *supp;
 344         size_t preflen, supplen, i, j;
 345         int k;
 346         /* Can't do anything on client side */
 347         if (s->server == 0)
 348                 return -1;
 349         tls1_get_curvelist(s, !!(s->options & SSL_OP_CIPHER_SERVER_PREFERENCE),
 350                                 &supp, &supplen);
 351         tls1_get_curvelist(s, !(s->options & SSL_OP_CIPHER_SERVER_PREFERENCE),
 352                                 &pref, &preflen);
 353         preflen /= 2;
 354         supplen /= 2;
 355         k = 0;
 356         for (i = 0; i < preflen; i++, pref+=2)
 357                 {
 358                 const unsigned char *tsupp = supp;
 359                 for (j = 0; j < supplen; j++, tsupp+=2)
 360                         {
 361                         if (pref[0] == tsupp[0] && pref[1] == tsupp[1])
 362                                 {
 363                                 if (nmatch == k)
 364                                         {
 365                                         int id = (pref[0] << 8) | pref[1];
 366                                         return tls1_ec_curve_id2nid(id);
 367                                         }
 368                                 k++;
 369                                 }
 370                         }
 371                 }
 372         if (nmatch == -1)
 373                 return k;
 374         return 0;
 375         }
 376
 377 int tls1_set_curves(unsigned char **pext, size_t *pextlen,
 378                         int *curves, size_t ncurves)
 379         {
 380         unsigned char *clist, *p;
 381         size_t i;
 382         /* Bitmap of curves included to detect duplicates: only works
 383          * while curve ids < 32
 384          */
 385         unsigned long dup_list = 0;
 386         clist = OPENSSL_malloc(ncurves * 2);
 387         if (!clist)
 388                 return 0;
 389         for (i = 0, p = clist; i < ncurves; i++)
 390                 {
 391                 unsigned long idmask;
 392                 int id;
 393                 id = tls1_ec_nid2curve_id(curves[i]);
 394                 idmask = 1L << id;
 395                 if (!id || (dup_list & idmask))
 396                         {
 397                         OPENSSL_free(clist);
 398                         return 0;
 399                         }
 400                 dup_list |= idmask;
 401                 s2n(id, p);
 402                 }
 403         if (*pext)
 404                 OPENSSL_free(*pext);
 405         *pext = clist;
 406         *pextlen = ncurves * 2;
 407         return 1;
 408         }
 409
 410 #define MAX_CURVELIST   25
 411
 412 typedef struct
 413         {
 414         size_t nidcnt;
 415         int nid_arr[MAX_CURVELIST];
 416         } nid_cb_st;
 417
 418 static int nid_cb(const char *elem, int len, void *arg)
 419         {
 420         nid_cb_st *narg = arg;
 421         size_t i;
 422         int nid;
 423         char etmp[20];
 424         if (narg->nidcnt == MAX_CURVELIST)
 425                 return 0;
 426         if (len > (int)(sizeof(etmp) - 1))
 427                 return 0;
 428         memcpy(etmp, elem, len);
 429         etmp[len] = 0;
 430         nid = EC_curve_nist2nid(etmp);
 431         if (nid == NID_undef)
 432                 nid = OBJ_sn2nid(etmp);
 433         if (nid == NID_undef)
 434                 nid = OBJ_ln2nid(etmp);
 435         if (nid == NID_undef)
 436                 return 0;
 437         for (i = 0; i < narg->nidcnt; i++)
 438                 if (narg->nid_arr[i] == nid)
 439                         return 0;
 440         narg->nid_arr[narg->nidcnt++] = nid;
 441         return 1;
 442         }
 443 /* Set curves based on a colon separate list */
 444 int tls1_set_curves_list(unsigned char **pext, size_t *pextlen,
 445                                 const char *str)
 446         {
 447         nid_cb_st ncb;
 448         ncb.nidcnt = 0;
 449         if (!CONF_parse_list(str, ':', 1, nid_cb, &ncb))
 450                 return 0;
 451         return tls1_set_curves(pext, pextlen, ncb.nid_arr, ncb.nidcnt);
 452         }
 453 /* For an EC key set TLS id and required compression based on parameters */
 454 static int tls1_set_ec_id(unsigned char *curve_id, unsigned char *comp_id,
 455                                 EC_KEY *ec)
 456         {
 457         int is_prime, id;
 458         const EC_GROUP *grp;
 459         const EC_POINT *pt;
 460         const EC_METHOD *meth;
 461         if (!ec)
 462                 return 0;
 463         /* Determine if it is a prime field */
 464         grp = EC_KEY_get0_group(ec);
 465         pt = EC_KEY_get0_public_key(ec);
 466         if (!grp || !pt)
 467                 return 0;
 468         meth = EC_GROUP_method_of(grp);
 469         if (!meth)
 470                 return 0;
 471         if (EC_METHOD_get_field_type(meth) == NID_X9_62_prime_field)
 472                 is_prime = 1;
 473         else
 474                 is_prime = 0;
 475         /* Determine curve ID */
 476         id = EC_GROUP_get_curve_name(grp);
 477         id = tls1_ec_nid2curve_id(id);
 478         /* If we have an ID set it, otherwise set arbitrary explicit curve */
 479         if (id)
 480                 {
 481                 curve_id[0] = 0;
 482                 curve_id[1] = (unsigned char)id;
 483                 }
 484         else
 485                 {
 486                 curve_id[0] = 0xff;
 487                 if (is_prime)
 488                         curve_id[1] = 0x01;
 489                 else
 490                         curve_id[1] = 0x02;
 491                 }
 492         if (comp_id)
 493                 {
 494                 if (EC_KEY_get_conv_form(ec) == POINT_CONVERSION_COMPRESSED)
 495                         {
 496                         if (is_prime)
 497                                 *comp_id = TLSEXT_ECPOINTFORMAT_ansiX962_compressed_prime;
 498                         else
 499                                 *comp_id = TLSEXT_ECPOINTFORMAT_ansiX962_compressed_char2;
 500                         }
 501                 else
 502                         *comp_id = TLSEXT_ECPOINTFORMAT_uncompressed;
 503                 }
 504         return 1;
 505         }
 506 /* Check an EC key is compatible with extensions */
 507 static int tls1_check_ec_key(SSL *s,
 508                         unsigned char *curve_id, unsigned char *comp_id)
 509         {
 510         const unsigned char *p;
 511         size_t plen, i;
 512         int j;
 513         /* If point formats extension present check it, otherwise everything
 514          * is supported (see RFC4492).
 515          */
 516         if (comp_id && s->session->tlsext_ecpointformatlist)
 517                 {
 518                 p = s->session->tlsext_ecpointformatlist;
 519                 plen = s->session->tlsext_ecpointformatlist_length;
 520                 for (i = 0; i < plen; i++, p++)
 521                         {
 522                         if (*comp_id == *p)
 523                                 break;
 524                         }
 525                 if (i == plen)
 526                         return 0;
 527                 }
 528         /* Check curve is consistent with client and server preferences */
 529         for (j = 0; j <= 1; j++)
 530                 {
 531                 tls1_get_curvelist(s, j, &p, &plen);
 532                 for (i = 0; i < plen; i+=2, p+=2)
 533                         {
 534                         if (p[0] == curve_id[0] && p[1] == curve_id[1])
 535                                 break;
 536                         }
 537                 if (i == plen)
 538                         return 0;
 539                 }
 540         return 1;
 541         }
 542 /* Check EC server key is compatible with client extensions */
 543 int tls1_check_ec_server_key(SSL *s)
 544         {
 545         int rv;
 546         CERT_PKEY *cpk = s->cert->pkeys + SSL_PKEY_ECC;
 547         EVP_PKEY *pkey;
 548         unsigned char comp_id, curve_id[2];
 549         if (!cpk->x509 || !cpk->privatekey)
 550                 return 0;
 551         pkey = X509_get_pubkey(cpk->x509);
 552         if (!pkey)
 553                 return 0;
 554         rv = tls1_set_ec_id(curve_id, &comp_id, pkey->pkey.ec);
 555         EVP_PKEY_free(pkey);
 556         if (!rv)
 557                 return 0;
 558         return tls1_check_ec_key(s, curve_id, &comp_id);
 559         }
 560 /* Check EC temporary key is compatible with client extensions */
 561 int tls1_check_ec_tmp_key(SSL *s)
 562         {
 563         unsigned char curve_id[2];
 564         EC_KEY *ec = s->cert->ecdh_tmp;
 565         if (s->cert->ecdh_tmp_auto)
 566                 {
 567                 /* Need a shared curve */
 568                 if (tls1_shared_curve(s, 0))
 569                         return 1;
 570                 else return 0;
 571                 }
 572         if (!ec)
 573                 {
 574                 if (s->cert->ecdh_tmp_cb)
 575                         return 1;
 576                 else
 577                         return 0;
 578                 }
 579         if (!tls1_set_ec_id(curve_id, NULL, ec))
 580                 return 1;
 581         return tls1_check_ec_key(s, curve_id, NULL);
 582         }
 583
 584 #endif /* OPENSSL_NO_EC */
 585
 586 #ifndef OPENSSL_NO_TLSEXT
 587
 588 /* List of supported signature algorithms and hashes. Should make this
 589  * customisable at some point, for now include everything we support.
 590  */
 591
 592 #ifdef OPENSSL_NO_RSA
 593 #define tlsext_sigalg_rsa(md) /* */
 594 #else
 595 #define tlsext_sigalg_rsa(md) md, TLSEXT_signature_rsa,
 596 #endif
 597
 598 #ifdef OPENSSL_NO_DSA
 599 #define tlsext_sigalg_dsa(md) /* */
 600 #else
 601 #define tlsext_sigalg_dsa(md) md, TLSEXT_signature_dsa,
 602 #endif
 603
 604 #ifdef OPENSSL_NO_ECDSA
 605 #define tlsext_sigalg_ecdsa(md) /* */
 606 #else
 607 #define tlsext_sigalg_ecdsa(md) md, TLSEXT_signature_ecdsa,
 608 #endif
 609
 610 #define tlsext_sigalg(md) \
 611                 tlsext_sigalg_rsa(md) \
 612                 tlsext_sigalg_dsa(md) \
 613                 tlsext_sigalg_ecdsa(md)
 614
 615 static unsigned char tls12_sigalgs[] = {
 616 #ifndef OPENSSL_NO_SHA512
 617         tlsext_sigalg(TLSEXT_hash_sha512)
 618         tlsext_sigalg(TLSEXT_hash_sha384)
 619 #endif
 620 #ifndef OPENSSL_NO_SHA256
 621         tlsext_sigalg(TLSEXT_hash_sha256)
 622         tlsext_sigalg(TLSEXT_hash_sha224)
 623 #endif
 624 #ifndef OPENSSL_NO_SHA
 625         tlsext_sigalg(TLSEXT_hash_sha1)
 626 #endif
 627 #ifndef OPENSSL_NO_MD5
 628         tlsext_sigalg_rsa(TLSEXT_hash_md5)
 629 #endif
 630 };
 631
 632 int tls12_get_req_sig_algs(SSL *s, unsigned char *p)
 633         {
 634         size_t slen = sizeof(tls12_sigalgs);
 635 #ifdef OPENSSL_FIPS
 636         /* If FIPS mode don't include MD5 which is last */
 637         if (FIPS_mode())
 638                 slen -= 2;
 639 #endif
 640         if (p)
 641                 memcpy(p, tls12_sigalgs, slen);
 642         return (int)slen;
 643         }
 644
 645 unsigned char *ssl_add_clienthello_tlsext(SSL *s, unsigned char *p, unsigned char *limit)
 646         {
 647         int extdatalen=0;
 648         unsigned char *ret = p;
 649 #ifndef OPENSSL_NO_EC
 650         /* See if we support any ECC ciphersuites */
 651         int using_ecc = 0;
 652         if (s->version != DTLS1_VERSION && s->version >= TLS1_VERSION)
 653                 {
 654                 int i;
 655                 unsigned long alg_k, alg_a;
 656                 STACK_OF(SSL_CIPHER) *cipher_stack = SSL_get_ciphers(s);
 657
 658                 for (i = 0; i < sk_SSL_CIPHER_num(cipher_stack); i++)
 659                         {
 660                         SSL_CIPHER *c = sk_SSL_CIPHER_value(cipher_stack, i);
 661
 662                         alg_k = c->algorithm_mkey;
 663                         alg_a = c->algorithm_auth;
 664                         if ((alg_k & (SSL_kEECDH|SSL_kECDHr|SSL_kECDHe)
 665                                 || (alg_a & SSL_aECDSA)))
 666                                 {
 667                                 using_ecc = 1;
 668                                 break;
 669                                 }
 670                         }
 671                 }
 672 #endif
 673
 674         /* don't add extensions for SSLv3 unless doing secure renegotiation */
 675         if (s->client_version == SSL3_VERSION
 676                                         && !s->s3->send_connection_binding)
 677                 return p;
 678
 679         ret+=2;
 680
 681         if (ret>=limit) return NULL; /* this really never occurs, but ... */
 682
 683         if (s->tlsext_hostname != NULL)
 684                 {
 685                 /* Add TLS extension servername to the Client Hello message */
 686                 unsigned long size_str;
 687                 long lenmax;
 688
 689                 /* check for enough space.
 690                    4 for the servername type and entension length
 691                    2 for servernamelist length
 692                    1 for the hostname type
 693                    2 for hostname length
 694                    + hostname length
 695                 */
 696
 697                 if ((lenmax = limit - ret - 9) < 0
 698                     || (size_str = strlen(s->tlsext_hostname)) > (unsigned long)lenmax)
 699                         return NULL;
 700
 701                 /* extension type and length */
 702                 s2n(TLSEXT_TYPE_server_name,ret);
 703                 s2n(size_str+5,ret);
 704
 705                 /* length of servername list */
 706                 s2n(size_str+3,ret);
 707
 708                 /* hostname type, length and hostname */
 709                 *(ret++) = (unsigned char) TLSEXT_NAMETYPE_host_name;
 710                 s2n(size_str,ret);
 711                 memcpy(ret, s->tlsext_hostname, size_str);
 712                 ret+=size_str;
 713                 }
 714
 715         /* Add RI if renegotiating */
 716         if (s->renegotiate)
 717           {
 718           int el;
 719
 720           if(!ssl_add_clienthello_renegotiate_ext(s, 0, &el, 0))
 721               {
 722               SSLerr(SSL_F_SSL_ADD_CLIENTHELLO_TLSEXT, ERR_R_INTERNAL_ERROR);
 723               return NULL;
 724               }
 725
 726           if((limit - p - 4 - el) < 0) return NULL;
 727
 728           s2n(TLSEXT_TYPE_renegotiate,ret);
 729           s2n(el,ret);
 730
 731           if(!ssl_add_clienthello_renegotiate_ext(s, ret, &el, el))
 732               {
 733               SSLerr(SSL_F_SSL_ADD_CLIENTHELLO_TLSEXT, ERR_R_INTERNAL_ERROR);
 734               return NULL;
 735               }
 736
 737           ret += el;
 738         }
 739
 740 #ifndef OPENSSL_NO_SRP
 741         /* Add SRP username if there is one */
 742         if (s->srp_ctx.login != NULL)
 743                 { /* Add TLS extension SRP username to the Client Hello message */
 744
 745                 int login_len = strlen(s->srp_ctx.login);
 746                 if (login_len > 255 || login_len == 0)
 747                         {
 748                         SSLerr(SSL_F_SSL_ADD_CLIENTHELLO_TLSEXT, ERR_R_INTERNAL_ERROR);
 749                         return NULL;
 750                         }
 751
 752                 /* check for enough space.
 753                    4 for the srp type type and entension length
 754                    1 for the srp user identity
 755                    + srp user identity length
 756                 */
 757                 if ((limit - ret - 5 - login_len) < 0) return NULL;
 758
 759                 /* fill in the extension */
 760                 s2n(TLSEXT_TYPE_srp,ret);
 761                 s2n(login_len+1,ret);
 762                 (*ret++) = (unsigned char) login_len;
 763                 memcpy(ret, s->srp_ctx.login, login_len);
 764                 ret+=login_len;
 765                 }
 766 #endif
 767
 768 #ifndef OPENSSL_NO_EC
 769         if (using_ecc)
 770                 {
 771                 /* Add TLS extension ECPointFormats to the ClientHello message */
 772                 long lenmax;
 773                 const unsigned char *plist;
 774                 size_t plistlen;
 775                 /* If we have a custom point format list use it otherwise
 776                  * use default */
 777                 plist = s->tlsext_ecpointformatlist;
 778                 if (plist)
 779                         plistlen = s->tlsext_ecpointformatlist_length;
 780                 else
 781                         {
 782                         plist = ecformats_default;
 783                         plistlen = sizeof(ecformats_default);
 784                         }
 785
 786                 if ((lenmax = limit - ret - 5) < 0) return NULL;
 787                 if (plistlen > (size_t)lenmax) return NULL;
 788                 if (plistlen > 255)
 789                         {
 790                         SSLerr(SSL_F_SSL_ADD_CLIENTHELLO_TLSEXT, ERR_R_INTERNAL_ERROR);
 791                         return NULL;
 792                         }
 793
 794                 s2n(TLSEXT_TYPE_ec_point_formats,ret);
 795                 s2n(plistlen + 1,ret);
 796                 *(ret++) = (unsigned char)plistlen ;
 797                 memcpy(ret, plist, plistlen);
 798                 ret+=plistlen;
 799
 800                 /* Add TLS extension EllipticCurves to the ClientHello message */
 801                 plist = s->tlsext_ellipticcurvelist;
 802                 tls1_get_curvelist(s, 0, &plist, &plistlen);
 803
 804                 if ((lenmax = limit - ret - 6) < 0) return NULL;
 805                 if (plistlen > (size_t)lenmax) return NULL;
 806                 if (plistlen > 65532)
 807                         {
 808                         SSLerr(SSL_F_SSL_ADD_CLIENTHELLO_TLSEXT, ERR_R_INTERNAL_ERROR);
 809                         return NULL;
 810                         }
 811
 812                 s2n(TLSEXT_TYPE_elliptic_curves,ret);
 813                 s2n(plistlen + 2, ret);
 814
 815                 /* NB: draft-ietf-tls-ecc-12.txt uses a one-byte prefix for
 816                  * elliptic_curve_list, but the examples use two bytes.
 817                  * http://www1.ietf.org/mail-archive/web/tls/current/msg00538.html
 818                  * resolves this to two bytes.
 819                  */
 820                 s2n(plistlen, ret);
 821                 memcpy(ret, plist, plistlen);
 822                 ret+=plistlen;
 823                 }
 824 #endif /* OPENSSL_NO_EC */
 825
 826         if (!(SSL_get_options(s) & SSL_OP_NO_TICKET))
 827                 {
 828                 int ticklen;
 829                 if (!s->new_session && s->session && s->session->tlsext_tick)
 830                         ticklen = s->session->tlsext_ticklen;
 831                 else if (s->session && s->tlsext_session_ticket &&
 832                          s->tlsext_session_ticket->data)
 833                         {
 834                         ticklen = s->tlsext_session_ticket->length;
 835                         s->session->tlsext_tick = OPENSSL_malloc(ticklen);
 836                         if (!s->session->tlsext_tick)
 837                                 return NULL;
 838                         memcpy(s->session->tlsext_tick,
 839                                s->tlsext_session_ticket->data,
 840                                ticklen);
 841                         s->session->tlsext_ticklen = ticklen;
 842                         }
 843                 else
 844                         ticklen = 0;
 845                 if (ticklen == 0 && s->tlsext_session_ticket &&
 846                     s->tlsext_session_ticket->data == NULL)
 847                         goto skip_ext;
 848                 /* Check for enough room 2 for extension type, 2 for len
 849                  * rest for ticket
 850                  */
 851                 if ((long)(limit - ret - 4 - ticklen) < 0) return NULL;
 852                 s2n(TLSEXT_TYPE_session_ticket,ret);
 853                 s2n(ticklen,ret);
 854                 if (ticklen)
 855                         {
 856                         memcpy(ret, s->session->tlsext_tick, ticklen);
 857                         ret += ticklen;
 858                         }
 859                 }
 860                 skip_ext:
 861
 862         if (TLS1_get_client_version(s) >= TLS1_2_VERSION)
 863                 {
 864                 if ((size_t)(limit - ret) < sizeof(tls12_sigalgs) + 6)
 865                         return NULL;
 866                 s2n(TLSEXT_TYPE_signature_algorithms,ret);
 867                 s2n(sizeof(tls12_sigalgs) + 2, ret);
 868                 s2n(sizeof(tls12_sigalgs), ret);
 869                 memcpy(ret, tls12_sigalgs, sizeof(tls12_sigalgs));
 870                 ret += sizeof(tls12_sigalgs);
 871                 }
 872
 873 #ifdef TLSEXT_TYPE_opaque_prf_input
 874         if (s->s3->client_opaque_prf_input != NULL &&
 875             s->version != DTLS1_VERSION)
 876                 {
 877                 size_t col = s->s3->client_opaque_prf_input_len;
 878
 879                 if ((long)(limit - ret - 6 - col < 0))
 880                         return NULL;
 881                 if (col > 0xFFFD) /* can't happen */
 882                         return NULL;
 883
 884                 s2n(TLSEXT_TYPE_opaque_prf_input, ret);
 885                 s2n(col + 2, ret);
 886                 s2n(col, ret);
 887                 memcpy(ret, s->s3->client_opaque_prf_input, col);
 888                 ret += col;
 889                 }
 890 #endif
 891
 892         if (s->tlsext_status_type == TLSEXT_STATUSTYPE_ocsp &&
 893             s->version != DTLS1_VERSION)
 894                 {
 895                 int i;
 896                 long extlen, idlen, itmp;
 897                 OCSP_RESPID *id;
 898
 899                 idlen = 0;
 900                 for (i = 0; i < sk_OCSP_RESPID_num(s->tlsext_ocsp_ids); i++)
 901                         {
 902                         id = sk_OCSP_RESPID_value(s->tlsext_ocsp_ids, i);
 903                         itmp = i2d_OCSP_RESPID(id, NULL);
 904                         if (itmp <= 0)
 905                                 return NULL;
 906                         idlen += itmp + 2;
 907                         }
 908
 909                 if (s->tlsext_ocsp_exts)
 910                         {
 911                         extlen = i2d_X509_EXTENSIONS(s->tlsext_ocsp_exts, NULL);
 912                         if (extlen < 0)
 913                                 return NULL;
 914                         }
 915                 else
 916                         extlen = 0;
 917
 918                 if ((long)(limit - ret - 7 - extlen - idlen) < 0) return NULL;
 919                 s2n(TLSEXT_TYPE_status_request, ret);
 920                 if (extlen + idlen > 0xFFF0)
 921                         return NULL;
 922                 s2n(extlen + idlen + 5, ret);
 923                 *(ret++) = TLSEXT_STATUSTYPE_ocsp;
 924                 s2n(idlen, ret);
 925                 for (i = 0; i < sk_OCSP_RESPID_num(s->tlsext_ocsp_ids); i++)
 926                         {
 927                         /* save position of id len */
 928                         unsigned char *q = ret;
 929                         id = sk_OCSP_RESPID_value(s->tlsext_ocsp_ids, i);
 930                         /* skip over id len */
 931                         ret += 2;
 932                         itmp = i2d_OCSP_RESPID(id, &ret);
 933                         /* write id len */
 934                         s2n(itmp, q);
 935                         }
 936                 s2n(extlen, ret);
 937                 if (extlen > 0)
 938                         i2d_X509_EXTENSIONS(s->tlsext_ocsp_exts, &ret);
 939                 }
 940
 941 #ifndef OPENSSL_NO_HEARTBEATS
 942         /* Add Heartbeat extension */
 943         s2n(TLSEXT_TYPE_heartbeat,ret);
 944         s2n(1,ret);
 945         /* Set mode:
 946          * 1: peer may send requests
 947          * 2: peer not allowed to send requests
 948          */
 949         if (s->tlsext_heartbeat & SSL_TLSEXT_HB_DONT_RECV_REQUESTS)
 950                 *(ret++) = SSL_TLSEXT_HB_DONT_SEND_REQUESTS;
 951         else
 952                 *(ret++) = SSL_TLSEXT_HB_ENABLED;
 953 #endif
 954
 955 #ifndef OPENSSL_NO_NEXTPROTONEG
 956         if (s->ctx->next_proto_select_cb && !s->s3->tmp.finish_md_len)
 957                 {
 958                 /* The client advertises an emtpy extension to indicate its
 959                  * support for Next Protocol Negotiation */
 960                 if (limit - ret - 4 < 0)
 961                         return NULL;
 962                 s2n(TLSEXT_TYPE_next_proto_neg,ret);
 963                 s2n(0,ret);
 964                 }
 965 #endif
 966
 967         if(SSL_get_srtp_profiles(s))
 968                 {
 969                 int el;
 970
 971                 ssl_add_clienthello_use_srtp_ext(s, 0, &el, 0);
 972
 973                 if((limit - p - 4 - el) < 0) return NULL;
 974
 975                 s2n(TLSEXT_TYPE_use_srtp,ret);
 976                 s2n(el,ret);
 977
 978                 if(ssl_add_clienthello_use_srtp_ext(s, ret, &el, el))
 979                         {
 980                         SSLerr(SSL_F_SSL_ADD_CLIENTHELLO_TLSEXT, ERR_R_INTERNAL_ERROR);
 981                         return NULL;
 982                         }
 983                 ret += el;
 984                 }
 985
 986         if ((extdatalen = ret-p-2)== 0)
 987                 return p;
 988
 989         s2n(extdatalen,p);
 990         return ret;
 991         }
 992
 993 unsigned char *ssl_add_serverhello_tlsext(SSL *s, unsigned char *p, unsigned char *limit)
 994         {
 995         int extdatalen=0;
 996         unsigned char *ret = p;
 997 #ifndef OPENSSL_NO_NEXTPROTONEG
 998         int next_proto_neg_seen;
 999 #endif
1000
1001         /* don't add extensions for SSLv3, unless doing secure renegotiation */
1002         if (s->version == SSL3_VERSION && !s->s3->send_connection_binding)
1003                 return p;
1004
1005         ret+=2;
1006         if (ret>=limit) return NULL; /* this really never occurs, but ... */
1007
1008         if (!s->hit && s->servername_done == 1 && s->session->tlsext_hostname != NULL)
1009                 {
1010                 if ((long)(limit - ret - 4) < 0) return NULL;
1011
1012                 s2n(TLSEXT_TYPE_server_name,ret);
1013                 s2n(0,ret);
1014                 }
1015
1016         if(s->s3->send_connection_binding)
1017         {
1018           int el;
1019
1020           if(!ssl_add_serverhello_renegotiate_ext(s, 0, &el, 0))
1021               {
1022               SSLerr(SSL_F_SSL_ADD_SERVERHELLO_TLSEXT, ERR_R_INTERNAL_ERROR);
1023               return NULL;
1024               }
1025
1026           if((limit - p - 4 - el) < 0) return NULL;
1027
1028           s2n(TLSEXT_TYPE_renegotiate,ret);
1029           s2n(el,ret);
1030
1031           if(!ssl_add_serverhello_renegotiate_ext(s, ret, &el, el))
1032               {
1033               SSLerr(SSL_F_SSL_ADD_SERVERHELLO_TLSEXT, ERR_R_INTERNAL_ERROR);
1034               return NULL;
1035               }
1036
1037           ret += el;
1038         }
1039
1040 #ifndef OPENSSL_NO_EC
1041         if (s->tlsext_ecpointformatlist != NULL &&
1042             s->version != DTLS1_VERSION)
1043                 {
1044                 /* Add TLS extension ECPointFormats to the ServerHello message */
1045                 long lenmax;
1046
1047                 if ((lenmax = limit - ret - 5) < 0) return NULL;
1048                 if (s->tlsext_ecpointformatlist_length > (unsigned long)lenmax) return NULL;
1049                 if (s->tlsext_ecpointformatlist_length > 255)
1050                         {
1051                         SSLerr(SSL_F_SSL_ADD_SERVERHELLO_TLSEXT, ERR_R_INTERNAL_ERROR);
1052                         return NULL;
1053                         }
1054
1055                 s2n(TLSEXT_TYPE_ec_point_formats,ret);
1056                 s2n(s->tlsext_ecpointformatlist_length + 1,ret);
1057                 *(ret++) = (unsigned char) s->tlsext_ecpointformatlist_length;
1058                 memcpy(ret, s->tlsext_ecpointformatlist, s->tlsext_ecpointformatlist_length);
1059                 ret+=s->tlsext_ecpointformatlist_length;
1060
1061                 }
1062         /* Currently the server should not respond with a SupportedCurves extension */
1063 #endif /* OPENSSL_NO_EC */
1064
1065         if (s->tlsext_ticket_expected
1066                 && !(SSL_get_options(s) & SSL_OP_NO_TICKET))
1067                 {
1068                 if ((long)(limit - ret - 4) < 0) return NULL;
1069                 s2n(TLSEXT_TYPE_session_ticket,ret);
1070                 s2n(0,ret);
1071                 }
1072
1073         if (s->tlsext_status_expected)
1074                 {
1075                 if ((long)(limit - ret - 4) < 0) return NULL;
1076                 s2n(TLSEXT_TYPE_status_request,ret);
1077                 s2n(0,ret);
1078                 }
1079
1080 #ifdef TLSEXT_TYPE_opaque_prf_input
1081         if (s->s3->server_opaque_prf_input != NULL &&
1082             s->version != DTLS1_VERSION)
1083                 {
1084                 size_t sol = s->s3->server_opaque_prf_input_len;
1085
1086                 if ((long)(limit - ret - 6 - sol) < 0)
1087                         return NULL;
1088                 if (sol > 0xFFFD) /* can't happen */
1089                         return NULL;
1090
1091                 s2n(TLSEXT_TYPE_opaque_prf_input, ret);
1092                 s2n(sol + 2, ret);
1093                 s2n(sol, ret);
1094                 memcpy(ret, s->s3->server_opaque_prf_input, sol);
1095                 ret += sol;
1096                 }
1097 #endif
1098
1099         if(s->srtp_profile)
1100                 {
1101                 int el;
1102
1103                 ssl_add_serverhello_use_srtp_ext(s, 0, &el, 0);
1104
1105                 if((limit - p - 4 - el) < 0) return NULL;
1106
1107                 s2n(TLSEXT_TYPE_use_srtp,ret);
1108                 s2n(el,ret);
1109
1110                 if(ssl_add_serverhello_use_srtp_ext(s, ret, &el, el))
1111                         {
1112                         SSLerr(SSL_F_SSL_ADD_SERVERHELLO_TLSEXT, ERR_R_INTERNAL_ERROR);
1113                         return NULL;
1114                         }
1115                 ret+=el;
1116                 }
1117
1118         if (((s->s3->tmp.new_cipher->id & 0xFFFF)==0x80 || (s->s3->tmp.new_cipher->id & 0xFFFF)==0x81)
1119                 && (SSL_get_options(s) & SSL_OP_CRYPTOPRO_TLSEXT_BUG))
1120                 { const unsigned char cryptopro_ext[36] = {
1121                         0xfd, 0xe8, /*65000*/
1122                         0x00, 0x20, /*32 bytes length*/
1123                         0x30, 0x1e, 0x30, 0x08, 0x06, 0x06, 0x2a, 0x85,
1124                         0x03,   0x02, 0x02, 0x09, 0x30, 0x08, 0x06, 0x06,
1125                         0x2a, 0x85, 0x03, 0x02, 0x02, 0x16, 0x30, 0x08,
1126                         0x06, 0x06, 0x2a, 0x85, 0x03, 0x02, 0x02, 0x17};
1127                         if (limit-ret<36) return NULL;
1128                         memcpy(ret,cryptopro_ext,36);
1129                         ret+=36;
1130
1131                 }
1132
1133 #ifndef OPENSSL_NO_HEARTBEATS
1134         /* Add Heartbeat extension if we've received one */
1135         if (s->tlsext_heartbeat & SSL_TLSEXT_HB_ENABLED)
1136                 {
1137                 s2n(TLSEXT_TYPE_heartbeat,ret);
1138                 s2n(1,ret);
1139                 /* Set mode:
1140                  * 1: peer may send requests
1141                  * 2: peer not allowed to send requests
1142                  */
1143                 if (s->tlsext_heartbeat & SSL_TLSEXT_HB_DONT_RECV_REQUESTS)
1144                         *(ret++) = SSL_TLSEXT_HB_DONT_SEND_REQUESTS;
1145                 else
1146                         *(ret++) = SSL_TLSEXT_HB_ENABLED;
1147
1148                 }
1149 #endif
1150
1151 #ifndef OPENSSL_NO_NEXTPROTONEG
1152         next_proto_neg_seen = s->s3->next_proto_neg_seen;
1153         s->s3->next_proto_neg_seen = 0;
1154         if (next_proto_neg_seen && s->ctx->next_protos_advertised_cb)
1155                 {
1156                 const unsigned char *npa;
1157                 unsigned int npalen;
1158                 int r;
1159
1160                 r = s->ctx->next_protos_advertised_cb(s, &npa, &npalen, s->ctx->next_protos_advertised_cb_arg);
1161                 if (r == SSL_TLSEXT_ERR_OK)
1162                         {
1163                         if ((long)(limit - ret - 4 - npalen) < 0) return NULL;
1164                         s2n(TLSEXT_TYPE_next_proto_neg,ret);
1165                         s2n(npalen,ret);
1166                         memcpy(ret, npa, npalen);
1167                         ret += npalen;
1168                         s->s3->next_proto_neg_seen = 1;
1169                         }
1170                 }
1171 #endif
1172
1173         if ((extdatalen = ret-p-2)== 0)
1174                 return p;
1175
1176         s2n(extdatalen,p);
1177         return ret;
1178         }
1179
1180 static int ssl_scan_clienthello_tlsext(SSL *s, unsigned char **p, unsigned char *d, int n, int *al)
1181         {
1182         unsigned short type;
1183         unsigned short size;
1184         unsigned short len;
1185         unsigned char *data = *p;
1186         int renegotiate_seen = 0;
1187         int sigalg_seen = 0;
1188
1189         s->servername_done = 0;
1190         s->tlsext_status_type = -1;
1191 #ifndef OPENSSL_NO_NEXTPROTONEG
1192         s->s3->next_proto_neg_seen = 0;
1193 #endif
1194
1195 #ifndef OPENSSL_NO_HEARTBEATS
1196         s->tlsext_heartbeat &= ~(SSL_TLSEXT_HB_ENABLED |
1197                                SSL_TLSEXT_HB_DONT_SEND_REQUESTS);
1198 #endif
1199
1200         if (data >= (d+n-2))
1201                 goto ri_check;
1202         n2s(data,len);
1203
1204         if (data > (d+n-len))
1205                 goto ri_check;
1206
1207         while (data <= (d+n-4))
1208                 {
1209                 n2s(data,type);
1210                 n2s(data,size);
1211
1212                 if (data+size > (d+n))
1213                         goto ri_check;
1214 #if 0
1215                 fprintf(stderr,"Received extension type %d size %d\n",type,size);
1216 #endif
1217                 if (s->tlsext_debug_cb)
1218                         s->tlsext_debug_cb(s, 0, type, data, size,
1219                                                 s->tlsext_debug_arg);
1220 /* The servername extension is treated as follows:
1221
1222    - Only the hostname type is supported with a maximum length of 255.
1223    - The servername is rejected if too long or if it contains zeros,
1224      in which case an fatal alert is generated.
1225    - The servername field is maintained together with the session cache.
1226    - When a session is resumed, the servername call back invoked in order
1227      to allow the application to position itself to the right context.
1228    - The servername is acknowledged if it is new for a session or when
1229      it is identical to a previously used for the same session.
1230      Applications can control the behaviour.  They can at any time
1231      set a 'desirable' servername for a new SSL object. This can be the
1232      case for example with HTTPS when a Host: header field is received and
1233      a renegotiation is requested. In this case, a possible servername
1234      presented in the new client hello is only acknowledged if it matches
1235      the value of the Host: field.
1236    - Applications must  use SSL_OP_NO_SESSION_RESUMPTION_ON_RENEGOTIATION
1237      if they provide for changing an explicit servername context for the session,
1238      i.e. when the session has been established with a servername extension.
1239    - On session reconnect, the servername extension may be absent.
1240
1241 */
1242
1243                 if (type == TLSEXT_TYPE_server_name)
1244                         {
1245                         unsigned char *sdata;
1246                         int servname_type;
1247                         int dsize;
1248
1249                         if (size < 2)
1250                                 {
1251                                 *al = SSL_AD_DECODE_ERROR;
1252                                 return 0;
1253                                 }
1254                         n2s(data,dsize);
1255                         size -= 2;
1256                         if (dsize > size  )
1257                                 {
1258                                 *al = SSL_AD_DECODE_ERROR;
1259                                 return 0;
1260                                 }
1261
1262                         sdata = data;
1263                         while (dsize > 3)
1264                                 {
1265                                 servname_type = *(sdata++);
1266                                 n2s(sdata,len);
1267                                 dsize -= 3;
1268
1269                                 if (len > dsize)
1270                                         {
1271                                         *al = SSL_AD_DECODE_ERROR;
1272                                         return 0;
1273                                         }
1274                                 if (s->servername_done == 0)
1275                                 switch (servname_type)
1276                                         {
1277                                 case TLSEXT_NAMETYPE_host_name:
1278                                         if (!s->hit)
1279                                                 {
1280                                                 if(s->session->tlsext_hostname)
1281                                                         {
1282                                                         *al = SSL_AD_DECODE_ERROR;
1283                                                         return 0;
1284                                                         }
1285                                                 if (len > TLSEXT_MAXLEN_host_name)
1286                                                         {
1287                                                         *al = TLS1_AD_UNRECOGNIZED_NAME;
1288                                                         return 0;
1289                                                         }
1290                                                 if ((s->session->tlsext_hostname = OPENSSL_malloc(len+1)) == NULL)
1291                                                         {
1292                                                         *al = TLS1_AD_INTERNAL_ERROR;
1293                                                         return 0;
1294                                                         }
1295                                                 memcpy(s->session->tlsext_hostname, sdata, len);
1296                                                 s->session->tlsext_hostname[len]='\0';
1297                                                 if (strlen(s->session->tlsext_hostname) != len) {
1298                                                         OPENSSL_free(s->session->tlsext_hostname);
1299                                                         s->session->tlsext_hostname = NULL;
1300                                                         *al = TLS1_AD_UNRECOGNIZED_NAME;
1301                                                         return 0;
1302                                                 }
1303                                                 s->servername_done = 1;
1304
1305                                                 }
1306                                         else
1307                                                 s->servername_done = s->session->tlsext_hostname
1308                                                         && strlen(s->session->tlsext_hostname) == len
1309                                                         && strncmp(s->session->tlsext_hostname, (char *)sdata, len) == 0;
1310
1311                                         break;
1312
1313                                 default:
1314                                         break;
1315                                         }
1316
1317                                 dsize -= len;
1318                                 }
1319                         if (dsize != 0)
1320                                 {
1321                                 *al = SSL_AD_DECODE_ERROR;
1322                                 return 0;
1323                                 }
1324
1325                         }
1326 #ifndef OPENSSL_NO_SRP
1327                 else if (type == TLSEXT_TYPE_srp)
1328                         {
1329                         if (size <= 0 || ((len = data[0])) != (size -1))
1330                                 {
1331                                 *al = SSL_AD_DECODE_ERROR;
1332                                 return 0;
1333                                 }
1334                         if (s->srp_ctx.login != NULL)
1335                                 {
1336                                 *al = SSL_AD_DECODE_ERROR;
1337                                 return 0;
1338                                 }
1339                         if ((s->srp_ctx.login = OPENSSL_malloc(len+1)) == NULL)
1340                                 return -1;
1341                         memcpy(s->srp_ctx.login, &data[1], len);
1342                         s->srp_ctx.login[len]='\0';
1343
1344                         if (strlen(s->srp_ctx.login) != len)
1345                                 {
1346                                 *al = SSL_AD_DECODE_ERROR;
1347                                 return 0;
1348                                 }
1349                         }
1350 #endif
1351
1352 #ifndef OPENSSL_NO_EC
1353                 else if (type == TLSEXT_TYPE_ec_point_formats &&
1354                      s->version != DTLS1_VERSION)
1355                         {
1356                         unsigned char *sdata = data;
1357                         int ecpointformatlist_length = *(sdata++);
1358
1359                         if (ecpointformatlist_length != size - 1)
1360                                 {
1361                                 *al = TLS1_AD_DECODE_ERROR;
1362                                 return 0;
1363                                 }
1364                         if (!s->hit)
1365                                 {
1366                                 if(s->session->tlsext_ecpointformatlist)
1367                                         {
1368                                         OPENSSL_free(s->session->tlsext_ecpointformatlist);
1369                                         s->session->tlsext_ecpointformatlist = NULL;
1370                                         }
1371                                 s->session->tlsext_ecpointformatlist_length = 0;
1372                                 if ((s->session->tlsext_ecpointformatlist = OPENSSL_malloc(ecpointformatlist_length)) == NULL)
1373                                         {
1374                                         *al = TLS1_AD_INTERNAL_ERROR;
1375                                         return 0;
1376                                         }
1377                                 s->session->tlsext_ecpointformatlist_length = ecpointformatlist_length;
1378                                 memcpy(s->session->tlsext_ecpointformatlist, sdata, ecpointformatlist_length);
1379                                 }
1380 #if 0
1381                         fprintf(stderr,"ssl_parse_clienthello_tlsext s->session->tlsext_ecpointformatlist (length=%i) ", s->session->tlsext_ecpointformatlist_length);
1382                         sdata = s->session->tlsext_ecpointformatlist;
1383                         for (i = 0; i < s->session->tlsext_ecpointformatlist_length; i++)
1384                                 fprintf(stderr,"%i ",*(sdata++));
1385                         fprintf(stderr,"\n");
1386 #endif
1387                         }
1388                 else if (type == TLSEXT_TYPE_elliptic_curves &&
1389                      s->version != DTLS1_VERSION)
1390                         {
1391                         unsigned char *sdata = data;
1392                         int ellipticcurvelist_length = (*(sdata++) << 8);
1393                         ellipticcurvelist_length += (*(sdata++));
1394
1395                         if (ellipticcurvelist_length != size - 2)
1396                                 {
1397                                 *al = TLS1_AD_DECODE_ERROR;
1398                                 return 0;
1399                                 }
1400                         if (!s->hit)
1401                                 {
1402                                 if(s->session->tlsext_ellipticcurvelist)
1403                                         {
1404                                         *al = TLS1_AD_DECODE_ERROR;
1405                                         return 0;
1406                                         }
1407                                 s->session->tlsext_ellipticcurvelist_length = 0;
1408                                 if ((s->session->tlsext_ellipticcurvelist = OPENSSL_malloc(ellipticcurvelist_length)) == NULL)
1409                                         {
1410                                         *al = TLS1_AD_INTERNAL_ERROR;
1411                                         return 0;
1412                                         }
1413                                 s->session->tlsext_ellipticcurvelist_length = ellipticcurvelist_length;
1414                                 memcpy(s->session->tlsext_ellipticcurvelist, sdata, ellipticcurvelist_length);
1415                                 }
1416 #if 0
1417                         fprintf(stderr,"ssl_parse_clienthello_tlsext s->session->tlsext_ellipticcurvelist (length=%i) ", s->session->tlsext_ellipticcurvelist_length);
1418                         sdata = s->session->tlsext_ellipticcurvelist;
1419                         for (i = 0; i < s->session->tlsext_ellipticcurvelist_length; i++)
1420                                 fprintf(stderr,"%i ",*(sdata++));
1421                         fprintf(stderr,"\n");
1422 #endif
1423                         }
1424 #endif /* OPENSSL_NO_EC */
1425 #ifdef TLSEXT_TYPE_opaque_prf_input
1426                 else if (type == TLSEXT_TYPE_opaque_prf_input &&
1427                      s->version != DTLS1_VERSION)
1428                         {
1429                         unsigned char *sdata = data;
1430
1431                         if (size < 2)
1432                                 {
1433                                 *al = SSL_AD_DECODE_ERROR;
1434                                 return 0;
1435                                 }
1436                         n2s(sdata, s->s3->client_opaque_prf_input_len);
1437                         if (s->s3->client_opaque_prf_input_len != size - 2)
1438                                 {
1439                                 *al = SSL_AD_DECODE_ERROR;
1440                                 return 0;
1441                                 }
1442
1443                         if (s->s3->client_opaque_prf_input != NULL) /* shouldn't really happen */
1444                                 OPENSSL_free(s->s3->client_opaque_prf_input);
1445                         if (s->s3->client_opaque_prf_input_len == 0)
1446                                 s->s3->client_opaque_prf_input = OPENSSL_malloc(1); /* dummy byte just to get non-NULL */
1447                         else
1448                                 s->s3->client_opaque_prf_input = BUF_memdup(sdata, s->s3->client_opaque_prf_input_len);
1449                         if (s->s3->client_opaque_prf_input == NULL)
1450                                 {
1451                                 *al = TLS1_AD_INTERNAL_ERROR;
1452                                 return 0;
1453                                 }
1454                         }
1455 #endif
1456                 else if (type == TLSEXT_TYPE_session_ticket)
1457                         {
1458                         if (s->tls_session_ticket_ext_cb &&
1459                             !s->tls_session_ticket_ext_cb(s, data, size, s->tls_session_ticket_ext_cb_arg))
1460                                 {
1461                                 *al = TLS1_AD_INTERNAL_ERROR;
1462                                 return 0;
1463                                 }
1464                         }
1465                 else if (type == TLSEXT_TYPE_renegotiate)
1466                         {
1467                         if(!ssl_parse_clienthello_renegotiate_ext(s, data, size, al))
1468                                 return 0;
1469                         renegotiate_seen = 1;
1470                         }
1471                 else if (type == TLSEXT_TYPE_signature_algorithms)
1472                         {
1473                         int dsize;
1474                         if (sigalg_seen || size < 2)
1475                                 {
1476                                 *al = SSL_AD_DECODE_ERROR;
1477                                 return 0;
1478                                 }
1479                         sigalg_seen = 1;
1480                         n2s(data,dsize);
1481                         size -= 2;
1482                         if (dsize != size || dsize & 1)
1483                                 {
1484                                 *al = SSL_AD_DECODE_ERROR;
1485                                 return 0;
1486                                 }
1487                         if (!tls1_process_sigalgs(s, data, dsize))
1488                                 {
1489                                 *al = SSL_AD_DECODE_ERROR;
1490                                 return 0;
1491                                 }
1492                         }
1493                 else if (type == TLSEXT_TYPE_status_request &&
1494                          s->version != DTLS1_VERSION && s->ctx->tlsext_status_cb)
1495                         {
1496
1497                         if (size < 5)
1498                                 {
1499                                 *al = SSL_AD_DECODE_ERROR;
1500                                 return 0;
1501                                 }
1502
1503                         s->tlsext_status_type = *data++;
1504                         size--;
1505                         if (s->tlsext_status_type == TLSEXT_STATUSTYPE_ocsp)
1506                                 {
1507                                 const unsigned char *sdata;
1508                                 int dsize;
1509                                 /* Read in responder_id_list */
1510                                 n2s(data,dsize);
1511                                 size -= 2;
1512                                 if (dsize > size  )
1513                                         {
1514                                         *al = SSL_AD_DECODE_ERROR;
1515                                         return 0;
1516                                         }
1517                                 while (dsize > 0)
1518                                         {
1519                                         OCSP_RESPID *id;
1520                                         int idsize;
1521                                         if (dsize < 4)
1522                                                 {
1523                                                 *al = SSL_AD_DECODE_ERROR;
1524                                                 return 0;
1525                                                 }
1526                                         n2s(data, idsize);
1527                                         dsize -= 2 + idsize;
1528                                         size -= 2 + idsize;
1529                                         if (dsize < 0)
1530                                                 {
1531                                                 *al = SSL_AD_DECODE_ERROR;
1532                                                 return 0;
1533                                                 }
1534                                         sdata = data;
1535                                         data += idsize;
1536                                         id = d2i_OCSP_RESPID(NULL,
1537                                                                 &sdata, idsize);
1538                                         if (!id)
1539                                                 {
1540                                                 *al = SSL_AD_DECODE_ERROR;
1541                                                 return 0;
1542                                                 }
1543                                         if (data != sdata)
1544                                                 {
1545                                                 OCSP_RESPID_free(id);
1546                                                 *al = SSL_AD_DECODE_ERROR;
1547                                                 return 0;
1548                                                 }
1549                                         if (!s->tlsext_ocsp_ids
1550                                                 && !(s->tlsext_ocsp_ids =
1551                                                 sk_OCSP_RESPID_new_null()))
1552                                                 {
1553                                                 OCSP_RESPID_free(id);
1554                                                 *al = SSL_AD_INTERNAL_ERROR;
1555                                                 return 0;
1556                                                 }
1557                                         if (!sk_OCSP_RESPID_push(
1558                                                         s->tlsext_ocsp_ids, id))
1559                                                 {
1560                                                 OCSP_RESPID_free(id);
1561                                                 *al = SSL_AD_INTERNAL_ERROR;
1562                                                 return 0;
1563                                                 }
1564                                         }
1565
1566                                 /* Read in request_extensions */
1567                                 if (size < 2)
1568                                         {
1569                                         *al = SSL_AD_DECODE_ERROR;
1570                                         return 0;
1571                                         }
1572                                 n2s(data,dsize);
1573                                 size -= 2;
1574                                 if (dsize != size)
1575                                         {
1576                                         *al = SSL_AD_DECODE_ERROR;
1577                                         return 0;
1578                                         }
1579                                 sdata = data;
1580                                 if (dsize > 0)
1581                                         {
1582                                         if (s->tlsext_ocsp_exts)
1583                                                 {
1584                                                 sk_X509_EXTENSION_pop_free(s->tlsext_ocsp_exts,
1585                                                                            X509_EXTENSION_free);
1586                                                 }
1587
1588                                         s->tlsext_ocsp_exts =
1589                                                 d2i_X509_EXTENSIONS(NULL,
1590                                                         &sdata, dsize);
1591                                         if (!s->tlsext_ocsp_exts
1592                                                 || (data + dsize != sdata))
1593                                                 {
1594                                                 *al = SSL_AD_DECODE_ERROR;
1595                                                 return 0;
1596                                                 }
1597                                         }
1598                                 }
1599                                 /* We don't know what to do with any other type
1600                                 * so ignore it.
1601                                 */
1602                                 else
1603                                         s->tlsext_status_type = -1;
1604                         }
1605 #ifndef OPENSSL_NO_HEARTBEATS
1606                 else if (type == TLSEXT_TYPE_heartbeat)
1607                         {
1608                         switch(data[0])
1609                                 {
1610                                 case 0x01:      /* Client allows us to send HB requests */
1611                                                         s->tlsext_heartbeat |= SSL_TLSEXT_HB_ENABLED;
1612                                                         break;
1613                                 case 0x02:      /* Client doesn't accept HB requests */
1614                                                         s->tlsext_heartbeat |= SSL_TLSEXT_HB_ENABLED;
1615                                                         s->tlsext_heartbeat |= SSL_TLSEXT_HB_DONT_SEND_REQUESTS;
1616                                                         break;
1617                                 default:        *al = SSL_AD_ILLEGAL_PARAMETER;
1618                                                         return 0;
1619                                 }
1620                         }
1621 #endif
1622 #ifndef OPENSSL_NO_NEXTPROTONEG
1623                 else if (type == TLSEXT_TYPE_next_proto_neg &&
1624                          s->s3->tmp.finish_md_len == 0)
1625                         {
1626                         /* We shouldn't accept this extension on a
1627                          * renegotiation.
1628                          *
1629                          * s->new_session will be set on renegotiation, but we
1630                          * probably shouldn't rely that it couldn't be set on
1631                          * the initial renegotation too in certain cases (when
1632                          * there's some other reason to disallow resuming an
1633                          * earlier session -- the current code won't be doing
1634                          * anything like that, but this might change).
1635
1636                          * A valid sign that there's been a previous handshake
1637                          * in this connection is if s->s3->tmp.finish_md_len >
1638                          * 0.  (We are talking about a check that will happen
1639                          * in the Hello protocol round, well before a new
1640                          * Finished message could have been computed.) */
1641                         s->s3->next_proto_neg_seen = 1;
1642                         }
1643 #endif
1644
1645                 /* session ticket processed earlier */
1646                 else if (type == TLSEXT_TYPE_use_srtp)
1647                         {
1648                         if(ssl_parse_clienthello_use_srtp_ext(s, data, size,
1649                                                               al))
1650                                 return 0;
1651                         }
1652
1653                 data+=size;
1654                 }
1655
1656         *p = data;
1657
1658         ri_check:
1659
1660         /* Need RI if renegotiating */
1661
1662         if (!renegotiate_seen && s->renegotiate &&
1663                 !(s->options & SSL_OP_ALLOW_UNSAFE_LEGACY_RENEGOTIATION))
1664                 {
1665                 *al = SSL_AD_HANDSHAKE_FAILURE;
1666                 SSLerr(SSL_F_SSL_SCAN_CLIENTHELLO_TLSEXT,
1667                                 SSL_R_UNSAFE_LEGACY_RENEGOTIATION_DISABLED);
1668                 return 0;
1669                 }
1670
1671         return 1;
1672         }
1673
1674 int ssl_parse_clienthello_tlsext(SSL *s, unsigned char **p, unsigned char *d, int n)
1675         {
1676         int al = -1;
1677         if (ssl_scan_clienthello_tlsext(s, p, d, n, &al) <= 0)
1678                 {
1679                 ssl3_send_alert(s,SSL3_AL_FATAL,al);
1680                 return 0;
1681                 }
1682
1683         if (ssl_check_clienthello_tlsext(s) <= 0)
1684                 {
1685                 SSLerr(SSL_F_SSL_PARSE_CLIENTHELLO_TLSEXT,SSL_R_CLIENTHELLO_TLSEXT);
1686                 return 0;
1687                 }
1688         return 1;
1689 }
1690
1691 #ifndef OPENSSL_NO_NEXTPROTONEG
1692 /* ssl_next_proto_validate validates a Next Protocol Negotiation block. No
1693  * elements of zero length are allowed and the set of elements must exactly fill
1694  * the length of the block. */
1695 static int ssl_next_proto_validate(unsigned char *d, unsigned len)
1696         {
1697         unsigned int off = 0;
1698
1699         while (off < len)
1700                 {
1701                 if (d[off] == 0)
1702                         return 0;
1703                 off += d[off];
1704                 off++;
1705                 }
1706
1707         return off == len;
1708         }
1709 #endif
1710
1711 static int ssl_scan_serverhello_tlsext(SSL *s, unsigned char **p, unsigned char *d, int n, int *al)
1712         {
1713         unsigned short length;
1714         unsigned short type;
1715         unsigned short size;
1716         unsigned char *data = *p;
1717         int tlsext_servername = 0;
1718         int renegotiate_seen = 0;
1719
1720 #ifndef OPENSSL_NO_NEXTPROTONEG
1721         s->s3->next_proto_neg_seen = 0;
1722 #endif
1723
1724 #ifndef OPENSSL_NO_HEARTBEATS
1725         s->tlsext_heartbeat &= ~(SSL_TLSEXT_HB_ENABLED |
1726                                SSL_TLSEXT_HB_DONT_SEND_REQUESTS);
1727 #endif
1728
1729         if (data >= (d+n-2))
1730                 goto ri_check;
1731
1732         n2s(data,length);
1733         if (data+length != d+n)
1734                 {
1735                 *al = SSL_AD_DECODE_ERROR;
1736                 return 0;
1737                 }
1738
1739         while(data <= (d+n-4))
1740                 {
1741                 n2s(data,type);
1742                 n2s(data,size);
1743
1744                 if (data+size > (d+n))
1745                         goto ri_check;
1746
1747                 if (s->tlsext_debug_cb)
1748                         s->tlsext_debug_cb(s, 1, type, data, size,
1749                                                 s->tlsext_debug_arg);
1750
1751                 if (type == TLSEXT_TYPE_server_name)
1752                         {
1753                         if (s->tlsext_hostname == NULL || size > 0)
1754                                 {
1755                                 *al = TLS1_AD_UNRECOGNIZED_NAME;
1756                                 return 0;
1757                                 }
1758                         tlsext_servername = 1;
1759                         }
1760
1761 #ifndef OPENSSL_NO_EC
1762                 else if (type == TLSEXT_TYPE_ec_point_formats &&
1763                      s->version != DTLS1_VERSION)
1764                         {
1765                         unsigned char *sdata = data;
1766                         int ecpointformatlist_length = *(sdata++);
1767
1768                         if (ecpointformatlist_length != size - 1)
1769                                 {
1770                                 *al = TLS1_AD_DECODE_ERROR;
1771                                 return 0;
1772                                 }
1773                         s->session->tlsext_ecpointformatlist_length = 0;
1774                         if (s->session->tlsext_ecpointformatlist != NULL) OPENSSL_free(s->session->tlsext_ecpointformatlist);
1775                         if ((s->session->tlsext_ecpointformatlist = OPENSSL_malloc(ecpointformatlist_length)) == NULL)
1776                                 {
1777                                 *al = TLS1_AD_INTERNAL_ERROR;
1778                                 return 0;
1779                                 }
1780                         s->session->tlsext_ecpointformatlist_length = ecpointformatlist_length;
1781                         memcpy(s->session->tlsext_ecpointformatlist, sdata, ecpointformatlist_length);
1782 #if 0
1783                         fprintf(stderr,"ssl_parse_serverhello_tlsext s->session->tlsext_ecpointformatlist ");
1784                         sdata = s->session->tlsext_ecpointformatlist;
1785                         for (i = 0; i < s->session->tlsext_ecpointformatlist_length; i++)
1786                                 fprintf(stderr,"%i ",*(sdata++));
1787                         fprintf(stderr,"\n");
1788 #endif
1789                         }
1790 #endif /* OPENSSL_NO_EC */
1791
1792                 else if (type == TLSEXT_TYPE_session_ticket)
1793                         {
1794                         if (s->tls_session_ticket_ext_cb &&
1795                             !s->tls_session_ticket_ext_cb(s, data, size, s->tls_session_ticket_ext_cb_arg))
1796                                 {
1797                                 *al = TLS1_AD_INTERNAL_ERROR;
1798                                 return 0;
1799                                 }
1800                         if ((SSL_get_options(s) & SSL_OP_NO_TICKET)
1801                                 || (size > 0))
1802                                 {
1803                                 *al = TLS1_AD_UNSUPPORTED_EXTENSION;
1804                                 return 0;
1805                                 }
1806                         s->tlsext_ticket_expected = 1;
1807                         }
1808 #ifdef TLSEXT_TYPE_opaque_prf_input
1809                 else if (type == TLSEXT_TYPE_opaque_prf_input &&
1810                      s->version != DTLS1_VERSION)
1811                         {
1812                         unsigned char *sdata = data;
1813
1814                         if (size < 2)
1815                                 {
1816                                 *al = SSL_AD_DECODE_ERROR;
1817                                 return 0;
1818                                 }
1819                         n2s(sdata, s->s3->server_opaque_prf_input_len);
1820                         if (s->s3->server_opaque_prf_input_len != size - 2)
1821                                 {
1822                                 *al = SSL_AD_DECODE_ERROR;
1823                                 return 0;
1824                                 }
1825
1826                         if (s->s3->server_opaque_prf_input != NULL) /* shouldn't really happen */
1827                                 OPENSSL_free(s->s3->server_opaque_prf_input);
1828                         if (s->s3->server_opaque_prf_input_len == 0)
1829                                 s->s3->server_opaque_prf_input = OPENSSL_malloc(1); /* dummy byte just to get non-NULL */
1830                         else
1831                                 s->s3->server_opaque_prf_input = BUF_memdup(sdata, s->s3->server_opaque_prf_input_len);
1832
1833                         if (s->s3->server_opaque_prf_input == NULL)
1834                                 {
1835                                 *al = TLS1_AD_INTERNAL_ERROR;
1836                                 return 0;
1837                                 }
1838                         }
1839 #endif
1840                 else if (type == TLSEXT_TYPE_status_request &&
1841                          s->version != DTLS1_VERSION)
1842                         {
1843                         /* MUST be empty and only sent if we've requested
1844                          * a status request message.
1845                          */
1846                         if ((s->tlsext_status_type == -1) || (size > 0))
1847                                 {
1848                                 *al = TLS1_AD_UNSUPPORTED_EXTENSION;
1849                                 return 0;
1850                                 }
1851                         /* Set flag to expect CertificateStatus message */
1852                         s->tlsext_status_expected = 1;
1853                         }
1854 #ifndef OPENSSL_NO_NEXTPROTONEG
1855                 else if (type == TLSEXT_TYPE_next_proto_neg &&
1856                          s->s3->tmp.finish_md_len == 0)
1857                         {
1858                         unsigned char *selected;
1859                         unsigned char selected_len;
1860
1861                         /* We must have requested it. */
1862                         if ((s->ctx->next_proto_select_cb == NULL))
1863                                 {
1864                                 *al = TLS1_AD_UNSUPPORTED_EXTENSION;
1865                                 return 0;
1866                                 }
1867                         /* The data must be valid */
1868                         if (!ssl_next_proto_validate(data, size))
1869                                 {
1870                                 *al = TLS1_AD_DECODE_ERROR;
1871                                 return 0;
1872                                 }
1873                         if (s->ctx->next_proto_select_cb(s, &selected, &selected_len, data, size, s->ctx->next_proto_select_cb_arg) != SSL_TLSEXT_ERR_OK)
1874                                 {
1875                                 *al = TLS1_AD_INTERNAL_ERROR;
1876                                 return 0;
1877                                 }
1878                         s->next_proto_negotiated = OPENSSL_malloc(selected_len);
1879                         if (!s->next_proto_negotiated)
1880                                 {
1881                                 *al = TLS1_AD_INTERNAL_ERROR;
1882                                 return 0;
1883                                 }
1884                         memcpy(s->next_proto_negotiated, selected, selected_len);
1885                         s->next_proto_negotiated_len = selected_len;
1886                         s->s3->next_proto_neg_seen = 1;
1887                         }
1888 #endif
1889                 else if (type == TLSEXT_TYPE_renegotiate)
1890                         {
1891                         if(!ssl_parse_serverhello_renegotiate_ext(s, data, size, al))
1892                                 return 0;
1893                         renegotiate_seen = 1;
1894                         }
1895 #ifndef OPENSSL_NO_HEARTBEATS
1896                 else if (type == TLSEXT_TYPE_heartbeat)
1897                         {
1898                         switch(data[0])
1899                                 {
1900                                 case 0x01:      /* Server allows us to send HB requests */
1901                                                         s->tlsext_heartbeat |= SSL_TLSEXT_HB_ENABLED;
1902                                                         break;
1903                                 case 0x02:      /* Server doesn't accept HB requests */
1904                                                         s->tlsext_heartbeat |= SSL_TLSEXT_HB_ENABLED;
1905                                                         s->tlsext_heartbeat |= SSL_TLSEXT_HB_DONT_SEND_REQUESTS;
1906                                                         break;
1907                                 default:        *al = SSL_AD_ILLEGAL_PARAMETER;
1908                                                         return 0;
1909                                 }
1910                         }
1911 #endif
1912                 else if (type == TLSEXT_TYPE_use_srtp)
1913                         {
1914                         if(ssl_parse_serverhello_use_srtp_ext(s, data, size,
1915                                                               al))
1916                                 return 0;
1917                         }
1918
1919                 data+=size;
1920                 }
1921
1922         if (data != d+n)
1923                 {
1924                 *al = SSL_AD_DECODE_ERROR;
1925                 return 0;
1926                 }
1927
1928         if (!s->hit && tlsext_servername == 1)
1929                 {
1930                 if (s->tlsext_hostname)
1931                         {
1932                         if (s->session->tlsext_hostname == NULL)
1933                                 {
1934                                 s->session->tlsext_hostname = BUF_strdup(s->tlsext_hostname);
1935                                 if (!s->session->tlsext_hostname)
1936                                         {
1937                                         *al = SSL_AD_UNRECOGNIZED_NAME;
1938                                         return 0;
1939                                         }
1940                                 }
1941                         else
1942                                 {
1943                                 *al = SSL_AD_DECODE_ERROR;
1944                                 return 0;
1945                                 }
1946                         }
1947                 }
1948
1949         *p = data;
1950
1951         ri_check:
1952
1953         /* Determine if we need to see RI. Strictly speaking if we want to
1954          * avoid an attack we should *always* see RI even on initial server
1955          * hello because the client doesn't see any renegotiation during an
1956          * attack. However this would mean we could not connect to any server
1957          * which doesn't support RI so for the immediate future tolerate RI
1958          * absence on initial connect only.
1959          */
1960         if (!renegotiate_seen
1961                 && !(s->options & SSL_OP_LEGACY_SERVER_CONNECT)
1962                 && !(s->options & SSL_OP_ALLOW_UNSAFE_LEGACY_RENEGOTIATION))
1963                 {
1964                 *al = SSL_AD_HANDSHAKE_FAILURE;
1965                 SSLerr(SSL_F_SSL_SCAN_SERVERHELLO_TLSEXT,
1966                                 SSL_R_UNSAFE_LEGACY_RENEGOTIATION_DISABLED);
1967                 return 0;
1968                 }
1969
1970         return 1;
1971         }
1972
1973
1974 int ssl_prepare_clienthello_tlsext(SSL *s)
1975         {
1976
1977 #ifdef TLSEXT_TYPE_opaque_prf_input
1978         {
1979                 int r = 1;
1980
1981                 if (s->ctx->tlsext_opaque_prf_input_callback != 0)
1982                         {
1983                         r = s->ctx->tlsext_opaque_prf_input_callback(s, NULL, 0, s->ctx->tlsext_opaque_prf_input_callback_arg);
1984                         if (!r)
1985                                 return -1;
1986                         }
1987
1988                 if (s->tlsext_opaque_prf_input != NULL)
1989                         {
1990                         if (s->s3->client_opaque_prf_input != NULL) /* shouldn't really happen */
1991                                 OPENSSL_free(s->s3->client_opaque_prf_input);
1992
1993                         if (s->tlsext_opaque_prf_input_len == 0)
1994                                 s->s3->client_opaque_prf_input = OPENSSL_malloc(1); /* dummy byte just to get non-NULL */
1995                         else
1996                                 s->s3->client_opaque_prf_input = BUF_memdup(s->tlsext_opaque_prf_input, s->tlsext_opaque_prf_input_len);
1997                         if (s->s3->client_opaque_prf_input == NULL)
1998                                 {
1999                                 SSLerr(SSL_F_SSL_PREPARE_CLIENTHELLO_TLSEXT,ERR_R_MALLOC_FAILURE);
2000                                 return -1;
2001                                 }
2002                         s->s3->client_opaque_prf_input_len = s->tlsext_opaque_prf_input_len;
2003                         }
2004
2005                 if (r == 2)
2006                         /* at callback's request, insist on receiving an appropriate server opaque PRF input */
2007                         s->s3->server_opaque_prf_input_len = s->tlsext_opaque_prf_input_len;
2008         }
2009 #endif
2010
2011         return 1;
2012         }
2013
2014 int ssl_prepare_serverhello_tlsext(SSL *s)
2015         {
2016 #ifndef OPENSSL_NO_EC
2017         /* If we are server and using an ECC cipher suite, send the point formats we support
2018          * if the client sent us an ECPointsFormat extension.  Note that the server is not
2019          * supposed to send an EllipticCurves extension.
2020          */
2021
2022         unsigned long alg_k = s->s3->tmp.new_cipher->algorithm_mkey;
2023         unsigned long alg_a = s->s3->tmp.new_cipher->algorithm_auth;
2024         int using_ecc = (alg_k & (SSL_kEECDH|SSL_kECDHr|SSL_kECDHe)) || (alg_a & SSL_aECDSA);
2025         using_ecc = using_ecc && (s->session->tlsext_ecpointformatlist != NULL);
2026
2027         if (using_ecc)
2028                 {
2029                 if (s->tlsext_ecpointformatlist != NULL) OPENSSL_free(s->tlsext_ecpointformatlist);
2030                 if ((s->tlsext_ecpointformatlist = OPENSSL_malloc(3)) == NULL)
2031                         {
2032                         SSLerr(SSL_F_SSL_PREPARE_SERVERHELLO_TLSEXT,ERR_R_MALLOC_FAILURE);
2033                         return -1;
2034                         }
2035                 s->tlsext_ecpointformatlist_length = 3;
2036                 s->tlsext_ecpointformatlist[0] = TLSEXT_ECPOINTFORMAT_uncompressed;
2037                 s->tlsext_ecpointformatlist[1] = TLSEXT_ECPOINTFORMAT_ansiX962_compressed_prime;
2038                 s->tlsext_ecpointformatlist[2] = TLSEXT_ECPOINTFORMAT_ansiX962_compressed_char2;
2039                 }
2040 #endif /* OPENSSL_NO_EC */
2041
2042         return 1;
2043         }
2044
2045 static int ssl_check_clienthello_tlsext(SSL *s)
2046         {
2047         int ret=SSL_TLSEXT_ERR_NOACK;
2048         int al = SSL_AD_UNRECOGNIZED_NAME;
2049
2050 #ifndef OPENSSL_NO_EC
2051         /* The handling of the ECPointFormats extension is done elsewhere, namely in
2052          * ssl3_choose_cipher in s3_lib.c.
2053          */
2054         /* The handling of the EllipticCurves extension is done elsewhere, namely in
2055          * ssl3_choose_cipher in s3_lib.c.
2056          */
2057 #endif
2058
2059         if (s->ctx != NULL && s->ctx->tlsext_servername_callback != 0)
2060                 ret = s->ctx->tlsext_servername_callback(s, &al, s->ctx->tlsext_servername_arg);
2061         else if (s->initial_ctx != NULL && s->initial_ctx->tlsext_servername_callback != 0)
2062                 ret = s->initial_ctx->tlsext_servername_callback(s, &al, s->initial_ctx->tlsext_servername_arg);
2063
2064         /* If status request then ask callback what to do.
2065          * Note: this must be called after servername callbacks in case
2066          * the certificate has changed.
2067          */
2068         if ((s->tlsext_status_type != -1) && s->ctx && s->ctx->tlsext_status_cb)
2069                 {
2070                 int r;
2071                 r = s->ctx->tlsext_status_cb(s, s->ctx->tlsext_status_arg);
2072                 switch (r)
2073                         {
2074                         /* We don't want to send a status request response */
2075                         case SSL_TLSEXT_ERR_NOACK:
2076                                 s->tlsext_status_expected = 0;
2077                                 break;
2078                         /* status request response should be sent */
2079                         case SSL_TLSEXT_ERR_OK:
2080                                 if (s->tlsext_ocsp_resp)
2081                                         s->tlsext_status_expected = 1;
2082                                 else
2083                                         s->tlsext_status_expected = 0;
2084                                 break;
2085                         /* something bad happened */
2086                         case SSL_TLSEXT_ERR_ALERT_FATAL:
2087                                 ret = SSL_TLSEXT_ERR_ALERT_FATAL;
2088                                 al = SSL_AD_INTERNAL_ERROR;
2089                                 goto err;
2090                         }
2091                 }
2092         else
2093                 s->tlsext_status_expected = 0;
2094
2095 #ifdef TLSEXT_TYPE_opaque_prf_input
2096         {
2097                 /* This sort of belongs into ssl_prepare_serverhello_tlsext(),
2098                  * but we might be sending an alert in response to the client hello,
2099                  * so this has to happen here in ssl_check_clienthello_tlsext(). */
2100
2101                 int r = 1;
2102
2103                 if (s->ctx->tlsext_opaque_prf_input_callback != 0)
2104                         {
2105                         r = s->ctx->tlsext_opaque_prf_input_callback(s, NULL, 0, s->ctx->tlsext_opaque_prf_input_callback_arg);
2106                         if (!r)
2107                                 {
2108                                 ret = SSL_TLSEXT_ERR_ALERT_FATAL;
2109                                 al = SSL_AD_INTERNAL_ERROR;
2110                                 goto err;
2111                                 }
2112                         }
2113
2114                 if (s->s3->server_opaque_prf_input != NULL) /* shouldn't really happen */
2115                         OPENSSL_free(s->s3->server_opaque_prf_input);
2116                 s->s3->server_opaque_prf_input = NULL;
2117
2118                 if (s->tlsext_opaque_prf_input != NULL)
2119                         {
2120                         if (s->s3->client_opaque_prf_input != NULL &&
2121                                 s->s3->client_opaque_prf_input_len == s->tlsext_opaque_prf_input_len)
2122                                 {
2123                                 /* can only use this extension if we have a server opaque PRF input
2124                                  * of the same length as the client opaque PRF input! */
2125
2126                                 if (s->tlsext_opaque_prf_input_len == 0)
2127                                         s->s3->server_opaque_prf_input = OPENSSL_malloc(1); /* dummy byte just to get non-NULL */
2128                                 else
2129                                         s->s3->server_opaque_prf_input = BUF_memdup(s->tlsext_opaque_prf_input, s->tlsext_opaque_prf_input_len);
2130                                 if (s->s3->server_opaque_prf_input == NULL)
2131                                         {
2132                                         ret = SSL_TLSEXT_ERR_ALERT_FATAL;
2133                                         al = SSL_AD_INTERNAL_ERROR;
2134                                         goto err;
2135                                         }
2136                                 s->s3->server_opaque_prf_input_len = s->tlsext_opaque_prf_input_len;
2137                                 }
2138                         }
2139
2140                 if (r == 2 && s->s3->server_opaque_prf_input == NULL)
2141                         {
2142                         /* The callback wants to enforce use of the extension,
2143                          * but we can't do that with the client opaque PRF input;
2144                          * abort the handshake.
2145                          */
2146                         ret = SSL_TLSEXT_ERR_ALERT_FATAL;
2147                         al = SSL_AD_HANDSHAKE_FAILURE;
2148                         }
2149         }
2150
2151 #endif
2152  err:
2153         switch (ret)
2154                 {
2155                 case SSL_TLSEXT_ERR_ALERT_FATAL:
2156                         ssl3_send_alert(s,SSL3_AL_FATAL,al);
2157                         return -1;
2158
2159                 case SSL_TLSEXT_ERR_ALERT_WARNING:
2160                         ssl3_send_alert(s,SSL3_AL_WARNING,al);
2161                         return 1;
2162
2163                 case SSL_TLSEXT_ERR_NOACK:
2164                         s->servername_done=0;
2165                         default:
2166                 return 1;
2167                 }
2168         }
2169
2170 int ssl_check_serverhello_tlsext(SSL *s)
2171         {
2172         int ret=SSL_TLSEXT_ERR_NOACK;
2173         int al = SSL_AD_UNRECOGNIZED_NAME;
2174
2175 #ifndef OPENSSL_NO_EC
2176         /* If we are client and using an elliptic curve cryptography cipher
2177          * suite, then if server returns an EC point formats lists extension
2178          * it must contain uncompressed.
2179          */
2180         unsigned long alg_k = s->s3->tmp.new_cipher->algorithm_mkey;
2181         unsigned long alg_a = s->s3->tmp.new_cipher->algorithm_auth;
2182         if ((s->tlsext_ecpointformatlist != NULL) && (s->tlsext_ecpointformatlist_length > 0) &&
2183             (s->session->tlsext_ecpointformatlist != NULL) && (s->session->tlsext_ecpointformatlist_length > 0) &&
2184             ((alg_k & (SSL_kEECDH|SSL_kECDHr|SSL_kECDHe)) || (alg_a & SSL_aECDSA)))
2185                 {
2186                 /* we are using an ECC cipher */
2187                 size_t i;
2188                 unsigned char *list;
2189                 int found_uncompressed = 0;
2190                 list = s->session->tlsext_ecpointformatlist;
2191                 for (i = 0; i < s->session->tlsext_ecpointformatlist_length; i++)
2192                         {
2193                         if (*(list++) == TLSEXT_ECPOINTFORMAT_uncompressed)
2194                                 {
2195                                 found_uncompressed = 1;
2196                                 break;
2197                                 }
2198                         }
2199                 if (!found_uncompressed)
2200                         {
2201                         SSLerr(SSL_F_SSL_CHECK_SERVERHELLO_TLSEXT,SSL_R_TLS_INVALID_ECPOINTFORMAT_LIST);
2202                         return -1;
2203                         }
2204                 }
2205         ret = SSL_TLSEXT_ERR_OK;
2206 #endif /* OPENSSL_NO_EC */
2207
2208         if (s->ctx != NULL && s->ctx->tlsext_servername_callback != 0)
2209                 ret = s->ctx->tlsext_servername_callback(s, &al, s->ctx->tlsext_servername_arg);
2210         else if (s->initial_ctx != NULL && s->initial_ctx->tlsext_servername_callback != 0)
2211                 ret = s->initial_ctx->tlsext_servername_callback(s, &al, s->initial_ctx->tlsext_servername_arg);
2212
2213 #ifdef TLSEXT_TYPE_opaque_prf_input
2214         if (s->s3->server_opaque_prf_input_len > 0)
2215                 {
2216                 /* This case may indicate that we, as a client, want to insist on using opaque PRF inputs.
2217                  * So first verify that we really have a value from the server too. */
2218
2219                 if (s->s3->server_opaque_prf_input == NULL)
2220                         {
2221                         ret = SSL_TLSEXT_ERR_ALERT_FATAL;
2222                         al = SSL_AD_HANDSHAKE_FAILURE;
2223                         }
2224
2225                 /* Anytime the server *has* sent an opaque PRF input, we need to check
2226                  * that we have a client opaque PRF input of the same size. */
2227                 if (s->s3->client_opaque_prf_input == NULL ||
2228                     s->s3->client_opaque_prf_input_len != s->s3->server_opaque_prf_input_len)
2229                         {
2230                         ret = SSL_TLSEXT_ERR_ALERT_FATAL;
2231                         al = SSL_AD_ILLEGAL_PARAMETER;
2232                         }
2233                 }
2234 #endif
2235
2236         /* If we've requested certificate status and we wont get one
2237          * tell the callback
2238          */
2239         if ((s->tlsext_status_type != -1) && !(s->tlsext_status_expected)
2240                         && s->ctx && s->ctx->tlsext_status_cb)
2241                 {
2242                 int r;
2243                 /* Set resp to NULL, resplen to -1 so callback knows
2244                  * there is no response.
2245                  */
2246                 if (s->tlsext_ocsp_resp)
2247                         {
2248                         OPENSSL_free(s->tlsext_ocsp_resp);
2249                         s->tlsext_ocsp_resp = NULL;
2250                         }
2251                 s->tlsext_ocsp_resplen = -1;
2252                 r = s->ctx->tlsext_status_cb(s, s->ctx->tlsext_status_arg);
2253                 if (r == 0)
2254                         {
2255                         al = SSL_AD_BAD_CERTIFICATE_STATUS_RESPONSE;
2256                         ret = SSL_TLSEXT_ERR_ALERT_FATAL;
2257                         }
2258                 if (r < 0)
2259                         {
2260                         al = SSL_AD_INTERNAL_ERROR;
2261                         ret = SSL_TLSEXT_ERR_ALERT_FATAL;
2262                         }
2263                 }
2264
2265         switch (ret)
2266                 {
2267                 case SSL_TLSEXT_ERR_ALERT_FATAL:
2268                         ssl3_send_alert(s,SSL3_AL_FATAL,al);
2269                         return -1;
2270
2271                 case SSL_TLSEXT_ERR_ALERT_WARNING:
2272                         ssl3_send_alert(s,SSL3_AL_WARNING,al);
2273                         return 1;
2274
2275                 case SSL_TLSEXT_ERR_NOACK:
2276                         s->servername_done=0;
2277                         default:
2278                 return 1;
2279                 }
2280         }
2281
2282 int ssl_parse_serverhello_tlsext(SSL *s, unsigned char **p, unsigned char *d, int n)
2283         {
2284         int al = -1;
2285         if (s->version < SSL3_VERSION)
2286                 return 1;
2287         if (ssl_scan_serverhello_tlsext(s, p, d, n, &al) <= 0)
2288                 {
2289                 ssl3_send_alert(s,SSL3_AL_FATAL,al);
2290                 return 0;
2291                 }
2292
2293         if (ssl_check_serverhello_tlsext(s) <= 0)
2294                 {
2295                 SSLerr(SSL_F_SSL_PARSE_SERVERHELLO_TLSEXT,SSL_R_SERVERHELLO_TLSEXT);
2296                 return 0;
2297                 }
2298         return 1;
2299 }
2300
2301 /* Since the server cache lookup is done early on in the processing of the
2302  * ClientHello, and other operations depend on the result, we need to handle
2303  * any TLS session ticket extension at the same time.
2304  *
2305  *   session_id: points at the session ID in the ClientHello. This code will
2306  *       read past the end of this in order to parse out the session ticket
2307  *       extension, if any.
2308  *   len: the length of the session ID.
2309  *   limit: a pointer to the first byte after the ClientHello.
2310  *   ret: (output) on return, if a ticket was decrypted, then this is set to
2311  *       point to the resulting session.
2312  *
2313  * If s->tls_session_secret_cb is set then we are expecting a pre-shared key
2314  * ciphersuite, in which case we have no use for session tickets and one will
2315  * never be decrypted, nor will s->tlsext_ticket_expected be set to 1.
2316  *
2317  * Returns:
2318  *   -1: fatal error, either from parsing or decrypting the ticket.
2319  *    0: no ticket was found (or was ignored, based on settings).
2320  *    1: a zero length extension was found, indicating that the client supports
2321  *       session tickets but doesn't currently have one to offer.
2322  *    2: either s->tls_session_secret_cb was set, or a ticket was offered but
2323  *       couldn't be decrypted because of a non-fatal error.
2324  *    3: a ticket was successfully decrypted and *ret was set.
2325  *
2326  * Side effects:
2327  *   Sets s->tlsext_ticket_expected to 1 if the server will have to issue
2328  *   a new session ticket to the client because the client indicated support
2329  *   (and s->tls_session_secret_cb is NULL) but the client either doesn't have
2330  *   a session ticket or we couldn't use the one it gave us, or if
2331  *   s->ctx->tlsext_ticket_key_cb asked to renew the client's ticket.
2332  *   Otherwise, s->tlsext_ticket_expected is set to 0.
2333  */
2334 int tls1_process_ticket(SSL *s, unsigned char *session_id, int len,
2335                         const unsigned char *limit, SSL_SESSION **ret)
2336         {
2337         /* Point after session ID in client hello */
2338         const unsigned char *p = session_id + len;
2339         unsigned short i;
2340
2341         *ret = NULL;
2342         s->tlsext_ticket_expected = 0;
2343
2344         /* If tickets disabled behave as if no ticket present
2345          * to permit stateful resumption.
2346          */
2347         if (SSL_get_options(s) & SSL_OP_NO_TICKET)
2348                 return 0;
2349         if ((s->version <= SSL3_VERSION) || !limit)
2350                 return 0;
2351         if (p >= limit)
2352                 return -1;
2353         /* Skip past DTLS cookie */
2354         if (s->version == DTLS1_VERSION || s->version == DTLS1_BAD_VER)
2355                 {
2356                 i = *(p++);
2357                 p+= i;
2358                 if (p >= limit)
2359                         return -1;
2360                 }
2361         /* Skip past cipher list */
2362         n2s(p, i);
2363         p+= i;
2364         if (p >= limit)
2365                 return -1;
2366         /* Skip past compression algorithm list */
2367         i = *(p++);
2368         p += i;
2369         if (p > limit)
2370                 return -1;
2371         /* Now at start of extensions */
2372         if ((p + 2) >= limit)
2373                 return 0;
2374         n2s(p, i);
2375         while ((p + 4) <= limit)
2376                 {
2377                 unsigned short type, size;
2378                 n2s(p, type);
2379                 n2s(p, size);
2380                 if (p + size > limit)
2381                         return 0;
2382                 if (type == TLSEXT_TYPE_session_ticket)
2383                         {
2384                         int r;
2385                         if (size == 0)
2386                                 {
2387                                 /* The client will accept a ticket but doesn't
2388                                  * currently have one. */
2389                                 s->tlsext_ticket_expected = 1;
2390                                 return 1;
2391                                 }
2392                         if (s->tls_session_secret_cb)
2393                                 {
2394                                 /* Indicate that the ticket couldn't be
2395                                  * decrypted rather than generating the session
2396                                  * from ticket now, trigger abbreviated
2397                                  * handshake based on external mechanism to
2398                                  * calculate the master secret later. */
2399                                 return 2;
2400                                 }
2401                         r = tls_decrypt_ticket(s, p, size, session_id, len, ret);
2402                         switch (r)
2403                                 {
2404                                 case 2: /* ticket couldn't be decrypted */
2405                                         s->tlsext_ticket_expected = 1;
2406                                         return 2;
2407                                 case 3: /* ticket was decrypted */
2408                                         return r;
2409                                 case 4: /* ticket decrypted but need to renew */
2410                                         s->tlsext_ticket_expected = 1;
2411                                         return 3;
2412                                 default: /* fatal error */
2413                                         return -1;
2414                                 }
2415                         }
2416                 p += size;
2417                 }
2418         return 0;
2419         }
2420
2421 /* tls_decrypt_ticket attempts to decrypt a session ticket.
2422  *
2423  *   etick: points to the body of the session ticket extension.
2424  *   eticklen: the length of the session tickets extenion.
2425  *   sess_id: points at the session ID.
2426  *   sesslen: the length of the session ID.
2427  *   psess: (output) on return, if a ticket was decrypted, then this is set to
2428  *       point to the resulting session.
2429  *
2430  * Returns:
2431  *   -1: fatal error, either from parsing or decrypting the ticket.
2432  *    2: the ticket couldn't be decrypted.
2433  *    3: a ticket was successfully decrypted and *psess was set.
2434  *    4: same as 3, but the ticket needs to be renewed.
2435  */
2436 static int tls_decrypt_ticket(SSL *s, const unsigned char *etick, int eticklen,
2437                                 const unsigned char *sess_id, int sesslen,
2438                                 SSL_SESSION **psess)
2439         {
2440         SSL_SESSION *sess;
2441         unsigned char *sdec;
2442         const unsigned char *p;
2443         int slen, mlen, renew_ticket = 0;
2444         unsigned char tick_hmac[EVP_MAX_MD_SIZE];
2445         HMAC_CTX hctx;
2446         EVP_CIPHER_CTX ctx;
2447         SSL_CTX *tctx = s->initial_ctx;
2448         /* Need at least keyname + iv + some encrypted data */
2449         if (eticklen < 48)
2450                 return 2;
2451         /* Initialize session ticket encryption and HMAC contexts */
2452         HMAC_CTX_init(&hctx);
2453         EVP_CIPHER_CTX_init(&ctx);
2454         if (tctx->tlsext_ticket_key_cb)
2455                 {
2456                 unsigned char *nctick = (unsigned char *)etick;
2457                 int rv = tctx->tlsext_ticket_key_cb(s, nctick, nctick + 16,
2458                                                         &ctx, &hctx, 0);
2459                 if (rv < 0)
2460                         return -1;
2461                 if (rv == 0)
2462                         return 2;
2463                 if (rv == 2)
2464                         renew_ticket = 1;
2465                 }
2466         else
2467                 {
2468                 /* Check key name matches */
2469                 if (memcmp(etick, tctx->tlsext_tick_key_name, 16))
2470                         return 2;
2471                 HMAC_Init_ex(&hctx, tctx->tlsext_tick_hmac_key, 16,
2472                                         tlsext_tick_md(), NULL);
2473                 EVP_DecryptInit_ex(&ctx, EVP_aes_128_cbc(), NULL,
2474                                 tctx->tlsext_tick_aes_key, etick + 16);
2475                 }
2476         /* Attempt to process session ticket, first conduct sanity and
2477          * integrity checks on ticket.
2478          */
2479         mlen = HMAC_size(&hctx);
2480         if (mlen < 0)
2481                 {
2482                 EVP_CIPHER_CTX_cleanup(&ctx);
2483                 return -1;
2484                 }
2485         eticklen -= mlen;
2486         /* Check HMAC of encrypted ticket */
2487         HMAC_Update(&hctx, etick, eticklen);
2488         HMAC_Final(&hctx, tick_hmac, NULL);
2489         HMAC_CTX_cleanup(&hctx);
2490         if (memcmp(tick_hmac, etick + eticklen, mlen))
2491                 return 2;
2492         /* Attempt to decrypt session data */
2493         /* Move p after IV to start of encrypted ticket, update length */
2494         p = etick + 16 + EVP_CIPHER_CTX_iv_length(&ctx);
2495         eticklen -= 16 + EVP_CIPHER_CTX_iv_length(&ctx);
2496         sdec = OPENSSL_malloc(eticklen);
2497         if (!sdec)
2498                 {
2499                 EVP_CIPHER_CTX_cleanup(&ctx);
2500                 return -1;
2501                 }
2502         EVP_DecryptUpdate(&ctx, sdec, &slen, p, eticklen);
2503         if (EVP_DecryptFinal(&ctx, sdec + slen, &mlen) <= 0)
2504                 return 2;
2505         slen += mlen;
2506         EVP_CIPHER_CTX_cleanup(&ctx);
2507         p = sdec;
2508
2509         sess = d2i_SSL_SESSION(NULL, &p, slen);
2510         OPENSSL_free(sdec);
2511         if (sess)
2512                 {
2513                 /* The session ID, if non-empty, is used by some clients to
2514                  * detect that the ticket has been accepted. So we copy it to
2515                  * the session structure. If it is empty set length to zero
2516                  * as required by standard.
2517                  */
2518                 if (sesslen)
2519                         memcpy(sess->session_id, sess_id, sesslen);
2520                 sess->session_id_length = sesslen;
2521                 *psess = sess;
2522                 if (renew_ticket)
2523                         return 4;
2524                 else
2525                         return 3;
2526                 }
2527         ERR_clear_error();
2528         /* For session parse failure, indicate that we need to send a new
2529          * ticket. */
2530         return 2;
2531         }
2532
2533 /* Tables to translate from NIDs to TLS v1.2 ids */
2534
2535 typedef struct
2536         {
2537         int nid;
2538         int id;
2539         } tls12_lookup;
2540
2541 static tls12_lookup tls12_md[] = {
2542         {NID_md5, TLSEXT_hash_md5},
2543         {NID_sha1, TLSEXT_hash_sha1},
2544         {NID_sha224, TLSEXT_hash_sha224},
2545         {NID_sha256, TLSEXT_hash_sha256},
2546         {NID_sha384, TLSEXT_hash_sha384},
2547         {NID_sha512, TLSEXT_hash_sha512}
2548 };
2549
2550 static tls12_lookup tls12_sig[] = {
2551         {EVP_PKEY_RSA, TLSEXT_signature_rsa},
2552         {EVP_PKEY_DSA, TLSEXT_signature_dsa},
2553         {EVP_PKEY_EC, TLSEXT_signature_ecdsa}
2554 };
2555
2556 static int tls12_find_id(int nid, tls12_lookup *table, size_t tlen)
2557         {
2558         size_t i;
2559         for (i = 0; i < tlen; i++)
2560                 {
2561                 if (table[i].nid == nid)
2562                         return table[i].id;
2563                 }
2564         return -1;
2565         }
2566
2567 static int tls12_find_nid(int id, tls12_lookup *table, size_t tlen)
2568         {
2569         size_t i;
2570         for (i = 0; i < tlen; i++)
2571                 {
2572                 if ((table[i].id) == id)
2573                         return table[i].nid;
2574                 }
2575         return NID_undef;
2576         }
2577
2578 int tls12_get_sigandhash(unsigned char *p, const EVP_PKEY *pk, const EVP_MD *md)
2579         {
2580         int sig_id, md_id;
2581         if (!md)
2582                 return 0;
2583         md_id = tls12_find_id(EVP_MD_type(md), tls12_md,
2584                                 sizeof(tls12_md)/sizeof(tls12_lookup));
2585         if (md_id == -1)
2586                 return 0;
2587         sig_id = tls12_get_sigid(pk);
2588         if (sig_id == -1)
2589                 return 0;
2590         p[0] = (unsigned char)md_id;
2591         p[1] = (unsigned char)sig_id;
2592         return 1;
2593         }
2594
2595 int tls12_get_sigid(const EVP_PKEY *pk)
2596         {
2597         return tls12_find_id(pk->type, tls12_sig,
2598                                 sizeof(tls12_sig)/sizeof(tls12_lookup));
2599         }
2600
2601 const EVP_MD *tls12_get_hash(unsigned char hash_alg)
2602         {
2603         switch(hash_alg)
2604                 {
2605 #ifndef OPENSSL_NO_MD5
2606                 case TLSEXT_hash_md5:
2607 #ifdef OPENSSL_FIPS
2608                 if (FIPS_mode())
2609                         return NULL;
2610 #endif
2611                 return EVP_md5();
2612 #endif
2613 #ifndef OPENSSL_NO_SHA
2614                 case TLSEXT_hash_sha1:
2615                 return EVP_sha1();
2616 #endif
2617 #ifndef OPENSSL_NO_SHA256
2618                 case TLSEXT_hash_sha224:
2619                 return EVP_sha224();
2620
2621                 case TLSEXT_hash_sha256:
2622                 return EVP_sha256();
2623 #endif
2624 #ifndef OPENSSL_NO_SHA512
2625                 case TLSEXT_hash_sha384:
2626                 return EVP_sha384();
2627
2628                 case TLSEXT_hash_sha512:
2629                 return EVP_sha512();
2630 #endif
2631                 default:
2632                 return NULL;
2633
2634                 }
2635         }
2636
2637 /* Set preferred digest for each key type */
2638
2639 int tls1_process_sigalgs(SSL *s, const unsigned char *data, int dsize)
2640         {
2641         int i, idx;
2642         const EVP_MD *md;
2643         CERT *c = s->cert;
2644         TLS_SIGALGS *sigptr;
2645         /* Extension ignored for TLS versions below 1.2 */
2646         if (TLS1_get_version(s) < TLS1_2_VERSION)
2647                 return 1;
2648         /* Should never happen */
2649         if (!c)
2650                 return 0;
2651
2652         c->pkeys[SSL_PKEY_DSA_SIGN].digest = NULL;
2653         c->pkeys[SSL_PKEY_RSA_SIGN].digest = NULL;
2654         c->pkeys[SSL_PKEY_RSA_ENC].digest = NULL;
2655         c->pkeys[SSL_PKEY_ECC].digest = NULL;
2656
2657         if (c->sigalgs)
2658                 OPENSSL_free(c->sigalgs);
2659         c->sigalgs = OPENSSL_malloc((dsize/2) * sizeof(TLS_SIGALGS));
2660         if (!c->sigalgs)
2661                 return 0;
2662         c->sigalgslen = dsize/2;
2663
2664         for (i = 0, sigptr = c->sigalgs; i < dsize; i += 2, sigptr++)
2665                 {
2666                 sigptr->rhash = data[i];
2667                 sigptr->rsign = data[i + 1];
2668                 sigptr->hash_nid = tls12_find_nid(sigptr->rhash, tls12_md,
2669                                         sizeof(tls12_md)/sizeof(tls12_lookup));
2670                 sigptr->sign_nid = tls12_find_nid(sigptr->rsign, tls12_sig,
2671                                         sizeof(tls12_sig)/sizeof(tls12_lookup));
2672                 if (!OBJ_find_sigid_by_algs(&sigptr->signandhash_nid,
2673                                                 sigptr->hash_nid,
2674                                                 sigptr->sign_nid))
2675                         sigptr->signandhash_nid = NID_undef;
2676                 switch(sigptr->rsign)
2677                         {
2678 #ifndef OPENSSL_NO_RSA
2679                         case TLSEXT_signature_rsa:
2680                         idx = SSL_PKEY_RSA_SIGN;
2681                         break;
2682 #endif
2683 #ifndef OPENSSL_NO_DSA
2684                         case TLSEXT_signature_dsa:
2685                         idx = SSL_PKEY_DSA_SIGN;
2686                         break;
2687 #endif
2688 #ifndef OPENSSL_NO_ECDSA
2689                         case TLSEXT_signature_ecdsa:
2690                         idx = SSL_PKEY_ECC;
2691                         break;
2692 #endif
2693                         default:
2694                         continue;
2695                         }
2696
2697                 if (c->pkeys[idx].digest == NULL)
2698                         {
2699                         md = tls12_get_hash(sigptr->rhash);
2700                         if (md)
2701                                 {
2702                                 c->pkeys[idx].digest = md;
2703                                 if (idx == SSL_PKEY_RSA_SIGN)
2704                                         c->pkeys[SSL_PKEY_RSA_ENC].digest = md;
2705                                 }
2706                         }
2707
2708                 }
2709
2710
2711         /* Set any remaining keys to default values. NOTE: if alg is not
2712          * supported it stays as NULL.
2713          */
2714 #ifndef OPENSSL_NO_DSA
2715         if (!c->pkeys[SSL_PKEY_DSA_SIGN].digest)
2716                 c->pkeys[SSL_PKEY_DSA_SIGN].digest = EVP_dss1();
2717 #endif
2718 #ifndef OPENSSL_NO_RSA
2719         if (!c->pkeys[SSL_PKEY_RSA_SIGN].digest)
2720                 {
2721                 c->pkeys[SSL_PKEY_RSA_SIGN].digest = EVP_sha1();
2722                 c->pkeys[SSL_PKEY_RSA_ENC].digest = EVP_sha1();
2723                 }
2724 #endif
2725 #ifndef OPENSSL_NO_ECDSA
2726         if (!c->pkeys[SSL_PKEY_ECC].digest)
2727                 c->pkeys[SSL_PKEY_ECC].digest = EVP_ecdsa();
2728 #endif
2729         return 1;
2730         }
2731
2732 #endif
2733
2734 int SSL_get_sigalgs(SSL *s, int idx,
2735                         int *psign, int *phash, int *psignandhash,
2736                         unsigned char *rsig, unsigned char *rhash)
2737         {
2738         if (s->cert->sigalgs == NULL)
2739                 return 0;
2740         if (idx >= 0)
2741                 {
2742                 TLS_SIGALGS *psig;
2743                 if (idx >= (int)s->cert->sigalgslen)
2744                         return 0;
2745                 psig = s->cert->sigalgs + idx;
2746                 if (psign)
2747                         *psign = psig->sign_nid;
2748                 if (phash)
2749                         *phash = psig->hash_nid;
2750                 if (psignandhash)
2751                         *psignandhash = psig->signandhash_nid;
2752                 if (rsig)
2753                         *rsig = psig->rsign;
2754                 if (rhash)
2755                         *rhash = psig->rhash;
2756                 }
2757         return s->cert->sigalgslen;
2758         }
2759
2760
2761 #ifndef OPENSSL_NO_HEARTBEATS
2762 int
2763 tls1_process_heartbeat(SSL *s)
2764         {
2765         unsigned char *p = &s->s3->rrec.data[0], *pl;
2766         unsigned short hbtype;
2767         unsigned int payload;
2768         unsigned int padding = 16; /* Use minimum padding */
2769
2770         /* Read type and payload length first */
2771         hbtype = *p++;
2772         n2s(p, payload);
2773         pl = p;
2774
2775         if (s->msg_callback)
2776                 s->msg_callback(0, s->version, TLS1_RT_HEARTBEAT,
2777                         &s->s3->rrec.data[0], s->s3->rrec.length,
2778                         s, s->msg_callback_arg);
2779
2780         if (hbtype == TLS1_HB_REQUEST)
2781                 {
2782                 unsigned char *buffer, *bp;
2783                 int r;
2784
2785                 /* Allocate memory for the response, size is 1 bytes
2786                  * message type, plus 2 bytes payload length, plus
2787                  * payload, plus padding
2788                  */
2789                 buffer = OPENSSL_malloc(1 + 2 + payload + padding);
2790                 bp = buffer;
2791
2792                 /* Enter response type, length and copy payload */
2793                 *bp++ = TLS1_HB_RESPONSE;
2794                 s2n(payload, bp);
2795                 memcpy(bp, pl, payload);
2796                 bp += payload;
2797                 /* Random padding */
2798                 RAND_pseudo_bytes(bp, padding);
2799
2800                 r = ssl3_write_bytes(s, TLS1_RT_HEARTBEAT, buffer, 3 + payload + padding);
2801
2802                 if (r >= 0 && s->msg_callback)
2803                         s->msg_callback(1, s->version, TLS1_RT_HEARTBEAT,
2804                                 buffer, 3 + payload + padding,
2805                                 s, s->msg_callback_arg);
2806
2807                 OPENSSL_free(buffer);
2808
2809                 if (r < 0)
2810                         return r;
2811                 }
2812         else if (hbtype == TLS1_HB_RESPONSE)
2813                 {
2814                 unsigned int seq;
2815
2816                 /* We only send sequence numbers (2 bytes unsigned int),
2817                  * and 16 random bytes, so we just try to read the
2818                  * sequence number */
2819                 n2s(pl, seq);
2820
2821                 if (payload == 18 && seq == s->tlsext_hb_seq)
2822                         {
2823                         s->tlsext_hb_seq++;
2824                         s->tlsext_hb_pending = 0;
2825                         }
2826                 }
2827
2828         return 0;
2829         }
2830
2831 int
2832 tls1_heartbeat(SSL *s)
2833         {
2834         unsigned char *buf, *p;
2835         int ret;
2836         unsigned int payload = 18; /* Sequence number + random bytes */
2837         unsigned int padding = 16; /* Use minimum padding */
2838
2839         /* Only send if peer supports and accepts HB requests... */
2840         if (!(s->tlsext_heartbeat & SSL_TLSEXT_HB_ENABLED) ||
2841             s->tlsext_heartbeat & SSL_TLSEXT_HB_DONT_SEND_REQUESTS)
2842                 {
2843                 SSLerr(SSL_F_TLS1_HEARTBEAT,SSL_R_TLS_HEARTBEAT_PEER_DOESNT_ACCEPT);
2844                 return -1;
2845                 }
2846
2847         /* ...and there is none in flight yet... */
2848         if (s->tlsext_hb_pending)
2849                 {
2850                 SSLerr(SSL_F_TLS1_HEARTBEAT,SSL_R_TLS_HEARTBEAT_PENDING);
2851                 return -1;
2852                 }
2853
2854         /* ...and no handshake in progress. */
2855         if (SSL_in_init(s) || s->in_handshake)
2856                 {
2857                 SSLerr(SSL_F_TLS1_HEARTBEAT,SSL_R_UNEXPECTED_MESSAGE);
2858                 return -1;
2859                 }
2860
2861         /* Check if padding is too long, payload and padding
2862          * must not exceed 2^14 - 3 = 16381 bytes in total.
2863          */
2864         OPENSSL_assert(payload + padding <= 16381);
2865
2866         /* Create HeartBeat message, we just use a sequence number
2867          * as payload to distuingish different messages and add
2868          * some random stuff.
2869          *  - Message Type, 1 byte
2870          *  - Payload Length, 2 bytes (unsigned int)
2871          *  - Payload, the sequence number (2 bytes uint)
2872          *  - Payload, random bytes (16 bytes uint)
2873          *  - Padding
2874          */
2875         buf = OPENSSL_malloc(1 + 2 + payload + padding);
2876         p = buf;
2877         /* Message Type */
2878         *p++ = TLS1_HB_REQUEST;
2879         /* Payload length (18 bytes here) */
2880         s2n(payload, p);
2881         /* Sequence number */
2882         s2n(s->tlsext_hb_seq, p);
2883         /* 16 random bytes */
2884         RAND_pseudo_bytes(p, 16);
2885         p += 16;
2886         /* Random padding */
2887         RAND_pseudo_bytes(p, padding);
2888
2889         ret = ssl3_write_bytes(s, TLS1_RT_HEARTBEAT, buf, 3 + payload + padding);
2890         if (ret >= 0)
2891                 {
2892                 if (s->msg_callback)
2893                         s->msg_callback(1, s->version, TLS1_RT_HEARTBEAT,
2894                                 buf, 3 + payload + padding,
2895                                 s, s->msg_callback_arg);
2896
2897                 s->tlsext_hb_pending = 1;
2898                 }
2899
2900         OPENSSL_free(buf);
2901
2902         return ret;
2903         }
2904 #endif