ssl/t1_lib.c

   1 /* ssl/t1_lib.c */
   2 /* Copyright (C) 1995-1998 Eric Young (eay@cryptsoft.com)
   3  * All rights reserved.
   4  *
   5  * This package is an SSL implementation written
   6  * by Eric Young (eay@cryptsoft.com).
   7  * The implementation was written so as to conform with Netscapes SSL.
   8  *
   9  * This library is free for commercial and non-commercial use as long as
  10  * the following conditions are aheared to.  The following conditions
  11  * apply to all code found in this distribution, be it the RC4, RSA,
  12  * lhash, DES, etc., code; not just the SSL code.  The SSL documentation
  13  * included with this distribution is covered by the same copyright terms
  14  * except that the holder is Tim Hudson (tjh@cryptsoft.com).
  15  *
  16  * Copyright remains Eric Young's, and as such any Copyright notices in
  17  * the code are not to be removed.
  18  * If this package is used in a product, Eric Young should be given attribution
  19  * as the author of the parts of the library used.
  20  * This can be in the form of a textual message at program startup or
  21  * in documentation (online or textual) provided with the package.
  22  *
  23  * Redistribution and use in source and binary forms, with or without
  24  * modification, are permitted provided that the following conditions
  25  * are met:
  26  * 1. Redistributions of source code must retain the copyright
  27  *    notice, this list of conditions and the following disclaimer.
  28  * 2. Redistributions in binary form must reproduce the above copyright
  29  *    notice, this list of conditions and the following disclaimer in the
  30  *    documentation and/or other materials provided with the distribution.
  31  * 3. All advertising materials mentioning features or use of this software
  32  *    must display the following acknowledgement:
  33  *    "This product includes cryptographic software written by
  34  *     Eric Young (eay@cryptsoft.com)"
  35  *    The word 'cryptographic' can be left out if the rouines from the library
  36  *    being used are not cryptographic related :-).
  37  * 4. If you include any Windows specific code (or a derivative thereof) from
  38  *    the apps directory (application code) you must include an acknowledgement:
  39  *    "This product includes software written by Tim Hudson (tjh@cryptsoft.com)"
  40  *
  41  * THIS SOFTWARE IS PROVIDED BY ERIC YOUNG ``AS IS'' AND
  42  * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
  43  * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
  44  * ARE DISCLAIMED.  IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE
  45  * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
  46  * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
  47  * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
  48  * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
  49  * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
  50  * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
  51  * SUCH DAMAGE.
  52  *
  53  * The licence and distribution terms for any publically available version or
  54  * derivative of this code cannot be changed.  i.e. this code cannot simply be
  55  * copied and put under another distribution licence
  56  * [including the GNU Public Licence.]
  57  */
  58 /* ====================================================================
  59  * Copyright (c) 1998-2007 The OpenSSL Project.  All rights reserved.
  60  *
  61  * Redistribution and use in source and binary forms, with or without
  62  * modification, are permitted provided that the following conditions
  63  * are met:
  64  *
  65  * 1. Redistributions of source code must retain the above copyright
  66  *    notice, this list of conditions and the following disclaimer.
  67  *
  68  * 2. Redistributions in binary form must reproduce the above copyright
  69  *    notice, this list of conditions and the following disclaimer in
  70  *    the documentation and/or other materials provided with the
  71  *    distribution.
  72  *
  73  * 3. All advertising materials mentioning features or use of this
  74  *    software must display the following acknowledgment:
  75  *    "This product includes software developed by the OpenSSL Project
  76  *    for use in the OpenSSL Toolkit. (http://www.openssl.org/)"
  77  *
  78  * 4. The names "OpenSSL Toolkit" and "OpenSSL Project" must not be used to
  79  *    endorse or promote products derived from this software without
  80  *    prior written permission. For written permission, please contact
  81  *    openssl-core@openssl.org.
  82  *
  83  * 5. Products derived from this software may not be called "OpenSSL"
  84  *    nor may "OpenSSL" appear in their names without prior written
  85  *    permission of the OpenSSL Project.
  86  *
  87  * 6. Redistributions of any form whatsoever must retain the following
  88  *    acknowledgment:
  89  *    "This product includes software developed by the OpenSSL Project
  90  *    for use in the OpenSSL Toolkit (http://www.openssl.org/)"
  91  *
  92  * THIS SOFTWARE IS PROVIDED BY THE OpenSSL PROJECT ``AS IS'' AND ANY
  93  * EXPRESSED OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
  94  * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
  95  * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL THE OpenSSL PROJECT OR
  96  * ITS CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
  97  * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
  98  * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
  99  * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
 100  * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT,
 101  * STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
 102  * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED
 103  * OF THE POSSIBILITY OF SUCH DAMAGE.
 104  * ====================================================================
 105  *
 106  * This product includes cryptographic software written by Eric Young
 107  * (eay@cryptsoft.com).  This product includes software written by Tim
 108  * Hudson (tjh@cryptsoft.com).
 109  *
 110  */
 111
 112 #include <stdio.h>
 113 #include <openssl/objects.h>
 114 #include <openssl/evp.h>
 115 #include <openssl/hmac.h>
 116 #include <openssl/ocsp.h>
 117 #include "ssl_locl.h"
 118
 119 const char tls1_version_str[]="TLSv1" OPENSSL_VERSION_PTEXT;
 120
 121 #ifndef OPENSSL_NO_TLSEXT
 122 static int tls_decrypt_ticket(SSL *s, const unsigned char *tick, int ticklen,
 123                                 const unsigned char *sess_id, int sesslen,
 124                                 SSL_SESSION **psess);
 125 #endif
 126
 127 SSL3_ENC_METHOD TLSv1_enc_data={
 128         tls1_enc,
 129         tls1_mac,
 130         tls1_setup_key_block,
 131         tls1_generate_master_secret,
 132         tls1_change_cipher_state,
 133         tls1_final_finish_mac,
 134         TLS1_FINISH_MAC_LENGTH,
 135         tls1_cert_verify_mac,
 136         TLS_MD_CLIENT_FINISH_CONST,TLS_MD_CLIENT_FINISH_CONST_SIZE,
 137         TLS_MD_SERVER_FINISH_CONST,TLS_MD_SERVER_FINISH_CONST_SIZE,
 138         tls1_alert_code,
 139         };
 140
 141 long tls1_default_timeout(void)
 142         {
 143         /* 2 hours, the 24 hours mentioned in the TLSv1 spec
 144          * is way too long for http, the cache would over fill */
 145         return(60*60*2);
 146         }
 147
 148 int tls1_new(SSL *s)
 149         {
 150         if (!ssl3_new(s)) return(0);
 151         s->method->ssl_clear(s);
 152         return(1);
 153         }
 154
 155 void tls1_free(SSL *s)
 156         {
 157 #ifndef OPENSSL_NO_TLSEXT
 158         if (s->tlsext_session_ticket)
 159                 {
 160                 OPENSSL_free(s->tlsext_session_ticket);
 161                 }
 162 #endif /* OPENSSL_NO_TLSEXT */
 163         ssl3_free(s);
 164         }
 165
 166 void tls1_clear(SSL *s)
 167         {
 168         ssl3_clear(s);
 169         s->version=TLS1_VERSION;
 170         }
 171
 172 #ifndef OPENSSL_NO_EC
 173 static int nid_list[] =
 174         {
 175                 NID_sect163k1, /* sect163k1 (1) */
 176                 NID_sect163r1, /* sect163r1 (2) */
 177                 NID_sect163r2, /* sect163r2 (3) */
 178                 NID_sect193r1, /* sect193r1 (4) */
 179                 NID_sect193r2, /* sect193r2 (5) */
 180                 NID_sect233k1, /* sect233k1 (6) */
 181                 NID_sect233r1, /* sect233r1 (7) */
 182                 NID_sect239k1, /* sect239k1 (8) */
 183                 NID_sect283k1, /* sect283k1 (9) */
 184                 NID_sect283r1, /* sect283r1 (10) */
 185                 NID_sect409k1, /* sect409k1 (11) */
 186                 NID_sect409r1, /* sect409r1 (12) */
 187                 NID_sect571k1, /* sect571k1 (13) */
 188                 NID_sect571r1, /* sect571r1 (14) */
 189                 NID_secp160k1, /* secp160k1 (15) */
 190                 NID_secp160r1, /* secp160r1 (16) */
 191                 NID_secp160r2, /* secp160r2 (17) */
 192                 NID_secp192k1, /* secp192k1 (18) */
 193                 NID_X9_62_prime192v1, /* secp192r1 (19) */
 194                 NID_secp224k1, /* secp224k1 (20) */
 195                 NID_secp224r1, /* secp224r1 (21) */
 196                 NID_secp256k1, /* secp256k1 (22) */
 197                 NID_X9_62_prime256v1, /* secp256r1 (23) */
 198                 NID_secp384r1, /* secp384r1 (24) */
 199                 NID_secp521r1  /* secp521r1 (25) */
 200         };
 201
 202 int tls1_ec_curve_id2nid(int curve_id)
 203         {
 204         /* ECC curves from draft-ietf-tls-ecc-12.txt (Oct. 17, 2005) */
 205         if ((curve_id < 1) || ((unsigned int)curve_id >
 206                                 sizeof(nid_list)/sizeof(nid_list[0])))
 207                 return 0;
 208         return nid_list[curve_id-1];
 209         }
 210
 211 int tls1_ec_nid2curve_id(int nid)
 212         {
 213         /* ECC curves from draft-ietf-tls-ecc-12.txt (Oct. 17, 2005) */
 214         switch (nid)
 215                 {
 216         case NID_sect163k1: /* sect163k1 (1) */
 217                 return 1;
 218         case NID_sect163r1: /* sect163r1 (2) */
 219                 return 2;
 220         case NID_sect163r2: /* sect163r2 (3) */
 221                 return 3;
 222         case NID_sect193r1: /* sect193r1 (4) */
 223                 return 4;
 224         case NID_sect193r2: /* sect193r2 (5) */
 225                 return 5;
 226         case NID_sect233k1: /* sect233k1 (6) */
 227                 return 6;
 228         case NID_sect233r1: /* sect233r1 (7) */
 229                 return 7;
 230         case NID_sect239k1: /* sect239k1 (8) */
 231                 return 8;
 232         case NID_sect283k1: /* sect283k1 (9) */
 233                 return 9;
 234         case NID_sect283r1: /* sect283r1 (10) */
 235                 return 10;
 236         case NID_sect409k1: /* sect409k1 (11) */
 237                 return 11;
 238         case NID_sect409r1: /* sect409r1 (12) */
 239                 return 12;
 240         case NID_sect571k1: /* sect571k1 (13) */
 241                 return 13;
 242         case NID_sect571r1: /* sect571r1 (14) */
 243                 return 14;
 244         case NID_secp160k1: /* secp160k1 (15) */
 245                 return 15;
 246         case NID_secp160r1: /* secp160r1 (16) */
 247                 return 16;
 248         case NID_secp160r2: /* secp160r2 (17) */
 249                 return 17;
 250         case NID_secp192k1: /* secp192k1 (18) */
 251                 return 18;
 252         case NID_X9_62_prime192v1: /* secp192r1 (19) */
 253                 return 19;
 254         case NID_secp224k1: /* secp224k1 (20) */
 255                 return 20;
 256         case NID_secp224r1: /* secp224r1 (21) */
 257                 return 21;
 258         case NID_secp256k1: /* secp256k1 (22) */
 259                 return 22;
 260         case NID_X9_62_prime256v1: /* secp256r1 (23) */
 261                 return 23;
 262         case NID_secp384r1: /* secp384r1 (24) */
 263                 return 24;
 264         case NID_secp521r1:  /* secp521r1 (25) */
 265                 return 25;
 266         default:
 267                 return 0;
 268                 }
 269         }
 270 #endif /* OPENSSL_NO_EC */
 271
 272 #ifndef OPENSSL_NO_TLSEXT
 273 unsigned char *ssl_add_clienthello_tlsext(SSL *s, unsigned char *p, unsigned char *limit)
 274         {
 275         int extdatalen=0;
 276         unsigned char *ret = p;
 277
 278         /* don't add extensions for SSLv3 */
 279         if (s->client_version == SSL3_VERSION)
 280                 return p;
 281
 282         ret+=2;
 283
 284         if (ret>=limit) return NULL; /* this really never occurs, but ... */
 285
 286         if (s->tlsext_hostname != NULL)
 287                 {
 288                 /* Add TLS extension servername to the Client Hello message */
 289                 unsigned long size_str;
 290                 long lenmax;
 291
 292                 /* check for enough space.
 293                    4 for the servername type and entension length
 294                    2 for servernamelist length
 295                    1 for the hostname type
 296                    2 for hostname length
 297                    + hostname length
 298                 */
 299
 300                 if ((lenmax = limit - ret - 9) < 0
 301                     || (size_str = strlen(s->tlsext_hostname)) > (unsigned long)lenmax)
 302                         return NULL;
 303
 304                 /* extension type and length */
 305                 s2n(TLSEXT_TYPE_server_name,ret);
 306                 s2n(size_str+5,ret);
 307
 308                 /* length of servername list */
 309                 s2n(size_str+3,ret);
 310
 311                 /* hostname type, length and hostname */
 312                 *(ret++) = (unsigned char) TLSEXT_NAMETYPE_host_name;
 313                 s2n(size_str,ret);
 314                 memcpy(ret, s->tlsext_hostname, size_str);
 315                 ret+=size_str;
 316                 }
 317
 318 #ifndef OPENSSL_NO_EC
 319         if (s->tlsext_ecpointformatlist != NULL)
 320                 {
 321                 /* Add TLS extension ECPointFormats to the ClientHello message */
 322                 long lenmax;
 323
 324                 if ((lenmax = limit - ret - 5) < 0) return NULL;
 325                 if (s->tlsext_ecpointformatlist_length > (unsigned long)lenmax) return NULL;
 326                 if (s->tlsext_ecpointformatlist_length > 255)
 327                         {
 328                         SSLerr(SSL_F_SSL_ADD_CLIENTHELLO_TLSEXT, ERR_R_INTERNAL_ERROR);
 329                         return NULL;
 330                         }
 331
 332                 s2n(TLSEXT_TYPE_ec_point_formats,ret);
 333                 s2n(s->tlsext_ecpointformatlist_length + 1,ret);
 334                 *(ret++) = (unsigned char) s->tlsext_ecpointformatlist_length;
 335                 memcpy(ret, s->tlsext_ecpointformatlist, s->tlsext_ecpointformatlist_length);
 336                 ret+=s->tlsext_ecpointformatlist_length;
 337                 }
 338         if (s->tlsext_ellipticcurvelist != NULL)
 339                 {
 340                 /* Add TLS extension EllipticCurves to the ClientHello message */
 341                 long lenmax;
 342
 343                 if ((lenmax = limit - ret - 6) < 0) return NULL;
 344                 if (s->tlsext_ellipticcurvelist_length > (unsigned long)lenmax) return NULL;
 345                 if (s->tlsext_ellipticcurvelist_length > 65532)
 346                         {
 347                         SSLerr(SSL_F_SSL_ADD_CLIENTHELLO_TLSEXT, ERR_R_INTERNAL_ERROR);
 348                         return NULL;
 349                         }
 350
 351                 s2n(TLSEXT_TYPE_elliptic_curves,ret);
 352                 s2n(s->tlsext_ellipticcurvelist_length + 2, ret);
 353
 354                 /* NB: draft-ietf-tls-ecc-12.txt uses a one-byte prefix for
 355                  * elliptic_curve_list, but the examples use two bytes.
 356                  * http://www1.ietf.org/mail-archive/web/tls/current/msg00538.html
 357                  * resolves this to two bytes.
 358                  */
 359                 s2n(s->tlsext_ellipticcurvelist_length, ret);
 360                 memcpy(ret, s->tlsext_ellipticcurvelist, s->tlsext_ellipticcurvelist_length);
 361                 ret+=s->tlsext_ellipticcurvelist_length;
 362                 }
 363 #endif /* OPENSSL_NO_EC */
 364
 365         if (!(SSL_get_options(s) & SSL_OP_NO_TICKET))
 366                 {
 367                 int ticklen;
 368                 if (s->session && s->session->tlsext_tick)
 369                         ticklen = s->session->tlsext_ticklen;
 370                 else if (s->session && s->tlsext_session_ticket &&
 371                          s->tlsext_session_ticket->data)
 372                         {
 373                         ticklen = s->tlsext_session_ticket->length;
 374                         s->session->tlsext_tick = OPENSSL_malloc(ticklen);
 375                         if (!s->session->tlsext_tick)
 376                                 return NULL;
 377                         memcpy(s->session->tlsext_tick,
 378                                s->tlsext_session_ticket->data,
 379                                ticklen);
 380                         s->session->tlsext_ticklen = ticklen;
 381                         }
 382                 else
 383                         ticklen = 0;
 384                 if (ticklen == 0 && s->tlsext_session_ticket &&
 385                     s->tlsext_session_ticket->data == NULL)
 386                         goto skip_ext;
 387                 /* Check for enough room 2 for extension type, 2 for len
 388                  * rest for ticket
 389                  */
 390                 if ((long)(limit - ret - 4 - ticklen) < 0) return NULL;
 391                 s2n(TLSEXT_TYPE_session_ticket,ret);
 392                 s2n(ticklen,ret);
 393                 if (ticklen)
 394                         {
 395                         memcpy(ret, s->session->tlsext_tick, ticklen);
 396                         ret += ticklen;
 397                         }
 398                 }
 399                 skip_ext:
 400
 401 #ifdef TLSEXT_TYPE_opaque_prf_input
 402         if (s->s3->client_opaque_prf_input != NULL)
 403                 {
 404                 size_t col = s->s3->client_opaque_prf_input_len;
 405
 406                 if ((long)(limit - ret - 6 - col < 0))
 407                         return NULL;
 408                 if (col > 0xFFFD) /* can't happen */
 409                         return NULL;
 410
 411                 s2n(TLSEXT_TYPE_opaque_prf_input, ret);
 412                 s2n(col + 2, ret);
 413                 s2n(col, ret);
 414                 memcpy(ret, s->s3->client_opaque_prf_input, col);
 415                 ret += col;
 416                 }
 417 #endif
 418
 419         if (s->tlsext_status_type == TLSEXT_STATUSTYPE_ocsp)
 420                 {
 421                 int i;
 422                 long extlen, idlen, itmp;
 423                 OCSP_RESPID *id;
 424
 425                 idlen = 0;
 426                 for (i = 0; i < sk_OCSP_RESPID_num(s->tlsext_ocsp_ids); i++)
 427                         {
 428                         id = sk_OCSP_RESPID_value(s->tlsext_ocsp_ids, i);
 429                         itmp = i2d_OCSP_RESPID(id, NULL);
 430                         if (itmp <= 0)
 431                                 return NULL;
 432                         idlen += itmp + 2;
 433                         }
 434
 435                 if (s->tlsext_ocsp_exts)
 436                         {
 437                         extlen = i2d_X509_EXTENSIONS(s->tlsext_ocsp_exts, NULL);
 438                         if (extlen < 0)
 439                                 return NULL;
 440                         }
 441                 else
 442                         extlen = 0;
 443
 444                 if ((long)(limit - ret - 7 - extlen - idlen) < 0) return NULL;
 445                 s2n(TLSEXT_TYPE_status_request, ret);
 446                 if (extlen + idlen > 0xFFF0)
 447                         return NULL;
 448                 s2n(extlen + idlen + 5, ret);
 449                 *(ret++) = TLSEXT_STATUSTYPE_ocsp;
 450                 s2n(idlen, ret);
 451                 for (i = 0; i < sk_OCSP_RESPID_num(s->tlsext_ocsp_ids); i++)
 452                         {
 453                         /* save position of id len */
 454                         unsigned char *q = ret;
 455                         id = sk_OCSP_RESPID_value(s->tlsext_ocsp_ids, i);
 456                         /* skip over id len */
 457                         ret += 2;
 458                         itmp = i2d_OCSP_RESPID(id, &ret);
 459                         /* write id len */
 460                         s2n(itmp, q);
 461                         }
 462                 s2n(extlen, ret);
 463                 if (extlen > 0)
 464                         i2d_X509_EXTENSIONS(s->tlsext_ocsp_exts, &ret);
 465                 }
 466
 467         if ((extdatalen = ret-p-2)== 0)
 468                 return p;
 469
 470         s2n(extdatalen,p);
 471         return ret;
 472         }
 473
 474 unsigned char *ssl_add_serverhello_tlsext(SSL *s, unsigned char *p, unsigned char *limit)
 475         {
 476         int extdatalen=0;
 477         unsigned char *ret = p;
 478
 479         /* don't add extensions for SSLv3 */
 480         if (s->version == SSL3_VERSION)
 481                 return p;
 482
 483         ret+=2;
 484         if (ret>=limit) return NULL; /* this really never occurs, but ... */
 485
 486         if (!s->hit && s->servername_done == 1 && s->session->tlsext_hostname != NULL)
 487                 {
 488                 if ((long)(limit - ret - 4) < 0) return NULL;
 489
 490                 s2n(TLSEXT_TYPE_server_name,ret);
 491                 s2n(0,ret);
 492                 }
 493 #ifndef OPENSSL_NO_EC
 494         if (s->tlsext_ecpointformatlist != NULL)
 495                 {
 496                 /* Add TLS extension ECPointFormats to the ServerHello message */
 497                 long lenmax;
 498
 499                 if ((lenmax = limit - ret - 5) < 0) return NULL;
 500                 if (s->tlsext_ecpointformatlist_length > (unsigned long)lenmax) return NULL;
 501                 if (s->tlsext_ecpointformatlist_length > 255)
 502                         {
 503                         SSLerr(SSL_F_SSL_ADD_SERVERHELLO_TLSEXT, ERR_R_INTERNAL_ERROR);
 504                         return NULL;
 505                         }
 506
 507                 s2n(TLSEXT_TYPE_ec_point_formats,ret);
 508                 s2n(s->tlsext_ecpointformatlist_length + 1,ret);
 509                 *(ret++) = (unsigned char) s->tlsext_ecpointformatlist_length;
 510                 memcpy(ret, s->tlsext_ecpointformatlist, s->tlsext_ecpointformatlist_length);
 511                 ret+=s->tlsext_ecpointformatlist_length;
 512
 513                 }
 514         /* Currently the server should not respond with a SupportedCurves extension */
 515 #endif /* OPENSSL_NO_EC */
 516
 517         if (s->tlsext_ticket_expected
 518                 && !(SSL_get_options(s) & SSL_OP_NO_TICKET))
 519                 {
 520                 if ((long)(limit - ret - 4) < 0) return NULL;
 521                 s2n(TLSEXT_TYPE_session_ticket,ret);
 522                 s2n(0,ret);
 523                 }
 524
 525         if (s->tlsext_status_expected)
 526                 {
 527                 if ((long)(limit - ret - 4) < 0) return NULL;
 528                 s2n(TLSEXT_TYPE_status_request,ret);
 529                 s2n(0,ret);
 530                 }
 531
 532 #ifdef TLSEXT_TYPE_opaque_prf_input
 533         if (s->s3->server_opaque_prf_input != NULL)
 534                 {
 535                 size_t sol = s->s3->server_opaque_prf_input_len;
 536
 537                 if ((long)(limit - ret - 6 - sol) < 0)
 538                         return NULL;
 539                 if (sol > 0xFFFD) /* can't happen */
 540                         return NULL;
 541
 542                 s2n(TLSEXT_TYPE_opaque_prf_input, ret);
 543                 s2n(sol + 2, ret);
 544                 s2n(sol, ret);
 545                 memcpy(ret, s->s3->server_opaque_prf_input, sol);
 546                 ret += sol;
 547                 }
 548 #endif
 549         if (((s->s3->tmp.new_cipher->id & 0xFFFF)==0x80 || (s->s3->tmp.new_cipher->id & 0xFFFF)==0x81)
 550                 && (SSL_get_options(s) & SSL_OP_CRYPTOPRO_TLSEXT_BUG))
 551                 { const unsigned char cryptopro_ext[36] = {
 552                         0xfd, 0xe8, /*65000*/
 553                         0x00, 0x20, /*32 bytes length*/
 554                         0x30, 0x1e, 0x30, 0x08, 0x06, 0x06, 0x2a, 0x85,
 555                         0x03,   0x02, 0x02, 0x09, 0x30, 0x08, 0x06, 0x06,
 556                         0x2a, 0x85, 0x03, 0x02, 0x02, 0x16, 0x30, 0x08,
 557                         0x06, 0x06, 0x2a, 0x85, 0x03, 0x02, 0x02, 0x17};
 558                         if (limit-ret<36) return NULL;
 559                         memcpy(ret,cryptopro_ext,36);
 560                         ret+=36;
 561
 562                 }
 563
 564         if ((extdatalen = ret-p-2)== 0)
 565                 return p;
 566
 567         s2n(extdatalen,p);
 568         return ret;
 569         }
 570
 571 int ssl_parse_clienthello_tlsext(SSL *s, unsigned char **p, unsigned char *d, int n, int *al)
 572         {
 573         unsigned short type;
 574         unsigned short size;
 575         unsigned short len;
 576         unsigned char *data = *p;
 577         s->servername_done = 0;
 578         s->tlsext_status_type = -1;
 579
 580         if (data >= (d+n-2))
 581                 return 1;
 582         n2s(data,len);
 583
 584         if (data > (d+n-len))
 585                 return 1;
 586
 587         while (data <= (d+n-4))
 588                 {
 589                 n2s(data,type);
 590                 n2s(data,size);
 591
 592                 if (data+size > (d+n))
 593                         return 1;
 594 #if 0
 595                 fprintf(stderr,"Received extension type %d size %d\n",type,size);
 596 #endif
 597                 if (s->tlsext_debug_cb)
 598                         s->tlsext_debug_cb(s, 0, type, data, size,
 599                                                 s->tlsext_debug_arg);
 600 /* The servername extension is treated as follows:
 601
 602    - Only the hostname type is supported with a maximum length of 255.
 603    - The servername is rejected if too long or if it contains zeros,
 604      in which case an fatal alert is generated.
 605    - The servername field is maintained together with the session cache.
 606    - When a session is resumed, the servername call back invoked in order
 607      to allow the application to position itself to the right context.
 608    - The servername is acknowledged if it is new for a session or when
 609      it is identical to a previously used for the same session.
 610      Applications can control the behaviour.  They can at any time
 611      set a 'desirable' servername for a new SSL object. This can be the
 612      case for example with HTTPS when a Host: header field is received and
 613      a renegotiation is requested. In this case, a possible servername
 614      presented in the new client hello is only acknowledged if it matches
 615      the value of the Host: field.
 616    - Applications must  use SSL_OP_NO_SESSION_RESUMPTION_ON_RENEGOTIATION
 617      if they provide for changing an explicit servername context for the session,
 618      i.e. when the session has been established with a servername extension.
 619    - On session reconnect, the servername extension may be absent.
 620
 621 */
 622
 623                 if (type == TLSEXT_TYPE_server_name)
 624                         {
 625                         unsigned char *sdata;
 626                         int servname_type;
 627                         int dsize;
 628
 629                         if (size < 2)
 630                                 {
 631                                 *al = SSL_AD_DECODE_ERROR;
 632                                 return 0;
 633                                 }
 634                         n2s(data,dsize);
 635                         size -= 2;
 636                         if (dsize > size  )
 637                                 {
 638                                 *al = SSL_AD_DECODE_ERROR;
 639                                 return 0;
 640                                 }
 641
 642                         sdata = data;
 643                         while (dsize > 3)
 644                                 {
 645                                 servname_type = *(sdata++);
 646                                 n2s(sdata,len);
 647                                 dsize -= 3;
 648
 649                                 if (len > dsize)
 650                                         {
 651                                         *al = SSL_AD_DECODE_ERROR;
 652                                         return 0;
 653                                         }
 654                                 if (s->servername_done == 0)
 655                                 switch (servname_type)
 656                                         {
 657                                 case TLSEXT_NAMETYPE_host_name:
 658                                         if (s->session->tlsext_hostname == NULL)
 659                                                 {
 660                                                 if (len > TLSEXT_MAXLEN_host_name ||
 661                                                         ((s->session->tlsext_hostname = OPENSSL_malloc(len+1)) == NULL))
 662                                                         {
 663                                                         *al = TLS1_AD_UNRECOGNIZED_NAME;
 664                                                         return 0;
 665                                                         }
 666                                                 memcpy(s->session->tlsext_hostname, sdata, len);
 667                                                 s->session->tlsext_hostname[len]='\0';
 668                                                 if (strlen(s->session->tlsext_hostname) != len) {
 669                                                         OPENSSL_free(s->session->tlsext_hostname);
 670                                                         s->session->tlsext_hostname = NULL;
 671                                                         *al = TLS1_AD_UNRECOGNIZED_NAME;
 672                                                         return 0;
 673                                                 }
 674                                                 s->servername_done = 1;
 675
 676                                                 }
 677                                         else
 678                                                 s->servername_done = strlen(s->session->tlsext_hostname) == len
 679                                                         && strncmp(s->session->tlsext_hostname, (char *)sdata, len) == 0;
 680
 681                                         break;
 682
 683                                 default:
 684                                         break;
 685                                         }
 686
 687                                 dsize -= len;
 688                                 }
 689                         if (dsize != 0)
 690                                 {
 691                                 *al = SSL_AD_DECODE_ERROR;
 692                                 return 0;
 693                                 }
 694
 695                         }
 696
 697 #ifndef OPENSSL_NO_EC
 698                 else if (type == TLSEXT_TYPE_ec_point_formats)
 699                         {
 700                         unsigned char *sdata = data;
 701                         int ecpointformatlist_length = *(sdata++);
 702
 703                         if (ecpointformatlist_length != size - 1)
 704                                 {
 705                                 *al = TLS1_AD_DECODE_ERROR;
 706                                 return 0;
 707                                 }
 708                         s->session->tlsext_ecpointformatlist_length = 0;
 709                         if (s->session->tlsext_ecpointformatlist != NULL) OPENSSL_free(s->session->tlsext_ecpointformatlist);
 710                         if ((s->session->tlsext_ecpointformatlist = OPENSSL_malloc(ecpointformatlist_length)) == NULL)
 711                                 {
 712                                 *al = TLS1_AD_INTERNAL_ERROR;
 713                                 return 0;
 714                                 }
 715                         s->session->tlsext_ecpointformatlist_length = ecpointformatlist_length;
 716                         memcpy(s->session->tlsext_ecpointformatlist, sdata, ecpointformatlist_length);
 717 #if 0
 718                         fprintf(stderr,"ssl_parse_clienthello_tlsext s->session->tlsext_ecpointformatlist (length=%i) ", s->session->tlsext_ecpointformatlist_length);
 719                         sdata = s->session->tlsext_ecpointformatlist;
 720                         for (i = 0; i < s->session->tlsext_ecpointformatlist_length; i++)
 721                                 fprintf(stderr,"%i ",*(sdata++));
 722                         fprintf(stderr,"\n");
 723 #endif
 724                         }
 725                 else if (type == TLSEXT_TYPE_elliptic_curves)
 726                         {
 727                         unsigned char *sdata = data;
 728                         int ellipticcurvelist_length = (*(sdata++) << 8);
 729                         ellipticcurvelist_length += (*(sdata++));
 730
 731                         if (ellipticcurvelist_length != size - 2)
 732                                 {
 733                                 *al = TLS1_AD_DECODE_ERROR;
 734                                 return 0;
 735                                 }
 736                         s->session->tlsext_ellipticcurvelist_length = 0;
 737                         if (s->session->tlsext_ellipticcurvelist != NULL) OPENSSL_free(s->session->tlsext_ellipticcurvelist);
 738                         if ((s->session->tlsext_ellipticcurvelist = OPENSSL_malloc(ellipticcurvelist_length)) == NULL)
 739                                 {
 740                                 *al = TLS1_AD_INTERNAL_ERROR;
 741                                 return 0;
 742                                 }
 743                         s->session->tlsext_ellipticcurvelist_length = ellipticcurvelist_length;
 744                         memcpy(s->session->tlsext_ellipticcurvelist, sdata, ellipticcurvelist_length);
 745 #if 0
 746                         fprintf(stderr,"ssl_parse_clienthello_tlsext s->session->tlsext_ellipticcurvelist (length=%i) ", s->session->tlsext_ellipticcurvelist_length);
 747                         sdata = s->session->tlsext_ellipticcurvelist;
 748                         for (i = 0; i < s->session->tlsext_ellipticcurvelist_length; i++)
 749                                 fprintf(stderr,"%i ",*(sdata++));
 750                         fprintf(stderr,"\n");
 751 #endif
 752                         }
 753 #endif /* OPENSSL_NO_EC */
 754 #ifdef TLSEXT_TYPE_opaque_prf_input
 755                 else if (type == TLSEXT_TYPE_opaque_prf_input)
 756                         {
 757                         unsigned char *sdata = data;
 758
 759                         if (size < 2)
 760                                 {
 761                                 *al = SSL_AD_DECODE_ERROR;
 762                                 return 0;
 763                                 }
 764                         n2s(sdata, s->s3->client_opaque_prf_input_len);
 765                         if (s->s3->client_opaque_prf_input_len != size - 2)
 766                                 {
 767                                 *al = SSL_AD_DECODE_ERROR;
 768                                 return 0;
 769                                 }
 770
 771                         if (s->s3->client_opaque_prf_input != NULL) /* shouldn't really happen */
 772                                 OPENSSL_free(s->s3->client_opaque_prf_input);
 773                         if (s->s3->client_opaque_prf_input_len == 0)
 774                                 s->s3->client_opaque_prf_input = OPENSSL_malloc(1); /* dummy byte just to get non-NULL */
 775                         else
 776                                 s->s3->client_opaque_prf_input = BUF_memdup(sdata, s->s3->client_opaque_prf_input_len);
 777                         if (s->s3->client_opaque_prf_input == NULL)
 778                                 {
 779                                 *al = TLS1_AD_INTERNAL_ERROR;
 780                                 return 0;
 781                                 }
 782                         }
 783 #endif
 784                 else if (type == TLSEXT_TYPE_session_ticket)
 785                         {
 786                         if (s->tls_session_ticket_ext_cb &&
 787                             !s->tls_session_ticket_ext_cb(s, data, size, s->tls_session_ticket_ext_cb_arg))
 788                                 {
 789                                 *al = TLS1_AD_INTERNAL_ERROR;
 790                                 return 0;
 791                                 }
 792                         }
 793                 else if (type == TLSEXT_TYPE_status_request
 794                                                 && s->ctx->tlsext_status_cb)
 795                         {
 796
 797                         if (size < 5)
 798                                 {
 799                                 *al = SSL_AD_DECODE_ERROR;
 800                                 return 0;
 801                                 }
 802
 803                         s->tlsext_status_type = *data++;
 804                         size--;
 805                         if (s->tlsext_status_type == TLSEXT_STATUSTYPE_ocsp)
 806                                 {
 807                                 const unsigned char *sdata;
 808                                 int dsize;
 809                                 /* Read in responder_id_list */
 810                                 n2s(data,dsize);
 811                                 size -= 2;
 812                                 if (dsize > size  )
 813                                         {
 814                                         *al = SSL_AD_DECODE_ERROR;
 815                                         return 0;
 816                                         }
 817                                 while (dsize > 0)
 818                                         {
 819                                         OCSP_RESPID *id;
 820                                         int idsize;
 821                                         if (dsize < 4)
 822                                                 {
 823                                                 *al = SSL_AD_DECODE_ERROR;
 824                                                 return 0;
 825                                                 }
 826                                         n2s(data, idsize);
 827                                         dsize -= 2 + idsize;
 828                                         if (dsize < 0)
 829                                                 {
 830                                                 *al = SSL_AD_DECODE_ERROR;
 831                                                 return 0;
 832                                                 }
 833                                         sdata = data;
 834                                         data += idsize;
 835                                         id = d2i_OCSP_RESPID(NULL,
 836                                                                 &sdata, idsize);
 837                                         if (!id)
 838                                                 {
 839                                                 *al = SSL_AD_DECODE_ERROR;
 840                                                 return 0;
 841                                                 }
 842                                         if (data != sdata)
 843                                                 {
 844                                                 OCSP_RESPID_free(id);
 845                                                 *al = SSL_AD_DECODE_ERROR;
 846                                                 return 0;
 847                                                 }
 848                                         if (!s->tlsext_ocsp_ids
 849                                                 && !(s->tlsext_ocsp_ids =
 850                                                 sk_OCSP_RESPID_new_null()))
 851                                                 {
 852                                                 OCSP_RESPID_free(id);
 853                                                 *al = SSL_AD_INTERNAL_ERROR;
 854                                                 return 0;
 855                                                 }
 856                                         if (!sk_OCSP_RESPID_push(
 857                                                         s->tlsext_ocsp_ids, id))
 858                                                 {
 859                                                 OCSP_RESPID_free(id);
 860                                                 *al = SSL_AD_INTERNAL_ERROR;
 861                                                 return 0;
 862                                                 }
 863                                         }
 864
 865                                 /* Read in request_extensions */
 866                                 n2s(data,dsize);
 867                                 size -= 2;
 868                                 if (dsize > size)
 869                                         {
 870                                         *al = SSL_AD_DECODE_ERROR;
 871                                         return 0;
 872                                         }
 873                                 sdata = data;
 874                                 if (dsize > 0)
 875                                         {
 876                                         s->tlsext_ocsp_exts =
 877                                                 d2i_X509_EXTENSIONS(NULL,
 878                                                         &sdata, dsize);
 879                                         if (!s->tlsext_ocsp_exts
 880                                                 || (data + dsize != sdata))
 881                                                 {
 882                                                 *al = SSL_AD_DECODE_ERROR;
 883                                                 return 0;
 884                                                 }
 885                                         }
 886                                 }
 887                                 /* We don't know what to do with any other type
 888                                 * so ignore it.
 889                                 */
 890                                 else
 891                                         s->tlsext_status_type = -1;
 892                         }
 893
 894                 /* session ticket processed earlier */
 895                 data+=size;
 896                 }
 897
 898         *p = data;
 899         return 1;
 900         }
 901
 902 int ssl_parse_serverhello_tlsext(SSL *s, unsigned char **p, unsigned char *d, int n, int *al)
 903         {
 904         unsigned short type;
 905         unsigned short size;
 906         unsigned short len;
 907         unsigned char *data = *p;
 908
 909         int tlsext_servername = 0;
 910
 911         if (data >= (d+n-2))
 912                 return 1;
 913
 914         n2s(data,len);
 915
 916         while(data <= (d+n-4))
 917                 {
 918                 n2s(data,type);
 919                 n2s(data,size);
 920
 921                 if (data+size > (d+n))
 922                         return 1;
 923
 924                 if (s->tlsext_debug_cb)
 925                         s->tlsext_debug_cb(s, 1, type, data, size,
 926                                                 s->tlsext_debug_arg);
 927
 928                 if (type == TLSEXT_TYPE_server_name)
 929                         {
 930                         if (s->tlsext_hostname == NULL || size > 0)
 931                                 {
 932                                 *al = TLS1_AD_UNRECOGNIZED_NAME;
 933                                 return 0;
 934                                 }
 935                         tlsext_servername = 1;
 936                         }
 937
 938 #ifndef OPENSSL_NO_EC
 939                 else if (type == TLSEXT_TYPE_ec_point_formats)
 940                         {
 941                         unsigned char *sdata = data;
 942                         int ecpointformatlist_length = *(sdata++);
 943
 944                         if (ecpointformatlist_length != size - 1)
 945                                 {
 946                                 *al = TLS1_AD_DECODE_ERROR;
 947                                 return 0;
 948                                 }
 949                         s->session->tlsext_ecpointformatlist_length = 0;
 950                         if (s->session->tlsext_ecpointformatlist != NULL) OPENSSL_free(s->session->tlsext_ecpointformatlist);
 951                         if ((s->session->tlsext_ecpointformatlist = OPENSSL_malloc(ecpointformatlist_length)) == NULL)
 952                                 {
 953                                 *al = TLS1_AD_INTERNAL_ERROR;
 954                                 return 0;
 955                                 }
 956                         s->session->tlsext_ecpointformatlist_length = ecpointformatlist_length;
 957                         memcpy(s->session->tlsext_ecpointformatlist, sdata, ecpointformatlist_length);
 958 #if 0
 959                         fprintf(stderr,"ssl_parse_serverhello_tlsext s->session->tlsext_ecpointformatlist ");
 960                         sdata = s->session->tlsext_ecpointformatlist;
 961                         for (i = 0; i < s->session->tlsext_ecpointformatlist_length; i++)
 962                                 fprintf(stderr,"%i ",*(sdata++));
 963                         fprintf(stderr,"\n");
 964 #endif
 965                         }
 966 #endif /* OPENSSL_NO_EC */
 967
 968                 else if (type == TLSEXT_TYPE_session_ticket)
 969                         {
 970                         if (s->tls_session_ticket_ext_cb &&
 971                             !s->tls_session_ticket_ext_cb(s, data, size, s->tls_session_ticket_ext_cb_arg))
 972                                 {
 973                                 *al = TLS1_AD_INTERNAL_ERROR;
 974                                 return 0;
 975                                 }
 976                         if ((SSL_get_options(s) & SSL_OP_NO_TICKET)
 977                                 || (size > 0))
 978                                 {
 979                                 *al = TLS1_AD_UNSUPPORTED_EXTENSION;
 980                                 return 0;
 981                                 }
 982                         s->tlsext_ticket_expected = 1;
 983                         }
 984 #ifdef TLSEXT_TYPE_opaque_prf_input
 985                 else if (type == TLSEXT_TYPE_opaque_prf_input)
 986                         {
 987                         unsigned char *sdata = data;
 988
 989                         if (size < 2)
 990                                 {
 991                                 *al = SSL_AD_DECODE_ERROR;
 992                                 return 0;
 993                                 }
 994                         n2s(sdata, s->s3->server_opaque_prf_input_len);
 995                         if (s->s3->server_opaque_prf_input_len != size - 2)
 996                                 {
 997                                 *al = SSL_AD_DECODE_ERROR;
 998                                 return 0;
 999                                 }
1000
1001                         if (s->s3->server_opaque_prf_input != NULL) /* shouldn't really happen */
1002                                 OPENSSL_free(s->s3->server_opaque_prf_input);
1003                         if (s->s3->server_opaque_prf_input_len == 0)
1004                                 s->s3->server_opaque_prf_input = OPENSSL_malloc(1); /* dummy byte just to get non-NULL */
1005                         else
1006                                 s->s3->server_opaque_prf_input = BUF_memdup(sdata, s->s3->server_opaque_prf_input_len);
1007
1008                         if (s->s3->server_opaque_prf_input == NULL)
1009                                 {
1010                                 *al = TLS1_AD_INTERNAL_ERROR;
1011                                 return 0;
1012                                 }
1013                         }
1014 #endif
1015                 else if (type == TLSEXT_TYPE_status_request)
1016                         {
1017                         /* MUST be empty and only sent if we've requested
1018                          * a status request message.
1019                          */
1020                         if ((s->tlsext_status_type == -1) || (size > 0))
1021                                 {
1022                                 *al = TLS1_AD_UNSUPPORTED_EXTENSION;
1023                                 return 0;
1024                                 }
1025                         /* Set flag to expect CertificateStatus message */
1026                         s->tlsext_status_expected = 1;
1027                         }
1028
1029                 data+=size;
1030                 }
1031
1032         if (data != d+n)
1033                 {
1034                 *al = SSL_AD_DECODE_ERROR;
1035                 return 0;
1036                 }
1037
1038         if (!s->hit && tlsext_servername == 1)
1039                 {
1040                 if (s->tlsext_hostname)
1041                         {
1042                         if (s->session->tlsext_hostname == NULL)
1043                                 {
1044                                 s->session->tlsext_hostname = BUF_strdup(s->tlsext_hostname);
1045                                 if (!s->session->tlsext_hostname)
1046                                         {
1047                                         *al = SSL_AD_UNRECOGNIZED_NAME;
1048                                         return 0;
1049                                         }
1050                                 }
1051                         else
1052                                 {
1053                                 *al = SSL_AD_DECODE_ERROR;
1054                                 return 0;
1055                                 }
1056                         }
1057                 }
1058
1059         *p = data;
1060         return 1;
1061         }
1062
1063
1064 int ssl_prepare_clienthello_tlsext(SSL *s)
1065         {
1066 #ifndef OPENSSL_NO_EC
1067         /* If we are client and using an elliptic curve cryptography cipher suite, send the point formats
1068          * and elliptic curves we support.
1069          */
1070         int using_ecc = 0;
1071         int i;
1072         unsigned char *j;
1073         unsigned long alg_k, alg_a;
1074         STACK_OF(SSL_CIPHER) *cipher_stack = SSL_get_ciphers(s);
1075
1076         for (i = 0; i < sk_SSL_CIPHER_num(cipher_stack); i++)
1077                 {
1078                 SSL_CIPHER *c = sk_SSL_CIPHER_value(cipher_stack, i);
1079
1080                 alg_k = c->algorithm_mkey;
1081                 alg_a = c->algorithm_auth;
1082                 if ((alg_k & (SSL_kEECDH|SSL_kECDHr|SSL_kECDHe) || (alg_a & SSL_aECDSA)))
1083                         {
1084                         using_ecc = 1;
1085                         break;
1086                         }
1087                 }
1088         using_ecc = using_ecc && (s->version == TLS1_VERSION);
1089         if (using_ecc)
1090                 {
1091                 if (s->tlsext_ecpointformatlist != NULL) OPENSSL_free(s->tlsext_ecpointformatlist);
1092                 if ((s->tlsext_ecpointformatlist = OPENSSL_malloc(3)) == NULL)
1093                         {
1094                         SSLerr(SSL_F_SSL_PREPARE_CLIENTHELLO_TLSEXT,ERR_R_MALLOC_FAILURE);
1095                         return -1;
1096                         }
1097                 s->tlsext_ecpointformatlist_length = 3;
1098                 s->tlsext_ecpointformatlist[0] = TLSEXT_ECPOINTFORMAT_uncompressed;
1099                 s->tlsext_ecpointformatlist[1] = TLSEXT_ECPOINTFORMAT_ansiX962_compressed_prime;
1100                 s->tlsext_ecpointformatlist[2] = TLSEXT_ECPOINTFORMAT_ansiX962_compressed_char2;
1101
1102                 /* we support all named elliptic curves in draft-ietf-tls-ecc-12 */
1103                 if (s->tlsext_ellipticcurvelist != NULL) OPENSSL_free(s->tlsext_ellipticcurvelist);
1104                 s->tlsext_ellipticcurvelist_length = sizeof(nid_list)/sizeof(nid_list[0]) * 2;
1105                 if ((s->tlsext_ellipticcurvelist = OPENSSL_malloc(s->tlsext_ellipticcurvelist_length)) == NULL)
1106                         {
1107                         s->tlsext_ellipticcurvelist_length = 0;
1108                         SSLerr(SSL_F_SSL_PREPARE_CLIENTHELLO_TLSEXT,ERR_R_MALLOC_FAILURE);
1109                         return -1;
1110                         }
1111                 for (i = 1, j = s->tlsext_ellipticcurvelist; (unsigned int)i <=
1112                                 sizeof(nid_list)/sizeof(nid_list[0]); i++)
1113                         s2n(i,j);
1114                 }
1115 #endif /* OPENSSL_NO_EC */
1116
1117 #ifdef TLSEXT_TYPE_opaque_prf_input
1118         {
1119                 int r = 1;
1120
1121                 if (s->ctx->tlsext_opaque_prf_input_callback != 0)
1122                         {
1123                         r = s->ctx->tlsext_opaque_prf_input_callback(s, NULL, 0, s->ctx->tlsext_opaque_prf_input_callback_arg);
1124                         if (!r)
1125                                 return -1;
1126                         }
1127
1128                 if (s->tlsext_opaque_prf_input != NULL)
1129                         {
1130                         if (s->s3->client_opaque_prf_input != NULL) /* shouldn't really happen */
1131                                 OPENSSL_free(s->s3->client_opaque_prf_input);
1132
1133                         if (s->tlsext_opaque_prf_input_len == 0)
1134                                 s->s3->client_opaque_prf_input = OPENSSL_malloc(1); /* dummy byte just to get non-NULL */
1135                         else
1136                                 s->s3->client_opaque_prf_input = BUF_memdup(s->tlsext_opaque_prf_input, s->tlsext_opaque_prf_input_len);
1137                         if (s->s3->client_opaque_prf_input == NULL)
1138                                 {
1139                                 SSLerr(SSL_F_SSL_PREPARE_CLIENTHELLO_TLSEXT,ERR_R_MALLOC_FAILURE);
1140                                 return -1;
1141                                 }
1142                         s->s3->client_opaque_prf_input_len = s->tlsext_opaque_prf_input_len;
1143                         }
1144
1145                 if (r == 2)
1146                         /* at callback's request, insist on receiving an appropriate server opaque PRF input */
1147                         s->s3->server_opaque_prf_input_len = s->tlsext_opaque_prf_input_len;
1148         }
1149 #endif
1150
1151         return 1;
1152         }
1153
1154 int ssl_prepare_serverhello_tlsext(SSL *s)
1155         {
1156 #ifndef OPENSSL_NO_EC
1157         /* If we are server and using an ECC cipher suite, send the point formats we support
1158          * if the client sent us an ECPointsFormat extension.  Note that the server is not
1159          * supposed to send an EllipticCurves extension.
1160          */
1161
1162         unsigned long alg_k = s->s3->tmp.new_cipher->algorithm_mkey;
1163         unsigned long alg_a = s->s3->tmp.new_cipher->algorithm_auth;
1164         int using_ecc = (alg_k & (SSL_kEECDH|SSL_kECDHr|SSL_kECDHe)) || (alg_a & SSL_aECDSA);
1165         using_ecc = using_ecc && (s->session->tlsext_ecpointformatlist != NULL);
1166
1167         if (using_ecc)
1168                 {
1169                 if (s->tlsext_ecpointformatlist != NULL) OPENSSL_free(s->tlsext_ecpointformatlist);
1170                 if ((s->tlsext_ecpointformatlist = OPENSSL_malloc(3)) == NULL)
1171                         {
1172                         SSLerr(SSL_F_SSL_PREPARE_SERVERHELLO_TLSEXT,ERR_R_MALLOC_FAILURE);
1173                         return -1;
1174                         }
1175                 s->tlsext_ecpointformatlist_length = 3;
1176                 s->tlsext_ecpointformatlist[0] = TLSEXT_ECPOINTFORMAT_uncompressed;
1177                 s->tlsext_ecpointformatlist[1] = TLSEXT_ECPOINTFORMAT_ansiX962_compressed_prime;
1178                 s->tlsext_ecpointformatlist[2] = TLSEXT_ECPOINTFORMAT_ansiX962_compressed_char2;
1179                 }
1180 #endif /* OPENSSL_NO_EC */
1181
1182         return 1;
1183         }
1184
1185 int ssl_check_clienthello_tlsext(SSL *s)
1186         {
1187         int ret=SSL_TLSEXT_ERR_NOACK;
1188         int al = SSL_AD_UNRECOGNIZED_NAME;
1189
1190 #ifndef OPENSSL_NO_EC
1191         /* The handling of the ECPointFormats extension is done elsewhere, namely in
1192          * ssl3_choose_cipher in s3_lib.c.
1193          */
1194         /* The handling of the EllipticCurves extension is done elsewhere, namely in
1195          * ssl3_choose_cipher in s3_lib.c.
1196          */
1197 #endif
1198
1199         if (s->ctx != NULL && s->ctx->tlsext_servername_callback != 0)
1200                 ret = s->ctx->tlsext_servername_callback(s, &al, s->ctx->tlsext_servername_arg);
1201         else if (s->initial_ctx != NULL && s->initial_ctx->tlsext_servername_callback != 0)
1202                 ret = s->initial_ctx->tlsext_servername_callback(s, &al, s->initial_ctx->tlsext_servername_arg);
1203
1204         /* If status request then ask callback what to do.
1205          * Note: this must be called after servername callbacks in case
1206          * the certificate has changed.
1207          */
1208         if ((s->tlsext_status_type != -1) && s->ctx && s->ctx->tlsext_status_cb)
1209                 {
1210                 int r;
1211                 r = s->ctx->tlsext_status_cb(s, s->ctx->tlsext_status_arg);
1212                 switch (r)
1213                         {
1214                         /* We don't want to send a status request response */
1215                         case SSL_TLSEXT_ERR_NOACK:
1216                                 s->tlsext_status_expected = 0;
1217                                 break;
1218                         /* status request response should be sent */
1219                         case SSL_TLSEXT_ERR_OK:
1220                                 if (s->tlsext_ocsp_resp)
1221                                         s->tlsext_status_expected = 1;
1222                                 else
1223                                         s->tlsext_status_expected = 0;
1224                                 break;
1225                         /* something bad happened */
1226                         case SSL_TLSEXT_ERR_ALERT_FATAL:
1227                                 ret = SSL_TLSEXT_ERR_ALERT_FATAL;
1228                                 al = SSL_AD_INTERNAL_ERROR;
1229                                 goto err;
1230                         }
1231                 }
1232         else
1233                 s->tlsext_status_expected = 0;
1234
1235 #ifdef TLSEXT_TYPE_opaque_prf_input
1236         {
1237                 /* This sort of belongs into ssl_prepare_serverhello_tlsext(),
1238                  * but we might be sending an alert in response to the client hello,
1239                  * so this has to happen here in ssl_check_clienthello_tlsext(). */
1240
1241                 int r = 1;
1242
1243                 if (s->ctx->tlsext_opaque_prf_input_callback != 0)
1244                         {
1245                         r = s->ctx->tlsext_opaque_prf_input_callback(s, NULL, 0, s->ctx->tlsext_opaque_prf_input_callback_arg);
1246                         if (!r)
1247                                 {
1248                                 ret = SSL_TLSEXT_ERR_ALERT_FATAL;
1249                                 al = SSL_AD_INTERNAL_ERROR;
1250                                 goto err;
1251                                 }
1252                         }
1253
1254                 if (s->s3->server_opaque_prf_input != NULL) /* shouldn't really happen */
1255                         OPENSSL_free(s->s3->server_opaque_prf_input);
1256                 s->s3->server_opaque_prf_input = NULL;
1257
1258                 if (s->tlsext_opaque_prf_input != NULL)
1259                         {
1260                         if (s->s3->client_opaque_prf_input != NULL &&
1261                                 s->s3->client_opaque_prf_input_len == s->tlsext_opaque_prf_input_len)
1262                                 {
1263                                 /* can only use this extension if we have a server opaque PRF input
1264                                  * of the same length as the client opaque PRF input! */
1265
1266                                 if (s->tlsext_opaque_prf_input_len == 0)
1267                                         s->s3->server_opaque_prf_input = OPENSSL_malloc(1); /* dummy byte just to get non-NULL */
1268                                 else
1269                                         s->s3->server_opaque_prf_input = BUF_memdup(s->tlsext_opaque_prf_input, s->tlsext_opaque_prf_input_len);
1270                                 if (s->s3->server_opaque_prf_input == NULL)
1271                                         {
1272                                         ret = SSL_TLSEXT_ERR_ALERT_FATAL;
1273                                         al = SSL_AD_INTERNAL_ERROR;
1274                                         goto err;
1275                                         }
1276                                 s->s3->server_opaque_prf_input_len = s->tlsext_opaque_prf_input_len;
1277                                 }
1278                         }
1279
1280                 if (r == 2 && s->s3->server_opaque_prf_input == NULL)
1281                         {
1282                         /* The callback wants to enforce use of the extension,
1283                          * but we can't do that with the client opaque PRF input;
1284                          * abort the handshake.
1285                          */
1286                         ret = SSL_TLSEXT_ERR_ALERT_FATAL;
1287                         al = SSL_AD_HANDSHAKE_FAILURE;
1288                         }
1289         }
1290
1291 #endif
1292  err:
1293         switch (ret)
1294                 {
1295                 case SSL_TLSEXT_ERR_ALERT_FATAL:
1296                         ssl3_send_alert(s,SSL3_AL_FATAL,al);
1297                         return -1;
1298
1299                 case SSL_TLSEXT_ERR_ALERT_WARNING:
1300                         ssl3_send_alert(s,SSL3_AL_WARNING,al);
1301                         return 1;
1302
1303                 case SSL_TLSEXT_ERR_NOACK:
1304                         s->servername_done=0;
1305                         default:
1306                 return 1;
1307                 }
1308         }
1309
1310 int ssl_check_serverhello_tlsext(SSL *s)
1311         {
1312         int ret=SSL_TLSEXT_ERR_NOACK;
1313         int al = SSL_AD_UNRECOGNIZED_NAME;
1314
1315 #ifndef OPENSSL_NO_EC
1316         /* If we are client and using an elliptic curve cryptography cipher suite, then server
1317          * must return a an EC point formats lists containing uncompressed.
1318          */
1319         unsigned long alg_k = s->s3->tmp.new_cipher->algorithm_mkey;
1320         unsigned long alg_a = s->s3->tmp.new_cipher->algorithm_auth;
1321         if ((s->tlsext_ecpointformatlist != NULL) && (s->tlsext_ecpointformatlist_length > 0) &&
1322             ((alg_k & (SSL_kEECDH|SSL_kECDHr|SSL_kECDHe)) || (alg_a & SSL_aECDSA)))
1323                 {
1324                 /* we are using an ECC cipher */
1325                 size_t i;
1326                 unsigned char *list;
1327                 int found_uncompressed = 0;
1328                 if ((s->session->tlsext_ecpointformatlist == NULL) || (s->session->tlsext_ecpointformatlist_length == 0))
1329                         {
1330                         SSLerr(SSL_F_SSL_CHECK_SERVERHELLO_TLSEXT,SSL_R_TLS_INVALID_ECPOINTFORMAT_LIST);
1331                         return -1;
1332                         }
1333                 list = s->session->tlsext_ecpointformatlist;
1334                 for (i = 0; i < s->session->tlsext_ecpointformatlist_length; i++)
1335                         {
1336                         if (*(list++) == TLSEXT_ECPOINTFORMAT_uncompressed)
1337                                 {
1338                                 found_uncompressed = 1;
1339                                 break;
1340                                 }
1341                         }
1342                 if (!found_uncompressed)
1343                         {
1344                         SSLerr(SSL_F_SSL_CHECK_SERVERHELLO_TLSEXT,SSL_R_TLS_INVALID_ECPOINTFORMAT_LIST);
1345                         return -1;
1346                         }
1347                 }
1348         ret = SSL_TLSEXT_ERR_OK;
1349 #endif /* OPENSSL_NO_EC */
1350
1351         if (s->ctx != NULL && s->ctx->tlsext_servername_callback != 0)
1352                 ret = s->ctx->tlsext_servername_callback(s, &al, s->ctx->tlsext_servername_arg);
1353         else if (s->initial_ctx != NULL && s->initial_ctx->tlsext_servername_callback != 0)
1354                 ret = s->initial_ctx->tlsext_servername_callback(s, &al, s->initial_ctx->tlsext_servername_arg);
1355
1356 #ifdef TLSEXT_TYPE_opaque_prf_input
1357         if (s->s3->server_opaque_prf_input_len > 0)
1358                 {
1359                 /* This case may indicate that we, as a client, want to insist on using opaque PRF inputs.
1360                  * So first verify that we really have a value from the server too. */
1361
1362                 if (s->s3->server_opaque_prf_input == NULL)
1363                         {
1364                         ret = SSL_TLSEXT_ERR_ALERT_FATAL;
1365                         al = SSL_AD_HANDSHAKE_FAILURE;
1366                         }
1367
1368                 /* Anytime the server *has* sent an opaque PRF input, we need to check
1369                  * that we have a client opaque PRF input of the same size. */
1370                 if (s->s3->client_opaque_prf_input == NULL ||
1371                     s->s3->client_opaque_prf_input_len != s->s3->server_opaque_prf_input_len)
1372                         {
1373                         ret = SSL_TLSEXT_ERR_ALERT_FATAL;
1374                         al = SSL_AD_ILLEGAL_PARAMETER;
1375                         }
1376                 }
1377 #endif
1378
1379         /* If we've requested certificate status and we wont get one
1380          * tell the callback
1381          */
1382         if ((s->tlsext_status_type != -1) && !(s->tlsext_status_expected)
1383                         && s->ctx && s->ctx->tlsext_status_cb)
1384                 {
1385                 int r;
1386                 /* Set resp to NULL, resplen to -1 so callback knows
1387                  * there is no response.
1388                  */
1389                 if (s->tlsext_ocsp_resp)
1390                         {
1391                         OPENSSL_free(s->tlsext_ocsp_resp);
1392                         s->tlsext_ocsp_resp = NULL;
1393                         }
1394                 s->tlsext_ocsp_resplen = -1;
1395                 r = s->ctx->tlsext_status_cb(s, s->ctx->tlsext_status_arg);
1396                 if (r == 0)
1397                         {
1398                         al = SSL_AD_BAD_CERTIFICATE_STATUS_RESPONSE;
1399                         ret = SSL_TLSEXT_ERR_ALERT_FATAL;
1400                         }
1401                 if (r < 0)
1402                         {
1403                         al = SSL_AD_INTERNAL_ERROR;
1404                         ret = SSL_TLSEXT_ERR_ALERT_FATAL;
1405                         }
1406                 }
1407
1408         switch (ret)
1409                 {
1410                 case SSL_TLSEXT_ERR_ALERT_FATAL:
1411                         ssl3_send_alert(s,SSL3_AL_FATAL,al);
1412                         return -1;
1413
1414                 case SSL_TLSEXT_ERR_ALERT_WARNING:
1415                         ssl3_send_alert(s,SSL3_AL_WARNING,al);
1416                         return 1;
1417
1418                 case SSL_TLSEXT_ERR_NOACK:
1419                         s->servername_done=0;
1420                         default:
1421                 return 1;
1422                 }
1423         }
1424
1425 /* Since the server cache lookup is done early on in the processing of client
1426  * hello and other operations depend on the result we need to handle any TLS
1427  * session ticket extension at the same time.
1428  */
1429
1430 int tls1_process_ticket(SSL *s, unsigned char *session_id, int len,
1431                                 const unsigned char *limit, SSL_SESSION **ret)
1432         {
1433         /* Point after session ID in client hello */
1434         const unsigned char *p = session_id + len;
1435         unsigned short i;
1436
1437         /* If tickets disabled behave as if no ticket present
1438          * to permit stateful resumption.
1439          */
1440         if (SSL_get_options(s) & SSL_OP_NO_TICKET)
1441                 return 1;
1442
1443         if ((s->version <= SSL3_VERSION) || !limit)
1444                 return 1;
1445         if (p >= limit)
1446                 return -1;
1447         /* Skip past cipher list */
1448         n2s(p, i);
1449         p+= i;
1450         if (p >= limit)
1451                 return -1;
1452         /* Skip past compression algorithm list */
1453         i = *(p++);
1454         p += i;
1455         if (p > limit)
1456                 return -1;
1457         /* Now at start of extensions */
1458         if ((p + 2) >= limit)
1459                 return 1;
1460         n2s(p, i);
1461         while ((p + 4) <= limit)
1462                 {
1463                 unsigned short type, size;
1464                 n2s(p, type);
1465                 n2s(p, size);
1466                 if (p + size > limit)
1467                         return 1;
1468                 if (type == TLSEXT_TYPE_session_ticket)
1469                         {
1470                         /* If tickets disabled indicate cache miss which will
1471                          * trigger a full handshake
1472                          */
1473                         if (SSL_get_options(s) & SSL_OP_NO_TICKET)
1474                                 return 1;
1475                         /* If zero length note client will accept a ticket
1476                          * and indicate cache miss to trigger full handshake
1477                          */
1478                         if (size == 0)
1479                                 {
1480                                 s->tlsext_ticket_expected = 1;
1481                                 return 0;       /* Cache miss */
1482                                 }
1483                         if (s->tls_session_secret_cb)
1484                                 {
1485                                 /* Indicate cache miss here and instead of
1486                                  * generating the session from ticket now,
1487                                  * trigger abbreviated handshake based on
1488                                  * external mechanism to calculate the master
1489                                  * secret later. */
1490                                 return 0;
1491                                 }
1492                         return tls_decrypt_ticket(s, p, size, session_id, len,
1493                                                                         ret);
1494                         }
1495                 p += size;
1496                 }
1497         return 1;
1498         }
1499
1500 static int tls_decrypt_ticket(SSL *s, const unsigned char *etick, int eticklen,
1501                                 const unsigned char *sess_id, int sesslen,
1502                                 SSL_SESSION **psess)
1503         {
1504         SSL_SESSION *sess;
1505         unsigned char *sdec;
1506         const unsigned char *p;
1507         int slen, mlen, renew_ticket = 0;
1508         unsigned char tick_hmac[EVP_MAX_MD_SIZE];
1509         HMAC_CTX hctx;
1510         EVP_CIPHER_CTX ctx;
1511         /* Need at least keyname + iv + some encrypted data */
1512         if (eticklen < 48)
1513                 goto tickerr;
1514         /* Initialize session ticket encryption and HMAC contexts */
1515         HMAC_CTX_init(&hctx);
1516         EVP_CIPHER_CTX_init(&ctx);
1517         if (s->ctx->tlsext_ticket_key_cb)
1518                 {
1519                 unsigned char *nctick = (unsigned char *)etick;
1520                 int rv = s->ctx->tlsext_ticket_key_cb(s, nctick, nctick + 16,
1521                                                         &ctx, &hctx, 0);
1522                 if (rv < 0)
1523                         return -1;
1524                 if (rv == 0)
1525                         goto tickerr;
1526                 if (rv == 2)
1527                         renew_ticket = 1;
1528                 }
1529         else
1530                 {
1531                 /* Check key name matches */
1532                 if (memcmp(etick, s->ctx->tlsext_tick_key_name, 16))
1533                         goto tickerr;
1534                 HMAC_Init_ex(&hctx, s->ctx->tlsext_tick_hmac_key, 16,
1535                                         tlsext_tick_md(), NULL);
1536                 EVP_DecryptInit_ex(&ctx, EVP_aes_128_cbc(), NULL,
1537                                 s->ctx->tlsext_tick_aes_key, etick + 16);
1538                 }
1539         /* Attempt to process session ticket, first conduct sanity and
1540          * integrity checks on ticket.
1541          */
1542         mlen = HMAC_size(&hctx);
1543         if (mlen < 0)
1544                 {
1545                 EVP_CIPHER_CTX_cleanup(&ctx);
1546                 return -1;
1547                 }
1548         eticklen -= mlen;
1549         /* Check HMAC of encrypted ticket */
1550         HMAC_Update(&hctx, etick, eticklen);
1551         HMAC_Final(&hctx, tick_hmac, NULL);
1552         HMAC_CTX_cleanup(&hctx);
1553         if (memcmp(tick_hmac, etick + eticklen, mlen))
1554                 goto tickerr;
1555         /* Attempt to decrypt session data */
1556         /* Move p after IV to start of encrypted ticket, update length */
1557         p = etick + 16 + EVP_CIPHER_CTX_iv_length(&ctx);
1558         eticklen -= 16 + EVP_CIPHER_CTX_iv_length(&ctx);
1559         sdec = OPENSSL_malloc(eticklen);
1560         if (!sdec)
1561                 {
1562                 EVP_CIPHER_CTX_cleanup(&ctx);
1563                 return -1;
1564                 }
1565         EVP_DecryptUpdate(&ctx, sdec, &slen, p, eticklen);
1566         if (EVP_DecryptFinal(&ctx, sdec + slen, &mlen) <= 0)
1567                 goto tickerr;
1568         slen += mlen;
1569         EVP_CIPHER_CTX_cleanup(&ctx);
1570         p = sdec;
1571
1572         sess = d2i_SSL_SESSION(NULL, &p, slen);
1573         OPENSSL_free(sdec);
1574         if (sess)
1575                 {
1576                 /* The session ID if non-empty is used by some clients to
1577                  * detect that the ticket has been accepted. So we copy it to
1578                  * the session structure. If it is empty set length to zero
1579                  * as required by standard.
1580                  */
1581                 if (sesslen)
1582                         memcpy(sess->session_id, sess_id, sesslen);
1583                 sess->session_id_length = sesslen;
1584                 *psess = sess;
1585                 s->tlsext_ticket_expected = renew_ticket;
1586                 return 1;
1587                 }
1588         /* If session decrypt failure indicate a cache miss and set state to
1589          * send a new ticket
1590          */
1591         tickerr:
1592         s->tlsext_ticket_expected = 1;
1593         return 0;
1594         }
1595
1596 #endif